be.lt: add beryllium laptop

hosts/be.lt.ts.hillion.co.uk/default.nix

@@ -0,0 +1,43 @@
+{ config, pkgs, lib, ... }:
+
+{
+  imports = [
+    ../../modules/common/default.nix
+    ./hardware-configuration.nix
+  ];
+
+  config = {
+    system.stateVersion = "23.11";
+
+    networking.hostName = "be";
+    networking.domain = "lt.ts.hillion.co.uk";
+
+    boot.loader.systemd-boot.enable = true;
+    boot.loader.efi.canTouchEfiVariables = true;
+
+    ## Impermanence
+    custom.impermanence = {
+      enable = true;
+      userExtraFiles.jake = [
+        ".ssh/id_ecdsa_sk_keys"
+      ];
+    };
+
+    ## Desktop
+    custom.users.jake.password = true;
+    custom.desktop.awesome.enable = true;
+
+    ## Tailscale
+    age.secrets."tailscale/be.lt.ts.hillion.co.uk".file = ../../secrets/tailscale/be.lt.ts.hillion.co.uk.age;
+    services.tailscale = {
+      enable = true;
+      authKeyFile = config.age.secrets."tailscale/be.lt.ts.hillion.co.uk".path;
+    };
+
+    security.sudo.wheelNeedsPassword = lib.mkForce true;
+
+    ## Enable btrfs compression
+    fileSystems."/data".options = [ "compress=zstd" ];
+    fileSystems."/nix".options = [ "compress=zstd" ];
+  };
+}

hosts/be.lt.ts.hillion.co.uk/hardware-configuration.nix

@@ -0,0 +1,54 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports =
+    [ (modulesPath + "/installer/scan/not-detected.nix")
+    ];
+
+  boot.initrd.availableKernelModules = [ "xhci_pci" "nvme" "usbhid" "usb_storage" "sd_mod" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-intel" ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" =
+    { device = "tmpfs";
+      fsType = "tmpfs";
+      options = [ "mode=0755" ];
+    };
+
+  fileSystems."/boot" =
+    { device = "/dev/disk/by-uuid/D184-A79B";
+      fsType = "vfat";
+    };
+
+  fileSystems."/nix" =
+    { device = "/dev/disk/by-uuid/3fdc1b00-28d5-41dd-b8e0-fa6b1217f6eb";
+      fsType = "btrfs";
+      options = [ "subvol=nix" ];
+    };
+
+  boot.initrd.luks.devices."root".device = "/dev/disk/by-uuid/c8ffa91a-5152-4d84-8995-01232fd5acd6";
+
+  fileSystems."/data" =
+    { device = "/dev/disk/by-uuid/3fdc1b00-28d5-41dd-b8e0-fa6b1217f6eb";
+      fsType = "btrfs";
+      options = [ "subvol=data" ];
+    };
+
+  swapDevices = [ ];
+
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  networking.useDHCP = lib.mkDefault true;
+  # networking.interfaces.enp0s20f0u1u4.useDHCP = lib.mkDefault true;
+  # networking.interfaces.wlp1s0.useDHCP = lib.mkDefault true;
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  powerManagement.cpuFreqGovernor = lib.mkDefault "powersave";
+  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+}

hosts/be.lt.ts.hillion.co.uk/system

@@ -0,0 +1 @@
+x86_64-linux

modules/common/ssh.nix

@@ -2,6 +2,8 @@
 
 {
   users.users."jake".openssh.authorizedKeys.keys = [
+    "sk-ecdsa-sha2-nistp256@openssh.com AAAAInNrLWVjZHNhLXNoYTItbmlzdHAyNTZAb3BlbnNzaC5jb20AAAAIbmlzdHAyNTYAAABBBBwJH4udKNvi9TjOBgkxpBBy7hzWqmP0lT5zE9neusCpQLIiDhr6KXYMPXWXdZDc18wH1OLi2+639dXOvp8V/wgAAAAEc3NoOg== jake@beryllium-keys"
+
     "ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBOt74U+rL+BMtAEjfu/Optg1D7Ly7U+TupRxd5u9kfN7oJnW4dJA25WRSr4dgQNq7MiMveoduBY/ky2s0c9gvIA= jake@jake-gentoo"
     "ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBC0uKIvvvkzrOcS7AcamsQRFId+bqPwUC9IiUIsiH5oWX1ReiITOuEo+TL9YMII5RyyfJFeu2ZP9moNuZYlE7Bs= jake@jake-mbp"
 
@@ -26,6 +28,7 @@
     "ssh.gitea.hillion.co.uk".publicKey = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCxQpywsy+WGeaEkEL67xOBL1NIE++pcojxro5xAPO6VQe2N79388NRFMLlX6HtnebkIpVrvnqdLOs0BPMAokjaWCC4Ay7T/3ko1kXSOlqHY5Ye9jtjRK+wPHMZgzf74a3jlvxjrXJMA70rPQ3X+8UGpA04eB3JyyLTLuVvc6znMe53QiZ0x+hSz+4pYshnCO2UazJ148vV3htN6wRK+uqjNdjjQXkNJ7llNBSrvmfrLidlf0LRphEk43maSQCBcLEZgf4pxXBA7rFuZABZTz1twbnxP2ziyBaSOs7rcII+jVhF2cqJlElutBfIgRNJ3DjNiTcdhNaZzkwJ59huR0LUFQlHI+SALvPzE9ZXWVOX/SqQG+oIB8VebR52icii0aJH7jatkogwNk0121xmhpvvR7gwbJ9YjYRTpKs4lew3bq/W/OM8GF/FEuCsCuNIXRXKqIjJVAtIpuuhxPymFHeqJH3wK3f6jTJfcAz/z33Rwpow2VOdDyqrRfAW8ti73CCnRlN+VJi0V/zvYGs9CHldY3YvMr7rSd0+fdGyJHSTSRBF0vcyRVA/SqSfcIo/5o0ssYoBnQCg6gOkc3nNQ0C0/qh1ww17rw4hqBRxFJ2t3aBUMK+UHPxrELLVmG6ZUmfg9uVkOoafjRsoML6DVDB4JAk5JsmcZhybOarI9PJfEQ==";
 
     # Tailscale hosts
+    "be.lt.ts.hillion.co.uk".publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILV3OSUT+cqFqrFHZGfn7/xi5FW3n1qjUFy8zBbYs2Sm";
     "dancefloor.dancefloor.ts.hillion.co.uk".publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEXkGueVYKr2wp/VHo2QLis0kmKtc/Upg3pGoHr6RkzY";
     "gendry.jakehillion.terminals.ts.hillion.co.uk".publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPXM5aDvNv4MTITXAvJWSS2yvr/mbxJE31tgwJtcl38c";
     "homeassistant.homeassistant.ts.hillion.co.uk".publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPM2ytacl/zYXhgvosvhudsl0zW5eQRHXm9aMqG9adux";

modules/impermanence.nix

@@ -45,7 +45,7 @@ in
 
       directories = [
         "/etc/nixos"
-      ] ++ (listIf config.custom.tailscale.enable [ "/var/lib/tailscale" ]) ++
+      ] ++ (listIf (config.services.tailscale.enable || config.custom.tailscale.enable) [ "/var/lib/tailscale" ]) ++
       (listIf config.services.zigbee2mqtt.enable [ config.services.zigbee2mqtt.dataDir ]) ++
       (listIf config.services.postgresql.enable [ config.services.postgresql.dataDir ]) ++
       (listIf config.hardware.bluetooth.enable [ "/var/lib/bluetooth" ]) ++

secrets/passwords/jake.age

@@ -1,21 +1,25 @@
 age-encryption.org/v1
 -> ssh-rsa GxPFJQ
-clM3ZZ+BrFyrKzQEptaVd8zHVtQJZi2gCxeQcdr4X07XFFfDoz+Ft2uY8+FVq54E
+V2AvkOD5bHByhebVLzXhGpKgD+ZbpXVU8qizj+nvcmsapadSjtnqo/PYHLatc3Hc
-U2d1Qorf14/K7ubHlTMFcTLksD9CsMSpj4tiVzZ6jLzoL2g8ygsnllyT2IcG6dmB
+9zJoCvW4hXu8DVx6sgEapBUibny8mRBUYm58yxi9UIv4PfutFfOqAaTDolOZkVr2
-8ZLRL+agcZJo+9cfdxOYwJTzjbDuuhGKsQDfS5T833CgDfleJ96XVFkDEnf4yQcB
+5cNY6JTjB8l3x0j+rQfSATMebCJr0mexi/vCxfk20BYAYxm71FWa/3HchH5ktf76
-DBNU4R10SIyHAhRDjZpIRyDAOkwfTVABxHFS9TFfIOWho6tRwfdUeoWAnzqO4wUJ
+YyQFgBG3zSLaWRS8wgWPZxbr3oz2mlQsgAgc2Q+D0RKQ9k9y4MFDy2kQgyBD0mh/
-FFTvnbiX44WU5VbUf7Em/92NDWtDJM98B2s+LbgZpGk3oqcY4iyVJIhi7Tfrz5+m
+LfEy27pFYDcFq5YFrHDx1mzFP6zmdrgNvJtTvIVHurMX0bjkMVvL1EMPkK89zft0
-5EXsa62mgd30xXHkdBp+6w
+2fO5lhEhjN1ZtsiRdi1AHw
 -> ssh-rsa K9mW1w
-hMggZlLSWTyf2LhYSVnvC11S9yPM7GN5uMRYlRyQoppHsHvNMkRQKYdwdzJUX2QA
+Ma3+rklXzp3GvZeLMJRsBFzQn7zx2XSRbeYGjbpwQ15aDaLkvwj30tTkC8T8UOaJ
-5OZ8XQwxct1MAxCp1kiwa7B/EwrlZfoFZgao8VWSs0TZTMCJnYFJ+ETBmVU1JnNa
+BxhMcsqVJtUQ+8VDT+8TI8G6z8FZRincI0RTpLXkjnd7wr+7dJGty3I8lvmAZLfc
-ZOJR+0bTdFMvWCkf5FeIAPz2CeOQ4XfmyU4QMnMdENzUVqPMoB0vPDd9mPNrWeiz
+Lq/ufWLR5siaHbPIdzD7xc3uIOM6uCEtirO69jylsOxI1ln2nFs/XmB7KFKVXFoR
-wuZgD4jqzZDbyuRhveOy4fCBQ485jxnqaT9l+VPQSA9xrDUMC5TA6Vg6yxwmu/hY
+BU7guCumIoxrPU/PRXsSxW2ZgnI/gMGzTFxdfBB+DG5ji3FQJDlQw7PZSKZV3e9r
-pv1Dni7aCiYALRPr7UK2hNUU84cG+8eFf53w+rngzt1lZElvjO0Oailaz5weCkP7
+0zOnJiRIdxwcdw22C5OWPV0NmchcVk07RVMC7g7ZlYn1ZvzyH4F6915vBO0AliQn
-nmSfOOpf5/sHE8uhHb9TSA
+owjfSi9xeR8B+6prms40Mw
--> ssh-ed25519 rjda/A rnnAChws0QFbuQeviARY1GxIMf7Q1EGcLclq9b/pFxM
+-> ssh-ed25519 rjda/A R372Lvn/wI+8QHzPHlfdjHbJdsd3CpUP+rDGgBQJCWI
-sOIHM3BMvKIKzXi14CRXJEiIHikJuRf2cl5egADncV4
+PohaMx5p6FHhx+EwypsBRHq2R3ujNU8UpbmYS8TKOBM
--> ssh-ed25519 8+Ls0w tJ9gHXR03ez8quA9/KSLzc+g8y1HE7RJ6SPsJ8O66hY
+-> ssh-ed25519 8+Ls0w jQRlUZRjOdFjp2jmKLBWiG1EM6XP1JYScC+y5ju62mA
-J+YWnfPQClYZRZehQco7zpCZUorLYv8uNinfmcEtq+o
+Siiu+PBmnnlXkY3iP16fOaqADppeMLW9csE6ezXOLCQ
---- iHsZcXh9VESnGPGMQnB7mdn3EVgCUXduFshfX1q88q0
+-> ssh-ed25519 ikTTQA qQIFOuadfKL5Ie3YekLaMDP5txofg9RDtirNvuun4DQ
-ęAZZ›Ź=É:“N3ĘVL¨AÓ"6Nčć4µ†áŇş:éƉX`řÍżkÔýěČ
<01>9Ŕs/rćaWîÍPŐ@§z<C2A7>ínµ›E,PŃ{0V$’mÎj'"=ŽLîŁ&B9$ú(<1B>w†,m›ô©gŚźÉtT8J<˙©0ťú…
_<>!˙PEv®JÎY鳲ě
+C+o9BE/MLnklCpTqR3z4VDULpcHuGolyxfDRMvmzSDM
+--- 6gNHbYKsXqKslBJBUbRtAGIGQqqS2uulAq7tmlOBYm4
+(rÒNäP+ƒ£_ŠC‹<43>¡L±s¾—Çë ôíz#vó-) `ÌâCöj¦ÓíÇëÚÈü}}A•.1üḎW«|
+g¥ôW¶ÓbÏ)Ç
+
»4_•X¹¢a¸rH…Ø»¾Ý@Aô}YÄüz¶Q€óp«¦Éà(•2øÅm%nš‡

secrets/secrets.nix

@@ -17,6 +17,7 @@ let
               microserver = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPPOCPqXm5a+vGB6PsJFvjKNgjLhM5MxrwCy6iHGRjXw root@microserver";
               router = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAlCj/i2xprN6h0Ik2tthOJQy6Qwq3Ony73+yfbHYTFu root@router";
             };
+            lt = { be = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILV3OSUT+cqFqrFHZGfn7/xi5FW3n1qjUFy8zBbYs2Sm root@be"; };
             pop = { li = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHQWgcDFL9UZBDKHPiEGepT1Qsc4gz3Pee0/XVHJ6V6u root@li"; };
             terminals = { jakehillion = { gendry = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPXM5aDvNv4MTITXAvJWSS2yvr/mbxJE31tgwJtcl38c root@gendry"; }; };
             storage = {
@@ -34,9 +35,14 @@ let
 in
 {
   # User Passwords
-  "passwords/jake.age".publicKeys = jake_users ++ [ ts.terminals.jakehillion.gendry ts.home.router ];
+  "passwords/jake.age".publicKeys = jake_users ++ [
+    ts.terminals.jakehillion.gendry
+    ts.home.router
+    ts.lt.be
+  ];
 
   # Tailscale Pre-Auth Keys
+  "tailscale/be.lt.ts.hillion.co.uk.age".publicKeys = jake_users ++ [ ts.lt.be ];
   "tailscale/gendry.jakehillion-terminals.ts.hillion.co.uk.age".publicKeys = jake_users ++ [ ts.terminals.jakehillion.gendry ];
   "tailscale/jorah.cx.ts.hillion.co.uk.age".publicKeys = jake_users ++ [ ts.cx.jorah ];
   "tailscale/microserver.home.ts.hillion.co.uk.age".publicKeys = jake_users ++ [ ts.home.microserver ];

secrets/tailscale/be.lt.ts.hillion.co.uk.age

@@ -0,0 +1,19 @@
+age-encryption.org/v1
+-> ssh-rsa GxPFJQ
+quD5S+nsgtv5VnsIk08B5Fqhs4oJFmwuw/mj2GwhOhzgMSzF/KiWnkRlcKL3w2LY
+zXnh2hB4kQHeudSNXLEh+3WupvynPcaSiuzBQaG559lBroFHR/Vw90MthhnnJszv
+a0WQzcLy0e+46gyV5PGD+qX281/lLJMztC6onR7WdGwfBdGsv9z/y4RVkGi/A34n
+pfXeJuTAP+tRcIeQCXUP87XBZdXBruNNtlRwM16UaVx2SzQH/WAirTD1zaG9GNG5
+oN8Uj030maXgxVBAzCwyM+9euWllx5XBuvpVsxypB0uqZZV7YJ108tjyY5ydDGTY
+tIV99TBm9IsENczBY85+ng
+-> ssh-rsa K9mW1w
+ZfMMTh58zNW63m9HaAdZ9KmlCiCAWfmMUyYBfnMEc3h7K5bIJPU3E7DymtvlO53/
+CsXMGb+t/cnctrTGlFT2VP8OhoQ5vQfDShjBbS49zYaP6oZR2D0iX7LqRSzZPpQF
+SWyFWnXKvYIRmtSXT8Ld+kfONBna3nLWUcPiBgQjLJ7pcRA2UJb78+t5sDKJp7iu
+CFbOEBIHBwnt5uk4tThzB/uZlJO1UMNRttgW5yyiivUSMHuVL729vllXNN2+4EUn
+H0r88XV6jR6j26Xvx7VmdZV6lLBUFJiBjy353OYfvl7wYWsTMZqRttJi+MZ6kx6V
+5NmbqWhtJ8ZoM3L1oV6DEQ
+-> ssh-ed25519 ikTTQA ahMu1d62ggresMO+p12kL27Sv+m0jMGG+FH9Knq27yM
+0dxGvslHl7EYLOl1nmXPqJBclwtid2+nV3zhJUNa8uQ
+--- JLHa4NeSjrwXflyWsZpr/vFO6SpTGXOpocmEDVOotE8
+0ê„#¿I¼æ¨÷á¥þÆÀæãç¤ÔSòØû5½%ù©³r:oLkÕ?Ÿ<ÈÚ‡ÄN–ù!ÔT¹ä`6·.Ɉxé¶è:Œ¥S~$Uó
nXÐ(ü\d
²;W