TheWanderingCrow/CrOS
1
0
Fork 0
mirror of https://github.com/TheWanderingCrow/CrOS.git synced 2026-01-11 17:54:08 -05:00
Code Issues Projects Releases Packages Wiki Activity Actions

lets see if this new vault stuff works out

Browse source
This commit is contained in:
TheWanderingCrow 2025-01-03 14:47:54 -05:00
parent 314b83a6c2
commit d8e9c05042
2 changed files with 42 additions and 29 deletions
Download patch file Download diff file Expand all files Collapse all files

69
modules/users/overseer/services.nix
View file

@ -7,10 +7,18 @@ in
pkgs,
...
}: {
# Some scafolding for secrets
sops = {
defaultSopsFile = ../../nix-secrets/secrets/overseer.json;
age.keyFile = "/var/lib/sops-nix/key.txt";
age.generateKey = true;
};
# Create the dirs we need
systemd.tmpfiles.rules = [
"d ${volumePath}"
"d ${volumePath}/vault/data 700 overseer overseer" # Vault says this needs to already exist upon boot
"d ${volumePath}/vault/snapshots 700 overseer overseer" # This is where we put snapshots for restic to backup
"d ${volumePath}/paperless/data 700 overseer overseer"
"d ${volumePath}/paperless/media 700 overseer overseer"
@ -19,34 +27,39 @@ in
"d ${volumePath}/NPM/letsencrypt 700 overseer overseer"
];
# Define some secrets to use in restic
sops.secrets."vault-backup/location" = {};
sops.secrets."vault-backup/pass" = {};
# (Arguably) Most Important Service - backups
services.restic.backups = {
npm = {
vault = {
user = "root";
timerConfig = {
OnCalendar = "hourly";
Persistent = true;
};
paths = [
"${volumePath}/NPM/data"
"${volumePath}/NPM/letsencrypt"
"${volumePath}/vault/snapshots"
];
backupPrepareCommand = "${pkgs.vault}/bin/vault operator raft snapshot save ${volumePath}/vault/snapshots/backup.snap";
repositoryFile = config.sops.secrets."vault-backup/location".path;
passwordFile = config.sops.secrets."vault-backup/pass".path;
};
};
# Vault Service
#services.vault = {
# enable = true;
# package = pkgs.vault-bin;
# storageBackend = "raft";
# storagePath = "${volumePath}/vault/data";
# address = "127.0.0.1:8200";
# extraConfig = ''
# ui = true
# api_addr = "http://127.0.0.1:8200"
# cluster_addr = "http://127.0.0.1:8201"
# '';
#};
services.vault = {
enable = true;
package = pkgs.vault-bin;
storageBackend = "raft";
storagePath = "${volumePath}/vault/data";
address = "127.0.0.1:8200";
extraConfig = ''
ui = true
api_addr = "http://127.0.0.1:8200"
cluster_addr = "http://127.0.0.1:8201"
'';
};
# Paperless-ngx
#services.paperless = {
@ -61,18 +74,18 @@ in
virtualisation.oci-containers.containers = {
## NGINX Proxy Manager
NPM = {
image = "jc21/nginx-proxy-manager:latest";
autoStart = true;
ports = [
"80:80"
"443:443"
"81:81"
];
volumes = [
"${volumePath}/NPM/data:/data"
"${volumePath}/NPM/letsencrypt:/etc/letsencrypt"
];
};
#NPM = {
# image = "jc21/nginx-proxy-manager:latest";
# autoStart = true;
# ports = [
# "80:80"
# "443:443"
# "81:81"
# ];
# volumes = [
# "${volumePath}/NPM/data:/data"
# "${volumePath}/NPM/letsencrypt:/etc/letsencrypt"
# ];
#};
};
}

2
nix-secrets

@ -1 +1 @@
Subproject commit a5093d3dca30fc8057c647a423c618e5d90f5028
Subproject commit d21933c3cc8ec3561ea8769362382272c34ceed4