oibot/Tobserver
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

Setup sops

Browse source
This commit is contained in:
Tobias Ostner 2026-04-11 18:52:36 +02:00
parent 3bb85d77de
commit 41cb36d15f
9 changed files with 163 additions and 34 deletions
Download patch file Download diff file Expand all files Collapse all files

1
.gitignore vendored
View file

@ -1 +1,2 @@
/result
tramp*

7
configuration.nix
View file

@ -71,6 +71,7 @@
boot.loader.grub.device = "/dev/nvme0n1";
environment.systemPackages = with pkgs; [
age
btop
ffmpeg
gnupg
@ -106,4 +107,10 @@
dockerCompat = true;
defaultNetwork.settings.dns_enabled = true;
};
sops = {
defaultSopsFile = ./secrets/tobserver.yaml;
defaultSopsFormat = "yaml";
age.keyFile = "/var/lib/sops-nix/key.txt";
};
}

23
flake.lock generated
View file

@ -18,7 +18,28 @@
},
"root": {
"inputs": {
"nixpkgs": "nixpkgs"
"nixpkgs": "nixpkgs",
"sops-nix": "sops-nix"
}
},
"sops-nix": {
"inputs": {
"nixpkgs": [
"nixpkgs"
]
},
"locked": {
"lastModified": 1775682595,
"narHash": "sha256-0E9PohY/VuESLq0LR4doaH7hTag513sDDW5n5qmHd1Q=",
"owner": "Mic92",
"repo": "sops-nix",
"rev": "d2e8438d5886e92bc5e7c40c035ab6cae0c41f76",
"type": "github"
},
"original": {
"owner": "Mic92",
"repo": "sops-nix",
"type": "github"
}
}
},

6
flake.nix
View file

@ -1,15 +1,18 @@
{
inputs = {
nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.11";
sops-nix.url = "github:Mic92/sops-nix";
sops-nix.inputs.nixpkgs.follows = "nixpkgs";
};
outputs = { self, nixpkgs, ... }:
outputs = { self, nixpkgs, sops-nix, ... }:
let
system = "x86_64-linux";
in {
nixosConfigurations.tobserver = nixpkgs.lib.nixosSystem {
inherit system;
modules = [
sops-nix.nixosModules.sops
./hardware-configuration.nix
./configuration.nix
./modules/bitcoin.nix
@ -21,4 +24,3 @@
};
};
}

89
modules/mempool.nix
View file

@ -1,5 +1,58 @@
{ config, pkgs, lib, ...}:
{
sops.secrets."mempool/mariadb-password" = {
owner = "root";
group = "root";
mode = "0400";
};
sops.secrets."mempool/mariadb-root-password" = {
owner = "root";
group = "root";
mode = "0400";
};
sops.templates."mempool-db.env" = {
owner = "root";
group = "root";
mode = "0400";
content = ''
MARIADB_DATABASE=mempool
MARIADB_USER=mempool
MARIADB_PASSWORD=${config.sops.placeholder."mempool/mariadb-password"}
MARIADB_ROOT_PASSWORD=${config.sops.placeholder."mempool/mariadb-root-password"}
'';
};
sops.templates."mempool-backend.env" = {
owner = "root";
group = "root";
mode = "0400";
content = ''
MEMPOOL_NETWORK=mainnet
MEMPOOL_BACKEND=electrum
MEMPOOL_HTTP_PORT=8999
ELECTRUM_HOST=host.containers.internal
ELECTRUM_PORT=50001
ELECTRUM_TLS_ENABLED=false
CORE_RPC_HOST=host.containers.internal
CORE_RPC_PORT=8332
CORE_RPC_COOKIE=true
CORE_RPC_COOKIE_PATH=/bitcoin/.cookie
DATABASE_ENABLED=true
DATABASE_HOST=mempool-db
DATABASE_PORT=3306
DATABASE_DATABASE=mempool
DATABASE_USERNAME=mempool
DATABASE_PASSWORD=${config.sops.placeholder."mempool/mariadb-password"}
STATISTICS_ENABLED=true
'';
};
virtualisation.oci-containers = {
backend = "podman";
@ -7,12 +60,9 @@
mempool-db = {
image = "mariadb:11";
autoStart = true;
environment = {
MARIADB_DATABASE = "mempool";
MARIADB_USER = "mempool";
MARIADB_PASSWORD = "mempool";
MARIADB_ROOT_PASSWORD = "root";
};
environmentFiles = [
config.sops.templates."mempool-db.env".path
];
volumes = [
"/srv/mempool/mysql:/var/lib/mysql"
];
@ -26,30 +76,9 @@
extraOptions = [
"--add-host=host.containers.internal:host-gateway"
];
environment = {
MEMPOOL_NETWORK = "mainnet";
MEMPOOL_BACKEND = "electrum";
MEMPOOL_HTTP_PORT = "8999";
ELECTRUM_HOST = "host.containers.internal";
ELECTRUM_PORT = "50001";
ELECTRUM_TLS_ENABLED = "false";
CORE_RPC_HOST = "host.containers.internal";
CORE_RPC_PORT = "8332";
CORE_RPC_COOKIE = "true";
CORE_RPC_COOKIE_PATH = "/bitcoin/.cookie";
DATABASE_ENABLED = "true";
DATABASE_HOST = "mempool-db";
DATABASE_PORT = "3306";
DATABASE_DATABASE = "mempool";
DATABASE_USERNAME = "mempool";
DATABASE_PASSWORD = "mempool";
STATISTICS_ENABLED = "true";
};
environmentFiles = [
config.sops.templates."mempool-backend.env".path
];
volumes = [
"/run/mempool/bitcoind.cookie:/bitcoin/.cookie:ro"
];

11
modules/nextcloud.nix
View file

@ -1,6 +1,15 @@
{ config, pkgs, lib, ... }:
{
sops.secrets."nextcloud/mail-json" = {
sopsFile = ../secrets/nextcloud-mail.json;
format = "json";
key = "";
owner = "root";
group = "root";
mode = "0400";
};
services = {
nextcloud = {
@ -64,7 +73,7 @@
"opcache.max_accelerated_files" = "30000";
};
secretFile = "/run/secrets/nextcloud-mail.json";
secretFile = config.sops.secrets."nextcloud/mail-json".path;
};
restic.backups.nextcloud = {

5
secrets/.sops.yaml Normal file
View file

@ -0,0 +1,5 @@
creation_rules:
- path_regex: .*\.(ya?ml|json)$
age:
- age1qnudtkywppsdk6zn6jh9gra093w4mnf63m333hxsms9ys7elkpps3y008z
- age1swfrmmxyfllp33tah7nskpvcmepqymhl7ax33zwtnf4lrkdp2srqrpzf3w

28
secrets/nextcloud-mail.json Normal file
View file

@ -0,0 +1,28 @@
{
"mail_from_address": "ENC[AES256_GCM,data:wkWN0cIQ,iv:aDmxjmR/9mghuQ/06ATVr274CW6hveECnHrJg26s6Lg=,tag:XorO3I8E36WAFLwIxiXYpQ==,type:str]",
"mail_domain": "ENC[AES256_GCM,data:d68tlQAx8zR87Lo=,iv:LQbhImweznHXCxQnQp1EC/yRin5kmGW5CpK6q5jXcYk=,tag:hAWOJDhozGPjU/zNleL5NQ==,type:str]",
"mail_smtpmode": "ENC[AES256_GCM,data:eJbZGg==,iv:yGj1aAjWgiFQDjVR9y8lO1MDPctpN+39aZt40/B8UF0=,tag:KJ6bdw5D7R4lc7mDzO6TkQ==,type:str]",
"mail_sendmailmode": "ENC[AES256_GCM,data:BUq83A==,iv:9UJVLgvkZDbdpWpEG0pFzqaKgBAW826wku9ZxPJNWdM=,tag:4MrswUzNK2Li9IRQts545g==,type:str]",
"mail_smtphost": "ENC[AES256_GCM,data:br1wM+lxOPn7QuAna47A4PfA,iv:uyZVMLRurAXTr5hTF25NoS8tE7Afj0QedWyZCiG+HzU=,tag:D7E571gligJBkIsBbIvmIA==,type:str]",
"mail_smtpport": "ENC[AES256_GCM,data:WiCb,iv:i4H8AlPn2An82QYToP26UkboRQ/nOXT8buphx801Bog=,tag:j/ky3g/EWEN3fAm1sR2mCQ==,type:str]",
"mail_smtpsecure": "ENC[AES256_GCM,data:0Nhu,iv:IYiTIKbNRnEzMfGCvK+PB5gFtt7F+1435vjgvFQh+S4=,tag:mt9nsH629tryaax2nuK7Pw==,type:str]",
"mail_smtpauth": "ENC[AES256_GCM,data:vA==,iv:P1zWkwLrQg/690X0Xd5wdA/LZ24uhR6Q/VZXwVZ+yzA=,tag:GY90C7ljljQDD3uwMrRWkQ==,type:float]",
"mail_smtpname": "ENC[AES256_GCM,data:yoUiA0rFw1aOtAWp5Rdbgv4a,iv:CH5E/gb6AUC087q7DO2eozDCVG943dqmYPIZdQDQv8Y=,tag:6jg8OvtEzm15IDNxxphOnQ==,type:str]",
"mail_smtppassword": "ENC[AES256_GCM,data:3TFl/4rCu9M6SM71kDeYAg==,iv:rf3wTdxtM79jk6wXfGpaNMTQmj9q/7U5Pz9eTQ/PT2A=,tag:XxclWFZFw/iuh6EaIPMlJw==,type:str]",
"sops": {
"age": [
{
"recipient": "age1qnudtkywppsdk6zn6jh9gra093w4mnf63m333hxsms9ys7elkpps3y008z",
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA1a2ZUaVJQVDBIOTByL011\ndWdKbkV1REtBZ0JnS3AvNUZIT1JWcExNNFhvCkhPNG5KTjhvMG5ZTzlwdllwUEZV\nMDdncjVUbHQ5bjJHcVJFcUFJV1cvaFUKLS0tIEx2elNGUDdyZGZxaVRLcjBob0Rz\ndExBZEkvd0x1SWNreXgwOEM0TWVuTzgKRpKZM7g5OklsuuA6chQA+BiZTnpEFThw\nKvhzsWd2YQszyLSOvCyjJ+g24lym+IZ6y5Lc2iukx+Du+CXJOGT4IA==\n-----END AGE ENCRYPTED FILE-----\n"
},
{
"recipient": "age1swfrmmxyfllp33tah7nskpvcmepqymhl7ax33zwtnf4lrkdp2srqrpzf3w",
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBBQzBBMGtSUVFIT2IzSHk1\nZWFhcTduVHJmRGVNaDIxaittVy9xa2ZFaEJVCkdoeHpSaUxKUWFvSmxhU3BpekFj\nOThsM1NUaVptT1ZiWTVpVEczRGszZWcKLS0tIDJoVE9jNFcvRjFnSzNKOVl6djc5\nSGEyN25EcjY5bDdVbEpiQWRtR1RqS1EKet3MvHgYNGfRwKmf0dsTcM4RP/ZgtwSd\nKg133l9Y4S9th1yB81c+wE0egS5P5VJOWgKpd7otAT66v/mZNbDIRw==\n-----END AGE ENCRYPTED FILE-----\n"
}
],
"lastmodified": "2026-04-11T16:41:06Z",
"mac": "ENC[AES256_GCM,data:G9bYGeRCEd7f5igAIYOxSOlyA+Du6j1iyygR6rS838HIUr/cucqo2wyVn95itHxsMJZDQtI8L4uRP3TE/p+PaPT3XG3hGrPwkC74MudJJlRCjSrsnaUrEr9KWZPg4diAvTWuC5szxN7Uxuh85V7EPSMhBSuVyI9OhQy1nf+Qbls=,iv:gDI9JQ+p0OhLgypjwHGNYIYi5c7BEN9IoQbRS0d0SpE=,tag:PP1ajrQI5es61ez7NmtCkQ==,type:str]",
"unencrypted_suffix": "_unencrypted",
"version": "3.11.0"
}
}

27
secrets/tobserver.yaml Normal file
View file

@ -0,0 +1,27 @@
mempool:
mariadb-password: ENC[AES256_GCM,data:NmFq8C3stA==,iv:XUvpviqUiS4UFCyZ3eahNY6NNy6/q3kLgWDfMW6I52U=,tag:9i5TO+9KbyM73RldtBw0fw==,type:str]
mariadb-root-password: ENC[AES256_GCM,data:CjXQWw==,iv:3amyq9/3Nq7pz8s7wk4UORI1gSgURufGh1u/cITQf/I=,tag:4ulBVRDh0Ws04IqHT5P6tg==,type:str]
sops:
age:
- recipient: age1qnudtkywppsdk6zn6jh9gra093w4mnf63m333hxsms9ys7elkpps3y008z
enc: |
-----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJVzV1ck0rNjBicGNhZWJR
Nm5ZWVphUlhIWmtrcUxkUzczOTlmMXhsdjF3CjM1bzVIUVpXYzJBODZhUXEyRTFs
WUtDV09Wb3NSOUJwWDJGanFXTllDeUUKLS0tIGpiandTeFJPdFoyR05DNzhMZTNh
ankwQ2I3M2VWR2Y4UC9wYVM4em0zczgK1mGVmNZU/l8Qn4lX/ftMLxdW7m/JgbDq
FAGCIW8S3RgORcLYAWrAf5E7jKAFeIM75STGH/MnyXUlncsBIxwKaw==
-----END AGE ENCRYPTED FILE-----
- recipient: age1swfrmmxyfllp33tah7nskpvcmepqymhl7ax33zwtnf4lrkdp2srqrpzf3w
enc: |
-----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAxa2dIMTJxdGZsSkZtSW1Z
aXJ6TFdSOGNmbzZEd3dDbWdKaW9aLzIrTW5VClFJdGZrOEIvMVVWLytOVlowdkdV
NnZhajAvWlR6ajR0elMzNkR3SWxISDQKLS0tIEQ4Qm1NU0xPMllGZko4WTJidnpT
cVE5VG56cFAzT1dsRFN4cCtnVEJJdU0KSBWm4blGhnVlOJ3k7lh8aJVOEH8NfFOh
EwU/4Up6zWYBoe2+GKiQf8imnVLSSxMR7dlNd06ttuFD4B5baqFRcA==
-----END AGE ENCRYPTED FILE-----
lastmodified: "2026-04-11T12:27:40Z"
mac: ENC[AES256_GCM,data:Uk6vIxyBzRLa3+IoQ0Tv5T4dwz2EQehuBSEXAzeTeNxf7ob/GRgzdZxVyoq0ycEOz3JS7k6RjhZYe0zDXMnp/9FVsWbItFiFs8OfqkxVbrjXjBCk5CeUENaeND4Hu7L0GvLCJYm7JPeI4+0Jr0DE0bPQs+HGYcwPUwDxqsjqgxU=,iv:zNNnfmlbQdfjzX3hqBEiw98TQUvUGiIbedqurWV/zBw=,tag:f8dfjTtWg48lls/Ah2wvtQ==,type:str]
unencrypted_suffix: _unencrypted
version: 3.11.0