starred/nix-config
1
0 Fork 0
mirror of https://github.com/ryan4yin/nix-config.git synced 2026-11-13 12:13:46 +01:00
Code Issues Packages Projects Releases 10 Wiki Activity
Files
71fa928254a9f4f186323d2b1950cfe2433bb9b7
nix-config/vars
T
History
ryan4yin | 二花 71fa928254 feat(canokey): sudo, SSH, LUKS and OpenPGP setup for daily use (#516) 
Use the CanoKey for daily authentication on idols-ai and shoukei, with
the existing passwords, passphrases and per-host SSH keys as fallback.

- sudo: pam_u2f with a shared origin (pam://ryan4yin) and a Nix-store
  authfile built from myvars.canokeyU2fKeys; the primary key is
  registered and touch-to-sudo works on idols-ai.
- SSH: one resident ed25519-sk key (application=ssh:ryan4yin) exported
  to ~/.ssh/id_ed25519_sk; GitHub tries it before the per-host key.
- shoukei LUKS: fido2-device=auto with token-timeout=10s. Update
  nixos-apple-silicon (linux-asahi 7.2.14), whose initrd adds
  thunderbolt_apple and reset_apple_cio so USB-C comes up before unlock.
- GPG: scdaemon disable-ccid so it uses pcscd.
- docs/security-keys.md: setup, PINs, enrollment, backup key and
  recovery; deduplicate the FIDO notes left by #515.

Assisted-by: Claude Code (claude-opus-5-5)
2026-11-04 01:50:21 -06:00
..
default.nix
feat(canokey): sudo, SSH, LUKS and OpenPGP setup for daily use (#516)
2026-11-04 01:50:21 -06:00
networking.nix
feat(remote-builders): build ai and shoukei on aquamarine (#467)
2026-10-17 00:49:22 +08:00
ports.nix
feat(youko): add pull-through cache for two Nix upstreams (#499)
2026-11-01 18:27:43 +08:00
README.md
feat(youko): add pull-through cache for two Nix upstreams (#499)
2026-11-01 18:27:43 +08:00

README.md

Variables

Common variables and configuration used across my NixOS and nix-darwin configurations.

Current Structure

vars/
├── README.md
├── default.nix         # Main variables entry point
├── networking.nix      # Network configuration and host definitions
└── ports.nix           # Loopback HTTP backend port registry

Components

1. default.nix

Contains user information, SSH keys, and password configuration:

  • User credentials (username, full name, email)
  • Initial hashed password for new installations
  • SSH authorized keys (main and backup sets)
  • Public key references for system access
  • Remote-builder client host keys (remoteBuilderClientKeys) that may build through aquamarine

2. networking.nix

Defines:

  • Gateway settings: Main router and proxy gateway configurations
  • Home LAN (lanCidr): the trusted LAN prefix the shared host firewall trusts by source
  • Cluster addressing: clusterULA6, the IPv6 ULA prefix for MicroVM guest addresses, and k8sVip, each k3s cluster's kube-vip API and LoadBalancer VIP block
  • DNS servers: IPv4 and IPv6 name servers
  • Host inventory: static LAN hosts and their interfaces; DHCP/mobile hosts (such as the macOS hosts) are omitted by design. homeOnly = true marks an address that exists only at home; SSH aliases and monitoring skip it
  • SSH configuration: Host aliases and known hosts configuration
  • Network topology: Physical machines, VMs, Kubernetes clusters, and SBCs

Host Categories

networking.nix maps each host to its LAN address and interface. The authoritative inventory is ../hosts/README.md; this file holds only the addresses.

Usage

These variables are imported and used throughout the configuration.

Reference in new issue View Git Blame Copy Permalink