Add borgmatic config for pi

Flake lock file updates:

• Updated input 'secrets':
    'git+ssh://git@git.vimium.com/jordan/nix-secrets.git?ref=refs/heads/master&rev=1374b9508620b9dcded687ff6f0110a1f916515a' (2023-12-17)
  → 'git+ssh://git@git.vimium.com/jordan/nix-secrets.git?ref=refs/heads/master&rev=a603c652568fc0e9b66aac70400aee2e394e5542' (2023-12-17)

flake.lock

@@ -42,6 +42,26 @@
         "type": "github"
       }
     },
+    "deploy-rs": {
+      "inputs": {
+        "flake-compat": "flake-compat",
+        "nixpkgs": "nixpkgs_2",
+        "utils": "utils"
+      },
+      "locked": {
+        "lastModified": 1702460489,
+        "narHash": "sha256-H6s6oVLvx7PCjUcvfkB89Bb+kbaiJxTAgWfMjiQTjA0=",
+        "owner": "serokell",
+        "repo": "deploy-rs",
+        "rev": "915327515f5fd1b7719c06e2f1eb304ee0bdd803",
+        "type": "github"
+      },
+      "original": {
+        "owner": "serokell",
+        "repo": "deploy-rs",
+        "type": "github"
+      }
+    },
     "firefox-gnome-theme": {
       "flake": false,
       "locked": {
@@ -58,6 +78,22 @@
         "type": "github"
       }
     },
+    "flake-compat": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1696426674,
+        "narHash": "sha256-kvjfFW7WAETZlt09AgDn1MrtKzP7t90Vf7vypd3OL1U=",
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "rev": "0f9255e01c2351cc7d116c072cb317785dd33b33",
+        "type": "github"
+      },
+      "original": {
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "type": "github"
+      }
+    },
     "home-manager": {
       "inputs": {
         "nixpkgs": [
@@ -86,11 +122,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1702195709,
-        "narHash": "sha256-+zRjWkm5rKqQ57PuLZ3JF3xi3vPMiOJzItb1m/43Cq4=",
+        "lastModified": 1702814678,
+        "narHash": "sha256-zDtO0jV2QLoddUJinLlTQrQqCUW3dPiIWOSYgg98T7E=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "6761b8188b860f374b457eddfdb05c82eef9752f",
+        "rev": "1488651d02c1a7a15e284210f0d380a62d8d8cef",
         "type": "github"
       },
       "original": {
@@ -100,6 +136,21 @@
         "type": "github"
       }
     },
+    "nixos-hardware": {
+      "locked": {
+        "lastModified": 1702453208,
+        "narHash": "sha256-0wRi9SposfE2wHqjuKt8WO2izKB/ASDOV91URunIqgo=",
+        "owner": "NixOS",
+        "repo": "nixos-hardware",
+        "rev": "7763c6fd1f299cb9361ff2abf755ed9619ef01d6",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "repo": "nixos-hardware",
+        "type": "github"
+      }
+    },
     "nixpkgs": {
       "locked": {
         "lastModified": 1677676435,
@@ -118,11 +169,27 @@
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1702233072,
-        "narHash": "sha256-H5G2wgbim2Ku6G6w+NSaQaauv6B6DlPhY9fMvArKqRo=",
+        "lastModified": 1702272962,
+        "narHash": "sha256-D+zHwkwPc6oYQ4G3A1HuadopqRwUY/JkMwHz1YF7j4Q=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "781e2a9797ecf0f146e81425c822dca69fe4a348",
+        "rev": "e97b3e4186bcadf0ef1b6be22b8558eab1cdeb5d",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixpkgs-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_3": {
+      "locked": {
+        "lastModified": 1702645756,
+        "narHash": "sha256-qKI6OR3TYJYQB3Q8mAZ+DG4o/BR9ptcv9UnRV2hzljc=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "40c3c94c241286dd2243ea34d3aef8a488f9e4d0",
         "type": "github"
       },
       "original": {
@@ -134,12 +201,46 @@
     "root": {
       "inputs": {
         "agenix": "agenix",
+        "deploy-rs": "deploy-rs",
         "firefox-gnome-theme": "firefox-gnome-theme",
         "home-manager": "home-manager_2",
-        "nixpkgs": "nixpkgs_2",
+        "nixos-hardware": "nixos-hardware",
+        "nixpkgs": "nixpkgs_3",
+        "secrets": "secrets",
         "thunderbird-gnome-theme": "thunderbird-gnome-theme"
       }
     },
+    "secrets": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1702826232,
+        "narHash": "sha256-IskiHZsE2B8BnByvhbrjArNltuFJeq/WmXFA+056jV0=",
+        "ref": "refs/heads/master",
+        "rev": "a603c652568fc0e9b66aac70400aee2e394e5542",
+        "revCount": 3,
+        "type": "git",
+        "url": "ssh://git@git.vimium.com/jordan/nix-secrets.git"
+      },
+      "original": {
+        "type": "git",
+        "url": "ssh://git@git.vimium.com/jordan/nix-secrets.git"
+      }
+    },
+    "systems": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
     "thunderbird-gnome-theme": {
       "flake": false,
       "locked": {
@@ -155,6 +256,24 @@
         "repo": "thunderbird-gnome-theme",
         "type": "github"
       }
+    },
+    "utils": {
+      "inputs": {
+        "systems": "systems"
+      },
+      "locked": {
+        "lastModified": 1701680307,
+        "narHash": "sha256-kAuep2h5ajznlPMD9rnQyffWG8EM/C73lejGofXvdM8=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "4022d587cbbfd70fe950c1e2083a02621806a725",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
     }
   },
   "root": "root",

flake.nix

@@ -4,6 +4,7 @@
   inputs = {
     nixpkgs.url = "nixpkgs/nixos-23.11";
     agenix.url = "github:ryantm/agenix";
+    deploy-rs.url = "github:serokell/deploy-rs";
     home-manager = {
       url = "github:nix-community/home-manager/release-23.11";
       inputs.nixpkgs.follows = "nixpkgs";
@@ -12,13 +13,18 @@
       url = "github:rafaelmardojai/firefox-gnome-theme";
       flake = false;
     };
+    nixos-hardware.url = "github:NixOS/nixos-hardware";
+    secrets = {
+      url = "git+ssh://git@git.vimium.com/jordan/nix-secrets.git";
+      flake = false;
+    };
     thunderbird-gnome-theme = {
       url = "github:rafaelmardojai/thunderbird-gnome-theme";
       flake = false;
     };
   };
 
-  outputs = inputs @ { self, nixpkgs, agenix, home-manager, ... }:
+  outputs = inputs @ { self, nixpkgs, agenix, deploy-rs, home-manager, nixos-hardware, secrets, ... }:
     let
       nixpkgsForSystem = system: inputs.nixpkgs;
       overlays = [
@@ -30,7 +36,7 @@
         home-manager.nixosModule
         ./modules
       ];
-      nixosSystem = system: name:
+      nixosSystem = { system, name, extraModules ? [] }:
         let
           nixpkgs = nixpkgsForSystem system;
           lib = (import nixpkgs { inherit overlays system; }).lib;
@@ -52,15 +58,29 @@
                 };
               })
             ./hosts/${name}
-          ];
+          ] ++ extraModules;
         };
-      nixosConfigurations = {
-        atlas = nixosSystem "x86_64-linux" "atlas";
-        eos = nixosSystem "x86_64-linux" "eos";
-        helios = nixosSystem "x86_64-linux" "helios";
-        odyssey = nixosSystem "x86_64-linux" "odyssey";
-      };
     in
-    { inherit nixosConfigurations; };
+    {
+      nixosConfigurations = {
+        atlas = nixosSystem { system = "x86_64-linux"; name = "atlas"; };
+        eos = nixosSystem { system = "x86_64-linux"; name = "eos"; };
+        helios = nixosSystem { system = "x86_64-linux"; name = "helios"; };
+        odyssey = nixosSystem { system = "x86_64-linux"; name = "odyssey"; };
+        pi = nixosSystem { system = "aarch64-linux"; name = "pi"; extraModules = [ nixos-hardware.nixosModules.raspberry-pi-4 ]; };
+      };
+
+      deploy.nodes.pi = {
+        hostname = "10.0.1.191";
+        sshUser = "root";
+
+        profiles.system = {
+          user = "root";
+          path = deploy-rs.lib.aarch64-linux.activate.nixos self.nixosConfigurations.pi;
+        };
+      };
+
+      # checks = builtins.mapAttrs (system: deployLib: deployLib.deployChecks self.deploy) deploy-rs.lib;
+    };
 }
 

hosts/desktop.nix

@@ -44,6 +44,12 @@
     neovim
   ];
 
+  system.autoUpgrade = {
+    enable = true;
+    flake = "git+ssh://git@git.vimium.com/jordan/nix-config.git";
+    randomizedDelaySec = "10min";
+  };
+
   nix = {
     settings = {
       connect-timeout = 5;

hosts/odyssey/default.nix

@@ -1,4 +1,4 @@
-{ config, lib, pkgs, ... }:
+{ config, lib, pkgs, inputs, ... }:
 
 {
   imports = [
@@ -25,6 +25,8 @@
 
   virtualisation.libvirtd.enable = true;
   virtualisation.lxd.enable = true;
+  # Work around https://github.com/NixOS/nixpkgs/issues/263359
+  networking.firewall.trustedInterfaces = [ "lxdbr0" "virbr0" ];
 
   users.defaultUserShell = pkgs.zsh;
 
@@ -50,23 +52,21 @@
     };
   };
 
-  age.secrets."odyssey_borg_passphrase" = {
-    file = ../../secrets/odyssey_borg_passphrase.age;
+  age.secrets."passwords/services/borg/odyssey-passphrase" = {
+    file = "${inputs.secrets}/passwords/services/borg/odyssey-passphrase.age";
   };
 
   services.borgmatic = {
     enable = true;
     settings = {
-      location = {
-        source_directories = [
-          "/home/jordan/Documents"
-        ];
-        repositories = [
-          "ssh://iqwu22oq@iqwu22oq.repo.borgbase.com/./repo"
-        ];
-      };
+      source_directories = [
+        "/home/jordan/Documents"
+      ];
+      repositories = [
+        { label = "borgbase"; path = "ssh://iqwu22oq@iqwu22oq.repo.borgbase.com/./repo"; }
+      ];
       storage = {
-        encryption_passcommand = "cat ${config.age.secrets.odyssey_borg_passphrase.path}";
+        encryption_passcommand = "cat ${config.age.secrets."passwords/services/borg/odyssey-passphrase".path}";
         ssh_command = "ssh -i /etc/ssh/ssh_host_ed25519_key";
       };
       retention = {

hosts/pi/README.md

@@ -0,0 +1,18 @@
+# Pi
+
+## Overview
+Raspberry Pi 4
+
+## Specs
+* SoC - Broadcom BCM2711
+* CPU - ARM Cortex-A72 @ 1.8 GHz
+* Memory - 8 GB LPDDR4
+
+### Disks
+Device | Partitions _(filesystem, usage)_
+--- | ---
+SD card | `/dev/mmcblk0` (ext4, NixOS Root)
+
+### Networks
+- DHCP on `10.0.1.0/24` subnet.
+- Tailscale on `100.64.0.0/10` subnet. FQDN: `pi.mesh.vimium.net`.

hosts/pi/default.nix

@@ -0,0 +1,116 @@
+{ config, lib, pkgs, inputs, ... }:
+
+{
+  imports = [
+    ./hardware-configuration.nix
+    ../server.nix
+  ];
+
+  networking.hostId = "731d1660";
+
+  hardware = {
+    raspberry-pi."4" = {
+      apply-overlays-dtmerge.enable = true;
+      audio.enable = false;
+      fkms-3d.enable = false;
+      xhci.enable = false;
+    };
+    deviceTree = {
+      enable = true;
+      overlays = [
+        { name = "hifiberry-digi-pro"; dtboFile = "${pkgs.device-tree_rpi.overlays}/hifiberry-digi-pro.dtbo"; }
+      ];
+    };
+    firmware = with pkgs; [
+      firmwareLinuxNonfree
+      wireless-regdb
+    ];
+  };
+
+  sound.enable = true;
+
+  age.secrets."passwords/networks.age" = {
+    file = "${inputs.secrets}/passwords/networks.age";
+  };
+
+  networking = {
+    wireless = {
+      enable = true;
+      interfaces = [ "wlan0" ];
+      environmentFile = config.age.secrets."passwords/networks.age".path;
+      networks = {
+        "Apollo 600 Mbps".psk = "@PSK_APOLLO@";
+      };
+    };
+  };
+
+  security.rtkit.enable = true;
+  services.pipewire = {
+    enable = true;
+    alsa.enable = true;
+    alsa.support32Bit = true;
+    pulse.enable = true;
+    systemWide = true;
+  };
+
+  services.mosquitto = {
+    enable = true;
+    listeners = [{
+      port = 1883;
+      settings = {
+        allow_anonymous = true;
+      };
+    }];
+  };
+
+  services.zigbee2mqtt = {
+    enable = true;
+    settings = {
+      homeassistant = config.services.home-assistant.enable;
+      frontend = true;
+      serial = {
+        port = "/dev/ttyUSB0";
+      };
+      mqtt = {
+        server = "mqtt://localhost:1883";
+      };
+    };
+  };
+
+  age.secrets."passwords/services/borg/pi-passphrase" = {
+    file = "${inputs.secrets}/passwords/services/borg/pi-passphrase.age";
+  };
+
+  services.borgmatic = {
+    enable = true;
+    settings = {
+      source_directories = [
+        "/var/lib/mosquitto"
+        "/var/lib/zigbee2mqtt"
+      ];
+      repositories = [
+        { label = "borgbase"; path = "ssh://qcw86s11@qcw86s11.repo.borgbase.com/./repo"; }
+      ];
+      storage = {
+        encryption_passcommand = "cat ${config.age.secrets."passwords/services/borg/pi-passphrase".path}";
+        ssh_command = "ssh -i /etc/ssh/ssh_host_ed25519_key";
+      };
+      retention = {
+        keep_daily = 7;
+        keep_weekly = 4;
+        keep_monthly = 6;
+      };
+    };
+  };
+
+  # Without this override, `cat` is unavailable for `encryption_passcommand`
+  systemd.services.borgmatic.confinement.fullUnit = true;
+
+  environment.systemPackages = with pkgs; [
+    libraspberrypi
+    raspberrypi-eeprom
+  ];
+
+  system.stateVersion = "22.11";
+}
+

hosts/pi/hardware-configuration.nix

@@ -0,0 +1,31 @@
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports = [
+    (modulesPath + "/installer/sd-card/sd-image-aarch64.nix")
+  ];
+
+  boot = {
+    # Stop ZFS kernel being built
+    supportedFilesystems = lib.mkForce [ "btrfs" "cifs" "f2fs" "jfs" "ntfs" "reiserfs" "vfat" "xfs" ];
+    tmp.cleanOnBoot = true;
+  };
+
+  # Fix missing modules
+  # https://github.com/NixOS/nixpkgs/issues/154163
+  nixpkgs.overlays = [
+    (final: super: {
+      makeModulesClosure = x:
+        super.makeModulesClosure (x // { allowMissing = true; });
+    })
+  ];
+
+  fileSystems = {
+    "/" = {
+      device = "/dev/disk/by-label/NIXOS_SD";
+      fsType = "ext4";
+      options = [ "noatime" ];
+    };
+  };
+}
+

hosts/server.nix

@@ -18,6 +18,8 @@
 
   console.keyMap = "uk";
 
+  documentation.enable = false;
+
   services.openssh = {
     enable = true;
     settings = {

modules/options.nix

@@ -1,4 +1,4 @@
-{ config, options, lib, home-manager, ... }:
+{ config, options, lib, home-manager, inputs, ... }:
 
 with lib;
 {
@@ -29,6 +29,7 @@ with lib;
   };
 
   config = {
+    age.secrets."passwords/users/jordan".file = "${inputs.secrets}/passwords/users/jordan.age";
     user =
       let user = builtins.getEnv "USER";
           name = if elem user [ "" "root" ] then "jordan" else user;
@@ -41,6 +42,7 @@ with lib;
         openssh.authorizedKeys.keys = [
           "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILVHTjsyMIV4THNw6yz0OxAxGnC+41gX72UrPqTzR+OS jordan@vimium.com"
         ];
+        hashedPasswordFile = config.age.secrets."passwords/users/jordan".path;
         home = "/home/${name}";
         group = "users";
         uid = 1000;

secrets.nix

@@ -1,10 +0,0 @@
-let
-  jordan = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILVHTjsyMIV4THNw6yz0OxAxGnC+41gX72UrPqTzR+OS";
-  users = [ jordan ];
-
-  odyssey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJre8/cjdoUnbTu0x4ClTITcq4lq+FjpEyJBbLbOlox7";
-  systems = [ odyssey ];
-in
-{
-  "secrets/odyssey_borg_passphrase.age".publicKeys = [ jordan odyssey ];
-}