wip rke2

modules/nixos/services/cloud-init/default.nix

@@ -0,0 +1,26 @@
+{ config, lib, namespace, ... }:
+let
+  inherit (lib) mkIf;
+
+  cfg = config.${namespace}.services.cloud-init;
+in
+{
+  options.${namespace}.services.cloud-init = {
+    enable = lib.mkEnableOption "Enable Cloud-Init";
+  };
+
+  config = mkIf cfg.enable {
+    services.cloud-init = {
+      enable = true;
+      network.enable = true;
+      settings = {
+        datasource_list = [ "NoCloud" ];
+        preserve_hostname = false;
+        system_info = {
+          distro = "nixos";
+          network.renderers = [ "networkd" ];
+        };
+      };
+    };
+  };
+}

modules/nixos/services/openiscsi/default.nix

@@ -0,0 +1,34 @@
+{ config, pkgs, lib, namespace, host, ... }:
+let
+  inherit (lib) types mkIf;
+  inherit (lib.${namespace}) mkOpt;
+
+  cfg = config.${namespace}.services.openiscsi;
+in
+{
+  options.${namespace}.services.openiscsi = {
+    enable = lib.mkEnableOption "Open iSCSI support";
+    name = mkOpt types.str "iqn.2025.reichard.io:${host}" "iSCSI name";
+    symlink = mkOpt types.bool false "Create a symlink to the iSCSI binaries";
+  };
+
+  config = mkIf cfg.enable {
+    boot.kernelModules = [ "iscsi_tcp" "libiscsi" "scsi_transport_iscsi" ];
+
+    services.openiscsi = {
+      enable = true;
+      name = cfg.name;
+    };
+
+    environment.systemPackages = with pkgs; [
+      openiscsi
+    ];
+
+    # Predominately used for RKE2 & Democratic CSI
+    system.activationScripts.iscsi-symlink = mkIf cfg.symlink ''
+      mkdir -p /usr/bin
+      ln -sf ${pkgs.openiscsi}/bin/iscsiadm /usr/bin/iscsiadm
+      ln -sf ${pkgs.openiscsi}/bin/iscsid /usr/bin/iscsid
+    '';
+  };
+}

modules/nixos/services/openssh/default.nix

@@ -1,4 +1,4 @@
-{ config, format, lib, namespace, ... }:
+{ config, lib, namespace, ... }:
 let
   inherit (lib)
     types
@@ -40,7 +40,7 @@ in
         AuthenticationMethods = "publickey";
         ChallengeResponseAuthentication = "no";
         PasswordAuthentication = false;
-        PermitRootLogin = if format == "install-iso" then "yes" else "no";
+        PermitRootLogin = "prohibit-password";
         PubkeyAuthentication = "yes";
         StreamLocalBindUnlink = "yes";
         UseDns = false;

modules/nixos/services/rke2/default.nix

@@ -0,0 +1,20 @@
+{ config, lib, namespace, ... }:
+let
+  inherit (lib) types mkIf;
+  inherit (lib.${namespace}) mkOpt;
+
+  cfg = config.${namespace}.services.rke2;
+in
+{
+  options.${namespace}.services.rke2 = with types; {
+    enable = lib.mkEnableOption "Enabel RKE2";
+    disable = mkOpt (listOf str) [ ] "Disable services";
+  };
+
+  config = mkIf cfg.enable {
+    services.rke2 = {
+      enable = true;
+      disable = cfg.disable;
+    };
+  };
+}