mikl
2d023fc86d
- flake.nix: mkHost helper, SOPS-age integration - hosts/common: locale, sshd, universal packages - hosts/muscari: k3s host with Cilium flags - modules/users/mikl: SSH keys via forgejo .keys + sha256 pinning - modules/services/k3s: k3s daemon with Cilium-compatible flags - hardware-configuration.nix: placeholder, will be regenerated on real VM Stack: - NixOS 25.11 - k3s single-node (Cilium CNI, Traefik ingress) - SOPS + age for secrets - Multi-host ready (rosemary planned)
38 lines
No EOL
1 KiB
Nix
38 lines
No EOL
1 KiB
Nix
{
|
|
description = "iscg NixOS configurations (muscari k3s + future rosemary backup)";
|
|
|
|
inputs = {
|
|
nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.11";
|
|
|
|
sops-nix = {
|
|
url = "github:Mic92/sops-nix";
|
|
inputs.nixpkgs.follows = "nixpkgs";
|
|
};
|
|
};
|
|
|
|
outputs = { self, nixpkgs, sops-nix, ... }:
|
|
let
|
|
system = "x86_64-linux";
|
|
|
|
mkHost = hostname: nixpkgs.lib.nixosSystem {
|
|
inherit system;
|
|
modules = [
|
|
./hosts/common
|
|
./hosts/${hostname}
|
|
sops-nix.nixosModules.sops
|
|
{
|
|
# SOPS для каждого хоста: secrets/<hostname>.yaml
|
|
# приватный age-ключ лежит в /etc/sops/age/keys.txt (chmod 600)
|
|
sops.defaultSopsFile = ./secrets/${hostname}.yaml;
|
|
sops.age.sshKeyPaths = [ "/etc/sops/age/keys.txt" ];
|
|
}
|
|
];
|
|
};
|
|
in
|
|
{
|
|
nixosConfigurations = {
|
|
muscari = mkHost "muscari";
|
|
# rosemary = mkHost "rosemary"; # раскомментировать когда будет backup VM
|
|
};
|
|
};
|
|
} |