superconfig/modules/ at b9625d311b63d03352fda68240d66ae8af57b940 · lass.pds.lassul.us/superconfig · Tangled

lass.pds.lassul.us / superconfig

0

This repository has no description

0

superconfig / modules

1 folder 7 files

at b9625d311b63d03352fda68240d66ae8af57b940

Hermes configs.hass: log in via id.lassul.us (auth_oidc) 3d ago

configs.hass: log in via id.lassul.us (auth_oidc) Zitadel project hass on neoprism with a public app (PKCE, no secret) and access = "managed": users get access via a user grant an admin gives in the id.lassul.us console. On acheron the auth_oidc custom component from nixpkgs is mounted into the Home Assistant container and configured via /config/packages, next to the username/password login. modules.zitadel gets authMethod = "none" for public clients: reconcile generates no secret for them and writes only the client id to the env file, so nothing secret has to reach acheron. Zitadel generates the client id, so it cannot be known at eval time on acheron. It is not secret; after neoprism is deployed it is copied from /var/lib/zitadel-apps/hass-web.env into the prompted hass-oidc var and passed to the container as HASS_OIDC_CLIENT_ID (!env_var in the yaml). automatic_user_linking reuses the existing HA user whose username equals the preferred_username claim instead of creating a new one; it stays on because only users granted the project can log in. The groups scope is not requested since Zitadel has no groups claim.

3 days ago

modules.backup: encrypted repos in per-machine storage box sub-accounts Every machine now backs up into its own Hetzner storage box sub-account (isolation: one machine's ssh key can't read or delete another's archives), into ./borg in the sub-account's home. lass.backup.user replaces lass.backup.repo and enables the job; host, port 23 and the box's host key are module defaults, so a machine's backup.nix is only the sub-account. Repos are always encrypted (repokey-blake2). The passphrase comes from a per-machine clan vars generator borgbackup-repokey; it lives in the password store, so passphrase + repo are enough to restore. The borgbackup ssh key generator is unchanged. neoprism moves to a new repo on u550643-sub1 (doInit creates it); the old unencrypted repo u550643@...:/./neoprism is no longer referenced and is removed by hand. Its paths, excludes and hooks are unchanged. The job stays `hetzner`: with fresh repos nothing gains from a rename, and the unit name is used for the postBackup hooks. The timers get a fixed random delay of up to 1h after 03:00, so the machines sharing the box don't all start at once.

3 days ago

modules.backup: per-service backup state, move neoprism paths into their services lass.backup.state.<name> lets every service declare its folders, excludes, pre/post backup hooks and the paths its pre hook writes to next to its definition. The borg job (still `hetzner`, so archive names and pruning continue) and the borgbackup ssh key generator exist only on machines that set lass.backup.repo; neoprism's backup.nix now only points to the storage box. Pre hooks run inside the borg unit as before; each runs on its own with pipefail, all of them run and the job fails if any did (a failing pg_dump used to go unnoticed behind the gzip pipe). Post hooks run in ExecStopPost as root, also after a failed backup. The four bridge dumps are split from the old loop into the bridges' files. The dump subdirs are created by the hooks instead of tmpfiles. hedgedoc's uploads directory is backed up now. The imgur items (hedgedoc image uploads) are backed up now too.

3 days ago

fetchWallpaper.nix

modules: rename from 3modules

2 weeks ago

modules.backup: per-service backup state, move neoprism paths into their services lass.backup.state.<name> lets every service declare its folders, excludes, pre/post backup hooks and the paths its pre hook writes to next to its definition. The borg job (still `hetzner`, so archive names and pruning continue) and the borgbackup ssh key generator exist only on machines that set lass.backup.repo; neoprism's backup.nix now only points to the storage box. Pre hooks run inside the borg unit as before; each runs on its own with pipefail, all of them run and the job fails if any did (a failing pg_dump used to go unnoticed behind the gzip pipe). Post hooks run in ExecStopPost as root, also after a failed backup. The four bridge dumps are split from the old loop into the bridges' files. The dump subdirs are created by the hooks instead of tmpfiles. hedgedoc's uploads directory is backed up now. The imgur items (hedgedoc image uploads) are backed up now too.

3 days ago

configs: allocate uids dynamically, drop stockholm.lib pairprogramming, radio, realwallpaper and the htgen users no longer get their ids from stockholm's genid. NixOS keeps the ids existing users already have in /etc/passwd and /etc/group, so nothing changes on deployed machines; fresh installs allocate them. The copied htgen, reaktor2 and realwallpaper modules use nixpkgs option types instead of stockholm's, htgen's user is a small name/home submodule (home still defaults to /home/<name>), and reaktor2 carries its own stripAttr.

2 weeks ago

modules: rename from 3modules

2 weeks ago

sync-containers3.nix

modules.sync-containers3: move options to lass.sync-containers3

2 weeks ago