Merge branch 'main' of gh:greg-hellings/nixos-config
This commit is contained in:
Greg Hellings
@@ -43,6 +43,7 @@ in {
|
||||
icdm-root = unstable { name = "icdm-root"; };
|
||||
linode = machine { name = "linode"; };
|
||||
hosea = unstable { name = "hosea"; };
|
||||
jeremiah = unstable { name = "jeremiah"; };
|
||||
myself = unstable { name = "myself"; };
|
||||
iso = machine { name = "iso"; };
|
||||
iso-beta = unstable { name = "iso"; };
|
||||
|
||||
@@ -184,8 +184,8 @@ in {
|
||||
"98:da:c4:77:7f:4d,192.168.66.102"
|
||||
"8c:85:80:1c:f9:d1,192.168.66.104"
|
||||
"98:da:c4:77:82:7b,192.168.66.105"
|
||||
"0c:80:63:41:74:73,192.168.66.106"
|
||||
"98:da:c4:20:ea:db,192.168.66.107" # HS220 switch
|
||||
"0c:80:63:41:74:73,192.168.66.106" # Front hall light switch
|
||||
"98:da:c4:20:ea:db,192.168.66.107" # Parlor light switch
|
||||
"8c:49:62:aa:58:60,192.168.66.108" # Roku, HiHandsome
|
||||
"92:3e:11:c7:c5:be,192.168.66.109"
|
||||
"d8:0d:17:19:60:62,192.168.66.112"
|
||||
|
||||
@@ -31,13 +31,15 @@ in
|
||||
|
||||
networking = {
|
||||
hostName = "hosea";
|
||||
nameservers = [ "10.42.1.5" ];
|
||||
defaultGateway = "10.42.1.1";
|
||||
interfaces = {
|
||||
"${wanInterface}".useDHCP = true;
|
||||
"${lanInterface}" = {
|
||||
useDHCP = false;
|
||||
ipv4.addresses = [{
|
||||
address = lanIpAddress;
|
||||
prefixLength = 24;
|
||||
prefixLength = 16;
|
||||
}];
|
||||
};
|
||||
};
|
||||
|
||||
@@ -0,0 +1,22 @@
|
||||
# Edit this configuration file to define what should be installed on
|
||||
# your system. Help is available in the configuration.nix(5) man page
|
||||
# and in the NixOS manual (accessible by running ‘nixos-help’).
|
||||
|
||||
{ config, pkgs, ... }:
|
||||
|
||||
{
|
||||
imports =
|
||||
[ # Include the results of the hardware scan.
|
||||
./hardware-configuration.nix
|
||||
];
|
||||
|
||||
# Bootloader.
|
||||
boot.loader.systemd-boot.enable = true;
|
||||
boot.loader.efi.canTouchEfiVariables = true;
|
||||
|
||||
networking.hostName = "jeremiah"; # Define your hostname.
|
||||
greg = {
|
||||
home = true;
|
||||
tailscale.enable = true;
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,39 @@
|
||||
# Do not modify this file! It was generated by ‘nixos-generate-config’
|
||||
# and may be overwritten by future invocations. Please make changes
|
||||
# to /etc/nixos/configuration.nix instead.
|
||||
{ config, lib, pkgs, modulesPath, ... }:
|
||||
|
||||
{
|
||||
imports =
|
||||
[ (modulesPath + "/installer/scan/not-detected.nix")
|
||||
];
|
||||
|
||||
boot.initrd.availableKernelModules = [ "nvme" "xhci_pci" "ahci" "uas" "usbhid" "sd_mod" ];
|
||||
boot.initrd.kernelModules = [ ];
|
||||
boot.kernelModules = [ "kvm-amd" ];
|
||||
boot.extraModulePackages = [ ];
|
||||
|
||||
fileSystems."/" =
|
||||
{ device = "/dev/disk/by-uuid/ffc167f5-d9e4-4b11-a5f1-f7da0550ad24";
|
||||
fsType = "ext4";
|
||||
};
|
||||
|
||||
fileSystems."/boot" =
|
||||
{ device = "/dev/disk/by-uuid/3047-870E";
|
||||
fsType = "vfat";
|
||||
};
|
||||
|
||||
swapDevices = [ ];
|
||||
|
||||
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
|
||||
# (the default) this is the recommended approach. When using systemd-networkd it's
|
||||
# still possible to use this option, but it's recommended to use it in conjunction
|
||||
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
|
||||
networking.useDHCP = lib.mkDefault true;
|
||||
# networking.interfaces.enp67s0.useDHCP = lib.mkDefault true;
|
||||
# networking.interfaces.enp68s0.useDHCP = lib.mkDefault true;
|
||||
# networking.interfaces.wlo2.useDHCP = lib.mkDefault true;
|
||||
|
||||
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
|
||||
hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
|
||||
}
|
||||
@@ -51,6 +51,7 @@
|
||||
distrobox
|
||||
expect
|
||||
gimp
|
||||
go
|
||||
gparted
|
||||
gnucash
|
||||
graphviz
|
||||
|
||||
@@ -50,6 +50,12 @@ lib.attrsets.recursiveUpdate {
|
||||
|
||||
nixpkgs.config.allowUnfree = true;
|
||||
|
||||
users.users.gitlab-runner = {
|
||||
isSystemUser = true;
|
||||
group = "kvm";
|
||||
extraGroups = [ "kvm" ];
|
||||
};
|
||||
|
||||
services = {
|
||||
gitlab-runner = {
|
||||
enable = true;
|
||||
@@ -78,6 +84,15 @@ lib.attrsets.recursiveUpdate {
|
||||
"network-online.target"
|
||||
"systemd-resolved.service"
|
||||
];
|
||||
serviceConfig = {
|
||||
DevicePolicy = lib.mkForce "auto";
|
||||
PrivateDevices = false;
|
||||
ProtectKernelModules = false;
|
||||
DevicesAllow = [ "/dev/kvm" "/dev/mem" ];
|
||||
DynamicUser = lib.mkForce false;
|
||||
User = "root";
|
||||
Group = "kvm";
|
||||
};
|
||||
};
|
||||
|
||||
system.stateVersion = lib.mkForce "24.05";
|
||||
|
||||
+33
-42
@@ -39,55 +39,20 @@ in {
|
||||
};
|
||||
|
||||
systemd.services = {
|
||||
"container@gitlab-runner-qemu" = {
|
||||
# Now moved to a separate machine
|
||||
conflicts = [
|
||||
"container@gitlab-runner-vbox.service"
|
||||
];
|
||||
"gitlab-runner" = {
|
||||
serviceConfig = {
|
||||
DevicePolicy = lib.mkForce "auto";
|
||||
DevicesAllow = [ "/dev/kvm" "/dev/mem" ];
|
||||
EnvironmentFile = config.age.secrets.docker-auth.path;
|
||||
ExecStopPost = [ "${pkgs.kmod}/bin/rmmod kvm_amd kvm" ];
|
||||
ExecStartPre = [
|
||||
"${pkgs.kmod}/bin/modprobe kvm"
|
||||
"${pkgs.kmod}/bin/modprobe kvm_amd"
|
||||
"+${pkgs.kmod}/bin/modprobe kvm"
|
||||
"+${pkgs.kmod}/bin/modprobe kvm_amd"
|
||||
];
|
||||
PrivateDevices = false;
|
||||
ProtectKernelModules = false;
|
||||
};
|
||||
};
|
||||
gitlab-runner.serviceConfig.EnvironmentFile = config.age.secrets.docker-auth.path;
|
||||
};
|
||||
|
||||
#####################################################################################
|
||||
#################### QEmu Runner ####################################################
|
||||
#####################################################################################
|
||||
containers.gitlab-runner-qemu = container {
|
||||
autoStart = true;
|
||||
bindMounts = {
|
||||
"/dev/kvm" = {
|
||||
hostPath = "/dev/kvm";
|
||||
isReadOnly = false;
|
||||
};
|
||||
"/dev/mem" = {
|
||||
hostPath = "/dev/mem";
|
||||
isReadOnly = false;
|
||||
};
|
||||
};
|
||||
extraFlags = [
|
||||
"--property=DeviceAllow=/dev/kvm"
|
||||
];
|
||||
hostAddress = "192.168.201.1";
|
||||
localAddress = "192.168.201.2";
|
||||
config = ((import ./container-runner.nix) {
|
||||
inherit inputs overlays;
|
||||
name = "qemu";
|
||||
packages = with pkgs; [ qemu_full qemu_kvm ];
|
||||
extra = {
|
||||
virtualisation.libvirtd = {
|
||||
enable = true;
|
||||
onBoot = "ignore";
|
||||
package = pkgs.libvirt-greg;
|
||||
};
|
||||
};
|
||||
});
|
||||
};
|
||||
|
||||
#####################################################################################
|
||||
@@ -108,6 +73,7 @@ in {
|
||||
#####################################################################################
|
||||
age.secrets.runner-reg.file = ../../secrets/gitlab/myself-podman-runner-reg.age;
|
||||
age.secrets.docker-auth.file = ../../secrets/gitlab/docker-auth.age;
|
||||
age.secrets.runner-qemu.file = ../../secrets/gitlab/myself-qemu-runner-reg.age;
|
||||
services.gitlab-runner = {
|
||||
enable = true;
|
||||
settings = {
|
||||
@@ -144,10 +110,35 @@ in {
|
||||
"/cache"
|
||||
];
|
||||
};
|
||||
qemu = {
|
||||
executor = "shell";
|
||||
limit = 5;
|
||||
registrationConfigFile = config.age.secrets.runner-qemu.path;
|
||||
environmentVariables = {
|
||||
EFI_DIR = "${pkgs.OVMF.fd}/FV/";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
virtualisation = {
|
||||
docker.enable = true;
|
||||
oci-containers.backend = "docker";
|
||||
};
|
||||
environment.systemPackages = with pkgs; [
|
||||
curl
|
||||
gawk
|
||||
git
|
||||
p7zip
|
||||
packer
|
||||
pup
|
||||
(python3.withPackages (p: with p; [ pip pyyaml virtualenv ]) )
|
||||
qemu_full
|
||||
qemu_kvm
|
||||
shellcheck
|
||||
unzip
|
||||
xonsh
|
||||
xorriso
|
||||
vagrant
|
||||
wget
|
||||
];
|
||||
}
|
||||
|
||||
@@ -5,6 +5,8 @@ let
|
||||
conn = "postgresql:///dendrite?sslmode=disable&host=/run/postgresql";
|
||||
in
|
||||
{
|
||||
environment.systemPackages = with pkgs; [ upgrade-pg-cluster ];
|
||||
|
||||
greg.containers.matrix = {
|
||||
tailscale = true;
|
||||
subnet = "204";
|
||||
|
||||
Reference in New Issue
Block a user