mirror of
https://github.com/Swarsel/.dotfiles.git
synced 2025-12-06 17:17:22 +01:00
chore: cleanup
This commit is contained in:
Leon Schwarzäugl
parent
a8daed1d10
commit
e9da090c2a
GPG key ID:
26A54C31F2A4FD84
67 changed files with 4146 additions and 2727 deletions
66
hosts/nixos/bakery/default.nix
Normal file
66
hosts/nixos/bakery/default.nix
Normal file
|
|
@ -0,0 +1,66 @@
|
|||
{ self, config, inputs, lib, minimal, ... }:
|
||||
let
|
||||
primaryUser = config.swarselsystems.mainUser;
|
||||
sharedOptions = {
|
||||
isLaptop = true;
|
||||
isNixos = true;
|
||||
isBtrfs = true;
|
||||
isLinux = true;
|
||||
sharescreen = "eDP-1";
|
||||
profiles = {
|
||||
reduced = lib.mkIf (!minimal) true;
|
||||
minimal = lib.mkIf minimal true;
|
||||
};
|
||||
};
|
||||
in
|
||||
{
|
||||
|
||||
imports = [
|
||||
inputs.nixos-hardware.nixosModules.common-cpu-intel
|
||||
|
||||
./disk-config.nix
|
||||
./hardware-configuration.nix
|
||||
|
||||
];
|
||||
|
||||
|
||||
swarselsystems = lib.recursiveUpdate
|
||||
{
|
||||
info = "Lenovo ThinkPad";
|
||||
firewall = lib.mkForce true;
|
||||
wallpaper = self + /files/wallpaper/lenovowp.png;
|
||||
hasBluetooth = true;
|
||||
hasFingerprint = true;
|
||||
isImpermanence = true;
|
||||
isSecureBoot = false;
|
||||
isCrypted = true;
|
||||
isSwap = true;
|
||||
rootDisk = "/dev/nvme0n1";
|
||||
swapSize = "4G";
|
||||
hostName = config.node.name;
|
||||
profiles = {
|
||||
btrfs = true;
|
||||
};
|
||||
}
|
||||
sharedOptions;
|
||||
|
||||
home-manager.users."${primaryUser}" = {
|
||||
# home.stateVersion = lib.mkForce "23.05";
|
||||
swarselsystems = lib.recursiveUpdate
|
||||
{
|
||||
lowResolution = "1280x800";
|
||||
highResolution = "1920x1080";
|
||||
monitors = {
|
||||
main = {
|
||||
name = "LG Display 0x04EF Unknown";
|
||||
mode = "1920x1080"; # TEMPLATE
|
||||
scale = "1";
|
||||
position = "1920,0";
|
||||
workspace = "15:L";
|
||||
output = "eDP-1";
|
||||
};
|
||||
};
|
||||
}
|
||||
sharedOptions;
|
||||
};
|
||||
}
|
||||
122
hosts/nixos/bakery/disk-config.nix
Normal file
122
hosts/nixos/bakery/disk-config.nix
Normal file
|
|
@ -0,0 +1,122 @@
|
|||
{ lib, pkgs, config, rootDisk, ... }:
|
||||
let
|
||||
type = "btrfs";
|
||||
extraArgs = [ "-L" "nixos" "-f" ]; # force overwrite
|
||||
subvolumes = {
|
||||
"/root" = {
|
||||
mountpoint = "/";
|
||||
mountOptions = [
|
||||
"subvol=root"
|
||||
"compress=zstd"
|
||||
"noatime"
|
||||
];
|
||||
};
|
||||
"/home" = lib.mkIf config.swarselsystems.isImpermanence {
|
||||
mountpoint = "/home";
|
||||
mountOptions = [
|
||||
"subvol=home"
|
||||
"compress=zstd"
|
||||
"noatime"
|
||||
];
|
||||
};
|
||||
"/persist" = lib.mkIf config.swarselsystems.isImpermanence {
|
||||
mountpoint = "/persist";
|
||||
mountOptions = [
|
||||
"subvol=persist"
|
||||
"compress=zstd"
|
||||
"noatime"
|
||||
];
|
||||
};
|
||||
"/log" = lib.mkIf config.swarselsystems.isImpermanence {
|
||||
mountpoint = "/var/log";
|
||||
mountOptions = [
|
||||
"subvol=log"
|
||||
"compress=zstd"
|
||||
"noatime"
|
||||
];
|
||||
};
|
||||
"/nix" = {
|
||||
mountpoint = "/nix";
|
||||
mountOptions = [
|
||||
"subvol=nix"
|
||||
"compress=zstd"
|
||||
"noatime"
|
||||
];
|
||||
};
|
||||
"/swap" = lib.mkIf config.swarselsystems.isSwap {
|
||||
mountpoint = "/.swapvol";
|
||||
swap.swapfile.size = config.swarselsystems.swapSize;
|
||||
};
|
||||
};
|
||||
in
|
||||
{
|
||||
disko.devices = {
|
||||
disk = {
|
||||
disk0 = {
|
||||
type = "disk";
|
||||
device = config.swarselsystems.rootDisk;
|
||||
content = {
|
||||
type = "gpt";
|
||||
partitions = {
|
||||
ESP = {
|
||||
priority = 1;
|
||||
name = "ESP";
|
||||
size = "512M";
|
||||
type = "EF00";
|
||||
content = {
|
||||
type = "filesystem";
|
||||
format = "vfat";
|
||||
mountpoint = "/boot";
|
||||
mountOptions = [ "defaults" ];
|
||||
};
|
||||
};
|
||||
root = lib.mkIf (!config.swarselsystems.isCrypted) {
|
||||
size = "100%";
|
||||
content = {
|
||||
inherit type subvolumes extraArgs;
|
||||
postCreateHook = lib.mkIf config.swarselsystems.isImpermanence ''
|
||||
MNTPOINT=$(mktemp -d)
|
||||
mount "/dev/disk/by-label/nixos" "$MNTPOINT" -o subvolid=5
|
||||
trap 'umount $MNTPOINT; rm -rf $MNTPOINT' EXIT
|
||||
btrfs subvolume snapshot -r $MNTPOINT/root $MNTPOINT/root-blank
|
||||
'';
|
||||
};
|
||||
};
|
||||
luks = lib.mkIf config.swarselsystems.isCrypted {
|
||||
size = "100%";
|
||||
content = {
|
||||
type = "luks";
|
||||
name = "cryptroot";
|
||||
passwordFile = "/tmp/disko-password"; # this is populated by bootstrap.sh
|
||||
settings = {
|
||||
allowDiscards = true;
|
||||
# https://github.com/hmajid2301/dotfiles/blob/a0b511c79b11d9b4afe2a5e2b7eedb2af23e288f/systems/x86_64-linux/framework/disks.nix#L36
|
||||
crypttabExtraOpts = [
|
||||
"fido2-device=auto"
|
||||
"token-timeout=10"
|
||||
];
|
||||
};
|
||||
content = {
|
||||
inherit type subvolumes extraArgs;
|
||||
postCreateHook = lib.mkIf config.swarselsystems.isImpermanence ''
|
||||
MNTPOINT=$(mktemp -d)
|
||||
mount "/dev/mapper/cryptroot" "$MNTPOINT" -o subvolid=5
|
||||
trap 'umount $MNTPOINT; rm -rf $MNTPOINT' EXIT
|
||||
btrfs subvolume snapshot -r $MNTPOINT/root $MNTPOINT/root-blank
|
||||
'';
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
fileSystems."/persist".neededForBoot = lib.mkIf config.swarselsystems.isImpermanence true;
|
||||
fileSystems."/home".neededForBoot = lib.mkIf config.swarselsystems.isImpermanence true;
|
||||
|
||||
environment.systemPackages = [
|
||||
pkgs.yubikey-manager
|
||||
];
|
||||
}
|
||||
23
hosts/nixos/bakery/hardware-configuration.nix
Normal file
23
hosts/nixos/bakery/hardware-configuration.nix
Normal file
|
|
@ -0,0 +1,23 @@
|
|||
# Do not modify this file! It was generated by ‘nixos-generate-config’
|
||||
# and may be overwritten by future invocations. Please make changes
|
||||
# to /etc/nixos/configuration.nix instead.
|
||||
{ config, lib, modulesPath, ... }:
|
||||
|
||||
{
|
||||
imports =
|
||||
[
|
||||
(modulesPath + "/installer/scan/not-detected.nix")
|
||||
];
|
||||
|
||||
boot = {
|
||||
initrd = {
|
||||
availableKernelModules = [ "xhci_pci" "nvme" "usb_storage" "sd_mod" ];
|
||||
kernelModules = [ ];
|
||||
};
|
||||
kernelModules = [ ];
|
||||
extraModulePackages = [ ];
|
||||
};
|
||||
|
||||
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
|
||||
hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
|
||||
}
|
||||
22
hosts/nixos/bakery/secrets/pii.nix.enc
Normal file
22
hosts/nixos/bakery/secrets/pii.nix.enc
Normal file
|
|
@ -0,0 +1,22 @@
|
|||
{
|
||||
"data": "ENC[AES256_GCM,data:M8uEE2uxhHHh5UdLO+J18EMVWm+9FCR2BHMJ3P0Il4h+0CqWOS27aVWPjI2lIt+jw5svt5kVbTIzwvw1GmEdcXzJrE9yZ0eKkXSm/TYQQZhlmcPcNeJyDf/bLivwExKicRy2JR2KNyAoiW5gISF7nkUv10EnM60mzH2RftPijvdgSTmdoNu/9Q0J3M46k+EVGO370NXT89eSbhFMS4r6M94vKaA=,iv:C4ELLFaF9yFfDH+g/TwQtRm1DuRtIAxcI55I0mpKd70=,tag:jLWAD2pLkqzekJipf/Rc5Q==,type:str]",
|
||||
"sops": {
|
||||
"age": [
|
||||
{
|
||||
"recipient": "age1mjgw3nxlnqdj04mgjz3wn7fj2nl2nxla4p2r2fn4nkvayfgp09pqllxzyh",
|
||||
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBZaGtCbDBYaDZTMUhhbTY2\nbk45NWRPZU5nWmh5M0ZDNGF2Q09rNHNzRGhzCjh1d3pLRnRtZjVnaG1oN0daOXRy\nUzVFd3QzVTBib29QbGN4cXNheVRCNWcKLS0tIFlielcwODk4MjFsS29ybXNDMm5y\nN01aaHBFN0VPdTNrMzJNaE9NRG9KRnMKNV4rqYphPTyXF5m+qNq10aIov8quVh2Y\nALelTPRpD/hMYou/s8Ro49GHNNNKeV9J+4Tvq1QEmIIdvjFLy9AS9A==\n-----END AGE ENCRYPTED FILE-----\n"
|
||||
}
|
||||
],
|
||||
"lastmodified": "2025-07-10T15:25:21Z",
|
||||
"mac": "ENC[AES256_GCM,data:pMWJo+JuSgs7RE+rc6vB1u/V3kfQzRjknxIMkNNJCcBp2WVoz84BZ23oruaB2Z/ZSO9zpaQMHkuAqGZU7CuvZ1JvECHWov5fRkXDPeaeIVw3dtof1XzH5plRmAUzabrmEzrGSnwJrJ6DRlAhrq2gDyyIY4qmUeySc7zgR7QVf0o=,iv:iCM7ulRAP5FYyR/z7CSDRYMsm2Gjs7qWLChtslGfzO4=,tag:QJ2Lxmwvgd+ILHeYhMvmwg==,type:str]",
|
||||
"pgp": [
|
||||
{
|
||||
"created_at": "2025-07-10T23:51:27Z",
|
||||
"enc": "-----BEGIN PGP MESSAGE-----\n\nhQIMAwDh3VI7VctTARAAmKgk+exHX36+IkSQC03yiRpEKpmkqt+FcGsbDMonTyow\nmvhmwSc7UscNOgOQYDYA66vMCWE2Ij9gxFJNpPG3rXFiC11XN1/pq+Jy3Qvk3DNV\ntnXgwDvSt7Ry7FThXnPiJAkcjwYNeTniyjzKcUmXA+yEJAlswjGjH6uP/Nvkeo2n\np+OvRQc0cXHBSTbnIq4dHaqVlp1JWOQgtZVrIgwN/rv3xvDPE2E2dmCc9hUg83vk\naUT7fDo8v5hWwJJO7Q6OvECKw/D4jWTxnBP1nS3a66shkpcC7lpYQjE6AtAM3AbY\nB84rat/Tff6ZcmtxMvIa62vfwrfSh/00DmRlPkIe1KlbjrV1kafzbySjI7q1vy2l\neZL7/Zi49fy/KudQ+/OOMC/PlhGLYGtEo3sNmLY7pfBNuMmwjYQ0K/1kKQ8XXJDw\nbWQDP+8aeIKKciLy07NW5Fd5gc5S1exSFHDQyhCXjdUcPk3cTfnEvMP/T1bCNCaD\nGxy6IEifdJvYNeWyaxgbKzsLmz8kTd6wPj/v0BIdL+dy3/a/4SVLR9r7Qn3bMgkc\nb1wVY4XDyt6LPnwVY3UOFPSCVckGb8NRnciKOj1TnsaYI6xEQ0ObuuAedVJQj0wF\n5OqYrwnH+riiLFMVzsEspNQNlMTRY86zPIxuNe8qPDdVL5CotAoobzdmr9cc75uF\nAgwDC9FRLmchgYQBD/4ntfP9dGtNzb9BjR6NEmdqJDIS37lHCc6ts/f86VCiy0tk\nhdtVdZ7sYdFvzkGimfmcbsVJ5VOPK6S82L0xUlROCax1bVkjK8VjqppUbTxQMgWh\nek7pPzE66MJzXlpqGgmRHgLuV0yhTqz9TGbTetjYYlWiOGMGYHwvxMLnvTvQIbJb\nBwtpbK0SEu7ODMn1mGtWpzkVI9rDeCW/FT0bBj1KvkWBWbCVFCSVGjmxuWcFgRs/\nc3aNA/DLQMsX7TzvqiY+dXLdp9/vuyqIf+qzC8IIrI5fskzaVfjP+OzeAVTXeI/f\nYsgvF31Z+DfMAFQ7dnAQ56Ys/oSdNTaAnhfFjI4S40qw0SfZdTWzUm9IjhnZKgaU\nNV9V3b2D7nr64JxutHzYiJemlB4Oy+HhqMQR3AYeMDX3hEG1Xt7splkBLdXccIEe\nGTOoaIffV1QUAB2M9PVyidpLf98Ii9s8Mr2OUcQsYiJy7jNXTudx50mnIhmBSDPN\nk/RSFoMo0+v7jC7lWkfWhvunUJrJ37zNSEHZcJo7Wj+SflqZDI/QRQAez6xRF6ih\nzgFfAgNSDAkbymvju7I6V9TEOw8rLdlXLlBNd+GAy0S2HfNIN8lx2tVnP++zP54C\nhdEDMU+uKp98Wu1fVuMipzjfPqJ0lpNj9M2+ma3q3w1L4YbMa+nVEK4/mmP0e9Jc\nAdvTsgHHFgN5KOwmZkQdAhKJ89cwcGUwZwn/gO7pEGoOw6WaHIIE6ueOiThfkXm/\nWIe1AC/JQapdMlvmF+2Rf51RmSkWX3/vtFPNkWvgkGgCely/eDXRK/si+kk=\n=ep9e\n-----END PGP MESSAGE-----",
|
||||
"fp": "4BE7925262289B476DBBC17B76FD3810215AE097"
|
||||
}
|
||||
],
|
||||
"unencrypted_suffix": "_unencrypted",
|
||||
"version": "3.10.2"
|
||||
}
|
||||
}
|
||||
|
|
@ -1,165 +1,46 @@
|
|||
{ lib, config, globals, ... }:
|
||||
{ lib, config, minimal, ... }:
|
||||
let
|
||||
primaryUser = config.swarselsystems.mainUser;
|
||||
sharedOptions = {
|
||||
isBtrfs = false;
|
||||
isBtrfs = true;
|
||||
isLinux = true;
|
||||
isNixos = true;
|
||||
};
|
||||
profiles = {
|
||||
minimal = lib.mkIf minimal true;
|
||||
};
|
||||
inherit (config.repo.secrets.common) workHostName;
|
||||
inherit (config.repo.secrets.local.syncthing) dev1 dev2 dev3 loc1;
|
||||
serviceDomain = config.repo.secrets.common.services.domains.syncthing2;
|
||||
in
|
||||
{
|
||||
imports = [
|
||||
./hardware-configuration.nix
|
||||
./disk-config.nix
|
||||
];
|
||||
|
||||
sops = {
|
||||
defaultSopsFile = lib.mkForce "/root/.dotfiles/secrets/milkywell/secrets.yaml";
|
||||
};
|
||||
|
||||
boot = {
|
||||
loader.systemd-boot.enable = true;
|
||||
tmp.cleanOnBoot = true;
|
||||
loader.grub.device = "nodev";
|
||||
};
|
||||
zramSwap.enable = false;
|
||||
|
||||
networking = {
|
||||
nftables.enable = lib.mkForce false;
|
||||
hostName = "milkywell";
|
||||
enableIPv6 = false;
|
||||
enableIPv6 = true;
|
||||
domain = "subnet03112148.vcn03112148.oraclevcn.com";
|
||||
firewall = {
|
||||
allowedTCPPorts = [ 80 443 8384 9812 22000 27701 ];
|
||||
allowedUDPPorts = [ 21027 22000 ];
|
||||
extraCommands = ''
|
||||
iptables -I INPUT -m state --state NEW -p tcp --dport 80 -j ACCEPT
|
||||
iptables -I INPUT -m state --state NEW -p tcp --dport 443 -j ACCEPT
|
||||
iptables -I INPUT -m state --state NEW -p tcp --dport 27701 -j ACCEPT
|
||||
iptables -I INPUT -m state --state NEW -p tcp --dport 8384 -j ACCEPT
|
||||
iptables -I INPUT -m state --state NEW -p tcp --dport 3000 -j ACCEPT
|
||||
iptables -I INPUT -m state --state NEW -p tcp --dport 22000 -j ACCEPT
|
||||
iptables -I INPUT -m state --state NEW -p udp --dport 22000 -j ACCEPT
|
||||
iptables -I INPUT -m state --state NEW -p udp --dport 21027 -j ACCEPT
|
||||
iptables -I INPUT -m state --state NEW -p tcp --dport 9812 -j ACCEPT
|
||||
'';
|
||||
};
|
||||
};
|
||||
|
||||
hardware = {
|
||||
enableAllFirmware = lib.mkForce false;
|
||||
};
|
||||
|
||||
system.stateVersion = "23.11";
|
||||
|
||||
globals.services."syncthing-${config.networking.hostName}".domain = serviceDomain;
|
||||
|
||||
services = {
|
||||
nginx = {
|
||||
virtualHosts = {
|
||||
${serviceDomain} = {
|
||||
enableACME = true;
|
||||
forceSSL = true;
|
||||
acmeRoot = null;
|
||||
locations = {
|
||||
"/" = {
|
||||
proxyPass = "http://localhost:8384";
|
||||
extraConfig = ''
|
||||
client_max_body_size 0;
|
||||
'';
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
syncthing = {
|
||||
enable = true;
|
||||
guiAddress = "0.0.0.0:8384";
|
||||
openDefaultPorts = true;
|
||||
relay.enable = false;
|
||||
settings = {
|
||||
urAccepted = -1;
|
||||
devices = {
|
||||
"magicant" = {
|
||||
id = "VMWGEE2-4HDS2QO-KNQOVGN-LXLX6LA-666E4EK-ZBRYRRO-XFEX6FB-6E3XLQO";
|
||||
};
|
||||
"winters" = {
|
||||
id = "O7RWDMD-AEAHPP7-7TAVLKZ-BSWNBTU-2VA44MS-EYGUNBB-SLHKB3C-ZSLMOAA";
|
||||
};
|
||||
"${workHostName}" = {
|
||||
id = "YAPV4BV-I26WPTN-SIP32MV-SQP5TBZ-3CHMTCI-Z3D6EP2-MNDQGLP-53FT3AB";
|
||||
};
|
||||
"${dev1}" = {
|
||||
id = "OCCDGDF-IPZ6HHQ-5SSLQ3L-MSSL5ZW-IX5JTAM-PW4PYEK-BRNMJ7E-Q7YDMA7";
|
||||
};
|
||||
"${dev2}" = {
|
||||
id = "LPCFIIB-ENUM2V6-F2BWVZ6-F2HXCL2-BSBZXUF-TIMNKYB-7CATP7H-YU5D3AH";
|
||||
};
|
||||
"${dev3}" = {
|
||||
id = "LAUT2ZP-KEZY35H-AHR3ARD-URAREJI-2B22P5T-PIMUNWW-PQRDETU-7KIGNQR";
|
||||
};
|
||||
};
|
||||
folders = {
|
||||
"Default Folder" = lib.mkForce {
|
||||
path = "/var/lib/syncthing/Sync";
|
||||
type = "receiveonly";
|
||||
versioning = null;
|
||||
devices = [ "winters" "magicant" "${workHostName}" ];
|
||||
id = "default";
|
||||
};
|
||||
"Obsidian" = {
|
||||
path = "/var/lib/syncthing/Obsidian";
|
||||
type = "receiveonly";
|
||||
versioning = {
|
||||
type = "simple";
|
||||
params.keep = "5";
|
||||
};
|
||||
devices = [ "winters" "magicant" "${workHostName}" ];
|
||||
id = "yjvni-9eaa7";
|
||||
};
|
||||
"Org" = {
|
||||
path = "/var/lib/syncthing/Org";
|
||||
type = "receiveonly";
|
||||
versioning = {
|
||||
type = "simple";
|
||||
params.keep = "5";
|
||||
};
|
||||
devices = [ "winters" "magicant" "${workHostName}" ];
|
||||
id = "a7xnl-zjj3d";
|
||||
};
|
||||
"Vpn" = {
|
||||
path = "/var/lib/syncthing/Vpn";
|
||||
type = "receiveonly";
|
||||
versioning = {
|
||||
type = "simple";
|
||||
params.keep = "5";
|
||||
};
|
||||
devices = [ "winters" "magicant" "${workHostName}" ];
|
||||
id = "hgp9s-fyq3p";
|
||||
};
|
||||
"${loc1}" = {
|
||||
path = "/var/lib/syncthing/${loc1}";
|
||||
type = "receiveonly";
|
||||
versioning = {
|
||||
type = "simple";
|
||||
params.keep = "3";
|
||||
};
|
||||
devices = [ dev1 dev2 dev3 ];
|
||||
id = "5gsxv-rzzst";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
swarselsystems = lib.recursiveUpdate
|
||||
{
|
||||
info = "VM.Standard.E2.1.Micro";
|
||||
flakePath = "/root/.dotfiles";
|
||||
isImpermanence = false;
|
||||
isImpermanence = true;
|
||||
isSecureBoot = false;
|
||||
isCrypted = false;
|
||||
isCrypted = true;
|
||||
isSwap = true;
|
||||
rootDisk = "/dev/sda";
|
||||
swapSize = "4G";
|
||||
profiles = {
|
||||
server.syncserver = true;
|
||||
};
|
||||
|
|
@ -167,7 +48,6 @@ in
|
|||
sharedOptions;
|
||||
|
||||
home-manager.users."${primaryUser}" = {
|
||||
home.stateVersion = lib.mkForce "23.05";
|
||||
swarselsystems = lib.recursiveUpdate
|
||||
{ }
|
||||
sharedOptions;
|
||||
|
|
|
|||
98
hosts/nixos/milkywell/disk-config.nix
Normal file
98
hosts/nixos/milkywell/disk-config.nix
Normal file
|
|
@ -0,0 +1,98 @@
|
|||
# NOTE: ... is needed because dikso passes diskoFile
|
||||
{ lib
|
||||
, config
|
||||
, rootDisk
|
||||
, ...
|
||||
}:
|
||||
let
|
||||
type = "btrfs";
|
||||
extraArgs = [ "-L" "nixos" "-f" ]; # force overwrite
|
||||
subvolumes = {
|
||||
"/root" = {
|
||||
mountpoint = "/";
|
||||
mountOptions = [
|
||||
"subvol=root"
|
||||
"compress=zstd"
|
||||
"noatime"
|
||||
];
|
||||
};
|
||||
"/home" = lib.mkIf config.swarselsystems.isImpermanence {
|
||||
mountpoint = "/home";
|
||||
mountOptions = [
|
||||
"subvol=home"
|
||||
"compress=zstd"
|
||||
"noatime"
|
||||
];
|
||||
};
|
||||
"/persist" = lib.mkIf config.swarselsystems.isImpermanence {
|
||||
mountpoint = "/persist";
|
||||
mountOptions = [
|
||||
"subvol=persist"
|
||||
"compress=zstd"
|
||||
"noatime"
|
||||
];
|
||||
};
|
||||
"/log" = lib.mkIf config.swarselsystems.isImpermanence {
|
||||
mountpoint = "/var/log";
|
||||
mountOptions = [
|
||||
"subvol=log"
|
||||
"compress=zstd"
|
||||
"noatime"
|
||||
];
|
||||
};
|
||||
"/nix" = {
|
||||
mountpoint = "/nix";
|
||||
mountOptions = [
|
||||
"subvol=nix"
|
||||
"compress=zstd"
|
||||
"noatime"
|
||||
];
|
||||
};
|
||||
"/swap" = lib.mkIf config.swarselsystems.isSwap {
|
||||
mountpoint = "/.swapvol";
|
||||
swap.swapfile.size = config.swarselsystems.swapSize;
|
||||
};
|
||||
};
|
||||
in
|
||||
{
|
||||
disko.devices = {
|
||||
disk = {
|
||||
disk0 = {
|
||||
type = "disk";
|
||||
device = config.swarselsystems.rootDisk;
|
||||
content = {
|
||||
type = "gpt";
|
||||
partitions = {
|
||||
ESP = {
|
||||
priority = 1;
|
||||
name = "ESP";
|
||||
size = "512M";
|
||||
type = "EF00";
|
||||
content = {
|
||||
type = "filesystem";
|
||||
format = "vfat";
|
||||
mountpoint = "/boot";
|
||||
mountOptions = [ "defaults" ];
|
||||
};
|
||||
};
|
||||
root = {
|
||||
size = "100%";
|
||||
content = {
|
||||
inherit type subvolumes extraArgs;
|
||||
postCreateHook = lib.mkIf config.swarselsystems.isImpermanence ''
|
||||
MNTPOINT=$(mktemp -d)
|
||||
mount "/dev/disk/by-label/nixos" "$MNTPOINT" -o subvolid=5
|
||||
trap 'umount $MNTPOINT; rm -rf $MNTPOINT' EXIT
|
||||
btrfs subvolume snapshot -r $MNTPOINT/root $MNTPOINT/root-blank
|
||||
'';
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
fileSystems."/persist".neededForBoot = lib.mkIf config.swarselsystems.isImpermanence true;
|
||||
fileSystems."/home".neededForBoot = lib.mkIf config.swarselsystems.isImpermanence true;
|
||||
}
|
||||
|
|
@ -10,22 +10,6 @@
|
|||
extraModulePackages = [ ];
|
||||
};
|
||||
|
||||
fileSystems = {
|
||||
"/" = {
|
||||
device = "/dev/disk/by-uuid/4b47378a-02eb-4548-bab8-59cbf379252a";
|
||||
fsType = "xfs";
|
||||
};
|
||||
|
||||
"/boot" = {
|
||||
device = "/dev/disk/by-uuid/2B75-2AD5";
|
||||
fsType = "vfat";
|
||||
};
|
||||
};
|
||||
|
||||
swapDevices = [
|
||||
{ device = "/dev/disk/by-uuid/f0126a93-753e-4769-ada8-7499a1efb3a9"; }
|
||||
];
|
||||
|
||||
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
|
||||
# (the default) this is the recommended approach. When using systemd-networkd it's
|
||||
# still possible to use this option, but it's recommended to use it in conjunction
|
||||
|
|
|
|||
|
|
@ -3,10 +3,12 @@ let
|
|||
primaryUser = config.swarselsystems.mainUser;
|
||||
inherit (config.repo.secrets.common) workHostName;
|
||||
inherit (config.repo.secrets.local.syncthing) dev1 dev2 dev3 loc1;
|
||||
inherit (config.swarselsystems) sopsFile;
|
||||
serviceDomain = config.repo.secrets.common.services.domains.syncthing3;
|
||||
|
||||
sharedOptions = {
|
||||
isBtrfs = true;
|
||||
isNixos = true;
|
||||
isLinux = true;
|
||||
};
|
||||
in
|
||||
|
|
@ -18,9 +20,9 @@ in
|
|||
|
||||
sops = {
|
||||
age.sshKeyPaths = lib.mkDefault [ "/etc/ssh/ssh_host_ed25519_key" ];
|
||||
defaultSopsFile = lib.mkForce "/home/swarsel/.dotfiles/secrets/moonside/secrets.yaml";
|
||||
# defaultSopsFile = lib.mkForce "/home/swarsel/.dotfiles/secrets/moonside/secrets.yaml";
|
||||
secrets = {
|
||||
wireguard-private-key = { };
|
||||
wireguard-private-key = { inherit sopsFile; };
|
||||
};
|
||||
};
|
||||
|
||||
|
|
@ -210,7 +212,6 @@ in
|
|||
swarselsystems = lib.recursiveUpdate
|
||||
{
|
||||
info = "VM.Standard.A1.Flex, 4 OCPUs, 24GB RAM";
|
||||
flakePath = "/home/swarsel/.dotfiles";
|
||||
isImpermanence = true;
|
||||
isSecureBoot = false;
|
||||
isCrypted = false;
|
||||
|
|
|
|||
|
|
@ -1,5 +1,5 @@
|
|||
{
|
||||
"data": "ENC[AES256_GCM,data:CmkNQJe2siUanybNt9Nv8JSsOnJuoLUOpAPXbACPQFLc4YL9u5R9wImwbbOOgXGfVl8hQwYS5dc+2nu4kj11zdT4mCe62/fO+HgIMBEbU/c0zGZj2hjArJYBkOCHQYu1IzgXdACyamJ9s3MVe0xGJUkwK93X+89YQpc=,iv:9tzNWIk10A4w986fo6pkpaUvo4+y5+RD+OmBksy9TbU=,tag:r5Dlv/HGwtlAdKp3HsKiMg==,type:str]",
|
||||
"data": "ENC[AES256_GCM,data:Wk3OGKwcuY72VLL+SBYXZUqxTQ8SlYroF4H81YDGMUZu6gt6ialXNvAsZSmYyFNh+3p+ejvzqMO5mxbvAI9tKAvbdamtfO4Pi3A+sNvJ9XSLE9iLAdfWeoT2qLqGPgkXI1SGDof+FP5yIb36C8Um9P4hE3zaE+UdJBk0qgzlc1Zlq2Pdg0TGU6wwJQkRhZIDun1wabeqGWjLrBqUa9VPfNB1El63q/1rhP5v3m6tI7dXt0SQArTtbPWkkHHYPehObG6Q5s4Cm2QrWGpbK+R6xe5F+nEv4+dOuSkZgOB2HsOjzenjp/slqoZTCJYnKT5IDkFQaj5G8YftySyNE/OguMW6atCgulSygwaeuFsnjMNxxsHssrTndNe22jpTTrh2Odp9BT7oRiZPPR8zj/Z3hpLYca24X4oSlZLD0PFEExQNir6V7eT0gH6Paj7wz2rYeYKB8focatLNAwug7L6lWxnr/pw8IXCrfx4ZHw7VYn4hf/KF4isrPju6XW0u2wuiIVlJfOUXZXONmJULB6biftgZapveIMy1oHaabyuIIxkKGParhSUfj6/8/qPVftVFYotdlAy9oNRpZ8JG8z8Sf34etu9Fi7uzcZySKU9e8cU43o6kAo+r39RHRDuhUmYP0ocN2bdlTAkhPoFccK2A1Qx+W/+EwQr55mb5NCH95AVh2QX0SwWgD79FV7EYGN7iVEc+duV5YH8Qy37f6ebehQy+mZGFqCZ5s7Cqy7ChypB476qDqh82qp4K5Uv2NwoF7TT9REzjU0cbRseFbC77AgEUNvfHpHvLBTsw5Y4963GefSKltNHxKROboBfLkaGFHNOlQ8sHIY+vd5Y=,iv:g9iNn/sH7CtxcT4SeI8/DFG8BPIIoseYTuprGEQPqJ8=,tag:SuV+seYm30JAMN7QbdDl9g==,type:str]",
|
||||
"sops": {
|
||||
"age": [
|
||||
{
|
||||
|
|
@ -7,8 +7,8 @@
|
|||
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2YjdYNFF5Q1VzQTZ0WU1z\nN2R6cEVObU9RMXdpd2x0Mjh2cmpvY0VvNjE4CmF5Sm1vZWRoOTFIY2pkQUVRQ3FY\nVEd3eGpCbGQ3cUpvTE9JdjJMWnQvckEKLS0tIFRpZDZ1ZGZKaXpObFhZVlNqV0hB\nT20rRGV6S3gvWkZLUzQzVVNGQWNGVkUK0bAeRuI0vb7MJTtpxuD56nwZAk39sHAa\njEhntqsV9ts1Vbw2f0mZEqDdzd64NTtDm/YIwygZ2udV27mXNhVUVw==\n-----END AGE ENCRYPTED FILE-----\n"
|
||||
}
|
||||
],
|
||||
"lastmodified": "2025-06-13T17:33:11Z",
|
||||
"mac": "ENC[AES256_GCM,data:/PDAd2LB2n3gwnaYaUHDHT/Ze1YxXTA0wDxAZEc72B9DQO8trN0XISSqQ3YbopOy8J7wZu/HveX5nx4zoCPKcrMtqtFtlyviAE5Afl+3XcgKcNOGK/0yCq1fAD6q8Lfsl/t/5/4qXA5jlhobVmsDFfXJ8woYqCLijZXNNkc3X+w=,iv:Q9yngw0Z6aS1aB/iF6+oFoCYg1yN+mNKEsv8zaX4ba0=,tag:470JaIY68O3NublQLYw7GA==,type:str]",
|
||||
"lastmodified": "2025-07-08T00:23:59Z",
|
||||
"mac": "ENC[AES256_GCM,data:Db2w9giZy+TyXp2hpMN1h7ZgBaJ4WiAN2P6IFaoXufOlxT2uwulbzDMYFoUm9jcdFc8zqnYCvttosJIzyjevY5up9gDarzTu+43XFrTxYqPdgRBzzvxSeXmKqDnngAvv/qOWfzt7TG1IzpyytHX/DEPHvPM9dWgut/1K6Eq94Hs=,iv:WoWAAjse1kyn9IGX4kqCl3zvq4kXEMkfTjAi2j5OCFs=,tag:xco/8fudn2kCLnFa8mUIsA==,type:str]",
|
||||
"pgp": [
|
||||
{
|
||||
"created_at": "2025-06-13T20:12:55Z",
|
||||
|
|
|
|||
|
|
@ -4,6 +4,7 @@ let
|
|||
sharedOptions = {
|
||||
isBtrfs = false;
|
||||
isLinux = true;
|
||||
isNixos = true;
|
||||
profiles = {
|
||||
server.local = true;
|
||||
};
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue