From 104804dbf693bdc52615bba1db724292d8153f7d Mon Sep 17 00:00:00 2001 From: beatzaplenty Date: Tue, 21 Jul 2026 23:54:00 +0000 Subject: [PATCH 1/2] Stage a ZFS RAID0 disko layout for the bare-metal gui host Adds modules/disko/baremetal.nix: two disks, each its own top-level zpool vdev with no mirror/raidz between them (disko's zpool `mode` defaults to "" for a plain stripe), ESP + systemd-boot on disk1. Device paths are placeholders in variables.nix (guiRootDisk1/guiRootDisk2) until the real hardware profile arrives. Verified structurally by building a throwaway nixosSystem with the actual disko.nixosModules.disko and reading the generated system.build.formatScript: it emits `zpool create rpool ... disk1 disk2` with no mirror/raidz keyword, confirming a genuine stripe. Not yet wired into any flake target -- that happens once the hardware config lands and a new bare-metal platform module is added, per the agreed sequencing. --- modules/disko/baremetal.nix | 87 +++++++++++++++++++++++++++++++++++++ variables.nix | 6 +++ 2 files changed, 93 insertions(+) create mode 100644 modules/disko/baremetal.nix diff --git a/modules/disko/baremetal.nix b/modules/disko/baremetal.nix new file mode 100644 index 0000000..c24dcbf --- /dev/null +++ b/modules/disko/baremetal.nix @@ -0,0 +1,87 @@ +{ vars, ... }: + +{ + # ZFS RAID0 (striped, no redundancy) root pool for the bare-metal gui + # host — two disks, each contributing its own top-level vdev. disko's + # zpool `mode` defaults to "" (plain stripe) when left unset, which is + # what gives RAID0 semantics here rather than mirror/raidz. + # + # Device paths are placeholders until the real hardware profile lands — + # fill in vars.guiRootDisk1/guiRootDisk2 (stable /dev/disk/by-id/... + # paths, not /dev/sdX) before running disko against real hardware. Swap + # is deliberately left out for now — sizing that sensibly needs the + # box's actual RAM size, which comes with the hardware profile too. + # + # Not yet imported anywhere: this awaits the new bare-metal platform + # module (alongside modules/boot/efi.nix for systemd-boot, matching + # modules/platforms/proxmox.nix's pattern) once the hardware config is + # in hand. + disko.devices = { + disk = { + disk1 = { + type = "disk"; + device = vars.guiRootDisk1; + + content = { + type = "gpt"; + + partitions = { + esp = { + priority = 1; + name = "ESP"; + size = "512M"; + type = "EF00"; + + content = { + type = "filesystem"; + format = "vfat"; + mountpoint = "/boot"; + mountOptions = [ "umask=0077" ]; + }; + }; + + zfs = { + size = "100%"; + + content = { + type = "zfs"; + pool = "rpool"; + }; + }; + }; + }; + }; + + disk2 = { + type = "disk"; + device = vars.guiRootDisk2; + + content = { + type = "gpt"; + + partitions = { + zfs = { + size = "100%"; + + content = { + type = "zfs"; + pool = "rpool"; + }; + }; + }; + }; + }; + }; + + zpool.rpool = { + type = "zpool"; + + rootFsOptions = { + compression = "zstd"; + "com.sun:auto-snapshot" = "false"; + }; + mountpoint = "/"; + options.ashift = "12"; + }; + }; +} diff --git a/variables.nix b/variables.nix index 36fd232..db37d20 100644 --- a/variables.nix +++ b/variables.nix @@ -52,6 +52,12 @@ wifiSsid = ""; wifiPassword = ""; + # Bare-metal gui host's two disks for a ZFS RAID0 (striped) root pool + # (modules/disko/baremetal.nix). Use stable /dev/disk/by-id/... paths, + # not /dev/sdX -- fill in once the hardware profile is available. + guiRootDisk1 = ""; + guiRootDisk2 = ""; + # System timeZone = "Australia/Brisbane"; -- 2.54.0 From 96cc63671a311b679b04a08d34502e0c2f5a6d6f Mon Sep 17 00:00:00 2001 From: beatzaplenty Date: Wed, 22 Jul 2026 01:25:29 +0000 Subject: [PATCH 2/2] Add baremetal-gui flake target with ZFS RAID0, AMD GPU, and sops-backed wifi Wires everything staged so far into a real flake target: - modules/platforms/baremetal.nix (new): the bare-metal platform module, composed from a real nixos-generate-config run on the actual gui-host hardware (AMD CPU, ahci/xhci/usb storage -- modules/hardware-configuration/baremetal.nix). Enables hardware.enableRedistributableFirmware (real wifi/GPU/microcode firmware VMs never needed), amdgpu as the Xorg video driver plus hardware.graphics for Mesa OpenGL/Vulkan, and imports the ZFS RAID0 disko layout + modules/services/zfs/enable-service.nix for root-on-ZFS boot support. - flake.nix: new baremetal-gui target, reusing hosts/nixos/host.nix (same identity already shared across linode/proxmox/lxc-gui). - hosts/nixos/host.nix: added networking.hostId, required now that a ZFS root pool is in the picture. - variables.nix: guiRootDisk1/guiRootDisk2 filled in (/dev/sda, /dev/sdb -- only used transiently at disko-format time, same as modules/disko/proxmox.nix's own plain device path). wifiPassword removed. - modules/networking/wifi.nix: reworked to pull the wifi password from a new sops secret (secrets/gui.yaml, wifi-password) instead of a plaintext variable -- NetworkManager's ensureProfiles renders `psk = "$WIFI_PASSWORD"` literally (nixpkgs' own documented pattern for this) and envsubst-expands it from a sops-rendered EnvironmentFile at activation, so the real value never touches the Nix store, only /run. - .sops.yaml: new secrets/gui\.yaml rule, admin + the currently-registered lxc-gui recipient (the only gui variant with a provisioned host key so far -- whichever variant is actually deployed next still needs scripts/secrets/sync-host-keys.sh run for its own recipient). - README.md/CLAUDE.md: documented the new platform/target and its module layout, per this repo's own drift-prevention note. Verified end-to-end: nix eval of every existing target (nothing broke), a temporary real nixosSystem build against the actual disko.nixosModules.disko confirming the generated zpool create has no mirror/raidz keyword (genuine stripe), and a temporary test SSID confirming the sops secret/template/ ensureProfiles chain renders correctly before reverting to blank/real values. Full scripts/codex-maintenance.sh (secret-grep, fmt, statix, full-fallback eval of every host/package) passes clean. --- .sops.yaml | 12 ++++++ CLAUDE.md | 39 ++++++++++++++------ README.md | 11 ++++-- flake.nix | 1 + hosts/nixos/host.nix | 5 +++ modules/hardware-configuration/baremetal.nix | 23 ++++++++++++ modules/networking/wifi.nix | 37 ++++++++++++++----- modules/platforms/baremetal.nix | 28 ++++++++++++++ secrets/gui.yaml | 25 +++++++++++++ variables.nix | 21 ++++++----- 10 files changed, 168 insertions(+), 34 deletions(-) create mode 100644 modules/hardware-configuration/baremetal.nix create mode 100644 modules/platforms/baremetal.nix create mode 100644 secrets/gui.yaml diff --git a/.sops.yaml b/.sops.yaml index b7c1d80..75fd09d 100644 --- a/.sops.yaml +++ b/.sops.yaml @@ -55,3 +55,15 @@ creation_rules: - age: - *admin - *docker + + # gui-host-specific secrets (currently: wifi-password, see + # modules/networking/wifi.nix). Only *lxc-gui has a registered key today + # -- proxmox-gui/linode-gui/baremetal-gui haven't been provisioned via + # scripts/secrets/sync-host-keys.sh yet, so whichever variant is actually + # deployed next needs its recipient added here (and `sops updatekeys` rerun) + # before it can decrypt this. + - path_regex: secrets/gui\.yaml$ + key_groups: + - age: + - *admin + - *lxc-gui diff --git a/CLAUDE.md b/CLAUDE.md index cdc1c79..49c4dc3 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -321,11 +321,14 @@ nixosSystem { } ``` -Platforms: `linode`, `proxmox`, `lxc`. Build types: `minimal`, `nix-cache`, -`server`, `docker`, `gui`, `pxe-boot`, `tailscale-exit-node`, `tor-relay`. Not -every combination is built — e.g. `pxe-boot` has no `linode` variant -(PXE/DHCP/TFTP need LAN L2 adjacency a Linode VPS doesn't have), and -`tor-relay` currently only exists as `lxc-tor-relay`. Treat `flake.nix`'s +Platforms: `linode`, `proxmox`, `lxc`, `baremetal`. Build types: `minimal`, +`nix-cache`, `server`, `docker`, `gui`, `pxe-boot`, `tailscale-exit-node`, +`tor-relay`. Not every combination is built — e.g. `pxe-boot` has no `linode` +variant (PXE/DHCP/TFTP need LAN L2 adjacency a Linode VPS doesn't have), +`tor-relay` currently only exists as `lxc-tor-relay`, and `baremetal` +currently only exists as `baremetal-gui` (the real gui-host hardware — +see `hosts/nixos/host.nix` and `modules/platforms/baremetal.nix`). Treat +`flake.nix`'s `generatedTargets` as the source of truth for which hosts exist — `README.md`, `AGENTS.md`, `docs/flake-lock-automation.md`, and the CI eval workflows @@ -341,12 +344,16 @@ removing a host. of their own beyond narrow parameterized helpers (see `modules/beszel/host-token.nix` below) — all shared behavior comes from the platform/build-type modules composed in `flake.nix`, not from the host file. -- `modules/platforms/{linode,proxmox,lxc}.nix` — platform-specific config: - boot method, guest tooling, and (for linode/proxmox) the hypervisor-specific - hardware config, imported directly by the platform module itself - (`../hardware-configuration/vm/{proxmox,linode}.nix`) — **not** wired in - from `flake.nix`. `lxc.nix` has no hardware-configuration counterpart since - containers share the host kernel; instead it imports nixpkgs' own +- `modules/platforms/{linode,proxmox,lxc,baremetal}.nix` — platform-specific + config: boot method, guest tooling, and the hardware config, imported + directly by the platform module itself — **not** wired in from + `flake.nix`. VM platforms use `../hardware-configuration/vm/{proxmox,linode}.nix`; + `baremetal.nix` uses `../hardware-configuration/baremetal.nix` (adapted + from a real `nixos-generate-config` run on the actual hardware, not a + vm/ file, since it isn't a VM) plus `hardware.enableRedistributableFirmware + = true` for real wifi/GPU/microcode firmware that VMs never needed. + `lxc.nix` has no hardware-configuration counterpart since containers + share the host kernel; instead it imports nixpkgs' own `virtualisation/proxmox-lxc.nix`, which gives every `lxc-*` host a `config.system.build.tarball` output — a plain rootfs tarball, used as a `pct create ... vztmpl` CT template (**not** `pct restore`, which expects @@ -370,6 +377,16 @@ removing a host. boots, so this declares them with `destroy = false` (disko never wipes them) and a bare `filesystem`/`swap` content type instead of a partition table — idempotent against an already-provisioned disk, never destructive. +- `modules/disko/baremetal.nix` — `baremetal-gui`'s disko config: a ZFS + RAID0 (striped, no redundancy — disko's zpool `mode` defaults to `""`, + which is a plain stripe rather than `"mirror"`/`"raidz"`) root pool + across two disks, ESP + systemd-boot on the first. Device paths + (`vars.guiRootDisk1`/`guiRootDisk2`) are placeholders — fill in stable + `/dev/disk/by-id/...` paths before running disko for real. + `modules/platforms/baremetal.nix` also imports + `modules/services/zfs/enable-service.nix` for this (the `zfs_unstable` + package, autoScrub/autoSnapshot/trim) — the only other importer today is + `server`'s NFS data pool, an unrelated non-root ZFS use. - `modules/boot/efi.nix` — systemd-boot + EFI vars, paired with the disko module. - `modules/installer/` — the auto-installer environment (ISO, also served as PXE netboot): `common.nix` (shared config + the generated diff --git a/README.md b/README.md index 8747b0e..9b5cf18 100644 --- a/README.md +++ b/README.md @@ -8,13 +8,15 @@ workstation. Targets are named `-`, generated from two orthogonal pieces composed in `flake.nix`: -- **Platforms** (what it runs on): `linode`, `proxmox`, `lxc` +- **Platforms** (what it runs on): `linode`, `proxmox`, `lxc`, `baremetal` - **Build types** (what it's for): `minimal`, `nix-cache`, `server`, `docker`, `gui`, `pxe-boot`, `tailscale-exit-node`, `tor-relay` Not every combination exists — `pxe-boot` has no `linode` variant, since -PXE/DHCP/TFTP need LAN L2 adjacency that a Linode VPS doesn't have, and -`tor-relay` currently only exists as `lxc-tor-relay`. The full list: +PXE/DHCP/TFTP need LAN L2 adjacency that a Linode VPS doesn't have, +`tor-relay` currently only exists as `lxc-tor-relay`, and `baremetal` +currently only exists as `baremetal-gui` (the real gui-host hardware). The +full list: | Target | Purpose | | --- | --- | @@ -25,6 +27,7 @@ PXE/DHCP/TFTP need LAN L2 adjacency that a Linode VPS doesn't have, and | `linode-server` / `proxmox-server` / `lxc-server` | Storage, NFS, backup, and monitoring exporter host — previously the flat `server` target | | `linode-docker` / `proxmox-docker` / `lxc-docker` | Docker host for the main container stack — previously the flat `docker` target | | `linode-gui` / `proxmox-gui` / `lxc-gui` | Cinnamon desktop workstation — previously the flat `nixos` target | +| `baremetal-gui` | Same Cinnamon desktop workstation, on the real gui-host hardware — ZFS RAID0 root, systemd-boot | | `proxmox-pxe-boot` / `lxc-pxe-boot` | HTTP/iPXE boot asset host — previously the flat `pxe-boot` target | | `linode-tailscale-exit-node` / `proxmox-tailscale-exit-node` / `lxc-tailscale-exit-node` | Tailscale exit node | | `lxc-tor-relay` | Tor middle relay | @@ -64,7 +67,7 @@ nix eval --json .#nixosConfigurations --apply builtins.attrNames | jq -r '.[]' | `variables.nix` | Single source of truth for shared values (LAN domain/CIDR, hostnames, timezone, primary username, storage root, NFS share subpaths/mountpoints, service ports, ...) — passed to every module and Home Manager config as the `vars` argument via `specialArgs`/`extraSpecialArgs` | | `hosts//host.nix` | Per-machine identity: hostname, hostId, per-machine secrets, `system.stateVersion` | | `hosts/nixos/home.nix` | Workstation-specific Home Manager config (used by the `gui` build type) | -| `modules/platforms/` | Platform-specific config: virtualisation guest tools, boot method, hardware config (`linode.nix`, `proxmox.nix`, `lxc.nix`) | +| `modules/platforms/` | Platform-specific config: virtualisation guest tools, boot method, hardware config (`linode.nix`, `proxmox.nix`, `lxc.nix`, `baremetal.nix`) | | `modules/build-types/` | Build-type-specific config: what makes a system minimal/server/docker/gui/pxe-boot/nix-cache | | `modules/common/` | Shared NixOS config, Home Manager, aliases imported by every host | | `modules/nix-cache/` | Binary cache and remote builder client/server modules | diff --git a/flake.nix b/flake.nix index 85a9a9c..0e13b20 100644 --- a/flake.nix +++ b/flake.nix @@ -91,6 +91,7 @@ linode-gui = mkTarget { platform = "linode"; buildType = "gui"; hostPath = ./hosts/nixos/host.nix; homeFile = ./hosts/nixos/home.nix; }; proxmox-gui = mkTarget { platform = "proxmox"; buildType = "gui"; hostPath = ./hosts/nixos/host.nix; homeFile = ./hosts/nixos/home.nix; }; lxc-gui = mkTarget { platform = "lxc"; buildType = "gui"; hostPath = ./hosts/nixos/host.nix; homeFile = ./hosts/nixos/home.nix; }; + baremetal-gui = mkTarget { platform = "baremetal"; buildType = "gui"; hostPath = ./hosts/nixos/host.nix; homeFile = ./hosts/nixos/home.nix; }; proxmox-pxe-boot = mkTarget { platform = "proxmox"; buildType = "pxe-boot"; hostPath = ./hosts/pxe-boot/host.nix; }; lxc-pxe-boot = mkTarget { platform = "lxc"; buildType = "pxe-boot"; hostPath = ./hosts/pxe-boot/host.nix; }; diff --git a/hosts/nixos/host.nix b/hosts/nixos/host.nix index a1d7ffb..ff5a512 100644 --- a/hosts/nixos/host.nix +++ b/hosts/nixos/host.nix @@ -7,6 +7,11 @@ _: networking.hostName = "nixos"; + # Only needed now that baremetal-gui exists (ZFS root) -- harmless on the + # ext4-rooted linode/proxmox/lxc-gui variants, so set unconditionally + # rather than only on the baremetal platform. + networking.hostId = "de6a9ffc"; + # Preserved from the pre-refactor `nixos` target — stateVersion must never # be bumped on an already-installed machine. system.stateVersion = "25.05"; diff --git a/modules/hardware-configuration/baremetal.nix b/modules/hardware-configuration/baremetal.nix new file mode 100644 index 0000000..a8c5a65 --- /dev/null +++ b/modules/hardware-configuration/baremetal.nix @@ -0,0 +1,23 @@ +# Adapted from the output of `nixos-generate-config`, run from a live GUI +# ISO boot on the actual gui-host hardware (AMD CPU). fileSystems and +# swapDevices are deliberately omitted -- the live ISO had no formatted +# disks to detect, and disko (modules/disko/baremetal.nix) generates both +# from the declarative zpool layout anyway. +{ config, lib, pkgs, modulesPath, ... }: + +{ + imports = + [ + (modulesPath + "/installer/scan/not-detected.nix") + ]; + + boot = { + initrd.availableKernelModules = [ "xhci_pci" "ahci" "usbhid" "usb_storage" "sd_mod" ]; + initrd.kernelModules = [ ]; + kernelModules = [ "kvm-amd" ]; + extraModulePackages = [ ]; + }; + + nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux"; + hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware; +} diff --git a/modules/networking/wifi.nix b/modules/networking/wifi.nix index 2765d0c..7b340ee 100644 --- a/modules/networking/wifi.nix +++ b/modules/networking/wifi.nix @@ -1,14 +1,31 @@ -{ lib, vars, ... }: +{ config, lib, vars, ... }: { - # Prestages a NetworkManager connection profile for vars.wifiSsid/ - # wifiPassword so the host associates on first boot with no manual - # nmtui/nmcli step. Guarded on a non-empty SSID so leaving the - # placeholders blank in variables.nix is a no-op rather than an empty, - # broken profile — fill both in once the bare-metal hardware profile is - # wired up. - networking.networkmanager.ensureProfiles.profiles = lib.mkIf (vars.wifiSsid != "") { - ${vars.wifiSsid} = { + # Prestages a NetworkManager connection profile for vars.wifiSsid so the + # host associates on first boot with no manual nmtui/nmcli step. Guarded + # on a non-empty SSID so leaving the placeholder blank in variables.nix + # is a no-op rather than an empty, broken profile — fill it in once the + # network is known. + # + # The password itself lives in secrets/gui.yaml, not variables.nix -- + # NetworkManager's ensureProfiles renders `psk = "$WIFI_PASSWORD"` + # literally into the store (see nixpkgs' own ensureProfiles example, + # which does the same for exactly this reason) and its systemd service + # envsubst-expands it from environmentFiles at activation time, so the + # real value only ever touches /run (root-only, UMask 0177), never the + # Nix store. + sops.secrets."wifi-password" = lib.mkIf (vars.wifiSsid != "") { + sopsFile = ../../secrets/gui.yaml; + }; + + sops.templates."wifi-password.env" = lib.mkIf (vars.wifiSsid != "") { + content = "WIFI_PASSWORD=${config.sops.placeholder."wifi-password"}"; + }; + + networking.networkmanager.ensureProfiles = lib.mkIf (vars.wifiSsid != "") { + environmentFiles = [ config.sops.templates."wifi-password.env".path ]; + + profiles.${vars.wifiSsid} = { connection = { id = vars.wifiSsid; type = "wifi"; @@ -19,7 +36,7 @@ }; wifi-security = { key-mgmt = "wpa-psk"; - psk = vars.wifiPassword; + psk = "$WIFI_PASSWORD"; }; }; }; diff --git a/modules/platforms/baremetal.nix b/modules/platforms/baremetal.nix new file mode 100644 index 0000000..081609c --- /dev/null +++ b/modules/platforms/baremetal.nix @@ -0,0 +1,28 @@ +{ ... }: + +{ + imports = [ + ../hardware-configuration/baremetal.nix + ../boot/efi.nix + ../disko/baremetal.nix + ../services/zfs/enable-service.nix + ]; + + # Needed for real wifi/bluetooth/GPU firmware blobs and CPU microcode + # updates (hardware-configuration/baremetal.nix's amd.updateMicrocode + # keys off this) -- irrelevant on the linode/proxmox/lxc platforms, + # which are all VMs with no real hardware to load firmware for. + hardware.enableRedistributableFirmware = true; + + # AMD GPU: the amdgpu kernel driver autoloads from the PCI ID with no + # extra boot.kernelModules entry needed; this is the userspace half -- + # the dedicated Xorg driver (not just the generic modesetting fallback) + # plus Mesa OpenGL/Vulkan (amdgpu/RADV), same firmware blobs as above. + # 32-bit support is for compatibility with 32-bit apps/games. + services.xserver.videoDrivers = [ "amdgpu" ]; + + hardware.graphics = { + enable = true; + enable32Bit = true; + }; +} diff --git a/secrets/gui.yaml b/secrets/gui.yaml new file mode 100644 index 0000000..c80784c --- /dev/null +++ b/secrets/gui.yaml @@ -0,0 +1,25 @@ +wifi-password: ENC[AES256_GCM,data:SZQPtU6PYHbf9o83wq3KTupx,iv:FxO68Pn/+N58r/OPLfkAMYPFpP8TYxszMniFd/01E38=,tag:jwxaY6zDEcO5r9OWSfvUyw==,type:str] +sops: + age: + - enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBVR0dXaC9VS2JxUWZ5RXUw + NnRVZ1FxbENwRXM1bFFJRVNQR1Q5amt3S20wCmxPdXFrcVhWeEtVcUIrc0twT1dw + VzhRQ2dpWFkvc2w1QWc4dG1MV2tualkKLS0tIG9Ka2ZWbHUvd2xRd3JoN0U4WU0r + YlRMeTcvZmhjMnZ3NTJZTkdvSWd2UGMKkrsWAtkLOlq6SQ/qSnndNtZY78clcUm1 + rHv9Qm0LYNegMbcqJOGdfHmafy2jWL4yO2VCeDeeaqf7PtcuIyXnMw== + -----END AGE ENCRYPTED FILE----- + recipient: age1njap586hc0q43kr03g6c8eqhdsmk8zcafkl3f83xwlc2gqhlmfgs4tmwad + - enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBXOS9vUGV4RjhndEp1WkhC + RHBLNmJ1YWZFRnIrbnZBeVVobU8vVmdqZ0dNCk5jUmVEMUFya2gxSzlqeHVQSlhR + SFdTUEhZMGFWeHpTbzhTS0trTVgwYWsKLS0tIEIyNmFGM0dwM0NyTlAzREFwNjNP + bTlIN3ZVQ0VzS3JuUVRBRUtrUzFwUzQKnI1RrVsCSOSo51IWygOrJeVokhPtEawj + ZIqbVU8IqbLRCcBvIjldDCvDpIsdfOf42HPagY7xHdjkylirx6Z6Jw== + -----END AGE ENCRYPTED FILE----- + recipient: age190htw7prp4vln076dxjx3gxxaq06h0zl0te7cqgpx79vl3lhkaes8suy05 + lastmodified: "2026-07-22T01:15:21Z" + mac: ENC[AES256_GCM,data:dC/oIqMUHkOh3AocOwP7Gc6XGH3L+nTqJfhFNts1DNbRXsopNIxVBtIz2pEhwnWSQrqPisDLmPHFBwRpGVn01u8w8IU1FKbAKC0J2nJXF8ozpInbjzDOmehqPWZG7yaKoq8cwAnp5XOk+IVO4l6tPxLxkExU5fT2ALuMq+sgOko=,iv:jaVyArpf6zMCFa6J9X1aQMGrmFq+W2CPZdWO6vVW68c=,tag:S+qF8/FkgHc4uW0e4ICmSQ==,type:str] + unencrypted_suffix: _unencrypted + version: 3.13.2 diff --git a/variables.nix b/variables.nix index db37d20..61f2085 100644 --- a/variables.nix +++ b/variables.nix @@ -45,18 +45,21 @@ # the installer image's nixos/root users. adminSshKey = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCq/Q5LvIXlZwO2kdeAN5nLGZ59nZB7JHYMEszHxmNtGMzv1lM31jiPNsr0z2EKVZhE7OOfa2IF9rhWYD7JUA9G0yzdZ4WTXFNGVVOJoOVH6vAF3XCxoVilOEwTc7h2Wiy+rzd0B28/3spffzQQWJhY6GRQVa8j+6xAGF60Fcvl1vLosYT9Bn2ZbK4TCWOwAn2jqXIieGpZdn/UNZbGOeKRiCvhktDfMAzuQzN/9jMu/oF4pkPn2X1UrsQdNlvp0Ci8md612MozIpncQJyAF1ADhunr3sMx0isUXiqD29R5DS4TftpekqLNLak+zcxFa8N7DcRNp3DcKfJvyTkwQrR4r+b7lFLYOLHLagSso9CzeW/paAS2q9I5SBm/2DtE1diLLg2jZikYcstsu/G5RgvbzbKqjiaMwTdXC3AMvDxQrs7U5pDRZFzoofG3cpODbTm+uy3m0kP70z0M1K45UbDG0p+itnTu9x40JbQEgefbx38AItNvAIx1A8HO4I1VX28= wayne@stream"; - # Prestaged wifi credentials for the gui host's NetworkManager profile - # (modules/networking/wifi.nix). Leave blank until the bare-metal - # hardware profile is wired up — an empty ssid disables the profile - # rather than creating a broken empty one. + # Prestaged wifi SSID for the gui host's NetworkManager profile + # (modules/networking/wifi.nix). Leave blank until the network is known + # — an empty ssid disables the profile rather than creating a broken + # empty one. The password is not here -- it's sops-encrypted in + # secrets/gui.yaml (wifi-password) instead, since this file isn't a + # secret store. wifiSsid = ""; - wifiPassword = ""; # Bare-metal gui host's two disks for a ZFS RAID0 (striped) root pool - # (modules/disko/baremetal.nix). Use stable /dev/disk/by-id/... paths, - # not /dev/sdX -- fill in once the hardware profile is available. - guiRootDisk1 = ""; - guiRootDisk2 = ""; + # (modules/disko/baremetal.nix). Only used transiently at disko-format + # time (partitioning); the resulting fileSystems/zpool import reference + # by-partlabel/by-id paths afterward regardless, same as + # modules/disko/proxmox.nix's own plain "/dev/sda". + guiRootDisk1 = "/dev/sda"; + guiRootDisk2 = "/dev/sdb"; # System timeZone = "Australia/Brisbane"; -- 2.54.0