wurzel/fruitbasket
9
1
Fork 0
Code Issues 5 Pull requests Packages Projects Releases Wiki Activity

secrets for mediawiki and formatting

Browse source
This commit is contained in:
revol-xut 2022-09-06 17:16:31 +02:00
parent 7131ba8691
commit 87bd442eed
No known key found for this signature in database
GPG key ID: 4F56FF7759627D07
18 changed files with 255 additions and 234 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
flake.nix
View file

@ -60,6 +60,7 @@
./modules/keycloak.nix ./modules/keycloak.nix
./modules/nginx.nix ./modules/nginx.nix
./modules/hedgedoc.nix ./modules/hedgedoc.nix
./modules/wiki.nix
{ {
sops.defaultSopsFile = ./secrets/durian.yaml; sops.defaultSopsFile = ./secrets/durian.yaml;
} }

3
hosts/birne/configuration.nix
View file

@ -5,7 +5,8 @@
{ config, pkgs, ... }: { config, pkgs, ... }:
{ {
imports =[ # Include the results of the hardware scan. imports = [
# Include the results of the hardware scan.
./hardware-configuration.nix ./hardware-configuration.nix
]; ];

12
hosts/birne/hardware-configuration.nix
View file

@ -5,7 +5,8 @@
{ {
imports = imports =
[ (modulesPath + "/installer/scan/not-detected.nix") [
(modulesPath + "/installer/scan/not-detected.nix")
]; ];
boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "ohci_pci" "ehci_pci" "usb_storage" "sd_mod" "rtsx_pci_sdmmc" ]; boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "ohci_pci" "ehci_pci" "usb_storage" "sd_mod" "rtsx_pci_sdmmc" ];
@ -14,18 +15,19 @@
boot.extraModulePackages = [ config.boot.kernelPackages.broadcom_sta ]; boot.extraModulePackages = [ config.boot.kernelPackages.broadcom_sta ];
fileSystems."/" = fileSystems."/" =
{ device = "/dev/disk/by-uuid/9799b183-a191-484e-b9a4-05e29412af25"; {
device = "/dev/disk/by-uuid/9799b183-a191-484e-b9a4-05e29412af25";
fsType = "ext4"; fsType = "ext4";
}; };
fileSystems."/boot" = fileSystems."/boot" =
{ device = "/dev/disk/by-uuid/CF58-EB12"; {
device = "/dev/disk/by-uuid/CF58-EB12";
fsType = "vfat"; fsType = "vfat";
}; };
swapDevices = swapDevices =
[ { device = "/dev/disk/by-uuid/94622e8e-8b58-4b3b-9494-d144ccaeb486"; } [{ device = "/dev/disk/by-uuid/94622e8e-8b58-4b3b-9494-d144ccaeb486"; }];
];
hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware; hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
} }

3
hosts/quitte/configuration.nix
View file

@ -6,7 +6,8 @@
{ {
imports = imports =
[ # Include the results of the hardware scan. [
# Include the results of the hardware scan.
./hardware-configuration.nix ./hardware-configuration.nix
]; ];

21
hosts/quitte/hardware-configuration.nix
View file

@ -5,7 +5,8 @@
{ {
imports = imports =
[ (modulesPath + "/installer/scan/not-detected.nix") [
(modulesPath + "/installer/scan/not-detected.nix")
]; ];
boot.initrd.availableKernelModules = [ "megaraid_sas" "xhci_pci" "ahci" "usbhid" "usb_storage" "sd_mod" "sr_mod" ]; boot.initrd.availableKernelModules = [ "megaraid_sas" "xhci_pci" "ahci" "usbhid" "usb_storage" "sd_mod" "sr_mod" ];
@ -14,36 +15,42 @@
boot.extraModulePackages = [ ]; boot.extraModulePackages = [ ];
fileSystems."/" = fileSystems."/" =
{ device = "rpool/nixos/root"; {
device = "rpool/nixos/root";
fsType = "zfs"; fsType = "zfs";
options = [ "zfsutil" ]; options = [ "zfsutil" ];
}; };
fileSystems."/home" = fileSystems."/home" =
{ device = "rpool/nixos/home"; {
device = "rpool/nixos/home";
fsType = "zfs"; fsType = "zfs";
options = [ "zfsutil" ]; options = [ "zfsutil" ];
}; };
fileSystems."/var/lib" = fileSystems."/var/lib" =
{ device = "rpool/nixos/var/lib"; {
device = "rpool/nixos/var/lib";
fsType = "zfs"; fsType = "zfs";
options = [ "zfsutil" ]; options = [ "zfsutil" ];
}; };
fileSystems."/var/log" = fileSystems."/var/log" =
{ device = "rpool/nixos/var/log"; {
device = "rpool/nixos/var/log";
fsType = "zfs"; fsType = "zfs";
options = [ "zfsutil" ]; options = [ "zfsutil" ];
}; };
fileSystems."/boot" = fileSystems."/boot" =
{ device = "/dev/disk/by-uuid/7FE6-F583"; {
device = "/dev/disk/by-uuid/7FE6-F583";
fsType = "vfat"; fsType = "vfat";
}; };
fileSystems."/nix" = fileSystems."/nix" =
{ device = "rpool/nixos/nix"; {
device = "rpool/nixos/nix";
fsType = "zfs"; fsType = "zfs";
options = [ "zfsutil" ]; options = [ "zfsutil" ];
}; };

3
modules/desktop.nix
View file

@ -10,7 +10,8 @@ extra_office_packages = (lib.ifEnable config.fsr.enable_office_bloat (with pkgs;
])); ]));
in { in
{
# enable XFCE as lightweight desktop environment # enable XFCE as lightweight desktop environment
services = { services = {
xserver.enable = true; xserver.enable = true;

3
modules/hedgedoc.nix
View file

@ -1,7 +1,8 @@
{ config, pkgs, lib, ... }: { config, pkgs, lib, ... }:
let let
domain = "pad.quitte.tassilo-tanneberger.de"; domain = "pad.quitte.tassilo-tanneberger.de";
in { in
{
services = { services = {
postgresql = { postgresql = {
enable = true; enable = true;

3
modules/infoscreen.nix
View file

@ -2,7 +2,8 @@
let let
fsr-infoscreen = pkgs.fsr-infoscreen; fsr-infoscreen = pkgs.fsr-infoscreen;
in { in
{
systemd = { systemd = {
services."fsr-infoscreen" = { services."fsr-infoscreen" = {

3
modules/keycloak.nix
View file

@ -52,7 +52,8 @@
"/" = "/" =
let let
cfg = config.services.keycloak.settings; cfg = config.services.keycloak.settings;
in { in
{
proxyPass = "http://${cfg.http-host}:${toString cfg.http-port}"; proxyPass = "http://${cfg.http-host}:${toString cfg.http-port}";
}; };
}; };

3
modules/wifi.nix
View file

@ -6,7 +6,8 @@
{ pkgs, config, ... }: { pkgs, config, ... }:
let let
password = "$(${pkgs.coreutils}/bin/cat /run/secrets/fsr_wifi_psk)"; password = "$(${pkgs.coreutils}/bin/cat /run/secrets/fsr_wifi_psk)";
in { in
{
networking = { networking = {
wireless = { wireless = {
enable = true; enable = true;

6
modules/wiki.nix
View file

@ -1,10 +1,12 @@
{ config, pkgs, lib, ... }: { config, pkgs, lib, ... }:
{ {
sops.secrets.postgres_mediawiki.owner = config.systemd.services.mediawiki.serviceConfig.User; sops.secrets.postgres_mediawiki.owner = config.systemd.services.mediawiki.serviceConfig.User;
sops.secrets.mediawiki_initial_admin.owner = config.systemd.services.mediawiki.serviceConfig.User;
services = { services = {
mediawiki = { mediawiki = {
enable = true; enable = true;
name = "FSR Wiki"; name = "FSR Wiki";
passwordFile = config.sops.secrets.mediawiki_initial_admin.path;
database = { database = {
user = "mediawiki"; user = "mediawiki";
type = "postgres"; type = "postgres";
@ -13,7 +15,7 @@
name = "mediawiki"; name = "mediawiki";
host = "localhost"; host = "localhost";
passwordFile = config.sops.secrets.postgres_mediawiki.path; passwordFile = config.sops.secrets.postgres_mediawiki.path;
createLocally = true; createLocally = false;
}; };
virtualHost = { virtualHost = {
hostName = "wiki.quitte.tassilo-tanneberger.de"; hostName = "wiki.quitte.tassilo-tanneberger.de";
@ -22,7 +24,7 @@
enableACME = true; enableACME = true;
}; };
}; };
postgres = { postgresql = {
enable = true; enable = true;
}; };
}; };

3
pkgs/server.nix
View file

@ -39,7 +39,8 @@ flask-misaka = pkgs.python39Packages.buildPythonPackage rec {
in pkgs.python39Packages.buildPythonApplication rec { in
pkgs.python39Packages.buildPythonApplication rec {
pname = "fsr-infoscreen"; pname = "fsr-infoscreen";
version = "2.1.0"; version = "2.1.0";

5
secrets/durian.yaml
View file

@ -2,6 +2,7 @@ postgres_keycloak: ENC[AES256_GCM,data:Vi0NLjpYDvFGIYYL/VPdgOqAS51KXQynBFlBjK64e
postgres_hedgedoc: ENC[AES256_GCM,data:VCoWXZbNGWfmorTNZRFWkDUp0B5JMmsA+bJFVrUREj0=,iv:fnSs3FOgmFn5/BqKTODpwIq023ZRMF8s/JiDyf2ZqkE=,tag:oit5sHf6QffhYYi/WJk5SQ==,type:str] postgres_hedgedoc: ENC[AES256_GCM,data:VCoWXZbNGWfmorTNZRFWkDUp0B5JMmsA+bJFVrUREj0=,iv:fnSs3FOgmFn5/BqKTODpwIq023ZRMF8s/JiDyf2ZqkE=,tag:oit5sHf6QffhYYi/WJk5SQ==,type:str]
hedgedoc_session_secret: ENC[AES256_GCM,data:uz7KggZqeZ2eqiCnOcnYh2I1p5BBXTQbC8PUhB2kM2U=,iv:aJDHKCPkccCT/OF6AGZMfRESNmoV9muGHbuCUfLQhH8=,tag:uEVXylpE8MSebqRr+4mQOw==,type:str] hedgedoc_session_secret: ENC[AES256_GCM,data:uz7KggZqeZ2eqiCnOcnYh2I1p5BBXTQbC8PUhB2kM2U=,iv:aJDHKCPkccCT/OF6AGZMfRESNmoV9muGHbuCUfLQhH8=,tag:uEVXylpE8MSebqRr+4mQOw==,type:str]
postgres_mediawiki: ENC[AES256_GCM,data:abxT4VB9c0YwqHI8OLvfLFjpJoLAoDNNE9ml58BpD2A=,iv:jn7e3oDWtADuK3o8x26uRbwruQ07zglMyXpThBV6uG0=,tag:9NF49KqdXoAgz8U/VWIKsg==,type:str] postgres_mediawiki: ENC[AES256_GCM,data:abxT4VB9c0YwqHI8OLvfLFjpJoLAoDNNE9ml58BpD2A=,iv:jn7e3oDWtADuK3o8x26uRbwruQ07zglMyXpThBV6uG0=,tag:9NF49KqdXoAgz8U/VWIKsg==,type:str]
mediawiki_initial_admin: ENC[AES256_GCM,data:V62NRMkQaXqHl4Jj69BNsprafEqszeoHiLWurexLuvs=,iv:aSZJLviR0Tt2RCeb22pPP4i/B4APNFvU1l8ipeNvER8=,tag:mWv8fN1RZwJHUqIxQonO8Q==,type:str]
sops: sops:
kms: [] kms: []
gcp_kms: [] gcp_kms: []
@ -17,8 +18,8 @@ sops:
bzNnbFZnZnZiY0xsbVlvUStBblBMWGcK7HSz9iFQiH0BJ3etF09opJreBoBtiBZ0 bzNnbFZnZnZiY0xsbVlvUStBblBMWGcK7HSz9iFQiH0BJ3etF09opJreBoBtiBZ0
L74EBGuEV4+dNWqY3QwAASmDYJJ8ocQMuAgctjsgstKBKUeOrkhDRg== L74EBGuEV4+dNWqY3QwAASmDYJJ8ocQMuAgctjsgstKBKUeOrkhDRg==
-----END AGE ENCRYPTED FILE----- -----END AGE ENCRYPTED FILE-----
lastmodified: "2022-09-06T15:00:39Z" lastmodified: "2022-09-06T15:14:55Z"
mac: ENC[AES256_GCM,data:Arjto/Cl6wcF99jUOWGZB28NME4t68oYL0yGdjUMTUCU+CKz2Y2sX82ncb6JpRPrSEzzhFAiEqK0QuXvxrgPnBp7MH0+fS8rNa87LEVOoesDnv0pcCZQXxDsJypNMkzEz1aZVEr9U212vulbShyz8HKcGioy5fLSx98fTCpaK/c=,iv:Bng+AlN0rnkXwMNiOKR8dIa3cf1sT8xpC8CFV0/xods=,tag:cKfI0BVDCKtV1W8j9riP/w==,type:str] mac: ENC[AES256_GCM,data:jd8op8K6jIyzUwiCX/6I716EI903rVZIMIRvxM/8w+oxqNVwaKGgY8IwQ3psg9SsGg+Sq+CNrm0Rf58Urz9hUywk2z70k/u/+5qWO7qUUuHNpYDLCLsOQ/BjYN+ZDATVFaD2hC+xYfwNKQXPPRTnnZ8oQ4AgybkSmrnjC13GCyM=,iv:VWKZITb/6wZe5lkru93AL27Pf/o1OCOPC0neNRRY79U=,tag:W3SBWD4ypcJx3mgRdWSNug==,type:str]
pgp: pgp:
- created_at: "2022-08-16T13:01:34Z" - created_at: "2022-08-16T13:01:34Z"
enc: | enc: |