servers/mermet/machine/apu2e4.nix

   1 { pkgs, lib, config, ... }:
   2 let inherit (builtins.extraBuiltins) pass pass-to-file;
   3     inherit (config) networking;
   4     userPass = name: pass "${networking.domainBase}/${networking.hostName}/login/${name}";
   5 in
   6 {
   7   imports =
   8     [ <nixpkgs/nixos/modules/installer/scan/not-detected.nix>
   9     ];
  10
  11   boot.loader = {
  12     grub = {
  13       enable = true;
  14       version = 2;
  15       copyKernels = true;
  16       # efiSupport = true;
  17       devices = [
  18         "/dev/disk/by-id/ata-Samsung_SSD_840_EVO_250GB_S1DBNSAF340110R"
  19       ];
  20       /*
  21       mirroredBoots = [
  22         { devices = [ "${disk_id}" ];
  23           path    = "/boot${bootnum}";
  24         }
  25       ];
  26       */
  27     };
  28     /*
  29     efi = {
  30       canTouchEfiVariables = true;
  31       efiSysMountPoint = "/boot/efi";
  32       efiInstallAsRemovable = false;
  33     };
  34     */
  35   };
  36
  37   boot.initrd = {
  38     availableKernelModules = [
  39       "ahci"
  40       "ehci_pci"
  41       "sd_mod"
  42       "uas"
  43       # Made the AES modules available at initrd,
  44       # to speedup the deciphering of the root.
  45       "aes_x86_64"
  46       "aesni_intel"
  47       "cryptd"
  48     ];
  49     kernelModules = [ ];
  50   };
  51   boot.kernelModules = [ ];
  52   boot.extraModulePackages = [ ];
  53   boot.kernelParams = [
  54     "gfxpayload=text"
  55     "console=tty0"
  56     "console=ttyS0,115200n8"
  57     # DEBUG: "boot.shell_on_fail"
  58     "zfs.zfs_arc_max=262144000" # 250Mo
  59   ];
  60   boot.kernel = {
  61     sysctl = {
  62       "vm.swappiness" = 10;
  63       "vm.vfs_cache_pressure" = 50;
  64     };
  65   };
  66
  67   boot.initrd.network = {
  68     # This will use udhcp to get an ip address.
  69     # Make sure you have added the kernel module for your network driver to `boot.initrd.availableKernelModules`,
  70     # so your initrd can load it!
  71     # Static ip addresses might be configured using the ip argument in kernel command line:
  72     # https://www.kernel.org/doc/Documentation/filesystems/nfs/nfsroot.txt
  73     enable = true;
  74     ssh = {
  75        enable = true;
  76        # To prevent ssh from freaking out because a different host key is used,
  77        # a different port for dropbear is useful (assuming the same host has also a normal sshd running)
  78        port = 2222;
  79        # dropbear uses key format different from openssh; can be generated by using:
  80        # $ nix-shell -p dropbear --command "dropbearkey -t ecdsa -f /tmp/initrd-ssh-key"
  81        # WARNING: this key will be in the NixOS store and the initrd and thus maybe on cleartext storage.
  82        # Unfortunately pass cannot be used here because the key is not a valid Nix string.
  83        hostECDSAKey = ../../../.sec/dropbear/mermet.dropbear-ecdsa.key ;
  84        # public ssh key used for login
  85        authorizedKeys = [
  86          # julm
  87          # readFile ../../../.pub/ssh/julm.ssh-rsa.pub
  88          "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQD5FtR++UPEg/5wFeyb2JSS09idTaDb4tMIRf1yxCsyIJEp5LQMif/fIptDeHoYc55lwy8vnWWN9PJpb6PS8YSaLLFV5tn8esR8Ml+evNCAD52Tdu1kPRXGLCSF5kSVnbAMoxqiNi8vRRKXwAzGgXmIUzDAE4QTsq3EwZM6cBnDx5O79wBIZ9va2TObL52qv+Vpi+QyINuslKKc+Osu92pdwceIGZUcwA6Y8aH6lavaTyDUQdSjMRMTAiXSPRjmHf1q+V7wENXT/TKXuuahN8NnJShX3Qf9hwNEIU46SOENsrRFQ5eYahAmqUIK4GbsERS2KRDxbvSOl7rKh2sauBxyKfkW/gxQ4LAyywxuumpI0pO7XmdINCGWdXS9gD216lcGuH/TC0KboiOVExh65eRIOeEFTec0VJQEqqnFul7u8YNPmbBpLnM+SQ3TAkdQmfasKgPIazFNCAnC8I9hKlGYpLk/Dgi/sVbwFeoOUQcaTBRnWKUCedX4v4kmPIHuHSNPV2C/0770gH2iJ1N1XEO3YDGiixuHHiLlCV8Ko950CoTh1PwDNCd3Qy/jR/QhE2waVPliFwl2+H6IkIxkUO8A9ktLCJUeaZJN3snoV+9hvpT1E2TrEccsTVx5BaGAJCUkvO2XYlEsNceIIitkrbhidjZvfZ4/czGUKoN1wSSpMw== GnuPG pub=F2E027182397AC0775714F2AD15AF7F467E8299B sub=7819E44BAEEDE91683811BB00E1AAADBE227DDAA"
  89        ];
  90     };
  91     # this will automatically load the zfs password prompt on login
  92     # and kill the other prompt so boot can continue
  93     postCommands = ''
  94       #zpool import rpool
  95       echo "zfs load-key -a; killall zfs" >> /root/.profile
  96     '';
  97   };
  98
  99   fileSystems."/boot" =
 100     { device = "/dev/disk/by-uuid/dc3c5387-17d2-43b3-bfa2-bf73afacca07";
 101       fsType = "ext2";
 102     };
 103
 104   fileSystems."/boot/efi" =
 105     { device = "/dev/disk/by-uuid/62E6-E65F";
 106       fsType = "vfat";
 107     };
 108
 109   swapDevices =
 110     [ { device = "/dev/disk/by-partuuid/6b1eaa35-776b-4e60-b21e-7bcee535dd8b";
 111         randomEncryption = {
 112           enable = true;
 113           cipher = "aes-xts-plain64";
 114           source = "/dev/urandom";
 115         };
 116       }
 117     ];
 118
 119   nix.maxJobs = lib.mkDefault 4;
 120   powerManagement.cpuFreqGovernor = lib.mkDefault "ondemand";
 121 }