From 040dae6da70eafd8e84cdf18a6eacd914dc7f7fa Mon Sep 17 00:00:00 2001 From: Morgan Helton Date: Sun, 30 Aug 2026 12:26:29 -0500 Subject: [PATCH 1/3] chore: factor the mhelton user into its own module The user and its authorized keys were defined in the common host baseline, which also pulls in sops, the substituter list and a node exporter. MicroVM guests want the user without any of that, so it moves to a module both can import. Host-specific groups stay in the baseline and merge on top. --- hosts/chopper/microvm/common.nix | 2 ++ hosts/common/default.nix | 18 ++++++------------ hosts/common/mhelton.nix | 13 +++++++++++++ 3 files changed, 21 insertions(+), 12 deletions(-) create mode 100644 hosts/common/mhelton.nix diff --git a/hosts/chopper/microvm/common.nix b/hosts/chopper/microvm/common.nix index 49cd125..7a6dea5 100644 --- a/hosts/chopper/microvm/common.nix +++ b/hosts/chopper/microvm/common.nix @@ -1,5 +1,7 @@ { ... }: { + imports = [ ../../common/mhelton.nix ]; + microvm = { registerWithMachined = true; vsock.ssh.enable = true; diff --git a/hosts/common/default.nix b/hosts/common/default.nix index 6784354..f27710d 100644 --- a/hosts/common/default.nix +++ b/hosts/common/default.nix @@ -5,6 +5,8 @@ ... }: { + imports = [ ./mhelton.nix ]; + sops = { defaultSopsFile = ../../secrets/default.yaml; secrets.attic_pull = { @@ -47,18 +49,10 @@ }; }; - users.users.mhelton = { - isNormalUser = true; - extraGroups = [ - "wheel" - "networkmanager" - "media" - "incus-admin" - ]; - }; - users.users.mhelton.openssh.authorizedKeys.keys = [ - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHD+tZ4hf4MhEW+akoZbXPN3Zi4cijSkQlX6bZlnV+Aq mhelton@gmail.com" - "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC5rmy7r//z1fARqDe6sIu5D4Nt5uD3rRvwtADDgb+sS6slv6I51Gm2rKcxDIHgYBSyhTDIuhNHlnn+cyJK4ZPxyZFxF0Vy0fZIFG3Y7AqkyQ0oXEDGYyqfL8U0mi0uGKmVW02T45w16REJG3x77uncw8VVxdEpKuYw+wk7uRlQpP/UiFYWsX4NS9rUS/aZrYZ2ys1/dCPqvz4KPXk7SZrqyqkiumIr8O0wluYI5FwhMtd3xpD9AQVI3V0zjYZPwesL+BkW4CAAm5dSnsns3haAuWHti/QLSR+90k15KhflXlq6JDzE4jrMbd1DYZqoVuTgoZxDB3HDJwEwpbYCWKLFaGR6ZDhE3NeFikNkdDRrlIcrK1wJCEO2QuDZ43IE/bDhLhOmqfliL6kRr+2G1AvY4Hr0jnJHbbHqN9mES5+VJZuhH2ii+QHS70VZN0NNQv7f0QJqiTVcUVuPXksBp6oojbkXK79CWd1X0u3shd6XinZ5N3KAD4PT8zlTCmglXNYamc1JpRqKzgFwgFcljXpHwtfuezpNVmzo1Vqi6Ib9S8qJi9rahhsafYP3Y+8EV3Ii3oXmGQBSwumAHCQIkiQ/Sc+FRS02GRgWuYOaQfvW99kLXbX+0eCMSdCJSLC+H1cO2b451qpDGGDnH9w+EvS04oyv4yufpwFlhys7qfU6HQ== mhelton@gmail.com" + users.users.mhelton.extraGroups = [ + "networkmanager" + "media" + "incus-admin" ]; environment.systemPackages = with pkgs; [ diff --git a/hosts/common/mhelton.nix b/hosts/common/mhelton.nix new file mode 100644 index 0000000..42165fc --- /dev/null +++ b/hosts/common/mhelton.nix @@ -0,0 +1,13 @@ +{ lib, ... }: +{ + users.users.mhelton = { + isNormalUser = true; + extraGroups = [ "wheel" ]; + openssh.authorizedKeys.keys = [ + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHD+tZ4hf4MhEW+akoZbXPN3Zi4cijSkQlX6bZlnV+Aq mhelton@gmail.com" + "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC5rmy7r//z1fARqDe6sIu5D4Nt5uD3rRvwtADDgb+sS6slv6I51Gm2rKcxDIHgYBSyhTDIuhNHlnn+cyJK4ZPxyZFxF0Vy0fZIFG3Y7AqkyQ0oXEDGYyqfL8U0mi0uGKmVW02T45w16REJG3x77uncw8VVxdEpKuYw+wk7uRlQpP/UiFYWsX4NS9rUS/aZrYZ2ys1/dCPqvz4KPXk7SZrqyqkiumIr8O0wluYI5FwhMtd3xpD9AQVI3V0zjYZPwesL+BkW4CAAm5dSnsns3haAuWHti/QLSR+90k15KhflXlq6JDzE4jrMbd1DYZqoVuTgoZxDB3HDJwEwpbYCWKLFaGR6ZDhE3NeFikNkdDRrlIcrK1wJCEO2QuDZ43IE/bDhLhOmqfliL6kRr+2G1AvY4Hr0jnJHbbHqN9mES5+VJZuhH2ii+QHS70VZN0NNQv7f0QJqiTVcUVuPXksBp6oojbkXK79CWd1X0u3shd6XinZ5N3KAD4PT8zlTCmglXNYamc1JpRqKzgFwgFcljXpHwtfuezpNVmzo1Vqi6Ib9S8qJi9rahhsafYP3Y+8EV3Ii3oXmGQBSwumAHCQIkiQ/Sc+FRS02GRgWuYOaQfvW99kLXbX+0eCMSdCJSLC+H1cO2b451qpDGGDnH9w+EvS04oyv4yufpwFlhys7qfU6HQ== mhelton@gmail.com" + ]; + }; + + security.sudo.wheelNeedsPassword = lib.mkDefault false; +} From 1796cc1c1d32ec6ddb6ba1442706ac3cb43b85e5 Mon Sep 17 00:00:00 2001 From: Morgan Helton Date: Sun, 30 Aug 2026 12:26:29 -0500 Subject: [PATCH 2/3] chore(chopper): raise the microvm state volume to 16G MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit NixOS modules put their state under /var/lib, so any guest running an ordinary service writes there whether or not it was planned for. Guest volumes are sparse, so the larger size costs nothing until it is used, and microvm only creates them when missing — a guest that boots with a small /var/lib cannot be grown from Nix afterwards. Genuinely bulky or recreatable storage still belongs on a per-guest volume. --- hosts/chopper/microvm/common.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/hosts/chopper/microvm/common.nix b/hosts/chopper/microvm/common.nix index 7a6dea5..fec1c8d 100644 --- a/hosts/chopper/microvm/common.nix +++ b/hosts/chopper/microvm/common.nix @@ -19,7 +19,7 @@ { image = "state.img"; mountPoint = "/var/lib"; - size = 1024; + size = 16384; } ]; }; From 4f4c967d1000c63debbdbbb5db7a0d27f090c437 Mon Sep 17 00:00:00 2001 From: Morgan Helton Date: Sun, 30 Aug 2026 12:34:36 -0500 Subject: [PATCH 3/3] chore(chopper): drop the root key from microvm guests Guests get the mhelton user with passwordless sudo, so the root key is redundant. Tailscale SSH authenticates against tailnet identity rather than authorized_keys and is unaffected; VSOCK sessions now need an explicit login user, as `microvm -s ` defaults to root. --- hosts/chopper/microvm/common.nix | 4 ---- 1 file changed, 4 deletions(-) diff --git a/hosts/chopper/microvm/common.nix b/hosts/chopper/microvm/common.nix index fec1c8d..2bc14a4 100644 --- a/hosts/chopper/microvm/common.nix +++ b/hosts/chopper/microvm/common.nix @@ -44,10 +44,6 @@ ]; }; - users.users.root.openssh.authorizedKeys.keys = [ - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHD+tZ4hf4MhEW+akoZbXPN3Zi4cijSkQlX6bZlnV+Aq mhelton@gmail.com" - ]; - networking.useNetworkd = true; networking.useDHCP = false; systemd.network.networks."20-lan" = {