From e39747ae2e9f4032b234f1f8d9a399b240f66539 Mon Sep 17 00:00:00 2001 From: andromeda Date: Tue, 30 Dec 2025 13:47:08 +0100 Subject: andromeda: add agenix; machines: start to add box --- machines/laptop/configuration.nix | 107 ++++++++++++++++++++++++++++++++++++++ machines/laptop/machine.nix | 4 +- 2 files changed, 110 insertions(+), 1 deletion(-) create mode 100644 machines/laptop/configuration.nix (limited to 'machines/laptop') diff --git a/machines/laptop/configuration.nix b/machines/laptop/configuration.nix new file mode 100644 index 0000000..1b07935 --- /dev/null +++ b/machines/laptop/configuration.nix @@ -0,0 +1,107 @@ +{ + lib, + machine, + ... +}: { + boot.loader = { + efi.canTouchEfiVariables = true; + systemd-boot.enable = true; + }; + environment.persistence."/nix/persist" = { + enable = true; + hideMounts = true; + directories = [ + "/var/log" + "/var/lib/bluetooth" + "/var/lib/nixos" + "/var/lib/systemd/coredump" + "/etc/NetworkManager/system-connections" + ]; + files = [ + "/etc/machine-id" + "/etc/ly/save.txt" + ]; + users."andromeda" = { + directories = [ + ".backups" + ".local/share/Anki2" + ".local/share/chat.fluffy.fluffychat" + ".local/share/zoxide" + ".ssh" + "conf" + "Downloads" + "pp" + ]; + files = [ + ".bash_history" + ".brush_history" + ]; + }; + users."mtgmonkey" = { + directories = [ + ".local/share/zoxide" + ".ssh" + ]; + files = [ + ".bash_history" + ".brush_history" + ]; + }; + }; + hardware.bluetooth = { + enable = true; + powerOnBoot = true; + }; + i18n.defaultLocale = "de_DE.UTF-8"; + networking = { + dhcpcd.enable = true; + firewall.enable = true; + hostName = machine.hostname; + networkmanager.enable = true; + }; + nix.settings.experimental-features = [ + "nix-command" + "flakes" + ]; + nixpkgs.config.allowUnfreePredicate = pkg: + builtins.elem (lib.getName pkg) [ + "steam" + "steam-original" + "steam-unwrapped" + "steam-run" + ]; + programs = { + noshell.enable = true; + steam.enable = true; + sway.enable = true; + }; + services = { + blueman.enable = true; + displayManager = { + enable = true; + ly.enable = true; + }; + libinput.enable = true; + printing.enable = true; + }; + system.stateVersion = "26.05"; + time.timeZone = "Europe/Berlin"; + users.users."andromeda" = { + isNormalUser = true; + description = "andromeda"; + initialPassword = "password"; + extraGroups = [ + "networkmanager" + "wheel" + ]; + }; + users.users."mtgmonkey" = { + isNormalUser = true; + description = "mtgmonkey"; + initialPassword = "password"; + extraGroups = [ + "networkmanager" + "wheel" + ]; + }; +} diff --git a/machines/laptop/machine.nix b/machines/laptop/machine.nix index d6b1e01..77c15b5 100644 --- a/machines/laptop/machine.nix +++ b/machines/laptop/machine.nix @@ -1,6 +1,8 @@ { hostname = "lenovo"; - usernames = ["andromeda"]; + usernames = ["andromeda" "mtgmonkey"]; system = "x86_64-linux"; + configuration = ./configuration.nix; hardware-configuration = ./hardware-configuration.nix; + pub-keys.ssh = []; } -- cgit v1.3 From 0468cf2621e8ef812f774bbf2eed396b4c0d4602 Mon Sep 17 00:00:00 2001 From: andromeda Date: Tue, 30 Dec 2025 17:45:01 +0100 Subject: use agenix --- flake.nix | 1 + machines/173-249-5-230/configuration.nix | 9 +++++++-- machines/laptop/configuration.nix | 11 +++++++++-- machines/laptop/hardware-configuration.nix | 8 +++++++- secrets/secret0.age | Bin 0 -> 396 bytes secrets/secret1.age | Bin 0 -> 396 bytes secrets/secrets.nix | 7 +++++++ 7 files changed, 31 insertions(+), 5 deletions(-) create mode 100644 secrets/secret0.age create mode 100644 secrets/secret1.age create mode 100644 secrets/secrets.nix (limited to 'machines/laptop') diff --git a/flake.nix b/flake.nix index 69b6cff..d8682d5 100644 --- a/flake.nix +++ b/flake.nix @@ -53,6 +53,7 @@ }; configurationWithHomeManager = machine: (configuration machine [ + agenix.nixosModules.default home-manager.nixosModules.home-manager { nixpkgs.overlays = [ diff --git a/machines/173-249-5-230/configuration.nix b/machines/173-249-5-230/configuration.nix index b8b403e..853a5db 100644 --- a/machines/173-249-5-230/configuration.nix +++ b/machines/173-249-5-230/configuration.nix @@ -1,4 +1,9 @@ -{machine, ...}: { +{ + config, + machine, + ... +}: { + age.secrets.secret1.file = ../../secrets/secret1.age; boot.tmp.cleanOnBoot = true; boot.loader.grub.devices = ["nodev"]; environment.persistence."/nix/persist" = { @@ -66,7 +71,7 @@ users.users."mtgmonkey" = { isNormalUser = true; description = "mtgmonkey"; - initialPassword = "password"; + passwordFile = builtins.toString config.age.secrets.secret1.path; extraGroups = ["wheel"]; openssh.authorizedKeys.keys = machine.pub-keys.ssh; }; diff --git a/machines/laptop/configuration.nix b/machines/laptop/configuration.nix index 1b07935..58b019e 100644 --- a/machines/laptop/configuration.nix +++ b/machines/laptop/configuration.nix @@ -1,8 +1,13 @@ { + config, lib, machine, ... }: { + age.secrets = { + secret0.file = ../../secrets/secret0.age; + secret1.file = ../../secrets/secret1.age; + }; boot.loader = { efi.canTouchEfiVariables = true; systemd-boot.enable = true; @@ -16,6 +21,7 @@ "/var/lib/nixos" "/var/lib/systemd/coredump" "/etc/NetworkManager/system-connections" + "/etc/ssh" ]; files = [ "/etc/machine-id" @@ -82,6 +88,7 @@ ly.enable = true; }; libinput.enable = true; + openssh.enable = true; printing.enable = true; }; system.stateVersion = "26.05"; @@ -89,7 +96,7 @@ users.users."andromeda" = { isNormalUser = true; description = "andromeda"; - initialPassword = "password"; + hashedPasswordFile = builtins.toString config.age.secrets.secret0.path; extraGroups = [ "networkmanager" "wheel" @@ -98,7 +105,7 @@ users.users."mtgmonkey" = { isNormalUser = true; description = "mtgmonkey"; - initialPassword = "password"; + hashedPasswordFile = builtins.toString config.age.secrets.secret1.path; extraGroups = [ "networkmanager" "wheel" diff --git a/machines/laptop/hardware-configuration.nix b/machines/laptop/hardware-configuration.nix index bde1c83..8ebef80 100644 --- a/machines/laptop/hardware-configuration.nix +++ b/machines/laptop/hardware-configuration.nix @@ -21,7 +21,7 @@ #device = "none"; #fsType = "tmpfs"; #options = ["defaults" "size=60%" "mode=755"]; - device = "/dev/disk/by-uuid/16c93673-4f0e-4010-a7f4-7ccffb20edb7"; + device = "/dev/disk/by-uuid/5455cfb4-0efd-4f55-b496-d2cab3f419b7"; fsType = "btrfs"; options = ["subvol=root"]; }; @@ -48,6 +48,12 @@ done btrfs subvolume create /btrfs_tmp/root + mkdir /btrfs_tmp/root/nix + mkdir /btrfs_tmp/root/etc + mount ${config.fileSystems."/nix".device} /btrfs_tmp/root/nix + cp /btrfs_tmp/root/nix/persist/etc/ssh /btrfs_tmp/root/etc/ssh -r + umount /btrfs_tmp/root/nix + rm -r /btrfs_tmp/root/nix umount /btrfs_tmp ''; diff --git a/secrets/secret0.age b/secrets/secret0.age new file mode 100644 index 0000000..4fd14de Binary files /dev/null and b/secrets/secret0.age differ diff --git a/secrets/secret1.age b/secrets/secret1.age new file mode 100644 index 0000000..3a172d3 Binary files /dev/null and b/secrets/secret1.age differ diff --git a/secrets/secrets.nix b/secrets/secrets.nix new file mode 100644 index 0000000..43b72b3 --- /dev/null +++ b/secrets/secrets.nix @@ -0,0 +1,7 @@ +let + andromeda = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJy2VD362wUcu0lKj2d6OIU8dbAna0Lu/NaAYIj8gdIA andromeda@lenovo"; + lenovo = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHG4eqsLTq2os2mxfwhys3BpVnowcJrqt2CbRFzN2pJb root@lenovo"; +in { + "secret0.age".publicKeys = [andromeda lenovo]; + "secret1.age".publicKeys = [andromeda lenovo]; +} -- cgit v1.3