Merge branch 'devos' of git.sealight.xyz:aynish/nix-garden into devos
This commit is contained in:
		
						commit
						d27f4ef047
					
				|  | @ -122,10 +122,10 @@ | |||
|             }; | ||||
|             suites = with profiles; rec { | ||||
|               base = [ core users.root users.anish ]; | ||||
|               sealight = [ base server ]; # matrix rsshub backup wireguard | ||||
|               mossnet = [ base server taskd wireguard-box shaarli wallabag dns backup monitoring nfs rss-bridge gonic headphones radicale ]; # hpi syncthing | ||||
|               sealight = [ base server ]; # matrix rsshub backup wireguard-server | ||||
|               mossnet = [ base server taskd shaarli wallabag dns monitoring nfs rss-bridge gonic headphones radicale ]; # hpi syncthing | ||||
|               cube = [ base site server ]; # backup | ||||
|               graphical = [ base bluetooth music sync wireguard wifi desktop ]; | ||||
|               graphical = [ base bluetooth music sync wifi desktop ]; | ||||
|               curve = [ graphical secrets ]; # backup? | ||||
|               work = [ base ]; | ||||
|             }; | ||||
|  |  | |||
|  | @ -1,4 +1,4 @@ | |||
| { profiles, suites, ... }: | ||||
| { self, profiles, suites, ... }: | ||||
| { | ||||
|   imports = [ | ||||
|     ./configuration.nix | ||||
|  | @ -12,4 +12,32 @@ | |||
|   services."grasp".enable = true; | ||||
|   services."grasp".path = "/home/anish/kitaab/grasp"; | ||||
|   services."grasp".user = "anish"; | ||||
| 
 | ||||
|   # Backups | ||||
|   age.secrets.borg-password.file = "${self}/secrets/borg-password.age"; | ||||
|   services.postgresqlBackup = { | ||||
|     enable = true; | ||||
|     databases = [ "wallabag" ]; | ||||
|     location = "/var/backup/postgresql"; | ||||
|   }; | ||||
|   mossnet.backup = { | ||||
|     enable = true; | ||||
|     name = "mossnet"; | ||||
|     paths = [ | ||||
|       "/var/lib/taskserver" # taskwarrior | ||||
|       "/var/www/shaarli-config" # sharli | ||||
|       "/var/backup/postgresql" # wallabag | ||||
|       "/var/lib/radicale" # radicale | ||||
|     ]; | ||||
|     # seafile? | ||||
|     # syncthing | ||||
|   }; | ||||
| 
 | ||||
|   age.secrets.box-wg.file = "${self}/secrets/box-wg.age"; | ||||
|   age.secrets.box-wg.owner = "anish"; | ||||
|   mossnet.wg = { | ||||
|     enable = true; | ||||
|     ips = [ "10.0.69.4/24" ]; | ||||
|     privateKeyFile = "/run/agenix/box-wg"; | ||||
|   }; | ||||
| } | ||||
|  |  | |||
|  | @ -1,4 +1,4 @@ | |||
| { profiles, suites, ... }: | ||||
| { self, profiles, suites, ... }: | ||||
| { | ||||
|   imports = [ | ||||
|     ./configuration.nix | ||||
|  | @ -28,22 +28,33 @@ | |||
| 
 | ||||
|   boot.supportedFilesystems = [ "ntfs" ]; | ||||
| 
 | ||||
|   age.secrets.curve-wg.file = "${self}/secrets/curve-wg.age"; | ||||
|   age.secrets.curve-wg.owner = "anish"; | ||||
|   mossnet.wg = { | ||||
|     enable = true; | ||||
|     ips = [ "10.0.69.2/24" ]; | ||||
|     privateKeyFile = "/run/agenix/curve-wg"; | ||||
|   }; | ||||
| 
 | ||||
|   age.secrets.borg-password.file = "${self}/secrets/borg-password.age"; | ||||
|   mossnet.backup = { | ||||
|     enable = true; | ||||
|     name = "curve"; | ||||
|     paths = [ "/home/anish" ]; | ||||
|   }; | ||||
| 
 | ||||
|   # enable adb  | ||||
|   # TODO move this (it's for KaiOS WebIDE devShell?) | ||||
|   programs.adb.enable = true; | ||||
|   #virtualisation.docker.enable = true; | ||||
|   services.udev.extraRules = '' | ||||
|         # Monitor plugged in | ||||
|         # Doesn't work, becuase /home/anish/bin/hotplug-monitor isn't part of the nix build | ||||
|         # KERNEL=="card0", SUBSYSTEM=="drm", ENV{DISPLAY}=":0", ENV{XAUTHORITY}="/home/anish/.Xauthority", RUN+="/home/anish/bin/hotplug-monitor.sh" # TODO: add this file to nix home-manager | ||||
|     # Qualcomm EDL | ||||
|     SUBSYSTEMS=="usb", ATTRS{idVendor}=="05c6", ATTRS{idProduct}=="9008", MODE="0666", GROUP="plugdev" | ||||
| 
 | ||||
|         # Qualcomm EDL | ||||
|         SUBSYSTEMS=="usb", ATTRS{idVendor}=="05c6", ATTRS{idProduct}=="9008", MODE="0666", GROUP="plugdev" | ||||
|     # Qualcomm Memory Debug | ||||
|     SUBSYSTEMS=="usb", ATTRS{idVendor}=="05c6", ATTRS{idProduct}=="9006", MODE="0666", GROUP="plugdev" | ||||
| 
 | ||||
|         # Qualcomm Memory Debug | ||||
|         SUBSYSTEMS=="usb", ATTRS{idVendor}=="05c6", ATTRS{idProduct}=="9006", MODE="0666", GROUP="plugdev" | ||||
| 
 | ||||
|         # Atmel DFU | ||||
|     # Atmel DFU | ||||
|     ### ATmega16U2 | ||||
|     SUBSYSTEMS=="usb", ATTRS{idVendor}=="03eb", ATTRS{idProduct}=="2fef", TAG+="uaccess" | ||||
|     ### ATmega32U2 | ||||
|  |  | |||
							
								
								
									
										53
									
								
								modules/backup.nix
									
									
									
									
									
										Normal file
									
								
							
							
						
						
									
										53
									
								
								modules/backup.nix
									
									
									
									
									
										Normal file
									
								
							|  | @ -0,0 +1,53 @@ | |||
| # TODO:  | ||||
| # This currently works on a per host basis, and the host file has to define all the locations it wants to back up. | ||||
| # Ideally, this would create a job for each profile instead, so the backup strategy is included in the profile regardless of host | ||||
| { config, lib, pkgs, ... }: | ||||
| with lib; | ||||
| let | ||||
|   cfg = config.mossnet.backup; | ||||
| in | ||||
| { | ||||
|   options = { | ||||
|     mossnet.backup = { | ||||
|       enable = mkEnableOption "Backup module using borg for Anish's computer nursery"; | ||||
|       name = lib.mkOption { | ||||
|         type = types.str; | ||||
|         default = { }; | ||||
|         example = literalExample '' | ||||
|           mossnet | ||||
|         ''; | ||||
|         description = '' | ||||
|           name for the backup operator | ||||
|         ''; | ||||
|       }; | ||||
|       paths = lib.mkOption { | ||||
|         type = with types; listOf str; | ||||
|         default = { }; | ||||
|         example = literalExample '' | ||||
|           [ "/home/anish/usr" ]; | ||||
|         ''; | ||||
|         description = '' | ||||
|           A list of folders to backup | ||||
|         ''; | ||||
|       }; | ||||
|     }; | ||||
|   }; | ||||
| 
 | ||||
|   config = mkIf cfg.enable { | ||||
|     services.borgbackup.jobs = { | ||||
|       "${cfg.name}" = { | ||||
|         paths = cfg.paths; | ||||
|         doInit = true; | ||||
|         repo = "20779@hk-s020.rsync.net:${cfg.name}"; | ||||
|         encryption = { | ||||
|           mode = "repokey-blake2"; | ||||
|           passCommand = "cat /run/agenix/borg-password"; | ||||
|         }; | ||||
|         environment = { BORG_RSH = "ssh -i /root/borg/borg-key"; }; # YOU NEED TO PUT THIS HERE MANUALLY | ||||
|         compression = "auto,lzma"; | ||||
|         startAt = "daily"; | ||||
|         extraArgs = "--remote-path=borg1"; | ||||
|       }; | ||||
|     }; | ||||
|   }; | ||||
| } | ||||
							
								
								
									
										54
									
								
								modules/wireguard.nix
									
									
									
									
									
										Normal file
									
								
							
							
						
						
									
										54
									
								
								modules/wireguard.nix
									
									
									
									
									
										Normal file
									
								
							|  | @ -0,0 +1,54 @@ | |||
| { config, lib, pkgs, ... }: | ||||
| with lib; | ||||
| let | ||||
|   cfg = config.mossnet.wg; | ||||
| in | ||||
| { | ||||
|   options = { | ||||
|     mossnet.wg = { | ||||
|       enable = mkEnableOption "Gain access to all mossnet systems through wireguard"; | ||||
|       ips = lib.mkOption { | ||||
|         type = with types; listOf str; | ||||
|         default = { }; | ||||
|         example = literalExample '' | ||||
|           [ "10.0.69.2/24" ]; | ||||
|         ''; | ||||
|         description = '' | ||||
|           The IP this machine is allowed to connect to | ||||
|         ''; | ||||
|       }; | ||||
|       privateKeyFile = lib.mkOption { | ||||
|         type = types.path; | ||||
|         default = { }; | ||||
|         example = literalExample '' | ||||
|           /run/agenix/wg-curve | ||||
|         ''; | ||||
|         description = '' | ||||
|           The private ssh key file to use to connect! | ||||
|           Remember set age.secrets.*.file and age.secrets.*.user | ||||
|         ''; | ||||
|       }; | ||||
|     }; | ||||
|   }; | ||||
|   config = mkIf cfg.enable { | ||||
|     networking.firewall.allowedUDPPorts = [ 60990 ]; | ||||
|     networking.wireguard.interfaces = { | ||||
|       wg0 = { | ||||
|         ips = cfg.ips; | ||||
|         listenPort = 60990; # to match firewall allowedUDPPorts (without this wg uses random port numbers) | ||||
| 
 | ||||
|         privateKeyFile = cfg.privateKeyFile; | ||||
|         peers = [ | ||||
|           # For a client configuration, one peer entry for the server will suffice. | ||||
|           { | ||||
|             publicKey = "c1J4p63rD3IlszugMZiki7UBV3YmDdqa3DU4UejXzAI="; | ||||
|             allowedIPs = [ "10.0.69.0/24" ]; | ||||
|             # Set this to the server IP and port. | ||||
|             endpoint = "149.28.163.78:60990"; # ToDo: route to endpoint not automatically configured https://wiki.archlinux.org/index.php/WireGuard#Loop_routing https://discourse.nixos.org/t/solved-minimal-firewall-setup-for-wireguard-client/7577 | ||||
|             persistentKeepalive = 25; | ||||
|           } | ||||
|         ]; | ||||
|       }; | ||||
|     }; | ||||
|   }; | ||||
| } | ||||
|  | @ -1,34 +1 @@ | |||
| { | ||||
|   # Assumes the remote borg backup server has already been initialized | ||||
|   # borg init --encryption-key=repokey-blake2 -rsh 'ssh -i /run/keys/id_ed25519_borgbase' 20779@hk-s020.rsync.net:<borg-archive> | ||||
|   services.borgbackup.jobs = { | ||||
|     backupTaskwarriorRsync = { | ||||
|       paths = [ "/var/lib/taskserver" ]; | ||||
|       doInit = true; | ||||
|       repo = "20779@hk-s020.rsync.net:taskwarrior"; | ||||
|       encryption = { | ||||
|         mode = "repokey-blake2"; | ||||
|         passCommand = "cat /run/keys/rsync"; | ||||
|       }; | ||||
|       environment = { BORG_RSH = "ssh -i /run/keys/id_ed25519_borgbase"; }; | ||||
|       compression = "auto,lzma"; | ||||
|       startAt = "weekly"; | ||||
|       extraArgs = "--remote-path=borg1"; | ||||
|     }; | ||||
|   }; | ||||
|   services.borgbackup.jobs = { | ||||
|     backupShaarliRsync = { | ||||
|       paths = [ "/var/www/shaarli-config/data/datastore.php" "/var/www/shaarli-config/config" "/var/www/shaarli-config/.json.config" ]; | ||||
|       doInit = true; | ||||
|       repo = "20779@hk-s020.rsync.net:shaarli"; | ||||
|       encryption = { | ||||
|         mode = "repokey-blake2"; | ||||
|         passCommand = "cat /run/keys/rsync"; | ||||
|       }; | ||||
|       environment = { BORG_RSH = "ssh -i /run/keys/id_ed25519_borgbase"; }; | ||||
|       compression = "auto,lzma"; | ||||
|       startAt = "weekly"; | ||||
|       extraArgs = "--remote-path=borg1"; | ||||
|     }; | ||||
|   }; | ||||
| } | ||||
| { } | ||||
|  |  | |||
|  | @ -6,12 +6,13 @@ | |||
|     port = 2342; | ||||
|     addr = "127.0.0.1"; | ||||
|   }; | ||||
|    | ||||
| 
 | ||||
|   # nginx reverse proxy | ||||
|   services.nginx.recommendedProxySettings = true; # Needed for new grafana versions  | ||||
|   services.nginx.virtualHosts.${config.services.grafana.domain} = { | ||||
|     locations."/" = { | ||||
|         proxyPass = "http://127.0.0.1:${toString config.services.grafana.port}"; | ||||
|         proxyWebsockets = true; | ||||
|       proxyPass = "http://127.0.0.1:${toString config.services.grafana.port}"; | ||||
|       proxyWebsockets = true; | ||||
|     }; | ||||
|   }; | ||||
| 
 | ||||
|  |  | |||
|  | @ -7,5 +7,18 @@ | |||
|       server.hosts = [ "0.0.0.0:5252" ]; | ||||
|     }; | ||||
|   }; | ||||
| 
 | ||||
|   networking.firewall.allowedTCPPorts = [ 5252 ]; | ||||
| 
 | ||||
|   services.nginx.virtualHosts."cal.mossnet.lan" = { | ||||
|     enableACME = false; | ||||
|     forceSSL = false; | ||||
| 
 | ||||
|     locations."/" = { | ||||
|       extraConfig = '' | ||||
|         proxy_pass http://localhost:5252/; | ||||
|         proxy_set_header X-Forwarded-Host $host; | ||||
|       ''; | ||||
|     }; | ||||
|   }; | ||||
| } | ||||
|  |  | |||
|  | @ -1,9 +1,9 @@ | |||
| { pkgs, config, lib, ... }: | ||||
| { self, pkgs, config, lib, ... }: | ||||
| { | ||||
|   # Secrets used by home-manager modules  | ||||
|   age.secrets.fastmail.file = "/etc/nixos/secrets/fastmail.age"; | ||||
|   age.secrets.fastmail.file = "${self}/secrets/fastmail.age"; | ||||
|   age.secrets.fastmail.owner = "anish"; | ||||
| 
 | ||||
|   age.secrets.mossnet.file = "/etc/nixos/secrets/mossnet.age"; | ||||
|   age.secrets.mossnet.file = "${self}/secrets/mossnet.age"; | ||||
|   age.secrets.mossnet.owner = "anish"; | ||||
| } | ||||
|  |  | |||
|  | @ -5,16 +5,22 @@ | |||
|     serviceConfig.Type = "oneshot"; | ||||
|     path = [ | ||||
|       pkgs.git | ||||
|       pkgs.coreutils | ||||
|     ]; | ||||
|     script = '' | ||||
|       ${pkgs.coreutils}/bin/cd /home/anish/kitaab/vimwiki | ||||
|       ${pkgs.git} commit -am "syncing curve" | ||||
|       ${pkgs.git} push | ||||
|       cd /home/anish/kitaab | ||||
|       git add -A | ||||
|       git diff-index --quiet HEAD || git commit -m 'syncing kitaab' # if nothing, don't exit 1 | ||||
|       git push | ||||
|       exit 0 | ||||
|     ''; | ||||
|     serviceConfig = { | ||||
|       User = "anish"; | ||||
|     }; | ||||
|   }; | ||||
|   systemd.timers.kitaab-timer = { | ||||
|     wantedBy = [ "timers.target" ]; | ||||
|     partOf = [ "kitaab-sync.service" ]; | ||||
|     timerConfig.OnCalendar = [ "*-*-* *:00:00" ]; | ||||
|     timerConfig.OnCalendar = [ "daily" ]; | ||||
|   }; | ||||
| } | ||||
|  |  | |||
|  | @ -1,12 +1,20 @@ | |||
| { pkgs, lib, ... }: | ||||
| 
 | ||||
| { | ||||
|   services.cron = { | ||||
|     enable = true; | ||||
|     systemCronJobs = [ | ||||
|       "* */24 * * * *     anish     /etc/get-music.sh" | ||||
|   systemd.services.get-music-sync = { | ||||
|     serviceConfig.Type = "oneshot"; | ||||
|     path = [ | ||||
|       pkgs.coreutils | ||||
|       pkgs.rsync | ||||
|     ]; | ||||
|     script = builtins.readFile ./get-music.sh; | ||||
|     serviceConfig = { | ||||
|       User = "anish"; | ||||
|     }; | ||||
|   }; | ||||
|   systemd.timers.get-music-timer = { | ||||
|     wantedBy = [ "timers.target" ]; | ||||
|     partOf = [ "get-music-sync.service" ]; | ||||
|     timerConfig.OnCalendar = [ "daily" ]; | ||||
|   }; | ||||
|   environment.etc."get-music.sh".text = builtins.readFile "./get-music.sh"; | ||||
|   evironment.systemPackages = [ pkgs.rsync ]; | ||||
| } | ||||
|  |  | |||
							
								
								
									
										
											BIN
										
									
								
								secrets/borg-password.age
									
									
									
									
									
										Normal file
									
								
							
							
						
						
									
										
											BIN
										
									
								
								secrets/borg-password.age
									
									
									
									
									
										Normal file
									
								
							
										
											Binary file not shown.
										
									
								
							
							
								
								
									
										8
									
								
								secrets/box-wg.age
									
									
									
									
									
										Normal file
									
								
							
							
						
						
									
										8
									
								
								secrets/box-wg.age
									
									
									
									
									
										Normal file
									
								
							|  | @ -0,0 +1,8 @@ | |||
| age-encryption.org/v1 | ||||
| -> ssh-ed25519 K2vF/Q Vbe7tvR9OtiY6YCfCAwkV9L/wlKd4h+stYnZu3aCSC4 | ||||
| U5V2qDLFNrY4SQn9aZZyNtsfXpae8eqo6JH66gbKwdg | ||||
| -> %!/-grease ErIq e d{ZU | ||||
| vKMMQJKGGb1YCU3Jn6xq5JTLoGYgC+X58WVxjpHYF126aDBN0NOYxYqDJFRQGe5S | ||||
| 7wuRgDPn | ||||
| --- QE25f0fQlnz4v6ei4OczAW9BpqOvnkwdc7re508d4A4 | ||||
| z@ÒÆfóE/_`)ÞYVh²þûc¥~‰Žü½ïw¨ÎËÙ'ØF1i½êEÞ–ëU(3xt¼®PáZ¦ˆž;Í
3g‡[a6a0aU0 | ||||
|  | @ -1,10 +1,13 @@ | |||
| age-encryption.org/v1 | ||||
| -> ssh-ed25519 E8y8hg ajjA98JsX1JBHd/6pPoTLCrMdkmgnviOZFTWUMtKfzk | ||||
| +ekDAlEfkZ9G6oYfek6kBu0z1jbfQDQfH2ukwk4pvNU | ||||
| -> ssh-ed25519 AiezdQ sZNx8/7RVk9XLvwxrbxjYb3q6uB8ny/DxktST7HMQSk | ||||
| EdEXGSPGJ9j52llednOb8ViK3a+C+ru1weF7wOL3Lzk | ||||
| -> B~GRUs-grease v) >0EI 7cA9 m&8 | ||||
| iYaE+kBtuRHNi7zc9xtWYnNs6ThyHNvSPYnY1SYsugftuao1wkXyFvRrd8wubj1k | ||||
| Y4e50A | ||||
| --- GAVr4RrSEgBxdamubXJNhRPXOeXccN7Nw5GqGLPwdWI | ||||
| 7Ž“x»¬â•¥$йú-¢*û^µ;§°<C2A7>~´é
ÐNŠ{úXá=ZªÙ¦}¯Fð¯Û¼µñ󖼇Åó‹<C3B3>fÞ•ˆÇ<7F>c | ||||
| -> ssh-ed25519 E8y8hg hedyIPcLQGc3KmKFzhVWU/zHcattXe4oRGo8wY/TV3s | ||||
| wXjPQaUnxci/pQKoNXMm7/yhXZ8Ec69w/3bJOxkiXws | ||||
| -> ssh-ed25519 AiezdQ lb8Hwsl8FDk/CExAVqMS0w20MJq5GKUm0NkE5O7k/is | ||||
| aspWW5q6YpXKIvkIzFIPdPFp7/oRgrE/cpqtis5BASY | ||||
| -> ssh-ed25519 K2vF/Q qw5EytbSJskHAcuKFbqZyvut5iJomIRMwgxFohvJBQo | ||||
| GkHaGU3BnBX2BCZ2eF8X1whFmQTKueXvOqC08UggQWU | ||||
| -> z-grease | ||||
| h8wf5RrYDiHoC5CuvGmL6xeol9K2o24A7WAky8qrmKWgjzlhR7IcitQ4AX9teOec | ||||
| 9wsfVkTBgbc | ||||
| --- +l7lATgPTYXuOOCaTYEOVMGxW0Ryaj5RAYaAVT/zIQE | ||||
| fØ‘ËEé¢ÿxP©²×?s“€®‡¾’dP<64>B‰g™œ¨*¨€úÞø¦|d˜°nb¼9ýPÚå | ||||
| âHÅš}™-)¸Þ$5W | ||||
										
											Binary file not shown.
										
									
								
							|  | @ -1,9 +1,12 @@ | |||
| age-encryption.org/v1 | ||||
| -> ssh-ed25519 E8y8hg zUl7tdxWGLDPiv9cX9/vTITX+H+rqgVSZ77YFZUQzBQ | ||||
| ZW9d2bKCo969jT1HWKw8tPSlYJpjm8T7mbcztPVWdyA | ||||
| -> ssh-ed25519 AiezdQ Gb5IB4nHlyBsjIgt52/BL7lcWZFEWly26HND0I/Q824 | ||||
| VyTx5jzEhsekC87qejQsfJGcHNlt0VghloDT+AVo9rQ | ||||
| -> Nbgn:*-grease | ||||
| 5IfKwbqa8Yrv5zz2Vcy98A | ||||
| --- D26v86VajBn6V2Go1nnNdBBwe7K+rLiVw5MVvAob/dk | ||||
| Ò<EFBFBD>@™=s`Ð6¼2ïZã‡ÈÞ‚€ŸÁO:Õ¼í30r«S©éÌüó€o•=Ã]  | ||||
| -> ssh-ed25519 E8y8hg g7zZHmh04X43ZguiRhdjeZ2BtBsT3o8qhSntPxDzd0k | ||||
| 6Cwi06GFH36g44rbkIK1rLxkXFJ5yWLpMsvl3xzFSY8 | ||||
| -> ssh-ed25519 AiezdQ tpn28KlGD2vaeS+3tsaxjhXfcMMNMgsZbQE9YySup3w | ||||
| TbfWuW62lYWkp0xnrrzbdMzNJ+jNn+5tMCZEz4GdTVs | ||||
| -> ssh-ed25519 K2vF/Q 7SQse/JhNP09k7xtyjw1Y2mnhFH5bmaXjqWrpxO5Bxg | ||||
| aKV2EN0a8t6NS+88eAG9+bu6+sFd9/Rc4nNoR0os9X0 | ||||
| -> xjS>-grease *{_ | ||||
| fOiZzBai7fC+jxV7RH8bKLx05h+UVmCR51CGMaAAsIyHivI+hb2M3lDfWdn0shZQ | ||||
| byznwCva3kNQwG3m4MYgk6J4/QiasZGF0O+QoA | ||||
| --- gEmFFhuHpKOP74G/65xuCK0EA3ERvF78q8eVTMlmkOY | ||||
| ハ旆d・D3エック<EFBFBD>┌-罰ツ\<5C>BS|<7C>|9<><39>S頚@/ZヤUdR"サ<> | ||||
|  | @ -3,12 +3,15 @@ let | |||
|   user = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIItTdCyYVur6LzRQf08JZUcEAr23H7fTRRmDJOzoOc6A anish@curve"; | ||||
|   system = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIMPcqWQ/L5nLTsBFHArl3AJb9xynhfsKenb5h0NNuMV root@curve"; | ||||
|   mossnet = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAA0bsVbdQR6iWNLKIiID57A1+dVXC58Dtf5cSXg6/JF root@box"; | ||||
|   allKeys = [ system user ]; | ||||
|   curve = [ system user ]; | ||||
|   allKeys = [ system user mossnet ]; | ||||
|   systemOnly = [ system mossnet ]; | ||||
| in | ||||
| { | ||||
|   "fastmail.age".publicKeys = allKeys; | ||||
|   "mossnet.age".publicKeys = allKeys; | ||||
|   "curve-wg.age".publicKeys = allKeys; | ||||
|   #"nextcloud-db.age".publicKeys = mossnet; | ||||
|   #"nextcloud-admin.age".publicKeys = mossnet; | ||||
|   "curve-wg.age".publicKeys = curve; | ||||
|   "box-wg.age".publicKeys = [ mossnet ]; | ||||
|   # "wallabag.age".publicKeys = [ mossnet ]; | ||||
|   "borg-password.age".publicKeys = systemOnly; | ||||
| } | ||||
|  |  | |||
		Loading…
	
		Reference in a new issue