updated, revised some modules, cleaned up secrets management

9 files changed, 64 insertions, 57 deletions

diff --git a/os/core/bootloader.nix b/os/core/bootloader.nix
index 91502e9..e8dfc11 100644
--- a/os/core/bootloader.nix
+++ b/os/core/bootloader.nix
@@ -48,6 +48,7 @@ in
       };
     };
 
+    #TODO add boot.initrd.luks.reusePassphrases = true; somewhere
     luks.enable = lib.mkEnableOption "LUKS encryption support";
   };
 
diff --git a/os/core/users.nix b/os/core/users.nix
index 4bd0221..1ba471f 100644
--- a/os/core/users.nix
+++ b/os/core/users.nix
@@ -12,13 +12,24 @@ in
   options.os.core.users.enable = lib.mkEnableOption "enables user accounts";
   config = lib.mkIf cfg.enable {
     programs.fish.enable = true;
+    assertions = [
+      {
+        assertion = config.os.srv.sops.enable;
+        message = "required for storing the ssh key";
+      }
+    ];
+    sops.secrets = {
+      "users/root_password".neededForUsers = true;
+      "users/main_password".neededForUsers = true;
+      "users/opc_password".neededForUsers = true;
+    };
     users = {
       mutableUsers = false;
 
       users = {
         "${username}" = {
           isNormalUser = true;
-          hashedPasswordFile = config.sops.secrets.user_password.path;
+          hashedPasswordFile = config.sops.secrets."users/main_password".path;
           shell = pkgs.fish;
           extraGroups = lib.mkMerge [
             [
@@ -36,7 +47,7 @@ in
             (lib.mkIf (config.os.srv.docker.enable or false) [ "docker" ])
           ];
         };
-        root.hashedPasswordFile = config.sops.secrets.root_password.path;
+        root.hashedPasswordFile = config.sops.secrets."users/root_password".path;
       };
     };
   };
diff --git a/os/srv/aide.nix b/os/srv/aide.nix
deleted file mode 100644
index 8bd4c6a..0000000
--- a/os/srv/aide.nix
+++ /dev/null
@@ -1,30 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-let
-  cfg = config.os.srv.aide;
-in
-{
-  options.os.srv.aide.enable = lib.mkEnableOption "enables aide checking";
-  config = lib.mkIf cfg.enable {
-    systemd = {
-      services.aide-check = {
-        description = "Daily File Integrity Operational Check";
-        serviceConfig = {
-          Type = "oneshot";
-          ExecStart = "${pkgs.aide}/bin/aide --check";
-        };
-      };
-      timers.aide-check = {
-        wantedBy = [ "timers.target" ];
-        timerConfig = {
-          OnCalendar = "daily";
-          Persistent = true;
-        };
-      };
-    };
-  };
-}
diff --git a/os/srv/clamav.nix b/os/srv/clamav.nix
index cc84802..d2dc49f 100644
--- a/os/srv/clamav.nix
+++ b/os/srv/clamav.nix
@@ -1,9 +1,4 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
+{ config, lib, ... }:
 let
   cfg = config.os.srv.clamav;
 in
@@ -22,6 +17,5 @@ in
       updater.enable = true;
       fangfrisch.enable = true;
     };
-    environment.systemPackages = [ pkgs.aide ];
   };
 }
diff --git a/os/srv/default.nix b/os/srv/default.nix
index 9bba42b..715b0e0 100644
--- a/os/srv/default.nix
+++ b/os/srv/default.nix
@@ -1,7 +1,6 @@
 { ... }:
 {
   imports = [
-    ./aide.nix
     ./authelia.nix
     ./backup.nix
     ./bluetooth.nix
diff --git a/os/srv/monero.nix b/os/srv/monero.nix
index c7db2d8..9088ef3 100644
--- a/os/srv/monero.nix
+++ b/os/srv/monero.nix
@@ -37,25 +37,32 @@ in
 
       services.monero = {
         enable = true;
-        environmentFile = config.sops.secrets."monero/rpc-password".path;
+        prune = true;
+        limits = {
+          upload = 1250;
+          download = 12500;
+          threads = 8;
+        };
         banlist = builtins.fetchurl {
           url = "https://gui.xmr.pm/files/block.txt";
           hash = "0ik4d66js6wvrvciza0li6bsajj8dvxsqlf09hcz7hg610szdxcw";
         };
-        limits = {
-          upload = 1250;
-          download = 1250;
-          threads = 4;
-        };
         rpc = {
           restricted = true;
           user = "admin";
+          password = config.sops.secrets."monero/rpc-password".path;
         };
       };
 
       services.nginx.virtualHosts."xmr.${masterDomain}" = {
         enableACME = true;
         forceSSL = true;
+        listen = [
+          {
+            addr = "10.255.0.1";
+            port = 443;
+          }
+        ];
 
         locations."/" = {
           proxyPass = "http://127.0.0.1:18081";
diff --git a/os/srv/nix-helper.nix b/os/srv/nix-helper.nix
index 9734043..5e5e133 100644
--- a/os/srv/nix-helper.nix
+++ b/os/srv/nix-helper.nix
@@ -2,6 +2,7 @@
   config,
   lib,
   pkgs,
+  username,
   ...
 }:
 let
@@ -11,7 +12,10 @@ in
   options.os.srv.nix-helper.enable = lib.mkEnableOption "enables nix-helper";
   config = lib.mkIf cfg.enable {
     nix.settings = {
-      allowed-users = [ "@users" ];
+      trusted-users = [
+        "root"
+        "${username}"
+      ];
       experimental-features = [
         "nix-command"
         "flakes"
diff --git a/os/srv/sops.nix b/os/srv/sops.nix
index 20e1891..1b27042 100644
--- a/os/srv/sops.nix
+++ b/os/srv/sops.nix
@@ -12,10 +12,7 @@ in
 {
   imports = [ inputs.sops-nix.nixosModules.sops ];
 
-  options.os.srv.sops = {
-    enable = lib.mkEnableOption "enables sops-nix";
-    diskEncryption = lib.mkEnableOption "enables initrd decryption key (LUKS)";
-  };
+  options.os.srv.sops.enable = lib.mkEnableOption "enables sops-nix";
   config = lib.mkIf cfg.enable {
     sops = {
       defaultSopsFile = ../../secrets.yaml;
@@ -24,20 +21,14 @@ in
 
       secrets = {
         "syncthing/gui_password".owner = username;
-        "syncthing/encryption/openmw-config".owner = username;
-        "syncthing/encryption/openmw-mods".owner = username;
-        "syncthing/encryption/game-saves".owner = username;
         "syncthing/encryption/keepass".owner = username;
         "syncthing/encryption/sync".owner = username;
-        "vpn/warp_private_key".owner = "root";
         "obs/websocket_password".owner = username;
         "yggdrasil-private-key" = {
           owner = "root";
           group = "wheel";
           mode = "0440";
         };
-        root_password.neededForUsers = true;
-        user_password.neededForUsers = true;
       };
     };
 
diff --git a/os/srv/ssh.nix b/os/srv/ssh.nix
index 2c7a4ac..ec39bbd 100644
--- a/os/srv/ssh.nix
+++ b/os/srv/ssh.nix
@@ -12,6 +12,7 @@ in
   options.os.srv.ssh = {
     server = {
       enable = lib.mkEnableOption "enables the ssh server module";
+      enableInitrd = lib.mkEnableOption "enables ssh access during initrd";
       enableWireguard = lib.mkEnableOption "only allows connections from wireguard";
     };
     client = {
@@ -44,6 +45,35 @@ in
       users.users.${username}.openssh.authorizedKeys.keys = [
         "${keys.main} adikro@disroot.org"
       ];
+
+    })
+    (lib.mkIf (cfg.server.enable && cfg.server.enableInitrd) {
+      assertions = [
+        {
+          assertion = config.os.srv.sops.enable;
+          message = "required for storing the ssh key";
+        }
+      ];
+      sops.secrets."initrd_ssh_key" = {
+        path = "/etc/secrets/initrd/ssh_host_ed25519_key";
+      };
+      boot = {
+        initrd = {
+          secrets = {
+            "/etc/secrets/initrd/ssh_host_ed25519_key" = config.sops.secrets.initrd_ssh_key.path;
+          };
+          network = {
+            enable = true;
+            ssh = {
+              enable = true;
+              port = 2222;
+              authorizedKeys = [ "${keys.main}" ];
+              hostKeys = [ "/etc/secrets/initrd/ssh_host_ed25519_key" ];
+            };
+          };
+        };
+        kernelParams = [ "ip=dhcp" ];
+      };
     })
     (lib.mkIf (cfg.server.enable && cfg.server.enableWireguard) {
       services.openssh.listenAddresses = [