feat(nixos): migrate system configuration

configs/nixos/hosts/neogaia/default.nix

@@ -0,0 +1,53 @@
+{
+  inputs,
+  pkgs,
+  ...
+}:
+# neogaia — Dell XPS 13 9380 laptop.
+# Disk layout is in ./disk.nix.
+# `fileSystems` are derived from it, none declared here.
+{
+  imports = [
+    inputs.nixos-hardware.nixosModules.dell-xps-13-9380
+    ./hardware-configuration.nix
+    ./disk.nix
+  ];
+
+  system.stateVersion = "26.05";
+
+  # systemd-boot on the EFI system partition.
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.efi.canTouchEfiVariables = true;
+
+  boot.kernelPackages = pkgs.linuxPackages_cachyos;
+
+  # Redistributable firmware for the QCA6174 wifi (ath10k blobs).
+  # Intel microcode updates follow from this, so none is declared here.
+  hardware.enableRedistributableFirmware = true;
+
+  # RAM-backed swap, no on-disk swap partition.
+  zramSwap.enable = true;
+
+  # So wifi can be joined from the console.
+  networking.networkmanager.enable = true;
+
+  registry.address.neogaia.self = "10.23.50.146";
+
+  # So setup can be driven over the network.
+  # The matching host public keys sit beside this file in plaintext, since
+  # publishing them is their purpose.
+  modules.network.ssh.enable = true;
+  modules.network.ssh.hostKeys.sopsFile = ../../secrets/neogaia.yaml;
+  modules.network.ssh.userKey.sopsFile = ../../secrets/neogaia.yaml;
+
+  modules.shell.herdr.enable = true;
+  modules.agents.tools.gitea-axi.enable = true;
+  modules.agents.pi.enable = true;
+
+  modules.desktop.enable = true;
+  modules.desktop.apps.obsidian.enable = true;
+  modules.desktop.apps.steam.enable = true;
+
+  time.timeZone = "America/New_York";
+  i18n.defaultLocale = "en_GB.UTF-8";
+}

configs/nixos/hosts/neogaia/disk.nix

@@ -0,0 +1,63 @@
+{ ... }:
+# neogaia's disk layout for disko: one NVMe disk, GPT, with an EFI system
+# partition and a LUKS container holding btrfs subvolumes.
+# No swap partition, since swap is zram.
+# disko derives `fileSystems` and `boot.initrd.luks.devices` from this.
+{
+  disko.devices.disk.main = {
+    type = "disk";
+    device = "/dev/nvme0n1";
+    content = {
+      type = "gpt";
+      partitions = {
+        ESP = {
+          # Each generation stores a kernel and initrd here and the CachyOS kernel is large.
+          # An exhausted partition fails bootloader installs.
+          size = "2G";
+          type = "EF00";
+          content = {
+            type = "filesystem";
+            format = "vfat";
+            mountpoint = "/boot";
+            mountOptions = [ "umask=0077" ];
+          };
+        };
+        luks = {
+          size = "100%";
+          content = {
+            type = "luks";
+            name = "cryptroot";
+            settings.allowDiscards = true;
+            content = {
+              type = "btrfs";
+              extraArgs = [ "-f" ];
+              subvolumes = {
+                "@root" = {
+                  mountpoint = "/";
+                  mountOptions = [
+                    "compress=zstd"
+                    "noatime"
+                  ];
+                };
+                "@home" = {
+                  mountpoint = "/home";
+                  mountOptions = [
+                    "compress=zstd"
+                    "noatime"
+                  ];
+                };
+                "@nix" = {
+                  mountpoint = "/nix";
+                  mountOptions = [
+                    "compress=zstd"
+                    "noatime"
+                  ];
+                };
+              };
+            };
+          };
+        };
+      };
+    };
+  };
+}

configs/nixos/hosts/neogaia/hardware-configuration.nix

@@ -0,0 +1,17 @@
+{ lib, modulesPath, ... }:
+# Hardware detected by nixos-generate-config on this machine.
+# disko derives `fileSystems` and the LUKS device, none declared here.
+{
+  imports = [ (modulesPath + "/installer/scan/not-detected.nix") ];
+
+  boot.initrd.availableKernelModules = [
+    "xhci_pci"
+    "nvme"
+    "rtsx_pci_sdmmc"
+  ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-intel" ];
+  boot.extraModulePackages = [ ];
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+}

configs/nixos/hosts/neogaia/ssh_host_ed25519_key.pub

@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJS+wp7K123+4BT6G4f954R6WyrbWveY7VlpoBUf6I5p neogaia

configs/nixos/hosts/neogaia/ssh_host_rsa_key.pub

@@ -0,0 +1 @@
+ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCo2wWUKxyAS4J5TqbWf8glDhJvS5XmdRqFhMeJwG3pOB+4AccZ1T8LU7ZN+RjtRi3j2qXBJvIHuzhtQNtmT59TxocvfobYiqOgJpvVO5K6yD8ZoUJs6ziDkIduI9w9mdRIESoi+dBbVu8n24r61cKDVh+jWX+yjzkOcWcOzqDyQhhkjqblZ1WMAdujEMuEPvif1i2LCxStUaZqRGcx09m/ME2fYcaJrpuxxxvX2+CPJNicoo6Rx9i7ZjAoNuvH+jui4KT62DzlQtQtCl2CFUOM0gCPSa+MbNQ9elfHPvGzEcwOIMo2cuy9KURUkQu+sAgaG8S1PEniDDTecskHtuRdmPZawnQGpIhzo919Q6wUgjT8scK4mmSXRWmGmkMt0GNA2tfj5tDks6r5Q8XsYqtWs4rsOEvfmxVSdM771w+fqDBAil99Jsh0ksPK9+Bwgg8cMDzLLFDn8JA5y2G1HocMMom+u5DYKwPXEKnCILkasB8y24+O3PhSu1EuWw277w6EUEXvU03rCf0Ak/ULjxp9a00EGlloEwSmFI7Aub9XHDr87IdbGInEn+PMqyBYADiN+3h6nE2JO+nMa6i/CHdebmT+T7YJvuTKHD9sjFmQsYaghlq03DZrhHcm4hgUvE1dqGojHrhk/WgA3EWTWtK/+BP0Vy2jXaaz+qAx+EGnhQ== neogaia

configs/nixos/hosts/pikachu/default.nix

@@ -0,0 +1,149 @@
+{
+  config,
+  pkgs,
+  registry,
+  ...
+}:
+# pikachu — AZW ME Pro server.
+# Disk layout is in ./disk.nix.
+# `fileSystems` for the root disk are derived from it.
+{
+  imports = [
+    ./hardware-configuration.nix
+    ./disk.nix
+  ];
+
+  system.stateVersion = "26.05";
+
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.efi.canTouchEfiVariables = true;
+
+  hardware.cpu.intel.updateMicrocode = true;
+  hardware.enableRedistributableFirmware = true;
+
+  zramSwap.enable = true;
+
+  systemd.network = {
+    enable = true;
+    netdevs = {
+      "40-br-vlan20".netdevConfig = {
+        Name = "br-vlan20";
+        Kind = "bridge";
+      };
+      "40-vlan20" = {
+        netdevConfig = {
+          Name = "vlan20";
+          Kind = "vlan";
+        };
+        vlanConfig.Id = 20;
+      };
+    };
+
+    networks = {
+      "10-uplink" = {
+        matchConfig = {
+          Name = "enp2s0";
+          MACAddress = "78:55:36:07:af:49";
+        };
+        networkConfig.DHCP = "yes";
+        vlan = [ "vlan20" ];
+        linkConfig.RequiredForOnline = "routable";
+      };
+      "40-vlan20" = {
+        matchConfig.Name = "vlan20";
+        networkConfig.Bridge = "br-vlan20";
+        linkConfig.RequiredForOnline = "no";
+      };
+      "40-br-vlan20" = {
+        matchConfig.Name = "br-vlan20";
+        linkConfig.RequiredForOnline = "no";
+      };
+    };
+  };
+  networking.useDHCP = false;
+
+  modules.network.vlans.ids = [ 20 ];
+
+  boot.zfs.forceImportRoot = false;
+
+  modules.zfs = {
+    enable = true;
+    hostId = "2346edbd";
+    pools.pikachu = { };
+  };
+
+  registry.address.pikachu.self = "10.23.10.102";
+
+  modules.network.ssh.enable = true;
+  modules.network.ssh.hostKeys.sopsFile = ../../secrets/pikachu.yaml;
+  modules.network.ssh.userKey.sopsFile = ../../secrets/pikachu.yaml;
+
+  guests.actualbudget = {
+    enable = true;
+    vlan = 20;
+    mac = "BC:24:11:C1:CD:28";
+    dataPath = "/pikachu/data/actualbudget";
+    address = "10.23.20.42";
+    reverseProxy = {
+      enable = true;
+      route = {
+        domain = "budget.alexion.dev";
+        port = 5006;
+      };
+    };
+  };
+
+  guests.reverse-proxy = {
+    enable = true;
+    vlan = 20;
+    mac = "02:98:64:5a:07:4f";
+    address = "10.23.20.109";
+  };
+
+  guests.copyparty = {
+    enable = true;
+    vlan = 20;
+    mac = "02:23:20:39:23:01";
+    statePath = "/pikachu/data/copyparty";
+    address = "10.23.20.126";
+    reverseProxy = {
+      enable = true;
+      route = {
+        domain = "files.alexion.dev";
+        port = 3923;
+      };
+      trustedSources = [ "${registry.address.${config.networking.hostName}."reverse-proxy"}/32" ];
+    };
+    volumes = {
+      "/inbox" = {
+        hostPath = "/pikachu/__inbox";
+        path = "/srv/inbox";
+        access.A = [ "alexion" ];
+        flags = [
+          "d2d"
+          "d2t"
+          "dthumb"
+        ];
+      };
+      "/media" = {
+        hostPath = "/pikachu/media";
+        path = "/srv/media";
+        access.A = [ "alexion" ];
+        flags = [
+          "d2d"
+          "d2t"
+          "dthumb"
+        ];
+      };
+    };
+  };
+
+  environment.systemPackages = with pkgs; [
+    pciutils
+    smartmontools
+    usbutils
+  ];
+
+  time.timeZone = "America/New_York";
+  i18n.defaultLocale = "en_GB.UTF-8";
+}

configs/nixos/hosts/pikachu/disk.nix

@@ -0,0 +1,32 @@
+{ ... }:
+# pikachu's install layout for disko: one NVMe boot disk with an EFI system partition and ext4 root.
+# The existing 8 TB ZFS mirror is imported by name and is never declared here.
+{
+  disko.devices.disk.main = {
+    type = "disk";
+    device = "/dev/nvme0n1";
+    content = {
+      type = "gpt";
+      partitions = {
+        ESP = {
+          size = "2G";
+          type = "EF00";
+          content = {
+            type = "filesystem";
+            format = "vfat";
+            mountpoint = "/boot";
+            mountOptions = [ "umask=0077" ];
+          };
+        };
+        root = {
+          size = "100%";
+          content = {
+            type = "filesystem";
+            format = "ext4";
+            mountpoint = "/";
+          };
+        };
+      };
+    };
+  };
+}

configs/nixos/hosts/pikachu/hardware-configuration.nix

@@ -0,0 +1,18 @@
+{ lib, modulesPath, ... }:
+# Hardware detected from the Proxmox inventory for this machine.
+# disko derives the root disk filesystems, none declared here.
+{
+  imports = [ (modulesPath + "/installer/scan/not-detected.nix") ];
+
+  boot.initrd.availableKernelModules = [
+    "ahci"
+    "nvme"
+    "sd_mod"
+    "xhci_pci"
+  ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-intel" ];
+  boot.extraModulePackages = [ ];
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+}

configs/nixos/hosts/pikachu/ssh_host_ed25519_key.pub

@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKljRf4pJO+pqEqjpPz08gOYq3g1PpxvE66xVw7uMEnA root@pikachu

configs/nixos/hosts/pikachu/ssh_host_rsa_key.pub

@@ -0,0 +1 @@
+ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCy/riwm7dflA3mT+3a0/2CIoS2LbAsK/vn35kOoNeuzn0yhiF+imexP6tkB3S2t+H5ybRzkbbuNZcynFfeCqthFc8kvbdCnt8Diqoeg96fZ6ecvh5QE5yH9op8534EySetZ/exakFLnF+6EiWMuWUW3DFwsc2kcgDJObqSE8gTx/d7JK953MiTFmSJBFyg1RtQ3ZnMT+iCrvY2dyCLQai7VeF8koVKF2c0leAq2Hc75rb/L9md8MoJa64iPiz7hwTCin3xoFyaY/5hNVvyqFd5PivgR69gLdJkuVsUYO2mJzhur8cYmJD+pGjJ0U45hyE9TMrCFjeJHHuvSt3+2kph62wv95jLNk0WmMlwgyunISxENCSVVtNYdBMXhUh8VhEAW17QpVUg9EnPvxOdTKEjrvfOZYASWUa51JKbgBgexVgFbxdjDZR88DZa31AVBts/cx/59gXTUahFXMYLdZgssx+5uibZQWnvCyfUV9WLbfmK1lgL6hzReg1VkQ87iGr6skjtQYemJxRaFNA1+Q5f3kmG3KncuK/594a3qXYP4gC6A2blf8om1YZ4aXXh6f+GFKLjoEw1vvM2rJ+rjzfymwDX+pxVQ9L13OEtVZc9Ez76pOkbm1hqdbL0gY45+0cpxodhWV0wMQJBDXL1MHP8qcs+/vw0GxVK5l1SnWBGlw== root@pikachu