Updating flake lockfile & secrets + fixes

.github/labeler.yml

@@ -0,0 +1,70 @@
+# TODO: Figure out desired directory structure.
+
+# --- Nix Config Component Classes ---
+# TODO: Look at `divnix/std`  to enumerate all classes.
+# TODO: Look at `divnix/hive` to enumerate all classes.
+# Environments: modules, profiles, suites, configurations
+# Installables: packages, apps
+# Runnables: scripts, <installables>
+# Imports: libs, data,
+"Type: Module":
+  - modules/**.nix
+  - common/modules/**.nix
+  - darwin/modules/**.nix
+  - hm/module/**.nix
+  - nixos/module/**.nix
+  - nixos/modules/**.nix
+  - nixvim/modules/**.nix
+  - wsl/modules/**.nix
+  - */modules/**.nix
+
+"Type: Profile":
+  - profiles/**.nix
+  - common/profiles/**.nix
+  - darwin/profiles/**.nix
+  - home/profiles/**.nix
+  - nixos/profiles/**.nix
+  - user/profiles/**.nix
+  - */profiles/**.nix
+
+"Type: Suite":
+  - */suites/**.nix
+
+"Type: Configuration":
+  - */configurations/**.nix
+
+"Type: Secret":
+  - */secret/**.nix
+
+"Type: Package":
+  - */packages/**.nix
+  - */pkgs/**.nix
+
+"Type: App":
+  - */apps/**.nix
+  - */apps.nix
+
+"Type: Overlay":
+  - */overlays/**.nix
+
+"Type: Snippet":
+  - snippets/**
+
+"Type: Documentation":
+  - docs/**
+  - **.md
+
+
+"Arch: x86_64":
+  - **/x86_64*.nix
+  - **/x86_64*/**.nix
+
+"OS: Linux":
+  - **/*-linux/**.nix
+  - **/*-linux.nix
+  - **/linux/**.nix
+  - **/linux.nix
+
+"System: x86_64-linux":
+  - **/x86_64-linux/**.nix
+  - **/x86_64-linux*.nix

.github/workflows/check.yaml

@@ -0,0 +1,34 @@
+# https://github.com/marketplace/actions/publish-nix-flakes-to-flakehub
+# https://github.com/marketplace/actions/magic-nix-cache
+name: Flake Check
+on:
+  push:
+    paths-ignore:
+      - 'docs/**'
+      - '**.md'
+      - '.*'
+      - './**'
+  pull_request:
+    paths-ignore:
+      - 'docs/**'
+      - '**.md'
+      - '.*'
+      - './**'
+
+jobs:
+  check:
+    runs-on: ubuntu-22.04
+    steps:
+      - uses: actions/checkout@v3
+      - uses: DeterminateSystems/nix-installer-action@main
+        with:
+          diagnostic-endpoint: ""
+        #  github-token: ${{ github.token }}
+      - uses: DeterminateSystems/magic-nix-cache-action@main
+        with:
+          diagnostic-endpoint: "" # Disables telemetry
+          upstream-cache: https://lehmanator.cachix.org  # Uses binary cache
+      - uses: DeterminateSystems/flake-checker-action@main
+        with:
+          send-statistics: false
+      - run: nix flake check

.github/workflows/editorconfig.yml

@@ -0,0 +1,40 @@
+name: "Checking EditorConfig"
+permissions: read-all
+on:
+  # avoids approving first time contributors
+  pull_request_target:
+    branches-ignore:
+      - 'release-**'
+
+jobs:
+  tests:
+    runs-on: ubuntu-latest
+    if: "github.repository_owner == 'Lehmanator' && !contains(github.event.pull_request.title, '[skip treewide]')"
+    steps:
+    - name: Get list of changed files from PR
+      env:
+        GITHUB_TOKEN: ${{ secrets.GH_TOKEN_FOR_UPDATE }}
+        #GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      run: |
+        gh api \
+          repos/NixOS/nixpkgs/pulls/${{github.event.number}}/files --paginate \
+          | jq '.[] | select(.status != "removed") | .filename' \
+          > "$HOME/changed_files"
+    - name: print list of changed files
+      run: |
+        cat "$HOME/changed_files"
+    - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+      with:
+        # pull_request_target checks out the base branch by default
+        ref: refs/pull/${{ github.event.pull_request.number }}/merge
+    - uses: cachix/install-nix-action@7ac1ec25491415c381d9b62f0657c7a028df52a7 # v24
+      with:
+        # nixpkgs commit is pinned so that it doesn't break
+        # editorconfig-checker 2.4.0
+        nix_path: nixpkgs=https://github.com/NixOS/nixpkgs/archive/c473cc8714710179df205b153f4e9fa007107ff9.tar.gz
+    - name: Checking EditorConfig
+      run: |
+        cat "$HOME/changed_files" | nix-shell -p editorconfig-checker --run 'xargs -r editorconfig-checker -disable-indent-size'
+    - if: ${{ failure() }}
+      run: |
+        echo "::error :: Hey! It looks like your changes don't follow our editorconfig settings. Read https://editorconfig.org/#download to configure your editor so you never see this error again."

.github/workflows/update-flake.yml

@@ -0,0 +1,26 @@
+name: update-flake-lock
+on:
+  workflow_dispatch: # allows manual triggering
+  schedule:
+    - cron: '0 0 * * 1, 4' # Run twice a week
+
+jobs:
+  lockfile:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v3
+      - name: Install Nix
+        uses: DeterminateSystems/nix-installer-action@main
+      - name: Update flake.lock
+        uses: DeterminateSystems/update-flake-lock@main
+        with:
+          pr-assignees: Lehmanator
+          pr-reviewers: Lehmanator
+          token: ${{ secrets.GH_TOKEN_FOR_UPDATES }}
+          #sign-commits: true
+          #gpg-private-key: ${{ secrets.GPG_PRIVATE_KEY }}
+          #gpg-fingerprint: ${{ secrets.GPG_FINGERPRINT }} # specify subkey fingerprint (optional)
+          #gpg-passphrase: ${{ secrets.GPG_PASSPHRASE }}
+
+

.gitignore

@@ -0,0 +1,61 @@
+# --- Build Artifacts ---
+.direnv/
+**/result
+result
+
+# --- Local NUR Repos ---
+.nur/
+
+# --- Keys ---
+*.cacert
+*.cert
+*.crt
+*.key
+*.keyfile
+*.luks
+*.lukskey
+*.privkey
+*.pubkey
+*.pub
+*.p7
+*.p11
+*.pem
+*.pks
+*.pkcs
+*.secret
+id_rsa
+id_ed25519
+id_rsa_*
+id_ed25519_*
+id_*_rsa*
+id_*_ed25519*
+ssh_*_key
+**/private-keys*.d/
+**/pubring.kbx
+**/random_seed
+**/trustdb.gpg
+**/keys
+**/.keys
+
+# --- Private Info ---
+hosts.nix
+networks.nix
+repo.nix
+users.nix
+
+# --- Logging ---
+**/logs
+*.log
+
+# --- Cache ---
+.*.cache
+.cache/
+tags
+
+# --- Data ---
+.data/
+.notes/
+
+# --- Manual Exclude ---
+excl/
+lib/shell/glyphs.nix

.pre-commit-config.yaml

@@ -0,0 +1,19 @@
+# https://pre-commit.com
+repos:
+  # Find dead Nix code
+  # https://github.com/astro/deadnix
+  - repo: https://github.com/astro/deadnix
+    rev: v1.0.0
+    #frozen: v1.0.0
+    #rev: ID # frozen: VERSION
+    hooks:
+      - id: deadnix
+        #args: [--edit] # Uncomment to automatically modify files
+        stages: [commit]
+
+  -   repo: https://github.com/pre-commit/pre-commit-hooks
+      rev: v2.3.0
+      hooks:
+      -   id: check-yaml
+      -   id: end-of-file-fixer
+      -   id: trailing-whitespace

.sops.yaml

@@ -0,0 +1,108 @@
+# Also see https://github.com/Mic92/dotfiles/blob/master/nixos/.sops.yaml
+# for a more complex example.
+#
+# TODO: Implement .sops.yaml in Nix: https://github.com/TUM-DSE/doctor-cluster-config/blob/master/sops.yaml.nix
+#
+# List GPG key fingerprints: $ gpg --list-secret-keys
+#
+keys:
+  # --- Host ---
+  - &age-host-fw-ssh-ed25519 age14ussjg6kmjawm6zhfkspnujndx48a8yzlg6sew0gzyu74gpr8amq9g9udd
+  - &gpg-host-fw-ssh-rsa 68ee228d57b5b97c7f88dd33188b0095248cb8a0
+  #- &age-host-wyse-ssh-ed25519 age14ussjg6kmjawm6zhfkspnujndx48a8yzlg6sew0gzyu74gpr8amq9g9udd
+  - &age-host-wyse-ssh-ed25519 age1rlx8p27kd9tr4sft5zym6h2fwyu54gkce4q7c2t5nrtxd64jvd3qntk7f6
+  - &gpg-host-wyse-ssh-rsa 144323cfbd2f70139cd36059da23379472614d6c
+  # --- User ---
+  - &age-user-sam-ssh-ed25519 age18v7nxk3e5p2xjtpe7uxv2jz9zz624tkscpkcr6fepc0k6vvvfdgq5mduj8
+  - &gpg-user-sam-ssh-rsa 23e6e50809065aed145adb5aa4b65f3430feef6c
+  - &gpg-user-sam-primary DC1962D6560FF66BB16F99E0C47C146240410561
+  - &age-backup age19exrq2t6lkchn08mhmxvywcsq2eur6h0jpz4zqrtvkvume37c3ysx8usjq
+creation_rules:
+  # --- Host Secrets: Shared -----------------------------------------
+  # Decrypt with all host keys (user keys optional)
+  # - <type>/profiles/**/secrets.yaml
+  # - <type>/secrets/**/*.yaml
+  - path_regex: (common|darwin|droid|nixos|robotnix|wsl)/profiles/([^/]+/)+secrets\.(ya?ml|json|env|ini|bin|key|privkey|luks|lukskey)$
+    key_groups:
+      - age:
+          - *age-host-fw-ssh-ed25519
+          - *age-host-wyse-ssh-ed25519
+          #- *age-host-fajita-ssh-ed25519
+          - *age-user-sam-ssh-ed25519
+          - *age-backup
+  - path_regex: (common|darwin|droid|nixos|robotnix|wsl)/secrets/([^/]+/)*[^/]+\.(ya?ml|json|env|ini|bin|key|privkey|luks|lukskey)$
+    key_groups:
+      - age:
+          - *age-host-fw-ssh-ed25519
+          - *age-host-wyse-ssh-ed25519
+          #- *age-host-fajita-ssh-ed25519
+          - *age-user-sam-ssh-ed25519
+          - *age-backup
+  # --- Host Secrets: Per-Host ---------------------------------------
+  - path_regex: (nixos/)?hosts/fw/secrets/[^/]+\.(ya?ml|json|env|ini|bin|key|privkey|luks|lukskey)$
+    key_groups:
+      - age:
+          - *age-host-fw-ssh-ed25519
+          - *age-user-sam-ssh-ed25519
+          - *age-backup
+          #pgp:
+          #- *age-host-fw-ssh-ed25519
+          #- *gpg-host-fw-ssh-rsa
+          #- *gpg-user-sam-primary
+  - path_regex: nixos/hosts/wyse/secrets/[^/]+\.(ya?ml|json|env|ini|bin|key|privkey|luks|lukskey)$
+    key_groups:
+      - age:
+          - *age-host-wyse-ssh-ed25519
+          #- *age-host-fw-ssh-ed25519
+          - *age-user-sam-ssh-ed25519
+          - *age-backup
+  - path_regex: nixos/hosts/[^/]+/secrets/[^/]+\.(ya?ml|json|env|ini|bin|key|privkey|luks|lukskey)$
+    key_groups:
+      - age:
+          - *age-host-fw-ssh-ed25519
+          - *age-host-wyse-ssh-ed25519
+          - *age-user-sam-ssh-ed25519
+          - *age-backup
+        #pgp:
+        #- *age-host-fw-ssh-ed25519
+        #- *gpg-host-fw-ssh-rsa
+        #- *gpg-user-sam-primary
+  # --- User Secrets: Shared -----------------------------------------
+  # Decrypt with all user keys
+  # - hm/profiles/**/secrets.yaml
+  # - hm/secrets/**/*.yaml
+  - path_regex: hm/profiles/([^/]+/)+secrets\.(ya?ml|json|env|ini|bin|key|privkey|luks|lukskey)$
+    key_groups:
+      - age:
+          - *age-user-sam-ssh-ed25519
+          #- *age-user-sammy-ssh-ed25519
+          #- *age-user-guest-ssh-ed25519
+          - *age-backup
+  - path_regex: hm/secrets/([^/]+/)*[^/]+\.(ya?ml|json|env|ini|bin|key|privkey|luks|lukskey)$
+    key_groups:
+      - age:
+          - *age-user-sam-ssh-ed25519
+          #- *age-user-sammy-ssh-ed25519
+          #- *age-user-guest-ssh-ed25519
+          - *age-backup
+  # --- User Secrets: Per-User ---------------------------------------
+  - path_regex: hm/users/sam/secrets/[^/]+\.(ya?ml|json|env|ini|bin|key|privkey|luks|lukskey)$
+    key_groups:
+      - age:
+          - *age-host-fw-ssh-ed25519
+          - *age-user-sam-ssh-ed25519
+          - *age-backup
+          #pgp:
+          #- *age-host-fw-ssh-ed25519
+          #- *gpg-host-fw-ssh-rsa
+          #- *gpg-user-sam-primary
+  - path_regex: hm/users/[^/]+/secrets/[^/]+\.(ya?ml|json|env|ini|bin|key|privkey|luks|lukskey)$
+    key_groups:
+      - age:
+          - *age-host-fw-ssh-ed25519
+          - *age-user-sam-ssh-ed25519
+          - *age-backup
+        #pgp:
+        #- *age-host-fw-ssh-ed25519
+        #- *gpg-host-fw-ssh-rsa
+        #- *gpg-user-sam-primary