mod: added env files to systemd services

flake.nix

@@ -187,32 +187,6 @@
       ];
     };
 
-    # Vintage story server - for a friend
-    nixosConfigurations."raubahn" = nixpkgs.lib.nixosSystem {
-      system = "x86_64-linux";
-      specialArgs = {
-        inherit userName userEmail nur;
-        hostname = "raubahn";
-        role = "server";
-      };
-      modules = [
-        myOverlays
-        ./modules/common
-        ./modules/machine/raubahn
-
-        home-manager.nixosModules.home-manager
-        {
-          home-manager.useGlobalPkgs = true;
-          home-manager.useUserPackages = true;
-          home-manager.extraSpecialArgs = extraSpecialArgs // { isNixOS = true; role = "server"; };
-          home-manager.backupFileExtension = "bak";
-          home-manager.users.${userName}.imports = [
-            ./home
-          ];
-        }
-      ];
-    };
-
     # Matrix and Mastodon server
     nixosConfigurations."yshtola" = nixpkgs.lib.nixosSystem {
       system = "x86_64-linux";

modules/desktop/default.nix

@@ -1,171 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}: let
-  cfg = config.desktop;
-
-  defaultWaylandPackages = with pkgs; [
-    brightnessctl
-    cliphist
-    foot
-    grim
-    libnotify
-    mako
-    networkmanagerapplet
-    playerctl
-    polkit_gnome
-    pavucontrol
-    rofi
-    slurp
-    waybar
-    wl-clipboard
-    xdg-utils
-  ];
-
-  defaultSwayPackages =
-    defaultWaylandPackages
-    ++ (with pkgs; [
-      pulseaudio
-      swayidle
-      swaylock
-      wmenu
-    ]);
-
-  resolvedDisplayManager =
-    if cfg.displayManager != "auto"
-    then cfg.displayManager
-    else if cfg.gnome.enable
-    then "gdm"
-    else if cfg.xfce.enable
-    then "lightdm"
-    else "none";
-in {
-  options.desktop = {
-    displayManager = lib.mkOption {
-      type = lib.types.enum ["auto" "none" "gdm" "lightdm" "ly"];
-      default = "auto";
-      description = ''
-        Display manager to enable. In auto mode, GDM is used when GNOME is
-        enabled, LightDM is used when XFCE is enabled, and no display manager
-        is enabled for compositor-only configurations.
-      '';
-    };
-
-    gnome.enable = lib.mkEnableOption "the vanilla GNOME desktop environment";
-
-    xfce.enable = lib.mkEnableOption "the vanilla XFCE desktop environment";
-
-    sway = {
-      enable = lib.mkEnableOption "the Sway Wayland compositor";
-
-      extraPackages = lib.mkOption {
-        type = with lib.types; listOf package;
-        default = defaultSwayPackages;
-        defaultText = lib.literalExpression ''
-          with pkgs; [
-            brightnessctl
-            cliphist
-            foot
-            grim
-            libnotify
-            mako
-            networkmanagerapplet
-            playerctl
-            polkit_gnome
-            pulseaudio
-            pavucontrol
-            rofi
-            slurp
-            swayidle
-            swaylock
-            waybar
-            wl-clipboard
-            wmenu
-            xdg-utils
-          ]
-        '';
-        description = "Packages installed alongside Sway.";
-      };
-    };
-
-    hyprland = {
-      enable = lib.mkEnableOption "the Hyprland Wayland compositor";
-
-      extraPackages = lib.mkOption {
-        type = with lib.types; listOf package;
-        default = defaultWaylandPackages;
-        defaultText = lib.literalExpression ''
-          with pkgs; [
-            brightnessctl
-            cliphist
-            foot
-            grim
-            libnotify
-            mako
-            networkmanagerapplet
-            playerctl
-            polkit_gnome
-            pavucontrol
-            rofi
-            slurp
-            waybar
-            wl-clipboard
-            xdg-utils
-          ]
-        '';
-        description = ''
-          Packages installed alongside Hyprland. Hyprlock and Hypridle are
-          enabled separately so their NixOS integration, including PAM, is
-          configured as well.
-        '';
-      };
-    };
-  };
-
-  config = lib.mkMerge [
-    (lib.mkIf cfg.gnome.enable {
-      services.desktopManager.gnome.enable = true;
-    })
-
-    (lib.mkIf cfg.xfce.enable {
-      services.xserver = {
-        enable = true;
-        desktopManager.xfce.enable = true;
-      };
-    })
-
-    (lib.mkIf cfg.sway.enable {
-      programs.sway = {
-        enable = true;
-        wrapperFeatures.gtk = true;
-        extraPackages = cfg.sway.extraPackages;
-      };
-    })
-
-    (lib.mkIf cfg.hyprland.enable {
-      programs = {
-        hyprland.enable = true;
-        hyprlock.enable = lib.mkDefault true;
-      };
-
-      environment.systemPackages = cfg.hyprland.extraPackages;
-    })
-
-    (lib.mkIf (resolvedDisplayManager == "gdm") {
-      services.displayManager.gdm.enable = true;
-    })
-
-    (lib.mkIf (resolvedDisplayManager == "lightdm") {
-      services.xserver = {
-        enable = true;
-        displayManager.lightdm.enable = true;
-      };
-    })
-
-    (lib.mkIf (resolvedDisplayManager == "ly") {
-      services.displayManager.ly.enable = true;
-    })
-  ];
-}

modules/machine/estinien/configuration.nix

@@ -5,6 +5,7 @@
   ...
 }: let
     hildibrand = nur.packages.${pkgs.stdenv.hostPlatform.system}.hildibrand;
+    caitsith = nur.packages.${pkgs.stdenv.hostPlatform.system}.caitsith;
   in {
   imports = [
     ../../pwrMgmt
@@ -56,6 +57,7 @@
 
   environment.systemPackages = [
     hildibrand
+    caitsith
   ];
 
   systemd.services.hildibrand = {
@@ -69,6 +71,22 @@
       ExecStart = "${hildibrand}/bin/hildebrand";
       Restart = "on-failure";
       RestartSec = "5s";
+      EnvironmentFile = "/etc/secrets/hildibrand.env";
+    };
+  };
+
+  systemd.services.caitsith = {
+    description = "Caitsith - a randomizer bot";
+    wantedBy = [ "multi-user.target" ];
+    after = [ "network.target" ];
+    serviceConfig = {
+      Type = "simple";
+      User = userName;
+      WorkingDirectory = "/home/${userName}";
+      ExecStart = "${caitsith}/bin/hildebrand";
+      Restart = "on-failure";
+      RestartSec = "5s";
+      EnvironmentFile = "/etc/secrets/caitsith.env";
     };
   };
 

modules/machine/raubahn/configuration.nix

@@ -1,105 +0,0 @@
-{
-  pkgs,
-  userName,
-  nur,
-  ...
-}: {
-  imports = [
-    ../../pwrMgmt
-    ../../networking/core.nix
-    ../../virtualization/podman.nix
-  ];
-
-  # Enable flakes for NixOS
-  nix.settings.experimental-features = ["nix-command" "flakes"];
-
-  # Custom kernel/boot stuff
-  boot.kernelPackages = pkgs.linuxPackages_latest;
-  boot.loader.systemd-boot.enable = true;
-  boot.loader.efi.canTouchEfiVariables = true;
-
-  # Set your timezone
-  time.timeZone = "America/Detroit";
-
-  # Enable OpenSSH
-  services.openssh.enable = true;
-
-  # Enable keyring
-  services.gnome.gnome-keyring.enable = true;
-
-  # Enable GnuPG
-  programs.gnupg.agent = {
-    enable = true;
-    enableSSHSupport = true;
-  };
-
-  # Enable SUID wrappers (some programs need them)
-  programs.mtr.enable = true;
-
-  # Enable Polkit
-  security.polkit.enable = true;
-
-  # Power management (see ../../pwrMgmt/default.nix)
-  pwrMgmt = {
-    enable = true;
-    cpuFreqGovernor = "performance";
-    powertop.enable = false;
-  };
-
-  network = {
-    firewall = {
-      enable = true;
-      tcpPorts = {
-        allowedPorts = [ 42420 ];
-      };
-      udpPorts = {
-        allowedPorts = [ 42420 ];
-      };
-    };
-    networkManager.enable = true;
-  };
-
-  environment.systemPackages = [
-    nur.packages.${pkgs.system}.vintage-story
-  ];
-
-  systemd.services.vintagestory-server = {
-    description = "Vintage Story Server";
-    wantedBy = [ "multi-user.target" ];
-    after = [ "network.target" ];
-    serviceConfig = {
-      Type = "simple";
-      User = userName;
-      WorkingDirectory = "/home/${userName}";
-      ExecStart = "${nur.packages.${pkgs.system}.vintage-story}/bin/vintagestory-server";
-      Restart = "on-failure";
-      RestartSec = "5s";
-    };
-  };
-
-  # Add username to groups "wheel" and "video" - more may be added here later
-  users = {
-    users = {
-      ${userName} = {
-        extraGroups = [ "wheel" "network" ];
-        openssh.authorizedKeys.keys = [
-          "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFV9eSc9L+aJLoKoexq2f/jb5rpyZnhuGiyhS8YQAbaS wyatt@wyattjmiller.com"
-          "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO4WKvKnnYpTbzZHFEslOKyfiiMqWxhW3AfX6E7ACmYU wyatt@wyattjmiller.com"
-        ];
-      };
-    };
-  };
-
-  services.fail2ban = {
-    enable = true;
-    package = pkgs.fail2ban;
-    maxretry = 5;
-    bantime = "3h";
-    bantime-increment = {
-      enable = true;
-      rndtime = "10m";
-    };
-  };
-
-  system.stateVersion = "24.11";
-}

modules/machine/raubahn/default.nix

@@ -1,6 +0,0 @@
-{ ... }: {
-  imports = [
-    ./configuration.nix
-    ./hardware-configuration.nix
-  ];
-}

modules/machine/raubahn/hardware-configuration.nix

@@ -1,32 +0,0 @@
-# Do not modify this file!  It was generated by ‘nixos-generate-config’
-# and may be overwritten by future invocations.  Please make changes
-# to /etc/nixos/configuration.nix instead.
-{ config, lib, pkgs, modulesPath, ... }:
-
-{
-  imports =
-    [ (modulesPath + "/profiles/qemu-guest.nix")
-    ];
-
-  boot.initrd.availableKernelModules = [ "ahci" "xhci_pci" "virtio_pci" "virtio_scsi" "sr_mod" "virtio_blk" ];
-  boot.initrd.kernelModules = [ ];
-  boot.kernelModules = [ "kvm-intel" ];
-  boot.extraModulePackages = [ ];
-
-  fileSystems."/" =
-    { device = "/dev/disk/by-uuid/ec4c43ec-efcc-40ea-a4c8-411e60ee7c4e";
-      fsType = "ext4";
-    };
-
-  fileSystems."/boot" =
-    { device = "/dev/disk/by-uuid/140E-FE19";
-      fsType = "vfat";
-      options = [ "fmask=0022" "dmask=0022" ];
-    };
-
-  swapDevices =
-    [ { device = "/dev/disk/by-uuid/547bbd78-85be-4d17-a519-c4a2a923bdab"; }
-    ];
-
-  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
-}