beatzaplenty/nixos
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Centralize shared values into variables.nix

Browse Source 
One file (variables.nix) holding every value that was previously
hardcoded and repeated across modules: LAN domain/CIDR, home/tailnet
domains, cross-host references (nix-cache substituter hostname, NFS
server hostname, remote-builder user), PXE/PBS IPs, timezone, and the
primary username.

Wired in via flake.nix's specialArgs (and home-manager's
extraSpecialArgs for the two home.nix files), so any module picks it
up by just adding `vars` to its function arguments — no explicit
import needed. Two hosts (nix-cache, server) now derive their own
networking.hostName from the same variable other hosts use to reach
them, so there's exactly one place to change either identifier.

Purely mechanical: every substituted value matches what was already
there, confirmed by identical toplevel .drv paths for all 17 targets
before and after.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
beatzaplenty
2026-07-19 14:51:37 +10:00
co-authored by Claude Sonnet 5
parent 71d052e737
commit eadb1e35ce
20 changed files with 219 additions and 191 deletions
Download Patch File Download Diff File Expand all files Collapse all files
modules/nix-cache/client.nix
+2 -2
View File
@@ -1,9 +1,9 @@
{ ... }:
{ vars, ... }:
{
nix.settings = {
substituters = [
"http://nix-cache"
"http://${vars.nixCacheHost}"
"https://cache.nixos.org/"
];
trusted-public-keys = [
modules/nix-cache/server.nix
+13 -11
View File
@@ -1,4 +1,4 @@
{ config, pkgs, ... }:
{ config, pkgs, vars, ... }:
{
# Generate the binary cache key pair on the nix-cache host:
@@ -17,7 +17,7 @@
services.nginx = {
enable = true;
recommendedProxySettings = true;
virtualHosts."nix-cache" = {
virtualHosts.${vars.nixCacheHost} = {
locations."/" = {
proxyPass = "http://${config.services.nix-serve.bindAddress}:${toString config.services.nix-serve.port}";
};
@@ -26,11 +26,11 @@
networking.firewall.allowedTCPPorts = [ 80 ];
users.groups.nixremote = {};
users.groups.${vars.remoteBuilderUser} = { };
users.users.nixremote = {
users.users.${vars.remoteBuilderUser} = {
isSystemUser = true;
group = "nixremote";
group = vars.remoteBuilderUser;
createHome = true;
home = "/var/lib/nixremote";
shell = pkgs.bashInteractive;
@@ -38,17 +38,19 @@
# openssh.authorizedKeys.keys = [ "ssh-ed25519 AAAA... client@host" ];
#
# Avoid absolute keyFiles paths here because they break pure flake evaluation.
openssh.authorizedKeys.keys = ["ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFDEA1S2ikpObREgbP5uVBWMxIOGbY8B+Wx7VTZK1m6t root@server"
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPAYIT9ormlmxZ0SziyDQaUntnKI8HK9/s3Qac1ZKjP2 root@docker"
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKKKzoEPl/ZW9KBRHBcp6/ThOngGpwMv5EhkTlgC4aDf root@nixos"
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIGtOWOCS+ImHc7NehguoyD7PbonGosKMZqc9+QR3v/h root@nixos"
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHxXTQxFnArK5HXG7czeoybZebCGfxpUdusJkPn+BCSp root@server"];
openssh.authorizedKeys.keys = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFDEA1S2ikpObREgbP5uVBWMxIOGbY8B+Wx7VTZK1m6t root@server"
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPAYIT9ormlmxZ0SziyDQaUntnKI8HK9/s3Qac1ZKjP2 root@docker"
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKKKzoEPl/ZW9KBRHBcp6/ThOngGpwMv5EhkTlgC4aDf root@nixos"
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIGtOWOCS+ImHc7NehguoyD7PbonGosKMZqc9+QR3v/h root@nixos"
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHxXTQxFnArK5HXG7czeoybZebCGfxpUdusJkPn+BCSp root@server"
];
};
services.openssh.enable = true;
nix.settings = {
trusted-users = [ "root" "nixremote" ];
trusted-users = [ "root" vars.remoteBuilderUser ];
experimental-features = [ "nix-command" "flakes" ];
auto-optimise-store = true;
builders-use-substitutes = true;