mikl
2d023fc86d
- flake.nix: mkHost helper, SOPS-age integration - hosts/common: locale, sshd, universal packages - hosts/muscari: k3s host with Cilium flags - modules/users/mikl: SSH keys via forgejo .keys + sha256 pinning - modules/services/k3s: k3s daemon with Cilium-compatible flags - hardware-configuration.nix: placeholder, will be regenerated on real VM Stack: - NixOS 25.11 - k3s single-node (Cilium CNI, Traefik ingress) - SOPS + age for secrets - Multi-host ready (rosemary planned)
43 lines
No EOL
960 B
Nix
43 lines
No EOL
960 B
Nix
# Common config for ALL NixOS hosts (muscari, future rosemary, ...)
|
|
# Только то что реально нужно везде. Специфичное для k3s/forgejo — в modules/services/
|
|
|
|
{ pkgs, ... }:
|
|
{
|
|
# Time
|
|
time.timeZone = "Europe/Moscow";
|
|
|
|
# Locale
|
|
i18n.defaultLocale = "en_US.UTF-8";
|
|
|
|
# SSH — единые правила для всех хостов
|
|
services.openssh = {
|
|
enable = true;
|
|
settings = {
|
|
PermitRootLogin = "prohibit-password";
|
|
PasswordAuthentication = false;
|
|
};
|
|
};
|
|
|
|
# Базовые пакеты — есть на каждом хосте
|
|
environment.systemPackages = with pkgs; [
|
|
# shell + tools
|
|
git
|
|
neovim
|
|
htop
|
|
tmux
|
|
curl
|
|
wget
|
|
rsync
|
|
dnsutils # dig, nslookup
|
|
|
|
# secrets
|
|
sops
|
|
age
|
|
ssh-to-age
|
|
|
|
# nix tooling
|
|
nh # nix-helper от vlaci, удобнее чем nixos-rebuild switch
|
|
shellcheck
|
|
shfmt
|
|
];
|
|
} |