add vm.strangervm host

hosts/vm.strangervm.ts.hillion.co.uk/default.nix

@@ -0,0 +1,26 @@
+{ config, pkgs, lib, ... }:
+
+{
+  system.stateVersion = "22.05";
+
+  networking.hostName = "vm";
+  networking.domain = "strangervm.ts.hillion.co.uk";
+ 
+  imports = [
+    ./hardware-configuration.nix
+    ../../modules/common/default.nix
+    ../../modules/secrets/tailscale/vm.strangervm.ts.hillion.co.uk.nix
+  ];
+
+  boot.loader.grub = {
+    enable = true;
+    device = "/dev/sda";
+  };
+
+  networking.interfaces.ens18.ipv4.addresses = [{
+    address = "10.72.164.3";
+    prefixLength = 24;
+  }];
+  networking.defaultGateway = "10.72.164.1";
+}
+

hosts/vm.strangervm.ts.hillion.co.uk/hardware-configuration.nix

@@ -0,0 +1,32 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports =
+    [ (modulesPath + "/profiles/qemu-guest.nix")
+    ];
+
+  boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "virtio_scsi" "sd_mod" "sr_mod" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-intel" ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" =
+    { device = "/dev/disk/by-uuid/6d59bd4b-439d-4480-897c-4480ea6fbe56";
+      fsType = "ext4";
+    };
+
+  swapDevices = [ ];
+
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  networking.useDHCP = lib.mkDefault true;
+  # networking.interfaces.ens18.useDHCP = lib.mkDefault true;
+
+  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+}
+

modules/common/authorized_keys

@@ -0,0 +1,6 @@
+ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBOt74U+rL+BMtAEjfu/Optg1D7Ly7U+TupRxd5u9kfN7oJnW4dJA25WRSr4dgQNq7MiMveoduBY/ky2s0c9gvIA= jake@jake-gentoo
+ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBC0uKIvvvkzrOcS7AcamsQRFId+bqPwUC9IiUIsiH5oWX1ReiITOuEo+TL9YMII5RyyfJFeu2ZP9moNuZYlE7Bs= jake@jake-mbp
+
+ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEAyFsYYjLZ/wyw8XUbcmkk6OKt2IqLOnWpRE5gEvm3X0V4IeTOL9F4IL79h7FTsPvi2t9zGBL1hxeTMZHSGfrdWaMJkQp94gA1W30MKXvJ47nEVt0HUIOufGqgTTaAn4BHxlFUBUuS7UxaA4igFpFVoPJed7ZMhMqxg+RWUmBAkcgTWDMgzUx44TiNpzkYlG8cYuqcIzpV2dhGn79qsfUzBMpGJgkxjkGdDEHRk66JXgD/EtVasZvqp5/KLNnOpisKjR88UJKJ6/buV7FLVra4/0hA9JtH9e1ecCfxMPbOeluaxlieEuSXV2oJMbQoPP87+/QriNdi/6QuCHkMDEhyGw== jake@jake-mbp
+ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCw4lgH20nfuchDqvVf0YciqN0GnBw5hfh8KIun5z0P7wlNgVYnCyvPvdIlGf2Nt1z5EGfsMzMLhKDOZkcTMlhupd+j2Er/ZB764uVBGe1n3CoPeasmbIlnamZ12EusYDvQGm2hVJTGQPPp9nKaRxr6ljvTMTNl0KWlWvKP4kec74d28MGgULOPLT3HlAyvUymSULK4lSxFK0l97IVXLa8YwuL5TNFGHUmjoSsi/Q7/CKaqvNh+ib1BYHzHYsuEzaaApnCnfjDBNexHm/AfbI7s+g3XZDcZOORZn6r44dOBNFfwvppsWj3CszwJQYIFeJFuMRtzlC8+kyYxci0+FXHn jake@jake-gentoo
+

modules/common/default.nix

@@ -0,0 +1,53 @@
+{ pkgs, lib, config, ... }:
+
+{
+  imports = [
+    ./shell.nix
+    ./ssh.nix
+    ./tailscale.nix
+  ];
+  
+  nix = {
+    settings.experimental-features = [ "nix-command" "flakes" ];
+    settings = {
+      auto-optimise-store = true;
+    };
+    gc = {
+      automatic = true;
+      dates = "weekly";
+      options = "--delete-older-than 90d";
+    };
+  };
+
+  time.timeZone = "Europe/London";
+  i18n.defaultLocale = "en_GB.UTF-8";
+
+  users = {
+    mutableUsers = false;
+    users."jake" = {
+      isNormalUser = true;
+      extraGroups = [ "wheel" ]; # enable sudo
+      shell = pkgs.zsh;
+    };
+  };
+
+  security.sudo.wheelNeedsPassword = false;
+
+  environment = {
+    systemPackages = with pkgs; [
+      git
+      htop
+      nix
+      vim
+    ];
+    variables.EDITOR = "vim";
+    shellAliases = {
+      ls = "ls -p --color=auto";
+    };
+  };
+
+  networking = rec {
+    nameservers = [ "1.1.1.1" "8.8.8.8" "100.100.100.100" ];
+    networkmanager.dns = "none";
+  };
+}

modules/common/shell.nix

@@ -0,0 +1,12 @@
+{ lib, config, ... }:
+
+{
+  config.programs.zsh = {
+    enable = true;
+    histSize = 100000;
+    syntaxHighlighting = {
+      enable = true;
+    };
+  };
+}
+

modules/common/ssh.nix

@@ -0,0 +1,14 @@
+{ pkgs, lib, config, ... }:
+
+{
+  users.mutableUsers = false;
+  users.users."jake".openssh.authorizedKeys.keyFiles = [ ./authorized_keys ];
+
+  programs.mosh.enable = true;
+  services.openssh = {
+    enable = true;
+    permitRootLogin = "no";
+    passwordAuthentication = false;
+  };
+}
+

modules/common/tailscale.nix

@@ -0,0 +1,50 @@
+{ pkgs, lib, config, ... }:
+
+{
+  options.tailscalePreAuth = lib.mkOption {
+    type = lib.types.str;
+  };
+  options.tailscaleAdvertiseRoutes = lib.mkOption {
+    type = lib.types.str;
+    default = "";
+  };
+
+  # make the tailscale command usable to users
+  config.environment.systemPackages = [ pkgs.tailscale ];
+
+  # enable the tailscale service
+  config.services.tailscale.enable = true;
+
+  config.systemd.services.tailscale-autoconnect = {
+    description = "Automatic connection to Tailscale";
+
+    # make sure tailscale is running before trying to connect to tailscale
+    after = [ "network-pre.target" "tailscale.service" ];
+    wants = [ "network-pre.target" "tailscale.service" ];
+    wantedBy = [ "multi-user.target" ];
+
+    # set this service as a oneshot job
+    serviceConfig.Type = "oneshot";
+
+    # have the job run this shell script
+    script = with pkgs; ''
+      # wait for tailscaled to settle
+      sleep 2
+
+      # check if we are already authenticated to tailscale
+      status="$(${tailscale}/bin/tailscale status -json | ${jq}/bin/jq -r .BackendState)"
+      if [ $status = "Running" ]; then # if so, then do nothing
+        exit 0
+      fi
+
+      # otherwise authenticate with tailscale
+      ${tailscale}/bin/tailscale up \
+        --login-server https://ts.hillion.co.uk/ \
+        --authkey ${config.tailscalePreAuth} \
+        --advertise-routes "${config.tailscaleAdvertiseRoutes}"
+    '';
+  };
+
+}
+
+

modules/secrets

@@ -1 +1 @@
-Subproject commit 921cd5a26fded8bdeacf47c464d7c06622920315
+Subproject commit 1f411f096e6b0059c4d31fb14dc6f4f2e91659c7