Archived
beatzaplentyandClaude Sonnet 4.6
2f829ba3e7
Check NixOS configurations / eval-hosts (pull_request) Failing after 9m48s
modules/ipa/client.nix is now a self-contained NixOS module (no longer a parameterized function): it checks builtins.pathExists for secrets/<hostname>.keytab at eval time and enables itself automatically if found, making it a no-op for hosts without a keytab. modules/common/configuration.nix imports it so every host in the flake is a candidate for IPA enrollment — no per-host wiring needed. Adding a keytab (via scripts/ipa/create-nixos-ipa-host-account.sh) is now the only step required to enroll a host. The module also sets networking.domain and networking.nameservers via mkDefault when active, so new hosts don't need those set explicitly. Also: - Remove explicit IPA imports from hosts/nix-cache and hosts/tailscale-router - Add secrets/pxe-boot.keytab + creation rule; remove incorrect secrets/nixos.sweet.home.keytab and its creation rule - Add .sops.yaml creation rules for all remaining host keytabs (server, docker, tor-relay, nix-minimal, nixos) so the creation script can target them without manual .sops.yaml edits - Fix duplicate tailscale-router.keytab rule and corrupted gui.yaml comment block in .sops.yaml Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
116 lines
3.5 KiB
Nix
116 lines
3.5 KiB
Nix
{ config, lib, pkgs, vars, ... }:
|
||
|
||
{
|
||
imports =
|
||
[
|
||
# Include the results of the hardware scan.
|
||
# ./hardware-configuration.nix
|
||
./set-locale.nix
|
||
../ipa/client.nix
|
||
];
|
||
# Use the GRUB 2 boot loader.
|
||
# boot.loader.grub.enable = true;
|
||
#boot.loader.grub.device = "/dev/sda"; # or "nodev" for efi only
|
||
|
||
networking.networkmanager.enable = true; # Easiest to use and most distros use this by default.
|
||
|
||
# Recommended over the true default (bypasses ZFS's own import safeguards)
|
||
# per the option's own docs; matches hosts/docker/host.nix and
|
||
# modules/services/zfs/enable-service.nix, which already set this
|
||
# explicitly. Harmless no-op on hosts that don't use ZFS at all.
|
||
boot.zfs.forceImportRoot = false;
|
||
|
||
# Set your time zone.
|
||
time.timeZone = vars.timeZone;
|
||
|
||
# Enable QEMU agent
|
||
services.qemuGuest.enable = true;
|
||
|
||
# Enable docker-compose
|
||
environment.systemPackages = with pkgs; [
|
||
vim
|
||
btop
|
||
git
|
||
gcr
|
||
jq
|
||
];
|
||
|
||
# Secrets shared by every host, decrypted at activation via each host's
|
||
# existing SSH host key (sops-nix derives the age key from
|
||
# /etc/ssh/ssh_host_ed25519_key automatically — see modules/common/README
|
||
# or docs/ for the sops workflow). hashedPassword/hashedPasswordFile need
|
||
# neededForUsers so they're available before the normal secret-activation
|
||
# step, since user creation happens very early in boot.
|
||
sops = {
|
||
defaultSopsFile = ../../secrets/common.yaml;
|
||
|
||
secrets = {
|
||
"root-hashedPassword".neededForUsers = true;
|
||
"nixos-hashedPassword".neededForUsers = true;
|
||
"nix-github-token" = { };
|
||
};
|
||
|
||
# nix.conf doesn't support a *File-style option for access-tokens, so the
|
||
# token is rendered into a runtime-only file (never touches the Nix store)
|
||
# and pulled in via nix.conf's native !include directive.
|
||
templates."nix-github-token.conf".content = ''
|
||
access-tokens = github.com=${config.sops.placeholder."nix-github-token"}
|
||
'';
|
||
};
|
||
|
||
nix.extraOptions = ''
|
||
!include ${config.sops.templates."nix-github-token.conf".path}
|
||
'';
|
||
|
||
users = {
|
||
# With mutableUsers = false, update-users-groups.pl enforces hashedPasswordFile
|
||
# on every activation regardless of whether the account already exists in
|
||
# /etc/shadow. The default (true) only applies hashedPasswordFile to newly-
|
||
# created accounts — which means a freshly-built proxmox disk image (where
|
||
# activation runs without a usable sops key, so both accounts land in shadow
|
||
# with ‘!’) will never have its passwords fixed by subsequent boots.
|
||
mutableUsers = false;
|
||
|
||
users.root = {
|
||
hashedPasswordFile = config.sops.secrets."root-hashedPassword".path;
|
||
};
|
||
|
||
users.${vars.primaryUser} = {
|
||
isNormalUser = true;
|
||
extraGroups = [ "wheel" ]; # Enable ‘sudo’ for the user.
|
||
packages = with pkgs; [
|
||
tree
|
||
];
|
||
hashedPasswordFile = config.sops.secrets."nixos-hashedPassword".path;
|
||
openssh.authorizedKeys.keys = [
|
||
vars.adminSshKey
|
||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICMJhrfFayLBG+gWtO6oAvgambw5nWWgztiTFEaaaVRH debian@surface"
|
||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGygkCljN6uKpdJbHTOQtn8ZnH+wKXDLAwrDFbLrE/65 nixos@nixos"
|
||
];
|
||
};
|
||
};
|
||
|
||
|
||
# Enable the OpenSSH daemon.
|
||
services.openssh.enable = true;
|
||
|
||
#Enable flakes
|
||
|
||
nix.settings = {
|
||
experimental-features = [ "nix-command" "flakes" ];
|
||
auto-optimise-store = true;
|
||
};
|
||
|
||
|
||
programs.git = {
|
||
enable = true;
|
||
package = pkgs.git;
|
||
config = {
|
||
credential.helper = "store";
|
||
};
|
||
};
|
||
|
||
|
||
|
||
}
|