manatee: Add host manatee

flake.lock

@@ -45,6 +45,26 @@
         "type": "github"
       }
     },
+    "disko": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1745812220,
+        "narHash": "sha256-hotBG0EJ9VmAHJYF0yhWuTVZpENHvwcJ2SxvIPrXm+g=",
+        "owner": "nix-community",
+        "repo": "disko",
+        "rev": "d0c543d740fad42fe2c035b43c9d41127e073c78",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "disko",
+        "type": "github"
+      }
+    },
     "emacs-overlay": {
       "inputs": {
         "nixpkgs": [
@@ -234,6 +254,7 @@
     "root": {
       "inputs": {
         "agenix": "agenix",
+        "disko": "disko",
         "emacs-overlay": "emacs-overlay",
         "home-manager": "home-manager_2",
         "hyprland-contrib": "hyprland-contrib",

flake.nix

@@ -6,6 +6,11 @@
 
     nixos-hardware.url = "github:nixos/nixos-hardware/master";
 
+    disko = {
+      url = "github:nix-community/disko";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
     nh = {
       url = "github:viperML/nh";
       inputs.nixpkgs.follows = "nixpkgs";
@@ -60,6 +65,16 @@
           ];
         };
 
+        manatee = inputs.nixpkgs.lib.nixosSystem {
+          system = "x86_64-linux";
+          specialArgs = {
+            inherit inputs;
+          };
+          modules = [
+            ./hosts/manatee/configuration.nix
+          ];
+        };
+
         backwards = inputs.nixpkgs.lib.nixosSystem {
           system = "x86_64-linux";
           specialArgs = {

hosts/manatee/boot/default.nix

@@ -0,0 +1,43 @@
+{
+  inputs,
+  lib,
+  config,
+  ...
+}:
+let
+  configurationLimit = config.mod.gc.configurationLimit;
+in
+{
+  imports = [ inputs.nix-gc-env.nixosModules.default ];
+
+  options = {
+    mod.gc = {
+      configurationLimit = lib.mkOption {
+        type = lib.types.int;
+        default = 10;
+        description = "number of configuration generations to keep";
+      };
+    };
+  };
+
+  config = {
+    nix.gc = {
+      automatic = true;
+      dates = "weekly";
+
+      # `delete_generations` added by nix-gc-env
+      delete_generations = "+${builtins.toString configurationLimit}";
+    };
+
+    boot = {
+      loader = {
+        systemd-boot = {
+          enable = true;
+          inherit configurationLimit;
+        };
+
+        efi.canTouchEfiVariables = true;
+      };
+    };
+  };
+}

hosts/manatee/configuration.nix

@@ -0,0 +1,50 @@
+{ pkgs, ... }:
+{
+  imports = [
+    ../../config-manager/default.nix
+    ./hardware-configuration.nix
+    ./disk-config.nix
+    ./modules
+  ];
+
+  nix.settings.experimental-features = [
+    "nix-command"
+    "flakes"
+  ];
+  nixpkgs.config.allowUnfree = true;
+
+  users.users.alex = {
+    isNormalUser = true;
+    description = "alex";
+    extraGroups = [ "wheel" ];
+  };
+
+  environment.systemPackages = with pkgs; [
+    vim
+    git
+  ];
+
+  config-manager = {
+    flakePath = "/home/alex/config";
+  };
+
+  # This option defines the first version of NixOS you have installed on this particular machine,
+  # and is used to maintain compatibility with application data (e.g. databases) created on older NixOS versions.
+  #
+  # Most users should NEVER change this value after the initial install, for any reason,
+  # even if you've upgraded your system to a new NixOS release.
+  #
+  # This value does NOT affect the Nixpkgs version your packages and OS are pulled from,
+  # so changing it will NOT upgrade your system - see https://nixos.org/manual/nixos/stable/#sec-upgrading for how
+  # to actually do that.
+  #
+  # This value being lower than the current NixOS release does NOT mean your system is
+  # out of date, out of support, or vulnerable.
+  #
+  # Do NOT change this value unless you have manually inspected all the changes it would make to your configuration,
+  # and migrated your data accordingly.
+  #
+  # For more information, see `man configuration.nix` or https://nixos.org/manual/nixos/stable/options#opt-system.stateVersion .
+  system.stateVersion = "24.11"; # Did you read the comment?
+
+}

hosts/manatee/disk-config.nix

@@ -0,0 +1,110 @@
+{ inputs, ... }:
+{
+  imports = [ inputs.disko.nixosModules.disko ];
+
+  config = {
+    networking.hostId = "0a9474e7"; # Required by ZFS
+    disko.devices = {
+      disk = {
+        root = {
+          type = "disk";
+          device = "/dev/nvme0n1";
+          content = {
+            type = "gpt";
+            partitions = {
+              ESP = {
+                size = "500M";
+                type = "EF00";
+                content = {
+                  type = "filesystem";
+                  format = "vfat";
+                  mountpoint = "/boot";
+                  mountOptions = [ "umask=0077" ];
+                };
+              };
+
+              root = {
+                size = "100%";
+                content = {
+                  type = "filesystem";
+                  format = "ext4";
+                  mountpoint = "/";
+                };
+              };
+            };
+          };
+        };
+
+        disk1 = {
+          type = "disk";
+          device = "/dev/disk/by-id/ata-ST8000VN004-3CP101_WWZ8QCG4";
+          content = {
+            type = "gpt";
+            partitions = {
+              zfs = {
+                size = "100%";
+                content = {
+                  type = "zfs";
+                  pool = "storage";
+                };
+              };
+            };
+          };
+        };
+
+        disk2 = {
+          type = "disk";
+          device = "/dev/disk/by-id/ata-ST8000VN004-3CP101_WWZ8QDJ5";
+          content = {
+            type = "gpt";
+            partitions = {
+              zfs = {
+                size = "100%";
+                content = {
+                  type = "zfs";
+                  pool = "storage";
+                };
+              };
+            };
+          };
+        };
+      };
+
+      zpool = {
+        storage = {
+          type = "zpool";
+
+          mode = {
+            topology = {
+              type = "topology";
+              vdev = [
+                {
+                  mode = "mirror";
+                  members = [
+                    "disk1"
+                    "disk2"
+                  ];
+                }
+              ];
+            };
+          };
+
+          rootFsOptions = {
+            mountpoint = "none";
+            compression = "zstd";
+            xattr = "sa";
+            "com.sun:auto-snapshot" = "false";
+          };
+
+          datasets = {
+            media = {
+              type = "zfs_fs";
+              mountpoint = "/mnt/media";
+              options.mountpoint = "legacy"; # otherwise we get a race between systemd and zfs; https://github.com/nix-community/disko/issues/214
+            };
+          };
+        };
+      };
+    };
+  };
+}

hosts/manatee/hardware-configuration.nix

@@ -0,0 +1,39 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{
+  config,
+  lib,
+  pkgs,
+  modulesPath,
+  ...
+}:
+
+{
+  imports = [
+    (modulesPath + "/installer/scan/not-detected.nix")
+  ];
+
+  boot.initrd.availableKernelModules = [
+    "xhci_pci"
+    "nvme"
+    "ahci"
+    "usb_storage"
+    "usbhid"
+    "sd_mod"
+  ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-intel" ];
+  boot.extraModulePackages = [ ];
+
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  networking.useDHCP = lib.mkDefault true;
+  # networking.interfaces.enp3s0.useDHCP = lib.mkDefault true;
+  # networking.interfaces.enp4s0.useDHCP = lib.mkDefault true;
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+}

hosts/manatee/modules/age/default.nix

@@ -0,0 +1,14 @@
+{ inputs, pkgs, ... }:
+{
+  imports = [ inputs.agenix.nixosModules.default ];
+
+  config = {
+    age = {
+      identityPaths = [ "/etc/ssh/manatee" ];
+    };
+
+    environment.systemPackages = [
+      inputs.agenix.packages."${pkgs.system}".default
+    ];
+  };
+}

hosts/manatee/modules/default.nix

@@ -0,0 +1,17 @@
+{ lib, ... }:
+let
+  toModulePath = dir: _: ./. + "/${dir}";
+  filterDirs = dirs: lib.attrsets.filterAttrs (_: type: type == "directory") dirs;
+in
+{
+  imports = lib.mapAttrsToList toModulePath (filterDirs (builtins.readDir ./.));
+
+  config = {
+    mod = {
+      gc.configurationLimit = 10;
+
+      ssh.enable = true;
+      git.enable = true;
+    };
+  };
+}

hosts/manatee/modules/git/default.nix

@@ -0,0 +1,39 @@
+{
+  pkgs,
+  lib,
+  config,
+  ...
+}:
+let
+  enabled = config.mod.git.enable;
+in
+{
+  options = {
+    mod.git = {
+      enable = lib.mkEnableOption "enable git module";
+    };
+  };
+
+  config = lib.mkIf enabled {
+    home-manager.users.alex = {
+      programs.git = {
+        enable = true;
+
+        includes = [
+          { path = ./gitconfig; }
+        ];
+
+        extraConfig = {
+          rerere.enable = true;
+        };
+      };
+
+      home.packages = [ pkgs.tig ];
+
+      home.file.".tigrc".text = ''
+        set main-view-line-number = yes
+        set main-view-line-number-interval = 1
+      '';
+    };
+  };
+}

hosts/manatee/modules/git/gitconfig

@@ -0,0 +1,9 @@
+[user]
+    name = Alexander Heldt
+    email = me@alexanderheldt.se
+
+[url "git@github.com:"]
+    insteadOf = https://github.com/
+
+[url "gitea@git.ppp.pm:"]
+    insteadOf = https://git.ppp.pm/

hosts/manatee/modules/ssh/default.nix

@@ -0,0 +1,101 @@
+{
+  pkgs,
+  lib,
+  config,
+  ...
+}:
+let
+  enabled = config.mod.ssh.enable;
+
+  authorizedKeysPath = "/home/alex/.ssh/authorized-keys";
+  rootSSHKeyPath = "/etc/ssh";
+in
+{
+  options = {
+    mod.ssh = {
+      enable = lib.mkEnableOption "enable ssh module";
+    };
+  };
+
+  config = lib.mkIf enabled {
+    home-manager.users.alex = {
+      programs.ssh = {
+        enable = true;
+
+        matchBlocks = {
+          "git.ppp.pm" = {
+            hostname = "git.ppp.pm";
+            identityFile = "/home/alex/.ssh/alex.manatee-git.ppp.pm";
+          };
+        };
+      };
+    };
+
+    environment.etc."ssh/authorized_keys_command" = {
+      mode = "0755";
+      text = ''
+        #!${pkgs.bash}/bin/bash
+        for file in ${authorizedKeysPath}/*; do
+          ${pkgs.coreutils}/bin/cat "$file"
+        done
+      '';
+    };
+
+    services = {
+      openssh = {
+        enable = true;
+        ports = [ 1122 ];
+
+        hostKeys = [
+          {
+            path = "${rootSSHKeyPath}/root.manatee";
+            type = "ed25519";
+          }
+        ];
+
+        settings = {
+          PasswordAuthentication = false;
+          KbdInteractiveAuthentication = false;
+        };
+
+        authorizedKeysCommand = "/etc/ssh/authorized_keys_command";
+        authorizedKeysCommandUser = "root";
+      };
+    };
+
+    networking = {
+      firewall = {
+        allowedTCPPorts = [ 1122 ];
+      };
+    };
+
+    age.secrets = {
+      "root.manatee" = {
+        file = ../../../../secrets/manatee/root.manatee.age;
+        path = "${rootSSHKeyPath}/root.manatee";
+      };
+      "root.manatee.pub" = {
+        file = ../../../../secrets/manatee/root.manatee.pub.age;
+        path = "${rootSSHKeyPath}/root.manatee.pub";
+      };
+
+      "alex.pinwheel-manatee.pub" = {
+        file = ../../../../secrets/pinwheel/alex.pinwheel-manatee.pub.age;
+        path = "${authorizedKeysPath}/alex.pinwheel-manatee.pub";
+      };
+
+      "alex.manatee-git.ppp.pm" = {
+        file = ../../../../secrets/manatee/alex.manatee-git.ppp.pm.age;
+        path = "/home/alex/.ssh/alex.manatee-git.ppp.pm";
+        owner = "alex";
+        group = "users";
+      };
+      "alex.manatee-git.ppp.pm.pub" = {
+        file = ../../../../secrets/manatee/alex.manatee-git.ppp.pm.pub.age;
+        path = "/home/alex/.ssh/alex.manatee-git.ppp.pm.pub";
+        owner = "alex";
+        group = "users";
+      };
+    };
+  };
+}

hosts/manatee/network/default.nix

@@ -0,0 +1,22 @@
+{ ... }:
+{
+  networking = {
+    hostName = "manatee";
+
+    defaultGateway = "192.168.50.1";
+    nameservers = [ "1.1.1.1" ];
+    interfaces = {
+      enp3s0 = {
+        useDHCP = false;
+        ipv4 = {
+          addresses = [
+            {
+              address = "192.168.50.203";
+              prefixLength = 24;
+            }
+          ];
+        };
+      };
+    };
+  };
+}

hosts/pinwheel/modules/ssh/default.nix

@@ -5,6 +5,13 @@
       enable = true;
 
       matchBlocks = {
+        "manatee" = {
+          hostname = "192.168.50.203";
+          user = "alex";
+          identityFile = "/home/alex/.ssh/alex.pinwheel-manatee";
+          port = 1122;
+        };
+
         "backwards" = {
           hostname = "backwards";
           user = "alex";
@@ -46,6 +53,19 @@
   };
 
   age.secrets = {
+    "alex.pinwheel-manatee" = {
+      file = ../../../../secrets/pinwheel/alex.pinwheel-manatee.age;
+      path = "/home/alex/.ssh/alex.pinwheel-manatee";
+      owner = "alex";
+      group = "users";
+    };
+    "alex.pinwheel-manatee.pub" = {
+      file = ../../../../secrets/pinwheel/alex.pinwheel-manatee.pub.age;
+      path = "/home/alex/.ssh/alex.pinwheel-manatee.pub";
+      owner = "alex";
+      group = "users";
+    };
+
     "alex.pinwheel-backwards" = {
       file = ../../../../secrets/pinwheel/alex.pinwheel-backwards.age;
       path = "/home/alex/.ssh/alex.pinwheel-backwards";

secrets/manatee/alex.manatee-git.ppp.pm.age

@@ -0,0 +1,9 @@
+age-encryption.org/v1
+-> ssh-ed25519 Pu0HWg K5M8i7f4yAiaCywNSQBhCbDSEY9KWyDhmgCjPho9Qls
+8tfUb6ymLJWe31gpRDoaP9Nv392nSnwU967YpIfI0Ek
+-> ssh-ed25519 +oNaHQ wI0pWfS1PnkeNuFvOLlYXaPHjCi/6CELa2zpejmxGSI
+amhEyvju+6iQs+7Aa30K0nOIW9FxdklpdhNusgL60pU
+--- uKnfEjZBKpwIqdMaIUMg9nxC8O7m4X4maN9ov7w+TVg
+<16><><EFBFBD>=b<>a<>H<EFBFBD><48><EFBFBD><EFBFBD><EFBFBD>H <20><><EFBFBD><14>!<21>E0<><30>S<EFBFBD>MYݎNB3㎲<33>Սs<D58D><73><EFBFBD>#<23><>9<EFBFBD><39><EFBFBD>bE<62>z<EFBFBD>z<EFBFBD>;i<><69>y<12><1E><><EFBFBD><EFBFBD>
+K<EFBFBD><EFBFBD><EFBFBD>87EF<EFBFBD>X	
+0<EFBFBD>V݀g<><67>D<>S<EFBFBD>|<14><>>zL<7A><4C>BmXlث9+<2B>c<EFBFBD><63>_q<17><><EFBFBD><EFBFBD><EFBFBD>!ꅔَ[<5B><><EFBFBD>u,-<2D>6<36><0C>0<EFBFBD><30><EFBFBD>
<01><15>q|+a<><61>Hs<48><73>F<EFBFBD><46>Z<>':<3A>c<EFBFBD><63><EFBFBD>1<><31><EFBFBD><EFBFBD>><3E>B<EFBFBD>0<EFBFBD><13><>:Eeަ<65>Hè<48>KLoL<6F>%z<1A>$ֲ<><D6B2>]ۦ<>

secrets/manatee/alex.manatee-git.ppp.pm.pub.age

@@ -0,0 +1,7 @@
+age-encryption.org/v1
+-> ssh-ed25519 Pu0HWg BXomhHuXRyt/yeywywbPrYQyMbclNOZu4hzSn9e7Fyg
+tqVocyanxmWhFuOnVHm1NO3RdeO09N3W9pVF8CL+aBc
+-> ssh-ed25519 +oNaHQ o6AgJ5AtsSGYTCJFPfycOXizE1pMOIOWUIxFsg3G9U0
+fp08a2IRhlKhDEYJABlGMFfviKk5wRIalSYjKYnbttQ
+--- r3FC4Rfz7iVDzjDykskwDWgN8Yt4BJDDdxa8Y3ByqY0
+'<04><>l3<6C>;N<>7<EFBFBD><37>}m<><6D>><3E><><EFBFBD><EFBFBD>bC9<43><1B>G<>0<EFBFBD><30>"<22><>-{|<7C>.<2E><><EFBFBD><EFBFBD>Q<06><>p2`D$I
j<>(!<21><><EFBFBD>h<EFBFBD>)<29><>~Y
μo<CEBC><6F><EFBFBD><EFBFBD>ΌC<CE8C><43><EFBFBD>

secrets/manatee/root.manatee.pub.age

@@ -0,0 +1,8 @@
+age-encryption.org/v1
+-> ssh-ed25519 Pu0HWg M5UOwBb0G/wzcDy8lmD4sUXAp0q27qw4lL9En4khlwE
+8dRyM0a3tcdcsy+T/yYo5lXamOaVvGuWvDrvLExWMjE
+-> ssh-ed25519 +oNaHQ SMZ2kHZKEtIthPEzpO3goMGOpOudcQzx2KdwjNP/cAE
+B8n1AOX4zQnXJWMcK+d0ws2SnrpWr+tKEZJ1XqMACPk
+--- JWEIxREHAs39JHrhy6HNGyXAWpSJVK0TwSOia8DtI+E
+W^<5E><>#<23>q<EFBFBD><1F>t<12>D$<24>Σ<EFBFBD><CEA3><EFBFBD>1<EFBFBD>9<EFBFBD>̹h]Tx<54><78>-<2D>X<EFBFBD><58>v<EFBFBD><76>÷*)<29><>I3<49>

+<EFBFBD>}ei<65>P<EFBFBD>&S<><53>R|t4<74><34><EFBFBD><EFBFBD>K<EFBFBD><4B>Qh"<22><1C><><EFBFBD>f<10>^<5E><>s<>2#<23>~^<5E><>ZRU<52><1A>V<EFBFBD><56>k<EFBFBD><6B><EFBFBD>j<EFBFBD><6A>8<>d"<22><>

secrets/pinwheel/alex.pinwheel-manatee.pub.age

@@ -0,0 +1,9 @@
+age-encryption.org/v1
+-> ssh-ed25519 vxPbZg YW9lqVTRD04cADmnlqv5EiTAT0HeNIl5Av4CqgHk5ls
+3g+zkm7Qslg/mq+oxz2NhLI9vQCPNzri87a2AOLyxMg
+-> ssh-ed25519 Pu0HWg 2NCikdn506idPSo428BpwXpmjPJPlKl1WLQdKCcC4CI
+3jnRPJyMEsyic/ZQkalcZVDvdJSefkl3qlXwP0B7f1U
+-> ssh-ed25519 +oNaHQ dA/YOfXwPKXW8fHb8s9v/KwFJN3jrGJZecN5820/G2w
+ZcxfT+gWXtc4JPE0xTJ8rpWB/fubDBaNplF+V8e0PRc
+--- zfQyYuHOYPOiN7xOgDamuuRXdsZOCcLXjVpnojhFeQk
+<10>ƃ<EFBFBD><0C><>lp<>M<1C>Ap<41>E4s<34>4<EFBFBD>5<EFBFBD>LҢ<4C><D2A2>Z<EFBFBD><05><>r{A<15>i#<23><>O<07>h<13><><EFBFBD>L]\י<><07>ʙ<17><06><08>t<EFBFBD>(<28>^<5E><><EFBFBD><EFBFBD>s<EFBFBD>5Igye}H<><48><02>NÊ<4E><C38A><EFBFBD><08>}<03>Q<EFBFBD><51><EFBFBD><EFBFBD>`y<>'<27>Tz*]<5D><><EFBFBD><EFBFBD>-<2D><><EFBFBD>"@	<09><>k

secrets/secrets.nix

@@ -1,6 +1,7 @@
 let
-  # see `modules/age/default.nix` where these are defined
+  # see `<host>/modules/age/default.nix` where these are defined
   pinwheel = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMoI7Q4zT2AGXU+i8fLmzcNLdfMkEnfHYh4PmaEmo2QW root@pinwheel";
+  manatee = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBcTK3CUtTsgavuLlbfOqCbHYLtUrIKqnSqYmtzGCZnv root.manatee";
   backwards = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBcTK3CUtTsgavuLlbfOqCbHYLtUrIKqnSqYmtzGCZnv root.backwards";
   tadpole = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDbyj/vYafqpJH33jFz5HV+gwCiEIJTpxKrEFrBWx73A root@tadpole";
   alex = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPTgiHYcdhS87pPnduLunZVEgLVj4EtbG9XVSZP1l5s5 alex";
@@ -8,6 +9,8 @@ in {
   "pinwheel/syncthing-cert.age".publicKeys = [ pinwheel alex ];
   "pinwheel/syncthing-key.age".publicKeys = [ pinwheel alex ];
   "pinwheel/tailscale-preferred-exit-node.age".publicKeys = [ pinwheel alex ];
+  "pinwheel/alex.pinwheel-manatee.age".publicKeys = [ pinwheel alex ];
+  "pinwheel/alex.pinwheel-manatee.pub.age".publicKeys = [ pinwheel manatee alex ];
   "pinwheel/alex.pinwheel-backwards.age".publicKeys = [ pinwheel alex ];
   "pinwheel/alex.pinwheel-backwards.pub.age".publicKeys = [ pinwheel backwards alex ];
   "pinwheel/alex.pinwheel-tadpole.age".publicKeys = [ pinwheel alex ];
@@ -27,6 +30,11 @@ in {
   "pinwheel/work-staging-ovpn.age".publicKeys = [ pinwheel alex ];
   "pinwheel/work-production-ovpn.age".publicKeys = [ pinwheel alex ];
 
+  "manatee/root.manatee.age".publicKeys = [ manatee alex ];
+  "manatee/root.manatee.pub.age".publicKeys = [ manatee alex ];
+  "manatee/alex.manatee-git.ppp.pm.age".publicKeys = [ manatee alex ];
+  "manatee/alex.manatee-git.ppp.pm.pub.age".publicKeys = [ manatee alex ];
+
   "backwards/root.backwards.age".publicKeys = [ backwards alex ];
   "backwards/root.backwards.pub.age".publicKeys = [ backwards alex ];
   "backwards/syncthing-cert.age".publicKeys = [ backwards alex ];