From f853cb93f1554090f7d150fb9dc54510d62cb9b9 Mon Sep 17 00:00:00 2001 From: transcaffeine Date: Fri, 4 Apr 2025 18:04:57 +0200 Subject: [PATCH 1/4] chore(hosts/backstage): cleanup --- hosts/backstage/boot.nix | 45 ++++++++++++++++++++++ hosts/backstage/configuration.nix | 39 ------------------- hosts/backstage/default.nix | 1 + hosts/backstage/hardware-configuration.nix | 15 -------- hosts/backstage/network.nix | 13 ++++++- 5 files changed, 57 insertions(+), 56 deletions(-) create mode 100644 hosts/backstage/boot.nix diff --git a/hosts/backstage/boot.nix b/hosts/backstage/boot.nix new file mode 100644 index 0000000..abd9a3b --- /dev/null +++ b/hosts/backstage/boot.nix @@ -0,0 +1,45 @@ +{config, lib, ...}: +{ + # Use the systemd-boot EFI boot loader. + boot = { + loader = { + systemd-boot.enable = true; + efi = { + canTouchEfiVariables = true; + efiSysMountPoint = "/boot/efi"; + }; + }; + initrd = { + network = { + enable = true; + ssh = { + enable = true; + port = 22; + authorizedKeys = config.users.users.root.openssh.authorizedKeys.keys; + hostKeys = [ + "/boot/efi/initrd_id_ed25519" + "/boot/efi/initrd_id_rsa4096" + ]; + }; + }; + systemd = { + enable = true; + network = config.systemd.network; + targets.initrd.wants = [ + "systemd-networkd-wait-online@enp1s0.service" + ]; + users.root.shell = "/bin/systemd-tty-ask-password-agent"; + }; + availableKernelModules = [ "xhci_pci" "ahci" "nvme" "usbhid" "usb_storage" "sd_mod" "virtio_pci" "r8169" ]; + kernelModules = [ "dm-snapshot" ]; + luks.devices."backstage" = { + preLVM = true; + device = "/dev/disk/by-uuid/7f3ccd2d-8022-491e-baa1-675805919fd7"; + }; + }; + kernelModules = [ "kvm-intel" ]; + kernelParams = [ + "zfs.zfs_arc_max=1024000000" + ]; + }; +} diff --git a/hosts/backstage/configuration.nix b/hosts/backstage/configuration.nix index 44d1ad3..61aaadf 100644 --- a/hosts/backstage/configuration.nix +++ b/hosts/backstage/configuration.nix @@ -6,45 +6,6 @@ ../../services/sshd ]; - # Use the systemd-boot EFI boot loader. - boot = { - loader = { - systemd-boot.enable = true; - efi = { - canTouchEfiVariables = true; - efiSysMountPoint = "/boot/efi"; - }; - }; - initrd = { - network = { - enable = true; - ssh = { - enable = true; - port = 22; - authorizedKeys = config.users.users.root.openssh.authorizedKeys.keys; - hostKeys = [ - "/boot/efi/initrd_id_ed25519" - "/boot/efi/initrd_id_rsa4096" - ]; - }; - }; - systemd = { - enable = true; - network = { - enable = true; - networks."10-dhcp" = { - matchConfig.Name = "enp1s0"; - DHCP = "yes"; - }; - }; - targets.initrd.wants = [ - "systemd-networkd-wait-online@enp1s0.service" - ]; - users.root.shell = "/bin/systemd-tty-ask-password-agent"; - }; - }; - }; - # Set your time zone. time.timeZone = "Europe/Berlin"; diff --git a/hosts/backstage/default.nix b/hosts/backstage/default.nix index 39a4e28..72b3230 100644 --- a/hosts/backstage/default.nix +++ b/hosts/backstage/default.nix @@ -5,5 +5,6 @@ ./hardware-configuration.nix ./configuration.nix ./network.nix + ./boot.nix ]; } diff --git a/hosts/backstage/hardware-configuration.nix b/hosts/backstage/hardware-configuration.nix index 3d94fc9..a7ba7ae 100644 --- a/hosts/backstage/hardware-configuration.nix +++ b/hosts/backstage/hardware-configuration.nix @@ -5,21 +5,6 @@ [ (modulesPath + "/installer/scan/not-detected.nix") ]; - boot = { - initrd = { - availableKernelModules = [ "xhci_pci" "ahci" "nvme" "usbhid" "usb_storage" "sd_mod" "virtio_pci" "r8169" ]; - kernelModules = [ "dm-snapshot" ]; - luks.devices."backstage" = { - preLVM = true; - device = "/dev/disk/by-uuid/7f3ccd2d-8022-491e-baa1-675805919fd7"; - }; - }; - kernelModules = [ "kvm-intel" ]; - kernelParams = [ - "zfs.zfs_arc_max=1024000000" - ]; - }; - fileSystems."/" = { device = "zpool/root"; fsType = "zfs"; diff --git a/hosts/backstage/network.nix b/hosts/backstage/network.nix index e228c1e..a2e3dca 100644 --- a/hosts/backstage/network.nix +++ b/hosts/backstage/network.nix @@ -1,10 +1,19 @@ -{ config, lib, pkgs, modulesPath, ... }: +{ config, lib, ... }: { networking = { useNetworkd = true; - useDHCP = lib.mkDefault true; hostName = "backstage"; hostId = "0ccd2304"; }; + + systemd.network = { + enable = true; + networks = { + "enp1s0" = { + matchConfig.Name = "enp1s0"; + DHCP = "yes"; + }; + }; + }; } From ca77d2e0e9c50874986ac4c75190574e9be6d42c Mon Sep 17 00:00:00 2001 From: transcaffeine Date: Fri, 18 Apr 2025 21:07:37 +0200 Subject: [PATCH 2/4] feat: add nixfiles-private and import host user config from there --- flake.lock | 22 ++++++++++++++++++++++ flake.nix | 4 ++++ hosts/backstage/configuration.nix | 24 ++---------------------- 3 files changed, 28 insertions(+), 22 deletions(-) diff --git a/flake.lock b/flake.lock index ea82eb6..6ba47bc 100644 --- a/flake.lock +++ b/flake.lock @@ -18,6 +18,27 @@ "type": "github" } }, + "nixfiles-private": { + "inputs": { + "nixpkgs": [ + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1745002185, + "narHash": "sha256-bdWS7dY1yUe+RfW9a3ySrorYq1S+pWJm4AE2J0yp3+I=", + "ref": "refs/tags/0.0.1", + "rev": "a0e92bad8feeb269f985a2d8112723bf5926528c", + "revCount": 2, + "type": "git", + "url": "ssh://forgejo@git.werkraum-karlsruhe.org/WRK/nixfiles-private" + }, + "original": { + "ref": "refs/tags/0.0.1", + "type": "git", + "url": "ssh://forgejo@git.werkraum-karlsruhe.org/WRK/nixfiles-private" + } + }, "nixos-hardware": { "locked": { "lastModified": 1743420942, @@ -68,6 +89,7 @@ "root": { "inputs": { "flake-parts": "flake-parts", + "nixfiles-private": "nixfiles-private", "nixos-hardware": "nixos-hardware", "nixpkgs": "nixpkgs" } diff --git a/flake.nix b/flake.nix index 71ed062..ba9c782 100644 --- a/flake.nix +++ b/flake.nix @@ -3,6 +3,10 @@ nixpkgs.url = "github:NixOS/nixpkgs/nixos-24.11"; nixos-hardware.url = "github:NixOS/nixos-hardware/master"; flake-parts.url = "github:hercules-ci/flake-parts"; + nixfiles-private = { + url = "git+ssh://forgejo@git.werkraum-karlsruhe.org/WRK/nixfiles-private?ref=refs/tags/0.0.1"; + inputs.nixpkgs.follows = "nixpkgs"; + }; }; outputs = inputs: inputs.flake-parts.lib.mkFlake { inherit inputs; } { diff --git a/hosts/backstage/configuration.nix b/hosts/backstage/configuration.nix index 61aaadf..7fc64af 100644 --- a/hosts/backstage/configuration.nix +++ b/hosts/backstage/configuration.nix @@ -1,9 +1,10 @@ -{ config, lib, pkgs, ... }: +{ inputs, config, lib, pkgs, ... }: { imports = [ ../../services/sshd + inputs.nixfiles-private.nixosModules.hosts.backstage ]; # Set your time zone. @@ -24,27 +25,6 @@ htop ]; - users.users.root = { - openssh.authorizedKeys.keys = [ - ''ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCnjrKWYc0bcIsTkdpyC+yAsxSeY9M1WxVDNm3I/R3BYqyvfFuzJMQyh5APhM52yKGMN9UOuJPNPz0C4P6EY3iC3ZqUHFJ6ILrZZxdLZBVxdy2F19Xv6XcZkZxLpRKWapVFECF5z/Bi0rg1uzNRyrHjfZWcHfHIvlqxUYiitvvTbbSMQKqEV8wlnshSzBoYzaKtV1+crwlgz6wCnXq8HIupEeWfUc9kc+zunpYnuHnU5Z3HhzQGBuIiPoVritDjOo7qYREftV4qQ15xFWdezsMZlR15edwZeyNdAEx044QgaGddC8uEMoi5cp4APIqH1cEkIvSU6Y+esdgZ4CHU6M5G5ub5PTT2TaKoUMLLFtpW6QImjVApixFTHWR7tUhqInplWWLqvviS4MoI1ppxgcDUg/bgPdeDBsoRkbESr2uT8ResNi9DlPlN2rlUjlb28awzHm7agFhwfPQZ1afnFSUh0tTFz1WeR7xIGhxR1xXc8sapJhgLnYYWpR2NaJzbYYdk7CWW/3rgEsJem7Kvll6HevnFgRP/uVhEyGZl9hw+tECzvwB/LEmQ/4raDMxqOB9XO9kusJX/jTnQIObrFubfKn3ToXlYbQxZX9+QobANvQ8huILz1bBeH8aKjf9RXu+j4VNyoCKhzU/v0MIdRCsgVWgjuYXMGRo0MFMFyMqQiw=='' - ]; - }; - - # Define a user account. Don't forget to set a password with ‘passwd’. - # users.users.alice = { - # isNormalUser = true; - # extraGroups = [ "wheel" ]; # Enable ‘sudo’ for the user. - # packages = with pkgs; [ - # tree - # ]; - # }; - - # List services that you want to enable: - - # Open ports in the firewall. - # networking.firewall.allowedTCPPorts = [ ... ]; - # networking.firewall.allowedUDPPorts = [ ... ]; - # Copy the NixOS configuration file and link it from the resulting system # (/run/current-system/configuration.nix). This is useful in case you # accidentally delete configuration.nix. From 6373a30f953de4aaa8d4654e7d2f4a011c1adcbe Mon Sep 17 00:00:00 2001 From: transcaffeine Date: Fri, 18 Apr 2025 21:12:42 +0200 Subject: [PATCH 3/4] feat: move flake input nixpkgs to channels.nixos.org --- flake.lock | 17 +++++++---------- flake.nix | 2 +- 2 files changed, 8 insertions(+), 11 deletions(-) diff --git a/flake.lock b/flake.lock index 6ba47bc..87d8d17 100644 --- a/flake.lock +++ b/flake.lock @@ -57,18 +57,15 @@ }, "nixpkgs": { "locked": { - "lastModified": 1743501102, - "narHash": "sha256-7PCBQ4aGVF8OrzMkzqtYSKyoQuU2jtpPi4lmABpe5X4=", - "owner": "NixOS", - "repo": "nixpkgs", - "rev": "02f2af8c8a8c3b2c05028936a1e84daefa1171d4", - "type": "github" + "lastModified": 1744533305, + "narHash": "sha256-56qCMHw9q2hkyh6qlbrTKTN102OfZPkXVI4YGLa5Wgc=", + "rev": "26d499fc9f1d567283d5d56fcf367edd815dba1d", + "type": "tarball", + "url": "https://releases.nixos.org/nixos/24.11/nixos-24.11.716947.26d499fc9f1d/nixexprs.tar.xz" }, "original": { - "owner": "NixOS", - "ref": "nixos-24.11", - "repo": "nixpkgs", - "type": "github" + "type": "tarball", + "url": "https://channels.nixos.org/nixos-24.11/nixexprs.tar.xz" } }, "nixpkgs-lib": { diff --git a/flake.nix b/flake.nix index ba9c782..e2651bc 100644 --- a/flake.nix +++ b/flake.nix @@ -1,6 +1,6 @@ { inputs = { - nixpkgs.url = "github:NixOS/nixpkgs/nixos-24.11"; + nixpkgs.url = "https://channels.nixos.org/nixos-24.11/nixexprs.tar.xz"; nixos-hardware.url = "github:NixOS/nixos-hardware/master"; flake-parts.url = "github:hercules-ci/flake-parts"; nixfiles-private = { From 36bc85d3018da06bd7b7a360ca761da013f48aa5 Mon Sep 17 00:00:00 2001 From: transcaffeine Date: Fri, 18 Apr 2025 22:20:09 +0200 Subject: [PATCH 4/4] chore(hosts/backstage): add packages pciutils, lshw, ethtool, usbutils --- hosts/backstage/configuration.nix | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/hosts/backstage/configuration.nix b/hosts/backstage/configuration.nix index 7fc64af..79cbafa 100644 --- a/hosts/backstage/configuration.nix +++ b/hosts/backstage/configuration.nix @@ -23,6 +23,10 @@ git tmux htop + pciutils + lshw + ethtool + usbutils ]; # Copy the NixOS configuration file and link it from the resulting system