hades: use tmpfs for /tmp

flake.nix

@@ -102,6 +102,15 @@
             ++ sharedModules;
         };
 
+        hades = nixpkgs.lib.nixosSystem rec {
+          inherit system;
+          modules =
+            [
+              ./hades.nix
+            ]
+            ++ sharedModules;
+        };
+
         boreal = nixpkgs.lib.nixosSystem rec {
           inherit system;
           modules =

hades.nix

@@ -0,0 +1,23 @@
+{...}: {
+  imports = [
+    # Default configuration
+    ./base
+
+    # Module definitions
+    ./modules
+
+    # Service definitions
+    ./services
+
+    # Host-specific config
+    ./hosts/hades
+  ];
+
+  # This value determines the NixOS release from which the default
+  # settings for stateful data, like file locations and database versions
+  # on your system were taken. It‘s perfectly fine and recommended to leave
+  # this value at the release version of the first install of this system.
+  # Before changing this value read the documentation for this option
+  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
+  system.stateVersion = "22.05"; # Did you read the comment?
+}

hosts/hades/configuration.nix

@@ -0,0 +1,84 @@
+{ config, pkgs, ... }:
+{
+  imports = [
+    ./hardware-configuration.nix
+  ];
+
+  services.openssh.enable = true;
+  users.users.root.openssh.authorizedKeys.keys = [
+    # Replace with your public key
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIH3rrF3VSWI4n4cpguvlmLAaU3uftuX4AVV/39S/8GO9 alarsyo@thinkpad"
+  ];
+  users.users.root.initialHashedPassword = "";
+  services.openssh.permitRootLogin = "prohibit-password";
+  users.users.alarsyo = {
+    password = "toto";
+    isNormalUser = true;
+    extraGroups = [
+      "media"
+      "networkmanager"
+      "video" # for `light` permissions
+      "docker"
+      "wheel" # Enable ‘sudo’ for the user.
+    ];
+    shell = pkgs.fish;
+    openssh.authorizedKeys.keys = [
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIH3rrF3VSWI4n4cpguvlmLAaU3uftuX4AVV/39S/8GO9 alarsyo@thinkpad"
+    ];
+  };
+
+
+  networking.useDHCP = false;
+  networking.interfaces.enp35s0.ipv4.addresses = [
+    {
+      address = "95.217.121.60";
+      prefixLength = 26;
+    }
+  ];
+  networking.interfaces.enp35s0.ipv6.addresses = [
+    {
+      address = "2a01:4f9:4a:3649::2";
+      prefixLength = 64;
+    }
+  ];
+  networking.defaultGateway = "95.217.121.1";
+  networking.defaultGateway6 = { address = "fe80::1"; interface = "enp35s0"; };
+  networking.nameservers = [ "1.1.1.1" "1.0.0.1" ];
+  networking.hostName = "hades";
+
+  boot.loader.systemd-boot.enable = false;
+  boot.loader.grub = {
+    enable = true;
+    efiSupport = false;
+    devices = [ "/dev/sda" "/dev/sdb" ];
+  };
+
+  system.stateVersion = "22.05";
+  
+  environment.systemPackages = with pkgs; [
+    vim
+    tmux
+    git
+    (pkgs.callPackage "${builtins.fetchTarball "https://github.com/ryantm/agenix/archive/main.tar.gz"}/pkgs/agenix.nix" {})
+  ];
+
+  nixpkgs.config.allowUnfree = true;
+
+  nix = {
+    package = pkgs.nixStable;
+
+    settings = {
+      experimental-features = ["nix-command" "flakes"];
+      trusted-users = ["@wheel"];
+      substituters = [
+        "https://alarsyo.cachix.org"
+        "https://nix-community.cachix.org"
+      ];
+      trusted-public-keys = [
+        "alarsyo.cachix.org-1:A6BmcaJek5+ZDWWv3fPteHhPm6U8liS9CbDbmegPfmk="
+        "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
+      ];
+    };
+  };
+
+}

hosts/hades/default.nix

@@ -0,0 +1,68 @@
+# Edit this configuration file to define what should be installed on
+# your system.  Help is available in the configuration.nix(5) man page
+# and in the NixOS manual (accessible by running ‘nixos-help’).
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}: let
+  secrets = config.my.secrets;
+in {
+  imports = [
+    # Include the results of the hardware scan.
+    ./hardware-configuration.nix
+
+    ./home.nix
+    ./secrets.nix
+  ];
+
+  boot.loader.systemd-boot.enable = false;
+  boot.loader.grub = {
+    enable = true;
+    efiSupport = false;
+    devices = [ "/dev/sda" "/dev/sdb" ];
+  };
+
+  boot.cleanTmpDir = true;
+
+  networking.hostName = "hades"; # Define your hostname.
+  networking.domain = "alarsyo.net";
+
+  # Set your time zone.
+  time.timeZone = "Europe/Paris";
+
+  networking.useDHCP = false;
+  networking.interfaces.enp35s0.ipv4.addresses = [
+    {
+      address = "95.217.121.60";
+      prefixLength = 26;
+    }
+  ];
+  networking.interfaces.enp35s0.ipv6.addresses = [
+    {
+      address = "2a01:4f9:4a:3649::2";
+      prefixLength = 64;
+    }
+  ];
+  networking.defaultGateway = "95.217.121.1";
+  networking.defaultGateway6 = { address = "fe80::1"; interface = "enp35s0"; };
+  networking.nameservers = [ "1.1.1.1" "1.0.0.1" ];
+  my.networking.externalInterface = "enp35s0";
+
+  # List services that you want to enable:
+  my.services = {
+    tailscale = {
+      enable = true;
+      exitNode = true;
+    };
+  };
+
+  # Enable the OpenSSH daemon.
+  services.openssh.enable = true;
+  services.openssh.permitRootLogin = "no";
+  services.openssh.passwordAuthentication = false;
+
+  # Takes a long while to build
+  documentation.nixos.enable = false;
+}

hosts/hades/hardware-configuration.nix

@@ -0,0 +1,25 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports =
+    [ (modulesPath + "/installer/scan/not-detected.nix")
+    ];
+
+  boot.initrd.availableKernelModules = [ "ahci" "sd_mod" ];
+  boot.initrd.kernelModules = [ "dm-snapshot" ];
+  boot.kernelModules = [ "kvm-amd" ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" =
+    { device = "/dev/disk/by-uuid/2a24010c-14bd-439b-b30b-d0e18db69952";
+      fsType = "ext4";
+    };
+
+  swapDevices = [ ];
+
+  powerManagement.cpuFreqGovernor = lib.mkDefault "ondemand";
+  hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+}

hosts/hades/home.nix

@@ -0,0 +1,5 @@
+{config, ...}: {
+  home-manager.users.alarsyo = {
+    my.theme = config.home-manager.users.alarsyo.my.themes.solarizedLight;
+  };
+}

hosts/hades/secrets.nix

@@ -0,0 +1,20 @@
+{
+  config,
+  lib,
+  options,
+  ...
+}: {
+  config.age = {
+    secrets = let
+      toSecret = name: {...} @ attrs:
+        {
+          file = ./../../modules/secrets + "/${name}.age";
+        }
+        // attrs;
+    in
+      lib.mapAttrs toSecret {
+        "users/alarsyo-hashed-password" = {};
+        "users/root-hashed-password" = {};
+      };
+  };
+}

modules/secrets/secrets.nix

@@ -3,10 +3,11 @@ let
   users = [alarsyo];
 
   boreal = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAagal1aqZh52wEmgsw7fkCzO41o4Cx+nV4wJGZuX1RP root@boreal";
+  hades = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMxw8CtKUPAiPdKDEnuS7UyRrZN5BkUwsy5UPVF8V+lt root@hades";
   poseidon = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKYhZYMbWQG9TSQ2qze8GgFo2XrZzgu/GuSOGwenByJo root@poseidon";
   zephyrus = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILU4JfIADH9MXUnVe+3ezYK9WXsqy/jJcm1zFkmL4aSU root@zephyrus";
 
-  machines = [boreal poseidon zephyrus];
+  machines = [boreal hades poseidon zephyrus];
 
   all = users ++ machines;
 in {