Sif config, remote website build, agenix for secrets

common.nix

@@ -1,7 +1,9 @@
 # Holds common settings for *all* systems, including both servers and
 # clients.
 
-{ pkgs, oxalica, ... }: {
+{ pkgs, oxalica, agenix, ... }: {
+
+	imports = [ agenix.nixosModule ];
 
     nix = {
         optimise.automatic = true;
@@ -24,6 +26,8 @@
         ];
     };
 
+    age.secrets."website-secret".file = ./secrets/website-secret.age;
+
     boot.cleanTmpDir = true;
 
     environment.systemPackages = [

flake.lock

@@ -1,5 +1,23 @@
 {
   "nodes": {
+    "agenix": {
+      "inputs": {
+        "nixpkgs": "nixpkgs"
+      },
+      "locked": {
+        "lastModified": 1652712410,
+        "narHash": "sha256-hMJ2TqLt0DleEnQFGUHK9sV2aAzJPU8pZeiZoqRozbE=",
+        "owner": "ryantm",
+        "repo": "agenix",
+        "rev": "7e5e58b98c3dcbf497543ff6f22591552ebfe65b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "ryantm",
+        "repo": "agenix",
+        "type": "github"
+      }
+    },
     "flake-utils": {
       "locked": {
         "lastModified": 1637014545,
@@ -17,7 +35,7 @@
     },
     "home-manager": {
       "inputs": {
-        "nixpkgs": "nixpkgs"
+        "nixpkgs": "nixpkgs_2"
       },
       "locked": {
         "lastModified": 1653153149,
@@ -34,6 +52,22 @@
       }
     },
     "nixpkgs": {
+      "locked": {
+        "lastModified": 1638587357,
+        "narHash": "sha256-2ySMW3QARG8BsRPmwe7clTbdCuaObromOKewykP+UJc=",
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "e34c5379866833f41e2a36f309912fa675d687c7",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nixos",
+        "ref": "nixos-21.11",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_2": {
       "locked": {
         "lastModified": 1653117584,
         "narHash": "sha256-5uUrHeHBIaySBTrRExcCoW8fBBYVSDjDYDU5A6iOl+k=",
@@ -47,7 +81,7 @@
         "type": "indirect"
       }
     },
-    "nixpkgs_2": {
+    "nixpkgs_3": {
       "locked": {
         "lastModified": 1653060744,
         "narHash": "sha256-kfRusllRumpt33J1hPV+CeCCylCXEU7e0gn2/cIM7cY=",
@@ -63,7 +97,7 @@
         "type": "github"
       }
     },
-    "nixpkgs_3": {
+    "nixpkgs_4": {
       "locked": {
         "lastModified": 1637453606,
         "narHash": "sha256-Gy6cwUswft9xqsjWxFYEnx/63/qzaFUwatcbV5GF/GQ=",
@@ -82,7 +116,7 @@
     "oxalica": {
       "inputs": {
         "flake-utils": "flake-utils",
-        "nixpkgs": "nixpkgs_3"
+        "nixpkgs": "nixpkgs_4"
       },
       "locked": {
         "lastModified": 1653273659,
@@ -100,8 +134,9 @@
     },
     "root": {
       "inputs": {
+        "agenix": "agenix",
         "home-manager": "home-manager",
-        "nixpkgs": "nixpkgs_2",
+        "nixpkgs": "nixpkgs_3",
         "oxalica": "oxalica"
       }
     }

flake.nix

@@ -17,6 +17,11 @@
             url = github:oxalica/rust-overlay;
         };
 
+		# For managing secrets
+        agenix = {
+            url = "github:ryantm/agenix";
+        };
+
     };
 
     outputs = args: with args.nixpkgs; {

machines/sif/README.md

@@ -0,0 +1,3 @@
+# Sif
+
+Sif is the server that hosts my website. It's a Raspberry Pi 3.

machines/sif/configuration.nix

@@ -3,7 +3,15 @@
 {
 
     imports = [
+
 		../../modules
+
+		# Reverse proxy
+		./nginx.nix
+
+		# Website
+		./website.nix
+
     ];
 
 	networking.hostName = "sif";
@@ -13,6 +21,8 @@
 		generic-extlinux-compatible.enable = true;
 	};
 
+	documentation.enable = false;
+
 	environment.systemPackages = with pkgs; [
 		git
 		vim
@@ -33,6 +43,8 @@
 		extraGroups = [ "wheel" ];
 	};
 
+	networking.interfaces.eth0.useDHCP = true;
+
 	boot.kernelPackages = pkgs.linuxPackages_latest;
 
 	fileSystems."/" = {
@@ -40,4 +52,30 @@
 		fsType = "ext4";
 	};
 
+	nix = {
+		distributedBuilds = true;
+		buildMachines = [{
+			hostName = "thor";
+			systems = [
+    			"x86_64-linux"
+                "aarch64-linux"
+			];
+            supportedFeatures = [
+                "nixos-test"
+                "benchmark"
+                "big-parallel"
+                "kvm"
+            ];
+		}];
+	};
+
+	programs.ssh.extraConfig = ''
+        Host thor
+            HostName thor
+            Port 22
+            User riley
+            IdentitiesOnly yes
+            IdentityFile /root/.ssh/id_ed25519
+    '';
+
 }

machines/sif/nginx.nix

@@ -0,0 +1,42 @@
+{ ... }:
+
+{
+
+    security.acme = {
+        acceptTerms = true;
+        email = "me@riley.lgbt";
+    };
+
+    services.nginx.enable = true;
+    services.nginx.virtualHosts = {
+        "riley.lgbt" = {
+            listen = [{
+                port = 443;
+                addr = "77.169.117.112";
+            }];
+            enableACME = true;
+            locations."/" = {
+                 proxyPass = "http://localhost:3000";
+                 extraConfig = ''
+                     proxy_set_header Host $host;
+                     proxy_buffering off;
+                 '';
+            };
+        };
+        "rly.cx" = {
+            listen = [{
+                port = 443;
+                addr = "77.169.117.112";
+            }];
+            enableACME = true;
+            locations."/" = {
+                 proxyPass = "http://localhost:3000";
+                 extraConfig = ''
+                     proxy_set_header Host $host;
+                     proxy_buffering off;
+                 '';
+            };
+        };
+    };
+
+}

machines/sif/website.nix

@@ -0,0 +1,26 @@
+{ pkgs, lib, config, ... }:
+
+let secret = config.age.secrets."website-secret".path;
+    website = pkgs.rustPlatform.buildRustPackage {
+    	pname = "website";
+    	version = "1.0.0";
+        cargoSha256 = "sha256-sT5BONGXWCpc+455TS1rc/SwNUtc6hXbwUMO/q/tiJ0=";
+
+    	postPatch = ''
+    		cp ${secret} secret
+    	'';
+        
+    	src = pkgs.fetchgit {
+    		url = "https://im.badat.dev/riley/website.git";
+    		rev = "refs/heads/mistress";
+    		sha256 = "sha256-NiFinpSOE1wokOgBmgpZfMqR9AsENA9t/N84c/Ms2vU=";
+    	};
+    };
+in {
+	systemd.services."website" = {
+		enable = true;
+		description = "Run my website :)";
+		path = [ website ];
+		script = "${website}/bin/website";
+	};
+}

secrets/secrets.nix

@@ -0,0 +1,4 @@
+let commonKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOIXreYQgV6lS0rJ1NlAbgq3Iv5FJ8o1MOr08NhLTGFG";
+in {
+	"website-secret.age".publicKeys = [ commonKey ];
+}

secrets/website-secret.age

@@ -0,0 +1,7 @@
+age-encryption.org/v1
+-> ssh-ed25519 ZEUNCQ D7HH+PR/jwjbb2LKJLVyADJjPvFflRDf61PywFWvpH0
+4pEJdyC8Obe7t+S5a2Yn52lfM7klw8eAsfZ6H48ivbg
+-> ^MruyW-grease S`2pFl
+z8kUgel+3sOrgcGwRRRPcvqCF7X1EmmbR6mUymUbuT0
+--- GvdH/J6Aa9dnK5QttDoOQTuZZos7s7xqPvPNJRF5A/k
+€[Å4mm!›‡Â¾8‰
Ü,%<25><>t;´“'áNæª11ò™ÿOQh5×['¨’_