RoyDumblauskas/homelab-config
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

add impermanence for user dirs

Browse Source
This commit is contained in:
RoyDumblauskas
2025-06-05 12:00:56 -05:00
parent a3b497aa46
commit cd5450a936
7 changed files with 36 additions and 30 deletions
Download Patch File Download Diff File Expand all files Collapse all files
nixos/.sops.yaml
+5 -1
View File
@@ -1,7 +1,7 @@
keys: keys:
hosts: hosts:
- &laptop age1ldgnl53dmvl4fjz6hgdj0cvensagddn3ltpmxfm72m8q273w75fsk42p8v - &laptop age1ldgnl53dmvl4fjz6hgdj0cvensagddn3ltpmxfm72m8q273w75fsk42p8v
- &nixos-homelab-00 age19sx89g6rs9hnrhkujf5uk2zrkj5d4l3gh33gzwau7v7z2249qq4sw47et8 - &nixos-homelab-00 age177wwag0rmyejqm37l748tuup5lvdslaza6kjkrjhdfce2drajscqn6cmru
creation_rules: creation_rules:
- path_regex: secrets/[^/]+\.(yaml|json|env|ini)$ - path_regex: secrets/[^/]+\.(yaml|json|env|ini)$
key_groups: key_groups:
@@ -30,3 +30,7 @@ creation_rules:
- *nixos-homelab-00 - *nixos-homelab-00
- *nixos-homelab-00 - *nixos-homelab-00
- *nixos-homelab-00 - *nixos-homelab-00
- *nixos-homelab-00
- *nixos-homelab-00
- *nixos-homelab-00
- *nixos-homelab-00
nixos/bootstrap.sh
-5
View File
@@ -154,11 +154,6 @@ fi
# delete known hosts # delete known hosts
sed -i "/$target_hostname/d; /$target_destination/d" ~/.ssh/known_hosts sed -i "/$target_hostname/d; /$target_destination/d" ~/.ssh/known_hosts
# create directory that will be used to store the users ssh keys
# (Not sure if it's necessary, but I want the directory to exist before it's symlinked as declared in the configuration.nix file)
install -d -m755 "$temp/persist/$target_administrator/.ssh"
install -d -m755 "$temp/persist/$target_administrator/rp"
# Create the directory where sshd expects to find the host keys # Create the directory where sshd expects to find the host keys
install -d -m755 "$temp/persist/etc/ssh" install -d -m755 "$temp/persist/etc/ssh"
nixos/configuration.nix
+7 -5
View File
@@ -65,7 +65,7 @@
# Declare test service manually # Declare test service manually
services.tests-service = { services.tests-service = {
enable = true; enable = true;
# port = 8080; port = 8080;
default-nginx = { default-nginx = {
enable = true; enable = true;
hostname = "test.roypository.com"; hostname = "test.roypository.com";
@@ -153,10 +153,12 @@
}; };
# Symlink the user directories that need to be persisted (ssh key/repository folder) # Symlink the user directories that need to be persisted (ssh key/repository folder)
systemd.tmpfiles.rules = [ environment.persistence."/persist" = {
"L /home/sysAdmin/.ssh/ - - - - /persist/home/sysAdmin/.ssh" users.sysAdmin.directories = [
"L /home/sysAdmin/rp/ - - - - /persist/home/sysAdmin/rp" ".ssh"
]; "rp"
];
};
users.users.root = { users.users.root = {
hashedPassword = "$y$j9T$IjaP0KIfdpEvlLtOn.u0T/$0MJDaFEdSu6zSJ04CF1dtorD6IVgbN3vmDiiwGwwqr5"; hashedPassword = "$y$j9T$IjaP0KIfdpEvlLtOn.u0T/$0MJDaFEdSu6zSJ04CF1dtorD6IVgbN3vmDiiwGwwqr5";
nixos/flake.lock
Generated
+12 -12
View File
@@ -7,11 +7,11 @@
] ]
}, },
"locked": { "locked": {
"lastModified": 1748832438, "lastModified": 1749089136,
"narHash": "sha256-/CtyLVfNaFP7PrOPrTEuGOJBIhcBKVQ91KiEbtXJi0A=", "narHash": "sha256-A1UgwtAEQYd38Z6VoRAiGs4jZQczAGyP5DF3hhYUdpg=",
"owner": "nix-community", "owner": "nix-community",
"repo": "disko", "repo": "disko",
"rev": "58d6e5a83fff9982d57e0a0a994d4e5c0af441e4", "rev": "a4f7deb49f7336feb6c5abaf213b374936421dbe",
"type": "github" "type": "github"
}, },
"original": { "original": {
@@ -110,11 +110,11 @@
}, },
"nixpkgs": { "nixpkgs": {
"locked": { "locked": {
"lastModified": 1748421225, "lastModified": 1748995628,
"narHash": "sha256-XXILOc80tvlvEQgYpYFnze8MkQQmp3eQxFbTzb3m/R0=", "narHash": "sha256-bFufQGSAEYQgjtc4wMrobS5HWN0hDP+ZX+zthYcml9U=",
"owner": "NixOS", "owner": "NixOS",
"repo": "nixpkgs", "repo": "nixpkgs",
"rev": "78add7b7abb61689e34fc23070a8f55e1d26185b", "rev": "8eb3b6a2366a7095939cd22f0dc0e9991313294b",
"type": "github" "type": "github"
}, },
"original": { "original": {
@@ -164,11 +164,11 @@
"systems": "systems_2" "systems": "systems_2"
}, },
"locked": { "locked": {
"lastModified": 1748884506, "lastModified": 1749107808,
"narHash": "sha256-P/ldKE0SCGKH6pEVJoW2MJJo2dZCZe10d/h1ree66c0=", "narHash": "sha256-ohLHvWmAuH4aHOCAGP1UlwRRxX21/eW+N2e7eB0kQeo=",
"owner": "nix-community", "owner": "nix-community",
"repo": "nixvim", "repo": "nixvim",
"rev": "d063d0dd5e0b82d8be4dd4bc00b887ac1f92e4b2", "rev": "635a9e770f77a7c586c60f84b1debf054318034a",
"type": "github" "type": "github"
}, },
"original": { "original": {
@@ -281,11 +281,11 @@
"nixpkgs": "nixpkgs_3" "nixpkgs": "nixpkgs_3"
}, },
"locked": { "locked": {
"lastModified": 1748908678, "lastModified": 1749140308,
"narHash": "sha256-spBZQ0D6IoO644uSI7x22vcou94CB73MFI7SFq2o0Ac=", "narHash": "sha256-qUdbbvRcnff4IcqvYB9lE6/R4w4QrMUtvc9iDJE2g3s=",
"owner": "RoyDumblauskas", "owner": "RoyDumblauskas",
"repo": "tests-service", "repo": "tests-service",
"rev": "3174bee901f0309cd3d0b4a6491c297c9b8469ca", "rev": "938de22060286391156f8d8533f8e7f7fa6b498b",
"type": "github" "type": "github"
}, },
"original": { "original": {
nixos/flake.nix
+6 -1
View File
@@ -17,6 +17,10 @@
url = "github:Mic92/sops-nix"; url = "github:Mic92/sops-nix";
inputs.nixpkgs.follows = "nixpkgs"; inputs.nixpkgs.follows = "nixpkgs";
}; };
impermanence = {
url = "github:nix-community/impermanence";
inputs.nixpkgs.follows = "nixpkgs";
};
# This is a path to the services I've declared. # This is a path to the services I've declared.
# It just happens to be stored in the same repository (relative), # It just happens to be stored in the same repository (relative),
# but could well be a separate repository # but could well be a separate repository
@@ -25,7 +29,7 @@
}; };
}; };
outputs = { self, nixpkgs, nixvim, home-manager, disko, sops-nix, quasiSecrets, tests-service }@inputs: outputs = { self, nixpkgs, nixvim, home-manager, disko, sops-nix, quasiSecrets, impermanence, tests-service }@inputs:
let let
nodes = [ nodes = [
{ {
@@ -52,6 +56,7 @@
sops-nix.nixosModules.sops sops-nix.nixosModules.sops
quasiSecrets.nixosModules.ipAddrs quasiSecrets.nixosModules.ipAddrs
quasiSecrets.nixosModules.serviceList quasiSecrets.nixosModules.serviceList
impermanence.nixosModules.impermanence
tests-service.nixosModules.default tests-service.nixosModules.default
home-manager.nixosModules.home-manager { home-manager.nixosModules.home-manager {
home-manager.useGlobalPkgs = true; home-manager.useGlobalPkgs = true;
nixos/secrets/build.json
+3 -3
View File
@@ -4,11 +4,11 @@
"age": [ "age": [
{ {
"recipient": "age1ldgnl53dmvl4fjz6hgdj0cvensagddn3ltpmxfm72m8q273w75fsk42p8v", "recipient": "age1ldgnl53dmvl4fjz6hgdj0cvensagddn3ltpmxfm72m8q273w75fsk42p8v",
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNbExuUVFsVDRmK0ZmSVNw\nMUhlZGhweTRQUmp0Q3N2SUh1Mmx5Q1JxSXlVCi9kQlhNNjF2d1M3Q0JwUTZ6WkJL\nbW40RGkzZFVJSUxBT0VLNU4yYjV6YjgKLS0tIGhhS2dNWXVZaXhjWjlaNkJsc0Fq\nWGNFeDBMY3IxNzVraWE3Q2pjWThxbGcKTxYNkf//IW24Cji5n47P5XvO3W0rtZ2c\nVI7vHn4BQiL6N75xtn8DUouBu78oPbhq/ltL1GSTPn2DObysmADFwQ==\n-----END AGE ENCRYPTED FILE-----\n" "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBVNkdjMER1TFB5MjRvWUxh\ncVRTRTNtV1ZuNUJjOFhGa2hYK0gwdTdVbEJjCjlDYkhDN1BEMHdjZStES2lyMUlF\nWTJZOTFFQUxYaDdSY0VUd2dFd3pBOHcKLS0tIFQzcm9aSzF6bklUWXJJTjcrRU1K\ndEpLY1RQNXN6YSszbUhzeGJPY3dXZW8KgOb1rFnqibwvtBdC55f2aVDIC3V33b6k\niIboCO/swiD7N3IF3imvaHdG9ILy5oIH9KJOCpl12RrLvhIlU/lp6Q==\n-----END AGE ENCRYPTED FILE-----\n"
}, },
{ {
"recipient": "age19sx89g6rs9hnrhkujf5uk2zrkj5d4l3gh33gzwau7v7z2249qq4sw47et8", "recipient": "age177wwag0rmyejqm37l748tuup5lvdslaza6kjkrjhdfce2drajscqn6cmru",
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBjK0x2UVBKSnVHOHYwZGRI\nSnJsUFJ4N29GbHl1RHZYMVcra1ZNczI1TlRJCnEwTDRoa3FEMEJKQUhoN3ZpcVVm\nbER6L1VxRlkxZ3EyN1pTNzVkbWNsTkEKLS0tIFhzWm1kN0czNitrbXlFOGdQNkxi\nV2lpOW9Id3Q2RlNpSWpiRVpldVNGZE0KMz7MZWp1pPwxidzzFGordBLdmQygDu9x\nAeMvZ75NYCiCvH7bn1C7j3mLNIQ/oJxXTP2ZXOy6w7HPItUdIqijaA==\n-----END AGE ENCRYPTED FILE-----\n" "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2ekYzQWZtM25IUTl2OU5i\nS3lkdFpLNUluZGxZNlpja3FlYUpzTmlRUDE0CkVneURXcGE5Zm5pbHlHeXMzZGJD\nODdXU25XTk5oWW0zQnhhdlZqc2pKNE0KLS0tIFNmOWdza3FYWUl0VTZlemFHUTd2\nRXRtOEpIZGwzOTBUSURWQVEwcHZXd2sKhqH+YCXCH/mplhUYxGOWz6S3ha+AJWqR\nEtdnr2XK6V8a1OmdMBtoYdym72S7W30TksoW6I+bYNP9lW74GgbuFw==\n-----END AGE ENCRYPTED FILE-----\n"
} }
], ],
"lastmodified": "2025-04-17T15:26:55Z", "lastmodified": "2025-04-17T15:26:55Z",
nixos/secrets/cloudflare.json
+3 -3
View File
@@ -5,11 +5,11 @@
"age": [ "age": [
{ {
"recipient": "age1ldgnl53dmvl4fjz6hgdj0cvensagddn3ltpmxfm72m8q273w75fsk42p8v", "recipient": "age1ldgnl53dmvl4fjz6hgdj0cvensagddn3ltpmxfm72m8q273w75fsk42p8v",
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA0T0o1Rktqa0w1MnNoa1Jr\nak83UGVLbkZDdGpYeDNCMXlNOWp2NHphR1dJCnFWLzUwck8yWE9jWVNJSVpNQTFY\nREZSM0lRM2lwSWxPdU50a1AzbTVuYnMKLS0tIEFScjN0M1EyRGMvZHlVQ1YvcXNa\ndnMzejQ2dnVmZDR6NWVjaGwxVjkrWDAKuNowznQhA59a9/d0A1w3xO/tZBRNxtZ0\nFAaxKLsL7WxvGYvX+AF0iAb/8mYYcDWhgTf49CbZNlGgaDd/0GU8/Q==\n-----END AGE ENCRYPTED FILE-----\n" "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqdk03R0xaZ090aER1Wldt\nRGVGMFFMZG90TVovVjJoWm9ONU1VaDdQS0ZnCitKcUhkV0VzODVKUkNxNU1rVXJk\nK1BwV1piVlo0Q0lTbUVTUlhDUGVZK28KLS0tIGRYeVUza2JRNE0vZzZsMTg4akJo\nMlBSNVNUZTBObDB3N0pTYXhtQWgydG8KTQs4V0VjUFWl6pUk4Po/03dxE+ANpXJb\nd8k1n39aqNa7WQdoEe6zUQlPhaGHUszj8bIbdv46GiVADCJGJXs+Wg==\n-----END AGE ENCRYPTED FILE-----\n"
}, },
{ {
"recipient": "age19sx89g6rs9hnrhkujf5uk2zrkj5d4l3gh33gzwau7v7z2249qq4sw47et8", "recipient": "age177wwag0rmyejqm37l748tuup5lvdslaza6kjkrjhdfce2drajscqn6cmru",
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBuVHoydjZ6Y2JpYklKT1Qz\nN2JWLzA3QW9rMlZGV1k0eFQzUzlINTV5NFZVCk5wbmVxdEtNR3FkYnAvYzhPVkRL\nQXRsZmFFWUZYRXcrSDA0UVhnUXowOTgKLS0tIFp4c1pxSzZMYTRycG96WjUxcmJp\najBtQmx6bW9iWSs3RGY4ci9pYzdnUjAKkN7qRqpRkJVER50NvrYQ/AjXO6OQ00xx\nJA+wjUdISdZBuEMdgJLiKudO3ejWt1w6JCPbVdbllBHJ4pzEHoIKjQ==\n-----END AGE ENCRYPTED FILE-----\n" "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBxb1ova3FYUE1wVnU0anJN\nQ28rRzNpbFlJTW05c0xUeWMzZlFNUlRsblZvCktmMzRGU3dQSnhwbVY1NFBWVGpG\ndEJ0ODhFcXRzKzdSRGo4ZDRMeGtkQUUKLS0tIFNBSVJZbkR0ampWN3pDVERDanFD\nZndXUGYyM01UcHFzV0xzZm5rUnpHYU0Kfc7Fh6q7xV4OyjB3F+fjjt9XWizm/fnz\n4fCkO9t0ZUcb7YoBwpHdZ3Ex7Xkey8URF2Tcv0/gWF0XyaJ0rOQvxA==\n-----END AGE ENCRYPTED FILE-----\n"
} }
], ],
"lastmodified": "2025-04-28T04:15:19Z", "lastmodified": "2025-04-28T04:15:19Z",