more kernel log

Reviewed-on: #14

README.md

@@ -1,19 +1,115 @@
 # nixConfig
 
 ## Build a machine
+There are multiple ways to build and deploy a machine configuration. Which is the
+most appropriate depends on the context and scenario. So first there will be a general
+explanation how this works and afterwards we will talk about some scenarios.
+
+If you run `nix flake show` you should get an output similiar to this
+```
+$ nix flake show
+git+file:///home/nerf/git/nixConfig?ref=refs%2fheads%2fnyarlathtop&rev=9d0eb749287d1e9e793811759dfa29469ab706dc
+├───apps
+│   └───x86_64-linux
+├───checks
+│   └───x86_64-linux
+├───devShells
+│   └───x86_64-linux
+├───formatter
+├───legacyPackages
+│   └───x86_64-linux omitted (use '--legacy' to show)
+├───nixosConfigurations
+│   └───nyarlathotep: NixOS configuration
+├───nixosModules
+├───overlays
+└───packages
+    └───x86_64-linux
+```
+we can see there is an output callled `nixosConfigurations.nyarlathotep`. Which contains the config of the machine
+called nyarlathotep. `nixosConfigurations` is special in that sense, that `nixos-rebuild` will automatically look
+for this key and assume how it is structured. The interesting part for us is the derivation `config.system.build.toplevel`.
+Its closure contains the whole system and the resulting derivation a script that changes the current system to
+that derivation. (called `/bin/switch-to-configuration`).
+
+So what we want to archive is populate the nix store of the target machine with the closure of the derivation
+`.#nixosConfigurations.<name>.config.system.build.toplevel` and run the the resulting script on the target machine.
+
+
 ### Local
-If you want to build the machineconfiguration for machine <name>
-run
+It has multiple benefits to build the system config on the local computer and push it to the target server.
+For example one doesn't stress the server with the load coming with evaluating the expression. Also the server
+doesn't need to fetch the build dependencies this way. One has a local check if at least the nix syntax was correct.
+And so on...
+
+#### Build
+If you have this repository local in your current directory you can just run:
 ```
-nix build .#nixosConfiguration.<name>.config.system.build.toplevel
+$ nix build .#nixosConfigurations.<name>.config.system.build.toplevel
 ```
 
+But you don't need to clone this repository for more on flake urls see the `nix flake --help` documentation.
+
+#### Copy
+After we build the derivation we need to get the closure onto the target system. Luckily nix has tools to do that
+via ssh. We could just run:
+```
+$ nix copy -s --to <however you setup your ssh stuff> .#nixosConfigurations.<name>.config.system.build.toplevel
+```
+we do not need the flake anymore, instead of specifying the derivation name we could also give the store path
+directly.
+
+The `-s` is important it makes the target machine substitute all derivations it can (by default from chache.nixos.org).
+So you only upload config files and self build things.
+
+To be able to copy things to a machine they need to be signed by someone trusted. Additional trusted nix keys are handled
+in `./nixos/roles/nix_keys.nix`. So to get yourself trusted you either need to install one derivation from the machine itself,
+or find someone who is already trusted.
+
+For more information on signing and key creation see `nix store sign --help` and `nix key --help`.
+
+#### Activate
+Log into the remote machine and execute
+```
+# /nix/store/<storepath>/bin/switch-to-configuration boot
+```
+That will setup a configuration switch at reboot. You can also switch the configuration live. For more
+details consider the `--help` output of that script.
+
+
+If you have a `nixos-rebuild` available on your system it can automatize these things with the `--flake` and
+`--target-host` parameters. But there are some pitfalls so look at the `nixos-rebuild` documentation beforehand.
+
 ### On the machine
-clone this repo to `/etc/nixos/` and `nixos-rebuild` that will select
-the appropriate machine based on hostname
+clone this repo to `/etc/nixos/` and `nixos-rebuild boot` or `nixos-rebuild switch` that will select
+the appropriate machine based on hostname.
+
+If the hostname is not correct, or you don't want to clone this flake you can also use the `--flake` parameter.
+
+In any case, to switch the system configuration you will need to have root priviledges on the target machine.
 
 
-### sops
+## How this flake is organized
+
+This flake uses `flake-parts` see [flake.parts](https://flake.parts) for more details. It makes handling
+`system` and some other moudles related things more convenient.
+For the general layout of nixos system config and modules, please see the corresponding documentation.
+
+The toplevel `flake.nix` contains the flake inputs as usual and only calls a file `flake-module.nix`
+this toplevel `flake-module.nix` imports further more specialiesed `flake-modules.nix` files from subdirectories.
+Right now the only one is `nixos/flake-module.nix`.
+
+the `nixos` folder contains all machine configurations. It sepreates in two folders `nixos/machines` and `nixos/roles`.
+
+`nixos/machines` contains all machine specific configuration (in a subfolder per machine). Like hardware configuration, specific
+network configuration. And service configuration that are too closely intervowen with the rest of that machine. It also
+contains the root config for that machine called `configuration.nix`. This file usually only includes other modules.
+
+`nixos/roles` contains config that is pontentially shared by some machines. It is expected that `nixos/roles/default.nix`
+is imported as (`../../roles`) in every machine. Notable are the files `nixos/roles/admins.nix` which contains
+common admin accounts for these machines and `nixos/roles/nix_keys.nix` which contains the additional trusted
+keys for the nix store.
+
+## sops
 
 We are sharing secrets using [`sops`](https://github.com/getsops/sops) and [`sops-nix`](https://github.com/Mic92/sops-nix)
 As of right now we use only `age` keys.
@@ -35,4 +131,3 @@ afterwards the secret should be available in `/run/secrets/example-key`.
 If the accessing process is not root it must be member of the group `config.users.groups.keys`
 for systemd services this can be archived by setting `serviceConfig.SupplementaryGroups = [ config.users.groups.keys.name ];`
 it the service config.
-

flake.lock

@@ -21,11 +21,11 @@
         "nixpkgs-lib": "nixpkgs-lib"
       },
       "locked": {
-        "lastModified": 1685662779,
-        "narHash": "sha256-cKDDciXGpMEjP1n6HlzKinN0H+oLmNpgeCTzYnsA2po=",
+        "lastModified": 1693611461,
+        "narHash": "sha256-aPODl8vAgGQ0ZYFIRisxYG5MOGSkIczvu2Cd8Gb9+1Y=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "71fb97f0d875fd4de4994dfb849f2c75e17eb6c3",
+        "rev": "7f53fdb7bdc5bb237da7fefef12d099e4fd611ca",
         "type": "github"
       },
       "original": {
@@ -33,20 +33,36 @@
         "type": "indirect"
       }
     },
+    "impermanence": {
+      "locked": {
+        "lastModified": 1694622745,
+        "narHash": "sha256-z397+eDhKx9c2qNafL1xv75lC0Q4nOaFlhaU1TINqb8=",
+        "owner": "nix-community",
+        "repo": "impermanence",
+        "rev": "e9643d08d0d193a2e074a19d4d90c67a874d932e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "impermanence",
+        "type": "github"
+      }
+    },
     "nixos-mailserver": {
       "inputs": {
         "blobs": "blobs",
         "flake-compat": [],
         "nixpkgs": [],
         "nixpkgs-22_11": "nixpkgs-22_11",
+        "nixpkgs-23_05": "nixpkgs-23_05",
         "utils": "utils"
       },
       "locked": {
-        "lastModified": 1686468558,
-        "narHash": "sha256-K69Ojlx3N8I6tRTZsrKFMIqK4yrnJ6/PjfKZi3wchYg=",
+        "lastModified": 1689976554,
+        "narHash": "sha256-uWJq3sIhkqfzPmfB2RWd5XFVooGFfSuJH9ER/r302xQ=",
         "ref": "refs/heads/master",
-        "rev": "290d00f6db4e80467013728819ad73dd4a394d9a",
-        "revCount": 554,
+        "rev": "c63f6e7b053c18325194ff0e274dba44e8d2271e",
+        "revCount": 570,
         "type": "git",
         "url": "https://gitlab.com/simple-nixos-mailserver/nixos-mailserver.git"
       },
@@ -57,11 +73,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1686412476,
-        "narHash": "sha256-inl9SVk6o5h75XKC79qrDCAobTD1Jxh6kVYTZKHzewA=",
+        "lastModified": 1695145219,
+        "narHash": "sha256-Eoe9IHbvmo5wEDeJXKFOpKUwxYJIOxKUesounVccNYk=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "21951114383770f96ae528d0ae68824557768e81",
+        "rev": "5ba549eafcf3e33405e5f66decd1a72356632b96",
         "type": "github"
       },
       "original": {
@@ -86,14 +102,29 @@
         "type": "indirect"
       }
     },
+    "nixpkgs-23_05": {
+      "locked": {
+        "lastModified": 1684782344,
+        "narHash": "sha256-SHN8hPYYSX0thDrMLMWPWYulK3YFgASOrCsIL3AJ78g=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "8966c43feba2c701ed624302b6a935f97bcbdf88",
+        "type": "github"
+      },
+      "original": {
+        "id": "nixpkgs",
+        "ref": "nixos-23.05",
+        "type": "indirect"
+      }
+    },
     "nixpkgs-lib": {
       "locked": {
         "dir": "lib",
-        "lastModified": 1685564631,
-        "narHash": "sha256-8ywr3AkblY4++3lIVxmrWZFzac7+f32ZEhH/A8pNscI=",
+        "lastModified": 1693471703,
+        "narHash": "sha256-0l03ZBL8P1P6z8MaSDS/MvuU8E75rVxe5eE1N6gxeTo=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "4f53efe34b3a8877ac923b9350c874e3dcd5dc0a",
+        "rev": "3e52e76b70d5508f3cec70b882a29199f4d1ee85",
         "type": "github"
       },
       "original": {
@@ -123,6 +154,7 @@
     "root": {
       "inputs": {
         "flake-parts": "flake-parts",
+        "impermanence": "impermanence",
         "nixos-mailserver": "nixos-mailserver",
         "nixpkgs": "nixpkgs",
         "sops-nix": "sops-nix"

flake.nix

@@ -14,6 +14,9 @@
       url = "github:Mic92/sops-nix";
       inputs.nixpkgs.follows = "nixpkgs";
     };
+    impermanence = {
+      url = "github:nix-community/impermanence";
+    };
   };
 
   outputs = inputs@{ flake-parts, ... }:

index.html

@@ -0,0 +1,175 @@
+<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/REC-html40/loose.dtd">
+<html><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"><meta http-equiv="Cache-Control" content="max-age=600"><link rel="stylesheet" href="/css/main.css?v=1.2" type="text/css"><script src="/js/jquery-3.4.1.min.js?v=1.2"></script><script src="/js/popper.min.js?v=1.2"></script><script src="/js/js.cookie.js?v=1.2"></script><script src="/js/bootstrap.min.js?v=1.2"></script><script src="/js/main.js?v=1.2"></script><script src="/js/background.js?v=1.3"></script><script src="/js/login.js?v=1.2"></script><script src="/js/style_lists.js"></script><script src="/js/contextualize_links.js"></script><title>DB Bahn WIFI</title></head><body>
+    <div class="container-fluid main-container px-0">
+      
+      
+       
+      <div class="user-class-2">
+        <div id="header-image" class="user-offline header-img">
+  <div class="header-overlay"></div>
+  <div class="header-overlay mobile"></div>
+  <div data-module="2c_WLAN_Overlay_Logout">
+    <img data-image="/images/WLAN_Overlay" class="wifi-overlay offline" src="/images/WLAN_Overlay.png" alt="overlay"></div>
+  <div class="container-desktop container-main relative-container header-container">
+    <div class="">
+      <div class="row header">
+        <div class="col-tablet-6">
+          <div alt="" hidden id="desktop_background" style="background-image: url('/images/2c_offline_image_desk.jpg'); background-image:url(&quot;/images/2c_offline_image_desk.jpg&quot;);" data-image="/images/2c_offline_image_desk"></div>
+          <div hidden id="mobile_background" style="background-image: url('/images/2c_offline_image_mobile.jpg'); background-image:url(&quot;/images/2c_offline_image_mobile.jpg&quot;);" data-image="/images/2c_offline_image_mobile"></div>
+          <div alt="" hidden id="tablet_background" style="background-image: url('/images/2c_offline_image_tablet.jpg'); background-image:url(&quot;/images/2c_offline_image_tablet.jpg&quot;);" data-image="/images/2c_offline_image_tablet"></div>
+          <div id="form-container" class="form-container">
+            <div class="conatiner justify-content-between d-flex flex-column form-content">
+              <div class="row logo">
+                <div class="col-3">
+                  <img data-image="/images/01_DB_Logo" class="header-logo" src="/images/01_DB_Logo.svg" alt="DB Logo"></div>
+                
+              </div>
+              
+<div class="row header-spacer"></div>
+<div class="row header-desktop-text">
+  <div class="col header-desktop-text iceportal-online">
+    <span data-slot="EN: NederlandsSlot 2c: header3 line: ICEPortal Online">Enjoy internet and entertainment on board.</span>
+  </div>
+  
+</div>
+<div>
+  <img class="header-line" src="/images/02_Pulse_red.svg" alt=""></div>
+<form method="POST" class="form">
+  <div class="row mb-3">
+    <div class="col">
+      <div class="custom-control custom-checkbox header-form">
+        <input type="checkbox" class="custom-control-input" id="accept" required><label class="custom-control-label accept-label" for="accept">
+          <span data-slot="EN: Slot 2c: checkbox label">
+
+By using I accept the following terms &amp; conditions of&nbsp;DB Systel GmbH:
+
+</span>
+        </label>
+        <br><span class="terms-link link" data-slot="EN: Slot 2c: checkbox link1"><a href="terms/">Terms &amp; Conditions</a></span>
+      </div>
+    </div>
+  </div>
+  <div class="row button-row">
+    <div class="col">
+      <input type="hidden" name="login" value="true"><input type="hidden" name="CSRFToken" value="f8c052ca38ca48d4455e293c21f3531b"><button disabled id="connect-btn" type="submit" class="btn btn-primary btn-connect">
+        <span data-slot="EN: Slot 2c: connect button text" class="unselectable">Free online access</span>
+      </button>
+    </div>
+  </div>
+</form>
+
+            </div>
+          </div>
+        </div>
+      </div>
+    </div>
+  </div>
+  <div class="form-overlay iceportal-online "></div>
+  
+  </div>
+
+        
+      </div>
+
+      
+      <div class="user-offline">
+         
+        
+              </div>
+        
+      
+       
+      <div class="user-offline">
+         
+        <div class="user-class-2 iceportal-online portal-tiles">
+  <div class="container-desktop container-main pb-5">
+    <div class="row">
+      <div class="col-tablet-4 col-desktop-3 py-tablet-0 py-4">
+        <span data-slot="EN: Slot 2c: ICE Portal Tile Header" class="portal-header-text">Information and entertainment on board</span>
+      </div>
+      <div class="col-tablet-4 col-desktop-3">
+        <div id="mobile-tile" class="tile d-flex flex-column justify-content-end">
+          <div class="tile-overlay"></div>
+          <div alt="" hidden id="desktop_background_tile" data-image="/images/2c_tile_1_desk" style="background-image: url('/images/2c_tile_1_desk.jpg'); background-image:url(&quot;/images/2c_tile_1_desk.jpg&quot;);"></div>
+          <div alt="" hidden id="mobile_background_tile" style="background-image: url('/images/2c_tile_1_mobile.jpg'); background-image:url(&quot;/images/2c_tile_1_mobile.jpg&quot;);" data-image="/images/2c_tile_1_mobile"></div>
+          <div alt="" hidden id="tablet_background_tile" style="background-image: url('/images/2c_tile_1_tablet.jpg'); background-image:url(&quot;/images/2c_tile_1_tablet.jpg&quot;);" data-image="/images/2c_tile_1_tablet"></div>
+          <span data-slot="EN: Slot 2c: Tile 1 Text" class="tile-text">
+            ICE Portal
+          </span>
+          
+        </div>
+      </div>
+      <div class="col-tablet-4 col-desktop-3 d-tablet-block d-none">
+        <div class="">
+          <div class="tile d-flex flex-column justify-content-end" data-image="/images/2c_tile_2_desk" style="background-image: url('/images/2c_tile_2_desk.jpg');; background-image:url(&quot;/images/2c_tile_2_desk.jpg&quot;);">
+            <div class="tile-overlay"></div>
+
+            <span data-slot="EN: Slot 2c: Tile 2 Text" class="tile-text">Travel information and news</span>
+            
+          </div>
+          <div class="test"></div>
+        </div>
+      </div>
+      <div class="col-desktop-3 d-desktop-block d-none">
+        <div class="tile d-flex flex-column justify-content-end" data-image="/images/2c_tile_3_desk" style="background-image: url('/images/2c_tile_3_desk.jpg');; background-image:url(&quot;/images/2c_tile_3_desk.jpg&quot;);">
+          <div class="tile-overlay"></div>
+
+          <span data-slot="EN: Slot 2c: Tile 3 Text" class="tile-text">
+            Latest news
+          </span>
+          
+        </div>
+      </div>
+    </div>
+  </div>
+  </div>
+              </div>
+        
+      
+      <div class="footer footercontainer py-3 py-tablet-2">
+        <div class="container-desktop container-main d-flex flex-column flex-tablet-row align-items-left align-items-tablet-center justify-content-between">
+          <div class="row pb-3 pb-tablet-0 ie-hack" style="min-width: 200px;">
+            <div class="col dropdown-col">
+              <div id="langs-menu" class="btn-group langs-group">
+                <button id="selectedlang" type="button" class="btn btn-secondary langs-btn dropdown-custom-toggle" data-toggle="dropdown" aria-haspopup="true" aria-expanded="false" data-abbrev="EN" data-value="English">
+                  <img class="lang-flag" src="/images/_en.svg" alt="Flag EN" data-image="/images/_en"><span class="lang-text unselectable">English</span>
+                </button>
+                <div class="dropdown-menu lang-menu">
+                  <a class="dropdown-item" href="/nl/" data-abbrev="NL">
+                    <img class="lang-flag" src="/images/_nl.svg" alt="Flag NL" data-image="/images/_nl"><span class="lang-text">Nederlands</span>
+                  </a>
+                <a class="dropdown-item" href="/en/" data-abbrev="EN">
+                    <img class="lang-flag" src="/images/_en.svg" alt="Flag EN" data-image="/images/_en"><span class="lang-text">English</span>
+                  </a>
+                <a class="dropdown-item" href="/fr/" data-abbrev="FR">
+                    <img class="lang-flag" src="/images/_fr.svg" alt="Flag FR" data-image="/images/_fr"><span class="lang-text">Fran&ccedil;ais</span>
+                  </a>
+                <a class="dropdown-item" href="/de/" data-abbrev="DE">
+                    <img class="lang-flag" src="/images/_de.svg" alt="Flag DE" data-image="/images/_de"><span class="lang-text">Deutsch</span>
+                  </a>
+                </div>
+              </div>
+            </div>
+          </div>
+          <div class="row ie-hack">
+            <div class="links-container justify-content-around d-flex flex-column flex-tablet-row col" style="min-width: 100%;">
+              <div class="footer-item">
+                <span class="link" data-slot="EN: Slot Footer item: AGB"><a href="/en/terms/">Terms &amp; Conditions</a></span>
+              </div>
+              <div class="footer-item">
+                <span class="link" data-slot="EN: Slot Footer item: Datenschutz"><a href="/en/datenschutz/">Privacy</a></span>
+              </div>
+              <div class="footer-item">
+                <span class="link" data-slot="EN: Slot Footer item: Impressum"><a href="/en/impressum/">Imprint</a></span>
+              </div>
+              <div class="footer-item">
+                <span class="link" data-slot="EN: Slot Footer item: FAQs"><a href="/en/wifiinfo/">
+                    FAQ</a></span>
+              </div>
+            </div>
+          </div>
+        </div>
+      </div>
+
+    </div>
+  </body></html>

nixos/flake-module.nix

@@ -2,6 +2,15 @@
 
 # This automatically searches for nixos configs in ./machines/${name}/configuration.nix
 # and exposes them as outputs.nixosConfigurations.${name}
+#
+
+# a comment regarding  pkgs.nixos vs lib.nixosSystem
+# while lib.nixosSystem is the usual enduser way to evaluate nixos configurations
+# in flakes, pkgs.nixos sets the package set to the packages it comes from.
+# This spares us tracking our potentiell overlays and own package additions, but just
+# using the right package set to begin with. Using lib.nixosSystem from the flake we would
+# need to specify that again.
+
 { withSystem, lib, inputs, ... }: {
   flake = {
     nixosConfigurations = withSystem "x86_64-linux" ({ pkgs, ... }:
@@ -12,6 +21,7 @@
           imports = [
             (import (./. + "/machines/${name}/configuration.nix") inputs)
             inputs.sops-nix.nixosModules.sops
+            inputs.impermanence.nixosModules.impermanence
           ];
         };
     in lib.genAttrs machines makeSystem);

nixos/machines/nerf-nixos-testlab/configuration.nix

@@ -0,0 +1,18 @@
+flake-inputs:
+{config, pkgs, lib, ... }: {
+
+imports = [
+  ./hardware-configuration.nix
+  ../../roles
+  ../../roles/xen_guest.nix
+  ./network.nix
+];
+
+# System configuration here
+
+  boot.consoleLogLevel = "7";
+  boot.loader.grub.storePath = "/nix/store";
+  boot.loader.grub.copyKernels = false;
+  networking.hostName = "nerf-nixos-testlab";
+  system.stateVersion = "23.11";
+}

nixos/machines/nerf-nixos-testlab/hardware-configuration.nix

@@ -0,0 +1,34 @@
+{config, lib, pkgs, modulesPath, ...}: {
+  imports = [ ];
+
+  fileSystems."/" = {
+    device = "root";
+    fsType = "tmpfs";
+    options = [ "size=1G" "mode=755" ];
+  };
+  fileSystems."/persistence" = {
+    device = "/dev/disk/by-uuid/30962650-f1dd-44bc-bca3-da1cdaa6fe3d";
+    fsType = "ext4";
+    neededForBoot = true;
+  };
+  fileSystems."/persist" = {
+    device = "/persistence/persist";
+    options = [ "bind" ];
+
+  };
+  fileSystems."/nix" = {
+    device = "/persistence/nix";
+    options = [ "bind" ];
+  };
+  fileSystems."/boot" = {
+    device = "/persistence/boot";
+    options = [ "bind" ];
+  };
+
+  swapDevices =
+    [{ device = "/dev/disk/by-uuid/30962650-f1dd-44bc-bca3-da1cdaa6fe3d"; }];
+
+  nix.settings.max-jobs = lib.mkDefault 4;
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+}

nixos/machines/nerf-nixos-testlab/network.nix

@@ -0,0 +1,15 @@
+# We sohuld put that config somewhere in roles and give it a parameter or something,
+# everyone gets the same nameserver and the same prefixLength and address vs defaultGateway alsways
+# depend on the same thing 
+{
+  imports = [ ];
+  networking = {
+    interfaces.enX0.ipv4.addresses = [ {
+      address = "192.168.0.40";
+      prefixLength = 16;
+    } ];
+    defaultGateway = "192.168.0.167";
+    nameservers = ["130.83.2.22" "130.83.56.60" "130.83.22.60" "130.82.22.63"];
+  };
+}
+

nixos/machines/nyarlathotep/configuration.nix

@@ -0,0 +1,16 @@
+flake-inputs:
+{config, pkgs, lib, ... }: {
+
+imports = [
+  ./hardware-configuration.nix
+  (import ./mail.nix flake-inputs)
+  ../../roles
+  ../../roles/xen_guest.nix
+  ./network.nix
+];
+
+# System configuration here
+
+  networking.hostName = "nyarlathotep";
+  system.stateVersion = "23.11";
+}

nixos/machines/nyarlathotep/hardware-configuration.nix

@@ -0,0 +1,35 @@
+{config, lib, pkgs, modulesPath, ...}: {
+  imports = [ ];
+
+  fileSystems."/" = {
+    device = "nya-root";
+    fsType = "tmpfs";
+    options = [ "size=1G" "mode=755" ];
+  };
+  fileSystems."/persist" = {
+    device = "/dev/disk/by-uuid/a72da670-f631-49b1-bcb3-6d378cc1f2d0";
+    fsType = "btrfs";
+    options = [ "subvol=persist" ];
+    neededForBoot = true;
+  };
+  fileSystems."/boot" = {
+    device = "/dev/disk/by-uuid/75b01f48-e159-4d72-b049-54b7af072076";
+    fsType = "ext4";
+  };
+  fileSystems."/nix" = {
+    device = "/dev/disk/by-uuid/a72da670-f631-49b1-bcb3-6d378cc1f2d0";
+    fsType = "btrfs";
+    options = [ "subvol=nix" ];
+  };
+  fileSystems."/var/vmail" = {
+    device = "/dev/disk/by-uuid/23c44c93-5035-4e29-9e46-75c1c08f4cea";
+    fsType = "ext4";
+  };
+
+  swapDevices =
+    [{ device = "/dev/disk/by-uuid/8bc30d17-3c08-4648-ab18-8c723523be1a"; }];
+
+  nix.settings.max-jobs = lib.mkDefault 4;
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+}

nixos/machines/nyarlathotep/mail.nix

@@ -0,0 +1,47 @@
+flake-inputs:
+{pkgs, config, lib, ...}: {
+  imports = [flake-inputs.nixos-mailserver.nixosModule];
+
+  mailserver = {
+    enable = true;
+    debug = false; # TODO disable
+    fqdn = "mathebau.de";
+    sendingFqdn = "fb04184.mathematik.tu-darmstadt.de";
+    domains = [
+      "mathebau.de"
+      "lists.mathebau.de"
+    ];
+    # forwards = #TODO
+    # loginAccounts = #TODO
+    # extraVirtualAliases = # TODO # only for local things (maybe don't use?)
+    certificateDomains = ["imap.mathebau.de"];
+    # certificateScheme = "manual"; # Do we need CERTS? We don't want to run a webmailer YES IMAP!!
+    #	certificateFile = #TODO
+    # keyFile = #TODO
+
+    enableSubmission = false; # no starttls smtp
+
+    # Fun dovecot stuff :
+
+    mailDirectory = "/var/vmail/vmail/"; # directory to store mail it was /var/mail/vmail but
+                                         # /var/mail ist special
+     
+    hierarchySeparator = "/"; # seperator for imap mailboxes from client view
+
+    # Caching of search indices
+    indexDir = "/var/vmail/lib/dovecot/indices";
+    fullTextSearch = {
+      enforced = "body"; # only brute force headers if no search index is available
+    };
+    lmtpSaveToDetailMailbox = "no";
+    # no starttls
+    enableImap = false;
+
+
+    # TODO checkout redis `config.services.redis.servers.rspamd.`
+
+    # TODO
+    # borgbackup = {
+    # };
+  };
+}

nixos/machines/nyarlathotep/network.nix

@@ -0,0 +1,15 @@
+# We sohuld put that config somewhere in roles and give it a parameter or something,
+# everyone gets the same nameserver and the same prefixLength and address vs defaultGateway alsways
+# depend on the same thing 
+{
+  imports = [ ];
+  networking = {
+    interfaces.enX0.ipv4.addresses = [ {
+      address = "192.168.0.28";
+      prefixLength = 16;
+    } ];
+    defaultGateway = "192.168.0.155";
+    nameservers = ["130.83.2.22" "130.83.56.60" "130.83.22.60" "130.82.22.63"];
+  };
+}
+

nixos/modules/impermanence.nix

@@ -0,0 +1,47 @@
+{lib, config, ...} :
+
+let 
+  inherit (lib)
+    mkEnableOption
+    mkIf
+    mkOption
+    types
+    ;
+  cfg = config.impermanence;
+in
+
+{
+imports = [ ];
+
+options.impermanence = {
+  enable = mkEnableOption "impermanence";
+  storagePath = mkOption {
+    type = types.path;
+    default = "/persist";
+    description = "The path where persistent data is stored";
+  };
+  name = mkOption {
+    type = types.str;
+    default = "persist";
+    description = "the name of the persistent data store";
+  };
+};
+
+config = mkIf cfg.enable {
+  environment.persistence.${cfg.name} = {
+    persistentStoragePath = cfg.storagePath;
+    directories = [
+      "/var/log"
+      "/var/lib/nixos"
+    ];
+    files = [
+      "/etc/ssh/ssh_host_ed25519_key"
+      "/etc/ssh/ssh_host_ed25519_key.pub"
+      "/etc/ssh/ssh_host_rsa_key"
+      "/etc/ssh/ssh_host_rsa_key.pub"
+    ];
+  };
+  environment.etc.machine-id.source = "${cfg.storagePath}/machine-id";
+};
+
+}

nixos/roles/admins.nix

@@ -0,0 +1,30 @@
+{lib, ...} :
+with lib;
+
+let
+  admins = {
+    nerf = {
+      hashedPassword =
+        "$y$j9T$SJcjUIcs3JYuM5oyxfEQa/$tUBQT07FK4cb9xm.A6ZKVnFIPNOYMOKC6Dt6hadCuJ7";
+        keys = [
+          "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEdA4LpEGUUmN8esFyrNZXFb2GiBID9/S6zzhcnofQuP nerf@nerflap2"
+        ];
+    };
+  };
+
+  mkAdmin = name :
+  {hashedPassword, keys}: {
+    "${name}" = {
+      isNormalUser = true;
+      createHome = true;
+      extraGroups = [ "wheel" ];
+      group = "users";
+      home = "/home/${name}";
+      openssh.authorizedKeys = { inherit keys; };
+      inherit hashedPassword;
+    };
+  };
+
+in {
+  users.users = mkMerge (mapAttrsToList mkAdmin admins);
+}

nixos/roles/default.nix

@@ -1,4 +1,58 @@
-{ ... } : {
+{pkgs, config, lib, ...} : {
+
+imports = [
+  ./admins.nix
+  ./nix_keys.nix
+  ../modules/impermanence.nix
+  ];
+nix = {
+  extraOptions = ''
+    experimental-features = nix-command flakes
+    builders-use-substitutes = true
+  '';
+};
+
+networking = {
+  firewall = { # these shoud be default, but better make sure!
+    enable = true;
+    allowPing = true;
+  };
+  nftables.enable = true;
+  useDHCP = false; # We don't speak DHCP and even if we would, we should enable it per interface
+  # hosts = # TODO write something to autogenerate ip adresses!
+};
+
+users = {
+  mutableUsers = false;
+  users.root.hashedPassword = "!";
+};
+
+impermanence.enable = true;
 
 sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
+
+environment = {
+  systemPackages = builtins.attrValues {
+    inherit (pkgs)
+      htop lsof tmux btop;
+  };
+};
+
+services = {
+  journald.extraConfig = "SystemMaxUse=5G";
+
+  nginx = {
+    recommendedOptimisation = true;
+    recommendedGzipSettings = true;
+    recommendedTlsSettings = true;
+  };
+
+  openssh = {
+    enable = true;
+    settings = {
+      PermitRootLogin = "no";
+      PasswordAuthentication = false;
+    };
+  };
+};
 }

nixos/roles/nix_keys.nix

@@ -0,0 +1,6 @@
+{
+  imports = [ ];
+  nix.settings.trusted-public-keys = [
+    "nerflap2-1:pDZCg0oo9PxNQxwVSQSvycw7WXTl53PGvVeZWvxuqJc="
+  ];
+}

nixos/roles/xen_guest.nix

@@ -0,0 +1,16 @@
+{...}: {
+  imports = [ ];
+  boot = {
+    loader.grub = {
+      device = "nodev";
+      enable = true;
+    };
+    initrd = {
+      availableKernelModules = [ "ata_piix" "sr_mod" "xen_blkfront" ];
+      kernelModules = [ ];
+    };
+    extraModulePackages = [ ];
+    tmp.useTmpfs = true;
+  };
+}
+