manatee: Add host manatee

flake.lock

@@ -45,6 +45,26 @@
         "type": "github"
       }
     },
+    "disko": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1745812220,
+        "narHash": "sha256-hotBG0EJ9VmAHJYF0yhWuTVZpENHvwcJ2SxvIPrXm+g=",
+        "owner": "nix-community",
+        "repo": "disko",
+        "rev": "d0c543d740fad42fe2c035b43c9d41127e073c78",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "disko",
+        "type": "github"
+      }
+    },
     "emacs-overlay": {
       "inputs": {
         "nixpkgs": [
@@ -234,6 +254,7 @@
     "root": {
       "inputs": {
         "agenix": "agenix",
+        "disko": "disko",
         "emacs-overlay": "emacs-overlay",
         "home-manager": "home-manager_2",
         "hyprland-contrib": "hyprland-contrib",

flake.nix

@@ -6,6 +6,11 @@
 
     nixos-hardware.url = "github:nixos/nixos-hardware/master";
 
+    disko = {
+      url = "github:nix-community/disko";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
     nh = {
       url = "github:viperML/nh";
       inputs.nixpkgs.follows = "nixpkgs";
@@ -60,6 +65,17 @@
           ];
         };
 
+        manatee = inputs.nixpkgs.lib.nixosSystem {
+          system = "x86_64-linux";
+          specialArgs = {
+            inherit inputs;
+          };
+          modules = [
+            ./hosts/manatee/configuration.nix
+            ./hosts/manatee/home.nix
+          ];
+        };
+
         backwards = inputs.nixpkgs.lib.nixosSystem {
           system = "x86_64-linux";
           specialArgs = {

hosts/manatee/configuration.nix

@@ -0,0 +1,50 @@
+{ pkgs, ... }:
+{
+  imports = [
+    ../../config-manager/default.nix
+    ./hardware-configuration.nix
+    ./disk-config.nix
+    ./modules
+  ];
+
+  nix.settings.experimental-features = [
+    "nix-command"
+    "flakes"
+  ];
+  nixpkgs.config.allowUnfree = true;
+
+  users.users.alex = {
+    isNormalUser = true;
+    description = "alex";
+    extraGroups = [ "wheel" ];
+  };
+
+  environment.systemPackages = with pkgs; [
+    vim
+    git
+  ];
+
+  config-manager = {
+    flakePath = "/home/alex/config";
+  };
+
+  # This option defines the first version of NixOS you have installed on this particular machine,
+  # and is used to maintain compatibility with application data (e.g. databases) created on older NixOS versions.
+  #
+  # Most users should NEVER change this value after the initial install, for any reason,
+  # even if you've upgraded your system to a new NixOS release.
+  #
+  # This value does NOT affect the Nixpkgs version your packages and OS are pulled from,
+  # so changing it will NOT upgrade your system - see https://nixos.org/manual/nixos/stable/#sec-upgrading for how
+  # to actually do that.
+  #
+  # This value being lower than the current NixOS release does NOT mean your system is
+  # out of date, out of support, or vulnerable.
+  #
+  # Do NOT change this value unless you have manually inspected all the changes it would make to your configuration,
+  # and migrated your data accordingly.
+  #
+  # For more information, see `man configuration.nix` or https://nixos.org/manual/nixos/stable/options#opt-system.stateVersion .
+  system.stateVersion = "24.11"; # Did you read the comment?
+
+}

hosts/manatee/disk-config.nix

@@ -0,0 +1,110 @@
+{ inputs, ... }:
+{
+  imports = [ inputs.disko.nixosModules.disko ];
+
+  config = {
+    networking.hostId = "0a9474e7"; # Required by ZFS
+    disko.devices = {
+      disk = {
+        root = {
+          type = "disk";
+          device = "/dev/nvme0n1";
+          content = {
+            type = "gpt";
+            partitions = {
+              ESP = {
+                size = "500M";
+                type = "EF00";
+                content = {
+                  type = "filesystem";
+                  format = "vfat";
+                  mountpoint = "/boot";
+                  mountOptions = [ "umask=0077" ];
+                };
+              };
+
+              root = {
+                size = "100%";
+                content = {
+                  type = "filesystem";
+                  format = "ext4";
+                  mountpoint = "/";
+                };
+              };
+            };
+          };
+        };
+
+        disk1 = {
+          type = "disk";
+          device = "/dev/disk/by-id/ata-ST8000VN004-3CP101_WWZ8QCG4";
+          content = {
+            type = "gpt";
+            partitions = {
+              zfs = {
+                size = "100%";
+                content = {
+                  type = "zfs";
+                  pool = "storage";
+                };
+              };
+            };
+          };
+        };
+
+        disk2 = {
+          type = "disk";
+          device = "/dev/disk/by-id/ata-ST8000VN004-3CP101_WWZ8QDJ5";
+          content = {
+            type = "gpt";
+            partitions = {
+              zfs = {
+                size = "100%";
+                content = {
+                  type = "zfs";
+                  pool = "storage";
+                };
+              };
+            };
+          };
+        };
+      };
+
+      zpool = {
+        storage = {
+          type = "zpool";
+
+          mode = {
+            topology = {
+              type = "topology";
+              vdev = [
+                {
+                  mode = "mirror";
+                  members = [
+                    "disk1"
+                    "disk2"
+                  ];
+                }
+              ];
+            };
+          };
+
+          rootFsOptions = {
+            mountpoint = "none";
+            compression = "zstd";
+            xattr = "sa";
+            "com.sun:auto-snapshot" = "false";
+          };
+
+          datasets = {
+            media = {
+              type = "zfs_fs";
+              mountpoint = "/mnt/media";
+              options.mountpoint = "legacy"; # otherwise we get a race between systemd and zfs; https://github.com/nix-community/disko/issues/214
+            };
+          };
+        };
+      };
+    };
+  };
+}

hosts/manatee/hardware-configuration.nix

@@ -0,0 +1,39 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{
+  config,
+  lib,
+  pkgs,
+  modulesPath,
+  ...
+}:
+
+{
+  imports = [
+    (modulesPath + "/installer/scan/not-detected.nix")
+  ];
+
+  boot.initrd.availableKernelModules = [
+    "xhci_pci"
+    "nvme"
+    "ahci"
+    "usb_storage"
+    "usbhid"
+    "sd_mod"
+  ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-intel" ];
+  boot.extraModulePackages = [ ];
+
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  networking.useDHCP = lib.mkDefault true;
+  # networking.interfaces.enp3s0.useDHCP = lib.mkDefault true;
+  # networking.interfaces.enp4s0.useDHCP = lib.mkDefault true;
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+}

hosts/manatee/home.nix

@@ -0,0 +1,22 @@
+{ inputs, ... }:
+{
+  imports = [ inputs.home-manager.nixosModules.home-manager ];
+
+  config = {
+    home-manager = {
+      useGlobalPkgs = true;
+      useUserPackages = true;
+
+      users.alex = {
+        programs.home-manager.enable = true;
+
+        home.username = "alex";
+        home.homeDirectory = "/home/alex";
+
+        home.packages = [ ];
+
+        home.stateVersion = "24.11";
+      };
+    };
+  };
+}

hosts/manatee/modules/age/default.nix

@@ -0,0 +1,14 @@
+{ inputs, pkgs, ... }:
+{
+  imports = [ inputs.agenix.nixosModules.default ];
+
+  config = {
+    age = {
+      identityPaths = [ "/etc/ssh/manatee" ];
+    };
+
+    environment.systemPackages = [
+      inputs.agenix.packages."${pkgs.system}".default
+    ];
+  };
+}

hosts/manatee/modules/boot/default.nix

@@ -0,0 +1,43 @@
+{
+  inputs,
+  lib,
+  config,
+  ...
+}:
+let
+  configurationLimit = config.mod.gc.configurationLimit;
+in
+{
+  imports = [ inputs.nix-gc-env.nixosModules.default ];
+
+  options = {
+    mod.gc = {
+      configurationLimit = lib.mkOption {
+        type = lib.types.int;
+        default = 10;
+        description = "number of configuration generations to keep";
+      };
+    };
+  };
+
+  config = {
+    nix.gc = {
+      automatic = true;
+      dates = "weekly";
+
+      # `delete_generations` added by nix-gc-env
+      delete_generations = "+${builtins.toString configurationLimit}";
+    };
+
+    boot = {
+      loader = {
+        systemd-boot = {
+          enable = true;
+          inherit configurationLimit;
+        };
+
+        efi.canTouchEfiVariables = true;
+      };
+    };
+  };
+}

hosts/manatee/modules/default.nix

@@ -0,0 +1,17 @@
+{ lib, ... }:
+let
+  toModulePath = dir: _: ./. + "/${dir}";
+  filterDirs = dirs: lib.attrsets.filterAttrs (_: type: type == "directory") dirs;
+in
+{
+  imports = lib.mapAttrsToList toModulePath (filterDirs (builtins.readDir ./.));
+
+  config = {
+    mod = {
+      gc.configurationLimit = 10;
+
+      ssh.enable = true;
+      git.enable = true;
+    };
+  };
+}

hosts/manatee/modules/git/default.nix

@@ -0,0 +1,39 @@
+{
+  pkgs,
+  lib,
+  config,
+  ...
+}:
+let
+  enabled = config.mod.git.enable;
+in
+{
+  options = {
+    mod.git = {
+      enable = lib.mkEnableOption "enable git module";
+    };
+  };
+
+  config = lib.mkIf enabled {
+    home-manager.users.alex = {
+      programs.git = {
+        enable = true;
+
+        includes = [
+          { path = ./gitconfig; }
+        ];
+
+        extraConfig = {
+          rerere.enable = true;
+        };
+      };
+
+      home.packages = [ pkgs.tig ];
+
+      home.file.".tigrc".text = ''
+        set main-view-line-number = yes
+        set main-view-line-number-interval = 1
+      '';
+    };
+  };
+}

hosts/manatee/modules/git/gitconfig

@@ -0,0 +1,9 @@
+[user]
+    name = Alexander Heldt
+    email = me@alexanderheldt.se
+
+[url "git@github.com:"]
+    insteadOf = https://github.com/
+
+[url "gitea@git.ppp.pm:"]
+    insteadOf = https://git.ppp.pm/

hosts/manatee/modules/network/default.nix

@@ -0,0 +1,22 @@
+{ ... }:
+{
+  networking = {
+    hostName = "manatee";
+
+    defaultGateway = "192.168.50.1";
+    nameservers = [ "1.1.1.1" ];
+    interfaces = {
+      enp3s0 = {
+        useDHCP = false;
+        ipv4 = {
+          addresses = [
+            {
+              address = "192.168.50.203";
+              prefixLength = 24;
+            }
+          ];
+        };
+      };
+    };
+  };
+}

hosts/manatee/modules/ssh/default.nix

@@ -0,0 +1,101 @@
+{
+  pkgs,
+  lib,
+  config,
+  ...
+}:
+let
+  enabled = config.mod.ssh.enable;
+
+  authorizedKeysPath = "/home/alex/.ssh/authorized-keys";
+  rootSSHKeyPath = "/etc/ssh";
+in
+{
+  options = {
+    mod.ssh = {
+      enable = lib.mkEnableOption "enable ssh module";
+    };
+  };
+
+  config = lib.mkIf enabled {
+    home-manager.users.alex = {
+      programs.ssh = {
+        enable = true;
+
+        matchBlocks = {
+          "git.ppp.pm" = {
+            hostname = "git.ppp.pm";
+            identityFile = "/home/alex/.ssh/alex.manatee-git.ppp.pm";
+          };
+        };
+      };
+    };
+
+    environment.etc."ssh/authorized_keys_command" = {
+      mode = "0755";
+      text = ''
+        #!${pkgs.bash}/bin/bash
+        for file in ${authorizedKeysPath}/*; do
+          ${pkgs.coreutils}/bin/cat "$file"
+        done
+      '';
+    };
+
+    services = {
+      openssh = {
+        enable = true;
+        ports = [ 1122 ];
+
+        hostKeys = [
+          {
+            path = "${rootSSHKeyPath}/root.manatee";
+            type = "ed25519";
+          }
+        ];
+
+        settings = {
+          PasswordAuthentication = false;
+          KbdInteractiveAuthentication = false;
+        };
+
+        authorizedKeysCommand = "/etc/ssh/authorized_keys_command";
+        authorizedKeysCommandUser = "root";
+      };
+    };
+
+    networking = {
+      firewall = {
+        allowedTCPPorts = [ 1122 ];
+      };
+    };
+
+    age.secrets = {
+      "root.manatee" = {
+        file = ../../../../secrets/manatee/root.manatee.age;
+        path = "${rootSSHKeyPath}/root.manatee";
+      };
+      "root.manatee.pub" = {
+        file = ../../../../secrets/manatee/root.manatee.pub.age;
+        path = "${rootSSHKeyPath}/root.manatee.pub";
+      };
+
+      "alex.pinwheel-manatee.pub" = {
+        file = ../../../../secrets/pinwheel/alex.pinwheel-manatee.pub.age;
+        path = "${authorizedKeysPath}/alex.pinwheel-manatee.pub";
+      };
+
+      "alex.manatee-git.ppp.pm" = {
+        file = ../../../../secrets/manatee/alex.manatee-git.ppp.pm.age;
+        path = "/home/alex/.ssh/alex.manatee-git.ppp.pm";
+        owner = "alex";
+        group = "users";
+      };
+      "alex.manatee-git.ppp.pm.pub" = {
+        file = ../../../../secrets/manatee/alex.manatee-git.ppp.pm.pub.age;
+        path = "/home/alex/.ssh/alex.manatee-git.ppp.pm.pub";
+        owner = "alex";
+        group = "users";
+      };
+    };
+  };
+}

hosts/pinwheel/modules/ssh/default.nix

@@ -5,6 +5,13 @@
       enable = true;
 
       matchBlocks = {
+        "manatee" = {
+          hostname = "192.168.50.203";
+          user = "alex";
+          identityFile = "/home/alex/.ssh/alex.pinwheel-manatee";
+          port = 1122;
+        };
+
         "backwards" = {
           hostname = "backwards";
           user = "alex";
@@ -46,6 +53,19 @@
   };
 
   age.secrets = {
+    "alex.pinwheel-manatee" = {
+      file = ../../../../secrets/pinwheel/alex.pinwheel-manatee.age;
+      path = "/home/alex/.ssh/alex.pinwheel-manatee";
+      owner = "alex";
+      group = "users";
+    };
+    "alex.pinwheel-manatee.pub" = {
+      file = ../../../../secrets/pinwheel/alex.pinwheel-manatee.pub.age;
+      path = "/home/alex/.ssh/alex.pinwheel-manatee.pub";
+      owner = "alex";
+      group = "users";
+    };
+
     "alex.pinwheel-backwards" = {
       file = ../../../../secrets/pinwheel/alex.pinwheel-backwards.age;
       path = "/home/alex/.ssh/alex.pinwheel-backwards";

secrets/manatee/alex.manatee-git.ppp.pm.pub.age

@@ -0,0 +1,7 @@
+age-encryption.org/v1
+-> ssh-ed25519 wkRvNA NmI7zT9UKGRlh3wQIt61Xww4p4pHMf9dtbZjYoWZ8Uw
+f+zEnvRCRG5jg/jvJyhn7cDwNQiQdycS1MjbEnD64Tc
+-> ssh-ed25519 +oNaHQ 73NC7E0ns+6Y5mSZFdlkPhZHWsqxe61CMnEqFEMZ90I
+hRfah4GDNd7Jcrfy0Xc6mGtTFGugm1R9EQTXWIQ3Dlo
+--- nCgXbaJ4nU1ovuOTtD025pzEwmtr2svW2XXj+oqd49g
+<EFBFBD><EFBFBD><EFBFBD>○<EFBFBD>.<2E><><EFBFBD>Q1pUv<55>i@<40><>yQ<79>h7<16><>n.r	<09><>%<25><>"YL<59>Rmw<6D><77>܌<><DC8C><EFBFBD>$g<14><>j<EFBFBD><6A>ϸ<EFBFBD><CFB8><EFBFBD>KY<4B>Ő<><14>g&<26>Me<>w<EFBFBD>o<><6F><EFBFBD>﨡<EFBFBD><EFA8A1><EFBFBD><EFBFBD>*<2A><>4W<34>8<EFBFBD><38>һN<D2BB><4E>n<EFBFBD>@Q<><51>c^<5E><> WƋ<57><C68B><08><>8S…<53>

secrets/manatee/root.manatee.pub.age

@@ -0,0 +1,8 @@
+age-encryption.org/v1
+-> ssh-ed25519 wkRvNA UqHbjXvBR0t5JDL698Ir+5Ea/8P12dlRwf8s8K4DLxU
+T4hCFBfgcGjX4bdcY3FAOAT+Y//gigh2wD+tulkzYg0
+-> ssh-ed25519 +oNaHQ rYO/FGLizmtgBbaum8n7Ey/fxLLzBY+qdCGEGA2eglg
+wWzReIBthn3dm8yfSljaIkyTVcegNQBFyUbUyWRpryU
+--- 4LIzUebAHUKqBwVaLPQntXiuj1hfyTvoRb9VusyQ01w
+ϪI<EFBFBD>k^<0F>f<EFBFBD><66>L2<4C><32>Y<EFBFBD><59><03><12>Ki<4B><69>kR<6B>;<3B><>O<EFBFBD><4F><EFBFBD>ժ9<D5AA><39>.hA
+<EFBFBD><18>^<5E>Bl%<25>1U<31><55>y}Y<>0c<30>!vHƋ<><C68B><EFBFBD>Ͻtjv<6A>߅<EFBFBD>AoE<6F><45><EFBFBD><EFBFBD>D<EFBFBD>جtCb<43>i5<69>4ab[<1D>og<6F><67>c<EFBFBD><12>9<EFBFBD>X@

secrets/pinwheel/alex.pinwheel-manatee.pub.age

@@ -0,0 +1,9 @@
+age-encryption.org/v1
+-> ssh-ed25519 vxPbZg eRWhz6fZKuP5v5E16uZg6si0/vlp3FdzcWud0OfAV38
+9ipUEQuy7IZZRi5RtoiH5/f093YCicJ/3VpH0TC7lh4
+-> ssh-ed25519 wkRvNA 938EBkoteypEXGVYII8KP1sm4fpN7MmasqN+lxW70DQ
+qt5DS5u1oCPvlOwO0DsoZp0OdEgZ/hRIJkD77c19Kts
+-> ssh-ed25519 +oNaHQ LJSsvOsWwHm+JygGKZ31+IBLKPNadx1OvIcA4Zm34G8
+AtSUR73XCikmAovR8YidLDy7WqZhsvjozzZM82qLsQA
+--- wDbiqcaXCRtSYx4qTqxFe8xn56J5ZkdtPrMs5Ba+4No
+<EFBFBD>d<1A><><EFBFBD><EFBFBD>RM<52>E<EFBFBD><45><EFBFBD><04>4<EFBFBD>\<5C>`<60><><EFBFBD><EFBFBD>X<EFBFBD>0<EFBFBD><30><EFBFBD>=<3D><><EFBFBD>l<EFBFBD><6C>.<2E>3ҡ<>d&`<60><>C<EFBFBD><43>'<27>Ͽ<EFBFBD>'<27>~<18>+<2B><>ܽ0<DCBD><10>`Ga<47><61>b<EFBFBD><1E>R,d<14>:<18><1A>Q|є<><D194><EFBFBD><EFBFBD><EFBFBD><16>}B<>Iߪ#<23>c<EFBFBD><63>L<EFBFBD><4C>%<10><>eD<65>Rp<52><70>ۘ6

secrets/secrets.nix

@@ -1,6 +1,7 @@
 let
-  # see `modules/age/default.nix` where these are defined
+  # see `<host>/modules/age/default.nix` where these are defined
   pinwheel = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMoI7Q4zT2AGXU+i8fLmzcNLdfMkEnfHYh4PmaEmo2QW root@pinwheel";
+  manatee = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBqJi/Oml2s/2KBqzLrCF77YJKn36Gute8jaTCEkHEZN root.manatee";
   backwards = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBcTK3CUtTsgavuLlbfOqCbHYLtUrIKqnSqYmtzGCZnv root.backwards";
   tadpole = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDbyj/vYafqpJH33jFz5HV+gwCiEIJTpxKrEFrBWx73A root@tadpole";
   alex = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPTgiHYcdhS87pPnduLunZVEgLVj4EtbG9XVSZP1l5s5 alex";
@@ -8,6 +9,8 @@ in {
   "pinwheel/syncthing-cert.age".publicKeys = [ pinwheel alex ];
   "pinwheel/syncthing-key.age".publicKeys = [ pinwheel alex ];
   "pinwheel/tailscale-preferred-exit-node.age".publicKeys = [ pinwheel alex ];
+  "pinwheel/alex.pinwheel-manatee.age".publicKeys = [ pinwheel alex ];
+  "pinwheel/alex.pinwheel-manatee.pub.age".publicKeys = [ pinwheel manatee alex ];
   "pinwheel/alex.pinwheel-backwards.age".publicKeys = [ pinwheel alex ];
   "pinwheel/alex.pinwheel-backwards.pub.age".publicKeys = [ pinwheel backwards alex ];
   "pinwheel/alex.pinwheel-tadpole.age".publicKeys = [ pinwheel alex ];
@@ -27,6 +30,11 @@ in {
   "pinwheel/work-staging-ovpn.age".publicKeys = [ pinwheel alex ];
   "pinwheel/work-production-ovpn.age".publicKeys = [ pinwheel alex ];
 
+  "manatee/root.manatee.age".publicKeys = [ manatee alex ];
+  "manatee/root.manatee.pub.age".publicKeys = [ manatee alex ];
+  "manatee/alex.manatee-git.ppp.pm.age".publicKeys = [ manatee alex ];
+  "manatee/alex.manatee-git.ppp.pm.pub.age".publicKeys = [ manatee alex ];
+
   "backwards/root.backwards.age".publicKeys = [ backwards alex ];
   "backwards/root.backwards.pub.age".publicKeys = [ backwards alex ];
   "backwards/syncthing-cert.age".publicKeys = [ backwards alex ];