Skip to content

Commit d03c6bb

Browse files
kmeinkmein
committed
feat: convert to flake
feat(zaatar): convert to flake feat(tahina, tabula): convert to flake feat(makanek): convert to flake feat(manakish, zaatar): convert to flake feat(ci): build flake systems fix: ci build feat: secrets via submodule foo foo foo
1 parent ba27e98 commit d03c6bb

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

92 files changed

+1656
-934
lines changed

‎.github/workflows/niveum.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,4 +11,4 @@ jobs:
1111
steps:
1212
- uses: actions/checkout@v2
1313
- uses: cachix/install-nix-action@v16
14-
- run: nix run .#build-${{matrix.system}}
14+
- run: nix build --dry-run .#nixosConfigurations.${{matrix.system}}.config.system.build.toplevel

‎.gitmodules

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
[submodule "secrets"]
2+
path = secrets
3+
url = ssh://[email protected]:22022/kfm/niveum-secrets.git

‎ci.nix

Lines changed: 2 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
system,
44
name,
55
}: let
6-
nixpkgs = inputs.nixos-stable;
6+
nixpkgs = inputs.nixpkgs;
77
pkgs = nixpkgs.legacyPackages.${system};
88
ensureFiles = paths:
99
pkgs.runCommand "directory" {} ''
@@ -23,13 +23,7 @@
2323
"nixos-config=${toString ./.}/systems/${name}/configuration.nix"
2424
"system-secrets=${systemSecrets}"
2525
"secrets=${sharedSecrets}"
26-
"nixpkgs=${
27-
toString (
28-
if name == "kabsa" || name == "manakish"
29-
then inputs.nixos-unstable
30-
else inputs.nixos-stable
31-
)
32-
}"
26+
"nixpkgs=${toString (inputs.nixpkgs)}"
3327
]
3428
++ nixpkgs.lib.mapAttrsToList (name: value: "${name}=${value}") inputs);
3529
# cd ~/.password-store/shared && find * -type f | sed 's/.gpg$//'

‎configs/aerc.nix

Lines changed: 39 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -16,8 +16,38 @@
1616
smtp.port = 25;
1717
smtp.tls.useStartTls = true;
1818
};
19-
passwordCommandFrom = path: toString (pkgs.writers.writeDash "email-credentials" "echo ${lib.escapeShellArg (lib.strings.fileContents path)}");
2019
in {
20+
age.secrets = {
21+
email-password-cock = {
22+
file = ../secrets/email-password-cock.age;
23+
owner = config.users.users.me.name;
24+
};
25+
email-password-fysi = {
26+
file = ../secrets/email-password-fysi.age;
27+
owner = config.users.users.me.name;
28+
};
29+
email-password-posteo = {
30+
file = ../secrets/email-password-posteo.age;
31+
owner = config.users.users.me.name;
32+
};
33+
email-password-meinhark = {
34+
file = ../secrets/email-password-meinhark.age;
35+
owner = config.users.users.me.name;
36+
};
37+
email-password-meinhaki = {
38+
file = ../secrets/email-password-meinhaki.age;
39+
owner = config.users.users.me.name;
40+
};
41+
email-password-dslalewa = {
42+
file = ../secrets/email-password-dslalewa.age;
43+
owner = config.users.users.me.name;
44+
};
45+
email-password-fsklassp = {
46+
file = ../secrets/email-password-fsklassp.age;
47+
owner = config.users.users.me.name;
48+
};
49+
};
50+
2151
home-manager.users.me = {
2252
accounts.email.accounts = rec {
2353
hu-student =
@@ -27,7 +57,7 @@ in {
2757
userName = "meinhark";
2858
address = "[email protected]";
2959
aliases = ["${userName}@hu-berlin.de"];
30-
passwordCommand = passwordCommandFrom <secrets/eduroam/password>;
60+
passwordCommand = "cat ${config.age.secrets.email-password-meinhark.path}";
3161
});
3262
hu-student-cs =
3363
lib.recursiveUpdate defaults
@@ -38,7 +68,7 @@ in {
3868
aliases = ["${userName}@informatik.hu-berlin.de"];
3969
imap.host = "mailbox.informatik.hu-berlin.de";
4070
smtp.host = "mailhost.informatik.hu-berlin.de";
41-
passwordCommand = passwordCommandFrom <secrets/eduroam/password>;
71+
passwordCommand = "cat ${config.age.secrets.email-password-meinhark.path}";
4272
});
4373
hu-employee =
4474
lib.recursiveUpdate defaults
@@ -47,7 +77,7 @@ in {
4777
userName = "meinhaki";
4878
address = "[email protected]";
4979
aliases = ["${userName}@hu-berlin.de"];
50-
passwordCommand = passwordCommandFrom <secrets/mail/meinhaki>;
80+
passwordCommand = "cat ${config.age.secrets.email-password-meinhaki.path}";
5181
aerc.extraAccounts.signature-file = toString (pkgs.writeText "signature" signature.text);
5282
signature = {
5383
showSignature = "append";
@@ -69,7 +99,7 @@ in {
6999
userName = "dslalewa";
70100
address = "[email protected]";
71101
aliases = ["${userName}@hu-berlin.de"];
72-
passwordCommand = passwordCommandFrom <secrets/mail/dslalewa>;
102+
passwordCommand = "cat ${config.age.secrets.email-password-dslalewa.path}";
73103
inherit (hu-employee) signature;
74104
aerc.extraAccounts.signature-file = toString (pkgs.writeText "signature" signature.text);
75105
});
@@ -78,7 +108,7 @@ in {
78108
(lib.recursiveUpdate hu-defaults
79109
rec {
80110
userName = "fsklassp";
81-
passwordCommand = passwordCommandFrom <secrets/mail/fsklassp>;
111+
passwordCommand = "cat ${config.age.secrets.email-password-fsklassp.path}";
82112
address = "${userName}@hu-berlin.de";
83113
realName = "FSI Klassische Philologie";
84114
aerc.extraAccounts.signature-file = toString (pkgs.writeText "signature" signature.text);
@@ -100,15 +130,15 @@ in {
100130
rec {
101131
address = "[email protected]";
102132
userName = address;
103-
passwordCommand = passwordCommandFrom <secrets/mail/fastmail>;
133+
passwordCommand = "cat ${config.age.secrets.email-password-fysi.path}";
104134
flavor = "fastmail.com";
105135
};
106136
cock =
107137
lib.recursiveUpdate defaults
108138
rec {
109139
address = "[email protected]";
110140
userName = address;
111-
passwordCommand = passwordCommandFrom <secrets/mail/cock>;
141+
passwordCommand = "cat ${config.age.secrets.email-password-cock.path}";
112142
realName = "";
113143
imap.host = "mail.cock.li";
114144
smtp.host = imap.host;
@@ -122,7 +152,7 @@ in {
122152
imap.host = "posteo.de";
123153
smtp.host = imap.host;
124154
primary = true;
125-
passwordCommand = passwordCommandFrom <secrets/mail/posteo>;
155+
passwordCommand = "cat ${config.age.secrets.email-password-posteo.path}";
126156
# himalaya = { enable = true; backend = "imap"; sender = "smtp"; };
127157
};
128158
};

‎configs/alacritty.nix

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -47,7 +47,7 @@
4747
alacritty-pkg = pkgs.symlinkJoin {
4848
name = "alacritty";
4949
paths = [
50-
(pkgs.writeDashBin "alacritty" ''
50+
(pkgs.writers.writeDashBin "alacritty" ''
5151
${pkgs.alacritty}/bin/alacritty --config-file /var/theme/config/alacritty.yml msg create-window "$@" ||
5252
${pkgs.alacritty}/bin/alacritty --config-file /var/theme/config/alacritty.yml "$@"
5353
'')
@@ -62,7 +62,7 @@ in {
6262
];
6363

6464
environment.etc = {
65-
"themes/dark/alacritty.yml".source = alacritty-cfg (import <niveum/lib/colours/papercolor-dark.nix>);
66-
"themes/light/alacritty.yml".source = alacritty-cfg (import <niveum/lib/colours/papercolor-light.nix>);
65+
"themes/dark/alacritty.yml".source = alacritty-cfg (import ../lib/colours/papercolor-dark.nix);
66+
"themes/light/alacritty.yml".source = alacritty-cfg (import ../lib/colours/papercolor-light.nix);
6767
};
6868
}

‎configs/backup.nix

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
config,
44
...
55
}: let
6-
inherit (import <niveum/lib>) restic;
6+
inherit (import ../lib) restic;
77
in {
88
services.restic.backups.niveum = {
99
initialize = true;
@@ -12,7 +12,7 @@ in {
1212
OnCalendar = "8:00";
1313
RandomizedDelaySec = "1h";
1414
};
15-
passwordFile = toString <secrets/restic/password>;
15+
passwordFile = config.age.secrets.restic.path;
1616
extraBackupArgs = [
1717
"--exclude=/home/kfm/projects/nixpkgs/.git"
1818
"--exclude=node_modules"
@@ -38,15 +38,15 @@ in {
3838

3939
environment.systemPackages = [
4040
(pkgs.writers.writeDashBin "restic-niveum" ''
41-
${pkgs.restic}/bin/restic -r ${restic.repository} -p ${<secrets/restic/password>} "$@"
41+
${pkgs.restic}/bin/restic -r ${restic.repository} -p ${config.age.secrets.restic.path} "$@"
4242
'')
4343
(pkgs.writers.writeDashBin "restic-mount" ''
4444
mountdir=$(mktemp -d)
4545
trap clean EXIT
4646
clean() {
4747
rm -r "$mountdir"
4848
}
49-
${pkgs.restic}/bin/restic -r ${restic.repository} -p ${<secrets/restic/password>} mount "$mountdir"
49+
${pkgs.restic}/bin/restic -r ${restic.repository} -p ${config.age.secrets.restic.path} mount "$mountdir"
5050
'')
5151
];
5252
}

‎configs/cloud.nix

Lines changed: 10 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -4,16 +4,8 @@
44
pkgs,
55
...
66
}: let
7-
inherit (import <niveum/lib>) tmpfilesConfig;
7+
inherit (import ../lib) tmpfilesConfig;
88
in {
9-
imports = [
10-
<niveum/modules/dropbox.nix>
11-
];
12-
13-
niveum = {
14-
dropbox.enable = false;
15-
};
16-
179
systemd.tmpfiles.rules = map tmpfilesConfig [
1810
{
1911
type = "L+";
@@ -55,13 +47,13 @@ in {
5547
script = let
5648
kieran = {
5749
user = "kieran";
58-
password = lib.fileContents <secrets/nextcloud/password>;
50+
passwordFile = config.age.secrets.nextcloud-password-kieran.path;
5951
endpoint = "https://cloud.xn--kiern-0qa.de";
6052
target = "${config.users.users.me.home}/notes";
6153
};
6254
in ''
6355
mkdir -p ${lib.escapeShellArg kieran.target}
64-
${pkgs.nextcloud-client}/bin/nextcloudcmd --non-interactive --user ${kieran.user} --password ${lib.escapeShellArg kieran.password} --path /Notes ${lib.escapeShellArg kieran.target} ${kieran.endpoint}
56+
${pkgs.nextcloud-client}/bin/nextcloudcmd --non-interactive --user ${kieran.user} --password "$(cat ${kieran.passwordFile})" --path /Notes ${lib.escapeShellArg kieran.target} ${kieran.endpoint}
6557
'';
6658
serviceConfig = {
6759
Type = "oneshot";
@@ -81,9 +73,9 @@ in {
8173
(let
8274
kieran = {
8375
user = "[email protected]";
84-
password = lib.fileContents <secrets/mega/password>;
76+
passwordFile = config.age.secrets.mega-password.path;
8577
};
86-
megatools = command: "${pkgs.megatools}/bin/megatools ${command} --username ${lib.escapeShellArg kieran.user} --password ${lib.escapeShellArg kieran.password}";
78+
megatools = command: ''${pkgs.megatools}/bin/megatools ${command} --username ${lib.escapeShellArg kieran.user} --password "$(cat ${kieran.passwordFile})"'';
8779
in
8880
pkgs.writers.writeDashBin "book-mega" ''
8981
set -efu
@@ -104,6 +96,8 @@ in {
10496
'')
10597
];
10698

99+
age.secrets.mega-password.file = ../secrets/mega-password.age;
100+
107101
fileSystems."/media/moodle" = {
108102
device = "zaatar.r:/moodle";
109103
fsType = "nfs";
@@ -120,9 +114,9 @@ in {
120114
openDefaultPorts = true;
121115
configDir = "/home/kfm/.config/syncthing";
122116
dataDir = "/home/kfm/.config/syncthing";
123-
cert = toString <system-secrets/syncthing/cert.pem>;
124-
key = toString <system-secrets/syncthing/key.pem>;
125-
inherit ((import <niveum/lib>).syncthing) devices;
117+
cert = config.age.secrets.syncthing-cert.path;
118+
key = config.age.secrets.syncthing-key.path;
119+
inherit ((import ../lib).syncthing) devices;
126120
folders = let
127121
cloud-dir = "${config.users.users.me.home}/cloud";
128122
in {

‎configs/default.nix

Lines changed: 12 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -6,13 +6,12 @@
66
...
77
}: let
88
inherit (lib.strings) makeBinPath;
9-
inherit (import <niveum/lib>) localAddresses kieran;
10-
scripts = import <niveum/packages/scripts> {inherit pkgs lib;};
11-
defaultApplications = (import <niveum/lib>).defaultApplications {inherit pkgs;};
9+
inherit (import ../lib) localAddresses kieran;
10+
scripts = import ../packages/scripts {inherit config pkgs lib;};
11+
defaultApplications = (import ../lib).defaultApplications {inherit pkgs;};
1212
in {
1313
imports = [
14-
<home-manager/nixos>
15-
<niveum/modules/system-dependent.nix>
14+
../modules/system-dependent.nix
1615
{
1716
boot.supportedFilesystems = ["ntfs"];
1817
}
@@ -28,10 +27,10 @@ in {
2827
allowUnfree = true;
2928
packageOverrides = pkgs: {
3029
dmenu = pkgs.writers.writeDashBin "dmenu" ''exec ${pkgs.rofi}/bin/rofi -dmenu "$@"'';
31-
gfs-fonts = pkgs.callPackage <niveum/packages/gfs-fonts.nix> {};
32-
tocharian-font = pkgs.callPackage <niveum/packages/tocharian-font.nix> {};
33-
iolanguage = pkgs.callPackage <niveum/packages/iolanguage.nix> {};
34-
ix = pkgs.callPackage <niveum/packages/ix.nix> {};
30+
gfs-fonts = pkgs.callPackage ../packages/gfs-fonts.nix {};
31+
tocharian-font = pkgs.callPackage ../packages/tocharian-font.nix {};
32+
iolanguage = pkgs.callPackage ../packages/iolanguage.nix {};
33+
ix = pkgs.callPackage ../packages/ix.nix {};
3534
};
3635
permittedInsecurePackages = [
3736
"qtwebkit-5.212.0-alpha4"
@@ -43,6 +42,9 @@ in {
4342
boot.cleanTmpDir = true;
4443
boot.loader.timeout = 1;
4544
}
45+
{
46+
age.secrets.di-fm-key.file = ../secrets/di-fm-key.age;
47+
}
4648
{
4749
home-manager.users.me = {
4850
programs.zathura = {
@@ -226,7 +228,6 @@ in {
226228
./clipboard.nix
227229
./cloud.nix
228230
./direnv.nix
229-
./distrobump.nix
230231
./docker.nix
231232
./dunst.nix
232233
./flix.nix
@@ -244,7 +245,7 @@ in {
244245
./neovim.nix
245246
./nix.nix
246247
./newsboat.nix
247-
./flameshot-once.nix
248+
./flameshot.nix
248249
./packages.nix
249250
./picom.nix
250251
./stardict.nix
@@ -262,7 +263,6 @@ in {
262263
./sshd.nix
263264
./sound.nix
264265
./sudo.nix
265-
./nsxiv.nix
266266
./themes.nix
267267
./tmux.nix
268268
# ./traadfri.nix

‎configs/dunst.nix

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
pkgs,
44
...
55
}: let
6-
inherit (import <niveum/lib>) defaultApplications colours theme;
6+
inherit (import ../lib) defaultApplications colours theme;
77
in {
88
home-manager.users.me.services.dunst = {
99
enable = true;

‎configs/flameshot-once.nix

Lines changed: 0 additions & 52 deletions
This file was deleted.

0 commit comments

Comments
 (0)