SebastianStork/nixos-config
1
0
Fork 0
mirror of https://github.com/SebastianStork/nixos-config.git synced 2026-01-21 15:11:34 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

Enable ShellCheck and improve shell scripts

Browse source
This commit is contained in:
SebastianStork 2025-09-12 19:32:48 +02:00
parent 58a78d7de7
commit e5b6374751
7 changed files with 64 additions and 42 deletions
Download patch file Download diff file Expand all files Collapse all files

15
flake/scripts.nix
View file

@ -13,8 +13,6 @@ _: {
pkgs.jq
];
excludeShellChecks = [ "SC2155" ];
text = ''
if [[ $# -ne 2 ]]; then
echo "Usage: $0 <host> <destination>"
@ -25,7 +23,7 @@ _: {
destination="$2"
root="/tmp/anywhere/$host"
impermanence=$(nix eval ".#nixosConfigurations.$host.config.custom.impermanence.enable")
impermanence="$(nix eval ".#nixosConfigurations.$host.config.custom.impermanence.enable")"
if [ "$impermanence" = true ]; then
ssh_dir="$root/persist/etc/ssh"
else
@ -38,13 +36,16 @@ _: {
ssh-keygen -C "root@$host" -f "$ssh_dir/ssh_host_ed25519_key" -N "" -q
echo "==> Replacing old age key with new age key..."
new_age_key=$(ssh-to-age -i "$ssh_dir/ssh_host_ed25519_key.pub")
new_age_key="$(ssh-to-age -i "$ssh_dir/ssh_host_ed25519_key.pub")"
sed -i -E "s|(agePublicKey\s*=\s*\")[^\"]*(\";)|\1$new_age_key\2|" "hosts/$host/default.nix"
echo "==> Updating SOPS secrets..."
export BW_SESSION=$(bw login --raw)
export SOPS_AGE_KEY=$(bw get item 'admin age-key' | jq -r '.notes')
export SOPS_CONFIG=$(nix build .#sops-config --print-out-paths)
BW_SESSION="$(bw login --raw)"
export BW_SESSION
SOPS_AGE_KEY="$(bw get item 'admin age-key' | jq -r '.notes')"
export SOPS_AGE_KEY
SOPS_CONFIG="$(nix build .#sops-config --print-out-paths)"
export SOPS_CONFIG
sops updatekeys --yes "hosts/$host/secrets.json"
fi

9
flake/sops.nix
View file

@ -50,9 +50,12 @@
pkgs.jq
];
shellHook = ''
export BW_SESSION=$(bw login --raw)
export SOPS_AGE_KEY=$(bw get item 'admin age-key' | jq -r '.notes')
export SOPS_CONFIG=${self'.packages.sops-config}
BW_SESSION="$(bw login --raw)"
export BW_SESSION
SOPS_AGE_KEY="$(bw get item 'admin age-key' | jq -r '.notes')"
export SOPS_AGE_KEY
SOPS_CONFIG="${self'.packages.sops-config}"
export SOPS_CONFIG
'';
};
};

2
hosts/shared.nix
View file

@ -41,6 +41,8 @@
};
};
systemd.enableStrictShellChecks = true;
time.timeZone = "Europe/Berlin";
i18n = {
defaultLocale = "en_US.UTF-8";

31
modules/system/services/forgejo/default.nix
View file

@ -70,22 +70,33 @@ in
};
};
systemd = {
services.forgejo.preStart =
systemd.services.forgejo.preStart =
let
userCmd = "${lib.getExe config.services.forgejo.package} admin user";
credentials = lib.concatStringsSep " " [
"--username SebastianStork"
"--password \"$PASSWORD\""
];
in
''
PASSWORD="$(< ${config.sops.secrets."forgejo/admin-password".path})"
username="SebastianStork"
password="$(cat ${config.sops.secrets."forgejo/admin-password".path})"
${userCmd} create ${credentials} --email "sebastian.stork@pm.me" --admin \
|| ${userCmd} change-password ${credentials} --must-change-password=false
create_user() {
${userCmd} create \
--username "$username" \
--password "$password" \
--email "sebastian.stork@pm.me" \
--admin
}
reset_password() {
${userCmd} change-password \
--username "$username" \
--password "$password" \
--must-change-password=false
}
if ! create_user; then
reset_password
fi
'';
};
custom.services.resticBackups.forgejo = lib.mkIf cfg.doBackups {
conflictingService = "forgejo.service";

16
modules/system/services/hedgedoc.nix
View file

@ -55,15 +55,15 @@ in
};
# Ensure session-secret
systemd.services.hedgedoc.preStart =
let
sessionSecret = "/var/lib/hedgedoc/session-secret";
in
lib.mkBefore ''
if [ ! -f ${sessionSecret} ]; then
${lib.getExe pkgs.pwgen} -s 64 1 > ${sessionSecret}
systemd.services.hedgedoc.preStart = lib.mkBefore ''
secret_file="/var/lib/hedgedoc/session-secret"
if [ ! -f $secret_file ]; then
${lib.getExe pkgs.pwgen} -s 64 1 > $secret_file
fi
export SESSION_SECRET=$(cat ${sessionSecret})
SESSION_SECRET="$(cat $secret_file)"
export SESSION_SECRET
'';
custom.services.resticBackups.hedgedoc = lib.mkIf cfg.doBackups {

7
modules/system/services/radicale.nix
View file

@ -49,8 +49,6 @@ in
storage.hook =
let
createBirthdayCalendar = "${inputs.radicale-birthday-calendar}/create_birthday_calendar.py";
hookScript = pkgs.writeShellApplication {
name = "radicale-git-hook";
runtimeInputs = [
@ -64,9 +62,10 @@ in
))
];
text = ''
readonly username="$1"
username="$1"
create_birthday_calendar="${inputs.radicale-birthday-calendar}/create_birthday_calendar.py"
git status --porcelain | awk '{print $2}' | python3 ${createBirthdayCalendar}
git status --porcelain | awk '{print $2}' | python3 $create_birthday_calendar
git add -A
if ! git diff --cached --quiet; then

12
modules/system/services/restic-backups/healthchecks.nix
View file

@ -31,9 +31,15 @@ in
serviceConfig.Type = "oneshot";
scriptArgs = "%i";
script = ''
${lib.getExe pkgs.curl} --fail --silent --show-error --max-time 10 --retry 5 https://hc-ping.com/$(cat ${
config.sops.secrets."healthchecks/ping-key".path
})/$(echo $1 | tr _ /)
ping_key="$(cat ${config.sops.secrets."healthchecks/ping-key".path})"
slug="$(echo "$1" | tr _ /)"
${lib.getExe pkgs.curl} \
--fail \
--silent \
--show-error \
--max-time 10 \
--retry 5 "https://hc-ping.com/$ping_key/$slug"
'';
};
}