add new host

.sops.yaml

@@ -7,6 +7,7 @@ keys:
     - &arcturus age1zsl5d4vj6gl3h96y5p53sq5y4vr4vtlwp727h7rp9a4xfkxm53lqrh6r50
     - &alpha age145uq9emlxqzm3wqauy9zqj78wqx9e6h09xag6wust7jjgn4upfzsaemcvx
     - &sirius age15d06qpn64p3w57l8yhdesdr5g69dtncwq8yrkx2uw0szql3p7fsq4awlka
+    - &vega age1ydkclhk9kwqdq74utesqdfupt43lz64d5k65gz2z9uyljcqq9fcq3hv28l
 
 creation_rules:
   - path_regex: hosts/common/secrets.yaml$
@@ -17,6 +18,7 @@ creation_rules:
           - *arcturus
           - *alpha
           - *sirius
+          - *vega
   - path_regex: hosts/canopus/secrets.yaml$
     key_groups:
       - age:

flake.nix

@@ -127,6 +127,25 @@
         ];
       };
 
+      vega = nixpkgs.lib.nixosSystem {
+        specialArgs = {inherit inputs outputs username;};
+        modules = [
+          ./hosts/vega
+
+          home-manager.nixosModules.home-manager
+          {
+            home-manager.backupFileExtension = "backup";
+            home-manager.useUserPackages = true;
+            home-manager.extraSpecialArgs = {inherit inputs outputs username;};
+            home-manager.users.${username} = {
+              imports = [
+                ./hosts/vega/home.nix
+              ];
+            };
+          }
+        ];
+      };
+
       isoImage = nixpkgs.lib.nixosSystem {
         specialArgs = {inherit inputs outputs username;};
         modules = [

hosts/common/secrets.yaml

@@ -1,4 +1,4 @@
-tux-password: ENC[AES256_GCM,data:MBEzVdDQJrWmAEzy1HW1KNT5a5B8nmoYsfp1dXHEmbh1hPNi+7tPT9H/97zbx3x8EzZGI7aSXmdvlGPTvFuJN0xOSe2FMce0Yw==,iv:UMTTDzHcGyIJFfKbzxxy0i3a5vP12vgAVD2bknMKVj0=,tag:ccUnbCrKAasTIuedChVE3Q==,type:str]
+tux-password: ENC[AES256_GCM,data:HhabXYKDqiNwNvOTzf3D+vBxm/y/XoTbuyh1U3HX3cxQdi5l8TdMpnO9x1MDQRLCYnCE8sBTBviybu9RGEu7RPXUatzTseMOIw==,iv:0T918MQMRUAhHfQJ20iPYcPBLCSWoGvpP1DesTb7Fek=,tag:oqnmIHTt99Gh3xNTDjCIFA==,type:str]
 sops:
     kms: []
     gcp_kms: []
@@ -8,50 +8,59 @@ sops:
         - recipient: age14vktfes95f33vuefwnmuvryas7az04u76dsgyhfvsx73czkvmp2q7njkl4
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB0S0xIbnBaNUgzNHZmVVdu
-            a1A5TXN1NUJTYmVaUk1lN2toN2FFOTV3UTBvCkVBemZyQ0lsWDVONkhJd3Y0bC92
-            UDlhWkMvcmNNMUxwdmJqb0pUaURCS0EKLS0tIEpYZlF0REMxV1hPSUFCNTBFMTBO
-            TzhsRmtBampwVUJtWWpuYVl5RUdWVlEKwp7/nP15bVp1J7YrsDxF5lOkJTDKSKFY
-            4flcP6jbpdBaNXg/LNBYUkAWU5IeV6Ym5TRbtL3CPsRYPEqWnN29tA==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBuNVg0UkpXSFd5dkZ2V2ZK
+            NVJGd0V4UFhrUWlwdVNLMElnZjJwcXNjbWtZCndJcmxyYUlDK0pzUitTU0t6TlN3
+            bTF1MnhMMzFtQjlRYzNiNTd2eStKWVUKLS0tIHhlZWtuOFZOZWIvTWVTOXUrMzNr
+            ZVJHdnJzYjRyeWU0TlpzTXVQT0FvN3MK4d9K16awsINh5YDTzGa08t2BGFSDTng7
+            t0QzH26cZvElDfsCpsC3JvV8cHKvNXPqsUqowQ5h/2TCybWz7CQDPQ==
             -----END AGE ENCRYPTED FILE-----
         - recipient: age1udt3cssu7ahdrhsvckt8450rswrr6mknn36xpq74dkfp9lpajvnq84kdzj
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBxaGZXQytzRUE0TjZ3WlZv
-            dXIzSWV5VGkvQk13Sit1TzlzdFdodlc0ZUV3CkpBdFpzcHowTGtnam5QQVlpSmYz
-            VmZIM2pidC8xejVSa2VsS0xNRDk1MTAKLS0tIHh5dHRycHo1THRjY1BONm12ZkJu
-            cGtzenNkK3J2bFF2MW53Z0lmQlFxRU0K+X1U+w4DNDDWK2vNJgfEbfz4dm7fFFtL
-            zTCl26FsOxvrzFqFd9STv/cd8rCSwKm9p7D+0tzmGbTb7mtSWvjuLA==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB4YUJON0VnVkFiZndGeHFS
+            TVBVYnlqMHZVczdnWm5hekJOM1VnMWlaQW04ClJ6Y0tpczZGYks1WE5VZEJDOVdD
+            Mi93SW9MVG1zVHFCcG5WTm9rNGJ1T2cKLS0tIEN5aHVLcFpjRjdQSVhrZExKanBu
+            NzFQTmtrSG00VzZiaUgybnJlR3RoalkKrCK2IGvPbqOOb4yXfF8zObqqFUiVy+8/
+            O+PQh+5wLI/mm6Ywov+iye15gxvv9KvIY+SYH68oz8dq1NBjGlH5Ew==
             -----END AGE ENCRYPTED FILE-----
         - recipient: age1zsl5d4vj6gl3h96y5p53sq5y4vr4vtlwp727h7rp9a4xfkxm53lqrh6r50
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA5ZTFldG1zckhsQVY5SmJx
-            T3dIUEJtT3p3OU9aMEdPUGxZWkJlYWM1N3hrCmNkeHpuenNycnVhMXAwbGpwdGRu
-            T2VOeGNlREx0T1d0U24wWEgwNS8zQkUKLS0tIHNXSW9PWGJNZElLLzREMHEwZTUv
-            a0thbWJoSkVsREhKUmZCTHRvK05CTk0Koz+mecZPDyerVeBdYlGuN/fK6ZIwR/yi
-            TTFqmEMe+IAq3Tu1nsChGnBO7Wm6eIwb9QlauR1R2vaUNGJ+dbcK8A==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAwRUM5T1NtOUZKVlpBOUls
+            NEdmait3aHJCTlFzVVQ4ZnVnT21GOXhXZGtrCnFySVVRbVBjcGhnQ1o2aDBJLzBr
+            b1EwVU9rVzIzUko1NkVoMlNLN0xUSTQKLS0tIHZVYWhOTzMwUXIrQWl2TVVSbS9x
+            WFoxUlhZL1pUVStvd0dFRXJhS0IrTU0K7FXe8JmzpW0QNZREczz+027uakStniXg
+            rOFUP1Q4GFPPpwSkW3q6n1WOCJzrDgLhHv028thCB96HnwOnQMQLUw==
             -----END AGE ENCRYPTED FILE-----
         - recipient: age145uq9emlxqzm3wqauy9zqj78wqx9e6h09xag6wust7jjgn4upfzsaemcvx
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBLRmpTRXZCZkZSd2FjeGl0
-            ckNIMk1rTmlvUjN2U2RjQ3l0OTlTRmczRnc0CnhaU3BRb1NyNmxCQi9SajEzWVB1
-            dnBMTWpiazRMQXFqRUtCWmdDOW11TWcKLS0tIFNZZy85aURLNHR6UmZNMXEzdXF1
-            NytZOGk5UEdUVXpIMHBMUFM3UGtGQ1kKQTyvpoFxYM1UsCf8ZqL5YQ40KMU/tYAt
-            iBuOBMgeR8itglE108W0lmVJUnVvtaxJD0U3hKbWNKu2RSrumm/tfw==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBjNlRMWFZRb3BFcDlyZlp6
+            NGJIVVVzZXBPbDhkVlE3UERYUGc5RzYzcEJRCkdnejdIRHlyeFFwa2RtdUgvUmFC
+            cmgrcmZnVy9QUlFvN1pnUUNTbng5ZHcKLS0tIGd5M1FyOXBXa0tDZmxQUFFKUHhN
+            aCtYY3NJV3o0NllxbktnaWxkbHhpM0EKvp9AeumYmrnq8K6HwdTurbhn8xjSx6Iw
+            YGwZN8+QLGWO2c0c5ZfkzBNIQeBCkEspchCojE7GuvgIg0fjDvtcGA==
             -----END AGE ENCRYPTED FILE-----
         - recipient: age15d06qpn64p3w57l8yhdesdr5g69dtncwq8yrkx2uw0szql3p7fsq4awlka
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBuMUhlV3UxZ1dPYkNOb2Nu
-            R3hJQ1RsZXBLU2FjUEFMQ01XY3ZPWVp4OVhNCll5UG4wTTRHSllNK09jSFBCKy90
-            NkpqM1JjUDlDV2xZc0FiWkVPYnRudUkKLS0tIEZ5WXJ6TVo1ck1QcVdnaHRqb3h3
-            eGlUUzBLS2lkYXVyc0NBT0JSOTQxL2cKrHAoTksXXCrux3NCvVMDrONnTIENcSiu
-            npoaUMfHj7vBu0t8TZ5DSyEiDHK080w5Opsnwp6HdyuZ7aI58z3viA==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBSUU02L2FQLzVEK0FOSXhL
+            K25FUzNXeHNXQUlJM2phTXhjajRGS3BwZzFBCkk5ZWlZRVJRM2xEMHpkQytYQUNK
+            RFdEOFNVSytPbUp4Nm5icFBGQXpPUEEKLS0tIDM4SXFHRkNDM2k2UWk4ZG01YWUv
+            Ny9CdmlSa3lhNzNwRmlhUUhicWZDMzAKcWtExqEK7wDnoX1dleU00SWpH5BISyP7
+            2EgX+BwGLe6SObOF95b6v4lyVCsEQPPnc+euBRGXjxrE+DXrUtG+/Q==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2024-10-08T18:58:50Z"
-    mac: ENC[AES256_GCM,data:LoQWZKejgtbRsZTa4zFPTlCDW8+LOVjq0xe+TvMFvKh3q60ObiT6P5K2wbdzVD8Kh8O5qfSY7UKHhHOGBF2gPBWWmInsBPIZ2bniihJypS7NRbdBr7aAz6jTIHR7MrO4SHJoG3BS/VaGjMhU+QtD6DGrSzjyeaovqrOScB+7gTY=,iv:pH9iBOXPMNmMVzJ9yblx0TgZ9r7s/nxFEJJC0l2fsSE=,tag:TRrgNElVf8DtuuHy8PIxmQ==,type:str]
+        - recipient: age1ydkclhk9kwqdq74utesqdfupt43lz64d5k65gz2z9uyljcqq9fcq3hv28l
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBwNzJ2aTZvZExWaTZNQVNJ
+            ZDdUTmRqYzlhbDU5Q1ZsWDBGRlBzc2hoQ2tnCjZrQ0dITlFHZVhrTmhCREo4ZXp5
+            SGEyVmlBRW50UGdlTXhndkovckpVSlkKLS0tIGFxTzNjNUxuaGM2Skt1TWRJUE9W
+            RUorZ1IwVnBhRjNRR21uVU5VTDBsN3MKOPlgcJ/zv/GbEZYbzKFxpU65b9Uf7Udl
+            fRBpQBHzS3BWcO87l9lgN8eqCzUhuD+iu1jAOmpNjcEhiY6kUq3YzQ==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2024-10-16T17:57:50Z"
+    mac: ENC[AES256_GCM,data:n8XQiiwv/FcPmurf2MKuKVBMGW3nqmssVkfEHu+VrSmXDzH4AkrAW6Aph8fHKOvr4AFOtj7eEmh+7pHWlinvJkr/Hf9hPbXKlDazd2PVqVFRUShM6y6jSAYjFxvgxeaw0dkQNmNtI0mfogqt8kNQDtduDaiI6l0h2q3TVbLPGNA=,iv:R0HzfyxXYYdpB6hy0KX8mm8Ae+XeQBnNyrRxVX/4fkU=,tag:c+vYOQUDNVYhjAcuwa36Bg==,type:str]
     pgp: []
     unencrypted_suffix: _unencrypted
     version: 3.9.0

hosts/vega/default.nix

@@ -0,0 +1,50 @@
+{...}: {
+  imports = [
+    ./hardware-configuration.nix
+    ../common
+  ];
+
+  boot.initrd.availableKernelModules = [
+    "usbhid"
+    "usb_storage"
+    "vc4"
+    "pcie_brcmstb" # required for the pcie bus to work
+    "reset-raspberrypi" # required for vl805 firmware to load
+  ];
+
+  # Use the extlinux boot loader. (NixOS wants to enable GRUB by default)
+  boot.loader.grub.enable = false;
+  # Enables the generation of /boot/extlinux/extlinux.conf
+  boot.loader.generic-extlinux-compatible.enable = true;
+
+  hardware.enableRedistributableFirmware = true;
+  powerManagement.cpuFreqGovernor = "ondemand";
+
+  networking = {
+    hostName = "vega";
+    networkmanager = {
+      enable = true;
+      wifi.powersave = false;
+    };
+    firewall = {
+      enable = true;
+      allowedTCPPorts = [22];
+
+      # Facilitate firewall punching
+      allowedUDPPorts = [41641];
+    };
+  };
+
+  services = {
+    tailscale = {
+      enable = true;
+      extraUpFlags = ["--login-server https://hs.tux.rs"];
+    };
+  };
+
+  environment.persistence."/persist" = {
+    enable = false;
+  };
+
+  system.stateVersion = "24.11";
+}

hosts/vega/hardware-configuration.nix

@@ -0,0 +1,32 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports =
+    [ (modulesPath + "/installer/scan/not-detected.nix")
+    ];
+
+  boot.initrd.availableKernelModules = [ ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" =
+    { device = "/dev/disk/by-uuid/44444444-4444-4444-8888-888888888888";
+      fsType = "ext4";
+    };
+
+  swapDevices = [ ];
+
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  networking.useDHCP = lib.mkDefault true;
+  # networking.interfaces.enu1u1.useDHCP = lib.mkDefault true;
+  # networking.interfaces.wlan0.useDHCP = lib.mkDefault true;
+
+  nixpkgs.hostPlatform = lib.mkDefault "aarch64-linux";
+}

hosts/vega/home.nix

@@ -0,0 +1,7 @@
+{...}: {
+  imports = [
+    ../common/home.nix
+  ];
+
+  home.stateVersion = "24.11";
+}