rrvsh/pantheon
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

refactor(sops): changed config around and centralised systems

Browse source
This commit is contained in:
Mohammad Rafiq 2025-03-26 22:00:57 +08:00
parent a5701f22d5
commit 5a2d890e70
No known key found for this signature in database
11 changed files with 112 additions and 180 deletions
Download patch file Download diff file Expand all files Collapse all files

99
systems/modules/common.nix
View file

@ -1,58 +1,57 @@
{
inputs,
pkgs,
config,
...
}:
{
imports = [
./networking.nix
./shell.nix
./stylix.nix
./sops.nix
./pipewire.nix
./programs/tailscale.nix
./programs/zsh.nix
inputs.nix-index-database.nixosModules.nix-index
inputs.sops-nix.nixosModules.sops
];
users.mutableUsers = false; # Always reset users on system activation
users.users.rafiq = {
isNormalUser = true;
description = "rafiq";
hashedPasswordFile = config.sops.secrets.hashed_password_rafiq.path;
hashedPasswordFile = config.sops.secrets.password.path;
extraGroups = [
"networkmanager"
"wheel"
];
openssh.authorizedKeys.keys = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILv8HqazE294YdyGaXK6q2EniDlTpGaUL071kk9+W0GJ rafiq@nemesis"
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICbZfOYt6zydLyO4f9JAsxb1i6kHAjYzqa0SOqef6MKM rafiq@orpheus"
];
};
environment = {
sessionVariables = {
CWP_JIRA_ACCESS_KEY_FILE = config.sops.secrets.cwp_jira_access_key.path;
CWP_JIRA_LINK_FILE = config.sops.secrets.cwp_jira_link.path;
};
systemPackages = with pkgs; [
git
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILdsZyY3gu8IGB8MzMnLdh+ClDxQQ2RYG9rkeetIKq8n rafiq"
];
};
security.sudo.wheelNeedsPassword = false;
# Enable basic fonts for reasonable Unicode coverage
fonts.enableDefaultPackages = true;
nixpkgs.config.allowUnfree = true;
nix.settings.experimental-features = [
"nix-command"
"flakes"
];
nix.settings.trusted-users = [
"root"
"@wheel"
];
nix = {
settings.experimental-features = [
"nix-command"
"flakes"
"pipe-operators"
];
# Add binary caches to avoid having to compile them
settings = {
substituters = [
"https://hyprland.cachix.org"
"https://cuda-maintainers.cachix.org"
"https://nix-community.cachix.org"
"https://nvf.cachix.org"
"https://yazi.cachix.org"
];
trusted-public-keys = [
"hyprland.cachix.org-1:a7pgxzMz7+chwVL3/pzj6jIBMioiJM7ypFP8PwtkuGc="
"cuda-maintainers.cachix.org-1:0dq3bujKpuEPMCX6U4WylrUDZ9JyUG0VpVZa7CNfq5E="
"nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
"nvf.cachix.org-1:GMQWiUhZ6ux9D5CvFFMwnc2nFrUHTeGaXRlVBXo+naI="
"yazi.cachix.org-1:Dcdz63NZKfvUCbDGngQDAZq6kOroIrFoyO064uvLh8k="
];
};
};
time.timeZone = "Asia/Singapore";
@ -70,11 +69,39 @@
LC_TIME = "en_SG.UTF-8";
};
nix.gc = {
automatic = true;
dates = "daily";
options = "-d";
programs.nix-index-database.comma.enable = true;
networking = {
networkmanager.enable = true;
networkmanager.wifi.backend = "iwd";
# Configures a simple stateful firewall.
# By default, it doesn't allow any incoming connections.
firewall = {
enable = true;
allowedTCPPorts = [
22 # SSH
];
allowedUDPPorts = [ ];
};
interfaces.enp12s0.wakeOnLan.policy = [
"phy"
"unicast"
"multicast"
"broadcast"
"arp"
"magic"
"secureon"
];
interfaces.enp12s0.wakeOnLan.enable = true;
};
programs.nix-index-database.comma.enable = true;
services.openssh.enable = true;
sops = {
defaultSopsFile = ../../secrets/secrets.yaml;
age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
secrets.password.neededForUsers = true;
};
}