Various changes, and added a live-disk config.

config/host-config/lambda.nix

@@ -5,13 +5,6 @@ let
   shinobi-od-port = "7082";
 
 in {
-  # TODO: remove?
-  nixpkgs.config.permittedInsecurePackages = [
-    "openssh-with-gssapi-8.4p1" # CVE-2021-28041
-  ];
-
-  fudo.slynk.enable = true;
-
   networking = {
     interfaces = {
       enp3s0f0.useDHCP = false;
@@ -23,19 +16,34 @@ in {
     };
   };
 
-  fudo.secrets.host-secrets.lambda = {
-    host-keytab = {
-      source-file = /state/secrets/kerberos/lambda.keytab;
-      target-file = "/etc/krb5.keytab";
-      user = "root";
+  fudo.secrets = {
+    host-secrets.lambda = {
+      host-keytab = {
+        source-file = /state/secrets/kerberos/lambda.keytab;
+        target-file = "/etc/krb5.keytab";
+        user = "root";
+      };
     };
+
+    secret-group = "fudo-secrets";
+    secret-users = [ "niten" ];
+    secret-paths = [ "/state/secrets" ];
   };
 
-  fudo.ipfs = {
-    enable = true;
-    users = [ "niten" ];
-    api-address = "/ip4/0.0.0.0/tcp/5001";
-  };
+  systemd.tmpfiles.rules = [
+    "L /root/.gnupg - - - - /state/root/gnupg"
+    # "L /root/.emacs.d - - - - /state/root/emacs.d"
+    "L /root/.ssh/id_rsa - - - - /state/root/ssh/id_rsa"
+    "L /root/.ssh/id_rsa.pub - - - - /state/root/ssh/id_rsa.pub"
+    "L /root/.ssh/known_hosts - - - - /state/root/ssh/known_hosts"
+    "L /etc/ssh/ssh_host_ed25519_key - - - - /state/ssh/ssh_host_ed25519_key"
+    "L /etc/ssh/ssh_host_rsa_key - - - - /state/ssh/ssh_host_rsa_key"
+  ];
+
+  security.sudo.extraConfig = ''
+    # Due to rollback, sudo will lecture after every reboot
+    Defaults lecture = never
+  '';
 
   virtualisation = {
     docker = {
@@ -50,10 +58,10 @@ in {
           image = "shinobisystems/shinobi:latest";
           ports = [ "${shinobi-port}:8080" ];
           volumes = [
-            "/srv/shinobi/plugins:/home/Shinobi/plugins"
-            "/srv/shinobi/config:/home/Shinobi/config"
-            "/srv/shinobi/videos:/home/Shinobi/videos"
-            "/srv/shinobi/db-data:/var/lib/mysql"
+            "/state/shinobi/plugins:/home/Shinobi/plugins"
+            "/state/shinobi/config:/home/Shinobi/config"
+            "/state/shinobi/videos:/home/Shinobi/videos"
+            "/state/shinobi/db-data:/var/lib/mysql"
             "/etc/localtime:/etc/localtime:ro"
           ];
         };