Ren key

keys/ren.pub

@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIM1gLSFZSVq+5s58+pymRJY+QOWHm6SZvvhY93YDm5k ren@me.com

keys/secrets.nix

@@ -2,6 +2,7 @@ let
   selene = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBEiuoUbvgZ2N03MTcWw4z+oUB9SG0jR0fy5AnTTBHym" "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKcfmaqbtwSEydV2hge/aDWxfwlKOw/JJZZWy8ycjojH" ];
   macbook = [ (builtins.readFile ./macbook.pub) ];
   master = [ (builtins.readFile ./master.pub) ];
+  ren = [ (builtins.readFile ./ren.pub) ];
 in
 {
   "jellyfin-key".publicKeys = selene;
@@ -10,6 +11,7 @@ in
   "master.priv".publicKeys = macbook ++ master;
   "wg-selene".publicKeys = macbook ++ selene ++ master;
   "wg-macbook".publicKeys = macbook ++ master;
-  "hetzner.priv".publicKeys = macbook ++ selene ++ master;
+  "hetzner.priv".publicKeys = macbook ++ selene ++ master ++ ren;
   "wg-ren".publicKeys = macbook++master;
+  "ren.priv".publicKeys = master ++ ren;
 }

keys/wg-macbook

@@ -1,7 +1,8 @@
 age-encryption.org/v1
--> ssh-ed25519 M7OTMg PyrVB10SxQZdhrwusKh+m6944Nj5vqBL6qGum8qK4Qg
+-> ssh-ed25519 M7OTMg f7fgG3DiQpjnDRSEUjSinuqgLATaK7QRN59bSimH1EU
-huIr2n2ciTqu11o6ApcCoVMstQ9b3XoRfgAtU79wdnY
+9sKf6eQVwqVBrB553zCHwFs0uyQGRpIJkBZ0AyXPFC4
--> ssh-ed25519 CJLJQg 2O7UQVLdlMJZzt5TOo5EYpfWjKAnNLJ6OQY+xRTp2go
+-> ssh-ed25519 CJLJQg +b+cRU3irwvMnqVBWBIV4GoRyEy+Lg3LHUxZ/httTDo
-TonYGAfBSeUpSHl+jHSG2qO9kWseAxfog1oWeGFWc5s
+uBlqCHMXyf1Um+W6y1Bh9pY0osqdeTgFQGuR6eSHQP4
---- Hh8KEiQFjdy2xYqcBX4L6XSp4GPpO29tSPrfpnZlv5o
+--- Ft1Ii2eVy0h8X6h7ABOW6ryT4ctxg9jS8utA7s52bBA
-Ó?À¤ÿ‡$‡ÜJΦŸßÑ^¦w’oÌ›Nv’ŠŽÍ*#å4„+=â·Á[ltÒQF™6Õ-Æwiy.Ú¢8¡iýýÒž'.H,a£
+zÅÙÈ0¿yžÀWÏ¥‹4Í°ö^|
+M<EFBFBD>æüuRtLµ
A†:µê¨ó„*ö<>œËÈ‚h2†ìSζèkå’¬ìFò‚&è	må1y£

keys/wg-ren

@@ -0,0 +1,7 @@
+age-encryption.org/v1
+-> ssh-ed25519 M7OTMg QdJds7EpXMyyO9aKmqQg3HWmY6RQbzkQxRQw+K9fn14
+/SlvfJAOmCqYvIOZm/ZSynAIWSC+2dAvPpa+5Me6I8k
+-> ssh-ed25519 CJLJQg MqNRTuwFcRdZ5VFbcgXQwjRxMAHLJEdUKLuXFPtkRVc
+qRaaJzGRPiW2doetErhhUKwUXitvsQ5CGl2QzGK44Ss
+--- fCQGYqP7qr+S1tzDeyce5Bn4iWsXq+kIe/ojPNj0LVA
+¹4µZŽÁ“Çi"Õž3ÄÞW+€i¾ï9ç8Íßž=¼<>Œ¿u°ÃnB’ÚÂy]@›[X[]²	X—„Û5ªîÌœðîö¢íÄz°lÊ@

keys/wg-ren.pub

@@ -0,0 +1 @@
+wvTFERFXOPcgziLtLtfF3LGv5zmBWikCy/yLRwSuxWA=

systems/ren/hardware.nix

@@ -6,9 +6,25 @@
     efiInstallAsRemovable = true;
     device = "nodev";
   };
-  fileSystems."/boot" = { device = "/dev/disk/by-uuid/0683-2D32"; fsType = "vfat"; };
+  fileSystems."/boot" = {
-  boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "xen_blkfront" "vmw_pvscsi" ];
+    device = "/dev/disk/by-uuid/0683-2D32";
+    fsType = "vfat";
+  };
+  boot.initrd.availableKernelModules = [
+    "ata_piix"
+    "uhci_hcd"
+    "xen_blkfront"
+    "vmw_pvscsi"
+  ];
   boot.initrd.kernelModules = [ "nvme" ];
-  fileSystems."/" = { device = "/dev/sda1"; fsType = "ext4"; };
+  fileSystems."/" = {
+    device = "/dev/sda1";
+    fsType = "ext4";
+  };
   system.stateVersion = "23.11";
+  nix.settings.experimental-features = [
+    "nix-command"
+    "flakes"
+  ];
+
 }

systems/ren/system.nix

@@ -23,6 +23,12 @@ nixpkgs.lib.nixosSystem {
       networking.hostName = "Ren";
       networking.domain = "";
       services.openssh.enable = true;
+      networking.firewall = {
+        enable = true;
+        allowedTCPPorts = [
+          22
+        ];
+      };
     }
     ./users.nix
     ./hardware.nix

systems/ren/users.nix

@@ -21,6 +21,8 @@
   };
 
   users.users.root.openssh.authorizedKeys.keys = [
-      (builtins.readFile ../../keys/hetzner.pub)
+    (builtins.readFile ../../keys/hetzner.pub)
-    ];
+  ];
+  age.identityPaths = [ "/home/ren/.ssh/id_ed25519" ];
+
 }