greg/nixos
1
0
Fork 1
Code Issues Pull Requests 2 Actions Packages Projects Releases Wiki Activity

Move genesis to Proxmox VE

Browse Source
This commit is contained in:
Greg Hellings
2023-09-02 20:07:12 -05:00
parent 153b8d8b96
commit 6446207eb2
5 changed files with 149 additions and 104 deletions
Download Patch File Download Diff File Expand all files Collapse all files
hosts/gen2/default.nix
+96
View File
@@ -0,0 +1,96 @@
# Edit this configuration file to define what should be installed on
# your system. Help is available in the configuration.nix(5) man page
# and in the NixOS manual (accessible by running ‘nixos-help’).
{ config, pkgs, ... }:
{
imports =
[ # Include the results of the hardware scan.
./hardware-configuration.nix
];
# Bootloader.
boot.loader.grub.enable = true;
boot.loader.grub.device = "/dev/vda";
boot.loader.grub.useOSProber = true;
nix.settings.experimental-features = "nix-command flakes";
networking.hostName = "nixos"; # Define your hostname.
# networking.wireless.enable = true; # Enables wireless support via wpa_supplicant.
# Configure network proxy if necessary
# networking.proxy.default = "http://user:password@proxy:port/";
# networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";
# Enable networking
networking.networkmanager.enable = true;
# Set your time zone.
time.timeZone = "America/Chicago";
# Select internationalisation properties.
i18n.defaultLocale = "en_US.UTF-8";
i18n.extraLocaleSettings = {
LC_ADDRESS = "en_US.UTF-8";
LC_IDENTIFICATION = "en_US.UTF-8";
LC_MEASUREMENT = "en_US.UTF-8";
LC_MONETARY = "en_US.UTF-8";
LC_NAME = "en_US.UTF-8";
LC_NUMERIC = "en_US.UTF-8";
LC_PAPER = "en_US.UTF-8";
LC_TELEPHONE = "en_US.UTF-8";
LC_TIME = "en_US.UTF-8";
};
# Configure keymap in X11
services.xserver = {
layout = "us";
xkbVariant = "";
};
# Define a user account. Don't forget to set a password with ‘passwd’.
users.users.greg = {
isNormalUser = true;
description = "Greg Hellings";
extraGroups = [ "networkmanager" "wheel" ];
packages = with pkgs; [];
};
# List packages installed in system profile. To search, run:
# $ nix search wget
environment.systemPackages = with pkgs; [
git
vim # Do not forget to add an editor to edit configuration.nix! The Nano editor is also installed by default.
# wget
];
# Some programs need SUID wrappers, can be configured further or are
# started in user sessions.
# programs.mtr.enable = true;
# programs.gnupg.agent = {
# enable = true;
# enableSSHSupport = true;
# };
# List services that you want to enable:
# Enable the OpenSSH daemon.
# services.openssh.enable = true;
# Open ports in the firewall.
# networking.firewall.allowedTCPPorts = [ ... ];
# networking.firewall.allowedUDPPorts = [ ... ];
# Or disable the firewall altogether.
# networking.firewall.enable = false;
# This value determines the NixOS release from which the default
# settings for stateful data, like file locations and database versions
# on your system were taken. It‘s perfectly fine and recommended to leave
# this value at the release version of the first install of this system.
# Before changing this value read the documentation for this option
# (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
system.stateVersion = "23.05"; # Did you read the comment?
}
hosts/genesis/default.nix
+12 -25
View File
@@ -18,32 +18,19 @@
greg.gnome.enable = false;
# Bootloader.
boot.loader = {
systemd-boot.enable = true;
efi = {
canTouchEfiVariables = true;
efiSysMountPoint = "/boot/efi";
};
boot.loader.grub = {
enable = true;
device = "/dev/vda";
useOSProber = true;
};
#boot.loader = {
# systemd-boot.enable = true;
# efi = {
# canTouchEfiVariables = true;
# efiSysMountPoint = "/boot/efi";
# };
#};
networking.hostName = "genesis"; # Define your hostname.
# Enable sound with pipewire.
sound.enable = true;
hardware.pulseaudio.enable = false;
security.rtkit.enable = true;
services.pipewire = {
enable = true;
alsa = {
enable = true;
support32Bit = true;
};
pulse.enable = true;
# If you want to use JACK applications, uncomment this
#jack.enable = true;
# use the example session manager (no others are packaged yet so this is enabled by default,
# no need to redefine it in your config for now)
#media-session.enable = true;
};
}
hosts/genesis/dnsmasq.nix
+4 -3
View File
@@ -4,10 +4,11 @@ let
extraHosts = builtins.concatStringsSep "\n" [
# Local hosts
"10.42.0.1 switch"
"10.42.1.1 router genesis genesis.thehellings.lan dns dns.thehellings.lan smart smart.thehellings.lan jellyfin jellyfin.thehellings.lan"
#"10.42.1.2 2maccabees 2maccabees.thehellings.lan dns dns.thehellings.lan smart smart.thehellings.lan jellyfin jellyfin.thehellings.lan"
"10.42.1.1 pve1.thehellings.lan"
"10.42.1.2 opnsense router opnsense.thehellings.lan router.thehellings.lan"
"10.42.1.3 printer"
"10.42.1.4 chronicles nas"
"10.42.1.5 router genesis genesis.thehellings.lan dns dns.thehellings.lan smart smart.thehellings.lan jellyfin jellyfin.thehellings.lan"
"10.42.1.12 tv"
# Tailscale hosts
@@ -23,7 +24,7 @@ let
extraConfig = builtins.concatStringsSep "\n" [
];
lanDevice = "enp1s0";
lanDevice = "enp0s18";
adblockUpdate = pkgs.writeShellScriptBin "adblockUpdate" (builtins.readFile ./adblockUpdate.sh);
in
hosts/genesis/hardware-configuration.nix
+27 -38
View File
@@ -4,42 +4,31 @@
{ config, lib, pkgs, modulesPath, ... }:
{
imports = [
(modulesPath + "/installer/scan/not-detected.nix")
];
boot = {
initrd = {
availableKernelModules = [ "xhci_pci" "ahci" "nvme" "usb_storage" "sd_mod" ];
kernelModules = [ ];
};
kernelModules = [ "kvm-intel" ];
extraModulePackages = [ ];
};
fileSystems."/" = {
device = "/dev/disk/by-uuid/a509426b-5af7-4d04-ac42-619674d932d9";
fsType = "btrfs";
options = [ "subvol=@" ];
};
fileSystems."/boot/efi" = {
device = "/dev/disk/by-uuid/5AC6-50D7";
fsType = "vfat";
};
swapDevices = [ {
device = "/dev/disk/by-uuid/a57f8b82-dc0c-4906-8a48-56203d07556b";
} ];
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
# (the default) this is the recommended approach. When using systemd-networkd it's
# still possible to use this option, but it's recommended to use it in conjunction
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
# networking.interfaces.enp1s0.useDHCP = lib.mkDefault true;
# networking.interfaces.enp2s0.useDHCP = lib.mkDefault true;
# networking.interfaces.eth2.useDHCP = lib.mkDefault true;
powerManagement.cpuFreqGovernor = lib.mkDefault "powersave";
hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
imports =
[ (modulesPath + "/profiles/qemu-guest.nix")
];
boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "sr_mod" "virtio_blk" ];
boot.initrd.kernelModules = [ ];
boot.kernelModules = [ ];
boot.extraModulePackages = [ ];
fileSystems."/" =
{ device = "/dev/disk/by-uuid/a13f941e-4985-47ab-a8c6-374a627c5ce1";
fsType = "ext4";
};
swapDevices =
[ { device = "/dev/disk/by-uuid/ac4557de-1ad5-4d3c-b9f4-5ec50dbf76f1"; }
];
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
# (the default) this is the recommended approach. When using systemd-networkd it's
# still possible to use this option, but it's recommended to use it in conjunction
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
networking.useDHCP = lib.mkDefault true;
# networking.interfaces.ens18.useDHCP = lib.mkDefault true;
# networking.interfaces.ens19.useDHCP = lib.mkDefault true;
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
}
hosts/genesis/networking.nix
+10 -38
View File
@@ -1,15 +1,13 @@
{ pkgs, config, ... }:
let
lan = "enp1s0";
wan = "enp2s0";
iot = "vlan66";
lan = "ens18";
iot = "ens19";
in {
greg.tailscale.enable = true;
# Really, why do I still have to force-disable this crap?
boot.kernel.sysctl = {
"net.ipv6.conf.${lan}.disable_ipv6" = true;
"net.ipv6.conf.${wan}.disable_ipv6" = true;
"net.ipv6.conf.${iot}.disable_ipv6" = true;
"net.ipv6.conf.lo.disable_ipv6" = true;
};
@@ -17,59 +15,31 @@ in {
networking = {
enableIPv6 = false;
networkmanager.enable = pkgs.lib.mkForce false;
#defaultGateway = "10.42.1.1";
# 100.100.100.100 is the tailscale DNS
defaultGateway = "10.42.1.1";
nameservers = [
"1.1.1.1"
#"100.100.100.100"
"1.0.0.1"
"127.0.0.1"
];
interfaces = {
# This is our WAN port
"${wan}" = {
useDHCP = true;
};
# This is our LAN port
"${lan}" = {
useDHCP = false;
ipv4.addresses = [ {
address = "10.42.1.1";
address = "10.42.1.5";
prefixLength = 16;
} ];
useDHCP = false;
};
wlan0.useDHCP = false;
"${iot}" = {
useDHCP = false;
ipv4.addresses = [ {
address = "192.168.66.1";
address = "192.168.66.250";
prefixLength = 24;
} ];
};
};
vlans = {
"${iot}" = {
id = 66;
interface = lan;
};
};
firewall.enable = false;
# Router portion here
nftables = let
myvars = {
lanInterfaces = [ lan ];
wanInterface = wan;
limitedLan = [ iot ];
tcpPorts = config.networking.firewall.allowedTCPPorts;
udpPorts = config.networking.firewall.allowedUDPPorts;
};
in {
enable = true;
rulesetFile = pkgs.template "router.nft" myvars ./nftables.nft;
};
firewall.enable = true;
};
@@ -83,6 +53,8 @@ in {
enable = true;
openFirewall = true;
};
# Used for service auto-disocvery
networking.firewall.allowedUDPPorts = [ 1900 7359 ];
greg.proxies = {
"jellyfin.thehellings.lan".target = "http://localhost:8096";