started soteria homeconfiguration

modules/hosts/john-pc-ubuntu.nix

@@ -2,7 +2,8 @@
 let
   username = "john";
   hostname = "john-pc-ubuntu";
-  testTarget = "fded:fb16:653e:25da:be24:11ff:fea0:753f";
+  # testTarget = "fded:fb16:653e:25da:be24:11ff:fea0:753f";
+  testTarget = "fded:fb16:653e:25da:be24:11ff:fe89:1cc3";
 in
 {
   flake.modules.homeManager."${hostname}" = { pkgs, config, ... }:
@@ -34,28 +35,14 @@ in
     home.packages = with pkgs; [
       nixos-rebuild
       (writeShellScriptBin "test-push" ''
-        nixos-rebuild switch --flake ${flakeDir}#soteria --target-host root@${testTarget}
+        mkdir -p /var/tmp/nix-build
+        chmod 1777 /var/tmp/nix-build
+        nixos-rebuild switch \
+          --flake ${flakeDir}#john-pc-ubuntu \
+          --target-host root@${testTarget}
       '')
     ];
 
-    mtls = {
-      enable = true;
-      caURL = "https://janus.john-stream.com/";
-      provisioner = "admin";
-      subject = hostname;
-      san = [
-        "${hostname}"
-        "192.168.1.85"
-        "spiffe://john-stream.com/ubuntu"
-      ];
-      lifetime = "1h";
-      renew.onCalendar = "*:1/10";
-    };
-
-    # TODO: Add host-specific settings here:
-    # - sops secret for `restic_password/john_ubuntu`
-    # - zsh RESTIC* session variables
-
     # TODO: make this more restrictive, rather than allowing all unfree packages
     nixpkgs.config.allowUnfree = true;
     nixpkgs.config.permittedInsecurePackages = [ "openssl-1.1.1w" ];
@@ -93,6 +80,19 @@ in
         "/home/john/john-nas"
       ];
     };
+    mtls = {
+      enable = true;
+      caURL = "https://janus.john-stream.com/";
+      provisioner = "admin";
+      subject = hostname;
+      san = [
+        "${hostname}"
+        "192.168.1.85"
+        "spiffe://john-stream.com/ubuntu"
+      ];
+      lifetime = "1h";
+      renew.onCalendar = "*:1/10";
+    };
   };
 
   flake.homeConfigurations."${hostname}" = inputs.home-manager.lib.homeManagerConfiguration {

modules/hosts/soteria.nix

@@ -14,23 +14,51 @@ in
       nixos."${username}"
       nixos.zsh
       nixos.login-text
-      nixos.mtls
-      nixos.restic-server
+      # nixos.mtls
+      # nixos.restic-server
+      # nixos.restic-envoy
       {
         networking.hostName = hostname;
+        nix.settings.build-dir = "/var/tmp/nix-build";
+        systemd.tmpfiles.rules = [
+          "d /var/tmp/nix-build 1777 root root -"
+        ];
         step-ssh-host = {
           hostname = hostname;
           caURL = caURL;
         };
-        mtls = {
-          enable = true;
-          subject = hostname;
-          caURL = caURL;
-          san = [
-            "${hostname}.john-stream.com"
-            # "192.168.1.244"
-          ];
-        };
+        # mtls = {
+        #   enable = true;
+        #   subject = hostname;
+        #   caURL = caURL;
+        #   san = [
+        #     "${hostname}.john-stream.com"
+        #     # "192.168.1.244"
+        #   ];
+        # };
+
+        # restic.envoy = {
+        #   enable = true;
+        #   port = 10000;
+        #   spiffePrefix = "spiffe://john-stream.com";
+        #   upstreamHost = "127.0.0.1";
+        #   upstreamPort = 8000;
+        #   logLevel = "debug";
+        #   policies = {
+        #     ubuntu-policy = {
+        #       pathPrefix = "/john-ubuntu";
+        #       principal = "spiffe://john-stream.com/ubuntu";
+        #     };
+        #     p14-policy = {
+        #       pathPrefix = "/john-p14s";
+        #       principal = "spiffe://john-stream.com/john-p14s";
+        #     };
+        #     gitea-policy = {
+        #       pathPrefix = "/gitea";
+        #       principal = "spiffe://john-stream.com/gitea";
+        #     };
+        #   };
+        # };
 
         home-manager.users."${username}" = {
           imports = with inputs.self.modules.homeManager; [
@@ -42,4 +70,11 @@ in
       }
     ];
   };
+
+  flake.homeConfigurations."${hostname}" = inputs.home-manager.lib.homeManagerConfiguration {
+    pkgs = import inputs.nixpkgs { system = "x86_64-linux"; };
+    modules = with inputs.self.modules; [
+      homeManager."${hostname}"
+    ];
+  };
 }