Compare commits
4 Commits
4d60e46541
...
7bb5689128
Author | SHA1 | Date |
---|---|---|
Sam | 7bb5689128 | |
Sam | 15291a162d | |
Sam | 7739e82f8e | |
Sam | 245bbb8de6 |
32
flake.lock
32
flake.lock
|
@ -155,11 +155,11 @@
|
||||||
]
|
]
|
||||||
},
|
},
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1716679503,
|
"lastModified": 1716711219,
|
||||||
"narHash": "sha256-aX8AEWHLwuiYX8OCpTnHGrQeei1Gb+AGbk1hq+RIClg=",
|
"narHash": "sha256-TnZETiQPXbyT5mdCHMOyrJnx2+BwroMBRrguciz1vEo=",
|
||||||
"owner": "nix-community",
|
"owner": "nix-community",
|
||||||
"repo": "home-manager",
|
"repo": "home-manager",
|
||||||
"rev": "e4611630c3cc8ed618b48d92f6291f65be9f7913",
|
"rev": "05e6ba83eb3585ce0aff7b41e4bd0e317d05ad4a",
|
||||||
"type": "github"
|
"type": "github"
|
||||||
},
|
},
|
||||||
"original": {
|
"original": {
|
||||||
|
@ -228,11 +228,11 @@
|
||||||
"nix-secrets": {
|
"nix-secrets": {
|
||||||
"flake": false,
|
"flake": false,
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1716685908,
|
"lastModified": 1716726210,
|
||||||
"narHash": "sha256-lVKaygQD16Kfld/Jq6/646OIQiJh8P2/gz29gvd0P08=",
|
"narHash": "sha256-usCA/GuvvERo5tcSIYFet5sF0GhKdewcbHfJNNsnNrw=",
|
||||||
"ref": "refs/heads/master",
|
"ref": "refs/heads/master",
|
||||||
"rev": "31ea4397c72c7c0ce650ea4cadfa7924ef84074f",
|
"rev": "2cead67c686ddfb8c5c450ab5b56c545b661005c",
|
||||||
"revCount": 35,
|
"revCount": 39,
|
||||||
"type": "git",
|
"type": "git",
|
||||||
"url": "ssh://git@git.bitlab21.com/sam/nix-secrets.git"
|
"url": "ssh://git@git.bitlab21.com/sam/nix-secrets.git"
|
||||||
},
|
},
|
||||||
|
@ -255,11 +255,11 @@
|
||||||
},
|
},
|
||||||
"nixpkgs-stable": {
|
"nixpkgs-stable": {
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1716061101,
|
"lastModified": 1716655032,
|
||||||
"narHash": "sha256-H0eCta7ahEgloGIwE/ihkyGstOGu+kQwAiHvwVoXaA0=",
|
"narHash": "sha256-kQ25DAiCGigsNR/Quxm3v+JGXAEXZ8I7RAF4U94bGzE=",
|
||||||
"owner": "NixOS",
|
"owner": "NixOS",
|
||||||
"repo": "nixpkgs",
|
"repo": "nixpkgs",
|
||||||
"rev": "e7cc61784ddf51c81487637b3031a6dd2d6673a2",
|
"rev": "59a450646ec8ee0397f5fa54a08573e8240eb91f",
|
||||||
"type": "github"
|
"type": "github"
|
||||||
},
|
},
|
||||||
"original": {
|
"original": {
|
||||||
|
@ -300,11 +300,11 @@
|
||||||
"treefmt-nix": "treefmt-nix"
|
"treefmt-nix": "treefmt-nix"
|
||||||
},
|
},
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1716673923,
|
"lastModified": 1716717390,
|
||||||
"narHash": "sha256-2u/NXh4FBbj8myQJTd3Are+a+qvhkXeqnpT/jq6VX2s=",
|
"narHash": "sha256-Hd8ky86xAFDrUqNPPx0bO/1x6WUEyWNLrdTEVShAMb8=",
|
||||||
"owner": "nix-community",
|
"owner": "nix-community",
|
||||||
"repo": "nixvim",
|
"repo": "nixvim",
|
||||||
"rev": "1cc2e02fcaabd224348fa0dbfeb311063787a060",
|
"rev": "beb86eec7cad226d100d2841aae09fc2d4e152a8",
|
||||||
"type": "github"
|
"type": "github"
|
||||||
},
|
},
|
||||||
"original": {
|
"original": {
|
||||||
|
@ -360,11 +360,11 @@
|
||||||
"nixpkgs-stable": "nixpkgs-stable"
|
"nixpkgs-stable": "nixpkgs-stable"
|
||||||
},
|
},
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1716400300,
|
"lastModified": 1716692524,
|
||||||
"narHash": "sha256-0lMkIk9h3AzOHs1dCL9RXvvN4PM8VBKb+cyGsqOKa4c=",
|
"narHash": "sha256-sALodaA7Zkp/JD6ehgwc0UCBrSBfB4cX66uFGTsqeFU=",
|
||||||
"owner": "mic92",
|
"owner": "mic92",
|
||||||
"repo": "sops-nix",
|
"repo": "sops-nix",
|
||||||
"rev": "b549832718b8946e875c016a4785d204fcfc2e53",
|
"rev": "962797a8d7f15ed7033031731d0bb77244839960",
|
||||||
"type": "github"
|
"type": "github"
|
||||||
},
|
},
|
||||||
"original": {
|
"original": {
|
||||||
|
|
|
@ -3,16 +3,17 @@ let
|
||||||
pubKeys = lib.filesystem.listFilesRecursive (../common/users/keys);
|
pubKeys = lib.filesystem.listFilesRecursive (../common/users/keys);
|
||||||
secretsDirectory = builtins.toString inputs.nix-secrets;
|
secretsDirectory = builtins.toString inputs.nix-secrets;
|
||||||
secretsFile = "${secretsDirectory}/secrets.yaml";
|
secretsFile = "${secretsDirectory}/secrets.yaml";
|
||||||
in
|
sopsHashedPasswordFile = lib.optionalString (lib.hasAttr "sops-nix" inputs) config.sops.secrets."passwords/root".path;
|
||||||
|
in
|
||||||
{
|
{
|
||||||
imports =
|
imports =
|
||||||
[
|
[
|
||||||
# Disk configuration
|
# Disk configuration
|
||||||
|
inputs.sops-nix.nixosModules.sops
|
||||||
inputs.disko.nixosModules.disko
|
inputs.disko.nixosModules.disko
|
||||||
(import ../common/disks/std-disk-config.nix { device = "/dev/vda"; })
|
(import ../common/disks/luks-btrfs-subvolumes.nix { device = "/dev/vda"; keyFile = "${sopsHashedPasswordFile}"; })
|
||||||
../common/optional/btrfs-impermanence.nix
|
../common/optional/btrfs-impermanence.nix
|
||||||
inputs.impermanence.nixosModules.impermanence
|
inputs.impermanence.nixosModules.impermanence
|
||||||
inputs.sops-nix.nixosModules.sops
|
|
||||||
|
|
||||||
# Import core options
|
# Import core options
|
||||||
./hardware-configuration.nix
|
./hardware-configuration.nix
|
||||||
|
@ -42,14 +43,14 @@ in
|
||||||
];
|
];
|
||||||
};
|
};
|
||||||
|
|
||||||
|
|
||||||
i18n.defaultLocale = "en_GB.UTF-8";
|
i18n.defaultLocale = "en_GB.UTF-8";
|
||||||
console = {
|
console = {
|
||||||
font = "Lat2-Terminus16";
|
font = "Lat2-Terminus16";
|
||||||
keyMap = "uk";
|
keyMap = "uk";
|
||||||
useXkbConfig = false;
|
useXkbConfig = false;
|
||||||
};
|
};
|
||||||
|
|
||||||
|
|
||||||
boot = {
|
boot = {
|
||||||
loader = {
|
loader = {
|
||||||
|
@ -96,7 +97,7 @@ in
|
||||||
pkgs.just
|
pkgs.just
|
||||||
pkgs.git
|
pkgs.git
|
||||||
pkgs.neovim
|
pkgs.neovim
|
||||||
];
|
];
|
||||||
|
|
||||||
services.openssh = {
|
services.openssh = {
|
||||||
enable = true;
|
enable = true;
|
||||||
|
@ -115,7 +116,7 @@ in
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
programs.ssh.extraConfig = ''
|
programs.ssh.extraConfig = ''
|
||||||
Host git.bitlab21.com
|
Host git.bitlab21.com
|
||||||
IdentitiesOnly yes
|
IdentitiesOnly yes
|
||||||
StrictHostKeyChecking no
|
StrictHostKeyChecking no
|
||||||
|
@ -125,7 +126,7 @@ in
|
||||||
security.pam = {
|
security.pam = {
|
||||||
sshAgentAuth.enable = true;
|
sshAgentAuth.enable = true;
|
||||||
};
|
};
|
||||||
|
|
||||||
networking.firewall.allowedTCPPorts = [ 22 ];
|
networking.firewall.allowedTCPPorts = [ 22 ];
|
||||||
|
|
||||||
services = {
|
services = {
|
||||||
|
|
|
@ -1,9 +1,12 @@
|
||||||
|
{device ? throw "Must define a device, e.g. /dev/sda", keyFile ? throw "LUKS password file not specified"}:
|
||||||
|
let
|
||||||
|
in
|
||||||
{
|
{
|
||||||
disko.devices = {
|
disko.devices = {
|
||||||
disk = {
|
disk = {
|
||||||
vdb = {
|
vdb = {
|
||||||
type = "disk";
|
type = "disk";
|
||||||
device = "/dev/vdb";
|
inherit device;
|
||||||
content = {
|
content = {
|
||||||
type = "gpt";
|
type = "gpt";
|
||||||
partitions = {
|
partitions = {
|
||||||
|
@ -28,33 +31,35 @@
|
||||||
#passwordFile = "/tmp/secret.key"; # Interactive
|
#passwordFile = "/tmp/secret.key"; # Interactive
|
||||||
settings = {
|
settings = {
|
||||||
allowDiscards = true;
|
allowDiscards = true;
|
||||||
keyFile = "/tmp/secret.key";
|
inherit keyFile;
|
||||||
};
|
};
|
||||||
additionalKeyFiles = [ "/tmp/additionalSecret.key" ];
|
content = {
|
||||||
content = {
|
type = "btrfs";
|
||||||
type = "btrfs";
|
extraArgs = ["-f"];
|
||||||
extraArgs = [ "-f" ];
|
subvolumes = {
|
||||||
subvolumes = {
|
"/root" = {
|
||||||
"/root" = {
|
mountpoint = "/";
|
||||||
mountpoint = "/";
|
};
|
||||||
mountOptions = [ "compress=zstd" "noatime" ];
|
|
||||||
};
|
"/persist" = {
|
||||||
"/home" = {
|
mountOptions = [ "subvol=persist" ];
|
||||||
mountpoint = "/home";
|
mountpoint = "/persist";
|
||||||
mountOptions = [ "compress=zstd" "noatime" ];
|
};
|
||||||
};
|
|
||||||
"/nix" = {
|
"/nix" = {
|
||||||
mountpoint = "/nix";
|
mountOptions = [ "subvol=nix" "noatime" ];
|
||||||
mountOptions = [ "compress=zstd" "noatime" ];
|
mountpoint = "/nix";
|
||||||
};
|
};
|
||||||
"/swap" = {
|
|
||||||
mountpoint = "/.swapvol";
|
"/swap" = {
|
||||||
swap.swapfile.size = "20M";
|
mountOptions = [ "noatime" ];
|
||||||
};
|
mountpoint = "/.swapvol";
|
||||||
|
swap.swapfile.size = "8192M";
|
||||||
|
};
|
||||||
|
};
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
};
|
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
|
@ -1,10 +1,10 @@
|
||||||
{ inputs, config, lib, pkgs, outputs,... }:
|
{ inputs, config, lib, pkgs, outputs,... }:
|
||||||
let
|
let
|
||||||
dev = "/dev/vda";
|
dev = "/dev/vda";
|
||||||
in
|
in
|
||||||
{
|
{
|
||||||
imports =
|
imports =
|
||||||
[
|
[
|
||||||
# Disk configuration
|
# Disk configuration
|
||||||
inputs.disko.nixosModules.disko
|
inputs.disko.nixosModules.disko
|
||||||
(import ../common/disks/std-disk-config.nix { device = dev; })
|
(import ../common/disks/std-disk-config.nix { device = dev; })
|
||||||
|
|
Loading…
Reference in New Issue