diff --git a/deploy/colmena.nix b/deploy/colmena.nix index 268b9e23..0e7ad4d7 100644 --- a/deploy/colmena.nix +++ b/deploy/colmena.nix @@ -30,7 +30,12 @@ inputs.colmena.lib.makeHive ( }; nodeNixpkgs = builtins.mapAttrs (_: v: v.pkgs) self.nixosConfigurations; - nodeSpecialArgs = builtins.mapAttrs (_: v: v._module.specialArgs or { }) self.nixosConfigurations; + specialArgs = { + inherit inputs; + outputs = self; + dotsPath = ../dots; + myUtils = utils; + }; }; } // nodes diff --git a/flake.lock b/flake.lock index 50c90473..62826e34 100644 --- a/flake.lock +++ b/flake.lock @@ -121,11 +121,11 @@ }, "locked": { "dir": "pkgs/firefox-addons", - "lastModified": 1774843378, - "narHash": "sha256-8QLbY8F7UdxeQaW0KUVgr1/YPIupe+1lGjS5joR+ZCw=", + "lastModified": 1775966594, + "narHash": "sha256-pnRtaqTr7ut8dz8b04OWAanUM4tGhDUJz8SWmeTRp7U=", "owner": "rycee", "repo": "nur-expressions", - "rev": "0a31b668e3ebb599f95dc518076d709e8dddb57c", + "rev": "000d1d2322d28fa0a51b8db9f85a227aa5413b52", "type": "gitlab" }, "original": { @@ -138,11 +138,11 @@ "firefox-gnome-theme": { "flake": false, "locked": { - "lastModified": 1764873433, - "narHash": "sha256-1XPewtGMi+9wN9Ispoluxunw/RwozuTRVuuQOmxzt+A=", + "lastModified": 1775176642, + "narHash": "sha256-2veEED0Fg7Fsh81tvVDNYR6SzjqQxa7hbi18Jv4LWpM=", "owner": "rafaelmardojai", "repo": "firefox-gnome-theme", - "rev": "f7ffd917ac0d253dbd6a3bf3da06888f57c69f92", + "rev": "179704030c5286c729b5b0522037d1d51341022c", "type": "github" }, "original": { @@ -213,11 +213,11 @@ ] }, "locked": { - "lastModified": 1767609335, - "narHash": "sha256-feveD98mQpptwrAEggBQKJTYbvwwglSbOv53uCfH9PY=", + "lastModified": 1775087534, + "narHash": "sha256-91qqW8lhL7TLwgQWijoGBbiD4t7/q75KTi8NxjVmSmA=", "owner": "hercules-ci", "repo": "flake-parts", - "rev": "250481aafeb741edfe23d29195671c19b36b6dca", + "rev": "3107b77cd68437b9a76194f0f7f9c55f2329ca5b", "type": "github" }, "original": { @@ -284,11 +284,11 @@ ] }, "locked": { - "lastModified": 1775036584, - "narHash": "sha256-zW0lyy7ZNNT/x8JhzFHBsP2IPx7ATZIPai4FJj12BgU=", + "lastModified": 1775585728, + "narHash": "sha256-8Psjt+TWvE4thRKktJsXfR6PA/fWWsZ04DVaY6PUhr4=", "owner": "cachix", "repo": "git-hooks.nix", - "rev": "4e0eb042b67d863b1b34b3f64d52ceb9cd926735", + "rev": "580633fa3fe5fc0379905986543fd7495481913d", "type": "github" }, "original": { @@ -321,20 +321,18 @@ "gnome-shell": { "flake": false, "locked": { - "host": "gitlab.gnome.org", "lastModified": 1767737596, "narHash": "sha256-eFujfIUQDgWnSJBablOuG+32hCai192yRdrNHTv0a+s=", "owner": "GNOME", "repo": "gnome-shell", "rev": "ef02db02bf0ff342734d525b5767814770d85b49", - "type": "gitlab" + "type": "github" }, "original": { - "host": "gitlab.gnome.org", "owner": "GNOME", - "ref": "gnome-49", "repo": "gnome-shell", - "type": "gitlab" + "rev": "ef02db02bf0ff342734d525b5767814770d85b49", + "type": "github" } }, "home-manager": { @@ -344,11 +342,11 @@ ] }, "locked": { - "lastModified": 1775047159, - "narHash": "sha256-UWM4VZvfKaPwA9FMu7iZha5YAE8vsEtUazk+rFxmbTY=", + "lastModified": 1775983377, + "narHash": "sha256-ZeRjipGQnVtQ/6batI+yVOrL853FZsL0m9A63OaSfgM=", "owner": "nix-community", "repo": "home-manager", - "rev": "1ce9e62690dfdd7e76bd266ccb9a887778410eb2", + "rev": "e0ca734ffc85d25297715e98010b93303fa165c4", "type": "github" }, "original": { @@ -400,10 +398,10 @@ "nix-secrets": { "flake": false, "locked": { - "lastModified": 1773999602, - "narHash": "sha256-Th4RuCEPHC8y1w/wrW9OSv9nAJ3/NSZ3MJ4DHhCXCKE=", + "lastModified": 1775987539, + "narHash": "sha256-ilN7pQUw/k4oBPJ+VoR3N5wWo72ePZfT4uvapiaLRng=", "ref": "main", - "rev": "6f4b099a0c5ad1cca97f4ba1a665faaaed367f13", + "rev": "13c6ddfbec41164dbdaa9d70c01cd784ea9e17e5", "shallow": true, "type": "git", "url": "ssh://git@github.com/hektor/nix-secrets" @@ -417,11 +415,11 @@ }, "nixCats": { "locked": { - "lastModified": 1770584904, - "narHash": "sha256-9Zaz8lbKF2W9pwXZEnbiGsicHdBoU+dHt3Wv3mCJoZ8=", + "lastModified": 1774835836, + "narHash": "sha256-6ok7iv/9R82vl6MYe3Lwyyb6S5bmW2PxEZtmjzlqyPs=", "owner": "BirdeeHub", "repo": "nixCats-nvim", - "rev": "538fdde784d2909700d97a8ef307783b33a86fb1", + "rev": "ebb9f279a55ca60ff4e37e4accf6518dc627aa8d", "type": "github" }, "original": { @@ -453,11 +451,11 @@ }, "nixos-hardware": { "locked": { - "lastModified": 1774933469, - "narHash": "sha256-OrnCQeUO2bqaWUl0lkDWyGWjKsOhtCyd7JSfTedQNUE=", + "lastModified": 1775490113, + "narHash": "sha256-2ZBhDNZZwYkRmefK5XLOusCJHnoeKkoN95hoSGgMxWM=", "owner": "NixOS", "repo": "nixos-hardware", - "rev": "f4c4c2c0c923d7811ac2a63ccc154767e4195337", + "rev": "c775c2772ba56e906cbeb4e0b2db19079ef11ff7", "type": "github" }, "original": { @@ -469,11 +467,11 @@ }, "nixpkgs": { "locked": { - "lastModified": 1774709303, - "narHash": "sha256-D3Q07BbIA2KnTcSXIqqu9P586uWxN74zNoCH3h2ESHg=", + "lastModified": 1775710090, + "narHash": "sha256-ar3rofg+awPB8QXDaFJhJ2jJhu+KqN/PRCXeyuXR76E=", "owner": "nixos", "repo": "nixpkgs", - "rev": "8110df5ad7abf5d4c0f6fb0f8f978390e77f9685", + "rev": "4c1018dae018162ec878d42fec712642d214fdfa", "type": "github" }, "original": { @@ -511,11 +509,11 @@ ] }, "locked": { - "lastModified": 1767810917, - "narHash": "sha256-ZKqhk772+v/bujjhla9VABwcvz+hB2IaRyeLT6CFnT0=", + "lastModified": 1775228139, + "narHash": "sha256-ebbeHmg+V7w8050bwQOuhmQHoLOEOfqKzM1KgCTexK4=", "owner": "nix-community", "repo": "NUR", - "rev": "dead29c804adc928d3a69dfe7f9f12d0eec1f1a4", + "rev": "601971b9c89e0304561977f2c28fa25e73aa7132", "type": "github" }, "original": { @@ -567,11 +565,11 @@ "plugins-helm-ls-nvim": { "flake": false, "locked": { - "lastModified": 1768584652, - "narHash": "sha256-jnMc87OjURNcqsva0npYgVyUrWc5C6L7yHpNvt9eSmg=", + "lastModified": 1773934114, + "narHash": "sha256-8trqFsA7nTKSdtkiAL0Sa9bXjh5ONtAqN7XNE/B8ukM=", "owner": "qvalentin", "repo": "helm-ls.nvim", - "rev": "f0b9a1723890971a6d84890b50dbf5f40974ea1b", + "rev": "20df43509b02a3ce3c6b3eee254d6e2bffa9a370", "type": "github" }, "original": { @@ -667,11 +665,11 @@ ] }, "locked": { - "lastModified": 1774910634, - "narHash": "sha256-B+rZDPyktGEjOMt8PcHKYmgmKoF+GaNAFJhguktXAo0=", + "lastModified": 1775971308, + "narHash": "sha256-VKp9bhVSm0bT6JWctFy06ocqxGGnWHi1NfoE90IgIcY=", "owner": "Mic92", "repo": "sops-nix", - "rev": "19bf3d8678fbbfbc173beaa0b5b37d37938db301", + "rev": "31ac5fe5d015f76b54058c69fcaebb66a55871a4", "type": "github" }, "original": { @@ -710,18 +708,17 @@ ], "nur": "nur", "systems": "systems_2", - "tinted-foot": "tinted-foot", "tinted-kitty": "tinted-kitty", "tinted-schemes": "tinted-schemes", "tinted-tmux": "tinted-tmux", "tinted-zed": "tinted-zed" }, "locked": { - "lastModified": 1774897726, - "narHash": "sha256-k/H2/oyex6GEC6uYXYetrboFQeTmX1Ouwv/zaW7b/Z0=", + "lastModified": 1775936757, + "narHash": "sha256-KJO/7qoxJ+hlsb3WlFSl6IGrExBIf1GvKdrhOlnGdKY=", "owner": "danth", "repo": "stylix", - "rev": "9b4a5eb409ceac2dd6ad495c7988e189a418cd30", + "rev": "d3e447786b74d62c75f665e17cb3e681c66e90c7", "type": "github" }, "original": { @@ -760,23 +757,6 @@ "type": "github" } }, - "tinted-foot": { - "flake": false, - "locked": { - "lastModified": 1726913040, - "narHash": "sha256-+eDZPkw7efMNUf3/Pv0EmsidqdwNJ1TaOum6k7lngDQ=", - "owner": "tinted-theming", - "repo": "tinted-foot", - "rev": "fd1b924b6c45c3e4465e8a849e67ea82933fcbe4", - "type": "github" - }, - "original": { - "owner": "tinted-theming", - "repo": "tinted-foot", - "rev": "fd1b924b6c45c3e4465e8a849e67ea82933fcbe4", - "type": "github" - } - }, "tinted-kitty": { "flake": false, "locked": { @@ -796,11 +776,11 @@ "tinted-schemes": { "flake": false, "locked": { - "lastModified": 1767710407, - "narHash": "sha256-+W1EB79Jl0/gm4JqmO0Nuc5C7hRdp4vfsV/VdzI+des=", + "lastModified": 1772661346, + "narHash": "sha256-4eu3LqB9tPqe0Vaqxd4wkZiBbthLbpb7llcoE/p5HT0=", "owner": "tinted-theming", "repo": "schemes", - "rev": "2800e2b8ac90f678d7e4acebe4fa253f602e05b2", + "rev": "13b5b0c299982bb361039601e2d72587d6846294", "type": "github" }, "original": { @@ -812,11 +792,11 @@ "tinted-tmux": { "flake": false, "locked": { - "lastModified": 1767489635, - "narHash": "sha256-e6nnFnWXKBCJjCv4QG4bbcouJ6y3yeT70V9MofL32lU=", + "lastModified": 1772934010, + "narHash": "sha256-x+6+4UvaG+RBRQ6UaX+o6DjEg28u4eqhVRM9kpgJGjQ=", "owner": "tinted-theming", "repo": "tinted-tmux", - "rev": "3c32729ccae99be44fe8a125d20be06f8d7d8184", + "rev": "c3529673a5ab6e1b6830f618c45d9ce1bcdd829d", "type": "github" }, "original": { @@ -828,11 +808,11 @@ "tinted-zed": { "flake": false, "locked": { - "lastModified": 1767488740, - "narHash": "sha256-wVOj0qyil8m+ouSsVZcNjl5ZR+1GdOOAooAatQXHbuU=", + "lastModified": 1772909925, + "narHash": "sha256-jx/5+pgYR0noHa3hk2esin18VMbnPSvWPL5bBjfTIAU=", "owner": "tinted-theming", "repo": "base16-zed", - "rev": "11abb0b282ad3786a2aae088d3a01c60916f2e40", + "rev": "b4d3a1b3bcbd090937ef609a0a3b37237af974df", "type": "github" }, "original": { diff --git a/home/hosts/astyanax/default.nix b/home/hosts/astyanax/default.nix index 5936f460..4dd8d5cf 100644 --- a/home/hosts/astyanax/default.nix +++ b/home/hosts/astyanax/default.nix @@ -23,6 +23,7 @@ ../../modules/nfc ../../modules/nvim ../../modules/pandoc + ../../modules/secrets ../../modules/shell ../../modules/ssh ../../modules/taskwarrior diff --git a/home/modules/anki/default.nix b/home/modules/anki/default.nix index 337679fa..91580b1c 100644 --- a/home/modules/anki/default.nix +++ b/home/modules/anki/default.nix @@ -4,13 +4,21 @@ pkgs, myUtils, osConfig ? null, + inputs ? null, ... }: let sops = myUtils.sopsAvailability config osConfig; + standalone = osConfig == null; in -{ +lib.optionalAttrs standalone { + sops.secrets = myUtils.mkSopsSecrets "${toString inputs.nix-secrets}/secrets" "anki" [ + "sync-user" + "sync-key" + ] { }; +} +// { warnings = lib.optional ( !sops.available && config.programs.anki.enable ) "anki is enabled but sops secrets are not available. anki sync will not be configured."; @@ -24,8 +32,8 @@ in review-heatmap ]; profiles."User 1".sync = lib.mkIf sops.available { - usernameFile = "${sops.secrets."anki-sync-user".path}"; - keyFile = "${sops.secrets."anki-sync-key".path}"; + usernameFile = "${sops.secrets."anki/sync-user".path}"; + keyFile = "${sops.secrets."anki/sync-key".path}"; }; }; } diff --git a/home/modules/secrets/default.nix b/home/modules/secrets/default.nix index d4eb45c4..3cd0ca67 100644 --- a/home/modules/secrets/default.nix +++ b/home/modules/secrets/default.nix @@ -6,7 +6,8 @@ imports = [ ./vault.nix ]; home.packages = with pkgs; [ - sops age + age-plugin-yubikey # TODO: only needed when using Yubikey + sops ]; } diff --git a/home/modules/taskwarrior/default.nix b/home/modules/taskwarrior/default.nix index 0ec05d6a..de10a1d9 100644 --- a/home/modules/taskwarrior/default.nix +++ b/home/modules/taskwarrior/default.nix @@ -5,13 +5,33 @@ dotsPath, myUtils, osConfig ? null, + inputs ? null, ... }: let sops = myUtils.sopsAvailability config osConfig; + standalone = osConfig == null; in -{ +lib.optionalAttrs standalone { + sops = { + secrets = myUtils.mkSopsSecrets "${toString inputs.nix-secrets}/secrets" "taskwarrior" [ + "sync-server-url" + "sync-server-client-id" + "sync-encryption-secret" + ] { }; + + templates."taskrc.d/sync" = { + content = '' + sync.server.url=${config.sops.placeholder."taskwarrior/sync-server-url"} + sync.server.client_id=${config.sops.placeholder."taskwarrior/sync-server-client-id"} + sync.encryption_secret=${config.sops.placeholder."taskwarrior/sync-encryption-secret"} + ''; + }; + }; +} +// { + warnings = lib.optional (!sops.available && config.programs.taskwarrior.enable) "taskwarrior is enabled, but sops templates are not available. taskwarrior sync will not be configured."; diff --git a/hosts/andromache/default.nix b/hosts/andromache/default.nix index 1a915ab4..ad938f89 100644 --- a/hosts/andromache/default.nix +++ b/hosts/andromache/default.nix @@ -23,6 +23,8 @@ in inherit lib config; device = "/dev/nvme1n1"; }) + ../../modules/ai-tools + ../../modules/anki ../../modules/audio ../../modules/backups ../../modules/bluetooth @@ -31,17 +33,19 @@ in ../../modules/firewall ../../modules/fonts ../../modules/gaming + ../../modules/git ../../modules/hcloud ../../modules/keyboard ../../modules/localization ../../modules/networking ../../modules/nvidia - (import ../../modules/secrets { inherit lib inputs config; }) + ../../modules/secrets ../../modules/ssh ../../modules/storage ../../modules/stylix ../../modules/syncthing ../../modules/tailscale + ../../modules/taskwarrior ../../modules/users ../../modules/wol ../../modules/yubikey diff --git a/hosts/astyanax/default.nix b/hosts/astyanax/default.nix index 85202aad..5eabf078 100644 --- a/hosts/astyanax/default.nix +++ b/hosts/astyanax/default.nix @@ -16,30 +16,34 @@ in inputs.nixos-hardware.nixosModules.common-pc inputs.nixos-hardware.nixosModules.common-pc-ssd # inputs.nixos-hardware.nixosModules.lenovo-thinkpad-e14-intel-gen7 (not available yet?) + inputs.sops-nix.nixosModules.sops ../../modules/common ../../modules/boot/bootloader.nix (import ../../modules/disko/zfs-encrypted-root.nix { inherit lib config; device = "/dev/nvme0n1"; }) - ../../modules/desktops/niri + ../../modules/ai-tools + ../../modules/anki ../../modules/audio ../../modules/backups ../../modules/bluetooth - ../../modules/keyboard - ../../modules/networking - ../../modules/users - ../../modules/localization + ../../modules/desktops/niri + ../../modules/docker + ../../modules/firewall ../../modules/fonts + ../../modules/git + ../../modules/keyboard + ../../modules/localization + ../../modules/networking + ../../modules/nfc + ../../modules/secrets ../../modules/ssh ../../modules/storage ../../modules/stylix - (import ../../modules/secrets { inherit lib inputs config; }) - ../../modules/docker - ../../modules/nfc - ../../modules/firewall ../../modules/tailscale ../../modules/taskwarrior + ../../modules/users ../../modules/yubikey ]; diff --git a/hosts/vm/default.nix b/hosts/vm/default.nix index 224b278f..f6f2d1b0 100644 --- a/hosts/vm/default.nix +++ b/hosts/vm/default.nix @@ -1,5 +1,4 @@ { - lib, inputs, config, pkgs, @@ -12,20 +11,22 @@ ./host.nix ./disk.nix ../../modules/common - ../../modules/boot/bootloader.nix - ../../modules/keyboard - ../../modules/networking - ../../modules/users + ../../modules/anki ../../modules/audio - ../../modules/localization - ../../modules/x + ../../modules/boot/bootloader.nix ../../modules/fonts + ../../modules/git + ../../modules/keyboard + ../../modules/localization + ../../modules/networking + ../../modules/ai-tools ../../modules/ssh ../../modules/storage ../../modules/stylix - (import ../../modules/secrets { - inherit lib inputs config; - }) + ../../modules/secrets + ../../modules/taskwarrior + ../../modules/users + ../../modules/x ]; home-manager.users.${config.host.username} = import ../../home/hosts/vm { diff --git a/modules/ai-tools/default.nix b/modules/ai-tools/default.nix new file mode 100644 index 00000000..bf3121e5 --- /dev/null +++ b/modules/ai-tools/default.nix @@ -0,0 +1,24 @@ +{ config, myUtils, ... }: + +let + inherit (config.secrets) sopsDir username; + owner = config.users.users.${username}.name; +in +{ + config.sops = { + secrets = myUtils.mkSopsSecrets sopsDir "opencode" [ "api-key" ] { inherit owner; }; + + templates."opencode/auth.json" = { + inherit owner; + path = "/home/${username}/.local/share/opencode/auth.json"; + content = '' + { + "zai-coding-plan": { + "type": "api", + "key": "${config.sops.placeholder."opencode/api-key"}" + } + } + ''; + }; + }; +} diff --git a/modules/anki/default.nix b/modules/anki/default.nix new file mode 100644 index 00000000..2b516352 --- /dev/null +++ b/modules/anki/default.nix @@ -0,0 +1,11 @@ +{ config, myUtils, ... }: + +let + inherit (config.secrets) sopsDir username; + owner = config.users.users.${username}.name; +in +{ + config.sops = { + secrets = myUtils.mkSopsSecrets sopsDir "anki" [ "sync-user" "sync-key" ] { inherit owner; }; + }; +} diff --git a/modules/backups/default.nix b/modules/backups/default.nix index 8e934baf..b1ffbdba 100644 --- a/modules/backups/default.nix +++ b/modules/backups/default.nix @@ -1,6 +1,7 @@ { lib, config, + myUtils, ... }: @@ -13,12 +14,12 @@ in restic-backup = { repository = lib.mkOption { type = lib.types.str; - default = "b2:${config.sops.placeholder.b2-bucket-name}:${config.networking.hostName}"; + default = "b2:${config.sops.placeholder."backblaze-b2/bucket-name"}:${config.networking.hostName}"; }; passwordFile = lib.mkOption { type = lib.types.str; - default = config.sops.secrets.restic-password.path; + default = config.sops.secrets."restic/password".path; }; paths = lib.mkOption { @@ -30,28 +31,18 @@ in config = { sops = { - secrets = { - restic-password = { - sopsFile = "${sopsDir}/restic-password"; - }; - b2-bucket-name = { - sopsFile = "${sopsDir}/b2-bucket-name"; - }; - b2-account-id = { - sopsFile = "${sopsDir}/b2-account-id"; - }; - b2-account-key = { - sopsFile = "${sopsDir}/b2-account-key"; - }; - }; + secrets = lib.mkMerge [ + (myUtils.mkSopsSecrets sopsDir "restic" [ "password" ] { }) + (myUtils.mkSopsSecrets sopsDir "backblaze-b2" [ "bucket-name" "account-id" "account-key" ] { }) + ]; templates = { "restic/repo-${config.networking.hostName}" = { - content = "b2:${config.sops.placeholder.b2-bucket-name}:${config.networking.hostName}"; + content = "b2:${config.sops.placeholder."backblaze-b2/bucket-name"}:${config.networking.hostName}"; }; "restic/b2-env-${config.networking.hostName}" = { content = '' - B2_ACCOUNT_ID=${config.sops.placeholder.b2-account-id} - B2_ACCOUNT_KEY=${config.sops.placeholder.b2-account-key} + B2_ACCOUNT_ID=${config.sops.placeholder."backblaze-b2/account-id"} + B2_ACCOUNT_KEY=${config.sops.placeholder."backblaze-b2/account-key"} ''; }; }; diff --git a/modules/git/default.nix b/modules/git/default.nix new file mode 100644 index 00000000..1557b375 --- /dev/null +++ b/modules/git/default.nix @@ -0,0 +1,29 @@ +{ + config, + ... +}: + +let + inherit (config.secrets) username; + owner = config.users.users.${username}.name; +in +{ + config.sops.templates = { + ".gitconfig.email" = { + inherit owner; + path = "/home/${username}/.gitconfig.email"; + content = '' + [user] + email = ${config.sops.placeholder."email/personal"} + ''; + }; + ".gitconfig.work.email" = { + inherit owner; + path = "/home/${username}/.gitconfig.work.email"; + content = '' + [user] + email = ${config.sops.placeholder."email/work"} + ''; + }; + }; +} diff --git a/modules/hcloud/default.nix b/modules/hcloud/default.nix index 7a7df657..a9591f2f 100644 --- a/modules/hcloud/default.nix +++ b/modules/hcloud/default.nix @@ -1,6 +1,7 @@ { lib, config, + myUtils, ... }: @@ -18,8 +19,7 @@ in }; config = lib.mkIf cfg.enable { - sops.secrets.hcloud-token = { - sopsFile = "${sopsDir}/hcloud-token"; + sops.secrets = myUtils.mkSopsSecrets sopsDir "hcloud" [ "api-token" ] { owner = config.users.users.${cfg.username}.name; }; @@ -31,7 +31,7 @@ in [[contexts]] name = "server" - token = "${config.sops.placeholder.hcloud-token}" + token = "${config.sops.placeholder."hcloud/api-token"}" ''; }; }; diff --git a/modules/secrets/default.nix b/modules/secrets/default.nix index 1ef1897c..052a1de1 100644 --- a/modules/secrets/default.nix +++ b/modules/secrets/default.nix @@ -1,7 +1,9 @@ { lib, inputs, + pkgs, config, + myUtils, ... }: @@ -9,13 +11,7 @@ let cfg = config.secrets; inherit (cfg) sopsDir; owner = config.users.users.${cfg.username}.name; - - mkSecret = name: { - ${name} = { - sopsFile = "${sopsDir}/${name}"; - inherit owner; - }; - }; + mkSopsSecrets = myUtils.mkSopsSecrets sopsDir; in { imports = [ inputs.sops-nix.nixosModules.sops ]; @@ -38,69 +34,42 @@ in default = "${config.host.name}-nix-signing-key"; }; }; + + yubikey = { + enable = lib.mkEnableOption "set up Yubikey"; + }; }; }; config = { sops = { + # for yubikey, generate as follows: + # ``` + # age-plugin-yubikey --identity > + # ``` age.keyFile = "/home/${cfg.username}/.config/sops/age/keys.txt"; secrets = lib.mkMerge [ - (mkSecret "taskwarrior-sync-server-url") - (mkSecret "taskwarrior-sync-server-client-id") - (mkSecret "taskwarrior-sync-encryption-secret") - (mkSecret "anki-sync-user") - (mkSecret "anki-sync-key") - (mkSecret "email-personal") - (mkSecret "email-work") - (mkSecret "opencode-api-key") - (lib.mkIf cfg.nixSigningKey.enable (mkSecret cfg.nixSigningKey.name)) + (mkSopsSecrets "email" [ "personal" "work" ] { inherit owner; }) + (lib.mkIf cfg.nixSigningKey.enable { + ${cfg.nixSigningKey.name} = { + sopsFile = "${sopsDir}/${cfg.nixSigningKey.name}.yaml"; + inherit owner; + }; + }) ]; - - templates = { - "taskrc.d/sync" = { - inherit owner; - content = '' - sync.server.url=${config.sops.placeholder.taskwarrior-sync-server-url} - sync.server.client_id=${config.sops.placeholder.taskwarrior-sync-server-client-id} - sync.encryption_secret=${config.sops.placeholder.taskwarrior-sync-encryption-secret} - ''; - }; - - ".gitconfig.email" = { - inherit owner; - path = "/home/${cfg.username}/.gitconfig.email"; - content = '' - [user] - email = ${config.sops.placeholder.email-personal} - ''; - }; - ".gitconfig.work.email" = { - inherit owner; - path = "/home/${cfg.username}/.gitconfig.work.email"; - content = '' - [user] - email = ${config.sops.placeholder.email-work} - ''; - }; - - "opencode/auth.json" = { - inherit owner; - path = "/home/${cfg.username}/.local/share/opencode/auth.json"; - content = '' - { - "zai-coding-plan": { - "type": "api", - "key": "${config.sops.placeholder.opencode-api-key}" - } - } - ''; - }; - }; }; nix.settings.secret-key-files = lib.mkIf cfg.nixSigningKey.enable [ config.sops.secrets.${cfg.nixSigningKey.name}.path ]; + + services = { + pcscd.enable = true; # needed for age-plugin-yubikey? + udev.packages = lib.mkIf cfg.yubikey.enable [ + pkgs.yubikey-personalization + pkgs.libfido2 + ]; + }; }; } diff --git a/modules/taskwarrior/default.nix b/modules/taskwarrior/default.nix new file mode 100644 index 00000000..7be02621 --- /dev/null +++ b/modules/taskwarrior/default.nix @@ -0,0 +1,24 @@ +{ config, myUtils, ... }: + +let + inherit (config.secrets) sopsDir username; + owner = config.users.users.${username}.name; +in +{ + config.sops = { + secrets = myUtils.mkSopsSecrets sopsDir "taskwarrior" [ + "sync-server-url" + "sync-server-client-id" + "sync-encryption-secret" + ] { inherit owner; }; + + templates."taskrc.d/sync" = { + inherit owner; + content = '' + sync.server.url=${config.sops.placeholder."taskwarrior/sync-server-url"} + sync.server.client_id=${config.sops.placeholder."taskwarrior/sync-server-client-id"} + sync.encryption_secret=${config.sops.placeholder."taskwarrior/sync-encryption-secret"} + ''; + }; + }; +} diff --git a/utils/default.nix b/utils/default.nix index a8a091d5..9209d915 100644 --- a/utils/default.nix +++ b/utils/default.nix @@ -11,15 +11,31 @@ else throw "meta.nix required in ${hostDir}"; + mkSopsSecrets = + sopsDir: group: names: extraOpts: + let + file = "${group}.yaml"; + in + lib.foldl' lib.mergeAttrs { } ( + map (name: { + "${group}/${name}" = { + sopsFile = "${sopsDir}/${file}"; + key = name; + } + // extraOpts; + }) names + ); + sopsAvailability = config: osConfig: let - hmSopsAvailable = config ? sops && config.sops ? secrets; osSopsAvailable = osConfig != null && osConfig ? sops && osConfig.sops ? secrets; + hmSopsAvailable = config ? sops && config.sops ? secrets; + preferOs = osSopsAvailable; in { - available = hmSopsAvailable || osSopsAvailable; - secrets = if hmSopsAvailable then config.sops.secrets else osConfig.sops.secrets; - templates = if hmSopsAvailable then config.sops.templates else osConfig.sops.templates; + available = osSopsAvailable || hmSopsAvailable; + secrets = if preferOs then osConfig.sops.secrets else config.sops.secrets; + templates = if preferOs then osConfig.sops.templates else config.sops.templates; }; }