From ed573f187a38a42cb65a85e52732282b7defc5e2 Mon Sep 17 00:00:00 2001 From: moons-14 Date: Thu, 25 Jun 2026 19:26:05 +0900 Subject: [PATCH] add host --- .sops.yaml | 2 + .../hardware-configuration.nix | 40 ++++++++++++++++++ secrets/common/system.yaml | 41 +++++++++++-------- 3 files changed, 67 insertions(+), 16 deletions(-) create mode 100644 hosts/internal-app-01/hardware-configuration.nix diff --git a/.sops.yaml b/.sops.yaml index 829eeaa..0aefbf7 100644 --- a/.sops.yaml +++ b/.sops.yaml @@ -2,6 +2,7 @@ keys: - &admin_yubikey1 age1yubikey1qvy5y8kxqc63y7fk0tfv43u499a8z8q332ff087lythry9cc6hdxxkznc6t - &host_x1g13 age12g85cuvg4kjfr79lqf5fx2k0d82tchrgv88xgkt7ukk2cfcsw98s2rjyat - &host_ops age18rtm2dq2r62zvnhwdq0gkm24hu85r7zyleyk3jqv22zpdtw064eq7ay7dl + - &host_internal-app-01 age1mcp5gma7y0k59equhzqfsnn0ed335ljjtn0k08ua77htlxf0x54qsravch creation_rules: - path_regex: ^secrets/common/[^/]+\.ya?ml$ key_groups: @@ -9,6 +10,7 @@ creation_rules: - *admin_yubikey1 - *host_x1g13 - *host_ops + - *host_internal-app-01 - path_regex: ^secrets/hosts/x1g13/[^/]+\.ya?ml$ key_groups: - age: diff --git a/hosts/internal-app-01/hardware-configuration.nix b/hosts/internal-app-01/hardware-configuration.nix new file mode 100644 index 0000000..8dafc0b --- /dev/null +++ b/hosts/internal-app-01/hardware-configuration.nix @@ -0,0 +1,40 @@ +# Do not modify this file! It was generated by ‘nixos-generate-config’ +# and may be overwritten by future invocations. Please make changes +# to /etc/nixos/configuration.nix instead. +{ lib, modulesPath, ... }: + +{ + imports = [ + (modulesPath + "/profiles/qemu-guest.nix") + ]; + + boot.initrd.availableKernelModules = [ + "ata_piix" + "uhci_hcd" + "virtio_pci" + "virtio_scsi" + "sd_mod" + "sr_mod" + ]; + boot.initrd.kernelModules = [ ]; + boot.kernelModules = [ ]; + boot.extraModulePackages = [ ]; + + fileSystems."/" = { + device = "/dev/disk/by-uuid/1b12ab98-2537-4207-a3f4-bb8ba7b53b00"; + fsType = "ext4"; + }; + + fileSystems."/boot" = { + device = "/dev/disk/by-uuid/8365-C778"; + fsType = "vfat"; + options = [ + "fmask=0077" + "dmask=0077" + ]; + }; + + swapDevices = [ ]; + + nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux"; +} diff --git a/secrets/common/system.yaml b/secrets/common/system.yaml index e1ac360..4d3315f 100644 --- a/secrets/common/system.yaml +++ b/secrets/common/system.yaml @@ -5,32 +5,41 @@ sops: age: - enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHBpdi1wMjU2IGxWc2NMZyBBNERDOVU2 - WkRMb05iS3Bmb3NxSnIrNEhDdTdrR25XZFB5aksweWtKRGxyNwpPWlpReXJCUVI4 - NzJMM1JKYTV0MTNxTkpxak9MRmdnaGpabHpTVHl2bUNBCi0tLSBwbnVKSnB6bnI2 - VVlrQ3p3d3ZtT3o4b3lxaVJpd0NCUkQ4VkE0bVMzYmpZCqArP2/pKAH3EuD4dPAU - Q8YWwWwtPWcANud8Ry1jSzg2HCOfrdv3AXaSlXdTbuIr3Q0yREM9YtCvxxYbXpt8 - Gpg= + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHBpdi1wMjU2IGxWc2NMZyBBbEttK0xB + ZVVDWk03alZnR3lGZEY4VlJMdTRTMXNDdHR6QW5YekgwZ3B0SQordFdPRUh4YU80 + MmxMNFdKbTNMVXZPMVVNY3ZKdjczWnhWTzYxbUV6NC9rCi0tLSBDSGlUWC9SVW1T + MitabjYrWG1FVG5xUGhqSVZDekgrQmcxSUZGSklFdU5vCu3bLs7yVM7vxFX2q3pt + W/4VEsxzYZN2aITrRfbVWCgwVyYBh3WbcImU8oLOhZ2nfgqfcQ5x2LVu1IzuCSdd + cjo= -----END AGE ENCRYPTED FILE----- recipient: age1yubikey1qvy5y8kxqc63y7fk0tfv43u499a8z8q332ff087lythry9cc6hdxxkznc6t - enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAxSmhCZU5kOGpNY1ZUNVFP - aFFBVWU0Vk14d1FHWmFvK0hjY21KcWdWZ2dJCmZvRDQ5aFRYRVFld3hZckIvcjJ3 - NUN2SERTOHQ3SEFFdXJXRFdpVGttVkEKLS0tIGp3aUI4TG9KU2NsbVlteG9lUGRv - SndsRCtpTUlFYWpJQ1NuSm40V0V1NWcKjMsZkKuDxsF3TH5G/rgilApv3BD/fqs5 - VucqOyeJXXv7ErkxFKm6EynSOzUiA82mDzyW+cF+0GFxheKfOlXKGw== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBVaWxxVWFSTUxDNy9KaGlE + ZVBWVHF2eEFXZnJLaXdiSW5kMUJpYiswVGhjCmFkcUhTMXhuRFpLTG9Udkd1UXI2 + MkN5VXJSNUNiQUp2MzFIbzhhbVZ3aGsKLS0tIGE3ZXlsMjdRb2RBM1lVMHRSY0I4 + SUVnNjFZVFQzZ3Y4UjlaK3ZNOXdGRXcKyrd86CUWYi13i+M7ESKQH3W41M2/pc60 + 04Px/7G7urIlgjfEV/wXaVIyeSU8Eb65uI/AOseJwH3v4IbW6Nd6bw== -----END AGE ENCRYPTED FILE----- recipient: age12g85cuvg4kjfr79lqf5fx2k0d82tchrgv88xgkt7ukk2cfcsw98s2rjyat - enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBUc29ucGhmODQvak9zL2NR - N3RUUzJYaC9idVl5bFB2c0ZDWlFIQ2Z0M21RCnRiaDl0aU5wSVdkalBXeW44RW9M - MlFFZ0RzUTVJL1YrN2JwRmtLRHBsem8KLS0tIGhVLzNIbmhrcGR2MWludFo1WGlF - ZCtCSXZyTE93Ull5VlkySnNTVGt0QncKqy+8NsS6tLWR31gJgOMDT49+vu4ZQRhS - 13XPPrRqxaaTRG+CTAQyu25FtGt8sH3rOs0VNfMj7TAtHZPGjn0L4A== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA2UDU4VFJ1d3VDa2lDNURW + RDFMQWFzNWRwcUFqT25KR29MU0x2NW9GMkFZCjJwUExKOFRPRW9kZWxVSisreVRo + Y2Era2dHZk1QR04xMkNGcnROR2R3eHcKLS0tIGh4alhBamJzVnMyczBMK0l4TEUr + WjF2R2N2RHdkMGh3VkdwKy9kb0VZOXMKCC3bEZROBi45aydfI5UL4oPP+ce91/UK + tOuHzwituiYZdJ79a/wXRJMFPg9eCiziSR3uLeP8279oLM417Drwxg== -----END AGE ENCRYPTED FILE----- recipient: age18rtm2dq2r62zvnhwdq0gkm24hu85r7zyleyk3jqv22zpdtw064eq7ay7dl + - enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBYZlNDTnhFSi9iOXZEcHdQ + U1kreStxZ2dJd0g4dE1rdDQrSk5QTUhMbm5JCmRNc0k4K2VrTTFnaFNFSkd1em1J + SGczRnFzK2RlSzFPQnVUWHZUdzYyL2MKLS0tICtBbk9Zc0tYaXJ6a3FXcUQ5R0xv + MVZxUGZTaHJyeGNjS1B2SVhJLzAyNFkKNGE5sNLodP5TcXqvW//JLRW/5g8I0Hzc + cAgBXe+70HqFzEHQF1X7jHSZarTwclaNsjQPVyEaQfxYf+mLh+bTaA== + -----END AGE ENCRYPTED FILE----- + recipient: age1mcp5gma7y0k59equhzqfsnn0ed335ljjtn0k08ua77htlxf0x54qsravch lastmodified: "2026-06-15T10:20:19Z" mac: ENC[AES256_GCM,data:Tw58FneoksiOuol1aUOFXoAnFiTzddmFfYAA0B0RfPPyj6UKQbBvRYJhOMuOMRE1fVlDhqxxDiqZI5y14vJg8gLusAZt1JKi7ODR7MqcImvxboaee8DIj4uIcN254g0c0cmZWsGrt7yTYoSLDUc3QdAxj9/Az/CMls6XjM+RL8E=,iv:XGgWgbexCUxzuJzRVG3V2GZGwmwjAtowgz+NRPxk1+o=,tag:FwYJXfwS2f70okl0bhS+Sw==,type:str] unencrypted_suffix: _unencrypted