1338fb1b68
- Rename hosts/nixos-server.nix -> sunken-ship.nix, nixos-server-hardware.nix -> sunken-ship-hardware.nix - Flake: nixos-server -> sunken-ship, update module path - Set networking.hostName = sunken-ship in server configs - Update AGENTS.md, nixos/readme.md, docs/ssh-and-secrets.md, TODO.md Made-with: Cursor
73 lines
2.7 KiB
Nix
73 lines
2.7 KiB
Nix
# NixOS server: hostname, user, SSH, auto-rebuild from dotfiles repo.
|
||
#
|
||
# One-time on server: clone repo to /etc/dotfiles (root needs git access).
|
||
# If private repo: use SSH (ssh:// or git@) and add root's key to GitHub, or use HTTPS + token.
|
||
# Then: sudo nixos-rebuild switch --flake /etc/dotfiles/nixos#sunken-ship
|
||
# If sudo git is not found: sudo nix run nixpkgs#git -- -C /etc/dotfiles pull origin main
|
||
# Timer runs every 15 min: git fetch, pull if origin/main changed, rebuild.
|
||
{ config, lib, pkgs, ... }:
|
||
|
||
let
|
||
dotfilesDir = "/etc/dotfiles";
|
||
flakeRef = "${dotfilesDir}/nixos#sunken-ship";
|
||
in
|
||
{
|
||
imports = [ ./sunken-ship-hardware.nix ];
|
||
|
||
networking.hostName = "sunken-ship";
|
||
time.timeZone = "Europe/Copenhagen";
|
||
|
||
boot.kernelParams = [ "consoleblank=60" ]; # blank TTY after 60s to reduce burn-in
|
||
|
||
# Turn off panel backlight after boot so the screen actually dims (consoleblank only blanks framebuffer).
|
||
# At the console, run: light -S 100 (or any 0–100) to restore brightness.
|
||
programs.light.enable = true;
|
||
systemd.services.server-backlight-off = {
|
||
description = "Turn off panel backlight after console idle (reduce burn-in)";
|
||
after = [ "multi-user.target" ];
|
||
wantedBy = [ "multi-user.target" ];
|
||
serviceConfig.Type = "oneshot";
|
||
script = ''
|
||
${pkgs.coreutils}/bin/sleep 65
|
||
for d in /sys/class/backlight/*; do
|
||
[ -f "$d/brightness" ] && echo 0 > "$d/brightness" 2>/dev/null || true
|
||
done
|
||
'';
|
||
};
|
||
|
||
nix.settings.experimental-features = [ "nix-command" "flakes" ];
|
||
system.stateVersion = "24.11";
|
||
|
||
users.users.danny = {
|
||
isNormalUser = true;
|
||
extraGroups = [ "wheel" "video" ]; # video: backlight control via light(1)
|
||
# SSH keys: push via scp, don't commit. NixOS does not manage authorized_keys so scp'd keys persist.
|
||
# Example: scp ~/.ssh/id_*_github.pub danny@server:/tmp/ then on server: mkdir -p ~/.ssh; cat /tmp/*.pub >> ~/.ssh/authorized_keys
|
||
};
|
||
|
||
services.openssh.enable = true;
|
||
environment.systemPackages = [ pkgs.git ]; # for clone/bootstrap and timer
|
||
|
||
# Pull dotfiles and rebuild if the repo has new commits.
|
||
systemd.services.dotfiles-rebuild = {
|
||
description = "Pull dotfiles and run nixos-rebuild if repo changed";
|
||
path = with pkgs; [ git nix ];
|
||
script = ''
|
||
set -euo pipefail
|
||
cd ${dotfilesDir}
|
||
git fetch origin
|
||
if [ "$(git rev-parse HEAD)" = "$(git rev-parse origin/main)" ]; then
|
||
exit 0
|
||
fi
|
||
git pull origin main
|
||
exec nixos-rebuild switch --flake ${flakeRef}
|
||
'';
|
||
serviceConfig.Type = "oneshot";
|
||
};
|
||
|
||
systemd.timers.dotfiles-rebuild = {
|
||
wantedBy = [ "timers.target" ];
|
||
timerConfig.OnCalendar = "*-*-* *:00/15:00"; # every 15 minutes
|
||
timerConfig.RandomizedDelaySec = "2min";
|
||
};
|
||
}
|