diff --git a/nixos/.sops.yaml b/nixos/.sops.yaml
index 94feb2d..21606cf 100644
--- a/nixos/.sops.yaml
+++ b/nixos/.sops.yaml
@@ -1,8 +1,9 @@
-
keys:
- - &homelab age1ldgnl53dmvl4fjz6hgdj0cvensagddn3ltpmxfm72m8q273w75fsk42p8v
+ - &laptop age1ldgnl53dmvl4fjz6hgdj0cvensagddn3ltpmxfm72m8q273w75fsk42p8v
+ - &server age1tklxmt3txjjhcsgwy8ejjj20xuq9ca9w522cvan0vwnmq0vdpezsah25pe
creation_rules:
- path_regex: secrets/[^/]+\.(yaml|json|env|ini)$
key_groups:
- age:
- - *homelab
+ - *laptop
+ - *server
diff --git a/nixos/configuration.nix b/nixos/configuration.nix
index 9ec719b..e09af25 100644
--- a/nixos/configuration.nix
+++ b/nixos/configuration.nix
@@ -5,7 +5,7 @@ let
Hello
- Hello from test.roypository.com 🎉
+ Hello from test.roypository.com
This content is defined in configuration.nix
@@ -47,11 +47,14 @@ in
};
environment.variables = {
- LEAKYKEY = builtins.readFile config.sops.secrets."clusterPassword".path;
+ CP = config.sops.secrets."clusterPassword".path;
+ CAE = config.sops.secrets."cloudflare-api-email".path;
+ CAK = config.sops.secrets."cloudflare-api-key".path;
};
systemd.user.services.mbsync.unitConfig.After = [ "sops-nix.service" ];
-
+ fileSystems."/persist".neededForBoot = true;
+
# set up DNS with nginx
security.acme = {
acceptTerms = true;
diff --git a/nixos/hardware-configuration.nix b/nixos/hardware-configuration.nix
index 4d9c12b..60e6ce9 100644
--- a/nixos/hardware-configuration.nix
+++ b/nixos/hardware-configuration.nix
@@ -8,7 +8,7 @@
[ (modulesPath + "/installer/scan/not-detected.nix")
];
- boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "ehci_pci" "nvme" "sr_mod" ];
+ boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "ehci_pci" "nvme" "usbhid" "usb_storage" "sd_mod" "sr_mod" ];
boot.initrd.kernelModules = [ ];
boot.kernelModules = [ "kvm-amd" ];
boot.extraModulePackages = [ ];
diff --git a/nixos/script.sh b/nixos/script.sh
new file mode 100755
index 0000000..1d20f70
--- /dev/null
+++ b/nixos/script.sh
@@ -0,0 +1,97 @@
+#!/usr/bin/env bash
+
+# User variables
+target_hostname=""
+target_destination=""
+target_user=${BOOTSTRAP_USER-root} # Set BOOTSTRAP_ defaults in your shell.nix
+ssh_port=${BOOTSTRAP_SSH_PORT-22}
+ssh_key=${BOOTSTRAP_SSH_KEY-}
+
+# Create a temporary directory
+temp=$(mktemp -d)
+
+# Function to cleanup temporary directory on exit
+cleanup() {
+ rm -rf "$temp"
+}
+trap cleanup EXIT
+
+function help_and_exit() {
+ echo
+ echo "Remotely installs NixOS on a target machine using this nix-config."
+ echo
+ echo "USAGE: $0 -n -d -k [OPTIONS]"
+ echo
+ echo "ARGS:"
+ echo " -n specify target_hostname of the target host to deploy the nixos config on."
+ echo " -d specify ip or domain to the target host."
+ echo " -k specify the full path to the ssh_key you'll use for remote access to the"
+ echo " target during install process."
+ echo " Example: -k /home/${target_user}/.ssh/my_ssh_key"
+ echo
+ echo "OPTIONS:"
+ echo " -u specify target_user with sudo access. nix-config will be cloned to their home."
+ echo " Default=root."
+ echo " --port specify the ssh port to use for remote access. Default=${ssh_port}."
+ echo " --debug Enable debug mode."
+ echo " -h | --help Print this help."
+ exit 0
+}
+
+# Handle command-line arguments
+while [[ $# -gt 0 ]]; do
+ case "$1" in
+ -n)
+ shift
+ target_hostname=$1
+ ;;
+ -d)
+ shift
+ target_destination=$1
+ ;;
+ -u)
+ shift
+ target_user=$1
+ ;;
+ -k)
+ shift
+ ssh_key=$1
+ ;;
+ --port)
+ shift
+ ssh_port=$1
+ ;;
+ --temp-override)
+ shift
+ temp=$1
+ ;;
+ --debug)
+ set -x
+ ;;
+ -h | --help) help_and_exit ;;
+ *)
+ red "ERROR: Invalid option detected."
+ help_and_exit
+ ;;
+ esac
+ shift
+done
+
+if [ -z "$target_hostname" ] || [ -z "$target_destination" ] || [ -z "$ssh_key" ]; then
+ red "ERROR: -n, -d, and -k are all required"
+ echo
+ help_and_exit
+fi
+
+# Create the directory where sshd expects to find the host keys
+install -d -m755 "$tempSSH/persist/etc/ssh"
+
+# Generate private key and copy it to the temporary directory
+ssh-keygen -t ed25519 -f "$temp/$persist_dir/etc/ssh/ssh_host_ed25519_key" -C "$target_user"@"$target_hostname" -N ""
+
+# Set the correct permissions so sshd will accept the key
+chmod 600 "$temp/persist/etc/ssh/ssh_host_ed25519_key"
+
+# Install NixOS to the host system with our secrets
+nix run github:nix-community/nixos-anywhere --extra-experimental-features "nix-command flakes" -- --ssh-port "$ssh_port" --post-kexec-ssh-port "$ssh_port" --extra-files "$temp" --generate-hardware-config nixos-generate-config ./hardware-configuration.nix --disko-mode disko --build-on local --flake .#"$target_hostname" --target-host "$target_user"@"$target_destination"
+
diff --git a/nixos/secrets/build.json b/nixos/secrets/build.json
index b8cf77b..63bfd84 100644
--- a/nixos/secrets/build.json
+++ b/nixos/secrets/build.json
@@ -8,7 +8,11 @@
"age": [
{
"recipient": "age1ldgnl53dmvl4fjz6hgdj0cvensagddn3ltpmxfm72m8q273w75fsk42p8v",
- "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBGZUs1ajViZTM4Smg3a1BU\nU05taWxTUGRzald0cnE3MWt1VzVtMGE0cHlvCnhWbVN0cFNSZDZMcVdXUXVtZUtM\nRzhmK1QvS1R6enNKRnRUdlRLdWhQZjQKLS0tIGJRWElaTWhCbm50Wk1ZRjBUbU5R\nZU9tUjhlR0xwQlU0WnNvQ1FBZGlRQWcK/+Vj6QoktFQ78CxJ8dSQGGqE72fxagA+\n10f60BNlWjWtkIZ2CmcjsDi1zLHny10MaKj9fyRvmBta6Inzra/maA==\n-----END AGE ENCRYPTED FILE-----\n"
+ "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJeFpEeWxyY3hVK0pOMFlV\ndXRhRzRjUUtmK2VpdjZNMDJ2NURDRFZ6WjBFClc3MXR2R3pPVERvUWV4OUpXM2hy\nVm9GTkxMSzRSZW1Lb0Fnbkx5YmFqNTAKLS0tIDBJZFgwQjNXaU5UeFUrWUlhWkRO\nK3QwdlBUSUpiVTVBTnkyM1RNMER6ekkKlzYHGPU9b3tY/37nEOiNgQpJFr5KwnU0\n13VRnL5IPlZuSSHaxDXZYjRas0lMT1LujrI0GSjqB8+Pj3m0nELFBg==\n-----END AGE ENCRYPTED FILE-----\n"
+ },
+ {
+ "recipient": "age1tklxmt3txjjhcsgwy8ejjj20xuq9ca9w522cvan0vwnmq0vdpezsah25pe",
+ "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBFY1hRWGowRUExd2VLa2Jh\nY2ZEc053b0lGaGlhSG8zalkwdmZaV1p4NVJFCjdxWGdaVVNrakRGZS92OVdGcndI\nZjNMWG56UURwUm4xZk5Ud2ErWGVxYzQKLS0tIFBTa0szR2pvczFwdGpncXhicTBQ\ndk9nL3ROUk1ROFNRYmlDZytRbkJzSlUKI5dp4LoM/aBz2A+mHCmUy7PoHP3CXFOU\nU4ciuyCV4HFHkDB7NMOsrO3D+7U/xG3gBzglEaws/hrCW7iZNjItUw==\n-----END AGE ENCRYPTED FILE-----\n"
}
],
"lastmodified": "2025-04-17T15:26:55Z",
diff --git a/nixos/secrets/cloudflare.json b/nixos/secrets/cloudflare.json
index 01fe7b4..c01139f 100644
--- a/nixos/secrets/cloudflare.json
+++ b/nixos/secrets/cloudflare.json
@@ -9,7 +9,11 @@
"age": [
{
"recipient": "age1ldgnl53dmvl4fjz6hgdj0cvensagddn3ltpmxfm72m8q273w75fsk42p8v",
- "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBiSVlXekdnZW02SlpUN0Zq\nS3hzVGtGdkRQRUMrNExqVEFaQnJrVVRNOXhVClJYT2dNVTFuSE9SYnlnSEJmdkUw\nS21pYmRSaFRIVlp5clVST3VTY0YyS1kKLS0tIE9Hd09QWk0xYzBuSzBnU3gzSmFZ\nWUo3T0EyeXUzVjA2SFNFR1QzeW84OUEKObVZ9D7NZPwRXj7OA7EAJtmarT76TnSb\n/SsZ6vU3hQ9Vcn5EIZ39+MpdFluyxZkoq+0di52BHkgExrUD8VD0Lg==\n-----END AGE ENCRYPTED FILE-----\n"
+ "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBKY2N5RWIwK21GRjgzVzdQ\nR0V1T3pwTWVCR2hNKzI3UTh2N3phYWFzTGtVCmN2Vlk1eUNCNlFVWWkyNVd2cUta\nYjNPZk4vUkZhSHU1T0cxRTRXVjArelkKLS0tIC9jM2pKSzE4TDJLdGF6OUJDSHZL\nYzdOT255TVZBOE9qYVN0NjZWdFArN0EKMa0cJmuYG4Jo1YqT9J9F6dFzscev+CDA\nzh0JsUbVmlHmjGIwVvrdmj3io/U12CrifnnEYs0oRb+zYMwTvbokFQ==\n-----END AGE ENCRYPTED FILE-----\n"
+ },
+ {
+ "recipient": "age1tklxmt3txjjhcsgwy8ejjj20xuq9ca9w522cvan0vwnmq0vdpezsah25pe",
+ "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBZcjlXYVJRNWNvTCs0ODBW\nblJGbEpjOUR2eDJDY0psbFBJMG5ZTitFRTE4CkZMS0ZhZ0Z3T2xXREZrc1VvUkhJ\nblN5SnMvWG5lVmdaMUVUWVRGTFBIKzgKLS0tIEpneFF2cytwa2FISmpScjdudTg5\nc3BvKzFpalIwQzczOUxCYXZnM0xwME0KksEAZTqf/N/FlgXwvHpzZ6U8Zhq2/Yz3\nDBv4A9SQMDhR3lVRxBP4Vw/+GbZ5ZTmGTsbSPqjvSsvT3wtde34Bkg==\n-----END AGE ENCRYPTED FILE-----\n"
}
],
"lastmodified": "2025-04-28T04:15:19Z",