This commit is contained in:
sadan 2025-02-21 21:45:59 -05:00
parent de4282f257
commit 69777aa4dc
No known key found for this signature in database
14 changed files with 259 additions and 26 deletions

View file

@ -2,6 +2,7 @@ keys:
- &desktop age1xsuyaeehzv4ar4f6xpc6tfp9pttzjf7qdyl3x2tj42vjc8szlqpq834e3d
- &laptop age1tq8zaaqe8t4u2jgyf7usngtzyql0ymyxq6hntmu04vt5ypwhxensmzynhl
- &win10 age1cz006hex596lmj88kkhrkvq89luqk59hxuq83q4kvhz82ltwpe4ss8gm3t
- &serverpc age1sn4uu6r6wrylpznx75jcw7ww58r9cut35n40gu4scpt9xy79rgrq2d7wga
creation_rules:
- path_regex: secrets/hosts
key_groups:
@ -9,9 +10,11 @@ creation_rules:
- *desktop
- *laptop
- *win10
- *serverpc
- path_regex: secrets.yaml$
key_groups:
- age:
- *desktop
- *laptop
- *win10
- *serverpc

View file

@ -5,7 +5,6 @@
config,
pkgs,
inputs,
stable,
...
}:
{

View file

@ -0,0 +1,65 @@
# Edit this configuration file to define what should be installed onconfiguraticonfig
# your system. Help is available in the configuration.nix(5) man page, on
# https://search.nixos.org/options and in the NixOS manual (`nixos-help`).
{
config,
pkgs,
...
}:
{
imports = [
# Include the results of the hardware scan.
./hardware-configuration.nix
../../common/systemModules/boot.nix
../../common/systemModules/kernel.nix
../../common/systemModules/tailscale.nix
../../common/systemModules/crypt.nix
../../common/systemModules/nix.nix
../../common/systemModules/sshd.nix
../../common/systemModules/tailscaleServer.nix
# USERS
../../common/users/meyer-server
];
hardware.i2c.enable = true;
networking.hostName = "serverpc"; # Define your hostname.
environment.sessionVariables = {
HOSTNAME = config.networking.hostName;
};
# Set your time zone.
time.timeZone = "America/New_York";
nixpkgs.config.allowUnfree = true;
programs.zsh.enable = true;
environment.systemPackages = with pkgs; [
neovim # Do not forget to add an editor to edit configuration.nix! The Nano editor is also installed by default.
curl
wget
ripgrep
tldr
file
];
#LD fix
programs.nix-ld.enable = true;
programs.nix-ld.libraries = with pkgs; [
];
# This option defines the first version of NixOS you have installed on this particular machine,
# and is used to maintain compatibility with application data (e.g. databases) created on older NixOS versions.
#
# Most users should NEVER change this value after the initial install, for any reason,
# even if you've upgraded your system to a new NixOS release.
#
# This value does NOT affect the Nixpkgs version your packages and OS are pulled from,
# so changing it will NOT upgrade your system.
#
# This value being lower than the current NixOS release does NOT mean your system is
# out of date, out of support, or vulnerable.
#
# Do NOT change this value unless you have manually inspected all the changes it would make to your configuration,
# and migrated your data accordingly.
#
# For more information, see `man configuration.nix` or https://nixos.org/manual/nixos/stable/options#opt-system.stateVersion .
system.stateVersion = "24.11"; # Did you read the comment?
}

View file

@ -10,12 +10,10 @@
programs = {
ssh = {
startAgent = true;
askPassword = "${pkgs.ksshaskpass}/bin/ksshaskpass";
};
gnupg = {
agent = {
enable = true;
pinentryPackage = pkgs.pinentry-gnome3;
};
};
};

View file

@ -1,4 +1,15 @@
{ ... }: {
{ pkgs, ... }:
{
programs = {
ssh = {
askPassword = "${pkgs.ksshaskpass}/bin/ksshaskpass";
};
gnupg = {
agent = {
pinentryPackage = pkgs.pinentry-gnome3;
};
};
};
services = {
desktopManager = {
plasma6 = {

View file

@ -0,0 +1,6 @@
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINbwWjnyagf8yvKhWruncrSaj4zOClJM4j1cspf/tYNz
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAII0GeAUBr3aprEC+V0s5qcfKsJyy7JFXvtZUNCWw328w
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKopbljRYwhVbVoXApoPZpmEjb9Zw7GD+SV49Asvuo7O
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPaz0uIWicLCPcYq35RUq/7iqaYOr9R5HDj89EeXXfzL
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINUl0IkmEqdUA09sC+SzDWAnTuAbdDl3KHeQbMNK1zRQ

View file

@ -0,0 +1,8 @@
{ ... }:
{
services= {
openssh = {
authorizedKeysFiles = ["${./ssh.keys}"];
};
};
}

View file

@ -0,0 +1,10 @@
{ config, ... }:
{
services = {
tailscale = {
enable = true;
authKeyFile = config.sops.secrets.tailscale_server_key.path;
extraSetFlags = [ "--advertise-exit-node" ];
};
};
}

View file

@ -0,0 +1,40 @@
{
pkgs,
inputs,
stable,
unstable,
...
}:
let
NAME = "meyer";
in
{
imports = [
(import ../../systemModules/sops.nix { inherit NAME; })
];
users = {
users = {
"${NAME}" = {
isNormalUser = true;
extraGroups = [
"wheel"
"audio"
"sound"
"video"
"input"
"tty"
"plugdev"
];
shell = pkgs.zsh;
};
};
};
home-manager = {
extraSpecialArgs = {
inherit inputs stable unstable;
};
users = {
"${NAME}" = import ./home.nix;
};
};
}

View file

@ -0,0 +1,49 @@
{
...
}:
{
nixpkgs.config.allowInsecurePredicate = (pkg: true);
nixpkgs.config.allowUnfreePredicate = (pkg: true);
imports = [
];
# Home Manager needs a bit of information about you and the paths it should
# nixpkg.config.allowUnfree = true;
# manage.
home.username = "meyer";
home.homeDirectory = "/home/meyer";
# The home.packages option allows you to install Nix packages into your
# environment.
# Home Manager is pretty good at managing dotfiles. The primary way to manage
# plain files is through 'home.file'.
# Home Manager can also manage your environment variables through
# 'home.sessionVariables'. If you don't want to manage your shell through Home
# Manager then you have to manually source 'hm-session-vars.sh' located at
# either
#
# ~/.nix-profile/etc/profile.d/hm-session-vars.sh
#
# or
#
# ~/.local/state/nix/profiles/profile/etc/profile.d/hm-session-vars.sh
#
# or
#
# /etc/profiles/per-user/meyer/etc/profile.d/hm-session-vars.sh
#
# This value determines the Home Manager release that your configuration is
# compatible with. This helps avoid breakage when a new Home Manager release
# introduces backwards incompatible changes.
#
# You should not change this value, even if you update Home Manager. If you do
# want to update the value, then make sure to first check the Home Manager
# release notes.
home.stateVersion = "23.11"; # Please read the comment before changing.
# Let Home Manager install and manage itself.
programs.home-manager.enable = true;
}

View file

@ -1,4 +1,10 @@
{ pkgs, inputs, stable, unstable, ... }:
{
pkgs,
inputs,
stable,
unstable,
...
}:
let
NAME = "meyer";
in

View file

@ -86,6 +86,30 @@
};
nixosConfigurations = {
nixd = nixpkgs.lib.nixosSystem { };
serverpc = nixpkgs.lib.nixosSystem rec {
system = "x86_64-linux";
specialArgs = {
inherit inputs;
unstable = import nixpkgs-unstable {
inherit system;
config = {
allowUnfree = true;
};
};
};
modules = [
(
{ pkgs, ... }:
{
_module.args = {
stable = pkgs;
};
}
)
./boxes/serverpc/configuration.nix
inputs.home-manager.nixosModules.default
];
};
desktopIso = nixpkgs.lib.nixosSystem {
system = "aarch64-linux";
modules = [

View file

@ -1,4 +1,5 @@
password: ENC[AES256_GCM,data:4/T7FbEmbBwWD7HpnCJVdzvKHQHyTgOY+rPXlnhPJRIYzsFkHpWGxVuzFKa6JkMqUWDTbdtMp4tpZAtP3mlRprdXOoO6v+Nv6A==,iv:Etm9J/FefdWrG2tNe3PIWqLfF3JHD5TY13eNMhOmORs=,tag:rqHXqIVjFmxyI5bVxezgAA==,type:str]
tailscale_server_key: ENC[AES256_GCM,data:87fmNeGiw13dVuXxDpFNe6ewnSnUFW+2XXBz4LG1Kbtstd6lGDJf4Qf+5Rw1dNh0mHBvVAPoon6SnHgwQVs=,iv:MQvEP7P44xnMZkGVjU1ahUI8nbsYQU8gLzVYLNHUNQw=,tag:5REUUhPN1NaVsQKaRcuS9Q==,type:str]
sops:
kms: []
gcp_kms: []
@ -8,32 +9,41 @@ sops:
- recipient: age1xsuyaeehzv4ar4f6xpc6tfp9pttzjf7qdyl3x2tj42vjc8szlqpq834e3d
enc: |
-----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBTaDUzVkN3ejU1UFpudHVn
ZXRldDNYWFB3MnM2UDIwb0tCN3dQQWs3OVZBCjZ3MUNPajd1czloM1BteUZ5cTJt
SkVCUTVNUmJpcUpab0dIUjNTSU5JTzQKLS0tIGZ0U2JvZm1ENnAxWTBTK25mR2Qv
ZTZuYUhYdGt1UUJ5eHppUThBaTdiWlEK39hS3SgkqByLoiYIfpWZ5MMoQMEDBEfP
lgNZvHh3ZwxKM6OSypJuAM+gA59P1Oeu2kngR3CGDZlAYltdZWA46A==
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBkTnE4MHg2TFVFUnlhTHp3
Y2x1Yi9tVUErNDNrZ0d2b2s1ekVpelJObUdFCjh5MGVnKys3Z1BGbXJzd3VObHdj
TzFRR3N2VXl0RG03dXNKejd2c1Q5Q1EKLS0tIFJiQzNtL2JPOC8zNHRtM3l0RTBN
T1dsR016WXV2MlljTHovaHRTbzUxOW8Kie3Rl0MMr0kgMgYyw6AAllaIBjzMVjSx
mZEY23YiaG6evXPgXCGwm6i3eYxql8lgHL/+XwOsHgY4pYckPTHaGg==
-----END AGE ENCRYPTED FILE-----
- recipient: age1tq8zaaqe8t4u2jgyf7usngtzyql0ymyxq6hntmu04vt5ypwhxensmzynhl
enc: |
-----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAyTU1nR2IvQVl0MGZzRy9Y
dldmS2RrRnhyaERHS29QeTFQaE1TaWpFMFJFClhZNHpoM21ERmt2TitybWRVU0Vx
cEg5MFNFYTJtdUVJajFmaWQ3d2VYRTQKLS0tIEltVEVrR1lsUmRtcHk4dW5FN1M5
OFdXYTZXTmVWVStRK2oxeEVvTTBjaFUK1gG2CTY1DRhYLZfnQFefjwaKtYQ1PBUZ
ZZRjpLg25Hk2Anu5KvKWRP5K1Tkuku6Xvv+brM+GUL2imTtt8R3HGg==
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBDYjRSUEZWV3g2MHNnVnYy
VFY0QWRHbWVMbFVwTElIMno1NWpVRE1uVG5VClIycmsvU3hSSFcwUmx2OEVXM1J2
THZFcUNFYTVtVHFwSm9rcnFTUUJOSk0KLS0tIElnRjNVNkJUdzNyS1lLeWlrK1Vs
ZnZMbXh3TS90eURmTnludmd4UmtCMDgKiNSKnGXwSVGREMrSb1xBXpyN632UYxdS
SqfbBUYUmN3SVViGCPXGG74GrlbjfhaTyleUXP5CjQTWRFGAmn8ElA==
-----END AGE ENCRYPTED FILE-----
- recipient: age1cz006hex596lmj88kkhrkvq89luqk59hxuq83q4kvhz82ltwpe4ss8gm3t
enc: |
-----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA4YzltNk1BbFRsaVBIQmxu
SmVEZzRNeUFmVXBMYVo4Nk90R2MxZktsb3pVCm9XeVRPZVR2Z0s3b0hzR0x1ekNU
QWQzdUc3RDlHVURjaFgxK1NDdDYwSmcKLS0tIDdkVkJJUE16WlVLSnRMdDAyam9W
TzdhbUlhaUpDWXF1Tkh2SG9FNGx2Y1UKPao0v1NTLV6hyoHmYLqUhPFbRtF8O/LI
oOOVThNhKjHWJ9+41o/VWRZEgvIIawdfOOJebpvzujN5ZOE8DOM2xw==
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWNDFERzhYaDR6eUpLWmE0
T24zejZrb2hDUnJ5VXBsejFXUUZhUFFrYnk0CmpoRm1GL2NTRGlsNXBXUFcyVWR2
L21RbVYzT1hFLzQvRHh3L2w4SlR4Rk0KLS0tIDNHWmZSdkZMVnp4dHdPSEp1MG44
WjRHc21YaHJYRFI3N3pIZEJ1V242dVEK5fbTQ7843ftQjrl4Ad+wo44gSjY/KayC
aQmH5aQdgXyOW0rtbKEnQJ4skRpKiSJMsqI+giJB1yA7KEV01FFd5g==
-----END AGE ENCRYPTED FILE-----
lastmodified: "2024-05-26T05:51:21Z"
mac: ENC[AES256_GCM,data:udNen7qCF1RLdjXbBgIInDf7Fh442UajcXEZk0QxjRKbk31p4xV9MdrEGIuBDalva1lGp/BjRSCxnq5Oq9tYAvvNQ077dpatIxgCmaZGHchcPZQfmnCfIeTLxJBP3XXaity+vsQOYRYKEpXagUc1juBfkloHmgiiZJwQqx/UBtk=,iv:K7NH07nvWD+aPr4EUbykVU7G0vuvB3H9mOtsyzArf4c=,tag:A9aXi7R5rvZnL5JgdSCnbA==,type:str]
- recipient: age1sn4uu6r6wrylpznx75jcw7ww58r9cut35n40gu4scpt9xy79rgrq2d7wga
enc: |
-----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAwSjljLzhBNnZYaFBJbFpm
ZVVQYkpZV0o4cGJ5M3U1RGsrbjVpbjNyMTJVClBGYnJjazBib1lXbXYzRVl1MEF0
dDlBZnoxeTVDc2pjaWZmOHppL2FvSWcKLS0tIEFWUFc4cVo0bGhaSHMzTjR1Q1V0
eGRJeW9VaDRGTU1XQ2VsM1NpQVdndWcKK9UFGjL2qUPrNywgL9cF2P3ulT7cAvfJ
mzUWv2+tUXRAPPK5iYfwts+VLzXveRespqzzuFl+I2/fTgZgK0FtJg==
-----END AGE ENCRYPTED FILE-----
lastmodified: "2025-02-22T02:31:56Z"
mac: ENC[AES256_GCM,data:FUX46w0RKRqnNnrtbKLYMKKX/wgOD8STrVenUwxxyBqxbiPy6gaFbbXYZ3KZ2bBux2/dpjKXCptDK09SBesYl3QwLQsJdufwNt593WUHFytbD6t7q6VmZKGAswQzlYomiaobHAZwVEn5e4+DZLALCO/L7paj1DRlQjVWBRYV1/M=,iv:N3qNe0BtgL15HxfLAp3OPvqVT4uFVeXcGj1XIkQ8Vf8=,tag:nC2lhKFjEAR897G+VNwQng==,type:str]
pgp: []
unencrypted_suffix: _unencrypted
version: 3.8.1
version: 3.9.4

View file

@ -8,15 +8,19 @@
"age": [
{
"recipient": "age1xsuyaeehzv4ar4f6xpc6tfp9pttzjf7qdyl3x2tj42vjc8szlqpq834e3d",
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqWGczdExuSk10K2x6Qkhv\ndlhqeGwrMjJUdTRYUjNvcmMvVjZBanE5bFhvCnIxdy9OWEZ5YVZ1b1JPaEVoRjlQ\nS2tTekdZVk1XV2o0TmdwbXFvTTU0QmcKLS0tIHEyUldoaUNXV0xuTjlqd3FiaC81\nT002TGZuOUFYOWtJNHQ5VEZxRGdGZ1EKfn6ogFhUJTPOWa9pwTrQDBly1A30JppY\n164UbgNlIx+muZqkm3l+RMUx41hzIA8JwdW/yDlhFM8pl9tR3y10FQ==\n-----END AGE ENCRYPTED FILE-----\n"
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2UkpCZzJabXN5WGtLbUtW\ndUlET1BRK1pxd3JyOVRyVm1LR1NXUldGSnhRCndpQXZ5MnZqM1pHbjJtdTA0OHh1\nd3U0WWdvOHRzc2plajhBbERYekZHd2cKLS0tIFhLdjRWMytlRTJWUG5XOUIyTzVI\nZlhzTGtwVzdzcnhMd3JwSGNVNWdWTWsKDRAxlgD5uS1MqYH/2qmtLIX30P53r2RS\nLKhGW/KAkKp5HxtQnvAUgy9TnjpQ7WZriVRKaw8+WFUzWqNzjf/O8w==\n-----END AGE ENCRYPTED FILE-----\n"
},
{
"recipient": "age1tq8zaaqe8t4u2jgyf7usngtzyql0ymyxq6hntmu04vt5ypwhxensmzynhl",
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBrN002bTJUcmt2TVNXR1Vu\nOElRLzdpdGU0c1daTjlEZlpXbXlnYTNNQ3hVCjdKcWR4UndSdUF3YnA0a1RKUy9m\ncEEyT3p4K3orNGhOT0RBa00yQS8vSW8KLS0tIElQMXdQMXdEelFPSlU3NENubVZE\nOTI5bmFFK0xUS0ZEMWtUZDloQTdOVFUKbgTzgiNPT+QXLXjNlBGK/XQFx9Ox8Bos\nTLUkJ23rsk+LMPWSO4Flpv+5ce/G2YQFV6SXlpFSYlNJlSxU2mZtWw==\n-----END AGE ENCRYPTED FILE-----\n"
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB6QnVETDFGZXhoZTVpKzBv\nSlhFRjl4K04yYzd6eCs5TzRwSVJkbWNqQ3lRCmcvRTE0M091WUdOSkx5UkxjdWds\nYkxKOEovUjdleTY5VjdMK01yM3hQVWMKLS0tIGhMaUd3M2RmYnYyMW0wT0FVbEpT\neGdGSlk0M1E4UEltazNvTXdnRnZaM0EKoSPVyyoG3RxQQUXB+DajVT8r14n0BPrs\n5uuCbKrURuSV8Vc3JJcvwzxiC/8/plYXjZesjTQJbMkilcdfGcy9PA==\n-----END AGE ENCRYPTED FILE-----\n"
},
{
"recipient": "age1cz006hex596lmj88kkhrkvq89luqk59hxuq83q4kvhz82ltwpe4ss8gm3t",
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBGRy9UZjRCaGlOUjVtTnZI\nV3VtdWwwbzQxaDhIVUN3cVF5OEUyVm8reUF3Cjh6bFVDY3ZZUWVvQ1h0QTFEU08r\nZ2tJN3ZrVisyQmpIcnoxZGdjcWcwbDAKLS0tIGNlbTc1QUJiWHU5bnhJKzRYTDVJ\nR1lrWlVmSkJJS2dZQlFTRWloN05mK2MKGVyjmdWFtCfR0AlnH8SaDdtHXlGsVleG\nRkHDFvAN2Y62S45w5l9d66J5WykSCmgQB2TNuzlYKNAsCwTbzaBBDg==\n-----END AGE ENCRYPTED FILE-----\n"
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB4QmdCQkVJVmRHTUlucjd1\nYWhQWWJpZkthNERBV1B1MW1aL2R2NGlqalN3CjhjWFRzdWphRElkWG9KWXVVTmsr\nTU5MR3dYa2lMNG52VWRqRWxYYjRUaE0KLS0tIFo5ZXdXTWRTaU1yWnNwNnNjOENC\nK1UrL2ExeTlJV3owRVlkbnpIT0N6cm8K+z4TfyrvXTAa0b7FkS0w65Y+JB7Cqgjo\nRwrZP49nlCfGA1l9iWgOyqgJozPGKAtg4SUnaaheJAvLjuQc/vHTUg==\n-----END AGE ENCRYPTED FILE-----\n"
},
{
"recipient": "age1sn4uu6r6wrylpznx75jcw7ww58r9cut35n40gu4scpt9xy79rgrq2d7wga",
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBEQWsvaThqRFR2RGR6OTlD\nOVhXUHdrTytnWDBOSnZvVXVmMHdTSGd1cGpvCjdsY3BsbW9scDhZYnVCRG1RbzFD\nd1Vld3N4akdLNTRoWGE3TXFWVWozV0EKLS0tIEJ3RFdSa2J6QlBsb3VpM2pmanhP\nK1ViT2VPblo2dHc2TFU1NDdWR0Z3SzAKtBZzdbP3cU/Km8+p1D1sAf3KtSDJmDEH\nH/NpfzpdbyMHbJ5Y4n8IJqs/GLeR88X0I2WOU86zvkr0dOFPYGwr5A==\n-----END AGE ENCRYPTED FILE-----\n"
}
],
"lastmodified": "2024-05-28T03:40:24Z",