flake.lock

@@ -273,6 +273,21 @@
         "type": "github"
       }
     },
+    "nix-flatpak": {
+      "locked": {
+        "lastModified": 1721549352,
+        "narHash": "sha256-nlXJa8RSOX0kykrIYW33ukoHYq+FOSNztHLLgqKwOp8=",
+        "owner": "gmodena",
+        "repo": "nix-flatpak",
+        "rev": "dbce39ea8664820ba9037caaf1e2fad365ed6b4b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "gmodena",
+        "repo": "nix-flatpak",
+        "type": "github"
+      }
+    },
     "nix-minecraft": {
       "inputs": {
         "flake-compat": "flake-compat_2",
@@ -408,6 +423,7 @@
         "crowdsec": "crowdsec",
         "home-manager": "home-manager_2",
         "impermanence": "impermanence",
+        "nix-flatpak": "nix-flatpak",
         "nix-minecraft": "nix-minecraft",
         "nixpkgs": "nixpkgs_3",
         "nixpkgs-unstable": "nixpkgs-unstable"

flake.nix

@@ -28,6 +28,7 @@
 
     # Add any other flake you might need.
     nix-minecraft.url = "github:Infinidoge/nix-minecraft";
+    nix-flatpak.url = "github:gmodena/nix-flatpak";
   };
 
   outputs = { self, nixpkgs, home-manager, ... }@inputs:

home-manager/sajenim/features/games/default.nix

@@ -3,6 +3,7 @@
 {
   imports = [
     ./mangohud.nix
+    ./runescape.nix
   ];
 
   home = {

home-manager/sajenim/features/games/runescape.nix

@@ -0,0 +1,20 @@
+{ inputs, lib, ... }:
+
+{
+  imports = [
+    inputs.nix-flatpak.homeManagerModules.nix-flatpak
+  ];
+
+  services.flatpak.remotes = lib.mkOptionDefault [
+    { name = "flathub"; location = "https://dl.flathub.org/repo/flathub.flatpakrepo"; }
+    { name = "JagexLauncher"; location = "https://jagexlauncher.flatpak.mcswain.dev/JagexLauncher.flatpakrepo"; }
+  ];
+
+  services.flatpak.packages = [
+    { appId = "org.freedesktop.Platform.Compat.i386/x86_64/23.08"; origin = "flathub"; }
+    { appId = "org.freedesktop.Platform.GL32.default/x86_64/23.08"; origin = "flathub"; }
+    { appId = "com.jagex.Launcher"; origin = "JagexLauncher"; }
+    { appId = "com.jagex.Launcher.ThirdParty.RuneLite"; origin = "JagexLauncher"; }
+  ];
+}
+

nixos/common/global/age.nix

@@ -16,13 +16,21 @@ in
     agenix-rekey
   ];
 
-  age.rekey = {
+  age = {
-    # Pubkey for rekeying
-    hostPubkey = ../../${hostname}/ssh_host_ed25519_key.pub;
     # Master identity used for decryption
-    masterIdentities = [ ../users/sajenim/agenix-rekey.pub ];
+    rekey.masterIdentities = [ ../users/sajenim/agenix-rekey.pub ];
+    # Pubkey for rekeying
+    rekey.hostPubkey = ../../${hostname}/ssh_host_ed25519_key.pub;
     # Where we store the rekeyed secrets
-    storageMode = "local";
+    rekey.cacheDir = "/var/tmp/agenix-rekey/\"$UID\"";
-    localStorageDir = ./. + "/secrets/rekeyed/${config.networking.hostName}";
+    # All rekeyed secrets for each host will be collected in a derivation which copies them to the nix store when it is built
+    rekey.storageMode = "derivation";
   };
+  # Required to persist `/var/tmp/agenix-rekey`
+  environment.persistence."/persist".directories = [
+    { directory = "/var/tmp/agenix-rekey"; mode = "1777"; }
+  ];
+  # As user not a trusted-users in our nix.conf
+  # we must add age.rekey.cacheDir as a global extra sandbox path
+  nix.settings.extra-sandbox-paths = [ "/var/tmp/agenix-rekey" ];
 }

nixos/common/global/secrets/rekeyed/fuchsia/146f3229661998a1ca74449720287a7d-smb-secrets.age

@@ -1,8 +0,0 @@
-age-encryption.org/v1
--> ssh-ed25519 jVljVA ILfVChFf5s9U6CODItB/TqS1tUaAEeoLAGiNKPbDclU
-MCyVqjOPexZm+is5JWG5zfbS26nJj/Z4mk6SJDufBPM
--> R<DEa-grease +b`?*<b*
-/5YP7TzDWxztiGzrMKkUYSBzX9wcz6HSR2mFNX0JmfaTVcnJFrl3KcqfJeNf/z1w
-JIBgF+2wzeD5I7PCcNjmHGn0f+W9kAImbw8
---- LZwgwtMUkIk4l/juYhY0i7kNFurvMAgcjhrYX4PsSEE
-7c5ÌñÀ
îÝ{¶>Œ¤Æ¥ãÕ<C3A3>“II¥9ôsÆç~³a–{³ê'¥æ<5›|±o;_§*T³'|yí¿sÇvt(ÊXŠ_J.ø`£ŠÈr`“"ÜÙ|ª*‘Æ[ê

nixos/common/global/secrets/rekeyed/viridian/026c5a7ee6936afe4252144b692d20dd-enrollment-key.age

@@ -1,7 +0,0 @@
-age-encryption.org/v1
--> ssh-ed25519 KTkZog wTpircyIN9PphOvX8FtFMU6Qir790QIhdWGGhp+NSS4
-NxK4uP2YyJXdhuixQVslEAEecvTu2HUM0JNYxN4uT9M
--> Y"s_\v5`-grease [YNL^5 eKm) 9eS1} r
-BWWX7A4Jar3ojDWzyxayQ0Vi95RG2tE
---- o0F6BEiHny57JBW9psAG7JgxoIO0jzbIJ9AG9cROdd4
--s;'¸›/‘¯Gõ’ r»È‚Ià·w‡2ï–žèÐP‚ù*EˆÎÝÊ÷W»”~j#4
ZwóVü

nixos/common/global/secrets/rekeyed/viridian/28bc204cd826947442f56c6ddc28829f-traefik.age

@@ -1,8 +0,0 @@
-age-encryption.org/v1
--> ssh-ed25519 KTkZog UtP8CzqqbmeIL6dRQ6UQFP4/ZZWQBPUxbzhqdMnPwSw
-EMkbY1yoyamLXQ3e8cFK+NW7NSgoWS3/zB0O2odXanI
--> za72-grease
-kRZubf60Uy2ne30UxkeIsgOuKPfx44pvVyMHGxlaHXhC8InnJu8JFAiYuFsc8ky7
-e7c5
---- 15mIrLf9zjT7wEgTsFaUcH5ADhBAf4drxiueUSd/gus
-Ëž—¸4ÕêçãÛbE#.]aÀ ½£à<ggó[)É¿òù
C‚]h=eêÃŪ·ÅˆEpT¯ã€Iß×{Âêûò¨´ÊB.ƒ0€¡¸rÚÃÀoÒ’W	å“d'T¹\é™%´ƒ<1E>öeÃ_÷\•“Éœ5À+ú¹ýÝ,˜m0¹®JÛM¨WÓîCsWô=¸Dn);Z–&´X‹!çG­!Â+§aW{e,ìM,±…ÊŠöol+6½Sþ
öÜ4¡<34>”	&€î$Ké“üº\4sJùéØÕªÎë

nixos/common/global/secrets/rekeyed/viridian/2bf24f1e069b0a5eb4596f26d9f0e380-traefik-bouncer-key.age

@@ -1,9 +0,0 @@
-age-encryption.org/v1
--> ssh-ed25519 KTkZog eD/tQAdKjWDDg1sI5fYeLrVTsYA11Pqb+BvHKkbBIxk
-VHZXnKoyb4QhC6+ir/B+yfAdJ76d6koegb9LGS60Ik4
--> m(_p-grease 9:63B,o
-GI8IPaOpdPBzOiUcj02Be+Ep54hnawoZ6ypt47k
---- 8CrSHUUOTWZ11AKVsXHCfSfpcllFwv2Q6xJMHpPQYe0
-ê7ă~¡™ñM#„eꚶÿ0Š@T
-³Æ¾ñtáÎ$Ê<>öP›<50>ŽŒHzÜ6’ë
-ÂÙ<ȼ->:…üª]ÍøÊ™