Rollover digital ocean auth token

machines/storage/s0/default.nix

@@ -262,6 +262,7 @@
     openMinimalFirewall = true;
   };
 
+  # TODO: setup backup
   services.vikunja = {
     enable = true;
     port = 61473;
@@ -271,6 +272,9 @@
       service.enableregistration = false;
     };
   };
+  backup.group."vikunja".paths = [
+    "/var/lib/vikunja"
+  ];
 
   boot.binfmt.emulatedSystems = [ "aarch64-linux" "armv7l-linux" ];
 }

machines/storage/s0/home-automation.nix

@@ -3,14 +3,14 @@
 {
   services.esphome.enable = true;
 
-  # TODO lock down
   services.mosquitto = {
     enable = true;
     listeners = [
       {
-        acl = [ "pattern readwrite #" ];
+        users.root = {
-        omitPasswordAuth = true;
+          acl = [ "readwrite #" ];
-        settings.allow_anonymous = true;
+          hashedPassword = "$7$101$8+QnkTzCdGizaKqq$lpU4o84n6D/1uwfA9pZDVExr1NDm1D/8tNla2tE9J9HdUqkvu192yYfiySY1MFqVNgUKgWEFu5P1bUKqRnzbUw==";
+        };
       }
     ];
   };
@@ -28,7 +28,8 @@
       };
       mqtt = {
         server = "mqtt://localhost:1883";
-        # base_topic = "zigbee2mqtt";
+        user = "root";
+        password = "'!/run/agenix/zigbee2mqtt.yaml mqtt_password'";
       };
       frontend = {
         host = "localhost";
@@ -36,6 +37,10 @@
       };
     };
   };
+  age.secrets."zigbee2mqtt.yaml" = {
+    file = ../../../secrets/zigbee2mqtt.yaml.age;
+    owner = "zigbee2mqtt";
+  };
 
   services.home-assistant = {
     enable = true;

machines/storage/s0/properties.nix

@@ -12,6 +12,7 @@
     "binary-cache"
     "gitea-actions-runner"
     "frigate"
+    "zigbee"
   ];
 
   hostKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAwiXcUFtAvZCayhu4+AIcF+Ktrdgv9ee/mXSIhJbp4q";

secrets/digitalocean-dns-credentials.age

@@ -1,11 +1,11 @@
 age-encryption.org/v1
--> ssh-ed25519 WBT1Hw wjZGPvilRXGZsC2+7dWm/Nbau8Allv29WwQCr0XSAWU
+-> ssh-ed25519 WBT1Hw TGdD8Nw+GPITDOXGhevSu+880DWET7WYN3nIyJ0xy2o
-uTOf/sokutOGDyc8fbTbBWXqCVQCFhGdHxwA6SXqhdA
+69xepRTnmaFwa4IsGJjDdwZqTSf5fz6EZK0/q3oz/ZA
--> ssh-ed25519 6AT2/g NU068qwqOWiKk0QwqP9vU4xJaND2OR4bo8xkmdWATgY
+-> ssh-ed25519 6AT2/g EmqXrXXsRxSS6AsH+7VMgoJTYo9eGj8ebLiLT4IWNxg
-uGd0sb5PH+rREn9pgLOFwk29CX66aPBQMvr4rBazylc
+eKs5/3tQMdg5bGJKNz8PFh9C7HiV+IlOU9dzpYcGIjo
--> ssh-ed25519 hPp1nw r2JRiZ7fsHPYDlte6Oh2Gx1KkugekFeeg3xSjziI+hQ
+-> ssh-ed25519 hPp1nw wsIF676is8FquF6oANNauPrumsMnfVUZpPeVKEtBOzQ
-xnO0gscMdR25mj5uAX7D42FCbCQhqbU0wkiLX4OmVqk
+qZR8LSF+TQ2K3K0An69NHfk53ZqNEWev0IVcb71SR40
--> ssh-ed25519 w3nu8g F03mPU63WwEs1SLUFErLOVCkARoggGIvvz9TFZfMOBY
+-> ssh-ed25519 w3nu8g TKHY/5JuzFMhbW9CQAOI3woX8M9b1H/XXUpIMT0Mylk
-HOdVA3xW9pqUPhclO6VueSfXg3ux06Ch3fucF6Vr4hM
+byJV0/BJ3ftG5eYv5BeyIYBi0VoWG31HRiENUxSeYE8
---- niyo231HPT/+2dzflP+zhYjL9XiWsk7svesCYdkU1jA
+--- fwHXHtE/sMLqCLSD8tR0oCPgNuif9Y/ncHU97hbf/Bw
-DÑØQî¬5–-ô@<40>¢¿—ßÐN5<4E> Ãÿ$Ø‚™’Çž…êÐ<C3AA>X=ŒHŽDÁ`P×5ZA´÷¼YóäÓ?¡é^[³1”6ÕK*mP݈ª­æ1æç÷ß›ƒ:$^ÑfDœ*î†ÿ“š-zi´"·Tàuÿüò
+f"+ÉŒqc<71>H†Ñjï!JSšË¡Ì|yMìðX¼þMl<4D>ýçCy™îUXn»Égk¨ë)¤óOY§uº„¦²¶g%è Håvn·œ5ô!$Jœ¤Š…¶›$<24>#Dö;±¥àÖ	}ÏŸcçKšˆ{R/

secrets/secrets.nix

@@ -57,4 +57,7 @@ with roles;
 
   # Frigate (DVR)
   "frigate-credentials.age".publicKeys = frigate;
+
+  # zigbee2mqtt secrets
+  "zigbee2mqtt.yaml.age".publicKeys = zigbee;
 }

secrets/zigbee2mqtt.yaml.age

@@ -0,0 +1,8 @@
+age-encryption.org/v1
+-> ssh-ed25519 hPp1nw TSDuPaFp/Qcz4r819X4QmU/4J2TGpoX7jCCJCdFDog0
+SwQUqEp45xMOeTkvBG6uX28kB8YWG66laYqakSgl9w4
+-> ssh-ed25519 w3nu8g tLZDNE0iBgOpUB3djpNu3CgimsRc0zcds+AgctzxyQ4
+Oyz6XORsApM4vFxWyaD3bR/ApIUFPY3q4yGvtbosUIY
+--- vuXlQmuOFbJhBTACN5ciH2GlOCbRCMPZdlogG2O+KOk
+Áëÿ!}UIì	p0@Xž|°þ#晆0HÙõò#BÇRR<52>Ù
+òùø5¾Iÿ?vX?pÝ<70>—<>fqÍ[lž¸˜xÏ­G7ü;UäÀOUä¶