A new start

systems/x86_64-linux/sgx/default.nix

@@ -0,0 +1,55 @@
+{ pkgs, lib, config, ... }:
+{
+  imports = [
+    ./hardware-configuration.nix
+    ./fileserver.nix
+    ./backup.nix
+    ./network.nix
+  ];
+
+  sops.secrets.pccs.sopsFile = ../../../.secrets/sgx/pccs.yaml;
+  sops.secrets.backup-pw.sopsFile = ../../../.secrets/sgx/backup-s3.yaml;
+
+  metacfg = {
+    base.enable = true;
+    gui.enable = false;
+    nix-ld.enable = true;
+    nix.enable = true;
+    aesmd_dcap.enable = true;
+    pccs.enable = true;
+    pccs.secret = config.sops.secrets.pccs.path;
+    podman.enable = true;
+    secureboot.enable = true;
+    user.extraGroups = [ "docker" "sgx" ];
+  };
+
+  virtualisation = {
+    docker.enable = true;
+    libvirtd.enable = true;
+    podman.dockerCompat = false;
+  };
+  systemd.services.libvirt-guests.after = [ "network-online.target" ];
+
+  system.autoUpgrade = {
+    enable = true;
+    operation = "switch";
+    allowReboot = true;
+  };
+
+  services.pcscd.enable = true;
+
+  environment.etc."sgx_default_qcnl.conf".text = ''
+    {
+      "pccs_url": "https://127.0.0.1:8081/sgx/certification/v4/",
+      "use_secure_cert": false,
+      "collateral_service": "https://api.trustedservices.intel.com/sgx/certification/v4/",
+      "retry_times": 6,
+      "retry_delay": 10,
+      "pck_cache_expire_hours": 168,
+      "verify_collateral_cache_expire_hours": 168,
+      "local_cache_only": false
+    }
+  '';
+
+  system.stateVersion = "23.11";
+}