home/private_dot_ssh/config.tmpl

@@ -1,10 +1,6 @@
 Host github.com
   AddKeysToAgent yes
   IdentityFile /run/agenix/git/github_personal 
-
-Host fm2120.rsync.net
-  AddKeysToAgent yes
-  IdentityFile /run/agenix/borg/rsync/id_rsa
 {{ if eq .chezmoi.hostname "kestrel" }}
 Host torus
   AddKeysToAgent yes

provision/hosts/bulwark/configuration.nix

@@ -46,6 +46,7 @@
       nipr.enable = true;
       ssh.enable = true;
       terminal.enable = true;
+      secrets.enable = true;
       wireguard-client.enable = false;
     };
   };

provision/hosts/default/backup.nix

@@ -3,7 +3,6 @@
   services.borgmatic.enable = true;
   environment.systemPackages = with pkgs; [
     borgbackup # Deduplicating backup program 
-    tree
     (pkgs.writeScriptBin "stop-docker-containers" ''
       #!/bin/sh
       [ -e /tmp/docker_images ] && rm /tmp/docker_images

provision/hosts/default/configuration.nix

@@ -1,4 +1,4 @@
-{ config, pkgs, user, lib, inputs, ... }:
+{ config, pkgs, user, lib, ... }:
 {
   nix = {
     package = pkgs.nixFlakes;
@@ -46,7 +46,6 @@
   
   environment.systemPackages = with pkgs; [
     cowsay # A program which generates ASCII pictures of a cow with a message
-    inputs.agenix.packages.x86_64-linux.default 
   ];
 
   # Did you read the comment?

provision/hosts/default/default.nix

@@ -1,4 +1,4 @@
 { ... }:
 { 
-  imports = [ ./git.nix ./backup.nix ./configuration.nix ./home-configuration.nix ];
+  imports = [ ./backup.nix ./configuration.nix ./home-configuration.nix ];
 }

provision/hosts/default/git.nix

@@ -1,15 +0,0 @@
-{ config, pkgs, user, lib, ... }:
-{
-  environment.systemPackages = with pkgs; [
-    git # Version control system for tracking changes in source code during software development.
-    git-annex # Manages files with git, without checking the file contents into git.
-    lazygit # Terminal-based GUI for git, making it easier to use and visualize git repositories.
-  ];
-
-  age.secrets."git/github_personal" = {
-    file = ../../secrets/git/github_personal.age;
-    owner = "${user}";
-    group = "users";
-  };
-}
-          

provision/hosts/kestrel/backup.nix

@@ -1,47 +1,9 @@
 { config, pkgs, user, lib, ... }:
 {
-  age.secrets."ssh/torus/id_ed25519.pub" = {
-    file = ../../secrets/ssh/torus/id_ed25519.pub.age;
-    owner = "${user}";
-    group = "users";
-  };
-  age.secrets."ssh/kestrel/id_ed25519" = {
-    file = ../../secrets/ssh/kestrel/id_ed25519.age;
-    owner = "${user}";
-    group = "users";
-  };
-  age.secrets."ssh/kestrel/id_ed25519.pub" = {
-    file = ../../secrets/ssh/kestrel/id_ed25519.pub.age;
-    owner = "${user}";
-    group = "users";
-  };
-  age.secrets."borg/rsync/id_rsa" = {
-    file = ../../secrets/borg/rsync/id_rsa.age;
-    owner = "${user}";
-    group = "users";
-  };
-  age.secrets."borg/rsync/id_rsa.pub" = {
-    file = ../../secrets/borg/rsync/id_rsa.pub.age;
-    owner = "${user}";
-    group = "users";
-  };
-
   # Password-less logins for backup
   users.users."${user}".openssh.authorizedKeys.keyFiles = [
     config.age.secrets."ssh/torus/id_ed25519.pub".path
   ];
-
-  # Password-less login for root
-  programs.ssh.extraConfig = ''
-    Host torus 
-      AddKeysToAgent yes
-      IdentityFile /run/agenix/ssh/kestrel/id_ed25519 
-
-    Host fm2120.rsync.net
-      AddKeysToAgent yes
-      IdentityFile /run/agenix/borg/rsync/id_rsa
-  '';
-
   systemd.tmpfiles.rules = [
     "d /store 0775 ${user} users -"
   ];

provision/hosts/kestrel/configuration.nix

@@ -61,6 +61,7 @@
     };
     system = {
       nipr.enable = true;
+      secrets.enable = true;
       ssh.enable = true;
       terminal.enable = true;
       wireguard-client = {

provision/hosts/shivan/configuration.nix

@@ -49,6 +49,7 @@
     };
     system = {
       nipr = true;
+      secrets.enable = true;
       ssh.enable = true;
       terminal.enable = true;
       wireguard-client.enable = false;

provision/hosts/torus/backup.nix

@@ -1,50 +1,8 @@
 { config, pkgs, user, lib, ... }:
 {
-  age.secrets."ssh/kestrel/id_ed25519.pub" = {
+  # Password-less logins for backup
-    file = ../../secrets/ssh/kestrel/id_ed25519.pub.age;
-    owner = "${user}";
-    group = "users";
-  };
-  age.secrets."ssh/torus/id_ed25519" = {
-    file = ../../secrets/ssh/torus/id_ed25519.age;
-    owner = "${user}";
-    group = "users";
-  };
-  age.secrets."ssh/torus/id_ed25519.pub" = {
-    file = ../../secrets/ssh/torus/id_ed25519.pub.age;
-    owner = "${user}";
-    group = "users";
-  };
-  age.secrets."borg/torus/password" = {
-    file = ../../secrets/borg/torus/password.age;
-    owner = "${user}";
-    group = "users";
-  };
-  age.secrets."borg/rsync/id_rsa" = {
-    file = ../../secrets/borg/rsync/id_rsa.age;
-    owner = "${user}";
-    group = "users";
-  };
-  age.secrets."borg/rsync/id_rsa.pub" = {
-    file = ../../secrets/borg/rsync/id_rsa.pub.age;
-    owner = "${user}";
-    group = "users";
-  };
-
-  # Password-less login for user
   users.users."${user}".openssh.authorizedKeys.keyFiles = [
     config.age.secrets."ssh/kestrel/id_ed25519.pub".path
   ];
-
-  # Password-less login for root
-  programs.ssh.extraConfig = ''
-    Host kestrel
-      AddKeysToAgent yes
-      IdentityFile /run/agenix/ssh/torus/id_ed25519 
-
-    Host fm2120.rsync.net
-      AddKeysToAgent yes
-      IdentityFile /run/agenix/borg/rsync/id_rsa
-  '';
 }
           

provision/hosts/torus/configuration.nix

@@ -102,6 +102,7 @@
     system = {
       terminal.enable = true;
       ssh.enable = true;
+      secrets.enable = true;
     };
   };
 

provision/modules/desktop/gnome.nix

@@ -183,7 +183,7 @@ in {
           screensaver = [];    
         };
         "org/gnome/settings-daemon/plugins/power" = {
-          sleep-inactive-ac-type = "blank";
+          sleep-inactive-ac-type = "suspend";
           sleep-inactive-battery-type = "suspend";
           sleep-inactive-ac-timeout = 2700;
           sleep-inactive-battery-timeout = 2700;

provision/modules/gaming/emulation.nix

@@ -21,16 +21,5 @@ in {
         ];
       })
     ];
-
-    age.secrets."emu/switch/prod.keys" = {
-      file = ../../secrets/emu/switch/prod.keys.age;
-      owner = "${user}";
-      group = "users";
-    };
-    age.secrets."emu/switch/title.keys" = {
-      file = ../../secrets/emu/switch/title.keys.age;
-      owner = "${user}";
-      group = "users";
-    };
   };
 }

provision/modules/system/default.nix

@@ -1,4 +1,4 @@
 { ... }:
 {
-  imports = [ ./nipr.nix ./ssh.nix ./terminal.nix ./wireguard-client.nix ];
+  imports = [ ./nipr.nix ./secrets.nix ./ssh.nix ./terminal.nix ./wireguard-client.nix ];
 }

provision/modules/system/secrets.nix

@@ -0,0 +1,53 @@
+{ config, lib, pkgs, user, inputs, ... }:
+
+let cfg = config.modules.system.secrets;
+in {
+  options.modules.system.secrets.enable = lib.mkEnableOption "secrets";
+  config = lib.mkIf cfg.enable {
+     
+    environment.systemPackages = [
+      inputs.agenix.packages.x86_64-linux.default 
+    ];
+   
+    # git secrets
+    age.secrets."git/github_personal" = {
+      file = ../../secrets/git/github_personal.age;
+      owner = "${user}";
+      group = "users";
+    };
+
+    # ssh secrets
+    age.secrets."ssh/kestrel/id_ed25519" = {
+      file = ../../secrets/ssh/kestrel/id_ed25519.age;
+      owner = "${user}";
+      group = "users";
+    };
+    age.secrets."ssh/kestrel/id_ed25519.pub" = {
+      file = ../../secrets/ssh/kestrel/id_ed25519.pub.age;
+      owner = "${user}";
+      group = "users";
+    };
+    age.secrets."ssh/torus/id_ed25519" = {
+      file = ../../secrets/ssh/torus/id_ed25519.age;
+      owner = "${user}";
+      group = "users";
+    };
+    age.secrets."ssh/torus/id_ed25519.pub" = {
+      file = ../../secrets/ssh/torus/id_ed25519.pub.age;
+      owner = "${user}";
+      group = "users";
+    };
+
+    # emu secrets
+    age.secrets."emu/switch/prod.keys" = {
+      file = ../../secrets/emu/switch/prod.keys.age;
+      owner = "${user}";
+      group = "users";
+    };
+    age.secrets."emu/switch/title.keys" = {
+      file = ../../secrets/emu/switch/title.keys.age;
+      owner = "${user}";
+      group = "users";
+    };
+  };
+}

provision/modules/system/terminal.nix

@@ -6,6 +6,9 @@ in {
   config = lib.mkIf cfg.enable {
 
     environment.systemPackages = with pkgs; [
+      git # Version control system for tracking changes in source code during software development.
+      git-annex # Manages files with git, without checking the file contents into git.
+      lazygit # Terminal-based GUI for git, making it easier to use and visualize git repositories.
       killall # Command-line utility to terminate processes by name.
       pciutils # Utilities for inspecting and manipulating devices connected to the PCI bus.
       chezmoi # Manages your dotfiles across multiple machines, ensuring consistency and version control.

provision/secrets/secrets.nix

@@ -21,8 +21,5 @@ in
   "ssh/kestrel/id_ed25519.pub.age".publicKeys = users ++ systems;
   "ssh/torus/id_ed25519.age".publicKeys = [ tstarr_torus ] ++ systems;
   "ssh/torus/id_ed25519.pub.age".publicKeys = users ++ systems;
-  "borg/torus/password.age".publicKeys = [ tstarr_torus ] ++ systems;
-  "borg/rsync/id_rsa.age".publicKeys = users ++ systems;
-  "borg/rsync/id_rsa.pub.age".publicKeys = users ++ systems;
 }