1
0
mirror of https://github.com/tboerger/nixos-config synced 2024-11-26 07:43:45 +01:00

feat: renamed forlders to machines and profiles

This commit is contained in:
Thomas Boerger 2024-11-24 16:13:02 +01:00
parent 101194e5b0
commit d530b95106
No known key found for this signature in database
GPG Key ID: F630596501026DB5
134 changed files with 33 additions and 742 deletions

111
README.md

@ -11,68 +11,9 @@ and rekey the secrets via [agenix][agenix], you could also just execute
`ssh-keyscan ip_or_fqdn` to fetch the current public keys. After pushing the
rekeyed secrets execute the commands below.
## Desktops
## Asgard
Generally after the installation I'm cloning this repository somewhere onto the
desktop machine and just execute `make switch` within that repository to apply
updates, if this is not the case I can always execute the following command to
get the latest changes pulled in:
```console
nixos-rebuild switch --flake github:tboerger/nixos-config#hostname
```
### Anubis
```console
sudo loadkeys de
sudo nix-shell --packages nixUnstable
nix --experimental-features "nix-command flakes" run github:nix-community/disko -- --mode disko --flake github:tboerger/nixos-config#anubis
mkdir -p /mnt/etc/ssh
cp /etc/ssh/ssh_host_* /mnt/etc/ssh/
nixos-install --no-root-password --root /mnt --flake github:tboerger/nixos-config#anubis
```
After a reboot of the system it should be fully provisioned with the regular
flake which includes all defined services:
```console
nixos-rebuild switch --flake github:tboerger/nixos-config#anubis
```
### Chnum
```console
sudo loadkeys de
sudo nix-shell --packages nixUnstable
nix --experimental-features "nix-command flakes" run github:nix-community/disko -- --mode disko --flake github:tboerger/nixos-config#chnum
mkdir -p /mnt/etc/ssh
cp /etc/ssh/ssh_host_* /mnt/etc/ssh/
nixos-install --no-root-password --root /mnt --flake github:tboerger/nixos-config#chnum
```
After a reboot of the system it should be fully provisioned with the regular
flake which includes all defined services:
```console
nixos-rebuild switch --flake github:tboerger/nixos-config#chnum
```
## Servers
To apply updates for servers this repository should be updated to the latest
version, after that it is possible to use `deploy-rs` to upgrade the deployment
with a command like this:
```console
nix run github:serokell/deploy-rs github:tboerger/nixos-config#hostname
```
### Asgard
### Bootstrap
```console
sudo loadkeys de
@ -85,14 +26,15 @@ cp /etc/ssh/ssh_host_* /mnt/etc/ssh/
nixos-install --no-root-password --root /mnt --flake github:tboerger/nixos-config#asgard
```
After a reboot of the system it should be fully provisioned with the regular
flake which includes all defined services:
### Updates
```console
nix run github:serokell/deploy-rs github:tboerger/nixos-config#asgard
```
### Utgard
## Utgard
### Bootstrap
```console
sudo loadkeys de
@ -105,14 +47,15 @@ cp /etc/ssh/ssh_host_* /mnt/etc/ssh/
nixos-install --no-root-password --root /mnt --flake github:tboerger/nixos-config#utgard
```
After a reboot of the system it should be fully provisioned with the regular
flake which includes all defined services:
### Updates
```console
nix run github:serokell/deploy-rs github:tboerger/nixos-config#utgard
```
### Vanaheim
## Vanaheim
### Bootstrap
```console
sudo loadkeys de
@ -125,14 +68,15 @@ cp /etc/ssh/ssh_host_* /mnt/etc/ssh/
nixos-install --no-root-password --root /mnt --flake github:tboerger/nixos-config#vanaheim
```
After a reboot of the system it should be fully provisioned with the regular
flake which includes all defined services:
### Updates
```console
nix run github:serokell/deploy-rs github:tboerger/nixos-config#vanaheim
```
### Yggdrasil
## Yggdrasil
### Bootstrap
```console
sudo loadkeys de
@ -145,37 +89,12 @@ cp /etc/ssh/ssh_host_* /mnt/etc/ssh/
nixos-install --no-root-password --root /mnt --flake github:tboerger/nixos-config#yggdrasil
```
After a reboot of the system it should be fully provisioned with the regular
flake which includes all defined services:
### Updates
```console
nix run github:serokell/deploy-rs github:tboerger/nixos-config#yggdrasil
```
## Finish
Finally after I have setup the whole system I usually copy the remaining
credentials from my securely stored USB stick to get access to my SSH keys and
Gnupg keys if this is required on the machine. It should not be required for
servers.
### SSH
```console
mkdir -p ${HOME}/.ssh/
cp /media/$(whoami)/secrets/ssh/id_* ${HOME}/.ssh/
chown -R $(id -u):$(id -g) ${HOME}/.ssh
chmod u=rw,g=,o= ${HOME}/.ssh/id_*
```
### Gnupg
```console
for FILE in /media/$(whoami)/secrets/gpg/*.asc; do
gpg --import ${FILE}
done
```
## Security
If you find a security issue please contact thomas@webhippie.de first.

@ -1,42 +0,0 @@
{ config, lib, pkgs, ... }:
{
boot = {
supportedFilesystems = [
"ntfs"
];
binfmt = {
emulatedSystems = [
"aarch64-linux"
];
};
kernelPackages = lib.mkDefault pkgs.linuxPackages_latest;
tmp = {
cleanOnBoot = true;
};
loader = {
efi = {
canTouchEfiVariables = true;
};
systemd-boot = {
enable = true;
consoleMode = "2";
configurationLimit = 5;
editor = false;
};
};
kernelModules = [ "coretemp" "thinkpad_acpi" ];
extraModulePackages = with config.boot.kernelPackages; [ acpi_call ];
initrd = {
availableKernelModules = [ "xhci_pci" "thunderbolt" "nvme" "usb_storage" "sd_mod" "acpi_call" ];
kernelModules = [ "dm-snapshot" ];
};
};
}

@ -1,59 +0,0 @@
{ config, lib, pkgs, ... }:
{
imports = [
../../shared/modules
../../shared/global
../../shared/programs
../../shared/services
./disko.nix
./boot.nix
./networking.nix
./graphics.nix
./hardware.nix
./extras.nix
];
personal = {
services = {
desktop = {
enable = config.personal.services.enable;
};
docker = {
enable = config.personal.services.enable;
};
libvirt = {
enable = config.personal.services.enable;
};
printing = {
enable = config.personal.services.enable;
};
tailscale = {
enable = config.personal.services.enable;
};
};
programs = {
browser = {
enable = config.personal.programs.enable;
};
lutris = {
enable = config.personal.programs.enable;
};
mail = {
enable = config.personal.programs.enable;
};
password = {
enable = config.personal.programs.enable;
};
steam = {
enable = config.personal.programs.enable;
};
};
};
system = {
stateVersion = "23.11";
};
}

@ -1,93 +0,0 @@
{ ... }:
{
disko = {
devices = {
disk = {
disk1 = {
type = "disk";
device = "/dev/disk/by-id/nvme-WD_PC_SN810_SDCQNRZ-2T00-1001_22343X803590";
content = {
type = "gpt";
partitions = {
ESP = {
type = "EF00";
size = "1G";
content = {
type = "filesystem";
format = "vfat";
mountpoint = "/boot";
};
};
primary = {
size = "100%";
content = {
type = "lvm_pv";
vg = "system";
};
};
};
};
};
};
lvm_vg = {
system = {
type = "lvm_vg";
lvs = {
swap = {
size = "32G";
content = {
type = "swap";
resumeDevice = true;
};
};
root = {
size = "20G";
content = {
type = "filesystem";
format = "ext4";
mountpoint = "/";
mountOptions = [
"defaults"
];
};
};
nix = {
size = "100G";
content = {
type = "filesystem";
format = "ext4";
mountpoint = "/nix";
};
};
home = {
size = "50G";
content = {
type = "filesystem";
format = "ext4";
mountpoint = "/home";
};
};
dummy1 = {
size = "1M";
content = {
type = "filesystem";
format = "ext4";
mountpoint = "/var/lib/dummy1";
};
};
};
};
};
};
};
}

@ -1,19 +0,0 @@
{ config, lib, pkgs, ... }:
{
services = {
thinkfan = {
enable = true;
};
};
systemd = {
services = {
thinkfan = {
preStart = "
/run/current-system/sw/bin/modprobe -r thinkpad_acpi && /run/current-system/sw/bin/modprobe thinkpad_acpi
";
};
};
};
}

@ -1,24 +0,0 @@
{ config, lib, pkgs, ... }:
{
hardware = {
nvidia = {
powerManagement = {
enable = true;
};
modesetting = {
enable = true;
};
prime = {
sync = {
enable = true;
};
nvidiaBusId = "PCI:3:0:0";
intelBusId = "PCI:0:2:0";
};
};
};
}

@ -1,18 +0,0 @@
{ config, lib, pkgs, ... }:
{
networking = {
hostName = "anubis";
networkmanager = {
enable = true;
};
# nat = {
# enable = true;
# enableIPv6 = true;
# internalInterfaces = [ "ve-+" ];
# externalInterface = "";
# };
};
}

@ -1,42 +0,0 @@
{ config, lib, pkgs, ... }:
{
boot = {
supportedFilesystems = [
"ntfs"
];
binfmt = {
emulatedSystems = [
"aarch64-linux"
];
};
kernelPackages = lib.mkDefault pkgs.linuxPackages_latest;
tmp = {
cleanOnBoot = true;
};
loader = {
efi = {
canTouchEfiVariables = true;
};
systemd-boot = {
enable = true;
consoleMode = "2";
configurationLimit = 5;
editor = false;
};
};
kernelModules = [ "kvm-intel" ];
extraModulePackages = with config.boot.kernelPackages; [ ];
initrd = {
availableKernelModules = [ "ahci" "atkbd" "rtsx_pci_sdmmc" "sd_mod" "usb_storage" "xhci_pci" ];
kernelModules = [ "dm-snapshot" ];
};
};
}

@ -1,59 +0,0 @@
{ config, lib, pkgs, ... }:
{
imports = [
../../shared/modules
../../shared/global
../../shared/programs
../../shared/services
./disko.nix
./boot.nix
./networking.nix
./graphics.nix
./hardware.nix
./extras.nix
];
personal = {
services = {
desktop = {
enable = config.personal.services.enable;
};
docker = {
enable = config.personal.services.enable;
};
libvirt = {
enable = config.personal.services.enable;
};
printing = {
enable = config.personal.services.enable;
};
tailscale = {
enable = config.personal.services.enable;
};
};
programs = {
browser = {
enable = config.personal.programs.enable;
};
lutris = {
enable = config.personal.programs.enable;
};
mail = {
enable = config.personal.programs.enable;
};
password = {
enable = config.personal.programs.enable;
};
steam = {
enable = config.personal.programs.enable;
};
};
};
system = {
stateVersion = "23.11";
};
}

@ -1,93 +0,0 @@
{ ... }:
{
disko = {
devices = {
disk = {
disk1 = {
type = "disk";
device = "/dev/disk/by-id/ata-TOSHIBA_THNSNH512GCST_14DS100ATBAY";
content = {
type = "gpt";
partitions = {
ESK = {
type = "EF00";
size = "1G";
content = {
type = "filesystem";
format = "vfat";
mountpoint = "/boot";
};
};
primary = {
size = "100%";
content = {
type = "lvm_pv";
vg = "system";
};
};
};
};
};
};
lvm_vg = {
system = {
type = "lvm_vg";
lvs = {
swap = {
size = "32G";
content = {
type = "swap";
resumeDevice = true;
};
};
root = {
size = "20G";
content = {
type = "filesystem";
format = "ext4";
mountpoint = "/";
mountOptions = [
"defaults"
];
};
};
nix = {
size = "100G";
content = {
type = "filesystem";
format = "ext4";
mountpoint = "/nix";
};
};
home = {
size = "50G";
content = {
type = "filesystem";
format = "ext4";
mountpoint = "/home";
};
};
dummy1 = {
size = "1M";
content = {
type = "filesystem";
format = "ext4";
mountpoint = "/var/lib/dummy1";
};
};
};
};
};
};
};
}

@ -1,3 +0,0 @@
{ config, lib, pkgs, ... }:
{ }

@ -1,18 +0,0 @@
{ config, lib, pkgs, ... }:
{
networking = {
hostName = "chnum";
networkmanager = {
enable = true;
};
# nat = {
# enable = true;
# enableIPv6 = true;
# internalInterfaces = [ "ve-+" ];
# externalInterface = "enp0s25";
# };
};
}

155
flake.nix

@ -68,112 +68,18 @@
in
{
diskoConfigurations = {
anubis = import ./desktops/anubis/disko.nix;
chnum = import ./desktops/chnum/disko.nix;
asgard = import ./servers/asgard/disko.nix;
utgard = import ./servers/utgard/disko.nix;
vanaheim = import ./servers/vanaheim/disko.nix;
asgard = import ./machines/asgard/disko.nix;
utgard = import ./machines/utgard/disko.nix;
vanaheim = import ./machines/vanaheim/disko.nix;
};
nixosConfigurations = {
anubis = mkComputer
./desktops/anubis
"x86_64-linux"
[
disko.nixosModules.disko
./home/thomas/user.nix
./home/anna/user.nix
./home/adrian/user.nix
./home/tabea/user.nix
{
home-manager = {
extraSpecialArgs = {
desktopSystem = true;
};
users = {
thomas = {
imports = [
agenix.homeManagerModules.default
./home/thomas
];
};
anna = {
imports = [
agenix.homeManagerModules.default
./home/anna
];
};
adrian = {
imports = [
agenix.homeManagerModules.default
./home/adrian
];
};
tabea = {
imports = [
agenix.homeManagerModules.default
./home/tabea
];
};
};
};
}
];
chnum = mkComputer
./desktops/chnum
"x86_64-linux"
[
disko.nixosModules.disko
./home/thomas/user.nix
./home/anna/user.nix
./home/adrian/user.nix
./home/tabea/user.nix
{
home-manager = {
extraSpecialArgs = {
desktopSystem = true;
};
users = {
thomas = {
imports = [
agenix.homeManagerModules.default
./home/thomas
];
};
anna = {
imports = [
agenix.homeManagerModules.default
./home/anna
];
};
adrian = {
imports = [
agenix.homeManagerModules.default
./home/adrian
];
};
tabea = {
imports = [
agenix.homeManagerModules.default
./home/tabea
];
};
};
};
}
];
asgard = mkComputer
./servers/asgard
./machines/asgard
"x86_64-linux"
[
disko.nixosModules.disko
./home/thomas/user.nix
./profiles/thomas/user.nix
{
home-manager = {
@ -184,8 +90,8 @@
users = {
thomas = {
imports = [
agenix.homeManagerModules.default
./home/thomas
# agenix.homeManagerModules.default
./profiles/thomas
];
};
};
@ -194,11 +100,11 @@
];
utgard = mkComputer
./servers/utgard
./machines/utgard
"x86_64-linux"
[
disko.nixosModules.disko
./home/thomas/user.nix
./profiles/thomas/user.nix
{
home-manager = {
@ -209,8 +115,8 @@
users = {
thomas = {
imports = [
agenix.homeManagerModules.default
./home/thomas
# agenix.homeManagerModules.default
./profiles/thomas
];
};
};
@ -219,11 +125,11 @@
];
vanaheim = mkComputer
./servers/vanaheim
./machines/vanaheim
"x86_64-linux"
[
disko.nixosModules.disko
./home/thomas/user.nix
./profiles/thomas/user.nix
{
home-manager = {
@ -234,8 +140,8 @@
users = {
thomas = {
imports = [
agenix.homeManagerModules.default
./home/thomas
# agenix.homeManagerModules.default
./profiles/thomas
];
};
};
@ -244,11 +150,11 @@
];
# yggdrasil = mkComputer
# ./servers/yggdrasil
# ./machines/yggdrasil
# "aarch64-linux"
# [
# hardware.nixosModules.raspberry-pi-4
# ./home/thomas/user.nix
# ./profiles/thomas/user.nix
# {
# home-manager = {
@ -260,7 +166,7 @@
# thomas = {
# imports = [
# agenix.homeManagerModules.default
# ./home/thomas
# ./profiles/thomas
# ];
# };
# };
@ -271,30 +177,6 @@
deploy = {
nodes = {
anubis = {
sshOpts = [ "-p" "22" ];
hostname = "anubis";
fastConnection = true;
profiles = {
system = {
sshUser = "thomas";
path = deploy-rs.lib.x86_64-linux.activate.nixos self.nixosConfigurations.anubis;
user = "root";
};
};
};
chnum = {
sshOpts = [ "-p" "22" ];
hostname = "chnum";
fastConnection = true;
profiles = {
system = {
sshUser = "thomas";
path = deploy-rs.lib.x86_64-linux.activate.nixos self.nixosConfigurations.chnum;
user = "root";
};
};
};
asgard = {
sshOpts = [ "-p" "22" ];
hostname = "asgard.boerger.ws";
@ -389,7 +271,6 @@
inputs.deploy-rs.packages.${system}.default
git
gnumake
home-manager
nixpkgs-fmt
rage

Before

Width:  |  Height:  |  Size: 208 KiB

After

Width:  |  Height:  |  Size: 208 KiB

Before

Width:  |  Height:  |  Size: 207 KiB

After

Width:  |  Height:  |  Size: 207 KiB

Some files were not shown because too many files have changed in this diff Show More