greg/nixos
1
0
Fork 2
Code Issues Pull Requests 3 Actions Packages Projects Releases Wiki Activity

Basic network server setup

Browse Source
This commit is contained in:
Greg Hellings
2023-08-18 20:48:36 -05:00
parent 2714146e1c
commit 70b76382ec
5 changed files with 120 additions and 102 deletions
Download Patch File Download Diff File Expand all files Collapse all files
hosts/genesis/default.nix
+36 -30
View File
@@ -5,39 +5,45 @@
{ config, pkgs, ... }: { config, pkgs, ... }:
{ {
imports = imports = [
[ # Include the results of the hardware scan. # Include the results of the hardware scan.
./dnsmasq.nix ./dnsmasq.nix
./hardware-configuration.nix ./hardware-configuration.nix
./home-assistant.nix ./home-assistant.nix
./networking.nix ./networking.nix
./vhosts.nix ./vhosts.nix
]; ];
greg.home = true; greg.home = true;
greg.gnome.enable = true; greg.gnome.enable = true;
# Bootloader. # Bootloader.
boot.loader.systemd-boot.enable = true; boot.loader = {
boot.loader.efi.canTouchEfiVariables = true; systemd-boot.enable = true;
boot.loader.efi.efiSysMountPoint = "/boot/efi"; efi = {
canTouchEfiVariables = true;
efiSysMountPoint = "/boot/efi";
};
};
networking.hostName = "genesis"; # Define your hostname. networking.hostName = "genesis"; # Define your hostname.
# Enable sound with pipewire. # Enable sound with pipewire.
sound.enable = true; sound.enable = true;
hardware.pulseaudio.enable = false; hardware.pulseaudio.enable = false;
security.rtkit.enable = true; security.rtkit.enable = true;
services.pipewire = { services.pipewire = {
enable = true; enable = true;
alsa.enable = true; alsa = {
alsa.support32Bit = true; enable = true;
pulse.enable = true; support32Bit = true;
# If you want to use JACK applications, uncomment this };
#jack.enable = true; pulse.enable = true;
# If you want to use JACK applications, uncomment this
#jack.enable = true;
# use the example session manager (no others are packaged yet so this is enabled by default, # use the example session manager (no others are packaged yet so this is enabled by default,
# no need to redefine it in your config for now) # no need to redefine it in your config for now)
#media-session.enable = true; #media-session.enable = true;
}; };
} }
hosts/genesis/dnsmasq.nix
+14 -12
View File
@@ -22,35 +22,37 @@ let
extraConfig = builtins.concatStringsSep "\n" [ extraConfig = builtins.concatStringsSep "\n" [
]; ];
lanDevice = "enp1s0";
in in
{ {
# Enable the service with its own configuration # Enable the service with its own configuration
services.dnsmasq = { services.dnsmasq = {
enable = true; enable = true;
# Public AdGuard DNS servers
settings = { settings = {
domain = "thehellings.lan"; domain = "thehellings.lan";
dhcp-range = [ dhcp-range = [
# "eth0,10.42.0.1,10.42.1.255,255.255.0.0,static" # "${lanDevice},10.42.0.1,10.42.1.255,255.255.0.0,static"
"eth0,10.42.2.1,10.42.2.255,255.255.0.0,12h" "${lanDevice},10.42.2.1,10.42.2.255,255.255.0.0,12h"
"vlan66@eth0,192.168.66.3,192.168.66.150,255.255.255.0,12h" "vlan66@${lanDevice},192.168.66.3,192.168.66.150,255.255.255.0,12h"
"vlan67@eth0,192.168.67.3,192.168.67.150,12h" "vlan67@${lanDevice},192.168.67.3,192.168.67.150,12h"
]; ];
dhcp-option = [ dhcp-option = [
"eth0,option:router,10.42.1.1" "${lanDevice},option:router,10.42.1.1"
"eth0,option:dns-server,10.42.1.2,1.1.1.1" "${lanDevice},option:dns-server,10.42.1.2,1.1.1.1"
"eth0,option:domain-search,thehellings.lan" "${lanDevice},option:domain-search,thehellings.lan"
"vlan66@eth0,option:router,192.168.66.1" "vlan66@${lanDevice},option:router,192.168.66.1"
"vlan66@eth0,option:dns-server,192.168.66.2" "vlan66@${lanDevice},option:dns-server,192.168.66.2"
"vlan67@eth0,option:router,192.168.67.1" "vlan67@${lanDevice},option:router,192.168.67.1"
"vlan67@eth0,option:dns-server,192.168.67.2" "vlan67@${lanDevice},option:dns-server,192.168.67.2"
]; ];
expand-hosts = true; expand-hosts = true;
log-dhcp = true; log-dhcp = true;
log-queries = true; log-queries = true;
addn-hosts = "/etc/adblock_hosts"; addn-hosts = "/etc/adblock_hosts";
# Public AdGuard DNS servers
server = [ server = [
"94.140.14.14" "94.140.14.14"
"94.140.15.15" "94.140.15.15"
hosts/genesis/hardware-configuration.nix
+32 -29
View File
@@ -4,39 +4,42 @@
{ config, lib, pkgs, modulesPath, ... }: { config, lib, pkgs, modulesPath, ... }:
{ {
imports = imports = [
[ (modulesPath + "/installer/scan/not-detected.nix") (modulesPath + "/installer/scan/not-detected.nix")
]; ];
boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "nvme" "usb_storage" "sd_mod" ]; boot = {
boot.initrd.kernelModules = [ ]; initrd = {
boot.kernelModules = [ "kvm-intel" ]; availableKernelModules = [ "xhci_pci" "ahci" "nvme" "usb_storage" "sd_mod" ];
boot.extraModulePackages = [ ]; kernelModules = [ ];
};
kernelModules = [ "kvm-intel" ];
extraModulePackages = [ ];
};
fileSystems."/" = fileSystems."/" = {
{ device = "/dev/disk/by-uuid/a509426b-5af7-4d04-ac42-619674d932d9"; device = "/dev/disk/by-uuid/a509426b-5af7-4d04-ac42-619674d932d9";
fsType = "btrfs"; fsType = "btrfs";
options = [ "subvol=@" ]; options = [ "subvol=@" ];
}; };
fileSystems."/boot/efi" = fileSystems."/boot/efi" = {
{ device = "/dev/disk/by-uuid/5AC6-50D7"; device = "/dev/disk/by-uuid/5AC6-50D7";
fsType = "vfat"; fsType = "vfat";
}; };
swapDevices = swapDevices = [ {
[ { device = "/dev/disk/by-uuid/a57f8b82-dc0c-4906-8a48-56203d07556b"; } device = "/dev/disk/by-uuid/a57f8b82-dc0c-4906-8a48-56203d07556b";
]; } ];
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
# (the default) this is the recommended approach. When using systemd-networkd it's # (the default) this is the recommended approach. When using systemd-networkd it's
# still possible to use this option, but it's recommended to use it in conjunction # still possible to use this option, but it's recommended to use it in conjunction
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`. # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
networking.useDHCP = lib.mkDefault true; # networking.interfaces.enp1s0.useDHCP = lib.mkDefault true;
# networking.interfaces.enp1s0.useDHCP = lib.mkDefault true; # networking.interfaces.enp2s0.useDHCP = lib.mkDefault true;
# networking.interfaces.enp2s0.useDHCP = lib.mkDefault true; # networking.interfaces.eth2.useDHCP = lib.mkDefault true;
# networking.interfaces.eth2.useDHCP = lib.mkDefault true;
powerManagement.cpuFreqGovernor = lib.mkDefault "powersave"; powerManagement.cpuFreqGovernor = lib.mkDefault "powersave";
hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware; hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
} }
hosts/genesis/networking.nix
+27 -15
View File
@@ -4,17 +4,27 @@
greg.tailscale.enable = true; greg.tailscale.enable = true;
networking = { networking = {
# This value is deprecated, you now set it per interface enableIPv6 = false;
useDHCP = false; #defaultGateway = "10.42.1.1";
defaultGateway = "10.42.1.1";
# 100.100.100.100 is the tailscale DNS # 100.100.100.100 is the tailscale DNS
nameservers = [ "100.100.100.100" "127.0.0.1" ]; nameservers = [
"1.1.1.1"
#"100.100.100.100"
"127.0.0.1"
];
interfaces = { interfaces = {
eth0.ipv4.addresses = [ { # This is our WAN port
address = "10.42.1.2"; enp2s0 = {
useDHCP = true;
name = "wan";
};
# This is our LAN port
enp1s0.ipv4.addresses = [ {
address = "10.43.1.1";
prefixLength = 16; prefixLength = 16;
} ]; } ];
wlan0.useDHCP = true; wlan0.useDHCP = false;
vlan66.ipv4.addresses = [ { vlan66.ipv4.addresses = [ {
address = "192.168.66.2"; address = "192.168.66.2";
@@ -25,7 +35,7 @@
vlans = { vlans = {
vlan66 = { vlan66 = {
id = 66; id = 66;
interface = "eth0"; interface = "enp2s0";
}; };
}; };
}; };
@@ -47,8 +57,10 @@
openFirewall = true; openFirewall = true;
}; };
greg.proxies."jellyfin.thehellings.lan".target = "http://localhost:8096"; greg.proxies = {
greg.proxies."jellyfin.me.ts".target = "http://localhost:8096"; "jellyfin.thehellings.lan".target = "http://localhost:8096";
"jellyfin.me.ts".target = "http://localhost:8096";
};
######### #########
# Blind service proxy behind the walls of the VPN # Blind service proxy behind the walls of the VPN
@@ -64,12 +76,12 @@
users = [ "greg" ]; users = [ "greg" ];
} ]; } ];
} ]; } ];
usersFile = "/run/agenix/3proxy"; #usersFile = "/run/agenix/3proxy";
denyPrivate = false; denyPrivate = false;
}; };
age.secrets."3proxy" = { #age.secrets."3proxy" = {
file = ../../secrets/3proxy.age; # file = ../../secrets/3proxy.age;
mode = "777"; # mode = "776";
}; #};
networking.firewall.allowedTCPPorts = [ 3128 ]; networking.firewall.allowedTCPPorts = [ 3128 ];
} }
hosts/genesis/vhosts.nix
-5
View File
@@ -5,11 +5,6 @@
{ ... }: { ... }:
{ {
greg.proxies."dns.thehellings.lan" = {
target = "http://127.0.0.1:8384/";
path = "/sync/";
};
# The module doesn't handle this # The module doesn't handle this
services.nginx.virtualHosts."dns.thehellings.lan".serverAliases = [ "dns" ]; services.nginx.virtualHosts."dns.thehellings.lan".serverAliases = [ "dns" ];
} }