126 lines
3.2 KiB
Nix
126 lines
3.2 KiB
Nix
{ inputs, ... }:
|
|
let
|
|
username = "john";
|
|
hostname = "john-pc-ubuntu";
|
|
testTarget = "fded:fb16:653e:25da:be24:11ff:fea0:753f";
|
|
in
|
|
{
|
|
flake.modules.homeManager."${hostname}" = { pkgs, config, ... }:
|
|
let
|
|
flakeDir = "${config.xdg.configHome}/home-manager/jsl-dendritic";
|
|
certDir = "${config.mtls.certDir}";
|
|
CACert = "${certDir}/root_ca.crt";
|
|
mtlsBundle = "${certDir}/${config.mtls.bundleFilename}";
|
|
in
|
|
{
|
|
imports = with inputs.self.modules.homeManager; [
|
|
rebuild
|
|
john
|
|
sops
|
|
step-ssh-user
|
|
mtls
|
|
restic
|
|
docker
|
|
desktop
|
|
];
|
|
targets.genericLinux.enable = true;
|
|
|
|
shell.program = "zsh";
|
|
|
|
home.username = "${username}";
|
|
home.homeDirectory = "/home/${username}";
|
|
|
|
home.packages = with pkgs; [
|
|
nixos-rebuild
|
|
(writeShellScriptBin "test-push" ''
|
|
nixos-rebuild switch --flake ${flakeDir}#soteria --target-host root@${testTarget}
|
|
'')
|
|
];
|
|
|
|
mtls = {
|
|
enable = true;
|
|
caURL = "https://janus.john-stream.com/";
|
|
provisioner = "admin";
|
|
subject = hostname;
|
|
san = [
|
|
"${hostname}"
|
|
"192.168.1.85"
|
|
"spiffe://john-stream.com/ubuntu"
|
|
];
|
|
lifetime = "1h";
|
|
renew.onCalendar = "*:1/10";
|
|
};
|
|
|
|
# TODO: Add host-specific settings here:
|
|
# - sops secret for `restic_password/john_ubuntu`
|
|
# - resticprofile profile definition
|
|
# - zsh RESTIC* session variables
|
|
|
|
# TODO: make this more restrictive, rather than allowing all unfree packages
|
|
nixpkgs.config.allowUnfree = true;
|
|
nixpkgs.config.permittedInsecurePackages = [ "openssl-1.1.1w" ];
|
|
|
|
homeManagerFlakeDir = flakeDir;
|
|
docker.enable = true;
|
|
|
|
step-ssh-user = {
|
|
enable = true;
|
|
principals = ["root" "${username}" "appdaemon"];
|
|
provisioner = "admin";
|
|
};
|
|
ssh = {
|
|
certificates.enable = true;
|
|
matchSets = {
|
|
certs = true;
|
|
appdaemon = true;
|
|
homelab = true;
|
|
dev = true;
|
|
};
|
|
};
|
|
sops.secrets."restic_password/john_ubuntu" = {
|
|
path = "${config.xdg.configHome}/restic/password.txt";
|
|
mode = "0400";
|
|
};
|
|
restic = {
|
|
passwordFile = "${config.xdg.configHome}/restic/password.txt";
|
|
paths = [
|
|
"${config.xdg.userDirs.documents}"
|
|
"/conf"
|
|
];
|
|
exclude = [
|
|
"/home/*/Pictures"
|
|
"/home/*/Videos"
|
|
"/home/*/go"
|
|
"/home/*/snap"
|
|
"/home/john/john-nas"
|
|
];
|
|
};
|
|
|
|
# programs.resticprofile = {
|
|
# enable= true;
|
|
# profiles = {
|
|
# default = {
|
|
# "inherit" = "base";
|
|
# repository = "rest:https://soteria.john-stream.com/john-ubuntu";
|
|
# cacert = "${CACert}";
|
|
# tls-client-cert = "${mtlsBundle}";
|
|
# backup = {
|
|
# source = [
|
|
# "${config.xdg.userDirs.documents}"
|
|
# "/conf"
|
|
# ];
|
|
# schedule = "*-*-* *:15,30,45:00";
|
|
# };
|
|
# };
|
|
# };
|
|
# };
|
|
};
|
|
|
|
flake.homeConfigurations."${hostname}" = inputs.home-manager.lib.homeManagerConfiguration {
|
|
pkgs = import inputs.nixpkgs { system = "x86_64-linux"; };
|
|
modules = with inputs.self.modules; [
|
|
homeManager."${hostname}"
|
|
];
|
|
};
|
|
}
|