From b6c393ff9860f9bbaacd6b474b2fe25f4680e0ef Mon Sep 17 00:00:00 2001 From: erik Date: Mon, 13 Jul 2026 19:34:27 +0200 Subject: [PATCH] refactor: move host configs under hosts/{jupiter,vps} - git-mv jupiter/ vps/ into hosts/; fix ../ -> ../../ for common/services/secrets - flake.nix + deploy point at hosts// - README structure updated - verified: jupiter/vps/vbox all eval --- README.md | 29 ++++++++++++------- flake.nix | 6 ++-- {jupiter => hosts/jupiter}/configuration.nix | 14 ++++----- {jupiter => hosts/jupiter}/disk-config.nix | 0 .../jupiter}/hardware-configuration.nix | 0 {jupiter => hosts/jupiter}/secrets.nix | 6 ++-- {jupiter => hosts/jupiter}/vm.nix | 12 ++++---- {vps => hosts/vps}/configuration.nix | 8 ++--- {vps => hosts/vps}/disk-config.nix | 0 {vps => hosts/vps}/hardware-configuration.nix | 0 {vps => hosts/vps}/secrets.nix | 6 ++-- scripts/deploy | 4 +-- 12 files changed, 47 insertions(+), 38 deletions(-) rename {jupiter => hosts/jupiter}/configuration.nix (88%) rename {jupiter => hosts/jupiter}/disk-config.nix (100%) rename {jupiter => hosts/jupiter}/hardware-configuration.nix (100%) rename {jupiter => hosts/jupiter}/secrets.nix (82%) rename {jupiter => hosts/jupiter}/vm.nix (87%) rename {vps => hosts/vps}/configuration.nix (91%) rename {vps => hosts/vps}/disk-config.nix (100%) rename {vps => hosts/vps}/hardware-configuration.nix (100%) rename {vps => hosts/vps}/secrets.nix (55%) diff --git a/README.md b/README.md index 46d393c..c3d17fc 100644 --- a/README.md +++ b/README.md @@ -5,16 +5,25 @@ Flake-based NixOS config. Host: `jupiter` (ZimaBlade, NAS + services). ## Structure ``` -flake.nix # inputs (nixpkgs, disko) + nixosConfigurations -jupiter/configuration.nix # real host: imports + bootloader + data mount -jupiter/disk-config.nix # disko: OS-disk partitions + filesystems -jupiter/hardware-configuration.nix # PLACEHOLDER — kernel modules, regenerate on target -jupiter/services.nix # shared: users, ssh, samba, containers, caddy -jupiter/vm.nix # VirtualBox test image (jupiter-vbox) +flake.nix # inputs + nixosConfigurations (jupiter, vps, kexec, ...) +common.nix # shared base: user, ssh, nix, firewall, timezone +services/ # one reusable module per service + samba.nix avahi.nix audiobookshelf.nix containers.nix caddy.nix tailscale.nix +hosts/ + jupiter/ # ZimaBlade NAS + configuration.nix # host bits + imports common + the services it runs + disk-config.nix # disko: eMMC partitions + hardware-configuration.nix + secrets.nix # sops-nix wiring + vm.nix # VirtualBox test image (jupiter-vbox) + vps/ # netcup public reverse proxy + tailnet node + configuration.nix disk-config.nix hardware-configuration.nix secrets.nix +secrets/ # age-encrypted sops files (jupiter.yaml, vps.yaml) +scripts/ # deploy, edit_secrets ``` -Two configs from one service definition: `jupiter` (real host, disko-partitioned) -and `jupiter-vbox` (test OVA). Both import `services.nix`. +Hosts compose by importing `common.nix` + whichever `services/*` modules they +run. Each service module opens its own firewall ports. ## Test in VirtualBox (no hardware needed) @@ -35,7 +44,7 @@ an installer, partitions via disko, installs. > ONLY (by-id). Back up / physically identify the NAS data disk first — it must > NOT appear in disko. `lsblk -o NAME,SERIAL,SIZE,MODEL` to identify. -1. Set the real OS disk id in `jupiter/disk-config.nix` +1. Set the real OS disk id in `hosts/jupiter/disk-config.nix` (`ls -l /dev/disk/by-id`), and the data-disk mount in `configuration.nix`. 2. Add your login SSH pubkey to `users.users.darman.openssh.authorizedKeys.keys`. 3. Set the real samba password: @@ -56,7 +65,7 @@ an installer, partitions via disko, installs. nix run github:nix-community/nixos-anywhere -- \ --flake .#jupiter \ --extra-files /tmp/extra \ - --generate-hardware-config nixos-generate-config ./jupiter/hardware-configuration.nix \ + --generate-hardware-config nixos-generate-config ./hosts/jupiter/hardware-configuration.nix \ --target-host root@ ``` `--extra-files` plants the host key before first boot (its age identity is diff --git a/flake.nix b/flake.nix index 20811a0..901d4ad 100644 --- a/flake.nix +++ b/flake.nix @@ -31,7 +31,7 @@ modules = [ disko.nixosModules.disko sops-nix.nixosModules.sops - ./jupiter/configuration.nix + ./hosts/jupiter/configuration.nix ]; }; @@ -42,7 +42,7 @@ modules = [ disko.nixosModules.disko sops-nix.nixosModules.sops - ./vps/configuration.nix + ./hosts/vps/configuration.nix ]; }; @@ -52,7 +52,7 @@ jupiter-vbox = nixpkgs.lib.nixosSystem { inherit system; specialArgs = { inherit inputs; }; - modules = [ ./jupiter/vm.nix ]; + modules = [ ./hosts/jupiter/vm.nix ]; }; # Custom kexec installer with our SSH key baked in, for headless install diff --git a/jupiter/configuration.nix b/hosts/jupiter/configuration.nix similarity index 88% rename from jupiter/configuration.nix rename to hosts/jupiter/configuration.nix index ef604ac..f78db1c 100644 --- a/jupiter/configuration.nix +++ b/hosts/jupiter/configuration.nix @@ -6,13 +6,13 @@ ./hardware-configuration.nix ./disk-config.nix # disko: OS-disk partitions + filesystems ./secrets.nix # sops-nix: samba password, tailscale key, ... - ../common.nix # shared base: user / ssh / nix / firewall - ../services/samba.nix - ../services/avahi.nix - ../services/audiobookshelf.nix - ../services/containers.nix - ../services/caddy.nix - ../services/tailscale.nix + ../../common.nix # shared base: user / ssh / nix / firewall + ../../services/samba.nix + ../../services/avahi.nix + ../../services/audiobookshelf.nix + ../../services/containers.nix + ../../services/caddy.nix + ../../services/tailscale.nix ]; # ---- Host identity ---- diff --git a/jupiter/disk-config.nix b/hosts/jupiter/disk-config.nix similarity index 100% rename from jupiter/disk-config.nix rename to hosts/jupiter/disk-config.nix diff --git a/jupiter/hardware-configuration.nix b/hosts/jupiter/hardware-configuration.nix similarity index 100% rename from jupiter/hardware-configuration.nix rename to hosts/jupiter/hardware-configuration.nix diff --git a/jupiter/secrets.nix b/hosts/jupiter/secrets.nix similarity index 82% rename from jupiter/secrets.nix rename to hosts/jupiter/secrets.nix index b25bc54..6c93acf 100644 --- a/jupiter/secrets.nix +++ b/hosts/jupiter/secrets.nix @@ -1,16 +1,16 @@ { config, ... }: # sops-nix secret wiring (real host only; not imported by vm.nix). -# Encrypted values live in ../secrets/jupiter.yaml, decrypted at activation to +# Encrypted values live in ../../secrets/jupiter.yaml, decrypted at activation to # /run/secrets/. # # The host decrypts with its OWN SSH host key (age identity derived via -# ssh-to-age, recipient listed in ../.sops.yaml). The key is pre-generated on +# ssh-to-age, recipient listed in ../../.sops.yaml). The key is pre-generated on # the laptop and shipped once at install as /etc/ssh/ssh_host_ed25519_key # (nixos-anywhere --extra-files) — so decryption works on boot #1 and there is # no separate sops-only key to manage. { - sops.defaultSopsFile = ../secrets/jupiter.yaml; + sops.defaultSopsFile = ../../secrets/jupiter.yaml; sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ]; # Decrypts to /run/secrets/samba_password (root-only by default). diff --git a/jupiter/vm.nix b/hosts/jupiter/vm.nix similarity index 87% rename from jupiter/vm.nix rename to hosts/jupiter/vm.nix index 1b09afd..98ce261 100644 --- a/jupiter/vm.nix +++ b/hosts/jupiter/vm.nix @@ -6,12 +6,12 @@ { imports = [ (modulesPath + "/virtualisation/virtualbox-image.nix") - ../common.nix # shared base: user / ssh / nix / firewall - ../services/samba.nix - ../services/avahi.nix - ../services/audiobookshelf.nix - ../services/containers.nix - ../services/caddy.nix + ../../common.nix # shared base: user / ssh / nix / firewall + ../../services/samba.nix + ../../services/avahi.nix + ../../services/audiobookshelf.nix + ../../services/containers.nix + ../../services/caddy.nix ]; networking.hostName = "jupiter"; diff --git a/vps/configuration.nix b/hosts/vps/configuration.nix similarity index 91% rename from vps/configuration.nix rename to hosts/vps/configuration.nix index 1fa1b96..10feffa 100644 --- a/vps/configuration.nix +++ b/hosts/vps/configuration.nix @@ -6,9 +6,9 @@ ./hardware-configuration.nix ./disk-config.nix # disko: vda partitions + filesystems ./secrets.nix # sops-nix: tailscale authkey - ../common.nix # shared base: user / ssh / nix / firewall - ../services/caddy.nix - ../services/tailscale.nix + ../../common.nix # shared base: user / ssh / nix / firewall + ../../services/caddy.nix + ../../services/tailscale.nix ]; # ---- Boot (UEFI) ---- @@ -37,7 +37,7 @@ networking.nameservers = [ "9.9.9.9" "1.1.1.1" "2620:fe::fe" ]; # firewall (enable + 22), caddy (80/443), tailscale (trust tailscale0 + join - # headscale) come from ../common.nix and ../services/{caddy,tailscale}.nix. + # headscale) come from ../../common.nix and ../../services/{caddy,tailscale}.nix. # ---- Public reverse proxy vhosts ---- # Caddy gets automatic public HTTPS (Let's Encrypt) for real domains. diff --git a/vps/disk-config.nix b/hosts/vps/disk-config.nix similarity index 100% rename from vps/disk-config.nix rename to hosts/vps/disk-config.nix diff --git a/vps/hardware-configuration.nix b/hosts/vps/hardware-configuration.nix similarity index 100% rename from vps/hardware-configuration.nix rename to hosts/vps/hardware-configuration.nix diff --git a/vps/secrets.nix b/hosts/vps/secrets.nix similarity index 55% rename from vps/secrets.nix rename to hosts/vps/secrets.nix index b643046..d01f857 100644 --- a/vps/secrets.nix +++ b/hosts/vps/secrets.nix @@ -1,11 +1,11 @@ { config, ... }: -# sops-nix wiring for the VPS. Encrypted values live in ../secrets/vps.yaml, -# decrypted with the VPS's own SSH host key (recipient in ../.sops.yaml). +# sops-nix wiring for the VPS. Encrypted values live in ../../secrets/vps.yaml, +# decrypted with the VPS's own SSH host key (recipient in ../../.sops.yaml). # The host key is pre-generated on the laptop and shipped at install # (nixos-anywhere --extra-files -> /etc/ssh/ssh_host_ed25519_key). { - sops.defaultSopsFile = ../secrets/vps.yaml; + sops.defaultSopsFile = ../../secrets/vps.yaml; sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ]; sops.secrets.tailscale_authkey = { }; diff --git a/scripts/deploy b/scripts/deploy index e0a03a7..23e8610 100755 --- a/scripts/deploy +++ b/scripts/deploy @@ -66,7 +66,7 @@ case "$cmd" in { [ -n "$config" ] && [ -n "$host" ]; } || die "usage: ./deploy install " hostkey="$HOME/.config/homelab/$config/ssh_host_ed25519_key" [ -f "$hostkey" ] || die "missing host key: $hostkey" - [ -d "./$config" ] || die "no ./$config directory in the repo" + [ -d "./hosts/$config" ] || die "no ./hosts/$config directory in the repo" # Stage the pre-generated SSH host key so sops can decrypt on boot #1. stage="$(mktemp -d)" @@ -78,7 +78,7 @@ case "$cmd" in nix run github:nix-community/nixos-anywhere -- \ --flake ".#$config" \ --extra-files "$stage" \ - --generate-hardware-config nixos-generate-config "./$config/hardware-configuration.nix" \ + --generate-hardware-config nixos-generate-config "./hosts/$config/hardware-configuration.nix" \ --target-host "root@$host" ;;