hardware config

Reviewed-on: #90
Reviewed-by: nerf <nerf@noreply.localhost>

.gitattributes

@@ -0,0 +1 @@
+*.secrets.yaml diff=sopsdiffer

README.md

@@ -233,6 +233,8 @@ If the accessing process is not root it must be member of the group `config.user
 for systemd services this can be archived by setting `serviceConfig.SupplementaryGroups = [ config.users.groups.keys.name ];`
 it the service configuration.
 
+For cleartext diffs configure your local clone with `git config diff.sopsdiffer.textconv "sops decrypt"` (see [Github](https://github.com/getsops/sops?tab=readme-ov-file#showing-diffs-in-cleartext-in-git)).
+
 ## impermanence
 
 These machines are setup with `"/"` as a tmpfs. This is there to keep the machines clean. So no clutter in home

nixos/machines/cthulhu/configuration.nix

@@ -0,0 +1,25 @@
+{
+  imports = [
+    ./hardware-configuration.nix
+    ../../roles
+    ../../roles/vm.nix
+    ../../modules/vmNetwork.nix
+  ];
+
+  # System configuration here
+
+  networking.hostName = "cthulhu";
+  vmNetwork.ipv4 = "192.168.0.16";
+  system.stateVersion = "25.05";
+
+  sops.secrets = {
+    backupKey = {
+      sopsFile = ./backupKey.secrets.yaml;
+      owner = "root";
+      group = "root";
+      mode = "0400";
+    };
+  };
+  # TODO for the network rework, make a central record of hostnames to ip adresses where every
+  # machine can read out their ip address and also this machine
+}

nixos/machines/cthulhu/hardware-configuration.nix

@@ -0,0 +1,39 @@
+{
+  lib,
+  pkgs,
+  ...
+}: {
+  imports = [];
+
+  fileSystems."/" = {
+    device = "root";
+    fsType = "tmpfs";
+    options = ["size=1G" "mode=755"];
+  };
+  fileSystems."/persist" = {
+    device = "/dev/disk/by-label/nixos";
+    fsType = "btrfs";
+    options = ["subvol=persist"];
+    neededForBoot = true;
+  };
+  fileSystems."/boot" = {
+    device = "/dev/disk/by-label/boot";
+    fsType = "ext4";
+  };
+  fileSystems."/nix" = {
+    device = "/dev/disk/by-label/nixos";
+    fsType = "btrfs";
+    options = ["subvol=nix"];
+  };
+  fileSystems."/var/www" = {
+    device = "/dev/disk/by-label/cthulhu-website-"; # The trailing - is part of the name, i suspect it was meant to be longer
+    fsType = "ext4";
+  };
+  # nix puts the caching folder under /var/cache/nginx
+  fileSystems."/var/cache/nginx" = {
+    device = "/dev/disk/by-label/cthulhu";
+    fsType = "ext4";
+  };
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+}