Skip to content

Commit 0331699

Browse files
99linesofcode99linesofcode
authored
Merge pull request #14 from 99linesofcode/mars-host-configuration
Configuration for hosts/mars
2 parents 62b4758 + 03ee30f commit 0331699

37 files changed

+728
-281
lines changed

‎.sops.yaml‎

Lines changed: 7 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -1,45 +1,21 @@
1-
# TODO: generate keys and update creation rules dynamically on nixos-anywhere install (update yaml with yq)
2-
# the /etc/ssh/ssh_host_ed25519_key is used in nixos-config by default and needs to be added in order for
3-
# # it to be able to succesfully complete the installation.
41
keys:
5-
- &master age1nww8elvlr7l2sn2452z6wef8tyex53ehrypemkxhzfay2t99x52scwsw94
6-
- &luna_shorty age10a049meemjvgdgukx6zu5lwu82mqul83l7fyd66tzy9sm8637s7q07ujez
7-
- &mars_shorty age1pztum0c6dy94ah2rcwfd983hwhg8mwum3uljpwguu8cypxrs0uxsqz6hc5
8-
- &host_mars age1gx9hqvsc2ewy5yu4xp6v9wl0la7s9qhnezaya54yhsx3w7w3vg9s8pzknr
9-
- &host_luna age1pueehhjrvwh8v50u7hhpy0u7zx50nj0u7c9hgtzrr7ja0hed9qdsk0m66j
2+
- &master age1hy523tlslqas8qgs0lxgxanp9gx06fjekn608w4qf66mxkjzmucqh0g6vg
3+
- &host_luna age10a049meemjvgdgukx6zu5lwu82mqul83l7fyd66tzy9sm8637s7q07ujez
4+
- &host_mars age1epkfxmjk0tlne8rmxqq77u06q3lnf5xfjcrwq42nuasswefndyfscw84cy
105
creation_rules:
116
- path_regex: hosts/shared/secrets/.*
127
key_groups:
138
- age:
149
- *master
15-
- *luna_shorty
16-
- *mars_shorty
1710
- *host_luna
18-
- path_regex: hosts/luna/secrets/.*
19-
key_groups:
20-
- age:
21-
- *master
22-
- *luna_shorty
23-
- path_regex: users/shorty/secrets/.*
24-
key_groups:
25-
- age:
26-
- *master
27-
- *luna_shorty
2811
- *host_mars
29-
- path_regex: hosts/mars/secrets/.*
30-
key_groups:
31-
- age:
32-
- *master
33-
- *luna_shorty
34-
- *mars_shorty
35-
- path_regex: hosts/mars/users/shorty/secrets/.*
12+
- path_regex: hosts/luna/.*/secrets/.*
3613
key_groups:
3714
- age:
3815
- *master
39-
- *luna_shorty
40-
- *mars_shorty
41-
- path_regex: hosts/luna/.*/secrets/.*
16+
- *host_luna
17+
- path_regex: hosts/mars/.*/secrets/.*
4218
key_groups:
4319
- age:
4420
- *master
45-
- *host_luna
21+
- *host_mars

‎deploy.sh‎

Lines changed: 86 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,86 @@
1+
#!/usr/bin/env sh
2+
3+
. ./scripts/sops.sh
4+
. ./scripts/ssh.sh
5+
6+
HOST=$(uname -n)
7+
USERNAME=$(id -un)
8+
VERBOSE=0
9+
10+
show_help() {
11+
cat <<EOF
12+
Usage: $0 [OPTION] [ARGUMENT]
13+
14+
Options:
15+
-h, -?, --help Show this help message
16+
-v, --verbose Enable verbose mode
17+
18+
Commands:
19+
install Remotely install a new NixOS system using nixos-anywhere
20+
21+
Examples:
22+
$0 --help
23+
EOF
24+
}
25+
26+
while [ $# -gt 0 ]; do
27+
case "$1" in
28+
"-h" | "-?" | "--help")
29+
show_help
30+
exit 0
31+
;;
32+
"-v" | "--VERBOSE")
33+
VERBOSE=1
34+
;;
35+
--)
36+
shift
37+
break
38+
;;
39+
*) break ;;
40+
esac
41+
shift
42+
done
43+
44+
# ---
45+
46+
WORKDIR=$(mktemp -d)
47+
48+
menu_install() {
49+
echo "Enter target host IP address: "
50+
read HOST_IP
51+
echo "Enter hostname: "
52+
read HOST
53+
echo "Enter username: "
54+
read USERNAME
55+
}
56+
57+
nixos_install() {
58+
nix run github:nix-community/nixos-anywhere -- \
59+
--generate-hardware-config nixos-generate-config "./hosts/${HOST}/hardware-configuration.nix" \
60+
--extra-files "$WORKDIR" \
61+
--flake ".#${HOST}" \
62+
"root@${HOST_IP}"
63+
}
64+
65+
# ---
66+
67+
case "$1" in
68+
"deploy")
69+
menu_install
70+
71+
ssh_generate_host_ssh_key
72+
73+
sops_add_or_update_public_age_key "$(ssh-to-age <"/etc/ssh/ssh_host_ed25519_key.pub")" "host_${HOST}"
74+
75+
sops_add_host_creation_rules "hosts/${HOST}/secrets/.*"
76+
77+
# TODO: figure out how to add anchors and anchor content using yq instead
78+
sed -E -i "s/'([&\*].*)'/\1/" .sops.yaml
79+
80+
sops_rekey
81+
82+
nixos_install
83+
84+
exit 0
85+
;;
86+
esac

‎flake.nix‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -45,9 +45,7 @@
4545
inherit (self) outputs;
4646

4747
systems = [
48-
"aarch64-darwin"
4948
"aarch64-linux"
50-
"x86_64-darwin"
5149
"x86_64-linux"
5250
];
5351

@@ -67,7 +65,6 @@
6765
nixpkgs.lib.nixosSystem {
6866
modules = [
6967
disko.nixosModules.disko
70-
sops-nix.nixosModules.sops
7168
(import ./modules)
7269
(import ./users)
7370
]
@@ -87,6 +84,9 @@
8784
luna = NixosConfiguration {
8885
modules = [ ./hosts/luna ];
8986
};
87+
mars = NixosConfiguration {
88+
modules = [ ./hosts/mars ];
89+
};
9090
};
9191
};
9292
}

‎hosts/luna/default.nix‎

Lines changed: 5 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,6 @@
11
{
2-
inputs,
32
modulesPath,
43
pkgs,
5-
self,
64
...
75
}:
86

@@ -25,7 +23,6 @@ in
2523
environment.systemPackages = with pkgs; [
2624
busybox
2725
git
28-
zsh
2926
];
3027

3128
hardware = {
@@ -36,24 +33,22 @@ in
3633
};
3734

3835
host = {
39-
root = self.outPath;
4036
user.${username}.enable = true;
4137

4238
efi.enable = true;
4339
encryption.enable = true;
4440
btrfs.enable = true;
4541
swap.enable = true;
4642

47-
networking = {
43+
network = {
4844
hostname = "luna";
49-
static = {
50-
systemd-networkd.enable = true;
51-
};
45+
manager.enable = true;
46+
systemd-resolved.enable = true;
5247
};
48+
5349
printing.enable = true;
5450
virtualization.enable = true;
5551

56-
avahi.enable = true;
5752
bluetooth.enable = true;
5853
catt.enable = true;
5954
docker = {
@@ -86,6 +81,7 @@ in
8681
undervolt = {
8782
enable = true;
8883
coreOffset = -125;
84+
8985
gpuOffset = -925;
9086
};
9187
};

‎hosts/luna/hardware-configuration.nix‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -27,9 +27,9 @@
2727
# (the default) this is the recommended approach. When using systemd-networkd it's
2828
# still possible to use this option, but it's recommended to use it in conjunction
2929
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
30-
networking.useDHCP = lib.mkDefault true;
31-
# networking.interfaces.docker0.useDHCP = lib.mkDefault true;
32-
# networking.interfaces.wlan0.useDHCP = lib.mkDefault true;
30+
# networking.useDHCP = lib.mkDefault true;
31+
networking.interfaces.docker0.useDHCP = lib.mkDefault true;
32+
networking.interfaces.wlan0.useDHCP = lib.mkDefault true;
3333

3434
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
3535
hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;

‎hosts/luna/secrets/wireguard-private-key‎

Lines changed: 0 additions & 24 deletions
This file was deleted.

‎hosts/luna/users/shorty/secrets/id_ed25519‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
{
2+
"data": "ENC[AES256_GCM,data:EEIiRpGzZb28fI9cjYuxAD69tIJHgj3ADT2TiLMovVIn0XJm5e9fS2SInmN0MW6ZtT/wlaPpiHRUTs9R5P4/vE0vGvTtm23Hm/yTMiP4aOU2n2mrvQBca5h+A3aQojHiR9tTBMMy2Zsh+AH5MvZeGAP0W5xx74B+uict5LO4ZfNByur7l19o3ezsPq/0gDxjscJT1xGieg9b8sR3GAtw8J34xjKultp8MqrQU5Ng8eLk2vhghAnrrlUW3o1GwRP224EMjMieVzf/tPDkb/yDpAGFtsMJ4yoP90NWZ8IV2KWzaqn45SCk1XpfwKUOx3ILRNkUbQnaTiuqo1m5MNNHB/xE+QzC3ufYfv6TAgfX3EdojxCUs53ZERnsta3dvFp6sfdVXbrR/GVFuy9AnkEmK2Nm05qBnJiLQf7dP4cl3sJlrA3GjKoqwEsz5tMGjR12EJHf1FwWtkIjrL81jnFDr3bZBqFiNYd+a2z9Nc/NwtyJSRpT6UcnPGWczpYHyc4K4x+uG2K67YblHx07TqjV,iv:3koIfiw1sqvSdNZenW8d1tWXa/eOe4bYbjMcspEMnFs=,tag:Kt2sjD2Vrb3p21DByHOYqg==,type:str]",
3+
"sops": {
4+
"age": [
5+
{
6+
"recipient": "age1hy523tlslqas8qgs0lxgxanp9gx06fjekn608w4qf66mxkjzmucqh0g6vg",
7+
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBCUzljQWlRb0ZyNHA1cUNN\nZ09QNXhFS2Q0UEJ5MDRkc29nVWJKQzZabWlZCmdpTjlIbU50Y2hPNU5mS2JGdTFJ\nTHltNEJJRWs0SVBEK2JzcklzaWp6emsKLS0tIFVTbHlOWnNhbWorSndFTmlCMjVj\nZjJkaHZaSUl2YW00MUttaWFFczZOUFEKO6+2ZzBOTwC6bFSf/y34l/okKgy2jYhj\n++IQltnjSEuoVZO9CaBiB0c2eknz382fd4N2uiepF8mRCd7dBHhvqw==\n-----END AGE ENCRYPTED FILE-----\n"
8+
},
9+
{
10+
"recipient": "age10a049meemjvgdgukx6zu5lwu82mqul83l7fyd66tzy9sm8637s7q07ujez",
11+
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBYajRJUTIzdnp4VE5zVnVB\nVHFjbXpZeU11L1JreURNaHNQYWkvM2hmTnhvCjR0V3M3SGJXcDN3NkVoV3NUZ1NV\nNVNlaVdQcXYvYVI3Nm9qMWlPK1VVQVkKLS0tIEFNOGNhTVdKd3h1d3l6czVXQXpX\nRXJHeXExbDRtRkJWUXVxRjZ4OWloSjQKcajyJcZCZoel1qXKES5NmZ/iHgQtiG2Y\npjZqIBrw6FNH1oTXmErLJIBxVW9d5I3bU/xQ2A5jNd3o8OAC9MsTAw==\n-----END AGE ENCRYPTED FILE-----\n"
12+
}
13+
],
14+
"lastmodified": "2025-10-24T11:14:20Z",
15+
"mac": "ENC[AES256_GCM,data:gWhdcymmHdDe3ObVcNgiBDdjgnPhkU7nCJUihVe5UB/bFl/hshLIvysuB7sIFzYDLLoJS3OYJBUtfG8L6ApUWKOMII5P1O7S+0TVzocm6OTORHiMKgAg4PfB5gJBgMZPoM5TDwHkZQFan5jMdZT2I2M3jIZhxNwdJbCqfXN0LZc=,iv:+pKinP22WwwqKwAJG4zvMBaZLC8RVivW/BVnQ1uPC6k=,tag:H9tepOOUIyR1s/asbefKpQ==,type:str]",
16+
"unencrypted_suffix": "_unencrypted",
17+
"version": "3.10.2"
18+
}
19+
}

‎hosts/luna/users/shorty/secrets/id_ed25519.pub‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
{
2+
"data": "ENC[AES256_GCM,data:lpXo14lBouQ8maOZFkxZRAC32m/wDMJHajNJQPF0IAzPxiDPMRwTdIDaqbT7ehJwibHyCFDKeN6ykW415ZkEoyFJRheP3mesKjlH/Blvqszl91uJhqBy7oCBiQSu,iv:S+rrflN8KGkBDui6KyHarzQTuGTN8EivJDuLYFLof8Q=,tag:FV8omreLceM9DA9MYxHfaQ==,type:str]",
3+
"sops": {
4+
"age": [
5+
{
6+
"recipient": "age1hy523tlslqas8qgs0lxgxanp9gx06fjekn608w4qf66mxkjzmucqh0g6vg",
7+
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2SFdqdUZkenRqUjV3d2o5\nS0VXTE1Cak80SHdXcnpCd0FmSTBBR0FwVjNRCjFEYXlLOCtHbUg4RlhmVkV6aldB\nbWxTRDhBd3grcnloMHNSSnFuN3RtTTQKLS0tIGNtTUI2WDVKV0pDU0NwQjRxdFZF\nK3IvQ1pyS3BSbVk5QjUyZk9tVmtFak0KW//YyXr6+6NSlUdatMX00O5dlioLBnqv\njq84ZsgCrzm7KAhStvH3icOGdP1skQ82Wp8B76X3IQQvIqTXLT+Jkw==\n-----END AGE ENCRYPTED FILE-----\n"
8+
},
9+
{
10+
"recipient": "age10a049meemjvgdgukx6zu5lwu82mqul83l7fyd66tzy9sm8637s7q07ujez",
11+
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBvUUxkNVFDVlFYOXpQVk45\nMEtTdEQvMEwramdLQW9XNVBNVDN5Z1JqMlFzClZTakNJVFBSSEFWdlBRN0xITXlS\nYkE2dk0rNDFrcnFwZ2FPL3ZvRTlINEUKLS0tIFhhdkF6ZWwvR3JJMTA2L0hITGsz\nYkhac0FKeHhqUUplblMrd1dpNldNdUUKGQZlACAnWYpxAVO5tHnHg/cJXypujWEk\n9t4pSQIamiFJQ7zeUuNjEPRppQYKuPCkGx6hZ7PUiuLLDNWdL/GzpQ==\n-----END AGE ENCRYPTED FILE-----\n"
12+
}
13+
],
14+
"lastmodified": "2025-10-26T18:29:50Z",
15+
"mac": "ENC[AES256_GCM,data:Ru1Fsr/jcq1ij9NJJyoKy4n0ft98V6u1vBP1tQHTF1bfL6jeHiFDQXdMN52aLAPgWiU0agyfYQ+SW9REoqpW9wMoNRPojGPfdi91Okt8irsdPxDPNTJ7sWA6XeIcLiNpFkFHY1S/VtOFICNLOldnctdHRxBocfsi8E3O7S1g8yM=,iv:yuyTCpLP/C7IE/kP2kGzBiwTLcXoJ1ng6TezKmyGEYY=,tag:rVSdDOCnbaOxxNiI7AIbpw==,type:str]",
16+
"unencrypted_suffix": "_unencrypted",
17+
"version": "3.10.2"
18+
}
19+
}

‎hosts/luna/users/shorty/secrets/passwd‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
{
2+
"data": "ENC[AES256_GCM,data:xhXb0H/xniOvNFtxPVwFsAdaJIRhSlX0PRvamZFCIQDXWgTS2tCvBMHEjtvm2kTgRoEn1wI7PRF6QdDtpemuSXQuPQ/oiaUAAQU=,iv:0oNZ9yVxqp4k10iOkC0xnNqJEPJftTE52svGJ6xz5Oo=,tag:LnG1A+0osRC3LaWDl3lOBA==,type:str]",
3+
"sops": {
4+
"age": [
5+
{
6+
"recipient": "age1hy523tlslqas8qgs0lxgxanp9gx06fjekn608w4qf66mxkjzmucqh0g6vg",
7+
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBaNXJ4TDNxa2FQS2FRSCs2\nVUNSME5SSEtUWTE5OHUveUtHWGVXMHRZZ3pvClljV0Z5OFNyWVpRU3ZTQlVjZng2\nTkc2S0pod01Oa3dHeWlHQWdYTTFnQTAKLS0tIEJpSHk2RHFabG54eGNPTVRIMHBU\nNkZTWVRMenZZamdzTHBzUUFJbGVsT3MKTwwrMTNUIOq8lTvC7uPyYV0n/6eVsF1v\nDIWopzau+JLckuGeddi5W++D3qT2V1Y+37u9MqbBeks1oQ7NENtbvw==\n-----END AGE ENCRYPTED FILE-----\n"
8+
},
9+
{
10+
"recipient": "age10a049meemjvgdgukx6zu5lwu82mqul83l7fyd66tzy9sm8637s7q07ujez",
11+
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBPalNaM2s3MU5uTTNrY0Zz\naTRmbktXVjhmYnZZTTl0WVJZYnZSZHBmclZVClFiYXBpM2xDc2JJZmV1V2dPVEIv\nTjdnU0dmSy96czhMV3YyZGxxRnBEQUUKLS0tIHNoazhXd3M0Wks2Vk1BSTArd1Rt\nNWQ0QTI4bm83U0xhN21ZWmxOTjhVK1UK9jKeX87VhO40kEUG4JDkLOgTKHb5i+5d\nEVJY3KEsbbF0V3H0ND9GJ8MuF1b9RMWjGMkEcardkLuy1M1nmtetDw==\n-----END AGE ENCRYPTED FILE-----\n"
12+
}
13+
],
14+
"lastmodified": "2025-03-11T21:49:48Z",
15+
"mac": "ENC[AES256_GCM,data:oEeEsZwgYq1EeuQKbWTdo5KSUdsVZZMdjFv2v5ThrlGpaJyIeuV5thBhahGEF6xnO/Ah6DZsA72i719vkX2kvG/TpsRDsoyZ9Vjs4OJ9ZgCDIIgFkKmav7mbeRSA0eCr97DUyu7uUHhy7eYvCXnBLLIea/TgJsHvfjA8AQIsauo=,iv:NQPEAYyccEdeWv+iSyZ7T08YZQjysdyaDArtfAiUcKk=,tag:FALOMEkEBGN7yu4ARiKrYA==,type:str]",
16+
"unencrypted_suffix": "_unencrypted",
17+
"version": "3.9.4"
18+
}
19+
}

‎hosts/mars/default.nix‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
{
2+
modulesPath,
3+
pkgs,
4+
...
5+
}:
6+
7+
let
8+
username = "shorty";
9+
in
10+
{
11+
imports = [
12+
(modulesPath + "/installer/scan/not-detected.nix")
13+
(modulesPath + "/profiles/qemu-guest.nix")
14+
./disko.nix
15+
./hardware-configuration.nix
16+
../shared
17+
];
18+
19+
environment.systemPackages = with pkgs; [
20+
busybox
21+
gitMinimal
22+
];
23+
24+
boot.loader.grub = {
25+
efiSupport = true;
26+
efiInstallAsRemovable = true;
27+
};
28+
29+
host = {
30+
user.${username}.enable = true;
31+
32+
network = {
33+
hostname = "mars";
34+
};
35+
36+
docker = {
37+
enable = true;
38+
rootless.enable = false;
39+
};
40+
k3s.enable = true;
41+
42+
openssh.enable = true;
43+
};
44+
}

0 commit comments

Comments
 (0)