feat: adds opnix, mennos-laptop-w as host and cleans up secrets

Signed-off-by: Menno van Leeuwen <menno@vleeuwen.me>
This commit is contained in:
2025-07-15 23:50:26 +02:00
parent 1867846c0d
commit 94998bec48
24 changed files with 185 additions and 152 deletions

View File

@@ -1,11 +1,9 @@
[workstations]
mennos-laptop ansible_connection=local
mennos-cosmic-laptop ansible_connection=local
mennos-laptop-w ansible_connection=local
mennos-desktop ansible_connection=local
[servers]
mennos-server ansible_connection=local
mennos-cloud-server ansible_connection=local
mennos-hobbypc ansible_connection=local
mennos-vm ansible_connection=local
dotfiles-test ansible_connection=local

View File

@@ -12,7 +12,7 @@
- name: Include workstation tasks
ansible.builtin.import_tasks: tasks/workstations/workstation.yml
when: inventory_hostname in ['mennos-laptop', 'mennos-cosmic-laptop', 'mennos-desktop']
when: inventory_hostname in ['mennos-laptop-w', 'mennos-desktop']
- name: Include server tasks
ansible.builtin.import_tasks: tasks/servers/server.yml

View File

@@ -10,6 +10,7 @@
- name: Include Tailscale tasks
ansible.builtin.import_tasks: tasks/global/tailscale.yml
become: true
when: "'microsoft-standard-WSL2' not in ansible_kernel"
- name: Include Rust tasks
ansible.builtin.import_tasks: tasks/global/rust.yml
@@ -18,14 +19,17 @@
- name: Include Docker tasks
ansible.builtin.import_tasks: tasks/global/docker.yml
become: true
when: "'microsoft-standard-WSL2' not in ansible_kernel"
- name: Include Ollama tasks
ansible.builtin.import_tasks: tasks/global/ollama.yml
become: true
when: "'microsoft-standard-WSL2' not in ansible_kernel"
- name: Include OpenSSH Server tasks
ansible.builtin.import_tasks: tasks/global/openssh-server.yml
become: true
when: "'microsoft-standard-WSL2' not in ansible_kernel"
- name: Ensure common packages are installed
ansible.builtin.package:

View File

@@ -27,28 +27,8 @@
vars:
gitconfig_mapping:
mennos-desktop: "$DOTFILES_PATH/config/git/gitconfig.linux"
mennos-laptop: "$DOTFILES_PATH/config/git/gitconfig.linux"
mennos-cosmic-laptop: "$DOTFILES_PATH/config/git/gitconfig.linux"
mennos-laptop-w: "$DOTFILES_PATH/config/git/gitconfig.wsl"
mennos-server: "$DOTFILES_PATH/config/git/gitconfig.mennos-server"
mennos-cloud-server: "$DOTFILES_PATH/config/git/gitconfig.mennos-server"
mennos-vm: "$DOTFILES_PATH/config/git/gitconfig.mennos-server"
mennos-hobbypc: "$DOTFILES_PATH/config/git/gitconfig.linux"
dotfiles-test: "$DOTFILES_PATH/config/git/gitconfig.mennos-server"
- name: Create SSH authorized_keys symlink
ansible.builtin.file:
src: "{{ authorized_keys_mapping[inventory_hostname] | replace('~', user_home) | replace('$DOTFILES_PATH', lookup('env', 'DOTFILES_PATH')) }}"
dest: "{{ user_home }}/.ssh/authorized_keys"
state: link
force: true
follow: false
vars:
authorized_keys_mapping:
mennos-desktop: "$DOTFILES_PATH/config/ssh/authorized_keys/mennos-desktop"
mennos-laptop: "$DOTFILES_PATH/config/ssh/authorized_keys/mennos-laptop"
mennos-cosmic-laptop: "$DOTFILES_PATH/config/ssh/authorized_keys/mennos-laptop"
mennos-server: "$DOTFILES_PATH/config/ssh/authorized_keys/mennos-server"
mennos-cloud-server: "$DOTFILES_PATH/config/ssh/authorized_keys/mennos-server"
mennos-vm: "$DOTFILES_PATH/config/ssh/authorized_keys/mennos-server"
mennos-hobbypc: "$DOTFILES_PATH/config/ssh/authorized_keys/mennos-hobbypc"
dotfiles-test: "$DOTFILES_PATH/config/ssh/authorized_keys/mennos-server"

View File

@@ -6,39 +6,45 @@
- name: Include workstation cliphist tasks
ansible.builtin.import_tasks: tasks/workstations/cliphist.yml
when: "'microsoft-standard-WSL2' not in ansible_kernel"
- name: Include GNOME Extensions tasks
ansible.builtin.import_tasks: tasks/workstations/gnome-extensions.yml
when: ansible_facts.env.XDG_CURRENT_DESKTOP is defined and 'GNOME' in ansible_facts.env.XDG_CURRENT_DESKTOP
when: ansible_facts.env.XDG_CURRENT_DESKTOP is defined and 'GNOME' in ansible_facts.env.XDG_CURRENT_DESKTOP and 'microsoft-standard-WSL2' not in ansible_kernel
- name: Include Firefox APT installation tasks
ansible.builtin.import_tasks: tasks/workstations/firefox-apt.yml
when: ansible_pkg_mgr == 'apt' and ansible_facts.packages.snapd is defined
when: ansible_pkg_mgr == 'apt' and ansible_facts.packages.snapd is defined and 'microsoft-standard-WSL2' not in ansible_kernel
- name: Include flatpaks tasks
ansible.builtin.import_tasks: tasks/workstations/flatpaks.yml
when: "'microsoft-standard-WSL2' not in ansible_kernel"
- name: Include snaps tasks
ansible.builtin.import_tasks: tasks/workstations/snaps.yml
when: ansible_facts.packages.snapd is defined
when: ansible_facts.packages.snapd is defined and 'microsoft-standard-WSL2' not in ansible_kernel
- name: Include Zen browser tasks
ansible.builtin.import_tasks: tasks/workstations/zen-browser.yml
vars:
browser_name: "zen"
browser_executable: "zen"
when: "'microsoft-standard-WSL2' not in ansible_kernel"
- name: Include 1Password Browsers tasks
ansible.builtin.import_tasks: tasks/workstations/1password-browsers.yml
when: "'microsoft-standard-WSL2' not in ansible_kernel"
- name: Include Firefox PWA tasks
ansible.builtin.import_tasks: tasks/workstations/firefoxpwa.yml
when: "'microsoft-standard-WSL2' not in ansible_kernel"
- name: Include purge LibreOffice tasks
ansible.builtin.import_tasks: tasks/workstations/purge-libreoffice.yml
- name: Include autostart tasks
ansible.builtin.import_tasks: tasks/workstations/autostart.yml
when: "'microsoft-standard-WSL2' not in ansible_kernel"
- name: Ensure workstation common packages are installed
ansible.builtin.package:

39
config/git/gitconfig.wsl Normal file
View File

@@ -0,0 +1,39 @@
[user]
signingkey = ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIM+sKpcREOUjwMMSzEWAso6830wbOi8kUxqpuXWw5gHr
email = menno@vleeuwen.me
name = Menno van Leeuwen
[gpg]
format = ssh
[gpg "ssh"]
program = "/mnt/c/Users/menno/AppData/Local/1Password/app/8/op-ssh-sign-wsl"
[commit]
gpgsign = true
[color]
ui = true
[push]
autoSetupRemote = true
[pull]
rebase = false
[filter "lfs"]
process = git-lfs filter-process
required = true
clean = git-lfs clean -- %f
smudge = git-lfs smudge -- %f
[init]
defaultBranch = main
[credential "https://github.com"]
helper =
helper = !/home/menno/.nix-profile/bin/gh auth git-credential
[credential "https://gist.github.com"]
helper =
helper = !/home/menno/.nix-profile/bin/gh auth git-credential
[gpg "ssh"]
program = /opt/1Password/op-ssh-sign

View File

@@ -1,5 +1,23 @@
{
"nodes": {
"flake-utils": {
"inputs": {
"systems": "systems"
},
"locked": {
"lastModified": 1731533236,
"narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
"owner": "numtide",
"repo": "flake-utils",
"rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
"type": "github"
},
"original": {
"owner": "numtide",
"repo": "flake-utils",
"type": "github"
}
},
"home-manager": {
"inputs": {
"nixpkgs": [
@@ -7,11 +25,11 @@
]
},
"locked": {
"lastModified": 1752391422,
"lastModified": 1752544374,
"narHash": "sha256-ReX0NG6nIAEtQQjLqeu1vUU2jjZuMlpymNtb4VQYeus=",
"owner": "nix-community",
"repo": "home-manager",
"rev": "c26266790678863cce8e7460fdbf0d80991b1906",
"rev": "2e00ed310c218127e02ffcf28ddd4e0f669fde3e",
"type": "github"
},
"original": {
@@ -23,11 +41,11 @@
},
"nixpkgs": {
"locked": {
"lastModified": 1752308619,
"narHash": "sha256-pzrVLKRQNPrii06Rm09Q0i0dq3wt2t2pciT/GNq5EZQ=",
"lastModified": 1752436162,
"narHash": "sha256-Kt1UIPi7kZqkSc5HVj6UY5YLHHEzPBkgpNUByuyxtlw=",
"owner": "nixos",
"repo": "nixpkgs",
"rev": "650e572363c091045cdbc5b36b0f4c1f614d3058",
"rev": "dfcd5b901dbab46c9c6e80b265648481aafb01f8",
"type": "github"
},
"original": {
@@ -39,11 +57,11 @@
},
"nixpkgs-unstable": {
"locked": {
"lastModified": 1751984180,
"narHash": "sha256-LwWRsENAZJKUdD3SpLluwDmdXY9F45ZEgCb0X+xgOL0=",
"lastModified": 1752480373,
"narHash": "sha256-JHQbm+OcGp32wAsXTE/FLYGNpb+4GLi5oTvCxwSoBOA=",
"owner": "nixos",
"repo": "nixpkgs",
"rev": "9807714d6944a957c2e036f84b0ff8caf9930bc0",
"rev": "62e0f05ede1da0d54515d4ea8ce9c733f12d9f08",
"type": "github"
},
"original": {
@@ -53,11 +71,62 @@
"type": "github"
}
},
"nixpkgs_2": {
"locked": {
"lastModified": 1751011381,
"narHash": "sha256-krGXKxvkBhnrSC/kGBmg5MyupUUT5R6IBCLEzx9jhMM=",
"owner": "NixOS",
"repo": "nixpkgs",
"rev": "30e2e2857ba47844aa71991daa6ed1fc678bcbb7",
"type": "github"
},
"original": {
"owner": "NixOS",
"ref": "nixos-unstable",
"repo": "nixpkgs",
"type": "github"
}
},
"opnix": {
"inputs": {
"flake-utils": "flake-utils",
"nixpkgs": "nixpkgs_2"
},
"locked": {
"lastModified": 1751283143,
"narHash": "sha256-I3DMLT0qg5xxjS7BrmOBIK6pG+vZqOhKivEGnkDIli8=",
"owner": "brizzbuzz",
"repo": "opnix",
"rev": "1a807befe8f418da0df24c54b9633c395d840d0e",
"type": "github"
},
"original": {
"owner": "brizzbuzz",
"repo": "opnix",
"type": "github"
}
},
"root": {
"inputs": {
"home-manager": "home-manager",
"nixpkgs": "nixpkgs",
"nixpkgs-unstable": "nixpkgs-unstable"
"nixpkgs-unstable": "nixpkgs-unstable",
"opnix": "opnix"
}
},
"systems": {
"locked": {
"lastModified": 1681028828,
"narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
"owner": "nix-systems",
"repo": "default",
"rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
"type": "github"
},
"original": {
"owner": "nix-systems",
"repo": "default",
"type": "github"
}
}
},

View File

@@ -9,6 +9,7 @@
url = "github:nix-community/home-manager/release-25.05";
inputs.nixpkgs.follows = "nixpkgs";
};
opnix.url = "github:brizzbuzz/opnix";
};
outputs =
@@ -17,6 +18,7 @@
nixpkgs,
nixpkgs-unstable,
home-manager,
opnix,
}:
let
system = if builtins.currentSystem == "aarch64-linux" then "aarch64-linux" else "x86_64-linux";
@@ -38,6 +40,7 @@
inherit
pkgs
pkgs-unstable
opnix
;
isServer = false;
hostname = "mennos-gamingpc";
@@ -51,6 +54,7 @@
inherit
pkgs
pkgs-unstable
opnix
;
isServer = true;
hostname = "mennos-server";
@@ -64,6 +68,7 @@
inherit
pkgs
pkgs-unstable
opnix
;
isServer = true;
hostname = "dotfiles-test";
@@ -77,6 +82,7 @@
inherit
pkgs
pkgs-unstable
opnix
;
isServer = true;
hostname = "mennos-cloud-server";
@@ -90,45 +96,24 @@
inherit
pkgs
pkgs-unstable
opnix
;
isServer = true;
hostname = "mennos-vm";
};
};
"mennos-laptop" = home-manager.lib.homeManagerConfiguration {
"mennos-laptop-w" = home-manager.lib.homeManagerConfiguration {
inherit pkgs;
modules = [ ./home.nix ];
extraSpecialArgs = {
inherit
pkgs
pkgs-unstable
opnix
;
isServer = false;
hostname = "mennos-laptop";
};
};
"mennos-cosmic-laptop" = home-manager.lib.homeManagerConfiguration {
inherit pkgs;
modules = [ ./home.nix ];
extraSpecialArgs = {
inherit
pkgs
pkgs-unstable
;
isServer = false;
hostname = "mennos-cosmic-laptop";
};
};
"mennos-hobbypc" = home-manager.lib.homeManagerConfiguration {
inherit pkgs;
modules = [ ./home.nix ];
extraSpecialArgs = {
inherit pkgs pkgs-unstable;
isServer = true;
hostname = "mennos-hobbypc";
hostname = "mennos-laptop-w";
};
};
};

View File

@@ -1,6 +1,7 @@
{
config,
isServer ? false,
opnix,
...
}:
@@ -13,7 +14,7 @@
};
imports =
[ ./packages/common/default.nix ]
[ opnix.homeManagerModules.default ./packages/common/default.nix ]
++ (
if isServer then
[
@@ -35,4 +36,5 @@
PATH = "${config.home.homeDirectory}/go/bin:$PATH";
};
};
}

View File

@@ -1,4 +0,0 @@
{ pkgs-unstable, ... }:
{
home.packages = with pkgs-unstable; [ ];
}

View File

@@ -9,8 +9,8 @@
imports =
if hostname == "mennos-gamingpc" then
[ ./hosts/mennos-gamingpc.nix ]
else if hostname == "mennos-laptop" then
[ ./hosts/mennos-laptop.nix ]
else if hostname == "mennos-laptop-w" then
[ ./hosts/mennos-laptop-w.nix ]
else if hostname == "mennos-server" then
[ ./hosts/mennos-server.nix ]
else if hostname == "dotfiles-test" then
@@ -33,6 +33,7 @@
nixfmt-rfc-style
wget
fastfetch
_1password-cli
# Package management
devbox

View File

@@ -0,0 +1,29 @@
{ config, hostname, ... }:
{
config.programs.onepassword-secrets = {
enable = true;
tokenFile = "${config.home.homeDirectory}/.op_sat";
secrets = {
mennos2025Pem = {
reference = "op://Dotfiles/Fallback SSH Key/private key";
path = ".ssh/mennos-2025.pem";
mode = "0600";
};
mennos2025Pub = {
reference = "op://Dotfiles/Fallback SSH Key/public key";
path = ".ssh/mennos-2025.pub";
mode = "0644";
};
workWgVPn = {
reference = "op://Dotfiles/Wireguard VPN Config/config";
path = ".config/wireguard/work-vpn.conf";
mode = "0600";
};
authorizedKeysForHost = {
reference = "op://Dotfiles/Authorized Keys/${hostname}";
path = ".ssh/authorized_keys";
mode = "0644";
};
};
};
}

View File

@@ -2,8 +2,5 @@
{
home.packages = with pkgs; [
ddrescue
# 1Password CLI
_1password-cli
];
}

View File

@@ -2,14 +2,10 @@
{
fonts.fontconfig.enable = true;
home.packages = [
(pkgs.nerdfonts.override {
fonts = [
"Hack"
"FiraCode"
"Meslo"
"FiraCode"
"DroidSansMono"
];
})
pkgs.nerd-fonts.hack
pkgs.nerd-fonts.fira-code
pkgs.nerd-fonts.fira-mono
pkgs.nerd-fonts.meslo-lg
pkgs.nerd-fonts.droid-sans-mono
];
}

View File

@@ -1,8 +0,0 @@
# This is the authrorized_keys file for the user mennos-laptop
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIM+sKpcREOUjwMMSzEWAso6830wbOi8kUxqpuXWw5gHr
# Samsung S24U
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMSJwfqOZQxGDbM07JziQeBNirvQxhFd6nEwWPjy1zCo u0_a555@localhost
# Menno's 2025 SSH Key
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIE22Hfx8wgkc57TXX1TCMHcNrCdjbfog5QeHFJfl7IeD menno_fallback

View File

@@ -1,8 +0,0 @@
# This is the authrorized_keys file for the user mennos-laptop
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIM+sKpcREOUjwMMSzEWAso6830wbOi8kUxqpuXWw5gHr
# Samsung S24U
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMSJwfqOZQxGDbM07JziQeBNirvQxhFd6nEwWPjy1zCo u0_a555@localhost
# Menno's 2025 SSH Key
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIE22Hfx8wgkc57TXX1TCMHcNrCdjbfog5QeHFJfl7IeD menno_fallback

View File

@@ -1,8 +0,0 @@
# This is the authrorized_keys file for the user mennos-laptop
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIM+sKpcREOUjwMMSzEWAso6830wbOi8kUxqpuXWw5gHr
# Samsung S24U
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMSJwfqOZQxGDbM07JziQeBNirvQxhFd6nEwWPjy1zCo u0_a555@localhost
# Menno's 2025 SSH Key
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIE22Hfx8wgkc57TXX1TCMHcNrCdjbfog5QeHFJfl7IeD menno_fallback

View File

@@ -1,11 +0,0 @@
# This is the authrorized_keys file for the user mennos-laptop
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIM+sKpcREOUjwMMSzEWAso6830wbOi8kUxqpuXWw5gHr
# Samsung S24U
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMSJwfqOZQxGDbM07JziQeBNirvQxhFd6nEwWPjy1zCo u0_a555@localhost
# Menno's 2025 SSH Key
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIE22Hfx8wgkc57TXX1TCMHcNrCdjbfog5QeHFJfl7IeD menno_fallback
# Menno's Server (rsync mostly)
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMwyFxs+Zva2W2Viu9dzznFR9CfsiRWM1gxxvD5FUhfb menno@mennos-server

View File

@@ -1,5 +1,5 @@
Host *
IdentityFile ~/.dotfiles/secrets/ssh_keys/mennos-2025.pem
IdentityFile ~/.ssh/mennos-2025.pem
IdentityAgent ~/.1password/agent.sock
AddKeysToAgent yes
ForwardAgent yes

View File

@@ -1,14 +0,0 @@
-----BEGIN PGP MESSAGE-----
jA0ECQMI552H37TRBAb/0sDqAXEjXr4FQoiibIvZJnQrjipoIK0WKbAUqSSGkpGJ
m3yy6Mh8WRH8tCu6Q3HV9FR4BhP0QkgmcXCk6fgsRft+qW7lWmS4urfScDTyifd3
L+rNRxQPE1RE2NntIL5dnOkU5uHQv87sWo+G9ffoY8zy0ConxFItzzbVj/wwu9Yr
ZVeHCvZMuKMzcfMnCIVPxJ1Fy0iwN9BjPw1ykASM7ZFBl/RMzqp89gnByDu25Xnq
aAda9jjW31Ly3B+Lb3lZKTnA1mTFIPhgXo/e7Q4u4em18biGShCB5CcV0/H6pNii
uODLAFSlTceloz34pFxfRRtfEJ7bk+4tRtG717KxWKsGktHGGIaISlMa4Oh6O9gx
zGeytZOFE3AlJmGhVDy16RpN6QRGUHjaygx7/EQ23t6ELeUi7KxgXZw3bv+n2FVG
g9Mz56qbA8bmLBC+7DFmlme38cg8t7t7d22oSDG5eaWDFh/K0IK/iks9uH/Yq7xM
7i8l8TWUhnrMw+VxPnUs2cviKwSByru/UgOQ9fpLotEGo5fougdICOlHKZfcdS5+
MmAGJ+J46mxQm6Na
=+p8L
-----END PGP MESSAGE-----

View File

@@ -1,8 +0,0 @@
-----BEGIN PGP MESSAGE-----
jA0ECQMIdfWQMldX4v3/0p0B/9DHZ452kh/ofRO2mYobq97VZZmm2yK+EGK6eoIA
rH7LsRt12iMtlCCwPxiwTQtuiQCEbIwpYKFk3+7dW3NlXjbP09H+YTR46yJwJNDF
9YdC9eERU18e4ut8+F3pJIKS84GmDuw7CBAaTQcdI2NbF0HP1yPACquPe+ZZsgcI
l8/yMhjcCwducCWHtQDmikx43MWsz4GN+hbKwhsk
=OG1d
-----END PGP MESSAGE-----

View File

@@ -1,12 +0,0 @@
-----BEGIN PGP MESSAGE-----
jA0ECQMINhVMB5bJU2v/0sCUAd22Gs1svmVsc3JLiH/uB7wOoW1tQdWdlznfGkft
wmuOUyZ92LO9PkQ5x6i2BgBOLszNTVbjGaH8hYhGHdSG+LKXX42TQT+E+m9PdHTW
FbeFd1hPvsfWvKAzTpPK3kv49erYnX4qd2nwx8jg9RJ1u8m8Y+1kvxAtBqEK0jlE
SUfEjT4pJVahprzl3bZgTyW03fZgoNGvAl1mpz3m0ni4Q3/C7N+IBikrnd7BXM3U
CTnLcLM7iFzHQ+FSDsNEDeZqoGEg9/Qzg61FS4VpbA8Sljev+zs/ArjUG92HZsET
XFwmW//CVF6kP8EcrNXZvtUvv0SRorKPPMEZF+JaJvMf8nTcU7j9mSOU6Jd01UJ0
+msltfdMnFQkRl9A2Hf/qO7ghfOXxCnmZaElRjFhiK76cNjVngRf58pS1X5lpaab
TCuGQKAUOGWeZJiMLLsnVMmRHtnv/Q==
=Ojnm
-----END PGP MESSAGE-----

View File

@@ -51,7 +51,7 @@
"editor.wordBasedSuggestions": "off"
},
"remote.SSH.remotePlatform": {
"mennos-laptop": "linux",
"mennos-laptop-w": "linux",
"mennos-desktop": "linux",
"cloud": "linux"
},