sops hosts layout
This commit is contained in:
parent
6b30d11d42
commit
f9250db3d8
GPG key ID:
EF99694AA599DDAD
20 changed files with 585 additions and 6 deletions
258
hosts/cryochamber/configuration.nix
Normal file
258
hosts/cryochamber/configuration.nix
Normal file
|
|
@ -0,0 +1,258 @@
|
|||
{ config, pkgs, lib, impermanence, ... }:
|
||||
|
||||
#zpool import -f rpool
|
||||
#mount -t zfs rpool/local/root /mnt
|
||||
#mkdir -p /mnt/{boot,nix,home,persist,var/lib,var/log}
|
||||
#mount /dev/vda2 /mnt/boot
|
||||
#mount -t zfs rpool/local/nix /mnt/nix
|
||||
#mount -t zfs rpool/safe/home /mnt/home
|
||||
#mount -t zfs rpool/safe/persist /mnt/persist
|
||||
#mount -t zfs rpool/local/var/lib /mnt/var/lib
|
||||
#mount -t zfs rpool/local/var/log /mnt/var/log
|
||||
|
||||
{
|
||||
imports =
|
||||
[
|
||||
./hardware-configuration.nix
|
||||
"${impermanence}/nixos.nix"
|
||||
];
|
||||
|
||||
# Enable ZFS support
|
||||
boot.supportedFilesystems = [ "zfs" ];
|
||||
boot.zfs.requestEncryptionCredentials = false;
|
||||
|
||||
fileSystems = {
|
||||
"/persist" = {
|
||||
device = "rpool/safe/persist";
|
||||
fsType = "zfs";
|
||||
neededForBoot = true; # Only /persist needs to be marked as needed for boot
|
||||
};
|
||||
};
|
||||
|
||||
# Import the existing ZFS pool from the second disk without formatting it
|
||||
boot.zfs.extraPools = [ "tank" ];
|
||||
boot.zfs.devNodes = "/dev/disk/by-path"; # This is neede for ZFS to find the pool at boot
|
||||
|
||||
# Use GRUB with BIOS booting, whether MBR or GPT
|
||||
boot.loader.grub.enable = true;
|
||||
boot.loader.grub.device = "/dev/vda";
|
||||
boot.loader.grub.zfsSupport = true;
|
||||
boot.loader.grub.efiSupport = false;
|
||||
|
||||
# Impermanence configuration
|
||||
# Set up impermanence - root filesystem will be reset on each boot
|
||||
boot.initrd.postResumeCommands = lib.mkAfter ''
|
||||
zfs rollback -r rpool/local/root@blank
|
||||
'';
|
||||
# /var/log and /var/lib ar persisted through zfs datasets, but not backed up.
|
||||
# Anything stored in /persist should get backed up.
|
||||
environment.persistence."/persist" = {
|
||||
hideMounts = true;
|
||||
directories = [
|
||||
"/root"
|
||||
"/etc/nixos"
|
||||
"/etc/ssh"
|
||||
];
|
||||
files = [
|
||||
"/etc/machine-id"
|
||||
];
|
||||
};
|
||||
# Files are not copied to /persist during install, so need to do so manually
|
||||
#rsync -azPH /mnt/root/ /mnt/persist/root
|
||||
#rsync -azPH /mnt/etc/nixos/ /mnt/persist/etc/nixos
|
||||
#rsync -azPH /mnt/etc/ssh/ /mnt/persist/etc/ssh
|
||||
#cp /mnt/etc/machine-id /mnt/persist/etc/machine-id
|
||||
|
||||
# Swap configuration
|
||||
swapDevices = [ {
|
||||
device = "/dev/vda3";
|
||||
randomEncryption.enable = true;
|
||||
} ];
|
||||
|
||||
# Basic system configuration
|
||||
networking.hostId = "5472a981"; # Required for ZFS
|
||||
networking.hostName = "cryochamber";
|
||||
|
||||
# Enable networking
|
||||
networking.networkmanager.enable = true;
|
||||
|
||||
# Don't lecture after reboot
|
||||
security.sudo.extraConfig = ''
|
||||
Defaults lecture = never
|
||||
'';
|
||||
|
||||
# Set your time zone
|
||||
time.timeZone = "UTC";
|
||||
|
||||
# Docker configuration
|
||||
virtualisation.docker = {
|
||||
enable = true;
|
||||
extraOptions = "--storage-driver=overlay2";
|
||||
};
|
||||
|
||||
# System packages
|
||||
environment.systemPackages = with pkgs; [
|
||||
git
|
||||
vim
|
||||
wget
|
||||
curl
|
||||
htop
|
||||
zfs
|
||||
zsh
|
||||
tmux
|
||||
docker-compose
|
||||
lzop # for syncoid
|
||||
pv # for syncoid
|
||||
mbuffer # for syncoid
|
||||
];
|
||||
|
||||
services.zfs.autoScrub = {
|
||||
enable = true;
|
||||
interval = "weekly";
|
||||
pools = [ "tank" ];
|
||||
};
|
||||
|
||||
services.sanoid = {
|
||||
enable = true;
|
||||
|
||||
templates.backup = {
|
||||
frequently = 0;
|
||||
hourly = 0;
|
||||
daily = 30;
|
||||
monthly = 6;
|
||||
yearly = 3;
|
||||
autosnap = false;
|
||||
autoprune = true;
|
||||
recursive = true;
|
||||
};
|
||||
|
||||
datasets."tank" = {
|
||||
useTemplate = [ "backup" ];
|
||||
};
|
||||
|
||||
datasets."rpool/safe" = {
|
||||
useTemplate = [ "backup" ];
|
||||
};
|
||||
};
|
||||
|
||||
# sops-nix secrets
|
||||
sops.defaultSopsFile = ./secrets/config.yaml;
|
||||
sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
|
||||
sops.secrets.hashedPassword.neededForUsers = true;
|
||||
|
||||
# Define a user account
|
||||
users.users.hunner = {
|
||||
isNormalUser = true;
|
||||
extraGroups = [ "wheel" "docker" "networkmanager" ];
|
||||
hashedPasswordFile = config.sops.secrets.hashedPassword.path;
|
||||
shell = pkgs.zsh;
|
||||
packages = with pkgs; [
|
||||
fzf
|
||||
neovim
|
||||
devenv
|
||||
pass
|
||||
jq
|
||||
yq
|
||||
yt-dlp
|
||||
bat
|
||||
ripgrep
|
||||
fd
|
||||
shellcheck
|
||||
tldr
|
||||
unzip
|
||||
lsof
|
||||
gnupg
|
||||
];
|
||||
};
|
||||
users.users.backup = {
|
||||
isNormalUser = true;
|
||||
description = "Backup replication user";
|
||||
shell = pkgs.bash;
|
||||
packages = with pkgs; [
|
||||
sanoid
|
||||
];
|
||||
openssh.authorizedKeys.keys = [
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDtgW+cxPjo70k6dkYPqzP0FR5G9zvbArp/85ZHRrMRL backup@cryochamber"
|
||||
];
|
||||
};
|
||||
|
||||
#services.syncoid = {
|
||||
# enable = true;
|
||||
# user = "backup";
|
||||
# sshKey = "/var/lib/syncoid/.ssh/id_ed25519";
|
||||
# commonArgs = [
|
||||
# #"--sshoption=StrictHostKeyChecking=off"
|
||||
# "--sshoption=UserKnownHostsFile=/var/lib/syncoid/.ssh/known_hosts"
|
||||
# "--sshoption=IdentitiesOnly=yes"
|
||||
# ];
|
||||
# #commands."zima-bitrot" = {
|
||||
# # source = "backup@zima:bitrot";
|
||||
# # target = "tank/backups/zima/bitrot";
|
||||
# # recursive = true;
|
||||
# #};
|
||||
# commands."zima-rpool-safe" = {
|
||||
# source = "backup@zima:rpool/safe";
|
||||
# target = "tank/backups/zima/rpool-safe";
|
||||
# recursive = true;
|
||||
# };
|
||||
#};
|
||||
#systemd.services.syncoid-zima-rpool-safe.serviceConfig = {
|
||||
# Environment = [
|
||||
# "HOME=/var/lib/syncoid"
|
||||
# "SSH_AUTH_SOCK="
|
||||
# ];
|
||||
# ExecStartPre = [
|
||||
# "+${pkgs.coreutils}/bin/mkdir -p /var/lib/syncoid/.ssh"
|
||||
# "+${pkgs.coreutils}/bin/cp /home/backup/.ssh/id_ed25519 /var/lib/syncoid/.ssh/"
|
||||
# "+${pkgs.coreutils}/bin/cp /home/backup/.ssh/known_hosts /var/lib/syncoid/.ssh/"
|
||||
# "+${pkgs.coreutils}/bin/chown -R backup:syncoid /var/lib/syncoid/.ssh"
|
||||
# "+${pkgs.coreutils}/bin/chmod 700 /var/lib/syncoid/.ssh"
|
||||
# "+${pkgs.coreutils}/bin/chmod 600 /var/lib/syncoid/.ssh/id_ed25519"
|
||||
# ];
|
||||
#};
|
||||
|
||||
#systemd.services.syncoid-replication = {
|
||||
# description = "ZFS syncoid replication";
|
||||
# path = with pkgs; [ sanoid openssh zfs ];
|
||||
# wants = [ "network-online.target" ];
|
||||
# after = [ "network-online.target" "zfs.target" ];
|
||||
|
||||
# startAt = "03:00";
|
||||
|
||||
# serviceConfig = {
|
||||
# Type = "oneshot";
|
||||
# User = "backup";
|
||||
# ExecStart = ''
|
||||
# ${pkgs.sanoid}/bin/syncoid \
|
||||
# --recursive \
|
||||
# --create-bookmark \
|
||||
# --sendoptions=w \
|
||||
# --source-bwlimit=50000 \
|
||||
# backup@zima:rpool/safe \
|
||||
# tank/backups/zima/rpool-safe
|
||||
# '';
|
||||
# TimeoutStartSec = "6h";
|
||||
# };
|
||||
#};
|
||||
|
||||
programs.direnv = {
|
||||
enable = true;
|
||||
nix-direnv.enable = true;
|
||||
};
|
||||
programs.zsh.enable = true;
|
||||
services.openssh.enable = true;
|
||||
services.openssh.settings.PermitRootLogin = "prohibit-password";
|
||||
services.openssh.settings.Macs = [
|
||||
"hmac-sha2-512"
|
||||
"hmac-sha2-512-etm@openssh.com"
|
||||
"hmac-sha2-256-etm@openssh.com"
|
||||
"umac-128-etm@openssh.com"
|
||||
];
|
||||
|
||||
services.tailscale.enable = true;
|
||||
|
||||
nix.settings.experimental-features = [ "nix-command" "flakes" ];
|
||||
nixpkgs.config.allowUnfree = true;
|
||||
|
||||
system.stateVersion = "24.11";
|
||||
}
|
||||
127
hosts/cryochamber/disko-gpt.nix
Normal file
127
hosts/cryochamber/disko-gpt.nix
Normal file
|
|
@ -0,0 +1,127 @@
|
|||
{
|
||||
disko.devices = {
|
||||
disk = {
|
||||
vda = {
|
||||
type = "disk";
|
||||
device = "/dev/vda";
|
||||
content = {
|
||||
type = "gpt";
|
||||
partitions = {
|
||||
boot = {
|
||||
size = "1M";
|
||||
type = "EF02";
|
||||
};
|
||||
ESP = {
|
||||
name = "ESP";
|
||||
size = "512M";
|
||||
type = "EF00";
|
||||
content = {
|
||||
type = "filesystem";
|
||||
format = "vfat";
|
||||
mountpoint = "/boot";
|
||||
mountOptions = [ "umask=0077" ];
|
||||
};
|
||||
};
|
||||
swap = {
|
||||
size = "8G";
|
||||
type = "82";
|
||||
content = {
|
||||
type = "swap";
|
||||
randomEncryption = true;
|
||||
};
|
||||
};
|
||||
zfs = {
|
||||
size = "100%";
|
||||
type = "83";
|
||||
content = {
|
||||
type = "zfs";
|
||||
pool = "rpool";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
zpool = {
|
||||
rpool = {
|
||||
type = "zpool";
|
||||
rootFsOptions = {
|
||||
acltype = "posixacl";
|
||||
compression = "lz4";
|
||||
dnodesize = "auto";
|
||||
normalization = "formD";
|
||||
relatime = "on";
|
||||
xattr = "sa";
|
||||
};
|
||||
options = {
|
||||
ashift = "12";
|
||||
autotrim = "on";
|
||||
};
|
||||
datasets = {
|
||||
# Non-filesystem datasets
|
||||
"local" = {
|
||||
type = "zfs_fs";
|
||||
options = {
|
||||
mountpoint = "none";
|
||||
canmount = "off";
|
||||
};
|
||||
};
|
||||
"safe" = {
|
||||
type = "zfs_fs";
|
||||
options = {
|
||||
mountpoint = "none";
|
||||
canmount = "off";
|
||||
};
|
||||
};
|
||||
"local/var" = {
|
||||
type = "zfs_fs";
|
||||
options = {
|
||||
mountpoint = "none";
|
||||
canmount = "off";
|
||||
};
|
||||
};
|
||||
|
||||
# Local datasets
|
||||
"local/root" = {
|
||||
type = "zfs_fs";
|
||||
options = {
|
||||
mountpoint = "legacy";
|
||||
canmount = "noauto";
|
||||
};
|
||||
mountpoint = "/";
|
||||
postCreateHook = ''
|
||||
zfs snapshot rpool/local/root@blank
|
||||
'';
|
||||
};
|
||||
"local/nix" = {
|
||||
type = "zfs_fs";
|
||||
options.mountpoint = "legacy";
|
||||
mountpoint = "/nix";
|
||||
};
|
||||
"local/var/lib" = {
|
||||
type = "zfs_fs";
|
||||
options.mountpoint = "legacy";
|
||||
mountpoint = "/var/lib";
|
||||
};
|
||||
"local/var/log" = {
|
||||
type = "zfs_fs";
|
||||
options.mountpoint = "legacy";
|
||||
mountpoint = "/var/log";
|
||||
};
|
||||
|
||||
# Safe datasets
|
||||
"safe/persist" = {
|
||||
type = "zfs_fs";
|
||||
options.mountpoint = "legacy";
|
||||
mountpoint = "/persist";
|
||||
};
|
||||
"safe/home" = {
|
||||
type = "zfs_fs";
|
||||
options.mountpoint = "legacy";
|
||||
mountpoint = "/home";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
23
hosts/cryochamber/flake.nix
Normal file
23
hosts/cryochamber/flake.nix
Normal file
|
|
@ -0,0 +1,23 @@
|
|||
{
|
||||
inputs = {
|
||||
sops-nix.url = "github:Mic92/sops-nix";
|
||||
sops-nix.inputs.nixpkgs.follows = "nixpkgs";
|
||||
};
|
||||
|
||||
outputs = {
|
||||
self,
|
||||
nixpkgs,
|
||||
sops-nix,
|
||||
}:
|
||||
let
|
||||
system = "x86_64-linux";
|
||||
in
|
||||
{
|
||||
nixosConfigurations.cryochamber = nixpkgs.lib.nixosSystem {
|
||||
modules = [
|
||||
./configuration.nix
|
||||
sops-nix.nixosModules.sops
|
||||
];
|
||||
};
|
||||
};
|
||||
}
|
||||
64
hosts/cryochamber/hardware-configuration.nix
Normal file
64
hosts/cryochamber/hardware-configuration.nix
Normal file
|
|
@ -0,0 +1,64 @@
|
|||
# Do not modify this file! It was generated by ‘nixos-generate-config’
|
||||
# and may be overwritten by future invocations. Please make changes
|
||||
# to /etc/nixos/configuration.nix instead.
|
||||
{ config, lib, pkgs, modulesPath, ... }:
|
||||
|
||||
{
|
||||
imports =
|
||||
[ (modulesPath + "/profiles/qemu-guest.nix")
|
||||
];
|
||||
|
||||
boot.initrd.availableKernelModules = [ "ahci" "xhci_pci" "virtio_pci" "virtio_scsi" "sr_mod" "virtio_blk" ];
|
||||
boot.initrd.kernelModules = [ ];
|
||||
boot.kernelModules = [ "kvm-amd" ];
|
||||
boot.extraModulePackages = [ ];
|
||||
|
||||
fileSystems."/" =
|
||||
{ device = "rpool/local/root";
|
||||
fsType = "zfs";
|
||||
};
|
||||
|
||||
fileSystems."/boot" =
|
||||
{ device = "/dev/disk/by-uuid/8553-FF36";
|
||||
fsType = "vfat";
|
||||
options = [ "fmask=0077" "dmask=0077" ];
|
||||
};
|
||||
|
||||
fileSystems."/home" =
|
||||
{ device = "rpool/safe/home";
|
||||
fsType = "zfs";
|
||||
};
|
||||
|
||||
fileSystems."/nix" =
|
||||
{ device = "rpool/local/nix";
|
||||
fsType = "zfs";
|
||||
};
|
||||
|
||||
fileSystems."/persist" =
|
||||
{ device = "rpool/safe/persist";
|
||||
fsType = "zfs";
|
||||
};
|
||||
|
||||
fileSystems."/var/lib" =
|
||||
{ device = "rpool/local/var/lib";
|
||||
fsType = "zfs";
|
||||
};
|
||||
|
||||
fileSystems."/var/log" =
|
||||
{ device = "rpool/local/var/log";
|
||||
fsType = "zfs";
|
||||
};
|
||||
|
||||
#swapDevices =
|
||||
# [ { device = "/dev/disk/by-uuid/c9c11edf-7989-4141-b647-4dbac7de5293"; }
|
||||
# ];
|
||||
|
||||
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
|
||||
# (the default) this is the recommended approach. When using systemd-networkd it's
|
||||
# still possible to use this option, but it's recommended to use it in conjunction
|
||||
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
|
||||
networking.useDHCP = lib.mkDefault true;
|
||||
# networking.interfaces.enp1s0.useDHCP = lib.mkDefault true;
|
||||
|
||||
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
|
||||
}
|
||||
25
hosts/cryochamber/secrets/config.yaml
Normal file
25
hosts/cryochamber/secrets/config.yaml
Normal file
|
|
@ -0,0 +1,25 @@
|
|||
hashedPassword: ENC[AES256_GCM,data:iUN2iaC2RPDa/vq6H7Xp2KqHYcHfQHU6IhZ2FWXEuaNhByFzpyMbJC7N2bmbDUD3ERLudHg686Uqt6XJV2PevQoXa1iYhv9cLw==,iv:ekGMzP2TXSrxLkqZVclHgN1NQIv6OqtsVLHdvsTgXQc=,tag:RRSZCHjmhn8ClrUTYteWWA==,type:str]
|
||||
sops:
|
||||
age:
|
||||
- recipient: age17sdp0gguexd88qel74fa4zeckxh93gqpkayz366fz6yvjauw7vcq7w6y45
|
||||
enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB3TWlKSGppbzRaZ0dUOUNz
|
||||
cXpReDF5UUZIbVg1MGkyZGNneGNiK0t3eEdRCk9jRjIvL25hREI3c1pVOU5JS1l2
|
||||
Q0tkNWU0RndiZEI4Z1dDSlFUQzAyZVUKLS0tIEVyc0JPVnBxNDlJSEVXc3V1WDY0
|
||||
bzlsWjVJZGx6eHk1MFh6ZFVpN0FOelUKaNsnY+6+t4lGv1e35BQjwPmI7AcQqpiu
|
||||
uiDxPhaXmGrlBDdpHaEjNYBvZjp0YA/0LwEX7uUipQD+Xrop5Snm4w==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
- recipient: age122r8wrurhfjwple2ykd4wxafxezjd78mpkrzzyplcdju8q5ykecs3wycee
|
||||
enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBYYjdUWjQxL0UrWnNWSUpi
|
||||
ZWlsUVNTK0xXZVVFd2pNSitldnFaVzdoQnhnCkNma2llSDVmTzZGL1Y0VUhFSk9h
|
||||
NEVUM3MwU2RQMTJpdFdEVWtPa2tCdzQKLS0tIGxrU3hzUzh4MGZQcElyRG1CZ3RS
|
||||
NDJWOEMyU1hwcHRXMUh6RkEzOFhndG8KY/fCz/+MfGQlnLC3Kzo5hYOmd0fRakDQ
|
||||
JjVD+zxHFqN5b3U03iS9WIsdjF3hRFqqnZMOeXTUDezDfTNPdmUuMg==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
lastmodified: "2025-12-29T20:30:43Z"
|
||||
mac: ENC[AES256_GCM,data:4tBtaoDxLrLIyIXi51TKB2U5eP9kkEpz1UaW2eBTGXkdmn+k/oiouQ4spigQ8O0dKvdy4SmvOSksCC7TSDeZ0ToKbyorqFrTbnhvUdACjw6O6I8WJ8daaOGuvKHjiYk1CWhn8zdC+QTa/gpjVoQhTfiEFuPXgFMMoI24h7000XE=,iv:6taR8qzv/liCLAeqkYnUV+9D0b9z0zCOPHsOo+JMXnw=,tag:TUg6Z9GQLPLnyvW6lCHFpw==,type:str]
|
||||
unencrypted_suffix: _unencrypted
|
||||
version: 3.11.0
|
||||
Loading…
Add table
Add a link
Reference in a new issue