mirrors_public/oddlama_nix-config
1
1
Fork 1
mirror of https://github.com/oddlama/nix-config.git synced 2025-10-10 23:00:39 +02:00
Code Activity

fix: refactoring mistakes; and add generator for initrd_host_ed25519_key

Browse source
This commit is contained in:
oddlama 2023-06-18 12:55:18 +02:00
parent abdf363fba
commit 1b42e0cd72
No known key found for this signature in database
GPG key ID: 14EFE510775FE39A
8 changed files with 19 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

1
README.md
View file

@ -60,7 +60,6 @@ This is my personal nix config.
- create hosts/<name>
- fill net.nix
- fill fs.nix (you need to know the device by-id paths in advance for formatting to work!)
- generate an initrd hostkey if necessary `ssh-keygen -t ed25519 -N "" -f /tmp/key; rage ...`
- run generate-secrets
#### Initial deploy

13
hosts/common/initrd-ssh.nix
View file

@ -4,8 +4,17 @@
nodePath,
...
}: {
# TODO generate script
age.secrets.initrd_host_ed25519_key.file = nodePath + "/secrets/initrd_host_ed25519_key.age";
age.secrets.initrd_host_ed25519_key = {
rekeyFile = nodePath + "/secrets/initrd_host_ed25519_key.age";
# Generate only an ssh-ed25519 private key
generator.script = {
pkgs,
lib,
...
}: ''
(exec 3>&1; ${pkgs.openssh}/bin/ssh-keygen -q -t ed25519 -N "" -f /proc/self/fd/3 <<<y >/dev/null 2>&1)
'';
};
boot.initrd.network.enable = true;
boot.initrd.network.ssh = {

2
hosts/ward/microvms/grafana/secrets/host.pub
View file

@ -1 +1 @@
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBXXjI6uB26xOF0DPy/QyLladoGIKfAtofyqPgIkCH/g
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBn1J13YFYrxYV39rdqDzTaS8r/U4iNMQmcz9Oi+D6oq

2
hosts/ward/microvms/kanidm/secrets/host.pub
View file

@ -1 +1 @@
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIN2TxWynLb8V9SP45kFqsoCWhe/dG8N1xWNuJG5VQndq
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIF6Waic9tzHF2gnD480ArdOyIdzdM4SN6bmh0ceVKqFo

6
hosts/ward/microvms/vaultwarden/default.nix
View file

@ -34,17 +34,17 @@ in {
import common
reverse_proxy {
to http://${config.services.vaultwarden.settings.ROCKET_ADDRESS}:${toString config.services.vaultwarden.settings.ROCKET_PORT}
to http://${config.services.vaultwarden.config.rocketAddress}:${toString config.services.vaultwarden.config.rocketPort}
header_up X-Real-IP {remote_host}
}
reverse_proxy /notifications/hub {
to http://${config.services.vaultwarden.settings.WEBSOCKET_ADDRESS}:${toString config.services.vaultwarden.settings.WEBSOCKET_PORT}
to http://${config.services.vaultwarden.config.websocketAddress}:${toString config.services.vaultwarden.config.websocketPort}
header_up X-Real-IP {remote_host}
}
reverse_proxy /notifications/hub/negotiate {
to http://${config.services.vaultwarden.settings.ROCKET_ADDRESS}:${toString config.services.vaultwarden.settings.ROCKET_PORT}
to http://${config.services.vaultwarden.config.rocketAddress}:${toString config.services.vaultwarden.config.rocketPort}
header_up X-Real-IP {remote_host}
}
'';

2
hosts/ward/microvms/vaultwarden/secrets/host.pub
View file

@ -1 +1 @@
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICDDvvF3+KwfoZrPAUAt2HS7y5FM9S5Mr1iRkBUqoXno
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMTYmtppqehM9LuH9PwBJvBxvbyvauTlqtMeRHEYYqW9

2
modules/extra.nix
View file

@ -50,7 +50,7 @@ in {
# Sensible defaults for caddy
services.caddy = mkIf config.services.caddy.enable {
globalConfig = ''
extraConfig = ''
(common) {
encode zstd gzip

2
modules/promtail.nix
View file

@ -48,7 +48,7 @@ in {
clients = [
{
basicAuthUser = nodeName;
basic_auth.username = nodeName;
basic_auth.password_file = config.age.secrets.promtail-loki-basic-auth-password.path;
url = "https://${nodes.${cfg.proxy}.config.proxiedDomains.loki}/loki/api/v1/push";
}