Add ruil and make liminal full-flake

2026-02-13 22:25:21 -08:00 · 2026-02-13 22:25:21 -08:00 · ff5367794d
commit ff5367794d
parent 97dceb1d65
16 changed files with 484 additions and 747 deletions
--- a/hosts/ruil/configuration.nix
+++ b/hosts/ruil/configuration.nix
@ -0,0 +1,71 @@
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports = [
+    ./hardware-configuration.nix
+    (modulesPath + "/virtualisation/digital-ocean-config.nix")
+  ];
+
+  networking.hostName = "ruil";
+
+  system.stateVersion = "25.11";
+
+  # Enable nix flakes
+  nix.settings.experimental-features = [ "nix-command" "flakes" ];
+
+  # sops-nix secrets
+  sops.defaultSopsFile = ./secrets/config.yaml;
+  sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
+  sops.secrets.hashedPassword-hunner.neededForUsers = true;
+  sops.secrets.hashedPassword-ruil.neededForUsers = true;
+  sops.secrets.hashedPassword-root.neededForUsers = true;
+
+  # SSH key from DO metadata, shared across all users
+  users.users.root = {
+    hashedPasswordFile = config.sops.secrets.hashedPassword-root.path;
+    openssh.authorizedKeys.keys = [
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB5+cFZ52qQft4ionKvdHkNM7lmj3x7vSiG/KqGvZ9JP hunter@haugens.org"
+    ];
+  };
+
+  users.users.hunner = {
+    uid = 1000;
+    isNormalUser = true;
+    extraGroups = [ "wheel" ];
+    hashedPasswordFile = config.sops.secrets.hashedPassword-hunner.path;
+    openssh.authorizedKeys.keys = [
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB5+cFZ52qQft4ionKvdHkNM7lmj3x7vSiG/KqGvZ9JP hunter@haugens.org"
+    ];
+  };
+
+  users.users.ruil = {
+    uid = 1001;
+    isNormalUser = true;
+    hashedPasswordFile = config.sops.secrets.hashedPassword-ruil.path;
+    openssh.authorizedKeys.keys = [
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB5+cFZ52qQft4ionKvdHkNM7lmj3x7vSiG/KqGvZ9JP hunter@haugens.org"
+    ];
+  };
+
+  # Packages
+  environment.systemPackages = with pkgs; [
+    vim
+    git
+    wget
+    curl
+    htop
+    tmux
+  ];
+
+  # SSH — keys only, no password auth
+  services.openssh.enable = true;
+  services.openssh.settings.PermitRootLogin = "prohibit-password";
+  services.openssh.settings.PasswordAuthentication = false;
+  services.openssh.settings.KbdInteractiveAuthentication = false;
+
+  # Firewall
+  networking.firewall = {
+    enable = true;
+    allowedTCPPorts = [ 22 ];
+  };
+}
--- a/hosts/ruil/hardware-configuration.nix
+++ b/hosts/ruil/hardware-configuration.nix
@ -0,0 +1,24 @@
+# Do not modify this file!  It was generated by 'nixos-generate-config'
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports =
+    [ (modulesPath + "/profiles/qemu-guest.nix")
+    ];
+
+  boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "virtio_scsi" "virtio_blk" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-intel" ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" =
+    { device = "/dev/disk/by-uuid/f222513b-ded1-49fa-b591-20ce86a2fe7f";
+      fsType = "ext4";
+    };
+
+  swapDevices = [ ];
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+}
--- a/hosts/ruil/secrets/config.yaml
+++ b/hosts/ruil/secrets/config.yaml
@ -0,0 +1,27 @@
+hashedPassword-hunner: ENC[AES256_GCM,data:fvgYWStE5XyHF1b9lntEfnml9cFbwaz5YCJRiPglDnLvWCPUY/95WsPAod/+1wYDW/LZl3tcBi9B0jF3OqiPZ8yeiu2DR85IKA==,iv:M0mu3m65L7ObZ9Mv97fvr9Z6qZk268h7AZSuW+ecrEk=,tag:pQKMKdJXToLJ188gkJMuCA==,type:str]
+hashedPassword-ruil: ENC[AES256_GCM,data:fwBU+24byBOTKljdABTvk2VxR5PGR18R3oozB/wSlORz12oQwjqAtdVBLSR2JZqA7yOWM5V//Ig60GCE4XmYc5pwVsEWqdY8JA==,iv:yuMNzQc+YfPyCFNYgNsh+xEJyLIFRUj0Er5TtYdcG18=,tag:dQpTM937EHEcEDJto4BVog==,type:str]
+hashedPassword-root: ENC[AES256_GCM,data:E/T3LBreiSZaC/qZ2QNxz3prGHoj47zS3ILsa7lmPzJDfLQ5yALxjWo4GyPHT9+kAU7uGOBG5/Ab5VqWxw+1cyk/YwT2dyMB+Q==,iv:eMav5Lnrm9SmQgHSDFiTKP6n9mADSsunlWyrSrIgA4E=,tag:fcMt6wiOClb30Vfkd9Dxmw==,type:str]
+sops:
+    age:
+        - recipient: age17sdp0gguexd88qel74fa4zeckxh93gqpkayz366fz6yvjauw7vcq7w6y45
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBSNU83VWd1WkVoQmJQSWxl
+            K0kwVkdwSmF0M1hWQllZVWdBOFZlVDJQQ3hzCjIzbTRuOVlLR2F5b2p2d0VzckRa
+            c3NmTDQ1KzMyVW1VaS92a0tHT0thR3cKLS0tIGFKRWkyVlZ6SVhxQW02Ny9vRVRG
+            VWltdzhKcVk1aW1iYlRyS2t2YVBpVlUKaIuwNyokIQt9NYWKeSqO2o0Zr3TrJkGT
+            tndCtzrHPjuQ5CPGofPW38nkNGMrrmuKcxwp+g8rawd35leCWCidPw==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1z9x0t7yw3g65wusgg3pg8dr9hu74wkxxfnasqgly32l28pkr6sfs8g72fz
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBsTTU2aTlJVkY2eUc5UG53
+            OGd6eFFwU3ZqcDRtdzRHSmJGVGFYVkZhMWljCkRoSUlCSW1ZeW9xdzUwL1FBYVpP
+            OVpRUXBQZ1dzdW9VWjlaZWUrenRSa28KLS0tIFNmcURtL0xvWVE3Y004Y3ZhSTZl
+            VHorQzNrMFJLaFpSalZZdjNraXhlSVUKwWLesTzMxsEB45hWWzhZGWc1cDm/gmvF
+            MAytSLiBcieAkRKZoklyk/llbnq7kycvpZCU/sQrjKqmoHkC+TF3BQ==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-02-12T04:52:00Z"
+    mac: ENC[AES256_GCM,data:nl2ALcLsI0eQJjfZniRxeKl6XV9IMGiSJOlv7fadsaTfE+tFRDZY9WyXTsdnyGXq+wH1jb7quesPQ2cv060A1COCa5cdbxfqPDRj2AacmSQ4YhBfz+SdfJznhpWDupeMyn0LBF7ffHVOqq+dkcWVOVQR/AzBuEPIdJdzs3/ya1k=,iv:PDnfRMBjQMXbB2Upycqqp/TYCC6fPYsh6GQAt9hf4qE=,tag:8riFvSKCx3Hisdxz3HgKdA==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.11.0