alexion
6b5729b98a
The access policy was a separate fleet declaration mapping each machine to a role and a client key, which the module looked up by hostname to derive what to authorize. Authorizing a key needs the key text and nothing else, so the per-machine names, the hostname lookup and the role existed only to reconstruct a grouping that two lists already are. The module now exposes those two lists and the set a machine admits, and a host declares what it draws from in its own file. The fleet declaration is gone, and with it a single-file directory at the repository root. `authorizedKeys` defaults to the workstation keys. An option of a list type is not mandatory the way a scalar one is: undeclared, it yields the empty list rather than failing, and a machine admitting no key is unreachable. The default makes the safe case the silent one. Verified to produce the same system as the design it replaces, and against the running machine in both directions.
56 lines
1.6 KiB
Nix
56 lines
1.6 KiB
Nix
{
|
|
config,
|
|
inputs,
|
|
pkgs,
|
|
...
|
|
}:
|
|
# neogaia — Dell XPS 13 9380 laptop.
|
|
# Disk layout is in ./disk.nix; `fileSystems` are derived from it, none declared here.
|
|
{
|
|
imports = [
|
|
inputs.nixos-hardware.nixosModules.dell-xps-13-9380
|
|
./hardware-configuration.nix
|
|
./disk.nix
|
|
];
|
|
|
|
system.stateVersion = "26.05";
|
|
|
|
# systemd-boot on the EFI system partition.
|
|
boot.loader.systemd-boot.enable = true;
|
|
boot.loader.efi.canTouchEfiVariables = true;
|
|
|
|
boot.kernelPackages = pkgs.linuxPackages_cachyos;
|
|
|
|
# Redistributable firmware for the QCA6174 wifi (ath10k blobs).
|
|
# Intel microcode updates follow from this; none declared here.
|
|
hardware.enableRedistributableFirmware = true;
|
|
|
|
# RAM-backed swap; no on-disk swap partition.
|
|
zramSwap.enable = true;
|
|
|
|
# So wifi can be joined from the console.
|
|
networking.networkmanager.enable = true;
|
|
|
|
# So setup can be driven over the network.
|
|
# The matching host public keys sit beside this file in plaintext, since
|
|
# publishing them is their purpose.
|
|
modules.ssh.enable = true;
|
|
modules.ssh.hostKeys.sopsFile = ../../secrets/neogaia.yaml;
|
|
modules.ssh.userKey.sopsFile = ../../secrets/neogaia.yaml;
|
|
|
|
# A machine the operator works from, so it admits the workstation keys alone.
|
|
modules.ssh.authorizedKeys = config.modules.ssh.workstationKeys;
|
|
|
|
# fish as the login shell.
|
|
modules.fish.enable = true;
|
|
modules.fish.defaultShell = true;
|
|
|
|
modules.git.enable = true;
|
|
modules.tmux.enable = true;
|
|
modules.nvim.enable = true;
|
|
modules.claude-code.enable = true;
|
|
|
|
time.timeZone = "America/New_York";
|
|
i18n.defaultLocale = "en_GB.UTF-8";
|
|
}
|