Merge branch 'main' of src:greg/nixos-config
This commit is contained in:
Greg Hellings
+5
-5
@@ -4,7 +4,6 @@
|
||||
overlays,
|
||||
pkgs,
|
||||
self,
|
||||
top,
|
||||
...
|
||||
}:
|
||||
let
|
||||
@@ -148,11 +147,11 @@ in
|
||||
];
|
||||
publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOjQjXq9WYU2Ki27BR9WwJ4ZruS/lJXbjC1b0Q42Adi0";
|
||||
};
|
||||
jude = {
|
||||
zeke = {
|
||||
extraHostNames = [
|
||||
"jude.home"
|
||||
"jude.thehellings.lan"
|
||||
"jude-builder"
|
||||
"zeke.home"
|
||||
"zeke.thehellings.lan"
|
||||
"zeke-builder"
|
||||
];
|
||||
publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOos0zQePsa+T6Z2dsKbPOvEdrBQ8a6mx3s7pN6ysCI0";
|
||||
};
|
||||
@@ -170,6 +169,7 @@ in
|
||||
|
||||
# Enable the OpenSSH daemon for remote control
|
||||
services = {
|
||||
locate.enable = true;
|
||||
openssh = {
|
||||
enable = true;
|
||||
settings.X11Forwarding = true;
|
||||
|
||||
+1
-1
@@ -44,7 +44,7 @@ in
|
||||
{
|
||||
genesis = unstable { name = "genesis"; };
|
||||
exodus = unstable { name = "exodus"; };
|
||||
jude = unstable { name = "jude"; };
|
||||
zeke = unstable { name = "zeke"; };
|
||||
icdm-root = unstable { name = "icdm-root"; };
|
||||
linode = unstable { name = "linode"; };
|
||||
hosea = unstable { name = "hosea"; };
|
||||
|
||||
@@ -28,8 +28,9 @@
|
||||
podman.enable = true;
|
||||
print.enable = true;
|
||||
tailscale.enable = true;
|
||||
runner.enable = true;
|
||||
vmdev = {
|
||||
enable = true;
|
||||
enable = false;
|
||||
system = "intel";
|
||||
};
|
||||
};
|
||||
@@ -41,6 +42,8 @@
|
||||
networkmanager.enable = lib.mkForce true;
|
||||
};
|
||||
|
||||
programs.adb.enable = true;
|
||||
|
||||
services = {
|
||||
fprintd.enable = true;
|
||||
fwupd = {
|
||||
@@ -53,5 +56,9 @@
|
||||
oci-containers.backend = "podman";
|
||||
};
|
||||
|
||||
users.users.greg.extraGroups = [ "podman" ];
|
||||
users.users.greg.extraGroups = [
|
||||
"adbusers"
|
||||
"kvm"
|
||||
"podman"
|
||||
];
|
||||
}
|
||||
|
||||
@@ -2,10 +2,9 @@
|
||||
# your system. Help is available in the configuration.nix(5) man page
|
||||
# and in the NixOS manual (accessible by running ‘nixos-help’).
|
||||
|
||||
{ config, pkgs, ... }:
|
||||
{ pkgs, ... }:
|
||||
|
||||
let
|
||||
dashy_port = "8080";
|
||||
speedtest_port = "19472";
|
||||
in
|
||||
{
|
||||
@@ -22,7 +21,6 @@ in
|
||||
proxies = {
|
||||
"speed.home".target = "http://localhost:${speedtest_port}";
|
||||
"speedtest.thehellings.lan".target = "http://localhost:${speedtest_port}";
|
||||
"dashy.home".target = "http://localhost:${dashy_port}";
|
||||
};
|
||||
};
|
||||
|
||||
@@ -41,102 +39,7 @@ in
|
||||
|
||||
networking.hostName = "genesis"; # Define your hostname.
|
||||
|
||||
services = {
|
||||
dashy = {
|
||||
enable = true;
|
||||
settings = {
|
||||
appConfig = {
|
||||
enableFontAwesome = true;
|
||||
statusCheck = true;
|
||||
statusCheckInterval = 20;
|
||||
theme = "callisto";
|
||||
};
|
||||
pageInfo = {
|
||||
description = "Hellings Lab";
|
||||
navLinks = [
|
||||
{
|
||||
path = "/";
|
||||
title = "Home";
|
||||
}
|
||||
{
|
||||
path = "http://speed.home";
|
||||
title = "Local Speedtest";
|
||||
}
|
||||
];
|
||||
};
|
||||
sections = [
|
||||
{
|
||||
name = "Hosting";
|
||||
displayData = {
|
||||
sortBy = "alphabetical";
|
||||
rows = 1;
|
||||
cols = 1;
|
||||
collapsed = false;
|
||||
hideForGusts = false;
|
||||
};
|
||||
items = [
|
||||
{
|
||||
title = "Romans";
|
||||
description = "Core Proxmox";
|
||||
icon = "favicon";
|
||||
url = "https://10.42.1.1:8006";
|
||||
target = "newtab";
|
||||
statusCheckAllowInsecure = true;
|
||||
}
|
||||
{
|
||||
title = "Isaiah";
|
||||
description = "Isaiah Proxmox";
|
||||
icon = "favicon";
|
||||
url = "https://isaiah.thehellings.lan:8006";
|
||||
target = "newtab";
|
||||
statusCheckAllowInsecure = true;
|
||||
}
|
||||
{
|
||||
title = "Linode";
|
||||
icon = "favicon";
|
||||
url = "https://login.linode.com/login";
|
||||
target = "newtab";
|
||||
}
|
||||
];
|
||||
}
|
||||
{
|
||||
name = "Services";
|
||||
displayData = {
|
||||
sortBy = "alphabetical";
|
||||
rows = 1;
|
||||
cols = 1;
|
||||
collapsed = false;
|
||||
hideForGusts = false;
|
||||
};
|
||||
items = [
|
||||
{
|
||||
title = "Jellyfin";
|
||||
description = "Home Jellyfin Server";
|
||||
icon = "favicon";
|
||||
url = "http://jellyfin.home";
|
||||
target = "newtab";
|
||||
}
|
||||
{
|
||||
title = "Speedtest";
|
||||
description = "Local Speedtest";
|
||||
icon = "favicon";
|
||||
url = "http://speed.home";
|
||||
target = "newtab";
|
||||
}
|
||||
];
|
||||
}
|
||||
];
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
virtualisation.oci-containers.containers = {
|
||||
dashy = {
|
||||
image = "lissy93/dashy:latest";
|
||||
hostname = "dashy";
|
||||
ports = [ "${dashy_port}:${dashy_port}" ];
|
||||
volumes = [ "${config.services.dashy.finalDrv}/conf.yml:/app/user-data/conf.yml" ];
|
||||
};
|
||||
speedtest = {
|
||||
image = "ghcr.io/librespeed/speedtest";
|
||||
hostname = "speedtest";
|
||||
|
||||
+12
-5
@@ -13,17 +13,23 @@
|
||||
10.42.1.7 hosea hosea.thehellings.lan
|
||||
10.42.1.8 jeremiah jeremiah.thehellings.lan minio-02.thehellings.lan
|
||||
10.42.1.9 ivr ivr.thehellings.lan
|
||||
10.42.1.10 jude jude.thehellings.lan
|
||||
10.42.1.11 jude1 jude1.thehellings.lan
|
||||
# 10 - monitor
|
||||
# 11 - old jude
|
||||
10.42.1.12 tv
|
||||
10.42.1.13 zeke zeke.thehellings.lan
|
||||
10.42.1.14 nas1 nas1.thehellings.lan
|
||||
|
||||
# VMs
|
||||
10.42.4.1 matrix matrix.thehellings.lan
|
||||
10.42.4.2 jellyfin jellyfin.thehellings.lan vm-jellyfin vm-jellyfin.thehellings.lan
|
||||
10.42.4.3 git gitlab git.thehellings.lan gitlab.thehellings.lan
|
||||
|
||||
# VIP
|
||||
10.42.5.1 longhorn.cluster matrix.cluster pgadmin.cluter postgres.cluster immich.cluster
|
||||
|
||||
# IPMI
|
||||
10.42.100.6 isaiahbmc isaiahbmc.thehellings.lan
|
||||
10.42.100.14 nas1bmc nas1bmc.thehellings.lan
|
||||
|
||||
# Tailscale hosts
|
||||
100.119.228.115 chronicles.home nas.home chronicles.shire-zebra.ts.net
|
||||
@@ -32,12 +38,13 @@
|
||||
100.88.91.27 genesis.home smart.home zwave.home nixcache.home gitcache.home dashy.home uptime.home speed.home
|
||||
100.117.28.111 gitlab.home gitlab.shire-zebra.ts.net gitlab.thehellings.lan registry.thehellings.lan git.thehellings.lan
|
||||
100.68.203.1 hosea.home hosea.shire-zebra.ts.net
|
||||
100.84.183.79 isaiah.home isaiah.shire-zebra.ts.net pgadmin.kubernetes postgres.kubernetes
|
||||
100.102.186.39 jeremiah.home jeremiah.shire-zebra.ts.net matrix.kubernetes
|
||||
100.90.74.19 jude.home
|
||||
100.84.183.79 isaiah.home isaiah.shire-zebra.ts.net pgadmin.kubernetes longhorn.kubernetes
|
||||
100.102.186.39 jeremiah.home jeremiah.shire-zebra.ts.net matrix.kubernetes immich.kubernetes postgres.kubernetes
|
||||
100.90.74.19 zeke.home
|
||||
100.115.57.8 linode.home
|
||||
100.65.5.38 matrix.home matrix.shire-zebra.ts.net
|
||||
100.127.55.22 jellyfin.home
|
||||
100.114.187.61 nas1.home nas1.shire-zebra.ts.net
|
||||
|
||||
# Dev hosts
|
||||
10.42.101.1 icdm.lan wiki.icdm.lan *.icdm.lan
|
||||
|
||||
@@ -107,7 +107,7 @@
|
||||
}
|
||||
{
|
||||
hw-address = "04:7c:16:d5:60:6f";
|
||||
ip-address = "10.42.1.11"; # Jude - but straight in the motherboard
|
||||
ip-address = "10.42.1.13"; # Zeke - but straight in the motherboard
|
||||
}
|
||||
|
||||
########################################
|
||||
|
||||
@@ -28,16 +28,20 @@
|
||||
};
|
||||
systemd-boot = {
|
||||
enable = true;
|
||||
configurationLimit = 10;
|
||||
};
|
||||
};
|
||||
supportedFilesystems = [ "ntfs" ];
|
||||
};
|
||||
|
||||
greg = {
|
||||
kubernetes.enable = true;
|
||||
kubernetes = {
|
||||
enable = true;
|
||||
vipInterface = "enp38s0";
|
||||
priority = 255;
|
||||
};
|
||||
tailscale.enable = true;
|
||||
remote-builder.enable = true;
|
||||
runner.enable = true;
|
||||
};
|
||||
|
||||
fileSystems = {
|
||||
@@ -80,16 +84,4 @@
|
||||
settings.PermitRootLogin = "yes";
|
||||
};
|
||||
};
|
||||
|
||||
virtualisation = {
|
||||
libvirtd = {
|
||||
enable = true;
|
||||
allowedBridges = [
|
||||
"br0"
|
||||
"virbr0"
|
||||
];
|
||||
onBoot = "ignore"; # only restart VMs labeled 'autostart'
|
||||
qemu.ovmf.enable = true;
|
||||
};
|
||||
};
|
||||
}
|
||||
|
||||
@@ -5,24 +5,55 @@
|
||||
config,
|
||||
lib,
|
||||
modulesPath,
|
||||
pkgs,
|
||||
...
|
||||
}:
|
||||
|
||||
{
|
||||
imports = [ (modulesPath + "/installer/scan/not-detected.nix") ];
|
||||
|
||||
boot.initrd.availableKernelModules = [
|
||||
"nvme"
|
||||
"xhci_pci"
|
||||
"ahci"
|
||||
"usb_storage"
|
||||
"usbhid"
|
||||
"sd_mod"
|
||||
"sr_mod"
|
||||
];
|
||||
boot.initrd.kernelModules = [ ];
|
||||
boot.kernelModules = [ "kvm-amd" ];
|
||||
boot.extraModulePackages = [ ];
|
||||
boot = {
|
||||
extraModulePackages = [ ];
|
||||
kernelModules = [ "kvm-amd" ];
|
||||
initrd = {
|
||||
availableKernelModules = [
|
||||
"nvme"
|
||||
"xhci_pci"
|
||||
"ahci"
|
||||
"usb_storage"
|
||||
"usbhid"
|
||||
"sd_mod"
|
||||
"sr_mod"
|
||||
];
|
||||
kernelModules = [ ];
|
||||
};
|
||||
loader = {
|
||||
timeout = 15;
|
||||
systemd-boot = {
|
||||
enable = true;
|
||||
configurationLimit = 20;
|
||||
extraEntries = {
|
||||
"Win2.conf" = (
|
||||
lib.strings.concatStringsSep "\n" [
|
||||
"title Windows 11"
|
||||
"efi /shellx64.efi"
|
||||
"options -nointerrupt -noconsolein -noconsoleout windows11.nsh"
|
||||
]
|
||||
);
|
||||
"Shell.conf" = (
|
||||
lib.strings.concatStringsSep "\n" [
|
||||
"title EFI Shell"
|
||||
"efi /shell.efi"
|
||||
]
|
||||
);
|
||||
};
|
||||
extraFiles = {
|
||||
"windows11.nsh" = (pkgs.writeText "windows11.nsh" (lib.strings.concatStringsSep "\n" [ ]));
|
||||
"shell.efi" = "${pkgs.edk2-uefi-shell}/shell.efi";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
fileSystems."/" = {
|
||||
device = "/dev/disk/by-uuid/714744ca-dd9d-4713-b571-c6ccfbf56d79";
|
||||
@@ -37,15 +68,20 @@
|
||||
};
|
||||
|
||||
fileSystems."/boot" = {
|
||||
device = "/dev/disk/by-uuid/29E7-E20C";
|
||||
device = "/dev/disk/by-uuid/4A92-3E4B";
|
||||
fsType = "vfat";
|
||||
};
|
||||
|
||||
fileSystems."/myvol" = {
|
||||
device = "/dev/nvme0n1p1";
|
||||
device = "/dev/disk/by-uuid/714744ca-dd9d-4713-b571-c6ccfbf56d79";
|
||||
fsType = "btrfs";
|
||||
};
|
||||
|
||||
fileSystems."/var/lib/longhorn" = {
|
||||
device = "/dev/disk/by-uuid/b9f5ace7-d224-4aff-8770-d5a9d22be2ae";
|
||||
fsType = "xfs";
|
||||
};
|
||||
|
||||
swapDevices = [ ];
|
||||
|
||||
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
|
||||
|
||||
@@ -75,9 +75,17 @@ in
|
||||
|
||||
greg = {
|
||||
home = true;
|
||||
kubernetes.enable = true;
|
||||
kubernetes = {
|
||||
enable = true;
|
||||
vipInterface = "br0";
|
||||
priority = 254;
|
||||
};
|
||||
tailscale.enable = true;
|
||||
remote-builder.enable = true;
|
||||
runner = {
|
||||
enable = true;
|
||||
threads = 3;
|
||||
};
|
||||
};
|
||||
|
||||
networking = {
|
||||
@@ -109,21 +117,6 @@ in
|
||||
age.secrets.runner-reg.file = ../../secrets/gitlab/nixos-qemu-shell.age;
|
||||
|
||||
services = {
|
||||
gitlab-runner = {
|
||||
enable = true;
|
||||
settings.concurrent = 3;
|
||||
services = {
|
||||
shell = {
|
||||
executor = "shell";
|
||||
limit = 7;
|
||||
authenticationTokenConfigFile = config.age.secrets.runner-reg.path;
|
||||
environmentVariables = {
|
||||
EFI_DIR = "${pkgs.OVMF.fd}/FV/";
|
||||
STORAGE_URL = "s3.thehellings.lan:9000";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
proxmox-ve = {
|
||||
enable = true;
|
||||
ipAddress = (builtins.elemAt config.networking.interfaces.br0.ipv4.addresses 0).address;
|
||||
|
||||
@@ -33,6 +33,11 @@
|
||||
fsType = "vfat";
|
||||
};
|
||||
|
||||
fileSystems."/var/lib/longhorn" = {
|
||||
device = "/dev/disk/by-uuid/1c896717-4a01-4136-825d-6c0160a78256";
|
||||
fsType = "xfs";
|
||||
};
|
||||
|
||||
swapDevices = [ ];
|
||||
|
||||
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
|
||||
|
||||
@@ -1,172 +0,0 @@
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
pkgs,
|
||||
top,
|
||||
...
|
||||
}:
|
||||
|
||||
{
|
||||
imports = [
|
||||
./boot.nix
|
||||
./hardware-configuration.nix
|
||||
./virt.nix
|
||||
./work.nix
|
||||
top.nix-hardware.nixosModules.system76
|
||||
];
|
||||
|
||||
boot.extraModulePackages = [ config.boot.kernelPackages.v4l2loopback ];
|
||||
|
||||
greg = {
|
||||
tailscale.enable = true;
|
||||
sway.enable = false;
|
||||
gnome.enable = true;
|
||||
kde.enable = false;
|
||||
kubernetes.enable = true;
|
||||
podman.enable = true;
|
||||
print.enable = true;
|
||||
remote-builder.enable = true;
|
||||
};
|
||||
|
||||
environment.systemPackages =
|
||||
with pkgs;
|
||||
lib.mkMerge [
|
||||
[
|
||||
# for Immersed
|
||||
cudatoolkit
|
||||
immersed
|
||||
libva
|
||||
]
|
||||
[
|
||||
bind # For things like nslookup
|
||||
create_ssl
|
||||
distrobox
|
||||
expect
|
||||
fswatch
|
||||
gimp
|
||||
go
|
||||
gparted
|
||||
graphviz
|
||||
flock
|
||||
ffmpeg
|
||||
handbrake
|
||||
imagemagick
|
||||
libtheora
|
||||
libxml2
|
||||
linode-cli
|
||||
makemkv
|
||||
oathToolkit
|
||||
usbutils
|
||||
ventoy
|
||||
]
|
||||
|
||||
[
|
||||
# Video/Audio data composition framework tools like "gst-inspect", "gst-launch" ...
|
||||
gst_all_1.gstreamer
|
||||
gst_all_1.gst-plugins-base
|
||||
gst_all_1.gst-plugins-good
|
||||
gst_all_1.gst-plugins-bad
|
||||
gst_all_1.gst-plugins-ugly
|
||||
gst_all_1.gst-libav
|
||||
gst_all_1.gst-vaapi
|
||||
]
|
||||
];
|
||||
|
||||
hardware = {
|
||||
nvidia = {
|
||||
package = config.boot.kernelPackages.nvidiaPackages.vulkan_beta;
|
||||
modesetting.enable = true;
|
||||
powerManagement = {
|
||||
enable = false;
|
||||
finegrained = false;
|
||||
};
|
||||
nvidiaSettings = true;
|
||||
open = true;
|
||||
};
|
||||
system76 = {
|
||||
firmware-daemon.enable = true;
|
||||
#kernel-modules.enable = true;
|
||||
};
|
||||
};
|
||||
|
||||
networking = {
|
||||
hostName = "jude";
|
||||
networkmanager.enable = lib.mkForce true;
|
||||
enableIPv6 = false;
|
||||
useDHCP = false;
|
||||
interfaces = {
|
||||
# This seems to be direct mother board interface
|
||||
enp12s0.useDHCP = true;
|
||||
#enp12s0.ipv4.addresses = [
|
||||
#{
|
||||
#address = "10.42.1.11";
|
||||
#prefixLength = 16;
|
||||
#}
|
||||
#];
|
||||
# This seems to be the one that comes through the monitor hookup
|
||||
enp14s0u1u2.ipv4.addresses = [
|
||||
{
|
||||
address = "10.42.1.10";
|
||||
prefixLength = 16;
|
||||
}
|
||||
];
|
||||
};
|
||||
defaultGateway = {
|
||||
address = "10.42.1.1";
|
||||
interface = "enp14s0u1u2";
|
||||
};
|
||||
nameservers = [
|
||||
"10.42.1.5"
|
||||
"10.42.1.1"
|
||||
];
|
||||
firewall = {
|
||||
enable = false;
|
||||
allowedTCPPorts = [ 21000 ];
|
||||
allowedUDPPorts = [
|
||||
21000
|
||||
21010
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
programs = {
|
||||
adb.enable = true;
|
||||
steam.enable = true;
|
||||
nix-index = {
|
||||
enable = true;
|
||||
enableBashIntegration = false;
|
||||
enableFishIntegration = false;
|
||||
enableZshIntegration = false;
|
||||
};
|
||||
nix-ld.enable = false;
|
||||
};
|
||||
|
||||
# Let's do a sound thing
|
||||
services = {
|
||||
k3s.extraFlags =
|
||||
let
|
||||
ip = (builtins.head config.networking.interfaces.enp14s0u1u2.ipv4.addresses).address;
|
||||
in
|
||||
[
|
||||
"--tls-san ${ip}"
|
||||
#"--bind-address ${ip}"
|
||||
];
|
||||
pipewire = {
|
||||
enable = true;
|
||||
alsa.enable = true;
|
||||
audio.enable = true;
|
||||
jack.enable = true;
|
||||
pulse.enable = true;
|
||||
wireplumber.enable = true;
|
||||
};
|
||||
pulseaudio.enable = false; # This conflicts with pipewire
|
||||
locate.enable = true;
|
||||
xserver.videoDrivers = [ "nvidia" ];
|
||||
};
|
||||
|
||||
users.users.greg.extraGroups = [
|
||||
"adbusers"
|
||||
"kvm"
|
||||
"podman"
|
||||
];
|
||||
}
|
||||
@@ -1,124 +0,0 @@
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
pkgs,
|
||||
...
|
||||
}:
|
||||
|
||||
let
|
||||
environmentVariables = {
|
||||
EFI_DIR = "${pkgs.OVMF.fd}/FV/";
|
||||
STORAGE_URL = "s3.thehellings.lan:9000";
|
||||
};
|
||||
passthru = [
|
||||
"1002:164e" # Raphael - embedded GPU
|
||||
"1002:1640" # Rembrandt - Audio
|
||||
#"10de:2507" # RTX 3050 video
|
||||
#"10de:228e" # RTX 3050 audio
|
||||
];
|
||||
in
|
||||
{
|
||||
specialisation = {
|
||||
vbox.configuration = {
|
||||
|
||||
greg = {
|
||||
podman.enable = lib.mkForce false;
|
||||
vmdev.enable = lib.mkForce false;
|
||||
};
|
||||
|
||||
users.extraGroups.vboxusers.members = [ "greg" ];
|
||||
|
||||
virtualisation = {
|
||||
virtualbox.host = {
|
||||
enable = true;
|
||||
enableExtensionPack = true;
|
||||
};
|
||||
};
|
||||
|
||||
services.gitlab-runner.services = lib.mkForce {
|
||||
vbox = {
|
||||
inherit environmentVariables;
|
||||
authenticationTokenConfigFile = config.age.secrets.vbox.path;
|
||||
executor = "shell";
|
||||
limit = 5;
|
||||
};
|
||||
};
|
||||
|
||||
systemd.services.gitlab-runner = {
|
||||
serviceConfig = {
|
||||
DevicePolicy = lib.mkForce "auto";
|
||||
User = "root";
|
||||
DynamicUser = lib.mkForce false;
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
age.secrets = {
|
||||
qemu.file = ../../secrets/gitlab/nixos-qemu-shell.age;
|
||||
vbox.file = ../../secrets/gitlab/nixos-vbox-shell.age;
|
||||
};
|
||||
|
||||
# These options enable sharing of the GPU with the VM
|
||||
boot = {
|
||||
# Order matters here, to prevent the AMD driver from getting to the driver before
|
||||
# vfio-pci does
|
||||
initrd.kernelModules = [
|
||||
"vfio_pci"
|
||||
"vfio"
|
||||
"vfio_iommu_type1"
|
||||
|
||||
#"amdgpu"
|
||||
#"nvidia"
|
||||
#"nvidia_modeset"
|
||||
#"nvidia_uvm"
|
||||
#"nvidia_drm"
|
||||
];
|
||||
kernelParams = [
|
||||
"amd_iommu=on"
|
||||
"iommu=pt"
|
||||
("vfio-pci.ids=" + (lib.concatStringsSep "," passthru))
|
||||
];
|
||||
};
|
||||
|
||||
greg.vmdev.enable = true;
|
||||
|
||||
hardware.graphics.enable = true;
|
||||
|
||||
services.gitlab-runner = {
|
||||
enable = true;
|
||||
settings.concurrent = 5;
|
||||
services.qemu = {
|
||||
inherit environmentVariables;
|
||||
executor = "shell";
|
||||
limit = 5;
|
||||
authenticationTokenConfigFile = config.age.secrets.qemu.path;
|
||||
};
|
||||
};
|
||||
|
||||
systemd.services = {
|
||||
"libvirt-nosleep@" = {
|
||||
description = "Prevent sleep while %i is running";
|
||||
serviceConfig = {
|
||||
Type = "simple";
|
||||
ExecStart = ''
|
||||
${pkgs.systemd}/bin/systemd-inhibit --what=sleep --why="Libvirt domain %i is running" --who=%U --mode=block sleep infinity
|
||||
'';
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
virtualisation = {
|
||||
libvirtd = {
|
||||
extraConfig = ''
|
||||
log_filters="1:qemu"
|
||||
log_outputs="1:file:/var/log/libvirt/libvirtd.log"
|
||||
'';
|
||||
hooks.qemu = {
|
||||
win10 = lib.getExe pkgs.qemu-hook;
|
||||
};
|
||||
};
|
||||
|
||||
spiceUSBRedirection.enable = true;
|
||||
};
|
||||
}
|
||||
@@ -1,14 +0,0 @@
|
||||
{ pkgs, ... }:
|
||||
|
||||
{
|
||||
services.mongodb = {
|
||||
enable = false;
|
||||
};
|
||||
environment.systemPackages = with pkgs; [
|
||||
mongodb-compass
|
||||
pipenv-ivr
|
||||
pre-commit
|
||||
python311
|
||||
stdenv.cc
|
||||
];
|
||||
}
|
||||
@@ -6,7 +6,7 @@ let
|
||||
in
|
||||
{
|
||||
greg.proxies."${srcDomain}" = {
|
||||
target = "http://git.thehellings.lan";
|
||||
target = "https://vm-gitlab.shire-zebra.ts.net";
|
||||
ssl = true;
|
||||
genAliases = false;
|
||||
extraConfig = ''
|
||||
@@ -16,10 +16,14 @@ in
|
||||
'';
|
||||
};
|
||||
greg.proxies."registry.thehellings.com" = {
|
||||
target = "https://registry.thehellings.lan:5000";
|
||||
target = "https://vm-gitlab.shire-zebra.ts.net:5000";
|
||||
ssl = true;
|
||||
genAliases = false;
|
||||
extraConfig = "client_max_body_size 25000m;";
|
||||
extraConfig = ''
|
||||
proxy_set_header X-Forwarded-Proto https;
|
||||
proxy_set_header X-Forwarded-Ssl on;
|
||||
client_max_body_size 25000m;
|
||||
'';
|
||||
};
|
||||
|
||||
networking.firewall.allowedTCPPorts = [ sshPort ];
|
||||
@@ -44,7 +48,7 @@ in
|
||||
" bind *:${toString sshPort}"
|
||||
" timeout client 1h"
|
||||
" mode tcp"
|
||||
" server git-thehellings-lan git.thehellings.lan:22"
|
||||
" server git-thehellings-lan vm-gitlab.shire-zebra.ts.net:22"
|
||||
];
|
||||
};
|
||||
}
|
||||
|
||||
+11
-4
@@ -29,9 +29,16 @@ in
|
||||
ports = [ "${homepage}:80" ];
|
||||
};
|
||||
};
|
||||
greg.proxies."thehellings.com" = {
|
||||
target = "http://${homepage}/";
|
||||
ssl = true;
|
||||
genAliases = false;
|
||||
greg.proxies = {
|
||||
"thehellings.com" = {
|
||||
target = "http://${homepage}/";
|
||||
ssl = true;
|
||||
genAliases = false;
|
||||
};
|
||||
"doubles.thehellings.com" = {
|
||||
target = "http://localhost:8081";
|
||||
ssl = true;
|
||||
genAliases = false;
|
||||
};
|
||||
};
|
||||
}
|
||||
|
||||
@@ -1,6 +1,10 @@
|
||||
{ ... }:
|
||||
{ pkgs, ... }:
|
||||
|
||||
{
|
||||
environment.systemPackages = with pkgs; [
|
||||
podman-compose
|
||||
];
|
||||
|
||||
virtualisation.podman = {
|
||||
enable = true;
|
||||
dockerCompat = true;
|
||||
|
||||
+88
-107
@@ -11,12 +11,10 @@
|
||||
|
||||
let
|
||||
registryPort = 5000;
|
||||
vpnIp = "100.91.131.66";
|
||||
containerIp = "192.168.200.2";
|
||||
vpnIp = "100.117.28.111";
|
||||
in
|
||||
{
|
||||
imports = [
|
||||
# Include the results of the hardware scan.
|
||||
./hardware-configuration.nix
|
||||
];
|
||||
|
||||
@@ -33,6 +31,7 @@ in
|
||||
gitlab-secret = cfg "secret";
|
||||
gitlab-otp = cfg "otp";
|
||||
gitlab-db = cfg "db";
|
||||
gitlab-db-password = cfg "db-password";
|
||||
gitlab-jws = cfg "jws";
|
||||
gitlab-key = cfg "key";
|
||||
gitlab-cert = cfg "cert";
|
||||
@@ -54,30 +53,12 @@ in
|
||||
};
|
||||
};
|
||||
|
||||
greg.proxies =
|
||||
let
|
||||
t = {
|
||||
target = "http://unix:/run/gitlab/gitlab-workhorse.socket";
|
||||
extraConfig = ''
|
||||
proxy_set_header X-Forwarded-Proto https;
|
||||
proxy_set_header X-Forwarded-Ssl on;
|
||||
client_max_body_size 10000m;
|
||||
'';
|
||||
};
|
||||
in
|
||||
{
|
||||
"${containerIp}" = t;
|
||||
"${vpnIp}" = t;
|
||||
"git.thehellings.lan" = t;
|
||||
};
|
||||
|
||||
greg.backup.jobs.nas-backup = {
|
||||
src = "/var/gitlab/state/backup/";
|
||||
dest = "gitlab";
|
||||
id = "container-gitlab";
|
||||
};
|
||||
|
||||
greg = {
|
||||
backup.jobs.nas-backup = {
|
||||
src = "/var/gitlab/state/backup/";
|
||||
dest = "gitlab";
|
||||
id = "gitlab";
|
||||
};
|
||||
home = true;
|
||||
tailscale.enable = true;
|
||||
};
|
||||
@@ -95,7 +76,7 @@ in
|
||||
cron = {
|
||||
enable = true;
|
||||
systemCronJobs = [
|
||||
"0 0 1 */2 * cd /etc/certs && tailscale cert gitlab.shire-zebra.ts.net && chown nginx * && systemctl reload nginx"
|
||||
"0 0 1 */2 * cd /etc/certs && tailscale cert vm-gitlab.shire-zebra.ts.net && chown nginx * && systemctl reload nginx"
|
||||
];
|
||||
};
|
||||
|
||||
@@ -105,47 +86,18 @@ in
|
||||
keepTime = 288;
|
||||
startAt = [ "03:00" ];
|
||||
};
|
||||
host = "src.thehellings.com";
|
||||
https = true;
|
||||
port = 443;
|
||||
databaseHost = "postgres.kubernetes";
|
||||
databaseName = "gitlab";
|
||||
databaseUsername = "gitlab";
|
||||
databasePasswordFile = config.age.secrets.gitlab-db-password.path;
|
||||
databaseCreateLocally = false;
|
||||
extraConfig = {
|
||||
gitlab = {
|
||||
trustedProxies = [
|
||||
"${vpnIp}/32" # The container itself
|
||||
"100.115.57.8/32" # Public server's IP
|
||||
"${vpnIp}/32" # The system itself
|
||||
"100.109.86.8/32" # Public server's IP
|
||||
];
|
||||
};
|
||||
};
|
||||
initialRootEmail = "greg@thehellings.com";
|
||||
initialRootPasswordFile = pkgs.writeText "initialRootPassword" "root_password";
|
||||
pages = {
|
||||
enable = true;
|
||||
settings.pages-domain = "pages.thehellings.com";
|
||||
};
|
||||
puma = {
|
||||
threadsMax = 6;
|
||||
threadsMin = 2;
|
||||
workers = 6;
|
||||
};
|
||||
redisUrl = "unix:${config.services.redis.servers.gitlab.unixSocket}";
|
||||
registry = {
|
||||
enable = true;
|
||||
certFile = config.age.secrets.gitlab-cert.path;
|
||||
keyFile = config.age.secrets.gitlab-key.path;
|
||||
externalAddress = "registry.thehellings.com";
|
||||
externalPort = 443;
|
||||
};
|
||||
secrets = {
|
||||
activeRecordDeterministicKeyFile = config.age.secrets.gitlab-deterministic-key.path;
|
||||
activeRecordPrimaryKeyFile = config.age.secrets.gitlab-primary-key.path;
|
||||
activeRecordSaltFile = config.age.secrets.gitlab-salt.path;
|
||||
dbFile = config.age.secrets.gitlab-db.path;
|
||||
jwsFile = config.age.secrets.gitlab-jws.path;
|
||||
otpFile = config.age.secrets.gitlab-otp.path;
|
||||
secretFile = config.age.secrets.gitlab-secret.path;
|
||||
};
|
||||
|
||||
extraConfig = {
|
||||
object_store = {
|
||||
enabled = true;
|
||||
proxy_download = true; # Tell them to reach out to object storage themselves!
|
||||
@@ -182,66 +134,95 @@ in
|
||||
);
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
nginx = {
|
||||
clientMaxBodySize = "25000m";
|
||||
virtualHosts."gitlab.shire-zebra.ts.net" = {
|
||||
listen = [
|
||||
{
|
||||
addr = "0.0.0.0";
|
||||
port = registryPort;
|
||||
ssl = true;
|
||||
}
|
||||
];
|
||||
locations."/" = {
|
||||
proxyPass = "http://127.0.0.1:4567/";
|
||||
recommendedProxySettings = true;
|
||||
};
|
||||
extraConfig = ''
|
||||
ssl_certificate /etc/certs/gitlab.shire-zebra.ts.net.crt ;
|
||||
ssl_certificate_key /etc/certs/gitlab.shire-zebra.ts.net.key ;
|
||||
client_max_body_size 10000m ;
|
||||
'';
|
||||
host = "src.thehellings.com";
|
||||
https = true;
|
||||
initialRootEmail = "greg@thehellings.com";
|
||||
initialRootPasswordFile = pkgs.writeText "initialRootPassword" "root_password";
|
||||
pages = {
|
||||
enable = true;
|
||||
settings.pages-domain = "pages.thehellings.com";
|
||||
};
|
||||
port = 443;
|
||||
puma = {
|
||||
threadsMax = 6;
|
||||
threadsMin = 2;
|
||||
workers = 6;
|
||||
};
|
||||
redisUrl = "unix:${config.services.redis.servers.gitlab.unixSocket}";
|
||||
registry = {
|
||||
enable = true;
|
||||
certFile = config.age.secrets.gitlab-cert.path;
|
||||
keyFile = config.age.secrets.gitlab-key.path;
|
||||
externalAddress = "registry.thehellings.com";
|
||||
externalPort = 443;
|
||||
};
|
||||
secrets = {
|
||||
activeRecordDeterministicKeyFile = config.age.secrets.gitlab-deterministic-key.path;
|
||||
activeRecordPrimaryKeyFile = config.age.secrets.gitlab-primary-key.path;
|
||||
activeRecordSaltFile = config.age.secrets.gitlab-salt.path;
|
||||
dbFile = config.age.secrets.gitlab-db.path;
|
||||
jwsFile = config.age.secrets.gitlab-jws.path;
|
||||
otpFile = config.age.secrets.gitlab-otp.path;
|
||||
secretFile = config.age.secrets.gitlab-secret.path;
|
||||
};
|
||||
};
|
||||
|
||||
logrotate = {
|
||||
nginx = {
|
||||
enable = true;
|
||||
settings = {
|
||||
"/var/lib/postgresql/*/log/*.log" = {
|
||||
enable = true;
|
||||
compress = true;
|
||||
compresscmd = "${pkgs.xz}/bin/xz";
|
||||
clientMaxBodySize = "25000m";
|
||||
virtualHosts = {
|
||||
"vm-gitlab.shire-zebra.ts.net" = {
|
||||
listen = [
|
||||
{
|
||||
addr = "0.0.0.0";
|
||||
port = 443;
|
||||
ssl = true;
|
||||
}
|
||||
];
|
||||
locations."/" = {
|
||||
proxyPass = "http://unix:/run/gitlab/gitlab-workhorse.socket";
|
||||
recommendedProxySettings = true;
|
||||
};
|
||||
extraConfig = ''
|
||||
ssl_certificate /etc/certs/vm-gitlab.shire-zebra.ts.net.crt ;
|
||||
ssl_certificate_key /etc/certs/vm-gitlab.shire-zebra.ts.net.key ;
|
||||
client_max_body_size 10000m ;
|
||||
'';
|
||||
};
|
||||
"registry" = {
|
||||
listen = [
|
||||
{
|
||||
addr = "0.0.0.0";
|
||||
port = registryPort;
|
||||
ssl = true;
|
||||
}
|
||||
];
|
||||
locations."/" = {
|
||||
proxyPass = "http://127.0.0.1:4567/";
|
||||
recommendedProxySettings = true;
|
||||
};
|
||||
extraConfig = ''
|
||||
ssl_certificate /etc/certs/vm-gitlab.shire-zebra.ts.net.crt ;
|
||||
ssl_certificate_key /etc/certs/vm-gitlab.shire-zebra.ts.net.key ;
|
||||
client_max_body_size 25000m ;
|
||||
'';
|
||||
serverAliases = [
|
||||
"vm-gitlab.shire-zebra.ts.net"
|
||||
];
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
openssh.enable = true;
|
||||
|
||||
postgresql = {
|
||||
enable = true;
|
||||
checkConfig = true;
|
||||
ensureDatabases = [ "gitlab" ];
|
||||
ensureUsers = [
|
||||
{
|
||||
name = "gitlab";
|
||||
ensureDBOwnership = true;
|
||||
}
|
||||
];
|
||||
settings = {
|
||||
log_connections = true;
|
||||
log_statement = "all";
|
||||
logging_collector = true;
|
||||
log_filename = "postgresql.log";
|
||||
};
|
||||
};
|
||||
postgresql.enable = true;
|
||||
|
||||
qemuGuest.enable = true;
|
||||
|
||||
redis.servers.gitlab = {
|
||||
enable = true;
|
||||
};
|
||||
|
||||
resolved.enable = true;
|
||||
};
|
||||
|
||||
|
||||
@@ -34,12 +34,12 @@
|
||||
};
|
||||
|
||||
fileSystems."/" = {
|
||||
device = "/dev/disk/by-uuid/507251f1-efe7-448d-8de8-91ee582a9afb";
|
||||
device = "/dev/disk/by-uuid/1fdbe86e-ce6f-4af3-a876-aec35731adab";
|
||||
fsType = "ext4";
|
||||
};
|
||||
|
||||
fileSystems."/boot" = {
|
||||
device = "/dev/disk/by-uuid/7115-EFA6";
|
||||
device = "/dev/disk/by-uuid/1E6A-C3BB";
|
||||
fsType = "vfat";
|
||||
options = [
|
||||
"fmask=0077"
|
||||
|
||||
@@ -30,17 +30,17 @@
|
||||
|
||||
fileSystems = {
|
||||
"/music" = {
|
||||
device = "10.42.1.4:/volume1/music";
|
||||
device = "nas1.shire-zebra.ts.net:/mnt/all/music";
|
||||
fsType = "nfs";
|
||||
options = [ "ro" ];
|
||||
};
|
||||
"/photo" = {
|
||||
device = "10.42.1.4:/volume1/photo";
|
||||
device = "nas1.shire-zebra.ts.net:/mnt/all/photos";
|
||||
fsType = "nfs";
|
||||
options = [ "ro" ];
|
||||
};
|
||||
"/video" = {
|
||||
device = "10.42.1.4:/volume1/video/";
|
||||
device = "nas1.shire-zebra.ts.net:/mnt/all/video/";
|
||||
fsType = "nfs";
|
||||
options = [ "ro" ];
|
||||
};
|
||||
|
||||
@@ -0,0 +1,89 @@
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
top,
|
||||
...
|
||||
}:
|
||||
|
||||
{
|
||||
imports = [
|
||||
./boot.nix
|
||||
./hardware-configuration.nix
|
||||
./virt.nix
|
||||
top.nix-hardware.nixosModules.system76
|
||||
];
|
||||
|
||||
boot.extraModulePackages = [ config.boot.kernelPackages.v4l2loopback ];
|
||||
|
||||
greg = {
|
||||
kubernetes = {
|
||||
enable = true;
|
||||
vipInterface = "enp12s0";
|
||||
priority = 253;
|
||||
};
|
||||
remote-builder.enable = true;
|
||||
runner.enable = true;
|
||||
tailscale.enable = true;
|
||||
};
|
||||
|
||||
hardware = {
|
||||
nvidia = {
|
||||
modesetting.enable = true;
|
||||
powerManagement = {
|
||||
enable = false;
|
||||
finegrained = false;
|
||||
};
|
||||
nvidiaSettings = true;
|
||||
open = true;
|
||||
};
|
||||
system76 = {
|
||||
firmware-daemon.enable = true;
|
||||
#kernel-modules.enable = true;
|
||||
};
|
||||
};
|
||||
|
||||
networking = {
|
||||
hostName = "zeke";
|
||||
networkmanager.enable = lib.mkForce true;
|
||||
enableIPv6 = false;
|
||||
useDHCP = false;
|
||||
interfaces = {
|
||||
# This seems to be direct mother board interface
|
||||
enp12s0.useDHCP = true;
|
||||
enp12s0.ipv4.addresses = [
|
||||
{
|
||||
address = "10.42.1.13";
|
||||
prefixLength = 16;
|
||||
}
|
||||
];
|
||||
};
|
||||
defaultGateway = {
|
||||
address = "10.42.1.1";
|
||||
interface = "enp12s0";
|
||||
};
|
||||
nameservers = [
|
||||
"10.42.1.5"
|
||||
"10.42.1.1"
|
||||
];
|
||||
};
|
||||
|
||||
# Let's do a sound thing
|
||||
services = {
|
||||
k3s = {
|
||||
extraFlags =
|
||||
let
|
||||
ip = (builtins.head config.networking.interfaces.enp12s0.ipv4.addresses).address;
|
||||
in
|
||||
[
|
||||
"--tls-san ${ip}"
|
||||
#"--bind-address ${ip}"
|
||||
];
|
||||
};
|
||||
xserver.videoDrivers = [ "nvidia" ];
|
||||
};
|
||||
|
||||
users.users.greg.extraGroups = [
|
||||
"kvm"
|
||||
"podman"
|
||||
];
|
||||
}
|
||||
@@ -33,10 +33,6 @@
|
||||
device = "/dev/nvme0n1p1";
|
||||
fsType = "auto";
|
||||
};
|
||||
"/windows11" = {
|
||||
device = "/dev/nvme1n1p2";
|
||||
fsType = "ntfs-3g";
|
||||
};
|
||||
};
|
||||
|
||||
swapDevices = [ ];
|
||||
@@ -0,0 +1,66 @@
|
||||
{
|
||||
lib,
|
||||
pkgs,
|
||||
...
|
||||
}:
|
||||
|
||||
let
|
||||
passthru = [
|
||||
"1002:164e" # Raphael - embedded GPU
|
||||
"1002:1640" # Rembrandt - Audio
|
||||
#"10de:2507" # RTX 3050 video
|
||||
#"10de:228e" # RTX 3050 audio
|
||||
];
|
||||
in
|
||||
{
|
||||
greg.runner.enable = true;
|
||||
# These options enable sharing of the GPU with the VM
|
||||
boot = {
|
||||
# Order matters here, to prevent the AMD driver from getting to the driver before
|
||||
# vfio-pci does
|
||||
initrd.kernelModules = [
|
||||
"vfio_pci"
|
||||
"vfio"
|
||||
"vfio_iommu_type1"
|
||||
|
||||
#"amdgpu"
|
||||
#"nvidia"
|
||||
#"nvidia_modeset"
|
||||
#"nvidia_uvm"
|
||||
#"nvidia_drm"
|
||||
];
|
||||
kernelParams = [
|
||||
"amd_iommu=on"
|
||||
"iommu=pt"
|
||||
("vfio-pci.ids=" + (lib.concatStringsSep "," passthru))
|
||||
];
|
||||
};
|
||||
|
||||
hardware.graphics.enable = true;
|
||||
|
||||
systemd.services = {
|
||||
"libvirt-nosleep@" = {
|
||||
description = "Prevent sleep while %i is running";
|
||||
serviceConfig = {
|
||||
Type = "simple";
|
||||
ExecStart = ''
|
||||
${pkgs.systemd}/bin/systemd-inhibit --what=sleep --why="Libvirt domain %i is running" --who=%U --mode=block sleep infinity
|
||||
'';
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
virtualisation = {
|
||||
libvirtd = {
|
||||
extraConfig = ''
|
||||
log_filters="1:qemu"
|
||||
log_outputs="1:file:/var/log/libvirt/libvirtd.log"
|
||||
'';
|
||||
hooks.qemu = {
|
||||
win10 = lib.getExe pkgs.qemu-hook;
|
||||
};
|
||||
};
|
||||
|
||||
spiceUSBRedirection.enable = true;
|
||||
};
|
||||
}
|
||||
Reference in New Issue
Block a user