auto: bootstrapping sparky

flake.lock

@@ -155,11 +155,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1716679503,
+        "lastModified": 1716711219,
-        "narHash": "sha256-aX8AEWHLwuiYX8OCpTnHGrQeei1Gb+AGbk1hq+RIClg=",
+        "narHash": "sha256-TnZETiQPXbyT5mdCHMOyrJnx2+BwroMBRrguciz1vEo=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "e4611630c3cc8ed618b48d92f6291f65be9f7913",
+        "rev": "05e6ba83eb3585ce0aff7b41e4bd0e317d05ad4a",
         "type": "github"
       },
       "original": {
@@ -228,11 +228,11 @@
     "nix-secrets": {
       "flake": false,
       "locked": {
-        "lastModified": 1716685908,
+        "lastModified": 1716726210,
-        "narHash": "sha256-lVKaygQD16Kfld/Jq6/646OIQiJh8P2/gz29gvd0P08=",
+        "narHash": "sha256-usCA/GuvvERo5tcSIYFet5sF0GhKdewcbHfJNNsnNrw=",
         "ref": "refs/heads/master",
-        "rev": "31ea4397c72c7c0ce650ea4cadfa7924ef84074f",
+        "rev": "2cead67c686ddfb8c5c450ab5b56c545b661005c",
-        "revCount": 35,
+        "revCount": 39,
         "type": "git",
         "url": "ssh://git@git.bitlab21.com/sam/nix-secrets.git"
       },
@@ -255,11 +255,11 @@
     },
     "nixpkgs-stable": {
       "locked": {
-        "lastModified": 1716061101,
+        "lastModified": 1716655032,
-        "narHash": "sha256-H0eCta7ahEgloGIwE/ihkyGstOGu+kQwAiHvwVoXaA0=",
+        "narHash": "sha256-kQ25DAiCGigsNR/Quxm3v+JGXAEXZ8I7RAF4U94bGzE=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "e7cc61784ddf51c81487637b3031a6dd2d6673a2",
+        "rev": "59a450646ec8ee0397f5fa54a08573e8240eb91f",
         "type": "github"
       },
       "original": {
@@ -300,11 +300,11 @@
         "treefmt-nix": "treefmt-nix"
       },
       "locked": {
-        "lastModified": 1716673923,
+        "lastModified": 1716717390,
-        "narHash": "sha256-2u/NXh4FBbj8myQJTd3Are+a+qvhkXeqnpT/jq6VX2s=",
+        "narHash": "sha256-Hd8ky86xAFDrUqNPPx0bO/1x6WUEyWNLrdTEVShAMb8=",
         "owner": "nix-community",
         "repo": "nixvim",
-        "rev": "1cc2e02fcaabd224348fa0dbfeb311063787a060",
+        "rev": "beb86eec7cad226d100d2841aae09fc2d4e152a8",
         "type": "github"
       },
       "original": {
@@ -360,11 +360,11 @@
         "nixpkgs-stable": "nixpkgs-stable"
       },
       "locked": {
-        "lastModified": 1716400300,
+        "lastModified": 1716692524,
-        "narHash": "sha256-0lMkIk9h3AzOHs1dCL9RXvvN4PM8VBKb+cyGsqOKa4c=",
+        "narHash": "sha256-sALodaA7Zkp/JD6ehgwc0UCBrSBfB4cX66uFGTsqeFU=",
         "owner": "mic92",
         "repo": "sops-nix",
-        "rev": "b549832718b8946e875c016a4785d204fcfc2e53",
+        "rev": "962797a8d7f15ed7033031731d0bb77244839960",
         "type": "github"
       },
       "original": {

hosts/bootstrap/default.nix

@@ -3,16 +3,17 @@ let
   pubKeys = lib.filesystem.listFilesRecursive (../common/users/keys);
   secretsDirectory = builtins.toString inputs.nix-secrets;
   secretsFile = "${secretsDirectory}/secrets.yaml";
-in 
+  sopsHashedPasswordFile = lib.optionalString (lib.hasAttr "sops-nix" inputs) config.sops.secrets."passwords/root".path;
+in
 {
   imports =
-    [ 
+    [
       # Disk configuration
+      inputs.sops-nix.nixosModules.sops
       inputs.disko.nixosModules.disko
-      (import ../common/disks/std-disk-config.nix { device = "/dev/vda"; })
+      (import ../common/disks/luks-btrfs-subvolumes.nix { device = "/dev/vda"; keyFile = "${sopsHashedPasswordFile}"; })
       ../common/optional/btrfs-impermanence.nix
       inputs.impermanence.nixosModules.impermanence
-      inputs.sops-nix.nixosModules.sops
 
       # Import core options
       ./hardware-configuration.nix
@@ -42,14 +43,14 @@ in
     ];
   };
 
- 
+
   i18n.defaultLocale = "en_GB.UTF-8";
   console = {
     font = "Lat2-Terminus16";
     keyMap = "uk";
-    useXkbConfig = false; 
+    useXkbConfig = false;
   };
- 
+
 
   boot = {
     loader = {
@@ -96,7 +97,7 @@ in
       pkgs.just
       pkgs.git
       pkgs.neovim
-  ]; 
+  ];
 
   services.openssh = {
     enable = true;
@@ -115,7 +116,7 @@ in
     };
   };
 
-  programs.ssh.extraConfig = '' 
+  programs.ssh.extraConfig = ''
     Host git.bitlab21.com
         IdentitiesOnly yes
         StrictHostKeyChecking no
@@ -125,7 +126,7 @@ in
   security.pam = {
     sshAgentAuth.enable = true;
   };
-  
+
   networking.firewall.allowedTCPPorts = [ 22 ];
 
   services = {

hosts/common/disks/luks-btrfs-subvolumes.nix

@@ -1,9 +1,12 @@
+{device ? throw "Must define a device, e.g. /dev/sda", keyFile ? throw "LUKS password file not specified"}:
+let
+in
 {
   disko.devices = {
     disk = {
       vdb = {
         type = "disk";
-        device = "/dev/vdb";
+        inherit device;
         content = {
           type = "gpt";
           partitions = {
@@ -28,33 +31,35 @@
                 #passwordFile = "/tmp/secret.key"; # Interactive
                 settings = {
                   allowDiscards = true;
-                  keyFile = "/tmp/secret.key";
+                  inherit keyFile;
                 };
-                additionalKeyFiles = [ "/tmp/additionalSecret.key" ];
+                  content = {
-                content = {
+                    type = "btrfs";
-                  type = "btrfs";
+                    extraArgs = ["-f"];
-                  extraArgs = [ "-f" ];
+                      subvolumes = {
-                  subvolumes = {
+                        "/root" = {
-                    "/root" = {
+                          mountpoint = "/";
-                      mountpoint = "/";
+                        };
-                      mountOptions = [ "compress=zstd" "noatime" ];
+
-                    };
+                        "/persist" = {
-                    "/home" = {
+                          mountOptions = [ "subvol=persist" ];
-                      mountpoint = "/home";
+                          mountpoint = "/persist";
-                      mountOptions = [ "compress=zstd" "noatime" ];
+                        };
-                    };
+
-                    "/nix" = {
+                        "/nix" = {
-                      mountpoint = "/nix";
+                          mountOptions = [ "subvol=nix" "noatime" ];
-                      mountOptions = [ "compress=zstd" "noatime" ];
+                          mountpoint = "/nix";
-                    };
+                        };
-                    "/swap" = {
+
-                      mountpoint = "/.swapvol";
+                        "/swap" = {
-                      swap.swapfile.size = "20M";
+                          mountOptions = [ "noatime" ];
-                    };
+                          mountpoint = "/.swapvol";
+                          swap.swapfile.size = "8192M";
+                        };
+                      };
                   };
                 };
               };
-            };
           };
         };
       };

hosts/sparky/default.nix

@@ -1,10 +1,10 @@
 { inputs, config, lib, pkgs, outputs,... }:
 let
   dev = "/dev/vda";
-in 
+in
 {
   imports =
-    [ 
+    [
       # Disk configuration
       inputs.disko.nixosModules.disko
       (import ../common/disks/std-disk-config.nix { device = dev; })