Merge pull request #22 from caperren/working-branch

Added changes for homelab cube cluster, no longer using unstable branch for packages, improved sudoers entries

flake.nix

@@ -2,7 +2,7 @@
   description = "Nixos config flake";
 
   inputs = {
-    nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";
+    nixpkgs.url = "github:nixos/nixpkgs/nixos-25.11";
     nixos-hardware.url = "github:NixOS/nixos-hardware/master";
 
     home-manager = {
@@ -20,6 +20,69 @@
       ...
     }@inputs:
     {
+      nixosConfigurations.cap-clust-01 = nixpkgs.lib.nixosSystem {
+        system = "x86_64-linux";
+        modules = [
+          ./hosts/cap-clust-01/configuration.nix
+          inputs.home-manager.nixosModules.default
+        ];
+      };
+      nixosConfigurations.cap-clust-02 = nixpkgs.lib.nixosSystem {
+        system = "x86_64-linux";
+        modules = [
+          ./hosts/cap-clust-02/configuration.nix
+          inputs.home-manager.nixosModules.default
+        ];
+      };
+      nixosConfigurations.cap-clust-03 = nixpkgs.lib.nixosSystem {
+        system = "x86_64-linux";
+        modules = [
+          ./hosts/cap-clust-03/configuration.nix
+          inputs.home-manager.nixosModules.default
+        ];
+      };
+      nixosConfigurations.cap-clust-04 = nixpkgs.lib.nixosSystem {
+        system = "x86_64-linux";
+        modules = [
+          ./hosts/cap-clust-04/configuration.nix
+          inputs.home-manager.nixosModules.default
+        ];
+      };
+      nixosConfigurations.cap-clust-05 = nixpkgs.lib.nixosSystem {
+        system = "x86_64-linux";
+        modules = [
+          ./hosts/cap-clust-05/configuration.nix
+          inputs.home-manager.nixosModules.default
+        ];
+      };
+      nixosConfigurations.cap-clust-06 = nixpkgs.lib.nixosSystem {
+        system = "x86_64-linux";
+        modules = [
+          ./hosts/cap-clust-06/configuration.nix
+          inputs.home-manager.nixosModules.default
+        ];
+      };
+      nixosConfigurations.cap-clust-07 = nixpkgs.lib.nixosSystem {
+        system = "x86_64-linux";
+        modules = [
+          ./hosts/cap-clust-07/configuration.nix
+          inputs.home-manager.nixosModules.default
+        ];
+      };
+      nixosConfigurations.cap-clust-08 = nixpkgs.lib.nixosSystem {
+        system = "x86_64-linux";
+        modules = [
+          ./hosts/cap-clust-08/configuration.nix
+          inputs.home-manager.nixosModules.default
+        ];
+      };
+      nixosConfigurations.cap-clust-09 = nixpkgs.lib.nixosSystem {
+        system = "x86_64-linux";
+        modules = [
+          ./hosts/cap-clust-09/configuration.nix
+          inputs.home-manager.nixosModules.default
+        ];
+      };
 
       nixosConfigurations.cap-slim7 = nixpkgs.lib.nixosSystem {
         system = "x86_64-linux";

hosts/cap-clust-01/configuration.nix

@@ -0,0 +1,12 @@
+{ config, pkgs, ... }:
+{
+  imports = [
+    # Hardware Scan
+    ./hardware-configuration.nix
+
+    # Host Groups
+    ../../modules/host-groups/cluster.nix
+  ];
+
+  networking.hostName = "cap-clust-01";
+}

hosts/cap-clust-01/hardware-configuration.nix

@@ -0,0 +1,52 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{
+  config,
+  lib,
+  pkgs,
+  modulesPath,
+  ...
+}:
+
+{
+  imports = [
+    (modulesPath + "/installer/scan/not-detected.nix")
+  ];
+
+  boot.initrd.availableKernelModules = [
+    "xhci_pci"
+    "ahci"
+    "ehci_pci"
+    "usb_storage"
+    "usbhid"
+    "sd_mod"
+  ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [
+    "kvm-amd"
+    "amdgpu"
+  ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" = {
+    device = "/dev/disk/by-uuid/0028a3af-8470-46c2-81ca-6d9be16a6236";
+    fsType = "ext4";
+  };
+
+  fileSystems."/boot" = {
+    device = "/dev/disk/by-uuid/C389-7B6B";
+    fsType = "vfat";
+    options = [
+      "fmask=0077"
+      "dmask=0077"
+    ];
+  };
+
+  swapDevices = [
+    { device = "/dev/disk/by-uuid/2b063ac4-54ee-4b16-b766-9c470733995c"; }
+  ];
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+}

hosts/cap-clust-02/configuration.nix

@@ -0,0 +1,12 @@
+{ config, pkgs, ... }:
+{
+  imports = [
+    # Hardware Scan
+    ./hardware-configuration.nix
+
+    # Host Groups
+    ../../modules/host-groups/cluster.nix
+  ];
+
+  networking.hostName = "cap-clust-02";
+}

hosts/cap-clust-02/hardware-configuration.nix

@@ -0,0 +1,52 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{
+  config,
+  lib,
+  pkgs,
+  modulesPath,
+  ...
+}:
+
+{
+  imports = [
+    (modulesPath + "/installer/scan/not-detected.nix")
+  ];
+
+  boot.initrd.availableKernelModules = [
+    "xhci_pci"
+    "ahci"
+    "ehci_pci"
+    "usb_storage"
+    "usbhid"
+    "sd_mod"
+  ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [
+    "kvm-amd"
+    "amdgpu"
+  ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" = {
+    device = "/dev/disk/by-uuid/9fcf291d-2576-44b4-bcba-98e40305e531";
+    fsType = "ext4";
+  };
+
+  fileSystems."/boot" = {
+    device = "/dev/disk/by-uuid/7727-439F";
+    fsType = "vfat";
+    options = [
+      "fmask=0077"
+      "dmask=0077"
+    ];
+  };
+
+  swapDevices = [
+    { device = "/dev/disk/by-uuid/56f2d727-03c5-4aef-9871-217bf98cdbb4"; }
+  ];
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+}

hosts/cap-clust-03/configuration.nix

@@ -0,0 +1,12 @@
+{ config, pkgs, ... }:
+{
+  imports = [
+    # Hardware Scan
+    ./hardware-configuration.nix
+
+    # Host Groups
+    ../../modules/host-groups/cluster.nix
+  ];
+
+  networking.hostName = "cap-clust-03";
+}

hosts/cap-clust-03/hardware-configuration.nix

@@ -0,0 +1,52 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{
+  config,
+  lib,
+  pkgs,
+  modulesPath,
+  ...
+}:
+
+{
+  imports = [
+    (modulesPath + "/installer/scan/not-detected.nix")
+  ];
+
+  boot.initrd.availableKernelModules = [
+    "xhci_pci"
+    "ahci"
+    "ehci_pci"
+    "usbhid"
+    "usb_storage"
+    "sd_mod"
+  ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [
+    "kvm-amd"
+    "amdgpu"
+  ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" = {
+    device = "/dev/disk/by-uuid/c2cfd56f-0090-45eb-a239-068fdadd2fd4";
+    fsType = "ext4";
+  };
+
+  fileSystems."/boot" = {
+    device = "/dev/disk/by-uuid/C3CF-3854";
+    fsType = "vfat";
+    options = [
+      "fmask=0077"
+      "dmask=0077"
+    ];
+  };
+
+  swapDevices = [
+    { device = "/dev/disk/by-uuid/e60a5ced-d01e-4613-afba-9b445bc43097"; }
+  ];
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+}

hosts/cap-clust-04/configuration.nix

@@ -0,0 +1,12 @@
+{ config, pkgs, ... }:
+{
+  imports = [
+    # Hardware Scan
+    ./hardware-configuration.nix
+
+    # Host Groups
+    ../../modules/host-groups/cluster.nix
+  ];
+
+  networking.hostName = "cap-clust-04";
+}

hosts/cap-clust-04/hardware-configuration.nix

@@ -0,0 +1,52 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{
+  config,
+  lib,
+  pkgs,
+  modulesPath,
+  ...
+}:
+
+{
+  imports = [
+    (modulesPath + "/installer/scan/not-detected.nix")
+  ];
+
+  boot.initrd.availableKernelModules = [
+    "xhci_pci"
+    "ahci"
+    "ehci_pci"
+    "usbhid"
+    "usb_storage"
+    "sd_mod"
+  ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [
+    "kvm-amd"
+    "amdgpu"
+  ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" = {
+    device = "/dev/disk/by-uuid/b9c79a2f-8c6a-4f86-8562-b2f882992e95";
+    fsType = "ext4";
+  };
+
+  fileSystems."/boot" = {
+    device = "/dev/disk/by-uuid/EF0B-C66E";
+    fsType = "vfat";
+    options = [
+      "fmask=0077"
+      "dmask=0077"
+    ];
+  };
+
+  swapDevices = [
+    { device = "/dev/disk/by-uuid/9a123c08-cc9b-4516-a158-b274e9b399c3"; }
+  ];
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+}

hosts/cap-clust-05/configuration.nix

@@ -0,0 +1,12 @@
+{ config, pkgs, ... }:
+{
+  imports = [
+    # Hardware Scan
+    ./hardware-configuration.nix
+
+    # Host Groups
+    ../../modules/host-groups/cluster.nix
+  ];
+
+  networking.hostName = "cap-clust-05";
+}

hosts/cap-clust-05/hardware-configuration.nix

@@ -0,0 +1,52 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{
+  config,
+  lib,
+  pkgs,
+  modulesPath,
+  ...
+}:
+
+{
+  imports = [
+    (modulesPath + "/installer/scan/not-detected.nix")
+  ];
+
+  boot.initrd.availableKernelModules = [
+    "xhci_pci"
+    "ahci"
+    "ehci_pci"
+    "usbhid"
+    "usb_storage"
+    "sd_mod"
+  ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [
+    "kvm-amd"
+    "amdgpu"
+  ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" = {
+    device = "/dev/disk/by-uuid/51ce9236-fe8c-49bc-bb90-1e582d163d04";
+    fsType = "ext4";
+  };
+
+  fileSystems."/boot" = {
+    device = "/dev/disk/by-uuid/FF5C-EB30";
+    fsType = "vfat";
+    options = [
+      "fmask=0077"
+      "dmask=0077"
+    ];
+  };
+
+  swapDevices = [
+    { device = "/dev/disk/by-uuid/1d24fd7d-c958-44ad-bb28-c394f3d56a6b"; }
+  ];
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+}

hosts/cap-clust-06/configuration.nix

@@ -0,0 +1,12 @@
+{ config, pkgs, ... }:
+{
+  imports = [
+    # Hardware Scan
+    ./hardware-configuration.nix
+
+    # Host Groups
+    ../../modules/host-groups/cluster.nix
+  ];
+
+  networking.hostName = "cap-clust-06";
+}

hosts/cap-clust-06/hardware-configuration.nix

@@ -0,0 +1,52 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{
+  config,
+  lib,
+  pkgs,
+  modulesPath,
+  ...
+}:
+
+{
+  imports = [
+    (modulesPath + "/installer/scan/not-detected.nix")
+  ];
+
+  boot.initrd.availableKernelModules = [
+    "xhci_pci"
+    "ahci"
+    "ehci_pci"
+    "usbhid"
+    "usb_storage"
+    "sd_mod"
+  ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [
+    "kvm-amd"
+    "amdgpu"
+  ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" = {
+    device = "/dev/disk/by-uuid/8cf14e41-2af7-4bbd-89e2-90f5d04601b8";
+    fsType = "ext4";
+  };
+
+  fileSystems."/boot" = {
+    device = "/dev/disk/by-uuid/33C3-BB59";
+    fsType = "vfat";
+    options = [
+      "fmask=0077"
+      "dmask=0077"
+    ];
+  };
+
+  swapDevices = [
+    { device = "/dev/disk/by-uuid/262fa61f-4beb-4822-ace6-bb15c62b2cca"; }
+  ];
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+}

hosts/cap-clust-07/configuration.nix

@@ -0,0 +1,12 @@
+{ config, pkgs, ... }:
+{
+  imports = [
+    # Hardware Scan
+    ./hardware-configuration.nix
+
+    # Host Groups
+    ../../modules/host-groups/cluster.nix
+  ];
+
+  networking.hostName = "cap-clust-07";
+}

hosts/cap-clust-07/hardware-configuration.nix

@@ -0,0 +1,52 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{
+  config,
+  lib,
+  pkgs,
+  modulesPath,
+  ...
+}:
+
+{
+  imports = [
+    (modulesPath + "/installer/scan/not-detected.nix")
+  ];
+
+  boot.initrd.availableKernelModules = [
+    "xhci_pci"
+    "ahci"
+    "ehci_pci"
+    "usbhid"
+    "usb_storage"
+    "sd_mod"
+  ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [
+    "kvm-amd"
+    "amdgpu"
+  ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" = {
+    device = "/dev/disk/by-uuid/ad88a1b0-c98e-4a95-9fb3-3299169c952b";
+    fsType = "ext4";
+  };
+
+  fileSystems."/boot" = {
+    device = "/dev/disk/by-uuid/73CA-8E6D";
+    fsType = "vfat";
+    options = [
+      "fmask=0077"
+      "dmask=0077"
+    ];
+  };
+
+  swapDevices = [
+    { device = "/dev/disk/by-uuid/c6139db9-2a9d-400a-b8a8-c8f77c5713ca"; }
+  ];
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+}

hosts/cap-clust-08/configuration.nix

@@ -0,0 +1,12 @@
+{ config, pkgs, ... }:
+{
+  imports = [
+    # Hardware Scan
+    ./hardware-configuration.nix
+
+    # Host Groups
+    ../../modules/host-groups/cluster.nix
+  ];
+
+  networking.hostName = "cap-clust-08";
+}

hosts/cap-clust-08/hardware-configuration.nix

@@ -0,0 +1,52 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{
+  config,
+  lib,
+  pkgs,
+  modulesPath,
+  ...
+}:
+
+{
+  imports = [
+    (modulesPath + "/installer/scan/not-detected.nix")
+  ];
+
+  boot.initrd.availableKernelModules = [
+    "xhci_pci"
+    "ahci"
+    "ehci_pci"
+    "usbhid"
+    "usb_storage"
+    "sd_mod"
+  ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [
+    "kvm-amd"
+    "amdgpu"
+  ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" = {
+    device = "/dev/disk/by-uuid/deed37a4-4d5a-465c-93e6-1b7b216e0a1c";
+    fsType = "ext4";
+  };
+
+  fileSystems."/boot" = {
+    device = "/dev/disk/by-uuid/3ABB-C794";
+    fsType = "vfat";
+    options = [
+      "fmask=0077"
+      "dmask=0077"
+    ];
+  };
+
+  swapDevices = [
+    { device = "/dev/disk/by-uuid/6a99a895-a58c-43d2-8b62-02e3c915f46c"; }
+  ];
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+}

hosts/cap-clust-09/configuration.nix

@@ -0,0 +1,12 @@
+{ config, pkgs, ... }:
+{
+  imports = [
+    # Hardware Scan
+    ./hardware-configuration.nix
+
+    # Host Groups
+    ../../modules/host-groups/cluster.nix
+  ];
+
+  networking.hostName = "cap-clust-09";
+}

hosts/cap-clust-09/hardware-configuration.nix

@@ -0,0 +1,33 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports =
+    [ (modulesPath + "/installer/scan/not-detected.nix")
+    ];
+
+  boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "ehci_pci" "usbhid" "usb_storage" "sd_mod" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-amd" "amdgpu" ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" =
+    { device = "/dev/disk/by-uuid/affec1c2-bf7c-499e-80a6-6615fd163e1a";
+      fsType = "ext4";
+    };
+
+  fileSystems."/boot" =
+    { device = "/dev/disk/by-uuid/9E1A-C3DA";
+      fsType = "vfat";
+      options = [ "fmask=0077" "dmask=0077" ];
+    };
+
+  swapDevices =
+    [ { device = "/dev/disk/by-uuid/a17f3a16-78fb-494d-8319-89e31e1defae"; }
+    ];
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+}

modules/application-groups/media-creation.nix

@@ -4,7 +4,7 @@
     audacity
     darktable
     inkscape
-    kdePackages.kdenlive
+    # kdePackages.kdenlive  # <- Build Failure
     obs-studio
     pinta
   ];

modules/application-groups/system-utilities-cluster.nix

@@ -0,0 +1,26 @@
+{ config, pkgs, ... }:
+{
+
+  services.glances.enable = true;
+  services.openssh.enable = true;
+
+  environment.systemPackages = with pkgs; [
+    btop
+    dnsutils
+    git
+    htop
+    iftop
+    iotop
+    killall
+    kitty
+    ncdu
+    networkmanager
+    nmap
+    nvtopPackages.full
+    pciutils
+    unzip
+    usbutils
+    util-linux
+    wget
+  ];
+}

modules/application-groups/system-utilities.nix

@@ -4,6 +4,7 @@
   hardware.logitech.wireless.enable = true;
   hardware.logitech.wireless.enableGraphical = true;
 
+  programs.ssh.startAgent = true;
   programs.thunar.enable = true;
   programs.thunar.plugins = with pkgs.xfce; [
     thunar-archive-plugin

modules/host-groups/cluster.nix

@@ -0,0 +1,33 @@
+{ config, pkgs, ... }:
+
+{
+  imports = [
+    # Users
+    ../../users/cluster-admin/cluster-admin.nix
+
+    # System Configuration
+    ../system/cpu-amd.nix
+    ../system/fonts.nix
+    ../system/git-auto-rebuild.nix
+    ../system/gpu-amd.nix
+    ../system/home-manager-settings.nix
+    ../system/internationalization.nix
+    ../system/networking.nix
+    ../system/nix-settings.nix
+    ../system/security.nix
+    ../system/systemd-boot.nix
+
+    # Application Groups
+    ../application-groups/system-utilities-cluster.nix
+  ];
+
+  time.timeZone = "America/Los_Angeles";
+
+  # This value determines the NixOS release from which the default
+  # settings for stateful data, like file locations and database versions
+  # on your system were taken. It‘s perfectly fine and recommended to leave
+  # this value at the release version of the first install of this system.
+  # Before changing this value read the documentation for this option
+  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
+  system.stateVersion = "25.11"; # Did you read the comment?
+}

modules/system/git-auto-rebuild.nix

@@ -0,0 +1,33 @@
+{ config, pkgs, ... }:
+{
+  systemd.services.git-auto-rebuild = {
+    enable = true;
+    after = [ "network.target" ];
+    description = "Rebuilds the git repo at /etc/nixos if there are changes in the currently checked out branch";
+    #        startAt = "*:0/1";
+
+    serviceConfig = {
+      Type = "oneshot";
+      ExecStart = ''${pkgs.bash}/bin/bash -c "cd /etc/nixos && ${pkgs.git}/bin/git pull && ${config.system.build.nixos-rebuild}/bin/nixos-rebuild switch --flake #$(${pkgs.hostname}/bin/hostname)"'';
+    };
+    environment =
+      config.nix.envVars
+      // {
+        inherit (config.environment.sessionVariables) NIX_PATH;
+        HOME = "/root";
+      }
+      // config.networking.proxy.envVars;
+    path = with pkgs; [
+      bash
+      coreutils
+      gnutar
+      hostname
+      xz.bin
+      gzip
+      gitMinimal
+      config.nix.package.out
+      config.programs.ssh.package
+    ];
+  };
+
+}

modules/system/gpu-amd.nix

@@ -1,5 +1,11 @@
 { config, pkgs, ... }:
 {
-  services.xserver.videoDrivers = [ "amdgpu" ];
+  hardware.graphics = {
+    enable = true;
+    enable32Bit = true;
+  };
 
+  nixpkgs.config.rocmSupport = true;
+
+  services.xserver.videoDrivers = [ "amdgpu" ];
 }

modules/system/security.nix

@@ -1,4 +1,4 @@
-{ pkgs, ... }:
+{ pkgs, config, ... }:
 {
   security.sudo = {
     enable = true;
@@ -7,21 +7,38 @@
         groups = [ "wheel" ];
         commands = [
           {
-            command = "${pkgs.systemd}/bin/reboot";
+            command = "${config.system.path}/bin/reboot";
             options = [ "NOPASSWD" ];
           }
           {
-            command = "${pkgs.systemd}/bin/poweroff";
+            command = "${config.system.path}/bin/poweroff";
             options = [ "NOPASSWD" ];
           }
         ];
       }
+      {
+        users = [ "cluster-admin" ];
+        commands = [
+          {
+            command = "${config.system.path}/bin/systemctl start git-auto-rebuild.service";
+            options = [ "NOPASSWD" ];
+          }
+          {
+            command = "${config.system.path}/bin/systemctl stop git-auto-rebuild.service";
+            options = [ "NOPASSWD" ];
+          }
+
+        ];
+      }
       {
         users = [ "caperren" ];
         commands = [
           {
-            command = "${pkgs.nvtopPackages.full}/bin/nvtop";
+            command = "${config.system.path}/bin/nvtop";
-            options = [ "NOPASSWD" "SETENV" ];
+            options = [
+              "NOPASSWD"
+              "SETENV"
+            ];
           }
         ];
 

users/caperren/caperren.nix

@@ -2,6 +2,8 @@
 let
   hyprlandConfigPath = ./. + "/dotfiles/hyprland/${config.networking.hostName}";
   kanshiConfigPath = ./. + "/dotfiles/kanshi/${config.networking.hostName}";
+  sshDesktopPubkey = builtins.readFile ./pubkeys/cap-nr200p.pub;
+  sshLaptopPubkey = builtins.readFile ./pubkeys/cap-slim7.pub;
   spotifyPlayerAppTomlTextTemplate = builtins.readFile ./dotfiles/spotify-player/app.toml;
   spotifyPlayerAppTomlText =
     builtins.replaceStrings [ "{{hostname}}" ] [ config.networking.hostName ]
@@ -22,6 +24,10 @@ in
       "podman"
       "wheel"
     ];
+    openssh.authorizedKeys.keys = [
+        sshDesktopPubkey
+        sshLaptopPubkey
+    ];
   };
 
   home-manager.users.caperren = {

users/caperren/dotfiles/hyprland/hyprland-common.conf

@@ -183,6 +183,8 @@ exec-once = waybar  # Wayland specific status bar
 exec-once = sleep 5 && nm-applet  # Traditional notifications area
 exec-once = sleep 5 && blueman-applet  # Traditional bluetooth management tool
 exec-once = sleep 5 && streamdeck -n  # Streamdeck management tool
+exec-once = sleep 5 && solaar --window=hide  # Logitech device management and battery
+
 exec-once = sleep 5 && Telegram -startintray  # Gotta keep in touch with peeps
 
 exec-once = sleep 10 && itch  # More fun games

users/caperren/pubkeys/cap-nr200p.pub

@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILb5YZG6wCmqoevSHsP9f9eix3iugntBFy9hf/gkGb5v caperren@cap-nr200p

users/caperren/pubkeys/cap-slim7.pub

@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKn/grpCtACdsrw1ocTBsf2Mc6hUZHNwvuZPk8K4UJ3p caperren@cap-slim7

users/cluster-admin/cluster-admin.nix

@@ -0,0 +1,44 @@
+{ config, pkgs, ... }:
+let
+  sshCaperrenDesktopPubkey = builtins.readFile ../caperren/pubkeys/cap-nr200p.pub;
+  sshCaperrenLaptopPubkey = builtins.readFile ../caperren/pubkeys/cap-slim7.pub;
+in
+{
+  users.users.cluster-admin = {
+    initialPassword = "changeme";
+    isNormalUser = true;
+    description = "Cluster Admin";
+    extraGroups = [
+      "networkmanager"
+      "wheel"
+    ];
+    openssh.authorizedKeys.keys = [
+      sshCaperrenDesktopPubkey
+      sshCaperrenLaptopPubkey
+    ];
+  };
+
+  home-manager.users.cluster-admin = {
+    home.username = "cluster-admin";
+    home.homeDirectory = "/home/cluster-admin";
+    home.stateVersion = "25.05";
+
+    home.packages = with pkgs; [ ];
+
+    programs.bash.enable = true;
+
+    programs.git = {
+      enable = true;
+      settings.user = {
+        name = "Corwin Perren";
+        email = "caperren@gmail.com";
+      };
+
+    };
+
+    programs.kitty = {
+      enable = true;
+      font.name = "JetBrains Mono";
+    };
+  };
+}