tree imports all now

tree/boot.nix

@@ -0,0 +1,23 @@
+{...}: {
+  flake.nixosModules.boot = {
+    boot = {
+      loader = {
+        efi.canTouchEfiVariables = true;
+        systemd-boot.enable = true;
+      };
+      plymouth.enable = false;
+      # consoleLogLevel = 0;
+      # initrd.verbose = false;
+      # kernelParams = [
+      #   "quiet"
+      #   "splash"
+      #   "boot.shell_on_fail"
+      #   "loglevel=3"
+      #   "rd.systemd.show_status=false"
+      #   "rd.udev.log_level=3"
+      #   "udev.log_priority=3"
+      # ];
+    };
+    system.stateVersion = "24.05";
+  };
+}

tree/deploy.nix

@@ -0,0 +1,84 @@
+{...}: {
+  flake.nixosModules.deploy = {
+    config,
+    pkgs,
+    lib,
+    ...
+  }:
+    with lib; let
+      cfg = config.c.services.remote-deploy;
+    in {
+      options.c.services.remote-deploy = {
+        enable = mkEnableOption "Enable remote deployment with nixinate.";
+        host = mkOption {
+          type = types.str;
+          description = "Hostname to connect to.";
+        };
+        user = mkOption {
+          type = types.str;
+          default = "deploy";
+          description = "Username for deploy account.";
+        };
+        group = mkOption {
+          type = types.str;
+          default = "deploy";
+          description = "Group for deploy account.";
+        };
+        keys = mkOption {
+          type = types.listOf types.str;
+          description = "Authorised SSH keys for deployment";
+        };
+        port = mkOption {
+          type = types.port;
+          default = 22;
+          description = "SSH port to use.";
+        };
+        buildOn = mkOption {
+          type = types.enum [
+            "local"
+            "remote"
+          ];
+          default = "local";
+          description = "Where to build the config.";
+        };
+        substituteOnTarget = mkOption {
+          type = types.bool;
+          default = true;
+          description = "Substitute closures and paths from remote";
+        };
+      };
+      config = mkIf cfg.enable {
+        _module.args = {
+          nixinate = {
+            inherit
+              (cfg)
+              host
+              buildOn
+              port
+              substituteOnTarget
+              ;
+            sshUser = cfg.user;
+          };
+        };
+        users.groups."${cfg.group}" = {};
+        users.users."${cfg.user}" = {
+          isSystemUser = true;
+          shell = pkgs.bash;
+          inherit (cfg) group;
+          openssh.authorizedKeys.keys = cfg.keys;
+        };
+        nix.settings.trusted-users = [cfg.user];
+        security.sudo.extraRules = [
+          {
+            groups = [cfg.group];
+            commands = [
+              {
+                command = "ALL";
+                options = ["NOPASSWD"];
+              }
+            ];
+          }
+        ];
+      };
+    };
+}

tree/gpg-pinentry-wayland.nix

@@ -0,0 +1,5 @@
+{...}: {
+  flake.nixosModules.gpg-pinentry-wayland = {pkgs, ...}: {
+    services.dbus.packages = [pkgs.gcr];
+  };
+}

tree/hm.nix

@@ -0,0 +1,6 @@
+{...}: {
+  flake.nixosModules.hm = {...}: {
+    home-manager.useGlobalPkgs = true;
+    home-manager.useUserPackages = true;
+  };
+}

tree/keys.nix

@@ -0,0 +1,7 @@
+{...}: {
+  flake.nixosModules.keys = {lib, ...}: {
+    options.keys = lib.mkOption {
+      default = import ../lib/keys.nix;
+    };
+  };
+}

tree/nix.nix

@@ -0,0 +1,31 @@
+{inputs, ...}: {
+  flake.nixosModules.nix-config = {
+    nix = {
+      registry.nixpkgs.flake = inputs.nixpkgs;
+      registry.unstable.flake = inputs.unstable;
+      gc = {
+        automatic = true;
+        dates = "weekly";
+        options = "--delete-older-than 7d";
+      };
+      extraOptions = "gc-keep-outputs = true";
+      settings = {
+        experimental-features = [
+          "nix-command"
+          "flakes"
+          "auto-allocate-uids"
+        ];
+        auto-optimise-store = true;
+        auto-allocate-uids = true;
+        substituters = [
+          "https://nix-community.cachix.org"
+          "https://callumio-public.cachix.org"
+        ];
+        trusted-public-keys = [
+          "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
+          "callumio-public.cachix.org-1:VucOSl7vh44GdqcILwMIeHlI0ufuAnHAl8cO1U/7yhg="
+        ];
+      };
+    };
+  };
+}

tree/secrets.nix

@@ -0,0 +1,5 @@
+{...}: {
+  flake.nixosModules.secrets = {...}: {
+    imports = [../secrets/secrets-configuration.nix];
+  };
+}

tree/tailscale.nix

@@ -0,0 +1,38 @@
+{...}: {
+  flake.nixosModules.tailscale = {
+    config,
+    lib,
+    ...
+  }:
+    with lib; let
+      cfg = config.c.services.mesh;
+    in {
+      options.c.services.mesh = {
+        enable = mkEnableOption "Enable tailscale daemon.";
+        exitNode = mkOption {
+          type = types.bool;
+          default = false;
+          description = "Enable advertising as an exit node.";
+        };
+        keyFile = mkOption {
+          type = types.path;
+          description = "Path to key file.";
+        };
+      };
+      config = mkIf cfg.enable {
+        services.tailscale = {
+          enable = true;
+          openFirewall = true;
+          authKeyFile = cfg.keyFile;
+          extraUpFlags = [
+            "--login-server"
+            "https://mesh.cleslie.uk"
+          ];
+          extraSetFlags = [(mkIf cfg.exitNode "--advertise-exit-node")];
+        };
+        networking.firewall = {
+          trustedInterfaces = [config.services.tailscale.interfaceName];
+        };
+      };
+    };
+}