From fb90b4319a8658f1057de643fdaa177cd20a3ba1 Mon Sep 17 00:00:00 2001 From: Anish L Date: Tue, 14 Jun 2022 14:28:34 +1000 Subject: [PATCH 01/20] adding borg secret --- secrets/secrets.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/secrets/secrets.nix b/secrets/secrets.nix index 15998d87..dbc73194 100644 --- a/secrets/secrets.nix +++ b/secrets/secrets.nix @@ -9,6 +9,6 @@ in "fastmail.age".publicKeys = allKeys; "mossnet.age".publicKeys = allKeys; "curve-wg.age".publicKeys = allKeys; - #"nextcloud-db.age".publicKeys = mossnet; - #"nextcloud-admin.age".publicKeys = mossnet; + "wallabag.age".publicKeys = mossnet; + "borg-password".publicKeys = mossnet; } From ef507ca7aa7cea993e59436ad242f6f58c9ca094 Mon Sep 17 00:00:00 2001 From: Anish L Date: Tue, 14 Jun 2022 14:29:46 +1000 Subject: [PATCH 02/20] doing it right --- secrets/secrets.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/secrets/secrets.nix b/secrets/secrets.nix index dbc73194..f781341d 100644 --- a/secrets/secrets.nix +++ b/secrets/secrets.nix @@ -9,6 +9,6 @@ in "fastmail.age".publicKeys = allKeys; "mossnet.age".publicKeys = allKeys; "curve-wg.age".publicKeys = allKeys; - "wallabag.age".publicKeys = mossnet; - "borg-password".publicKeys = mossnet; + "wallabag.age".publicKeys = [ mossnet ]; + "borg-password.age".publicKeys = [ mossnet ]; } From 5637febfd5f8b27568c32a76e55702e29675f63a Mon Sep 17 00:00:00 2001 From: Anish L Date: Tue, 14 Jun 2022 15:23:09 +1000 Subject: [PATCH 03/20] added backup module and backups for box and curve also put a reverse proxy infront of radicale --- hosts/box/default.nix | 19 ++++++++++++ hosts/curve/default.nix | 22 ++++++++------ modules/backup.nix | 54 +++++++++++++++++++++++++++++++++++ profiles/radicale/default.nix | 13 +++++++++ 4 files changed, 100 insertions(+), 8 deletions(-) create mode 100644 modules/backup.nix diff --git a/hosts/box/default.nix b/hosts/box/default.nix index ada393dd..c2ac2a65 100644 --- a/hosts/box/default.nix +++ b/hosts/box/default.nix @@ -12,4 +12,23 @@ services."grasp".enable = true; services."grasp".path = "/home/anish/kitaab/grasp"; services."grasp".user = "anish"; + + services.postgresqlBackup = { + enable = true; + databases = [ "wallabag" ]; + location = "/var/backup/postgresql"; + }; + + mossnet.backup = { + enable = true; + name = "mossnet"; + paths = [ + "/var/lib/taskserver" # taskwarrior + "/var/www/shaarli-config" # sharli + "/var/backup/postgresql" # wallabag + "/var/lib/radicale" # radicale + ]; + # seafile? + # syncthing + }; } diff --git a/hosts/curve/default.nix b/hosts/curve/default.nix index 436519e5..13e51aa3 100644 --- a/hosts/curve/default.nix +++ b/hosts/curve/default.nix @@ -28,22 +28,28 @@ boot.supportedFilesystems = [ "ntfs" ]; + mossnet.backup = { + enable = true; + name = "curve"; + paths = [ "/home/anish" ]; + }; + # enable adb # TODO move this (it's for KaiOS WebIDE devShell?) programs.adb.enable = true; #virtualisation.docker.enable = true; services.udev.extraRules = '' - # Monitor plugged in - # Doesn't work, becuase /home/anish/bin/hotplug-monitor isn't part of the nix build - # KERNEL=="card0", SUBSYSTEM=="drm", ENV{DISPLAY}=":0", ENV{XAUTHORITY}="/home/anish/.Xauthority", RUN+="/home/anish/bin/hotplug-monitor.sh" # TODO: add this file to nix home-manager + # Monitor plugged in + # Doesn't work, becuase /home/anish/bin/hotplug-monitor isn't part of the nix build + # KERNEL=="card0", SUBSYSTEM=="drm", ENV{DISPLAY}=":0", ENV{XAUTHORITY}="/home/anish/.Xauthority", RUN+="/home/anish/bin/hotplug-monitor.sh" # TODO: add this file to nix home-manager - # Qualcomm EDL - SUBSYSTEMS=="usb", ATTRS{idVendor}=="05c6", ATTRS{idProduct}=="9008", MODE="0666", GROUP="plugdev" + # Qualcomm EDL + SUBSYSTEMS=="usb", ATTRS{idVendor}=="05c6", ATTRS{idProduct}=="9008", MODE="0666", GROUP="plugdev" - # Qualcomm Memory Debug - SUBSYSTEMS=="usb", ATTRS{idVendor}=="05c6", ATTRS{idProduct}=="9006", MODE="0666", GROUP="plugdev" + # Qualcomm Memory Debug + SUBSYSTEMS=="usb", ATTRS{idVendor}=="05c6", ATTRS{idProduct}=="9006", MODE="0666", GROUP="plugdev" - # Atmel DFU + # Atmel DFU ### ATmega16U2 SUBSYSTEMS=="usb", ATTRS{idVendor}=="03eb", ATTRS{idProduct}=="2fef", TAG+="uaccess" ### ATmega32U2 diff --git a/modules/backup.nix b/modules/backup.nix new file mode 100644 index 00000000..eabdc1b3 --- /dev/null +++ b/modules/backup.nix @@ -0,0 +1,54 @@ +# Assumes the remote borg backup server has already been initialized +# TODO: +# This currently works on a per host basis, and the host file has to define all the locations it wants to back up. +# Ideally, this would create a job for each profile instead, so the backup strategy is included in the profile regardless of host +{ config, lib, pkgs, ... }: +with lib; +let + cfg = config.mossnet.backup; +in +{ + options = { + mossnet.backup = { + enable = mkEnableOption "Backup module using borg for Anish's computer nursery"; + name = lib.mkOption { + type = types.str; + default = { }; + example = literalExample '' + shaarli + ''; + description = '' + name for the backup operator + ''; + }; + paths = lib.mkOption { + type = with types; attrsOf (listOf str); + default = { }; + example = literalExample '' + [ "/home/anish/usr" ]; + ''; + description = '' + A list of folders to backup + ''; + }; + }; + }; + + config = mkIf cfg.enable { + services.borgbackup.jobs = { + "${cfg.name}" = { + paths = cfg.paths; + doInit = true; + repo = "20779@hk-s020.rsync.net:${cfg.name}"; + encryption = { + mode = "repokey-blake2"; + passCommand = "cat /run/keys/borg-password"; + }; + environment = { BORG_RSH = "ssh -i /root/borg/borg-key"; }; # YOU NEED TO PUT THIS HERE MANUALLY + compression = "auto,lzma"; + startAt = "weekly"; + extraArgs = "--remote-path=borg1"; + }; + }; + }; +} diff --git a/profiles/radicale/default.nix b/profiles/radicale/default.nix index 9604acd6..e08af459 100644 --- a/profiles/radicale/default.nix +++ b/profiles/radicale/default.nix @@ -7,5 +7,18 @@ server.hosts = [ "0.0.0.0:5252" ]; }; }; + networking.firewall.allowedTCPPorts = [ 5252 ]; + + services.nginx.virtualHosts."cal.mossnet.lan" = { + enableACME = false; + forceSSL = false; + + locations."/" = { + extraConfig = '' + proxy_pass http://localhost:5252/; + proxy_set_header X-Forwarded-Host $host; + ''; + }; + }; } From 568b6c290f1fc00568abaa6218733c7f38334118 Mon Sep 17 00:00:00 2001 From: Anish Lakhwara Date: Tue, 14 Jun 2022 15:55:08 +1000 Subject: [PATCH 04/20] add borg-backup password secret --- secrets/borg-password.age | 8 ++++++++ secrets/secrets.nix | 5 +++-- 2 files changed, 11 insertions(+), 2 deletions(-) create mode 100644 secrets/borg-password.age diff --git a/secrets/borg-password.age b/secrets/borg-password.age new file mode 100644 index 00000000..e8c46597 --- /dev/null +++ b/secrets/borg-password.age @@ -0,0 +1,8 @@ +age-encryption.org/v1 +-> ssh-ed25519 K2vF/Q Qy2T64fWyXzd5AGl/ml+qv4762P8ssuU6T5oY73XhGg +zqmeRJUBH7Uphk8w9y4139y35sY7aqNvi4VdEE3+9C4 +-> Ssv8/I?-grease C#A?FUJ _w +RWw+O3vvqWwiADgWHq618yDTmb/xMpl1C6qCcQBBh/DHUZOSNzNTPKALIs1sZcOd +6ruueM3qx9RD9Zk +--- pql0nQHe9TaQXhGBk5tEeCzMaRxNoNwUAhlda0PhPug +?^=N廖|1/D(fnsQ1:%ٽbי(ڦ!\`>؝i+6G8h6uh2LfhuXPƮJ/-ꦐf?'\sb/thV"Q \ No newline at end of file diff --git a/secrets/secrets.nix b/secrets/secrets.nix index f781341d..ec72324c 100644 --- a/secrets/secrets.nix +++ b/secrets/secrets.nix @@ -3,12 +3,13 @@ let user = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIItTdCyYVur6LzRQf08JZUcEAr23H7fTRRmDJOzoOc6A anish@curve"; system = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIMPcqWQ/L5nLTsBFHArl3AJb9xynhfsKenb5h0NNuMV root@curve"; mossnet = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAA0bsVbdQR6iWNLKIiID57A1+dVXC58Dtf5cSXg6/JF root@box"; - allKeys = [ system user ]; + allKeys = [ system user mossnet ]; + systemOnly = [ system mossnet ]; in { "fastmail.age".publicKeys = allKeys; "mossnet.age".publicKeys = allKeys; "curve-wg.age".publicKeys = allKeys; "wallabag.age".publicKeys = [ mossnet ]; - "borg-password.age".publicKeys = [ mossnet ]; + "borg-password.age".publicKeys = systemOnly; } From 47d6cba1f4a7ee192b6fc9fe60e9f20f5bca515b Mon Sep 17 00:00:00 2001 From: Anish Lakhwara Date: Tue, 14 Jun 2022 15:59:28 +1000 Subject: [PATCH 05/20] rekey borg password --- secrets/borg-password.age | 17 ++++++++++------- 1 file changed, 10 insertions(+), 7 deletions(-) diff --git a/secrets/borg-password.age b/secrets/borg-password.age index e8c46597..0a70fd89 100644 --- a/secrets/borg-password.age +++ b/secrets/borg-password.age @@ -1,8 +1,11 @@ age-encryption.org/v1 --> ssh-ed25519 K2vF/Q Qy2T64fWyXzd5AGl/ml+qv4762P8ssuU6T5oY73XhGg -zqmeRJUBH7Uphk8w9y4139y35sY7aqNvi4VdEE3+9C4 --> Ssv8/I?-grease C#A?FUJ _w -RWw+O3vvqWwiADgWHq618yDTmb/xMpl1C6qCcQBBh/DHUZOSNzNTPKALIs1sZcOd -6ruueM3qx9RD9Zk ---- pql0nQHe9TaQXhGBk5tEeCzMaRxNoNwUAhlda0PhPug -?^=N廖|1/D(fnsQ1:%ٽbי(ڦ!\`>؝i+6G8h6uh2LfhuXPƮJ/-ꦐf?'\sb/thV"Q \ No newline at end of file +-> ssh-ed25519 E8y8hg FFMPMg+N6vr+9CLRnJsJfPHDsVW/+vj4n1+yOKqjsmE +RRpHi+sXeMarf/BpLmkE3Aaqak2tdr/wDRpxw515jiw +-> ssh-ed25519 K2vF/Q bg0q/EYl845QSUKR1h5GhZpeZ3Rg+3B7xfriMSk5nTs +NUCRbS2CwV4EfDOqyof0seA8/BG1OfkBhs5QYWdIzGU +-> dO[?-grease x+=nsn p_S]y +:dl$w.?ęIGy"qVcKŜԭ4ݨ=|+r{ Qi_ \ No newline at end of file From 36d1d1c61e8c2bcdbd6be3c64bf758a1cfaa2e8c Mon Sep 17 00:00:00 2001 From: Anish L Date: Tue, 14 Jun 2022 16:04:23 +1000 Subject: [PATCH 06/20] rekey keys to allow box access --- secrets/borg-password.age | Bin 558 -> 543 bytes secrets/curve-wg.age | 21 ++++++++++++--------- secrets/fastmail.age | Bin 400 -> 513 bytes secrets/mossnet.age | 19 +++++++++++-------- 4 files changed, 23 insertions(+), 17 deletions(-) diff --git a/secrets/borg-password.age b/secrets/borg-password.age index 0a70fd8947ba1e0de84f3a87e3eb60cd34c75968..ae9b8787a3b69eee9b21cd464678b4df434deb62 100644 GIT binary patch delta 509 zcmV2xEc2-w7d2?!Fb3t!yL{4@| zF<5m~ZwgU!P+~GpXhb$OR#agtHc&QIZf-YpY-M^(aZgiBP*Zd^c12-#Rx~tZRSGRW zAaiqQEoEdfH8n9gAWJfKMlVqyaw{`aH)%LZO+iaSdN_A0Z+~h?P%lV`w!@ZcJoyRA*U6K{RY{cz8}W zSvh)BMP@TYReyGFazbY|QaMXlPkCr~dSq*Pc~4eUXi;%uP&o=~X-aodR!dPcLw9RM zY*H&tK`~iyaVtbCN=h*^WLGi@EiEk|YiDjXOJh!HbY@F|$f@IGlVt+#wvzD7Ty~WVsD$K4YR708V(*M-EPqBuO;Al|D^50caw|DQOj2%2b4q4VNJMj1S1&7eYBX*!D|t^# zacXmIMG8_*XDc&8 zH+W`pX-!jWHEvXM3Qko+QesmwLw8m*MP@`#ad~fMFmq)=I4?p+F;8Y|LTGa}QCU}H zNqR?B3N1b$WKUZ^EoX9NVRL05cq=__b8a9!OCeHPN(y*zR!wVCcXU@$aWF78F)?;G zM0jLDYEw{gFn@7%adl@(H#BuhD>GL$QF=mUZdO!xO>#_fK{zWbNn=)6WHw|9WMVf^ zLuhp|RBtnIO=@CLVMumKY*0C6G(vbyG-PH?LUB__H)jehEiE8pc`!6fZe>eFG*)Oc zcx-QGWo%Y3GB818O+j%>W^QCNLosDfYA|Q<@gHPtB(8V! zqxbEve+Vw&jz5fp#F^hoj7R;pc_NI$`f>MGt{uo@OU0ap)UC5L-Kaf$%PYTf>gN}G P&>$93sRn74z+bAqAil#r diff --git a/secrets/curve-wg.age b/secrets/curve-wg.age index ada0fb2f..a1cdf212 100644 --- a/secrets/curve-wg.age +++ b/secrets/curve-wg.age @@ -1,10 +1,13 @@ age-encryption.org/v1 --> ssh-ed25519 E8y8hg ajjA98JsX1JBHd/6pPoTLCrMdkmgnviOZFTWUMtKfzk -+ekDAlEfkZ9G6oYfek6kBu0z1jbfQDQfH2ukwk4pvNU --> ssh-ed25519 AiezdQ sZNx8/7RVk9XLvwxrbxjYb3q6uB8ny/DxktST7HMQSk -EdEXGSPGJ9j52llednOb8ViK3a+C+ru1weF7wOL3Lzk --> B~GRUs-grease v) >0EI 7cA9 m&8 -iYaE+kBtuRHNi7zc9xtWYnNs6ThyHNvSPYnY1SYsugftuao1wkXyFvRrd8wubj1k -Y4e50A ---- GAVr4RrSEgBxdamubXJNhRPXOeXccN7Nw5GqGLPwdWI -7x╥$-*^;~ N{X=Z٦}Fۼ󖼇fޕǍc \ No newline at end of file +-> ssh-ed25519 E8y8hg hedyIPcLQGc3KmKFzhVWU/zHcattXe4oRGo8wY/TV3s +wXjPQaUnxci/pQKoNXMm7/yhXZ8Ec69w/3bJOxkiXws +-> ssh-ed25519 AiezdQ lb8Hwsl8FDk/CExAVqMS0w20MJq5GKUm0NkE5O7k/is +aspWW5q6YpXKIvkIzFIPdPFp7/oRgrE/cpqtis5BASY +-> ssh-ed25519 K2vF/Q qw5EytbSJskHAcuKFbqZyvut5iJomIRMwgxFohvJBQo +GkHaGU3BnBX2BCZ2eF8X1whFmQTKueXvOqC08UggQWU +-> z-grease +h8wf5RrYDiHoC5CuvGmL6xeol9K2o24A7WAky8qrmKWgjzlhR7IcitQ4AX9teOec +9wsfVkTBgbc +--- +l7lATgPTYXuOOCaTYEOVMGxW0Ryaj5RAYaAVT/zIQE +fؑExP?sdPBg* |dnb9P + HŚ}-)$5W \ No newline at end of file diff --git a/secrets/fastmail.age b/secrets/fastmail.age index d65baa5015a5eb2af910d6495f7bc87f49dff68b..3a3aeb4a537c6061367ee67172bc0759f9672362 100644 GIT binary patch literal 513 zcmZ9|J&%)M003ZTjDt(fxyY!waC{s+UY64WZGo2ZQD}M5;aa|13N4?7P1hS-oK0@= z54gKt;%Z`|iHrULe}Pfg`vp((tU@32Q#Wt-Wt^pFSsvmwiC~v#QAC*UQT;y2qC?Pv zC`7Y}awy&HI>@gpT~N$|fReU~gW5hP#l+aS7s|ZZOWYVB3n!+@CCz!6%9=(tF<|3B zd(81M&XS3D5$oe6=ooI;D0j6%?024yCMrEIUEqj;*FUY2T_a^1zg7V^4n<<#PD?4E zOKl-j96(@bL*7;sE=@_!Jhyy@_X-Z5C2N>NlhuZ^nLIu;4mE1-Y7?p+;W}z9KqyrE za8ng)%F;U}Q3c4jj6s-qBw5J}*xQ;orjel|BurWPSajmR;oAaFtM(9x4Zae!N)g)S z_Gk`Vx3kwAYyH<=)h`o(g}J{fd=wHDIz_Mkl^(A6p^qa6O7aG_!fcLBtJcgwu1@1^ zLdiQbk|#QXVHm2=-ult&ma6+KK_1_f4+V4>H68(pZDPU{>`@!mv7$w1@Kp?-~a#s delta 365 zcmWm8&q~5z003~Jpcqltx~=GDV>UOPLBZ#oGyi_G>E`I7`@ZSa&FO~DU8JH@1ztMz z1ie6Y>=1MedVx*_LFeeyp?ZSf?|5N0Kii&;8wn(qjkKH}Sg}w6U0t5AG^*=*v|p`h z{D@QWp&NKKUkm^7F%LG6>C*QPLH zIBq9N0t<&oCQ;}V43iJ(f~0Yh4Z72o=z}7LeY=Z$DJkc~HPm1Rs??GRWZ(oHxIt#* zHYbk4DOunYhDhq?1Eb_^6TnfQY7KG2!{i=1VmFDPqv|?F)q^pt z@nY16#a=Z`Y85+@3Opr(>c})1{Vz*VWV4q`!*U*iAT_AVrI?zvGIU;2lU_-HuF+NN zOk1=~-enDfTDyI^ytsS4TG@F1h(yl6-oEEfPZk$;-#_mk+F(6++*{sSy?#Es`FW|h HwbIfrP4IpM diff --git a/secrets/mossnet.age b/secrets/mossnet.age index d2ac8f74..2a75cae7 100644 --- a/secrets/mossnet.age +++ b/secrets/mossnet.age @@ -1,9 +1,12 @@ age-encryption.org/v1 --> ssh-ed25519 E8y8hg zUl7tdxWGLDPiv9cX9/vTITX+H+rqgVSZ77YFZUQzBQ -ZW9d2bKCo969jT1HWKw8tPSlYJpjm8T7mbcztPVWdyA --> ssh-ed25519 AiezdQ Gb5IB4nHlyBsjIgt52/BL7lcWZFEWly26HND0I/Q824 -VyTx5jzEhsekC87qejQsfJGcHNlt0VghloDT+AVo9rQ --> Nbgn:*-grease -5IfKwbqa8Yrv5zz2Vcy98A ---- D26v86VajBn6V2Go1nnNdBBwe7K+rLiVw5MVvAob/dk -ҍ@=s`62ZނO:ռ30rSo=] \ No newline at end of file +-> ssh-ed25519 E8y8hg g7zZHmh04X43ZguiRhdjeZ2BtBsT3o8qhSntPxDzd0k +6Cwi06GFH36g44rbkIK1rLxkXFJ5yWLpMsvl3xzFSY8 +-> ssh-ed25519 AiezdQ tpn28KlGD2vaeS+3tsaxjhXfcMMNMgsZbQE9YySup3w +TbfWuW62lYWkp0xnrrzbdMzNJ+jNn+5tMCZEz4GdTVs +-> ssh-ed25519 K2vF/Q 7SQse/JhNP09k7xtyjw1Y2mnhFH5bmaXjqWrpxO5Bxg +aKV2EN0a8t6NS+88eAG9+bu6+sFd9/Rc4nNoR0os9X0 +-> xjS>-grease *{_ +fOiZzBai7fC+jxV7RH8bKLx05h+UVmCR51CGMaAAsIyHivI+hb2M3lDfWdn0shZQ +byznwCva3kNQwG3m4MYgk6J4/QiasZGF0O+QoA +--- gEmFFhuHpKOP74G/65xuCK0EA3ERvF78q8eVTMlmkOY +ʝdD3-\XBS||9TSz@/ZUdR" \ No newline at end of file From 123b167ef56e72472d467c1cb71d3c8225d8a7e9 Mon Sep 17 00:00:00 2001 From: Anish L Date: Tue, 14 Jun 2022 16:05:12 +1000 Subject: [PATCH 07/20] key the file saved and add it to hosts that need backup --- hosts/box/default.nix | 4 +++- modules/backup.nix | 4 ++-- profiles/backup/default.nix | 35 +---------------------------------- 3 files changed, 6 insertions(+), 37 deletions(-) diff --git a/hosts/box/default.nix b/hosts/box/default.nix index c2ac2a65..cd138a44 100644 --- a/hosts/box/default.nix +++ b/hosts/box/default.nix @@ -1,4 +1,4 @@ -{ profiles, suites, ... }: +{ self, profiles, suites, ... }: { imports = [ ./configuration.nix @@ -13,6 +13,8 @@ services."grasp".path = "/home/anish/kitaab/grasp"; services."grasp".user = "anish"; + age.secrets.borg-password.file = "${self}/secrets/borg-password.age"; + services.postgresqlBackup = { enable = true; databases = [ "wallabag" ]; diff --git a/modules/backup.nix b/modules/backup.nix index eabdc1b3..ca3cbe5c 100644 --- a/modules/backup.nix +++ b/modules/backup.nix @@ -22,7 +22,7 @@ in ''; }; paths = lib.mkOption { - type = with types; attrsOf (listOf str); + type = with types; listOf str; default = { }; example = literalExample '' [ "/home/anish/usr" ]; @@ -46,7 +46,7 @@ in }; environment = { BORG_RSH = "ssh -i /root/borg/borg-key"; }; # YOU NEED TO PUT THIS HERE MANUALLY compression = "auto,lzma"; - startAt = "weekly"; + startAt = "daily"; extraArgs = "--remote-path=borg1"; }; }; diff --git a/profiles/backup/default.nix b/profiles/backup/default.nix index ee9ecb43..ffcd4415 100644 --- a/profiles/backup/default.nix +++ b/profiles/backup/default.nix @@ -1,34 +1 @@ -{ - # Assumes the remote borg backup server has already been initialized - # borg init --encryption-key=repokey-blake2 -rsh 'ssh -i /run/keys/id_ed25519_borgbase' 20779@hk-s020.rsync.net: - services.borgbackup.jobs = { - backupTaskwarriorRsync = { - paths = [ "/var/lib/taskserver" ]; - doInit = true; - repo = "20779@hk-s020.rsync.net:taskwarrior"; - encryption = { - mode = "repokey-blake2"; - passCommand = "cat /run/keys/rsync"; - }; - environment = { BORG_RSH = "ssh -i /run/keys/id_ed25519_borgbase"; }; - compression = "auto,lzma"; - startAt = "weekly"; - extraArgs = "--remote-path=borg1"; - }; - }; - services.borgbackup.jobs = { - backupShaarliRsync = { - paths = [ "/var/www/shaarli-config/data/datastore.php" "/var/www/shaarli-config/config" "/var/www/shaarli-config/.json.config" ]; - doInit = true; - repo = "20779@hk-s020.rsync.net:shaarli"; - encryption = { - mode = "repokey-blake2"; - passCommand = "cat /run/keys/rsync"; - }; - environment = { BORG_RSH = "ssh -i /run/keys/id_ed25519_borgbase"; }; - compression = "auto,lzma"; - startAt = "weekly"; - extraArgs = "--remote-path=borg1"; - }; - }; -} +{ } From 83b0fd46cd597354c139ecadf9897a1d0e53ba35 Mon Sep 17 00:00:00 2001 From: Anish L Date: Tue, 14 Jun 2022 16:06:42 +1000 Subject: [PATCH 08/20] idk probs forgot something --- hosts/box/default.nix | 3 +-- hosts/curve/default.nix | 5 +---- 2 files changed, 2 insertions(+), 6 deletions(-) diff --git a/hosts/box/default.nix b/hosts/box/default.nix index cd138a44..4fa0242b 100644 --- a/hosts/box/default.nix +++ b/hosts/box/default.nix @@ -13,14 +13,13 @@ services."grasp".path = "/home/anish/kitaab/grasp"; services."grasp".user = "anish"; + # Backups age.secrets.borg-password.file = "${self}/secrets/borg-password.age"; - services.postgresqlBackup = { enable = true; databases = [ "wallabag" ]; location = "/var/backup/postgresql"; }; - mossnet.backup = { enable = true; name = "mossnet"; diff --git a/hosts/curve/default.nix b/hosts/curve/default.nix index 13e51aa3..6b2059eb 100644 --- a/hosts/curve/default.nix +++ b/hosts/curve/default.nix @@ -28,6 +28,7 @@ boot.supportedFilesystems = [ "ntfs" ]; + age.secrets.borg-password.file = "${self}/secrets/borg-password.age"; mossnet.backup = { enable = true; name = "curve"; @@ -39,10 +40,6 @@ programs.adb.enable = true; #virtualisation.docker.enable = true; services.udev.extraRules = '' - # Monitor plugged in - # Doesn't work, becuase /home/anish/bin/hotplug-monitor isn't part of the nix build - # KERNEL=="card0", SUBSYSTEM=="drm", ENV{DISPLAY}=":0", ENV{XAUTHORITY}="/home/anish/.Xauthority", RUN+="/home/anish/bin/hotplug-monitor.sh" # TODO: add this file to nix home-manager - # Qualcomm EDL SUBSYSTEMS=="usb", ATTRS{idVendor}=="05c6", ATTRS{idProduct}=="9008", MODE="0666", GROUP="plugdev" From 16387b9728a209dd6fa2a5f51d6587a0c487eee8 Mon Sep 17 00:00:00 2001 From: Anish L Date: Tue, 14 Jun 2022 16:15:48 +1000 Subject: [PATCH 09/20] hide wallabag secret because it doesn't exist --- secrets/secrets.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/secrets/secrets.nix b/secrets/secrets.nix index ec72324c..11e7c3ec 100644 --- a/secrets/secrets.nix +++ b/secrets/secrets.nix @@ -10,6 +10,6 @@ in "fastmail.age".publicKeys = allKeys; "mossnet.age".publicKeys = allKeys; "curve-wg.age".publicKeys = allKeys; - "wallabag.age".publicKeys = [ mossnet ]; + # "wallabag.age".publicKeys = [ mossnet ]; "borg-password.age".publicKeys = systemOnly; } From 6ae1da08e1e1ecc4543a7045d5961781dd998fd1 Mon Sep 17 00:00:00 2001 From: Anish L Date: Tue, 14 Jun 2022 16:16:09 +1000 Subject: [PATCH 10/20] deploy anywhere, by passing self to secrets profile for home-manager age passwords --- profiles/secrets/default.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/profiles/secrets/default.nix b/profiles/secrets/default.nix index acc2f41f..3fc78875 100644 --- a/profiles/secrets/default.nix +++ b/profiles/secrets/default.nix @@ -1,9 +1,9 @@ -{ pkgs, config, lib, ... }: +{ self, pkgs, config, lib, ... }: { # Secrets used by home-manager modules - age.secrets.fastmail.file = "/etc/nixos/secrets/fastmail.age"; + age.secrets.fastmail.file = "${self}/secrets/fastmail.age"; age.secrets.fastmail.owner = "anish"; - age.secrets.mossnet.file = "/etc/nixos/secrets/mossnet.age"; + age.secrets.mossnet.file = "${self}/secrets/mossnet.age"; age.secrets.mossnet.owner = "anish"; } From 401f2c3a3c8da1df50fae1e0a0f10daa8709da5d Mon Sep 17 00:00:00 2001 From: Anish L Date: Tue, 14 Jun 2022 16:16:34 +1000 Subject: [PATCH 11/20] point the password to the right place for borg --- hosts/curve/default.nix | 2 +- modules/backup.nix | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/hosts/curve/default.nix b/hosts/curve/default.nix index 6b2059eb..09cb4798 100644 --- a/hosts/curve/default.nix +++ b/hosts/curve/default.nix @@ -1,4 +1,4 @@ -{ profiles, suites, ... }: +{ self, profiles, suites, ... }: { imports = [ ./configuration.nix diff --git a/modules/backup.nix b/modules/backup.nix index ca3cbe5c..c5d462c7 100644 --- a/modules/backup.nix +++ b/modules/backup.nix @@ -42,7 +42,7 @@ in repo = "20779@hk-s020.rsync.net:${cfg.name}"; encryption = { mode = "repokey-blake2"; - passCommand = "cat /run/keys/borg-password"; + passCommand = "cat /run/agenix/borg-password"; }; environment = { BORG_RSH = "ssh -i /root/borg/borg-key"; }; # YOU NEED TO PUT THIS HERE MANUALLY compression = "auto,lzma"; From 143059edc50facaf27c7959c2ca3796e45f8f07f Mon Sep 17 00:00:00 2001 From: Anish L Date: Tue, 14 Jun 2022 17:00:59 +1000 Subject: [PATCH 12/20] update monitoring so it works with recent grafana --- modules/backup.nix | 2 +- profiles/monitoring/default.nix | 9 ++++++--- 2 files changed, 7 insertions(+), 4 deletions(-) diff --git a/modules/backup.nix b/modules/backup.nix index c5d462c7..8ab45fef 100644 --- a/modules/backup.nix +++ b/modules/backup.nix @@ -15,7 +15,7 @@ in type = types.str; default = { }; example = literalExample '' - shaarli + mossnet ''; description = '' name for the backup operator diff --git a/profiles/monitoring/default.nix b/profiles/monitoring/default.nix index 793ac393..58c352d1 100644 --- a/profiles/monitoring/default.nix +++ b/profiles/monitoring/default.nix @@ -6,12 +6,15 @@ port = 2342; addr = "127.0.0.1"; }; - + # nginx reverse proxy services.nginx.virtualHosts.${config.services.grafana.domain} = { locations."/" = { - proxyPass = "http://127.0.0.1:${toString config.services.grafana.port}"; - proxyWebsockets = true; + proxyPass = "http://127.0.0.1:${toString config.services.grafana.port}"; + proxyWebsockets = true; + extraConfig = '' + proxy_set_header Host ${config.services.grafana.domain} + ''; }; }; From 3d2e050370bd2a7e78b912eb36f08b4bbfdf277d Mon Sep 17 00:00:00 2001 From: Anish L Date: Tue, 14 Jun 2022 17:17:12 +1000 Subject: [PATCH 13/20] add wireguard module --- modules/wireguard.nix | 54 +++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 54 insertions(+) create mode 100644 modules/wireguard.nix diff --git a/modules/wireguard.nix b/modules/wireguard.nix new file mode 100644 index 00000000..1bb0ebd1 --- /dev/null +++ b/modules/wireguard.nix @@ -0,0 +1,54 @@ +{ config, lib, pkgs, ... }: +with lib; +let + cfg = config.mossnet.wg; +in +{ + options = { + mossnet.wg = { + enable = mkEnableOption "Gain access to all mossnet systems through wireguard, but only if it's already included in the server config"; + ips = lib.mkOption { + type = with types; listOf str; + default = { }; + example = literalExample '' + [ "10.0.69.2/24" ]; + ''; + description = '' + The IP this machine is allowed to connect to + ''; + privateKeyFile = lib.mkOption { + type = types.path; + default = { }; + example = literalExample '' + /run/agenix/wg-curve + ''; + description = '' + The private ssh key file to use to connect! + Remember set age.secrets.*.file and age.secrets.*.user + ''; + }; + }; + }; + }; + config = mkIf cfg.enable { + networking.firewall.allowedUDPPorts = [ 60990 ]; + networking.wireguard.interfaces = { + wg0 = { + ips = cfg.ips; + listenPort = 60990; # to match firewall allowedUDPPorts (without this wg uses random port numbers) + + privateKeyFile = cfg.privateKeyFile; + peers = [ + # For a client configuration, one peer entry for the server will suffice. + { + publicKey = "c1J4p63rD3IlszugMZiki7UBV3YmDdqa3DU4UejXzAI="; + allowedIPs = [ "10.0.69.0/24" ]; + # Set this to the server IP and port. + endpoint = "149.28.163.78:60990"; # ToDo: route to endpoint not automatically configured https://wiki.archlinux.org/index.php/WireGuard#Loop_routing https://discourse.nixos.org/t/solved-minimal-firewall-setup-for-wireguard-client/7577 + persistentKeepalive = 25; + } + ]; + }; + }; + }; +} From 7d81a07030c77ffdcaaa4c786b29f939eb2d68db Mon Sep 17 00:00:00 2001 From: Anish L Date: Tue, 14 Jun 2022 17:17:23 +1000 Subject: [PATCH 14/20] maybe this monitoring work? --- profiles/monitoring/default.nix | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/profiles/monitoring/default.nix b/profiles/monitoring/default.nix index 58c352d1..cdf568de 100644 --- a/profiles/monitoring/default.nix +++ b/profiles/monitoring/default.nix @@ -12,9 +12,7 @@ locations."/" = { proxyPass = "http://127.0.0.1:${toString config.services.grafana.port}"; proxyWebsockets = true; - extraConfig = '' - proxy_set_header Host ${config.services.grafana.domain} - ''; + extraConfig = "proxy_set_header Host $http_host"; }; }; From c1650e57c81a0293e46054392ff67f3fd6b4745f Mon Sep 17 00:00:00 2001 From: Anish L Date: Tue, 14 Jun 2022 17:17:43 +1000 Subject: [PATCH 15/20] idk probs something --- modules/backup.nix | 1 - secrets/secrets.nix | 4 +++- 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/modules/backup.nix b/modules/backup.nix index 8ab45fef..3980262d 100644 --- a/modules/backup.nix +++ b/modules/backup.nix @@ -1,4 +1,3 @@ -# Assumes the remote borg backup server has already been initialized # TODO: # This currently works on a per host basis, and the host file has to define all the locations it wants to back up. # Ideally, this would create a job for each profile instead, so the backup strategy is included in the profile regardless of host diff --git a/secrets/secrets.nix b/secrets/secrets.nix index 11e7c3ec..9ac323cf 100644 --- a/secrets/secrets.nix +++ b/secrets/secrets.nix @@ -3,13 +3,15 @@ let user = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIItTdCyYVur6LzRQf08JZUcEAr23H7fTRRmDJOzoOc6A anish@curve"; system = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIMPcqWQ/L5nLTsBFHArl3AJb9xynhfsKenb5h0NNuMV root@curve"; mossnet = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAA0bsVbdQR6iWNLKIiID57A1+dVXC58Dtf5cSXg6/JF root@box"; + curve = [ system user ]; allKeys = [ system user mossnet ]; systemOnly = [ system mossnet ]; in { "fastmail.age".publicKeys = allKeys; "mossnet.age".publicKeys = allKeys; - "curve-wg.age".publicKeys = allKeys; + "curve-wg.age".publicKeys = curve; + # "box-wg.age".publicKeys = [ mossnet ]; # "wallabag.age".publicKeys = [ mossnet ]; "borg-password.age".publicKeys = systemOnly; } From 04490dceb83d43db3304109eb3b0e569e77ad4ad Mon Sep 17 00:00:00 2001 From: Anish L Date: Tue, 14 Jun 2022 17:29:17 +1000 Subject: [PATCH 16/20] converted to working wireguard module --- flake.nix | 6 +++--- hosts/box/default.nix | 8 ++++++++ hosts/curve/default.nix | 8 ++++++++ modules/wireguard.nix | 24 ++++++++++++------------ 4 files changed, 31 insertions(+), 15 deletions(-) diff --git a/flake.nix b/flake.nix index 60585b0c..75f0a2fc 100644 --- a/flake.nix +++ b/flake.nix @@ -122,10 +122,10 @@ }; suites = with profiles; rec { base = [ core users.root users.anish ]; - sealight = [ base server ]; # matrix rsshub backup wireguard - mossnet = [ base server taskd wireguard-box shaarli wallabag dns backup monitoring nfs rss-bridge gonic headphones radicale ]; # hpi syncthing + sealight = [ base server ]; # matrix rsshub backup wireguard-server + mossnet = [ base server taskd wireguard-box shaarli wallabag dns monitoring nfs rss-bridge gonic headphones radicale ]; # hpi syncthing cube = [ base site server ]; # backup - graphical = [ base bluetooth music sync wireguard wifi desktop ]; + graphical = [ base bluetooth music sync wifi desktop ]; curve = [ graphical secrets ]; # backup? work = [ base ]; }; diff --git a/hosts/box/default.nix b/hosts/box/default.nix index 4fa0242b..b8e8792d 100644 --- a/hosts/box/default.nix +++ b/hosts/box/default.nix @@ -32,4 +32,12 @@ # seafile? # syncthing }; + + #age.secrets.box-wg.file = "${self}/secrets/curve-wg.age"; + #age.secrets.box-wg.owner = "anish"; + #mossnet.wg = { + # enable = true; + # ips = [ "10.0.69.4/24" ]; + # privateKeyFile = "/run/agenix/box-wg"; + #}; } diff --git a/hosts/curve/default.nix b/hosts/curve/default.nix index 09cb4798..26489b9c 100644 --- a/hosts/curve/default.nix +++ b/hosts/curve/default.nix @@ -28,6 +28,14 @@ boot.supportedFilesystems = [ "ntfs" ]; + age.secrets.curve-wg.file = "${self}/secrets/curve-wg.age"; + age.secrets.curve-wg.owner = "anish"; + mossnet.wg = { + enable = true; + ips = [ "10.0.69.2/24" ]; + privateKeyFile = "/run/agenix/curve-wg"; + }; + age.secrets.borg-password.file = "${self}/secrets/borg-password.age"; mossnet.backup = { enable = true; diff --git a/modules/wireguard.nix b/modules/wireguard.nix index 1bb0ebd1..5e9e9b52 100644 --- a/modules/wireguard.nix +++ b/modules/wireguard.nix @@ -6,7 +6,7 @@ in { options = { mossnet.wg = { - enable = mkEnableOption "Gain access to all mossnet systems through wireguard, but only if it's already included in the server config"; + enable = mkEnableOption "Gain access to all mossnet systems through wireguard"; ips = lib.mkOption { type = with types; listOf str; default = { }; @@ -16,17 +16,17 @@ in description = '' The IP this machine is allowed to connect to ''; - privateKeyFile = lib.mkOption { - type = types.path; - default = { }; - example = literalExample '' - /run/agenix/wg-curve - ''; - description = '' - The private ssh key file to use to connect! - Remember set age.secrets.*.file and age.secrets.*.user - ''; - }; + }; + privateKeyFile = lib.mkOption { + type = types.path; + default = { }; + example = literalExample '' + /run/agenix/wg-curve + ''; + description = '' + The private ssh key file to use to connect! + Remember set age.secrets.*.file and age.secrets.*.user + ''; }; }; }; From 2f457a42ce24f5180aaf9fb8c9f60051c4bd62ba Mon Sep 17 00:00:00 2001 From: Anish Lakhwara Date: Tue, 14 Jun 2022 17:34:19 +1000 Subject: [PATCH 17/20] add box-wg secret --- hosts/box/default.nix | 14 +++++++------- secrets/box-wg.age | 8 ++++++++ secrets/secrets.nix | 2 +- 3 files changed, 16 insertions(+), 8 deletions(-) create mode 100644 secrets/box-wg.age diff --git a/hosts/box/default.nix b/hosts/box/default.nix index b8e8792d..c4c6f2ee 100644 --- a/hosts/box/default.nix +++ b/hosts/box/default.nix @@ -33,11 +33,11 @@ # syncthing }; - #age.secrets.box-wg.file = "${self}/secrets/curve-wg.age"; - #age.secrets.box-wg.owner = "anish"; - #mossnet.wg = { - # enable = true; - # ips = [ "10.0.69.4/24" ]; - # privateKeyFile = "/run/agenix/box-wg"; - #}; + age.secrets.box-wg.file = "${self}/secrets/box-wg.age"; + age.secrets.box-wg.owner = "anish"; + mossnet.wg = { + enable = true; + ips = [ "10.0.69.4/24" ]; + privateKeyFile = "/run/agenix/box-wg"; + }; } diff --git a/secrets/box-wg.age b/secrets/box-wg.age new file mode 100644 index 00000000..51508c37 --- /dev/null +++ b/secrets/box-wg.age @@ -0,0 +1,8 @@ +age-encryption.org/v1 +-> ssh-ed25519 K2vF/Q Vbe7tvR9OtiY6YCfCAwkV9L/wlKd4h+stYnZu3aCSC4 +U5V2qDLFNrY4SQn9aZZyNtsfXpae8eqo6JH66gbKwdg +-> %!/-grease ErIq e d{ZU +vKMMQJKGGb1YCU3Jn6xq5JTLoGYgC+X58WVxjpHYF126aDBN0NOYxYqDJFRQGe5S +7wuRgDPn +--- QE25f0fQlnz4v6ei4OczAW9BpqOvnkwdc7re508d4A4 +z@fE/_`)YVhc~w'F1iEޖU(3xtPZ; 3g[a6a0aU0 \ No newline at end of file diff --git a/secrets/secrets.nix b/secrets/secrets.nix index 9ac323cf..1685d2d0 100644 --- a/secrets/secrets.nix +++ b/secrets/secrets.nix @@ -11,7 +11,7 @@ in "fastmail.age".publicKeys = allKeys; "mossnet.age".publicKeys = allKeys; "curve-wg.age".publicKeys = curve; - # "box-wg.age".publicKeys = [ mossnet ]; + "box-wg.age".publicKeys = [ mossnet ]; # "wallabag.age".publicKeys = [ mossnet ]; "borg-password.age".publicKeys = systemOnly; } From 2f2f9d2c916dbc0dda9489a1f55df1546b06fa8d Mon Sep 17 00:00:00 2001 From: Anish L Date: Tue, 14 Jun 2022 18:03:01 +1000 Subject: [PATCH 18/20] working grafana again changed to wireguard module for box --- flake.nix | 2 +- profiles/monitoring/default.nix | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/flake.nix b/flake.nix index 75f0a2fc..b3968ed0 100644 --- a/flake.nix +++ b/flake.nix @@ -123,7 +123,7 @@ suites = with profiles; rec { base = [ core users.root users.anish ]; sealight = [ base server ]; # matrix rsshub backup wireguard-server - mossnet = [ base server taskd wireguard-box shaarli wallabag dns monitoring nfs rss-bridge gonic headphones radicale ]; # hpi syncthing + mossnet = [ base server taskd shaarli wallabag dns monitoring nfs rss-bridge gonic headphones radicale ]; # hpi syncthing cube = [ base site server ]; # backup graphical = [ base bluetooth music sync wifi desktop ]; curve = [ graphical secrets ]; # backup? diff --git a/profiles/monitoring/default.nix b/profiles/monitoring/default.nix index cdf568de..c652a5ab 100644 --- a/profiles/monitoring/default.nix +++ b/profiles/monitoring/default.nix @@ -8,11 +8,11 @@ }; # nginx reverse proxy + services.nginx.recommendedProxySettings = true; # Needed for new grafana versions services.nginx.virtualHosts.${config.services.grafana.domain} = { locations."/" = { proxyPass = "http://127.0.0.1:${toString config.services.grafana.port}"; proxyWebsockets = true; - extraConfig = "proxy_set_header Host $http_host"; }; }; From 438bb4b8a7d28695c48f742575c13a15cfc6ae3c Mon Sep 17 00:00:00 2001 From: Anish L Date: Tue, 14 Jun 2022 23:27:01 +1000 Subject: [PATCH 19/20] fix: kitaab sync --- profiles/sync/default.nix | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) diff --git a/profiles/sync/default.nix b/profiles/sync/default.nix index a689e571..7a3da959 100644 --- a/profiles/sync/default.nix +++ b/profiles/sync/default.nix @@ -5,16 +5,22 @@ serviceConfig.Type = "oneshot"; path = [ pkgs.git + pkgs.coreutils ]; script = '' - ${pkgs.coreutils}/bin/cd /home/anish/kitaab/vimwiki - ${pkgs.git} commit -am "syncing curve" - ${pkgs.git} push + cd /home/anish/kitaab + git add -A + git diff-index --quiet HEAD || git commit -m 'syncing kitaab' # if nothing, don't exit 1 + git push + exit 0 ''; + serviceConfig = { + User = "anish"; + }; }; systemd.timers.kitaab-timer = { wantedBy = [ "timers.target" ]; partOf = [ "kitaab-sync.service" ]; - timerConfig.OnCalendar = [ "*-*-* *:00:00" ]; + timerConfig.OnCalendar = [ "daily" ]; }; } From 59e270033623cb34aef3ae2ffdc6609addd515ba Mon Sep 17 00:00:00 2001 From: Anish L Date: Tue, 14 Jun 2022 23:27:12 +1000 Subject: [PATCH 20/20] clean up get-music, needs to be in it's own proflie --- profiles/sync/get-music.nix | 20 ++++++++++++++------ 1 file changed, 14 insertions(+), 6 deletions(-) diff --git a/profiles/sync/get-music.nix b/profiles/sync/get-music.nix index 721696ec..4c070e43 100644 --- a/profiles/sync/get-music.nix +++ b/profiles/sync/get-music.nix @@ -1,12 +1,20 @@ { pkgs, lib, ... }: { - services.cron = { - enable = true; - systemCronJobs = [ - "* */24 * * * * anish /etc/get-music.sh" + systemd.services.get-music-sync = { + serviceConfig.Type = "oneshot"; + path = [ + pkgs.coreutils + pkgs.rsync ]; + script = builtins.readFile ./get-music.sh; + serviceConfig = { + User = "anish"; + }; + }; + systemd.timers.get-music-timer = { + wantedBy = [ "timers.target" ]; + partOf = [ "get-music-sync.service" ]; + timerConfig.OnCalendar = [ "daily" ]; }; - environment.etc."get-music.sh".text = builtins.readFile "./get-music.sh"; - evironment.systemPackages = [ pkgs.rsync ]; }