danvics/selfhostblocks
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

update to latest version of options

Browse source
This commit is contained in:
ibizaman 2025-03-16 21:56:47 +01:00 committed by Pierre Penninckx
parent 5e613b1aaf
commit c7b8529502
2 changed files with 44 additions and 123 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

42
demo/homeassistant/flake.nix
View file

@ -25,42 +25,40 @@
sops-nix.nixosModules.default sops-nix.nixosModules.default
]; ];
sops.defaultSopsFile = ./secrets.yaml;
shb.home-assistant = { shb.home-assistant = {
enable = true; enable = true;
domain = "example.com"; domain = "example.com";
subdomain = "ha"; subdomain = "ha";
config = { config = {
name = "SHB Home Assistant"; name = "SHB Home Assistant";
country.source = config.sops.secrets."home-assistant/country".path; country.source = config.shb.sops.secret."home-assistant/country".result.path;
latitude.source = config.sops.secrets."home-assistant/latitude".path; latitude.source = config.shb.sops.secret."home-assistant/latitude".result.path;
longitude.source = config.sops.secrets."home-assistant/longitude".path; longitude.source = config.shb.sops.secret."home-assistant/longitude".result.path;
time_zone.source = config.sops.secrets."home-assistant/time_zone".path; time_zone.source = config.shb.sops.secret."home-assistant/time_zone".result.path;
unit_system = "metric"; unit_system = "metric";
}; };
}; };
sops.secrets."home-assistant/country" = { shb.sops.secret."home-assistant/country".request = {
sopsFile = ./secrets.yaml;
mode = "0440"; mode = "0440";
owner = "hass"; owner = "hass";
group = "hass"; group = "hass";
restartUnits = [ "home-assistant.service" ]; restartUnits = [ "home-assistant.service" ];
}; };
sops.secrets."home-assistant/latitude" = { shb.sops.secret."home-assistant/latitude".request = {
sopsFile = ./secrets.yaml;
mode = "0440"; mode = "0440";
owner = "hass"; owner = "hass";
group = "hass"; group = "hass";
restartUnits = [ "home-assistant.service" ]; restartUnits = [ "home-assistant.service" ];
}; };
sops.secrets."home-assistant/longitude" = { shb.sops.secret."home-assistant/longitude".request = {
sopsFile = ./secrets.yaml;
mode = "0440"; mode = "0440";
owner = "hass"; owner = "hass";
group = "hass"; group = "hass";
restartUnits = [ "home-assistant.service" ]; restartUnits = [ "home-assistant.service" ];
}; };
sops.secrets."home-assistant/time_zone" = { shb.sops.secret."home-assistant/time_zone".request = {
sopsFile = ./secrets.yaml;
mode = "0440"; mode = "0440";
owner = "hass"; owner = "hass";
group = "hass"; group = "hass";
@ -80,23 +78,11 @@
ldapPort = 3890; ldapPort = 3890;
webUIListenPort = 17170; webUIListenPort = 17170;
dcdomain = "dc=example,dc=com"; dcdomain = "dc=example,dc=com";
ldapUserPasswordFile = config.sops.secrets."lldap/user_password".path; ldapUserPassword.result = config.shb.sops.secret."lldap/user_password".result;
jwtSecretFile = config.sops.secrets."lldap/jwt_secret".path; jwtSecret.result = config.shb.sops.secret."lldap/jwt_secret".result;
};
sops.secrets."lldap/user_password" = {
sopsFile = ./secrets.yaml;
mode = "0440";
owner = "lldap";
group = "lldap";
restartUnits = [ "lldap.service" ];
};
sops.secrets."lldap/jwt_secret" = {
sopsFile = ./secrets.yaml;
mode = "0440";
owner = "lldap";
group = "lldap";
restartUnits = [ "lldap.service" ];
}; };
shb.sops.secret."lldap/user_password".request = config.shb.ldap.ldapUserPassword.request;
shb.sops.secret."lldap/jwt_secret".request = config.shb.ldap.jwtSecret.request;
shb.home-assistant.ldap = { shb.home-assistant.ldap = {
enable = true; enable = true;

125
demo/nextcloud/flake.nix
View file

@ -25,6 +25,8 @@
sops-nix.nixosModules.default sops-nix.nixosModules.default
]; ];
sops.defaultSopsFile = ./secrets.yaml;
shb.nextcloud = { shb.nextcloud = {
enable = true; enable = true;
domain = "example.com"; domain = "example.com";
@ -36,21 +38,13 @@
# This option is only needed because we do not access Nextcloud at the default port in the VM. # This option is only needed because we do not access Nextcloud at the default port in the VM.
port = 8080; port = 8080;
adminPassFile = config.sops.secrets."nextcloud/adminpass".path; adminPass.result = config.shb.sops.secret."nextcloud/adminpass".result;
apps = { apps = {
previewgenerator.enable = true; previewgenerator.enable = true;
}; };
}; };
shb.sops.secret."nextcloud/adminpass".request = config.shb.nextcloud.adminPass.request;
# Secret needed for services.nextcloud.config.adminpassFile.
sops.secrets."nextcloud/adminpass" = {
sopsFile = ./secrets.yaml;
mode = "0440";
owner = "nextcloud";
group = "nextcloud";
restartUnits = [ "phpfpm-nextcloud.service" ];
};
# Set to true for more debug info with `journalctl -f -u nginx`. # Set to true for more debug info with `journalctl -f -u nginx`.
shb.nginx.accessLog = true; shb.nginx.accessLog = true;
@ -65,23 +59,11 @@
ldapPort = 3890; ldapPort = 3890;
webUIListenPort = 17170; webUIListenPort = 17170;
dcdomain = "dc=example,dc=com"; dcdomain = "dc=example,dc=com";
ldapUserPasswordFile = config.sops.secrets."lldap/user_password".path; ldapUserPassword.result = config.shb.sops.secret."lldap/user_password".result;
jwtSecretFile = config.sops.secrets."lldap/jwt_secret".path; jwtSecret.result = config.shb.sops.secret."lldap/jwt_secret".result;
};
sops.secrets."lldap/user_password" = {
sopsFile = ./secrets.yaml;
mode = "0440";
owner = "lldap";
group = "lldap";
restartUnits = [ "lldap.service" ];
};
sops.secrets."lldap/jwt_secret" = {
sopsFile = ./secrets.yaml;
mode = "0440";
owner = "lldap";
group = "lldap";
restartUnits = [ "lldap.service" ];
}; };
shb.sops.secret."lldap/user_password".request = config.shb.ldap.ldapUserPassword.request;
shb.sops.secret."lldap/jwt_secret".request = config.shb.ldap.jwtSecret.request;
shb.nextcloud.apps.ldap = { shb.nextcloud.apps.ldap = {
enable = true; enable = true;
@ -89,18 +71,12 @@
port = config.shb.ldap.ldapPort; port = config.shb.ldap.ldapPort;
dcdomain = config.shb.ldap.dcdomain; dcdomain = config.shb.ldap.dcdomain;
adminName = "admin"; adminName = "admin";
adminPasswordFile = config.sops.secrets."nextcloud/ldap_admin_password".path; adminPassword.result = config.shb.sops.secret."nextcloud/ldap_admin_password".result;
userGroup = "nextcloud_user"; userGroup = "nextcloud_user";
}; };
shb.sops.secret."nextcloud/ldap_admin_password" = {
# Secret needed for LDAP app. request = config.shb.nextcloud.apps.ldap.adminPassword.request;
sops.secrets."nextcloud/ldap_admin_password" = { settings.key = "lldap/user_password";
sopsFile = ./secrets.yaml;
key = "lldap/user_password";
mode = "0400";
owner = "nextcloud";
group = "nextcloud";
restartUnits = [ "nextcloud-setup.service" ];
}; };
}; };
@ -143,53 +119,20 @@
dcdomain = config.shb.ldap.dcdomain; dcdomain = config.shb.ldap.dcdomain;
secrets = { secrets = {
jwtSecretFile = config.sops.secrets."authelia/jwt_secret".path; jwtSecret.result = config.shb.sops.secret."authelia/jwt_secret".result;
ldapAdminPasswordFile = config.sops.secrets."authelia/ldap_admin_password".path; ldapAdminPassword.result = config.shb.sops.secret."authelia/ldap_admin_password".result;
sessionSecretFile = config.sops.secrets."authelia/session_secret".path; sessionSecret.result = config.shb.sops.secret."authelia/session_secret".result;
storageEncryptionKeyFile = config.sops.secrets."authelia/storage_encryption_key".path; storageEncryptionKey.result = config.shb.sops.secret."authelia/storage_encryption_key".result;
identityProvidersOIDCHMACSecretFile = config.sops.secrets."authelia/hmac_secret".path; identityProvidersOIDCHMACSecret.result = config.shb.sops.secret."authelia/hmac_secret".result;
identityProvidersOIDCIssuerPrivateKeyFile = config.sops.secrets."authelia/private_key".path; identityProvidersOIDCIssuerPrivateKey.result = config.shb.sops.secret."authelia/private_key".result;
}; };
}; };
sops.secrets."authelia/jwt_secret" = { shb.sops.secret."authelia/jwt_secret".request = config.shb.authelia.secrets.jwtSecret.request;
sopsFile = ./secrets.yaml; shb.sops.secret."authelia/ldap_admin_password".request = config.shb.authelia.secrets.ldapAdminPassword.request;
mode = "0400"; shb.sops.secret."authelia/session_secret".request = config.shb.authelia.secrets.sessionSecret.request;
owner = config.shb.authelia.autheliaUser; shb.sops.secret."authelia/storage_encryption_key".request = config.shb.authelia.secrets.storageEncryptionKey.request;
restartUnits = [ "authelia.service" ]; shb.sops.secret."authelia/hmac_secret".request = config.shb.authelia.secrets.identityProvidersOIDCHMACSecret.request;
}; shb.sops.secret."authelia/private_key".request = config.shb.authelia.secrets.identityProvidersOIDCIssuerPrivateKey.request;
# Here we use the password defined in the lldap/user_password field in the secrets.yaml file
# and sops-nix will write it to "/run/secrets/authelia/ldap_admin_password".
sops.secrets."authelia/ldap_admin_password" = {
sopsFile = ./secrets.yaml;
key = "lldap/user_password";
mode = "0400";
owner = config.shb.authelia.autheliaUser;
restartUnits = [ "authelia.service" ];
};
sops.secrets."authelia/session_secret" = {
sopsFile = ./secrets.yaml;
mode = "0400";
owner = config.shb.authelia.autheliaUser;
restartUnits = [ "authelia.service" ];
};
sops.secrets."authelia/storage_encryption_key" = {
sopsFile = ./secrets.yaml;
mode = "0400";
owner = config.shb.authelia.autheliaUser;
restartUnits = [ "authelia.service" ];
};
sops.secrets."authelia/hmac_secret" = {
sopsFile = ./secrets.yaml;
mode = "0400";
owner = config.shb.authelia.autheliaUser;
restartUnits = [ "authelia.service" ];
};
sops.secrets."authelia/private_key" = {
sopsFile = ./secrets.yaml;
mode = "0400";
owner = config.shb.authelia.autheliaUser;
restartUnits = [ "authelia.service" ];
};
shb.nextcloud.apps.sso = { shb.nextcloud.apps.sso = {
enable = true; enable = true;
@ -197,21 +140,13 @@
clientID = "nextcloud"; clientID = "nextcloud";
fallbackDefaultAuth = true; fallbackDefaultAuth = true;
secretFile = config.sops.secrets."nextcloud/sso/secret".path; secret.result = config.shb.sops.secret."nextcloud/sso/secret".result;
secretFileForAuthelia = config.sops.secrets."authelia/nextcloud_sso_secret".path; secretForAuthelia.result = config.shb.sops.secret."authelia/nextcloud_sso_secret".result;
}; };
shb.sops.secret."nextcloud/sso/secret".request = config.shb.nextcloud.apps.sso.secret.request;
sops.secrets."nextcloud/sso/secret" = { shb.sops.secret."authelia/nextcloud_sso_secret" = {
sopsFile = ./secrets.yaml; request = config.shb.nextcloud.apps.sso.secretForAuthelia.request;
mode = "0400"; settings.key = "nextcloud/sso/secret";
owner = "nextcloud";
restartUnits = [ "nextcloud-setup.service" ];
};
sops.secrets."authelia/nextcloud_sso_secret" = {
sopsFile = ./secrets.yaml;
key = "nextcloud/sso/secret";
mode = "0400";
owner = config.shb.authelia.autheliaUser;
}; };
}; };