Compare commits
2
Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 Emma Thorpe
|
ea3e75e0af | ||
|
Emma Thorpe
|
10cc6cceed |
@@ -8,6 +8,12 @@ indent_size = 2
|
||||
trim_trailing_whitespace = true
|
||||
insert_final_newline = true
|
||||
|
||||
[*.{nix,yaml,yml,json,md,sh,toml}]
|
||||
indent_style = space
|
||||
indent_size = 2
|
||||
trim_trailing_whitespace = true
|
||||
insert_final_newline = true
|
||||
|
||||
# Markdown uses trailing whitespace for hard line breaks.
|
||||
[*.md]
|
||||
trim_trailing_whitespace = false
|
||||
|
||||
@@ -2,6 +2,3 @@ modules/firmware/*
|
||||
|
||||
# vim swap files
|
||||
*.swp
|
||||
|
||||
# Local scratch project, not part of this flake.
|
||||
tf-inspect/
|
||||
|
||||
@@ -52,33 +52,6 @@ The home config is also exposed for use beyond these hosts:
|
||||
(`inputs.<this>.homeModules.default`). Consumers must supply the module args
|
||||
these expect: `inputs` always, `identity` for git/desktop, `portable` for sway.
|
||||
|
||||
## Directory authentication (SSSD → Authentik LDAP)
|
||||
|
||||
Every NixOS host authenticates users against the Authentik LDAP outpost via
|
||||
SSSD, implemented in [`modules/sssd.nix`](./modules/sssd.nix) and enabled by
|
||||
default through the `services.authentikLdap.enable` option (added to
|
||||
`baseModules`). The **EDaaS** WSL box opts out
|
||||
(`services.authentikLdap.enable = false`) as a work-managed environment; the
|
||||
macOS host is unaffected (SSSD is Linux-only).
|
||||
|
||||
- Connects over LDAPS to `ldap.lyrapup.pet:636`, search base
|
||||
`dc=ldap,dc=goauthentik,dc=io`, binding as
|
||||
`cn=sssd-bind,ou=users,dc=ldap,dc=goauthentik,dc=io`.
|
||||
- The schema mappings match Authentik's non-standard object classes
|
||||
(`goauthentik.io/ldap/user`, `goauthentik.io/ldap/group`) over the POSIX
|
||||
attributes (`uid`, `uidNumber`, `gidNumber`, `homeDirectory`).
|
||||
- Home directories are created on first login (`pam_mkhomedir`).
|
||||
|
||||
### Secrets (agenix)
|
||||
|
||||
The LDAP bind credential is an [agenix](https://github.com/ryantm/agenix)
|
||||
secret, decrypted at activation with each host's SSH host key. The decrypted
|
||||
plaintext is a full `sssd.conf` drop-in delivered to
|
||||
`/etc/sssd/conf.d/01-ldap-authtok.conf`, so the password never enters the Nix
|
||||
store. Owner setup (host recipient keys, encrypting the bind password, DNS for
|
||||
`ldap.lyrapup.pet`, rebuild) is documented in
|
||||
[`secrets/README.md`](./secrets/README.md).
|
||||
|
||||
## Applying
|
||||
|
||||
```sh
|
||||
|
||||
Generated
-17
@@ -191,22 +191,6 @@
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"kube-tmux": {
|
||||
"flake": false,
|
||||
"locked": {
|
||||
"lastModified": 1779714285,
|
||||
"narHash": "sha256-l1wjg2ReWKCI7h/K11vvX2ykYTs/mVD+tfz/mQsjn/E=",
|
||||
"owner": "jonmosco",
|
||||
"repo": "kube-tmux",
|
||||
"rev": "8b7e1d127c16b6dc87ff5743f4d775b245198b69",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "jonmosco",
|
||||
"repo": "kube-tmux",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"nix-darwin": {
|
||||
"inputs": {
|
||||
"nixpkgs": [
|
||||
@@ -389,7 +373,6 @@
|
||||
"flake-parts": "flake-parts",
|
||||
"git-hooks": "git-hooks",
|
||||
"home-manager": "home-manager",
|
||||
"kube-tmux": "kube-tmux",
|
||||
"nix-darwin": "nix-darwin",
|
||||
"nix-homebrew": "nix-homebrew",
|
||||
"nix-index-database": "nix-index-database",
|
||||
|
||||
@@ -46,15 +46,6 @@
|
||||
url = "github:cachix/git-hooks.nix";
|
||||
inputs.nixpkgs.follows = "nixpkgs";
|
||||
};
|
||||
# agenix: age-encrypted secrets, decrypted at activation with each host's
|
||||
# SSH host key. Provides the SSSD LDAP bind credential (secrets/, see
|
||||
# modules/sssd.nix). The darwin module is intentionally unused (SSSD is
|
||||
# Linux-only).
|
||||
agenix = {
|
||||
url = "github:ryantm/agenix";
|
||||
inputs.nixpkgs.follows = "nixpkgs";
|
||||
inputs.home-manager.follows = "home-manager";
|
||||
};
|
||||
# Declarative Neovim (the editor; see home/editor.nix). Release
|
||||
# branch matched to the pinned nixpkgs (26.05); follows our nixpkgs to keep a
|
||||
# single nixpkgs in the closure. editor.nix sets programs.nixvim.nixpkgs.source
|
||||
@@ -69,13 +60,6 @@
|
||||
url = "github:NixOS/nixos-hardware";
|
||||
inputs.nixpkgs.follows = "nixpkgs";
|
||||
};
|
||||
# kube-tmux: kube context/namespace for the tmux status line on the work
|
||||
# host. Not in nixpkgs and not a flake -- pinned here as a plain source so
|
||||
# the script is always in the store (no manual checkout). See work.nix.
|
||||
kube-tmux = {
|
||||
url = "github:jonmosco/kube-tmux";
|
||||
flake = false;
|
||||
};
|
||||
};
|
||||
|
||||
outputs =
|
||||
@@ -109,9 +93,14 @@
|
||||
# Unfree packages permitted to be built (replaces blanket allowUnfree).
|
||||
unfreePackages = [
|
||||
"claude-code"
|
||||
"lens"
|
||||
"lens-desktop"
|
||||
];
|
||||
|
||||
# Per-user identity, keyed by username. See README "Users".
|
||||
# Identity registry: who each user is (name, email, keys, groups), keyed
|
||||
# by username. Threaded into the system layer as the `userRegistry`
|
||||
# specialArg and into each user's home config as the `identity` module
|
||||
# arg. See users/registry.nix, modules/users.nix, home/git.nix.
|
||||
userRegistry = import ./users/registry.nix;
|
||||
|
||||
# nixpkgs + nix-daemon settings shared by NixOS and Darwin hosts.
|
||||
@@ -132,9 +121,7 @@
|
||||
./modules/users.nix
|
||||
./modules/common-nixos.nix
|
||||
./modules/features.nix
|
||||
./modules/sssd.nix
|
||||
commonModule
|
||||
inputs.agenix.nixosModules.default
|
||||
home-manager.nixosModules.home-manager
|
||||
{
|
||||
home-manager.useGlobalPkgs = true;
|
||||
@@ -145,8 +132,14 @@
|
||||
}
|
||||
];
|
||||
|
||||
# Build one NixOS host. `users` is an attrset keyed by username (home
|
||||
# modules + optional per-user system bits). See README "Users".
|
||||
# mkHost :: { system, modules, users, portable } -> nixosSystem
|
||||
# Builds one machine by appending its host-specific modules to the shared
|
||||
# baseModules. `users` is an attrset keyed by username; each value carries
|
||||
# that user's home-module list and optional per-host-user system bits
|
||||
# (e.g. linger). Per-user identity is injected into each home config via
|
||||
# the `identity` module arg (extraSpecialArgs is per-host, so it cannot
|
||||
# carry per-user data); the system layer reads the global `userRegistry`
|
||||
# restricted to this host's `hostUsers` set.
|
||||
mkHost =
|
||||
{
|
||||
system,
|
||||
@@ -197,8 +190,11 @@
|
||||
}
|
||||
];
|
||||
|
||||
# Darwin counterpart of mkHost: single-user (macOS owns the account),
|
||||
# identity still from the registry. See README "Users".
|
||||
# mkDarwinHost :: { system, username, modules, homeModules } -> darwinSystem
|
||||
# Darwin counterpart of mkHost. macOS already owns the login user, so we
|
||||
# only attach the platform and home-manager; no NixOS user module here.
|
||||
# Stays single-user (macOS owns the account); identity is still sourced
|
||||
# from the registry so the shared home modules behave as on NixOS.
|
||||
mkDarwinHost =
|
||||
{
|
||||
system,
|
||||
@@ -227,8 +223,12 @@
|
||||
];
|
||||
};
|
||||
|
||||
# Host table — one entry per machine, realised into a nixosConfiguration
|
||||
# of the same name below. See README "Hosts" / "Users".
|
||||
# Host table — declarative registry of every machine. To add a host:
|
||||
# give it a name, its `system`, its `users` set (each user's home-module
|
||||
# list, plus optional per-host-user bits like linger), and the system
|
||||
# `modules`. mapAttrs below turns each entry into a nixosConfiguration of
|
||||
# the same name. Per-user home configs compose ./home (the shared bundle)
|
||||
# with any per-user modules (e.g. ./users/emmathorpe/work.nix).
|
||||
hosts = {
|
||||
lyrathorpe-mbp = {
|
||||
system = "aarch64-linux";
|
||||
@@ -240,7 +240,6 @@
|
||||
];
|
||||
users.lyrathorpe.homeModules = [
|
||||
./home
|
||||
./users/lyrathorpe/home.nix
|
||||
./home/desktop.nix
|
||||
];
|
||||
};
|
||||
@@ -262,7 +261,6 @@
|
||||
];
|
||||
users.lyrathorpe.homeModules = [
|
||||
./home
|
||||
./users/lyrathorpe/home.nix
|
||||
./home/desktop.nix
|
||||
];
|
||||
};
|
||||
@@ -280,7 +278,6 @@
|
||||
];
|
||||
users.lyrathorpe.homeModules = [
|
||||
./home
|
||||
./users/lyrathorpe/home.nix
|
||||
./home/desktop.nix
|
||||
];
|
||||
};
|
||||
@@ -314,10 +311,7 @@
|
||||
inputs.nixos-hardware.nixosModules.raspberry-pi-5
|
||||
./modules/ssh.nix
|
||||
];
|
||||
users.lyrathorpe.homeModules = [
|
||||
./home
|
||||
./users/lyrathorpe/home.nix
|
||||
];
|
||||
users.lyrathorpe.homeModules = [ ./home ];
|
||||
};
|
||||
};
|
||||
|
||||
@@ -333,7 +327,6 @@
|
||||
];
|
||||
homeModules = [
|
||||
./home
|
||||
./users/lyrathorpe/home.nix
|
||||
];
|
||||
};
|
||||
};
|
||||
@@ -425,8 +418,14 @@
|
||||
flake.nixosConfigurations = lib.mapAttrs (_name: mkHost) hosts;
|
||||
flake.darwinConfigurations = lib.mapAttrs (_name: mkDarwinHost) darwinHosts;
|
||||
|
||||
# Reusable home modules, exported for use off these hosts. See README
|
||||
# "Portable home" for the consumer module-arg expectations.
|
||||
# Reusable home modules, exported so this config can be consumed off these
|
||||
# hosts -- by a standalone home-manager on a non-NixOS machine, or as an
|
||||
# input to someone else's flake. `default` is the portable bundle
|
||||
# (shell + git + editor + claude). Consumers must supply the module args
|
||||
# these expect: `inputs` always; `identity` (see users/registry.nix) for
|
||||
# git/desktop; `portable` for sway. `desktop`/`sway` additionally require
|
||||
# a NixOS host that provides the Sway/Firefox binary -- they are not
|
||||
# standalone-portable.
|
||||
flake.homeModules = {
|
||||
default = ./home;
|
||||
shell = ./home/shell.nix;
|
||||
@@ -437,8 +436,13 @@
|
||||
sway = ./home/sway.nix;
|
||||
};
|
||||
|
||||
# Standalone home-manager configs (portable bundle) for machines not
|
||||
# managed by this flake. See README "Portable home".
|
||||
# Standalone home-manager configurations: the portable bundle built for a
|
||||
# machine NOT managed by this flake (`home-manager switch --flake
|
||||
# .#"<user>@<system>"`). Only the portable subset is exposed; the desktop
|
||||
# suite stays NixOS-only. homeConfigurations are not per-system, so the
|
||||
# system is encoded in the attribute name, and home.username/homeDirectory
|
||||
# are set explicitly (the NixOS module sets them automatically; standalone
|
||||
# does not).
|
||||
flake.homeConfigurations =
|
||||
let
|
||||
mkHome =
|
||||
|
||||
+17
-17
@@ -110,23 +110,23 @@ declaratively with **nixvim**, so the same plugins and config are baked in on
|
||||
every host. Migrated from plain vim; the practical gain is a real LSP stack in
|
||||
place of the old (inert) ALE.
|
||||
|
||||
| Feature | Notes |
|
||||
| -------------- | ----------------------------------------------------------------------------------------- |
|
||||
| Colorscheme | Catppuccin Mocha (matches the terminal and the rest of the desktop) |
|
||||
| File tree | nvim-tree, toggled with `,,` (comma twice; was nerdtree) |
|
||||
| Fuzzy finder | telescope (+fzf-native): `<leader>ff` files, `<leader>fg` grep, `<leader>fb` buffers |
|
||||
| Format on save | conform-nvim (nixfmt, stylua, ruff, shfmt, prettier, gofumpt; LSP fallback otherwise) |
|
||||
| Git | fugitive (`:Git …`) + gitsigns gutter signs/blame |
|
||||
| Diagnostics | inline + trouble list (`<leader>xx`) |
|
||||
| Completion | nvim-cmp (LSP/buffer/path) with luasnip snippet expansion |
|
||||
| Indent guides | indent-blankline, on by default (was vim-indent-guides) |
|
||||
| Statusline | lualine (Catppuccin theme) |
|
||||
| Editing | which-key hints, comment (`gc`/`gcc`), autopairs, treesitter textobjects |
|
||||
| Pane nav | vim-tmux-navigator — `Ctrl`+`h/j/k/l` moves across vim splits and tmux panes |
|
||||
| Syntax | tree-sitter (nix, lua, bash, markdown, groovy, c#, python, terraform, yaml) |
|
||||
| LSP | nvim-cmp completion + servers `nil_ls` (Nix), `lua_ls`, `pyright` (Python), `terraformls` |
|
||||
| Indentation | 2-wide hard tabs (`noexpandtab`, `tabstop`/`shiftwidth` = 2); line numbers on |
|
||||
| Filetypes | `*Jenkinsfile` → groovy |
|
||||
| Feature | Notes |
|
||||
| -------------- | -------------------------------------------------------------------------------------- |
|
||||
| Colorscheme | Catppuccin Mocha (matches the terminal and the rest of the desktop) |
|
||||
| File tree | nvim-tree, toggled with `,,` (comma twice; was nerdtree) |
|
||||
| Fuzzy finder | telescope (+fzf-native): `<leader>ff` files, `<leader>fg` grep, `<leader>fb` buffers |
|
||||
| Format on save | conform-nvim (nixfmt, stylua, ruff, shfmt, prettier, gofumpt; LSP fallback otherwise) |
|
||||
| Git | fugitive (`:Git …`) + gitsigns gutter signs/blame |
|
||||
| Diagnostics | inline + trouble list (`<leader>xx`) |
|
||||
| Completion | nvim-cmp (LSP/buffer/path) with luasnip snippet expansion |
|
||||
| Indent guides | indent-blankline, on by default (was vim-indent-guides) |
|
||||
| Statusline | lualine (Catppuccin theme) |
|
||||
| Editing | which-key hints, comment (`gc`/`gcc`), autopairs, treesitter textobjects |
|
||||
| Pane nav | vim-tmux-navigator — `Ctrl`+`h/j/k/l` moves across vim splits and tmux panes |
|
||||
| Syntax | tree-sitter (nix, lua, bash, markdown, groovy, c#, python, terraform, yaml) |
|
||||
| LSP | nvim-cmp completion + servers `nil` (Nix), `lua_ls`, `pyright` (Python), `terraformls` |
|
||||
| Indentation | 2-wide hard tabs (`noexpandtab`, `tabstop`/`shiftwidth` = 2); line numbers on |
|
||||
| Filetypes | `*Jenkinsfile` → groovy |
|
||||
|
||||
Leader is `Space`. LSP keymaps (`gd`, `gr`, `K`, `<leader>rn`, `<leader>ca`) and
|
||||
the file-tree toggle are listed in
|
||||
|
||||
+8
-5
@@ -1,5 +1,6 @@
|
||||
# Version control: git + delta + commitizen + lazygit. Committer identity comes
|
||||
# from the per-user `identity` arg (the registry). See README "Users".
|
||||
# Version control: git + delta pager + commitizen + lazygit. The committer
|
||||
# identity (name, email, signing key) comes from the per-user `identity` arg,
|
||||
# derived from the registry (users/registry.nix) by mkHost.
|
||||
{
|
||||
pkgs,
|
||||
lib,
|
||||
@@ -19,7 +20,8 @@ in
|
||||
package = pkgs.gitFull;
|
||||
settings = {
|
||||
user.name = identity.fullName;
|
||||
# mkDefault so a host-specific module can still override it.
|
||||
# Identity from the registry. mkDefault so a host-specific module can still
|
||||
# override it without conflicting.
|
||||
user.email = lib.mkDefault identity.email;
|
||||
push.autoSetupRemote = true;
|
||||
init.defaultBranch = "main";
|
||||
@@ -76,8 +78,9 @@ in
|
||||
cc = "!cz commit";
|
||||
};
|
||||
|
||||
# SSH signing, key from the registry. mkDefault so a host lacking the key
|
||||
# in its agent can set gpgsign = false instead of failing every commit.
|
||||
# SSH commit signing, key from the registry. mkDefault on the key and on
|
||||
# gpgsign so a host without that key in its ssh-agent can override gpgsign
|
||||
# to false rather than fail every commit.
|
||||
gpg.format = "ssh";
|
||||
user.signingkey = lib.mkDefault identity.signingKey;
|
||||
commit.gpgsign = lib.mkDefault true;
|
||||
|
||||
@@ -341,6 +341,9 @@ in
|
||||
IdentityFile = "~/.ssh/code.emmathe.dev";
|
||||
IdentitiesOnly = true;
|
||||
};
|
||||
"dockerpi.inf.cbg.emmaisvery.gay" = {
|
||||
User = "emmathorpe";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
|
||||
+4
-3
@@ -334,12 +334,13 @@ in
|
||||
];
|
||||
};
|
||||
|
||||
# Night light. Manual location (no geoclue dependency); warmer at night,
|
||||
# neutral by day. Coordinates come from the per-user module (e.g.
|
||||
# users/lyrathorpe/home.nix), not this shared module.
|
||||
# Night light. Manual location (no geoclue dependency); adjust the coordinates
|
||||
# to taste. Warmer at night, neutral by day.
|
||||
services.gammastep = {
|
||||
enable = true;
|
||||
provider = "manual";
|
||||
latitude = 51.5;
|
||||
longitude = -0.13; # London-ish; set to your actual location
|
||||
temperature = {
|
||||
day = 6500;
|
||||
night = 3700;
|
||||
|
||||
@@ -62,11 +62,6 @@
|
||||
|
||||
features.swayDesktop.enable = false;
|
||||
|
||||
# Opt out of fleet-wide SSSD/Authentik LDAP auth: this is a work-managed WSL
|
||||
# box, not part of the personal directory. Every other NixOS host inherits the
|
||||
# default-true from modules/sssd.nix.
|
||||
services.authentikLdap.enable = false;
|
||||
|
||||
# NOTE: this user's systemd --user lingering -- so the home-manager renovate
|
||||
# timer fires without an open login session -- is enabled from the host table
|
||||
# in flake.nix (users.emmathorpe.linger = true) and applied by
|
||||
|
||||
@@ -26,8 +26,10 @@
|
||||
# workstation.nix is the backstop).
|
||||
zramSwap.enable = true;
|
||||
|
||||
# sshd (daemon, port 22, key-only policy) comes from ../../modules/ssh.nix;
|
||||
# the firewall itself is enabled in workstation.nix with a default-deny policy.
|
||||
# This host accepts SSH, so open 22 (the firewall itself is enabled in
|
||||
# workstation.nix with a default-deny policy).
|
||||
services.openssh.enable = true;
|
||||
networking.firewall.allowedTCPPorts = [ 22 ];
|
||||
|
||||
# Dual Harpertown Xeon microcode. Redistributable firmware (GPU/NIC blobs) is
|
||||
# enabled in workstation.nix.
|
||||
|
||||
@@ -25,12 +25,15 @@
|
||||
boot.loader.grub.enable = false;
|
||||
boot.loader.generic-extlinux-compatible.enable = true;
|
||||
|
||||
# Remote administration: the daemon, port 22 and key-only policy all come from
|
||||
# ../../modules/ssh.nix.
|
||||
# Remote administration. Key-only policy and the authorized key come from
|
||||
# ../../modules/ssh.nix; here we just enable the daemon and open the port.
|
||||
services.openssh.enable = true;
|
||||
|
||||
# Default-deny inbound; the Docker and nginx submodules open their own ports
|
||||
# (Docker via a source-restricted nftables rule, nginx via 80/443).
|
||||
# Default-deny inbound. Open only SSH here; the Docker and nginx submodules
|
||||
# open their own ports (Docker via a source-restricted nftables rule, nginx
|
||||
# via 80/443). List-valued, so these merge with the submodule definitions.
|
||||
networking.firewall.enable = true;
|
||||
networking.firewall.allowedTCPPorts = [ 22 ];
|
||||
|
||||
# See `man configuration.nix` / the stateVersion docs before changing.
|
||||
system.stateVersion = "26.05";
|
||||
|
||||
@@ -8,10 +8,6 @@
|
||||
# secure upgrade path is mutual TLS on 2376 (--tlsverify with client certs);
|
||||
# that needs out-of-band cert provisioning and is intentionally not wired here.
|
||||
{ ... }:
|
||||
let
|
||||
# LAN allowed to reach the unauthenticated Docker TCP socket (see SECURITY above).
|
||||
trustedSubnet = "10.187.1.0/24";
|
||||
in
|
||||
{
|
||||
virtualisation.docker.enable = true;
|
||||
|
||||
@@ -33,6 +29,6 @@ in
|
||||
# CIDR to match the LAN that should reach the Docker API.
|
||||
networking.nftables.enable = true;
|
||||
networking.firewall.extraInputRules = ''
|
||||
ip saddr ${trustedSubnet} tcp dport 2375 accept
|
||||
ip saddr 10.187.1.0/24 tcp dport 2375 accept
|
||||
'';
|
||||
}
|
||||
|
||||
@@ -21,8 +21,10 @@
|
||||
# Low-RAM host (4 GiB max): a compressed RAM swap reduces disk paging.
|
||||
zramSwap.enable = true;
|
||||
|
||||
# sshd (daemon, port 22, key-only policy) comes from ../../modules/ssh.nix;
|
||||
# the firewall itself is enabled in laptop.nix with a default-deny policy.
|
||||
# This host accepts SSH, so open 22 (the firewall itself is enabled in
|
||||
# laptop.nix with a default-deny policy).
|
||||
services.openssh.enable = true;
|
||||
networking.firewall.allowedTCPPorts = [ 22 ];
|
||||
|
||||
# Intel Core 2 (Penryn) microcode. Redistributable firmware (enabled in
|
||||
# workstation.nix) supplies the iwlwifi blobs (Intel WiFi Link 5100/5300) and
|
||||
|
||||
+6
-6
@@ -1,11 +1,11 @@
|
||||
# sshd for the hosts that run it (T400, Mac Pro, RPi5): enable the daemon, open
|
||||
# port 22, and apply a key-only policy. Authorized keys are owned per-user by the
|
||||
# registry (modules/users.nix), not here.
|
||||
# Key-only SSH hardening, imported by the hosts that run sshd (T400, Mac Pro,
|
||||
# RPi5). The host config still does `services.openssh.enable = true` and opens
|
||||
# port 22 next to where it documents the listening service; this module only
|
||||
# tightens the policy so a host opting into sshd cannot accidentally ship
|
||||
# password/root login. Authorized keys are owned per-user by the identity
|
||||
# registry (users/registry.nix, applied via modules/users.nix), not here.
|
||||
{ ... }:
|
||||
{
|
||||
services.openssh.enable = true;
|
||||
networking.firewall.allowedTCPPorts = [ 22 ];
|
||||
|
||||
services.openssh.settings = {
|
||||
PasswordAuthentication = false; # keys only
|
||||
KbdInteractiveAuthentication = false; # no keyboard-interactive fallback
|
||||
|
||||
@@ -1,130 +0,0 @@
|
||||
# Authentik LDAP authentication for NixOS hosts.
|
||||
#
|
||||
# Wires SSSD (System Security Services Daemon) to the Authentik LDAP outpost so
|
||||
# every Linux host authenticates users against the same directory that backs the
|
||||
# SSO stack. Enabled by default on every NixOS host via baseModules; the EDaaS
|
||||
# WSL box opts out (services.authentikLdap.enable = false) because it is a
|
||||
# work-managed Windows-hosted environment.
|
||||
#
|
||||
# The Authentik LDAP provider exposes NON-standard object classes/attributes
|
||||
# (goauthentik.io/ldap/user, goauthentik.io/ldap/group) alongside the POSIX
|
||||
# attributes (uid, uidNumber, gidNumber, homeDirectory), so the schema mappings
|
||||
# below are explicit rather than relying on an RFC2307 default.
|
||||
#
|
||||
# The bind password is NOT inlined: services.sssd.config renders to the world-
|
||||
# readable Nix store, so the credential is delivered out-of-band by agenix as an
|
||||
# sssd.conf drop-in under /etc/sssd/conf.d/ (SSSD merges conf.d/*.conf after the
|
||||
# main file). See secrets/README.md.
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
...
|
||||
}:
|
||||
let
|
||||
cfg = config.services.authentikLdap;
|
||||
|
||||
# Directory coordinates for the Authentik LDAP provider.
|
||||
ldapUri = "ldaps://ldap.lyrapup.pet:636";
|
||||
searchBase = "dc=ldap,dc=goauthentik,dc=io";
|
||||
bindDn = "cn=sssd-bind,ou=users,dc=ldap,dc=goauthentik,dc=io";
|
||||
in
|
||||
{
|
||||
options.services.authentikLdap.enable =
|
||||
lib.mkEnableOption "SSSD authentication against the Authentik LDAP outpost"
|
||||
// {
|
||||
default = true;
|
||||
};
|
||||
|
||||
config = lib.mkIf cfg.enable {
|
||||
services.sssd = {
|
||||
enable = true;
|
||||
|
||||
# Non-secret sssd.conf. The bind password is injected separately via the
|
||||
# agenix conf.d drop-in (ldap_default_authtok lives there, not here) to
|
||||
# keep it out of the Nix store.
|
||||
config = ''
|
||||
[sssd]
|
||||
config_file_version = 2
|
||||
services = nss, pam
|
||||
domains = default
|
||||
|
||||
[nss]
|
||||
# Do not walk the whole directory for `getent passwd` etc.
|
||||
filter_users = root
|
||||
filter_groups = root
|
||||
|
||||
[pam]
|
||||
|
||||
[domain/default]
|
||||
# --- Providers --------------------------------------------------------
|
||||
id_provider = ldap
|
||||
auth_provider = ldap
|
||||
chpass_provider = none
|
||||
access_provider = permit
|
||||
|
||||
# --- Connection -------------------------------------------------------
|
||||
ldap_uri = ${ldapUri}
|
||||
ldap_search_base = ${searchBase}
|
||||
ldap_default_bind_dn = ${bindDn}
|
||||
ldap_default_authtok_type = password
|
||||
# ldap_default_authtok is supplied by the agenix drop-in in conf.d.
|
||||
|
||||
# --- TLS (LDAPS on 636; no StartTLS) ---------------------------------
|
||||
ldap_id_use_start_tls = false
|
||||
ldap_tls_reqcert = demand
|
||||
|
||||
# --- Schema: Authentik LDAP provider ---------------------------------
|
||||
# Authentik returns DN-valued group membership (member/memberOf), so
|
||||
# rfc2307bis (not rfc2307) is the correct base schema.
|
||||
ldap_schema = rfc2307bis
|
||||
|
||||
# Users: goauthentik.io/ldap/user, keyed by uid; POSIX attrs are
|
||||
# standard names (uidNumber/gidNumber/homeDirectory).
|
||||
ldap_user_object_class = goauthentik.io/ldap/user
|
||||
ldap_user_name = uid
|
||||
ldap_user_uid_number = uidNumber
|
||||
ldap_user_gid_number = gidNumber
|
||||
ldap_user_home_directory = homeDirectory
|
||||
ldap_user_gecos = displayName
|
||||
ldap_user_shell = loginShell
|
||||
|
||||
# Groups: goauthentik.io/ldap/group, keyed by cn.
|
||||
ldap_group_object_class = goauthentik.io/ldap/group
|
||||
ldap_group_name = cn
|
||||
ldap_group_gid_number = gidNumber
|
||||
ldap_group_member = member
|
||||
|
||||
# --- Behaviour --------------------------------------------------------
|
||||
cache_credentials = true
|
||||
enumerate = false
|
||||
'';
|
||||
};
|
||||
|
||||
# agenix delivers the bind password as an sssd.conf drop-in. The decrypted
|
||||
# plaintext IS a valid conf.d snippet:
|
||||
#
|
||||
# [domain/default]
|
||||
# ldap_default_authtok = <the bind password>
|
||||
#
|
||||
# SSSD requires conf.d files to be root-owned and 0600 or it ignores them.
|
||||
age.secrets.ldap-bind = {
|
||||
file = ../secrets/ldap-bind.age;
|
||||
path = "/etc/sssd/conf.d/01-ldap-authtok.conf";
|
||||
owner = "root";
|
||||
group = "root";
|
||||
mode = "0600";
|
||||
};
|
||||
|
||||
# Restart SSSD when the credential drop-in changes. agenix writes secrets in
|
||||
# a system activation script that runs before systemd (re)starts services on
|
||||
# a `switch`, so the file is present by the time sssd starts; the trigger
|
||||
# picks up rotations of the bind password.
|
||||
systemd.services.sssd.restartTriggers = [ config.age.secrets.ldap-bind.path ];
|
||||
|
||||
# Create home directories on first login for LDAP users (they have no
|
||||
# locally-provisioned home). NixOS wires nss + the SSSD PAM stack when
|
||||
# services.sssd.enable is true; mkHomeDir adds pam_mkhomedir to it.
|
||||
security.pam.services.login.makeHomeDir = true;
|
||||
security.pam.services.sshd.makeHomeDir = true;
|
||||
};
|
||||
}
|
||||
+9
-3
@@ -1,5 +1,9 @@
|
||||
# System user accounts, built from the registry (users/registry.nix) for the
|
||||
# host's `hostUsers` set. See README "Users".
|
||||
# System-level user accounts, built from the identity registry
|
||||
# (users/registry.nix). `hostUsers` is the host's user set, threaded by mkHost
|
||||
# from the flake host table; `userRegistry` is the global identity table passed
|
||||
# as a specialArg. Every account's identity -- description, groups, authorized
|
||||
# keys -- comes from its registry entry, so no user data is hardcoded here and a
|
||||
# host may declare any number of users.
|
||||
{
|
||||
config,
|
||||
pkgs,
|
||||
@@ -25,7 +29,9 @@
|
||||
openssh.authorizedKeys.keys = id.sshAuthorizedKeys;
|
||||
shell = pkgs.zsh;
|
||||
}
|
||||
# linger opt-in (host table); left unmanaged when unset.
|
||||
# Keep this user's systemd --user instance running without an open login
|
||||
# session (e.g. for home-manager user timers). Only emitted when the host
|
||||
# table opts in, so hosts that don't set it leave linger entirely unmanaged.
|
||||
// lib.optionalAttrs (spec ? linger) { inherit (spec) linger; }
|
||||
) hostUsers;
|
||||
|
||||
|
||||
@@ -1,92 +0,0 @@
|
||||
# Secrets (agenix)
|
||||
|
||||
Encrypted secrets for the fleet, managed with [agenix](https://github.com/ryantm/agenix).
|
||||
|
||||
Each secret is an age-encrypted file (`*.age`) encrypted to a set of recipient
|
||||
public keys declared in [`secrets.nix`](./secrets.nix). A host decrypts its
|
||||
secrets at activation using its SSH **host** key
|
||||
(`/etc/ssh/ssh_host_ed25519_key`), so every host that must read a secret has to
|
||||
be listed as a recipient for it.
|
||||
|
||||
`secrets.nix` is read only by the `agenix` CLI. It is never imported into the
|
||||
NixOS evaluation.
|
||||
|
||||
## Secrets in this repo
|
||||
|
||||
| File | Purpose | Recipients |
|
||||
| --------------- | ----------------------------------------------------------------------- | ----------------------------------- |
|
||||
| `ldap-bind.age` | SSSD → Authentik LDAP bind credential, as an `sssd.conf` drop-in snippet | all SSSD-enabled hosts (not EDaaS) |
|
||||
|
||||
Consumed by [`modules/sssd.nix`](../modules/sssd.nix) via
|
||||
`age.secrets.ldap-bind.path`, which places the decrypted snippet at
|
||||
`/etc/sssd/conf.d/01-ldap-authtok.conf`.
|
||||
|
||||
> **`ldap-bind.age` is not committed yet.** Only `ldap-bind.age.PLACEHOLDER`
|
||||
> ships in this change (real host recipient keys and the real password were not
|
||||
> available when it was written). Follow the steps below to create the real
|
||||
> secret, then delete the `.PLACEHOLDER`.
|
||||
|
||||
## Owner setup checklist
|
||||
|
||||
Run these once (per new host or when the bind password rotates):
|
||||
|
||||
### 1. Collect host recipient keys
|
||||
|
||||
On each SSSD-enabled host (all Linux hosts **except** EDaaS):
|
||||
|
||||
```sh
|
||||
cat /etc/ssh/ssh_host_ed25519_key.pub
|
||||
```
|
||||
|
||||
Paste each value into the matching placeholder in `secrets.nix`, replacing the
|
||||
`AAAA_PLACEHOLDER_REPLACE_ME_*` strings. (Optionally uncomment and set `admin`
|
||||
to an operator user key so the secret can be edited off-host.)
|
||||
|
||||
### 2. Encrypt the bind password
|
||||
|
||||
The plaintext must be a **full sssd.conf drop-in snippet**, because SSSD cannot
|
||||
read `ldap_default_authtok` from a separate file — it only merges `conf.d/*.conf`.
|
||||
The content is exactly:
|
||||
|
||||
```ini
|
||||
[domain/default]
|
||||
ldap_default_authtok = <the sssd-bind service-account password>
|
||||
```
|
||||
|
||||
Use the password of the `sssd-bind` (Terraform: `sssd-bind`) Authentik LDAP
|
||||
service account. Then, from the repo root:
|
||||
|
||||
```sh
|
||||
# Requires the agenix CLI: `nix run github:ryantm/agenix -- -e secrets/ldap-bind.age`
|
||||
cd secrets
|
||||
agenix -e ldap-bind.age
|
||||
```
|
||||
|
||||
An `$EDITOR` opens; paste the two-line snippet above, save, quit. agenix writes
|
||||
the encrypted `ldap-bind.age`. Commit it and delete `ldap-bind.age.PLACEHOLDER`.
|
||||
|
||||
### 3. Rekey after changing recipients
|
||||
|
||||
If you add/remove hosts in `secrets.nix`, re-encrypt every secret to the new
|
||||
recipient set:
|
||||
|
||||
```sh
|
||||
cd secrets
|
||||
agenix -r
|
||||
```
|
||||
|
||||
### 4. DNS
|
||||
|
||||
`ldap.lyrapup.pet` must resolve to the Authentik LDAP outpost and serve LDAPS on
|
||||
port 636 with a certificate the hosts trust (`ldap_tls_reqcert = demand`). If the
|
||||
cert is not from a system-trusted CA, add it to the hosts' trust store
|
||||
(`security.pki.certificateFiles`) or relax `ldap_tls_reqcert` in
|
||||
`modules/sssd.nix`.
|
||||
|
||||
### 5. Rebuild
|
||||
|
||||
```sh
|
||||
sudo nixos-rebuild switch --flake .#<host>
|
||||
```
|
||||
|
||||
Verify with `getent passwd <ldap-user>` and `id <ldap-user>`.
|
||||
@@ -1,21 +0,0 @@
|
||||
THIS IS A PLACEHOLDER, NOT A REAL AGE SECRET.
|
||||
|
||||
The real secrets/ldap-bind.age is produced by the repo owner with `agenix -e`
|
||||
(see secrets/README.md) and is a binary age-encrypted blob. It is intentionally
|
||||
NOT committed here because:
|
||||
* the real host age recipients are not available to the author of this change
|
||||
(they are each host's /etc/ssh/ssh_host_ed25519_key.pub), and
|
||||
* fabricating an encrypted blob or fake host keys would be misleading.
|
||||
|
||||
Committing this file as `ldap-bind.age` would let modules/sssd.nix reference
|
||||
`../secrets/ldap-bind.age` and evaluate, but SSSD would fail to decrypt it at
|
||||
runtime. Do ONE of the following before deploying:
|
||||
|
||||
1. Preferred: generate the real secret (secrets/README.md), commit it as
|
||||
secrets/ldap-bind.age, and delete this .PLACEHOLDER file.
|
||||
|
||||
The decrypted plaintext must be a valid sssd.conf drop-in (NOT the bare
|
||||
password):
|
||||
|
||||
[domain/default]
|
||||
ldap_default_authtok = <the sssd-bind service-account password>
|
||||
@@ -1,15 +0,0 @@
|
||||
let
|
||||
lyrathorpe-mbp = "ssh-ed25519 AAAA_PLACEHOLDER_REPLACE_ME_mbp";
|
||||
lyrathorpe-t400 = "ssh-ed25519 AAAA_PLACEHOLDER_REPLACE_ME_t400";
|
||||
lyrathorpe-macpro31 = "ssh-ed25519 AAAA_PLACEHOLDER_REPLACE_ME_macpro31";
|
||||
lyrathorpe-rpi5 = "ssh-ed25519 AAAA_PLACEHOLDER_REPLACE_ME_rpi5";
|
||||
sssdHosts = [
|
||||
lyrathorpe-mbp
|
||||
lyrathorpe-t400
|
||||
lyrathorpe-macpro31
|
||||
lyrathorpe-rpi5
|
||||
];
|
||||
in
|
||||
{
|
||||
"ldap-bind.age".publicKeys = sssdHosts;
|
||||
}
|
||||
@@ -1,11 +1,8 @@
|
||||
# Work (EDaaS/WSL) home profile: corporate toolchain + tmux tweaks. Git identity
|
||||
# comes from the registry (users/registry.nix), not here.
|
||||
{
|
||||
pkgs,
|
||||
lib,
|
||||
inputs,
|
||||
...
|
||||
}:
|
||||
# Home-manager module for the work (EDaaS/WSL) profile: corporate work toolchain
|
||||
# packages and tmux tweaks. Imported only by the work host. The corporate git
|
||||
# identity (email + signing key) is the emmathorpe entry in the identity
|
||||
# registry (users/registry.nix), applied by the shared home/git.nix.
|
||||
{ pkgs, lib, ... }:
|
||||
|
||||
{
|
||||
# Host-scoped extras for this machine only (the EDaaS/WSL host).
|
||||
@@ -29,6 +26,7 @@
|
||||
pkgs.powershell
|
||||
pkgs.nuget
|
||||
pkgs.gedit
|
||||
pkgs.lens
|
||||
pkgs.python3
|
||||
pkgs.gnumake
|
||||
pkgs.gcc
|
||||
@@ -52,10 +50,8 @@
|
||||
docker = "/run/current-system/sw/bin/docker";
|
||||
};
|
||||
programs.tmux = {
|
||||
# kube context/namespace in the status line. kube-tmux is pinned as a flake
|
||||
# input (it is not in nixpkgs), so the script is always present in the store.
|
||||
extraConfig = ''
|
||||
set -g status-right "#(${pkgs.bash}/bin/bash ${inputs.kube-tmux}/kube.tmux 250 red black)"
|
||||
set -g status-right "#(/run/current-system/sw/bin/bash $HOME/code/kube-tmux/kube.tmux 250 red black)"
|
||||
'';
|
||||
};
|
||||
programs.go = {
|
||||
|
||||
@@ -1,17 +0,0 @@
|
||||
# Lyra's personal home extras, imported on her hosts (not the work box). Keeps
|
||||
# personal data out of the shared home/ modules. See README "Users".
|
||||
{ pkgs, lib, ... }:
|
||||
{
|
||||
# Personal ssh host shortcut.
|
||||
programs.ssh.settings."dockerpi.inf.cbg.emmaisvery.gay" = {
|
||||
User = "emmathorpe";
|
||||
};
|
||||
|
||||
# Night-light location for gammastep (the service itself is enabled by
|
||||
# home/sway.nix on graphical hosts). Linux-guarded so Darwin, which imports
|
||||
# this module but has no gammastep, skips it.
|
||||
services.gammastep = lib.mkIf pkgs.stdenv.hostPlatform.isLinux {
|
||||
latitude = 51.5;
|
||||
longitude = -0.13;
|
||||
};
|
||||
}
|
||||
+15
-3
@@ -1,5 +1,14 @@
|
||||
# User identity registry -- pure data, keyed by username. See README "Users".
|
||||
# (`identity.username` is injected by mkHost, so it is not repeated here.)
|
||||
# User identity registry -- pure data, no machinery. Keyed by username.
|
||||
#
|
||||
# Each entry describes WHO a user is (display name, email, authorized/signing
|
||||
# keys, supplementary groups). The reusable modules read this indirectly:
|
||||
# - system: modules/users.nix builds users.users.* from `userRegistry`
|
||||
# (specialArg) restricted to the host's `hostUsers` set.
|
||||
# - home: home/git.nix and home/desktop.nix read the per-user `identity`
|
||||
# module arg, which mkHost derives from the matching registry entry.
|
||||
#
|
||||
# The login name is injected by mkHost as `identity.username`, so it is not
|
||||
# repeated inside each entry here.
|
||||
{
|
||||
lyrathorpe = {
|
||||
fullName = "Lyra Thorpe";
|
||||
@@ -21,7 +30,10 @@
|
||||
"wheel"
|
||||
"docker"
|
||||
];
|
||||
# No personal key on file yet; add one if SSH login as emmathorpe is wanted.
|
||||
# No personal authorized key on file yet. The previous shared user module
|
||||
# applied Lyra's key to every account, including this one -- a defect. Leave
|
||||
# this empty until a real key is provisioned; SSH login is moot on the WSL
|
||||
# host (entered via wsl.exe, not sshd).
|
||||
sshAuthorizedKeys = [ ];
|
||||
signingKey = "key::ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAJMVgeRKnfX1G8coU3nAobI485aeUpGTMqH7+zbKI8o emma.thorpe@cloud.com";
|
||||
};
|
||||
|
||||
Reference in New Issue
Block a user