Compare commits

...

5 commits

12 changed files with 153 additions and 43 deletions

View file

@ -14,11 +14,11 @@
]
},
"locked": {
"lastModified": 1699171528,
"narHash": "sha256-ZsN6y+tgN5w84oAqRQpMhIvQM39ZNSZoZvn2AK0QYr4=",
"lastModified": 1706509311,
"narHash": "sha256-QQKQ6r3CID8aXn2ZXZ79ZJxdCOeVP+JTnOctDALErOw=",
"owner": "zhaofengli",
"repo": "colmena",
"rev": "665603956a1c3040d756987bc7a810ffe86a3b15",
"rev": "c84ccd0a7a712475e861c2b111574472b1a8d0cd",
"type": "github"
},
"original": {
@ -64,11 +64,11 @@
"systems": "systems"
},
"locked": {
"lastModified": 1701680307,
"narHash": "sha256-kAuep2h5ajznlPMD9rnQyffWG8EM/C73lejGofXvdM8=",
"lastModified": 1709126324,
"narHash": "sha256-q6EQdSeUZOG26WelxqkmR7kArjgWCdw5sfJVHPH/7j8=",
"owner": "numtide",
"repo": "flake-utils",
"rev": "4022d587cbbfd70fe950c1e2083a02621806a725",
"rev": "d465f4819400de7c8d874d50b982301f28a84605",
"type": "github"
},
"original": {
@ -84,11 +84,11 @@
]
},
"locked": {
"lastModified": 1705104164,
"narHash": "sha256-pllCu3Hcm1wP/B0SUxgUXvHeEd4w8s2aVrEQRdIL1yo=",
"lastModified": 1709764752,
"narHash": "sha256-+lM4J4JoJeiN8V+3WSWndPHj1pJ9Jc1UMikGbXLqCTk=",
"owner": "nix-community",
"repo": "home-manager",
"rev": "0912d26b30332ae6a90e1b321ff88e80492127dd",
"rev": "cf111d1a849ddfc38e9155be029519b0e2329615",
"type": "github"
},
"original": {
@ -104,11 +104,11 @@
]
},
"locked": {
"lastModified": 1704596958,
"narHash": "sha256-BK3Ohsz7m8X6qVKFxDtr8KVcHipfr5hYE9PDIJevHbQ=",
"lastModified": 1709708644,
"narHash": "sha256-XAFOkZ6yexsqeJrCXWoHxopq0i+7ZqbwATXomMnGmr4=",
"owner": "Mic92",
"repo": "nix-index-database",
"rev": "f46800ac5a6e9f892fe36e50821c5d85794ecc62",
"rev": "94a1e46434736a40f976a454f8bd3ea2144f349b",
"type": "github"
},
"original": {
@ -128,11 +128,11 @@
]
},
"locked": {
"lastModified": 1705108826,
"narHash": "sha256-1xOzPcS8Zr4rqgLoaRwAcKqdCdzrBDaNwT+tiBdXf18=",
"lastModified": 1709773506,
"narHash": "sha256-RK9D2rbN7usqlxogWSBA0EsKDScSF/Uyb8ATntC4juA=",
"owner": "nix-community",
"repo": "nix-vscode-extensions",
"rev": "92fd8c24719f08692c36b685de6884a20080edf0",
"rev": "a17ea69caec11561e73c985360fb596c25f74131",
"type": "github"
},
"original": {
@ -166,11 +166,11 @@
},
"nixos-hardware": {
"locked": {
"lastModified": 1704786394,
"narHash": "sha256-aJM0ln9fMGWw1+tjyl5JZWZ3ahxAA2gw2ZpZY/hkEMs=",
"lastModified": 1709410583,
"narHash": "sha256-esOSUoQ7mblwcsSea0K17McZuwAIjoS6dq/4b83+lvw=",
"owner": "NixOS",
"repo": "nixos-hardware",
"rev": "b34a6075e9e298c4124e35c3ccaf2210c1f3a43b",
"rev": "59e37017b9ed31dee303dbbd4531c594df95cfbc",
"type": "github"
},
"original": {
@ -182,11 +182,11 @@
},
"nixpkgs": {
"locked": {
"lastModified": 1704722960,
"narHash": "sha256-mKGJ3sPsT6//s+Knglai5YflJUF2DGj7Ai6Ynopz0kI=",
"lastModified": 1709479366,
"narHash": "sha256-n6F0n8UV6lnTZbYPl1A9q1BS0p4hduAv1mGAP17CVd0=",
"owner": "nixos",
"repo": "nixpkgs",
"rev": "317484b1ead87b9c1b8ac5261a8d2dd748a0492d",
"rev": "b8697e57f10292a6165a20f03d2f42920dfaf973",
"type": "github"
},
"original": {
@ -214,27 +214,27 @@
},
"nixpkgs-stable_2": {
"locked": {
"lastModified": 1704290814,
"narHash": "sha256-LWvKHp7kGxk/GEtlrGYV68qIvPHkU9iToomNFGagixU=",
"lastModified": 1709428628,
"narHash": "sha256-//ZCCnpVai/ShtO2vPjh3AWgo8riXCaret6V9s7Hew4=",
"owner": "NixOS",
"repo": "nixpkgs",
"rev": "70bdadeb94ffc8806c0570eb5c2695ad29f0e421",
"rev": "66d65cb00b82ffa04ee03347595aa20e41fe3555",
"type": "github"
},
"original": {
"owner": "NixOS",
"ref": "release-23.05",
"ref": "release-23.11",
"repo": "nixpkgs",
"type": "github"
}
},
"nur": {
"locked": {
"lastModified": 1705110884,
"narHash": "sha256-8t8C+vYVoNsG7uv1cH/vkUHM84EkxGRoPuwk1TMXBZE=",
"lastModified": 1709780742,
"narHash": "sha256-mJXQZLSI/zgQ98nHMSdmJ0l0YL3n38FWsdE9OiKPcWk=",
"owner": "nix-community",
"repo": "NUR",
"rev": "075357ead2dbaf5c64120371f6a1e57d1ee23a02",
"rev": "3428e6cf4521df6254ff5b8bcf31df84fc1dd0d2",
"type": "github"
},
"original": {
@ -266,11 +266,11 @@
"nixpkgs-stable": "nixpkgs-stable_2"
},
"locked": {
"lastModified": 1704908274,
"narHash": "sha256-74W9Yyomv3COGRmKi8zvyA5tL2KLiVkBeaYmYLjXyOw=",
"lastModified": 1709711091,
"narHash": "sha256-L0rSIU9IguTG4YqSj4B/02SyTEz55ACq5t8gXpzteYc=",
"owner": "Mic92",
"repo": "sops-nix",
"rev": "c0b3a5af90fae3ba95645bbf85d2b64880addd76",
"rev": "25dd60fdd08fcacee2567a26ba6b91fe098941dc",
"type": "github"
},
"original": {

View file

@ -169,6 +169,7 @@
nixos-hardware.nixosModules.asus-zephyrus-ga401
machines/calcite/configuration.nix
(mkHome "xin" "calcite")
(./overlays)
];
};
raspite = mkNixos {
@ -199,7 +200,7 @@
{
devShells = {
default = pkgs.mkShell {
packages = with pkgs; [ git colmena sops nix-output-monitor rnix-lsp ];
packages = with pkgs; [ git colmena sops nix-output-monitor rnix-lsp nvd ];
};
};
}

View file

@ -1,4 +1,4 @@
{ config, pkgs, ... }:
{ config, pkgs, lib, ... }:
{
imports =
@ -22,9 +22,16 @@
enable = true;
# expose /run/current-system/sw/lib/libtpm2_pkcs11.so
pkcs11.enable = true;
# TODO: Need this until fapi-config is fixed in NixOS
pkcs11.package = pkgs.tpm2-pkcs11.override { fapiSupport = false; };
# TPM2TOOLS_TCTI and TPM2_PKCS11_TCTI env variables
tctiEnvironment.enable = true;
};
services.gnome.gnome-keyring.enable = lib.mkForce false;
security.pam.services.login.enableGnomeKeyring = lib.mkForce false;
services.ssh-tpm-agent.enable = true;
programs.ssh.agentPKCS11Whitelist = "${config.security.tpm2.pkcs11.package}/lib/libtpm_pkcs11.so";
networking.hostName = "calcite";
@ -73,8 +80,8 @@
# Configure keymap in X11
services.xserver = {
layout = "us";
xkbVariant = "";
xkb.layout = "us";
xkb.variant = "";
};
# Keyboard mapping on internal keyboard
services.keyd = {
@ -180,6 +187,7 @@
gnomeExtensions.search-light
gnomeExtensions.tray-icons-reloaded
gnome.gnome-tweaks
gnome.gnome-themes-extra
gthumb
oculante
@ -293,7 +301,6 @@
libvirtd.enable = true;
podman = {
enable = true;
enableNvidia = true;
};
docker = {
enable = true;

View file

@ -49,4 +49,9 @@
enable = true;
driSupport32Bit = true;
};
hardware.nvidia = {
powerManagement.enable = true;
dynamicBoost.enable = lib.mkForce false;
};
}

View file

@ -38,7 +38,7 @@
networking.firewall.allowedUDPPorts = [ ] ++ (lib.range 6311 6314);
custom.prometheus = {
enable = true;
enable = false;
exporters.enable = true;
grafana = {
enable = true;
@ -164,8 +164,7 @@
protocol = "dns";
}
{
geoip = "cn";
geosite = "cn";
inbound = "sg4";
outbound = "direct";
}
];

View file

@ -14,7 +14,7 @@ in
enable = mkEnableOption "Git ssh signing";
keyFile = mkOption {
type = types.str;
default = "~/.ssh/id_ed25519_sk";
default = "~/.ssh/id.pub";
};
};
};

View file

@ -33,8 +33,6 @@ in
# Markdown
davidanson.vscode-markdownlint
# C/C++
ms-vscode.cmake-tools
twxs.cmake
llvm-vs-code-extensions.vscode-clangd
# Nix
jnoortheen.nix-ide
@ -46,6 +44,9 @@ in
scala-lang.scala
scalameta.metals
(ms-vscode.cmake-tools.overrideAttrs (_: { sourceRoot = "extension"; }))
twxs.cmake
sterben.fpga-support
ms-vscode-remote.remote-ssh-edit
@ -55,7 +56,6 @@ in
catppuccin.catppuccin-vsc
# Rust
rust-lang.rust-analyzer
github.copilot
]);
userSettings = {
"workbench.colorTheme" = "Catppuccin Macchiato";

View file

@ -7,5 +7,6 @@
./hedgedoc.nix
./sing-box.nix
./kanidm-client.nix
./ssh-tpm-agent.nix # FIXME: Waiting for upstream merge
];
}

View file

@ -0,0 +1,48 @@
# Temporary workaround
{ config, pkgs, lib, ... }:
let
cfg = config.services.ssh-tpm-agent;
in
{
options = {
services.ssh-tpm-agent.enable = lib.mkEnableOption "TPM supported ssh agent in go";
};
config = lib.mkIf cfg.enable {
systemd.user.services.ssh-tpm-agent = {
enable = true;
unitConfig = {
Description = "SSH TPM agent service";
Documentation = "man:ssh-agent(1) man:ssh-add(1) man:ssh(1)";
Requires = "ssh-tpm-agent.socket";
ConditionEnvironment = "!SSH_AGENT_PID";
};
serviceConfig = {
Environment = "SSH_AUTH_SOCK=%t/ssh-tpm-agent.socket";
ExecStart = "${pkgs.ssh-tpm-agent}/bin/ssh-tpm-agent";
PassEnvironment = "SSH_AGENT_PID";
SuccessExitStatus = 2;
Type = "simple";
};
wants = [ "ssh-tpm-agent.socket" ];
};
systemd.user.sockets.ssh-tpm-agent = {
enable = true;
description = "SSH TPM agent socket";
socketConfig = {
ListenStream = "%t/ssh-tpm-agent.sock";
SocketMode = "0600";
Service = "ssh-tpm-agent.service";
};
wantedBy = [ "sockets.target" ];
};
environment = {
systemPackages = [ pkgs.ssh-tpm-agent ];
extraInit = ''
export SSH_AUTH_SOCK="$XDG_RUNTIME_DIR/ssh-tpm-agent.sock"
'';
};
};
}

10
overlays/add-pkgs.nix Normal file
View file

@ -0,0 +1,10 @@
{ config, pkgs, lib, ... }:
{
nixpkgs.overlays = [
(self: super: {
ssh-tpm-agent =
pkgs.callPackage ./pkgs/ssh-tpm-agent.nix { };
})
];
}

6
overlays/default.nix Normal file
View file

@ -0,0 +1,6 @@
{ config, pkgs, ... }:
{
imports = [
./add-pkgs.nix
];
}

View file

@ -0,0 +1,33 @@
{ lib
, buildGo122Module
, fetchFromGitHub
, openssl
}:
buildGo122Module rec {
pname = "ssh-tpm-agent";
version = "0.3.1";
src = fetchFromGitHub {
owner = "Foxboron";
repo = "ssh-tpm-agent";
rev = "v${version}";
hash = "sha256-8CGSiCOcns4cWkYWqibs6hAFRipYabKPCpkhxF4OE8w=";
};
proxyVendor = true;
vendorHash = "sha256-zUAIesBeuh1zlxXcjKSNmMawZGgUr9z3NzT0XKn/YCQ=";
buildInputs = [
openssl
];
meta = with lib; {
description = "SSH agent with support for TPM sealed keys for public key authentication";
homepage = "https://github.com/Foxboron/ssh-agent-tpm";
license = licenses.mit;
platforms = platforms.linux;
maintainers = with maintainers; [ sgo ];
};
}