Add attic

Signed-off-by: Nikolaos Karaolidis <nick@karaolidis.com>
2025-09-03 15:03:30 +01:00
parent dd34a05ee8
commit 0ceab452be
24 changed files with 658 additions and 24 deletions
--- a/hosts/common/configs/system/nix/default.nix
+++ b/hosts/common/configs/system/nix/default.nix
@@ -1,25 +1,54 @@
-{ config, inputs, ... }:
+{
+  config,
+  inputs,
+  lib,
+  ...
+}:
 {
  sops = {
-    secrets."git/credentials/github.com/tokens/public".sopsFile =
-      "${inputs.secrets}/domains/personal/secrets.yaml";
+    secrets = {
+      "git/credentials/github.com/tokens/public".sopsFile =
+        "${inputs.secrets}/domains/personal/secrets.yaml";

-    templates.nix-access-tokens = {
-      content = ''
-        access-tokens = github.com=${config.sops.placeholder."git/credentials/github.com/tokens/public"}
-      '';
-      group = "users";
+      "nix/cache/nix.karaolidis.com".sopsFile = "${inputs.secrets}/domains/personal/secrets.yaml";
+    };
+
+    templates = {
+      nix-access-tokens = {
+        content = ''
+          access-tokens = github.com=${config.sops.placeholder."git/credentials/github.com/tokens/public"}
+        '';
+        group = "users";
+        mode = "0440";
+      };
+
+      nix-netrc = {
+        content = ''
+          machine nix.karaolidis.com
+          password ${config.sops.placeholder."nix/cache/nix.karaolidis.com"}
+        '';
+        group = "users";
+        mode = "0440";
+      };
    };
  };

  nix = {
    settings = {
+      trusted-users = [
+        "root"
+        "@wheel"
+      ];
      use-xdg-base-directories = true;
      experimental-features = [
        "nix-command"
        "flakes"
      ];
      download-buffer-size = 524288000;
+      substituters = lib.mkBefore [ "https://nix.karaolidis.com/main" ];
+      trusted-substituters = lib.mkBefore [ "https://nix.karaolidis.com/main" ];
+      trusted-public-keys = lib.mkBefore [ "main:nJVRBnv73MDkwuV5sgm52m4E2ImOhWHvY12qzjPegAk=" ];
+      netrc-file = config.sops.templates.nix-netrc.path;
    };

    channel.enable = false;
--- a/hosts/common/configs/user/console/attic/default.nix
+++ b/hosts/common/configs/user/console/attic/default.nix
@@ -0,0 +1,33 @@
+{ user, home }:
+{
+  config,
+  inputs,
+  pkgs,
+  ...
+}:
+let
+  hmConfig = config.home-manager.users.${user};
+in
+{
+  home-manager.users.${user} = {
+    sops = {
+      secrets."nix/cache/nix.karaolidis.com".sopsFile = "${inputs.secrets}/domains/personal/secrets.yaml";
+
+      templates."attic" = {
+        content = builtins.readFile (
+          (pkgs.formats.toml { }).generate "config.toml" {
+            default-server = "main";
+
+            servers."main" = {
+              endpoint = "https://nix.karaolidis.com/";
+              token = hmConfig.sops.placeholder."nix/cache/nix.karaolidis.com";
+            };
+          }
+        );
+        path = "${home}/.config/attic/config.toml";
+      };
+    };
+
+    home.packages = with pkgs; [ attic-client ];
+  };
+}
--- a/hosts/common/configs/user/console/home-manager/default.nix
+++ b/hosts/common/configs/user/console/home-manager/default.nix
@@ -1,5 +1,10 @@
 { user, home }:
-{ config, inputs, ... }:
+{
+  config,
+  inputs,
+  lib,
+  ...
+}:
 {
  imports = [ inputs.home-manager.nixosModules.default ];

@@ -15,10 +20,18 @@
      home.stateVersion = "24.11";
      systemd.user.startServices = true;

-      nix.settings.experimental-features = [
-        "nix-command"
-        "flakes"
-      ];
+      nix.settings = {
+        use-xdg-base-directories = true;
+        experimental-features = [
+          "nix-command"
+          "flakes"
+        ];
+        download-buffer-size = 524288000;
+        substituters = lib.mkBefore [ "https://nix.karaolidis.com/main" ];
+        trusted-substituters = lib.mkBefore [ "https://nix.karaolidis.com/main" ];
+        trusted-public-keys = lib.mkBefore [ "main:nJVRBnv73MDkwuV5sgm52m4E2ImOhWHvY12qzjPegAk=" ];
+        netrc-file = config.sops.templates.nix-netrc.path;
+      };
    };
  };
 }
--- a/hosts/common/configs/user/console/syncthing/default.nix
+++ b/hosts/common/configs/user/console/syncthing/default.nix
@@ -14,11 +14,13 @@
    "syncthing/key" = {
      owner = user;
      group = "users";
+      mode = "0440";
    };
    # openssl req -new -x509 -key key.pem -out cert.pem -days 9999 -subj "/CN=syncthing"
    "syncthing/cert" = {
      owner = user;
      group = "users";
+      mode = "0440";
    };
  };

--- a/hosts/elara/default.nix
+++ b/hosts/elara/default.nix
@@ -43,7 +43,7 @@

  networking.hostName = "elara";

-  sas.build.private = true;
+  sas.build.private = false;

  environment.impermanence.enable = lib.mkForce false;
 }
--- a/hosts/elara/users/nikara/default.nix
+++ b/hosts/elara/users/nikara/default.nix
@@ -14,6 +14,7 @@ in
  imports = [
    (import ../../../common/configs/user { inherit user home; })

+    (import ../../../common/configs/user/console/attic { inherit user home; })
    (import ../../../common/configs/user/console/btop { inherit user home; })
    (import ../../../common/configs/user/console/dive { inherit user home; })
    (import ../../../common/configs/user/console/fastfetch { inherit user home; })
--- a/hosts/himalia/users/nick/default.nix
+++ b/hosts/himalia/users/nick/default.nix
@@ -15,6 +15,7 @@ in
    (import ../../../common/configs/user { inherit user home; })

    (import ../../../common/configs/user/console/android { inherit user home; })
+    (import ../../../common/configs/user/console/attic { inherit user home; })
    (import ../../../common/configs/user/console/brightnessctl { inherit user home; })
    (import ../../../common/configs/user/console/btop { inherit user home; })
    (import ../../../common/configs/user/console/dive { inherit user home; })
@@ -123,6 +124,7 @@ in
    ];
    linger = true;
    uid = lib.strings.toInt (builtins.readFile ./uid);
+    openssh.authorizedKeys.keyFiles = [ "${inputs.secrets}/domains/personal/id_ed25519.pub" ];
  };

  services.getty.autologinUser = user;
--- a/hosts/installer/default.nix
+++ b/hosts/installer/default.nix
@@ -33,6 +33,7 @@
    ../common/configs/system/power
    ../common/configs/system/sops
    ../common/configs/system/ssh
+    ../common/configs/system/sshd
    ../common/configs/system/sudo
    ../common/configs/system/system
    ../common/configs/system/timezone
--- a/hosts/installer/users/nick/default.nix
+++ b/hosts/installer/users/nick/default.nix
@@ -14,6 +14,7 @@ in
  imports = [
    (import ../../../common/configs/user { inherit user home; })

+    (import ../../../common/configs/user/console/attic { inherit user home; })
    (import ../../../common/configs/user/console/brightnessctl { inherit user home; })
    (import ../../../common/configs/user/console/btop { inherit user home; })
    (import ../../../common/configs/user/console/fastfetch { inherit user home; })
@@ -63,6 +64,7 @@ in
    ];
    linger = true;
    uid = lib.strings.toInt (builtins.readFile ./uid);
+    openssh.authorizedKeys.keyFiles = [ "${inputs.secrets}/domains/personal/id_ed25519.pub" ];
  };

  services.getty.autologinUser = user;
--- a/hosts/jupiter/users/nick/default.nix
+++ b/hosts/jupiter/users/nick/default.nix
@@ -14,6 +14,7 @@ in
  imports = [
    (import ../../../common/configs/user { inherit user home; })

+    (import ../../../common/configs/user/console/attic { inherit user home; })
    (import ../../../common/configs/user/console/brightnessctl { inherit user home; })
    (import ../../../common/configs/user/console/btop { inherit user home; })
    (import ../../../common/configs/user/console/fastfetch { inherit user home; })
--- a/hosts/jupiter/users/storm/configs/console/podman/attic/default.nix
+++ b/hosts/jupiter/users/storm/configs/console/podman/attic/default.nix
@@ -0,0 +1,127 @@
+{ user, home }:
+{
+  config,
+  inputs,
+  pkgs,
+  ...
+}:
+let
+  hmConfig = config.home-manager.users.${user};
+  inherit (hmConfig.virtualisation.quadlet) containers volumes networks;
+in
+{
+  home-manager.users.${user} = {
+    sops = {
+      secrets = {
+        "attic/postgresql".sopsFile = "${inputs.secrets}/hosts/jupiter/secrets.yaml";
+        "attic/rs256".sopsFile = "${inputs.secrets}/hosts/jupiter/secrets.yaml";
+        "attic/admin".sopsFile = "${inputs.secrets}/hosts/jupiter/secrets.yaml";
+      };
+
+      templates = {
+        attic-postgresql-env.content = ''
+          POSTGRES_PASSWORD=${hmConfig.sops.placeholder."attic/postgresql"}
+        '';
+
+        attic-env.content = ''
+          ATTIC_TOKEN=${hmConfig.sops.placeholder."attic/admin"}
+        '';
+
+        attic.content = builtins.readFile (
+          (pkgs.formats.toml { }).generate "server.toml" {
+            listen = "[::]:8080";
+
+            allowed-hosts = [ "nix.karaolidis.com" ];
+            api-endpoint = "https://nix.karaolidis.com/";
+
+            database.url = "postgres://attic:${
+              hmConfig.sops.placeholder."attic/postgresql"
+            }@attic-postgresql:5432/attic";
+
+            storage = {
+              type = "local";
+              path = "/var/lib/attic";
+            };
+
+            chunking = {
+              nar-size-threshold = 65536;
+              min-size = 16384;
+              avg-size = 65536;
+              max-size = 262144;
+            };
+
+            compression = {
+              type = "zstd";
+              level = 8;
+            };
+
+            garbage-collection = {
+              interval = "12 hours";
+              default-retention-period = "1 month";
+            };
+
+            jwt.signing.token-rs256-secret-base64 = hmConfig.sops.placeholder."attic/rs256";
+          }
+        );
+      };
+    };
+
+    systemd.user.tmpfiles.rules = [
+      "d /mnt/storage/private/storm/containers/storage/volumes/attic/_data 700 storm storm"
+    ];
+
+    virtualisation.quadlet = {
+      networks.attic = { };
+
+      volumes.attic-postgresql = { };
+
+      containers = {
+        attic = {
+          containerConfig = {
+            image = "docker-archive:${pkgs.dockerImages.attic}";
+            networks = [
+              networks.attic.ref
+              networks.traefik.ref
+            ];
+            volumes = [
+              "/mnt/storage/private/storm/containers/storage/volumes/attic/_data:/var/lib/attic"
+              "${hmConfig.sops.templates.attic.path}:/etc/attic/server.toml"
+            ];
+            environmentFiles = [ hmConfig.sops.templates.attic-env.path ];
+            exec = [
+              "--config"
+              "/etc/attic/server.toml"
+            ];
+            labels = [
+              "traefik.enable=true"
+              "traefik.http.routers.attic.rule=Host(`nix.karaolidis.com`)"
+            ];
+          };
+
+          unitConfig = {
+            After = [
+              "${containers.attic-postgresql._serviceName}.service"
+              "sops-nix.service"
+            ];
+            Requires = [ "${containers.attic-postgresql._serviceName}.service" ];
+          };
+        };
+
+        attic-postgresql = {
+          containerConfig = {
+            image = "docker-archive:${pkgs.dockerImages.postgresql}";
+            networks = [ networks.attic.ref ];
+            volumes = [ "${volumes.attic-postgresql.ref}:/var/lib/postgresql/data" ];
+            environments = {
+              POSTGRES_DB = "attic";
+              POSTGRES_USER = "attic";
+            };
+            environmentFiles = [ hmConfig.sops.templates.attic-postgresql-env.path ];
+          };
+
+          unitConfig.After = [ "sops-nix.service" ];
+        };
+      };
+    };
+  };
+}
--- a/hosts/jupiter/users/storm/configs/console/podman/attic/post-start.sh
+++ b/hosts/jupiter/users/storm/configs/console/podman/attic/post-start.sh
@@ -0,0 +1,22 @@
+# shellcheck shell=sh
+
+attic login main https://nix.karaolidis.com/ "$ATTIC_TOKEN"
+
+CACHE_NAME="main"
+
+while true; do
+  out=$(attic cache info "$CACHE_NAME" 2>&1)
+  status=$?
+
+  if [ $status -eq 0 ]; then
+    break
+  elif echo "$out" | grep -q "NoSuchCache"; then
+    attic cache create "$CACHE_NAME"
+  elif echo "$out" | grep -q "404"; then
+    sleep 0.1
+  else
+    echo "Unexpected error:"
+    echo "$out"
+    break
+  fi
+done
--- a/hosts/jupiter/users/storm/configs/console/podman/default.nix
+++ b/hosts/jupiter/users/storm/configs/console/podman/default.nix
@@ -10,6 +10,7 @@ let
 in
 {
  imports = [
+    (import ./attic { inherit user home; })
    (import ./authelia { inherit user home; })
    (import ./gitea { inherit user home; })
    (import ./grafana { inherit user home; })
--- a/hosts/jupiter/users/storm/default.nix
+++ b/hosts/jupiter/users/storm/default.nix
@@ -14,6 +14,7 @@ in
  imports = [
    (import ../../../common/configs/user { inherit user home; })

+    (import ../../../common/configs/user/console/attic { inherit user home; })
    (import ../../../common/configs/user/console/brightnessctl { inherit user home; })
    (import ../../../common/configs/user/console/btop { inherit user home; })
    (import ../../../common/configs/user/console/home-manager { inherit user home; })