From bf009cbcdd636256a6a6632f4c0bb72434cf4b81 Mon Sep 17 00:00:00 2001 From: Yisroel Baum Date: Thu, 2 Jul 2026 11:51:07 +0300 Subject: [PATCH 1/3] configure rabbi gerzi --- .sops.yaml | 4 ++++ flake.nix | 30 ++++++++++++++++++++---------- rabbi-gerzi.nix | 34 ++++++++++++++++++++++++++++++++++ secrets/README.md | 10 ++++++++++ 4 files changed, 68 insertions(+), 10 deletions(-) create mode 100644 rabbi-gerzi.nix diff --git a/.sops.yaml b/.sops.yaml index a57ed0d..b8e34d6 100644 --- a/.sops.yaml +++ b/.sops.yaml @@ -5,3 +5,7 @@ creation_rules: key_groups: - age: - *server + - path_regex: secrets/rabbi-gerzi\.env$ + key_groups: + - age: + - *server diff --git a/flake.nix b/flake.nix index 71124a5..3921e65 100644 --- a/flake.nix +++ b/flake.nix @@ -20,6 +20,10 @@ url = "git+https://git.yisroelbaum.com/yisroelbaum/MyResume"; inputs.nixpkgs.follows = "nixpkgs"; }; + rabbi-gerzi = { + url = "git+https://git.yisroelbaum.com/yisroelbaum/Rabbi_Gerzi"; + inputs.nixpkgs.follows = "nixpkgs"; + }; }; outputs = @@ -30,20 +34,24 @@ sops-nix, tide, resume, + rabbi-gerzi, ... }: let system = "x86_64-linux"; domainName = "yisroelbaum.com"; - in { + in + { nixosConfigurations.nixos = nixpkgs.lib.nixosSystem { modules = [ ./configuration.nix ./discourse.nix ./tide.nix + ./rabbi-gerzi.nix home-manager.nixosModules.home-manager sops-nix.nixosModules.sops tide.nixosModules.tide + rabbi-gerzi.nixosModules.default { home-manager.useGlobalPkgs = true; home-manager.useUserPackages = true; @@ -52,14 +60,16 @@ ]; specialArgs = { inherit domainName resume; }; }; - devShells."${system}".default = let - pkgs = import nixpkgs { inherit system; }; - in pkgs.mkShell { - buildInputs = with pkgs; [ - nixos-rebuild - sops - age - ]; - }; + devShells."${system}".default = + let + pkgs = import nixpkgs { inherit system; }; + in + pkgs.mkShell { + buildInputs = with pkgs; [ + nixos-rebuild + sops + age + ]; + }; }; } diff --git a/rabbi-gerzi.nix b/rabbi-gerzi.nix new file mode 100644 index 0000000..ad5f676 --- /dev/null +++ b/rabbi-gerzi.nix @@ -0,0 +1,34 @@ +{ + config, + domainName, + ... +}: +{ + services.rabbi-gerzi = { + enable = true; + frontend = { + hostName = "rabbigerzi.${domainName}"; + nginx = { + forceSSL = true; + enableACME = true; + }; + }; + backend = { + hostName = "rabbigerziapi.${domainName}"; + environmentFile = config.sops.secrets."rabbi-gerzi-env".path; + nginx = { + forceSSL = true; + enableACME = true; + }; + }; + }; + + sops.secrets."rabbi-gerzi-env" = { + sopsFile = ./secrets/rabbi-gerzi.env; + format = "dotenv"; + key = ""; + mode = "0400"; + owner = config.services.rabbi-gerzi.user; + group = config.services.rabbi-gerzi.group; + }; +} diff --git a/secrets/README.md b/secrets/README.md index d923746..5350e1a 100644 --- a/secrets/README.md +++ b/secrets/README.md @@ -21,3 +21,13 @@ host's age key. `tide.yaml` is encrypted and committed. `tide.yaml.example` is the plaintext template. + +## Rabbi Gerzi + +Create `rabbi-gerzi.env` as a SOPS-encrypted dotenv file with: + +```dotenv +APP_KEY=base64:... +RABBI_GERZI_INITIAL_ADMIN_EMAIL=... +RABBI_GERZI_INITIAL_ADMIN_PASSWORD=... +``` From 005072fcaadd097916f1de11df6700e6eb756c9c Mon Sep 17 00:00:00 2001 From: Yisroel Baum Date: Thu, 2 Jul 2026 16:22:55 +0300 Subject: [PATCH 2/3] add rabbi gerzi secrets --- secrets/rabbi-gerzi.env | 9 +++++++++ 1 file changed, 9 insertions(+) create mode 100644 secrets/rabbi-gerzi.env diff --git a/secrets/rabbi-gerzi.env b/secrets/rabbi-gerzi.env new file mode 100644 index 0000000..0a29861 --- /dev/null +++ b/secrets/rabbi-gerzi.env @@ -0,0 +1,9 @@ +APP_KEY=ENC[AES256_GCM,data:oBfwwZoeClMagCYNCtKVHr/PHtwGJedwCxOQx59lRx2axbAF7EkhguwgSGDfDTlde2K/,iv:PRjJ5umGKokJ9aeJByNW4UQx2f41mPTCLaYatrfuMZo=,tag:v2B+hbh0KEtIy/ZSuj7nQw==,type:str] +RABBI_GERZI_INITIAL_ADMIN_EMAIL=ENC[AES256_GCM,data:DLzOu5WRYbIZRMheNIRJxRQ6U9A=,iv:ql+WFYHCK6La48azvyqOYoAPBX4kjVTjCl+9S9ynRXo=,tag:R6T98nWiIWQ8YDzsW0CqfA==,type:str] +RABBI_GERZI_INITIAL_ADMIN_PASSWORD=ENC[AES256_GCM,data:5R/YEeYAgKHCNCp5pVTEkTia1KoXTCFOrw+aOfJQmNs=,iv:a+39JK/CYE0z+yYrhI6uXEypPErkpFTot05h1Ue4xUY=,tag:ATAl3qfWQ25E0okdPgvLTg==,type:str] +sops_age__list_0__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSByRndjT3VrTk5vM2daOHdC\nNS8yUXJNcG9uQzBJL3J3K3k3M2NxMUxTTVJJCkhrSTMyWDdJa0xhVmZzbVNCMXNC\nc0lTdTFVU2M3bzFBMDJOM3JpSG14alEKLS0tIDFac3pqbi9rK0FHRklsa2xNRTNX\nS0Q0NXRubXVWRytSSjFVYlI3R2FyU3cKqV5N6ap5lobx9jZexWi/GswKLb4ytAMW\nB3/VA8eeVz9Wuvim0TtiN0UB9oqsBjnbnekJa0Y4tdvwRQhr2AuOxw==\n-----END AGE ENCRYPTED FILE-----\n +sops_age__list_0__map_recipient=age1haj8v88kjna6ttkdufjpyjcf478kyvclnpdc8jwh97ewhqcc9eqsgrku4v +sops_lastmodified=2026-07-02T13:22:18Z +sops_mac=ENC[AES256_GCM,data:3X46T+cx+cG3Zjq8QecbVa4/inJACFnJpMCtL/BWTaz6zDGD1TdkFORiD9z7IKMV3dbCgvve3pOatDkMYmfiWdFgW8wsIlKHHQhz58Eq5WZMHfXNKLykdEix0nGb2RGFdq6d3xaCyc6slJuhpo8uxzDoOHE9FkmdGdAC+NSkWvY=,iv:r6xHAWbldo4yar7YY/WZhw/NX5a4KJS+CWKCUkd+Z0U=,tag:4RIJcaoXZjkYHtkmphEPXA==,type:str] +sops_unencrypted_suffix=_unencrypted +sops_version=3.12.2 From d7d396c6bdbd7a9e02050295060e93bee1132a84 Mon Sep 17 00:00:00 2001 From: Yisroel Baum Date: Thu, 2 Jul 2026 16:23:09 +0300 Subject: [PATCH 3/3] add rabbi gerzi to flake lock --- flake.lock | 57 +++++++++++++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 56 insertions(+), 1 deletion(-) diff --git a/flake.lock b/flake.lock index d746903..3f38e18 100644 --- a/flake.lock +++ b/flake.lock @@ -36,6 +36,27 @@ "type": "github" } }, + "rabbi-gerzi": { + "inputs": { + "nixpkgs": [ + "nixpkgs" + ], + "utils": "utils" + }, + "locked": { + "lastModified": 1782998088, + "narHash": "sha256-FBh/n9Z5V3pBzYzTpCYXbmtNXiopZDOpaUcL3292ZLM=", + "ref": "refs/heads/master", + "rev": "b1281be699d2d75b1f25ecd5cf11d7204bf4c237", + "revCount": 349, + "type": "git", + "url": "https://git.yisroelbaum.com/yisroelbaum/Rabbi_Gerzi" + }, + "original": { + "type": "git", + "url": "https://git.yisroelbaum.com/yisroelbaum/Rabbi_Gerzi" + } + }, "resume": { "inputs": { "nixpkgs": [ @@ -60,6 +81,7 @@ "inputs": { "home-manager": "home-manager", "nixpkgs": "nixpkgs", + "rabbi-gerzi": "rabbi-gerzi", "resume": "resume", "sops-nix": "sops-nix", "tide": "tide" @@ -100,12 +122,27 @@ "type": "github" } }, + "systems_2": { + "locked": { + "lastModified": 1681028828, + "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=", + "owner": "nix-systems", + "repo": "default", + "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e", + "type": "github" + }, + "original": { + "owner": "nix-systems", + "repo": "default", + "type": "github" + } + }, "tide": { "inputs": { "nixpkgs": [ "nixpkgs" ], - "utils": "utils" + "utils": "utils_2" }, "locked": { "lastModified": 1778485449, @@ -138,6 +175,24 @@ "repo": "flake-utils", "type": "github" } + }, + "utils_2": { + "inputs": { + "systems": "systems_2" + }, + "locked": { + "lastModified": 1731533236, + "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=", + "owner": "numtide", + "repo": "flake-utils", + "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b", + "type": "github" + }, + "original": { + "owner": "numtide", + "repo": "flake-utils", + "type": "github" + } } }, "root": "root",