diff --git a/.sops.yaml b/.sops.yaml new file mode 100644 index 00000000..d9792794 --- /dev/null +++ b/.sops.yaml @@ -0,0 +1,12 @@ +keys: + users: + - &rap_zion age1y8vwxjyzhftr8n0mry5zkq34ra5g69z927p9s3qrj04gzqwasc8q3fqlgf + - &kubex age1qmfyk82lve992tvzw82d4dgr3ek77xx9m7uez3uq55mgqu6r5eys40evkr + - &firefly age13ps3kkzfn3eyaqc50reudytr5ws80ssamzh09kj6878a6lgxususuu58wp +creation_rules: + - path_regex: secrets/common/ssh.yaml$ + key_groups: + - age: + - *rap_zion + - *kubex + - *firefly diff --git a/README.md b/README.md index b5bdfb25..a113cc32 100644 --- a/README.md +++ b/README.md @@ -45,9 +45,9 @@ nh home switch -c nix@firefly . # nix build installer iso nix build .#nixosConfigurations.vinox.config.system.build.isoImage -# nh remote switch -nh os switch --hostname kubex . -d always --target-host kubex -nh os switch --hostname nixberry . -d always --target-host +# nh remote switch / update +nh os boot --hostname kubex . -d always --target-host kubex +nh os boot --hostname nixberry . -d always --target-host # nix remote switch nixos-rebuild switch --flake .#kubex --target-host 192.168.55.10 --sudo diff --git a/docs/k3s.md b/docs/k3s.md index dd6cd7bc..56e5d049 100644 --- a/docs/k3s.md +++ b/docs/k3s.md @@ -31,6 +31,13 @@ sudo zpool create -f \ raidz2 /dev/sda /dev/sdb /dev/sdc /dev/sdd ``` +The `k3s` role includes a `wait-for-zfs-pool.service` unit that imports `kubex-main` +if needed, then loads its encryption key from `rap@nixberry` before `k3s.service` +starts. + +Because the unit runs non-interactively, `kubex` is configured for passwordless sudo +for members of the `wheel` group. + ## Copy kubeconfig ```bash diff --git a/docs/new-host.md b/docs/new-host.md index d148f236..58a317a3 100644 --- a/docs/new-host.md +++ b/docs/new-host.md @@ -8,13 +8,18 @@ option. In order to access secrets via `sops-nix`, the `age-key` which is autogenerated for every host needs to be copied over to the `.sops.yaml` config. +This repo keeps the SSH-related secrets in `secrets/common/ssh.yaml` and deploys them into `~/.ssh/`: + +- NixOS hosts get them from `modules/nixos/system/sops.nix` +- standalone Home Manager hosts get them from `modules/home/services/sops.nix` +- hybrid hosts should let only one layer own `~/.ssh` to avoid duplicate files + ``` # Connect to the new host, and copy the public key of the autogenerated age-key. sudo cat /home/rap/.config/sops/age/keys.txt | grep "public key" -# Add recipient in .sops.yaml and paste public key, assign it to a creaton_rule. -# Then a rekey for the secrets.yaml is necessary. -sops updatekeys secrets/secrets.yaml +# Add recipient in `.sops.yaml` and paste the public key, then update the secret file. +sops updatekeys secrets/common/ssh.yaml ``` ## Github action diff --git a/flake.lock b/flake.lock index e54688b8..275b7373 100644 --- a/flake.lock +++ b/flake.lock @@ -20,11 +20,11 @@ ] }, "locked": { - "lastModified": 1778857089, - "narHash": "sha256-TclWRW2SdFeETLaiTG4BA8C8C4m/LppQEldncqyTzAQ=", + "lastModified": 1782073106, + "narHash": "sha256-dnS5SaZlPqR1E0dPXaPc+lFkBwLUbAgbwsVMk7uA6dY=", "owner": "hyprwm", "repo": "aquamarine", - "rev": "ab2b0af63fbc9fb779d684f19149b790978be8a8", + "rev": "6d6e2384f381def4ea4ea81543cba4bbdac72457", "type": "github" }, "original": { @@ -38,11 +38,11 @@ "nixpkgs": "nixpkgs" }, "locked": { - "lastModified": 1780833533, - "narHash": "sha256-0StMUC1sOkiQq7qoLQpobwVlad09EA5cy7HZit172Fw=", + "lastModified": 1782648384, + "narHash": "sha256-OlHdAqdXasZk1U+Zf9n+ivqHL9kj/UD0DFO4yYTNBYc=", "owner": "catppuccin", "repo": "nix", - "rev": "4dd4177dc14b0c0b23bf3ce403f813be0c4c30de", + "rev": "f2c7dd14ecce785c206a39466cbe227ff62e3803", "type": "github" }, "original": { @@ -58,11 +58,11 @@ ] }, "locked": { - "lastModified": 1780290312, - "narHash": "sha256-eTAlX0CwgB84Ts3GaBd944A3DRXVMzgA0EqroZBISUo=", + "lastModified": 1781152676, + "narHash": "sha256-RxWs5ND31KzTG7wvMM+PMfUjyNpmIEr999lqNARaM5o=", "owner": "nix-community", "repo": "disko", - "rev": "115e5211780054d8a890b41f0b7734cafad54dfe", + "rev": "ff8702b4de27f72b4c78573dfb89ec74e36abdf1", "type": "github" }, "original": { @@ -252,11 +252,11 @@ ] }, "locked": { - "lastModified": 1780679734, - "narHash": "sha256-KmRNvpNOb7QEORa06bVgjW9kITcx0VhsI7w0vhmZyD8=", + "lastModified": 1782657028, + "narHash": "sha256-PHTCpYZCMzJYS3phhywqRAZphKVr2zjvlGYa+H20ZZ4=", "owner": "nix-community", "repo": "home-manager", - "rev": "b2b7db486e06e098711dc291bb25db82850e1d16", + "rev": "4ad9aaae70c9aaab504127f926c0fa9cfbc2b365", "type": "github" }, "original": { @@ -310,11 +310,11 @@ ] }, "locked": { - "lastModified": 1776426399, - "narHash": "sha256-RUESLKNikIeEq9ymGJ6nmcDXiSFQpUW1IhJ245nL3xM=", + "lastModified": 1782566056, + "narHash": "sha256-haEZcHzYrePnjFOYSWTbxm/Nrla0aPslJfmvdCvqtVc=", "owner": "hyprwm", "repo": "hyprgraphics", - "rev": "68d064434787cf1ed4a2fe257c03c5f52f33cf84", + "rev": "c6e7b9f673f4360bc813d3dc75028f75ee88d3f8", "type": "github" }, "original": { @@ -342,11 +342,11 @@ "xdph": "xdph" }, "locked": { - "lastModified": 1780768552, - "narHash": "sha256-J2gBzBBE9C6LMMJec8buysLAQl7QmqtP/oMrPfVioYc=", + "lastModified": 1782657896, + "narHash": "sha256-k0BoF/ooLq41QZAi00SI9isMJ5gWc3zg6NWrh9pgZko=", "owner": "hyprwm", "repo": "hyprland", - "rev": "20ee7553c95dd1fa30a00564561f40f7986ffbc7", + "rev": "8149ba1df53d0a0881dca82f2a74ba207041ec95", "type": "github" }, "original": { @@ -388,11 +388,11 @@ ] }, "locked": { - "lastModified": 1776426575, - "narHash": "sha256-KI6nIfVihn/DPaeB5Et46Xg3dkNHrrEtUd5LBBVomB0=", + "lastModified": 1782563850, + "narHash": "sha256-rs/EzgrgPHbCtJjFZN4aR1HYldH/0NtGAempWVpWQTs=", "owner": "hyprwm", "repo": "hyprland-guiutils", - "rev": "a968d211048e3ed538e47b84cb3649299578f19d", + "rev": "5ba080ee036c30cb2485f2647ff8a61f7aa08178", "type": "github" }, "original": { @@ -494,11 +494,11 @@ ] }, "locked": { - "lastModified": 1772462885, - "narHash": "sha256-5pHXrQK9zasMnIo6yME6EOXmWGFMSnCITcfKshhKJ9I=", + "lastModified": 1782554491, + "narHash": "sha256-+p3MlyN/nqRefcf2IckPlGRUn9+hielqpS9XClbLleM=", "owner": "hyprwm", "repo": "hyprtoolkit", - "rev": "9af245a69fa6b286b88ddfc340afd288e00a6998", + "rev": "bdba25ced39ea39ab004a8f31593ba0b0ff1ca35", "type": "github" }, "original": { @@ -519,11 +519,11 @@ ] }, "locked": { - "lastModified": 1779475241, - "narHash": "sha256-Nw4DN0A5krWNcPBvuWe5Gz2yuxsUUPiDgtu6SVPJQeU=", + "lastModified": 1782035033, + "narHash": "sha256-pUtCphVzH1iNUTMGdJr4+e/yzUXA6/DZwsn+cyfIVJU=", "owner": "hyprwm", "repo": "hyprutils", - "rev": "3cd3972b2ee658a14d2610d8494e09259e530124", + "rev": "9d8bf6e810597152eef8906c670b96679af2faec", "type": "github" }, "original": { @@ -601,21 +601,6 @@ "type": "github" } }, - "import-tree_2": { - "locked": { - "lastModified": 1778781969, - "narHash": "sha256-Jjuz5CmSkur8KvLDoGa+vylEp+RkQtv4mt/qcMznpH0=", - "owner": "vic", - "repo": "import-tree", - "rev": "d321337efd0f23a9eb14a42adb7b2c29313ab274", - "type": "github" - }, - "original": { - "owner": "vic", - "repo": "import-tree", - "type": "github" - } - }, "krewfile": { "inputs": { "flake-utils": "flake-utils", @@ -639,21 +624,21 @@ }, "neonix": { "inputs": { - "import-tree": "import-tree_2", + "import-tree": "import-tree", "nixpkgs": "nixpkgs_2", "nixvim": "nixvim", "pre-commit-hooks": "pre-commit-hooks_2" }, "locked": { - "lastModified": 1780865186, - "narHash": "sha256-GXjj3r00JhjYtVZZtDTz99ZPcJqTTcrsF1NS+jEdDhk=", - "owner": "rgroemmer", + "lastModified": 1782657946, + "narHash": "sha256-drO3tcL528kWQpktth5PeT6jVQRPJge24y/7KMFAe5g=", + "owner": "rapsnx", "repo": "neonix", - "rev": "16a56ef334a7117f1124b4082121fbe6787f94d9", + "rev": "4bc7283e07684c468e7139135fb8ee2a5297d6d0", "type": "github" }, "original": { - "owner": "rgroemmer", + "owner": "rapsnx", "repo": "neonix", "type": "github" } @@ -692,11 +677,11 @@ "xwayland-satellite-unstable": "xwayland-satellite-unstable" }, "locked": { - "lastModified": 1780694373, - "narHash": "sha256-wuj6QmOlLsGjBOut+Ki/hiOT/H5ONzBePqOkOolsNfo=", + "lastModified": 1782592242, + "narHash": "sha256-kgINba6Ilpj3rdTi2BeKlQBs6ZxTdu3Gb49U5gDUVhg=", "owner": "sodiboo", "repo": "niri-flake", - "rev": "8f7043c852210cd0875a1bbe9ca872c90ab5ac74", + "rev": "9e26dfe0fb8d61475b6f9e8d63477fe92509f1db", "type": "github" }, "original": { @@ -725,11 +710,11 @@ "niri-unstable": { "flake": false, "locked": { - "lastModified": 1780637332, - "narHash": "sha256-FeKyLRxLZu2EUnhifijZPDZRl0sVnPVHMtizAINNiN4=", + "lastModified": 1781781064, + "narHash": "sha256-Ii/koEm/sRyg65qbAQWqEgboSEIhdH0EL4KglAc14p0=", "owner": "YaLTeR", "repo": "niri", - "rev": "f717ae030fe56fc52522ebef69f17f3f09064ac4", + "rev": "49fc6117fd6c043adaa2ead316b82db5ed735d36", "type": "github" }, "original": { @@ -743,11 +728,11 @@ "nixpkgs": "nixpkgs_3" }, "locked": { - "lastModified": 1780310866, - "narHash": "sha256-fPBRVf6A5xlACYcOI59shGrjURuvwu0lRsDoSCEXt/I=", + "lastModified": 1782562157, + "narHash": "sha256-a7+T6QSeowynwZ1ZJJbP8T8ntAytvrui8kFGJmIZt2c=", "owner": "nixos", "repo": "nixos-hardware", - "rev": "4ed851c979641e28597a05086332d75cdc9e395f", + "rev": "a9cf7546a938c737b079e738de73934a13de9784", "type": "github" }, "original": { @@ -759,11 +744,11 @@ }, "nixpkgs": { "locked": { - "lastModified": 1780365719, - "narHash": "sha256-JX05Ms/dk0c+UoW9IqQriB53HNZFckX9Qd3EJqmcqEw=", - "rev": "ffa10e26ae11d676b2db836259889f1f571cb14f", + "lastModified": 1782175435, + "narHash": "sha256-8d2wCNWKnd86GzKZvbuqqlS+HqMrheXkvRf0qGJ/oA0=", + "rev": "89570f24e97e614aa34aa9ab1c927b6578a43775", "type": "tarball", - "url": "https://releases.nixos.org/nixpkgs/nixpkgs-26.11pre1009182.ffa10e26ae11/nixexprs.tar.xz" + "url": "https://releases.nixos.org/nixpkgs/nixpkgs-26.11pre1020805.89570f24e97e/nixexprs.tar.xz" }, "original": { "type": "tarball", @@ -772,11 +757,11 @@ }, "nixpkgs-stable": { "locked": { - "lastModified": 1780511130, - "narHash": "sha256-2v9lT4ya59Lh1FqPeLnz1MoX9y/wz2huqfe9RtQZITk=", + "lastModified": 1782498288, + "narHash": "sha256-8/X3yyTXiE82b38n32ItbOqfWOVBl+gKa8fILyZfR4Q=", "owner": "NixOS", "repo": "nixpkgs", - "rev": "535f3e6942cb1cead3929c604320d3db54b542b9", + "rev": "3cac626ec5e3703e835f227687e88aa9e2f25701", "type": "github" }, "original": { @@ -788,11 +773,11 @@ }, "nixpkgs_2": { "locked": { - "lastModified": 1780243769, - "narHash": "sha256-x5UQuRsH3MqI0U9afaXSNqzTPSeZlRLvFAav2Ux1pNw=", + "lastModified": 1781577229, + "narHash": "sha256-lrp67w8AulE9Ks53n27I45ADSzbOCn4H+CNW1Ck8B+8=", "owner": "nixos", "repo": "nixpkgs", - "rev": "331800de5053fcebacf6813adb5db9c9dca22a0c", + "rev": "567a49d1913ce81ac6e9582e3553dd90a955875f", "type": "github" }, "original": { @@ -817,11 +802,11 @@ }, "nixpkgs_4": { "locked": { - "lastModified": 1780243769, - "narHash": "sha256-x5UQuRsH3MqI0U9afaXSNqzTPSeZlRLvFAav2Ux1pNw=", + "lastModified": 1782467914, + "narHash": "sha256-pGvFkM8N0xEkIIXDe5YYfbEAvHrk4IxBrjB/x8OomhE=", "owner": "nixos", "repo": "nixpkgs", - "rev": "331800de5053fcebacf6813adb5db9c9dca22a0c", + "rev": "e73de5be04e0eff4190a1432b946d469c794e7b4", "type": "github" }, "original": { @@ -841,11 +826,11 @@ "systems": "systems_3" }, "locked": { - "lastModified": 1780849525, - "narHash": "sha256-yjtMubbmPi4Y4pgDSdmytqUutGJ+LJLcPgXGNNdXiUs=", + "lastModified": 1782254890, + "narHash": "sha256-kjsEECqhpPnJWqhooXp6tWh2qGQftCPAo2G1GvZtKdw=", "owner": "nix-community", "repo": "nixvim", - "rev": "98acb923e5882a6a6a2b660d99e8c5124e08b838", + "rev": "dbf9550dba8448b03e11d58e5695d6c44a464554", "type": "github" }, "original": { @@ -864,11 +849,11 @@ ] }, "locked": { - "lastModified": 1778507602, - "narHash": "sha256-kTwur1wV+01SdqskVMSo6JMEpg71ps3HpbFY2GsflKs=", + "lastModified": 1781733627, + "narHash": "sha256-U3yTuGBnmXvXoQI3qkpfEDsn9RovQPAjN7ndRco+3u0=", "owner": "cachix", "repo": "git-hooks.nix", - "rev": "61ab0e80d9c7ab14c256b5b453d8b3fb0189ba0a", + "rev": "3bbec39bc90eadfa031e6f3b77272f3f60803e39", "type": "github" }, "original": { @@ -887,11 +872,11 @@ ] }, "locked": { - "lastModified": 1778507602, - "narHash": "sha256-kTwur1wV+01SdqskVMSo6JMEpg71ps3HpbFY2GsflKs=", + "lastModified": 1781733627, + "narHash": "sha256-U3yTuGBnmXvXoQI3qkpfEDsn9RovQPAjN7ndRco+3u0=", "owner": "cachix", "repo": "pre-commit-hooks.nix", - "rev": "61ab0e80d9c7ab14c256b5b453d8b3fb0189ba0a", + "rev": "3bbec39bc90eadfa031e6f3b77272f3f60803e39", "type": "github" }, "original": { @@ -909,11 +894,11 @@ ] }, "locked": { - "lastModified": 1778507602, - "narHash": "sha256-kTwur1wV+01SdqskVMSo6JMEpg71ps3HpbFY2GsflKs=", + "lastModified": 1781733627, + "narHash": "sha256-U3yTuGBnmXvXoQI3qkpfEDsn9RovQPAjN7ndRco+3u0=", "owner": "cachix", "repo": "pre-commit-hooks.nix", - "rev": "61ab0e80d9c7ab14c256b5b453d8b3fb0189ba0a", + "rev": "3bbec39bc90eadfa031e6f3b77272f3f60803e39", "type": "github" }, "original": { @@ -928,14 +913,34 @@ "disko": "disko", "home-manager": "home-manager", "hyprland-git": "hyprland-git", - "import-tree": "import-tree", "krewfile": "krewfile", "neonix": "neonix", "nfsm": "nfsm", "niri": "niri", "nixos-hardware": "nixos-hardware", "nixpkgs": "nixpkgs_4", - "pre-commit-hooks": "pre-commit-hooks_3" + "pre-commit-hooks": "pre-commit-hooks_3", + "sops-nix": "sops-nix" + } + }, + "sops-nix": { + "inputs": { + "nixpkgs": [ + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1782165805, + "narHash": "sha256-478kKQBvK6SYTOdN2h9jhKJv94nbXRbFMfuL1WshErg=", + "owner": "mic92", + "repo": "sops-nix", + "rev": "56b24064fdcaedca53553b1a6d607fd23b613a24", + "type": "github" + }, + "original": { + "owner": "mic92", + "repo": "sops-nix", + "type": "github" } }, "systems": { @@ -1027,11 +1032,11 @@ ] }, "locked": { - "lastModified": 1778265244, - "narHash": "sha256-8jlPtGSsv/CQY6tVVyLF4Jjd0gnS+Zbn9yk/V13A9nM=", + "lastModified": 1782311043, + "narHash": "sha256-07zLc2M3/ax+JsjxGTft17/Joua41LHE9/9AC/F9zeU=", "owner": "hyprwm", "repo": "xdg-desktop-portal-hyprland", - "rev": "813ea5ca9a1702a9a2d1f5836bc00172ef698968", + "rev": "882ad01e195ce201b07c618bbee44a0cad8b9e5a", "type": "github" }, "original": { @@ -1060,11 +1065,11 @@ "xwayland-satellite-unstable": { "flake": false, "locked": { - "lastModified": 1779745227, - "narHash": "sha256-yqY7RtEJGJiENzR0GwL6q69tSAy6xAAmAcLuIhLjPf8=", + "lastModified": 1781226823, + "narHash": "sha256-28696iIw8uE0ZUyFTtzhEM8xMh85clCYypMxkvUi+sc=", "owner": "Supreeeme", "repo": "xwayland-satellite", - "rev": "5d1efbc9dc3ab1c10160b656e0247f3325daf0f2", + "rev": "8575d0ef55d70f9b4c46b6bffb3accf912217e1e", "type": "github" }, "original": { diff --git a/flake.nix b/flake.nix index 0ebaf259..9ed145bc 100644 --- a/flake.nix +++ b/flake.nix @@ -12,7 +12,11 @@ inputs.nixpkgs.follows = "nixpkgs"; }; neonix = { - url = "github:rgroemmer/neonix"; + url = "github:rapsnx/neonix"; + }; + sops-nix = { + url = "github:mic92/sops-nix"; + inputs.nixpkgs.follows = "nixpkgs"; }; krewfile = { url = "github:brumhard/krewfile"; @@ -39,7 +43,6 @@ inputs.nixpkgs.follows = "nixpkgs"; }; - import-tree.url = "github:vic/import-tree"; }; outputs = @@ -76,7 +79,8 @@ nixosModules = [ inputs.catppuccin.nixosModules.catppuccin inputs.niri.nixosModules.niri - (inputs.import-tree.match ".*/default\\.nix" ./modules/nixos) + inputs.sops-nix.nixosModules.sops + ./modules/nixos ./modules/nix.nix ]; @@ -85,7 +89,8 @@ inputs.neonix.homeManagerModules.neonix inputs.krewfile.homeManagerModules.krewfile inputs.niri.homeModules.niri - (inputs.import-tree.match ".*/default\\.nix" ./modules/home) + inputs.sops-nix.homeManagerModules.sops + ./modules/home ./modules/nix.nix ]; in diff --git a/hosts/kubex/default.nix b/hosts/kubex/default.nix index fc3c4c0c..200e3a08 100644 --- a/hosts/kubex/default.nix +++ b/hosts/kubex/default.nix @@ -20,10 +20,6 @@ user = { name = "kubex"; initialHashedPassword = "$y$j9T$8uQSJbY6w9kjXnj74JKjA1$pWYgNf.gb497suX//oIw6aggEPoD2Xv1kvMKZfDTOU/"; - keys = [ - "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIKX8MmA9KdHCny6rKCGZlyd/J5qCXh+YDM0/3ZGDmfyaAAAABHNzaDo= yubi@rapsn.me" - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGqKYXW07z0llbDKRIakLD1PjHe3HxK9iu6czXs+ZU7v techkey@rapsn" - ]; extraOptions = { }; extraGroups = [ ]; }; @@ -38,6 +34,12 @@ hostId = "5851308f"; # Required by zfs }; + boot.zfs.forceImportRoot = false; + + security = { + sudo.wheelNeedsPassword = false; + }; + environment = { variables = { PROMPT = "%m@%n> "; diff --git a/hosts/nixberry/default.nix b/hosts/nixberry/default.nix index 0f32d00d..aec94dd4 100644 --- a/hosts/nixberry/default.nix +++ b/hosts/nixberry/default.nix @@ -13,9 +13,6 @@ user = { name = "rap"; initialHashedPassword = "$y$j9T$8uQSJbY6w9kjXnj74JKjA1$pWYgNf.gb497suX//oIw6aggEPoD2Xv1kvMKZfDTOU/"; - keys = [ - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGqKYXW07z0llbDKRIakLD1PjHe3HxK9iu6czXs+ZU7v techkey@rapsn" - ]; extraOptions = { }; extraGroups = [ ]; }; diff --git a/hosts/vinox/default.nix b/hosts/vinox/default.nix index faf32ae6..4e0f7d02 100644 --- a/hosts/vinox/default.nix +++ b/hosts/vinox/default.nix @@ -24,7 +24,6 @@ initialHashedPassword = ""; extraOptions = { }; extraGroups = [ ]; - keys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGqKYXW07z0llbDKRIakLD1PjHe3HxK9iu6czXs+ZU7v" ]; }; }; diff --git a/hosts/zion/default.nix b/hosts/zion/default.nix index db650f31..b93aaf20 100644 --- a/hosts/zion/default.nix +++ b/hosts/zion/default.nix @@ -22,7 +22,6 @@ extraOptions = { initialHashedPassword = "$y$j9T$DZQaaK3xGqarN8KE8qnw..$dvgiS7dso5LboGRRf0dcyct/LQUFp4J0LUo2ZRRdTr8"; }; - keys = [ ]; }; services = { diff --git a/modules/home/browsers/default.nix b/modules/home/browsers/default.nix new file mode 100644 index 00000000..1e9097d5 --- /dev/null +++ b/modules/home/browsers/default.nix @@ -0,0 +1,6 @@ +{ + imports = [ + ./chromium + ./firefox + ]; +} diff --git a/modules/home/browsers/firefox/default.nix b/modules/home/browsers/firefox/default.nix index 28d0ff2f..a88e79a9 100644 --- a/modules/home/browsers/firefox/default.nix +++ b/modules/home/browsers/firefox/default.nix @@ -10,6 +10,7 @@ in { programs.firefox = { enable = true; + configPath = ".mozilla/firefox"; profiles.default = { name = "Default"; @@ -40,6 +41,8 @@ in "widget.use-xdg-desktop-portal.file-picker" = 0; # Use new gtk file picker instead of legacy one + "widget.wayland.fractional-scale.enabled" = false; # Disable buggy scaling + "toolkit.legacyUserProfileCustomizations.stylesheets" = true; "layers.acceleration.force-enabled" = true; "gfx.webrender.all" = true; diff --git a/modules/home/cli/tools/atuin/default.nix b/modules/home/cli/atuin/default.nix similarity index 100% rename from modules/home/cli/tools/atuin/default.nix rename to modules/home/cli/atuin/default.nix diff --git a/modules/home/cli/tools/core/packages.nix b/modules/home/cli/core/default.nix similarity index 79% rename from modules/home/cli/tools/core/packages.nix rename to modules/home/cli/core/default.nix index cb8d269b..1841188d 100644 --- a/modules/home/cli/tools/core/packages.nix +++ b/modules/home/cli/core/default.nix @@ -51,8 +51,20 @@ # Clipboard wl-clipboard + # AI Shit + codex + # Monitor / I2C com ddcutil ; }; + programs = { + bat.enable = true; + fzf.enable = true; + btop.enable = true; + + zoxide.enable = true; + neonix.enable = true; + eza.enable = true; + }; } diff --git a/modules/home/cli/tools/custom/default.nix b/modules/home/cli/custom/default.nix similarity index 100% rename from modules/home/cli/tools/custom/default.nix rename to modules/home/cli/custom/default.nix diff --git a/modules/home/cli/tools/custom/shell-scripts.nix b/modules/home/cli/custom/shell-scripts.nix similarity index 100% rename from modules/home/cli/tools/custom/shell-scripts.nix rename to modules/home/cli/custom/shell-scripts.nix diff --git a/modules/home/cli/default.nix b/modules/home/cli/default.nix new file mode 100644 index 00000000..a2d36e30 --- /dev/null +++ b/modules/home/cli/default.nix @@ -0,0 +1,16 @@ +{ + imports = [ + ./atuin + ./core + ./custom + ./direnv + ./git + ./k8s + ./langs + ./lazygit + ./pet + ./starship + ./terminals + ./zsh + ]; +} diff --git a/modules/home/cli/tools/direnv/default.nix b/modules/home/cli/direnv/default.nix similarity index 100% rename from modules/home/cli/tools/direnv/default.nix rename to modules/home/cli/direnv/default.nix diff --git a/modules/home/cli/tools/git/default.nix b/modules/home/cli/git/default.nix similarity index 100% rename from modules/home/cli/tools/git/default.nix rename to modules/home/cli/git/default.nix diff --git a/modules/home/cli/tools/k8s/default.nix b/modules/home/cli/k8s/default.nix similarity index 100% rename from modules/home/cli/tools/k8s/default.nix rename to modules/home/cli/k8s/default.nix diff --git a/modules/home/cli/tools/k8s/k9s.nix b/modules/home/cli/k8s/k9s.nix similarity index 67% rename from modules/home/cli/tools/k8s/k9s.nix rename to modules/home/cli/k8s/k9s.nix index a4b97ba2..a1ed7961 100644 --- a/modules/home/cli/tools/k8s/k9s.nix +++ b/modules/home/cli/k8s/k9s.nix @@ -4,6 +4,23 @@ ... }: let + gardenerScopes = [ + "shoots" + # all resources in extensions.gardener.cloud/v1alpha1 + "backupbuckets" + "backupentries" + "bastions" + "clusters" + "containerruntimes" + "controlplanes" + "dnsrecords" + "extensions" + "infrastructures" + "networks" + "operatingsystemconfigs" + "workers" + ]; + defaultPlugins = { edit-secret = { description = "Edit Decoded Secret"; @@ -23,22 +40,7 @@ let reconcile = { description = "Reconcile resource"; shortCut = "r"; - scopes = [ - "shoots" - # all resources in extensions.gardener.cloud/v1alpha1 - "backupbuckets" - "backupentries" - "bastions" - "clusters" - "containerruntimes" - "controlplanes" - "dnsrecords" - "extensions" - "infrastructures" - "networks" - "operatingsystemconfigs" - "workers" - ]; + scopes = gardenerScopes; command = "kubectl"; background = true; args = [ @@ -51,6 +53,38 @@ let ]; }; + suspend = { + description = "Suspend resource"; + shortCut = "s"; + scopes = gardenerScopes; + command = "kubectl"; + background = true; + args = [ + "annotate" + "-n" + "$NAMESPACE" + "$RESOURCE_NAME" + "$NAME" + "gardener.cloud/operation=suspend" + ]; + }; + + resume = { + description = "Resume resource"; + shortCut = "u"; + scopes = gardenerScopes; + command = "kubectl"; + background = true; + args = [ + "annotate" + "-n" + "$NAMESPACE" + "$RESOURCE_NAME" + "$NAME" + "gardener.cloud/operation=resume" + ]; + }; + reconcile-seed = { description = "Reconcile seed"; shortCut = "r"; diff --git a/modules/home/cli/tools/k8s/krewfile.nix b/modules/home/cli/k8s/krewfile.nix similarity index 100% rename from modules/home/cli/tools/k8s/krewfile.nix rename to modules/home/cli/k8s/krewfile.nix diff --git a/modules/home/cli/tools/k8s/kubecolor.nix b/modules/home/cli/k8s/kubecolor.nix similarity index 100% rename from modules/home/cli/tools/k8s/kubecolor.nix rename to modules/home/cli/k8s/kubecolor.nix diff --git a/modules/home/cli/tools/langs/default.nix b/modules/home/cli/langs/default.nix similarity index 100% rename from modules/home/cli/tools/langs/default.nix rename to modules/home/cli/langs/default.nix diff --git a/modules/home/cli/tools/langs/go.nix b/modules/home/cli/langs/go.nix similarity index 100% rename from modules/home/cli/tools/langs/go.nix rename to modules/home/cli/langs/go.nix diff --git a/modules/home/cli/tools/langs/rust.nix b/modules/home/cli/langs/rust.nix similarity index 100% rename from modules/home/cli/tools/langs/rust.nix rename to modules/home/cli/langs/rust.nix diff --git a/modules/home/cli/tools/lazygit/default.nix b/modules/home/cli/lazygit/default.nix similarity index 100% rename from modules/home/cli/tools/lazygit/default.nix rename to modules/home/cli/lazygit/default.nix diff --git a/modules/home/cli/tools/pet/default.nix b/modules/home/cli/pet/default.nix similarity index 63% rename from modules/home/cli/tools/pet/default.nix rename to modules/home/cli/pet/default.nix index b8090478..470b5b89 100644 --- a/modules/home/cli/tools/pet/default.nix +++ b/modules/home/cli/pet/default.nix @@ -1,6 +1,6 @@ { lib, - inputs, + config, ... }: { @@ -8,7 +8,7 @@ enable = true; settings = { General = lib.mkForce { - snippetfile = "${inputs.self.outPath}/extra/snippet.toml"; + snippetfile = "${config.home.homeDirectory}/Projects/rapsnx/dotfiles/extra/snippet.toml"; selectcmd = "fzf --ansi"; color = true; }; diff --git a/modules/home/cli/tools/starship/default.nix b/modules/home/cli/starship/default.nix similarity index 100% rename from modules/home/cli/tools/starship/default.nix rename to modules/home/cli/starship/default.nix diff --git a/modules/home/cli/terminals/default.nix b/modules/home/cli/terminals/default.nix new file mode 100644 index 00000000..c0bcbaee --- /dev/null +++ b/modules/home/cli/terminals/default.nix @@ -0,0 +1,5 @@ +{ + imports = [ + ./alacritty + ]; +} diff --git a/modules/home/cli/tools/core/default.nix b/modules/home/cli/tools/core/default.nix deleted file mode 100644 index ccf22c23..00000000 --- a/modules/home/cli/tools/core/default.nix +++ /dev/null @@ -1,6 +0,0 @@ -{ - imports = [ - ./packages.nix - ./programs.nix - ]; -} diff --git a/modules/home/cli/tools/core/programs.nix b/modules/home/cli/tools/core/programs.nix deleted file mode 100644 index 889d1a85..00000000 --- a/modules/home/cli/tools/core/programs.nix +++ /dev/null @@ -1,17 +0,0 @@ -{ - # catppuccin = { - # bat.enable = true; - # fzf.enable = true; - # btop.enable = true; - # }; - - programs = { - bat.enable = true; - fzf.enable = true; - btop.enable = true; - - zoxide.enable = true; - neonix.enable = true; - eza.enable = true; - }; -} diff --git a/modules/home/cli/shells/zsh/default.nix b/modules/home/cli/zsh/default.nix similarity index 100% rename from modules/home/cli/shells/zsh/default.nix rename to modules/home/cli/zsh/default.nix diff --git a/modules/home/common/default.nix b/modules/home/common/default.nix index 48666c57..688d6c8a 100644 --- a/modules/home/common/default.nix +++ b/modules/home/common/default.nix @@ -7,6 +7,7 @@ catppuccin = { enable = true; + autoEnable = true; flavor = "mocha"; }; diff --git a/modules/home/default.nix b/modules/home/default.nix new file mode 100644 index 00000000..56bbfabd --- /dev/null +++ b/modules/home/default.nix @@ -0,0 +1,10 @@ +{ + imports = [ + ./common + ./programs + ./services + ./cli + ./desktops + ./browsers + ]; +} diff --git a/modules/home/desktops/addons/default.nix b/modules/home/desktops/addons/default.nix new file mode 100644 index 00000000..ddf31450 --- /dev/null +++ b/modules/home/desktops/addons/default.nix @@ -0,0 +1,11 @@ +{ + imports = [ + ./fuzzel + ./gtk + ./kanshi + ./qt + ./swaync + ./waybar + ./wlogout + ]; +} diff --git a/modules/home/desktops/addons/kanshi/default.nix b/modules/home/desktops/addons/kanshi/default.nix index 3ff4b50b..10b2e393 100644 --- a/modules/home/desktops/addons/kanshi/default.nix +++ b/modules/home/desktops/addons/kanshi/default.nix @@ -1,43 +1,61 @@ -{ pkgs, lib, ... }: +{ + pkgs, + lib, + self, + ... +}: { services.kanshi = let hyprctl = lib.getExe' pkgs.hyprland "hyprctl"; - - # Pins Hyprland workspaces to monitors. - # Args: primary matcher, optional secondary matcher. - # Writes workspace config for hyprland, reloads it, and sets focus. - workspaceSetup = pkgs.writeShellScriptBin "workspaceSetup" '' - set -euo pipefail - - monitors="$(${hyprctl} monitors -j)" - - match_monitor() { - ${lib.getExe pkgs.jq} -r --arg matcher "$1" ' - [.[] | select(.description | test($matcher)) | .name][0]' <<< "$monitors" - } - - primary="$(match_monitor "''${1:?missing primary monitor matcher}")" - secondary="$(match_monitor "''${2:-$1}")" - - cat > "$HOME/.config/hypr/workspaces.conf" < "$HOME/.config/hypr/workspaces.conf" </dev/null 2>&1; then + ${pkgs.sudo}/bin/sudo -n ${pkgs.zfs}/bin/zpool import -aN + fi + + until ${pkgs.zfs}/bin/zpool list -H "$pool" >/dev/null 2>&1; do + echo "Waiting for ZFS pool $pool to appear" + sleep 2 + done + + echo "Loading encryption key for $pool from $key_source" + while true; do + if key="$(${pkgs.openssh}/bin/ssh \ + -o BatchMode=yes \ + -o ConnectTimeout=10 \ + -o StrictHostKeyChecking=accept-new \ + "$key_source" ulock-agent get)"; then + break + fi + + echo "Waiting for SSH access to $key_source" + sleep 5 + done + + printf '%s\n' "$key" | ${pkgs.sudo}/bin/sudo -n ${pkgs.zfs}/bin/zfs load-key "$pool" + ''; + }; + + systemd.services.k3s = { + requires = [ "wait-for-zfs-pool.service" ]; + after = [ "wait-for-zfs-pool.service" ]; + }; + }; +} diff --git a/modules/nixos/services/nh.nix b/modules/nixos/services/nh.nix index b0f9f4ac..34d06270 100644 --- a/modules/nixos/services/nh.nix +++ b/modules/nixos/services/nh.nix @@ -3,6 +3,6 @@ enable = true; clean.enable = true; clean.extraArgs = "--keep 5 --keep-since 5d"; - flake = "/home/rap/Projects/rgroemmer/dotfiles"; + flake = "/home/rap/Projects/rapsnx/dotfiles"; }; } diff --git a/modules/nixos/system/boot.nix b/modules/nixos/system/boot.nix index 244a8961..946bc878 100644 --- a/modules/nixos/system/boot.nix +++ b/modules/nixos/system/boot.nix @@ -26,7 +26,6 @@ in kernelParams = [ "quiet" - "splash" "boot.shell_on_fail" "udev.log_priority=3" "rd.systemd.show_status=auto" diff --git a/modules/nixos/system/default.nix b/modules/nixos/system/default.nix index 89a3a136..ad8e35be 100644 --- a/modules/nixos/system/default.nix +++ b/modules/nixos/system/default.nix @@ -4,6 +4,7 @@ ./boot.nix ./user.nix ./locale.nix + ./sops.nix ./zsh.nix ]; } diff --git a/modules/nixos/system/sops.nix b/modules/nixos/system/sops.nix new file mode 100644 index 00000000..d7577af7 --- /dev/null +++ b/modules/nixos/system/sops.nix @@ -0,0 +1,47 @@ +{ + lib, + config, + ... +}: +lib.mkIf (config.hostConfig.user.name != "root") { + sops = { + age = { + generateKey = false; + keyFile = "/home/${config.hostConfig.user.name}/.config/sops/age/keys.txt"; + }; + + defaultSopsFile = ../../../secrets/common/ssh.yaml; + + secrets = { + ssh_config = { + path = "/home/${config.hostConfig.user.name}/.ssh/config"; + owner = config.hostConfig.user.name; + mode = "0600"; + }; + + swiss = { + path = "/home/${config.hostConfig.user.name}/.ssh/swiss"; + owner = config.hostConfig.user.name; + mode = "0600"; + }; + + "swiss.pub" = { + path = "/home/${config.hostConfig.user.name}/.ssh/swiss.pub"; + owner = config.hostConfig.user.name; + mode = "0644"; + }; + + yubi = { + path = "/home/${config.hostConfig.user.name}/.ssh/yubi"; + owner = config.hostConfig.user.name; + mode = "0600"; + }; + + "yubi.pub" = { + path = "/home/${config.hostConfig.user.name}/.ssh/yubi.pub"; + owner = config.hostConfig.user.name; + mode = "0644"; + }; + }; + }; +} diff --git a/modules/nixos/system/user.nix b/modules/nixos/system/user.nix index 7fe57285..7566bfc6 100644 --- a/modules/nixos/system/user.nix +++ b/modules/nixos/system/user.nix @@ -12,7 +12,6 @@ in options.hostConfig.user = { name = mylib.mkOpt lib.types.str "Name of user."; initialHashedPassword = mylib.mkOpt lib.types.str "Password of user."; - keys = mylib.mkOpt (lib.types.listOf lib.types.str) "Public SSH keys of user."; extraGroups = mylib.mkOpt' (lib.types.listOf lib.types.str) [ ] "Additional groups for the user."; extraOptions = mylib.mkOpt lib.types.attrs "Additional options for the user."; }; @@ -24,7 +23,10 @@ in shell = pkgs.zsh; initialHashedPassword = lib.mkForce cfg.initialHashedPassword; - openssh.authorizedKeys.keys = cfg.keys; + openssh.authorizedKeys.keys = [ + "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIB1twcfSmy7xyUA5iWl51kfBHS1Dxpmmog0x55Z6HRNlAAAABHNzaDo= swiss" + "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIKX8MmA9KdHCny6rKCGZlyd/J5qCXh+YDM0/3ZGDmfyaAAAABHNzaDo= yubi" + ]; extraGroups = [ "wheel" diff --git a/secrets/common/ssh.yaml b/secrets/common/ssh.yaml new file mode 100644 index 00000000..e7af406f --- /dev/null +++ b/secrets/common/ssh.yaml @@ -0,0 +1,38 @@ +ssh_config: ENC[AES256_GCM,data:jy99anNQWbZG41aa6HeTdGsKsjDWg2B72RTQk2MmeLlhQhBOMn4639G4ibkWFlCTkmRtz+XCHTiuUUnvChLxtFz7/osGGpKmBr6mVBG78Hftbf97UP88Ydt5zOLWRIb2U1i5dzLxiLFfbYl0bVKd7DHrsM9KLRlWtpGOJ2WW1Qubg1MrXjQc0Wcv/hYjoLfysyNYeBRAHDmuAVlsqrWvXT/hs11xHxLeyBU1NjkmdKjtQ54y6yoS4bYbMAXa2WDsM1iZVsrBvadkOn+/C02QWI/nugPb5ycTaWLbu342ixBrDyyvZkmX+HHkR0h4yjqDGfYT62be4lTn3iyFjNno/VgORat8VTFzBubpnpm+AfhdG+4EqqBu5sJejZbGTIa0kfkfTG0pCzLNvh1HyvO38Ccjluhx8pbSHdlbK0Gj0Lu1+WMVxlXCYNTTJWKuS3isZhtA6Mk5HJNwpdQZo8XD2OJGKWQKLPHmp/K4x7HfLmRYyB+p+EPfT/CMFisYVKiQZle0tHq5aQ0czzeZpXSwi4J06UF3W2hPLMN2Eup9bRF8gg39+6gh5Ceji7RCqc9iw/CVUdq7KvlR1tky7jQP8VRrFUAjMYm8dy8Lrmbs/BT0kDlqkaReIHpSXJn2z19O86Si7yEEbLIyUWEaMhzW4lEkbel6X6ZOc8SRIlDak7JcPSagDDZo1LTjgDvyzQNkfEV4v2JKJTVNI+bqXzC34ss5sUs0cHSwWeQ7ja88ef4Fe74ySea/unt7qbkzkdzWg9i4jfPRA/clZ7CYSpLU0v5/H3zijZbrGmsgskVsJHUHxptsgzkFI4eu4ISeQUyiP3IjkfmL4UEVO4dvpNFBa1kourh0FyEfvN1hb1C3Vg18i1ltvj8kCUntmXGHMJxz7idSPP8Hl/dYG+y8fWa45cvgDRVs+bNm50qr2zyPLOpIdRt8hPFLKGFJT3113h1D/BAn2765kbO3jZ7KGG6wVIitEYwgmPitq41C3rIa+J+tYANQ47rK82nyacnRCVphnZl6hsd7LNtrDx+BkLNoM7BPpKK2i4yml1v9amgqWRc58y3e8X797AGCkJZJroqytdXmamuAUlc9kZ0VTI7YXDJuIg3ysll5Hv61Zg1eW6m/NZqsy0fHfMJmpDFvyqF4gATqN3Rfsdn5YFv7hF6VY5Q=,iv:oAOfe0qlOanFFgH4CjKtHYPAUujM4xid+U3zKQhtJbI=,tag:mxYZxlsv/WLQYRGdoeh+9g==,type:str] +swiss: ENC[AES256_GCM,data:zDBhSsPOguZuD6Kx+rMYR9KAjXxycbjXMhL5MZabZShKV+1ICZBsfnWOnBcfxX281hXf2K/TNbphC3KLnTaV0+Ti43BKunSDJp8qyEKgG3xsd7Zf8/i/eMQJygMphCF3XvJJjc3wBEUf/mZ1ObJKYueqtTdSZzx4orR6X93Vdt13GgFJLaX4/8XYsAeBXf4RwYD5gsVjg2QI0t48vnvlU0xN6oFvJAYedvyxgPL3z1pGv+0k/85XtaCfy38LQ5ddOYGxH+XKDzCfkskhd3X6cUeMbDfLrelGwvTB967wHAulgilBR1ObhV1SoUiz6K1a1PRy9XjuzwTbFG8fjFrGk+9yJtucFp1Vgtf6L+pgLxc5HzkC+f9tEldslJQC6y1045s/OWp+ghL+auzFuJGhDuq8JJUSF9Pk0LeDOb67wIrW+2250PTYJbINk2Sdo09Bj7GUCCBkrDHT+IcA/qF0saQ25QTE/BtPLEMiPhwgkYAhrL1uz7s6+HfuUiFPKY0jOn0q0xTxfV00G+wGJFp7,iv:uZxwZQZhmBKUQnAPuf6NFk9TRWH16PmVu5RoTmmxN9Y=,tag:hbvkjfxuSUM2MOyrUzhDrg==,type:str] +swiss.pub: ENC[AES256_GCM,data:wGUgxBYiTu0PcDSK/wNgIfdFyOIuqXkr7cOkXDkN3TdccYa/Lsa1qhm5ZXfVpktQE00oVLEHF8hnJfLUfPgOb44XfwhoWUFIdJRDokLSZoLwT/zlOqzEgJ1o1QZxm73xO5wFG1ns4+Fl2Jz5HJ55U3FHMP88B/UY5hYw6vNXfxcpPGbMOA==,iv:tdXPLgImFmEcMiqBSYMzTWFWbK2+5DKdvRyg+luEE0U=,tag:RsEI/YH0z8LW6f1cGhf68g==,type:str] +yubi: ENC[AES256_GCM,data:cUO0Yf06ZCIDXe6XBAvHcF+4/rFz3iC8rkgWKtyp5e8nJ80jXF9U00g8zns1yfnRG92QfHNH9hewDepSjkNY/j3SjhUbJynKjJpMTxZURVURJtrVwVbtlN/PvPyffxjolEFzzjM62wCNUCtF4lSZn1p8RQ/G38MI3wTP2JSAOFn4cA2nvJ5rL1vs05pElBfT19hDUfImFR4L5A7Q/bkfIpO7bO0D2qBbiCO6NI0epYXPUp0yize2+hu1mDPCLPIL29P3q7ycVJAXFqxyTvweo72qY7he1dqNEKu/hIFDuHMS+n9fhzf6Qn+5eJcljMofeYLXcLQn57TtUMFkiMRc9t50sip/S0DuPrFO87zf7FZYeHaRKs35gKktVPKl3Vgb+On6BO3A4oU1Ru/EiCdRiYL8d7yTKe9CcU7Hghz41ToAH6PEvx+uCFNvWvmIOlTfGHCik4uwPa35H/aUzLAd736AtcrjyNfvISx6MdtbS83+UFi+clM6ZDvLn/YShEBiipWzJuhK6ZjVq47kDxKFW1ym6ybihL/c+dXS7NcNigkJgpEpZMuFvPDyk/thmyhE3GgBExC/Lms=,iv:XmGbA9MElvTgd4cyjtPAy7uKC0GTqpQksX/8UBl1r+k=,tag:Ox8HK8XVRFGc8CYcnwKn5w==,type:str] +yubi.pub: ENC[AES256_GCM,data:MdT+SaIQ4Uf+7SXPTE9dKo9pLdfP299qUSeg5XITB5APs7jOleh6VIZXXamitYm9YQLHrwIZJdTql66SfNyRp0YbkEbd5VGBYKSkHj1taDqFoEG8HCv9DTBj/CiNEimrVcbAFU4zgc6S4jAbY4C3WIDiJ2+GsNjZJgIKOtYwCVKxheRW,iv:TwkpyyiFvOtiKxrtcxn6vgP5yCfW/1bDRGUpCSrJw84=,tag:+1YVdIqiY5VQnfOJK1Syzw==,type:str] +sops: + age: + - enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB1VHNVeE1hWWw2K3RDTEdv + UXlyMHRuVVhtSHF1VVRkcEE5VFNFcVFDelRNCkJSd1hwWXZNSWE4MWxLeEhWNmdw + bUg4S0ptSW1MZTV2NVlweUdyTFhGVEkKLS0tIHJuYWI2YjkrVU5LSU44MHZrYVVq + OHp6dUlaVkh3SGlJVUdIbkFvQVBJMWcKyivsQOeFIt19FqMdNrwphoUbbVmHZEL0 + auPp4D2lfZeN+qThhSqlL7gwAMgYII07Bxy+zdfRzDgZG4Vu9wSkOw== + -----END AGE ENCRYPTED FILE----- + recipient: age1y8vwxjyzhftr8n0mry5zkq34ra5g69z927p9s3qrj04gzqwasc8q3fqlgf + - enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBtdG1RRGFMbk11KzJBMnU2 + YW1GeFBzYUVURDlsenFldlZ5Q0FxUHdCU0RZCnIvUnlmKzlzSUtMVzlMSHVib2Zp + eEl0dlRNZlpqWTVKQVV1N2pVcTZwazQKLS0tIDM0Q1pMNFhVVlRoSDRkOUVnd0JI + cHVTZmpYcjk5ZTBMT09wbkNEY05hSlEKsDWV8a0HjyOgpusWHVKEkmt8yKAofVTD + LWmnHHwKMmORSke7Sv2w8HnLc3yBMJ7kIXdqzNL+qoD8ntxI/LkxaQ== + -----END AGE ENCRYPTED FILE----- + recipient: age1qmfyk82lve992tvzw82d4dgr3ek77xx9m7uez3uq55mgqu6r5eys40evkr + - enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBsRnJ1Nkw2bXQwSUYxR29i + cGsweXpKNEFObUROVjU4TmtJWjhib2ZuckRvCkg5MHkwdVlnQnBYMmpseEhxMXI3 + Rm5tMmpFSzd6ZEZTWW5IWW1zWC9JL2sKLS0tIFpSc1EvckhuVTdqOFBia0RkTjBl + N0Y2anMzSm9mU1ZnZU9wN3h2Q0lud3cKKB3WZzhBM2scG0tBDa+QOxt9IcHFQw9T + 4QAZU7kwgzEZuAOty9OYvsSa2ArFlhMxF1SPasO1iBgeQG8PL7ifIg== + -----END AGE ENCRYPTED FILE----- + recipient: age13ps3kkzfn3eyaqc50reudytr5ws80ssamzh09kj6878a6lgxususuu58wp + lastmodified: "2026-06-28T14:28:58Z" + mac: ENC[AES256_GCM,data:9ImIbWTSPIhFpgx+DhICpgTF2feJ9tlikEdlbpEMz5d9zpxHq4O2zxJwmUg8m547lhz5EN9ZwT+Al002DR2396n+tg6NsLCbUNMcf2BelW+2EWSsEPt3tNzazEW4EQIKHWS4y1FPXnQBpPtXPNHBuhWabMwCICk8uD2TFe+snL0=,iv:a0ZbRl6GqbOcSkUvavi0lTQkFEUcK1kgKWtVO1o0kRc=,tag:bL9M9kw7Q/o1K/+pYgRSFA==,type:str] + unencrypted_suffix: _unencrypted + version: 3.13.1