From fadcad2d0b74c9bfd72d6bfa93030869d528cb08 Mon Sep 17 00:00:00 2001 From: nicknase27 Date: Sat, 25 Jul 2026 23:26:39 +0200 Subject: [PATCH] init --- README.md | 0 flake.lock | 196 ++++++++++++++++++++++++ flake.nix | 32 ++++ hosts/hermes/configuration.nix | 66 ++++++++ hosts/hermes/hardware-configuration.nix | 77 ++++++++++ modules/homelab.nix | 13 ++ modules/security.nix | 6 + modules/security/ssh.nix | 21 +++ modules/services/caddy.nix | 85 ++++++++++ modules/services/gitea.nix | 26 ++++ modules/services/navidrome.nix | 56 +++++++ modules/services/unifi.nix | 16 ++ modules/services/vaultwarden.nix | 24 +++ modules/system.nix | 7 + modules/system/backups.nix | 33 ++++ modules/system/garbage-collection.nix | 16 ++ secrets/caddy.age | Bin 0 -> 311 bytes secrets/gitea-db.age | Bin 0 -> 497 bytes secrets/navidrome.age | 5 + secrets/restic.age | 8 + secrets/secrets.nix | 15 ++ secrets/smb.age | 7 + secrets/vaultwarden.age | 5 + 23 files changed, 714 insertions(+) create mode 100644 README.md create mode 100644 flake.lock create mode 100644 flake.nix create mode 100644 hosts/hermes/configuration.nix create mode 100644 hosts/hermes/hardware-configuration.nix create mode 100644 modules/homelab.nix create mode 100644 modules/security.nix create mode 100644 modules/security/ssh.nix create mode 100644 modules/services/caddy.nix create mode 100644 modules/services/gitea.nix create mode 100644 modules/services/navidrome.nix create mode 100644 modules/services/unifi.nix create mode 100644 modules/services/vaultwarden.nix create mode 100644 modules/system.nix create mode 100644 modules/system/backups.nix create mode 100644 modules/system/garbage-collection.nix create mode 100644 secrets/caddy.age create mode 100644 secrets/gitea-db.age create mode 100644 secrets/navidrome.age create mode 100644 secrets/restic.age create mode 100644 secrets/secrets.nix create mode 100644 secrets/smb.age create mode 100644 secrets/vaultwarden.age diff --git a/README.md b/README.md new file mode 100644 index 0000000..e69de29 diff --git a/flake.lock b/flake.lock new file mode 100644 index 0000000..f6f57d3 --- /dev/null +++ b/flake.lock @@ -0,0 +1,196 @@ +{ + "nodes": { + "agenix": { + "inputs": { + "darwin": "darwin", + "home-manager": "home-manager", + "nixpkgs": "nixpkgs", + "systems": "systems" + }, + "locked": { + "lastModified": 1770165109, + "narHash": "sha256-9VnK6Oqai65puVJ4WYtCTvlJeXxMzAp/69HhQuTdl/I=", + "owner": "ryantm", + "repo": "agenix", + "rev": "b027ee29d959fda4b60b57566d64c98a202e0feb", + "type": "github" + }, + "original": { + "owner": "ryantm", + "repo": "agenix", + "type": "github" + } + }, + "blueprint": { + "inputs": { + "nixpkgs": [ + "unifi-os-server", + "nixpkgs" + ], + "systems": "systems_2" + }, + "locked": { + "lastModified": 1776249299, + "narHash": "sha256-Dt9t1TGRmJFc0xVYhttNBD6QsAgHOHCArqGa0AyjrJY=", + "owner": "numtide", + "repo": "blueprint", + "rev": "56131e8628f173d24a27f6d27c0215eff57e40dd", + "type": "github" + }, + "original": { + "owner": "numtide", + "repo": "blueprint", + "type": "github" + } + }, + "darwin": { + "inputs": { + "nixpkgs": [ + "agenix", + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1744478979, + "narHash": "sha256-dyN+teG9G82G+m+PX/aSAagkC+vUv0SgUw3XkPhQodQ=", + "owner": "lnl7", + "repo": "nix-darwin", + "rev": "43975d782b418ebf4969e9ccba82466728c2851b", + "type": "github" + }, + "original": { + "owner": "lnl7", + "ref": "master", + "repo": "nix-darwin", + "type": "github" + } + }, + "home-manager": { + "inputs": { + "nixpkgs": [ + "agenix", + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1745494811, + "narHash": "sha256-YZCh2o9Ua1n9uCvrvi5pRxtuVNml8X2a03qIFfRKpFs=", + "owner": "nix-community", + "repo": "home-manager", + "rev": "abfad3d2958c9e6300a883bd443512c55dfeb1be", + "type": "github" + }, + "original": { + "owner": "nix-community", + "repo": "home-manager", + "type": "github" + } + }, + "nixpkgs": { + "locked": { + "lastModified": 1754028485, + "narHash": "sha256-IiiXB3BDTi6UqzAZcf2S797hWEPCRZOwyNThJIYhUfk=", + "owner": "NixOS", + "repo": "nixpkgs", + "rev": "59e69648d345d6e8fef86158c555730fa12af9de", + "type": "github" + }, + "original": { + "owner": "NixOS", + "ref": "nixos-25.05", + "repo": "nixpkgs", + "type": "github" + } + }, + "nixpkgs_2": { + "locked": { + "lastModified": 1784796856, + "narHash": "sha256-wWFrV5/Qbm+lyt5x20E/bSbfJiGKMo4RCxZV8cl/WZI=", + "owner": "nixos", + "repo": "nixpkgs", + "rev": "e2587caef70cea85dd97d7daab492899902dbf5d", + "type": "github" + }, + "original": { + "owner": "nixos", + "ref": "nixos-unstable", + "repo": "nixpkgs", + "type": "github" + } + }, + "nixpkgs_3": { + "locked": { + "lastModified": 1776169885, + "narHash": "sha256-l/iNYDZ4bGOAFQY2q8y5OAfBBtrDAaPuRQqWaFHVRXM=", + "owner": "NixOS", + "repo": "nixpkgs", + "rev": "4bd9165a9165d7b5e33ae57f3eecbcb28fb231c9", + "type": "github" + }, + "original": { + "owner": "NixOS", + "ref": "nixos-unstable", + "repo": "nixpkgs", + "type": "github" + } + }, + "root": { + "inputs": { + "agenix": "agenix", + "nixpkgs": "nixpkgs_2", + "unifi-os-server": "unifi-os-server" + } + }, + "systems": { + "locked": { + "lastModified": 1681028828, + "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=", + "owner": "nix-systems", + "repo": "default", + "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e", + "type": "github" + }, + "original": { + "owner": "nix-systems", + "repo": "default", + "type": "github" + } + }, + "systems_2": { + "locked": { + "lastModified": 1681028828, + "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=", + "owner": "nix-systems", + "repo": "default", + "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e", + "type": "github" + }, + "original": { + "owner": "nix-systems", + "repo": "default", + "type": "github" + } + }, + "unifi-os-server": { + "inputs": { + "blueprint": "blueprint", + "nixpkgs": "nixpkgs_3" + }, + "locked": { + "lastModified": 1783941815, + "narHash": "sha256-9S5fNoQpSipPSRijOhgB0JHsZlLQxJzEzgM8Ia9SJz4=", + "owner": "rcambrj", + "repo": "unifi-os-server", + "rev": "075e542294406a2f3449e06dab12765ce56958c3", + "type": "github" + }, + "original": { + "owner": "rcambrj", + "repo": "unifi-os-server", + "type": "github" + } + } + }, + "root": "root", + "version": 7 +} diff --git a/flake.nix b/flake.nix new file mode 100644 index 0000000..38f2ee1 --- /dev/null +++ b/flake.nix @@ -0,0 +1,32 @@ +{ + description = "Nixos config flake"; + + inputs = { + nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable"; + agenix.url = "github:ryantm/agenix"; + unifi-os-server.url = "github:rcambrj/unifi-os-server"; + + # home-manager = { + # url = "github:nix-community/home-manager"; + # inputs.nixpkgs.follows = "nixpkgs"; + # }; + }; + + outputs = { self, nixpkgs, agenix, unifi-os-server, ... }@inputs: { + # use "nixos", or your hostname as the name of the configuration + # it's a better practice than "default" shown in the video + nixosConfigurations.Hermes= nixpkgs.lib.nixosSystem { + specialArgs = {inherit inputs;}; + modules = [ + ./hosts/hermes/configuration.nix + ./hosts/hermes/hardware-configuration.nix + ./modules/homelab.nix + ./modules/security.nix + ./modules/system.nix + agenix.nixosModules.default + unifi-os-server.nixosModules.unifi-os-server + # inputs.home-manager.nixosModules.default + ]; + }; + }; +} diff --git a/hosts/hermes/configuration.nix b/hosts/hermes/configuration.nix new file mode 100644 index 0000000..79c6963 --- /dev/null +++ b/hosts/hermes/configuration.nix @@ -0,0 +1,66 @@ +{ + config, + lib, + pkgs, + inputs, + ... +}: { + imports = [ + ]; + + nix.settings.experimental-features = ["nix-command" "flakes"]; + nixpkgs.config.allowUnfree = true; + + # Use the systemd-boot EFI boot loader. + boot.loader.systemd-boot.enable = true; + boot.loader.efi.canTouchEfiVariables = true; + + # Use latest kernel. + boot.kernelPackages = pkgs.linuxPackages_latest; + + networking.hostName = "Hermes"; # Define your hostname. + + networking.networkmanager.enable = true; + networking.nameservers = ["1.1.1.1" "1.0.0.1"]; + + # Set your time zone. + time.timeZone = "Europe/Berlin"; + + users.users.nick = { + isNormalUser = true; + shell = pkgs.zsh; + extraGroups = ["wheel"]; # Enable ‘sudo’ for the user. + packages = with pkgs; [ + ]; + }; + + programs.zsh = { + enable = true; + }; + + environment.systemPackages = with pkgs; [ + inputs.agenix.packages."${system}".default + neovim + wget + curl + git + fastfetch + rsync + starship + eza + net-tools + alejandra + nixd + ]; + + networking.firewall.enable = false; + networking.firewall.allowedTCPPorts = [8222]; + + networking.nftables.enable = true; + + age.identityPaths = [ + "/etc/ssh/id_ed25519" + ]; + + system.stateVersion = "26.05"; # Did you read the comment? +} diff --git a/hosts/hermes/hardware-configuration.nix b/hosts/hermes/hardware-configuration.nix new file mode 100644 index 0000000..f764d1b --- /dev/null +++ b/hosts/hermes/hardware-configuration.nix @@ -0,0 +1,77 @@ +{ + config, + lib, + pkgs, + modulesPath, + ... +}: { + imports = [ + (modulesPath + "/profiles/qemu-guest.nix") + ]; + + boot.initrd.availableKernelModules = ["ahci" "xhci_pci" "virtio_pci" "sr_mod" "virtio_blk"]; + boot.initrd.kernelModules = []; + boot.kernelModules = ["kvm-amd"]; + boot.extraModulePackages = []; + + fileSystems."/" = { + device = "/dev/disk/by-uuid/4a3884e7-5c89-4987-8482-3b3640d2aebf"; + fsType = "btrfs"; + options = ["subvol=@"]; + }; + + fileSystems."/home" = { + device = "/dev/disk/by-uuid/4a3884e7-5c89-4987-8482-3b3640d2aebf"; + fsType = "btrfs"; + options = ["subvol=@home"]; + }; + + fileSystems."/nix" = { + device = "/dev/disk/by-uuid/4a3884e7-5c89-4987-8482-3b3640d2aebf"; + fsType = "btrfs"; + options = ["subvol=@nix"]; + }; + + fileSystems."/.snapshots" = { + device = "/dev/disk/by-uuid/4a3884e7-5c89-4987-8482-3b3640d2aebf"; + fsType = "btrfs"; + options = ["subvol=@snapshots"]; + }; + + fileSystems."/var/log" = { + device = "/dev/disk/by-uuid/4a3884e7-5c89-4987-8482-3b3640d2aebf"; + fsType = "btrfs"; + options = ["subvol=@log"]; + }; + + fileSystems."/boot" = { + device = "/dev/disk/by-uuid/5802-1BBF"; + fsType = "vfat"; + options = ["fmask=0022" "dmask=0022"]; + }; + + fileSystems."/mnt/media" = { + device = "//10.0.0.5/media"; + fsType = "cifs"; + options = ["credentials=${config.age.secrets.smb.path}" "x-systemd.automount" "nofail" "noperm" "x-systemd.after=network-online.target" "x-systemd.automount-options=--timeout=30" "_netdev"]; + }; + + fileSystems."/mnt/backups" = { + device = "//10.0.0.5/infra/backups"; + fsType = "cifs"; + options = ["credentials=${config.age.secrets.smb.path}" "x-systemd.automount" "nofail" "noperm" "x-systemd.after=network-online.target" "x-systemd.automount-options=--timeout=30" "_netdev"]; + }; + + swapDevices = [ + {device = "/dev/disk/by-uuid/ecbbcef6-c4c2-4cfe-bcd2-5a2e599c3009";} + ]; + + age.secrets.smb = { + file = ../../secrets/smb.age; + path = "/run/secrets/smb"; + }; + + systemd.network.wait-online.enable = true; + hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware; + nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux"; +} diff --git a/modules/homelab.nix b/modules/homelab.nix new file mode 100644 index 0000000..99f4177 --- /dev/null +++ b/modules/homelab.nix @@ -0,0 +1,13 @@ +{ + pkgs, + lib, + ... +}: { + imports = [ + ./services/vaultwarden.nix + ./services/navidrome.nix + ./services/caddy.nix + ./services/unifi.nix + ./services/gitea.nix + ]; +} diff --git a/modules/security.nix b/modules/security.nix new file mode 100644 index 0000000..3cf9988 --- /dev/null +++ b/modules/security.nix @@ -0,0 +1,6 @@ +{ pkgs, lib, config, ... }: +{ + imports = [ + ./security/ssh.nix + ]; +} diff --git a/modules/security/ssh.nix b/modules/security/ssh.nix new file mode 100644 index 0000000..2945291 --- /dev/null +++ b/modules/security/ssh.nix @@ -0,0 +1,21 @@ +{ + pkgs, + lib, + ... +}: { + services.openssh = { + enable = true; + openFirewall = true; + settings = { + PasswordAuthentication = false; + KbdInteractiveAuthentication = false; + PermitRootLogin = "no"; + AllowUsers = ["nick" "gitea"]; + MaxAuthTries = 3; + PerSourcePenalties = "crash:3600s authfail:3600s max:86400s"; + }; + }; + users.users."nick".openssh.authorizedKeys.keys = [ + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJwouafzGDRGeMJQbm9ME/1CSkXicdL7TthJjWkhyLYd nick@Theseus" + ]; +} diff --git a/modules/services/caddy.nix b/modules/services/caddy.nix new file mode 100644 index 0000000..e017025 --- /dev/null +++ b/modules/services/caddy.nix @@ -0,0 +1,85 @@ +{ + pkgs, + lib, + config, + ... +}: { + services.caddy = { + enable = true; + environmentFile = "/run/secrets/caddy.env"; + package = pkgs.caddy.withPlugins { + plugins = ["github.com/caddy-dns/cloudflare@v0.2.4"]; + hash = "sha256-7GoH8YLCoPmPExQxoga2FHB58zQDoZVf1BBwkVi0SsQ="; + }; + globalConfig = '' + email {$EMAIL} + acme_dns cloudflare {$CLOUDFLARE} { + resolvers 1.1.1.1:53 1.0.0.1:53 + } + ''; + # Public + virtualHosts = { + "nicknase27.com" = { + extraConfig = '' + respond "Blank" 200 + ''; + }; + "nv.nicknase27.com" = { + extraConfig = '' + reverse_proxy localhost:4533 + ''; + serverAliases = ["music.nicknase27.com"]; + }; + "vt.nicknase27.com" = { + extraConfig = '' + reverse_proxy localhost:8222 + ''; + serverAliases = ["vault.nicknase27.com"]; + }; + "git.nicknase27.com" = { + extraConfig = '' + reverse_proxy localhost:3000 + ''; + }; + "jf.nicknase27.com" = { + extraConfig = '' + reverse_proxy 10.0.0.5:8096 + ''; + serverAliases = ["watch.nicknase27.com"]; + }; + + # Local + "opn.nicknase27.com" = { + extraConfig = '' + reverse_proxy 10.0.0.1:80 + ''; + }; + "ui.nicknase27.com" = { + extraConfig = '' + reverse_proxy https://localhost:11443 { + transport http { + tls_insecure_skip_verify + } + + } + + ''; + }; + "storage.nicknase27.com" = { + extraConfig = '' + reverse_proxy 10.0.0.5:80 + ''; + }; + "photos.nicknase27.com" = { + extraConfig = '' + reverse_proxy 10.0.0.5:2283 + ''; + }; + }; + }; + + age.secrets.caddy = { + file = ../../secrets/caddy.age; + path = "/run/secrets/caddy.env"; + }; +} diff --git a/modules/services/gitea.nix b/modules/services/gitea.nix new file mode 100644 index 0000000..225be6c --- /dev/null +++ b/modules/services/gitea.nix @@ -0,0 +1,26 @@ +{ + pkgs, + config, + lib, + ... +}: { + services.gitea = { + enable = true; + database = { + type = "sqlite3"; + passwordFile = "${config.age.secrets.gitea-db.path}"; + }; + settings = { + server = { + DOMAIN = "git.nicknase27.com"; + ROOT_URL = "https://git.nicknase27.com"; + }; + }; + }; + + age.secrets.gitea-db = { + file = ../../secrets/gitea-db.age; + path = "/run/secrets/gitea-db"; + mode = "777"; + }; +} diff --git a/modules/services/navidrome.nix b/modules/services/navidrome.nix new file mode 100644 index 0000000..3f82afa --- /dev/null +++ b/modules/services/navidrome.nix @@ -0,0 +1,56 @@ +{ + pkgs, + lib, + config, + ... +}: { + services.navidrome = { + #Settings + enable = true; + openFirewall = true; + settings = { + Address = "0.0.0.0"; + Port = 4533; + DataFolder = "/var/lib/navidrome"; + BaseURL = "https://nv.nicknase27.com"; + + # Library + MusicFolder = "/mnt/media/music"; + AlbumPlayCountMode = "normalized"; + AutoImportPlaylists = false; + PID.Track = "musicbrainz_trackid|albumid,discnumber,tracknumber,title"; + PID.Album = "musicbrainz_albumid|albumartistid,album,albumversion,musicbrainz_acoustid"; + + # UI / Features + DefaultTheme = "Spotify-ish"; + EnableDownloads = true; + DefaultDownloadableShare = true; + EnableInsightsCollector = false; + EnableSharing = true; + EnableStarRating = true; + DefaultUIVolume = 100; + + LastFM.Enabled = true; + }; + + #Plugins + plugins = with pkgs.navidromePlugins; [ + discord-rich-presence + ]; + + #Environment + environmentFile = "/run/secrets/navidrome.env"; + }; + + age.secrets.navidrome = { + file = ../../secrets/navidrome.age; + path = "/run/secrets/navidrome.env"; + }; + + systemd.services = { + navidrome = { + after = ["mnt-media.mount"]; + requires = ["mnt-media.mount"]; + }; + }; +} diff --git a/modules/services/unifi.nix b/modules/services/unifi.nix new file mode 100644 index 0000000..a26913c --- /dev/null +++ b/modules/services/unifi.nix @@ -0,0 +1,16 @@ +{ + pkgs, + lib, + config, + ... +}: { + virtualisation.podman.enable = true; + virtualisation.oci-containers.backend = "podman"; + + services.unifi-os-server = { + enable = true; + uosSystemIP = "10.0.0.10"; + openFirewallUiPort = true; + openFirewallServicePorts = true; + }; +} diff --git a/modules/services/vaultwarden.nix b/modules/services/vaultwarden.nix new file mode 100644 index 0000000..7d2a6e3 --- /dev/null +++ b/modules/services/vaultwarden.nix @@ -0,0 +1,24 @@ +{ + pkgs, + lib, + ... +}: { + services.vaultwarden = { + enable = true; + dbBackend = "sqlite"; + backupDir = "/var/local/vaultwarden/backup"; + config = { + DOMAIN = "https://vt.nicknase27.com"; + SIGNUPS_ALLOWED = "true"; + + ROCKET_ADDRESS = "0.0.0.0"; + ROCKET_PORT = 8222; + ROCKET_LOG = "critical"; + }; + environmentFile = ["/run/secrets/vaultwarden.env"]; + }; + age.secrets.vaultwarden = { + file = ../../secrets/vaultwarden.age; + path = "/run/secrets/vaultwarden.env"; + }; +} diff --git a/modules/system.nix b/modules/system.nix new file mode 100644 index 0000000..c3e3f99 --- /dev/null +++ b/modules/system.nix @@ -0,0 +1,7 @@ +{ pkgs, lib, config, ... }: +{ + imports = [ + ./system/garbage-collection.nix + ./system/backups.nix + ]; +} diff --git a/modules/system/backups.nix b/modules/system/backups.nix new file mode 100644 index 0000000..de4ec98 --- /dev/null +++ b/modules/system/backups.nix @@ -0,0 +1,33 @@ +{ + pkgs, + config, + lib, + ... +}: { + services.restic.backups.hermes = { + initialize = true; + + repository = "/mnt/backups/"; + + passwordFile = config.age.secrets.restic.path; + + paths = [ + "/var/lib" + ]; + + timerConfig = { + OnCalendar = "daily"; + RandomizedDelaySec = "1h"; + }; + + pruneOpts = [ + "--keep-daily=7" + "--keep-weekly=4" + "--keep-monthly=12" + ]; + }; + + age.secrets.restic = { + file = ../../secrets/restic.age; + }; +} diff --git a/modules/system/garbage-collection.nix b/modules/system/garbage-collection.nix new file mode 100644 index 0000000..788d01d --- /dev/null +++ b/modules/system/garbage-collection.nix @@ -0,0 +1,16 @@ +{ + pkgs, + lib, + config, + ... +}: { + nix = { + gc = { + automatic = true; + dates = "weekly"; + options = "--delete-older-than 30d"; + }; + + optimise.automatic = true; + }; +} diff --git a/secrets/caddy.age b/secrets/caddy.age new file mode 100644 index 0000000000000000000000000000000000000000..8d19d651f3fdd6b77a0de044070a3267d38bb3cc GIT binary patch literal 311 zcmYdHPt{G$OD?J`D9Oyv)5|YP*Do{V(zR14F3!+RO))YxHMCSnDKtq9PFJw7$f(HA zOS3Stu*gVqFLw(w^Y_WgP7Mz5_K!>~F%Q!Yt0*UeBx=7kYiYF6er)^v|MkcPZvEsGc_h8 zHw7=#4%nvea$$q{llk4JKToZ??ELCv-aoqnJ;4L~&(xQ`xlqxOd1sq3mtWqcjaPe( zW^PiQ!zOO!cKF`gU7Jqp?)tsW>U)y&g2m-41)cI01Q?7q+vP>{N50XH*$@`|)jD@S N*Pg#O+>LF%0|2d~dPe{N literal 0 HcmV?d00001 diff --git a/secrets/gitea-db.age b/secrets/gitea-db.age new file mode 100644 index 0000000000000000000000000000000000000000..67a4e85c3eb2d1f25a7eb5d800db42d5dd077fff GIT binary patch literal 497 zcmYdHPt{G$OD?J`D9Oyv)5|YP*Do{V(zR14F3!+RO))YxHMCSnDKtq9PFL^>&vME% z%L&d5@GMO&aZ3-1tVk*HDh+bXsPIenjLJ1Nv+&9?EG-YHNak|(ElBp%cXiKBODi?b zwQvvDH;wdm$}Y|D^G%5e(f0GrkMb|bbaHmg3`MuC!Y4F0Do`Q3&?K|O$UHC1r>rp3 zH@7^^G2bNBue`9_AS)v?EH}$9D!jxm!`&sd%7V);(JjibqQW!4)Wz7{%*3K9Q@_~M zBqh|{$15Pf)3`|AFegvD$kaX0ES*bNS63k`#nn4KIN!w0DAc{&(Z|A|I5ElCHP|S~ z%q`s_qr|{4Dk~+mBrDh?Dx2%jJLh?ia^qYR>$J>$X0Lg3>+bvj-vG;1vL}?(3~utx z&AT2Zy-zfJ|L(h`o`!4OB_1}cNIz}7<-gw#w{i!rs_aKB?~*bnM5o>BOTW@=rT2e% z%SSE|DN%*U`&ZZuH*BvEVAvdakN4nI<7p-jZ=LeF$t3svame?Z)u-z(dL3Hv=v3sL zs)&@Ity{L(Epoj*ufFc7*KcRee2=zWRfY5P`A?{MPpsMBWwI$QyVv_;yx5hdro5^} heskuoJDk0EhR{CSOFfdao|exRbxwJ&$)m`!3INKl!)yQm literal 0 HcmV?d00001 diff --git a/secrets/navidrome.age b/secrets/navidrome.age new file mode 100644 index 0000000..6fc26c9 --- /dev/null +++ b/secrets/navidrome.age @@ -0,0 +1,5 @@ +age-encryption.org/v1 +-> ssh-ed25519 dq4eSg Bq3jE4tZijPeR0roGJHQA7JH914Evpn6z1WGRllF5Bg +/b27LMvQPH3GLDPCCBye1rkwmGfCyP9q6G5sejPMWis +--- Vyv4jpwB4CKfE0jALdWEydsowc/4aRV4iz8UvkWxibQ + ~:x5ۺ5fD$ʫc]y"d 8a?9d t`B,j-YSE^@(K[2fnhk}>tbqxc:(d.wj \ No newline at end of file diff --git a/secrets/restic.age b/secrets/restic.age new file mode 100644 index 0000000..489d536 --- /dev/null +++ b/secrets/restic.age @@ -0,0 +1,8 @@ +age-encryption.org/v1 +-> ssh-ed25519 dq4eSg oxAzXUKcoOjUxNB4tZII/ytFF6DRjm7duIS9Ds/2Zwo +xm7nHystUY8VeCPKUHIkWrDsXHLJTsYMZX8tKtp5VYI +-> ssh-ed25519 xLUmZQ zrJy1kKXBVSKyKUXGT2Cpi9SW46Kxuz7SCviY/56HFw +dWs2+G1D7oTpHc71xOlqy8nWYjw+Qw2JsQ23X5JrU5Q +--- XojFhUQJoBobIDxGDG9rW52zmf4K3Z73Iiu9EpTSQB0 + +f5qr#4;.|SRajQd_j`wӠ;=x$L1=2Va \ No newline at end of file diff --git a/secrets/secrets.nix b/secrets/secrets.nix new file mode 100644 index 0000000..4191299 --- /dev/null +++ b/secrets/secrets.nix @@ -0,0 +1,15 @@ +let + hermes = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIF+0IQBasZ9MUZxF7hlx3aH00pEIgpkuWh5ZVRmOLpMN nick@Hermes"; + theseus = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJwouafzGDRGeMJQbm9ME/1CSkXicdL7TthJjWkhyLYd nick@Theseus"; + + systems = [hermes theseus]; +in { + "caddy.age".publicKeys = systems; + "restic.age".publicKeys = systems; + "smb.age".publicKeys = systems; + "gitea-db.age".publicKeys = systems; + #"wireguard-private.age".publicKeys = systems; + #"wireguard-public.age".publicKeys = systems; + "navidrome.age".publicKeys = systems; + "vaultwarden.age".publicKeys = systems; +} diff --git a/secrets/smb.age b/secrets/smb.age new file mode 100644 index 0000000..03a1d21 --- /dev/null +++ b/secrets/smb.age @@ -0,0 +1,7 @@ +age-encryption.org/v1 +-> ssh-ed25519 dq4eSg B7XhfVlAF4n2nOiakXwfDlmabbeYctB5kfGHQeTBIg8 +QRMGoqZ+3m9eCh4JtSvrMkwB8REo/SFy/E5x1acZLnQ +-> ssh-ed25519 xLUmZQ kx3yrLGzWjAY2xfF6wqND5aYZMxlDkSW1NKeoylxrhk +Tz8/KjlcYO0MCiypLQWNuZID+BJXmJ3vQH3c22Bbs/A +--- tlKKxD/3yE85aBdrMC6o5gr86RBo8qNJPJdEJ6gbkxE +.߼h9>mHpIyZ7%!-4gyΠo>eAdENlZ.7N蜘"t# P{R}7P_e \ No newline at end of file diff --git a/secrets/vaultwarden.age b/secrets/vaultwarden.age new file mode 100644 index 0000000..f529b14 --- /dev/null +++ b/secrets/vaultwarden.age @@ -0,0 +1,5 @@ +age-encryption.org/v1 +-> ssh-ed25519 dq4eSg kIejU5J8ePOW65gY/72byCy5jQk/y4TBwuJ+Ss/fpmg +UI2cKAJ3sOwSKmlavV0SZ3sFnCNEwbGpled1QMQPppU +--- vpqeBDI2Vbds2jih32m5uqVmgsFlZMbfwsqTvEND6pY +`!e~Y@>0#[)4g^1A@;8 0*1KbRG\uaA_9;iƏG \ No newline at end of file