81 lines
2.0 KiB
Nix
81 lines
2.0 KiB
Nix
{
|
|
pkgs,
|
|
lib,
|
|
config,
|
|
...
|
|
}:
|
|
|
|
with lib;
|
|
let
|
|
cfg = config.modules.profiles.server;
|
|
in
|
|
{
|
|
options.modules.profiles.server = {
|
|
enable = mkEnableOption "Base server profile";
|
|
};
|
|
|
|
config = mkIf cfg.enable {
|
|
# Enabled modules
|
|
modules = {
|
|
profiles.base.enable = true;
|
|
disko.enable = true;
|
|
impermanence = {
|
|
enable = true;
|
|
resetScript = ''
|
|
# Revert to the blank state for the root directory
|
|
zfs rollback -r tank/root@blank
|
|
'';
|
|
};
|
|
domain = {
|
|
enable = mkDefault true;
|
|
join = {
|
|
userFile = config.sops.secrets."vm-join/user".path;
|
|
passwordFile = config.sops.secrets."vm-join/password".path;
|
|
domainOUFile = config.sops.secrets."vm-join/ou".path;
|
|
};
|
|
};
|
|
ssh.enable = true;
|
|
};
|
|
|
|
# Initialize domain join secrets
|
|
sops.secrets."vm-join/user" = { };
|
|
sops.secrets."vm-join/password" = { };
|
|
sops.secrets."vm-join/ou" = { };
|
|
|
|
# Local user
|
|
sops.secrets."passwords/local-hashed".neededForUsers = true;
|
|
users.mutableUsers = false;
|
|
users.users.local = {
|
|
isNormalUser = true;
|
|
group = "local";
|
|
hashedPasswordFile = config.sops.secrets."passwords/local-hashed".path;
|
|
extraGroups = [ "wheel" ];
|
|
openssh.authorizedKeys.keys = [
|
|
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKKxoQSxfYqf9ITN8Fhckk8WbY4dwtBAXOhC9jxihJvq Admin"
|
|
];
|
|
};
|
|
users.groups.local = { };
|
|
home-manager.users.local =
|
|
{ ... }:
|
|
{
|
|
home.stateVersion = "24.11";
|
|
modules.profiles.base.enable = true;
|
|
};
|
|
|
|
# System packages
|
|
environment.systemPackages = with pkgs; [
|
|
# TODO: Make module for utilities/scripts
|
|
(writeShellScriptBin "system-update" "nixos-rebuild switch --flake git+https://git.bulthuis.dev/Jan/nixos-config")
|
|
];
|
|
|
|
# Machine platform
|
|
nixpkgs.hostPlatform = mkDefault "x86_64-linux";
|
|
|
|
# Set hostid (required for ZFS)
|
|
networking.hostId = "deadbeef";
|
|
|
|
# Hardware configuration
|
|
hardware.enableRedistributableFirmware = true;
|
|
};
|
|
}
|