erikandClaude Opus 4.8
10387fdbee
- add sops-nix input + module (jupiter only, not the VM) - secrets/jupiter.yaml: age-encrypted samba_password (safe to commit) - .sops.yaml: encryption rule for admin age key - secrets.nix: decrypt samba_password to /run/secrets on the host - provisioning oneshot reads sops secret (host) or plaintext (VM), single value - .sops private key stays off-repo (~/.config, /var/lib/sops-nix on host) Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
25 lines
794 B
Nix
25 lines
794 B
Nix
{ config, pkgs, lib, ... }:
|
|
|
|
# Real-host config: hardware + disk layout + bootloader + shared services.
|
|
{
|
|
imports = [
|
|
./hardware-configuration.nix
|
|
./disk-config.nix # disko: OS-disk partitions + filesystems
|
|
./secrets.nix # sops-nix: samba password etc.
|
|
./services.nix
|
|
];
|
|
|
|
# ---- Boot ----
|
|
# systemd-boot for UEFI. If ZimaBlade boots legacy/BIOS, switch to grub.
|
|
boot.loader.systemd-boot.enable = true;
|
|
boot.loader.efi.canTouchEfiVariables = true;
|
|
|
|
# ---- NAS data disk ----
|
|
# Existing data filesystem — mounted, NOT formatted (kept out of disko).
|
|
# Set the id from `ls -l /dev/disk/by-id` (or by-uuid). Adjust fsType.
|
|
# fileSystems."/mnt/data" = {
|
|
# device = "/dev/disk/by-id/CHANGE-ME-data-disk";
|
|
# fsType = "ext4";
|
|
# };
|
|
}
|