Modules/Agenix: Add dockerhub credentials

home/christoph/default.nix

@@ -312,7 +312,7 @@
             # If this user defined any secrets...
             (builtins.hasAttr "${username}" nixosConfig.modules.agenix.secrets)
             # ...we will add them to the current secrets.nix,
-            # s.t. agenix can be used to encrypt the secret.
+            # s.t. agenix can be used to encrypt/access them.
             (builtins.concatStringsSep "\n"
               (builtins.map
                 (mkSecret publicKeys.${username}.ssh)

system/default.nix

@@ -25,6 +25,10 @@ with mylib.networking; {
   ];
 
   modules = {
+    agenix.secrets.${username} = [
+      "dockerhub-password"
+    ];
+
     bootloader = {
       enable = true;
 

system/modules/agenix/dockerhub-password.age

@@ -0,0 +1,5 @@
+age-encryption.org/v1
+-> ssh-ed25519 PW+5DQ z6Fm40D2nCJvvFsQdj9V4zcvVBpjFAvLZh17cEtLEx8
+hIyc+AUuEiIv6TobnNawdyEswAAQ4kQeh5n0yaVT/mY
+--- Yhxh9hnsPfHYcmmrpQm5Up0VzRh2ndoF3R3W+7ojW58
+b<><1D><><14>?<02><><EFBFBD> ̙Wc<57><63><EFBFBD><EFBFBD><EFBFBD><EFBFBD>R<EFBFBD><52><<3C>@<40>y<EFBFBD><79><EFBFBD><EFBFBD>1z%<25>4EWu<57>7	<09><<3C><><EFBFBD>'<27><>Cg9!<21>`cv

system/modules/agenix/options.nix

@@ -5,7 +5,7 @@
 }: {
   secrets = lib.mkOption {
     type = lib.types.attrs;
-    description = "The secret files managed by agenix (and their associated keys)";
+    description = "The secret files managed by agenix (encrypted by SSH key)";
     example = ''
       {
         christoph = [

system/services/0_TEMPLATE.nix

@@ -8,6 +8,15 @@
     image = "TEMPLATE";
     autoStart = true;
 
+    login = {
+      # Uses DockerHub by default
+      # registry = "";
+
+      # DockerHub Credentials
+      username = "christoph.urlacher@protonmail.com";
+      passwordFile = "${config.age.secrets.dockerhub-pasword.path}";
+    };
+
     dependsOn = [];
 
     ports = [];

system/services/adguard.nix

@@ -8,6 +8,15 @@
     image = "adguard/adguardhome";
     autoStart = true;
 
+    login = {
+      # Uses DockerHub by default
+      # registry = "";
+
+      # DockerHub Credentials
+      username = "christoph.urlacher@protonmail.com";
+      passwordFile = "${config.age.secrets.dockerhub-pasword.path}";
+    };
+
     dependsOn = [];
 
     ports = [

system/services/authelia.nix

@@ -8,6 +8,15 @@
     image = "authelia/authelia:latest";
     autoStart = true;
 
+    login = {
+      # Uses DockerHub by default
+      # registry = "";
+
+      # DockerHub Credentials
+      username = "christoph.urlacher@protonmail.com";
+      passwordFile = "${config.age.secrets.dockerhub-pasword.path}";
+    };
+
     dependsOn = [
       # "pihole"
     ];

system/services/formula10.nix

@@ -8,6 +8,15 @@
     image = "gitea.vps.chriphost.de/christoph/formula10:latest";
     autoStart = true;
 
+    # login = {
+    #   # Uses DockerHub by default
+    #   # registry = "";
+    #
+    #   # DockerHub Credentials
+    #   username = "christoph.urlacher@protonmail.com";
+    #   passwordFile = "${config.age.secrets.dockerhub-pasword.path}";
+    # };
+
     dependsOn = [];
 
     ports = [

system/services/formula11.nix

@@ -8,6 +8,15 @@
     image = "gitea.vps.chriphost.de/christoph/pocketbase:0.25.0";
     autoStart = true;
 
+    # login = {
+    #   # Uses DockerHub by default
+    #   # registry = "";
+    #
+    #   # DockerHub Credentials
+    #   username = "christoph.urlacher@protonmail.com";
+    #   passwordFile = "${config.age.secrets.dockerhub-pasword.path}";
+    # };
+
     dependsOn = [
       # "pihole"
     ];
@@ -32,6 +41,15 @@
     image = "gitea.vps.chriphost.de/christoph/formula11:latest";
     autoStart = true;
 
+    # login = {
+    #   # Uses DockerHub by default
+    #   # registry = "";
+    #
+    #   # DockerHub Credentials
+    #   username = "christoph.urlacher@protonmail.com";
+    #   passwordFile = "${config.age.secrets.dockerhub-pasword.path}";
+    # };
+
     dependsOn = [
       "formula11_pocketbase"
     ];
@@ -51,10 +69,10 @@
       # PB_PROTOCOL="https";
       # PB_URL="f11pb.vps.chriphost.de";
 
-      PUBLIC_PBURL="https://f11pb.vps.chriphost.de";
+      PUBLIC_PBURL = "https://f11pb.vps.chriphost.de";
 
       # Required by SvelteKit to prevent cross-site POST errors
-      ORIGIN="https://f11.vps.chriphost.de";
+      ORIGIN = "https://f11.vps.chriphost.de";
     };
 
     extraOptions = [

system/services/gitea-runner.nix

@@ -8,6 +8,15 @@
     image = "gitea/act_runner:latest"; # NOTE: vegardit has other runner images
     autoStart = true;
 
+    login = {
+      # Uses DockerHub by default
+      # registry = "";
+
+      # DockerHub Credentials
+      username = "christoph.urlacher@protonmail.com";
+      passwordFile = "${config.age.secrets.dockerhub-pasword.path}";
+    };
+
     dependsOn = [];
 
     ports = [];

system/services/gitea.nix

@@ -23,6 +23,15 @@
     image = "postgres:14";
     autoStart = true;
 
+    login = {
+      # Uses DockerHub by default
+      # registry = "";
+
+      # DockerHub Credentials
+      username = "christoph.urlacher@protonmail.com";
+      passwordFile = "${config.age.secrets.dockerhub-pasword.path}";
+    };
+
     dependsOn = [];
 
     ports = [];
@@ -46,6 +55,15 @@
     image = "gitea/gitea:latest";
     autoStart = true;
 
+    login = {
+      # Uses DockerHub by default
+      # registry = "";
+
+      # DockerHub Credentials
+      username = "christoph.urlacher@protonmail.com";
+      passwordFile = "${config.age.secrets.dockerhub-pasword.path}";
+    };
+
     dependsOn = [
       "gitea-db"
     ];

system/services/heidi.nix

@@ -8,6 +8,15 @@
     image = "gitea.vps.chriphost.de/christoph/discord-heidi:latest";
     autoStart = true;
 
+    # login = {
+    #   # Uses DockerHub by default
+    #   # registry = "";
+    #
+    #   # DockerHub Credentials
+    #   username = "christoph.urlacher@protonmail.com";
+    #   passwordFile = "${config.age.secrets.dockerhub-pasword.path}";
+    # };
+
     dependsOn = [];
 
     ports = [];

system/services/immich.nix

@@ -8,6 +8,15 @@
     image = "ghcr.io/immich-app/postgres:15-vectorchord0.3.0-pgvectors0.2.0";
     autoStart = true;
 
+    # login = {
+    #   # Uses DockerHub by default
+    #   # registry = "";
+    #
+    #   # DockerHub Credentials
+    #   username = "christoph.urlacher@protonmail.com";
+    #   passwordFile = "${config.age.secrets.dockerhub-pasword.path}";
+    # };
+
     dependsOn = [];
 
     ports = [
@@ -33,6 +42,15 @@
     image = "redis";
     autoStart = true;
 
+    login = {
+      # Uses DockerHub by default
+      # registry = "";
+
+      # DockerHub Credentials
+      username = "christoph.urlacher@protonmail.com";
+      passwordFile = "${config.age.secrets.dockerhub-pasword.path}";
+    };
+
     dependsOn = [];
 
     ports = [
@@ -52,6 +70,15 @@
     image = "ghcr.io/imagegenius/immich:latest";
     autoStart = true;
 
+    # login = {
+    #   # Uses DockerHub by default
+    #   # registry = "";
+    #
+    #   # DockerHub Credentials
+    #   username = "christoph.urlacher@protonmail.com";
+    #   passwordFile = "${config.age.secrets.dockerhub-pasword.path}";
+    # };
+
     dependsOn = [
       "immich-database"
       "immich-redis"

system/services/jellyfin.nix

@@ -8,6 +8,15 @@
     image = "linuxserver/jellyfin:latest";
     autoStart = true;
 
+    login = {
+      # Uses DockerHub by default
+      # registry = "";
+
+      # DockerHub Credentials
+      username = "christoph.urlacher@protonmail.com";
+      passwordFile = "${config.age.secrets.dockerhub-pasword.path}";
+    };
+
     dependsOn = [
       # "pihole"
     ];

system/services/kopia.nix

@@ -8,6 +8,15 @@
     image = "kopia/kopia:latest";
     autoStart = true;
 
+    login = {
+      # Uses DockerHub by default
+      # registry = "";
+
+      # DockerHub Credentials
+      username = "christoph.urlacher@protonmail.com";
+      passwordFile = "${config.age.secrets.dockerhub-pasword.path}";
+    };
+
     dependsOn = [];
 
     ports = [

system/services/nextcloud.nix

@@ -4,10 +4,41 @@
   pkgs,
   ...
 }: {
+  systemd.services.nextcloud-cron = {
+    enable = true;
+    description = "Nextcloud Cron Job";
+
+    serviceConfig = {
+      ExecStart = "${pkgs.docker}/bin/docker exec -u www-data nextcloud /usr/local/bin/php -f /var/www/html/cron.php";
+    };
+  };
+
+  systemd.timers.nextcloud-cron = {
+    enable = true;
+    description = "Nextcloud Cron Job";
+
+    timerConfig = {
+      OnBootSec = "5min";
+      OnUnitActiveSec = "5min";
+      Unit = "nextcloud-cron.service";
+    };
+
+    wantedBy = ["timers.target"];
+  };
+
   virtualisation.oci-containers.containers.nextcloud-db = {
     image = "postgres:alpine";
     autoStart = true;
 
+    login = {
+      # Uses DockerHub by default
+      # registry = "";
+
+      # DockerHub Credentials
+      username = "christoph.urlacher@protonmail.com";
+      passwordFile = "${config.age.secrets.dockerhub-pasword.path}";
+    };
+
     dependsOn = [];
 
     ports = [
@@ -33,6 +64,15 @@
     image = "redis:alpine";
     autoStart = true;
 
+    login = {
+      # Uses DockerHub by default
+      # registry = "";
+
+      # DockerHub Credentials
+      username = "christoph.urlacher@protonmail.com";
+      passwordFile = "${config.age.secrets.dockerhub-pasword.path}";
+    };
+
     dependsOn = [];
 
     ports = [
@@ -54,6 +94,15 @@
     image = "nextcloud:apache";
     autoStart = true;
 
+    login = {
+      # Uses DockerHub by default
+      # registry = "";
+
+      # DockerHub Credentials
+      username = "christoph.urlacher@protonmail.com";
+      passwordFile = "${config.age.secrets.dockerhub-pasword.path}";
+    };
+
     dependsOn = [
       "nextcloud-db"
       "nextcloud-memcache"
@@ -101,26 +150,4 @@
       "--net=behind-nginx"
     ];
   };
-
-  systemd.services.nextcloud-cron = {
-    enable = true;
-    description = "Nextcloud Cron Job";
-    
-    serviceConfig = {
-      ExecStart = "${pkgs.docker}/bin/docker exec -u www-data nextcloud /usr/local/bin/php -f /var/www/html/cron.php";
-    };
-  };
-
-  systemd.timers.nextcloud-cron = {
-    enable = true;
-    description = "Nextcloud Cron Job";
-
-    timerConfig = {
-      OnBootSec = "5min";
-      OnUnitActiveSec = "5min";
-      Unit = "nextcloud-cron.service";
-    };
-
-    wantedBy = ["timers.target"];
-  };
 }

system/services/nginx-proxy-manager.nix

@@ -8,6 +8,15 @@
     image = "jc21/nginx-proxy-manager:latest";
     autoStart = true;
 
+    login = {
+      # Uses DockerHub by default
+      # registry = "";
+
+      # DockerHub Credentials
+      username = "christoph.urlacher@protonmail.com";
+      passwordFile = "${config.age.secrets.dockerhub-pasword.path}";
+    };
+
     dependsOn = [
       # "pihole"
     ];

system/services/paperless.nix

@@ -5,9 +5,18 @@
   ...
 }: {
   virtualisation.oci-containers.containers.paperless-redis = {
-    image = "docker.io/library/redis:7";
+    image = "redis:7";
     autoStart = true;
 
+    login = {
+      # Uses DockerHub by default
+      # registry = "";
+
+      # DockerHub Credentials
+      username = "christoph.urlacher@protonmail.com";
+      passwordFile = "${config.age.secrets.dockerhub-pasword.path}";
+    };
+
     dependsOn = [];
 
     ports = [];
@@ -24,9 +33,18 @@
   };
 
   virtualisation.oci-containers.containers.paperless-postgres = {
-    image = "docker.io/library/postgres:15";
+    image = "postgres:15";
     autoStart = true;
 
+    login = {
+      # Uses DockerHub by default
+      # registry = "";
+
+      # DockerHub Credentials
+      username = "christoph.urlacher@protonmail.com";
+      passwordFile = "${config.age.secrets.dockerhub-pasword.path}";
+    };
+
     dependsOn = [];
 
     ports = [];
@@ -50,6 +68,15 @@
     image = "ghcr.io/paperless-ngx/paperless-ngx:latest";
     autoStart = true;
 
+    # login = {
+    #   # Uses DockerHub by default
+    #   # registry = "";
+    #
+    #   # DockerHub Credentials
+    #   username = "christoph.urlacher@protonmail.com";
+    #   passwordFile = "${config.age.secrets.dockerhub-pasword.path}";
+    # };
+
     dependsOn = [
       "paperless-redis"
       "paperless-postgres"

system/services/portainer.nix

@@ -32,6 +32,15 @@
     image = "portainer/agent:latest";
     autoStart = true;
 
+    login = {
+      # Uses DockerHub by default
+      # registry = "";
+
+      # DockerHub Credentials
+      username = "christoph.urlacher@protonmail.com";
+      passwordFile = "${config.age.secrets.dockerhub-pasword.path}";
+    };
+
     dependsOn = [];
 
     ports = [

system/services/whats-up-docker.nix

@@ -8,6 +8,15 @@
     image = "getwud/wud:latest";
     autoStart = true;
 
+    login = {
+      # Uses DockerHub by default
+      # registry = "";
+
+      # DockerHub Credentials
+      username = "christoph.urlacher@protonmail.com";
+      passwordFile = "${config.age.secrets.dockerhub-pasword.path}";
+    };
+
     dependsOn = [
       # "pihole"
     ];