]> Git — Sourcephile - sourcephile-nix.git/blob - servers/mermet/machine/apu2e4.nix
nix: revamp the hierarchy (again)
[sourcephile-nix.git] / servers / mermet / machine / apu2e4.nix
1 { pkgs, lib, config, ... }:
2 let inherit (builtins.extraBuiltins) pass pass-to-file;
3 inherit (config) networking;
4 userPass = name: pass "${networking.domainBase}/${networking.hostName}/login/${name}";
5 in
6 {
7 imports =
8 [ <nixpkgs/nixos/modules/installer/scan/not-detected.nix>
9 ];
10
11 boot.loader = {
12 grub = {
13 enable = true;
14 version = 2;
15 copyKernels = true;
16 # efiSupport = true;
17 devices = [
18 "/dev/disk/by-id/ata-Samsung_SSD_840_EVO_250GB_S1DBNSAF340110R"
19 ];
20 /*
21 mirroredBoots = [
22 { devices = [ "${disk_id}" ];
23 path = "/boot${bootnum}";
24 }
25 ];
26 */
27 };
28 /*
29 efi = {
30 canTouchEfiVariables = true;
31 efiSysMountPoint = "/boot/efi";
32 efiInstallAsRemovable = false;
33 };
34 */
35 };
36
37 boot.initrd = {
38 availableKernelModules = [
39 "ahci"
40 "ehci_pci"
41 "sd_mod"
42 "uas"
43 # Made the AES modules available at initrd,
44 # to speedup the deciphering of the root.
45 "aes_x86_64"
46 "aesni_intel"
47 "cryptd"
48 ];
49 kernelModules = [ ];
50 };
51 boot.kernelModules = [ ];
52 boot.extraModulePackages = [ ];
53 boot.kernelParams = [
54 "gfxpayload=text"
55 "console=tty0"
56 "console=ttyS0,115200n8"
57 # DEBUG: "boot.shell_on_fail"
58 "zfs.zfs_arc_max=262144000" # 250Mo
59 ];
60 boot.kernel = {
61 sysctl = {
62 "vm.swappiness" = 10;
63 "vm.vfs_cache_pressure" = 50;
64 };
65 };
66
67 boot.initrd.network = {
68 # This will use udhcp to get an ip address.
69 # Make sure you have added the kernel module for your network driver to `boot.initrd.availableKernelModules`,
70 # so your initrd can load it!
71 # Static ip addresses might be configured using the ip argument in kernel command line:
72 # https://www.kernel.org/doc/Documentation/filesystems/nfs/nfsroot.txt
73 enable = true;
74 ssh = {
75 enable = true;
76 # To prevent ssh from freaking out because a different host key is used,
77 # a different port for dropbear is useful (assuming the same host has also a normal sshd running)
78 port = 2222;
79 # dropbear uses key format different from openssh; can be generated by using:
80 # $ nix-shell -p dropbear --command "dropbearkey -t ecdsa -f /tmp/initrd-ssh-key"
81 # WARNING: this key will be in the NixOS store and the initrd and thus maybe on cleartext storage.
82 # Unfortunately pass cannot be used here because the key is not a valid Nix string.
83 hostECDSAKey = ../../../.sec/dropbear/mermet.dropbear-ecdsa.key ;
84 # public ssh key used for login
85 authorizedKeys = [
86 # julm
87 # readFile ../../../.pub/ssh/julm.ssh-rsa.pub
88 "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQD5FtR++UPEg/5wFeyb2JSS09idTaDb4tMIRf1yxCsyIJEp5LQMif/fIptDeHoYc55lwy8vnWWN9PJpb6PS8YSaLLFV5tn8esR8Ml+evNCAD52Tdu1kPRXGLCSF5kSVnbAMoxqiNi8vRRKXwAzGgXmIUzDAE4QTsq3EwZM6cBnDx5O79wBIZ9va2TObL52qv+Vpi+QyINuslKKc+Osu92pdwceIGZUcwA6Y8aH6lavaTyDUQdSjMRMTAiXSPRjmHf1q+V7wENXT/TKXuuahN8NnJShX3Qf9hwNEIU46SOENsrRFQ5eYahAmqUIK4GbsERS2KRDxbvSOl7rKh2sauBxyKfkW/gxQ4LAyywxuumpI0pO7XmdINCGWdXS9gD216lcGuH/TC0KboiOVExh65eRIOeEFTec0VJQEqqnFul7u8YNPmbBpLnM+SQ3TAkdQmfasKgPIazFNCAnC8I9hKlGYpLk/Dgi/sVbwFeoOUQcaTBRnWKUCedX4v4kmPIHuHSNPV2C/0770gH2iJ1N1XEO3YDGiixuHHiLlCV8Ko950CoTh1PwDNCd3Qy/jR/QhE2waVPliFwl2+H6IkIxkUO8A9ktLCJUeaZJN3snoV+9hvpT1E2TrEccsTVx5BaGAJCUkvO2XYlEsNceIIitkrbhidjZvfZ4/czGUKoN1wSSpMw== GnuPG pub=F2E027182397AC0775714F2AD15AF7F467E8299B sub=7819E44BAEEDE91683811BB00E1AAADBE227DDAA"
89 ];
90 };
91 # this will automatically load the zfs password prompt on login
92 # and kill the other prompt so boot can continue
93 postCommands = ''
94 #zpool import rpool
95 echo "zfs load-key -a; killall zfs" >> /root/.profile
96 '';
97 };
98
99 fileSystems."/boot" =
100 { device = "/dev/disk/by-uuid/dc3c5387-17d2-43b3-bfa2-bf73afacca07";
101 fsType = "ext2";
102 };
103
104 fileSystems."/boot/efi" =
105 { device = "/dev/disk/by-uuid/62E6-E65F";
106 fsType = "vfat";
107 };
108
109 swapDevices =
110 [ { device = "/dev/disk/by-partuuid/6b1eaa35-776b-4e60-b21e-7bcee535dd8b";
111 randomEncryption = {
112 enable = true;
113 cipher = "aes-xts-plain64";
114 source = "/dev/urandom";
115 };
116 }
117 ];
118
119 nix.maxJobs = lib.mkDefault 4;
120 powerManagement.cpuFreqGovernor = lib.mkDefault "ondemand";
121 }