cleanup

flake.lock

@@ -53,24 +53,6 @@
         "type": "github"
       }
     },
-    "flake-utils_2": {
-      "inputs": {
-        "systems": "systems_2"
-      },
-      "locked": {
-        "lastModified": 1681202837,
-        "narHash": "sha256-H+Rh19JDwRtpVPAWp64F+rlEtxUWBAQW28eAi3SRSzg=",
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "rev": "cfacdce06f30d2b68473a46042957675eebb3401",
-        "type": "github"
-      },
-      "original": {
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "type": "github"
-      }
-    },
     "home-manager": {
       "inputs": {
         "nixpkgs": "nixpkgs"
@@ -125,6 +107,22 @@
         "type": "github"
       }
     },
+    "nixos-hardware": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1774465523,
+        "narHash": "sha256-4v7HPm63Q90nNn4fgkgKsjW1AH2Klw7XzPtHJr562nM=",
+        "owner": "NixOS",
+        "repo": "nixos-hardware",
+        "rev": "de895be946ad1d8aafa0bb6dfc7e7e0e9e466a29",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "repo": "nixos-hardware",
+        "type": "github"
+      }
+    },
     "nixpkgs": {
       "locked": {
         "lastModified": 1773389992,
@@ -154,20 +152,6 @@
         "url": "https://channels.nixos.org/nixpkgs-unstable/nixexprs.tar.xz"
       }
     },
-    "nixpkgs_3": {
-      "locked": {
-        "lastModified": 1682134069,
-        "narHash": "sha256-TnI/ZXSmRxQDt2sjRYK/8j8iha4B4zP2cnQCZZ3vp7k=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "fd901ef4bf93499374c5af385b2943f5801c0833",
-        "type": "github"
-      },
-      "original": {
-        "id": "nixpkgs",
-        "type": "indirect"
-      }
-    },
     "root": {
       "inputs": {
         "flake-file": "flake-file",
@@ -175,12 +159,12 @@
         "home-manager": "home-manager",
         "import-tree": "import-tree",
         "nixgl": "nixgl",
+        "nixos-hardware": "nixos-hardware",
         "nixpkgs": "nixpkgs_2",
         "nixpkgs-lib": [
           "nixpkgs"
         ],
-        "sops-nix": "sops-nix",
-        "vscode-server": "vscode-server"
+        "sops-nix": "sops-nix"
       }
     },
     "sops-nix": {
@@ -217,40 +201,6 @@
         "repo": "default",
         "type": "github"
       }
-    },
-    "systems_2": {
-      "locked": {
-        "lastModified": 1681028828,
-        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
-        "owner": "nix-systems",
-        "repo": "default",
-        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-systems",
-        "repo": "default",
-        "type": "github"
-      }
-    },
-    "vscode-server": {
-      "inputs": {
-        "flake-utils": "flake-utils_2",
-        "nixpkgs": "nixpkgs_3"
-      },
-      "locked": {
-        "lastModified": 1770124655,
-        "narHash": "sha256-yHmd2B13EtBUPLJ+x0EaBwNkQr9LTne1arLVxT6hSnY=",
-        "owner": "nix-community",
-        "repo": "nixos-vscode-server",
-        "rev": "92ce71c3ba5a94f854e02d57b14af4997ab54ef0",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-community",
-        "repo": "nixos-vscode-server",
-        "type": "github"
-      }
     }
   },
   "root": "root",

flake.nix

@@ -1,28 +1,29 @@
 # DO-NOT-EDIT. This file was auto-generated using github:vic/flake-file.
 # Use `nix run .#write-flake` to regenerate it.
 {
-
   outputs = inputs: inputs.flake-parts.lib.mkFlake { inherit inputs; } (inputs.import-tree ./modules);
 
   inputs = {
     flake-file.url = "github:vic/flake-file";
     flake-parts = {
-      inputs.nixpkgs-lib.follows = "nixpkgs-lib";
       url = "github:hercules-ci/flake-parts";
+      inputs.nixpkgs-lib.follows = "nixpkgs-lib";
     };
     home-manager.url = "github:nix-community/home-manager";
     import-tree.url = "github:vic/import-tree";
     nixgl = {
-      inputs.nixpkgs.follows = "nixpkgs";
       url = "github:nix-community/nixGL";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+    nixos-hardware = {
+      url = "github:NixOS/nixos-hardware";
+      flake = false;
     };
     nixpkgs.url = "https://channels.nixos.org/nixpkgs-unstable/nixexprs.tar.xz";
     nixpkgs-lib.follows = "nixpkgs";
     sops-nix = {
-      inputs.nixpkgs.follows = "nixpkgs";
       url = "github:Mic92/sops-nix";
+      inputs.nixpkgs.follows = "nixpkgs";
     };
-    vscode-server.url = "github:nix-community/nixos-vscode-server";
   };
-
 }

modules/hosts/janus/default.nix

@@ -2,9 +2,17 @@
 let
   username = "john";
   hostname = "janus";
-  caURL = "https://janus.john-stream.com/";
 in
 {
+  flake.modules.homeManager.janus-ca = { config, ... }: {
+    home.file.".step/config/defaults.json".text = builtins.toJSON {
+      "ca-url" = "https://janus.john-stream.com/";
+      fingerprint = "2036c44f7b5901566ff7611ea6c927291ecc6d2dd00779c0eead70ec77fa10d6";
+      root = "${config.home.homeDirectory}/.step/certs/root_ca.crt";
+    };
+    home.file.".step/certs/root_ca.crt".source = ./root_ca.crt;
+  };
+
   flake.nixosConfigurations."${hostname}" = inputs.nixpkgs.lib.nixosSystem {
     modules = with inputs.self.modules; [
       nixos.lxc
@@ -20,12 +28,10 @@ in
         networking.hostName = hostname;
         step-ssh-host = {
           hostname = hostname;
-          caURL = caURL;
         };
         mtls = {
           enable = true;
           subject = hostname;
-          caURL = caURL;
           san = [
             "${hostname}.john-stream.com"
             "192.168.1.244"
@@ -36,6 +42,7 @@ in
           imports = with inputs.self.modules.homeManager; [
             sops
             step-ssh-user
+            janus-ca
           ];
           
           shell.program = "zsh";

modules/hosts/john-p14s/configuration.nix

@@ -0,0 +1,138 @@
+{ self, inputs, ... }:
+{
+  flake.modules.nixos.p14sConfiguration = { pkgs, lib, ... }: {
+    imports = [
+      self.modules.nixos.p14sHardware
+    ];
+
+    nix.settings.experimental-features = [ "nix-command" "flakes" ];
+    nixpkgs.config.allowUnfree = true;
+
+    networking = {
+      hostName = "john-p14s";
+      networkmanager.enable = true;
+    };
+
+    # Enable automatic login for the user.
+    services.displayManager.autoLogin.enable = true;
+    services.displayManager.autoLogin.user = "john";
+
+    # Define a user account. Don't forget to set a password with 'passwd'.
+    users.users.john = {
+      isNormalUser = true;
+      description = "John Lancaster";
+      extraGroups = [
+        "networkmanager"
+        "wheel"
+        "docker"
+      ];
+      shell = pkgs.zsh;
+    };
+
+    programs.zsh.enable = true;
+
+    # Workaround for GNOME autologin: https://github.com/NixOS/nixpkgs/issues/103746#issuecomment-945091229
+    systemd.services."getty@tty1".enable = false;
+    systemd.services."autovt@tty1".enable = false;
+
+    services.openssh.enable = true;
+    services.tailscale.enable = true;
+
+    # List packages installed in system profile. To search, run:
+    # $ nix search wget
+    environment.systemPackages = with pkgs; [
+      wget
+      cacert
+      busybox
+      dig
+      samba
+    ];
+
+    virtualisation.docker = {
+      enable = true;
+      enableOnBoot = true;
+    };
+
+    # For gnome systray icons
+    services.udev.packages = with pkgs; [ gnome-settings-daemon ];
+
+    security.pam.services.swaylock = {};
+    security.pam.services.swaylock.fprintAuth = true;
+
+    programs._1password.enable = true;
+    programs._1password-gui = {
+      enable = true;
+      # Certain features, including CLI integration and system authentication support,
+      # require enabling PolKit integration on some desktop environments (e.g. Plasma).
+      polkitPolicyOwners = [ "john" ];
+      # TODO this should not be a hardcoded username
+    };
+
+    # This is needed for VSCode remote support. Read: https://nixos.wiki/wiki/Visual_Studio_Code
+    programs.nix-ld.enable = true;
+
+    programs.steam = {
+      enable = true;
+      gamescopeSession.enable = true;
+      remotePlay.openFirewall = true; # Open ports in the firewall for Steam Remote Play
+      dedicatedServer.openFirewall = true; # Open ports in the firewall for Source Dedicated Server
+      localNetworkGameTransfers.openFirewall = true; # Open ports in the firewall for Steam Local Network Game Transfers
+    };
+
+    # progams.gamemode.enable = true;
+
+    # Some programs need SUID wrappers, can be configured further or are
+    # started in user sessions.
+    # programs.mtr.enable = true;
+    # programs.gnupg.agent = {
+    #   enable = true;
+    #   enableSSHSupport = true;
+    # };
+
+    # This value determines the NixOS release from which the default
+    # settings for stateful data, like file locations and database versions
+    # on your system were taken. It's perfectly fine and recommended to leave
+    # this value at the release version of the first install of this system.
+    # Before changing this value read the documentation for this option
+    # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
+    system.stateVersion = "24.05"; # Did you read the comment?
+
+    # Set your time zone.
+    time.timeZone = "America/Chicago";
+
+    # Select internationalisation properties.
+    i18n.defaultLocale = "en_US.UTF-8";
+
+    i18n.extraLocaleSettings = {
+      LC_ADDRESS = "en_US.UTF-8";
+      LC_IDENTIFICATION = "en_US.UTF-8";
+      LC_MEASUREMENT = "en_US.UTF-8";
+      LC_MONETARY = "en_US.UTF-8";
+      LC_NAME = "en_US.UTF-8";
+      LC_NUMERIC = "en_US.UTF-8";
+      LC_PAPER = "en_US.UTF-8";
+      LC_TELEPHONE = "en_US.UTF-8";
+      LC_TIME = "en_US.UTF-8";
+    };
+
+    # Enables fingerprint sensor
+    services.fprintd.enable = true;
+
+    # Enable sound with pipewire.
+    services.pulseaudio.enable = false;
+    security.rtkit.enable = true; # PulseAudio server uses this to acquire realtime priority.
+    services.pipewire = {
+      enable = true;
+      alsa.enable = true;
+      alsa.support32Bit = true;
+      pulse.enable = true;
+      # If you want to use JACK applications, uncomment this
+      #jack.enable = true;
+
+      # use the example session manager (no others are packaged yet so this is enabled by default,
+      # no need to redefine it in your config for now)
+      # media-session.enable = true;
+    };
+
+  };
+}

modules/hosts/john-p14s/default.nix

@@ -0,0 +1,16 @@
+{ self, inputs, ... }: {
+  flake-file.inputs = {
+    nixos-hardware = {
+      url = "github:NixOS/nixos-hardware";
+      flake = false;
+    };
+  };
+
+  flake.nixosConfigurations.john-p14s = inputs.nixpkgs.lib.nixosSystem {
+    modules = [
+      "${inputs.nixos-hardware}/lenovo/thinkpad/p14s"
+      "${inputs.nixos-hardware}/lenovo/thinkpad/p14s/amd/gen4"
+      self.modules.nixos.p14sConfiguration
+    ];
+  };
+}

modules/hosts/john-p14s/hardware.nix

@@ -0,0 +1,40 @@
+{ self, inputs, ... }: {
+  flake.modules.nixos.p14sHardware = { config, lib, pkgs, modulesPath, ... }: {
+    imports =[
+      (modulesPath + "/installer/scan/not-detected.nix")
+    ];
+
+
+    boot.loader.systemd-boot.enable = true;
+    boot.loader.efi.canTouchEfiVariables = true;
+    boot.initrd.availableKernelModules = [ "nvme" "xhci_pci" "thunderbolt" "usb_storage" "usbhid" "sd_mod" ];
+    boot.initrd.kernelModules = [ "amdgpu" ];
+    boot.kernelModules = [ "kvm-amd" ];
+    boot.extraModulePackages = [ ];
+
+    fileSystems."/" = {
+      device = "/dev/disk/by-uuid/fbc7d8bc-080b-4554-a2b2-5f92d059ce07";
+      fsType = "ext4";
+    };
+
+    fileSystems."/boot" = {
+      device = "/dev/disk/by-uuid/9A04-ADD8";
+      fsType = "vfat";
+      options = [ "fmask=0022" "dmask=0022" ];
+    };
+
+    swapDevices = [ ];
+
+    # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+    # (the default) this is the recommended approach. When using systemd-networkd it's
+    # still possible to use this option, but it's recommended to use it in conjunction
+    # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+    networking.useDHCP = lib.mkDefault true;
+    # networking.interfaces.enp102s0u2u4.useDHCP = lib.mkDefault true;
+    # networking.interfaces.enp1s0f0.useDHCP = lib.mkDefault true;
+    # networking.interfaces.wlp2s0.useDHCP = lib.mkDefault true;
+
+    nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+    hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+  };
+}

modules/hosts/john-pc/default.nix

@@ -10,7 +10,6 @@ in
   let
     flakeDir = "${config.xdg.configHome}/home-manager/jsl-dendritic";
     certDir = "${config.mtls.certDir}";
-    CACert = "${certDir}/root_ca.crt";
     mtlsBundle = "${certDir}/${config.mtls.bundleFilename}";
     resticPasswordFile = "${config.xdg.configHome}/restic/password.txt";
   in
@@ -19,6 +18,7 @@ in
       rebuild
       john
       mysops
+      janus-ca
       step-ssh-user
       mtls
       restic
@@ -91,10 +91,6 @@ in
     mtls = {
       enable = true;
       subject = hostname;
-      ca = {
-        url = "https://janus.john-stream.com/";
-        fingerprint = "2036c44f7b5901566ff7611ea6c927291ecc6d2dd00779c0eead70ec77fa10d6";
-      };
       san = [
         "${hostname}"
         "192.168.1.85"

modules/hosts/soteria/soteria.nix

@@ -24,7 +24,6 @@ in
         ];
         step-ssh-host = {
           hostname = hostname;
-          caURL = caURL;
         };
 
         home-manager.users."${username}" = {
@@ -40,6 +39,7 @@ in
     imports = with inputs.self.modules; [
       homeManager.rebuild
       homeManager.mysops
+      homeManager.janus-ca
       homeManager.mtls
       homeManager.docker
     ];
@@ -56,10 +56,6 @@ in
     mtls = {
       enable = true;
       subject = hostname;
-      ca = {
-        url = "https://janus.john-stream.com/";
-        fingerprint = "2036c44f7b5901566ff7611ea6c927291ecc6d2dd00779c0eead70ec77fa10d6";
-      };
       san = [
         "${hostname}.john-stream.com"
         "192.168.1.142"

modules/programs/step-client.nix

@@ -1,9 +1,4 @@
-{ inputs, ... }:
-let
-  caURL = "https://janus.john-stream.com/";
-  stepFingerprint = "2036c44f7b5901566ff7611ea6c927291ecc6d2dd00779c0eead70ec77fa10d6";
-in
-{
+{ self, inputs, ... }: {
   #
   # Home Manager Module
   #
@@ -17,42 +12,15 @@ in
   {
     options.step-ssh-user = {
       enable = lib.mkEnableOption "opionated step client config for SSH certs";
-      caURL = lib.mkOption {
-        type = lib.types.str;
-        default = "${caURL}";
-      };
-      fingerprint = lib.mkOption {
-        type = lib.types.str;
-        default = "${stepFingerprint}";
-      };
-      rootCertFile = {
-        path = lib.mkOption {
-          type = lib.types.str;
-          description = "String path to where the root_ca.crt file will be stored for the user";
-          default = ".step/certs/root_ca.crt";
-        };
-        source = lib.mkOption {
-          type = lib.types.path;
-          description = "Nix path to the root cert file within the repo";
-          default = ../../keys/root_ca.crt;
-        };
-      };
       provisioner = lib.mkOption {
         type = lib.types.str;
         default = "admin";
       };
       principals = lib.mkOption {
         type = lib.types.listOf lib.types.str;
-        # default = [ ];
       };
     };
     config = lib.mkIf cfg.enable {
-      home.file."${cfg.rootCertFile.path}".source = cfg.rootCertFile.source;
-      home.file.".step/config/defaults.json".text = builtins.toJSON {
-        "ca-url" = cfg.caURL;
-        fingerprint = cfg.fingerprint;
-        root = "${config.home.homeDirectory}/${cfg.rootCertFile.path}";
-      };
       sops.secrets."janus/admin_jwk".mode = "0400";
       home.packages = with pkgs; [
         (writeShellScriptBin "sign-ssh-cert" ''

modules/services/step-ca/mtls.nix

@@ -3,14 +3,6 @@ let
   # Options that will be in common between
   opts = {
     enable = lib.mkEnableOption "Enable mTLS";
-    ca = {
-      url = lib.mkOption {
-        type = lib.types.str;
-      };
-      fingerprint = lib.mkOption {
-        type = lib.types.str;
-      };
-    };
     subject = lib.mkOption {
       description = "The Common Name, DNS Name, or IP address that will be set as the Subject Common Name for the certificate. If no Subject Alternative Names (SANs) are configured (via the --san flag) then the subject will be set as the only SAN.";
       type = lib.types.str;
@@ -92,9 +84,12 @@ let
     systemctlArgs ? [ ],
   }:
   let
+    systemctl = lib.getExe' pkgs.systemd "systemctl";
+    escapedArgs = lib.escapeShellArgs systemctlArgs;
+    systemctlCommand = "${systemctl} ${escapedArgs}";
     renewReloadScript = lib.concatMapStringsSep "\n" (unit: ''
-      if ${lib.getExe' pkgs.systemd "systemctl"} ${lib.escapeShellArgs systemctlArgs} --quiet is-active "${unit}"; then
-        ${lib.getExe' pkgs.systemd "systemctl"} ${lib.escapeShellArgs systemctlArgs} try-reload-or-restart "${unit}"
+      if ${systemctlCommand} --quiet is-active "${unit}"; then
+        ${systemctlCommand} try-reload-or-restart "${unit}"
       fi
     '') reloadUnits;
     renewPostCommands = lib.concatStringsSep "\n" postCommands;
@@ -221,7 +216,6 @@ in
       tlsKey = "${certDir}/${cfg.keyFilename}";
       tlsCert = "${certDir}/${cfg.certFilename}";
       mtlsBundle = "${certDir}/${cfg.bundleFilename}";
-      rootCA = "${certDir}/root_ca.crt";
       sanArgs = lib.concatMapStringsSep " " (san: "--san \"${san}\"") cfg.san;
     in
     {
@@ -264,7 +258,6 @@ in
       tlsKey = "${certDir}/${cfg.keyFilename}";
       tlsCert = "${certDir}/${cfg.certFilename}";
       mtlsBundle = "${certDir}/${cfg.bundleFilename}";
-      rootCA = "${certDir}/root_ca.crt";
       sanArgs = lib.concatMapStringsSep " " (san: "--san \"${san}\"") cfg.san;
     in
     {
@@ -277,12 +270,6 @@ in
       };
 
       config = {
-        home.file.".step/config/defaults.json".text = builtins.toJSON {
-          "ca-url" = cfg.ca.url;
-          fingerprint = cfg.ca.fingerprint;
-          root = "${cfg.certDir}/root_ca.crt";
-        };
-
         home.packages = with pkgs; lib.optionals cfg.enable [
           step-cli
           (writeShellScriptBin "mtls-generate" ''

modules/services/step-ca/ssh-host.nix

@@ -2,7 +2,6 @@
   flake.modules.nixos.step-ssh-host = { config, pkgs, lib, ... }:
   let
     cfg = config.step-ssh-host;
-    rootCertPath = "/etc/step/certs/root_ca.crt";
     provisionerPasswordPath = config.sops.secrets."janus/admin_jwk".path;
     sshKeyPath = "/etc/ssh/ssh_host_ed25519_key";
     sshCertPath = "${sshKeyPath}-cert.pub";
@@ -11,25 +10,9 @@
     # NixOS Options
     options.step-ssh-host = {
       hostname = lib.mkOption {
-        description = "Networking host name";
+        description = "Networking host name to register with the CA";
         type = lib.types.str;
       };
-      caURL = lib.mkOption {
-        description = "URL for the certificate authority";
-        type = lib.types.str;
-      };
-      rootCertFile = {
-        path = lib.mkOption {
-          description = "String path to where the root_ca.crt file will be stored for the user";
-          type = lib.types.str;
-          default = "step/certs/root_ca.crt";
-        };
-        source = lib.mkOption {
-          description = "Nix path to the root cert file within the repo";
-          type = lib.types.path;
-          default = ../../../keys/root_ca.crt;
-        };
-      };
       provisioner = lib.mkOption {
         description = "Provisioner inside Step CA to use for the SSH certificates";
         type = lib.types.str;
@@ -38,6 +21,7 @@
     };
 
     imports = with inputs.self.modules.nixos; [ ssh ];
+
     # NixOS Config
     config = {
       ssh.certificates.enable = true;
@@ -48,15 +32,11 @@
       };
       networking.nameservers = [ "192.168.1.150" ];
       networking.dhcpcd.extraConfig = "nohook resolv.conf";
-
-      environment.etc."${cfg.rootCertFile.path}".source = cfg.rootCertFile.source;
       environment.systemPackages = with pkgs; [
         step-cli
         (writeShellScriptBin "ssh-host-cert-renew" ''
           ${lib.getExe pkgs.step-cli} ssh certificate \
           --host --sign \
-          --root "${rootCertPath}" \
-          --ca-url ${cfg.caURL} \
           --provisioner "${cfg.provisioner}" \
           --provisioner-password-file "${provisionerPasswordPath}" \
           --principal "${cfg.hostname}" \