darmanandClaude Sonnet 5
69a63dc615
- sabnzbd, prowlarr, sonarr, radarr, clonarr, seerr, cinephage, mediamanager services, wired into jupiter with LAN Caddy vhosts. - Gitea: migrated the old ZimaOS docker instance's data (sqlite db, 4 repos, no LFS objects) into the NixOS module's default stateDir layout. HTTP via Caddy; git SSH on its own built-in server at :2222 (not :222 - the unpriv gitea user can't bind <1024). - mediamanager-nix flake input for the mediamanager service. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
30 lines
1.2 KiB
Nix
30 lines
1.2 KiB
Nix
{ config, ... }:
|
|
|
|
# sops-nix secret wiring (real host only; not imported by vm.nix).
|
|
# Encrypted values live in ../../secrets/jupiter.yaml, decrypted at activation to
|
|
# /run/secrets/<name>.
|
|
#
|
|
# The host decrypts with its OWN SSH host key (age identity derived via
|
|
# ssh-to-age, recipient listed in ../../.sops.yaml). The key is pre-generated on
|
|
# the laptop and shipped once at install as /etc/ssh/ssh_host_ed25519_key
|
|
# (nixos-anywhere --extra-files) — so decryption works on boot #1 and there is
|
|
# no separate sops-only key to manage.
|
|
{
|
|
sops.defaultSopsFile = ../../secrets/jupiter.yaml;
|
|
sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
|
|
|
|
# Decrypts to /run/secrets/samba_password (root-only by default).
|
|
sops.secrets.samba_password = { };
|
|
|
|
# darman's login password (a sha-512 hash, not plaintext — generate with
|
|
# `mkpasswd -m sha-512`, edit via ./edit_secrets). neededForUsers makes it
|
|
# available before user setup, at /run/secrets-for-users/darman_password.
|
|
sops.secrets.darman_password.neededForUsers = true;
|
|
users.users.darman.hashedPasswordFile =
|
|
config.sops.secrets.darman_password.path;
|
|
|
|
# Headscale pre-auth key for tailscale auto-registration (see configuration.nix).
|
|
sops.secrets.tailscale_authkey = { };
|
|
|
|
}
|