3 files changed, 89 insertions, 43 deletions
diff --git a/nix-conf/machines/djmuk2/configuration.nix b/nix-conf/machines/djmuk2/configuration.nix
index 8d679ac..0b31a01 100644
--- a/nix-conf/machines/djmuk2/configuration.nix
+++ b/nix-conf/machines/djmuk2/configuration.nix
@@ -1,7 +1,6 @@
-{ config, pkgs, ... }: {
-  imports = [
-    ./hardware-configuration.nix
-  ];
+{ config, pkgs, ... }:
+{
+  imports = [ ./hardware-configuration.nix ];
 
   boot.tmp.cleanOnBoot = true;
   zramSwap.enable = true;
@@ -31,49 +30,65 @@
   services.sshguard.enable = true;
   services.oidentd.enable = true;
 
-  services.locate = {
-    enable = true;
-    package = pkgs.plocate;
-    localuser = null;
-  };
+  services.locate.enable = true;
 
-  users.users.djm =
-   { isNormalUser = true;
-     home = "/home/djm";
-     description = "David Morgan";
-     extraGroups = [ "wheel" "plocate" ];
-     shell = pkgs.zsh;
-     openssh.authorizedKeys.keys = [
+  # Emulate nix-sops. Technically an anti-pattern, but this isn't a real secret, and this has to be embedded here, as we cannot set a file path to read it from.
+  # Populate/update with:
+  # SOPS_AGE_KEY=$(doas ssh-to-age -private-key -i /etc/ssh/ssh_host_ed25519_key) sops -d --extract '["openiscsi_name"]' machines/djmuk2/secrets.yaml | doas tee /root/.config/secrets/openiscsi_name
+  services.openiscsi.enable = true;
+  services.openiscsi.name = builtins.readFile "/root/.config/secrets/openiscsi_name";
+  #services.openiscsi.enableAutoLoginOut = true;
+
+  users.users.djm = {
+    isNormalUser = true;
+    home = "/home/djm";
+    description = "David Morgan";
+    extraGroups = [
+      "wheel"
+      "plocate"
+    ];
+    shell = pkgs.zsh;
+    openssh.authorizedKeys.keys = [
       "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCurCpxZCHtByB5wXzsjTXwMyDSB4+B8rq5XY6EGss58NwD8jc5cII4i+QUbCOGTiAggSZUSC9YIP24hjpOeNT/IYs5m7Qn1B9MtBAiUSrIYew8eDwnMLlPzN+k2x9zCrJeCHIvGJaFHPXTh1Lf5Jt2fPVGW9lksE/XUVOe6ht4N/b+nqqszXFhc8Ug6le2bC1YeTCVEf8pjlh/I7DkDBl6IB8uEXc3X2vxxbV0Z4vlBrFkkAywcD3j5VlS/QYfBr4BICNmq/sO3fMkbMbtAPwuFxeL4+h6426AARQZiSS0qVEc8OoFRBVx3GEH5fqVAWfB1geyLzei22HbjUcT9+xN davidmo@gendros"
       "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIK9UDTaVnUOU/JknrNdihlhhGOk53LmHq9I1ASri3aga djm@gaius"
-     ];
-   };
+    ];
+  };
 
-   security.sudo.extraConfig = ''
-     djm ALL=(ALL) NOPASSWD: ALL
-   '';
-   security.doas = {
-     enable = true;
-     extraRules = [ { users = [ "djm" ]; noPass = true; keepEnv = true; } ];
-   };
+  security.sudo.extraConfig = ''
+    djm ALL=(ALL) NOPASSWD: ALL
+  '';
+  security.doas = {
+    enable = true;
+    extraRules = [
+      {
+        users = [ "djm" ];
+        noPass = true;
+        keepEnv = true;
+      }
+    ];
+  };
 
-   programs.zsh.enable = true;
+  programs.zsh.enable = true;
 
-   programs.vim.defaultEditor = true;
+  programs.vim = {
+    enable = true;
+    defaultEditor = true;
+  };
 
-   environment.systemPackages = with pkgs; [
-     #procmail
-     git
-     vim
-     wget
-   ];
+  environment.systemPackages = with pkgs; [
+    #procmail
+    git
+    wget
+  ];
 
-   nix.settings.trusted-users = [ "root" "djm" ];
-   nix.optimise.automatic = true;
-   nix.optimise.dates = [ "03:00" ];
+  nix.settings.trusted-users = [
+    "root"
+    "djm"
+  ];
+  nix.optimise.automatic = true;
+  nix.optimise.dates = [ "03:00" ];
 
-   i18n.defaultLocale = "en_GB.UTF-8";
+  i18n.defaultLocale = "en_GB.UTF-8";
 
-   system.stateVersion = "22.05";
+  system.stateVersion = "22.05";
 }
-
diff --git a/nix-conf/machines/djmuk2/hardware-configuration.nix b/nix-conf/machines/djmuk2/hardware-configuration.nix
index e27e899..5c421f9 100644
--- a/nix-conf/machines/djmuk2/hardware-configuration.nix
+++ b/nix-conf/machines/djmuk2/hardware-configuration.nix
@@ -6,9 +6,19 @@
     efiInstallAsRemovable = true;
     device = "nodev";
   };
-  fileSystems."/boot" = { device = "/dev/disk/by-uuid/4875-017B"; fsType = "vfat"; };
-  boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "xen_blkfront" ];
+  fileSystems."/boot" = {
+    device = "/dev/disk/by-uuid/4875-017B";
+    fsType = "vfat";
+  };
+  boot.initrd.availableKernelModules = [
+    "ata_piix"
+    "uhci_hcd"
+    "xen_blkfront"
+  ];
   boot.initrd.kernelModules = [ "nvme" ];
-  fileSystems."/" = { device = "/dev/mapper/ocivolume-root"; fsType = "xfs"; };
-  
+  fileSystems."/" = {
+    device = "/dev/mapper/ocivolume-root";
+    fsType = "xfs";
+  };
+
 }
diff --git a/nix-conf/machines/djmuk2/secrets.yaml b/nix-conf/machines/djmuk2/secrets.yaml
new file mode 100644
index 0000000..3216fd3
--- /dev/null
+++ b/nix-conf/machines/djmuk2/secrets.yaml
@@ -0,0 +1,21 @@
+openiscsi_name: ENC[AES256_GCM,data:RZtrRGCnYgiAwq1bVnyK8fiYCxCKbtNs5diV3nUmNWAhU8CYRxau6SIAhB9t3f7p1fKgVC1V0fxV0nko6tdK,iv:M7qSnfBdxdTaCIb2/QZfrTUOZGX19IJY69IncTEk68w=,tag:eIo0fSKZTMEakGHh2zi5oQ==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age17j56andser5ddtlfunm35m25xueua4djh9glxlscfcet8865yv9s5aqvla
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA5UFgxckhMa1RWL3hGQkZw
+            M25XN1JkT2dnQk9iVXdyaFJsa3hMM0pVam04CmZSWFdJbnl4RzFpUUpYK2JmRXFO
+            L3ZZbXZ3aHA4NjBuRCtnYlpsNG94ZVkKLS0tIFNIUTVjOUxhS00zZFlyODVuQ1lB
+            bC9sLzdObkpFNTJRcmk3N3Y0TG1xakkKvFbr1YlLFS7c0BfK1MYczTXgjwcaNjxH
+            tHCQWzVyx1VzLID1TCQDGXWApkaaQYxa2d/afTTRxk98w6xJIvLj2g==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2024-09-03T15:08:24Z"
+    mac: ENC[AES256_GCM,data:CtMDdk/tY52HLDuTHIUWF8qV3wdyykWnEKJk0bGMT+feWd/+PAzJRzCOVDuL6AxT1FmtZGx2lFZz6A9vzFbGsn1fawXVo40q+6TWpdcv80tRaicfyh1FTppWGNOJn/bh7DILuX41HRTEP2ngpMHwSr3cbCUfhxrV+r7giguj1do=,iv:uGe15h57SyQr8yi19sqDRPwtC/4WmBAwqvsHI5g5pAc=,tag:2Lv+QZf0CsgusJMay9MyQQ==,type:str]
+    pgp: []
+    unencrypted_suffix: _unencrypted
+    version: 3.8.1