mirror of
https://github.com/Swarsel/.dotfiles.git
synced 2025-12-06 00:57:22 +01:00
feat: add globals system
This commit is contained in:
Leon Schwarzäugl
parent
6cac368378
commit
2aa5e0095c
GPG key ID:
26A54C31F2A4FD84
31 changed files with 833 additions and 528 deletions
|
|
@ -155,21 +155,123 @@ In =outputs = inputs@ [...]=, the =inputs@= makes it so that all inputs are auto
|
|||
}:
|
||||
let
|
||||
<<flakelet>>
|
||||
in
|
||||
inputs.flake-parts.lib.mkFlake { inherit inputs; } {
|
||||
imports = [
|
||||
./nix/globals.nix
|
||||
];
|
||||
flake = { config, ... }:
|
||||
let
|
||||
<<flakelet>>
|
||||
|
||||
linuxUser = "swarsel";
|
||||
macUser = "leon.schwarzaeugl";
|
||||
|
||||
mkFullHost = host: type: {
|
||||
${host} =
|
||||
let
|
||||
systemFunc = if (type == "nixos") then lib.nixosSystem else inputs.nix-darwin.lib.darwinSystem;
|
||||
in
|
||||
systemFunc {
|
||||
specialArgs = { inherit inputs outputs lib self; inherit (config) globals; };
|
||||
modules = [
|
||||
{
|
||||
node.name = host;
|
||||
node.secretsDir = ./hosts/${type}/${host}/secrets;
|
||||
}
|
||||
# put inports here that are for all hosts
|
||||
inputs.disko.nixosModules.disko
|
||||
inputs.sops-nix.nixosModules.sops
|
||||
inputs.impermanence.nixosModules.impermanence
|
||||
inputs.lanzaboote.nixosModules.lanzaboote
|
||||
inputs.fw-fanctrl.nixosModules.default
|
||||
"${self}/hosts/${type}/${host}"
|
||||
{
|
||||
_module.args.primaryUser = linuxUser;
|
||||
}
|
||||
] ++
|
||||
(if (host == "iso") then [
|
||||
inputs.nix-topology.nixosModules.default
|
||||
] else
|
||||
([
|
||||
# put nixos imports here that are for all servers and normal hosts
|
||||
inputs.nix-topology.nixosModules.default
|
||||
"${self}/modules/${type}/common"
|
||||
inputs.stylix.nixosModules.stylix
|
||||
inputs.nswitch-rcm-nix.nixosModules.nswitch-rcm
|
||||
] ++ (if (type == "nixos") then [
|
||||
inputs.home-manager.nixosModules.home-manager
|
||||
"${self}/profiles/nixos"
|
||||
"${self}/modules/nixos/server"
|
||||
"${self}/modules/nixos/optional"
|
||||
{
|
||||
home-manager.users."${linuxUser}".imports = [
|
||||
# put home-manager imports here that are for all normal hosts
|
||||
"${self}/modules/home/common"
|
||||
"${self}/modules/home/server"
|
||||
"${self}/modules/home/optional"
|
||||
"${self}/profiles/home"
|
||||
];
|
||||
}
|
||||
] else [
|
||||
# put nixos imports here that are for darwin hosts
|
||||
"${self}/modules/darwin/nixos/common"
|
||||
"${self}/profiles/darwin"
|
||||
inputs.home-manager.darwinModules.home-manager
|
||||
{
|
||||
home-manager.users."${macUser}".imports = [
|
||||
# put home-manager imports here that are for darwin hosts
|
||||
"${self}/modules/darwin/home"
|
||||
"${self}/modules/home/server"
|
||||
"${self}/modules/home/optional"
|
||||
"${self}/profiles/home"
|
||||
];
|
||||
}
|
||||
])
|
||||
));
|
||||
};
|
||||
};
|
||||
|
||||
mkHalfHost = host: type: pkgs: {
|
||||
${host} =
|
||||
let
|
||||
systemFunc = if (type == "home") then inputs.home-manager.lib.homeManagerConfiguration else inputs.nix-on-droid.lib.nixOnDroidConfiguration;
|
||||
in
|
||||
systemFunc
|
||||
{
|
||||
inherit pkgs;
|
||||
extraSpecialArgs = { inherit inputs outputs lib self; };
|
||||
modules = [ "${self}/hosts/${type}/${host}" ];
|
||||
};
|
||||
};
|
||||
|
||||
mkFullHostConfigs = hosts: type: lib.foldl (acc: set: acc // set) { } (lib.map (host: mkFullHost host type) hosts);
|
||||
|
||||
mkHalfHostConfigs = hosts: type: pkgs: lib.foldl (acc: set: acc // set) { } (lib.map (host: mkHalfHost host type pkgs) hosts);
|
||||
|
||||
in
|
||||
{
|
||||
<<flakeoutputgeneral>>
|
||||
|
||||
nixosConfigurations =
|
||||
<<flakenixosconf>>
|
||||
homeConfigurations =
|
||||
<<flakehomeconf>>
|
||||
darwinConfigurations =
|
||||
<<flakedarwinconf>>
|
||||
nixOnDroidConfigurations =
|
||||
<<flakedroidconf>>
|
||||
nixosConfigurations = mkFullHostConfigs (lib.swarselsystems.readHosts "nixos") "nixos";
|
||||
homeConfigurations = mkHalfHostConfigs (lib.swarselsystems.readHosts "home") "home" lib.swarselsystems.pkgsFor.x86_64-linux;
|
||||
darwinConfigurations = mkFullHostConfigs (lib.swarselsystems.readHosts "darwin") "darwin";
|
||||
nixOnDroidConfigurations = mkHalfHostConfigs (lib.swarselsystems.readHosts "android") "android" lib.swarselsystems.pkgsFor.aarch64-linux;
|
||||
|
||||
topology =
|
||||
<<topologyconf>>
|
||||
topology = lib.swarselsystems.forEachSystem (pkgs: import inputs.nix-topology {
|
||||
inherit pkgs;
|
||||
modules = [
|
||||
"${self}/topology"
|
||||
{ inherit (self) nixosConfigurations; }
|
||||
];
|
||||
});
|
||||
|
||||
nodes = config.nixosConfigurations;
|
||||
};
|
||||
systems = [
|
||||
"x86_64-linux"
|
||||
"aarch64-linux"
|
||||
];
|
||||
};
|
||||
}
|
||||
#+end_src
|
||||
|
|
@ -304,6 +406,7 @@ When setting this option normally, the password would normally be written world-
|
|||
inputs.nixpkgs.follows = "nixpkgs";
|
||||
};
|
||||
nix-topology.url = "github:oddlama/nix-topology";
|
||||
flake-parts.url = "github:hercules-ci/flake-parts";
|
||||
#+end_src
|
||||
** let
|
||||
:PROPERTIES:
|
||||
|
|
@ -497,7 +600,6 @@ Note: The preceding =nixosConfigurations= is found in [[#h:aee5ec75-7ca6-40d8-b6
|
|||
|
||||
|
||||
#+begin_src nix :tangle no :noweb-ref flakenixosconf
|
||||
lib.swarselsystems.mkFullHostConfigs (lib.swarselsystems.readHosts "nixos") "nixos";
|
||||
#+end_src
|
||||
** darwinConfigurations
|
||||
:PROPERTIES:
|
||||
|
|
@ -510,7 +612,6 @@ Note: The preceding =darwinConfigurations= is found in [[#h:aee5ec75-7ca6-40d8-b
|
|||
=3a272b1 feat!: dynamically create hosts=, and the deprecated system definitions removed in =7457109 main chore: remove deprecated static host config=. See those commits for a state with a simpler config.
|
||||
|
||||
#+begin_src nix :tangle no :noweb-ref flakedarwinconf
|
||||
lib.swarselsystems.mkFullHostConfigs (lib.swarselsystems.readHosts "darwin") "darwin";
|
||||
#+end_src
|
||||
|
||||
** homeConfigurations
|
||||
|
|
@ -530,7 +631,6 @@ In contrast, this defines home-manager systems, which I only have one of, that s
|
|||
# ];
|
||||
# };
|
||||
|
||||
lib.swarselsystems.mkHalfHostConfigs (lib.swarselsystems.readHosts "home") "home" lib.swarselsystems.pkgsFor.x86_64-linux;
|
||||
#+end_src
|
||||
|
||||
** nixOnDroidConfigurations
|
||||
|
|
@ -549,7 +649,6 @@ Nix on Android also demands an own flake output, which is provided here.
|
|||
# ];
|
||||
# };
|
||||
|
||||
lib.swarselsystems.mkHalfHostConfigs (lib.swarselsystems.readHosts "android") "android" lib.swarselsystems.pkgsFor.aarch64-linux;
|
||||
|
||||
#+end_src
|
||||
|
||||
|
|
@ -561,13 +660,6 @@ Nix on Android also demands an own flake output, which is provided here.
|
|||
|
||||
#+begin_src nix :tangle no :noweb-ref topologyconf
|
||||
|
||||
lib.swarselsystems.forEachSystem (pkgs: import inputs.nix-topology {
|
||||
inherit pkgs;
|
||||
modules = [
|
||||
"${self}/topology"
|
||||
{ inherit (self) nixosConfigurations; }
|
||||
];
|
||||
});
|
||||
|
||||
#+end_src
|
||||
|
||||
|
|
@ -2133,6 +2225,9 @@ Also, an initial bash history is provided to allow for a very quick local deploy
|
|||
"${self}/modules/nixos/common/topology.nix"
|
||||
"${self}/modules/home/common/sharedsetup.nix"
|
||||
|
||||
"${self}/modules/nixos/common/globals.nix"
|
||||
|
||||
|
||||
inputs.home-manager.nixosModules.home-manager
|
||||
{
|
||||
home-manager.users."${primaryUser}".imports = [
|
||||
|
|
@ -5092,11 +5187,7 @@ The interesting part is in the start:
|
|||
TODO
|
||||
|
||||
#+begin_src nix :tangle lib/default.nix
|
||||
{ self, lib, systems, inputs, outputs, ... }:
|
||||
let
|
||||
linuxUser = "swarsel";
|
||||
macUser = "leon.schwarzaeugl";
|
||||
in
|
||||
{ self, lib, systems, inputs, ... }:
|
||||
{
|
||||
|
||||
mkIfElseList = p: yes: no: lib.mkMerge [
|
||||
|
|
@ -5141,88 +5232,6 @@ TODO
|
|||
|
||||
forEachSystem = f: lib.genAttrs (import systems) (system: f lib.swarselsystems.pkgsFor.${system});
|
||||
|
||||
mkFullHost = host: type: {
|
||||
${host} =
|
||||
let
|
||||
systemFunc = if (type == "nixos") then lib.nixosSystem else inputs.nix-darwin.lib.darwinSystem;
|
||||
in
|
||||
systemFunc {
|
||||
specialArgs = { inherit inputs outputs lib self; };
|
||||
modules = [
|
||||
{
|
||||
node.name = host;
|
||||
node.secretsDir = ../hosts/${type}/${host}/secrets;
|
||||
}
|
||||
# put inports here that are for all hosts
|
||||
inputs.disko.nixosModules.disko
|
||||
inputs.sops-nix.nixosModules.sops
|
||||
inputs.impermanence.nixosModules.impermanence
|
||||
inputs.lanzaboote.nixosModules.lanzaboote
|
||||
inputs.fw-fanctrl.nixosModules.default
|
||||
"${self}/hosts/${type}/${host}"
|
||||
{
|
||||
_module.args.primaryUser = linuxUser;
|
||||
}
|
||||
] ++
|
||||
(if (host == "iso") then [
|
||||
inputs.nix-topology.nixosModules.default
|
||||
] else
|
||||
([
|
||||
# put nixos imports here that are for all servers and normal hosts
|
||||
inputs.nix-topology.nixosModules.default
|
||||
"${self}/modules/${type}/common"
|
||||
inputs.stylix.nixosModules.stylix
|
||||
inputs.nswitch-rcm-nix.nixosModules.nswitch-rcm
|
||||
] ++ (if (type == "nixos") then [
|
||||
inputs.home-manager.nixosModules.home-manager
|
||||
"${self}/profiles/nixos"
|
||||
"${self}/modules/nixos/server"
|
||||
"${self}/modules/nixos/optional"
|
||||
{
|
||||
home-manager.users."${linuxUser}".imports = [
|
||||
# put home-manager imports here that are for all normal hosts
|
||||
"${self}/modules/home/common"
|
||||
"${self}/modules/home/server"
|
||||
"${self}/modules/home/optional"
|
||||
"${self}/profiles/home"
|
||||
];
|
||||
}
|
||||
] else [
|
||||
# put nixos imports here that are for darwin hosts
|
||||
"${self}/modules/darwin/nixos/common"
|
||||
"${self}/profiles/darwin"
|
||||
inputs.home-manager.darwinModules.home-manager
|
||||
{
|
||||
home-manager.users."${macUser}".imports = [
|
||||
# put home-manager imports here that are for darwin hosts
|
||||
"${self}/modules/darwin/home"
|
||||
"${self}/modules/home/server"
|
||||
"${self}/modules/home/optional"
|
||||
"${self}/profiles/home"
|
||||
];
|
||||
}
|
||||
])
|
||||
));
|
||||
};
|
||||
};
|
||||
|
||||
mkHalfHost = host: type: pkgs: {
|
||||
${host} =
|
||||
let
|
||||
systemFunc = if (type == "home") then inputs.home-manager.lib.homeManagerConfiguration else inputs.nix-on-droid.lib.nixOnDroidConfiguration;
|
||||
in
|
||||
systemFunc
|
||||
{
|
||||
inherit pkgs;
|
||||
extraSpecialArgs = { inherit inputs outputs lib self; };
|
||||
modules = [ "${self}/hosts/${type}/${host}" ];
|
||||
};
|
||||
};
|
||||
|
||||
mkFullHostConfigs = hosts: type: lib.foldl (acc: set: acc // set) { } (lib.map (host: lib.swarselsystems.mkFullHost host type) hosts);
|
||||
|
||||
mkHalfHostConfigs = hosts: type: pkgs: lib.foldl (acc: set: acc // set) { } (lib.map (host: lib.swarselsystems.mkHalfHost host type pkgs) hosts);
|
||||
|
||||
readHosts = type: lib.attrNames (builtins.readDir "${self}/hosts/${type}");
|
||||
readNix = type: lib.filter (name: name != "default.nix") (lib.attrNames (builtins.readDir "${self}/${type}"));
|
||||
|
||||
|
|
@ -5533,6 +5542,60 @@ in
|
|||
};
|
||||
}
|
||||
|
||||
#+end_src
|
||||
**** Globals
|
||||
|
||||
#+begin_src nix :tangle nix/globals.nix
|
||||
{ inputs, ... }:
|
||||
{
|
||||
flake =
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
...
|
||||
}:
|
||||
{
|
||||
globals =
|
||||
let
|
||||
globalsSystem = lib.evalModules {
|
||||
prefix = [ "globals" ];
|
||||
specialArgs = {
|
||||
inherit lib;
|
||||
inherit inputs;
|
||||
inherit (config) nodes;
|
||||
};
|
||||
modules = [
|
||||
../modules/nixos/common/globals.nix
|
||||
(
|
||||
{ lib, ... }:
|
||||
{
|
||||
globals = lib.mkMerge (
|
||||
lib.concatLists (
|
||||
lib.flip lib.mapAttrsToList config.nodes (
|
||||
name: cfg:
|
||||
builtins.addErrorContext "while aggregating globals from nixosConfigurations.${name} into flake-level globals:" cfg.config._globalsDefs
|
||||
)
|
||||
)
|
||||
);
|
||||
}
|
||||
)
|
||||
];
|
||||
};
|
||||
in
|
||||
{
|
||||
# Make sure the keys of this attrset are trivially evaluatable to avoid infinite recursion,
|
||||
# therefore we inherit relevant attributes from the config.
|
||||
inherit (globalsSystem.config.globals)
|
||||
domains
|
||||
services
|
||||
macs
|
||||
myuser
|
||||
root
|
||||
;
|
||||
};
|
||||
};
|
||||
}
|
||||
|
||||
#+end_src
|
||||
** NixOS
|
||||
:PROPERTIES:
|
||||
|
|
@ -5604,38 +5667,6 @@ I usually use =mutableUsers = false= in my NixOS configuration. However, on a ne
|
|||
isImpermanence = lib.mkEnableOption "use impermanence on this system";
|
||||
isSecureBoot = lib.mkEnableOption "use secure boot on this system";
|
||||
};
|
||||
globals = lib.mkOption {
|
||||
default = { };
|
||||
type = lib.types.submodule {
|
||||
options = {
|
||||
|
||||
services = lib.mkOption {
|
||||
type = lib.types.attrsOf (
|
||||
lib.types.submodule {
|
||||
options = {
|
||||
domain = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
description = "Domain that the service runs under";
|
||||
};
|
||||
};
|
||||
}
|
||||
);
|
||||
};
|
||||
domains = {
|
||||
main = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
description = "My main domain.";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
# _globalsDefs = lib.mkOption {
|
||||
# type = lib.types.unspecified;
|
||||
# default = options.globals.definitions;
|
||||
# readOnly = true;
|
||||
# internal = true;
|
||||
# };
|
||||
};
|
||||
}
|
||||
#+end_src
|
||||
|
|
@ -5810,6 +5841,86 @@ A breakdown of the flags being set:
|
|||
}
|
||||
#+end_src
|
||||
|
||||
**** Global options
|
||||
|
||||
#+begin_src nix :tangle modules/nixos/common/globals.nix
|
||||
{ lib, options, ... }:
|
||||
let
|
||||
inherit (lib)
|
||||
mkOption
|
||||
types
|
||||
;
|
||||
|
||||
in
|
||||
{
|
||||
options = {
|
||||
globals = mkOption {
|
||||
default = { };
|
||||
type = types.submodule {
|
||||
options = {
|
||||
root = {
|
||||
hashedPassword = mkOption {
|
||||
type = types.str;
|
||||
description = "My root user's password hash.";
|
||||
};
|
||||
};
|
||||
|
||||
myuser = {
|
||||
name = mkOption {
|
||||
type = types.str;
|
||||
description = "My unix username.";
|
||||
};
|
||||
hashedPassword = mkOption {
|
||||
type = types.str;
|
||||
description = "My unix password hash.";
|
||||
};
|
||||
};
|
||||
|
||||
|
||||
services = mkOption {
|
||||
type = types.attrsOf (
|
||||
types.submodule {
|
||||
options = {
|
||||
domain = mkOption {
|
||||
type = types.str;
|
||||
description = "The domain under which this service can be reached";
|
||||
};
|
||||
};
|
||||
}
|
||||
);
|
||||
};
|
||||
|
||||
domains = {
|
||||
me = mkOption {
|
||||
type = types.str;
|
||||
description = "My main domain.";
|
||||
};
|
||||
|
||||
personal = mkOption {
|
||||
type = types.str;
|
||||
description = "My personal domain.";
|
||||
};
|
||||
};
|
||||
|
||||
macs = mkOption {
|
||||
default = { };
|
||||
type = types.attrsOf types.str;
|
||||
description = "Known MAC addresses for external devices.";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
_globalsDefs = mkOption {
|
||||
type = types.unspecified;
|
||||
default = options.globals.definitions;
|
||||
readOnly = true;
|
||||
internal = true;
|
||||
};
|
||||
};
|
||||
}
|
||||
#+end_src
|
||||
|
||||
**** System Packages
|
||||
:PROPERTIES:
|
||||
:CUSTOM_ID: h:0e7e8bea-ec58-499c-9731-09dddfc39532
|
||||
|
|
@ -7910,7 +8021,7 @@ Here I am forcing =startWhenNeeded= to false so that the value will not be set t
|
|||
let
|
||||
serviceName = "kavita";
|
||||
serviceUser = "kavita";
|
||||
serviceDomain = "scroll.swarsel.win";
|
||||
serviceDomain = config.repo.secrets.common.services.domains.${serviceName};
|
||||
servicePort = 8080;
|
||||
in
|
||||
{
|
||||
|
|
@ -7933,6 +8044,7 @@ Here I am forcing =startWhenNeeded= to false so that the value will not be set t
|
|||
info = "https://${serviceDomain}";
|
||||
icon = "${self}/topology/images/kavita.png";
|
||||
};
|
||||
globals.services.${serviceName}.domain = serviceDomain;
|
||||
|
||||
services.kavita = {
|
||||
enable = true;
|
||||
|
|
@ -8002,7 +8114,8 @@ Here I am forcing =startWhenNeeded= to false so that the value will not be set t
|
|||
];
|
||||
};
|
||||
|
||||
topology.self.services.jellyfin.info = "https://${serviceDomain}";
|
||||
topology.self.services.${serviceName}.info = "https://${serviceDomain}";
|
||||
globals.services.${serviceName}.domain = serviceDomain;
|
||||
|
||||
services.jellyfin = {
|
||||
enable = true;
|
||||
|
|
@ -8085,6 +8198,8 @@ Here I am forcing =startWhenNeeded= to false so that the value will not be set t
|
|||
|
||||
networking.firewall.allowedTCPPorts = [ 4040 ];
|
||||
|
||||
globals.services.${serviceName}.domain = serviceDomain;
|
||||
|
||||
services.navidrome = {
|
||||
enable = true;
|
||||
openFirewall = true;
|
||||
|
|
@ -8444,6 +8559,8 @@ Here I am forcing =startWhenNeeded= to false so that the value will not be set t
|
|||
};
|
||||
};
|
||||
|
||||
globals.services.${serviceName}.domain = matrixDomain;
|
||||
|
||||
services = {
|
||||
postgresql = {
|
||||
enable = true;
|
||||
|
|
@ -8728,6 +8845,9 @@ Here I am forcing =startWhenNeeded= to false so that the value will not be set t
|
|||
};
|
||||
};
|
||||
|
||||
|
||||
globals.services.${serviceName}.domain = serviceDomain;
|
||||
|
||||
services = {
|
||||
nextcloud = {
|
||||
enable = true;
|
||||
|
|
@ -8785,7 +8905,7 @@ Here I am forcing =startWhenNeeded= to false so that the value will not be set t
|
|||
:END:
|
||||
|
||||
#+begin_src nix :tangle modules/nixos/server/immich.nix
|
||||
{ lib, config, ... }:
|
||||
{ lib, config, globals, ... }:
|
||||
let
|
||||
serviceDomain = "shots.swarsel.win";
|
||||
servicePort = 3001;
|
||||
|
|
@ -8800,7 +8920,8 @@ Here I am forcing =startWhenNeeded= to false so that the value will not be set t
|
|||
extraGroups = [ "video" "render" "users" ];
|
||||
};
|
||||
|
||||
topology.self.services.immich.info = "https://${serviceDomain}";
|
||||
topology.self.services.${serviceName}.info = "https://${serviceDomain}";
|
||||
globals.services.${serviceName}.domain = serviceDomain;
|
||||
|
||||
services.immich = {
|
||||
enable = true;
|
||||
|
|
@ -8891,6 +9012,8 @@ Also I install Tika and Gotenberg, which are needed to create PDFs out of =.eml=
|
|||
|
||||
networking.firewall.allowedTCPPorts = [ servicePort ];
|
||||
|
||||
globals.services.${serviceName}.domain = serviceDomain;
|
||||
|
||||
services = {
|
||||
paperless = {
|
||||
enable = true;
|
||||
|
|
@ -9085,6 +9208,8 @@ Also I install Tika and Gotenberg, which are needed to create PDFs out of =.eml=
|
|||
prowlarr.info = "https://${serviceDomain}/prowlarr";
|
||||
};
|
||||
|
||||
globals.services.transmission.domain = serviceDomain;
|
||||
|
||||
services = {
|
||||
radarr = {
|
||||
enable = true;
|
||||
|
|
@ -9206,6 +9331,8 @@ Also I install Tika and Gotenberg, which are needed to create PDFs out of =.eml=
|
|||
|
||||
networking.firewall.allowedTCPPorts = [ servicePort ];
|
||||
|
||||
globals.services.${serviceName}.domain = serviceDomain;
|
||||
|
||||
services.syncthing = {
|
||||
enable = true;
|
||||
user = serviceUser;
|
||||
|
|
@ -9420,6 +9547,7 @@ This section exposes several metrics that I use to check the health of my server
|
|||
networking.firewall.allowedTCPPorts = [ servicePort prometheusPort ];
|
||||
|
||||
topology.self.services.prometheus.info = "https://${serviceDomain}/${prometheusWebRoot}";
|
||||
globals.services.${moduleName}.domain = serviceDomain;
|
||||
|
||||
services = {
|
||||
grafana = {
|
||||
|
|
@ -9746,12 +9874,14 @@ FreshRSS claims to support HTTP header auth, but at least it does not work with
|
|||
# };
|
||||
};
|
||||
|
||||
topology.self.services.freshrss = {
|
||||
topology.self.services.${serviceName} = {
|
||||
name = "FreshRSS";
|
||||
info = "https://${serviceDomain}";
|
||||
icon = "${self}/topology/images/freshrss.png";
|
||||
};
|
||||
|
||||
globals.services.${serviceName}.domain = serviceDomain;
|
||||
|
||||
services.freshrss = {
|
||||
enable = true;
|
||||
virtualHost = serviceDomain;
|
||||
|
|
@ -9829,6 +9959,8 @@ FreshRSS claims to support HTTP header auth, but at least it does not work with
|
|||
kanidm-forgejo-client = { owner = serviceUser; group = serviceGroup; mode = "0440"; };
|
||||
};
|
||||
|
||||
globals.services.${serviceName}.domain = serviceDomain;
|
||||
|
||||
services.forgejo = {
|
||||
enable = true;
|
||||
user = serviceUser;
|
||||
|
|
@ -9976,11 +10108,13 @@ FreshRSS claims to support HTTP header auth, but at least it does not work with
|
|||
|
||||
sops.secrets.swarsel = { owner = "root"; };
|
||||
|
||||
topology.self.services.anki = {
|
||||
topology.self.services.${serviceName} = {
|
||||
name = lib.mkForce "Anki Sync Server";
|
||||
info = "https://${serviceDomain}";
|
||||
};
|
||||
|
||||
globals.services.${serviceName}.domain = serviceDomain;
|
||||
|
||||
services.anki-sync-server = {
|
||||
enable = true;
|
||||
port = servicePort;
|
||||
|
|
@ -10036,7 +10170,7 @@ A stupid (but simple) way to get the =originUrl= is to simply set any URL there
|
|||
To get other URLs (token, etc.), use https://<kanidmDomain>/oauth2/openid/<clientID>/.well-known/oauth-authorization-server, e.g. https://sso.swarsel.win/oauth2/openid/nextcloud/.well-known/oauth-authorization-server, with clienID being the client name as specified in kanidm.
|
||||
|
||||
#+begin_src nix :tangle modules/nixos/server/kanidm.nix
|
||||
{ self, lib, pkgs, config, ... }:
|
||||
{ self, lib, pkgs, config, globals, ... }:
|
||||
let
|
||||
certsSopsFile = self + /secrets/certs/secrets.yaml;
|
||||
serviceDomain = "sso.swarsel.win";
|
||||
|
|
@ -10044,7 +10178,7 @@ To get other URLs (token, etc.), use https://<kanidmDomain>/oauth2/openid/<clien
|
|||
serviceUser = "kanidm";
|
||||
serviceGroup = serviceUser;
|
||||
serviceName = "kanidm";
|
||||
oauth2ProxyDomain = "soauth.swarsel.win";
|
||||
oauth2ProxyDomain = globals.services.oauth2Proxy.domain;
|
||||
in
|
||||
{
|
||||
options.swarselsystems.modules.server."${serviceName}" = lib.mkEnableOption "enable ${serviceName} on server";
|
||||
|
|
@ -10075,6 +10209,8 @@ To get other URLs (token, etc.), use https://<kanidmDomain>/oauth2/openid/<clien
|
|||
|
||||
networking.firewall.allowedTCPPorts = [ servicePort ];
|
||||
|
||||
globals.services.${serviceName}.domain = serviceDomain;
|
||||
|
||||
services = {
|
||||
kanidm = {
|
||||
package = pkgs.kanidmWithSecretProvisioning;
|
||||
|
|
@ -10289,9 +10425,9 @@ To get other URLs (token, etc.), use https://<kanidmDomain>/oauth2/openid/<clien
|
|||
|
||||
|
||||
#+begin_src nix :tangle modules/nixos/server/oauth2-proxy.nix
|
||||
{ lib, config, ... }:
|
||||
{ lib, config, globals, ... }:
|
||||
let
|
||||
kanidmDomain = "sso.swarsel.win";
|
||||
kanidmDomain = globals.services.kanidm.domain;
|
||||
oauth2ProxyDomain = "soauth.swarsel.win";
|
||||
oauth2ProxyPort = 3004;
|
||||
in
|
||||
|
|
@ -10428,6 +10564,8 @@ To get other URLs (token, etc.), use https://<kanidmDomain>/oauth2/openid/<clien
|
|||
|
||||
networking.firewall.allowedTCPPorts = [ oauth2ProxyPort ];
|
||||
|
||||
globals.services.oauth2Proxy.domain = oauth2ProxyDomain;
|
||||
|
||||
services = {
|
||||
oauth2-proxy = {
|
||||
enable = true;
|
||||
|
|
@ -10515,7 +10653,7 @@ To get other URLs (token, etc.), use https://<kanidmDomain>/oauth2/openid/<clien
|
|||
{ self, lib, config, ... }:
|
||||
let
|
||||
cfg = config.services.firefly-iii;
|
||||
fireflyDomain = "stonks.swarsel.win";
|
||||
serviceDomain = "stonks.swarsel.win";
|
||||
fireflyUser = "firefly-iii";
|
||||
serviceName = "firefly";
|
||||
in
|
||||
|
|
@ -10536,9 +10674,10 @@ To get other URLs (token, etc.), use https://<kanidmDomain>/oauth2/openid/<clien
|
|||
|
||||
topology.self.services.firefly-iii = {
|
||||
name = "Firefly-III";
|
||||
info = "https://${fireflyDomain}";
|
||||
info = "https://${serviceDomain}";
|
||||
icon = "${self}/topology/images/firefly-iii.png";
|
||||
};
|
||||
globals.services.${serviceName}.domain = serviceDomain;
|
||||
|
||||
services = {
|
||||
firefly-iii = {
|
||||
|
|
@ -10548,7 +10687,7 @@ To get other URLs (token, etc.), use https://<kanidmDomain>/oauth2/openid/<clien
|
|||
dataDir = "/Vault/data/firefly-iii";
|
||||
settings = {
|
||||
TZ = config.repo.secrets.common.location.timezone;
|
||||
APP_URL = "https://${fireflyDomain}";
|
||||
APP_URL = "https://${serviceDomain}";
|
||||
APP_KEY_FILE = config.sops.secrets.firefly-iii-app-key.path;
|
||||
APP_ENV = "local";
|
||||
DB_CONNECTION = "sqlite";
|
||||
|
|
@ -10559,12 +10698,12 @@ To get other URLs (token, etc.), use https://<kanidmDomain>/oauth2/openid/<clien
|
|||
# AUTHENTICATION_GUARD_EMAIL = "X-Email";
|
||||
};
|
||||
enableNginx = true;
|
||||
virtualHost = fireflyDomain;
|
||||
virtualHost = serviceDomain;
|
||||
};
|
||||
|
||||
nginx = {
|
||||
virtualHosts = {
|
||||
"${fireflyDomain}" = {
|
||||
"${serviceDomain}" = {
|
||||
locations = {
|
||||
"/api" = {
|
||||
setOauth2Headers = false;
|
||||
|
|
@ -10589,7 +10728,7 @@ To get other URLs (token, etc.), use https://<kanidmDomain>/oauth2/openid/<clien
|
|||
};
|
||||
};
|
||||
virtualHosts = {
|
||||
"${fireflyDomain}" = {
|
||||
"${serviceDomain}" = {
|
||||
enableACME = true;
|
||||
forceSSL = true;
|
||||
acmeRoot = null;
|
||||
|
|
@ -10645,6 +10784,7 @@ To get other URLs (token, etc.), use https://<kanidmDomain>/oauth2/openid/<clien
|
|||
info = "https://${serviceDomain}";
|
||||
icon = "${self}/topology/images/koillection.png";
|
||||
};
|
||||
globals.services.${serviceName}.domain = serviceDomain;
|
||||
|
||||
virtualisation.oci-containers.containers = {
|
||||
koillection = {
|
||||
|
|
@ -10757,7 +10897,8 @@ To get other URLs (token, etc.), use https://<kanidmDomain>/oauth2/openid/<clien
|
|||
options.swarselsystems.modules.server."${serviceName}" = lib.mkEnableOption "enable ${serviceName} on server";
|
||||
config = lib.mkIf config.swarselsystems.modules.server."${serviceName}" {
|
||||
|
||||
topology.self.services.atuin.info = "https://${serviceDomain}";
|
||||
topology.self.services.${serviceName}.info = "https://${serviceDomain}";
|
||||
globals.services.${serviceName}.domain = serviceDomain;
|
||||
|
||||
services.atuin = {
|
||||
enable = true;
|
||||
|
|
@ -10834,7 +10975,8 @@ To get other URLs (token, etc.), use https://<kanidmDomain>/oauth2/openid/<clien
|
|||
};
|
||||
};
|
||||
|
||||
topology.self.services.radicale.info = "https://${serviceDomain}";
|
||||
topology.self.services.${serviceName}.info = "https://${serviceDomain}";
|
||||
globals.services.${serviceName}.domain = serviceDomain;
|
||||
|
||||
services.radicale = {
|
||||
enable = true;
|
||||
|
|
@ -10950,7 +11092,8 @@ To get other URLs (token, etc.), use https://<kanidmDomain>/oauth2/openid/<clien
|
|||
};
|
||||
};
|
||||
|
||||
topology.self.services.croc.info = "https://${serviceDomain}";
|
||||
topology.self.services.${serviceName}.info = "https://${serviceDomain}";
|
||||
globals.services.${serviceName}.domain = serviceDomain;
|
||||
|
||||
services.croc = {
|
||||
enable = true;
|
||||
|
|
@ -11029,7 +11172,8 @@ To get other URLs (token, etc.), use https://<kanidmDomain>/oauth2/openid/<clien
|
|||
};
|
||||
};
|
||||
|
||||
topology.self.services."${serviceName}".info = "https://${serviceDomain}";
|
||||
topology.self.services.${serviceName}.info = "https://${serviceDomain}";
|
||||
globals.services.${serviceName}.domain = serviceDomain;
|
||||
|
||||
services."${serviceName}" = {
|
||||
enable = true;
|
||||
|
|
@ -11167,6 +11311,9 @@ To get other URLs (token, etc.), use https://<kanidmDomain>/oauth2/openid/<clien
|
|||
{ directory = "/var/lib/containers"; }
|
||||
];
|
||||
|
||||
topology.self.services.${serviceName}.info = "https://${serviceDomain}";
|
||||
globals.services.${serviceName}.domain = serviceDomain;
|
||||
|
||||
services.nginx = {
|
||||
upstreams = {
|
||||
"${serviceName}" = {
|
||||
|
|
|
|||
50
flake.lock
generated
50
flake.lock
generated
|
|
@ -270,6 +270,24 @@
|
|||
}
|
||||
},
|
||||
"flake-parts": {
|
||||
"inputs": {
|
||||
"nixpkgs-lib": "nixpkgs-lib"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1749398372,
|
||||
"narHash": "sha256-tYBdgS56eXYaWVW3fsnPQ/nFlgWi/Z2Ymhyu21zVM98=",
|
||||
"owner": "hercules-ci",
|
||||
"repo": "flake-parts",
|
||||
"rev": "9305fe4e5c2a6fcf5ba6a3ff155720fbe4076569",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "hercules-ci",
|
||||
"repo": "flake-parts",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"flake-parts_2": {
|
||||
"inputs": {
|
||||
"nixpkgs-lib": [
|
||||
"lanzaboote",
|
||||
|
|
@ -290,9 +308,9 @@
|
|||
"type": "github"
|
||||
}
|
||||
},
|
||||
"flake-parts_2": {
|
||||
"flake-parts_3": {
|
||||
"inputs": {
|
||||
"nixpkgs-lib": "nixpkgs-lib"
|
||||
"nixpkgs-lib": "nixpkgs-lib_2"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1719994518,
|
||||
|
|
@ -307,7 +325,7 @@
|
|||
"type": "indirect"
|
||||
}
|
||||
},
|
||||
"flake-parts_3": {
|
||||
"flake-parts_4": {
|
||||
"inputs": {
|
||||
"nixpkgs-lib": [
|
||||
"nur",
|
||||
|
|
@ -328,7 +346,7 @@
|
|||
"type": "github"
|
||||
}
|
||||
},
|
||||
"flake-parts_4": {
|
||||
"flake-parts_5": {
|
||||
"inputs": {
|
||||
"nixpkgs-lib": [
|
||||
"stylix",
|
||||
|
|
@ -649,7 +667,7 @@
|
|||
"inputs": {
|
||||
"crane": "crane",
|
||||
"flake-compat": "flake-compat_2",
|
||||
"flake-parts": "flake-parts",
|
||||
"flake-parts": "flake-parts_2",
|
||||
"nixpkgs": "nixpkgs",
|
||||
"pre-commit-hooks-nix": "pre-commit-hooks-nix",
|
||||
"rust-overlay": "rust-overlay"
|
||||
|
|
@ -973,6 +991,21 @@
|
|||
}
|
||||
},
|
||||
"nixpkgs-lib": {
|
||||
"locked": {
|
||||
"lastModified": 1748740939,
|
||||
"narHash": "sha256-rQaysilft1aVMwF14xIdGS3sj1yHlI6oKQNBRTF40cc=",
|
||||
"owner": "nix-community",
|
||||
"repo": "nixpkgs.lib",
|
||||
"rev": "656a64127e9d791a334452c6b6606d17539476e2",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "nix-community",
|
||||
"repo": "nixpkgs.lib",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"nixpkgs-lib_2": {
|
||||
"locked": {
|
||||
"lastModified": 1719876945,
|
||||
"narHash": "sha256-Fm2rDDs86sHy0/1jxTOKB1118Q0O3Uc7EC0iXvXKpbI=",
|
||||
|
|
@ -1247,7 +1280,7 @@
|
|||
},
|
||||
"nswitch-rcm-nix": {
|
||||
"inputs": {
|
||||
"flake-parts": "flake-parts_2",
|
||||
"flake-parts": "flake-parts_3",
|
||||
"nixpkgs": "nixpkgs_6"
|
||||
},
|
||||
"locked": {
|
||||
|
|
@ -1266,7 +1299,7 @@
|
|||
},
|
||||
"nur": {
|
||||
"inputs": {
|
||||
"flake-parts": "flake-parts_3",
|
||||
"flake-parts": "flake-parts_4",
|
||||
"nixpkgs": "nixpkgs_7",
|
||||
"treefmt-nix": "treefmt-nix"
|
||||
},
|
||||
|
|
@ -1389,6 +1422,7 @@
|
|||
"inputs": {
|
||||
"disko": "disko",
|
||||
"emacs-overlay": "emacs-overlay",
|
||||
"flake-parts": "flake-parts",
|
||||
"fw-fanctrl": "fw-fanctrl",
|
||||
"home-manager": "home-manager",
|
||||
"impermanence": "impermanence",
|
||||
|
|
@ -1501,7 +1535,7 @@
|
|||
"base16-vim": "base16-vim",
|
||||
"firefox-gnome-theme": "firefox-gnome-theme",
|
||||
"flake-compat": "flake-compat_6",
|
||||
"flake-parts": "flake-parts_4",
|
||||
"flake-parts": "flake-parts_5",
|
||||
"git-hooks": "git-hooks",
|
||||
"gnome-shell": "gnome-shell",
|
||||
"home-manager": "home-manager_3",
|
||||
|
|
|
|||
138
flake.nix
138
flake.nix
|
|
@ -83,6 +83,7 @@
|
|||
inputs.nixpkgs.follows = "nixpkgs";
|
||||
};
|
||||
nix-topology.url = "github:oddlama/nix-topology";
|
||||
flake-parts.url = "github:hercules-ci/flake-parts";
|
||||
};
|
||||
outputs =
|
||||
inputs@{ self
|
||||
|
|
@ -96,6 +97,103 @@
|
|||
inherit (self) outputs;
|
||||
lib = (nixpkgs.lib // home-manager.lib).extend (_: _: { swarselsystems = import ./lib { inherit self lib inputs outputs systems; }; });
|
||||
|
||||
in
|
||||
inputs.flake-parts.lib.mkFlake { inherit inputs; } {
|
||||
imports = [
|
||||
./nix/globals.nix
|
||||
];
|
||||
flake = { config, ... }:
|
||||
let
|
||||
|
||||
inherit (self) outputs;
|
||||
lib = (nixpkgs.lib // home-manager.lib).extend (_: _: { swarselsystems = import ./lib { inherit self lib inputs outputs systems; }; });
|
||||
|
||||
|
||||
linuxUser = "swarsel";
|
||||
macUser = "leon.schwarzaeugl";
|
||||
|
||||
mkFullHost = host: type: {
|
||||
${host} =
|
||||
let
|
||||
systemFunc = if (type == "nixos") then lib.nixosSystem else inputs.nix-darwin.lib.darwinSystem;
|
||||
in
|
||||
systemFunc {
|
||||
specialArgs = { inherit inputs outputs lib self; inherit (config) globals; };
|
||||
modules = [
|
||||
{
|
||||
node.name = host;
|
||||
node.secretsDir = ./hosts/${type}/${host}/secrets;
|
||||
}
|
||||
# put inports here that are for all hosts
|
||||
inputs.disko.nixosModules.disko
|
||||
inputs.sops-nix.nixosModules.sops
|
||||
inputs.impermanence.nixosModules.impermanence
|
||||
inputs.lanzaboote.nixosModules.lanzaboote
|
||||
inputs.fw-fanctrl.nixosModules.default
|
||||
"${self}/hosts/${type}/${host}"
|
||||
{
|
||||
_module.args.primaryUser = linuxUser;
|
||||
}
|
||||
] ++
|
||||
(if (host == "iso") then [
|
||||
inputs.nix-topology.nixosModules.default
|
||||
] else
|
||||
([
|
||||
# put nixos imports here that are for all servers and normal hosts
|
||||
inputs.nix-topology.nixosModules.default
|
||||
"${self}/modules/${type}/common"
|
||||
inputs.stylix.nixosModules.stylix
|
||||
inputs.nswitch-rcm-nix.nixosModules.nswitch-rcm
|
||||
] ++ (if (type == "nixos") then [
|
||||
inputs.home-manager.nixosModules.home-manager
|
||||
"${self}/profiles/nixos"
|
||||
"${self}/modules/nixos/server"
|
||||
"${self}/modules/nixos/optional"
|
||||
{
|
||||
home-manager.users."${linuxUser}".imports = [
|
||||
# put home-manager imports here that are for all normal hosts
|
||||
"${self}/modules/home/common"
|
||||
"${self}/modules/home/server"
|
||||
"${self}/modules/home/optional"
|
||||
"${self}/profiles/home"
|
||||
];
|
||||
}
|
||||
] else [
|
||||
# put nixos imports here that are for darwin hosts
|
||||
"${self}/modules/darwin/nixos/common"
|
||||
"${self}/profiles/darwin"
|
||||
inputs.home-manager.darwinModules.home-manager
|
||||
{
|
||||
home-manager.users."${macUser}".imports = [
|
||||
# put home-manager imports here that are for darwin hosts
|
||||
"${self}/modules/darwin/home"
|
||||
"${self}/modules/home/server"
|
||||
"${self}/modules/home/optional"
|
||||
"${self}/profiles/home"
|
||||
];
|
||||
}
|
||||
])
|
||||
));
|
||||
};
|
||||
};
|
||||
|
||||
mkHalfHost = host: type: pkgs: {
|
||||
${host} =
|
||||
let
|
||||
systemFunc = if (type == "home") then inputs.home-manager.lib.homeManagerConfiguration else inputs.nix-on-droid.lib.nixOnDroidConfiguration;
|
||||
in
|
||||
systemFunc
|
||||
{
|
||||
inherit pkgs;
|
||||
extraSpecialArgs = { inherit inputs outputs lib self; };
|
||||
modules = [ "${self}/hosts/${type}/${host}" ];
|
||||
};
|
||||
};
|
||||
|
||||
mkFullHostConfigs = hosts: type: lib.foldl (acc: set: acc // set) { } (lib.map (host: mkFullHost host type) hosts);
|
||||
|
||||
mkHalfHostConfigs = hosts: type: pkgs: lib.foldl (acc: set: acc // set) { } (lib.map (host: mkHalfHost host type pkgs) hosts);
|
||||
|
||||
in
|
||||
{
|
||||
inherit lib;
|
||||
|
|
@ -168,36 +266,12 @@
|
|||
|
||||
diskoConfigurations.default = import .templates/hosts/nixos/disk-config.nix;
|
||||
|
||||
nixosConfigurations =
|
||||
lib.swarselsystems.mkFullHostConfigs (lib.swarselsystems.readHosts "nixos") "nixos";
|
||||
homeConfigurations =
|
||||
nixosConfigurations = mkFullHostConfigs (lib.swarselsystems.readHosts "nixos") "nixos";
|
||||
homeConfigurations = mkHalfHostConfigs (lib.swarselsystems.readHosts "home") "home" lib.swarselsystems.pkgsFor.x86_64-linux;
|
||||
darwinConfigurations = mkFullHostConfigs (lib.swarselsystems.readHosts "darwin") "darwin";
|
||||
nixOnDroidConfigurations = mkHalfHostConfigs (lib.swarselsystems.readHosts "android") "android" lib.swarselsystems.pkgsFor.aarch64-linux;
|
||||
|
||||
# "swarsel@home-manager" = inputs.home-manager.lib.homeManagerConfiguration {
|
||||
# pkgs = lib.swarselsystems.pkgsFor.x86_64-linux;
|
||||
# extraSpecialArgs = { inherit inputs outputs; };
|
||||
# modules = homeModules ++ mixedModules ++ [
|
||||
# ./hosts/home-manager
|
||||
# ];
|
||||
# };
|
||||
|
||||
lib.swarselsystems.mkHalfHostConfigs (lib.swarselsystems.readHosts "home") "home" lib.swarselsystems.pkgsFor.x86_64-linux;
|
||||
darwinConfigurations =
|
||||
lib.swarselsystems.mkFullHostConfigs (lib.swarselsystems.readHosts "darwin") "darwin";
|
||||
nixOnDroidConfigurations =
|
||||
|
||||
# magicant = inputs.nix-on-droid.lib.nixOnDroidConfiguration {
|
||||
# pkgs = lib.swarselsystems.pkgsFor.aarch64-linux;
|
||||
# modules = [
|
||||
# ./hosts/magicant
|
||||
# ];
|
||||
# };
|
||||
|
||||
lib.swarselsystems.mkHalfHostConfigs (lib.swarselsystems.readHosts "android") "android" lib.swarselsystems.pkgsFor.aarch64-linux;
|
||||
|
||||
|
||||
topology =
|
||||
|
||||
lib.swarselsystems.forEachSystem (pkgs: import inputs.nix-topology {
|
||||
topology = lib.swarselsystems.forEachSystem (pkgs: import inputs.nix-topology {
|
||||
inherit pkgs;
|
||||
modules = [
|
||||
"${self}/topology"
|
||||
|
|
@ -205,5 +279,11 @@
|
|||
];
|
||||
});
|
||||
|
||||
nodes = config.nixosConfigurations;
|
||||
};
|
||||
systems = [
|
||||
"x86_64-linux"
|
||||
"aarch64-linux"
|
||||
];
|
||||
};
|
||||
}
|
||||
|
|
|
|||
|
|
@ -13,6 +13,9 @@ in
|
|||
"${self}/modules/nixos/common/topology.nix"
|
||||
"${self}/modules/home/common/sharedsetup.nix"
|
||||
|
||||
"${self}/modules/nixos/common/globals.nix"
|
||||
|
||||
|
||||
inputs.home-manager.nixosModules.home-manager
|
||||
{
|
||||
home-manager.users."${primaryUser}".imports = [
|
||||
|
|
|
|||
|
|
@ -1,8 +1,4 @@
|
|||
{ self, lib, systems, inputs, outputs, ... }:
|
||||
let
|
||||
linuxUser = "swarsel";
|
||||
macUser = "leon.schwarzaeugl";
|
||||
in
|
||||
{ self, lib, systems, inputs, ... }:
|
||||
{
|
||||
|
||||
mkIfElseList = p: yes: no: lib.mkMerge [
|
||||
|
|
@ -47,88 +43,6 @@ in
|
|||
|
||||
forEachSystem = f: lib.genAttrs (import systems) (system: f lib.swarselsystems.pkgsFor.${system});
|
||||
|
||||
mkFullHost = host: type: {
|
||||
${host} =
|
||||
let
|
||||
systemFunc = if (type == "nixos") then lib.nixosSystem else inputs.nix-darwin.lib.darwinSystem;
|
||||
in
|
||||
systemFunc {
|
||||
specialArgs = { inherit inputs outputs lib self; };
|
||||
modules = [
|
||||
{
|
||||
node.name = host;
|
||||
node.secretsDir = ../hosts/${type}/${host}/secrets;
|
||||
}
|
||||
# put inports here that are for all hosts
|
||||
inputs.disko.nixosModules.disko
|
||||
inputs.sops-nix.nixosModules.sops
|
||||
inputs.impermanence.nixosModules.impermanence
|
||||
inputs.lanzaboote.nixosModules.lanzaboote
|
||||
inputs.fw-fanctrl.nixosModules.default
|
||||
"${self}/hosts/${type}/${host}"
|
||||
{
|
||||
_module.args.primaryUser = linuxUser;
|
||||
}
|
||||
] ++
|
||||
(if (host == "iso") then [
|
||||
inputs.nix-topology.nixosModules.default
|
||||
] else
|
||||
([
|
||||
# put nixos imports here that are for all servers and normal hosts
|
||||
inputs.nix-topology.nixosModules.default
|
||||
"${self}/modules/${type}/common"
|
||||
inputs.stylix.nixosModules.stylix
|
||||
inputs.nswitch-rcm-nix.nixosModules.nswitch-rcm
|
||||
] ++ (if (type == "nixos") then [
|
||||
inputs.home-manager.nixosModules.home-manager
|
||||
"${self}/profiles/nixos"
|
||||
"${self}/modules/nixos/server"
|
||||
"${self}/modules/nixos/optional"
|
||||
{
|
||||
home-manager.users."${linuxUser}".imports = [
|
||||
# put home-manager imports here that are for all normal hosts
|
||||
"${self}/modules/home/common"
|
||||
"${self}/modules/home/server"
|
||||
"${self}/modules/home/optional"
|
||||
"${self}/profiles/home"
|
||||
];
|
||||
}
|
||||
] else [
|
||||
# put nixos imports here that are for darwin hosts
|
||||
"${self}/modules/darwin/nixos/common"
|
||||
"${self}/profiles/darwin"
|
||||
inputs.home-manager.darwinModules.home-manager
|
||||
{
|
||||
home-manager.users."${macUser}".imports = [
|
||||
# put home-manager imports here that are for darwin hosts
|
||||
"${self}/modules/darwin/home"
|
||||
"${self}/modules/home/server"
|
||||
"${self}/modules/home/optional"
|
||||
"${self}/profiles/home"
|
||||
];
|
||||
}
|
||||
])
|
||||
));
|
||||
};
|
||||
};
|
||||
|
||||
mkHalfHost = host: type: pkgs: {
|
||||
${host} =
|
||||
let
|
||||
systemFunc = if (type == "home") then inputs.home-manager.lib.homeManagerConfiguration else inputs.nix-on-droid.lib.nixOnDroidConfiguration;
|
||||
in
|
||||
systemFunc
|
||||
{
|
||||
inherit pkgs;
|
||||
extraSpecialArgs = { inherit inputs outputs lib self; };
|
||||
modules = [ "${self}/hosts/${type}/${host}" ];
|
||||
};
|
||||
};
|
||||
|
||||
mkFullHostConfigs = hosts: type: lib.foldl (acc: set: acc // set) { } (lib.map (host: lib.swarselsystems.mkFullHost host type) hosts);
|
||||
|
||||
mkHalfHostConfigs = hosts: type: pkgs: lib.foldl (acc: set: acc // set) { } (lib.map (host: lib.swarselsystems.mkHalfHost host type pkgs) hosts);
|
||||
|
||||
readHosts = type: lib.attrNames (builtins.readDir "${self}/hosts/${type}");
|
||||
readNix = type: lib.filter (name: name != "default.nix") (lib.attrNames (builtins.readDir "${self}/${type}"));
|
||||
|
||||
|
|
|
|||
75
modules/nixos/common/globals.nix
Normal file
75
modules/nixos/common/globals.nix
Normal file
|
|
@ -0,0 +1,75 @@
|
|||
{ lib, options, ... }:
|
||||
let
|
||||
inherit (lib)
|
||||
mkOption
|
||||
types
|
||||
;
|
||||
|
||||
in
|
||||
{
|
||||
options = {
|
||||
globals = mkOption {
|
||||
default = { };
|
||||
type = types.submodule {
|
||||
options = {
|
||||
root = {
|
||||
hashedPassword = mkOption {
|
||||
type = types.str;
|
||||
description = "My root user's password hash.";
|
||||
};
|
||||
};
|
||||
|
||||
myuser = {
|
||||
name = mkOption {
|
||||
type = types.str;
|
||||
description = "My unix username.";
|
||||
};
|
||||
hashedPassword = mkOption {
|
||||
type = types.str;
|
||||
description = "My unix password hash.";
|
||||
};
|
||||
};
|
||||
|
||||
|
||||
services = mkOption {
|
||||
type = types.attrsOf (
|
||||
types.submodule {
|
||||
options = {
|
||||
domain = mkOption {
|
||||
type = types.str;
|
||||
description = "The domain under which this service can be reached";
|
||||
};
|
||||
};
|
||||
}
|
||||
);
|
||||
};
|
||||
|
||||
domains = {
|
||||
me = mkOption {
|
||||
type = types.str;
|
||||
description = "My main domain.";
|
||||
};
|
||||
|
||||
personal = mkOption {
|
||||
type = types.str;
|
||||
description = "My personal domain.";
|
||||
};
|
||||
};
|
||||
|
||||
macs = mkOption {
|
||||
default = { };
|
||||
type = types.attrsOf types.str;
|
||||
description = "Known MAC addresses for external devices.";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
_globalsDefs = mkOption {
|
||||
type = types.unspecified;
|
||||
default = options.globals.definitions;
|
||||
readOnly = true;
|
||||
internal = true;
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
@ -24,37 +24,5 @@
|
|||
isImpermanence = lib.mkEnableOption "use impermanence on this system";
|
||||
isSecureBoot = lib.mkEnableOption "use secure boot on this system";
|
||||
};
|
||||
globals = lib.mkOption {
|
||||
default = { };
|
||||
type = lib.types.submodule {
|
||||
options = {
|
||||
|
||||
services = lib.mkOption {
|
||||
type = lib.types.attrsOf (
|
||||
lib.types.submodule {
|
||||
options = {
|
||||
domain = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
description = "Domain that the service runs under";
|
||||
};
|
||||
};
|
||||
}
|
||||
);
|
||||
};
|
||||
domains = {
|
||||
main = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
description = "My main domain.";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
# _globalsDefs = lib.mkOption {
|
||||
# type = lib.types.unspecified;
|
||||
# default = options.globals.definitions;
|
||||
# readOnly = true;
|
||||
# internal = true;
|
||||
# };
|
||||
};
|
||||
}
|
||||
|
|
|
|||
|
|
@ -12,11 +12,13 @@ in
|
|||
|
||||
sops.secrets.swarsel = { owner = "root"; };
|
||||
|
||||
topology.self.services.anki = {
|
||||
topology.self.services.${serviceName} = {
|
||||
name = lib.mkForce "Anki Sync Server";
|
||||
info = "https://${serviceDomain}";
|
||||
};
|
||||
|
||||
globals.services.${serviceName}.domain = serviceDomain;
|
||||
|
||||
services.anki-sync-server = {
|
||||
enable = true;
|
||||
port = servicePort;
|
||||
|
|
|
|||
|
|
@ -8,7 +8,8 @@ in
|
|||
options.swarselsystems.modules.server."${serviceName}" = lib.mkEnableOption "enable ${serviceName} on server";
|
||||
config = lib.mkIf config.swarselsystems.modules.server."${serviceName}" {
|
||||
|
||||
topology.self.services.atuin.info = "https://${serviceDomain}";
|
||||
topology.self.services.${serviceName}.info = "https://${serviceDomain}";
|
||||
globals.services.${serviceName}.domain = serviceDomain;
|
||||
|
||||
services.atuin = {
|
||||
enable = true;
|
||||
|
|
|
|||
|
|
@ -30,7 +30,8 @@ in
|
|||
};
|
||||
};
|
||||
|
||||
topology.self.services.croc.info = "https://${serviceDomain}";
|
||||
topology.self.services.${serviceName}.info = "https://${serviceDomain}";
|
||||
globals.services.${serviceName}.domain = serviceDomain;
|
||||
|
||||
services.croc = {
|
||||
enable = true;
|
||||
|
|
|
|||
|
|
@ -1,7 +1,7 @@
|
|||
{ self, lib, config, ... }:
|
||||
let
|
||||
cfg = config.services.firefly-iii;
|
||||
fireflyDomain = "stonks.swarsel.win";
|
||||
serviceDomain = "stonks.swarsel.win";
|
||||
fireflyUser = "firefly-iii";
|
||||
serviceName = "firefly";
|
||||
in
|
||||
|
|
@ -22,9 +22,10 @@ in
|
|||
|
||||
topology.self.services.firefly-iii = {
|
||||
name = "Firefly-III";
|
||||
info = "https://${fireflyDomain}";
|
||||
info = "https://${serviceDomain}";
|
||||
icon = "${self}/topology/images/firefly-iii.png";
|
||||
};
|
||||
globals.services.${serviceName}.domain = serviceDomain;
|
||||
|
||||
services = {
|
||||
firefly-iii = {
|
||||
|
|
@ -34,7 +35,7 @@ in
|
|||
dataDir = "/Vault/data/firefly-iii";
|
||||
settings = {
|
||||
TZ = config.repo.secrets.common.location.timezone;
|
||||
APP_URL = "https://${fireflyDomain}";
|
||||
APP_URL = "https://${serviceDomain}";
|
||||
APP_KEY_FILE = config.sops.secrets.firefly-iii-app-key.path;
|
||||
APP_ENV = "local";
|
||||
DB_CONNECTION = "sqlite";
|
||||
|
|
@ -45,12 +46,12 @@ in
|
|||
# AUTHENTICATION_GUARD_EMAIL = "X-Email";
|
||||
};
|
||||
enableNginx = true;
|
||||
virtualHost = fireflyDomain;
|
||||
virtualHost = serviceDomain;
|
||||
};
|
||||
|
||||
nginx = {
|
||||
virtualHosts = {
|
||||
"${fireflyDomain}" = {
|
||||
"${serviceDomain}" = {
|
||||
locations = {
|
||||
"/api" = {
|
||||
setOauth2Headers = false;
|
||||
|
|
@ -75,7 +76,7 @@ in
|
|||
};
|
||||
};
|
||||
virtualHosts = {
|
||||
"${fireflyDomain}" = {
|
||||
"${serviceDomain}" = {
|
||||
enableACME = true;
|
||||
forceSSL = true;
|
||||
acmeRoot = null;
|
||||
|
|
|
|||
|
|
@ -23,6 +23,8 @@ in
|
|||
kanidm-forgejo-client = { owner = serviceUser; group = serviceGroup; mode = "0440"; };
|
||||
};
|
||||
|
||||
globals.services.${serviceName}.domain = serviceDomain;
|
||||
|
||||
services.forgejo = {
|
||||
enable = true;
|
||||
user = serviceUser;
|
||||
|
|
|
|||
|
|
@ -44,12 +44,14 @@ in
|
|||
# };
|
||||
};
|
||||
|
||||
topology.self.services.freshrss = {
|
||||
topology.self.services.${serviceName} = {
|
||||
name = "FreshRSS";
|
||||
info = "https://${serviceDomain}";
|
||||
icon = "${self}/topology/images/freshrss.png";
|
||||
};
|
||||
|
||||
globals.services.${serviceName}.domain = serviceDomain;
|
||||
|
||||
services.freshrss = {
|
||||
enable = true;
|
||||
virtualHost = serviceDomain;
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
{ lib, config, ... }:
|
||||
{ lib, config, globals, ... }:
|
||||
let
|
||||
serviceDomain = "shots.swarsel.win";
|
||||
servicePort = 3001;
|
||||
|
|
@ -13,7 +13,8 @@ in
|
|||
extraGroups = [ "video" "render" "users" ];
|
||||
};
|
||||
|
||||
topology.self.services.immich.info = "https://${serviceDomain}";
|
||||
topology.self.services.${serviceName}.info = "https://${serviceDomain}";
|
||||
globals.services.${serviceName}.domain = serviceDomain;
|
||||
|
||||
services.immich = {
|
||||
enable = true;
|
||||
|
|
|
|||
|
|
@ -24,7 +24,8 @@ in
|
|||
];
|
||||
};
|
||||
|
||||
topology.self.services.jellyfin.info = "https://${serviceDomain}";
|
||||
topology.self.services.${serviceName}.info = "https://${serviceDomain}";
|
||||
globals.services.${serviceName}.domain = serviceDomain;
|
||||
|
||||
services.jellyfin = {
|
||||
enable = true;
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
{ self, lib, pkgs, config, ... }:
|
||||
{ self, lib, pkgs, config, globals, ... }:
|
||||
let
|
||||
certsSopsFile = self + /secrets/certs/secrets.yaml;
|
||||
serviceDomain = "sso.swarsel.win";
|
||||
|
|
@ -6,7 +6,7 @@ let
|
|||
serviceUser = "kanidm";
|
||||
serviceGroup = serviceUser;
|
||||
serviceName = "kanidm";
|
||||
oauth2ProxyDomain = "soauth.swarsel.win";
|
||||
oauth2ProxyDomain = globals.services.oauth2Proxy.domain;
|
||||
in
|
||||
{
|
||||
options.swarselsystems.modules.server."${serviceName}" = lib.mkEnableOption "enable ${serviceName} on server";
|
||||
|
|
@ -37,6 +37,8 @@ in
|
|||
|
||||
networking.firewall.allowedTCPPorts = [ servicePort ];
|
||||
|
||||
globals.services.${serviceName}.domain = serviceDomain;
|
||||
|
||||
services = {
|
||||
kanidm = {
|
||||
package = pkgs.kanidmWithSecretProvisioning;
|
||||
|
|
|
|||
|
|
@ -2,7 +2,7 @@
|
|||
let
|
||||
serviceName = "kavita";
|
||||
serviceUser = "kavita";
|
||||
serviceDomain = "scroll.swarsel.win";
|
||||
serviceDomain = config.repo.secrets.common.services.domains.${serviceName};
|
||||
servicePort = 8080;
|
||||
in
|
||||
{
|
||||
|
|
@ -25,6 +25,7 @@ in
|
|||
info = "https://${serviceDomain}";
|
||||
icon = "${self}/topology/images/kavita.png";
|
||||
};
|
||||
globals.services.${serviceName}.domain = serviceDomain;
|
||||
|
||||
services.kavita = {
|
||||
enable = true;
|
||||
|
|
|
|||
|
|
@ -23,6 +23,7 @@ in
|
|||
info = "https://${serviceDomain}";
|
||||
icon = "${self}/topology/images/koillection.png";
|
||||
};
|
||||
globals.services.${serviceName}.domain = serviceDomain;
|
||||
|
||||
virtualisation.oci-containers.containers = {
|
||||
koillection = {
|
||||
|
|
|
|||
|
|
@ -87,6 +87,8 @@ in
|
|||
};
|
||||
};
|
||||
|
||||
globals.services.${serviceName}.domain = matrixDomain;
|
||||
|
||||
services = {
|
||||
postgresql = {
|
||||
enable = true;
|
||||
|
|
|
|||
|
|
@ -42,7 +42,8 @@ in
|
|||
};
|
||||
};
|
||||
|
||||
topology.self.services."${serviceName}".info = "https://${serviceDomain}";
|
||||
topology.self.services.${serviceName}.info = "https://${serviceDomain}";
|
||||
globals.services.${serviceName}.domain = serviceDomain;
|
||||
|
||||
services."${serviceName}" = {
|
||||
enable = true;
|
||||
|
|
|
|||
|
|
@ -35,6 +35,7 @@ in
|
|||
networking.firewall.allowedTCPPorts = [ servicePort prometheusPort ];
|
||||
|
||||
topology.self.services.prometheus.info = "https://${serviceDomain}/${prometheusWebRoot}";
|
||||
globals.services.${moduleName}.domain = serviceDomain;
|
||||
|
||||
services = {
|
||||
grafana = {
|
||||
|
|
|
|||
|
|
@ -38,6 +38,8 @@ in
|
|||
|
||||
networking.firewall.allowedTCPPorts = [ 4040 ];
|
||||
|
||||
globals.services.${serviceName}.domain = serviceDomain;
|
||||
|
||||
services.navidrome = {
|
||||
enable = true;
|
||||
openFirewall = true;
|
||||
|
|
|
|||
|
|
@ -22,6 +22,9 @@ in
|
|||
};
|
||||
};
|
||||
|
||||
|
||||
globals.services.${serviceName}.domain = serviceDomain;
|
||||
|
||||
services = {
|
||||
nextcloud = {
|
||||
enable = true;
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
{ lib, config, ... }:
|
||||
{ lib, config, globals, ... }:
|
||||
let
|
||||
kanidmDomain = "sso.swarsel.win";
|
||||
kanidmDomain = globals.services.kanidm.domain;
|
||||
oauth2ProxyDomain = "soauth.swarsel.win";
|
||||
oauth2ProxyPort = 3004;
|
||||
in
|
||||
|
|
@ -137,6 +137,8 @@ in
|
|||
|
||||
networking.firewall.allowedTCPPorts = [ oauth2ProxyPort ];
|
||||
|
||||
globals.services.oauth2Proxy.domain = oauth2ProxyDomain;
|
||||
|
||||
services = {
|
||||
oauth2-proxy = {
|
||||
enable = true;
|
||||
|
|
|
|||
|
|
@ -25,6 +25,8 @@ in
|
|||
|
||||
networking.firewall.allowedTCPPorts = [ servicePort ];
|
||||
|
||||
globals.services.${serviceName}.domain = serviceDomain;
|
||||
|
||||
services = {
|
||||
paperless = {
|
||||
enable = true;
|
||||
|
|
|
|||
|
|
@ -29,7 +29,8 @@ in
|
|||
};
|
||||
};
|
||||
|
||||
topology.self.services.radicale.info = "https://${serviceDomain}";
|
||||
topology.self.services.${serviceName}.info = "https://${serviceDomain}";
|
||||
globals.services.${serviceName}.domain = serviceDomain;
|
||||
|
||||
services.radicale = {
|
||||
enable = true;
|
||||
|
|
|
|||
|
|
@ -48,6 +48,9 @@ in
|
|||
{ directory = "/var/lib/containers"; }
|
||||
];
|
||||
|
||||
topology.self.services.${serviceName}.info = "https://${serviceDomain}";
|
||||
globals.services.${serviceName}.domain = serviceDomain;
|
||||
|
||||
services.nginx = {
|
||||
upstreams = {
|
||||
"${serviceName}" = {
|
||||
|
|
|
|||
|
|
@ -21,6 +21,8 @@ in
|
|||
|
||||
networking.firewall.allowedTCPPorts = [ servicePort ];
|
||||
|
||||
globals.services.${serviceName}.domain = serviceDomain;
|
||||
|
||||
services.syncthing = {
|
||||
enable = true;
|
||||
user = serviceUser;
|
||||
|
|
|
|||
|
|
@ -85,6 +85,8 @@ in
|
|||
prowlarr.info = "https://${serviceDomain}/prowlarr";
|
||||
};
|
||||
|
||||
globals.services.transmission.domain = serviceDomain;
|
||||
|
||||
services = {
|
||||
radarr = {
|
||||
enable = true;
|
||||
|
|
|
|||
48
nix/globals.nix
Normal file
48
nix/globals.nix
Normal file
|
|
@ -0,0 +1,48 @@
|
|||
{ inputs, ... }:
|
||||
{
|
||||
flake =
|
||||
{ config
|
||||
, lib
|
||||
, ...
|
||||
}:
|
||||
{
|
||||
globals =
|
||||
let
|
||||
globalsSystem = lib.evalModules {
|
||||
prefix = [ "globals" ];
|
||||
specialArgs = {
|
||||
inherit lib;
|
||||
inherit inputs;
|
||||
inherit (config) nodes;
|
||||
};
|
||||
modules = [
|
||||
../modules/nixos/common/globals.nix
|
||||
(
|
||||
{ lib, ... }:
|
||||
{
|
||||
globals = lib.mkMerge (
|
||||
lib.concatLists (
|
||||
lib.flip lib.mapAttrsToList config.nodes (
|
||||
name: cfg:
|
||||
builtins.addErrorContext "while aggregating globals from nixosConfigurations.${name} into flake-level globals:" cfg.config._globalsDefs
|
||||
)
|
||||
)
|
||||
);
|
||||
}
|
||||
)
|
||||
];
|
||||
};
|
||||
in
|
||||
{
|
||||
# Make sure the keys of this attrset are trivially evaluatable to avoid infinite recursion,
|
||||
# therefore we inherit relevant attributes from the config.
|
||||
inherit (globalsSystem.config.globals)
|
||||
domains
|
||||
services
|
||||
macs
|
||||
myuser
|
||||
root
|
||||
;
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
@ -1,5 +1,5 @@
|
|||
{
|
||||
"data": "ENC[AES256_GCM,data:+CYlqWYF5RJ8/uzhGEG5uA638DmLc9vCMwRBiBZVFkUzb7Ja+jAZ5GVy6Sxw5SwqJsmZEdqKdGCV2TzTO1vcDBixJlwQlCQcwFDdi3W7ZokzEMdOP03vgx5qgd3kwwe0fEuBS7byragm6rt4Vg3bkBa4uwq1cnQEjKmGa69UTaG0FScKHBeFkEHLBUwIPgH0H52JRQurd8eCF1MPYKNTulpta8pDFb/OuM11zjdNfxJaoqtTN7I0PvS/RHTTuLtuNOi3vv8rJ+PeR3xj3B6mgBwWAews7MdlyfTrgOMd9BWFgnRrWBK4WcPa9gfOgEF4A1jkrh7l23lRo1xpWZFYhGEOl/zVQn6KsPwKtS8VU1e7gLi8EOSUMMkBPyAMfGu0SpRDUwISU0joVzeEvOZ5CrteB683qUYf16jWWfAx1v/7/gr2H01UGOpUsc/z4CPv5jeYzr2mBEa76wSBqSm9KjDS4uea6bHMFvLyVGDwg+ljzM+L5sAMEOoBSY2Pojb3lZuOwve6NI9R6aRRoKbuhLyHgcIH6dk1Dc9+scvrOeDMbzp2oppqLfW2uiG6mTcfvE5leJxQeeUV23LXhZsCkK2+UU5JfVj9JWLp6EBZWZdpTjOHDrMUdPBJtXvrirUu4W1s3Ny36o05d0esav4m+qEhwJEO3iDSAMRzQMFGdZhQOKgAgqCXyg3wUh47qdx54SMeyyLhQIHkz9AmeCeYmALnOxGrUrNGfnytNvPOA41qlmwD4e4yLeiwAowuWnVfw7GC5UGU9O5/B42VWN4WdsNgY6SdjBaRUaotil/UuDVISTczcwI3+NWqLtC5,iv:WmrLJN951DRaXKDVi7KHURWRRRusPisETUy+BH5U6/s=,tag:u36D+o4sA94D5W7CmjAizw==,type:str]",
|
||||
"data": "ENC[AES256_GCM,data:K6Exxoz4dyUuVSvS0BQOyjCQ7iuicPUJbDYhWtX350/9tOhu9XorVNmI1ezfFEmY8iAdxVy/E3QEEQcO+XjJVEVGKoX8NtAWSMUkRJT/S2MLG0nNt3kcsIhoya3S5SDiblMIA+S/yFJOmsyykgLUynYgR9QL5URdGj2utoSi9+WYvUsbxrlmcxIqk443huoq4AeZp5X+HVSIhq0rby0/Uc62ox6jz4S9CwSNTOc41xI6UNRz96xppqcAhru7NjZxomtbI9LaDBMVVRe+k5GrKCTyjqp7JCaeN19Sba/k7Uh+4VOVokNEEL0cYNIZXh8eBBxT3ogQhAfOZXfp+lWKf1bAZvVFBrXI4cSGjNUDcbYCIa1gv+rdaVMju29ZNBp+Hx9p4WjJz6zFAbC+tjmH6wBjGNz8Zeqn5Mmm755yPgdvsVAW4ZZfB49T6qOjkDnNSltoHw0n49qTVS7AmQRSQvzPERyAte3IyftQ0bIGALE27h5oB6ls7X9EXUPyNqaT1G0trnrq5D8L4C3xqYJB3KriHA7PNfpKyOVM50ryACyuF2QRHeWfBnFu78hQbMg4lWYXnVggZQdeFDaHZUeYpJCmeyehmSl88+v8f6hjV0aDPlYh8Yv7lfJokGyffMNq0ShmT2/FBPu+9iAvk/apcE8KFdlct5qtkRaOeXp2iwnHWr2bYg/JQ4D4/xePvqBfV22Qd2MarA1qW7ggVJNCbKcOSJzwbEjPGjBjkH6crfO4LD/SYmVMgSoSGojdyLc7hsAFoUtdhzfknV6vVF7h0TTIIEVIEYt0HJGIfMk3PQ4Z+4O7PSwZXxctT8d7GvuWA45QMO+Ok3pRxqNmWUxEHrJF75l+lZMnSrtjdR1r+vNPnwJxHOgn/2h0sYYvqGVVZdHapxdi+V6za0f/,iv:xXAjuNpqXRuReAH6dlunrbPgspj2/+VtCV3p+xjtOi0=,tag:m//iBHvmYmWw4vtgojbpFw==,type:str]",
|
||||
"sops": {
|
||||
"age": [
|
||||
{
|
||||
|
|
@ -27,8 +27,8 @@
|
|||
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBtU240VjVRZmJ5TGsrclJF\nRXRLbTRCZURtR0Z3d2E2eDNNeGRDODlXVEY4CllTeVFYbDJQWlRSS1RFLzAxSnlM\nZi9NU1c3cWo3YWRLcUJ2U2ZFWFBBVEEKLS0tIGtmZU9qSWdBT3RDeStaaFFDSWtk\ndkUzZXJwZUl4LzVxYXdidmxXRnNnclUKyAMZqCKSY/RQvTR4bbjLaPnGKwdBcHXc\nvtiVSrLdIdzMa6id/J07TJH5UesUmcp0wjU41MDa4aMBLy+cXhuBHA==\n-----END AGE ENCRYPTED FILE-----\n"
|
||||
}
|
||||
],
|
||||
"lastmodified": "2025-06-14T20:56:55Z",
|
||||
"mac": "ENC[AES256_GCM,data:03b5V3zO7mmoP050rrgBaZqR7ik3eioW3PJt0dKab85zOaOXwyq22Ps7vftRV6tQ5S83dSXsAnXvYmdUQ3F3h0Z4zqHB680r1uJG24kJLik+9Pl1a8SwQFB0/yWCaXfKqCZhXIoektl83oBaoWFoCpTuOtYmdoF3rt2mVounIHM=,iv:vAzVQRgQyIMUbwWCG/r4n/QXP/67QN7B651tIzU4TpU=,tag:zcgKO/8g1VmhXHfU7XyeYA==,type:str]",
|
||||
"lastmodified": "2025-07-01T10:27:51Z",
|
||||
"mac": "ENC[AES256_GCM,data:RyksomYlwuQTcCfmZqmxMMoanvIzu4FcJ+xlUjbBu9Kb/OU5cp8PJXdA78jY/58GOu9s3fkSD1wFewFrPTwtO8xry4Fvw8smr2wttvDS4c6nJ/9lg3Vab147JCEszqHLxghGV48tChvB2zfhpVy1LoF4y+vixMPIrlTFAw+ICzg=,iv:0LzxSmi8kCweETwQw9+UDpudZvJiTaT9UMLfmi990gQ=,tag:vl2y2f3G+Xn1fWwgkE7NfQ==,type:str]",
|
||||
"pgp": [
|
||||
{
|
||||
"created_at": "2025-06-13T20:13:06Z",
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue