sam
/
nixos
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Compare commits

base: sam:7bb5689128553378ee297f2b0fdd8dd7d6ddfd39
Branches Tags
sam:master
sam:docker
sam:docker-entrypoint
sam:incus
sam:lxd
sam:nebula
sam:overseer
sam:disko
sam:development
sam:change-decrypt-key
sam:media
sam:impermanence
sam:fileserver-host
sam:sops
sam:modules
..
compare: sam:4d60e46541fc955f527f85cd2a8f6e7b2b48e6d1
Branches Tags
sam:master
sam:docker
sam:docker-entrypoint
sam:incus
sam:lxd
sam:nebula
sam:overseer
sam:disko
sam:development
sam:change-decrypt-key
sam:media
sam:impermanence
sam:fileserver-host
sam:sops
sam:modules

No commits in common. "7bb5689128553378ee297f2b0fdd8dd7d6ddfd39" and "4d60e46541fc955f527f85cd2a8f6e7b2b48e6d1" have entirely different histories.
7bb5689128 ... 4d60e46541

4 changed files with 52 additions and 58 deletions
Show Stats Expand all files Collapse all files

32
flake.lock
View File

@ -155,11 +155,11 @@
]
},
"locked": {
"lastModified": 1716711219,
"narHash": "sha256-TnZETiQPXbyT5mdCHMOyrJnx2+BwroMBRrguciz1vEo=",
"lastModified": 1716679503,
"narHash": "sha256-aX8AEWHLwuiYX8OCpTnHGrQeei1Gb+AGbk1hq+RIClg=",
"owner": "nix-community",
"repo": "home-manager",
"rev": "05e6ba83eb3585ce0aff7b41e4bd0e317d05ad4a",
"rev": "e4611630c3cc8ed618b48d92f6291f65be9f7913",
"type": "github"
},
"original": {
@ -228,11 +228,11 @@
"nix-secrets": {
"flake": false,
"locked": {
"lastModified": 1716726210,
"narHash": "sha256-usCA/GuvvERo5tcSIYFet5sF0GhKdewcbHfJNNsnNrw=",
"lastModified": 1716685908,
"narHash": "sha256-lVKaygQD16Kfld/Jq6/646OIQiJh8P2/gz29gvd0P08=",
"ref": "refs/heads/master",
"rev": "2cead67c686ddfb8c5c450ab5b56c545b661005c",
"revCount": 39,
"rev": "31ea4397c72c7c0ce650ea4cadfa7924ef84074f",
"revCount": 35,
"type": "git",
"url": "ssh://git@git.bitlab21.com/sam/nix-secrets.git"
},
@ -255,11 +255,11 @@
},
"nixpkgs-stable": {
"locked": {
"lastModified": 1716655032,
"narHash": "sha256-kQ25DAiCGigsNR/Quxm3v+JGXAEXZ8I7RAF4U94bGzE=",
"lastModified": 1716061101,
"narHash": "sha256-H0eCta7ahEgloGIwE/ihkyGstOGu+kQwAiHvwVoXaA0=",
"owner": "NixOS",
"repo": "nixpkgs",
"rev": "59a450646ec8ee0397f5fa54a08573e8240eb91f",
"rev": "e7cc61784ddf51c81487637b3031a6dd2d6673a2",
"type": "github"
},
"original": {
@ -300,11 +300,11 @@
"treefmt-nix": "treefmt-nix"
},
"locked": {
"lastModified": 1716717390,
"narHash": "sha256-Hd8ky86xAFDrUqNPPx0bO/1x6WUEyWNLrdTEVShAMb8=",
"lastModified": 1716673923,
"narHash": "sha256-2u/NXh4FBbj8myQJTd3Are+a+qvhkXeqnpT/jq6VX2s=",
"owner": "nix-community",
"repo": "nixvim",
"rev": "beb86eec7cad226d100d2841aae09fc2d4e152a8",
"rev": "1cc2e02fcaabd224348fa0dbfeb311063787a060",
"type": "github"
},
"original": {
@ -360,11 +360,11 @@
"nixpkgs-stable": "nixpkgs-stable"
},
"locked": {
"lastModified": 1716692524,
"narHash": "sha256-sALodaA7Zkp/JD6ehgwc0UCBrSBfB4cX66uFGTsqeFU=",
"lastModified": 1716400300,
"narHash": "sha256-0lMkIk9h3AzOHs1dCL9RXvvN4PM8VBKb+cyGsqOKa4c=",
"owner": "mic92",
"repo": "sops-nix",
"rev": "962797a8d7f15ed7033031731d0bb77244839960",
"rev": "b549832718b8946e875c016a4785d204fcfc2e53",
"type": "github"
},
"original": {

5
hosts/bootstrap/default.nix
View File

@ -3,17 +3,16 @@ let
pubKeys = lib.filesystem.listFilesRecursive (../common/users/keys);
secretsDirectory = builtins.toString inputs.nix-secrets;
secretsFile = "${secretsDirectory}/secrets.yaml";
sopsHashedPasswordFile = lib.optionalString (lib.hasAttr "sops-nix" inputs) config.sops.secrets."passwords/root".path;
in
{
imports =
[
# Disk configuration
inputs.sops-nix.nixosModules.sops
inputs.disko.nixosModules.disko
(import ../common/disks/luks-btrfs-subvolumes.nix { device = "/dev/vda"; keyFile = "${sopsHashedPasswordFile}"; })
(import ../common/disks/std-disk-config.nix { device = "/dev/vda"; })
../common/optional/btrfs-impermanence.nix
inputs.impermanence.nixosModules.impermanence
inputs.sops-nix.nixosModules.sops
# Import core options
./hardware-configuration.nix

25
hosts/common/disks/luks-btrfs-subvolumes.nix
View File

@ -1,12 +1,9 @@
{device ? throw "Must define a device, e.g. /dev/sda", keyFile ? throw "LUKS password file not specified"}:
let
in
{
disko.devices = {
disk = {
vdb = {
type = "disk";
inherit device;
device = "/dev/vdb";
content = {
type = "gpt";
partitions = {
@ -31,30 +28,28 @@ in
#passwordFile = "/tmp/secret.key"; # Interactive
settings = {
allowDiscards = true;
inherit keyFile;
keyFile = "/tmp/secret.key";
};
additionalKeyFiles = [ "/tmp/additionalSecret.key" ];
content = {
type = "btrfs";
extraArgs = ["-f"];
extraArgs = [ "-f" ];
subvolumes = {
"/root" = {
mountpoint = "/";
mountOptions = [ "compress=zstd" "noatime" ];
};
"/persist" = {
mountOptions = [ "subvol=persist" ];
mountpoint = "/persist";
"/home" = {
mountpoint = "/home";
mountOptions = [ "compress=zstd" "noatime" ];
};
"/nix" = {
mountOptions = [ "subvol=nix" "noatime" ];
mountpoint = "/nix";
mountOptions = [ "compress=zstd" "noatime" ];
};
"/swap" = {
mountOptions = [ "noatime" ];
mountpoint = "/.swapvol";
swap.swapfile.size = "8192M";
swap.swapfile.size = "20M";
};
};
};