darman/homelab
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity
23 Commits 2 Branches 0 Tags
946c44f1d3b4401cdd8f2892ed0f8ebde92a6bf7
Commit Graph
7 Commits
Author SHA1 Message Date
erik 946c44f1d3 feat: scaffold netcup vps host (disko/vda, static net, tailscale, caddy) 
- new nixosConfigurations.vps: UEFI systemd-boot, disko on /dev/vda
- static IPv4 159.195.64.117/22 gw .1 (+ IPv6), eth0 pinned, public DNS
- tailscale via headscale + sops authkey (secrets/vps.yaml, own host key)
- caddy public reverse proxy: audiobookshelf.mgaction.town -> jupiter tailnet:8000
- shared common.nix (user/ssh/nix) ; .sops.yaml per-host rules
 2026-07-13 01:01:53 +02:00
erik 25c6982cea feat(audiobookshelf): bind 0.0.0.0 so it's reachable over tailscale (VPS proxy) 2026-07-13 00:26:16 +02:00
erik 5dddc9d2fb feat: tailscale via headscale (vpn.mgaction.town) + fix audiobookshelf extraGroups syntax 
- services.tailscale auto-registers with headscale using a sops pre-auth key
- trust tailscale0 so LAN services are reachable over the tailnet
- fix missing semicolon on audiobookshelf extraGroups
 2026-07-13 00:17:41 +02:00
erik 5239f1ce71 chore: set real samba + darman secrets; edit_secrets zeditor support 2026-07-12 21:35:58 +02:00
erikandClaude Opus 4.8 dd6c4829ad feat: darman login password via sops (hashedPasswordFile) 
- add darman_password (sha-512 hash) to secrets/jupiter.yaml
- neededForUsers so it lands in /run/secrets-for-users before user setup
- real host uses hashedPasswordFile; VM keeps its test initialPassword

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-07-12 21:22:00 +02:00
erikandClaude Opus 4.8 f9358375b5 feat: sops decrypts via pre-generated SSH host key (works on boot #1) 
- pre-generate jupiter SSH host key off-repo (~/.config/homelab/jupiter)
- derive age recipient via ssh-to-age, add to .sops.yaml, re-encrypt secret
- secrets.nix: sops.age.sshKeyPaths = host key (drop separate keyFile)
- gitignore private-key patterns
- README: ship host key via nixos-anywhere --extra-files; secret decrypts boot #1

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-07-12 20:48:33 +02:00
erikandClaude Opus 4.8 10387fdbee feat: sops-nix for samba password secret 
- add sops-nix input + module (jupiter only, not the VM)
- secrets/jupiter.yaml: age-encrypted samba_password (safe to commit)
- .sops.yaml: encryption rule for admin age key
- secrets.nix: decrypt samba_password to /run/secrets on the host
- provisioning oneshot reads sops secret (host) or plaintext (VM), single value
- .sops private key stays off-repo (~/.config, /var/lib/sops-nix on host)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-07-12 20:16:17 +02:00