mirror of
https://github.com/tuxdotrs/nix-config.git
synced 2026-06-17 02:06:32 +05:30
feat(canopus): add canopus host
This commit is contained in:
@@ -4,6 +4,7 @@ keys:
|
||||
|
||||
- &hosts
|
||||
- &sirius age1maxsx5tq2h3d92rfyl8ekcdan5gu5cpch4qs3c56cu7qag02xgvs3h0gqc
|
||||
- &canopus age1x36yr8h993srfj29sfpzt4wyz52nztvncpmhgmfs0j26qvfecq3qvcm0an
|
||||
- &arcturus age1huqa3hc7wcxk4dpelrzny437nzrx4fnll3d8g9ahznzk268yju5qufapxy
|
||||
- &alpha age1mzxxxzhy3us3rd960ufqv7vlxj5cnug86md6x69llg9ujzw2pqws057llf
|
||||
|
||||
@@ -13,6 +14,11 @@ creation_rules:
|
||||
- age:
|
||||
- *tux
|
||||
- *sirius
|
||||
- path_regex: hosts/canopus/secrets.yaml$
|
||||
key_groups:
|
||||
- age:
|
||||
- *tux
|
||||
- *canopus
|
||||
- path_regex: hosts/arcturus/secrets.yaml$
|
||||
key_groups:
|
||||
- age:
|
||||
|
||||
145
modules/hosts/canopus/config.nix
Normal file
145
modules/hosts/canopus/config.nix
Normal file
@@ -0,0 +1,145 @@
|
||||
{ config, ... }:
|
||||
{
|
||||
flake.modules.nixos.canopus =
|
||||
{
|
||||
pkgs,
|
||||
hostName,
|
||||
userName,
|
||||
...
|
||||
}:
|
||||
{
|
||||
imports = with config.flake.modules.nixos; [
|
||||
boot
|
||||
hardware
|
||||
networking
|
||||
desktop
|
||||
gaming
|
||||
virtualisation
|
||||
];
|
||||
|
||||
tnix = {
|
||||
boot = {
|
||||
secure-boot.enable = true;
|
||||
|
||||
impermanence = {
|
||||
enable = true;
|
||||
|
||||
home = {
|
||||
directories = [
|
||||
".steam"
|
||||
".cache/awww"
|
||||
".config/BraveSoftware"
|
||||
".config/zed"
|
||||
".config/Vencord"
|
||||
".config/vesktop"
|
||||
".config/sops"
|
||||
".config/obs-studio"
|
||||
".config/easyeffects"
|
||||
".config/DankMaterialShell"
|
||||
".local/share/Steam"
|
||||
".local/share/nvim"
|
||||
".local/share/opencode"
|
||||
".local/share/zsh"
|
||||
".local/share/zoxide"
|
||||
".local/state/lazygit"
|
||||
".local/share/vicinae"
|
||||
".local/share/TelegramDesktop"
|
||||
];
|
||||
|
||||
files = [
|
||||
".wakatime.cfg"
|
||||
];
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
networking = {
|
||||
openssh.enable = true;
|
||||
netbird-client.enable = true;
|
||||
};
|
||||
|
||||
virtualisation = {
|
||||
docker.enable = true;
|
||||
docker.nvidia.enable = false;
|
||||
qemu.enable = true;
|
||||
waydroid.enable = true;
|
||||
distrobox.enable = true;
|
||||
};
|
||||
};
|
||||
|
||||
sops.secrets = {
|
||||
tux-password = {
|
||||
sopsFile = ./secrets.yaml;
|
||||
neededForUsers = true;
|
||||
};
|
||||
|
||||
gemini-api-key = {
|
||||
sopsFile = ./secrets.yaml;
|
||||
owner = userName;
|
||||
};
|
||||
|
||||
openrouter-api-key = {
|
||||
sopsFile = ./secrets.yaml;
|
||||
owner = userName;
|
||||
};
|
||||
|
||||
opencode-go-api-key = {
|
||||
sopsFile = ./secrets.yaml;
|
||||
owner = userName;
|
||||
};
|
||||
|
||||
netbird-key = {
|
||||
sopsFile = ./secrets.yaml;
|
||||
owner = userName;
|
||||
};
|
||||
|
||||
vicinae-json = {
|
||||
sopsFile = ./secrets.yaml;
|
||||
owner = userName;
|
||||
};
|
||||
};
|
||||
|
||||
# --- Networking ---
|
||||
networking = {
|
||||
hostName = hostName;
|
||||
networkmanager = {
|
||||
enable = true;
|
||||
wifi.backend = "iwd";
|
||||
};
|
||||
wireless.iwd = {
|
||||
enable = true;
|
||||
settings = {
|
||||
Network = {
|
||||
EnableIPv6 = true;
|
||||
};
|
||||
Settings = {
|
||||
AutoConnect = true;
|
||||
};
|
||||
};
|
||||
};
|
||||
firewall.enable = false;
|
||||
};
|
||||
|
||||
# --- Hardware / GPU ---
|
||||
# hardware = {
|
||||
# nvidia = {
|
||||
# modesetting.enable = true;
|
||||
# open = false;
|
||||
# nvidiaSettings = true;
|
||||
# };
|
||||
# };
|
||||
# boot.kernelParams = [ "nvidia-drm.modeset=1" ];
|
||||
# nixpkgs.config.cudaSupport = true;
|
||||
# services.xserver.videoDrivers = [ "nvidia" ];
|
||||
|
||||
environment.systemPackages = with pkgs; [
|
||||
nvtopPackages.full
|
||||
davinci-resolve
|
||||
telegram-desktop
|
||||
];
|
||||
|
||||
# !!! DO NOT CHANGE THIS !!!
|
||||
# This should match the version used at initial install.
|
||||
system.stateVersion = "26.05";
|
||||
};
|
||||
}
|
||||
23
modules/hosts/canopus/default.nix
Normal file
23
modules/hosts/canopus/default.nix
Normal file
@@ -0,0 +1,23 @@
|
||||
{
|
||||
inputs,
|
||||
config,
|
||||
...
|
||||
}:
|
||||
let
|
||||
hostName = "canopus";
|
||||
userName = "tux";
|
||||
userEmail = "t@tux.rs";
|
||||
system = "x86_64-linux";
|
||||
unstable = true;
|
||||
nixpkgs = if unstable then inputs.nixpkgs else inputs.nixpkgs-stable;
|
||||
in
|
||||
{
|
||||
flake.nixosConfigurations."${hostName}" = nixpkgs.lib.nixosSystem {
|
||||
inherit system;
|
||||
specialArgs = { inherit hostName userName userEmail; };
|
||||
modules = [
|
||||
config.flake.modules.nixos.core
|
||||
config.flake.modules.nixos.${hostName}
|
||||
];
|
||||
};
|
||||
}
|
||||
82
modules/hosts/canopus/disko.nix
Normal file
82
modules/hosts/canopus/disko.nix
Normal file
@@ -0,0 +1,82 @@
|
||||
{ inputs, ... }:
|
||||
{
|
||||
flake.modules.nixos.canopus =
|
||||
{ config, lib, ... }:
|
||||
let
|
||||
hasOptinPersistence = config.tnix.boot.impermanence.enable;
|
||||
in
|
||||
{
|
||||
imports = [
|
||||
inputs.disko.nixosModules.disko
|
||||
];
|
||||
|
||||
disko.devices.disk.primary = {
|
||||
device = "/dev/nvme0n1";
|
||||
type = "disk";
|
||||
content = {
|
||||
type = "gpt";
|
||||
partitions = {
|
||||
ESP = {
|
||||
size = "1G";
|
||||
type = "EF00";
|
||||
content = {
|
||||
type = "filesystem";
|
||||
format = "vfat";
|
||||
mountpoint = "/boot";
|
||||
mountOptions = [
|
||||
"defaults"
|
||||
"umask=0077"
|
||||
];
|
||||
};
|
||||
};
|
||||
swap = {
|
||||
size = "32G";
|
||||
content = {
|
||||
type = "swap";
|
||||
discardPolicy = "both";
|
||||
resumeDevice = true;
|
||||
};
|
||||
};
|
||||
root = {
|
||||
size = "100%";
|
||||
type = "8300";
|
||||
content = {
|
||||
type = "btrfs";
|
||||
# Base subvolumes that always exist
|
||||
subvolumes = {
|
||||
"/root" = {
|
||||
mountOptions = [
|
||||
"compress=zstd"
|
||||
"noatime"
|
||||
"space_cache=v2"
|
||||
];
|
||||
mountpoint = "/";
|
||||
};
|
||||
"/nix" = {
|
||||
mountOptions = [
|
||||
"compress=zstd"
|
||||
"noatime"
|
||||
"noacl"
|
||||
"space_cache=v2"
|
||||
];
|
||||
mountpoint = "/nix";
|
||||
};
|
||||
}
|
||||
# Conditionally merge /persist only when impermanence is enabled
|
||||
// lib.optionalAttrs hasOptinPersistence {
|
||||
"/persist" = {
|
||||
mountOptions = [
|
||||
"compress=zstd"
|
||||
"noatime"
|
||||
"space_cache=v2"
|
||||
];
|
||||
mountpoint = "/persist";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
32
modules/hosts/canopus/hardware.nix
Normal file
32
modules/hosts/canopus/hardware.nix
Normal file
@@ -0,0 +1,32 @@
|
||||
{
|
||||
flake.modules.nixos.canopus =
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
...
|
||||
}:
|
||||
{
|
||||
boot.initrd.availableKernelModules = [
|
||||
"nvme"
|
||||
"xhci_pci"
|
||||
"ahci"
|
||||
"usbhid"
|
||||
"usb_storage"
|
||||
"sd_mod"
|
||||
];
|
||||
boot.initrd.kernelModules = [ ];
|
||||
boot.kernelModules = [ "kvm-amd" ];
|
||||
boot.extraModulePackages = [ ];
|
||||
|
||||
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
|
||||
# (the default) this is the recommended approach. When using systemd-networkd it's
|
||||
# still possible to use this option, but it's recommended to use it in conjunction
|
||||
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
|
||||
networking.useDHCP = lib.mkDefault true;
|
||||
# networking.interfaces.eno1.useDHCP = lib.mkDefault true;
|
||||
# networking.interfaces.wlp10s0f3u2i2.useDHCP = lib.mkDefault true;
|
||||
|
||||
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
|
||||
hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
|
||||
};
|
||||
}
|
||||
20
modules/hosts/canopus/home.nix
Normal file
20
modules/hosts/canopus/home.nix
Normal file
@@ -0,0 +1,20 @@
|
||||
{ config, ... }:
|
||||
{
|
||||
flake.modules.homeManager.canopus = {
|
||||
imports = with config.flake.modules.homeManager; [
|
||||
desktop
|
||||
];
|
||||
|
||||
tnix.services.lan-mouse = {
|
||||
enable = true;
|
||||
settings = {
|
||||
authorized_fingerprints = {
|
||||
"f4:4b:17:61:f7:01:a4:a2:e1:c7:8c:1c:7a:f3:8b:87:14:3d:05:3d:a0:8b:cc:e7:88:d8:d8:d2:a4:c2:75:8b" =
|
||||
"sirius";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
home.stateVersion = "26.05";
|
||||
};
|
||||
}
|
||||
30
modules/hosts/canopus/secrets.yaml
Normal file
30
modules/hosts/canopus/secrets.yaml
Normal file
@@ -0,0 +1,30 @@
|
||||
tux-password: ENC[AES256_GCM,data:Xb4/JMAZCBnBheDCJdRRGXLnMJ1ej8HbN+AUqA/+2sdYESKeF1PFny4Iq2kqvzdK4D3mp+pdjd7GAGfJp4M7sOcvI3V/coyxPQ==,iv:h+S+MEwHj22uHaTzFoxGZtefNUAQNp3fbU+QRfgtKvQ=,tag:VHrIEIQivPFTfhmm7dWEyQ==,type:str]
|
||||
gemini-api-key: ENC[AES256_GCM,data:Q6+actg0oyUWiUJVy/9yZmea1QyGu2o8LfMsuAVFD6k7kp0dYIrl,iv:ukyouqrHxzVpBBE98KL6PW8P3j+seemm/e0Gl1urUcM=,tag:Z7MM3dJ414CmdxE72cdzNA==,type:str]
|
||||
openrouter-api-key: ENC[AES256_GCM,data:SalhWKR6artX/kOVKZGpKSmrgsQDU/heshrdkK3wotOZ3BRn/ZqZRBldvl1JPSenMAMvE2LWUdmBQmwG/id7L7JL1O/+lUHIQw==,iv:hLlHayFJgUkWOirVLfqP0pGRBZAqGKe+EE2yG1ELGNk=,tag:0qoo0tb+xWjjQXr4n1qGmw==,type:str]
|
||||
opencode-go-api-key: ENC[AES256_GCM,data:zbeTcaXJZFVfYnM/7sgblJFU9WfeosX/44KsXvrzKwiLPfGLLYYo9AFaCvWzzG6jHuSZC5OYrBWfOZv4+3omfCgglQ==,iv:LscUQE+PNhXGim9PSqc9nZIZichWSgAn/zsNxQ/HM/o=,tag:MaBCobnRM42fopiibibe5Q==,type:str]
|
||||
netbird-key: ENC[AES256_GCM,data:swmaa+RjxeUmEl8hS2riGrW4lP5jdks9HM3x57/FLpOuqFtR,iv:MrpVjiocrPi+dBGPk7pwgSUNlJ1eryRpMjC8+jkU+T0=,tag:j6sqpQ02apqc6FwkdDvk9g==,type:str]
|
||||
vicinae-json: ENC[AES256_GCM,data:FarBf6l8pl3hF7kGKPIWztUhwiKoQXmyTufCuJ120K/bPh1Bfiyi+ETt4DLYOGI6FJXfpVz4BbZOA29bXTLhVPxH0QtyBu/F5uEqA015b/c8VevDJSyy9huR13qO9ksLbMBt8RfWbAd9j26t7A1C8/mMyiJOEXCCTV9CEIW3xWrsYmhwsT8RYM+PwrPSeN1gQXHSMyRUjf/kOdJoda8+iXpLfjo4II4r2ELpbqi8QxhrRdsJsoOfAymFM784NtlTjE+h6S4TMehmoF/9ARif6I5SGQ0WfIKt/8orTGCPllL+NupLziSnpIGRGSybdArD+o5NCw59GOAbVRADxq8rCESwEkq3cF+hm8HabfYbiQ==,iv:Y/hXLFTJT3gNF3B6tgKoAh7njVuneoUzjVTlsCZiySw=,tag:2hfrwph6IccJdRu/yGu3XA==,type:str]
|
||||
sops:
|
||||
age:
|
||||
- recipient: age14vktfes95f33vuefwnmuvryas7az04u76dsgyhfvsx73czkvmp2q7njkl4
|
||||
enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqS2RZdVJaNTlRamZPMkll
|
||||
MDRVSVl1b2x2LzZpdlBrdmZtdyt3UE15RldRCldXUXE2a1BFeHg5NGNPbW5IMDht
|
||||
cHN1QituOU9uWFQwNS9udzNEbVhtUjQKLS0tIEtkTXhlYS9XSUlQRTY1eXBjeXZQ
|
||||
bThQTFdZU29ISm93TWcwVk5ZTkhRWm8KCcprmLGhahgDkXCBpzjctHgao+gc+rKC
|
||||
xLIwheUyFJOGK+ixqcdoZ/PC0kY68hVLt1YzLAyxFi4Ur1wltPrNug==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
- recipient: age1x36yr8h993srfj29sfpzt4wyz52nztvncpmhgmfs0j26qvfecq3qvcm0an
|
||||
enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBGVW13WFE1Ylh3Uk1HNU1i
|
||||
bU9kRzFqTmhkQlRzMlRkM0VhMlNmMDUyK25NCkZYUStxM2tScGozRXJGekxGa1RX
|
||||
b1VXK0Y2Z1U0YU9XRmxRUWdWem50L1EKLS0tIFovcHRlZ1JJd2lRN0RFbHdCdm9m
|
||||
V1N3eUVjZ0VZRjBZdXRPNng3Y3JoUTAKQau9CG9XfvM+5JZVRwaJr/o/sXMaJiy2
|
||||
wo2YcDb+4vfT4Wr+/8J3ccQgbLRZH916X5ZPL+A+nFyVXVKOCl3ENg==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
lastmodified: "2026-05-12T06:33:00Z"
|
||||
mac: ENC[AES256_GCM,data:htDJdEx34Q5NG8vwbBimnFENZawbLZ4FC0DkyG6J5RYP0BFnycKcKGsYR87SvIjcJZXvfZ0e6fXdtc78dd6I0sQtrQ7aNn4Iktbu/AkPmntsBwpIjVI99X9zUyQB87go/oX15yuyt8loB6ds2RkL/pfFsgLbFc10JHsBy+WcEzI=,iv:HvY+5LYzyHpRm8XCSKrN8ra/LJT9v23TPSsZg/4QVNU=,tag:k+d45+zgBYq4vlWmmc8ZkQ==,type:str]
|
||||
unencrypted_suffix: _unencrypted
|
||||
version: 3.12.2
|
||||
Reference in New Issue
Block a user