From fb5aa857116c21a40e8547074336661c866bd6fd Mon Sep 17 00:00:00 2001 From: Phoenix/HotaruBlaze Date: Sun, 31 May 2026 10:56:54 +0100 Subject: [PATCH] rewrite --- common.nix | 39 ------------------- flake.nix | 6 +-- hosts/blade/default.nix | 72 +++-------------------------------- modules/common.nix | 11 ++++++ modules/common/networking.nix | 15 ++++++++ modules/common/packages.nix | 18 +++++++++ modules/common/services.nix | 6 +++ modules/common/system.nix | 10 +++++ modules/common/users.nix | 35 +++++++++++++++++ 9 files changed, 103 insertions(+), 109 deletions(-) delete mode 100644 common.nix create mode 100644 modules/common.nix create mode 100644 modules/common/networking.nix create mode 100644 modules/common/packages.nix create mode 100644 modules/common/services.nix create mode 100644 modules/common/system.nix create mode 100644 modules/common/users.nix diff --git a/common.nix b/common.nix deleted file mode 100644 index c2313ec..0000000 --- a/common.nix +++ /dev/null @@ -1,39 +0,0 @@ -{ config, lib, pkgs, ... }: - -{ - # Shared users - users.mutableUsers = false; - users.users.phoenix = { - isNormalUser = true; - description = "Phoenix"; - extraGroups = [ "wheel" ]; - shell = pkgs.bash; - home = "/home/phoenix"; - createHome = true; - useDefaultShell = true; - }; - - # Shared packages - environment.systemPackages = with pkgs; [ - nano - vim - git - curl - wget - sops - age - ]; - - # Shared services - services.openssh.enable = true; - services.openssh.permitRootLogin = "no"; - - # Timezone and locale - time.timeZone = "Europe/London"; - i18n.defaultLocale = "en_US.UTF-8"; - console.keyMap = "uk"; - - # Firewall - networking.firewall.enable = true; - networking.firewall.allowedTCPPorts = [ 22 ]; # SSH -} diff --git a/flake.nix b/flake.nix index 1abdd3d..f2c8843 100644 --- a/flake.nix +++ b/flake.nix @@ -1,10 +1,9 @@ { - description = "Colmena Remote NixOS Management"; + description = "NixOS at Home - Colmena Remote Management"; inputs = { nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable"; nixpkgs-stable.url = "github:nixos/nixpkgs/nixos-22.11"; - colmena.url = "github:zhaofengli/colmena"; }; @@ -16,7 +15,6 @@ system = "x86_64-linux"; overlays = []; }; - specialArgs = { inherit inputs; }; @@ -25,4 +23,4 @@ blade = import ./hosts/blade; }; }; -} \ No newline at end of file +} diff --git a/hosts/blade/default.nix b/hosts/blade/default.nix index 7b6f85e..217699e 100644 --- a/hosts/blade/default.nix +++ b/hosts/blade/default.nix @@ -9,39 +9,26 @@ { deployment = { - targetHost = "192.168.1.69"; # also supports an IP address + targetHost = "192.168.1.69"; targetPort = 22; targetUser = "phoenix"; buildOnTarget = true; keys.phoenix.keyFile = "/home/nixos/.ssh/id_ed25519.pub"; tags = [ - "homelab" + "homelab" ]; }; imports = [ ./hardware-configuration.nix + ../../modules/common.nix ]; - # boot.loader.grub.enable = true; - networking.useDHCP = false; networking.interfaces.eth0.useDHCP = true; - time.timeZone = "America/New_York"; networking.hostName = "blade"; - services.xserver.xkb.layout = "uk"; - i18n.defaultLocale = "en_US.UTF-8"; - - nix.settings.trusted-users = [ - "root" - "@wheel" - ]; users.users.phoenix = { - isNormalUser = true; - extraGroups = [ - "wheel" - "networkmanager" - ]; + extraGroups = [ "wheel" "networkmanager" ]; home = "/home/phoenix"; packages = with pkgs; [ vim @@ -55,60 +42,13 @@ }; users.users.deploy = { - isNormalUser = true; - extraGroups = [ - "wheel" - "networkmanager" - ]; + extraGroups = [ "wheel" "networkmanager" ]; home = "/home/deploy"; - # packages = with pkgs; [ - # vim - # tree - # lego - # ]; openssh.authorizedKeys.keys = [ "sk-ecdsa-sha2-nistp256@openssh.com AAAAInNrLWVjZHNhLXNoYTItbmlzdHAyNTZAb3BlbnNzaC5jb20AAAAIbmlzdHAyNTYAAABBBMPNyAyMrqlI3tUI39TqcgYBciIC+aY2UNAunFqylhhzTVA14rluMjFqHf9HKs9SHZ52nLEV58/BxlnMeMtRc+cAAAAEc3NoOg== phoenix@DESKTOP-1A9MAJO" "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMoM3FANeYtWLJIiTL+nU0XzZft2psiSgbCmNfQZBXgy nixos@nixos" ]; }; -# systemd.user.enable = false; - security.sudo.extraRules = [ - { - users = [ "phoenix" ]; - commands = [ - { - command = "ALL"; - options = [ "NOPASSWD" ]; # "SETENV" # Adding the following could be a good idea - } - ]; - } - ]; - - environment.systemPackages = with pkgs; [ - inetutils - mtr - sysstat - dig - openssl - ]; - - services.openssh = { - enable = true; - settings.PermitRootLogin = "yes"; - }; - - networking.firewall.allowedTCPPorts = [ - 22 - 80 - 443 - ]; - # networking.firewall.allowedUDPPorts = [ ... ]; - networking.firewall.enable = true; - networking.usePredictableInterfaceNames = false; - # Bootloader - boot.loader.systemd-boot.enable = true; - boot.loader.efi.canTouchEfiVariables = true; - - system.stateVersion = "25.11"; + networking.firewall.allowedTCPPorts = [ 22 80 443 ]; } diff --git a/modules/common.nix b/modules/common.nix new file mode 100644 index 0000000..dca178a --- /dev/null +++ b/modules/common.nix @@ -0,0 +1,11 @@ +{ config, lib, pkgs, ... }: + +{ + imports = [ + ./common/users.nix + ./common/packages.nix + ./common/services.nix + ./common/networking.nix + ./common/system.nix + ]; +} diff --git a/modules/common/networking.nix b/modules/common/networking.nix new file mode 100644 index 0000000..18d166d --- /dev/null +++ b/modules/common/networking.nix @@ -0,0 +1,15 @@ +{ config, lib, pkgs, ... }: + +{ + time.timeZone = "Europe/London"; + i18n.defaultLocale = "en_US.UTF-8"; + console.keyMap = "uk"; + + networking = { + firewall.enable = true; + firewall.allowedTCPPorts = [ 22 ]; # SSH + hostName = config.networking.hostName or "nixos"; + useDHCP = false; + usePredictableInterfaceNames = false; + }; +} diff --git a/modules/common/packages.nix b/modules/common/packages.nix new file mode 100644 index 0000000..85070ec --- /dev/null +++ b/modules/common/packages.nix @@ -0,0 +1,18 @@ +{ config, lib, pkgs, ... }: + +{ + environment.systemPackages = with pkgs; [ + nano + vim + git + curl + wget + sops + age + inetutils + mtr + sysstat + dig + openssl + ]; +} diff --git a/modules/common/services.nix b/modules/common/services.nix new file mode 100644 index 0000000..dd3272b --- /dev/null +++ b/modules/common/services.nix @@ -0,0 +1,6 @@ +{ config, lib, pkgs, ... }: + +{ + services.openssh.enable = true; + services.openssh.permitRootLogin = "no"; +} diff --git a/modules/common/system.nix b/modules/common/system.nix new file mode 100644 index 0000000..4612399 --- /dev/null +++ b/modules/common/system.nix @@ -0,0 +1,10 @@ +{ config, lib, pkgs, ... }: + +{ + system.stateVersion = "25.11"; + + boot.loader.systemd-boot.enable = true; + boot.loader.efi.canTouchEfiVariables = true; + + services.xserver.xkb.layout = "uk"; +} diff --git a/modules/common/users.nix b/modules/common/users.nix new file mode 100644 index 0000000..7d82edd --- /dev/null +++ b/modules/common/users.nix @@ -0,0 +1,35 @@ +{ config, lib, pkgs, ... }: + +{ + users.mutableUsers = false; + + users.users.phoenix = { + isNormalUser = true; + description = "Phoenix"; + extraGroups = [ "wheel" "networkmanager" ]; + shell = pkgs.bash; + home = "/home/phoenix"; + createHome = true; + useDefaultShell = true; + }; + + users.users.deploy = { + isNormalUser = true; + extraGroups = [ "wheel" "networkmanager" ]; + home = "/home/deploy"; + }; + + security.sudo.extraRules = [ + { + users = [ "phoenix" ]; + commands = [ + { + command = "ALL"; + options = [ "NOPASSWD" ]; + } + ]; + } + ]; + + nix.settings.trusted-users = [ "root" "@wheel" ]; +}