alexion
ce103a7353
Wire sops-nix into the shared base config as unconditional plumbing, with a two-tier age identity model: an admin identity held outside the repo, and a per-host identity generated on the machine and kept on its encrypted root. Both `sshKeyPaths` defaults are cleared so the SSH host keys stay out of the decryption path and remain free to become secrets in their own right. The primary user's password hash moves into a shared secrets file encrypted to admin plus neogaia, consumed through `hashedPasswordFile` and decrypted before accounts are created. This needs `users.mutableUsers = false`: NixOS applies a declared hash to an already-existing account only when that flag is false, so at the default the hand-set password would have been kept and the change would have been inert. Root consequently has no password and is locked; sudo from wheel is the way in, and generation rollback remains the recovery path.
67 lines
2.0 KiB
Nix
67 lines
2.0 KiB
Nix
{
|
|
description = "Alexion's NixOS configuration — one flake for every host";
|
|
|
|
inputs = {
|
|
# Base channel.
|
|
nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";
|
|
|
|
# Fresher packages, reachable per-package as `unstable.<name>`.
|
|
nixpkgs-unstable.url = "github:nixos/nixpkgs/nixpkgs-unstable";
|
|
|
|
# Latest stable release, reachable per-package as `stable.<name>`.
|
|
nixpkgs-stable.url = "github:nixos/nixpkgs/nixos-26.05";
|
|
|
|
home-manager = {
|
|
url = "github:nix-community/home-manager";
|
|
inputs.nixpkgs.follows = "nixpkgs";
|
|
};
|
|
|
|
# Follows our nixpkgs so its plugins build against the same package set.
|
|
nixvim = {
|
|
url = "github:nix-community/nixvim";
|
|
inputs.nixpkgs.follows = "nixpkgs";
|
|
};
|
|
|
|
# Declarative disk partitioning; each host declares its own layout.
|
|
disko = {
|
|
url = "github:nix-community/disko";
|
|
inputs.nixpkgs.follows = "nixpkgs";
|
|
};
|
|
|
|
# Upstream per-machine hardware profiles; each host imports its own.
|
|
nixos-hardware = {
|
|
url = "github:NixOS/nixos-hardware";
|
|
inputs.nixpkgs.follows = "nixpkgs";
|
|
};
|
|
|
|
# Decrypts committed secrets at activation, from an age identity on the host.
|
|
sops-nix = {
|
|
url = "github:Mic92/sops-nix";
|
|
inputs.nixpkgs.follows = "nixpkgs";
|
|
};
|
|
|
|
# CachyOS kernel and binary cache. Pins its own nixpkgs so its cache stays
|
|
# usable and the kernel is fetched from it.
|
|
chaotic.url = "github:chaotic-cx/nyx/nyxpkgs-unstable";
|
|
};
|
|
|
|
outputs =
|
|
{ self, nixpkgs, ... }@inputs:
|
|
let
|
|
inherit (nixpkgs) lib;
|
|
my = import ./lib { inherit lib inputs self; };
|
|
in
|
|
{
|
|
# Helper functions for discovering and building hosts.
|
|
lib = my;
|
|
|
|
# Every host under hosts/ is discovered and built.
|
|
nixosConfigurations = my.mkHosts (self + "/hosts");
|
|
|
|
# `nix flake check` builds each host's toplevel.
|
|
checks.x86_64-linux = lib.mapAttrs (
|
|
_name: host: host.config.system.build.toplevel
|
|
) self.nixosConfigurations;
|
|
};
|
|
}
|