Aner Zakobar
2f0d0b5e4c
Replaces the Helm/k3s setup with a declarative NixOS configuration targeting
a Raspberry Pi 4. Services run as podman containers under systemd, with data
on an external HD at /mnt/data. Key components:
- flake.nix: multi-host flake with pi-main (aarch64) and a placeholder for a
second machine
- modules/common.nix: shared system config (nix, podman, sops, SSH)
- modules/storage.nix: external HD mount with per-service subdirs
- modules/caddy.nix: Caddy with cloudflare DNS-01 ACME + authelia forward_auth
- modules/cloudflared.nix: Cloudflare tunnel for remote access
- modules/backup.nix: restic daily backups with NC maintenance mode pre-hook
- modules/services/{openldap,authelia,gitea,nextcloud,phpldapadmin}.nix: core services
- modules/services/{jellyfin,transmission}.nix: media services (disabled by default)
- secrets/: sops-nix scaffold with .sops.yaml age key config
- hosts/pi-main/: hardware config + service selection for the Pi
- PORTING.md: step-by-step migration guide (SD card → data restore → verify)
25 lines
1000 B
YAML
25 lines
1000 B
YAML
# sops configuration — controls which keys can decrypt secrets.yaml.
|
|
#
|
|
# SETUP STEPS (do this once on the Pi):
|
|
#
|
|
# 1. Install age: nix-shell -p age
|
|
# 2. Generate a key: age-keygen -o /var/lib/sops-nix/key.txt
|
|
# 3. Print the pubkey: age-keygen -y /var/lib/sops-nix/key.txt
|
|
# 4. Replace AGE-PUBLIC-KEY-PI-MAIN below with the output of step 3.
|
|
# 5. (Optional) add your own age key or GPG key as a second recipient so
|
|
# you can edit secrets from your workstation without the Pi being on.
|
|
#
|
|
# To encrypt / edit secrets.yaml:
|
|
# sops secrets/secrets.yaml
|
|
#
|
|
# sops will re-encrypt the file for all keys listed here every time you save.
|
|
|
|
creation_rules:
|
|
- path_regex: secrets/secrets\.yaml$
|
|
key_groups:
|
|
- age:
|
|
# Pi main host key — replace with output of `age-keygen -y /var/lib/sops-nix/key.txt`
|
|
- AGE-PUBLIC-KEY-PI-MAIN-REPLACE-ME
|
|
# (Optional) your workstation key for offline editing:
|
|
# - AGE-PUBLIC-KEY-YOUR-WORKSTATION
|