Merge branch 'main' of gh:greg-hellings/nixos-config
This commit is contained in:
Greg Hellings
@@ -1,13 +0,0 @@
|
||||
{ config, pkgs, ... }:
|
||||
|
||||
{
|
||||
imports = [
|
||||
./hardware-configuration.nix
|
||||
./dnsmasq.nix
|
||||
./home-assistant.nix
|
||||
./networking.nix
|
||||
./vhosts.nix
|
||||
];
|
||||
networking.hostName = "2maccabees";
|
||||
greg.rpi4.enable = true;
|
||||
}
|
||||
@@ -1,80 +0,0 @@
|
||||
{ config, pkgs, ... }:
|
||||
|
||||
let
|
||||
extraHosts = builtins.concatStringsSep "\n" [
|
||||
# Local hosts
|
||||
"10.42.0.1 switch"
|
||||
"10.42.1.1 router"
|
||||
"10.42.1.2 2maccabees 2maccabees.thehellings.lan dns dns.thehellings.lan smart smart.thehellings.lan jellyfin jellyfin.thehellings.lan"
|
||||
"10.42.1.3 printer"
|
||||
"10.42.1.4 chronicles nas"
|
||||
"10.42.1.12 tv"
|
||||
|
||||
# Tailscale hosts
|
||||
"100.90.74.19 jude.me.ts"
|
||||
"100.99.244.92 dns.me.ts 2maccabees.me.ts smart.me.ts jellyfin.me.ts"
|
||||
"100.119.228.115 chronicles.me.ts nas.me.ts"
|
||||
"100.115.57.8 linode.me.ts"
|
||||
|
||||
# Dev hosts
|
||||
"10.42.101.1 icdm.lan wiki.icdm.lan *.icdm.lan"
|
||||
];
|
||||
|
||||
extraConfig = builtins.concatStringsSep "\n" [
|
||||
];
|
||||
in
|
||||
{
|
||||
# Enable the service with its own configuration
|
||||
services.dnsmasq = {
|
||||
enable = true;
|
||||
# Public AdGuard DNS servers
|
||||
settings = {
|
||||
domain = "thehellings.lan";
|
||||
dhcp-range = [
|
||||
# "eth0,10.42.0.1,10.42.1.255,255.255.0.0,static"
|
||||
"eth0,10.42.2.1,10.42.2.255,255.255.0.0,12h"
|
||||
"vlan66@eth0,192.168.66.3,192.168.66.150,255.255.255.0,12h"
|
||||
"vlan67@eth0,192.168.67.3,192.168.67.150,12h"
|
||||
];
|
||||
dhcp-option = [
|
||||
"eth0,option:router,10.42.1.1"
|
||||
"eth0,option:dns-server,10.42.1.2,1.1.1.1"
|
||||
"eth0,option:domain-search,thehellings.lan"
|
||||
|
||||
"vlan66@eth0,option:router,192.168.66.1"
|
||||
"vlan66@eth0,option:dns-server,192.168.66.2"
|
||||
|
||||
"vlan67@eth0,option:router,192.168.67.1"
|
||||
"vlan67@eth0,option:dns-server,192.168.67.2"
|
||||
];
|
||||
expand-hosts = true;
|
||||
log-dhcp = true;
|
||||
log-queries = true;
|
||||
addn-hosts = "/etc/adblock_hosts";
|
||||
server = [
|
||||
"94.140.14.14"
|
||||
"94.140.15.15"
|
||||
];
|
||||
};
|
||||
extraConfig = "${extraConfig}";
|
||||
};
|
||||
environment.systemPackages = [ pkgs.curl ];
|
||||
|
||||
# Regularly update DNS block list
|
||||
services.cron = {
|
||||
enable = true;
|
||||
systemCronJobs = [
|
||||
"* * * * * root ( ${pkgs.curl}/bin/curl -s https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts | sed '1,33d' > /etc/adblock_hosts && systemctl restart dnsmasq ) 2>&1 > /var/log/adblock.log"
|
||||
];
|
||||
};
|
||||
|
||||
# Allow traffic through
|
||||
networking.firewall = {
|
||||
enable = true;
|
||||
allowedTCPPorts = [ 53 ];
|
||||
allowedUDPPorts = [ 53 67 ];
|
||||
};
|
||||
|
||||
# Custom host addition
|
||||
networking.extraHosts = "${extraHosts}";
|
||||
}
|
||||
@@ -1,31 +0,0 @@
|
||||
# Do not modify this file! It was generated by ‘nixos-generate-config’
|
||||
# and may be overwritten by future invocations. Please make changes
|
||||
# to /etc/nixos/configuration.nix instead.
|
||||
{ config, lib, pkgs, modulesPath, ... }:
|
||||
|
||||
{
|
||||
imports =
|
||||
[ (modulesPath + "/installer/scan/not-detected.nix")
|
||||
];
|
||||
|
||||
boot.initrd.availableKernelModules = [ "xhci_pci" "usbhid" "usb_storage" "uas" ];
|
||||
boot.initrd.kernelModules = [ ];
|
||||
boot.kernelModules = [ ];
|
||||
boot.extraModulePackages = [ ];
|
||||
|
||||
fileSystems."/" ={
|
||||
device = "/dev/disk/by-uuid/35f9a49a-b557-4eb3-a013-2afca7a990e4";
|
||||
fsType = "btrfs";
|
||||
};
|
||||
|
||||
fileSystems."/boot" = {
|
||||
device = "/dev/disk/by-uuid/A982-C8A3";
|
||||
fsType = "vfat";
|
||||
};
|
||||
|
||||
swapDevices = [ {
|
||||
device = "/dev/disk/by-uuid/4b6f2dc4-d845-4ec4-81f2-4f61bb3f282d";
|
||||
} ];
|
||||
|
||||
powerManagement.cpuFreqGovernor = lib.mkDefault "ondemand";
|
||||
}
|
||||
@@ -1,90 +0,0 @@
|
||||
{ config, pkgs, ... }:
|
||||
|
||||
let
|
||||
service_list = [ "podman-home-assistant.service" ];
|
||||
in
|
||||
{
|
||||
virtualisation.podman.enable = true;
|
||||
|
||||
services.home-assistant = {
|
||||
enable = true;
|
||||
configDir = "/var/lib/hass";
|
||||
package = (pkgs.home-assistant.override {
|
||||
extraComponents = [
|
||||
"accuweather"
|
||||
"calendar"
|
||||
"cast"
|
||||
"eufy"
|
||||
"lovelace"
|
||||
"nextcloud"
|
||||
"smart_meter_texas"
|
||||
"solaredge"
|
||||
"tplink"
|
||||
"wiz"
|
||||
"zwave_js"
|
||||
];
|
||||
}).overrideAttrs (oldAttrs: {
|
||||
doInstallCheck = false;
|
||||
});
|
||||
|
||||
config = {
|
||||
default_config = {};
|
||||
esphome = {}; # Get these things loaded, even if not configured
|
||||
met = {};
|
||||
tts = [ { platform = "google_translate"; } ];
|
||||
http = {
|
||||
use_x_forwarded_for = true;
|
||||
trusted_proxies = [ "127.0.0.1" "::1" ];
|
||||
server_host = "127.0.0.1";
|
||||
};
|
||||
#"automation manual" = *nix config here* and so on
|
||||
"automation ui" = "!include automations.yaml";
|
||||
"script ui" = "!include scripts.yaml";
|
||||
"scene ui" = "!include scenes.yaml";
|
||||
};
|
||||
};
|
||||
|
||||
# Although NixOS has a package for Home Assistant, it is not kept as up to date as the container and the upstream
|
||||
# is very vocal about only supporting their own container or the HAOS deployments. So we deploy the container here
|
||||
# and avoid any potential messes from that
|
||||
virtualisation.oci-containers = {
|
||||
backend = "podman";
|
||||
|
||||
# I have ZWave devices. The easiest way to connect to them is the zwavejs2mqtt service running, so we spin up
|
||||
# its container and map the ZWave device into it
|
||||
containers.zwave = {
|
||||
image = "zwavejs/zwavejs2mqtt:latest";
|
||||
ports = [ "8091:8091" "3000:3000" ];
|
||||
volumes = [ "/var/lib/zwave:/usr/src/app/store" ];
|
||||
extraOptions = [
|
||||
"--device" "/dev/serial/by-id/usb-0658_0200-if00:/dev/zwave"
|
||||
"--pull=newer"
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
# Both of the above container need storage for their configuration and devices, but it is not created correctly by
|
||||
# the container. So we add the creation of /var/lib/{zwave,hass} to the systemd Unit files
|
||||
systemd.services = {
|
||||
"podman-zwave".serviceConfig = {
|
||||
StateDirectory = "zwave";
|
||||
StateDirectoryMode = pkgs.lib.mkForce "0777";
|
||||
};
|
||||
};
|
||||
|
||||
|
||||
greg.proxies."smart.thehellings.lan".target = "http://127.0.0.1:8123";
|
||||
|
||||
# Ensure that both ports are up and running. We keep 8123 directly open because we are on the LAN and sometimes want to connect
|
||||
# directly for troubleshooting Nginx configuration
|
||||
networking.firewall = {
|
||||
enable = true;
|
||||
allowedTCPPorts = [ 80 443 8091 8123 ];
|
||||
};
|
||||
|
||||
greg.backup.jobs.zwave = {
|
||||
src = "/var/lib/zwave";
|
||||
dest = "zwave";
|
||||
user = "root";
|
||||
};
|
||||
}
|
||||
@@ -1,75 +0,0 @@
|
||||
{ ... }:
|
||||
|
||||
{
|
||||
greg.tailscale.enable = true;
|
||||
|
||||
networking = {
|
||||
# This value is deprecated, you now set it per interface
|
||||
useDHCP = false;
|
||||
defaultGateway = "10.42.1.1";
|
||||
# 100.100.100.100 is the tailscale DNS
|
||||
nameservers = [ "100.100.100.100" "127.0.0.1" ];
|
||||
interfaces = {
|
||||
eth0.ipv4.addresses = [ {
|
||||
address = "10.42.1.2";
|
||||
prefixLength = 16;
|
||||
} ];
|
||||
wlan0.useDHCP = true;
|
||||
|
||||
vlan66.ipv4.addresses = [ {
|
||||
address = "192.168.66.2";
|
||||
prefixLength = 24;
|
||||
} ];
|
||||
};
|
||||
|
||||
vlans = {
|
||||
vlan66 = {
|
||||
id = 66;
|
||||
interface = "eth0";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
# Open ports in the firewall.
|
||||
# networking.firewall.allowedTCPPorts = [ ... ];
|
||||
# networking.firewall.allowedUDPPorts = [ ... ];
|
||||
# Or disable the firewall altogether.
|
||||
# networking.firewall.enable = false;
|
||||
|
||||
fileSystems."/media" = {
|
||||
device = "10.42.1.4:/volume1/video/";
|
||||
fsType = "nfs";
|
||||
options = [ "ro" ];
|
||||
};
|
||||
|
||||
services.jellyfin = {
|
||||
enable = true;
|
||||
openFirewall = true;
|
||||
};
|
||||
|
||||
greg.proxies."jellyfin.thehellings.lan".target = "http://localhost:8096";
|
||||
greg.proxies."jellyfin.me.ts".target = "http://localhost:8096";
|
||||
|
||||
#########
|
||||
# Blind service proxy behind the walls of the VPN
|
||||
########
|
||||
services._3proxy = {
|
||||
enable = true;
|
||||
services = [ {
|
||||
type = "socks";
|
||||
auth = [ "strong" ];
|
||||
bindPort = 3128;
|
||||
acl = [ {
|
||||
rule = "allow";
|
||||
users = [ "greg" ];
|
||||
} ];
|
||||
} ];
|
||||
usersFile = "/run/agenix/3proxy";
|
||||
denyPrivate = false;
|
||||
};
|
||||
age.secrets."3proxy" = {
|
||||
file = ../../secrets/3proxy.age;
|
||||
mode = "777";
|
||||
};
|
||||
networking.firewall.allowedTCPPorts = [ 3128 ];
|
||||
}
|
||||
@@ -1,15 +0,0 @@
|
||||
# Virtual hosts that don't seem to have any better place to live should go in here.
|
||||
# There are others that are specific to their own purposese scattered about in the
|
||||
# configuration in places where they more naturally live. This is more of a catchall
|
||||
# for ones that do not have a better place to live
|
||||
{ ... }:
|
||||
|
||||
{
|
||||
greg.proxies."dns.thehellings.lan" = {
|
||||
target = "http://127.0.0.1:8384/";
|
||||
path = "/sync/";
|
||||
};
|
||||
|
||||
# The module doesn't handle this
|
||||
services.nginx.virtualHosts."dns.thehellings.lan".serverAliases = [ "dns" ];
|
||||
}
|
||||
@@ -1,11 +1,11 @@
|
||||
#!/usr/bin/env bash
|
||||
set -ex
|
||||
|
||||
|
||||
curl -s https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts | sed '1,33d' > /etc/adblock_hosts
|
||||
|
||||
# Custom domains that I need to preserve for some reason
|
||||
sed -i -e '/segment.com/d' /etc/adblock_hosts # Blocks Trelly content for house investors
|
||||
sed -i -e '/segment.io/d' /etc/adblock_hosts # Blocks Trelly content for house investors
|
||||
for f in "segment.com" "segment.io" "branch.io" "dev.visualwebsiteoptimizer.com"; do
|
||||
sed -i -e "/${f}/d" /etc/adblock_hosts # Blocks Trelly content for house investors
|
||||
done
|
||||
|
||||
systemctl restart dnsmasq
|
||||
|
||||
@@ -86,8 +86,10 @@ in
|
||||
addn-hosts = "/etc/adblock_hosts";
|
||||
# Public AdGuard DNS servers
|
||||
server = [
|
||||
"94.140.14.14"
|
||||
"94.140.15.15"
|
||||
"9.9.9.9" # Quad 9
|
||||
"1.1.1.1" # Cloudflare
|
||||
"1.0.0.1" # Cloudflare
|
||||
"149.112.112.112" # Quad 9
|
||||
];
|
||||
};
|
||||
extraConfig = "${extraConfig}";
|
||||
|
||||
@@ -36,9 +36,9 @@ in
|
||||
server_host = "127.0.0.1";
|
||||
};
|
||||
#"automation manual" = *nix config here* and so on
|
||||
"automation ui" = "";
|
||||
"script ui" = "";
|
||||
"scene ui" = "";
|
||||
"automation ui" = "!include automations.yaml";
|
||||
"script ui" = "!include scripts.yaml";
|
||||
"scene ui" = "!include scenes.yaml";
|
||||
};
|
||||
};
|
||||
|
||||
|
||||
Reference in New Issue
Block a user