From b7f052bfaa533a84982d3beea162e5c544bd0ace Mon Sep 17 00:00:00 2001 From: winston Date: Thu, 18 May 2023 15:10:28 +0200 Subject: [PATCH] feat: rework how I do secrets --- .gitattributes | 5 +- home/apps/git.nix | 14 +- home/apps/kubernetes.nix | 9 + home/apps/mail.nix | 430 ++++++++++++++------------------------ home/default.nix | 62 ++---- home/secrets/default.nix | Bin 480 -> 0 bytes home/secrets/fallback.nix | 7 - home/secrets/main.yaml | 6 +- home/secrets/sops.nix | 6 - 9 files changed, 201 insertions(+), 338 deletions(-) delete mode 100644 home/secrets/default.nix delete mode 100644 home/secrets/fallback.nix diff --git a/.gitattributes b/.gitattributes index afb59d5..aeebdda 100644 --- a/.gitattributes +++ b/.gitattributes @@ -6,7 +6,4 @@ lazy-lock.json -diff *.png filter=lfs diff=lfs merge=lfs -text # git crypt -home/secrets/fonts/* filter=git-crypt diff=git-crypt -home/secrets/*.nix filter=git-crypt diff=git-crypt -home/secrets/fallback.nix !filter !diff -home/secrets/sops.nix !filter !diff +home/secrets/fonts/* filter=git-crypt diff=git-crypt diff --git a/home/apps/git.nix b/home/apps/git.nix index e9bbb5a..429082d 100644 --- a/home/apps/git.nix +++ b/home/apps/git.nix @@ -1,6 +1,18 @@ -{pkgs, ...}: let +{ + config, + pkgs, + ... +}: let inherit (pkgs.stdenv.hostPlatform) isDarwin; in { + sops.secrets."gitconfig-work".path = "${config.xdg.configHome}/git/gitconfig-work"; + programs.git.includes = [ + { + condition = "gitdir:~/Code/work/"; + path = config.sops.secrets.gitconfig-work.path; + } + ]; + programs.git = { enable = true; userName = "winston"; diff --git a/home/apps/kubernetes.nix b/home/apps/kubernetes.nix index fea5c88..c95a702 100644 --- a/home/apps/kubernetes.nix +++ b/home/apps/kubernetes.nix @@ -41,6 +41,15 @@ ''; }; + sops.secrets = let + konfStore = "${config.xdg.configHome}/.kube/konfs/store"; + in { + "konf-ctp".path = "${konfStore}/ctp_ctp.yaml"; + "konf-fra1".path = "${konfStore}/fra1_fra1.yaml"; + "konf-work-prod".path = "${konfStore}/work-prod_work-prod.yaml"; + "konf-work-staging".path = "${konfStore}/work-staging_work-staging.yaml"; + }; + home.sessionVariables = { KREW_ROOT = "${config.xdg.dataHome}/krew"; KUBECACHEDIR = "${config.xdg.cacheHome}/kube"; diff --git a/home/apps/mail.nix b/home/apps/mail.nix index 774125d..ba7175f 100644 --- a/home/apps/mail.nix +++ b/home/apps/mail.nix @@ -1,289 +1,163 @@ { config, - lib, pkgs, ... -}: let - inherit (pkgs.stdenv.hostPlatform) isLinux; -in { - accounts.email.maildirBasePath = "${config.xdg.dataHome}/mail"; - - accounts.email.accounts = { - "personal" = { - primary = true; - passwordCommand = "${lib.getExe pkgs.gopass} -o mail/personal"; - maildir.path = "personal"; - - aliases = ["hey@winston.sh"]; - - imap = { - host = "imap.fastmail.com"; - port = 993; - tls.enable = true; - }; - - smtp = { - host = "smtp.fastmail.com"; - port = 465; - tls.enable = true; - }; - - mbsync = { - enable = true; - create = "both"; - expunge = "both"; - }; - - imapnotify = { - enable = true; - onNotify = "${lib.getExe pkgs.isync} %s"; - onNotifyPost = "${lib.getExe pkgs.notmuch} new && ${lib.getExe pkgs.libnotify} 'New mail arrived'"; - }; - - msmtp.enable = true; - neomutt = { - enable = true; - }; - notmuch.enable = true; - }; - }; - - home.packages = with pkgs; [w3m]; - - services.imapnotify.enable = isLinux; - +}: { + home.packages = with pkgs; [chroma pandoc w3m]; + sops.secrets."aerc-accounts".path = "${config.xdg.configHome}/aerc/accounts.conf"; programs = { - mbsync.enable = true; - msmtp.enable = true; - neomutt = { + aerc = { enable = true; - sidebar.enable = true; - sort = "reverse-threads"; - vimKeys = true; - extraConfig = ""; - settings = { - mailcap_path = "$HOME/.config/neomutt/mailcap:$mailcap_path"; + extraConfig = { + general = { + default-save-path = "~/Downloads"; + pgp-provider = "gpg"; + # sops-nix manages the accounts.conf, + # so the permissions appear unsafe to aerc + unsafe-accounts-conf = true; + }; + filters = { + "text/plain" = "colorize"; + "text/html" = "w3m -s -T text/html -o display_link_number=1 -dump | colorize"; + "text/calendar" = "calendar"; + "message/delivery-status" = "colorize"; + "message/rfc822" = "colorize"; + }; }; - binds = [ - { - map = ["index" "pager"]; - key = "i"; - action = "noop"; - } - { - map = ["index" "pager"]; - key = "g"; - action = "noop"; - } - { - map = ["index"]; - key = "\\Cf"; - action = "noop"; - } - { - map = ["index" "pager"]; - key = "M"; - action = "noop"; - } - { - map = ["index" "pager"]; - key = "C"; - action = "noop"; - } - { - map = ["index"]; - key = "gg"; - action = "first-entry"; - } - { - map = ["index"]; - key = "j"; - action = "next-entry"; - } - { - map = ["index"]; - key = "k"; - action = "previous-entry"; - } - { - map = ["attach"]; - key = ""; - action = "view-mailcap"; - } - { - map = ["attach"]; - key = "l"; - action = "view-mailcap"; - } - { - map = ["editor"]; - key = ""; - action = "noop"; - } - { - map = ["index"]; - key = "G"; - action = "last-entry"; - } - { - map = ["index"]; - key = "gg"; - action = "first-entry"; - } - { - map = ["pager" "attach"]; - key = "h"; - action = "exit"; - } - { - map = ["pager"]; - key = "j"; - action = "next-line"; - } - { - map = ["pager"]; - key = "k"; - action = "previous-line"; - } - { - map = ["pager"]; - key = "l"; - action = "view-attachments"; - } - { - map = ["index"]; - key = "D"; - action = "delete-message"; - } - { - map = ["index"]; - key = "U"; - action = "undelete-message"; - } - { - map = ["index"]; - key = "L"; - action = "limit"; - } - { - map = ["index"]; - key = "h"; - action = "noop"; - } - { - map = ["index"]; - key = "l"; - action = "display-message"; - } - { - map = ["index" "query"]; - key = ""; - action = "tag-entry"; - } - { - map = ["browser"]; - key = "h"; - action = "goto-parent"; - } - # { map = [ "browser" ]; key = "h"; action = "'..' \"Go to parent folder\""; } - { - map = ["index" "pager"]; - key = "H"; - action = "view-raw-message"; - } - { - map = ["browser"]; - key = "l"; - action = "select-entry"; - } - { - map = ["browser"]; - key = "gg"; - action = "top-page"; - } - { - map = ["browser"]; - key = "G"; - action = "bottom-page"; - } - { - map = ["pager"]; - key = "gg"; - action = "top"; - } - { - map = ["pager"]; - key = "G"; - action = "bottom"; - } - { - map = ["index" "pager" "browser"]; - key = "d"; - action = "half-down"; - } - { - map = ["index" "pager" "browser"]; - key = "u"; - action = "half-up"; - } - { - map = ["index" "pager"]; - key = "S"; - action = "sync-mailbox"; - } - { - map = ["index" "pager"]; - key = "R"; - action = "group-reply"; - } - { - map = ["index"]; - key = "\\031"; - action = "previous-undeleted"; - } - { - map = ["index"]; - key = "\\005"; - action = "next-undeleted"; - } - { - map = ["pager"]; - key = "\\031"; - action = "previous-line"; - } - { - map = ["pager"]; - key = "\\005"; - action = "next-line"; - } - { - map = ["editor"]; - key = ""; - action = "complete-query"; - } - ]; - }; - notmuch.enable = true; - }; + extraBinds = { + global = { + "" = ":prev-tab"; + "" = ":next-tab"; + "" = ":term"; + "?" = ":help keys"; + }; - # need to use setsid on video/* mpv - xdg.configFile = { - "neomutt/mailcap".text = let - openurl = "${config.xdg.configHome}/neomutt/openurl"; - in '' - text/plain; $EDITOR %s ; - text/html; ${openurl} %s ; nametemplate=%s.html - text/html; ${lib.getExe pkgs.lynx} -assume_charset=%{charset} -display_charset=utf-8 -dump -width=1024 %s; nametemplate=%s.html; copiousoutput; - image/*; ${openurl} %s ; - video/*; ${lib.getExe pkgs.mpv} --quiet %s &; copiousoutput - audio/*; ${lib.getExe pkgs.mpv} %s ; - application/pdf; ${openurl} %s ; - application/pgp-encrypted; ${lib.getExe pkgs.gnupg} -d '%s'; copiousoutput; - application/pgp-keys; ${lib.getExe pkgs.gnupg} --import '%s'; copiousoutput; - ''; - "neomutt/openurl" = { - source = ./neomutt/openurl; - executable = true; + messages = { + q = ":quit"; + j = ":next"; + k = ":prev"; + "" = ":prev"; + "" = ":next"; + "" = ":next 50%"; + "" = ":prev 50%"; + "" = ":next 100%"; + "" = ":prev 100%"; + "" = ":next 100%"; + "" = ":prev 100%"; + g = ":select 0"; + G = ":select -1"; + + H = ":collapse-folder"; + J = ":next-folder"; + K = ":prev-folder"; + L = ":expand-folder"; + + v = ":mark -t"; + V = ":mark -v"; + + T = ":toggle-threads"; + + "" = ":view"; + d = ":prompt 'Really delete this message?' 'delete-message'"; + D = ":delete"; + A = ":archive flat"; + + C = ":compose"; + + rr = ":reply -a"; + rq = ":reply -aq"; + Rr = ":reply"; + Rq = ":reply -q"; + + c = ":cf"; + "$" = ":term"; + "!" = ":term"; + "|" = ":pipe"; + + "/" = ":search"; + "\\" = ":filter"; + n = ":next-result"; + N = ":prev-result"; + "" = ":clear"; + }; + + "messages:folder=Drafts" = { + "" = ":recall"; + }; + + view = { + "/" = ":toggle-key-passthrough/"; + q = ":close"; + O = ":open"; + S = ":save"; + "|" = ":pipe"; + D = ":delete"; + A = ":archive flat"; + + "" = ":open-link "; + + f = ":forward"; + rr = ":reply -a"; + rq = ":reply -aq"; + Rr = ":reply"; + Rq = ":reply -q"; + + H = ":toggle-headers"; + "" = ":prev-part"; + "" = ":next-part"; + K = ":prev"; + J = ":next"; + }; + + "view::passthrough" = { + "$noinherit" = "true"; + "$ex" = ""; + "" = ":toggle-key-passthrough"; + }; + + # Keybindings used when the embedded terminal is not selected in the compose view + "compose" = { + "$noinherit" = "true"; + "$ex" = ""; + "" = ":prev-field"; + "" = ":next-field"; + "" = ":switch-account -p"; + "" = ":switch-account -n"; + "" = ":next-field"; + "" = ":prev-field"; + "" = ":prev-tab"; + "" = ":next-tab"; + }; + + # Keybindings used when the embedded terminal is selected in the compose view + "compose::editor" = { + "$noinherit" = "true"; + "$ex" = ""; + "" = ":prev-field"; + "" = ":next-field"; + "" = ":prev-tab"; + "" = ":next-tab"; + }; + + # Keybindings used when reviewing a message to be sent + "compose::review" = { + y = ":send"; + n = ":abort"; + v = ":preview"; + p = ":postpone"; + q = ":choose -o d discard abort -o p postpone postpone"; + e = ":edit"; + a = ":attach"; + d = ":detach"; + }; + + "terminal" = { + "$noinherit" = "true"; + "$ex" = ""; + "" = ":prev-tab"; + "" = ":next-tab"; + }; + }; }; }; } diff --git a/home/default.nix b/home/default.nix index 525e058..2b27cbc 100644 --- a/home/default.nix +++ b/home/default.nix @@ -3,38 +3,30 @@ flakePath, lib, pkgs, - machine, ... }: let inherit (pkgs.stdenv.hostPlatform) isDarwin isLinux; - secretsAvailable = builtins.pathExists ./secrets/default.nix; in { - imports = - [ - ./apps/browsers.nix - ./apps/fonts.nix - ./apps/git.nix - ./apps/gpg.nix - ./apps/i3.nix - ./apps/kubernetes.nix - ./apps/macos.nix - ./apps/mail.nix - ./apps/music.nix - ./apps/neovim.nix - ./apps/newsboat.nix - ./apps/rice.nix - ./apps/vscode.nix - ./apps/wayland.nix - ./apps/wezterm.nix - ./apps/zsh.nix - ./secrets/sops.nix - ./xdg.nix - ] - ++ ( - if secretsAvailable - then [./secrets] - else [./secrets/fallback.nix] - ); + imports = [ + ./apps/browsers.nix + ./apps/fonts.nix + ./apps/git.nix + ./apps/gpg.nix + ./apps/i3.nix + ./apps/kubernetes.nix + ./apps/macos.nix + ./apps/mail.nix + ./apps/music.nix + ./apps/neovim.nix + ./apps/newsboat.nix + ./apps/rice.nix + ./apps/vscode.nix + ./apps/wayland.nix + ./apps/wezterm.nix + ./apps/zsh.nix + ./secrets/sops.nix + ./xdg.nix + ]; home = { packages = with pkgs; ([ @@ -55,30 +47,20 @@ in { ] ++ lib.optionals isLinux [ _1password-gui - #insomnia - #mattermost-desktop - neovide kooha - #jetbrains.webstorm - gnome.gnome-boxes + jetbrains.goland + jetbrains.webstorm ]); sessionVariables = lib.mkIf isDarwin { SSH_AUTH_SOCK = "${config.programs.gpg.homedir}/S.gpg-agent.ssh"; }; - stateVersion = "22.11"; }; programs = { home-manager.enable = true; man.enable = true; - mpv.enable = isLinux; taskwarrior.enable = true; - mangohud = { - enable = isLinux && machine.personal; - package = pkgs.mangohud; - }; - zathura.enable = true; }; xdg.configFile."ideavim/ideavimrc".source = config.lib.file.mkOutOfStoreSymlink "${flakePath}/home/apps/ideavim/ideavimrc"; diff --git a/home/secrets/default.nix b/home/secrets/default.nix deleted file mode 100644 index f5511704b8b455de37f06d0eb9f3d6f2f70d362e..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 480 zcmV<60U!PVM@dveQdv+`0PXYkseFfchf6)fM^#wQfam4&K!}3&sDni}-L~Ra z8;