add turny

hosts/turny/configuration.nix

@@ -0,0 +1,98 @@
+# Edit this configuration file to define what should be installed on
+# your system.  Help is available in the configuration.nix(5) man page
+# and in the NixOS manual (accessible by running `nixos-help`).
+
+{
+  pkgs,
+  ssh,
+  config,
+  inputs,
+  ...
+}:
+let
+  secrets = config.age.secrets;
+in
+{
+  nix = {
+    settings = {
+      experimental-features = [
+        "nix-command"
+        "flakes"
+      ];
+      auto-optimise-store = true;
+    };
+    gc = {
+      automatic = true;
+      dates = "weekly";
+      options = "--delete-older-than 30d";
+    };
+  };
+
+  networking = {
+    hostName = "turny"; # Define your hostname.
+    useDHCP = true;
+    useNetworkd = true;
+    nftables.enable = true;
+    wireless = {
+      enable = true;
+      networks = {
+        KotiWLANi.pskRaw = "ext:psk_kotiwlani";
+      };
+      secretsFile = secrets.wpa_supplicant.path;
+    };
+  };
+
+  services.avahi = {
+    publish.enable = true;
+  };
+
+  services.tailscale = {
+    enable = true;
+    useRoutingFeatures = "client";
+  };
+
+  # Set your time zone.
+  time.timeZone = "Europe/Helsinki";
+
+  # Select internationalisation properties.
+  i18n.defaultLocale = "en_US.UTF-8";
+
+  # Define a user account. Don't forget to set a password with ‘passwd’.
+  users.users.jokke = {
+    isNormalUser = true;
+    extraGroups = [ "wheel" ]; # Enable ‘sudo’ for the user.
+    packages = [ pkgs.nh ];
+    openssh.authorizedKeys.keys = [ ssh.publicKeys.yubikey ];
+    initialPassword = "changeme";
+  };
+  users.users.root.openssh.authorizedKeys.keys = [ ssh.publicKeys.yubikey ];
+
+  nix.settings.trusted-users = [ "jokke" ];
+
+  environment.systemPackages = with pkgs; [
+    vim
+    wget
+    htop
+    git
+    inputs.turny.packages.${stdenv.hostPlatform.system}.default
+  ];
+
+  # Enable the OpenSSH daemon.
+  services.openssh = {
+    enable = true;
+    settings.PasswordAuthentication = false;
+  };
+
+  modules.firewall = {
+    enable = true;
+    allInterfaces = [ "ssh" ];
+  };
+
+  # This value determines the NixOS release from which the default
+  # settings for stateful data, like file locations and database versions
+  # on your system were taken. It's perfectly fine and recommended to leave
+  # this value at the release version of the first install of this system.
+  # Before changing this value read the documentation for this option
+  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
+  system.stateVersion = "25.05"; # Did you read the comment?
+}

hosts/turny/default.nix

@@ -0,0 +1,9 @@
+{ inputs, ... }:
+{
+  imports = [
+    ./hardware-configuration.nix
+    ./configuration.nix
+    ./secrets.nix
+    inputs.nixos-hardware.nixosModules.raspberry-pi-3
+  ];
+}

hosts/turny/hardware-configuration.nix

@@ -0,0 +1,4 @@
+{ lib, ... }:
+{
+  nixpkgs.hostPlatform = lib.mkDefault "aarch64-linux";
+}

hosts/turny/secrets.nix

@@ -0,0 +1,15 @@
+{ lib, ... }:
+{
+  age.secrets = lib.listToAttrs (
+    map
+      (secret: {
+        name = secret;
+        value = {
+          file = ../../secrets/${secret}.age;
+        };
+      })
+      [
+        "wpa_supplicant"
+      ]
+  );
+}