mirror of
https://github.com/ryan4yin/nix-config.git
synced 2026-11-13 12:13:46 +01:00
ryan4yin | 二花
7cfda39c2c
The CanoKey resident SSH key (`ryan@canokey-moe`, the backup once a new primary key is enrolled) is now authorized for ryan and root on every host, and sudo on server and agent hosts accepts its touch through the forwarded agent (`pam_rssh`). Without the key or a forwarded agent, sudo asks for the password and login falls back to the file keys. Only `canokeySshKeys` can satisfy sudo. Risks to weigh: - Colmena deploys need one touch per host connection, since the agent offers the CanoKey key first. - Desktops now forward the agent to every `hostsAddr` alias, as they already did for `192.168.*`; while a session is open, root there can request signatures, each needing a touch. ### Verification - `just test` exits 0; CI passed on the first commit. - Evaluated: sudo PAM stack `rssh` → `unix` → `deny` on shoryu, kana, akane and k3s-test-1-master-1, ai-niri keeps `pam_u2f`; shoryu root and ryan list `ryan@canokey-moe`. - Not yet verified on a running host. ### Manual step after merge Deploy the servers, then `just niri`; close old multiplexed connections (`ssh -O exit <host>`) and try `sudo true` over SSH. AI assistance: DeepSeek Harness (claude-opus-5-5). Assisted-by: DeepSeek Harness (claude-opus-5-5)
Documentation
Canonical index for this repository. Standalone reference material lives in this directory. Component runbooks stay next to the code they describe so they remain visible during maintenance; every human-facing document is linked here.
README.md and AGENTS.md remain at the repository root because GitHub and coding agents require
those entry points.
Repository
- Repository overview — systems, components, deployment and validation quick start.
- Agent guide — repository conventions, command hazards and validation rules.
- NixOS modernization options — design options and decisions.
Operations and policy
- Security — threat model, trust boundaries, implemented controls and audits.
- Backups — backup layers, password model, retention and restore procedure.
- Hardware security keys — CanoKey/YubiKey setup, backup keys and recovery.
- Workarounds and known gaps — pins, temporary workarounds and removal conditions.
- BIOS settings — firmware settings for the physical hosts.
- Wake-on-LAN — firmware prerequisites, NixOS setup and wake commands.
- Runtime hardening validation.
Hosts and services
- Host inventory and deployment notes.
- AI desktop: host runbook and VR notes.
- Akane: host runbook.
- Aquamarine: host runbook, iGPU notes and ROCm notes.
- Kana: host runbook.
- Ruby: host runbook.
- Shoukei: host runbook.
- Youko homelab: services overview, Immich, monitoring, alert rules, recording rules and Grafana dashboards.
- Kubernetes cluster: k8s host notes and disko configuration.
- Infrastructure: infra overview, RustFS, Loki storage and Terraform S3 backend.
- NixOS installation: installer guide and Shoukei notes.
- Certificates: certificate setup.
Configuration structure
- NixOS and nix-darwin modules, including Darwin modules, Mihomo networking and Sunshine.
- Home Manager modules.
- Flake outputs and tests.
- Secrets management.
- Overlays, shared library helpers and shared variables.
- Hardening wrappers and policy.
Desktop and Home Manager details
- Darwin, per-host Home Manager profiles and Linux.
- Linux desktop stack: base GUI, Fcitx5, hypridle, vinput and i3.
- Base Home Manager profile: editors, editor glossary, Helix, Neovim, Rime and terminal.
- Terminal tools: agents and dsh notes, editors, encryption, GPG and password store.