This repository has no description
use new facts api
author
lassulus
date
(Mar 28, 2024, 10:21 PM CET)
commit
cfe426b6
cfe426b6507197d3822b5aac083e76fbb5124024
parent
1a6cd0a0
1a6cd0a00bfb5507dac7e5383cb0a8a1bfe5e778
+172
-104
+4
-5
flake.nix
+4
-5
flake.nix
···
49
49
./machines/${machineName}/physical.nix
50
50
({ config, pkgs, ... }: {
51
51
clanCore.machineName = machineName;
52
-
clanCore.secretStore = "password-store";
53
-
clanCore.secretsUploadDirectory = "/etc/secrets";
54
-
clanCore.secretsDirectory = pkgs.lib.mkForce config.clanCore.secretsUploadDirectory;
52
+
clanCore.facts.secretStore = "password-store";
53
+
clanCore.facts.secretUploadDirectory = "/etc/secrets";
54
+
clanCore.facts.secretDirectory = pkgs.lib.mkForce config.clanCore.facts.secretUploadDirectory;
55
55
clan.networking.targetHost = "root@${machineName}";
56
-
krebs.secret.directory = config.clanCore.secretsUploadDirectory;
56
+
krebs.secret.directory = config.clanCore.facts.secretUploadDirectory;
57
57
nixpkgs.overlays = [
58
58
self.inputs.stockholm.overlays.default
59
59
(import (self.inputs.stockholm.inputs.nix-writers + "/pkgs")) # TODO get rid of that overlay
···
71
71
imports = [
72
72
./tools/nvim.nix
73
73
./tools/astronvim/flake-module.nix
74
-
75
74
./tools/zsh.nix
76
75
./tools/get-spora-hosts.nix
77
76
];
+3
-4
2configs/codimd.nix
+3
-4
2configs/codimd.nix
···
70
70
sslCertPath = "/var/lib/acme/${domain}/cert.pem";
71
71
sslKeyPath = "/var/lib/acme/${domain}/key.pem";
72
72
dhParamPath = config.security.dhparams.params.hedgedoc.path;
73
-
74
73
};
75
74
76
75
# https://github.com/settings/applications/2352617
77
-
environmentFile = config.clanCore.secretsUploadDirectory + "/hedgedoc.env";
76
+
environmentFile = config.clanCore.facts.secretUploadDirectory + "/hedgedoc.env";
78
77
};
79
78
80
-
clanCore.secrets.hedgedoc-github-auth = {
81
-
secrets."hedgedoc.env" = { };
79
+
clanCore.facts.services.hedgedoc-github-auth = {
80
+
secret."hedgedoc.env" = { };
82
81
generator.script = ''
83
82
cat > "$secrets"/hedgedoc.env
84
83
'';
+8
-7
2configs/default.nix
+8
-7
2configs/default.nix
···
35
35
{
36
36
users.extraUsers.mainUser.hashedPasswordFile = "${config.krebs.secret.directory}/passwordHash";
37
37
users.extraUsers.root.hashedPasswordFile = "${config.krebs.secret.directory}/passwordHash";
38
-
clanCore.secrets.password = {
39
-
secrets.password = { };
40
-
secrets.passwordHash = { };
38
+
clanCore.facts.services.password = {
39
+
secret.password = { };
40
+
secret.passwordHash = { };
41
41
generator.path = with pkgs; [ coreutils xkcdpass mkpasswd ];
42
42
generator.script = ''
43
43
xkcdpass -n 4 -d - > $secrets/password
···
48
48
{
49
49
services.openssh.enable = true;
50
50
services.openssh.hostKeys = [{
51
-
path = "${config.krebs.secret.directory}/ssh.id_ed25519";
51
+
path = config.clanCore.facts.services.ssh.secret."ssh.id_ed25519".path;
52
52
type = "ed25519";
53
53
}];
54
-
clanCore.secrets.ssh = {
55
-
secrets."ssh.id_ed25519" = { };
56
-
facts."ssh.id_ed25519.pub" = { };
54
+
clanCore.facts.services.ssh = {
55
+
secret."ssh.id_ed25519" = { };
56
+
public."ssh.id_ed25519.pub" = { };
57
57
generator.path = with pkgs; [ coreutils openssh ];
58
58
generator.script = ''
59
59
ssh-keygen -t ed25519 -N "" -f $secrets/ssh.id_ed25519
···
184
184
ls = "ls --color";
185
185
ip = "ip -color=auto";
186
186
grep = "grep --color=auto";
187
+
nosleep = "systemd-inhibit --what=handle-lid-switch sleep infinity";
187
188
};
188
189
189
190
programs.bash = {
+8
-1
2configs/green-host.nix
+8
-1
2configs/green-host.nix
···
1
1
{ config, pkgs, ... }:
2
2
{
3
3
krebs.sync-containers3.containers.green = {
4
-
sshKey = "${config.krebs.secret.directory}/green.sync.key";
4
+
sshKey = config.clanCore.facts.services.green-container.secret."green.sync.key".path;
5
5
startCommand = ''
6
6
export PATH=$PATH:${pkgs.git}/bin
7
7
until ${pkgs.dig.host}/bin/host github.com; do sleep 1; done
8
8
${pkgs.nixos-rebuild}/bin/nixos-rebuild --refresh --flake github:lassulus/superconfig#green switch --no-write-lock-file
9
+
'';
10
+
};
11
+
clanCore.facts.services.green-container = {
12
+
secret."green.sync.key" = { };
13
+
generator.script = ":";
14
+
generator.prompt = ''
15
+
copy or reference the secret key from the container into here, so we can actually start/sync the container
9
16
'';
10
17
};
11
18
}
+18
-8
2configs/hotdog-host.nix
+18
-8
2configs/hotdog-host.nix
···
1
-
{ self, pkgs, ... }:
1
+
{ config, pkgs, ... }:
2
2
{
3
-
imports = [
4
-
(self.inputs.stockholm + "/krebs/2configs/hotdog-host.nix")
5
-
];
6
-
clanCore.secrets.hotdog-container = {
7
-
secrets."hotdog.sync.key" = { };
8
-
facts."hotdog.sync.pub" = { };
3
+
krebs.sync-containers3.containers.hotdog = {
4
+
sshKey = "${config.krebs.secret.directory}/hotdog.sync.key";
5
+
startCommand = ''
6
+
export PATH=$PATH:${pkgs.git}/bin
7
+
ln -sfrT /var/lib/var_src /var/src
8
+
until ${pkgs.dig.host}/bin/host github.com; do sleep 1; done
9
+
${pkgs.nixos-rebuild}/bin/nixos-rebuild --refresh --flake 'git+https://cgit.lassul.us/stockholm#hotdog' switch --no-write-lock-file
10
+
'';
11
+
};
12
+
containers.hotdog.bindMounts."/var/lib" = {
13
+
hostPath = "/var/lib/sync-containers3/hotdog/state";
14
+
isReadOnly = false;
15
+
};
16
+
clanCore.facts.services.hotdog-container = {
17
+
secret."hotdog.sync.key" = { };
18
+
public."hotdog.sync.pub" = { };
9
19
generator.path = with pkgs; [ coreutils openssh ];
10
20
generator.script = ''
11
21
ssh-keygen -t ed25519 -N "" -f "$secrets"/hotdog.sync.key
12
-
mv "$secrets"/hotdog.sync.key "$facts"/hotdog.sync.pub
22
+
mv "$secrets"/hotdog.sync.key.pub "$facts"/hotdog.sync.pub
13
23
'';
14
24
};
15
25
}
+2
-2
2configs/orange-host.nix
+2
-2
2configs/orange-host.nix
···
21
21
proxyPass = "http://orange.r";
22
22
};
23
23
};
24
-
clanCore.secrets.orange-container = {
25
-
secrets."orange.sync.key" = { };
24
+
clanCore.facts.services.orange-container = {
25
+
secret."orange.sync.key" = { };
26
26
generator.script = ";";
27
27
generator.prompt = ''
28
28
copy or reference the secret key from the container into here, so we can actually start/sync the container
+7
-8
2configs/retiolum.nix
+7
-8
2configs/retiolum.nix
···
17
17
AutoConnect = yes
18
18
LocalDiscovery = yes
19
19
'';
20
-
tincUp = lib.mkIf config.systemd.network.enable "";
21
-
privkey = "${config.krebs.secret.directory}/retiolum.rsa_key.priv";
22
-
privkey_ed25519 = "${config.krebs.secret.directory}/retiolum.ed25519_key.priv";
20
+
privkey = config.clanCore.facts.services.retiolum."retiolum.rsa_key.priv".path;
21
+
privkey_ed25519 = config.clanCore.facts.services.retiolum."retiolum.ed25519_key.priv".path;
23
22
};
24
23
25
-
clanCore.secrets.retiolum = {
26
-
secrets."retiolum.rsa_key.priv" = { };
27
-
secrets."retiolum.ed25519_key.priv" = { };
28
-
facts."retiolum.rsa_key.pub" = { };
29
-
facts."retiolum.ed25519_key.pub" = { };
24
+
clanCore.facts.services.retiolum = {
25
+
secret."retiolum.rsa_key.priv" = { };
26
+
secret."retiolum.ed25519_key.priv" = { };
27
+
public."retiolum.rsa_key.pub" = { };
28
+
public."retiolum.ed25519_key.pub" = { };
30
29
generator.path = with pkgs; [
31
30
coreutils
32
31
tinc_pre
+3
-3
2configs/shadowsocks.nix
+3
-3
2configs/shadowsocks.nix
···
1
1
{ config, pkgs, ... }: {
2
2
services.shadowsocks = {
3
3
enable = true;
4
-
passwordFile = config.clanCore.secrets.shadowsocks.secrets.shadowsocks_password.path;
4
+
passwordFile = config.clanCore.facts.services.shadowsocks.secret.shadowsocks_password.path;
5
5
};
6
6
networking.firewall.allowedTCPPorts = [ 8388 ];
7
-
clanCore.secrets.shadowsocks = {
8
-
secrets."shadowsocks_password" = { };
7
+
clanCore.facts.services.shadowsocks = {
8
+
secret."shadowsocks_password" = { };
9
9
generator = {
10
10
prompt = "please enter your shadowsocks password";
11
11
path = with pkgs; [
+12
-5
2configs/spora.nix
+12
-5
2configs/spora.nix
···
3
3
imports = [
4
4
self.inputs.spora.nixosModules.spora
5
5
];
6
-
services.mycelium.keyFile = config.clanCore.secrets.mycelium.secrets.mycelium_key.path;
7
-
clanCore.secrets.mycelium = {
8
-
secrets."mycelium_key" = { };
9
-
facts."mycelium_ip" = { };
10
-
facts."mycelium_pubkey" = { };
6
+
services.mycelium = {
7
+
enable = true;
8
+
keyFile = config.clanCore.facts.services.mycelium.secret.mycelium_key.path;
9
+
peers = [
10
+
# "quic://lassul.us:9651"
11
+
];
12
+
package = self.packages.${pkgs.system}.mycelium;
13
+
};
14
+
clanCore.facts.services.mycelium = {
15
+
secret."mycelium_key" = { };
16
+
public."mycelium_ip" = { };
17
+
public."mycelium_pubkey" = { };
11
18
generator = {
12
19
path = [
13
20
pkgs.mycelium
+4
-4
2configs/syncthing.nix
+4
-4
2configs/syncthing.nix
···
37
37
user = "lass";
38
38
};
39
39
40
-
clanCore.secrets.syncthing = {
41
-
secrets."syncthing.key" = { };
42
-
secrets."syncthing.cert" = { };
43
-
facts."syncthing.pub" = { };
40
+
clanCore.facts.services.syncthing = {
41
+
secret."syncthing.key" = { };
42
+
secret."syncthing.cert" = { };
43
+
public."syncthing.pub" = { };
44
44
generator.path = with pkgs; [
45
45
coreutils
46
46
gnugrep
+3
-3
2configs/tor-ssh.nix
+3
-3
2configs/tor-ssh.nix
···
14
14
client.enable = true;
15
15
};
16
16
17
-
clanCore.secrets.tor-ssh = {
18
-
secrets."ssh-tor.priv" = { };
19
-
secrets."tor-hostname" = { };
17
+
clanCore.facts.services.tor-ssh = {
18
+
secret."ssh-tor.priv" = { };
19
+
secret."tor-hostname" = { };
20
20
generator.path = with pkgs; [
21
21
coreutils
22
22
mkp224o
+19
-10
2configs/ubik-host.nix
+19
-10
2configs/ubik-host.nix
···
27
27
'';
28
28
};
29
29
};
30
-
services.nginx.virtualHosts."mail.ubikmedia.eu" = {
31
-
enableACME = true;
32
-
forceSSL = true;
33
-
acmeFallbackHost = "ubik.r";
34
-
locations."/" = {
35
-
recommendedProxySettings = true;
36
-
proxyWebsockets = true;
37
-
proxyPass = "https://ubik.r";
38
-
};
39
-
};
30
+
# services.nginx.virtualHosts."mail.ubikmedia.eu" = {
31
+
# enableACME = true;
32
+
# forceSSL = true;
33
+
# acmeFallbackHost = "ubik.r";
34
+
# locations."/" = {
35
+
# recommendedProxySettings = true;
36
+
# proxyWebsockets = true;
37
+
# proxyPass = "https://ubik.r";
38
+
# };
39
+
# };
40
40
41
41
services.nginx.virtualHosts."karlaskop.de" = {
42
42
serverAliases = [ "www.karlaskop.de" ];
···
48
48
proxyWebsockets = true;
49
49
proxyPass = "https://prism.r";
50
50
};
51
+
};
52
+
clanCore.facts.services.ubik-container = {
53
+
secret."ubik.sync.key" = { };
54
+
public."ubik.sync.pub" = { };
55
+
generator.path = with pkgs; [ coreutils openssh ];
56
+
generator.script = ''
57
+
ssh-keygen -t ed25519 -N "" -f "$secrets"/ubik.sync.key
58
+
mv "$secrets"/ubik.sync.key "$facts"/ubik.sync.pub
59
+
'';
51
60
};
52
61
}
+3
-3
2configs/wiregrill.nix
+3
-3
2configs/wiregrill.nix
···
23
23
{ predicate = "-o wiregrill -m conntrack --ctstate RELATED,ESTABLISHED"; target = "ACCEPT"; }
24
24
]);
25
25
26
-
clanCore.secrets.wiregrill = {
27
-
secrets."wiregrill.key" = { };
28
-
facts."wiregrill.pub" = { };
26
+
clanCore.facts.services.wiregrill = {
27
+
secret."wiregrill.key" = { };
28
+
public."wiregrill.pub" = { };
29
29
generator.path = with pkgs; [
30
30
coreutils
31
31
wireguard-tools
+3
-3
2configs/binary-cache/server.nix
+3
-3
2configs/binary-cache/server.nix
···
5
5
# };
6
6
# generate private key with:
7
7
# nix-store --generate-binary-cache-key my-secret-key my-public-key
8
-
clanCore.secrets."nix-serve" = {
9
-
secrets."nix-serve.key" = { };
10
-
facts."nix-serve.pub" = { };
8
+
clanCore.facts.services."nix-serve" = {
9
+
secret."nix-serve.key" = { };
10
+
public."nix-serve.pub" = { };
11
11
generator.path = with pkgs; [ coreutils nix ];
12
12
generator.script = ''
13
13
nix-store --generate-binary-cache-key "$secrets"/nix-serve.key "$facts"/nix-serve.pub
+2
-2
2configs/dns/knot.nix
+2
-2
2configs/dns/knot.nix
···
31
31
# algorithm: hmac-sha256
32
32
# secret: 00000000000000000000000000000000000000000000
33
33
#nix-shell -p knot-dns --run 'keymgr -t my_name hmac-sha256'
34
-
# clanCore.secrets.knot = {
35
-
# secrets."knot-keys.conf" = {};
34
+
# clanCore.facts.services.knot = {
35
+
# secret."knot-keys.conf" = {};
36
36
# generator = ''
37
37
# ${pkgs.knot-dns}/bin/keymgr -t hmac-sha256
38
38
# '';
+3
-3
2configs/mail/internet-gateway.nix
+3
-3
2configs/mail/internet-gateway.nix
···
9
9
"nginx"
10
10
];
11
11
12
-
clanCore.secrets."lassul.us-dkim" = {
13
-
secrets."lassul.us.dkim.priv" = { };
14
-
facts."lassul.us.dkim.pub" = { };
12
+
clanCore.facts.services."lassul.us-dkim" = {
13
+
secret."lassul.us.dkim.priv" = { };
14
+
public."lassul.us.dkim.pub" = { };
15
15
generator.path = with pkgs; [ coreutils openssl ];
16
16
generator.script = ''
17
17
openssl genrsa -out "$secrets"/lassul.us.dkim.priv 2048
+11
-11
2configs/websites/domsen.nix
+11
-11
2configs/websites/domsen.nix
···
97
97
file_uploads = on
98
98
'';
99
99
100
-
clanCore.secrets.nextcloud = {
101
-
secrets."nextcloud_pw" = { };
100
+
clanCore.facts.services.nextcloud = {
101
+
secret."nextcloud_pw" = { };
102
102
generator.script = ''
103
103
cat > "$secrets"/nexcloud_pw;
104
104
'';
···
215
215
{ domain = "beesmooth.ch"; }
216
216
];
217
217
};
218
-
clanCore.secrets."ubikmedia.eu-dkim" = {
219
-
secrets."ubikmedia.eu.dkim.priv" = { };
220
-
facts."ubikmedia.eu.dkim.pub" = { };
218
+
clanCore.facts.services."ubikmedia.eu-dkim" = {
219
+
secret."ubikmedia.eu.dkim.priv" = { };
220
+
public."ubikmedia.eu.dkim.pub" = { };
221
221
generator.path = with pkgs; [ coreutils openssl ];
222
222
generator.script = ''
223
223
openssl genrsa -out "$secrets"/ubikmedia.eu.dkim.priv 2048
224
224
openssl rsa -in "$secrets"/ubikmedia.eu.dkim.priv -pubout -outform der 2>/dev/null | openssl base64 -A > "$facts"/ubikmedia.eu.dkim.pub
225
225
'';
226
226
};
227
-
clanCore.secrets."apanowicz.de-dkim" = {
228
-
secrets."apanowicz.de.dkim.priv" = { };
229
-
facts."apanowicz.de.dkim.pub" = { };
227
+
clanCore.facts.services."apanowicz.de-dkim" = {
228
+
secret."apanowicz.de.dkim.priv" = { };
229
+
public."apanowicz.de.dkim.pub" = { };
230
230
generator.path = with pkgs; [ coreutils openssl ];
231
231
generator.script = ''
232
232
openssl genrsa -out "$secrets"/apanowicz.de.dkim.priv 2048
233
233
openssl rsa -in "$secrets"/apanowicz.de.dkim.priv -pubout -outform der 2>/dev/null | openssl base64 -A > "$facts"/apanowicz.de.dkim.pub
234
234
'';
235
235
};
236
-
clanCore.secrets."beesmooth.ch-dkim" = {
237
-
secrets."beesmooth.ch.dkim.priv" = { };
238
-
facts."beesmooth.ch.dkim.pub" = { };
236
+
clanCore.facts.services."beesmooth.ch-dkim" = {
237
+
secret."beesmooth.ch.dkim.priv" = { };
238
+
public."beesmooth.ch.dkim.pub" = { };
239
239
generator.path = with pkgs; [ coreutils openssl ];
240
240
generator.script = ''
241
241
openssl genrsa -out "$secrets"/beesmooth.ch.dkim.priv 2048
+2
-2
2configs/websites/sqlBackup.nix
+2
-2
2configs/websites/sqlBackup.nix
+13
-3
machines/green/config.nix
+13
-3
machines/green/config.nix
···
1
-
{ config, lib, ... }:
1
+
{ config, lib, pkgs, ... }:
2
2
{
3
3
imports = [
4
4
../../2configs
···
20
20
../../2configs/atuin-server.nix
21
21
];
22
22
23
-
clanCore.secretsUploadDirectory = lib.mkForce "/var/state/secrets";
23
+
clanCore.facts.secretUploadDirectory = lib.mkForce "/var/state/secrets";
24
24
25
25
krebs.build.host = config.krebs.hosts.green;
26
26
27
27
krebs.sync-containers3.inContainer = {
28
28
enable = true;
29
-
pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFlUMf943qEQG64ob81p6dgoHq4jUjq7tSvmSdEOEU2y";
29
+
pubkey = config.clanCore.facts.services.green-container.public."green.sync.pub".value;
30
+
};
31
+
32
+
clanCore.facts.services.green-container = {
33
+
secret."green.sync.key" = { };
34
+
public."green.sync.pub" = { };
35
+
generator.path = with pkgs; [ coreutils openssh ];
36
+
generator.script = ''
37
+
ssh-keygen -t ed25519 -N "" -f "$secrets"/green.sync.key
38
+
mv "$secrets"/green.sync.key "$facts"/green.sync.pub
39
+
'';
30
40
};
31
41
32
42
systemd.tmpfiles.rules = [
+3
-3
machines/orange/config.nix
+3
-3
machines/orange/config.nix
···
22
22
enable = true;
23
23
pubkey = builtins.readFile ./facts/orange.sync.pub;
24
24
};
25
-
clanCore.secrets.orange-container = {
26
-
secrets."orange.sync.key" = { };
27
-
facts."orange.sync.pub" = { };
25
+
clanCore.facts.services.orange-container = {
26
+
secret."orange.sync.key" = { };
27
+
public."orange.sync.pub" = { };
28
28
generator.path = with pkgs; [ coreutils openssh ];
29
29
generator.script = ''
30
30
ssh-keygen -t ed25519 -N "" -f "$secrets"/orange.sync.key
+4
-4
machines/radio/config.nix
+4
-4
machines/radio/config.nix
···
7
7
../../2configs/services/radio
8
8
];
9
9
10
-
clanCore.secretsUploadDirectory = lib.mkForce "/var/state/secrets";
10
+
clanCore.facts.secretUploadDirectory = lib.mkForce "/var/state/secrets";
11
11
12
12
krebs.build.host = config.krebs.hosts.radio;
13
13
system.stateVersion = "24.05";
···
22
22
pubkey = builtins.readFile ./facts/radio.sync.pub;
23
23
};
24
24
25
-
clanCore.secrets.radio-container = {
26
-
secrets."radio.sync.key" = { };
27
-
facts."radio.sync.pub" = { };
25
+
clanCore.facts.services.radio-container = {
26
+
secret."radio.sync.key" = { };
27
+
public."radio.sync.pub" = { };
28
28
generator.path = with pkgs; [ coreutils openssh ];
29
29
generator.script = ''
30
30
ssh-keygen -t ed25519 -N "" -f "$secrets"/radio.sync.key
+3
-3
machines/yellow/config.nix
+3
-3
machines/yellow/config.nix
···
76
76
IOSchedulingPriority = 7;
77
77
};
78
78
};
79
-
clanCore.secrets.yellow-container = {
80
-
secrets."yellow.sync.key" = { };
81
-
facts."yellow.sync.pub" = { };
79
+
clanCore.facts.services.yellow-container = {
80
+
secret."yellow.sync.key" = { };
81
+
public."yellow.sync.pub" = { };
82
82
generator.path = with pkgs; [ coreutils openssh ];
83
83
generator.script = ''
84
84
ssh-keygen -t ed25519 -N "" -f "$secrets"/yellow.sync.key
+2
-2
2configs/services/flix/container-host.nix
+2
-2
2configs/services/flix/container-host.nix
···
42
42
recommendedProxySettings = true;
43
43
};
44
44
};
45
-
clanCore.secrets.yellow-container = {
46
-
secrets."yellow.sync.key" = { };
45
+
clanCore.facts.services.yellow-container = {
46
+
secret."yellow.sync.key" = { };
47
47
generator.script = ";";
48
48
generator.prompt = ''
49
49
copy or reference the secret key from the container into here, so we can actually start/sync the container
+20
-2
2configs/services/matrix/default.nix
+20
-2
2configs/services/matrix/default.nix
···
1
-
{ config, ... }:
1
+
{ config, pkgs, ... }:
2
2
{
3
3
services.matrix-synapse = {
4
4
enable = true;
5
5
settings = {
6
6
server_name = "lassul.us";
7
-
# registration_shared_secret = "yolo";
8
7
database = {
9
8
args.user = "matrix-synapse";
10
9
args.database = "matrix-synapse";
···
37
36
}
38
37
];
39
38
};
39
+
extraConfigFiles = [
40
+
"/var/lib/matrix-synapse/registration_shared_secret.yaml"
41
+
];
42
+
};
43
+
systemd.services.matrix-synapse.serviceConfig.ExecStartPre = [
44
+
"+${pkgs.writeScript "copy_registration_shared_secret" ''
45
+
#!/bin/sh
46
+
cp ${config.clanCore.facts.services.matrix-synapse.secret.synapse-registration_shared_secret.path} /var/lib/matrix-synapse/registration_shared_secret.yaml
47
+
chown matrix-synapse:matrix-synapse /var/lib/matrix-synapse/registration_shared_secret.yaml
48
+
chmod 600 /var/lib/matrix-synapse/registration_shared_secret.yaml
49
+
''}"
50
+
];
51
+
52
+
clanCore.facts.services."matrix-synapse" = {
53
+
secret."synapse-registration_shared_secret" = { };
54
+
generator.path = with pkgs; [ coreutils pwgen ];
55
+
generator.script = ''
56
+
echo "registration_shared_secret: $(pwgen -s 32 1)" > "$secrets"/synapse-registration_shared_secret
57
+
'';
40
58
};
41
59
42
60
# TODO add other VPNs here as well
+10
-1
2configs/services/nixcache/default.nix
+10
-1
2configs/services/nixcache/default.nix
···
1
-
{ config, lib, pkgs, ... }:
1
+
{ config, pkgs, ... }:
2
2
{
3
3
nixpkgs.config.packageOverrides = p: {
4
4
nix-serve = p.haskellPackages.nix-serve-ng;
···
8
8
enable = true;
9
9
port = 5005;
10
10
secretKeyFile = "${config.krebs.secret.directory}/nix-serve.key";
11
+
};
12
+
13
+
clanCore.facts.services.nix-serve = {
14
+
secret."nix-serve.key" = { };
15
+
public."nix-serve.pub" = { };
16
+
generator.path = with pkgs; [ coreutils nix ];
17
+
generator.script = ''
18
+
nix-store --generate-binary-cache-key cache.${config.networking.hostName} "$secrets"/nix-serve.key "$facts"/nix-serve.pub
19
+
'';
11
20
};
12
21
}
+2
-2
2configs/services/radio/container-host.nix
+2
-2
2configs/services/radio/container-host.nix
···
17
17
isReadOnly = false;
18
18
};
19
19
};
20
-
clanCore.secrets.radio-container = {
21
-
secrets."radio.sync.key" = { };
20
+
clanCore.facts.services.radio-container = {
21
+
secret."radio.sync.key" = { };
22
22
generator.script = ";";
23
23
generator.prompt = ''
24
24
copy or reference the secret key from the container into here, so we can actually start/sync the container