alexion
f18b40091c
The operator's SSH client key existed only as a file created by hand on one laptop, so a reimage would destroy it and lock the operator out of the remote. It now lives in neogaia's own secrets file, encrypted to the admin identity and neogaia alone, and the client is pointed at the decrypted path rather than a copy in the user's home. Access becomes a policy over roles instead of a per-host list of keys. A new fleet declaration names each machine's role and client public key, and every machine derives what it authorizes from that: a workstation admits workstations alone, a server admits both, so a compromised server reaches no machine of the operator's own. Registering a machine is an entry in that one file. Only neogaia exists, so the server half of the policy is built rather than exercised. Two assertions reject a machine missing from the fleet and any entry whose role no policy defines.
48 lines
1.4 KiB
Nix
48 lines
1.4 KiB
Nix
{ inputs, pkgs, ... }:
|
|
# neogaia — Dell XPS 13 9380 laptop.
|
|
# Disk layout is in ./disk.nix; `fileSystems` are derived from it, none declared here.
|
|
{
|
|
imports = [
|
|
inputs.nixos-hardware.nixosModules.dell-xps-13-9380
|
|
./hardware-configuration.nix
|
|
./disk.nix
|
|
];
|
|
|
|
system.stateVersion = "26.05";
|
|
|
|
# systemd-boot on the EFI system partition.
|
|
boot.loader.systemd-boot.enable = true;
|
|
boot.loader.efi.canTouchEfiVariables = true;
|
|
|
|
boot.kernelPackages = pkgs.linuxPackages_cachyos;
|
|
|
|
# Redistributable firmware for the QCA6174 wifi (ath10k blobs).
|
|
# Intel microcode updates follow from this; none declared here.
|
|
hardware.enableRedistributableFirmware = true;
|
|
|
|
# RAM-backed swap; no on-disk swap partition.
|
|
zramSwap.enable = true;
|
|
|
|
# So wifi can be joined from the console.
|
|
networking.networkmanager.enable = true;
|
|
|
|
# So setup can be driven over the network.
|
|
# The matching host public keys sit beside this file in plaintext, since
|
|
# publishing them is their purpose.
|
|
modules.ssh.enable = true;
|
|
modules.ssh.hostKeys.sopsFile = ../../secrets/neogaia.yaml;
|
|
modules.ssh.userKey.sopsFile = ../../secrets/neogaia.yaml;
|
|
|
|
# fish as the login shell.
|
|
modules.fish.enable = true;
|
|
modules.fish.defaultShell = true;
|
|
|
|
modules.git.enable = true;
|
|
modules.tmux.enable = true;
|
|
modules.nvim.enable = true;
|
|
modules.claude-code.enable = true;
|
|
|
|
time.timeZone = "America/New_York";
|
|
i18n.defaultLocale = "en_GB.UTF-8";
|
|
}
|