add some secrets for use in algiz

.sops.yaml

@@ -0,0 +1,19 @@
+# This document uses YAML anchors which allows reuse of multiple keys
+# without having to repeat yourself.
+# Also see https://github.com/Mic92/dotfiles/blob/master/nixos/.sops.yaml
+# for a more complex example.
+keys:
+  - &admin_daylin age10ft5tkswydhmassqeqzr8frpx6vc07g4rwam09rs8agvgfrsn95q9ml7u3
+  - &host_othalan age1t4k04mjltmmhljnwugm6y4dejtu72vv4fd4anxxfsdpkapfnfauqe765gy
+creation_rules:
+  - path_regex: hosts/(.*)/[^/]+\.(yaml|json|env|ini)$
+  # - path_regex: hosts/algiz/[^/]+\.(yaml|json|env|ini)$
+    key_groups:
+    - age:
+      - *admin_daylin
+  - path_regex: hosts/othalan/[^/]+\.(yaml|json|env|ini)$
+
+    key_groups:
+    - age:
+      - *admin_daylin
+      - *host_othalan

flake.lock

@@ -915,11 +915,32 @@
         "nixpkgs": "nixpkgs_4",
         "nixpkgs-wayland": "nixpkgs-wayland",
         "pixi": "pixi",
+        "sops-nix": "sops-nix",
         "stable": "stable",
         "tsm": "tsm",
         "utils": "utils"
       }
     },
+    "sops-nix": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1732575825,
+        "narHash": "sha256-xtt95+c7OUMoqZf4OvA/7AemiH3aVuWHQbErYQoPwFk=",
+        "owner": "Mic92",
+        "repo": "sops-nix",
+        "rev": "3433ea14fbd9e6671d0ff0dd45ed15ee4c156ffa",
+        "type": "github"
+      },
+      "original": {
+        "owner": "Mic92",
+        "repo": "sops-nix",
+        "type": "github"
+      }
+    },
     "stable": {
       "locked": {
         "lastModified": 1732632634,

flake.nix

@@ -16,6 +16,11 @@
       inputs.nixpkgs.follows = "nixpkgs";
     };
 
+    sops-nix = {
+      url = "github:Mic92/sops-nix";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
     lix = {
       url = "https://git.lix.systems/lix-project/lix/archive/main.tar.gz";
       flake = false;

hosts/algiz/default.nix

@@ -1,4 +1,5 @@
 {
+  config,
   enabled,
   enableAttrs,
   listify,
@@ -15,7 +16,8 @@
     user = "root";
     rcloneConfigFile = "/home/daylin/.config/rclone/rclone.conf";
     repository = "rclone:g:archives/algiz";
-    passwordFile = "/home/daylin/.config/restic/algiz-pass";
+    # passwordFile = "/home/daylin/.config/restic/algiz-pass";
+    passwordFile = config.sops.secrets.restic-algiz.path;
     paths = [
       "/home/daylin/services/git/"
       "/home/daylin/services/gotosocial/"
@@ -26,4 +28,11 @@
 
   # git user handles the forgjo ssh authentication
   users.users.git.isNormalUser = true;
+
+  sops = {
+    age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
+    defaultSopsFile = ./secrets.yaml;
+    # by default is accessible only by root:root which should work with above service
+    secrets.restic-algiz = { };
+  };
 }

hosts/algiz/secrets.yaml

@@ -0,0 +1,21 @@
+restic-algiz: ENC[AES256_GCM,data:r7z1s5pSEIlg2laRmY4D,iv:nfajL8J2A8G80NqMBw/t1tFXCsK9JbTzUgFTisf5JLk=,tag:LWOT9vVzuinXD+AYwk35jA==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age10ft5tkswydhmassqeqzr8frpx6vc07g4rwam09rs8agvgfrsn95q9ml7u3
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA5ZUJhVVV1SFBEV1BNRS9D
+            TlhhMW1RbGtaam1FYnppcURlU0VVekRNTUNvCk50aW4yaWJpVTZPK3dPMWI3UjBY
+            L3k5c1lnejl5M1FxZC9TQU8yWVNZRlkKLS0tIEZHRXNLZG1McFFOeVpWUWtHYUl3
+            YWlZMzI4eUoxMW5SanJxSzVpRmJnQlUKPiZnIuBQ5E0A5yorjmoI2pehpMDQ7TNs
+            3IvyW+HUOnM/gCJqKBzR/Iqlk74mRKoDb5GuOiUpy7yN/1vrMdHQmw==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2024-11-29T01:19:00Z"
+    mac: ENC[AES256_GCM,data:J8jbVgwtqck2Sis03re93cVyFw1tMrPc+nnWmlDGoLWh6Jrxq8n+Eac7nsIxU/pZVnY+1x68lAz/2+YHPe8zxChz3f6O2ebscQaAo9M7gG76W2Rt6pDtrKXL7U2pDbjx0p5RwZQM/1tdeRbuUvJk/PYPJONiPVgi/bL6chd2Tew=,iv:brwJE8CZY0K6iRqB9ZUG1AwPfkISoSax692NZoyaNVQ=,tag:7/7V/jw/cgsCSJryrRMJMA==,type:str]
+    pgp: []
+    unencrypted_suffix: _unencrypted
+    version: 3.9.1

hosts/othalan/default.nix

@@ -2,6 +2,7 @@
   enabled,
   enableAttrs,
   listify,
+  config,
   ...
 }:
 {
@@ -25,4 +26,16 @@
       |> listify
       |> enableAttrs
     );
+
+  sops.defaultSopsFile = ./secrets.yaml;
+  # This will automatically import SSH keys as age keys
+  sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
+  sops.secrets.restic-othalan = {
+    # Permission modes are in octal representation (same as chmod),
+    mode = "0440";
+    # It is recommended to get the group/name name from
+    # `config.users.users.<?name>.{name,group}` to avoid misconfiguration
+    owner = config.users.users.daylin.name;
+    group = config.users.users.daylin.group;
+  };
 }

hosts/othalan/pkgs.nix

@@ -7,7 +7,7 @@
     ]
 
     ++ (with pkgs; [
-
+      sops
       distrobox
       zk
       quarto

hosts/othalan/secrets.yaml

@@ -0,0 +1,30 @@
+restic-othalan: ENC[AES256_GCM,data:HNIya1Rp,iv:8QkDewpXoy+3ahuuaCN/HfbGOgfQQ0Ud5emD7zVPE2s=,tag:bDfumEnt20lun5hnLY+eVA==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age10ft5tkswydhmassqeqzr8frpx6vc07g4rwam09rs8agvgfrsn95q9ml7u3
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBCK3pzZ3hXdG40L1JyK281
+            NDJ4WWEyWFBPeERabXpSUXYzOWMxdWJlMGdFCmQydi8rbVZCUFBzM0NUbWJlZzZ3
+            anV6a2FCL1BRTWg2V1RBZFJXUUNRUEkKLS0tIHIwTzl5NEdoTWRaUm9LR3I1MFph
+            TFJjQndHQUJZdEZsSElmY0xDMTMvc2MKCO9BP1jccmFXqLjJQyk5a1/QC69/WPaV
+            xl8U7gFoiOf6ZIESk/fADVtnG+thEYF1vwEMI8ClUfs+8kWgwBqoGw==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1t4k04mjltmmhljnwugm6y4dejtu72vv4fd4anxxfsdpkapfnfauqe765gy
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqWnBYVFRKMVJPVEQ1VlAy
+            Y000L1lHM2JyN0oyeTFROXh6OTVlTkc5RlVBCkdqU20yeGtVcWo3cmRoQmFKVG91
+            d3RQazc1UTJBdWQwUEdzNkNPYXZ3SmsKLS0tIHdzd0Q0a1pPeEJqS1Rrckt6aUdt
+            UmE2Mk4yV21TNTF2NjBqZ0txYThRRzAKgyWCwmF4mhX8lmfslmBf2UrcFqzT8m11
+            AqhJsG2LRU/9/6FXOYn2rYeCIDpTkPoQ4ez7F4m/zp+RvOc2eW3g2g==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2024-11-29T00:41:44Z"
+    mac: ENC[AES256_GCM,data:4+H5OmCCTrMrkz9sLHcdwu8EFc+iS3MUTfhLgH6crfE0QSmV87b4JKQTVtdoYnzB8f2hRS/DeAImaLs68NQ/c7raLKwKmX1Bx2htV92MEOhoEjnZ6IbpCzY9FhrtRFjjBrg/nAuMpK0ktYW3w9C/v/jq/YEnP+pabkPhsUav8GU=,iv:LtBd2nj21ZCOXmvfbCIz/lvYC4neRk7ZTnY/rbJnATU=,tag:o9K/TxIp/NLmcvpXHYPHoQ==,type:str]
+    pgp: []
+    unencrypted_suffix: _unencrypted
+    version: 3.9.1

hosts/othalan/services.nix

@@ -1,35 +1,39 @@
-{ pkgs, ... }:
-let
-  notes-git = ''${pkgs.git}/bin/git -C /home/daylin/stuff/notes'';
-in
+{
+  config,
+#  pkgs,
+  ...
+}:
+# let
+#   notes-git = ''${pkgs.git}/bin/git -C /home/daylin/stuff/notes'';
+# in
 {
   services.restic.backups.gdrive = {
     user = "daylin";
     repository = "rclone:g:archives/othalan";
-    passwordFile = "/home/daylin/.config/restic/othalan-pass";
+    passwordFile = config.sops.secrets.restic-othalan.path;
     paths = [
       "/home/daylin/stuff/"
       "/home/daylin/dev/"
     ];
   };
 
-  systemd.services.notes-bot = {
-    description = "auto commit changes to notes";
-    serviceConfig = {
-      Type = "oneshot";
-      User = "daylin";
-      ExecStart = ''
-        ${pkgs.bash}/bin/bash -c '${notes-git} commit -m ":memo: :robot: $(${pkgs.coreutils}/bin/date +\'%%T\')" --no-gpg-sign -- notes'
-      '';
-    };
-  };
-  systemd.timers.notes-bot-timer = {
-    description = "run notes commit service";
-    wantedBy = [ "timers.target" ];
-    timerConfig = {
-      OnCalendar = "daily";
-      Persistent = true;
-      Unit = "notes-bot.service";
-    };
-  };
+  # systemd.services.notes-bot = {
+  #   description = "auto commit changes to notes";
+  #   serviceConfig = {
+  #     Type = "oneshot";
+  #     User = "daylin";
+  #     ExecStart = ''
+  #       ${pkgs.bash}/bin/bash -c '${notes-git} commit -m ":memo: :robot: $(${pkgs.coreutils}/bin/date +\'%%T\')" --no-gpg-sign -- notes'
+  #     '';
+  #   };
+  # };
+  # systemd.timers.notes-bot-timer = {
+  #   description = "run notes commit service";
+  #   wantedBy = [ "timers.target" ];
+  #   timerConfig = {
+  #     OnCalendar = "daily";
+  #     Persistent = true;
+  #     Unit = "notes-bot.service";
+  #   };
+  # };
 }

lib/generators.nix

@@ -17,13 +17,15 @@ let
     listify
     ;
   inherit (lib.filesystem) listFilesRecursive;
-
   flake = flakeFromSystem "x86_64-linux";
   hostPath = host: ../. + "/hosts/${host}";
+
   # all nix files not including pkgs.nix
-  # hostFiles = host: filter isNixFile (listFilesRecursive (hostPath host));
   hostFiles = host: host |> hostPath |> listFilesRecursive |> filter isNixFile;
 
+  nixosModules = names: names |> listify |> map (n: inputs.${n}.nixosModules.default);
+  selfModules = names: names |> listify |> map (n: self.nixosModules.${n});
+
   commonSpecialArgs = {
     inherit
       self
@@ -35,12 +37,7 @@ let
 
   mkIso = nixosSystem {
     system = "x86_64-linux";
-    modules = [
-      inputs.lix-module.nixosModules.default
-      self.nixosModules.nix
-      self.nixosModules.essentials
-      self.nixosModules.iso
-    ];
+    modules = (nixosModules "lix-module") ++ (selfModules "nix|essentials|iso");
     specialArgs = commonSpecialArgs;
   };
 
@@ -48,12 +45,13 @@ let
     hostName:
     nixosSystem {
       system = "x86_64-linux";
-      modules = [
-        ../modules/oizys.nix
-        inputs.lix-module.nixosModules.default
-        inputs.hyprland.nixosModules.default
+      modules =
+        [
           inputs.comin.nixosModules.comin
-      ] ++ (hostFiles hostName);
+        ]
+        ++ (selfModules ''oizys'')
+        ++ (nixosModules ''lix-module|hyprland|sops-nix'')
+        ++ (hostFiles hostName);
 
       specialArgs = commonSpecialArgs // {
         inherit