Set up secrets for Archie

The device key seems to escape the \x in the label, so I switched away from double quotes to avoid that

flake.nix

@@ -34,6 +34,22 @@ outputs = {nixpkgs, agenix, home-manager, nixpkgs-unstable, nix-impermanence, ..
 	};
 
 	nixosConfigurations = {
+		Archie = nixpkgs-unstable.lib.nixosSystem {
+			system = "x86_64-linux";
+			pkgs = import nixpkgs-unstable {
+				system = "x86_64-linux";
+				config = { allowUnfree = true; };
+			};
+			modules = [
+				# Needed for nix-index
+				{ nix.nixPath = [ "nixpkgs=${nixpkgs}" ]; }
+				agenix.nixosModules.default
+				home-manager.nixosModule
+				./roles/common
+				./machines/Archie
+			];
+		};
+
 		Everest = nixpkgs.lib.nixosSystem {
 			system = "x86_64-linux";
 			pkgs = import nixpkgs {

machines/Archie/configuration.nix

@@ -0,0 +1,102 @@
+# Edit this configuration file to define what should be installed on
+# your system.  Help is available in the configuration.nix(5) man page
+# and in the NixOS manual (accessible by running `nixos-help`).
+
+{ config, pkgs, ... }:
+
+{
+	# Use grub boot loader
+	boot.loader = {
+		systemd-boot.enable = false;
+		grub = {
+			enable = true;
+			device = "nodev";
+			efiSupport = true;
+			useOSProber = true;
+		};
+		efi.efiSysMountPoint = "/boot/efi";
+	};
+	boot.loader.efi.canTouchEfiVariables = true;
+
+	networking.hostName = "Archie"; # Define your hostname.
+	networking.networkmanager.enable = true; # Enable networking
+
+	# Set your time zone.
+	time.timeZone = "Europe/Madrid";
+
+	# Configure network proxy if necessary
+	# networking.proxy.default = "http://user:password@proxy:port/";
+	# networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";
+
+	# Select internationalisation properties.
+	i18n.defaultLocale = "en_US.UTF-8";
+	console = {
+		keyMap = "es";
+	};
+
+	# Enable the X11 windowing system.
+	services.xserver.enable = true;
+
+
+	# Enable the Plasma 5 Desktop Environment.
+	services.xserver.displayManager.sddm.enable = true;
+	services.xserver.desktopManager.plasma5.enable = true;
+	
+
+	# Configure keymap in X11
+	# services.xserver.layout = "us";
+	# services.xserver.xkbOptions = "eurosign:e,caps:escape";
+
+	# Enable CUPS to print documents.
+	# services.printing.enable = true;
+
+	# Enable sound.
+	# sound.enable = true;
+	# hardware.pulseaudio.enable = true;
+
+	# Enable touchpad support (enabled default in most desktopManager).
+	# services.xserver.libinput.enable = true;
+
+	# Define a user account. Don't forget to set a password with ‘passwd’.
+	users.users.toast = {
+		isNormalUser = true;
+		extraGroups = [ "wheel" ]; # Enable ‘sudo’ for the user.
+		packages = with pkgs; [
+			firefox
+			tree
+		];
+	};
+
+	# List packages installed in system profile. To search, run:
+	# $ nix search wget
+	# environment.systemPackages = with pkgs; [
+	#   vim # Do not forget to add an editor to edit configuration.nix! The Nano editor is also installed by default.
+	#   wget
+	# ];
+
+	# Some programs need SUID wrappers, can be configured further or are
+	# started in user sessions.
+	# programs.mtr.enable = true;
+	# programs.gnupg.agent = {
+	#   enable = true;
+	#   enableSSHSupport = true;
+	# };
+
+	# List services that you want to enable:
+
+	# Enable the OpenSSH daemon.
+	# services.openssh.enable = true;
+
+	# Open ports in the firewall.
+	# networking.firewall.allowedTCPPorts = [ ... ];
+	# networking.firewall.allowedUDPPorts = [ ... ];
+	# Or disable the firewall altogether.
+	# networking.firewall.enable = false;
+
+	# Copy the NixOS configuration file and link it from the resulting system
+	# (/run/current-system/configuration.nix). This is useful in case you
+	# accidentally delete configuration.nix.
+	# system.copySystemConfiguration = true;
+
+}
+

machines/Archie/default.nix

@@ -0,0 +1,8 @@
+{ ... }:
+
+{
+	imports = [
+		./configuration.nix
+		./hardware-configuration.nix
+	];
+}

machines/Archie/hardware-configuration.nix

@@ -0,0 +1,43 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+	imports =
+		[ (modulesPath + "/installer/scan/not-detected.nix")
+		];
+
+	boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "usbhid" "usb_storage" "sd_mod" ];
+	boot.initrd.kernelModules = [ ];
+	boot.kernelModules = [ "kvm-amd" ];
+	boot.extraModulePackages = [ ];
+
+	fileSystems."/" =
+		{ device = "/dev/disk/by-uuid/5322c217-b87b-4150-8b4c-a8fa17a899bf";
+			fsType = "btrfs";
+			options = [ "subvol=@root" "compress=zstd" ];
+		};
+
+	fileSystems."/nix" =
+		{ device = "/dev/disk/by-uuid/5322c217-b87b-4150-8b4c-a8fa17a899bf";
+			fsType = "btrfs";
+			options = [ "subvol=@nix" "compress=zstd" ];
+		};
+
+	fileSystems."/boot" =
+		{ device = "/dev/disk/by-uuid/5322c217-b87b-4150-8b4c-a8fa17a899bf";
+			fsType = "btrfs";
+			options = [ "subvol=@boot" "compress=zstd" ];
+		};
+
+	fileSystems."/boot/efi" =
+		{ device = "/dev/disk/by-uuid/FB87-4CBC";
+			fsType = "vfat";
+		};
+
+	swapDevices = [ ];
+
+	nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+	hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+}

roles/common/configuration.nix

@@ -24,23 +24,23 @@
 		secrets = {
 			"ed25519" = {
 				symlink = false;
-				file = ../../secrets/Everest/host-key-ed25519;
+				file = ../../secrets/${config.networking.hostName}/host-key-ed25519;
 				path = "/etc/ssh/ssh_host_ed25519_key";
 			};
 			"rsa" = {
 				symlink = false;
-				file = ../../secrets/Everest/host-key-rsa;
+				file = ../../secrets/${config.networking.hostName}/host-key-rsa;
 				path= "/etc/ssh/ssh_host_rsa_key";
 			};
 			"ed25519-public" = {
 				symlink = false;
-				file = ../../secrets/Everest/host-key-ed25519-public;
+				file = ../../secrets/${config.networking.hostName}/host-key-ed25519-public;
 				path = "/etc/ssh/ssh_host_ed25519_key.pub";
 				mode = "0644";
 			};
 			"rsa-public" = {
 				symlink = false;
-				file = ../../secrets/Everest/host-key-rsa-public;
+				file = ../../secrets/${config.networking.hostName}/host-key-rsa-public;
 				path = "/etc/ssh/ssh_host_rsa_key.pub";
 				mode = "0644";
 			};

secrets/Archie/host-key-ed25519

@@ -0,0 +1,14 @@
+age-encryption.org/v1
+-> ssh-ed25519 zhSyTg v0zMwf3PyU8i5Z8cKQAM8G/egqkmPONA7twvIsTtFUU
+4BlqeR6PpQrYwf7BT1UXqzaiiNwHAxsbbvX1Sk7YG7M
+-> ssh-ed25519 AuWU1Q m0nCQcYG0Jz8AeouayMRTPiQvZxWDbci88ouaaW1kBE
+FMRP4tDLTQ8wo/9j6AaVhl4/amQAjgZDPKqmtzTwHbI
+-> tR-grease jXU
+zPQZdJy9DQ9MUenFWBk
+--- NY5Z2u04JmXtfy09gfYTziCNqdXfSXQLe3n/e7wburg
+åê
+šKàQoƒa|É—·²ëÞ âÜ.ýƒùhSÞ
+^aɹL)m.	At‘}B¡RüÈ!7ÌJí¿%fÒ#f_/=´ïïÏÞd›:§‡\[ùTý<54>ãxÈ”—U³s(†:‘’ÝI¨ãˆ~-¢ºiº”-l!(íÌ®S†G¿»½^öä¹Ù¢ØVŒ¤Ú—ig¾ñ~ò™MDdn–WõqûÕb7¼ÃÊÖáñ‘†ôP\÷²CαˆØü½Iõþë}©ÍmsUè•4="™‚‰1Ï.Ùõ±:aT-Oo<4F>yˆ¢%v¥$iBåN—À)s8¿OV(EÇ…ì­¯ôtW•i;n·€Pè7æÝQº‡çó0†Â·„tRúá+W´’1Bdé„T’òTO…W¡f>å”æ6Cß>ö<0E>´nT¾ô
+ÈKÙ)åDÍ81Õi<17>lÃß3JPQw¢Õ.w\&6¢Åö¿j ”T:¥8E`,•Ò"ÔìaÒ‚<Êd<>K×rc2ä´ƒ<´ÔÞ~¹ù
+h?FŽc
+ÐΣJ
öüto›D€Æ

secrets/Archie/host-key-ed25519-public

@@ -0,0 +1,10 @@
+age-encryption.org/v1
+-> ssh-ed25519 zhSyTg Xkk6wPQm3Sm3RuNyKhnKVz/evGJtr0UwhB7m2iuhrR4
+RMheqKeCD+Py22+xmvp3Se1z84t60+6y1Bbt7uYGxFs
+-> ssh-ed25519 AuWU1Q 5l5/vuIGxW+6ZzlDKjLzNCxyiW1+Kh651xpnwjfF3FQ
+ZIx/zZZMPpO8zDW5JdkucIBVH1xK4KtoA7Kovw+bcOU
+-> 7%-grease [ wwEC MxP UF:U6Cy
+Hp7t6AxdTAfm4r/LMWAt22vOYvhfHJLX4BIB7eEUfQnNAPIx43SrK8QIrAGHWbxN
+hdO18C5g6xoE5HHz5uM5ASzUWC4Nws3OXwY
+--- 2kwRA1NakiMhvMQgkaiEiJ93SkjTmOt77m0tO+e/p/w
+Ï ^^ðè”Ià=Õð•ñÏ*Ã='çVå[$-Ä<10>ÙÕʲ}	.’¼²=€&°<>É­ºl@®l5êÇ×<C387>p¯—¯¼™IÈKVèˆN¼‡Œ“‹C¡ÔŽI¥¼š_<³g.…ïÄmf}Oá4(<28>шûöø¾@Ç;

secrets/secrets.nix

@@ -1,5 +1,6 @@
 let
 	everest = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID7GzKZIK/UAMfRjsaxWWKOBqG7sa1ttJ+Gp0zTQSBXM root@Everest";
+	archie = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINuqKOfYb2lyhoQYBQbuIEyMomze872rnpxDnax8BsC5 root@Archie";
   bootsrtrap = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMKloSXSeF4dNXebd93uMuiFuXRHfxo/he4+O9SFTz1s bootstrap key";
 in
 {
@@ -10,4 +11,8 @@ in
 	"Everest/host-key-ed25519-public".publicKeys = [ everest bootsrtrap ];
 	"Everest/host-key-rsa".publicKeys = [ everest bootsrtrap ];
 	"Everest/host-key-rsa-public".publicKeys = [ everest bootsrtrap ];
+	"Archie/host-key-ed25519".publicKeys = [ archie  bootsrtrap ];
+	"Archie/host-key-ed25519-public".publicKeys = [ archie bootsrtrap ];
+	"Archie/host-key-rsa".publicKeys = [ archie bootsrtrap ];
+	"Archie/host-key-rsa-public".publicKeys = [ archie bootsrtrap ];
 }