hosts/dunamis/nix.nix: sync nix

hosts/eldrid/nix.nix: sync nix
hosts/sarien/nix.nix: sync nix

Signed-off-by: unexplrd <unexplrd@linerds.us>

flake.lock

@@ -1120,11 +1120,11 @@
     "mysecrets": {
       "flake": false,
       "locked": {
-        "lastModified": 1743273192,
-        "narHash": "sha256-G9VhIc+Fc+w4LDR81xmkj3xxbrvYJUOTM9sM4191ucY=",
+        "lastModified": 1743935322,
+        "narHash": "sha256-x/yc+PK6q8mE1iWh43GRBfN0CfLL2RH4fDHvmQwcVRo=",
         "ref": "refs/heads/main",
-        "rev": "e8f749354223905785f4510fde10b528bf1b2ba2",
-        "revCount": 13,
+        "rev": "44bde2e703b87c91862d9273c57f8122a6b408b3",
+        "revCount": 14,
         "type": "git",
         "url": "ssh://gitea@gitea.linerds.us/unexplrd/nix-secrets"
       },

hosts/dunamis/nix.nix

@@ -2,12 +2,14 @@
 {
   config,
   inputs,
+  # pkgs,
   ...
 }: {
   imports = with inputs; [
-    lix.nixosModules.default
+    determinate.nixosModules.default
   ];
   nix = {
+    # package = pkgs.lix;
     channel.enable = false;
     settings.experimental-features = ["nix-command" "flakes"];
     daemonCPUSchedPolicy = "idle";

hosts/dunamis/programs.nix

@@ -7,8 +7,6 @@
     fish.enable = true;
     nh = {
       enable = true;
-      clean.enable = true;
-      clean.extraArgs = "--keep-since 7d --keep 3";
       flake = "/home/user/.config/nixos";
     };
   };

hosts/dunamis/sops.nix

@@ -3,9 +3,17 @@
   inputs,
   ...
 }: let
-  s = inputs.mysecrets;
-  hostname = config.networking.hostName;
-  sopsFile = "${s}/hosts/${hostname}.yaml";
+  inherit (inputs) mysecrets;
+  hostName =
+    if (config.networking.hostName == "vylxae")
+    then "sarien"
+    else config.networking.hostName;
+  sopsFile = mysecrets + "/hosts/${hostName}.yaml";
+  dotSsh = name: "/home/user/.ssh/" + name;
+  sshKey = {
+    mode = "0400";
+    owner = "user";
+  };
 in {
   imports = with inputs; [
     sops-nix.nixosModules.sops
@@ -17,45 +25,39 @@ in {
       keyFile = "/var/lib/sops-nix/key.txt";
       generateKey = true;
     };
-    defaultSopsFile = "${s}/common.yaml";
+    defaultSopsFile = mysecrets + "/common.yaml";
     secrets = {
       "user-password-hashed".neededForUsers = true;
       "ssh-config" = {
-        path = "/home/user/.ssh/config";
+        path = dotSsh "config";
         mode = "0400";
         owner = "user";
       };
-      "ssh-${hostname}-user" = {
+      "ssh-${hostName}-user" = {
         inherit sopsFile;
-        path = "/home/user/.ssh/id_ed25519";
-        mode = "0400";
-        owner = "user";
+        inherit (sshKey) mode owner;
+        path = dotSsh "id_ed25519";
       };
-      "ssh-${hostname}-user.pub" = {
+      "ssh-${hostName}-user.pub" = {
         inherit sopsFile;
-        path = "/home/user/.ssh/id_ed25519.pub";
-        mode = "0400";
-        owner = "user";
+        inherit (sshKey) mode owner;
+        path = dotSsh "id_ed25519.pub";
       };
       "ssh-unexplrd" = {
-        path = "/home/user/.ssh/id_unexplrd_ed25519";
-        mode = "0400";
-        owner = "user";
+        inherit (sshKey) mode owner;
+        path = dotSsh "id_unexplrd_ed25519";
       };
       "ssh-unexplrd.pub" = {
-        path = "/home/user/.ssh/id_unexplrd_ed25519.pub";
-        mode = "0400";
-        owner = "user";
+        inherit (sshKey) mode owner;
+        path = dotSsh "id_unexplrd_ed25519.pub";
       };
       "ssh-uni" = {
-        path = "/home/user/.ssh/id_uni_ed25519";
-        mode = "0400";
-        owner = "user";
+        inherit (sshKey) mode owner;
+        path = dotSsh "id_uni_ed25519";
       };
       "ssh-uni.pub" = {
-        path = "/home/user/.ssh/id_uni_ed25519.pub";
-        mode = "0400";
-        owner = "user";
+        inherit (sshKey) mode owner;
+        path = dotSsh "id_uni_ed25519.pub";
       };
     };
   };

hosts/dunamis/users.nix

@@ -4,20 +4,21 @@
   pkgs,
   ...
 }: let
-  sopSec = config.sops.secrets;
-  s = inputs.mysecrets;
+  inherit (config.sops) secrets;
+  inherit (inputs) mysecrets;
 in {
   nix.settings.trusted-users = ["user" "nix-ssh"];
   users.mutableUsers = false;
   users.users = {
     user = {
-      hashedPasswordFile = sopSec."user-password-hashed".path;
+      hashedPasswordFile = secrets."user-password-hashed".path;
       extraGroups = ["wheel" "video" "libvirtd" "dialout"];
       isNormalUser = true;
       shell = pkgs.fish;
-      openssh.authorizedKeys.keyFiles = map (f: s + "/ssh/" + f) [
-        "id_ed25519_sarien_user.pub"
-        "id_ed25519_eldrid_user.pub"
+      openssh.authorizedKeys.keyFiles = map (f: "${mysecrets}/ssh/user/${f}") [
+        "id_dunamis_ed25519.pub"
+        "id_eldrid_ed25519.pub"
+        "id_sarien_ed25519.pub"
       ];
     };
   };

hosts/eldrid/configuration.nix

@@ -8,7 +8,7 @@
     ./networking.nix
     ./nix.nix
     ./power-saving.nix
-    ./programs.nix
+    ../dunamis/programs.nix
     ./services.nix
     ./sops.nix
     ./users.nix

hosts/eldrid/nix.nix

@@ -1,12 +1,18 @@
+# TODO: better file name
 {
   config,
   inputs,
+  # pkgs,
   ...
-}: {
+}: let
+  inherit (config.sops) secrets;
+  inherit (inputs) mysecrets;
+in {
   imports = with inputs; [
-    lix.nixosModules.default
+    determinate.nixosModules.default
   ];
   nix = {
+    # package = pkgs.lix;
     channel.enable = false;
     daemonCPUSchedPolicy = "idle";
     settings = {
@@ -19,9 +25,9 @@
         hostName = "dunamis";
         sshUser = "nix-ssh";
         system = "x86_64-linux";
-        sshKey = config.sops.secrets."ssh-eldrid-user".path;
+        sshKey = secrets."ssh-eldrid-user".path;
         supportedFeatures = ["nixos-test" "big-parallel" "kvm" "benchmark"];
-        publicHostKey = builtins.readFile "${inputs.mysecrets}/ssh/ssh_host_ed25519_dunamis.base64";
+        publicHostKey = builtins.readFile "${mysecrets}/ssh/ssh_host_ed25519_dunamis.base64";
       }
     ];
   };

hosts/eldrid/sops.nix

@@ -3,9 +3,17 @@
   inputs,
   ...
 }: let
-  s = inputs.mysecrets;
-  hostname = config.networking.hostName;
-  sopsFile = "${s}/hosts/${hostname}.yaml";
+  inherit (inputs) mysecrets;
+  hostName =
+    if (config.networking.hostName == "vylxae")
+    then "sarien"
+    else config.networking.hostName;
+  sopsFile = mysecrets + "/hosts/${hostName}.yaml";
+  dotSsh = name: "/home/user/.ssh/" + name;
+  sshKey = {
+    mode = "0400";
+    owner = "user";
+  };
 in {
   imports = with inputs; [
     sops-nix.nixosModules.sops
@@ -17,45 +25,39 @@ in {
       keyFile = "/var/lib/sops-nix/key.txt";
       generateKey = true;
     };
-    defaultSopsFile = "${s}/common.yaml";
+    defaultSopsFile = mysecrets + "/common.yaml";
     secrets = {
       "user-password-hashed".neededForUsers = true;
       "ssh-config" = {
-        path = "/home/user/.ssh/config";
+        path = dotSsh "config";
         mode = "0400";
         owner = "user";
       };
-      "ssh-${hostname}-user" = {
+      "ssh-${hostName}-user" = {
         inherit sopsFile;
-        path = "/home/user/.ssh/id_ed25519";
-        mode = "0400";
-        owner = "user";
+        inherit (sshKey) mode owner;
+        path = dotSsh "id_ed25519";
       };
-      "ssh-${hostname}-user.pub" = {
+      "ssh-${hostName}-user.pub" = {
         inherit sopsFile;
-        path = "/home/user/.ssh/id_ed25519.pub";
-        mode = "0400";
-        owner = "user";
+        inherit (sshKey) mode owner;
+        path = dotSsh "id_ed25519.pub";
       };
       "ssh-unexplrd" = {
-        path = "/home/user/.ssh/id_unexplrd_ed25519";
-        mode = "0400";
-        owner = "user";
+        inherit (sshKey) mode owner;
+        path = dotSsh "id_unexplrd_ed25519";
       };
       "ssh-unexplrd.pub" = {
-        path = "/home/user/.ssh/id_unexplrd_ed25519.pub";
-        mode = "0400";
-        owner = "user";
+        inherit (sshKey) mode owner;
+        path = dotSsh "id_unexplrd_ed25519.pub";
       };
       "ssh-uni" = {
-        path = "/home/user/.ssh/id_uni_ed25519";
-        mode = "0400";
-        owner = "user";
+        inherit (sshKey) mode owner;
+        path = dotSsh "id_uni_ed25519";
       };
       "ssh-uni.pub" = {
-        path = "/home/user/.ssh/id_uni_ed25519.pub";
-        mode = "0400";
-        owner = "user";
+        inherit (sshKey) mode owner;
+        path = dotSsh "id_uni_ed25519.pub";
       };
     };
   };

hosts/eldrid/users.nix

@@ -4,27 +4,22 @@
   pkgs,
   ...
 }: let
-  sopSec = config.sops.secrets;
-  secrets = inputs.mysecrets;
+  inherit (config.sops) secrets;
+  inherit (inputs) mysecrets;
 in {
   nix.settings.trusted-users = ["user"];
   users.mutableUsers = false;
   users.users = {
     user = {
-      hashedPasswordFile = sopSec."user-password-hashed".path;
-      # passwordFile = config.sops.secrets.user-password.path;
-      isNormalUser = true;
+      hashedPasswordFile = secrets."user-password-hashed".path;
       extraGroups = ["wheel" "video" "libvirtd" "dialout"];
+      isNormalUser = true;
       shell = pkgs.fish;
-      openssh.authorizedKeys.keyFiles = [
-        "${secrets}/ssh/id_ed25519_sarien_user.pub"
-        "${secrets}/ssh/id_ed25519_eldrid_user.pub"
+      openssh.authorizedKeys.keyFiles = map (f: "${mysecrets}/ssh/user/${f}") [
+        "id_dunamis_ed25519.pub"
+        "id_eldrid_ed25519.pub"
+        "id_sarien_ed25519.pub"
       ];
     };
-    # work = {
-    #   isNormalUser = true;
-    #   extraGroups = ["video"];
-    #   shell = pkgs.nushell;
-    # };
   };
 }

hosts/sarien/configuration.nix

@@ -8,7 +8,7 @@
     ./networking.nix
     ./nix.nix
     ./power-saving.nix
-    ./programs.nix
+    ../dunamis/programs.nix
     ./services.nix
     ./sops.nix
     ./users.nix

hosts/sarien/nix.nix

@@ -1,9 +1,13 @@
+# TODO: better file name
 {
   config,
   inputs,
-  pkgs,
+  # pkgs,
   ...
-}: {
+}: let
+  inherit (config.sops) secrets;
+  inherit (inputs) mysecrets;
+in {
   imports = with inputs; [
     determinate.nixosModules.default
   ];
@@ -21,9 +25,9 @@
         hostName = "dunamis";
         sshUser = "nix-ssh";
         system = "x86_64-linux";
-        sshKey = config.sops.secrets."ssh-sarien-user".path;
+        sshKey = secrets."ssh-eldrid-user".path;
         supportedFeatures = ["nixos-test" "big-parallel" "kvm" "benchmark"];
-        publicHostKey = builtins.readFile "${inputs.mysecrets}/ssh/ssh_host_ed25519_dunamis.base64";
+        publicHostKey = builtins.readFile "${mysecrets}/ssh/ssh_host_ed25519_dunamis.base64";
       }
     ];
   };

hosts/sarien/sops.nix

@@ -4,9 +4,11 @@
   ...
 }: let
   inherit (inputs) mysecrets;
-  # TODO: stop relying on networking.hostName
-  hostname = "sarien";
-  sopsFile = mysecrets + "/hosts/${hostname}.yaml";
+  hostName =
+    if (config.networking.hostName == "vylxae")
+    then "sarien"
+    else config.networking.hostName;
+  sopsFile = mysecrets + "/hosts/${hostName}.yaml";
   dotSsh = name: "/home/user/.ssh/" + name;
   sshKey = {
     mode = "0400";
@@ -31,12 +33,12 @@ in {
         mode = "0400";
         owner = "user";
       };
-      "ssh-${hostname}-user" = {
+      "ssh-${hostName}-user" = {
         inherit sopsFile;
         inherit (sshKey) mode owner;
         path = dotSsh "id_ed25519";
       };
-      "ssh-${hostname}-user.pub" = {
+      "ssh-${hostName}-user.pub" = {
         inherit sopsFile;
         inherit (sshKey) mode owner;
         path = dotSsh "id_ed25519.pub";

hosts/sarien/users.nix

@@ -4,20 +4,21 @@
   pkgs,
   ...
 }: let
-  sopSec = config.sops.secrets;
-  secrets = inputs.mysecrets;
+  inherit (config.sops) secrets;
+  inherit (inputs) mysecrets;
 in {
   nix.settings.trusted-users = ["user"];
   users.mutableUsers = false;
   users.users = {
     user = {
-      hashedPasswordFile = sopSec."user-password-hashed".path;
+      hashedPasswordFile = secrets."user-password-hashed".path;
       isNormalUser = true;
       extraGroups = ["wheel" "video" "libvirtd" "dialout"];
       shell = pkgs.fish;
-      openssh.authorizedKeys.keyFiles = [
-        "${secrets}/ssh/id_ed25519_sarien_user.pub"
-        "${secrets}/ssh/id_ed25519_eldrid_user.pub"
+      openssh.authorizedKeys.keyFiles = map (f: "${mysecrets}/ssh/user/${f}") [
+        "id_dunamis_ed25519.pub"
+        "id_eldrid_ed25519.pub"
+        "id_sarien_ed25519.pub"
       ];
     };
   };