greg/nixos
1
0
Fork 1
Code Issues Pull Requests 2 Actions Packages Projects Releases Wiki Activity

Merge branch 'main' of 10.42.4.3:greg/nixos-config

Browse Source
This commit is contained in:
Greg Hellings
2025-06-05 13:25:38 -05:00
parent 24d1247a79 ec06d665cd
commit 021aea0643
73 changed files with 14236 additions and 426 deletions
Download Patch File Download Diff File Expand all files Collapse all files
hosts/exodus/default.nix
+2
View File
@@ -55,4 +55,6 @@
virtualisation = {
oci-containers.backend = "podman";
};
users.users.greg.extraGroups = [ "podman" ];
}
hosts/genesis/acme.nix
-75
View File
@@ -1,75 +0,0 @@
{
pkgs,
config,
lib,
...
}:
let
address = (builtins.elemAt config.networking.interfaces.ens18.ipv4.addresses 0).address;
root_ca = pkgs.writeText "root_ca.crt" (builtins.readFile ../../ca/root_ca.crt);
intermediate_ca = pkgs.writeText "intermediate_ca.crt" (
builtins.readFile ../../ca/intermediate_ca.crt
);
in
{
age.secrets.acme_password = {
file = ../../secrets/acme_password.age;
};
age.secrets.intermediate_ca_key = {
file = ../../secrets/ca/intermediate_key.age;
};
age.secrets.root_ca_key.file = ../../secrets/ca/root_key.age;
systemd.services.step-ca.serviceConfig.Environment = lib.mkForce [
"STEPDEBUG=1"
"HOME=%S/step-ca"
];
services.step-ca = {
inherit address;
enable = false;
intermediatePasswordFile = config.age.secrets.acme_password.path;
openFirewall = true;
port = 8443;
settings = {
root = root_ca;
federatedRoots = null;
cert = intermediate_ca;
key = config.age.secrets.intermediate_ca_key.path;
dnsNames = [
"10.42.1.5"
"acme.thehellings.lan"
];
logger.format = "text";
db = {
type = "badgerv2";
dataSource = "/var/lib/step-ca/db";
badgerFileLoadingMode = "";
};
authority.provisioners = [
{
type = "JWK";
name = "greg@thehellings.com";
key = {
use = "sig";
kty = "EC";
kid = "1GOpOttYLZtx7XiG79ZycbGcG4ptL0czfohK35SZOEI";
crv = "P-256";
alg = "ES256";
x = "YEWVj5CCoqWQXWqmL0UuORlFY9IEOLcg1jpG1o-wGx4";
y = "MEpqnJp60VV-SpFtb6m8U-VAYut7R_PKFm07xl7MjBk";
};
encryptedKey = "eyJhbGciOiJQQkVTMi1IUzI1NitBMTI4S1ciLCJjdHkiOiJqd2sranNvbiIsImVuYyI6IkEyNTZHQ00iLCJwMmMiOjYwMDAwMCwicDJzIjoieWdfb0lfbWgwbHhPRXdjUTBsd0FnUSJ9.ivdQUFEhs2U8PUBYr8AhQl3hHdb4spF4jvXgqY_hiVgpjB-z3Nn9Uw.u7vrNht_3WD1G97q.mbydlpAQxjtKLkOmmDOUczqscRDPqrUyoPJ1uqXcJDH3vs4KiYlrKRcFLjPy9sWzEL1iIrqjwf3U-3AAx1KNAg7frs2D__MGfOO-U5SdQDVJVAND7KpWOJGJVSb0xioCA6-8ldlP_REqu4ENmkkdw0_6Is2b0p7ZFKqke_fqOOs7osqFAfbMb_WzEWrACLn5A5-Teh2rpEgR-z9zipN6MSEqE6VIQ2BXuv70aHWhslNe1MK1OgTYm9CqA47EMYvQ7HQLPDZAbP56WK84yJLktoXMmnkaKeTtvER0dh4ufyjJHBhecnEranbR5rHc_jV8_qvyWhlqbCrOU_8bWrk.a9SH_q3GKIUsOUSRWkDxQg";
}
];
tls = {
cipherSuites = [
"TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256"
"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256"
];
minVersion = 1.2;
maxVersion = 1.3;
renegotiation = false;
};
};
};
}
hosts/genesis/default.nix
-17
View File
@@ -7,12 +7,10 @@
let
dashy_port = "8080";
speedtest_port = "19472";
uptime_kuma_port = "4000";
in
{
imports = [
# Include the results of the hardware scan.
./acme.nix
./hardware-configuration.nix
./home-assistant.nix
./networking.nix
@@ -25,7 +23,6 @@ in
"speed.home".target = "http://localhost:${speedtest_port}";
"speedtest.thehellings.lan".target = "http://localhost:${speedtest_port}";
"dashy.home".target = "http://localhost:${dashy_port}";
"uptime.home".target = "http://localhost:${uptime_kuma_port}";
};
};
@@ -36,14 +33,6 @@ in
useOSProber = true;
};
#boot.loader = {
# systemd-boot.enable = true;
# efi = {
# canTouchEfiVariables = true;
# efiSysMountPoint = "/boot/efi";
# };
#};
environment.systemPackages = with pkgs; [
awscli2
create_ssl
@@ -139,12 +128,6 @@ in
];
};
};
uptime-kuma = {
enable = true;
settings = {
PORT = uptime_kuma_port;
};
};
};
virtualisation.oci-containers.containers = {
hosts/genesis/net/hosts
+4 -2
View File
@@ -13,6 +13,8 @@
10.42.1.7 hosea hosea.thehellings.lan
10.42.1.8 jeremiah jeremiah.thehellings.lan minio-02.thehellings.lan
10.42.1.9 ivr ivr.thehellings.lan
10.42.1.10 jude jude.thehellings.lan
10.42.1.11 jude1 jude1.thehellings.lan
10.42.1.12 tv
# VMs
@@ -30,8 +32,8 @@
100.88.91.27 genesis.home smart.home zwave.home nixcache.home gitcache.home dashy.home uptime.home speed.home
100.91.131.66 gitlab.home gitlab.shire-zebra.ts.net gitlab.thehellings.lan registry.thehellings.lan git.thehellings.lan
100.68.203.1 hosea.home hosea.shire-zebra.ts.net
100.84.183.79 isaiah.home isaiah.shire-zebra.ts.net
100.102.186.39 jeremiah.home jeremiah.shire-zebra.ts.net
100.84.183.79 isaiah.home isaiah.shire-zebra.ts.net pgadmin.kubernetes postgres.kubernetes
100.102.186.39 jeremiah.home jeremiah.shire-zebra.ts.net matrix.kubernetes
100.90.74.19 jude.home
100.115.57.8 linode.home
100.65.5.38 matrix.home matrix.shire-zebra.ts.net
hosts/genesis/networking/dhcp.nix
+8
View File
@@ -101,6 +101,14 @@
hw-address = "c8:5e:a9:54:9e:c6"; # IVR laptop Wi-Fi
ip-address = "10.42.1.9";
}
{
hw-address = "c8:4b:d6:ca:20:8f";
ip-address = "10.42.1.10"; # Jude - but maybe through the monitor?
}
{
hw-address = "04:7c:16:d5:60:6f";
ip-address = "10.42.1.11"; # Jude - but straight in the motherboard
}
########################################
# VM servers #
hosts/isaiah/default.nix
+3 -32
View File
@@ -11,9 +11,7 @@
];
age.secrets = {
runner-reg.file = ../../secrets/gitlab/isaiah-podman-runner-reg.age;
docker-auth.file = ../../secrets/gitlab/docker-auth.age;
runner-qemu.file = ../../secrets/gitlab/isaiah-qemu-runner-reg.age;
runner-reg.file = ../../secrets/gitlab/kubernetes-k3s-local.age;
};
boot = {
@@ -83,31 +81,9 @@
concurrent = 5;
};
services = {
default = {
executor = "docker";
kubernetes = {
authenticationTokenConfigFile = config.age.secrets.runner-reg.path;
dockerImage = "gitlab.shire-zebra.ts.net:5000/greg/ci-images/fedora:latest";
dockerAllowedImages = [
"alpine:*"
"debian:*"
"docker:*"
"fedora:*"
"python:*"
"ubuntu:*"
"registry.gitlab.com/gitlab-org/*"
"registry.thehellings.com/*/*/*:*"
"gitlab.shire-zebra.ts.net:5000/*/*/*:*"
];
dockerAllowedServices = [
"docker:*"
"registry.thehellings.com/*/*/*:*"
"gitlab.shire-zebra.ts.net:5000/*/*/*:*"
];
dockerPrivileged = true;
dockerVolumes = [
"/certs/client"
"/cache"
];
executor = "shell";
};
};
};
@@ -118,11 +94,6 @@
};
};
systemd.services.gitlab-runner = {
after = [ "network-online.target" ];
requires = [ "network-online.target" ];
};
virtualisation = {
libvirtd = {
enable = true;
hosts/jeremiah/default.nix
+1 -1
View File
@@ -106,7 +106,7 @@ in
#####################################################################################
#################### Virtualbox Runner ##############################################
#####################################################################################
age.secrets.runner-reg.file = ../../secrets/gitlab/jeremiah-runner-reg.age;
age.secrets.runner-reg.file = ../../secrets/gitlab/nixos-qemu-shell.age;
services = {
gitlab-runner = {
hosts/jude/default.nix
+34 -2
View File
@@ -93,7 +93,32 @@
hostName = "jude";
networkmanager.enable = lib.mkForce true;
enableIPv6 = false;
interfaces.enp12s0.useDHCP = true;
useDHCP = false;
interfaces = {
# This seems to be direct mother board interface
enp12s0.useDHCP = true;
#enp12s0.ipv4.addresses = [
#{
#address = "10.42.1.11";
#prefixLength = 16;
#}
#];
# This seems to be the one that comes through the monitor hookup
enp14s0u1u2.ipv4.addresses = [
{
address = "10.42.1.10";
prefixLength = 16;
}
];
};
defaultGateway = {
address = "10.42.1.1";
interface = "enp14s0u1u2";
};
nameservers = [
"10.42.1.5"
"10.42.1.1"
];
firewall = {
enable = false;
allowedTCPPorts = [ 21000 ];
@@ -118,7 +143,14 @@
# Let's do a sound thing
services = {
k3s.extraFlags = [ "--tls-san 10.42.0.6" ];
k3s.extraFlags =
let
ip = (builtins.head config.networking.interfaces.enp14s0u1u2.ipv4.addresses).address;
in
[
"--tls-san ${ip}"
#"--bind-address ${ip}"
];
pipewire = {
enable = true;
alsa.enable = true;
hosts/jude/virt.nix
+49 -18
View File
@@ -6,6 +6,10 @@
}:
let
environmentVariables = {
EFI_DIR = "${pkgs.OVMF.fd}/FV/";
STORAGE_URL = "s3.thehellings.lan:9000";
};
passthru = [
"1002:164e" # Raphael - embedded GPU
"1002:1640" # Rembrandt - Audio
@@ -14,9 +18,46 @@ let
];
in
{
greg.vmdev.enable = true;
specialisation = {
vbox.configuration = {
age.secrets.runner-reg.file = ../../secrets/gitlab/isaiah-vbox-runner-reg.age;
greg = {
podman.enable = lib.mkForce false;
vmdev.enable = lib.mkForce false;
};
users.extraGroups.vboxusers.members = [ "greg" ];
virtualisation = {
virtualbox.host = {
enable = true;
enableExtensionPack = true;
};
};
services.gitlab-runner.services = lib.mkForce {
vbox = {
inherit environmentVariables;
authenticationTokenConfigFile = config.age.secrets.vbox.path;
executor = "shell";
limit = 5;
};
};
systemd.services.gitlab-runner = {
serviceConfig = {
DevicePolicy = lib.mkForce "auto";
User = "root";
DynamicUser = lib.mkForce false;
};
};
};
};
age.secrets = {
qemu.file = ../../secrets/gitlab/nixos-qemu-shell.age;
vbox.file = ../../secrets/gitlab/nixos-vbox-shell.age;
};
# These options enable sharing of the GPU with the VM
boot = {
@@ -39,33 +80,23 @@ in
("vfio-pci.ids=" + (lib.concatStringsSep "," passthru))
];
};
greg.vmdev.enable = true;
hardware.graphics.enable = true;
services.gitlab-runner = {
enable = true;
settings.concurrent = 5;
services.vbox = {
services.qemu = {
inherit environmentVariables;
executor = "shell";
limit = 5;
authenticationTokenConfigFile = config.age.secrets.runner-reg.path;
environmentVariables = {
EFI_DIR = "${pkgs.OVMF.fd}/FV/";
};
authenticationTokenConfigFile = config.age.secrets.qemu.path;
};
};
systemd.services = {
gitlab-runner = {
conflicts = [ "libvirtd.service" ];
preStart = builtins.concatStringsSep "\n" [
"${pkgs.kmod}/bin/modprobe vboxnetflt vboxdrv"
"${pkgs.kmod}/bin/modprobe vboxnetadp"
];
postStop = "${pkgs.kmod}/bin/rmmod vboxnetflt vboxnetadp vboxdrv";
wantedBy = pkgs.lib.mkForce [ ];
serviceConfig.User = "root";
};
"libvirt-nosleep@" = {
description = "Prevent sleep while %i is running";
serviceConfig = {
hosts/linode/matrix.nix
+10 -2
View File
@@ -14,7 +14,6 @@ in
"${domain}" = {
enableACME = true;
forceSSL = true;
# This is needed so that servers contacting hellings.com can find
# the actual application server at matrix.thehellings.com
locations."= /.well-known/matrix/server".extraConfig =
@@ -51,11 +50,20 @@ in
enableACME = true;
forceSSL = true;
extraConfig = ''
error_log /var/log/nginx/debug.log debug;
'';
# Not the appropriate place for the chat client
locations =
(builtins.listToAttrs (
builtins.map
(val: lib.nameValuePair "/_${val}" { proxyPass = "http://matrix.shire-zebra.ts.net:8448"; })
(
val:
lib.nameValuePair "/_${val}" {
proxyPass = "http://matrix.kubernetes";
}
)
[
"matrix"
"synapse"
hosts/proxmoxtemplate/default.nix
+12 -8
View File
@@ -2,13 +2,13 @@
# your system. Help is available in the configuration.nix(5) man page
# and in the NixOS manual (accessible by running ‘nixos-help’).
{ config, pkgs, ... }:
{ pkgs, ... }:
{
imports =
[ # Include the results of the hardware scan.
./hardware-configuration.nix
];
imports = [
# Include the results of the hardware scan.
./hardware-configuration.nix
];
# Bootloader.
boot.loader = {
@@ -16,8 +16,10 @@
efi.canTouchEfiVariables = true;
};
environment.systemPackages = with pkgs; [
];
environment.systemPackages =
with pkgs;
[
];
greg = {
home = true;
@@ -43,6 +45,8 @@
nameservers = [ "10.42.1.5" ];
};
services.qemuGuest.enable = true;
system.stateVersion = "24.11"; # Did you read the comment?
# Define a user account. Don't forget to set a password with ‘passwd’.
@@ -50,6 +54,6 @@
isNormalUser = true;
description = "Greg Hellings";
extraGroups = [ "wheel" ];
packages = with pkgs; [];
packages = with pkgs; [ ];
};
}
hosts/proxmoxtemplate/hardware-configuration.nix
+29 -14
View File
@@ -1,28 +1,43 @@
# Do not modify this file! It was generated by ‘nixos-generate-config’
# and may be overwritten by future invocations. Please make changes
# to /etc/nixos/configuration.nix instead.
{ config, lib, pkgs, modulesPath, ... }:
{
lib,
modulesPath,
...
}:
{
imports =
[ (modulesPath + "/profiles/qemu-guest.nix")
];
imports = [
(modulesPath + "/profiles/qemu-guest.nix")
];
boot.initrd.availableKernelModules = [ "uhci_hcd" "ehci_pci" "ahci" "virtio_pci" "virtio_scsi" "sd_mod" "sr_mod" ];
boot.initrd.availableKernelModules = [
"uhci_hcd"
"ehci_pci"
"ahci"
"virtio_pci"
"virtio_scsi"
"sd_mod"
"sr_mod"
];
boot.initrd.kernelModules = [ ];
boot.kernelModules = [ ];
boot.extraModulePackages = [ ];
fileSystems."/" =
{ device = "/dev/disk/by-uuid/507251f1-efe7-448d-8de8-91ee582a9afb";
fsType = "ext4";
};
fileSystems."/" = {
device = "/dev/disk/by-uuid/507251f1-efe7-448d-8de8-91ee582a9afb";
fsType = "ext4";
};
fileSystems."/boot" =
{ device = "/dev/disk/by-uuid/7115-EFA6";
fsType = "vfat";
options = [ "fmask=0077" "dmask=0077" ];
};
fileSystems."/boot" = {
device = "/dev/disk/by-uuid/7115-EFA6";
fsType = "vfat";
options = [
"fmask=0077"
"dmask=0077"
];
};
swapDevices = [ ];
hosts/vm-gitlab/default.nix
+12 -7
View File
@@ -15,10 +15,10 @@ let
containerIp = "192.168.200.2";
in
{
imports =
[ # Include the results of the hardware scan.
./hardware-configuration.nix
];
imports = [
# Include the results of the hardware scan.
./hardware-configuration.nix
];
age.secrets =
let
@@ -36,6 +36,9 @@ in
gitlab-jws = cfg "jws";
gitlab-key = cfg "key";
gitlab-cert = cfg "cert";
gitlab-salt = cfg "salt";
gitlab-primary-key = cfg "primary-key";
gitlab-deterministic-key = cfg "deterministic-key";
minio_access_key_id = {
file = ../../secrets/minio_access_key_id.age;
@@ -79,7 +82,6 @@ in
tailscale.enable = true;
};
networking = {
hostName = "vm-gitlab"; # Define your hostname.
firewall.allowedTCPPorts = [
@@ -134,10 +136,13 @@ in
externalPort = 443;
};
secrets = {
secretFile = config.age.secrets.gitlab-secret.path;
otpFile = config.age.secrets.gitlab-otp.path;
activeRecordDeterministicKeyFile = config.age.secrets.gitlab-deterministic-key.path;
activeRecordPrimaryKeyFile = config.age.secrets.gitlab-primary-key.path;
activeRecordSaltFile = config.age.secrets.gitlab-salt.path;
dbFile = config.age.secrets.gitlab-db.path;
jwsFile = config.age.secrets.gitlab-jws.path;
otpFile = config.age.secrets.gitlab-otp.path;
secretFile = config.age.secrets.gitlab-secret.path;
};
extraConfig = {
hosts/vm-gitlab/hardware-configuration.nix
+29 -14
View File
@@ -1,18 +1,30 @@
# Do not modify this file! It was generated by ‘nixos-generate-config’
# and may be overwritten by future invocations. Please make changes
# to /etc/nixos/configuration.nix instead.
{ config, lib, pkgs, modulesPath, ... }:
{
lib,
modulesPath,
...
}:
{
imports =
[ (modulesPath + "/profiles/qemu-guest.nix")
];
imports = [
(modulesPath + "/profiles/qemu-guest.nix")
];
# Bootloader.
boot = {
extraModulePackages = [ ];
initrd = {
availableKernelModules = [ "uhci_hcd" "ehci_pci" "ahci" "virtio_pci" "virtio_scsi" "sd_mod" "sr_mod" ];
availableKernelModules = [
"uhci_hcd"
"ehci_pci"
"ahci"
"virtio_pci"
"virtio_scsi"
"sd_mod"
"sr_mod"
];
kernelModules = [ ];
};
loader = {
@@ -21,16 +33,19 @@
};
};
fileSystems."/" =
{ device = "/dev/disk/by-uuid/507251f1-efe7-448d-8de8-91ee582a9afb";
fsType = "ext4";
};
fileSystems."/" = {
device = "/dev/disk/by-uuid/507251f1-efe7-448d-8de8-91ee582a9afb";
fsType = "ext4";
};
fileSystems."/boot" =
{ device = "/dev/disk/by-uuid/7115-EFA6";
fsType = "vfat";
options = [ "fmask=0077" "dmask=0077" ];
};
fileSystems."/boot" = {
device = "/dev/disk/by-uuid/7115-EFA6";
fsType = "vfat";
options = [
"fmask=0077"
"dmask=0077"
];
};
swapDevices = [ ];
hosts/vm-jellyfin/hardware-configuration.nix
+29 -14
View File
@@ -1,28 +1,43 @@
# Do not modify this file! It was generated by ‘nixos-generate-config’
# and may be overwritten by future invocations. Please make changes
# to /etc/nixos/configuration.nix instead.
{ config, lib, pkgs, modulesPath, ... }:
{
lib,
modulesPath,
...
}:
{
imports =
[ (modulesPath + "/profiles/qemu-guest.nix")
];
imports = [
(modulesPath + "/profiles/qemu-guest.nix")
];
boot.initrd.availableKernelModules = [ "uhci_hcd" "ehci_pci" "ahci" "virtio_pci" "virtio_scsi" "sd_mod" "sr_mod" ];
boot.initrd.availableKernelModules = [
"uhci_hcd"
"ehci_pci"
"ahci"
"virtio_pci"
"virtio_scsi"
"sd_mod"
"sr_mod"
];
boot.initrd.kernelModules = [ ];
boot.kernelModules = [ ];
boot.extraModulePackages = [ ];
fileSystems."/" =
{ device = "/dev/disk/by-uuid/507251f1-efe7-448d-8de8-91ee582a9afb";
fsType = "ext4";
};
fileSystems."/" = {
device = "/dev/disk/by-uuid/507251f1-efe7-448d-8de8-91ee582a9afb";
fsType = "ext4";
};
fileSystems."/boot" =
{ device = "/dev/disk/by-uuid/7115-EFA6";
fsType = "vfat";
options = [ "fmask=0077" "dmask=0077" ];
};
fileSystems."/boot" = {
device = "/dev/disk/by-uuid/7115-EFA6";
fsType = "vfat";
options = [
"fmask=0077"
"dmask=0077"
];
};
swapDevices = [ ];