Files

T

Emma Thorpe 10cc6cceed refactor(flake): add user registry and multi-user host support

Separate user identity (data) from the reusable modules, and let a host
declare any number of users instead of exactly one.

- users/registry.nix: per-user identity (name, email, groups, authorized
  and signing keys) as the single source of identity; no user data is
  hardcoded in the modules.
- mkHost takes a `users` set keyed by username; per-user identity is
  injected into each home config via the `identity` module arg
  (extraSpecialArgs is per-host, so it cannot carry per-user data).
- modules/users.nix builds accounts from the registry; modules/ssh.nix no
  longer defines authorized keys (the registry owns them); home/git.nix
  and home/desktop.nix read `identity`; users/emmathorpe/work.nix drops
  its now-redundant git identity override.
- Restructure the tree: users/, home/, modules/, hosts/, lib/ replace the
  former lyrathorpe/ and system/ layout.
- Add standalone homeConfigurations (the portable subset: shell, git,
  editor, claude) and an exported homeModules output for use on machines
  not managed by this flake, or as an input to other flakes.

Behaviour-preserving for existing hosts: lyrathorpe-mbp and
emmathorpe-edaas evaluate to identical derivations; lyrathorpe-t400,
lyrathorpe-macpro31 and lyrathorpe-rpi5 differ only by de-duplicating a
repeated authorized_keys entry. Fixes the SSH authorized-key leak (one
user's key was applied to every account), the hardcoded default git
identity, and the hardcoded EDaaS linger setting.

2026-06-29 12:27:52 +01:00

2.5 KiB

Raw Blame History

Raspberry Pi 5 (`lyrathorpe-rpi5`)

Headless aarch64-linux server with two roles:

Docker host — daemon exposed over the network (docker.nix).
nginx reverse proxy — declarative virtualHosts (reverse-proxy.nix).

Install

Flash a NixOS aarch64 SD image (or USB) and boot the Pi. The raspberry-pi-5 profile from nixos-hardware (wired in the flake host table) supplies the kernel, firmware and device tree; boot is U-Boot + extlinux.
Partition/mount the target, then regenerate the hardware config on the device and replace the committed placeholder:
```
nixos-generate-config --root /mnt
# copy /mnt/etc/nixos/hardware-configuration.nix over
# system/machine/RPi5/hardware-configuration.nix in this repo, then commit
```
hardware-configuration.nix in this directory is a placeholder committed only so the host evaluates in CI. The machine will not boot correctly until it is replaced with the generated one.
Set the host name to match the flake attribute (already done in configuration.nix: lyrathorpe-rpi5) and build:
```
sudo nixos-rebuild switch --flake .#lyrathorpe-rpi5
# or, once the hostname is live:
nh os switch
```
Give the login user a password (passwd lyrathorpe) and confirm the key in system/modules/ssh.nix is the one you will connect with.

Docker socket (security)

The daemon listens on plain TCP 2375, no TLS, no auth. Access is root-equivalent on this host. The only protection is the nftables rule in docker.nix, which accepts 2375 only from the trusted LAN subnet (10.187.1.0/24 by default — change it to match your network). Do not widen that subnet to anything untrusted.

From a LAN client:

export DOCKER_HOST=tcp://lyrathorpe-rpi5:2375
docker info

The secure upgrade path is mutual TLS on 2376 (--tlsverify with a CA and client certs); it needs out-of-band cert provisioning and is intentionally not wired here.

Adding a reverse-proxy site

Each proxied service is a Nix entry in reverse-proxy.nix:

services.nginx.virtualHosts."app.example.lan" = {
  # enableACME = true; forceSSL = true;   # once a DNS name + cert exist
  locations."/" = {
    proxyPass = "http://127.0.0.1:8080";  # e.g. a local container
    proxyWebsockets = true;
  };
};

The example vhost is HTTP-only by design. Turn on enableACME/forceSSL per-vhost once the host has a real DNS name and the ACME challenge can be met; 443 is already open in the firewall.

2.5 KiB Raw Blame History

Raspberry Pi 5 (lyrathorpe-rpi5)

Install

Docker socket (security)

Adding a reverse-proxy site

2.5 KiB

Raw Blame History

Raspberry Pi 5 (`lyrathorpe-rpi5`)