2maccabees setup

DNS setup with dnsmasq
DHCP setup with dnsmasq
Home Assistant setup

hosts/2maccabees/default.nix

@@ -0,0 +1,13 @@
+{ config, pkgs, ... }:
+
+{
+  imports = [
+    ./networking.nix
+    ./dnsmasq.nix
+	./home-assistant.nix
+    ../profiles/rpi4.nix
+	../profiles/home.nix
+  ];
+  networking.hostName = "2maccabees";
+  networking.domain = "home.thehellings.com";
+}

hosts/2maccabees/dnsmasq.nix

@@ -0,0 +1,65 @@
+{ config, pkgs, ... }:
+
+let
+	extraHosts = builtins.concatStringsSep "\n" [
+		"10.42.0.1 switch"
+		"10.42.1.1 router"
+		"10.42.1.2 dns smart"
+		"10.42.1.3 printer"
+		"10.42.1.4 chronicles"
+		"10.42.1.12 tv"
+	];
+
+	extraConfig = builtins.concatStringsSep "\n" [
+		"expand-hosts"
+		"domain=thehellings.lan"
+		"log-dhcp"
+		"log-queries"
+		"addn-hosts=/etc/adblock_hosts"
+
+#		"dhcp-range=eth0,10.42.0.1,10.42.1.255,255.255.0.0,static"
+		"dhcp-range=eth0,10.42.2.1,10.42.2.255,255.255.0.0,12h"
+		"dhcp-option=eth0,option:router,10.42.1.1"
+		"dhcp-option=eth0,option:dns-server,10.42.1.2"
+		"dhcp-option=eth0,option:domain-search,thehellings.lan"
+
+		"dhcp-range=vlan66@eth0,192.168.66.3,192.168.66.150,255.255.255.0,12h"
+		"dhcp-option=vlan66@eth0,option:router,192.168.66.1"
+		"dhcp-option=vlan66@eth0,option:dns-server,192.168.66.2"
+
+		"dhcp-range=vlan67@eth0,192.168.67.3,192.168.67.150,12h"
+		"dhcp-option=vlan67@eth0,option:router,192.168.67.1"
+		"dhcp-option=vlan67@eth0,option:dns-server,192.168.67.2"
+	];
+in
+{
+	# Enable the service with its own configuration
+	services.dnsmasq = {
+		enable = true;
+		# Public AdGuard DNS servers
+		servers = [
+			"94.140.14.14"
+			"94.140.15.15"
+		];
+		extraConfig = "${extraConfig}";
+	};
+	environment.systemPackages = [ pkgs.curl ];
+
+	# Regularly update DNS block list
+	services.cron = {
+		enable = true;
+		systemCronJobs = [
+			"* * * * * root ( ${pkgs.curl}/bin/curl -s https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts | sed '1,33d' > /etc/adblock_hosts && systemctl restart dnsmasq ) 2>&1 > /var/log/adblock.log"
+		];
+	};
+
+	# Allow traffic through
+	networking.firewall = {
+		enable = true;
+		allowedTCPPorts = [ 53 ];
+		allowedUDPPorts = [ 53 67 ];
+	};
+
+	# Custom host addition
+	networking.extraHosts = "${extraHosts}";
+}

hosts/2maccabees/home-assistant.nix

@@ -0,0 +1,94 @@
+{ config, pkgs, ... }:
+
+let
+	#unstable-src = builtins.fetchTarball "https://github.com/NixOS/nixpkgs/archive/nixos-unstable.tar.gz";
+	#unstable = import unstable-src {};
+	unstable = import <nixos-unstable> {};
+in
+{
+	#services.home-assistant = {
+	#	enable = true;
+	#	applyDefaultConfig = true;
+	#	configWritable = true;
+	#	configDir = "/var/lib/hass";
+	#	config = {
+	#		default_config = {};
+	#		met = {};
+	#		frontend = {};
+	#		http = {
+	#			use_x_forwarded_for = true;
+	#			trusted_proxies = [ "127.0.0.1" "::1" ];
+	#		};
+	#		"map" = {};
+	#		cloud = {};
+	#		mobile_app = {};
+	#	};
+
+	#	package = (unstable.home-assistant.override {
+	#		extraComponents = [
+	#			"accuweather"
+	#			"cast"
+	#			"cloud"
+	#			"default_config"
+	#			"esphome"
+	#			"google"
+	#			"google_assistant"
+	#			"roomba"
+	#			"synology_dsm"
+	#			"tplink"
+	#			"wiz"
+	#			"zwave_js"
+	#		];
+	#		extraPackages = py: with unstable.python39Packages; [
+	#			ifaddr
+	#		];
+	#	}).overrideAttrs (oldAttrs: {
+	#		doInstallCheck = false;
+	#	});
+	#	openFirewall = true;
+	#};
+
+	virtualisation.podman.enable = true;
+
+	virtualisation.oci-containers = {
+		backend = "podman";
+		containers."home-assistant" = {
+			image = "ghcr.io/home-assistant/home-assistant:stable";
+			ports = [ "127.0.0.1:8123:8123" ];
+			volumes = [ "/var/lib/hass:/config" ];
+			extraOptions = [
+				"--network" "podman"
+				"--network" "podman66:ip=192.168.66.193"
+			];
+		};
+	};
+
+	#systemd.services.podman66 = {
+		#wantedBy = [ "podman-home-assistant.service" ];
+		#serviceConfig = {
+			#Type = "oneshot";
+			#ExecStart = ''
+				#${pkgs.podman}/bin/podman network create -d macvlan -o parent=vlan66 --subnet 192.168.66.0/24 --ip-range 192.168.66.192/26 --gateway 192.168.66.1 podman66 || true
+			#'';
+		#};
+	#};
+
+	services.nginx = {
+		enable= true;
+		virtualHosts."smart.thehellings.lan".locations."/" = {
+			proxyPass = "http://127.0.0.1:8123";
+			extraConfig = ''
+				proxy_set_header Host $host;
+				proxy_http_version 1.1;
+				proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+				proxy_set_header Upgrade $http_upgrade;
+				proxy_set_header Connection $connection_upgrade;
+			'';
+		};
+	};
+
+	networking.firewall = {
+		enable = true;
+		allowedTCPPorts = [ 80 8123 ];
+	};
+}

hosts/2maccabees/networking.nix

@@ -0,0 +1,44 @@
+{ config, ... }:
+
+{
+	networking = {
+		# This value is deprecated, you now set it per interface
+		useDHCP = false;
+		defaultGateway = "10.42.1.1";
+		nameservers = [ "127.0.0.1" ];
+		interfaces = {
+			eth0.ipv4.addresses = [ {
+				address = "10.42.1.2";
+				prefixLength = 16;
+			} ];
+			wlan0.useDHCP = true;
+
+			vlan66.ipv4.addresses = [ {
+				address = "192.168.66.2";
+				prefixLength = 24;
+			} ];
+
+			vlan67.ipv4.addresses = [ {
+				address = "192.168.67.2";
+				prefixLength = 24;
+			} ];
+		};
+
+		vlans = {
+			vlan66 = {
+				id = 66;
+				interface = "eth0";
+			};
+			vlan67 = {
+				id = 67;
+				interface = "eth0";
+			};
+		};
+	};
+
+	# Open ports in the firewall.
+	# networking.firewall.allowedTCPPorts = [ ... ];
+	# networking.firewall.allowedUDPPorts = [ ... ];
+	# Or disable the firewall altogether.
+	# networking.firewall.enable = false;
+}