From 1162318ebe58907d6d7d5057559c0af81e884d1e Mon Sep 17 00:00:00 2001 From: KeksNino Date: Fri, 11 Sep 2026 22:13:01 +0200 Subject: [PATCH] add sops-nix for mpdscribble and slskd --- flake.lock | 27 ++++++++++++++++++++++++--- flake.nix | 6 ++++++ hosts/desktop/configuration.nix | 1 + modules/home/mpd.nix | 3 ++- modules/server/slskd.nix | 4 ++-- modules/sops.nix | 15 +++++++++++++++ secrets/secrets.yaml | 17 +++++++++++++++++ 7 files changed, 67 insertions(+), 6 deletions(-) create mode 100644 modules/sops.nix create mode 100644 secrets/secrets.yaml diff --git a/flake.lock b/flake.lock index 5cb5325..b6527d6 100644 --- a/flake.lock +++ b/flake.lock @@ -865,6 +865,7 @@ "nixpkgs-patcher": "nixpkgs-patcher", "nixvim": "nixvim", "sls-steam": "sls-steam", + "sops-nix": "sops-nix", "xremap-flake": "xremap-flake", "zen-browser": "zen-browser" } @@ -890,6 +891,26 @@ "type": "github" } }, + "sops-nix": { + "inputs": { + "nixpkgs": [ + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1788914643, + "narHash": "sha256-4GuMPW90JSxXWDPUB9M+1m7fYbe3H0apOd86/zBQ2Kw=", + "owner": "Mic92", + "repo": "sops-nix", + "rev": "13616fff713a9f94055c66f15687ebdc17a335df", + "type": "github" + }, + "original": { + "owner": "Mic92", + "repo": "sops-nix", + "type": "github" + } + }, "steam-src": { "flake": false, "locked": { @@ -1047,11 +1068,11 @@ "nixpkgs": "nixpkgs_7" }, "locked": { - "lastModified": 1788864239, - "narHash": "sha256-a2BIiekLSIgruRro3fXQgohmw3xlCFJBGW/TKK4x+E8=", + "lastModified": 1789133576, + "narHash": "sha256-wJJGLMs78PDdbdXd0f50vq7s+xpKOuAUMZPsyDgXyew=", "owner": "0xc000022070", "repo": "zen-browser-flake", - "rev": "018726119b87c9fb906857af802d3cbfbc10a46d", + "rev": "975870eb40a0cb6dc1baf6d63a704f9cfd5d4f27", "type": "github" }, "original": { diff --git a/flake.nix b/flake.nix index 6a95f91..fcd7fe8 100644 --- a/flake.nix +++ b/flake.nix @@ -28,6 +28,10 @@ url = "github:KeksNino/ASSella-nix"; inputs.nixpkgs.follows = "nixpkgs"; }; + sops-nix = { + url = "github:Mic92/sops-nix"; + inputs.nixpkgs.follows = "nixpkgs"; + }; }; outputs = @@ -44,6 +48,7 @@ nix-flatpak, nixpkgs-patcher, assella, + sops-nix, ... }@inputs: let @@ -56,6 +61,7 @@ inherit (inputs) sls-steam bcdl-free + sops-nix ; }; nixpkgsPatcher.inputs = inputs; diff --git a/hosts/desktop/configuration.nix b/hosts/desktop/configuration.nix index 631a524..6a6824e 100644 --- a/hosts/desktop/configuration.nix +++ b/hosts/desktop/configuration.nix @@ -11,6 +11,7 @@ ./packages.nix ./hardware-configuration.nix ../../modules/git.nix + ../../modules/sops.nix ../../modules/office.nix ../../modules/scripts.nix ../../modules/desktop/vr.nix diff --git a/modules/home/mpd.nix b/modules/home/mpd.nix index 6059070..5f152e6 100644 --- a/modules/home/mpd.nix +++ b/modules/home/mpd.nix @@ -32,7 +32,7 @@ enable = true; endpoints = { "last.fm" = { - passwordFile = "/home/user/lastfm_password"; + passwordFile = "/run/secrets/lastfm_password"; username = "KeksNino"; }; }; @@ -118,6 +118,7 @@ "": UpHalf, "N": PreviousResult, "a": Add, + "a": AddOptions(kind: Action(all: false, position: AfterCurrentSong)), "A": AddAll, "r": Rename, "n": NextResult, diff --git a/modules/server/slskd.nix b/modules/server/slskd.nix index 9f50092..d897b66 100644 --- a/modules/server/slskd.nix +++ b/modules/server/slskd.nix @@ -3,7 +3,7 @@ { services.slskd = { enable = true; - environmentFile = /home/user/slskd_secrets; + environmentFile = /run/secrets/slskd_secrets; user = "user"; settings = { remote_file_management = true; @@ -102,7 +102,7 @@ RestartSec = 30; StandardOutput = "journal"; StandardError = "journal"; - EnvironmentFile = "/home/user/slskd_secrets"; + EnvironmentFile = "/run/secrets/slskd_secrets"; ExecStart = '' ${pkgs.python3}/bin/python3 /home/user/slskd-speed.py \ -u "$SLSKD_SLSK_USERNAME" \ diff --git a/modules/sops.nix b/modules/sops.nix new file mode 100644 index 0000000..e3d8d8f --- /dev/null +++ b/modules/sops.nix @@ -0,0 +1,15 @@ +{ sops-nix, ... }: +{ + imports = [ + sops-nix.nixosModules.sops + ]; + + sops.defaultSopsFile = ../secrets/secrets.yaml; + sops.defaultSopsFormat = "yaml"; + sops.age.keyFile = "/home/user/.config/sops/age/keys.txt"; + sops.secrets."lastfm_password" = { + owner = "user"; + }; + sops.secrets."slskd_secrets" = { }; + +} diff --git a/secrets/secrets.yaml b/secrets/secrets.yaml new file mode 100644 index 0000000..d39a73b --- /dev/null +++ b/secrets/secrets.yaml @@ -0,0 +1,17 @@ +lastfm_password: ENC[AES256_GCM,data:k8wfXqaUOMAuoZ05uM8=,iv:bgvMefgKZM02Wio41HgFmOBQ/n7jnTFtjmZDPt7X5Vk=,tag:6NFalog2QjsHwhSBpWyt1w==,type:str] +slskd_secrets: ENC[AES256_GCM,data:TucvWuybP5KNNeUGPs80MPscRfGKMsQPD/4oPgRV1XIA/8r7lULDZvVGHAjujxxg013nY61HFbRoWGtLjFBDeu+WyNxcZtucKQhdAQE1o0Vmm/NAa93WyLlGeoBeOj4qb31e4exYHokxQXp5b2BsaJ5MatkkJVSbrliELg2zLgbcRa1uxSfTHXrVyWVSRBB8,iv:rR5nsBmHg9xRaytMdx/ko9XU5pchb1D5VsQsPy21who=,tag:EQ6USTwGiELllZrJhAPqJA==,type:str] +sops: + age: + - enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA3cThSQVJwUE9OWjhjZlNY + OWFLZVgvU2QvdEQyVWR6NmFFY0lscmJUR213CmZEWWFEUTgvaHAyTi9jVnhsWFFE + cHU1U011SURvZGsxalRGMmNNUk53MGsKLS0tIEVGTVA4N25HazRNM0tzVExEV2RB + K1ZHTjB0WFgyeno2MDNReUJkYktMcGsKb9Bc+MAK5hudUUtCwHcAttmSPYT9MDZG + kF8qcidjuq6S8ll7re4TEPvidwwVDmqiIAx4M28B70xB57rtr+2q2Q== + -----END AGE ENCRYPTED FILE----- + recipient: age1pwwatyrc0vftxx72muq43kwvhm8apl4g5de0d4dr8q490mp38gmst3g24q + lastmodified: "2026-09-11T20:06:51Z" + mac: ENC[AES256_GCM,data:C80wh5s2Ef+Q9OpG6+WP0VDCPlwhzUOXZTLUJhn1HWCjWURExTXNW3NsvriQ5E4pezOkjaWjYSNEka1movtuUwkTSvFop1Wis/kHPibh9Erge//ia9VA/4npY3iGRH8Bl/6d/7lbHNl66zC+9/yKesiRRBbjqy5winyprvBOP2I=,iv:WFhvmY10yQ8H9+9GkAcWQFe3LtT/lR1mNGGrSeTJovU=,tag:+oO45a1AFCDnXfJiurxESA==,type:str] + unencrypted_suffix: _unencrypted + version: 3.13.3