rouven.seifert/nixos-config
1
1
Fork 0
mirror of https://git.sr.ht/~rouven/nixos-config synced 2024-11-14 21:03:10 +01:00
Code Issues Packages Projects Releases Wiki Activity

updates

Browse source
This commit is contained in:
Rouven Seifert 2024-08-07 13:40:02 +02:00
parent 28526d5db2
commit efe00fc184
9 changed files with 55 additions and 39 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

32
flake.lock
View file

@ -38,11 +38,11 @@
"poetry2nix": "poetry2nix" "poetry2nix": "poetry2nix"
}, },
"locked": { "locked": {
"lastModified": 1720784813, "lastModified": 1722879849,
"narHash": "sha256-8/6yU/wbf6lsUFOLisLVADD6QHHmMDUM85c7hPnPBZA=", "narHash": "sha256-Hg1I6vmrxWz6RrVROXn1RDCPniOJx93QQg99x/wSkjY=",
"owner": "nix-community", "owner": "nix-community",
"repo": "authentik-nix", "repo": "authentik-nix",
"rev": "89cfaf2eb197a39d12422e773f867d1a7c99b048", "rev": "80fc87361809f78b8a8cd7e57a14b66a726379ef",
"type": "github" "type": "github"
}, },
"original": { "original": {
@ -54,16 +54,16 @@
"authentik-src": { "authentik-src": {
"flake": false, "flake": false,
"locked": { "locked": {
"lastModified": 1720727154, "lastModified": 1722875733,
"narHash": "sha256-SMupiJGJbkBn33JP4WLF3IsBdt3SN3JvZg/EYlz443g=", "narHash": "sha256-LPNcvKiVrwPwc3G/j0a7KoMKAMScbzui0C3IgWXP+g4=",
"owner": "goauthentik", "owner": "goauthentik",
"repo": "authentik", "repo": "authentik",
"rev": "9075270b01e784d25f2ec08b82e73f1ce3086184", "rev": "8f207c75046d722c17dee2bcf65fa386b06f5b9a",
"type": "github" "type": "github"
}, },
"original": { "original": {
"owner": "goauthentik", "owner": "goauthentik",
"ref": "version/2024.6.1", "ref": "version/2024.6.3",
"repo": "authentik", "repo": "authentik",
"type": "github" "type": "github"
} }
@ -299,11 +299,11 @@
] ]
}, },
"locked": { "locked": {
"lastModified": 1722407237, "lastModified": 1723015306,
"narHash": "sha256-wcpVHUc2nBSSgOM7UJSpcRbyus4duREF31xlzHV5T+A=", "narHash": "sha256-jQnFEtH20/OsDPpx71ntZzGdRlpXhUENSQCGTjn//NA=",
"owner": "nix-community", "owner": "nix-community",
"repo": "home-manager", "repo": "home-manager",
"rev": "58cef3796271aaeabaed98884d4abaab5d9d162d", "rev": "b3d5ea65d88d67d4ec578ed11d4d2d51e3de525e",
"type": "github" "type": "github"
}, },
"original": { "original": {
@ -447,11 +447,11 @@
] ]
}, },
"locked": { "locked": {
"lastModified": 1722136042, "lastModified": 1722740924,
"narHash": "sha256-x3FmT4QSyK28itMiR5zfYhUrG5nY+2dv+AIcKfmSp5A=", "narHash": "sha256-UQPgA5d8azLZuDHZMPmvDszhuKF1Ek89SrTRtqsQ4Ss=",
"owner": "nix-community", "owner": "nix-community",
"repo": "nix-index-database", "repo": "nix-index-database",
"rev": "c0ca47e8523b578464014961059999d8eddd4aae", "rev": "97ca0a0fca0391de835f57e44f369a283e37890f",
"type": "github" "type": "github"
}, },
"original": { "original": {
@ -462,11 +462,11 @@
}, },
"nixpkgs": { "nixpkgs": {
"locked": { "locked": {
"lastModified": 1722185531, "lastModified": 1722813957,
"narHash": "sha256-veKR07psFoJjINLC8RK4DiLniGGMgF3QMlS4tb74S6k=", "narHash": "sha256-IAoYyYnED7P8zrBFMnmp7ydaJfwTnwcnqxUElC1I26Y=",
"owner": "NixOS", "owner": "NixOS",
"repo": "nixpkgs", "repo": "nixpkgs",
"rev": "52ec9ac3b12395ad677e8b62106f0b98c1f8569d", "rev": "cb9a96f23c491c081b38eab96d22fa958043c9fa",
"type": "github" "type": "github"
}, },
"original": { "original": {

1
flake.nix
View file

@ -11,7 +11,6 @@
url = "github:ryantm/agenix"; url = "github:ryantm/agenix";
inputs.nixpkgs.follows = "nixpkgs"; inputs.nixpkgs.follows = "nixpkgs";
inputs.home-manager.follows = "home-manager"; inputs.home-manager.follows = "home-manager";
}; };
impermanence.url = "github:nix-community/impermanence"; impermanence.url = "github:nix-community/impermanence";

27
hosts/thinkpad/modules/networks/uni.nix
View file

@ -3,15 +3,19 @@
age.secrets = { age.secrets = {
tud.file = ../../../../secrets/thinkpad/tud.age; tud.file = ../../../../secrets/thinkpad/tud.age;
agdsn.file = ../../../../secrets/thinkpad/agdsn.age; agdsn.file = ../../../../secrets/thinkpad/agdsn.age;
ifsr-apb-auth = { dyport-auth = {
file = ../../../../secrets/thinkpad/ifsr-apb-auth.age; file = ../../../../secrets/thinkpad/dyport-auth.age;
}; };
}; };
networking = { networking = {
supplicant."enp0s31f6" = { supplicant = rec {
userControlled.enable = true; enp0s31f6 = {
driver = "wired"; userControlled.enable = true;
configFile.path = config.age.secrets.ifsr-apb-auth.path; driver = "wired";
configFile.path = config.age.secrets.dyport-auth.path;
};
# ugly way to add more interfaces
"enp0s13f0u2u1" = enp0s31f6;
}; };
wireless.networks = { wireless.networks = {
eduroam = { eduroam = {
@ -90,6 +94,17 @@
compression = "stateless"; compression = "stateless";
}; };
}; };
ZIH = {
protocol = "anyconnect";
gateway = "vpn2.zih.tu-dresden.de";
user = "rose159e@zih-ma-vpn";
passwordFile = config.age.secrets.tud.path;
autoStart = false;
extraOptions = {
authgroup = "A-Tunnel-TU-Networks";
compression = "stateless";
};
};
}; };
}; };
systemd.services = { systemd.services = {

14
hosts/thinkpad/modules/security/default.nix
View file

@ -14,10 +14,9 @@
pam = { pam = {
u2f = { u2f = {
enable = true; enable = true;
cue = true; settings = {
# settings = { cue = true;
# cue = true; };
# };
}; };
}; };
krb5 = { krb5 = {
@ -45,9 +44,10 @@
}; };
}; };
}; };
services = { # broken again
fprintd.enable = true; # log in using fingerprint # services = {
}; # fprintd.enable = true; # log in using fingerprint
# };
environment.systemPackages = with pkgs; [ environment.systemPackages = with pkgs; [
agenix.packages.x86_64-linux.default agenix.packages.x86_64-linux.default
tpm2-tools tpm2-tools

2
secrets.nix
View file

@ -9,7 +9,7 @@ in
"secrets/thinkpad/wireless.age".publicKeys = [ rouven thinkpad ]; "secrets/thinkpad/wireless.age".publicKeys = [ rouven thinkpad ];
"secrets/thinkpad/tud.age".publicKeys = [ rouven thinkpad ]; "secrets/thinkpad/tud.age".publicKeys = [ rouven thinkpad ];
"secrets/thinkpad/agdsn.age".publicKeys = [ rouven thinkpad ]; "secrets/thinkpad/agdsn.age".publicKeys = [ rouven thinkpad ];
"secrets/thinkpad/ifsr-apb-auth.age".publicKeys = [ rouven thinkpad ]; "secrets/thinkpad/dyport-auth.age".publicKeys = [ rouven thinkpad ];
"secrets/thinkpad/wireguard/dorm/private.age".publicKeys = [ rouven thinkpad ]; "secrets/thinkpad/wireguard/dorm/private.age".publicKeys = [ rouven thinkpad ];
"secrets/thinkpad/wireguard/dorm/preshared.age".publicKeys = [ rouven thinkpad ]; "secrets/thinkpad/wireguard/dorm/preshared.age".publicKeys = [ rouven thinkpad ];
"secrets/thinkpad/borg/passphrase.age".publicKeys = [ rouven thinkpad ]; "secrets/thinkpad/borg/passphrase.age".publicKeys = [ rouven thinkpad ];

BIN
secrets/thinkpad/dyport-auth.age Normal file
View file

Binary file not shown.

BIN
secrets/thinkpad/ifsr-apb-auth.age
View file

Binary file not shown.

2
users/rouven/fixes.nix
View file

@ -37,6 +37,7 @@
# home manager needs dconf # home manager needs dconf
programs.dconf.enable = true; programs.dconf.enable = true;
# fixes pam entries for swaylock # fixes pam entries for swaylock
# auth sufficient ${pkgs.fprintd}/lib/security/pam_fprintd.so
security.pam.services.swaylock.text = '' security.pam.services.swaylock.text = ''
# Account management. # Account management.
account required pam_unix.so account required pam_unix.so
@ -45,7 +46,6 @@
auth sufficient pam_unix.so nullok likeauth try_first_pass auth sufficient pam_unix.so nullok likeauth try_first_pass
auth sufficient ${pkgs.pam_u2f}/lib/security/pam_u2f.so auth sufficient ${pkgs.pam_u2f}/lib/security/pam_u2f.so
auth sufficient ${pkgs.fprintd}/lib/security/pam_fprintd.so
auth required pam_deny.so auth required pam_deny.so
# Password management. # Password management.

16
users/rouven/modules/ssh/default.nix
View file

@ -36,13 +36,15 @@ in
hostname = "login.zih.tu-dresden.de"; hostname = "login.zih.tu-dresden.de";
user = "rose159e"; user = "rose159e";
}; };
"mininet" = { "*.zih.tu-dresden.de" = {
hostname = "internet.netd.cs.tu-dresden.de"; user = "rose159e";
user = "root"; };
port = 2133; "*.net.tu-dresden.de" = {
extraOptions = { user = "rose159e";
ProxyJump = "tud"; };
}; "git@gitlab.hrz.tu-chemnitz.de" = {
match = "Host gitlab.hrz.tu-chemnitz.de User git";
identityFile = git;
}; };
# iFSR # iFSR