add basic mb1 host

flake.nix

@@ -12,6 +12,7 @@
             (./. + "/nixos/boxes/${hostname}")
             (import ./nixos/server-common.nix)
             sops.nixosModules.sops
+            disko.nixosModules.disko
           ];
           specialArgs = { inherit inputs system; };
         };
@@ -130,6 +131,7 @@
         thinky = mkWorkstation nixpkgs-stable "x86_64-linux" "thinky";
         bolty = mkServer nixpkgs-stable "x86_64-linux" "bolty";
         vpsfree1 = mkServer nixpkgs-stable "x86_64-linux" "vpsfree1";
+        mb1 = mkServer nixpkgs-stable "x86_64-linux" "mb1";
         yoga = mkKiosk nixpkgs-stable "x86_64-linux" "yoga";
         homescreen = mkRaspi nixpkgs-stable "homescreen";
 

nixos/boxes/mb1/README.md

@@ -0,0 +1,5 @@
+* boot from nixos unstable installer minimal image, or >23.05
+    * https://releases.nixos.org/nixos/unstable/nixos-23.05pre470969.0e19daa510e/nixos-minimal-23.05pre470969.0e19daa510e-x86_64-linux.iso
+* use serial console via mb ssh
+* add ssh authorized key for root
+* `nix run github:numtide/nixos-anywhere -- root@93.93.131.8 --flake '.#mb1'`

nixos/boxes/mb1/default.nix

@@ -0,0 +1,23 @@
+{ config, pkgs, inputs, lib, ... }: {
+  imports = [
+    ../cli.nix
+    ./disks.nix
+    "${inputs.nixpkgs-stable}/nixos/modules/profiles/qemu-guest.nix"
+  ];
+  networking.hostName = "mb1";
+  environment.systemPackages = with pkgs; [ ];
+
+  boot.loader.grub = {
+    devices = [ "/dev/vda" ];
+    efiSupport = true;
+    efiInstallAsRemovable = true;
+  };
+
+  zramSwap = {
+    enable = true;
+    algorithm = "zstd";
+    memoryPercent = 80;
+  };
+
+  time.timeZone = "Europe/London";
+}

nixos/boxes/mb1/disks.nix

@@ -0,0 +1,48 @@
+{ ... }: {
+  disko.devices = {
+    disk = {
+      vda = {
+        type = "disk";
+        device = "/dev/vda";
+        content = {
+          type = "table";
+          format = "gpt";
+          partitions = [
+            {
+              name = "boot";
+              type = "partition";
+              start = "0";
+              end = "1M";
+              flags = [ "bios_grub" ];
+            }
+            {
+              type = "partition";
+              name = "ESP";
+              start = "1M";
+              end = "512M";
+              bootable = true;
+              content = {
+                type = "filesystem";
+                format = "vfat";
+                mountpoint = "/boot";
+              };
+            }
+            {
+              name = "primary";
+              type = "partition";
+              start = "512M";
+              end = "100%";
+              part-type = "primary";
+              bootable = false;
+              content = {
+                type = "filesystem";
+                format = "btrfs";
+                mountpoint = "/";
+              };
+            }
+          ];
+        };
+      };
+    };
+  };
+}

nixos/tailscale/keys.sops.yaml

@@ -2,8 +2,9 @@ tailscale-key-foureighty: ENC[AES256_GCM,data:Kii4Vq28eqoLSkr/mJwyhmfAcfNa6geMc5
 tailscale-key-bolty: ENC[AES256_GCM,data:Hfx4+am1LI/4MqgeSbrRuyjRdmBzpHDNiDEGJ87NrDAmMbxO4mLRXASUkywEDv/kPjtNUz5s45g=,iv:YuNLgEfvBezS1+P/sKN96h1/88e2xU/gyfkzjIy3vNI=,tag:r9Jq6lWKRt84sRLJMBGlzg==,type:str]
 tailscale-key-vpsfree1: ENC[AES256_GCM,data:ryvIT5ZTdoYZnRZ4gl4XYfuT4f44qNuKTRQ7cL4kRMVq2KkyEUb63tXkr180jgyQllQ6BahR51VN,iv:b+zNGOP1lAQ7BRg6JetKCvo91hzZhqoYgwiQZzqMnKo=,tag:sPPLieczV5sgKMAFgic+0A==,type:str]
 tailscale-key-vultr1: ENC[AES256_GCM,data:8YNSlIKi4ssvH0XNLs3e5ee5624wGm1guaYQLWQ0KWMiXW/8jeeCDw==,iv:QsKL4NqOUTCWSIxlaXqXbfzhFcAbJTkYXjkc1eCJv8M=,tag:qhod5l9qupdHGxvbRNuIiw==,type:str]
-tailscale-key-thinky: ENC[AES256_GCM,data:xRaCvVaGgLxIn1dhA+SNUIeljTnOiJryrUy/wK09t4gTMQA2h0kj9wg=,iv:b8iw5se4Lucmfi7N0B+RFUAl4tUYGFqtHZ0IxVfCHXE=,tag:dJyVuzbTm/hGalx2H0XjRA==,type:str]
 tailscale-key-yoga: ENC[AES256_GCM,data:SLVR7gGJVxExHdxW6xfNcSbxRW0f16J1QIjqmDxuJVMAtYel4ywigw7FilmV/CePrtTo7vttxPke,iv:VbqKTg5ZwLgeE0sbCp5381QX0/QY7DXAkalWVFsWyoA=,tag:eVVm3uCxSVKPn+ZSWeu30A==,type:str]
+tailscale-key-mb1: ENC[AES256_GCM,data:VMlMWOWiMgZKut3GHZfxa8yneUDgLCWZnmNaqo8HHytSqScqwAVJw+FhXwETSah3c9IWgyFj2I0=,iv:lgt5B0wSS4baqk6NEDPetMTYd9+DSIw/ro3Vth2hfQw=,tag:V02ZMlnhYzNWO5rN8RCVcQ==,type:str]
+tailscale-key-thinky: ENC[AES256_GCM,data:xRaCvVaGgLxIn1dhA+SNUIeljTnOiJryrUy/wK09t4gTMQA2h0kj9wg=,iv:b8iw5se4Lucmfi7N0B+RFUAl4tUYGFqtHZ0IxVfCHXE=,tag:dJyVuzbTm/hGalx2H0XjRA==,type:str]
 tailscale-key-fixme: ENC[AES256_GCM,data:GfuoFnJBO7RYe0e5vUrHCHgGO+G5rH/WedjG2sEk61tzjUfKoHpt1Mw=,iv:/j2MxHG025lc8z3elehxwvMXN3YEcaKuGmDdWKEsJmI=,tag:h8A9Wt1VAUR8EtAR8Jtr5w==,type:str]
 sops:
     kms: []
@@ -101,8 +102,8 @@ sops:
             Vkc0MGZmNFdmYUJvKys5YVZsOWtURm8Ky4sDGX7Inn7+aQxgU92mcUT+te5sya3s
             dDqfr1pp2Gbt337kCmvBpwulvYXC/iKtrp3Dh1omWET+39cI1Hfw0w==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2023-03-30T17:37:36Z"
+    lastmodified: "2023-04-07T07:55:53Z"
-    mac: ENC[AES256_GCM,data:HuMuwCSClaBBVneyVRpQHSW+BeXMbQRtwJiPrR1PpsMpEaGQg7jkD0KJvauVbl2VBcJ4I8tyg+EArsQ0ZOy/40wJU9n6eOc1mnnPCeE+36q5rdvLCV+oWuZ8mHXOcUSql3O+56f+1bhIayzzYDyQG0pWPrWVE7BaCLSjyKHt2+4=,iv:UnpGCtvmwOiuhIYRgiaASWaeShXM5RrE3goHcpLbk3I=,tag:OeEBad/jRSGvxCVo7YhBxw==,type:str]
+    mac: ENC[AES256_GCM,data:OaS5U4BYiPC301VvVvcCuIn5/o49X/zqZUfmgpmG2n8rBpfJ0/1SMqZ35Dy2oRGbUkZvTqdzQThvITiQue/d5FfgvyQ8hqjxiBT4JIewGTAH7IVCYIzu5nJA+aGLGvaa3jXaWt1vr3b+qcgirL0inSFSV0XDbErk/LSJ1IKb5B8=,iv:vwrS2tlI4tR6ZA9offRlW5UI2YsUivkKYnjt4O2MNsE=,tag:a+nc/k31Mn9VC4MmiGnOfA==,type:str]
     pgp: []
     unencrypted_suffix: _unencrypted
     version: 3.7.3