Updated vm-minecraft

Reviewed-on: Jan/dotfiles#2

README.md

@@ -4,8 +4,39 @@ My NixOS configuration.
 
 ## Installation
 
-For disk configuration we use disko, this means that installing the system from the configuration is just a single command:
+For disk configuration we use disko, but for secrets management we use sops-nix and the particular setup makes the installation process a bit more involved. It is required that the computer from which the installation is being run has access to the `nixos-secrets` repository, otherwise you will need to manually add the required ssh keys to the installation image. 
+```bash
+# Load into the installer
+sudo passwd # Set a root password
 
+# From a machine with network access to the installer
+# and access to the nixos-secrets repo
+ssh -A root@(installer-ip)
+
+# Set up disks
+nix-shell -p disko
+disko --mode disko --flake git+https://git.bulthuis.dev/Jan/nixos-config#(system)
+exit
+
+# Install NixOS
+nixos-install --no-channel-copy --no-root-password --flake git+https://git.bulthuis.dev/Jan/nixos-config#(system)
+
+# Set up host credentials for access to the secrets
+cd /mnt/persist/system/etc/sops
+touch sops_ed25519_key 
+chmod 600 sops_ed25519_key
+nano sops_ed25519_key
 ```
-sudo nix --experimental-features "nix-command flakes" run "github:nix-community/disko/latest#disko-install" -- --flake git+https://git.bulthuis.dev/Jan/dotfiles#<hostname> --disk main /dev/sda
-```
+If `nixos-install` is being stopped by the OOM-killer, you can try adding `-j 1` to limit the amount of jobs that will be executed at the same time to 1. It might require running nixos-install multiple times untill it has managed to download all requirements and slowly start building the rest of the system.
+
+## Updating
+
+To update the system configuration, it is a single command:
+```bash
+sudo system-update
+```
+Or if this shell script has not been installed for some reason:
+```bash
+sudo nixos-rebuild switch --flake git+https://git.bulthuis.dev/Jan/nixos-config
+```
+Sometimes it may be necessary to reboot of course.

flake.lock

@@ -7,11 +7,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1748225455,
-        "narHash": "sha256-AzlJCKaM4wbEyEpV3I/PUq5mHnib2ryEy32c+qfj6xk=",
+        "lastModified": 1750040002,
+        "narHash": "sha256-KrC9iOVYIn6ukpVlHbqSA4hYCZ6oDyJKrcLqv4c5v84=",
         "owner": "nix-community",
         "repo": "disko",
-        "rev": "a894f2811e1ee8d10c50560551e50d6ab3c392ba",
+        "rev": "7f1857b31522062a6a00f88cbccf86b43acceed1",
         "type": "github"
       },
       "original": {
@@ -23,11 +23,11 @@
     "flake-compat": {
       "flake": false,
       "locked": {
-        "lastModified": 1733328505,
-        "narHash": "sha256-NeCCThCEP3eCl2l/+27kNNK7QrwZB1IJCrXfrbv5oqU=",
+        "lastModified": 1747046372,
+        "narHash": "sha256-CIVLLkVgvHYbgI2UpXvIIBJ12HWgX+fjA8Xf8PUmqCY=",
         "owner": "edolstra",
         "repo": "flake-compat",
-        "rev": "ff81ac966bb2cae68946d5ed5fc4994f96d0ffec",
+        "rev": "9100a0f413b0c601e0533d1d94ffd501ce2e7885",
         "type": "github"
       },
       "original": {
@@ -61,11 +61,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1748134483,
-        "narHash": "sha256-5PBK1nV8X39K3qUj8B477Aa2RdbLq3m7wRxUKRtggX4=",
+        "lastModified": 1750107071,
+        "narHash": "sha256-yfuHCO4m+gu3OBNGnP0/TL5W8nLXrC/EV1fs/+YcoL8=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "c1e671036224089937e111e32ea899f59181c383",
+        "rev": "0edffd088e42fdc48598b37d88eb5345e2ca3937",
         "type": "github"
       },
       "original": {
@@ -98,11 +98,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1747581338,
-        "narHash": "sha256-/+H9qce+NPsEcAC31s3pbD64nB6GKC3+3ZNLV1+tffk=",
+        "lastModified": 1751650156,
+        "narHash": "sha256-1gIPVDf159TQlcVg3WQBHMZVn8RllHOa8eT7AJPj2IE=",
         "owner": "Jan-Bulthuis",
         "repo": "nix-minecraft",
-        "rev": "44b6b40d7a3e0a114567b38a203029a5bc67e838",
+        "rev": "d3b3779fd78bd55db24d25e896438b2b51cbb6cb",
         "type": "github"
       },
       "original": {
@@ -133,11 +133,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1747958103,
-        "narHash": "sha256-qmmFCrfBwSHoWw7cVK4Aj+fns+c54EBP8cGqp/yK410=",
+        "lastModified": 1749903597,
+        "narHash": "sha256-jp0D4vzBcRKwNZwfY4BcWHemLGUs4JrS3X9w5k/JYDA=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "fe51d34885f7b5e3e7b59572796e1bcb427eccb1",
+        "rev": "41da1e3ea8e23e094e5e3eeb1e6b830468a7399e",
         "type": "github"
       },
       "original": {
@@ -154,7 +154,44 @@
         "impermanence": "impermanence",
         "nix-minecraft": "nix-minecraft",
         "nix-modpack": "nix-modpack",
-        "nixpkgs": "nixpkgs"
+        "nixpkgs": "nixpkgs",
+        "secrets": "secrets",
+        "sops-nix": "sops-nix"
+      }
+    },
+    "secrets": {
+      "locked": {
+        "lastModified": 1750361251,
+        "narHash": "sha256-yfK2ArCYImg5vIfWP8f2O9+TF18K0dGOVqjheI23zuo=",
+        "ref": "refs/heads/main",
+        "rev": "498db9fadb1810dd2c3e5d130b655ff7632f9640",
+        "revCount": 14,
+        "type": "git",
+        "url": "ssh://gitea@git.bulthuis.dev/Jan/nixos-secrets"
+      },
+      "original": {
+        "type": "git",
+        "url": "ssh://gitea@git.bulthuis.dev/Jan/nixos-secrets"
+      }
+    },
+    "sops-nix": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1749592509,
+        "narHash": "sha256-VunQzfZFA+Y6x3wYi2UE4DEQ8qKoAZZCnZPUlSoqC+A=",
+        "owner": "Mic92",
+        "repo": "sops-nix",
+        "rev": "50754dfaa0e24e313c626900d44ef431f3210138",
+        "type": "github"
+      },
+      "original": {
+        "owner": "Mic92",
+        "repo": "sops-nix",
+        "type": "github"
       }
     },
     "systems": {

flake.nix

@@ -6,6 +6,13 @@
     nixpkgs.url = "github:nixos/nixpkgs/nixpkgs-unstable";
     home-manager.url = "github:nix-community/home-manager";
     home-manager.inputs.nixpkgs.follows = "nixpkgs";
+
+    # Secrets
+    sops-nix.url = "github:Mic92/sops-nix";
+    sops-nix.inputs.nixpkgs.follows = "nixpkgs";
+    secrets.url = "git+ssh://gitea@git.bulthuis.dev/Jan/nixos-secrets";
+
+    # Disk setup
     disko.url = "github:nix-community/disko";
     disko.inputs.nixpkgs.follows = "nixpkgs";
     impermanence.url = "github:nix-community/impermanence";

hosts/20212060/configuration.nix

@@ -1,4 +1,4 @@
-{ flake, ... }:
+{ inputs, ... }:
 
 {
   # State version
@@ -13,6 +13,17 @@
     "wireshark"
   ];
 
+  # Set up kerberos
+  security.krb5 = {
+    enable = true;
+    settings = {
+      libdefaults = {
+        rdns = false;
+      };
+      realms = (inputs.secrets.gewis.krb5Realm);
+    };
+  };
+
   # Enable virtualisation for VMs
   virtualisation.libvirtd.enable = true;
 

hosts/vm-audio/users/local.nix

@@ -1,7 +0,0 @@
-{ ... }:
-
-{
-  home.stateVersion = "24.11";
-
-  modules.profiles.base.enable = true;
-}

hosts/vm-minecraft/configuration.nix

@@ -25,14 +25,25 @@
 
   # Set up minecraft servers
   users.users.local.extraGroups = [ "minecraft" ];
+  modules.impermanence.directories = [
+    "/srv/minecraft"
+  ];
   services.minecraft-servers = {
     enable = true;
     eula = true;
     openFirewall = true;
     servers = {
-      modpack = {
+      vanilla = {
         enable = true;
         autoStart = true;
+        serverProperties = {
+          white-list = true;
+        };
+        package = inputs.nix-minecraft.legacyPackages.${pkgs.system}.vanillaServers.vanilla-1_21_7;
+      };
+      modpack = {
+        enable = false;
+        autoStart = true;
         serverProperties = { };
         package = inputs.nix-modpack.packages.${pkgs.system}.mkModpackServer {
           packUrl = "https://raw.githubusercontent.com/Jan-Bulthuis/Modpack/refs/heads/master/pack.toml";

hosts/vm-minecraft/users/local.nix

@@ -1,7 +0,0 @@
-{ ... }:
-
-{
-  home.stateVersion = "24.11";
-
-  modules.profiles.base.enable = true;
-}

hosts/vm-oddjob/configuration.nix

@@ -0,0 +1,91 @@
+{
+  inputs,
+  lib,
+  pkgs,
+  config,
+  ...
+}:
+
+{
+  # State version
+  system.stateVersion = "24.11";
+
+  # Machine hostname
+  networking.hostName = "vm-oddjob";
+
+  # Enabled modules
+  modules = {
+    profiles.vm.enable = true;
+  };
+
+  # Setup NAS backups
+  environment.systemPackages = with pkgs; [
+    keyutils
+  ];
+  environment.etc."request-key.d/cifs.spnego.conf".text = ''
+    create cifs.spnego * * ${pkgs.cifs-utils}/bin/cifs.upcall -t %k
+  '';
+  environment.etc."request-key.d/cifs.idmap.conf".text = ''
+    create cifs.idmap * * ${pkgs.cifs-utils}/bin/cifs.idmap %k
+  '';
+  sops.secrets."smb-credentials" = {
+    sopsFile = "${inputs.secrets}/secrets/vm-oddjob.enc.yaml";
+  };
+  sops.secrets."backup-script-env" = {
+    sopsFile = "${inputs.secrets}/secrets/vm-oddjob.enc.yaml";
+  };
+  services.cron = {
+    enable = true;
+    systemCronJobs =
+      let
+        script = pkgs.writeShellScript "backup-script" (
+          lib.concatStrings (
+            [
+              ''
+                . ${config.sops.secrets."backup-script-env".path}
+                export PBS_REPOSITORY=$PBS_REPOSITORY
+                export PBS_NAMESPACE=$PBS_NAMESPACE
+                export PBS_PASSWORD=$PBS_PASSWORD
+                export PBS_FINGERPRINT=$PBS_FINGERPRINT
+              ''
+            ]
+            ++ lib.map (share: ''
+              systemctl start mnt-${share}.mount
+              ${pkgs.util-linux}/bin/prlimit --nofile=1024:1024 ${pkgs.proxmox-backup-client}/bin/proxmox-backup-client backup nfs.pxar:/mnt/${share} --ns $PBS_NAMESPACE --backup-id share-${share} --change-detection-mode=metadata --exclude "#recycle"
+              systemctl stop mnt-${share}.mount
+            '') inputs.secrets.lab.nas.backupShares
+          )
+        );
+      in
+      [
+        "0 0 * * * root ${script}"
+      ];
+  };
+
+  # Mount filesystems
+  systemd.services.krb5-mnt-credentials = {
+    description = "Set up Kerberos credentials for mounting shares";
+    before = map (share: "mnt-${share}.mount") inputs.secrets.lab.nas.backupShares;
+    requiredBy = map (share: "mnt-${share}.mount") inputs.secrets.lab.nas.backupShares;
+    after = [ "network-online.target" ];
+    requires = [ "network-online.target" ];
+    serviceConfig.Type = "oneshot";
+    script = ''
+      . ${config.sops.secrets."smb-credentials".path}
+      echo $password | ${pkgs.krb5}/bin/kinit $username
+    '';
+  };
+  fileSystems = lib.listToAttrs (
+    lib.map (share: {
+      name = "/mnt/${share}";
+      value = {
+        device = "//${inputs.secrets.lab.nas.host}/${share}";
+        fsType = "cifs";
+        options = [
+          "noauto"
+          "sec=krb5,credentials=${config.sops.secrets."smb-credentials".path}"
+        ];
+      };
+    }) inputs.secrets.lab.nas.backupShares
+  );
+}

hosts/vm-test/configuration.nix

@@ -0,0 +1,19 @@
+{
+  lib,
+  pkgs,
+  config,
+  ...
+}:
+
+{
+  # State version
+  system.stateVersion = "24.11";
+
+  # Machine hostname
+  networking.hostName = "vm-test";
+
+  # Enabled modules
+  modules = {
+    profiles.vm.enable = true;
+  };
+}

hosts/vm-vpn/users/local.nix

@@ -1,7 +0,0 @@
-{ ... }:
-
-{
-  home.stateVersion = "24.11";
-
-  modules.profiles.base.enable = true;
-}

modules/home/utilities/bitwarden.nix

@@ -0,0 +1,22 @@
+{
+  lib,
+  config,
+  pkgs,
+  ...
+}:
+
+with lib;
+let
+  cfg = config.modules.bitwarden;
+in
+{
+  options.modules.bitwarden = {
+    enable = mkEnableOption "Bitwarden";
+  };
+
+  config = mkIf cfg.enable {
+    home.packages = with pkgs; [
+      bitwarden-desktop
+    ];
+  };
+}

modules/home/utilities/secrets.nix

@@ -0,0 +1,43 @@
+{
+  inputs,
+  lib,
+  config,
+  ...
+}:
+
+with lib;
+let
+  cfg = config.modules.secrets;
+  secrets = inputs.secrets;
+in
+{
+  options.modules.secrets = {
+    enable = mkEnableOption "secrets";
+    defaultFile = mkOption {
+      type = types.str;
+      default = "${secrets}/secrets/common.enc.yaml";
+      description = ''
+        The default file to use for SOPS.
+      '';
+    };
+    secrets = mkOption {
+      type = types.attrs;
+      default = { };
+      description = ''
+        All secrets that should be made available.
+      '';
+    };
+  };
+
+  config = mkIf cfg.enable {
+    # Set up SOPS
+    # TODO: Fix the key not being present in .config/sops before sops-nix runs
+    sops.defaultSopsFile = cfg.defaultFile;
+    sops.age.sshKeyPaths = [
+      "${config.home.homeDirectory}/.config/sops/sops_ed25519_key"
+      # "/persist/home/${config.home.username}/.config/sops/sops_ed25519_key"
+    ];
+    sops.secrets = cfg.secrets;
+    modules.impermanence.directories = [ ".config/sops" ];
+  };
+}

modules/nixos/bootloader.nix

@@ -16,5 +16,8 @@ in
       systemd-boot.editor = false;
       efi.canTouchEfiVariables = true;
     };
+
+    # Initrd
+    boot.initrd.systemd.enable = true;
   };
 }

modules/nixos/disko.nix

@@ -20,5 +20,7 @@ in
     };
   };
 
-  config = mkIf cfg.enable { disko.devices = profile.disko.devices; };
+  config = mkIf cfg.enable {
+    disko.devices = profile.disko.devices;
+  };
 }

modules/nixos/domain.nix

@@ -0,0 +1,212 @@
+{
+  inputs,
+  lib,
+  pkgs,
+  config,
+  ...
+}:
+
+with lib;
+let
+  cfg = config.modules.domain;
+  domain = inputs.secrets.lab.domain;
+  domainUpper = lib.strings.toUpper domain;
+in
+{
+  options.modules.domain = {
+    enable = mkEnableOption "Domain Integration";
+    join = {
+      userFile = mkOption {
+        type = types.str;
+        description = "File containing the user used to join the computer.";
+      };
+      passwordFile = mkOption {
+        type = types.str;
+        description = "File containing the password for the join user.";
+      };
+      domainOUFile = mkOption {
+        type = types.str;
+        description = "The OU to join the computer to.";
+      };
+    };
+  };
+
+  config = mkIf cfg.enable {
+    # Set network domain
+    networking.domain = domain;
+    networking.search = [ domain ];
+
+    # Automatically join the domain
+    systemd.services.adcli-join = {
+      description = "Automatically join the domain";
+      wantedBy = [ "default.target" ];
+      before = [ "sssd.service" ];
+      requiredBy = [ "sssd.service" ];
+      after = [
+        "network-online.target"
+      ];
+      requires = [
+        "network-online.target"
+      ];
+      serviceConfig = {
+        Type = "oneshot";
+      };
+      script = ''
+        ADCLI_JOIN_USER=$(cat ${cfg.join.userFile})
+        ADCLI_JOIN_OU=$(cat ${cfg.join.domainOUFile})
+        ${pkgs.adcli}/bin/adcli join -D ${domain} \
+          -U $ADCLI_JOIN_USER \
+          -O $ADCLI_JOIN_OU \
+          --dont-expire-password=true \
+          --stdin-password < ${cfg.join.passwordFile}
+      '';
+    };
+
+    # Set up Kerberos
+    security.krb5 = {
+      enable = true;
+      settings = {
+        libdefaults = {
+          default_realm = domainUpper;
+        };
+        realms.${domainUpper} = {
+        };
+        domain_realm = {
+          "${domain}" = domainUpper;
+          ".${domain}" = domainUpper;
+        };
+      };
+    };
+
+    # Set up SSSD
+    services.sssd = {
+      enable = true;
+      config = ''
+        [sssd]
+        domains = ${domain}
+        config_file_version = 2
+        services = nss, pam
+
+        [nss]
+        filter_users = ${concatStringsSep "," (lib.attrNames config.users.users)}
+        filter_groups = ${concatStringsSep "," (lib.attrNames config.users.groups)}
+
+        [domain/${domain}]
+        enumerate = False
+        ad_domain = ${domain}
+        krb5_realm = ${domainUpper}H
+        id_provider = ad
+        auth_provider = ad
+        access_provider = ad
+        chpass_provider = ad
+        use_fully_qualified_names = False
+        ldap_schema = ad
+        ldap_id_mapping = True
+        ad_gpo_access_control = enforcing
+        ad_gpo_implicit_deny = True
+        dyndns_update = True
+        dyndns_update_ptr = False
+        dyndns_refresh_interval = 86400
+        dyndns_ttl = 3600
+      '';
+    };
+    security.pam.services.login.sssdStrictAccess = true;
+    security.pam.services.sshd.sssdStrictAccess = true;
+    security.pam.services.su.sssdStrictAccess = true;
+
+    # Set up Sudo
+    security.sudo =
+      let
+        admin_group = "host_${lib.replaceStrings [ "-" ] [ "_" ] config.networking.hostName}_admin";
+      in
+      {
+        extraConfig = ''
+          %${admin_group} ALL=(ALL) SETENV: ALL
+        '';
+      };
+
+    # Set up SSH
+    services.openssh = {
+      package = pkgs.opensshWithKerberos;
+      settings = {
+        GSSAPIAuthentication = true;
+        GSSAPICleanupCredentials = true;
+        GSSAPIStrictAcceptorCheck = true;
+      };
+    };
+
+    # Set up home directory
+    security.pam.services.login.makeHomeDir = true;
+    security.pam.services.sshd.makeHomeDir = true;
+    security.pam.services.su.makeHomeDir = true;
+    environment.etc.profile.text =
+      let
+        # TODO: Activate configuration based on AD group
+        homeConfiguration = inputs.home-manager.lib.homeManagerConfiguration {
+          inherit pkgs;
+          modules = [
+            (
+              { lib, ... }:
+              {
+                home.stateVersion = "24.11";
+                home.username = "$USER";
+                home.homeDirectory = "/.$HOME";
+                modules.profiles.base.enable = true;
+
+                # Mount the directories from the network share
+                home.activation.dirMount =
+                  let
+                    bindScript = dir: ''
+                      mkdir -p /network/$USER/${dir}
+                      mkdir -p $HOME/${dir}
+                      ${pkgs.bindfs}/bin/bindfs /network/$USER/${dir} $HOME/${dir}
+                    '';
+                  in
+                  lib.hm.dag.entryAfter [ "writeBoundary" ] ''
+                    if ! ${pkgs.krb5}/bin/klist -s; then
+                      echo "No kerberos ticket found"
+                      ${pkgs.krb5}/bin/kinit
+                    fi
+
+                    if ${pkgs.krb5}/bin/klist -s; then
+                      echo "Kerberos ticket found, mounting home directory"
+                      ${bindScript "Documents"}
+                      ${bindScript "Music"}
+                      ${bindScript "Pictures"}
+                      ${bindScript "Video"}
+                    else
+                      echo "Still no kerberos ticket found, skipping home directory mount"
+                    fi
+                  '';
+              }
+            )
+          ] ++ config.home-manager.sharedModules;
+        };
+      in
+      mkAfter ''
+        # Activate Home Manager configuration for domain users
+        if id | egrep -o 'groups=.*' | sed 's/,/\n/g' | cut -d'(' -f2 | sed 's/)//' | egrep -o "^domain users$"; then
+          echo "Setting up environment for domain user"
+          SKIP_SANITY_CHECKS=1 ${homeConfiguration.activationPackage}/activate
+          if test -f "$HOME/.bashrc"; then
+            . $HOME/.bashrc
+          fi
+        fi
+      '';
+
+    # Automatically mount home share
+    # Can be accessed at /network/$USER
+    services.autofs = {
+      enable = true;
+      autoMaster =
+        let
+          networkMap = pkgs.writeText "auto" ''
+            * -fstype=cifs,sec=krb5,user=&,uid=$UID,gid=$GID,cruid=$UID ://${inputs.secrets.lab.nas.host}/home
+          '';
+        in
+        ''
+          /network ${networkMap} --timeout=30
+        '';
+    };
+  };
+}

modules/nixos/gnome.nix

@@ -17,10 +17,9 @@ in
 
   config = mkIf cfg.enable {
     # Enable GDM and Gnome
-    services.xserver.enable = true;
-    services.xserver.displayManager.gdm.enable = true;
-    services.xserver.desktopManager.gnome.enable = true;
-    services.gnome.core-utilities.enable = false;
+    services.displayManager.gdm.enable = true;
+    services.desktopManager.gnome.enable = true;
+    services.gnome.core-apps.enable = false;
     services.gnome.games.enable = false;
     services.gnome.core-developer-tools.enable = false;
     environment.gnome.excludePackages = with pkgs; [

modules/nixos/impermanence.nix

@@ -24,18 +24,32 @@ in
     resetScript = mkOption {
       type = types.lines;
       description = ''
-        Script to run on boot that resets the root partition.
+        Script to run in order to reset the system to a clean state.
       '';
     };
   };
 
   config = mkIf cfg.enable {
+    # Filesystem setup
     fileSystems."/persist".neededForBoot = true;
-    boot.initrd.postResumeCommands = mkAfter cfg.resetScript;
+    # boot.initrd.postResumeCommands = mkAfter cfg.resetScript;
+    # TODO: Reduce dependency on the root filesystem being ZFS?
+    boot.initrd.systemd.services.impermanence-rollback = {
+      description = "Rollback filesystem to clean state.";
+      wantedBy = [ "initrd.target" ];
+      after = [ "zfs-import.target" ];
+      before = [ "sysroot.mount" ];
+      unitConfig.DefaultDependencies = "no";
+      serviceConfig.Type = "oneshot";
+      script = cfg.resetScript;
+    };
 
     # For home-manager persistence
     programs.fuse.userAllowOther = true;
 
+    # For testing purposes with VM
+    virtualisation.vmVariantWithDisko.virtualisation.fileSystems."/persist".neededForBoot = true;
+
     environment.persistence."/persist/system" = {
       enable = true;
       hideMounts = true;

modules/nixos/networkmanager.nix

@@ -11,5 +11,7 @@ in
   config = mkIf cfg.enable {
     # TODO: Add sudo users to the networkmanager group?
     networking.networkmanager.enable = true;
+
+    networking.firewall.checkReversePath = false;
   };
 }

modules/nixos/secrets.nix

@@ -0,0 +1,44 @@
+{
+  inputs,
+  lib,
+  config,
+  ...
+}:
+
+with lib;
+let
+  cfg = config.modules.secrets;
+  secrets = inputs.secrets;
+in
+{
+  options.modules.secrets = {
+    enable = mkEnableOption "secrets";
+    defaultFile = mkOption {
+      type = types.str;
+      default = "${secrets}/secrets/common.enc.yaml";
+      description = ''
+        The default file to use for SOPS.
+      '';
+    };
+    secrets = mkOption {
+      type = types.attrs;
+      default = { };
+      description = ''
+        All secrets that should be made available.
+      '';
+    };
+  };
+
+  config = mkIf cfg.enable {
+    # Set up SOPS
+    # TODO: Fix the key not being present in /etc/sops before sops-nix runs
+    sops.defaultSopsFile = cfg.defaultFile;
+    sops.age.sshKeyPaths = [
+      "/etc/sops/sops_ed25519_key"
+      "/persist/system/etc/sops/sops_ed25519_key"
+    ];
+    sops.secrets = cfg.secrets;
+    modules.impermanence.directories = [ "/etc/sops" ];
+    virtualisation.vmVariantWithDisko.sops.age.sshKeyPaths = [ "/tmp/shared/sops_ed25519_key" ];
+  };
+}

modules/nixos/ssh.nix

@@ -9,7 +9,24 @@ in
     enable = mkEnableOption "ssh";
   };
   config = mkIf cfg.enable {
-    services.openssh.enable = true;
-    # TODO: Is this default configuration secure?
+    services.openssh = {
+      enable = true;
+      settings = {
+        PasswordAuthentication = false;
+        KbdInteractiveAuthentication = false;
+        PermitRootLogin = "no";
+      };
+      hostKeys = mkIf (config.modules.impermanence.enable) [
+        {
+          type = "ed25519";
+          path = "/persist/system/etc/ssh/ssh_host_ed25519_key";
+        }
+        {
+          type = "rsa";
+          bits = 4096;
+          path = "/persist/system/etc/ssh/ssh_host_rsa_key";
+        }
+      ];
+    };
   };
 }

profiles/disko/vm.nix

@@ -3,6 +3,8 @@
     disk = {
       main = {
         type = "disk";
+        device = "/dev/sda";
+        imageSize = "32G"; # For test VMs
         content = {
           type = "gpt";
           partitions = {
@@ -17,12 +19,19 @@
               };
             };
             zfs = {
-              size = "100%";
+              end = "-4G";
               content = {
                 type = "zfs";
                 pool = "tank";
               };
             };
+            swap = {
+              size = "100%";
+              content = {
+                type = "swap";
+                discardPolicy = "both";
+              };
+            };
           };
         };
       };

profiles/home/jan.nix

@@ -24,14 +24,13 @@ in
       freecad-wayland
       inkscape
       ente-auth
-      bitwarden
       carla
       winbox
       whatsapp-for-linux
       discord
       steam
       spotify
-      # feishin # TODO: Fix or replace as insecure
+      feishin
       eduvpn-client
       river # TODO: Move
       ryubing
@@ -39,6 +38,9 @@ in
       prismlauncher
       foliate
       wireshark
+      obsidian
+      devenv
+      kicad
     ];
 
     modules = {
@@ -61,6 +63,7 @@ in
           "flake.lock"
         ];
       };
+      bitwarden.enable = true;
       xpra = {
         enable = true;
         hosts = [

profiles/nixos/base.nix

@@ -1,5 +1,4 @@
 {
-  mkModule,
   pkgs,
   lib,
   config,
@@ -20,13 +19,19 @@ in
       bootloader.enable = mkDefault true;
       ssh.enable = mkDefault true;
 
-      # Setup sensible default persistent data
       impermanence.directories = [
         "/var/lib/nixos"
       ];
-      impermanence.files = [
-        "/etc/shadow"
-      ];
+
+      # TODO: Remove the secrets module and use sops directly?
+      secrets = {
+        enable = true;
+        secrets = {
+          "ssh-keys/deploy-priv" = {
+            path = "/root/.ssh/id_ed25519";
+          };
+        };
+      };
     };
 
     # Localization

profiles/nixos/vm.nix

@@ -1,5 +1,4 @@
 {
-  mkModule,
   pkgs,
   lib,
   config,
@@ -30,17 +29,50 @@ in
           zfs rollback -r tank/root@blank
         '';
       };
+      domain = {
+        enable = true;
+        join = {
+          userFile = config.sops.secrets."vm-join/user".path;
+          passwordFile = config.sops.secrets."vm-join/password".path;
+          domainOUFile = config.sops.secrets."vm-join/ou".path;
+        };
+      };
       ssh.enable = true;
     };
 
-    # Admin users
+    # Initialize domain join secrets
+    sops.secrets."vm-join/user" = { };
+    sops.secrets."vm-join/password" = { };
+    sops.secrets."vm-join/ou" = { };
+
+    # Autologin to root for access from hypervisor
+    services.getty.autologinUser = "root";
+
+    # Local user
+    modules.secrets.secrets."passwords/local-hashed".neededForUsers = true;
+    users.mutableUsers = false;
     users.users.local = {
-      initialPassword = "local";
+      isNormalUser = true;
+      group = "local";
+      hashedPasswordFile = config.sops.secrets."passwords/local-hashed".path;
       extraGroups = [ "wheel" ];
       openssh.authorizedKeys.keys = [
-        "ssh-ed25519  jan@bulthuis.dev"
+        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKKxoQSxfYqf9ITN8Fhckk8WbY4dwtBAXOhC9jxihJvq Admin"
       ];
     };
+    users.groups.local = { };
+    home-manager.users.local =
+      { ... }:
+      {
+        home.stateVersion = "24.11";
+        modules.profiles.base.enable = true;
+      };
+
+    # System packages
+    environment.systemPackages = with pkgs; [
+      # TODO: Make module for utilities/scripts
+      (writeShellScriptBin "system-update" "nixos-rebuild switch --flake git+https://git.bulthuis.dev/Jan/nixos-config")
+    ];
 
     # Enable qemu guest agent
     services.qemuGuest.enable = true;
@@ -61,17 +93,6 @@ in
       "sd_mod"
       "sr_mod"
     ];
-    boot.initrd.kernelModules = [ ];
     boot.kernelModules = [ "kvm-intel" ];
-    boot.extraModulePackages = [ ];
-    hardware.cpu.intel.updateMicrocode = true;
-
-    # Swapfile
-    swapDevices = [
-      {
-        device = "/var/lib/swapfile";
-        size = 6 * 1024;
-      }
-    ];
   };
 }