From d8d14db505ca88d002a9948717357035e17a18b4 Mon Sep 17 00:00:00 2001 From: beatzaplenty Date: Mon, 20 Jul 2026 02:57:38 +1000 Subject: [PATCH] Extract ports, docker host, and remote-builder keys into variables.nix Pulls the beszel hub / PVE / PBS ports, the docker-compose host's LAN name, and the remote-builder client SSH keys out of scattered inline literals across modules/hosts and into variables.nix as the single source of truth, matching the existing pattern for other cross-host references (nixCacheHost, nfsServerHost). Co-Authored-By: Claude Sonnet 5 Claude-Session: https://claude.ai/code/session_01La55Nsss8jZ7ZuzUV9mfot --- hosts/nixos/home.nix | 8 ++++---- modules/beszel/enable-agent.nix | 2 +- modules/nix-cache/server.nix | 15 ++++----------- variables.nix | 17 +++++++++++++++++ 4 files changed, 26 insertions(+), 16 deletions(-) diff --git a/hosts/nixos/home.nix b/hosts/nixos/home.nix index eefc6e2..6a1337d 100644 --- a/hosts/nixos/home.nix +++ b/hosts/nixos/home.nix @@ -39,7 +39,7 @@ [Desktop Entry] Type=Application Name=Proxmox (Chromium) - Exec=chromium --app=https://pve.${vars.homeDomain}:8006 --window-size=1920,1080 --window-position=0,0 + Exec=chromium --app=https://pve.${vars.homeDomain}:${toString vars.pveWebPort} --window-size=1920,1080 --window-position=0,0 Icon=${config.home.homeDirectory}/.local/share/icons/proxmox.png Terminal=false Categories=Hypervisor; @@ -49,7 +49,7 @@ [Desktop Entry] Type=Application Name=Proxmox Backup Server (Chromium) - Exec=chromium --app=https://${vars.pbsIp}:8007 --window-size=1920,1080 --window-position=0,0 + Exec=chromium --app=https://${vars.pbsIp}:${toString vars.pbsWebPort} --window-size=1920,1080 --window-position=0,0 Icon=${config.home.homeDirectory}/.local/share/icons/proxmox.png Terminal=false Categories=backup; @@ -59,7 +59,7 @@ [Desktop Entry] Type=Application Name=Proxmox (Firefox) - Exec=firefox --new-instance https://pve.${vars.homeDomain}:8006 --profile ProxmoxWebApp --window-size=1920,1080 --class ProxmoxWebApp + Exec=firefox --new-instance https://pve.${vars.homeDomain}:${toString vars.pveWebPort} --profile ProxmoxWebApp --window-size=1920,1080 --class ProxmoxWebApp Icon=${config.home.homeDirectory}/.local/share/icons/proxmox.png Terminal=false Categories=Hypervisor; @@ -69,7 +69,7 @@ [Desktop Entry] Type=Application Name=Proxmox Backup Server (Firefox) - Exec=firefox --new-window https://${vars.pbsIp}:8007 --profile PbsWebApp --window-size=1920,1080 --class PbsWebApp + Exec=firefox --new-window https://${vars.pbsIp}:${toString vars.pbsWebPort} --profile PbsWebApp --window-size=1920,1080 --class PbsWebApp Icon=${config.home.homeDirectory}/.local/share/icons/proxmox.png Terminal=false Categories=backup; diff --git a/modules/beszel/enable-agent.nix b/modules/beszel/enable-agent.nix index 42aa4c7..5ebf20f 100644 --- a/modules/beszel/enable-agent.nix +++ b/modules/beszel/enable-agent.nix @@ -4,6 +4,6 @@ services.beszel.agent.enable = true; services.beszel.agent.environment = { #DOCKER_HOST = "tcp://docker-socket-proxy:2375"; - HUB_URL = "http://docker.${vars.homeDomain}:8090"; + HUB_URL = "http://${vars.dockerHost}.${vars.homeDomain}:${toString vars.beszelHubPort}"; }; } diff --git a/modules/nix-cache/server.nix b/modules/nix-cache/server.nix index de632c2..b65986d 100644 --- a/modules/nix-cache/server.nix +++ b/modules/nix-cache/server.nix @@ -34,17 +34,10 @@ createHome = true; home = "/var/lib/nixremote"; shell = pkgs.bashInteractive; - # Provide remote builder public keys here (safe to commit public keys only): - # openssh.authorizedKeys.keys = [ "ssh-ed25519 AAAA... client@host" ]; - # - # Avoid absolute keyFiles paths here because they break pure flake evaluation. - openssh.authorizedKeys.keys = [ - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFDEA1S2ikpObREgbP5uVBWMxIOGbY8B+Wx7VTZK1m6t root@server" - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPAYIT9ormlmxZ0SziyDQaUntnKI8HK9/s3Qac1ZKjP2 root@docker" - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKKKzoEPl/ZW9KBRHBcp6/ThOngGpwMv5EhkTlgC4aDf root@nixos" - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIGtOWOCS+ImHc7NehguoyD7PbonGosKMZqc9+QR3v/h root@nixos" - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHxXTQxFnArK5HXG7czeoybZebCGfxpUdusJkPn+BCSp root@server" - ]; + # Client public keys allowed to use this host as a remote builder — + # single source of truth is vars.remoteBuilderAuthorizedKeys (safe to + # commit public keys only). + openssh.authorizedKeys.keys = vars.remoteBuilderAuthorizedKeys; }; services.openssh.enable = true; diff --git a/variables.nix b/variables.nix index 1ab2fe5..cb1d798 100644 --- a/variables.nix +++ b/variables.nix @@ -10,13 +10,30 @@ # Cross-host references (LAN hostnames/users other hosts reach over the network) nixCacheHost = "nix-cache"; # substituter/remote-builder hostname nfsServerHost = "server"; # NFS export source hostname + dockerHost = "docker"; # docker-compose stack host remoteBuilderUser = "nixremote"; # remote builder SSH user + # Public keys authorized to SSH in as remoteBuilderUser on the nix-cache + # host (modules/nix-cache/server.nix) — one per client host that's allowed + # to use it as a distributed builder. + remoteBuilderAuthorizedKeys = [ + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFDEA1S2ikpObREgbP5uVBWMxIOGbY8B+Wx7VTZK1m6t root@server" + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPAYIT9ormlmxZ0SziyDQaUntnKI8HK9/s3Qac1ZKjP2 root@docker" + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKKKzoEPl/ZW9KBRHBcp6/ThOngGpwMv5EhkTlgC4aDf root@nixos" + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIGtOWOCS+ImHc7NehguoyD7PbonGosKMZqc9+QR3v/h root@nixos" + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHxXTQxFnArK5HXG7czeoybZebCGfxpUdusJkPn+BCSp root@server" + ]; + # System timeZone = "Australia/Brisbane"; primaryUser = "nixos"; # main interactive user on every host # Storage storageRoot = "/tank"; # ZFS pool root on `server` + + # Well-known ports for LAN services referenced from multiple hosts + beszelHubPort = 8090; + pveWebPort = 8006; + pbsWebPort = 8007; }