Archived
beatzaplentyandClaude Sonnet 4.6
2f829ba3e7
Check NixOS configurations / eval-hosts (pull_request) Failing after 9m48s
modules/ipa/client.nix is now a self-contained NixOS module (no longer a parameterized function): it checks builtins.pathExists for secrets/<hostname>.keytab at eval time and enables itself automatically if found, making it a no-op for hosts without a keytab. modules/common/configuration.nix imports it so every host in the flake is a candidate for IPA enrollment — no per-host wiring needed. Adding a keytab (via scripts/ipa/create-nixos-ipa-host-account.sh) is now the only step required to enroll a host. The module also sets networking.domain and networking.nameservers via mkDefault when active, so new hosts don't need those set explicitly. Also: - Remove explicit IPA imports from hosts/nix-cache and hosts/tailscale-router - Add secrets/pxe-boot.keytab + creation rule; remove incorrect secrets/nixos.sweet.home.keytab and its creation rule - Add .sops.yaml creation rules for all remaining host keytabs (server, docker, tor-relay, nix-minimal, nixos) so the creation script can target them without manual .sops.yaml edits - Fix duplicate tailscale-router.keytab rule and corrupted gui.yaml comment block in .sops.yaml Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
31 lines
853 B
Nix
31 lines
853 B
Nix
{ vars, ... }:
|
|
|
|
{
|
|
imports = [
|
|
(import ../../modules/beszel/host-token.nix {
|
|
name = "tailscale-router";
|
|
sopsFile = ../../secrets/tailscale-router.yaml;
|
|
})
|
|
];
|
|
|
|
networking = {
|
|
hostName = "tailscale-router";
|
|
useDHCP = false;
|
|
interfaces.${vars.lxcLanInterface}.ipv4.addresses = [{
|
|
address = vars.tailscaleRouterIp;
|
|
prefixLength = vars.lanPrefixLength;
|
|
}];
|
|
defaultGateway = { address = vars.lanGateway; interface = vars.lxcLanInterface; };
|
|
nameservers = [ vars.domainControllerIp ];
|
|
};
|
|
|
|
services.beszel.agent.environment = {
|
|
KEY = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFPR9kwtC4TAeTRu46A7+opZsYpxqkRJ+x/ZyB2GWCeG";
|
|
};
|
|
|
|
# No networking.hostId: only ZFS-touching hosts (server, docker) need one
|
|
# for pool-import safety, and this host does neither.
|
|
|
|
system.stateVersion = "26.05";
|
|
}
|