Emma Thorpe
10cc6cceed
Separate user identity (data) from the reusable modules, and let a host declare any number of users instead of exactly one. - users/registry.nix: per-user identity (name, email, groups, authorized and signing keys) as the single source of identity; no user data is hardcoded in the modules. - mkHost takes a `users` set keyed by username; per-user identity is injected into each home config via the `identity` module arg (extraSpecialArgs is per-host, so it cannot carry per-user data). - modules/users.nix builds accounts from the registry; modules/ssh.nix no longer defines authorized keys (the registry owns them); home/git.nix and home/desktop.nix read `identity`; users/emmathorpe/work.nix drops its now-redundant git identity override. - Restructure the tree: users/, home/, modules/, hosts/, lib/ replace the former lyrathorpe/ and system/ layout. - Add standalone homeConfigurations (the portable subset: shell, git, editor, claude) and an exported homeModules output for use on machines not managed by this flake, or as an input to other flakes. Behaviour-preserving for existing hosts: lyrathorpe-mbp and emmathorpe-edaas evaluate to identical derivations; lyrathorpe-t400, lyrathorpe-macpro31 and lyrathorpe-rpi5 differ only by de-duplicating a repeated authorized_keys entry. Fixes the SSH authorized-key leak (one user's key was applied to every account), the hardcoded default git identity, and the hardcoded EDaaS linger setting.
69 lines
2.5 KiB
Markdown
69 lines
2.5 KiB
Markdown
# Raspberry Pi 5 (`lyrathorpe-rpi5`)
|
|
|
|
Headless `aarch64-linux` server with two roles:
|
|
|
|
- **Docker host** — daemon exposed over the network (`docker.nix`).
|
|
- **nginx reverse proxy** — declarative `virtualHosts` (`reverse-proxy.nix`).
|
|
|
|
## Install
|
|
|
|
1. Flash a NixOS `aarch64` SD image (or USB) and boot the Pi. The
|
|
`raspberry-pi-5` profile from `nixos-hardware` (wired in the flake host table)
|
|
supplies the kernel, firmware and device tree; boot is U-Boot + extlinux.
|
|
2. Partition/mount the target, then **regenerate the hardware config on the
|
|
device** and replace the committed placeholder:
|
|
```sh
|
|
nixos-generate-config --root /mnt
|
|
# copy /mnt/etc/nixos/hardware-configuration.nix over
|
|
# system/machine/RPi5/hardware-configuration.nix in this repo, then commit
|
|
```
|
|
`hardware-configuration.nix` in this directory is a **placeholder** committed
|
|
only so the host evaluates in CI. The machine will not boot correctly until it
|
|
is replaced with the generated one.
|
|
3. Set the host name to match the flake attribute (already done in
|
|
`configuration.nix`: `lyrathorpe-rpi5`) and build:
|
|
```sh
|
|
sudo nixos-rebuild switch --flake .#lyrathorpe-rpi5
|
|
# or, once the hostname is live:
|
|
nh os switch
|
|
```
|
|
4. Give the login user a password (`passwd lyrathorpe`) and confirm the key in
|
|
`system/modules/ssh.nix` is the one you will connect with.
|
|
|
|
## Docker socket (security)
|
|
|
|
The daemon listens on **plain TCP `2375`, no TLS, no auth**. Access is
|
|
root-equivalent on this host. The only protection is the nftables rule in
|
|
`docker.nix`, which accepts `2375` **only** from the trusted LAN subnet
|
|
(`10.187.1.0/24` by default — change it to match your network). Do not widen
|
|
that subnet to anything untrusted.
|
|
|
|
From a LAN client:
|
|
|
|
```sh
|
|
export DOCKER_HOST=tcp://lyrathorpe-rpi5:2375
|
|
docker info
|
|
```
|
|
|
|
The secure upgrade path is mutual TLS on `2376` (`--tlsverify` with a CA and
|
|
client certs); it needs out-of-band cert provisioning and is intentionally not
|
|
wired here.
|
|
|
|
## Adding a reverse-proxy site
|
|
|
|
Each proxied service is a Nix entry in `reverse-proxy.nix`:
|
|
|
|
```nix
|
|
services.nginx.virtualHosts."app.example.lan" = {
|
|
# enableACME = true; forceSSL = true; # once a DNS name + cert exist
|
|
locations."/" = {
|
|
proxyPass = "http://127.0.0.1:8080"; # e.g. a local container
|
|
proxyWebsockets = true;
|
|
};
|
|
};
|
|
```
|
|
|
|
The example vhost is HTTP-only by design. Turn on `enableACME`/`forceSSL`
|
|
per-vhost once the host has a real DNS name and the ACME challenge can be met;
|
|
`443` is already open in the firewall.
|