diff --git a/flake.nix b/flake.nix index 2f7675e..c3b7ed8 100644 --- a/flake.nix +++ b/flake.nix @@ -7,9 +7,10 @@ url = "github:nix-community/home-manager/release-25.11"; inputs.nixpkgs.follows = "nixpkgs"; }; + agenix.url = "github:ryantm/agenix"; }; - outputs = { self, nixpkgs, home-manager, ... }: + outputs = { self, nixpkgs, home-manager, agenix, ... }: let system = "x86_64-linux"; in { @@ -17,6 +18,7 @@ inherit system; modules = [ ./nixos/configuration.nix + agenix.nixosModules.default home-manager.nixosModules.home-manager { home-manager.useGlobalPkgs = true; diff --git a/home/ltadeu6.nix b/home/ltadeu6.nix index e05827f..e8803ca 100644 --- a/home/ltadeu6.nix +++ b/home/ltadeu6.nix @@ -82,6 +82,12 @@ ]; home.file = { + ".config/fish/conf.d/agenix-openai.fish".text = '' + if test -r /run/agenix/openai_api_key + set -gx OPENAI_API_KEY (cat /run/agenix/openai_api_key) + end + ''; + ".config/hypr/hyprland.conf".source = ../hypr/hyprland.conf; ".config/hypr/hyprpaper.conf".source = ../hypr/hyprpaper.conf; diff --git a/nixos/configuration.nix b/nixos/configuration.nix index 934af54..09ca101 100644 --- a/nixos/configuration.nix +++ b/nixos/configuration.nix @@ -2,15 +2,32 @@ # your system. Help is available in the configuration.nix(5) man page # and in the NixOS manual (accessible by running ‘nixos-help’). -{ pkgs, ... }: +{ config, pkgs, lib, ... }: -let secrets = import ./secrets.nix; -in { +{ imports = [ # Include the results of the hardware scan. ./hardware-configuration.nix ]; + age = { + identityPaths = [ "/home/ltadeu6/.ssh/id_ed25519" ]; + secrets = + { } + // lib.optionalAttrs (builtins.pathExists ../secrets/openai_api_key.age) { + openai_api_key.file = ../secrets/openai_api_key.age; + } + // lib.optionalAttrs (builtins.pathExists ../secrets/minecraft_rcon_password.age) { + minecraft_rcon_password.file = ../secrets/minecraft_rcon_password.age; + } + // lib.optionalAttrs (builtins.pathExists ../secrets/syncthing_pixel_id.age) { + syncthing_pixel_id.file = ../secrets/syncthing_pixel_id.age; + } + // lib.optionalAttrs (builtins.pathExists ../secrets/syncthing_tv_id.age) { + syncthing_tv_id.file = ../secrets/syncthing_tv_id.age; + }; + }; + powerManagement.cpuFreqGovernor = "performance"; # Bootloader. @@ -58,11 +75,11 @@ in { # wg0 = { # ips = [ "10.0.0.2/24" ]; # listenPort = 51820; - # privateKey = secrets.wireguard.privateKey; + # privateKey = builtins.readFile config.age.secrets.wireguard_private_key.path; # peers = [{ - # publicKey = secrets.wireguard.peerPublicKey; + # publicKey = (import ../secrets/secrets.nix).wireguard.peerPublicKey; # allowedIPs = [ "10.0.0.1" ]; - # endpoint = secrets.wireguard.endpoint; + # endpoint = (import ../secrets/secrets.nix).wireguard.endpoint; # persistentKeepalive = 25; # }]; # }; @@ -88,9 +105,7 @@ in { console.keyMap = "br-abnt2"; - environment.sessionVariables = { - OPENAI_API_KEY = secrets.openaiApiKey; - }; + environment.sessionVariables = { }; programs = { cdemu.enable = true; @@ -196,9 +211,12 @@ in { max-players = 20; white-list = false; enable-rcon = true; - "rcon.password" = secrets.minecraft.rconPassword; online-mode = false; - }; + } // lib.optionalAttrs (config.services.minecraft-server.enable + && config.age.secrets ? minecraft_rcon_password) { + "rcon.password" = + builtins.readFile config.age.secrets.minecraft_rcon_password.path; + }; }; xserver = { @@ -344,10 +362,20 @@ in { dataDir = "/home/ltadeu6"; # Default folder for new synced folders configDir = "/home/ltadeu6/.config/syncthing"; settings = { - devices = { - "Pixel" = { id = secrets.syncthing.devices.pixelId; }; - "TV" = { id = secrets.syncthing.devices.tvId; }; - }; + devices = + { } + // lib.optionalAttrs (config.services.syncthing.enable + && config.age.secrets ? syncthing_pixel_id) { + "Pixel" = { + id = builtins.readFile config.age.secrets.syncthing_pixel_id.path; + }; + } + // lib.optionalAttrs (config.services.syncthing.enable + && config.age.secrets ? syncthing_tv_id) { + "TV" = { + id = builtins.readFile config.age.secrets.syncthing_tv_id.path; + }; + }; folders = { "RetroArch" = { # Name of folder in Syncthing, also the folder ID path = @@ -408,6 +436,7 @@ in { environment.systemPackages = with pkgs; [ most + agenix # mangohud hyfetch cacert diff --git a/secrets/minecraft_rcon_password.age b/secrets/minecraft_rcon_password.age new file mode 100644 index 0000000..1b479ea Binary files /dev/null and b/secrets/minecraft_rcon_password.age differ diff --git a/secrets/openai_api_key.age b/secrets/openai_api_key.age new file mode 100644 index 0000000..aa8429b --- /dev/null +++ b/secrets/openai_api_key.age @@ -0,0 +1,7 @@ +age-encryption.org/v1 +-> ssh-ed25519 PLsDCw QHiCDmpxviQE+8K5GTzoEROGdG3sMM7vI3hxPHs/sXo +k3icGb22p6Em8LSsaJF/xnU28P17kXDwl4D2erNbvKQ +-> ssh-ed25519 PLsDCw Hyntb19GeC7jG2NTle9WNna1X4e8judraY6vhoux8Qg +xHO7Vh9OD8Yf9YfNf0n0jF2ZISd05M4d/r5+9NQRGiU +--- H0bQF7/xRCAP100Y3VbPQoDzDC3tmF9YyrChk0Iwlng +5YQۦh/|]y"oy thgzErx/bMiڗ|?DG*:{@25-'!F &6@ǂq_:cbݖ"*rpz#Eh&pDy#M6 ssh-ed25519 PLsDCw jeIeeJWcN+xV5azLkyMK2YdaZXlav1ehnv5kzmcURzE +o6DUO2AoYX8OeIHlPM8dK21tGoG54Gnvr/CjlBGTLj4 +-> ssh-ed25519 PLsDCw SHKfV63stmxfaRZ/ZAWRsIDLRHpdjI5+IACMW1zv7Uc +grXmEGA58z/XxNIWuhWlyUEPo4l3t6UGwnQbKiEs/50 +--- Sd2JFl0CaniOP+PynBOtGT+OJc3I/PFRMNZi0L9Ants +f+Rsr#3W(v!v+ +Q>JEwS[LQt|r7]./a&B ׂ*ؒct +Z+Y \ No newline at end of file diff --git a/secrets/syncthing_tv_id.age b/secrets/syncthing_tv_id.age new file mode 100644 index 0000000..8e4e888 --- /dev/null +++ b/secrets/syncthing_tv_id.age @@ -0,0 +1,7 @@ +age-encryption.org/v1 +-> ssh-ed25519 PLsDCw wlxQ0eW0pF5TUUZH9/4eCc7fx5hJZ98mi0CHcRvUVFQ +tGbNvthS41qp+SfzRsKZkBsQocuQxTpYE0u/0i23RdQ +-> ssh-ed25519 PLsDCw Xz4F9+s7tS9r+qVf62ALAqqmbGfR719SdloCBmjZZ3U +2Fdp5L0rVXH1U7GOWX07cxpkGfEVTuTFvTKGwFb+ueI +--- G/eTc6dYfIhisIYxaWfhR3K52ruwAgtWpTj5V9nBs5Q +d1Y F xkM>g@$3uOWJ}R`Ԣb՞ֈkFvlc8ZȇQew \ No newline at end of file diff --git a/secrets/wireguard_private_key.age b/secrets/wireguard_private_key.age new file mode 100644 index 0000000..895dd06 Binary files /dev/null and b/secrets/wireguard_private_key.age differ