Basic network server setup
This commit is contained in:
Greg Hellings
+41
-35
@@ -5,39 +5,45 @@
|
||||
{ config, pkgs, ... }:
|
||||
|
||||
{
|
||||
imports =
|
||||
[ # Include the results of the hardware scan.
|
||||
./dnsmasq.nix
|
||||
./hardware-configuration.nix
|
||||
./home-assistant.nix
|
||||
./networking.nix
|
||||
./vhosts.nix
|
||||
];
|
||||
|
||||
greg.home = true;
|
||||
greg.gnome.enable = true;
|
||||
|
||||
# Bootloader.
|
||||
boot.loader.systemd-boot.enable = true;
|
||||
boot.loader.efi.canTouchEfiVariables = true;
|
||||
boot.loader.efi.efiSysMountPoint = "/boot/efi";
|
||||
|
||||
networking.hostName = "genesis"; # Define your hostname.
|
||||
|
||||
# Enable sound with pipewire.
|
||||
sound.enable = true;
|
||||
hardware.pulseaudio.enable = false;
|
||||
security.rtkit.enable = true;
|
||||
services.pipewire = {
|
||||
enable = true;
|
||||
alsa.enable = true;
|
||||
alsa.support32Bit = true;
|
||||
pulse.enable = true;
|
||||
# If you want to use JACK applications, uncomment this
|
||||
#jack.enable = true;
|
||||
|
||||
# use the example session manager (no others are packaged yet so this is enabled by default,
|
||||
# no need to redefine it in your config for now)
|
||||
#media-session.enable = true;
|
||||
};
|
||||
imports = [
|
||||
# Include the results of the hardware scan.
|
||||
./dnsmasq.nix
|
||||
./hardware-configuration.nix
|
||||
./home-assistant.nix
|
||||
./networking.nix
|
||||
./vhosts.nix
|
||||
];
|
||||
|
||||
greg.home = true;
|
||||
greg.gnome.enable = true;
|
||||
|
||||
# Bootloader.
|
||||
boot.loader = {
|
||||
systemd-boot.enable = true;
|
||||
efi = {
|
||||
canTouchEfiVariables = true;
|
||||
efiSysMountPoint = "/boot/efi";
|
||||
};
|
||||
};
|
||||
|
||||
networking.hostName = "genesis"; # Define your hostname.
|
||||
|
||||
# Enable sound with pipewire.
|
||||
sound.enable = true;
|
||||
hardware.pulseaudio.enable = false;
|
||||
security.rtkit.enable = true;
|
||||
services.pipewire = {
|
||||
enable = true;
|
||||
alsa = {
|
||||
enable = true;
|
||||
support32Bit = true;
|
||||
};
|
||||
pulse.enable = true;
|
||||
# If you want to use JACK applications, uncomment this
|
||||
#jack.enable = true;
|
||||
|
||||
# use the example session manager (no others are packaged yet so this is enabled by default,
|
||||
# no need to redefine it in your config for now)
|
||||
#media-session.enable = true;
|
||||
};
|
||||
}
|
||||
|
||||
+14
-12
@@ -22,35 +22,37 @@ let
|
||||
|
||||
extraConfig = builtins.concatStringsSep "\n" [
|
||||
];
|
||||
|
||||
lanDevice = "enp1s0";
|
||||
in
|
||||
{
|
||||
# Enable the service with its own configuration
|
||||
services.dnsmasq = {
|
||||
enable = true;
|
||||
# Public AdGuard DNS servers
|
||||
settings = {
|
||||
domain = "thehellings.lan";
|
||||
dhcp-range = [
|
||||
# "eth0,10.42.0.1,10.42.1.255,255.255.0.0,static"
|
||||
"eth0,10.42.2.1,10.42.2.255,255.255.0.0,12h"
|
||||
"vlan66@eth0,192.168.66.3,192.168.66.150,255.255.255.0,12h"
|
||||
"vlan67@eth0,192.168.67.3,192.168.67.150,12h"
|
||||
# "${lanDevice},10.42.0.1,10.42.1.255,255.255.0.0,static"
|
||||
"${lanDevice},10.42.2.1,10.42.2.255,255.255.0.0,12h"
|
||||
"vlan66@${lanDevice},192.168.66.3,192.168.66.150,255.255.255.0,12h"
|
||||
"vlan67@${lanDevice},192.168.67.3,192.168.67.150,12h"
|
||||
];
|
||||
dhcp-option = [
|
||||
"eth0,option:router,10.42.1.1"
|
||||
"eth0,option:dns-server,10.42.1.2,1.1.1.1"
|
||||
"eth0,option:domain-search,thehellings.lan"
|
||||
"${lanDevice},option:router,10.42.1.1"
|
||||
"${lanDevice},option:dns-server,10.42.1.2,1.1.1.1"
|
||||
"${lanDevice},option:domain-search,thehellings.lan"
|
||||
|
||||
"vlan66@eth0,option:router,192.168.66.1"
|
||||
"vlan66@eth0,option:dns-server,192.168.66.2"
|
||||
"vlan66@${lanDevice},option:router,192.168.66.1"
|
||||
"vlan66@${lanDevice},option:dns-server,192.168.66.2"
|
||||
|
||||
"vlan67@eth0,option:router,192.168.67.1"
|
||||
"vlan67@eth0,option:dns-server,192.168.67.2"
|
||||
"vlan67@${lanDevice},option:router,192.168.67.1"
|
||||
"vlan67@${lanDevice},option:dns-server,192.168.67.2"
|
||||
];
|
||||
expand-hosts = true;
|
||||
log-dhcp = true;
|
||||
log-queries = true;
|
||||
addn-hosts = "/etc/adblock_hosts";
|
||||
# Public AdGuard DNS servers
|
||||
server = [
|
||||
"94.140.14.14"
|
||||
"94.140.15.15"
|
||||
|
||||
@@ -4,39 +4,42 @@
|
||||
{ config, lib, pkgs, modulesPath, ... }:
|
||||
|
||||
{
|
||||
imports =
|
||||
[ (modulesPath + "/installer/scan/not-detected.nix")
|
||||
];
|
||||
|
||||
boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "nvme" "usb_storage" "sd_mod" ];
|
||||
boot.initrd.kernelModules = [ ];
|
||||
boot.kernelModules = [ "kvm-intel" ];
|
||||
boot.extraModulePackages = [ ];
|
||||
|
||||
fileSystems."/" =
|
||||
{ device = "/dev/disk/by-uuid/a509426b-5af7-4d04-ac42-619674d932d9";
|
||||
fsType = "btrfs";
|
||||
options = [ "subvol=@" ];
|
||||
};
|
||||
|
||||
fileSystems."/boot/efi" =
|
||||
{ device = "/dev/disk/by-uuid/5AC6-50D7";
|
||||
fsType = "vfat";
|
||||
};
|
||||
|
||||
swapDevices =
|
||||
[ { device = "/dev/disk/by-uuid/a57f8b82-dc0c-4906-8a48-56203d07556b"; }
|
||||
];
|
||||
|
||||
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
|
||||
# (the default) this is the recommended approach. When using systemd-networkd it's
|
||||
# still possible to use this option, but it's recommended to use it in conjunction
|
||||
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
|
||||
networking.useDHCP = lib.mkDefault true;
|
||||
# networking.interfaces.enp1s0.useDHCP = lib.mkDefault true;
|
||||
# networking.interfaces.enp2s0.useDHCP = lib.mkDefault true;
|
||||
# networking.interfaces.eth2.useDHCP = lib.mkDefault true;
|
||||
|
||||
powerManagement.cpuFreqGovernor = lib.mkDefault "powersave";
|
||||
hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
|
||||
imports = [
|
||||
(modulesPath + "/installer/scan/not-detected.nix")
|
||||
];
|
||||
|
||||
boot = {
|
||||
initrd = {
|
||||
availableKernelModules = [ "xhci_pci" "ahci" "nvme" "usb_storage" "sd_mod" ];
|
||||
kernelModules = [ ];
|
||||
};
|
||||
kernelModules = [ "kvm-intel" ];
|
||||
extraModulePackages = [ ];
|
||||
};
|
||||
|
||||
fileSystems."/" = {
|
||||
device = "/dev/disk/by-uuid/a509426b-5af7-4d04-ac42-619674d932d9";
|
||||
fsType = "btrfs";
|
||||
options = [ "subvol=@" ];
|
||||
};
|
||||
|
||||
fileSystems."/boot/efi" = {
|
||||
device = "/dev/disk/by-uuid/5AC6-50D7";
|
||||
fsType = "vfat";
|
||||
};
|
||||
|
||||
swapDevices = [ {
|
||||
device = "/dev/disk/by-uuid/a57f8b82-dc0c-4906-8a48-56203d07556b";
|
||||
} ];
|
||||
|
||||
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
|
||||
# (the default) this is the recommended approach. When using systemd-networkd it's
|
||||
# still possible to use this option, but it's recommended to use it in conjunction
|
||||
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
|
||||
# networking.interfaces.enp1s0.useDHCP = lib.mkDefault true;
|
||||
# networking.interfaces.enp2s0.useDHCP = lib.mkDefault true;
|
||||
# networking.interfaces.eth2.useDHCP = lib.mkDefault true;
|
||||
|
||||
powerManagement.cpuFreqGovernor = lib.mkDefault "powersave";
|
||||
hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
|
||||
}
|
||||
|
||||
@@ -4,17 +4,27 @@
|
||||
greg.tailscale.enable = true;
|
||||
|
||||
networking = {
|
||||
# This value is deprecated, you now set it per interface
|
||||
useDHCP = false;
|
||||
defaultGateway = "10.42.1.1";
|
||||
enableIPv6 = false;
|
||||
#defaultGateway = "10.42.1.1";
|
||||
# 100.100.100.100 is the tailscale DNS
|
||||
nameservers = [ "100.100.100.100" "127.0.0.1" ];
|
||||
nameservers = [
|
||||
"1.1.1.1"
|
||||
#"100.100.100.100"
|
||||
"127.0.0.1"
|
||||
];
|
||||
interfaces = {
|
||||
eth0.ipv4.addresses = [ {
|
||||
address = "10.42.1.2";
|
||||
# This is our WAN port
|
||||
enp2s0 = {
|
||||
useDHCP = true;
|
||||
name = "wan";
|
||||
};
|
||||
|
||||
# This is our LAN port
|
||||
enp1s0.ipv4.addresses = [ {
|
||||
address = "10.43.1.1";
|
||||
prefixLength = 16;
|
||||
} ];
|
||||
wlan0.useDHCP = true;
|
||||
wlan0.useDHCP = false;
|
||||
|
||||
vlan66.ipv4.addresses = [ {
|
||||
address = "192.168.66.2";
|
||||
@@ -25,7 +35,7 @@
|
||||
vlans = {
|
||||
vlan66 = {
|
||||
id = 66;
|
||||
interface = "eth0";
|
||||
interface = "enp2s0";
|
||||
};
|
||||
};
|
||||
};
|
||||
@@ -47,8 +57,10 @@
|
||||
openFirewall = true;
|
||||
};
|
||||
|
||||
greg.proxies."jellyfin.thehellings.lan".target = "http://localhost:8096";
|
||||
greg.proxies."jellyfin.me.ts".target = "http://localhost:8096";
|
||||
greg.proxies = {
|
||||
"jellyfin.thehellings.lan".target = "http://localhost:8096";
|
||||
"jellyfin.me.ts".target = "http://localhost:8096";
|
||||
};
|
||||
|
||||
#########
|
||||
# Blind service proxy behind the walls of the VPN
|
||||
@@ -64,12 +76,12 @@
|
||||
users = [ "greg" ];
|
||||
} ];
|
||||
} ];
|
||||
usersFile = "/run/agenix/3proxy";
|
||||
#usersFile = "/run/agenix/3proxy";
|
||||
denyPrivate = false;
|
||||
};
|
||||
age.secrets."3proxy" = {
|
||||
file = ../../secrets/3proxy.age;
|
||||
mode = "777";
|
||||
};
|
||||
#age.secrets."3proxy" = {
|
||||
# file = ../../secrets/3proxy.age;
|
||||
# mode = "776";
|
||||
#};
|
||||
networking.firewall.allowedTCPPorts = [ 3128 ];
|
||||
}
|
||||
|
||||
@@ -5,11 +5,6 @@
|
||||
{ ... }:
|
||||
|
||||
{
|
||||
greg.proxies."dns.thehellings.lan" = {
|
||||
target = "http://127.0.0.1:8384/";
|
||||
path = "/sync/";
|
||||
};
|
||||
|
||||
# The module doesn't handle this
|
||||
services.nginx.virtualHosts."dns.thehellings.lan".serverAliases = [ "dns" ];
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user