Compare commits

...

49 commits

Author SHA1 Message Date
Akshay Mankar 5c894c5265
Rekey agenix secrets
All checks were successful
continuous-integration/drone/push Build is passing
continuous-integration/drone/pr Build is passing
2023-04-25 12:10:02 +02:00
teutat3s a5061b8947
secrets: add host keys for hensoko
All checks were successful
continuous-integration/drone/push Build is passing
continuous-integration/drone/pr Build is passing
2023-04-25 10:18:54 +02:00
teutat3s 41939956c5
secrets: add host keys for b12f + teutat3s
All checks were successful
continuous-integration/drone/push Build is passing
continuous-integration/drone/pr Build is passing
2023-04-25 10:14:46 +02:00
teutat3s b55dace1ea
Merge branch 'momo/main' into momo/keycloak
All checks were successful
continuous-integration/drone/push Build is passing
continuous-integration/drone/pr Build is passing
2023-04-25 09:49:13 +02:00
teutat3s 9efce1619a
Merge pull request 'host_001_momo_koeln: fix swap UUID and initrd boot modules' (#223) from momo/fix-swap-uuid into momo/main
All checks were successful
continuous-integration/drone/push Build is passing
Reviewed-on: #223
Reviewed-by: hensoko <hensoko@gssws.de>
2023-04-24 18:02:29 +02:00
teutat3s db53f9f1be
host_001_momo_koeln: fix initrd kernelModules
All checks were successful
continuous-integration/drone/push Build is passing
continuous-integration/drone/pr Build is passing
boot.initrd.kernelModules overrides boot.initrd.availableKernelModules
and forces the initrd to load only those modules. This leads to the host
being unbootable in this case because of missing required modules.
availableKernelModules is the correct place for desired modules.

This got fixed during a debugging session of hensoko and teutat3s, but
not implemented in nix code until now.
2023-04-24 13:13:12 +02:00
teutat3s 2692b2dc20
host_001_momo_koeln: fix swap UUID
All checks were successful
continuous-integration/drone/push Build is passing
This got changed while debugging boot failures on this host, by

re-creating swap.
2023-04-24 13:05:05 +02:00
b12f 211f1d16d0
Merge pull request 'momo/main: merge main branch' (#219) from momo-merge-main into momo/main
Some checks failed
continuous-integration/drone/push Build is failing
Reviewed-on: #219
Reviewed-by: b12f <hello@benjaminbaedorf.eu>
2023-04-24 12:50:47 +02:00
teutat3s 4faf4267a3
Merge branch 'main' into momo-merge-main
All checks were successful
continuous-integration/drone/push Build is passing
continuous-integration/drone/pr Build is passing
2023-04-18 10:45:27 +02:00
Akshay Mankar 4c4c4cab0b
secrets: Add keycloak-database-password
Some checks failed
continuous-integration/drone/push Build is passing
continuous-integration/drone/pr Build is failing
2023-04-17 18:41:44 +02:00
Akshay Mankar 8b8280d07e
secrets: Add keys for axeman and host_001_momo_koeln 2023-04-17 18:41:44 +02:00
Akshay Mankar a0a92d27c9
001_momo_koeln: Add caddy 2023-04-17 18:41:42 +02:00
Akshay Mankar 6e6e5857fd
001_momo_koeln: Add keycloak 2023-04-17 18:41:26 +02:00
teutat3s 366d3b1278
Merge pull request '001_momo_koeln: Add @axeman's key to barkeeper's authorized_keys' (#213) from momo/add-axeman-key into momo/main
All checks were successful
continuous-integration/drone/push Build is passing
Reviewed-on: #213
Reviewed-by: teutat3s <teutates@mailbox.org>
2023-03-31 16:44:25 +02:00
Akshay Mankar 48d55417bd
001_momo_koeln: Add @axeman's key to barkeeper's authorized_keys
All checks were successful
continuous-integration/drone/push Build is passing
continuous-integration/drone/pr Build is passing
2023-03-31 16:40:13 +02:00
teutat3s ea18402f21
Merge pull request 'main-to-momo-main' (#212) from main-to-momo-main into momo/main
All checks were successful
continuous-integration/drone/push Build is passing
Reviewed-on: #212
Reviewed-by: teutat3s <teutates@mailbox.org>
2023-03-31 16:19:07 +02:00
Akshay Mankar 3992ca0d5f
Merge branch 'main' into main-to-momo-main
All checks were successful
continuous-integration/drone/push Build is passing
continuous-integration/drone/pr Build is passing
2023-03-31 16:15:10 +02:00
teutat3s 43bd742150
Merge pull request 'ci: fix Host key verification failed' (#205) from momo/ci-deployment-known-hosts into momo/main
All checks were successful
continuous-integration/drone/push Build is passing
Reviewed-on: #205
2023-03-08 14:13:03 +01:00
teutat3s b21b98dadd
ci: fix Host key verification failed
All checks were successful
continuous-integration/drone/push Build is passing
continuous-integration/drone/pr Build is passing
- Fix missing SSH known_hosts in deploy pipeline
- SSH tries to use Trust-On-First-Use (TOFU) interactively to add a new
  host key
- Verbose SSH logs show:
debug1: Server host key: ssh-ed25519 SHA256:1bbksDNYBWSh/rIFP7MMfs557kWn1dM64bpXdnfBE5E
debug1: read_passphrase: can't open /dev/tty: No such device or address
- deploy-rs uses nix, which uses SSH which doesn't use the environment variable
HOME, but rather /etc/passwd to find a user's HOME
- To solve this, we override SSH options using UserKnownHostsFile and
  the -i flag
2023-03-08 14:10:19 +01:00
teutat3s f5239c042b
Merge pull request 'ci: debug Host key verification failed error' (#204) from momo/ci-deployment-known-hosts into momo/main
All checks were successful
continuous-integration/drone/push Build is passing
Reviewed-on: #204
2023-03-08 14:05:19 +01:00
teutat3s 51e84e9418
ci: debug Host key verification failed error
All checks were successful
continuous-integration/drone/push Build is passing
continuous-integration/drone/pr Build is passing
2023-03-08 14:04:06 +01:00
teutat3s f6708d252e
Merge pull request 'ci: debug Host key verification failed error' (#203) from momo/ci-deployment-known-hosts into momo/main
Some checks failed
continuous-integration/drone/push Build is failing
Reviewed-on: #203
2023-03-08 13:55:32 +01:00
teutat3s 0bd30c33d5
ci: debug Host key verification failed error
All checks were successful
continuous-integration/drone/push Build is passing
continuous-integration/drone/pr Build is passing
2023-03-08 13:54:50 +01:00
teutat3s 3f9b0f9a3b
Merge pull request 'ci: debug Host key verification failed error' (#202) from momo/ci-deployment-known-hosts into momo/main
Some checks failed
continuous-integration/drone/push Build is failing
Reviewed-on: #202
2023-03-08 13:49:58 +01:00
teutat3s 09cdf6c390
ci: debug Host key verification failed error
All checks were successful
continuous-integration/drone/push Build is passing
continuous-integration/drone/pr Build is passing
2023-03-08 13:49:27 +01:00
teutat3s 30652571cf
Merge pull request 'ci: debug Host key verification failed error' (#201) from momo/ci-deployment-known-hosts into momo/main
Some checks failed
continuous-integration/drone/push Build is failing
Reviewed-on: #201
2023-03-08 13:43:13 +01:00
teutat3s 9812687fb1
ci: debug Host key verification failed error
All checks were successful
continuous-integration/drone/push Build is passing
continuous-integration/drone/pr Build is passing
2023-03-08 13:42:29 +01:00
teutat3s 86ca4f6f54
Merge pull request 'ci: debug Host key verification failed error' (#200) from momo/ci-deployment-known-hosts into momo/main
Some checks failed
continuous-integration/drone/push Build is failing
Reviewed-on: #200
2023-03-08 13:35:46 +01:00
teutat3s 1a16083510
ci: debug Host key verification failed error
All checks were successful
continuous-integration/drone/push Build is passing
continuous-integration/drone/pr Build is passing
2023-03-08 13:35:02 +01:00
teutat3s 8c4cc68bd6
Merge pull request 'ci: fix Host key verification failed' (#199) from momo/ci-deployment-known-hosts into momo/main
Some checks failed
continuous-integration/drone/push Build is failing
Reviewed-on: #199
2023-03-08 13:30:24 +01:00
teutat3s 9dc77abfc8
ci: fix Host key verification failed
All checks were successful
continuous-integration/drone/push Build is passing
continuous-integration/drone/pr Build is passing
- missing SSH known_hosts in deploy pipeline
- SSH tries to use Trust-On-First-Use (TOFU) interactively to add a new
  host key
- verbose SSH logs:
debug1: Server host key: ssh-ed25519 SHA256:1bbksDNYBWSh/rIFP7MMfs557kWn1dM64bpXdnfBE5E
debug1: read_passphrase: can't open /dev/tty: No such device or address
- deploy-rs uses nix, which uses SSH which doesn't use the environment variable
HOME, but rather /etc/passwd to find a user's HOME
2023-03-08 13:25:49 +01:00
teutat3s 6192881ac1
Merge pull request 'ci: debug Host key verification failed error' (#198) from momo/ci-deployment-known-hosts into momo/main
Some checks failed
continuous-integration/drone/push Build is failing
Reviewed-on: #198
2023-03-08 12:54:37 +01:00
teutat3s 3890494935
ci: debug Host key verification failed error
All checks were successful
continuous-integration/drone/push Build is passing
continuous-integration/drone/pr Build is passing
2023-03-08 12:53:56 +01:00
teutat3s 420a201f70
Merge pull request 'ci: debug Host key verification failed error' (#197) from momo/ci-deployment-known-hosts into momo/main
Some checks failed
continuous-integration/drone/push Build is failing
Reviewed-on: #197
2023-03-08 12:26:33 +01:00
teutat3s e2c601509a
ci: debug Host key verification failed error
All checks were successful
continuous-integration/drone/push Build is passing
continuous-integration/drone/pr Build is passing
2023-03-08 12:26:01 +01:00
teutat3s 3491fc2b74
Merge pull request 'ci: debug Host key verification failed error' (#196) from momo/ci-deployment-known-hosts into momo/main
Some checks failed
continuous-integration/drone/push Build is failing
Reviewed-on: #196
2023-03-08 11:54:51 +01:00
teutat3s 40e967fb7d
ci: debug Host key verification failed error
All checks were successful
continuous-integration/drone/push Build is passing
continuous-integration/drone/pr Build is passing
2023-03-08 11:54:03 +01:00
teutat3s 503a40da11
Merge pull request 'ci: debug Host key verification failed error' (#195) from momo/ci-deployment-known-hosts into momo/main
Some checks failed
continuous-integration/drone/push Build is failing
Reviewed-on: #195
2023-03-08 11:51:40 +01:00
teutat3s 6190795afa
ci: debug Host key verification failed error
All checks were successful
continuous-integration/drone/push Build is passing
continuous-integration/drone/pr Build is passing
2023-03-08 11:50:21 +01:00
teutat3s 8bf3b126de
Merge pull request 'ci: fix missing SSH known_hosts in deploy pipeline' (#194) from momo/ci-deployment-known-hosts into momo/main
Some checks failed
continuous-integration/drone/push Build is failing
Reviewed-on: #194
Reviewed-by: hensoko <hensoko@gssws.de>
2023-03-08 11:33:02 +01:00
teutat3s e3db9f51a6
ci: fix missing SSH known_hosts in deploy pipeline
All checks were successful
continuous-integration/drone/push Build is passing
continuous-integration/drone/pr Build is passing
2023-03-07 21:51:43 +01:00
teutat3s 6913d66458
Merge pull request 'ci: deploy host_001_momo_koeln on every push to momo/main' (#193) from momo/ci-deployment into momo/main
Some checks failed
continuous-integration/drone/push Build is failing
Reviewed-on: #193
Reviewed-by: hensoko <hensoko@gssws.de>
2023-03-07 21:21:56 +01:00
teutat3s 716f22e32d
ci: deploy host_001_momo_koeln on every push to
All checks were successful
continuous-integration/drone/push Build is passing
continuous-integration/drone/pr Build is passing
momo/main

The branch momo/main is now protected from direct pushes and changes
should go through review before getting merged

Fix drone lint errors:
Pipeline stage 'Notification' declares invalid dependency 'Tests'
Pipeline stage 'Publish ISO' declares invalid dependency 'Check'
2023-03-07 17:33:01 +01:00
hensoko 4b5955a164
Merge pull request 'barkeeper: add teutat3s SSH public key' (#191) from momo/teutat3s-ssh-public-key into momo/main
All checks were successful
continuous-integration/drone/push Build is passing
Reviewed-on: #191
2023-03-07 10:54:47 +01:00
teutat3s 9ae94a6c4e
Remove unused bootstrap host
All checks were successful
continuous-integration/drone/push Build is passing
continuous-integration/drone/pr Build is passing
2023-03-07 01:19:46 +01:00
teutat3s 597594912c
Remove unused pub-solar user 2023-03-07 01:17:03 +01:00
teutat3s 2ae3276694
Remove unused PubSolarOS host, ci should builds
Some checks failed
continuous-integration/drone/push Build is passing
continuous-integration/drone/pr Build is failing
host_001_momo_koeln instead
2023-03-07 01:14:59 +01:00
teutat3s 9d7dfe52cb
barkeeper: add teutat3s SSH public key
Some checks failed
continuous-integration/drone/push Build is passing
continuous-integration/drone/pr Build is failing
2023-03-07 01:10:27 +01:00
Hendrik Sokolowski 0daf30fe09 add 001_momo_koeln
All checks were successful
continuous-integration/drone/push Build is passing
2023-03-07 00:48:42 +01:00
15 changed files with 256 additions and 113 deletions

View file

@ -1,7 +1,7 @@
---
kind: pipeline
type: exec
name: Check
name: Check and deploy
node:
hosttype: baremetal
@ -15,7 +15,27 @@ steps:
commands:
- 'echo DEBUG: Using NIX_FLAGS: $NIX_FLAGS'
- nix $$NIX_FLAGS develop --command nix flake show
- nix $$NIX_FLAGS build ".#nixosConfigurations.PubSolarOS.config.system.build.toplevel"
- nix $$NIX_FLAGS build ".#nixosConfigurations.host_001_momo_koeln.config.system.build.toplevel"
- name: "Deploy"
when:
event:
- push
branch:
- momo/main
environment:
NIX_FLAGS: "--print-build-logs --verbose --accept-flake-config"
PRIVATE_SSH_KEY:
from_secret: ci_private_ssh_key
SSH_HOST_KEY: "80.244.242.4 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIE7XTCHfX6ta8EtkdOcZLnpdhMmXDfTebVMs4NC8JEPj"
commands:
- mkdir $$HOME/.ssh && chmod 700 $$HOME/.ssh
- echo "$$PRIVATE_SSH_KEY" > $$HOME/.ssh/id_ed25519 && chmod 600 $$HOME/.ssh/id_ed25519
- echo "$$SSH_HOST_KEY" > $$HOME/.ssh/known_hosts
# SSH uses HOME from /etc/passwd, not from the environment, so override it
- export SSHOPTS="-o UserKnownHostsFile=$$HOME/.ssh/known_hosts -i $$HOME/.ssh/id_ed25519"
- "echo DEBUG: Using NIX_FLAGS: $$NIX_FLAGS"
- nix $$NIX_FLAGS develop --command deploy --magic-rollback false --skip-checks --targets '.#host_001_momo_koeln' --ssh-opts="$$SSHOPTS"
---
kind: pipeline
@ -76,9 +96,6 @@ steps:
from_secret: matrix_password
template: "Test run triggered by tag: {{ build.tag }}. Test run exit status: {{ build.status }}. Artifacts uploaded to Manta: https://eu-central.manta.greenbaum.cloud/pub_solar/public/ci/{{ repo.Owner }}/{{ repo.Name }}/{{ build.number }}/foot_wayland_info.png"
depends_on:
- Tests
trigger:
ref:
- refs/tags/v*
@ -132,9 +149,6 @@ steps:
unlink_first: true
strip_components: 3
depends_on:
- Check
trigger:
branch:
- main
@ -147,6 +161,6 @@ volumes:
---
kind: signature
hmac: 6aee0ffe22111bb629c0a79940bfbc3fa75f68c5ed5c4bba68abf6797b87a7ab
hmac: a600be61980312efec74374647cdff7e3876a7858caf51433a8b76148312edc1
...

View file

@ -119,10 +119,9 @@
users = digga.lib.rakeLeaves ./users;
};
suites = with profiles; rec {
base = [users.pub-solar users.root];
iso = base ++ [base-user graphical pub-solar-iso];
pubsolaros = [full-install base-user users.root];
anonymous = [pubsolaros users.pub-solar];
base = [ base-user users.root users.barkeeper ];
host_001_momo_koeln = base;
};
};
};
@ -137,10 +136,10 @@
};
};
users = {
pub-solar = {suites, ...}: {
barkeeper = {suites, ...}: {
imports = suites.base;
home.stateVersion = "21.03";
home.stateVersion = "22.05";
};
}; # digga.lib.importers.rakeLeaves ./users/hm;
};
@ -149,6 +148,11 @@
homeConfigurations = digga.lib.mkHomeConfigurations self.nixosConfigurations;
deploy.nodes = digga.lib.mkDeployNodes self.nixosConfigurations {};
deploy.nodes = digga.lib.mkDeployNodes self.nixosConfigurations {
host_001_momo_koeln = {
hostname = "80.244.242.4";
sshUser = "barkeeper";
};
};
};
}

View file

@ -1,21 +0,0 @@
{suites, ...}: {
### root password is empty by default ###
### default password: pub-solar, optional: add your SSH keys
imports =
suites.iso;
boot.loader.systemd-boot.enable = true;
boot.loader.efi.canTouchEfiVariables = true;
networking.networkmanager.enable = true;
fileSystems."/" = {device = "/dev/disk/by-label/nixos";};
# This value determines the NixOS release from which the default
# settings for stateful data, like file locations and database versions
# on your system were taken. Its perfectly fine and recommended to leave
# this value at the release version of the first install of this system.
# Before changing this value read the documentation for this option
# (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
system.stateVersion = "22.05"; # Did you read the comment?
}

View file

@ -1,54 +0,0 @@
{
config,
lib,
pkgs,
profiles,
...
}:
with lib; let
# Gets hostname of host to be bundled inside iso
# Copied from https://github.com/divnix/digga/blob/30ffa0b02272dc56c94fd3c7d8a5a0f07ca197bf/modules/bootstrap-iso.nix#L3-L11
getFqdn = config: let
net = config.networking;
fqdn =
if (net ? domain) && (net.domain != null)
then "${net.hostName}.${net.domain}"
else net.hostName;
in
fqdn;
in {
# build with: `nix build ".#nixosConfigurations.bootstrap.config.system.build.isoImage"`
imports = [
# profiles.networking
profiles.users.root # make sure to configure ssh keys
profiles.users.pub-solar
profiles.base-user
profiles.graphical
profiles.pub-solar-iso
];
config = {
boot.loader.systemd-boot.enable = true;
# will be overridden by the bootstrapIso instrumentation
fileSystems."/" = {device = "/dev/disk/by-label/nixos";};
system.nixos.label = "PubSolarOS-" + config.system.nixos.version;
# mkForce because a similar transformation gets double applied otherwise
# https://github.com/divnix/digga/blob/30ffa0b02272dc56c94fd3c7d8a5a0f07ca197bf/modules/bootstrap-iso.nix#L17
# https://github.com/NixOS/nixpkgs/blob/aecd4d8349b94f9bd5718c74a5b789f233f67326/nixos/modules/installer/cd-dvd/installation-cd-base.nix#L21-L22
isoImage = {
isoBaseName = mkForce (getFqdn config);
isoName = mkForce "${config.system.nixos.label}-${config.isoImage.isoBaseName}-${pkgs.stdenv.hostPlatform.system}.iso";
};
# This value determines the NixOS release from which the default
# settings for stateful data, like file locations and database versions
# on your system were taken. Its perfectly fine and recommended to leave
# this value at the release version of the first install of this system.
# Before changing this value read the documentation for this option
# (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
system.stateVersion = "21.05"; # Did you read the comment?
};
}

View file

@ -0,0 +1,26 @@
{
config,
...
}: {
# Changing the Caddyfile should only trigger a reload, not a restart
systemd.services.caddy.reloadTriggers = [
config.services.caddy.configFile
];
services.caddy = {
enable = true;
email = "wg-tooling@list.momo.koeln";
virtualHosts = {
"auth.momo.koeln" = {
logFormat = ''
output discard
'';
extraConfig = ''
reverse_proxy :8080
'';
};
};
};
networking.firewall.allowedTCPPorts = [80 443];
}

View file

@ -0,0 +1,33 @@
{ config, lib, pkgs, ... }:
{
imports =
[
# Include the results of the hardware scan.
./hardware-configuration.nix
./caddy.nix
./keycloak.nix
];
pub-solar.core.lite = true;
time.timeZone = "Europe/Berlin";
networking = {
useDHCP = false;
interfaces.enp1s0.ipv4.addresses = [{
address = "80.244.242.4";
prefixLength = 29;
}];
defaultGateway = "80.244.242.1";
nameservers = [ "95.129.51.51" "80.244.244.244" ];
};
# Enable the OpenSSH daemon.
services.openssh.enable = true;
system.stateVersion = "22.05";
}

View file

@ -0,0 +1,6 @@
{ suites, ... }:
{
imports = [
./host_001_momo_koeln.nix
] ++ suites.host_001_momo_koeln;
}

View file

@ -0,0 +1,57 @@
{
config,
pkgs,
lib,
...
}: {
# Use the GRUB 2 boot loader.
boot.loader.systemd-boot.enable = false;
boot.loader.grub.enable = true;
boot.loader.grub.version = 2;
# boot.loader.grub.efiSupport = true;
# boot.loader.grub.efiInstallAsRemovable = true;
# boot.loader.efi.efiSysMountPoint = "/boot/efi";
# Define on which hard drive you want to install Grub.
boot.loader.grub.device = "/dev/sda"; # or "nodev" for efi only
boot.initrd.availableKernelModules = ["ahci" "xhci_pci" "virtio_pci" "sd_mod" "sr_mod" "dm-snapshot"];
boot.initrd.kernelModules = [];
boot.kernelModules = ["kvm-intel"];
boot.extraModulePackages = [];
boot.initrd.luks.devices."cryptroot" = {
device = "/dev/disk/by-uuid/531ee357-5777-498f-abbf-64bb4cff9a14";
};
fileSystems."/" = {
device = "/dev/disk/by-uuid/f5b3152a-a3bd-46d1-968f-53d50fca921e";
fsType = "ext4";
};
fileSystems."/boot" = {
device = "/dev/disk/by-uuid/1fd053f8-725b-418d-aed1-aee71dac2b62";
fsType = "ext4";
};
swapDevices = [
{device = "/dev/disk/by-uuid/967d1933-131d-4b56-8aa9-15c11ff940c9";}
];
networking = {
defaultGateway = "80.244.242.1";
nameservers = ["95.129.51.51" "80.244.244.244"];
interfaces."enp1s0" = {
ipv4.addresses = [
{
address = "80.244.242.4";
prefixLength = 29;
}
];
};
};
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
}

View file

@ -0,0 +1,12 @@
{ config, pkgs, lib, ... }:
with lib;
with pkgs;
let
psCfg = config.pub-solar;
in
{
imports = [
./configuration.nix
];
}

View file

@ -0,0 +1,25 @@
{
config,
lib,
inputs,
pkgs,
self,
...
}: {
age.secrets.keycloak-database-password = {
file = "${self}/secrets/keycloak-database-password.age";
mode = "700";
};
# keycloak
services.keycloak = {
enable = true;
database.passwordFile = config.age.secrets.keycloak-database-password.path;
settings = {
hostname = "auth.momo.koeln";
http-host = "127.0.0.1";
http-port = 8080;
proxy = "edge";
};
};
}

View file

@ -13,12 +13,15 @@ in {
users = {
mutableUsers = false;
groups."${psCfg.user.name}" = {};
users = with pkgs;
pkgs.lib.setAttrByPath [psCfg.user.name] {
# Indicates whether this is an account for a “real” user.
# This automatically sets group to users, createHome to true,
# home to /home/username, useDefaultShell to true, and isSystemUser to false.
isNormalUser = true;
group = "${psCfg.user.name}";
description = psCfg.user.description;
extraGroups = [
"wheel"

Binary file not shown.

View file

@ -1,8 +1,21 @@
let
# set ssh public keys here for your system and user
system = "";
user = "";
allKeys = [system user];
host_001_momo_koeln = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIE7XTCHfX6ta8EtkdOcZLnpdhMmXDfTebVMs4NC8JEPj root@nixos";
axeman = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMNeQYLFauAbzDyIbKC86NUh9yZfiyBm/BtIdkcpZnSU @axeman";
b12f-bbcom = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCmXpOU6vzQiVSSYCoxHYv7wDxC63Qg3dxlAMR6AOzwIABCU5PFFNcO0NWYms/YR7MOViorl+19LCLRABar9JgHU1n+uqxKV6eGph3OPeMp5sN8LAh7C9N+TZj8iJzBxQ3ch+Z/LdmLRwYNJ7KSUI+gwGK6xRS3+z1022Y4P0G0sx7IeCBl4lealQEIIF10ZOfjUdBcLQar7XTc5AxyGKnHCerXHRtccCoadLQujk0AvPXbv3Ma4JwX9X++AnCWRWakqS5UInu2tGuZ/6Hrjd2a9AKWjTaBVDcbYqCvY4XVuMj2/A2bCceFBaoi41apybSk26FSFTU4qiEUNQ6lxeOwG4+1NCXyHe2bGI4VyoxinDYa8vLLzXIRfTRA0qoGfCweXNeWPf0jMqASkUKaSOH5Ot7O5ps34r0j9pWzavDid8QeKJPyhxKuF1a5G4iBEZ0O9vuti60dPSjJPci9oTxbune2/jb7Sa0yO06DtLFJ2ncr5f70s/BDxKk4XIwQLy+KsvzlQEGdY8yA6xv28bOGxL3sQ0HE2pDTsvIbAisVOKzdJeolStL9MM5W8Hg0r/KkGj2bg0TfoRp1xHV9hjKkvJrsQ6okaPvNFeZq0HXzPhWMOVQ+/46z80uaQ1ByRLr3FTwuWJ7F/73ndfxiq6bDE4z2Ji0vOjeWJm6HCxTdGw==";
teutat3s-dumpyourvms = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHcU6KPy4b1MQXd6EJhcYwbJu7E+0IrBZF/IP6T7gbMf teutat3s@dumpyourvms";
hensoko_nitrokey_1 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAII/58A18EtxnLYHu63c/+AyTSkJQSso/VVdHUFGp1CTk cardno:FFFE34353135";
hensoko_harrison = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEbaQdxp7Flz6ttELe63rn+Nt9g43qJOLih6VCMP4gPb hensoko@harrison";
hensoko_norman = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAqkqMYgncrnczcW/0PY+Z+FmNXXpgw6D9JWTTwiainy hensoko@hensoko-tp-work";
allKeys = [
axeman
b12f-bbcom
hensoko_nitrokey_1
hensoko_harrison
hensoko_norman
host_001_momo_koeln
teutat3s-dumpyourvms
];
in {
"secret.age".publicKeys = allKeys;
"keycloak-database-password.age".publicKeys = allKeys;
}

View file

@ -0,0 +1,43 @@
{
config,
hmUsers,
pkgs,
lib,
...
}: let
psCfg = config.pub-solar;
in {
config = {
home-manager.users = {inherit (hmUsers) barkeeper;};
security.sudo.extraRules = [
{
users = ["${psCfg.user.name}"];
commands = [
{
command = "ALL";
options = ["NOPASSWD"];
}
];
}
];
pub-solar = {
user = {
name = "barkeeper";
description = "momo deployment user";
fullName = "momo infra barkeeper";
email = "admins@momo.koeln";
gpgKeyId = "";
publicKeys = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAII/58A18EtxnLYHu63c/+AyTSkJQSso/VVdHUFGp1CTk cardno:FFFE34353135 @hensoko"
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAqkqMYgncrnczcW/0PY+Z+FmNXXpgw6D9JWTTwiainy hensoko@hensoko-tp-work"
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEbaQdxp7Flz6ttELe63rn+Nt9g43qJOLih6VCMP4gPb @hensoko"
"ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBFro/k4Mgqyh8yV/7Zwjc0dv60ZM7bROBU9JNd99P/4co6fxPt1pJiU/pEz2Dax/HODxgcO+jFZfvPEuLMCeAl0= YubiKey #10593996 PIV Slot 9a @teutat3s"
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGP5MvCwNRtCcP1pSDrn0XZTNlpOqYnjHDm9/OI4hECW @ci-drone-runner"
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMNeQYLFauAbzDyIbKC86NUh9yZfiyBm/BtIdkcpZnSU @axeman"
];
};
};
};
}

View file

@ -1,18 +0,0 @@
{hmUsers, ...}: {
home-manager.users = {inherit (hmUsers) pub-solar;};
pub-solar = {
# These are your personal settings
# The only required settings are `name` and `password`,
# for convenience, use publicKeys to add your SSH keys
# The rest is used for programs like git
user = {
name = "pub-solar";
# default password = pub-solar
password = "$6$Kv0BCLU2Jg7GN8Oa$hc2vERKCbZdczFqyHPfgCaleGP.JuOWyd.bfcIsLDNmExGXI6Rnkze.SWzVzVS311KBznN/P4uUYAUADXkVtr.";
fullName = "Pub Solar";
email = "iso@pub.solar";
publicKeys = [];
};
};
}