2024-12-22 06:00:45 -06:00
10 changed files with 40 additions and 160 deletions
--- a/.sops.yaml
+++ b/.sops.yaml
@ -1,19 +0,0 @@
-# This document uses YAML anchors which allows reuse of multiple keys
-# without having to repeat yourself.
-# Also see https://github.com/Mic92/dotfiles/blob/master/nixos/.sops.yaml
-# for a more complex example.
-keys:
-  - &admin_daylin age10ft5tkswydhmassqeqzr8frpx6vc07g4rwam09rs8agvgfrsn95q9ml7u3
-  - &host_othalan age1t4k04mjltmmhljnwugm6y4dejtu72vv4fd4anxxfsdpkapfnfauqe765gy
-creation_rules:
-  - path_regex: hosts/(.*)/[^/]+\.(yaml|json|env|ini)$
-  # - path_regex: hosts/algiz/[^/]+\.(yaml|json|env|ini)$
-    key_groups:
-    - age:
-      - *admin_daylin
-  - path_regex: hosts/othalan/[^/]+\.(yaml|json|env|ini)$
-
-    key_groups:
-    - age:
-      - *admin_daylin
-      - *host_othalan
--- a/flake.lock
+++ b/flake.lock
@ -915,32 +915,11 @@
        "nixpkgs": "nixpkgs_4",
        "nixpkgs-wayland": "nixpkgs-wayland",
        "pixi": "pixi",
-        "sops-nix": "sops-nix",
        "stable": "stable",
        "tsm": "tsm",
        "utils": "utils"
      }
    },
-    "sops-nix": {
-      "inputs": {
-        "nixpkgs": [
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1732575825,
-        "narHash": "sha256-xtt95+c7OUMoqZf4OvA/7AemiH3aVuWHQbErYQoPwFk=",
-        "owner": "Mic92",
-        "repo": "sops-nix",
-        "rev": "3433ea14fbd9e6671d0ff0dd45ed15ee4c156ffa",
-        "type": "github"
-      },
-      "original": {
-        "owner": "Mic92",
-        "repo": "sops-nix",
-        "type": "github"
-      }
-    },
    "stable": {
      "locked": {
        "lastModified": 1732632634,
--- a/flake.nix
+++ b/flake.nix
@ -16,11 +16,6 @@
      inputs.nixpkgs.follows = "nixpkgs";
    };

-    sops-nix = {
-      url = "github:Mic92/sops-nix";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
-
    lix = {
      url = "https://git.lix.systems/lix-project/lix/archive/main.tar.gz";
      flake = false;
--- a/hosts/algiz/default.nix
+++ b/hosts/algiz/default.nix
@ -1,5 +1,4 @@
 {
-  config,
  enabled,
  enableAttrs,
  listify,
@ -16,8 +15,7 @@
    user = "root";
    rcloneConfigFile = "/home/daylin/.config/rclone/rclone.conf";
    repository = "rclone:g:archives/algiz";
-    # passwordFile = "/home/daylin/.config/restic/algiz-pass";
-    passwordFile = config.sops.secrets.restic-algiz.path;
+    passwordFile = "/home/daylin/.config/restic/algiz-pass";
    paths = [
      "/home/daylin/services/git/"
      "/home/daylin/services/gotosocial/"
@ -28,11 +26,4 @@

  # git user handles the forgjo ssh authentication
  users.users.git.isNormalUser = true;
-
-  sops = {
-    age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
-    defaultSopsFile = ./secrets.yaml;
-    # by default is accessible only by root:root which should work with above service
-    secrets.restic-algiz = { };
-  };
 }
--- a/hosts/algiz/secrets.yaml
+++ b/hosts/algiz/secrets.yaml
@ -1,21 +0,0 @@
-restic-algiz: ENC[AES256_GCM,data:r7z1s5pSEIlg2laRmY4D,iv:nfajL8J2A8G80NqMBw/t1tFXCsK9JbTzUgFTisf5JLk=,tag:LWOT9vVzuinXD+AYwk35jA==,type:str]
-sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
-    age:
-        - recipient: age10ft5tkswydhmassqeqzr8frpx6vc07g4rwam09rs8agvgfrsn95q9ml7u3
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA5ZUJhVVV1SFBEV1BNRS9D
-            TlhhMW1RbGtaam1FYnppcURlU0VVekRNTUNvCk50aW4yaWJpVTZPK3dPMWI3UjBY
-            L3k5c1lnejl5M1FxZC9TQU8yWVNZRlkKLS0tIEZHRXNLZG1McFFOeVpWUWtHYUl3
-            YWlZMzI4eUoxMW5SanJxSzVpRmJnQlUKPiZnIuBQ5E0A5yorjmoI2pehpMDQ7TNs
-            3IvyW+HUOnM/gCJqKBzR/Iqlk74mRKoDb5GuOiUpy7yN/1vrMdHQmw==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2024-11-29T01:19:00Z"
-    mac: ENC[AES256_GCM,data:J8jbVgwtqck2Sis03re93cVyFw1tMrPc+nnWmlDGoLWh6Jrxq8n+Eac7nsIxU/pZVnY+1x68lAz/2+YHPe8zxChz3f6O2ebscQaAo9M7gG76W2Rt6pDtrKXL7U2pDbjx0p5RwZQM/1tdeRbuUvJk/PYPJONiPVgi/bL6chd2Tew=,iv:brwJE8CZY0K6iRqB9ZUG1AwPfkISoSax692NZoyaNVQ=,tag:7/7V/jw/cgsCSJryrRMJMA==,type:str]
-    pgp: []
-    unencrypted_suffix: _unencrypted
-    version: 3.9.1
--- a/hosts/othalan/default.nix
+++ b/hosts/othalan/default.nix
@ -2,7 +2,6 @@
  enabled,
  enableAttrs,
  listify,
-  config,
  ...
 }:
 {
@ -26,16 +25,4 @@
      |> listify
      |> enableAttrs
    );
-
-  sops.defaultSopsFile = ./secrets.yaml;
-  # This will automatically import SSH keys as age keys
-  sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
-  sops.secrets.restic-othalan = {
-    # Permission modes are in octal representation (same as chmod),
-    mode = "0440";
-    # It is recommended to get the group/name name from
-    # `config.users.users.<?name>.{name,group}` to avoid misconfiguration
-    owner = config.users.users.daylin.name;
-    group = config.users.users.daylin.group;
-  };
 }
--- a/hosts/othalan/pkgs.nix
+++ b/hosts/othalan/pkgs.nix
@ -7,7 +7,7 @@
    ]

    ++ (with pkgs; [
-      sops
+
      distrobox
      zk
      quarto
--- a/hosts/othalan/secrets.yaml
+++ b/hosts/othalan/secrets.yaml
@ -1,30 +0,0 @@
-restic-othalan: ENC[AES256_GCM,data:HNIya1Rp,iv:8QkDewpXoy+3ahuuaCN/HfbGOgfQQ0Ud5emD7zVPE2s=,tag:bDfumEnt20lun5hnLY+eVA==,type:str]
-sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
-    age:
-        - recipient: age10ft5tkswydhmassqeqzr8frpx6vc07g4rwam09rs8agvgfrsn95q9ml7u3
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBCK3pzZ3hXdG40L1JyK281
-            NDJ4WWEyWFBPeERabXpSUXYzOWMxdWJlMGdFCmQydi8rbVZCUFBzM0NUbWJlZzZ3
-            anV6a2FCL1BRTWg2V1RBZFJXUUNRUEkKLS0tIHIwTzl5NEdoTWRaUm9LR3I1MFph
-            TFJjQndHQUJZdEZsSElmY0xDMTMvc2MKCO9BP1jccmFXqLjJQyk5a1/QC69/WPaV
-            xl8U7gFoiOf6ZIESk/fADVtnG+thEYF1vwEMI8ClUfs+8kWgwBqoGw==
-            -----END AGE ENCRYPTED FILE-----
-        - recipient: age1t4k04mjltmmhljnwugm6y4dejtu72vv4fd4anxxfsdpkapfnfauqe765gy
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqWnBYVFRKMVJPVEQ1VlAy
-            Y000L1lHM2JyN0oyeTFROXh6OTVlTkc5RlVBCkdqU20yeGtVcWo3cmRoQmFKVG91
-            d3RQazc1UTJBdWQwUEdzNkNPYXZ3SmsKLS0tIHdzd0Q0a1pPeEJqS1Rrckt6aUdt
-            UmE2Mk4yV21TNTF2NjBqZ0txYThRRzAKgyWCwmF4mhX8lmfslmBf2UrcFqzT8m11
-            AqhJsG2LRU/9/6FXOYn2rYeCIDpTkPoQ4ez7F4m/zp+RvOc2eW3g2g==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2024-11-29T00:41:44Z"
-    mac: ENC[AES256_GCM,data:4+H5OmCCTrMrkz9sLHcdwu8EFc+iS3MUTfhLgH6crfE0QSmV87b4JKQTVtdoYnzB8f2hRS/DeAImaLs68NQ/c7raLKwKmX1Bx2htV92MEOhoEjnZ6IbpCzY9FhrtRFjjBrg/nAuMpK0ktYW3w9C/v/jq/YEnP+pabkPhsUav8GU=,iv:LtBd2nj21ZCOXmvfbCIz/lvYC4neRk7ZTnY/rbJnATU=,tag:o9K/TxIp/NLmcvpXHYPHoQ==,type:str]
-    pgp: []
-    unencrypted_suffix: _unencrypted
-    version: 3.9.1
--- a/hosts/othalan/services.nix
+++ b/hosts/othalan/services.nix
@ -1,39 +1,35 @@
-{
-  config,
-#  pkgs,
-  ...
-}:
-# let
-#   notes-git = ''${pkgs.git}/bin/git -C /home/daylin/stuff/notes'';
-# in
+{ pkgs, ... }:
+let
+  notes-git = ''${pkgs.git}/bin/git -C /home/daylin/stuff/notes'';
+in
 {
  services.restic.backups.gdrive = {
    user = "daylin";
    repository = "rclone:g:archives/othalan";
-    passwordFile = config.sops.secrets.restic-othalan.path;
+    passwordFile = "/home/daylin/.config/restic/othalan-pass";
    paths = [
      "/home/daylin/stuff/"
      "/home/daylin/dev/"
    ];
  };

-  # systemd.services.notes-bot = {
-  #   description = "auto commit changes to notes";
-  #   serviceConfig = {
-  #     Type = "oneshot";
-  #     User = "daylin";
-  #     ExecStart = ''
-  #       ${pkgs.bash}/bin/bash -c '${notes-git} commit -m ":memo: :robot: $(${pkgs.coreutils}/bin/date +\'%%T\')" --no-gpg-sign -- notes'
-  #     '';
-  #   };
-  # };
-  # systemd.timers.notes-bot-timer = {
-  #   description = "run notes commit service";
-  #   wantedBy = [ "timers.target" ];
-  #   timerConfig = {
-  #     OnCalendar = "daily";
-  #     Persistent = true;
-  #     Unit = "notes-bot.service";
-  #   };
-  # };
+  systemd.services.notes-bot = {
+    description = "auto commit changes to notes";
+    serviceConfig = {
+      Type = "oneshot";
+      User = "daylin";
+      ExecStart = ''
+        ${pkgs.bash}/bin/bash -c '${notes-git} commit -m ":memo: :robot: $(${pkgs.coreutils}/bin/date +\'%%T\')" --no-gpg-sign -- notes'
+      '';
+    };
+  };
+  systemd.timers.notes-bot-timer = {
+    description = "run notes commit service";
+    wantedBy = [ "timers.target" ];
+    timerConfig = {
+      OnCalendar = "daily";
+      Persistent = true;
+      Unit = "notes-bot.service";
+    };
+  };
 }
--- a/lib/generators.nix
+++ b/lib/generators.nix
@ -17,15 +17,13 @@ let
    listify
    ;
  inherit (lib.filesystem) listFilesRecursive;
+
  flake = flakeFromSystem "x86_64-linux";
  hostPath = host: ../. + "/hosts/${host}";
-
  # all nix files not including pkgs.nix
+  # hostFiles = host: filter isNixFile (listFilesRecursive (hostPath host));
  hostFiles = host: host |> hostPath |> listFilesRecursive |> filter isNixFile;

-  nixosModules = names: names |> listify |> map (n: inputs.${n}.nixosModules.default);
-  selfModules = names: names |> listify |> map (n: self.nixosModules.${n});
-
  commonSpecialArgs = {
    inherit
      self
@ -37,7 +35,12 @@ let

  mkIso = nixosSystem {
    system = "x86_64-linux";
-    modules = (nixosModules "lix-module") ++ (selfModules "nix|essentials|iso");
+    modules = [
+      inputs.lix-module.nixosModules.default
+      self.nixosModules.nix
+      self.nixosModules.essentials
+      self.nixosModules.iso
+    ];
    specialArgs = commonSpecialArgs;
  };

@ -45,13 +48,12 @@ let
    hostName:
    nixosSystem {
      system = "x86_64-linux";
-      modules =
-        [
-          inputs.comin.nixosModules.comin
-        ]
-        ++ (selfModules ''oizys'')
-        ++ (nixosModules ''lix-module|hyprland|sops-nix'')
-        ++ (hostFiles hostName);
+      modules = [
+        ../modules/oizys.nix
+        inputs.lix-module.nixosModules.default
+        inputs.hyprland.nixosModules.default
+        inputs.comin.nixosModules.comin
+      ] ++ (hostFiles hostName);

      specialArgs = commonSpecialArgs // {
        inherit