148 lines
5.2 KiB
Nix
148 lines
5.2 KiB
Nix
{
|
|
pkgs,
|
|
inputs,
|
|
config,
|
|
lib,
|
|
configVars,
|
|
...
|
|
}: let
|
|
hostname = config.networking.hostName;
|
|
pubKeys = lib.filesystem.listFilesRecursive ../keys;
|
|
sopsHashedPasswordFile = lib.optionalString (lib.hasAttr "sops-nix" inputs) config.sops.secrets."passwords/sam".path;
|
|
secretsDirectory = builtins.toString inputs.nix-secrets;
|
|
secretsFile = "${secretsDirectory}/secrets.yaml";
|
|
baseddataPostgresIp = configVars.networking.addresses.postgres.ip;
|
|
username = "sam";
|
|
in {
|
|
services.restic.backups = {
|
|
daily = {
|
|
paths = [
|
|
"/home/${username}/"
|
|
];
|
|
exclude = [
|
|
"/home/${username}/.mozilla"
|
|
"/home/${username}/.cache"
|
|
];
|
|
};
|
|
};
|
|
|
|
users.users.${username} = {
|
|
isNormalUser = true;
|
|
shell = pkgs.zsh; # default shell
|
|
hashedPasswordFile = sopsHashedPasswordFile;
|
|
openssh.authorizedKeys.keys = lib.lists.forEach pubKeys (key: builtins.readFile key);
|
|
|
|
extraGroups = [
|
|
"wheel"
|
|
"networkmanager"
|
|
"scanner"
|
|
"lp"
|
|
"docker"
|
|
"podman"
|
|
"render"
|
|
"video"
|
|
];
|
|
};
|
|
services.tailscale.enable = true;
|
|
sops.secrets = {
|
|
"passwords/${username}" = {
|
|
sopsFile = "${secretsFile}";
|
|
neededForUsers = true;
|
|
};
|
|
"ssh_keys/${username}/id_ed25519" = {
|
|
path = "/home/${username}/.ssh/id_ed25519";
|
|
mode = "0600";
|
|
owner = "${username}";
|
|
};
|
|
"ssh_keys/${username}/id_ed25519.pub" = {
|
|
path = "/home/${username}/.ssh/id_ed25519.pub";
|
|
mode = "0644";
|
|
owner = "${username}";
|
|
};
|
|
"github-access-token" = {
|
|
mode = "0655";
|
|
};
|
|
"software/postgres/baseddata_models/password" = {};
|
|
"software/postgres/baseddata_models/ip" = {};
|
|
"software/postgres/baseddata_models/username" = {};
|
|
"software/postgres/osm/password" = {};
|
|
"software/postgres/osm/ip" = {};
|
|
"software/postgres/osm/username" = {};
|
|
"software/postgres/bitcoin/password" = {};
|
|
"software/postgres/bitcoin/ip" = {};
|
|
"software/postgres/bitcoin/username" = {};
|
|
"software/postgres/baseddata/user_password" = {};
|
|
"software/postgres/baseddata/user_username" = {};
|
|
"software/zotero/username" = {};
|
|
"software/zotero/password" = {};
|
|
"software/zotero/guid" = {};
|
|
};
|
|
|
|
# Setup software specific templates for user
|
|
# Should be part of home-manager - waiting for templates functionality
|
|
# See here https://github.com/Mic92/sops-nix/issues/423 and here https://github.com/Mic92/sops-nix/issues/498
|
|
# TODO: migrate db_ui connection to home-manager when issue 423 and 498 are resolved in github:Mic92/sops-nix
|
|
sops.templates."dbui_connections.json" = {
|
|
path = "/home/${username}/.local/share/db_ui/connections.json";
|
|
owner = "${username}";
|
|
mode = "0600";
|
|
content = ''
|
|
[
|
|
{
|
|
"url": "postgresql://${config.sops.placeholder."software/postgres/baseddata_models/username"}:${config.sops.placeholder."software/postgres/baseddata_models/password"}@${config.sops.placeholder."software/postgres/baseddata_models/ip"}/btc_models",
|
|
"name": "baseddata_models"
|
|
},
|
|
{
|
|
"url": "postgresql://${config.sops.placeholder."software/postgres/baseddata_models/username"}:${config.sops.placeholder."software/postgres/baseddata_models/password"}@${config.sops.placeholder."software/postgres/baseddata_models/ip"}/dev_baseddata_models",
|
|
"name": "dev_baseddata_models"
|
|
},
|
|
{
|
|
"url": "postgresql://${config.sops.placeholder."software/postgres/osm/username"}:${config.sops.placeholder."software/postgres/osm/password"}@${config.sops.placeholder."software/postgres/osm/ip"}/osm",
|
|
"name": "osm"
|
|
},
|
|
{
|
|
"url": "postgresql://${config.sops.placeholder."software/postgres/bitcoin/username"}:${config.sops.placeholder."software/postgres/bitcoin/password"}@${config.sops.placeholder."software/postgres/bitcoin/ip"}/bitcoin",
|
|
"name": "bitcoin"
|
|
},
|
|
{
|
|
"url": "postgresql://${config.sops.placeholder."software/postgres/baseddata/user_username"}:${config.sops.placeholder."software/postgres/baseddata/user_password"}@${baseddataPostgresIp}/baseddata",
|
|
"name": "baseddata"
|
|
}
|
|
]
|
|
'';
|
|
};
|
|
|
|
nix = {
|
|
extraOptions = ''
|
|
experimental-features = nix-command flakes
|
|
!include ${config.sops.secrets.github-access-token.path}
|
|
'';
|
|
};
|
|
# The containing folders are created as root and if this is the first entry when writing files,
|
|
# the ownership is busted and home-manager can't target because it can't write to these dirs...
|
|
# FIXME: We might not need this depending on how https://github.com/Mic92/sops-nix/issues/381 is fixed
|
|
system.activationScripts.sopsSetOwnwership = let
|
|
sshFolder = "/home/${username}/.ssh";
|
|
user = config.users.users.${username}.name;
|
|
group = config.users.users.${username}.group;
|
|
in ''
|
|
mkdir -p ${sshFolder} || true
|
|
chown -R ${user}:${group} /home/${username}/.ssh
|
|
'';
|
|
|
|
environment.persistence."/persist" = {
|
|
directories = [
|
|
"/home/${username}"
|
|
"/var/lib/tailscale"
|
|
];
|
|
};
|
|
|
|
programs.zsh.enable = true;
|
|
|
|
home-manager = {
|
|
extraSpecialArgs = {inherit inputs;};
|
|
users = {
|
|
${username} = import ../../../../home/${hostname}.nix;
|
|
};
|
|
};
|
|
}
|