Archived
beatzaplentyandClaude Sonnet 4.6
a63e1c70c3
Replaces the gitignored host-keys/ directory with clan vars as the authoritative storage for SSH host keys. Keys are now generated as sops-binary-encrypted clan var files (admin-key only) and checked into vars/per-machine/<target>/openssh/, eliminating the plaintext private key that previously had to live outside the repo. Changes: - modules/clan/ssh-host-key.nix: clan vars generator for the ed25519 SSH host key pair (neededFor="activation" — not mapped to sops.secrets, delivered via tarball baking for LXC or --pre-format-files for VMs) - flake.nix: add clanCore module + required settings to every mkTarget; deduplicate bundled disko/sops-nix via follows; all 27 hosts eval clean - flake.lock: updated to reflect the new follows constraints - scripts/lib/clan-vars.sh: new helper library with clan_ssh_key_exists / clan_ssh_pubkey_path / clan_decrypt_ssh_key / clan_generate_ssh_key for use by the provisioning and sync scripts - scripts/secrets/sync-host-keys.sh: queue_host_sync() now checks clan vars first; generates via clan_generate_ssh_key if no key exists; derives age fingerprint from clan pub key for .sops.yaml registration - scripts/proxmox/create-proxmox-resource.sh: key management simplified (sync-host-keys.sh now generates the key if missing, so the inline prepare-host-key.sh call is gone); sync_remote_host_keys() decrypts the clan key into a temp dir and scps just the two files to the node when a clan key exists, falling back to the old host-keys/ scp for any remaining legacy entries Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01B2EJ4qTsM5KUqhS5c3GAwx
240 lines
12 KiB
Nix
240 lines
12 KiB
Nix
{
|
|
description = "LAN NixOS configs";
|
|
|
|
inputs = {
|
|
nixpkgs.url = "github:NixOS/nixpkgs/nixos-26.05";
|
|
nixos-conf-editor.url = "github:snowfallorg/nixos-conf-editor";
|
|
home-manager = {
|
|
url = "github:nix-community/home-manager/release-26.05";
|
|
inputs.nixpkgs.follows = "nixpkgs";
|
|
};
|
|
disko = {
|
|
url = "github:nix-community/disko";
|
|
inputs.nixpkgs.follows = "nixpkgs";
|
|
};
|
|
sops-nix = {
|
|
url = "github:Mic92/sops-nix";
|
|
inputs.nixpkgs.follows = "nixpkgs";
|
|
};
|
|
clan-core = {
|
|
url = "https://git.clan.lol/clan/clan-core/archive/26.05.tar.gz";
|
|
# Deduplicate modules: clan-core bundles its own disko and sops-nix
|
|
# (both imported by nixosModules.clanCore). Without follows, we'd get
|
|
# two different versions of each, and disko's _module.args.diskoLib
|
|
# unique option would conflict. With follows, clan-core uses the same
|
|
# store paths as us, so NixOS deduplicates the imports.
|
|
inputs = {
|
|
nixpkgs.follows = "nixpkgs";
|
|
disko.follows = "disko";
|
|
sops-nix.follows = "sops-nix";
|
|
};
|
|
};
|
|
};
|
|
|
|
outputs = { self, nixpkgs, nixos-conf-editor, home-manager, sops-nix, ... } @ inputs:
|
|
|
|
let
|
|
system = "x86_64-linux";
|
|
inherit (nixpkgs) lib;
|
|
pkgs = nixpkgs.legacyPackages.${system};
|
|
vars = import ./variables.nix;
|
|
|
|
# Generates a nixosConfiguration from a platform (what it runs on) and
|
|
# a build type (what it's for), plus the per-identity host.nix that
|
|
# carries the bits that must stay fixed regardless of platform
|
|
# (hostName, hostId, per-machine secrets). Every build type except
|
|
# nix-cache itself consumes the nix-cache substituter and remote
|
|
# builder.
|
|
mkTarget = { platform, buildType, hostPath, homeFile ? ./modules/common/home.nix }:
|
|
let
|
|
flakeTarget = "${platform}-${buildType}";
|
|
in
|
|
nixpkgs.lib.nixosSystem {
|
|
inherit system;
|
|
modules = [
|
|
inputs.disko.nixosModules.disko
|
|
sops-nix.nixosModules.sops
|
|
inputs.clan-core.nixosModules.clanCore
|
|
{
|
|
# Required clan settings. directory is the flake root (where
|
|
# vars/ and sops/ directories live); machine.name is the flake
|
|
# target name (matches what clan vars generate uses as the key
|
|
# under vars/per-machine/). enableRecommendedDefaults = false
|
|
# is mandatory: without it, clan unconditionally enables
|
|
# networking.useNetworkd, adds packages, and tweaks nix settings
|
|
# -- none of which belong here.
|
|
clan.core = {
|
|
settings.directory = self;
|
|
settings.machine.name = flakeTarget;
|
|
enableRecommendedDefaults = false;
|
|
};
|
|
}
|
|
./modules/clan/ssh-host-key.nix
|
|
./modules/common/configuration.nix
|
|
./modules/platforms/${platform}.nix
|
|
./modules/build-types/${buildType}.nix
|
|
hostPath
|
|
{ environment.etc."flake-target".text = flakeTarget; }
|
|
home-manager.nixosModules.home-manager
|
|
{
|
|
home-manager = {
|
|
useGlobalPkgs = true;
|
|
useUserPackages = true;
|
|
extraSpecialArgs = { inherit vars; };
|
|
users.nixos = import homeFile;
|
|
};
|
|
}
|
|
] ++ lib.optionals (buildType != "nix-cache") [
|
|
./modules/nix-cache/client.nix
|
|
./modules/nix-cache/remote-builder-client.nix
|
|
];
|
|
# flakeTarget is passed via specialArgs (not read back from
|
|
# config.environment.etc."flake-target" above) specifically so
|
|
# modules/platforms/lxc.nix can use it to select its own host key
|
|
# file without a same-option circular dependency (a module
|
|
# contributing to environment.etc can't read the merged
|
|
# environment.etc it's itself contributing to).
|
|
specialArgs = { inherit inputs vars netbootSystem netbootMinimalSystem flakeTarget; };
|
|
};
|
|
|
|
# Generated platform x build-type matrix. pxe-boot has no linode
|
|
# variant (PXE/DHCP/TFTP need LAN L2 adjacency, which a Linode VPS
|
|
# doesn't have).
|
|
generatedTargets = {
|
|
linode-minimal = mkTarget { platform = "linode"; buildType = "minimal"; hostPath = ./hosts/nix-minimal/host.nix; };
|
|
proxmox-minimal = mkTarget { platform = "proxmox"; buildType = "minimal"; hostPath = ./hosts/nix-minimal/host.nix; };
|
|
lxc-minimal = mkTarget { platform = "lxc"; buildType = "minimal"; hostPath = ./hosts/nix-minimal/host.nix; };
|
|
|
|
linode-nix-cache = mkTarget { platform = "linode"; buildType = "nix-cache"; hostPath = ./hosts/nix-cache/host.nix; };
|
|
proxmox-nix-cache = mkTarget { platform = "proxmox"; buildType = "nix-cache"; hostPath = ./hosts/nix-cache/host.nix; };
|
|
lxc-nix-cache = mkTarget { platform = "lxc"; buildType = "nix-cache"; hostPath = ./hosts/nix-cache/host.nix; };
|
|
|
|
linode-server = mkTarget { platform = "linode"; buildType = "server"; hostPath = ./hosts/server/host.nix; };
|
|
proxmox-server = mkTarget { platform = "proxmox"; buildType = "server"; hostPath = ./hosts/server/host.nix; };
|
|
lxc-server = mkTarget { platform = "lxc"; buildType = "server"; hostPath = ./hosts/server/host.nix; };
|
|
|
|
linode-docker = mkTarget { platform = "linode"; buildType = "docker"; hostPath = ./hosts/docker/host.nix; };
|
|
proxmox-docker = mkTarget { platform = "proxmox"; buildType = "docker"; hostPath = ./hosts/docker/host.nix; };
|
|
lxc-docker = mkTarget { platform = "lxc"; buildType = "docker"; hostPath = ./hosts/docker/host.nix; };
|
|
|
|
linode-gui = mkTarget { platform = "linode"; buildType = "gui"; hostPath = ./hosts/nixos/host.nix; homeFile = ./hosts/nixos/home.nix; };
|
|
proxmox-gui = mkTarget { platform = "proxmox"; buildType = "gui"; hostPath = ./hosts/nixos/host.nix; homeFile = ./hosts/nixos/home.nix; };
|
|
lxc-gui = mkTarget { platform = "lxc"; buildType = "gui"; hostPath = ./hosts/nixos/host.nix; homeFile = ./hosts/nixos/home.nix; };
|
|
baremetal-gui = mkTarget { platform = "baremetal"; buildType = "gui"; hostPath = ./hosts/nixos/host.nix; homeFile = ./hosts/nixos/home.nix; };
|
|
|
|
proxmox-pxe-boot = mkTarget { platform = "proxmox"; buildType = "pxe-boot"; hostPath = ./hosts/pxe-boot/host.nix; };
|
|
lxc-pxe-boot = mkTarget { platform = "lxc"; buildType = "pxe-boot"; hostPath = ./hosts/pxe-boot/host.nix; };
|
|
|
|
linode-tailscale-router = mkTarget { platform = "linode"; buildType = "tailscale-router"; hostPath = ./hosts/tailscale-router/host.nix; };
|
|
proxmox-tailscale-router = mkTarget { platform = "proxmox"; buildType = "tailscale-router"; hostPath = ./hosts/tailscale-router/host.nix; };
|
|
lxc-tailscale-router = mkTarget { platform = "lxc"; buildType = "tailscale-router"; hostPath = ./hosts/tailscale-router/host.nix; };
|
|
|
|
lxc-tor-relay = mkTarget { platform = "lxc"; buildType = "tor-relay"; hostPath = ./hosts/tor-relay/host.nix; };
|
|
};
|
|
|
|
# Auto-install environments (migrated from the former nix-auto-installer
|
|
# flake): a self-contained NixOS installer that boots, discovers this
|
|
# flake's own nixosConfigurations over the network, and runs
|
|
# nixos-install against whichever one the operator picks. These are
|
|
# deliberately not part of the platform x build-type matrix above —
|
|
# they're throwaway boot media, not persistent hosts, so they skip
|
|
# disko/sops-nix/home-manager and just need `vars`.
|
|
installerTargets = {
|
|
installer = nixpkgs.lib.nixosSystem {
|
|
inherit system;
|
|
modules = [ ./modules/installer/iso.nix ];
|
|
specialArgs = { inherit vars; };
|
|
};
|
|
};
|
|
|
|
# Same installer environment, built as netboot (kernel + initrd +
|
|
# iPXE script) instead of an ISO — this is what packages.pxe bundles.
|
|
#
|
|
# Deliberately imports common.nix directly, NOT ./modules/installer/iso.nix
|
|
# (which pulls in nixpkgs' installation-cd-minimal.nix) -- confirmed live
|
|
# that composing the ISO module together with netboot-minimal.nix hangs
|
|
# every boot waiting for a device that can never exist on a netboot
|
|
# client ("A start job is running for /dev/disk/by-label/nixos-minimal-...").
|
|
# Both installation-cd-base.nix and netboot.nix set fileSystems."/" via
|
|
# the identical lib.mkImageMediaOverride (mkOverride 60) priority --
|
|
# genuinely conflicting root-filesystem strategies (ISO-by-label vs.
|
|
# netboot-tmpfs) at the same priority, and the ISO one was winning.
|
|
# netboot-minimal.nix's own chain (netboot-base.nix) already imports
|
|
# profiles/installation-device.nix independently, so common.nix's
|
|
# initialHashedPassword override (which assumes that profile is
|
|
# present) still applies correctly without iso.nix in the mix.
|
|
#
|
|
# networking.hostName is set explicitly (rather than left at nixpkgs'
|
|
# own "nixos" default) so this image's generated system name
|
|
# (nixos-system-auto-installer-*) matches its iPXE menu entry —
|
|
# see modules/build-types/pxe-boot.nix's :auto-installer item — and
|
|
# its staged directory, /srv/pxe/http/auto-installer.
|
|
netbootSystem = nixpkgs.lib.nixosSystem {
|
|
inherit system;
|
|
modules = [
|
|
./modules/installer/common.nix
|
|
({ modulesPath, ... }: {
|
|
imports = [
|
|
(modulesPath + "/installer/netboot/netboot-minimal.nix")
|
|
];
|
|
})
|
|
{ networking.hostName = "auto-installer"; }
|
|
];
|
|
specialArgs = { inherit vars; };
|
|
};
|
|
|
|
# A genuinely vanilla NixOS minimal netboot image: nixpkgs'
|
|
# netboot-minimal.nix on its own, with none of this flake's
|
|
# auto-installer wiring (no common.nix — no auto-install.sh, no
|
|
# baked host keys, no custom users/passwords). Built from source via
|
|
# the same nixosSystem + netboot-minimal.nix path as netbootSystem
|
|
# above, so both go through an identical build mechanism; the only
|
|
# difference is what's composed in. hostName again matches this
|
|
# image's iPXE menu entry (:nixos-minimal) and staged directory
|
|
# (/srv/pxe/http/nixos-minimal).
|
|
netbootMinimalSystem = nixpkgs.lib.nixosSystem {
|
|
inherit system;
|
|
modules = [
|
|
({ modulesPath, ... }: {
|
|
imports = [
|
|
(modulesPath + "/installer/netboot/netboot-minimal.nix")
|
|
];
|
|
})
|
|
{ networking.hostName = "nixos-minimal"; }
|
|
];
|
|
};
|
|
|
|
in
|
|
{
|
|
|
|
nixosConfigurations = generatedTargets // installerTargets;
|
|
|
|
# Buildable auto-installer artifacts (`nix build .#<name>`). No `lxc`
|
|
# variant (installer-boots-as-an-LXC-container) or `all` bundle
|
|
# anymore — lxc-* and proxmox-* hosts deploy via their own tarball/
|
|
# disk-image outputs instead (see docs/auto-installer.md and
|
|
# docs/proxmox-images.md), which left the installer's own LXC form
|
|
# with no real use case: it's excluded from the install menu (same
|
|
# bind-mount problem as any LXC nixos-install target) and nothing
|
|
# else needed booting the installer itself as a container.
|
|
packages.${system} = {
|
|
iso = installerTargets.installer.config.system.build.isoImage;
|
|
|
|
pxe = pkgs.linkFarm "pxe" [
|
|
{ name = "netboot.ipxe"; path = netbootSystem.config.system.build.netbootIpxeScript; }
|
|
{ name = "initrd"; path = netbootSystem.config.system.build.netbootRamdisk; }
|
|
{ name = "kernel"; path = netbootSystem.config.system.build.kernel; }
|
|
];
|
|
|
|
# Vanilla NixOS minimal netboot bundle — see netbootMinimalSystem
|
|
# above. Staged onto the pxe-boot host alongside packages.pxe by
|
|
# modules/pxe-boot/stage-installer-artifacts.nix.
|
|
pxe-minimal = pkgs.linkFarm "pxe-minimal" [
|
|
{ name = "netboot.ipxe"; path = netbootMinimalSystem.config.system.build.netbootIpxeScript; }
|
|
{ name = "initrd"; path = netbootMinimalSystem.config.system.build.netbootRamdisk; }
|
|
{ name = "kernel"; path = netbootMinimalSystem.config.system.build.kernel; }
|
|
];
|
|
};
|
|
};
|
|
}
|