jory
582faec359
- Replace age-based key decryption with automatic SSH host key support - Simplify SSH configuration with consolidated host entries and enhanced security settings - Upgrade home-manager to himmelblau for Microsoft Entra ID authentication - Remove legacy agenix inputs and consolidate secrets to essential services only - Add Cisco Secure Client overlay for enterprise VPN capabilities - Update secrets.yaml to minimal configuration with gitea/github/hetzner services - Expand system packages with tun module for VPN connectivity - Add work directory setup for user development environment
101 lines
2.6 KiB
Nix
101 lines
2.6 KiB
Nix
{
|
|
self,
|
|
inputs,
|
|
...
|
|
}: let
|
|
# shorten paths
|
|
inherit (inputs.nixpkgs.lib) nixosSystem;
|
|
lib = inputs.nixpkgs.lib;
|
|
# Server uses its own pinned 24.05 nixpkgs (kept isolated from the laptop's unstable)
|
|
nixosSystem24 = inputs.nixos-24-05.lib.nixosSystem;
|
|
unstablePkgs = import inputs.nixpkgs-unstable {system = "x86_64-linux";};
|
|
mod = "${self}/system";
|
|
home = "${self}/home";
|
|
|
|
# get the basic config to build on top of
|
|
inherit (import "${self}/system") tty desktop laptop;
|
|
|
|
# get these into the module system
|
|
specialArgs = {inherit inputs self;};
|
|
|
|
# shared modules for all configurations
|
|
sharedModules = [
|
|
./aesthetic
|
|
"${mod}/services/gnome-services.nix"
|
|
"${mod}/core/limine.nix"
|
|
"${home}"
|
|
"${self}/work"
|
|
inputs.sops-nix.nixosModules.sops
|
|
inputs.himmelblau.nixosModules.himmelblau
|
|
];
|
|
in {
|
|
flake.nixosConfigurations = {
|
|
# TTY: desktop headless (no GUI)
|
|
tty = nixosSystem {
|
|
inherit specialArgs;
|
|
modules = tty ++ sharedModules;
|
|
};
|
|
|
|
# Desktop: desktop with GUI
|
|
desktop = nixosSystem {
|
|
inherit specialArgs;
|
|
modules = desktop ++ sharedModules;
|
|
};
|
|
|
|
# Laptop: laptop with GUI + battery + bluetooth
|
|
laptop = nixosSystem {
|
|
inherit specialArgs;
|
|
modules =
|
|
laptop
|
|
++ sharedModules
|
|
++ [
|
|
"${mod}/services/location.nix"
|
|
];
|
|
};
|
|
|
|
# Laptop UEFI: explicit UEFI boot mode
|
|
laptop-uefi = nixosSystem {
|
|
inherit specialArgs;
|
|
modules =
|
|
laptop
|
|
++ sharedModules
|
|
++ [
|
|
"${mod}/services/location.nix"
|
|
({ config, ... }: {
|
|
boot.loader.limine.bootMode = "uefi";
|
|
})
|
|
];
|
|
};
|
|
|
|
# Laptop BIOS: explicit BIOS boot mode
|
|
laptop-bios = nixosSystem {
|
|
inherit specialArgs;
|
|
modules =
|
|
laptop
|
|
++ sharedModules
|
|
++ [
|
|
"${mod}/services/location.nix"
|
|
({ config, ... }: {
|
|
boot.loader.limine.bootMode = "bios";
|
|
boot.loader.limine.biosDevice = "/dev/nvme0n1";
|
|
})
|
|
];
|
|
};
|
|
|
|
# Server: severijnse.eu (Hetzner) — fully isolated under servers/hetzner/.
|
|
# Uses nixos-24.05 + disko + sops-nix and does NOT inherit the laptop's shared modules.
|
|
hetzner = nixosSystem24 {
|
|
system = "x86_64-linux";
|
|
specialArgs = {
|
|
inherit inputs self unstablePkgs;
|
|
};
|
|
modules = [
|
|
inputs.disko.nixosModules.disko
|
|
inputs.sops-nix.nixosModules.sops
|
|
"${self}/servers/hetzner/hosts/hetzner/hardware-configuration.nix"
|
|
"${self}/servers/hetzner/hosts/hetzner/default.nix"
|
|
];
|
|
};
|
|
};
|
|
}
|