diff --git a/flake.nix b/flake.nix index bf6fc2c..5ed22ed 100644 --- a/flake.nix +++ b/flake.nix @@ -102,6 +102,15 @@ ++ sharedModules; }; + hades = nixpkgs.lib.nixosSystem rec { + inherit system; + modules = + [ + ./hades.nix + ] + ++ sharedModules; + }; + boreal = nixpkgs.lib.nixosSystem rec { inherit system; modules = diff --git a/hades.nix b/hades.nix new file mode 100644 index 0000000..26018f0 --- /dev/null +++ b/hades.nix @@ -0,0 +1,23 @@ +{...}: { + imports = [ + # Default configuration + ./base + + # Module definitions + ./modules + + # Service definitions + ./services + + # Host-specific config + ./hosts/hades + ]; + + # This value determines the NixOS release from which the default + # settings for stateful data, like file locations and database versions + # on your system were taken. It‘s perfectly fine and recommended to leave + # this value at the release version of the first install of this system. + # Before changing this value read the documentation for this option + # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html). + system.stateVersion = "22.05"; # Did you read the comment? +} diff --git a/hosts/hades/default.nix b/hosts/hades/default.nix new file mode 100644 index 0000000..95e529a --- /dev/null +++ b/hosts/hades/default.nix @@ -0,0 +1,71 @@ +# Edit this configuration file to define what should be installed on +# your system. Help is available in the configuration.nix(5) man page +# and in the NixOS manual (accessible by running ‘nixos-help’). +{ + config, + lib, + pkgs, + ... +}: let + secrets = config.my.secrets; +in { + imports = [ + # Include the results of the hardware scan. + ./hardware-configuration.nix + + ./home.nix + ./secrets.nix + ]; + + boot.loader.systemd-boot.enable = false; + boot.loader.grub = { + enable = true; + efiSupport = false; + devices = ["/dev/sda" "/dev/sdb"]; + }; + + boot.tmpOnTmpfs = true; + + networking.hostName = "hades"; # Define your hostname. + networking.domain = "alarsyo.net"; + + # Set your time zone. + time.timeZone = "Europe/Paris"; + + networking.useDHCP = false; + networking.interfaces.enp35s0.ipv4.addresses = [ + { + address = "95.217.121.60"; + prefixLength = 26; + } + ]; + networking.interfaces.enp35s0.ipv6.addresses = [ + { + address = "2a01:4f9:4a:3649::2"; + prefixLength = 64; + } + ]; + networking.defaultGateway = "95.217.121.1"; + networking.defaultGateway6 = { + address = "fe80::1"; + interface = "enp35s0"; + }; + networking.nameservers = ["1.1.1.1" "1.0.0.1"]; + my.networking.externalInterface = "enp35s0"; + + # List services that you want to enable: + my.services = { + tailscale = { + enable = true; + exitNode = true; + }; + }; + + # Enable the OpenSSH daemon. + services.openssh.enable = true; + services.openssh.permitRootLogin = "no"; + services.openssh.passwordAuthentication = false; + + # Takes a long while to build + documentation.nixos.enable = false; +} diff --git a/hosts/hades/hardware-configuration.nix b/hosts/hades/hardware-configuration.nix new file mode 100644 index 0000000..57882a3 --- /dev/null +++ b/hosts/hades/hardware-configuration.nix @@ -0,0 +1,29 @@ +# Do not modify this file! It was generated by ‘nixos-generate-config’ +# and may be overwritten by future invocations. Please make changes +# to /etc/nixos/configuration.nix instead. +{ + config, + lib, + pkgs, + modulesPath, + ... +}: { + imports = [ + (modulesPath + "/installer/scan/not-detected.nix") + ]; + + boot.initrd.availableKernelModules = ["ahci" "sd_mod"]; + boot.initrd.kernelModules = ["dm-snapshot"]; + boot.kernelModules = ["kvm-amd"]; + boot.extraModulePackages = []; + + fileSystems."/" = { + device = "/dev/disk/by-uuid/2a24010c-14bd-439b-b30b-d0e18db69952"; + fsType = "ext4"; + }; + + swapDevices = []; + + powerManagement.cpuFreqGovernor = lib.mkDefault "ondemand"; + hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware; +} diff --git a/hosts/hades/home.nix b/hosts/hades/home.nix new file mode 100644 index 0000000..3bb7dab --- /dev/null +++ b/hosts/hades/home.nix @@ -0,0 +1,5 @@ +{config, ...}: { + home-manager.users.alarsyo = { + my.theme = config.home-manager.users.alarsyo.my.themes.solarizedLight; + }; +} diff --git a/hosts/hades/secrets.nix b/hosts/hades/secrets.nix new file mode 100644 index 0000000..3fbc379 --- /dev/null +++ b/hosts/hades/secrets.nix @@ -0,0 +1,20 @@ +{ + config, + lib, + options, + ... +}: { + config.age = { + secrets = let + toSecret = name: {...} @ attrs: + { + file = ./../../modules/secrets + "/${name}.age"; + } + // attrs; + in + lib.mapAttrs toSecret { + "users/alarsyo-hashed-password" = {}; + "users/root-hashed-password" = {}; + }; + }; +} diff --git a/modules/secrets/secrets.nix b/modules/secrets/secrets.nix index 7e1ce4b..68137cc 100644 --- a/modules/secrets/secrets.nix +++ b/modules/secrets/secrets.nix @@ -3,10 +3,11 @@ let users = [alarsyo]; boreal = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAagal1aqZh52wEmgsw7fkCzO41o4Cx+nV4wJGZuX1RP root@boreal"; + hades = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMxw8CtKUPAiPdKDEnuS7UyRrZN5BkUwsy5UPVF8V+lt root@hades"; poseidon = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKYhZYMbWQG9TSQ2qze8GgFo2XrZzgu/GuSOGwenByJo root@poseidon"; zephyrus = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILU4JfIADH9MXUnVe+3ezYK9WXsqy/jJcm1zFkmL4aSU root@zephyrus"; - machines = [boreal poseidon zephyrus]; + machines = [boreal hades poseidon zephyrus]; all = users ++ machines; in { diff --git a/modules/secrets/users/alarsyo-hashed-password.age b/modules/secrets/users/alarsyo-hashed-password.age index 9d80aa7..f9a9f83 100644 Binary files a/modules/secrets/users/alarsyo-hashed-password.age and b/modules/secrets/users/alarsyo-hashed-password.age differ diff --git a/modules/secrets/users/root-hashed-password.age b/modules/secrets/users/root-hashed-password.age index b0ef183..0eff2bd 100644 Binary files a/modules/secrets/users/root-hashed-password.age and b/modules/secrets/users/root-hashed-password.age differ