f926b4d61a
Here is my first attempt to manage secrets when I deploy onto a NixOS machine. Background: When I develop, I use direnv, which reads an .envrc file in which I define my secrets. My secrets are read from `pass` using a pattern like this... ```shell secret_value="$(pass show path/to/secret)" ``` ...Thus far, I've found this pattern convenient. `pass show` invokes GPG, which asks me for a password to authenticate. This means that when I cd into a directory with an .envrc file using this pattern, I may be prompted by GPG for a password. When I'm not, it's because gpg-agent is still caching my password. This works for development, but I currently do not know how to use direnv for deployments. Here is what I'm using until I find a more convenient solution: - Store the secrets in /etc/secrets on socrates. Ensure that the /etc/secrets directory and its contents are only readable by root. - Use systemd's Environment and NixOS's builtins.readFile to read the files in /etc/secrets when I can `sudo nixos-rebuild`. Ideally I could call a function like `builtins.readFromPasswordStore` within configuration.nix. This would allow me to skip the step where I run... ```shell > ssh socrates > pass show finance/monzo/client-id | sudo tee /etc/secrets/monzo-client-id > pass show finance/monzo/client-secret | sudo tee /etc/secrets/monzo-client-secret > # etc ``` ...I don't know how to manage secrets using NixOS, but at least this is one answer.
149 lines
3.8 KiB
Nix
149 lines
3.8 KiB
Nix
{ pkgs ? import <nixpkgs> {}, ... }:
|
|
|
|
let
|
|
trimNewline = x: pkgs.lib.removeSuffix "\n" x;
|
|
readSecret = x: trimNewline (builtins.readFile ("/etc/secrets/" + x));
|
|
in {
|
|
imports = [ ./hardware.nix ];
|
|
|
|
# Use the systemd-boot EFI boot loader.
|
|
boot.loader.systemd-boot.enable = true;
|
|
boot.loader.efi.canTouchEfiVariables = true;
|
|
|
|
networking = {
|
|
hostName = "socrates";
|
|
# The global useDHCP flag is deprecated, therefore explicitly set to false
|
|
# here. Per-interface useDHCP will be mandatory in the future, so this
|
|
# generated config replicates the default behaviour.
|
|
useDHCP = false;
|
|
networkmanager.enable = true;
|
|
interfaces.enp2s0f1.useDHCP = true;
|
|
interfaces.wlp3s0.useDHCP = true;
|
|
firewall.allowedTCPPorts = [ 9418 80 443 ];
|
|
};
|
|
|
|
time.timeZone = "UTC";
|
|
|
|
programs.fish.enable = true;
|
|
programs.mosh.enable = true;
|
|
|
|
environment.systemPackages = with pkgs; [
|
|
curl
|
|
direnv
|
|
emacs26-nox
|
|
gnupg
|
|
htop
|
|
pass
|
|
vim
|
|
certbot
|
|
tree
|
|
git
|
|
];
|
|
|
|
users = {
|
|
# I need a git group to run the git server.
|
|
groups.git = {};
|
|
|
|
users.wpcarro = {
|
|
isNormalUser = true;
|
|
extraGroups = [ "git" "wheel" ];
|
|
shell = pkgs.fish;
|
|
};
|
|
|
|
users.git = {
|
|
group = "git";
|
|
isNormalUser = false;
|
|
};
|
|
};
|
|
|
|
nix = {
|
|
# Expose depot as <depot>, nixpkgs as <nixpkgs>
|
|
nixPath = [
|
|
"briefcase=/home/wpcarro/briefcase"
|
|
"depot=/home/wpcarro/depot"
|
|
"nixpkgs=/home/wpcarro/nixpkgs"
|
|
];
|
|
|
|
# Allow wpcarro to call nixos-rebuild
|
|
trustedUsers = [ "root" "wpcarro" ];
|
|
};
|
|
|
|
##############################################################################
|
|
# Services
|
|
##############################################################################
|
|
services.openssh.enable = true;
|
|
|
|
services.lorri.enable = true;
|
|
|
|
systemd.user.services.monzo-token-server = {
|
|
enable = true;
|
|
description = "Ensure my Monzo access token is valid";
|
|
script = "/home/wpcarro/.nix-profile/bin/token-server";
|
|
|
|
environment = {
|
|
monzo_client_id = readSecret "monzo-client-id";
|
|
monzo_client_secret = readSecret "monzo-client-secret";
|
|
ynab_personal_access_token = readSecret "ynab-personal-access-token";
|
|
ynab_account_id = readSecret "ynab-account-id";
|
|
ynab_budget_id = readSecret "ynab-budget-id";
|
|
};
|
|
|
|
serviceConfig = {
|
|
WorkingDirectory = "%h/briefcase/monzo_ynab";
|
|
Type = "oneshot";
|
|
};
|
|
};
|
|
|
|
services.gitDaemon = {
|
|
enable = true;
|
|
basePath = "/srv/git";
|
|
exportAll = true;
|
|
repositories = [ "/srv/git/briefcase" ];
|
|
};
|
|
|
|
# Since I'm using this laptop as a server in my flat, I'd prefer to close its
|
|
# lid.
|
|
services.logind.lidSwitch = "ignore";
|
|
|
|
# Provision SSL certificates to support HTTPS connections.
|
|
security.acme.acceptTerms = true;
|
|
security.acme.certs."wpcarro.dev".email = "wpcarro@gmail.com";
|
|
|
|
services.nginx = {
|
|
enable = true;
|
|
enableReload = true;
|
|
|
|
recommendedTlsSettings = true;
|
|
recommendedGzipSettings = true;
|
|
recommendedProxySettings = true;
|
|
|
|
commonHttpConfig = ''
|
|
log_format json_combined escape=json
|
|
'{'
|
|
'"time_local":"$time_local",'
|
|
'"remote_addr":"$remote_addr",'
|
|
'"remote_user":"$remote_user",'
|
|
'"request":"$request",'
|
|
'"status": "$status",'
|
|
'"body_bytes_sent":"$body_bytes_sent",'
|
|
'"request_time":"$request_time",'
|
|
'"http_referrer":"$http_referer",'
|
|
'"http_user_agent":"$http_user_agent"'
|
|
'}';
|
|
access_log syslog:server=unix:/dev/log json_combined;
|
|
'';
|
|
|
|
virtualHosts.blog = {
|
|
serverName = "blog.wpcarro.dev";
|
|
useACMEHost = "wpcarro.dev";
|
|
addSSL = true;
|
|
extraConfig = ''
|
|
location / {
|
|
proxy_pass http://localhost:80
|
|
}
|
|
'';
|
|
};
|
|
};
|
|
|
|
system.stateVersion = "20.09"; # Did you read the comment?
|
|
}
|