diff --git a/nixos/.sops.yaml b/nixos/.sops.yaml index c6dad7f..0609d7f 100644 --- a/nixos/.sops.yaml +++ b/nixos/.sops.yaml @@ -1,7 +1,7 @@ keys: hosts: - &laptop age1ldgnl53dmvl4fjz6hgdj0cvensagddn3ltpmxfm72m8q273w75fsk42p8v - - &nixos-homelab-00 age19sx89g6rs9hnrhkujf5uk2zrkj5d4l3gh33gzwau7v7z2249qq4sw47et8 + - &nixos-homelab-00 age177wwag0rmyejqm37l748tuup5lvdslaza6kjkrjhdfce2drajscqn6cmru creation_rules: - path_regex: secrets/[^/]+\.(yaml|json|env|ini)$ key_groups: @@ -30,3 +30,7 @@ creation_rules: - *nixos-homelab-00 - *nixos-homelab-00 - *nixos-homelab-00 + - *nixos-homelab-00 + - *nixos-homelab-00 + - *nixos-homelab-00 + - *nixos-homelab-00 diff --git a/nixos/bootstrap.sh b/nixos/bootstrap.sh index 618e258..073cb86 100755 --- a/nixos/bootstrap.sh +++ b/nixos/bootstrap.sh @@ -154,11 +154,6 @@ fi # delete known hosts sed -i "/$target_hostname/d; /$target_destination/d" ~/.ssh/known_hosts -# create directory that will be used to store the users ssh keys -# (Not sure if it's necessary, but I want the directory to exist before it's symlinked as declared in the configuration.nix file) -install -d -m755 "$temp/persist/$target_administrator/.ssh" -install -d -m755 "$temp/persist/$target_administrator/rp" - # Create the directory where sshd expects to find the host keys install -d -m755 "$temp/persist/etc/ssh" diff --git a/nixos/configuration.nix b/nixos/configuration.nix index c5886e0..e99d1cf 100644 --- a/nixos/configuration.nix +++ b/nixos/configuration.nix @@ -65,7 +65,7 @@ # Declare test service manually services.tests-service = { enable = true; - # port = 8080; + port = 8080; default-nginx = { enable = true; hostname = "test.roypository.com"; @@ -153,10 +153,12 @@ }; # Symlink the user directories that need to be persisted (ssh key/repository folder) - systemd.tmpfiles.rules = [ - "L /home/sysAdmin/.ssh/ - - - - /persist/home/sysAdmin/.ssh" - "L /home/sysAdmin/rp/ - - - - /persist/home/sysAdmin/rp" - ]; + environment.persistence."/persist" = { + users.sysAdmin.directories = [ + ".ssh" + "rp" + ]; + }; users.users.root = { hashedPassword = "$y$j9T$IjaP0KIfdpEvlLtOn.u0T/$0MJDaFEdSu6zSJ04CF1dtorD6IVgbN3vmDiiwGwwqr5"; diff --git a/nixos/flake.lock b/nixos/flake.lock index e5a093f..7c468db 100644 --- a/nixos/flake.lock +++ b/nixos/flake.lock @@ -7,11 +7,11 @@ ] }, "locked": { - "lastModified": 1748832438, - "narHash": "sha256-/CtyLVfNaFP7PrOPrTEuGOJBIhcBKVQ91KiEbtXJi0A=", + "lastModified": 1749089136, + "narHash": "sha256-A1UgwtAEQYd38Z6VoRAiGs4jZQczAGyP5DF3hhYUdpg=", "owner": "nix-community", "repo": "disko", - "rev": "58d6e5a83fff9982d57e0a0a994d4e5c0af441e4", + "rev": "a4f7deb49f7336feb6c5abaf213b374936421dbe", "type": "github" }, "original": { @@ -110,11 +110,11 @@ }, "nixpkgs": { "locked": { - "lastModified": 1748421225, - "narHash": "sha256-XXILOc80tvlvEQgYpYFnze8MkQQmp3eQxFbTzb3m/R0=", + "lastModified": 1748995628, + "narHash": "sha256-bFufQGSAEYQgjtc4wMrobS5HWN0hDP+ZX+zthYcml9U=", "owner": "NixOS", "repo": "nixpkgs", - "rev": "78add7b7abb61689e34fc23070a8f55e1d26185b", + "rev": "8eb3b6a2366a7095939cd22f0dc0e9991313294b", "type": "github" }, "original": { @@ -164,11 +164,11 @@ "systems": "systems_2" }, "locked": { - "lastModified": 1748884506, - "narHash": "sha256-P/ldKE0SCGKH6pEVJoW2MJJo2dZCZe10d/h1ree66c0=", + "lastModified": 1749107808, + "narHash": "sha256-ohLHvWmAuH4aHOCAGP1UlwRRxX21/eW+N2e7eB0kQeo=", "owner": "nix-community", "repo": "nixvim", - "rev": "d063d0dd5e0b82d8be4dd4bc00b887ac1f92e4b2", + "rev": "635a9e770f77a7c586c60f84b1debf054318034a", "type": "github" }, "original": { @@ -281,11 +281,11 @@ "nixpkgs": "nixpkgs_3" }, "locked": { - "lastModified": 1748908678, - "narHash": "sha256-spBZQ0D6IoO644uSI7x22vcou94CB73MFI7SFq2o0Ac=", + "lastModified": 1749140308, + "narHash": "sha256-qUdbbvRcnff4IcqvYB9lE6/R4w4QrMUtvc9iDJE2g3s=", "owner": "RoyDumblauskas", "repo": "tests-service", - "rev": "3174bee901f0309cd3d0b4a6491c297c9b8469ca", + "rev": "938de22060286391156f8d8533f8e7f7fa6b498b", "type": "github" }, "original": { diff --git a/nixos/flake.nix b/nixos/flake.nix index aa4a299..efd4d5e 100644 --- a/nixos/flake.nix +++ b/nixos/flake.nix @@ -17,6 +17,10 @@ url = "github:Mic92/sops-nix"; inputs.nixpkgs.follows = "nixpkgs"; }; + impermanence = { + url = "github:nix-community/impermanence"; + inputs.nixpkgs.follows = "nixpkgs"; + }; # This is a path to the services I've declared. # It just happens to be stored in the same repository (relative), # but could well be a separate repository @@ -25,7 +29,7 @@ }; }; - outputs = { self, nixpkgs, nixvim, home-manager, disko, sops-nix, quasiSecrets, tests-service }@inputs: + outputs = { self, nixpkgs, nixvim, home-manager, disko, sops-nix, quasiSecrets, impermanence, tests-service }@inputs: let nodes = [ { @@ -52,6 +56,7 @@ sops-nix.nixosModules.sops quasiSecrets.nixosModules.ipAddrs quasiSecrets.nixosModules.serviceList + impermanence.nixosModules.impermanence tests-service.nixosModules.default home-manager.nixosModules.home-manager { home-manager.useGlobalPkgs = true; diff --git a/nixos/secrets/build.json b/nixos/secrets/build.json index 8be5014..828600b 100644 --- a/nixos/secrets/build.json +++ b/nixos/secrets/build.json @@ -4,11 +4,11 @@ "age": [ { "recipient": "age1ldgnl53dmvl4fjz6hgdj0cvensagddn3ltpmxfm72m8q273w75fsk42p8v", - "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNbExuUVFsVDRmK0ZmSVNw\nMUhlZGhweTRQUmp0Q3N2SUh1Mmx5Q1JxSXlVCi9kQlhNNjF2d1M3Q0JwUTZ6WkJL\nbW40RGkzZFVJSUxBT0VLNU4yYjV6YjgKLS0tIGhhS2dNWXVZaXhjWjlaNkJsc0Fq\nWGNFeDBMY3IxNzVraWE3Q2pjWThxbGcKTxYNkf//IW24Cji5n47P5XvO3W0rtZ2c\nVI7vHn4BQiL6N75xtn8DUouBu78oPbhq/ltL1GSTPn2DObysmADFwQ==\n-----END AGE ENCRYPTED FILE-----\n" + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBVNkdjMER1TFB5MjRvWUxh\ncVRTRTNtV1ZuNUJjOFhGa2hYK0gwdTdVbEJjCjlDYkhDN1BEMHdjZStES2lyMUlF\nWTJZOTFFQUxYaDdSY0VUd2dFd3pBOHcKLS0tIFQzcm9aSzF6bklUWXJJTjcrRU1K\ndEpLY1RQNXN6YSszbUhzeGJPY3dXZW8KgOb1rFnqibwvtBdC55f2aVDIC3V33b6k\niIboCO/swiD7N3IF3imvaHdG9ILy5oIH9KJOCpl12RrLvhIlU/lp6Q==\n-----END AGE ENCRYPTED FILE-----\n" }, { - "recipient": "age19sx89g6rs9hnrhkujf5uk2zrkj5d4l3gh33gzwau7v7z2249qq4sw47et8", - "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBjK0x2UVBKSnVHOHYwZGRI\nSnJsUFJ4N29GbHl1RHZYMVcra1ZNczI1TlRJCnEwTDRoa3FEMEJKQUhoN3ZpcVVm\nbER6L1VxRlkxZ3EyN1pTNzVkbWNsTkEKLS0tIFhzWm1kN0czNitrbXlFOGdQNkxi\nV2lpOW9Id3Q2RlNpSWpiRVpldVNGZE0KMz7MZWp1pPwxidzzFGordBLdmQygDu9x\nAeMvZ75NYCiCvH7bn1C7j3mLNIQ/oJxXTP2ZXOy6w7HPItUdIqijaA==\n-----END AGE ENCRYPTED FILE-----\n" + "recipient": "age177wwag0rmyejqm37l748tuup5lvdslaza6kjkrjhdfce2drajscqn6cmru", + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2ekYzQWZtM25IUTl2OU5i\nS3lkdFpLNUluZGxZNlpja3FlYUpzTmlRUDE0CkVneURXcGE5Zm5pbHlHeXMzZGJD\nODdXU25XTk5oWW0zQnhhdlZqc2pKNE0KLS0tIFNmOWdza3FYWUl0VTZlemFHUTd2\nRXRtOEpIZGwzOTBUSURWQVEwcHZXd2sKhqH+YCXCH/mplhUYxGOWz6S3ha+AJWqR\nEtdnr2XK6V8a1OmdMBtoYdym72S7W30TksoW6I+bYNP9lW74GgbuFw==\n-----END AGE ENCRYPTED FILE-----\n" } ], "lastmodified": "2025-04-17T15:26:55Z", diff --git a/nixos/secrets/cloudflare.json b/nixos/secrets/cloudflare.json index 3b46c1c..9481356 100644 --- a/nixos/secrets/cloudflare.json +++ b/nixos/secrets/cloudflare.json @@ -5,11 +5,11 @@ "age": [ { "recipient": "age1ldgnl53dmvl4fjz6hgdj0cvensagddn3ltpmxfm72m8q273w75fsk42p8v", - "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA0T0o1Rktqa0w1MnNoa1Jr\nak83UGVLbkZDdGpYeDNCMXlNOWp2NHphR1dJCnFWLzUwck8yWE9jWVNJSVpNQTFY\nREZSM0lRM2lwSWxPdU50a1AzbTVuYnMKLS0tIEFScjN0M1EyRGMvZHlVQ1YvcXNa\ndnMzejQ2dnVmZDR6NWVjaGwxVjkrWDAKuNowznQhA59a9/d0A1w3xO/tZBRNxtZ0\nFAaxKLsL7WxvGYvX+AF0iAb/8mYYcDWhgTf49CbZNlGgaDd/0GU8/Q==\n-----END AGE ENCRYPTED FILE-----\n" + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqdk03R0xaZ090aER1Wldt\nRGVGMFFMZG90TVovVjJoWm9ONU1VaDdQS0ZnCitKcUhkV0VzODVKUkNxNU1rVXJk\nK1BwV1piVlo0Q0lTbUVTUlhDUGVZK28KLS0tIGRYeVUza2JRNE0vZzZsMTg4akJo\nMlBSNVNUZTBObDB3N0pTYXhtQWgydG8KTQs4V0VjUFWl6pUk4Po/03dxE+ANpXJb\nd8k1n39aqNa7WQdoEe6zUQlPhaGHUszj8bIbdv46GiVADCJGJXs+Wg==\n-----END AGE ENCRYPTED FILE-----\n" }, { - "recipient": "age19sx89g6rs9hnrhkujf5uk2zrkj5d4l3gh33gzwau7v7z2249qq4sw47et8", - "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBuVHoydjZ6Y2JpYklKT1Qz\nN2JWLzA3QW9rMlZGV1k0eFQzUzlINTV5NFZVCk5wbmVxdEtNR3FkYnAvYzhPVkRL\nQXRsZmFFWUZYRXcrSDA0UVhnUXowOTgKLS0tIFp4c1pxSzZMYTRycG96WjUxcmJp\najBtQmx6bW9iWSs3RGY4ci9pYzdnUjAKkN7qRqpRkJVER50NvrYQ/AjXO6OQ00xx\nJA+wjUdISdZBuEMdgJLiKudO3ejWt1w6JCPbVdbllBHJ4pzEHoIKjQ==\n-----END AGE ENCRYPTED FILE-----\n" + "recipient": "age177wwag0rmyejqm37l748tuup5lvdslaza6kjkrjhdfce2drajscqn6cmru", + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBxb1ova3FYUE1wVnU0anJN\nQ28rRzNpbFlJTW05c0xUeWMzZlFNUlRsblZvCktmMzRGU3dQSnhwbVY1NFBWVGpG\ndEJ0ODhFcXRzKzdSRGo4ZDRMeGtkQUUKLS0tIFNBSVJZbkR0ampWN3pDVERDanFD\nZndXUGYyM01UcHFzV0xzZm5rUnpHYU0Kfc7Fh6q7xV4OyjB3F+fjjt9XWizm/fnz\n4fCkO9t0ZUcb7YoBwpHdZ3Ex7Xkey8URF2Tcv0/gWF0XyaJ0rOQvxA==\n-----END AGE ENCRYPTED FILE-----\n" } ], "lastmodified": "2025-04-28T04:15:19Z",