Merge pull request 'forgot to write my whole name LAMO' (!109) from new-user-part-two into main

Reviewed-on: https://git.pvv.ntnu.no/Drift/pvv-nixos-config/pulls/109

flake.lock

@@ -190,11 +190,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1752865540,
-        "narHash": "sha256-VYLXcV8FsaMTsmxISOejvBq76eA41yi7BCRNW1qGbV0=",
+        "lastModified": 1755204441,
+        "narHash": "sha256-f1wkq/RxfjFPnAriK7KhrFQ8x+Wet7OrJTaTd9YPAXU=",
         "ref": "refs/heads/main",
-        "rev": "f732582d0d1389721ea2c91ab370ba2fb824d644",
-        "revCount": 496,
+        "rev": "7070a12e16b9a25b61212194e7683b059c3c2c96",
+        "revCount": 503,
         "type": "git",
         "url": "https://git.pvv.ntnu.no/Projects/nettsiden.git"
       },

hosts/kommode/services/gitea/default.nix

@@ -51,11 +51,11 @@ in {
         START_SSH_SERVER = true;
         START_LFS_SERVER = true;
         LFS_JWT_SECRET = lib.mkForce "";
-        LFS_JWT_SECRET_URI = config.sops.secrets."gitea/lfs-jwt-secret".path;
+        LFS_JWT_SECRET_URI = "file:${config.sops.secrets."gitea/lfs-jwt-secret".path}";
       };
       oauth2 = {
         JWT_SECRET = lib.mkForce "";
-        JWT_SECRET_URI = config.sops.secrets."gitea/oauth2-jwt-secret".path;
+        JWT_SECRET_URI = "file:${config.sops.secrets."gitea/oauth2-jwt-secret".path}";
       };
       "git.timeout" = {
         MIGRATE = 3600;
@@ -85,7 +85,7 @@ in {
       session.COOKIE_SECURE = true;
       security = {
         SECRET_KEY = lib.mkForce "";
-        SECRET_KEY_PATH = config.sops.secrets."gitea/secret-key".path;
+        SECRET_KEY_URI = "file:${config.sops.secrets."gitea/secret-key".path}";
       };
       database.LOG_SQL = false;
       repository = {

hosts/kommode/services/gitea/import-users/default.nix

@@ -11,7 +11,8 @@ in
 
   systemd.services.gitea-import-users = lib.mkIf cfg.enable {
     enable = true;
-    preStart=''${pkgs.rsync}/bin/rsync -e "${pkgs.openssh}/bin/ssh -o UserKnownHostsFile=$CREDENTIALS_DIRECTORY/ssh-known-hosts -i $CREDENTIALS_DIRECTORY/sshkey" -a pvv@smtp.pvv.ntnu.no:/etc/passwd /tmp/passwd-import'';
+    preStart=''${pkgs.rsync}/bin/rsync -e "${pkgs.openssh}/bin/ssh -o UserKnownHostsFile=$CREDENTIALS_DIRECTORY/ssh-known-hosts -i $CREDENTIALS_DIRECTORY/sshkey" -a pvv@smtp.pvv.ntnu.no:/etc/passwd /run/gitea-import-users/passwd'';
+    environment.PASSWD_FILE_PATH = "/run/gitea-import-users/passwd";
     serviceConfig = {
       ExecStart = pkgs.writers.writePython3 "gitea-import-users" {
         flakeIgnore = [
@@ -25,6 +26,7 @@ in
       ];
       DynamicUser="yes";
       EnvironmentFile=config.sops.secrets."gitea/import-user-env".path;
+      RuntimeDirectory = "gitea-import-users";
     };
   };
 

hosts/kommode/services/gitea/import-users/gitea-import-users.py

@@ -17,6 +17,10 @@ GITEA_API_URL = os.getenv('GITEA_API_URL')
 if GITEA_API_URL is None:
     GITEA_API_URL = 'https://git.pvv.ntnu.no/api/v1'
 
+PASSWD_FILE_PATH = os.getenv('PASSWD_FILE_PATH')
+if PASSWD_FILE_PATH is None:
+    PASSWD_FILE_PATH = '/tmp/passwd-import'
+
 
 def gitea_list_all_users() -> dict[str, dict[str, any]] | None:
     r = requests.get(
@@ -187,7 +191,8 @@ def main():
     if existing_users is None:
         exit(1)
 
-    for username, name in passwd_file_parser("/tmp/passwd-import"):
+    print(f"Reading passwd entries from {PASSWD_FILE_PATH}")
+    for username, name in passwd_file_parser(PASSWD_FILE_PATH):
         print(f"Processing {username}")
         add_or_patch_gitea_user(username, name, existing_users)
         for org, team_name in COMMON_USER_TEAMS:

hosts/lupine/services/gitea-runner.nix

@@ -6,14 +6,16 @@
   # successfully registered will gitea give you the next token.
   # - oysteikt Sep 2023
   sops = {
-    secrets."gitea/runners/token" = { };
+    secrets."gitea/runners/token" = {
+      key = "gitea/runners/${lupineName}";
+    };
 
     templates."gitea-runner-envfile" = {
       restartUnits = [
         "gitea-runner-${lupineName}.service"
       ];
       content = ''
-        TOKEN=${config.sops.placeholder."gitea/runners/token"}
+        TOKEN="${config.sops.placeholder."gitea/runners/token"}"
       '';
     };
   };

secrets/lupine/lupine.yaml

@@ -1,6 +1,10 @@
 gitea:
     runners:
-        token: ENC[AES256_GCM,data:Y27trzUHuA1k9fVs/3PM/L8aIlI+37nAPTVDgWjBX+K4q23saa5XUA==,iv:J4litvX0ip/a340E7S+XHZQG+BGh+K/RzFxdS1VLwA0=,tag:H4oK4vn27U+yXqa/YQJOxA==,type:str]
+        lupine-1: ENC[AES256_GCM,data:UcZB2p/dInvcl0yNBEohzbmcVxg/QQPXlIsaVB3M3hyxFg1gtGfUGA==,iv:OigyPfPoRIjvyiId7hiiWdNrZqyZqI3OonvJC+zYEzI=,tag:SjBsvo/IJKhFQs+PiI596g==,type:str]
+        lupine-2: null
+        lupine-3: null
+        lupine-4: null
+        lupine-5: null
 sops:
     age:
         - recipient: age1fkrypl6fu4ldsa7te4g3v4qsegnk7sd6qhkquuwzh04vguy96qus08902e
@@ -93,8 +97,8 @@ sops:
             YU5mMDlRckJCMDAzcHYyMWN1clRJRVEK77PiAQP+2+WblGYEgAf6bx6RTh0JHiSZ
             /jPIN/rbAKNv36wpZDbuLV8tcMuvhleNMRSSqbIloLSzww+Z5nOU4A==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-08-03T01:13:50Z"
-    mac: ENC[AES256_GCM,data:oFbwmbLk3z6oYQMCEcFAGstf6DUT7hh9OUa5HVyeIR15YVgJ9/0hwZPG1m00w1HpKjt7/iVnQQYdPvt00snwn7g0M822MquMbwavozOrWWuhpxlzjM1kn/zTHAPFMmDihAciuQSSk43Dc5FRS5Gc6gwonEsJ5EUqcq2nM/cnAUY=,iv:H1CEaaypKUMCd2zJOXhIUQQqTfOwknG+iBOpgYlirmY=,tag:gKX+OTZ+BrHvcwoyO6YFdA==,type:str]
+    lastmodified: "2025-07-30T18:29:08Z"
+    mac: ENC[AES256_GCM,data:47cki5ucPTVd4JuEyK0QkDCCEqj1pW6SA5I6ihC/MEja6TIuHTcEPFpje8+LvpGjpP9uobKX4g3UcyvkJ63j/k3hU0xPYQX3Z1ee00KIMKB0GHNjUR8ENtnwd3TU7kp5ohtXeCtcyzCjdFFuXp8AINGv3vpbU2MzauctUxn5B1Y=,iv:1mpk/f1QlRtHfA9dqyNLBrvfVPgtLnZ7ibj8qNrEGD8=,tag:drEK1+qeJy97rgeQJyqucA==,type:str]
     pgp:
         - created_at: "2025-07-30T18:27:50Z"
           enc: |-

users/albertba.nix

@@ -0,0 +1,23 @@
+{ pkgs, ... }:
+{
+  users.users.albertba = {
+    isNormalUser = true;
+    extraGroups = [ "wheel" "drift" "nix-builder-users" ];
+
+    packages = with pkgs; [
+      htop
+      neovim
+      ripgrep
+      fd
+      tmux
+    ];
+
+    shell = pkgs.zsh;
+
+    openssh.authorizedKeys.keys = [
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICheSCAxsYc/6g8hq2lXXHoUWPjWvntzzTA7OhG8waMN albert@Arch"
+    ];
+  };
+
+}
+