-{ privateFiles }:
{ config, pkgs, lib, ... }:
{
deployment = {
targetHost = config.hostEnv.ips.main.ip4;
substituteOnDestination = true;
};
+ # ssh-keyscan eldiron | nix-shell -p ssh-to-age --run ssh-to-age
+ secrets.ageKeys = [ "age1dxr5lhvtnjssfaqpnf6qx80h8gfwkxg3tdf35m6n9wljmk7wadfs3kmahj" ];
boot = {
kernelModules = [ "kvm-intel" ];
blacklistedKernelModules = [ "nvidiafb" ];
'';
nix.maxJobs = 8;
powerManagement.cpuFreqGovernor = "powersave";
- myEnv = import "${privateFiles}/environment.nix" // { inherit privateFiles; };
+ myEnv = import ../../../nixops/secrets/environment.nix;
fileSystems = {
# pools:
myServices.dns.enable = true;
myServices.certificates.enable = true;
myServices.websites.enable = true;
+ myServices.gemini.enable = true;
myServices.mail.enable = true;
myServices.ejabberd.enable = true;
myServices.vpn.enable = true;
services.netdata.config.global."memory mode" = "none";
services.netdata.config.health."enabled" = "no";
services.netdata.config.web.mode = "none";
- environment.etc."netdata/stream.conf".text = ''
- [stream]
- enabled = yes
- destination = ${config.myEnv.monitoring.netdata_aggregator}
- api key = ${config.myEnv.monitoring.netdata_keys.eldiron}
- '';
+ users.users."${config.services.netdata.user}".extraGroups = [ "keys" ];
+ environment.etc."netdata/stream.conf".source = config.secrets.fullPaths."netdata-stream.conf";
secrets.keys = [
+ {
+ dest = "netdata-stream.conf";
+ user = config.services.netdata.user;
+ group = config.services.netdata.group;
+ permissions = "0400";
+ text = ''
+ [stream]
+ enabled = yes
+ destination = ${config.myEnv.monitoring.netdata_aggregator}
+ api key = ${config.myEnv.monitoring.netdata_keys.eldiron}
+ '';
+ }
{
dest = "zrepl_backup/identity";
user = "root";