lass.pds.lassul.us / superconfig
This repository has no description
0
Fork 1

Configure Feed

Select the types of activity you want to include in your feed.

*: migrate facts to vars

author
lassulus date (Dec 11, 2025, 12:36 PM CET) commit e78cd6ea parent a4b82cf5
+110 -105
+1 -1
2configs/c-base.nix
··· 57 57 # register-dns 58 58 # block-outside-dns 59 59 script-security 2 60 - auth-user-pass ${config.clanCore.facts.services.c-base.secret."c-base.txt".path} 60 + auth-user-pass ${config.clan.core.vars.generators.c-base.files."c-base.txt".path} 61 61 #auth-user-pass 62 62 key-direction 1 63 63 <tls-auth>
+3 -7
2configs/default.nix
··· 7 7 }: 8 8 { 9 9 # Clan core configuration 10 - clan.core.facts.secretStore = "password-store"; 11 - clan.core.facts.secretUploadDirectory = lib.mkDefault "/etc/secrets"; 12 10 clan.core.vars.settings.secretStore = "password-store"; 13 11 clan.core.networking.targetHost = "root@${config.networking.hostName}"; 14 12 15 13 # Stockholm configuration 16 - krebs.secret.directory = config.clan.core.facts.secretUploadDirectory; 14 + krebs.secret.directory = config.clan.core.vars.password-store.secretLocation; 17 15 18 16 # Nixpkgs overlays 19 17 nixpkgs.overlays = [ ··· 81 79 }; 82 80 files.password.deploy = false; 83 81 files.passwordHash.neededFor = "users"; 84 - migrateFact = "password"; 85 82 runtimeInputs = with pkgs; [ 86 83 coreutils 87 84 mkpasswd ··· 97 94 services.openssh.settings.PasswordAuthentication = false; 98 95 services.openssh.hostKeys = [ 99 96 { 100 - path = config.clanCore.vars.generators.ssh.files."ssh.id_ed25519".path; 97 + path = config.clan.core.vars.generators.ssh.files."ssh.id_ed25519".path; 101 98 type = "ed25519"; 102 99 } 103 100 ]; 104 101 clan.core.vars.generators.ssh = { 105 - files."ssh.id_ed25519".secret = true; 102 + files."ssh.id_ed25519" = { }; 106 103 files."ssh.id_ed25519.pub".secret = false; 107 - migrateFact = "ssh"; 108 104 runtimeInputs = with pkgs; [ 109 105 coreutils 110 106 openssh
+37 -35
2configs/websites/domsen.nix
··· 118 118 file_uploads = on 119 119 ''; 120 120 121 - clanCore.facts.services.nextcloud = { 122 - secret."nextcloud_pw" = { }; 123 - generator.script = '' 124 - cat > "$secrets"/nexcloud_pw; 125 - ''; 126 - generator.prompt = '' 127 - enter initial admin password for nextcloud 121 + clan.core.vars.generators.nextcloud = { 122 + files."nextcloud_pw" = { }; 123 + prompts.password.description = "enter initial admin password for nextcloud"; 124 + script = '' 125 + cat "$prompts"/password > "$out"/nextcloud_pw 128 126 ''; 129 127 }; 130 128 # systemd.services.nextcloud-setup.after = [ "secret-nextcloud_pw.service" ]; ··· 285 283 { domain = "beesmooth.ch"; } 286 284 ]; 287 285 }; 288 - clanCore.facts.services."ubikmedia.eu-dkim" = { 289 - secret."ubikmedia.eu.dkim.priv" = { }; 290 - public."ubikmedia.eu.dkim.pub" = { }; 291 - generator.path = with pkgs; [ 286 + clan.core.vars.generators."ubikmedia.eu-dkim" = { 287 + files."ubikmedia.eu.dkim.priv" = { }; 288 + files."ubikmedia.eu.dkim.pub".secret = false; 289 + runtimeInputs = with pkgs; [ 292 290 coreutils 293 291 openssl 294 292 ]; 295 - generator.script = '' 296 - openssl genrsa -out "$secrets"/ubikmedia.eu.dkim.priv 1024 297 - openssl rsa -in "$secrets"/ubikmedia.eu.dkim.priv -pubout -outform der 2>/dev/null | openssl base64 -A > "$facts"/ubikmedia.eu.dkim.pub 293 + script = '' 294 + exit 1 # Manual migration required from facts to vars 295 + openssl genrsa -out "$out"/ubikmedia.eu.dkim.priv 1024 296 + openssl rsa -in "$out"/ubikmedia.eu.dkim.priv -pubout -outform der 2>/dev/null | openssl base64 -A > "$out"/ubikmedia.eu.dkim.pub 298 297 ''; 299 298 }; 300 - clanCore.facts.services."apanowicz.de-dkim" = { 301 - secret."apanowicz.de.dkim.priv" = { }; 302 - public."apanowicz.de.dkim.pub" = { }; 303 - generator.path = with pkgs; [ 299 + clan.core.vars.generators."apanowicz.de-dkim" = { 300 + files."apanowicz.de.dkim.priv" = { }; 301 + files."apanowicz.de.dkim.pub".secret = false; 302 + runtimeInputs = with pkgs; [ 304 303 coreutils 305 304 openssl 306 305 ]; 307 - generator.script = '' 308 - openssl genrsa -out "$secrets"/apanowicz.de.dkim.priv 1024 309 - openssl rsa -in "$secrets"/apanowicz.de.dkim.priv -pubout -outform der 2>/dev/null | openssl base64 -A > "$facts"/apanowicz.de.dkim.pub 306 + script = '' 307 + exit 1 # Manual migration required from facts to vars 308 + openssl genrsa -out "$out"/apanowicz.de.dkim.priv 1024 309 + openssl rsa -in "$out"/apanowicz.de.dkim.priv -pubout -outform der 2>/dev/null | openssl base64 -A > "$out"/apanowicz.de.dkim.pub 310 310 ''; 311 311 }; 312 - clanCore.facts.services."beesmooth.ch-dkim" = { 313 - secret."beesmooth.ch.dkim.priv" = { }; 314 - public."beesmooth.ch.dkim.pub" = { }; 315 - generator.path = with pkgs; [ 312 + clan.core.vars.generators."beesmooth.ch-dkim" = { 313 + files."beesmooth.ch.dkim.priv" = { }; 314 + files."beesmooth.ch.dkim.pub".secret = false; 315 + runtimeInputs = with pkgs; [ 316 316 coreutils 317 317 openssl 318 318 ]; 319 - generator.script = '' 320 - openssl genrsa -out "$secrets"/beesmooth.ch.dkim.priv 1024 321 - openssl rsa -in "$secrets"/beesmooth.ch.dkim.priv -pubout -outform der 2>/dev/null | openssl base64 -A > "$facts"/beesmooth.ch.dkim.pub 319 + script = '' 320 + exit 1 # Manual migration required from facts to vars 321 + openssl genrsa -out "$out"/beesmooth.ch.dkim.priv 1024 322 + openssl rsa -in "$out"/beesmooth.ch.dkim.priv -pubout -outform der 2>/dev/null | openssl base64 -A > "$out"/beesmooth.ch.dkim.pub 322 323 ''; 323 324 }; 324 - clanCore.facts.services."freemonkey.art" = { 325 - secret."freemonkey.art.dkim.priv" = { }; 326 - public."freemonkey.art.dkim.pub" = { }; 327 - generator.path = with pkgs; [ 325 + clan.core.vars.generators."freemonkey.art" = { 326 + files."freemonkey.art.dkim.priv" = { }; 327 + files."freemonkey.art.dkim.pub".secret = false; 328 + runtimeInputs = with pkgs; [ 328 329 coreutils 329 330 openssl 330 331 ]; 331 - generator.script = '' 332 - openssl genrsa -out "$secrets"/freemonkey.art.dkim.priv 1024 333 - openssl rsa -in "$secrets"/freemonkey.art.dkim.priv -pubout -outform der 2>/dev/null | openssl base64 -A > "$facts"/freemonkey.art.dkim.pub 332 + script = '' 333 + exit 1 # Manual migration required from facts to vars 334 + openssl genrsa -out "$out"/freemonkey.art.dkim.priv 1024 335 + openssl rsa -in "$out"/freemonkey.art.dkim.priv -pubout -outform der 2>/dev/null | openssl base64 -A > "$out"/freemonkey.art.dkim.pub 334 336 ''; 335 337 }; 336 338 services.borgbackup.jobs.hetzner.paths = [
+5 -7
2configs/websites/sqlBackup.nix
··· 1 1 { config, pkgs, ... }: 2 2 { 3 - clanCore.facts.services.mysql = { 4 - secret."mysql_rootPassword" = { }; 5 - generator.script = '' 6 - cat > "$secrets"/mysql_rootPassword 7 - ''; 8 - generator.prompt = '' 9 - enter mysql root password 3 + clan.core.vars.generators.mysql = { 4 + files."mysql_rootPassword" = { }; 5 + prompts.password.description = "enter mysql root password"; 6 + script = '' 7 + cat "$prompts"/password > "$out"/mysql_rootPassword 10 8 ''; 11 9 }; 12 10 krebs.secret.files.mysql_rootPassword = {
+3 -4
machines/green/config.nix
··· 5 5 ... 6 6 }: 7 7 { 8 + clan.core.vars.password-store.secretLocation = "/var/state/secret-vars"; 9 + 8 10 imports = [ 9 11 ../../2configs 10 12 ../../2configs/retiolum.nix ··· 25 27 ../../2configs/autoupdate.nix 26 28 ]; 27 29 28 - # clanCore.facts.secretUploadDirectory = lib.mkForce "/var/state/secrets"; 29 - clan.password-store.targetDirectory = "/var/state/secrets"; 30 - 31 30 krebs.build.host = config.krebs.hosts.green; 32 31 33 32 krebs.sync-containers3.inContainer = { ··· 35 34 pubkey = config.clan.core.vars.generators.green-container.files."green.sync.pub".path; 36 35 }; 37 36 38 - clanCore.vars.generators.green-container = { 37 + clan.core.vars.generators.green-container = { 39 38 files."green.sync.key" = { }; 40 39 files."green.sync.pub".secret = false; 41 40 runtimeInputs = with pkgs; [
+9 -8
machines/orange/config.nix
··· 1 1 { config, pkgs, ... }: 2 2 { 3 + clan.core.vars.password-store.secretLocation = "/var/state/secret-vars"; 4 + 3 5 imports = [ 4 6 ../../2configs 5 7 ../../2configs/retiolum.nix ··· 10 12 11 13 krebs.build.host = config.krebs.hosts.orange; 12 14 system.stateVersion = "24.05"; 13 - clan.password-store.targetDirectory = "/var/state/secrets"; 14 15 15 16 services.nginx.enable = true; 16 17 networking.firewall.allowedTCPPorts = [ ··· 26 27 enable = true; 27 28 pubkey = builtins.readFile ./facts/orange.sync.pub; 28 29 }; 29 - clanCore.facts.services.orange-container = { 30 - secret."orange.sync.key" = { }; 31 - public."orange.sync.pub" = { }; 32 - generator.path = with pkgs; [ 30 + clan.core.vars.generators.orange-container = { 31 + files."orange.sync.key" = { }; 32 + files."orange.sync.pub".secret = false; 33 + runtimeInputs = with pkgs; [ 33 34 coreutils 34 35 openssh 35 36 ]; 36 - generator.script = '' 37 - ssh-keygen -t ed25519 -N "" -f "$secrets"/orange.sync.key 38 - mv "$secrets"/orange.sync.key "$facts"/orange.sync.pub 37 + script = '' 38 + ssh-keygen -t ed25519 -N "" -f "$out"/orange.sync.key 39 + mv "$out"/orange.sync.key.pub "$out"/orange.sync.pub 39 40 ''; 40 41 }; 41 42 }
+10 -10
machines/prism/backup.nix
··· 4 4 5 5 systemd.services.borgbackup-job-hetzner.serviceConfig.ReadWritePaths = [ "/var/log/telegraf" ]; 6 6 7 - clanCore.facts.services.borgbackup = { 8 - secret."borgbackup.ssh.id25519" = { }; 9 - public."borgbackup.ssh.id25519.pub" = { }; 10 - generator.path = [ 11 - pkgs.coreutils 12 - pkgs.openssh 7 + clan.core.vars.generators.borgbackup = { 8 + files."borgbackup.ssh.id25519" = { }; 9 + files."borgbackup.ssh.id25519.pub".secret = false; 10 + runtimeInputs = with pkgs; [ 11 + coreutils 12 + openssh 13 13 ]; 14 - generator.script = '' 15 - ssh-keygen -t ed25519 -N "" -f $secrets/borgbackup.ssh.id25519 16 - mv $secrets/borgbackup.ssh.id25519.pub $facts/borgbackup.ssh.id25519.pub 14 + script = '' 15 + exit 1 # Manual migration required from facts to vars 16 + ssh-keygen -t ed25519 -N "" -f $out/borgbackup.ssh.id25519 17 17 ''; 18 18 }; 19 19 ··· 30 30 startAt = "*-*-* 02:00:00"; 31 31 # TODO: change backup key 32 32 environment.BORG_RSH = "ssh -oPort=23 -i ${ 33 - config.clanCore.facts.services.borgbackup.secret."borgbackup.ssh.id25519".path 33 + config.clan.core.vars.generators.borgbackup.files."borgbackup.ssh.id25519".path 34 34 }"; 35 35 preHook = '' 36 36 set -x
-2
machines/radio/config.nix
··· 8 8 ../../2configs/autoupdate.nix 9 9 ]; 10 10 11 - clan.password-store.targetDirectory = "/var/state/secrets"; 12 11 clan.core.vars.password-store.secretLocation = "/var/state/secret-vars"; 13 12 14 13 krebs.build.host = config.krebs.hosts.radio; ··· 27 26 clan.core.vars.generators.radio-sync = { 28 27 files."radio.sync.key" = { }; 29 28 files."radio.sync.pub".secret = false; 30 - migrateFact = "radio-container"; 31 29 runtimeInputs = with pkgs; [ 32 30 coreutils 33 31 openssh
-1
machines/ubik/config.nix
··· 14 14 ]; 15 15 16 16 krebs.build.host = config.krebs.hosts.ubik; 17 - clan.password-store.targetDirectory = "/var/state/secrets"; 18 17 clan.core.vars.password-store.secretLocation = "/var/state/secret-vars"; 19 18 20 19 krebs.sync-containers3.inContainer = {
+16 -16
machines/yellow/config.nix
··· 8 8 torrentport = 56709; # port forwarded in airvpn webinterface 9 9 in 10 10 { 11 + clan.core.vars.password-store.secretLocation = "/var/state/secret-vars"; 12 + 11 13 imports = [ 12 14 ../../2configs 13 15 ../../2configs/retiolum.nix 14 16 ../../2configs/services/flix 15 17 ../../2configs/autoupdate.nix 16 18 ]; 17 - 18 - clan.password-store.targetDirectory = "/var/state/secrets"; 19 19 20 20 # we need to configure another port for the mycelium admin interface, because it conflicts with sonarr. 21 21 services.mycelium.extraArgs = [ ··· 70 70 ip -n transmission addr add 10.176.43.231/32 dev airvpn 71 71 ip -n transmission addr add fd7d:76ee:e68f:a993:41b3:846b:d271:30d8/128 dev airvpn 72 72 ip netns exec transmission wg syncconf airvpn <(wg-quick strip ${ 73 - config.clanCore.facts.services.airvpn.secret."airvpn.conf".path 73 + config.clan.core.vars.generators.airvpn.files."airvpn.conf".path 74 74 }) 75 75 ip -n transmission link set airvpn up 76 76 ip -n transmission route add default dev airvpn ··· 94 94 }; 95 95 }; 96 96 97 - clanCore.facts.services.airvpn = { 98 - secret."airvpn.conf" = { }; 99 - generator.path = with pkgs; [ coreutils ]; 100 - generator.prompt = '' 97 + clan.core.vars.generators.airvpn = { 98 + files."airvpn.conf" = { }; 99 + prompts.config.description = '' 101 100 login into https://airvpn.org/ goto https://airvpn.org/generator/ 102 101 generate a wireguard config 103 102 paste the config here 104 103 ''; 105 - generator.script = '' 106 - echo "$prompt_value" > "$secrets"/airvpn.conf 104 + runtimeInputs = with pkgs; [ coreutils ]; 105 + script = '' 106 + cat "$prompts"/config > "$out"/airvpn.conf 107 107 ''; 108 108 }; 109 109 ··· 124 124 IOSchedulingPriority = 7; 125 125 }; 126 126 }; 127 - clanCore.facts.services.yellow-container = { 128 - secret."yellow.sync.key" = { }; 129 - public."yellow.sync.pub" = { }; 130 - generator.path = with pkgs; [ 127 + clan.core.vars.generators.yellow-container = { 128 + files."yellow.sync.key" = { }; 129 + files."yellow.sync.pub".secret = false; 130 + runtimeInputs = with pkgs; [ 131 131 coreutils 132 132 openssh 133 133 ]; 134 - generator.script = '' 135 - ssh-keygen -t ed25519 -N "" -f "$secrets"/yellow.sync.key 136 - mv "$secrets"/yellow.sync.key "$facts"/yellow.sync.pub 134 + script = '' 135 + ssh-keygen -t ed25519 -N "" -f "$out"/yellow.sync.key 136 + mv "$out"/yellow.sync.key.pub "$out"/yellow.sync.pub 137 137 ''; 138 138 }; 139 139 }
+6 -4
2configs/services/flix/container-host.nix
··· 56 56 recommendedProxySettings = true; 57 57 }; 58 58 }; 59 - clanCore.facts.services.yellow-container = { 60 - secret."yellow.sync.key" = { }; 61 - generator.script = ";"; 62 - generator.prompt = '' 59 + clan.core.vars.generators.yellow-container = { 60 + files."yellow.sync.key" = { }; 61 + prompts.key.description = '' 63 62 copy or reference the secret key from the container into here, so we can actually start/sync the container 63 + ''; 64 + script = '' 65 + cat "$prompts"/key > "$out"/yellow.sync.key 64 66 ''; 65 67 }; 66 68 }
+7 -6
2configs/services/nixcache/default.nix
··· 10 10 secretKeyFile = "${config.krebs.secret.directory}/nix-serve.key"; 11 11 }; 12 12 13 - clanCore.facts.services.nix-serve = { 14 - secret."nix-serve.key" = { }; 15 - public."nix-serve.pub" = { }; 16 - generator.path = with pkgs; [ 13 + clan.core.vars.generators.nix-serve = { 14 + files."nix-serve.key" = { }; 15 + files."nix-serve.pub".secret = false; 16 + runtimeInputs = with pkgs; [ 17 17 coreutils 18 18 nix 19 19 ]; 20 - generator.script = '' 21 - nix-store --generate-binary-cache-key cache.${config.networking.hostName} "$secrets"/nix-serve.key "$facts"/nix-serve.pub 20 + script = '' 21 + exit 1 # Manual migration required from facts to vars 22 + nix-store --generate-binary-cache-key cache.${config.networking.hostName} "$out"/nix-serve.key "$out"/nix-serve.pub 22 23 ''; 23 24 }; 24 25 }
+6 -4
2configs/services/radio/container-host.nix
··· 22 22 isReadOnly = false; 23 23 }; 24 24 }; 25 - clanCore.facts.services.radio-container = { 26 - secret."radio.sync.key" = { }; 27 - generator.script = ";"; 28 - generator.prompt = '' 25 + clan.core.vars.generators.radio-container = { 26 + files."radio.sync.key" = { }; 27 + prompts.key.description = '' 29 28 copy or reference the secret key from the container into here, so we can actually start/sync the container 29 + ''; 30 + script = '' 31 + cat "$prompts"/key > "$out"/radio.sync.key 30 32 ''; 31 33 }; 32 34 }
+1
vars/per-machine/orange/orange-container/orange.sync.pub/value
··· 1 + ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFQWzKuXrwQopBc1mzb2VpljmwAs7Y8bRl9a8hBXLC+l
+1
vars/per-machine/prism/apanowicz.de-dkim/apanowicz.de.dkim.pub/value
··· 1 + MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDrJ0roq5SCfS6T/mhSjnSQeU2saM6daIybHiuCDIZx5jgZ2ARdz5ZBwzGypG+aOOomff0LT+p+EC1dKmjI30J6t8zIX5uDy5orKeJWpT84ZCrYk5mC+QTlwaawJ6EFnQoarMkPsJC3HUaiAB7A+kGeaODXK2/a0xWy2AwqWbe9RwIDAQAB
+1
vars/per-machine/prism/beesmooth.ch-dkim/beesmooth.ch.dkim.pub/value
··· 1 + MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCXHIWuekFlbxRTT+Yq+untZkkIx+NLU3JZj/zKjZqLe5qLxcA8UW5u/fQIykPiOcCcpCTlxg/XwYMBEDBGQzn/T9MlVOoEaEaaseJ0foRf/ljO5s6deoH+XtcxeuvNduB8/EDQFBYz687ULXy/8eLbSiSt699J2JlWuR2pB05YDwIDAQAB
+1
vars/per-machine/prism/borgbackup/borgbackup.ssh.id25519.pub/value
··· 1 + ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAII8LnVQBZP2KOmNaJCkTltzOVix9qZ8FXHZCKt52Wgph lass@aergia
+1
vars/per-machine/prism/freemonkey.art/freemonkey.art.dkim.pub/value
··· 1 + MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDobKGU44EjDyifVdPO15TubKC4yVoIQrd/pvNHW/jcxpsVZS7w2EHeYtiex+TJtBN64OZhed4jPsxLqTeQI07SQ5Wt7u/bJb6y69t2Bs314tK2OPAcySsU6tCFr2Jq25fjopFdhhOC/StMEjTR/WR+4VXVePx0Kt51zlPmIiGmPwIDAQAB
+1
vars/per-machine/prism/ubikmedia.eu-dkim/ubikmedia.eu.dkim.pub/value
··· 1 + MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCbCyGa0Kbgw7YL2OHU0Ou3wuzzyA8G5wcg60oMj4PK6xpKpon3PKN4DvNXLoBEc0ME2y1G2NocceLGGYD/pbUzbwv82R09NzNzZkLzOzr2TlbnK7BF4R2rbC4cV3Q2O4JXQSbzupECto8z2xWRj76c1GqGaTJHaGwKvuj768BG0QIDAQAB
+1
vars/per-machine/yellow/yellow-container/yellow.sync.pub/value
··· 1 + ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIN737BAP36KiZO97mPKTIUGJUcr97ps8zjfFag6cUiYL