Setup my blog today, and made my first post detailing a Nix flake that I include on all my nixosSystem builds that sets some sensible defaults

Check it out:
https://blog.xvrqt.com/nix-defaults.html

#nix #nixos #rust #flakes #programming #coder #hacking #crows
nix defaults

Sensible Nix Defaults If you're using Nix you are probably more accustomed to nonsense, and I am no...

xvrqt
Got tricked into writing a blog post better explaining the linux kernel's audit system and setting it up in Nix

It's a moving work of art and you should read it; it will look great on your wedding day:
https://blog.xvrqt.com/nix-audit.html

#nix #nixos #linux #kernelsecurity
nix audit

Nix Audit The linux kernel has an audit module which can keep track of which files are accessed, an...

xvrqt
https://blog.xvrqt.com/nix-wireguard.html

Writing a new series on using Nix to configure Wireguard. It's probably overly ambitious as I have had the completed flake done for personal use for weeks now, but writing the blog means redoing it step by step in excruciating detail.

I had to keep cutting scope for each post and now, after typing all day, I finally have... the basic option setup for it. How is writing so hard? Why would a loving god cause such agony?

Feedback welcome, as I think part of my problem is I don't understand who my audience is so I never know what I can leave out and what I should explain further.

#nix #nixos #linux #wireguard #kernel #flakes #foss
nix wireguard

Wireguard1 is a Linux Kernel Module which allows you to easily configure encrypted network interfac...

xvrqt
@crow You might find wirenix interesting (autogen via agenix implemented there already) https://man.sr.ht/~msalerno/wirenix/
@juuso truly nothing new under the sun 🥲

in the next post we autogen keys and encrypt with agenix but you have to do it in a separate step so you can save the keys to the flake so they are the same for each peer using the flake

i'll check this out to see if they do something more clever where you can have deterministic key gen without leaking the seed via the config
@crow in wirenix the keys can also be saved to the flake. But it's not deterministic -- it uses agenix-rekey to generate new keys whenever the mesh topology changes. It's also ipv6 only. But yeah, no secrets are leaked, instead it can use hmac secrets of Yubikeys and such which can be public. And agenix encrypts host secrets against hosts persistent SSH private keys (ed25519). Would be interesting to hear about alternative methods though!
@juuso Oh yeah, in mine you just set your agenix public keys in your config and it generates all the keys and rekeys the Wireguard keys on mesh changes. I wasn't sure how to get Machine A and Machine B to generate the same Wireguard keys when running without saving them somewhere though

Mine is IPv4 only, already at my limit writing Nix code to deal with that