greg/nixos
1
0
Fork 1
Code Issues Pull Requests 2 Actions Packages Projects Releases Wiki Activity

Completely reformat to satisfy nixfmt

Browse Source
This commit is contained in:
Greg Hellings
2024-10-19 01:20:46 -05:00
parent 7abb613f20
commit a71eb7485a
56 changed files with 1749 additions and 1393 deletions
Download Patch File Download Diff File Expand all files Collapse all files
ceph/home.nix
+8 -4
View File
@@ -1,7 +1,8 @@
{
fsid = "749bf0ea-acf5-4a5e-b33e-9a057455c06b";
clusterName = "home";
initialMonitors = [{
initialMonitors = [
{
hostname = "myself.thehellings.lan";
ipAddress = "10.42.1.6";
}
@@ -12,11 +13,14 @@
{
hostname = "hosea.thehellings.lan";
ipAddress = "10.42.1.7";
}];
mdsNodes = [{
}
];
mdsNodes = [
{
hostname = "jeremiah.thehellings.lan";
ipAddress = "10.42.1.8";
}];
}
];
publicNetworks = [ "10.42.0.0/16" ];
clusterNetworks = [ "10.201.0.0/16" ];
adminKeyring = ../secrets/home.client.admin.keyring;
hardware-configuration.nix
+16 -10
View File
@@ -1,28 +1,34 @@
# Do not modify this file! It was generated by ‘nixos-generate-config’
# and may be overwritten by future invocations. Please make changes
# to /etc/nixos/configuration.nix instead.
{ config, lib, modulesPath, ... }:
{
config,
lib,
modulesPath,
...
}:
{
imports =
[
(modulesPath + "/installer/scan/not-detected.nix")
];
imports = [ (modulesPath + "/installer/scan/not-detected.nix") ];
boot.initrd.availableKernelModules = [ "xhci_pci" "thunderbolt" "nvme" "uas" "sd_mod" ];
boot.initrd.availableKernelModules = [
"xhci_pci"
"thunderbolt"
"nvme"
"uas"
"sd_mod"
];
boot.initrd.kernelModules = [ ];
boot.kernelModules = [ "kvm-intel" ];
boot.extraModulePackages = [ ];
fileSystems."/" =
{
fileSystems."/" = {
device = "/dev/disk/by-uuid/607b933f-2967-4652-b478-4d8e9aa38a0d";
fsType = "btrfs";
options = [ "subvol=@" ];
};
fileSystems."/boot" =
{
fileSystems."/boot" = {
device = "/dev/disk/by-uuid/B31C-C1F4";
fsType = "vfat";
};
home/home.nix
+7 -9
View File
@@ -1,8 +1,9 @@
{ pkgs
, lib
, host ? "most"
, nixvim
, ...
{
pkgs,
lib,
host ? "most",
nixvim,
...
}:
{
@@ -12,15 +13,12 @@
./modules
] ++ lib.optionals (builtins.pathExists ./hosts/${host}) [ ./hosts/${host} ];
programs.tmux = {
enable = true;
keyMode = "vi";
terminal = "xterm-256color";
customPaneNavigationAndResize = true;
extraConfig = (lib.strings.concatStringsSep "\n" [
"bind P paste-buffer"
]);
extraConfig = (lib.strings.concatStringsSep "\n" [ "bind P paste-buffer" ]);
};
home.stateVersion = "23.05";
home/hosts/icdm-root/default.nix
+2 -1
View File
@@ -1,3 +1,4 @@
{ ... }:
{ }
{
}
home/hosts/work/default.nix
+1 -3
View File
@@ -3,7 +3,5 @@
{
greg.vscodium.enable = true;
home.packages = with pkgs; [
brew
];
home.packages = with pkgs; [ brew ];
}
home/modules/baseline/ssh.nix
+11 -6
View File
@@ -15,16 +15,18 @@
matchBlocks =
let
nas = { user = "admin"; };
owned = { user = "greg"; };
nas = {
user = "admin";
};
owned = {
user = "greg";
};
in
{
inherit nas;
"*" = {
dynamicForwards = [{
port = 10240;
}];
dynamicForwards = [ { port = 10240; } ];
};
"10.42.1.4" = lib.hm.dag.entryBefore [ "10.42.*" ] nas;
@@ -33,7 +35,10 @@
chronicles = nas;
"chronicles.thehellings.lan" = lib.hm.dag.entryBefore [ "*.thehellings.lan" ] nas;
gh = { user = "git"; hostname = "github.com"; };
gh = {
user = "git";
hostname = "github.com";
};
"src" = {
user = "gitlab";
hostname = "git.thehellings.lan";
home/modules/baseline/vim.nix
+9 -2
View File
@@ -1,9 +1,16 @@
{ config, pkgs, lib, ... }:
{
config,
pkgs,
lib,
...
}:
{
# The Hack font is used in the Fugitive sidebars
fonts.fontconfig.enable = true;
home.packages = [ (pkgs.nerdfonts.override { fonts = [ "Hack" ]; }) ];
programs.nixvim = (import ./vim/config.nix { inherit config pkgs lib; }) // { enable = true; };
programs.nixvim = (import ./vim/config.nix { inherit config pkgs lib; }) // {
enable = true;
};
}
home/modules/baseline/xonsh.nix
+3 -1
View File
@@ -67,7 +67,9 @@
};
configHeader = builtins.readFile ./xonsh_header.xsh;
configFooter = (builtins.readFile ./xonsh_footer.xsh) + (builtins.concatStringsSep "\n" [
configFooter =
(builtins.readFile ./xonsh_footer.xsh)
+ (builtins.concatStringsSep "\n" [
"with open('${pkgs.stdenv.cc}/nix-support/dynamic-linker', 'r') as fp:"
" $NIX_LD = fp.read().strip()"
]);
home/modules/development.nix
+9 -5
View File
@@ -1,4 +1,9 @@
{ config, pkgs, lib, ... }:
{
config,
pkgs,
lib,
...
}:
let
packages = with pkgs; [
bruno # but let's not talk about it
@@ -16,10 +21,9 @@ let
zed-editor
];
in
with lib; {
with lib;
{
options.greg.development = mkEnableOption "Setup necessary development packages";
config = mkIf config.greg.development {
home.packages = packages;
};
config = mkIf config.greg.development { home.packages = packages; };
}
home/modules/gnome.nix
+18 -5
View File
@@ -1,4 +1,9 @@
{ config, pkgs, lib, ... }:
{
config,
pkgs,
lib,
...
}:
let
cfg = config.greg.gnome;
@@ -6,7 +11,8 @@ in
{
options.greg.gnome = lib.mkEnableOption "Enable Gnome support and settings";
config = (lib.mkIf cfg {
config = (
lib.mkIf cfg {
programs.gnome-terminal = lib.mkIf (pkgs.system != "x86_64-darwin") {
enable = true;
showMenubar = true;
@@ -112,9 +118,16 @@ in
show-toolbar = true;
};
"org/virt-manager/virt-manager/connections" = {
autoconnect = [ "qemu:///session" "qemu:///system" ];
uris = [ "qemu:///session" "qemu:///system" ];
autoconnect = [
"qemu:///session"
"qemu:///system"
];
uris = [
"qemu:///session"
"qemu:///system"
];
};
};
});
}
);
}
home/modules/python.nix
+6 -1
View File
@@ -1,4 +1,9 @@
{ config, pkgs, lib, ... }:
{
config,
pkgs,
lib,
...
}:
{
options.greg.pypackage = lib.mkOption {
description = "Enable Gnome support and settings";
home/modules/sway.nix
+19 -10
View File
@@ -1,4 +1,9 @@
{ config, pkgs, lib, ... }:
{
config,
pkgs,
lib,
...
}:
let
cfg = config.greg.sway;
@@ -9,7 +14,8 @@ let
term = "${pkgs.alacritty}/bin/alacritty";
msg = "${pkgs.sway}/bin/swaymsg";
sleep = "${pkgs.coreutils}/bin/sleep";
workstation1 = pkgs.writeScriptBin "workstation1" (builtins.concatStringsSep "\n" [
workstation1 = pkgs.writeScriptBin "workstation1" (
builtins.concatStringsSep "\n" [
"${msg} \"workspace 1 ; exec ${pkgs.firefox}/bin/firefox ; split horizontal ; exec ${pkgs.element-desktop}/bin/element-desktop \""
"${sleep} 1"
"${msg} '[app_id=\"firefox\"]' move left"
@@ -18,16 +24,20 @@ let
"${sleep} 0.3"
"${msg} '[app_id=\"Alacritty\" workspace=\"1\"]' move right"
"${msg} '[app_id=\"firefox\"]' resize grow width 300 px"
]);
workstation2 = pkgs.writeScriptBin "workstation2" (builtins.concatStringsSep "\n" [
]
);
workstation2 = pkgs.writeScriptBin "workstation2" (
builtins.concatStringsSep "\n" [
"${sleep} 5"
"${msg} \"workspace 2 ; exec ${term} ; layout tabbed\""
]);
]
);
in
{
options.greg.sway = lib.mkEnableOption "Enable Sway support and settings";
config = (lib.mkIf cfg {
config = (
lib.mkIf cfg {
programs.swaylock.enable = true;
wayland.windowManager.sway =
@@ -64,9 +74,7 @@ in
{ command = "${workstation2}/bin/workstation2"; }
];
};
extraOptions = [
"--unsupported-gpu"
];
extraOptions = [ "--unsupported-gpu" ];
extraSessionCommands = ''
export WLR_NO_HARDWARE_CURSORS=1
'';
@@ -102,5 +110,6 @@ in
xorg.xmodmap
xxdiff
];
});
}
);
}
home/modules/xonsh.nix
+12 -12
View File
@@ -4,7 +4,8 @@ let
cfg = config.programs.xonsh;
in
with lib; {
with lib;
{
options = {
programs.xonsh = {
enable = mkEnableOption "Enable the xonsh program";
@@ -12,7 +13,9 @@ with lib; {
sessionVariables = mkOption {
type = types.attrs;
default = { };
example = { XONSH_TRACE_SUBPROC = true; };
example = {
XONSH_TRACE_SUBPROC = true;
};
description = ''
Environment variables that will be set for the Xonsh session.
'';
@@ -59,29 +62,26 @@ with lib; {
config =
let
shortAliases = concatStringsSep "\n" (
mapAttrsToList (k: v: "aliases['${k}']=r'${v}'") cfg.aliases
);
shortAliases = concatStringsSep "\n" (mapAttrsToList (k: v: "aliases['${k}']=r'${v}'") cfg.aliases);
listToPythonList =
let
listInternals = args:
concatStringsSep "\n" (map (v: "'${v}'") args);
listInternals = args: concatStringsSep "\n" (map (v: "'${v}'") args);
in
list: "[${listInternals list}]";
sessionVars = concatStringsSep "\n" (
mapAttrsToList
(k: v:
mapAttrsToList (
k: v:
if builtins.typeOf v == "string" then
"\$${k} = '${v}'"
else if builtins.typeOf v == "list" then
"\$${k} = ${listToPythonList}"
else if builtins.typeOf v == "int" then
"\$${k} = ${toString v}"
else ""
)
cfg.sessionVariables
else
""
) cfg.sessionVariables
);
in
hosts/exodus/hardware-configuration.nix
+16 -10
View File
@@ -1,28 +1,34 @@
# Do not modify this file! It was generated by ‘nixos-generate-config’
# and may be overwritten by future invocations. Please make changes
# to /etc/nixos/configuration.nix instead.
{ config, lib, modulesPath, ... }:
{
config,
lib,
modulesPath,
...
}:
{
imports =
[
(modulesPath + "/installer/scan/not-detected.nix")
];
imports = [ (modulesPath + "/installer/scan/not-detected.nix") ];
boot.initrd.availableKernelModules = [ "xhci_pci" "thunderbolt" "nvme" "uas" "sd_mod" ];
boot.initrd.availableKernelModules = [
"xhci_pci"
"thunderbolt"
"nvme"
"uas"
"sd_mod"
];
boot.initrd.kernelModules = [ ];
boot.kernelModules = [ "kvm-intel" ];
boot.extraModulePackages = [ ];
fileSystems."/" =
{
fileSystems."/" = {
device = "/dev/disk/by-uuid/607b933f-2967-4652-b478-4d8e9aa38a0d";
fsType = "btrfs";
options = [ "subvol=@" ];
};
fileSystems."/boot" =
{
fileSystems."/boot" = {
device = "/dev/disk/by-uuid/B31C-C1F4";
fsType = "vfat";
};
hosts/genesis/acme.nix
+17 -5
View File
@@ -1,9 +1,16 @@
{ pkgs, config, lib, ... }:
{
pkgs,
config,
lib,
...
}:
let
address = (builtins.elemAt config.networking.interfaces.ens18.ipv4.addresses 0).address;
root_ca = pkgs.writeText "root_ca.crt" (builtins.readFile ../../ca/root_ca.crt);
intermediate_ca = pkgs.writeText "intermediate_ca.crt" (builtins.readFile ../../ca/intermediate_ca.crt);
intermediate_ca = pkgs.writeText "intermediate_ca.crt" (
builtins.readFile ../../ca/intermediate_ca.crt
);
in
{
age.secrets.acme_password = {
@@ -13,7 +20,10 @@ in
file = ../../secrets/ca/intermediate_key.age;
};
age.secrets.root_ca_key.file = ../../secrets/ca/root_key.age;
systemd.services.step-ca.serviceConfig.Environment = lib.mkForce [ "STEPDEBUG=1" "HOME=%S/step-ca" ];
systemd.services.step-ca.serviceConfig.Environment = lib.mkForce [
"STEPDEBUG=1"
"HOME=%S/step-ca"
];
services.step-ca = {
inherit address;
enable = false;
@@ -35,7 +45,8 @@ in
dataSource = "/var/lib/step-ca/db";
badgerFileLoadingMode = "";
};
authority.provisioners = [{
authority.provisioners = [
{
type = "JWK";
name = "greg@thehellings.com";
key = {
@@ -48,7 +59,8 @@ in
y = "MEpqnJp60VV-SpFtb6m8U-VAYut7R_PKFm07xl7MjBk";
};
encryptedKey = "eyJhbGciOiJQQkVTMi1IUzI1NitBMTI4S1ciLCJjdHkiOiJqd2sranNvbiIsImVuYyI6IkEyNTZHQ00iLCJwMmMiOjYwMDAwMCwicDJzIjoieWdfb0lfbWgwbHhPRXdjUTBsd0FnUSJ9.ivdQUFEhs2U8PUBYr8AhQl3hHdb4spF4jvXgqY_hiVgpjB-z3Nn9Uw.u7vrNht_3WD1G97q.mbydlpAQxjtKLkOmmDOUczqscRDPqrUyoPJ1uqXcJDH3vs4KiYlrKRcFLjPy9sWzEL1iIrqjwf3U-3AAx1KNAg7frs2D__MGfOO-U5SdQDVJVAND7KpWOJGJVSb0xioCA6-8ldlP_REqu4ENmkkdw0_6Is2b0p7ZFKqke_fqOOs7osqFAfbMb_WzEWrACLn5A5-Teh2rpEgR-z9zipN6MSEqE6VIQ2BXuv70aHWhslNe1MK1OgTYm9CqA47EMYvQ7HQLPDZAbP56WK84yJLktoXMmnkaKeTtvER0dh4ufyjJHBhecnEranbR5rHc_jV8_qvyWhlqbCrOU_8bWrk.a9SH_q3GKIUsOUSRWkDxQg";
}];
}
];
tls = {
cipherSuites = [
"TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256"
hosts/genesis/hardware-configuration.nix
+10 -9
View File
@@ -4,24 +4,25 @@
{ lib, modulesPath, ... }:
{
imports =
[
(modulesPath + "/profiles/qemu-guest.nix")
];
imports = [ (modulesPath + "/profiles/qemu-guest.nix") ];
boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "sr_mod" "virtio_blk" ];
boot.initrd.availableKernelModules = [
"ata_piix"
"uhci_hcd"
"virtio_pci"
"sr_mod"
"virtio_blk"
];
boot.initrd.kernelModules = [ ];
boot.kernelModules = [ ];
boot.extraModulePackages = [ ];
fileSystems."/" =
{
fileSystems."/" = {
device = "/dev/disk/by-uuid/a13f941e-4985-47ab-a8c6-374a627c5ce1";
fsType = "ext4";
};
swapDevices =
[{ device = "/dev/disk/by-uuid/ac4557de-1ad5-4d3c-b9f4-5ec50dbf76f1"; }];
swapDevices = [ { device = "/dev/disk/by-uuid/ac4557de-1ad5-4d3c-b9f4-5ec50dbf76f1"; } ];
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
# (the default) this is the recommended approach. When using systemd-networkd it's
hosts/genesis/home-assistant.nix
+20 -10
View File
@@ -26,16 +26,17 @@
"wyoming"
"zwave_js"
];
customComponents = with pkgs.home-assistant-custom-components; [
smartthinq-sensors
];
customComponents = with pkgs.home-assistant-custom-components; [ smartthinq-sensors ];
config = {
default_config = { };
tts = [{ platform = "google_translate"; }];
tts = [ { platform = "google_translate"; } ];
http = {
use_x_forwarded_for = true;
trusted_proxies = [ "127.0.0.1" "::1" ];
trusted_proxies = [
"127.0.0.1"
"::1"
];
server_host = "127.0.0.1";
};
#"automation manual" = *nix config here* and so on
@@ -75,7 +76,10 @@
containers.zwave = {
autoStart = false; # We will try to start it with udev.extraRules listed below, as this option starts it too quickly
image = "zwavejs/zwave-js-ui:latest";
ports = [ "8091:8091" "3000:3000" ];
ports = [
"8091:8091"
"3000:3000"
];
volumes = [ "/var/lib/zwave:/usr/src/app/store" ];
extraOptions = [
"--device"
@@ -93,8 +97,12 @@
# the container. So we add the creation of /var/lib/{zwave,hass} to the systemd Unit files
systemd.services = {
"podman-zwave" = {
after = [ "sys-devices-pci0000:00-0000:00:1e.0-0000:02:1b.0-usb2-2\\x2d1-2\\x2d1:1.0-tty-ttyACM0.device" ];
wantedBy = [ "sys-devices-pci0000:00-0000:00:1e.0-0000:02:1b.0-usb2-2\\x2d1-2\\x2d1:1.0-tty-ttyACM0.device" ];
after = [
"sys-devices-pci0000:00-0000:00:1e.0-0000:02:1b.0-usb2-2\\x2d1-2\\x2d1:1.0-tty-ttyACM0.device"
];
wantedBy = [
"sys-devices-pci0000:00-0000:00:1e.0-0000:02:1b.0-usb2-2\\x2d1-2\\x2d1:1.0-tty-ttyACM0.device"
];
serviceConfig = {
StateDirectory = "zwave";
StateDirectoryMode = pkgs.lib.mkForce "0777";
@@ -106,7 +114,6 @@
SUBSYSTEM=="tty", KERNEL=="ttyACM0", TAG+="systemd"
'';
greg.proxies = {
"smart.home".target = "http://127.0.0.1:8123/";
"smart.thehellings.lan".target = "http://127.0.0.1:8123/";
@@ -116,7 +123,10 @@
# Ensure that both ports are up and running. We keep 8123 directly open because we are on the LAN and sometimes want to connect
# directly for troubleshooting Nginx configuration
networking.firewall = {
allowedTCPPorts = [ 80 443 ];
allowedTCPPorts = [
80
443
];
};
greg.backup.jobs.zwave = {
hosts/genesis/networking.nix
+18 -12
View File
@@ -37,18 +37,22 @@ in
# This is our LAN port
"${lan}" = {
useDHCP = false;
ipv4.addresses = [{
ipv4.addresses = [
{
address = "${lanIP}";
prefixLength = 16;
}];
}
];
};
"${iot}" = {
useDHCP = false;
ipv4.addresses = [{
ipv4.addresses = [
{
address = "${iotIP}";
prefixLength = 24;
}];
}
];
};
};
firewall = {
@@ -90,15 +94,19 @@ in
########
_3proxy = {
enable = true;
services = [{
services = [
{
type = "socks";
auth = [ "strong" ];
bindPort = proxyPort;
acl = [{
acl = [
{
rule = "allow";
users = [ "greg" ];
}];
}];
}
];
}
];
#usersFile = "/run/agenix/3proxy";
denyPrivate = false;
};
@@ -140,7 +148,7 @@ in
"4c:a1:61:05:cd:52,192.168.66.61" # Rainbird
"48:d6:d5:5d:81:21,192.168.66.65" # Google Home
"6c:29:90:3e:e2:02,192.168.66.66" # wiz
"28:87:ba:0e:ca:da,192.168.66.74" #
"28:87:ba:0e:ca:da,192.168.66.74"
"28:87:ba:0e:c9:fd,192.168.66.75" # Master closet
"54:af:97:c2:0f:a1,192.168.66.76" # Master toilet
"54:af:97:83:ed:33,192.168.66.80"
@@ -174,9 +182,7 @@ in
# Update adblock list
cron = {
enable = true;
systemCronJobs = [
"* * * * * root ${adblockUpdate} 2>&1 > /var/log/adblock.log"
];
systemCronJobs = [ "* * * * * root ${adblockUpdate} 2>&1 > /var/log/adblock.log" ];
};
}; # End of services configuration
hosts/hosea/bitcoin.nix
+2 -5
View File
@@ -41,9 +41,7 @@ in
listen = true;
rpc = {
address = ip;
allowip = [
"100.1.1.1/8"
];
allowip = [ "100.1.1.1/8" ];
};
};
clightning = {
@@ -74,6 +72,5 @@ in
};
};
environment.systemPackages = with pkgs; [
];
environment.systemPackages = with pkgs; [ ];
}
hosts/hosea/hardware-configuration.nix
+17 -10
View File
@@ -1,28 +1,35 @@
# Do not modify this file! It was generated by ‘nixos-generate-config’
# and may be overwritten by future invocations. Please make changes
# to /etc/nixos/configuration.nix instead.
{ config, lib, modulesPath, ... }:
{
config,
lib,
modulesPath,
...
}:
{
imports =
[
(modulesPath + "/installer/scan/not-detected.nix")
];
imports = [ (modulesPath + "/installer/scan/not-detected.nix") ];
boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "nvme" "usbhid" "uas" "sd_mod" ];
boot.initrd.availableKernelModules = [
"xhci_pci"
"ahci"
"nvme"
"usbhid"
"uas"
"sd_mod"
];
boot.initrd.kernelModules = [ ];
boot.kernelModules = [ "kvm-intel" ];
boot.extraModulePackages = [ ];
fileSystems."/" =
{
fileSystems."/" = {
device = "/dev/disk/by-uuid/d4ac74f7-62bb-421a-aad8-566277c9d8ba";
fsType = "btrfs";
options = [ "subvol=@" ];
};
fileSystems."/boot" =
{
fileSystems."/boot" = {
device = "/dev/disk/by-uuid/1F51-B638";
fsType = "vfat";
};
hosts/icdm-root/default.nix
+4 -1
View File
@@ -19,7 +19,10 @@
users.users.greg = {
isNormalUser = true;
description = "Gregory Hellings";
extraGroups = [ "networkmanager" "wheel" ];
extraGroups = [
"networkmanager"
"wheel"
];
packages = with pkgs; [ ];
};
}
hosts/icdm-root/filesystem.nix
+2 -1
View File
@@ -1,7 +1,8 @@
{ ... }:
let
in {
in
{
fileSystems."serve" = {
#device = "10.42.1.4:/volume1/icdm-mysql/";
#fsType = "nfs";
hosts/icdm-root/hardware-configuration.nix
+19 -14
View File
@@ -1,40 +1,45 @@
# Do not modify this file! It was generated by ‘nixos-generate-config’
# and may be overwritten by future invocations. Please make changes
# to /etc/nixos/configuration.nix instead.
{ config, lib, modulesPath, ... }:
{
config,
lib,
modulesPath,
...
}:
{
imports =
[
(modulesPath + "/installer/scan/not-detected.nix")
];
imports = [ (modulesPath + "/installer/scan/not-detected.nix") ];
boot.initrd.availableKernelModules = [ "xhci_pci" "ehci_pci" "ahci" "usbhid" "usb_storage" "sd_mod" ];
boot.initrd.availableKernelModules = [
"xhci_pci"
"ehci_pci"
"ahci"
"usbhid"
"usb_storage"
"sd_mod"
];
boot.initrd.kernelModules = [ ];
boot.kernelModules = [ "kvm-intel" ];
boot.extraModulePackages = [ ];
fileSystems."/" =
{
fileSystems."/" = {
device = "/dev/disk/by-uuid/dab0d455-e25e-4445-8fa4-5320047d7e7b";
fsType = "btrfs";
options = [ "subvol=@" ];
};
fileSystems."/boot" =
{
fileSystems."/boot" = {
device = "/dev/disk/by-uuid/5aedbb07-5761-423b-909d-2560405eae32";
fsType = "ext4";
};
fileSystems."/var" =
{
fileSystems."/var" = {
device = "/dev/disk/by-uuid/57968536-c29d-417d-997e-85223d1d1f65";
fsType = "btrfs";
};
swapDevices =
[{ device = "/dev/disk/by-uuid/09691dce-375a-43c6-8d40-4498d20a6d9a"; }];
swapDevices = [ { device = "/dev/disk/by-uuid/09691dce-375a-43c6-8d40-4498d20a6d9a"; } ];
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
# (the default) this is the recommended approach. When using systemd-networkd it's
hosts/icdm-root/networking.nix
+14 -10
View File
@@ -1,8 +1,6 @@
{ ... }:
let
dnsHosts = builtins.concatStringsSep "\n" [
"wiki.icdm.lan 10.42.101.1"
];
dnsHosts = builtins.concatStringsSep "\n" [ "wiki.icdm.lan 10.42.101.1" ];
in
{
# If we have to do proxying in Bayonnais, we can start to work on that here
@@ -11,24 +9,32 @@ in
hostName = "icdm-root";
useDHCP = false;
defaultGateway = "10.42.1.1";
nameservers = [ "100.100.100.100" "10.42.1.2" ];
nameservers = [
"100.100.100.100"
"10.42.1.2"
];
enableIPv6 = false;
interfaces = {
eno1.ipv4.addresses = [{
eno1.ipv4.addresses = [
{
address = "10.42.101.1";
prefixLength = 16;
}
{
address = "10.77.1.2";
prefixLength = 16;
}];
}
];
};
# Allow traffic through
firewall = {
enable = true;
allowedTCPPorts = [ 53 ];
allowedUDPPorts = [ 53 67 ];
allowedUDPPorts = [
53
67
];
};
extraHosts = "${dnsHosts}";
@@ -38,9 +44,7 @@ in
enable = true;
settings = {
domain = "icdm.lan";
dhcp-range = [
"eno1,10.77.1.10,10.77.1.255,255.255.0.0,12h"
];
dhcp-range = [ "eno1,10.77.1.10,10.77.1.255,255.255.0.0,12h" ];
dhcp-option = [
"eno1,option:router,10.77.1.1"
"eno1,option:dns-server,10.77.1.2,1.1.1.1"
hosts/iso/default.nix
+7 -4
View File
@@ -1,4 +1,9 @@
{ pkgs, lib, modulesPath, ... }:
{
pkgs,
lib,
modulesPath,
...
}:
{
imports = [
@@ -9,7 +14,5 @@
networking.networkmanager.enable = lib.mkForce false;
users.users.greg.initialPassword = "";
#services.getty.autologinUser = lib.mkForce "greg";
environment.systemPackages = with pkgs; [
tree
];
environment.systemPackages = with pkgs; [ tree ];
}
hosts/jeremiah/default.nix
+17 -11
View File
@@ -2,11 +2,15 @@
# your system. Help is available in the configuration.nix(5) man page
# and in the NixOS manual (accessible by running ‘nixos-help’).
{ config, pkgs, lib, ... }:
{
config,
pkgs,
lib,
...
}:
{
imports =
[
imports = [
# Include the results of the hardware scan.
./ceph.nix
./hardware-configuration.nix
@@ -32,26 +36,28 @@
};
interfaces = {
enp68s0 = {
ipv4.addresses = [{
ipv4.addresses = [
{
address = "10.42.1.8";
prefixLength = 16;
}
{
address = "10.42.100.1";
prefixLength = 16;
}];
}
];
};
san = {
ipv4.addresses = [{
ipv4.addresses = [
{
address = "10.201.1.2";
prefixLength = 24;
}];
};
};
nameservers = [
"10.42.1.5"
}
];
};
};
nameservers = [ "10.42.1.5" ];
};
greg = {
home = true;
tailscale.enable = true;
hosts/jeremiah/hardware-configuration.nix
+17 -10
View File
@@ -1,27 +1,34 @@
# Do not modify this file! It was generated by ‘nixos-generate-config’
# and may be overwritten by future invocations. Please make changes
# to /etc/nixos/configuration.nix instead.
{ config, lib, modulesPath, ... }:
{
config,
lib,
modulesPath,
...
}:
{
imports =
[
(modulesPath + "/installer/scan/not-detected.nix")
];
imports = [ (modulesPath + "/installer/scan/not-detected.nix") ];
boot.initrd.availableKernelModules = [ "nvme" "xhci_pci" "ahci" "uas" "usbhid" "sd_mod" ];
boot.initrd.availableKernelModules = [
"nvme"
"xhci_pci"
"ahci"
"uas"
"usbhid"
"sd_mod"
];
boot.initrd.kernelModules = [ ];
boot.kernelModules = [ "kvm-amd" ];
boot.extraModulePackages = [ ];
fileSystems."/" =
{
fileSystems."/" = {
device = "/dev/disk/by-uuid/ffc167f5-d9e4-4b11-a5f1-f7da0550ad24";
fsType = "ext4";
};
fileSystems."/boot" =
{
fileSystems."/boot" = {
device = "/dev/disk/by-uuid/3047-870E";
fsType = "vfat";
};
hosts/jude/boot.nix
+13 -8
View File
@@ -12,23 +12,28 @@
enable = true;
configurationLimit = 20;
extraEntries = {
"Windows.conf" = (lib.strings.concatStringsSep "\n" [
"Windows.conf" = (
lib.strings.concatStringsSep "\n" [
"title Windows"
"efi /EFI/Microsoft/EFI/bootmgfw.efi"
]);
"Win2.conf" = (lib.strings.concatStringsSep "\n" [
]
);
"Win2.conf" = (
lib.strings.concatStringsSep "\n" [
"title Windows 11"
"efi /shellx64.efi"
"options -nointerrupt -noconsolein -noconsoleout windows11.nsh"
]);
"Shell.conf" = (lib.strings.concatStringsSep "\n" [
]
);
"Shell.conf" = (
lib.strings.concatStringsSep "\n" [
"title EFI Shell"
"efi /shell.efi"
]);
]
);
};
extraFiles = {
"windows11.nsh" = (pkgs.writeText "windows11.nsh" (lib.strings.concatStringsSep "\n" [
]));
"windows11.nsh" = (pkgs.writeText "windows11.nsh" (lib.strings.concatStringsSep "\n" [ ]));
"shell.efi" = "${pkgs.edk2-uefi-shell}/shell.efi";
};
};
hosts/jude/default.nix
+7 -2
View File
@@ -25,7 +25,10 @@
firewall = {
enable = false;
allowedTCPPorts = [ 21000 ];
allowedUDPPorts = [ 21000 21010 ];
allowedUDPPorts = [
21000
21010
];
};
};
greg = {
@@ -38,7 +41,9 @@
boot.extraModulePackages = [ config.boot.kernelPackages.v4l2loopback ];
environment.systemPackages = with pkgs; lib.mkMerge [
environment.systemPackages =
with pkgs;
lib.mkMerge [
[
# for Immersed
cudatoolkit
hosts/jude/hardware-configuration.nix
+16 -8
View File
@@ -1,21 +1,29 @@
# Do not modify this file! It was generated by ‘nixos-generate-config’
# and may be overwritten by future invocations. Please make changes
# to /etc/nixos/configuration.nix instead.
{ config, lib, modulesPath, ... }:
{
config,
lib,
modulesPath,
...
}:
{
imports =
[
(modulesPath + "/installer/scan/not-detected.nix")
];
imports = [ (modulesPath + "/installer/scan/not-detected.nix") ];
boot.initrd.availableKernelModules = [ "nvme" "xhci_pci" "ahci" "usbhid" "usb_storage" "sd_mod" ];
boot.initrd.availableKernelModules = [
"nvme"
"xhci_pci"
"ahci"
"usbhid"
"usb_storage"
"sd_mod"
];
boot.initrd.kernelModules = [ ];
boot.kernelModules = [ "kvm-amd" ];
boot.extraModulePackages = [ ];
fileSystems."/" =
{
fileSystems."/" = {
#device = "/dev/disk/by-uuid/27ae91ed-32e9-411e-8227-0d99e360fbbf";
device = "/dev/nvme0n1p4";
fsType = "btrfs";
hosts/linode/default.nix
+15 -8
View File
@@ -1,4 +1,9 @@
{ pkgs, lib, config, ... }:
{
pkgs,
lib,
config,
...
}:
{
imports = [
@@ -29,9 +34,7 @@
networkmanager.enable = lib.mkForce false;
hostName = "linode";
domain = "thehellings.com";
nameservers = [
"100.88.91.27"
];
nameservers = [ "100.88.91.27" ];
};
age.secrets.runner-deployer = {
@@ -58,17 +61,21 @@
User = "gitlab-runner";
};
security.sudo.extraRules = [{
security.sudo.extraRules = [
{
users = [ "gitlab-runner" ];
commands = [{
commands = [
{
command = "/run/current-system/sw/bin/systemctl";
options = [ "NOPASSWD" ];
}
{
command = "/run/current-system/sw/bin/podman";
options = [ "NOPASSWD" ];
}];
}];
}
];
}
];
environment.systemPackages = with pkgs; [
bind
hosts/linode/hardware-configuration.nix
+14 -8
View File
@@ -1,14 +1,22 @@
# Do not modify this file! It was generated by "nixos-generate-config"
# and may be overwritten by future invocations. Please make changes
# to /etc/nixos/configuration.nix instead.
{ config, lib, modulesPath, ... }:
{
config,
lib,
modulesPath,
...
}:
{
imports = [
(modulesPath + "/profiles/qemu-guest.nix")
];
imports = [ (modulesPath + "/profiles/qemu-guest.nix") ];
boot.initrd.availableKernelModules = [ "virtio_pci" "virtio_scsi" "ahci" "sd_mod" ];
boot.initrd.availableKernelModules = [
"virtio_pci"
"virtio_scsi"
"ahci"
"sd_mod"
];
boot.initrd.kernelModules = [ ];
boot.kernelModules = [ ];
boot.extraModulePackages = [ ];
@@ -18,9 +26,7 @@
fsType = "ext4";
};
swapDevices = [
{ device = "/dev/sdb"; }
];
swapDevices = [ { device = "/dev/sdb"; } ];
hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
}
hosts/linode/matrix.nix
+13 -4
View File
@@ -19,7 +19,9 @@ in
# the actual application server at matrix.thehellings.com
locations."= /.well-known/matrix/server".extraConfig =
let
server = { "m.server" = "${fqdn}:443"; };
server = {
"m.server" = "${fqdn}:443";
};
in
''
add_header Content-Type application/json;
@@ -29,8 +31,12 @@ in
locations."= /.well-known/matrix/client".extraConfig =
let
client = {
"m.homeserver" = { "base_url" = "https://${fqdn}"; };
"m.identity_server" = { "base_url" = "https://vector.im"; };
"m.homeserver" = {
"base_url" = "https://${fqdn}";
};
"m.identity_server" = {
"base_url" = "https://vector.im";
};
};
in
''
@@ -58,6 +64,9 @@ in
# Open networking ports for the server
networking.firewall = {
enable = true;
allowedTCPPorts = [ 80 443 ];
allowedTCPPorts = [
80
443
];
};
}
hosts/linode/postgres.nix
+7 -11
View File
@@ -1,26 +1,24 @@
{ config, pkgs, ... }:
{
environment.systemPackages = [
pkgs.upgrade-pg-cluster
];
environment.systemPackages = [ pkgs.upgrade-pg-cluster ];
services.postgresql = {
enable = true;
package = pkgs.postgresql_15;
checkConfig = true;
ensureDatabases = [
"nextcloud"
];
ensureDatabases = [ "nextcloud" ];
#initialScript = pkgs.writeText "create-matrix-db.sql" ''
# CREATE ROLE "matrix-synapse" WITH LOGIN;
# CREATE DATABASE "synapse" WITH OWNER "matrix-synapse" TEMPLATE template0 LC_COLLATE = "C" LC_CTYPE = "C";
# GRANT ALL PRIVILEGES ON DATABASE "synapse" TO "matrix-synapse";
#''; # These are done manually in order to set the LC_COLLATE values properly
ensureUsers = [{
ensureUsers = [
{
name = "nextcloud";
ensureDBOwnership = true;
}];
}
];
settings = {
log_connections = true;
log_statement = "all";
@@ -34,9 +32,7 @@
services.postgresqlBackup = {
enable = true;
databases = [
"nextcloud"
];
databases = [ "nextcloud" ];
};
services.logrotate = {
hosts/myself/container-git.nix
+42 -15
View File
@@ -1,4 +1,9 @@
{ config, pkgs, lib, ... }:
{
config,
pkgs,
lib,
...
}:
let
registryPort = 5000;
vpnIp = "100.78.226.76";
@@ -8,7 +13,12 @@ in
age.secretsMountPoint = "/run/derp";
age.secrets =
let
cfg = n: { file = ../../secrets/gitlab/${n}.age; owner = "gitlab"; group = "gitlab"; mode = "0444"; };
cfg = n: {
file = ../../secrets/gitlab/${n}.age;
owner = "gitlab";
group = "gitlab";
mode = "0444";
};
in
{
gitlab-secret = cfg "secret";
@@ -32,7 +42,10 @@ in
};
};
networking.firewall.allowedTCPPorts = [ 80 registryPort ];
networking.firewall.allowedTCPPorts = [
80
registryPort
];
greg.proxies =
let
@@ -115,13 +128,22 @@ in
provider = "AWS";
endpoint = "http://s3.thehellings.lan:9000";
region = "us-east-1";
aws_access_key_id = { _secret = config.age.secrets.minio_access_key_id.path; };
aws_secret_access_key = { _secret = config.age.secrets.minio_secret_access_key.path; };
aws_access_key_id = {
_secret = config.age.secrets.minio_access_key_id.path;
};
aws_secret_access_key = {
_secret = config.age.secrets.minio_secret_access_key.path;
};
path_style = true; # True for MinIO
aws_signature_version = 2;
};
#storage_options = ...;
objects = builtins.listToAttrs (builtins.map (x: lib.attrsets.nameValuePair x { bucket = "gitlab-${builtins.replaceStrings [ "_" ] [ "-" ] x}"; }) [
objects = builtins.listToAttrs (
builtins.map
(
x: lib.attrsets.nameValuePair x { bucket = "gitlab-${builtins.replaceStrings [ "_" ] [ "-" ] x}"; }
)
[
"artifacts"
"ci_secure_files"
"dependency_proxy"
@@ -131,17 +153,20 @@ in
"pages"
"terraform_state"
"uploads"
]);
]
);
};
};
};
nginx.virtualHosts."gitlab.shire-zebra.ts.net" = {
listen = [{
listen = [
{
addr = vpnIp;
port = registryPort;
ssl = true;
}];
}
];
locations."/" = {
proxyPass = "http://127.0.0.1:5000/";
recommendedProxySettings = true;
@@ -156,17 +181,21 @@ in
# Fetch the SSL certificates for nginx to use
cron = {
enable = true;
systemCronJobs = [ "0 0 1 */2 * cd /etc/certs && tailscale cert gitlab.shire-zebra.ts.net && chown nginx * && systemctl reload nginx" ];
systemCronJobs = [
"0 0 1 */2 * cd /etc/certs && tailscale cert gitlab.shire-zebra.ts.net && chown nginx * && systemctl reload nginx"
];
};
postgresql = {
enable = true;
checkConfig = true;
ensureDatabases = [ "gitlab" ];
ensureUsers = [{
ensureUsers = [
{
name = "gitlab";
ensureDBOwnership = true;
}];
}
];
settings = {
log_connections = true;
log_statement = "all";
@@ -186,9 +215,7 @@ in
# to the 100.* addresses
systemd.services = {
nginx = rec {
after = [
"network-online.target"
];
after = [ "network-online.target" ];
wants = after;
serviceConfig = {
RestartMaxDelaySec = "30s";
hosts/myself/hardware-configuration.nix
+20 -14
View File
@@ -1,41 +1,47 @@
# Do not modify this file! It was generated by ‘nixos-generate-config’
# and may be overwritten by future invocations. Please make changes
# to /etc/nixos/configuration.nix instead.
{ config, lib, modulesPath, ... }:
{
config,
lib,
modulesPath,
...
}:
{
imports =
[
(modulesPath + "/installer/scan/not-detected.nix")
];
imports = [ (modulesPath + "/installer/scan/not-detected.nix") ];
boot.initrd.availableKernelModules = [ "nvme" "xhci_pci" "ahci" "usb_storage" "usbhid" "sd_mod" "sr_mod" ];
boot.initrd.availableKernelModules = [
"nvme"
"xhci_pci"
"ahci"
"usb_storage"
"usbhid"
"sd_mod"
"sr_mod"
];
boot.initrd.kernelModules = [ ];
boot.kernelModules = [ "kvm-amd" ];
boot.extraModulePackages = [ ];
fileSystems."/" =
{
fileSystems."/" = {
device = "/dev/disk/by-uuid/714744ca-dd9d-4713-b571-c6ccfbf56d79";
fsType = "btrfs";
options = [ "subvol=nixos" ];
};
fileSystems."/home" =
{
fileSystems."/home" = {
device = "/dev/disk/by-uuid/714744ca-dd9d-4713-b571-c6ccfbf56d79";
fsType = "btrfs";
options = [ "subvol=home" ];
};
fileSystems."/boot" =
{
fileSystems."/boot" = {
device = "/dev/disk/by-uuid/29E7-E20C";
fsType = "vfat";
};
fileSystems."/myvol" =
{
fileSystems."/myvol" = {
device = "/dev/nvme0n1p1";
fsType = "btrfs";
};
hosts/myself/matrix.nix
+15 -5
View File
@@ -8,7 +8,9 @@ in
greg.containers.matrix = {
tailscale = true;
subnet = "204";
builder = { config, ... }: {
builder =
{ config, ... }:
{
networking.firewall.allowedTCPPorts = [ config.services.dendrite.httpPort ];
# Environment secrets
@@ -42,7 +44,14 @@ in
# Identify ourselves as the root of our own domain
settings = (
(builtins.listToAttrs (
(map (x: { name = x; value = { database.connection_string = conn; }; }) [
(map
(x: {
name = x;
value = {
database.connection_string = conn;
};
})
[
"app_service_api"
"federation_api"
"key_server"
@@ -51,9 +60,10 @@ in
"relay_api"
"room_server"
"sync_api"
])
)) //
{
]
)
))
// {
user_api.account_database.connection_string = conn;
user_api.device_database.connection_string = conn;
global = {
modules/darwin/default.nix
+1 -3
View File
@@ -1,8 +1,6 @@
{ ... }:
{
imports = [
../baseline.nix
];
imports = [ ../baseline.nix ];
system.stateVersion = 4;
home-manager = {
useGlobalPkgs = true;
modules/nixos/backup.nix
+18 -10
View File
@@ -1,4 +1,9 @@
{ lib, config, pkgs, ... }:
{
lib,
config,
pkgs,
...
}:
let
cfg = config.greg.backup;
@@ -14,7 +19,8 @@ let
type = "sendonly";
};
makeRestic = _: job:
makeRestic =
_: job:
let
who = "${config.services.syncthing.user}:${config.services.syncthing.group}";
in
@@ -27,13 +33,17 @@ let
};
in
with lib; {
with lib;
{
options = {
greg.backup = {
jobs = mkOption {
default = { };
type = with types; attrsOf (submodule (
type =
with types;
attrsOf (
submodule (
{ ... }:
{
options = {
@@ -42,9 +52,7 @@ with lib; {
description = "Local path (string form) to backup from";
};
dest = mkOption {
type = types.str;
};
dest = mkOption { type = types.str; };
id = mkOption {
type = types.str;
@@ -52,13 +60,13 @@ with lib; {
};
};
}
));
)
);
};
};
};
config = mkIf ((attrValues cfg.jobs) != [ ])
{
config = mkIf ((attrValues cfg.jobs) != [ ]) {
age.secrets = {
restic-pw.file = ../../secrets/restic-pw.age;
restic-env.file = ../../secrets/restic-env.age;
modules/nixos/ceph.nix
+130 -64
View File
@@ -1,6 +1,11 @@
# This is a good source for a Ceph dealio
# https://gist.github.com0/nh2/13425a1f18b4c1ce82edb63c10b163c9
{ config, lib, pkgs, ... }:
{
config,
lib,
pkgs,
...
}:
with lib;
@@ -8,13 +13,12 @@ let
cfg = config.services.ceph-benaco;
commaSep = builtins.concatStringsSep ",";
ensureUnitExists = c': name:
ensureUnitExists =
c': name:
let
#unitName = (builtins.elemAt (builtins.split "\\." name) 0);
in
if c'.systemd.services ? unitName
then name
else name; # "Unable to locate ${name} at ${commaSep (builtins.attrNames c')}";
#unitName = (builtins.elemAt (builtins.split "\\." name) 0);
if c'.systemd.services ? unitName then name else name; # "Unable to locate ${name} at ${commaSep (builtins.attrNames c')}";
in
{
@@ -46,7 +50,8 @@ in
};
initialMonitors = mkOption {
type = types.listOf (types.submodule {
type = types.listOf (
types.submodule {
options = {
hostname = mkOption {
type = types.str;
@@ -58,12 +63,14 @@ in
description = "Initial monitor IP address.";
};
};
});
}
);
description = "Initial monitors.";
};
mdsNodes = mkOption {
type = types.listOf (types.submodule {
type = types.listOf (
types.submodule {
options = {
hostname = mkOption {
type = types.str;
@@ -75,7 +82,8 @@ in
description = "MDS IP address.";
};
};
});
}
);
description = "MDS nodes.";
};
@@ -177,7 +185,8 @@ in
current machine only, used only to name the systemd service
for that OSD.
'';
type = types.attrsOf (types.submodule {
type = types.attrsOf (
types.submodule {
options = {
enable = mkEnableOption "Activate a Ceph OSD on this machine.";
@@ -293,7 +302,8 @@ in
};
};
});
}
);
};
mds = {
@@ -367,10 +377,12 @@ in
sudoersExtraRule = {
# entry for `security.sudo.extraRules`
users = [ config.users.users.ceph.name ];
commands = [{
commands = [
{
command = "${lib.getBin pkgs.smartmontools}/bin/smartctl -x --json=o /dev/*";
options = [ "NOPASSWD" ];
}];
}
];
};
}
{
@@ -378,24 +390,30 @@ in
sudoersExtraRule = {
# entry for `security.sudo.extraRules`
users = [ config.users.users.ceph.name ];
commands = [{
commands = [
{
command = "${lib.getBin pkgs.nvme-cli}/bin/nvme * smart-log-add --json /dev/*";
options = [ "NOPASSWD" ];
}];
}
];
};
}
];
cephDeviceHealthMonitoringPathsOrPackages = with pkgs; [
cephDeviceHealthMonitoringPathsOrPackages =
with pkgs;
[
# Contains `sudo`. Ceph wraps this around the other health check programs.
# Cannot use `pkgs.sudo` because that one is not SUID, see:
# https://discourse.nixos.org/t/sudo-uid-issues/9133
"/run/wrappers" # `systemd.services.<name>.path` adds the `bin/` subdir of this
] ++ map ({ package, ... }: package) cephMonitoringSudoersCommandsAndPackages;
]
++ map ({ package, ... }: package) cephMonitoringSudoersCommandsAndPackages;
# Unused localOsdServiceName in the following line
# deadnix: skip
makeCephOsdSetupSystemdService = localOsdServiceName: osdConfig:
makeCephOsdSetupSystemdService =
_localOsdServiceName: osdConfig:
let
osdExistenceFile = "/var/lib/ceph/osd/.${toString osdConfig.id}.${osdConfig.uuid}.nix-existence";
in
@@ -414,7 +432,8 @@ in
# TODO Use `udevadm trigger --settle` instead of the separate `udevadm settle`
# once that feature is available to us with systemd >= 238;
# see https://github.com/systemd/systemd/commit/792cc203a67edb201073351f5c766fce3d5eab45
preStart = ''
preStart =
''
set -x
${ensureCephDirs}
install -m 755 -o ${config.users.users.ceph.name} -g ${config.users.groups.ceph.name} -d /var/lib/ceph/bootstrap-osd
@@ -427,22 +446,26 @@ in
# Trigger udev rules for permissions of block devices and wait for them to settle.
udevadm trigger --name-match=${osdConfig.blockDevice}
'' + lib.optionalString (osdConfig.dbBlockDevice != null) ''
udevadm trigger --name-match=${osdConfig.dbBlockDevice}
'' +
''
+ lib.optionalString (osdConfig.dbBlockDevice != null) ''
udevadm trigger --name-match=${osdConfig.dbBlockDevice}
''
+ ''
udevadm settle
'' + (optionalString (!osdConfig.skipZap) (
''
+ (optionalString (!osdConfig.skipZap) (
''
# Zap OSD block devices, otherwise `ceph-osd` below will try to fsck if there's some old
# ceph data on the block device (see https://tracker.ceph.com/issues/24099).
${cfg.package}/bin/ceph-volume lvm zap ${osdConfig.blockDevice}
'' + lib.optionalString (osdConfig.dbBlockDevice != null) ''
''
+ lib.optionalString (osdConfig.dbBlockDevice != null) ''
${cfg.package}/bin/ceph-volume lvm zap ${osdConfig.dbBlockDevice}
''
));
script = ''
script =
''
set -euo pipefail
set -x
until [ -f /etc/ceph/${cfg.clusterName}.client.admin.keyring ]
@@ -457,10 +480,11 @@ in
mkdir -p /var/lib/ceph/osd/${cfg.clusterName}-${toString osdConfig.id}
ln -s ${osdConfig.blockDevice} /var/lib/ceph/osd/${cfg.clusterName}-${toString osdConfig.id}/block
'' + lib.optionalString (osdConfig.dbBlockDevice != null) ''
ln -s ${osdConfig.dbBlockDevice} /var/lib/ceph/osd/${cfg.clusterName}-${toString osdConfig.id}/block.db
'' +
''
+ lib.optionalString (osdConfig.dbBlockDevice != null) ''
ln -s ${osdConfig.dbBlockDevice} /var/lib/ceph/osd/${cfg.clusterName}-${toString osdConfig.id}/block.db
''
+ ''
${cfg.package}/bin/ceph-authtool --create-keyring /var/lib/ceph/osd/ceph-${toString osdConfig.id}/keyring \
--name osd.${toString osdConfig.id} --add-key $OSD_SECRET
@@ -481,14 +505,14 @@ in
};
};
makeCephOsdSystemdService = localOsdServiceName: osdConfig: mkIf osdConfig.enable {
makeCephOsdSystemdService =
localOsdServiceName: osdConfig:
mkIf osdConfig.enable {
description = "Ceph OSD";
# Note we do not have to add `osdConfig.systemdExtraRequiresAfter` here because
# that's already a dependency of our dependency `ceph-osd-setup-*`.
requires = [
(ensureUnitExists config "ceph-osd-setup-${localOsdServiceName}.service")
];
requires = [ (ensureUnitExists config "ceph-osd-setup-${localOsdServiceName}.service") ];
requiredBy = [ "multi-user.target" ];
after = [
"network.target"
@@ -505,9 +529,7 @@ in
path = [
# TODO: use wrapProgram in the ceph package for this in the future
pkgs.getopt
]
++ cephDeviceHealthMonitoringPathsOrPackages
;
] ++ cephDeviceHealthMonitoringPathsOrPackages;
restartTriggers = [ config.environment.etc."ceph/${cfg.clusterName}.conf".source ];
@@ -518,7 +540,9 @@ in
serviceConfig =
let
clusterIpArg = lib.optionalString (osdConfig.clusterAddress != null) "--cluster_addr=${osdConfig.clusterAddress}";
clusterIpArg = lib.optionalString (
osdConfig.clusterAddress != null
) "--cluster_addr=${osdConfig.clusterAddress}";
in
{
LimitNOFILE = "1048576";
@@ -551,7 +575,10 @@ in
3300 # ceph msgr-v2
];
allowedTCPPortRanges = [
{ from = 6800; to = 7300; } # https://docs.ceph.com/en/pacific/rados/configuration/network-config-ref/
{
from = 6800;
to = 7300;
} # https://docs.ceph.com/en/pacific/rados/configuration/network-config-ref/
];
};
@@ -565,8 +592,7 @@ in
# if you want to override an option you've set in `global`.
#
# Sample: https://github.com/ceph/ceph/blob/master/src/sample.ceph.conf
environment.etc."ceph/${cfg.clusterName}.conf".text =
''
environment.etc."ceph/${cfg.clusterName}.conf".text = ''
[global]
fsid = ${cfg.fsid}
mon_initial_members = ${commaSep (map (mon: mon.hostname) cfg.initialMonitors)}
@@ -649,27 +675,25 @@ in
};
# Allow ceph daemons (which run as user ceph) to collect device health metrics.
security.sudo.extraRules =
map ({ sudoersExtraRule, ... }: sudoersExtraRule) cephMonitoringSudoersCommandsAndPackages;
security.sudo.extraRules = map (
{ sudoersExtraRule, ... }: sudoersExtraRule
) cephMonitoringSudoersCommandsAndPackages;
# The udevadm trigger/settle in `makeCephOsdSetupSystemdService` waits for these rules rule to be applied.
services.udev.extraRules =
lib.concatStringsSep "\n" (
lib.mapAttrsToList
(_localOsdServiceName: osdConfig:
services.udev.extraRules = lib.concatStringsSep "\n" (
lib.mapAttrsToList (
_localOsdServiceName: osdConfig:
''
SUBSYSTEM=="block", ${osdConfig.blockDeviceUdevRuleMatcher}, OWNER="${config.users.users.ceph.name}", GROUP="${config.users.groups.ceph.name}", MODE="0660"
''
+ lib.optionalString (osdConfig.dbBlockDeviceUdevRuleMatcher != null) (
''
+ lib.optionalString (osdConfig.dbBlockDeviceUdevRuleMatcher != null) (''
SUBSYSTEM=="block", ${osdConfig.dbBlockDeviceUdevRuleMatcher}, OWNER="${config.users.users.ceph.name}", GROUP="${config.users.groups.ceph.name}", MODE="0660"
''
)
)
cfg.osds
'')
) cfg.osds
);
systemd.services = {
systemd.services =
{
ceph-mon-setup = mkIf cfg.monitor.enable {
description = "Initialize ceph monitor";
@@ -680,9 +704,15 @@ in
let
# `--addv` seems currently required to get msgr-v2 working, see:
# https://tracker.ceph.com/issues/53751#note-11
monmapNodes = builtins.concatStringsSep " " (lib.concatMap (mon: [ "--addv" mon.hostname "[v2:${mon.ipAddress}:3300,v1:${mon.ipAddress}:6789]" ]) cfg.initialMonitors);
# Monitors cannot simply be changed in config, one has to update the monmap, see note [replacing-ceph-monmap-ips-for-existing-cluster]
monmapNodes = builtins.concatStringsSep " " (
lib.concatMap (mon: [
"--addv"
mon.hostname
"[v2:${mon.ipAddress}:3300,v1:${mon.ipAddress}:6789]"
]) cfg.initialMonitors
);
in
# Monitors cannot simply be changed in config, one has to update the monmap, see note [replacing-ceph-monmap-ips-for-existing-cluster]
''
set -euo pipefail
rm -rf "${monDir}" # Start from scratch.
@@ -711,8 +741,17 @@ in
requires = [ (ensureUnitExists config "ceph-mon-setup.service") ];
requiredBy = [ "multi-user.target" ];
after = [ "network.target" "local-fs.target" "time-sync.target" (ensureUnitExists config "ceph-mon-setup.service") ];
wants = [ "network.target" "local-fs.target" "time-sync.target" ];
after = [
"network.target"
"local-fs.target"
"time-sync.target"
(ensureUnitExists config "ceph-mon-setup.service")
];
wants = [
"network.target"
"local-fs.target"
"time-sync.target"
];
restartTriggers = [ config.environment.etc."ceph/${cfg.clusterName}.conf".source ];
@@ -774,8 +813,17 @@ in
requires = [ (ensureUnitExists config "ceph-mgr-setup.service") ];
requiredBy = [ "multi-user.target" ];
after = [ "network.target" "local-fs.target" "time-sync.target" (ensureUnitExists config "ceph-mgr-setup.service") ];
wants = [ "network.target" "local-fs.target" "time-sync.target" ];
after = [
"network.target"
"local-fs.target"
"time-sync.target"
(ensureUnitExists config "ceph-mgr-setup.service")
];
wants = [
"network.target"
"local-fs.target"
"time-sync.target"
];
restartTriggers = [ config.environment.etc."ceph/${cfg.clusterName}.conf".source ];
@@ -831,8 +879,17 @@ in
requires = [ (ensureUnitExists config "ceph-mds-setup.service") ];
requiredBy = [ "multi-user.target" ];
after = [ "network.target" "local-fs.target" "time-sync.target" (ensureUnitExists config "ceph-mds-setup.service") ];
wants = [ "network.target" "local-fs.target" "time-sync.target" ];
after = [
"network.target"
"local-fs.target"
"time-sync.target"
(ensureUnitExists config "ceph-mds-setup.service")
];
wants = [
"network.target"
"local-fs.target"
"time-sync.target"
];
restartTriggers = [ config.environment.etc."ceph/${cfg.clusterName}.conf".source ];
@@ -856,8 +913,17 @@ in
}
# Make one OSD service for each configured OSD.
// lib.mapAttrs' (localOsdServiceName: osdConfig: nameValuePair "ceph-osd-setup-${localOsdServiceName}" (makeCephOsdSetupSystemdService localOsdServiceName osdConfig)) cfg.osds
// lib.mapAttrs' (localOsdServiceName: osdConfig: nameValuePair "ceph-osd-${localOsdServiceName}" (makeCephOsdSystemdService localOsdServiceName osdConfig)) cfg.osds;
// lib.mapAttrs' (
localOsdServiceName: osdConfig:
nameValuePair "ceph-osd-setup-${localOsdServiceName}" (
makeCephOsdSetupSystemdService localOsdServiceName osdConfig
)
) cfg.osds
// lib.mapAttrs' (
localOsdServiceName: osdConfig:
nameValuePair "ceph-osd-${localOsdServiceName}" (
makeCephOsdSystemdService localOsdServiceName osdConfig
)
) cfg.osds;
};
}
modules/nixos/db.nix
+18 -5
View File
@@ -1,4 +1,9 @@
{ config, lib, pkgs, ... }:
{
config,
lib,
pkgs,
...
}:
let
cfg = config.greg.databases;
@@ -7,12 +12,17 @@ in
{
options.greg.databases = lib.mkOption {
default = { };
type = with lib.types; attrsOf (submodule (
{ ... }: {
type =
with lib.types;
attrsOf (
submodule (
{ ... }:
{
# Options reserved for future expansion
options = { };
}
));
)
);
};
config = lib.mkIf (dbs != [ ]) {
@@ -22,7 +32,10 @@ in
package = pkgs.postgresql_15;
checkConfig = true;
ensureDatabases = dbs;
ensureUsers = map (db: { name = db; ensureDBOwnership = true; }) dbs;
ensureUsers = map (db: {
name = db;
ensureDBOwnership = true;
}) dbs;
settings = {
log_connections = true;
log_statement = "all";
modules/nixos/gnome.nix
+9 -5
View File
@@ -1,10 +1,16 @@
{ config, pkgs, lib, ... }:
{
config,
pkgs,
lib,
...
}:
let
cfg = config.greg.gnome;
in
with lib; {
with lib;
{
options = {
greg.gnome.enable = mkEnableOption "Enable my default Gnome3 setup";
};
@@ -24,9 +30,7 @@ with lib; {
xkb.layout = "us";
};
udev.packages = with pkgs; [
gnome-settings-daemon
];
udev.packages = with pkgs; [ gnome-settings-daemon ];
pipewire.enable = true;
modules/nixos/kde.nix
+13 -4
View File
@@ -1,17 +1,25 @@
{ config, pkgs, lib, options, ... }:
{
config,
pkgs,
lib,
options,
...
}:
let
cfg = config.greg.kde;
in
with lib; {
with lib;
{
options = {
greg.kde.enable = mkEnableOption "Enable my default KDE setup";
};
config = mkIf cfg.enable {
# Sets up a basic KDE installation
services = {
services =
{
xserver = {
enable = true;
xkb.layout = "us";
@@ -25,7 +33,8 @@ with lib; {
alsa.support32Bit = true;
pulse.enable = true;
};
} // (optionalAttrs (builtins.hasAttr "plasma6" options.services.xserver.desktopManager) {
}
// (optionalAttrs (builtins.hasAttr "plasma6" options.services.xserver.desktopManager) {
desktopManager.plasma6.enable = true;
displayManager = {
defaultSession = "plasma";
modules/nixos/kiwix-serve.nix
+11 -6
View File
@@ -1,9 +1,15 @@
{ config, pkgs, lib, ... }:
{
config,
pkgs,
lib,
...
}:
let
cfg = config.services.kiwix-serve;
in
with lib; {
with lib;
{
options.services.kiwix-serve = {
enable = mkEnableOption "Enable the Kiwix web server";
@@ -22,16 +28,15 @@ with lib; {
proxy = mkOption {
type = types.str;
default = "";
description = ''Upstream proxy, if any, to configure with kiwix. Specify
description = ''
Upstream proxy, if any, to configure with kiwix. Specify
host and port. E.g. "localhost:8080"
'';
};
};
config = mkIf cfg.enable {
environment.systemPackages = [
pkgs.kiwix-tools
];
environment.systemPackages = [ pkgs.kiwix-tools ];
systemd.services.kiwix-serve = {
enable = true;
modules/nixos/linode.nix
+6 -1
View File
@@ -1,4 +1,9 @@
{ config, lib, pkgs, ... }:
{
config,
lib,
pkgs,
...
}:
let
cfg = config.greg.linode;
modules/nixos/print.nix
+11 -6
View File
@@ -1,4 +1,9 @@
{ config, lib, pkgs, ... }:
{
config,
lib,
pkgs,
...
}:
let
cfg = config.greg.print;
@@ -16,12 +21,11 @@ with lib;
# ipp://printer.thehellings.lan:631/ - generic postscript printer
services.printing = {
enable = true;
drivers = with pkgs; [
gutenprint
] ++ (lib.optional pkgs.stdenv.isx86_64 gutenprintBin);
drivers = with pkgs; [ gutenprint ] ++ (lib.optional pkgs.stdenv.isx86_64 gutenprintBin);
};
hardware.printers.ensurePrinters = [{
hardware.printers.ensurePrinters = [
{
name = "HomeLexmarkColorPrinter";
location = "Home office";
deviceUri = "ipp://printer.thehellings.lan:631/";
@@ -29,6 +33,7 @@ with lib;
ppdOptions = {
PageSize = "Letter";
};
}];
}
];
};
}
modules/nixos/proxy.nix
+12 -5
View File
@@ -10,17 +10,20 @@ let
enableACME = dest.ssl;
locations."${dest.path}" = {
proxyPass = dest.target;
extraConfig = ''
extraConfig =
''
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $connection_upgrade;
'' + dest.extraConfig;
''
+ dest.extraConfig;
};
serverAliases = lib.mkIf dest.genAliases [ "${alias name}" ];
};
in
with lib; {
with lib;
{
options = {
greg.proxies = mkOption {
default = { };
@@ -37,7 +40,10 @@ with lib; {
enablement.
'';
type = with types; attrsOf (submodule (
type =
with types;
attrsOf (
submodule (
{ ... }:
{
options = {
@@ -72,7 +78,8 @@ with lib; {
};
};
}
));
)
);
};
};
modules/nixos/router.nix
+32 -12
View File
@@ -1,22 +1,39 @@
{ config, lib, pkgs, ... }:
{
config,
lib,
pkgs,
...
}:
let
names = mylist: (lib.strings.concatMapStringsSep "," (x: ''"${x}"'') mylist);
# Pass the names of the wan/lan ports
nftConfig =
{ wan
, lan
, limitedLan ? [ ]
, openPorts ? [ "ssh" "67" "53" ]
, # ssh, dhcpd, dns
openUDPPorts ? [ "67" "53" ] # dhcpd, dns
{
wan,
lan,
limitedLan ? [ ],
openPorts ? [
"ssh"
"67"
"53"
],
# ssh, dhcpd, dns
openUDPPorts ? [
"67"
"53"
], # dhcpd, dns
}:
let
lanList = names lan;
allLan = names (lan ++ limitedLan);
wanName = names wan;
portsString = lib.strings.concatMapStringsSep "\n" (x: "iifname { ${lanList}, \"tailscale0\" } tcp dport ${toString x} accept") openPorts;
udpPortsString = lib.strings.concatMapStringsSep "\n" (x: "iifname { ${lanList}, \"tailscale0\" } udp dport ${toString x} accept") openUDPPorts;
portsString = lib.strings.concatMapStringsSep "\n" (
x: "iifname { ${lanList}, \"tailscale0\" } tcp dport ${toString x} accept"
) openPorts;
udpPortsString = lib.strings.concatMapStringsSep "\n" (
x: "iifname { ${lanList}, \"tailscale0\" } udp dport ${toString x} accept"
) openUDPPorts;
in
lib.strings.concatStringsSep "\n" [
"table ip filter {"
@@ -61,7 +78,8 @@ let
cfg = config.greg.router;
in
with lib; {
with lib;
{
options.greg.router = {
enable = mkEnableOption "Enable NFTables and routing";
wan = mkOption {
@@ -82,11 +100,13 @@ with lib; {
config = mkIf cfg.enable {
networking.nftables = {
enable = true;
ruleset = (nftConfig {
ruleset = (
nftConfig {
inherit (cfg) lan wan;
openPorts = config.networking.firewall.allowedTCPPorts;
openUDPPorts = config.networking.firewall.allowedUDPPorts;
});
}
);
};
environment.systemPackages = [
modules/nixos/rpi4.nix
+8 -2
View File
@@ -1,10 +1,16 @@
{ config, lib, pkgs, ... }:
{
config,
lib,
pkgs,
...
}:
let
cfg = config.greg.rpi4;
in
with lib; {
with lib;
{
options = {
greg.rpi4 = {
enable = mkEnableOption "Enable support for Raspberry Pi 4s";
modules/nixos/sway.nix
+2 -1
View File
@@ -4,7 +4,8 @@ let
cfg = config.greg.sway;
in
with lib; {
with lib;
{
options = {
greg.sway.enable = mkEnableOption "Enable my default Gnome3 setup";
};
modules/nixos/syncthing.nix
+2 -1
View File
@@ -3,7 +3,8 @@
let
cfg = config.greg.syncthing;
in
with lib; {
with lib;
{
options.greg.syncthing = {
enable = mkEnableOption "Setup my personal minimal configuration for Syncthing";
};
modules/nixos/vmdev.nix
+6 -1
View File
@@ -1,4 +1,9 @@
{ pkgs, lib, config, ... }:
{
pkgs,
lib,
config,
...
}:
let
cfg = config.greg.vmdev;
overlays/pipenv.nix
+12 -12
View File
@@ -1,24 +1,26 @@
{ lib
, stdenv
, python3
, fetchFromGitHub
, installShellFiles
{
lib,
stdenv,
python3,
fetchFromGitHub,
installShellFiles,
}:
with python3.pkgs;
let
runtimeDeps = ps: with ps; [
runtimeDeps =
ps:
with ps;
[
certifi
setuptools
pip
virtualenv
virtualenv-clone
]
++ lib.optionals stdenv.hostPlatform.isAndroid [
pyjnius
];
++ lib.optionals stdenv.hostPlatform.isAndroid [ pyjnius ];
pythonEnv = python3.withPackages runtimeDeps;
@@ -71,9 +73,7 @@ buildPythonApplication rec {
"test_download_file"
];
disabledTestPaths = [
"tests/integration"
];
disabledTestPaths = [ "tests/integration" ];
postInstall = ''
installShellCompletion --cmd pipenv \
overlays/xonsh-apipenv.nix
+7 -9
View File
@@ -1,9 +1,9 @@
{ lib
, buildPythonPackage
, fetchFromGitHub
, toPythonModule
, pipenv
,
{
lib,
buildPythonPackage,
fetchFromGitHub,
toPythonModule,
pipenv,
}:
buildPythonPackage rec {
@@ -19,9 +19,7 @@ buildPythonPackage rec {
doCheck = false;
dependencies = [
(toPythonModule pipenv)
];
dependencies = [ (toPythonModule pipenv) ];
meta = with lib; {
description = "Auto pipenv support for Xonsh";
secrets/secrets.nix
+8 -2
View File
@@ -5,7 +5,14 @@ let
genesis = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEI9jbTPmEWQ0F2bLYmnIOLmBnag1fkKxHRjz3X8lB/k root@genesis";
hosea = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKLIwkTTXA56sUlUjEulXXZRvZy5H4a5ZwgKWLlpkQDz";
jeremiah = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOjQjXq9WYU2Ki27BR9WwJ4ZruS/lJXbjC1b0Q42Adi0";
systems = [ genesis linode jude myself hosea jeremiah ];
systems = [
genesis
linode
jude
myself
hosea
jeremiah
];
user_genesis_virt = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFWPSFQT0AH77wrwRhiskcBS0w4ZakBRdJywYYBsnm3S greg@genesis";
user_ivr = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMYzms+KIe5/bYF3uCyFjA5e1AgMPLIA3c4k417coqBe gregory.hellings@ls23003";
@@ -44,7 +51,6 @@ in
"restic-env.age".publicKeys = everyone;
"restic-pw.age".publicKeys = everyone;
"dendrite.age".publicKeys = everyone;
"dendrite_key.age".publicKeys = everyone;
"gitlab/secret.age".publicKeys = everyone;