Common/syncthing: use key and cert from secrets

flake.lock

@@ -411,9 +411,26 @@
         "nixpkgs-unstable-raw": "nixpkgs-unstable-raw",
         "nur": "nur",
         "plasma-manager": "plasma-manager",
+        "secrets": "secrets",
         "vscode-extensions": "vscode-extensions"
       }
     },
+    "secrets": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1708347322,
+        "narHash": "sha256-30rLLNMGvVz8xbklqRpA3uE6UDneAUGFz7dCmH9YbA8=",
+        "ref": "refs/heads/main",
+        "rev": "409536f1d2b8ffe741fe47b8701ba28137f9de38",
+        "revCount": 3,
+        "type": "git",
+        "url": "http://git.everest.sable-pancake.ts.net/Toast/nix-secrets"
+      },
+      "original": {
+        "type": "git",
+        "url": "http://git.everest.sable-pancake.ts.net/Toast/nix-secrets"
+      }
+    },
     "systems": {
       "locked": {
         "lastModified": 1681028828,

flake.nix

@@ -2,6 +2,10 @@
 	description = "Configuration for Everest";
 
 	inputs = {
+		secrets = {
+			url = "git+http://git.everest.sable-pancake.ts.net/Toast/nix-secrets";
+			flake = false;
+		};
 		nixpkgs-raw.url = "nixpkgs/nixos-23.11";
 		nixpkgs-unstable-raw.url = "nixpkgs/nixos-unstable";
 

machines/WinMax2/hardware-configuration.nix

@@ -43,12 +43,12 @@ in
 			fsType = "btrfs";
 			options = [ "subvol=@" ];
 		};
-		/*"btrfs_boot" = {
-			mountPoint = "/boot";
+		"btrfs_persist" = {
+			mountPoint = "/persist";
 			label = ssdLabel;
 			fsType = "btrfs";
-			options = [ "subvol=@boot" ];
-		};*/
+			options = [ "subvol=@persist" ];
+		};
 		"btrfs_home" = {
 			mountPoint = "/home";
 			label = ssdLabel;

roles/common/configuration.nix

@@ -105,11 +105,7 @@
 	# Set up secrets
 	age = {
 		identityPaths = [ 
-			"/etc/ssh/ssh_host_rsa_key"
-			"/etc/ssh/ssh_host_ed25519_key"
-			# This key has a passcode, so if you need to use it you'll have to 
-			# enter the password A LOT of times. Only on the first setup tho
-			"/tmp/id_ed25519_bootstrap"
+			"/persist/id_host"
 		];
 	};
 

roles/common/services/syncthing.nix

@@ -1,7 +1,19 @@
-{ config, ... }:
+{ config, flakeSelf, ... }:
+
+let
+	hostSecrets = "${flakeSelf.inputs.secrets}/" + config.networking.hostName;
+in
 
 {
+	# Get secrets
+	age.secrets = {
+		syncthingKey.file = hostSecrets + "/syncthingKey.age";
+		syncthingCert.file = hostSecrets + "/syncthingCert.age";
+	};
+
 	services.syncthing = {
+		key = config.age.secrets.syncthingKey.path;
+		cert = config.age.secrets.syncthingCert.path;
 		overrideDevices = true;
 		overrideFolders = true;
 		openDefaultPorts = true;