From f54b116972bb4c730b9ba98e570f3d64d90a8a0a Mon Sep 17 00:00:00 2001 From: vi Date: Tue, 5 May 2026 23:20:48 +0100 Subject: [PATCH] init agenix --- flake.lock | 104 +++++++++++++++++++++++++++-- flake.nix | 2 + hosts/common/default.nix | 4 +- hosts/common/users.nix | 9 ++- hosts/ivy/default.nix | 4 ++ hosts/ivy/services/at/tranquil.nix | 2 +- hosts/ivy/services/immich.nix | 2 +- hosts/ivy/services/vaultwarden.nix | 2 +- secrets/apr-password.age | Bin 0 -> 539 bytes secrets/ivy/immich.age | 9 +++ secrets/ivy/tranquil.age | Bin 0 -> 823 bytes secrets/ivy/vaultwarden.age | 11 +++ secrets/root-password.age | Bin 0 -> 539 bytes secrets/secrets.nix | 18 +++++ 14 files changed, 156 insertions(+), 11 deletions(-) create mode 100644 secrets/apr-password.age create mode 100644 secrets/ivy/immich.age create mode 100644 secrets/ivy/tranquil.age create mode 100644 secrets/ivy/vaultwarden.age create mode 100644 secrets/root-password.age create mode 100644 secrets/secrets.nix diff --git a/flake.lock b/flake.lock index 4b4e208..88e3c0e 100644 --- a/flake.lock +++ b/flake.lock @@ -1,5 +1,48 @@ { "nodes": { + "agenix": { + "inputs": { + "darwin": "darwin", + "home-manager": "home-manager", + "nixpkgs": "nixpkgs", + "systems": "systems" + }, + "locked": { + "lastModified": 1770165109, + "narHash": "sha256-9VnK6Oqai65puVJ4WYtCTvlJeXxMzAp/69HhQuTdl/I=", + "owner": "ryantm", + "repo": "agenix", + "rev": "b027ee29d959fda4b60b57566d64c98a202e0feb", + "type": "github" + }, + "original": { + "owner": "ryantm", + "repo": "agenix", + "type": "github" + } + }, + "darwin": { + "inputs": { + "nixpkgs": [ + "agenix", + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1744478979, + "narHash": "sha256-dyN+teG9G82G+m+PX/aSAagkC+vUv0SgUw3XkPhQodQ=", + "owner": "lnl7", + "repo": "nix-darwin", + "rev": "43975d782b418ebf4969e9ccba82466728c2851b", + "type": "github" + }, + "original": { + "owner": "lnl7", + "ref": "master", + "repo": "nix-darwin", + "type": "github" + } + }, "fenix": { "inputs": { "nixpkgs": [ @@ -39,6 +82,27 @@ } }, "home-manager": { + "inputs": { + "nixpkgs": [ + "agenix", + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1745494811, + "narHash": "sha256-YZCh2o9Ua1n9uCvrvi5pRxtuVNml8X2a03qIFfRKpFs=", + "owner": "nix-community", + "repo": "home-manager", + "rev": "abfad3d2958c9e6300a883bd443512c55dfeb1be", + "type": "github" + }, + "original": { + "owner": "nix-community", + "repo": "home-manager", + "type": "github" + } + }, + "home-manager_2": { "inputs": { "nixpkgs": [ "nixpkgs" @@ -135,6 +199,22 @@ } }, "nixpkgs": { + "locked": { + "lastModified": 1754028485, + "narHash": "sha256-IiiXB3BDTi6UqzAZcf2S797hWEPCRZOwyNThJIYhUfk=", + "owner": "NixOS", + "repo": "nixpkgs", + "rev": "59e69648d345d6e8fef86158c555730fa12af9de", + "type": "github" + }, + "original": { + "owner": "NixOS", + "ref": "nixos-25.05", + "repo": "nixpkgs", + "type": "github" + } + }, + "nixpkgs_2": { "locked": { "lastModified": 1777578337, "narHash": "sha256-Ad49moKWeXtKBJNy2ebiTQUEgdLyvGmTeykAQ9xM+Z4=", @@ -150,7 +230,7 @@ "type": "github" } }, - "nixpkgs_2": { + "nixpkgs_3": { "locked": { "lastModified": 1775888245, "narHash": "sha256-nwASzrRDD1JBEu/o8ekKYEXm/oJW6EMCzCRdrwcLe90=", @@ -168,10 +248,11 @@ }, "root": { "inputs": { - "home-manager": "home-manager", + "agenix": "agenix", + "home-manager": "home-manager_2", "ironbar": "ironbar", "nixos-hardware": "nixos-hardware", - "nixpkgs": "nixpkgs", + "nixpkgs": "nixpkgs_2", "tranquil": "tranquil" } }, @@ -192,9 +273,24 @@ "type": "github" } }, + "systems": { + "locked": { + "lastModified": 1681028828, + "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=", + "owner": "nix-systems", + "repo": "default", + "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e", + "type": "github" + }, + "original": { + "owner": "nix-systems", + "repo": "default", + "type": "github" + } + }, "tranquil": { "inputs": { - "nixpkgs": "nixpkgs_2" + "nixpkgs": "nixpkgs_3" }, "locked": { "lastModified": 1777753977, diff --git a/flake.nix b/flake.nix index cd59b09..bd4ba74 100644 --- a/flake.nix +++ b/flake.nix @@ -3,6 +3,7 @@ nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable"; nixos-hardware.url = "github:NixOS/nixos-hardware/master"; tranquil.url = "git+https://tangled.org/tranquil.farm/tranquil-pds.git"; + agenix.url = "github:ryantm/agenix"; home-manager = { url = "github:nix-community/home-manager"; @@ -37,6 +38,7 @@ modules = [ ./hosts/common ./hosts/${hostname} + inputs.agenix.nixosModules.default ]; }; in diff --git a/hosts/common/default.nix b/hosts/common/default.nix index 4aaf374..8cf880b 100644 --- a/hosts/common/default.nix +++ b/hosts/common/default.nix @@ -1,4 +1,4 @@ -{ pkgs, ... }: +{ inputs, pkgs, ... }: { imports = [ ./users.nix @@ -46,6 +46,8 @@ }; environment.systemPackages = with pkgs; [ + inputs.agenix.packages.${stdenv.hostPlatform.system}.default + # dev tools htop vim diff --git a/hosts/common/users.nix b/hosts/common/users.nix index 401eede..e3870ee 100644 --- a/hosts/common/users.nix +++ b/hosts/common/users.nix @@ -1,11 +1,14 @@ -{ pkgs, ... }: +{ pkgs, config, ... }: { + age.secrets.apr-password.file = ../../secrets/apr-password.age; + age.secrets.root-password.file = ../../secrets/root-password.age; + users = { mutableUsers = false; users = { apr = { - initialPassword = "pass"; + hashedPasswordFile = config.age.secrets.apr-password.path; isNormalUser = true; extraGroups = [ "wheel" @@ -22,7 +25,7 @@ shell = pkgs.fish; }; root = { - initialPassword = "pass"; + hashedPasswordFile = config.age.secrets.root-password.path; openssh.authorizedKeys.keys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGDXt8vkpi9jOp9dCjoS8u0dC4fDdgb73w8z7VNI42FB did:web:vt3e.cat" ]; diff --git a/hosts/ivy/default.nix b/hosts/ivy/default.nix index d830766..534eae9 100644 --- a/hosts/ivy/default.nix +++ b/hosts/ivy/default.nix @@ -11,6 +11,10 @@ inputs.tranquil.nixosModules.tranquil-pds ]; + age.secrets.ivy-vaultwarden.file = ../../secrets/ivy/vaultwarden.age; + age.secrets.ivy-immich.file = ../../secrets/ivy/immich.age; + age.secrets.ivy-tranquil.file = ../../secrets/ivy/tranquil.age; + nix.settings.trusted-users = [ "root" "@wheel" diff --git a/hosts/ivy/services/at/tranquil.nix b/hosts/ivy/services/at/tranquil.nix index f753b0e..109c1d0 100644 --- a/hosts/ivy/services/at/tranquil.nix +++ b/hosts/ivy/services/at/tranquil.nix @@ -6,7 +6,7 @@ in services.tranquil-pds = { enable = true; - environmentFiles = [ "/var/secrets/tranquil" ]; + environmentFiles = [ config.age.secrets.ivy-tranquil.path ]; database.createLocally = true; settings = { diff --git a/hosts/ivy/services/immich.nix b/hosts/ivy/services/immich.nix index c10074a..be33379 100644 --- a/hosts/ivy/services/immich.nix +++ b/hosts/ivy/services/immich.nix @@ -5,7 +5,7 @@ in { services.immich = { enable = true; - secretsFile = "/var/secrets/immich"; + secretsFile = config.age.secrets.ivy-immich.path; port = PORT; settings = { server = { diff --git a/hosts/ivy/services/vaultwarden.nix b/hosts/ivy/services/vaultwarden.nix index 8bf15c4..30c5ab8 100644 --- a/hosts/ivy/services/vaultwarden.nix +++ b/hosts/ivy/services/vaultwarden.nix @@ -6,7 +6,7 @@ in services.vaultwarden = { enable = true; backupDir = "/var/backups/vaultwarden"; - environmentFile = "/var/secrets/vaultwarden"; + environmentFile = config.age.secrets.ivy-vaultwarden.path; config = { DOMAIN = "https://vaultwarden.vt3e.cat"; SIGNUPS_ALLOWED = false; diff --git a/secrets/apr-password.age b/secrets/apr-password.age new file mode 100644 index 0000000000000000000000000000000000000000..b60c999fbdb14642e5a7239550964d1d9b0b2736 GIT binary patch literal 539 zcmYdHPt{G$OD?J`D9Oyv)5|YP*Do{V(zR14F3!+RO))YxHMCU7NX_&qPFL^`F3BqK z4)JuU@;AyX_ApEJ3`ub`i7JWEPWCR#2`x);$uv$gG|URDvfxVba?di%HjK*42oAMK zOpVMd@-B&TN(pg~2sJV+$xQdlcXY{*DhW;sH9@z{NjuHkFi^qQ)4fnXBgoyNC_UFH zqSPfdqNF&;&>}l1A~&hh%)lo!GS|;JBG@;-+|Y{6GcMJg4voN1vjAD(&plvNR)0eUFkV z?+6pmFz1NmRFmMa%nXm9lBV~;M{U|6Q}&}%m8zv%94USgCNJy zU>8FZM-PiK&ya9auRtzcU0sF3@}jDol4AF&jHvRw%s?~e9Mhn%szA$9Z^w|R6!WSS zPoGTF^mJo0UtcZ;hP6k#R`lfVbrVwQTbX9YcPzjl@xbH@46->ZPw(*H`BL~W@CN6V zg^|5>C>|^oc;P9_wS$DPVi~GwwapIwEtY|tEfFf7o+wXT-7p4zLI#j G{2>6C55>9w literal 0 HcmV?d00001 diff --git a/secrets/ivy/immich.age b/secrets/ivy/immich.age new file mode 100644 index 0000000..d0673e2 --- /dev/null +++ b/secrets/ivy/immich.age @@ -0,0 +1,9 @@ +age-encryption.org/v1 +-> ssh-ed25519 heiLsg agzxtdQbyc3t6XCAH1cMa9spstRDO97K0cCLpNnHnxU +88wPAfCucIkXdnm+3nOOVYLKJHiNTC6jUGNGcRs//mI +-> ssh-ed25519 B+fK1Q xkD4+HePvfFgWUOxDNV6SVoDRl3zI3vEk/yMBo/WMQ0 +wFe3/81Pc6WYcCgfltyXgLTdeWSAs7AyAxYK1U6z/Ik +-> ssh-ed25519 3AUUoQ UQ/oKjfSU8VvltLvtBxlcmjl+TCQf19fDFRdtxGwoBU ++cyo8HM88Sc5O4dahVxbKm7WcHYc+t+yG6HCNph0ktU +--- esYPCLqBQ0Q51T2O31xHbzkvFXhyPgkV4GvHUfNiavw +�{79��TN�&E��ʽr�N=LWNNjuHkFi@e$vDiGR)LB0*$j8zv zB{aO)qCh*jsKhA8IHk-zCod!0+%(nCEWaWo(1Od`*vZhS$SJ}sJwHE9-#suaEV05r z%+fN|Jj5u%&&0ecF*wvHz1%0|Y{6K|#zqFhP6K$i!l0+Bx!jgzk%kY4} zTz7Bx~EU0nr7!;pybOegJ%)R1J$LT~dRuc)v}FH_H|w4|&u6OXEp z@&fm&DD&(pM@O#ZubE`CKW13Js1}+U_4%bsQ0tw@bJ-K~y%Q4Tf}TB!6Ii-yeV67N z#=s96VHL-2X4t81xaD+sj$OvD*{;z2Q(z?XY(n|lR0DOUm}hF|nC|A@+-X{Cx3kJchhO?}*hI=F@Yt-MbCviQlwn>+-$cc7E3C)xDE592(C0#LYSDY5VVY zsHeAt(}B{q@@qXk(@QT$EwPgjYiF6XIe%VcbjHrDpSHaDV8Zd%&gKTsoSlJmKN%Z&k;(Psne#bW%}dSbFBU zf}Q=wi99hZB0YwmT-83*%0F%V$zJ9}l t#fGiMo5eG3TB_du*l$~~`IS_D(ercCX@SO@Cn)&N6J&hLq}L#N3ji9-QEvbM literal 0 HcmV?d00001 diff --git a/secrets/ivy/vaultwarden.age b/secrets/ivy/vaultwarden.age new file mode 100644 index 0000000..284dbd0 --- /dev/null +++ b/secrets/ivy/vaultwarden.age @@ -0,0 +1,11 @@ +age-encryption.org/v1 +-> ssh-ed25519 heiLsg K0Id/m3OIwN/VA6HxsVXkjbDyKa9KMG9gMVnfDHmFSs +klf2wPcyxvewRNy4mNDzqDa8jlJbtOANbMyvwHwkJwQ +-> ssh-ed25519 B+fK1Q jrR8Lc/ha4wcqCU0R8S29ksqodEE2VWYMN9XmvBknx8 +Z3e4UzunBbu85Llyy9amtGusW5Wh24cuR67KSPJL2Sg +-> ssh-ed25519 3AUUoQ hwNa9j5bQNmWbOiZdMhkXG9H6xlBc+5pFA43yEsVyjA +umFQiA2/SQNP/ba/7YSh55qJpx6AXFTeReYP6TO9pDs +--- kDdYozJX4D/+xh7N9DqhnAEg4Azz1ER+akRg0ITUITg +W���X��%�@ :kk(�8� +:A�Z�V޳ �C�2�F��mJy��j뗕��g���ҵ��� +%w�<�!D��5���s���4�������08�c����"�A~��A��E��y%�2^���e2l#�T�s�"&q���ޖe3zD[�8���٤�J��F�ʕ|� \ No newline at end of file diff --git a/secrets/root-password.age b/secrets/root-password.age new file mode 100644 index 0000000000000000000000000000000000000000..ce485f602dfeb210fc038d35211ca8fbe0cbb1ef GIT binary patch literal 539 zcmYdHPt{G$OD?J`D9Oyv)5|YP*Do{V(zR14F3!+RO))YxHMCU7NX_&qPFKkGw=i~g z_po&LEAxvgamq1BayQr4FE{cpDsyrR%_+$6jwtlVEj9A&+^JLHFM3cDo)BaF-^40&o{GhEl0P_NjuHkFi^p(s4z2A+bl1$G_2Cm z$JII2(y%J4AT%=FG&r#$$hE*CF;`pL-Pbh5J(SBg$txp0$}KoQLf^I0G(V*{EGfso z$fP2|z$7Cq$+$cuDZtXnNZ;A72*WmG$I#IHK!so---g`ByZEaaxRZ#f5)P7!!X})cmEtWvz#LRH1~>dOOy1>q$=;6 z;G&9x;Id?sBsa%oPcB_uU4?>R|Fj7AvWiHF_g>T8zGJ~hIO=3{gwT*dj)uHI*oufaEG@eb+P