From 77b69bb0a0aa17d5b9809cb00fee5f1345b1595e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Patrick=20Gro=C3=9Fmann?= Date: Tue, 7 Feb 2023 14:30:39 +0100 Subject: [PATCH] Fix: removed unusable warning in rekey module --- apps/rekey.nix | 7 +- configuration.nix | 11 +- flake.lock | 12 +- modules/rekey-drv.nix | 16 +- modules/rekey.nix | 25 ++- users/common/polybar.nix | 417 +++++++++++++++++++++++++++++++++++---- users/patrick.nix | 2 +- 7 files changed, 411 insertions(+), 79 deletions(-) diff --git a/apps/rekey.nix b/apps/rekey.nix index 6876440..869a4c3 100644 --- a/apps/rekey.nix +++ b/apps/rekey.nix @@ -9,12 +9,7 @@ with nixpkgs.lib; let rekeyCommandForHost = hostName: hostAttrs: let masterIdentities = strings.concatMapStrings (x: "-i ${x} ") hostAttrs.config.rekey.masterIdentityPaths; - pubKeyStr = let - pubKey = hostAttrs.config.rekey.pubKey; - in - if isPath pubKey - then readFile pubKey - else pubKey; + pubKeyStr = hostAttrs.config.rekey.pubKey; secretPath = "/tmp/nix-rekey.d/${builtins.hashString "sha1" pubKeyStr}/"; rekeyCommand = secretName: secretAttrs: let diff --git a/configuration.nix b/configuration.nix index f67ffce..a3a376f 100644 --- a/configuration.nix +++ b/configuration.nix @@ -28,7 +28,6 @@ rekey.masterIdentityPaths = [./secrets/NIXOSc.key ./secrets/NIXOSa.key]; rekey.pubKey = ./keys + "/${config.networking.hostName}.pub"; - rekey.plugins = [pkgs.age-plugin-yubikey]; networking.wireless.iwd.enable = true; rekey.secrets.eduroam = { @@ -88,24 +87,30 @@ powerManagement.powertop.enable = true; + # Disable mutable Users, any option can only be set by the nix config + users.mutableUsers = false; + + rekey.secrets.patrick.file = ./secrets/patrick.passwd.age; # Define a user account. Don't forget to set a password with ‘passwd’. users.users.patrick = { isNormalUser = true; uid = 1000; createHome = true; - extraGroups = ["wheel" "audio" "video" "input"]; # Enable ‘sudo’ for the user. + extraGroups = ["wheel" "audio" "video" "input"]; group = "patrick"; shell = pkgs.zsh; + passwordFile = config.rekey.secrets.patrick.path; }; users.groups.patrick.gid = 1000; + rekey.secrets.root.file = ./secrets/root.passwd.age; users.users.root = { - initialPassword = "ctie"; openssh.authorizedKeys.keys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDZixkix0KfKuq7Q19whS5FQQg51/AJGB5BiNF/7h/LM" "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHxD4GOrwrBTG4/qQhm5hoSB2CP7W9g1LPWP11oLGOjQ" ]; shell = pkgs.zsh; + passwordFile = config.rekey.secrets.root.path; }; security.sudo.enable = false; diff --git a/flake.lock b/flake.lock index 9af2e3a..20c33c8 100644 --- a/flake.lock +++ b/flake.lock @@ -66,11 +66,11 @@ "utils": "utils" }, "locked": { - "lastModified": 1675462931, - "narHash": "sha256-JiOUSERBtA1lN/s9YTKGZoZ3XUicHDwr+C8swaPSh3M=", + "lastModified": 1675637696, + "narHash": "sha256-tilJS8zCS3PaDfVOfsBZ4zspuam8tc7IMZxtGa/K/uo=", "owner": "nix-community", "repo": "home-manager", - "rev": "e2c1756e3ae001ca8696912016dd31cb1503ccf3", + "rev": "c43d4a3d6d9ef8ddbe2438362f5c775b4186000b", "type": "github" }, "original": { @@ -81,11 +81,11 @@ }, "nixpkgs": { "locked": { - "lastModified": 1675362331, - "narHash": "sha256-VmcnKPj5gJLxWK7Bxlhg2LoQvhKRss7Ax+uoFjd3qKY=", + "lastModified": 1675545634, + "narHash": "sha256-TbQeQcM5TA/wIho6xtzG+inUfiGzUXi8ewwttiQWYJE=", "owner": "NixOS", "repo": "nixpkgs", - "rev": "a100acd7bbf105915b0004427802286c37738fef", + "rev": "0591d6b57bfeb55dfeec99a671843337bc2c3323", "type": "github" }, "original": { diff --git a/modules/rekey-drv.nix b/modules/rekey-drv.nix index 0f5d818..58e15a8 100644 --- a/modules/rekey-drv.nix +++ b/modules/rekey-drv.nix @@ -1,18 +1,13 @@ pkgs: config: ( + # Derivation to copy the rekeyd secrets for tmp to the nix store + # Agenix will read them from the store for decryption pkgs.stdenv.mkDerivation rec { pname = "host-secrets"; version = "1"; description = "Rekeyed secrets for this host"; - pubKeyStr = let - pubKey = config.rekey.pubKey; - in - if builtins.isPath pubKey - then builtins.readFile pubKey - else pubKey; - + # Set all keys and secrets as input so the derivation gets rebuild if any of them change + pubKeyStr = config.rekey.pubKey; secretFiles = pkgs.lib.mapAttrsToList (_: x: x.file) config.rekey.secrets; - srcs = secretFiles; - sourceRoot = "."; dontMakeSourcesWriteable = true; dontUnpack = true; @@ -20,7 +15,8 @@ pkgs: config: ( dontBuild = true; installPhase = '' - cp -r /tmp/nix-rekey.d/${builtins.hashString "sha1" pubKeyStr}/. $out + cp -r /tmp/nix-rekey.d/${builtins.hashString "sha1" pubKeyStr}/. $out \ + || { echo "Warning Secrets not available. Maybe you forgot to run 'nix run .#rekey' to rekey them?"; exit 1; } ''; } ) diff --git a/modules/rekey.nix b/modules/rekey.nix index 8762cc3..036ec9e 100644 --- a/modules/rekey.nix +++ b/modules/rekey.nix @@ -11,6 +11,7 @@ drv = import ./rekey-drv.nix pkgs config; in mkIf (config.rekey.secrets != {}) { + # export all secrets to agenix with rewritten path from rekey age = { secrets = let secretPath = "${drv}/"; @@ -18,16 +19,22 @@ in mapAttrs (name: value: value // {file = newPath name;}) config.rekey.secrets; }; - warnings = optional (! pathExists (removeSuffix ".drv" drv.drvPath)) '' - Rekeyed secrets not available. - Maybe you forgot to run "nix run '.#rekey'" to rekey them? - ''; + + # Warn if rekey has to been executed + # use the drvPath to prevent nix from building the derivation in this step + # drvPath is not outPath so this warning does not work + # to fix it you would need some kind of way to access the outPath without evaluating the derivation + #warnings = optional ( ! pathExists (removeSuffix ".drv" drv.drvPath)) '' + # Path ${drv.drvPath} + # Rekeyed secrets not available. + # Maybe you forgot to run "nix run '.#rekey'" to rekey them? + #''; }; options = with lib; { rekey.secrets = options.age.secrets; rekey.pubKey = mkOption { - type = types.either types.path types.str; + type = types.coercedTo types.path builtins.readFile types.str; description = '' The age public key set as a recipient when rekeying. either a path to a public key file or a string public key @@ -46,13 +53,5 @@ ''; }; - rekey.plugins = mkOption { - type = types.listOf types.package; - default = []; - description = '' - A list of plugins that should be available in your path when rekeying. - ''; - example = [pkgs.age-plugin-yubikey]; - }; }; } diff --git a/users/common/polybar.nix b/users/common/polybar.nix index 55e84ad..26a2f8c 100644 --- a/users/common/polybar.nix +++ b/users/common/polybar.nix @@ -1,50 +1,387 @@ -{ - config, - ... -}: -let +# Polybar config +# Polybar is kinda weird in two regards: +# 1. polybar allows a superkey and subkey to both have values eg: +# a = "lel" +# a.b = "lul" +# since nix does not allow this you have to hardcode the key with a '-' +# instead of using actual nix subkeys witt '.' eg: +# a = "lel" +# a-b = "lul" +# 2. polybar allows integer keys. In nix these have to be quoted + + +{config, ...}: let color = { - bground = ; - fground = ; -in -{ - services.polybar = { - enable = true; - settings = { - "bar/main" = { - monitor = "DP-1"; - monitro.fallback = "eDP-1"; - bottom = true; + shade1 = "#311B92"; + shade2 = "#4527A0"; + shade3 = "#512DA8"; + shade4 = "#5E35B1"; + shade5 = "#673AB7"; + shade6 = "#7E57C2"; + shade7 = "#9575CD"; + shade8 = "#B39DDB"; - dpi = 96; - heigh = 22; + bground = "#1D1F28"; + fground = "#f7f7f7"; + borderbg = "#f7f7f7"; + accent = "#5E35B1"; + modulefg = "#f7f7f7"; + modulefg-alt = "#f7f7f7"; - background = color.bground; - foreground = color.fground; + trans = "#00000000"; + white = "#FFFFFF"; + black = "#000000"; - font = { - 0 = "FiraCode Nerd Font Mono:style=Medium:size=13"; - 1 = ""; - 2 = "Iosevka Nerd Font:style=Medium:size=16"; - 3 = "Font Awesome 5 Pro:style=Solid:size=13"; - 4 = "Font Awesome 5 Pro:style=Regular:size=13"; - 5 = "Font Awesome 5 Pro:style=Light:size=13"; - }; + # Material Colors + red = "#e53935"; + pink = "#d81b60"; + purple = "#8e24aa"; + deep-purple = "#5e35b1"; + indigo = "#3949ab"; + blue = "#1e88e5"; + light-blue = "#039be5"; + cyan = "#00acc1"; + teal = "#00897b"; + green = "#43a047"; + light-green = "#7cb342"; + lime = "#c0ca33"; + yellow = "#fdd835"; + amber = "#ffb300"; + orange = "#fb8c00"; + deep-orange = "#f4511e"; + brown = "#6d4c41"; + grey = "#757575"; + blue-gray = "#546e7a"; + }; +in { + services.polybar = { + enable = true; + settings = { + "bar/main" = { + monitor = "DP-1"; + monitro.fallback = "eDP-1"; + bottom = true; - modules = { - left = [ "icon" "left1" "title" "left2" ]; - center = [ "workspaces" ]; - right = [ "right5" "alsa" "right4" "battery" "right3" "network" "date" "right1" "keyboardswitcher" ]; - }; + dpi = 96; + height = 22; - tray = { - position = "right"; - background = color.shade1; - }; + background = color.bground; + foreground = color.fground; - enable.ipc = true; + font = { + "0" = "FiraCode Nerd Font Mono:style=Medium:size=13"; + "1" = ""; + "2" = "Iosevka Nerd Font:style=Medium:size=16"; + "3" = "Font Awesome 5 Pro:style=Solid:size=13"; + "4" = "Font Awesome 5 Pro:style=Regular:size=13"; + "5" = "Font Awesome 5 Pro:style=Light:size=13"; + }; + modules = { + left = ["icon" "left1" "title" "left2"]; + center = ["workspaces"]; + right = ["right5" "alsa" "right4" "battery" "right3" "network" "date" "right1" "keyboardswitcher"]; + }; - }; - }; + tray = { + position = "right"; + background = color.shade1; + }; + + enable.ipc = true; + }; + # _._._._._._._._._._._._._._._._._._._._._._ + # Functional MODULES + # _._._._._._._._._._._._._._._._._._._._._._ + + "module/title" = { + type = "internal/xwindow"; + + format = "