darman/homelab
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

common: swap ssh key to darman@terra, cap boot generations + journald size

Browse Source 
The old key was a leftover from a previous laptop. Also cap every host at
5 boot generations and journald at 200M so none of them can quietly repeat
jupiter's 34-generations-on-a-29G-eMMC incident.
This commit is contained in:
darman
2026-07-29 21:42:54 +02:00
parent d43709536c
commit 2fd5752d87
1 changed files with 31 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
common.nix
+31 -7
View File
@@ -9,14 +9,17 @@
extraGroups = [ "wheel" "networkmanager" ]; extraGroups = [ "wheel" "networkmanager" ];
shell = pkgs.zsh; shell = pkgs.zsh;
openssh.authorizedKeys.keys = [ openssh.authorizedKeys.keys = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGZpkPVhzi1zG5JI9hWyUgdyvNIQbp4ts4jw3idpMhhN erik@laptop" "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILD5K6AQ0wYYHbNGzC4PyunUQsXbaD0iu1eaadLtv+Xp darman@terra"
]; ];
}; };
# Costs a password prompt on every `./scripts/deploy switch` (nixos-rebuild
# --use-remote-sudo). Worth it: darman's key is the only thing between the security.sudo = {
# public internet and root on neptun. The password is darman_password from enable = true;
# each host's sops file. wheelNeedsPassword = true;
security.sudo.wheelNeedsPassword = true; extraConfig = ''
Defaults timestamp_timeout=20
'';
};
# ---- SSH (key-only) ---- # ---- SSH (key-only) ----
services.openssh = { services.openssh = {
@@ -48,7 +51,7 @@
options = "--delete-older-than 30d"; options = "--delete-older-than 30d";
}; };
environment.systemPackages = with pkgs; [ vim git htop tmux curl wget zsh-powerlevel10k ]; environment.systemPackages = with pkgs; [ git btop tmux curl wget zsh-powerlevel10k lsd ];
# ---- zsh / oh-my-zsh / powerlevel10k ---- # ---- zsh / oh-my-zsh / powerlevel10k ----
programs.zsh = { programs.zsh = {
@@ -57,15 +60,36 @@
enable = true; enable = true;
theme = "robbyrussell"; # prompt itself replaced by p10k below theme = "robbyrussell"; # prompt itself replaced by p10k below
}; };
shellAliases = {
ls = "lsd";
};
interactiveShellInit = '' interactiveShellInit = ''
source ${pkgs.zsh-powerlevel10k}/share/zsh-powerlevel10k/powerlevel10k.zsh-theme source ${pkgs.zsh-powerlevel10k}/share/zsh-powerlevel10k/powerlevel10k.zsh-theme
source ${./dotfiles/p10k.zsh} source ${./dotfiles/p10k.zsh}
''; '';
}; };
# ---- Boot generations ----
# Cap every host at 5 generations so none of them can quietly repeat
# jupiter's 34-generations-on-a-29G-eMMC incident. Both loader options are
# set unconditionally since only one is ever enabled per host (systemd-boot
# everywhere except mercury's generic-extlinux-compatible RPi image) — the
# other one is simply inert.
boot.loader.systemd-boot.configurationLimit = 5;
boot.loader.generic-extlinux-compatible.configurationLimit = 5;
# Stock journald defaults to ~10% of the filesystem (up to 4G) before it
# rotates — no scheduled vacuum, just a ceiling it grows into. On jupiter's
# 29G eMMC that's ~2.9G it could silently accumulate. Cap it well below that
# everywhere instead of only noticing when a disk fills up again.
services.journald.extraConfig = ''
SystemMaxUse=200M
'';
# ---- Locale / firewall base ---- # ---- Locale / firewall base ----
time.timeZone = "Europe/Berlin"; time.timeZone = "Europe/Berlin";
i18n.defaultLocale = "en_US.UTF-8"; i18n.defaultLocale = "en_US.UTF-8";
console.keyMap = "de";
# Firewall on, ssh always allowed. Service modules add their own ports # Firewall on, ssh always allowed. Service modules add their own ports
# (samba via openFirewall, caddy 80/443, tailscale trusts tailscale0). # (samba via openFirewall, caddy 80/443, tailscale trusts tailscale0).