From 64d879b4a7663e19a6999f98dc9379de7eb04737 Mon Sep 17 00:00:00 2001 From: 0xTux <0xtux@pm.me> Date: Thu, 17 Oct 2024 03:07:24 +0530 Subject: [PATCH] add new host --- .sops.yaml | 2 + flake.nix | 19 ++++++++ hosts/common/secrets.yaml | 65 +++++++++++++++------------ hosts/vega/default.nix | 50 +++++++++++++++++++++ hosts/vega/hardware-configuration.nix | 32 +++++++++++++ hosts/vega/home.nix | 7 +++ 6 files changed, 147 insertions(+), 28 deletions(-) create mode 100644 hosts/vega/default.nix create mode 100644 hosts/vega/hardware-configuration.nix create mode 100644 hosts/vega/home.nix diff --git a/.sops.yaml b/.sops.yaml index 0242d10..fc3387a 100644 --- a/.sops.yaml +++ b/.sops.yaml @@ -7,6 +7,7 @@ keys: - &arcturus age1zsl5d4vj6gl3h96y5p53sq5y4vr4vtlwp727h7rp9a4xfkxm53lqrh6r50 - &alpha age145uq9emlxqzm3wqauy9zqj78wqx9e6h09xag6wust7jjgn4upfzsaemcvx - &sirius age15d06qpn64p3w57l8yhdesdr5g69dtncwq8yrkx2uw0szql3p7fsq4awlka + - &vega age1ydkclhk9kwqdq74utesqdfupt43lz64d5k65gz2z9uyljcqq9fcq3hv28l creation_rules: - path_regex: hosts/common/secrets.yaml$ @@ -17,6 +18,7 @@ creation_rules: - *arcturus - *alpha - *sirius + - *vega - path_regex: hosts/canopus/secrets.yaml$ key_groups: - age: diff --git a/flake.nix b/flake.nix index b762e49..9b8c8f8 100755 --- a/flake.nix +++ b/flake.nix @@ -127,6 +127,25 @@ ]; }; + vega = nixpkgs.lib.nixosSystem { + specialArgs = {inherit inputs outputs username;}; + modules = [ + ./hosts/vega + + home-manager.nixosModules.home-manager + { + home-manager.backupFileExtension = "backup"; + home-manager.useUserPackages = true; + home-manager.extraSpecialArgs = {inherit inputs outputs username;}; + home-manager.users.${username} = { + imports = [ + ./hosts/vega/home.nix + ]; + }; + } + ]; + }; + isoImage = nixpkgs.lib.nixosSystem { specialArgs = {inherit inputs outputs username;}; modules = [ diff --git a/hosts/common/secrets.yaml b/hosts/common/secrets.yaml index 5381c49..d19d11e 100644 --- a/hosts/common/secrets.yaml +++ b/hosts/common/secrets.yaml @@ -1,4 +1,4 @@ -tux-password: ENC[AES256_GCM,data:MBEzVdDQJrWmAEzy1HW1KNT5a5B8nmoYsfp1dXHEmbh1hPNi+7tPT9H/97zbx3x8EzZGI7aSXmdvlGPTvFuJN0xOSe2FMce0Yw==,iv:UMTTDzHcGyIJFfKbzxxy0i3a5vP12vgAVD2bknMKVj0=,tag:ccUnbCrKAasTIuedChVE3Q==,type:str] +tux-password: ENC[AES256_GCM,data:HhabXYKDqiNwNvOTzf3D+vBxm/y/XoTbuyh1U3HX3cxQdi5l8TdMpnO9x1MDQRLCYnCE8sBTBviybu9RGEu7RPXUatzTseMOIw==,iv:0T918MQMRUAhHfQJ20iPYcPBLCSWoGvpP1DesTb7Fek=,tag:oqnmIHTt99Gh3xNTDjCIFA==,type:str] sops: kms: [] gcp_kms: [] @@ -8,50 +8,59 @@ sops: - recipient: age14vktfes95f33vuefwnmuvryas7az04u76dsgyhfvsx73czkvmp2q7njkl4 enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB0S0xIbnBaNUgzNHZmVVdu - a1A5TXN1NUJTYmVaUk1lN2toN2FFOTV3UTBvCkVBemZyQ0lsWDVONkhJd3Y0bC92 - UDlhWkMvcmNNMUxwdmJqb0pUaURCS0EKLS0tIEpYZlF0REMxV1hPSUFCNTBFMTBO - TzhsRmtBampwVUJtWWpuYVl5RUdWVlEKwp7/nP15bVp1J7YrsDxF5lOkJTDKSKFY - 4flcP6jbpdBaNXg/LNBYUkAWU5IeV6Ym5TRbtL3CPsRYPEqWnN29tA== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBuNVg0UkpXSFd5dkZ2V2ZK + NVJGd0V4UFhrUWlwdVNLMElnZjJwcXNjbWtZCndJcmxyYUlDK0pzUitTU0t6TlN3 + bTF1MnhMMzFtQjlRYzNiNTd2eStKWVUKLS0tIHhlZWtuOFZOZWIvTWVTOXUrMzNr + ZVJHdnJzYjRyeWU0TlpzTXVQT0FvN3MK4d9K16awsINh5YDTzGa08t2BGFSDTng7 + t0QzH26cZvElDfsCpsC3JvV8cHKvNXPqsUqowQ5h/2TCybWz7CQDPQ== -----END AGE ENCRYPTED FILE----- - recipient: age1udt3cssu7ahdrhsvckt8450rswrr6mknn36xpq74dkfp9lpajvnq84kdzj enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBxaGZXQytzRUE0TjZ3WlZv - dXIzSWV5VGkvQk13Sit1TzlzdFdodlc0ZUV3CkpBdFpzcHowTGtnam5QQVlpSmYz - VmZIM2pidC8xejVSa2VsS0xNRDk1MTAKLS0tIHh5dHRycHo1THRjY1BONm12ZkJu - cGtzenNkK3J2bFF2MW53Z0lmQlFxRU0K+X1U+w4DNDDWK2vNJgfEbfz4dm7fFFtL - zTCl26FsOxvrzFqFd9STv/cd8rCSwKm9p7D+0tzmGbTb7mtSWvjuLA== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB4YUJON0VnVkFiZndGeHFS + TVBVYnlqMHZVczdnWm5hekJOM1VnMWlaQW04ClJ6Y0tpczZGYks1WE5VZEJDOVdD + Mi93SW9MVG1zVHFCcG5WTm9rNGJ1T2cKLS0tIEN5aHVLcFpjRjdQSVhrZExKanBu + NzFQTmtrSG00VzZiaUgybnJlR3RoalkKrCK2IGvPbqOOb4yXfF8zObqqFUiVy+8/ + O+PQh+5wLI/mm6Ywov+iye15gxvv9KvIY+SYH68oz8dq1NBjGlH5Ew== -----END AGE ENCRYPTED FILE----- - recipient: age1zsl5d4vj6gl3h96y5p53sq5y4vr4vtlwp727h7rp9a4xfkxm53lqrh6r50 enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA5ZTFldG1zckhsQVY5SmJx - T3dIUEJtT3p3OU9aMEdPUGxZWkJlYWM1N3hrCmNkeHpuenNycnVhMXAwbGpwdGRu - T2VOeGNlREx0T1d0U24wWEgwNS8zQkUKLS0tIHNXSW9PWGJNZElLLzREMHEwZTUv - a0thbWJoSkVsREhKUmZCTHRvK05CTk0Koz+mecZPDyerVeBdYlGuN/fK6ZIwR/yi - TTFqmEMe+IAq3Tu1nsChGnBO7Wm6eIwb9QlauR1R2vaUNGJ+dbcK8A== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAwRUM5T1NtOUZKVlpBOUls + NEdmait3aHJCTlFzVVQ4ZnVnT21GOXhXZGtrCnFySVVRbVBjcGhnQ1o2aDBJLzBr + b1EwVU9rVzIzUko1NkVoMlNLN0xUSTQKLS0tIHZVYWhOTzMwUXIrQWl2TVVSbS9x + WFoxUlhZL1pUVStvd0dFRXJhS0IrTU0K7FXe8JmzpW0QNZREczz+027uakStniXg + rOFUP1Q4GFPPpwSkW3q6n1WOCJzrDgLhHv028thCB96HnwOnQMQLUw== -----END AGE ENCRYPTED FILE----- - recipient: age145uq9emlxqzm3wqauy9zqj78wqx9e6h09xag6wust7jjgn4upfzsaemcvx enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBLRmpTRXZCZkZSd2FjeGl0 - ckNIMk1rTmlvUjN2U2RjQ3l0OTlTRmczRnc0CnhaU3BRb1NyNmxCQi9SajEzWVB1 - dnBMTWpiazRMQXFqRUtCWmdDOW11TWcKLS0tIFNZZy85aURLNHR6UmZNMXEzdXF1 - NytZOGk5UEdUVXpIMHBMUFM3UGtGQ1kKQTyvpoFxYM1UsCf8ZqL5YQ40KMU/tYAt - iBuOBMgeR8itglE108W0lmVJUnVvtaxJD0U3hKbWNKu2RSrumm/tfw== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBjNlRMWFZRb3BFcDlyZlp6 + NGJIVVVzZXBPbDhkVlE3UERYUGc5RzYzcEJRCkdnejdIRHlyeFFwa2RtdUgvUmFC + cmgrcmZnVy9QUlFvN1pnUUNTbng5ZHcKLS0tIGd5M1FyOXBXa0tDZmxQUFFKUHhN + aCtYY3NJV3o0NllxbktnaWxkbHhpM0EKvp9AeumYmrnq8K6HwdTurbhn8xjSx6Iw + YGwZN8+QLGWO2c0c5ZfkzBNIQeBCkEspchCojE7GuvgIg0fjDvtcGA== -----END AGE ENCRYPTED FILE----- - recipient: age15d06qpn64p3w57l8yhdesdr5g69dtncwq8yrkx2uw0szql3p7fsq4awlka enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBuMUhlV3UxZ1dPYkNOb2Nu - R3hJQ1RsZXBLU2FjUEFMQ01XY3ZPWVp4OVhNCll5UG4wTTRHSllNK09jSFBCKy90 - NkpqM1JjUDlDV2xZc0FiWkVPYnRudUkKLS0tIEZ5WXJ6TVo1ck1QcVdnaHRqb3h3 - eGlUUzBLS2lkYXVyc0NBT0JSOTQxL2cKrHAoTksXXCrux3NCvVMDrONnTIENcSiu - npoaUMfHj7vBu0t8TZ5DSyEiDHK080w5Opsnwp6HdyuZ7aI58z3viA== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBSUU02L2FQLzVEK0FOSXhL + K25FUzNXeHNXQUlJM2phTXhjajRGS3BwZzFBCkk5ZWlZRVJRM2xEMHpkQytYQUNK + RFdEOFNVSytPbUp4Nm5icFBGQXpPUEEKLS0tIDM4SXFHRkNDM2k2UWk4ZG01YWUv + Ny9CdmlSa3lhNzNwRmlhUUhicWZDMzAKcWtExqEK7wDnoX1dleU00SWpH5BISyP7 + 2EgX+BwGLe6SObOF95b6v4lyVCsEQPPnc+euBRGXjxrE+DXrUtG+/Q== -----END AGE ENCRYPTED FILE----- - lastmodified: "2024-10-08T18:58:50Z" - mac: ENC[AES256_GCM,data:LoQWZKejgtbRsZTa4zFPTlCDW8+LOVjq0xe+TvMFvKh3q60ObiT6P5K2wbdzVD8Kh8O5qfSY7UKHhHOGBF2gPBWWmInsBPIZ2bniihJypS7NRbdBr7aAz6jTIHR7MrO4SHJoG3BS/VaGjMhU+QtD6DGrSzjyeaovqrOScB+7gTY=,iv:pH9iBOXPMNmMVzJ9yblx0TgZ9r7s/nxFEJJC0l2fsSE=,tag:TRrgNElVf8DtuuHy8PIxmQ==,type:str] + - recipient: age1ydkclhk9kwqdq74utesqdfupt43lz64d5k65gz2z9uyljcqq9fcq3hv28l + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBwNzJ2aTZvZExWaTZNQVNJ + ZDdUTmRqYzlhbDU5Q1ZsWDBGRlBzc2hoQ2tnCjZrQ0dITlFHZVhrTmhCREo4ZXp5 + SGEyVmlBRW50UGdlTXhndkovckpVSlkKLS0tIGFxTzNjNUxuaGM2Skt1TWRJUE9W + RUorZ1IwVnBhRjNRR21uVU5VTDBsN3MKOPlgcJ/zv/GbEZYbzKFxpU65b9Uf7Udl + fRBpQBHzS3BWcO87l9lgN8eqCzUhuD+iu1jAOmpNjcEhiY6kUq3YzQ== + -----END AGE ENCRYPTED FILE----- + lastmodified: "2024-10-16T17:57:50Z" + mac: ENC[AES256_GCM,data:n8XQiiwv/FcPmurf2MKuKVBMGW3nqmssVkfEHu+VrSmXDzH4AkrAW6Aph8fHKOvr4AFOtj7eEmh+7pHWlinvJkr/Hf9hPbXKlDazd2PVqVFRUShM6y6jSAYjFxvgxeaw0dkQNmNtI0mfogqt8kNQDtduDaiI6l0h2q3TVbLPGNA=,iv:R0HzfyxXYYdpB6hy0KX8mm8Ae+XeQBnNyrRxVX/4fkU=,tag:c+vYOQUDNVYhjAcuwa36Bg==,type:str] pgp: [] unencrypted_suffix: _unencrypted version: 3.9.0 diff --git a/hosts/vega/default.nix b/hosts/vega/default.nix new file mode 100644 index 0000000..08d9251 --- /dev/null +++ b/hosts/vega/default.nix @@ -0,0 +1,50 @@ +{...}: { + imports = [ + ./hardware-configuration.nix + ../common + ]; + + boot.initrd.availableKernelModules = [ + "usbhid" + "usb_storage" + "vc4" + "pcie_brcmstb" # required for the pcie bus to work + "reset-raspberrypi" # required for vl805 firmware to load + ]; + + # Use the extlinux boot loader. (NixOS wants to enable GRUB by default) + boot.loader.grub.enable = false; + # Enables the generation of /boot/extlinux/extlinux.conf + boot.loader.generic-extlinux-compatible.enable = true; + + hardware.enableRedistributableFirmware = true; + powerManagement.cpuFreqGovernor = "ondemand"; + + networking = { + hostName = "vega"; + networkmanager = { + enable = true; + wifi.powersave = false; + }; + firewall = { + enable = true; + allowedTCPPorts = [22]; + + # Facilitate firewall punching + allowedUDPPorts = [41641]; + }; + }; + + services = { + tailscale = { + enable = true; + extraUpFlags = ["--login-server https://hs.tux.rs"]; + }; + }; + + environment.persistence."/persist" = { + enable = false; + }; + + system.stateVersion = "24.11"; +} diff --git a/hosts/vega/hardware-configuration.nix b/hosts/vega/hardware-configuration.nix new file mode 100644 index 0000000..3f13493 --- /dev/null +++ b/hosts/vega/hardware-configuration.nix @@ -0,0 +1,32 @@ +# Do not modify this file! It was generated by ‘nixos-generate-config’ +# and may be overwritten by future invocations. Please make changes +# to /etc/nixos/configuration.nix instead. +{ config, lib, pkgs, modulesPath, ... }: + +{ + imports = + [ (modulesPath + "/installer/scan/not-detected.nix") + ]; + + boot.initrd.availableKernelModules = [ ]; + boot.initrd.kernelModules = [ ]; + boot.kernelModules = [ ]; + boot.extraModulePackages = [ ]; + + fileSystems."/" = + { device = "/dev/disk/by-uuid/44444444-4444-4444-8888-888888888888"; + fsType = "ext4"; + }; + + swapDevices = [ ]; + + # Enables DHCP on each ethernet and wireless interface. In case of scripted networking + # (the default) this is the recommended approach. When using systemd-networkd it's + # still possible to use this option, but it's recommended to use it in conjunction + # with explicit per-interface declarations with `networking.interfaces..useDHCP`. + networking.useDHCP = lib.mkDefault true; + # networking.interfaces.enu1u1.useDHCP = lib.mkDefault true; + # networking.interfaces.wlan0.useDHCP = lib.mkDefault true; + + nixpkgs.hostPlatform = lib.mkDefault "aarch64-linux"; +} diff --git a/hosts/vega/home.nix b/hosts/vega/home.nix new file mode 100644 index 0000000..bbac4a5 --- /dev/null +++ b/hosts/vega/home.nix @@ -0,0 +1,7 @@ +{...}: { + imports = [ + ../common/home.nix + ]; + + home.stateVersion = "24.11"; +}