.sops.yaml

@@ -19,7 +19,7 @@ creation_rules:
         - *nkagami_main
         - *nkagami_do
         - *nki_framework
-  - path_regex: nki-home/secrets\.yaml$
+  - path_regex: nki-home/secrets/secrets\.yaml$
     key_groups:
     - age:
         - *nki_pc

common.nix

@@ -13,7 +13,6 @@ in
 with lib; {
   imports = [
     # defaultShell
-    ./modules/services/nix-cache
   ];
 
   ## Packages

modules/my-tinc/hosts.nix

@@ -23,13 +23,10 @@ in
       hosts;
 
     # Add all of them to host
-    nki.services.edns = {
-      enable = true;
-      cloaking-rules =
-        (lib.attrsets.mapAttrs'
-          (name: host: { name = "${name}.tinc"; value = host.subnetAddr; })
-          hosts)
-      ;
-    };
+    networking.extraHosts = lib.strings.concatStringsSep
+      "\n"
+      (lib.attrsets.mapAttrsToList
+        (name: host: "${host.subnetAddr} ${name}.tinc")
+        hosts);
   };
 }

modules/services/edns/default.nix

@@ -8,11 +8,6 @@ in
   options.nki.services.edns = {
     enable = mkEnableOption "Enable encrypted DNS";
     ipv6 = mkEnableOption "Enable ipv6";
-    cloaking-rules = mkOption {
-      type = types.attrsOf types.str;
-      default = { };
-      description = "A set of domain -> ip mapping for cloaking_rules";
-    };
   };
 
   config = mkIf cfg.enable {
@@ -47,11 +42,6 @@ in
           { server_name = "*"; via = [ "anon-plan9-dns" "anon-v.dnscrypt.up-ipv4" ]; }
         ];
         anonymized_dns.skip_incompatible = true;
-
-        # Cloaking rules
-        cloaking_rules = pkgs.writeText "cloaking_rules.txt" (lib.strings.concatStringsSep
-          "\n"
-          (lib.attrsets.mapAttrsToList (name: ip: "${name} ${ip}") cfg.cloaking-rules));
       };
     };
   };

modules/services/nix-cache/cache-pub-key.pem

@@ -1 +0,0 @@
-nix.home.tinc:zG2uDy0MbLY0wLuoVH/qKzTD6hTfKZufA2cWDSTCZMA=

modules/services/nix-cache/default.nix

@@ -1,59 +0,0 @@
-{ config, pkgs, lib, ... }:
-
-with { inherit (lib) mkEnableOption mkOption types mkIf; };
-let
-  cfg = config.nki.services.nix-cache;
-in
-{
-  options.nki.services.nix-cache = {
-    enableClient = mkOption {
-      type = types.bool;
-      default = !cfg.enableServer;
-      description = "Enable nix-cache client";
-    };
-    enableServer = mkEnableOption "Enable nix-cache server";
-
-    host = mkOption {
-      type = types.str;
-      default = "nix.home.tinc";
-    };
-
-    publicKey = mkOption {
-      type = types.str;
-      default = builtins.readFile ./cache-pub-key.pem;
-    };
-
-    privateKeyFile = mkOption {
-      type = types.path;
-      description = "Path to the private key .pem file";
-    };
-  };
-
-  config = {
-    nix.settings = mkIf cfg.enableClient {
-      substituters = [ cfg.host ];
-      trusted-public-keys = [ cfg.publicKey ];
-    };
-
-    services.nix-serve = mkIf cfg.enableServer {
-      enable = true;
-      secretKeyFile = cfg.privateKeyFile;
-    };
-
-    users = mkIf cfg.enableServer {
-      users.nix-serve = { group = "nix-serve"; isSystemUser = true; };
-      groups.nix-serve = { };
-    };
-
-    services.nginx = mkIf cfg.enableServer {
-      enable = true;
-      recommendedProxySettings = true;
-      virtualHosts = {
-        # ... existing hosts config etc. ...
-        "${cfg.host}" = {
-          locations."/".proxyPass = "http://${config.services.nix-serve.bindAddress}:${toString config.services.nix-serve.port}";
-        };
-      };
-    };
-  };
-}

nki-home/configuration.nix

@@ -10,6 +10,8 @@ with lib;
     [
       # Include the results of the hardware scan.
       ./hardware-configuration.nix
+      # secret management
+      ./secrets
       # Fonts
       ../modules/personal/fonts
       # Encrypted DNS
@@ -31,13 +33,6 @@ with lib;
   common.linux.sops.enable = true;
   common.linux.sops.file = ./secrets.yaml;
 
-  # Nix cache server
-  sops.secrets."nix-cache/private-key" = { owner = "nix-serve"; group = "nix-serve"; mode = "0600"; };
-  nki.services.nix-cache = {
-    enableServer = true;
-    privateKeyFile = config.sops.secrets."nix-cache/private-key".path;
-  };
-
   # Networking
   common.linux.networking =
     {

nki-home/secrets.yaml

@@ -13,8 +13,6 @@ dtth-wg:
     preshared-key: ENC[AES256_GCM,data:96q0ZfvPz4pb53XvTGameVkcETamYH8Xbv69672RBdacH6QjRCCVvPnBTfA=,iv:Q2Yonb07/Uu6KidhMgRX4zJuNU1ZySNC7g/5TwpMU80=,tag:1qQQdk20yIQlGZmX+/25RA==,type:str]
 peertube:
     dtth-key: ENC[AES256_GCM,data:Gu7qOisVBZrFXKBr51165FJ7Ej4hV+lIf3AMC02R3UFNXOnTHF2xC8E=,iv:F83FuD1VjZEJFMcx3gkQuKCpJmYdHtO15fRHkYdMxJM=,tag:ScH42Tr5ZsIo9JMnXhylSw==,type:str]
-nix-cache:
-    private-key: ENC[AES256_GCM,data:4sbfIQb10Y50CrZbgjN+1iXEbXTpDqMbIB/yA3WlaAqhLtb8HKib5aZX3DLoxFbVihJcztQsvBBgEAhT9iMijoksaT9qzBQ5yIn4NGCfFem1DK8DQdjhTLMCVTyMFCT7hQHu/2Sd7w==,iv:zTSxuKOtOLekOBKBvl9MScD/Bo1Hviqq/n8Saa+1Cgo=,tag:fx73fCDPY9d07V3KKMw3DA==,type:str]
 sops:
     kms: []
     gcp_kms: []
@@ -48,8 +46,8 @@ sops:
             bUhIT0Z2b1dVWGNyS1hRVFRyZTA4d00KchP7EhSOMwBl5vFuuskzosRoi8jUu1sw
             hVjJNF2a40ewgkQgVAoWEzirHbknbQORzmepDDRth7Bve3UQU64+GA==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2024-08-16T12:16:41Z"
-    mac: ENC[AES256_GCM,data:x3zeCDljzyRpro4sem2pC33rFfm5jAjFhhX9JNlzLB6aNZ1TUv0qz4g7NhkWY23XNjJFmYqIW+pib97OVDd15kRojknM/UYCThW5oZDIWKn+TA9+bF9NGBjxP60t3n3dlU5VmgD8bgiApUS+XzHnJXuxhfiIHclvfxdLC33R7S4=,iv:str4fZX58mzFlD4rYaLmiCAeZmHIernG3636Tt+Rwgg=,tag:qS47OGc/o4/0Cj/V4e8dBg==,type:str]
+    lastmodified: "2024-04-18T13:34:51Z"
+    mac: ENC[AES256_GCM,data:cinVE1pHSgjCRPIDwANzR0oHw7zdN8DVDQKkhXT5j+dGiaFzNvLoYyMcEsjoxAjEdup3YMo+Vg6I4C94AUCrTn7N9BGjnGFVQz3m9q13zORi1+HWam0VItBzJm1iIo8x0PPs79OBaIHVUFAz8r4DW46P/LQISl9MQSDpCCTjVVk=,iv:2VAehWaoh2lNZM8jlmt+dqo5eeHfcr++eAdQfm/tCcM=,tag:QSnbObe3046AnFpK3Y01Eg==,type:str]
     pgp: []
     unencrypted_suffix: _unencrypted
-    version: 3.9.0
+    version: 3.8.1

nki-yoga-g8/configuration.nix

@@ -16,8 +16,8 @@
     ];
 
   # Secrets
-  common.linux.sops.enable = true;
-  common.linux.sops.file = ./secrets.yaml;
+  sops.defaultSopsFile = ./secrets.yaml;
+  sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
 
   ## tinc
   sops.secrets."tinc-private-key" = { };