Compare commits

..

No commits in common. "main" and "main" have entirely different histories.
main ... main

5 changed files with 26 additions and 36 deletions

View file

@ -48,6 +48,13 @@ in {
path = "/var/lib/backups/cthulhu";
allowSubRepos = true;
};
dagon = {
authorizedKeysAppendOnly = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJaTBennwqT9eB43gVD1nM1os3dMPZ8RWwIKPEjqMK5V Dagon Backup"
];
path = "/var/lib/backups/dagon";
allowSubRepos = true;
};
eihort = {
authorizedKeysAppendOnly = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHLoDxtY4Tp6NKxLt9oHmWT6w4UpU6eA1TnPU2Ut83BN Eihort Backup"

View file

@ -3,28 +3,21 @@ with lib; let
admins = {
nerf = {
hashedPassword = "$y$j9T$SJcjUIcs3JYuM5oyxfEQa/$tUBQT07FK4cb9xm.A6ZKVnFIPNOYMOKC6Dt6hadCuJ7";
sshKeys = [
keys = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEdA4LpEGUUmN8esFyrNZXFb2GiBID9/S6zzhcnofQuP nerf@nerflap2"
];
nixKeys = [
"nerflap2-1:pDZCg0oo9PxNQxwVSQSvycw7WXTl53PGvVeZWvxuqJc="
];
};
gonne = {
hashedPassword = "$6$EtGpHEcFkOi0yUWp$slXf0CvIUrhdqaoCrQ5YwtYu2IVuE1RGGst4fnDPRLWVm.lYx0ruvSAF2/vw/sLbW37ORJjlb0NHQ.kSG7cVY/";
sshKeys = [
keys = [
"sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIAhwkSDISCWLN2GhHfxdZsVkK4J7JoEcPwtNbAesb+BZAAAABHNzaDo= Gonne"
];
nixKeys = [
"gonne.mathebau.de-1:FsXFyFiBFE/JxC9MCkt/WuiXjx5dkRI9RXj0FxOQrV0="
];
};
};
mkAdmin = name: {
hashedPassword,
sshKeys,
...
keys,
}: {
"${name}" = {
isNormalUser = true;
@ -32,12 +25,10 @@ with lib; let
extraGroups = ["wheel"];
group = "users";
home = "/home/${name}";
openssh.authorizedKeys = {keys = sshKeys;};
openssh.authorizedKeys = {inherit keys;};
inherit hashedPassword;
};
};
mkNixKeys = _: {nixKeys, ...}: nixKeys;
in {
users.users = mkMerge (mapAttrsToList mkAdmin admins);
nix.settings.trusted-public-keys = lists.concatLists (mapAttrsToList mkNixKeys admins);
}

View file

@ -5,11 +5,18 @@
}: {
imports = [
./admins.nix
./nix.nix
./nix_keys.nix
./prometheusNodeExporter.nix
../modules/impermanence.nix
];
nix = {
extraOptions = ''
experimental-features = nix-command flakes
builders-use-substitutes = true
'';
};
networking = {
firewall = {
# these shoud be default, but better make sure!

View file

@ -1,22 +0,0 @@
{
nix = {
settings = {
# trusted-public-keys belonging to specific persons are set in rolse/admins.nix
trusted-public-keys = [];
experimental-features = [
"flakes"
"nix-command"
];
auto-optimise-store = true;
fallback = true;
builders-use-substitutes = true;
};
gc = {
automatic = true;
persistent = false;
dates = "weekly";
options = "-d";
randomizedDelaySec = "5h";
};
};
}

7
nixos/roles/nix_keys.nix Normal file
View file

@ -0,0 +1,7 @@
{
imports = [];
nix.settings.trusted-public-keys = [
"nerflap2-1:pDZCg0oo9PxNQxwVSQSvycw7WXTl53PGvVeZWvxuqJc="
"gonne.mathebau.de-1:FsXFyFiBFE/JxC9MCkt/WuiXjx5dkRI9RXj0FxOQrV0="
];
}