From b309200640206fb010322125cc1373ffd9ecd00a Mon Sep 17 00:00:00 2001
From: Alejandro Angulo <iam@alejandr0angul0.dev>
Date: Sun, 26 Nov 2023 18:41:45 -0800
Subject: [PATCH] Added mosquitto as mqtt broker

---
 .../nixos/services/homeassistant/default.nix  |   2 +
 modules/nixos/services/mosquitto/default.nix  |  45 ++++++++++++++++++
 secrets/cf_dns_kilonull.age                   |  25 +++++-----
 secrets/hass_mqtt.age                         | Bin 0 -> 520 bytes
 secrets/nextcloud_admin.age                   | Bin 402 -> 468 bytes
 secrets/secrets.nix                           |   2 +
 secrets/theengs_ble_mqtt.age                  |   9 ++++
 systems/aarch64-linux/pi4/default.nix         |   1 +
 8 files changed, 71 insertions(+), 13 deletions(-)
 create mode 100644 modules/nixos/services/mosquitto/default.nix
 create mode 100644 secrets/hass_mqtt.age
 create mode 100644 secrets/theengs_ble_mqtt.age

diff --git a/modules/nixos/services/homeassistant/default.nix b/modules/nixos/services/homeassistant/default.nix
index 5d7e7a0..a57d03b 100644
--- a/modules/nixos/services/homeassistant/default.nix
+++ b/modules/nixos/services/homeassistant/default.nix
@@ -33,6 +33,8 @@ in {
       extraComponents = [
         "hue"
         "met"
+        "mqtt"
+        "octoprint"
         "tuya"
         "vizio"
         "zeroconf"
diff --git a/modules/nixos/services/mosquitto/default.nix b/modules/nixos/services/mosquitto/default.nix
new file mode 100644
index 0000000..8ef4232
--- /dev/null
+++ b/modules/nixos/services/mosquitto/default.nix
@@ -0,0 +1,45 @@
+{
+  options,
+  config,
+  lib,
+  pkgs,
+  format,
+  ...
+}:
+with lib; let
+  cfg = config.aa.services.mosquitto;
+  mosquitto_cfg = config.services.mosquitto;
+in {
+  options.aa.services.mosquitto = with types; {
+    enable = mkEnableOption "home assistant";
+  };
+  config = mkIf cfg.enable {
+    age.secrets = {
+      hass_mqtt.file = ../../../../secrets/hass_mqtt.age;
+      theengs_ble_mqtt.file = ../../../../secrets/theengs_ble_mqtt.age;
+    };
+
+    services.mosquitto = {
+      enable = true;
+      listeners = [
+        {
+          users = {
+            hass = {
+              acl = [
+                "read home/#"
+                "readwrite homeassistant/status"
+              ];
+              passwordFile = config.age.secrets.hass_mqtt.path;
+            };
+            theengs_ble_gateway = {
+              acl = ["readwrite home/#"];
+              passwordFile = config.age.secrets.theengs_ble_mqtt.path;
+            };
+          };
+        }
+      ];
+    };
+
+    networking.firewall.allowedTCPPorts = [1883];
+  };
+}
diff --git a/secrets/cf_dns_kilonull.age b/secrets/cf_dns_kilonull.age
index d9d3255..2b90162 100644
--- a/secrets/cf_dns_kilonull.age
+++ b/secrets/cf_dns_kilonull.age
@@ -1,14 +1,13 @@
 age-encryption.org/v1
--> ssh-ed25519 Yk7ehg NwKwWQiMTehA+gluPXpVyL4zyhGRheQ1hCyyjPyWNlM
-ZTD2ssehxzayPhnW+OVqXzr/fqQ7Hdm711RgZT5R4Pw
--> ssh-ed25519 SYNSNQ oEc4p7cz7u+gEYIJVW7hl+VXwXzPSpRXCL33Ij2ZIkc
-avgbK9ss20KmL1XB9Sg45bwv6BItDcMJj8/e2fXxZOE
--> ssh-ed25519 t5XIGA huqEOk8X1Z4g4pcjAc6griyt3x+hU5NWMfCUL8WoUkI
-yqJxaxWF04PzcmyFN8hq+u9DaQmbI4W3PSDC2+Rxr5I
--> piv-p256 UIEGzg AzYN661WI0nUCA4MHnSqOT0A23jbBl9Dnv5CmmJkvuSk
-BXxeYW5RdiYNwtMG+PHF5b7x2Pu129SNOeqItwfcWTs
--> X{\S-grease <0c[|Bb
-tXXujcfm/3s/TMaX5tM9TamHAEHSUCArwJCDEJ2SFKcL8FSV1N3srp4wNogtF7pO
-PjLeXFHo
---- 1VR3EGzzVvK+pbDlvomJ6cJ9wOrP2LoPsUqmh0c6bVE
-��>�/���,+��b�L�jg�f�<9m�K���T���N3��w��¹1�(�&��D��	7�2�#�.^"KW�$B�KUknDX��k��7GRڡd���^9`��єy�M-���Kv�O#��#��8_�<����u:;�\�
A0�X5��)��
\ No newline at end of file
+-> ssh-ed25519 Yk7ehg YW+VO4Mb5SxfM9mxXRvYKC2kJVZeULkllzvUbo0VShM
+yOts+jZvdreDDC13fT/4BdF7d/B03RaGlDzSwBGa6Q8
+-> ssh-ed25519 SYNSNQ tdbAwQABaA+r2Kkm7d9UIsVC7J/LtmlI1rnbQOlkYQU
+sJfnI9RdEoYaI7+rlrG+N4cTxdWRX2XDDzjuql5CYhI
+-> ssh-ed25519 t5XIGA 61XjTYo7NAeORxGErzRef/qluiux1GiOKbTUoetarzE
+JZYJQRs6jDPubIVAxbvDK3wGUcydLs8mbj+s/gYannk
+-> piv-p256 UIEGzg A+RKB16kMJniwsfCfG5apfAXcoYFyo+7NAIp0PRcEyeZ
+aWL7CzAm9iEFyoeaK7fWSiV8zVYv9FZr0JV5sgD1r/k
+-> X-:^I-grease )G"sj("
+jVX1VFRb4ltX1a+uPuXUtXycWEMUY0RRqC9IRJ7KDMQk39Rt
+--- gT6dA9SwnjRXm0xmHuVZcjmPyk4Awg7EOJGEsiVRbjQ
+�P�T���p���E�[T`�í��|��<�GC���#���H�9��^�ޛ�#3!��'ڣ�&覛h��pZ��cK�3�4S0���g@,�Z�̆�y���i��
8I"{�&�
���T
��Љl#PK��oy�h8�]�i��	���7�~�|�gz�‘~6
\ No newline at end of file
diff --git a/secrets/hass_mqtt.age b/secrets/hass_mqtt.age
new file mode 100644
index 0000000000000000000000000000000000000000..77772888d8adda98f6629baf5df8a5a46b053eb1
GIT binary patch
literal 520
zcmZ9{JCBoa003}JoN)9plbD<)4ML$HnCOL;SFb=Hyh=6k3I$3jk3Y{AKY_ECxH#$L
zcB>}tu4-H_anr?{FVSdp^b`E@TLvEDC2qdY$}mmtrg?zYT?lyy7sVR!Ryav^8Mq|p
zLy?7}5wB69%H>>M@hK(^9G5DrS&)Y^Z;*>VL*vsCPZ=|uhd?9-wm1zNjn4<Fyk|t+
z5`8JmCOR17`>LHy6OmXDE?WGr+0i|39l&dCMel?naf1y|4YjO+Eina0=5vi!6^Y?6
z*+-8go{wxOi_MYcB!EbH0hdi_0%Sv|8z*u51D7o{H<dU&u~$My|JAavMlzhFU}MOO
zZ2+@f6w{Qg8E?UIQ!T89C0NU))*zzFj3pYNn>v^~JGbsEpas=w=bW}(noT*y@Jb)!
zJzwp`oEg-1do=cO#i=|=o~i$4eIG=K@DvGhZ&`S7cHcPYjc!%2g=%oWxAkeydjKCm
zRjPE&nCKTuuA@^3K@ga3N+n=tLy1n}oaw|9YP%*-Fji$p+M$%!shqjS?iWpqL61&8
zwWrMI_dk!nKl_UO`X*c)Ur&BKdGi8tzFfUH+kE`+?n-khJwH5u{<xxUzr1<IVb$+z
PH%_%X<m=0?PTu|j{$a7X

literal 0
HcmV?d00001

diff --git a/secrets/nextcloud_admin.age b/secrets/nextcloud_admin.age
index d1ee0dbd5e36f79f6cc4087f9a1b6efd4eadb16b..c4180505c1a4c0c4e1f7e3bc4fe02532c3a6c045 100644
GIT binary patch
delta 434
zcmWm7J&%)M003YOlf=Zq#JE{w984whmXAWb+=ZjigS+FSfV6`HZ8<3A^X&^1678mw
ziE+Kz#lhXd!NJ5urw(pL;@}@}a5FxC;CX}XvDXiGt%iy@ntHmF=~EK%bHpOMY~yo8
zEw@Dr>|6!@DG;r6hKEL@L}O}Ro*zS!nhTL8n?h{5jK#r-3eaZa`ANLox}}5@hrN7N
z5&3{&dyXQF+n^_ufRh7SdeV4P3-X*b%-LPyTT#<L0rUj<o1&mr>t?o+WfS)iIP+_*
zVTU4>jjh3AoJpvvY|ANW%7U!HYi!bt90AV$XPS(1B7nZP@$rD}AE%RoOu6_BrX)1=
zoJr6i(P%?mgb`b-s-Oix1Yv*I=aN*GcpKKP0=0Ff^Gsvl(M2>|=t;{9mFk2nm$9NN
zj#e=A)LNSZSFLe^AbMUs0BKa`BW1Q!XOE-{YfXa+nA>LJI7XzXwoS^bQ-_La{KeyI
z@8ACFy32RNAD2f5x9>{b&-i-(#&7HjI{JI-=HZ7w4?aG}?uTFYFP~wZzh}B{oy~s#
P^!d)yldG@PulN1|Ntc%W

delta 367
zcmV-#0g(RG1Cj%fEPrZ8RANkIST8wnW^yrYO;B1<O=fj;cxp;`I5KD}W@1cIH$io7
zH)1m}K?-nmFHL4KSyE0$IZ#bCNLO`wGh{<DG*CH4Hf}LFFiveZdR9m;QhGEvRSGRW
zAaH4REpRe5HXv0=MMrvPAVDi~Z&7)5P)<)$Fj!bCa!+nKbAM-aPB&^{Hfl9!H+C?3
zSW#hic4|2>Sx5>pb!cizcXDG*YH4ItHBC}sK}<PjOmtI6WHu{HZ8S?bMo)H8b!&NO
zQ&9>nJ|J%`XL4m>b7dfYCRb1(DO4*s3Q00rbWmYqT5C@-R%J$LdQe4cc3MPaSVm_G
zEiEk|bVo~WdT4o1Zf;9!WKm0FQFui{crZ_FbWnL{Ze&PAcy4xOPDL;`NL5s43Ja=>
z#hl5@xGMFIr>~$DJo(vNp0r#O4oWca(N|%bLKrZ0T&Kl!p$6FF-Wm|FinMKy+i-N%
NNsT@GP7IyLaEcCWf<yoS

diff --git a/secrets/secrets.nix b/secrets/secrets.nix
index 79edeb1..70bbea6 100644
--- a/secrets/secrets.nix
+++ b/secrets/secrets.nix
@@ -10,4 +10,6 @@ let
 in {
   "cf_dns_kilonull.age".publicKeys = [users.me machines.node machines.gospel machines.pi4];
   "nextcloud_admin.age".publicKeys = [users.me machines.node];
+  "theengs_ble_mqtt.age".publicKeys = [users.me machines.pi4];
+  "hass_mqtt.age".publicKeys = [users.me machines.pi4 machines.node];
 }
diff --git a/secrets/theengs_ble_mqtt.age b/secrets/theengs_ble_mqtt.age
new file mode 100644
index 0000000..0f59fc6
--- /dev/null
+++ b/secrets/theengs_ble_mqtt.age
@@ -0,0 +1,9 @@
+age-encryption.org/v1
+-> ssh-ed25519 t5XIGA VI8M2lKHFTlmy8SztjfCE5sGTZEtk11OvYKOHVsYbFM
+BKBGSSpbl0D64mtyfKBkapjyn3G4U7DLPDu0Xb7T0sM
+-> piv-p256 UIEGzg A4nB8kjBm06K2nVBkHANTzBZcflssYIyA4fKgxtNmnMF
+8dFmHQjiJ9bDDC7zcVjoiDtv8aHLZUdYZwp/YCL6Lmo
+-> "DI?cD^G-grease sK5f 3_ <Zq
+lPu7GtAC0D0wNw0lBLB9MTpMFnU
+--- a3oVDb9D/2tKnYpZ0HIrTPdOJsHKudZEOkmSqD5l05E
+|��s��%7��RW���9��gY:�/R9ܤ�M�T� �Z���5.T�k�����˓�E:
\ No newline at end of file
diff --git a/systems/aarch64-linux/pi4/default.nix b/systems/aarch64-linux/pi4/default.nix
index 77f1330..d0f0e3d 100644
--- a/systems/aarch64-linux/pi4/default.nix
+++ b/systems/aarch64-linux/pi4/default.nix
@@ -43,6 +43,7 @@
     };
     services.prometheus.enable = true;
     services.promtail.enable = true;
+    services.mosquitto.enable = true;
 
     security.acme = {
       enable = true;