darwin modules

hosts/darwin/cen-it-07/configuration.nix

@@ -9,8 +9,18 @@
   imports = [
     inputs.nix-homebrew.darwinModules.nix-homebrew
     ../default.nix
+   ../../../modules/darwin
   ];
 
+  # home grown nixos modules
+  darwin = {
+#    ssh.enable = true;
+    sops.enable = true;
+    tailscale.enable = true;
+    syncthing.enable = true;
+  };
+ 
+
   # since darwin needs root now
   system = {
     primaryUser = "bhelderman";

modules/darwin/default.nix

@@ -0,0 +1,14 @@
+{
+  pkgs,
+  config,
+  lib,
+  ...
+}: {
+  imports = [
+#    ./ssh
+    ./tailscale
+    ./syncthing
+    ./sops
+  ];
+
+}

modules/darwin/sops/default.nix

@@ -0,0 +1,24 @@
+{
+  pkgs,
+  config,
+  lib,
+  inputs,
+  ...
+}: let
+  cfg = config.darwin.sops;
+in {
+  imports = [inputs.sops-nix.nixosModules.sops];
+
+  options.darwin.sops = {
+    enable = lib.mkEnableOption "enables sops";
+  };
+
+  config = lib.mkIf cfg.enable {
+    # enable and configure sops for secrets
+    sops = {
+      defaultSopsFile = ../../../secrets/secrets.yaml;
+      defaultSopsFormat = "yaml";
+      age.keyFile = "/etc/sops/keys.txt";
+    };
+  };
+}

modules/darwin/syncthing/default.nix

@@ -0,0 +1,95 @@
+{
+  pkgs,
+  config,
+  lib,
+  ...
+}: let
+  service = "syncthing";
+  cfg = config.darwin.${service};
+  sec = config.sops.secrets;
+in {
+  options.darwin.${service} = {
+    enable = lib.mkEnableOption "enables syncthing";
+    host = lib.mkOption {
+      type = lib.types.nullOr lib.types.str;
+      default = config.networking.hostName;
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.syncthing = {
+      enable = true;
+      user = "bhelderman";
+      group = "bhelderman";
+      guiAddress = "127.0.0.1:2222";
+      openDefaultPorts = true;
+      dataDir = "/home/blake/.config/syncthing";
+      #extraFlags = ["--no-default-folder"];
+      overrideFolders = false;
+      overrideDevices = false;
+      key = sec."${service}/${cfg.host}/key".path;
+      cert = sec."${service}/${cfg.host}/cert".path;
+      settings = {
+        devices = {
+          "snowbelle" = {id = "6WQ6ATA-5AT4RUM-NW67PAL-N62CPNV-ALRFG3P-5BDRO22-HWFC2Q4-5S5BDA5";};
+          "mudkip" = {id = "OV4NUQK-3YHRL5R-SIZGTNL-7VZFFUX-FOJ6NTS-C7ROXR7-I2Q2W7G-QERO7AO";};
+          "zygarde" = {id = "UYLTF52-VVKUR7F-JN33HQZ-RFNWGL3-JER52LA-GZD2LPJ-QIFEE7K-MNMZRQ5";};
+          "mew" = {id = "7ZC2NAS-QONQKAL-Z54NPMB-7TRXM6M-K7Z6PZD-FG4AI4H-V7SMFJN-JOYBHQO";};
+          "yveltal" = {id = "ZVSQ4WJ-7OICYOZ-3ECES4X-KH37IPB-TKHKUJG-BSEGXVM-AHYY5C3-VKG44AX";};
+          "CEN-IT-07" = {id = "DPYKA4Z-3PX7JB2-FBEOXXX-SC7TLT2-QC5P2IR-SXOPJGX-QO3DMII-5B7UCA4";};
+          "CEN-IT-00007" = {id = "XBPXGYU-DUJSLDH-6BDNF4D-CO2COC3-N3FM6W5-IHZOJBM-Z2N77RI-IVAV5AH";};
+        };
+        folders = {
+          "holocron" = {
+            path = "/home/bhelderman/holocron";
+            devices = ["mudkip" "zygarde" "mew" "yveltal" "CEN-IT-07" "CEN-IT-00007" "snowbelle"];
+            id = "5voxg-c3he2";
+            versioning = {
+              type = "staggered";
+              fsPath = "/home/blake/holocron/.stversions";
+              params = {
+                cleanInterval = "3600";
+                maxAge = "0";
+              };
+            };
+            ignorePerms = true;
+            ignorePatterns = [
+              "// syncthing"
+              "/.versions"
+              "/.versions/**"
+              "/.stversions"
+              "/.stversions/**"
+              "// macos system junk"
+              "(?d).DS_Store"
+              "(?d).AppleDouble"
+              "(?d).LSOverride"
+              "(?d)Icon?"
+              "(?d)._*"
+              "(?d).Spotlight-V100"
+              "(?d).Trashes"
+              "(?d).fseventsd"
+              "(?d).metadata_never_index"
+              "(?d).com.apple.timemachine.donotpresent"
+              "(?d).com.apple.*"
+              "(?d)~*.tmp"
+            ];
+          };
+        };
+        options = {
+          urAccepted = -1;
+        };
+      };
+    };
+
+    sops.secrets = {
+      "${service}/${cfg.host}/key" = {
+        owner = "blake";
+        group = "blake";
+      };
+      "${service}/${cfg.host}/cert" = {
+        owner = "blake";
+        group = "blake";
+      };
+    };
+  };
+}

modules/darwin/tailscale/default.nix

@@ -0,0 +1,33 @@
+{
+  pkgs,
+  config,
+  lib,
+  ...
+}: let
+  cfg = config.darwin.tailscale;
+  authkey_file = config.sops.secrets."tailscale_authkey".path;
+in {
+  options.darwin.tailscale = {
+    enable = lib.mkEnableOption "enables tailscale";
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.tailscale = {
+      enable = true;
+      useRoutingFeatures = "both";
+      #authKeyFile = authkey_file;
+      extraSetFlags = [
+        "--accept-routes=true" # true is equilivant to useRoutingFeatures = "client" (breaks shit)
+        "--accept-dns=true" # explicitly allow resolved
+      ];
+    };
+
+
+    # declare authkey secrets
+    sops.secrets = {
+      "tailscale_authkey" = {
+        owner = "root";
+      };
+    };
+  };
+}