fix missing arg

flake.lock

@@ -174,11 +174,11 @@
     },
     "nixUnstable": {
       "locked": {
-        "lastModified": 1776949667,
+        "lastModified": 1777548390,
-        "narHash": "sha256-GMSVw35Q+294GlrTUKlx087E31z7KurReQ1YHSKp5iw=",
+        "narHash": "sha256-WacE23EbHTsBKvr8cu+1DFNbP6Rh1brHUH5SDUI0NQI=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "01fbdeef22b76df85ea168fbfe1bfd9e63681b30",
+        "rev": "7aaa00e7cc9be6c316cb5f6617bd740dd435c59d",
         "type": "github"
       },
       "original": {
@@ -190,11 +190,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1776734388,
+        "lastModified": 1777428379,
-        "narHash": "sha256-vl3dkhlE5gzsItuHoEMVe+DlonsK+0836LIRDnm6MXQ=",
+        "narHash": "sha256-ypxFOeDz+CqADEQNL72haqGjvZQdBR5Vc7pyx2JDttI=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "10e7ad5bbcb421fe07e3a4ad53a634b0cd57ffac",
+        "rev": "755f5aa91337890c432639c60b6064bb7fe67769",
         "type": "github"
       },
       "original": {
@@ -221,11 +221,11 @@
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1776877367,
+        "lastModified": 1777268161,
-        "narHash": "sha256-EHq1/OX139R1RvBzOJ0aMRT3xnWyqtHBRUBuO1gFzjI=",
+        "narHash": "sha256-bxrdOn8SCOv8tN4JbTF/TXq7kjo9ag4M+C8yzzIRYbE=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "0726a0ecb6d4e08f6adced58726b95db924cef57",
+        "rev": "1c3fe55ad329cbcb28471bb30f05c9827f724c76",
         "type": "github"
       },
       "original": {
@@ -241,11 +241,11 @@
         "nixpkgs": "nixpkgs_2"
       },
       "locked": {
-        "lastModified": 1777162113,
+        "lastModified": 1777684559,
-        "narHash": "sha256-76X5+aK1TyKAcuSCJHBI2p51Kd81xEQ0AEl3aQNlbQU=",
+        "narHash": "sha256-0QXkkTPUnHLeMjb+FYVbCSbboVkTjeEnyPXOzb7A2Z0=",
         "owner": "nix-community",
         "repo": "nur",
-        "rev": "d6d97ae13c82041a36b4f3cff4af35b54f0e40ba",
+        "rev": "ed879a8036a7255c34ec4b17dd4db087bff8f874",
         "type": "github"
       },
       "original": {
@@ -274,11 +274,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1776771786,
+        "lastModified": 1777338324,
-        "narHash": "sha256-DRFGPfFV6hbrfO9a1PH1FkCi7qR5FgjSqsQGGvk1rdI=",
+        "narHash": "sha256-bc+ZZCmOTNq86/svGnw0tVpH7vJaLYvGLLKFYP08Q8E=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "bef289e2248991f7afeb95965c82fbcd8ff72598",
+        "rev": "8eaee5c45428b28b8c47a83e4c09dccec5f279b5",
         "type": "github"
       },
       "original": {

modules/nixos/system/network/wireguard/default.nix

@@ -1,5 +1,12 @@
-{ config, lib, pkgs, ... }: {
+{ config, lib, pkgs, ... }: let
-  imports = [ ./forwarding.nix ];
+
+  isValidPeer = p: 
+    (p ? syscfg.net.wg.enable) && 
+    (p.syscfg.net.wg.enable == true) && 
+    (p.syscfg.net.wg.pubkey != config.syscfg.net.wg.pubkey);
+  activePeers = builtins.filter isValidPeer config.syscfg.peers;
+in
+{
   config = lib.mkIf (config.syscfg.net.wg.enable) {
     networking.wireguard = {
       enable = true;
@@ -10,18 +17,13 @@
             config.sops.secrets."${config.syscfg.hostname}_wg_priv".path;
           listenPort = 1515;
           mtu = 1340;
-          postSetup = if config.syscfg.net.wg.server.enable then ''
-          for keyfile in /run/secrets/*_wg_pub; do
-            if [ -f "$keyfile" ]; then
-              ${pkgs.wireguard-tools}/bin/wg set wg0 \
-                peer "$(cat "$keyfile")" \
-                allowed-ips 10.10.1.0/24,fd10:10:10::0/64
-            fi
-          done
-          '' else '''';
           peers = 
-            if config.syscfg.net.wg.server.enable then
+            if config.syscfg.server ? wireguard then
-              []
+              map (p: {
+                name = p.syscfg.hostname;
+                publicKey = p.syscfg.net.wg.pubkey;
+                allowedIPs = [ p.syscfg.net.wg.ip4 p.syscfg.net.wg.ip6 ];
+              }) activePeers
             else
               [{
                 allowedIPs = [ "10.10.1.0/24" "fd10:10:10::0/64" ];

modules/server/arion/default.nix

@@ -0,0 +1,13 @@
+{ config, pkgs, lib, ... }:{
+  config = lib.mkIf (config.syscfg.server ? arion) {
+    environment.systemPackages = with pkgs; [ arion ];
+    virtualisation.arion = {
+      backend = "podman-socket";
+      projects = {
+        cloud.settings = import ./docker/cloud.nix { inherit config pkgs lib; };
+        authentik.settings =
+          import ./docker/authentik.nix { inherit config pkgs lib; };
+      };
+    };
+  };
+}

modules/server/default.nix

@@ -1,15 +1,3 @@
-{ config, pkgs, lib, ... }:
+{ config, pkgs, lib, ... }:{
-let
+  imports = [ ./sops ./nftables ./openssh ./arion ];
-in {
-  imports = [ ./sops ];
-  environment.systemPackages = with pkgs; [ arion ];
-  virtualisation.arion = {
-    backend = "podman-socket";
-    projects = {
-      cloud.settings = import ./docker/cloud.nix { inherit config pkgs lib; };
-      authentik.settings =
-        import ./docker/authentik.nix { inherit config pkgs lib; };
-    };
-  };
-
 }

modules/server/nftables/default.nix

@@ -1,8 +1,7 @@
 
 
-{ config, lib, pkgs, ... }:
+{ config, lib, ... }:{
-{
+  config = lib.mkIf (config.syscfg.server.nftables.enable) {
-  config = lib.mkIf (config.syscfg.net.wg.server.enable) {
     boot.kernel.sysctl = {
       "net.ipv4.ip_forward" = 1;
       "net.ipv6.conf.all.forwarding" = 1;
@@ -28,12 +27,12 @@
                 iifname "${srcInt}" tcp dport ${srcPort} counter dnat ip6 to [${dstAddr6}]:${dstPort}
                 iifname "${srcInt}" udp dport ${srcPort} counter dnat ip6 to [${dstAddr6}]:${dstPort}
             ''
-          ) config.syscfg.net.wg.server.forward}
+          ) config.syscfg.server.nftables.ports}
         }
         
         chain postrouting {
           type nat hook postrouting priority srcnat; policy accept;
-          oifname { "wg0", "ens3" } masquerade
+          oifname { ${lib.concatMapStringsSep ", " (iface: ''"${iface}"'') config.syscfg.server.nftables.ifs} } masquerade
         }
       }
     '';

modules/server/openssh/default.nix

@@ -0,0 +1,27 @@
+{ config, lib, ... }: 
+let
+  allUsers = lib.concatMap (peer: if peer.syscfg ? users then peer.syscfg.users else []) config.syscfg.peers;
+  groupedUsers = lib.groupBy (u: u.username) allUsers;
+  allowedUsernames = map (u: u.username) config.syscfg.users;
+  activeUsers = lib.filterAttrs (name: _: lib.elem name allowedUsernames) groupedUsers;
+in {
+  config = lib.mkIf (config.syscfg.server.nftables.enable) {
+    services.openssh = {
+        enable = true;
+        ports = [ 422 ];
+        banner = "";
+        settings = {
+        PasswordAuthentication = false;
+        PermitRootLogin = "no";
+        ClientAliveInterval = 60;
+        ClientAliveCountMax = 3;
+        TCPKeepAlive = true;
+        };
+    };
+    users.users = lib.mapAttrs (name: userList: {
+        openssh.authorizedKeys.keys = lib.unique (
+        lib.concatMap (u: if u ? pubssh then [ u.pubssh ] else []) userList
+        );
+    }) activeUsers;
+    };
+}

modules/server/sops/default.nix

@@ -1,20 +1,5 @@
-{ config, pkgs, ... }: {
+{ config, lib, pkgs, ... }: {
+  config = lib.mkIf (config.syscfg.server ? sops) {
     sops.secrets.INFOMANIAK_API_KEY = { sopsFile = ./server.yaml; };
-  sops.secrets."${config.syscfg.hostname}_ssh_pub" = {
-    mode = "0400";
-    owner = config.users.users.${config.syscfg.defaultUser}.name;
-    group = config.users.users.${config.syscfg.defaultUser}.group;
   };
-  sops.secrets."iriy_ssh_pub" = {
-    mode = "0444";
-    owner = config.users.users.${config.syscfg.defaultUser}.name;
-    group = config.users.users.${config.syscfg.defaultUser}.group;
-  };
-  sops.secrets."valinor_ssh_pub" = {
-    mode = "0444";
-    owner = config.users.users.${config.syscfg.defaultUser}.name;
-    group = config.users.users.${config.syscfg.defaultUser}.group;
-  };
-  sops.secrets."${config.syscfg.hostname}_wg_priv" = { };
-  sops.secrets."${config.syscfg.hostname}_wg_pub" = { };
 }

modules/shared/sops/default.nix

@@ -22,21 +22,7 @@ in {
       owner = config.users.users.${config.syscfg.defaultUser}.name;
       group = config.users.users.${config.syscfg.defaultUser}.group;
     };
-    "${config.syscfg.hostname}_ssh_pub" = {
-      mode = "0444";
-      owner = config.users.users.${config.syscfg.defaultUser}.name;
-      group = config.users.users.${config.syscfg.defaultUser}.group;
-    };
     "${config.syscfg.hostname}_wg_priv" = { };
-    "${config.syscfg.hostname}_wg_pub" = { };
   }
-  (lib.genAttrs 
-    (map (peer: "${peer}_wg_pub") config.syscfg.net.wg.server.peers)
-    (_: { mode = "0444"; })
-  )
-  (lib.genAttrs 
-    (map (peer: "${peer}_ssh_pub") ["iriy" "avalon" "valinor"])
-    (_: { mode = "0444"; })
-  )
 ];
 }

modules/shared/syscfg/default.nix

@@ -1,7 +1,13 @@
 { inputs, lib, ... }:
 let
+  systemsDir = ../../../systems;
+  systemNames = lib.attrNames (lib.filterAttrs 
+    (name: type: type == "directory" && builtins.pathExists (systemsDir + "/${name}/cfg.nix")) 
+    (builtins.readDir systemsDir));
+
   userOpt = with lib; {
     username = mkOption { type = types.str; };
+    pubssh = mkOption { type = types.str; default=""; };
     wm = mkOption {
       type = types.enum [ "Wayland" "X11" "-" ];
       default = "-";
@@ -42,25 +48,9 @@ let
         type = types.str;
         default = "";
       };
-      server = {
+      pubkey = mkOption {
-        enable = mkOption {
+        type = types.str;
-          type = types.bool;
+        default = "";
-          default = false;
-        };
-        peers = mkOption {
-          type = types.listOf types.str;
-          default = [];
-        };
-        forward = mkOption {
-          type = types.listOf (types.listOf (types.oneOf [ types.str types.int ]));
-          default = [];
-          description = "Forwarding rules: [ [srcInterface dstAddr srcPort dstPort] ... ]";
-          example = [
-            [ "ens3" "10.10.1.2" "IPV6" 22 2222 ]
-            [ "ens3" "10.10.1.2" "IPV6" 80 80 ]
-            [ "ens3" "10.10.1.2" "IPV6" 443 443 ]
-          ];
-        };
       };
     };
   };
@@ -104,7 +94,6 @@ let
       type = types.str;
       default = "3306";
     };
-
     configPath = mkOption {
       type = types.str;
       default = "/media/config";
@@ -113,6 +102,42 @@ let
       type = types.str;
       default = "/media/data";
     };
+    arion = mkOption {
+      type = type.bool;
+      default = false;
+    };
+    sops = mkOption {
+      type = type.bool;
+      default = false;
+    };
+    openssh = mkOption {
+      type = type.bool;
+      default = false;
+    };
+    wireguard = mkOption {
+      type = type.bool;
+      default = false;
+    };
+    nftables = {
+      enable = mkOption {
+        type = type.bool;
+        default = false;
+      };
+      ifs = mkOption {
+        type = types.listOf types.str;
+        default = [ ];
+      };
+      ports = mkOption {
+        type = types.listOf (types.listOf (types.oneOf [ types.str types.int ]));
+        default = [];
+        description = "Forwarding rules: [ [srcInterface dstAddr srcPort dstPort] ... ]";
+        example = [
+          [ "ens3" "10.10.1.2" "IPV6" 22 2222 ]
+          [ "ens3" "10.10.1.2" "IPV6" 80 80 ]
+          [ "ens3" "10.10.1.2" "IPV6" 443 443 ]
+        ];
+      };
+    };
 
   };
 in with lib; {
@@ -134,6 +159,9 @@ in with lib; {
       type = types.listOf (types.submodule { options = userOpt; });
       default = [ ];
     };
+    peers = mkOption {
+      default = map (name: import (systemsDir + "/${name}/cfg.nix")) systemNames;
+    };
     server = mkOption {
       type = types.oneOf [
         (types.attrs)

systems/avalon/cfg.nix

@@ -26,10 +26,13 @@
       cli = true;
       virt = true;
     };
+    net = {
       wg = {
         enable = true;
         ip4 = "10.10.1.2/32";
         ip6 = "fd10:10:10::2/128";
+        pubkey = "QlvpTiK6s/lIha9vKmo+teSy2Nw52qWLYatYjxVan3U=";
+      };
     };
   };
 }

systems/gateway/cfg.nix

@@ -6,6 +6,7 @@
     defaultUser = "sora";
     users = [{
       username = "sora";
+      pubssh = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINrrUB0KBjeAKPVG2Bdcm4mI9AMab7y97SOCdEHGogYv sora@gateway";
       wm = "-";
       git = {
         email = "soraefir+git@helcel";
@@ -22,11 +23,17 @@
         enable = true;
         ip4 = "10.10.1.1/32";
         ip6 = "fd10:10:10::1/128";
+        pubkey = "NFBJvYXZC+bd62jhrKnM7/pugidWhgR6+C5qIiUiq3Q=";
+      };
+    };
     server = {
+      openssh = true;
+      wireguard = true;
+      nftables = {
         enable = true;
-            peers = ["avalon" "iriy" "valinor"];
+        ifs = ["ens3" "wg0" ];
-            forward = [
+        ports = [
-                [ "ens3" "10.10.1.2" "fd10:10:10::2" 2222 2222 ]      # SSH
+                [ "ens3" "10.10.1.2" "fd10:10:10::2" 22 2222 ]      # SSH/GIT
                 [ "ens3" "10.10.1.2" "fd10:10:10::2" 80 80 ]        # HTTP
                 [ "ens3" "10.10.1.2" "fd10:10:10::2" 443 443 ]      # HTTPS
                 [ "ens3" "10.10.1.2" "fd10:10:10::2" 3979 3979 ]    # OTTD
@@ -34,5 +41,4 @@
       };
     };
   };
-  };
 }

systems/gateway/default.nix

@@ -1,13 +1,14 @@
-{ config, inputs, ... }: {
+{ config, lib, inputs, ... }: {
-  imports = [ ./hardware.nix ];
+  imports = [ ./hardware.nix ../../modules/server ];
 
-  services.openssh.enable = true;
+  system.autoUpgrade = {
-  services.openssh.authorizedKeysFiles = [
+    enable = true;
-    config.sops.secrets."iriy_ssh_pub".path
+    flake = "git+https://git.helcel.net/sora/nixconfig"; 
-    config.sops.secrets."valinor_ssh_pub".path
+    flags = [
-  ];
+      "--no-write-lock-file"
-  users.users.root.openssh.authorizedKeys.keys = [
-    "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC0GpKd62XMlO410/iYkNG8MHdGGaeMG3Gmsf3Pv3u2BllUzR9Dpym1ZOz2lwo3iK0FimcQpOiJqSIahO59HJl8jQ9BoQrJMXH7l2kuq1T09cMNWGjlzowg0LWKWOzoBzOwcheyW68OJGgkSfvk9BdshkUYTLVBXjiI9jo/8Qkcv1WLJJvJmDBDwnbYDQpODXCEDQ/t3YVubb+ocLmh40sDUffJLWZQXN6OFW9N5XxnvY7K5x9ci9GU4Reei40K8yDw2Hgi0njzijRdzie3MJlKPPawJ2TATu9LsGuxfx8bJXVx+mNxP0lhO8dOOhP7p0ozTxlJJY9ZWaKgOz3SzYNCgJ1gH7NtTBtSruXd6pfmErUmuJEAeMD6+QF3yJ5tnVFNPoSHqjP+oL3CgSRpmuvn7ChSSI3J3UVhLux165VtwIL7UhosO2mCqmn0Yk2mSBkB/L4ZiWFmO3vYdagYNQX7xZHzCJ5my8vomiT+DUGb2h/o1NetKwIZJiFAuHxKt3k= sora@valinor"
     ];
+    dates = "04:00";
+    randomizedDelaySec = "30min";
+    allowReboot = false;
+  };
 }
-

systems/gateway/hardware.nix

@@ -1,17 +1,26 @@
 { config, lib, pkgs, modulesPath, ... }: {
+  imports = [ (modulesPath + "/profiles/qemu-guest.nix" ) ];
+
   boot.kernelPackages = pkgs.linuxPackages_latest;
   nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
-  boot.loader.grub.device = "/dev/sda";
+
+  boot.loader.systemd-boot.enable = lib.mkForce false;
+  boot.loader.grub = {
+    enable = true;
+    device = "/dev/sda";
+    efiSupport = true;
+  };
+
   boot.initrd.availableKernelModules =
     [ "ata_piix" "uhci_hcd" "xen_blkfront" "vmw_pvscsi" ];
   boot.initrd.kernelModules = [ "nvme" ];
 
   fileSystems."/" = {
-    device = "/dev/sda3";
+    device = "/dev/disk/by-uuid/25df457a-21d0-41ab-9de5-88ffc00e3469";
     fsType = "btrfs";
   };
   fileSystems."/boot" = {
-    device = "/dev/sda2";
+    device = "/dev/disk/by-uuid/F24E-74FA";
     fsType = "vfat";
     options = [ "defaults" ];
   };

systems/iriy/cfg.nix

@@ -6,6 +6,7 @@
     defaultUser = "sora";
     users = [{
       username = "sora";
+      pubssh = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDGtotfQkclilrhEOzY3QUpOwYF+eOjHvqN6Of3NVg4x8NQLjx/X/gxC+GAllQxy9Zkz/N5wY0Fa4/6HoGheCRvWaN/nofz95VgtX8a1A/flrT8CGdBfRqXlcd4OEXhpFcbEm9VRXmxSKnsD4zySZr/151S+1PlQr8pJ1yyzxsIQx+RNo9P4gzpoJgkfZ3JIqLWb6B4aXallAg9Ha1WX0lx24voWNgg9AQt6/lccfmeoWAzBGUNq5a/mH59O+UCIM2y19ksEweY6URHpk6Ss597zp+0j2NYg8MS4rToYUb0Y7giNNBdKAzqNd+Wp6gjqBthuDIOfsXM082O5IarPKPJNVbx/Xpf3m1hYtxfL+LhEkdoE94iue601WqTltC0btS63LeZuoAZYji/GG/D8U7V77Lh3MV5/hJm5sK6wM6r7fCoenehgiy49z00NqtgM33rWNrpL9eXNKb//5Lxe7U58jPyteWpsL8+fJFcs/2uh4D5zN3d/I+yLZ1OMgUN6LM= sora@iriy";
       wm = "Wayland";
       git = {
         email = "soraefir+git@helcel";
@@ -30,6 +31,7 @@
         enable = true;
         ip4 = "10.10.1.7/32";
         ip6 = "fd10:10:10::7/128";
+        pubkey = "6d1bINFmH12ACAJLDOwfFIZgmNHV/FGGk0YJyDP50HQ=";
       };
     };
   };

systems/sandbox/default.nix

@@ -2,10 +2,6 @@
   imports = [ ./hardware.nix ../../modules/server ];
 
   services.openssh.enable = true;
-  services.openssh.authorizedKeysFiles = [
-    config.sops.secrets."iriy_ssh_pub".path
-    config.sops.secrets."valinor_ssh_pub".path
-  ];
   users.users.root.openssh.authorizedKeys.keys = [
     "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC0GpKd62XMlO410/iYkNG8MHdGGaeMG3Gmsf3Pv3u2BllUzR9Dpym1ZOz2lwo3iK0FimcQpOiJqSIahO59HJl8jQ9BoQrJMXH7l2kuq1T09cMNWGjlzowg0LWKWOzoBzOwcheyW68OJGgkSfvk9BdshkUYTLVBXjiI9jo/8Qkcv1WLJJvJmDBDwnbYDQpODXCEDQ/t3YVubb+ocLmh40sDUffJLWZQXN6OFW9N5XxnvY7K5x9ci9GU4Reei40K8yDw2Hgi0njzijRdzie3MJlKPPawJ2TATu9LsGuxfx8bJXVx+mNxP0lhO8dOOhP7p0ozTxlJJY9ZWaKgOz3SzYNCgJ1gH7NtTBtSruXd6pfmErUmuJEAeMD6+QF3yJ5tnVFNPoSHqjP+oL3CgSRpmuvn7ChSSI3J3UVhLux165VtwIL7UhosO2mCqmn0Yk2mSBkB/L4ZiWFmO3vYdagYNQX7xZHzCJ5my8vomiT+DUGb2h/o1NetKwIZJiFAuHxKt3k= sora@valinor"
   ];

systems/valinor/cfg.nix

@@ -6,6 +6,7 @@
     defaultUser = "sora";
     users = [{
       username = "sora";
+      pubssh = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDCZibVYTvS4Dd+ZhGCpRpKfxs1fQeepNTzfzYk9I12Hyez25pQCeH+6ArrVhf6yX5Na1ffkvqTrNIDYJ1V2GHhemX0ruYp2B3xt229JszI7DeRC7YeG7v5uvsfTgicADCstGPSNorKXuNnHuBebSHpmWWbuKrYZdmcA/Az7H8uwF5+VQrnyASgZgwGV94MHinFVWsisB7o6iq4qxqpsUdtuZGbU0stDE5f9DLMDYuUxtx+jASRt+X60Bzjv3OFjU/b/YYzojTtuujkYXunNNTceCB4DTue5YMKQOlmd/IezL5nPAK9IsonPqojX9LPk2RvTCr4qalQ6AD92nq+xMW6FY1uJaKT81S8TvZcaqTm4FhEDkChuFq77biSUDhQkpcdNVOjUn5OtKpYl+0VkCaAx/8uyoylBacrn1XXLLg+gjwGCFHa2eeNu/BKIUa+5EK/FRwLpnEoPDkAHQ95JXQewChcUKG8A+Bz29XRKr9J64kbbGmwa+yjlVTPLSE6ZZE= sora@valinor";
       wm = "Wayland";
       git = {
         email = "soraefir+git@helcel";
@@ -31,6 +32,7 @@
         enable = true;
         ip4 = "10.10.1.5/32";
         ip6 = "fd10:10:10::5/128";
+        pubkey = "EUYd/dMdGcbxiWJXHhQhCXV00cr87pxiW1HExwCTGg0=";
       };
     };
   };