hosts: source modules from workstation
Signed-off-by: unexplrd <unexplrd@linerds.us>
This commit is contained in:
@ -5,12 +5,12 @@
|
||||
./boot
|
||||
./disko
|
||||
./hardware
|
||||
./networking.nix
|
||||
./networking
|
||||
./nix
|
||||
../dunamis/programs.nix
|
||||
./services.nix
|
||||
./sops.nix
|
||||
./users.nix
|
||||
../dunamis/services.nix
|
||||
../dunamis/sops.nix
|
||||
../dunamis/users.nix
|
||||
];
|
||||
|
||||
desktop.plasma.enable = true;
|
||||
|
@ -3,7 +3,7 @@
|
||||
networkmanager = {
|
||||
enable = true;
|
||||
ethernet.macAddress = "stable";
|
||||
networkmanager.wifi = {
|
||||
wifi = {
|
||||
backend = "iwd";
|
||||
macAddress = "random";
|
||||
scanRandMacAddress = true;
|
||||
|
@ -1,18 +0,0 @@
|
||||
{pkgs, ...}: {
|
||||
programs.neovim = {
|
||||
enable = false;
|
||||
viAlias = true;
|
||||
vimAlias = true;
|
||||
};
|
||||
programs.nh = {
|
||||
enable = true;
|
||||
clean.enable = true;
|
||||
clean.extraArgs = "--keep-since 7d --keep 3";
|
||||
flake = "/home/user/.config/nixos";
|
||||
};
|
||||
programs.fish.enable = true;
|
||||
environment.systemPackages = with pkgs; [
|
||||
helix
|
||||
# nushell
|
||||
];
|
||||
}
|
@ -1,21 +0,0 @@
|
||||
{
|
||||
services = {
|
||||
# flatpak.enable = true;
|
||||
fstrim.enable = true;
|
||||
openssh.enable = true;
|
||||
power-profiles-daemon.enable = true;
|
||||
syncthing.openDefaultPorts = true;
|
||||
dnscrypt-proxy2 = {
|
||||
enable = true;
|
||||
settings = {
|
||||
require_dnssec = true;
|
||||
server_names = ["mullvad-doh"];
|
||||
bootstrap_resolvers = ["9.9.9.11:53" "9.9.9.9:53"];
|
||||
};
|
||||
};
|
||||
scx = {
|
||||
enable = true;
|
||||
scheduler = "scx_flash";
|
||||
};
|
||||
};
|
||||
}
|
@ -1,64 +0,0 @@
|
||||
{
|
||||
config,
|
||||
inputs,
|
||||
...
|
||||
}: let
|
||||
inherit (inputs) mysecrets;
|
||||
hostName =
|
||||
if (config.networking.hostName == "vylxae")
|
||||
then "sarien"
|
||||
else config.networking.hostName;
|
||||
sopsFile = mysecrets + "/hosts/${hostName}.yaml";
|
||||
dotSsh = name: "/home/user/.ssh/" + name;
|
||||
sshKey = {
|
||||
mode = "0400";
|
||||
owner = "user";
|
||||
};
|
||||
in {
|
||||
imports = with inputs; [
|
||||
sops-nix.nixosModules.sops
|
||||
];
|
||||
|
||||
sops = {
|
||||
age = {
|
||||
sshKeyPaths = ["/etc/ssh/ssh_host_ed25519_key"];
|
||||
keyFile = "/var/lib/sops-nix/key.txt";
|
||||
generateKey = true;
|
||||
};
|
||||
defaultSopsFile = mysecrets + "/common.yaml";
|
||||
secrets = {
|
||||
"user-password-hashed".neededForUsers = true;
|
||||
"ssh-config" = {
|
||||
path = dotSsh "config";
|
||||
mode = "0400";
|
||||
owner = "user";
|
||||
};
|
||||
"ssh-${hostName}-user" = {
|
||||
inherit sopsFile;
|
||||
inherit (sshKey) mode owner;
|
||||
path = dotSsh "id_ed25519";
|
||||
};
|
||||
"ssh-${hostName}-user.pub" = {
|
||||
inherit sopsFile;
|
||||
inherit (sshKey) mode owner;
|
||||
path = dotSsh "id_ed25519.pub";
|
||||
};
|
||||
"ssh-unexplrd" = {
|
||||
inherit (sshKey) mode owner;
|
||||
path = dotSsh "id_unexplrd_ed25519";
|
||||
};
|
||||
"ssh-unexplrd.pub" = {
|
||||
inherit (sshKey) mode owner;
|
||||
path = dotSsh "id_unexplrd_ed25519.pub";
|
||||
};
|
||||
"ssh-uni" = {
|
||||
inherit (sshKey) mode owner;
|
||||
path = dotSsh "id_uni_ed25519";
|
||||
};
|
||||
"ssh-uni.pub" = {
|
||||
inherit (sshKey) mode owner;
|
||||
path = dotSsh "id_uni_ed25519.pub";
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
@ -1,26 +0,0 @@
|
||||
{
|
||||
inputs,
|
||||
config,
|
||||
pkgs,
|
||||
...
|
||||
}: let
|
||||
inherit (config.sops) secrets;
|
||||
inherit (inputs) mysecrets;
|
||||
in {
|
||||
nix.settings.trusted-users = ["user"];
|
||||
users.mutableUsers = false;
|
||||
users.users = {
|
||||
user = {
|
||||
hashedPasswordFile = secrets."user-password-hashed".path;
|
||||
extraGroups = ["wheel" "video" "libvirtd" "dialout"];
|
||||
isNormalUser = true;
|
||||
shell = pkgs.fish;
|
||||
openssh.authorizedKeys.keyFiles = map (f: "${mysecrets}/ssh/user/id_${f}_ed25519.pub") [
|
||||
"dunamis"
|
||||
"eldrid"
|
||||
"sarien"
|
||||
"legion"
|
||||
];
|
||||
};
|
||||
};
|
||||
}
|
Reference in New Issue
Block a user