opdavies/dotfiles
1
0
Fork 0
Code Issues Pull requests Actions Packages Projects Releases Wiki Activity

Use agenix to encrypt secrets

Browse source
This commit is contained in:
Oliver Davies 2024-12-09 22:35:34 +00:00
parent 04c32edb04
commit c01820a33b
7 changed files with 137 additions and 13 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

110
flake.lock
View file

@ -1,5 +1,48 @@
{
"nodes": {
"agenix": {
"inputs": {
"darwin": "darwin",
"home-manager": "home-manager",
"nixpkgs": "nixpkgs",
"systems": "systems"
},
"locked": {
"lastModified": 1723293904,
"narHash": "sha256-b+uqzj+Wa6xgMS9aNbX4I+sXeb5biPDi39VgvSFqFvU=",
"owner": "ryantm",
"repo": "agenix",
"rev": "f6291c5935fdc4e0bef208cfc0dcab7e3f7a1c41",
"type": "github"
},
"original": {
"owner": "ryantm",
"repo": "agenix",
"type": "github"
}
},
"darwin": {
"inputs": {
"nixpkgs": [
"agenix",
"nixpkgs"
]
},
"locked": {
"lastModified": 1700795494,
"narHash": "sha256-gzGLZSiOhf155FW7262kdHo2YDeugp3VuIFb4/GGng0=",
"owner": "lnl7",
"repo": "nix-darwin",
"rev": "4b9b83d5a92e8c1fbfd8eb27eda375908c11ec4d",
"type": "github"
},
"original": {
"owner": "lnl7",
"ref": "master",
"repo": "nix-darwin",
"type": "github"
}
},
"disko": {
"inputs": {
"nixpkgs": [
@ -21,6 +64,27 @@
}
},
"home-manager": {
"inputs": {
"nixpkgs": [
"agenix",
"nixpkgs"
]
},
"locked": {
"lastModified": 1703113217,
"narHash": "sha256-7ulcXOk63TIT2lVDSExj7XzFx09LpdSAPtvgtM7yQPE=",
"owner": "nix-community",
"repo": "home-manager",
"rev": "3bfaacf46133c037bb356193bd2f1765d9dc82c1",
"type": "github"
},
"original": {
"owner": "nix-community",
"repo": "home-manager",
"type": "github"
}
},
"home-manager_2": {
"inputs": {
"nixpkgs": [
"nixpkgs"
@ -59,15 +123,15 @@
},
"nixpkgs": {
"locked": {
"lastModified": 1733015953,
"narHash": "sha256-t4BBVpwG9B4hLgc6GUBuj3cjU7lP/PJfpTHuSqE+crk=",
"owner": "nixos",
"lastModified": 1703013332,
"narHash": "sha256-+tFNwMvlXLbJZXiMHqYq77z/RfmpfpiI3yjL6o/Zo9M=",
"owner": "NixOS",
"repo": "nixpkgs",
"rev": "ac35b104800bff9028425fec3b6e8a41de2bbfff",
"rev": "54aac082a4d9bb5bbc5c4e899603abfb76a3f6d6",
"type": "github"
},
"original": {
"owner": "nixos",
"owner": "NixOS",
"ref": "nixos-unstable",
"repo": "nixpkgs",
"type": "github"
@ -89,14 +153,46 @@
"type": "github"
}
},
"nixpkgs_2": {
"locked": {
"lastModified": 1733015953,
"narHash": "sha256-t4BBVpwG9B4hLgc6GUBuj3cjU7lP/PJfpTHuSqE+crk=",
"owner": "nixos",
"repo": "nixpkgs",
"rev": "ac35b104800bff9028425fec3b6e8a41de2bbfff",
"type": "github"
},
"original": {
"owner": "nixos",
"ref": "nixos-unstable",
"repo": "nixpkgs",
"type": "github"
}
},
"root": {
"inputs": {
"agenix": "agenix",
"disko": "disko",
"home-manager": "home-manager",
"home-manager": "home-manager_2",
"nixos-hardware": "nixos-hardware",
"nixpkgs": "nixpkgs",
"nixpkgs": "nixpkgs_2",
"nixpkgs-2405": "nixpkgs-2405"
}
},
"systems": {
"locked": {
"lastModified": 1681028828,
"narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
"owner": "nix-systems",
"repo": "default",
"rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
"type": "github"
},
"original": {
"owner": "nix-systems",
"repo": "default",
"type": "github"
}
}
},
"root": "root",

2
flake.nix
View file

@ -5,6 +5,8 @@
nixos-hardware.url = "github:NixOS/nixos-hardware/master";
agenix.url = "github:ryantm/agenix";
disko = {
inputs.nixpkgs.follows = "nixpkgs";
url = "github:nix-community/disko";

8
nix/hosts/lemp11/default.nix
View file

@ -1,3 +1,5 @@
{ inputs, ... }:
{
features = {
cli = {
@ -17,5 +19,9 @@
};
};
imports = [ ./configuration.nix ];
imports = [
inputs.agenix.nixosModules.default
./configuration.nix
./secrets.nix
];
}

5
nix/hosts/lemp11/secrets.nix Normal file
View file

@ -0,0 +1,5 @@
{
age.secrets = {
tubearchivist.file = ../../secrets/tubearchivist.age;
};
}

14
nix/modules/nixos/features/homelab/tubearchivist-container.nix
View file

@ -29,13 +29,16 @@ in
image = "bbilly1/tubearchivist-es";
environment = {
"ELASTIC_PASSWORD" = "verysecret";
"ES_JAVA_OPTS" = "-Xms1g -Xmx1g";
"discovery.type" = "single-node";
"path.repo" = "/usr/share/elasticsearch/data/snapshot";
"xpack.security.enabled" = "true";
};
environmentFiles = [
config.age.secrets.tubearchivist.path
];
volumes = [
"tubearchivist_es:/usr/share/elasticsearch/data:rw"
];
@ -125,17 +128,18 @@ in
image = "bbilly1/tubearchivist";
environment = {
"ELASTIC_PASSWORD" = "verysecret";
"ES_URL" = "http://archivist-es:9200";
"HOST_GID" = "1000";
"HOST_UID" = "1000";
"REDIS_HOST" = "archivist-redis";
"TA_HOST" = "tubearchivist.local";
"TA_PASSWORD" = "verysecret";
"TA_USERNAME" = "tubearchivist";
"TZ" = "America/New_York";
"TZ" = "Europe/London";
};
environmentFiles = [
config.age.secrets.tubearchivist.path
];
volumes = [
"tubearchivist_cache:/cache:rw"
"tubearchivist_media:/youtube:rw"

6
nix/secrets/secrets.nix Normal file
View file

@ -0,0 +1,6 @@
let
lemp11 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEZ+ljJKd6uqdAk+fqxwtObI4Stab2N9Bjo4QFHY/v8n";
in
{
"tubearchivist.age".publicKeys = [ lemp11 ];
}

5
nix/secrets/tubearchivist.age Normal file
View file

@ -0,0 +1,5 @@
age-encryption.org/v1
-> ssh-ed25519 sHhprA Cbb0hZFbjSm4+wohOIa0rrppM4aiCD2OBxua/UTzjgU
6E7zItGopz9VqRflgpJAC910cDZ9i85Mz7+PwvIsxPk
--- oBcUij9hrWy2ol4cLUFlWkFaS/w4byNu42nk3sI0ras
”XvAœ-rÐ|‚÷ýýk~m›!Ó– <aAhŸÂƸ€+äËNšõÉa²qÝLEá Þ<>×XŒ¢²Èžº<C5BE>Ù€<02>(äâ$cô̦¾4²ðϪÿYüÉ8c<38>2û_0U “õwí*CµozÊb