Port the SSH daemon used to decrypt the root partition listens to.

Type: signed integer

Default:

2223

Declared by:

If set to false, completely disable network setup by Skarabox.

Make sure you can still ssh to the server.

Type: boolean

Default:

false

Declared by:

ZFS pool to store important data.

Type: submodule

Declared by:

Whether to enable the data pool on other hard drives…

Type: boolean

Default:

true

Example:

true

Declared by:

First disk on which to install the data pool.

Type: string

Example:

"/dev/sda"

Declared by:

Second disk on which to install the data pool.

Type: string

Example:

"/dev/sdb"

Declared by:

Name of the data pool

Type: string

Default:

"zdata"

Declared by:

Disk size to reserve for ZFS internals. Should be between 5% and 10% of available size as recorded by zpool.

To get available size on zpool:

zfs get -Hpo value available <pool name>

Then to set manually, if needed:

sudo zfs set reservation=100G <pool name>

Type: string

Example:

"1T"

Declared by:

Create the backup dataset.

Type: boolean

Default:

true

Declared by:

ZFS root pool where the OS is stored.

Type: submodule

Declared by:

What bootloader mode to use.

Type: one of “uefi”, “bios”

Default:

"if config.hardware.facter.detected.uefi.supported then \"uefi\" else \"bios\""

Example:

"bios"

Declared by:

SSD disk on which to install. Required

Type: string

Example:

"/dev/nvme0n1"

Declared by:

Mirror SSD disk on which to install. Optional. Boot partition will be mirrored too.

Type: null or string

Default:

null

Example:

"/dev/nvme0n2"

Declared by:

Name of the root pool

Type: string

Default:

"root"

Declared by:

Disk size to reserve for ZFS internals. Should be between 10% and 15% of available size as recorded by zpool.

To get available size on zpool:

zfs get -Hpo value available <pool name>

Then to set manually, if needed:

sudo zfs set reservation=100G <pool name>

Type: string

Example:

"100G"

Declared by:

nixos-facter config file.

Type: absolute path

Declared by:

Contains hashed password for the admin user.

Type: string

Declared by:

8 characters unique identifier for this server. Generate with uuidgen | head -c 8.

Type: string

Declared by:

Hostname to give to the server.

Type: string

Default:

"skarabox"

Declared by:

Whether to enable the Skarabox HotSpot.

Type: boolean

Default:

true

Example:

true

Declared by:

IP address of the beacon in the hotspot network.

Type: string

Default:

"192.168.12.1"

Declared by:

SSID of the hotspot network.

Type: string

Default:

"Skarabox"

Declared by:

Unique identifier. Generate with uuidgen -r | tr -d -.

This must be persisted https://nixos.org/manual/nixos/stable/#sec-machine-id

Type: string

Declared by:

Public SSH key(s) used to connect on boot to decrypt the root pool.

Type: list of (non-empty single-line SSH public key string or path to a non-empty single-line SSH public key file)

Default:

[ ]

Declared by:

Port the SSH daemon listens to.

Type: 16 bit unsigned integer; between 0 and 65535 (both inclusive)

Default:

2222

Declared by:

Use static IP configuration. If unset, use DHCP.

Type: null or (submodule)

Default:

null

Example:

{
  ip = "192.168.1.30";
  gateway = "192.168.1.1";
}

Declared by:

Whether to enable Skarabox static IP configuration.

Type: boolean

Default:

false

Example:

true

Declared by:

Device for which to configure the IP address for.

Either pass the device name directly if you know it, like “ens3”. Or configure the deviceName option to get the first device name matching that prefix from the facter.json report.

Type: string or (submodule)

Default:

{
  namePrefix = "en";
}

Declared by:

IP Gateway, often same beginning as ip and finishing by a 1: XXX.YYY.ZZZ.1.

Type: string

Declared by:

Static IP to use.

Type: string

Declared by:

Name given to the admin user on the server.

Type: string

Default:

"skarabox"

Declared by:

Hosts managed by Skarabox.

Type: attribute set of (submodule)

Default:

{ }

Declared by:

Port the SSH daemon listens to on the beacon.

Defaults to the same port configured for the target host, which should work in most cases.

If installing on a cloud instance, set this to the port that can ssh into the instance as given by your cloud provider, usually 22.

Type: signed integer

Default:

"config.skarabox.sshPort"

Declared by:

Path from the top of the repo to the ssh private file used to ssh into the host.

Defaults to the ssh key for the target host skarabox.hosts.<name>.sshPublicKeyPath.

Set to null if you use an ssh agent. See also sshPublicKeyPath.

Type: null or string

Default:

"‹name›/ssh"

Declared by:

Path from the top of the repo to the ssh public file used to ssh into the host.

Defaults to the ssh key for the target host skarabox.hosts.<name>.sshPublicKeyPath.

Should be only necessary when using an ssh agent which has a lot of ssh keys. Setting this option allows the ssh agent to know which key to give, otherwise ssh might fail with “too many authentication attempts”.

If set, you should probably set sshPrivateKeyPath to null.

Type: null or string

Default:

null

Declared by:

Username with which you can log into the beacon.

Defaults to the username configured for the target host, which should work in most cases.

If installing on a cloud instance, set this to the user that can ssh into the instance as given by your cloud provider.

Type: string

Default:

"topLevelConfig.flake.nixosConfigurations.‹name›.config.skarabox.username"

Declared by:

Modules to add to the beacon configuration. Use this to add static network config, for example.

Type: list of anything

Default:

[ ]

Example:

''
  extraBeaconModules = [
    {
      environment.systemPackages = [ pkgs.tmux ];
    }
  ];
''

Declared by:

Paths in python dictionary format to other passphrases for extra ZFS pools as they is stored in the SOPS secrets file.

Type: attribute set of string

Default:

{ }

Example:

{
  backup_passphrase = "['‹name›']['disks']['backupPassphrase']";
}

Declared by:

Path from the top of the repo to the ssh private file used as the host key.

Type: string

Default:

"‹name›/host_key"

Declared by:

SSH public file used as the host key.

Type: string or absolute path

Example:

./‹name›/host_key.pub

Declared by:

IP or hostname used to ssh into the server.

This can be the fqdn used to access the server or the external IP if port forwarding is configured on the router or the internal IP if on the same network.

All cases are valid and might need to be adapted if the server moves or if the DNS or DHCP server are mis-configured.

Type: string

Default:

"127.0.0.1"

Declared by:

Path from the top of the repo to known hosts file.

Type: string

Default:

"‹name›/known_hosts"

Declared by:

Modules to add to the host nixosConfiguration. Add here all your own configuration.

Type: list of anything

Default:

[ ]

Declared by:

If given, overrides nixpkgs in the nixosConfiguration, including nixos/modules/.

By default, uses the nixpkgs input.

This option allows to patch nixpkgs following https://wiki.nixos.org/wiki/Nixpkgs/Patching_Nixpkgs

Type: raw value

Default:

"inputs.nixpkgs"

Declared by:

Path in python dictionary format to the passphrase of the data ZFS pool as it is stored in the SOPS secrets file.

Type: string

Default:

"['‹name›']['disks']['dataPassphrase']"

Declared by:

Path from the top of the repo to the SOPS secrets file.

By default Skarabox assumes one secret file per host to avoid sharing secrets across them but having only one file by specifying “./secrets.yaml” is possible too.

Type: string

Default:

"‹name›/secrets.yaml"

Declared by:

Path in python dictionary format to the passphrase of the root ZFS pool as it is stored in the SOPS secrets file.

Type: string

Default:

"['‹name›']['disks']['rootPassphrase']"

Declared by:

Extra specialArgs passed to the host nixosConfiguration.

Type: attribute set of raw value

Default:

{ }

Declared by:

Port used to ssh into the server.

By default it is the same as the port configured in the NixOS module in configuration.nix but can be different if accessing the server from outside with some port forwarding enabled or if you want to update the ssh port.

To update the ssh port of a live target host, first update the ssh port in the configuration.nix then deploy the new change, and finally update the port here.

Type: 16 bit unsigned integer; between 0 and 65535 (both inclusive)

Default:

"topLevelConfig.flake.nixosConfigurations.‹name›.config.skarabox.boot.sshPort"

Declared by:

Port used to ssh into the server.

By default it is the same as the port configured in the NixOS module in configuration.nix but can be different if accessing the server from outside with some port forwarding enabled or if you want to update the ssh port.

To update the ssh port of a live target host, first update the ssh port in the configuration.nix then deploy the new change, and finally update the port here.

Type: 16 bit unsigned integer; between 0 and 65535 (both inclusive)

Default:

"topLevelConfig.flake.nixosConfigurations.‹name›.config.skarabox.sshPort"

Declared by:

Path from the top of the repo to the ssh private file used to ssh into the host. Set to null if you use an ssh agent.

Type: null or string

Default:

"‹name›/ssh"

Declared by:

Path from the top of the repo to the ssh public file used to ssh into the host.

Should be only necessary when using an ssh agent which has a lot of ssh keys. Setting this option allows the ssh agent to know which key to give, otherwise ssh might fail with “too many authentication attempts”.

If set, you should probably set sshPrivateKeyPath to null.

Type: null or string

Default:

null

Declared by:

System of the host.

Can be the systm directly or a file containing the value.

Type: string or absolute path

Declared by:

Path from the top of the repo to the main sops key.

Type: string

Default:

"sops.key"

Declared by: