Move genesis to Proxmox VE

hosts/gen2/default.nix

@@ -0,0 +1,96 @@
+# Edit this configuration file to define what should be installed on
+# your system.  Help is available in the configuration.nix(5) man page
+# and in the NixOS manual (accessible by running ‘nixos-help’).
+
+{ config, pkgs, ... }:
+
+{
+  imports =
+    [ # Include the results of the hardware scan.
+      ./hardware-configuration.nix
+    ];
+
+  # Bootloader.
+  boot.loader.grub.enable = true;
+  boot.loader.grub.device = "/dev/vda";
+  boot.loader.grub.useOSProber = true;
+
+  nix.settings.experimental-features = "nix-command flakes";
+  networking.hostName = "nixos"; # Define your hostname.
+  # networking.wireless.enable = true;  # Enables wireless support via wpa_supplicant.
+
+  # Configure network proxy if necessary
+  # networking.proxy.default = "http://user:password@proxy:port/";
+  # networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";
+
+  # Enable networking
+  networking.networkmanager.enable = true;
+
+  # Set your time zone.
+  time.timeZone = "America/Chicago";
+
+  # Select internationalisation properties.
+  i18n.defaultLocale = "en_US.UTF-8";
+
+  i18n.extraLocaleSettings = {
+    LC_ADDRESS = "en_US.UTF-8";
+    LC_IDENTIFICATION = "en_US.UTF-8";
+    LC_MEASUREMENT = "en_US.UTF-8";
+    LC_MONETARY = "en_US.UTF-8";
+    LC_NAME = "en_US.UTF-8";
+    LC_NUMERIC = "en_US.UTF-8";
+    LC_PAPER = "en_US.UTF-8";
+    LC_TELEPHONE = "en_US.UTF-8";
+    LC_TIME = "en_US.UTF-8";
+  };
+
+  # Configure keymap in X11
+  services.xserver = {
+    layout = "us";
+    xkbVariant = "";
+  };
+
+  # Define a user account. Don't forget to set a password with ‘passwd’.
+  users.users.greg = {
+    isNormalUser = true;
+    description = "Greg Hellings";
+    extraGroups = [ "networkmanager" "wheel" ];
+    packages = with pkgs; [];
+  };
+
+  # List packages installed in system profile. To search, run:
+  # $ nix search wget
+  environment.systemPackages = with pkgs; [
+    git
+    vim # Do not forget to add an editor to edit configuration.nix! The Nano editor is also installed by default.
+  #  wget
+  ];
+
+  # Some programs need SUID wrappers, can be configured further or are
+  # started in user sessions.
+  # programs.mtr.enable = true;
+  # programs.gnupg.agent = {
+  #   enable = true;
+  #   enableSSHSupport = true;
+  # };
+
+  # List services that you want to enable:
+
+  # Enable the OpenSSH daemon.
+  # services.openssh.enable = true;
+
+  # Open ports in the firewall.
+  # networking.firewall.allowedTCPPorts = [ ... ];
+  # networking.firewall.allowedUDPPorts = [ ... ];
+  # Or disable the firewall altogether.
+  # networking.firewall.enable = false;
+
+  # This value determines the NixOS release from which the default
+  # settings for stateful data, like file locations and database versions
+  # on your system were taken. It‘s perfectly fine and recommended to leave
+  # this value at the release version of the first install of this system.
+  # Before changing this value read the documentation for this option
+  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
+  system.stateVersion = "23.05"; # Did you read the comment?
+
+}

hosts/genesis/default.nix

@@ -18,32 +18,19 @@
 	greg.gnome.enable = false;
 	
 	# Bootloader.
-	boot.loader = {
+	boot.loader.grub = {
-		systemd-boot.enable = true;
+		enable = true;
-		efi = {
+		device = "/dev/vda";
-			canTouchEfiVariables = true;
+		useOSProber = true;
-			efiSysMountPoint = "/boot/efi";
-		};
 	};
+
+	#boot.loader = {
+	#	systemd-boot.enable = true;
+	#	efi = {
+	#		canTouchEfiVariables = true;
+	#		efiSysMountPoint = "/boot/efi";
+	#	};
+	#};
 	
 	networking.hostName = "genesis"; # Define your hostname.
-	
-	# Enable sound with pipewire.
-	sound.enable = true;
-	hardware.pulseaudio.enable = false;
-	security.rtkit.enable = true;
-	services.pipewire = {
-		enable = true;
-		alsa = {
-			enable = true;
-			support32Bit = true;
-		};
-		pulse.enable = true;
-		# If you want to use JACK applications, uncomment this
-		#jack.enable = true;
-		
-		# use the example session manager (no others are packaged yet so this is enabled by default,
-		# no need to redefine it in your config for now)
-		#media-session.enable = true;
-	};
 }

hosts/genesis/dnsmasq.nix

@@ -4,10 +4,11 @@ let
 	extraHosts = builtins.concatStringsSep "\n" [
 		# Local hosts
 		"10.42.0.1 switch"
-		"10.42.1.1 router genesis genesis.thehellings.lan dns dns.thehellings.lan smart smart.thehellings.lan jellyfin jellyfin.thehellings.lan"
+		"10.42.1.1 pve1.thehellings.lan"
-		#"10.42.1.2 2maccabees 2maccabees.thehellings.lan dns dns.thehellings.lan smart smart.thehellings.lan jellyfin jellyfin.thehellings.lan"
+		"10.42.1.2 opnsense router opnsense.thehellings.lan router.thehellings.lan"
 		"10.42.1.3 printer"
 		"10.42.1.4 chronicles nas"
+		"10.42.1.5 router genesis genesis.thehellings.lan dns dns.thehellings.lan smart smart.thehellings.lan jellyfin jellyfin.thehellings.lan"
 		"10.42.1.12 tv"
 
 		# Tailscale hosts
@@ -23,7 +24,7 @@ let
 	extraConfig = builtins.concatStringsSep "\n" [
 	];
 
-	lanDevice = "enp1s0";
+	lanDevice = "enp0s18";
 
 	adblockUpdate = pkgs.writeShellScriptBin "adblockUpdate" (builtins.readFile ./adblockUpdate.sh);
 in

hosts/genesis/hardware-configuration.nix

@@ -4,42 +4,31 @@
 { config, lib, pkgs, modulesPath, ... }:
 
 {
-	imports = [
+  imports =
-		(modulesPath + "/installer/scan/not-detected.nix")
+    [ (modulesPath + "/profiles/qemu-guest.nix")
-	];
+    ];
-	
+
-	boot = {
+  boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "sr_mod" "virtio_blk" ];
-		initrd = {
+  boot.initrd.kernelModules = [ ];
-			availableKernelModules = [ "xhci_pci" "ahci" "nvme" "usb_storage" "sd_mod" ];
+  boot.kernelModules = [ ];
-			kernelModules = [ ];
+  boot.extraModulePackages = [ ];
-		};
+
-		kernelModules = [ "kvm-intel" ];
+  fileSystems."/" =
-		extraModulePackages = [ ];
+    { device = "/dev/disk/by-uuid/a13f941e-4985-47ab-a8c6-374a627c5ce1";
-	};
+      fsType = "ext4";
-	
+    };
-	fileSystems."/" = {
+
-		device = "/dev/disk/by-uuid/a509426b-5af7-4d04-ac42-619674d932d9";
+  swapDevices =
-		fsType = "btrfs";
+    [ { device = "/dev/disk/by-uuid/ac4557de-1ad5-4d3c-b9f4-5ec50dbf76f1"; }
-		options = [ "subvol=@" ];
+    ];
-	};
+
-	
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
-	fileSystems."/boot/efi" = {
+  # (the default) this is the recommended approach. When using systemd-networkd it's
-		device = "/dev/disk/by-uuid/5AC6-50D7";
+  # still possible to use this option, but it's recommended to use it in conjunction
-		fsType = "vfat";
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
-	};
+  networking.useDHCP = lib.mkDefault true;
-	
+  # networking.interfaces.ens18.useDHCP = lib.mkDefault true;
-	swapDevices = [ {
+  # networking.interfaces.ens19.useDHCP = lib.mkDefault true;
-		device = "/dev/disk/by-uuid/a57f8b82-dc0c-4906-8a48-56203d07556b";
+
-	} ];
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
-	
-	# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
-	# (the default) this is the recommended approach. When using systemd-networkd it's
-	# still possible to use this option, but it's recommended to use it in conjunction
-	# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
-	# networking.interfaces.enp1s0.useDHCP = lib.mkDefault true;
-	# networking.interfaces.enp2s0.useDHCP = lib.mkDefault true;
-	# networking.interfaces.eth2.useDHCP = lib.mkDefault true;
-	
-	powerManagement.cpuFreqGovernor = lib.mkDefault "powersave";
-	hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
 }

hosts/genesis/networking.nix

@@ -1,15 +1,13 @@
 { pkgs, config, ... }:
 let
-	lan = "enp1s0";
+	lan = "ens18";
-	wan = "enp2s0";
+	iot = "ens19";
-	iot = "vlan66";
 in {
 	greg.tailscale.enable = true;
 
 	# Really, why do I still have to force-disable this crap?
 	boot.kernel.sysctl = {
 		"net.ipv6.conf.${lan}.disable_ipv6" = true;
-		"net.ipv6.conf.${wan}.disable_ipv6" = true;
 		"net.ipv6.conf.${iot}.disable_ipv6" = true;
 		"net.ipv6.conf.lo.disable_ipv6" = true;
 	};
@@ -17,59 +15,31 @@ in {
 	networking = {
 		enableIPv6 = false;
 		networkmanager.enable = pkgs.lib.mkForce false;
-		#defaultGateway = "10.42.1.1";
+		defaultGateway = "10.42.1.1";
-		# 100.100.100.100 is the tailscale DNS
 		nameservers = [
 			"1.1.1.1"
-			#"100.100.100.100"
+			"1.0.0.1"
 			"127.0.0.1"
 		];
 		interfaces = {
-			# This is our WAN port
-			"${wan}" = {
-				useDHCP = true;
-			};
-
 			# This is our LAN port
 			"${lan}" = {
+				useDHCP = false;
 				ipv4.addresses = [ {
-					address = "10.42.1.1";
+					address = "10.42.1.5";
 					prefixLength = 16;
 				} ];
-				useDHCP = false;
 			};
-			wlan0.useDHCP = false;
 
 			"${iot}" = {
 				useDHCP = false;
 				ipv4.addresses = [ {
-					address = "192.168.66.1";
+					address = "192.168.66.250";
 					prefixLength = 24;
 				} ];
 			};
 		};
-
+		firewall.enable = true;
-		vlans = {
-			"${iot}" = {
-				id = 66;
-				interface = lan;
-			};
-		};
-
-		firewall.enable = false;
-		# Router portion here
-		nftables = let
-			myvars = {
-				lanInterfaces = [ lan ];
-				wanInterface = wan;
-				limitedLan = [ iot ];
-				tcpPorts = config.networking.firewall.allowedTCPPorts;
-				udpPorts = config.networking.firewall.allowedUDPPorts;
-			};
-		in {
-			enable = true;
-			rulesetFile = pkgs.template "router.nft" myvars ./nftables.nft;
-		};
 	};
 
 
@@ -83,6 +53,8 @@ in {
 		enable = true;
 		openFirewall = true;
 	};
+	# Used for service auto-disocvery
+	networking.firewall.allowedUDPPorts = [ 1900 7359 ];
 
 	greg.proxies = {
 		"jellyfin.thehellings.lan".target = "http://localhost:8096";