john/dendritic
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

started soteria homeconfiguration

Browse Source
This commit is contained in:
John Lancaster
2026-03-22 10:33:33 -05:00
parent 1d3847ec12
commit e925b43a2d
3 changed files with 389 additions and 31 deletions
Download Patch File Download Diff File Expand all files Collapse all files

40
modules/hosts/john-pc-ubuntu.nix
View File

@@ -2,7 +2,8 @@
let
username = "john";
hostname = "john-pc-ubuntu";
testTarget = "fded:fb16:653e:25da:be24:11ff:fea0:753f";
# testTarget = "fded:fb16:653e:25da:be24:11ff:fea0:753f";
testTarget = "fded:fb16:653e:25da:be24:11ff:fe89:1cc3";
in
{
flake.modules.homeManager."${hostname}" = { pkgs, config, ... }:
@@ -34,28 +35,14 @@ in
home.packages = with pkgs; [
nixos-rebuild
(writeShellScriptBin "test-push" ''
nixos-rebuild switch --flake ${flakeDir}#soteria --target-host root@${testTarget}
mkdir -p /var/tmp/nix-build
chmod 1777 /var/tmp/nix-build
nixos-rebuild switch \
--flake ${flakeDir}#john-pc-ubuntu \
--target-host root@${testTarget}
'')
];
mtls = {
enable = true;
caURL = "https://janus.john-stream.com/";
provisioner = "admin";
subject = hostname;
san = [
"${hostname}"
"192.168.1.85"
"spiffe://john-stream.com/ubuntu"
];
lifetime = "1h";
renew.onCalendar = "*:1/10";
};
# TODO: Add host-specific settings here:
# - sops secret for `restic_password/john_ubuntu`
# - zsh RESTIC* session variables
# TODO: make this more restrictive, rather than allowing all unfree packages
nixpkgs.config.allowUnfree = true;
nixpkgs.config.permittedInsecurePackages = [ "openssl-1.1.1w" ];
@@ -93,6 +80,19 @@ in
"/home/john/john-nas"
];
};
mtls = {
enable = true;
caURL = "https://janus.john-stream.com/";
provisioner = "admin";
subject = hostname;
san = [
"${hostname}"
"192.168.1.85"
"spiffe://john-stream.com/ubuntu"
];
lifetime = "1h";
renew.onCalendar = "*:1/10";
};
};
flake.homeConfigurations."${hostname}" = inputs.home-manager.lib.homeManagerConfiguration {