Personal Nix flake
nixos
home-manager
nix
feat: Enable syncthing on raspberrypi, misc improvements
+49
-12
+1
.github/workflows/update-flake.yml
+1
.github/workflows/update-flake.yml
+1
keys/github.pub
+1
keys/github.pub
···
1
+
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJMlCP3GL7MCCZHvQcbNyET6HGT2BbLuBkDQPZ2tk8TU github.com
+1
keys/tangled.pub
+1
keys/tangled.pub
···
1
+
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJ+uIAmaOxc9or9djd+yUcmrPKcdjzIQhydOPrLipUbW tangled.com
+1
keys/yubikey-25388788.pub
+1
keys/yubikey-25388788.pub
···
1
+
sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIOq7xMJxBehEnVZHYtUvrS51OjJskVQBkgMM/wIrQVKpAAAACnNzaDpnaXRodWI= ssh:github
+1
keys/yubikey-26583315.pub
+1
keys/yubikey-26583315.pub
···
1
+
sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIL92uxU/gdt0slWOcy0Lx4LUPlgZmfiMTWR4GYAV2iZgAAAACnNzaDpnaXRodWI= ssh:github
+3
nix/home/modules/ssh/default.nix
+3
nix/home/modules/ssh/default.nix
+12
-1
nix/home/modules/syncthing/default.nix
+12
-1
nix/home/modules/syncthing/default.nix
···
24
24
tray.enable = true;
25
25
cert = config.my.secrets."host.syncthing-cert".path;
26
26
key = config.my.secrets."host.syncthing-key".path;
27
+
overrideDevices = true;
28
+
overrideFolders = true;
27
29
settings = {
28
30
gui.theme = "dark";
29
31
options = {
···
35
37
folders = let
36
38
computers = ["desktop" "laptop" "steamdeck"];
37
39
phones = ["galaxyS23"];
38
-
servers = ["server"];
40
+
servers = ["raspberrypi" "server"];
39
41
allDevices = computers ++ phones ++ servers;
40
42
trashVersioning = {
41
43
type = "trashcan";
···
63
65
versioning = trashVersioning;
64
66
devices = allDevices;
65
67
};
68
+
"~/Notes/Work" = {
69
+
id = "gkcpi-lubwx";
70
+
label = "Notes/Work";
71
+
type = "sendreceive";
72
+
versioning = trashVersioning;
73
+
devices = allDevices;
74
+
};
66
75
"~/.steam/steam/userdata/85204334/config/grid" = {
67
76
id = "steam-custom-icons";
68
77
label = "Steam/Custom Icons";
···
80
89
pixel7.name = "Pixel 7 Pro";
81
90
galaxyS23.id = "DPARDTW-7LHI6VK-CRKEYI4-VK6BWWP-DMW6KOG-6LWAT4O-QFGDFPR-XVO6RAF";
82
91
galaxyS23.name = "Galaxy S23";
92
+
raspberrypi.id = "XT3UPMT-4I4FJ5W-YTHHID6-GGM57IS-RE7Z7PU-FMYJMGW-T7MJVZF-3MLJTQK";
93
+
raspberrypi.name = "Raspberry Pi";
83
94
server.id = "X5LHXQ6-NOCD2NO-RQ7FPLO-WFLLFRE-5BTTVL6-XLH3DAV-4ZIYI47-EEOVYAK";
84
95
server.name = "Server";
85
96
steamdeck.id = "OBZRWRW-B7DYVZC-RL5JV3D-6YNWG4O-MAIN2GY-KTEBY6V-DWQK36S-5E2O7AB";
+5
-5
nix/lib/config.nix
+5
-5
nix/lib/config.nix
···
21
21
wallpaper = assetWithPrefix "wallpaper";
22
22
profilePicture = assetWithPrefix "profile-picture";
23
23
ssh.publicKeys = {
24
-
github = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJMlCP3GL7MCCZHvQcbNyET6HGT2BbLuBkDQPZ2tk8TU github.com";
25
-
tangled = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJ+uIAmaOxc9or9djd+yUcmrPKcdjzIQhydOPrLipUbW tangled.com";
24
+
github = ../../keys/github.pub;
25
+
tangled = ../../keys/tangled.pub;
26
26
perHost =
27
27
../../secrets/perHost
28
28
|> lib.filesystem.listFilesRecursive
29
29
|> builtins.filter (lib.hasSuffix "ssh.pub")
30
30
|> map (value: {
31
-
value = builtins.readFile value;
31
+
inherit value;
32
32
name =
33
33
value
34
34
|> toString
···
38
38
})
39
39
|> builtins.listToAttrs;
40
40
perYubikey = {
41
-
"25388788" = "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIOq7xMJxBehEnVZHYtUvrS51OjJskVQBkgMM/wIrQVKpAAAACnNzaDpnaXRodWI= ssh:github";
42
-
"26583315" = "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIL92uxU/gdt0slWOcy0Lx4LUPlgZmfiMTWR4GYAV2iZgAAAACnNzaDpnaXRodWI= ssh:github";
41
+
"25388788" = ../../keys/yubikey-25388788.pub;
42
+
"26583315" = ../../keys/yubikey-26583315.pub;
43
43
};
44
44
};
45
45
nix = {
-1
nix/nixos/configs/raspberrypi/default.nix
-1
nix/nixos/configs/raspberrypi/default.nix
+1
-1
nix/nixos/modules/users/lpchaim.nix
+1
-1
nix/nixos/modules/users/lpchaim.nix
···
29
29
group = userName;
30
30
shell = pkgs.${shell};
31
31
hashedPasswordFile = "${config.my.secrets."user.lpchaim.password".path}";
32
-
openssh.authorizedKeys.keys =
32
+
openssh.authorizedKeys.keyFiles =
33
33
perYubikey
34
34
// {inherit (perHost) laptop desktop;}
35
35
|> builtins.attrValues;
secrets/perHost/raspberrypi/syncthing-cert.age
secrets/perHost/raspberrypi/syncthing-cert.age
This is a binary file and will not be displayed.
+10
secrets/perHost/raspberrypi/syncthing-key.age
+10
secrets/perHost/raspberrypi/syncthing-key.age
···
1
+
age-encryption.org/v1
2
+
-> piv-p256 0D9K1g Am7IqsMHLkLVtiIkfHpI81ux8czgVs8/piBncZXoiRty
3
+
P5x6Cj27i6UnLN16a+u/7ttuvCmpXBoWrlqtM5OrDuA
4
+
-> piv-p256 4lCx1w A7pR2QoZMJxw2tzhiuEVsBWwv5C4s74kSIOBZyYoDsmv
5
+
Pthsr2UWyBwuyavG0uBgE6vA1KvLg/RsEbvIPoyLUfk
6
+
-> `&-grease n($
7
+
slgZ7o+oOrA6xW+iXPk+
8
+
--- JRsm8ddtmf0juu11DVFeHixddEVAVIMPOKe1Saxb+AU
9
+
`���#������ >L�p�+w(�� �Qy���O H�H�5��ge T}3�!��Nh���܆hJ��K�j�w,J�3fw`�bS"�� $ag���/+�����JI/�M �T7��DF�ߎ!��Uf
10
+
�y�_�����?{G����}s:# _�ɚ
+9
secrets/rekeyed/raspberrypi/7ca16fe6117bbd91659e9b8307f78897-host.syncthing-key.age
+9
secrets/rekeyed/raspberrypi/7ca16fe6117bbd91659e9b8307f78897-host.syncthing-key.age
···
1
+
age-encryption.org/v1
2
+
-> ssh-ed25519 7Q9N6w o+TcXJRjZvaY9/Zl+bcNjKJMrL9Nj8ux47r69M37DCU
3
+
0y2P7E82Y0m3e8+TdZpmaP2/j1cKXx97y4yVFJm8OlU
4
+
-> A-grease %jW7':
5
+
Hn+IQl3GLt9oGQrR4bZGlmL5QkBoDjoKCkWBky5judIyoeTpSkmlWsT74z0bJq/R
6
+
OBavRw4SOC5PU2fQOw
7
+
--- bNU4OmG0/sXPSjT34zNKTw9qCv2H/KlTWcdmuZX7y9Y
8
+
���nM�h?���E�� ;��X�=9 ��R*�+�&���0��= eVx�`O�2������4fgh�,*?E^��Z4#�ş*�,>]�����:r/��d|���0
9
+
:@��?+��2uI�g�����X�O9;.OߑT<N��s�7�\̊Џ�dۻ
secrets/rekeyed/raspberrypi/d82ca35ed0162f0dbce685ad556b29bb-host.syncthing-cert.age
secrets/rekeyed/raspberrypi/d82ca35ed0162f0dbce685ad556b29bb-host.syncthing-cert.age
This is a binary file and will not be displayed.