From 57f6b25a9e6a6882f50f4ec1454c52e24541ecd8 Mon Sep 17 00:00:00 2001 From: DerGrumpf Date: Sat, 27 Jun 2026 21:43:29 +0200 Subject: [PATCH] Added Disko setup; And test impermanence on node 1 & 2 --- .gitignore | 1 + flake.lock | 117 ++++++++++++------ flake.nix | 93 +++----------- hosts/cyper-node-1/disko.nix | 2 +- hosts/cyper-node-1/hardware-configuration.nix | 25 +--- hosts/cyper-node-2/configuration.nix | 1 + hosts/cyper-node-2/disko.nix | 68 ++++++++++ hosts/cyper-node-2/hardware-configuration.nix | 28 +---- hosts/installer/configuration.nix | 80 ++++++++++++ nixos/sops.nix | 3 +- 10 files changed, 254 insertions(+), 164 deletions(-) create mode 100644 hosts/cyper-node-2/disko.nix create mode 100644 hosts/installer/configuration.nix diff --git a/.gitignore b/.gitignore index cbdecd7..999f2bc 100644 --- a/.gitignore +++ b/.gitignore @@ -2,6 +2,7 @@ result result-* *.qcow2 +extra-files/* # Ignore everything in the secrets directory secrets/* diff --git a/flake.lock b/flake.lock index e6d076c..1f87d27 100644 --- a/flake.lock +++ b/flake.lock @@ -90,6 +90,26 @@ "type": "github" } }, + "disko": { + "inputs": { + "nixpkgs": [ + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1781152676, + "narHash": "sha256-RxWs5ND31KzTG7wvMM+PMfUjyNpmIEr999lqNARaM5o=", + "owner": "nix-community", + "repo": "disko", + "rev": "ff8702b4de27f72b4c78573dfb89ec74e36abdf1", + "type": "github" + }, + "original": { + "owner": "nix-community", + "repo": "disko", + "type": "github" + } + }, "flake-compat": { "flake": false, "locked": { @@ -223,6 +243,27 @@ "type": "github" } }, + "home-manager_2": { + "inputs": { + "nixpkgs": [ + "impermanence", + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1768598210, + "narHash": "sha256-kkgA32s/f4jaa4UG+2f8C225Qvclxnqs76mf8zvTVPg=", + "owner": "nix-community", + "repo": "home-manager", + "rev": "c47b2cc64a629f8e075de52e4742de688f930dc6", + "type": "github" + }, + "original": { + "owner": "nix-community", + "repo": "home-manager", + "type": "github" + } + }, "hyprcursor": { "inputs": { "hyprlang": "hyprlang", @@ -647,6 +688,25 @@ "type": "github" } }, + "impermanence": { + "inputs": { + "home-manager": "home-manager_2", + "nixpkgs": "nixpkgs_2" + }, + "locked": { + "lastModified": 1769548169, + "narHash": "sha256-03+JxvzmfwRu+5JafM0DLbxgHttOQZkUtDWBmeUkN8Y=", + "owner": "nix-community", + "repo": "impermanence", + "rev": "7b1d382faf603b6d264f58627330f9faa5cba149", + "type": "github" + }, + "original": { + "owner": "nix-community", + "repo": "impermanence", + "type": "github" + } + }, "nix-homebrew": { "inputs": { "brew-src": "brew-src" @@ -688,42 +748,6 @@ "type": "github" } }, - "nixlib": { - "locked": { - "lastModified": 1736643958, - "narHash": "sha256-tmpqTSWVRJVhpvfSN9KXBvKEXplrwKnSZNAoNPf/S/s=", - "owner": "nix-community", - "repo": "nixpkgs.lib", - "rev": "1418bc28a52126761c02dd3d89b2d8ca0f521181", - "type": "github" - }, - "original": { - "owner": "nix-community", - "repo": "nixpkgs.lib", - "type": "github" - } - }, - "nixos-generators": { - "inputs": { - "nixlib": "nixlib", - "nixpkgs": [ - "nixpkgs" - ] - }, - "locked": { - "lastModified": 1769813415, - "narHash": "sha256-nnVmNNKBi1YiBNPhKclNYDORoHkuKipoz7EtVnXO50A=", - "owner": "nix-community", - "repo": "nixos-generators", - "rev": "8946737ff703382fda7623b9fab071d037e897d5", - "type": "github" - }, - "original": { - "owner": "nix-community", - "repo": "nixos-generators", - "type": "github" - } - }, "nixpkgs": { "locked": { "lastModified": 1780749050, @@ -772,6 +796,22 @@ } }, "nixpkgs_2": { + "locked": { + "lastModified": 1768564909, + "narHash": "sha256-Kell/SpJYVkHWMvnhqJz/8DqQg2b6PguxVWOuadbHCc=", + "owner": "nixos", + "repo": "nixpkgs", + "rev": "e4bae1bd10c9c57b2cf517953ab70060a828ee6f", + "type": "github" + }, + "original": { + "owner": "nixos", + "ref": "nixos-unstable", + "repo": "nixpkgs", + "type": "github" + } + }, + "nixpkgs_3": { "locked": { "lastModified": 1781577229, "narHash": "sha256-lrp67w8AulE9Ks53n27I45ADSzbOCn4H+CNW1Ck8B+8=", @@ -857,14 +897,15 @@ "inputs": { "catppuccin": "catppuccin", "darwin": "darwin", + "disko": "disko", "home-manager": "home-manager", "hyprcursor": "hyprcursor", "hyprland": "hyprland", "hyprland-plugins": "hyprland-plugins", + "impermanence": "impermanence", "nix-homebrew": "nix-homebrew", "nixcord": "nixcord", - "nixos-generators": "nixos-generators", - "nixpkgs": "nixpkgs_2", + "nixpkgs": "nixpkgs_3", "nixvim": "nixvim", "nur": "nur", "sops-nix": "sops-nix", diff --git a/flake.nix b/flake.nix index d986a1f..94fb378 100644 --- a/flake.nix +++ b/flake.nix @@ -5,11 +5,7 @@ # monorepo w/ recipes ("derivations") nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable"; - nixos-generators = { - url = "github:nix-community/nixos-generators"; - inputs.nixpkgs.follows = "nixpkgs"; - }; - + # declarative disk layout disko = { url = "github:nix-community/disko"; inputs.nixpkgs.follows = "nixpkgs"; @@ -99,7 +95,6 @@ nixvim, hyprland, sops-nix, - nixos-generators, nur, impermanence, disko, @@ -108,59 +103,19 @@ let primaryUser = "phil"; - mkIso = - { - hostName, - isDarwin ? false, - isServer ? false, - }: - nixos-generators.nixosGenerate { - system = "x86_64-linux"; - format = "iso"; - specialArgs = { - inherit - inputs - primaryUser - self - hostName - isDarwin - isServer - ; - }; - modules = [ - { - nixpkgs.overlays = [ - inputs.nur.overlays.default - (import ./overlays { inherit (inputs) nur; }) - ]; - } - { nixpkgs.config.allowUnfree = true; } - { nixpkgs.hostPlatform = "x86_64-linux"; } - { networking.hostName = hostName; } - ./hosts/${hostName}/configuration.nix - ./nixos - inputs.sops-nix.nixosModules.sops - inputs.home-manager.nixosModules.home-manager - { - home-manager = { - extraSpecialArgs = { - inherit - inputs - primaryUser - self - hostName - isDarwin - isServer - ; - }; - users.${primaryUser} = import ./home; - backupFileExtension = "backup"; - useGlobalPkgs = true; - useUserPackages = true; - }; - } - ]; - }; + installer = nixpkgs.lib.nixosSystem { + system = "x86_64-linux"; + specialArgs = { inherit inputs; }; + modules = [ + { + nixpkgs = { + config.allowUnfree = true; + hostPlatform = "x86_64-linux"; + }; + } + ./hosts/installer/configuration.nix + ]; + }; mkSystem = { @@ -229,6 +184,8 @@ in { nixosConfigurations = { + "installer" = installer; + "cyper-desktop" = mkSystem { hostName = "cyper-desktop"; system = "x86_64-linux"; @@ -266,23 +223,7 @@ }; packages.x86_64-linux = { - cyper-desktop-iso = mkIso { hostName = "cyper-desktop"; }; - cyper-controller-iso = mkIso { - hostName = "cyper-controller"; - isServer = true; - }; - cyper-proxy-iso = mkIso { - hostName = "cyper-proxy"; - isServer = true; - }; - cyper-node-1-iso = mkIso { - hostName = "cyper-node-1"; - isServer = true; - }; - cyper-node-2-iso = mkIso { - hostName = "cyper-node-2"; - isServer = true; - }; + installer = self.nixosConfigurations.installer.config.system.build.isoImage; }; formatter.x86_64-linux = nixpkgs.legacyPackages.x86_64-linux.nixfmt-tree; diff --git a/hosts/cyper-node-1/disko.nix b/hosts/cyper-node-1/disko.nix index 2de2c15..07f3f42 100644 --- a/hosts/cyper-node-1/disko.nix +++ b/hosts/cyper-node-1/disko.nix @@ -1,7 +1,7 @@ { disko.devices.disk.main = { type = "disk"; - device = "/dev/sda"; # change to your actual disk, e.g. /dev/nvme0n1 + device = "/dev/sda"; content = { type = "gpt"; partitions = { diff --git a/hosts/cyper-node-1/hardware-configuration.nix b/hosts/cyper-node-1/hardware-configuration.nix index 19a7eee..df92976 100644 --- a/hosts/cyper-node-1/hardware-configuration.nix +++ b/hosts/cyper-node-1/hardware-configuration.nix @@ -31,29 +31,10 @@ "mode=755" ]; }; - "/boot" = { - device = "/dev/disk/by-label/NIXBOOT"; - fsType = "vfat"; - options = [ - "fmask=0022" - "dmask=0022" - ]; - }; - "/nix" = { - device = "/dev/disk/by-label/NIXSTORE"; - fsType = "ext4"; - neededForBoot = true; - }; - "/persist" = { - device = "/dev/disk/by-label/NIXPERSIST"; - fsType = "ext4"; - neededForBoot = true; - }; - }; - swapDevices = [ - { device = "/dev/disk/by-label/NIXSWAP"; } - ]; + "/nix".neededForBoot = true; + "/persist".neededForBoot = true; + }; hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware; } diff --git a/hosts/cyper-node-2/configuration.nix b/hosts/cyper-node-2/configuration.nix index 575b7c3..39789ba 100644 --- a/hosts/cyper-node-2/configuration.nix +++ b/hosts/cyper-node-2/configuration.nix @@ -1,5 +1,6 @@ { imports = [ + ./disko.nix ./hardware-configuration.nix ]; diff --git a/hosts/cyper-node-2/disko.nix b/hosts/cyper-node-2/disko.nix new file mode 100644 index 0000000..07f3f42 --- /dev/null +++ b/hosts/cyper-node-2/disko.nix @@ -0,0 +1,68 @@ +{ + disko.devices.disk.main = { + type = "disk"; + device = "/dev/sda"; + content = { + type = "gpt"; + partitions = { + + ESP = { + size = "512M"; + type = "EF00"; + content = { + type = "filesystem"; + format = "vfat"; + mountpoint = "/boot"; + mountOptions = [ + "fmask=0022" + "dmask=0022" + ]; + extraArgs = [ + "-n" + "NIXBOOT" + ]; + }; + }; + + swap = { + size = "4G"; + content = { + type = "swap"; + extraArgs = [ + "-L" + "NIXSWAP" + ]; + }; + }; + + nix = { + size = "50G"; + content = { + type = "filesystem"; + format = "ext4"; + mountpoint = "/nix"; + mountOptions = [ "defaults" ]; + extraArgs = [ + "-L" + "NIXSTORE" + ]; + }; + }; + + persist = { + size = "100%"; + content = { + type = "filesystem"; + format = "ext4"; + mountpoint = "/persist"; + extraArgs = [ + "-L" + "NIXPERSIST" + ]; + }; + }; + + }; + }; + }; +} diff --git a/hosts/cyper-node-2/hardware-configuration.nix b/hosts/cyper-node-2/hardware-configuration.nix index df531ed..df92976 100644 --- a/hosts/cyper-node-2/hardware-configuration.nix +++ b/hosts/cyper-node-2/hardware-configuration.nix @@ -31,32 +31,10 @@ "mode=755" ]; }; - "/boot" = { - device = "/dev/disk/by-label/NIXBOOT"; - fsType = "vfat"; - options = [ - "fmask=0022" - "dmask=0022" - ]; - }; - "/nix" = { - device = "/dev/disk/by-label/NIXSTORE"; - fsType = "ext4"; - neededForBoot = true; - }; - "/persist" = { - device = "/dev/disk/by-label/NIXPERSIST"; - fsType = "ext4"; - neededForBoot = true; - }; - }; - swapDevices = [ - { - device = "/persist/swapfile"; - size = 4096; - } - ]; + "/nix".neededForBoot = true; + "/persist".neededForBoot = true; + }; hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware; } diff --git a/hosts/installer/configuration.nix b/hosts/installer/configuration.nix new file mode 100644 index 0000000..6c3b6eb --- /dev/null +++ b/hosts/installer/configuration.nix @@ -0,0 +1,80 @@ +{ modulesPath, pkgs, ... }: +{ + imports = [ (modulesPath + "/installer/cd-dvd/installation-cd-minimal.nix") ]; + + boot.zfs.forceImportRoot = false; + + time.timeZone = "Europe/Berlin"; + i18n = { + defaultLocale = "en_US.UTF-8"; + extraLocaleSettings = { + LC_ADDRESS = "de_DE.UTF-8"; + LC_IDENTIFICATION = "de_DE.UTF-8"; + LC_MEASUREMENT = "de_DE.UTF-8"; + LC_MONETARY = "de_DE.UTF-8"; + LC_NAME = "de_DE.UTF-8"; + LC_NUMERIC = "de_DE.UTF-8"; + LC_PAPER = "de_DE.UTF-8"; + LC_TELEPHONE = "de_DE.UTF-8"; + LC_TIME = "de_DE.UTF-8"; + }; + }; + + services.openssh = { + enable = true; + openFirewall = true; + settings = { + PermitRootLogin = "yes"; + PasswordAuthentication = false; + }; + }; + + users.users = { + root.openssh.authorizedKeys.keyFiles = [ + ../../secrets/ssh-key + ]; + + phil = { + isNormalUser = true; + password = "nixos"; + extraGroups = [ "wheel" ]; + openssh.authorizedKeys.keyFiles = [ + ../../secrets/ssh-key + ]; + }; + }; + + security.sudo = { + enable = true; + wheelNeedsPassword = false; + }; + + networking = { + useNetworkd = true; + useDHCP = false; + firewall.enable = false; + }; + + systemd.network = { + enable = true; + networks."10-ethernet" = { + matchConfig.Name = "en*"; + networkConfig = { + Address = "192.168.2.99/24"; + Gateway = "192.168.2.1"; + DNS = "192.168.2.2"; + DHCP = "no"; + }; + }; + }; + + environment.systemPackages = with pkgs; [ + htop + lsscsi + pciutils + usbutils + nvme-cli + ]; + + system.stateVersion = "26.05"; +} diff --git a/nixos/sops.nix b/nixos/sops.nix index 76d349a..1d3564e 100644 --- a/nixos/sops.nix +++ b/nixos/sops.nix @@ -1,8 +1,7 @@ -{ primaryUser, ... }: { sops = { defaultSopsFile = ../secrets/secrets.yaml; defaultSopsFormat = "yaml"; - age.keyFile = "/home/${primaryUser}/.config/nix/secrets/keys.txt"; + age.keyFile = "/persist/secrets/age-key.txt"; }; }