Merge branch 'devos' of git.sealight.xyz:aynish/nix-garden into devos

flake.nix

@@ -122,10 +122,10 @@
             };
             suites = with profiles; rec {
               base = [ core users.root users.anish ];
-              sealight = [ base server ]; # matrix rsshub backup wireguard
+              sealight = [ base server ]; # matrix rsshub backup wireguard-server
-              mossnet = [ base server taskd wireguard-box shaarli wallabag dns backup monitoring nfs rss-bridge gonic headphones radicale ]; # hpi syncthing
+              mossnet = [ base server taskd shaarli wallabag dns monitoring nfs rss-bridge gonic headphones radicale ]; # hpi syncthing
               cube = [ base site server ]; # backup
-              graphical = [ base bluetooth music sync wireguard wifi desktop ];
+              graphical = [ base bluetooth music sync wifi desktop ];
               curve = [ graphical secrets ]; # backup?
               work = [ base ];
             };

hosts/box/default.nix

@@ -1,4 +1,4 @@
-{ profiles, suites, ... }:
+{ self, profiles, suites, ... }:
 {
   imports = [
     ./configuration.nix
@@ -12,4 +12,32 @@
   services."grasp".enable = true;
   services."grasp".path = "/home/anish/kitaab/grasp";
   services."grasp".user = "anish";
+
+  # Backups
+  age.secrets.borg-password.file = "${self}/secrets/borg-password.age";
+  services.postgresqlBackup = {
+    enable = true;
+    databases = [ "wallabag" ];
+    location = "/var/backup/postgresql";
+  };
+  mossnet.backup = {
+    enable = true;
+    name = "mossnet";
+    paths = [
+      "/var/lib/taskserver" # taskwarrior
+      "/var/www/shaarli-config" # sharli
+      "/var/backup/postgresql" # wallabag
+      "/var/lib/radicale" # radicale
+    ];
+    # seafile?
+    # syncthing
+  };
+
+  age.secrets.box-wg.file = "${self}/secrets/box-wg.age";
+  age.secrets.box-wg.owner = "anish";
+  mossnet.wg = {
+    enable = true;
+    ips = [ "10.0.69.4/24" ];
+    privateKeyFile = "/run/agenix/box-wg";
+  };
 }

hosts/curve/default.nix

@@ -1,4 +1,4 @@
-{ profiles, suites, ... }:
+{ self, profiles, suites, ... }:
 {
   imports = [
     ./configuration.nix
@@ -28,15 +28,26 @@
 
   boot.supportedFilesystems = [ "ntfs" ];
 
+  age.secrets.curve-wg.file = "${self}/secrets/curve-wg.age";
+  age.secrets.curve-wg.owner = "anish";
+  mossnet.wg = {
+    enable = true;
+    ips = [ "10.0.69.2/24" ];
+    privateKeyFile = "/run/agenix/curve-wg";
+  };
+
+  age.secrets.borg-password.file = "${self}/secrets/borg-password.age";
+  mossnet.backup = {
+    enable = true;
+    name = "curve";
+    paths = [ "/home/anish" ];
+  };
+
   # enable adb 
   # TODO move this (it's for KaiOS WebIDE devShell?)
   programs.adb.enable = true;
   #virtualisation.docker.enable = true;
   services.udev.extraRules = ''
-        # Monitor plugged in
-        # Doesn't work, becuase /home/anish/bin/hotplug-monitor isn't part of the nix build
-        # KERNEL=="card0", SUBSYSTEM=="drm", ENV{DISPLAY}=":0", ENV{XAUTHORITY}="/home/anish/.Xauthority", RUN+="/home/anish/bin/hotplug-monitor.sh" # TODO: add this file to nix home-manager
-
     # Qualcomm EDL
     SUBSYSTEMS=="usb", ATTRS{idVendor}=="05c6", ATTRS{idProduct}=="9008", MODE="0666", GROUP="plugdev"
 

modules/backup.nix

@@ -0,0 +1,53 @@
+# TODO: 
+# This currently works on a per host basis, and the host file has to define all the locations it wants to back up.
+# Ideally, this would create a job for each profile instead, so the backup strategy is included in the profile regardless of host
+{ config, lib, pkgs, ... }:
+with lib;
+let
+  cfg = config.mossnet.backup;
+in
+{
+  options = {
+    mossnet.backup = {
+      enable = mkEnableOption "Backup module using borg for Anish's computer nursery";
+      name = lib.mkOption {
+        type = types.str;
+        default = { };
+        example = literalExample ''
+          mossnet
+        '';
+        description = ''
+          name for the backup operator
+        '';
+      };
+      paths = lib.mkOption {
+        type = with types; listOf str;
+        default = { };
+        example = literalExample ''
+          [ "/home/anish/usr" ];
+        '';
+        description = ''
+          A list of folders to backup
+        '';
+      };
+    };
+  };
+
+  config = mkIf cfg.enable {
+    services.borgbackup.jobs = {
+      "${cfg.name}" = {
+        paths = cfg.paths;
+        doInit = true;
+        repo = "20779@hk-s020.rsync.net:${cfg.name}";
+        encryption = {
+          mode = "repokey-blake2";
+          passCommand = "cat /run/agenix/borg-password";
+        };
+        environment = { BORG_RSH = "ssh -i /root/borg/borg-key"; }; # YOU NEED TO PUT THIS HERE MANUALLY
+        compression = "auto,lzma";
+        startAt = "daily";
+        extraArgs = "--remote-path=borg1";
+      };
+    };
+  };
+}

modules/wireguard.nix

@@ -0,0 +1,54 @@
+{ config, lib, pkgs, ... }:
+with lib;
+let
+  cfg = config.mossnet.wg;
+in
+{
+  options = {
+    mossnet.wg = {
+      enable = mkEnableOption "Gain access to all mossnet systems through wireguard";
+      ips = lib.mkOption {
+        type = with types; listOf str;
+        default = { };
+        example = literalExample ''
+          [ "10.0.69.2/24" ];
+        '';
+        description = ''
+          The IP this machine is allowed to connect to
+        '';
+      };
+      privateKeyFile = lib.mkOption {
+        type = types.path;
+        default = { };
+        example = literalExample ''
+          /run/agenix/wg-curve
+        '';
+        description = ''
+          The private ssh key file to use to connect!
+          Remember set age.secrets.*.file and age.secrets.*.user
+        '';
+      };
+    };
+  };
+  config = mkIf cfg.enable {
+    networking.firewall.allowedUDPPorts = [ 60990 ];
+    networking.wireguard.interfaces = {
+      wg0 = {
+        ips = cfg.ips;
+        listenPort = 60990; # to match firewall allowedUDPPorts (without this wg uses random port numbers)
+
+        privateKeyFile = cfg.privateKeyFile;
+        peers = [
+          # For a client configuration, one peer entry for the server will suffice.
+          {
+            publicKey = "c1J4p63rD3IlszugMZiki7UBV3YmDdqa3DU4UejXzAI=";
+            allowedIPs = [ "10.0.69.0/24" ];
+            # Set this to the server IP and port.
+            endpoint = "149.28.163.78:60990"; # ToDo: route to endpoint not automatically configured https://wiki.archlinux.org/index.php/WireGuard#Loop_routing https://discourse.nixos.org/t/solved-minimal-firewall-setup-for-wireguard-client/7577
+            persistentKeepalive = 25;
+          }
+        ];
+      };
+    };
+  };
+}

profiles/backup/default.nix

@@ -1,34 +1 @@
-{
+{ }
-  # Assumes the remote borg backup server has already been initialized
-  # borg init --encryption-key=repokey-blake2 -rsh 'ssh -i /run/keys/id_ed25519_borgbase' 20779@hk-s020.rsync.net:<borg-archive>
-  services.borgbackup.jobs = {
-    backupTaskwarriorRsync = {
-      paths = [ "/var/lib/taskserver" ];
-      doInit = true;
-      repo = "20779@hk-s020.rsync.net:taskwarrior";
-      encryption = {
-        mode = "repokey-blake2";
-        passCommand = "cat /run/keys/rsync";
-      };
-      environment = { BORG_RSH = "ssh -i /run/keys/id_ed25519_borgbase"; };
-      compression = "auto,lzma";
-      startAt = "weekly";
-      extraArgs = "--remote-path=borg1";
-    };
-  };
-  services.borgbackup.jobs = {
-    backupShaarliRsync = {
-      paths = [ "/var/www/shaarli-config/data/datastore.php" "/var/www/shaarli-config/config" "/var/www/shaarli-config/.json.config" ];
-      doInit = true;
-      repo = "20779@hk-s020.rsync.net:shaarli";
-      encryption = {
-        mode = "repokey-blake2";
-        passCommand = "cat /run/keys/rsync";
-      };
-      environment = { BORG_RSH = "ssh -i /run/keys/id_ed25519_borgbase"; };
-      compression = "auto,lzma";
-      startAt = "weekly";
-      extraArgs = "--remote-path=borg1";
-    };
-  };
-}

profiles/monitoring/default.nix

@@ -8,6 +8,7 @@
   };
 
   # nginx reverse proxy
+  services.nginx.recommendedProxySettings = true; # Needed for new grafana versions 
   services.nginx.virtualHosts.${config.services.grafana.domain} = {
     locations."/" = {
       proxyPass = "http://127.0.0.1:${toString config.services.grafana.port}";

profiles/radicale/default.nix

@@ -7,5 +7,18 @@
       server.hosts = [ "0.0.0.0:5252" ];
     };
   };
+
   networking.firewall.allowedTCPPorts = [ 5252 ];
+
+  services.nginx.virtualHosts."cal.mossnet.lan" = {
+    enableACME = false;
+    forceSSL = false;
+
+    locations."/" = {
+      extraConfig = ''
+        proxy_pass http://localhost:5252/;
+        proxy_set_header X-Forwarded-Host $host;
+      '';
+    };
+  };
 }

profiles/secrets/default.nix

@@ -1,9 +1,9 @@
-{ pkgs, config, lib, ... }:
+{ self, pkgs, config, lib, ... }:
 {
   # Secrets used by home-manager modules 
-  age.secrets.fastmail.file = "/etc/nixos/secrets/fastmail.age";
+  age.secrets.fastmail.file = "${self}/secrets/fastmail.age";
   age.secrets.fastmail.owner = "anish";
 
-  age.secrets.mossnet.file = "/etc/nixos/secrets/mossnet.age";
+  age.secrets.mossnet.file = "${self}/secrets/mossnet.age";
   age.secrets.mossnet.owner = "anish";
 }

profiles/sync/default.nix

@@ -5,16 +5,22 @@
     serviceConfig.Type = "oneshot";
     path = [
       pkgs.git
+      pkgs.coreutils
     ];
     script = ''
-      ${pkgs.coreutils}/bin/cd /home/anish/kitaab/vimwiki
+      cd /home/anish/kitaab
-      ${pkgs.git} commit -am "syncing curve"
+      git add -A
-      ${pkgs.git} push
+      git diff-index --quiet HEAD || git commit -m 'syncing kitaab' # if nothing, don't exit 1
+      git push
+      exit 0
     '';
+    serviceConfig = {
+      User = "anish";
+    };
   };
   systemd.timers.kitaab-timer = {
     wantedBy = [ "timers.target" ];
     partOf = [ "kitaab-sync.service" ];
-    timerConfig.OnCalendar = [ "*-*-* *:00:00" ];
+    timerConfig.OnCalendar = [ "daily" ];
   };
 }

profiles/sync/get-music.nix

@@ -1,12 +1,20 @@
 { pkgs, lib, ... }:
 
 {
-  services.cron = {
+  systemd.services.get-music-sync = {
-    enable = true;
+    serviceConfig.Type = "oneshot";
-    systemCronJobs = [
+    path = [
-      "* */24 * * * *     anish     /etc/get-music.sh"
+      pkgs.coreutils
+      pkgs.rsync
     ];
+    script = builtins.readFile ./get-music.sh;
+    serviceConfig = {
+      User = "anish";
+    };
+  };
+  systemd.timers.get-music-timer = {
+    wantedBy = [ "timers.target" ];
+    partOf = [ "get-music-sync.service" ];
+    timerConfig.OnCalendar = [ "daily" ];
   };
-  environment.etc."get-music.sh".text = builtins.readFile "./get-music.sh";
-  evironment.systemPackages = [ pkgs.rsync ];
 }

secrets/box-wg.age

@@ -0,0 +1,8 @@
+age-encryption.org/v1
+-> ssh-ed25519 K2vF/Q Vbe7tvR9OtiY6YCfCAwkV9L/wlKd4h+stYnZu3aCSC4
+U5V2qDLFNrY4SQn9aZZyNtsfXpae8eqo6JH66gbKwdg
+-> %!/-grease ErIq e d{ZU
+vKMMQJKGGb1YCU3Jn6xq5JTLoGYgC+X58WVxjpHYF126aDBN0NOYxYqDJFRQGe5S
+7wuRgDPn
+--- QE25f0fQlnz4v6ei4OczAW9BpqOvnkwdc7re508d4A4
+z@ÒÆfóE/_`)ÞYVh²þûc¥~‰Žü½ïw¨Î
ËÙ'ØF1i½êEÞ–ëU(3xt¼®PáZ¦ˆž;Í
3g‡[a6a0aU0

secrets/curve-wg.age

@@ -1,10 +1,13 @@
 age-encryption.org/v1
--> ssh-ed25519 E8y8hg ajjA98JsX1JBHd/6pPoTLCrMdkmgnviOZFTWUMtKfzk
+-> ssh-ed25519 E8y8hg hedyIPcLQGc3KmKFzhVWU/zHcattXe4oRGo8wY/TV3s
-+ekDAlEfkZ9G6oYfek6kBu0z1jbfQDQfH2ukwk4pvNU
+wXjPQaUnxci/pQKoNXMm7/yhXZ8Ec69w/3bJOxkiXws
--> ssh-ed25519 AiezdQ sZNx8/7RVk9XLvwxrbxjYb3q6uB8ny/DxktST7HMQSk
+-> ssh-ed25519 AiezdQ lb8Hwsl8FDk/CExAVqMS0w20MJq5GKUm0NkE5O7k/is
-EdEXGSPGJ9j52llednOb8ViK3a+C+ru1weF7wOL3Lzk
+aspWW5q6YpXKIvkIzFIPdPFp7/oRgrE/cpqtis5BASY
--> B~GRUs-grease v) >0EI 7cA9 m&8
+-> ssh-ed25519 K2vF/Q qw5EytbSJskHAcuKFbqZyvut5iJomIRMwgxFohvJBQo
-iYaE+kBtuRHNi7zc9xtWYnNs6ThyHNvSPYnY1SYsugftuao1wkXyFvRrd8wubj1k
+GkHaGU3BnBX2BCZ2eF8X1whFmQTKueXvOqC08UggQWU
-Y4e50A
+-> z-grease
---- GAVr4RrSEgBxdamubXJNhRPXOeXccN7Nw5GqGLPwdWI
+h8wf5RrYDiHoC5CuvGmL6xeol9K2o24A7WAky8qrmKWgjzlhR7IcitQ4AX9teOec
-7Ž“x»¬â•¥$Š¹ú-¢*û^µ;§°<C2A7>~´é
ÐNŠ{úXá=ZªÙ¦}¯Fð¯Û¼µñ󖼇Åó‹<C3B3>fÞ•ˆÇ<7F>c
+9wsfVkTBgbc
+--- +l7lATgPTYXuOOCaTYEOVMGxW0Ryaj5RAYaAVT/zIQE
+fØ‘ËEé¢ÿxP©²
×?s“€®‡¾’dP<64>B‰g™­œ¨*¨€úÞø¦|d˜°nb¼9ýPÚå
+âHÅš}™-)¸Þ$5W

secrets/mossnet.age

@@ -1,9 +1,12 @@
 age-encryption.org/v1
--> ssh-ed25519 E8y8hg zUl7tdxWGLDPiv9cX9/vTITX+H+rqgVSZ77YFZUQzBQ
+-> ssh-ed25519 E8y8hg g7zZHmh04X43ZguiRhdjeZ2BtBsT3o8qhSntPxDzd0k
-ZW9d2bKCo969jT1HWKw8tPSlYJpjm8T7mbcztPVWdyA
+6Cwi06GFH36g44rbkIK1rLxkXFJ5yWLpMsvl3xzFSY8
--> ssh-ed25519 AiezdQ Gb5IB4nHlyBsjIgt52/BL7lcWZFEWly26HND0I/Q824
+-> ssh-ed25519 AiezdQ tpn28KlGD2vaeS+3tsaxjhXfcMMNMgsZbQE9YySup3w
-VyTx5jzEhsekC87qejQsfJGcHNlt0VghloDT+AVo9rQ
+TbfWuW62lYWkp0xnrrzbdMzNJ+jNn+5tMCZEz4GdTVs
--> Nbgn:*-grease
+-> ssh-ed25519 K2vF/Q 7SQse/JhNP09k7xtyjw1Y2mnhFH5bmaXjqWrpxO5Bxg
-5IfKwbqa8Yrv5zz2Vcy98A
+aKV2EN0a8t6NS+88eAG9+bu6+sFd9/Rc4nNoR0os9X0
---- D26v86VajBn6V2Go1nnNdBBwe7K+rLiVw5MVvAob/dk
+-> xjS>-grease *{_
-Ò<EFBFBD>@™=s`Ð6¼2ïZã‡ÈÞ‚€ŸÁO:Õ¼í30r«S©éÌüó€o•=Ã] 
+fOiZzBai7fC+jxV7RH8bKLx05h+UVmCR51CGMaAAsIyHivI+hb2M3lDfWdn0shZQ
+byznwCva3kNQwG3m4MYgk6J4/QiasZGF0O+QoA
+--- gEmFFhuHpKOP74G/65xuCK0EA3ERvF78q8eVTMlmkOY
+ﾊ旆d･D3ｴｯｸ<EFBFBD>┌-罰ﾂ\<5C>BS|<7C>|9<><39>S頚@/ZﾔUdR"ｻ<>

secrets/secrets.nix

@@ -3,12 +3,15 @@ let
   user = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIItTdCyYVur6LzRQf08JZUcEAr23H7fTRRmDJOzoOc6A anish@curve";
   system = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIMPcqWQ/L5nLTsBFHArl3AJb9xynhfsKenb5h0NNuMV root@curve";
   mossnet = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAA0bsVbdQR6iWNLKIiID57A1+dVXC58Dtf5cSXg6/JF root@box";
-  allKeys = [ system user ];
+  curve = [ system user ];
+  allKeys = [ system user mossnet ];
+  systemOnly = [ system mossnet ];
 in
 {
   "fastmail.age".publicKeys = allKeys;
   "mossnet.age".publicKeys = allKeys;
-  "curve-wg.age".publicKeys = allKeys;
+  "curve-wg.age".publicKeys = curve;
-  #"nextcloud-db.age".publicKeys = mossnet;
+  "box-wg.age".publicKeys = [ mossnet ];
-  #"nextcloud-admin.age".publicKeys = mossnet;
+  # "wallabag.age".publicKeys = [ mossnet ];
+  "borg-password.age".publicKeys = systemOnly;
 }