Reduced config for demo purposes

flake.nix

@@ -4,8 +4,6 @@
   inputs = {
     nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
 
-    nixos-hardware.url = "github:NixOS/nixos-hardware";
-
     home-manager = {
       url = "github:nix-community/home-manager";
       inputs.nixpkgs.follows = "nixpkgs";
@@ -16,11 +14,6 @@
       inputs.nixpkgs.follows = "nixpkgs";
     };
 
-    agenix = {
-      url = "github:ryantm/agenix";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
-
     nvf = {
       url = "github:notashelf/nvf";
       inputs.nixpkgs.follows = "nixpkgs";
@@ -33,19 +26,20 @@
     };
   };
 
-  outputs = { nixpkgs, ... }@inputs:
+  outputs =
-  let
+    { nixpkgs, ... }@inputs:
-    system = "x86_64-linux";
+    let
-    host = "vanta";
+      system = "x86_64-linux";
-  in
+      host = "demo";
-  {
+    in
-    nixosConfigurations.${host} = nixpkgs.lib.nixosSystem {
+    {
-      inherit system;
+      nixosConfigurations.${host} = nixpkgs.lib.nixosSystem {
-      specialArgs = { inherit inputs host; };
+        inherit system;
-      modules = [
+        specialArgs = { inherit inputs host; };
-        ./modules/system
+        modules = [
-        ./hosts/${host}
+          ./modules/system
-      ];
+          ./hosts/${host}
+        ];
+      };
     };
-  };
 }

hosts/demo/placeholder.txt

@@ -0,0 +1 @@
+Put host config here!

hosts/vanta/default.nix

@@ -1,10 +0,0 @@
-{
-  inputs,
-  ...
-}:
-{
-  imports = [
-    inputs.nixos-hardware.nixosModules.framework-12th-gen-intel
-    ./hardware-configuration.nix
-  ];
-}

hosts/vanta/hardware-configuration.nix

@@ -1,40 +0,0 @@
-# Do not modify this file!  It was generated by ‘nixos-generate-config’
-# and may be overwritten by future invocations.  Please make changes
-# to /etc/nixos/configuration.nix instead.
-{ config, lib, pkgs, modulesPath, ... }:
-
-{
-  imports =
-    [ (modulesPath + "/installer/scan/not-detected.nix")
-    ];
-
-  boot.initrd.availableKernelModules = [ "xhci_pci" "thunderbolt" "nvme" "usbhid" "usb_storage" "sd_mod" ];
-  boot.initrd.kernelModules = [ ];
-  boot.kernelModules = [ "kvm-intel" ];
-  boot.extraModulePackages = [ ];
-
-  fileSystems."/" =
-    { device = "/dev/disk/by-uuid/1df00fd1-f531-49b9-9dc6-6d17ca39b67a";
-      fsType = "ext4";
-    };
-
-  fileSystems."/boot" =
-    { device = "/dev/disk/by-uuid/EE0E-CAE4";
-      fsType = "vfat";
-      options = [ "fmask=0077" "dmask=0077" ];
-    };
-
-  swapDevices =
-    [ { device = "/dev/disk/by-uuid/fbacd982-b161-447c-a34a-7b44bc063a08"; }
-    ];
-
-  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
-  # (the default) this is the recommended approach. When using systemd-networkd it's
-  # still possible to use this option, but it's recommended to use it in conjunction
-  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
-  networking.useDHCP = lib.mkDefault true;
-  # networking.interfaces.wlp166s0.useDHCP = lib.mkDefault true;
-
-  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
-  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
-}

modules/system/agenix.nix

@@ -1,20 +0,0 @@
-{
-  inputs,
-  pkgs,
-  ...
-}:
-{
-  imports = [
-    inputs.agenix.nixosModules.default
-  ];
-
-  environment.systemPackages = [
-    inputs.agenix.packages.${pkgs.system}.default # CLI Tool
-  ];
-
-  age.secrets = {
-    tailscale-auth.file = ../../secrets/tailscale-auth.age;
-    eclypsecloud-eclypse.file = ../../secrets/eclypsecloud-eclypse.age;
-    eclypse-password.file = ../../secrets/eclypse-password.age;
-  };
-}

modules/system/boot.nix

@@ -1,10 +1,8 @@
 {
-  config,
   ...
 }:
 {
   boot = {
-    extraModulePackages = with config.boot.kernelPackages; [ virtualbox ];
     loader = {
       systemd-boot = {
         enable = true;
@@ -12,6 +10,5 @@
       };
       efi.canTouchEfiVariables = true;
     };
-    kernelParams = [ "kvm.enable_virt_at_load=0" ];
   };
 }

modules/system/default.nix

@@ -3,7 +3,6 @@
 }:
 {
   imports = [
-    ./agenix.nix
     ./boot.nix
     ./fileSystems.nix
     ./fonts.nix
@@ -12,8 +11,6 @@
     ./security.nix
     ./services.nix
     ./system.nix
-    ./tailscale.nix
     ./user.nix
-    ./virtualisation.nix
   ];
 }

modules/system/fileSystems.nix

@@ -1,45 +0,0 @@
-{
-  pkgs,
-  config,
-  ...
-}:
-let
-  automount_opts = [
-    "x-systemd.automount"
-    "x-systemd.idle-timeout=60"
-    "x-systemd.device-timeout=5s"
-    "x-systemd.mount-timeout=5s"
-    "noauto"
-    "user"
-    "users"
-  ];
-in
-{
-  fileSystems = {
-    "/mnt/EclypseCloud" = {
-      device = "//100.78.212.35/EclypseCloud";
-      fsType = "cifs";
-      options = [
-        "credentials=${config.age.secrets.eclypsecloud-eclypse.path}"
-        "uid=${toString config.users.users.eclypse.uid}"
-        "rw"
-      ]
-      ++ automount_opts;
-    };
-    "/mnt/Music" = {
-      device = "//100.78.212.35/music";
-      fsType = "cifs";
-      options = [
-        "credentials=${config.age.secrets.eclypsecloud-eclypse.path}"
-        "uid=${toString config.users.users.eclypse.uid}"
-        "rw"
-      ]
-      ++ automount_opts;
-    };
-  };
-
-  environment.systemPackages = with pkgs; [
-    cifs-utils
-    # rclone
-  ];
-}

modules/system/tailscale.nix

@@ -1,31 +0,0 @@
-{
-  config,
-  pkgs,
-  ...
-}:
-{
-  services.tailscale = {
-    enable = true;
-    useRoutingFeatures = "client";
-    authKeyFile = config.age.secrets.tailscale-auth.path;
-
-    # * Only applied if `authKeyFile` is specified
-    extraUpFlags = [
-      "--ssh"
-      "--accept-routes=true"
-    ];
-    extraSetFlags = [
-      "--operator=eclypse"
-    ];
-  };
-
-  # Taildrop
-  systemd.user.services.taildrop = {
-    description = "Taildrop File Receiver Service";
-    wantedBy = [ "default.target" ];
-    serviceConfig = {
-      Type = "simple";
-      ExecStart = "${pkgs.tailscale}/bin/tailscale file get --verbose --loop %h/Downloads/";
-    };
-  };
-}

modules/system/user.nix

@@ -2,7 +2,6 @@
   inputs,
   pkgs,
   host,
-  config,
   ...
 }:
 {
@@ -22,8 +21,6 @@
       };
       programs.home-manager.enable = true;
     };
-
-    backupFileExtension = "backup18";
   };
 
   users.mutableUsers = false;
@@ -35,7 +32,7 @@
       "networkmanager"
       "wheel"
     ];
-    hashedPasswordFile = config.age.secrets.eclypse-password.path;
+    hashedPassword = "$6$33qMKGMsdYC//e/s$Z2mQCqDOwbP185OVOLsE63hg.orMrBbxR8WHIiZ9dAnNk3jgEsEU218qtgsQsyATvjsyHUPBQjsa/3JmNLoMM0";
     shell = pkgs.zsh;
   };
 }

modules/system/virtualisation.nix

@@ -1,8 +0,0 @@
-{
-  ...
-}:
-{
-  virtualisation.virtualbox.host.enable = true;
-  virtualisation.virtualbox.host.enableExtensionPack = true;
-  users.extraGroups.vboxusers.members = [ "eclypse" ];
-}

secrets/eclypse-password.age

@@ -1,6 +0,0 @@
-age-encryption.org/v1
--> ssh-ed25519 7p4RPw wZdiee1a8rqdaNA8EVLUJIEue1ldgrk3HgVGhmHpnTQ
-8VLt5rSvqN+HAHS9JL6hYSj7xVrTtZAcrn5C12it+Fw
---- 9oiyRlMDS7PrUyP4SmkgcMZz+/BENDBn9XN+3216OXY
-<EFBFBD>%<25>v*|<7C>M<EFBFBD>3<EFBFBD>g<EFBFBD>g<EFBFBD>%;F"s<15><><0B> <20>7<EFBFBD>Uj<55>_H<5F><48><1F><>D<EFBFBD>^*B<>nK'
-v<EFBFBD><EFBFBD>~<7E>`<60>

secrets/eclypsecloud-eclypse.age

@@ -1,5 +0,0 @@
-age-encryption.org/v1
--> ssh-ed25519 7p4RPw dVTohhNu/jjHSNyhw7irzffqzJJFvW0TbkhSmKKrhS8
-zTc4HaFO3hSYVLM35KwEGUcu2R+JGHIN758FpKKxL5U
---- EhTyT6CYdKjAC9yN0kCxx5yW4o27DJteu8YCbVF2Ln4
-<EFBFBD>ܬ<EFBFBD><EFBFBD><EFBFBD><EFBFBD>}<7D>P<EFBFBD><50>l<EFBFBD><6C>'<27><>,QLג5P<13>SMs<4D><0C><₼<><E282BC>z<EFBFBD><7A><EFBFBD><EFBFBD><EFBFBD>yQ<0C>o<EFBFBD> t[a0<0F><>U<EFBFBD><12>z?R<>"&ߨC<DFA8><43><EFBFBD>l<EFBFBD>

secrets/secrets.nix

@@ -1,19 +0,0 @@
-# This file is NOT imported into the nix configuration, it is just for the agenix CLI
-let
-  # System public ssh keys (/etc/ssh/)
-  vanta = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAaDVBJdMDFL8r9NQCbaLe+DPHGhGzRv2N7+7m1/U8DP";
-in
-{
-  # Tailscale auth key need to be up to date with a valid auth key in the tailscale
-  # dashboard. Single-use keys expire after a single machine connects, and even
-  # reusable keys expire after 90 days.
-  # Update tailscale-auth.age with `agenix -e tailscale-auth.age -i /path/to/private-ssh-key`
-  # Note: Only devices with the below public keys are allowed to edit tailscale-auth.age
-  "tailscale-auth.age".publicKeys = [ vanta ]; # Devices allowed to join the tailnet;
-
-  # Devices that can connect to EclypseCloud with the eclypse user.
-  "eclypsecloud-eclypse.age".publicKeys = [ vanta ];
-
-  # Devices that have the eclypse user
-  "eclypse-password.age".publicKeys = [ vanta ];
-}

secrets/tailscale-auth.age

@@ -1,6 +0,0 @@
-age-encryption.org/v1
--> ssh-ed25519 7p4RPw 7GuZj43+NoyPXf//ZLM99vossbJXOpDQSkBi3w51Wl8
-FTMjlyml+T87LQffffY2AJL5IhTAJF2QlfFvhvZpvOs
---- iONf8B3bUxXtCiv0EAv5QO0ZyhE5A6YfRbcxUr/awFg
-<EFBFBD><0E><><EFBFBD>Tw<54><77>J`<60>~B
-<EFBFBD><11>;<3B>lOh<4F><68>{2<>?<3F><>P<EFBFBD><50>F>@m<>
o<><6F>c<EFBFBD><1C>~X<>3<EFBFBD>@.g<0E>ھ<EFBFBD>eK<65><18>V7zphS<68><53>د6<D8AF><36>.W<><57>O@F