diff --git a/flake.nix b/flake.nix index 0909ddf..0d440aa 100755 --- a/flake.nix +++ b/flake.nix @@ -34,6 +34,22 @@ outputs = {nixpkgs, agenix, home-manager, nixpkgs-unstable, nix-impermanence, .. }; nixosConfigurations = { + Archie = nixpkgs-unstable.lib.nixosSystem { + system = "x86_64-linux"; + pkgs = import nixpkgs-unstable { + system = "x86_64-linux"; + config = { allowUnfree = true; }; + }; + modules = [ + # Needed for nix-index + { nix.nixPath = [ "nixpkgs=${nixpkgs}" ]; } + agenix.nixosModules.default + home-manager.nixosModule + ./roles/common + ./machines/Archie + ]; + }; + Everest = nixpkgs.lib.nixosSystem { system = "x86_64-linux"; pkgs = import nixpkgs { diff --git a/machines/Archie/configuration.nix b/machines/Archie/configuration.nix new file mode 100644 index 0000000..99ae850 --- /dev/null +++ b/machines/Archie/configuration.nix @@ -0,0 +1,102 @@ +# Edit this configuration file to define what should be installed on +# your system. Help is available in the configuration.nix(5) man page +# and in the NixOS manual (accessible by running `nixos-help`). + +{ config, pkgs, ... }: + +{ + # Use grub boot loader + boot.loader = { + systemd-boot.enable = false; + grub = { + enable = true; + device = "nodev"; + efiSupport = true; + useOSProber = true; + }; + efi.efiSysMountPoint = "/boot/efi"; + }; + boot.loader.efi.canTouchEfiVariables = true; + + networking.hostName = "Archie"; # Define your hostname. + networking.networkmanager.enable = true; # Enable networking + + # Set your time zone. + time.timeZone = "Europe/Madrid"; + + # Configure network proxy if necessary + # networking.proxy.default = "http://user:password@proxy:port/"; + # networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain"; + + # Select internationalisation properties. + i18n.defaultLocale = "en_US.UTF-8"; + console = { + keyMap = "es"; + }; + + # Enable the X11 windowing system. + services.xserver.enable = true; + + + # Enable the Plasma 5 Desktop Environment. + services.xserver.displayManager.sddm.enable = true; + services.xserver.desktopManager.plasma5.enable = true; + + + # Configure keymap in X11 + # services.xserver.layout = "us"; + # services.xserver.xkbOptions = "eurosign:e,caps:escape"; + + # Enable CUPS to print documents. + # services.printing.enable = true; + + # Enable sound. + # sound.enable = true; + # hardware.pulseaudio.enable = true; + + # Enable touchpad support (enabled default in most desktopManager). + # services.xserver.libinput.enable = true; + + # Define a user account. Don't forget to set a password with ‘passwd’. + users.users.toast = { + isNormalUser = true; + extraGroups = [ "wheel" ]; # Enable ‘sudo’ for the user. + packages = with pkgs; [ + firefox + tree + ]; + }; + + # List packages installed in system profile. To search, run: + # $ nix search wget + # environment.systemPackages = with pkgs; [ + # vim # Do not forget to add an editor to edit configuration.nix! The Nano editor is also installed by default. + # wget + # ]; + + # Some programs need SUID wrappers, can be configured further or are + # started in user sessions. + # programs.mtr.enable = true; + # programs.gnupg.agent = { + # enable = true; + # enableSSHSupport = true; + # }; + + # List services that you want to enable: + + # Enable the OpenSSH daemon. + # services.openssh.enable = true; + + # Open ports in the firewall. + # networking.firewall.allowedTCPPorts = [ ... ]; + # networking.firewall.allowedUDPPorts = [ ... ]; + # Or disable the firewall altogether. + # networking.firewall.enable = false; + + # Copy the NixOS configuration file and link it from the resulting system + # (/run/current-system/configuration.nix). This is useful in case you + # accidentally delete configuration.nix. + # system.copySystemConfiguration = true; + +} + diff --git a/machines/Archie/default.nix b/machines/Archie/default.nix new file mode 100755 index 0000000..5bf2485 --- /dev/null +++ b/machines/Archie/default.nix @@ -0,0 +1,8 @@ +{ ... }: + +{ + imports = [ + ./configuration.nix + ./hardware-configuration.nix + ]; +} diff --git a/machines/Archie/hardware-configuration.nix b/machines/Archie/hardware-configuration.nix new file mode 100644 index 0000000..cd626b4 --- /dev/null +++ b/machines/Archie/hardware-configuration.nix @@ -0,0 +1,43 @@ +# Do not modify this file! It was generated by ‘nixos-generate-config’ +# and may be overwritten by future invocations. Please make changes +# to /etc/nixos/configuration.nix instead. +{ config, lib, pkgs, modulesPath, ... }: + +{ + imports = + [ (modulesPath + "/installer/scan/not-detected.nix") + ]; + + boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "usbhid" "usb_storage" "sd_mod" ]; + boot.initrd.kernelModules = [ ]; + boot.kernelModules = [ "kvm-amd" ]; + boot.extraModulePackages = [ ]; + + fileSystems."/" = + { device = "/dev/disk/by-uuid/5322c217-b87b-4150-8b4c-a8fa17a899bf"; + fsType = "btrfs"; + options = [ "subvol=@root" "compress=zstd" ]; + }; + + fileSystems."/nix" = + { device = "/dev/disk/by-uuid/5322c217-b87b-4150-8b4c-a8fa17a899bf"; + fsType = "btrfs"; + options = [ "subvol=@nix" "compress=zstd" ]; + }; + + fileSystems."/boot" = + { device = "/dev/disk/by-uuid/5322c217-b87b-4150-8b4c-a8fa17a899bf"; + fsType = "btrfs"; + options = [ "subvol=@boot" "compress=zstd" ]; + }; + + fileSystems."/boot/efi" = + { device = "/dev/disk/by-uuid/FB87-4CBC"; + fsType = "vfat"; + }; + + swapDevices = [ ]; + + nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux"; + hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware; +} diff --git a/roles/common/configuration.nix b/roles/common/configuration.nix index 2c4bba9..34901b3 100755 --- a/roles/common/configuration.nix +++ b/roles/common/configuration.nix @@ -24,23 +24,23 @@ secrets = { "ed25519" = { symlink = false; - file = ../../secrets/Everest/host-key-ed25519; + file = ../../secrets/${config.networking.hostName}/host-key-ed25519; path = "/etc/ssh/ssh_host_ed25519_key"; }; "rsa" = { symlink = false; - file = ../../secrets/Everest/host-key-rsa; + file = ../../secrets/${config.networking.hostName}/host-key-rsa; path= "/etc/ssh/ssh_host_rsa_key"; }; "ed25519-public" = { symlink = false; - file = ../../secrets/Everest/host-key-ed25519-public; + file = ../../secrets/${config.networking.hostName}/host-key-ed25519-public; path = "/etc/ssh/ssh_host_ed25519_key.pub"; mode = "0644"; }; "rsa-public" = { symlink = false; - file = ../../secrets/Everest/host-key-rsa-public; + file = ../../secrets/${config.networking.hostName}/host-key-rsa-public; path = "/etc/ssh/ssh_host_rsa_key.pub"; mode = "0644"; }; diff --git a/secrets/Archie/host-key-ed25519 b/secrets/Archie/host-key-ed25519 new file mode 100644 index 0000000..ddd8e91 --- /dev/null +++ b/secrets/Archie/host-key-ed25519 @@ -0,0 +1,14 @@ +age-encryption.org/v1 +-> ssh-ed25519 zhSyTg v0zMwf3PyU8i5Z8cKQAM8G/egqkmPONA7twvIsTtFUU +4BlqeR6PpQrYwf7BT1UXqzaiiNwHAxsbbvX1Sk7YG7M +-> ssh-ed25519 AuWU1Q m0nCQcYG0Jz8AeouayMRTPiQvZxWDbci88ouaaW1kBE +FMRP4tDLTQ8wo/9j6AaVhl4/amQAjgZDPKqmtzTwHbI +-> tR-grease jXU +zPQZdJy9DQ9MUenFWBk +--- NY5Z2u04JmXtfy09gfYTziCNqdXfSXQLe3n/e7wburg + +KQoa|ɗ .hS +^aɹL)m. At}BR!7J%f#f_/=d:\[ TxȔUs(:I~-i -l!(̮SG^٢Vڗig~MDdnWqÕb7P\CαI}msU4="1.:aT-Ooy%v$iBN)s8OV(EDžtWi;nP7Q0·tR+W1BdTTOWf>6C>nT¾ +K)D81il3JPQw.w\&6j T:8E`,"a҂<dKrc2䴃<~ +h?Fc + ΣJtoD \ No newline at end of file diff --git a/secrets/Archie/host-key-ed25519-public b/secrets/Archie/host-key-ed25519-public new file mode 100644 index 0000000..91e279e --- /dev/null +++ b/secrets/Archie/host-key-ed25519-public @@ -0,0 +1,10 @@ +age-encryption.org/v1 +-> ssh-ed25519 zhSyTg Xkk6wPQm3Sm3RuNyKhnKVz/evGJtr0UwhB7m2iuhrR4 +RMheqKeCD+Py22+xmvp3Se1z84t60+6y1Bbt7uYGxFs +-> ssh-ed25519 AuWU1Q 5l5/vuIGxW+6ZzlDKjLzNCxyiW1+Kh651xpnwjfF3FQ +ZIx/zZZMPpO8zDW5JdkucIBVH1xK4KtoA7Kovw+bcOU +-> 7%-grease [ wwEC MxP UF:U6Cy +Hp7t6AxdTAfm4r/LMWAt22vOYvhfHJLX4BIB7eEUfQnNAPIx43SrK8QIrAGHWbxN +hdO18C5g6xoE5HHz5uM5ASzUWC4Nws3OXwY +--- 2kwRA1NakiMhvMQgkaiEiJ93SkjTmOt77m0tO+e/p/w +^^I=*='V [$-ʲ} .=&ɭl@l5׏pIKVNCԎ I_<g.mf}O4( @ ; \ No newline at end of file diff --git a/secrets/Archie/host-key-rsa b/secrets/Archie/host-key-rsa new file mode 100644 index 0000000..e323c7a Binary files /dev/null and b/secrets/Archie/host-key-rsa differ diff --git a/secrets/Archie/host-key-rsa-public b/secrets/Archie/host-key-rsa-public new file mode 100644 index 0000000..8bb561d Binary files /dev/null and b/secrets/Archie/host-key-rsa-public differ diff --git a/secrets/secrets.nix b/secrets/secrets.nix index 848c315..5c1d5a7 100755 --- a/secrets/secrets.nix +++ b/secrets/secrets.nix @@ -1,5 +1,6 @@ let everest = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID7GzKZIK/UAMfRjsaxWWKOBqG7sa1ttJ+Gp0zTQSBXM root@Everest"; + archie = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINuqKOfYb2lyhoQYBQbuIEyMomze872rnpxDnax8BsC5 root@Archie"; bootsrtrap = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMKloSXSeF4dNXebd93uMuiFuXRHfxo/he4+O9SFTz1s bootstrap key"; in { @@ -10,4 +11,8 @@ in "Everest/host-key-ed25519-public".publicKeys = [ everest bootsrtrap ]; "Everest/host-key-rsa".publicKeys = [ everest bootsrtrap ]; "Everest/host-key-rsa-public".publicKeys = [ everest bootsrtrap ]; + "Archie/host-key-ed25519".publicKeys = [ archie bootsrtrap ]; + "Archie/host-key-ed25519-public".publicKeys = [ archie bootsrtrap ]; + "Archie/host-key-rsa".publicKeys = [ archie bootsrtrap ]; + "Archie/host-key-rsa-public".publicKeys = [ archie bootsrtrap ]; }