feat: new deploy system, allows for in-repo pii

modules/home/common/custom-packages.nix

@@ -24,6 +24,7 @@
       fhs
       swarsel-bootstrap
       swarsel-displaypower
+      swarsel-deploy
       swarselzellij
       sshrm
 

modules/home/common/ssh.nix

@@ -16,7 +16,7 @@
         };
         "winters" = {
           hostname = "192.168.1.2";
-          user = "swarsel";
+          user = "root";
         };
         "minecraft" = {
           hostname = "130.61.119.129";

modules/nixos/common/home-manager.nix

@@ -6,6 +6,14 @@
     home-manager = lib.mkIf config.swarselsystems.withHomeManager {
       useGlobalPkgs = true;
       useUserPackages = true;
+      verbose = true;
+      sharedModules = [
+        inputs.nix-index-database.hmModules.nix-index
+        inputs.sops-nix.homeManagerModules.sops
+        {
+          home.stateVersion = lib.mkDefault config.system.stateVersion;
+        }
+      ];
       extraSpecialArgs = { inherit (inputs) self; };
     };
   };

modules/nixos/common/lanzaboote.nix

@@ -10,7 +10,7 @@
       lanzaboote = lib.mkIf (!config.swarselsystems.initialSetup && config.swarselsystems.isSecureBoot) {
         enable = true;
         pkiBundle = "/var/lib/sbctl";
-        configurationLimit = 3;
+        configurationLimit = 6;
       };
     };
   };

modules/nixos/server/packages.nix

@@ -5,6 +5,7 @@
     environment.systemPackages = with pkgs; [
       gnupg
       nix-index
+      nvd
       ssh-to-age
       git
       emacs

modules/nixos/server/ssh.nix

@@ -4,6 +4,18 @@
   config = lib.mkIf config.swarselsystems.modules.server.ssh {
     services.openssh = {
       enable = true;
+      startWhenNeeded = lib.mkForce false;
+      settings = {
+        PasswordAuthentication = false;
+        KbdInteractiveAuthentication = false;
+        PermitRootLogin = "yes";
+      };
+      hostKeys = [
+        {
+          path = "/etc/ssh/ssh_host_ed25519_key";
+          type = "ed25519";
+        }
+      ];
     };
     users.users."${config.swarselsystems.mainUser}".openssh.authorizedKeys.keyFiles = [
       (self + /secrets/keys/ssh/yubikey.pub)