A complete reformatting to match nixpkgs-fmt
This commit is contained in:
Greg Hellings
+59
-58
@@ -1,62 +1,63 @@
|
||||
{ pkgs, config, lib, ... }:
|
||||
|
||||
let
|
||||
address = (builtins.elemAt config.networking.interfaces.ens18.ipv4.addresses 0).address;
|
||||
root_ca = pkgs.writeText "root_ca.crt" (builtins.readFile ../../ca/root_ca.crt);
|
||||
intermediate_ca = pkgs.writeText "intermediate_ca.crt" (builtins.readFile ../../ca/intermediate_ca.crt);
|
||||
in {
|
||||
age.secrets.acme_password = {
|
||||
file = ../../secrets/acme_password.age;
|
||||
};
|
||||
age.secrets.intermediate_ca_key = {
|
||||
file = ../../secrets/ca/intermediate_key.age;
|
||||
};
|
||||
age.secrets.root_ca_key.file = ../../secrets/ca/root_key.age;
|
||||
systemd.services.step-ca.serviceConfig.Environment = lib.mkForce ["STEPDEBUG=1" "HOME=%S/step-ca"];
|
||||
services.step-ca = {
|
||||
inherit address;
|
||||
enable = false;
|
||||
intermediatePasswordFile = config.age.secrets.acme_password.path;
|
||||
openFirewall = true;
|
||||
port = 8443;
|
||||
settings = {
|
||||
root = root_ca;
|
||||
federatedRoots = null;
|
||||
cert = intermediate_ca;
|
||||
key = config.age.secrets.intermediate_ca_key.path;
|
||||
dnsNames = [
|
||||
"10.42.1.5"
|
||||
"acme.thehellings.lan"
|
||||
];
|
||||
logger.format = "text";
|
||||
db = {
|
||||
type = "badgerv2";
|
||||
dataSource = "/var/lib/step-ca/db";
|
||||
badgerFileLoadingMode = "";
|
||||
};
|
||||
authority.provisioners = [ {
|
||||
type = "JWK";
|
||||
name = "greg@thehellings.com";
|
||||
key = {
|
||||
use = "sig";
|
||||
kty = "EC";
|
||||
kid = "1GOpOttYLZtx7XiG79ZycbGcG4ptL0czfohK35SZOEI";
|
||||
crv = "P-256";
|
||||
alg = "ES256";
|
||||
x = "YEWVj5CCoqWQXWqmL0UuORlFY9IEOLcg1jpG1o-wGx4";
|
||||
y = "MEpqnJp60VV-SpFtb6m8U-VAYut7R_PKFm07xl7MjBk";
|
||||
};
|
||||
encryptedKey = "eyJhbGciOiJQQkVTMi1IUzI1NitBMTI4S1ciLCJjdHkiOiJqd2sranNvbiIsImVuYyI6IkEyNTZHQ00iLCJwMmMiOjYwMDAwMCwicDJzIjoieWdfb0lfbWgwbHhPRXdjUTBsd0FnUSJ9.ivdQUFEhs2U8PUBYr8AhQl3hHdb4spF4jvXgqY_hiVgpjB-z3Nn9Uw.u7vrNht_3WD1G97q.mbydlpAQxjtKLkOmmDOUczqscRDPqrUyoPJ1uqXcJDH3vs4KiYlrKRcFLjPy9sWzEL1iIrqjwf3U-3AAx1KNAg7frs2D__MGfOO-U5SdQDVJVAND7KpWOJGJVSb0xioCA6-8ldlP_REqu4ENmkkdw0_6Is2b0p7ZFKqke_fqOOs7osqFAfbMb_WzEWrACLn5A5-Teh2rpEgR-z9zipN6MSEqE6VIQ2BXuv70aHWhslNe1MK1OgTYm9CqA47EMYvQ7HQLPDZAbP56WK84yJLktoXMmnkaKeTtvER0dh4ufyjJHBhecnEranbR5rHc_jV8_qvyWhlqbCrOU_8bWrk.a9SH_q3GKIUsOUSRWkDxQg";
|
||||
} ];
|
||||
tls = {
|
||||
cipherSuites = [
|
||||
"TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256"
|
||||
"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256"
|
||||
];
|
||||
minVersion = 1.2;
|
||||
maxVersion = 1.3;
|
||||
renegotiation = false;
|
||||
};
|
||||
};
|
||||
};
|
||||
address = (builtins.elemAt config.networking.interfaces.ens18.ipv4.addresses 0).address;
|
||||
root_ca = pkgs.writeText "root_ca.crt" (builtins.readFile ../../ca/root_ca.crt);
|
||||
intermediate_ca = pkgs.writeText "intermediate_ca.crt" (builtins.readFile ../../ca/intermediate_ca.crt);
|
||||
in
|
||||
{
|
||||
age.secrets.acme_password = {
|
||||
file = ../../secrets/acme_password.age;
|
||||
};
|
||||
age.secrets.intermediate_ca_key = {
|
||||
file = ../../secrets/ca/intermediate_key.age;
|
||||
};
|
||||
age.secrets.root_ca_key.file = ../../secrets/ca/root_key.age;
|
||||
systemd.services.step-ca.serviceConfig.Environment = lib.mkForce [ "STEPDEBUG=1" "HOME=%S/step-ca" ];
|
||||
services.step-ca = {
|
||||
inherit address;
|
||||
enable = false;
|
||||
intermediatePasswordFile = config.age.secrets.acme_password.path;
|
||||
openFirewall = true;
|
||||
port = 8443;
|
||||
settings = {
|
||||
root = root_ca;
|
||||
federatedRoots = null;
|
||||
cert = intermediate_ca;
|
||||
key = config.age.secrets.intermediate_ca_key.path;
|
||||
dnsNames = [
|
||||
"10.42.1.5"
|
||||
"acme.thehellings.lan"
|
||||
];
|
||||
logger.format = "text";
|
||||
db = {
|
||||
type = "badgerv2";
|
||||
dataSource = "/var/lib/step-ca/db";
|
||||
badgerFileLoadingMode = "";
|
||||
};
|
||||
authority.provisioners = [{
|
||||
type = "JWK";
|
||||
name = "greg@thehellings.com";
|
||||
key = {
|
||||
use = "sig";
|
||||
kty = "EC";
|
||||
kid = "1GOpOttYLZtx7XiG79ZycbGcG4ptL0czfohK35SZOEI";
|
||||
crv = "P-256";
|
||||
alg = "ES256";
|
||||
x = "YEWVj5CCoqWQXWqmL0UuORlFY9IEOLcg1jpG1o-wGx4";
|
||||
y = "MEpqnJp60VV-SpFtb6m8U-VAYut7R_PKFm07xl7MjBk";
|
||||
};
|
||||
encryptedKey = "eyJhbGciOiJQQkVTMi1IUzI1NitBMTI4S1ciLCJjdHkiOiJqd2sranNvbiIsImVuYyI6IkEyNTZHQ00iLCJwMmMiOjYwMDAwMCwicDJzIjoieWdfb0lfbWgwbHhPRXdjUTBsd0FnUSJ9.ivdQUFEhs2U8PUBYr8AhQl3hHdb4spF4jvXgqY_hiVgpjB-z3Nn9Uw.u7vrNht_3WD1G97q.mbydlpAQxjtKLkOmmDOUczqscRDPqrUyoPJ1uqXcJDH3vs4KiYlrKRcFLjPy9sWzEL1iIrqjwf3U-3AAx1KNAg7frs2D__MGfOO-U5SdQDVJVAND7KpWOJGJVSb0xioCA6-8ldlP_REqu4ENmkkdw0_6Is2b0p7ZFKqke_fqOOs7osqFAfbMb_WzEWrACLn5A5-Teh2rpEgR-z9zipN6MSEqE6VIQ2BXuv70aHWhslNe1MK1OgTYm9CqA47EMYvQ7HQLPDZAbP56WK84yJLktoXMmnkaKeTtvER0dh4ufyjJHBhecnEranbR5rHc_jV8_qvyWhlqbCrOU_8bWrk.a9SH_q3GKIUsOUSRWkDxQg";
|
||||
}];
|
||||
tls = {
|
||||
cipherSuites = [
|
||||
"TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256"
|
||||
"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256"
|
||||
];
|
||||
minVersion = 1.2;
|
||||
maxVersion = 1.3;
|
||||
renegotiation = false;
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
|
||||
+37
-37
@@ -5,43 +5,43 @@
|
||||
{ config, pkgs, ... }:
|
||||
|
||||
{
|
||||
imports = [
|
||||
# Include the results of the hardware scan.
|
||||
./acme.nix
|
||||
./hardware-configuration.nix
|
||||
./home-assistant.nix
|
||||
./networking.nix
|
||||
];
|
||||
|
||||
greg.home = true;
|
||||
greg.gnome.enable = false;
|
||||
|
||||
# Bootloader.
|
||||
boot.loader.grub = {
|
||||
enable = true;
|
||||
device = "/dev/vda";
|
||||
useOSProber = true;
|
||||
};
|
||||
imports = [
|
||||
# Include the results of the hardware scan.
|
||||
./acme.nix
|
||||
./hardware-configuration.nix
|
||||
./home-assistant.nix
|
||||
./networking.nix
|
||||
];
|
||||
|
||||
#boot.loader = {
|
||||
# systemd-boot.enable = true;
|
||||
# efi = {
|
||||
# canTouchEfiVariables = true;
|
||||
# efiSysMountPoint = "/boot/efi";
|
||||
# };
|
||||
#};
|
||||
|
||||
networking.hostName = "genesis"; # Define your hostname.
|
||||
environment.systemPackages = with pkgs; [
|
||||
awscli2
|
||||
create_ssl
|
||||
step-ca
|
||||
];
|
||||
greg.home = true;
|
||||
greg.gnome.enable = false;
|
||||
|
||||
virtualisation.oci-containers.containers.speedtest = {
|
||||
image = "ghcr.io/librespeed/speedtest";
|
||||
hostname = "speedtest";
|
||||
ports = [ "19472:80" ];
|
||||
};
|
||||
greg.proxies."speedtest.thehellings.lan".target = "http://localhost:19472";
|
||||
# Bootloader.
|
||||
boot.loader.grub = {
|
||||
enable = true;
|
||||
device = "/dev/vda";
|
||||
useOSProber = true;
|
||||
};
|
||||
|
||||
#boot.loader = {
|
||||
# systemd-boot.enable = true;
|
||||
# efi = {
|
||||
# canTouchEfiVariables = true;
|
||||
# efiSysMountPoint = "/boot/efi";
|
||||
# };
|
||||
#};
|
||||
|
||||
networking.hostName = "genesis"; # Define your hostname.
|
||||
environment.systemPackages = with pkgs; [
|
||||
awscli2
|
||||
create_ssl
|
||||
step-ca
|
||||
];
|
||||
|
||||
virtualisation.oci-containers.containers.speedtest = {
|
||||
image = "ghcr.io/librespeed/speedtest";
|
||||
hostname = "speedtest";
|
||||
ports = [ "19472:80" ];
|
||||
};
|
||||
greg.proxies."speedtest.thehellings.lan".target = "http://localhost:19472";
|
||||
}
|
||||
|
||||
@@ -5,7 +5,8 @@
|
||||
|
||||
{
|
||||
imports =
|
||||
[ (modulesPath + "/profiles/qemu-guest.nix")
|
||||
[
|
||||
(modulesPath + "/profiles/qemu-guest.nix")
|
||||
];
|
||||
|
||||
boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "sr_mod" "virtio_blk" ];
|
||||
@@ -14,13 +15,13 @@
|
||||
boot.extraModulePackages = [ ];
|
||||
|
||||
fileSystems."/" =
|
||||
{ device = "/dev/disk/by-uuid/a13f941e-4985-47ab-a8c6-374a627c5ce1";
|
||||
{
|
||||
device = "/dev/disk/by-uuid/a13f941e-4985-47ab-a8c6-374a627c5ce1";
|
||||
fsType = "ext4";
|
||||
};
|
||||
|
||||
swapDevices =
|
||||
[ { device = "/dev/disk/by-uuid/ac4557de-1ad5-4d3c-b9f4-5ec50dbf76f1"; }
|
||||
];
|
||||
[{ device = "/dev/disk/by-uuid/ac4557de-1ad5-4d3c-b9f4-5ec50dbf76f1"; }];
|
||||
|
||||
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
|
||||
# (the default) this is the recommended approach. When using systemd-networkd it's
|
||||
|
||||
+118
-117
@@ -1,135 +1,136 @@
|
||||
{ config, pkgs, ... }:
|
||||
|
||||
let
|
||||
service_list = [ "podman-home-assistant.service" ];
|
||||
service_list = [ "podman-home-assistant.service" ];
|
||||
in
|
||||
{
|
||||
virtualisation.podman.enable = true;
|
||||
virtualisation.podman.enable = true;
|
||||
|
||||
services.home-assistant = {
|
||||
enable = true;
|
||||
configDir = "/var/lib/hass";
|
||||
extraComponents = [
|
||||
"accuweather"
|
||||
"calendar"
|
||||
"cast"
|
||||
"eufy"
|
||||
"lovelace"
|
||||
"nextcloud"
|
||||
"ping"
|
||||
"piper"
|
||||
"radio_browser"
|
||||
"rainbird"
|
||||
"roborock"
|
||||
"smart_meter_texas"
|
||||
"speedtestdotnet"
|
||||
"solaredge"
|
||||
"whisper"
|
||||
"wiz"
|
||||
"wyoming"
|
||||
"zwave_js"
|
||||
];
|
||||
customComponents = with pkgs.home-assistant-custom-components; [
|
||||
smartthinq-sensors
|
||||
];
|
||||
services.home-assistant = {
|
||||
enable = true;
|
||||
configDir = "/var/lib/hass";
|
||||
extraComponents = [
|
||||
"accuweather"
|
||||
"calendar"
|
||||
"cast"
|
||||
"eufy"
|
||||
"lovelace"
|
||||
"nextcloud"
|
||||
"ping"
|
||||
"piper"
|
||||
"radio_browser"
|
||||
"rainbird"
|
||||
"roborock"
|
||||
"smart_meter_texas"
|
||||
"speedtestdotnet"
|
||||
"solaredge"
|
||||
"whisper"
|
||||
"wiz"
|
||||
"wyoming"
|
||||
"zwave_js"
|
||||
];
|
||||
customComponents = with pkgs.home-assistant-custom-components; [
|
||||
smartthinq-sensors
|
||||
];
|
||||
|
||||
config = {
|
||||
default_config = {};
|
||||
tts = [ { platform = "google_translate"; } ];
|
||||
http = {
|
||||
use_x_forwarded_for = true;
|
||||
trusted_proxies = [ "127.0.0.1" "::1" ];
|
||||
server_host = "127.0.0.1";
|
||||
};
|
||||
#"automation manual" = *nix config here* and so on
|
||||
"automation ui" = "!include automations.yaml";
|
||||
"script ui" = "!include scripts.yaml";
|
||||
"scene ui" = "!include scenes.yaml";
|
||||
};
|
||||
};
|
||||
config = {
|
||||
default_config = { };
|
||||
tts = [{ platform = "google_translate"; }];
|
||||
http = {
|
||||
use_x_forwarded_for = true;
|
||||
trusted_proxies = [ "127.0.0.1" "::1" ];
|
||||
server_host = "127.0.0.1";
|
||||
};
|
||||
#"automation manual" = *nix config here* and so on
|
||||
"automation ui" = "!include automations.yaml";
|
||||
"script ui" = "!include scripts.yaml";
|
||||
"scene ui" = "!include scenes.yaml";
|
||||
};
|
||||
};
|
||||
|
||||
# Helps with Voice stuff for Home Assistant
|
||||
services.wyoming = {
|
||||
faster-whisper.servers = {
|
||||
greg = {
|
||||
enable = true;
|
||||
beamSize = 1; # wut?
|
||||
device = "auto"; # Could be CPU or CUDA
|
||||
language = "en";
|
||||
model = "base-int8";
|
||||
uri = "tcp://0.0.0.0:13415";
|
||||
};
|
||||
};
|
||||
piper.servers.greg = {
|
||||
enable = true;
|
||||
uri = "tcp://0.0.0.0:13416";
|
||||
voice = "en_US-amy-medium";
|
||||
};
|
||||
};
|
||||
# Helps with Voice stuff for Home Assistant
|
||||
services.wyoming = {
|
||||
faster-whisper.servers = {
|
||||
greg = {
|
||||
enable = true;
|
||||
beamSize = 1; # wut?
|
||||
device = "auto"; # Could be CPU or CUDA
|
||||
language = "en";
|
||||
model = "base-int8";
|
||||
uri = "tcp://0.0.0.0:13415";
|
||||
};
|
||||
};
|
||||
piper.servers.greg = {
|
||||
enable = true;
|
||||
uri = "tcp://0.0.0.0:13416";
|
||||
voice = "en_US-amy-medium";
|
||||
};
|
||||
};
|
||||
|
||||
# Although NixOS has a package for Home Assistant, it is not kept as up to date as the container and the upstream
|
||||
# is very vocal about only supporting their own container or the HAOS deployments. So we deploy the container here
|
||||
# and avoid any potential messes from that
|
||||
virtualisation.oci-containers = {
|
||||
backend = "podman";
|
||||
# Although NixOS has a package for Home Assistant, it is not kept as up to date as the container and the upstream
|
||||
# is very vocal about only supporting their own container or the HAOS deployments. So we deploy the container here
|
||||
# and avoid any potential messes from that
|
||||
virtualisation.oci-containers = {
|
||||
backend = "podman";
|
||||
|
||||
# I have ZWave devices. The easiest way to connect to them is the zwavejs2mqtt service running, so we spin up
|
||||
# its container and map the ZWave device into it
|
||||
containers.zwave = {
|
||||
autoStart = false; # We will try to start it with udev.extraRules listed below, as this option starts it too quickly
|
||||
image = "zwavejs/zwave-js-ui:latest";
|
||||
ports = [ "8091:8091" "3000:3000" ];
|
||||
volumes = [ "/var/lib/zwave:/usr/src/app/store" ];
|
||||
extraOptions = [
|
||||
"--device" "/dev/serial/by-id/usb-0658_0200-if00:/dev/zwave"
|
||||
"--pull=newer"
|
||||
];
|
||||
environment = {
|
||||
TZ = "America/Chicago";
|
||||
CONSOLE_OUTPUT = "true";
|
||||
};
|
||||
};
|
||||
};
|
||||
# I have ZWave devices. The easiest way to connect to them is the zwavejs2mqtt service running, so we spin up
|
||||
# its container and map the ZWave device into it
|
||||
containers.zwave = {
|
||||
autoStart = false; # We will try to start it with udev.extraRules listed below, as this option starts it too quickly
|
||||
image = "zwavejs/zwave-js-ui:latest";
|
||||
ports = [ "8091:8091" "3000:3000" ];
|
||||
volumes = [ "/var/lib/zwave:/usr/src/app/store" ];
|
||||
extraOptions = [
|
||||
"--device"
|
||||
"/dev/serial/by-id/usb-0658_0200-if00:/dev/zwave"
|
||||
"--pull=newer"
|
||||
];
|
||||
environment = {
|
||||
TZ = "America/Chicago";
|
||||
CONSOLE_OUTPUT = "true";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
# Both of the above container need storage for their configuration and devices, but it is not created correctly by
|
||||
# the container. So we add the creation of /var/lib/{zwave,hass} to the systemd Unit files
|
||||
systemd.services = {
|
||||
"podman-zwave" = {
|
||||
after = [ "sys-devices-pci0000:00-0000:00:1e.0-0000:02:1b.0-usb2-2\\x2d1-2\\x2d1:1.0-tty-ttyACM0.device" ];
|
||||
wantedBy = [ "sys-devices-pci0000:00-0000:00:1e.0-0000:02:1b.0-usb2-2\\x2d1-2\\x2d1:1.0-tty-ttyACM0.device" ];
|
||||
serviceConfig = {
|
||||
StateDirectory = "zwave";
|
||||
StateDirectoryMode = pkgs.lib.mkForce "0777";
|
||||
};
|
||||
};
|
||||
};
|
||||
# Both of the above container need storage for their configuration and devices, but it is not created correctly by
|
||||
# the container. So we add the creation of /var/lib/{zwave,hass} to the systemd Unit files
|
||||
systemd.services = {
|
||||
"podman-zwave" = {
|
||||
after = [ "sys-devices-pci0000:00-0000:00:1e.0-0000:02:1b.0-usb2-2\\x2d1-2\\x2d1:1.0-tty-ttyACM0.device" ];
|
||||
wantedBy = [ "sys-devices-pci0000:00-0000:00:1e.0-0000:02:1b.0-usb2-2\\x2d1-2\\x2d1:1.0-tty-ttyACM0.device" ];
|
||||
serviceConfig = {
|
||||
StateDirectory = "zwave";
|
||||
StateDirectoryMode = pkgs.lib.mkForce "0777";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
services.udev.extraRules = ''
|
||||
SUBSYSTEM=="tty", KERNEL=="ttyACM0", TAG+="systemd"
|
||||
'';
|
||||
services.udev.extraRules = ''
|
||||
SUBSYSTEM=="tty", KERNEL=="ttyACM0", TAG+="systemd"
|
||||
'';
|
||||
|
||||
|
||||
greg.proxies = {
|
||||
"smart.home".target = "http://127.0.0.1:8123/";
|
||||
"smart.thehellings.lan".target = "http://127.0.0.1:8123/";
|
||||
"zwave.home".target = "http://127.0.0.1:8091/";
|
||||
};
|
||||
greg.proxies = {
|
||||
"smart.home".target = "http://127.0.0.1:8123/";
|
||||
"smart.thehellings.lan".target = "http://127.0.0.1:8123/";
|
||||
"zwave.home".target = "http://127.0.0.1:8091/";
|
||||
};
|
||||
|
||||
# Ensure that both ports are up and running. We keep 8123 directly open because we are on the LAN and sometimes want to connect
|
||||
# directly for troubleshooting Nginx configuration
|
||||
networking.firewall = {
|
||||
allowedTCPPorts = [ 80 443 ];
|
||||
};
|
||||
# Ensure that both ports are up and running. We keep 8123 directly open because we are on the LAN and sometimes want to connect
|
||||
# directly for troubleshooting Nginx configuration
|
||||
networking.firewall = {
|
||||
allowedTCPPorts = [ 80 443 ];
|
||||
};
|
||||
|
||||
greg.backup.jobs.zwave = {
|
||||
src = "/var/lib/zwave";
|
||||
dest = "zwave";
|
||||
id = "zwave-asdf";
|
||||
};
|
||||
greg.backup.jobs.zwave = {
|
||||
src = "/var/lib/zwave";
|
||||
dest = "zwave";
|
||||
id = "zwave-asdf";
|
||||
};
|
||||
|
||||
greg.backup.jobs.hass-backup = {
|
||||
src = "/var/lib/hass";
|
||||
dest = "hass";
|
||||
id = "hass-asdf";
|
||||
};
|
||||
greg.backup.jobs.hass-backup = {
|
||||
src = "/var/lib/hass";
|
||||
dest = "hass";
|
||||
id = "hass-asdf";
|
||||
};
|
||||
}
|
||||
|
||||
+174
-173
@@ -1,191 +1,192 @@
|
||||
{ pkgs, config, ... }:
|
||||
let
|
||||
lan = "ens18";
|
||||
lanIP = "10.42.1.5";
|
||||
iot = "ens19";
|
||||
iotIP = "192.168.66.250";
|
||||
routerIP = "10.42.1.2";
|
||||
extraHosts = builtins.readFile ./net/hosts;
|
||||
lan = "ens18";
|
||||
lanIP = "10.42.1.5";
|
||||
iot = "ens19";
|
||||
iotIP = "192.168.66.250";
|
||||
routerIP = "10.42.1.2";
|
||||
extraHosts = builtins.readFile ./net/hosts;
|
||||
|
||||
adblockUpdate = pkgs.writeShellScriptBin "adblockUpdate" (builtins.readFile ./adblockUpdate.sh);
|
||||
proxyPort = 3128;
|
||||
dnsPort = 53;
|
||||
dhcpPort = 67;
|
||||
dnsServers = [
|
||||
"9.9.9.9" # Quad 9
|
||||
"1.1.1.1" # Cloudflare
|
||||
"1.0.0.1" # Cloudflare
|
||||
"149.112.112.112" # Quad 9
|
||||
];
|
||||
in {
|
||||
greg.tailscale.enable = true;
|
||||
adblockUpdate = pkgs.writeShellScriptBin "adblockUpdate" (builtins.readFile ./adblockUpdate.sh);
|
||||
proxyPort = 3128;
|
||||
dnsPort = 53;
|
||||
dhcpPort = 67;
|
||||
dnsServers = [
|
||||
"9.9.9.9" # Quad 9
|
||||
"1.1.1.1" # Cloudflare
|
||||
"1.0.0.1" # Cloudflare
|
||||
"149.112.112.112" # Quad 9
|
||||
];
|
||||
in
|
||||
{
|
||||
greg.tailscale.enable = true;
|
||||
|
||||
# Really, why do I still have to force-disable this crap?
|
||||
boot.kernel.sysctl = {
|
||||
"net.ipv6.conf.${lan}.disable_ipv6" = true;
|
||||
"net.ipv6.conf.${iot}.disable_ipv6" = true;
|
||||
"net.ipv6.conf.lo.disable_ipv6" = true;
|
||||
};
|
||||
# Really, why do I still have to force-disable this crap?
|
||||
boot.kernel.sysctl = {
|
||||
"net.ipv6.conf.${lan}.disable_ipv6" = true;
|
||||
"net.ipv6.conf.${iot}.disable_ipv6" = true;
|
||||
"net.ipv6.conf.lo.disable_ipv6" = true;
|
||||
};
|
||||
|
||||
networking = {
|
||||
enableIPv6 = false;
|
||||
networkmanager.enable = pkgs.lib.mkForce false;
|
||||
defaultGateway = routerIP;
|
||||
nameservers = dnsServers;
|
||||
interfaces = {
|
||||
# This is our LAN port
|
||||
"${lan}" = {
|
||||
useDHCP = false;
|
||||
ipv4.addresses = [ {
|
||||
address = "${lanIP}";
|
||||
prefixLength = 16;
|
||||
} ];
|
||||
};
|
||||
networking = {
|
||||
enableIPv6 = false;
|
||||
networkmanager.enable = pkgs.lib.mkForce false;
|
||||
defaultGateway = routerIP;
|
||||
nameservers = dnsServers;
|
||||
interfaces = {
|
||||
# This is our LAN port
|
||||
"${lan}" = {
|
||||
useDHCP = false;
|
||||
ipv4.addresses = [{
|
||||
address = "${lanIP}";
|
||||
prefixLength = 16;
|
||||
}];
|
||||
};
|
||||
|
||||
"${iot}" = {
|
||||
useDHCP = false;
|
||||
ipv4.addresses = [ {
|
||||
address = "${iotIP}";
|
||||
prefixLength = 24;
|
||||
} ];
|
||||
};
|
||||
};
|
||||
firewall = {
|
||||
enable = false;
|
||||
allowedUDPPorts = [
|
||||
dhcpPort
|
||||
dnsPort
|
||||
1900 # Jellyfin auto-discovery
|
||||
7359 # Jellyfin auto-discovery
|
||||
];
|
||||
allowedTCPPorts = [
|
||||
dnsPort
|
||||
proxyPort
|
||||
80
|
||||
];
|
||||
};
|
||||
nftables.enable = false;
|
||||
};
|
||||
"${iot}" = {
|
||||
useDHCP = false;
|
||||
ipv4.addresses = [{
|
||||
address = "${iotIP}";
|
||||
prefixLength = 24;
|
||||
}];
|
||||
};
|
||||
};
|
||||
firewall = {
|
||||
enable = false;
|
||||
allowedUDPPorts = [
|
||||
dhcpPort
|
||||
dnsPort
|
||||
1900 # Jellyfin auto-discovery
|
||||
7359 # Jellyfin auto-discovery
|
||||
];
|
||||
allowedTCPPorts = [
|
||||
dnsPort
|
||||
proxyPort
|
||||
80
|
||||
];
|
||||
};
|
||||
nftables.enable = false;
|
||||
};
|
||||
|
||||
environment.etc."hosts.d/local".text = extraHosts;
|
||||
environment.etc."hosts.d/local".text = extraHosts;
|
||||
|
||||
fileSystems = {
|
||||
"/media" = {
|
||||
device = "10.42.1.4:/volume1/video/";
|
||||
fsType = "nfs";
|
||||
options = [ "ro" ];
|
||||
};
|
||||
};
|
||||
fileSystems = {
|
||||
"/media" = {
|
||||
device = "10.42.1.4:/volume1/video/";
|
||||
fsType = "nfs";
|
||||
options = [ "ro" ];
|
||||
};
|
||||
};
|
||||
|
||||
services = {
|
||||
# Video services
|
||||
jellyfin = {
|
||||
enable = true;
|
||||
openFirewall = true;
|
||||
};
|
||||
services = {
|
||||
# Video services
|
||||
jellyfin = {
|
||||
enable = true;
|
||||
openFirewall = true;
|
||||
};
|
||||
|
||||
#########
|
||||
# Blind service proxy behind the walls of the VPN
|
||||
########
|
||||
_3proxy = {
|
||||
enable = true;
|
||||
services = [ {
|
||||
type = "socks";
|
||||
auth = [ "strong" ];
|
||||
bindPort = proxyPort;
|
||||
acl = [ {
|
||||
rule = "allow";
|
||||
users = [ "greg" ];
|
||||
} ];
|
||||
} ];
|
||||
#usersFile = "/run/agenix/3proxy";
|
||||
denyPrivate = false;
|
||||
};
|
||||
#########
|
||||
# Blind service proxy behind the walls of the VPN
|
||||
########
|
||||
_3proxy = {
|
||||
enable = true;
|
||||
services = [{
|
||||
type = "socks";
|
||||
auth = [ "strong" ];
|
||||
bindPort = proxyPort;
|
||||
acl = [{
|
||||
rule = "allow";
|
||||
users = [ "greg" ];
|
||||
}];
|
||||
}];
|
||||
#usersFile = "/run/agenix/3proxy";
|
||||
denyPrivate = false;
|
||||
};
|
||||
|
||||
#########
|
||||
# dnsmasq config
|
||||
########
|
||||
dnsmasq = {
|
||||
enable = true;
|
||||
settings = {
|
||||
domain = "thehellings.lan";
|
||||
dhcp-range = [
|
||||
"${lan},10.42.2.1,10.42.2.255,255.255.0.0,12h"
|
||||
"${iot},192.168.66.3,192.168.66.150,255.255.255.0,12h"
|
||||
"vlan67@${lan},192.168.67.3,192.168.67.150,12h"
|
||||
];
|
||||
dhcp-option = [
|
||||
"${lan},option:router,${routerIP}"
|
||||
"${lan},option:dns-server,${lanIP},1.1.1.1"
|
||||
"${lan},option:domain-search,thehellings.lan"
|
||||
#########
|
||||
# dnsmasq config
|
||||
########
|
||||
dnsmasq = {
|
||||
enable = true;
|
||||
settings = {
|
||||
domain = "thehellings.lan";
|
||||
dhcp-range = [
|
||||
"${lan},10.42.2.1,10.42.2.255,255.255.0.0,12h"
|
||||
"${iot},192.168.66.3,192.168.66.150,255.255.255.0,12h"
|
||||
"vlan67@${lan},192.168.67.3,192.168.67.150,12h"
|
||||
];
|
||||
dhcp-option = [
|
||||
"${lan},option:router,${routerIP}"
|
||||
"${lan},option:dns-server,${lanIP},1.1.1.1"
|
||||
"${lan},option:domain-search,thehellings.lan"
|
||||
|
||||
"${iot},option:router,192.168.66.1"
|
||||
"${iot},option:dns-server,${iotIP}"
|
||||
"${iot},option:router,192.168.66.1"
|
||||
"${iot},option:dns-server,${iotIP}"
|
||||
|
||||
"vlan67@${lan},option:router,192.168.67.1"
|
||||
"vlan67@${lan},option:dns-server,192.168.67.1"
|
||||
];
|
||||
dhcp-host = [
|
||||
# Static IPs for personal work
|
||||
"2a:5d:23:10:4e:22,10.42.0.5" # SAN Switch
|
||||
"00:00:de:ad:be:ef,10.42.2.254"
|
||||
"01:a8:a1:59:c7:8a:12,10.42.2.253" # BMC management interface for isaiah
|
||||
"vlan67@${lan},option:router,192.168.67.1"
|
||||
"vlan67@${lan},option:dns-server,192.168.67.1"
|
||||
];
|
||||
dhcp-host = [
|
||||
# Static IPs for personal work
|
||||
"2a:5d:23:10:4e:22,10.42.0.5" # SAN Switch
|
||||
"00:00:de:ad:be:ef,10.42.2.254"
|
||||
"01:a8:a1:59:c7:8a:12,10.42.2.253" # BMC management interface for isaiah
|
||||
|
||||
# Static IPs for things in the IOT range
|
||||
"b4:b0:24:9a:02:4a,192.168.66.5" # LD125
|
||||
"98:da:c4:20:f3:64,192.168.66.6" # Dining room light
|
||||
"54:af:97:c1:dc:b9,192.168.66.25" # Master bedroom Kasa switch
|
||||
"f0:03:8c:b3:b0:f6,192.168.66.55" # Roomba
|
||||
"4c:a1:61:05:cd:52,192.168.66.61" # Rainbird
|
||||
"48:d6:d5:5d:81:21,192.168.66.65" # Google Home
|
||||
"6c:29:90:3e:e2:02,192.168.66.66" # wiz
|
||||
"28:87:ba:0e:ca:da,192.168.66.74" #
|
||||
"28:87:ba:0e:c9:fd,192.168.66.75" # Master closet
|
||||
"54:af:97:c2:0f:a1,192.168.66.76" # Master toilet
|
||||
"54:af:97:83:ed:33,192.168.66.80"
|
||||
"98:da:c4:77:80:18,192.168.66.84" # Kitchen lights
|
||||
"98:da:c4:21:1b:2e,192.168.66.85" # Living Room lights
|
||||
"0c:80:63:41:6e:0f,192.168.66.90" # Front porch
|
||||
"0c:80:63:41:6c:5d,192.168.66.98" # House number
|
||||
"ac:84:c6:5e:4b:28,192.168.66.100"
|
||||
"98:da:c4:77:7f:4d,192.168.66.102" # Office lights
|
||||
"8c:85:80:1c:f9:d1,192.168.66.104"
|
||||
"98:da:c4:77:82:7b,192.168.66.105" # Parlor lamp
|
||||
"0c:80:63:41:74:73,192.168.66.106" # Front hall light switch
|
||||
"98:da:c4:20:ea:db,192.168.66.107" # Parlor light switch
|
||||
"8c:49:62:aa:58:60,192.168.66.108" # Roku, HiHandsome
|
||||
"92:3e:11:c7:c5:be,192.168.66.109"
|
||||
"d8:0d:17:19:60:62,192.168.66.112"
|
||||
"b4:b0:24:9a:12:53,192.168.66.130" # KL125
|
||||
"b4:b0:24:9a:14:0e,192.168.66.131"
|
||||
"e4:f0:42:61:fa:b5,192.168.66.149" # Google Home-mini
|
||||
];
|
||||
expand-hosts = true;
|
||||
log-dhcp = true;
|
||||
log-queries = true;
|
||||
no-hosts = true; # Do not read /etc/hosts, which makes genesis resolve to 127.0.0.2
|
||||
addn-hosts = "/etc/adblock_hosts";
|
||||
hostsdir = "/etc/hosts.d/";
|
||||
server = dnsServers;
|
||||
};
|
||||
};
|
||||
# Static IPs for things in the IOT range
|
||||
"b4:b0:24:9a:02:4a,192.168.66.5" # LD125
|
||||
"98:da:c4:20:f3:64,192.168.66.6" # Dining room light
|
||||
"54:af:97:c1:dc:b9,192.168.66.25" # Master bedroom Kasa switch
|
||||
"f0:03:8c:b3:b0:f6,192.168.66.55" # Roomba
|
||||
"4c:a1:61:05:cd:52,192.168.66.61" # Rainbird
|
||||
"48:d6:d5:5d:81:21,192.168.66.65" # Google Home
|
||||
"6c:29:90:3e:e2:02,192.168.66.66" # wiz
|
||||
"28:87:ba:0e:ca:da,192.168.66.74" #
|
||||
"28:87:ba:0e:c9:fd,192.168.66.75" # Master closet
|
||||
"54:af:97:c2:0f:a1,192.168.66.76" # Master toilet
|
||||
"54:af:97:83:ed:33,192.168.66.80"
|
||||
"98:da:c4:77:80:18,192.168.66.84" # Kitchen lights
|
||||
"98:da:c4:21:1b:2e,192.168.66.85" # Living Room lights
|
||||
"0c:80:63:41:6e:0f,192.168.66.90" # Front porch
|
||||
"0c:80:63:41:6c:5d,192.168.66.98" # House number
|
||||
"ac:84:c6:5e:4b:28,192.168.66.100"
|
||||
"98:da:c4:77:7f:4d,192.168.66.102" # Office lights
|
||||
"8c:85:80:1c:f9:d1,192.168.66.104"
|
||||
"98:da:c4:77:82:7b,192.168.66.105" # Parlor lamp
|
||||
"0c:80:63:41:74:73,192.168.66.106" # Front hall light switch
|
||||
"98:da:c4:20:ea:db,192.168.66.107" # Parlor light switch
|
||||
"8c:49:62:aa:58:60,192.168.66.108" # Roku, HiHandsome
|
||||
"92:3e:11:c7:c5:be,192.168.66.109"
|
||||
"d8:0d:17:19:60:62,192.168.66.112"
|
||||
"b4:b0:24:9a:12:53,192.168.66.130" # KL125
|
||||
"b4:b0:24:9a:14:0e,192.168.66.131"
|
||||
"e4:f0:42:61:fa:b5,192.168.66.149" # Google Home-mini
|
||||
];
|
||||
expand-hosts = true;
|
||||
log-dhcp = true;
|
||||
log-queries = true;
|
||||
no-hosts = true; # Do not read /etc/hosts, which makes genesis resolve to 127.0.0.2
|
||||
addn-hosts = "/etc/adblock_hosts";
|
||||
hostsdir = "/etc/hosts.d/";
|
||||
server = dnsServers;
|
||||
};
|
||||
};
|
||||
|
||||
# Update adblock list
|
||||
cron = {
|
||||
enable = true;
|
||||
systemCronJobs = [
|
||||
"* * * * * root ${adblockUpdate} 2>&1 > /var/log/adblock.log"
|
||||
];
|
||||
};
|
||||
}; # End of services configuration
|
||||
# Update adblock list
|
||||
cron = {
|
||||
enable = true;
|
||||
systemCronJobs = [
|
||||
"* * * * * root ${adblockUpdate} 2>&1 > /var/log/adblock.log"
|
||||
];
|
||||
};
|
||||
}; # End of services configuration
|
||||
|
||||
greg.proxies = {
|
||||
"jellyfin.home".target = "http://localhost:8096/";
|
||||
};
|
||||
greg.proxies = {
|
||||
"jellyfin.home".target = "http://localhost:8096/";
|
||||
};
|
||||
|
||||
environment.systemPackages = with pkgs; [
|
||||
bind
|
||||
curl # Used by dnsmasq fetching
|
||||
sqlite
|
||||
];
|
||||
environment.systemPackages = with pkgs; [
|
||||
bind
|
||||
curl # Used by dnsmasq fetching
|
||||
sqlite
|
||||
];
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user