Initial commit

modules/default.nix

@@ -0,0 +1,7 @@
+{
+  imports = [
+    ./sops.nix
+    ./vpn
+    ./users
+  ];
+}

modules/sops.nix

@@ -0,0 +1,26 @@
+{ lib, config, ... }:
+let
+  sops = config.maid.sops;
+in
+{
+  options = {
+    maid = {
+      sops = {
+        work.enable = lib.mkEnableOption "work secrets";
+        viendesu.enable = lib.mkEnableOption "VienDesu! secrets";
+      };
+    };
+  };
+
+  config.sops.secrets = lib.mkMerge [
+    (lib.mkIf sops.work.enable {
+      "work/vpn/ovpn" = {};
+      "work/vpn/shadowsocks" = {};
+      "work/vpn/password" = {};
+    })
+    (lib.mkIf sops.viendesu.enable {
+      "shadowsocks/gneg" = {};
+      "shadowsocks/yor" = {};
+    })
+  ];
+}

modules/users/default.nix

@@ -0,0 +1,5 @@
+{
+  imports = [
+    ./nero.nix
+  ];
+}

modules/users/nero.nix

@@ -0,0 +1,39 @@
+{ lib, config, ... }:
+let
+  types = lib.types;
+in
+{
+  options.maid.masters.nero = {
+    enable = lib.mkEnableOption "Nero user";
+    hashedPasswordFile = lib.mkOption {
+      type = types.str;
+    };
+    groups = lib.mkOption {
+      type = types.listOf types.str;
+      default = [ "wheel" "docker" "networkmanager" ];
+    };
+    uid = lib.mkOption {
+      type = types.int;
+      default = 1337;
+    };
+    authorizedKeys = lib.mkOption {
+      type = types.listOf lib.str;
+      default = [];
+    };
+  };
+
+  config = lib.mkIf config.maid.masters.nero.enable (
+    let
+      nero = config.maid.masters.nero;
+    in
+    {
+      users.users.nero = {
+        isNormalUser = true;
+        uid = nero.uid;
+        openssh.authorizedKeys.keys = nero.authorizedKeys;
+
+        hashedPasswordFile = nero.hashedPasswordFile;
+      };
+    }
+  );
+}

modules/vpn/default.nix

@@ -0,0 +1,5 @@
+{
+  imports = [
+    ./hft.nix
+  ];
+}

modules/vpn/hft.nix

@@ -0,0 +1,59 @@
+{ pkgs, lib, config, ... }:
+let
+  types = lib.types;
+in
+{
+  options.maid.vpn.hft = {
+    enable = lib.mkEnableOption "HFT-OpenVPN server";
+    shadowsocksConfigPath = lib.mkOption {
+      type = types.str;
+      description = "Shadowsocks config path";
+    };
+    name = lib.mkOption {
+      type = types.str;
+      description = "Name of the service";
+      default = "hft";
+    };
+    configPath = lib.mkOption {
+      type = types.str;
+      description = "OpenVPN configuration file";
+    };
+    passwordFile = lib.mkOption {
+      type = types.str;
+      description = "OpenVPN certificate password";
+    };
+    autoStart = lib.mkOption {
+      type = types.bool;
+      default = false;
+      description = "Whether to start VPN on system start or not";
+    };
+  };
+
+  config =
+    let
+      hft = config.vpn.hft;
+    in
+      lib.mkIf hft.enable {
+          services.openvpn.servers."${hft.name}" = {
+            autoStart = hft.autoStart;
+            updateResolvConf = true;
+
+            config = ''
+              config ${hft.configPath}
+              askpass ${hft.passwordFile}
+            '';
+          };
+
+          systemd.services."openvpn-${hft.name}-shadowsocks" = {
+            wantedBy = [ "openvpn-${hft.name}.service" ];
+            partOf = [ "openvpn-${hft.name}.service" ];
+            after = [ "network.target" ];
+
+            description = "Corporate shadowsocks";
+            serviceConfig = {
+              Type = "Simple";
+              ExecStart = ''${pkgs.shadowsocks-rust}/bin/sslocal --config ${hft.shadowsocksConfigPath}'';
+            };
+          };
+  };
+}