nixos-config/nixos/machines/orbi/hardware-configuration/default.nix

124 lines
4.5 KiB
Nix
Raw Normal View History

2023-12-09 17:15:50 +01:00
{ config, pkgs, modulesPath, lib, ... }:
let
# in rescue shell
# ---------------
2023-12-09 17:15:50 +01:00
# apt install -y lshw
# lshw -C network | grep -Poh 'driver=[[:alnum:]]+'
networkInterfaceModule = "e1000e";
# ip addr
networkInterface = "enp0s31f6";
2023-12-09 17:15:50 +01:00
# From the Hetzner control panel
ipv4 = {
2024-02-16 22:21:05 +01:00
address = "95.216.66.212"; # the ip address
gateway = "95.216.66.193"; # the gateway ip address
netmask = "255.255.255.192"; # the netmask -- might not be the same for you!
prefixLength = 26; # must match the netmask, see <https://www.pawprint.net/designresources/netmask-converter.php>
2023-12-09 17:15:50 +01:00
};
ipv6 = {
2024-02-16 22:21:05 +01:00
address = "2a01:4f9:2b:326::2"; # the ipv6 addres
2023-12-09 17:15:50 +01:00
gateway = "fe80::1"; # the ipv6 gateway
prefixLength = 64; # shown in the control panel
};
in
{
imports = [
./disko-config.nix
./hardware-configuration.nix
];
2023-12-09 17:15:50 +01:00
# Use GRUB2 as the boot loader.
# We don't use systemd-boot because Hetzner uses BIOS legacy boot.
2024-02-24 03:20:01 +01:00
boot.loader.grub = {
enable = true;
2024-02-26 09:44:59 +01:00
efiSupport = false; # we created a ef02 partition because uefi is not supported on hetzner online machines.
2024-02-24 03:20:01 +01:00
};
2024-02-26 09:44:59 +01:00
#boot.loader.grub.mirroredBoots = [
# { path = "/boot_sda"; devices = [ "/dev/sda" ]; }
# { path = "/boot_sdb"; devices = [ "/dev/sdb" ]; }
#];
2023-12-09 17:15:50 +01:00
# Network configuration (Hetzner uses static IP assignments, and we don't use DHCP here)
2024-02-16 22:21:05 +01:00
#networking.useDHCP = false;
#networking.interfaces.${networkInterface} = {
# ipv4 = { addresses = [{ address = ipv4.address; prefixLength = ipv4.prefixLength; }]; };
# ipv6 = { addresses = [{ address = ipv6.address; prefixLength = ipv6.prefixLength; }]; };
#};
#networking.defaultGateway = ipv4.gateway;
#networking.defaultGateway6 = { address = ipv6.gateway; interface = networkInterface; };
#networking.nameservers = [ "8.8.8.8" "1.1.1.1" ];
2023-12-09 17:15:50 +01:00
# Initial empty root password for easy login:
users.users.root.initialHashedPassword = "";
services.openssh.settings.PermitRootLogin = "prohibit-password";
services.openssh.settings.PasswordAuthentication = false;
environment.systemPackages = [ pkgs.mosh ];
users.users.root.openssh.authorizedKeys.keys = [
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC6uza62+Go9sBFs3XZE2OkugBv9PJ7Yv8ebCskE5WYPcahMZIKkQw+zkGI8EGzOPJhQEv2xk+XBf2VOzj0Fto4nh8X5+Llb1nM+YxQPk1SVlwbNAlhh24L1w2vKtBtMy277MF4EP+caGceYP6gki5+DzlPUSdFSAEFFWgN1WPkiyUii15Xi3QuCMR8F18dbwVUYbT11vwNhdiAXWphrQG+yPguALBGR+21JM6fffOln3BhoDUp2poVc5Qe2EBuUbRUV3/fOU4HwWVKZ7KCFvLZBSVFutXCj5HuNWJ5T3RuuxJSmY5lYuFZx9gD+n+DAEJt30iXWcaJlmUqQB5awcB1S2d9pJ141V4vjiCMKUJHIdspFrI23rFNYD9k2ZXDA8VOnQE33BzmgF9xOVh6qr4G0oEpsNqJoKybVTUeSyl4+ifzdQANouvySgLJV/pcqaxX1srSDIUlcM2vDMWAs3ryCa0aAlmAVZIHgRhh6wa+IXW8gIYt+5biPWUuihJ4zGBEwkyVXXf2xsecMWCAGPWPDL0/fBfY9krNfC5M2sqxey2ShFIq+R/wMdaI7yVjUCF2QIUNiIdFbJL6bDrDyHnEXJJN+rAo23jUoTZZRv7Jq3DB/A5H7a73VCcblZyUmwMSlpg3wos7pdw5Ctta3zQPoxoAKGS1uZ+yTeZbPMmdbw=="
];
services.openssh.enable = true;
2024-02-16 22:21:05 +01:00
services.sshguard.enable = true;
2023-12-09 17:15:50 +01:00
2024-02-16 22:21:05 +01:00
system.stateVersion = "23.11";
2023-12-09 17:15:50 +01:00
# enable ssh on init
# ------------------
2024-02-16 22:21:05 +01:00
#boot.kernelParams = [
# # See <https://www.kernel.org/doc/Documentation/filesystems/nfs/nfsroot.txt> for docs on this
# # ip=<client-ip>:<server-ip>:<gw-ip>:<netmask>:<hostname>:<device>:<autoconf>:<dns0-ip>:<dns1-ip>:<ntp0-ip>
# # The server ip refers to the NFS server -- we don't need it.
# "ip=${ipv4.address}::${ipv4.gateway}:${ipv4.netmask}:${hostName}-initrd:${networkInterface}:off:8.8.8.8"
#];
# luks unlock zeug
#boot.initrd.systemd.services.openssh = {
2024-02-26 09:44:59 +01:00
# enable = true;
#};
#unlock_root(){
# pw=$(rbw get 'zfs encryption')
# ssh root@eve.i -p 2222 "echo ${pw} | systemd-tty-ask-password-agent"
#}
#boot.initrd.systemd.users.root.shell = "/bin/cryptsetup-askpass";
#boot.kernelParams = [ "ip=dhcp" ];
boot.initrd.kernelModules = [ networkInterfaceModule ];
boot.initrd.network = {
enable = true;
ssh = {
enable = true;
authorizedKeys = config.users.users.root.openssh.authorizedKeys.keys;
port = 2222;
hostKeys = [
# make sure you use --copy-host-keys during nixos-anywhere
# (you can create ne ssh keys later, again)
/etc/ssh/ssh_host_rsa_key
/etc/ssh/ssh_host_ed25519_key
];
};
};
2023-12-09 17:15:50 +01:00
systemd.network.networks."10-uplink".networkConfig.Address = ipv6.address;
boot.initrd.systemd.network.networks."10-uplink" = config.systemd.network.networks."10-uplink";
boot.initrd.systemd.enable = true;
2024-02-24 03:20:01 +01:00
# root shell if not booting (usefull for debugging), but hijacks luks unlock
#boot.initrd.systemd.emergencyAccess = true;
2023-12-09 17:15:50 +01:00
}