Align file system layout to new naming policy

Die Bilder, die gesichert wurden, liegen jetzt alle im Git-Repo der Webseite

README.md

@@ -94,7 +94,7 @@ In any case, to switch the system configuration you will need to have root privi
 ## Installing a new machine
 
 You have written a configuration and now want to deploy it as a new machine. You need to get the build configuration on the
-`nixos-installer` machine (regarding this machine see issue [#10]). You can either use either any of the
+`nodens` machine. You can either use either any of the
 versions above, or just continue then the machine will build the configuration implicitly.
 
 ### Disk layout
@@ -111,22 +111,14 @@ reflect those.
 - `"/boot"` the place for bootloader configuration and kernel also persistent
 - any additional data paths for your machine specific needs. Choose filesystems accordingly.
 
-My recommendation is to put `"/persist"` and `"/nix"` on a joint btrfs as subvolumes and `"/boot"` on separate disks (because grub
+My recommendation is to put `"/persist"` and `"/nix"` on a joint btrfs labelled `nixos` as subvolumes and `"/boot"` on a separate disk labelled `boot` (because grub
 will give you a hard time if you do it as a subvolume or bind mount (even though that should be possible but is an upstream problem)).
-For how to configure additional persistent data
-to be stored in `"/persist"` look at the impermanence section as soon it is merged. Before this look at issue [#9].
+For how to configure additional persistent data to be stored in `"/persist"` look at the impermanence section.
 I do not recommend this for actual high access application data like databases mailboxes and things like it. You should
 think about this as data that if lost can be regenerated with only little problems and read/written only a few times
 during setup. (Like the server ssh keys for example). The configuration also setups some paths for `"/persist"` automatically,
 again look at the impermanence sections.
 
-#### File system uuids
-
-You might end with a bit of a chicken/egg problem regarding filesystem uuids. See you need to set them in your system configuration.
-There are two ways around that. Either generate the filesystems read out the uuids, and push them into the repository holding
-the configuration you want to build, or generate the uuids first, have them in your configuration and set them upon filesystem creation. Most
-`mkfs` utilities have an option for that.
-
 ### Installing
 
 Just run
@@ -151,13 +143,16 @@ A good skeleton is probably:
 imports = [
   ./hardware-configuration.nix
   ../../roles
-  ./network.nix
+  ../../roles/vm.nix
+  ../../vmNetwork.nix
 
   <your additional imports here>
 
   ];
 
   <your system config here>
+
+  vmNetwork.ipv4 = "192.168.0.XX";
   networking.hostname = "<your hostname>"; # this will hopefully disappear if I have time to refactor this.
   system.stateVersion = "<state version at time of install>";
 }
@@ -173,9 +168,6 @@ The `flake-inputs` argument is optional, but you can use it if you need to get a
 else this is a complete normal nixos system configuration module (with a lot of settings already imorted
 from `../../roles`).
 
-As of moment of writing `network.nix` should contain ip, nameserver and default gateway setup. As parts of
-this is constant across all systems and will undergo refactor soon.
-
 I would recommend to split your configuration into small files you import. If this is something machine specific (like
 tied to your ip address hostname), put it into the machine directory. If it is not, put it into `/nixos/roles/` if it
 is not but has options to set, put it in `/nixos/modules`.
@@ -202,14 +194,12 @@ network configuration. And service configuration that are too closely interwoven
 mailserver configuration depends heavily on network settings). It also
 contains the root configuration for that machine called `configuration.nix`. This file usually only includes other modules.
 These `configuration.nix` files are almost usual nix configurations. The only difference is that they take as an extra argument
-the flake inputs. This allows them to load modules from these flakes. For example, nyarlathotep loads the simple-nixos-mailserver
-module that way.
+the flake inputs. This allows them to load modules from these flakes. For example, lobon loads the mathebau-mailman module that way.
 
 #### roles
 `nixos/roles` contains configuration that is potentially shared by some machines. It is expected that `nixos/roles/default.nix`
 is imported as (`../../roles`) in every machine. Notable are the files `nixos/roles/admins.nix` which contains
-common admin accounts for these machines and `nixos/roles/nix_keys.nix` which contains the additional trusted
-keys for the nix store.
+common admin accounts for these machines and the additional trusted keys for the nix store.
 
 ## sops
 
@@ -289,7 +279,7 @@ by the circumstances or by the person that didn't run fast enough. So we are hap
 mean that we don't need to have some level of quality, people after us needs to work with it. It is live infrastructure
 and downtime hurts someone (and in the wrong moment even really bad (Matheball ticket sales for example)).
 
-So here are some Guidelines.
+So here are some guidelines.
 
 ## Coding style and linting.
 If you run `nix flake check` there are automated checks in place, please make sure to pass them.

nixos/flake-module.nix

@@ -14,7 +14,13 @@
         importedConfig = import (./. + "/machines/${name}/configuration.nix");
         systemConfig =
           if lib.isFunction importedConfig
-          then x: importedConfig (x // {flake-inputs = inputs;})
+          then
+            x:
+              importedConfig (x
+                // {
+                  flake-inputs = inputs;
+                  inherit pkgs;
+                })
           else importedConfig;
       in
         pkgs.nixos {

nixos/machines/ghatanothoa/hardware-configuration.nix

@@ -7,17 +7,17 @@
     options = ["size=1G" "mode=755"];
   };
   fileSystems."/persist" = {
-    device = "/dev/disk/by-uuid/e0a160ef-7d46-4705-9152-a6b602898136";
+    device = "/dev/disk/by-label/nixos";
     fsType = "btrfs";
     options = ["subvol=persist"];
     neededForBoot = true;
   };
   fileSystems."/boot" = {
-    device = "/dev/disk/by-uuid/19da7f3a-69da-4fa8-bb68-b355d7697ba7";
+    device = "/dev/disk/by-label/boot";
     fsType = "ext4";
   };
   fileSystems."/nix" = {
-    device = "/dev/disk/by-uuid/e0a160ef-7d46-4705-9152-a6b602898136";
+    device = "/dev/disk/by-label/nixos";
     fsType = "btrfs";
     options = ["subvol=nix"];
   };

nixos/machines/nodens/configuration.nix

@@ -0,0 +1,16 @@
+{pkgs, ...}: {
+  imports = [
+    ./hardware-configuration.nix
+    ../../roles
+    ../../roles/vm.nix
+    ../../modules/vmNetwork.nix
+  ];
+
+  # System configuration here
+
+  environment.systemPackages = [pkgs.git];
+
+  networking.hostName = "nodens";
+  vmNetwork.ipv4 = "192.168.0.18";
+  system.stateVersion = "24.11";
+}

nixos/machines/nodens/hardware-configuration.nix

@@ -0,0 +1,48 @@
+# A machine that exists to install other NixOS machines from some config
+{
+  lib,
+  pkgs,
+  ...
+}: {
+  fileSystems."/" = {
+    device = "root";
+    fsType = "tmpfs";
+    options = ["size=1G" "mode=755"];
+  };
+  # Different than usual names in order to automount other VMs
+  fileSystems."/persist" = {
+    device = "/dev/disk/by-label/nixosNodens";
+    fsType = "btrfs";
+    options = ["subvol=persist"];
+    neededForBoot = true;
+  };
+  fileSystems."/boot" = {
+    device = "/dev/disk/by-label/bootNodens";
+    fsType = "ext4";
+  };
+  fileSystems."/nix" = {
+    device = "/dev/disk/by-label/nixosNodens";
+    fsType = "btrfs";
+    options = ["subvol=nix"];
+  };
+
+  #Machine to be installed
+  fileSystems."/mnt/persist" = {
+    device = "/dev/disk/by-label/nixos";
+    fsType = "btrfs";
+    options = ["subvol=persist"];
+  };
+  fileSystems."/mnt/boot" = {
+    device = "/dev/disk/by-label/boot";
+    fsType = "ext4";
+  };
+  fileSystems."/mnt/nix" = {
+    device = "/dev/disk/by-label/nixos";
+    fsType = "btrfs";
+    options = ["subvol=nix"];
+  };
+
+  swapDevices = [{device = "/dev/disk/by-uuid/89e13a83-506a-43b4-b06a-09424500ceda";}];
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+}

nixos/modules/borgbackup.nix

@@ -48,13 +48,6 @@ in {
           path = "/var/lib/backups/cthulhu";
           allowSubRepos = true;
         };
-        dagon = {
-          authorizedKeysAppendOnly = [
-            "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJaTBennwqT9eB43gVD1nM1os3dMPZ8RWwIKPEjqMK5V Dagon Backup"
-          ];
-          path = "/var/lib/backups/dagon";
-          allowSubRepos = true;
-        };
         eihort = {
           authorizedKeysAppendOnly = [
             "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHLoDxtY4Tp6NKxLt9oHmWT6w4UpU6eA1TnPU2Ut83BN Eihort Backup"

nixos/roles/admins.nix

@@ -3,21 +3,28 @@ with lib; let
   admins = {
     nerf = {
       hashedPassword = "$y$j9T$SJcjUIcs3JYuM5oyxfEQa/$tUBQT07FK4cb9xm.A6ZKVnFIPNOYMOKC6Dt6hadCuJ7";
-      keys = [
+      sshKeys = [
         "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEdA4LpEGUUmN8esFyrNZXFb2GiBID9/S6zzhcnofQuP nerf@nerflap2"
       ];
+      nixKeys = [
+        "nerflap2-1:pDZCg0oo9PxNQxwVSQSvycw7WXTl53PGvVeZWvxuqJc="
+      ];
     };
     gonne = {
       hashedPassword = "$6$EtGpHEcFkOi0yUWp$slXf0CvIUrhdqaoCrQ5YwtYu2IVuE1RGGst4fnDPRLWVm.lYx0ruvSAF2/vw/sLbW37ORJjlb0NHQ.kSG7cVY/";
-      keys = [
+      sshKeys = [
         "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIAhwkSDISCWLN2GhHfxdZsVkK4J7JoEcPwtNbAesb+BZAAAABHNzaDo= Gonne"
       ];
+      nixKeys = [
+        "gonne.mathebau.de-1:FsXFyFiBFE/JxC9MCkt/WuiXjx5dkRI9RXj0FxOQrV0="
+      ];
     };
   };
 
   mkAdmin = name: {
     hashedPassword,
-    keys,
+    sshKeys,
+    ...
   }: {
     "${name}" = {
       isNormalUser = true;
@@ -25,10 +32,12 @@ with lib; let
       extraGroups = ["wheel"];
       group = "users";
       home = "/home/${name}";
-      openssh.authorizedKeys = {inherit keys;};
+      openssh.authorizedKeys = {keys = sshKeys;};
       inherit hashedPassword;
     };
   };
+  mkNixKeys = _: {nixKeys, ...}: nixKeys;
 in {
   users.users = mkMerge (mapAttrsToList mkAdmin admins);
+  nix.settings.trusted-public-keys = lists.concatLists (mapAttrsToList mkNixKeys admins);
 }

nixos/roles/default.nix

@@ -5,18 +5,11 @@
 }: {
   imports = [
     ./admins.nix
-    ./nix_keys.nix
+    ./nix.nix
     ./prometheusNodeExporter.nix
     ../modules/impermanence.nix
   ];
 
-  nix = {
-    extraOptions = ''
-      experimental-features = nix-command flakes
-      builders-use-substitutes = true
-    '';
-  };
-
   networking = {
     firewall = {
       # these shoud be default, but better make sure!

nixos/roles/nix.nix

@@ -0,0 +1,22 @@
+{
+  nix = {
+    settings = {
+      # trusted-public-keys belonging to specific persons are set in rolse/admins.nix
+      trusted-public-keys = [];
+      experimental-features = [
+        "flakes"
+        "nix-command"
+      ];
+      auto-optimise-store = true;
+      fallback = true;
+      builders-use-substitutes = true;
+    };
+    gc = {
+      automatic = true;
+      persistent = false;
+      dates = "weekly";
+      options = "-d";
+      randomizedDelaySec = "5h";
+    };
+  };
+}

nixos/roles/nix_keys.nix

@@ -1,7 +0,0 @@
-{
-  imports = [];
-  nix.settings.trusted-public-keys = [
-    "nerflap2-1:pDZCg0oo9PxNQxwVSQSvycw7WXTl53PGvVeZWvxuqJc="
-    "gonne.mathebau.de-1:FsXFyFiBFE/JxC9MCkt/WuiXjx5dkRI9RXj0FxOQrV0="
-  ];
-}