extract nixos.boot.ssh and set up probe

This commit is contained in:
Ingolf Wagner 2024-08-07 11:07:10 +02:00
parent 36fc0508b0
commit d5f1ef4af6
No known key found for this signature in database
GPG key ID: 76BF5F1928B9618B
15 changed files with 137 additions and 57 deletions

View file

@ -7,7 +7,7 @@ with lib;
default = !config.components.gui.xorg.enable; default = !config.components.gui.xorg.enable;
}; };
config = mkIf config.components.gui.wayland.enable { config = mkIf (config.components.gui.wayland.enable && config.components.gui.enable) {
programs.hyprland.enable = true; programs.sway.enable = false;
}; };
} }

View file

@ -9,7 +9,7 @@ with lib;
default = config.components.gui.enable; default = config.components.gui.enable;
}; };
config = mkIf config.components.gui.xorg.enable { config = mkIf (config.components.gui.xorg.enable && config.components.gui.enable) {
# system.custom.fonts.enable = true; # system.custom.fonts.enable = true;
services.displayManager = { services.displayManager = {

View file

@ -0,0 +1,15 @@
{ lib, config, ... }:
{
imports = [
./ssh.nix
];
options.components.nixos.boot.enable = lib.mkOption {
type = lib.types.bool;
default = false;
};
config = lib.mkIf (config.components.nixos.boot.enable) { };
}

View file

@ -0,0 +1,49 @@
{ config, lib, pkgs, factsGenerator, clanLib, ... }:
with lib;
with types;
{
options.components.nixos.boot.ssh = {
enable = lib.mkOption {
type = lib.types.bool;
default = config.components.nixos.boot.enable;
};
kernelModules = mkOption {
type = listOf str;
default = [ ];
description =
"nix-shell -p pciutils --run 'lspci -v' will tell you which kernel module is used for the ethernet interface";
};
};
config = mkIf (config.components.nixos.boot.ssh.enable) {
# root password
#clan.core.facts.services.rootPassword = factsGenerator.password { name = "root"; };
#users.users.root.hashedPasswordFile = config.clan.core.facts.services.rootPassword.secret."password.root.pam".path; # fixme not working for some reason
#users.users.root.initalPassword = "admin";
# ssh host key
clan.core.facts.services."boot.ssh" = factsGenerator.ssh { name = "boot"; };
# boot
boot.initrd.systemd.enable = true;
boot.initrd.systemd.contents."/etc/hostname".text = "unlock.${config.networking.hostName}";
# network
boot.initrd.systemd.network.enable = true;
boot.initrd.availableKernelModules = config.components.nixos.boot.ssh.kernelModules;
# ssh
boot.initrd.network.enable = true;
boot.initrd.network.ssh = {
enable = true;
authorizedKeys = config.users.users.root.openssh.authorizedKeys.keys;
port = 2222;
hostKeys = [ config.clan.core.facts.services."boot.ssh".secret."ssh.boot.id_ed25519".path ];
};
};
}

View file

@ -10,18 +10,6 @@ with types;
default = false; default = false;
}; };
kernelModules = mkOption {
type = listOf str;
default = [ ];
description =
"lspci -v will tell you which kernel module is used for the ethernet interface";
};
ssh.enable = lib.mkOption {
type = lib.types.bool;
default = config.components.nixos.boot.enable;
};
tor.enable = lib.mkOption { tor.enable = lib.mkOption {
type = lib.types.bool; type = lib.types.bool;
default = config.components.nixos.boot.ssh.enable; default = config.components.nixos.boot.ssh.enable;
@ -107,31 +95,6 @@ with types;
}) })
# ssh part
# --------
(mkIf (config.components.nixos.boot.ssh.enable) {
# boot
boot.initrd.systemd.enable = true;
boot.initrd.systemd.contents."/etc/hostname".text = "unlock.${config.networking.hostName}";
# network
boot.initrd.systemd.network.enable = true;
boot.initrd.availableKernelModules = config.components.nixos.boot.kernelModules;
# ssh
boot.initrd.network.enable = true;
boot.initrd.network.ssh = {
enable = true;
#authorizedKeys = config.users.users.root.openssh.authorizedKeys.keys ;
#authorizedKeyFiles = config.users.users.root.openssh.authorizedKeys.keyFiles;
port = 2222;
hostKeys = map ({ path, ... }: path) config.services.openssh.hostKeys;
};
})
]; ];
} }

View file

@ -2,7 +2,7 @@
{ {
imports = [ imports = [
./upgrade-diff.nix ./upgrade-diff.nix
./tor-ssh.nix ./boot
]; ];
options.components.nixos.enable = lib.mkOption { options.components.nixos.enable = lib.mkOption {

View file

@ -246,12 +246,8 @@
# configure nix # configure nix
({ pkgs, lib, clanLib, ... }: ({ pkgs, lib, clanLib, ... }:
{ {
nix.settings.substituters = [ #nix.settings.substituters = [ "http://cache.orbi.wg0" ];
"http://cache.orbi.wg0" #nix.settings.trusted-public-keys = [ (clanLib.readFact "nix-serve.pub" "orbi") ];
];
nix.settings.trusted-public-keys = [
(clanLib.readFact "nix-serve.pub" "orbi")
];
nix.settings.experimental-features = [ "nix-command" "flakes" ]; nix.settings.experimental-features = [ "nix-command" "flakes" ];
nix.settings.max-jobs = 1; nix.settings.max-jobs = 1;
# no channesl needed this way # no channesl needed this way
@ -477,13 +473,15 @@
probe = clanSetup { probe = clanSetup {
name = "probe"; name = "probe";
host = "probe.bear"; #host = "167.235.205.150";
host = "95.217.18.54";
modules = [ modules = [
homeManagerModules homeManagerModules
stylixModules stylixModules
srvos.nixosModules.hardware-hetzner-cloud srvos.nixosModules.hardware-hetzner-cloud
srvos.nixosModules.server srvos.nixosModules.server
srvos.nixosModules.mixins-terminfo srvos.nixosModules.mixins-terminfo
#inputs.clan-core.clanModules.sshd
{ {
home-manager.users.mainUser = import ./homes/palo; home-manager.users.mainUser = import ./homes/palo;
home-manager.users.root = import ./homes/root; home-manager.users.root = import ./homes/root;

View file

@ -59,8 +59,7 @@
components.terminal.enable = true; components.terminal.enable = true;
components.nixos.boot.enable = true; components.nixos.boot.enable = true;
components.nixos.boot.kernelModules = [ "e1000e" ]; components.nixos.boot.ssh.kernelModules = [ "e1000e" ];
components.nixos.boot.tor.enable = false;
components.monitor.enable = true; components.monitor.enable = true;
components.monitor.opentelemetry.receiver.endpoint = "0.0.0.0:4317"; components.monitor.opentelemetry.receiver.endpoint = "0.0.0.0:4317";

View file

@ -54,7 +54,6 @@
components.network.sshd.sshguard.enable = false; components.network.sshd.sshguard.enable = false;
components.nixos.boot.enable = true; components.nixos.boot.enable = true;
components.nixos.boot.tor.enable = false;
components.monitor.enable = true; components.monitor.enable = true;
networking.firewall.interfaces.wg0.allowedTCPPorts = [ 4317 ]; networking.firewall.interfaces.wg0.allowedTCPPorts = [ 4317 ];

View file

@ -10,8 +10,11 @@
components.mainUser.enable = true; components.mainUser.enable = true;
components.network.enable = true; components.network.enable = true;
components.nixos.boot.enable = true;
components.nixos.boot.ssh.enable = true;
networking.hostName = "probe"; networking.hostName = "probe";
users.users.root.openssh.authorizedKeys.keys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJkqVvuJSvRMO5pG2CHNNBxjB7HlJudK4TQs3BhbOWOD" ]; users.users.root.openssh.authorizedKeys.keys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJkqVvuJSvRMO5pG2CHNNBxjB7HlJudK4TQs3BhbOWOD" ];
users.users.root.initialPassword = "admin"; #users.users.root.initialPassword = "admin";
} }

View file

@ -0,0 +1 @@
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINGpSFQ3qd9iXkIxhLdP2ic6pGNPKlyKfQdeMN2IutmE nixbld@cream

View file

@ -1,13 +1,12 @@
{ config, factsGenerator, clanLib, ... }: { config, factsGenerator, clanLib, ... }:
{ {
imports = [ imports = [
./disko-config.nix #./disko-config-simple.nix
./disko-config-encrypted.nix
./hardware-configuration.nix ./hardware-configuration.nix
./hetzner.nix # to more me to components ./hetzner.nix # to more me to components
]; ];
boot.tmp.useTmpfs = true; # make /tmp a tmpfs (performance!) boot.tmp.useTmpfs = true; # make /tmp a tmpfs (performance!)
} }

View file

@ -0,0 +1,44 @@
# Example to create a bios compatible gpt partition
{ lib, ... }:
{
disko.devices = {
disk.disk1 = {
device = lib.mkDefault "/dev/sda";
type = "disk";
content = {
type = "gpt";
partitions = {
boot = {
name = "boot";
size = "1M";
type = "EF02";
};
esp = {
name = "ESP";
size = "500M";
type = "EF00";
content = {
type = "filesystem";
format = "vfat";
mountpoint = "/boot";
};
};
root = {
name = "root";
size = "100%";
content = {
type = "luks";
name = "root";
settings.allowDiscards = true;
content = {
type = "filesystem";
format = "ext4";
mountpoint = "/";
};
};
};
};
};
};
};
}

View file

@ -1,12 +1,22 @@
{ config, ... }:
{ {
# set up hetzner cloud network
systemd.network.enable = true; systemd.network.enable = true;
systemd.network.networks."10-private-hetzner" = { systemd.network.networks."10-hetzner" = {
matchConfig.Name = "en*"; matchConfig.Name = "en*";
networkConfig.DHCP = "ipv4"; networkConfig.DHCP = "ipv4";
linkConfig.RequiredForOnline = "routable"; linkConfig.RequiredForOnline = "routable";
}; };
# set up hetzner cloud network during init
boot.initrd.systemd.network.networks."10-hetzner" = config.systemd.network.networks."10-hetzner";
boot.initrd.availableKernelModules = [ "virtio_pci" ]; # network kernel module
# set up hetzner boot loader
boot.loader.grub = { boot.loader.grub = {
efiSupport = true; efiSupport = true;
efiInstallAsRemovable = true; efiInstallAsRemovable = true;
}; };
} }