Nix configurations for my homelab

Setup syncthing for syncing files between servers

Changed files
+135 -15
dandelion
hidden
modules
packages
buildConfig
services
caddy
secrets
+6
.sops.yaml
···
- *dandelion
- *lily
- *lutea
+
- path_regex: hidden/syncthing.json$
+
key_groups:
+
- age:
+
- *dandelion
+
- *lily
+
- *lutea
- path_regex: secrets/dali.yaml$
key_groups:
- age:
+1
dandelion/config.nix
···
../modules/nix.nix
../modules/remote-build-machines.nix
../modules/sss.nix
+
../modules/syncthing.nix
../modules/services/caddy
../modules/services/caddy/atproto-did.nix
+28
hidden/syncthing.json
···
+
{
+
"dandelion": {
+
"device-id": "ENC[AES256_GCM,data:9cQ0UcJPHf3cWT6ABbSGA7yXjFx259lY88ZNbwwJjzMLF2fg/O5wU3qV9zbhhvClTkOepDSYKT1vSSGUT2U6,iv:evUyvt0VfnE/7KWGjI5cwmf7sIODuU/xfozAJJV3qIk=,tag:oYZlKJuRDoEh6vzGJFkpNA==,type:str]"
+
},
+
"lily": {
+
"device-id": "ENC[AES256_GCM,data:QBoqthsC94CjSh5ZnmtkMJjdHVaNeop/rCfraEPMh4nGUqpy3PS2vRmPu3OfK4Avw02y3EPyoP8plqBXBRbc,iv:ZDCCequtiX9Bk0NF3hP4h/GGkbu6sBSKCXOFIcL3U/E=,tag:XZqzbasSBWo472YPIugklA==,type:str]"
+
},
+
"sops": {
+
"age": [
+
{
+
"recipient": "age1p5y7px4qnlgxgxd6j5vg4wtpzs24fnh4808ws7gah3x89j66muasxz7ck2",
+
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWa0JpcEhYTytSZEFMWnMr\nRXo1TGozd0o5MUpIZ2kyTXFneWszRVRoMVd3CkJYOUZhRzR5b3kzbmxHcVByalFP\nRzJlMG0yQjNYVHEydDAvQ2dvSUZwR2sKLS0tIGU3OFRYdml5YmNyK0hzZFRmWnpJ\nTGdnUW9MUTVBRmRSSVplMHVKSUUyVUkKt/qajgJ2+CSZexX9Syzpzuowl36Otk+F\nXOlD3LUEIciza6sCsTuIi6PSAt1Ro6GgSw128AegO2YUG3zEe5DFGA==\n-----END AGE ENCRYPTED FILE-----\n"
+
},
+
{
+
"recipient": "age1amaa55e7nusv904a9ucfvtnjlw4srtet42suehey6u3yc4t2xc5sdldepj",
+
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBUWE5aNkxFOE1ZdXRTNTVv\naXJmSkU4YXJ1SUQxQkZNQW1EWHFaR1dScGtRClhGc2VLUFA5T1NlMFMvU1VveC93\nb1AzSHNDVXNtMldHczQ4TG85dEV5dmMKLS0tIGh0SFdwbktxR25Ja2s0dTJaTnlM\nczZhTDhzWTNpRnQ3ZVhHQWtWbXpCWE0KEg9F/2NVATX1pQjmC1cNmJAtqVsIOhtl\n8jU2FuaBwukrlB92iAsJIgi0YTLiEC/y6KRLXfBW7Qmf1ePnvrqstw==\n-----END AGE ENCRYPTED FILE-----\n"
+
},
+
{
+
"recipient": "age1p55em5e3uk3fprj2mpum7ulrslcqgly63pjsyw2yv6hx99trdsnsvvv9ex",
+
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAzT3g4cXowbyt6UXZJa0Uw\nU2JmQWFFOGNGekcrcDVIWWM5azVnTHdnYUVjCnpXMmV3RXNQei9XaTcvamVDWlhR\neFZYbC9qM2dJS21UbHFaSnE2TXpUSjgKLS0tIDlDRzBaTjFQVXRsVXFXWng2VExu\nZUNzaVdnSG9qaE93cHNvZHg4OHJEaFEKBZ4+MAMbzu49WZfac0m0rvBGwjN5WKge\ncz0/GqBOjcHzOo1Bc0UkM4SMjD/7l7cUZxLw8IO1LiTx4kJgxk7OZw==\n-----END AGE ENCRYPTED FILE-----\n"
+
}
+
],
+
"lastmodified": "2025-05-14T11:07:45Z",
+
"mac": "ENC[AES256_GCM,data:NyH9pU3bAxOgeXxGOeGXGgchUZ4pNINVBznzCMv1WsfeIRORh/w7VmsflqPFZxkbE/XKtmPZG+wFB9QQaUcCIQB9SW1fqlnlpygHFpTcAjqz+gfGFYRtFmNKAaveuLYpA02wluXxSHZCzRW8JgqVVjyMsEBm5ifm8sq7NrtJt8k=,iv:Yq2LW3b1EKQtIFB/eUuOtuiEX6F7yZe2ZE7uCbreImY=,tag:jQxspW81i4Ysm8cnuaKYAA==,type:str]",
+
"unencrypted_suffix": "_unencrypted",
+
"version": "3.10.2"
+
}
+
}
+3 -7
modules/packages/buildConfig/buildConfig.sh
···
done
)
-
[ -e "$temp_dir/hidden/network.json" ] || {
-
printf '%s\n' "/config/hidden/network.json is not yet staged"
-
exit 1
-
}
-
-
SOPS_AGE_KEY_FILE=${SOPS_AGE_KEY_FILE:=/data/keys.txt} \
-
sops decrypt --in-place "$temp_dir/hidden/network.json"
+
for json in "$temp_dir/hidden/"*".json"
+
do SOPS_AGE_KEY_FILE=${SOPS_AGE_KEY_FILE:=/data/keys.txt} sops decrypt --in-place "$json"
+
done
nixos-rebuild switch --flake "$temp_dir#$hostname" "$@"
rm -r "$temp_dir"
+8
modules/services/caddy/default.nix
···
443
];
+
users.users.syncthing.extraGroups = [ "caddy" ];
+
services.syncthing.settings.folders.caddy-certs = {
+
enable = true;
+
path = "/var/lib/caddy/.local/share/caddy/certificates";
+
devices = [ "lily" ];
+
type = "sendonly";
+
};
+
services.caddy = {
enable = true;
email = "acme@mou.pink";
+83
modules/syncthing.nix
···
+
{ config, lib, ... }:
+
{
+
options.garden.info.syncthing = lib.mkOption {
+
description = "Information about the syncthing network";
+
type =
+
with lib.types;
+
attrsOf (
+
submodule (
+
{ name, ... }:
+
{
+
options = {
+
name = lib.mkOption {
+
type = str;
+
description = "Name of the device";
+
};
+
device-id = lib.mkOption {
+
type = str;
+
description = "Syncthing ID for the device";
+
};
+
};
+
+
config.name = name;
+
}
+
)
+
);
+
};
+
+
config = {
+
garden.info.syncthing = builtins.fromJSON (builtins.readFile ../hidden/syncthing.json);
+
+
sops.secrets = {
+
"syncthing/cert" = { };
+
"syncthing/key" = { };
+
};
+
+
networking.firewall.interfaces.${config.services.netbird.clients.homelab.interface} = {
+
allowedTCPPorts = [ 22000 ];
+
allowedUDPPorts = [ 22000 ];
+
};
+
+
services.syncthing = {
+
enable = true;
+
cert = config.sops.secrets."syncthing/cert".path;
+
key = config.sops.secrets."syncthing/key".path;
+
overrideFolders = true;
+
overrideDevices = true;
+
settings = {
+
devices =
+
if (config.networking.hostName == "dandelion") then
+
{
+
"lily" = {
+
id = config.garden.info.syncthing.lily.device-id;
+
addresses = [
+
"tcp://${config.garden.info.network.lily.netbird-ip}"
+
"quic://${config.garden.info.network.lily.netbird-ip}"
+
];
+
};
+
}
+
else if (config.networking.hostName == "lily") then
+
{
+
"dandelion" = {
+
id = config.garden.info.syncthing.dandelion.device-id;
+
addresses = [
+
"tcp://${config.garden.info.network.dandelion.netbird-ip}"
+
"quic://${config.garden.info.network.dandelion.netbird-ip}"
+
];
+
};
+
}
+
# Unknown device
+
else
+
{ };
+
options = {
+
urAccepted = -1;
+
relaysEnabled = false;
+
globalAnnounceEnabled = false;
+
localAnnounceEnabled = false;
+
startBrowser = false;
+
stunServer = "butwho.org:3478";
+
};
+
};
+
};
+
};
+
}
+6 -8
secrets/dandelion.yaml
···
passwordHashes:
root: ENC[AES256_GCM,data:Sd7brLDa9QLKBUrPMPMDDMG1rZc1jklLXjDprhK/X27ZPg/T6hDFvfc0buWoY8Rbidw9WoT3oA8Me9SQF6U70Mr1HNUHYlT2zA==,iv:1z2SgWdghTk5dp+OCWdj1h5KWMXgO8gjDKoG1FljMy8=,tag:T4nkg2jJudq8JOsf8w06zA==,type:str]
mou: ENC[AES256_GCM,data:xKNnwWsLSh41U7n8aGa7kkO8ylo2hcCpuZ7tptZKm132eyH5rUk1poVqqqoxQSMdiWQKrTlLAXZuQJM/lG9xr62Yfvy4mhz1sA==,iv:UL1+u/Beilym5sL5AeqVky/o7q332Hm0nDJ9CJ1lVec=,tag:LuO4dqTERugIap6oOsNokA==,type:str]
+
syncthing:
+
cert: ENC[AES256_GCM,data:o7yV7nSqMKqpJ5zZ9s6CmQYgm4L8KyntdlJ2gQedmSocR3UYjkwJkQflrEORiTOJR6DJGjdyFhg37k8cfNApIK2aDyVD8pKbH6iUcFF0asg+aUlkr0X6MZh6B+NAOfz1qHpFDrE8hbn2rqMNC1+eanV85ROYVrEuWNDo1u4G1jLhRzqi4gzKNCOl0D6+3ol8sgkaZAPtRO0IBh3UUmgrGwmVGQMyavpS2tcqlJ3E6icjSWepX0UzRYUBmSermQeIZDO5W+BpU4hkmrPfWrMGeEWEumIBPxxLuWHMoossOq10NVJ6FjS5z9ud2AwXMngWZ5p9p6+f1azWqSp6cLh8rD03ZnfztJQw9/J/nEsF9O1OqDRIG1uhEOD7URrvhRl51hDbwOm6lFNonmbKFi2JUyxKLK/uVQABx7zsslcGuCU/xPgi3XFngYgYwnj9rNAfD+ImaogPmIW7XMU/NTgG/P3+9eMjR0XEzeZXMT0MVk/RT3+XWzOjTePCC7fOUCoAcN0CFT3vx/HsOLX/h4HpLLVmqz9u7qjG3/6GcNA2NRx9AOkjsLd8BcTzoTfwX/hYrQXpMyOHIjmI1Y29bWEmeecbiz+kZpnI0BsXYpCICqvPGxoMQo/T3hYDLdTDIAmtsUTgqjPbudGKeM/fxjDY8kOpmcOjf2GEBGLfe8w500vb/QYlbALXD+PpuwQgS6sPtsXdEnw7d5Sw6+9AEPPGzeTe6U2xONS6H+aTwpfWqS1RwwJCXZpc9sP5I4AQzaVUk/j6uLmyOKGwXdbt+T5G7yUD/PRnYPriDi4ruKj5jtHEEAQdhDLnUqCZGfX+3/qwB9BTyQdx13bNaYmOPrkfy9MY4mMoBVnkk1M3wFtv+XTXKMkDk2CbRPH2t7ifnkVxKYWnwWSdGR4MC+1VC7YvutMZB5/pE26BA685IVGxNjyQ/cF0x0Bw3To5ft4edS/89V3k46ty9XTnjDsPJZwrj+SJ586EzX9Pzlo9s4zCW7xjry7OxB81ZMLlI6WOivd2umZNomL2hl/ld0sFEkl2CIiQahBDA/l2HA==,iv:GGQrllOl1zM3euq+Lffq/BrEM+D/Xso2AfKBGMDSPIk=,tag:PYp0THpNq9ZQhxmrB/WNyw==,type:str]
+
key: ENC[AES256_GCM,data:PsOpgifBULla8rCdxFPzujl0YHYY8s+r/Pd7GYMZqe+Jybni9roHlVsfqGChBPBvvHhE4EDFGo+vfncjGGUjlhGGIIuJstyepoYaU7k2t480NdJ5j1lDH/ualuzD4Vvvo3gqRS9SMYxes1bKOP9a8PJ1m1zEcBCH6qn4DvI0yqsZhf53km46b/EBTZjeLrt/p0tSM6WdRP8wArDsn3Myb15bwVF4Qs4oPlS5Dm8K+dYbksphxe/Exod0b2ZRIiDuSF6bLwdM6nEBC46oF7qUsD/3XpzmmbRCGY/3UrbOzRhyuhDB4ze3baEjeNwJQVzgBsJMSE8bX7vDcWGBD3S/hqSrp3BCrnKTN38Dw+y4baaMSpIAsQx7Wy3Q2GCBorg=,iv:5OrV6odFEreWrUjczCGI4r2kUuG+FumqqiybeAeoV2c=,tag:+DXZ/0RcoqeIbew3S/MDXA==,type:str]
sops:
-
kms: []
-
gcp_kms: []
-
azure_kv: []
-
hc_vault: []
age:
- recipient: age1p5y7px4qnlgxgxd6j5vg4wtpzs24fnh4808ws7gah3x89j66muasxz7ck2
enc: |
···
bFpBYWRMYi9wcXlvSkExNVEzNldMZ2MKSfrbClrpiSz4ZPlScIY3EpTyZMa9aiaY
6UhOvLwesOKm7TCFyKbSR+xFmro6kOCt0VpcxXtRBQ6Je0bo6HvuSA==
-----END AGE ENCRYPTED FILE-----
-
lastmodified: "2024-10-27T22:06:02Z"
-
mac: ENC[AES256_GCM,data:c9wPpSRqCDEKw+wUjjJrHhYCOedZz8mJuGrGLlDcJ4SPHudqCBM2hmYEGWoGpape/8CtmayLI6x3/xkA/SzgRFQaFQHG3oOh3smrLXEo1ir7NCVVL8+xnRmQPBbrP6tTkOYb4d21ogeMXRnBwXxypf+YN5r7E6+GIyd/plx5usc=,iv:I+SA27LuHAvI1uysVeKBJDrCI6V0voAiexNnwAYNiUs=,tag:R3GU6Kf/GalOcLBLnhDbhA==,type:str]
-
pgp: []
+
lastmodified: "2025-05-14T10:44:55Z"
+
mac: ENC[AES256_GCM,data:iUYApCuh0T3vzhn4oebX1NaGgMsQF+U7q3mSdx5/IAPLxnv2++0w1+hZ3Yv4S8ij1OyL9sAedOsEt/3kCwXf3GblxofstbTO0srhQRvRjF16URmzjGj18ts8OdDDSUWdwRktGYEqlDeGetA75KAo/S2Zewx72MJCq0mOLyIqH8A=,iv:Mn+qTHaVQDFDbrykVUmPkjPjjfTXWoTZ0IF3KOskC6g=,tag:E5bO9sIsomAPfEB3PWziKQ==,type:str]
unencrypted_suffix: _unencrypted
-
version: 3.9.1
+
version: 3.10.2