Initial commit

2026-05-31 09:33:14 +00:00
commit 6bce73c167
12 changed files with 698 additions and 0 deletions
--- a/hosts/blade/default.nix
+++ b/hosts/blade/default.nix
@@ -0,0 +1,96 @@
+{
+  name,
+  nodes,
+  pkgs,
+  lib,
+  inputs,
+  ...
+}:
+{
+
+  deployment = {
+    targetHost = "192.168.1.69"; # also supports an IP address
+    targetPort = 22;
+    targetUser = "phoenix";
+    buildOnTarget = true;
+    keys.phoenix.keyFile = "/home/nixos/.ssh/id_ed25519.pub";
+  };
+
+  imports = [
+    ./hardware-configuration.nix
+  ];
+
+  #   boot.loader.grub.enable = true;
+  networking.useDHCP = false;
+  networking.interfaces.eth0.useDHCP = true;
+  time.timeZone = "America/New_York";
+  networking.hostName = "blade";
+  services.xserver.xkb.layout = "uk";
+  i18n.defaultLocale = "en_US.UTF-8";
+
+  nix.settings.trusted-users = [
+    "root"
+    "@wheel"
+  ];
+
+  users.users.phoenix = {
+    isNormalUser = true;
+    extraGroups = [
+      "wheel"
+      "networkmanager"
+    ];
+    home = "/home/phoenix";
+    packages = with pkgs; [
+      vim
+      tree
+      lego
+    ];
+    openssh.authorizedKeys.keys = [
+      "sk-ecdsa-sha2-nistp256@openssh.com AAAAInNrLWVjZHNhLXNoYTItbmlzdHAyNTZAb3BlbnNzaC5jb20AAAAIbmlzdHAyNTYAAABBBMPNyAyMrqlI3tUI39TqcgYBciIC+aY2UNAunFqylhhzTVA14rluMjFqHf9HKs9SHZ52nLEV58/BxlnMeMtRc+cAAAAEc3NoOg== phoenix@DESKTOP-1A9MAJO"
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMoM3FANeYtWLJIiTL+nU0XzZft2psiSgbCmNfQZBXgy nixos@nixos"
+    ];
+  };
+
+  systemd.user.services.dbus = {
+    restartIfChanged = false;
+  };
+
+  security.sudo.extraRules = [
+    {
+      users = [ "phoenix" ];
+      commands = [
+        {
+          command = "ALL";
+          options = [ "NOPASSWD" ]; # "SETENV" # Adding the following could be a good idea
+        }
+      ];
+    }
+  ];
+
+  environment.systemPackages = with pkgs; [
+    inetutils
+    mtr
+    sysstat
+    dig
+    openssl
+  ];
+
+  services.openssh = {
+    enable = true;
+    settings.PermitRootLogin = "yes";
+  };
+
+  networking.firewall.allowedTCPPorts = [
+    22
+    80
+    443
+  ];
+  # networking.firewall.allowedUDPPorts = [ ... ];
+  networking.firewall.enable = true;
+  networking.usePredictableInterfaceNames = false;
+  # Bootloader
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.efi.canTouchEfiVariables = true;
+
+  system.stateVersion = "25.11";
+}
--- a/hosts/blade/hardware-configuration.nix
+++ b/hosts/blade/hardware-configuration.nix
@@ -0,0 +1,31 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports =
+    [ (modulesPath + "/installer/scan/not-detected.nix")
+    ];
+
+  boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "usbhid" "uas" "usb_storage" "sd_mod" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-intel" ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" =
+    { device = "/dev/disk/by-uuid/64882a2d-c966-4fc9-96f0-413c6d835848";
+      fsType = "ext4";
+    };
+
+  fileSystems."/boot" =
+    { device = "/dev/disk/by-uuid/8381-A6DD";
+      fsType = "vfat";
+      options = [ "fmask=0022" "dmask=0022" ];
+    };
+
+  swapDevices = [ ];
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+}
--- a/hosts/blade/secrets.yaml
+++ b/hosts/blade/secrets.yaml
@@ -0,0 +1,17 @@
+phoenix_password: ENC[AES256_GCM,data:v39j4NSTWfDcg1em5eat7APzEAOdgxWZ7RVhtErVFfVsvK7lof3mmdjfcqaRiJL0VZunY6/idAIG9m18p6+14+pre3Esrr56iw==,iv:ut2M0g+tgVwNA2MGb0OhQRLevcQp8IkkYvnJlDzIK3Q=,tag:AtL7MAntOPSp37T+12jy3A==,type:str]
+root_password: ENC[AES256_GCM,data:qn/nJm1Wt9GPVh1qifIIxOp89WWGMuAL52JHoHC3S+0HHFkAds+ZuvuXWnwt6t9WG3v8QdBXbGEK+KlEwdyke5OTfnWQXr0udA==,iv:Ve1IAI3vRGnUSgJoSYKGl3swLKjgozFL5I7crbAjtWw=,tag:6IBWbriKr1bt0IWuppLlRg==,type:str]
+sops:
+    age:
+        - recipient: age1t9c8j4yclx7wylzry8k0f473p4qt32d0kvgj8ce5k5zqvj2p9g4qsplaw8
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBQL0lPQWh1ME5Ibm1vSnF6
+            WHg5VDZGaEt2bVFMN2tVUm9rbjNBVTdNdWo0Ck9aeVI2NVpDR3l3Qk5GTE1EN0I0
+            L2JtLzg3aFJqaEpURWs4cy9iZWNVNEkKLS0tIHhnUEdQVm5odk04QjJLKzNPdnU4
+            MVpEejNnN0xNYWRxeVFLV2c5MTBhbmMKi4y6u2MaqjnnNR/jKXPZDBX2xfnkbwZ3
+            ZP/Eu4qwakyow6pmn0Xw4IMizkAmylQWQL7T2lfoqatZ2sAyUQj2Yg==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-05-28T14:31:52Z"
+    mac: ENC[AES256_GCM,data:dzNPYMmmDV4VjFeGa0FtcPbGQmVo48V7M8kqnmH4HsZJRUlBO+sNclQbBibGjne5hZYP6h2dfRb3gXYV4OmmLUcaQenMRLAUGQvR80wAIRFcD+v7ax2oqiG0sTkodtG8dFfeKwpWvWLTL6IuVuEZ0+yVp9pvtqHPdrB0c73rqzY=,iv:T6d4B4s0OY/InJ03y4COPG0Ms0WlwN1WQjK+lThnjzM=,tag:Jni2/94F+SX1149/cBK2dA==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.11.0