incorporated john-p14s, big squash merge of stuff
This commit is contained in:
John Lancaster
@@ -0,0 +1,16 @@
|
||||
# This module is for programs with GUIs that run in a desktop environment
|
||||
{ self, inputs, ... }: {
|
||||
flake.modules.homeManager.desktop = { config, pkgs, lib, ... }: {
|
||||
imports = with inputs.self.modules.homeManager; [
|
||||
brave
|
||||
ghostty
|
||||
onepassword
|
||||
vscode
|
||||
];
|
||||
home.packages = with pkgs; [
|
||||
mangohud
|
||||
sublime4
|
||||
proton-vpn
|
||||
];
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,107 @@
|
||||
{ inputs, ... }: {
|
||||
flake.modules.nixos.gnome = {pkgs, ... }: {
|
||||
services = {
|
||||
desktopManager.gnome.enable = true;
|
||||
displayManager.gdm = {
|
||||
enable = true;
|
||||
wayland = true;
|
||||
banner = "Welcome to John's NixOS implementation";
|
||||
};
|
||||
udev.packages = [
|
||||
pkgs.gnome-settings-daemon # For gnome systray icons
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
flake.modules.homeManager.gnome = { config, pkgs, ... }:
|
||||
let
|
||||
# `gnome-extensions list` for a list
|
||||
extensions = with pkgs.gnomeExtensions; [
|
||||
appindicator # For gnome systray icons
|
||||
dash-to-panel
|
||||
gtile
|
||||
space-bar
|
||||
switcher
|
||||
tactile
|
||||
vitals
|
||||
];
|
||||
enabledExtensions = map (ext: ext.extensionUuid) extensions;
|
||||
in
|
||||
{
|
||||
gtk = {
|
||||
enable = true;
|
||||
theme = {
|
||||
name = "Orchis-Dark";
|
||||
package = pkgs.orchis-theme;
|
||||
};
|
||||
gtk4.theme = config.gtk.theme;
|
||||
};
|
||||
|
||||
home.packages = [ pkgs.gnome-tweaks ] ++ extensions;
|
||||
|
||||
dconf.settings = {
|
||||
"org/gnome/desktop/interface" = {
|
||||
color-scheme = "prefer-dark";
|
||||
};
|
||||
|
||||
"org/gnome/shell" = {
|
||||
disable-user-extensions = false;
|
||||
enabled-extensions = enabledExtensions;
|
||||
};
|
||||
|
||||
"org/gnome/desktop/wm/preferences" = {
|
||||
button-layout = ":minimize,close";
|
||||
};
|
||||
|
||||
"org/gnome/desktop/wm/keybindings" = {
|
||||
"switch-to-workspace-1" = ["<Super>1"];
|
||||
"switch-to-workspace-2" = ["<Super>2"];
|
||||
"switch-to-workspace-3" = ["<Super>3"];
|
||||
"switch-to-workspace-4" = ["<Super>4"];
|
||||
"move-to-workspace-1" = ["<Shift><Super>1"];
|
||||
"move-to-workspace-2" = ["<Shift><Super>2"];
|
||||
"move-to-workspace-3" = ["<Shift><Super>3"];
|
||||
"move-to-workspace-4" = ["<Shift><Super>4"];
|
||||
};
|
||||
|
||||
"org/gnome/settings-daemon/plugins/media-keys" = {
|
||||
custom-keybindings = [
|
||||
"/org/gnome/settings-daemon/plugins/media-keys/custom-keybindings/edit-nix/"
|
||||
"/org/gnome/settings-daemon/plugins/media-keys/custom-keybindings/launch-browser/"
|
||||
"/org/gnome/settings-daemon/plugins/media-keys/custom-keybindings/ad-dev/"
|
||||
"/org/gnome/settings-daemon/plugins/media-keys/custom-keybindings/shutdown/"
|
||||
];
|
||||
};
|
||||
|
||||
"org/gnome/settings-daemon/plugins/media-keys/custom-keybindings/edit-nix" = {
|
||||
binding = "<Primary><Alt>n";
|
||||
command = "code /etc/nixos";
|
||||
name = "Edit Nix config";
|
||||
};
|
||||
|
||||
"org/gnome/settings-daemon/plugins/media-keys/custom-keybindings/launch-browser" = {
|
||||
binding = "<Primary><Alt>b";
|
||||
command = "brave";
|
||||
name = "Launch Brave browser";
|
||||
};
|
||||
|
||||
"org/gnome/settings-daemon/plugins/media-keys/custom-keybindings/ad-dev" = {
|
||||
binding = "<Primary><Alt>d";
|
||||
command = ''code --file-uri "vscode-remote://ssh-remote+ad-nix/etc/nixos/ad-nix.code-workspace"'';
|
||||
name = "Launch AppDaemon Development over Tailscale";
|
||||
};
|
||||
|
||||
"org/gnome/settings-daemon/plugins/media-keys/custom-keybindings/ws1" = {
|
||||
binding = "<Super>1";
|
||||
command = "wmctrl -s 0";
|
||||
name = "Switch to workspace 1";
|
||||
};
|
||||
|
||||
"org/gnome/settings-daemon/plugins/media-keys/custom-keybindings/shutdown" = {
|
||||
binding = "<Primary><Alt>p";
|
||||
command = "gnome-session-quit --power-off --force";
|
||||
name = "Shutdown immediately";
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,28 @@
|
||||
# https://github.com/glabrie/dotfiles/blob/main/modules/system/settings/greetd.nix
|
||||
{ inputs, ... }: {
|
||||
flake.module.nixos.greetd = { pkgs, lib, ... }: {
|
||||
services.greetd = {
|
||||
enable = true;
|
||||
settings = {
|
||||
default_session = {
|
||||
command = "${lib.getExe pkgs.tuigreet} --time --remember --cmd niri-session";
|
||||
user = "greeter";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
systemd.services.greetd.serviceConfig = {
|
||||
Type = "idle";
|
||||
StandardInput = "tty";
|
||||
StandardOutput = "tty";
|
||||
StandardError = "journal"; # Without this errors will spam on screen
|
||||
# Without these bootlogs will spam on screen
|
||||
TTYReset = true;
|
||||
TTYVHangup = true;
|
||||
TTYVTDisallocate = true;
|
||||
};
|
||||
|
||||
# Let's allow our keyring to work from the start
|
||||
security.pam.services.greetd.enableGnomeKeyring = true;
|
||||
};
|
||||
}
|
||||
@@ -1,20 +1,16 @@
|
||||
{ inputs, lib, ... }:
|
||||
{ self, inputs, lib, ... }:
|
||||
let
|
||||
# Options that will be in common between
|
||||
opts = {
|
||||
enable = lib.mkEnableOption "Enable mTLS";
|
||||
ca = {
|
||||
url = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
};
|
||||
fingerprint = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
};
|
||||
};
|
||||
subject = lib.mkOption {
|
||||
description = "The Common Name, DNS Name, or IP address that will be set as the Subject Common Name for the certificate. If no Subject Alternative Names (SANs) are configured (via the --san flag) then the subject will be set as the only SAN.";
|
||||
type = lib.types.str;
|
||||
};
|
||||
certDir = lib.mkOption {
|
||||
description = "String path to the directory where the certs will be stored";
|
||||
type = lib.types.str;
|
||||
};
|
||||
keyFilename = lib.mkOption {
|
||||
description = "String filename for the private key";
|
||||
type = lib.types.str;
|
||||
@@ -82,6 +78,38 @@ let
|
||||
};
|
||||
};
|
||||
|
||||
mkMtlsGenerateScript = {
|
||||
pkgs,
|
||||
subject,
|
||||
provisioner,
|
||||
san,
|
||||
tlsCert,
|
||||
tlsKey,
|
||||
mtlsBundle,
|
||||
lifetime,
|
||||
}:
|
||||
let
|
||||
stepCmd = lib.getExe pkgs.step-cli;
|
||||
sanArgs = lib.concatMapStringsSep " " (s: "--san \"${s}\"") san;
|
||||
in
|
||||
pkgs.writeShellScriptBin "mtls-generate" ''
|
||||
set -euo pipefail
|
||||
${stepCmd} ca certificate \
|
||||
${subject} ${tlsCert} ${tlsKey} \
|
||||
--not-before=-5m --not-after=${lifetime} \
|
||||
--provisioner ${provisioner} \
|
||||
${sanArgs} \
|
||||
"$@"
|
||||
cat ${tlsCert} ${tlsKey} > ${mtlsBundle}
|
||||
'';
|
||||
|
||||
mkMtlsCheckScript = { pkgs, mtlsBundle }: pkgs.writeShellScriptBin "mtls-check" ''
|
||||
${lib.getExe pkgs.openssl} x509 \
|
||||
-noout -subject -issuer \
|
||||
-ext subjectAltName,extendedKeyUsage \
|
||||
-enddate -in ${mtlsBundle}
|
||||
'';
|
||||
|
||||
mkMtlsRenewScript = {
|
||||
pkgs,
|
||||
tlsCert,
|
||||
@@ -92,9 +120,13 @@ let
|
||||
systemctlArgs ? [ ],
|
||||
}:
|
||||
let
|
||||
echoCmd = lib.getExe' pkgs.coreutils "echo";
|
||||
systemctl = lib.getExe' pkgs.systemd "systemctl";
|
||||
escapedArgs = lib.escapeShellArgs systemctlArgs;
|
||||
systemctlCommand = "${systemctl} ${escapedArgs}";
|
||||
renewReloadScript = lib.concatMapStringsSep "\n" (unit: ''
|
||||
if ${lib.getExe' pkgs.systemd "systemctl"} ${lib.escapeShellArgs systemctlArgs} --quiet is-active "${unit}"; then
|
||||
${lib.getExe' pkgs.systemd "systemctl"} ${lib.escapeShellArgs systemctlArgs} try-reload-or-restart "${unit}"
|
||||
if ${systemctlCommand} --quiet is-active "${unit}"; then
|
||||
${systemctlCommand} try-reload-or-restart "${unit}"
|
||||
fi
|
||||
'') reloadUnits;
|
||||
renewPostCommands = lib.concatStringsSep "\n" postCommands;
|
||||
@@ -103,9 +135,9 @@ let
|
||||
set -euo pipefail
|
||||
|
||||
if ${lib.getExe pkgs.step-cli} certificate needs-renewal "${tlsCert}"; then
|
||||
echo "Renewing mTLS certificate"
|
||||
${echoCmd} "Renewing mTLS certificate"
|
||||
else
|
||||
echo "Skipping renew"
|
||||
${echoCmd} "Skipping renew"
|
||||
exit "$?"
|
||||
fi
|
||||
|
||||
@@ -114,10 +146,10 @@ let
|
||||
umask 077
|
||||
${lib.getExe' pkgs.coreutils "cat"} "${tlsCert}" "${tlsKey}" > "${mtlsBundle}"
|
||||
|
||||
echo "Reloading units:"
|
||||
${echoCmd} "Reloading units:"
|
||||
${renewReloadScript}
|
||||
|
||||
echo "Post commands:"
|
||||
${echoCmd} "Post commands:"
|
||||
${renewPostCommands}
|
||||
'';
|
||||
|
||||
@@ -217,33 +249,33 @@ in
|
||||
flake.modules.nixos.mtls = { config, lib, pkgs, ... }:
|
||||
let
|
||||
cfg = config.mtls;
|
||||
certDir = "/etc/step/certs";
|
||||
tlsKey = "${certDir}/${cfg.keyFilename}";
|
||||
tlsCert = "${certDir}/${cfg.certFilename}";
|
||||
mtlsBundle = "${certDir}/${cfg.bundleFilename}";
|
||||
rootCA = "${certDir}/root_ca.crt";
|
||||
tlsKey = "${cfg.certDir}/${cfg.keyFilename}";
|
||||
tlsCert = "${cfg.certDir}/${cfg.certFilename}";
|
||||
mtlsBundle = "${cfg.certDir}/${cfg.bundleFilename}";
|
||||
sanArgs = lib.concatMapStringsSep " " (san: "--san \"${san}\"") cfg.san;
|
||||
in
|
||||
{
|
||||
options.mtls = opts;
|
||||
options.mtls = opts // {
|
||||
certDir = lib.mkOption {
|
||||
description = "String path to where the mtls certs will be stored.";
|
||||
type = lib.types.str;
|
||||
default = "/etc/step/certs";
|
||||
};
|
||||
};
|
||||
|
||||
config = lib.mkIf cfg.enable {
|
||||
environment.systemPackages = with pkgs; lib.optionals cfg.enable [
|
||||
(writeShellScriptBin "mtls-generate" ''
|
||||
set -euo pipefail
|
||||
${lib.getExe pkgs.step-cli} ca certificate \
|
||||
${cfg.subject} ${tlsCert} ${tlsKey} \
|
||||
--provisioner ${cfg.provisioner} \
|
||||
--not-before=-5m --not-after=${cfg.lifetime} \
|
||||
${sanArgs} \
|
||||
"$@"
|
||||
cat ${tlsCert} ${tlsKey} > ${mtlsBundle}
|
||||
'')
|
||||
(writeShellScriptBin "mtls-check" ''
|
||||
${lib.getExe pkgs.openssl} x509 \
|
||||
-noout -subject -issuer \
|
||||
-ext subjectAltName,extendedKeyUsage \
|
||||
-enddate -in ${mtlsBundle}
|
||||
'')
|
||||
step-cli
|
||||
(mkMtlsGenerateScript {
|
||||
inherit (cfg) subject provisioner san lifetime;
|
||||
inherit pkgs tlsCert tlsKey mtlsBundle;
|
||||
})
|
||||
(mkMtlsCheckScript { inherit pkgs mtlsBundle; })
|
||||
(mkMtlsRenewScript { inherit pkgs tlsCert tlsKey mtlsBundle; })
|
||||
];
|
||||
|
||||
systemd.tmpfiles.rules = [
|
||||
"d ${cfg.certDir} 0750 ${cfg.renew.user} ${if cfg.renew.group == null then cfg.renew.user else cfg.renew.group} -"
|
||||
];
|
||||
|
||||
systemd.services.mtls-renew = lib.mkIf cfg.renew.enable (mkNixosMtlsRenewService {
|
||||
@@ -260,11 +292,9 @@ in
|
||||
flake.modules.homeManager.mtls = { config, lib, pkgs, ... }:
|
||||
let
|
||||
cfg = config.mtls;
|
||||
certDir = cfg.certDir;
|
||||
tlsKey = "${certDir}/${cfg.keyFilename}";
|
||||
tlsCert = "${certDir}/${cfg.certFilename}";
|
||||
mtlsBundle = "${certDir}/${cfg.bundleFilename}";
|
||||
rootCA = "${certDir}/root_ca.crt";
|
||||
tlsKey = "${cfg.certDir}/${cfg.keyFilename}";
|
||||
tlsCert = "${cfg.certDir}/${cfg.certFilename}";
|
||||
mtlsBundle = "${cfg.certDir}/${cfg.bundleFilename}";
|
||||
sanArgs = lib.concatMapStringsSep " " (san: "--san \"${san}\"") cfg.san;
|
||||
in
|
||||
{
|
||||
@@ -272,38 +302,25 @@ in
|
||||
certDir = lib.mkOption {
|
||||
description = "String path to where the mtls certs will be stored.";
|
||||
type = lib.types.str;
|
||||
default ="${config.home.homeDirectory}/.step/certs";
|
||||
default = "${config.home.homeDirectory}/.step/certs";
|
||||
};
|
||||
};
|
||||
|
||||
config = {
|
||||
home.file.".step/config/defaults.json".text = builtins.toJSON {
|
||||
"ca-url" = cfg.ca.url;
|
||||
fingerprint = cfg.ca.fingerprint;
|
||||
root = "${cfg.certDir}/root_ca.crt";
|
||||
};
|
||||
|
||||
home.packages = with pkgs; lib.optionals cfg.enable [
|
||||
step-cli
|
||||
(writeShellScriptBin "mtls-generate" ''
|
||||
set -euo pipefail
|
||||
${lib.getExe pkgs.step-cli} ca certificate \
|
||||
${cfg.subject} ${tlsCert} ${tlsKey} \
|
||||
--not-before=-5m --not-after=${cfg.lifetime} \
|
||||
--provisioner ${cfg.provisioner} \
|
||||
${sanArgs} \
|
||||
"$@"
|
||||
cat ${tlsCert} ${tlsKey} > ${mtlsBundle}
|
||||
'')
|
||||
(writeShellScriptBin "mtls-check" ''
|
||||
${lib.getExe pkgs.openssl} x509 \
|
||||
-noout -subject -issuer \
|
||||
-ext subjectAltName,extendedKeyUsage \
|
||||
-enddate -in ${mtlsBundle}
|
||||
'')
|
||||
(mkMtlsGenerateScript {
|
||||
inherit (cfg) subject provisioner san lifetime;
|
||||
inherit pkgs tlsCert tlsKey mtlsBundle;
|
||||
})
|
||||
(mkMtlsCheckScript { inherit pkgs mtlsBundle; })
|
||||
(mkMtlsRenewScript { inherit pkgs tlsCert tlsKey mtlsBundle; })
|
||||
];
|
||||
|
||||
systemd.user.tmpfiles.rules = lib.mkIf cfg.enable [
|
||||
"d ${cfg.certDir} 0700 - - -"
|
||||
];
|
||||
|
||||
systemd.user.services.mtls-renew = lib.mkIf cfg.renew.enable (mkHomeManagerMtlsRenewService {
|
||||
inherit pkgs tlsCert tlsKey mtlsBundle;
|
||||
inherit (cfg.renew) reloadUnits postCommands;
|
||||
@@ -1,4 +1,4 @@
|
||||
{ inputs, ... }: {
|
||||
{ self, inputs, ... }: {
|
||||
flake.modules.nixos.restic-server = { config, pkgs, lib, ... }: {
|
||||
services.restic.server = {
|
||||
enable = true;
|
||||
@@ -47,20 +47,20 @@
|
||||
config = let
|
||||
resticRepository = "rest:https://soteria.john-stream.com/${cfg.repoName}";
|
||||
caCert = "${config.mtls.certDir}/root_ca.crt";
|
||||
mtlsClientCert = "${config.mtls.certDir}/${config.mtls.bundleFilename}";
|
||||
mtlsBundle = "${config.mtls.certDir}/${config.mtls.bundleFilename}";
|
||||
in
|
||||
{
|
||||
home.sessionVariables = {
|
||||
RESTIC_REPOSITORY = resticRepository;
|
||||
RESTIC_PASSWORD_FILE = cfg.passwordFile;
|
||||
RESTIC_CACERT = caCert;
|
||||
RESTIC_TLS_CLIENT_CERT = mtlsClientCert;
|
||||
RESTIC_TLS_CLIENT_CERT = mtlsBundle;
|
||||
};
|
||||
|
||||
# This is necessary because the restic service in home manager doesn't otherwise expose these options.
|
||||
systemd.user.services."restic-backups-${cfg.repoName}".Service.Environment = [
|
||||
"RESTIC_CACERT=${caCert}"
|
||||
"RESTIC_TLS_CLIENT_CERT=${mtlsClientCert}"
|
||||
"RESTIC_TLS_CLIENT_CERT=${mtlsBundle}"
|
||||
];
|
||||
|
||||
services.restic = {
|
||||
@@ -103,7 +103,6 @@
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -23,7 +23,6 @@
|
||||
home.packages = with pkgs; [
|
||||
wget
|
||||
curl
|
||||
cacert
|
||||
busybox
|
||||
gnugrep
|
||||
dig
|
||||
@@ -31,6 +30,10 @@
|
||||
uv
|
||||
xclip
|
||||
jq
|
||||
ripgrep
|
||||
(writeShellScriptBin "ds" ''
|
||||
${lib.getExe pkgs.gdu} -x -I /snap /
|
||||
'')
|
||||
];
|
||||
};
|
||||
};
|
||||
@@ -2,9 +2,17 @@
|
||||
let
|
||||
username = "john";
|
||||
hostname = "janus";
|
||||
caURL = "https://janus.john-stream.com/";
|
||||
in
|
||||
{
|
||||
flake.modules.homeManager.janus-ca = { config, ... }: {
|
||||
home.file.".step/config/defaults.json".text = builtins.toJSON {
|
||||
"ca-url" = "https://janus.john-stream.com/";
|
||||
fingerprint = "2036c44f7b5901566ff7611ea6c927291ecc6d2dd00779c0eead70ec77fa10d6";
|
||||
root = "${config.home.homeDirectory}/.step/certs/root_ca.crt";
|
||||
};
|
||||
home.file.".step/certs/root_ca.crt".source = ./root_ca.crt;
|
||||
};
|
||||
|
||||
flake.nixosConfigurations."${hostname}" = inputs.nixpkgs.lib.nixosSystem {
|
||||
modules = with inputs.self.modules; [
|
||||
nixos.lxc
|
||||
@@ -20,12 +28,10 @@ in
|
||||
networking.hostName = hostname;
|
||||
step-ssh-host = {
|
||||
hostname = hostname;
|
||||
caURL = caURL;
|
||||
};
|
||||
mtls = {
|
||||
enable = true;
|
||||
subject = hostname;
|
||||
caURL = caURL;
|
||||
san = [
|
||||
"${hostname}.john-stream.com"
|
||||
"192.168.1.244"
|
||||
@@ -36,18 +42,10 @@ in
|
||||
imports = with inputs.self.modules.homeManager; [
|
||||
sops
|
||||
step-ssh-user
|
||||
janus-ca
|
||||
];
|
||||
|
||||
shell.program = "zsh";
|
||||
docker.enable = true;
|
||||
# step-ssh-user = {
|
||||
# enable = true;
|
||||
# principals = [ "${hostname}" ];
|
||||
# };
|
||||
ssh.matchSets = {
|
||||
certs = true;
|
||||
homelab = true;
|
||||
};
|
||||
};
|
||||
}
|
||||
];
|
||||
@@ -0,0 +1,11 @@
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIIBlDCCATqgAwIBAgIRAKDvqOX8WVhJ/ev02Y1gXKQwCgYIKoZIzj0EAwIwKDEO
|
||||
MAwGA1UEChMFSmFudXMxFjAUBgNVBAMTDUphbnVzIFJvb3QgQ0EwHhcNMjUxMjE4
|
||||
MDYwMjI4WhcNMzUxMjE2MDYwMjI4WjAoMQ4wDAYDVQQKEwVKYW51czEWMBQGA1UE
|
||||
AxMNSmFudXMgUm9vdCBDQTBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABMt6kNpx
|
||||
Q9vySc1N6F9jJObeQXZI+9f33E1cN4zbEuNpmtpRl0WaPa1AGNbSi5sIbiH7wDv2
|
||||
llXfCqYWkeoCE5mjRTBDMA4GA1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/
|
||||
AgEBMB0GA1UdDgQWBBRo55byyyo2sePP+8zz+uM4mXNV+zAKBggqhkjOPQQDAgNI
|
||||
ADBFAiB6zxTbvWMZWgDQhKGh+MnGQQ7f8UGhzinOfRG7a/HdOAIhAIVWt6MLl6QU
|
||||
FOvl/qIFGd7YJeWU5aahPABVttxjSMn/
|
||||
-----END CERTIFICATE-----
|
||||
@@ -0,0 +1,138 @@
|
||||
{ self, inputs, ... }:
|
||||
{
|
||||
flake.modules.nixos.p14sConfiguration = { config, pkgs, lib, ... }:
|
||||
let
|
||||
hostname = "john-p14s";
|
||||
homeDirectory = config.home-manager.users.john.home.homeDirectory;
|
||||
flakeDir = "${homeDirectory}/Documents/dendritic";
|
||||
in
|
||||
{
|
||||
imports = [
|
||||
self.modules.nixos.p14sHardware
|
||||
];
|
||||
|
||||
nix.settings.experimental-features = [ "nix-command" "flakes" ];
|
||||
nixpkgs.config = {
|
||||
permittedInsecurePackages = [ "openssl-1.1.1w" ];
|
||||
allowUnfree = true;
|
||||
};
|
||||
|
||||
rebuild.flakeDir = flakeDir;
|
||||
|
||||
networking = {
|
||||
hostName = hostname;
|
||||
networkmanager.enable = true;
|
||||
};
|
||||
|
||||
# Enable automatic login for the user.
|
||||
# services.displayManager.autoLogin.enable = true;
|
||||
# services.displayManager.autoLogin.user = "john";
|
||||
|
||||
programs.zsh.enable = true;
|
||||
services.openssh.enable = true;
|
||||
services.tailscale.enable = true;
|
||||
|
||||
# List packages installed in system profile. To search, run:
|
||||
# $ nix search wget
|
||||
environment.systemPackages = with pkgs; [
|
||||
wget
|
||||
cacert
|
||||
busybox
|
||||
dig
|
||||
samba
|
||||
];
|
||||
|
||||
security.pam.services.swaylock = {};
|
||||
security.pam.services.swaylock.fprintAuth = true;
|
||||
|
||||
programs._1password.enable = true;
|
||||
programs._1password-gui = {
|
||||
enable = true;
|
||||
# Certain features, including CLI integration and system authentication support,
|
||||
# require enabling PolKit integration on some desktop environments (e.g. Plasma).
|
||||
polkitPolicyOwners = [ "john" ];
|
||||
# TODO this should not be a hardcoded username
|
||||
};
|
||||
|
||||
# This is needed for VSCode remote support. Read: https://nixos.wiki/wiki/Visual_Studio_Code
|
||||
programs.nix-ld.enable = true;
|
||||
|
||||
# This value determines the NixOS release from which the default
|
||||
# settings for stateful data, like file locations and database versions
|
||||
# on your system were taken. It's perfectly fine and recommended to leave
|
||||
# this value at the release version of the first install of this system.
|
||||
# Before changing this value read the documentation for this option
|
||||
# (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
|
||||
system.stateVersion = "24.05"; # Did you read the comment?
|
||||
|
||||
# Set your time zone.
|
||||
time.timeZone = "America/Chicago";
|
||||
|
||||
# Select internationalisation properties.
|
||||
i18n = {
|
||||
defaultLocale = "en_US.UTF-8";
|
||||
extraLocaleSettings = {
|
||||
LC_ADDRESS = "en_US.UTF-8";
|
||||
LC_IDENTIFICATION = "en_US.UTF-8";
|
||||
LC_MEASUREMENT = "en_US.UTF-8";
|
||||
LC_MONETARY = "en_US.UTF-8";
|
||||
LC_NAME = "en_US.UTF-8";
|
||||
LC_NUMERIC = "en_US.UTF-8";
|
||||
LC_PAPER = "en_US.UTF-8";
|
||||
LC_TELEPHONE = "en_US.UTF-8";
|
||||
LC_TIME = "en_US.UTF-8";
|
||||
};
|
||||
};
|
||||
|
||||
services.libinput.enable = true; # Enable touchpad support (enabled default in most desktopManager).
|
||||
services.fprintd.enable = true; # Enables fingerprint sensor
|
||||
|
||||
# Enable sound with pipewire.
|
||||
services.pulseaudio.enable = false;
|
||||
security.rtkit.enable = true; # PulseAudio server uses this to acquire realtime priority.
|
||||
services.pipewire = {
|
||||
enable = true;
|
||||
alsa.enable = true;
|
||||
alsa.support32Bit = true;
|
||||
pulse.enable = true;
|
||||
# If you want to use JACK applications, uncomment this
|
||||
#jack.enable = true;
|
||||
|
||||
# use the example session manager (no others are packaged yet so this is enabled by default,
|
||||
# no need to redefine it in your config for now)
|
||||
# media-session.enable = true;
|
||||
};
|
||||
|
||||
home-manager.useGlobalPkgs = true;
|
||||
home-manager.users.root = {
|
||||
imports = with inputs.self.modules.homeManager; [
|
||||
rebuild
|
||||
janus-ca
|
||||
];
|
||||
home.stateVersion = "25.11";
|
||||
};
|
||||
home-manager.users.john.imports = with inputs.self.modules.homeManager; [
|
||||
gnome
|
||||
desktop
|
||||
mysops
|
||||
rebuild
|
||||
janus-ca
|
||||
{
|
||||
my-vscode.enable = true;
|
||||
mysops.hostSecretFile = "${flakeDir}/modules/hosts/john-p14s/secrets.yaml";
|
||||
homeManagerFlakeDir = "${flakeDir}";
|
||||
shell.program = "zsh";
|
||||
home.packages = with pkgs; [
|
||||
bash
|
||||
discord
|
||||
];
|
||||
}
|
||||
];
|
||||
sops.defaultSopsFile = ./secrets.yaml;
|
||||
sops.age.sshKeyPaths = [ "${homeDirectory}/.ssh/id_ed25519" ];
|
||||
mtls = {
|
||||
enable = true;
|
||||
subject = hostname;
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,26 @@
|
||||
{ self, inputs, ... }: {
|
||||
flake-file.inputs = {
|
||||
nixos-hardware = {
|
||||
url = "github:NixOS/nixos-hardware";
|
||||
flake = false;
|
||||
};
|
||||
};
|
||||
|
||||
flake.nixosConfigurations.john-p14s = inputs.nixpkgs.lib.nixosSystem {
|
||||
modules = [
|
||||
"${inputs.nixos-hardware}/lenovo/thinkpad/p14s"
|
||||
"${inputs.nixos-hardware}/lenovo/thinkpad/p14s/amd/gen4"
|
||||
] ++ (with self.modules.nixos; [
|
||||
p14sConfiguration
|
||||
rebuild
|
||||
sudo
|
||||
john
|
||||
gnome
|
||||
steam
|
||||
wireguard
|
||||
mtls
|
||||
# greetd
|
||||
# niri
|
||||
]);
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,59 @@
|
||||
{ self, inputs, ... }: {
|
||||
flake.modules.nixos.p14sHardware = { config, lib, pkgs, modulesPath, ... }: {
|
||||
imports = [
|
||||
(modulesPath + "/installer/scan/not-detected.nix")
|
||||
];
|
||||
|
||||
boot = {
|
||||
loader = {
|
||||
systemd-boot.enable = true;
|
||||
efi.canTouchEfiVariables = true;
|
||||
};
|
||||
initrd = {
|
||||
availableKernelModules = [ "nvme" "xhci_pci" "thunderbolt" "usb_storage" "usbhid" "sd_mod" ];
|
||||
kernelModules = [ "amdgpu" ];
|
||||
};
|
||||
kernelModules = [ "kvm-amd" ];
|
||||
extraModulePackages = [ ];
|
||||
};
|
||||
|
||||
# boot.loader.systemd-boot.enable = true;
|
||||
# boot.loader.efi.canTouchEfiVariables = true;
|
||||
# boot.initrd.availableKernelModules = [ "nvme" "xhci_pci" "thunderbolt" "usb_storage" "usbhid" "sd_mod" ];
|
||||
# boot.initrd.kernelModules = [ "amdgpu" ];
|
||||
# boot.kernelModules = [ "kvm-amd" ];
|
||||
# boot.extraModulePackages = [ ];
|
||||
|
||||
fileSystems."/" = {
|
||||
device = "/dev/disk/by-uuid/fbc7d8bc-080b-4554-a2b2-5f92d059ce07";
|
||||
fsType = "ext4";
|
||||
};
|
||||
|
||||
fileSystems."/boot" = {
|
||||
device = "/dev/disk/by-uuid/9A04-ADD8";
|
||||
fsType = "vfat";
|
||||
options = [ "fmask=0022" "dmask=0022" ];
|
||||
};
|
||||
|
||||
swapDevices = [ ];
|
||||
|
||||
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
|
||||
# (the default) this is the recommended approach. When using systemd-networkd it's
|
||||
# still possible to use this option, but it's recommended to use it in conjunction
|
||||
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
|
||||
networking.useDHCP = lib.mkDefault true;
|
||||
# networking.interfaces.enp102s0u2u4.useDHCP = lib.mkDefault true;
|
||||
# networking.interfaces.enp1s0f0.useDHCP = lib.mkDefault true;
|
||||
# networking.interfaces.wlp2s0.useDHCP = lib.mkDefault true;
|
||||
|
||||
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
|
||||
hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
|
||||
|
||||
hardware.graphics = {
|
||||
enable = true;
|
||||
enable32Bit = true;
|
||||
extraPackages = [ pkgs.rocmPackages.clr.icd ];
|
||||
};
|
||||
environment.variables.AMD_VULKAN_ICD = "RADV";
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,26 @@
|
||||
restic_password: ENC[AES256_GCM,data:8KeL7kOMTHkK+ZpY3aq0/S4UYbkZh72FxJAolcVes79NPfdHiNi77fmAZuXb8Gxasu16vk4y6ksWFmrZquvcbg+cLt8Yze+qvuCiUW62IOppzRIBLk6w2f8uPhU41gsVuj6u4Jz/Su7miNBvJYmF8vulIwDKS7qg43dzIKXY4q1HaRHCD12PkU9EfGpIgivdNCOO0lCE6m/O3IB8Ed4R51scBnVrIj89K5OuTepvIrGElmXiWqBdsTzCIaJCZJ8fDnzJPorLhsTAzKCnQhNoIrW/aYArzj9+WmglmGuqeaoemBoNTrYC9bssUwuWAOqsf1HC7gWST/dP9FmKl7UHlgkslblRcRedFPAQjDhy/RgZCj8hs/XrVYOzwW8WJ0XeB9UPK03QPJc8EZdz9r2Q0+U3LQxMV6Jne5JZGsMpII4b+7b/WbRZTooX3G09MES/gzwD+hyBr++6EpP9QTYs+4XsNLNN+S6y5+YS/7XmRvR7xb93eZ4EfUUKiQYejVKQBl9b8QTJa3q26RPa/82O5zQlzd1w/EjA4G6Vv8H6wvK0fHNwpU3hl9V8EL7Ca7JKfJr11Vw0fNHx2nXjOLURt27wbDeWUaSrzI+z2h/0TSiKWas/Eu5+4L9n7E3H5u5Hg2uaCQkDpy6RJkW9UL6lCC1YEJw5yHTugrPNoMcRlAKRoSIeSZSPfGl0CKYAC39s422xX2f46GpJu0bO8GG/XN9Qk+SxqPHGuzx7nWghFQctZb1ssGKuvHKqaNYZvWeWqqkxyPWb6xjaBaSGxcp5MsET+RAu2F1XgX9Is11mIJETlHhRE3OpMSHh7toIiuNs8YzsgkedVFWhx+Xu27DWvOFvg/01Rh6s5RGJKMgL7WQMLTtY2KI/ko648WXVoCtVymG8d30qWnSt8319jkILX/wdB8Vqp5ceRqHwDE89jhEh0GOg07eLcREnh+gjXij1/bS66/+hHk4jhkzGtbdfEji9sro4Nm+kVRA+6fgJjCvt1sAvjuj10Scx4uH3AdDTW+y0KaniK8EHTZzaGDuaV+tk3hZEfpwpdan5mquoQvFdZWsWlDefX7gRq38szmi9LtULEai0WKOtqnnDIOnWk/3NYeNdzJ28YzrUDbkxtghkRgr7fNGEtyCGRuWRRMc5mVp2FPzAwRKk29ShILpWbvfUzwAWUOEpyAS4bstzlMybf9L8sp20+Ier8gOMGJ81eXXXmhtgMn6aWZ6EDGe1Shl0gDM0JUEAkA2+kf3oIZAvcWiFxj7vyd4Aacw3RetUSJcy8JwbV3I/isxKyy/xs8zE2PUY0z3Cwh9MpVP9G8N6Mef6v2DNDNg+2iJ/eslQdbZRQzdJwnBMhpOopzRwuUaC7jJKyGBkcNbbmNjceJWEue0XVjIcZHJ7BFe3jKluezNIJIf268V35+HIpXJA7BUJn8NPCIQXze5Frm46U2aRTQ53LU4HBGLXYPzx8QLsn0jLVy518w/TztawdT3/SmSWNwYTuZG18TmXs9v3oB6PrUr4M7kJbNRLpRb0ZelbMDwpR074FPwwud6fkjR2lLQBbufmPUBdpVJZ2xFjijle8h1h29zoFsydFNq5wSXUO/nm/S09KdKi5F2S1uKP+NL80OVEeC+QXcBdTry07meVIhsBOh+9ajy1ExaMaPs2xjB5QvTgJA9kfJOAoUygjMC33FwdRw10eGP//IsiRm9EukF1o++MfZnAtcjhoOoy79TjlO8p8YVNwEhZ14Ik/kIizyQtr0gR+pVEIc6+1W29UOWNRXb+ZavXRDq0wvxigMagfcL+zIr4gctufTfubiOmVa85qVJB,iv:VogP+OQvlsYCSqlmffO+o99C0hJm63ZqLXVd2B0oom0=,tag:+se1QHW6xLMj/dZrbY0MKQ==,type:str]
|
||||
wireguard_private_key: ENC[AES256_GCM,data:sCskwDhemU1y4M4A4R9KxwiL8q+FtxnUqg1omU7yS81H1bbSM804hNzmq+A=,iv:7wNMAG+7wYYXYgKEohIAYisMN5lbz+M5RhCEaHL4yWE=,tag:FENdJTEEGD9cEJVwIIUQDA==,type:str]
|
||||
sops:
|
||||
age:
|
||||
- recipient: age1f6drjusg866yscj8029tk4yfpgecklrvezldm02ankm6h8nnwu5s2u6ahy
|
||||
enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBHS0F1R0NnV0gyNFlkUEhZ
|
||||
UkxvN1ZLQTFsV0tnR0pLNFJycmduU1VXUlFVCjBkRGxQd1B1c3cweTRsZm9OUCt0
|
||||
anU3RTFUUkxoaXlhdlR0RkxPclVUdVkKLS0tIG9kTEVNK2piRWI5ZWFSejFFUGtD
|
||||
emtTUGk0cVZWR3F5R05WTTFJUFUwNTAKrRYQAJen6QVSgaOyqPxSIniHiMLUfXuv
|
||||
/O1Ebz5xLWn99EhloqW7rHhUxXlhxP2CmwfYXizyKFa6nAu6R+BCgg==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
- recipient: age1ykcs39e62pz3xu6cedg8ea685kv5d5qsrhgkndygzm8rx30xd5ys5t3qxt
|
||||
enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBXNWRXZTFWREIzRVhRaWRB
|
||||
anNDb3hsZzFOMFMrclhmeldaOWY4b3BJekFBCkJhbjRvRUwva3lFbzNTKzJqK2p2
|
||||
WVlMaXpvczlhdGduZHIrb2xPaEg3OUUKLS0tIHFtM09mN0FEUWdjWEVEL3VXL00w
|
||||
WHpOY280S2hpVU1mNnozODRoMnB4bGMKK5RrDK2kAZlWf2igqyzWgshxLPj+f74A
|
||||
mCmMLDHo5drNieFYp+guqHaHnZkf9IzpAglj7x6wCITjk+l6go5KvA==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
lastmodified: "2026-03-27T03:59:09Z"
|
||||
mac: ENC[AES256_GCM,data:MsPAxssWUSvsJQP0Ogrl3r/GoVqeL1L95YTJQbAJZ4FVxhRXP7KfbUnKSclzU6G8CP5WxV18TXZfB4JITKG3Lz5rtVpD/WFMdhDmve0f6BPMAimle2ajWUaWYNePvEynClX3nydLk3h31DjHGa8YvJZqW2ieDb/JDMdBXiLTrWc=,iv:82ul5CV3XXllFCDJfF6beIcAIFj71ycJJF4iEQvovMA=,tag:108L7VkAoPUTLtV74qgrrA==,type:str]
|
||||
unencrypted_suffix: _unencrypted
|
||||
version: 3.12.2
|
||||
@@ -1,52 +1,56 @@
|
||||
{ inputs, ... }:
|
||||
{ self, inputs, ... }:
|
||||
let
|
||||
username = "john";
|
||||
hostname = "john-pc-ubuntu";
|
||||
# testTarget = "fded:fb16:653e:25da:be24:11ff:fea0:753f"; # test-nix
|
||||
testTarget = "fded:fb16:653e:25da:be24:11ff:fe89:1cc3"; # soteria
|
||||
|
||||
testHost = "soteria";
|
||||
testTarget = "fded:fb16:653e:25da:be24:11ff:fea0:753f"; # test-nix
|
||||
# testTarget = "fded:fb16:653e:25da:be24:11ff:fe89:1cc3"; # soteria
|
||||
|
||||
in
|
||||
{
|
||||
flake.modules.homeManager."${hostname}" = { pkgs, config, ... }:
|
||||
flake.modules.homeManager."${hostname}" = { config, pkgs, lib, ... }:
|
||||
let
|
||||
flakeDir = "${config.xdg.configHome}/home-manager/jsl-dendritic";
|
||||
certDir = "${config.mtls.certDir}";
|
||||
CACert = "${certDir}/root_ca.crt";
|
||||
mtlsBundle = "${certDir}/${config.mtls.bundleFilename}";
|
||||
resticPasswordFile = "${config.xdg.configHome}/restic/password.txt";
|
||||
|
||||
testPushCmd = (pkgs.writeShellScriptBin "test-push" ''
|
||||
${lib.getExe' pkgs.coreutils "mkdir"} -p /var/tmp/nix-build
|
||||
${lib.getExe' pkgs.coreutils "chmod"} 1777 /var/tmp/nix-build
|
||||
${lib.getExe pkgs.nixos-rebuild} switch \
|
||||
--flake ${flakeDir}#${testHost} \
|
||||
--target-host root@${testTarget}
|
||||
'');
|
||||
in
|
||||
{
|
||||
imports = with inputs.self.modules.homeManager; [
|
||||
rebuild
|
||||
john
|
||||
mysops
|
||||
janus-ca
|
||||
step-ssh-user
|
||||
mtls
|
||||
restic
|
||||
docker
|
||||
desktop
|
||||
];
|
||||
targets.genericLinux.enable = true;
|
||||
|
||||
shell.program = "zsh";
|
||||
|
||||
home.username = "${username}";
|
||||
home.homeDirectory = "/home/${username}";
|
||||
|
||||
home.packages = with pkgs; [
|
||||
nixos-rebuild
|
||||
(writeShellScriptBin "test-push" ''
|
||||
mkdir -p /var/tmp/nix-build
|
||||
chmod 1777 /var/tmp/nix-build
|
||||
nixos-rebuild switch \
|
||||
--flake ${flakeDir}#john-pc-ubuntu \
|
||||
--target-host root@${testTarget}
|
||||
'')
|
||||
];
|
||||
|
||||
# TODO: make this more restrictive, rather than allowing all unfree packages
|
||||
nixpkgs.config.allowUnfree = true;
|
||||
nixpkgs.config.permittedInsecurePackages = [ "openssl-1.1.1w" ];
|
||||
|
||||
targets.genericLinux.enable = true;
|
||||
|
||||
home.username = "${username}";
|
||||
home.homeDirectory = "/home/${username}";
|
||||
home.packages = [
|
||||
pkgs.nixos-rebuild
|
||||
testPushCmd
|
||||
];
|
||||
|
||||
shell.program = "zsh";
|
||||
|
||||
homeManagerFlakeDir = flakeDir;
|
||||
docker.enable = true;
|
||||
|
||||
@@ -91,10 +95,6 @@ in
|
||||
mtls = {
|
||||
enable = true;
|
||||
subject = hostname;
|
||||
ca = {
|
||||
url = "https://janus.john-stream.com/";
|
||||
fingerprint = "2036c44f7b5901566ff7611ea6c927291ecc6d2dd00779c0eead70ec77fa10d6";
|
||||
};
|
||||
san = [
|
||||
"${hostname}"
|
||||
"192.168.1.85"
|
||||
@@ -7,11 +7,9 @@ in
|
||||
flake.nixosConfigurations."${hostname}" = inputs.nixpkgs.lib.nixosSystem {
|
||||
modules = with inputs.self.modules; [
|
||||
nixos.lxc
|
||||
nixos."${username}"
|
||||
nixos.mysops
|
||||
nixos.step-ssh-host
|
||||
inputs.home-manager.nixosModules.home-manager
|
||||
nixos."${username}"
|
||||
nixos.zsh
|
||||
nixos.login-text
|
||||
# nixos.mtls
|
||||
# nixos.restic-server
|
||||
@@ -24,42 +22,38 @@ in
|
||||
];
|
||||
step-ssh-host = {
|
||||
hostname = hostname;
|
||||
caURL = caURL;
|
||||
};
|
||||
# This provides the secrets at install time
|
||||
sops.defaultSopsFile = ./secrets.yaml;
|
||||
|
||||
home-manager.users."${username}" = {
|
||||
imports = with inputs.self.modules; [
|
||||
homeManager"${hostname}"
|
||||
homeManager."${hostname}"
|
||||
];
|
||||
};
|
||||
}
|
||||
];
|
||||
};
|
||||
|
||||
flake.modules.homeManager."${hostname}" = { config, lib, pkgs, ... }: {
|
||||
flake.modules.homeManager."${hostname}" = { config, pkgs, lib, ... }: {
|
||||
imports = with inputs.self.modules; [
|
||||
homeManager.rebuild
|
||||
homeManager.mysops
|
||||
homeManager.janus-ca
|
||||
homeManager.mtls
|
||||
homeManager.docker
|
||||
];
|
||||
|
||||
homeManagerFlakeDir = "${config.xdg.configHome}/home-manager";
|
||||
home.username = "${username}";
|
||||
home.homeDirectory = "/home/${username}";
|
||||
shell.program = "zsh";
|
||||
docker.enable = true;
|
||||
|
||||
# This will provide the edit-secrets script targeting this file
|
||||
mysops.hostSecretFile = "${config.xdg.configHome}/home-manager/modules/hosts/soteria/secrets.yaml";
|
||||
mysops.hostSecretFile = "${config.homeManagerFlakeDir}/modules/hosts/soteria/secrets.yaml";
|
||||
|
||||
mtls = {
|
||||
enable = true;
|
||||
subject = hostname;
|
||||
ca = {
|
||||
url = "https://janus.john-stream.com/";
|
||||
fingerprint = "2036c44f7b5901566ff7611ea6c927291ecc6d2dd00779c0eead70ec77fa10d6";
|
||||
};
|
||||
san = [
|
||||
"${hostname}.john-stream.com"
|
||||
"192.168.1.142"
|
||||
|
||||
@@ -1,43 +1,91 @@
|
||||
{ inputs, ... }:
|
||||
{ self, inputs, ... }:
|
||||
{
|
||||
flake.modules.homeManager.rebuild =
|
||||
{ pkgs, lib, config, ... }:
|
||||
flake.modules.nixos.rebuild =
|
||||
{ config, pkgs, lib, ... }:
|
||||
let
|
||||
flakeDir = config.rebuild.flakeDir;
|
||||
echoCmd = lib.getExe' pkgs.coreutils "echo";
|
||||
hostnameCmd = "$(${lib.getExe pkgs.hostname} -s)";
|
||||
nfs = (pkgs.writeShellScriptBin "nfs" ''
|
||||
HOSTNAME=${hostnameCmd}
|
||||
${echoCmd} "Switching to the $HOSTNAME nixos profile"
|
||||
sudo ${lib.getExe pkgs.nixos-rebuild} switch --impure --flake ${flakeDir}#$HOSTNAME
|
||||
'');
|
||||
in
|
||||
{
|
||||
options = {
|
||||
homeManagerFlakeDir = lib.mkOption {
|
||||
options.rebuild = {
|
||||
flakeDir = lib.mkOption {
|
||||
description = "Path to the flake directory.";
|
||||
type = lib.types.str;
|
||||
default = "${config.xdg.configHome}/home-manager";
|
||||
description = "Path to the home-manager flake directory.";
|
||||
default = "/etc/nixos";
|
||||
};
|
||||
};
|
||||
|
||||
config = let
|
||||
nixBin = lib.getExe pkgs.nix;
|
||||
flakeDir = config.homeManagerFlakeDir;
|
||||
in
|
||||
{
|
||||
config = {
|
||||
environment.systemPackages = with pkgs; [
|
||||
nfs
|
||||
(writeShellScriptBin "nfsu" ''
|
||||
${lib.getExe nix} flake update --impure --flake ${flakeDir}
|
||||
${lib.getExe git} -C ${flakeDir} add ${flakeDir}/flake.lock > /dev/null 2>&1
|
||||
${lib.getExe nfs}
|
||||
'')
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
flake.modules.homeManager.rebuild =
|
||||
{ config, pkgs, lib, ... }:
|
||||
let
|
||||
nixBin = lib.getExe pkgs.nix;
|
||||
flakeDir = config.homeManagerFlakeDir;
|
||||
echoCmd = lib.getExe' pkgs.coreutils "echo";
|
||||
hostnameCmd = "$(${lib.getExe pkgs.hostname} -s)";
|
||||
nhms = (pkgs.writeShellScriptBin "nhms" ''
|
||||
HOSTNAME=${hostnameCmd}
|
||||
${echoCmd} "Switching to the $HOSTNAME home-manager profile"
|
||||
${lib.getExe pkgs.home-manager} switch --impure --flake ${flakeDir}#$HOSTNAME
|
||||
'');
|
||||
in
|
||||
{
|
||||
options = {
|
||||
homeManagerFlakeDir = lib.mkOption {
|
||||
description = "Path to the home-manager flake directory.";
|
||||
type = lib.types.str;
|
||||
default = "${config.xdg.configHome}/home-manager";
|
||||
};
|
||||
buildHostname = lib.mkOption {
|
||||
description = "Hostname for the NixOS configuration to use.";
|
||||
type = lib.types.str;
|
||||
default = hostnameCmd;
|
||||
};
|
||||
};
|
||||
|
||||
config = {
|
||||
home.activation.printFlakeDir = lib.hm.dag.entryAfter ["writeBoundary"] ''
|
||||
run echo "Home Manager flake directory: ${flakeDir}"
|
||||
run ${echoCmd} "Home Manager flake directory: ${flakeDir}"
|
||||
'';
|
||||
|
||||
home.packages = with pkgs; [
|
||||
home-manager
|
||||
(writeShellScriptBin "flake-parts-test" ''
|
||||
echo "Test ${flakeDir}"
|
||||
'')
|
||||
(writeShellScriptBin "flake-parts-check" ''
|
||||
cd ${flakeDir}
|
||||
${nixBin} run ".#write-flake"
|
||||
${nixBin} run "${flakeDir}#write-flake"
|
||||
${nixBin} flake check
|
||||
'')
|
||||
(writeShellScriptBin "nhms" ''
|
||||
HOSTNAME=$(hostname -s)
|
||||
echo "Switching to the $HOSTNAME profile"
|
||||
${lib.getExe home-manager} switch --impure --flake ${flakeDir}#$HOSTNAME
|
||||
'')
|
||||
nhms
|
||||
(writeShellScriptBin "nhmu" ''
|
||||
${nixBin} flake update --flake ${flakeDir}
|
||||
nhms
|
||||
${lib.getExe nhms}
|
||||
'')
|
||||
|
||||
(writeShellScriptBin "test-build" ''
|
||||
if [ -z "$1" ]; then
|
||||
HOSTNAME=${hostnameCmd}
|
||||
else
|
||||
HOSTNAME="$1"
|
||||
fi
|
||||
${echoCmd} "Testing the evaulation of the nixos config for $HOSTNAME"
|
||||
${lib.getExe nix} eval ${flakeDir}#nixosConfigurations.$HOSTNAME.config.system.build.toplevel.drvPath
|
||||
'')
|
||||
];
|
||||
};
|
||||
|
||||
@@ -1,12 +1,23 @@
|
||||
# Lifted from:
|
||||
# https://github.com/Doc-Steve/dendritic-design-with-flake-parts/blob/69edacdb5a4a6ca71d649bb8eb62cf8c630c8627/modules/users/bob%20%5BNDn%5D/bob.nix#L8
|
||||
{ self, ... }:
|
||||
{ self, inputs, ... }:
|
||||
{
|
||||
config.flake.factory.user = username: isAdmin: {
|
||||
nixos."${username}" = { lib, pkgs, ... }: {
|
||||
config.flake.factory.user = {
|
||||
username,
|
||||
isAdmin ? false,
|
||||
noPassword ? false,
|
||||
# homeImports ? [ ],
|
||||
# homePackages ? [ ],
|
||||
}: {
|
||||
nixos."${username}" = { config, lib, pkgs, ... }: {
|
||||
imports = [
|
||||
inputs.home-manager.nixosModules.home-manager
|
||||
];
|
||||
|
||||
users.users."${username}" = {
|
||||
isNormalUser = true;
|
||||
home = "/home/${username}";
|
||||
shell = lib.mkIf config.programs.zsh.enable pkgs.zsh;
|
||||
extraGroups = [
|
||||
"input"
|
||||
"networkmanager"
|
||||
@@ -21,7 +32,7 @@
|
||||
enable = true;
|
||||
extraRules = [{
|
||||
users = [ "${username}" ];
|
||||
commands = [{
|
||||
commands = lib.mkIf noPassword [{
|
||||
command = "ALL";
|
||||
options = [ "NOPASSWD" ];
|
||||
}];
|
||||
@@ -30,11 +41,10 @@
|
||||
|
||||
# https://github.com/Doc-Steve/dendritic-design-with-flake-parts/wiki/Dendritic_Aspects#multi-context-aspect
|
||||
home-manager.users."${username}" = {
|
||||
imports = [ self.modules.homeManager."${username}" ];
|
||||
home.username = "${username}";
|
||||
home.homeDirectory = "/home/${username}";
|
||||
imports = [
|
||||
self.modules.homeManager."${username}"
|
||||
];
|
||||
# home.packages = homePackages;
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
@@ -0,0 +1,11 @@
|
||||
{ self, inputs, ... }: {
|
||||
flake.modules.homeManager.brave = {
|
||||
programs.brave = {
|
||||
enable = true;
|
||||
extensions = [
|
||||
# https://chromewebstore.google.com/detail/1password-%E2%80%93-password-mana/aeblfdkhhhdcdjpifhhbdiojplfjncoa
|
||||
"aeblfdkhhhdcdjpifhhbdiojplfjncoa"
|
||||
];
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -1,12 +0,0 @@
|
||||
# This module is for programs with GUIs that run in a desktop environment
|
||||
{ inputs, ... }:
|
||||
{
|
||||
flake.modules.homeManager.desktop =
|
||||
{
|
||||
imports = with inputs.self.modules.homeManager; [
|
||||
onepassword
|
||||
ghostty
|
||||
sublime
|
||||
];
|
||||
};
|
||||
}
|
||||
@@ -58,11 +58,16 @@
|
||||
};
|
||||
|
||||
# https://github.com/ghostty-org/ghostty/discussions/3763#discussioncomment-11699970
|
||||
xdg.desktopEntries."com.mitchellh.ghostty" = {
|
||||
xdg.desktopEntries."com.mitchellh.ghostty" =
|
||||
let
|
||||
ghosttyCmd = "nixGLMesa ${lib.getExe pkgs.ghostty}";
|
||||
in
|
||||
{
|
||||
name = "Ghostty";
|
||||
type = "Application";
|
||||
comment = "A terminal emulator";
|
||||
exec = "nixGLMesa ghostty";
|
||||
# exec = "nixGLMesa ghostty";
|
||||
exec = ghosttyCmd;
|
||||
icon = "com.mitchellh.ghostty";
|
||||
terminal = false;
|
||||
startupNotify = true;
|
||||
@@ -79,7 +84,8 @@
|
||||
actions = {
|
||||
new-window = {
|
||||
name = "New Window";
|
||||
exec = "nixGLMesa ghostty";
|
||||
exec = ghosttyCmd;
|
||||
# exec = "nixGLMesa ghostty";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
@@ -1,6 +1,8 @@
|
||||
{
|
||||
flake.modules.homeManager.git = { config, lib, ... }:
|
||||
{
|
||||
{ self, inputs, ... }: {
|
||||
flake.modules.homeManager.git = { config, pkgs, lib, ... }: {
|
||||
home.packages = with pkgs; [
|
||||
git-credential-oauth
|
||||
];
|
||||
programs.git = {
|
||||
enable = true;
|
||||
settings = {
|
||||
@@ -14,5 +16,8 @@
|
||||
enableBashIntegration = true;
|
||||
enableZshIntegration = true;
|
||||
};
|
||||
home.shellAliases = {
|
||||
"lzg" = "lazygit";
|
||||
};
|
||||
};
|
||||
}
|
||||
|
||||
@@ -0,0 +1,33 @@
|
||||
{ self, inputs, ... }: {
|
||||
flake-file.inputs = {
|
||||
wrapper-modules.url = "github:BirdeeHub/nix-wrapper-modules";
|
||||
# wrapper-modules.inputs.nixpkgs.follows = "nixpkgs";
|
||||
};
|
||||
|
||||
flake.modules.nixos.niri = { pkgs, lib, ... }: {
|
||||
programs.niri = {
|
||||
enable = true;
|
||||
package = self.packages.${pkgs.stdenv.hostPlatform.system}.myNiri;
|
||||
};
|
||||
};
|
||||
|
||||
perSystem = { pkgs, lib, self', ... }: {
|
||||
packages.myNiri = inputs.wrapper-modules.wrappers.niri.wrap {
|
||||
inherit pkgs;
|
||||
env.RUST_BACKTRACE = "full";
|
||||
settings = {
|
||||
spawn-at-startup = [
|
||||
"${lib.getExe self'.packages.myNoctalia}"
|
||||
];
|
||||
xwayland-satellite.path = lib.getExe pkgs.xwayland-satellite;
|
||||
input.keyboard.xkb.layout = "us,ua";
|
||||
layout.gaps = 5;
|
||||
binds = {
|
||||
"Mod+Return".spawn-sh = lib.getExe pkgs.ghostty;
|
||||
"Mod+Q".close-window = null;
|
||||
"Mod+S".spawn-sh = "${lib.getExe self'.packages.myNoctalia} ipc call launcher toggle";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,8 @@
|
||||
{ self, inputs, ... }: {
|
||||
perSystem = { pkgs, ... }: {
|
||||
packages.myNoctalia = inputs.wrapper-modules.wrappers.noctalia-shell.wrap {
|
||||
inherit pkgs;
|
||||
# settings = (builtins.fromJSON (builtins.readFile ./noctalia.json)).settings;
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -1,5 +1,16 @@
|
||||
{
|
||||
flake.modules.homeManager.onepassword = {
|
||||
# TODO: Port `_1password = true` behavior into an explicit Home Manager module.
|
||||
{ self, inputs, ... }: {
|
||||
flake.modules.homeManager.onepassword = { config, pkgs, lib, ... }: {
|
||||
home.file.".config/1Password/ssh/agent.toml".text = ''
|
||||
# https://developer.1password.com/docs/ssh/agent/config
|
||||
[[ssh-keys]]
|
||||
vault = "Private"
|
||||
'';
|
||||
programs.ssh = {
|
||||
enable = true;
|
||||
extraConfig = ''
|
||||
Host *
|
||||
IdentityAgent ${config.home.homeDirectory}/.1password/agent.sock
|
||||
'';
|
||||
};
|
||||
};
|
||||
}
|
||||
}
|
||||
|
||||
@@ -40,13 +40,22 @@ in
|
||||
default = "${config.xdg.configHome}/sops/age/keys.txt";
|
||||
};
|
||||
hostSecretFile = lib.mkOption {
|
||||
description = "Path to the secrets file for this host";
|
||||
description = "Path to the secrets file for this host. Used to create the edit-secrets script";
|
||||
type = lib.types.nullOr lib.types.str;
|
||||
default = null;
|
||||
};
|
||||
};
|
||||
|
||||
config = {
|
||||
config =
|
||||
let
|
||||
echo = lib.getExe' pkgs.coreutils "echo";
|
||||
dirname = lib.getExe' pkgs.coreutils "dirname";
|
||||
mkdir = lib.getExe' pkgs.coreutils "mkdir";
|
||||
show-age-key = (pkgs.writeShellScriptBin "show-age-key" ''
|
||||
${lib.getExe' pkgs.age "age-keygen"} -y ${cfg.ageKeyFile}
|
||||
'');
|
||||
in
|
||||
{
|
||||
home.packages = with pkgs; [
|
||||
eza
|
||||
age
|
||||
@@ -56,21 +65,21 @@ in
|
||||
set -eu
|
||||
|
||||
if [ ! -f "${config.ssh.IdentityFile}" ]; then
|
||||
echo "SSH identity file not found: ${config.ssh.IdentityFile}" >&2
|
||||
${echo} "SSH identity file not found: ${config.ssh.IdentityFile}" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if [ -e "${cfg.ageKeyFile}" ]; then
|
||||
echo "Refusing to overwrite existing age key file: ${cfg.ageKeyFile}" >&2
|
||||
${echo} "Refusing to overwrite existing age key file: ${cfg.ageKeyFile}" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
mkdir -p "$(dirname "${cfg.ageKeyFile}")"
|
||||
${mkdir} -p "$(${dirname} "${cfg.ageKeyFile}")"
|
||||
${lib.getExe pkgs.ssh-to-age} -i ${config.ssh.IdentityFile} -private-key > ${cfg.ageKeyFile}
|
||||
echo -n "Created ${cfg.ageKeyFile}: "
|
||||
echo $(show-age-key)
|
||||
${echo} -n "Created ${cfg.ageKeyFile}: "
|
||||
${echo} $(${lib.getExe show-age-key})
|
||||
'')
|
||||
(writeShellScriptBin "show-age-key" "${lib.getExe' pkgs.age "age-keygen"} -y ${cfg.ageKeyFile}")
|
||||
show-age-key
|
||||
(writeShellScriptBin "ls-secrets" "${lib.getExe pkgs.eza} -alT --follow-symlinks ~/.config/sops-nix/secrets")
|
||||
] ++ editScript;
|
||||
|
||||
|
||||
@@ -0,0 +1,14 @@
|
||||
{ self, inputs, ... }: {
|
||||
flake.modules.nixos.steam = {
|
||||
programs.steam = {
|
||||
enable = true;
|
||||
gamescopeSession.enable = true;
|
||||
# Open ports in the firewall for Steam Remote Play
|
||||
remotePlay.openFirewall = true;
|
||||
# Open ports in the firewall for Source Dedicated Server
|
||||
dedicatedServer.openFirewall = true;
|
||||
# Open ports in the firewall for Steam Local Network Game Transfers
|
||||
localNetworkGameTransfers.openFirewall = true;
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -1,9 +1,4 @@
|
||||
{ inputs, ... }:
|
||||
let
|
||||
caURL = "https://janus.john-stream.com/";
|
||||
stepFingerprint = "2036c44f7b5901566ff7611ea6c927291ecc6d2dd00779c0eead70ec77fa10d6";
|
||||
in
|
||||
{
|
||||
{ self, inputs, ... }: {
|
||||
#
|
||||
# Home Manager Module
|
||||
#
|
||||
@@ -17,42 +12,15 @@ in
|
||||
{
|
||||
options.step-ssh-user = {
|
||||
enable = lib.mkEnableOption "opionated step client config for SSH certs";
|
||||
caURL = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "${caURL}";
|
||||
};
|
||||
fingerprint = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "${stepFingerprint}";
|
||||
};
|
||||
rootCertFile = {
|
||||
path = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
description = "String path to where the root_ca.crt file will be stored for the user";
|
||||
default = ".step/certs/root_ca.crt";
|
||||
};
|
||||
source = lib.mkOption {
|
||||
type = lib.types.path;
|
||||
description = "Nix path to the root cert file within the repo";
|
||||
default = ../../keys/root_ca.crt;
|
||||
};
|
||||
};
|
||||
provisioner = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "admin";
|
||||
};
|
||||
principals = lib.mkOption {
|
||||
type = lib.types.listOf lib.types.str;
|
||||
# default = [ ];
|
||||
};
|
||||
};
|
||||
config = lib.mkIf cfg.enable {
|
||||
home.file."${cfg.rootCertFile.path}".source = cfg.rootCertFile.source;
|
||||
home.file.".step/config/defaults.json".text = builtins.toJSON {
|
||||
"ca-url" = cfg.caURL;
|
||||
fingerprint = cfg.fingerprint;
|
||||
root = "${config.home.homeDirectory}/${cfg.rootCertFile.path}";
|
||||
};
|
||||
sops.secrets."janus/admin_jwk".mode = "0400";
|
||||
home.packages = with pkgs; [
|
||||
(writeShellScriptBin "sign-ssh-cert" ''
|
||||
|
||||
@@ -1,8 +0,0 @@
|
||||
{ inputs, pkgs, ... }:
|
||||
{
|
||||
flake.modules.homeManager.sublime = { pkgs, lib, ... }: {
|
||||
home.packages = with pkgs; [
|
||||
sublime4
|
||||
];
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,10 @@
|
||||
{ self, inputs, ... }: {
|
||||
flake.modules.nixos.sudo = {
|
||||
security.sudo-rs = {
|
||||
enable = true;
|
||||
execWheelOnly = false;
|
||||
wheelNeedsPassword = false;
|
||||
extraConfig = "Defaults timestamp_timeout=1440";
|
||||
};
|
||||
};
|
||||
}
|
||||
+23
-18
@@ -1,21 +1,26 @@
|
||||
{
|
||||
flake.modules.homeManager.vscode = { pkgs, ... }:
|
||||
{
|
||||
programs.vscode = {
|
||||
enable = true;
|
||||
package = pkgs.vscode;
|
||||
profiles.default.extensions = with pkgs.vscode-extensions; [
|
||||
mhutchie.git-graph
|
||||
ms-vscode-remote.vscode-remote-extensionpack
|
||||
ms-python.python
|
||||
ms-python.vscode-pylance
|
||||
ms-toolsai.jupyter
|
||||
charliermarsh.ruff
|
||||
github.vscode-pull-request-github
|
||||
github.vscode-github-actions
|
||||
github.copilot
|
||||
catppuccin.catppuccin-vsc
|
||||
];
|
||||
{ self, inputs, ... }: {
|
||||
flake.modules.homeManager.vscode = { config, pkgs, lib, ... }: {
|
||||
options.my-vscode = {
|
||||
enable = lib.mkEnableOption "Enable nix-managed VSCode";
|
||||
};
|
||||
|
||||
config = lib.mkIf config.my-vscode.enable {
|
||||
programs.vscode = {
|
||||
enable = true;
|
||||
package = pkgs.vscode;
|
||||
profiles.default.extensions = with pkgs.vscode-extensions; [
|
||||
mhutchie.git-graph
|
||||
ms-vscode-remote.vscode-remote-extensionpack
|
||||
ms-python.python
|
||||
ms-python.vscode-pylance
|
||||
ms-toolsai.jupyter
|
||||
charliermarsh.ruff
|
||||
github.vscode-pull-request-github
|
||||
github.vscode-github-actions
|
||||
github.copilot
|
||||
catppuccin.catppuccin-vsc
|
||||
];
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,59 @@
|
||||
{ self, inputs, ... }: {
|
||||
flake.modules.nixos.wireguard = { config, pkgs, lib, ... }:
|
||||
let
|
||||
wgInterface = "platform";
|
||||
systemctl = lib.getExe' pkgs.systemd "systemctl";
|
||||
journalctl = lib.getExe' pkgs.systemd "journalctl";
|
||||
|
||||
mkConnect = interface:
|
||||
let
|
||||
serviceName = "wg-quick-${interface}";
|
||||
service = "${serviceName}.service";
|
||||
in
|
||||
pkgs.writeShellScriptBin "wg-connect-${interface}" ''
|
||||
${systemctl} start ${service}
|
||||
start_time=$(${systemctl} show -p ActiveEnterTimestamp ${serviceName} | cut -d= -f2)
|
||||
${journalctl} -u ${service} --since "$start_time" --no-pager
|
||||
'';
|
||||
mkDisconnect = interface:
|
||||
let
|
||||
serviceName = "wg-quick-${interface}";
|
||||
service = "${serviceName}.service";
|
||||
in
|
||||
pkgs.writeShellScriptBin "wg-disconnect-${interface}" ''
|
||||
STOPTIME=$(${lib.getExe' pkgs.coreutils "date"} '+%Y-%m-%d %H:%M:%S')
|
||||
${systemctl} stop ${service}
|
||||
start_time=$(${systemctl} show -p ActiveEnterTimestamp ${serviceName} | cut -d= -f2)
|
||||
${journalctl} -u ${service} --since "$STOPTIME" --no-pager
|
||||
'';
|
||||
in
|
||||
{
|
||||
imports = [ inputs.sops-nix.nixosModules.sops ];
|
||||
|
||||
environment.systemPackages = with pkgs; [
|
||||
wireguard-tools
|
||||
wg-netmanager
|
||||
(mkConnect "platform")
|
||||
(mkDisconnect "platform")
|
||||
];
|
||||
|
||||
sops.secrets.wireguard_private_key = { };
|
||||
networking.wg-quick.interfaces = {
|
||||
${wgInterface} = {
|
||||
autostart = false; # Managed by dispatcher
|
||||
postUp = "echo 'Post up command'";
|
||||
address = [ "192.168.3.5/32" ];
|
||||
dns = [ "192.168.1.150" ];
|
||||
privateKeyFile = config.sops.secrets.wireguard_private_key.path;
|
||||
peers = [
|
||||
{
|
||||
publicKey = "BD1/q18OfpoMCDusNZk9cqB1vvR8bgodZ1L7198jVic=";
|
||||
allowedIPs = [ "192.168.0.0/16" ];
|
||||
endpoint = "wg.john-stream.com:51830";
|
||||
persistentKeepalive = 25;
|
||||
}
|
||||
];
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -1,20 +1,13 @@
|
||||
{ inputs, ... }:
|
||||
{ self, inputs, ... }:
|
||||
{
|
||||
flake.modules.nixos.docker = {
|
||||
virtualisation.docker = {
|
||||
enable = true;
|
||||
};
|
||||
home-manager.sharedModules = with inputs.self.modules.homeManager; [
|
||||
docker
|
||||
];
|
||||
virtualisation.docker.enable = true;
|
||||
home-manager.sharedModules = [ inputs.self.modules.homeManager.docker ];
|
||||
};
|
||||
|
||||
flake.modules.homeManager.docker = { config, lib, pkgs, ... }:
|
||||
{
|
||||
options.docker = {
|
||||
enable = lib.mkEnableOption "Docker tools and utilities";
|
||||
};
|
||||
|
||||
options.docker.enable = lib.mkEnableOption "Docker tools and utilities";
|
||||
config = lib.mkIf config.docker.enable {
|
||||
programs.lazydocker.enable = true;
|
||||
programs.docker-cli.enable = true;
|
||||
|
||||
@@ -2,7 +2,6 @@
|
||||
flake.modules.nixos.step-ssh-host = { config, pkgs, lib, ... }:
|
||||
let
|
||||
cfg = config.step-ssh-host;
|
||||
rootCertPath = "/etc/step/certs/root_ca.crt";
|
||||
provisionerPasswordPath = config.sops.secrets."janus/admin_jwk".path;
|
||||
sshKeyPath = "/etc/ssh/ssh_host_ed25519_key";
|
||||
sshCertPath = "${sshKeyPath}-cert.pub";
|
||||
@@ -11,25 +10,9 @@
|
||||
# NixOS Options
|
||||
options.step-ssh-host = {
|
||||
hostname = lib.mkOption {
|
||||
description = "Networking host name";
|
||||
description = "Networking host name to register with the CA";
|
||||
type = lib.types.str;
|
||||
};
|
||||
caURL = lib.mkOption {
|
||||
description = "URL for the certificate authority";
|
||||
type = lib.types.str;
|
||||
};
|
||||
rootCertFile = {
|
||||
path = lib.mkOption {
|
||||
description = "String path to where the root_ca.crt file will be stored for the user";
|
||||
type = lib.types.str;
|
||||
default = "step/certs/root_ca.crt";
|
||||
};
|
||||
source = lib.mkOption {
|
||||
description = "Nix path to the root cert file within the repo";
|
||||
type = lib.types.path;
|
||||
default = ../../../keys/root_ca.crt;
|
||||
};
|
||||
};
|
||||
provisioner = lib.mkOption {
|
||||
description = "Provisioner inside Step CA to use for the SSH certificates";
|
||||
type = lib.types.str;
|
||||
@@ -38,6 +21,7 @@
|
||||
};
|
||||
|
||||
imports = with inputs.self.modules.nixos; [ ssh ];
|
||||
|
||||
# NixOS Config
|
||||
config = {
|
||||
ssh.certificates.enable = true;
|
||||
@@ -48,15 +32,11 @@
|
||||
};
|
||||
networking.nameservers = [ "192.168.1.150" ];
|
||||
networking.dhcpcd.extraConfig = "nohook resolv.conf";
|
||||
|
||||
environment.etc."${cfg.rootCertFile.path}".source = cfg.rootCertFile.source;
|
||||
environment.systemPackages = with pkgs; [
|
||||
step-cli
|
||||
(writeShellScriptBin "ssh-host-cert-renew" ''
|
||||
${lib.getExe pkgs.step-cli} ssh certificate \
|
||||
--host --sign \
|
||||
--root "${rootCertPath}" \
|
||||
--ca-url ${cfg.caURL} \
|
||||
--provisioner "${cfg.provisioner}" \
|
||||
--provisioner-password-file "${provisionerPasswordPath}" \
|
||||
--principal "${cfg.hostname}" \
|
||||
|
||||
+23
-21
@@ -1,46 +1,48 @@
|
||||
{ inputs, ... }:
|
||||
{ self, inputs, lib, ... }:
|
||||
let
|
||||
username = "john";
|
||||
in
|
||||
{
|
||||
flake = {
|
||||
meta.users."${username}" = {
|
||||
email = "32917998+jsl12@users.noreply.github.com";
|
||||
name = "John Lancaster";
|
||||
username = "${username}";
|
||||
key = "";
|
||||
keygrip = [
|
||||
];
|
||||
authorizedKeys = [
|
||||
# "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIAUa4dcg1TWc4pW++uodyhX4eOqrX/QYIxFWtEP7HFJ john@john-pc-ubuntu"
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMOkGLo4N/L3RYvaIZ1FmePlxa1HK0fMciZxKtRhN58F root@janus"
|
||||
];
|
||||
};
|
||||
flake.meta.users."${username}" = {
|
||||
email = "32917998+jsl12@users.noreply.github.com";
|
||||
name = "John Lancaster";
|
||||
inherit username;
|
||||
key = "";
|
||||
keygrip = [
|
||||
];
|
||||
authorizedKeys = [
|
||||
# "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIAUa4dcg1TWc4pW++uodyhX4eOqrX/QYIxFWtEP7HFJ john@john-pc-ubuntu"
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMOkGLo4N/L3RYvaIZ1FmePlxa1HK0fMciZxKtRhN58F root@janus"
|
||||
];
|
||||
};
|
||||
|
||||
modules = {
|
||||
flake.modules = lib.mkMerge [
|
||||
(self.factory.user {
|
||||
username = username;
|
||||
isAdmin = true;
|
||||
})
|
||||
{
|
||||
nixos."${username}" = {
|
||||
imports = [
|
||||
(inputs.self.factory.user username true).nixos."${username}"
|
||||
inputs.home-manager.nixosModules.home-manager
|
||||
];
|
||||
users.users."${username}" = {
|
||||
openssh.authorizedKeys.keys = inputs.self.meta.users."${username}".authorizedKeys;
|
||||
extraGroups = [ "docker" ];
|
||||
};
|
||||
};
|
||||
|
||||
# This module will be imported by the user factory
|
||||
homeManager."${username}" = with inputs.self.meta.users."${username}"; {
|
||||
home.stateVersion = "25.11";
|
||||
xdg.enable = true;
|
||||
|
||||
programs.git.settings.user.name = name;
|
||||
programs.git.settings.user.email = email;
|
||||
|
||||
imports = with inputs.self.modules.homeManager; [
|
||||
ssh
|
||||
shell-tools
|
||||
git
|
||||
];
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
];
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user