updates

2026-09-22 21:44:35 +02:00
1 parent f164d8b76e
commit 5748b3409b
@@ -0,0 +1,132 @@
+{ inputs, ... }:
+{
+  flake.modules.homeManager.workbench =
+    {
+      config,
+      lib,
+      pkgs,
+      ...
+    }:
+    let
+      home = config.home.homeDirectory;
+      root = "${home}/yookr/workbench";
+      companySecrets = "${home}/.config/nixos/modules/secrets/company.yaml";
+      environmentInputs = builtins.toJSON {
+        inputs = {
+          nixpkgs.url = "path:${inputs.nixpkgs}";
+          git-hooks.url = "path:${inputs.devenv.inputs.git-hooks}";
+        };
+      };
+      secretsManifest = (pkgs.formats.toml { }).generate "workbench-secrets.toml" {
+        project = {
+          name = "workbench";
+          revision = "1";
+        };
+        providers.company = "sops://${companySecrets}?age_key_file=/var/lib/sops/keys.txt";
+        profiles =
+          lib.mapAttrs
+            (
+              _: names:
+              lib.genAttrs names (name: {
+                description = name;
+                ref.item = name;
+                providers = [ "company" ];
+              })
+            )
+            {
+              company = [
+                "email"
+                "password"
+              ];
+              live = [
+                "YOOKR_MYSQL_LIVE_DATABASE_URL"
+                "YOOKR_MONGODB_LIVE_DATABASE_URL"
+              ];
+            };
+      };
+      mountObs = pkgs.writeShellApplication {
+        name = "mount-company-obs";
+        runtimeInputs = [
+          pkgs.python3
+          pkgs.rclone
+          pkgs.sops
+        ];
+        text = ''
+          export PATH=/run/wrappers/bin:"$PATH"
+          exec python3 ${./mount-obs.py} ${lib.escapeShellArg companySecrets} ${lib.escapeShellArg "${root}/obs"}
+        '';
+      };
+      mountSharepoint = pkgs.writeShellApplication {
+        name = "mount-company-sharepoint";
+        runtimeInputs = [
+          pkgs.rclone
+          pkgs.coreutils
+        ];
+        text = ''
+          export PATH=/run/wrappers/bin:"$PATH"
+          mkdir -p ${lib.escapeShellArg "${root}/sharepoint"}
+          export RCLONE_CONFIG_SHAREPOINT_TYPE=combine
+          export RCLONE_CONFIG_SHAREPOINT_UPSTREAMS='Algemeen=company-sharepoint: Projecten=company-sharepoint-projecten:'
+          exec rclone mount sharepoint: ${lib.escapeShellArg "${root}/sharepoint"} \
+            --config ${lib.escapeShellArg "${config.xdg.configHome}/rclone/rclone.conf"} \
+            --read-only --vfs-cache-mode off --buffer-size 8M
+        '';
+      };
+      mountService = name: command: {
+        Unit = {
+          Description = "Read-only company ${name} mount";
+          After = [ "network-online.target" ];
+          StartLimitIntervalSec = 0;
+        };
+        Service = {
+          Type = "simple";
+          ExecStart = lib.getExe command;
+          ExecStop = "/run/wrappers/bin/fusermount3 -u ${root}/${name}";
+          Environment = "SOPS_AGE_KEY_FILE=/var/lib/sops/keys.txt";
+          UMask = "0077";
+          Restart = "on-failure";
+          RestartSec = 60;
+        };
+        Install.WantedBy = [ "default.target" ];
+      };
+    in
+    {
+      # devenv already installs its bundled SecretSpec CLI in the workstation profile.
+      home.packages =
+        lib.remove pkgs.secretspec (import ./_support/tools.nix { inherit pkgs; }).packages;
+      programs.zsh.initContent = lib.mkAfter ''
+        workbench-reload() {
+          if [[ "''${DEVENV_ROOT:-}" != ${lib.escapeShellArg root} ]]; then
+            print -u2 'Enter the workbench devenv shell before loading credentials.'
+            return 1
+          fi
+          local exports
+          exports="$(${pkgs.python3}/bin/python3 ${./load-secrets.py} ${secretsManifest} "$@")" || return
+          eval "$exports"
+        }
+      '';
+
+      home.file."yookr/workbench/devenv.yaml".text = environmentInputs;
+      home.file."yookr/workbench/devenv.nix".text = ''
+        { pkgs, ... }:
+        let tools = import ${./_support/tools.nix} {
+          inherit pkgs;
+          garden = import ${../yookr-dev/_support/packages.nix} { inherit pkgs; };
+        };
+        in {
+          inherit (tools) packages env;
+          enterShell = ${lib.strings.escapeNixString ''
+            if [ "''${WORKBENCH_TOOLS_ONLY:-0}" = 1 ]; then
+              eval "$(python3 ${./load-secrets.py} ${secretsManifest} --tools-only)"
+            else
+              eval "$(python3 ${./load-secrets.py} ${secretsManifest})"
+            fi
+          ''};
+        }
+      '';
+      systemd.user.services = {
+        company-obs = mountService "obs" mountObs;
+        company-sharepoint = mountService "sharepoint" mountSharepoint;
+      };
+    };
+}