feat(nixos/hosts): add iris
6 files changed, -4/+108
home/features/cli/ssh.nix
@@ -11,7 +11,7 @@ ForwardAgent = false; AddKeysToAgent = "no"; Compression = false;- ServerAliveInterval = 0;+ ServerAliveInterval = 30; ServerAliveCountMax = 3; HashKnownHosts = false; UserKnownHostsFile = "~/.ssh/known_hosts";
keys/hosts/iris.pub
@@ -0,0 +1 @@+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEe/oNYmN4c1Z2u152CKRQ1NOjjv7bSM8uyp+2hxkvJD
kore.json
@@ -12,6 +12,13 @@ "roles": ["home"], "users": ["lostduk"], "ipv4": null+ },+ "iris": {+ "system": "x86_64-linux",+ "stateVersion": "26.11",+ "roles": [],+ "users": ["lostduk"],+ "ipv4": "82.153.138.53" } } }
nixos/features/global.nix
@@ -1,7 +1,5 @@ { inputs, outputs, config, lib, pkgs, utils, modulesPath, ... }: -# Policy for every host. Values under mkForce are invariants: roles and-# hosts must not weaken them. let impermanence = config.kore.impermanence.enable; rollback = impermanence && config ? disko && config.disko.devices.disk ? main;@@ -65,7 +63,7 @@ in { networking = { domain = "lostduk.com"; - useDHCP = true;+ useDHCP = lib.mkDefault true; enableIPv6 = lib.mkForce false; firewall = {
nixos/features/kore.nix
@@ -3,6 +3,8 @@ let cfg = config.kore; hostname = config.networking.hostName;+ hasHome = lib.elem "home" cfg.currentHost.roles;+ hostKey = name: ../../keys/hosts + "/${name}.pub"; identityOptions = { name, ... }: let@@ -93,6 +95,10 @@ in { password = "tmp"; extraGroups = [ "wheel" ]; + # Only hosts with the home role get home folders.+ createHome = hasHome;+ home = if hasHome then "/home/${user}" else "/var/empty";+ subUidRanges = [{ startUid = 100000 + i * 65536; count = 65536; }]; subGidRanges = [{ startGid = 100000 + i * 65536; count = 65536; }]; @@ -104,5 +110,11 @@ in { lib.optionalAttrs (host.ipv4 != null) { "${host.ipv4}" = [ "${name}.${config.networking.domain}" name ]; }) cfg.hosts);++ programs.ssh.knownHosts = lib.mapAttrs (name: host: {+ hostNames = [ name "${name}.${config.networking.domain}" ]+ ++ lib.optional (host.ipv4 != null) host.ipv4;+ publicKeyFile = hostKey name;+ }) (lib.filterAttrs (name: _: builtins.pathExists (hostKey name)) cfg.hosts); }; }
nixos/hosts/iris.nix
@@ -0,0 +1,86 @@+{ inputs, config, modulesPath, ... }:++let+ gateway = "100.213.253.237";+in {+ imports = [+ inputs.disko.nixosModules.disko++ ( modulesPath + "/profiles/qemu-guest.nix" )+ ];++ # Kyun hands out a /32 with an off-subnet gateway; pin it instead of DHCP.+ networking = {+ useDHCP = false;+ nameservers = [ "9.9.9.9" "149.112.112.112" ];++ interfaces.enp0s4.ipv4.addresses = [{ address = config.kore.currentHost.ipv4; prefixLength = 32; }];++ defaultGateway = {+ address = gateway;+ interface = "enp0s4";+ };+ };++ zramSwap.enable = true;+ services.journald.settings.Journal.SystemMaxUse = "500M";++ boot = {+ loader.grub = {+ efiSupport = true;+ efiInstallAsRemovable = true;+ };++ initrd = {+ systemd.enable = true;+ availableKernelModules = [ "ahci" "xhci_pci" "virtio_pci" "virtio_scsi" "sd_mod" "sr_mod" ];+ };+ };++ disko.devices.disk.main = {+ type = "disk";+ device = "/dev/sda";+ content = {+ type = "gpt";+ partitions = {+ boot = {+ size = "1M";+ type = "EF02";+ };+ ESP = {+ size = "512M";+ type = "EF00";+ content = {+ type = "filesystem";+ format = "vfat";+ mountpoint = "/boot";+ mountOptions = [ "umask=0077" ];+ };+ };+ root = {+ size = "100%";+ content = {+ type = "btrfs";+ extraArgs = [ "-f" ];+ subvolumes = let+ options = [ "compress=zstd" "noatime" ];+ in {+ "/@" = {+ mountpoint = "/";+ mountOptions = options;+ };+ "/@nix" = {+ mountpoint = "/nix";+ mountOptions = options;+ };+ "/@persist" = {+ mountpoint = "/persist";+ mountOptions = options;+ };+ };+ };+ };+ };+ };+ };+}
greenhouse