Move modules to shared
This commit is contained in:
Greg Hellings
@@ -0,0 +1,84 @@
|
||||
{ config, pkgs, lib, ... }:
|
||||
|
||||
let
|
||||
cfg = config.greg.ci-runner;
|
||||
runnerNames = (builtins.attrNames cfg);
|
||||
makeRunner = name: value: {
|
||||
enable = true;
|
||||
hostPackages = with pkgs; [
|
||||
bashInteractive
|
||||
podman
|
||||
git
|
||||
nodejs
|
||||
] ++ value.packages;
|
||||
labels = lib.mkIf ( builtins.hasAttr "labels" value) value.labels;
|
||||
name = config.networking.hostName;
|
||||
tokenFile = config.age.secrets.forgejo-runner.path;
|
||||
url = "https://src.thehellings.com";
|
||||
settings.runner.capacity = value.parallel;
|
||||
};
|
||||
|
||||
userName = "gitea-runner";
|
||||
|
||||
in with lib; {
|
||||
options = {
|
||||
greg.ci-runner = mkOption {
|
||||
default = {};
|
||||
description = "List of gitea/forgejo runners to configure";
|
||||
example = ''
|
||||
```
|
||||
greg.ci-runner.snarfblatt = {
|
||||
labels = [ "ubuntu-latest:docker://ubuntu:latest" ];
|
||||
};
|
||||
```
|
||||
'';
|
||||
|
||||
type = with types; attrsOf ( submodule (
|
||||
{ name, config, options, ... }:
|
||||
{
|
||||
options.labels = mkOption {
|
||||
type = (types.listOf types.str);
|
||||
default = [];
|
||||
description = ''List of labels. The syntax is
|
||||
more or less going to be something along the lines
|
||||
of `<runs-on-label>:docker://<actual docker image>` or
|
||||
`native:host` for a system that will support running
|
||||
commands directly on the server.'';
|
||||
};
|
||||
|
||||
options.packages = mkOption {
|
||||
type = (types.listOf types.package);
|
||||
default = [];
|
||||
description = ''List of extra packages that will be needed
|
||||
in the running environment for this worker.'';
|
||||
};
|
||||
|
||||
options.parallel = mkOption {
|
||||
type = types.int;
|
||||
default = 3;
|
||||
description = "The maximum number of parallel jobs this runner will support.";
|
||||
};
|
||||
})
|
||||
);
|
||||
};
|
||||
};
|
||||
|
||||
config = mkIf ( runnerNames != [] ) {
|
||||
services.gitea-actions-runner.instances = ( mapAttrs makeRunner cfg);
|
||||
|
||||
age.secrets.forgejo-runner = let
|
||||
aName = builtins.elemAt runnerNames 0;
|
||||
target = "gitea-runner-${aName}";
|
||||
in {
|
||||
file = ../secrets/${config.networking.hostName}-forgejo-runner.age;
|
||||
owner = userName;
|
||||
group = userName;
|
||||
};
|
||||
|
||||
users.users."${userName}" = {
|
||||
isSystemUser = true;
|
||||
group = "${userName}";
|
||||
};
|
||||
users.groups."${userName}" = {};
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,11 @@
|
||||
{ ... }:
|
||||
|
||||
{
|
||||
system.stateVersion = 4;
|
||||
programs = {
|
||||
zsh.enable = true;
|
||||
bash.enable = true;
|
||||
};
|
||||
services.nix-daemon.enable = true;
|
||||
nix.gc.interval.Hour = 24;
|
||||
}
|
||||
@@ -0,0 +1,66 @@
|
||||
{ pkgs, lib, ... }:
|
||||
|
||||
let
|
||||
inherit (lib.strings) hasSuffix;
|
||||
system = pkgs.system; in
|
||||
{
|
||||
imports = [
|
||||
./ci-runner.nix
|
||||
]
|
||||
++ (if (lib.strings.hasSuffix "darwin" "nope") then [./darwin] else [])
|
||||
++ (if (lib.strings.hasSuffix "linux" "linux") then [./linux] else []);
|
||||
|
||||
# Enable flakes
|
||||
nix = {
|
||||
package = pkgs.nixFlakes;
|
||||
gc = {
|
||||
automatic = true;
|
||||
# Scheduling of them is different in nixos vs nix-darwin, so check for
|
||||
# the extra details there
|
||||
options = "--delete-older-than 30d";
|
||||
};
|
||||
|
||||
settings = {
|
||||
auto-optimise-store = (if lib.strings.hasSuffix "darwin" pkgs.system then false else true);
|
||||
experimental-features = "nix-command flakes";
|
||||
keep-outputs = true;
|
||||
keep-derivations = true;
|
||||
min-free = (toString (1024 * 1024 * 1024) );
|
||||
max-free = (toString (5 * 1024 * 1024 * 1024) );
|
||||
substituters = [
|
||||
"https://cache.garnix.io"
|
||||
"https://ai.cachix.org"
|
||||
];
|
||||
trusted-public-keys = [
|
||||
"cache.garnix.io:CTFPyKSLcx5RMJKfLo5EEPUObbA78b0YQ2DTCJXqr9g="
|
||||
"ai.cachix.org-1:N9dzRK+alWwoKXQlnn0H6aUx0lU/mspIoz8hMvGvbbc="
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
nixpkgs.config = {
|
||||
allowUnfree = true;
|
||||
};
|
||||
|
||||
# Base packages that need to be in all my hosts
|
||||
environment.systemPackages = with pkgs; [
|
||||
agenix
|
||||
android-file-transfer
|
||||
bitwarden-cli
|
||||
diffutils
|
||||
git
|
||||
gh
|
||||
gnupatch
|
||||
gregpy
|
||||
findutils
|
||||
hms # My own home manager switcher
|
||||
htop
|
||||
killall
|
||||
nano
|
||||
pciutils
|
||||
pwgen
|
||||
transcrypt
|
||||
unzip
|
||||
wget
|
||||
];
|
||||
}
|
||||
@@ -0,0 +1,96 @@
|
||||
{ lib, config, pkgs, ... }:
|
||||
|
||||
let
|
||||
cfg = config.greg.backup;
|
||||
backup_key = "backup_keys/id_ed25519";
|
||||
|
||||
makeJob = name: job: {
|
||||
paths = job.src;
|
||||
encryption.mode = "none";
|
||||
environment.BORG_RSH = "ssh -i /etc/${backup_key} -o 'StrictHostKeyChecking=no' -o 'UserKnownHostsFile=/dev/null'";
|
||||
repo = "ssh://backup@nas.me.ts//volume1/NetBackup/${job.dest}";
|
||||
compression = "auto,zstd";
|
||||
startAt = "daily";
|
||||
|
||||
user = job.user;
|
||||
group = job.group;
|
||||
preHook = job.pre;
|
||||
postHook = job.post;
|
||||
};
|
||||
|
||||
cronJob = name: job:
|
||||
let
|
||||
binName = "backup-${name}";
|
||||
script = pkgs.writeShellScriptBin binName ''
|
||||
exec 1> >(systemd-cat -t $(basename $0)) 2>&1
|
||||
set -ex
|
||||
${job.pre}
|
||||
${pkgs.rsync}/bin/rsync -avz --delete -e "${pkgs.openssh}/bin/ssh -i /etc/${backup_key} -o 'StrictHostKeyChecking=no' -o 'UserKnownHostsFile=/dev/null'" ${job.src}/* backup@chronicles:/volume1/NetBackup/${job.dest}/
|
||||
${job.post}
|
||||
'';
|
||||
in {
|
||||
inherit script;
|
||||
cron = "0 1 * * * ${job.user} ${script}/bin/${binName}";
|
||||
};
|
||||
|
||||
in with lib; {
|
||||
options = {
|
||||
greg.backup = {
|
||||
key = mkOption {
|
||||
type = types.path;
|
||||
description = "SSH key to use";
|
||||
default = ../ssh/id_ed25519;
|
||||
};
|
||||
|
||||
jobs = mkOption {
|
||||
default = {};
|
||||
|
||||
type = with types; attrsOf (submodule (
|
||||
{ name, config, options, ... }:
|
||||
{
|
||||
options = {
|
||||
src = mkOption {
|
||||
type = types.str;
|
||||
description = "Local path (string form) to backup from";
|
||||
};
|
||||
|
||||
dest = mkOption {
|
||||
type = types.str;
|
||||
};
|
||||
|
||||
user = mkOption {
|
||||
type = types.str;
|
||||
default = "root";
|
||||
description = "User to run backup as";
|
||||
};
|
||||
|
||||
pre = mkOption {
|
||||
type = types.str;
|
||||
default = "";
|
||||
description = "Commands to run before backup";
|
||||
};
|
||||
|
||||
post = mkOption {
|
||||
type = types.str;
|
||||
default = "";
|
||||
description = "Commands to run after backup";
|
||||
};
|
||||
};
|
||||
}
|
||||
));
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
config = let
|
||||
jobs = attrValues ( mapAttrs cronJob cfg.jobs );
|
||||
in mkIf ( ( attrValues cfg.jobs ) != [] )
|
||||
{
|
||||
services.cron = {
|
||||
enable = true;
|
||||
systemCronJobs = map (e: e.cron) jobs;
|
||||
};
|
||||
|
||||
environment.systemPackages = map (e: e.script) jobs;
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,65 @@
|
||||
{ pkgs, ... }:
|
||||
|
||||
{
|
||||
imports = [
|
||||
./backup.nix
|
||||
./gnome.nix
|
||||
./home.nix
|
||||
./kde.nix
|
||||
./kiwix-serve.nix
|
||||
./linode.nix
|
||||
./linux.nix
|
||||
./proxy.nix
|
||||
./router.nix
|
||||
./rpi4.nix
|
||||
./tailscale.nix
|
||||
];
|
||||
|
||||
environment.systemPackages = with pkgs; [
|
||||
coreutils-full
|
||||
efibootmgr
|
||||
psmisc
|
||||
lshw
|
||||
];
|
||||
|
||||
system.stateVersion = "22.05";
|
||||
|
||||
nix.gc.dates = "weekly";
|
||||
|
||||
# I am a fan of network manager, myself
|
||||
networking = {
|
||||
search = [
|
||||
"thehellings.lan"
|
||||
"home"
|
||||
];
|
||||
networkmanager.enable = true;
|
||||
};
|
||||
|
||||
programs = {
|
||||
xonsh.enable = true;
|
||||
};
|
||||
|
||||
# Enable the OpenSSH daemon for remote control
|
||||
services = {
|
||||
openssh.enable = true;
|
||||
};
|
||||
|
||||
# Define a user account. Don't forget to set a password with ‘passwd’.
|
||||
users.users.greg = {
|
||||
isNormalUser = true;
|
||||
createHome = true;
|
||||
extraGroups = [ "wheel" "networkmanager" ]; # Enable ‘sudo’ for the user.
|
||||
shell = pkgs.xonsh;
|
||||
openssh.authorizedKeys.keys = [
|
||||
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAEAQDLQRq55JKqLifX+31kEXyuoB8gfM+5thAlgR7XLPvvdu6g2a5cCWyozQ1I2oGbPRfJtzcJ5ifM7Ii2PuqAj3MdYFLHBEDOhIpBBWme9Ts2YB9HJ4NorBvB4zEfJd0Q7k2MmylyeBOwdwGz3bVqPRDcJbxWFMDHqr33FEs6SXdfyAQ5SvhWGARI84qz8zUUdOp6M4e3aIGO3cx1gA+YzYQ4FbUtL8+m1NFO8VoNFMZBMf5q0iF/SgEu5bmGWUCePia6DvfeBFQ2/y4Y7WmOj980WE+JmFTkIvmGruMYeGI8FuDQ2JIIIcehddy9bQbPF4VlGnTFsHqJYVRUUWc+vH1cPNMn01oB8s27ogf9e1lyhIN+cZOgp/jDt4eXcO4Wr04uwj7CI6m+d8iMQOa5Jv0hmNgqqiwOMVBlKeo0FCxlovzwvn/Lia9WZ74JqM6JwLCD8SZ0oFgiSIHOTHrQhr7iaCmj7X/0ey7VR8FnCrpeAJpG+ELTfWGshF1d9QR2zW7u4EsXTDLiuOmdJ+/KxwMvjMcWdlg2+Qch6SwulTQRxWaED2IWJo+YiAql8eaiVXu/eZJGLoiskGFZnONoLrzIT4pSjakPlrSpn/M/GkP1pDpaMkr24OhJsGpJNEU3F1ZcOMqy2iJzIxlPmU8Xg0I/OrnbJplpaXeRCqnmouJUJhWkaPzawaVyW7dtvprLWcpQtUgTRet18WLyOrLKlq1jwvNRMTPKUJ2IFJMpk2pNEP6bdiUxyMa4vrRIEU2p1zsYSUJpCRLtccZ/i/+yAqwnTA2L5TdAORi9nD2uCdM/Ljz52V3A14QapS6oqcoWx2soWKgnsbVXoG8DxmUTpll77Ze9t7Y5216SMInWuOu0vstP8ZcgFmWsiBgIYIuLA58abWHMxgD251phYidua6R3Gtkf8J/kYqTR1P6eJF1bt5efEg7FD2aL1QQZsYJo3CRNz7yVe1XqMdPbfe2mFXQVF9TDX5x6r9Ir3d0KiEmTlBdByz8nSyPJ8IQxC58NT4LNVQs3p2XH2Zcf6B4JOBSmV4NNBnLseFobsxniWjkWwZigED/D2iu3OXuuhmskCbw0hKy2rBcKffaSNMioVqYIiYNfKlMlSvAacQKqc/1HCpqgX8PwAcSgNSLy4K7/gIrTHmjY+g+CH7onzatWzkLo+0vsZRa/D/qwhhK2CU2FeU07mhnWxWuzqpJuqVaAwDTaEforK7nQUtAOFAZZP6qGhIoqsynYt4THb+QORb3QYfaP0PVgQwXfVU5Q8eUQFZ8A+siPtOASFjDumsIbseB5VzkF+UhvdseJwkX2+4pVFu8eHFDyvArYsHeGK6fBcQGJFQc2jSs6doIP9HD9IO2R ghelling@unknown38BAF87CD102"
|
||||
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDv26EhyBZS9E5bcuZDHHkh/oeyINHXlsD3OEL1UjZekIsiHoMv2QHYq99cYO/CsTVGcZj4ZTOKxrQQ069Cm1II76nXJP9mb3+jip5QAE/zYSWfxi3SgQum95qmkQsx9mxeKFi4NfUU9qN9vpmJkn0hrvYWg8vU98bcYmkx4RtGW6EgZJed3347EtHshTqq3UfAbj3ErSQdCbEqgNOjokzGWmcx16HyyO5HoQj2FP7PGQmArzMz0V76BRsnpg97CoPKkoWoGk+P13BCWWXR9GCa2PbJ9uprzPa6Ib4+i9RJPdeSkUiLlFi6rBTHaZUT9WUIEaqNSq3bbu1bIqMXkifPeDw7m+TMfOBT8MUBciJaPlPTgXuz3T4kCHBI041hIt+/VqryGtxnT45IavyUaN3JWYntDbpG3eEW4N9IB2oGWuC/XuTJrsUaNpLPpApUKuozxhsFELBRepU+j+Wn4kgJJl8hy0n+WL63ZUee+/F23C7UNXoOc/wU3KbpxO6ipsTSkTzhZpQF2LOuA3JUs5t9ZaiCJ2P9r8axHiphCRcIYSbcCo3pZupf1eTDSXm+x9/UB2sfzErNEH4SdakoSdAi8jG8WhPVOs3BrIXjVBjvyBLeOH86EzBGR/Ba8X6MWoEW9Oau1C3P/z65VH8RHpvPvp6axlMynyVI1ygt5uheuQ== gregory.hellings@C02G48H8MD6R"
|
||||
];
|
||||
};
|
||||
|
||||
i18n.defaultLocale = "en_US.UTF-8";
|
||||
|
||||
console = {
|
||||
font = "Lat2-Terminus16";
|
||||
keyMap = "us";
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,63 @@
|
||||
{ config, pkgs, lib, ... }:
|
||||
|
||||
let
|
||||
cfg = config.greg.gnome;
|
||||
|
||||
in with lib; {
|
||||
options = {
|
||||
greg.gnome.enable = mkEnableOption "Enable my default Gnome3 setup";
|
||||
};
|
||||
|
||||
config = mkIf cfg.enable {
|
||||
# Sets up a basic Gnome installation
|
||||
services = {
|
||||
accounts-daemon.enable = true;
|
||||
|
||||
xserver = {
|
||||
enable = true;
|
||||
displayManager.gdm.enable = true;
|
||||
desktopManager.gnome.enable = true;
|
||||
layout = "us";
|
||||
# Trackpad support
|
||||
libinput.enable = true;
|
||||
};
|
||||
|
||||
udev.packages = with pkgs; [
|
||||
gnome3.gnome-settings-daemon
|
||||
];
|
||||
|
||||
pipewire.enable = true;
|
||||
|
||||
# Enablement for Firefox
|
||||
gnome = {
|
||||
gnome-browser-connector.enable = true;
|
||||
#chrome-gnome-shell.enable = true;
|
||||
sushi.enable = true;
|
||||
gnome-online-accounts.enable = true;
|
||||
};
|
||||
};
|
||||
|
||||
programs.dconf.enable = true;
|
||||
programs.sway.enable = true; # Gives us Wayland
|
||||
xdg.portal = {
|
||||
enable = true;
|
||||
wlr.enable = true; # Enables screen sharing in Wayland
|
||||
};
|
||||
|
||||
# Used by gsconnect
|
||||
networking.firewall.allowedTCPPorts = [ 1716 ];
|
||||
|
||||
# Enable some Gnome plugins that I like
|
||||
environment.systemPackages = with pkgs; [
|
||||
gnome3.adwaita-icon-theme
|
||||
gnome3.gnome-tweaks
|
||||
gnome3.dconf-editor
|
||||
gnomeExtensions.appindicator
|
||||
gnomeExtensions.clipboard-indicator
|
||||
gnomeExtensions.dash-to-dock
|
||||
gnomeExtensions.gsconnect
|
||||
gnomeExtensions.stocks-extension
|
||||
gnomeExtensions.vitals
|
||||
];
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,18 @@
|
||||
{ config, lib, ... }:
|
||||
|
||||
let
|
||||
cfg = config.greg.home;
|
||||
|
||||
in with lib;
|
||||
{
|
||||
options.greg.home = mkOption {
|
||||
type = types.bool;
|
||||
default = true;
|
||||
description = "Sets the device up to be part of my home network";
|
||||
};
|
||||
|
||||
config = mkIf cfg {
|
||||
time.timeZone = "America/Chicago";
|
||||
networking.domain = "thehellings.lan";
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,44 @@
|
||||
{ config, pkgs, lib, ... }:
|
||||
|
||||
let
|
||||
cfg = config.greg.kde;
|
||||
|
||||
in with lib; {
|
||||
options = {
|
||||
greg.kde.enable = mkEnableOption "Enable my default KDE setup";
|
||||
};
|
||||
|
||||
config = mkIf cfg.enable {
|
||||
# Sets up a basic KDE installation
|
||||
services = {
|
||||
xserver = {
|
||||
enable = true;
|
||||
displayManager.sddm.enable = true;
|
||||
desktopManager.plasma5.enable = true;
|
||||
layout = "us";
|
||||
# Trackpad support
|
||||
libinput.enable = true;
|
||||
};
|
||||
|
||||
pipewire = {
|
||||
enable = true;
|
||||
alsa.enable = true;
|
||||
alsa.support32Bit = true;
|
||||
pulse.enable = true;
|
||||
};
|
||||
};
|
||||
|
||||
programs.dconf.enable = true;
|
||||
programs.sway.enable = true; # Gives us Wayland
|
||||
xdg.portal = {
|
||||
enable = true;
|
||||
wlr.enable = true; # Enables screen sharing in Wayland
|
||||
};
|
||||
|
||||
environment.systemPackages = with pkgs; [
|
||||
kalendar
|
||||
korganizer
|
||||
plasma-pa
|
||||
];
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,48 @@
|
||||
{ config, pkgs, lib, ... }:
|
||||
|
||||
let
|
||||
cfg = config.services.kiwix-serve;
|
||||
in with lib; {
|
||||
options.services.kiwix-serve = {
|
||||
enable = mkEnableOption "Enable the Kiwix web server";
|
||||
|
||||
port = mkOption {
|
||||
type = types.int;
|
||||
default = 8888;
|
||||
description = "Port to serve the Kiwix HTTP service on";
|
||||
};
|
||||
|
||||
path = mkOption {
|
||||
type = types.str;
|
||||
default = "/var/lib/kiwix-serve/";
|
||||
description = "Path to Zim file(s) to serve";
|
||||
};
|
||||
|
||||
proxy = mkOption {
|
||||
type = types.str;
|
||||
default = "";
|
||||
description = ''Upstream proxy, if any, to configure with kiwix. Specify
|
||||
host and port. E.g. "localhost:8080"
|
||||
'';
|
||||
};
|
||||
};
|
||||
|
||||
config = mkIf cfg.enable {
|
||||
environment.systemPackages = [
|
||||
pkgs.kiwix-tools
|
||||
];
|
||||
|
||||
systemd.services.kiwix-serve = {
|
||||
enable = true;
|
||||
after = [ "network.service" ];
|
||||
description = "Runs the kiwix-serve binary as a sysmted service";
|
||||
restartTriggers = [ pkgs.kiwix-tools ];
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
script = "${pkgs.kiwix-tools}/bin/kiwix-serve --port ${toString cfg.port} ${cfg.path}";
|
||||
environment = {
|
||||
UPSTREAM_HOST = mkIf (cfg.proxy != "") cfg.proxy;
|
||||
UPSTREAM_WIKI = mkIf (cfg.proxy != "") cfg.proxy;
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,44 @@
|
||||
{ config, lib, pkgs, ... }:
|
||||
|
||||
let
|
||||
cfg = config.greg.linode;
|
||||
|
||||
in with lib;
|
||||
{
|
||||
options.greg.linode = {
|
||||
enable = mkEnableOption "Set sensible defaults for a Linode host";
|
||||
|
||||
bootTimeout = mkOption {
|
||||
type = types.int;
|
||||
default = 15;
|
||||
description = "Set bootloader timeout in seconds.";
|
||||
};
|
||||
};
|
||||
|
||||
config = mkIf cfg.enable {
|
||||
# Enables connection over Linode consoles
|
||||
boot.kernelParams = [ "console=ttyS0,19200n8" ];
|
||||
boot.loader.grub = {
|
||||
device = "nodev";
|
||||
extraConfig = ''
|
||||
serial --speed=19200 --unit=0 --word=8 --parity=no --stop=1;
|
||||
terminal_input serial;
|
||||
terminal_output serial;
|
||||
'';
|
||||
};
|
||||
|
||||
# Tells grub to ignore partion-free device warnings, since we are on Linode
|
||||
boot.loader.timeout = 15;
|
||||
|
||||
networking.usePredictableInterfaceNames = false; # Use old style eth0 names
|
||||
networking.useDHCP = false;
|
||||
networking.interfaces.eth0.useDHCP = true;
|
||||
|
||||
# Suggested diagnostic tools
|
||||
environment.systemPackages = with pkgs; [
|
||||
inetutils
|
||||
mtr
|
||||
sysstat
|
||||
];
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,11 @@
|
||||
{ config, lib, ... }:
|
||||
|
||||
let
|
||||
cfg = config.greg.linux;
|
||||
|
||||
in with lib; {
|
||||
options.greg.linux = mkEnableOption "This system is Linux";
|
||||
|
||||
config = mkIf cfg {
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,87 @@
|
||||
{ config, lib, pkgs, ... }:
|
||||
|
||||
let
|
||||
cfg = config.greg.proxies;
|
||||
|
||||
alias = name: with builtins; head (split "\\." name);
|
||||
|
||||
makeHost = name: dest: {
|
||||
forceSSL = dest.ssl;
|
||||
enableACME = dest.ssl;
|
||||
locations."${dest.path}" = {
|
||||
proxyPass = dest.target;
|
||||
extraConfig = ''
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Upgrade $http_upgrade;
|
||||
proxy_set_header Connection $connection_upgrade;
|
||||
'' + dest.extraConfig;
|
||||
};
|
||||
serverAliases = lib.mkIf dest.genAliases [ "${alias name}" ];
|
||||
};
|
||||
|
||||
in with lib; {
|
||||
options = {
|
||||
greg.proxies = mkOption {
|
||||
default = {};
|
||||
example = literalExpression ''
|
||||
{ host-name = {
|
||||
target = proxyLocation;
|
||||
ssl = true;
|
||||
};
|
||||
'';
|
||||
description = ''
|
||||
Quick and simple Nginx proxy configurations.
|
||||
Use this to configure a very simple proxy that does not
|
||||
need any extra customization options other than SSL
|
||||
enablement.
|
||||
'';
|
||||
|
||||
type = with types; attrsOf (submodule (
|
||||
{ name, config, options, ... }:
|
||||
{
|
||||
options = {
|
||||
genAliases = mkOption {
|
||||
type = types.bool;
|
||||
description = "Whether to auto-generate short alias name";
|
||||
default = true;
|
||||
};
|
||||
|
||||
target = mkOption {
|
||||
type = types.str;
|
||||
description = ''The destination that is being proxied.'';
|
||||
example = "http://localhost:8080";
|
||||
};
|
||||
|
||||
ssl = mkOption {
|
||||
type = types.bool;
|
||||
description = "Whether to enable SSL in front of the proxy";
|
||||
default = false;
|
||||
};
|
||||
|
||||
path = mkOption {
|
||||
type = types.str;
|
||||
description = "The path prefix for this proxy";
|
||||
default = "/";
|
||||
};
|
||||
|
||||
extraConfig = mkOption {
|
||||
type = types.str;
|
||||
description = "Extra nginx config options";
|
||||
default = "";
|
||||
};
|
||||
};
|
||||
}));
|
||||
};
|
||||
};
|
||||
|
||||
config.services.nginx = mkIf ( ( attrValues cfg ) != [] ) {
|
||||
enable = true;
|
||||
|
||||
recommendedGzipSettings = true;
|
||||
recommendedOptimisation = true;
|
||||
recommendedProxySettings = true;
|
||||
recommendedTlsSettings = true;
|
||||
|
||||
virtualHosts = mapAttrs makeHost cfg;
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,93 @@
|
||||
{ config, lib, pkgs, ... }:
|
||||
|
||||
let
|
||||
names = mylist: (lib.strings.concatMapStringsSep "," (x: ''"${x}"'') mylist);
|
||||
# Pass the names of the wan/lan ports
|
||||
nftConfig = {
|
||||
wan,
|
||||
lan,
|
||||
limitedLan ? [],
|
||||
openPorts ? [ "ssh" "67" "53" ], # ssh, dhcpd, dns
|
||||
openUDPPorts ? [ "67" "53" ] # dhcpd, dns
|
||||
}: let
|
||||
lanList = names lan;
|
||||
allLan = names (lan ++ limitedLan);
|
||||
wanName = names wan;
|
||||
portsString = lib.strings.concatMapStringsSep "\n" (x: "iifname { ${lanList}, \"tailscale0\" } tcp dport ${toString x} accept") openPorts;
|
||||
udpPortsString = lib.strings.concatMapStringsSep "\n" (x: "iifname { ${lanList}, \"tailscale0\" } udp dport ${toString x} accept") openUDPPorts;
|
||||
in lib.strings.concatStringsSep "\n" [
|
||||
"table ip filter {"
|
||||
" chain output {"
|
||||
" type filter hook output priority 100; policy accept;"
|
||||
" }"
|
||||
|
||||
" chain input {"
|
||||
" type filter hook input priority 0; policy drop;"
|
||||
|
||||
" iifname lo accept"
|
||||
portsString
|
||||
udpPortsString
|
||||
" iifname { ${lanList} } accept comment \"Allows LAN traffic and outgoing\""
|
||||
" iifname { ${wanName} } ct state { established, related } accept comment \"Allows existing connections\""
|
||||
" iifname { ${wanName} } icmp type { echo-request, destination-unreachable, time-exceeded } counter accept comment \"Allow some ICMP traffic\""
|
||||
" iifname { ${wanName} } counter drop comment \"Drop other incoming traffic, and count how much\""
|
||||
" }"
|
||||
" chain forward {"
|
||||
" type filter hook forward priority 0; policy drop;"
|
||||
" iifname { ${allLan} } oifname { ${wanName} } accept comment \"Forward LAN to WAN\""
|
||||
" iifname { ${wanName} } oifname { ${allLan} } ct state established, related accept comment \"Allow incoming established traffic\""
|
||||
" }"
|
||||
"}"
|
||||
|
||||
"table ip nat {"
|
||||
" chain postrouting {"
|
||||
" type nat hook postrouting priority 100; policy accept;"
|
||||
" oifname { ${wanName} } masquerade"
|
||||
" }"
|
||||
"}"
|
||||
|
||||
"table ip6 filter {"
|
||||
" chain input {"
|
||||
" type filter hook input priority 0; policy drop;"
|
||||
" }"
|
||||
" chain forward {"
|
||||
" type filter hook forward priority 0; policy drop;"
|
||||
" }"
|
||||
"}"
|
||||
];
|
||||
cfg = config.greg.router;
|
||||
|
||||
in with lib; {
|
||||
options.greg.router = {
|
||||
enable = mkEnableOption "Enable NFTables and routing";
|
||||
wan = mkOption {
|
||||
type = (types.listOf types.str);
|
||||
description = "The name of the network interface that is the WAN connection";
|
||||
};
|
||||
lan = mkOption {
|
||||
type = (types.listOf types.str);
|
||||
description = "A list of all network interfaces that are considered LAN connections";
|
||||
};
|
||||
limited = mkOption {
|
||||
type = (types.listOf types.str);
|
||||
description = "A list of limited access LAN connections - such as IOT connections and similar.";
|
||||
default = [];
|
||||
};
|
||||
};
|
||||
|
||||
config = mkIf cfg.enable {
|
||||
networking.nftables = {
|
||||
enable = true;
|
||||
ruleset = (nftConfig {
|
||||
inherit (cfg) lan wan;
|
||||
openPorts = config.networking.firewall.allowedTCPPorts;
|
||||
openUDPPorts = config.networking.firewall.allowedUDPPorts;
|
||||
});
|
||||
};
|
||||
|
||||
environment.systemPackages = [
|
||||
pkgs.pciutils
|
||||
pkgs.tcpdump
|
||||
];
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,43 @@
|
||||
{ config, lib, pkgs, ... }:
|
||||
|
||||
let
|
||||
cfg = config.greg.rpi4;
|
||||
|
||||
in with lib; {
|
||||
options = {
|
||||
greg.rpi4 = {
|
||||
enable = mkEnableOption "Enable support for Raspberry Pi 4s";
|
||||
};
|
||||
};
|
||||
|
||||
config = mkIf cfg.enable {
|
||||
boot = {
|
||||
# This prevents us from having to compile our own kernel
|
||||
kernelPackages = pkgs.linuxPackages_rpi4;
|
||||
kernelParams = [
|
||||
"8250.nr_uarts=1"
|
||||
"console=ttyAMA0,115200"
|
||||
"console=tty1"
|
||||
"cma=128M"
|
||||
];
|
||||
|
||||
loader = {
|
||||
raspberryPi = {
|
||||
enable = true;
|
||||
version = 4;
|
||||
};
|
||||
|
||||
# Use the extlinux boot loader. (NixOS wants to enable GRUB by default)
|
||||
grub.enable = false;
|
||||
|
||||
# Enables the generation of /boot/extlinux/extlinux.conf
|
||||
#generic-extlinux-compatible.enable = true;
|
||||
};
|
||||
};
|
||||
|
||||
environment.systemPackages = with pkgs; [
|
||||
raspberrypifw
|
||||
usbutils
|
||||
];
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,18 @@
|
||||
{ lib, config, ... }:
|
||||
|
||||
let
|
||||
cfg = config.greg.tailscale;
|
||||
in {
|
||||
options = {
|
||||
greg.tailscale.enable = lib.mkEnableOption "Enable Tailscale";
|
||||
};
|
||||
|
||||
config = lib.mkIf cfg.enable {
|
||||
services.tailscale.enable = true;
|
||||
networking.firewall.checkReversePath = "loose";
|
||||
boot.kernel.sysctl = {
|
||||
"net.ipv4.ip_forward" = "1";
|
||||
"net.ipv6.conf.all.forwarding" = "1";
|
||||
};
|
||||
};
|
||||
}
|
||||
Reference in New Issue
Block a user