1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
|
{ config, lib, input, pkgs, ... }:
let
sefidelKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILN14b5Fu+StHeMXq4ClyLG4G+/vCAfS7adxceEFria/ openpgp:0x1D5BCD11" ];
maintainerKeys = [ ] ++ sefidelKeys;
in
{
imports = [ ];
deployment = {
targetHost = "kanata.bee-polaris.ts.net";
targetUser = "root";
};
boot.loader.systemd-boot.enable = true;
boot.loader.efi.canTouchEfiVariables = true;
boot.supportedFilesystems = [ "zfs" ];
networking.hostId = "31cc5527";
networking.hostName = "kanata";
# Erase your darlings
boot.initrd.postDeviceCommands = lib.mkAfter ''
zfs rollback -r rpool/local/root@blank
'';
boot.kernelModules = [ "r8169" ];
boot.initrd.kernelModules = [ "r8169" ];
boot.initrd.network.enable = true;
boot.initrd.network.ssh = {
enable = true;
# Using the same port as the actual SSH daemon will cause the clients to
# throw errors related to host key mismatch.
port = 2222;
hostKeys = [
# XXX: This has to be manually generated during NixOS install.
# The files are then copied to initrd secrets during activation.
"/persist/initrd/ssh_host_rsa_key"
"/persist/initrd/ssh_host_ed25519_key"
];
authorizedKeys = maintainerKeys;
};
boot.initrd.network.postCommands = ''
cat <<EOF > /root/.profile
if pgrep -x "zfs" > /dev/null
then
zfs load-key -a
killall zfs
else
echo "ZFS is not running -- this could be a sign of failure."
fi
EOF
'';
modules.tailscale-initrd = {
enable = true;
# XXX: This has to be manually generatd during NixOS install.
# The files are then copied to initrd secrets during activation.
tailscaleStatePath = "/persist/initrd/tailscale-initrd.state";
};
services.openssh.enable = true;
users.users.root.openssh.authorizedKeys.keys = maintainerKeys;
fileSystems."/persist".neededForBoot = true;
services.openssh.hostKeys = [
{
path = "/persist/ssh/ssh_host_ed25519_key";
type = "ed25519";
}
{
path = "/persist/ssh/ssh_host_rsa_key";
type = "rsa";
bits = 4096;
}
];
services.tailscale = {
enable = true;
useRoutingFeatures = "both";
};
environment.persistence."/persist".directories = [ "/var/lib/tailscale" ];
sops.defaultSopsFile = ./secrets/secrets.yaml;
# This option defines the first version of NixOS you have installed on this particular machine,
# and is used to maintain compatibility with application data (e.g. databases) created on older NixOS versions.
#
# Most users should NEVER change this value after the initial install, for any reason,
# even if you've upgraded your system to a new NixOS release.
#
# This value does NOT affect the Nixpkgs version your packages and OS are pulled from,
# so changing it will NOT upgrade your system - see https://nixos.org/manual/nixos/stable/#sec-upgrading for how
# to actually do that.
#
# This value being lower than the current NixOS release does NOT mean your system is
# out of date, out of support, or vulnerable.
#
# Do NOT change this value unless you have manually inspected all the changes it would make to your configuration,
# and migrated your data accordingly.
#
# For more information, see `man configuration.nix` or https://nixos.org/manual/nixos/stable/options#opt-system.stateVersion .
system.stateVersion = "24.05"; # Did you read the comment?
}
|
