palo/nixos-config
palo/nixos-config
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

extract nixos.boot.ssh and set up probe

Browse source
This commit is contained in:
Ingolf Wagner 2024-08-07 11:07:10 +02:00
parent 36fc0508b0
commit d5f1ef4af6
No known key found for this signature in database
GPG key ID: 76BF5F1928B9618B
15 changed files with 137 additions and 57 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
components/gui/wayland.nix
View file

@ -7,7 +7,7 @@ with lib;
default = !config.components.gui.xorg.enable;
};
config = mkIf config.components.gui.wayland.enable {
programs.hyprland.enable = true;
config = mkIf (config.components.gui.wayland.enable && config.components.gui.enable) {
programs.sway.enable = false;
};
}

2
components/gui/xorg/default.nix
View file

@ -9,7 +9,7 @@ with lib;
default = config.components.gui.enable;
};
config = mkIf config.components.gui.xorg.enable {
config = mkIf (config.components.gui.xorg.enable && config.components.gui.enable) {
# system.custom.fonts.enable = true;
services.displayManager = {

15
components/nixos/boot/default.nix Normal file
View file

@ -0,0 +1,15 @@
{ lib, config, ... }:
{
imports = [
./ssh.nix
];
options.components.nixos.boot.enable = lib.mkOption {
type = lib.types.bool;
default = false;
};
config = lib.mkIf (config.components.nixos.boot.enable) { };
}

49
components/nixos/boot/ssh.nix Normal file
View file

@ -0,0 +1,49 @@
{ config, lib, pkgs, factsGenerator, clanLib, ... }:
with lib;
with types;
{
options.components.nixos.boot.ssh = {
enable = lib.mkOption {
type = lib.types.bool;
default = config.components.nixos.boot.enable;
};
kernelModules = mkOption {
type = listOf str;
default = [ ];
description =
"nix-shell -p pciutils --run 'lspci -v' will tell you which kernel module is used for the ethernet interface";
};
};
config = mkIf (config.components.nixos.boot.ssh.enable) {
# root password
#clan.core.facts.services.rootPassword = factsGenerator.password { name = "root"; };
#users.users.root.hashedPasswordFile = config.clan.core.facts.services.rootPassword.secret."password.root.pam".path; # fixme not working for some reason
#users.users.root.initalPassword = "admin";
# ssh host key
clan.core.facts.services."boot.ssh" = factsGenerator.ssh { name = "boot"; };
# boot
boot.initrd.systemd.enable = true;
boot.initrd.systemd.contents."/etc/hostname".text = "unlock.${config.networking.hostName}";
# network
boot.initrd.systemd.network.enable = true;
boot.initrd.availableKernelModules = config.components.nixos.boot.ssh.kernelModules;
# ssh
boot.initrd.network.enable = true;
boot.initrd.network.ssh = {
enable = true;
authorizedKeys = config.users.users.root.openssh.authorizedKeys.keys;
port = 2222;
hostKeys = [ config.clan.core.facts.services."boot.ssh".secret."ssh.boot.id_ed25519".path ];
};
};
}

37
components/nixos/tor-ssh.nix → components/nixos/boot/tor-ssh.nix
View file

@ -10,18 +10,6 @@ with types;
default = false;
};
kernelModules = mkOption {
type = listOf str;
default = [ ];
description =
"lspci -v will tell you which kernel module is used for the ethernet interface";
};
ssh.enable = lib.mkOption {
type = lib.types.bool;
default = config.components.nixos.boot.enable;
};
tor.enable = lib.mkOption {
type = lib.types.bool;
default = config.components.nixos.boot.ssh.enable;
@ -107,31 +95,6 @@ with types;
})
# ssh part
# --------
(mkIf (config.components.nixos.boot.ssh.enable) {
# boot
boot.initrd.systemd.enable = true;
boot.initrd.systemd.contents."/etc/hostname".text = "unlock.${config.networking.hostName}";
# network
boot.initrd.systemd.network.enable = true;
boot.initrd.availableKernelModules = config.components.nixos.boot.kernelModules;
# ssh
boot.initrd.network.enable = true;
boot.initrd.network.ssh = {
enable = true;
#authorizedKeys = config.users.users.root.openssh.authorizedKeys.keys ;
#authorizedKeyFiles = config.users.users.root.openssh.authorizedKeys.keyFiles;
port = 2222;
hostKeys = map ({ path, ... }: path) config.services.openssh.hostKeys;
};
})
];
}

2
components/nixos/default.nix
View file

@ -2,7 +2,7 @@
{
imports = [
./upgrade-diff.nix
./tor-ssh.nix
./boot
];
options.components.nixos.enable = lib.mkOption {

12
flake.nix
View file

@ -246,12 +246,8 @@
# configure nix
({ pkgs, lib, clanLib, ... }:
{
nix.settings.substituters = [
"http://cache.orbi.wg0"
];
nix.settings.trusted-public-keys = [
(clanLib.readFact "nix-serve.pub" "orbi")
];
#nix.settings.substituters = [ "http://cache.orbi.wg0" ];
#nix.settings.trusted-public-keys = [ (clanLib.readFact "nix-serve.pub" "orbi") ];
nix.settings.experimental-features = [ "nix-command" "flakes" ];
nix.settings.max-jobs = 1;
# no channesl needed this way
@ -477,13 +473,15 @@
probe = clanSetup {
name = "probe";
host = "probe.bear";
#host = "167.235.205.150";
host = "95.217.18.54";
modules = [
homeManagerModules
stylixModules
srvos.nixosModules.hardware-hetzner-cloud
srvos.nixosModules.server
srvos.nixosModules.mixins-terminfo
#inputs.clan-core.clanModules.sshd
{
home-manager.users.mainUser = import ./homes/palo;
home-manager.users.root = import ./homes/root;

3
machines/chungus/configuration.nix
View file

@ -59,8 +59,7 @@
components.terminal.enable = true;
components.nixos.boot.enable = true;
components.nixos.boot.kernelModules = [ "e1000e" ];
components.nixos.boot.tor.enable = false;
components.nixos.boot.ssh.kernelModules = [ "e1000e" ];
components.monitor.enable = true;
components.monitor.opentelemetry.receiver.endpoint = "0.0.0.0:4317";

1
machines/orbi/configuration.nix
View file

@ -54,7 +54,6 @@
components.network.sshd.sshguard.enable = false;
components.nixos.boot.enable = true;
components.nixos.boot.tor.enable = false;
components.monitor.enable = true;
networking.firewall.interfaces.wg0.allowedTCPPorts = [ 4317 ];

5
machines/probe/configuration.nix
View file

@ -10,8 +10,11 @@
components.mainUser.enable = true;
components.network.enable = true;
components.nixos.boot.enable = true;
components.nixos.boot.ssh.enable = true;
networking.hostName = "probe";
users.users.root.openssh.authorizedKeys.keys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJkqVvuJSvRMO5pG2CHNNBxjB7HlJudK4TQs3BhbOWOD" ];
users.users.root.initialPassword = "admin";
#users.users.root.initialPassword = "admin";
}

1
machines/probe/facts/ssh.boot.id_ed25519.pub Normal file
View file

@ -0,0 +1 @@
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINGpSFQ3qd9iXkIxhLdP2ic6pGNPKlyKfQdeMN2IutmE nixbld@cream

5
machines/probe/hardware-configuration/default.nix
View file

@ -1,13 +1,12 @@
{ config, factsGenerator, clanLib, ... }:
{
imports = [
./disko-config.nix
#./disko-config-simple.nix
./disko-config-encrypted.nix
./hardware-configuration.nix
./hetzner.nix # to more me to components
];
boot.tmp.useTmpfs = true; # make /tmp a tmpfs (performance!)
}

44
machines/probe/hardware-configuration/disko-config-encrypted.nix Normal file
View file

@ -0,0 +1,44 @@
# Example to create a bios compatible gpt partition
{ lib, ... }:
{
disko.devices = {
disk.disk1 = {
device = lib.mkDefault "/dev/sda";
type = "disk";
content = {
type = "gpt";
partitions = {
boot = {
name = "boot";
size = "1M";
type = "EF02";
};
esp = {
name = "ESP";
size = "500M";
type = "EF00";
content = {
type = "filesystem";
format = "vfat";
mountpoint = "/boot";
};
};
root = {
name = "root";
size = "100%";
content = {
type = "luks";
name = "root";
settings.allowDiscards = true;
content = {
type = "filesystem";
format = "ext4";
mountpoint = "/";
};
};
};
};
};
};
};
}

0
machines/probe/hardware-configuration/disko-config.nix → machines/probe/hardware-configuration/disko-config-simple.nix
View file

12
machines/probe/hardware-configuration/hetzner.nix
View file

@ -1,12 +1,22 @@
{ config, ... }:
{
# set up hetzner cloud network
systemd.network.enable = true;
systemd.network.networks."10-private-hetzner" = {
systemd.network.networks."10-hetzner" = {
matchConfig.Name = "en*";
networkConfig.DHCP = "ipv4";
linkConfig.RequiredForOnline = "routable";
};
# set up hetzner cloud network during init
boot.initrd.systemd.network.networks."10-hetzner" = config.systemd.network.networks."10-hetzner";
boot.initrd.availableKernelModules = [ "virtio_pci" ]; # network kernel module
# set up hetzner boot loader
boot.loader.grub = {
efiSupport = true;
efiInstallAsRemovable = true;
};
}