1e2e2bdd35
grep -- '- &' .sops.yaml | cut -d'&' -f2 | grep _host | sed 's/_host//' | xargs -n2 clan secrets machines add
for i in secrets/*.yaml; do host=$(basename $i .yaml); clan secrets import-sops $i --machine $host --user makefu --prefix ${host}-;done
for i in secrets/*.yaml; do host=$(basename $i .yaml) ;clan secrets groups add-machine common "$host";done
26 lines
771 B
Nix
26 lines
771 B
Nix
{ config, pkgs, lib, ... }:
|
|
|
|
with pkgs.stockholm.lib;
|
|
{
|
|
imports = [
|
|
<stockholm/makefu>
|
|
# <stockholm/makefu/2configs/tools/core.nix>
|
|
<nixpkgs/nixos/modules/installer/netboot/netboot-minimal.nix>
|
|
<clever_kexec/kexec/kexec.nix>
|
|
];
|
|
# cd ~/stockholm ; nix-build '<nixpkgs/nixos>' -A config.system.build.kexec_tarball -j 4 -I nixos-config=makefu/1systems/iso.nix -I secrets=/home/makefu/secrets/iso
|
|
|
|
krebs.build.host = config.krebs.hosts.iso;
|
|
krebs.hidden-ssh.enable = true;
|
|
environment.extraInit = ''
|
|
EDITOR=vim
|
|
'';
|
|
services.openssh = {
|
|
enable = true;
|
|
hostKeys = [
|
|
{ bits = 8192; type = "ed25519"; path = "/etc/ssh/ssh_host_ed25519_key"; }
|
|
];
|
|
};
|
|
systemd.services.sshd.wantedBy = lib.mkForce [ "multi-user.target" ];
|
|
}
|