orbi works now
This commit is contained in:
Ingolf Wagner
parent
049d9206d6
commit
eea11b2589
7 changed files with 64 additions and 64 deletions
|
|
@ -5,8 +5,8 @@
|
|||
../../system/server
|
||||
../../components
|
||||
|
||||
./hardware-configuration.nix
|
||||
./disko-config.nix
|
||||
./hardware-configuration
|
||||
|
||||
./disko-syncoid.nix
|
||||
./packages.nix
|
||||
|
||||
|
|
@ -70,14 +70,6 @@
|
|||
|
||||
services.printing.enable = false;
|
||||
|
||||
boot.loader.systemd-boot.enable = true;
|
||||
boot.loader.efi.canTouchEfiVariables = true;
|
||||
boot.tmp.useTmpfs = true; # make /tmp a tmpfs (performance!)
|
||||
|
||||
boot.supportedFilesystems = [ "zfs" ];
|
||||
# head -c4 /dev/urandom | od -A none -t x4
|
||||
networking.hostId = "e439b116";
|
||||
services.zfs.autoSnapshot.enable = true;
|
||||
|
||||
#virtualisation.containers.storage.settings = {
|
||||
# # fixes: Error: 'overlay' is not supported over zfs, a mount_program is required: backing file system is unsupported for this graph driver
|
||||
|
|
@ -91,13 +83,6 @@
|
|||
|
||||
users.users.root.shell = pkgs.zsh;
|
||||
|
||||
# todo : rename to component.init.ssh
|
||||
# todo : make tor optional
|
||||
configuration.init-ssh = {
|
||||
enable = "enabled";
|
||||
kernelModules = [ "e1000e" ];
|
||||
};
|
||||
|
||||
hardware.opengl = {
|
||||
enable = true;
|
||||
extraPackages = with pkgs; [
|
||||
|
|
|
|||
24
nixos/machines/chungus/hardware-configuration/default.nix
Normal file
24
nixos/machines/chungus/hardware-configuration/default.nix
Normal file
|
|
@ -0,0 +1,24 @@
|
|||
{ ... }:
|
||||
{
|
||||
imports = [
|
||||
./disko-config.nix
|
||||
./hardware-configuration.nix
|
||||
];
|
||||
|
||||
# todo : rename to component.init.ssh
|
||||
# todo : make tor optional
|
||||
configuration.init-ssh = {
|
||||
enable = "enabled";
|
||||
kernelModules = [ "e1000e" ];
|
||||
};
|
||||
|
||||
boot.loader.systemd-boot.enable = true;
|
||||
boot.loader.efi.canTouchEfiVariables = true;
|
||||
boot.tmp.useTmpfs = true; # make /tmp a tmpfs (performance!)
|
||||
|
||||
boot.supportedFilesystems = [ "zfs" ];
|
||||
# head -c4 /dev/urandom | od -A none -t x4
|
||||
networking.hostId = "e439b116";
|
||||
services.zfs.autoSnapshot.enable = true;
|
||||
|
||||
}
|
||||
|
|
@ -70,11 +70,6 @@
|
|||
|
||||
services.smartd.enable = true;
|
||||
|
||||
boot.tmp.useTmpfs = true; # make /tmp a tmpfs (performance!)
|
||||
|
||||
boot.supportedFilesystems = [ "zfs" ];
|
||||
# head -c4 /dev/urandom | od -A none -t x4
|
||||
networking.hostId = "5bb982a6";
|
||||
|
||||
|
||||
}
|
||||
|
|
|
|||
|
|
@ -34,10 +34,6 @@ in
|
|||
./hardware-configuration.nix
|
||||
];
|
||||
|
||||
environment.systemPackages = [
|
||||
pkgs.mosh
|
||||
];
|
||||
|
||||
# Use GRUB2 as the boot loader.
|
||||
# We don't use systemd-boot because Hetzner uses BIOS legacy boot.
|
||||
boot.loader.grub = {
|
||||
|
|
@ -50,6 +46,7 @@ in
|
|||
services.openssh.settings.PermitRootLogin = "prohibit-password";
|
||||
services.openssh.settings.PasswordAuthentication = false;
|
||||
|
||||
# todo : move this to the flake, this is always true
|
||||
users.users.root.openssh.authorizedKeys.keys = [
|
||||
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC6uza62+Go9sBFs3XZE2OkugBv9PJ7Yv8ebCskE5WYPcahMZIKkQw+zkGI8EGzOPJhQEv2xk+XBf2VOzj0Fto4nh8X5+Llb1nM+YxQPk1SVlwbNAlhh24L1w2vKtBtMy277MF4EP+caGceYP6gki5+DzlPUSdFSAEFFWgN1WPkiyUii15Xi3QuCMR8F18dbwVUYbT11vwNhdiAXWphrQG+yPguALBGR+21JM6fffOln3BhoDUp2poVc5Qe2EBuUbRUV3/fOU4HwWVKZ7KCFvLZBSVFutXCj5HuNWJ5T3RuuxJSmY5lYuFZx9gD+n+DAEJt30iXWcaJlmUqQB5awcB1S2d9pJ141V4vjiCMKUJHIdspFrI23rFNYD9k2ZXDA8VOnQE33BzmgF9xOVh6qr4G0oEpsNqJoKybVTUeSyl4+ifzdQANouvySgLJV/pcqaxX1srSDIUlcM2vDMWAs3ryCa0aAlmAVZIHgRhh6wa+IXW8gIYt+5biPWUuihJ4zGBEwkyVXXf2xsecMWCAGPWPDL0/fBfY9krNfC5M2sqxey2ShFIq+R/wMdaI7yVjUCF2QIUNiIdFbJL6bDrDyHnEXJJN+rAo23jUoTZZRv7Jq3DB/A5H7a73VCcblZyUmwMSlpg3wos7pdw5Ctta3zQPoxoAKGS1uZ+yTeZbPMmdbw=="
|
||||
];
|
||||
|
|
@ -57,28 +54,14 @@ in
|
|||
services.openssh.enable = true;
|
||||
services.sshguard.enable = true;
|
||||
|
||||
boot.tmp.useTmpfs = true; # make /tmp a tmpfs (performance!)
|
||||
|
||||
# enable ssh on init
|
||||
# ------------------
|
||||
boot.supportedFilesystems = [ "zfs" ];
|
||||
# head -c4 /dev/urandom | od -A none -t x4
|
||||
networking.hostId = "5bb982a6";
|
||||
|
||||
#boot.kernelParams = [
|
||||
# # See <https://www.kernel.org/doc/Documentation/filesystems/nfs/nfsroot.txt> for docs on this
|
||||
# # ip=<client-ip>:<server-ip>:<gw-ip>:<netmask>:<hostname>:<device>:<autoconf>:<dns0-ip>:<dns1-ip>:<ntp0-ip>
|
||||
# # The server ip refers to the NFS server -- we don't need it.
|
||||
# "ip=${ipv4.address}::${ipv4.gateway}:${ipv4.netmask}:${hostName}-initrd:${networkInterface}:off:8.8.8.8"
|
||||
#];
|
||||
systemd.network.networks."10-uplink".networkConfig.Address = ipv6.address;
|
||||
|
||||
# luks unlock zeug
|
||||
#boot.initrd.systemd.services.openssh = {
|
||||
# enable = true;
|
||||
#};
|
||||
#unlock_root(){
|
||||
# pw=$(rbw get 'zfs encryption')
|
||||
# ssh root@eve.i -p 2222 "echo ${pw} | systemd-tty-ask-password-agent"
|
||||
#}
|
||||
#boot.initrd.systemd.users.root.shell = "/bin/cryptsetup-askpass";
|
||||
|
||||
#boot.kernelParams = [ "ip=dhcp" ];
|
||||
boot.initrd.kernelModules = [ networkInterfaceModule ];
|
||||
boot.initrd.network = {
|
||||
enable = true;
|
||||
|
|
@ -95,14 +78,27 @@ in
|
|||
};
|
||||
};
|
||||
|
||||
systemd.network.networks."10-uplink".networkConfig.Address = ipv6.address;
|
||||
boot.initrd.systemd.network.networks."10-uplink" = config.systemd.network.networks."10-uplink";
|
||||
# enable ssh on init
|
||||
# ==================
|
||||
|
||||
|
||||
# No SystemD at boot
|
||||
# ------------------
|
||||
#boot.kernelParams = [
|
||||
# # See <https://www.kernel.org/doc/Documentation/filesystems/nfs/nfsroot.txt> for docs on this
|
||||
# # ip=<client-ip>:<server-ip>:<gw-ip>:<netmask>:<hostname>:<device>:<autoconf>:<dns0-ip>:<dns1-ip>:<ntp0-ip>
|
||||
# # The server ip refers to the NFS server -- we don't need it.
|
||||
# "ip=${ipv4.address}::${ipv4.gateway}:${ipv4.netmask}:${hostName}-initrd:${networkInterface}:off:8.8.8.8"
|
||||
#];
|
||||
#boot.initrd.systemd.enable = false;
|
||||
#boot.kernelParams = [ "ip=dhcp" ];
|
||||
#boot.initrd.network.ssh.shell = "/bin/cryptsetup-askpass";
|
||||
#boot.initrd.luks.reusePassphrases = true;
|
||||
|
||||
# SystemD at boot
|
||||
# ---------------
|
||||
boot.initrd.systemd.enable = true;
|
||||
|
||||
# root shell if not booting (usefull for debugging)
|
||||
boot.initrd.systemd.emergencyAccess = false;
|
||||
|
||||
# playing around with stuff
|
||||
# boot.initrd.luks.reusePassphrases = true;
|
||||
#boot.initrd.systemd.services.openssh.enable = true;
|
||||
boot.initrd.systemd.network.networks."10-uplink" = config.systemd.network.networks."10-uplink";
|
||||
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,7 +1,4 @@
|
|||
# nix run github:nix-community/disko -- --mode zap_create_mount ./disko-config.nix
|
||||
# nixos-generate-config --no-filesystems --root /mnt
|
||||
# vim /mnt/configuration.nix
|
||||
# nixos-install
|
||||
# nix run github:nix-community/nixos-anywhere -- --copy-host-keys --disk-encryption-keys /run/secret.key /home/palo/orbi/run/secret.key --flake .#orbi root@95.216.66.212
|
||||
{ config, lib, ... }:
|
||||
let
|
||||
disks = [ "sda" "sdb" ];
|
||||
|
|
@ -38,11 +35,12 @@ in
|
|||
content = {
|
||||
type = "luks";
|
||||
name = "root_${disk}";
|
||||
# if you want to use the key for interactive login be sure there is no trailing newline
|
||||
# for example use `echo -n "password" > /run/secret.key`
|
||||
# for example use `pass show hetzner/orbi/master_password | head -c -1 > /run/secret.key`
|
||||
# or use nixos-anywhere --disk-encryption-keys /run/secret.key <local-path>
|
||||
passwordFile = "/run/secret.key";
|
||||
settings = {
|
||||
# if you want to use the key for interactive login be sure there is no trailing newline
|
||||
# for example use `echo -n "password" > /run/secret.key`
|
||||
# or use nixos-anywhere --disk-encryption-keys /run/secret.key <local-path>
|
||||
keyFile = "/run/secret.key";
|
||||
allowDiscards = true;
|
||||
};
|
||||
content = {
|
||||
|
|
@ -56,10 +54,12 @@ in
|
|||
size = "100%";
|
||||
content = {
|
||||
type = "luks";
|
||||
# if you want to use the key for interactive login be sure there is no trailing newline
|
||||
# for example use `echo -n "password" > /run/secret.key`
|
||||
# for example use `pass show hetzner/orbi/master_password | head -c -1 > /run/secret.key`
|
||||
# or use nixos-anywhere --disk-encryption-keys /run/secret.key <local-path>
|
||||
passwordFile = "/run/secret.key";
|
||||
settings = {
|
||||
# if you want to use the key for interactive login be sure there is no trailing newline
|
||||
# for example use `echo -n "password" > /run/secret.key`
|
||||
keyFile = "/run/secret.key";
|
||||
allowDiscards = true;
|
||||
};
|
||||
name = "media_${disk}";
|
||||
|
|
|
|||
Loading…
Reference in a new issue