diff --git a/checks.nix b/checks.nix
deleted file mode 100644
index 9505c35..0000000
--- a/checks.nix
+++ /dev/null
@@ -1,20 +0,0 @@
-{
- self,
- flake-utils,
- nixpkgs,
- ...
-}:
-(flake-utils.lib.eachDefaultSystem (
- system:
- let
- pkgs = nixpkgs.legacyPackages.${system};
- formatter = self.formatter.${system};
- in
- {
- checks = {
- format = pkgs.runCommand "check-format" {
- buildInputs = [ formatter ];
- } "${formatter}/bin/nixpkgs-fmt --check ${./.} && touch $out";
- };
- }
-)).checks
diff --git a/devshell.nix b/devshell.nix
index 1fbad07..3931494 100644
--- a/devshell.nix
+++ b/devshell.nix
@@ -6,7 +6,6 @@
packages = with pkgs; [
agenix
- nixpkgs-fmt
nixos-rebuild
];
diff --git a/flake.lock b/flake.lock
index 8c964f5..3d0d3f2 100644
--- a/flake.lock
+++ b/flake.lock
@@ -325,22 +325,6 @@
"type": "github"
}
},
- "nixpkgs-small": {
- "locked": {
- "lastModified": 1753505055,
- "narHash": "sha256-jQKnNATDGDeuIeUf7r0yHnmirfYkYPHeF0N2Lv8rjPE=",
- "owner": "NixOS",
- "repo": "nixpkgs",
- "rev": "7be0239edbf0783ff959f94f9728db414be73002",
- "type": "github"
- },
- "original": {
- "owner": "NixOS",
- "ref": "nixos-unstable-small",
- "repo": "nixpkgs",
- "type": "github"
- }
- },
"nixpkgs-stable": {
"locked": {
"lastModified": 1730741070,
@@ -397,7 +381,6 @@
"nixos-generators": "nixos-generators",
"nixos-hardware": "nixos-hardware",
"nixpkgs": "nixpkgs",
- "nixpkgs-small": "nixpkgs-small",
"systems": "systems_2",
"treefmt-nix": "treefmt-nix"
}
diff --git a/flake.nix b/flake.nix
index 73686ce..151f1b5 100644
--- a/flake.nix
+++ b/flake.nix
@@ -2,7 +2,6 @@
description = "dadada's nix flake";
inputs = {
- nixpkgs-small.url = "github:NixOS/nixpkgs/nixos-unstable-small";
nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
disko = {
url = "github:nix-community/disko";
diff --git a/home/nixpkgs-config.nix b/home/nixpkgs-config.nix
deleted file mode 100644
index 6a29a63..0000000
--- a/home/nixpkgs-config.nix
+++ /dev/null
@@ -1,7 +0,0 @@
-{ pkgs }:
-{
- allowUnfree = true;
- allowUnfreePredicate = pkg: true;
- allowBroken = false;
- android_sdk.accept_license = true;
-}
diff --git a/home/pkgs.nix b/home/pkgs.nix
index 7a707e1..e980614 100644
--- a/home/pkgs.nix
+++ b/home/pkgs.nix
@@ -125,7 +125,6 @@ with pkgs;
spotify
sqlite
sshfs-fuse
- steam
taplo
tcpdump
tdesktop
diff --git a/hydra-jobs.nix b/hydra-jobs.nix
deleted file mode 100644
index 3369943..0000000
--- a/hydra-jobs.nix
+++ /dev/null
@@ -1,4 +0,0 @@
-{ self, nixpkgs, ... }:
-(nixpkgs.lib.mapAttrs' (
- name: config: nixpkgs.lib.nameValuePair name config.config.system.build.toplevel
-) self.nixosConfigurations)
diff --git a/nixos/agares/configuration.nix b/nixos/agares/configuration.nix
deleted file mode 100644
index ba00c29..0000000
--- a/nixos/agares/configuration.nix
+++ /dev/null
@@ -1,108 +0,0 @@
-{
- config,
- modulesPath,
- pkgs,
- ...
-}:
-{
- imports = [
- (modulesPath + "/installer/scan/not-detected.nix")
- ./ddns.nix
- ./dns.nix
- ./firewall.nix
- ../modules/profiles/server.nix
- ./network.nix
- ./ntp.nix
- ./ppp.nix
- ];
-
- fileSystems."/" = {
- device = "/dev/sda1";
- fsType = "btrfs";
- options = [ "subvol=root" ];
- };
-
- #fileSystems."/nix/store" = {
- # device = "/dev/sda1";
- # fsType = "btrfs";
- # options = [ "subvol=/root/nix" "noatime" ];
- #};
-
- fileSystems."/swap" = {
- device = "/dev/sda1";
- fsType = "btrfs";
- options = [
- "subvol=/root/swap"
- "noatime"
- ];
- };
-
- #swapDevices = [{
- # device = "/swap/swapfile";
- # size = 32 * 1024; # 32 GByte
- #}];
-
- hardware.cpu.amd.updateMicrocode = config.hardware.enableRedistributableFirmware;
-
- dadada = {
- admin.enable = true;
- };
-
- services.smartd.enable = true;
-
- networking.hostName = "agares";
- networking.domain = "bs.dadada.li";
-
- boot.initrd.availableKernelModules = [
- "xhci_pci"
- "ahci"
- "ehci_pci"
- "usb_storage"
- "sd_mod"
- "sdhci_pci"
- ];
- boot.initrd.kernelModules = [ "dm-snapshot" ];
-
- # Use the GRUB 2 boot loader.
- boot.loader.grub.enable = true;
- boot.loader.grub.device = "/dev/sda";
- boot.loader.grub.extraConfig = "
- serial --speed=115200 --unit=0 --word=8 --parity=no --stop=1
- terminal_input serial
- terminal_output serial
- ";
-
- boot.kernelParams = [
- "console=ttyS0,115200"
- "amd_iommu=on"
- "iommu=pt"
- ];
-
- boot.kernelModules = [
- "kvm-amd"
- "vfio"
- "vfio_iommu_type1"
- "vfio_pci"
- "vfio_virqfd"
- ];
-
- environment.systemPackages = with pkgs; [
- curl
- flashrom
- dmidecode
- tcpdump
- ];
-
- services.munin-node = {
- enable = true;
- extraConfig = ''
- host_name ${config.networking.hostName}
- cidr_allow 10.3.3.3/32
- '';
- };
-
- # Running router VM. They have to be restarted in the right order, so network comes up cleanly. Not ideal.
- system.autoUpgrade.allowReboot = false;
-
- system.stateVersion = "23.05";
-}
diff --git a/nixos/agares/ddns.nix b/nixos/agares/ddns.nix
deleted file mode 100644
index 9a5948f..0000000
--- a/nixos/agares/ddns.nix
+++ /dev/null
@@ -1,13 +0,0 @@
-{ config, ... }:
-{
- dadada.ddns = {
- domains = [ "vpn.dadada.li" ];
- credentialsPath = config.age.secrets."ddns-credentials".path;
- interface = "ppp0";
- };
-
- age.secrets."ddns-credentials" = {
- file = "${config.dadada.secrets.path}/ddns-credentials.age";
- mode = "400";
- };
-}
diff --git a/nixos/agares/dns.nix b/nixos/agares/dns.nix
deleted file mode 100644
index fe2843f..0000000
--- a/nixos/agares/dns.nix
+++ /dev/null
@@ -1,81 +0,0 @@
-{ ... }:
-{
- services.unbound = {
- enable = true;
- localControlSocketPath = "/run/unbound/unbound.ctl";
- settings = {
- server = {
- access-control = [
- "127.0.0.0/8 allow"
- "127.0.0.1/32 allow_snoop"
- "192.168.96.0/19 allow"
- "192.168.1.0/24 allow"
- "172.16.128.0/24 allow"
- "::1/128 allow_snoop"
- "fd42:9c3b:f96d::/48 allow"
- ];
- interface = [
- "127.0.0.1"
- "192.168.1.1"
- "192.168.100.1"
- "192.168.101.1"
- "192.168.102.1"
- "192.168.103.1"
- "192.168.120.1"
- "::1"
- "fd42:9c3b:f96d:100::1"
- "fd42:9c3b:f96d:101::1"
- "fd42:9c3b:f96d:102::1"
- "fd42:9c3b:f96d:103::1"
- "fd42:9c3b:f96d:120::1"
- ];
- prefer-ip6 = true;
- prefetch = true;
- prefetch-key = true;
- serve-expired = false;
- aggressive-nsec = true;
- hide-identity = true;
- hide-version = true;
- use-caps-for-id = true;
- val-permissive-mode = true;
- local-data = [
- "\"agares.bs.dadada.li. 10800 IN A 192.168.101.1\""
- "\"danjal.bs.dadada.li. 10800 IN A 192.168.100.108\""
- "\"legion.bs.dadada.li. 10800 IN A 192.168.100.107\""
- "\"ninurta.bs.dadada.li. 10800 IN A 192.168.101.184\""
- "\"agares.bs.dadada.li. 10800 IN AAAA fd42:9c3b:f96d:101::1\""
- "\"ninurta.bs.dadada.li. 10800 IN AAAA fd42:9c3b:f96d:101:4a21:bff:fe3e:9cfe\""
- "\"backup1.dadada.li. 10800 IN AAAA fd42:9c3b:f96d:101:4a21:bff:fe3e:9cfe\""
- ];
- local-zone = [
- "\"168.192.in-addr.arpa.\" nodefault"
- "\"d.f.ip6.arpa.\" nodefault"
- ];
- };
- forward-zone = [
- {
- name = ".";
- forward-tls-upstream = "yes";
- forward-addr = [
- "2620:fe::fe@853#dns.quad9.net"
- "2620:fe::9@853#dns.quad9.net"
- "9.9.9.9@853#dns.quad9.net"
- "149.112.112.112@853#dns.quad9.net"
- ];
- }
- ];
- stub-zone =
- let
- stubZone = name: addrs: {
- name = "${name}";
- stub-addr = addrs;
- };
- in
- [
- #(stubZone "li.dadada.bs" ["192.168.128.220" "2a01:4f8:c010:a710::1"])
- #(stubZone "d.6.9.f.b.3.c.9.2.4.d.f.ip6.arpa" ["192.168.101.220" "2a01:4f8:c010:a710::1"])
- #(stubZone "168.192.in-addr.arpa" ["192.168.128.220" "2a01:4f8:c010:a710::1"])
- ];
- };
- };
-}
diff --git a/nixos/agares/firewall.nix b/nixos/agares/firewall.nix
deleted file mode 100644
index 569259f..0000000
--- a/nixos/agares/firewall.nix
+++ /dev/null
@@ -1,13 +0,0 @@
-{ ... }:
-{
- networking = {
- useDHCP = false;
- nat.enable = false;
- firewall.enable = false;
- nftables = {
- enable = true;
- checkRuleset = true;
- ruleset = builtins.readFile ./rules.nft;
- };
- };
-}
diff --git a/nixos/agares/network.nix b/nixos/agares/network.nix
deleted file mode 100644
index 6d86d22..0000000
--- a/nixos/agares/network.nix
+++ /dev/null
@@ -1,323 +0,0 @@
-{ config, lib, ... }:
-let
- ulaPrefix = "fd42:9c3b:f96d"; # fd42:9c3b:f96d::/48
- ipv4Prefix = "192.168"; # 192.168.96.0/19
- domain = "bs.dadada.li";
-in
-{
- networking.useDHCP = false;
- systemd.network = {
- enable = true;
- links = {
- "10-persistent" = {
- matchConfig.OriginalName = [
- "enp1s0"
- "enp2s0"
- ]; # takes search domains from the [Network]
- linkConfig.MACAddressPolicy = "persistent";
- };
- };
- netdevs = {
- # QoS concentrator
- "ifb4ppp0" = {
- netdevConfig = {
- Kind = "ifb";
- Name = "ifb4ppp0";
- };
- };
- "20-lan" = {
- netdevConfig = {
- Kind = "vlan";
- Name = "lan.10";
- };
- vlanConfig = {
- Id = 10;
- };
- };
- "20-freifunk" = {
- netdevConfig = {
- Kind = "vlan";
- Name = "ff.11";
- };
- vlanConfig = {
- Id = 11;
- };
- };
- "20-roadw" = {
- netdevConfig = {
- Kind = "wireguard";
- Name = "roadw";
- };
- wireguardConfig = {
- PrivateKeyFile = config.age.secrets."wg-privkey-vpn-dadada-li".path;
- ListenPort = 51234;
- };
- wireguardPeers = [
- {
- wireguardPeerConfig =
- let
- peerAddresses = i: [
- "${ipv4Prefix}.120.${i}/32"
- "${ulaPrefix}:120::${i}/128"
- ];
- in
- {
- PublicKey = "0eWP1hzkyoXlrjPSOq+6Y1u8tnFH+SejBJs8f8lf+iU=";
- AllowedIPs = peerAddresses "3";
- };
- }
- ];
- };
- "20-wg0" = {
- netdevConfig = {
- Kind = "wireguard";
- Name = "wg0";
- };
- wireguardConfig = {
- PrivateKeyFile = config.age.secrets."wg-privkey-wg0".path;
- ListenPort = 51235;
- };
- wireguardPeers = lib.singleton {
- wireguardPeerConfig = {
- PublicKey = "Kw2HVRb1zeA7NAzBvI3UzmOj45VqM358EBuZWdlAUDE=";
- AllowedIPs = [
- "10.3.3.3/32"
- "fd42:9c3b:f96d:121::3/128"
- "fd42:9c3b:f96d:101:4a21:bff:fe3e:9cfe/128"
- ];
- };
- };
- };
- };
- networks =
- let
- subnet = name: subnetId: {
- matchConfig.Name = name;
- addresses = [
- { addressConfig.Address = "${ipv4Prefix}.${subnetId}.1/24"; }
- { addressConfig.Address = "${ulaPrefix}:${subnetId}::1/64"; }
- ];
- dhcpPrefixDelegationConfig = {
- SubnetId = "auto";
- };
- ipv6Prefixes = [
- {
- ipv6PrefixConfig.Prefix = "${ulaPrefix}:${subnetId}::/64";
- }
- ];
- dhcpServerConfig = {
- DNS = "_server_address";
- NTP = "_server_address";
- EmitDNS = true;
- EmitNTP = true;
- EmitRouter = true;
- PoolOffset = 100;
- PoolSize = 100;
- };
- ipv6SendRAConfig = {
- EmitDNS = true;
- DNS = "_link_local";
- EmitDomains = true; # takes search domains from the [Network]
- };
- linkConfig = {
- RequiredForOnline = false;
- };
- networkConfig = {
- Domains = domain;
- EmitLLDP = "yes";
- IPv6SendRA = true;
- IPv6AcceptRA = false;
- DHCPPrefixDelegation = true;
- DHCPServer = true;
- };
- extraConfig = ''
- [CAKE]
- OverheadBytes = 38
- Bandwidth = 1G
- RTT = lan
- '';
- };
- in
- {
- "10-mgmt" = lib.mkMerge [
- (subnet "enp1s0" "100")
- {
- networkConfig.VLAN = [
- "lan.10"
- "ff.11"
- ];
- dhcpServerStaticLeases = [
- {
- # legion
- dhcpServerStaticLeaseConfig = {
- Address = "192.168.100.107";
- MACAddress = "80:CC:9C:95:4A:60";
- };
- }
- {
- # danyal
- dhcpServerStaticLeaseConfig = {
- Address = "192.168.100.108";
- MACAddress = "c8:9e:43:a3:3d:7f";
- };
- }
- ];
- }
- ];
- "30-wg0" = {
- matchConfig.Name = "wg0";
- address = [
- "10.3.3.2/32"
- "fd42:9c3b:f96d:121::2/128"
- ];
- DHCP = "no";
- networkConfig.IPv6AcceptRA = false;
- linkConfig.RequiredForOnline = false;
- routes = [
- {
- routeConfig = {
- Destination = "10.3.3.1/24";
- };
- }
- {
- routeConfig = {
- Destination = "fd42:9c3b:f96d:121::1/64";
- };
- }
- ];
- };
- "30-lan" = subnet "lan.10" "101" // {
- dhcpServerStaticLeases = [
- {
- # ninurta
- dhcpServerStaticLeaseConfig = {
- Address = "192.168.101.184";
- MACAddress = "48:21:0B:3E:9C:FE";
- };
- }
- {
- # crocell
- dhcpServerStaticLeaseConfig = {
- Address = "192.168.101.122";
- MACAddress = "9C:C9:EB:4F:3F:0E";
- };
- }
- {
- # gorgon
- dhcpServerStaticLeaseConfig = {
- Address = "192.168.101.205";
- MACAddress = "8C:C6:81:6A:39:2F";
- };
- }
- ];
- };
-
- "30-ff" = subnet "ff.11" "102";
-
- "30-ifb4ppp0" = {
- name = "ifb4ppp0";
- extraConfig = ''
- [CAKE]
- OverheadBytes = 65
- Bandwidth = 100M
- FlowIsolationMode = triple
- RTT = internet
- '';
- linkConfig = {
- RequiredForOnline = false;
- };
- };
-
- "30-ppp0" = {
- name = "ppp*";
- linkConfig = {
- RequiredForOnline = "routable";
- };
- networkConfig = {
- KeepConfiguration = "static";
- DefaultRouteOnDevice = true;
- LinkLocalAddressing = "ipv6";
- DHCP = "ipv6";
- };
- extraConfig = ''
- [CAKE]
- OverheadBytes = 65
- Bandwidth = 40M
- FlowIsolationMode = triple
- NAT=true
- RTT = internet
-
- [DHCPv6]
- PrefixDelegationHint= ::/56
- UseAddress = false
- UseDelegatedPrefix = true
- WithoutRA = solicit
-
- [DHCPPrefixDelegation]
- UplinkInterface=:self
- '';
- ipv6SendRAConfig = {
- # Let networkd know that we would very much like to use DHCPv6
- # to obtain the "managed" information. Not sure why they can't
- # just take that from the upstream RAs.
- Managed = true;
- };
- };
- # Talk to modem for management
- "enp2s0" = {
- name = "enp2s0";
- linkConfig = {
- RequiredForOnline = false;
- };
- networkConfig = {
- Address = "192.168.1.254/24";
- EmitLLDP = "yes";
- };
- };
- "10-roadw" = {
- matchConfig.Name = "roadw";
- addresses = [
- { addressConfig.Address = "${ipv4Prefix}.120.1/24"; }
- { addressConfig.Address = "${ulaPrefix}:120::1/64"; }
- ];
- DHCP = "no";
- networkConfig.IPv6AcceptRA = false;
- linkConfig.RequiredForOnline = false;
- routes = [
- {
- routeConfig = {
- Destination = "${ipv4Prefix}.120.1/24";
- };
- }
- {
- routeConfig = {
- Destination = "${ulaPrefix}::120:1/64";
- };
- }
- ];
- };
- };
- };
-
- age.secrets."wg-privkey-vpn-dadada-li" = {
- file = "${config.dadada.secrets.path}/wg-privkey-vpn-dadada-li.age";
- owner = "systemd-network";
- };
-
- age.secrets."wg-privkey-wg0" = {
- file = "${config.dadada.secrets.path}/agares-wg0-key.age";
- owner = "systemd-network";
- };
-
- boot.kernel.sysctl = {
- # Enable forwarding for interface
- "net.ipv4.conf.all.forwarding" = "1";
- "net.ipv6.conf.all.forwarding" = "1";
- "net.ipv6.conf.all.accept_ra" = "0";
- "net.ipv6.conf.all.autoconf" = "0";
- # Set via systemd-networkd
- #"net.ipv6.conf.${intf}.use_tempaddr" = "0";
- };
-
- powerManagement.cpuFreqGovernor = lib.mkDefault "schedutil";
-}
diff --git a/nixos/agares/ntp.nix b/nixos/agares/ntp.nix
deleted file mode 100644
index c3ec49b..0000000
--- a/nixos/agares/ntp.nix
+++ /dev/null
@@ -1,12 +0,0 @@
-{ ... }:
-{
- services.chrony = {
- enable = true;
- extraConfig = ''
- allow 192.168.1
- allow 192.168.100
- allow 192.168.101
- allow 192.168.102
- '';
- };
-}
diff --git a/nixos/agares/ppp.nix b/nixos/agares/ppp.nix
deleted file mode 100644
index ffa5bc4..0000000
--- a/nixos/agares/ppp.nix
+++ /dev/null
@@ -1,68 +0,0 @@
-{
- pkgs,
- lib,
- config,
- ...
-}:
-let
- secretsPath = config.dadada.secrets.path;
-in
-{
- # PPPoE
- services.pppd = {
- enable = true;
- peers = {
- telekom = {
- enable = true;
- autostart = true;
- config = ''
- debug
-
- plugin pppoe.so enp2s0
-
- noauth
- hide-password
- call telekom-secret
-
- linkname ppp0
-
- persist
- maxfail 0
- holdoff 5
-
- noipdefault
- defaultroute
-
- lcp-echo-interval 15
- lcp-echo-failure 3
- '';
- };
- };
- };
-
- age.secrets."etc-ppp-telekom-secret" = {
- file = "${secretsPath}/etc-ppp-telekom-secret.age";
- owner = "root";
- mode = "700";
- path = "/etc/ppp/peers/telekom-secret";
- };
-
- age.secrets."etc-ppp-pap-secrets" = {
- # format: client server passphrase
- file = "${secretsPath}/etc-ppp-chap-secrets.age";
- owner = "root";
- mode = "700";
- path = "/etc/ppp/pap-secrets";
- };
-
- # Hook for QoS via Intermediate Functional Block
- environment.etc."ppp/ip-up" = {
- mode = "755";
- text = with lib; ''
- #!/usr/bin/env sh
- ${getBin pkgs.iproute2}/bin/tc qdisc del dev $1 ingress
- ${getBin pkgs.iproute2}/bin/tc qdisc add dev $1 handle ffff: ingress
- ${getBin pkgs.iproute2}/bin/tc filter add dev $1 parent ffff: matchall action mirred egress redirect dev ifb4ppp0
- '';
- };
-}
diff --git a/nixos/agares/rules.nft b/nixos/agares/rules.nft
deleted file mode 100644
index 4b41bea..0000000
--- a/nixos/agares/rules.nft
+++ /dev/null
@@ -1,136 +0,0 @@
-flush ruleset
-
-define IF_MGMT = "enp1s0"
-define IF_FF = "ff.11"
-define IF_LAN = "lan.10"
-define IF_WAN = "ppp0"
-
-# Modem uses this for internet uplink via our WAN
-define IF_MODEM = "enp2s0"
-
-define IF_ROADW = "roadw"
-
-table inet filter {
- # Will give "no such file or directory if hardware does not support flow offloading"
- # flowtable f {
- # hook ingress priority 0; devices = { enp1s0, enp2s0 }; flags offload;
- # }
-
- chain input_local {
- ip6 saddr != ::1/128 log prefix "Dropped IPv6 nonlocalhost packet on loopback:" drop
- accept comment "Accept traffic to loopback interface"
- }
-
- chain input_icmp_untrusted {
- # Allow ICMP echo
- ip protocol icmp icmp type { echo-request } limit rate 1000/second burst 5 packets accept comment "Accept echo request"
-
- # Allow some ICMPv6
- icmpv6 type { destination-unreachable, packet-too-big, time-exceeded, echo-request, echo-reply, parameter-problem, mld-listener-query, mld-listener-report, mld-listener-done, mld-listener-reduction, nd-router-solicit, nd-router-advert, nd-neighbor-solicit, nd-neighbor-advert, mld2-listener-report } limit rate 1000/second burst 5 packets accept comment "Allow some ICMPv6"
- }
-
- chain input_modem {
- jump input_icmp_untrusted
- }
-
- chain input_wan {
- # DHCPv6 client
- meta nfproto ipv6 udp sport 547 accept comment "Allow DHCPv6 client"
-
- jump input_icmp_untrusted
-
- udp dport 51234 accept comment "Wireguard roadwarriors"
- }
-
- chain input_lan {
- counter accept comment "Accept all traffic from LAN"
- }
-
- chain input_mgmt {
- counter accept comment "Accept all traffic from MGMT"
- }
-
- chain input_roadw {
- counter accept comment "Accept all traffic from roadwarriors"
- }
-
- chain input_ff {
- jump input_icmp_untrusted
-
- # DHCP
- meta nfproto ipv6 udp dport 547 accept comment "Allow DHCPv6 client"
-
- # Allow DNS and DHCP from Freifunk
- udp dport { 53, 67 } accept comment "Allow DNS and DHCP from Freifunk"
- }
-
- chain input_wg0 {
- tcp dport 4949 accept comment "Munin node"
- }
-
- chain input {
- type filter hook input priority filter; policy drop;
-
- ct state {established, related} counter accept comment "Accept packets from established and related connections"
- ct state invalid counter drop comment "Early drop of invalid packets"
-
- iifname vmap { lo : accept, $IF_WAN : jump input_wan, $IF_LAN : jump input_lan, $IF_FF : jump input_ff, $IF_ROADW : jump input_roadw, $IF_MODEM : jump input_modem, $IF_MGMT : jump input_mgmt, wg0 : jump input_wg0 }
- }
-
-# Only works if hardware flow offloading is available
-# chain offload {
-# type filter hook forward priority -100; policy accept;
-# ip protocol tcp flow add @f
-# counter packets 0 bytes 0
-# }
-
- chain forward {
- type filter hook forward priority filter; policy drop;
-
- # Accept connections tracked by destination NAT
- ct status dnat counter accept comment "Accept connections tracked by DNAT"
-
- # TCP options
- tcp flags syn tcp option maxseg size set rt mtu comment "Remove TCP maximum segment size and set a size based on route information"
-
- # ICMPv6
- icmpv6 type { destination-unreachable, packet-too-big, time-exceeded, echo-request, echo-reply, parameter-problem } limit rate 5/second counter accept comment "Forward up to five ICMP messages of allowed types per second"
- meta l4proto ipv6-icmp accept comment "Forward ICMP in IPv6"
-
- # mgmt <-> *
- iifname { $IF_LAN, $IF_ROADW } oifname $IF_MGMT counter reject comment "Reject traffic from LAN and roadwarrior to MGMT"
- iifname $IF_MGMT oifname { $IF_LAN, $IF_ROADW } counter reject comment "Reject traffic from MGMT to LAN and roadwarrior"
- # drop (instead of reject) everything else to MGMT
-
- # LAN, ROADW -> * (except mgmt)
- iifname { $IF_LAN, $IF_ROADW } counter accept comment "Allow all traffic forwarding from LAN and roadwarrior to all interfaces, except to mgmt"
-
- # FF -> WAN
- iifname { $IF_FF } oifname $IF_WAN counter accept comment "Allow all traffic forwarding from Freifunk and services to WAN"
-
- # { WAN } -> { FF, LAN, RW }
- iifname { $IF_WAN } oifname { $IF_FF, $IF_LAN, $IF_ROADW } ct state established,related counter accept comment "Allow established back from WAN"
- }
-
- chain output {
- type filter hook output priority 100; policy accept;
- }
-}
-
-table ip nat {
- chain prerouting {
- type nat hook prerouting priority dstnat; policy accept;
- }
-
- chain postrouting {
- type nat hook postrouting priority srcnat; policy accept;
- ip saddr { 192.168.96.0/19 } oifname { $IF_WAN } masquerade comment "Masquerade traffic from LANs"
- }
-}
-
-table arp filter {
- chain input {
- type filter hook input priority filter; policy drop;
- iifname { $IF_MGMT, $IF_LAN, $IF_FF, $IF_MODEM } limit rate 1/second burst 2 packets accept comment "Limit number of ARP messages from LAN, FF, MGMT, modem"
- }
-}
diff --git a/nixos/configurations.nix b/nixos/configurations.nix
index 95b894e..877c6a9 100644
--- a/nixos/configurations.nix
+++ b/nixos/configurations.nix
@@ -8,127 +8,84 @@
nixos-hardware,
nixos-generators,
nixpkgs,
- nixpkgs-small,
...
}@inputs:
let
- nixosSystem =
+ # create a new instance allowing some unfree packages
+ nixpkgsx86 = import nixpkgs {
+ system = "x86_64-linux";
+ config.allowUnfreePredicate =
+ pkg:
+ builtins.elem (nixpkgs.lib.getName pkg) [
+ "aspell-dict-en-science"
+ "brgenml1lpr"
+ "saleae-logic-2"
+ "spotify"
+ ];
+ };
+ nixosSystem = nixpkgs.lib.nixosSystem;
+ baseModule =
+ { lib, ... }:
{
- nixpkgs,
- system ? "x86_64-linux",
- extraModules ? [ ],
- }:
- nixpkgs.lib.nixosSystem {
- inherit system;
-
- modules = [
- {
- nixpkgs.overlays = nixpkgs.lib.attrValues self.overlays;
- }
+ _module.args.inputs = inputs;
+ imports = [
+ inputs.agenix.nixosModules.age
+ inputs.disko.nixosModules.disko
+ inputs.home-manager.nixosModules.home-manager
+ (
+ { pkgs, ... }:
+ {
+ dadada.homepage.package = homepage;
+ dadada.pkgs = inputs.self.packages.${pkgs.system};
+ dadada.inputs = inputs // {
+ dadada = inputs.self;
+ };
+ }
+ )
+ inputs.lanzaboote.nixosModules.lanzaboote
]
- ++ (nixpkgs.lib.attrValues self.nixosModules)
- ++ [ agenix.nixosModules.age ]
- ++ extraModules;
+ ++ (lib.attrValues inputs.self.nixosModules);
};
+ homeModule = ./modules/profiles/home.nix;
in
{
- stolas =
- let
- system = "x86_64-linux";
- in
- nixosSystem {
- inherit nixpkgs system;
+ stolas = nixosSystem {
+ modules = [
+ { nixpkgs.pkgs = nixpkgsx86; }
+ baseModule
+ nixos-hardware.nixosModules.framework-amd-ai-300-series
+ homeModule
+ ./stolas
+ ];
+ };
- extraModules = [
- lanzaboote.nixosModules.lanzaboote
- disko.nixosModules.disko
- {
- nixpkgs.overlays = nixpkgs.lib.attrValues self.overlays;
- dadada.pkgs = self.packages.${system};
- dadada.inputs = inputs // {
- dadada = self;
- };
- }
- nixos-hardware.nixosModules.framework-amd-ai-300-series
- home-manager.nixosModules.home-manager
- (
- { pkgs, ... }:
- {
- home-manager.useGlobalPkgs = true;
- home-manager.useUserPackages = true;
- home-manager.sharedModules = (nixpkgs.lib.attrValues self.hmModules) ++ [
- { dadada.home.helix.package = pkgs.helix; }
- ];
- home-manager.users.dadada = import ../home;
- }
- )
- ./stolas
- ];
- };
-
- gorgon =
- let
- system = "x86_64-linux";
- in
- nixosSystem {
- inherit nixpkgs system;
-
- extraModules = [
- {
- nixpkgs.overlays = nixpkgs.lib.attrValues self.overlays;
- dadada.pkgs = self.packages.${system};
- dadada.inputs = inputs // {
- dadada = self;
- };
- }
- nixos-hardware.nixosModules.lenovo-thinkpad-t14s-amd-gen1
- home-manager.nixosModules.home-manager
- (
- { pkgs, ... }:
- {
- home-manager.useGlobalPkgs = true;
- home-manager.useUserPackages = true;
- home-manager.sharedModules = (nixpkgs.lib.attrValues self.hmModules) ++ [
- { dadada.home.helix.package = pkgs.helix; }
- { manual.manpages.enable = false; }
- ];
- home-manager.users.dadada = import ../home;
- }
- )
- ./gorgon/configuration.nix
- ];
- };
+ gorgon = nixosSystem {
+ modules = [
+ { nixpkgs.pkgs = nixpkgsx86; }
+ baseModule
+ nixos-hardware.nixosModules.lenovo-thinkpad-t14s-amd-gen1
+ homeModule
+ ./gorgon/configuration.nix
+ ];
+ };
surgat = nixosSystem {
- nixpkgs = nixpkgs-small;
- system = "x86_64-linux";
- extraModules = [
- {
- dadada.homepage.package = homepage;
- }
- ./modules/profiles/server.nix
+ modules = [
+ { nixpkgs.pkgs = nixpkgsx86; }
+ baseModule
./surgat/configuration.nix
];
};
- agares = nixosSystem {
- nixpkgs = nixpkgs-small;
- extraModules = [
- ./agares/configuration.nix
- ];
- };
-
- installer =
- let
- nixpkgs = nixpkgs-small;
- in
- nixpkgs.lib.nixosSystem {
- system = "x86_64-linux";
- modules = [
- nixos-generators.nixosModules.install-iso
- self.nixosModules.admin
+ installer = nixosSystem {
+ modules = [
+ nixos-generators.nixosModules.install-iso
+ inputs.self.nixosModules.admin
+ (
+ { lib, ... }:
{
- isoImage.isoName = nixpkgs.lib.mkForce "dadada-nixos-installer.iso";
+ nixpkgs.pkgs = nixpkgs.legacyPackages."x86_64-linux";
+ isoImage.isoName = lib.mkForce "dadada-nixos-installer.iso";
networking.tempAddresses = "disabled";
dadada.admin.enable = true;
documentation.enable = true;
@@ -139,12 +96,14 @@ in
keyMap = "us";
};
}
- ];
- };
+ )
+ ];
+ };
ninurta = nixosSystem {
- nixpkgs = nixpkgs-small;
- extraModules = [
+ modules = [
+ { nixpkgs.pkgs = nixpkgsx86; }
+ baseModule
./ninurta/configuration.nix
];
};
diff --git a/nixos/gorgon/configuration.nix b/nixos/gorgon/configuration.nix
index 16f8130..69e7588 100644
--- a/nixos/gorgon/configuration.nix
+++ b/nixos/gorgon/configuration.nix
@@ -52,8 +52,6 @@ in
age.secrets."${config.networking.hostName}-backup-passphrase-gs".file =
"${secretsPath}/${config.networking.hostName}-backup-passphrase-gs.age";
- nixpkgs.config.android_sdk.accept_license = true;
-
programs.ssh.startAgent = true;
nix.extraOptions = ''
@@ -85,7 +83,7 @@ in
networking.hostName = "gorgon";
dadada = {
- steam.enable = true;
+ steam.enable = false;
yubikey.enable = true;
};
@@ -154,7 +152,6 @@ in
#];
environment.systemPackages = with pkgs; [
- android-studio
ghostscript
smartmontools
@@ -264,7 +261,7 @@ in
xdg.portal.wlr.enable = false;
hardware.bluetooth.enable = true;
- hardware.opengl = {
+ hardware.graphics = {
enable = true;
extraPackages = with pkgs; [
vaapiVdpau
diff --git a/nixos/modules/nixpkgs.nix b/nixos/modules/nixpkgs.nix
deleted file mode 100644
index 2c5849f..0000000
--- a/nixos/modules/nixpkgs.nix
+++ /dev/null
@@ -1,3 +0,0 @@
-{
- nixpkgs.config.allowUnfreePredicate = pkg: true;
-}
diff --git a/nixos/modules/profiles/cloud.nix b/nixos/modules/profiles/cloud.nix
index de57714..1ddbb1e 100644
--- a/nixos/modules/profiles/cloud.nix
+++ b/nixos/modules/profiles/cloud.nix
@@ -4,6 +4,10 @@ let
initrdHostKey = "${config.networking.hostName}-ssh_host_ed25519_key";
in
{
+ imports = [
+ ./server.nix
+ ];
+
boot.initrd.availableKernelModules = [ "virtio-pci" ];
boot.kernelParams = [
diff --git a/nixos/modules/profiles/home.nix b/nixos/modules/profiles/home.nix
new file mode 100644
index 0000000..a695e8b
--- /dev/null
+++ b/nixos/modules/profiles/home.nix
@@ -0,0 +1,7 @@
+{ pkgs, inputs, ... }:
+{
+ home-manager.useGlobalPkgs = true;
+ home-manager.useUserPackages = true;
+ home-manager.sharedModules = pkgs.lib.attrValues inputs.self.hmModules;
+ home-manager.users.dadada = inputs.self.hmConfigurations.dadada;
+}
diff --git a/nixos/modules/steam.nix b/nixos/modules/steam.nix
index b6b0846..e14add3 100644
--- a/nixos/modules/steam.nix
+++ b/nixos/modules/steam.nix
@@ -15,11 +15,8 @@ in
};
};
config = mkIf cfg.enable {
- nixpkgs.config.allowUnfree = true;
-
- hardware.opengl = {
+ hardware.graphics = {
enable = true;
- driSupport32Bit = true;
extraPackages32 = with pkgs.pkgsi686Linux; [ libva ];
};
diff --git a/nixos/modules/yubikey.nix b/nixos/modules/yubikey.nix
index 4be4492..47699e1 100644
--- a/nixos/modules/yubikey.nix
+++ b/nixos/modules/yubikey.nix
@@ -34,7 +34,7 @@ in
};
u2f = {
control = "sufficient";
- cue = true;
+ settings.cue = true;
};
};
diff --git a/nixos/ninurta/configuration.nix b/nixos/ninurta/configuration.nix
index 39bdca7..d4a7bb9 100644
--- a/nixos/ninurta/configuration.nix
+++ b/nixos/ninurta/configuration.nix
@@ -14,7 +14,6 @@ let
uwuPrivKey = "pruflas-wg0-key";
wgHydraPrivKey = "pruflas-wg-hydra-key";
uwuPresharedKey = "pruflas-wg0-preshared-key";
- hydraGitHubAuth = "hydra-github-authorization";
initrdSshKey = "/etc/ssh/ssh_initrd_ed25519_key";
softServePort = 23231;
in
@@ -154,34 +153,6 @@ in
mode = "400";
};
- age.secrets.${hydraGitHubAuth} = {
- file = "${secretsPath}/${hydraGitHubAuth}.age";
- mode = "440";
- owner = "hydra-www";
- group = "hydra";
- };
-
- services.hydra = {
- enable = false;
- package = pkgs.hydra;
- hydraURL = "https://hydra.dadada.li";
- notificationSender = "hydra@localhost";
- buildMachinesFiles = [ ];
- useSubstitutes = true;
- port = 3000;
- listenHost = "10.3.3.3";
- extraConfig = ''
- Include ${config.age.secrets."${hydraGitHubAuth}".path}
-
-
- jobs = nix-config:main.*
- inputs = nix-config
- excludeBuildFromContext = 1
- useShortContext = 1
-
- '';
- };
-
nix.buildMachines = [
{
hostName = "localhost";
@@ -299,14 +270,10 @@ in
linkConfig.RequiredForOnline = false;
routes = [
{
- routeConfig = {
- Destination = "10.3.3.1/24";
- };
+ Destination = "10.3.3.1/24";
}
{
- routeConfig = {
- Destination = "fd42:9c3b:f96d:121::1/64";
- };
+ Destination = "fd42:9c3b:f96d:121::1/64";
}
];
};
@@ -323,14 +290,10 @@ in
linkConfig.RequiredForOnline = false;
routes = [
{
- routeConfig = {
- Destination = "10.11.0.0/22";
- };
+ Destination = "10.11.0.0/22";
}
{
- routeConfig = {
- Destination = "fc00:1337:dead:beef::10.11.0.0/118";
- };
+ Destination = "fc00:1337:dead:beef::10.11.0.0/118";
}
];
};
@@ -370,25 +333,21 @@ in
};
wireguardPeers = [
{
- wireguardPeerConfig = {
- PublicKey = "KzL+PKlv4LktIqqTqC9Esw8dkSZN2qSn/vq76UHbOlY=";
- AllowedIPs = [
- "10.3.3.1/32"
- "fd42:9c3b:f96d:121::1/128"
- ];
- PersistentKeepalive = 25;
- Endpoint = "surgat.dadada.li:51235";
- };
+ PublicKey = "KzL+PKlv4LktIqqTqC9Esw8dkSZN2qSn/vq76UHbOlY=";
+ AllowedIPs = [
+ "10.3.3.1/32"
+ "fd42:9c3b:f96d:121::1/128"
+ ];
+ PersistentKeepalive = 25;
+ Endpoint = "surgat.dadada.li:51235";
}
{
- wireguardPeerConfig = {
- PublicKey = "INfv++4R+Kd2jdh/3CooM70ZeeoN6aeU6mo+T4C8gWU=";
- AllowedIPs = [
- "10.3.3.2/32"
- "fd42:9c3b:f96d:121::2/128"
- ];
- Endpoint = "192.168.101.1:51235";
- };
+ PublicKey = "INfv++4R+Kd2jdh/3CooM70ZeeoN6aeU6mo+T4C8gWU=";
+ AllowedIPs = [
+ "10.3.3.2/32"
+ "fd42:9c3b:f96d:121::2/128"
+ ];
+ Endpoint = "192.168.101.1:51235";
}
];
};
@@ -402,17 +361,15 @@ in
};
wireguardPeers = [
{
- wireguardPeerConfig = {
- PublicKey = "tuoiOWqgHz/lrgTcLjX+xIhvxh9jDH6gmDw2ZMvX5T8=";
- AllowedIPs = [
- "10.11.0.0/22"
- "fc00:1337:dead:beef::10.11.0.0/118"
- "192.168.178.0/23"
- ];
- PersistentKeepalive = 25;
- PresharedKeyFile = config.age.secrets.${uwuPresharedKey}.path;
- Endpoint = "53c70r.de:51820";
- };
+ PublicKey = "tuoiOWqgHz/lrgTcLjX+xIhvxh9jDH6gmDw2ZMvX5T8=";
+ AllowedIPs = [
+ "10.11.0.0/22"
+ "fc00:1337:dead:beef::10.11.0.0/118"
+ "192.168.178.0/23"
+ ];
+ PersistentKeepalive = 25;
+ PresharedKeyFile = config.age.secrets.${uwuPresharedKey}.path;
+ Endpoint = "53c70r.de:51820";
}
];
};
@@ -472,7 +429,7 @@ in
})
];
- hardware.pulseaudio.enable = false;
+ services.pulseaudio.enable = false;
environment.systemPackages = with pkgs; [
smartmontools
diff --git a/nixos/stolas/default.nix b/nixos/stolas/default.nix
index 696f55f..1c5cc9b 100644
--- a/nixos/stolas/default.nix
+++ b/nixos/stolas/default.nix
@@ -12,18 +12,20 @@
./paperless.nix
];
- nixpkgs = {
- hostPlatform = "x86_64-linux";
- config.allowUnfree = true;
- };
-
boot = {
lanzaboote = {
enable = true;
pkiBundle = "/var/lib/sbctl";
};
kernelModules = [ "kvm-amd" ];
- extraModulePackages = [ pkgs.linuxPackages.v4l2loopback ];
+ # Hopefully fixes suspend issues with wifi card
+ kernelPackages = pkgs.linuxPackages_latest;
+ kernelParams = [
+ "resume=UUID=81dfbfa5-d578-479c-b11c-3ee5abd6848a"
+ "resume_offset=79859524"
+ "zswap.enabled=1"
+ ];
+ extraModulePackages = [ config.boot.kernelPackages.v4l2loopback ];
# Lanzaboote currently replaces the systemd-boot module.
# This setting is usually set to true in configuration.nix
# generated at installation time. So we force it to false
@@ -51,7 +53,7 @@
# NOTE: hardware.framework.enableKmod requires kernel patching, but enables access to some EC features
bluetooth.enable = true;
cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
- enableAllFirmware = true;
+ enableRedistributableFirmware = true;
framework.laptop13.audioEnhancement.enable = true;
graphics = {
enable = true;
@@ -65,10 +67,6 @@
powerManagement = {
enable = true;
cpuFreqGovernor = "schedutil";
- # TODO: Limit charge of battery, does this work without kernel patches from hardware.frameworkenableKmod?
- powerUpCommands = ''
- echo 80 > /sys/class/power_supply/BAT0/charge_control_stop_threshold
- '';
};
networking = {
@@ -174,10 +172,6 @@
"dbus-org.freedesktop.ModemManager1".enable = lib.mkForce false;
};
- systemd.sleep.extraConfig = ''
- HibernateDelaySec=1h
- '';
-
systemd.tmpfiles.rules = [
"v /var/.snapshots 0755 root root - -"
"v /var/paperless/.snapshots 0755 root root - -"
@@ -205,20 +199,7 @@
"wireshark"
"paperless"
];
- shell = "/run/current-system/sw/bin/zsh";
};
};
};
-
- # TODO
- # age.secrets = {
- # paperless = {
- # file = "${config.dadada.secrets.path}/paperless.age";
- # mode = "700";
- # owner = "paperless";
- # };
- # };
-
- # Create compressing swap space in RAM
- zramSwap.enable = true;
}
diff --git a/nixos/stolas/disks.nix b/nixos/stolas/disks.nix
index 01cf635..eff5680 100644
--- a/nixos/stolas/disks.nix
+++ b/nixos/stolas/disks.nix
@@ -86,7 +86,7 @@
};
"/swap" = {
mountpoint = "/.swapvol";
- swap.swapfile.size = "64G";
+ swap.swapfile.size = "128G";
};
};
};
diff --git a/nixos/surgat/configuration.nix b/nixos/surgat/configuration.nix
index 5cd9596..5ddef7f 100644
--- a/nixos/surgat/configuration.nix
+++ b/nixos/surgat/configuration.nix
@@ -74,12 +74,10 @@ in
"2a01:4f8:c17:1d70::/64"
];
routes = [
- { routeConfig.Gateway = "fe80::1"; }
+ { Gateway = "fe80::1"; }
{
- routeConfig = {
- Gateway = "172.31.1.1";
- GatewayOnLink = true;
- };
+ Gateway = "172.31.1.1";
+ GatewayOnLink = true;
}
];
linkConfig.RequiredForOnline = "routable";
@@ -95,19 +93,13 @@ in
linkConfig.RequiredForOnline = "no";
routes = [
{
- routeConfig = {
- Destination = "10.3.3.3/24";
- };
+ Destination = "10.3.3.3/24";
}
{
- routeConfig = {
- Destination = "fd42:9c3b:f96d:121::/64";
- };
+ Destination = "fd42:9c3b:f96d:121::/64";
}
{
- routeConfig = {
- Destination = "fd42:9c3b:f96d:101::/64";
- };
+ Destination = "fd42:9c3b:f96d:101::/64";
}
];
};
@@ -124,14 +116,12 @@ in
};
wireguardPeers = [
{
- wireguardPeerConfig = {
- PublicKey = "Kw2HVRb1zeA7NAzBvI3UzmOj45VqM358EBuZWdlAUDE=";
- AllowedIPs = [
- "10.3.3.3/32"
- "fd42:9c3b:f96d:121::3/128"
- "fd42:9c3b:f96d:101:4a21:bff:fe3e:9cfe/128"
- ];
- };
+ PublicKey = "Kw2HVRb1zeA7NAzBvI3UzmOj45VqM358EBuZWdlAUDE=";
+ AllowedIPs = [
+ "10.3.3.3/32"
+ "fd42:9c3b:f96d:121::3/128"
+ "fd42:9c3b:f96d:101:4a21:bff:fe3e:9cfe/128"
+ ];
}
];
};
diff --git a/outputs.nix b/outputs.nix
index c860d3c..ef7a742 100644
--- a/outputs.nix
+++ b/outputs.nix
@@ -1,4 +1,3 @@
-# Adapted from Mic92/dotfiles
{
self,
flake-utils,
@@ -11,7 +10,7 @@
(flake-utils.lib.eachDefaultSystem (
system:
let
- pkgs = import nixpkgs { inherit system; };
+ pkgs = nixpkgs.legacyPackages.${system};
treefmtEval = treefmt-nix.lib.evalModule pkgs ./treefmt.nix;
in
{
@@ -28,23 +27,22 @@
in
import ./devshell.nix { inherit pkgs extraModules; };
+ checks = {
+ formatting = treefmtEval.config.build.check self;
+ };
+
formatter = treefmtEval.config.build.wrapper;
packages = import ./pkgs { inherit pkgs; } // {
- installer-iso = self.nixosConfigurations.installer.config.system.build.isoImage;
+ installer-iso = inputs.self.nixosConfigurations.installer.config.system.build.isoImage;
};
}
))
// {
hmModules = import ./home/modules.nix { lib = nixpkgs.lib; };
-
+ hmConfigurations = {
+ dadada = import ./home;
+ };
nixosConfigurations = import ./nixos/configurations.nix inputs;
-
nixosModules = import ./nixos/modules { lib = nixpkgs.lib; };
-
- overlays = import ./overlays.nix;
-
- hydraJobs = import ./hydra-jobs.nix inputs;
-
- checks = import ./checks.nix inputs;
}
diff --git a/overlays.nix b/overlays.nix
deleted file mode 100644
index ffcd441..0000000
--- a/overlays.nix
+++ /dev/null
@@ -1 +0,0 @@
-{ }
diff --git a/secrets/secrets.nix b/secrets/secrets.nix
index f449646..50dd263 100644
--- a/secrets/secrets.nix
+++ b/secrets/secrets.nix
@@ -1,7 +1,6 @@
let
dadada = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIN+bBJptw2H35vMPV7Mfj9oaepR7cHCQH8ZsvL8qnj+r dadada (nix-config-secrets) ";
systems = {
- agares = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPcbuLtU9/VhFy5VAp/ZI0T+gr7kExG73hmjjvno10gP root@nixos";
gorgon = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDCcwG8BkqjZJ1bPdFbLYfXeBgaI10+gyVs1r1aNJ49H root@gorgon";
ifrit = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEYO4L5EvKRtVUB6YHtHN7R980fwH9kKVt0V3kj6rORS root@nixos";
ninurta = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO8TDCzjVVO7A4k6rp+srMj0HHc5gmUOlskTBOvhMkEc root@nixos";
@@ -63,24 +62,16 @@ in
dadada
];
"ddns-credentials.age".publicKeys = [
- systems.agares
systems.ninurta
dadada
];
"etc-ppp-chap-secrets.age".publicKeys = [
- systems.agares
dadada
];
"etc-ppp-telekom-secret.age".publicKeys = [
- systems.agares
dadada
];
"wg-privkey-vpn-dadada-li.age".publicKeys = [
- systems.agares
- dadada
- ];
- "agares-wg0-key.age".publicKeys = [
- systems.agares
dadada
];
}
@@ -89,5 +80,4 @@ in
// backupSecrets "ifrit"
// backupSecrets "pruflas"
// backupSecrets "surgat"
-// backupSecrets "agares"
// backupSecrets "stolas"