flake.lock: Update

Flake lock file updates: • Updated input 'home-manager': 'github:nix-community/home-manager/64831f938bd413cefde0b0cf871febc494afaa4f' (2022-05-25) → 'github:nix-community/home-manager/70824bb5c790b820b189f62f643f795b1d2ade2e' (2022-06-07) • Added input 'home-manager/flake-compat': 'github:edolstra/flake-compat/b4a34015c698c7793d592d66adbab377907a2be8' (2022-04-19) • Added input 'home-manager/nmd': 'gitlab:rycee/nmd/9e7a20e6ee3f6751f699f79c0b299390f81f7bcd' (2022-05-23) • Added input 'home-manager/nmt': 'gitlab:rycee/nmt/d83601002c99b78c89ea80e5e6ba21addcfe12ae' (2022-03-23) • Added input 'home-manager/utils': 'github:numtide/flake-utils/1ed9fb1935d260de5fe1c2f7ee0ebaae17ed2fa1' (2022-05-30) • Updated input 'nixpkgs': 'github:NixOS/nixpkgs/83658b28fe638a170a19b8933aa008b30640fbd1' (2022-05-26) → 'github:NixOS/nixpkgs/e0169d7a9d324afebf5679551407756c77af8930' (2022-06-08) • Updated input 'nixpkgs-unstable-small': 'github:NixOS/nixpkgs/f6c4da49202d79cdab2fdf2bfa3019cde23f007e' (2022-05-29) → 'github:NixOS/nixpkgs/a58de450c514aa1bc5a4999f92656ab6b600dc59' (2022-06-10)
hades: use tmpfs for /tmp
2022-06-10 17:25:41 +02:00 · 2022-06-10 17:25:26 +02:00 · 2022-06-10 17:20:31 +02:00
11 changed files with 313 additions and 11 deletions
--- a/flake.lock
+++ b/flake.lock
@ -18,6 +18,22 @@
        "type": "github"
      }
    },
+    "flake-compat": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1650374568,
+        "narHash": "sha256-Z+s0J8/r907g149rllvwhb4pKi8Wam5ij0st8PwAh+E=",
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "rev": "b4a34015c698c7793d592d66adbab377907a2be8",
+        "type": "github"
+      },
+      "original": {
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "type": "github"
+      }
+    },
    "flake-utils": {
      "locked": {
        "lastModified": 1648297722,
@ -36,16 +52,20 @@
    },
    "home-manager": {
      "inputs": {
+        "flake-compat": "flake-compat",
        "nixpkgs": [
          "nixpkgs"
-        ]
+        ],
+        "nmd": "nmd",
+        "nmt": "nmt",
+        "utils": "utils"
      },
      "locked": {
-        "lastModified": 1653518057,
-        "narHash": "sha256-cam3Nfae5ADeEs6mRPzr0jXB7+DhyMIXz0/0Q13r/yk=",
+        "lastModified": 1654628474,
+        "narHash": "sha256-Llm9X8Af15uC9IMStxqjCfO15WgYTqTnsQq8wMcpp5Q=",
        "owner": "nix-community",
        "repo": "home-manager",
-        "rev": "64831f938bd413cefde0b0cf871febc494afaa4f",
+        "rev": "70824bb5c790b820b189f62f643f795b1d2ade2e",
        "type": "github"
      },
      "original": {
@ -89,11 +109,11 @@
    },
    "nixpkgs-unstable-small": {
      "locked": {
-        "lastModified": 1653839487,
-        "narHash": "sha256-UFTixs7vCadS50/J0Q5tIFSeXrDJs7lCKHi+a3V9oVQ=",
+        "lastModified": 1654819923,
+        "narHash": "sha256-s3m3dbCVWw7XAFbkIJyPKtlqgbcDD+2BrBOGTRn0fIw=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "f6c4da49202d79cdab2fdf2bfa3019cde23f007e",
+        "rev": "a58de450c514aa1bc5a4999f92656ab6b600dc59",
        "type": "github"
      },
      "original": {
@ -105,11 +125,11 @@
    },
    "nixpkgs_2": {
      "locked": {
-        "lastModified": 1653581809,
-        "narHash": "sha256-Uvka0V5MTGbeOfWte25+tfRL3moECDh1VwokWSZUdoY=",
+        "lastModified": 1654682581,
+        "narHash": "sha256-Jb1PQCwKgwdNAp907eR5zPzuxV+kRroA3UIxUxCMJ9s=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "83658b28fe638a170a19b8933aa008b30640fbd1",
+        "rev": "e0169d7a9d324afebf5679551407756c77af8930",
        "type": "github"
      },
      "original": {
@ -119,6 +139,38 @@
        "type": "github"
      }
    },
+    "nmd": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1653339422,
+        "narHash": "sha256-8nc7lcYOgih3YEmRMlBwZaLLJYpLPYKBlewqHqx8ieg=",
+        "owner": "rycee",
+        "repo": "nmd",
+        "rev": "9e7a20e6ee3f6751f699f79c0b299390f81f7bcd",
+        "type": "gitlab"
+      },
+      "original": {
+        "owner": "rycee",
+        "repo": "nmd",
+        "type": "gitlab"
+      }
+    },
+    "nmt": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1648075362,
+        "narHash": "sha256-u36WgzoA84dMVsGXzml4wZ5ckGgfnvS0ryzo/3zn/Pc=",
+        "owner": "rycee",
+        "repo": "nmt",
+        "rev": "d83601002c99b78c89ea80e5e6ba21addcfe12ae",
+        "type": "gitlab"
+      },
+      "original": {
+        "owner": "rycee",
+        "repo": "nmt",
+        "type": "gitlab"
+      }
+    },
    "root": {
      "inputs": {
        "agenix": "agenix",
@ -128,6 +180,21 @@
        "nixpkgs": "nixpkgs_2",
        "nixpkgs-unstable-small": "nixpkgs-unstable-small"
      }
+    },
+    "utils": {
+      "locked": {
+        "lastModified": 1653893745,
+        "narHash": "sha256-0jntwV3Z8//YwuOjzhV2sgJJPt+HY6KhU7VZUL0fKZQ=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "1ed9fb1935d260de5fe1c2f7ee0ebaae17ed2fa1",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
    }
  },
  "root": "root",
--- a/flake.nix
+++ b/flake.nix
@ -102,6 +102,15 @@
            ++ sharedModules;
        };

+        hades = nixpkgs.lib.nixosSystem rec {
+          inherit system;
+          modules =
+            [
+              ./hades.nix
+            ]
+            ++ sharedModules;
+        };
+
        boreal = nixpkgs.lib.nixosSystem rec {
          inherit system;
          modules =
--- a/hades.nix
+++ b/hades.nix
@ -0,0 +1,23 @@
+{...}: {
+  imports = [
+    # Default configuration
+    ./base
+
+    # Module definitions
+    ./modules
+
+    # Service definitions
+    ./services
+
+    # Host-specific config
+    ./hosts/hades
+  ];
+
+  # This value determines the NixOS release from which the default
+  # settings for stateful data, like file locations and database versions
+  # on your system were taken. It‘s perfectly fine and recommended to leave
+  # this value at the release version of the first install of this system.
+  # Before changing this value read the documentation for this option
+  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
+  system.stateVersion = "22.05"; # Did you read the comment?
+}
--- a/hosts/hades/configuration.nix
+++ b/hosts/hades/configuration.nix
@ -0,0 +1,84 @@
+{ config, pkgs, ... }:
+{
+  imports = [
+    ./hardware-configuration.nix
+  ];
+
+  services.openssh.enable = true;
+  users.users.root.openssh.authorizedKeys.keys = [
+    # Replace with your public key
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIH3rrF3VSWI4n4cpguvlmLAaU3uftuX4AVV/39S/8GO9 alarsyo@thinkpad"
+  ];
+  users.users.root.initialHashedPassword = "";
+  services.openssh.permitRootLogin = "prohibit-password";
+  users.users.alarsyo = {
+    password = "toto";
+    isNormalUser = true;
+    extraGroups = [
+      "media"
+      "networkmanager"
+      "video" # for `light` permissions
+      "docker"
+      "wheel" # Enable ‘sudo’ for the user.
+    ];
+    shell = pkgs.fish;
+    openssh.authorizedKeys.keys = [
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIH3rrF3VSWI4n4cpguvlmLAaU3uftuX4AVV/39S/8GO9 alarsyo@thinkpad"
+    ];
+  };
+
+
+  networking.useDHCP = false;
+  networking.interfaces.enp35s0.ipv4.addresses = [
+    {
+      address = "95.217.121.60";
+      prefixLength = 26;
+    }
+  ];
+  networking.interfaces.enp35s0.ipv6.addresses = [
+    {
+      address = "2a01:4f9:4a:3649::2";
+      prefixLength = 64;
+    }
+  ];
+  networking.defaultGateway = "95.217.121.1";
+  networking.defaultGateway6 = { address = "fe80::1"; interface = "enp35s0"; };
+  networking.nameservers = [ "1.1.1.1" "1.0.0.1" ];
+  networking.hostName = "hades";
+
+  boot.loader.systemd-boot.enable = false;
+  boot.loader.grub = {
+    enable = true;
+    efiSupport = false;
+    devices = [ "/dev/sda" "/dev/sdb" ];
+  };
+
+  system.stateVersion = "22.05";
+  
+  environment.systemPackages = with pkgs; [
+    vim
+    tmux
+    git
+    (pkgs.callPackage "${builtins.fetchTarball "https://github.com/ryantm/agenix/archive/main.tar.gz"}/pkgs/agenix.nix" {})
+  ];
+
+  nixpkgs.config.allowUnfree = true;
+
+  nix = {
+    package = pkgs.nixStable;
+
+    settings = {
+      experimental-features = ["nix-command" "flakes"];
+      trusted-users = ["@wheel"];
+      substituters = [
+        "https://alarsyo.cachix.org"
+        "https://nix-community.cachix.org"
+      ];
+      trusted-public-keys = [
+        "alarsyo.cachix.org-1:A6BmcaJek5+ZDWWv3fPteHhPm6U8liS9CbDbmegPfmk="
+        "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
+      ];
+    };
+  };
+
+}
--- a/hosts/hades/default.nix
+++ b/hosts/hades/default.nix
@ -0,0 +1,68 @@
+# Edit this configuration file to define what should be installed on
+# your system.  Help is available in the configuration.nix(5) man page
+# and in the NixOS manual (accessible by running ‘nixos-help’).
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}: let
+  secrets = config.my.secrets;
+in {
+  imports = [
+    # Include the results of the hardware scan.
+    ./hardware-configuration.nix
+
+    ./home.nix
+    ./secrets.nix
+  ];
+
+  boot.loader.systemd-boot.enable = false;
+  boot.loader.grub = {
+    enable = true;
+    efiSupport = false;
+    devices = [ "/dev/sda" "/dev/sdb" ];
+  };
+
+  boot.tmpOnTmpfs = true;
+
+  networking.hostName = "hades"; # Define your hostname.
+  networking.domain = "alarsyo.net";
+
+  # Set your time zone.
+  time.timeZone = "Europe/Paris";
+
+  networking.useDHCP = false;
+  networking.interfaces.enp35s0.ipv4.addresses = [
+    {
+      address = "95.217.121.60";
+      prefixLength = 26;
+    }
+  ];
+  networking.interfaces.enp35s0.ipv6.addresses = [
+    {
+      address = "2a01:4f9:4a:3649::2";
+      prefixLength = 64;
+    }
+  ];
+  networking.defaultGateway = "95.217.121.1";
+  networking.defaultGateway6 = { address = "fe80::1"; interface = "enp35s0"; };
+  networking.nameservers = [ "1.1.1.1" "1.0.0.1" ];
+  my.networking.externalInterface = "enp35s0";
+
+  # List services that you want to enable:
+  my.services = {
+    tailscale = {
+      enable = true;
+      exitNode = true;
+    };
+  };
+
+  # Enable the OpenSSH daemon.
+  services.openssh.enable = true;
+  services.openssh.permitRootLogin = "no";
+  services.openssh.passwordAuthentication = false;
+
+  # Takes a long while to build
+  documentation.nixos.enable = false;
+}
--- a/hosts/hades/hardware-configuration.nix
+++ b/hosts/hades/hardware-configuration.nix
@ -0,0 +1,25 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports =
+    [ (modulesPath + "/installer/scan/not-detected.nix")
+    ];
+
+  boot.initrd.availableKernelModules = [ "ahci" "sd_mod" ];
+  boot.initrd.kernelModules = [ "dm-snapshot" ];
+  boot.kernelModules = [ "kvm-amd" ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" =
+    { device = "/dev/disk/by-uuid/2a24010c-14bd-439b-b30b-d0e18db69952";
+      fsType = "ext4";
+    };
+
+  swapDevices = [ ];
+
+  powerManagement.cpuFreqGovernor = lib.mkDefault "ondemand";
+  hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+}
--- a/hosts/hades/home.nix
+++ b/hosts/hades/home.nix
@ -0,0 +1,5 @@
+{config, ...}: {
+  home-manager.users.alarsyo = {
+    my.theme = config.home-manager.users.alarsyo.my.themes.solarizedLight;
+  };
+}
--- a/hosts/hades/secrets.nix
+++ b/hosts/hades/secrets.nix
@ -0,0 +1,20 @@
+{
+  config,
+  lib,
+  options,
+  ...
+}: {
+  config.age = {
+    secrets = let
+      toSecret = name: {...} @ attrs:
+        {
+          file = ./../../modules/secrets + "/${name}.age";
+        }
+        // attrs;
+    in
+      lib.mapAttrs toSecret {
+        "users/alarsyo-hashed-password" = {};
+        "users/root-hashed-password" = {};
+      };
+  };
+}
--- a/modules/secrets/secrets.nix
+++ b/modules/secrets/secrets.nix
@ -3,10 +3,11 @@ let
  users = [alarsyo];

  boreal = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAagal1aqZh52wEmgsw7fkCzO41o4Cx+nV4wJGZuX1RP root@boreal";
+  hades = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMxw8CtKUPAiPdKDEnuS7UyRrZN5BkUwsy5UPVF8V+lt root@hades";
  poseidon = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKYhZYMbWQG9TSQ2qze8GgFo2XrZzgu/GuSOGwenByJo root@poseidon";
  zephyrus = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILU4JfIADH9MXUnVe+3ezYK9WXsqy/jJcm1zFkmL4aSU root@zephyrus";

-  machines = [boreal poseidon zephyrus];
+  machines = [boreal hades poseidon zephyrus];

  all = users ++ machines;
 in {
--- a/modules/secrets/users/alarsyo-hashed-password.age
+++ b/modules/secrets/users/alarsyo-hashed-password.age
--- a/modules/secrets/users/root-hashed-password.age
+++ b/modules/secrets/users/root-hashed-password.age