From 9f7b2bd3d56b09fda7801a069081ac30076c15f4 Mon Sep 17 00:00:00 2001 From: ahtlon Date: Thu, 30 Jul 2026 18:49:39 +0200 Subject: [PATCH 1/5] add goldman, the rpi that runs gatekeeper --- flake.lock | 115 ++++++++++++++++++++++++++++- flake.nix | 5 ++ machines/goldman/configuration.nix | 66 +++++++++++++++++ machines/hosts.nix | 9 +++ 4 files changed, 194 insertions(+), 1 deletion(-) create mode 100644 machines/goldman/configuration.nix diff --git a/flake.lock b/flake.lock index 3914a22..0ad7ec1 100644 --- a/flake.lock +++ b/flake.lock @@ -78,6 +78,29 @@ "type": "github" } }, + "gatekeeper": { + "inputs": { + "nixpkgs": [ + "nixpkgs-unstable" + ], + "pyproject-build-systems": "pyproject-build-systems", + "pyproject-nix": "pyproject-nix", + "uv2nix": "uv2nix" + }, + "locked": { + "lastModified": 1785429358, + "narHash": "sha256-uWUZm9iRqPkkNWrgtpsN9GyDQsiz80eHvuE14wOKp+Q=", + "ref": "refs/heads/master", + "rev": "40312020c8e17c78ac345def6ac95cb1ed8f344f", + "revCount": 110, + "type": "git", + "url": "https://git.dynamicdiscord.de/malobeo/gatekeeper" + }, + "original": { + "type": "git", + "url": "https://git.dynamicdiscord.de/malobeo/gatekeeper" + } + }, "home-manager": { "inputs": { "nixpkgs": [ @@ -255,11 +278,78 @@ "type": "github" } }, + "nixpkgs_4": { + "locked": { + "lastModified": 1783522502, + "narHash": "sha256-iffAls3iaNTyJC2faYcUXSI+Gp02cDjYl+MygxKl2GI=", + "owner": "nixos", + "repo": "nixpkgs", + "rev": "0bb7ec54c8483066ec9d7720e780a5caa71f8612", + "type": "github" + }, + "original": { + "owner": "nixos", + "ref": "nixos-unstable", + "repo": "nixpkgs", + "type": "github" + } + }, + "pyproject-build-systems": { + "inputs": { + "nixpkgs": [ + "gatekeeper", + "nixpkgs" + ], + "pyproject-nix": [ + "gatekeeper", + "pyproject-nix" + ], + "uv2nix": [ + "gatekeeper", + "uv2nix" + ] + }, + "locked": { + "lastModified": 1776659114, + "narHash": "sha256-qapCOQmR++yZSY43dzrp3wCrkOTLpod+ONtJWBk6iKU=", + "owner": "pyproject-nix", + "repo": "build-system-pkgs", + "rev": "ffaa2161dd5d63e0e94591f86b54fc239660fb2e", + "type": "github" + }, + "original": { + "owner": "pyproject-nix", + "repo": "build-system-pkgs", + "type": "github" + } + }, + "pyproject-nix": { + "inputs": { + "nixpkgs": [ + "gatekeeper", + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1778901413, + "narHash": "sha256-GSKXTAnFqRAMlZkJrIPcQMYf+lpMr66K3i60mB9STvc=", + "owner": "pyproject-nix", + "repo": "pyproject.nix", + "rev": "a228447c3e179d477c1b6246ef3efa8cfe3c469a", + "type": "github" + }, + "original": { + "owner": "pyproject-nix", + "repo": "pyproject.nix", + "type": "github" + } + }, "root": { "inputs": { "disko": "disko", "dns": "dns", "ep3-bs": "ep3-bs", + "gatekeeper": "gatekeeper", "home-manager": "home-manager", "mfsync": "mfsync", "microvm": "microvm", @@ -461,11 +551,34 @@ "type": "github" } }, - "zineshop": { + "uv2nix": { "inputs": { "nixpkgs": [ + "gatekeeper", "nixpkgs" ], + "pyproject-nix": [ + "gatekeeper", + "pyproject-nix" + ] + }, + "locked": { + "lastModified": 1779269674, + "narHash": "sha256-P1LHCRdYpdtHAEzuEsNHrI6d9mVPl5a2fyFDZGHNVbI=", + "owner": "pyproject-nix", + "repo": "uv2nix", + "rev": "69aec536f6d1acc415ed2e20299312802aba98c6", + "type": "github" + }, + "original": { + "owner": "pyproject-nix", + "repo": "uv2nix", + "type": "github" + } + }, + "zineshop": { + "inputs": { + "nixpkgs": "nixpkgs_4", "utils": "utils_4" }, "locked": { diff --git a/flake.nix b/flake.nix index decbc2c..20c41a9 100644 --- a/flake.nix +++ b/flake.nix @@ -37,6 +37,11 @@ inputs.nixpkgs.follows = "nixpkgs"; }; + gatekeeper = { + url = "git+https://git.dynamicdiscord.de/malobeo/gatekeeper"; + inputs.nixpkgs.follows = "nixpkgs-unstable"; + }; + nixos-generators = { url = "github:nix-community/nixos-generators"; inputs.nixpkgs.follows = "nixpkgs"; diff --git a/machines/goldman/configuration.nix b/machines/goldman/configuration.nix new file mode 100644 index 0000000..e6a935d --- /dev/null +++ b/machines/goldman/configuration.nix @@ -0,0 +1,66 @@ +{ config, pkgs, inputs, modulesPath, ... }: + +let + sshKeys = import ../ssh_keys.nix; +in +{ + networking.hostName = "goldman"; # Define your hostname. + nixpkgs.hostPlatform = { system = "aarch64-linux"; }; + imports = + [ + inputs.gatekeeper.nixosModules.gatekeeper + ../modules/malobeo_user.nix + #inputs.nixos-hardware.nixosModules.raspberry-pi-3 + (modulesPath + "/profiles/minimal.nix") + ]; + + #Try to reduce size + services.nixosManual.enable = false; + documentation.man.enable = false; + + services.openssh.enable = true; + services.openssh.ports = [ 22 ]; + services.openssh.settings.PasswordAuthentication = false; + services.openssh.settings.PermitRootLogin = "prohibit-password"; + users.users.root.openssh.authorizedKeys.keys = sshKeys.admins; + + # Use the extlinux boot loader. (NixOS wants to enable GRUB by default) + boot.loader.grub.enable = false; + + # Enables the generation of /boot/extlinux/extlinux.conf + boot.loader.generic-extlinux-compatible.enable = true; + + networking.dhcpcd.enable = true; + + # Set your time zone. + time.timeZone = "Europe/Berlin"; + + services = { + gatekeeper = { + enable = true; + }; + }; + + environment.systemPackages = with pkgs; [ + htop + wget + git + pciutils + nix-tree + ]; + + services.avahi = { + enable = true; + nssmdns4 = true; + publish = { + enable = true; + addresses = true; + userServices = true; + }; + }; + + networking.firewall.allowedTCPPorts = [ 80 443 ]; + + system.stateVersion = "23.05"; +} + diff --git a/machines/hosts.nix b/machines/hosts.nix index e194ed1..4482706 100644 --- a/machines/hosts.nix +++ b/machines/hosts.nix @@ -58,6 +58,15 @@ in address = "192.168.1.105"; }; }; + + goldman = { + type = "rpi"; + network = { + local = true; + hostId = "16"; + address = "192.168.1.106"; + }; + }; durruti = { type = "microvm"; -- 2.51.2 From 3d31a8a690882638647b8b33c6bf71101807fc87 Mon Sep 17 00:00:00 2001 From: ahtlon Date: Thu, 30 Jul 2026 19:29:51 +0200 Subject: [PATCH 2/5] fix flake check --- flake.lock | 20 +++----------------- machines/goldman/configuration.nix | 8 +++++++- 2 files changed, 10 insertions(+), 18 deletions(-) diff --git a/flake.lock b/flake.lock index 0ad7ec1..0933998 100644 --- a/flake.lock +++ b/flake.lock @@ -278,22 +278,6 @@ "type": "github" } }, - "nixpkgs_4": { - "locked": { - "lastModified": 1783522502, - "narHash": "sha256-iffAls3iaNTyJC2faYcUXSI+Gp02cDjYl+MygxKl2GI=", - "owner": "nixos", - "repo": "nixpkgs", - "rev": "0bb7ec54c8483066ec9d7720e780a5caa71f8612", - "type": "github" - }, - "original": { - "owner": "nixos", - "ref": "nixos-unstable", - "repo": "nixpkgs", - "type": "github" - } - }, "pyproject-build-systems": { "inputs": { "nixpkgs": [ @@ -578,7 +562,9 @@ }, "zineshop": { "inputs": { - "nixpkgs": "nixpkgs_4", + "nixpkgs": [ + "nixpkgs" + ], "utils": "utils_4" }, "locked": { diff --git a/machines/goldman/configuration.nix b/machines/goldman/configuration.nix index e6a935d..31e3077 100644 --- a/machines/goldman/configuration.nix +++ b/machines/goldman/configuration.nix @@ -12,11 +12,17 @@ in ../modules/malobeo_user.nix #inputs.nixos-hardware.nixosModules.raspberry-pi-3 (modulesPath + "/profiles/minimal.nix") + #(modulesPath + "/installer/sd-card/sd-image.nix") ]; + fileSystems."/" = + { device = "/dev/disk/by-label/NIXOS_SD"; + fsType = "ext4"; + }; + #Try to reduce size - services.nixosManual.enable = false; documentation.man.enable = false; + documentation.nixos.enable = false; services.openssh.enable = true; services.openssh.ports = [ 22 ]; -- 2.51.2 From 54ea96f84c004c258810185f304f00edadd20ee7 Mon Sep 17 00:00:00 2001 From: ahtlon Date: Sat, 1 Aug 2026 14:48:13 +0200 Subject: [PATCH 3/5] Fix gatekeeper missing the key --- machines/goldman/configuration.nix | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/machines/goldman/configuration.nix b/machines/goldman/configuration.nix index 31e3077..9edfe42 100644 --- a/machines/goldman/configuration.nix +++ b/machines/goldman/configuration.nix @@ -6,6 +6,7 @@ in { networking.hostName = "goldman"; # Define your hostname. nixpkgs.hostPlatform = { system = "aarch64-linux"; }; + imports = [ inputs.gatekeeper.nixosModules.gatekeeper @@ -44,6 +45,13 @@ in services = { gatekeeper = { enable = true; + envFile = pkgs.writeText "env" '' + MIFARE_APP_MASTER_KEY="7b195adb892073c9e34ebe7e0ca28b2b" + MIFARE_ACL_READ_BASE_KEY="741a50f2b189cc9f151e0600f50a6e1a" + MIFARE_ACL_WRITE_BASE_KEY="f1aa99f81cca268de98d422ee0ccb65c" + SECRET_KEY="8b14d0b447bff7efa24d5019cc59a999786e31f6f865173bbd642bf18de5ad85" + ''; + mockGpio = "False"; }; }; @@ -52,7 +60,9 @@ in wget git pciutils + gpio-utils nix-tree + lgpio ]; services.avahi = { -- 2.51.2 From 6b70d4d151c0419cabba778f88b04271a8efb1d9 Mon Sep 17 00:00:00 2001 From: ahtlon Date: Fri, 7 Aug 2026 19:43:12 +0200 Subject: [PATCH 4/5] Update gatekeeper --- flake.lock | 8 ++++---- machines/goldman/configuration.nix | 4 +++- 2 files changed, 7 insertions(+), 5 deletions(-) diff --git a/flake.lock b/flake.lock index 0933998..758d100 100644 --- a/flake.lock +++ b/flake.lock @@ -88,11 +88,11 @@ "uv2nix": "uv2nix" }, "locked": { - "lastModified": 1785429358, - "narHash": "sha256-uWUZm9iRqPkkNWrgtpsN9GyDQsiz80eHvuE14wOKp+Q=", + "lastModified": 1786138873, + "narHash": "sha256-+G/hTquaK4AjYxNSJTpcZXUEKxFDv9lOn3x+lHHTWJw=", "ref": "refs/heads/master", - "rev": "40312020c8e17c78ac345def6ac95cb1ed8f344f", - "revCount": 110, + "rev": "c5934d05c6f01c94c36221deb7ed4de03aa91ca1", + "revCount": 127, "type": "git", "url": "https://git.dynamicdiscord.de/malobeo/gatekeeper" }, diff --git a/machines/goldman/configuration.nix b/machines/goldman/configuration.nix index 9edfe42..a775d57 100644 --- a/machines/goldman/configuration.nix +++ b/machines/goldman/configuration.nix @@ -50,8 +50,10 @@ in MIFARE_ACL_READ_BASE_KEY="741a50f2b189cc9f151e0600f50a6e1a" MIFARE_ACL_WRITE_BASE_KEY="f1aa99f81cca268de98d422ee0ccb65c" SECRET_KEY="8b14d0b447bff7efa24d5019cc59a999786e31f6f865173bbd642bf18de5ad85" + MQTT_HOST = "192.168.178.120" + MQTT_PORT = "1883" ''; - mockGpio = "False"; + mock = "False"; }; }; -- 2.51.2 From 3de04bb5d440c76360128fd44fc5453434f0572a Mon Sep 17 00:00:00 2001 From: Ahtlon Date: Sat, 8 Aug 2026 16:41:40 +0200 Subject: [PATCH 5/5] Add mosquitto --- machines/goldman/configuration.nix | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/machines/goldman/configuration.nix b/machines/goldman/configuration.nix index a775d57..6c46059 100644 --- a/machines/goldman/configuration.nix +++ b/machines/goldman/configuration.nix @@ -42,6 +42,15 @@ in # Set your time zone. time.timeZone = "Europe/Berlin"; + services.mosquitto = { + enable = true; + listeners = [{ + acl = [ "pattern readwrite #" ]; + omitPasswordAuth = true; + settings.allow_anonymous = true; + }]; + }; + services = { gatekeeper = { enable = true; @@ -50,7 +59,7 @@ in MIFARE_ACL_READ_BASE_KEY="741a50f2b189cc9f151e0600f50a6e1a" MIFARE_ACL_WRITE_BASE_KEY="f1aa99f81cca268de98d422ee0ccb65c" SECRET_KEY="8b14d0b447bff7efa24d5019cc59a999786e31f6f865173bbd642bf18de5ad85" - MQTT_HOST = "192.168.178.120" + MQTT_HOST = "localhost" MQTT_PORT = "1883" ''; mock = "False"; @@ -77,7 +86,7 @@ in }; }; - networking.firewall.allowedTCPPorts = [ 80 443 ]; + networking.firewall.allowedTCPPorts = [ 80 443 1883]; system.stateVersion = "23.05"; } -- 2.51.2