Compare commits

..

4 Commits

Author SHA1 Message Date
Sam 7bb5689128 auto: bootstrapping sparky 2024-05-26 13:23:35 +01:00
Sam 15291a162d auto: bootstrapping sparky 2024-05-26 13:16:16 +01:00
Sam 7739e82f8e auto: bootstrapping sparky 2024-05-26 13:13:35 +01:00
Sam 245bbb8de6 auto: bootstrapping sparky 2024-05-26 13:11:54 +01:00
4 changed files with 58 additions and 52 deletions

View File

@ -155,11 +155,11 @@
] ]
}, },
"locked": { "locked": {
"lastModified": 1716679503, "lastModified": 1716711219,
"narHash": "sha256-aX8AEWHLwuiYX8OCpTnHGrQeei1Gb+AGbk1hq+RIClg=", "narHash": "sha256-TnZETiQPXbyT5mdCHMOyrJnx2+BwroMBRrguciz1vEo=",
"owner": "nix-community", "owner": "nix-community",
"repo": "home-manager", "repo": "home-manager",
"rev": "e4611630c3cc8ed618b48d92f6291f65be9f7913", "rev": "05e6ba83eb3585ce0aff7b41e4bd0e317d05ad4a",
"type": "github" "type": "github"
}, },
"original": { "original": {
@ -228,11 +228,11 @@
"nix-secrets": { "nix-secrets": {
"flake": false, "flake": false,
"locked": { "locked": {
"lastModified": 1716685908, "lastModified": 1716726210,
"narHash": "sha256-lVKaygQD16Kfld/Jq6/646OIQiJh8P2/gz29gvd0P08=", "narHash": "sha256-usCA/GuvvERo5tcSIYFet5sF0GhKdewcbHfJNNsnNrw=",
"ref": "refs/heads/master", "ref": "refs/heads/master",
"rev": "31ea4397c72c7c0ce650ea4cadfa7924ef84074f", "rev": "2cead67c686ddfb8c5c450ab5b56c545b661005c",
"revCount": 35, "revCount": 39,
"type": "git", "type": "git",
"url": "ssh://git@git.bitlab21.com/sam/nix-secrets.git" "url": "ssh://git@git.bitlab21.com/sam/nix-secrets.git"
}, },
@ -255,11 +255,11 @@
}, },
"nixpkgs-stable": { "nixpkgs-stable": {
"locked": { "locked": {
"lastModified": 1716061101, "lastModified": 1716655032,
"narHash": "sha256-H0eCta7ahEgloGIwE/ihkyGstOGu+kQwAiHvwVoXaA0=", "narHash": "sha256-kQ25DAiCGigsNR/Quxm3v+JGXAEXZ8I7RAF4U94bGzE=",
"owner": "NixOS", "owner": "NixOS",
"repo": "nixpkgs", "repo": "nixpkgs",
"rev": "e7cc61784ddf51c81487637b3031a6dd2d6673a2", "rev": "59a450646ec8ee0397f5fa54a08573e8240eb91f",
"type": "github" "type": "github"
}, },
"original": { "original": {
@ -300,11 +300,11 @@
"treefmt-nix": "treefmt-nix" "treefmt-nix": "treefmt-nix"
}, },
"locked": { "locked": {
"lastModified": 1716673923, "lastModified": 1716717390,
"narHash": "sha256-2u/NXh4FBbj8myQJTd3Are+a+qvhkXeqnpT/jq6VX2s=", "narHash": "sha256-Hd8ky86xAFDrUqNPPx0bO/1x6WUEyWNLrdTEVShAMb8=",
"owner": "nix-community", "owner": "nix-community",
"repo": "nixvim", "repo": "nixvim",
"rev": "1cc2e02fcaabd224348fa0dbfeb311063787a060", "rev": "beb86eec7cad226d100d2841aae09fc2d4e152a8",
"type": "github" "type": "github"
}, },
"original": { "original": {
@ -360,11 +360,11 @@
"nixpkgs-stable": "nixpkgs-stable" "nixpkgs-stable": "nixpkgs-stable"
}, },
"locked": { "locked": {
"lastModified": 1716400300, "lastModified": 1716692524,
"narHash": "sha256-0lMkIk9h3AzOHs1dCL9RXvvN4PM8VBKb+cyGsqOKa4c=", "narHash": "sha256-sALodaA7Zkp/JD6ehgwc0UCBrSBfB4cX66uFGTsqeFU=",
"owner": "mic92", "owner": "mic92",
"repo": "sops-nix", "repo": "sops-nix",
"rev": "b549832718b8946e875c016a4785d204fcfc2e53", "rev": "962797a8d7f15ed7033031731d0bb77244839960",
"type": "github" "type": "github"
}, },
"original": { "original": {

View File

@ -3,16 +3,17 @@ let
pubKeys = lib.filesystem.listFilesRecursive (../common/users/keys); pubKeys = lib.filesystem.listFilesRecursive (../common/users/keys);
secretsDirectory = builtins.toString inputs.nix-secrets; secretsDirectory = builtins.toString inputs.nix-secrets;
secretsFile = "${secretsDirectory}/secrets.yaml"; secretsFile = "${secretsDirectory}/secrets.yaml";
in sopsHashedPasswordFile = lib.optionalString (lib.hasAttr "sops-nix" inputs) config.sops.secrets."passwords/root".path;
in
{ {
imports = imports =
[ [
# Disk configuration # Disk configuration
inputs.sops-nix.nixosModules.sops
inputs.disko.nixosModules.disko inputs.disko.nixosModules.disko
(import ../common/disks/std-disk-config.nix { device = "/dev/vda"; }) (import ../common/disks/luks-btrfs-subvolumes.nix { device = "/dev/vda"; keyFile = "${sopsHashedPasswordFile}"; })
../common/optional/btrfs-impermanence.nix ../common/optional/btrfs-impermanence.nix
inputs.impermanence.nixosModules.impermanence inputs.impermanence.nixosModules.impermanence
inputs.sops-nix.nixosModules.sops
# Import core options # Import core options
./hardware-configuration.nix ./hardware-configuration.nix
@ -42,14 +43,14 @@ in
]; ];
}; };
i18n.defaultLocale = "en_GB.UTF-8"; i18n.defaultLocale = "en_GB.UTF-8";
console = { console = {
font = "Lat2-Terminus16"; font = "Lat2-Terminus16";
keyMap = "uk"; keyMap = "uk";
useXkbConfig = false; useXkbConfig = false;
}; };
boot = { boot = {
loader = { loader = {
@ -96,7 +97,7 @@ in
pkgs.just pkgs.just
pkgs.git pkgs.git
pkgs.neovim pkgs.neovim
]; ];
services.openssh = { services.openssh = {
enable = true; enable = true;
@ -115,7 +116,7 @@ in
}; };
}; };
programs.ssh.extraConfig = '' programs.ssh.extraConfig = ''
Host git.bitlab21.com Host git.bitlab21.com
IdentitiesOnly yes IdentitiesOnly yes
StrictHostKeyChecking no StrictHostKeyChecking no
@ -125,7 +126,7 @@ in
security.pam = { security.pam = {
sshAgentAuth.enable = true; sshAgentAuth.enable = true;
}; };
networking.firewall.allowedTCPPorts = [ 22 ]; networking.firewall.allowedTCPPorts = [ 22 ];
services = { services = {

View File

@ -1,9 +1,12 @@
{device ? throw "Must define a device, e.g. /dev/sda", keyFile ? throw "LUKS password file not specified"}:
let
in
{ {
disko.devices = { disko.devices = {
disk = { disk = {
vdb = { vdb = {
type = "disk"; type = "disk";
device = "/dev/vdb"; inherit device;
content = { content = {
type = "gpt"; type = "gpt";
partitions = { partitions = {
@ -28,33 +31,35 @@
#passwordFile = "/tmp/secret.key"; # Interactive #passwordFile = "/tmp/secret.key"; # Interactive
settings = { settings = {
allowDiscards = true; allowDiscards = true;
keyFile = "/tmp/secret.key"; inherit keyFile;
}; };
additionalKeyFiles = [ "/tmp/additionalSecret.key" ]; content = {
content = { type = "btrfs";
type = "btrfs"; extraArgs = ["-f"];
extraArgs = [ "-f" ]; subvolumes = {
subvolumes = { "/root" = {
"/root" = { mountpoint = "/";
mountpoint = "/"; };
mountOptions = [ "compress=zstd" "noatime" ];
}; "/persist" = {
"/home" = { mountOptions = [ "subvol=persist" ];
mountpoint = "/home"; mountpoint = "/persist";
mountOptions = [ "compress=zstd" "noatime" ]; };
};
"/nix" = { "/nix" = {
mountpoint = "/nix"; mountOptions = [ "subvol=nix" "noatime" ];
mountOptions = [ "compress=zstd" "noatime" ]; mountpoint = "/nix";
}; };
"/swap" = {
mountpoint = "/.swapvol"; "/swap" = {
swap.swapfile.size = "20M"; mountOptions = [ "noatime" ];
}; mountpoint = "/.swapvol";
swap.swapfile.size = "8192M";
};
};
}; };
}; };
}; };
};
}; };
}; };
}; };

View File

@ -1,10 +1,10 @@
{ inputs, config, lib, pkgs, outputs,... }: { inputs, config, lib, pkgs, outputs,... }:
let let
dev = "/dev/vda"; dev = "/dev/vda";
in in
{ {
imports = imports =
[ [
# Disk configuration # Disk configuration
inputs.disko.nixosModules.disko inputs.disko.nixosModules.disko
(import ../common/disks/std-disk-config.nix { device = dev; }) (import ../common/disks/std-disk-config.nix { device = dev; })