From 41cb36d15fefb9ccecab5a729f892b0f224eb0c4 Mon Sep 17 00:00:00 2001 From: Tobias Ostner Date: Sat, 11 Apr 2026 18:52:36 +0200 Subject: [PATCH] Setup sops --- .gitignore | 1 + configuration.nix | 7 +++ flake.lock | 23 +++++++++- flake.nix | 6 ++- modules/mempool.nix | 89 ++++++++++++++++++++++++------------- modules/nextcloud.nix | 11 ++++- secrets/.sops.yaml | 5 +++ secrets/nextcloud-mail.json | 28 ++++++++++++ secrets/tobserver.yaml | 27 +++++++++++ 9 files changed, 163 insertions(+), 34 deletions(-) create mode 100644 secrets/.sops.yaml create mode 100644 secrets/nextcloud-mail.json create mode 100644 secrets/tobserver.yaml diff --git a/.gitignore b/.gitignore index c4a847d..5456fd4 100644 --- a/.gitignore +++ b/.gitignore @@ -1 +1,2 @@ /result +tramp* diff --git a/configuration.nix b/configuration.nix index dd4206c..a9701a2 100644 --- a/configuration.nix +++ b/configuration.nix @@ -71,6 +71,7 @@ boot.loader.grub.device = "/dev/nvme0n1"; environment.systemPackages = with pkgs; [ + age btop ffmpeg gnupg @@ -106,4 +107,10 @@ dockerCompat = true; defaultNetwork.settings.dns_enabled = true; }; + + sops = { + defaultSopsFile = ./secrets/tobserver.yaml; + defaultSopsFormat = "yaml"; + age.keyFile = "/var/lib/sops-nix/key.txt"; + }; } diff --git a/flake.lock b/flake.lock index 8b40c7b..9d686f6 100644 --- a/flake.lock +++ b/flake.lock @@ -18,7 +18,28 @@ }, "root": { "inputs": { - "nixpkgs": "nixpkgs" + "nixpkgs": "nixpkgs", + "sops-nix": "sops-nix" + } + }, + "sops-nix": { + "inputs": { + "nixpkgs": [ + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1775682595, + "narHash": "sha256-0E9PohY/VuESLq0LR4doaH7hTag513sDDW5n5qmHd1Q=", + "owner": "Mic92", + "repo": "sops-nix", + "rev": "d2e8438d5886e92bc5e7c40c035ab6cae0c41f76", + "type": "github" + }, + "original": { + "owner": "Mic92", + "repo": "sops-nix", + "type": "github" } } }, diff --git a/flake.nix b/flake.nix index 38872e6..446f875 100644 --- a/flake.nix +++ b/flake.nix @@ -1,15 +1,18 @@ { inputs = { nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.11"; + sops-nix.url = "github:Mic92/sops-nix"; + sops-nix.inputs.nixpkgs.follows = "nixpkgs"; }; - outputs = { self, nixpkgs, ... }: + outputs = { self, nixpkgs, sops-nix, ... }: let system = "x86_64-linux"; in { nixosConfigurations.tobserver = nixpkgs.lib.nixosSystem { inherit system; modules = [ + sops-nix.nixosModules.sops ./hardware-configuration.nix ./configuration.nix ./modules/bitcoin.nix @@ -21,4 +24,3 @@ }; }; } - diff --git a/modules/mempool.nix b/modules/mempool.nix index adbe69d..2295ad4 100644 --- a/modules/mempool.nix +++ b/modules/mempool.nix @@ -1,5 +1,58 @@ { config, pkgs, lib, ...}: { + sops.secrets."mempool/mariadb-password" = { + owner = "root"; + group = "root"; + mode = "0400"; + }; + + sops.secrets."mempool/mariadb-root-password" = { + owner = "root"; + group = "root"; + mode = "0400"; + }; + + sops.templates."mempool-db.env" = { + owner = "root"; + group = "root"; + mode = "0400"; + content = '' + MARIADB_DATABASE=mempool + MARIADB_USER=mempool + MARIADB_PASSWORD=${config.sops.placeholder."mempool/mariadb-password"} + MARIADB_ROOT_PASSWORD=${config.sops.placeholder."mempool/mariadb-root-password"} + ''; + }; + + sops.templates."mempool-backend.env" = { + owner = "root"; + group = "root"; + mode = "0400"; + content = '' + MEMPOOL_NETWORK=mainnet + MEMPOOL_BACKEND=electrum + MEMPOOL_HTTP_PORT=8999 + + ELECTRUM_HOST=host.containers.internal + ELECTRUM_PORT=50001 + ELECTRUM_TLS_ENABLED=false + + CORE_RPC_HOST=host.containers.internal + CORE_RPC_PORT=8332 + CORE_RPC_COOKIE=true + CORE_RPC_COOKIE_PATH=/bitcoin/.cookie + + DATABASE_ENABLED=true + DATABASE_HOST=mempool-db + DATABASE_PORT=3306 + DATABASE_DATABASE=mempool + DATABASE_USERNAME=mempool + DATABASE_PASSWORD=${config.sops.placeholder."mempool/mariadb-password"} + + STATISTICS_ENABLED=true + ''; + }; + virtualisation.oci-containers = { backend = "podman"; @@ -7,12 +60,9 @@ mempool-db = { image = "mariadb:11"; autoStart = true; - environment = { - MARIADB_DATABASE = "mempool"; - MARIADB_USER = "mempool"; - MARIADB_PASSWORD = "mempool"; - MARIADB_ROOT_PASSWORD = "root"; - }; + environmentFiles = [ + config.sops.templates."mempool-db.env".path + ]; volumes = [ "/srv/mempool/mysql:/var/lib/mysql" ]; @@ -26,30 +76,9 @@ extraOptions = [ "--add-host=host.containers.internal:host-gateway" ]; - environment = { - MEMPOOL_NETWORK = "mainnet"; - MEMPOOL_BACKEND = "electrum"; - MEMPOOL_HTTP_PORT = "8999"; - - ELECTRUM_HOST = "host.containers.internal"; - ELECTRUM_PORT = "50001"; - ELECTRUM_TLS_ENABLED = "false"; - - CORE_RPC_HOST = "host.containers.internal"; - CORE_RPC_PORT = "8332"; - - CORE_RPC_COOKIE = "true"; - CORE_RPC_COOKIE_PATH = "/bitcoin/.cookie"; - - DATABASE_ENABLED = "true"; - DATABASE_HOST = "mempool-db"; - DATABASE_PORT = "3306"; - DATABASE_DATABASE = "mempool"; - DATABASE_USERNAME = "mempool"; - DATABASE_PASSWORD = "mempool"; - - STATISTICS_ENABLED = "true"; - }; + environmentFiles = [ + config.sops.templates."mempool-backend.env".path + ]; volumes = [ "/run/mempool/bitcoind.cookie:/bitcoin/.cookie:ro" ]; diff --git a/modules/nextcloud.nix b/modules/nextcloud.nix index 0fc307d..398fb9a 100644 --- a/modules/nextcloud.nix +++ b/modules/nextcloud.nix @@ -1,6 +1,15 @@ { config, pkgs, lib, ... }: { + sops.secrets."nextcloud/mail-json" = { + sopsFile = ../secrets/nextcloud-mail.json; + format = "json"; + key = ""; + owner = "root"; + group = "root"; + mode = "0400"; + }; + services = { nextcloud = { @@ -64,7 +73,7 @@ "opcache.max_accelerated_files" = "30000"; }; - secretFile = "/run/secrets/nextcloud-mail.json"; + secretFile = config.sops.secrets."nextcloud/mail-json".path; }; restic.backups.nextcloud = { diff --git a/secrets/.sops.yaml b/secrets/.sops.yaml new file mode 100644 index 0000000..9c7f5a8 --- /dev/null +++ b/secrets/.sops.yaml @@ -0,0 +1,5 @@ +creation_rules: + - path_regex: .*\.(ya?ml|json)$ + age: + - age1qnudtkywppsdk6zn6jh9gra093w4mnf63m333hxsms9ys7elkpps3y008z + - age1swfrmmxyfllp33tah7nskpvcmepqymhl7ax33zwtnf4lrkdp2srqrpzf3w diff --git a/secrets/nextcloud-mail.json b/secrets/nextcloud-mail.json new file mode 100644 index 0000000..168f511 --- /dev/null +++ b/secrets/nextcloud-mail.json @@ -0,0 +1,28 @@ +{ + "mail_from_address": "ENC[AES256_GCM,data:wkWN0cIQ,iv:aDmxjmR/9mghuQ/06ATVr274CW6hveECnHrJg26s6Lg=,tag:XorO3I8E36WAFLwIxiXYpQ==,type:str]", + "mail_domain": "ENC[AES256_GCM,data:d68tlQAx8zR87Lo=,iv:LQbhImweznHXCxQnQp1EC/yRin5kmGW5CpK6q5jXcYk=,tag:hAWOJDhozGPjU/zNleL5NQ==,type:str]", + "mail_smtpmode": "ENC[AES256_GCM,data:eJbZGg==,iv:yGj1aAjWgiFQDjVR9y8lO1MDPctpN+39aZt40/B8UF0=,tag:KJ6bdw5D7R4lc7mDzO6TkQ==,type:str]", + "mail_sendmailmode": "ENC[AES256_GCM,data:BUq83A==,iv:9UJVLgvkZDbdpWpEG0pFzqaKgBAW826wku9ZxPJNWdM=,tag:4MrswUzNK2Li9IRQts545g==,type:str]", + "mail_smtphost": "ENC[AES256_GCM,data:br1wM+lxOPn7QuAna47A4PfA,iv:uyZVMLRurAXTr5hTF25NoS8tE7Afj0QedWyZCiG+HzU=,tag:D7E571gligJBkIsBbIvmIA==,type:str]", + "mail_smtpport": "ENC[AES256_GCM,data:WiCb,iv:i4H8AlPn2An82QYToP26UkboRQ/nOXT8buphx801Bog=,tag:j/ky3g/EWEN3fAm1sR2mCQ==,type:str]", + "mail_smtpsecure": "ENC[AES256_GCM,data:0Nhu,iv:IYiTIKbNRnEzMfGCvK+PB5gFtt7F+1435vjgvFQh+S4=,tag:mt9nsH629tryaax2nuK7Pw==,type:str]", + "mail_smtpauth": "ENC[AES256_GCM,data:vA==,iv:P1zWkwLrQg/690X0Xd5wdA/LZ24uhR6Q/VZXwVZ+yzA=,tag:GY90C7ljljQDD3uwMrRWkQ==,type:float]", + "mail_smtpname": "ENC[AES256_GCM,data:yoUiA0rFw1aOtAWp5Rdbgv4a,iv:CH5E/gb6AUC087q7DO2eozDCVG943dqmYPIZdQDQv8Y=,tag:6jg8OvtEzm15IDNxxphOnQ==,type:str]", + "mail_smtppassword": "ENC[AES256_GCM,data:3TFl/4rCu9M6SM71kDeYAg==,iv:rf3wTdxtM79jk6wXfGpaNMTQmj9q/7U5Pz9eTQ/PT2A=,tag:XxclWFZFw/iuh6EaIPMlJw==,type:str]", + "sops": { + "age": [ + { + "recipient": "age1qnudtkywppsdk6zn6jh9gra093w4mnf63m333hxsms9ys7elkpps3y008z", + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA1a2ZUaVJQVDBIOTByL011\ndWdKbkV1REtBZ0JnS3AvNUZIT1JWcExNNFhvCkhPNG5KTjhvMG5ZTzlwdllwUEZV\nMDdncjVUbHQ5bjJHcVJFcUFJV1cvaFUKLS0tIEx2elNGUDdyZGZxaVRLcjBob0Rz\ndExBZEkvd0x1SWNreXgwOEM0TWVuTzgKRpKZM7g5OklsuuA6chQA+BiZTnpEFThw\nKvhzsWd2YQszyLSOvCyjJ+g24lym+IZ6y5Lc2iukx+Du+CXJOGT4IA==\n-----END AGE ENCRYPTED FILE-----\n" + }, + { + "recipient": "age1swfrmmxyfllp33tah7nskpvcmepqymhl7ax33zwtnf4lrkdp2srqrpzf3w", + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBBQzBBMGtSUVFIT2IzSHk1\nZWFhcTduVHJmRGVNaDIxaittVy9xa2ZFaEJVCkdoeHpSaUxKUWFvSmxhU3BpekFj\nOThsM1NUaVptT1ZiWTVpVEczRGszZWcKLS0tIDJoVE9jNFcvRjFnSzNKOVl6djc5\nSGEyN25EcjY5bDdVbEpiQWRtR1RqS1EKet3MvHgYNGfRwKmf0dsTcM4RP/ZgtwSd\nKg133l9Y4S9th1yB81c+wE0egS5P5VJOWgKpd7otAT66v/mZNbDIRw==\n-----END AGE ENCRYPTED FILE-----\n" + } + ], + "lastmodified": "2026-04-11T16:41:06Z", + "mac": "ENC[AES256_GCM,data:G9bYGeRCEd7f5igAIYOxSOlyA+Du6j1iyygR6rS838HIUr/cucqo2wyVn95itHxsMJZDQtI8L4uRP3TE/p+PaPT3XG3hGrPwkC74MudJJlRCjSrsnaUrEr9KWZPg4diAvTWuC5szxN7Uxuh85V7EPSMhBSuVyI9OhQy1nf+Qbls=,iv:gDI9JQ+p0OhLgypjwHGNYIYi5c7BEN9IoQbRS0d0SpE=,tag:PP1ajrQI5es61ez7NmtCkQ==,type:str]", + "unencrypted_suffix": "_unencrypted", + "version": "3.11.0" + } +} diff --git a/secrets/tobserver.yaml b/secrets/tobserver.yaml new file mode 100644 index 0000000..ff4ff8c --- /dev/null +++ b/secrets/tobserver.yaml @@ -0,0 +1,27 @@ +mempool: + mariadb-password: ENC[AES256_GCM,data:NmFq8C3stA==,iv:XUvpviqUiS4UFCyZ3eahNY6NNy6/q3kLgWDfMW6I52U=,tag:9i5TO+9KbyM73RldtBw0fw==,type:str] + mariadb-root-password: ENC[AES256_GCM,data:CjXQWw==,iv:3amyq9/3Nq7pz8s7wk4UORI1gSgURufGh1u/cITQf/I=,tag:4ulBVRDh0Ws04IqHT5P6tg==,type:str] +sops: + age: + - recipient: age1qnudtkywppsdk6zn6jh9gra093w4mnf63m333hxsms9ys7elkpps3y008z + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJVzV1ck0rNjBicGNhZWJR + Nm5ZWVphUlhIWmtrcUxkUzczOTlmMXhsdjF3CjM1bzVIUVpXYzJBODZhUXEyRTFs + WUtDV09Wb3NSOUJwWDJGanFXTllDeUUKLS0tIGpiandTeFJPdFoyR05DNzhMZTNh + ankwQ2I3M2VWR2Y4UC9wYVM4em0zczgK1mGVmNZU/l8Qn4lX/ftMLxdW7m/JgbDq + FAGCIW8S3RgORcLYAWrAf5E7jKAFeIM75STGH/MnyXUlncsBIxwKaw== + -----END AGE ENCRYPTED FILE----- + - recipient: age1swfrmmxyfllp33tah7nskpvcmepqymhl7ax33zwtnf4lrkdp2srqrpzf3w + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAxa2dIMTJxdGZsSkZtSW1Z + aXJ6TFdSOGNmbzZEd3dDbWdKaW9aLzIrTW5VClFJdGZrOEIvMVVWLytOVlowdkdV + NnZhajAvWlR6ajR0elMzNkR3SWxISDQKLS0tIEQ4Qm1NU0xPMllGZko4WTJidnpT + cVE5VG56cFAzT1dsRFN4cCtnVEJJdU0KSBWm4blGhnVlOJ3k7lh8aJVOEH8NfFOh + EwU/4Up6zWYBoe2+GKiQf8imnVLSSxMR7dlNd06ttuFD4B5baqFRcA== + -----END AGE ENCRYPTED FILE----- + lastmodified: "2026-04-11T12:27:40Z" + mac: ENC[AES256_GCM,data:Uk6vIxyBzRLa3+IoQ0Tv5T4dwz2EQehuBSEXAzeTeNxf7ob/GRgzdZxVyoq0ycEOz3JS7k6RjhZYe0zDXMnp/9FVsWbItFiFs8OfqkxVbrjXjBCk5CeUENaeND4Hu7L0GvLCJYm7JPeI4+0Jr0DE0bPQs+HGYcwPUwDxqsjqgxU=,iv:zNNnfmlbQdfjzX3hqBEiw98TQUvUGiIbedqurWV/zBw=,tag:f8dfjTtWg48lls/Ah2wvtQ==,type:str] + unencrypted_suffix: _unencrypted + version: 3.11.0