dev/nixfiles
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity

Functioning installation

Browse Source
This commit is contained in:
Jack O'Sullivan
2022-02-19 22:55:53 +00:00
parent ac0d2bc001
commit 7537cf4205
11 changed files with 487 additions and 60 deletions
Download Patch File Download Diff File Expand all files Collapse all files

71
nixos/modules/common.nix
View File

@@ -1,23 +1,31 @@
{ lib, pkgs, pkgs', inputs, options, config, ... }:
let
inherit (builtins) attrValues;
inherit (lib) flatten optional mkIf mkDefault mkMerge mkAliasDefinitions;
inherit (lib.my) mkOpt' mkBoolOpt' dummyOption;
defaultUsername = "dev";
uname = config.my.user.name;
inherit (lib) flatten optional mkIf mkDefault mkMerge mkOption mkAliasDefinitions;
inherit (lib.my) mkOpt' mkBoolOpt' dummyOption mkDefault';
in
{
options = with lib.types; {
my = {
# Pretty hacky but too lazy to figure out if there's a better way to alias the options
user = mkOpt' (attrsOf anything) { } "User definition (as `users.users.*`).";
homeConfig = mkOpt' anything { } "Home configuration (as `home-manager.users.*`)";
# TODO: Move to separate module
user = {
enable = mkBoolOpt' true "Whether to create a primary user.";
config = mkOption {
type = options.users.users.type.nestedTypes.elemType;
default = { };
description = "User definition (as `users.users.*`).";
};
homeConfig = mkOption {
type = options.home-manager.users.type.nestedTypes.elemType;
default = { };
# Prevent docs traversing into all of home-manager
visible = "shallow";
description = "Home configuration (as `home-manager.users.*`)";
};
};
ssh = {
# If enabled, we can't set `authorized_keys` from home-manager because SSH won't like the file being owned by
# root.
strictModes = mkBoolOpt' false
strictModes = mkBoolOpt' true
("Specifies whether sshd(8) should check file modes and ownership of the user's files and home directory "+
"before accepting login.");
};
@@ -28,17 +36,37 @@ in
};
config = mkMerge [
(let
cfg = config.my.user;
user' = cfg.config;
in mkIf cfg.enable
{
my = {
user = {
name = mkDefault defaultUsername;
isNormalUser = true;
uid = mkDefault 1000;
extraGroups = mkDefault [ "wheel" ];
password = mkDefault "hunter2"; # TODO: secrets...
config = {
name = mkDefault' "dev";
isNormalUser = true;
uid = mkDefault 1000;
extraGroups = mkDefault [ "wheel" ];
password = mkDefault "hunter2"; # TODO: secrets...
openssh.authorizedKeys.keyFiles = [ lib.my.authorizedKeys ];
};
# In order for this option to evaluate on its own, home-manager expects the `name` (which is derived from the
# parent attr name) to be the users name, aka `home-manager.users.<name>`
homeConfig = { _module.args.name = lib.mkForce user'.name; };
};
deploy.authorizedKeys = mkDefault user'.openssh.authorizedKeys;
};
# mkAliasDefinitions will copy the unmerged defintions to allow the upstream submodule to deal with
users.users.${user'.name} = mkAliasDefinitions options.my.user.config;
# NOTE: As the "outermost" module is still being evaluated in NixOS land, special params (e.g. pkgs) won't be
# passed to it
home-manager.users.${user'.name} = mkAliasDefinitions options.my.user.homeConfig;
})
{
home-manager = {
# Installs packages in the system config instead of in the local profile on activation
useUserPackages = mkDefault true;
@@ -46,13 +74,8 @@ in
users = {
mutableUsers = false;
users.${uname} = mkAliasDefinitions options.my.user;
};
# NOTE: As the "outermost" module is still being evaluated in NixOS land, special params (e.g. pkgs) won't be
# passed to it
home-manager.users.${uname} = config.my.homeConfig;
security = {
sudo.enable = mkDefault false;
doas = {
@@ -63,6 +86,8 @@ in
nix = {
package = pkgs'.unstable.nixVersions.stable;
# TODO: This has been renamed to nix.settings.trusted-users in 22.05
trustedUsers = [ "@wheel" ];
extraOptions =
''
experimental-features = nix-command flakes ca-derivations
@@ -70,6 +95,7 @@ in
};
nixpkgs = {
overlays = [
inputs.deploy-rs.overlay
# TODO: Wait for https://github.com/NixOS/nixpkgs/pull/159074 to arrive to nixos-unstable
(final: prev: { remarshal = pkgs'.master.remarshal; })
];
@@ -109,6 +135,7 @@ in
};
networking = {
domain = mkDefault "int.nul.ie";
useDHCP = mkDefault false;
enableIPv6 = mkDefault true;
};
@@ -137,6 +164,8 @@ in
openssh = {
enable = mkDefault true;
extraConfig = ''StrictModes ${if config.my.ssh.strictModes then "yes" else "no"}'';
permitRootLogin = mkDefault "no";
passwordAuthentication = mkDefault false;
};
};

66
nixos/modules/deploy-rs.nix Normal file
View File

@@ -0,0 +1,66 @@
{ lib, extendModules, pkgs, options, config, baseModules, ... }:
let
inherit (builtins) head;
inherit (lib) mkOption mkMerge mkIf mkDefault;
inherit (lib.my) mkOpt' mkBoolOpt';
cfg = config.my.deploy;
in
{
options.my.deploy = with lib.types; rec {
authorizedKeys = {
keys = mkOpt' (listOf singleLineStr) [ ] "SSH public keys to add to the default deployment user.";
keyFiles = mkOpt' (listOf str) [ ] "SSH public key files to add to the default deployment user.";
};
enable = mkBoolOpt' true "Whether to expose deploy-rs configuration for this system.";
node = mkOpt' lib.my.deploy-rs.node { } "deploy-rs node configuration.";
generate = {
system.enable = mkBoolOpt' true "Whether to generate a deploy-rs profile for this system's config.";
};
rendered = mkOption {
type = nullOr (attrsOf anything);
default = null;
internal = true;
description = "Rendered deploy-rs node configuration.";
};
};
config = mkMerge [
{
my.deploy = {
enable = mkIf config.my.build.isDevVM false;
node = {
hostname = mkDefault config.networking.fqdn;
profiles = {
system = mkIf cfg.generate.system.enable {
path = pkgs.deploy-rs.lib.activate.nixos { inherit config; };
user = "root";
};
};
sshUser = "deploy";
user = mkDefault "root";
sudo = mkDefault (if config.security.doas.enable then "doas -u" else "sudo -u");
sshOpts = mkDefault [ "-p" (toString (head config.services.openssh.ports)) ];
};
rendered = mkIf cfg.enable (lib.my.deploy-rs.filterOpts cfg.node);
};
}
(mkIf cfg.enable {
users = {
users."${cfg.node.sshUser}" = {
isSystemUser = true;
group = cfg.node.sshUser;
extraGroups = mkDefault [ "wheel" ];
shell = pkgs.bash;
openssh.authorizedKeys = cfg.authorizedKeys;
};
groups."${cfg.node.sshUser}" = {};
};
})
];
}

9
nixos/modules/server.nix
View File

@@ -1,19 +1,20 @@
{ config, lib, ... }:
let
inherit (lib) mkIf;
inherit (lib) mkIf mkDefault;
inherit (lib.my) mkBoolOpt';
cfg = config.my.server;
uname = if config.my.user.enable then config.my.user.config.name else "root";
in
{
options.my.server.enable = mkBoolOpt' false "Whether to enable common configuration for servers.";
config = mkIf cfg.enable {
services = {
getty.autologinUser = config.my.user.name;
kmscon.autologinUser = config.my.user.name;
getty.autologinUser = mkDefault uname;
kmscon.autologinUser = mkDefault uname;
};
my.homeConfig = {
my.user.homeConfig = {
my.gui.enable = false;
};
};

7
nixos/modules/tmproot.nix
View File

@@ -50,7 +50,8 @@ let
rootDef = {
device = "yeet";
fsType = "tmpfs";
options = [ "size=${cfg.size}" ];
# The default mode for tmpfs is 777
options = [ "size=${cfg.size}" "mode=755" ];
};
in
{
@@ -98,6 +99,10 @@ in
# Specifies obsolete files that should be deleted on activation - we'll never have those!
"/etc/.clean"
# These are set in environment.etc by the sshd module, but because their mode needs to be changed,
# setup-etc will copy them instead of symlinking
"/etc/ssh/authorized_keys.d"
];
environment.systemPackages = [