Archived
beatzaplenty
96cc63671a
Check NixOS configurations / eval-hosts (pull_request) Successful in 10m40s
Wires everything staged so far into a real flake target: - modules/platforms/baremetal.nix (new): the bare-metal platform module, composed from a real nixos-generate-config run on the actual gui-host hardware (AMD CPU, ahci/xhci/usb storage -- modules/hardware-configuration/baremetal.nix). Enables hardware.enableRedistributableFirmware (real wifi/GPU/microcode firmware VMs never needed), amdgpu as the Xorg video driver plus hardware.graphics for Mesa OpenGL/Vulkan, and imports the ZFS RAID0 disko layout + modules/services/zfs/enable-service.nix for root-on-ZFS boot support. - flake.nix: new baremetal-gui target, reusing hosts/nixos/host.nix (same identity already shared across linode/proxmox/lxc-gui). - hosts/nixos/host.nix: added networking.hostId, required now that a ZFS root pool is in the picture. - variables.nix: guiRootDisk1/guiRootDisk2 filled in (/dev/sda, /dev/sdb -- only used transiently at disko-format time, same as modules/disko/proxmox.nix's own plain device path). wifiPassword removed. - modules/networking/wifi.nix: reworked to pull the wifi password from a new sops secret (secrets/gui.yaml, wifi-password) instead of a plaintext variable -- NetworkManager's ensureProfiles renders `psk = "$WIFI_PASSWORD"` literally (nixpkgs' own documented pattern for this) and envsubst-expands it from a sops-rendered EnvironmentFile at activation, so the real value never touches the Nix store, only /run. - .sops.yaml: new secrets/gui\.yaml rule, admin + the currently-registered lxc-gui recipient (the only gui variant with a provisioned host key so far -- whichever variant is actually deployed next still needs scripts/secrets/sync-host-keys.sh run for its own recipient). - README.md/CLAUDE.md: documented the new platform/target and its module layout, per this repo's own drift-prevention note. Verified end-to-end: nix eval of every existing target (nothing broke), a temporary real nixosSystem build against the actual disko.nixosModules.disko confirming the generated zpool create has no mirror/raidz keyword (genuine stripe), and a temporary test SSID confirming the sops secret/template/ ensureProfiles chain renders correctly before reverting to blank/real values. Full scripts/codex-maintenance.sh (secret-grep, fmt, statix, full-fallback eval of every host/package) passes clean.
44 lines
1.5 KiB
Nix
44 lines
1.5 KiB
Nix
{ config, lib, vars, ... }:
|
|
|
|
{
|
|
# Prestages a NetworkManager connection profile for vars.wifiSsid so the
|
|
# host associates on first boot with no manual nmtui/nmcli step. Guarded
|
|
# on a non-empty SSID so leaving the placeholder blank in variables.nix
|
|
# is a no-op rather than an empty, broken profile — fill it in once the
|
|
# network is known.
|
|
#
|
|
# The password itself lives in secrets/gui.yaml, not variables.nix --
|
|
# NetworkManager's ensureProfiles renders `psk = "$WIFI_PASSWORD"`
|
|
# literally into the store (see nixpkgs' own ensureProfiles example,
|
|
# which does the same for exactly this reason) and its systemd service
|
|
# envsubst-expands it from environmentFiles at activation time, so the
|
|
# real value only ever touches /run (root-only, UMask 0177), never the
|
|
# Nix store.
|
|
sops.secrets."wifi-password" = lib.mkIf (vars.wifiSsid != "") {
|
|
sopsFile = ../../secrets/gui.yaml;
|
|
};
|
|
|
|
sops.templates."wifi-password.env" = lib.mkIf (vars.wifiSsid != "") {
|
|
content = "WIFI_PASSWORD=${config.sops.placeholder."wifi-password"}";
|
|
};
|
|
|
|
networking.networkmanager.ensureProfiles = lib.mkIf (vars.wifiSsid != "") {
|
|
environmentFiles = [ config.sops.templates."wifi-password.env".path ];
|
|
|
|
profiles.${vars.wifiSsid} = {
|
|
connection = {
|
|
id = vars.wifiSsid;
|
|
type = "wifi";
|
|
};
|
|
wifi = {
|
|
mode = "infrastructure";
|
|
ssid = vars.wifiSsid;
|
|
};
|
|
wifi-security = {
|
|
key-mgmt = "wpa-psk";
|
|
psk = "$WIFI_PASSWORD";
|
|
};
|
|
};
|
|
};
|
|
}
|