begin migration to dendritic pattern

old-config/hosts/takamaki/modules/openssh.nix

@@ -0,0 +1,29 @@
+{
+  config,
+  pkgs,
+  ...
+}: {
+  users.users."grey".openssh.authorizedKeys.keys = [ "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCeYFzFyv1LEdWngyTDqnsdJQhmgAfQbbksyZrNWkameVMJpi8IJ+3IIrL96BtD8EAC/jxHIbri49TInN0lYRBH3cH3jbBupdDFaziH3ohyMoeg8enKYsiisaT+MTGEGFygF9Ul1WDrOM1oThEP1LTYj5pWNfZRtIG870jLzRkNczb0eCtEO0qWtyH92Cb5BSpXBKd4Eaysvkm5ex77I5Y1Hl0RUjyEiegiwC1LrcrFhjhVFQGlShTr5kf/LJrwamyGJx4oLi462Omf/jLwNoIMLNgxzuJBynYK714AY9U/IbNq//bEQro6i2cwxPm4lSTaGemnhvEItHsDfbeAJ06iqOl51OtsM2qees2ygCgFvraKNRTmOoRkhS/IwC1bqoMqR8uraYcfKlXeXBjYnJbVG6u/SAGLg7Llmt5UAs7a6/W/7ytWJ90uQVjgPcb7h+9ji+jK18EQUd/AAknfLkLE5IoU5wj6+2OTAGeCT46BbMpYOk2RJinUy93VBIPuRyvZ5tdIt76BPt3JgosYbYtbdkyZTI8V72iCVLWae1uCF2pJlZ1gLteaS0ZmkgyEsAchm8VaoE8NrIO4MBpyZ3fZ9gsprT5jsnUb9Hc+opKSgX+OwDjzM5BadCUFtvoJE3FNTv7koIDg2myHyYj+1kFxp6ctjNgP9V9/0rc4oWz9ew== grey@kitagawa" ];
+
+  services.openssh = {
+    enable = true;
+    enableRecommendedAlgorithms = false;
+    generateHostKeys = false;
+    settings = {
+      AllowUsers = [ "grey" ];
+      KbdInteractiveAuthentication = false;
+      PasswordAuthentication = false;
+      PermitRootLogin = "no";
+      MaxAuthTries = 3;
+      MaxSessions = 5;
+      MaxStartups = "2:50:5";
+    };
+    startWhenNeeded = true;
+  };
+
+  networking.firewall.extraCommands = ''
+    if [ "$(iptables -S INPUT)" != "-P INPUT ACCEPT" ]; then iptables -D INPUT -p tcp --dport 22 -m set ! --match-set geo-whitelist src -j DROP; ${pkgs.ipset}/bin/ipset destroy geo-whitelist; fi
+    ${pkgs.ipset}/bin/ipset restore -file /home/grey/nixos/assets/geo-whitelist.ipset
+    iptables -I INPUT -p tcp --dport 22 -m set ! --match-set geo-whitelist src -j DROP
+  '';
+}

old-config/hosts/takamaki/modules/remote-builder.nix

@@ -0,0 +1,20 @@
+{
+  pkgs,
+  config,
+  ...
+}: {
+  users.users.remotebuild = {
+    isSystemUser = true;
+    group = "remotebuild";
+    useDefaultShell = true;
+
+    # also uses id_takamaki for simplicity's sake
+    openssh.authorizedKeys.keys = [ "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCeYFzFyv1LEdWngyTDqnsdJQhmgAfQbbksyZrNWkameVMJpi8IJ+3IIrL96BtD8EAC/jxHIbri49TInN0lYRBH3cH3jbBupdDFaziH3ohyMoeg8enKYsiisaT+MTGEGFygF9Ul1WDrOM1oThEP1LTYj5pWNfZRtIG870jLzRkNczb0eCtEO0qWtyH92Cb5BSpXBKd4Eaysvkm5ex77I5Y1Hl0RUjyEiegiwC1LrcrFhjhVFQGlShTr5kf/LJrwamyGJx4oLi462Omf/jLwNoIMLNgxzuJBynYK714AY9U/IbNq//bEQro6i2cwxPm4lSTaGemnhvEItHsDfbeAJ06iqOl51OtsM2qees2ygCgFvraKNRTmOoRkhS/IwC1bqoMqR8uraYcfKlXeXBjYnJbVG6u/SAGLg7Llmt5UAs7a6/W/7ytWJ90uQVjgPcb7h+9ji+jK18EQUd/AAknfLkLE5IoU5wj6+2OTAGeCT46BbMpYOk2RJinUy93VBIPuRyvZ5tdIt76BPt3JgosYbYtbdkyZTI8V72iCVLWae1uCF2pJlZ1gLteaS0ZmkgyEsAchm8VaoE8NrIO4MBpyZ3fZ9gsprT5jsnUb9Hc+opKSgX+OwDjzM5BadCUFtvoJE3FNTv7koIDg2myHyYj+1kFxp6ctjNgP9V9/0rc4oWz9ew== grey@kitagawa" ];
+  };
+
+  services.openssh.settings.AllowUsers = [ "remotebuild" ];
+
+  users.groups.remotebuild = {};
+
+  nix.settings.trusted-users = [ "remotebuild" ];
+}

old-config/hosts/takamaki/modules/sudo.nix

@@ -0,0 +1,51 @@
+{
+  pkgs,
+  config,
+  ...
+}: {
+  security.sudo = {
+    enable = true;
+    extraRules = [{
+      commands = [
+        {
+          command = "${pkgs.systemd}/bin/systemctl poweroff";
+          options = [ "NOPASSWD" ];
+        }
+        {
+          command = "${pkgs.systemd}/bin/shutdown";
+          options = [ "NOPASSWD" ];
+        }
+        {
+          command = "${pkgs.systemd}/bin/systemctl reboot";
+          options = [ "NOPASSWD" ];
+        }
+        {
+          command = "${pkgs.systemd}/bin/reboot";
+          options = [ "NOPASSWD" ];
+        }
+        {
+          command = "${pkgs.efibootmgr}/bin/efibootmgr";
+          options = [ "NOPASSWD" ];
+        }
+        {
+          command = "/run/current-system/sw/bin/efibootmgr";
+          options = [ "NOPASSWD" ];
+        }
+        {
+          command = "${pkgs.efibootmgr}/bin/efibootdump";
+          options = [ "NOPASSWD" ];
+        }
+        {
+          command = "${pkgs.efibootmgr}/sbin/efibootdump";
+          options = [ "NOPASSWD" ];
+        }
+      ];
+      users = [ "grey" ];
+    }];
+    extraConfig = with pkgs; ''
+      Defaults:grey secure_path="${lib.makeBinPath [
+        systemd
+      ]}:/nix/var/nix/profiles/default/bin:/run/current-system/sw/bin"
+    '';
+  };
+}

old-config/hosts/takamaki/modules/virt-manager.nix

@@ -0,0 +1,20 @@
+{
+  pkgs,
+  config,
+  ...
+}: {
+  virtualisation.libvirtd = {
+    enable = true;
+    qemu.vhostUserPackages = with pkgs; [ virtiofsd ];
+  };
+
+  programs.virt-manager.enable = true;
+
+  users.users.grey.extraGroups = [ "libvirtd" ];
+
+  environment.systemPackages = with pkgs; [
+    dnsmasq
+  ];
+
+  networking.firewall.trustedInterfaces = [ "virbr0" ];
+}