From 8c4e9f6641ca1ddeacd8b6fa75b0934fdb3f0f03 Mon Sep 17 00:00:00 2001 From: Crony Akatsuki Date: Wed, 7 May 2025 16:41:42 +0200 Subject: [PATCH] feat(servers): add baldur, the immortal --- flake.nix | 20 +++++++++++ hosts/baldur/configuration.nix | 27 +++++++++++++++ hosts/baldur/disk-config.nix | 54 +++++++++++++++++++++++++++++ hosts/nixos/configuration.nix | 3 ++ modules/servers/baldur/default.nix | 1 + secrets/secrets.nix | 3 +- secrets/traefik.age | Bin 609 -> 719 bytes secrets/wg-desktop.age | Bin 785 -> 895 bytes secrets/wg-heimdall.age | Bin 986 -> 1096 bytes 9 files changed, 107 insertions(+), 1 deletion(-) create mode 100644 hosts/baldur/configuration.nix create mode 100644 hosts/baldur/disk-config.nix create mode 100644 modules/servers/baldur/default.nix diff --git a/flake.nix b/flake.nix index 94e40f8..8ef310a 100644 --- a/flake.nix +++ b/flake.nix @@ -105,6 +105,15 @@ path = deploy-rs.lib.x86_64-linux.activate.nixos self.nixosConfigurations.loki; }; }; + + baldur = { + hostname = "baldur"; + profiles.system = { + sshUser = "root"; + user = "root"; + path = deploy-rs.lib.aarch64-linux.activate.nixos self.nixosConfigurations.baldur; + }; + }; }; nixOnDroidConfigurations.default = nix-on-droid.lib.nixOnDroidConfiguration { @@ -141,6 +150,17 @@ ]; }; + baldur = nixpkgs.lib.nixosSystem { + system = "aarch64-linux"; + modules = [ + disko.nixosModules.disko + agenix.nixosModules.default + ./hosts/baldur/configuration.nix + ./modules/servers/general + ./modules/servers/baldur + ]; + }; + nixos = nixpkgs.lib.nixosSystem { specialArgs = {inherit inputs;}; modules = [ diff --git a/hosts/baldur/configuration.nix b/hosts/baldur/configuration.nix new file mode 100644 index 0000000..c89c1a3 --- /dev/null +++ b/hosts/baldur/configuration.nix @@ -0,0 +1,27 @@ +{ + modulesPath, + lib, + pkgs, + ... +}: { + imports = [ + (modulesPath + "/installer/scan/not-detected.nix") + (modulesPath + "/profiles/qemu-guest.nix") + ./disk-config.nix + ]; + + networking.hostName = "baldur"; + + boot.loader.grub = { + efiSupport = true; + efiInstallAsRemovable = true; + }; + + environment.systemPackages = map lib.lowPrio [ + pkgs.curl + pkgs.neovim + pkgs.gitMinimal + ]; + + system.stateVersion = "24.05"; +} diff --git a/hosts/baldur/disk-config.nix b/hosts/baldur/disk-config.nix new file mode 100644 index 0000000..8f36ed4 --- /dev/null +++ b/hosts/baldur/disk-config.nix @@ -0,0 +1,54 @@ +{lib, ...}: { + disko.devices = { + disk.disk1 = { + device = lib.mkDefault "/dev/sda"; + type = "disk"; + content = { + type = "gpt"; + partitions = { + boot = { + name = "boot"; + size = "1M"; + type = "EF02"; + }; + esp = { + name = "ESP"; + size = "500M"; + type = "EF00"; + content = { + type = "filesystem"; + format = "vfat"; + mountpoint = "/boot"; + }; + }; + root = { + name = "root"; + size = "100%"; + content = { + type = "lvm_pv"; + vg = "pool"; + }; + }; + }; + }; + }; + lvm_vg = { + pool = { + type = "lvm_vg"; + lvs = { + root = { + size = "100%FREE"; + content = { + type = "filesystem"; + format = "ext4"; + mountpoint = "/"; + mountOptions = [ + "defaults" + ]; + }; + }; + }; + }; + }; + }; +} diff --git a/hosts/nixos/configuration.nix b/hosts/nixos/configuration.nix index 9aeaa29..f93b0c5 100644 --- a/hosts/nixos/configuration.nix +++ b/hosts/nixos/configuration.nix @@ -25,6 +25,9 @@ # Enable flakes nix.settings.experimental-features = ["nix-command" "flakes"]; + # Enable trusted users + nix.trustedUsers = ["root" "@wheel"]; + # Setup gpu hardware.graphics = { enable = true; diff --git a/modules/servers/baldur/default.nix b/modules/servers/baldur/default.nix new file mode 100644 index 0000000..6462967 --- /dev/null +++ b/modules/servers/baldur/default.nix @@ -0,0 +1 @@ +{...}: {} diff --git a/secrets/secrets.nix b/secrets/secrets.nix index 16ceaf6..c7811ad 100644 --- a/secrets/secrets.nix +++ b/secrets/secrets.nix @@ -2,6 +2,7 @@ let # SYSTEMS heimdall = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBs+qYjpeAEHPFUQeatNkhKbXz8+A1VAl21jgifDYJK8"; loki = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIF+xpWCoBEO/pzAwS1ZZEsiLSarvSVkdxQEo49xma2PV"; + baldur = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOvZ7Z8GS4+1+9D6u/BDit4Eij5Ubbii2dzJ/+ecT8iR"; # USERS root = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBJLduAXHWJiglmfRfkBGKffzVWkJP6porxIzw6+Zz3W crony@cronyakatsuki.xyz"; @@ -9,7 +10,7 @@ let users = [ root ]; - systems = [heimdall loki]; + systems = [heimdall loki baldur]; in { "traefik.age".publicKeys = systems ++ users; "wg-heimdall.age".publicKeys = systems ++ users; diff --git a/secrets/traefik.age b/secrets/traefik.age index adffe366b9e0f790fa434d951fb1fa86b23e5b8b..92a86c264a6f683bab578abc24392bf546f7fbb5 100644 GIT binary patch delta 667 zcmaFJa-Ma9PJNb-iI28nL3pH7Zk|zyd65(4U`FZ}%Ret&9<|Vn_{#jL~WfqQ!C4R-m zfn46E`nlQp#`y-8kyZJ5LEg^kL8T_9#yQEp`AH#VW)=ZXCGL6YE&-MiffGN9*H`*w znwl9#dZi@inff?}gr!Bfm>U`xS7v%-1s0o^`}k)Ccv=`bTl%<}aOH&=I^|d8msO_Z z2d27JWF{JTMrG*-8JgtyI93EjMR)`n8G96E`V{JybLr~pDijz6m=@+4ITjjMmKB#r zm^v932O639g@jdjWq1ag7p6J7*5?|RB~^N)mUB(XSBu%+mZ!H^N7QuVm2%B?%Jqr{Ro?dKP{^xeIy?2P}ugvc1Xb57d(AFt_}{bX96NX$=V zHcN{#!yc8O*9>zlQWk{;P3c%|vD%qS|I>VnRg?LQ@8*7SnqH!^QZYj-e|wwob1kvF41Z(uEDIC;vzFPqBM`###SbHRrhs{yp>Wnf`n_ w?T)J99aZtLaYide(fon){db)+Lmv2~JiHS#QhGV*sMX-lip+!c9kG^l9 zE0=3lR!~8Cu4$2K}u?-qkCw1VPR2DnTe5qcABAKsY{BfbD2}* zWyo#y{k6`Bvf1|7{vr2)T3GLTXSkBhT z7%jH?XWslPsQGl6{l27F=GNWhJc7_CHXssikWX@W~F(OPeo)zN?>-dc7~U$e}R91n{h~}ms!4LR%t{; zGFPd)W2#GXK}J?ygl|Q0q+?E+VS%4Zs+U22XhgPaRHX=PDJkx68fdzM*HNxf%rW>#@XL7B6AiK#`pUx=A^ zV!A=1MW#nSSA}+!d1`WbL0X1EUQnrFnqz3Lvwn(Gj%8I^si#kPhO0@EXJ(d@pSy(x zx^+4F{x0E;3QqaKuI7drUWx7%S?N_?UWOiN!DYD~8P3j$K1t!GK8C@j#-XW&p;1mo z>0FM5k+}gOCMHQ{o-SUdi2-S4i9R95g+cCK*`{V0mA;ip0jY+exjyby#S=e@*BiJO zMw*qS7#D?Wo4EVt7#1a&B&X+A6sCsz2Sg<6M^!~e8M_x|x|_KfaQQ@O=Q+DrWI9I_ zmPF<{78qN)Te_I#HmNVl#CRg6Ci?xiMtFI@jr2Xc8>wK>h-nR9( zmjy-|&X~rh{pnTqDT&zo7p*Toep0ot)-nZCkW*wS;+4&@U#43%z z*|whXAt9e6zH*$jsaoTp`&!ELtgheQXBOKR%~1Mm`svS1)kX_@ncogVW|_-2g?|fo zx+@#nnU=iIcKyMH{Mj9oy-GT^Dk+<3wFTRsSD1WZNep#fM zhmmn;u~~3AmzREJd5&Xnsk5a=dWCz1pJS@ItGB*sL7qiuaAv57Z>F(!o@J%Bv1_pF z0E|7@3}$ddGkN8lpZWuE>H*>TwQq62|diKSj z%&}Gd1eexDKV7LkjzP2PU9WfltyVnAa3^C@ur+VTf`a)M@1|@nF5RO#bHjm{Z~rUL zRDQYo|4jXK{v2kr&w8G_HFmz^Z(bIgyCU(->HL%16-|=jU!Ki8U3jau)u+|P+kT3k z;IltU2VP$Z3Ya{5O~oqn)3RTb&ad|HT7KH=+@FM%!Yb|O#p-6pl^#1V%}n3%<*_VpE^ySI0&UUz$eR`1t8KF-G_-Z!qwduSD;UG5^$>1*bG jJ5S6QN0X;y)Sfs2Kauc2{Nl3!+GvSoy~hjVH{WlmmBWl(02x4)lXj%8Rf zx^+4F{x0E;3jUF4Ci(`E9_E$)A!TMpS^g23&S|beS=mVyRi+*;r4~M>7AYYX=I&8$ z23$FYrD5(7K^7)%rD;)NC0Q<>#z`K9W!_~zVJ;DFDZ%>A5xxdRfw}4Wo)bTc*LxO* zxTKkzSXKpE8b?HgT0|D58$@K9hDT(%8@V|7`a~HOgq39by9S1Ma;0l0Wd|Ag<`+bo z>gN{bSOkYgnWU8Fr6v0%n;HaGWTYf|R#rM@gq8<;a_Q>oDmeLN8C9AYc~qtr`5Oj@ zIu=G4Ryuq6SsHpKmj^m}ggZwW))!V-7MD0>T5xUh=HBpcKG&wmoLMK^xpyi~6}eXH zS|fYR(C$Ozlg#FS|5(E!&%OK?tGBwo*7lHK2G9JJVL73SyV@1x|F-6=OSE?SP$3=n zCojDJB&VH7;QkqfQzj=qJj)?H>&v~Zm)PDK<~P~j(fIpKQ^fA!weKg`6cz_hI95^5 z$u;+NMN9gB(UZ>~D`zCdt-WZIDfoYZ!=7@}kCzMAR9ZwY-fxm^RPc3W`R@jX(l?73 zwYPBoR^PTsElNqN#X)dZ>wm^t6Y;Z`ls-l|&$j4KHgxe^$NzMiA(NBM;(Nj?{Z6hC z{Jrer*SGH#O&;lG`<+kypre#>3je~Viiw;w{HbVScB!BB zWmZ#n)%5g5EgXqb zW0oA6pAl*25Px<~->;>Dx`B^f>|1B^|0t<{?R+iM;;ZG;FpKalizmou>M=jH4bzx= z|KpJh$9A5sckcY;apz@|^j_xVNXlA{u7*#}tq-1L1oTzKz(v-@JFs>Sv5nbS?ylUKt{RZ5c+`Lus6+NsL! z*xYue_o~XdiRZKrL~(D_5n_rur`>l-Civy~X+6PbCh_i5f|Fw|e^& e9busqOT+gj!S-~BbTn7LUD11 zZfc5=si~o*f|+(kU_qclqHlgdNqTmso4c`ox@)FquA8ZcUtoE*QEEj-g+XLcVpVRU zMObE)nWeEKmv^>vlyQoOzq7GxgoTTCM6g9@d7^%#Ym%>Do?AhAiBptsetCsuq=~7) zA~`sxv9>=uNk|(Jmh|4s%|7sefPT^9R%IR|y+f(4YW9gAU&`P29-pKT;E{YVOu2Vi zSL_>!KixGiDwf-eY<{~T@$Am8*8677m7BMJ(Sd?jpU=#g7q?&wlcd1A#vavMj&?G< z4$l@uMt110jW=G9Y~(ewx?-Zk`U|g?pD(zo$6vh8O`=+K9xG3M<;lq>Z%+}IRAHU? z!CC6tS*F6*U8R|#r`gQ6{|x_c=h_v?#Gc-NWYM{45*yrSx8FY_#pS)s-azZ3h--F} z#Q#5r_EYA|X!#qfrAjTH%l)^hY}0ayh1;g{&DXQt`HshT)2E3yFYkVO!`fbm>0?4( z5X%eczXvr#N)O$a3Y~wir=nhJDpz8X>BovHfvXi^ruFYqOKke$zCtgoL*#7bXU&p&A(IG)QQ{9AafBUI><6M2)sVBXwPAx8q{gccR{>AOZ zhX!krEeC{uC%I{HmMEXR^dU*!;6mc@iAtVtyjHJ0`rK|q-7{atYpXZ>dh$c>*;(C6 pubILZ?Ad%4K40_2w)H^RG~=@