From cbc5c997ca1a7ba40ae0f258aeb77c68417478e0 Mon Sep 17 00:00:00 2001
From: Anish Lakhwara <anish+git@lakhwara.com>
Date: Wed, 7 Dec 2022 20:10:15 +1000
Subject: [PATCH] add secrets for freshrss deploy

---
 hosts/helix/hardware-configuration.nix  | 8 ++++----
 hosts/lituus/hardware-configuration.nix | 8 ++++----
 hosts/profiles/freshrss/default.nix     | 2 +-
 secrets/freshrss-dbpass.age             | 9 +++++++++
 secrets/secrets.nix                     | 2 ++
 5 files changed, 20 insertions(+), 9 deletions(-)
 create mode 100644 secrets/freshrss-dbpass.age

diff --git a/hosts/helix/hardware-configuration.nix b/hosts/helix/hardware-configuration.nix
index cb2c516e..c10b3c90 100644
--- a/hosts/helix/hardware-configuration.nix
+++ b/hosts/helix/hardware-configuration.nix
@@ -9,19 +9,19 @@
       (modulesPath + "/profiles/qemu-guest.nix")
     ];
 
-  boot.initrd.availableKernelModules = [ "ata_piix" "floppy" "virtio_pci" "sr_mod" "virtio_blk" ];
+  boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "sr_mod" "virtio_blk" ];
   boot.initrd.kernelModules = [ ];
   boot.kernelModules = [ ];
   boot.extraModulePackages = [ ];
 
   fileSystems."/" =
     {
-      device = "/dev/disk/by-uuid/7c560634-d545-41cc-b375-42ce3037fd73";
-      fsType = "ext4";
+      device = "/dev/disk/by-uuid/3b8b2c4b-835e-4822-8ac8-0effdc8270d6";
+      fsType = "btrfs";
     };
 
   swapDevices = [ ];
 
-  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+  nix.settings.max-jobs = lib.mkDefault 1;
   nixpkgs.hostPlatform = "x86_64-linux";
 }
diff --git a/hosts/lituus/hardware-configuration.nix b/hosts/lituus/hardware-configuration.nix
index fd79d996..cb2c516e 100644
--- a/hosts/lituus/hardware-configuration.nix
+++ b/hosts/lituus/hardware-configuration.nix
@@ -9,19 +9,19 @@
       (modulesPath + "/profiles/qemu-guest.nix")
     ];
 
-  boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "sr_mod" "virtio_blk" ];
+  boot.initrd.availableKernelModules = [ "ata_piix" "floppy" "virtio_pci" "sr_mod" "virtio_blk" ];
   boot.initrd.kernelModules = [ ];
   boot.kernelModules = [ ];
   boot.extraModulePackages = [ ];
 
   fileSystems."/" =
     {
-      device = "/dev/disk/by-uuid/3b8b2c4b-835e-4822-8ac8-0effdc8270d6";
-      fsType = "btrfs";
+      device = "/dev/disk/by-uuid/7c560634-d545-41cc-b375-42ce3037fd73";
+      fsType = "ext4";
     };
 
   swapDevices = [ ];
 
-  nix.maxJobs = lib.mkDefault 1;
+  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
   nixpkgs.hostPlatform = "x86_64-linux";
 }
diff --git a/hosts/profiles/freshrss/default.nix b/hosts/profiles/freshrss/default.nix
index 2c736daa..f5447dfe 100644
--- a/hosts/profiles/freshrss/default.nix
+++ b/hosts/profiles/freshrss/default.nix
@@ -25,7 +25,7 @@
         freshrss-users freshrss freshrss
       '';
     # TODO with password
-    # ensureDatabases = [ "freshrss" ];
+    ensureDatabases = [ "freshrss" ];
     ensureUsers = [
       { name = "freshrss"; ensurePermissions."DATABASE freshrss" = "ALL PRIVILEGES"; }
     ];
diff --git a/secrets/freshrss-dbpass.age b/secrets/freshrss-dbpass.age
new file mode 100644
index 00000000..a32e69ff
--- /dev/null
+++ b/secrets/freshrss-dbpass.age
@@ -0,0 +1,9 @@
+age-encryption.org/v1
+-> ssh-ed25519 kgCrKA mLQH468uhh1m8iQKV2/jffzYVulg5jj4RPlzkHACTRU
++COpkATGYfZdvknW47SUO66cG2susG/xU6cJV34fsUc
+-> r-grease 5 &J{s<$a- ug
+rAWQD4eZYzWTvtoHgf2GuMHPE8MULtfL8AUTgZRtMCREWqylQrLmOwYcXn0/er1i
+gE6vH3r6iLWrEZCpHB3uG0k
+--- PECN04bxeqDCaqrTE3eB+MIqG/lKrJhYyvIhnVdajVU
+;¡zqIÏr¡·02É&K<�nvü Œ�Ê¥Æ1-Þõ´«Ë°¬
+BüÊP©w…ªZ9ËzqÐU•°©ªèE
\ No newline at end of file
diff --git a/secrets/secrets.nix b/secrets/secrets.nix
index 308274e8..a45b5c0f 100644
--- a/secrets/secrets.nix
+++ b/secrets/secrets.nix
@@ -4,6 +4,7 @@ let
   system = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIMPcqWQ/L5nLTsBFHArl3AJb9xynhfsKenb5h0NNuMV root@curve";
   mossnet = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAA0bsVbdQR6iWNLKIiID57A1+dVXC58Dtf5cSXg6/JF root@box";
   lituus = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIH2lAb33LH3JNuOfBXt971u0tHe+NURFecQdfjwEj+C+ root@lituus";
+  helix = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAKrL6IDHNnHmxi0q9nzu87NOyidPm3HpE7klU368lEf root@helix";
   curve = [ system user ];
   allUserKeys = [ system user mossnet ];
   systemOnly = [ system mossnet ]; # lituus
@@ -15,6 +16,7 @@ in
   "box-wg.age".publicKeys = [ mossnet ];
   # "wallabag.age".publicKeys = [ mossnet ];
   "borg-password.age".publicKeys = systemOnly;
+  "freshrss-dbpass.age".publicKeys = [ helix ];
   "synapse-config.age".publicKeys = [ lituus ];
   "synapse-database-password.age".publicKeys = [ lituus ];
   "sealight-mod-password.age".publicKeys = [ lituus ];