feb2025 sprint

1 files changed, 84 insertions, 53 deletions

diff --git a/machines/xnet/default.nix b/machines/xnet/default.nix
index 138bd53..808bebc 100644
--- a/machines/xnet/default.nix
+++ b/machines/xnet/default.nix
@@ -1,6 +1,23 @@
-{ pkgs, lib, ... }:
+{ pkgs, lib, config, ... }:
 let
-  inherit (lib) mkDefault;
+  inherit (builtins)
+    fetchurl
+    filter
+    readFile
+    ;
+
+  inherit (lib)
+    mkDefault
+    mkOption
+    types
+    splitString
+    ;
+
+  gitKeys = fetchurl {
+    url = "https://github.com/kbujari.keys";
+    sha256 = "1kskbiyqvjz1wsmcrgh9v0iryf33y70zk503z0m96wmzdjllmc94";
+  };
+
 in
 {
   imports = [
@@ -13,67 +30,81 @@ in
     ./monitoring
   ];
 
-  i18n.defaultLocale = mkDefault "en_US.UTF-8";
-  time.timeZone = mkDefault "America/Toronto";
-
-  nix = {
-    settings = {
-      auto-optimise-store = true;
-      experimental-features = [ "nix-command" "flakes" ];
-      warn-dirty = false;
-
-      # timeout fast from binary cache
-      connect-timeout = 5;
-    };
-    gc = {
-      automatic = true;
-      options = mkDefault "--delete-older-than 30d";
+  options.xnet = {
+    pubKeys = mkOption {
+      type = types.listOf types.str;
+      default = filter (s: s != "")
+        (splitString "\n" (readFile gitKeys));
     };
   };
 
-  documentation = {
-    doc.enable = mkDefault false;
-    info.enable = mkDefault false;
-  };
+  config = {
+    i18n.defaultLocale = mkDefault "en_US.UTF-8";
+    time.timeZone = mkDefault "America/Toronto";
 
-  users.mutableUsers = false;
+    nix = {
+      settings = {
+        auto-optimise-store = true;
+        experimental-features = [ "nix-command" "flakes" ];
+        warn-dirty = false;
 
-  security.sudo = {
-    execWheelOnly = true;
-    extraConfig = "Defaults lecture = never";
-  };
+        # timeout fast from binary cache
+        connect-timeout = 5;
+      };
+      gc = {
+        automatic = true;
+        options = mkDefault "--delete-older-than 30d";
+      };
+    };
 
-  programs.ssh = {
-    knownHosts = {
-      "github.com".publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOMqqnkVzrm0SdG6UOoqKLsabgH5C9okWi0dh2l9GKJl";
-      "gitlab.com".publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAfuCHKVTjquxvt6CM6tdG4SLp1Btn/nOeHHE5UOzRdf";
-      "git.sr.ht".publicKey = " ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMZvRd4EtM7R+IHVMWmDkVU3VLQTSwQDSAvW0t2Tkj60";
-      "pascal.ee.ryerson.ca".publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFmWInQNT6EoU1NtUYzTs5jtpfbO/m6yvCckOiEGjvDc";
+    documentation = {
+      doc.enable = mkDefault false;
+      info.enable = mkDefault false;
     };
-    extraConfig = ''
-      Host github
-        HostName github.com
-        User git
-        PreferredAuthentications publickey
 
-      Host ee
-        HostName pascal.ee.ryerson.ca
-        User kbujari
-    '';
-  };
+    users.mutableUsers = false;
+    users.users.root = {
+      openssh.authorizedKeys.keys = config.xnet.pubKeys;
+      initialPassword = "hello";
+    };
+
+    security.sudo = {
+      execWheelOnly = true;
+      extraConfig = "Defaults lecture = never";
+    };
+
+    programs.ssh = {
+      knownHosts = {
+        "github.com".publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOMqqnkVzrm0SdG6UOoqKLsabgH5C9okWi0dh2l9GKJl";
+        "gitlab.com".publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAfuCHKVTjquxvt6CM6tdG4SLp1Btn/nOeHHE5UOzRdf";
+        "git.sr.ht".publicKey = " ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMZvRd4EtM7R+IHVMWmDkVU3VLQTSwQDSAvW0t2Tkj60";
+        "pascal.ee.ryerson.ca".publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFmWInQNT6EoU1NtUYzTs5jtpfbO/m6yvCckOiEGjvDc";
+      };
+      extraConfig = ''
+        Host github
+          HostName github.com
+          User git
+          PreferredAuthentications publickey
 
-  programs.git = {
-    enable = true;
-    config = {
-      init.defaultBranch = "master";
-      fetch.prune = true;
-      core.excludesFile = pkgs.writeText "gitignore" ''
-        # dev shell caching
-        .direnv/
-        .envrc
+        Host ee
+          HostName pascal.ee.ryerson.ca
+          User kbujari
       '';
-      push.default = "upstream";
-      push.autoSetupRemote = true;
+    };
+
+    programs.git = {
+      enable = true;
+      config = {
+        init.defaultBranch = "master";
+        fetch.prune = true;
+        core.excludesFile = pkgs.writeText "gitignore" ''
+          # dev shell caching
+          .direnv/
+          .envrc
+        '';
+        push.default = "upstream";
+        push.autoSetupRemote = true;
+      };
     };
   };
 }