Use agenix to encrypt secrets

flake.lock

@@ -1,5 +1,48 @@
 {
   "nodes": {
+    "agenix": {
+      "inputs": {
+        "darwin": "darwin",
+        "home-manager": "home-manager",
+        "nixpkgs": "nixpkgs",
+        "systems": "systems"
+      },
+      "locked": {
+        "lastModified": 1723293904,
+        "narHash": "sha256-b+uqzj+Wa6xgMS9aNbX4I+sXeb5biPDi39VgvSFqFvU=",
+        "owner": "ryantm",
+        "repo": "agenix",
+        "rev": "f6291c5935fdc4e0bef208cfc0dcab7e3f7a1c41",
+        "type": "github"
+      },
+      "original": {
+        "owner": "ryantm",
+        "repo": "agenix",
+        "type": "github"
+      }
+    },
+    "darwin": {
+      "inputs": {
+        "nixpkgs": [
+          "agenix",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1700795494,
+        "narHash": "sha256-gzGLZSiOhf155FW7262kdHo2YDeugp3VuIFb4/GGng0=",
+        "owner": "lnl7",
+        "repo": "nix-darwin",
+        "rev": "4b9b83d5a92e8c1fbfd8eb27eda375908c11ec4d",
+        "type": "github"
+      },
+      "original": {
+        "owner": "lnl7",
+        "ref": "master",
+        "repo": "nix-darwin",
+        "type": "github"
+      }
+    },
     "disko": {
       "inputs": {
         "nixpkgs": [
@@ -21,6 +64,27 @@
       }
     },
     "home-manager": {
+      "inputs": {
+        "nixpkgs": [
+          "agenix",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1703113217,
+        "narHash": "sha256-7ulcXOk63TIT2lVDSExj7XzFx09LpdSAPtvgtM7yQPE=",
+        "owner": "nix-community",
+        "repo": "home-manager",
+        "rev": "3bfaacf46133c037bb356193bd2f1765d9dc82c1",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "home-manager",
+        "type": "github"
+      }
+    },
+    "home-manager_2": {
       "inputs": {
         "nixpkgs": [
           "nixpkgs"
@@ -59,15 +123,15 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1733015953,
+        "lastModified": 1703013332,
-        "narHash": "sha256-t4BBVpwG9B4hLgc6GUBuj3cjU7lP/PJfpTHuSqE+crk=",
+        "narHash": "sha256-+tFNwMvlXLbJZXiMHqYq77z/RfmpfpiI3yjL6o/Zo9M=",
-        "owner": "nixos",
+        "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "ac35b104800bff9028425fec3b6e8a41de2bbfff",
+        "rev": "54aac082a4d9bb5bbc5c4e899603abfb76a3f6d6",
         "type": "github"
       },
       "original": {
-        "owner": "nixos",
+        "owner": "NixOS",
         "ref": "nixos-unstable",
         "repo": "nixpkgs",
         "type": "github"
@@ -89,14 +153,46 @@
         "type": "github"
       }
     },
+    "nixpkgs_2": {
+      "locked": {
+        "lastModified": 1733015953,
+        "narHash": "sha256-t4BBVpwG9B4hLgc6GUBuj3cjU7lP/PJfpTHuSqE+crk=",
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "ac35b104800bff9028425fec3b6e8a41de2bbfff",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nixos",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
     "root": {
       "inputs": {
+        "agenix": "agenix",
         "disko": "disko",
-        "home-manager": "home-manager",
+        "home-manager": "home-manager_2",
         "nixos-hardware": "nixos-hardware",
-        "nixpkgs": "nixpkgs",
+        "nixpkgs": "nixpkgs_2",
         "nixpkgs-2405": "nixpkgs-2405"
       }
+    },
+    "systems": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
     }
   },
   "root": "root",

flake.nix

@@ -5,6 +5,8 @@
 
     nixos-hardware.url = "github:NixOS/nixos-hardware/master";
 
+    agenix.url = "github:ryantm/agenix";
+
     disko = {
       inputs.nixpkgs.follows = "nixpkgs";
       url = "github:nix-community/disko";

nix/hosts/lemp11/default.nix

@@ -1,3 +1,5 @@
+{ inputs, ... }:
+
 {
   features = {
     cli = {
@@ -17,5 +19,9 @@
     };
   };
 
-  imports = [ ./configuration.nix ];
+  imports = [
+    inputs.agenix.nixosModules.default
+    ./configuration.nix
+    ./secrets.nix
+  ];
 }

nix/hosts/lemp11/secrets.nix

@@ -0,0 +1,5 @@
+{
+  age.secrets = {
+    tubearchivist.file = ../../secrets/tubearchivist.age;
+  };
+}

nix/modules/nixos/features/homelab/tubearchivist-container.nix

@@ -29,13 +29,16 @@ in
       image = "bbilly1/tubearchivist-es";
 
       environment = {
-        "ELASTIC_PASSWORD" = "verysecret";
         "ES_JAVA_OPTS" = "-Xms1g -Xmx1g";
         "discovery.type" = "single-node";
         "path.repo" = "/usr/share/elasticsearch/data/snapshot";
         "xpack.security.enabled" = "true";
       };
 
+      environmentFiles = [
+        config.age.secrets.tubearchivist.path
+      ];
+
       volumes = [
         "tubearchivist_es:/usr/share/elasticsearch/data:rw"
       ];
@@ -125,17 +128,18 @@ in
       image = "bbilly1/tubearchivist";
 
       environment = {
-        "ELASTIC_PASSWORD" = "verysecret";
         "ES_URL" = "http://archivist-es:9200";
         "HOST_GID" = "1000";
         "HOST_UID" = "1000";
         "REDIS_HOST" = "archivist-redis";
         "TA_HOST" = "tubearchivist.local";
-        "TA_PASSWORD" = "verysecret";
+        "TZ" = "Europe/London";
-        "TA_USERNAME" = "tubearchivist";
-        "TZ" = "America/New_York";
       };
 
+      environmentFiles = [
+        config.age.secrets.tubearchivist.path
+      ];
+
       volumes = [
         "tubearchivist_cache:/cache:rw"
         "tubearchivist_media:/youtube:rw"

nix/secrets/secrets.nix

@@ -0,0 +1,6 @@
+let
+  lemp11 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEZ+ljJKd6uqdAk+fqxwtObI4Stab2N9Bjo4QFHY/v8n";
+in
+{
+  "tubearchivist.age".publicKeys = [ lemp11 ];
+}

nix/secrets/tubearchivist.age

@@ -0,0 +1,5 @@
+age-encryption.org/v1
+-> ssh-ed25519 sHhprA Cbb0hZFbjSm4+wohOIa0rrppM4aiCD2OBxua/UTzjgU
+6E7zItGopz9VqRflgpJAC910cDZ9i85Mz7+PwvIsxPk
+--- oBcUij9hrWy2ol4cLUFlWkFaS/w4byNu42nk3sI0ras
+”XvAœ-rÐ|‚÷ýýk~m›!Ó– <aAhŸÂƸ€+äËNšõÉa²qÝLEá Þ<>×XŒ¢²Èžº<C5BE>Ù€<02>(äâ$cô̦¾4²ðϪÿYüÉ8c<38>2û_0U“õwí*CµozÊb