jet/noisebell
jet/noisebell
1
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat: update age configuration to be inside

Browse source
This commit is contained in:
Jet 2026-03-17 03:51:07 -07:00
parent 773c14e32f
commit fc2aacd460
No known key found for this signature in database
9 changed files with 187 additions and 191 deletions
Download patch file Download diff file Expand all files Collapse all files

11
pi/configuration.nix
View file

@ -20,17 +20,16 @@
};
# Decrypted at runtime by agenix
age.secrets.tailscale-auth-key.file = ./secrets/tailscale-auth-key.age;
age.secrets.api-key.file = ./secrets/api-key.age;
age.secrets.inbound-api-key.file = ./secrets/inbound-api-key.age;
age.secrets.tailscale-auth-key.file = ../secrets/tailscale-auth-key.age;
age.secrets.pi-to-cache-key.file = ../secrets/pi-to-cache-key.age;
age.secrets.cache-to-pi-key.file = ../secrets/cache-to-pi-key.age;
services.noisebell = {
enable = true;
port = 80;
endpointUrl = "https://noisebell.extremist.software/webhook";
apiKeyFile = config.age.secrets.api-key.path;
inboundApiKeyFile = config.age.secrets.inbound-api-key.path;
apiKeyFile = config.age.secrets.pi-to-cache-key.path;
inboundApiKeyFile = config.age.secrets.cache-to-pi-key.path;
};
nix.settings.experimental-features = [ "nix-command" "flakes" ];

160
pi/flake.nix
View file

@ -1,163 +1,13 @@
{
description = "NixOS configuration for noisebell Pi";
description = "Noisebell Pi service";
inputs = {
nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
noisebell.url = "path:./pi-service";
agenix = {
url = "github:ryantm/agenix";
inputs.nixpkgs.follows = "nixpkgs";
};
};
outputs = { self, nixpkgs, noisebell, agenix }:
let
nixosModule = { config, lib, pkgs, ... }:
let
cfg = config.services.noisebell;
in
{
options.services.noisebell = {
enable = lib.mkEnableOption "noisebell GPIO door monitor";
gpioPin = lib.mkOption {
type = lib.types.ints.unsigned;
default = 17;
description = "GPIO pin number to monitor.";
};
debounceSecs = lib.mkOption {
type = lib.types.ints.positive;
default = 5;
description = "Debounce delay in seconds.";
};
port = lib.mkOption {
type = lib.types.port;
default = 8080;
description = "HTTP port for the status endpoint.";
};
endpointUrl = lib.mkOption {
type = lib.types.str;
description = "Webhook endpoint URL to POST state changes to.";
};
apiKeyFile = lib.mkOption {
type = lib.types.path;
description = "Path to a file containing the outbound API key for the cache endpoint.";
};
inboundApiKeyFile = lib.mkOption {
type = lib.types.path;
description = "Path to a file containing the inbound API key for authenticating GET requests.";
};
retryAttempts = lib.mkOption {
type = lib.types.ints.unsigned;
default = 3;
description = "Number of retries after a failed webhook POST.";
};
retryBaseDelaySecs = lib.mkOption {
type = lib.types.ints.positive;
default = 1;
description = "Base delay in seconds for exponential backoff between retries.";
};
httpTimeoutSecs = lib.mkOption {
type = lib.types.ints.positive;
default = 10;
description = "Timeout in seconds for outbound HTTP requests to the webhook endpoint.";
};
bindAddress = lib.mkOption {
type = lib.types.str;
default = "0.0.0.0";
description = "Address to bind the HTTP server to.";
};
activeLow = lib.mkOption {
type = lib.types.bool;
default = true;
description = "Whether a low GPIO level means open. Set to false if your sensor wiring is inverted.";
};
restartDelaySecs = lib.mkOption {
type = lib.types.ints.positive;
default = 5;
description = "Seconds to wait before systemd restarts the service on failure.";
};
watchdogSecs = lib.mkOption {
type = lib.types.ints.positive;
default = 30;
description = "Watchdog timeout in seconds. The service is restarted if it fails to notify systemd within this interval.";
};
};
config = lib.mkIf cfg.enable {
systemd.services.noisebell = let
bin = "${noisebell.packages.aarch64-linux.default}/bin/noisebell";
in {
description = "Noisebell GPIO door monitor";
wantedBy = [ "multi-user.target" ];
after = [ "network-online.target" "tailscaled.service" ];
wants = [ "network-online.target" ];
environment = {
NOISEBELL_GPIO_PIN = toString cfg.gpioPin;
NOISEBELL_DEBOUNCE_SECS = toString cfg.debounceSecs;
NOISEBELL_PORT = toString cfg.port;
NOISEBELL_RETRY_ATTEMPTS = toString cfg.retryAttempts;
NOISEBELL_RETRY_BASE_DELAY_SECS = toString cfg.retryBaseDelaySecs;
NOISEBELL_HTTP_TIMEOUT_SECS = toString cfg.httpTimeoutSecs;
NOISEBELL_ENDPOINT_URL = cfg.endpointUrl;
NOISEBELL_BIND_ADDRESS = cfg.bindAddress;
NOISEBELL_ACTIVE_LOW = if cfg.activeLow then "true" else "false";
NOISEBELL_COMMIT = self.shortRev or "dirty";
RUST_LOG = "info";
};
script = ''
export NOISEBELL_API_KEY="$(cat ${cfg.apiKeyFile})"
export NOISEBELL_INBOUND_API_KEY="$(cat ${cfg.inboundApiKeyFile})"
exec ${bin}
'';
serviceConfig = {
Type = "notify";
NotifyAccess = "all";
WatchdogSec = cfg.watchdogSecs;
Restart = "on-failure";
RestartSec = cfg.restartDelaySecs;
};
};
};
};
in
{
nixosModules.default = nixosModule;
nixosConfigurations.pi = nixpkgs.lib.nixosSystem {
system = "aarch64-linux";
modules = [
agenix.nixosModules.default
nixosModule
./configuration.nix
./hardware-configuration.nix
];
};
nixosConfigurations.bootstrap = nixpkgs.lib.nixosSystem {
system = "aarch64-linux";
modules = [ ./bootstrap.nix ];
};
devShells.x86_64-linux.default = let
pkgs = nixpkgs.legacyPackages.x86_64-linux;
in pkgs.mkShell {
packages = [ agenix.packages.x86_64-linux.default ];
};
};
outputs = { self, nixpkgs, noisebell }: {
packages = noisebell.packages;
nixosModules.default = import ./module.nix;
};
}

123
pi/module.nix Normal file
View file

@ -0,0 +1,123 @@
{ pkg, rev }:
{ config, lib, ... }:
let
cfg = config.services.noisebell;
bin = "${pkg}/bin/noisebell";
in
{
options.services.noisebell = {
enable = lib.mkEnableOption "noisebell GPIO door monitor";
gpioPin = lib.mkOption {
type = lib.types.ints.unsigned;
default = 17;
description = "GPIO pin number to monitor.";
};
debounceSecs = lib.mkOption {
type = lib.types.ints.positive;
default = 5;
description = "Debounce delay in seconds.";
};
port = lib.mkOption {
type = lib.types.port;
default = 8080;
description = "HTTP port for the status endpoint.";
};
endpointUrl = lib.mkOption {
type = lib.types.str;
description = "Webhook endpoint URL to POST state changes to.";
};
apiKeyFile = lib.mkOption {
type = lib.types.path;
description = "Path to a file containing the outbound API key for the cache endpoint.";
};
inboundApiKeyFile = lib.mkOption {
type = lib.types.path;
description = "Path to a file containing the inbound API key for authenticating GET requests.";
};
retryAttempts = lib.mkOption {
type = lib.types.ints.unsigned;
default = 3;
description = "Number of retries after a failed webhook POST.";
};
retryBaseDelaySecs = lib.mkOption {
type = lib.types.ints.positive;
default = 1;
description = "Base delay in seconds for exponential backoff between retries.";
};
httpTimeoutSecs = lib.mkOption {
type = lib.types.ints.positive;
default = 10;
description = "Timeout in seconds for outbound HTTP requests to the webhook endpoint.";
};
bindAddress = lib.mkOption {
type = lib.types.str;
default = "0.0.0.0";
description = "Address to bind the HTTP server to.";
};
activeLow = lib.mkOption {
type = lib.types.bool;
default = true;
description = "Whether a low GPIO level means open. Set to false if your sensor wiring is inverted.";
};
restartDelaySecs = lib.mkOption {
type = lib.types.ints.positive;
default = 5;
description = "Seconds to wait before systemd restarts the service on failure.";
};
watchdogSecs = lib.mkOption {
type = lib.types.ints.positive;
default = 30;
description = "Watchdog timeout in seconds. The service is restarted if it fails to notify systemd within this interval.";
};
};
config = lib.mkIf cfg.enable {
systemd.services.noisebell = {
description = "Noisebell GPIO door monitor";
wantedBy = [ "multi-user.target" ];
after = [ "network-online.target" "tailscaled.service" ];
wants = [ "network-online.target" ];
environment = {
NOISEBELL_GPIO_PIN = toString cfg.gpioPin;
NOISEBELL_DEBOUNCE_SECS = toString cfg.debounceSecs;
NOISEBELL_PORT = toString cfg.port;
NOISEBELL_RETRY_ATTEMPTS = toString cfg.retryAttempts;
NOISEBELL_RETRY_BASE_DELAY_SECS = toString cfg.retryBaseDelaySecs;
NOISEBELL_HTTP_TIMEOUT_SECS = toString cfg.httpTimeoutSecs;
NOISEBELL_ENDPOINT_URL = cfg.endpointUrl;
NOISEBELL_BIND_ADDRESS = cfg.bindAddress;
NOISEBELL_ACTIVE_LOW = if cfg.activeLow then "true" else "false";
NOISEBELL_COMMIT = rev;
RUST_LOG = "info";
};
script = ''
export NOISEBELL_API_KEY="$(cat ${cfg.apiKeyFile})"
export NOISEBELL_INBOUND_API_KEY="$(cat ${cfg.inboundApiKeyFile})"
exec ${bin}
'';
serviceConfig = {
Type = "notify";
NotifyAccess = "all";
WatchdogSec = cfg.watchdogSecs;
Restart = "on-failure";
RestartSec = cfg.restartDelaySecs;
};
};
};
}

7
pi/secrets/api-key.age
View file

@ -1,7 +0,0 @@
age-encryption.org/v1
-> ssh-ed25519 Ziw7aw KeT7ZRx4LnoXw4TzbqAZ6U4tc74XdTGOoFvF3p1cwwc
FMlEdlMjMGfMJByOBYaY2m0Zr6eGOVm/wYCBkUMUUmg
-> ssh-ed25519 jcT/MQ A0b/6ZhKbqAk8Wx/jCcZsPSygXDyll+f6v8GmM3v1T8
BE4MTRbbXBFGVYFpKdbD8EzYSLCZxxo3UX9hxrlX9N8
--- rsyZbWLKxYWHT71Yg0nVryroF8QCjmVvGsYidVM2LP0
lh^²õM5£<35>Ê<>'¡<>QO¤¼'Ûs­xœUë§å¥[[‰Ðf1¦Ï1Nô"¡KEò—ð„ÿ ߬Ëçbb*FÐÉhPõu»¯sáÀ

7
pi/secrets/inbound-api-key.age
View file

@ -1,7 +0,0 @@
age-encryption.org/v1
-> ssh-ed25519 Ziw7aw Gykk5VLi/S/Lbf0YDFG7rax5WCIwjmfJMpe9r8XK4T0
nbggjY+m082BdKzUYucVFrwu08ziQtnY3BMXQ2dwMJo
-> ssh-ed25519 jcT/MQ OmtLLN7acSjwZrbYpc8eCOfgw1ZelHk2OWusj3kukyM
DoW2NvsOBLHhfa7NYEZP92nm1fAY7gYjM+/WHIPLD88
--- HuvJEBrp5h5PXzlruLVL9pIKmlu8VBK17spsb/gco2E
`%ñ(OÐÜtãN‘ÝAß^ؽÞz¿ô Ü%i'cÖGKý3v0bZ0߇ПŒ Ü\ŒÙ”¸2gIV†+9˲¦Í1ÅA¢T.V‡MöZ

9
pi/secrets/secrets.nix
View file

@ -1,9 +0,0 @@
let
jet = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIE40ISu3ydCqfdpb26JYD5cIN0Fu0id/FDS+xjB5zpqu";
pi = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKmJFZAVJUjDziQ7XytVhQIv+Pm9hnbVU0flxZK17K5E";
in
{
"api-key.age".publicKeys = [ jet pi ];
"inbound-api-key.age".publicKeys = [ jet pi ];
"tailscale-auth-key.age".publicKeys = [ jet pi ];
}

7
pi/secrets/tailscale-auth-key.age
View file

@ -1,7 +0,0 @@
age-encryption.org/v1
-> ssh-ed25519 Ziw7aw VR4dTYsFGIL0wGdikj1l034Uxg+C06qn9xwNrDfrYGg
FSp36eUOslycLme0hQalv/6oS6tQmJbXbIZ9ezaCznc
-> ssh-ed25519 jcT/MQ 65epjpYA8RNKGxgyEbASm7aZaAdaj88FH2D3/yWHXH0
rUhjanumw1mr/YkpMYfVamegTKNMXkQS/CifOTvQHAA
--- nyitQGsf/UyVmRaqMXOBXYRhbeViymeHhCWZkKqtfNo
xîÖè!ñ¯¡¿áf#ÙŒCZGßÔíByÆ%©èA<C3A8>·µ/ç~}õJA¬(’„³™‡ru¬Lþ•“gðDy§Â2RÑà®vû<76>‹€%¼eP ÈÕ(ÀqŽ»ÛÃÔ