...

4 files changed, 71 insertions, 39 deletions

diff --git a/os/core/bootloader.nix b/os/core/bootloader.nix
index f0aacc0..52761f1 100644
--- a/os/core/bootloader.nix
+++ b/os/core/bootloader.nix
@@ -2,12 +2,18 @@
   config,
   lib,
   ...
-}: let
+}:
+let
   cfg = config.os.core.bootloader;
-in {
+in
+{
   options.os.core.bootloader = {
     type = lib.mkOption {
-      type = lib.types.enum ["systemd-boot" "grub" "none"];
+      type = lib.types.enum [
+        "systemd-boot"
+        "grub"
+        "none"
+      ];
       default = "systemd-boot";
       description = "which bootloader to use";
     };
@@ -35,13 +41,25 @@ in {
   config = lib.mkMerge [
     {
       boot = {
-        supportedFilesystems = ["ntfs" "btrfs"];
-        kernelParams = ["quiet" "splash"];
-        initrd.luks.devices = lib.mkIf (cfg.enableEncryption && cfg.luksDevice != null) {
-          "crypted" = {
-            device = cfg.luksDevice;
-            preLVM = true;
-            allowDiscards = true;
+        supportedFilesystems = [
+          "ntfs"
+          "btrfs"
+        ];
+        kernelParams = [
+          "quiet"
+          "splash"
+        ];
+        initrd = {
+          availableKernelModules = [
+            "aesni_intel"
+            "cryptd"
+          ];
+          luks.devices = lib.mkIf (cfg.enableEncryption && cfg.luksDevice != null) {
+            "crypted" = {
+              device = cfg.luksDevice;
+              preLVM = true;
+              allowDiscards = true;
+            };
           };
         };
       };
@@ -57,6 +75,7 @@ in {
           systemd-boot = {
             enable = true;
             editor = false;
+            consoleMode = "max";
           };
         };
       };
@@ -72,10 +91,7 @@ in {
           useOSProber = cfg.useOSProber;
           enableCryptodisk = cfg.enableEncryption;
 
-          default =
-            if cfg.useOSProber
-            then 2
-            else 0;
+          default = if cfg.useOSProber then 2 else 0;
 
           efiSupport = lib.mkDefault (cfg.grubDevice == "nodev");
           copyKernels = lib.mkIf cfg.enableEncryption true;
diff --git a/os/core/networking.nix b/os/core/networking.nix
index bf611a3..830f475 100644
--- a/os/core/networking.nix
+++ b/os/core/networking.nix
@@ -13,8 +13,8 @@ in
       };
       firewall = {
         enable = true;
-        allowedTCPPorts = [ 7960 ];
-        allowedUDPPorts = [ 7960 ];
+        allowedTCPPorts = [ ];
+        allowedUDPPorts = [ ];
       };
     };
     systemd.services."NetworkManager-wait-online".enable = false;
diff --git a/os/core/users.nix b/os/core/users.nix
index 74a8fc4..03eff8a 100644
--- a/os/core/users.nix
+++ b/os/core/users.nix
@@ -12,21 +12,29 @@ in
   options.os.core.users.enable = lib.mkEnableOption "enables user accounts";
   config = lib.mkIf cfg.enable {
     programs.fish.enable = true;
-    users.users.${username} = {
-      isNormalUser = true;
-      shell = pkgs.fish;
-      extraGroups = lib.mkMerge [
-        [ "wheel" ]
+    users = {
+      mutableUsers = false;
 
-        (lib.mkIf (config.os.core.drivers.amd.enable or false) [
-          "video"
-          "render"
-        ])
-        (lib.mkIf (config.os.core.network.enable or false) [ "networkmanager" ])
-        (lib.mkIf (config.os.srv.virtualization.enable or false) [ "libvirtd" ])
-        (lib.mkIf (config.os.srv.docker.enable or false) [ "docker" ])
-        (lib.mkIf (config.os.srv.autoclicker.enable or false) [ "input" ])
-      ];
+      users = {
+        "${username}" = {
+          isNormalUser = true;
+          hashedPasswordFile = config.sops.secrets.user_password.path;
+          shell = pkgs.fish;
+          extraGroups = lib.mkMerge [
+            [ "wheel" ]
+
+            (lib.mkIf (config.os.core.drivers.amd.enable or false) [
+              "video"
+              "render"
+            ])
+            (lib.mkIf (config.os.core.network.enable or false) [ "networkmanager" ])
+            (lib.mkIf (config.os.srv.virtualization.enable or false) [ "libvirtd" ])
+            (lib.mkIf (config.os.srv.docker.enable or false) [ "docker" ])
+            (lib.mkIf (config.os.srv.autoclicker.enable or false) [ "input" ])
+          ];
+        };
+        root.hashedPasswordFile = config.sops.secrets.root_password.path;
+      };
     };
   };
 }
diff --git a/os/srv/sops.nix b/os/srv/sops.nix
index 0d0c7bf..67cf8f7 100644
--- a/os/srv/sops.nix
+++ b/os/srv/sops.nix
@@ -1,6 +1,7 @@
 {
   config,
   lib,
+  pkgs,
   username,
   ...
 }:
@@ -16,16 +17,23 @@ in
       age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
 
       secrets = {
-        "syncthing/gui_password" = {
-          owner = username;
-        };
-        "obs/websocket_password" = {
-          owner = username;
-        };
-        "git/email" = {
-          owner = username;
-        };
+        "syncthing/gui_password".owner = username;
+        "obs/websocket_password".owner = username;
+        root_password.neededForUsers = true;
+        user_password.neededForUsers = true;
+        storage_key = { };
       };
     };
+
+    boot.initrd.secrets = {
+      "/tmp/storage.key" = config.sops.secrets.storage_key.path;
+    };
+
+    environment.systemPackages = with pkgs; [
+      sops
+      age
+      ssh-to-age
+      gnupg
+    ];
   };
 }