forked from
lass.pds.lassul.us/superconfig
This repository has no description
add some clan secrets generators
author
lassulus
date
(Oct 1, 2023, 9:37 PM CEST)
commit
77710545
77710545ff02b0add2e4aad55c6c490b374dcadd
parent
166fef5d
166fef5d32aaf22d53a1ae1e8617dc37e482b757
+49
-6
+23
-6
nixos/2configs/default.nix
+23
-6
nixos/2configs/default.nix
···
32
32
{
33
33
users.extraUsers.mainUser.passwordFile = "${config.krebs.secret.directory}/passwordFile";
34
34
users.extraUsers.root.passwordFile = "${config.krebs.secret.directory}/passwordFile";
35
+
clanCore.secrets.password = {
36
+
secrets.password = { };
37
+
secrets.passwordHash = { };
38
+
generator = ''
39
+
${pkgs.xkcdpass}/bin/xkcdpass -n 4 -d - > $secrets/password
40
+
cat $secrets/password | ${pkgs.mkpasswd}/bin/mkpasswd -s -m sha-512 > $secrets/passwordHash
41
+
'';
42
+
};
43
+
}
44
+
{
45
+
services.openssh.enable = true;
46
+
services.openssh.hostKeys = [{
47
+
path = "${config.krebs.secret.directory}/ssh.id_ed25519";
48
+
type = "ed25519";
49
+
}];
50
+
clanCore.secrets.ssh = {
51
+
secrets."ssh.id_ed25519" = { };
52
+
facts."ssh.id_ed25519.pub" = { };
53
+
generator = ''
54
+
${pkgs.openssh}/bin/ssh-keygen -t ed25519 -N "" -f $secrets/ssh.id_ed25519
55
+
mv $secrets/ssh.id_ed25519.pub $facts/ssh.id_ed25519.pub
56
+
'';
57
+
};
35
58
}
36
59
{
37
60
users.extraUsers = {
···
193
216
fi
194
217
'';
195
218
};
196
-
197
-
services.openssh.enable = true;
198
-
services.openssh.hostKeys = [{
199
-
path = "${config.clan.password-store.targetDirectory}/ssh.id_ed25519";
200
-
type = "ed25519";
201
-
}];
202
219
203
220
services.journald.extraConfig = ''
204
221
SystemMaxUse=1G
+14
nixos/2configs/retiolum.nix
+14
nixos/2configs/retiolum.nix
···
31
31
privkey_ed25519 = "${config.krebs.secret.directory}/retiolum.ed25519_key.priv";
32
32
};
33
33
34
+
clanCore.secrets.retiolum = {
35
+
secrets."retiolum.rsa_key.priv" = { };
36
+
secrets."retiolum.ed25519_key.priv" = { };
37
+
facts."retiolum.rsa_key.pub" = { };
38
+
facts."retiolum.ed25519_key.pub" = { };
39
+
generator = ''
40
+
${pkgs.tinc_pre}/bin/tinc --config "$secrets" generate-keys 4096 >/dev/null
41
+
mv "$secrets"/rsa_key.priv "$secrets"/retiolum.rsa_key.priv
42
+
mv "$secrets"/ed25519_key.priv "$secrets"/retiolum.ed25519_key.priv
43
+
mv "$secrets"/rsa_key.pub "$facts"/retiolum.rsa_key.pub
44
+
mv "$secrets"/ed25519_key.pub "$facts"/retiolum.ed25519_key.pub
45
+
'';
46
+
};
47
+
34
48
systemd.network.networks.retiolum = {
35
49
matchConfig.Name = "retiolum";
36
50
address = [
+12
nixos/2configs/syncthing.nix
+12
nixos/2configs/syncthing.nix
···
16
16
settings.devices = mk_peers used_peers;
17
17
};
18
18
19
+
clanCore.secrets.syncthing = {
20
+
secrets."syncthing.key" = { };
21
+
secrets."syncthing.cert" = { };
22
+
facts."syncthing.pub" = { };
23
+
generator = ''
24
+
${pkgs.syncthing}/bin/syncthing generate --config "$secrets"
25
+
mv "$secrets"/key.pem "$secrets"/syncthing.cert
26
+
mv "$secrets"/cert.pem "$secrets"/syncthing.key
27
+
cat "$secrets"/config.xml | ${pkgs.gnugrep}/bin/grep -oP '(?<=<device id=")[^"]+' > "$facts"/syncthing.pub
28
+
'';
29
+
};
30
+
19
31
boot.kernel.sysctl."fs.inotify.max_user_watches" = 524288;
20
32
krebs.iptables.tables.filter.INPUT.rules = [
21
33
{ predicate = "-p tcp --dport 22000"; target = "ACCEPT";}