Add template host

flake.nix

@@ -28,6 +28,15 @@
             sops-nix.nixosModules.sops
           ];
         };
+        template1 = nixpkgs.lib.nixosSystem {
+          inherit system;
+          specialArgs = { inherit inputs self sops-nix; };
+          modules = [
+            ({ config, pkgs, ... }: { nixpkgs.overlays = [ overlay-unstable ]; })
+            ./hosts/template
+            sops-nix.nixosModules.sops
+          ];
+        };
       };
     };
 }

hosts/ns3/configuration.nix

@@ -3,19 +3,27 @@
 {
   imports =
     [
-      ./hardware-configuration.nix
+      ../template/hardware-configuration.nix
 
-      ../system
+      ../../system
-      ../services/ns/master-authorative.nix
+      ../../services/ns/master-authorative.nix
     ];
 
   nixpkgs.config.allowUnfree = true;
   # Use the systemd-boot EFI boot loader.
-  boot.loader.systemd-boot.enable = true;
+  boot.loader.grub.enable = true;
-  boot.loader.efi.canTouchEfiVariables = true;
+  boot.loader.grub.device = "/dev/sda";
 
-  networking.hostName = "ns3.home.2rjus.net"; # Define your hostname.
+  networking.hostname = "ns3";
+  networking.domain = "home.2rjus.net";
   networking.useNetworkd = true;
+  networking.useDHCP = false;
+  services.resolved.enable = true;
+  networking.nameservers = [
+    "10.69.13.5"
+    "10.69.13.6"
+  ];
+
   systemd.network.enable = true;
   systemd.network.networks."ens18" = {
     matchConfig.Name = "ens18";
@@ -36,10 +44,6 @@
     git
   ];
 
-  # Enable the OpenSSH daemon.
-  services.openssh.enable = true;
-  services.openssh.settings.PermitRootLogin = "yes";
-
   # Open ports in the firewall.
   # networking.firewall.allowedTCPPorts = [ ... ];
   # networking.firewall.allowedUDPPorts = [ ... ];

hosts/template/configuration.nix

@@ -0,0 +1,53 @@
+{ config, lib, pkgs, ... }:
+
+{
+  imports =
+    [
+      ./hardware-configuration.nix
+
+      ../../system
+    ];
+
+
+  boot.loader.grub.enable = true;
+  boot.loader.grub.device = "/dev/sda";
+  networking.hostName = "nixos-template";
+  networking.domain = "home.2rjus.net";
+  networking.useNetworkd = true;
+  networking.useDHCP = false;
+  services.resolved.enable = true;
+  networking.nameservers = [
+    "10.69.13.5"
+    "10.69.13.6"
+  ];
+
+  systemd.network.enable = true;
+  systemd.network.networks."ens18" = {
+    matchConfig.Name = "ens18";
+    address = [
+      "10.69.8.250/24"
+    ];
+    routes = [
+      { routeConfig.Gateway = "10.69.8.1"; }
+    ];
+    linkConfig.RequiredForOnline = "routable";
+  };
+  time.timeZone = "Europe/Oslo";
+
+  nix.settings.experimental-features = [ "nix-command" "flakes" ];
+  environment.systemPackages = with pkgs; [
+    age
+    vim
+    wget
+    git
+  ];
+
+  # Open ports in the firewall.
+  # networking.firewall.allowedTCPPorts = [ ... ];
+  # networking.firewall.allowedUDPPorts = [ ... ];
+  # Or disable the firewall altogether.
+  networking.firewall.enable = false;
+
+  system.stateVersion = "23.11"; # Did you read the comment?
+}
+

hosts/template/default.nix

@@ -0,0 +1,7 @@
+{ ... }: {
+  imports = [
+    ./hardware-configuration.nix
+    ./configuration.nix
+    ./scripts.nix
+  ];
+}

hosts/template/hardware-configuration.nix

@@ -0,0 +1,32 @@
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports =
+    [
+      (modulesPath + "/profiles/qemu-guest.nix")
+    ];
+
+  boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "virtio_scsi" "sd_mod" "sr_mod" ];
+  boot.initrd.kernelModules = [ "dm-snapshot" ];
+  boot.kernelModules = [ ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" =
+    {
+      device = "/dev/disk/by-uuid/68e895de-b547-4ba2-bfc6-57ec5eeea19f";
+      fsType = "xfs";
+    };
+
+  swapDevices =
+    [{ device = "/dev/disk/by-uuid/bfbe964e-89d8-48f0-b4e2-9723ee1081ac"; }];
+
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  networking.useDHCP = lib.mkDefault true;
+  # networking.interfaces.ens18.useDHCP = lib.mkDefault true;
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+}
+

hosts/template/scripts.nix

@@ -0,0 +1,32 @@
+{ pkgs, ... }:
+let
+  prepare-host-script = pkgs.writeShellScriptBin "prepare-host.sh"
+    ''
+      echo "Removing machine-id"
+      rm -f /etc/machine-id || true
+
+      echo "Removing SSH host keys"
+      rm -f /etc/ssh/ssh_host_* || true
+
+      echo "Removing temporary files"
+      rm -rf /tmp/* || true
+
+      echo "Removing logs"
+      rm -rf /var/log/* || true
+
+      echo "Removing cache"
+      rm -rf /var/cache/* || true
+
+      echo "Generate age key"
+      rm -rf /var/lib/sops-nix || true
+      mkdir -p /var/lib/sops-nix
+      ${pkgs.age}/bin/age-keygen -o /var/lib/sops-nix/key.txt
+
+      echo "Runing garbage collector"
+      ${pkgs.nix}/bin/nix-collect-garbage -d
+    '';
+in
+{
+  environment.systemPackages = [ prepare-host-script ];
+  users.motd = "Prepare host by running 'systemctl start prepare-host'.";
+}

services/ns/master-authorative.nix

@@ -3,9 +3,11 @@
     enable = true;
     port = 8053;
 
-    "test.2rjus.net." = {
+    zones = {
-      provideXFR = [ "10.69.0.0/16 NOKEY" ];
+      "test.2rjus.net." = {
+        provideXFR = [ "10.69.0.0/16 NOKEY" ];
+        data = builtins.readFile ./zones-test-2rjus-net.conf;
+      };
     };
-    data = builtins.readFile ./zones-test-2rjus-net.conf;
   };
 }

system/default.nix

@@ -1,5 +1,5 @@
 { ... }: {
-  import = [
+  imports = [
     ./sops.nix
     ./root-user.nix
     ./sshd.nix

system/root-user.nix

@@ -6,7 +6,7 @@
   users.users.root = {
     shell = pkgs.zsh;
     hashedPasswordFile = config.sops.secrets.root_password_hash.path;
-    opennsh.authorizedKeys.keys = [
+    openssh.authorizedKeys.keys = [
       "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAwfb2jpKrBnCw28aevnH8HbE5YbcMXpdaVv2KmueDu6 torjus@gunter"
     ];
   };

system/sops.nix

@@ -1,6 +1,6 @@
 { ... }: {
   sops = {
-    defaultSopsFile = ./secrets/secrets.yaml;
+    defaultSopsFile = ../secrets/secrets.yaml;
     age.keyFile = "/var/lib/sops-nix/key.txt";
     age.generateKey = true;
   };

system/sshd.nix

@@ -1,9 +1,11 @@
 { ... }: {
   services.openssh = {
     enable = true;
-    permitRootLogin = "no";
+    settings = {
-    # TODO: Allow root login from certain hosts.
+      PermitRootLogin = "yes";
-    # Then dissallow rest.
+      # TODO: Allow root login from certain hosts.
-    passwordAuthentication = true;
+      # Then dissallow rest.
+      PasswordAuthentication = true;
+    };
   };
 }