From ac05d948b6c6d86083b6b82f9010a115f1a81607 Mon Sep 17 00:00:00 2001 From: erik Date: Tue, 14 Jul 2026 13:32:44 +0200 Subject: [PATCH] refactor: rename vps host -> neptun (solar-system theme) git-mv hosts/vps->neptun, secrets/vps.yaml->neptun.yaml; update flake, .sops.yaml rules, hostName, sops paths, README/CLAUDE. Off-repo host key dir renamed too. --- .sops.yaml | 6 +++--- CLAUDE.md | 6 +++--- README.md | 10 +++++----- common.nix | 2 +- flake.nix | 4 ++-- hosts/{vps => neptun}/configuration.nix | 2 +- hosts/{vps => neptun}/disk-config.nix | 0 hosts/{vps => neptun}/hardware-configuration.nix | 0 hosts/{vps => neptun}/secrets.nix | 4 ++-- secrets/{vps.yaml => neptun.yaml} | 0 services/caddy.nix | 2 +- 11 files changed, 18 insertions(+), 18 deletions(-) rename hosts/{vps => neptun}/configuration.nix (98%) rename hosts/{vps => neptun}/disk-config.nix (100%) rename hosts/{vps => neptun}/hardware-configuration.nix (100%) rename hosts/{vps => neptun}/secrets.nix (79%) rename secrets/{vps.yaml => neptun.yaml} (100%) diff --git a/.sops.yaml b/.sops.yaml index f940a97..3a1678a 100644 --- a/.sops.yaml +++ b/.sops.yaml @@ -11,7 +11,7 @@ keys: # per-host keys — derived from each box's pre-generated SSH host key # (ssh-to-age). The host decrypts at runtime using /etc/ssh/ssh_host_ed25519_key. - &jupiter age1zak7glavmg4026p2389fyqe769vqm4jrryknuqckgqq4merz5f7q44rkkt - - &vps age1hp72xyx2cnd05937e4eww95g5kdtn0wsf9j2nypw330pa69gfdxqn0lpkp + - &neptun age1hp72xyx2cnd05937e4eww95g5kdtn0wsf9j2nypw330pa69gfdxqn0lpkp # mercury (rpi) uses a dedicated age key (SD image, no ssh-host-key delivery); # the private key is dropped on its boot partition after flashing. - &mercury age1cpty7zrgnn6l97upq00w5wa8zcvnkxkdt2jvhlj97jh83exure4slha43t @@ -21,9 +21,9 @@ creation_rules: - path_regex: secrets/jupiter\.yaml$ key_groups: - age: [ *admin, *jupiter ] - - path_regex: secrets/vps\.yaml$ + - path_regex: secrets/neptun\.yaml$ key_groups: - - age: [ *admin, *vps ] + - age: [ *admin, *neptun ] - path_regex: secrets/mercury\.yaml$ key_groups: - age: [ *admin, *mercury ] diff --git a/CLAUDE.md b/CLAUDE.md index de456df..df31841 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -3,7 +3,7 @@ This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository. Flake-based NixOS config for a homelab. Hosts: **jupiter** (ZimaBlade NAS, x86_64), -**vps** (netcup public reverse proxy + tailnet node, x86_64), **mercury** (Raspberry +**neptun** (netcup public reverse proxy + tailnet node, x86_64), **mercury** (Raspberry Pi 3B+ DNS/DHCP, aarch64). See `README.md` for the full install/deploy walkthrough. ## Layout @@ -21,7 +21,7 @@ scripts/edit_secrets A host = `common.nix` + the `services/*` modules it imports + its `hosts//configuration.nix`. `services/` modules are engine-agnostic and shared across hosts (e.g. `tailscale.nix`, -`caddy.nix` used by jupiter and vps). +`caddy.nix` used by jupiter and neptun). ## Commands @@ -59,7 +59,7 @@ nix build .#nixosConfigurations.jupiter-vbox.config.system.build.virtualBoxOVA - Each `secrets/.yaml` is encrypted to the **admin** key (edit) + that **host's** key (runtime decrypt); rules in `.sops.yaml`. Private keys live OFF-repo: `~/.config/sops/age/keys.txt` (admin), `~/.config/homelab//` (host keys). -- jupiter/vps decrypt with their **ssh host key** (`ssh-to-age` recipient), shipped at +- jupiter/neptun decrypt with their **ssh host key** (`ssh-to-age` recipient), shipped at install via `nixos-anywhere --extra-files`. - mercury (SD image, no `--extra-files`) uses a **dedicated age key** at `/var/lib/sops-nix/age.txt` — `./scripts/deploy flash` writes it to the ext4 root partition. diff --git a/README.md b/README.md index c3d17fc..7d9e52b 100644 --- a/README.md +++ b/README.md @@ -5,7 +5,7 @@ Flake-based NixOS config. Host: `jupiter` (ZimaBlade, NAS + services). ## Structure ``` -flake.nix # inputs + nixosConfigurations (jupiter, vps, kexec, ...) +flake.nix # inputs + nixosConfigurations (jupiter, neptun, kexec, ...) common.nix # shared base: user, ssh, nix, firewall, timezone services/ # one reusable module per service samba.nix avahi.nix audiobookshelf.nix containers.nix caddy.nix tailscale.nix @@ -16,9 +16,9 @@ hosts/ hardware-configuration.nix secrets.nix # sops-nix wiring vm.nix # VirtualBox test image (jupiter-vbox) - vps/ # netcup public reverse proxy + tailnet node + neptun/ # netcup public reverse proxy + tailnet node configuration.nix disk-config.nix hardware-configuration.nix secrets.nix -secrets/ # age-encrypted sops files (jupiter.yaml, vps.yaml) +secrets/ # age-encrypted sops files (jupiter.yaml, neptun.yaml) scripts/ # deploy, edit_secrets ``` @@ -86,13 +86,13 @@ All arguments mandatory — no default host, no default config. ./deploy switch # rebuild + activate on a running host ./deploy boot|test # stage for next boot / activate without boot entry ``` -`` is a `nixosConfigurations` name (`jupiter`, `vps`). Its pre-generated +`` is a `nixosConfigurations` name (`jupiter`, `neptun`). Its pre-generated SSH host key lives at `~/.config/homelab//ssh_host_ed25519_key`. Examples: ``` ./deploy switch jupiter jupiter.sol -./deploy install vps 159.195.64.117 +./deploy install neptun 159.195.64.117 ``` Rollback: `nixos-rebuild switch --rollback` on the host, or pick a prior generation at boot. diff --git a/common.nix b/common.nix index ca274b2..ed00dcd 100644 --- a/common.nix +++ b/common.nix @@ -1,7 +1,7 @@ { pkgs, ... }: # Shared base for all hosts: user, SSH hardening, nix settings, packages. -# (jupiter still carries its own copy in services.nix; vps uses this.) +# (jupiter still carries its own copy in services.nix; neptun uses this.) { # ---- User ---- users.users.darman = { diff --git a/flake.nix b/flake.nix index 574727b..858f1f8 100644 --- a/flake.nix +++ b/flake.nix @@ -36,13 +36,13 @@ }; # netcup VPS — public reverse proxy + tailnet node. - vps = nixpkgs.lib.nixosSystem { + neptun = nixpkgs.lib.nixosSystem { inherit system; specialArgs = { inherit inputs; }; modules = [ disko.nixosModules.disko sops-nix.nixosModules.sops - ./hosts/vps/configuration.nix + ./hosts/neptun/configuration.nix ]; }; diff --git a/hosts/vps/configuration.nix b/hosts/neptun/configuration.nix similarity index 98% rename from hosts/vps/configuration.nix rename to hosts/neptun/configuration.nix index 10feffa..9150c29 100644 --- a/hosts/vps/configuration.nix +++ b/hosts/neptun/configuration.nix @@ -18,7 +18,7 @@ # what nixos-generate-config detects in the installer. boot.initrd.availableKernelModules = [ "virtio_pci" "virtio_blk" "virtio_scsi" ]; - networking.hostName = "vps"; + networking.hostName = "neptun"; # ---- Static networking (netcup) ---- # No LAN fallback: get this right or the box is unreachable (use netcup's diff --git a/hosts/vps/disk-config.nix b/hosts/neptun/disk-config.nix similarity index 100% rename from hosts/vps/disk-config.nix rename to hosts/neptun/disk-config.nix diff --git a/hosts/vps/hardware-configuration.nix b/hosts/neptun/hardware-configuration.nix similarity index 100% rename from hosts/vps/hardware-configuration.nix rename to hosts/neptun/hardware-configuration.nix diff --git a/hosts/vps/secrets.nix b/hosts/neptun/secrets.nix similarity index 79% rename from hosts/vps/secrets.nix rename to hosts/neptun/secrets.nix index 426de47..0c96430 100644 --- a/hosts/vps/secrets.nix +++ b/hosts/neptun/secrets.nix @@ -1,11 +1,11 @@ { config, ... }: -# sops-nix wiring for the VPS. Encrypted values live in ../../secrets/vps.yaml, +# sops-nix wiring for neptun (netcup VPS). Encrypted values in ../../secrets/neptun.yaml, # decrypted with the VPS's own SSH host key (recipient in ../../.sops.yaml). # The host key is pre-generated on the laptop and shipped at install # (nixos-anywhere --extra-files -> /etc/ssh/ssh_host_ed25519_key). { - sops.defaultSopsFile = ../../secrets/vps.yaml; + sops.defaultSopsFile = ../../secrets/neptun.yaml; sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ]; sops.secrets.tailscale_authkey = { }; diff --git a/secrets/vps.yaml b/secrets/neptun.yaml similarity index 100% rename from secrets/vps.yaml rename to secrets/neptun.yaml diff --git a/services/caddy.nix b/services/caddy.nix index 42e33de..84fa692 100644 --- a/services/caddy.nix +++ b/services/caddy.nix @@ -2,7 +2,7 @@ # Caddy reverse proxy — base enable + open the web ports. # Each host adds its own `services.caddy.virtualHosts.` (LAN names on -# jupiter, public domains with automatic HTTPS on the vps). +# jupiter, public domains with automatic HTTPS on the neptun). { services.caddy.enable = true; networking.firewall.allowedTCPPorts = [ 80 443 ];