From d2f9cb70ad60c3429df3b414d5bb33944ef685c4 Mon Sep 17 00:00:00 2001 From: Kyren223 Date: Thu, 5 Jun 2025 13:42:54 +0300 Subject: Moved timers into their own nix module, fixed issues with sops, upgraded gitea.py to use env vars for secrets, added a timer to run every 5 hours to mirror repos from github to gitea --- flake.lock | 21 +++++++++++++++ flake.nix | 5 +++- hosts/configuration.nix | 37 ++------------------------- modules/secrets.nix | 2 +- modules/secrets.yaml | 17 +++++++++++++ modules/secrets.yml | 17 ------------- modules/timers.nix | 68 +++++++++++++++++++++++++++++++++++++++++++++++++ scripts/gitea.py | 27 +++++++++++++++----- 8 files changed, 134 insertions(+), 60 deletions(-) create mode 100644 modules/secrets.yaml delete mode 100644 modules/secrets.yml create mode 100644 modules/timers.nix mode change 100644 => 100755 scripts/gitea.py diff --git a/flake.lock b/flake.lock index 5ed8d13..bfc8ec8 100644 --- a/flake.lock +++ b/flake.lock @@ -61,9 +61,30 @@ "inputs": { "home-manager": "home-manager", "nixpkgs": "nixpkgs", + "sops-nix": "sops-nix", "zen-browser": "zen-browser" } }, + "sops-nix": { + "inputs": { + "nixpkgs": [ + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1747603214, + "narHash": "sha256-lAblXm0VwifYCJ/ILPXJwlz0qNY07DDYdLD+9H+Wc8o=", + "owner": "Mic92", + "repo": "sops-nix", + "rev": "8d215e1c981be3aa37e47aeabd4e61bb069548fd", + "type": "github" + }, + "original": { + "owner": "Mic92", + "repo": "sops-nix", + "type": "github" + } + }, "zen-browser": { "inputs": { "home-manager": "home-manager_2", diff --git a/flake.nix b/flake.nix index 0906015..9dc5780 100644 --- a/flake.nix +++ b/flake.nix @@ -14,7 +14,10 @@ inputs.nixpkgs.follows = "nixpkgs"; }; - sops-nix.url = "github:Mic92/sops-nix/bd695cc4d0a5e1bead703cc1bec5fa3094820a81"; + sops-nix = { + url = "github:Mic92/sops-nix"; + inputs.nixpkgs.follows = "nixpkgs"; + }; }; outputs = { self, nixpkgs, ... }@inputs: { diff --git a/hosts/configuration.nix b/hosts/configuration.nix index 423b9bb..7af6654 100644 --- a/hosts/configuration.nix +++ b/hosts/configuration.nix @@ -1,14 +1,15 @@ { pkgs, inputs, ... }: { imports = [ + inputs.sops-nix.nixosModules.sops ../modules/apps.nix ../modules/kde.nix ../modules/networking.nix ../modules/development.nix ../modules/gaming.nix ../modules/secrets.nix + ../modules/timers.nix inputs.home-manager.nixosModules.default - inputs.sops-nix.nixosModules.sops ]; home-manager = { @@ -111,38 +112,4 @@ "d /home/kyren/.config/syncthing 0700 kyren users" ]; - systemd.timers."git-auto-sync" = { - wantedBy = [ "timers.target" ]; - timerConfig = { - OnBootSec = "5m"; - OnUnitActiveSec = "5m"; - Unit = "git-auto-sync.service"; - }; - }; - - systemd.services."git-auto-sync" = { - script = "$HOME/scripts/git-auto-sync.sh"; - path = [ - pkgs.git - pkgs.gh - pkgs.keychain - pkgs.openssh - ]; - serviceConfig = { Type = "oneshot"; User = "kyren"; }; - }; - - systemd.timers."k-sleep-tracker" = { - wantedBy = [ "timers.target" ]; - timerConfig = { - OnBootSec = "1m"; - OnUnitActiveSec = "1m"; - Unit = "k-sleep-tracker.service"; - }; - }; - - systemd.services."k-sleep-tracker" = { - script = "$HOME/projects/k/bin/k tracker sleep"; - serviceConfig = { Type = "oneshot"; User = "kyren"; }; - }; - } diff --git a/modules/secrets.nix b/modules/secrets.nix index df1e9f0..7cb1e22 100644 --- a/modules/secrets.nix +++ b/modules/secrets.nix @@ -2,7 +2,7 @@ sops = { defaultSopsFile = ./secrets.yaml; - age.sshKeyPaths = [ "/home/kyren/.ssh/id_ed25519" ]; + age.sshKeyPaths = [ "/home/kyren/.ssh/sops_id_ed25519" ]; }; } diff --git a/modules/secrets.yaml b/modules/secrets.yaml new file mode 100644 index 0000000..b3d2e72 --- /dev/null +++ b/modules/secrets.yaml @@ -0,0 +1,17 @@ +gitea-sync-token: ENC[AES256_GCM,data:mG2lOIqSBy+3O/P2AGACQOc/QdORHwsnJmGcdKZo6i5Vsqf6lLVdMA==,iv:2FgXjSIuL+UPkWgGx2PXJ/kl2FFCm+1HfgDJVXeT/jU=,tag:sjRK8x1ktkEgls8jk9EeRQ==,type:str] +github-mirror-token: ENC[AES256_GCM,data:VmTpqOCR71napTGTs2aZDDi8BkT/EhPo7jjijCO9/7PozQDnTzvcY95lZsHSUV9d8jERxqYgkNLxcrxJh+auiNnlFnoZUfGWli6IU9GE/CsVC0JlqAIGv5zMa0gz,iv:7RvW3HOsHkVC1oW4RrTNqzGf8IPEjhwH/8VPZTEIICQ=,tag:gcDsLhrn9OKdCwZCHqTZrQ==,type:str] +sops: + age: + - recipient: age1zn3jpeqducllfxlm2l57pq2kqzkg23q8jgu23lyzvfapgnkf8gmqmtchfx + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBIQUkrREw0blJkeExpWVkr + ZndwbG1xSDllODM3OHNMYUFrKy92VzliTWlRCjRIQ1lpejFKM2p0QUU1OGY3T3hu + NkdkTU9tTHJNaUY3OWtCalFYQTFLN2cKLS0tIEZhU0dIenpHTiszUVZGWkIzTkFO + NEZVQ0JJMTMydUZkY3RKekQwbUEyb1EKcOQ15upVDjgGb4CzzGKIjATxCCxJJKzQ + DkkVZBZycAhVl3ChdsmulkserdvnLgwhSfGs82bsXS8lD0hsdqctCA== + -----END AGE ENCRYPTED FILE----- + lastmodified: "2025-06-05T09:53:12Z" + mac: ENC[AES256_GCM,data:nL72VUNUF7sBWbW64EegrY/Zp+LB2FPYDmWSANv8ShIJMmMY3xypFTtQr082/U2zBivAA+0HoRmUHdlaLv5OF7kVN4xuGq78EzOw55TNAa6yNqlNCbmozQfcOSfkkHsDWCVSBnzzHCmujDzDSseq3hDl4B9PB10WCPhe5+2HQc8=,iv:2zoPZjpLqxBkS4nsg/atFPXQERjk+LHr9MjE3UvcrBo=,tag:kE+9iG5ugefA7VVMbKFhJA==,type:str] + unencrypted_suffix: _unencrypted + version: 3.10.2 diff --git a/modules/secrets.yml b/modules/secrets.yml deleted file mode 100644 index b3d2e72..0000000 --- a/modules/secrets.yml +++ /dev/null @@ -1,17 +0,0 @@ -gitea-sync-token: ENC[AES256_GCM,data:mG2lOIqSBy+3O/P2AGACQOc/QdORHwsnJmGcdKZo6i5Vsqf6lLVdMA==,iv:2FgXjSIuL+UPkWgGx2PXJ/kl2FFCm+1HfgDJVXeT/jU=,tag:sjRK8x1ktkEgls8jk9EeRQ==,type:str] -github-mirror-token: ENC[AES256_GCM,data:VmTpqOCR71napTGTs2aZDDi8BkT/EhPo7jjijCO9/7PozQDnTzvcY95lZsHSUV9d8jERxqYgkNLxcrxJh+auiNnlFnoZUfGWli6IU9GE/CsVC0JlqAIGv5zMa0gz,iv:7RvW3HOsHkVC1oW4RrTNqzGf8IPEjhwH/8VPZTEIICQ=,tag:gcDsLhrn9OKdCwZCHqTZrQ==,type:str] -sops: - age: - - recipient: age1zn3jpeqducllfxlm2l57pq2kqzkg23q8jgu23lyzvfapgnkf8gmqmtchfx - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBIQUkrREw0blJkeExpWVkr - ZndwbG1xSDllODM3OHNMYUFrKy92VzliTWlRCjRIQ1lpejFKM2p0QUU1OGY3T3hu - NkdkTU9tTHJNaUY3OWtCalFYQTFLN2cKLS0tIEZhU0dIenpHTiszUVZGWkIzTkFO - NEZVQ0JJMTMydUZkY3RKekQwbUEyb1EKcOQ15upVDjgGb4CzzGKIjATxCCxJJKzQ - DkkVZBZycAhVl3ChdsmulkserdvnLgwhSfGs82bsXS8lD0hsdqctCA== - -----END AGE ENCRYPTED FILE----- - lastmodified: "2025-06-05T09:53:12Z" - mac: ENC[AES256_GCM,data:nL72VUNUF7sBWbW64EegrY/Zp+LB2FPYDmWSANv8ShIJMmMY3xypFTtQr082/U2zBivAA+0HoRmUHdlaLv5OF7kVN4xuGq78EzOw55TNAa6yNqlNCbmozQfcOSfkkHsDWCVSBnzzHCmujDzDSseq3hDl4B9PB10WCPhe5+2HQc8=,iv:2zoPZjpLqxBkS4nsg/atFPXQERjk+LHr9MjE3UvcrBo=,tag:kE+9iG5ugefA7VVMbKFhJA==,type:str] - unencrypted_suffix: _unencrypted - version: 3.10.2 diff --git a/modules/timers.nix b/modules/timers.nix new file mode 100644 index 0000000..9c6f4a4 --- /dev/null +++ b/modules/timers.nix @@ -0,0 +1,68 @@ +{ config, pkgs, ... }: { + + systemd.timers."git-auto-sync" = { + wantedBy = [ "timers.target" ]; + timerConfig = { + OnBootSec = "5m"; + OnUnitActiveSec = "5m"; + Unit = "git-auto-sync.service"; + }; + }; + + systemd.services."git-auto-sync" = { + script = "$HOME/scripts/git-auto-sync.sh"; + path = [ + pkgs.git + pkgs.gh + pkgs.keychain + pkgs.openssh + ]; + serviceConfig = { Type = "oneshot"; User = "kyren"; }; + }; + + ########################################################################### + + systemd.timers."k-sleep-tracker" = { + wantedBy = [ "timers.target" ]; + timerConfig = { + OnBootSec = "1m"; + OnUnitActiveSec = "1m"; + Unit = "k-sleep-tracker.service"; + }; + }; + + systemd.services."k-sleep-tracker" = { + script = "$HOME/projects/k/bin/k tracker sleep"; + serviceConfig = { Type = "oneshot"; User = "kyren"; }; + }; + + ########################################################################### + + systemd.timers."git-auto-mirror" = { + wantedBy = [ "timers.target" ]; + timerConfig = { + OnBootSec = "1m"; + OnUnitActiveSec = "5h"; + Unit = "git-auto-mirror.service"; + }; + }; + + sops.secrets.gitea-sync-token = { owner = "kyren"; }; + sops.secrets.github-mirror-token = { owner = "kyren"; }; + systemd.services."git-auto-mirror" = { + script = "python $HOME/scripts/gitea.py"; + path = [ + (pkgs.python312.withPackages (pypkgs: [ + pypkgs.matplotlib + pypkgs.pandas + pypkgs.pygithub + ])) + ]; + environment = { + GITEA_TOKEN_FILE = config.sops.secrets.gitea-sync-token.path; + GITHUB_TOKEN_FILE = config.sops.secrets.github-mirror-token.path; + }; + serviceConfig = { Type = "oneshot"; User = "kyren"; }; + }; + +} diff --git a/scripts/gitea.py b/scripts/gitea.py old mode 100644 new mode 100755 index 873775e..7c63e07 --- a/scripts/gitea.py +++ b/scripts/gitea.py @@ -1,14 +1,27 @@ +import os +import sys import requests from github import Github from github import Auth -GITHUB_TOKEN = "" +def read_token(var: str) -> str: + path = os.getenv(var) + if path is None: + print(f"Missing env var: {var}", file=sys.stderr) + sys.exit(1) + return open(path).read().strip() + +GITHUB_TOKEN: str = read_token("GITHUB_TOKEN_FILE") GITHUB_USERNAME = "Kyren223" GITEA_URL = "https://git.kyren.codes" -GITEA_TOKEN = "" +GITEA_TOKEN: str = read_token("GITEA_TOKEN_FILE") GITEA_USER = "Kyren223" +success = 0 +skipped = 0 +failed = 0 + def repo_exists(repo_name: str) -> bool: headers = {'Authorization': f'token {GITEA_TOKEN}'} r = requests.get(f'{GITEA_URL}/api/v1/repos/{GITEA_USER}/{repo_name}', headers=headers) @@ -17,6 +30,7 @@ def repo_exists(repo_name: str) -> bool: def mirror(addr: str, repo_name: str): if repo_exists(repo_name): print(f"Skipping existing repo: {repo_name}") + global skipped; skipped += 1 return json = { @@ -43,12 +57,11 @@ def mirror(addr: str, repo_name: str): json=json, params=payload) r.raise_for_status() + global success; success += 1 print(f'Mirrored {repo_name}') except requests.exceptions.HTTPError as e: - if r.status_code == 422: - print(f"Skipping existing repo: {repo_name} (failed)") - else: - print(f"Failed to mirror {repo_name}: {e}") + global failed; failed += 1 + print(f"Failed to mirror {repo_name}: {e}") # using an access token auth = Auth.Token(GITHUB_TOKEN or '') @@ -64,3 +77,5 @@ for repo in g.get_user().get_repos(): # To close connections after use g.close() + +print(f"\nSummary: {success} mirrored, {skipped} skipped, {failed} failed.") -- cgit v1.3.1