From 12778e5393de5e298d9a68bb50a1853e4415b97a Mon Sep 17 00:00:00 2001 From: Sridhar Ratnakumar Date: Wed, 24 Dec 2025 10:46:27 -0500 Subject: [PATCH] beszel --- configurations/nixos/pureintent/default.nix | 11 +++++++++ modules/nixos/linux/beszel.nix | 25 ++++++++++++++++++++ secrets/beszel-agent-key.age | Bin 0 -> 601 bytes secrets/github-nix-ci/emaletter.token.age | Bin 526 -> 526 bytes secrets/github-nix-ci/srid.token.age | 18 +++++++------- secrets/gmail-app-password.age | Bin 449 -> 449 bytes secrets/hackage-password.age | 18 +++++++------- secrets/hedgedoc.env.age | Bin 538 -> 538 bytes secrets/juspay-anthropic-api-key.age | 16 ++++++------- secrets/pureintent-basic-auth.age | 16 ++++++------- secrets/secrets.nix | 3 ++- 11 files changed, 71 insertions(+), 36 deletions(-) create mode 100644 modules/nixos/linux/beszel.nix create mode 100644 secrets/beszel-agent-key.age diff --git a/configurations/nixos/pureintent/default.nix b/configurations/nixos/pureintent/default.nix index 0568ed2..8b8425a 100644 --- a/configurations/nixos/pureintent/default.nix +++ b/configurations/nixos/pureintent/default.nix @@ -12,6 +12,7 @@ in imports = [ self.nixosModules.default ./configuration.nix + (self + /modules/nixos/linux/beszel.nix) ]; users.users.${flake.config.me.username}.linger = true; @@ -36,6 +37,11 @@ in ]; nix.settings.sandbox = "relaxed"; + nix.gc = { + automatic = true; + dates = "weekly"; + options = "--delete-older-than 30d"; + }; zramSwap.enable = true; swapDevices = [{ @@ -43,6 +49,11 @@ in size = 32 * 1024; # 32GB in megabytes }]; + services.glances = { + enable = true; + openFirewall = true; + }; + services.openssh.enable = true; services.tailscale.enable = true; networking.firewall.allowedTCPPorts = [ diff --git a/modules/nixos/linux/beszel.nix b/modules/nixos/linux/beszel.nix new file mode 100644 index 0000000..f3edc5c --- /dev/null +++ b/modules/nixos/linux/beszel.nix @@ -0,0 +1,25 @@ +# Beszel monitoring - local-only setup (hub + agent on same machine) +# +# Secret file (beszel-agent-key.age) should contain: +# KEY=ssh-ed25519 AAAA... +# Get the KEY from beszel hub web UI (http://localhost:8090) when adding a system. +{ flake, config, ... }: + +let + inherit (flake.inputs) self; +in +{ + age.secrets."beszel-agent-key.age".file = self + /secrets/beszel-agent-key.age; + + services.beszel = { + hub = { + enable = true; + host = "0.0.0.0"; + port = 8090; + }; + agent = { + enable = true; + environmentFile = config.age.secrets."beszel-agent-key.age".path; + }; + }; +} diff --git a/secrets/beszel-agent-key.age b/secrets/beszel-agent-key.age new file mode 100644 index 0000000000000000000000000000000000000000..75d32bf9e3e7622ee8e634d4052bc132b9c4f35a GIT binary patch literal 601 zcmYdHPt{G$OD?J`D9Oyv)5|YP*Do{V(zR14F3!+RO))YxHMCT)H1mw`3sf-A4fKhM zEb-SbPO&ts^06>+k4Op#D~t?INw3U}%n3GdGR|@JuJkqyj^uKx%JwSqvd9Sab2s!U zjI0a^EHVfR)XvV!%P{pc%n!^8^(t|8E6zwX4@I}lv&7sZDp0}L#kD**)GyT1FVEN2 z)8F4j-%mTk+rQG)Im59u-_6uGDJ$Es%sIEr#g{8JCo#-D(k#fNpdui%)Ym<#G%?J( zB+uI?L|fb6$y>WBxWYfQEI+K=*%RG1OS2NssC0!2#|Y;rv#?A@pWyPmiZnMzwZy UFYCWniK`4&9IEZwn7sWn0D)xVHvj+t literal 0 HcmV?d00001 diff --git a/secrets/github-nix-ci/emaletter.token.age b/secrets/github-nix-ci/emaletter.token.age index ed919e2893f6e77842b0c6dd18e9b067a8ed50bf..63a00c2dc638031e2a2f2a08d6842b438f17d27e 100644 GIT binary patch delta 492 zcmeBU>0_CoQ}5*E<>wmc<{IvA;#Ck;X5kg=l3MPQtzBrYubt^%;2xP+WRPoAmRRnd z&y`ai7MYP6>Eq^G9OP(fmJ+6&<&+p`>6hYR5|HJeTa+CY8tCY3nriIjQesjVTJPvo7#>hnY!MRW78+@kt?w3< z=;>qP993D)6;u+QnHy>785Ztnkr^Qt9nh;p!fU zZk?rBiDy*0f|rp|S%#;vaadAeVv=8mky)fckb8k~ew2Htwxy+hhM`-%c9nTrMn+JC zE0U+mS9WrcFIV>e->Uo^)7HLN zXjgjd?}h`9zbFLDq%mc8rrta?Z)a*+SaHohexDobUiCc44spKAd*S86nZIWK3uTU* zwPmhjhwc))MIpHw!b|!-f4Ug7bb0V+_UI)>JL5&AIZJ=d^|bJfXsVjH%G+_(pKTFa YcSqQ@9M@VsiOu!v`92dZZ++2c0Pc*l5C8xG delta 492 zcmeBU>0_CoQ*Y*FVdU-RlbdVknp>5hlbsgk>Q$8DQ|9KB7ZDYuT^{LJ5M@yi>8zdU z%H^qT=~o(M6cuWbV_X(w47-5iPX_lUvSQJ?78UF23`;;mig7Z&VcRN!RfRaNYX zZe3(?MOkjTLQz3#MsazTcV1qBVM;|sPDNt6Yfye@npdEkYhG$jMxk%LMR;g(VP%qG zK37smq=%!KXQF;YaK3MGMN)A}k*jB=Pf@u^P+oSDTUwQuc6mg4a(G^)Czr0Su0o(e zxWB)jsb_G0TBKiut8Z~?fSztYG9Ugv3_ZRONwcpV}x6lFV|&WA5ISA4UN}c zPdw08_bn+xK(&BHD)EqNs-u;`vxhDxa}8Z%jub@Dzz1J5HN5cZ5C$0GST8k^lez diff --git a/secrets/github-nix-ci/srid.token.age b/secrets/github-nix-ci/srid.token.age index 27cbc8e..3f97bc9 100644 --- a/secrets/github-nix-ci/srid.token.age +++ b/secrets/github-nix-ci/srid.token.age @@ -1,11 +1,9 @@ age-encryption.org/v1 --> ssh-ed25519 96IXNQ V6z62p+pW3kgBssNzyKXgeSkg1Wd8RL6G1UrumXTIWY -Ct4rp8A1Gg9ExzUyE63JgzgHD5aaeqakZ6ROAPm/XRE --> ssh-ed25519 It7HZQ +Hfd+DFL1cxlRFHSfLC2iiEbQ52cir2KgsIAQsgWLj8 -pCD9VDE0GWsr23NRHRCmiZJDrdNN3zKJFY6zNTpzPqg --> ssh-ed25519 Ysxvmg NzAhvPK21VdhfbEAD5Fk9VSqqeKjE8n5T9yurBeGohs -qRZzel60SENc1ewUbubi48zRyhxbpGK85Y2j871YPwY ---- R2HwRQqDwwfnDYltxQsw+s8fhBHhXVY+t93Uwh4PNYw -/ݹ{?b^i#W -as}ȭj -p$'DA@62O<0D2c@Ҧ) 7^?娨lV05Xe8 \ No newline at end of file +-> ssh-ed25519 96IXNQ mx7/eE4DEfCt9BxsJnthcGnR/OO+25hm4yryO/TZvGc ++TiFwUdsSm5CP9APEDnNZ2m6NSHk87WwpNv1fGrRzP0 +-> ssh-ed25519 It7HZQ TjB6x48XJJJCw0fd/EPLhsgPHSxT27YcoVBcMP7z7TQ +9sMA8uDJlrq0X1Cw/OTQlRGLKCGj9A4BMckCVydoQEU +-> ssh-ed25519 96tIZg BiOqFUjYKDibqjlwZMzno6rWR9Slwjrj761Izu3aIHk +umsE6YUJVagwI6AiOtPQhTuLTdWZHPxIEU3VhDM6f3o +--- rnVRzKjo30T3lQ/4ZUjvV5cTCInwNsFsettECi26aT4 +%O$Txdk\֤lh;_ey lY&,L#.S ӂZAH?=&Q$ dz<~B(grsV 3 \ No newline at end of file diff --git a/secrets/gmail-app-password.age b/secrets/gmail-app-password.age index 1361e700bd051b9310625e649035753921af98cf..4a16bda4cd1ef057d489683fb4a9dca3ba5ced67 100644 GIT binary patch delta 415 zcmX@ee2{s9PJMAeh>L5Uv0qqTk+y+vdcISUi?e@#p+TU&Z%CDPly`DYQF>^OTUkSwMuovv;XsSiO5dScIW}lDB_BWPXupq|StRb_6$e&s=-ZeDJQIZpm&7F@czx(b2$ z;mM9gA&wbUQMqOn!GU@DSx&(jCN71gm02MbK9Q!`DJ99-1$k9Lo?ILISF`!be4FH% v{yy$PSkte3LxJd%9x`V{B<3?bR`t7d?$fchglPU7cNN|@%(&w#KE(|H3$Klq delta 415 zcmX@ee2{s9PJM`RP^EW9YGS!hVx(VDPPR+Fb40L3L3)s9d9hz*x^skgaY3?Yx?7=h zK38H%u!mEqQE8I5QCUP#X^N|UxMPZ8QdnYgPLi=vQelyyOQ~~OX|>4|>X`L3?1$;QT(nK{J<>Bb%gF2+Vd?gbf^rB2!PhQ;~G#Xgx% zo?NB{xhWwgB_@^?NmYSfl_n7xQAN&~sV>Qpkwy9*Ar?kv>87T+d5&qR ssh-ed25519 96IXNQ nHWK3DGvD5svfKFD/QiyGUyE94MfiIAGvwtowQfB8CE -HKw+5SB99G+BVO1t6dggH+LFfjWSExUXaPA6TgbXkjo --> ssh-ed25519 It7HZQ tN1niOfw1WOTti0NAg9IlBSnAkTGloTE5dZGJ3rdXR0 -xw9DqdaqI3o0JuXslaOWcHwN4eLqz4g/lzQPmqZIpLU --> ssh-ed25519 Ysxvmg K7Taxefo/m7ObS0f62lowOnSNkN4kRO51A68N9tFmGM -sOEEjMpzH2CPwnmk7X5fbLKJ3Yw/Tr2P33UHM676y8A ---- FrVEGbyKNFknaLXq05sb5gD7cZqPv+UZUcuD+sj/SPA -cĊx=wj@[ -y}h8#M .N)D+ \ No newline at end of file +-> ssh-ed25519 96IXNQ HmkQjnB89LYi1B9uuKijjY+2rbasHwwjwCepD13ki1Y +79ieKetZcWLKMB7QpalExQ8JUksNM4TM/UzACoJzL88 +-> ssh-ed25519 It7HZQ CpSuqMO/s9X2gBccHbWD4h40O2WSfaXlXRlZlUum6Uc +TMhDOLjCz/UpOgMAtf0vBih2uEZnBz2VkGqaOD+4Xtk +-> ssh-ed25519 96tIZg Op6i6DAXYghLEBDGR4VXmfPgnDoA7c96jE6jRv9GcWA +s/FbEOowcWHLuH/3mmONgADTsfU7b8gniLgvXkHQ+yg +--- xFxBJUQOZ88Z5f+vIPb0LGWDSyYjUWEk4faoVAob/x0 +p_uR^`lK. +^:.wty۠9i$*!;? \ No newline at end of file diff --git a/secrets/hedgedoc.env.age b/secrets/hedgedoc.env.age index a85ba6058e4105f20e91683643bb826248cd4538..ed0eaf480cfee81408721ae3235ad6eaee524102 100644 GIT binary patch delta 504 zcmbQmGK*z`PQA8SaDItbpmT(=xnEg8kx_7lSwOOZhmom)TZV6@b77`&Nm5$6pHp&n zD3^P7WU_ZgR8(O^rJ-R(YPr65dX7_Cl!vKNu!&h-d4_?zTWPAkMVhvmCzr0BLUD11 zZfc5=si~o*f@g`jM^vDKUuKxMv9r0GrFT$OMp2M=XuV;eca%$|ho!Mkk$%2GPC-Vx zX?RMGcTRaSmw&!~nQvfbm~on=n?;_dsZT(uzfV$lgmad+Nm5WoKyXoho==6hmxp6A zx^d8>WN`@pPShgi2Z_mtT9WPg^e{Izc1Ka0eJn*&ZB lTem-}M^+}IEuZTFTfye~gKS?+f7Z+^kMwa-xVR;EI{?ofyCnbs delta 504 zcmbQmGK*z`PJK{#MWAQssb{WFXrX0rd7hbpfsc1Zj<1_}L3W98vSW5&W~g&` zC|9tfX@!elW`sUmq_KyeiEpT>XMKdJab>nkmYYjvk!yCak#<^e zRY7<`ftgbvm%dq0L3naRUW#|5S(1rYP*8ffvtgJ)eyFQ~Q+}n3pG#$Bs9R)}uUAkx zx^ ssh-ed25519 96IXNQ y9xfS/LgeA97ofunk5sm6a9yPMTQXoiqKzhSQ5xFJxM -Jj2xw854u6AsRXHaHl50D40Hpct9mBRD5vusndtWlRU --> ssh-ed25519 It7HZQ Ac3LWqNFln9fK7aYeqmG8yQfDl5nG0H8J4fCfk13xFE -7A9aSpzne7sFYLzQusalxg5d/fyM2/kwEJxZ7rCEJ6c --> ssh-ed25519 Ysxvmg pK+ZzeQpLoA0tvTbcOK4lmU111XN0h0U0/k6n3oj9X0 -ubUmOeCFczTjKgnzxA3ePnWb0WH8YKcI+WCJWUfcmEo ---- cuWCm/u/ZHJxHTvKFujn9RvQM90gCkjnGcWm1azYBGc - ssh-ed25519 96IXNQ htUePAVPstdIelYURI4fLB3p2rbQl/oVgdymtOnikjQ +pnEPOw7C17qEL5GLbSOUzhTS+TQjPKt8yn6DZnW93r0 +-> ssh-ed25519 It7HZQ VhHvmCe0xXx/aINQZZdGyfuQdAowuX6zrh+d6IzNqgQ +wDugkAqRt/Sbej2UTpIpjvitYk1WON4DuVecQqsQMP8 +-> ssh-ed25519 96tIZg LcgBZtB1BCjjWQVOQcCsOkRBTyi5HF88l1vLSdSyRVU +YC+uduqOuAAtlrFlLeSuaNzQC/OL9XW8vcjp8WKOKhY +--- pupMpTgDxQAt6CcB99LwNArx0wyxZGDu/ehh1Mikppk +߱#ؔb)HQ.v%Ef 10@Ga^DIhO/ \ No newline at end of file diff --git a/secrets/pureintent-basic-auth.age b/secrets/pureintent-basic-auth.age index 8c4004e..f48eef7 100644 --- a/secrets/pureintent-basic-auth.age +++ b/secrets/pureintent-basic-auth.age @@ -1,9 +1,9 @@ age-encryption.org/v1 --> ssh-ed25519 96IXNQ 2fAb4UaMDzIvV6al6FJhaLubphtiSuCpVOaeN+HwGVo -bP/J1UYVBhjV2aquWSsTytU19R76+9Vlof5/V9CUBZU --> ssh-ed25519 It7HZQ /UlpuPliwqF04HPG87ldFPCjxWim6EuCxUUax8h51TQ -rbQBDdCtd1N2IEuCSZeeusVtkogL3MOr0Mxue/Gwiso --> ssh-ed25519 Ysxvmg A81MyiFDefSbX6u7p4bN9vCREgGcp/frzguX1uwXYVM -KiicSyou3NiK9znW2/MEJi3ElLfsqkCLfMuPbqTLoJs ---- ArMgx+hzGLdzksx0CEXhb7N//pSq+ovYS/SPS3mQBcs -bQ A[iz/%VAEx.bZMIsҨ1Teq̦S,Jӭ2S(T6FkD.QR[ \ No newline at end of file +-> ssh-ed25519 96IXNQ d7wXeB4PTqliQUEgQxysva34qimZh8Fw3YimMmmCqkw +taOzZDVk2k7GYUo91uMfgGxU2+aWn8AWDMhnonD9Dy8 +-> ssh-ed25519 It7HZQ 8jeI9aR89Bn5xmypNz2jYsAB/vCjCssh4+TEHEqtDX0 +vmG3sL20z8lpXSM44At/HiBEiMd3FLlZ4rVFFEJu0j4 +-> ssh-ed25519 96tIZg ICbhKedcqc21jBVGnd3MkRFrQ2UaE1VsHAWQnV2+oxc +IkPX7iYYUpt+MMkmOe4DeGy5DXcMzFjylxVliuyzeas +--- XUds2rgdSivHfQmQ30q3Olz4ky9F4KU1gH8S83ooz1w +My59j0|ct9.Jŵa upk#'IQu6XY U j"[)5[Ê8HK$'J \ No newline at end of file diff --git a/secrets/secrets.nix b/secrets/secrets.nix index 3d35497..556952e 100644 --- a/secrets/secrets.nix +++ b/secrets/secrets.nix @@ -6,7 +6,7 @@ let "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJYQQXPMHYBtRcPzSkjQ3oqyje8T4UlCpbr6XjrlzzlK srid@zest" ]; - pureintent = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICkY5feaNt4elPqRQimB9h3OFxtFAzp98p1H+JezBv92 root@nixos"; + pureintent = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJUzYd7ys2gzx0Zu7yZDjZaRdUHDZIVahyVgaU2w2Ms8 root@nixos"; systems = [ pureintent ]; @@ -19,4 +19,5 @@ in "gmail-app-password.age".publicKeys = users ++ systems; "hackage-password.age".publicKeys = users ++ systems; "juspay-anthropic-api-key.age".publicKeys = users ++ systems; + "beszel-agent-key.age".publicKeys = users ++ systems; }