Skip to content

Commit 0b4f00d

Browse files
VanderscycleVanderscycle
committed
update
1 parent 279f918 commit 0b4f00d

File tree

7 files changed

+196
-147
lines changed

7 files changed

+196
-147
lines changed

‎nix-darwin/flakes/monolith/configuration.nix‎

Lines changed: 28 additions & 121 deletions
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,8 @@
1919
./hardware-configuration.nix
2020
./fstab.nix
2121
./traefik.nix
22-
inputs.sops-nix.nixosModules.sops
22+
./sops.nix
23+
./services
2324
];
2425

2526
nix = {
@@ -83,96 +84,12 @@
8384
sops
8485
git
8586
vim
87+
tree
8688
sysz
8789
samba
8890
openssl
8991
];
9092

91-
# secrets
92-
# if you change the secret strucutre you must first create the new secret and then rebuild and then change its reference in the config
93-
sops = {
94-
defaultSopsFile = ./secrets/secrets.yaml;
95-
defaultSopsFormat = "yaml";
96-
97-
age.keyFile = "/home/${meta.username}/.config/sops/age/keys.txt";
98-
secrets = {
99-
# factorio
100-
"factorio/game-password" = {
101-
owner = meta.username;
102-
};
103-
"factorio/token" = {
104-
owner = meta.username;
105-
};
106-
"factorio/admin" = {
107-
owner = meta.username;
108-
};
109-
# paperless
110-
"paperless/admin/password" = {
111-
owner = meta.username;
112-
};
113-
"paperless/admin/username" = {
114-
owner = meta.username;
115-
};
116-
"paperless/admin/email" = {
117-
owner = meta.username;
118-
};
119-
# smb root user
120-
"home-server/rice/password" = {
121-
owner = "root";
122-
};
123-
"home-server/rice/user" = {
124-
owner = "root";
125-
};
126-
# docker
127-
"docker/homarr/enc_key" = {
128-
owner = "root";
129-
};
130-
# smb systemd user
131-
"home-server/systemd/password" = {
132-
owner = meta.username;
133-
};
134-
"home-server/systemd/user" = {
135-
owner = meta.username;
136-
};
137-
# nextcloud
138-
"nextcloud/admin/password" = {
139-
owner = "root";
140-
};
141-
};
142-
};
143-
systemd.services."smbcreds_fam_root" = {
144-
script = ''
145-
echo "user=$(cat ${config.sops.secrets."home-server/rice/user".path})" > /root/smbcreds_fam
146-
echo "password=$(cat ${config.sops.secrets."home-server/rice/password".path})" >> /root/smbcreds_fam
147-
'';
148-
serviceConfig = {
149-
Type = "oneshot";
150-
User = "root";
151-
WorkingDirectory = "/root/";
152-
};
153-
# Make it run immediately after each system rebuild
154-
wantedBy = [ "multi-user.target" ];
155-
};
156-
157-
# TODO: change the user
158-
systemd.services."smbcreds_fam_general" = {
159-
script = ''
160-
echo "user=$(cat ${
161-
config.sops.secrets."home-server/systemd/user".path
162-
})" > "/home/${meta.username}/smbcreds_fam_user"
163-
echo "password=$(cat ${
164-
config.sops.secrets."home-server/systemd/password".path
165-
})" >> "/home/${meta.username}/smbcreds_fam_user"
166-
'';
167-
serviceConfig = {
168-
Type = "oneshot";
169-
User = meta.username;
170-
WorkingDirectory = "/home/${meta.username}";
171-
};
172-
# Make it run immediately after each system rebuild
173-
wantedBy = [ "multi-user.target" ];
174-
};
175-
17693
systemd.tmpfiles.rules = [
17794
# Copy/Link the save file (use either C or L)
17895
"C /var/lib/factorio/saves/save1.zip - - - - ${builtins.path { path = ./save1.zip; }}"
@@ -272,13 +189,17 @@
272189
systemd.services.n8n.environment = {
273190
N8N_SECURE_COOKIE = "false";
274191
N8N_LISTEN_ADDRESS = "0.0.0.0";
275-
# N8N_PATH = "/n8n";
192+
N8N_METRICS = "true"; # prometheus
193+
# N8N_PATH = "/n8n"; # base url
276194
};
277195
services.gitea = {
278196
enable = true;
279197
settings = {
280198
# server.ROOT_URL = "http://0.0.0.0/gitea/";
281199
server.HTTP_PORT = 3001;
200+
metrics = {
201+
ENABLED = true;
202+
};
282203
};
283204
};
284205
environment.etc."nextcloud-admin-pass".text =
@@ -385,38 +306,27 @@
385306
services.prometheus = {
386307
enable = true;
387308
port = 4011;
388-
};
389-
# systemd.services.paperless = {
390-
# wants = [ "mnt-paperless.mount" ];
391-
# after = [ "mnt-paperless.mount" ];
392-
# serviceConfig = {
393-
# ProtectSystem = "no";
394-
# ProtectHome = false;
395-
# PrivateTmp = false;
396-
# PrivateDevices = false;
397-
# ReadOnlyPaths = [ ];
398-
# ReadWritePaths = [ "/mnt/paperless" ];
399-
# };
400-
# };
401-
402-
services.paperless = {
403-
enable = true;
404-
port = 28981;
405-
address = "localhost";
406-
settings = {
407-
# https://docs.paperless-ngx.com/configuration/
408-
# PAPERLESS_FORCE_SCRIPT_NAME = "/paperless";
409-
# PAPERLESS_STATIC_URL = "/paperless/";
410-
411-
# PAPERLESS_CONSUMPTION_DIR = "/mnt/paperless/consume";
412-
# PAPERLESS_DATA_DIR = "/mnt/paperless/data";
413-
# PAPERLESS_MEDIA_ROOT = "/mnt/paperless/media";
414-
# PAPERLESS_STATICDIR = "/mnt/paperless/static";
415-
416-
PAPERLESS_ADMIN_USER = builtins.readFile config.sops.secrets."paperless/admin/username".path;
417-
PAPERLESS_ADMIN_MAIL = builtins.readFile config.sops.secrets."paperless/admin/email".path;
418-
PAPERLESS_ADMIN_PASSWORD = builtins.readFile config.sops.secrets."paperless/admin/password".path;
309+
exporters.node = {
310+
enable = true;
419311
};
312+
scrapeConfigs = [
313+
{
314+
job_name = "n8n";
315+
static_configs = [
316+
{
317+
targets = [ "n8n.homecloud.lan" ];
318+
}
319+
];
320+
}
321+
{
322+
job_name = "gitea";
323+
static_configs = [
324+
{
325+
targets = [ "gitea.homecloud.lan" ];
326+
}
327+
];
328+
}
329+
];
420330
};
421331

422332
services.transmission = {
@@ -447,9 +357,6 @@
447357
networking = {
448358
hosts = {
449359
"192.168.4.129" = [
450-
"nextcloud.local"
451-
"gitea.local"
452-
"n8n.local"
453360
];
454361
};
455362
defaultGateway = "192.168.4.1"; # Point to Proxmox

‎nix-darwin/flakes/monolith/secrets/secrets.yaml‎

Lines changed: 22 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -1,40 +1,40 @@
1-
game-password: ENC[AES256_GCM,data:MQwNMfEk5VGFkvAwhYSZGw==,iv:ZmspiIzdMabZZR/51hVf2wybfKxm8zZEUGh831pBsYQ=,tag:s0NQPqquIb9EuW49bxx67A==,type:str]
2-
admin: ENC[AES256_GCM,data:N84wluTCsQEghAs=,iv:7d6ff9p7nQixuKmP2ZJQ4Oh90l8WO9qA0gX6g6YFiF0=,tag:wmH545nSEeE/aCvd8atSeg==,type:str]
3-
token: ENC[AES256_GCM,data:NRMmfGJxScikUGcTOWxWVcnb/CcAG7Iow0caHPuY,iv:MCcYF+odmJa7PIXGqIdR1T+0GCvsh1CEBazWFuawoms=,tag:zS1vpKyQOfFDgLwtnaB/UQ==,type:str]
1+
game-password: ENC[AES256_GCM,data:D3yA1Hhms+EKwmVashSh7w==,iv:K9uPoQAG3gu56NmlV6+iHu+eGpw3EYNtzZ+1Hz8ervQ=,tag:K6X6TJi+f0vQpFh2rKjcbg==,type:str]
2+
admin: ENC[AES256_GCM,data:ULENnDB0imv57Q0=,iv:00s70iks/MNEjKqIgXhiT+itarw2pTqIKgxugFfBFA8=,tag:zZ23xRF1gthaEyd1A9dMgw==,type:str]
3+
token: ENC[AES256_GCM,data:202352gHcQ2x8/ZzdQMi4t2HREZoclT+GpfkakwY,iv:UZJKrUYhjvClsLGPgSav0v0u1iDo/LjyTA6xuVXsnSE=,tag:713G5kTG4toZir71iL4iQQ==,type:str]
44
factorio:
5-
game-password: ENC[AES256_GCM,data:14xapHt2pjY/D03JmIvZ8g==,iv:1cZcMnGCHcimDRj1eIZkPO5/txO5PgzDl4hncFavvHM=,tag:JrR4pp/vMUqtSEbGRkQ55Q==,type:str]
6-
admin: ENC[AES256_GCM,data:U9WOCnBSG01u5Ac=,iv:4mJyDg0PIDWgJUwEpWNO8BIjF/XH2z0bbdiLUoU9/sY=,tag:iH139ItX2hEhcMin5Th1/A==,type:str]
7-
token: ENC[AES256_GCM,data:bX+R061FkP1FnSA/TzWCRnVc26FuUUZbvLZcW5YQ,iv:Oi/iZnEczUJxLpBqr1hc5O63+a0rdy9gUn8aqkcdRwM=,tag:zXNSdE1X/jdwEEY/w4cbPA==,type:str]
5+
game-password: ENC[AES256_GCM,data:K4nW5eS+pcYXTT4x1r7kBQ==,iv:t9AkZLdW27WMUgPeZWKb3F4QsfozpTtQcMYmHYx7u+M=,tag:5Yc2B54RfW8YiBgnD/zFpw==,type:str]
6+
admin: ENC[AES256_GCM,data:Btf2joNz2rMcfzs=,iv:+nErFlClsiS8u7zCyIUNvoSd1SrrX4tow+FvynBWCgU=,tag:phq7cOyMuA9dkyAUTyhD9g==,type:str]
7+
token: ENC[AES256_GCM,data:J/hgqD83JpEfp20oRBkUO4zQXFpLjaZSM0fZxNT7,iv:2nNCxmn63nHjK+aZ7BR5WdZSw8sswIDVdtF7n3+Iw3A=,tag:/HJ/ywaEfDG+HaHXJMP0mg==,type:str]
88
home-server:
99
systemd:
10-
user: ENC[AES256_GCM,data:wAn+d+TK,iv:7Vhr6nLkc5sdaABF44Ly/lsaSODRWiamRco/SVwYpUg=,tag:aZIhpZRQ+95ywBXxoR01PQ==,type:str]
11-
password: ENC[AES256_GCM,data:m1bxR5u1edAxLg==,iv:Qj2R87hERS1Og52k7OvCrxtCGl7ncxJjofS86ShVsXc=,tag:No5oVG4bjLThzq8ZDoP4rQ==,type:str]
10+
user: ENC[AES256_GCM,data:bxMVoR49,iv:8EOUrZUF1gTagkgKv1w1Hq+wdPbYhbNks2n7KvHoMNQ=,tag:ZkE1hahrZRWXo6QBdL5q+g==,type:str]
11+
password: ENC[AES256_GCM,data:IxhNQRRYXxZHjg==,iv:kOYJU04kSghPgG/y9Ami3LZPoDpg/uZKNG9xb/XxYas=,tag:yYzcLIMmkekieQbZAZhOkw==,type:str]
1212
rice:
13-
user: ENC[AES256_GCM,data:2twGfFja,iv:Q+rhT4t6MZB1PV5lmnhJgjA67v6K6ulJvPerJznbOGc=,tag:EZonu+RQbsRGq8t1ER3Wrw==,type:str]
14-
password: ENC[AES256_GCM,data:nKX56agLCaORcw==,iv:ZgY8rW/A0112eCqxMFPlbvhYL0IekaeVmMztpvRgIN4=,tag:7IjUcp0K3NFWuM78AMiAcg==,type:str]
13+
user: ENC[AES256_GCM,data:kfHkP5BU,iv:v7IhxiW9u9UukkPd8cbeydzjdTuNKTZHVgdQFZqniq0=,tag:YsKM8dQybrDPHMabRLM0HA==,type:str]
14+
password: ENC[AES256_GCM,data:eMPay82SEjzRyQ==,iv:D3DFud1jqbOrk/hBQCXilgWORWmNhtKbS4Cjbeb4Bls=,tag:SOSmdCK9T6KU8FPYioZ8mw==,type:str]
1515
nextcloud:
1616
admin:
17-
password: ENC[AES256_GCM,data:wnm+iv/TX2JJUQ==,iv:XDBMX8OBgF1PZU8fBiebNJH5lsFEU/yEz5SsxdptqjY=,tag:mVRm/FkcFMA3LxZSaxqBsA==,type:str]
17+
password: ENC[AES256_GCM,data:tPhuahnM57THOg==,iv:iShg8ZZh18AQphI24X6551FDKT/acehfTdwPgQjOlb4=,tag:HNdPnmBt+Wt/USfW1jh4kg==,type:str]
1818
paperless:
1919
admin:
20-
username: ENC[AES256_GCM,data:BIru0G4=,iv:BZDQ4ySXtvqXNu6Q+yl2QcvwbNtQqmcgDQE/XOCkOGg=,tag:Dd2CTyERsPPUlv/9yc/3xg==,type:str]
21-
password: ENC[AES256_GCM,data:G4KTuD4mBm6u,iv:rt8VlAhaj86XGvthorGKm4hKkgMeBjQSTLLrkVoY0L0=,tag:VBX9xAlrwD78k+DXJWpsuA==,type:str]
22-
email: ENC[AES256_GCM,data:hF+8wo8xhTr4wRuYnVC81aMDHKNWrWJLwul1L/vXmOYQ,iv:NYTju0fh7H2M621YWU8itM/UF3c4L0wU+iMsspXSubc=,tag:HPfG5FRlErfvgxGiDwy4oA==,type:str]
20+
username: ENC[AES256_GCM,data:oc7yIA==,iv:nRxbFAT/caXU5LxfRP2b4S3hvCRZmGsYEZTctZMRGUw=,tag:NyrVH30z9Lbd4INAjmyQLg==,type:str]
21+
password: ENC[AES256_GCM,data:d2FFhqV+Iwob,iv:CY6KzS1XFKq2M4P1Wh8wrNOrSoyJjY86m9guz4Z+FwE=,tag:z4UKmNLHJ0daqtELkTrPog==,type:str]
22+
email: ENC[AES256_GCM,data:aqrMJtcdPlGA276DYl0nr5wRTvloJGI65j+8mPCNLlWZ,iv:Z8z5hgBjqQ47jUrAt6lmeGoP/By50/hfPB08WPbUjEI=,tag:AbLWOBNOdB5rqMtW27moqw==,type:str]
2323
docker:
2424
homarr:
25-
enc_key: ENC[AES256_GCM,data:gD1LWBWsWmNOWCLRHB5PX+NN8Z9fY/5l2i/ij7oJQXpJBvTFKmxW5MIUCxNMtYBa4ixkicm9rfHUssrO2aCHGQ==,iv:dH3hP3kDsbzoIOViFxRVZEbvNobzIji4ApjMyb1jqK0=,tag:QF5OvSzx3U4ppXm+sNDKGQ==,type:str]
25+
enc_key: ENC[AES256_GCM,data:Igole8lbilV4POI6bzHJ1khrkJ0PTG9tA9qEEyf/o+HI/zQd+hEqHjE/a5DjTU/8zKWZqkj/uyNTaau8htGaGw==,iv:QnGf3n+TxALNO/yMNmu/IM53fIX63nXAQt7BnZXdjUs=,tag:edSCkai3/IJYgRX1YY/79A==,type:str]
2626
sops:
2727
age:
2828
- recipient: age1df2u7xvze6rq5utz74ckx059wr3z97j484wc04063437h6hn4v6s9auec3
2929
enc: |
3030
-----BEGIN AGE ENCRYPTED FILE-----
31-
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA1NHNuTWhVOXo0K3I0M0x1
32-
cWRWeFcyc2ZxendwRnNRazRadk5BU1VhaVR3CmgzcHFUa3duVnVVcUNST25SRjVD
33-
UFgxR3RqcnIrd3Z4VFpOZTE2UUFqYVEKLS0tIFozellXRFlPZXIwWlk4VXRTY2NZ
34-
OTZxZ0tzbmwvbDZ3b3ltOUphclBERVUKU9e+Rn4yXqqChk5JqfOkCSHX90Shkrh3
35-
HTMLSw3ABXr/ttFfnzqRGMFhMuS6jawAMuInOIyNQKPWQ8NL6gIsqw==
31+
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBjUWRIbVVtMkl4bGhZY2Y1
32+
QjVCVHdPR2tqbGFJSzRiZCswa0FQTSthZEJvCmR0T2ZZTE5XUFFLeWtMOTh4KzNP
33+
UlBXcGpEWEozTGkvVGtQZmZhYzJwV0EKLS0tIDEzb2kyUjNkSWJKZHZGb1g5ZkFU
34+
REYvMG10ZlRXSTFZWnpQZW9pT1pSUDgKsu7T5fv2Y5te0HGGDI3s46vKdUU2GFJb
35+
yRGvoGflnfRfmDS92QkyKaQIrwDA+S3/wCjXq6O651XCQFcC7tYqxg==
3636
-----END AGE ENCRYPTED FILE-----
37-
lastmodified: "2025-06-24T05:24:51Z"
38-
mac: ENC[AES256_GCM,data:FYH0xDUwGJtZqBWErzSI9HDmTCy3HrYsbGvcEJUaG4f6PBcbiYz3PqZ71ec9v6u8YeZVBi6pA2QQS8rvJ73H/4knRw7sB3WAJ74YBPHcuLXy+bagPanzMCpff98rVr1yaDOC8dQlchPQTNnDPJFbxQ22Kh2vOMVBNOy8QDWyhUA=,iv:UwqBDb8BjDZS7R90eqtOG+KO56fyTQXR7kYZEjItmAQ=,tag:WaU/6gIx/KsaKUpQ9IoOLw==,type:str]
37+
lastmodified: "2025-07-07T05:06:44Z"
38+
mac: ENC[AES256_GCM,data:R1Hfxuzsq54ekijB4nUhmZPKjf3vFJ3NXZmEkexWLsexWSGyh9BVCUMWkKdHj6gFwJSvyE6h07FOh3pixzsLGaU9Pv4tobrwiQ6MLMovJzRaGAeWkhUejna93HZVe1mnFglxUXTZjpOtepdpha0Bhiti3IdTc4lIwjWeLpTRbWM=,iv:wtpM6MlPwbuZueAG0s4oeSNuqM0acHQx9TTHm9/vtz0=,tag:D51Wy8oR/106v0Mq7tyYXQ==,type:str]
3939
unencrypted_suffix: _unencrypted
4040
version: 3.10.2

‎nix-darwin/flakes/monolith/services/default.nix‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
{ ... }:
2+
{
3+
imports = [
4+
./paperless.nix
5+
];
6+
}

‎nix-darwin/flakes/monolith/services/paperless.nix‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
{ config, ... }:
2+
{
3+
systemd.services.paperless = {
4+
wants = [ "mnt-paperless.mount" ];
5+
after = [ "mnt-paperless.mount" ];
6+
serviceConfig = {
7+
ProtectSystem = "no";
8+
ProtectHome = false;
9+
PrivateTmp = false;
10+
PrivateDevices = false;
11+
ReadOnlyPaths = [ ];
12+
ReadWritePaths = [ "/mnt/paperless" ];
13+
};
14+
};
15+
16+
users.users.paperless = {
17+
isNormalUser = false;
18+
extraGroups = [
19+
"smbaccess"
20+
];
21+
};
22+
environment.etc."paperless-admin-pass".text =
23+
builtins.readFile
24+
config.sops.secrets."paperless/admin/password".path;
25+
26+
services.paperless = {
27+
passwordFile = "/etc/paperless-admin-pass";
28+
enable = true;
29+
port = 28981;
30+
address = "127.0.0.1";
31+
settings = {
32+
# PAPERLESS_CONSUMPTION_DIR = "/mnt/paperless/consume";
33+
# PAPERLESS_DATA_DIR = "/mnt/paperless/data";
34+
# PAPERLESS_MEDIA_ROOT = "/mnt/paperless/media";
35+
# PAPERLESS_STATICDIR = "/mnt/paperless/static";
36+
# https://docs.paperless-ngx.com/configuration/
37+
# PAPERLESS_FORCE_SCRIPT_NAME = "/paperless";
38+
# PAPERLESS_STATIC_URL = "/paperless/";
39+
40+
# PAPERLESS_ADMIN_USER = builtins.readFile config.sops.secrets."paperless/admin/username".path;
41+
# PAPERLESS_ADMIN_MAIL = builtins.readFile config.sops.secrets."paperless/admin/email".path;
42+
# PAPERLESS_ADMIN_PASSWORD = builtins.readFile config.sops.secrets."paperless/admin/password".path;
43+
};
44+
};
45+
}

0 commit comments

Comments
 (0)