ssh: remove old known hosts

This reduces disk-usage for servers.

flake.lock

@@ -136,11 +136,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1731332224,
+        "lastModified": 1731403644,
-        "narHash": "sha256-0ctfVp27ingWtY7dbP5+QpSQ98HaOZleU0teyHQUAw0=",
+        "narHash": "sha256-T9V7CTucjRZ4Qc6pUEV/kpgNGzQbHWfGcfK6JJLfUeI=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "184687ae1a3139faa4746168baf071f60d0310c8",
+        "rev": "f6581f1c3b137086e42a08a906bdada63045f991",
         "type": "github"
       },
       "original": {
@@ -214,10 +214,10 @@
     },
     "secrets": {
       "locked": {
-        "lastModified": 1731269025,
+        "lastModified": 1731452589,
-        "narHash": "sha256-Vq3nNbn2mAO3Ma50leb+LIiFmdUZ1P73CfrT3Znr94g=",
+        "narHash": "sha256-GpAaJ+WcJd1BMmQmO4QoCnvXz4s2WWl8AOyRMRRKa24=",
         "ref": "refs/heads/master",
-        "rev": "f2d6367a7320e3c597122869f073dc839e56abe9",
+        "rev": "a250fcf99ece2ae6e92713d9cf8b24c98a579320",
         "revCount": 47,
         "type": "git",
         "url": "ssh://git@git.caspervk.net/caspervk/nixos-secrets.git"

hosts/tor/default.nix

@@ -12,10 +12,8 @@
 
   boot = {
     loader = {
-      grub = {
+      efi.canTouchEfiVariables = true;
-        enable = true;
+      systemd-boot.enable = true;
-        device = "/dev/vda";
-      };
     };
     initrd.luks.devices.crypted.device = "/dev/disk/by-label/crypted";
   };

hosts/tor/hardware.nix

@@ -9,7 +9,7 @@
     (modulesPath + "/profiles/qemu-guest.nix")
   ];
 
-  boot.initrd.availableKernelModules = ["ata_piix" "uhci_hcd" "virtio_pci" "sr_mod" "virtio_blk"];
+  boot.initrd.availableKernelModules = ["ata_piix" "uhci_hcd" "virtio_pci" "virtio_scsi" "sr_mod" "virtio_blk"];
   boot.initrd.kernelModules = ["dm-snapshot"];
   boot.kernelModules = [];
   boot.extraModulePackages = [];

hosts/tor/network.nix

@@ -8,21 +8,19 @@
 
   systemd.network = {
     networks."10-lan" = {
-      # IPv4 settings are from `sudo dhcpcd --test`.
+      matchConfig.Name = "enp0s18";
-      # IPv6 settings are from https://www.ssdvps.dk/knowledgebase/18/IPv6-Gateway.html.
-      matchConfig.Name = "ens3";
       address = [
-        "91.210.59.57/25"
+        "185.231.102.51/24"
-        "2a12:bec4:11d3:de9f::1/64"
+        "2a0c:5700:3133:650:b0ea:eeff:fedb:1f7b/64"
       ];
       routes = [
-        {routeConfig = {Gateway = "91.210.59.1";};}
+        {routeConfig = {Gateway = "185.231.102.1";};}
-        {
+        # {
-          routeConfig = {
+        #   routeConfig = {
-            Gateway = "2a12:bec4:11d3::1";
+        #     Gateway = "fe80::200:5eff:fe00:20c";
-            GatewayOnLink = true;
+        #     GatewayOnLink = true;
-          };
+        #   };
-        }
+        # }
       ];
     };
   };

hosts/tor/tor.nix

@@ -1,8 +1,4 @@
-{
+{pkgs, ...}: {
-  config,
-  pkgs,
-  ...
-}: {
   services.tor = {
     enable = true;
     openFirewall = true;
@@ -15,11 +11,11 @@
       ContactInfo = "admin@caspervk.net";
       ORPort = [
         {
-          addr = "91.210.59.57";
+          addr = "185.231.102.51";
           port = 443;
         }
         {
-          addr = "[2a12:bec4:11d3:de9f::1]";
+          addr = "[2a0c:5700:3133:650:b0ea:eeff:fedb:1f7b]";
           port = 443;
         }
       ];

modules/base/default.nix

@@ -1,7 +1,6 @@
 {...}: {
   imports = [
     ./agenix.nix
-    ./docker.nix
     ./fish.nix
     ./git.nix
     ./hardware.nix

modules/base/programs.nix

@@ -2,34 +2,25 @@
   # NixOS default packages:
   # https://github.com/NixOS/nixpkgs/blob/nixos-unstable/nixos/modules/config/system-path.nix
   environment.systemPackages = with pkgs; [
-    ascii
     bandwhich
     bat
     binutils
-    black
-    clang
     dnsutils
     fd
     file
     fzf
-    gcc
     git
-    gnumake
     htop
     iputils
     jq
     lsof
-    magic-wormhole-rs
     mtr
     ncdu
     ntp
     openssl
     pciutils
-    postgresql
     progress
-    pwgen
     python3
-    python310
     python311
     python312
     socat

modules/base/ssh.nix

@@ -19,9 +19,7 @@
   programs.ssh.knownHosts = {
     "alpha".publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGOpQNEmmEe6jr7Mv37ozokvtTSd1I3SmUU1tpCSNTkc";
     "delta".publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFe9RpnO1/QRU81kjtEsWN66xfP5Y/qf5EQZ6wdM/XCT";
-    "delta-old".publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB0x9oImZjIhoPEwLlHVixIh7y1Kwn+SX17xffrdRzvv";
     "sigma".publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIC4Kvx/lcFRvl7KlxqqhrJ32h3FzuzyLA5BNB42+p92c";
-    "sigma-old".publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIF2Qrh0tpR5YawiYvcPGC4OSnu4//ge1eVdiBDLrTbCx";
     "tor".publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMVPxvqwS2NMqqCGBkMmExzdBY5hGLegiOuqPJAOfdKk";
     "git.caspervk.net".publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIC4Kvx/lcFRvl7KlxqqhrJ32h3FzuzyLA5BNB42+p92c";
   };

modules/desktop/default.nix

@@ -1,6 +1,7 @@
 {...}: {
   imports = [
     ./clipman.nix
+    ./docker.nix
     ./flatpak.nix
     ./foot.nix
     ./gammastep.nix

modules/desktop/programs.nix

@@ -8,11 +8,13 @@
   # Packages useful on a desktop computer which don't require their own module
 
   environment.systemPackages = with pkgs; [
+    ascii
     aspell
     aspellDicts.da
     aspellDicts.en
     aspellDicts.en-computers
     aspellDicts.en-science
+    black
     element-desktop
     firefox-wayland
     gimp
@@ -30,6 +32,8 @@
     libreoffice
     mpv
     mumble
+    postgresql
+    pwgen
     spotify
     thunderbird
     tor-browser-bundle-bin