mirror of
https://github.com/Stunkymonkey/nixos.git
synced 2025-05-24 09:54:40 +02:00
newton: init
This commit is contained in:
Felix Buehler
parent
e337aac7f1
commit
a3a764bddf
7 changed files with 137 additions and 3 deletions
|
|
@ -2,6 +2,7 @@ keys:
|
|||
- &admin_felix age1hf8m9upp00dr7qv2kmqdr50fpvd9ejzkfu8yknqnuda2aas2tvrs4l3u7m
|
||||
- &thinkman age1spt854cdscqs757a8kazth52rv4p9udh54suw9lpzlqg5savyapq2u0c03
|
||||
- &serverle age14nt7qcsrye0vrpk0xcgcfmhkxwwumna39fpn83g3x0zml62skatqpnmhk4
|
||||
- &newton age1s9spl75rwhgm3cvvqsr9rze5m0kuxqes2tsxjmq07xg5ycn5j47s2m0dlu
|
||||
creation_rules:
|
||||
- path_regex: secrets.yaml$
|
||||
key_groups:
|
||||
|
|
@ -9,3 +10,4 @@ creation_rules:
|
|||
- *admin_felix
|
||||
- *thinkman
|
||||
- *serverle
|
||||
- *newton
|
||||
|
|
|
|||
|
|
@ -53,4 +53,10 @@ in
|
|||
./serverle/configuration.nix
|
||||
];
|
||||
};
|
||||
newton = nixosSystem {
|
||||
system = "x86_64-linux";
|
||||
modules = defaultModules ++ [
|
||||
./newton/configuration.nix
|
||||
];
|
||||
};
|
||||
}
|
||||
|
|
|
|||
|
|
@ -7,14 +7,16 @@ let
|
|||
hostname = "${ip}:22";
|
||||
fastConnection = fast;
|
||||
profiles.system.path =
|
||||
deploy.lib.x86_64-linux.activate.nixos
|
||||
deploy-rs.lib.x86_64-linux.activate.nixos
|
||||
self.nixosConfigurations."${server}";
|
||||
};
|
||||
in
|
||||
{
|
||||
user = "root";
|
||||
sshUser = "felix";
|
||||
#sshUser = "felix";
|
||||
sshUser = "root";
|
||||
nodes = {
|
||||
serverle = mkNode "serverle" "192.167.178.60" true;
|
||||
serverle = mkNode "serverle" "serverle.local" true;
|
||||
newton = mkNode "newton" "buehler.rocks" true;
|
||||
};
|
||||
}
|
||||
|
|
|
|||
47
nixos/newton/configuration.nix
Normal file
47
nixos/newton/configuration.nix
Normal file
|
|
@ -0,0 +1,47 @@
|
|||
{ config, ... }:
|
||||
{
|
||||
imports = [
|
||||
./hardware-configuration.nix
|
||||
./disks.nix
|
||||
#../modules/backup.nix
|
||||
../modules/compression.nix
|
||||
../modules/development.nix
|
||||
../modules/docker.nix
|
||||
../modules/networkdecrypt.nix
|
||||
../modules/nix.nix
|
||||
../modules/ssh.nix
|
||||
../modules/users.nix
|
||||
../modules/webapps/config.nix
|
||||
../modules/webapps/homer.nix
|
||||
../modules/webapps/jellyfin.nix
|
||||
../modules/webapps/navidrome.nix
|
||||
];
|
||||
networking.hostName = "newton";
|
||||
|
||||
sops.defaultSopsFile = ./secrets.yaml;
|
||||
|
||||
#environment.noXlibs = true;
|
||||
|
||||
networking.firewall.allowedTCPPorts = [
|
||||
];
|
||||
|
||||
# Use the GRUB 2 boot loader.
|
||||
boot.loader.grub.enable = true;
|
||||
boot.loader.grub.version = 2;
|
||||
boot.loader.grub.device = "/dev/sda";
|
||||
#boot.loader.grub.copyKernels = true;
|
||||
|
||||
services.openssh.permitRootLogin = "yes";
|
||||
users.extraUsers.root.openssh.authorizedKeys.keys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOFx6OLwL9MbkD3mnMsv+xrzZHN/rwCTgVs758SCLG0h felix@thinkman" ];
|
||||
|
||||
# Nix
|
||||
nix.gc = {
|
||||
automatic = true;
|
||||
options = "--delete-older-than 30d";
|
||||
};
|
||||
|
||||
system = {
|
||||
stateVersion = "22.05";
|
||||
autoUpgrade.enable = true;
|
||||
};
|
||||
}
|
||||
31
nixos/newton/disks.nix
Normal file
31
nixos/newton/disks.nix
Normal file
|
|
@ -0,0 +1,31 @@
|
|||
{ config, lib, pkgs, ... }:
|
||||
|
||||
{
|
||||
|
||||
boot.initrd.luks.devices."luks-drive" = {
|
||||
name = "luks-drive";
|
||||
device = "/dev/disk/by-partlabel/Crypt";
|
||||
preLVM = true;
|
||||
allowDiscards = true;
|
||||
};
|
||||
|
||||
fileSystems."/" = {
|
||||
device = "/dev/disk/by-label/serverle-root";
|
||||
fsType = "ext4";
|
||||
};
|
||||
|
||||
fileSystems."/boot" = {
|
||||
device = "/dev/disk/by-label/serverle-boot";
|
||||
fsType = "vfat";
|
||||
};
|
||||
|
||||
fileSystems."/srv" = {
|
||||
device = "/dev/disk/by-label/serverle-srv";
|
||||
fsType = "ext4";
|
||||
};
|
||||
|
||||
swapDevices = [{
|
||||
device = "/dev/disk/by-label/serverle-swap";
|
||||
}];
|
||||
}
|
||||
|
||||
11
nixos/newton/hardware-configuration.nix
Normal file
11
nixos/newton/hardware-configuration.nix
Normal file
|
|
@ -0,0 +1,11 @@
|
|||
{ config, pkgs, lib, modulesPath, ... }:
|
||||
{
|
||||
imports = [ (modulesPath + "/profiles/qemu-guest.nix") ];
|
||||
|
||||
boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "virtio_scsi" "sd_mod" ];
|
||||
boot.initrd.kernelModules = [ "dm-snapshot" ];
|
||||
boot.kernelModules = [ ];
|
||||
boot.extraModulePackages = [ ];
|
||||
|
||||
hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
|
||||
}
|
||||
35
nixos/newton/secrets.yaml
Normal file
35
nixos/newton/secrets.yaml
Normal file
|
|
@ -0,0 +1,35 @@
|
|||
borgbackup_user: ENC[AES256_GCM,data:9eCWsSi9U2b4XKKc,iv:PDS8TrbmU5XmefLFdi8XIQeu9Rq0y+yJkdGrND6F3ts=,tag:651RHA5y6all5+2rhdjCdg==,type:str]
|
||||
borgbackup_host: ENC[AES256_GCM,data:qYwTGE5kdp/jsKK8scVAUCXfOAi787lwiFB3VlntIg==,iv:sFerbhHMCw1lwm9CzAAW7G1JwuZxvTxMzoKP6U5l7bI=,tag:Mi1QFDUo5rWzKXBQ1fsrZg==,type:str]
|
||||
borgbackup_dir: ENC[AES256_GCM,data:B8KO2IsfYA==,iv:NjyxpK0xMBio2xFdcmbOj+CoS54A8b7AfXUbAlQqH8A=,tag:PkrlX7XtctsfUmbZCIi/0Q==,type:str]
|
||||
borgbackup_password: ENC[AES256_GCM,data:BJReaY2D2vtOKRWBytbieEYIhMKxn3U=,iv:DJv8s1onfO1FAAJYLwcRszkG9SjC+sJMdvqLEwcggFk=,tag:WYJvEuRilMLaOVcvXkDH3w==,type:str]
|
||||
borgbackup_private_ssh_key: ENC[AES256_GCM,data:WDVQaAmNMtZP99lCOpeMDnsL26gziDHlDDSnct7QXU9KgveNhDnnh4vGR/DaPlsnp76dVaNKf1vpspsJjtJ+BcEOg4SKU7xyODK5f5tglRJqapmTymASzERNF9joP8Py1lW15zlgGy4s/J9oAQ8gsfwy7aUGMlPr5xafHatbKPXiy+OnxekTTzT+H5eGaMl+q5nPKX8yOwnwBnPwp6DKvK+rTrqBptNsYBxw0MYgdEK1hW1YUxE9d4oZM3Mi7ggklK+ztspuXNpqkbogqc+1XIZN8vMaL9MK5zSJjuCw9lFYsfHctgiBlEuOy5Hn4tyEhu49uWVvoJLb+q7+gNJcbKBrisFd4c9fa7EnaQ4AenP2l1arZqlqjaqLNhD9FWI47o0neXe6TDAv1msIMXHibQVEVyNdktl6LBxQerXiGq33fWe3J5usaUFVi2N4sOF/Pn1Hta25OvuO2N2gUWh1bqi11wYzljS445LOOPBT3jkoceV2m+5R7fpF0soc/beKdj0dP6u5sfKbXFolHk1K,iv:4ZS/6PfyUwXlFaCYxpO0VkjBoH9zM9DJvF5I7fLYR+M=,tag:9m6RHNgr9TunQJp1Q5MqJA==,type:str]
|
||||
initrd_ssh_key: ENC[AES256_GCM,data:kt8S7FKIApR8Td4IC57yEODiYn13UoDF+ry73nazi7YZCVPwT415cjIY9iH2/5MoWBwLA7Wd65/NnQQwkkE6ls+d7ra+U5YTKCQPfPEhywkWFn/0s61xyM+HyjOr06O+IYm9fhJloaiag8EBPHULh+3g6Ta05db/eWOYPctYa1xIKKSbXQCrnIrZp5R1SUqA5Lnxj+U9n1ZYLVSunXn4+mtTkyPv6mAAbnk+Kvj0eMIWY/9yu0r4q2Lx7ubf90EIfn29V501X9MArUKtzSfyP6Y3rOrCuq98uYlu9STTauQojdChDeiTreUtpqRnqtRvgK+AfNwxkY+GVQALgsxphbsiK3Y/LRmUBdp8Gqq5zJwzczlEIUkAOy2Wy/ewx0exJj2k9D05iI66kA76Aj6lSIwzoGm6aqqEA1rRWeylUDtVAwV55DE/FKtKc/49Me+Q+3K62t30IeApgY4X+H0gN8LUH6AOTqj8WEd7s7cfjWEzZJfntpToI4q9nQ7SQxTNuyD4GBS/bo/ExT1pgb7Q,iv:LPmxOBkyxpfoZ5YzuO4Nbf2dLXhxXvXOoiG1vYLY7wA=,tag:aDuSCFfFsdk66fi4hlcHhg==,type:str]
|
||||
sops:
|
||||
kms: []
|
||||
gcp_kms: []
|
||||
azure_kv: []
|
||||
hc_vault: []
|
||||
age:
|
||||
- recipient: age1hf8m9upp00dr7qv2kmqdr50fpvd9ejzkfu8yknqnuda2aas2tvrs4l3u7m
|
||||
enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB5STRaTnBIRFptdlBMenh4
|
||||
UnhKdlQ1bDVzQzJqenRHeERWeU1pRU9vT2tRCitBVFhBbXMvQ0p2YUs0b0d2Q2hW
|
||||
aHVxRWVnMWw2dkNIVVBBN1pTaUZIeWcKLS0tIEZZN3haVkVJL2dnRW05WDhtenJI
|
||||
YlZ5RVdyOFBVVkJmRUFIeGFEbW1XdkUKM0U4vXxIbHx31btXdRVB4oXRiEPbDK2L
|
||||
nY/sf0N9AOnR3n+RaoCF+gM7VlykKECKsbW538Lba6nX46FZc+LcCQ==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
- recipient: age14nt7qcsrye0vrpk0xcgcfmhkxwwumna39fpn83g3x0zml62skatqpnmhk4
|
||||
enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBKdWovR2dKYjNZaFZ1czJ0
|
||||
VFZUMytvb0dKUk5qb3F5ZHpnci9ibUt0QlJjClZ6YUdrZWJLb1d1bEFNNzgwWnRH
|
||||
amVxYldDU21HUk5jUENQV0dSSGtqSE0KLS0tIE12WGFUU1gyM1l5U2ZhM2c1d1JW
|
||||
SkFGQ04yWEhBY3FPSE5RaXZ6N1NmSUkKpLf4gOnPBx1ao5slYIfvK9sShRep2bqO
|
||||
IZvlGcsX1EHP0WB8XT1f9GUjBaEM1ZdIlXfaWRW2DDrDbgs+usQq2A==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
lastmodified: "2022-06-06T12:48:22Z"
|
||||
mac: ENC[AES256_GCM,data:5vkt5me5m81mVJQ4X94dFh7jzkNllJTeG8hlVm+nctqrHj5zEUdk6CCTmOQ6w/EMqpNOFX1vpEy8eakmH00+prLYuAuHYEb8IHbAKTA8b2aekUZX8saCust0DLTkwgOGiQ64xNEfrfgwB//TlbrT0Dw6a68KenUy0+riJCDpMP8=,iv:YcOpLsV/4Ahb0Gh5vrlNQL/13UFMxqpH0VPg4b4hU7U=,tag:hmyKAHuCaTw6Y47uP5lIxg==,type:str]
|
||||
pgp: []
|
||||
unencrypted_suffix: _unencrypted
|
||||
version: 3.7.3
|
||||
Loading…
Add table
Add a link
Reference in a new issue