updates for soteria host

2026-07-05 20:05:02 -05:00
parent bfbdbae99b
commit 9f1fed071d
5 changed files with 86 additions and 76 deletions
@@ -266,6 +266,10 @@ in
              HostName = "fded:fb16:653e:25da:be24:11ff:fe6b:4d57";
              User = "root";
            };
+            "soteria" = {
+              HostName = "fded:fb16:653e:25da:be24:11ff:fe54:aa39";
+              User = "root";
+            };
            "hermes" = {
              HostName = "192.168.1.150";
              User = "root";
@@ -3,17 +3,22 @@
 let
  username = "john";
  hostname = "soteria";
+  ipv4 = "192.168.1.233";
+  ipv6 = "fded:fb16:653e:25da:be24:11ff:fe54:aa39";
+  names = [ "${hostname}.john-stream.com" ipv4 ipv6 ];
 in
 {
  flake.nixosConfigurations."${hostname}" = inputs.nixpkgs.lib.nixosSystem {
    modules = with inputs.self.modules; [
      nixos.lxc
-      nixos.mysops
-      nixos."${username}"
-      nixos.ssh-certs
      nixos.login-text
+      inputs.home-manager.nixosModules.home-manager
+      nixos."${username}"
+      nixos.ssh-new
+      # nixos.mtls
+      nixos.mysops
+      # nixos.ssh-certs
      nixos.docker
-      nixos.mtls
      nixos.step-client
      nixos.forgejo
      nixos.restic-server
@@ -38,12 +43,7 @@ in
        mtls = {
          enable = true;
          subject = hostname;
-          san = [
-            "${hostname}.john-stream.com"
-            # "192.168.1.142"
-            "forgejo.john-stream.com"
-            "192.168.1.244"
-          ];
+          san = names;
          lifetime = "12h";
          renew.onCalendar = "*:3/15";
          renew.reloadUnits = [ "forgejo.service" "restic-rest-server.service" ];
@@ -70,18 +70,24 @@ in
        loginText.extraServiceStatus = {
          Docker = "docker";
          "mTLS Renewal" = "mtls-renew.timer";
-          Forgejo = "forgejo.service";
+          "Forgejo" = "forgejo.service";
          "Forgejo Backup" = "forgejo-dump.timer";
          "Restic REST Server" = "restic-rest-server.service";
        };

-        ssh-certs.hostname = hostname;
+        ssh-new.certificates = {
+          provisioner = "admin";
+          host = {
+            enable = true;
+            extraPrincipals = names;
+            autoRenew = true;
+          };
+          user.enable = true;
+        };

        # This provides the secrets at install time
        sops.defaultSopsFile = ./secrets.yaml;

-        # programs.zsh.enable = true;
-
        home-manager.users."${username}".imports = [ inputs.self.modules.homeManager.soteria ];

        environment.systemPackages = [
@@ -93,10 +99,10 @@ in
  };

  flake.modules.homeManager.soteria = { config, pkgs, lib, ... }: {
-    imports = [
-      inputs.self.modules.homeManager.rebuild
-      inputs.self.modules.homeManager.mysops
-      inputs.self.modules.homeManager.step-client
+    imports = with inputs.self.modules.homeManager; [
+      rebuild
+      mysops
+      step-client
      ({ config, pkgs, lib, ... }: {
        homeManagerFlakeDir = "${config.xdg.configHome}/home-manager";
        docker.enable = true;
@@ -107,12 +113,12 @@ in
    ];
  };

-  flake.homeConfigurations.soteria = withSystem "x86_64-linux" (ctx@{ config, inputs', ...}:
-    inputs.home-manager.lib.homeManagerConfiguration {
-      pkgs = inputs'.nixpkgs.legacyPackages;
-      modules = [
-        inputs.self.modules.homeManager."${username}"
-        inputs.self.modules.homeManager.soteria
-      ];
-  });
+  # flake.homeConfigurations.soteria = withSystem "x86_64-linux" (ctx@{ config, inputs', ...}:
+  #   inputs.home-manager.lib.homeManagerConfiguration {
+  #     pkgs = inputs'.nixpkgs.legacyPackages;
+  #     modules = [
+  #       inputs.self.modules.homeManager."${username}"
+  #       inputs.self.modules.homeManager.soteria
+  #     ];
+  # });
 }
@@ -9,33 +9,33 @@ forgejo:
 restic_password: ENC[AES256_GCM,data:u7QOZXJkxVG4J75K5nphb2uJGdz6jbWuVSsKKu+41fshp7cVoRijtr/Cs02LjVse,iv:bt1W2FeBTG6ypBFYzMPXPIkYTSn0uHURY2ui6MRgYY8=,tag:DObAMws/zQcM+UKUe9EECA==,type:str]
 sops:
    age:
-        - recipient: age1ykcs39e62pz3xu6cedg8ea685kv5d5qsrhgkndygzm8rx30xd5ys5t3qxt
-          enc: |
+        - enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA5QThHOFdVQ0F6ZDE3QXdL
-            QVF0WW5yRkNtNXIyRm1LeEhwY2dRRWo0WENZCmZoWmlXZDh4ZGlUR2JYOUxuaVAx
-            WjhXVHBMNWdrdkgvTENJR2RpWldkNTAKLS0tIEF1bS9JSnFTbytBa1U5RjVzWkd3
-            S0pKVVI2RFN5a1BMYXBEY3VOUUM5QTAKNarYZm9DKRQhosSJBn9yryFxDkmFTV/o
-            i8b/tZ1ZybjEXX+X1EsgylM5u8iKkbEyUzqKO0E0gpg4qXSsJaMMYQ==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBLM3NML2ozWExSTlY3ZXJH
+            ZEpaN1RIOWVjNXRRQTlLQVZKTUUvZnBxREd3Cmp6b29aRDlUdDFwMVhwS2thODNO
+            QzNWSVIrak1uMGRuUlBONkR2aW1nbXMKLS0tIDh2YmFaRXBvZ0Q2blhjTVphL3J3
+            TkROaHdwWWN4YnkyczZLbDJYRTNrQTQKvHSXjP9EZkq9DrPZZHTIlFrPUhez6jZT
+            LJvkmQgKluer7+lWr8XuuqtQsvhtef1di82SBG6C6YK0zWIxrMjFkA==
            -----END AGE ENCRYPTED FILE-----
-        - recipient: age1h0prahyukq4l564yqwgcpg3g6gdrjflk0suklussjjrjstxd9uesws8633
-          enc: |
+          recipient: age1p4gyh5260ewp7t2ctzv5ewj4a06szl389fm4gzy6vltxhjj73ers87u33g
+        - enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBhdEN2M1lkMFoyQzg3bCsz
-            cVB0NUlkV1JPRjQ1TW5RSVFHUjdNMERoRXlzCk9tc25iMG00TkZjWjk2S2cyVE1J
-            cUFITDh2SkZGN0lpeWJVcWM3V3JrTTQKLS0tIENOWVBzTFYrdHRsMERwV0RKS01j
-            QVI5TVl4L0dwOWpoQ1I2THZ6cWovWGMKIo1x1ZbdTyr/dNlPhvuomfk2MoPLsHyU
-            N3CP3Scu3aZ7vqVua7uwtv4xQqyQI/yOnFjwxrVYPJ+N5Y/b4wsC6A==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBwWThXZGtFSjFZVU1UWG9v
+            Wk9sVEVWemtVWTJ6TGlOd3ZhVUZBYnJ1OFFRClpFNmEwTG1PR0pQUFJuTTVVZGRD
+            bnpPdjZGVUJvS0NyWGJQbEV4cUlHZncKLS0tIDFNU1VxNjZYSks1OTMrblJPbDI1
+            bHIrUnhsMWNhWVpVc3hCazlKTlV5YncKgR/AbgCE9JU8U8PH3ouYTZJOqL7rRODr
+            5D2zT9pcTC3LQGZrhNtgjAi6IucU4yDAU7UhT3D7cZawwFTKVaoplw==
            -----END AGE ENCRYPTED FILE-----
-        - recipient: age1gvplss0ddmyf6vpjy363wu3n057vhm0j6n7tc94cxd8kadapypws5mtaj0
-          enc: |
+          recipient: age1ykcs39e62pz3xu6cedg8ea685kv5d5qsrhgkndygzm8rx30xd5ys5t3qxt
+        - enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBGSGQvL2ZYM2dtV1JWaDR1
-            RjJnN0YwWFM4d1IwTElqUnZQQkVDTmdydUJjCjdCUWxCVDNXUHVLd2ZHcDA5L0Mw
-            cEVxVE84L2xmQnRoYmsxVEdMSEZjdGcKLS0tIHViRVJyTWt4Q3JrMWtYaS9QdHlS
-            Yjd0MUcxcExvWVpCOUR3MkdZdGQyWUkKnru0Y2A98+0Mps7EtVK7ct3vPqIGveUt
-            E5fzpcKvdefzObrx7BPTwJ19t2fZg/dSi7HKwx3vmKZSzyQaqJOzsg==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA3K054SHE0V1RCYlRlTXJT
+            bXo4ZnE1cFozY3R2dmg5S1BacC9xb2oweWpBClJJVnkrSytFaG8xR1l4SU5FNGxi
+            UndnNzYwMUlXSjRYK3c3MzI4NmRVRVEKLS0tIFQ4NFdPeGI4LytWK0JPcUV4VjM2
+            b1dtYWdFTTFQcW5PQml2OWs1Z0VZOFUKrDX7y3cU8KPRLKlO/HI/jdynqwO1TAS0
+            WY4F0qFKmWwsJJjbnjdpYYP3O1/8RNeXjnUg8fGYY75sf7iAYWSe/w==
            -----END AGE ENCRYPTED FILE-----
+          recipient: age1gvplss0ddmyf6vpjy363wu3n057vhm0j6n7tc94cxd8kadapypws5mtaj0
    lastmodified: "2026-04-04T23:18:43Z"
    mac: ENC[AES256_GCM,data:qBgeli5lHb4pyA8nAADBuRBAaq8VbAIsFI37OZtgnbnoHW2crxo3YC+EknaIYnZpZ48kwVhQS5lGRjI6JsWWhTH3+LVAhTmS2Qj/pZTD/JDLK6XJGXS4U9nB7m9aGYyW8gFCy9/DfoJWGsS//+ZmUikKPfd5kMZgh1zGoYCIGug=,iv:h+2fA+bO2SMCNrEslP36x3BPRaIy25cU/DNX8CYSC6A=,tag:RvVyUZ4ONRaKaqGiT31eUQ==,type:str]
    unencrypted_suffix: _unencrypted