restructure code

nixos/default.nix

@@ -0,0 +1,186 @@
+{ pkgs, config, lib, modulesPath, ... }: {
+  imports = [
+    (modulesPath + "/installer/scan/not-detected.nix")
+    ./modules/custom
+  ];
+
+  boot = {
+    kernelModules = [ "kvm-intel" ];
+    extraModulePackages = [ ];
+
+    initrd = {
+      availableKernelModules = [
+        "ahci"
+        "xhci_pci"
+        "nvme"
+        "usbhid"
+        "usb_storage"
+        "sd_mod"
+        "sdhci_pci"
+      ];
+      kernelModules = [ ];
+    };
+
+    loader = {
+      systemd-boot.enable = true;
+      efi.canTouchEfiVariables = true;
+    };
+  };
+
+  time.timeZone = "Europe/Amsterdam";
+
+  i18n = {
+    defaultLocale = "en_US.UTF-8";
+
+    extraLocaleSettings = {
+      LC_ADDRESS = "nl_NL.UTF-8";
+      LC_IDENTIFICATION = "nl_NL.UTF-8";
+      LC_MEASUREMENT = "nl_NL.UTF-8";
+      LC_MONETARY = "nl_NL.UTF-8";
+      LC_NAME = "nl_NL.UTF-8";
+      LC_NUMERIC = "nl_NL.UTF-8";
+      LC_PAPER = "nl_NL.UTF-8";
+      LC_TELEPHONE = "nl_NL.UTF-8";
+      LC_TIME = "nl_NL.UTF-8";
+    };
+  };
+
+  services = {
+    openssh = {
+      enable = true;
+      openFirewall = true;
+
+      settings = {
+        PasswordAuthentication = false;
+        KbdInteractiveAuthentication = false;
+      };
+    };
+
+    xserver = {
+      layout = "us";
+      xkbVariant = "";
+    };
+  };
+
+  users.users.root.openssh.authorizedKeys.keys = [
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOodpLr+FDRyKyHjucHizNLVFHZ5AQmE9GmxMnOsSoaw pimkunis@thinkpadpim"
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINUZp4BCxf7uLa1QWonx/Crf8tYZ5MKIZ+EuaBa82LrV user@user-laptop"
+  ];
+
+  programs = {
+    ssh = {
+      knownHosts = {
+        dmz = {
+          hostNames = [ "*.dmz" ];
+          publicKey =
+            "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAX2IhgHNxC6JTvLu9cej+iWuG+uJFMXn4AiRro9533x";
+          certAuthority = true;
+        };
+
+        hypervisors = {
+          hostNames = [ "*.hyp" ];
+          publicKey =
+            "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFzRkH3d/KVJQouswY/DMpenWbDFVOnI3Vut0xR0e1tb";
+          certAuthority = true;
+        };
+      };
+
+    };
+
+    neovim = {
+      enable = true;
+      vimAlias = true;
+      viAlias = true;
+    };
+  };
+
+  nixpkgs = {
+    config.allowUnfree = true;
+    hostPlatform = "x86_64-linux";
+  };
+
+  environment.systemPackages = with pkgs; [
+    neofetch
+    wget
+    git
+    btop
+    htop
+    ripgrep
+    dig
+    tree
+    file
+  ];
+
+  networking = {
+    domain = "hyp";
+    firewall.enable = true;
+    useDHCP = false;
+  };
+
+  system.stateVersion = "23.05";
+
+  systemd.network = {
+    enable = true;
+
+    netdevs = {
+      "20-vlandmz" = {
+        netdevConfig = {
+          Kind = "vlan";
+          Name = "vlandmz";
+        };
+        vlanConfig.Id = 30;
+      };
+      "20-bridgedmz" = {
+        netdevConfig = {
+          Kind = "bridge";
+          Name = "bridgedmz";
+        };
+      };
+    };
+
+    networks = {
+      "30-main-nic" = {
+        matchConfig.Name = "en*";
+        networkConfig = { DHCP = "yes"; };
+        vlan = [ "vlandmz" ];
+      };
+      "40-vlandmz" = {
+        matchConfig.Name = "vlandmz";
+        networkConfig = {
+          IPv6AcceptRA = false;
+          LinkLocalAddressing = "no";
+          Bridge = "bridgedmz";
+        };
+        linkConfig.RequiredForOnline = "enslaved";
+      };
+      "40-bridgedmz" = {
+        matchConfig.Name = "bridgedmz";
+        networkConfig = {
+          IPv6AcceptRA = false;
+          LinkLocalAddressing = "no";
+        };
+        linkConfig.RequiredForOnline = "carrier";
+      };
+    };
+  };
+
+  hardware.cpu.intel.updateMicrocode =
+    lib.mkDefault config.hardware.enableRedistributableFirmware;
+
+  age.identityPaths = [ "/root/age_ed25519" ];
+
+  virtualisation.libvirtd.enable = true;
+
+  nix = {
+    package = pkgs.nixFlakes;
+    extraOptions = ''
+      experimental-features = nix-command flakes
+    '';
+  };
+
+  system.activationScripts.diff = ''
+    if [[ -e  /run/current-system ]]; then
+      ${pkgs.nix}/bin/nix store diff-closures /run/current-system "$systemConfig"
+    fi
+  '';
+}

nixos/machines/atlas_host_ed25519-cert.pub

@@ -0,0 +1 @@
+ssh-ed25519-cert-v01@openssh.com AAAAIHNzaC1lZDI1NTE5LWNlcnQtdjAxQG9wZW5zc2guY29tAAAAIH4CQGHwWytKnkn7lYjT6G1NyPzINvfroZgwCLoOLO74AAAAIOMoSSEqM4VUBWUeFweJbqK9z7Ygp7fkX22hyWmgCNg8AAAAAAAAAAAAAAACAAAACWF0bGFzLmh5cAAAAA0AAAAJYXRsYXMuaHlwAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAADMAAAALc3NoLWVkMjU1MTkAAAAgXNGQfd38pUlCi6zBj8Myl6dZsMVU6cjdW63TFHR7W1sAAABTAAAAC3NzaC1lZDI1NTE5AAAAQAYModSEVNG06xvAcRn8XFeCp/iXFeqVcbtfT1NmmMkyIgybkXhJyHjp89BPg0zeAaoScFx8Xpsdd8CsxTeP+QU= root@atlas

nixos/machines/atlas_user_ed25519-cert.pub

@@ -0,0 +1 @@
+ssh-ed25519-cert-v01@openssh.com AAAAIHNzaC1lZDI1NTE5LWNlcnQtdjAxQG9wZW5zc2guY29tAAAAIItpNkjaH8o51VKydwHYbbLxXMtf4euzojFKPxz+XqdwAAAAIG1vJNH1p8l8HlmYMT/vHGTjEnIul7ORQhutNnKiXlgqAAAAAAAAAAAAAAABAAAACWF0bGFzLmh5cAAAABsAAAAJYXRsYXMuaHlwAAAACmh5cGVydmlzb3IAAAAAAAAAAP//////////AAAAAAAAAIIAAAAVcGVybWl0LVgxMS1mb3J3YXJkaW5nAAAAAAAAABdwZXJtaXQtYWdlbnQtZm9yd2FyZGluZwAAAAAAAAAWcGVybWl0LXBvcnQtZm9yd2FyZGluZwAAAAAAAAAKcGVybWl0LXB0eQAAAAAAAAAOcGVybWl0LXVzZXItcmMAAAAAAAAAAAAAADMAAAALc3NoLWVkMjU1MTkAAAAgdmt4SFL+swd8kHsh6cQR+TfzMKObJx75fYBbHNT83zUAAABTAAAAC3NzaC1lZDI1NTE5AAAAQIW4tC+FJA6bKFUfRVcHLWz1u3ZL/GRTWD2WCW4ApHq7no6ODeMwE10noNt/42mwYjFmjwR+cd9EuMyUErXmaw8= root@atlas

nixos/machines/default.nix

@@ -0,0 +1,55 @@
+{
+  jefke = {
+    name = "jefke";
+    hostName = "jefke.hyp";
+
+    nixosModule.custom = {
+      dataDisk.enable = true;
+      terraformDatabase.enable = true;
+      # k3s.enable = true;
+      disko.osDiskDevice = "/dev/nvme0n1";
+
+      ssh = {
+        useCertificates = true;
+        hostCert = builtins.readFile ./jefke_host_ed25519-cert.pub;
+        userCert = builtins.readFile ./jefke_user_ed25519-cert.pub;
+      };
+    };
+  };
+
+  atlas = {
+    name = "atlas";
+    hostName = "atlas.hyp";
+
+    nixosModule.custom = {
+      disko.osDiskDevice = "/dev/nvme0n1";
+
+      ssh = {
+        useCertificates = true;
+        hostCert = builtins.readFile ./atlas_host_ed25519-cert.pub;
+        userCert = builtins.readFile ./atlas_user_ed25519-cert.pub;
+      };
+    };
+  };
+
+  lewis = {
+    name = "lewis";
+    hostName = "lewis.hyp";
+
+    nixosModule.custom = {
+      disko.osDiskDevice = "/dev/sda";
+      backups.enable = true;
+
+      dataDisk = {
+        enable = true;
+        devicePath = "/dev/nvme0n1p1";
+      };
+
+      ssh = {
+        useCertificates = true;
+        hostCert = builtins.readFile ./lewis_host_ed25519-cert.pub;
+        userCert = builtins.readFile ./lewis_user_ed25519-cert.pub;
+      };
+    };
+  };
+}

nixos/machines/jefke_host_ed25519-cert.pub

@@ -0,0 +1 @@
+ssh-ed25519-cert-v01@openssh.com AAAAIHNzaC1lZDI1NTE5LWNlcnQtdjAxQG9wZW5zc2guY29tAAAAIHzQMMRr2vNtTW3joxPzQYjFFu3iI/WyIRVD18YKY61CAAAAIKTzrsjwRmKg3JbRLY/RrWnIBfCupfFdMWZ/8AQAXg9uAAAAAAAAAAAAAAACAAAACWplZmtlLmh5cAAAAA0AAAAJamVma2UuaHlwAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAADMAAAALc3NoLWVkMjU1MTkAAAAgXNGQfd38pUlCi6zBj8Myl6dZsMVU6cjdW63TFHR7W1sAAABTAAAAC3NzaC1lZDI1NTE5AAAAQPNDgNAOmp5Gl//mjEHF2H5Yi8GIFfyiRm8nJ2UkGXzpNr3+bQvQhPigziuXO0+8910yY9QzXTfvc4mgAT1gpgU= root@jefke

nixos/machines/jefke_user_ed25519-cert.pub

@@ -0,0 +1 @@
+ssh-ed25519-cert-v01@openssh.com AAAAIHNzaC1lZDI1NTE5LWNlcnQtdjAxQG9wZW5zc2guY29tAAAAIKdTRygvLfapNY6umK+TdoqWDIq4ZzXLZlUJ/lVvkuqtAAAAINZ3aw6gjrOt561j1Mh7kINqlavorKeujN1Q8mn/Fy69AAAAAAAAAAAAAAABAAAACWplZmtlLmh5cAAAABsAAAAJamVma2UuaHlwAAAACmh5cGVydmlzb3IAAAAAAAAAAP//////////AAAAAAAAAIIAAAAVcGVybWl0LVgxMS1mb3J3YXJkaW5nAAAAAAAAABdwZXJtaXQtYWdlbnQtZm9yd2FyZGluZwAAAAAAAAAWcGVybWl0LXBvcnQtZm9yd2FyZGluZwAAAAAAAAAKcGVybWl0LXB0eQAAAAAAAAAOcGVybWl0LXVzZXItcmMAAAAAAAAAAAAAADMAAAALc3NoLWVkMjU1MTkAAAAgdmt4SFL+swd8kHsh6cQR+TfzMKObJx75fYBbHNT83zUAAABTAAAAC3NzaC1lZDI1NTE5AAAAQI36zBw4Epr1ijXBk7T5JENgisn4SbVTLkhYBWCquHcAv3nFFJOEZ1kdC/SfYaDwmXb/rNybpr3942wF0xD3/ws= root@jefke

nixos/machines/lewis_host_ed25519-cert.pub

@@ -0,0 +1 @@
+ssh-ed25519-cert-v01@openssh.com AAAAIHNzaC1lZDI1NTE5LWNlcnQtdjAxQG9wZW5zc2guY29tAAAAIAP9Xu3G75HcVIVhrgiCKSM+YTkaCbTqI18NBdWikIlHAAAAIKfbZauF+7q3s7VxhvxdPT7XDapch0P3tD//U4/70D6cAAAAAAAAAAAAAAACAAAACWxld2lzLmh5cAAAAA0AAAAJbGV3aXMuaHlwAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAADMAAAALc3NoLWVkMjU1MTkAAAAgXNGQfd38pUlCi6zBj8Myl6dZsMVU6cjdW63TFHR7W1sAAABTAAAAC3NzaC1lZDI1NTE5AAAAQGHtz4FNkj0LuplU+12A/sx0bE4QeHLYhctXag9DSMGJz9yOpyMpK3PPKkm6leLdGYs7RUjxwXvcj+f4k16VXA0= root@atlas

nixos/machines/lewis_user_ed25519-cert.pub

@@ -0,0 +1 @@
+ssh-ed25519-cert-v01@openssh.com AAAAIHNzaC1lZDI1NTE5LWNlcnQtdjAxQG9wZW5zc2guY29tAAAAIGqYC+tRPZ24WMroezrFgxtm8YObweMCTpz/y+dbGrzKAAAAIEuhHYB6zdSsfvLm4zXfuUbUCkUgPRu6rdt1rninA7PwAAAAAAAAAAAAAAABAAAACWxld2lzLmh5cAAAABsAAAAJbGV3aXMuaHlwAAAACmh5cGVydmlzb3IAAAAAAAAAAP//////////AAAAAAAAAIIAAAAVcGVybWl0LVgxMS1mb3J3YXJkaW5nAAAAAAAAABdwZXJtaXQtYWdlbnQtZm9yd2FyZGluZwAAAAAAAAAWcGVybWl0LXBvcnQtZm9yd2FyZGluZwAAAAAAAAAKcGVybWl0LXB0eQAAAAAAAAAOcGVybWl0LXVzZXItcmMAAAAAAAAAAAAAADMAAAALc3NoLWVkMjU1MTkAAAAgdmt4SFL+swd8kHsh6cQR+TfzMKObJx75fYBbHNT83zUAAABTAAAAC3NzaC1lZDI1NTE5AAAAQGV0nCPl4HDo1Q24NnFcPc1/FPYxwkWg864eUp5hdbttL4f8h7YLtZw6k8hHIn50wVdHEJkUwYrXgR1dwYhfEwA= root@atlas

nixos/modules/custom/backups.nix

@@ -0,0 +1,106 @@
+{ pkgs, lib, config, ... }:
+let
+  cfg = config.custom.backups;
+  snapshotFile = "/tmp/snapshot.qcow2";
+  snapshotMount = "/tmp/snapshot";
+  beforeEverything = pkgs.writeShellScriptBin "beforeEverything" ''
+    ${pkgs.libvirt}/bin/virsh snapshot-create-as --domain ${cfg.domainName} --name backup-${cfg.domainName} --disk-only --quiesce --no-metadata --diskspec vda,snapshot=no --diskspec vdb,file=${snapshotFile} && ${pkgs.coreutils}/bin/sleep 1
+    ${pkgs.coreutils}/bin/mkdir -p ${snapshotMount}
+    ${pkgs.libguestfs-with-appliance}/bin/guestmount -a ${snapshotFile} -m /dev/sda1 --ro ${snapshotMount}
+  '';
+
+  afterEverything = pkgs.writeShellScriptBin "afterEverything" ''
+    set +e
+    ${pkgs.coreutils}/bin/sleep 10
+    ${pkgs.libguestfs-with-appliance}/bin/guestunmount ${snapshotMount} && ${pkgs.coreutils}/bin/sleep 1
+    ${pkgs.coreutils}/bin/rm -rf ${snapshotMount}
+    ${pkgs.libvirt}/bin/virsh blockcommit ${cfg.domainName} vdb --active --verbose --pivot
+    ${pkgs.coreutils}/bin/rm -f ${snapshotFile}
+  '';
+
+  borgmaticConfig = pkgs.writeTextFile {
+    name = "borgmatic-config";
+    text = ''
+      source_directories:
+      - ${snapshotMount}
+      repositories:
+      - path: ${cfg.repoLocation}
+        label: ${cfg.domainName}
+      keep_daily: 7
+      keep_weekly: 4
+      keep_monthly: 6
+      unknown_unencrypted_repo_access_is_ok: true
+      before_everything:
+      - ${beforeEverything}/bin/beforeEverything
+      after_everything:
+      - ${afterEverything}/bin/afterEverything
+    '';
+  };
+in
+{
+  options.custom.backups = {
+    enable = lib.mkOption {
+      default = false;
+      type = lib.types.bool;
+      description = ''
+        Whether to enable backups of persistent data on this machine.
+      '';
+    };
+
+    repoLocation = lib.mkOption {
+      default = "${config.custom.dataDisk.mountPoint}/backups/thecloud-data.borg";
+      type = lib.types.str;
+      description = ''
+        Location of the Borg repository to back up to.
+      '';
+    };
+
+    domainName = lib.mkOption {
+      default = "thecloud";
+      type = lib.types.str;
+      description = ''
+        The name of the Libvirt domain with the data disk attached.
+      '';
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    environment.systemPackages = with pkgs; [ libguestfs-with-appliance borgbackup ];
+    # Converted from:
+    # https://github.com/borgmatic-collective/borgmatic/tree/84823dfb912db650936e3492f6ead7e0e0d32a0f/sample/systemd
+    systemd.services.borgmatic = {
+      description = "borgmatic backup";
+      wants = [ "network-online.target" ];
+      after = [ "network-online.target" ];
+      unitConfig = {
+        ConditionACPower = true;
+      };
+      serviceConfig = {
+        Type = "oneshot";
+        Nice = 19;
+        CPUSchedulingPolicy = "batch";
+        IOSchedulingClass = "best-effort";
+        IOSchedulingPriority = 7;
+        IOWeight = 100;
+        Restart = "no";
+        LogRateLimitIntervalSec = 0;
+      };
+      preStart = "${pkgs.coreutils}/bin/sleep 1m";
+      script = "${pkgs.systemd}/bin/systemd-inhibit --who=\"borgmatic\" --what=\"sleep:shutdown\" --why=\"Prevent interrupting scheduled backup\" ${pkgs.borgmatic}/bin/borgmatic --verbosity -2 --syslog-verbosity 1";
+    };
+
+    environment.etc."borgmatic/config.yaml" = {
+      source = borgmaticConfig;
+    };
+
+    # systemd.timers.borgmatic = {
+    #   description = "Run borgmatic backup";
+    #   wantedBy = [ "timers.target" ];
+    #   timerConfig = {
+    #     OnCalendar = "*-*-* 3:00:00";
+    #     Persistent = true;
+    #     RandomizedDelaySec = "3h";
+    #   };
+    # };
+  };
+}

nixos/modules/custom/data-disk.nix

@@ -0,0 +1,37 @@
+{ lib, config, ... }:
+let cfg = config.custom.dataDisk;
+in {
+  options = {
+    custom = {
+      dataDisk = {
+        enable = lib.mkOption {
+          default = false;
+          type = lib.types.bool;
+          description = ''
+            Whether to automatically mount a disk to be used as a data disk.
+          '';
+        };
+
+        mountPoint = lib.mkOption {
+          default = "/mnt/data";
+          type = lib.types.str;
+          description = ''
+            Mount point of the data disk (if enabled).
+          '';
+        };
+
+        devicePath = lib.mkOption {
+          default = "/dev/sda1";
+          type = lib.types.str;
+          description = ''
+            Path of the device to be used as a data disk.
+          '';
+        };
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    fileSystems.${cfg.mountPoint} = { device = cfg.devicePath; };
+  };
+}

nixos/modules/custom/default.nix

@@ -0,0 +1,3 @@
+{
+  imports = [ ./terraform-database.nix ./data-disk.nix ./ssh-certificates.nix ./k3s ./disko.nix ./backups.nix ];
+}

nixos/modules/custom/disko.nix

@@ -0,0 +1,43 @@
+{ lib, config, ... }:
+let cfg = config.custom.disko;
+in {
+  options = {
+    custom = {
+      disko.osDiskDevice = lib.mkOption {
+        type = lib.types.str;
+        description = ''
+          The disk device to be used for the operating system.
+        '';
+      };
+    };
+  };
+
+  # TODO: rename this to 'osDisk'. Unfortunately, we would need to run nixos-anywhere again then
+  config.disko.devices.disk.vdb = {
+    device = cfg.osDiskDevice;
+    type = "disk";
+    content = {
+      type = "gpt";
+      partitions = {
+        ESP = {
+          type = "EF00";
+          size = "500M";
+          content = {
+            type = "filesystem";
+            format = "vfat";
+            mountpoint = "/boot";
+          };
+        };
+        root = {
+          end = "-4G";
+          content = {
+            type = "filesystem";
+            format = "btrfs";
+            mountpoint = "/";
+          };
+        };
+        swap = { size = "100%"; };
+      };
+    };
+  };
+}

nixos/modules/custom/k3s/bootstrap.nix

@@ -0,0 +1,16 @@
+{ kubenix, ... }: {
+  imports = [ kubenix.modules.k8s ];
+  kubernetes.resources.clusterRoleBindings.pim-cluster-admin = {
+    roleRef = {
+      apiGroup = "rbac.authorization.k8s.io";
+      kind = "ClusterRole";
+      name = "cluster-admin";
+    };
+    subjects = [
+      {
+        kind = "User";
+        name = "pim";
+      }
+    ];
+  };
+}

nixos/modules/custom/k3s/default.nix

@@ -0,0 +1,36 @@
+{ pkgs, lib, config, kubenix, ... }:
+let cfg = config.custom.k3s;
+in {
+  options = {
+    custom = {
+      k3s.enable = lib.mkOption {
+        default = false;
+        type = lib.types.bool;
+        description = ''
+          Whether to start k3s with custom configuration.
+        '';
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    environment.systemPackages = [ pkgs.k3s ];
+    networking.firewall.allowedTCPPorts = [ 6443 ];
+
+    services.k3s = {
+      enable = true;
+      role = "server";
+      extraFlags = "--tls-san ${config.networking.fqdn} --data-dir ${config.custom.dataDisk.mountPoint}/k3s";
+    };
+
+    system.activationScripts.k3s-bootstrap.text =
+      let
+        k3sBootstrapFile = (kubenix.evalModules.x86_64-linux {
+          module = import ./bootstrap.nix;
+        }).config.kubernetes.result;
+      in
+      ''
+        ln -sf ${k3sBootstrapFile} ${config.custom.dataDisk.mountPoint}/k3s/server/manifests/k3s-bootstrap.json
+      '';
+  };
+}

nixos/modules/custom/ssh-certificates.nix

@@ -0,0 +1,73 @@
+{ lib, config, ... }:
+let
+  cfg = config.custom.ssh;
+  hostCert = builtins.toFile "host_ed25519-cert.pub" cfg.hostCert;
+  userCert = builtins.toFile "user_ed25519-cert.pub" cfg.userCert;
+in {
+  options = {
+    custom = {
+      ssh = {
+        useCertificates = lib.mkOption {
+          type = lib.types.bool;
+          default = false;
+          description = ''
+            Whether to use certificates at all.
+          '';
+        };
+
+        hostCert = lib.mkOption {
+          type = lib.types.str;
+          description = ''
+            SSH host certificate
+          '';
+        };
+
+        userCert = lib.mkOption {
+          type = lib.types.str;
+          description = ''
+            SSH user certificate
+          '';
+        };
+
+        hostKey = lib.mkOption {
+          default =
+            ../../secrets/${config.networking.hostName}_host_ed25519.age;
+          type = lib.types.path;
+          description = ''
+            SSH host key
+          '';
+        };
+
+        userKey = lib.mkOption {
+          default =
+            ../../secrets/${config.networking.hostName}_user_ed25519.age;
+          type = lib.types.path;
+          description = ''
+            SSH user key
+          '';
+        };
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.useCertificates {
+    services.openssh = {
+      extraConfig = ''
+        HostCertificate ${hostCert}
+        HostKey ${config.age.secrets.host_ed25519.path}
+      '';
+    };
+
+    programs.ssh = {
+      extraConfig = ''
+        CertificateFile ${userCert}
+        IdentityFile ${config.age.secrets.user_ed25519.path}
+      '';
+    };
+
+    age.secrets = {
+      "host_ed25519".file = cfg.hostKey;
+      "user_ed25519".file = cfg.userKey;
+    };
+  };
+}

nixos/modules/custom/terraform-database.nix

@@ -0,0 +1,57 @@
+{ pkgs, lib, config, ... }:
+let cfg = config.custom.terraformDatabase;
+in {
+  options = {
+    custom = {
+      terraformDatabase.enable = lib.mkOption {
+        default = false;
+        type = lib.types.bool;
+        description = ''
+          Whether to start a postgreSQL database for Terraform states
+        '';
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.postgresql = {
+      enable = true;
+      ensureDatabases = [ "terraformstates" ];
+      package = pkgs.postgresql_15;
+      enableTCPIP = true;
+
+      dataDir = lib.mkIf config.custom.dataDisk.enable
+        "${config.custom.dataDisk.mountPoint}/postgresql/${config.services.postgresql.package.psqlSchema}";
+
+      authentication = ''
+        hostssl terraformstates terraform all cert
+      '';
+
+      settings =
+        let
+          serverCert = builtins.toFile "postgresql_server.crt"
+            (builtins.readFile ../../postgresql_server.crt);
+        in
+        {
+          ssl = true;
+          ssl_cert_file = serverCert;
+          ssl_key_file = config.age.secrets."postgresql_server.key".path;
+          ssl_ca_file = serverCert;
+        };
+
+      ensureUsers = [{
+        name = "terraform";
+        ensurePermissions = { "DATABASE terraformstates" = "ALL PRIVILEGES"; };
+      }];
+    };
+
+    networking.firewall.allowedTCPPorts = [ 5432 ];
+
+    age.secrets."postgresql_server.key" = {
+      file = ../../secrets/postgresql_server.key.age;
+      mode = "400";
+      owner = builtins.toString config.ids.uids.postgres;
+      group = builtins.toString config.ids.gids.postgres;
+    };
+  };
+}

nixos/modules/disk-config.nix

@@ -0,0 +1,33 @@
+{
+  disko.devices = {
+    disk = {
+      vdb = {
+        device = "/dev/nvme0n1";
+        type = "disk";
+        content = {
+          type = "gpt";
+          partitions = {
+            ESP = {
+              type = "EF00";
+              size = "500M";
+              content = {
+                type = "filesystem";
+                format = "vfat";
+                mountpoint = "/boot";
+              };
+            };
+            root = {
+              end = "-4G";
+              content = {
+                type = "filesystem";
+                format = "btrfs";
+                mountpoint = "/";
+              };
+            };
+            swap = { size = "100%"; };
+          };
+        };
+      };
+    };
+  };
+}

nixos/postgresql_server.crt

@@ -0,0 +1,67 @@
+Certificate:
+    Data:
+        Version: 1 (0x0)
+        Serial Number:
+            ef:2f:4d:d4:26:7e:33:1b
+    Signature Algorithm: sha256WithRSAEncryption
+        Issuer: CN=jefke.hyp
+        Validity
+            Not Before: Nov 22 19:12:03 2023 GMT
+            Not After : Oct 29 19:12:03 2123 GMT
+        Subject: CN=jefke.hyp
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                RSA Public-Key: (2048 bit)
+                Modulus:
+                    00:c7:ab:eb:9c:d0:7f:4f:f1:ba:65:0a:8b:07:7b:
+                    2e:5b:f0:26:82:33:c9:73:e6:91:cc:11:94:05:1c:
+                    8d:67:29:cb:5e:67:35:02:80:54:af:99:4b:aa:ce:
+                    e8:56:62:be:63:cb:b2:4a:b0:a9:28:12:e2:77:50:
+                    7d:d5:d2:3b:48:d8:32:59:25:26:ff:a6:5c:f6:eb:
+                    ae:5b:3d:7a:14:10:ba:90:9c:6f:1f:b9:d8:99:0e:
+                    b7:09:5e:62:69:c4:c0:c6:27:b0:d3:60:0d:47:4c:
+                    a5:11:53:f2:f1:4a:f9:a6:bc:d6:a3:35:a2:e8:e5:
+                    a9:d1:60:e8:e5:18:ce:d2:60:80:4e:dc:48:ae:7f:
+                    b7:ea:76:51:28:39:a4:b0:95:82:95:93:98:b2:9f:
+                    23:c9:81:69:59:a3:e4:f7:5a:1c:01:31:96:c1:4b:
+                    59:21:f8:a2:e6:9e:21:78:0e:6b:c1:68:c7:5c:16:
+                    9a:06:54:df:b6:77:1d:2d:89:d0:c8:9e:db:b5:d4:
+                    8c:fb:b9:4f:b7:6e:39:5f:39:8e:48:73:76:7d:46:
+                    6e:1f:8d:14:cb:40:b5:ff:c6:f0:c0:44:3c:ed:52:
+                    3f:4f:7b:69:63:93:c6:41:e6:5e:ed:33:50:20:46:
+                    db:93:bf:e8:52:51:95:f1:81:73:58:da:67:21:7b:
+                    12:bd
+                Exponent: 65537 (0x10001)
+    Signature Algorithm: sha256WithRSAEncryption
+         aa:5c:89:41:a6:b7:3d:65:87:ca:50:c4:f3:58:aa:d3:b4:55:
+         b1:a7:8d:18:26:17:e5:8a:21:24:a1:49:53:77:31:5b:55:63:
+         be:01:d8:fe:b7:06:7c:da:07:1f:94:6a:de:96:ad:ca:3b:20:
+         2a:e1:35:90:19:83:6d:37:d1:15:12:de:3c:0e:46:be:66:a1:
+         6a:1d:ec:72:dc:46:79:69:e4:af:77:c8:ff:cd:d6:7d:16:88:
+         ab:44:fd:70:fc:40:47:ff:43:95:11:5a:9a:56:0c:d2:dd:7c:
+         3b:87:aa:10:26:fa:25:a3:a0:43:8a:1b:ec:54:11:7e:65:67:
+         d2:06:e1:3e:3b:e1:0e:b0:80:ef:4b:35:3f:fc:34:1d:95:2e:
+         ee:c1:67:38:da:b3:74:86:4b:95:8c:0c:1d:51:28:c1:42:e9:
+         77:68:d7:ec:3b:66:30:c6:e5:2a:62:ea:15:fb:24:56:cf:02:
+         d0:25:54:a7:58:15:b5:2a:71:93:56:c0:69:7a:36:18:6c:31:
+         b1:8e:3c:77:d7:77:ac:fc:e1:94:c5:08:bb:35:ac:48:5f:6b:
+         8b:c8:c8:78:f4:a9:ca:4f:9d:51:54:89:97:c9:af:a1:fa:71:
+         df:58:f6:ff:04:7c:c8:1c:95:6b:1a:e3:a7:f6:43:1c:27:94:
+         10:03:ce:ec
+-----BEGIN CERTIFICATE-----
+MIICpjCCAY4CCQDvL03UJn4zGzANBgkqhkiG9w0BAQsFADAUMRIwEAYDVQQDDAlq
+ZWZrZS5oeXAwIBcNMjMxMTIyMTkxMjAzWhgPMjEyMzEwMjkxOTEyMDNaMBQxEjAQ
+BgNVBAMMCWplZmtlLmh5cDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB
+AMer65zQf0/xumUKiwd7LlvwJoIzyXPmkcwRlAUcjWcpy15nNQKAVK+ZS6rO6FZi
+vmPLskqwqSgS4ndQfdXSO0jYMlklJv+mXPbrrls9ehQQupCcbx+52JkOtwleYmnE
+wMYnsNNgDUdMpRFT8vFK+aa81qM1oujlqdFg6OUYztJggE7cSK5/t+p2USg5pLCV
+gpWTmLKfI8mBaVmj5PdaHAExlsFLWSH4ouaeIXgOa8Fox1wWmgZU37Z3HS2J0Mie
+27XUjPu5T7duOV85jkhzdn1Gbh+NFMtAtf/G8MBEPO1SP097aWOTxkHmXu0zUCBG
+25O/6FJRlfGBc1jaZyF7Er0CAwEAATANBgkqhkiG9w0BAQsFAAOCAQEAqlyJQaa3
+PWWHylDE81iq07RVsaeNGCYX5YohJKFJU3cxW1VjvgHY/rcGfNoHH5Rq3patyjsg
+KuE1kBmDbTfRFRLePA5Gvmahah3sctxGeWnkr3fI/83WfRaIq0T9cPxAR/9DlRFa
+mlYM0t18O4eqECb6JaOgQ4ob7FQRfmVn0gbhPjvhDrCA70s1P/w0HZUu7sFnONqz
+dIZLlYwMHVEowULpd2jX7DtmMMblKmLqFfskVs8C0CVUp1gVtSpxk1bAaXo2GGwx
+sY48d9d3rPzhlMUIuzWsSF9ri8jIePSpyk+dUVSJl8mvofpx31j2/wR8yByVaxrj
+p/ZDHCeUEAPO7A==
+-----END CERTIFICATE-----

nixos/secrets/README.md

@@ -0,0 +1,5 @@
+To create a secret:
+
+```bash
+nix run github:ryantm/agenix# -- -e secret.age
+``

nixos/secrets/lewis_user_ed25519.age

@@ -0,0 +1,9 @@
+age-encryption.org/v1
+-> ssh-ed25519 aqswPA eCaomN/OCSet7JteG5GE1xArpi+zLdVjD415HRSa1hE
+lgBm3ZCSzQlSOxLtLR6NW33TQcWgmU0nIMzZXpaTdsQ
+--- z8b1blOyH3Ne62B4YO0UcwgGorWXHtguz453oHYUEV0
+ð
+"<22>ß]ËÞókéõR•»qÑ—+Œñ‚f*Œ/Ö#	Ü¢,ÁU,5ÔЈūQ9ÍKÃÆ>‰<²%/P–@%ä#;0¼+Te
§Šñ?ó”´º "½ÎSÊð
+)bYZ†úÌ}-ëÜ™7UÞ%®:Ûë¼i
+2ßú;íTÙ1ªû¤¿‰j…¸œNóëý´Ë#sY¸ÒòÔ‘ˆ¼dêR檸þ«Š}†W?‘ÆØ ÈZ¯0ô*ïäU¯Q”drÆ
ɪ£Ûuù¦Õ]Û<>$÷E#¹=çhAð³¬
kô³ã”+Z"¡…sÉ‘_Ÿ¥5%(
˪W€1GÆ€dÒ°Îwø!W¹pÒÈ¿J2ù_.
+x%ÒŸGï«/í»'ÇPd¬åW¦I<›ÛS—î/ ³ÕϽÃ{ëc¶–òÞ3ó›“ïâÜ	¼˜5/E6`(袆(	çðÇqpJ,÷ ÜÉ?&†÷½‘.8è×m¢žúiçÓA‚¦{-`¢=§GÏ<47>3濾Jzòuºa'Õk+•™“r×™RJHÃðOìâ”ò¯a½9§ÿf•ÓÌjüäT

nixos/secrets/secrets.nix

@@ -0,0 +1,40 @@
+let
+  pkgs = import <nixpkgs> { };
+  lib = pkgs.lib;
+  secrets = {
+    jefke = {
+      publicKeys = [
+        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIJUSH2IQg8Y/CCcej7J6oe4co++6HlDo1MYDCR3gV3a pim@x260"
+      ];
+      encryptedFiles = [
+        "jefke_host_ed25519.age"
+        "jefke_user_ed25519.age"
+        "postgresql_server.key.age"
+      ];
+    };
+    atlas = {
+      publicKeys = [
+        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKZ1OGe8jLyc+72SFUnW4FOKbpqHs7Mym85ESBN4HWV7 pim@x260"
+      ];
+      encryptedFiles = [
+        "atlas_host_ed25519.age"
+        "atlas_user_ed25519.age"
+      ];
+    };
+    lewis = {
+      publicKeys = [
+        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIL5lZjsqS6C50WO8p08TY7Fg8rqQH04EkpDTxCRGtR7a pim@x260"
+      ];
+      encryptedFiles = [
+        "lewis_host_ed25519.age"
+        "lewis_user_ed25519.age"
+      ];
+    };
+  };
+in
+lib.attrsets.mergeAttrsList (builtins.map
+  ({ publicKeys, encryptedFiles }:
+  lib.attrsets.mergeAttrsList (builtins.map
+    (encryptedFile: { "${encryptedFile}" = { inherit publicKeys; }; })
+    encryptedFiles))
+  (lib.attrsets.attrValues secrets))