char/flake

nixos flake

git clone https://git.t4t.associates/char/flake

Charlotte Somlazuli: bump ssh keys85eec1d

main
branchesmainall refs →
3.9 KiB143 linesraw
1{
2  hostName,
3  ipAddress,
4  tapId,
5  mac,
6}:
7{ pkgs, lib, ... }:
8let
9  workspace = "/x/vm/${hostName}";
10in
11{
12  networking.hostName = hostName;
13  time.timeZone = "Europe/London";
14  system.stateVersion = "26.05";
15
16  # GC of the shared lower store creates persistent overlayfs whiteouts.
17  nix.gc.automatic = lib.mkForce false;
18
19  microvm = {
20    hypervisor = "qemu";
21    vcpu = 4;
22    mem = 8192;
23    interfaces = [ { type = "tap"; id = tapId; inherit mac; } ];
24    writableStoreOverlay = "/nix/.rw-store";
25    # whole-disk persistent root; sparse image under /var/lib/microvms/<hostName>/
26    volumes = [ {
27      image = "root.img";
28      mountPoint = "/";
29      size = 81920;
30      label = "${hostName}-root";
31    } ];
32    shares = [
33      {
34        proto = "virtiofs";
35        tag = "ro-store";
36        source = "/nix/store";
37        mountPoint = "/nix/.ro-store";
38      }
39      {
40        proto = "virtiofs";
41        tag = "ssh-keys";
42        source = "/var/lib/microvms/${hostName}/ssh-host-keys";
43        mountPoint = "/etc/ssh/host-keys";
44      }
45      {
46        proto = "virtiofs";
47        tag = "user-ssh-keys";
48        source = "/var/lib/microvms/${hostName}/ssh-user-keys";
49        mountPoint = "/etc/ssh/user-keys";
50      }
51      # tailscaled state must persist or the node re-registers on every boot
52      {
53        proto = "virtiofs";
54        tag = "tailscale-state";
55        source = "/var/lib/microvms/${hostName}/tailscale";
56        mountPoint = "/var/lib/tailscale";
57      }
58      {
59        proto = "virtiofs";
60        tag = "pi-agent";
61        source = "/home/charlotte/.pi/agent";
62        mountPoint = "/home/charlotte/.pi/agent";
63      }
64      # ~/.pi/agent/extensions symlinks into here
65      {
66        proto = "virtiofs";
67        tag = "personal-dotfiles";
68        source = "/home/charlotte/.personal-dotfiles";
69        mountPoint = "/home/charlotte/.personal-dotfiles";
70      }
71      {
72        proto = "virtiofs";
73        tag = "nixos-system";
74        source = "/home/charlotte/.nixos-system";
75        mountPoint = "/home/charlotte/.nixos-system";
76      }
77      {
78        proto = "virtiofs";
79        tag = "workspace";
80        source = workspace;
81        mountPoint = "/x";
82      }
83    ];
84  };
85
86  boot.loader.systemd-boot.enable = lib.mkForce false;
87  boot.loader.efi.canTouchEfiVariables = lib.mkForce false;
88
89  networking.useNetworkd = true;
90  networking.useDHCP = false;
91  networking.firewall.enable = false;
92
93  systemd.network.enable = true;
94  systemd.network.wait-online.enable = lib.mkForce true;
95  systemd.network.networks."20-lan" = {
96    matchConfig.Type = "ether";
97    address = [ "${ipAddress}/16" ];
98    networkConfig.Gateway = "10.11.0.1";
99    networkConfig.DNS = [ "10.11.0.1" ];
100    networkConfig.IPv6AcceptRA = true;
101  };
102
103  services.openssh.hostKeys = [
104    {
105      path = "/etc/ssh/host-keys/ssh_host_ed25519_key";
106      type = "ed25519";
107    }
108  ];
109
110  users.users.charlotte = {
111    isNormalUser = true;
112    # virtiofs passes uids through raw; must match the host user
113    uid = 1000;
114    description = "charlotte";
115    extraGroups = [ "wheel" ];
116    shell = pkgs.zsh;
117    openssh.authorizedKeys.keyFiles = [
118      (pkgs.fetchurl {
119        url = "https://char.lt/ssh.txt";
120        hash = "sha256-5rwSdpfUJIB9KlQp2Xw6m02/0uc9TUV0/zBgrg0nCik=";
121      })
122    ];
123  };
124
125  systemd.services.persist-user-ssh-key = {
126    description = "Provision charlotte's persistent ssh key";
127    wantedBy = [ "multi-user.target" ];
128    serviceConfig = {
129      Type = "oneshot";
130      RemainAfterExit = true;
131    };
132    path = [ pkgs.openssh ];
133    script = ''
134      install -d -m 0700 -o charlotte -g users /home/charlotte/.ssh
135      if [ ! -f /etc/ssh/user-keys/id_ed25519 ]; then
136        ssh-keygen -t ed25519 -N "" -C "charlotte@${hostName}" -f /etc/ssh/user-keys/id_ed25519
137      fi
138      chown charlotte:users /etc/ssh/user-keys/id_ed25519{,.pub}
139      chmod 600 /etc/ssh/user-keys/id_ed25519
140      ln -sf /etc/ssh/user-keys/id_ed25519{,.pub} /home/charlotte/.ssh/
141    '';
142  };
143}