Merge branch 'main' of gh:greg-hellings/nixos-config

This commit is contained in:
Greg Hellings
2024-06-20 14:36:01 -05:00
47 changed files with 1607 additions and 343 deletions
+1
View File
@@ -39,6 +39,7 @@ let
};
in {
genesis = machine { name = "genesis"; };
exodus = unstable { name = "exodus"; };
jude = unstable { name = "jude"; };
icdm-root = unstable { name = "icdm-root"; };
linode = machine { name = "linode"; };
+20
View File
@@ -0,0 +1,20 @@
{ pkgs, config, ... }:
{
imports = [
./hardware-configuration.nix
../jude/printing.nix
];
boot.loader = {
systemd-boot.enable = true;
efi.canTouchEfiVariables = true;
};
networking.hostName = "exodus";
greg = {
home = true;
gnome.enable = true;
tailscale.enable = true;
};
}
+39
View File
@@ -0,0 +1,39 @@
# Do not modify this file! It was generated by nixos-generate-config
# and may be overwritten by future invocations. Please make changes
# to /etc/nixos/configuration.nix instead.
{ config, lib, pkgs, modulesPath, ... }:
{
imports =
[ (modulesPath + "/installer/scan/not-detected.nix")
];
boot.initrd.availableKernelModules = [ "xhci_pci" "thunderbolt" "nvme" "uas" "sd_mod" ];
boot.initrd.kernelModules = [ ];
boot.kernelModules = [ "kvm-intel" ];
boot.extraModulePackages = [ ];
fileSystems."/" =
{ device = "/dev/disk/by-uuid/607b933f-2967-4652-b478-4d8e9aa38a0d";
fsType = "btrfs";
options = [ "subvol=@" ];
};
fileSystems."/boot" =
{ device = "/dev/disk/by-uuid/B31C-C1F4";
fsType = "vfat";
};
swapDevices = [ ];
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
# (the default) this is the recommended approach. When using systemd-networkd it's
# still possible to use this option, but it's recommended to use it in conjunction
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
networking.useDHCP = lib.mkDefault true;
# networking.interfaces.enp0s13f0u1.useDHCP = lib.mkDefault true;
# networking.interfaces.wlp170s0.useDHCP = lib.mkDefault true;
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
}
+4 -2
View File
@@ -8,9 +8,10 @@
10.42.1.2 opnsense router opnsense.thehellings.lan router.thehellings.lan
10.42.1.3 printer.thehellings.lan
10.42.1.4 chronicles chronicles.thehellings.lan nas.thehellings.lan
10.42.1.5 genesis genesis.thehellings.lan dns dns.thehellings.lan smart smart.thehellings.lan jellyfin jellyfin.thehellings.lan speedtest.thehellings.lan nixcache.thehellings.lan gitcache.thehellings.lan s3.thehellings.lan
10.42.1.5 genesis genesis.thehellings.lan dns dns.thehellings.lan smart smart.thehellings.lan jellyfin jellyfin.thehellings.lan speedtest.thehellings.lan nixcache.thehellings.lan gitcache.thehellings.lan
10.42.1.6 isaiah isaiah.thehellings.lan
10.42.1.7 hosea hosea.thehellings.lan
10.42.1.7 hosea hosea.thehellings.lan s3.thehellings.lan
10.42.1.8 jeremiah jeremiah.thehellings.lan
10.42.1.12 tv
10.42.100.6 isaiahbmc isaiahbmc.thehellings.lan
@@ -24,6 +25,7 @@
100.84.183.79 myself.home myself.shire-zebra.ts.net
100.78.226.76 gitlab.home gitlab.shire-zebra.ts.net gitlab.thehellings.lan registry.thehellings.lan git.thehellings.lan
100.68.203.1 hosea.home hosea.shire-zebra.ts.net
100.102.186.39 jeremiah.home jeremiah.shire-zebra.ts.net
# Dev hosts
10.42.101.1 icdm.lan wiki.icdm.lan *.icdm.lan
+10 -10
View File
@@ -137,24 +137,24 @@ in {
# Static IPs for things in the IOT range
"b4:b0:24:9a:02:4a,192.168.66.5" # LD125
"98:da:c4:20:f3:64,192.168.66.6"
"98:da:c4:20:f3:64,192.168.66.6" # Dining room light
"54:af:97:c1:dc:b9,192.168.66.25" # Master bedroom Kasa switch
"f0:03:8c:b3:b0:f6,192.168.66.55" # Roomba
"4c:a1:61:05:cd:52,192.168.66.61" # Rainbird
"48:d6:d5:5d:81:21,192.168.66.65" # Google Home
"6c:29:90:3e:e2:02,192.168.66.66" # wiz
"28:87:ba:0e:ca:da,192.168.66.74" # KS200M switch
"28:87:ba:0e:c9:fd,192.168.66.75"
"54:af:97:c2:0f:a1,192.168.66.76"
"28:87:ba:0e:ca:da,192.168.66.74" #
"28:87:ba:0e:c9:fd,192.168.66.75" # Master closet
"54:af:97:c2:0f:a1,192.168.66.76" # Master toilet
"54:af:97:83:ed:33,192.168.66.80"
"98:da:c4:77:80:18,192.168.66.84"
"98:da:c4:21:1b:2e,192.168.66.85"
"0c:80:63:41:6e:0f,192.168.66.90"
"0c:80:63:41:6c:5d,192.168.66.98" # HS200 switch
"98:da:c4:77:80:18,192.168.66.84" # Kitchen lights
"98:da:c4:21:1b:2e,192.168.66.85" # Living Room lights
"0c:80:63:41:6e:0f,192.168.66.90" # Front porch
"0c:80:63:41:6c:5d,192.168.66.98" # House number
"ac:84:c6:5e:4b:28,192.168.66.100"
"98:da:c4:77:7f:4d,192.168.66.102"
"98:da:c4:77:7f:4d,192.168.66.102" # Office lights
"8c:85:80:1c:f9:d1,192.168.66.104"
"98:da:c4:77:82:7b,192.168.66.105"
"98:da:c4:77:82:7b,192.168.66.105" # Parlor lamp
"0c:80:63:41:74:73,192.168.66.106" # Front hall light switch
"98:da:c4:20:ea:db,192.168.66.107" # Parlor light switch
"8c:49:62:aa:58:60,192.168.66.108" # Roku, HiHandsome
+33
View File
@@ -0,0 +1,33 @@
{ config, ... }:
let
publicIp = (builtins.elemAt config.networking.interfaces.enp68s0.ipv4.addresses 0).address;
sanIp = (builtins.elemAt config.networking.interfaces.enp67s0.ipv4.addresses 0).address;
vip = (builtins.elemAt config.networking.interfaces.enp68s0.ipv4.addresses 1).address;
hostname = config.networking.hostName;
baseConfig = import ../../ceph/home.nix;
in {
services.ceph-benaco = baseConfig // {
enable = true;
monitor = {
enable = true;
initialKeyring = ../../secrets/home.mon.keyring;
nodeName = hostname;
bindAddr = publicIp;
advertisedPublicAddr = vip;
};
osdBindAddr = publicIp;
osdAdvertisedPublicAddr = publicIp;
osds = {
osd1 = {
enable = true;
bootstrapKeyring = ../../secrets/home.osd-bootstrap.keyring;
id = 1;
uuid = "c13bd2b1-cfc7-4966-8da5-d92356e87e06";
blockDevice = "/dev/sda";
blockDeviceUdevRuleMatcher = ''KERNEL=="sda"'';
clusterAddress = sanIp;
};
};
};
}
+56 -12
View File
@@ -1,22 +1,66 @@
# Edit this configuration file to define what should be installed on
# your system. Help is available in the configuration.nix(5) man page
# your system. Help is available in the configuration.nix(5) man page
# and in the NixOS manual (accessible by running nixos-help).
{ config, pkgs, ... }:
{
imports =
[ # Include the results of the hardware scan.
./hardware-configuration.nix
];
imports =
[ # Include the results of the hardware scan.
./ceph.nix
./hardware-configuration.nix
];
# Bootloader.
boot.loader.systemd-boot.enable = true;
boot.loader.efi.canTouchEfiVariables = true;
# Bootloader.
boot.loader.systemd-boot.enable = true;
boot.loader.efi.canTouchEfiVariables = true;
networking.hostName = "jeremiah"; # Define your hostname.
greg = {
networking = {
hostName = "jeremiah"; # Define your hostname.
useDHCP = false;
defaultGateway = {
address = " 10.42.1.1";
interface = "enp68s0";
};
interfaces = {
enp68s0 = {
ipv4.addresses = [ {
address = "10.42.1.8";
prefixLength = 16;
} {
address = "10.42.100.1";
prefixLength = 16;
} ];
};
enp67s0 = {
ipv4.addresses = [ {
address = "10.201.1.2";
prefixLength = 16;
} ];
};
};
nameservers = [
"10.42.1.5"
];
};
greg = {
home = true;
tailscale.enable = true;
};
tailscale.enable = true;
};
environment.systemPackages = with pkgs; [
btrfs-progs
];
fileSystems = {
"/nix" = {
fsType = "btrfs";
options = [ "subvol=nix" ];
device = "/dev/nvme0n1p1";
};
"/var" = {
fsType = "btrfs";
options = [ "subvol=var" ];
device = "/dev/nvme0n1p1";
};
};
}
+3 -2
View File
@@ -32,8 +32,8 @@
greg = {
tailscale.enable = true;
sway.enable = false;
gnome.enable = false;
kde.enable = true;
gnome.enable = true;
kde.enable = false;
};
boot.extraModulePackages = [ config.boot.kernelPackages.v4l2loopback ];
@@ -68,6 +68,7 @@
oathToolkit
synology-drive-client
terraform
usbutils
vagrant
ventoy
]
+28 -17
View File
@@ -1,4 +1,4 @@
{ pkgs, ... }:
{ pkgs, config, ... }:
{
environment.systemPackages = with pkgs; [
@@ -6,11 +6,11 @@
guestfs-tools
libguestfs
OVMFFull
ovftool
packer
virt-manager
vmware-workstation
vmfs-tools
xorriso
];
# Give my user access to the libvirtd process
@@ -28,8 +28,6 @@
enableExtensionPack = true;
};
vmware.host.enable = false;
waydroid.enable = false;
lxd.enable = false;
};
@@ -39,20 +37,33 @@
boot.extraModprobeConfig = "options kvm_amd nested=1";
systemd.services = {
vbox = {
gitlab-runner = {
conflicts = [ "libvirtd.service" ];
serviceConfig = {
Type = "oneshot";
RemainAfterExit = "yes";
ExecStart = [
"rmmod kvm_amd"
"rmmod kvm"
];
ExecStop = [
"rmmod vboxnetflt"
"rmmod vboxnetadp"
"rmmod vboxdrv"
];
preStart = builtins.concatStringsSep "\n" [
"${pkgs.kmod}/bin/modprobe vboxnetflt vboxdrv"
"${pkgs.kmod}/bin/modprobe vboxnetadp"
];
postStop = "${pkgs.kmod}/bin/rmmod vboxnetflt vboxnetadp vboxdrv";
wantedBy = pkgs.lib.mkForce [];
serviceConfig.User = "root";
};
libvirtd = {
preStart = "${pkgs.kmod}/bin/modprobe kvm_amd";
postStop = "${pkgs.kmod}/bin/rmmod kvm_amd kvm";
};
};
age.secrets.runner-reg.file = ../../secrets/gitlab/myself-vbox-runner-reg.age;
services.gitlab-runner = {
enable = true;
settings.concurrent = 5;
services.vbox = {
executor = "shell";
limit = 5;
registrationConfigFile = config.age.secrets.runner-reg.path;
environmentVariables = {
EFI_DIR = "${pkgs.OVMF.fd}/FV/";
};
};
};
+37 -1
View File
@@ -1,4 +1,4 @@
{ pkgs, lib, ... }:
{ pkgs, lib, config, ... }:
{
imports = [
@@ -26,6 +26,7 @@
];
networking = {
networkmanager.enable = lib.mkForce false;
hostName = "linode";
domain = "thehellings.com";
nameservers = [
@@ -33,6 +34,41 @@
];
};
age.secrets.runner-deployer = {
file = ../../secrets/gitlab/linode-deployer-runner-reg.age;
owner = "gitlab-runner";
};
services.gitlab-runner = {
enable = true;
services.deployer = {
executor = "shell";
registrationConfigFile = config.age.secrets.runner-deployer.path;
};
};
users.users.gitlab-runner = {
isSystemUser = true;
group = "gitlab-runner";
};
users.groups.gitlab-runner = {};
systemd.services."gitlab-runner".serviceConfig = {
DynamicUser = lib.mkForce false;
User = "gitlab-runner";
};
security.sudo.extraRules = [{
users = [ "gitlab-runner" ];
commands = [{
command = "/run/current-system/sw/bin/systemctl";
options = [ "NOPASSWD" ];
} {
command = "/run/current-system/sw/bin/podman";
options = [ "NOPASSWD" ];
}];
}];
environment.systemPackages = with pkgs; [
bind
graphviz
+6 -6
View File
@@ -2,6 +2,7 @@
let
srcDomain = "src.thehellings.com";
sshPort = 2222;
in {
greg.proxies."${srcDomain}" = {
target = "http://git.thehellings.lan";
@@ -19,6 +20,8 @@ in {
extraConfig = "client_max_body_size 250m;";
};
networking.firewall.allowedTCPPorts = [ sshPort ];
services.haproxy = {
enable = true;
config = builtins.concatStringsSep "\n" [
@@ -31,14 +34,11 @@ in {
" timeout client 500s"
" timeout server 1h"
"frontend gitsshd"
" bind *:2222"
" default_backend gitssh"
"listen gitsshd"
" bind *:${toString sshPort}"
" timeout client 1h"
"backend gitssh"
" mode tcp"
" server git-thehellings-lan git.thehellings.lan:2222"
" server git-thehellings-lan git.thehellings.lan:22"
];
};
}
+1 -1
View File
@@ -25,7 +25,7 @@
enableACME = true;
};
greg.backup.jobs.nextcloud = {
greg.backup.jobs.nextcloud-bkup = {
src = "/var/lib/nextcloud";
dest = "nextcloud-backup";
user = "nextcloud";
+2 -1
View File
@@ -23,7 +23,8 @@ in
virtualisation.oci-containers = {
backend = "podman";
containers."homepage" = {
image = "ghcr.io/greg-hellings/homepage:latest";
# needs explicit port to match what gitlab-runner sees when pulling
image = "registry.thehellings.com:443/greg/homepage/gregs-homepage:latest";
ports = [ "${homepage}:80" ];
};
};
+5
View File
@@ -1,8 +1,13 @@
{ config, pkgs, lib, ... }:
{
environment.systemPackages = [
pkgs.upgrade-pg-cluster
];
services.postgresql = {
enable = true;
package = pkgs.postgresql_15;
checkConfig = true;
ensureDatabases = [
"nextcloud"
+44
View File
@@ -13,6 +13,19 @@ in {
gitlab-jws = cfg "jws";
gitlab-key = cfg "key";
gitlab-cert = cfg "cert";
minio_access_key_id = {
file = ../../secrets/minio_access_key_id.age;
owner = "gitlab";
group = "gitlab";
mode = "0444";
};
minio_secret_access_key = {
file = ../../secrets/minio_secret_access_key.age;
owner = "gitlab";
group = "gitlab";
mode = "0444";
};
};
networking.firewall.allowedTCPPorts = [ 80 registryPort ];
@@ -86,6 +99,34 @@ in {
dbFile = config.age.secrets.gitlab-db.path;
jwsFile = config.age.secrets.gitlab-jws.path;
};
extraConfig = {
object_store = {
enabled = true;
proxy_download = false; # Tell them to reach out to object storage themselves!
connection = {
provider = "AWS";
endpoint = "http://s3.thehellings.lan:9000";
region = "us-east-1";
aws_access_key_id = { _secret = config.age.secrets.minio_access_key_id.path; };
aws_secret_access_key = { _secret = config.age.secrets.minio_secret_access_key.path; };
path_style = true; # True for MinIO
aws_signature_version = 2;
};
#storage_options = ...;
objects = builtins.listToAttrs ( builtins.map (x: lib.attrsets.nameValuePair x { bucket = "gitlab-${builtins.replaceStrings [ "_" ] [ "-" ] x}"; }) [
"artifacts"
"ci_secure_files"
"dependency_proxy"
"external_diffs"
"lfs"
"packages"
"pages"
"terraform_state"
"uploads"
]);
};
};
};
nginx.virtualHosts."gitlab.shire-zebra.ts.net" = {
@@ -147,6 +188,9 @@ in {
"network.target"
"network-online.target"
];
preStart = ''
sleep 5 # tailscaled is up before it's ACTUALLY up... try waiting?
'';
};
system.stateVersion = lib.mkForce "24.05";
}
+9
View File
@@ -33,6 +33,15 @@
ipv4.addresses = [ {
address = "10.42.1.6";
prefixLength = 16;
} {
address = "10.42.100.1";
prefixLength = 16;
} ];
};
interfaces.enp39s0 = {
ipv4.addresses = [ {
address = "10.201.1.1";
prefixLength = 24;
} ];
};
nameservers = [
+5 -4
View File
@@ -65,6 +65,7 @@ in {
config = ((import ./container-runner.nix) {
inherit inputs overlays;
name = "shell";
extra.virtualisation.podman.enable = true;
});
};
@@ -96,13 +97,13 @@ in {
"koalaman/shellcheck:*"
"registry.gitlab.com/gitlab-org/*"
"registry.thehellings.com/*"
"gitlab.shire-zebra.ts.net:5000/*:*"
"registry.thehellings.com/*/*/*:*"
"gitlab.shire-zebra.ts.net:5000/*/*/*:*"
];
dockerAllowedServices = [
"docker:*"
"registry.thehellings.com/*"
"gitlab.shire-zebra.ts.net:5000/*:*"
"registry.thehellings.com/*/*/*:*"
"gitlab.shire-zebra.ts.net:5000/*/*/*:*"
];
dockerPrivileged = true;
dockerVolumes = [