passwordless login for kestrel restic backup

home/dot_aliases

@@ -3,7 +3,7 @@
 
 # nixos
 alias nu="cd ~/.local/share/chezmoi/provision && \
-          sudo nixos-rebuild switch --flake .#$(hostname) && \
+          sudo nixos-rebuild switch --impure --flake .#$(hostname) && \
           cd -"
 # sway
 alias s='sway'

provision/flake.nix

@@ -33,9 +33,10 @@
         inherit system;
         specialArgs = { inherit user; inherit inputs; };
         modules = [
-          ./modules
+          ./hosts/default.nix
           ./hosts/kestrel/configuration.nix
           ./hosts/kestrel/hardware.nix
+          ./modules
           agenix.nixosModules.default
           home-manager.nixosModules.home-manager {
             home-manager.useGlobalPkgs = true;
@@ -44,7 +45,6 @@
             home-manager.users.${user} = {
               imports = [ 
                 ./home-modules
-                ./hosts/kestrel/home-configuration.nix 
               ];
             };
           }
@@ -55,9 +55,10 @@
         inherit system;
         specialArgs = { inherit user; inherit inputs; };
         modules = [
-          ./modules
+          ./hosts/default.nix
           ./hosts/shivan/configuration.nix
           ./hosts/shivan/hardware.nix
+          ./modules
           agenix.nixosModules.default
           home-manager.nixosModules.home-manager {
             home-manager.useGlobalPkgs = true;
@@ -66,7 +67,6 @@
             home-manager.users.${user} = {
               imports = [ 
                 ./home-modules
-                ./hosts/shivan/home-configuration.nix 
               ];
             };
           }
@@ -77,9 +77,10 @@
         inherit system;
         specialArgs = { inherit user; inherit inputs; };
         modules = [
-          ./modules
+          ./hosts/default.nix
           ./hosts/torus/configuration.nix
           ./hosts/torus/hardware.nix
+          ./modules
           agenix.nixosModules.default
           home-manager.nixosModules.home-manager {
             home-manager.useGlobalPkgs = true;
@@ -88,7 +89,6 @@
             home-manager.users.${user} = {
               imports = [ 
                 ./home-modules
-                ./hosts/torus/home-configuration.nix 
               ];
             };
           }
@@ -99,9 +99,10 @@
         inherit system;
         specialArgs = { inherit user; inherit inputs; inherit jovian-nixos; inherit home-manager; };
         modules = [
-          ./modules
+          ./hosts/default.nix
           ./hosts/bulwark/configuration.nix
           ./hosts/bulwark/hardware.nix
+          ./modules
           agenix.nixosModules.default
           home-manager.nixosModules.home-manager {
             home-manager.useGlobalPkgs = true;
@@ -110,7 +111,6 @@
             home-manager.users.${user} = {
               imports = [ 
                 ./home-modules
-                ./hosts/bulwark/home-configuration.nix 
               ];
             };
           }

provision/hosts/bulwark/configuration.nix

@@ -5,53 +5,11 @@
     ./syncthing.nix
   ];
 
-  nix = {
-    package = pkgs.nixFlakes;
-    extraOptions = "experimental-features = nix-command flakes";
-
-    settings.auto-optimise-store = true;
-    gc = {
-      automatic = true;
-      dates = "weekly";
-      options = "--delete-older-than 7d";
-    };
-  };
-
-  # Add non-free packages
-  nixpkgs.config.allowUnfree = true;
-  nixpkgs.config.permittedInsecurePackages = [ "electron-25.9.0" "openssl-1.1.1w" ];
-  nixpkgs.overlays = import ../../lib/overlays.nix;
-
-  # Hardware options
-  hardware.bluetooth.enable = true;
-  hardware.bluetooth.package = pkgs.bluez;
-  hardware.sensor.iio.enable = true;
-  hardware.graphics.enable = true;
-
-  # Use the systemd-boot EFI boot loader.
-  boot.loader.systemd-boot.enable = true;
-  boot.loader.efi.canTouchEfiVariables = true;
-
   # Set networking options
   networking.hostName = "bulwark"; 
   networking.firewall.checkReversePath = "loose";
   networking.firewall.enable = false;
 
-  # Set your time zone.
-  time.timeZone = "America/Los_Angeles";
-  i18n.defaultLocale = "en_US.UTF-8";
-
-  # Add fonts
-  fonts.packages= with pkgs; [
-    nerdfonts
-  ];
-
-  # Define user account.
-  users.users.${user} = {
-    isNormalUser = true;
-    extraGroups = [ "dialout" "wheel" ]; # Enable ‘sudo’ for the user.
-  };
-
   # Password-less root
   security.sudo.extraRules = [{ 
     users = [ "${user}" ];
@@ -64,10 +22,10 @@
   environment.systemPackages = with pkgs; [
   ];
 
-  # host secrets
+  # Secrets
   age.secrets."wireguard/bulwark".file = ../../secrets/wireguard/bulwark.age;
 
-  # Enable modules
+  # Modules
   modules = {
     desktop = {
       sway.enable = false;
@@ -103,6 +61,11 @@
     };
   };
 
-  # Did you read the comment?
-  system.stateVersion = "23.11"; 
+  home-manager.users.${user} = {
+    modules = {
+      desktop = {
+        kitty.enable = true;
+      };
+    };
+  };
 }

provision/hosts/bulwark/home-configuration.nix

@@ -1,22 +0,0 @@
-{ config, pkgs, user, ... }:
-{
-  home.username = "${user}";
-  home.homeDirectory = "/home/${user}";
-  programs.home-manager.enable = true;
-
-  # Setup git
-  programs.git = {
-      enable = true;
-      userName = "starr-dusT";
-      userEmail = "starrtyler88@gmail.com";
-  };
-
-  home.packages = with pkgs; [
-  ];
-
-  # Enable home modules
-  #modules = {
-  #};
-
-  home.stateVersion = "23.11";
-}

provision/hosts/default.nix

@@ -0,0 +1,4 @@
+{ ... }:
+{
+  imports = [ ./default ];
+}

provision/hosts/default/backup.nix

@@ -0,0 +1,11 @@
+{ config, pkgs, user, lib, ... }:
+{
+  # Password-less logins for backup
+  users.users."${user}".openssh.authorizedKeys.keyFiles = [
+    config.age.secrets."ssh/kestrel/id_ed25519.pub".path
+  ];
+
+  environment.systemPackages = with pkgs; [
+    restic # Fast and secure backup program
+  ];
+}

provision/hosts/default/configuration.nix

@@ -0,0 +1,53 @@
+{ config, pkgs, user, lib, ... }:
+{
+  nix = {
+    package = pkgs.nixFlakes;
+    extraOptions = "experimental-features = nix-command flakes";
+
+    settings.auto-optimise-store = true;
+    gc = {
+      automatic = true;
+      dates = "weekly";
+      options = "--delete-older-than 7d";
+    };
+  };
+
+  # Add non-free packages
+  nixpkgs.config.allowUnfree = true;
+  nixpkgs.config.permittedInsecurePackages = [ "electron-25.9.0" "openssl-1.1.1w" ];
+  nixpkgs.overlays = import ../../lib/overlays.nix;
+
+  # Hardware options
+  hardware.bluetooth.enable = true;
+  hardware.bluetooth.package = pkgs.bluez;
+  hardware.sensor.iio.enable = true;
+  hardware.graphics.enable = true;
+  hardware.graphics.enable32Bit = true;
+
+  # Use the systemd-boot EFI boot loader.
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.efi.canTouchEfiVariables = true;
+
+  # Set your time zone.
+  time.timeZone = "America/Los_Angeles";
+  i18n.defaultLocale = "en_US.UTF-8";
+
+  # Fonts
+  fonts.packages = with pkgs; [
+    nerdfonts
+  ];
+
+  # Define user account.
+  users.users.${user} = {
+    isNormalUser = true;
+    extraGroups = [ "dialout" "wheel" "docker" "libvirtd" ];
+    shell = pkgs.bash;
+  };
+  
+  environment.systemPackages = with pkgs; [
+    cowsay # A program which generates ASCII pictures of a cow with a message
+  ];
+
+  # Did you read the comment?
+  system.stateVersion = "23.11";
+}

provision/hosts/default/default.nix

@@ -0,0 +1,4 @@
+{ ... }:
+{ 
+  imports = [ ./backup.nix ./configuration.nix ./home-configuration.nix ];
+}

provision/hosts/default/home-configuration.nix

@@ -0,0 +1,20 @@
+{ config, pkgs, user, ... }:
+{
+  home-manager.users.${user} = {
+    home.username = "${user}";
+    home.homeDirectory = "/home/${user}";
+    programs.home-manager.enable = true;
+
+    programs.direnv = {
+      enable = true;
+      enableBashIntegration = true;
+      nix-direnv.enable = true;
+    };
+
+    home.packages = with pkgs; [
+    ];
+
+    # Did you read the comment?
+    home.stateVersion = "23.11";
+  };
+}

provision/hosts/kestrel/configuration.nix

@@ -4,60 +4,18 @@
     ./syncthing.nix
   ];
 
-  nix = {
-    package = pkgs.nixFlakes;
-    extraOptions = "experimental-features = nix-command flakes";
-
-    settings.auto-optimise-store = true;
-    gc = {
-      automatic = true;
-      dates = "weekly";
-      options = "--delete-older-than 7d";
-    };
-  };
-
-  # Add non-free packages
-  nixpkgs.config.allowUnfree = true;
-  nixpkgs.config.permittedInsecurePackages = [ "electron-25.9.0" "openssl-1.1.1w" ];
-  nixpkgs.overlays = import ../../lib/overlays.nix;
-
   # Use zen kernel
   boot.kernelPackages = pkgs.linuxPackages_zen;
 
-  # Hardware options
-  hardware.bluetooth.enable = true;
-  hardware.bluetooth.package = pkgs.bluez;
-  hardware.sensor.iio.enable = true;
-  hardware.graphics.enable = true;
-
-  # Use the systemd-boot EFI boot loader.
-  boot.loader.systemd-boot.enable = true;
-  boot.loader.efi.canTouchEfiVariables = true;
-
   # Set networking options
   networking.hostName = "kestrel"; 
   networking.firewall.checkReversePath = "loose";
   networking.firewall.enable = false;
 
-  # Set your time zone.
-  time.timeZone = "America/Los_Angeles";
-  i18n.defaultLocale = "en_US.UTF-8";
-
-  # Add fonts
-  fonts.packages = with pkgs; [
-    nerdfonts
-  ];
-
   # Enable docker 
   virtualisation.docker.enable = true;
   virtualisation.docker.storageDriver = "btrfs";
 
-  # Define user account.
-  users.users.${user} = {
-    isNormalUser = true;
-    extraGroups = [ "dialout" "wheel" "docker" "libvirtd" ]; # Enable ‘sudo’ for the user.
-  };
-
   # Password-less root
   security.sudo.extraRules = [{ 
     users = [ "${user}" ];
@@ -71,10 +29,10 @@
       distrobox # Platform for creating and managing Linux distribution images.
   ];
 
-  # host secrets
+  # Secrets
   age.secrets."wireguard/kestrel".file = ../../secrets/wireguard/kestrel.age;
 
-  # Enable modules
+  # Modules 
   modules = {
     desktop = {
       sway.enable = false;
@@ -116,6 +74,11 @@
     };
   };
 
-  # Did you read the comment?
-  system.stateVersion = "23.11";
+  home-manager.users.${user} = {
+    modules = {
+      desktop = {
+        kitty.enable = true;
+      };
+    };
+  };
 }

provision/hosts/kestrel/home-configuration.nix

@@ -1,32 +0,0 @@
-{ config, pkgs, user, ... }:
-{
-  home.username = "${user}";
-  home.homeDirectory = "/home/${user}";
-  programs.home-manager.enable = true;
-
-  # Setup direnv
-  programs.direnv = {
-    enable = true;
-    enableBashIntegration = true;
-    nix-direnv.enable = true;
-  };
-
-  # Setup git
-  programs.git = {
-    enable = true;
-    userName = "starr-dusT";
-    userEmail = "starrtyler88@gmail.com";
-  };
-
-  home.packages = with pkgs; [
-  ];
-
-  # Enable home modules
-  modules = {
-    desktop = {
-      kitty.enable = true;
-    };
-  };
-
-  home.stateVersion = "23.11";
-}

provision/hosts/shivan/configuration.nix

@@ -4,60 +4,17 @@
     ./syncthing.nix
   ];
 
-  nix = {
-    package = pkgs.nixFlakes;
-    extraOptions = "experimental-features = nix-command flakes";
-
-    settings.auto-optimise-store = true;
-    gc = {
-      automatic = true;
-      dates = "weekly";
-      options = "--delete-older-than 7d";
-    };
-  };
-
-  # Add non-free packages
-  nixpkgs.config.allowUnfree = true;
-  nixpkgs.config.permittedInsecurePackages = [ "electron-25.9.0" "openssl-1.1.1w" ];
-  nixpkgs.overlays = import ../../lib/overlays.nix;
-
   # Use zen kernel
   boot.kernelPackages = pkgs.linuxPackages_zen;
 
-  # Hardware options
-  hardware.bluetooth.enable = true;
-  hardware.bluetooth.package = pkgs.bluez;
-  hardware.sensor.iio.enable = true;
-  hardware.graphics.enable = true;
-
-  # Use the systemd-boot EFI boot loader.
-  boot.loader.systemd-boot.enable = true;
-  boot.loader.efi.canTouchEfiVariables = true;
-
   # Set networking options
   networking.hostName = "shivan"; 
   networking.firewall.checkReversePath = "loose";
   networking.firewall.enable = false;
-  networking.networkmanager.enable = true;
-
-  # Set your time zone.
-  time.timeZone = "America/Los_Angeles";
-  i18n.defaultLocale = "en_US.UTF-8";
-
-  # Add fonts
-  fonts.packages = with pkgs; [
-    nerdfonts
-  ];
 
   # Enable docker 
   virtualisation.docker.enable = true;
 
-  # Define user account.
-  users.users.${user} = {
-    isNormalUser = true;
-    extraGroups = [ "dialout" "wheel" "docker" "libvirtd" ]; # Enable ‘sudo’ for the user.
-  };
-
   # Password-less root
   security.sudo.extraRules = [{ 
     users = [ "${user}" ];
@@ -71,7 +28,7 @@
     distrobox # Platform for creating and managing Linux distribution images.
   ]; 
 
-  # Enable modules
+  # Modules
   modules = {
     desktop = {
       sway.enable = true;
@@ -98,16 +55,15 @@
       secrets.enable = true;
       ssh.enable = true;
       terminal.enable = true;
-      wireguard-client = {
-        enable = false;
-        #privateKeyFile = "/run/secrets/wireguard/kestrel";
-        #address = [ "192.168.3.3/24" ];
-        #publicKey = "bd7bbZOngl/FTdBlnbIhgCLNf6yx5X8WjiRB7E1NEQQ=";
-        #endpoint = "66.218.43.87";
-      };
+      wireguard-client.enable = false;
     };
   };
 
-  # Did you read the comment?
-  system.stateVersion = "23.11";
+  home-manager.users.${user} = {
+    modules = {
+      desktop = {
+        kitty.enable = true;
+      };
+    };
+  };
 }

provision/hosts/shivan/home-configuration.nix

@@ -1,32 +0,0 @@
-{ config, pkgs, user, ... }:
-{
-  home.username = "${user}";
-  home.homeDirectory = "/home/${user}";
-  programs.home-manager.enable = true;
-
-  # Setup direnv
-  programs.direnv = {
-    enable = true;
-    enableBashIntegration = true;
-    nix-direnv.enable = true;
-  };
-
-  # Setup git
-  programs.git = {
-    enable = true;
-    userName = "starr-dusT";
-    userEmail = "starrtyler88@gmail.com";
-  };
-
-  home.packages = with pkgs; [
-  ];
-
-  # Enable home modules
-  modules = {
-    desktop = {
-      kitty.enable = true;
-    };
-  };
-
-  home.stateVersion = "23.11";
-}

provision/hosts/torus/configuration.nix

@@ -11,51 +11,22 @@
     ./nextcloud.nix
   ];
 
-  nix = {
-    package = pkgs.nixFlakes;
-    extraOptions = "experimental-features = nix-command flakes";
-
-    settings.auto-optimise-store = true;
-    gc = {
-      automatic = true;
-      dates = "weekly";
-      options = "--delete-older-than 7d";
-    };
-  };
-
-  # Add non-free packages
-  nixpkgs.config.allowUnfree = true;
-  nixpkgs.config.permittedInsecurePackages = [ "openssl-1.1.1w" ];
-  nixpkgs.overlays = import ../../lib/overlays.nix;
-
   # Use normal kernel
   boot.kernelPackages = pkgs.linuxPackages;
 
   # Set kernel modules
   boot.kernelModules = [ "sg" ];
 
-  # Hardware options
-  hardware.graphics.enable = true;
-  hardware.graphics.enable32Bit = true;
-
-  # Use the systemd-boot EFI boot loader.
-  boot.loader.systemd-boot.enable = true;
-  boot.loader.efi.canTouchEfiVariables = true;
-
   # Set networking options
   networking.hostName = "torus"; 
-  # Needed for wireguard-server
-  boot.kernel.sysctl = {
-    "net.ipv4.conf.all.forwarding" = true;
-  };
   networking.firewall.enable = true;
   networking.firewall.checkReversePath = "loose";
   networking.firewall.allowedTCPPorts = [ 80 443 ];
   networking.firewall.allowedUDPPorts = [ 80 443 ];
-
-  # Set your time zone.
-  time.timeZone = "America/Los_Angeles";
-  i18n.defaultLocale = "en_US.UTF-8";
+  networking.nameservers = [ "8.8.8.8" "8.8.4.4" ];
+  boot.kernel.sysctl = {
+    "net.ipv4.conf.all.forwarding" = true; # Needed for wireguard-server
+  };
 
   # Enable virtualisation
   virtualisation.docker.enable = true;
@@ -63,19 +34,9 @@
   virtualisation.docker.enableNvidia = true;
   services.xserver.videoDrivers = [ "nvidia" ];
 
-
-  # Define user account.
-  users.users.${user} = {
-    isNormalUser = true;
-    extraGroups = [ "wheel" "docker" ]; # Enable ‘sudo’ for the user.
-    shell = pkgs.bash;
-  };
-
   environment.systemPackages = with pkgs; [
     docker-compose # Tool for defining and running multi-container Docker applications.
     python3 # Interpreted, high-level programming language known for its simplicity and versatility.
-    zk # Command-line tool for interacting with Apache ZooKeeper, a centralized service for distributed systems.
-    gollum # Wiki software that provides a simple, Git-based wiki engine.
   ];
 
   security.acme = {
@@ -83,14 +44,9 @@
     defaults.email = "starrtyler88@gmail.com";
   };
 
-
+  # Nginx
   security.pam.services.nginx.setEnvironment = false;
-  systemd.services.nginx.serviceConfig = {
-    SupplementaryGroups = [ "shadow" ];
-  };
-
-  networking.nameservers = [ "8.8.8.8" "8.8.4.4" ];
-  
+  systemd.services.nginx.serviceConfig = { SupplementaryGroups = [ "shadow" ]; };
   services.nginx = {
     enable = true;
     recommendedGzipSettings = true;
@@ -133,7 +89,7 @@
     };
   };
 
-  # Enable modules
+  # Modules
   modules = {
     devel = {
       tooling.enable = true;
@@ -147,6 +103,12 @@
       secrets.enable = true;
     };
   };
-  # Did you read the comment?
-  system.stateVersion = "23.11";
+
+  home-manager.users.${user} = {
+    modules = {
+      desktop = {
+        kitty.enable = false;
+      };
+    };
+  };
 }

provision/hosts/torus/home-configuration.nix

@@ -1,17 +0,0 @@
-{ config, pkgs, user, ... }:
-{
-  home.username = "${user}";
-  home.homeDirectory = "/home/${user}";
-  programs.home-manager.enable = true;
-
-  home.packages = with pkgs; [
-    chezmoi
-    rbw 
-  ];
-
-  # Enable home modules
-  #modules = {
-  #};
-
-  home.stateVersion = "23.11";
-}

provision/modules/system/secrets.nix

@@ -15,5 +15,15 @@ in {
       owner = "${user}";
       group = "users";
     };
+    age.secrets."ssh/kestrel/id_ed25519" = {
+      file = ../../secrets/ssh/kestrel/id_ed25519.age;
+      owner = "${user}";
+      group = "users";
+    };
+    age.secrets."ssh/kestrel/id_ed25519.pub" = {
+      file = ../../secrets/ssh/kestrel/id_ed25519.pub.age;
+      owner = "${user}";
+      group = "users";
+    };
   };
 }

provision/secrets/secrets.nix

@@ -14,4 +14,6 @@ in
   "wireguard/bulwark.age".publicKeys = systems;
   "git/gitea-runner-1.age".publicKeys = systems;
   "nextcloud/password.age".publicKeys = systems;
+  "ssh/kestrel/id_ed25519.age".publicKeys = [ tstarr_kestrel ] ++ systems;
+  "ssh/kestrel/id_ed25519.pub.age".publicKeys = [ tstarr_kestrel ] ++ systems;
 }

provision/secrets/ssh/kestrel/id_ed25519.pub.age

@@ -0,0 +1,10 @@
+age-encryption.org/v1
+-> ssh-ed25519 c/r/0Q +D6/eizW8sHinmD3T1GcRHbykaKpTLg/LA/TVwtcKE8
+OMZiDpnclm43THtvOMS1yty6TGd+uhY3pXZ4Ki+P8Cc
+-> ssh-ed25519 Fz/sQw 7nGnk473hfSh/ZuDxaFcrTBjYg93blJJyhfz/g5NuGM
+bwdjYVzIi8djVzkS2FOgL1V/zi/nNszxXg9EHo9Z7T0
+-> ssh-ed25519 47GzQA lm5EIYLobeJyOmvSW9GPU2V+7KAGBEJXJ0TqHx3ABVQ
+gnl/k+gfXEUqleiJWQipLOrhVcJljEMp2mbC+irGkJA
+--- K/QSHLrouRPDlm0mesa1wk9rOS9sjK1lmVhzHLj4VqM
+Úx‘…<ÜŒy[€ %[!iÉûs}ËÒI¬Žðì¸hd”žxÖ	2s
+‰÷^Ø6èé5ÆhAºÍ?ÖWå~¢â¯Ï’<>g$¶<>=UØ\E’¤ÑÒ˜I@Æc¿
ýt$õ<>Æ-
6y*â+A[§À<Êß³ÛK