A complete reformatting to match nixpkgs-fmt
This commit is contained in:
Greg Hellings
+65
-62
@@ -1,65 +1,68 @@
|
||||
{ inputs, overlays, ... }:
|
||||
let
|
||||
wsl = args: (unstable (args // { extraMods = [ inputs.wsl.nixosModules.wsl ]; }));
|
||||
unstable = args: (machine (args // {
|
||||
channel = inputs.nixunstable;
|
||||
hm = inputs.hmunstable;
|
||||
nixvim = inputs.nixvimunstable;
|
||||
}));
|
||||
machine = {
|
||||
channel ? inputs.nixstable,
|
||||
extraMods ? [],
|
||||
name,
|
||||
system ? "x86_64-linux",
|
||||
hm ? inputs.hm,
|
||||
nixvim ? inputs.nixvimstable,
|
||||
}:
|
||||
let
|
||||
nixpkgs = import channel {
|
||||
inherit system;
|
||||
};
|
||||
# Use this to include modules directly from a repo
|
||||
nurNoPkg = import inputs.nurpkgs {
|
||||
nurpkgs = nixpkgs;
|
||||
};
|
||||
in channel.lib.nixosSystem {
|
||||
inherit system;
|
||||
specialArgs = { inherit nixpkgs inputs overlays; };
|
||||
modules = [
|
||||
{
|
||||
nixpkgs.overlays = overlays;
|
||||
home-manager = {
|
||||
useGlobalPkgs = true;
|
||||
useUserPackages = true;
|
||||
users.greg = import ../home/home.nix;
|
||||
extraSpecialArgs = {
|
||||
inherit inputs overlays nixvim;
|
||||
home = "/home/greg";
|
||||
host = name;
|
||||
};
|
||||
backupFileExtension = "bkp";
|
||||
};
|
||||
}
|
||||
inputs.agenix.nixosModules.default
|
||||
hm.nixosModules.home-manager
|
||||
inputs.self.modules.nixosModule
|
||||
inputs.nurpkgs.nixosModules.nur
|
||||
./${name}
|
||||
] ++ extraMods;
|
||||
};
|
||||
in {
|
||||
genesis = machine { name = "genesis"; };
|
||||
exodus = unstable { name = "exodus"; };
|
||||
jude = unstable { name = "jude"; };
|
||||
icdm-root = unstable { name = "icdm-root"; };
|
||||
linode = machine { name = "linode"; };
|
||||
hosea = unstable { name = "hosea"; };
|
||||
jeremiah = unstable { name = "jeremiah"; };
|
||||
myself = unstable { name = "myself"; };
|
||||
iso = machine { name = "iso"; };
|
||||
iso-beta = unstable { name = "iso"; };
|
||||
# nix build '.#nixosConfigurations.wsl.config.system.build.installer'
|
||||
nixos = wsl { name = "wsl"; system = "aarch64-linux"; };
|
||||
# nix build '.#nixosConfigurations.wsl-aarch.config.system.build.installer'
|
||||
nixos-arm = wsl { name = "wsl"; system = "aarch64-linux"; };
|
||||
wsl = args: (unstable (args // { extraMods = [ inputs.wsl.nixosModules.wsl ]; }));
|
||||
unstable = args: (machine (args // {
|
||||
channel = inputs.nixunstable;
|
||||
hm = inputs.hmunstable;
|
||||
nixvim = inputs.nixvimunstable;
|
||||
}));
|
||||
machine =
|
||||
{ channel ? inputs.nixstable
|
||||
, extraMods ? [ ]
|
||||
, name
|
||||
, system ? "x86_64-linux"
|
||||
, hm ? inputs.hm
|
||||
, nixvim ? inputs.nixvimstable
|
||||
,
|
||||
}:
|
||||
let
|
||||
nixpkgs = import channel {
|
||||
inherit system;
|
||||
};
|
||||
# Use this to include modules directly from a repo
|
||||
nurNoPkg = import inputs.nurpkgs {
|
||||
nurpkgs = nixpkgs;
|
||||
};
|
||||
in
|
||||
channel.lib.nixosSystem {
|
||||
inherit system;
|
||||
specialArgs = { inherit nixpkgs inputs overlays; };
|
||||
modules = [
|
||||
{
|
||||
nixpkgs.overlays = overlays;
|
||||
home-manager = {
|
||||
useGlobalPkgs = true;
|
||||
useUserPackages = true;
|
||||
users.greg = import ../home/home.nix;
|
||||
extraSpecialArgs = {
|
||||
inherit inputs overlays nixvim;
|
||||
home = "/home/greg";
|
||||
host = name;
|
||||
};
|
||||
backupFileExtension = "bkp";
|
||||
};
|
||||
}
|
||||
inputs.agenix.nixosModules.default
|
||||
hm.nixosModules.home-manager
|
||||
inputs.self.modules.nixosModule
|
||||
inputs.nurpkgs.nixosModules.nur
|
||||
./${name}
|
||||
] ++ extraMods;
|
||||
};
|
||||
in
|
||||
{
|
||||
genesis = machine { name = "genesis"; };
|
||||
exodus = unstable { name = "exodus"; };
|
||||
jude = unstable { name = "jude"; };
|
||||
icdm-root = unstable { name = "icdm-root"; };
|
||||
linode = machine { name = "linode"; };
|
||||
hosea = unstable { name = "hosea"; };
|
||||
jeremiah = unstable { name = "jeremiah"; };
|
||||
myself = unstable { name = "myself"; };
|
||||
iso = machine { name = "iso"; };
|
||||
iso-beta = unstable { name = "iso"; };
|
||||
# nix build '.#nixosConfigurations.wsl.config.system.build.installer'
|
||||
nixos = wsl { name = "wsl"; system = "aarch64-linux"; };
|
||||
# nix build '.#nixosConfigurations.wsl-aarch.config.system.build.installer'
|
||||
nixos-arm = wsl { name = "wsl"; system = "aarch64-linux"; };
|
||||
}
|
||||
|
||||
+18
-18
@@ -1,24 +1,24 @@
|
||||
{ pkgs, config, ... }:
|
||||
|
||||
{
|
||||
imports = [
|
||||
./hardware-configuration.nix
|
||||
];
|
||||
imports = [
|
||||
./hardware-configuration.nix
|
||||
];
|
||||
|
||||
boot.loader = {
|
||||
systemd-boot.enable = true;
|
||||
efi.canTouchEfiVariables = true;
|
||||
};
|
||||
boot.loader = {
|
||||
systemd-boot.enable = true;
|
||||
efi.canTouchEfiVariables = true;
|
||||
};
|
||||
|
||||
networking.hostName = "exodus";
|
||||
greg = {
|
||||
home = true;
|
||||
gnome.enable = true;
|
||||
print.enable = true;
|
||||
tailscale.enable = true;
|
||||
vmdev = {
|
||||
enable = true;
|
||||
system = "intel";
|
||||
};
|
||||
};
|
||||
networking.hostName = "exodus";
|
||||
greg = {
|
||||
home = true;
|
||||
gnome.enable = true;
|
||||
print.enable = true;
|
||||
tailscale.enable = true;
|
||||
vmdev = {
|
||||
enable = true;
|
||||
system = "intel";
|
||||
};
|
||||
};
|
||||
}
|
||||
|
||||
@@ -5,7 +5,8 @@
|
||||
|
||||
{
|
||||
imports =
|
||||
[ (modulesPath + "/installer/scan/not-detected.nix")
|
||||
[
|
||||
(modulesPath + "/installer/scan/not-detected.nix")
|
||||
];
|
||||
|
||||
boot.initrd.availableKernelModules = [ "xhci_pci" "thunderbolt" "nvme" "uas" "sd_mod" ];
|
||||
@@ -14,13 +15,15 @@
|
||||
boot.extraModulePackages = [ ];
|
||||
|
||||
fileSystems."/" =
|
||||
{ device = "/dev/disk/by-uuid/607b933f-2967-4652-b478-4d8e9aa38a0d";
|
||||
{
|
||||
device = "/dev/disk/by-uuid/607b933f-2967-4652-b478-4d8e9aa38a0d";
|
||||
fsType = "btrfs";
|
||||
options = [ "subvol=@" ];
|
||||
};
|
||||
|
||||
fileSystems."/boot" =
|
||||
{ device = "/dev/disk/by-uuid/B31C-C1F4";
|
||||
{
|
||||
device = "/dev/disk/by-uuid/B31C-C1F4";
|
||||
fsType = "vfat";
|
||||
};
|
||||
|
||||
|
||||
+59
-58
@@ -1,62 +1,63 @@
|
||||
{ pkgs, config, lib, ... }:
|
||||
|
||||
let
|
||||
address = (builtins.elemAt config.networking.interfaces.ens18.ipv4.addresses 0).address;
|
||||
root_ca = pkgs.writeText "root_ca.crt" (builtins.readFile ../../ca/root_ca.crt);
|
||||
intermediate_ca = pkgs.writeText "intermediate_ca.crt" (builtins.readFile ../../ca/intermediate_ca.crt);
|
||||
in {
|
||||
age.secrets.acme_password = {
|
||||
file = ../../secrets/acme_password.age;
|
||||
};
|
||||
age.secrets.intermediate_ca_key = {
|
||||
file = ../../secrets/ca/intermediate_key.age;
|
||||
};
|
||||
age.secrets.root_ca_key.file = ../../secrets/ca/root_key.age;
|
||||
systemd.services.step-ca.serviceConfig.Environment = lib.mkForce ["STEPDEBUG=1" "HOME=%S/step-ca"];
|
||||
services.step-ca = {
|
||||
inherit address;
|
||||
enable = false;
|
||||
intermediatePasswordFile = config.age.secrets.acme_password.path;
|
||||
openFirewall = true;
|
||||
port = 8443;
|
||||
settings = {
|
||||
root = root_ca;
|
||||
federatedRoots = null;
|
||||
cert = intermediate_ca;
|
||||
key = config.age.secrets.intermediate_ca_key.path;
|
||||
dnsNames = [
|
||||
"10.42.1.5"
|
||||
"acme.thehellings.lan"
|
||||
];
|
||||
logger.format = "text";
|
||||
db = {
|
||||
type = "badgerv2";
|
||||
dataSource = "/var/lib/step-ca/db";
|
||||
badgerFileLoadingMode = "";
|
||||
};
|
||||
authority.provisioners = [ {
|
||||
type = "JWK";
|
||||
name = "greg@thehellings.com";
|
||||
key = {
|
||||
use = "sig";
|
||||
kty = "EC";
|
||||
kid = "1GOpOttYLZtx7XiG79ZycbGcG4ptL0czfohK35SZOEI";
|
||||
crv = "P-256";
|
||||
alg = "ES256";
|
||||
x = "YEWVj5CCoqWQXWqmL0UuORlFY9IEOLcg1jpG1o-wGx4";
|
||||
y = "MEpqnJp60VV-SpFtb6m8U-VAYut7R_PKFm07xl7MjBk";
|
||||
};
|
||||
encryptedKey = "eyJhbGciOiJQQkVTMi1IUzI1NitBMTI4S1ciLCJjdHkiOiJqd2sranNvbiIsImVuYyI6IkEyNTZHQ00iLCJwMmMiOjYwMDAwMCwicDJzIjoieWdfb0lfbWgwbHhPRXdjUTBsd0FnUSJ9.ivdQUFEhs2U8PUBYr8AhQl3hHdb4spF4jvXgqY_hiVgpjB-z3Nn9Uw.u7vrNht_3WD1G97q.mbydlpAQxjtKLkOmmDOUczqscRDPqrUyoPJ1uqXcJDH3vs4KiYlrKRcFLjPy9sWzEL1iIrqjwf3U-3AAx1KNAg7frs2D__MGfOO-U5SdQDVJVAND7KpWOJGJVSb0xioCA6-8ldlP_REqu4ENmkkdw0_6Is2b0p7ZFKqke_fqOOs7osqFAfbMb_WzEWrACLn5A5-Teh2rpEgR-z9zipN6MSEqE6VIQ2BXuv70aHWhslNe1MK1OgTYm9CqA47EMYvQ7HQLPDZAbP56WK84yJLktoXMmnkaKeTtvER0dh4ufyjJHBhecnEranbR5rHc_jV8_qvyWhlqbCrOU_8bWrk.a9SH_q3GKIUsOUSRWkDxQg";
|
||||
} ];
|
||||
tls = {
|
||||
cipherSuites = [
|
||||
"TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256"
|
||||
"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256"
|
||||
];
|
||||
minVersion = 1.2;
|
||||
maxVersion = 1.3;
|
||||
renegotiation = false;
|
||||
};
|
||||
};
|
||||
};
|
||||
address = (builtins.elemAt config.networking.interfaces.ens18.ipv4.addresses 0).address;
|
||||
root_ca = pkgs.writeText "root_ca.crt" (builtins.readFile ../../ca/root_ca.crt);
|
||||
intermediate_ca = pkgs.writeText "intermediate_ca.crt" (builtins.readFile ../../ca/intermediate_ca.crt);
|
||||
in
|
||||
{
|
||||
age.secrets.acme_password = {
|
||||
file = ../../secrets/acme_password.age;
|
||||
};
|
||||
age.secrets.intermediate_ca_key = {
|
||||
file = ../../secrets/ca/intermediate_key.age;
|
||||
};
|
||||
age.secrets.root_ca_key.file = ../../secrets/ca/root_key.age;
|
||||
systemd.services.step-ca.serviceConfig.Environment = lib.mkForce [ "STEPDEBUG=1" "HOME=%S/step-ca" ];
|
||||
services.step-ca = {
|
||||
inherit address;
|
||||
enable = false;
|
||||
intermediatePasswordFile = config.age.secrets.acme_password.path;
|
||||
openFirewall = true;
|
||||
port = 8443;
|
||||
settings = {
|
||||
root = root_ca;
|
||||
federatedRoots = null;
|
||||
cert = intermediate_ca;
|
||||
key = config.age.secrets.intermediate_ca_key.path;
|
||||
dnsNames = [
|
||||
"10.42.1.5"
|
||||
"acme.thehellings.lan"
|
||||
];
|
||||
logger.format = "text";
|
||||
db = {
|
||||
type = "badgerv2";
|
||||
dataSource = "/var/lib/step-ca/db";
|
||||
badgerFileLoadingMode = "";
|
||||
};
|
||||
authority.provisioners = [{
|
||||
type = "JWK";
|
||||
name = "greg@thehellings.com";
|
||||
key = {
|
||||
use = "sig";
|
||||
kty = "EC";
|
||||
kid = "1GOpOttYLZtx7XiG79ZycbGcG4ptL0czfohK35SZOEI";
|
||||
crv = "P-256";
|
||||
alg = "ES256";
|
||||
x = "YEWVj5CCoqWQXWqmL0UuORlFY9IEOLcg1jpG1o-wGx4";
|
||||
y = "MEpqnJp60VV-SpFtb6m8U-VAYut7R_PKFm07xl7MjBk";
|
||||
};
|
||||
encryptedKey = "eyJhbGciOiJQQkVTMi1IUzI1NitBMTI4S1ciLCJjdHkiOiJqd2sranNvbiIsImVuYyI6IkEyNTZHQ00iLCJwMmMiOjYwMDAwMCwicDJzIjoieWdfb0lfbWgwbHhPRXdjUTBsd0FnUSJ9.ivdQUFEhs2U8PUBYr8AhQl3hHdb4spF4jvXgqY_hiVgpjB-z3Nn9Uw.u7vrNht_3WD1G97q.mbydlpAQxjtKLkOmmDOUczqscRDPqrUyoPJ1uqXcJDH3vs4KiYlrKRcFLjPy9sWzEL1iIrqjwf3U-3AAx1KNAg7frs2D__MGfOO-U5SdQDVJVAND7KpWOJGJVSb0xioCA6-8ldlP_REqu4ENmkkdw0_6Is2b0p7ZFKqke_fqOOs7osqFAfbMb_WzEWrACLn5A5-Teh2rpEgR-z9zipN6MSEqE6VIQ2BXuv70aHWhslNe1MK1OgTYm9CqA47EMYvQ7HQLPDZAbP56WK84yJLktoXMmnkaKeTtvER0dh4ufyjJHBhecnEranbR5rHc_jV8_qvyWhlqbCrOU_8bWrk.a9SH_q3GKIUsOUSRWkDxQg";
|
||||
}];
|
||||
tls = {
|
||||
cipherSuites = [
|
||||
"TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256"
|
||||
"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256"
|
||||
];
|
||||
minVersion = 1.2;
|
||||
maxVersion = 1.3;
|
||||
renegotiation = false;
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
|
||||
+37
-37
@@ -5,43 +5,43 @@
|
||||
{ config, pkgs, ... }:
|
||||
|
||||
{
|
||||
imports = [
|
||||
# Include the results of the hardware scan.
|
||||
./acme.nix
|
||||
./hardware-configuration.nix
|
||||
./home-assistant.nix
|
||||
./networking.nix
|
||||
];
|
||||
|
||||
greg.home = true;
|
||||
greg.gnome.enable = false;
|
||||
|
||||
# Bootloader.
|
||||
boot.loader.grub = {
|
||||
enable = true;
|
||||
device = "/dev/vda";
|
||||
useOSProber = true;
|
||||
};
|
||||
imports = [
|
||||
# Include the results of the hardware scan.
|
||||
./acme.nix
|
||||
./hardware-configuration.nix
|
||||
./home-assistant.nix
|
||||
./networking.nix
|
||||
];
|
||||
|
||||
#boot.loader = {
|
||||
# systemd-boot.enable = true;
|
||||
# efi = {
|
||||
# canTouchEfiVariables = true;
|
||||
# efiSysMountPoint = "/boot/efi";
|
||||
# };
|
||||
#};
|
||||
|
||||
networking.hostName = "genesis"; # Define your hostname.
|
||||
environment.systemPackages = with pkgs; [
|
||||
awscli2
|
||||
create_ssl
|
||||
step-ca
|
||||
];
|
||||
greg.home = true;
|
||||
greg.gnome.enable = false;
|
||||
|
||||
virtualisation.oci-containers.containers.speedtest = {
|
||||
image = "ghcr.io/librespeed/speedtest";
|
||||
hostname = "speedtest";
|
||||
ports = [ "19472:80" ];
|
||||
};
|
||||
greg.proxies."speedtest.thehellings.lan".target = "http://localhost:19472";
|
||||
# Bootloader.
|
||||
boot.loader.grub = {
|
||||
enable = true;
|
||||
device = "/dev/vda";
|
||||
useOSProber = true;
|
||||
};
|
||||
|
||||
#boot.loader = {
|
||||
# systemd-boot.enable = true;
|
||||
# efi = {
|
||||
# canTouchEfiVariables = true;
|
||||
# efiSysMountPoint = "/boot/efi";
|
||||
# };
|
||||
#};
|
||||
|
||||
networking.hostName = "genesis"; # Define your hostname.
|
||||
environment.systemPackages = with pkgs; [
|
||||
awscli2
|
||||
create_ssl
|
||||
step-ca
|
||||
];
|
||||
|
||||
virtualisation.oci-containers.containers.speedtest = {
|
||||
image = "ghcr.io/librespeed/speedtest";
|
||||
hostname = "speedtest";
|
||||
ports = [ "19472:80" ];
|
||||
};
|
||||
greg.proxies."speedtest.thehellings.lan".target = "http://localhost:19472";
|
||||
}
|
||||
|
||||
@@ -5,7 +5,8 @@
|
||||
|
||||
{
|
||||
imports =
|
||||
[ (modulesPath + "/profiles/qemu-guest.nix")
|
||||
[
|
||||
(modulesPath + "/profiles/qemu-guest.nix")
|
||||
];
|
||||
|
||||
boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "sr_mod" "virtio_blk" ];
|
||||
@@ -14,13 +15,13 @@
|
||||
boot.extraModulePackages = [ ];
|
||||
|
||||
fileSystems."/" =
|
||||
{ device = "/dev/disk/by-uuid/a13f941e-4985-47ab-a8c6-374a627c5ce1";
|
||||
{
|
||||
device = "/dev/disk/by-uuid/a13f941e-4985-47ab-a8c6-374a627c5ce1";
|
||||
fsType = "ext4";
|
||||
};
|
||||
|
||||
swapDevices =
|
||||
[ { device = "/dev/disk/by-uuid/ac4557de-1ad5-4d3c-b9f4-5ec50dbf76f1"; }
|
||||
];
|
||||
[{ device = "/dev/disk/by-uuid/ac4557de-1ad5-4d3c-b9f4-5ec50dbf76f1"; }];
|
||||
|
||||
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
|
||||
# (the default) this is the recommended approach. When using systemd-networkd it's
|
||||
|
||||
+118
-117
@@ -1,135 +1,136 @@
|
||||
{ config, pkgs, ... }:
|
||||
|
||||
let
|
||||
service_list = [ "podman-home-assistant.service" ];
|
||||
service_list = [ "podman-home-assistant.service" ];
|
||||
in
|
||||
{
|
||||
virtualisation.podman.enable = true;
|
||||
virtualisation.podman.enable = true;
|
||||
|
||||
services.home-assistant = {
|
||||
enable = true;
|
||||
configDir = "/var/lib/hass";
|
||||
extraComponents = [
|
||||
"accuweather"
|
||||
"calendar"
|
||||
"cast"
|
||||
"eufy"
|
||||
"lovelace"
|
||||
"nextcloud"
|
||||
"ping"
|
||||
"piper"
|
||||
"radio_browser"
|
||||
"rainbird"
|
||||
"roborock"
|
||||
"smart_meter_texas"
|
||||
"speedtestdotnet"
|
||||
"solaredge"
|
||||
"whisper"
|
||||
"wiz"
|
||||
"wyoming"
|
||||
"zwave_js"
|
||||
];
|
||||
customComponents = with pkgs.home-assistant-custom-components; [
|
||||
smartthinq-sensors
|
||||
];
|
||||
services.home-assistant = {
|
||||
enable = true;
|
||||
configDir = "/var/lib/hass";
|
||||
extraComponents = [
|
||||
"accuweather"
|
||||
"calendar"
|
||||
"cast"
|
||||
"eufy"
|
||||
"lovelace"
|
||||
"nextcloud"
|
||||
"ping"
|
||||
"piper"
|
||||
"radio_browser"
|
||||
"rainbird"
|
||||
"roborock"
|
||||
"smart_meter_texas"
|
||||
"speedtestdotnet"
|
||||
"solaredge"
|
||||
"whisper"
|
||||
"wiz"
|
||||
"wyoming"
|
||||
"zwave_js"
|
||||
];
|
||||
customComponents = with pkgs.home-assistant-custom-components; [
|
||||
smartthinq-sensors
|
||||
];
|
||||
|
||||
config = {
|
||||
default_config = {};
|
||||
tts = [ { platform = "google_translate"; } ];
|
||||
http = {
|
||||
use_x_forwarded_for = true;
|
||||
trusted_proxies = [ "127.0.0.1" "::1" ];
|
||||
server_host = "127.0.0.1";
|
||||
};
|
||||
#"automation manual" = *nix config here* and so on
|
||||
"automation ui" = "!include automations.yaml";
|
||||
"script ui" = "!include scripts.yaml";
|
||||
"scene ui" = "!include scenes.yaml";
|
||||
};
|
||||
};
|
||||
config = {
|
||||
default_config = { };
|
||||
tts = [{ platform = "google_translate"; }];
|
||||
http = {
|
||||
use_x_forwarded_for = true;
|
||||
trusted_proxies = [ "127.0.0.1" "::1" ];
|
||||
server_host = "127.0.0.1";
|
||||
};
|
||||
#"automation manual" = *nix config here* and so on
|
||||
"automation ui" = "!include automations.yaml";
|
||||
"script ui" = "!include scripts.yaml";
|
||||
"scene ui" = "!include scenes.yaml";
|
||||
};
|
||||
};
|
||||
|
||||
# Helps with Voice stuff for Home Assistant
|
||||
services.wyoming = {
|
||||
faster-whisper.servers = {
|
||||
greg = {
|
||||
enable = true;
|
||||
beamSize = 1; # wut?
|
||||
device = "auto"; # Could be CPU or CUDA
|
||||
language = "en";
|
||||
model = "base-int8";
|
||||
uri = "tcp://0.0.0.0:13415";
|
||||
};
|
||||
};
|
||||
piper.servers.greg = {
|
||||
enable = true;
|
||||
uri = "tcp://0.0.0.0:13416";
|
||||
voice = "en_US-amy-medium";
|
||||
};
|
||||
};
|
||||
# Helps with Voice stuff for Home Assistant
|
||||
services.wyoming = {
|
||||
faster-whisper.servers = {
|
||||
greg = {
|
||||
enable = true;
|
||||
beamSize = 1; # wut?
|
||||
device = "auto"; # Could be CPU or CUDA
|
||||
language = "en";
|
||||
model = "base-int8";
|
||||
uri = "tcp://0.0.0.0:13415";
|
||||
};
|
||||
};
|
||||
piper.servers.greg = {
|
||||
enable = true;
|
||||
uri = "tcp://0.0.0.0:13416";
|
||||
voice = "en_US-amy-medium";
|
||||
};
|
||||
};
|
||||
|
||||
# Although NixOS has a package for Home Assistant, it is not kept as up to date as the container and the upstream
|
||||
# is very vocal about only supporting their own container or the HAOS deployments. So we deploy the container here
|
||||
# and avoid any potential messes from that
|
||||
virtualisation.oci-containers = {
|
||||
backend = "podman";
|
||||
# Although NixOS has a package for Home Assistant, it is not kept as up to date as the container and the upstream
|
||||
# is very vocal about only supporting their own container or the HAOS deployments. So we deploy the container here
|
||||
# and avoid any potential messes from that
|
||||
virtualisation.oci-containers = {
|
||||
backend = "podman";
|
||||
|
||||
# I have ZWave devices. The easiest way to connect to them is the zwavejs2mqtt service running, so we spin up
|
||||
# its container and map the ZWave device into it
|
||||
containers.zwave = {
|
||||
autoStart = false; # We will try to start it with udev.extraRules listed below, as this option starts it too quickly
|
||||
image = "zwavejs/zwave-js-ui:latest";
|
||||
ports = [ "8091:8091" "3000:3000" ];
|
||||
volumes = [ "/var/lib/zwave:/usr/src/app/store" ];
|
||||
extraOptions = [
|
||||
"--device" "/dev/serial/by-id/usb-0658_0200-if00:/dev/zwave"
|
||||
"--pull=newer"
|
||||
];
|
||||
environment = {
|
||||
TZ = "America/Chicago";
|
||||
CONSOLE_OUTPUT = "true";
|
||||
};
|
||||
};
|
||||
};
|
||||
# I have ZWave devices. The easiest way to connect to them is the zwavejs2mqtt service running, so we spin up
|
||||
# its container and map the ZWave device into it
|
||||
containers.zwave = {
|
||||
autoStart = false; # We will try to start it with udev.extraRules listed below, as this option starts it too quickly
|
||||
image = "zwavejs/zwave-js-ui:latest";
|
||||
ports = [ "8091:8091" "3000:3000" ];
|
||||
volumes = [ "/var/lib/zwave:/usr/src/app/store" ];
|
||||
extraOptions = [
|
||||
"--device"
|
||||
"/dev/serial/by-id/usb-0658_0200-if00:/dev/zwave"
|
||||
"--pull=newer"
|
||||
];
|
||||
environment = {
|
||||
TZ = "America/Chicago";
|
||||
CONSOLE_OUTPUT = "true";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
# Both of the above container need storage for their configuration and devices, but it is not created correctly by
|
||||
# the container. So we add the creation of /var/lib/{zwave,hass} to the systemd Unit files
|
||||
systemd.services = {
|
||||
"podman-zwave" = {
|
||||
after = [ "sys-devices-pci0000:00-0000:00:1e.0-0000:02:1b.0-usb2-2\\x2d1-2\\x2d1:1.0-tty-ttyACM0.device" ];
|
||||
wantedBy = [ "sys-devices-pci0000:00-0000:00:1e.0-0000:02:1b.0-usb2-2\\x2d1-2\\x2d1:1.0-tty-ttyACM0.device" ];
|
||||
serviceConfig = {
|
||||
StateDirectory = "zwave";
|
||||
StateDirectoryMode = pkgs.lib.mkForce "0777";
|
||||
};
|
||||
};
|
||||
};
|
||||
# Both of the above container need storage for their configuration and devices, but it is not created correctly by
|
||||
# the container. So we add the creation of /var/lib/{zwave,hass} to the systemd Unit files
|
||||
systemd.services = {
|
||||
"podman-zwave" = {
|
||||
after = [ "sys-devices-pci0000:00-0000:00:1e.0-0000:02:1b.0-usb2-2\\x2d1-2\\x2d1:1.0-tty-ttyACM0.device" ];
|
||||
wantedBy = [ "sys-devices-pci0000:00-0000:00:1e.0-0000:02:1b.0-usb2-2\\x2d1-2\\x2d1:1.0-tty-ttyACM0.device" ];
|
||||
serviceConfig = {
|
||||
StateDirectory = "zwave";
|
||||
StateDirectoryMode = pkgs.lib.mkForce "0777";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
services.udev.extraRules = ''
|
||||
SUBSYSTEM=="tty", KERNEL=="ttyACM0", TAG+="systemd"
|
||||
'';
|
||||
services.udev.extraRules = ''
|
||||
SUBSYSTEM=="tty", KERNEL=="ttyACM0", TAG+="systemd"
|
||||
'';
|
||||
|
||||
|
||||
greg.proxies = {
|
||||
"smart.home".target = "http://127.0.0.1:8123/";
|
||||
"smart.thehellings.lan".target = "http://127.0.0.1:8123/";
|
||||
"zwave.home".target = "http://127.0.0.1:8091/";
|
||||
};
|
||||
greg.proxies = {
|
||||
"smart.home".target = "http://127.0.0.1:8123/";
|
||||
"smart.thehellings.lan".target = "http://127.0.0.1:8123/";
|
||||
"zwave.home".target = "http://127.0.0.1:8091/";
|
||||
};
|
||||
|
||||
# Ensure that both ports are up and running. We keep 8123 directly open because we are on the LAN and sometimes want to connect
|
||||
# directly for troubleshooting Nginx configuration
|
||||
networking.firewall = {
|
||||
allowedTCPPorts = [ 80 443 ];
|
||||
};
|
||||
# Ensure that both ports are up and running. We keep 8123 directly open because we are on the LAN and sometimes want to connect
|
||||
# directly for troubleshooting Nginx configuration
|
||||
networking.firewall = {
|
||||
allowedTCPPorts = [ 80 443 ];
|
||||
};
|
||||
|
||||
greg.backup.jobs.zwave = {
|
||||
src = "/var/lib/zwave";
|
||||
dest = "zwave";
|
||||
id = "zwave-asdf";
|
||||
};
|
||||
greg.backup.jobs.zwave = {
|
||||
src = "/var/lib/zwave";
|
||||
dest = "zwave";
|
||||
id = "zwave-asdf";
|
||||
};
|
||||
|
||||
greg.backup.jobs.hass-backup = {
|
||||
src = "/var/lib/hass";
|
||||
dest = "hass";
|
||||
id = "hass-asdf";
|
||||
};
|
||||
greg.backup.jobs.hass-backup = {
|
||||
src = "/var/lib/hass";
|
||||
dest = "hass";
|
||||
id = "hass-asdf";
|
||||
};
|
||||
}
|
||||
|
||||
+174
-173
@@ -1,191 +1,192 @@
|
||||
{ pkgs, config, ... }:
|
||||
let
|
||||
lan = "ens18";
|
||||
lanIP = "10.42.1.5";
|
||||
iot = "ens19";
|
||||
iotIP = "192.168.66.250";
|
||||
routerIP = "10.42.1.2";
|
||||
extraHosts = builtins.readFile ./net/hosts;
|
||||
lan = "ens18";
|
||||
lanIP = "10.42.1.5";
|
||||
iot = "ens19";
|
||||
iotIP = "192.168.66.250";
|
||||
routerIP = "10.42.1.2";
|
||||
extraHosts = builtins.readFile ./net/hosts;
|
||||
|
||||
adblockUpdate = pkgs.writeShellScriptBin "adblockUpdate" (builtins.readFile ./adblockUpdate.sh);
|
||||
proxyPort = 3128;
|
||||
dnsPort = 53;
|
||||
dhcpPort = 67;
|
||||
dnsServers = [
|
||||
"9.9.9.9" # Quad 9
|
||||
"1.1.1.1" # Cloudflare
|
||||
"1.0.0.1" # Cloudflare
|
||||
"149.112.112.112" # Quad 9
|
||||
];
|
||||
in {
|
||||
greg.tailscale.enable = true;
|
||||
adblockUpdate = pkgs.writeShellScriptBin "adblockUpdate" (builtins.readFile ./adblockUpdate.sh);
|
||||
proxyPort = 3128;
|
||||
dnsPort = 53;
|
||||
dhcpPort = 67;
|
||||
dnsServers = [
|
||||
"9.9.9.9" # Quad 9
|
||||
"1.1.1.1" # Cloudflare
|
||||
"1.0.0.1" # Cloudflare
|
||||
"149.112.112.112" # Quad 9
|
||||
];
|
||||
in
|
||||
{
|
||||
greg.tailscale.enable = true;
|
||||
|
||||
# Really, why do I still have to force-disable this crap?
|
||||
boot.kernel.sysctl = {
|
||||
"net.ipv6.conf.${lan}.disable_ipv6" = true;
|
||||
"net.ipv6.conf.${iot}.disable_ipv6" = true;
|
||||
"net.ipv6.conf.lo.disable_ipv6" = true;
|
||||
};
|
||||
# Really, why do I still have to force-disable this crap?
|
||||
boot.kernel.sysctl = {
|
||||
"net.ipv6.conf.${lan}.disable_ipv6" = true;
|
||||
"net.ipv6.conf.${iot}.disable_ipv6" = true;
|
||||
"net.ipv6.conf.lo.disable_ipv6" = true;
|
||||
};
|
||||
|
||||
networking = {
|
||||
enableIPv6 = false;
|
||||
networkmanager.enable = pkgs.lib.mkForce false;
|
||||
defaultGateway = routerIP;
|
||||
nameservers = dnsServers;
|
||||
interfaces = {
|
||||
# This is our LAN port
|
||||
"${lan}" = {
|
||||
useDHCP = false;
|
||||
ipv4.addresses = [ {
|
||||
address = "${lanIP}";
|
||||
prefixLength = 16;
|
||||
} ];
|
||||
};
|
||||
networking = {
|
||||
enableIPv6 = false;
|
||||
networkmanager.enable = pkgs.lib.mkForce false;
|
||||
defaultGateway = routerIP;
|
||||
nameservers = dnsServers;
|
||||
interfaces = {
|
||||
# This is our LAN port
|
||||
"${lan}" = {
|
||||
useDHCP = false;
|
||||
ipv4.addresses = [{
|
||||
address = "${lanIP}";
|
||||
prefixLength = 16;
|
||||
}];
|
||||
};
|
||||
|
||||
"${iot}" = {
|
||||
useDHCP = false;
|
||||
ipv4.addresses = [ {
|
||||
address = "${iotIP}";
|
||||
prefixLength = 24;
|
||||
} ];
|
||||
};
|
||||
};
|
||||
firewall = {
|
||||
enable = false;
|
||||
allowedUDPPorts = [
|
||||
dhcpPort
|
||||
dnsPort
|
||||
1900 # Jellyfin auto-discovery
|
||||
7359 # Jellyfin auto-discovery
|
||||
];
|
||||
allowedTCPPorts = [
|
||||
dnsPort
|
||||
proxyPort
|
||||
80
|
||||
];
|
||||
};
|
||||
nftables.enable = false;
|
||||
};
|
||||
"${iot}" = {
|
||||
useDHCP = false;
|
||||
ipv4.addresses = [{
|
||||
address = "${iotIP}";
|
||||
prefixLength = 24;
|
||||
}];
|
||||
};
|
||||
};
|
||||
firewall = {
|
||||
enable = false;
|
||||
allowedUDPPorts = [
|
||||
dhcpPort
|
||||
dnsPort
|
||||
1900 # Jellyfin auto-discovery
|
||||
7359 # Jellyfin auto-discovery
|
||||
];
|
||||
allowedTCPPorts = [
|
||||
dnsPort
|
||||
proxyPort
|
||||
80
|
||||
];
|
||||
};
|
||||
nftables.enable = false;
|
||||
};
|
||||
|
||||
environment.etc."hosts.d/local".text = extraHosts;
|
||||
environment.etc."hosts.d/local".text = extraHosts;
|
||||
|
||||
fileSystems = {
|
||||
"/media" = {
|
||||
device = "10.42.1.4:/volume1/video/";
|
||||
fsType = "nfs";
|
||||
options = [ "ro" ];
|
||||
};
|
||||
};
|
||||
fileSystems = {
|
||||
"/media" = {
|
||||
device = "10.42.1.4:/volume1/video/";
|
||||
fsType = "nfs";
|
||||
options = [ "ro" ];
|
||||
};
|
||||
};
|
||||
|
||||
services = {
|
||||
# Video services
|
||||
jellyfin = {
|
||||
enable = true;
|
||||
openFirewall = true;
|
||||
};
|
||||
services = {
|
||||
# Video services
|
||||
jellyfin = {
|
||||
enable = true;
|
||||
openFirewall = true;
|
||||
};
|
||||
|
||||
#########
|
||||
# Blind service proxy behind the walls of the VPN
|
||||
########
|
||||
_3proxy = {
|
||||
enable = true;
|
||||
services = [ {
|
||||
type = "socks";
|
||||
auth = [ "strong" ];
|
||||
bindPort = proxyPort;
|
||||
acl = [ {
|
||||
rule = "allow";
|
||||
users = [ "greg" ];
|
||||
} ];
|
||||
} ];
|
||||
#usersFile = "/run/agenix/3proxy";
|
||||
denyPrivate = false;
|
||||
};
|
||||
#########
|
||||
# Blind service proxy behind the walls of the VPN
|
||||
########
|
||||
_3proxy = {
|
||||
enable = true;
|
||||
services = [{
|
||||
type = "socks";
|
||||
auth = [ "strong" ];
|
||||
bindPort = proxyPort;
|
||||
acl = [{
|
||||
rule = "allow";
|
||||
users = [ "greg" ];
|
||||
}];
|
||||
}];
|
||||
#usersFile = "/run/agenix/3proxy";
|
||||
denyPrivate = false;
|
||||
};
|
||||
|
||||
#########
|
||||
# dnsmasq config
|
||||
########
|
||||
dnsmasq = {
|
||||
enable = true;
|
||||
settings = {
|
||||
domain = "thehellings.lan";
|
||||
dhcp-range = [
|
||||
"${lan},10.42.2.1,10.42.2.255,255.255.0.0,12h"
|
||||
"${iot},192.168.66.3,192.168.66.150,255.255.255.0,12h"
|
||||
"vlan67@${lan},192.168.67.3,192.168.67.150,12h"
|
||||
];
|
||||
dhcp-option = [
|
||||
"${lan},option:router,${routerIP}"
|
||||
"${lan},option:dns-server,${lanIP},1.1.1.1"
|
||||
"${lan},option:domain-search,thehellings.lan"
|
||||
#########
|
||||
# dnsmasq config
|
||||
########
|
||||
dnsmasq = {
|
||||
enable = true;
|
||||
settings = {
|
||||
domain = "thehellings.lan";
|
||||
dhcp-range = [
|
||||
"${lan},10.42.2.1,10.42.2.255,255.255.0.0,12h"
|
||||
"${iot},192.168.66.3,192.168.66.150,255.255.255.0,12h"
|
||||
"vlan67@${lan},192.168.67.3,192.168.67.150,12h"
|
||||
];
|
||||
dhcp-option = [
|
||||
"${lan},option:router,${routerIP}"
|
||||
"${lan},option:dns-server,${lanIP},1.1.1.1"
|
||||
"${lan},option:domain-search,thehellings.lan"
|
||||
|
||||
"${iot},option:router,192.168.66.1"
|
||||
"${iot},option:dns-server,${iotIP}"
|
||||
"${iot},option:router,192.168.66.1"
|
||||
"${iot},option:dns-server,${iotIP}"
|
||||
|
||||
"vlan67@${lan},option:router,192.168.67.1"
|
||||
"vlan67@${lan},option:dns-server,192.168.67.1"
|
||||
];
|
||||
dhcp-host = [
|
||||
# Static IPs for personal work
|
||||
"2a:5d:23:10:4e:22,10.42.0.5" # SAN Switch
|
||||
"00:00:de:ad:be:ef,10.42.2.254"
|
||||
"01:a8:a1:59:c7:8a:12,10.42.2.253" # BMC management interface for isaiah
|
||||
"vlan67@${lan},option:router,192.168.67.1"
|
||||
"vlan67@${lan},option:dns-server,192.168.67.1"
|
||||
];
|
||||
dhcp-host = [
|
||||
# Static IPs for personal work
|
||||
"2a:5d:23:10:4e:22,10.42.0.5" # SAN Switch
|
||||
"00:00:de:ad:be:ef,10.42.2.254"
|
||||
"01:a8:a1:59:c7:8a:12,10.42.2.253" # BMC management interface for isaiah
|
||||
|
||||
# Static IPs for things in the IOT range
|
||||
"b4:b0:24:9a:02:4a,192.168.66.5" # LD125
|
||||
"98:da:c4:20:f3:64,192.168.66.6" # Dining room light
|
||||
"54:af:97:c1:dc:b9,192.168.66.25" # Master bedroom Kasa switch
|
||||
"f0:03:8c:b3:b0:f6,192.168.66.55" # Roomba
|
||||
"4c:a1:61:05:cd:52,192.168.66.61" # Rainbird
|
||||
"48:d6:d5:5d:81:21,192.168.66.65" # Google Home
|
||||
"6c:29:90:3e:e2:02,192.168.66.66" # wiz
|
||||
"28:87:ba:0e:ca:da,192.168.66.74" #
|
||||
"28:87:ba:0e:c9:fd,192.168.66.75" # Master closet
|
||||
"54:af:97:c2:0f:a1,192.168.66.76" # Master toilet
|
||||
"54:af:97:83:ed:33,192.168.66.80"
|
||||
"98:da:c4:77:80:18,192.168.66.84" # Kitchen lights
|
||||
"98:da:c4:21:1b:2e,192.168.66.85" # Living Room lights
|
||||
"0c:80:63:41:6e:0f,192.168.66.90" # Front porch
|
||||
"0c:80:63:41:6c:5d,192.168.66.98" # House number
|
||||
"ac:84:c6:5e:4b:28,192.168.66.100"
|
||||
"98:da:c4:77:7f:4d,192.168.66.102" # Office lights
|
||||
"8c:85:80:1c:f9:d1,192.168.66.104"
|
||||
"98:da:c4:77:82:7b,192.168.66.105" # Parlor lamp
|
||||
"0c:80:63:41:74:73,192.168.66.106" # Front hall light switch
|
||||
"98:da:c4:20:ea:db,192.168.66.107" # Parlor light switch
|
||||
"8c:49:62:aa:58:60,192.168.66.108" # Roku, HiHandsome
|
||||
"92:3e:11:c7:c5:be,192.168.66.109"
|
||||
"d8:0d:17:19:60:62,192.168.66.112"
|
||||
"b4:b0:24:9a:12:53,192.168.66.130" # KL125
|
||||
"b4:b0:24:9a:14:0e,192.168.66.131"
|
||||
"e4:f0:42:61:fa:b5,192.168.66.149" # Google Home-mini
|
||||
];
|
||||
expand-hosts = true;
|
||||
log-dhcp = true;
|
||||
log-queries = true;
|
||||
no-hosts = true; # Do not read /etc/hosts, which makes genesis resolve to 127.0.0.2
|
||||
addn-hosts = "/etc/adblock_hosts";
|
||||
hostsdir = "/etc/hosts.d/";
|
||||
server = dnsServers;
|
||||
};
|
||||
};
|
||||
# Static IPs for things in the IOT range
|
||||
"b4:b0:24:9a:02:4a,192.168.66.5" # LD125
|
||||
"98:da:c4:20:f3:64,192.168.66.6" # Dining room light
|
||||
"54:af:97:c1:dc:b9,192.168.66.25" # Master bedroom Kasa switch
|
||||
"f0:03:8c:b3:b0:f6,192.168.66.55" # Roomba
|
||||
"4c:a1:61:05:cd:52,192.168.66.61" # Rainbird
|
||||
"48:d6:d5:5d:81:21,192.168.66.65" # Google Home
|
||||
"6c:29:90:3e:e2:02,192.168.66.66" # wiz
|
||||
"28:87:ba:0e:ca:da,192.168.66.74" #
|
||||
"28:87:ba:0e:c9:fd,192.168.66.75" # Master closet
|
||||
"54:af:97:c2:0f:a1,192.168.66.76" # Master toilet
|
||||
"54:af:97:83:ed:33,192.168.66.80"
|
||||
"98:da:c4:77:80:18,192.168.66.84" # Kitchen lights
|
||||
"98:da:c4:21:1b:2e,192.168.66.85" # Living Room lights
|
||||
"0c:80:63:41:6e:0f,192.168.66.90" # Front porch
|
||||
"0c:80:63:41:6c:5d,192.168.66.98" # House number
|
||||
"ac:84:c6:5e:4b:28,192.168.66.100"
|
||||
"98:da:c4:77:7f:4d,192.168.66.102" # Office lights
|
||||
"8c:85:80:1c:f9:d1,192.168.66.104"
|
||||
"98:da:c4:77:82:7b,192.168.66.105" # Parlor lamp
|
||||
"0c:80:63:41:74:73,192.168.66.106" # Front hall light switch
|
||||
"98:da:c4:20:ea:db,192.168.66.107" # Parlor light switch
|
||||
"8c:49:62:aa:58:60,192.168.66.108" # Roku, HiHandsome
|
||||
"92:3e:11:c7:c5:be,192.168.66.109"
|
||||
"d8:0d:17:19:60:62,192.168.66.112"
|
||||
"b4:b0:24:9a:12:53,192.168.66.130" # KL125
|
||||
"b4:b0:24:9a:14:0e,192.168.66.131"
|
||||
"e4:f0:42:61:fa:b5,192.168.66.149" # Google Home-mini
|
||||
];
|
||||
expand-hosts = true;
|
||||
log-dhcp = true;
|
||||
log-queries = true;
|
||||
no-hosts = true; # Do not read /etc/hosts, which makes genesis resolve to 127.0.0.2
|
||||
addn-hosts = "/etc/adblock_hosts";
|
||||
hostsdir = "/etc/hosts.d/";
|
||||
server = dnsServers;
|
||||
};
|
||||
};
|
||||
|
||||
# Update adblock list
|
||||
cron = {
|
||||
enable = true;
|
||||
systemCronJobs = [
|
||||
"* * * * * root ${adblockUpdate} 2>&1 > /var/log/adblock.log"
|
||||
];
|
||||
};
|
||||
}; # End of services configuration
|
||||
# Update adblock list
|
||||
cron = {
|
||||
enable = true;
|
||||
systemCronJobs = [
|
||||
"* * * * * root ${adblockUpdate} 2>&1 > /var/log/adblock.log"
|
||||
];
|
||||
};
|
||||
}; # End of services configuration
|
||||
|
||||
greg.proxies = {
|
||||
"jellyfin.home".target = "http://localhost:8096/";
|
||||
};
|
||||
greg.proxies = {
|
||||
"jellyfin.home".target = "http://localhost:8096/";
|
||||
};
|
||||
|
||||
environment.systemPackages = with pkgs; [
|
||||
bind
|
||||
curl # Used by dnsmasq fetching
|
||||
sqlite
|
||||
];
|
||||
environment.systemPackages = with pkgs; [
|
||||
bind
|
||||
curl # Used by dnsmasq fetching
|
||||
sqlite
|
||||
];
|
||||
}
|
||||
|
||||
+71
-70
@@ -1,78 +1,79 @@
|
||||
{ config, pkgs, ... }:
|
||||
|
||||
let
|
||||
ip = "100.68.203.1";
|
||||
in {
|
||||
nix-bitcoin = {
|
||||
generateSecrets = true;
|
||||
operator = {
|
||||
enable = true;
|
||||
name = "greg";
|
||||
};
|
||||
useVersionLockedPkgs = true; # Use the exact versions of packages from upstream
|
||||
};
|
||||
ip = "100.68.203.1";
|
||||
in
|
||||
{
|
||||
nix-bitcoin = {
|
||||
generateSecrets = true;
|
||||
operator = {
|
||||
enable = true;
|
||||
name = "greg";
|
||||
};
|
||||
useVersionLockedPkgs = true; # Use the exact versions of packages from upstream
|
||||
};
|
||||
|
||||
networking.firewall.allowedTCPPorts = with config.services; [
|
||||
bitcoind.port
|
||||
bitcoind.rpc.port
|
||||
lnd.restPort
|
||||
lnd.port
|
||||
mempool.frontend.port
|
||||
];
|
||||
networking.firewall.allowedTCPPorts = with config.services; [
|
||||
bitcoind.port
|
||||
bitcoind.rpc.port
|
||||
lnd.restPort
|
||||
lnd.port
|
||||
mempool.frontend.port
|
||||
];
|
||||
|
||||
greg.backup.jobs = {
|
||||
clightning = {
|
||||
src = config.services.clightning.replication.local.directory;
|
||||
dest = "hosea-clightning";
|
||||
id = "clightning";
|
||||
};
|
||||
};
|
||||
greg.backup.jobs = {
|
||||
clightning = {
|
||||
src = config.services.clightning.replication.local.directory;
|
||||
dest = "hosea-clightning";
|
||||
id = "clightning";
|
||||
};
|
||||
};
|
||||
|
||||
services = {
|
||||
backups = {
|
||||
enable = true;
|
||||
frequency = "hourly";
|
||||
};
|
||||
bitcoind = {
|
||||
enable = true;
|
||||
address = "0.0.0.0";
|
||||
dataDir = "/chain/bitcoind";
|
||||
listen = true;
|
||||
rpc = {
|
||||
address = ip;
|
||||
allowip = [
|
||||
"100.1.1.1/8"
|
||||
];
|
||||
};
|
||||
};
|
||||
clightning = {
|
||||
enable = true;
|
||||
address = ip;
|
||||
port = 9736;
|
||||
replication = {
|
||||
enable = true;
|
||||
local.directory = "/var/backup/clightning";
|
||||
encrypt = false;
|
||||
};
|
||||
};
|
||||
electrs = {
|
||||
enable = true;
|
||||
address = ip;
|
||||
};
|
||||
lnd = {
|
||||
enable = true;
|
||||
address = ip;
|
||||
lndconnect.enable = true;
|
||||
};
|
||||
mempool = {
|
||||
enable = true;
|
||||
frontend = {
|
||||
enable = true;
|
||||
address = ip;
|
||||
};
|
||||
};
|
||||
};
|
||||
services = {
|
||||
backups = {
|
||||
enable = true;
|
||||
frequency = "hourly";
|
||||
};
|
||||
bitcoind = {
|
||||
enable = true;
|
||||
address = "0.0.0.0";
|
||||
dataDir = "/chain/bitcoind";
|
||||
listen = true;
|
||||
rpc = {
|
||||
address = ip;
|
||||
allowip = [
|
||||
"100.1.1.1/8"
|
||||
];
|
||||
};
|
||||
};
|
||||
clightning = {
|
||||
enable = true;
|
||||
address = ip;
|
||||
port = 9736;
|
||||
replication = {
|
||||
enable = true;
|
||||
local.directory = "/var/backup/clightning";
|
||||
encrypt = false;
|
||||
};
|
||||
};
|
||||
electrs = {
|
||||
enable = true;
|
||||
address = ip;
|
||||
};
|
||||
lnd = {
|
||||
enable = true;
|
||||
address = ip;
|
||||
lndconnect.enable = true;
|
||||
};
|
||||
mempool = {
|
||||
enable = true;
|
||||
frontend = {
|
||||
enable = true;
|
||||
address = ip;
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
environment.systemPackages = with pkgs; [
|
||||
];
|
||||
environment.systemPackages = with pkgs; [
|
||||
];
|
||||
}
|
||||
|
||||
+49
-48
@@ -4,58 +4,59 @@
|
||||
|
||||
{ config, pkgs, lib, inputs, overlays, ... }:
|
||||
let
|
||||
wanInterface = "enp2s0";
|
||||
lanInterface = "enp1s0";
|
||||
lanIpAddress = "10.42.1.7";
|
||||
wanInterface = "enp2s0";
|
||||
lanInterface = "enp1s0";
|
||||
lanIpAddress = "10.42.1.7";
|
||||
in
|
||||
|
||||
{
|
||||
imports =
|
||||
[ # Include the results of the hardware scan.
|
||||
./hardware-configuration.nix
|
||||
inputs.btc.nixosModules.default
|
||||
./bitcoin.nix
|
||||
];
|
||||
imports =
|
||||
[
|
||||
# Include the results of the hardware scan.
|
||||
./hardware-configuration.nix
|
||||
inputs.btc.nixosModules.default
|
||||
./bitcoin.nix
|
||||
];
|
||||
|
||||
# Bootloader
|
||||
boot = {
|
||||
loader = {
|
||||
systemd-boot.enable = true;
|
||||
efi = {
|
||||
canTouchEfiVariables = true;
|
||||
efiSysMountPoint = "/boot/";
|
||||
};
|
||||
};
|
||||
extraModprobeConfig = "vboxdrv";
|
||||
};
|
||||
users.users.greg.extraGroups = [ "vboxusers" ];
|
||||
# Bootloader
|
||||
boot = {
|
||||
loader = {
|
||||
systemd-boot.enable = true;
|
||||
efi = {
|
||||
canTouchEfiVariables = true;
|
||||
efiSysMountPoint = "/boot/";
|
||||
};
|
||||
};
|
||||
extraModprobeConfig = "vboxdrv";
|
||||
};
|
||||
users.users.greg.extraGroups = [ "vboxusers" ];
|
||||
|
||||
networking = {
|
||||
hostName = "hosea";
|
||||
nameservers = [ "10.42.1.5" ];
|
||||
defaultGateway = "10.42.1.1";
|
||||
interfaces = {
|
||||
"${wanInterface}".useDHCP = true;
|
||||
"${lanInterface}" = {
|
||||
useDHCP = false;
|
||||
ipv4.addresses = [{
|
||||
address = lanIpAddress;
|
||||
prefixLength = 16;
|
||||
}];
|
||||
};
|
||||
};
|
||||
};
|
||||
networking = {
|
||||
hostName = "hosea";
|
||||
nameservers = [ "10.42.1.5" ];
|
||||
defaultGateway = "10.42.1.1";
|
||||
interfaces = {
|
||||
"${wanInterface}".useDHCP = true;
|
||||
"${lanInterface}" = {
|
||||
useDHCP = false;
|
||||
ipv4.addresses = [{
|
||||
address = lanIpAddress;
|
||||
prefixLength = 16;
|
||||
}];
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
# Serves as the router, DHCP, and DNS for the site
|
||||
greg = {
|
||||
tailscale.enable = true;
|
||||
home = true;
|
||||
};
|
||||
services = {
|
||||
# Configure keymap
|
||||
xserver.xkb = {
|
||||
layout = "us";
|
||||
variant = "";
|
||||
};
|
||||
};
|
||||
# Serves as the router, DHCP, and DNS for the site
|
||||
greg = {
|
||||
tailscale.enable = true;
|
||||
home = true;
|
||||
};
|
||||
services = {
|
||||
# Configure keymap
|
||||
xserver.xkb = {
|
||||
layout = "us";
|
||||
variant = "";
|
||||
};
|
||||
};
|
||||
}
|
||||
|
||||
@@ -5,7 +5,8 @@
|
||||
|
||||
{
|
||||
imports =
|
||||
[ (modulesPath + "/installer/scan/not-detected.nix")
|
||||
[
|
||||
(modulesPath + "/installer/scan/not-detected.nix")
|
||||
];
|
||||
|
||||
boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "nvme" "usbhid" "uas" "sd_mod" ];
|
||||
@@ -14,13 +15,15 @@
|
||||
boot.extraModulePackages = [ ];
|
||||
|
||||
fileSystems."/" =
|
||||
{ device = "/dev/disk/by-uuid/d4ac74f7-62bb-421a-aad8-566277c9d8ba";
|
||||
{
|
||||
device = "/dev/disk/by-uuid/d4ac74f7-62bb-421a-aad8-566277c9d8ba";
|
||||
fsType = "btrfs";
|
||||
options = [ "subvol=@" ];
|
||||
};
|
||||
|
||||
fileSystems."/boot" =
|
||||
{ device = "/dev/disk/by-uuid/1F51-B638";
|
||||
{
|
||||
device = "/dev/disk/by-uuid/1F51-B638";
|
||||
fsType = "vfat";
|
||||
};
|
||||
|
||||
|
||||
@@ -1,11 +1,11 @@
|
||||
{ pkgs, config, ...}:
|
||||
{ pkgs, config, ... }:
|
||||
|
||||
{
|
||||
# Bootloader.
|
||||
boot = {
|
||||
loader.grub = {
|
||||
enable = true;
|
||||
device = "/dev/sda";
|
||||
};
|
||||
};
|
||||
# Bootloader.
|
||||
boot = {
|
||||
loader.grub = {
|
||||
enable = true;
|
||||
device = "/dev/sda";
|
||||
};
|
||||
};
|
||||
}
|
||||
|
||||
+16
-15
@@ -5,20 +5,21 @@
|
||||
{ config, pkgs, agenix, ... }:
|
||||
|
||||
{
|
||||
imports = [ # Include the results of the hardware scan.
|
||||
./hardware-configuration.nix
|
||||
./boot.nix
|
||||
./filesystem.nix
|
||||
./location.nix
|
||||
./networking.nix
|
||||
./wiki.nix
|
||||
];
|
||||
imports = [
|
||||
# Include the results of the hardware scan.
|
||||
./hardware-configuration.nix
|
||||
./boot.nix
|
||||
./filesystem.nix
|
||||
./location.nix
|
||||
./networking.nix
|
||||
./wiki.nix
|
||||
];
|
||||
|
||||
# Define a user account. Don't forget to set a password with ‘passwd’.
|
||||
users.users.greg = {
|
||||
isNormalUser = true;
|
||||
description = "Gregory Hellings";
|
||||
extraGroups = [ "networkmanager" "wheel" ];
|
||||
packages = with pkgs; [];
|
||||
};
|
||||
# Define a user account. Don't forget to set a password with ‘passwd’.
|
||||
users.users.greg = {
|
||||
isNormalUser = true;
|
||||
description = "Gregory Hellings";
|
||||
extraGroups = [ "networkmanager" "wheel" ];
|
||||
packages = with pkgs; [ ];
|
||||
};
|
||||
}
|
||||
|
||||
@@ -2,11 +2,11 @@
|
||||
|
||||
let
|
||||
in {
|
||||
fileSystems."serve" = {
|
||||
#device = "10.42.1.4:/volume1/icdm-mysql/";
|
||||
#fsType = "nfs";
|
||||
device = "/dev/sdb1";
|
||||
fsType = "auto";
|
||||
mountPoint = "/srv";
|
||||
};
|
||||
fileSystems."serve" = {
|
||||
#device = "10.42.1.4:/volume1/icdm-mysql/";
|
||||
#fsType = "nfs";
|
||||
device = "/dev/sdb1";
|
||||
fsType = "auto";
|
||||
mountPoint = "/srv";
|
||||
};
|
||||
}
|
||||
|
||||
@@ -5,7 +5,8 @@
|
||||
|
||||
{
|
||||
imports =
|
||||
[ (modulesPath + "/installer/scan/not-detected.nix")
|
||||
[
|
||||
(modulesPath + "/installer/scan/not-detected.nix")
|
||||
];
|
||||
|
||||
boot.initrd.availableKernelModules = [ "xhci_pci" "ehci_pci" "ahci" "usbhid" "usb_storage" "sd_mod" ];
|
||||
@@ -14,24 +15,26 @@
|
||||
boot.extraModulePackages = [ ];
|
||||
|
||||
fileSystems."/" =
|
||||
{ device = "/dev/disk/by-uuid/dab0d455-e25e-4445-8fa4-5320047d7e7b";
|
||||
{
|
||||
device = "/dev/disk/by-uuid/dab0d455-e25e-4445-8fa4-5320047d7e7b";
|
||||
fsType = "btrfs";
|
||||
options = [ "subvol=@" ];
|
||||
};
|
||||
|
||||
fileSystems."/boot" =
|
||||
{ device = "/dev/disk/by-uuid/5aedbb07-5761-423b-909d-2560405eae32";
|
||||
{
|
||||
device = "/dev/disk/by-uuid/5aedbb07-5761-423b-909d-2560405eae32";
|
||||
fsType = "ext4";
|
||||
};
|
||||
|
||||
fileSystems."/var" =
|
||||
{ device = "/dev/disk/by-uuid/57968536-c29d-417d-997e-85223d1d1f65";
|
||||
{
|
||||
device = "/dev/disk/by-uuid/57968536-c29d-417d-997e-85223d1d1f65";
|
||||
fsType = "btrfs";
|
||||
};
|
||||
|
||||
swapDevices =
|
||||
[ { device = "/dev/disk/by-uuid/09691dce-375a-43c6-8d40-4498d20a6d9a"; }
|
||||
];
|
||||
[{ device = "/dev/disk/by-uuid/09691dce-375a-43c6-8d40-4498d20a6d9a"; }];
|
||||
|
||||
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
|
||||
# (the default) this is the recommended approach. When using systemd-networkd it's
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
{...}:
|
||||
{ ... }:
|
||||
|
||||
{
|
||||
# Set your time zone.
|
||||
|
||||
@@ -1,58 +1,59 @@
|
||||
{...}:
|
||||
{ ... }:
|
||||
let
|
||||
dnsHosts = builtins.concatStringsSep "\n" [
|
||||
"wiki.icdm.lan 10.42.101.1"
|
||||
];
|
||||
dnsHosts = builtins.concatStringsSep "\n" [
|
||||
"wiki.icdm.lan 10.42.101.1"
|
||||
];
|
||||
in
|
||||
{
|
||||
# If we have to do proxying in Bayonnais, we can start to work on that here
|
||||
# networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";
|
||||
networking = {
|
||||
hostName = "icdm-root";
|
||||
useDHCP = false;
|
||||
defaultGateway = "10.42.1.1";
|
||||
nameservers = [ "100.100.100.100" "10.42.1.2" ];
|
||||
enableIPv6 = false;
|
||||
# If we have to do proxying in Bayonnais, we can start to work on that here
|
||||
# networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";
|
||||
networking = {
|
||||
hostName = "icdm-root";
|
||||
useDHCP = false;
|
||||
defaultGateway = "10.42.1.1";
|
||||
nameservers = [ "100.100.100.100" "10.42.1.2" ];
|
||||
enableIPv6 = false;
|
||||
|
||||
interfaces = {
|
||||
eno1.ipv4.addresses = [ {
|
||||
address = "10.42.101.1";
|
||||
prefixLength = 16;
|
||||
} {
|
||||
address = "10.77.1.2";
|
||||
prefixLength = 16;
|
||||
} ];
|
||||
};
|
||||
# Allow traffic through
|
||||
firewall = {
|
||||
enable = true;
|
||||
allowedTCPPorts = [ 53 ];
|
||||
allowedUDPPorts = [ 53 67 ];
|
||||
};
|
||||
interfaces = {
|
||||
eno1.ipv4.addresses = [{
|
||||
address = "10.42.101.1";
|
||||
prefixLength = 16;
|
||||
}
|
||||
{
|
||||
address = "10.77.1.2";
|
||||
prefixLength = 16;
|
||||
}];
|
||||
};
|
||||
# Allow traffic through
|
||||
firewall = {
|
||||
enable = true;
|
||||
allowedTCPPorts = [ 53 ];
|
||||
allowedUDPPorts = [ 53 67 ];
|
||||
};
|
||||
|
||||
extraHosts = "${dnsHosts}";
|
||||
};
|
||||
extraHosts = "${dnsHosts}";
|
||||
};
|
||||
|
||||
services.dnsmasq = {
|
||||
enable = true;
|
||||
settings = {
|
||||
domain = "icdm.lan";
|
||||
dhcp-range = [
|
||||
"eno1,10.77.1.10,10.77.1.255,255.255.0.0,12h"
|
||||
];
|
||||
dhcp-option = [
|
||||
"eno1,option:router,10.77.1.1"
|
||||
"eno1,option:dns-server,10.77.1.2,1.1.1.1"
|
||||
"eno1,option:domain-search,icdm.lan"
|
||||
];
|
||||
expand-hosts = true;
|
||||
log-dhcp = true;
|
||||
log-queries = true;
|
||||
# Upstream servers
|
||||
server = [
|
||||
"1.1.1.1"
|
||||
"8.8.4.4"
|
||||
];
|
||||
};
|
||||
};
|
||||
services.dnsmasq = {
|
||||
enable = true;
|
||||
settings = {
|
||||
domain = "icdm.lan";
|
||||
dhcp-range = [
|
||||
"eno1,10.77.1.10,10.77.1.255,255.255.0.0,12h"
|
||||
];
|
||||
dhcp-option = [
|
||||
"eno1,option:router,10.77.1.1"
|
||||
"eno1,option:dns-server,10.77.1.2,1.1.1.1"
|
||||
"eno1,option:domain-search,icdm.lan"
|
||||
];
|
||||
expand-hosts = true;
|
||||
log-dhcp = true;
|
||||
log-queries = true;
|
||||
# Upstream servers
|
||||
server = [
|
||||
"1.1.1.1"
|
||||
"8.8.4.4"
|
||||
];
|
||||
};
|
||||
};
|
||||
}
|
||||
|
||||
+24
-24
@@ -1,32 +1,32 @@
|
||||
{ pkgs, ... }:
|
||||
let
|
||||
wikiPasswordFile = "/var/mediawiki/passwordFile";
|
||||
wikiHost = "wiki.icdm.lan";
|
||||
kiwixport = 8080;
|
||||
dependents = with pkgs; [
|
||||
enwiki-dump
|
||||
transmission
|
||||
];
|
||||
wikiPasswordFile = "/var/mediawiki/passwordFile";
|
||||
wikiHost = "wiki.icdm.lan";
|
||||
kiwixport = 8080;
|
||||
dependents = with pkgs; [
|
||||
enwiki-dump
|
||||
transmission
|
||||
];
|
||||
in
|
||||
{
|
||||
services.kiwix-serve = {
|
||||
enable = true;
|
||||
port = kiwixport;
|
||||
path = "/srv/zims/*.zim";
|
||||
};
|
||||
services.kiwix-serve = {
|
||||
enable = true;
|
||||
port = kiwixport;
|
||||
path = "/srv/zims/*.zim";
|
||||
};
|
||||
|
||||
services.transmission = {
|
||||
enable = true;
|
||||
settings = {
|
||||
download-dir = "/srv";
|
||||
incomplete-dir = "/srv/incomplete";
|
||||
rpc-bind-address = "0.0.0.0";
|
||||
rpc-whitelist = "10.42.*,127.*,localhost";
|
||||
};
|
||||
};
|
||||
services.transmission = {
|
||||
enable = true;
|
||||
settings = {
|
||||
download-dir = "/srv";
|
||||
incomplete-dir = "/srv/incomplete";
|
||||
rpc-bind-address = "0.0.0.0";
|
||||
rpc-whitelist = "10.42.*,127.*,localhost";
|
||||
};
|
||||
};
|
||||
|
||||
greg.proxies."${wikiHost}".target = "http://localhost:${toString kiwixport}";
|
||||
networking.firewall.allowedTCPPorts = [ 80 ];
|
||||
greg.proxies."${wikiHost}".target = "http://localhost:${toString kiwixport}";
|
||||
networking.firewall.allowedTCPPorts = [ 80 ];
|
||||
|
||||
environment.systemPackages = dependents;
|
||||
environment.systemPackages = dependents;
|
||||
}
|
||||
|
||||
+10
-10
@@ -1,15 +1,15 @@
|
||||
{ pkgs, lib, modulesPath, ... }:
|
||||
{
|
||||
|
||||
imports = [
|
||||
"${modulesPath}/installer/cd-dvd/installation-cd-graphical-calamares-gnome.nix"
|
||||
"${modulesPath}/installer/cd-dvd/channel.nix"
|
||||
];
|
||||
imports = [
|
||||
"${modulesPath}/installer/cd-dvd/installation-cd-graphical-calamares-gnome.nix"
|
||||
"${modulesPath}/installer/cd-dvd/channel.nix"
|
||||
];
|
||||
|
||||
networking.networkmanager.enable = lib.mkForce false;
|
||||
users.users.greg.initialPassword = "";
|
||||
#services.getty.autologinUser = lib.mkForce "greg";
|
||||
environment.systemPackages = with pkgs; [
|
||||
tree
|
||||
];
|
||||
networking.networkmanager.enable = lib.mkForce false;
|
||||
users.users.greg.initialPassword = "";
|
||||
#services.getty.autologinUser = lib.mkForce "greg";
|
||||
environment.systemPackages = with pkgs; [
|
||||
tree
|
||||
];
|
||||
}
|
||||
|
||||
+30
-29
@@ -1,33 +1,34 @@
|
||||
{ config, ... }:
|
||||
|
||||
let
|
||||
publicIp = (builtins.elemAt config.networking.interfaces.enp68s0.ipv4.addresses 0).address;
|
||||
sanIp = (builtins.elemAt config.networking.interfaces.enp67s0.ipv4.addresses 0).address;
|
||||
vip = (builtins.elemAt config.networking.interfaces.enp68s0.ipv4.addresses 1).address;
|
||||
hostname = config.networking.hostName;
|
||||
baseConfig = import ../../ceph/home.nix;
|
||||
in {
|
||||
services.ceph-benaco = baseConfig // {
|
||||
enable = false;
|
||||
monitor = {
|
||||
enable = false;
|
||||
initialKeyring = ../../secrets/home.mon.keyring;
|
||||
nodeName = hostname;
|
||||
bindAddr = publicIp;
|
||||
advertisedPublicAddr = vip;
|
||||
};
|
||||
osdBindAddr = publicIp;
|
||||
osdAdvertisedPublicAddr = publicIp;
|
||||
osds = {
|
||||
osd1 = {
|
||||
enable = false;
|
||||
bootstrapKeyring = ../../secrets/home.osd-bootstrap.keyring;
|
||||
id = 1;
|
||||
uuid = "c13bd2b1-cfc7-4966-8da5-d92356e87e06";
|
||||
blockDevice = "/dev/sda";
|
||||
blockDeviceUdevRuleMatcher = ''KERNEL=="sda"'';
|
||||
clusterAddress = sanIp;
|
||||
};
|
||||
};
|
||||
};
|
||||
publicIp = (builtins.elemAt config.networking.interfaces.enp68s0.ipv4.addresses 0).address;
|
||||
sanIp = (builtins.elemAt config.networking.interfaces.enp67s0.ipv4.addresses 0).address;
|
||||
vip = (builtins.elemAt config.networking.interfaces.enp68s0.ipv4.addresses 1).address;
|
||||
hostname = config.networking.hostName;
|
||||
baseConfig = import ../../ceph/home.nix;
|
||||
in
|
||||
{
|
||||
services.ceph-benaco = baseConfig // {
|
||||
enable = false;
|
||||
monitor = {
|
||||
enable = false;
|
||||
initialKeyring = ../../secrets/home.mon.keyring;
|
||||
nodeName = hostname;
|
||||
bindAddr = publicIp;
|
||||
advertisedPublicAddr = vip;
|
||||
};
|
||||
osdBindAddr = publicIp;
|
||||
osdAdvertisedPublicAddr = publicIp;
|
||||
osds = {
|
||||
osd1 = {
|
||||
enable = false;
|
||||
bootstrapKeyring = ../../secrets/home.osd-bootstrap.keyring;
|
||||
id = 1;
|
||||
uuid = "c13bd2b1-cfc7-4966-8da5-d92356e87e06";
|
||||
blockDevice = "/dev/sda";
|
||||
blockDeviceUdevRuleMatcher = ''KERNEL=="sda"'';
|
||||
clusterAddress = sanIp;
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
|
||||
+119
-117
@@ -5,125 +5,127 @@
|
||||
{ config, pkgs, lib, ... }:
|
||||
|
||||
{
|
||||
imports =
|
||||
[ # Include the results of the hardware scan.
|
||||
./ceph.nix
|
||||
./hardware-configuration.nix
|
||||
./minio.nix
|
||||
];
|
||||
imports =
|
||||
[
|
||||
# Include the results of the hardware scan.
|
||||
./ceph.nix
|
||||
./hardware-configuration.nix
|
||||
./minio.nix
|
||||
];
|
||||
|
||||
# Bootloader.
|
||||
boot.loader.systemd-boot.enable = true;
|
||||
boot.loader.efi.canTouchEfiVariables = true;
|
||||
# Bootloader.
|
||||
boot.loader.systemd-boot.enable = true;
|
||||
boot.loader.efi.canTouchEfiVariables = true;
|
||||
|
||||
networking = {
|
||||
hostName = "jeremiah"; # Define your hostname.
|
||||
useDHCP = false;
|
||||
defaultGateway = {
|
||||
address = " 10.42.1.1";
|
||||
interface = "enp68s0";
|
||||
};
|
||||
vlans = {
|
||||
san = {
|
||||
id = 616;
|
||||
interface = "enp67s0";
|
||||
};
|
||||
};
|
||||
interfaces = {
|
||||
enp68s0 = {
|
||||
ipv4.addresses = [ {
|
||||
address = "10.42.1.8";
|
||||
prefixLength = 16;
|
||||
} {
|
||||
address = "10.42.100.1";
|
||||
prefixLength = 16;
|
||||
} ];
|
||||
};
|
||||
san = {
|
||||
ipv4.addresses = [ {
|
||||
address = "10.201.1.2";
|
||||
prefixLength = 24;
|
||||
} ];
|
||||
};
|
||||
};
|
||||
nameservers = [
|
||||
"10.42.1.5"
|
||||
];
|
||||
};
|
||||
greg = {
|
||||
home = true;
|
||||
tailscale.enable = true;
|
||||
};
|
||||
environment.systemPackages = with pkgs; [
|
||||
curl
|
||||
gawk
|
||||
git
|
||||
unzip
|
||||
wget
|
||||
];
|
||||
|
||||
fileSystems = {
|
||||
"/nix" = {
|
||||
fsType = "btrfs";
|
||||
options = [ "subvol=nix" ];
|
||||
device = "/dev/nvme0n1p1";
|
||||
};
|
||||
"/var" = {
|
||||
fsType = "btrfs";
|
||||
options = [ "subvol=var" ];
|
||||
device = "/dev/nvme0n1p1";
|
||||
};
|
||||
};
|
||||
networking = {
|
||||
hostName = "jeremiah"; # Define your hostname.
|
||||
useDHCP = false;
|
||||
defaultGateway = {
|
||||
address = " 10.42.1.1";
|
||||
interface = "enp68s0";
|
||||
};
|
||||
vlans = {
|
||||
san = {
|
||||
id = 616;
|
||||
interface = "enp67s0";
|
||||
};
|
||||
};
|
||||
interfaces = {
|
||||
enp68s0 = {
|
||||
ipv4.addresses = [{
|
||||
address = "10.42.1.8";
|
||||
prefixLength = 16;
|
||||
}
|
||||
{
|
||||
address = "10.42.100.1";
|
||||
prefixLength = 16;
|
||||
}];
|
||||
};
|
||||
san = {
|
||||
ipv4.addresses = [{
|
||||
address = "10.201.1.2";
|
||||
prefixLength = 24;
|
||||
}];
|
||||
};
|
||||
};
|
||||
nameservers = [
|
||||
"10.42.1.5"
|
||||
];
|
||||
};
|
||||
greg = {
|
||||
home = true;
|
||||
tailscale.enable = true;
|
||||
};
|
||||
environment.systemPackages = with pkgs; [
|
||||
curl
|
||||
gawk
|
||||
git
|
||||
unzip
|
||||
wget
|
||||
];
|
||||
|
||||
#####################################################################################
|
||||
#################### Virtualbox Runner ##############################################
|
||||
#####################################################################################
|
||||
services = {
|
||||
gitlab-runner = {
|
||||
enable = true;
|
||||
settings.concurrent = 7;
|
||||
services = {
|
||||
shell = {
|
||||
executor = "shell";
|
||||
limit = 5;
|
||||
authenticationTokenConfigFile = config.age.secrets.runner-reg.path;
|
||||
environmentVariables = {
|
||||
EFI_DIR = "${pkgs.OVMF.fd}/FV/";
|
||||
STORAGE_URL = "http://s3.thehellings.lan:9000";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
age.secrets.runner-reg.file = ../../secrets/gitlab/jeremiah-runner-reg.age;
|
||||
virtualisation.virtualbox.host = {
|
||||
enable = true;
|
||||
enableExtensionPack = true;
|
||||
enableHardening = false;
|
||||
headless = true;
|
||||
enableWebService = true;
|
||||
};
|
||||
fileSystems = {
|
||||
"/nix" = {
|
||||
fsType = "btrfs";
|
||||
options = [ "subvol=nix" ];
|
||||
device = "/dev/nvme0n1p1";
|
||||
};
|
||||
"/var" = {
|
||||
fsType = "btrfs";
|
||||
options = [ "subvol=var" ];
|
||||
device = "/dev/nvme0n1p1";
|
||||
};
|
||||
};
|
||||
|
||||
systemd.services."gitlab-runner" = {
|
||||
after = [
|
||||
"network.target"
|
||||
"network-online.target"
|
||||
"systemd-resolved.service"
|
||||
];
|
||||
wants = [
|
||||
"network-online.target"
|
||||
"systemd-resolved.service"
|
||||
];
|
||||
preStart = builtins.concatStringsSep "\n" [
|
||||
"${pkgs.kmod}/bin/modprobe vboxdrv"
|
||||
"${pkgs.kmod}/bin/modprobe vboxnetadp"
|
||||
"${pkgs.kmod}/bin/modprobe vboxnetflt"
|
||||
];
|
||||
postStop = "${pkgs.kmod}/bin/rmmod vboxnetadp vboxnetflt vboxdrv";
|
||||
serviceConfig = {
|
||||
DevicePolicy = lib.mkForce "auto";
|
||||
User = "root";
|
||||
DynamicUser = lib.mkForce false;
|
||||
};
|
||||
};
|
||||
#####################################################################################
|
||||
#################### Virtualbox Runner ##############################################
|
||||
#####################################################################################
|
||||
services = {
|
||||
gitlab-runner = {
|
||||
enable = true;
|
||||
settings.concurrent = 7;
|
||||
services = {
|
||||
shell = {
|
||||
executor = "shell";
|
||||
limit = 5;
|
||||
authenticationTokenConfigFile = config.age.secrets.runner-reg.path;
|
||||
environmentVariables = {
|
||||
EFI_DIR = "${pkgs.OVMF.fd}/FV/";
|
||||
STORAGE_URL = "http://s3.thehellings.lan:9000";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
age.secrets.runner-reg.file = ../../secrets/gitlab/jeremiah-runner-reg.age;
|
||||
virtualisation.virtualbox.host = {
|
||||
enable = true;
|
||||
enableExtensionPack = true;
|
||||
enableHardening = false;
|
||||
headless = true;
|
||||
enableWebService = true;
|
||||
};
|
||||
|
||||
systemd.services."gitlab-runner" = {
|
||||
after = [
|
||||
"network.target"
|
||||
"network-online.target"
|
||||
"systemd-resolved.service"
|
||||
];
|
||||
wants = [
|
||||
"network-online.target"
|
||||
"systemd-resolved.service"
|
||||
];
|
||||
preStart = builtins.concatStringsSep "\n" [
|
||||
"${pkgs.kmod}/bin/modprobe vboxdrv"
|
||||
"${pkgs.kmod}/bin/modprobe vboxnetadp"
|
||||
"${pkgs.kmod}/bin/modprobe vboxnetflt"
|
||||
];
|
||||
postStop = "${pkgs.kmod}/bin/rmmod vboxnetadp vboxnetflt vboxdrv";
|
||||
serviceConfig = {
|
||||
DevicePolicy = lib.mkForce "auto";
|
||||
User = "root";
|
||||
DynamicUser = lib.mkForce false;
|
||||
};
|
||||
};
|
||||
}
|
||||
|
||||
@@ -5,7 +5,8 @@
|
||||
|
||||
{
|
||||
imports =
|
||||
[ (modulesPath + "/installer/scan/not-detected.nix")
|
||||
[
|
||||
(modulesPath + "/installer/scan/not-detected.nix")
|
||||
];
|
||||
|
||||
boot.initrd.availableKernelModules = [ "nvme" "xhci_pci" "ahci" "uas" "usbhid" "sd_mod" ];
|
||||
@@ -14,12 +15,14 @@
|
||||
boot.extraModulePackages = [ ];
|
||||
|
||||
fileSystems."/" =
|
||||
{ device = "/dev/disk/by-uuid/ffc167f5-d9e4-4b11-a5f1-f7da0550ad24";
|
||||
{
|
||||
device = "/dev/disk/by-uuid/ffc167f5-d9e4-4b11-a5f1-f7da0550ad24";
|
||||
fsType = "ext4";
|
||||
};
|
||||
|
||||
fileSystems."/boot" =
|
||||
{ device = "/dev/disk/by-uuid/3047-870E";
|
||||
{
|
||||
device = "/dev/disk/by-uuid/3047-870E";
|
||||
fsType = "vfat";
|
||||
};
|
||||
|
||||
|
||||
+24
-23
@@ -1,32 +1,33 @@
|
||||
{ config, pkgs, ... }:
|
||||
|
||||
let
|
||||
minioPort = 9000;
|
||||
minioConsolePort = 9001;
|
||||
in {
|
||||
environment.systemPackages = with pkgs; [
|
||||
minio-client
|
||||
xfsprogs
|
||||
];
|
||||
minioPort = 9000;
|
||||
minioConsolePort = 9001;
|
||||
in
|
||||
{
|
||||
environment.systemPackages = with pkgs; [
|
||||
minio-client
|
||||
xfsprogs
|
||||
];
|
||||
|
||||
greg.proxies."minio-02.thehellings.lan".target = "http://localhost:9000";
|
||||
greg.proxies."minio-02.thehellings.lan".target = "http://localhost:9000";
|
||||
|
||||
fileSystems."/data/1" = {
|
||||
device = "/dev/disk/by-id/ata-ST12000NM0558_ZHZ5YSXW-part1";
|
||||
fsType = "xfs";
|
||||
};
|
||||
fileSystems."/data/1" = {
|
||||
device = "/dev/disk/by-id/ata-ST12000NM0558_ZHZ5YSXW-part1";
|
||||
fsType = "xfs";
|
||||
};
|
||||
|
||||
networking.firewall.allowedTCPPorts = [
|
||||
minioPort
|
||||
minioConsolePort
|
||||
];
|
||||
networking.firewall.allowedTCPPorts = [
|
||||
minioPort
|
||||
minioConsolePort
|
||||
];
|
||||
|
||||
age.secrets.minio.file = ../../secrets/minio.age;
|
||||
age.secrets.minio.file = ../../secrets/minio.age;
|
||||
|
||||
services.minio = {
|
||||
enable = true;
|
||||
dataDir = [ "/data/1/minio" ];
|
||||
rootCredentialsFile = config.age.secrets.minio.path;
|
||||
browser = true;
|
||||
};
|
||||
services.minio = {
|
||||
enable = true;
|
||||
dataDir = [ "/data/1/minio" ];
|
||||
rootCredentialsFile = config.age.secrets.minio.path;
|
||||
browser = true;
|
||||
};
|
||||
}
|
||||
|
||||
+46
-46
@@ -1,50 +1,50 @@
|
||||
{ lib, pkgs, ... }:
|
||||
|
||||
{
|
||||
# Use the systemd-boot EFI boot loader.
|
||||
boot = {
|
||||
binfmt.emulatedSystems = [ "aarch64-linux" ];
|
||||
kernelPackages = pkgs.linuxPackages_latest;
|
||||
supportedFilesystems = [ "ntfs" ];
|
||||
loader = {
|
||||
timeout = 15;
|
||||
systemd-boot = {
|
||||
enable = true;
|
||||
configurationLimit = 20;
|
||||
extraEntries = {
|
||||
"Windows.conf" = (lib.strings.concatStringsSep "\n" [
|
||||
"title Windows"
|
||||
"efi /EFI/Microsoft/EFI/bootmgfw.efi"
|
||||
]);
|
||||
"Win2.conf" = (lib.strings.concatStringsSep "\n" [
|
||||
"title Windows 11"
|
||||
"efi /shellx64.efi"
|
||||
"options -nointerrupt -noconsolein -noconsoleout windows11.nsh"
|
||||
]);
|
||||
"Shell.conf" = (lib.strings.concatStringsSep "\n" [
|
||||
"title EFI Shell"
|
||||
"efi /shell.efi"
|
||||
]);
|
||||
};
|
||||
extraFiles = {
|
||||
"windows11.nsh" = (pkgs.writeText "windows11.nsh" (lib.strings.concatStringsSep "\n" [
|
||||
]));
|
||||
"shell.efi" = "${pkgs.edk2-uefi-shell}/shell.efi";
|
||||
};
|
||||
};
|
||||
grub = {
|
||||
enable = false;
|
||||
device = "/dev/nvme0n1";
|
||||
useOSProber = true;
|
||||
efiSupport = true;
|
||||
extraEntries = ''
|
||||
menuentry "Windows" --class windows --class os {
|
||||
insmod ntfs
|
||||
chainloader (hd0,0)/EFI/Windows/bootmgfw.efi
|
||||
}
|
||||
'';
|
||||
};
|
||||
#efi.canTouchEfiVariables = true;
|
||||
};
|
||||
};
|
||||
# Use the systemd-boot EFI boot loader.
|
||||
boot = {
|
||||
binfmt.emulatedSystems = [ "aarch64-linux" ];
|
||||
kernelPackages = pkgs.linuxPackages_latest;
|
||||
supportedFilesystems = [ "ntfs" ];
|
||||
loader = {
|
||||
timeout = 15;
|
||||
systemd-boot = {
|
||||
enable = true;
|
||||
configurationLimit = 20;
|
||||
extraEntries = {
|
||||
"Windows.conf" = (lib.strings.concatStringsSep "\n" [
|
||||
"title Windows"
|
||||
"efi /EFI/Microsoft/EFI/bootmgfw.efi"
|
||||
]);
|
||||
"Win2.conf" = (lib.strings.concatStringsSep "\n" [
|
||||
"title Windows 11"
|
||||
"efi /shellx64.efi"
|
||||
"options -nointerrupt -noconsolein -noconsoleout windows11.nsh"
|
||||
]);
|
||||
"Shell.conf" = (lib.strings.concatStringsSep "\n" [
|
||||
"title EFI Shell"
|
||||
"efi /shell.efi"
|
||||
]);
|
||||
};
|
||||
extraFiles = {
|
||||
"windows11.nsh" = (pkgs.writeText "windows11.nsh" (lib.strings.concatStringsSep "\n" [
|
||||
]));
|
||||
"shell.efi" = "${pkgs.edk2-uefi-shell}/shell.efi";
|
||||
};
|
||||
};
|
||||
grub = {
|
||||
enable = false;
|
||||
device = "/dev/nvme0n1";
|
||||
useOSProber = true;
|
||||
efiSupport = true;
|
||||
extraEntries = ''
|
||||
menuentry "Windows" --class windows --class os {
|
||||
insmod ntfs
|
||||
chainloader (hd0,0)/EFI/Windows/bootmgfw.efi
|
||||
}
|
||||
'';
|
||||
};
|
||||
#efi.canTouchEfiVariables = true;
|
||||
};
|
||||
};
|
||||
}
|
||||
|
||||
+111
-110
@@ -1,119 +1,120 @@
|
||||
{ pkgs, config, ... }:
|
||||
|
||||
{
|
||||
imports = [
|
||||
./boot.nix
|
||||
./hardware-configuration.nix
|
||||
./podman.nix
|
||||
./virt.nix
|
||||
];
|
||||
programs = {
|
||||
steam.enable = true;
|
||||
nix-index = {
|
||||
enable = true;
|
||||
enableBashIntegration = false;
|
||||
enableFishIntegration = false;
|
||||
enableZshIntegration = false;
|
||||
};
|
||||
nix-ld.enable = false;
|
||||
};
|
||||
imports = [
|
||||
./boot.nix
|
||||
./hardware-configuration.nix
|
||||
./podman.nix
|
||||
./virt.nix
|
||||
];
|
||||
programs = {
|
||||
steam.enable = true;
|
||||
nix-index = {
|
||||
enable = true;
|
||||
enableBashIntegration = false;
|
||||
enableFishIntegration = false;
|
||||
enableZshIntegration = false;
|
||||
};
|
||||
nix-ld.enable = false;
|
||||
};
|
||||
|
||||
networking = {
|
||||
hostName = "jude";
|
||||
enableIPv6 = false;
|
||||
interfaces.enp12s0.useDHCP = true;
|
||||
firewall = {
|
||||
enable = false;
|
||||
allowedTCPPorts = [ 21000 ];
|
||||
allowedUDPPorts = [ 21000 21010 ];
|
||||
};
|
||||
};
|
||||
greg = {
|
||||
tailscale.enable = true;
|
||||
sway.enable = false;
|
||||
gnome.enable = true;
|
||||
kde.enable = false;
|
||||
print.enable = true;
|
||||
};
|
||||
networking = {
|
||||
hostName = "jude";
|
||||
enableIPv6 = false;
|
||||
interfaces.enp12s0.useDHCP = true;
|
||||
firewall = {
|
||||
enable = false;
|
||||
allowedTCPPorts = [ 21000 ];
|
||||
allowedUDPPorts = [ 21000 21010 ];
|
||||
};
|
||||
};
|
||||
greg = {
|
||||
tailscale.enable = true;
|
||||
sway.enable = false;
|
||||
gnome.enable = true;
|
||||
kde.enable = false;
|
||||
print.enable = true;
|
||||
};
|
||||
|
||||
boot.extraModulePackages = [ config.boot.kernelPackages.v4l2loopback ];
|
||||
boot.extraModulePackages = [ config.boot.kernelPackages.v4l2loopback ];
|
||||
|
||||
environment.systemPackages = with pkgs; lib.mkMerge [
|
||||
[ # for Immersed
|
||||
cudatoolkit
|
||||
immersed-vr
|
||||
libva
|
||||
]
|
||||
[
|
||||
bind # For things like nslookup
|
||||
create_ssl
|
||||
distrobox
|
||||
expect
|
||||
gimp
|
||||
go
|
||||
gparted
|
||||
gnucash
|
||||
graphviz
|
||||
flock
|
||||
ffmpeg
|
||||
handbrake
|
||||
imagemagick
|
||||
libtheora
|
||||
libxml2
|
||||
linode-cli
|
||||
makemkv
|
||||
oathToolkit
|
||||
usbutils
|
||||
vagrant
|
||||
ventoy
|
||||
]
|
||||
environment.systemPackages = with pkgs; lib.mkMerge [
|
||||
[
|
||||
# for Immersed
|
||||
cudatoolkit
|
||||
immersed-vr
|
||||
libva
|
||||
]
|
||||
[
|
||||
bind # For things like nslookup
|
||||
create_ssl
|
||||
distrobox
|
||||
expect
|
||||
gimp
|
||||
go
|
||||
gparted
|
||||
gnucash
|
||||
graphviz
|
||||
flock
|
||||
ffmpeg
|
||||
handbrake
|
||||
imagemagick
|
||||
libtheora
|
||||
libxml2
|
||||
linode-cli
|
||||
makemkv
|
||||
oathToolkit
|
||||
usbutils
|
||||
vagrant
|
||||
ventoy
|
||||
]
|
||||
|
||||
[
|
||||
# Video/Audio data composition framework tools like "gst-inspect", "gst-launch" ...
|
||||
gst_all_1.gstreamer
|
||||
gst_all_1.gst-plugins-base
|
||||
gst_all_1.gst-plugins-good
|
||||
gst_all_1.gst-plugins-bad
|
||||
gst_all_1.gst-plugins-ugly
|
||||
gst_all_1.gst-libav
|
||||
gst_all_1.gst-vaapi
|
||||
]
|
||||
];
|
||||
fileSystems = {
|
||||
"/boot" = {
|
||||
device = "/dev/nvme0n1p1";
|
||||
fsType = "auto";
|
||||
};
|
||||
"/windows" = {
|
||||
device = "/dev/nvme0n1p5";
|
||||
fsType = "ntfs-3g";
|
||||
};
|
||||
"/windows11" = {
|
||||
device = "/dev/nvme1n1p2";
|
||||
fsType = "ntfs-3g";
|
||||
};
|
||||
};
|
||||
[
|
||||
# Video/Audio data composition framework tools like "gst-inspect", "gst-launch" ...
|
||||
gst_all_1.gstreamer
|
||||
gst_all_1.gst-plugins-base
|
||||
gst_all_1.gst-plugins-good
|
||||
gst_all_1.gst-plugins-bad
|
||||
gst_all_1.gst-plugins-ugly
|
||||
gst_all_1.gst-libav
|
||||
gst_all_1.gst-vaapi
|
||||
]
|
||||
];
|
||||
fileSystems = {
|
||||
"/boot" = {
|
||||
device = "/dev/nvme0n1p1";
|
||||
fsType = "auto";
|
||||
};
|
||||
"/windows" = {
|
||||
device = "/dev/nvme0n1p5";
|
||||
fsType = "ntfs-3g";
|
||||
};
|
||||
"/windows11" = {
|
||||
device = "/dev/nvme1n1p2";
|
||||
fsType = "ntfs-3g";
|
||||
};
|
||||
};
|
||||
|
||||
# Let's do a sound thing
|
||||
services = {
|
||||
pipewire = {
|
||||
enable = true;
|
||||
alsa.enable = true;
|
||||
audio.enable = true;
|
||||
jack.enable = true;
|
||||
pulse.enable = true;
|
||||
wireplumber.enable = true;
|
||||
};
|
||||
locate.enable = true;
|
||||
xserver.videoDrivers = [ "nvidia" ];
|
||||
};
|
||||
hardware = {
|
||||
nvidia = {
|
||||
modesetting.enable = true;
|
||||
nvidiaSettings = true;
|
||||
open = true;
|
||||
};
|
||||
pulseaudio.enable = false; # This conflicts with pipewire
|
||||
system76.enableAll = true;
|
||||
};
|
||||
# Let's do a sound thing
|
||||
services = {
|
||||
pipewire = {
|
||||
enable = true;
|
||||
alsa.enable = true;
|
||||
audio.enable = true;
|
||||
jack.enable = true;
|
||||
pulse.enable = true;
|
||||
wireplumber.enable = true;
|
||||
};
|
||||
locate.enable = true;
|
||||
xserver.videoDrivers = [ "nvidia" ];
|
||||
};
|
||||
hardware = {
|
||||
nvidia = {
|
||||
modesetting.enable = true;
|
||||
nvidiaSettings = true;
|
||||
open = true;
|
||||
};
|
||||
pulseaudio.enable = false; # This conflicts with pipewire
|
||||
system76.enableAll = true;
|
||||
};
|
||||
}
|
||||
|
||||
@@ -5,7 +5,8 @@
|
||||
|
||||
{
|
||||
imports =
|
||||
[ (modulesPath + "/installer/scan/not-detected.nix")
|
||||
[
|
||||
(modulesPath + "/installer/scan/not-detected.nix")
|
||||
];
|
||||
|
||||
boot.initrd.availableKernelModules = [ "nvme" "xhci_pci" "ahci" "usbhid" "usb_storage" "sd_mod" ];
|
||||
@@ -14,7 +15,8 @@
|
||||
boot.extraModulePackages = [ ];
|
||||
|
||||
fileSystems."/" =
|
||||
{ #device = "/dev/disk/by-uuid/27ae91ed-32e9-411e-8227-0d99e360fbbf";
|
||||
{
|
||||
#device = "/dev/disk/by-uuid/27ae91ed-32e9-411e-8227-0d99e360fbbf";
|
||||
device = "/dev/nvme0n1p4";
|
||||
fsType = "btrfs";
|
||||
};
|
||||
|
||||
@@ -1,8 +1,8 @@
|
||||
{ ... }:
|
||||
|
||||
{
|
||||
virtualisation.podman = {
|
||||
enable = true;
|
||||
dockerCompat = true;
|
||||
};
|
||||
virtualisation.podman = {
|
||||
enable = true;
|
||||
dockerCompat = true;
|
||||
};
|
||||
}
|
||||
|
||||
+30
-30
@@ -1,38 +1,38 @@
|
||||
{ pkgs, config, ... }:
|
||||
|
||||
{
|
||||
greg.vmdev.enable = true;
|
||||
greg.vmdev.enable = true;
|
||||
|
||||
virtualisation = {
|
||||
waydroid.enable = false;
|
||||
lxd.enable = false;
|
||||
};
|
||||
virtualisation = {
|
||||
waydroid.enable = false;
|
||||
lxd.enable = false;
|
||||
};
|
||||
|
||||
systemd.services = {
|
||||
gitlab-runner = {
|
||||
conflicts = [ "libvirtd.service" ];
|
||||
preStart = builtins.concatStringsSep "\n" [
|
||||
"${pkgs.kmod}/bin/modprobe vboxnetflt vboxdrv"
|
||||
"${pkgs.kmod}/bin/modprobe vboxnetadp"
|
||||
];
|
||||
postStop = "${pkgs.kmod}/bin/rmmod vboxnetflt vboxnetadp vboxdrv";
|
||||
wantedBy = pkgs.lib.mkForce [];
|
||||
serviceConfig.User = "root";
|
||||
};
|
||||
};
|
||||
systemd.services = {
|
||||
gitlab-runner = {
|
||||
conflicts = [ "libvirtd.service" ];
|
||||
preStart = builtins.concatStringsSep "\n" [
|
||||
"${pkgs.kmod}/bin/modprobe vboxnetflt vboxdrv"
|
||||
"${pkgs.kmod}/bin/modprobe vboxnetadp"
|
||||
];
|
||||
postStop = "${pkgs.kmod}/bin/rmmod vboxnetflt vboxnetadp vboxdrv";
|
||||
wantedBy = pkgs.lib.mkForce [ ];
|
||||
serviceConfig.User = "root";
|
||||
};
|
||||
};
|
||||
|
||||
age.secrets.runner-reg.file = ../../secrets/gitlab/myself-vbox-runner-reg.age;
|
||||
age.secrets.runner-reg.file = ../../secrets/gitlab/myself-vbox-runner-reg.age;
|
||||
|
||||
services.gitlab-runner = {
|
||||
enable = true;
|
||||
settings.concurrent = 5;
|
||||
services.vbox = {
|
||||
executor = "shell";
|
||||
limit = 5;
|
||||
authenticationTokenConfigFile = config.age.secrets.runner-reg.path;
|
||||
environmentVariables = {
|
||||
EFI_DIR = "${pkgs.OVMF.fd}/FV/";
|
||||
};
|
||||
};
|
||||
};
|
||||
services.gitlab-runner = {
|
||||
enable = true;
|
||||
settings.concurrent = 5;
|
||||
services.vbox = {
|
||||
executor = "shell";
|
||||
limit = 5;
|
||||
authenticationTokenConfigFile = config.age.secrets.runner-reg.path;
|
||||
environmentVariables = {
|
||||
EFI_DIR = "${pkgs.OVMF.fd}/FV/";
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
|
||||
+66
-65
@@ -1,78 +1,79 @@
|
||||
{ pkgs, lib, config, ... }:
|
||||
|
||||
{
|
||||
imports = [
|
||||
./git.nix
|
||||
./hardware-configuration.nix
|
||||
./podman.nix
|
||||
./matrix.nix
|
||||
./nextcloud.nix
|
||||
./nginx.nix
|
||||
./postgres.nix
|
||||
];
|
||||
imports = [
|
||||
./git.nix
|
||||
./hardware-configuration.nix
|
||||
./podman.nix
|
||||
./matrix.nix
|
||||
./nextcloud.nix
|
||||
./nginx.nix
|
||||
./postgres.nix
|
||||
];
|
||||
|
||||
greg = {
|
||||
home = false;
|
||||
linode.enable = true;
|
||||
tailscale.enable = true;
|
||||
};
|
||||
greg = {
|
||||
home = false;
|
||||
linode.enable = true;
|
||||
tailscale.enable = true;
|
||||
};
|
||||
|
||||
programs.ssh.extraConfig = lib.strings.concatStringsSep "\n" [
|
||||
"Host chronicles.shire-zebra.ts.net"
|
||||
" User backup"
|
||||
" IdentityFile /etc/ssh/backup_ed25519"
|
||||
" StrictHostKeyChecking no"
|
||||
" UserKnownHostsFile /dev/null"
|
||||
];
|
||||
programs.ssh.extraConfig = lib.strings.concatStringsSep "\n" [
|
||||
"Host chronicles.shire-zebra.ts.net"
|
||||
" User backup"
|
||||
" IdentityFile /etc/ssh/backup_ed25519"
|
||||
" StrictHostKeyChecking no"
|
||||
" UserKnownHostsFile /dev/null"
|
||||
];
|
||||
|
||||
networking = {
|
||||
networkmanager.enable = lib.mkForce false;
|
||||
hostName = "linode";
|
||||
domain = "thehellings.com";
|
||||
nameservers = [
|
||||
"100.88.91.27"
|
||||
];
|
||||
};
|
||||
networking = {
|
||||
networkmanager.enable = lib.mkForce false;
|
||||
hostName = "linode";
|
||||
domain = "thehellings.com";
|
||||
nameservers = [
|
||||
"100.88.91.27"
|
||||
];
|
||||
};
|
||||
|
||||
age.secrets.runner-deployer = {
|
||||
file = ../../secrets/gitlab/linode-deployer-runner-reg.age;
|
||||
owner = "gitlab-runner";
|
||||
};
|
||||
age.secrets.runner-deployer = {
|
||||
file = ../../secrets/gitlab/linode-deployer-runner-reg.age;
|
||||
owner = "gitlab-runner";
|
||||
};
|
||||
|
||||
services.gitlab-runner = {
|
||||
enable = true;
|
||||
services.deployer = {
|
||||
executor = "shell";
|
||||
authenticationTokenConfigFile = config.age.secrets.runner-deployer.path;
|
||||
};
|
||||
};
|
||||
services.gitlab-runner = {
|
||||
enable = true;
|
||||
services.deployer = {
|
||||
executor = "shell";
|
||||
authenticationTokenConfigFile = config.age.secrets.runner-deployer.path;
|
||||
};
|
||||
};
|
||||
|
||||
users.users.gitlab-runner = {
|
||||
isSystemUser = true;
|
||||
group = "gitlab-runner";
|
||||
};
|
||||
users.groups.gitlab-runner = {};
|
||||
users.users.gitlab-runner = {
|
||||
isSystemUser = true;
|
||||
group = "gitlab-runner";
|
||||
};
|
||||
users.groups.gitlab-runner = { };
|
||||
|
||||
systemd.services."gitlab-runner".serviceConfig = {
|
||||
DynamicUser = lib.mkForce false;
|
||||
User = "gitlab-runner";
|
||||
};
|
||||
systemd.services."gitlab-runner".serviceConfig = {
|
||||
DynamicUser = lib.mkForce false;
|
||||
User = "gitlab-runner";
|
||||
};
|
||||
|
||||
security.sudo.extraRules = [{
|
||||
users = [ "gitlab-runner" ];
|
||||
commands = [{
|
||||
command = "/run/current-system/sw/bin/systemctl";
|
||||
options = [ "NOPASSWD" ];
|
||||
} {
|
||||
command = "/run/current-system/sw/bin/podman";
|
||||
options = [ "NOPASSWD" ];
|
||||
}];
|
||||
}];
|
||||
security.sudo.extraRules = [{
|
||||
users = [ "gitlab-runner" ];
|
||||
commands = [{
|
||||
command = "/run/current-system/sw/bin/systemctl";
|
||||
options = [ "NOPASSWD" ];
|
||||
}
|
||||
{
|
||||
command = "/run/current-system/sw/bin/podman";
|
||||
options = [ "NOPASSWD" ];
|
||||
}];
|
||||
}];
|
||||
|
||||
environment.systemPackages = with pkgs; [
|
||||
bind
|
||||
graphviz
|
||||
nix-du
|
||||
pgloader
|
||||
];
|
||||
environment.systemPackages = with pkgs; [
|
||||
bind
|
||||
graphviz
|
||||
nix-du
|
||||
pgloader
|
||||
];
|
||||
}
|
||||
|
||||
+38
-37
@@ -1,44 +1,45 @@
|
||||
{ config, pkgs, ... }:
|
||||
|
||||
let
|
||||
srcDomain = "src.thehellings.com";
|
||||
sshPort = 2222;
|
||||
in {
|
||||
greg.proxies."${srcDomain}" = {
|
||||
target = "http://git.thehellings.lan";
|
||||
ssl = true;
|
||||
genAliases = false;
|
||||
extraConfig = ''
|
||||
proxy_set_header X-Forwarded-Proto https;
|
||||
proxy_set_header X-Forwarded-Ssl on;
|
||||
'';
|
||||
};
|
||||
greg.proxies."registry.thehellings.com" = {
|
||||
target = "https://registry.thehellings.lan:5000";
|
||||
ssl = true;
|
||||
genAliases = false;
|
||||
extraConfig = "client_max_body_size 250m;";
|
||||
};
|
||||
srcDomain = "src.thehellings.com";
|
||||
sshPort = 2222;
|
||||
in
|
||||
{
|
||||
greg.proxies."${srcDomain}" = {
|
||||
target = "http://git.thehellings.lan";
|
||||
ssl = true;
|
||||
genAliases = false;
|
||||
extraConfig = ''
|
||||
proxy_set_header X-Forwarded-Proto https;
|
||||
proxy_set_header X-Forwarded-Ssl on;
|
||||
'';
|
||||
};
|
||||
greg.proxies."registry.thehellings.com" = {
|
||||
target = "https://registry.thehellings.lan:5000";
|
||||
ssl = true;
|
||||
genAliases = false;
|
||||
extraConfig = "client_max_body_size 250m;";
|
||||
};
|
||||
|
||||
networking.firewall.allowedTCPPorts = [ sshPort ];
|
||||
networking.firewall.allowedTCPPorts = [ sshPort ];
|
||||
|
||||
services.haproxy = {
|
||||
enable = true;
|
||||
config = builtins.concatStringsSep "\n" [
|
||||
"global"
|
||||
" daemon"
|
||||
" maxconn 20"
|
||||
|
||||
"defaults"
|
||||
" timeout connect 500s"
|
||||
" timeout client 500s"
|
||||
" timeout server 1h"
|
||||
services.haproxy = {
|
||||
enable = true;
|
||||
config = builtins.concatStringsSep "\n" [
|
||||
"global"
|
||||
" daemon"
|
||||
" maxconn 20"
|
||||
|
||||
"listen gitsshd"
|
||||
" bind *:${toString sshPort}"
|
||||
" timeout client 1h"
|
||||
" mode tcp"
|
||||
" server git-thehellings-lan git.thehellings.lan:22"
|
||||
];
|
||||
};
|
||||
"defaults"
|
||||
" timeout connect 500s"
|
||||
" timeout client 500s"
|
||||
" timeout server 1h"
|
||||
|
||||
"listen gitsshd"
|
||||
" bind *:${toString sshPort}"
|
||||
" timeout client 1h"
|
||||
" mode tcp"
|
||||
" server git-thehellings-lan git.thehellings.lan:22"
|
||||
];
|
||||
};
|
||||
}
|
||||
|
||||
+49
-47
@@ -4,59 +4,61 @@
|
||||
# register_new_matrix_user -k "B9EoPr2WV9hzwc7uL2Sx1JmvCeKDEOGCpB0uginQcQtEH4wzRtkSIdo7lltrjSQa" http://localhost:8448
|
||||
{ config, pkgs, ... }:
|
||||
let
|
||||
domain = "${config.networking.domain}";
|
||||
fqdn = "matrix.${domain}";
|
||||
conn = "postgresql:///dendrite?sslmode=disable&host=/run/postgresql";
|
||||
domain = "${config.networking.domain}";
|
||||
fqdn = "matrix.${domain}";
|
||||
conn = "postgresql:///dendrite?sslmode=disable&host=/run/postgresql";
|
||||
in
|
||||
{
|
||||
services.nginx = {
|
||||
virtualHosts = {
|
||||
# Server the '.well-known' files to find the Matrix API server
|
||||
"${domain}" = {
|
||||
enableACME = true;
|
||||
forceSSL = true;
|
||||
services.nginx = {
|
||||
virtualHosts = {
|
||||
# Server the '.well-known' files to find the Matrix API server
|
||||
"${domain}" = {
|
||||
enableACME = true;
|
||||
forceSSL = true;
|
||||
|
||||
# This is needed so that servers contacting hellings.com can find
|
||||
# the actual application server at matrix.thehellings.com
|
||||
locations."= /.well-known/matrix/server".extraConfig =
|
||||
let
|
||||
server = { "m.server" = "${fqdn}:443"; };
|
||||
in ''
|
||||
add_header Content-Type application/json;
|
||||
return 200 '${builtins.toJSON server}';
|
||||
'';
|
||||
# This is needed so that servers contacting hellings.com can find
|
||||
# the actual application server at matrix.thehellings.com
|
||||
locations."= /.well-known/matrix/server".extraConfig =
|
||||
let
|
||||
server = { "m.server" = "${fqdn}:443"; };
|
||||
in
|
||||
''
|
||||
add_header Content-Type application/json;
|
||||
return 200 '${builtins.toJSON server}';
|
||||
'';
|
||||
|
||||
locations."= /.well-known/matrix/client".extraConfig =
|
||||
let
|
||||
client = {
|
||||
"m.homeserver" = { "base_url" = "https://${fqdn}"; };
|
||||
"m.identity_server" = { "base_url" = "https://vector.im"; };
|
||||
};
|
||||
in ''
|
||||
add_header Content-Type application/json;
|
||||
add_header Access-Control-Allow-Origin *;
|
||||
return 200 '${builtins.toJSON client}';
|
||||
'';
|
||||
};
|
||||
locations."= /.well-known/matrix/client".extraConfig =
|
||||
let
|
||||
client = {
|
||||
"m.homeserver" = { "base_url" = "https://${fqdn}"; };
|
||||
"m.identity_server" = { "base_url" = "https://vector.im"; };
|
||||
};
|
||||
in
|
||||
''
|
||||
add_header Content-Type application/json;
|
||||
add_header Access-Control-Allow-Origin *;
|
||||
return 200 '${builtins.toJSON client}';
|
||||
'';
|
||||
};
|
||||
|
||||
# Reverse proxy in front of the actual Matrix server
|
||||
"${fqdn}" = {
|
||||
enableACME = true;
|
||||
forceSSL = true;
|
||||
# Reverse proxy in front of the actual Matrix server
|
||||
"${fqdn}" = {
|
||||
enableACME = true;
|
||||
forceSSL = true;
|
||||
|
||||
# Not the appropriate place for the chat client
|
||||
locations."/".extraConfig = "return 404;";
|
||||
# Not the appropriate place for the chat client
|
||||
locations."/".extraConfig = "return 404;";
|
||||
|
||||
locations."/_matrix" = {
|
||||
proxyPass = "http://matrix.shire-zebra.ts.net:8448"; # Lacking the trailing / is correct
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
locations."/_matrix" = {
|
||||
proxyPass = "http://matrix.shire-zebra.ts.net:8448"; # Lacking the trailing / is correct
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
# Open networking ports for the server
|
||||
networking.firewall = {
|
||||
enable = true;
|
||||
allowedTCPPorts = [ 80 443 ];
|
||||
};
|
||||
# Open networking ports for the server
|
||||
networking.firewall = {
|
||||
enable = true;
|
||||
allowedTCPPorts = [ 80 443 ];
|
||||
};
|
||||
}
|
||||
|
||||
+30
-30
@@ -1,38 +1,38 @@
|
||||
{ config, pkgs, ... }:
|
||||
|
||||
{
|
||||
age.secrets.nextcloudadmin.file = ../../secrets/nextcloudadmin.age;
|
||||
age.secrets.nextcloudadmin.owner = "nextcloud";
|
||||
age.secrets.nextcloudadmin.file = ../../secrets/nextcloudadmin.age;
|
||||
age.secrets.nextcloudadmin.owner = "nextcloud";
|
||||
|
||||
services.nextcloud = {
|
||||
enable = true;
|
||||
package = pkgs.nextcloud29;
|
||||
appstoreEnable = true;
|
||||
hostName = "next.${config.networking.domain}";
|
||||
https = true;
|
||||
config = {
|
||||
adminpassFile = config.age.secrets.nextcloudadmin.path;
|
||||
adminuser = "greg";
|
||||
dbhost = "/run/postgresql";
|
||||
dbtype = "pgsql";
|
||||
};
|
||||
settings = {
|
||||
default_phone_region = "US";
|
||||
overwriteprotocol = "https";
|
||||
};
|
||||
};
|
||||
services.nextcloud = {
|
||||
enable = true;
|
||||
package = pkgs.nextcloud29;
|
||||
appstoreEnable = true;
|
||||
hostName = "next.${config.networking.domain}";
|
||||
https = true;
|
||||
config = {
|
||||
adminpassFile = config.age.secrets.nextcloudadmin.path;
|
||||
adminuser = "greg";
|
||||
dbhost = "/run/postgresql";
|
||||
dbtype = "pgsql";
|
||||
};
|
||||
settings = {
|
||||
default_phone_region = "US";
|
||||
overwriteprotocol = "https";
|
||||
};
|
||||
};
|
||||
|
||||
services.nginx.virtualHosts."next.thehellings.com" = {
|
||||
forceSSL = true;
|
||||
enableACME = true;
|
||||
};
|
||||
services.nginx.virtualHosts."next.thehellings.com" = {
|
||||
forceSSL = true;
|
||||
enableACME = true;
|
||||
};
|
||||
|
||||
# Otherwise nginx errors looking for the nextcloud sock file
|
||||
systemd.services.nginx.after = [ "nextcloud.service" ];
|
||||
# Otherwise nginx errors looking for the nextcloud sock file
|
||||
systemd.services.nginx.after = [ "nextcloud.service" ];
|
||||
|
||||
greg.backup.jobs.nextcloud-bkup = {
|
||||
src = "/var/lib/nextcloud";
|
||||
dest = "nextcloud-backup";
|
||||
id = "rbfco-rvmis";
|
||||
};
|
||||
greg.backup.jobs.nextcloud-bkup = {
|
||||
src = "/var/lib/nextcloud";
|
||||
dest = "nextcloud-backup";
|
||||
id = "rbfco-rvmis";
|
||||
};
|
||||
}
|
||||
|
||||
+28
-28
@@ -1,36 +1,36 @@
|
||||
{ ... }:
|
||||
let
|
||||
homepage = "127.0.0.1:30080";
|
||||
homepage = "127.0.0.1:30080";
|
||||
in
|
||||
{
|
||||
security.acme = {
|
||||
acceptTerms = true;
|
||||
defaults.email = "greg.hellings@gmail.com";
|
||||
};
|
||||
security.acme = {
|
||||
acceptTerms = true;
|
||||
defaults.email = "greg.hellings@gmail.com";
|
||||
};
|
||||
|
||||
services.nginx = {
|
||||
enable = true;
|
||||
services.nginx = {
|
||||
enable = true;
|
||||
|
||||
# If there are recommended settings, let's use them!
|
||||
recommendedGzipSettings = true;
|
||||
recommendedOptimisation = true;
|
||||
recommendedProxySettings = true;
|
||||
recommendedTlsSettings = true;
|
||||
};
|
||||
# If there are recommended settings, let's use them!
|
||||
recommendedGzipSettings = true;
|
||||
recommendedOptimisation = true;
|
||||
recommendedProxySettings = true;
|
||||
recommendedTlsSettings = true;
|
||||
};
|
||||
|
||||
# Actually serve the content from here
|
||||
virtualisation.podman.enable = true;
|
||||
virtualisation.oci-containers = {
|
||||
backend = "podman";
|
||||
containers."homepage" = {
|
||||
# needs explicit port to match what gitlab-runner sees when pulling
|
||||
image = "registry.thehellings.com:443/greg/homepage/gregs-homepage:latest";
|
||||
ports = [ "${homepage}:80" ];
|
||||
};
|
||||
};
|
||||
greg.proxies."thehellings.com" = {
|
||||
target = "http://${homepage}/";
|
||||
ssl = true;
|
||||
genAliases = false;
|
||||
};
|
||||
# Actually serve the content from here
|
||||
virtualisation.podman.enable = true;
|
||||
virtualisation.oci-containers = {
|
||||
backend = "podman";
|
||||
containers."homepage" = {
|
||||
# needs explicit port to match what gitlab-runner sees when pulling
|
||||
image = "registry.thehellings.com:443/greg/homepage/gregs-homepage:latest";
|
||||
ports = [ "${homepage}:80" ];
|
||||
};
|
||||
};
|
||||
greg.proxies."thehellings.com" = {
|
||||
target = "http://${homepage}/";
|
||||
ssl = true;
|
||||
genAliases = false;
|
||||
};
|
||||
}
|
||||
|
||||
@@ -1,9 +1,9 @@
|
||||
{ ... }:
|
||||
|
||||
{
|
||||
virtualisation.podman = {
|
||||
enable = true;
|
||||
dockerCompat = true;
|
||||
dockerSocket.enable = true;
|
||||
};
|
||||
virtualisation.podman = {
|
||||
enable = true;
|
||||
dockerCompat = true;
|
||||
dockerSocket.enable = true;
|
||||
};
|
||||
}
|
||||
|
||||
+55
-55
@@ -1,63 +1,63 @@
|
||||
{ config, pkgs, lib, ... }:
|
||||
|
||||
{
|
||||
environment.systemPackages = [
|
||||
pkgs.upgrade-pg-cluster
|
||||
];
|
||||
environment.systemPackages = [
|
||||
pkgs.upgrade-pg-cluster
|
||||
];
|
||||
|
||||
services.postgresql = {
|
||||
enable = true;
|
||||
package = pkgs.postgresql_15;
|
||||
checkConfig = true;
|
||||
ensureDatabases = [
|
||||
"nextcloud"
|
||||
];
|
||||
#initialScript = pkgs.writeText "create-matrix-db.sql" ''
|
||||
# CREATE ROLE "matrix-synapse" WITH LOGIN;
|
||||
# CREATE DATABASE "synapse" WITH OWNER "matrix-synapse" TEMPLATE template0 LC_COLLATE = "C" LC_CTYPE = "C";
|
||||
# GRANT ALL PRIVILEGES ON DATABASE "synapse" TO "matrix-synapse";
|
||||
#''; # These are done manually in order to set the LC_COLLATE values properly
|
||||
ensureUsers = [ {
|
||||
name = "nextcloud";
|
||||
ensureDBOwnership = true;
|
||||
} ];
|
||||
settings = {
|
||||
log_connections = true;
|
||||
log_statement = "all";
|
||||
logging_collector = true;
|
||||
log_filename = "postgresql.log";
|
||||
};
|
||||
identMap = ''
|
||||
root root postgres
|
||||
'';
|
||||
};
|
||||
services.postgresql = {
|
||||
enable = true;
|
||||
package = pkgs.postgresql_15;
|
||||
checkConfig = true;
|
||||
ensureDatabases = [
|
||||
"nextcloud"
|
||||
];
|
||||
#initialScript = pkgs.writeText "create-matrix-db.sql" ''
|
||||
# CREATE ROLE "matrix-synapse" WITH LOGIN;
|
||||
# CREATE DATABASE "synapse" WITH OWNER "matrix-synapse" TEMPLATE template0 LC_COLLATE = "C" LC_CTYPE = "C";
|
||||
# GRANT ALL PRIVILEGES ON DATABASE "synapse" TO "matrix-synapse";
|
||||
#''; # These are done manually in order to set the LC_COLLATE values properly
|
||||
ensureUsers = [{
|
||||
name = "nextcloud";
|
||||
ensureDBOwnership = true;
|
||||
}];
|
||||
settings = {
|
||||
log_connections = true;
|
||||
log_statement = "all";
|
||||
logging_collector = true;
|
||||
log_filename = "postgresql.log";
|
||||
};
|
||||
identMap = ''
|
||||
root root postgres
|
||||
'';
|
||||
};
|
||||
|
||||
services.postgresqlBackup = {
|
||||
enable = true;
|
||||
databases = [
|
||||
"nextcloud"
|
||||
];
|
||||
};
|
||||
services.postgresqlBackup = {
|
||||
enable = true;
|
||||
databases = [
|
||||
"nextcloud"
|
||||
];
|
||||
};
|
||||
|
||||
services.logrotate = {
|
||||
enable = true;
|
||||
settings = {
|
||||
postgresBackup = {
|
||||
enable = true;
|
||||
files = "${config.services.postgresqlBackup.location}/*.gz";
|
||||
};
|
||||
postgresLog = {
|
||||
enable = true;
|
||||
files = "/var/lib/postgresql/*/log/*.log";
|
||||
compress = true;
|
||||
compresscmd = "${pkgs.xz}/bin/xz";
|
||||
};
|
||||
};
|
||||
};
|
||||
services.logrotate = {
|
||||
enable = true;
|
||||
settings = {
|
||||
postgresBackup = {
|
||||
enable = true;
|
||||
files = "${config.services.postgresqlBackup.location}/*.gz";
|
||||
};
|
||||
postgresLog = {
|
||||
enable = true;
|
||||
files = "/var/lib/postgresql/*/log/*.log";
|
||||
compress = true;
|
||||
compresscmd = "${pkgs.xz}/bin/xz";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
greg.backup.jobs.greg-postgresql-backup = {
|
||||
src = config.services.postgresqlBackup.location;
|
||||
dest = "linode-postgres";
|
||||
id = "9pwvg-s257a";
|
||||
};
|
||||
greg.backup.jobs.greg-postgresql-backup = {
|
||||
src = config.services.postgresqlBackup.location;
|
||||
dest = "linode-postgres";
|
||||
id = "9pwvg-s257a";
|
||||
};
|
||||
}
|
||||
|
||||
+30
-29
@@ -1,33 +1,34 @@
|
||||
{ config, ... }:
|
||||
|
||||
let
|
||||
publicIp = (builtins.elemAt config.networking.interfaces.enp38s0.ipv4.addresses 0).address;
|
||||
sanIp = (builtins.elemAt config.networking.interfaces.enp39s0.ipv4.addresses 0).address;
|
||||
vip = (builtins.elemAt config.networking.interfaces.enp38s0.ipv4.addresses 1).address;
|
||||
hostname = config.networking.hostName;
|
||||
baseConfig = import ../../ceph/home.nix;
|
||||
in {
|
||||
services.ceph-benaco = baseConfig // {
|
||||
enable = false;
|
||||
monitor = {
|
||||
enable = false;
|
||||
initialKeyring = ../../secrets/home.mon.keyring;
|
||||
nodeName = hostname;
|
||||
bindAddr = publicIp;
|
||||
advertisedPublicAddr = vip;
|
||||
};
|
||||
osdBindAddr = publicIp;
|
||||
osdAdvertisedPublicAddr = publicIp;
|
||||
osds = {
|
||||
osd1 = {
|
||||
enable = false;
|
||||
bootstrapKeyring = ../../secrets/home.osd-bootstrap.keyring;
|
||||
id = 2;
|
||||
uuid = "73424b68-210b-415f-800f-8767babea625";
|
||||
blockDevice = "/dev/disk/by-id/ata-ST12000NM0558_ZHZ5WM4L";
|
||||
blockDeviceUdevRuleMatcher = ''KERNEL=="sdb"'';
|
||||
clusterAddress = sanIp;
|
||||
};
|
||||
};
|
||||
};
|
||||
publicIp = (builtins.elemAt config.networking.interfaces.enp38s0.ipv4.addresses 0).address;
|
||||
sanIp = (builtins.elemAt config.networking.interfaces.enp39s0.ipv4.addresses 0).address;
|
||||
vip = (builtins.elemAt config.networking.interfaces.enp38s0.ipv4.addresses 1).address;
|
||||
hostname = config.networking.hostName;
|
||||
baseConfig = import ../../ceph/home.nix;
|
||||
in
|
||||
{
|
||||
services.ceph-benaco = baseConfig // {
|
||||
enable = false;
|
||||
monitor = {
|
||||
enable = false;
|
||||
initialKeyring = ../../secrets/home.mon.keyring;
|
||||
nodeName = hostname;
|
||||
bindAddr = publicIp;
|
||||
advertisedPublicAddr = vip;
|
||||
};
|
||||
osdBindAddr = publicIp;
|
||||
osdAdvertisedPublicAddr = publicIp;
|
||||
osds = {
|
||||
osd1 = {
|
||||
enable = false;
|
||||
bootstrapKeyring = ../../secrets/home.osd-bootstrap.keyring;
|
||||
id = 2;
|
||||
uuid = "73424b68-210b-415f-800f-8767babea625";
|
||||
blockDevice = "/dev/disk/by-id/ata-ST12000NM0558_ZHZ5WM4L";
|
||||
blockDeviceUdevRuleMatcher = ''KERNEL=="sdb"'';
|
||||
clusterAddress = sanIp;
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
|
||||
+187
-181
@@ -1,195 +1,201 @@
|
||||
{ config, pkgs, lib, ... }: let
|
||||
registryPort = 5000;
|
||||
vpnIp = "100.78.226.76";
|
||||
containerIp = "192.168.200.2";
|
||||
in {
|
||||
age.secretsMountPoint = "/run/derp";
|
||||
age.secrets = let
|
||||
cfg = n: { file = ../../secrets/gitlab/${n}.age; owner = "gitlab"; group = "gitlab"; mode = "0444"; };
|
||||
in {
|
||||
gitlab-secret = cfg "secret";
|
||||
gitlab-otp = cfg "otp";
|
||||
gitlab-db = cfg "db";
|
||||
gitlab-jws = cfg "jws";
|
||||
gitlab-key = cfg "key";
|
||||
gitlab-cert = cfg "cert";
|
||||
{ config, pkgs, lib, ... }:
|
||||
let
|
||||
registryPort = 5000;
|
||||
vpnIp = "100.78.226.76";
|
||||
containerIp = "192.168.200.2";
|
||||
in
|
||||
{
|
||||
age.secretsMountPoint = "/run/derp";
|
||||
age.secrets =
|
||||
let
|
||||
cfg = n: { file = ../../secrets/gitlab/${n}.age; owner = "gitlab"; group = "gitlab"; mode = "0444"; };
|
||||
in
|
||||
{
|
||||
gitlab-secret = cfg "secret";
|
||||
gitlab-otp = cfg "otp";
|
||||
gitlab-db = cfg "db";
|
||||
gitlab-jws = cfg "jws";
|
||||
gitlab-key = cfg "key";
|
||||
gitlab-cert = cfg "cert";
|
||||
|
||||
minio_access_key_id = {
|
||||
file = ../../secrets/minio_access_key_id.age;
|
||||
owner = "gitlab";
|
||||
group = "gitlab";
|
||||
mode = "0444";
|
||||
};
|
||||
minio_secret_access_key = {
|
||||
file = ../../secrets/minio_secret_access_key.age;
|
||||
owner = "gitlab";
|
||||
group = "gitlab";
|
||||
mode = "0444";
|
||||
};
|
||||
};
|
||||
minio_access_key_id = {
|
||||
file = ../../secrets/minio_access_key_id.age;
|
||||
owner = "gitlab";
|
||||
group = "gitlab";
|
||||
mode = "0444";
|
||||
};
|
||||
minio_secret_access_key = {
|
||||
file = ../../secrets/minio_secret_access_key.age;
|
||||
owner = "gitlab";
|
||||
group = "gitlab";
|
||||
mode = "0444";
|
||||
};
|
||||
};
|
||||
|
||||
networking.firewall.allowedTCPPorts = [ 80 registryPort ];
|
||||
networking.firewall.allowedTCPPorts = [ 80 registryPort ];
|
||||
|
||||
greg.proxies = let
|
||||
t = {
|
||||
target = "http://unix:/run/gitlab/gitlab-workhorse.socket";
|
||||
extraConfig = ''
|
||||
proxy_set_header X-Forwarded-Proto https;
|
||||
proxy_set_header X-Forwarded-Ssl on;
|
||||
'';
|
||||
};
|
||||
in {
|
||||
"${containerIp}" = t;
|
||||
"${vpnIp}" = t;
|
||||
"git.thehellings.lan" = t;
|
||||
};
|
||||
greg.proxies =
|
||||
let
|
||||
t = {
|
||||
target = "http://unix:/run/gitlab/gitlab-workhorse.socket";
|
||||
extraConfig = ''
|
||||
proxy_set_header X-Forwarded-Proto https;
|
||||
proxy_set_header X-Forwarded-Ssl on;
|
||||
'';
|
||||
};
|
||||
in
|
||||
{
|
||||
"${containerIp}" = t;
|
||||
"${vpnIp}" = t;
|
||||
"git.thehellings.lan" = t;
|
||||
};
|
||||
|
||||
virtualisation.docker.enable = true;
|
||||
virtualisation.docker.enable = true;
|
||||
|
||||
programs.ssh.extraConfig = lib.strings.concatStringsSep "\n" [
|
||||
"Host nas"
|
||||
" User backup"
|
||||
" IdentityFile /etc/ssh/duplicity_ed25519"
|
||||
" StrictHostKeyChecking no"
|
||||
" UserKnownHostsFile /dev/null"
|
||||
];
|
||||
programs.ssh.extraConfig = lib.strings.concatStringsSep "\n" [
|
||||
"Host nas"
|
||||
" User backup"
|
||||
" IdentityFile /etc/ssh/duplicity_ed25519"
|
||||
" StrictHostKeyChecking no"
|
||||
" UserKnownHostsFile /dev/null"
|
||||
];
|
||||
|
||||
greg.backup.jobs.nas-backup = {
|
||||
src = "/var/gitlab/state/backup/";
|
||||
dest = "gitlab";
|
||||
id = "yha^-s45h";
|
||||
};
|
||||
greg.backup.jobs.nas-backup = {
|
||||
src = "/var/gitlab/state/backup/";
|
||||
dest = "gitlab";
|
||||
id = "yha^-s45h";
|
||||
};
|
||||
|
||||
services = {
|
||||
gitlab = {
|
||||
enable = true;
|
||||
backup = {
|
||||
keepTime = 288;
|
||||
startAt = [ "03:00" ];
|
||||
};
|
||||
host = "src.thehellings.com";
|
||||
https = true;
|
||||
port = 443;
|
||||
extraConfig = {
|
||||
gitlab = {
|
||||
trustedProxies = [ "100.109.86.8/32" ];
|
||||
};
|
||||
};
|
||||
initialRootEmail = "greg@thehellings.com";
|
||||
initialRootPasswordFile = pkgs.writeText "initialRootPassword" "root_password";
|
||||
pages = {
|
||||
enable = true;
|
||||
settings.pages-domain = "pages.thehellings.com";
|
||||
};
|
||||
puma = {
|
||||
threadsMax = 6;
|
||||
threadsMin = 2;
|
||||
workers = 6;
|
||||
};
|
||||
redisUrl = "unix:${config.services.redis.servers.gitlab.unixSocket}";
|
||||
registry = {
|
||||
enable = true;
|
||||
certFile = config.age.secrets.gitlab-cert.path;
|
||||
keyFile = config.age.secrets.gitlab-key.path;
|
||||
externalAddress = "registry.thehellings.com";
|
||||
externalPort = 443;
|
||||
};
|
||||
secrets = {
|
||||
secretFile = config.age.secrets.gitlab-secret.path;
|
||||
otpFile = config.age.secrets.gitlab-otp.path;
|
||||
dbFile = config.age.secrets.gitlab-db.path;
|
||||
jwsFile = config.age.secrets.gitlab-jws.path;
|
||||
};
|
||||
services = {
|
||||
gitlab = {
|
||||
enable = true;
|
||||
backup = {
|
||||
keepTime = 288;
|
||||
startAt = [ "03:00" ];
|
||||
};
|
||||
host = "src.thehellings.com";
|
||||
https = true;
|
||||
port = 443;
|
||||
extraConfig = {
|
||||
gitlab = {
|
||||
trustedProxies = [ "100.109.86.8/32" ];
|
||||
};
|
||||
};
|
||||
initialRootEmail = "greg@thehellings.com";
|
||||
initialRootPasswordFile = pkgs.writeText "initialRootPassword" "root_password";
|
||||
pages = {
|
||||
enable = true;
|
||||
settings.pages-domain = "pages.thehellings.com";
|
||||
};
|
||||
puma = {
|
||||
threadsMax = 6;
|
||||
threadsMin = 2;
|
||||
workers = 6;
|
||||
};
|
||||
redisUrl = "unix:${config.services.redis.servers.gitlab.unixSocket}";
|
||||
registry = {
|
||||
enable = true;
|
||||
certFile = config.age.secrets.gitlab-cert.path;
|
||||
keyFile = config.age.secrets.gitlab-key.path;
|
||||
externalAddress = "registry.thehellings.com";
|
||||
externalPort = 443;
|
||||
};
|
||||
secrets = {
|
||||
secretFile = config.age.secrets.gitlab-secret.path;
|
||||
otpFile = config.age.secrets.gitlab-otp.path;
|
||||
dbFile = config.age.secrets.gitlab-db.path;
|
||||
jwsFile = config.age.secrets.gitlab-jws.path;
|
||||
};
|
||||
|
||||
extraConfig = {
|
||||
object_store = {
|
||||
enabled = true;
|
||||
proxy_download = false; # Tell them to reach out to object storage themselves!
|
||||
connection = {
|
||||
provider = "AWS";
|
||||
endpoint = "http://s3.thehellings.lan:9000";
|
||||
region = "us-east-1";
|
||||
aws_access_key_id = { _secret = config.age.secrets.minio_access_key_id.path; };
|
||||
aws_secret_access_key = { _secret = config.age.secrets.minio_secret_access_key.path; };
|
||||
path_style = true; # True for MinIO
|
||||
aws_signature_version = 2;
|
||||
};
|
||||
#storage_options = ...;
|
||||
objects = builtins.listToAttrs ( builtins.map (x: lib.attrsets.nameValuePair x { bucket = "gitlab-${builtins.replaceStrings [ "_" ] [ "-" ] x}"; }) [
|
||||
"artifacts"
|
||||
"ci_secure_files"
|
||||
"dependency_proxy"
|
||||
"external_diffs"
|
||||
"lfs"
|
||||
"packages"
|
||||
"pages"
|
||||
"terraform_state"
|
||||
"uploads"
|
||||
]);
|
||||
};
|
||||
};
|
||||
};
|
||||
extraConfig = {
|
||||
object_store = {
|
||||
enabled = true;
|
||||
proxy_download = false; # Tell them to reach out to object storage themselves!
|
||||
connection = {
|
||||
provider = "AWS";
|
||||
endpoint = "http://s3.thehellings.lan:9000";
|
||||
region = "us-east-1";
|
||||
aws_access_key_id = { _secret = config.age.secrets.minio_access_key_id.path; };
|
||||
aws_secret_access_key = { _secret = config.age.secrets.minio_secret_access_key.path; };
|
||||
path_style = true; # True for MinIO
|
||||
aws_signature_version = 2;
|
||||
};
|
||||
#storage_options = ...;
|
||||
objects = builtins.listToAttrs (builtins.map (x: lib.attrsets.nameValuePair x { bucket = "gitlab-${builtins.replaceStrings [ "_" ] [ "-" ] x}"; }) [
|
||||
"artifacts"
|
||||
"ci_secure_files"
|
||||
"dependency_proxy"
|
||||
"external_diffs"
|
||||
"lfs"
|
||||
"packages"
|
||||
"pages"
|
||||
"terraform_state"
|
||||
"uploads"
|
||||
]);
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
nginx.virtualHosts."gitlab.shire-zebra.ts.net" = {
|
||||
listen = [ {
|
||||
addr = vpnIp;
|
||||
port = registryPort;
|
||||
ssl = true;
|
||||
} ];
|
||||
locations."/" = {
|
||||
proxyPass = "http://127.0.0.1:5000/";
|
||||
recommendedProxySettings = true;
|
||||
};
|
||||
extraConfig = builtins.concatStringsSep "\n" [
|
||||
"ssl_certificate /etc/certs/gitlab.shire-zebra.ts.net.crt ;"
|
||||
"ssl_certificate_key /etc/certs/gitlab.shire-zebra.ts.net.key ;"
|
||||
"client_max_body_size 250m;"
|
||||
];
|
||||
};
|
||||
nginx.virtualHosts."gitlab.shire-zebra.ts.net" = {
|
||||
listen = [{
|
||||
addr = vpnIp;
|
||||
port = registryPort;
|
||||
ssl = true;
|
||||
}];
|
||||
locations."/" = {
|
||||
proxyPass = "http://127.0.0.1:5000/";
|
||||
recommendedProxySettings = true;
|
||||
};
|
||||
extraConfig = builtins.concatStringsSep "\n" [
|
||||
"ssl_certificate /etc/certs/gitlab.shire-zebra.ts.net.crt ;"
|
||||
"ssl_certificate_key /etc/certs/gitlab.shire-zebra.ts.net.key ;"
|
||||
"client_max_body_size 250m;"
|
||||
];
|
||||
};
|
||||
|
||||
# Fetch the SSL certificates for nginx to use
|
||||
cron = {
|
||||
enable = true;
|
||||
systemCronJobs = [ "0 0 1 */2 * cd /etc/certs && tailscale cert gitlab.shire-zebra.ts.net && chown nginx * && systemctl reload nginx" ];
|
||||
};
|
||||
# Fetch the SSL certificates for nginx to use
|
||||
cron = {
|
||||
enable = true;
|
||||
systemCronJobs = [ "0 0 1 */2 * cd /etc/certs && tailscale cert gitlab.shire-zebra.ts.net && chown nginx * && systemctl reload nginx" ];
|
||||
};
|
||||
|
||||
postgresql = {
|
||||
enable = true;
|
||||
checkConfig = true;
|
||||
ensureDatabases = [ "gitlab" ];
|
||||
ensureUsers = [ {
|
||||
name = "gitlab";
|
||||
ensureDBOwnership = true;
|
||||
} ];
|
||||
settings = {
|
||||
log_connections = true;
|
||||
log_statement = "all";
|
||||
logging_collector = true;
|
||||
log_filename = "postgresql.log";
|
||||
};
|
||||
};
|
||||
postgresql = {
|
||||
enable = true;
|
||||
checkConfig = true;
|
||||
ensureDatabases = [ "gitlab" ];
|
||||
ensureUsers = [{
|
||||
name = "gitlab";
|
||||
ensureDBOwnership = true;
|
||||
}];
|
||||
settings = {
|
||||
log_connections = true;
|
||||
log_statement = "all";
|
||||
logging_collector = true;
|
||||
log_filename = "postgresql.log";
|
||||
};
|
||||
};
|
||||
|
||||
redis.servers.gitlab = {
|
||||
enable = true;
|
||||
};
|
||||
resolved.enable = true;
|
||||
openssh.enable = true;
|
||||
};
|
||||
redis.servers.gitlab = {
|
||||
enable = true;
|
||||
};
|
||||
resolved.enable = true;
|
||||
openssh.enable = true;
|
||||
};
|
||||
|
||||
# Do not start nginx until we have tailscaled up and running, so it can bind
|
||||
# to the 100.* addresses
|
||||
systemd.services = {
|
||||
nginx = rec {
|
||||
after = [
|
||||
"network-online.target"
|
||||
];
|
||||
wants = after;
|
||||
serviceConfig = {
|
||||
RestartMaxDelaySec = "30s";
|
||||
RestartSteps = "5";
|
||||
};
|
||||
};
|
||||
tailscaled.partOf = [ "network-online.target" ];
|
||||
};
|
||||
system.stateVersion = lib.mkForce "24.05";
|
||||
# Do not start nginx until we have tailscaled up and running, so it can bind
|
||||
# to the 100.* addresses
|
||||
systemd.services = {
|
||||
nginx = rec {
|
||||
after = [
|
||||
"network-online.target"
|
||||
];
|
||||
wants = after;
|
||||
serviceConfig = {
|
||||
RestartMaxDelaySec = "30s";
|
||||
RestartSteps = "5";
|
||||
};
|
||||
};
|
||||
tailscaled.partOf = [ "network-online.target" ];
|
||||
};
|
||||
system.stateVersion = lib.mkForce "24.05";
|
||||
}
|
||||
|
||||
@@ -1,91 +1,92 @@
|
||||
{ inputs, name, extra ? {}, packages ? [], overlays }:
|
||||
{ inputs, name, extra ? { }, packages ? [ ], overlays }:
|
||||
|
||||
({ config, pkgs, lib, ... }:
|
||||
(
|
||||
lib.attrsets.recursiveUpdate {
|
||||
lib.attrsets.recursiveUpdate
|
||||
{
|
||||
|
||||
imports = [
|
||||
inputs.agenix.nixosModules.default
|
||||
inputs.self.modules.nixosModule
|
||||
];
|
||||
imports = [
|
||||
inputs.agenix.nixosModules.default
|
||||
inputs.self.modules.nixosModule
|
||||
];
|
||||
|
||||
nixpkgs.overlays = overlays;
|
||||
nixpkgs.overlays = overlays;
|
||||
|
||||
greg.tailscale.enable = true;
|
||||
greg.tailscale.enable = true;
|
||||
|
||||
age = {
|
||||
identityPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
|
||||
secrets.runner-reg = {
|
||||
file = ../../secrets/gitlab/myself-${name}-runner-reg.age;
|
||||
owner = "gitlab-runner";
|
||||
};
|
||||
};
|
||||
age = {
|
||||
identityPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
|
||||
secrets.runner-reg = {
|
||||
file = ../../secrets/gitlab/myself-${name}-runner-reg.age;
|
||||
owner = "gitlab-runner";
|
||||
};
|
||||
};
|
||||
|
||||
environment.systemPackages = with pkgs; [
|
||||
curl
|
||||
gawk
|
||||
git
|
||||
unzip
|
||||
xorriso
|
||||
wget
|
||||
] ++ packages;
|
||||
environment.systemPackages = with pkgs; [
|
||||
curl
|
||||
gawk
|
||||
git
|
||||
unzip
|
||||
xorriso
|
||||
wget
|
||||
] ++ packages;
|
||||
|
||||
networking = {
|
||||
useHostResolvConf = pkgs.lib.mkForce false;
|
||||
nameservers = [ "100.100.100.100" ];
|
||||
};
|
||||
networking = {
|
||||
useHostResolvConf = pkgs.lib.mkForce false;
|
||||
nameservers = [ "100.100.100.100" ];
|
||||
};
|
||||
|
||||
nixpkgs.config.allowUnfree = true;
|
||||
nixpkgs.config.allowUnfree = true;
|
||||
|
||||
users.users.gitlab-runner = {
|
||||
isSystemUser = true;
|
||||
group = "kvm";
|
||||
extraGroups = [ "kvm" ];
|
||||
};
|
||||
users.users.gitlab-runner = {
|
||||
isSystemUser = true;
|
||||
group = "kvm";
|
||||
extraGroups = [ "kvm" ];
|
||||
};
|
||||
|
||||
services = {
|
||||
gitlab-runner = {
|
||||
enable = true;
|
||||
settings.concurrent = 5;
|
||||
services = {
|
||||
shell = {
|
||||
executor = "shell";
|
||||
limit = 5;
|
||||
authenticationTokenConfigFile = config.age.secrets.runner-reg.path;
|
||||
environmentVariables = {
|
||||
EFI_DIR = "${pkgs.OVMF.fd}/FV/";
|
||||
STORAGE_URL = "http://s3.thehellings.lan:9000";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
resolved.enable = true;
|
||||
};
|
||||
services = {
|
||||
gitlab-runner = {
|
||||
enable = true;
|
||||
settings.concurrent = 5;
|
||||
services = {
|
||||
shell = {
|
||||
executor = "shell";
|
||||
limit = 5;
|
||||
authenticationTokenConfigFile = config.age.secrets.runner-reg.path;
|
||||
environmentVariables = {
|
||||
EFI_DIR = "${pkgs.OVMF.fd}/FV/";
|
||||
STORAGE_URL = "http://s3.thehellings.lan:9000";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
resolved.enable = true;
|
||||
};
|
||||
|
||||
systemd.services.gitlab-runner = {
|
||||
wants = [
|
||||
"network-online.target"
|
||||
"systemd-resolved.service"
|
||||
];
|
||||
after = [
|
||||
"network.target"
|
||||
"network-online.target"
|
||||
"systemd-resolved.service"
|
||||
];
|
||||
serviceConfig = {
|
||||
DevicePolicy = lib.mkForce "auto";
|
||||
PrivateDevices = false;
|
||||
ProtectKernelModules = false;
|
||||
DevicesAllow = [ "/dev/kvm" "/dev/mem" ];
|
||||
DynamicUser = lib.mkForce false;
|
||||
User = "root";
|
||||
Group = "kvm";
|
||||
};
|
||||
};
|
||||
systemd.services.gitlab-runner = {
|
||||
wants = [
|
||||
"network-online.target"
|
||||
"systemd-resolved.service"
|
||||
];
|
||||
after = [
|
||||
"network.target"
|
||||
"network-online.target"
|
||||
"systemd-resolved.service"
|
||||
];
|
||||
serviceConfig = {
|
||||
DevicePolicy = lib.mkForce "auto";
|
||||
PrivateDevices = false;
|
||||
ProtectKernelModules = false;
|
||||
DevicesAllow = [ "/dev/kvm" "/dev/mem" ];
|
||||
DynamicUser = lib.mkForce false;
|
||||
User = "root";
|
||||
Group = "kvm";
|
||||
};
|
||||
};
|
||||
|
||||
system.stateVersion = lib.mkForce "24.05";
|
||||
}
|
||||
system.stateVersion = lib.mkForce "24.05";
|
||||
}
|
||||
|
||||
extra
|
||||
extra
|
||||
) # End of attrsets.recursiveUpdate
|
||||
) # End of outter function wrapper
|
||||
|
||||
+82
-81
@@ -1,86 +1,87 @@
|
||||
{ config, pkgs, lib, ... }:
|
||||
{
|
||||
imports = [
|
||||
./ceph.nix
|
||||
./hardware-configuration.nix
|
||||
./git.nix
|
||||
./matrix.nix
|
||||
./minio.nix
|
||||
];
|
||||
imports = [
|
||||
./ceph.nix
|
||||
./hardware-configuration.nix
|
||||
./git.nix
|
||||
./matrix.nix
|
||||
./minio.nix
|
||||
];
|
||||
|
||||
greg.tailscale.enable = true;
|
||||
greg.tailscale.enable = true;
|
||||
|
||||
services = {
|
||||
openssh.enable = true;
|
||||
};
|
||||
networking = {
|
||||
hostName = "myself";
|
||||
useDHCP = false;
|
||||
defaultGateway = {
|
||||
address = " 10.42.1.1";
|
||||
interface = "enp38s0";
|
||||
};
|
||||
vlans = {
|
||||
san = {
|
||||
id = 616;
|
||||
interface = "enp39s0";
|
||||
};
|
||||
};
|
||||
interfaces = {
|
||||
enp38s0 = {
|
||||
ipv4.addresses = [ {
|
||||
address = "10.42.1.6";
|
||||
prefixLength = 16;
|
||||
} {
|
||||
address = "10.42.100.1";
|
||||
prefixLength = 16;
|
||||
} ];
|
||||
};
|
||||
san = {
|
||||
ipv4.addresses = [ {
|
||||
address = "10.201.1.1";
|
||||
prefixLength = 24;
|
||||
} ];
|
||||
};
|
||||
};
|
||||
nameservers = [
|
||||
"10.42.1.5"
|
||||
];
|
||||
};
|
||||
users = {
|
||||
users = {
|
||||
greg = {
|
||||
extraGroups = [
|
||||
"kvm"
|
||||
"sudo"
|
||||
"wheel"
|
||||
];
|
||||
isNormalUser = true;
|
||||
};
|
||||
};
|
||||
};
|
||||
system.stateVersion = lib.mkForce "24.05";
|
||||
boot = {
|
||||
extraModprobeConfig = "options kvm_amd nested=1";
|
||||
supportedFilesystems = [ "ntfs" ];
|
||||
loader = {
|
||||
efi = {
|
||||
canTouchEfiVariables = true;
|
||||
efiSysMountPoint = "/boot";
|
||||
};
|
||||
systemd-boot = {
|
||||
enable = true;
|
||||
configurationLimit = 10;
|
||||
};
|
||||
};
|
||||
binfmt.emulatedSystems = [
|
||||
"aarch64-linux"
|
||||
];
|
||||
};
|
||||
nixpkgs.config = {
|
||||
allowUnfree = true;
|
||||
permittedInsecurePackages = [
|
||||
"nodejs-16.20.2"
|
||||
];
|
||||
};
|
||||
services = {
|
||||
openssh.enable = true;
|
||||
};
|
||||
networking = {
|
||||
hostName = "myself";
|
||||
useDHCP = false;
|
||||
defaultGateway = {
|
||||
address = " 10.42.1.1";
|
||||
interface = "enp38s0";
|
||||
};
|
||||
vlans = {
|
||||
san = {
|
||||
id = 616;
|
||||
interface = "enp39s0";
|
||||
};
|
||||
};
|
||||
interfaces = {
|
||||
enp38s0 = {
|
||||
ipv4.addresses = [{
|
||||
address = "10.42.1.6";
|
||||
prefixLength = 16;
|
||||
}
|
||||
{
|
||||
address = "10.42.100.1";
|
||||
prefixLength = 16;
|
||||
}];
|
||||
};
|
||||
san = {
|
||||
ipv4.addresses = [{
|
||||
address = "10.201.1.1";
|
||||
prefixLength = 24;
|
||||
}];
|
||||
};
|
||||
};
|
||||
nameservers = [
|
||||
"10.42.1.5"
|
||||
];
|
||||
};
|
||||
users = {
|
||||
users = {
|
||||
greg = {
|
||||
extraGroups = [
|
||||
"kvm"
|
||||
"sudo"
|
||||
"wheel"
|
||||
];
|
||||
isNormalUser = true;
|
||||
};
|
||||
};
|
||||
};
|
||||
system.stateVersion = lib.mkForce "24.05";
|
||||
boot = {
|
||||
extraModprobeConfig = "options kvm_amd nested=1";
|
||||
supportedFilesystems = [ "ntfs" ];
|
||||
loader = {
|
||||
efi = {
|
||||
canTouchEfiVariables = true;
|
||||
efiSysMountPoint = "/boot";
|
||||
};
|
||||
systemd-boot = {
|
||||
enable = true;
|
||||
configurationLimit = 10;
|
||||
};
|
||||
};
|
||||
binfmt.emulatedSystems = [
|
||||
"aarch64-linux"
|
||||
];
|
||||
};
|
||||
nixpkgs.config = {
|
||||
allowUnfree = true;
|
||||
permittedInsecurePackages = [
|
||||
"nodejs-16.20.2"
|
||||
];
|
||||
};
|
||||
}
|
||||
|
||||
+130
-127
@@ -2,139 +2,142 @@
|
||||
|
||||
let
|
||||
|
||||
gitlabStateDir = "/var/lib/gitlab";
|
||||
gitlabStateDir = "/var/lib/gitlab";
|
||||
|
||||
container = input: (lib.attrsets.recursiveUpdate {
|
||||
bindMounts."/etc/ssh".hostPath = "/etc/ssh"; # For agenix secrets
|
||||
enableTun = true;
|
||||
privateNetwork = true;
|
||||
} input);
|
||||
in {
|
||||
networking = {
|
||||
firewall = {
|
||||
enable = true;
|
||||
allowedTCPPorts = [ 80 ];
|
||||
};
|
||||
nat = {
|
||||
enable = true;
|
||||
internalInterfaces = [ "ve-+" ];
|
||||
externalInterface = "enp38s0";
|
||||
};
|
||||
};
|
||||
container = input: (lib.attrsets.recursiveUpdate
|
||||
{
|
||||
bindMounts."/etc/ssh".hostPath = "/etc/ssh"; # For agenix secrets
|
||||
enableTun = true;
|
||||
privateNetwork = true;
|
||||
}
|
||||
input);
|
||||
in
|
||||
{
|
||||
networking = {
|
||||
firewall = {
|
||||
enable = true;
|
||||
allowedTCPPorts = [ 80 ];
|
||||
};
|
||||
nat = {
|
||||
enable = true;
|
||||
internalInterfaces = [ "ve-+" ];
|
||||
externalInterface = "enp38s0";
|
||||
};
|
||||
};
|
||||
|
||||
greg.proxies."git.thehellings.lan" = {
|
||||
target = "http://192.168.200.2";
|
||||
extraConfig = ''
|
||||
proxy_set_header X-Forwarded-Proto https;
|
||||
proxy_set_header X-Forwarded-Ssl on;
|
||||
'';
|
||||
};
|
||||
|
||||
system.activationScripts.makeGitlabDir = lib.stringAfter [ "var" ] "mkdir -p ${gitlabStateDir} && touch ${gitlabStateDir}/touch";
|
||||
greg.proxies."git.thehellings.lan" = {
|
||||
target = "http://192.168.200.2";
|
||||
extraConfig = ''
|
||||
proxy_set_header X-Forwarded-Proto https;
|
||||
proxy_set_header X-Forwarded-Ssl on;
|
||||
'';
|
||||
};
|
||||
|
||||
greg.containers.gitlab = {
|
||||
tailscale = true;
|
||||
subnet = "200";
|
||||
builder = (import ./container-git.nix);
|
||||
};
|
||||
system.activationScripts.makeGitlabDir = lib.stringAfter [ "var" ] "mkdir -p ${gitlabStateDir} && touch ${gitlabStateDir}/touch";
|
||||
|
||||
systemd.services = {
|
||||
"gitlab-runner" = {
|
||||
after = [ "container@github.service" ];
|
||||
preStart = builtins.concatStringsSep "\n" [
|
||||
"${pkgs.kmod}/bin/modprobe kvm"
|
||||
"${pkgs.kmod}/bin/modprobe kvm_amd"
|
||||
];
|
||||
postStop = builtins.concatStringsSep "\n" [
|
||||
"${pkgs.kmod}/bin/rmmod -f kvm_amd kvm"
|
||||
];
|
||||
serviceConfig = {
|
||||
DevicePolicy = lib.mkForce "auto";
|
||||
DevicesAllow = [ "/dev/kvm" "/dev/mem" ];
|
||||
EnvironmentFile = config.age.secrets.docker-auth.path;
|
||||
PermissionsStartOnly = "true";
|
||||
PrivateDevices = false;
|
||||
ProtectKernelModules = false;
|
||||
};
|
||||
};
|
||||
};
|
||||
greg.containers.gitlab = {
|
||||
tailscale = true;
|
||||
subnet = "200";
|
||||
builder = (import ./container-git.nix);
|
||||
};
|
||||
|
||||
#####################################################################################
|
||||
#################### Container Podman Runner ########################################
|
||||
#####################################################################################
|
||||
containers.gitlab-runner-shell = container {
|
||||
autoStart = true;
|
||||
hostAddress = "192.168.203.1";
|
||||
localAddress = "192.168.203.2";
|
||||
config = ((import ./container-runner.nix) {
|
||||
inherit inputs overlays;
|
||||
name = "shell";
|
||||
extra.virtualisation.podman.enable = true;
|
||||
});
|
||||
};
|
||||
systemd.services = {
|
||||
"gitlab-runner" = {
|
||||
after = [ "container@github.service" ];
|
||||
preStart = builtins.concatStringsSep "\n" [
|
||||
"${pkgs.kmod}/bin/modprobe kvm"
|
||||
"${pkgs.kmod}/bin/modprobe kvm_amd"
|
||||
];
|
||||
postStop = builtins.concatStringsSep "\n" [
|
||||
"${pkgs.kmod}/bin/rmmod -f kvm_amd kvm"
|
||||
];
|
||||
serviceConfig = {
|
||||
DevicePolicy = lib.mkForce "auto";
|
||||
DevicesAllow = [ "/dev/kvm" "/dev/mem" ];
|
||||
EnvironmentFile = config.age.secrets.docker-auth.path;
|
||||
PermissionsStartOnly = "true";
|
||||
PrivateDevices = false;
|
||||
ProtectKernelModules = false;
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
#####################################################################################
|
||||
#################### Local Podman/Docker Runner #####################################
|
||||
#####################################################################################
|
||||
age.secrets.runner-reg.file = ../../secrets/gitlab/myself-podman-runner-reg.age;
|
||||
age.secrets.docker-auth.file = ../../secrets/gitlab/docker-auth.age;
|
||||
age.secrets.runner-qemu.file = ../../secrets/gitlab/myself-qemu-runner-reg.age;
|
||||
services.gitlab-runner = {
|
||||
enable = true;
|
||||
settings = {
|
||||
concurrent = 5;
|
||||
};
|
||||
services = {
|
||||
default = {
|
||||
executor = "docker";
|
||||
authenticationTokenConfigFile = config.age.secrets.runner-reg.path;
|
||||
dockerImage = "gitlab.shire-zebra.ts.net:5000/greg/ci-images/fedora:latest";
|
||||
dockerAllowedImages = [
|
||||
"alpine:*"
|
||||
"debian:*"
|
||||
"docker:*"
|
||||
"fedora:*"
|
||||
"python:*"
|
||||
"ubuntu:*"
|
||||
#####################################################################################
|
||||
#################### Container Podman Runner ########################################
|
||||
#####################################################################################
|
||||
containers.gitlab-runner-shell = container {
|
||||
autoStart = true;
|
||||
hostAddress = "192.168.203.1";
|
||||
localAddress = "192.168.203.2";
|
||||
config = ((import ./container-runner.nix) {
|
||||
inherit inputs overlays;
|
||||
name = "shell";
|
||||
extra.virtualisation.podman.enable = true;
|
||||
});
|
||||
};
|
||||
|
||||
"hashicorp/*:*"
|
||||
"koalaman/shellcheck:*"
|
||||
#####################################################################################
|
||||
#################### Local Podman/Docker Runner #####################################
|
||||
#####################################################################################
|
||||
age.secrets.runner-reg.file = ../../secrets/gitlab/myself-podman-runner-reg.age;
|
||||
age.secrets.docker-auth.file = ../../secrets/gitlab/docker-auth.age;
|
||||
age.secrets.runner-qemu.file = ../../secrets/gitlab/myself-qemu-runner-reg.age;
|
||||
services.gitlab-runner = {
|
||||
enable = true;
|
||||
settings = {
|
||||
concurrent = 5;
|
||||
};
|
||||
services = {
|
||||
default = {
|
||||
executor = "docker";
|
||||
authenticationTokenConfigFile = config.age.secrets.runner-reg.path;
|
||||
dockerImage = "gitlab.shire-zebra.ts.net:5000/greg/ci-images/fedora:latest";
|
||||
dockerAllowedImages = [
|
||||
"alpine:*"
|
||||
"debian:*"
|
||||
"docker:*"
|
||||
"fedora:*"
|
||||
"python:*"
|
||||
"ubuntu:*"
|
||||
|
||||
"registry.gitlab.com/gitlab-org/*"
|
||||
"registry.thehellings.com/*/*/*:*"
|
||||
"gitlab.shire-zebra.ts.net:5000/*/*/*:*"
|
||||
];
|
||||
dockerAllowedServices = [
|
||||
"docker:*"
|
||||
"registry.thehellings.com/*/*/*:*"
|
||||
"gitlab.shire-zebra.ts.net:5000/*/*/*:*"
|
||||
];
|
||||
dockerPrivileged = true;
|
||||
dockerVolumes = [
|
||||
"/certs/client"
|
||||
"/cache"
|
||||
];
|
||||
};
|
||||
qemu = {
|
||||
executor = "shell";
|
||||
limit = 5;
|
||||
authenticationTokenConfigFile = config.age.secrets.runner-qemu.path;
|
||||
environmentVariables = {
|
||||
EFI_DIR = "${pkgs.OVMF.fd}/FV/";
|
||||
STORAGE_URL = "http://s3.thehellings.lan:9000";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
virtualisation = {
|
||||
docker.enable = true;
|
||||
oci-containers.backend = "docker";
|
||||
};
|
||||
environment.systemPackages = with pkgs; [
|
||||
curl
|
||||
gawk
|
||||
git
|
||||
unzip
|
||||
wget
|
||||
];
|
||||
"hashicorp/*:*"
|
||||
"koalaman/shellcheck:*"
|
||||
|
||||
"registry.gitlab.com/gitlab-org/*"
|
||||
"registry.thehellings.com/*/*/*:*"
|
||||
"gitlab.shire-zebra.ts.net:5000/*/*/*:*"
|
||||
];
|
||||
dockerAllowedServices = [
|
||||
"docker:*"
|
||||
"registry.thehellings.com/*/*/*:*"
|
||||
"gitlab.shire-zebra.ts.net:5000/*/*/*:*"
|
||||
];
|
||||
dockerPrivileged = true;
|
||||
dockerVolumes = [
|
||||
"/certs/client"
|
||||
"/cache"
|
||||
];
|
||||
};
|
||||
qemu = {
|
||||
executor = "shell";
|
||||
limit = 5;
|
||||
authenticationTokenConfigFile = config.age.secrets.runner-qemu.path;
|
||||
environmentVariables = {
|
||||
EFI_DIR = "${pkgs.OVMF.fd}/FV/";
|
||||
STORAGE_URL = "http://s3.thehellings.lan:9000";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
virtualisation = {
|
||||
docker.enable = true;
|
||||
oci-containers.backend = "docker";
|
||||
};
|
||||
environment.systemPackages = with pkgs; [
|
||||
curl
|
||||
gawk
|
||||
git
|
||||
unzip
|
||||
wget
|
||||
];
|
||||
}
|
||||
|
||||
@@ -4,48 +4,53 @@
|
||||
{ config, lib, pkgs, modulesPath, ... }:
|
||||
|
||||
{
|
||||
imports =
|
||||
[ (modulesPath + "/installer/scan/not-detected.nix")
|
||||
];
|
||||
imports =
|
||||
[
|
||||
(modulesPath + "/installer/scan/not-detected.nix")
|
||||
];
|
||||
|
||||
boot.initrd.availableKernelModules = [ "nvme" "xhci_pci" "ahci" "usb_storage" "usbhid" "sd_mod" "sr_mod" ];
|
||||
boot.initrd.kernelModules = [ ];
|
||||
boot.kernelModules = [ "kvm-amd" ];
|
||||
boot.extraModulePackages = [ ];
|
||||
boot.initrd.availableKernelModules = [ "nvme" "xhci_pci" "ahci" "usb_storage" "usbhid" "sd_mod" "sr_mod" ];
|
||||
boot.initrd.kernelModules = [ ];
|
||||
boot.kernelModules = [ "kvm-amd" ];
|
||||
boot.extraModulePackages = [ ];
|
||||
|
||||
fileSystems."/" =
|
||||
{ device = "/dev/disk/by-uuid/714744ca-dd9d-4713-b571-c6ccfbf56d79";
|
||||
fsType = "btrfs";
|
||||
options = [ "subvol=nixos" ];
|
||||
};
|
||||
fileSystems."/" =
|
||||
{
|
||||
device = "/dev/disk/by-uuid/714744ca-dd9d-4713-b571-c6ccfbf56d79";
|
||||
fsType = "btrfs";
|
||||
options = [ "subvol=nixos" ];
|
||||
};
|
||||
|
||||
fileSystems."/home" =
|
||||
{ device = "/dev/disk/by-uuid/714744ca-dd9d-4713-b571-c6ccfbf56d79";
|
||||
fsType = "btrfs";
|
||||
options = [ "subvol=home" ];
|
||||
};
|
||||
fileSystems."/home" =
|
||||
{
|
||||
device = "/dev/disk/by-uuid/714744ca-dd9d-4713-b571-c6ccfbf56d79";
|
||||
fsType = "btrfs";
|
||||
options = [ "subvol=home" ];
|
||||
};
|
||||
|
||||
fileSystems."/boot" =
|
||||
{ device = "/dev/disk/by-uuid/29E7-E20C";
|
||||
fsType = "vfat";
|
||||
};
|
||||
fileSystems."/boot" =
|
||||
{
|
||||
device = "/dev/disk/by-uuid/29E7-E20C";
|
||||
fsType = "vfat";
|
||||
};
|
||||
|
||||
fileSystems."/myvol" =
|
||||
{ device = "/dev/nvme0n1p1";
|
||||
fsType = "btrfs";
|
||||
};
|
||||
fileSystems."/myvol" =
|
||||
{
|
||||
device = "/dev/nvme0n1p1";
|
||||
fsType = "btrfs";
|
||||
};
|
||||
|
||||
swapDevices = [ ];
|
||||
swapDevices = [ ];
|
||||
|
||||
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
|
||||
# (the default) this is the recommended approach. When using systemd-networkd it's
|
||||
# still possible to use this option, but it's recommended to use it in conjunction
|
||||
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
|
||||
networking.useDHCP = lib.mkDefault true;
|
||||
# networking.interfaces.enp38s0.useDHCP = lib.mkDefault true;
|
||||
# networking.interfaces.enp39s0.useDHCP = lib.mkDefault true;
|
||||
# networking.interfaces.enp42s0f3u5u3c2.useDHCP = lib.mkDefault true;
|
||||
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
|
||||
# (the default) this is the recommended approach. When using systemd-networkd it's
|
||||
# still possible to use this option, but it's recommended to use it in conjunction
|
||||
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
|
||||
networking.useDHCP = lib.mkDefault true;
|
||||
# networking.interfaces.enp38s0.useDHCP = lib.mkDefault true;
|
||||
# networking.interfaces.enp39s0.useDHCP = lib.mkDefault true;
|
||||
# networking.interfaces.enp42s0f3u5u3c2.useDHCP = lib.mkDefault true;
|
||||
|
||||
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
|
||||
hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
|
||||
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
|
||||
hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
|
||||
}
|
||||
|
||||
+79
-78
@@ -1,90 +1,91 @@
|
||||
{ config, pkgs, inputs, lib, ... }:
|
||||
let
|
||||
domain = "thehellings.com";
|
||||
fqdn = "matrix.${domain}";
|
||||
conn = "postgresql:///dendrite?sslmode=disable&host=/run/postgresql";
|
||||
domain = "thehellings.com";
|
||||
fqdn = "matrix.${domain}";
|
||||
conn = "postgresql:///dendrite?sslmode=disable&host=/run/postgresql";
|
||||
in
|
||||
{
|
||||
environment.systemPackages = with pkgs; [ upgrade-pg-cluster ];
|
||||
environment.systemPackages = with pkgs; [ upgrade-pg-cluster ];
|
||||
|
||||
greg.containers.matrix = {
|
||||
tailscale = true;
|
||||
subnet = "204";
|
||||
builder = { pkgs, config, ... }: {
|
||||
networking.firewall.allowedTCPPorts = [ config.services.dendrite.httpPort ];
|
||||
greg.containers.matrix = {
|
||||
tailscale = true;
|
||||
subnet = "204";
|
||||
builder = { pkgs, config, ... }: {
|
||||
networking.firewall.allowedTCPPorts = [ config.services.dendrite.httpPort ];
|
||||
|
||||
# Environment secrets
|
||||
age = {
|
||||
secrets.dendrite = {
|
||||
file = ../../secrets/dendrite.age;
|
||||
owner = "dendrite";
|
||||
};
|
||||
secrets.dendrite_key = {
|
||||
file = ../../secrets/dendrite_key.age;
|
||||
owner = "dendrite";
|
||||
};
|
||||
};
|
||||
# Environment secrets
|
||||
age = {
|
||||
secrets.dendrite = {
|
||||
file = ../../secrets/dendrite.age;
|
||||
owner = "dendrite";
|
||||
};
|
||||
secrets.dendrite_key = {
|
||||
file = ../../secrets/dendrite_key.age;
|
||||
owner = "dendrite";
|
||||
};
|
||||
};
|
||||
|
||||
users.users.dendrite = {
|
||||
isSystemUser = true;
|
||||
group = "dendrite";
|
||||
};
|
||||
users.groups.dendrite = {};
|
||||
users.users.dendrite = {
|
||||
isSystemUser = true;
|
||||
group = "dendrite";
|
||||
};
|
||||
users.groups.dendrite = { };
|
||||
|
||||
systemd.services.dendrite.serviceConfig = {
|
||||
User = "dendrite";
|
||||
};
|
||||
systemd.services.dendrite.serviceConfig = {
|
||||
User = "dendrite";
|
||||
};
|
||||
|
||||
greg.databases.dendrite = {};
|
||||
greg.databases.dendrite = { };
|
||||
|
||||
services.dendrite = {
|
||||
enable = true;
|
||||
environmentFile = config.age.secrets.dendrite.path;
|
||||
httpPort = 8448;
|
||||
# Identify ourselves as the root of our own domain
|
||||
settings = (
|
||||
(builtins.listToAttrs (
|
||||
(map (x: { name = x; value = { database.connection_string = conn; }; }) [
|
||||
"app_service_api"
|
||||
"federation_api"
|
||||
"key_server"
|
||||
"media_api"
|
||||
"mscs"
|
||||
"relay_api"
|
||||
"room_server"
|
||||
"sync_api"
|
||||
])
|
||||
) ) //
|
||||
{
|
||||
user_api.account_database.connection_string = conn;
|
||||
user_api.device_database.connection_string = conn;
|
||||
global = {
|
||||
database = {
|
||||
connection_string = conn;
|
||||
max_open_conns = 25;
|
||||
max_idle_conns = 5;
|
||||
conn_max_lifetime = -1;
|
||||
};
|
||||
server_name = "thehellings.com";
|
||||
trusted_third_party_id_servers = [
|
||||
"matrix.org"
|
||||
"vector.im"
|
||||
"jupiterbroadcasting.com"
|
||||
];
|
||||
# Generate this with {path-to-dendrite}/bin/generate-keys --private-key /etc/dendrite.pem
|
||||
private_key = config.age.secrets.dendrite_key.path;
|
||||
};
|
||||
client_api = {
|
||||
registration_enabled = false;
|
||||
registration_shared_secret = "\${REGISTRATION_SHARED_SECRET}";
|
||||
};
|
||||
});
|
||||
};
|
||||
services.dendrite = {
|
||||
enable = true;
|
||||
environmentFile = config.age.secrets.dendrite.path;
|
||||
httpPort = 8448;
|
||||
# Identify ourselves as the root of our own domain
|
||||
settings = (
|
||||
(builtins.listToAttrs (
|
||||
(map (x: { name = x; value = { database.connection_string = conn; }; }) [
|
||||
"app_service_api"
|
||||
"federation_api"
|
||||
"key_server"
|
||||
"media_api"
|
||||
"mscs"
|
||||
"relay_api"
|
||||
"room_server"
|
||||
"sync_api"
|
||||
])
|
||||
)) //
|
||||
{
|
||||
user_api.account_database.connection_string = conn;
|
||||
user_api.device_database.connection_string = conn;
|
||||
global = {
|
||||
database = {
|
||||
connection_string = conn;
|
||||
max_open_conns = 25;
|
||||
max_idle_conns = 5;
|
||||
conn_max_lifetime = -1;
|
||||
};
|
||||
server_name = "thehellings.com";
|
||||
trusted_third_party_id_servers = [
|
||||
"matrix.org"
|
||||
"vector.im"
|
||||
"jupiterbroadcasting.com"
|
||||
];
|
||||
# Generate this with {path-to-dendrite}/bin/generate-keys --private-key /etc/dendrite.pem
|
||||
private_key = config.age.secrets.dendrite_key.path;
|
||||
};
|
||||
client_api = {
|
||||
registration_enabled = false;
|
||||
registration_shared_secret = "\${REGISTRATION_SHARED_SECRET}";
|
||||
};
|
||||
}
|
||||
);
|
||||
};
|
||||
|
||||
systemd.services.dendrite = {
|
||||
after = [ "postgresql.service" ];
|
||||
requires = [ "postgresql.service" ];
|
||||
};
|
||||
};
|
||||
};
|
||||
systemd.services.dendrite = {
|
||||
after = [ "postgresql.service" ];
|
||||
requires = [ "postgresql.service" ];
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
|
||||
+24
-23
@@ -1,32 +1,33 @@
|
||||
{ config, pkgs, ... }:
|
||||
|
||||
let
|
||||
minioPort = 9000;
|
||||
minioConsolePort = 9001;
|
||||
in {
|
||||
environment.systemPackages = with pkgs; [
|
||||
minio-client
|
||||
xfsprogs
|
||||
];
|
||||
minioPort = 9000;
|
||||
minioConsolePort = 9001;
|
||||
in
|
||||
{
|
||||
environment.systemPackages = with pkgs; [
|
||||
minio-client
|
||||
xfsprogs
|
||||
];
|
||||
|
||||
greg.proxies."minio-01.thehellings.lan".target = "http://localhost:9000";
|
||||
greg.proxies."minio-01.thehellings.lan".target = "http://localhost:9000";
|
||||
|
||||
fileSystems."/data/1" = {
|
||||
device = "/dev/disk/by-id/wwn-0x5000c500c48728e9-part1";
|
||||
fsType = "xfs";
|
||||
};
|
||||
fileSystems."/data/1" = {
|
||||
device = "/dev/disk/by-id/wwn-0x5000c500c48728e9-part1";
|
||||
fsType = "xfs";
|
||||
};
|
||||
|
||||
networking.firewall.allowedTCPPorts = [
|
||||
minioPort
|
||||
minioConsolePort
|
||||
];
|
||||
networking.firewall.allowedTCPPorts = [
|
||||
minioPort
|
||||
minioConsolePort
|
||||
];
|
||||
|
||||
age.secrets.minio.file = ../../secrets/minio.age;
|
||||
age.secrets.minio.file = ../../secrets/minio.age;
|
||||
|
||||
services.minio = {
|
||||
enable = true;
|
||||
dataDir = [ "/data/1/minio" ];
|
||||
rootCredentialsFile = config.age.secrets.minio.path;
|
||||
browser = true;
|
||||
};
|
||||
services.minio = {
|
||||
enable = true;
|
||||
dataDir = [ "/data/1/minio" ];
|
||||
rootCredentialsFile = config.age.secrets.minio.path;
|
||||
browser = true;
|
||||
};
|
||||
}
|
||||
|
||||
@@ -1,11 +1,11 @@
|
||||
{ pkgs, ... }:
|
||||
|
||||
{
|
||||
wsl = {
|
||||
enable = true;
|
||||
wslConf.automount.root = "/mnt";
|
||||
defaultUser = "greg";
|
||||
startMenuLaunchers = true;
|
||||
nativeSystemd = true;
|
||||
};
|
||||
wsl = {
|
||||
enable = true;
|
||||
wslConf.automount.root = "/mnt";
|
||||
defaultUser = "greg";
|
||||
startMenuLaunchers = true;
|
||||
nativeSystemd = true;
|
||||
};
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user