greg/nixos
1
0
Fork 1
Code Issues Pull Requests 2 Actions Packages Projects Releases Wiki Activity

Merge branch 'main' of gh:greg-hellings/nixos-config

Browse Source
This commit is contained in:
Greg Hellings
2024-04-19 21:57:13 -05:00
parent 3cc341c550 3e97731761
commit 025dbaf8af
20 changed files with 185 additions and 50 deletions
Download Patch File Download Diff File Expand all files Collapse all files
home/hosts/jeremiah/default.nix
+4
View File
@@ -0,0 +1,4 @@
{ pkgs, config, ... }:
{
}
home/hosts/jude/default.nix
+2
View File
@@ -11,4 +11,6 @@
greg.gui = true;
greg.sway = false;
greg.gnome = false;
programs.xonsh.sessionVariables.EFI_DIR = "${pkgs.OVMF.fd}/FV/";
}
home/ssh/authorized_keys
+1
View File
@@ -4,3 +4,4 @@ ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMYzms+KIe5/bYF3uCyFjA5e1AgMPLIA3c4k417coqBe
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINnRc/kBhxcjpUtiRQY+BXnSObdp0jFL1395wAQxJip7 greg@jude
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAl6DJVrPSujvJSAEA5Q8tRrzfJs/c6DMwqwQEUFffIR greg@myself
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGrqJQvDspLi1vXQRJ/Z5kN/F8jCBHvaXjo+5zLuIYjR greg@hosea
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIYIiecdyM9c7tXgR96983K3wqiJeQRMbrzGIF8Wy6uO greg@jeremiah
home/xonsh.nix
-2
View File
@@ -29,8 +29,6 @@
GOPATH = "${config.home.homeDirectory}/src/go";
GOBIN = "${config.home.homeDirectory}/src/bin";
EFI_DIR = lib.mkIf pkgs.stdenv.isLinux "${pkgs.OVMF.fd}/FV/";
};
aliases = {
hosts/default.nix
+1
View File
@@ -43,6 +43,7 @@ in {
icdm-root = unstable { name = "icdm-root"; };
linode = machine { name = "linode"; };
hosea = unstable { name = "hosea"; };
jeremiah = unstable { name = "jeremiah"; };
myself = unstable { name = "myself"; };
iso = machine { name = "iso"; };
iso-beta = unstable { name = "iso"; };
hosts/genesis/networking.nix
+2 -2
View File
@@ -184,8 +184,8 @@ in {
"98:da:c4:77:7f:4d,192.168.66.102"
"8c:85:80:1c:f9:d1,192.168.66.104"
"98:da:c4:77:82:7b,192.168.66.105"
"0c:80:63:41:74:73,192.168.66.106"
"98:da:c4:20:ea:db,192.168.66.107" # HS220 switch
"0c:80:63:41:74:73,192.168.66.106" # Front hall light switch
"98:da:c4:20:ea:db,192.168.66.107" # Parlor light switch
"8c:49:62:aa:58:60,192.168.66.108" # Roku, HiHandsome
"92:3e:11:c7:c5:be,192.168.66.109"
"d8:0d:17:19:60:62,192.168.66.112"
hosts/hosea/default.nix
+3 -1
View File
@@ -31,13 +31,15 @@ in
networking = {
hostName = "hosea";
nameservers = [ "10.42.1.5" ];
defaultGateway = "10.42.1.1";
interfaces = {
"${wanInterface}".useDHCP = true;
"${lanInterface}" = {
useDHCP = false;
ipv4.addresses = [{
address = lanIpAddress;
prefixLength = 24;
prefixLength = 16;
}];
};
};
hosts/jeremiah/default.nix
+22
View File
@@ -0,0 +1,22 @@
# Edit this configuration file to define what should be installed on
# your system. Help is available in the configuration.nix(5) man page
# and in the NixOS manual (accessible by running ‘nixos-help’).
{ config, pkgs, ... }:
{
imports =
[ # Include the results of the hardware scan.
./hardware-configuration.nix
];
# Bootloader.
boot.loader.systemd-boot.enable = true;
boot.loader.efi.canTouchEfiVariables = true;
networking.hostName = "jeremiah"; # Define your hostname.
greg = {
home = true;
tailscale.enable = true;
};
}
hosts/jeremiah/hardware-configuration.nix
+39
View File
@@ -0,0 +1,39 @@
# Do not modify this file! It was generated by ‘nixos-generate-config’
# and may be overwritten by future invocations. Please make changes
# to /etc/nixos/configuration.nix instead.
{ config, lib, pkgs, modulesPath, ... }:
{
imports =
[ (modulesPath + "/installer/scan/not-detected.nix")
];
boot.initrd.availableKernelModules = [ "nvme" "xhci_pci" "ahci" "uas" "usbhid" "sd_mod" ];
boot.initrd.kernelModules = [ ];
boot.kernelModules = [ "kvm-amd" ];
boot.extraModulePackages = [ ];
fileSystems."/" =
{ device = "/dev/disk/by-uuid/ffc167f5-d9e4-4b11-a5f1-f7da0550ad24";
fsType = "ext4";
};
fileSystems."/boot" =
{ device = "/dev/disk/by-uuid/3047-870E";
fsType = "vfat";
};
swapDevices = [ ];
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
# (the default) this is the recommended approach. When using systemd-networkd it's
# still possible to use this option, but it's recommended to use it in conjunction
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
networking.useDHCP = lib.mkDefault true;
# networking.interfaces.enp67s0.useDHCP = lib.mkDefault true;
# networking.interfaces.enp68s0.useDHCP = lib.mkDefault true;
# networking.interfaces.wlo2.useDHCP = lib.mkDefault true;
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
}
hosts/jude/default.nix
+1
View File
@@ -51,6 +51,7 @@
distrobox
expect
gimp
go
gparted
gnucash
graphviz
hosts/myself/container-runner.nix
+15
View File
@@ -50,6 +50,12 @@ lib.attrsets.recursiveUpdate {
nixpkgs.config.allowUnfree = true;
users.users.gitlab-runner = {
isSystemUser = true;
group = "kvm";
extraGroups = [ "kvm" ];
};
services = {
gitlab-runner = {
enable = true;
@@ -78,6 +84,15 @@ lib.attrsets.recursiveUpdate {
"network-online.target"
"systemd-resolved.service"
];
serviceConfig = {
DevicePolicy = lib.mkForce "auto";
PrivateDevices = false;
ProtectKernelModules = false;
DevicesAllow = [ "/dev/kvm" "/dev/mem" ];
DynamicUser = lib.mkForce false;
User = "root";
Group = "kvm";
};
};
system.stateVersion = lib.mkForce "24.05";
hosts/myself/git.nix
+33 -42
View File
@@ -39,55 +39,20 @@ in {
};
systemd.services = {
"container@gitlab-runner-qemu" = {
# Now moved to a separate machine
conflicts = [
"container@gitlab-runner-vbox.service"
];
"gitlab-runner" = {
serviceConfig = {
DevicePolicy = lib.mkForce "auto";
DevicesAllow = [ "/dev/kvm" "/dev/mem" ];
EnvironmentFile = config.age.secrets.docker-auth.path;
ExecStopPost = [ "${pkgs.kmod}/bin/rmmod kvm_amd kvm" ];
ExecStartPre = [
"${pkgs.kmod}/bin/modprobe kvm"
"${pkgs.kmod}/bin/modprobe kvm_amd"
"+${pkgs.kmod}/bin/modprobe kvm"
"+${pkgs.kmod}/bin/modprobe kvm_amd"
];
PrivateDevices = false;
ProtectKernelModules = false;
};
};
gitlab-runner.serviceConfig.EnvironmentFile = config.age.secrets.docker-auth.path;
};
#####################################################################################
#################### QEmu Runner ####################################################
#####################################################################################
containers.gitlab-runner-qemu = container {
autoStart = true;
bindMounts = {
"/dev/kvm" = {
hostPath = "/dev/kvm";
isReadOnly = false;
};
"/dev/mem" = {
hostPath = "/dev/mem";
isReadOnly = false;
};
};
extraFlags = [
"--property=DeviceAllow=/dev/kvm"
];
hostAddress = "192.168.201.1";
localAddress = "192.168.201.2";
config = ((import ./container-runner.nix) {
inherit inputs overlays;
name = "qemu";
packages = with pkgs; [ qemu_full qemu_kvm ];
extra = {
virtualisation.libvirtd = {
enable = true;
onBoot = "ignore";
package = pkgs.libvirt-greg;
};
};
});
};
#####################################################################################
@@ -108,6 +73,7 @@ in {
#####################################################################################
age.secrets.runner-reg.file = ../../secrets/gitlab/myself-podman-runner-reg.age;
age.secrets.docker-auth.file = ../../secrets/gitlab/docker-auth.age;
age.secrets.runner-qemu.file = ../../secrets/gitlab/myself-qemu-runner-reg.age;
services.gitlab-runner = {
enable = true;
settings = {
@@ -144,10 +110,35 @@ in {
"/cache"
];
};
qemu = {
executor = "shell";
limit = 5;
registrationConfigFile = config.age.secrets.runner-qemu.path;
environmentVariables = {
EFI_DIR = "${pkgs.OVMF.fd}/FV/";
};
};
};
};
virtualisation = {
docker.enable = true;
oci-containers.backend = "docker";
};
environment.systemPackages = with pkgs; [
curl
gawk
git
p7zip
packer
pup
(python3.withPackages (p: with p; [ pip pyyaml virtualenv ]) )
qemu_full
qemu_kvm
shellcheck
unzip
xonsh
xorriso
vagrant
wget
];
}
hosts/myself/matrix.nix
+2
View File
@@ -5,6 +5,8 @@ let
conn = "postgresql:///dendrite?sslmode=disable&host=/run/postgresql";
in
{
environment.systemPackages = with pkgs; [ upgrade-pg-cluster ];
greg.containers.matrix = {
tailscale = true;
subnet = "204";
modules/nixos/ceph.nix
+2
View File
@@ -0,0 +1,2 @@
# This is a good source for a Ceph dealio
# https://gist.github.com/nh2/13425a1f18b4c1ce82edb63c10b163c9
modules/nixos/db.nix
+1
View File
@@ -18,6 +18,7 @@ in {
services = {
postgresql = {
enable = true;
package = pkgs.postgresql_15;
checkConfig = true;
ensureDatabases = dbs;
ensureUsers = map (db: { name = db; ensureDBOwnership = true; }) dbs;
overlays/default.nix
+1
View File
@@ -60,6 +60,7 @@ in rec {
setup-ssh = prev.callPackage ./setup-ssh {
pkgs = final.pkgs;
};
upgrade-pg-cluster = prev.callPackage ./upgrade-pg-cluster.nix {};
# Overrides of packages
brew = prev.callPackage ./homebrew.nix {};
overlays/inject.nix
+30 -3
View File
@@ -17,13 +17,40 @@ ${git}/bin/git clone http://github.com/greg-hellings/nixos-config nixos
mkdir -p "/etc/nixos/hosts/''${hostname}"
# Prepares everything for the flake usage
cp /etc/nixos.bk/configuration.nix "/etc/nixos/hosts/''${hostname}/default.nix"
#cp /etc/nixos.bk/configuration.nix "/etc/nixos/hosts/''${hostname}/default.nix"
cat << EOF > "/etc/nixos/hosts/''${hostname}/default.nix"
{ pkgs, config, ... }:
{
imports = [ ./hardware-configuration.nix ];
boot.loader = {
systemd-boot.enable = true;
efi.canTouchEfiVariables = true;
};
networking.hostName = "''${hostname}";
greg = {
home = true;
tailscale.enable = true;
};
}
EOF
cp /etc/nixos.bk/hardware-configuration.nix "/etc/nixos/hosts/''${hostname}/hardware-configuration.nix"
# Prepare home-manager portion for setup
mkdir -p "/etc/nixos/home/hosts/''${hostname}"
cat << EOF > "/etc/nixos/home/hosts/''${hostname}/default.nix"
{ pkgs, config, ... }:
{
}
EOF
# Prepares it for injecting the use case into the flake usage
cp /etc/nixos.bk/hardware-configuration.nix /etc/nixos
chown -R greg nixos
echo "Now you should be able to just run 'nixos-rebuild switch' to enable the flake functionality"
echo "After that and adding the entry to the flake, run 'nixos-rebuild boot --flake '.#''${hostname}' and reboot"
echo "Now you should be able to just run `nixos-rebuild switch` to enable the flake functionality"
echo "After that and adding the entry to the flake, run `nixos-rebuild boot --flake '.#''${hostname}'` and reboot"
''
overlays/upgrade-pg-cluster.nix
+24
View File
@@ -0,0 +1,24 @@
{ postgresql_15, postgresql_14, writeScriptBin, ... }:
let
newPostgres = postgresql_15;
oldPostgres = postgresql_14;
in writeScriptBin "upgrade-pg-cluster" ''
set -eux
systemctl stop postgresql
export NEWDATA="/var/lib/postgresql/${newPostgres.psqlSchema}"
export NEWBIN="${newPostgres}/bin"
export OLDDATA="/var/lib/postgresql/${oldPostgres.psqlSchema}"
export OLDBIN="${oldPostgres}/bin"
install -d -m 0700 -o postgres -g postgres "$NEWDATA"
cd "$NEWDATA"
sudo -u postgres "$NEWBIN/initdb" -D "$NEWDATA"
sudo -u postgres "$NEWBIN/pg_upgrade" \
--old-datadir "$OLDDATA" --new-datadir "$NEWDATA" \
--old-bindir "$OLDBIN" --new-bindir "$NEWBIN" \
"$@"
''
secrets/gitlab/myself-qemu-runner-reg.age
BIN
View File
Binary file not shown.
secrets/secrets.nix
+2
View File
@@ -17,6 +17,7 @@ let
user_linode = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINAX6pNx5mbwIa8X+GzktyNijfYmJUpgROFpRxSW9js0 greg@linode";
user_myself = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAl6DJVrPSujvJSAEA5Q8tRrzfJs/c6DMwqwQEUFffIR greg@myself";
user_hosea = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGrqJQvDspLi1vXQRJ/Z5kN/F8jCBHvaXjo+5zLuIYjR greg@hosea";
user_jeremiah = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIYIiecdyM9c7tXgR96983K3wqiJeQRMbrzGIF8Wy6uO greg@jeremiah";
users = [
user_genesis_virt
@@ -25,6 +26,7 @@ let
user_linode
user_myself
user_hosea
user_jeremiah
];
everyone = systems ++ users;