From 39952ecd6efb54888844a4f3cb9d4d2eabb02342 Mon Sep 17 00:00:00 2001 From: Leonhard Kost Date: Sun, 8 Feb 2026 17:28:29 +0100 Subject: [PATCH] feat: add agenix, some secrets and dyndns user --- flake.lock | 88 ++++++++++++++++++++++- flake.nix | 3 + nixos/server/default.nix | 40 ++++++++++- nixos/server/dyndns.py | 3 + nixos/server/secrets/default.nix | 25 +++++++ nixos/server/secrets/nc_api_key.age | 13 ++++ nixos/server/secrets/nc_api_password.age | Bin 0 -> 692 bytes nixos/server/secrets/nc_customer.age | Bin 0 -> 648 bytes 8 files changed, 166 insertions(+), 6 deletions(-) create mode 100644 nixos/server/dyndns.py create mode 100644 nixos/server/secrets/default.nix create mode 100644 nixos/server/secrets/nc_api_key.age create mode 100644 nixos/server/secrets/nc_api_password.age create mode 100644 nixos/server/secrets/nc_customer.age diff --git a/flake.lock b/flake.lock index d92446f..ff54adc 100644 --- a/flake.lock +++ b/flake.lock @@ -1,5 +1,50 @@ { "nodes": { + "agenix": { + "inputs": { + "darwin": "darwin", + "home-manager": "home-manager", + "nixpkgs": [ + "nixpkgs" + ], + "systems": "systems" + }, + "locked": { + "lastModified": 1770165109, + "narHash": "sha256-9VnK6Oqai65puVJ4WYtCTvlJeXxMzAp/69HhQuTdl/I=", + "owner": "ryantm", + "repo": "agenix", + "rev": "b027ee29d959fda4b60b57566d64c98a202e0feb", + "type": "github" + }, + "original": { + "owner": "ryantm", + "repo": "agenix", + "type": "github" + } + }, + "darwin": { + "inputs": { + "nixpkgs": [ + "agenix", + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1744478979, + "narHash": "sha256-dyN+teG9G82G+m+PX/aSAagkC+vUv0SgUw3XkPhQodQ=", + "owner": "lnl7", + "repo": "nix-darwin", + "rev": "43975d782b418ebf4969e9ccba82466728c2851b", + "type": "github" + }, + "original": { + "owner": "lnl7", + "ref": "master", + "repo": "nix-darwin", + "type": "github" + } + }, "flake-parts": { "inputs": { "nixpkgs-lib": [ @@ -23,7 +68,7 @@ }, "flake-utils": { "inputs": { - "systems": "systems" + "systems": "systems_2" }, "locked": { "lastModified": 1731533236, @@ -40,6 +85,27 @@ } }, "home-manager": { + "inputs": { + "nixpkgs": [ + "agenix", + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1745494811, + "narHash": "sha256-YZCh2o9Ua1n9uCvrvi5pRxtuVNml8X2a03qIFfRKpFs=", + "owner": "nix-community", + "repo": "home-manager", + "rev": "abfad3d2958c9e6300a883bd443512c55dfeb1be", + "type": "github" + }, + "original": { + "owner": "nix-community", + "repo": "home-manager", + "type": "github" + } + }, + "home-manager_2": { "inputs": { "nixpkgs": [ "nixpkgs" @@ -127,7 +193,7 @@ "nixpkgs" ], "nuschtosSearch": "nuschtosSearch", - "systems": "systems_2" + "systems": "systems_3" }, "locked": { "lastModified": 1767448089, @@ -169,7 +235,8 @@ }, "root": { "inputs": { - "home-manager": "home-manager", + "agenix": "agenix", + "home-manager": "home-manager_2", "nixpkgs": "nixpkgs", "nixpkgs-unstable": "nixpkgs-unstable", "nixvim": "nixvim" @@ -204,6 +271,21 @@ "repo": "default", "type": "github" } + }, + "systems_3": { + "locked": { + "lastModified": 1681028828, + "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=", + "owner": "nix-systems", + "repo": "default", + "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e", + "type": "github" + }, + "original": { + "owner": "nix-systems", + "repo": "default", + "type": "github" + } } }, "root": "root", diff --git a/flake.nix b/flake.nix index 2d1c88b..86763ad 100644 --- a/flake.nix +++ b/flake.nix @@ -8,6 +8,9 @@ nixvim.url = "github:nix-community/nixvim/nixos-25.11"; nixvim.inputs.nixpkgs.follows = "nixpkgs"; + + agenix.url = "github:ryantm/agenix"; + agenix.inputs.nixpkgs.follows = "nixpkgs"; }; outputs = diff --git a/nixos/server/default.nix b/nixos/server/default.nix index b1b06c1..9b4e13d 100644 --- a/nixos/server/default.nix +++ b/nixos/server/default.nix @@ -1,22 +1,53 @@ { inputs, outputs, + config, + pkgs, ... }: +let + dyndnsScript = pkgs.writeScript "dyndns.py" (builtins.readFile ./dyndns.py); +in { imports = [ (import ../base.nix { inherit inputs outputs; }) ./hardware-configuration.nix + ./secrets + inputs.agenix.nixosModules.default ]; + users.groups.dyndns = { }; users.users = { leonhard = { initialPassword = "leonhard"; isNormalUser = true; extraGroups = [ "wheel" ]; - openssh.authorizedKeys.keys = [ - "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDPegeAIABaY9DyWumihNZBlzfdduycvurwYYqoZrdkov2pRVJt8eFhXe+5tdLTKiAq58yzkJ6Zj3CuYb3XuQxX/aDvY4covDXjn1tGKf32xkhTuLd9eDGbFishiC+qROp2/3eZ01DwuttHWo3n/jwOwL3M9mw9Now2i2qaTGuq8wfG5XJ9Cp2+3Ly+mChhtff7Us65dWihNbR3k2WLLvdPJ2HMjeZder0u/IsTTGJj/sytEGt0LPqFOJMl0QuqemkzbeoSAEpVl4huXp5LVT7be2UUmRuekg0p2+EopHunMhUaf7dekiupbKFFNY8aU/eOEZmnakJpOEhcZWaFot825O8jViC9I0NTLazgwttqnZxnuFIp/0Ljf0j7SR/tJa55T0yMH5pyEjw/yvYLplJKbBlPyl2LpsN37l5HKXFtunOsiK/NLL6rLUoTjO5QGCg750c2UKqL8A1g11sW82kscePQTFKbIRmr271ruFWaxnNNh2W5LuJNcUlLf/t/6ps= leonhard" - ]; + openssh.authorizedKeys.keys = config.kekleo.publicKeys; + }; + dyndns = { + isSystemUser = true; + group = "dyndns"; + packages = [ pkgs.python313Packages.nc-dnsapi ]; + }; + }; + + systemd.timers."dyndns" = { + wantedBy = [ "timers.target" ]; + timerConfig = { + OnBootSec = "5m"; + OnUnitActiveSec = "5m"; + Unit = "dyndns.service"; + }; + }; + + systemd.services."dyndns" = { + script = '' + set -eu + ${pkgs.python313}/bin/python3 ${dyndnsScript} + ''; + serviceConfig = { + Type = "oneshot"; + User = "dyndns"; }; }; @@ -52,4 +83,7 @@ }; kekleo.graphical = false; + kekleo.publicKeys = [ + "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDPegeAIABaY9DyWumihNZBlzfdduycvurwYYqoZrdkov2pRVJt8eFhXe+5tdLTKiAq58yzkJ6Zj3CuYb3XuQxX/aDvY4covDXjn1tGKf32xkhTuLd9eDGbFishiC+qROp2/3eZ01DwuttHWo3n/jwOwL3M9mw9Now2i2qaTGuq8wfG5XJ9Cp2+3Ly+mChhtff7Us65dWihNbR3k2WLLvdPJ2HMjeZder0u/IsTTGJj/sytEGt0LPqFOJMl0QuqemkzbeoSAEpVl4huXp5LVT7be2UUmRuekg0p2+EopHunMhUaf7dekiupbKFFNY8aU/eOEZmnakJpOEhcZWaFot825O8jViC9I0NTLazgwttqnZxnuFIp/0Ljf0j7SR/tJa55T0yMH5pyEjw/yvYLplJKbBlPyl2LpsN37l5HKXFtunOsiK/NLL6rLUoTjO5QGCg750c2UKqL8A1g11sW82kscePQTFKbIRmr271ruFWaxnNNh2W5LuJNcUlLf/t/6ps= leonhard@LeonhardsPC" + ]; } diff --git a/nixos/server/dyndns.py b/nixos/server/dyndns.py new file mode 100644 index 0000000..f6cbdc3 --- /dev/null +++ b/nixos/server/dyndns.py @@ -0,0 +1,3 @@ +from nc_dnsapi import Client, DNSRecord + +pass diff --git a/nixos/server/secrets/default.nix b/nixos/server/secrets/default.nix new file mode 100644 index 0000000..fc3879e --- /dev/null +++ b/nixos/server/secrets/default.nix @@ -0,0 +1,25 @@ +{ + config, + pkgs, + ... +}: +let + keys = builtins.map ( + key: builtins.toString (pkgs.writeText "agenix-key" key) + ) config.kekleo.publicKeys; +in +{ + age.identityPaths = keys; + age.secrets.nc_customer = { + file = ./nc_customer.age; + owner = "dyndns"; + }; + age.secrets.nc_api_password = { + file = ./nc_api_password.age; + owner = "dyndns"; + }; + age.secrets.nc_api_key = { + file = ./nc_api_key.age; + owner = "dyndns"; + }; +} diff --git a/nixos/server/secrets/nc_api_key.age b/nixos/server/secrets/nc_api_key.age new file mode 100644 index 0000000..c56e35f --- /dev/null +++ b/nixos/server/secrets/nc_api_key.age @@ -0,0 +1,13 @@ +age-encryption.org/v1 +-> ssh-rsa 0VNryQ +YH11o9QzKg5u12VpNWVth66TStPbNM1A5LEc2iERk6pt3mh3gMFZ4dY0xCi8unaY +C1xeNd0dmxJwbeCVmEy7zj8IQ9ROAhobv0uFGDJHuqr96HoMxk3iw2/M5up3KCFc +w6cdJWVJzG0UP20Jiu3f3Yw5dCt7bGGr4MWL9XNmzOzXZEfBcnPiXgdhwurRfOR/ +ZR/r06uNzJNb9nyZeAewU4B1WtkfGdzw6T44IheTmXjTSP2woFl64vddnayl64lw +xnoG85jz23ayiB8IDIkE+o5cb/2kfPCQNG3JVd+XGT3SJvJRYHwFl6hfX63G504A +6UzCHMrKG8WeNg0WwR4ViyoEg3Q0ZsExCxBx7itB0/7i/Q4v3bcif1jFFIC2HepC +5M9UcYlHr06qkfITHATnq3pCd+0piolT7k3YwFzeojp/zUUtfnMOFauVNpeEfqy4 +B5deqnbKYt8z0BZsZ377RUbsP7q+Xho6dZmVOEqG3LzzW3aJSbhigduh51vCbimD + +--- yMIQCO5AwTLnXoHXjYHBvXfOIf5vRe/cmNv4mzqlU6s +E½bü¥°<ÕQXH O0q†w¿üç®Ô³‡w$ lyg]¿ÇõñâÒŠ›Άþ´gÇÑH Z"ÉÇn³Q&-U_2ÎõN.–ärg»·™ö3€ \ No newline at end of file diff --git a/nixos/server/secrets/nc_api_password.age b/nixos/server/secrets/nc_api_password.age new file mode 100644 index 0000000000000000000000000000000000000000..f6a14a75fa6c744d8bce76d1478fa35841a92807 GIT binary patch literal 692 zcmYdHPt{G$OD?J`D9Oyv)5|YP*Do{V(zR14F3!*`Do#`|2=gnd4CKl-FEt4Durx3V zFHSYj_73p(4KOsf40H5KH#W^H4|mVE@Hcb~bIZyqDR(yYEz3&{agEB!F!szgsB*7J zOv~nq$}mXHNleRjt4hfzFGvp056sHXPYgE5Nz>0Tb*fCP$V<-(sxql8&#(+n@h&Vk z4=fBdG&eO1b#k=`&N0g53N?2uNpjOKN=(ZO^2jc$N-D2#whS#S^*8Yj4b?6zO?9a- z$;&dX%nA&%jHoC}cXji~EO5%oF3z;fOv&<$;;PJaGtCdq%+=1X^iDK1^|drAb_?>X zs7mw+bPr7p$PF;}@p4JY42iPHjC3na@^f)9bTV_yPWMSq&8jLbOy;V}D9ZFOPx9CH z3C{`lwumsy&rJ6Y@zu`_%PJ2lPYfz9j|?rX$}n|vNeRnyaSt#vERM+X3MzHU%}R3% zN=fH3$WAdRa!*W5bj%AjOb<-4@Gi}DFLSiWGfXY;b_opdE;7h)jWG7Ea13`TG4k~; za&vaib#X0o@eD}z$}B75%6803N_8#s2+dA5D77@M%1C$B&k2euHjMOg3oS7AHz?0^ zukvvXNen2Dv?vb?ib(Ob%yM&y(APFH3M}x?;R-S<$%qOps`R#WF7`7D3`wyxEGV`p z$#L{C$;rwNDGAT@cTd(1Dl@3`uX4@KH%kuJ&dD<^OU)1W&+-rSvgG2@)zww-3G*s- zw(vC1aq@PyOioJ9EHBK;j4I113reZ1tV(ltb}I}|^bT?IaLVWUyfbQhX4UDpKRvkq zecXCW!B!&XSJ;J*%uG$c>@IZO+Y{>j?sY~&cl~;|Udx^D^rwsd>75qwai2_mcVtw1 b{gkFN+3hI|9LFvRgzL}c-tzyl6@M-O1*Z2{ literal 0 HcmV?d00001 diff --git a/nixos/server/secrets/nc_customer.age b/nixos/server/secrets/nc_customer.age new file mode 100644 index 0000000000000000000000000000000000000000..0b8ba9b99e14a3f35ea5ad0f0c359e95d79e28de GIT binary patch literal 648 zcmYdHPt{G$OD?J`D9Oyv)5|YP*Do{V(zR14F3!*`Do#`|2=gnd4CE?{EG-MH2>0^~ z$*Riq^-A(Evhd6_x6rppk1X@>%=0xVHB2&3&QEjl2n%xxGPBS(b+ITZFtaT6j|$7w zHw)$ROE2^eD=-bo^Gzx8GBi!9Eb;a%_sZ}HO*3%~jx5hlE-VQ*FYs}zG>9q<$Vkk| zN(nX$4l4-sEhw?jF3d~iiqfts$jDC0PcE&{Hw`hWvM4ss(vR{9Ezb=LGqm(BHZKjy zDNhS7Ofm{A$hUAyE%c4ZE%ORb$~Dl>42en&;tF$f^+`%Mb4f|o*7htabq;beD>TkY zcMtMR_H)THuZSqh$o4Rc@Ha`WEUijO%&sae@XK;B56nx+ta8lE3gztg1{dFY^j84scEja5l_y3k@^T_OUS4 z&oXj0EX(tBbV)8sH22Bi%J47oEDLeXP4m(ZDmBe54Gs;=bTjn#cJ&E0*EjbyHcKtd zN;D03)h`Lps|q)=ObV|sa`Q8f$O+2KFiSHv=5i_Vb$2QCbPP(i%yrbS2#&0D)2=FU zax2hx3(QMTbM`CNjwp0Xs|fOQ4vh$R@hvrTEY1n@EiU%T*LF2<$>rkG)zwuf^K|wI z56