Archived
123 lines
3.7 KiB
Nix
123 lines
3.7 KiB
Nix
{ config, lib, pkgs, vars, ... }:
|
|
|
|
let
|
|
switchCmd = ''
|
|
sudo nixos-rebuild switch \
|
|
--no-write-lock-file \
|
|
--refresh \
|
|
--flake git+https://${vars.giteaDomain}/${vars.giteaRepoPath}.git?dir=${vars.giteaRepoFlakePath}#$(cat /etc/flake-target)
|
|
'';
|
|
testCmd = ''
|
|
sudo nixos-rebuild test \
|
|
--no-write-lock-file \
|
|
--refresh \
|
|
--flake git+https://${vars.giteaDomain}/${vars.giteaRepoPath}.git?dir=${vars.giteaRepoFlakePath}#$(cat /etc/flake-target)
|
|
'';
|
|
buildImageFn = ''
|
|
buildImage() {
|
|
if [ -z "$1" ]; then
|
|
echo "usage: buildImage <flake-target> (e.g. lxc-docker)" >&2
|
|
return 1
|
|
fi
|
|
NIXOS_HOST_KEYS_DIR="$(pwd)/host-keys" nix build --impure \
|
|
".#nixosConfigurations.$1.config.system.build.tarball"
|
|
}
|
|
'';
|
|
in
|
|
{
|
|
imports = [
|
|
./set-locale.nix
|
|
../ipa/client.nix
|
|
];
|
|
|
|
# System-wide shell config so all users (including IPA accounts) get the
|
|
# same management aliases as the local nixos user's Home Manager provides.
|
|
programs.bash = {
|
|
shellAliases = {
|
|
"Switch-nix" = switchCmd;
|
|
"Test-nix" = testCmd;
|
|
};
|
|
interactiveShellInit = buildImageFn;
|
|
};
|
|
|
|
networking.networkmanager.enable = true;
|
|
|
|
# Recommended over the true default (bypasses ZFS's own import safeguards)
|
|
# per the option's own docs; matches hosts/docker/host.nix and
|
|
# modules/services/zfs/enable-service.nix. Harmless no-op on hosts without ZFS.
|
|
boot.zfs.forceImportRoot = false;
|
|
|
|
time.timeZone = vars.timeZone;
|
|
|
|
services.qemuGuest.enable = true;
|
|
|
|
environment.systemPackages = with pkgs; [
|
|
vim
|
|
btop
|
|
git
|
|
gcr
|
|
jq
|
|
];
|
|
|
|
# Secrets shared by every host, decrypted at activation via each host's
|
|
# SSH host key (sops-nix derives the age key from
|
|
# /etc/ssh/ssh_host_ed25519_key automatically). hashedPassword secrets need
|
|
# neededForUsers so they're available before the normal secret-activation
|
|
# step — user creation happens very early in boot.
|
|
sops = {
|
|
defaultSopsFile = ../../secrets/common.yaml;
|
|
|
|
secrets = {
|
|
"root-hashedPassword".neededForUsers = true;
|
|
"nixos-hashedPassword".neededForUsers = true;
|
|
"nix-github-token" = { };
|
|
"nix-gitea-token" = { };
|
|
};
|
|
|
|
# nix.conf has no *File-style option for access-tokens, so tokens are
|
|
# rendered into a runtime-only file (never touches the Nix store) and
|
|
# pulled in via nix.conf's native !include directive.
|
|
templates."nix-access-tokens.conf".content = ''
|
|
access-tokens = github.com=${config.sops.placeholder."nix-github-token"} ${vars.giteaDomain}=${config.sops.placeholder."nix-gitea-token"}
|
|
'';
|
|
};
|
|
|
|
nix.extraOptions = ''
|
|
!include ${config.sops.templates."nix-access-tokens.conf".path}
|
|
'';
|
|
|
|
users = {
|
|
# mutableUsers = false makes update-users-groups.pl enforce hashedPasswordFile
|
|
# on every activation, not just on newly-created accounts. Without this, a
|
|
# freshly-built proxmox disk image (activation runs without a usable sops key,
|
|
# so both accounts land in shadow with '!') will never have its passwords fixed
|
|
# by subsequent boots.
|
|
mutableUsers = false;
|
|
|
|
users.root = {
|
|
hashedPasswordFile = config.sops.secrets."root-hashedPassword".path;
|
|
};
|
|
|
|
users.${vars.primaryUser} = {
|
|
isNormalUser = true;
|
|
extraGroups = [ "wheel" ];
|
|
packages = with pkgs; [ tree ];
|
|
hashedPasswordFile = config.sops.secrets."nixos-hashedPassword".path;
|
|
openssh.authorizedKeys.keys = [ vars.adminSshKey ] ++ vars.extraAdminSshKeys;
|
|
};
|
|
};
|
|
|
|
services.openssh.enable = true;
|
|
|
|
nix.settings = {
|
|
experimental-features = [ "nix-command" "flakes" ];
|
|
auto-optimise-store = true;
|
|
};
|
|
|
|
programs.git = {
|
|
enable = true;
|
|
package = pkgs.git;
|
|
config.credential.helper = "store";
|
|
};
|
|
}
|