feat: add agenix, some secrets and dyndns user

nixos/server/default.nix

@@ -1,22 +1,53 @@
 {
   inputs,
   outputs,
+  config,
+  pkgs,
   ...
 }:
+let
+  dyndnsScript = pkgs.writeScript "dyndns.py" (builtins.readFile ./dyndns.py);
+in
 {
   imports = [
     (import ../base.nix { inherit inputs outputs; })
     ./hardware-configuration.nix
+    ./secrets
+    inputs.agenix.nixosModules.default
   ];
 
+  users.groups.dyndns = { };
   users.users = {
     leonhard = {
       initialPassword = "leonhard";
       isNormalUser = true;
       extraGroups = [ "wheel" ];
-      openssh.authorizedKeys.keys = [
-        "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDPegeAIABaY9DyWumihNZBlzfdduycvurwYYqoZrdkov2pRVJt8eFhXe+5tdLTKiAq58yzkJ6Zj3CuYb3XuQxX/aDvY4covDXjn1tGKf32xkhTuLd9eDGbFishiC+qROp2/3eZ01DwuttHWo3n/jwOwL3M9mw9Now2i2qaTGuq8wfG5XJ9Cp2+3Ly+mChhtff7Us65dWihNbR3k2WLLvdPJ2HMjeZder0u/IsTTGJj/sytEGt0LPqFOJMl0QuqemkzbeoSAEpVl4huXp5LVT7be2UUmRuekg0p2+EopHunMhUaf7dekiupbKFFNY8aU/eOEZmnakJpOEhcZWaFot825O8jViC9I0NTLazgwttqnZxnuFIp/0Ljf0j7SR/tJa55T0yMH5pyEjw/yvYLplJKbBlPyl2LpsN37l5HKXFtunOsiK/NLL6rLUoTjO5QGCg750c2UKqL8A1g11sW82kscePQTFKbIRmr271ruFWaxnNNh2W5LuJNcUlLf/t/6ps= leonhard"
-      ];
+      openssh.authorizedKeys.keys = config.kekleo.publicKeys;
+    };
+    dyndns = {
+      isSystemUser = true;
+      group = "dyndns";
+      packages = [ pkgs.python313Packages.nc-dnsapi ];
+    };
+  };
+
+  systemd.timers."dyndns" = {
+    wantedBy = [ "timers.target" ];
+    timerConfig = {
+      OnBootSec = "5m";
+      OnUnitActiveSec = "5m";
+      Unit = "dyndns.service";
+    };
+  };
+
+  systemd.services."dyndns" = {
+    script = ''
+      set -eu
+      ${pkgs.python313}/bin/python3 ${dyndnsScript}
+    '';
+    serviceConfig = {
+      Type = "oneshot";
+      User = "dyndns";
     };
   };
 
@@ -52,4 +83,7 @@
   };
 
   kekleo.graphical = false;
+  kekleo.publicKeys = [
+    "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDPegeAIABaY9DyWumihNZBlzfdduycvurwYYqoZrdkov2pRVJt8eFhXe+5tdLTKiAq58yzkJ6Zj3CuYb3XuQxX/aDvY4covDXjn1tGKf32xkhTuLd9eDGbFishiC+qROp2/3eZ01DwuttHWo3n/jwOwL3M9mw9Now2i2qaTGuq8wfG5XJ9Cp2+3Ly+mChhtff7Us65dWihNbR3k2WLLvdPJ2HMjeZder0u/IsTTGJj/sytEGt0LPqFOJMl0QuqemkzbeoSAEpVl4huXp5LVT7be2UUmRuekg0p2+EopHunMhUaf7dekiupbKFFNY8aU/eOEZmnakJpOEhcZWaFot825O8jViC9I0NTLazgwttqnZxnuFIp/0Ljf0j7SR/tJa55T0yMH5pyEjw/yvYLplJKbBlPyl2LpsN37l5HKXFtunOsiK/NLL6rLUoTjO5QGCg750c2UKqL8A1g11sW82kscePQTFKbIRmr271ruFWaxnNNh2W5LuJNcUlLf/t/6ps= leonhard@LeonhardsPC"
+  ];
 }

nixos/server/dyndns.py

@@ -0,0 +1,3 @@
+from nc_dnsapi import Client, DNSRecord
+
+pass

nixos/server/secrets/default.nix

@@ -0,0 +1,25 @@
+{
+  config,
+  pkgs,
+  ...
+}:
+let
+  keys = builtins.map (
+    key: builtins.toString (pkgs.writeText "agenix-key" key)
+  ) config.kekleo.publicKeys;
+in
+{
+  age.identityPaths = keys;
+  age.secrets.nc_customer = {
+    file = ./nc_customer.age;
+    owner = "dyndns";
+  };
+  age.secrets.nc_api_password = {
+    file = ./nc_api_password.age;
+    owner = "dyndns";
+  };
+  age.secrets.nc_api_key = {
+    file = ./nc_api_key.age;
+    owner = "dyndns";
+  };
+}

nixos/server/secrets/nc_api_key.age

@@ -0,0 +1,13 @@
+age-encryption.org/v1
+-> ssh-rsa 0VNryQ
+YH11o9QzKg5u12VpNWVth66TStPbNM1A5LEc2iERk6pt3mh3gMFZ4dY0xCi8unaY
+C1xeNd0dmxJwbeCVmEy7zj8IQ9ROAhobv0uFGDJHuqr96HoMxk3iw2/M5up3KCFc
+w6cdJWVJzG0UP20Jiu3f3Yw5dCt7bGGr4MWL9XNmzOzXZEfBcnPiXgdhwurRfOR/
+ZR/r06uNzJNb9nyZeAewU4B1WtkfGdzw6T44IheTmXjTSP2woFl64vddnayl64lw
+xnoG85jz23ayiB8IDIkE+o5cb/2kfPCQNG3JVd+XGT3SJvJRYHwFl6hfX63G504A
+6UzCHMrKG8WeNg0WwR4ViyoEg3Q0ZsExCxBx7itB0/7i/Q4v3bcif1jFFIC2HepC
+5M9UcYlHr06qkfITHATnq3pCd+0piolT7k3YwFzeojp/zUUtfnMOFauVNpeEfqy4
+B5deqnbKYt8z0BZsZ377RUbsP7q+Xho6dZmVOEqG3LzzW3aJSbhigduh51vCbimD
+
+--- yMIQCO5AwTLnXoHXjYHBvXfOIf5vRe/cmNv4mzqlU6s
+E½b�ü¥°<ÕQXHO0q†w¿üç®Ô³‡w$lyg]¿ÇõñâÒŠ›Άþ´gÇÑH␍Z
�"ÉÇn³Q
&-U_2
ÎõN.–ärg»·™ö3€