From 6a5e8a2dc5d8d04b5bb056c987879d2c2351740c Mon Sep 17 00:00:00 2001 From: Christine Elisabeth Koppel Date: Thu, 12 Feb 2026 15:00:54 +0100 Subject: [PATCH 01/10] Created preliminary foundation of testing the nix systems by Flakes. --- copy_pasta.zsh | 17 ++++++ flake.lock | 27 ++++++++++ flake.nix | 50 +++++++++++++++++ .../sway_greetd_homemanager.nix | 5 +- .../modules/secrets-config/sops-wireguard.nix | 54 +++++++++++++++++++ .../system/blank_system_USE_THIS_AS_COPY.nix | 10 ++-- .../modules/system/compose-songsheet.nix | 19 ++++--- .../modules/system/database.nix | 13 ++--- nix-system-configs/modules/system/forgejo.nix | 12 ++--- .../modules/system/teamspeak.nix | 16 +++--- nix-system-configs/modules/system/traefik.nix | 10 ++-- .../modules/system/wireguard_server.nix | 16 +++--- 12 files changed, 200 insertions(+), 49 deletions(-) create mode 100644 copy_pasta.zsh create mode 100644 flake.lock create mode 100644 flake.nix create mode 100644 nix-system-configs/modules/secrets-config/sops-wireguard.nix diff --git a/copy_pasta.zsh b/copy_pasta.zsh new file mode 100644 index 0000000..0f2792e --- /dev/null +++ b/copy_pasta.zsh @@ -0,0 +1,17 @@ + +export NIX_CONFIG="experimental-features = nix-command flakes" + +echo "=== nix --version ===" +nix --version +echo + +echo "=== nix flake show ===" +nix flake show . +echo + +echo "=== nix eval (raw toplevel) ===" +nix eval --raw .#nixosConfigurations.nixos-local-wireguard-server.config.system.build.toplevel || true +echo + +echo "=== nix build --dry-run ===" +nix build --dry-run .#nixosConfigurations.nixos-local-wireguard-server.config.system.build.toplevel || true \ No newline at end of file diff --git a/flake.lock b/flake.lock new file mode 100644 index 0000000..f732214 --- /dev/null +++ b/flake.lock @@ -0,0 +1,27 @@ +{ + "nodes": { + "nixpkgs": { + "locked": { + "lastModified": 1770770419, + "narHash": "sha256-iKZMkr6Cm9JzWlRYW/VPoL0A9jVKtZYiU4zSrVeetIs=", + "owner": "NixOS", + "repo": "nixpkgs", + "rev": "6c5e707c6b5339359a9a9e215c5e66d6d802fd7a", + "type": "github" + }, + "original": { + "owner": "NixOS", + "ref": "nixos-25.11", + "repo": "nixpkgs", + "type": "github" + } + }, + "root": { + "inputs": { + "nixpkgs": "nixpkgs" + } + } + }, + "root": "root", + "version": 7 +} diff --git a/flake.nix b/flake.nix new file mode 100644 index 0000000..f3c5349 --- /dev/null +++ b/flake.nix @@ -0,0 +1,50 @@ +{ + description = "PRG Server Infrastructure - NixOS Configurations"; + + inputs = { + nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.11"; + }; + + outputs = { self, nixpkgs, ... }: + let + system = "x86_64-linux"; + in + { + nixosConfigurations = { + "nixos-local-wireguard-server" = nixpkgs.lib.nixosSystem { + inherit system; + modules = [ ./nix-system-configs/modules/system/wireguard_server.nix ]; + }; + + "nixos-blank" = nixpkgs.lib.nixosSystem { + inherit system; + modules = [ ./nix-system-configs/modules/system/blank_system_USE_THIS_AS_COPY.nix ]; + }; + + "nixos-songsheet" = nixpkgs.lib.nixosSystem { + inherit system; + modules = [ ./nix-system-configs/modules/system/compose-songsheet.nix ]; + }; + + "nixos-database" = nixpkgs.lib.nixosSystem { + inherit system; + modules = [ ./nix-system-configs/modules/system/database.nix ]; + }; + + "nixos-forgejo" = nixpkgs.lib.nixosSystem { + inherit system; + modules = [ ./nix-system-configs/modules/system/forgejo.nix ]; + }; + + "nixos-teamspeak" = nixpkgs.lib.nixosSystem { + inherit system; + modules = [ ./nix-system-configs/modules/system/teamspeak.nix ]; + }; + + "nixos-traefik" = nixpkgs.lib.nixosSystem { + inherit system; + modules = [ ./nix-system-configs/modules/system/traefik.nix ]; + }; + }; + }; +} diff --git a/nix-system-configs/modules/desktop-manager/sway_greetd_homemanager.nix b/nix-system-configs/modules/desktop-manager/sway_greetd_homemanager.nix index efe791b..cd34a7d 100644 --- a/nix-system-configs/modules/desktop-manager/sway_greetd_homemanager.nix +++ b/nix-system-configs/modules/desktop-manager/sway_greetd_homemanager.nix @@ -4,7 +4,10 @@ lib, ... }: let - home-manager = builtins.fetchTarball "https://github.com/nix-community/home-manager/archive/release-25.11.tar.gz"; + home-manager = builtins.fetchTarball { + url = "https://github.com/nix-community/home-manager/archive/release-25.11.tar.gz"; + sha256 = "1kqxy6r4ahnbazmpa4pncdp62najdikdaw8hvrv8nl6qxvbmf9fy"; + }; cfg = config.services.forgejo; srv = cfg.settings.server; in { diff --git a/nix-system-configs/modules/secrets-config/sops-wireguard.nix b/nix-system-configs/modules/secrets-config/sops-wireguard.nix new file mode 100644 index 0000000..73f7041 --- /dev/null +++ b/nix-system-configs/modules/secrets-config/sops-wireguard.nix @@ -0,0 +1,54 @@ +{ + config, + pkgs, + lib, + ... +}: { + imports = let + # replace this with an actual commit id or tag + commit = "17eea6f3816ba6568b8c81db8a4e6ca438b30b7c"; + in [ + "${builtins.fetchTarball { + url = "https://github.com/Mic92/sops-nix/archive/${commit}.tar.gz"; + # replace this with an actual hash + sha256 = "ktjWTq+D5MTXQcL9N6cDZXUf9kX8JBLLBLT0ZyOTSYY="; + }}/modules/sops" + ]; + + # This will add secrets.yml to the nix store + # You can avoid this by adding a string to the full path instead, i.e. + # sops.defaultSopsFile = "/root/.sops/secrets/example.yaml"; + sops.defaultSopsFile = ../../secrets/wireguard/secrets.yaml; + # This will automatically import SSH keys as age keys + #sops.age.sshKeyPaths = ["/home/nixosdd/.ssh/id_ed25519"]; + # This is using an age key that is expected to already be in the filesystem + sops.age.keyFile = "/var/lib/sops-nix/key.txt"; + # This will generate a new key if the key specified above does not exist + sops.age.generateKey = true; + + # Export individual WireGuard keys from the SOPS YAML as text secrets so they + # are available both as strings and as files (.path) + sops.secrets."wireguard_private" = { + format = "yaml"; + sopsFile = ../../secrets/wireguard/secrets.yaml; + owner = "root"; + mode = "0400"; + }; + + sops.secrets."wireguard_preshared" = { + format = "yaml"; + sopsFile = ../../secrets/wireguard/secrets.yaml; + owner = "root"; + mode = "0400"; + }; + + sops.secrets."wireguard_public" = { + format = "yaml"; + sopsFile = ../../secrets/wireguard/secrets.yaml; + owner = "root"; + mode = "0444"; + }; + + + +} diff --git a/nix-system-configs/modules/system/blank_system_USE_THIS_AS_COPY.nix b/nix-system-configs/modules/system/blank_system_USE_THIS_AS_COPY.nix index 6fa22ea..41384a0 100644 --- a/nix-system-configs/modules/system/blank_system_USE_THIS_AS_COPY.nix +++ b/nix-system-configs/modules/system/blank_system_USE_THIS_AS_COPY.nix @@ -28,11 +28,11 @@ }; imports = [ - ./modules/desktop-manager/sway_greetd_homemanager.nix - ./modules/local/hostname_username.nix - ./modules/local/networking_local.nix - ./modules/bootloader/seabios-assigned-iso-at-birth.nix - ./modules/lix-default.nix + ../desktop-manager/sway_greetd_homemanager.nix + ../local/hostname_username.nix + ../local/networking_local.nix + ../bootloader/seabios-assigned-iso-at-birth.nix + ../lix-default.nix # Optionally to enable remote building: ./modules/toolsets/remote_building.nix #./modules/songsheet/wavelog/docker-compose.nix #./modules/secrets-config/sops-the-blank-system.nix diff --git a/nix-system-configs/modules/system/compose-songsheet.nix b/nix-system-configs/modules/system/compose-songsheet.nix index 2a83324..89a2148 100644 --- a/nix-system-configs/modules/system/compose-songsheet.nix +++ b/nix-system-configs/modules/system/compose-songsheet.nix @@ -28,17 +28,16 @@ }; imports = [ - ./modules/desktop-manager/sway_greetd_homemanager.nix - ./modules/local/hostname_username.nix - ./modules/local/networking_local.nix - ./modules/bootloader/seabios-assigned-iso-at-birth.nix - ./modules/lix-default.nix - # Optionally: ./modules/toolsets/remote_building.nix - # - # + ../desktop-manager/sway_greetd_homemanager.nix + ../local/hostname_username.nix + ../local/networking_local.nix + ../bootloader/seabios-assigned-iso-at-birth.nix + ../lix-default.nix + # Optionally: ../toolsets/remote_building.nix + ## Compose modules for Portainer service - ./modules/songsheet/wavelog/docker-compose.nix - ./modules/secrets-config/sops-composesongsheet.nix + ../songsheet/wavelog/docker-compose.nix + ../secrets-config/sops-composesongsheet.nix ]; config = { diff --git a/nix-system-configs/modules/system/database.nix b/nix-system-configs/modules/system/database.nix index fdac7b9..7255081 100644 --- a/nix-system-configs/modules/system/database.nix +++ b/nix-system-configs/modules/system/database.nix @@ -28,12 +28,13 @@ }; imports = [ - ./modules/desktop-manager/gnome.nix - ./modules/local/hostname_username.nix - ./modules/local/networking_local.nix - ./modules/lix-default.nix - ./modules/secrets-config/sops-database.nix - ./modules/system_scripts/gcloud_backup.nix + ../desktop-manager/gnome.nix + ../local/hostname_username.nix + ../local/networking_local.nix + ../bootloader/seabios-assigned-iso-at-birth.nix + ../lix-default.nix + ../secrets-config/sops-database.nix + ../system_scripts/gcloud_backup.nix ./hardware-configuration.nix ]; diff --git a/nix-system-configs/modules/system/forgejo.nix b/nix-system-configs/modules/system/forgejo.nix index f000f9f..583c0f7 100644 --- a/nix-system-configs/modules/system/forgejo.nix +++ b/nix-system-configs/modules/system/forgejo.nix @@ -32,12 +32,12 @@ in { }; imports = [ - ./modules/desktop-manager/sway_greetd_homemanager.nix - ./modules/local/hostname_username.nix - ./modules/local/networking_local.nix - ./modules/toolsets/remote_building.nix - ./modules/bootloader/seabios-assigned-proxmox-at-birth.nix - ./modules/lix-default.nix + ../desktop-manager/sway_greetd_homemanager.nix + ../local/hostname_username.nix + ../local/networking_local.nix + ../toolsets/remote_building.nix + ../bootloader/seabios-assigned-proxmox-at-birth.nix + ../lix-default.nix ]; config = { diff --git a/nix-system-configs/modules/system/teamspeak.nix b/nix-system-configs/modules/system/teamspeak.nix index 7427647..6f89dbd 100644 --- a/nix-system-configs/modules/system/teamspeak.nix +++ b/nix-system-configs/modules/system/teamspeak.nix @@ -28,17 +28,15 @@ }; imports = [ - ./modules/desktop-manager/sway_greetd_homemanager.nix - ./modules/local/hostname_username.nix - ./modules/local/networking_local.nix - ./modules/bootloader/seabios-assigned-iso-at-birth.nix - ./modules/lix-default.nix + ../desktop-manager/sway_greetd_homemanager.nix + ../local/hostname_username.nix + ../local/networking_local.nix + ../bootloader/seabios-assigned-iso-at-birth.nix + ../lix-default.nix # Optionally: ./modules/toolsets/remote_building.nix - # - # ## Compose modules for Portainer service - ./modules/songsheet/wavelog/docker-compose.nix - ./modules/secrets-config/sops-composesongsheet.nix + ../songsheet/wavelog/docker-compose.nix + ../secrets-config/sops-composesongsheet.nix ]; config = { diff --git a/nix-system-configs/modules/system/traefik.nix b/nix-system-configs/modules/system/traefik.nix index 3613882..07d2ac8 100644 --- a/nix-system-configs/modules/system/traefik.nix +++ b/nix-system-configs/modules/system/traefik.nix @@ -28,11 +28,11 @@ }; imports = [ - ./modules/desktop-manager/sway_greetd_homemanager.nix - ./modules/local/hostname_username.nix - ./modules/local/networking_local.nix - ./modules/bootloader/seabios-assigned-iso-at-birth.nix - ./modules/lix-default.nix + ../desktop-manager/sway_greetd_homemanager.nix + ../local/hostname_username.nix + ../local/networking_local.nix + ../bootloader/seabios-assigned-iso-at-birth.nix + ../lix-default.nix # Optionally: ./modules/toolsets/remote_building.nix ]; diff --git a/nix-system-configs/modules/system/wireguard_server.nix b/nix-system-configs/modules/system/wireguard_server.nix index 71be160..db47c70 100644 --- a/nix-system-configs/modules/system/wireguard_server.nix +++ b/nix-system-configs/modules/system/wireguard_server.nix @@ -28,11 +28,12 @@ }; imports = [ - ./modules/desktop-manager/sway_greetd_homemanager.nix - ./modules/local/hostname_username.nix - ./modules/local/networking_local.nix - ./modules/bootloader/seabios-assigned-iso-at-birth.nix - ./modules/lix-default.nix + ../desktop-manager/sway_greetd_homemanager.nix + ../local/hostname_username.nix + ../local/networking_local.nix + ../bootloader/seabios-assigned-iso-at-birth.nix + ../lix-default.nix + ../secrets-config/sops-wireguard.nix # Optionally to enable remote building: ./modules/toolsets/remote_building.nix #./modules/songsheet/wavelog/docker-compose.nix #./modules/secrets-config/sops-the-blank-system.nix @@ -76,18 +77,19 @@ # Why 5182(0)? WireGuard server is running on port 51820, # thus we can use the "5182" infix in the IPv6 prefix to make it more memorable and less likely to cause confusion # with other local network services in the future. - postUp = '' + postSetup = '' ${pkgs.iptables}/bin/ip6tables -A FORWARD -i wg0 -j ACCEPT ${pkgs.iptables}/bin/ip6tables -t nat -A POSTROUTING -s fc00:5182::1:1/112 -o eth0 -j MASQUERADE ''; # Undo the above - preDown = '' + postShutdown = '' ${pkgs.iptables}/bin/ip6tables -D FORWARD -i wg0 -j ACCEPT ${pkgs.iptables}/bin/ip6tables -t nat -D POSTROUTING -s fc00:5182::1:1/112 -o eth0 -j MASQUERADE ''; privateKeyFile = config.sops.secrets.wireguard_private.path; + #presharedKeyFile = config.sops.secrets.wireguard_preshared.path; }; }; From b66ab168d68f8893651f753c567d5eeef3d818db Mon Sep 17 00:00:00 2001 From: Christine Elisabeth Koppel Date: Thu, 12 Feb 2026 15:05:42 +0100 Subject: [PATCH 02/10] Additional documentation of how to add and test deployed systems. --- documentation_titlepage.md | 40 ++++++++++++++++++++++++++++++++++++++ 1 file changed, 40 insertions(+) diff --git a/documentation_titlepage.md b/documentation_titlepage.md index ee020cf..eb7dbd6 100644 --- a/documentation_titlepage.md +++ b/documentation_titlepage.md @@ -171,6 +171,46 @@ Synchronizes local system changes back to the repository. This script: 5. Syncs changes from `/etc/nixos/modules` back to the repository 6. Stages, commits, and pushes changes to the remote git repository with a timestamped commit message +## Adding New Systems + +To add a new system configuration to the infrastructure: + +1. **Create the configuration file** in `nix-system-configs/modules/system/`: + ```bash + cp nix-system-configs/modules/system/blank_system_USE_THIS_AS_COPY.nix \ + nix-system-configs/modules/system/your-new-system.nix + ``` + +2. **Edit the configuration** to set your system's unique properties: + ```nix + config = { + local.hostname = "nixos-your-system"; + local.username = "yourusername"; + local.userDescription = "Your System Description"; + local.address = "10.XXX.XXX.XXX"; # Choose an available IP + + system.stateVersion = "25.11"; + }; + ``` + +3. **Register in `flake.nix`** to make it available for builds: + ```nix + nixosConfigurations = { + # ...existing configurations... + + "nixos-your-system" = nixpkgs.lib.nixosSystem { + inherit system; + modules = [ ./nix-system-configs/modules/system/your-new-system.nix ]; + }; + }; + ``` +4. ***IF YOU WANT TO CHECK IT MANUALLY*** - **Test the configuration** before deploying, change the `nixos-your-system` accordingly: + ```bash + nix build .#nixosConfigurations.nixos-your-system.config.system.build.toplevel + ``` + +Once the build succeeds, the configuration is ready for deployment using the `pull.zsh` script on the target machine. + ## How to maintain the local machines > [!NOTE] The following maintenance scripts should be made less unwieldy to use, so they will be changed in the next From c7d4fc7e473462ac9e7d2b73d6249b672b463e22 Mon Sep 17 00:00:00 2001 From: Christine Elisabeth Koppel Date: Thu, 12 Feb 2026 16:50:52 +0100 Subject: [PATCH 03/10] Sunset the build machine configuration and move it to the newer format. Setup the Forgejo Runner. --- .sops.yaml | 8 +- flake.nix | 75 +++-- .../configuration.nix | 0 .../modules/secrets-config/notes.md | 3 +- .../secrets-config/sops-build-machine.nix | 38 +++ .../modules/secrets-config/sops-wireguard.nix | 15 +- .../modules/system/build_machine.nix | 294 ++++++++++++++++++ .../secrets/build_machine/secrets.yaml | 25 ++ 8 files changed, 413 insertions(+), 45 deletions(-) rename nix-system-configs/{build => build-deprecated}/configuration.nix (100%) create mode 100644 nix-system-configs/modules/secrets-config/sops-build-machine.nix create mode 100644 nix-system-configs/modules/system/build_machine.nix create mode 100644 nix-system-configs/secrets/build_machine/secrets.yaml diff --git a/.sops.yaml b/.sops.yaml index df91613..4fdecd4 100644 --- a/.sops.yaml +++ b/.sops.yaml @@ -3,6 +3,7 @@ keys: - &server_songsheet age1la8yjuc2ws9pyx70rc83jd2084v5e08v8fvh6muvfzrl2ulp8fms6frs86 - &server_traefik age1rdcs8y4fjfyagwt2q9599ax329thceersh6dg2f0p6nsghm5xufq00qu0p - &server_database age1k9ddvzypz986a7dt403ja6evql2agz0gehll79mx64zceteya38smxph8m + - &server_build_machine age1xtsm7kmql8794756ls53eu8pusyadk4lauadxx867tgsjhd38y5sj7elca - &server_christine age1kzsrlz86y5nqe4vaufv8chupq2hrf3avlmxsp3d5p9t5xj593deszslkmp creation_rules: - path_regex: nix-system-configs/secrets/songsheet/[^/]+\.(yaml|json|env|ini)$ @@ -28,4 +29,9 @@ creation_rules: - path_regex: nix-system-configs/secrets/wireguard/[^/]+\.(yaml|json|env|ini)$ key_groups: - age: - - *admin_christine \ No newline at end of file + - *admin_christine + - path_regex: nix-system-configs/secrets/build_machine/[^/]+\.(yaml|json|env|ini)$ + key_groups: + - age: + - *admin_christine + - *server_build_machine \ No newline at end of file diff --git a/flake.nix b/flake.nix index f3c5349..ad1ebd7 100644 --- a/flake.nix +++ b/flake.nix @@ -5,46 +5,53 @@ nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.11"; }; - outputs = { self, nixpkgs, ... }: - let - system = "x86_64-linux"; - in - { - nixosConfigurations = { - "nixos-local-wireguard-server" = nixpkgs.lib.nixosSystem { - inherit system; - modules = [ ./nix-system-configs/modules/system/wireguard_server.nix ]; - }; + outputs = { + self, + nixpkgs, + ... + }: let + system = "x86_64-linux"; + in { + nixosConfigurations = { + "nixos-local-wireguard-server" = nixpkgs.lib.nixosSystem { + inherit system; + modules = [./nix-system-configs/modules/system/wireguard_server.nix]; + }; - "nixos-blank" = nixpkgs.lib.nixosSystem { - inherit system; - modules = [ ./nix-system-configs/modules/system/blank_system_USE_THIS_AS_COPY.nix ]; - }; + "nixos-blank" = nixpkgs.lib.nixosSystem { + inherit system; + modules = [./nix-system-configs/modules/system/blank_system_USE_THIS_AS_COPY.nix]; + }; - "nixos-songsheet" = nixpkgs.lib.nixosSystem { - inherit system; - modules = [ ./nix-system-configs/modules/system/compose-songsheet.nix ]; - }; + "nixos-songsheet" = nixpkgs.lib.nixosSystem { + inherit system; + modules = [./nix-system-configs/modules/system/compose-songsheet.nix]; + }; - "nixos-database" = nixpkgs.lib.nixosSystem { - inherit system; - modules = [ ./nix-system-configs/modules/system/database.nix ]; - }; + "nixos-database" = nixpkgs.lib.nixosSystem { + inherit system; + modules = [./nix-system-configs/modules/system/database.nix]; + }; - "nixos-forgejo" = nixpkgs.lib.nixosSystem { - inherit system; - modules = [ ./nix-system-configs/modules/system/forgejo.nix ]; - }; + "nixos-forgejo" = nixpkgs.lib.nixosSystem { + inherit system; + modules = [./nix-system-configs/modules/system/forgejo.nix]; + }; - "nixos-teamspeak" = nixpkgs.lib.nixosSystem { - inherit system; - modules = [ ./nix-system-configs/modules/system/teamspeak.nix ]; - }; + "nixos-teamspeak" = nixpkgs.lib.nixosSystem { + inherit system; + modules = [./nix-system-configs/modules/system/teamspeak.nix]; + }; - "nixos-traefik" = nixpkgs.lib.nixosSystem { - inherit system; - modules = [ ./nix-system-configs/modules/system/traefik.nix ]; - }; + "nixos-traefik" = nixpkgs.lib.nixosSystem { + inherit system; + modules = [./nix-system-configs/modules/system/traefik.nix]; + }; + + "nixos-build-machine" = nixpkgs.lib.nixosSystem { + inherit system; + modules = [./nix-system-configs/modules/system/build_machine.nix]; }; }; + }; } diff --git a/nix-system-configs/build/configuration.nix b/nix-system-configs/build-deprecated/configuration.nix similarity index 100% rename from nix-system-configs/build/configuration.nix rename to nix-system-configs/build-deprecated/configuration.nix diff --git a/nix-system-configs/modules/secrets-config/notes.md b/nix-system-configs/modules/secrets-config/notes.md index a0c2863..9218e2a 100644 --- a/nix-system-configs/modules/secrets-config/notes.md +++ b/nix-system-configs/modules/secrets-config/notes.md @@ -1,6 +1,7 @@ To generate the keys beforehand ```ssh nix-shell -p age -/var/lib/sops-nix/key.txt +sudo mkdir /var/lib/sops-nix +age-keygen -o /var/lib/sops-nix/key.txt ``` And then update the .sops.yaml in the project directory accordingly. \ No newline at end of file diff --git a/nix-system-configs/modules/secrets-config/sops-build-machine.nix b/nix-system-configs/modules/secrets-config/sops-build-machine.nix new file mode 100644 index 0000000..8dee242 --- /dev/null +++ b/nix-system-configs/modules/secrets-config/sops-build-machine.nix @@ -0,0 +1,38 @@ +{ + config, + pkgs, + lib, + ... +}: { + imports = let + # replace this with an actual commit id or tag + commit = "17eea6f3816ba6568b8c81db8a4e6ca438b30b7c"; + in [ + "${builtins.fetchTarball { + url = "https://github.com/Mic92/sops-nix/archive/${commit}.tar.gz"; + # replace this with an actual hash + sha256 = "ktjWTq+D5MTXQcL9N6cDZXUf9kX8JBLLBLT0ZyOTSYY="; + }}/modules/sops" + ]; + + # This will add secrets.yml to the nix store + # You can avoid this by adding a string to the full path instead, i.e. + # sops.defaultSopsFile = "/root/.sops/secrets/example.yaml"; + sops.defaultSopsFile = ../../secrets/build_machine/secrets.yaml; + # This will automatically import SSH keys as age keys + #sops.age.sshKeyPaths = ["/home/nixosdd/.ssh/id_ed25519"]; + # This is using an age key that is expected to already be in the filesystem + sops.age.keyFile = "/var/lib/sops-nix/key.txt"; + # This will generate a new key if the key specified above does not exist + sops.age.generateKey = true; + + # Export individual WireGuard keys from the SOPS YAML as text secrets so they + # are available both as strings and as files (.path) + sops.secrets.":" = { + format = "yaml"; + sopsFile = ../../secrets/build_machine/secrets.yaml; + owner = "root"; + mode = "0400"; + }; + +} diff --git a/nix-system-configs/modules/secrets-config/sops-wireguard.nix b/nix-system-configs/modules/secrets-config/sops-wireguard.nix index 73f7041..35d48c6 100644 --- a/nix-system-configs/modules/secrets-config/sops-wireguard.nix +++ b/nix-system-configs/modules/secrets-config/sops-wireguard.nix @@ -35,12 +35,12 @@ mode = "0400"; }; - sops.secrets."wireguard_preshared" = { - format = "yaml"; - sopsFile = ../../secrets/wireguard/secrets.yaml; - owner = "root"; - mode = "0400"; - }; + sops.secrets."wireguard_preshared" = { + format = "yaml"; + sopsFile = ../../secrets/wireguard/secrets.yaml; + owner = "root"; + mode = "0400"; + }; sops.secrets."wireguard_public" = { format = "yaml"; @@ -48,7 +48,4 @@ owner = "root"; mode = "0444"; }; - - - } diff --git a/nix-system-configs/modules/system/build_machine.nix b/nix-system-configs/modules/system/build_machine.nix new file mode 100644 index 0000000..3c5f069 --- /dev/null +++ b/nix-system-configs/modules/system/build_machine.nix @@ -0,0 +1,294 @@ +{ + config, + pkgs, + lib, + ... +}: { + options.local = { + hostname = lib.mkOption { + type = lib.types.str; + default = "nixos-build-machine"; + description = "System hostname"; + }; + username = lib.mkOption { + type = lib.types.str; + default = "nixosbm"; + description = "Primary user username"; + }; + userDescription = lib.mkOption { + type = lib.types.str; + default = "NixOS Build Machine"; + description = "Primary user description"; + }; + address = lib.mkOption { + type = lib.types.str; + default = "10.1.1.3"; + description = "Static IP address"; + }; + }; + + imports = [ + ../local/hostname_username.nix + ../local/networking_local.nix + ../bootloader/seabios-assigned-iso-at-birth.nix + ../lix-default.nix + ../secrets-config/sops-build-machine.nix + ]; + + config = { + # Local metadata + local.hostname = "nixos-build-machine"; + local.username = "nixosbm"; + local.userDescription = "NixOS Build Machine"; + local.address = "10.1.1.3"; + + # Add Lix instead of Nix + nixpkgs.overlays = [ + (final: prev: { + inherit + (prev.lixPackageSets.stable) + nixpkgs-review + nix-eval-jobs + nix-fast-build + colmena + ; + }) + ]; + + nix.package = pkgs.lixPackageSets.stable.lix; + + # Enable Rsync + services.rsync.enable = true; + + # Passwordless sudo for wheel group + security.sudo.wheelNeedsPassword = false; + + # Hardware U2F support - Passwordless sudo with hardware key + security.pam.u2f = { + enable = true; + settings = { + authfile = "/etc/u2f_keys"; + cue = true; + pinverification = 0; # No PIN verification + userpresence = 1; # Require user presence (touch) + }; + }; + + # Optimize builds + nix.settings = { + # Enable parallel building + max-jobs = "auto"; + cores = 0; # Use all available cores + + # Optimize store operations + auto-optimise-store = true; + + # Build settings + sandbox = true; + keep-outputs = true; + keep-derivations = true; + }; + + # Enable distributed builds (optional, for your VM setup) + nix.buildMachines = []; + nix.distributedBuilds = false; + + # Optimize garbage collection + nix.gc = { + automatic = true; + dates = "weekly"; + options = "--delete-older-than 30d"; + }; + + # Increase build speed with tmpfs for builds (if you have enough RAM) + # Comment out if low on memory + systemd.services.nix-daemon.environment = { + TMPDIR = "/tmp"; + }; + boot.tmp.useTmpfs = true; + boot.tmp.tmpfsSize = "50%"; # Adjust based on your 62GB RAM + + # SSH Agent authentication + security.pam.sshAgentAuth.enable = true; + + # Automatic upgrades + system.autoUpgrade = { + enable = true; # Set to true for automatic updates + dates = "daily"; + allowReboot = false; + }; + + # Bootloader fallback settings are provided by the seabios import + # (seabios-assigned-iso-at-birth.nix) + + # Enable Tailscale + services.tailscale.enable = true; + + networking.hostName = local.hostname; # Define your hostname. + + # Enable networking + networking.networkmanager.enable = true; + + # Set your time zone. + time.timeZone = "Europe/Copenhagen"; + + # Select internationalisation properties. + i18n.defaultLocale = "en_AU.UTF-8"; + + i18n.extraLocaleSettings = { + LC_ADDRESS = "en_AU.UTF-8"; + LC_IDENTIFICATION = "en_AU.UTF-8"; + LC_MEASUREMENT = "en_AU.UTF-8"; + LC_MONETARY = "en_AU.UTF-8"; + LC_NAME = "en_AU.UTF-8"; + LC_NUMERIC = "en_AU.UTF-8"; + LC_PAPER = "en_AU.UTF-8"; + LC_TELEPHONE = "en_AU.UTF-8"; + LC_TIME = "en_AU.UTF-8"; + }; + + # Configure keymap in X11 + services.xserver.xkb = { + layout = "au"; + variant = ""; + }; + + # Define a user account. Don't forget to set a password with ‘passwd’. + users.users.nixosbm = { + isNormalUser = true; + description = "NixOS Build Machine"; + extraGroups = ["networkmanager" "wheel"]; + packages = with pkgs; []; + }; + + # Remote builder server setup + users.users.nixremote = { + isNormalUser = true; + description = "Nix Remote Builder"; + home = "/home/nixremote"; + createHome = true; + + # Lock the user account (no login shell) + shell = pkgs.shadow; + + # SSH key for remote builds + openssh.authorizedKeys.keys = [ + # Add the public key from your client machines here + # Example: "ssh-ed25519 AAAAC3... root@client-machine" + ]; + }; + + systemd.tmpfiles.rules = [ + "z /home/nixremote 0555 nixremote nixremote - -" + "z /home/nixremote/.ssh 0555 nixremote nixremote - -" + ]; + + # Allow unfree packages + nixpkgs.config.allowUnfree = true; + + # List packages installed in system profile. To search, run: + # $ nix search wget + environment.systemPackages = with pkgs; [ + wget + fastfetch + hyfetch + helix + ]; + + programs.gnupg.agent = { + enable = true; + enableSSHSupport = true; + }; + + # Enable the OpenSSH daemon. + services.openssh.enable = true; + + # Network configuration for the build machine on the Proxmox bridge + networking.interfaces.ens18.ipv4.addresses = [ + { + address = local.address; + #dns = "10.1.1.2"; + prefixLength = 24; + } + ]; + networking.defaultGateway = "10.1.1.1"; + environment.etc."resolv.conf".text = '' + nameserver 10.1.1.2 + ''; + + services.gitea-actions-runner = { + package = pkgs.forgejo-runner; + instances.default = { + enable = true; + name = "monolith"; + url = "https://git.prg-radio.org"; + # Obtaining the path to the runner token file may differ + # tokenFile should be in format TOKEN=, since it's EnvironmentFile for systemd + tokenFile = config.sops.secrets.runner_token.path; + labels = [ + "lix:docker://git.lix.systems/lix-project/lix:latest" + "nix:docker://git.lix.systems/lix-project/lix:latest" + "ubuntu-bleeding-edge:docker://ubuntu:resolute" + "ubuntu-latest:docker://ubuntu:plucky" + "ubuntu-24.04:docker://ubuntu:noble" + "alpine:docker://alpine:edge" + "rust:docker://rust:trixie" + "python-315:docker://python:3.15.0a6-slim-trixie" + ]; + }; + }; + + # This value determines the NixOS release from which the default + # settings for stateful data, like file locations and database versions + # on your system were taken. It‘s perfectly fine and recommended to leave + # this value at the release version of the first install of this system. + # Before changing this value read the documentation for this option + # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html). + system.stateVersion = "25.11"; # Did you read the comment? + + # Helpful commented examples for remote-build configuration retained from original + # THE FOLLOWING CODE BLOCK IS FOR COPYING TO OTHER CONFIGURATIONS, NOT FOR THIS FILE + # nix.distributedBuilds = true; + # nix.buildMachines = [ + # { + # hostName = "nixos-build-machine"; + # system = "x86_64-linux"; + # sshUser = "nixremote"; + # sshKey = "/root/.ssh/nixremote"; + # maxJobs = 4; + # speedFactor = 2; + # supportedFeatures = [ "nixos-test" "benchmark" "big-parallel" "kvm" ]; + # } + # ]; + # + # Generate SSH key for remote building + #systemd.services.generate-nixremote-key = { + # description = "Generate SSH key for remote Nix builds"; + # wantedBy = [ "multi-user.target" ]; + # serviceConfig = { + # Type = "oneshot"; + # RemainAfterExit = true; + # }; + # script = '' + # if [ ! -f /root/.ssh/nixremote ]; then + # ${pkgs.openssh}/bin/ssh-keygen -t ed25519 -f /root/.ssh/nixremote -N "" -C "nix-remote-builder" + # fi + # ''; + #}; + # + #programs.ssh.extraConfig = '' + # Host nixos-build-machine + # HostName 192.168.1.175 + # IdentitiesOnly yes + # IdentityFile /root/.ssh/nixremote + # User nixremoteStrictHostKeyChecking accept-new + #''; + # + # Manual step required: After rebuilding the client, copy /root/.ssh/nixremote.pub + # from the client to the build machine's users.users.nixremote.openssh.authorizedKeys.keys list, + # then rebuild the build machine. + # i.e on the client: run "cat /root.ssh/nixremote.pub" + # and copy the output to the build machine's configuration.nix + }; +} + diff --git a/nix-system-configs/secrets/build_machine/secrets.yaml b/nix-system-configs/secrets/build_machine/secrets.yaml new file mode 100644 index 0000000..4ca6a75 --- /dev/null +++ b/nix-system-configs/secrets/build_machine/secrets.yaml @@ -0,0 +1,25 @@ +runner_token: ENC[AES256_GCM,data:SZnND7nTNwrYrQDKkurH1SoZLygFkVbAJFFcCcuDRbqSGGV49TQizw==,iv:wY33GdeQ13xC7gRjVM4UiVgZbvtrfQPUuveUJw8Bj0k=,tag:dSL6gmKGYxZemecD/l5eRQ==,type:str] +sops: + age: + - recipient: age1746rvsvsc3snxfl7cndm222wd5kck4aqj3x7nednlegq0gdjhfcqx0qv7m + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB1WEE5MUJiK0tUSmZMMXVq + LzdON0trT0NYbXZXdkluak9xQVlHM0F2OVI4CnFmaEpEdEVMalgxQjJMalp3Mjl3 + M3l2WXpQVnZjYmtNSEJIWVR5cWlUbEEKLS0tIDNtVHRnRVl5RWdmRmNXYVFRbkNq + TFZpeGwrM2V3aWRybGE2WVNQRW5QV0kKdJb7svK5k5rYMtfiTsJy5QE3+1MP04jz + zadKKK+kDaK+h4AmkFGLRoKLpJoEU2nEUo2FD4LxiGOOvSXmeOUxbw== + -----END AGE ENCRYPTED FILE----- + - recipient: age1xtsm7kmql8794756ls53eu8pusyadk4lauadxx867tgsjhd38y5sj7elca + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBGUEdoMkVyMjVsOG1LYkRW + M08xemlxRHU4THRidWZXZFhEdXFBV05YUFZRCjlpeERUbWVjY0cxMlk5elk1VHFn + UXgzNmVhbWh3MytRNXlJdkJ0ak4vQXcKLS0tIGZ1eEU2UjIxcmw1ZnVwTFVZSHMx + U3hva2JqWUdjR2JzTmpFanppUk5MTmsKwD8rlnddUQkgtuZLTgpmS4jGRmgNReUN + mEx0pxnWIIrLUGRgwE3WDbBVRTqVo1ai6BZY3FzBCnXU6zbNwYhqIg== + -----END AGE ENCRYPTED FILE----- + lastmodified: "2026-02-12T14:23:57Z" + mac: ENC[AES256_GCM,data:DorP7hsnq582LR5fQDFVBy6xtPEMIlvLKPYdK6h7Nq6ajAMquiU8i33IfMzEnLWC6oa4soiIZA+LBMlHR7LCKOQWvdHp8k8q08MbqlMLQO3yH/Lc+J2W8v1SQwPlEXUwF4DIuzCos0D1IfpD/f2gQ2SAmbIJkJHMkviJM76YiqY=,iv:Yzu0GjZhimt6Yk3bZvGfIHz55pPI/gZyJKv99SsSWec=,tag:/ytugAI8voXt0nb9uV8nlA==,type:str] + unencrypted_suffix: _unencrypted + version: 3.11.0 From 3ac51c3662f224115d425344a746e9ca830d2d52 Mon Sep 17 00:00:00 2001 From: Christine Elisabeth Koppel Date: Thu, 12 Feb 2026 17:37:54 +0100 Subject: [PATCH 04/10] Build machine config change and fixes, improve the dry running, move about the some configs when using builtin hardware-configuration.nix, and fix some syntax issues. --- copy_pasta.zsh | 27 ++++++--- .../secrets-config/sops-build-machine.nix | 2 +- .../modules/system/build_machine.nix | 57 +++---------------- .../modules/system/database.nix | 4 +- 4 files changed, 31 insertions(+), 59 deletions(-) diff --git a/copy_pasta.zsh b/copy_pasta.zsh index 0f2792e..9fe02d0 100644 --- a/copy_pasta.zsh +++ b/copy_pasta.zsh @@ -1,3 +1,4 @@ +#!/usr/bin/env zsh export NIX_CONFIG="experimental-features = nix-command flakes" @@ -5,13 +6,23 @@ echo "=== nix --version ===" nix --version echo -echo "=== nix flake show ===" -nix flake show . -echo +configs=( + "nixos-local-wireguard-server" + "nixos-blank" + "nixos-songsheet" + "nixos-database" + "nixos-forgejo" + "nixos-teamspeak" + "nixos-traefik" + "nixos-build-machine" +) -echo "=== nix eval (raw toplevel) ===" -nix eval --raw .#nixosConfigurations.nixos-local-wireguard-server.config.system.build.toplevel || true -echo +if [[ -n "$1" ]]; then + configs=("$1") +fi -echo "=== nix build --dry-run ===" -nix build --dry-run .#nixosConfigurations.nixos-local-wireguard-server.config.system.build.toplevel || true \ No newline at end of file +for config in "${configs[@]}"; do + echo "=== Dry-run: $config ===" + nix build --dry-run ".#nixosConfigurations.${config}.config.system.build.toplevel" || true + echo +done diff --git a/nix-system-configs/modules/secrets-config/sops-build-machine.nix b/nix-system-configs/modules/secrets-config/sops-build-machine.nix index 8dee242..d66aeda 100644 --- a/nix-system-configs/modules/secrets-config/sops-build-machine.nix +++ b/nix-system-configs/modules/secrets-config/sops-build-machine.nix @@ -28,7 +28,7 @@ # Export individual WireGuard keys from the SOPS YAML as text secrets so they # are available both as strings and as files (.path) - sops.secrets.":" = { + sops.secrets."runner_token" = { format = "yaml"; sopsFile = ../../secrets/build_machine/secrets.yaml; owner = "root"; diff --git a/nix-system-configs/modules/system/build_machine.nix b/nix-system-configs/modules/system/build_machine.nix index 3c5f069..2bc2328 100644 --- a/nix-system-configs/modules/system/build_machine.nix +++ b/nix-system-configs/modules/system/build_machine.nix @@ -42,21 +42,6 @@ local.userDescription = "NixOS Build Machine"; local.address = "10.1.1.3"; - # Add Lix instead of Nix - nixpkgs.overlays = [ - (final: prev: { - inherit - (prev.lixPackageSets.stable) - nixpkgs-review - nix-eval-jobs - nix-fast-build - colmena - ; - }) - ]; - - nix.package = pkgs.lixPackageSets.stable.lix; - # Enable Rsync services.rsync.enable = true; @@ -124,35 +109,6 @@ # Enable Tailscale services.tailscale.enable = true; - networking.hostName = local.hostname; # Define your hostname. - - # Enable networking - networking.networkmanager.enable = true; - - # Set your time zone. - time.timeZone = "Europe/Copenhagen"; - - # Select internationalisation properties. - i18n.defaultLocale = "en_AU.UTF-8"; - - i18n.extraLocaleSettings = { - LC_ADDRESS = "en_AU.UTF-8"; - LC_IDENTIFICATION = "en_AU.UTF-8"; - LC_MEASUREMENT = "en_AU.UTF-8"; - LC_MONETARY = "en_AU.UTF-8"; - LC_NAME = "en_AU.UTF-8"; - LC_NUMERIC = "en_AU.UTF-8"; - LC_PAPER = "en_AU.UTF-8"; - LC_TELEPHONE = "en_AU.UTF-8"; - LC_TIME = "en_AU.UTF-8"; - }; - - # Configure keymap in X11 - services.xserver.xkb = { - layout = "au"; - variant = ""; - }; - # Define a user account. Don't forget to set a password with ‘passwd’. users.users.nixosbm = { isNormalUser = true; @@ -168,9 +124,6 @@ home = "/home/nixremote"; createHome = true; - # Lock the user account (no login shell) - shell = pkgs.shadow; - # SSH key for remote builds openssh.authorizedKeys.keys = [ # Add the public key from your client machines here @@ -203,10 +156,18 @@ # Enable the OpenSSH daemon. services.openssh.enable = true; +# Enable Podman for Gitea Actions Runner + virtualisation.podman = { + enable = true; + dockerCompat = true; + defaultNetwork.settings.dns_enabled = true; + }; + + # Network configuration for the build machine on the Proxmox bridge networking.interfaces.ens18.ipv4.addresses = [ { - address = local.address; + address = config.local.address; #dns = "10.1.1.2"; prefixLength = 24; } diff --git a/nix-system-configs/modules/system/database.nix b/nix-system-configs/modules/system/database.nix index 7255081..772f117 100644 --- a/nix-system-configs/modules/system/database.nix +++ b/nix-system-configs/modules/system/database.nix @@ -35,8 +35,8 @@ ../lix-default.nix ../secrets-config/sops-database.nix ../system_scripts/gcloud_backup.nix - ./hardware-configuration.nix - ]; + ## TODO: Make this more elegant and less risky for unexpected errors happening. +] ++ lib.optional (builtins.pathExists ./hardware-configuration.nix) ./hardware-configuration.nix; config = { local.hostname = "nixosdd"; From 1dd3af35f012ca5b51e1fea30642c1c9dcd69509 Mon Sep 17 00:00:00 2001 From: Christine Elisabeth Koppel Date: Thu, 12 Feb 2026 17:48:47 +0100 Subject: [PATCH 05/10] I HATE FLAKES, I HATE FLAKES, I HATE FLAKES --- .../system/blank_system_USE_THIS_AS_COPY.nix | 17 ++++++++-------- .../modules/system/build_machine.nix | 14 +++++++------ .../modules/system/compose-songsheet.nix | 20 ++++++++++--------- .../modules/system/database.nix | 20 ++++++++++--------- nix-system-configs/modules/system/forgejo.nix | 13 ++++++------ .../modules/system/teamspeak.nix | 20 ++++++++++--------- nix-system-configs/modules/system/traefik.nix | 16 ++++++++------- .../modules/system/wireguard_server.nix | 16 ++++++++------- 8 files changed, 74 insertions(+), 62 deletions(-) diff --git a/nix-system-configs/modules/system/blank_system_USE_THIS_AS_COPY.nix b/nix-system-configs/modules/system/blank_system_USE_THIS_AS_COPY.nix index 41384a0..6a5afa3 100644 --- a/nix-system-configs/modules/system/blank_system_USE_THIS_AS_COPY.nix +++ b/nix-system-configs/modules/system/blank_system_USE_THIS_AS_COPY.nix @@ -3,7 +3,9 @@ pkgs, lib, ... -}: { +}: let + choose = paths: builtins.head (builtins.filter (p: builtins.pathExists p) paths); +in { options.local = { hostname = lib.mkOption { type = lib.types.str; @@ -28,14 +30,11 @@ }; imports = [ - ../desktop-manager/sway_greetd_homemanager.nix - ../local/hostname_username.nix - ../local/networking_local.nix - ../bootloader/seabios-assigned-iso-at-birth.nix - ../lix-default.nix - # Optionally to enable remote building: ./modules/toolsets/remote_building.nix - #./modules/songsheet/wavelog/docker-compose.nix - #./modules/secrets-config/sops-the-blank-system.nix + (choose [ ./modules/local/hostname_username.nix ../local/hostname_username.nix ]) + (choose [ ./modules/local/networking_local.nix ../local/networking_local.nix ]) + (choose [ ./modules/bootloader/seabios-assigned-iso-at-birth.nix ../bootloader/seabios-assigned-iso-at-birth.nix ]) + (choose [ ./modules/lix-default.nix ../lix-default.nix ]) + (choose [ ./modules/secrets-config/sops-the-blank-system.nix ../secrets-config/sops-the-blank-system.nix ]) ]; config = { diff --git a/nix-system-configs/modules/system/build_machine.nix b/nix-system-configs/modules/system/build_machine.nix index 2bc2328..b5a2ef0 100644 --- a/nix-system-configs/modules/system/build_machine.nix +++ b/nix-system-configs/modules/system/build_machine.nix @@ -3,7 +3,9 @@ pkgs, lib, ... -}: { +}: let + choose = paths: builtins.head (builtins.filter (p: builtins.pathExists p) paths); +in { options.local = { hostname = lib.mkOption { type = lib.types.str; @@ -28,11 +30,11 @@ }; imports = [ - ../local/hostname_username.nix - ../local/networking_local.nix - ../bootloader/seabios-assigned-iso-at-birth.nix - ../lix-default.nix - ../secrets-config/sops-build-machine.nix + (choose [ ./modules/local/hostname_username.nix ../local/hostname_username.nix ]) + (choose [ ./modules/local/networking_local.nix ../local/networking_local.nix ]) + (choose [ ./modules/bootloader/seabios-assigned-iso-at-birth.nix ../bootloader/seabios-assigned-iso-at-birth.nix ]) + (choose [ ./modules/lix-default.nix ../lix-default.nix ]) + (choose [ ./modules/secrets-config/sops-build-machine.nix ../secrets-config/sops-build-machine.nix ]) ]; config = { diff --git a/nix-system-configs/modules/system/compose-songsheet.nix b/nix-system-configs/modules/system/compose-songsheet.nix index 89a2148..95fd8fc 100644 --- a/nix-system-configs/modules/system/compose-songsheet.nix +++ b/nix-system-configs/modules/system/compose-songsheet.nix @@ -3,7 +3,9 @@ pkgs, lib, ... -}: { +}: let + choose = paths: builtins.head (builtins.filter (p: builtins.pathExists p) paths); +in { options.local = { hostname = lib.mkOption { type = lib.types.str; @@ -28,16 +30,16 @@ }; imports = [ - ../desktop-manager/sway_greetd_homemanager.nix - ../local/hostname_username.nix - ../local/networking_local.nix - ../bootloader/seabios-assigned-iso-at-birth.nix - ../lix-default.nix - # Optionally: ../toolsets/remote_building.nix + (choose [ ./modules/desktop-manager/sway_greetd_homemanager.nix ../desktop-manager/sway_greetd_homemanager.nix ]) + (choose [ ./modules/local/hostname_username.nix ../local/hostname_username.nix ]) + (choose [ ./modules/local/networking_local.nix ../local/networking_local.nix ]) + (choose [ ./modules/bootloader/seabios-assigned-iso-at-birth.nix ../bootloader/seabios-assigned-iso-at-birth.nix ]) + (choose [ ./modules/lix-default.nix ../lix-default.nix ]) + # Optionally: (choose [ ./modules/toolsets/remote_building.nix ../toolsets/remote_building.nix ]) ## Compose modules for Portainer service - ../songsheet/wavelog/docker-compose.nix - ../secrets-config/sops-composesongsheet.nix + (choose [ ./modules/songsheet/wavelog/docker-compose.nix ../songsheet/wavelog/docker-compose.nix ]) + (choose [ ./modules/secrets-config/sops-composesongsheet.nix ../secrets-config/sops-composesongsheet.nix ]) ]; config = { diff --git a/nix-system-configs/modules/system/database.nix b/nix-system-configs/modules/system/database.nix index 772f117..f22ec06 100644 --- a/nix-system-configs/modules/system/database.nix +++ b/nix-system-configs/modules/system/database.nix @@ -3,7 +3,9 @@ pkgs, lib, ... -}: { +}: let + choose = paths: builtins.head (builtins.filter (p: builtins.pathExists p) paths); +in { options.local = { hostname = lib.mkOption { type = lib.types.str; @@ -28,15 +30,15 @@ }; imports = [ - ../desktop-manager/gnome.nix - ../local/hostname_username.nix - ../local/networking_local.nix - ../bootloader/seabios-assigned-iso-at-birth.nix - ../lix-default.nix - ../secrets-config/sops-database.nix - ../system_scripts/gcloud_backup.nix + (choose [ ./modules/desktop-manager/gnome.nix ../desktop-manager/gnome.nix ]) + (choose [ ./modules/local/hostname_username.nix ../local/hostname_username.nix ]) + (choose [ ./modules/local/networking_local.nix ../local/networking_local.nix ]) + (choose [ ./modules/bootloader/seabios-assigned-iso-at-birth.nix ../bootloader/seabios-assigned-iso-at-birth.nix ]) + (choose [ ./modules/lix-default.nix ../lix-default.nix ]) + (choose [ ./modules/secrets-config/sops-database.nix ../secrets-config/sops-database.nix ]) + (choose [ ./modules/system_scripts/gcloud_backup.nix ../system_scripts/gcloud_backup.nix ]) ## TODO: Make this more elegant and less risky for unexpected errors happening. -] ++ lib.optional (builtins.pathExists ./hardware-configuration.nix) ./hardware-configuration.nix; + ] ++ lib.optional (builtins.pathExists ./hardware-configuration.nix) ./hardware-configuration.nix; config = { local.hostname = "nixosdd"; diff --git a/nix-system-configs/modules/system/forgejo.nix b/nix-system-configs/modules/system/forgejo.nix index 583c0f7..5a1a6da 100644 --- a/nix-system-configs/modules/system/forgejo.nix +++ b/nix-system-configs/modules/system/forgejo.nix @@ -7,6 +7,7 @@ home-manager = builtins.fetchTarball "https://github.com/nix-community/home-manager/archive/release-25.11.tar.gz"; cfg = config.services.forgejo; srv = cfg.settings.server; + choose = paths: builtins.head (builtins.filter (p: builtins.pathExists p) paths); in { options.local = { hostname = lib.mkOption { @@ -32,12 +33,12 @@ in { }; imports = [ - ../desktop-manager/sway_greetd_homemanager.nix - ../local/hostname_username.nix - ../local/networking_local.nix - ../toolsets/remote_building.nix - ../bootloader/seabios-assigned-proxmox-at-birth.nix - ../lix-default.nix + (choose [ ./modules/desktop-manager/sway_greetd_homemanager.nix ../desktop-manager/sway_greetd_homemanager.nix ]) + (choose [ ./modules/local/hostname_username.nix ../local/hostname_username.nix ]) + (choose [ ./modules/local/networking_local.nix ../local/networking_local.nix ]) + (choose [ ./modules/toolsets/remote_building.nix ../toolsets/remote_building.nix ]) + (choose [ ./modules/bootloader/seabios-assigned-proxmox-at-birth.nix ../bootloader/seabios-assigned-proxmox-at-birth.nix ]) + (choose [ ./modules/lix-default.nix ../lix-default.nix ]) ]; config = { diff --git a/nix-system-configs/modules/system/teamspeak.nix b/nix-system-configs/modules/system/teamspeak.nix index 6f89dbd..fc57454 100644 --- a/nix-system-configs/modules/system/teamspeak.nix +++ b/nix-system-configs/modules/system/teamspeak.nix @@ -3,7 +3,9 @@ pkgs, lib, ... -}: { +}: let + choose = paths: builtins.head (builtins.filter (p: builtins.pathExists p) paths); +in { options.local = { hostname = lib.mkOption { type = lib.types.str; @@ -28,15 +30,15 @@ }; imports = [ - ../desktop-manager/sway_greetd_homemanager.nix - ../local/hostname_username.nix - ../local/networking_local.nix - ../bootloader/seabios-assigned-iso-at-birth.nix - ../lix-default.nix - # Optionally: ./modules/toolsets/remote_building.nix + (choose [ ./modules/desktop-manager/sway_greetd_homemanager.nix ../desktop-manager/sway_greetd_homemanager.nix ]) + (choose [ ./modules/local/hostname_username.nix ../local/hostname_username.nix ]) + (choose [ ./modules/local/networking_local.nix ../local/networking_local.nix ]) + (choose [ ./modules/bootloader/seabios-assigned-iso-at-birth.nix ../bootloader/seabios-assigned-iso-at-birth.nix ]) + (choose [ ./modules/lix-default.nix ../lix-default.nix ]) + # Optionally: (choose [ ./modules/toolsets/remote_building.nix ../toolsets/remote_building.nix ]) ## Compose modules for Portainer service - ../songsheet/wavelog/docker-compose.nix - ../secrets-config/sops-composesongsheet.nix + (choose [ ./modules/songsheet/wavelog/docker-compose.nix ../songsheet/wavelog/docker-compose.nix ]) + (choose [ ./modules/secrets-config/sops-composesongsheet.nix ../secrets-config/sops-composesongsheet.nix ]) ]; config = { diff --git a/nix-system-configs/modules/system/traefik.nix b/nix-system-configs/modules/system/traefik.nix index 07d2ac8..28b6d7c 100644 --- a/nix-system-configs/modules/system/traefik.nix +++ b/nix-system-configs/modules/system/traefik.nix @@ -3,7 +3,9 @@ pkgs, lib, ... -}: { +}: let + choose = paths: builtins.head (builtins.filter (p: builtins.pathExists p) paths); +in { options.local = { hostname = lib.mkOption { type = lib.types.str; @@ -28,12 +30,12 @@ }; imports = [ - ../desktop-manager/sway_greetd_homemanager.nix - ../local/hostname_username.nix - ../local/networking_local.nix - ../bootloader/seabios-assigned-iso-at-birth.nix - ../lix-default.nix - # Optionally: ./modules/toolsets/remote_building.nix + (choose [ ./modules/desktop-manager/sway_greetd_homemanager.nix ../desktop-manager/sway_greetd_homemanager.nix ]) + (choose [ ./modules/local/hostname_username.nix ../local/hostname_username.nix ]) + (choose [ ./modules/local/networking_local.nix ../local/networking_local.nix ]) + (choose [ ./modules/bootloader/seabios-assigned-iso-at-birth.nix ../bootloader/seabios-assigned-iso-at-birth.nix ]) + (choose [ ./modules/lix-default.nix ../lix-default.nix ]) + # Optionally: (choose [ ./modules/toolsets/remote_building.nix ../toolsets/remote_building.nix ]) ]; config = { diff --git a/nix-system-configs/modules/system/wireguard_server.nix b/nix-system-configs/modules/system/wireguard_server.nix index db47c70..32ee0fb 100644 --- a/nix-system-configs/modules/system/wireguard_server.nix +++ b/nix-system-configs/modules/system/wireguard_server.nix @@ -3,7 +3,9 @@ pkgs, lib, ... -}: { +}: let + choose = paths: builtins.head (builtins.filter (p: builtins.pathExists p) paths); +in { options.local = { hostname = lib.mkOption { type = lib.types.str; @@ -28,12 +30,12 @@ }; imports = [ - ../desktop-manager/sway_greetd_homemanager.nix - ../local/hostname_username.nix - ../local/networking_local.nix - ../bootloader/seabios-assigned-iso-at-birth.nix - ../lix-default.nix - ../secrets-config/sops-wireguard.nix + (choose [ ./modules/desktop-manager/sway_greetd_homemanager.nix ../desktop-manager/sway_greetd_homemanager.nix ]) + (choose [ ./modules/local/hostname_username.nix ../local/hostname_username.nix ]) + (choose [ ./modules/local/networking_local.nix ../local/networking_local.nix ]) + (choose [ ./modules/bootloader/seabios-assigned-iso-at-birth.nix ../bootloader/seabios-assigned-iso-at-birth.nix ]) + (choose [ ./modules/lix-default.nix ../lix-default.nix ]) + (choose [ ./modules/secrets-config/sops-wireguard.nix ../secrets-config/sops-wireguard.nix ]) # Optionally to enable remote building: ./modules/toolsets/remote_building.nix #./modules/songsheet/wavelog/docker-compose.nix #./modules/secrets-config/sops-the-blank-system.nix From ec7ce7f1d0960583ccd8122f38bb8749ca9b0285 Mon Sep 17 00:00:00 2001 From: Christine Elisabeth Koppel Date: Thu, 12 Feb 2026 17:54:09 +0100 Subject: [PATCH 06/10] Reinclude the hardware config. --- nix-system-configs/modules/system/build_machine.nix | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/nix-system-configs/modules/system/build_machine.nix b/nix-system-configs/modules/system/build_machine.nix index b5a2ef0..97e6f34 100644 --- a/nix-system-configs/modules/system/build_machine.nix +++ b/nix-system-configs/modules/system/build_machine.nix @@ -35,7 +35,8 @@ in { (choose [ ./modules/bootloader/seabios-assigned-iso-at-birth.nix ../bootloader/seabios-assigned-iso-at-birth.nix ]) (choose [ ./modules/lix-default.nix ../lix-default.nix ]) (choose [ ./modules/secrets-config/sops-build-machine.nix ../secrets-config/sops-build-machine.nix ]) - ]; + ## TODO: Make this more elegant and less risky for unexpected errors happening. + ] ++ lib.optional (builtins.pathExists ./hardware-configuration.nix) ./hardware-configuration.nix; config = { # Local metadata From 6ac033dd563e60551f7ed643c012a6fb59a39e74 Mon Sep 17 00:00:00 2001 From: Christine Elisabeth Koppel Date: Thu, 12 Feb 2026 17:55:11 +0100 Subject: [PATCH 07/10] Remove seabios-assigned-iso-at-birth module from build machine configuration. --- nix-system-configs/modules/system/build_machine.nix | 1 - 1 file changed, 1 deletion(-) diff --git a/nix-system-configs/modules/system/build_machine.nix b/nix-system-configs/modules/system/build_machine.nix index 97e6f34..94749f3 100644 --- a/nix-system-configs/modules/system/build_machine.nix +++ b/nix-system-configs/modules/system/build_machine.nix @@ -32,7 +32,6 @@ in { imports = [ (choose [ ./modules/local/hostname_username.nix ../local/hostname_username.nix ]) (choose [ ./modules/local/networking_local.nix ../local/networking_local.nix ]) - (choose [ ./modules/bootloader/seabios-assigned-iso-at-birth.nix ../bootloader/seabios-assigned-iso-at-birth.nix ]) (choose [ ./modules/lix-default.nix ../lix-default.nix ]) (choose [ ./modules/secrets-config/sops-build-machine.nix ../secrets-config/sops-build-machine.nix ]) ## TODO: Make this more elegant and less risky for unexpected errors happening. From fe2b0f0841ab46fb40aa912c31f108d12b7f180c Mon Sep 17 00:00:00 2001 From: Christine Elisabeth Koppel Date: Thu, 12 Feb 2026 17:59:06 +0100 Subject: [PATCH 08/10] Fix the boot error. --- nix-system-configs/modules/system/build_machine.nix | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/nix-system-configs/modules/system/build_machine.nix b/nix-system-configs/modules/system/build_machine.nix index 94749f3..4aeb41c 100644 --- a/nix-system-configs/modules/system/build_machine.nix +++ b/nix-system-configs/modules/system/build_machine.nix @@ -108,6 +108,11 @@ in { # Bootloader fallback settings are provided by the seabios import # (seabios-assigned-iso-at-birth.nix) + # Replicate systemd-boot configuration from the deprecated configuration + # so the system is bootable (matches build-deprecated/configuration.nix). + boot.loader.systemd-boot.enable = true; + boot.loader.efi.canTouchEfiVariables = true; + # Enable Tailscale services.tailscale.enable = true; @@ -242,7 +247,7 @@ in { #programs.ssh.extraConfig = '' # Host nixos-build-machine # HostName 192.168.1.175 - # IdentitiesOnly yes + # IdentitiesOnly yes; # IdentityFile /root/.ssh/nixremote # User nixremoteStrictHostKeyChecking accept-new #''; From 1a0b4a3a53241fb4328dc1ed918be653caaf4561 Mon Sep 17 00:00:00 2001 From: Christine Elisabeth Koppel Date: Thu, 12 Feb 2026 18:12:54 +0100 Subject: [PATCH 09/10] Update runner_token to be correct. --- nix-system-configs/secrets/build_machine/secrets.yaml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/nix-system-configs/secrets/build_machine/secrets.yaml b/nix-system-configs/secrets/build_machine/secrets.yaml index 4ca6a75..019b967 100644 --- a/nix-system-configs/secrets/build_machine/secrets.yaml +++ b/nix-system-configs/secrets/build_machine/secrets.yaml @@ -1,4 +1,4 @@ -runner_token: ENC[AES256_GCM,data:SZnND7nTNwrYrQDKkurH1SoZLygFkVbAJFFcCcuDRbqSGGV49TQizw==,iv:wY33GdeQ13xC7gRjVM4UiVgZbvtrfQPUuveUJw8Bj0k=,tag:dSL6gmKGYxZemecD/l5eRQ==,type:str] +runner_token: ENC[AES256_GCM,data:SEN4lL2cxkM/cExdasB2zIV3EDJcBIZOAr1ab6aLagPVReZ8UTaFKgMctnLIkA==,iv:EMUQW8ufCnbCeN3PmSoxBsHLukwS4yNSA3xor89uNxE=,tag:V8RDaeGMI4ReZrGTw9V2Qw==,type:str] sops: age: - recipient: age1746rvsvsc3snxfl7cndm222wd5kck4aqj3x7nednlegq0gdjhfcqx0qv7m @@ -19,7 +19,7 @@ sops: U3hva2JqWUdjR2JzTmpFanppUk5MTmsKwD8rlnddUQkgtuZLTgpmS4jGRmgNReUN mEx0pxnWIIrLUGRgwE3WDbBVRTqVo1ai6BZY3FzBCnXU6zbNwYhqIg== -----END AGE ENCRYPTED FILE----- - lastmodified: "2026-02-12T14:23:57Z" - mac: ENC[AES256_GCM,data:DorP7hsnq582LR5fQDFVBy6xtPEMIlvLKPYdK6h7Nq6ajAMquiU8i33IfMzEnLWC6oa4soiIZA+LBMlHR7LCKOQWvdHp8k8q08MbqlMLQO3yH/Lc+J2W8v1SQwPlEXUwF4DIuzCos0D1IfpD/f2gQ2SAmbIJkJHMkviJM76YiqY=,iv:Yzu0GjZhimt6Yk3bZvGfIHz55pPI/gZyJKv99SsSWec=,tag:/ytugAI8voXt0nb9uV8nlA==,type:str] + lastmodified: "2026-02-12T17:12:42Z" + mac: ENC[AES256_GCM,data:Z888IrMcNO0VwoliGoLS8SsZPffXvH2yY6w9y3i7laepvrq2dW2a3fx+urwzgYfpJBLMJQNJ10SauBINlgIYp5KYf1dMRSsLBbwIsJi90lmqmRSNmNdQmkJdwi4MhmQxbZmHpwrxwFrx9EAkWdWXKlMBCkO2WJxNVQdYVty2bNs=,iv:FssN2HByfcbgFY5NKEyadyrrdidFx5iHaEXX2rDLYvw=,tag:bRGpOVzv26kjOswlQC7aoA==,type:str] unencrypted_suffix: _unencrypted version: 3.11.0 From dca2e4ffbf780a9c5e6c919809aa2f0326ca3d5e Mon Sep 17 00:00:00 2001 From: Christine Elisabeth Koppel Date: Thu, 12 Feb 2026 18:31:12 +0100 Subject: [PATCH 10/10] Add build-modules.yml for Nix module dry-run workflow --- .forgejo/workflows/build-modules.yml | 23 +++++++++++++++++++++++ copy_pasta.zsh => dry_run.zsh | 0 2 files changed, 23 insertions(+) create mode 100644 .forgejo/workflows/build-modules.yml rename copy_pasta.zsh => dry_run.zsh (100%) mode change 100644 => 100755 diff --git a/.forgejo/workflows/build-modules.yml b/.forgejo/workflows/build-modules.yml new file mode 100644 index 0000000..96e45c0 --- /dev/null +++ b/.forgejo/workflows/build-modules.yml @@ -0,0 +1,23 @@ +name: Build Nix modules (dry-run) + +on: + push: + branches: + - main + +jobs: + build-modules: + runs-on: docker + container: + image: lix:latest + steps: + - name: Checkout repository + uses: actions/checkout@v4 + + - name: Run Dry Run (dry-run) + env: + NIX_CONFIG: experimental-features = nix-command flakes + run: | + set -eux + ./dry_run.zsh + diff --git a/copy_pasta.zsh b/dry_run.zsh old mode 100644 new mode 100755 similarity index 100% rename from copy_pasta.zsh rename to dry_run.zsh