darwin modules

hosts/darwin/cen-it-07/configuration.nix

@@ -9,8 +9,18 @@
   imports = [
     inputs.nix-homebrew.darwinModules.nix-homebrew
     ../default.nix
+   ../../../modules/darwin
   ];
 
+  # home grown nixos modules
+  darwin = {
+#    ssh.enable = true;
+    sops.enable = true;
+    tailscale.enable = true;
+    syncthing.enable = true;
+  };
+ 
+
   # since darwin needs root now
   system = {
     primaryUser = "bhelderman";

modules/darwin/default.nix

@@ -0,0 +1,14 @@
+{
+  pkgs,
+  config,
+  lib,
+  ...
+}: {
+  imports = [
+#    ./ssh
+    ./tailscale
+    ./syncthing
+    ./sops
+  ];
+
+}

modules/darwin/sops/default.nix

@@ -0,0 +1,24 @@
+{
+  pkgs,
+  config,
+  lib,
+  inputs,
+  ...
+}: let
+  cfg = config.darwin.sops;
+in {
+  imports = [inputs.sops-nix.nixosModules.sops];
+
+  options.darwin.sops = {
+    enable = lib.mkEnableOption "enables sops";
+  };
+
+  config = lib.mkIf cfg.enable {
+    # enable and configure sops for secrets
+    sops = {
+      defaultSopsFile = ../../../secrets/secrets.yaml;
+      defaultSopsFormat = "yaml";
+      age.keyFile = "/etc/sops/keys.txt";
+    };
+  };
+}

modules/darwin/syncthing/default.nix

@@ -0,0 +1,95 @@
+{
+  pkgs,
+  config,
+  lib,
+  ...
+}: let
+  service = "syncthing";
+  cfg = config.darwin.${service};
+  sec = config.sops.secrets;
+in {
+  options.darwin.${service} = {
+    enable = lib.mkEnableOption "enables syncthing";
+    host = lib.mkOption {
+      type = lib.types.nullOr lib.types.str;
+      default = config.networking.hostName;
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.syncthing = {
+      enable = true;
+      user = "bhelderman";
+      group = "bhelderman";
+      guiAddress = "127.0.0.1:2222";
+      openDefaultPorts = true;
+      dataDir = "/home/blake/.config/syncthing";
+      #extraFlags = ["--no-default-folder"];
+      overrideFolders = false;
+      overrideDevices = false;
+      key = sec."${service}/${cfg.host}/key".path;
+      cert = sec."${service}/${cfg.host}/cert".path;
+      settings = {
+        devices = {
+          "snowbelle" = {id = "6WQ6ATA-5AT4RUM-NW67PAL-N62CPNV-ALRFG3P-5BDRO22-HWFC2Q4-5S5BDA5";};
+          "mudkip" = {id = "OV4NUQK-3YHRL5R-SIZGTNL-7VZFFUX-FOJ6NTS-C7ROXR7-I2Q2W7G-QERO7AO";};
+          "zygarde" = {id = "UYLTF52-VVKUR7F-JN33HQZ-RFNWGL3-JER52LA-GZD2LPJ-QIFEE7K-MNMZRQ5";};
+          "mew" = {id = "7ZC2NAS-QONQKAL-Z54NPMB-7TRXM6M-K7Z6PZD-FG4AI4H-V7SMFJN-JOYBHQO";};
+          "yveltal" = {id = "ZVSQ4WJ-7OICYOZ-3ECES4X-KH37IPB-TKHKUJG-BSEGXVM-AHYY5C3-VKG44AX";};
+          "CEN-IT-07" = {id = "DPYKA4Z-3PX7JB2-FBEOXXX-SC7TLT2-QC5P2IR-SXOPJGX-QO3DMII-5B7UCA4";};
+          "CEN-IT-00007" = {id = "XBPXGYU-DUJSLDH-6BDNF4D-CO2COC3-N3FM6W5-IHZOJBM-Z2N77RI-IVAV5AH";};
+        };
+        folders = {
+          "holocron" = {
+            path = "/home/bhelderman/holocron";
+            devices = ["mudkip" "zygarde" "mew" "yveltal" "CEN-IT-07" "CEN-IT-00007" "snowbelle"];
+            id = "5voxg-c3he2";
+            versioning = {
+              type = "staggered";
+              fsPath = "/home/blake/holocron/.stversions";
+              params = {
+                cleanInterval = "3600";
+                maxAge = "0";
+              };
+            };
+            ignorePerms = true;
+            ignorePatterns = [
+              "// syncthing"
+              "/.versions"
+              "/.versions/**"
+              "/.stversions"
+              "/.stversions/**"
+              "// macos system junk"
+              "(?d).DS_Store"
+              "(?d).AppleDouble"
+              "(?d).LSOverride"
+              "(?d)Icon?"
+              "(?d)._*"
+              "(?d).Spotlight-V100"
+              "(?d).Trashes"
+              "(?d).fseventsd"
+              "(?d).metadata_never_index"
+              "(?d).com.apple.timemachine.donotpresent"
+              "(?d).com.apple.*"
+              "(?d)~*.tmp"
+            ];
+          };
+        };
+        options = {
+          urAccepted = -1;
+        };
+      };
+    };
+
+    sops.secrets = {
+      "${service}/${cfg.host}/key" = {
+        owner = "blake";
+        group = "blake";
+      };
+      "${service}/${cfg.host}/cert" = {
+        owner = "blake";
+        group = "blake";
+      };
+    };
+  };
+}

modules/darwin/tailscale/default.nix

@@ -0,0 +1,33 @@
+{
+  pkgs,
+  config,
+  lib,
+  ...
+}: let
+  cfg = config.darwin.tailscale;
+  authkey_file = config.sops.secrets."tailscale_authkey".path;
+in {
+  options.darwin.tailscale = {
+    enable = lib.mkEnableOption "enables tailscale";
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.tailscale = {
+      enable = true;
+      useRoutingFeatures = "both";
+      #authKeyFile = authkey_file;
+      extraSetFlags = [
+        "--accept-routes=true" # true is equilivant to useRoutingFeatures = "client" (breaks shit)
+        "--accept-dns=true" # explicitly allow resolved
+      ];
+    };
+
+
+    # declare authkey secrets
+    sops.secrets = {
+      "tailscale_authkey" = {
+        owner = "root";
+      };
+    };
+  };
+}

users/blake/dots/core/lf/lfrc

@@ -114,3 +114,71 @@ cmd mkbak %{{
   done
 
 }}
+
+# git stuff
+cmd git_branch ${{
+    git branch | fzf | xargs git checkout
+    pwd_shell="$(pwd | sed 's/\\/\\\\/g;s/"/\\"/g')"
+    lf -remote "send $id updir; cd \"$pwd_shell\""
+}}
+map gb :git_branch
+map gp $clear; git pull --rebase || true; echo "press ENTER"; read ENTER
+map gs $clear; git status; echo "press ENTER"; read ENTER
+map gl $clear; git log --graph --pretty=format:'%Cred%h%Creset -%C(yellow)%d%Creset %s %Cgreen(%cr) %C(bold blue)<%an>%Creset' --abbrev-commit
+
+set info custom
+
+cmd on-load &{{
+    cd "$(dirname "$1")" || exit 1
+    [ "$(git rev-parse --is-inside-git-dir 2>/dev/null)" = false ] || exit 0
+
+    cmds=""
+
+    for file in "$@"; do
+        case "$file" in
+            */.git|*/.git/*) continue;;
+        esac
+
+        status=$(git status --porcelain --ignored -- "$file" | cut -c1-2 | head -n1)
+
+        if [ -n "$status" ]; then
+            cmds="${cmds}addcustominfo ${file} \"$status\"; "
+        else
+            cmds="${cmds}addcustominfo ${file} ''; "
+        fi
+    done
+
+    lf -remote "send $id :$cmds"
+}}
+
+cmd on-cd &{{
+    # display git repository status in your prompt
+    source /usr/share/git/completion/git-prompt.sh
+    GIT_PS1_SHOWDIRTYSTATE=auto
+    GIT_PS1_SHOWSTASHSTATE=auto
+    GIT_PS1_SHOWUNTRACKEDFILES=auto
+    GIT_PS1_SHOWUPSTREAM=auto
+    GIT_PS1_COMPRESSSPARSESTATE=auto
+    git="$(__git_ps1 " [GIT BRANCH:> %s]")" || true
+    fmt="\033[32;1m%u@%h\033[0m:\033[34;1m%w\033[0m\033[33;1m$git\033[0m"
+    lf -remote "send $id set promptfmt \"$fmt\""
+}}
+
+cmd on-cd &{{
+    # display repository status in your prompt
+    if [ -d .git ] || [ -f .git ]; then
+        branch="$(git branch --show-current 2>/dev/null)" || true
+        remote="$(git config --get "branch.$branch.remote" 2>/dev/null)" || true
+        url="$(git remote get-url "$remote" 2>/dev/null)" || true
+        fmt="\033[32;1m%u@%h\033[0m:\033[34;1m%w\033[0m\033[33;1m [GIT BRANCH:> $branch >> $url]\033[0m"
+    elif [ -d .hg ]; then
+        hg="$(hg branch 2>/dev/null)" || true
+        fmt="\033[32;1m%u@%h\033[0m:\033[34;1m%w\033[0m\033[33;1m [HG BRANCH:> $hg]\033[0m"
+    elif [ -d .svn ]; then
+        svn="$(svn info 2>/dev/null | awk '/^URL: /{print $2}')" || true
+        fmt="\033[32;1m%u@%h\033[0m:\033[34;1m%w\033[0m\033[33;1m [SVN URL:> $svn]\033[0m"
+    else
+        fmt="\033[32;1m%u@%h\033[0m:\033[34;1m%d\033[0m\033[1m%f\033[0m"
+    fi
+    lf -remote "send $id set promptfmt \"$fmt\""
+}}