dotfiles

commit d65a8e013e855d0166c0635a5280870774059dbe
parent 1c249c7eaacc852e0863f45b390ad947b3fc2459
Author: maydayv7 <maydayv7@gmail.com>
Date:   Fri,  8 Dec 2023 21:16:38 +0530

refactor!: Secrets Imports

Also fix hostnames and `nixos` script

Diffstat:

17 files changed, 109 insertions(+), 107 deletions(-)
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
@@ -25,7 +25,7 @@ jobs:
       max-parallel: 1
       fail-fast: false
       matrix:
-        device: [Vortex, Futura]
+        device: [vortex, futura]
     steps:
       - name: Maximize Build Space
         run: |
diff --git a/.gitignore b/.gitignore
@@ -1,6 +0,0 @@
-*~*
-*.bak
-builds
-.direnv
-result
-*.wiki
diff --git a/README.md b/README.md
@@ -105,8 +105,8 @@ github:maydayv7/dotfiles
 │   └───x86_64-linux: omitted (use '--legacy' to show)
 ├───lib: utility library functions
 ├───nixosConfigurations
-│   ├───Futura: NixOS configuration
-│   └───Vortex: NixOS configuration
+│   ├───futura: NixOS configuration
+│   └───vortex: NixOS configuration
 ├───nixosModule: NixOS module
 ├───nixosModules
 │   ├───apps: NixOS module
@@ -323,7 +323,7 @@ This repository makes use of [`GitHub Actions`](./checks/github/workflows) in or
 
 ###### Variables
 
-- [`ACCESS_TOKEN`](./devices/Vortex/secrets/github-token.secret): Personal Access Token (To create one - [GitHub](https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token), [GitLab](https://docs.gitlab.com/ee/user/profile/personal_access_tokens.html))
+- [`ACCESS_TOKEN`](./secrets/github-token.secret): Personal Access Token (To create one - [GitHub](https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token), [GitLab](https://docs.gitlab.com/ee/user/profile/personal_access_tokens.html))
 - [`CACHIX_TOKEN`](./secrets/cachix-token.secret): Cachix Authentication Token
 
 ### Home Manager
diff --git a/checks/gitlab/pipelines/build.yml b/checks/gitlab/pipelines/build.yml
@@ -11,7 +11,7 @@ device:
     CACHIX_CACHE_NAME: maydayv7-dotfiles
   parallel:
     matrix:
-      - DEVICE: [Vortex, Futura]
+      - DEVICE: [vortex, futura]
   script: cachix watch-exec $CACHIX_CACHE_NAME nix build .#nixosConfigurations.$DEVICE.config.system.build.toplevel -- -L --show-trace
 
 # Build and Upload Install Media Image
diff --git a/checks/gitlab/pipelines/shell.yml b/checks/gitlab/pipelines/shell.yml
@@ -13,6 +13,5 @@ shell:
     CACHIX_CACHE_NAME: maydayv7-dotfiles
   parallel:
     matrix:
-      - DEVSHELL:
-          [cc, format, java, lua, python, rust, video, website]
+      - DEVSHELL: [cc, format, java, lua, python, rust, video, website]
   script: cachix watch-exec $CACHIX_CACHE_NAME nix develop .#$DEVSHELL
diff --git a/devices/Futura.nix b/devices/Futura.nix
@@ -1,29 +0,0 @@
-{
-  system = "x86_64-linux";
-  name = "Futura";
-  description = "PC - Dell Inspiron 11 3000";
-
-  timezone = "Asia/Kolkata";
-  locale = "IN";
-  update = "weekly";
-
-  kernel = "6_5";
-  hardware = {
-    boot = "efi";
-    cores = 4;
-    filesystem = "simple";
-    support = ["laptop"];
-    modules = ["common-cpu-intel" "common-pc" "common-pc-laptop"];
-  };
-
-  gui.desktop = "xfce";
-  apps.list = ["firefox" "office"];
-
-  # User Navya
-  user = {
-    name = "navya";
-    groups = ["wheel"];
-    description = "Navya";
-    shell = "zsh";
-  };
-}
diff --git a/devices/Vortex/default.nix b/devices/Vortex/default.nix
@@ -1,48 +0,0 @@
-{
-  system = "x86_64-linux";
-  name = "Vortex";
-  description = "PC - Dell Inspiron 15 5000";
-
-  timezone = "Asia/Kolkata";
-  locale = "IN";
-
-  kernel = "lqx";
-  kernelModules = ["nvme" "thunderbolt"];
-
-  imports = [./secrets];
-
-  hardware = {
-    boot = "secure";
-    cores = 8;
-    filesystem = "advanced";
-    support = ["laptop" "mobile" "printer" "virtualisation"];
-    modules = ["dell-inspiron-5509"];
-    vm.android.enable = true;
-  };
-
-  gui = {
-    desktop = "gnome";
-    wallpaper = "Nix";
-  };
-
-  nix = {
-    index = true;
-    tools = true;
-  };
-
-  shell.utilities = true;
-  apps = {
-    list = ["discord" "firefox" "git" "office" "vscode" "wine"];
-    wine.utilities = true;
-  };
-
-  # User V7
-  user = {
-    name = "v7";
-    description = "V 7";
-    groups = ["wheel" "keys"];
-    uid = 1000;
-    shell = "zsh";
-    shells = ["bash"];
-  };
-}
diff --git a/devices/Vortex/secrets/default.nix b/devices/Vortex/secrets/default.nix
@@ -1,4 +0,0 @@
-{util, ...}: {
-  ## System Secrets ##
-  config.sops.secrets = util.map.secrets {directory = ./.;};
-}
diff --git a/devices/futura.nix b/devices/futura.nix
@@ -0,0 +1,29 @@
+{
+  system = "x86_64-linux";
+  name = "futura";
+  description = "PC - Dell Inspiron 11 3000";
+
+  timezone = "Asia/Kolkata";
+  locale = "IN";
+  update = "weekly";
+
+  kernel = "6_5";
+  hardware = {
+    boot = "efi";
+    cores = 4;
+    filesystem = "simple";
+    support = ["laptop"];
+    modules = ["common-cpu-intel" "common-pc" "common-pc-laptop"];
+  };
+
+  gui.desktop = "xfce";
+  apps.list = ["firefox" "office"];
+
+  # User Navya
+  user = {
+    name = "navya";
+    groups = ["wheel"];
+    description = "Navya";
+    shell = "zsh";
+  };
+}
diff --git a/devices/vortex.nix b/devices/vortex.nix
@@ -0,0 +1,46 @@
+{
+  system = "x86_64-linux";
+  name = "vortex";
+  description = "PC - Dell Inspiron 15 5000";
+
+  timezone = "Asia/Kolkata";
+  locale = "IN";
+
+  kernel = "lqx";
+  kernelModules = ["nvme" "thunderbolt"];
+
+  hardware = {
+    boot = "secure";
+    cores = 8;
+    filesystem = "advanced";
+    support = ["laptop" "mobile" "printer" "virtualisation"];
+    modules = ["dell-inspiron-5509"];
+    vm.android.enable = true;
+  };
+
+  gui = {
+    desktop = "gnome";
+    wallpaper = "Nix";
+  };
+
+  nix = {
+    index = true;
+    tools = true;
+  };
+
+  shell.utilities = true;
+  apps = {
+    list = ["discord" "firefox" "git" "office" "vscode" "wine"];
+    wine.utilities = true;
+  };
+
+  # User V7
+  user = {
+    name = "v7";
+    description = "V 7";
+    groups = ["wheel" "keys"];
+    uid = 1000;
+    shell = "zsh";
+    shells = ["bash"];
+  };
+}
diff --git a/scripts/nixos.nix b/scripts/nixos.nix
@@ -301,11 +301,11 @@ in
         case $2 in
         "") error "Expected a Variant of Install Media or Device";;
         *)
-          if grep -wq "$2" <<<"${installMedia}"
+          if grep -wq "$2" <<<"${installMedia}" &> /dev/null
           then
             echo "Building '$2' Install Media Image..."
             nix build ${path.system}#installMedia."$2".config.system.build.isoImage && echo "The Image is located at './result/iso/nixos.iso'"
-          elif grep -wq "$2" <<<"${nixosConfigurations}"
+          elif grep -wq "$2" <<<"${nixosConfigurations}" &> /dev/null
           then
             echo "Building '$2' Device Image..."
             nixos-generate -f iso --flake ${path.system}#"$2"
@@ -450,8 +450,13 @@ in
           case $3 in
           "") error "Expected 'name' of Secret";;
           *)
-            echo "Editing Secret '$3'..."
-            find ${path.system} -name "$3".secret -exec sops --config ${sops} -i {} \+ || error "Unknown Secret '$3'"
+            if find ${path.system} -name "$3".secret | grep "secret" &> /dev/null
+            then
+              echo "Editing Secret '$3'..."
+              find ${path.system} -name "$3".secret -exec sops --config ${sops} -i {} \+
+            else
+              error "Unknown Secret '$3'"
+            fi
           ;;
           esac
         ;;
@@ -460,8 +465,13 @@ in
           grep / ${sops} | sed -e 's|- path_regex:||' -e 's/\/\.\*\$//' -e 's|   |${path.system}/|' | xargs tree -C --noreport -P '*.secret' -I '_*' | sed 's/\.secret//'
         ;;
         show)
-          echo "Showing Secret '$3'..."
-          find ${path.system} -name "$3".secret -exec sops --config ${sops} -d {} \+ || error "Unknown Secret '$3'"
+          if find ${path.system} -name "$3".secret | grep "secret" &> /dev/null
+          then
+            echo "Showing Secret '$3'..."
+            find ${path.system} -name "$3".secret -exec sops --config ${sops} -d {} \+
+          else
+            error "Unknown Secret '$3'"
+          fi
         ;;
         update)
           echo "Updating Secrets..."
@@ -474,7 +484,7 @@ in
         case $2 in
         "") nix develop ${path.system} --command "$SHELL";;
         *)
-          if grep -wq "$2" <<<"${devShells}"
+          if grep -wq "$2" <<<"${devShells}" &> /dev/null
           then
             nix develop ${path.system}#"$2" --command "$SHELL"
           else
diff --git a/secrets/README.md b/secrets/README.md
@@ -2,4 +2,4 @@
 
 The authentication credentials are managed using [`sops-nix`](https://github.com/Mic92/sops-nix) at `secrets`. The [`sops`](https://github.com/mozilla/sops) encrypted secrets (using GPG authentication) are stored at multiple places, like in this directory, as well as [`modules/user/passwords`](../modules/user/passwords). User passwords are made using the command `mkpasswd -m sha-512` and specified using the `hashedPasswordFile` option. The `sops` encrypted secrets are of `binary` format (and have the extension `.secret`) and can be conveniently managed using the [`nixos`](../scripts/README.md) `secret` command. The `keys` directory contains the _public_ User GPG Keys which are automatically imported
 
-To create a secret, use the `nixos secret create` command, and append the directory along with requisite access permissions to the `secrets.yaml` file
+To create a secret, use the `nixos secret create` command, and append the directory along with requisite access permissions to the `secrets.yaml` file. Device-specific secrets are automatically imported, if a directory (with the same name as the device `HOSTNAME`) containing them is present in this directory
diff --git a/secrets/default.nix b/secrets/default.nix
@@ -1,4 +1,5 @@
 {
+  config,
   lib,
   util,
   inputs,
@@ -17,7 +18,15 @@
 
     sops = {
       # Encrypted Secrets
-      secrets = util.map.secrets {directory = ./.;};
+      secrets = let
+        directory = ./. + "/${config.networking.hostName}";
+      in
+        util.map.secrets {directory = ./.;}
+        // (
+          if (builtins.pathExists directory)
+          then util.map.secrets {inherit directory;}
+          else {}
+        );
 
       # GPG Key Import
       gnupg = {
diff --git a/secrets/secrets.yaml b/secrets/secrets.yaml
@@ -11,7 +11,3 @@ creation_rules:
       - pgp:
           - *v7
           - *navya
-  - path_regex: devices/Vortex/secrets/.*$
-    key_groups:
-      - pgp:
-          - *v7
diff --git a/devices/Vortex/secrets/cloudflare.secret b/secrets/vortex/cloudflare.secret
diff --git a/devices/Vortex/secrets/github-runner.secret b/secrets/vortex/github-runner.secret
diff --git a/devices/Vortex/secrets/gitlab-runner.secret b/secrets/vortex/gitlab-runner.secret