132 lines
4.4 KiB
Nix
132 lines
4.4 KiB
Nix
{ inputs, ... }:
|
|
{
|
|
flake.modules.homeManager.workbench =
|
|
{
|
|
config,
|
|
lib,
|
|
pkgs,
|
|
...
|
|
}:
|
|
let
|
|
home = config.home.homeDirectory;
|
|
root = "${home}/yookr/workbench";
|
|
companySecrets = "${home}/.config/nixos/modules/secrets/company.yaml";
|
|
environmentInputs = builtins.toJSON {
|
|
inputs = {
|
|
nixpkgs.url = "path:${inputs.nixpkgs}";
|
|
git-hooks.url = "path:${inputs.devenv.inputs.git-hooks}";
|
|
};
|
|
};
|
|
secretsManifest = (pkgs.formats.toml { }).generate "workbench-secrets.toml" {
|
|
project = {
|
|
name = "workbench";
|
|
revision = "1";
|
|
};
|
|
providers.company = "sops://${companySecrets}?age_key_file=/var/lib/sops/keys.txt";
|
|
profiles =
|
|
lib.mapAttrs
|
|
(
|
|
_: names:
|
|
lib.genAttrs names (name: {
|
|
description = name;
|
|
ref.item = name;
|
|
providers = [ "company" ];
|
|
})
|
|
)
|
|
{
|
|
company = [
|
|
"email"
|
|
"password"
|
|
];
|
|
live = [
|
|
"YOOKR_MYSQL_LIVE_DATABASE_URL"
|
|
"YOOKR_MONGODB_LIVE_DATABASE_URL"
|
|
];
|
|
};
|
|
};
|
|
mountObs = pkgs.writeShellApplication {
|
|
name = "mount-company-obs";
|
|
runtimeInputs = [
|
|
pkgs.python3
|
|
pkgs.rclone
|
|
pkgs.sops
|
|
];
|
|
text = ''
|
|
export PATH=/run/wrappers/bin:"$PATH"
|
|
exec python3 ${./mount-obs.py} ${lib.escapeShellArg companySecrets} ${lib.escapeShellArg "${root}/obs"}
|
|
'';
|
|
};
|
|
mountSharepoint = pkgs.writeShellApplication {
|
|
name = "mount-company-sharepoint";
|
|
runtimeInputs = [
|
|
pkgs.rclone
|
|
pkgs.coreutils
|
|
];
|
|
text = ''
|
|
export PATH=/run/wrappers/bin:"$PATH"
|
|
mkdir -p ${lib.escapeShellArg "${root}/sharepoint"}
|
|
export RCLONE_CONFIG_SHAREPOINT_TYPE=combine
|
|
export RCLONE_CONFIG_SHAREPOINT_UPSTREAMS='Algemeen=company-sharepoint: Projecten=company-sharepoint-projecten:'
|
|
exec rclone mount sharepoint: ${lib.escapeShellArg "${root}/sharepoint"} \
|
|
--config ${lib.escapeShellArg "${config.xdg.configHome}/rclone/rclone.conf"} \
|
|
--read-only --vfs-cache-mode off --buffer-size 8M
|
|
'';
|
|
};
|
|
mountService = name: command: {
|
|
Unit = {
|
|
Description = "Read-only company ${name} mount";
|
|
After = [ "network-online.target" ];
|
|
StartLimitIntervalSec = 0;
|
|
};
|
|
Service = {
|
|
Type = "simple";
|
|
ExecStart = lib.getExe command;
|
|
ExecStop = "/run/wrappers/bin/fusermount3 -u ${root}/${name}";
|
|
Environment = "SOPS_AGE_KEY_FILE=/var/lib/sops/keys.txt";
|
|
UMask = "0077";
|
|
Restart = "on-failure";
|
|
RestartSec = 60;
|
|
};
|
|
Install.WantedBy = [ "default.target" ];
|
|
};
|
|
in
|
|
{
|
|
# devenv already installs its bundled SecretSpec CLI in the workstation profile.
|
|
home.packages = lib.remove pkgs.secretspec (import ./_support/tools.nix { inherit pkgs; }).packages;
|
|
programs.zsh.initContent = lib.mkAfter ''
|
|
workbench-reload() {
|
|
if [[ "''${DEVENV_ROOT:-}" != ${lib.escapeShellArg root} ]]; then
|
|
print -u2 'Enter the workbench devenv shell before loading credentials.'
|
|
return 1
|
|
fi
|
|
local exports
|
|
exports="$(${pkgs.python3}/bin/python3 ${./load-secrets.py} ${secretsManifest} "$@")" || return
|
|
eval "$exports"
|
|
}
|
|
'';
|
|
|
|
home.file."yookr/workbench/devenv.yaml".text = environmentInputs;
|
|
home.file."yookr/workbench/devenv.nix".text = ''
|
|
{ pkgs, ... }:
|
|
let tools = import ${./_support/tools.nix} {
|
|
inherit pkgs;
|
|
garden = import ${../yookr-dev/_support/packages.nix} { inherit pkgs; };
|
|
};
|
|
in {
|
|
inherit (tools) packages env;
|
|
enterShell = ${lib.strings.escapeNixString ''
|
|
if [ "''${WORKBENCH_TOOLS_ONLY:-0}" = 1 ]; then
|
|
eval "$(python3 ${./load-secrets.py} ${secretsManifest} --tools-only)"
|
|
else
|
|
eval "$(python3 ${./load-secrets.py} ${secretsManifest})"
|
|
fi
|
|
''};
|
|
}
|
|
'';
|
|
systemd.user.services = {
|
|
company-obs = mountService "obs" mountObs;
|
|
company-sharepoint = mountService "sharepoint" mountSharepoint;
|
|
};
|
|
};
|
|
}
|