From d16f4939bc6f8adbf1a9c2d1ee92158eae24aaf3 Mon Sep 17 00:00:00 2001 From: Joshua Falkenberg Date: Thu, 10 Sep 2026 14:56:25 +0200 Subject: [PATCH] fixing issues from first live install try --- hosts/desktop/default.nix | 5 +++- hosts/desktop/disko.nix | 1 - hosts/desktop/hardware-configuration.nix | 27 +++++++++++++++++ modules/boot.nix | 6 ---- modules/secrets.nix | 4 +++ secrets/test.yaml | 38 ------------------------ secrets/user-password.yaml | 36 ++++++++++++++++++++++ 7 files changed, 71 insertions(+), 46 deletions(-) create mode 100644 hosts/desktop/hardware-configuration.nix delete mode 100644 secrets/test.yaml create mode 100644 secrets/user-password.yaml diff --git a/hosts/desktop/default.nix b/hosts/desktop/default.nix index 4c30d20..6685a6a 100644 --- a/hosts/desktop/default.nix +++ b/hosts/desktop/default.nix @@ -1,8 +1,9 @@ -{ ... }: +{ config, ... }: { imports = [ ./disko.nix + ./hardware-configuration.nix ]; networking.hostName = "desktop"; @@ -11,6 +12,8 @@ isNormalUser = true; home = "/home/user"; + hashedPasswordFile = config.sops.secrets.user-password.path; + extraGroups = [ "wheel" "networkmanager" diff --git a/hosts/desktop/disko.nix b/hosts/desktop/disko.nix index ffe25c0..3aa3713 100644 --- a/hosts/desktop/disko.nix +++ b/hosts/desktop/disko.nix @@ -21,7 +21,6 @@ luks = { size = "100%"; - label="luks"; content = { type = "luks"; diff --git a/hosts/desktop/hardware-configuration.nix b/hosts/desktop/hardware-configuration.nix new file mode 100644 index 0000000..452a3b4 --- /dev/null +++ b/hosts/desktop/hardware-configuration.nix @@ -0,0 +1,27 @@ +# Do not modify this file! It was generated by ‘nixos-generate-config’ +# and may be overwritten by future invocations. +{ config, lib, pkgs, modulesPath, ... }: + +{ + imports = + [ (modulesPath + "/installer/scan/not-detected.nix") + ]; + + boot.initrd.availableKernelModules = [ + "xhci_pci" + "ahci" + "usb_storage" + "usbhid" + "sd_mod" + ]; + + boot.initrd.kernelModules = [ ]; + boot.kernelModules = [ "kvm-intel" ]; + boot.extraModulePackages = [ ]; + + swapDevices = [ ]; + + nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux"; + hardware.cpu.intel.updateMicrocode = + lib.mkDefault config.hardware.enableRedistributableFirmware; +} diff --git a/modules/boot.nix b/modules/boot.nix index 1f87399..473e7bf 100644 --- a/modules/boot.nix +++ b/modules/boot.nix @@ -15,10 +15,4 @@ boot.consoleLogLevel = 3; boot.initrd.verbose = false; - - boot.initrd.luks.devices."cryptroot" = { - device = "/dev/disk/by-partlabel/luks"; - }; - - fileSystems."/".device = "/dev/mapper/cryptroot"; } diff --git a/modules/secrets.nix b/modules/secrets.nix index 89b00f5..baa62ec 100644 --- a/modules/secrets.nix +++ b/modules/secrets.nix @@ -2,4 +2,8 @@ { sops.age.keyFile = "/persist/keys/host-age.key"; + + sops.secrets.user-password = { + sopsFile = ../secrets/user-password.yaml; + }; } diff --git a/secrets/test.yaml b/secrets/test.yaml deleted file mode 100644 index 82fa3d0..0000000 --- a/secrets/test.yaml +++ /dev/null @@ -1,38 +0,0 @@ -test: - message: ENC[AES256_GCM,data:eF4xvJYIkGg1,iv:CVf9AA5hjPBq+wZLpOjmcOZhve2Tsyk/eULXdOp9Q/s=,tag:BrRYXcHOuftG0Vap4bK4ig==,type:str] - number: ENC[AES256_GCM,data:M8M=,iv:hgv/5PHEIS1ENu2UGMsKMc+liHMjEafd6ITyZvpGnb8=,tag:Xs/cUc/Ny17Ka8qtQHWMUw==,type:int] -sops: - age: - - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHBpdi1wMjU2IE5MdVJBQSBBOStPcWx0 - YkhRNkFKNmhNeHlvQWFYRDJ2UmNMR2lyTWZEV3MrbldmSWd1Sgp4a0FidVJwZ2tv - V2JlZjRQT05xZlpoTEFiVUdKVTRVemx3a0dnTm9MRENjCi0tLSBQMGE0aXVQRFQx - NjVEWEtNcldHUWlXbmhQRWxXdzk5bzd1RjNmaFdRS1Z3Crl/J6U3WSvIZRreNIXO - aTqjTZaahbHjX4pmkDRmSd2o5x1oNksutIoWO5l32tX8SEU3quDj9bDymZIJBp8X - 86g= - -----END AGE ENCRYPTED FILE----- - recipient: age1yubikey1q26trpwnpym6t9m5qlcfm00kddy3tzex7u8r6ck7sqkq39wxc5wwwafuq89 - - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHBpdi1wMjU2IEcyMVBZdyBBdktHQ0px - ZVBMNDhteElxVXlUczd5K2I5K25iejNCOEZkTjFDRkwzcUlJWAptRmlpazhsbkY5 - QnRhamtXR1JObFlTY1FjZ1hIUmxzTTZEYXVrZzlaY2lBCi0tLSBSUlAxOFZlcTFn - cEFRR2tIT2liSVAxaHhkcWs4MlQ1cVBTeW9vUm9PcW5VCpQ82CSSMYHMK5Su/An9 - o6Ybb//z92Xm1fbuCv/1E/yQg12sOClbsJvNPWbwynoWkAmVzureuDzXNgIsv2oA - Mt4= - -----END AGE ENCRYPTED FILE----- - recipient: age1yubikey1qgvu222dwg2gtvc4mq2txk79t4ep5gk9qwgfh520lc3m4kyxjmtgzexyljy - - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBzMWthMjdFTElpbzcvcFFQ - UzdzbUtpSkVQQWpWTVpxNUcwamlqOE5Nd2hVCkZNeUdvOVF0eWxwZ2F5WlY0UHNv - QlFlNUdRSlh6M0xub1dUNkNTWVdxZzQKLS0tIGNQcGdzazZTRll1MEhuZzlxZUM0 - UEdvV0xsRzRRRUZxZ0NsUFpUSEpKZ2sKQxxSJOQen+whTB4awc7EGSUJO/CWmlOc - Srryah6025tEfH+scMxYJcpSMKrQlQ778yvK92xxSJbFgoQi0sReoA== - -----END AGE ENCRYPTED FILE----- - recipient: age1r993gvlratqk5h5seuzrd8fjv356csnrvtdt5ugcfdu3cw66hdls9gtuwd - lastmodified: "2026-09-10T08:56:29Z" - mac: ENC[AES256_GCM,data:YOEymqQFlK/4iaQpcA3e7OtuTnqz/52iS+TAc2sSIdKP2TV9NG6tr32Fn66AQrjFfYmfY81LIYFRnqRNV1IH9rccNTvxxklF6wKCz8p0/ESqpKbDEaNsoRzaTHCNRvDu3t8GvrxudDtRXQtQ94yx/WCk/M7XHQuY0LbagJv0Jm0=,iv:AIyGRpYuAsxaD2Rm/CZMUCLEkHCR3ImvJ/GoRwG9FAk=,tag:Fr5T15lfHUv1cIvJmXwZkA==,type:str] - unencrypted_suffix: _unencrypted - version: 3.13.3 diff --git a/secrets/user-password.yaml b/secrets/user-password.yaml new file mode 100644 index 0000000..6c51808 --- /dev/null +++ b/secrets/user-password.yaml @@ -0,0 +1,36 @@ +user-password: ENC[AES256_GCM,data:0kyCCpjuUEFxw5onG8O/FuAoQgnljNx7rk/4AoTjAFNbxqSy8+xYEFUW83zwg8HTYHw35EE5OqPOMX67TbUiXLpvqzQF1ugs0g==,iv:PWBzbYUew5QVWHyLzRd+iQRN2VhxamSs6Mqp0ccAuBs=,tag:CmTJtrt2KwkfJBlRf1uyjQ==,type:str] +sops: + age: + - enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHBpdi1wMjU2IE5MdVJBQSBBK0R5NjZO + Qk5WYXRpcUhBOE1TcUd2N2tuTGJrditubHhsTWd0NmJVTlMvMgphUldKdWYwQlVn + bFI1VVptcDA3R0hSU2ZTMXhyQnRLLy82WGpIWGtlSUhrCi0tLSBIdTE4S0dSL2Jp + WW9iMzNWUm5nZGJwdWFOU1FkZUZwZGRrOWVFdXJOaW8wCrJZ+9nFGLQ+FCn1Mu6S + rgfG72JPUAYOCitK01X4US9VQbnyt1VzkBIN1UbgLa8SyQUOIUz5jQX2raxTWlA+ + 3NU= + -----END AGE ENCRYPTED FILE----- + recipient: age1yubikey1q26trpwnpym6t9m5qlcfm00kddy3tzex7u8r6ck7sqkq39wxc5wwwafuq89 + - enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHBpdi1wMjU2IEcyMVBZdyBBdFlBR2x4 + L1AvV3oxRFg3ZmUzSnpvc2F4YUp2TzZWSHltV0VnNkR6N2VnWQpqczdIOEZwM0JK + MEx2NThpSEVUYVM3aGV0bUVBK3FxOVhVa1ZPZE04WmJFCi0tLSBRd3R3WVRNWGNs + WlMrWmJ4bUs3dWZwaStqQzViajN6S0tSL25KMEVYOFlFClNZPzUpNWfwDaoHjIdb + dhYlOhYXCsDYwAii2hU8HwyLSgWG1QALOBhZhhyEADRStSujilMLsbsaONCNFSvt + mgY= + -----END AGE ENCRYPTED FILE----- + recipient: age1yubikey1qgvu222dwg2gtvc4mq2txk79t4ep5gk9qwgfh520lc3m4kyxjmtgzexyljy + - enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBaazdKTEREeEo0SC9DRE1S + K0lQVklWVndQeW9BeEVqN3hPanJmUUR6VmhvClB3MXVZMCsyOHN4bU42VTBoQUtB + RFMrN3IxMExBL1A1MWJyZWc1RS9oekEKLS0tIDJJYnc0U01TbjZzYWVsWE5OVlZy + b2NFQVFpOTdGVHhMcHBzY2xKYXI5cDQK1atLJ9/8/8yZfXO/WmolvTre+Z1BBvNl + Zu4kYHjlfX/wbtDiyyd5rORalUkLUYzK2IZOSjwfCsY+qrjqAlncow== + -----END AGE ENCRYPTED FILE----- + recipient: age1r993gvlratqk5h5seuzrd8fjv356csnrvtdt5ugcfdu3cw66hdls9gtuwd + lastmodified: "2026-09-10T12:55:42Z" + mac: ENC[AES256_GCM,data:V5h1J+jZV7zSo+zCZCmlOjbY1+8f0uDUb3c/0h3Q5llXzkDRJrbhRMLQXgyghvBRq16KrEr+s+JAL7piJkAT5IlIhIQ6xUsr7dTd8JfN008cT1/NqXzkgcsx8/xwL/ABeOJe5d2iXcbpJCMjScDqvGvXgLqeSLfpgPYoA9nsXgI=,iv:FovsxL+GejChvtX5Swkm9x8VU6p5lkTBin/xNkmEfyQ=,tag:TRw/HfkN7kisEYDTlL6AwQ==,type:str] + unencrypted_suffix: _unencrypted + version: 3.13.3