me/nixos-system
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add pi sd card image building flake and homepi system

Browse source
This commit is contained in:
Adriano Caloiaro 2023-12-24 08:17:48 -07:00
parent 4b0456fb98
commit 738eb1102c
No known key found for this signature in database
GPG key ID: 920633857147D83D
18 changed files with 1494 additions and 39 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
.gitignore vendored Normal file
View file

@ -0,0 +1 @@
**/result

64
README.md
View file

@ -1,10 +1,31 @@
# NixOS dotfiles
# NixOS systems
These dotfiles initialize my primary system 'z1', and various raspberry PIs.
These nixos configurations and flakes configure all of my systems.
# Install
The contents of this repository are organized as follows:
- Boot into a NixOS install USB stick/CD/DVD
- `systems`: These are complete nix modules for configuring specific systems. Unforutnately they're not "role based" systems, but explicit systems. I'd like to change that.
- `images`: This directory contains a flake for building SD card images. Ideally, SD card images could also be complete systems e.g. for building a pi sd card. However, cross-compiling issues have prevented me from doing so. For now, sd card images are phase 1 in and two-phase install process.
## Systems
### homepi
This pi is at my house in Florida.
### roampi
This pi is in Roamy McRoamerson.
### z1
This is my primary System76 system.
## Installing
### z1
- Boot into a NixOS install USB stick/CD/DVD. This can be an official image, or one generated by the flake in `images`.
- At the install terminal, run `sudo -i`
- Make this directory available to your installer, either by putting it on a separate usb drive, separate disk, or cloning the repo to the installer ramdisk.
- Open `nixos-zfs-setup.sh` and modify it to your liking, paying special attention to the `DISK` variable. This should match the disk on which NixOS will be installed. It is also the disk on which the `esp` is installed. !!IF THERE IS ALREADY AN OS ON `DISK`, IT WILL BE WIPED OUT IN THE NEXT STEP!!
@ -13,12 +34,32 @@ These dotfiles initialize my primary system 'z1', and various raspberry PIs.
- Add private keys corresponding with the public keys that encrypted the system's secrets to `/mnt/root/.ssh`
- Copy our custom configs to where the installer will use them: `cp -rf * /mnt/etc/nixos`
- `cd /mnt/etc/nixos`
- See `Rescue / Install help` for how to connect to a wifi network
- Install NixOS on the system: `nixos-install --flake .#z1`
- `umount -Rl /mnt && swapoff -a && zpool export -a && reboot`
# Rescue / Install help
### homepi
Boot into the NixOS installer usb/CD/DVD.
- Boot into a NixOS install USB stick/CD/DVD. Directions for generating images is in `images`.
- After boot, your pi system will connect to wifi and be available over ssh with the SSH key configured in `images/systems/homepi/default.nix`
- SSH into the system: `ssh pi@<IP ADDR>`
- Clone this repo onto the system / transfer it to the system via sftp/rsync/scp
- Create an SSH key and encrypt secrets:
- `ssh-keygen -t rsa -b 4096 -C "code@adriano.fyi" -f ~/.ssh/id_rsa_homepi -P ""`
- In `systems/homepi/secrets/secrets.nix`, add the contents (`cat ~/.ssh/id_rsa_homepi.pub`) of the system's public key
- Create a Tailscale auth key at: https://login.tailscale.com/admin/settings/keys
- Add the Tailsclale auth key secret: `agenix -e tailscale_key.age -i ~/.ssh/id_rsa_homepi`
- Add wifi network secrets. `agenix -e wireless_networks.age -i ~/.ssh/id_rsa_homepi`. Wifi network secrets are of the form `NETWORK_NAME=<PRESHARED KEY>`. Where `NETWORK_NAME` is the name that's used between the `@` symbols in `configuration.nix`, e.g.
```
"Home5536" = {
psk = "@HOME5536_PSK@";
};
```
- Install the homepi flake: `sudo nixos-rebuild --flake .#homepi switch`
## Rescue / Install help
Boot into the NixOS installer sd card/CD/DVD.
**Wireless Networking**
@ -36,14 +77,3 @@ set network 0 key_mgmt WPA-PSK | NONE | <WHATEVER TYPE YOUR NETWORK USES>
enable_network 0
```
**Rebuilding from rescue**
It _may_ be possible to perform `nixos-rebuild --flake .#z1` from the following environment, but doing so is currentlyl untested.
```bash
zpool import -alf -R /mnt
nixos-enter --root /mnt
```
**Add `NIXOS_INSTALL_BOOTLOADER=1` to rescue from bootloader issues if running `nixos-rebuild`.

21
flake.nix
View file

@ -115,6 +115,27 @@
}
];
};
homepi = nixpkgs-pi.lib.nixosSystem {
system = "aarch64-linux";
specialArgs = {inherit inputs;};
modules = [
{ environment.systemPackages = [ agenix.packages.aarch64-linux.default ]; }
nur.nixosModules.nur
agenix.nixosModules.default
./systems/homepi/configuration.nix
home-manager-pi.nixosModules.home-manager
{
home-manager.backupFileExtension = "backup";
home-manager.useGlobalPkgs = true;
home-manager.useUserPackages = true;
home-manager.users.kodi = import ./systems/homepi/kodi.nix;
home-manager.extraSpecialArgs = {
inherit agenix homeage;
};
}
];
};
};
};
}

31
images/README.md Normal file
View file

@ -0,0 +1,31 @@
# images
This directory contains code for building sd card images for booting new systems.
These images can be cross-compiled to from any architecture to the ARM (pi) arechitecture.
## build
To build the `rpi4` image, for example:
`nix build .#images.rpi4 --log-format bar-with-logs`
This will output a `.zst` suffixed image that can be unpacked with: `nix-shell -p zstd --run "unzstd <img-name>.img.zst"`
Built images are placed in `./result`
## installation
Images should be installed directly on the PI's primary sd card and booted from there. I typically use an sd card reader
on a laptop separate from the pi. In the following example, the sd card reader for the pi's sd card is `/dev/sdb`
Write to the pi's sd card:
`sudo dd bs=4M if=sdcard.img of=/dev/sdb conv=fsync oflag=direct status=progress`
## booting
This is a bootable sd card image, so the pi can now be booted directly from its sd card when inserted.
## references
1. [https://nixos.wiki/wiki/NixOS_on_ARM](https://nixos.wiki/wiki/NixOS_on_ARM)

169
images/flake.lock Normal file
View file

@ -0,0 +1,169 @@
{
"nodes": {
"agenix": {
"inputs": {
"darwin": "darwin",
"home-manager": "home-manager",
"nixpkgs": [
"nixpkgs"
],
"systems": "systems"
},
"locked": {
"lastModified": 1703433843,
"narHash": "sha256-nmtA4KqFboWxxoOAA6Y1okHbZh+HsXaMPFkYHsoDRDw=",
"owner": "ryantm",
"repo": "agenix",
"rev": "417caa847f9383e111d1397039c9d4337d024bf0",
"type": "github"
},
"original": {
"owner": "ryantm",
"repo": "agenix",
"type": "github"
}
},
"darwin": {
"inputs": {
"nixpkgs": [
"agenix",
"nixpkgs"
]
},
"locked": {
"lastModified": 1700795494,
"narHash": "sha256-gzGLZSiOhf155FW7262kdHo2YDeugp3VuIFb4/GGng0=",
"owner": "lnl7",
"repo": "nix-darwin",
"rev": "4b9b83d5a92e8c1fbfd8eb27eda375908c11ec4d",
"type": "github"
},
"original": {
"owner": "lnl7",
"ref": "master",
"repo": "nix-darwin",
"type": "github"
}
},
"home-manager": {
"inputs": {
"nixpkgs": [
"agenix",
"nixpkgs"
]
},
"locked": {
"lastModified": 1703113217,
"narHash": "sha256-7ulcXOk63TIT2lVDSExj7XzFx09LpdSAPtvgtM7yQPE=",
"owner": "nix-community",
"repo": "home-manager",
"rev": "3bfaacf46133c037bb356193bd2f1765d9dc82c1",
"type": "github"
},
"original": {
"owner": "nix-community",
"repo": "home-manager",
"type": "github"
}
},
"home-manager_2": {
"inputs": {
"nixpkgs": [
"nixpkgs"
]
},
"locked": {
"lastModified": 1703527373,
"narHash": "sha256-AjypRssRtS6F3xkf7rE3/bXkIF2WJOZLbTIspjcE1zM=",
"owner": "nix-community",
"repo": "home-manager",
"rev": "80679ea5074ab7190c4cce478c600057cfb5edae",
"type": "github"
},
"original": {
"owner": "nix-community",
"ref": "master",
"repo": "home-manager",
"type": "github"
}
},
"homeage": {
"inputs": {
"nixpkgs": [
"nixpkgs"
]
},
"locked": {
"lastModified": 1669234151,
"narHash": "sha256-TwT87E3m2TZLgwYJESlype14HxUOrRGojPM5C2akrMg=",
"owner": "jordanisaacs",
"repo": "homeage",
"rev": "02bfe4ca06962d222e522fff0240c93946b20278",
"type": "github"
},
"original": {
"owner": "jordanisaacs",
"repo": "homeage",
"type": "github"
}
},
"nixos-hardware": {
"locked": {
"lastModified": 1681679909,
"narHash": "sha256-p4LR9MYP1Khn/2WJX7ElPTSN+Ce4N/0FYZsvH5VChgI=",
"owner": "nixos",
"repo": "nixos-hardware",
"rev": "34f96de8c9ad390d8717e3ca6260afd5f500de04",
"type": "github"
},
"original": {
"owner": "nixos",
"repo": "nixos-hardware",
"rev": "34f96de8c9ad390d8717e3ca6260afd5f500de04",
"type": "github"
}
},
"nixpkgs": {
"locked": {
"lastModified": 1703255338,
"narHash": "sha256-Z6wfYJQKmDN9xciTwU3cOiOk+NElxdZwy/FiHctCzjU=",
"owner": "nixos",
"repo": "nixpkgs",
"rev": "6df37dc6a77654682fe9f071c62b4242b5342e04",
"type": "github"
},
"original": {
"owner": "nixos",
"ref": "nixos-unstable",
"repo": "nixpkgs",
"type": "github"
}
},
"root": {
"inputs": {
"agenix": "agenix",
"home-manager": "home-manager_2",
"homeage": "homeage",
"nixos-hardware": "nixos-hardware",
"nixpkgs": "nixpkgs"
}
},
"systems": {
"locked": {
"lastModified": 1681028828,
"narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
"owner": "nix-systems",
"repo": "default",
"rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
"type": "github"
},
"original": {
"owner": "nix-systems",
"repo": "default",
"type": "github"
}
}
},
"root": "root",
"version": 7
}

45
images/flake.nix
View file

@ -1,22 +1,43 @@
{
description = "Build sd card images";
inputs.nixpkgs.url = "github:nixos/nixpkgs/nixos-22.11";
outputs = { self, nixpkgs }: rec {
nixosConfigurations.rpi2 = nixpkgs.lib.nixosSystem {
nixpkgs.crossSystem.system = "armv7l-linux";
imports = [
<nixpkgs/nixos/modules/installer/sd-card/sd-image-aarch64.nix>
];
description = "Build image";
inputs.nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";
inputs.agenix = {
url = "github:ryantm/agenix";
inputs.nixpkgs.follows = "nixpkgs";
};
inputs.homeage = {
url = "github:jordanisaacs/homeage";
inputs.nixpkgs.follows = "nixpkgs";
};
inputs.home-manager = {
url = "github:nix-community/home-manager/master";
inputs.nixpkgs.follows = "nixpkgs";
};
inputs.nixos-hardware.url = "github:nixos/nixos-hardware?rev=34f96de8c9ad390d8717e3ca6260afd5f500de04";
outputs = { self, agenix, homeage, home-manager, nixos-hardware, nixpkgs }@inputs:
rec {
nixosConfigurations.rpi4 = nixpkgs.lib.nixosSystem {
system = "aarch64-linux";
specialArgs = {inherit inputs;};
modules = [
"${nixpkgs}/nixos/modules/installer/sd-card/sd-image-raspberrypi.nix"
"${nixpkgs}/nixos/modules/installer/sd-card/sd-image-aarch64.nix"
# { environment.systemPackages = [ agenix.packages.aarch64-linux.default ]; }
agenix.nixosModules.default
# Below block enable cross-compiling from x86 to aarch
{
nixpkgs.config.allowUnsupportedSystem = true;
nixpkgs.hostPlatform.system = "armv7l-linux";
nixpkgs.hostPlatform.system = "aarch64-linux";
nixpkgs.buildPlatform.system = "x86_64-linux"; #If you build on x86 other wise changes this.
# ... extra configs as above
}
./systems/homepi/default.nix
];
};
images.rpi2 = nixosConfigurations.rpi2.config.system.build.sdImage;
# Enable reating an sd card image of this rpi4
images.rpi4 = nixosConfigurations.rpi4.config.system.build.sdImage;
};
}

53
images/systems/homepi/default.nix Normal file
View file

@ -0,0 +1,53 @@
{ agenix, config, lib, pkgs, inputs, homeage, ... }:
{
nixpkgs.config.allowUnsupportedSystem = true;
nixpkgs.hostPlatform.system = "aarch64-linux";
nixpkgs.buildPlatform.system = "x86_64-linux"; #If you build on x86 other wise changes this.
# ... extra configs as above
sdImage.compressImage = false;
services.openssh.enable = true;
networking.hostName = "homepi"; # Define your hostname.
networking.wireless.enable = true; # Enables wireless support via wpa_supplicant.
networking.wireless.networks = {
"Home5536" = {
psk = "3216240371";
};
};
nix = {
package = pkgs.nixFlakes;
extraOptions = ''
experimental-features = nix-command flakes
'';
gc = {
automatic = true;
dates = "weekly";
options = "--delete-older-than 7d";
};
};
environment.systemPackages = with pkgs; [
inputs.agenix
git
tailscale
vim # Do not forget to add an editor to edit configuration.nix! The Nano editor is also installed by default.
wget
];
users.mutableUsers = true;
users = {
users.pi = {
isNormalUser = true;
initialPassword = "raspberrypi";
extraGroups = [ "wheel" ]; # Enable ‘sudo’ for the user.
openssh.authorizedKeys.keys = [
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQD1LwyUmY8yaaIfPKn9aUIsbm8NkcLvx8MOILtKubMxOvnJ+ZkOQnqve/KE+VNdvOzlZgnnLA24ZAeM5fD8n/WFVjDRsKqXVAfZOIygm2/P1RzEK5+AoVOeIC25DhizNGJ0pE8F4aSVTmTtOq5kOf1bTSuVhv3p/k6ZusrzBI2HOEOUg/sfs3Q1L7wHDHTA5qxqYACLebGocq0KqWPW4GTJ67XEMiNIENBh4EEEDTaeQZjRomeeR0ssDlrNAabf+vp+dxEtyHXS9dPznCFUIh7KyCx1oKLBl/O3B2NuVycXdo2yGpPGF6iKC6HW6lBHkYWfmgunQ4NOZWpbFFF0nT7K/kbFjmQKn3h7xuH3wXqs+iGXlDCQ1c/7YKarrD/JOsyWN/qHj9nto5QE40GZZRqhO1i16jCgMTyk0VLwZ5Eq6+zAKBKBQ2t/aFov4i05LuM3geg3LO4BoyQnP/ikuDb4ENRb1+wlJp9kCk2YKZeLwcgBXYg9xkXpX5ZnQl9E26s= adriano@zenity"];
packages = with pkgs; [
];
};
};
system.stateVersion = "24.05";
}

12
systems/homepi/README.md Normal file
View file

@ -0,0 +1,12 @@
# Raspberry Pi / Kodi
Build Raspberry Pi 4 with Kodi and custom keymap to support a TV remote over CEC.
---
This system is not yet in its desired state. While it currently builds a working raspberrypi/kodi system, a few things
are not ideal.
1. It's pinned to an arbitrary NixOS 23.05 version due to a confluence of bugs between home-manager, and hardware
support for video acceleration and audio on raspberry pi.

272
systems/homepi/configuration.nix Normal file
View file

@ -0,0 +1,272 @@
# Edit this configuration file to define what should be installed on
# your system. Help is available in the configuration.nix(5) man page, on
# https://search.nixos.org/options and in the NixOS manual (`nixos-help`).
{ config, lib, pkgs, inputs, homeage, ... }:
{
imports =
[
"${inputs.nixos-hardware}/raspberry-pi/4"
./hardware-configuration.nix
];
boot = {
kernelParams = [ "kunit.enable=0" ];
supportedFilesystems = lib.mkForce [ "ntfs" "ext4" "vfat" "zfs" ];
initrd.availableKernelModules = [
"usbhid"
"usb_storage"
"vc4"
"pcie_brcmstb" # required for the pcie bus to work
"reset-raspberrypi" # required for vl805 firmware to load
];
loader = {
grub.enable = false;
generic-extlinux-compatible.enable = true;
};
kernel.sysctl = {
"net.ipv4.ip_forward" = "1";
"net.ipv6.conf.all.forwarding" = "1";
};
};
# Configure secrets
age = {
identityPaths = [ "/home/pi/.ssh/id_rsa_homepi" ];
secrets = {
wireless_networks = {
file = ./secrets/wireless_networks.age;
};
tailscale_key = {
file = ./secrets/tailscale_key.age;
};
};
};
sound.enable = true;
hardware = {
enableRedistributableFirmware = true;
deviceTree.filter = lib.mkDefault "bcm2711-rpi-4-b.dtb";
raspberry-pi."4".apply-overlays-dtmerge.enable = false;
raspberry-pi."4".fkms-3d.enable = true;
raspberry-pi."4".audio.enable = true;
pulseaudio.enable = true;
};
nix = {
package = pkgs.nixFlakes;
extraOptions = ''
experimental-features = nix-command flakes
'';
gc = {
automatic = true;
dates = "weekly";
options = "--delete-older-than 7d";
};
};
# Build libcec with raspberrypi support
nixpkgs.overlays = [
(self: super: { libcec = super.libcec.override { withLibraspberrypi = true; }; })
];
nixpkgs.config.allowUnfree = true;
time.timeZone = "America/Denver";
i18n.defaultLocale = "en_US.UTF-8";
services.openssh.enable = true;
services.xserver = {
enable = true;
layout = "us";
xkbOptions = "caps:ctrl_modifier";
displayManager = {
autoLogin = {
enable = true;
user = "kodi";
};
lightdm = {
enable = true;
autoLogin.timeout = 3;
};
};
desktopManager.kodi = {
enable = true;
package = pkgs.kodi.withPackages (pkgs: with pkgs; [ ]);
};
};
services.logind.extraConfig = ''
IdleAction=sleep
IdleActionSec=100000000000
'';
networking.wireless.enable = true; # Enables wireless support via wpa_supplicant.
networking.wireless.environmentFile = config.age.secrets.wireless_networks.path;
networking.wireless.networks = {
"Home5536" = {
psk = "@HOME5536_PSK@";
};
};
networking = {
hostName = "homepi"; # Define your hostname.
hostId = "0cb3361b";
firewall = {
# enable the firewall
enable = true;
# always allow traffic from your Tailscale network
trustedInterfaces = [ "tailscale0" ];
# allow the Tailscale UDP port through the firewall
allowedUDPPorts = [ config.services.tailscale.port ];
# allow you to SSH in over the public internet
allowedTCPPorts = [ 22 ];
};
};
environment.systemPackages = with pkgs; [
git
tailscale
vim # Do not forget to add an editor to edit configuration.nix! The Nano editor is also installed by default.
wget
libcec
libraspberrypi
raspberrypi-eeprom
zfs
zfstools
];
users.mutableUsers = true;
users = {
users.pi = {
isNormalUser = true;
initialPassword = "raspberrypi";
extraGroups = [ "wheel" ]; # Enable ‘sudo’ for the user.
openssh.authorizedKeys.keys = [
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQD1LwyUmY8yaaIfPKn9aUIsbm8NkcLvx8MOILtKubMxOvnJ+ZkOQnqve/KE+VNdvOzlZgnnLA24ZAeM5fD8n/WFVjDRsKqXVAfZOIygm2/P1RzEK5+AoVOeIC25DhizNGJ0pE8F4aSVTmTtOq5kOf1bTSuVhv3p/k6ZusrzBI2HOEOUg/sfs3Q1L7wHDHTA5qxqYACLebGocq0KqWPW4GTJ67XEMiNIENBh4EEEDTaeQZjRomeeR0ssDlrNAabf+vp+dxEtyHXS9dPznCFUIh7KyCx1oKLBl/O3B2NuVycXdo2yGpPGF6iKC6HW6lBHkYWfmgunQ4NOZWpbFFF0nT7K/kbFjmQKn3h7xuH3wXqs+iGXlDCQ1c/7YKarrD/JOsyWN/qHj9nto5QE40GZZRqhO1i16jCgMTyk0VLwZ5Eq6+zAKBKBQ2t/aFov4i05LuM3geg3LO4BoyQnP/ikuDb4ENRb1+wlJp9kCk2YKZeLwcgBXYg9xkXpX5ZnQl9E26s= adriano@zenity"];
packages = with pkgs; [
];
};
extraUsers.kodi = {
isNormalUser = true;
extraGroups = [ "video" "audio" ];
};
};
# fileSystems."/storage" = {
# device = "storage";
# depends = ["/run/cec.fifo"];
# fsType = "zfs";
# };
# Allow normal users to use CEC
services.udev.extraRules = ''
# allow access to raspi cec device for video group (and optionally register it as a systemd device, used below)
SUBSYSTEM=="vchiq", GROUP="video", MODE="0660", TAG+="systemd", ENV{SYSTEMD_ALIAS}="/dev/vchiq"
'';
systemd.sockets."cec-client" = {
after = [ "dev-vchiq.device" ];
bindsTo = [ "dev-vchiq.device" ];
wantedBy = [ "sockets.target" ];
socketConfig = {
ListenFIFO = "/run/cec.fifo";
SocketGroup = "video";
SocketMode = "0660";
};
};
systemd.services."cec-client" = {
after = [ "dev-vchiq.device" ];
bindsTo = [ "dev-vchiq.device" ];
wantedBy = [ "multi-user.target" ];
serviceConfig = {
ExecStart = ''${pkgs.libcec}/bin/cec-client -d 1'';
ExecStop = ''/bin/sh -c "echo q &gt; /run/cec.fifo"'';
StandardInput = "socket";
StandardOutput = "journal";
Restart="no";
};
};
# Enable tailscaled
services.tailscale.enable = true;
# create a oneshot job to authenticate to Tailscale
systemd.services.tailscale-autoconnect = {
description = "Automatic connection to Tailscale";
enable = true;
# make sure tailscale is running before trying to connect to tailscale
after = [ "network-pre.target" "tailscale.service" ];
wants = [ "network-pre.target" "tailscale.service" ];
wantedBy = [ "multi-user.target" ];
# set this service as a oneshot job
serviceConfig.Type = "oneshot";
# have the job run this shell script
script = with pkgs; ''
# wait for tailscaled to settle
sleep 2
# check if we are already authenticated to tailscale
status="$(${tailscale}/bin/tailscale status -json | ${jq}/bin/jq -r .BackendState)"
if [ $status = "Running" ]; then # if so, then do nothing
exit 0
fi
# otherwise authenticate with tailscale
${tailscale}/bin/tailscale up -authkey $(cat ${config.age.secrets.tailscale_key.path}) --accept-routes --advertise-routes=10.0.0.0/24 --advertise-exit-node --reset
'';
};
services = {
syncthing = {
enable = true;
user = "pi";
dataDir = "/home/pi/.config/syncthing";
configDir = "/home/pi/.config/syncthing/config";
guiAddress = "100.74.132.56:8384";
overrideDevices = true; # overrides any devices added or deleted through the WebUI
overrideFolders = true; # overrides any folders added or deleted through the WebUI
devices = {
"z1" = { id = "MXXILUU-IUTJYFM-5QW4SAL-SJB5EJY-NJ57ROO-OUI3KRK-G2AS3OU-7GXJKQU"; };
};
folders = {
"Documents" = { # Name of folder in Syncthing, also the folder ID
path = "/home/pi/Documents"; # Which folder to add to Syncthing
devices = [ "z1" ]; # Which devices to share the folder with
};
"KB" = { # Name of folder in Syncthing, also the folder ID
path = "/home/pi/KB"; # Which folder to add to Syncthing
devices = [ "z1" ]; # Which devices to share the folder with
};
};
};
};
# Copy the NixOS configuration file and link it from the resulting system
# (/run/current-system/configuration.nix). This is useful in case you
# accidentally delete configuration.nix.
# system.copySystemConfiguration = true;
# This value determines the NixOS release from which the default
# settings for stateful data, like file locations and database versions
# on your system were taken. It's perfectly fine and recommended to leave
# this value at the release version of the first install of this system.
# Before changing this value read the documentation for this option
# (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
system.stateVersion = "23.11"; # Did you read the comment?
}

33
systems/homepi/hardware-configuration.nix Normal file
View file

@ -0,0 +1,33 @@
# Do not modify this file! It was generated by ‘nixos-generate-config’
# and may be overwritten by future invocations. Please make changes
# to /etc/nixos/configuration.nix instead.
{ config, lib, pkgs, modulesPath, ... }:
{
imports =
[ (modulesPath + "/installer/scan/not-detected.nix")
];
boot.initrd.availableKernelModules = [ "xhci_pci" "usbhid" ];
boot.initrd.kernelModules = [ ];
boot.kernelModules = [ ];
boot.extraModulePackages = [ ];
fileSystems."/" =
{ device = "/dev/disk/by-uuid/44444444-4444-4444-8888-888888888888";
fsType = "ext4";
};
swapDevices = [ ];
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
# (the default) this is the recommended approach. When using systemd-networkd it's
# still possible to use this option, but it's recommended to use it in conjunction
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
networking.useDHCP = lib.mkDefault true;
# networking.interfaces.end0.useDHCP = lib.mkDefault true;
# networking.interfaces.wlan0.useDHCP = lib.mkDefault true;
nixpkgs.hostPlatform = lib.mkDefault "aarch64-linux";
powerManagement.cpuFreqGovernor = lib.mkDefault "ondemand";
}

29
systems/homepi/kodi.nix Normal file
View file

@ -0,0 +1,29 @@
{ config, pkgs, lib, homeage, ... }:
{
imports = [
#homeage.homeManagerModules.homeage
];
xsession = {
enable = true;
initExtra = ''
xset s off -display :0.0
xset s noblank -display :0.0
xset -dpms -dispaly :0.0
'';
};
programs.home-manager = {
enable = true;
};
home = {
stateVersion = "23.05";
sessionVariables = {};
file = {
".kodi/userdata/keymaps/kodi_remote_keymaps.xml".source = ./kodi_remote_keymaps.xml;
};
};
}

708
systems/homepi/kodi_remote_keymaps.xml Normal file
View file

@ -0,0 +1,708 @@
<?xml version="1.0" encoding="UTF-8"?>
<!-- This file contains the mapping of remote keys to actions within Kodi. -->
<!-- -->
<!-- The format is: -->
<!-- <window> -->
<!-- <device> -->
<!-- <button>action</button> -->
<!-- </device> -->
<!-- </window> -->
<!-- -->
<!-- The <global> section is a fall through - they will only be used if the button is -->
<!-- not used in the current window's section. -->
<!-- -->
<!-- Actions can be built-in functions. -->
<!-- eg <B>ActivateWindow(Music)</B> -->
<!-- would automatically go to Music on the press of the B button. -->
<!-- -->
<!-- An empty action removes the corresponding mapping from default and parent keymaps. -->
<!-- This is different from a "noop" action, which disables a button. -->
<!-- -->
<!-- More documentation on keymaps can be found on http://kodi.wiki/view/keymaps -->
<keymap>
<global>
<remote>
<play>PlayPause</play>
<pause>Pause</pause>
<stop>Stop</stop>
<forward>FastForward</forward>
<reverse>Back</reverse>
<info>Back</info>
<left>Left</left>
<right>Right</right>
<up>Up</up>
<down>Down</down>
<select>Select</select>
<enter>FullScreen</enter>
<pageplus>PageUp</pageplus>
<pageminus>PageDown</pageminus>
<one>Back</one>
<menu>ContextMenu</menu>
<contentsmenu>PreviousMenu</contentsmenu>
<rootmenu>PreviousMenu</rootmenu>
<title>ContextMenu</title>
<info>Info</info>
<skipplus>SkipNext</skipplus>
<skipminus>SkipPrevious</skipminus>
<display>FullScreen</display>
<start>PreviousMenu</start>
<record>Record</record>
<eject>EjectTray()</eject>
<volumeplus>VolumeUp</volumeplus>
<volumeminus>VolumeDown</volumeminus>
<mute>Mute</mute>
<power>ShutDown()</power>
<myvideo>ActivateWindow(Videos)</myvideo>
<mymusic>ActivateWindow(Music)</mymusic>
<mypictures>ActivateWindow(Pictures)</mypictures>
<mytv>ActivateWindow(Videos,TvShows)</mytv>
<guide>ActivateWindow(TVGuide)</guide>
<livetv>ActivateWindow(TVChannels)</livetv>
<liveradio>ActivateWindow(RadioChannels)</liveradio>
<recordedtv>ActivateWindow(TVRecordings)</recordedtv>
<epgsearch>ActivateWindow(TVSearch)</epgsearch>
<red>ActivateWindow(TVChannels)</red>
<green>ActivateWindow(Videos)</green>
<yellow>ActivateWindow(Music)</yellow>
<blue>ActivateWindow(Pictures)</blue>
<zero>Number0</zero>
<two>JumpSMS2</two>
<three>JumpSMS3</three>
<four>JumpSMS4</four>
<five>JumpSMS5</five>
<six>JumpSMS6</six>
<seven>JumpSMS7</seven>
<eight>JumpSMS8</eight>
<nine>JumpSMS9</nine>
<print>Screenshot</print>
</remote>
</global>
<Home>
<remote>
<clear>ActivateWindow(Weather)</clear>
<hash>ActivateWindow(Settings)</hash>
</remote>
</Home>
<TVRecordings>
<remote>
<clear>Delete</clear>
<red>Red</red>
<green>Green</green>
<yellow>Yellow</yellow>
<blue>Blue</blue>
</remote>
</TVRecordings>
<TVTimers>
<remote>
<clear>Delete</clear>
<red>Red</red>
<green>Green</green>
<yellow>Yellow</yellow>
<blue>Blue</blue>
</remote>
</TVTimers>
<TVTimerRules>
<remote>
<clear>Delete</clear>
<red>Red</red>
<green>Green</green>
<yellow>Yellow</yellow>
<blue>Blue</blue>
</remote>
</TVTimerRules>
<RadioRecordings>
<remote>
<clear>Delete</clear>
<red>Red</red>
<green>Green</green>
<yellow>Yellow</yellow>
<blue>Blue</blue>
</remote>
</RadioRecordings>
<RadioTimers>
<remote>
<clear>Delete</clear>
<red>Red</red>
<green>Green</green>
<yellow>Yellow</yellow>
<blue>Blue</blue>
</remote>
</RadioTimers>
<RadioTimerRules>
<remote>
<clear>Delete</clear>
<red>Red</red>
<green>Green</green>
<yellow>Yellow</yellow>
<blue>Blue</blue>
</remote>
</RadioTimerRules>
<FileManager>
<remote>
<clear>Delete</clear>
<zero>Highlight</zero>
<star>Move</star>
<hash>Rename</hash>
</remote>
</FileManager>
<FileBrowser>
<remote>
<zero>Highlight</zero>
</remote>
</FileBrowser>
<MusicPlaylist>
<remote>
<clear>Delete</clear>
<zero>Delete</zero>
</remote>
</MusicPlaylist>
<MusicPlaylistEditor>
<remote>
<zero>Queue</zero>
</remote>
</MusicPlaylistEditor>
<Music>
<remote>
<zero>Queue</zero>
<star>Queue</star>
</remote>
</Music>
<Pictures>
<remote>
<clear>Delete</clear>
</remote>
</Pictures>
<FullscreenVideo>
<remote>
<zero>Number0</zero>
<one>Back</one>
<two>Number2</two>
<three>Number3</three>
<four>Number4</four>
<five>Number5</five>
<six>Number6</six>
<seven>Number7</seven>
<eight>Number8</eight>
<nine>Number9</nine>
<left>StepBack</left>
<right>StepForward</right>
<up>ChapterOrBigStepForward</up>
<down>ChapterOrBigStepBack</down>
<back>Back</back>
<menu>OSD</menu>
<contentsmenu>OSD</contentsmenu>
<rootmenu>OSD</rootmenu>
<start>OSD</start>
<select>OSD</select>
<title>PlayerProcessInfo</title>
<info>Info</info>
<guide>ActivateWindow(TVGuide)</guide>
<teletext>ActivateWindow(Teletext)</teletext>
<subtitle>NextSubtitle</subtitle>
<star>NextSubtitle</star>
<language>AudioNextLanguage</language>
<playlist>Playlist</playlist>
<hash>AudioNextLanguage</hash>
<pageplus>SkipNext</pageplus>
<pageminus>SkipPrevious</pageminus>
</remote>
</FullscreenVideo>
<FullscreenGame>
<remote>
<left>StepBack</left>
<right>StepForward</right>
<back>Back</back>
<menu>OSD</menu>
<contentsmenu>OSD</contentsmenu>
<rootmenu>OSD</rootmenu>
<start>OSD</start>
<select>OSD</select>
<title>CodecInfo</title>
<info>Info</info>
</remote>
</FullscreenGame>
<VideoTimeSeek>
<remote>
<select>Select</select>
<enter>Select</enter>
</remote>
</VideoTimeSeek>
<FullscreenInfo>
<remote>
<title>PlayerProcessInfo</title>
<info>Back</info>
<menu>OSD</menu>
<contentsmenu>OSD</contentsmenu>
<rootmenu>OSD</rootmenu>
</remote>
</FullscreenInfo>
<PlayerControls>
<remote>
<menu>Back</menu>
<contentsmenu>Back</contentsmenu>
<rootmenu>Back</rootmenu>
</remote>
</PlayerControls>
<Visualisation>
<remote>
<left>StepBack</left>
<right>StepForward</right>
<up>SkipNext</up>
<down>SkipPrevious</down>
<pageplus>IncreaseRating</pageplus>
<pageminus>DecreaseRating</pageminus>
<back>Back</back>
<title>PlayerProcessInfo</title>
<select>OSD</select>
<menu>OSD</menu>
<contentsmenu>OSD</contentsmenu>
<rootmenu>OSD</rootmenu>
<start>OSD</start>
<info>Info</info>
<guide>ActivateWindow(TVGuide)</guide>
<playlist>ActivateWindow(PVROSDChannels)</playlist>
<zero>Number0</zero>
<two>Number2</two>
<three>Number3</three>
<four>Number4</four>
<five>Number5</five>
<six>Number6</six>
<seven>Number7</seven>
<eight>Number8</eight>
<nine>Number9</nine>
</remote>
</Visualisation>
<MusicOSD>
<remote>
<menu>Back</menu>
<contentsmenu>Back</contentsmenu>
<rootmenu>Back</rootmenu>
<title>Info</title>
<info>PlayerProcessInfo</info>
</remote>
</MusicOSD>
<VisualisationPresetList>
<remote>
<menu>Back</menu>
<contentsmenu>Back</contentsmenu>
<rootmenu>Back</rootmenu>
</remote>
</VisualisationPresetList>
<SlideShow>
<remote>
<zero>ZoomNormal</zero>
<two>ZoomLevel2</two>
<three>ZoomLevel3</three>
<four>ZoomLevel4</four>
<five>ZoomLevel5</five>
<six>ZoomLevel6</six>
<seven>ZoomLevel7</seven>
<eight>ZoomLevel8</eight>
<nine>ZoomLevel9</nine>
<info>Info</info>
<skipplus>NextPicture</skipplus>
<skipminus>PreviousPicture</skipminus>
<title>Info</title>
<select>Rotate</select>
</remote>
</SlideShow>
<ScreenCalibration>
<remote>
<select>NextCalibration</select>
<zero>ResetCalibration</zero>
<display>NextResolution</display>
<xbox>NextResolution</xbox>
</remote>
</ScreenCalibration>
<ScreenCalibration>
<remote>
<select>NextCalibration</select>
<zero>ResetCalibration</zero>
</remote>
</ScreenCalibration>
<VideoOSD>
<remote>
<menu>Back</menu>
<contentsmenu>Back</contentsmenu>
<rootmenu>Back</rootmenu>
<start>Back</start>
</remote>
</VideoOSD>
<VideoMenu>
<remote>
<menu>OSD</menu>
<contentsmenu>OSD</contentsmenu>
<rootmenu>OSD</rootmenu>
<info>Info</info>
<title>PlayerProcessInfo</title>
<zero>Number0</zero>
<two>Number2</two>
<three>Number3</three>
<four>Number4</four>
<five>Number5</five>
<six>Number6</six>
<seven>Number7</seven>
<eight>Number8</eight>
<nine>Number9</nine>
<play>Select</play>
<pageplus>SkipNext</pageplus>
<pageminus>SkipPrevious</pageminus>
</remote>
</VideoMenu>
<OSDVideoSettings>
<remote>
<menu>Back</menu>
<contentsmenu>Back</contentsmenu>
<rootmenu>Back</rootmenu>
<start>Back</start>
</remote>
</OSDVideoSettings>
<OSDAudioSettings>
<remote>
<menu>Back</menu>
<contentsmenu>Back</contentsmenu>
<rootmenu>Back</rootmenu>
<start>Back</start>
</remote>
</OSDAudioSettings>
<VideoBookmarks>
<remote>
<menu>Back</menu>
<contentsmenu>Back</contentsmenu>
<rootmenu>Back</rootmenu>
<start>Back</start>
<zero>Delete</zero>
</remote>
</VideoBookmarks>
<Videos>
<remote>
<zero>Queue</zero>
<clear>Delete</clear>
</remote>
</Videos>
<VideoPlaylist>
<remote>
<clear>Delete</clear>
<zero>Delete</zero>
</remote>
</VideoPlaylist>
<VirtualKeyboard>
<remote>
<back>Back</back>
<star>Shift</star>
<hash>Symbols</hash>
<zero>Number0</zero>
<two>Number2</two>
<three>Number3</three>
<four>Number4</four>
<five>Number5</five>
<six>Number6</six>
<seven>Number7</seven>
<eight>Number8</eight>
<nine>Number9</nine>
<enter>Enter</enter>
<pageminus>CursorLeft</pageminus>
<pageplus>CursorRight</pageplus>
</remote>
</VirtualKeyboard>
<ContextMenu>
<remote>
<title>Back</title>
</remote>
</ContextMenu>
<Programs>
<remote>
<info>info</info>
</remote>
</Programs>
<NumericInput>
<remote>
<zero>Number0</zero>
<two>Number2</two>
<three>Number3</three>
<four>Number4</four>
<five>Number5</five>
<six>Number6</six>
<seven>Number7</seven>
<eight>Number8</eight>
<nine>Number9</nine>
<enter>Enter</enter>
<back>Back</back>
</remote>
</NumericInput>
<Weather>
<remote>
<back>PreviousMenu</back>
</remote>
</Weather>
<Settings>
<remote>
<back>PreviousMenu</back>
</remote>
</Settings>
<AddonBrowser>
<remote>
</remote>
</AddonBrowser>
<AddonInformation>
<remote>
<back>Close</back>
</remote>
</AddonInformation>
<AddonSettings>
<remote>
<back>Close</back>
</remote>
</AddonSettings>
<TextViewer>
<remote>
<back>Close</back>
</remote>
</TextViewer>
<PlayerSettings>
<remote>
<back>PreviousMenu</back>
</remote>
</PlayerSettings>
<MediaSettings>
<remote>
<back>PreviousMenu</back>
</remote>
</MediaSettings>
<SystemSettings>
<remote>
<back>PreviousMenu</back>
</remote>
</SystemSettings>
<ServiceSettings>
<remote>
<back>PreviousMenu</back>
</remote>
</ServiceSettings>
<InterfaceSettings>
<remote>
<back>PreviousMenu</back>
</remote>
</InterfaceSettings>
<Profiles>
<remote>
<back>PreviousMenu</back>
</remote>
</Profiles>
<systeminfo>
<remote>
<back>PreviousMenu</back>
</remote>
</systeminfo>
<shutdownmenu>
<remote>
<back>PreviousMenu</back>
</remote>
</shutdownmenu>
<submenu>
<remote>
<back>PreviousMenu</back>
</remote>
</submenu>
<MusicInformation>
<remote>
<info>Back</info>
</remote>
</MusicInformation>
<MovieInformation>
<remote>
<info>Back</info>
</remote>
</MovieInformation>
<LockSettings>
<remote>
<menu>Back</menu>
<contentsmenu>Back</contentsmenu>
<rootmenu>Back</rootmenu>
</remote>
</LockSettings>
<ProfileSettings>
<remote>
<menu>Back</menu>
<contentsmenu>Back</contentsmenu>
<rootmenu>Back</rootmenu>
</remote>
</ProfileSettings>
<PictureInfo>
<remote>
<skipplus>NextPicture</skipplus>
<skipminus>PreviousPicture</skipminus>
<info>Back</info>
</remote>
</PictureInfo>
<Teletext>
<remote>
<zero>number0</zero>
<two>number2</two>
<three>number3</three>
<four>number4</four>
<five>number5</five>
<six>number6</six>
<seven>number7</seven>
<eight>number8</eight>
<nine>number9</nine>
<red>Red</red>
<green>Green</green>
<yellow>Yellow</yellow>
<blue>Blue</blue>
<info>Info</info>
<menu>Back</menu>
<contentsmenu>Back</contentsmenu>
<rootmenu>Back</rootmenu>
<start>Back</start>
<teletext>Back</teletext>
</remote>
</Teletext>
<Favourites>
<remote>
<back>Close</back>
</remote>
</Favourites>
<FullscreenLiveTV>
<remote>
<left>StepBack</left>
<right>StepForward</right>
<up>Up</up>
<down>Down</down>
<pageplus>ChannelUp</pageplus>
<pageminus>ChannelDown</pageminus>
</remote>
</FullscreenLiveTV>
<FullscreenRadio>
<remote>
<left>StepBack</left>
<right>StepForward</right>
<up>Up</up>
<down>Down</down>
<pageplus>ChannelUp</pageplus>
<pageminus>ChannelDown</pageminus>
</remote>
</FullscreenRadio>
<FullscreenLiveTvPreview>
<remote>
<select>Select</select>
</remote>
</FullscreenLiveTvPreview>
<FullscreenRadioPreview>
<remote>
<select>Select</select>
</remote>
</FullscreenRadioPreview>
<FullscreenLiveTvInput>
<remote>
<select>Select</select>
</remote>
</FullscreenLiveTvInput>
<FullscreenRadioInput>
<remote>
<select>Select</select>
</remote>
</FullscreenRadioInput>
<PVROSDChannels>
<remote>
<back>Close</back>
<start>Close</start>
<playlist>Close</playlist>
<zero>Number0</zero>
<two>number2</two>
<three>number3</three>
<four>number4</four>
<five>number5</five>
<six>number6</six>
<seven>number7</seven>
<eight>number8</eight>
<nine>number9</nine>
</remote>
</PVROSDChannels>
<PVRChannelGuide>
<remote>
<back>Close</back>
<start>Close</start>
<guide>Close</guide>
<zero>Number0</zero>
<two>number2</two>
<three>number3</three>
<four>number4</four>
<five>number5</five>
<six>number6</six>
<seven>number7</seven>
<eight>number8</eight>
<nine>number9</nine>
</remote>
</PVRChannelGuide>
<TVChannels>
<remote>
<zero>Number0</zero>
<two>number2</two>
<three>number3</three>
<four>number4</four>
<five>number5</five>
<six>number6</six>
<seven>number7</seven>
<eight>number8</eight>
<nine>number9</nine>
</remote>
</TVChannels>
<TVGuide>
<remote>
<zero>Number0</zero>
<two>number2</two>
<three>number3</three>
<four>number4</four>
<five>number5</five>
<six>number6</six>
<seven>number7</seven>
<eight>number8</eight>
<nine>number9</nine>
</remote>
</TVGuide>
<RadioChannels>
<remote>
<zero>Number0</zero>
<two>number2</two>
<three>number3</three>
<four>number4</four>
<five>number5</five>
<six>number6</six>
<seven>number7</seven>
<eight>number8</eight>
<nine>number9</nine>
</remote>
</RadioChannels>
<RadioGuide>
<remote>
<zero>Number0</zero>
<two>number2</two>
<three>number3</three>
<four>number4</four>
<five>number5</five>
<six>number6</six>
<seven>number7</seven>
<eight>number8</eight>
<nine>number9</nine>
</remote>
</RadioGuide>
<PVRSettings>
<remote>
<back>PreviousMenu</back>
</remote>
</PVRSettings>
<Addon>
<remote>
<red>Red</red>
<green>Green</green>
<yellow>Yellow</yellow>
<blue>Blue</blue>
</remote>
</Addon>
<PlayerProcessInfo>
<remote>
<title>PlayerProcessInfo</title>
</remote>
</PlayerProcessInfo>
</keymap>

27
systems/homepi/secrets/README.md Normal file
View file

@ -0,0 +1,27 @@
# About
This directory contains encrypted secrets.
The private keys for the public keys listed in `secrets.nix` must be available on any systems that use the `z1` flake at the top-level of this repository.
NixOS does not handle private keys with pass phrases well. It is recommended that one generate keys without passphrases, e.g.
> ssh-keygen -t rsa -b 4096 -C "code@adriano.fyi" -f ~/.ssh/id_rsa_homepi -P ""
## Dependencies
Adding keys and re-keying require `agenix` to be installed. On a nix system, install with `nix-env -i agenix`.
## Re-keying
Re-keying must be done when new keys are added.
> agenix -r
## Adding secrets
To add new secrets, edit `secrets.nix` and then edit this contents of the new secrets with:
> agenix -e <SECRET NAME>
Don't forget to commit new secrets to git.

8
systems/homepi/secrets/secrets.nix Normal file
View file

@ -0,0 +1,8 @@
let
homepi = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCfzyZYbuGbITft9sYO3T7mJ14Hxk/fqtml4l7nWwoId3UlUuGI4eCHzxi8pZAmDgyAn1rglX8FAGUqLFkQaryoQ6N8Qx2Jpi2TNAudBjucxPsjLY8e7HjD12MhL8U2w7KsH/t7utlxSMVTodpNMMW1uuKbPF/9YnIyL5Mm1aoCfxIOUgDok8VXFgVptx26TfV+6GvaAAaFCnftiOjnSKsbcdVpvpU0LGtCEUyj803kjebSJ+VVPUT6jPs+4EQqzR74ZQKMgCwTrTVrYLG+d+p9zLOPUDLpIKeuA4i3dzFcs+XcR28FqQv8I7Kg3ICqM/Cmbc+eKvN6qqDKfA5GfXyPI7WSPfUcIANUrQrrw/ORL4ZmyJfeZsBm1MRMGevxtIzFm1qcpn39Oe7CSDGwmrONMybI4gD0SB5FndUEU7E+b/QoWq2QQ6sZ2EmSLBLui0RoM1Uth6q4J+anJUWXcqx7sBdkucv0UzVbgIYcKQXt+VzyyzXcLRfJOSiAgBLttZXqe3NwuZ3UaxFdhRbeslyhbzGrek8sJmeCowj+L9o4+lxZy6R2LLKXVnPhE7fweou84T1dglQ9ZbdqD+8ChY5KjP2nAZqZppA+JZOOifHhX5/tdA3qeKsMZUnbiYsAMqZ4ABYXKwLxUlmVGPd7TeY+erODlOu7f7QyUpvxSUJ/3w== code@adriano.fyi";
in {
"tailscale_key.age".publicKeys = [ homepi ];
"wireless_networks.age".publicKeys = [ homepi ];
}

19
systems/homepi/secrets/tailscale_key.age Normal file
View file

@ -0,0 +1,19 @@
age-encryption.org/v1
-> ssh-rsa 9/cTkg
WtxpN7syb0ExQeXE2V01TRBGLdTBirJzJ/2ZARG1pRFguvEG3Ylm/7z6tZoQ8/Ex
eli4eD9otiyrFllCU2mvyPCNVYwqdViU7dJqa38Q3sedHStecvu95yRrGw2brsG/
nUFYbF3wO2nLkiOCBD+jsXn2t+03ImE5gad4wSuBqk31D0ybYCFekGPpUCW4EBiC
5+97VpRjN26Gb1AUb98aWYjGG1nxd5OBHyh9VzntH+ngLdiBE4g3ymNOMOw8wK4s
z0ljo9VWMOSUF5GEInKtRgFSIDEeUl2YVAyrwqS7uY9XulgSm7AecFHE5wcU5Wv6
1yUnTycHpwY1BT8fqWcfqpcZl1/OfdwfDmxjVKqT8gbgcdoepEPJv05mHIVSQqc3
PDcc6He/Bm5MaFfuZDUh04t+cO5nAnQF8S0ObpJHOUKQGg0BoQgfHR6wWfLpoFXr
cs+MO8N0h8y2Ajj4ZKjXzmGLOHAaSaL5hZGNQrni26VH3VBiJVXeyqozNL7o3h78
P2mX8ed3pti5D58KsjKH8aEI7sw2SsG2PCiikTNgt1xICOT9CAxbc2z/8LB533lE
joesmYsyy6OAgKTcUfOTCyPs+n0hDb2zBuJNz8hWx2hzbU0NIPO85Nw6j/nESGgu
Lyy+P+lfpptOy0Y5DPsqQFcLC8U3H95ssY0YWgNWhLo
-> ]w`K~-grease U7>C/B f
luasyuL3yDvvBv/ak+yOrfwKo0/lpkeYjWxKWRz5bDE+w0C8mDS7joApwB2w+lM4
2pqB7wp3cdnDlYLgXyGrV0phL1tVFUFx7nfnUJdKWL5V3rhR44lvBvI
--- 6M11C0PXbCA6Aun/6oM0WQ0I5IQjs0KLLDSD0Jt1qbs
OŸÚ<EFBFBD>Ÿ›h
È6vCqk!„gßp{#†ó¶‹ÄùV¤ì÷Ĉ}:ÝcxsÛ<73> O©€¬zÔè»!‚» · *æ¹NWÀz©7IýVAoLl: Üå€Ü1P¸Õ

18
systems/homepi/secrets/wireless_networks.age Normal file
View file

@ -0,0 +1,18 @@
age-encryption.org/v1
-> ssh-rsa 9/cTkg
mVjXnI6HmQYkdFymjNFrPAvQ3hc7KJeJ19ZwB/kO3kvkMpHdrjwaACTf87fCdCLg
R2FPwhRvsA5MoHzayMHBeBHQ884TukN7YLep6bhQfSpeW5fORUbvMQa3gmXS1Aq9
kKRmiV91J7OnbMliALYvl7x6Uz3u8JVCJbCzD3GV8e6gXLihN0a15J7InBR808Ar
0pndza1YpOdVB62VsuLcx03/6zqkX0/kEi0sukZGwjyxzGts8HHLLp8DvlhfSrnI
JwWs4PItse3PPZsc+84A6HZJawssbwwwks8KgXGITmzRgf5ayKzwyIhRd5NV3Epp
ZPoGfxUCixa8N/dkrXYh4s2qwO0YSgfn5uiTMCAoLVUs4x15KjOHVvVKOp+6OLUm
UKu9kpRyB8l39rq+5+vA5Jm9fLQB6zIC8DOBORSXy/eds0mttaC6XiDkz3WBjKNb
f/wtpm3bCd2+MZxXVvl9BHtrWxSEEPMCCKhvtgmZ4/O4s2JQPbBZiX7RcvN9Eg0v
MD0lYgux3Gi4TS2O4HnMJxucnEhbl5fhteCzf05l3sa0QKLwSWwoOEQZZ1uCv+gW
nFpAKhnXMkgn/xe9ZG2mrTl2c0MZGN7zgENtPcafSetzC+u+WqHfV+YS47Nm14mg
EF+HxK4gdRkpHVLd28TULhQIVEclKzu0GaUG6jcBwBU
-> !J@\&s*M-grease FoUi
d++ceD+X58Damnv/QkfYhwdCj5pXE7sW1si7ByC2BZT432hDL/vGqx2T/mZJwVWY
H18
--- KgSfaKVCvVAsmCjwGhGqM0HxdjTt4BGXaQGQtAfsBf0
<EFBFBD>Ì£ø縿öÇ`ï»j‰ØNQJÊ¡kþc“èAÐï‚FŒìûªî'ÈñZÔÔ¶<16>½³PÙûº

15
systems/z1/configuration.nix
View file

@ -275,11 +275,11 @@
# wait for tailscaled to settle
sleep 2
# check if we are already authenticated to tailscale
status="$(${tailscale}/bin/tailscale status -json | ${jq}/bin/jq -r .BackendState)"
if [ $status = "Running" ]; then # if so, then do nothing
exit 0
fi
# # check if we are already authenticated to tailscale
# status="$(${tailscale}/bin/tailscale status -json | ${jq}/bin/jq -r .BackendState)"
# if [ $status = "Running" ]; then # if so, then do nothing
# exit 0
# fi
# otherwise authenticate with tailscale
${tailscale}/bin/tailscale up -authkey $(cat ${config.age.secrets.tailscale_key.path}) --accept-routes --reset
@ -389,15 +389,16 @@
devices = {
"roampi" = { id = "PD2KG67-FKNO6QS-UTY24Q7-L6QQM6B-KL5NYMZ-A5HKAEH-4VYLSZR-WCCBPQT"; };
"Miniroam" = { id = "F7UWLCE-JPZXXU2-4SHXZ3X-BM3T3U7-DTSVPVA-TXFYB67-5TCR574-MSYRJQR"; };
"homepi" = { id = "CGBRCYB-2USPMPW-VKMVC4N-7SF2QLX-W5WWKHX-YD22FCO-XFNTJPC-RCKW5AY"; };
};
folders = {
"Documents" = { # Name of folder in Syncthing, also the folder ID
path = "/home/adriano/Nextcloud/Documents"; # Which folder to add to Syncthing
devices = [ "roampi" "Miniroam" ]; # Which devices to share the folder with
devices = [ "roampi" "Miniroam" "homepi" ]; # Which devices to share the folder with
};
"KB" = { # Name of folder in Syncthing, also the folder ID
path = "/home/adriano/KB"; # Which folder to add to Syncthing
devices = [ "roampi" "Miniroam" ]; # Which devices to share the folder with
devices = [ "roampi" "Miniroam" "homepi" ]; # Which devices to share the folder with
};
};

8
systems/z1/secrets/README.md
View file

@ -6,11 +6,13 @@ The private keys for the public keys listed in `secrets.nix` must be available o
NixOS does not handle private keys with pass phrases well. It is recommended that one generate keys without passphrases, e.g.
> ssh-keygen -t rsa -b 4096 -C "code@adriano.fyi" -f ~/.ssh/id_rsa_nixos
> ssh-keygen -t rsa -b 4096 -C "code@adriano.fyi" -f ~/.ssh/id_rsa_<system_name> -P ""
Once keys have been generated for the new system, the private key needs to be transferred to the new system: `/root/.ssh/id_rsa`
## Dependencies
Adding keys and re-keying require `agenix` to be installed. On a nix system, install with `nix-env -i agenix`.
Adding keys and re-keying require `agenix` to be installed. On a nix system, install with `nix-shell -p agenix`.
## Re-keying
@ -24,4 +26,4 @@ To add new secrets, edit `secrets.nix` and then edit this contents of the new se
> agenix -e <SECRET NAME>
Don't forget to commit new secrets to git.
Don't forget to commit new secrets to git.