Archived
Centralize shared values into variables.nix
One file (variables.nix) holding every value that was previously hardcoded and repeated across modules: LAN domain/CIDR, home/tailnet domains, cross-host references (nix-cache substituter hostname, NFS server hostname, remote-builder user), PXE/PBS IPs, timezone, and the primary username. Wired in via flake.nix's specialArgs (and home-manager's extraSpecialArgs for the two home.nix files), so any module picks it up by just adding `vars` to its function arguments — no explicit import needed. Two hosts (nix-cache, server) now derive their own networking.hostName from the same variable other hosts use to reach them, so there's exactly one place to change either identifier. Purely mechanical: every substituted value matches what was already there, confirmed by identical toplevel .drv paths for all 17 targets before and after. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
Claude Sonnet 5
@@ -1,4 +1,4 @@
|
||||
{ config, pkgs, lib, ... }:
|
||||
{ config, pkgs, lib, vars, ... }:
|
||||
|
||||
let
|
||||
# Flake attribute names are now <platform>-<buildtype> (e.g. proxmox-docker)
|
||||
@@ -9,13 +9,13 @@ let
|
||||
sudo nixos-rebuild switch \
|
||||
--no-write-lock-file \
|
||||
--refresh \
|
||||
--flake git+https://gitea.lan.ddnsgeek.com/beatzaplenty/nixos.git#$(cat /etc/flake-target)
|
||||
--flake git+https://${vars.lanDomain}/beatzaplenty/nixos.git#$(cat /etc/flake-target)
|
||||
'';
|
||||
myTestCmd = ''
|
||||
sudo nixos-rebuild test \
|
||||
--no-write-lock-file \
|
||||
--refresh \
|
||||
--flake git+https://gitea.lan.ddnsgeek.com/beatzaplenty/nixos.git#$(cat /etc/flake-target)
|
||||
--flake git+https://${vars.lanDomain}/beatzaplenty/nixos.git#$(cat /etc/flake-target)
|
||||
'';
|
||||
in
|
||||
{
|
||||
|
||||
@@ -1,29 +1,30 @@
|
||||
{ config, lib, pkgs, ... }:
|
||||
{ config, lib, pkgs, vars, ... }:
|
||||
|
||||
{
|
||||
imports =
|
||||
[ # Include the results of the hardware scan.
|
||||
# ./hardware-configuration.nix
|
||||
imports =
|
||||
[
|
||||
# Include the results of the hardware scan.
|
||||
# ./hardware-configuration.nix
|
||||
../set-locale.nix
|
||||
];
|
||||
# Use the GRUB 2 boot loader.
|
||||
# boot.loader.grub.enable = true;
|
||||
#boot.loader.grub.device = "/dev/sda"; # or "nodev" for efi only
|
||||
|
||||
networking.networkmanager.enable = true; # Easiest to use and most distros use this by default.
|
||||
networking.networkmanager.enable = true; # Easiest to use and most distros use this by default.
|
||||
|
||||
# Set your time zone.
|
||||
time.timeZone = "Australia/Brisbane";
|
||||
time.timeZone = vars.timeZone;
|
||||
|
||||
# Enable QEMU agent
|
||||
services.qemuGuest.enable = true;
|
||||
|
||||
# Enable docker-compose
|
||||
# Enable docker-compose
|
||||
environment.systemPackages = with pkgs; [
|
||||
vim
|
||||
btop
|
||||
git
|
||||
gcr
|
||||
vim
|
||||
btop
|
||||
git
|
||||
gcr
|
||||
];
|
||||
|
||||
# Secrets shared by every host, decrypted at activation via each host's
|
||||
@@ -47,13 +48,13 @@
|
||||
!include ${config.sops.templates."nix-github-token.conf".path}
|
||||
'';
|
||||
|
||||
#Set root password
|
||||
users.users.root = {
|
||||
hashedPasswordFile = config.sops.secrets."root-hashedPassword".path;
|
||||
};
|
||||
#Set root password
|
||||
users.users.root = {
|
||||
hashedPasswordFile = config.sops.secrets."root-hashedPassword".path;
|
||||
};
|
||||
|
||||
# Define a user account. Don't forget to set a password with ‘passwd’.
|
||||
users.users.nixos = {
|
||||
users.users.${vars.primaryUser} = {
|
||||
isNormalUser = true;
|
||||
extraGroups = [ "wheel" ]; # Enable ‘sudo’ for the user.
|
||||
packages = with pkgs; [
|
||||
@@ -61,8 +62,8 @@ users.users.root = {
|
||||
];
|
||||
hashedPasswordFile = config.sops.secrets."nixos-hashedPassword".path;
|
||||
openssh.authorizedKeys.keys = [
|
||||
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCq/Q5LvIXlZwO2kdeAN5nLGZ59nZB7JHYMEszHxmNtGMzv1lM31jiPNsr0z2EKVZhE7OOfa2IF9rhWYD7JUA9G0yzdZ4WTXFNGVVOJoOVH6vAF3XCxoVilOEwTc7h2Wiy+rzd0B28/3spffzQQWJhY6GRQVa8j+6xAGF60Fcvl1vLosYT9Bn2ZbK4TCWOwAn2jqXIieGpZdn/UNZbGOeKRiCvhktDfMAzuQzN/9jMu/oF4pkPn2X1UrsQdNlvp0Ci8md612MozIpncQJyAF1ADhunr3sMx0isUXiqD29R5DS4TftpekqLNLak+zcxFa8N7DcRNp3DcKfJvyTkwQrR4r+b7lFLYOLHLagSso9CzeW/paAS2q9I5SBm/2DtE1diLLg2jZikYcstsu/G5RgvbzbKqjiaMwTdXC3AMvDxQrs7U5pDRZFzoofG3cpODbTm+uy3m0kP70z0M1K45UbDG0p+itnTu9x40JbQEgefbx38AItNvAIx1A8HO4I1VX28= wayne@stream"
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICMJhrfFayLBG+gWtO6oAvgambw5nWWgztiTFEaaaVRH debian@surface"
|
||||
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCq/Q5LvIXlZwO2kdeAN5nLGZ59nZB7JHYMEszHxmNtGMzv1lM31jiPNsr0z2EKVZhE7OOfa2IF9rhWYD7JUA9G0yzdZ4WTXFNGVVOJoOVH6vAF3XCxoVilOEwTc7h2Wiy+rzd0B28/3spffzQQWJhY6GRQVa8j+6xAGF60Fcvl1vLosYT9Bn2ZbK4TCWOwAn2jqXIieGpZdn/UNZbGOeKRiCvhktDfMAzuQzN/9jMu/oF4pkPn2X1UrsQdNlvp0Ci8md612MozIpncQJyAF1ADhunr3sMx0isUXiqD29R5DS4TftpekqLNLak+zcxFa8N7DcRNp3DcKfJvyTkwQrR4r+b7lFLYOLHLagSso9CzeW/paAS2q9I5SBm/2DtE1diLLg2jZikYcstsu/G5RgvbzbKqjiaMwTdXC3AMvDxQrs7U5pDRZFzoofG3cpODbTm+uy3m0kP70z0M1K45UbDG0p+itnTu9x40JbQEgefbx38AItNvAIx1A8HO4I1VX28= wayne@stream"
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICMJhrfFayLBG+gWtO6oAvgambw5nWWgztiTFEaaaVRH debian@surface"
|
||||
];
|
||||
};
|
||||
|
||||
@@ -88,4 +89,4 @@ users.users.root = {
|
||||
|
||||
|
||||
|
||||
}
|
||||
}
|
||||
|
||||
+32
-31
@@ -1,22 +1,23 @@
|
||||
{ config, pkgs, lib, ... }:
|
||||
{ config, pkgs, lib, vars, ... }:
|
||||
|
||||
let
|
||||
remote = "root@proxmox-ip:/var/lib/vz/template/iso";
|
||||
localMount = "${config.home.homeDirectory}/proxmox-iso";
|
||||
in {
|
||||
in
|
||||
{
|
||||
|
||||
imports = [
|
||||
./aliases.nix
|
||||
];
|
||||
|
||||
home.username = "nixos"; # your actual username
|
||||
home.homeDirectory = "/home/nixos";
|
||||
home.stateVersion = "25.11"; # match your NixOS stateVersion
|
||||
home.username = vars.primaryUser;
|
||||
home.homeDirectory = "/home/${vars.primaryUser}";
|
||||
home.stateVersion = "25.11"; # match your NixOS stateVersion
|
||||
|
||||
programs.home-manager.enable = true; # mandatory to activate HM
|
||||
|
||||
programs.bash.enable = true;
|
||||
|
||||
programs.home-manager.enable = true; # mandatory to activate HM
|
||||
|
||||
programs.bash.enable = true;
|
||||
|
||||
# GitHub access-tokens setting used to live here in plaintext; it's now
|
||||
# rendered system-wide from a sops-nix secret via nix.extraOptions in
|
||||
# modules/common/configuration.nix instead (covers the daemon for every
|
||||
@@ -35,31 +36,31 @@ programs.bash.enable = true;
|
||||
home.sessionVariables = {
|
||||
EDITOR = "nano";
|
||||
};
|
||||
# systemd.user.services.mount-proxmox-iso = {
|
||||
# Unit = {
|
||||
# Description = "Mount Proxmox ISO dir via SSHFS";
|
||||
# After = [ "network-online.target" ];
|
||||
# Wants = [ "network-online.target" ];
|
||||
# };
|
||||
# systemd.user.services.mount-proxmox-iso = {
|
||||
# Unit = {
|
||||
# Description = "Mount Proxmox ISO dir via SSHFS";
|
||||
# After = [ "network-online.target" ];
|
||||
# Wants = [ "network-online.target" ];
|
||||
# };
|
||||
|
||||
# Service = {
|
||||
# Type = "simple";
|
||||
# ExecStartPre = "${pkgs.coreutils}/bin/mkdir -p ${localMount}";
|
||||
# ExecStart = "${pkgs.sshfs}/bin/sshfs -o IdentityFile=${config.home.homeDirectory}/.ssh/id_ed25519,allow_other,reconnect,ServerAliveInterval=15,ServerAliveCountMax=3 root@proxmox-ip:/var/lib/vz/template/iso ${localMount}";
|
||||
# ExecStop = "${pkgs.fuse3}/bin/fusermount3 -u ${localMount}";
|
||||
# Restart = "on-failure";
|
||||
# };
|
||||
# Service = {
|
||||
# Type = "simple";
|
||||
# ExecStartPre = "${pkgs.coreutils}/bin/mkdir -p ${localMount}";
|
||||
# ExecStart = "${pkgs.sshfs}/bin/sshfs -o IdentityFile=${config.home.homeDirectory}/.ssh/id_ed25519,allow_other,reconnect,ServerAliveInterval=15,ServerAliveCountMax=3 root@proxmox-ip:/var/lib/vz/template/iso ${localMount}";
|
||||
# ExecStop = "${pkgs.fuse3}/bin/fusermount3 -u ${localMount}";
|
||||
# Restart = "on-failure";
|
||||
# };
|
||||
|
||||
# Install = {
|
||||
# WantedBy = [ "default.target" ];
|
||||
# };
|
||||
# };
|
||||
# Install = {
|
||||
# WantedBy = [ "default.target" ];
|
||||
# };
|
||||
# };
|
||||
# Optional: enable bash (or zsh, fish...)
|
||||
# programs.bash.enable = true;
|
||||
# programs.bash.enable = true;
|
||||
|
||||
# Optional: manage dotfiles via symlinks
|
||||
# home.file = {
|
||||
# ".tmux.conf".source = ./dotfiles/tmux.conf;
|
||||
# ".config/nvim/init.vim".source = ./dotfiles/init.vim;
|
||||
# };
|
||||
# home.file = {
|
||||
# ".tmux.conf".source = ./dotfiles/tmux.conf;
|
||||
# ".config/nvim/init.vim".source = ./dotfiles/init.vim;
|
||||
# };
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user