From a62a3d136a555002e531c8e27e8d7f6369ef766a Mon Sep 17 00:00:00 2001 From: Gene Liverman Date: Mon, 5 Feb 2024 00:45:52 -0500 Subject: [PATCH] Add hetznix01 --- flake.nix | 3 ++ modules/home-manager/hosts/hetznix01/gene.nix | 7 ++++ modules/hosts/nixos/hetznix01/default.nix | 32 ++++++++++++++ modules/hosts/nixos/hetznix01/disk-config.nix | 42 +++++++++++++++++++ .../hetznix01/hardware-configuration.nix | 24 +++++++++++ modules/hosts/nixos/hetznix01/secrets.yaml | 0 modules/hosts/nixos/nixnuc/default.nix | 5 +++ .../hosts/nixos/rainbow-planet/default.nix | 7 +++- modules/system/common/all-nixos.nix | 14 +------ 9 files changed, 120 insertions(+), 14 deletions(-) create mode 100644 modules/home-manager/hosts/hetznix01/gene.nix create mode 100644 modules/hosts/nixos/hetznix01/default.nix create mode 100644 modules/hosts/nixos/hetznix01/disk-config.nix create mode 100644 modules/hosts/nixos/hetznix01/hardware-configuration.nix create mode 100644 modules/hosts/nixos/hetznix01/secrets.yaml diff --git a/flake.nix b/flake.nix index 8106e85..01d591d 100644 --- a/flake.nix +++ b/flake.nix @@ -92,6 +92,8 @@ }; specialArgs = { inherit inputs username hostname; }; modules = [ + disko.nixosModules.disko + home-manager.nixosModules.home-manager { home-manager = { extraSpecialArgs = { inherit genebean-omp-themes hostname username; }; @@ -139,6 +141,7 @@ }; nixosConfigurations = { + hetznix01 = nixosHostConfig "aarch64-linux" "hetznix01" "gene"; nixnuc = nixosHostConfig "x86_64-linux" "nixnuc" "gene"; rainbow-planet = nixosHostConfig "x86_64-linux" "rainbow-planet" "gene"; }; diff --git a/modules/home-manager/hosts/hetznix01/gene.nix b/modules/home-manager/hosts/hetznix01/gene.nix new file mode 100644 index 0000000..30158a5 --- /dev/null +++ b/modules/home-manager/hosts/hetznix01/gene.nix @@ -0,0 +1,7 @@ +{ pkgs, genebean-omp-themes, ... }: { + home.stateVersion = "23.11"; + imports = [ + ../../common/all-cli.nix + ../../common/all-linux.nix + ]; +} diff --git a/modules/hosts/nixos/hetznix01/default.nix b/modules/hosts/nixos/hetznix01/default.nix new file mode 100644 index 0000000..102f240 --- /dev/null +++ b/modules/hosts/nixos/hetznix01/default.nix @@ -0,0 +1,32 @@ +{ inputs, config, disko, hostname, pkgs, sops-nix, username, ... }: { + imports = [ + ./hardware-configuration.nix + ./disk-config.nix + ]; + + system.stateVersion = "23.11"; + + networking = { + # Open ports in the firewall. + firewall.allowedTCPPorts = [ 22 ]; + # firewall.allowedUDPPorts = [ ... ]; + # Or disable the firewall altogether. + # firewall.enable = false; + + hostId = "85d0e6cb"; # head -c4 /dev/urandom | od -A none -t x4 + + networkmanager.enable = true; + }; + + programs.mtr.enable = true; + + users.users.${username} = { + isNormalUser = true; + description = "Gene Liverman"; + extraGroups = [ "networkmanager" "wheel" ]; + openssh.authorizedKeys.keys = [ + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBjigwV0KnnaTnFmKjjvnULa5X+hvsy2FAlu+lUUY59f gene@rainbow-planet" + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIp42X5DZ713+bgbOO+GXROufUFdxWo7NjJbGQ285x3N bluerock" + ]; + }; +} diff --git a/modules/hosts/nixos/hetznix01/disk-config.nix b/modules/hosts/nixos/hetznix01/disk-config.nix new file mode 100644 index 0000000..76a07cd --- /dev/null +++ b/modules/hosts/nixos/hetznix01/disk-config.nix @@ -0,0 +1,42 @@ +# Example to create a bios compatible gpt partition +{ lib, ... }: +{ + disko.devices = { + disk.disk1 = { + device = lib.mkDefault "/dev/sda"; + type = "disk"; + content = { + type = "gpt"; + partitions = { + boot = { + name = "boot"; + size = "1M"; + type = "EF02"; + }; + esp = { + name = "ESP"; + size = "500M"; + type = "EF00"; + content = { + type = "filesystem"; + format = "vfat"; + mountpoint = "/boot"; + }; + }; + root = { + name = "root"; + size = "100%"; + content = { + type = "filesystem"; + format = "ext4"; + mountpoint = "/"; + mountOptions = [ + "defaults" + ]; + }; + }; + }; + }; + }; + }; +} diff --git a/modules/hosts/nixos/hetznix01/hardware-configuration.nix b/modules/hosts/nixos/hetznix01/hardware-configuration.nix new file mode 100644 index 0000000..f2551e3 --- /dev/null +++ b/modules/hosts/nixos/hetznix01/hardware-configuration.nix @@ -0,0 +1,24 @@ +# Do not modify this file! It was generated by ‘nixos-generate-config’ +# and may be overwritten by future invocations. Please make changes +# to /etc/nixos/configuration.nix instead. +{ config, lib, pkgs, modulesPath, ... }: + +{ + imports = + [ (modulesPath + "/profiles/qemu-guest.nix") + ]; + + boot.initrd.availableKernelModules = [ "xhci_pci" "virtio_pci" "virtio_scsi" "usbhid" "sr_mod" ]; + boot.initrd.kernelModules = [ ]; + boot.kernelModules = [ ]; + boot.extraModulePackages = [ ]; + + # Enables DHCP on each ethernet and wireless interface. In case of scripted networking + # (the default) this is the recommended approach. When using systemd-networkd it's + # still possible to use this option, but it's recommended to use it in conjunction + # with explicit per-interface declarations with `networking.interfaces..useDHCP`. + networking.useDHCP = lib.mkDefault true; + # networking.interfaces.enp1s0.useDHCP = lib.mkDefault true; + + nixpkgs.hostPlatform = lib.mkDefault "aarch64-linux"; +} diff --git a/modules/hosts/nixos/hetznix01/secrets.yaml b/modules/hosts/nixos/hetznix01/secrets.yaml new file mode 100644 index 0000000..e69de29 diff --git a/modules/hosts/nixos/nixnuc/default.nix b/modules/hosts/nixos/nixnuc/default.nix index 13865f9..3ad18a9 100644 --- a/modules/hosts/nixos/nixnuc/default.nix +++ b/modules/hosts/nixos/nixnuc/default.nix @@ -114,6 +114,8 @@ }; }; tailscale = { + enable = true; + authKeyFile = config.sops.secrets.tailscale_key.path; extraUpFlags = [ "--advertise-exit-node" "--operator" @@ -136,6 +138,9 @@ owner = "${username}"; path = "/home/${username}/.private-env"; }; + tailscale_key = { + restartUnits = [ "tailscaled-autoconnect.service" ]; + }; }; }; diff --git a/modules/hosts/nixos/rainbow-planet/default.nix b/modules/hosts/nixos/rainbow-planet/default.nix index cb2c521..748f765 100644 --- a/modules/hosts/nixos/rainbow-planet/default.nix +++ b/modules/hosts/nixos/rainbow-planet/default.nix @@ -1,4 +1,4 @@ -{ pkgs, username, ... }: { +{ config, pkgs, username, ... }: { imports = [ ./hardware-configuration.nix ../../../system/common/linux/flatpaks.nix @@ -73,6 +73,8 @@ gvfs.enable = true; # Used by Nautilus printing.enable = true; # Enable CUPS tailscale = { + enable = true; + authKeyFile = config.sops.secrets.tailscale_key.path; extraUpFlags = [ "--operator" "${username}" @@ -120,6 +122,9 @@ owner = "${username}"; path = "/home/${username}/.private-env"; }; + tailscale_key = { + restartUnits = [ "tailscaled-autoconnect.service" ]; + }; }; }; diff --git a/modules/system/common/all-nixos.nix b/modules/system/common/all-nixos.nix index 646901a..6a2bb3c 100644 --- a/modules/system/common/all-nixos.nix +++ b/modules/system/common/all-nixos.nix @@ -52,21 +52,9 @@ services = { openssh.enable = true; - tailscale = { - enable = true; - authKeyFile = config.sops.secrets.tailscale_key.path; - }; }; - sops = { - age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ]; - secrets = { - tailscale_key = { - restartUnits = [ "tailscaled-autoconnect.service" ]; - sopsFile = ../../hosts/nixos/${hostname}/secrets.yaml; - }; - }; - }; + sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ]; time.timeZone = "America/New_York";