sagittarius: switch storage box from samba to sftp

4 files changed, 31 insertions, 22 deletions

diff --git a/hosts/sagittarius/default.nix b/hosts/sagittarius/default.nix
index 44a72b7..4b2246a 100644
--- a/hosts/sagittarius/default.nix
+++ b/hosts/sagittarius/default.nix
@@ -17,19 +17,22 @@
   boot.loader.grub.device = "/dev/sda";
   time.timeZone = "Europe/Helsinki";
 
-  environment.systemPackages = [ pkgs.cifs-utils ];
+  environment.systemPackages = [ pkgs.rclone ];
   fileSystems."/mnt/storage-box" = {
-    device = "//u423859-sub3.your-storagebox.de/u423859-sub3";
-    fsType = "cifs";
+    device = "storage-box:/";
+    fsType = "rclone";
     options =
       let
         opts = lib.concatStringsSep "," [
-          "x-systemd.automount"
+          "nodev"
+          "allow_other"
+          "args2env"
+          "config=${config.sops.secrets.storage-box-rclone-conf.path}"
           "noauto"
+          "x-systemd.automount"
           "x-systemd.idle-timeout=60"
           "x-systemd.device-timeout=5s"
           "x-systemd.mount-timeout=5s"
-          "credentials=${config.sops.secrets.samba-creds.path}"
           "gid=${toString config.users.groups.storage-box.gid}"
         ];
       in
diff --git a/hosts/sagittarius/sops.nix b/hosts/sagittarius/sops.nix
index 01836b3..db70d49 100644
--- a/hosts/sagittarius/sops.nix
+++ b/hosts/sagittarius/sops.nix
@@ -9,9 +9,9 @@
         sopsFile = ../../secrets/forgejo-runner-token.env;
         format = "dotenv";
       };
-      "samba-creds" = {
-        sopsFile = ../../secrets/sagittarius-samba-creds.env;
-        format = "dotenv";
+      "storage-box-rclone-conf" = {
+        sopsFile = ../../secrets/storage-box-rclone.ini;
+        format = "ini";
       };
     };
   };
diff --git a/secrets/sagittarius-samba-creds.env b/secrets/sagittarius-samba-creds.env
deleted file mode 100644
index 0dc6964..0000000
--- a/secrets/sagittarius-samba-creds.env
+++ /dev/null
@@ -1,14 +0,0 @@
-username=ENC[AES256_GCM,data:1DaR7q0oo+uKf2x3,iv:/z5RrXyug1muw+vK7eJulZ15GSkHWF5aGV4bGE5yHKo=,tag:zDmaFjAkF5QvoT5AJusR6w==,type:str]
-password=ENC[AES256_GCM,data:zvC7dyNzH1PBN/hbJQeBFw==,iv:Ev//CwP2PQCSV1YMciTMxXsx1oP0he8uPfbG+4mu/44=,tag:XsKU+/oRfIM+DUi9/+5TbA==,type:str]
-sops_age__list_0__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBKODh0TVNkdjJoeWxFTnhu\nN3c0NnRWc3dyR0RPR0VpY0lGd2NJOSsvdTNFCjhoRTlyK3VGejlxMVI3UkRoQlg1\nb2pmRUtMV3VFQUNGSVR0NU9WdnBtRm8KLS0tICtSZy9oNXVWLzFuQ0hKeWQ5SDdD\nS0tqTDZ5ajczcVcreEcyYWhUTnVtSUUK4N9JcFTW3TpVSw2O8birSh8uO9Wbbswp\n/NCqeT3wgetyPvP3zPcsfkWEvCsQ6C+OPLlKE71jLevy+/jRddPRZA==\n-----END AGE ENCRYPTED FILE-----\n
-sops_age__list_0__map_recipient=age1l088h7umwuxp0sw8wk0stfup0empdnldczxvrhueu7n0vxd0c57q9zvwsk
-sops_age__list_1__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBrUXFUNmk5NXVlUVRsbmNR\nUTBQVDNSTTNsQzF4ZXRrWDBhRUZUSUErelh3Ck9ZRDhxNlJIUGRhY2JzcWs0WEhw\nMmJ2RUU5b2dkaDBxb3hZNHNZbklCejAKLS0tIGdzMnZOSStodDRvQ2IyMHBFVGJR\nVjBmeEQ1ZzAzcnVYVThldVdtT29zNUkK150LRqZmcjxodjyFCTtkU+GW7EnnRd/8\nnbzvSHMpRL3UtHBBd2GFc6He7Z92dxxyD1VfMk6CgRQsAgt2maP1nw==\n-----END AGE ENCRYPTED FILE-----\n
-sops_age__list_1__map_recipient=age1xzqshnlstewfha28sqjp4lf97mm43axyrhga0vkjmt5zx6eydqhsvlsasc
-sops_age__list_2__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAxUmkzWHJYMHpsUjBHTlpK\nSEdCV2ZzWDEwSDVzRHZTWGpzYUtlUEs0aG1NCnJjWDh2b1YrRWRwNE15UXJVdDFU\nTUFWUDJBdUZBNTlaUXFIMlhWKzIwV28KLS0tIG9pUS9jT3U3V1Era2VYQ1lHaDZY\nM0hQYnRXN3Zqd1ZzTjJDOGZML0pVZU0KztlbftsZBkryoSj+7jysTUOkGfCyRgrD\neNs9Wre0e2XB462lzw1q7/MtYJPwqLQ1is8Syw5ZyktDDPwmH28pyw==\n-----END AGE ENCRYPTED FILE-----\n
-sops_age__list_2__map_recipient=age1jmpdssn7555g0pht7zwqq2dvrvzxyu65w6cf2su8pp2fz0zvaykq0jgern
-sops_age__list_3__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBFQ3VXVGF3WlZEcFIwdmIx\nYVhoSGpxcHZkeEdraGZOaStSZm8za28yb3hRCi9VWjlSSXNlR0ErWWhObG5weTdZ\nN1U0N2dWeDhuU2N4SDg4MW41T1hQUXMKLS0tIEhCQitXZkhJRkNENm1iMW1zcERz\nQVZBVEg2NlZLbnV1MEhXYXo1MlljZWcK+FBwL787RgzZaCia3Cw2hpu+4Hj20Krd\nTNljcbzieRMrhiPdlPESBBR1ZcWQD7egBJlrIotOcz2li2qMezxh1w==\n-----END AGE ENCRYPTED FILE-----\n
-sops_age__list_3__map_recipient=age1sffhunmeqmeey29lnvuds59mn74jfpctd3wm0t6svca0fztgvd4qnretc6
-sops_lastmodified=2024-10-19T19:47:00Z
-sops_mac=ENC[AES256_GCM,data:/5achQBtokwUDDuYXjQYgKl3bkFne7ec5MuHnvG5S0iNZxnGzotBvJ5LVETbQwnrS3CXPNjmXhTC8tERIKLw7ZrE5u+YeMoBElxF0Ttbj7NbLBchXcLpLdWgTjbgn2OkbRiD563Bw3g312QeYVlkTwnUH7dUrDi5Zn0YfTTb4T4=,iv:eYNWab82IIsTtPw0lOOJ3JH8msdKw2Of+RhavtqTPL8=,tag:wEuItTbVJKYecOqFvjWQ8w==,type:str]
-sops_unencrypted_suffix=_unencrypted
-sops_version=3.9.1
diff --git a/secrets/storage-box-rclone.ini b/secrets/storage-box-rclone.ini
new file mode 100644
index 0000000..495afda
--- /dev/null
+++ b/secrets/storage-box-rclone.ini
@@ -0,0 +1,20 @@
+[storagebox]
+type = ENC[AES256_GCM,data:hwywOw==,iv:ijonOXj2mbr3cxFDpyYApGzDAQYTG10nToonwnGEYrs=,tag:h4kDHo/8p71Zl4VM7fx4VA==,type:str]
+host = ENC[AES256_GCM,data:MLXAZwTN9VB4syONkHGY3JyGMhCgTunfeNXtU3nYDA==,iv:WVs720K+DWQnntBfh/hApLQ9zSlCbsrrbQ/uHpsuM40=,tag:BlA2YnsmMPR64My48oYpag==,type:str]
+user = ENC[AES256_GCM,data:LJNzw0TWLTHqArQG,iv:xsCHnin6+R4owaDdvnCeNujh0yg0i10wizN+vCl0Ftg=,tag:YTSWbl0MxINCdMYtihRiTA==,type:str]
+port = ENC[AES256_GCM,data:rrQ=,iv:JyPCrm0uv7/UzbKXPOOnzS07fI8eJGXPSnxbEZwNChE=,tag:fnBw9RW0CYy7+tr0c1KeIg==,type:str]
+pass = ENC[AES256_GCM,data:lciVz+rDlpX0C8IRliI/bEJG81wHOxo+8IEcBe7O5qe7onVkQzULOMQvgw==,iv:QjYs0RfR7/cObSWAIzKNRg7fTORAWccupwqmbS+XHfg=,tag:Qf/iJDxOLCl98NgCG3ty7A==,type:str]
+
+[sops]
+age__list_0__map_enc       = -----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAwQnFhb29wcGJCMWtJSnNQ\nZXByUGJLbG9pOEFpUTBBQ29iOTZuZnVxbjB3Cks2VXJJWG42aGNleEdMT2ovQnRN\nS3YrQkpPNWdyaXlXbnhKbmNncDFFQVUKLS0tIEJMbnFZNDNBNTdXd2FhdFo0WXY4\nYjZ6azVVZFIxOVoxWVVaZnVuZ1dlMjgKpruOpmUezvFrAj2VhsNW+defW/ozjoXa\nERraRjoKJy7NwlK1napNpTAf67Qphxbs+rWooxtZ1pMrC6Veu/WkEg==\n-----END AGE ENCRYPTED FILE-----\n
+version                    = 3.9.1
+age__list_1__map_recipient = age1xzqshnlstewfha28sqjp4lf97mm43axyrhga0vkjmt5zx6eydqhsvlsasc
+age__list_3__map_recipient = age1sffhunmeqmeey29lnvuds59mn74jfpctd3wm0t6svca0fztgvd4qnretc6
+age__list_3__map_enc       = -----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWYWdTSlM3SWtMME1YOFd0\nQWpMcjFhZTJlSW9tcnV4L1NFT3NMMDRPeUVzClExd2xYYitwZlgweUtvb2F3dk9q\nZG9SRTJzUzY5OUczWmczVUVvQ2VHN0UKLS0tIGJjcXdud01sSjVKU0lrbmZLaFdW\nWEVIVmMvTHp5c2xnSFYxQ1M5NUYxNjQK6hKowuITzZqAn+oWScn9SqgN+eXCoTDy\n+lawVNv5dIPdoCNxCTVHrMhhZK/lt9XhWXdQnKn29Dt6sqx3/nZNdA==\n-----END AGE ENCRYPTED FILE-----\n
+age__list_1__map_enc       = -----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBjVnI4SllFRHFMNjEyNWww\nZGpjanF5OE9EdTNqdTVlU2RtS0JFazQ3cXpzCnJiZCtDK0ZHN0pwVk5oMkdwMHh5\nOGRvZjJ6RjZ4SWtjczFWajJKTnhQNXcKLS0tIHVLOVc3d1FjVnhFS0lDRDRqZkRK\nYVVWOFFWOWxZVEU5cW1VY1VqcmZVNFkKY1d+MrweZN5xYKsAHM62g8iek7fiwqtW\nkaUtg6uG9Q2mgAPq/YqVySfD7P7Ih8zT00OrTFZm0sFuMtyiE3Hlbg==\n-----END AGE ENCRYPTED FILE-----\n
+age__list_2__map_enc       = -----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBpbHhNYmhsNkVpT09weURs\nalNGbXRpZHEwc0FjbTVPYkJFSktQNWZUalFvCjkxZjR6SmlCcjZ6Qks0VEtDbE5C\nRklNcDJZUmNQTlhZV3BTclpobGVFUDgKLS0tIFljWUE3VVgrSFEzemNTcDBJMkps\nUkJSOG00QlJFMXVWRFRFNEc0d3k0Z1UK7gWAX0VCZCgZemDunBZTocJyuxYNGPgp\nk9SiA6To0M+GjlBnRyBlgS5sudqL3yVmFOYvfyOYr3FuXNm4uNdRbg==\n-----END AGE ENCRYPTED FILE-----\n
+age__list_2__map_recipient = age1jmpdssn7555g0pht7zwqq2dvrvzxyu65w6cf2su8pp2fz0zvaykq0jgern
+mac                        = ENC[AES256_GCM,data:CHcDVQqDuM5uiQilabdsWGa+XvqUt8jag/xJ2GKpaYW4DFCqywME5zeFIyEydvxAUCKstqEUDY7otsmi1xbOXOwazsM47chnaCFw8d7n3oURUVYeNmYky+TAT8t3N57JvZr/QP6e4bJ0sRVi1jH5xI5TI8Ya/qQ3zj1JqRfdgP8=,iv:nvRvlBGoNxSxN1d54gvRoS8NunmfPEohFlaDMLXmhp4=,tag:x7DZQpY09bBpS6B6Be6NNg==,type:str]
+unencrypted_suffix         = _unencrypted
+age__list_0__map_recipient = age1l088h7umwuxp0sw8wk0stfup0empdnldczxvrhueu7n0vxd0c57q9zvwsk
+lastmodified               = 2024-10-19T21:14:48Z