Merge remote-tracking branch 'origin/main' into darwin
This commit is contained in:
greg-compass
@@ -2,14 +2,22 @@
|
||||
|
||||
let
|
||||
extraHosts = builtins.concatStringsSep "\n" [
|
||||
# Local hosts
|
||||
"10.42.0.1 switch"
|
||||
"10.42.1.1 router"
|
||||
"10.42.1.2 dns smart"
|
||||
"100.99.244.92 dns.me.ts"
|
||||
"10.42.1.2 2maccabees 2maccabees.thehellings.lan dns dns.thehellings.lan smart smart.thehellings.lan"
|
||||
"10.42.1.3 printer"
|
||||
"10.42.1.4 chronicles nas"
|
||||
"100.119.228.115 nas.me.ts"
|
||||
"10.42.1.12 tv"
|
||||
|
||||
# Tailscale hosts
|
||||
"100.90.74.19 jude.me.ts"
|
||||
"100.99.244.92 dns.me.ts 2maccabees.me.ts smart.me.ts"
|
||||
"100.119.228.115 chronicles.me.ts nas.me.ts"
|
||||
"100.115.57.8 linode.me.ts"
|
||||
|
||||
# Dev hosts
|
||||
"10.42.101.1 icdm.lan wiki.icdm.lan *.icdm.lan"
|
||||
];
|
||||
|
||||
extraConfig = builtins.concatStringsSep "\n" [
|
||||
|
||||
@@ -7,19 +7,44 @@ in
|
||||
{
|
||||
virtualisation.podman.enable = true;
|
||||
|
||||
services.home-assistant = {
|
||||
enable = true;
|
||||
configDir = "/var/lib/hass";
|
||||
package = (pkgs.home-assistant.override {
|
||||
extraComponents = [
|
||||
"accuweather"
|
||||
"cast"
|
||||
"eufy"
|
||||
"lovelace"
|
||||
"tplink"
|
||||
"wiz"
|
||||
"zwave_js"
|
||||
];
|
||||
}).overrideAttrs (oldAttrs: {
|
||||
doInstallCheck = false;
|
||||
});
|
||||
|
||||
config = {
|
||||
default_config = {};
|
||||
esphome = {}; # Get these things loaded, even if not configured
|
||||
met = {};
|
||||
tts = [ { platform = "google_translate"; } ];
|
||||
http = {
|
||||
use_x_forwarded_for = true;
|
||||
trusted_proxies = [ "127.0.0.1" "::1" ];
|
||||
server_host = "127.0.0.1";
|
||||
};
|
||||
"automation ui" = "!include automations.yaml";
|
||||
"script ui" = "!include scripts.yaml";
|
||||
"scene ui" = "!include scenes.yaml";
|
||||
};
|
||||
};
|
||||
|
||||
# Although NixOS has a package for Home Assistant, it is not kept as up to date as the container and the upstream
|
||||
# is very vocal about only supporting their own container or the HAOS deployments. So we deploy the container here
|
||||
# and avoid any potential messes from that
|
||||
virtualisation.oci-containers = {
|
||||
backend = "podman";
|
||||
containers."home-assistant" = {
|
||||
image = "ghcr.io/home-assistant/home-assistant:stable";
|
||||
ports = [ "127.0.0.1:8123:8123" ];
|
||||
volumes = [ "/var/lib/hass:/config" ];
|
||||
extraOptions = [
|
||||
"--device" "/dev/ttyAMA0"
|
||||
];
|
||||
};
|
||||
|
||||
# I have ZWave devices. The easiest way to connect to them is the zwavejs2mqtt service running, so we spin up
|
||||
# its container and map the ZWave device into it
|
||||
@@ -36,13 +61,6 @@ in
|
||||
# Both of the above container need storage for their configuration and devices, but it is not created correctly by
|
||||
# the container. So we add the creation of /var/lib/{zwave,hass} to the systemd Unit files
|
||||
systemd.services = {
|
||||
"podman-home-assistant" = {
|
||||
serviceConfig = {
|
||||
StateDirectory = "hass";
|
||||
StateDirectoryMode = pkgs.lib.mkForce "0777";
|
||||
};
|
||||
};
|
||||
|
||||
"podman-zwave".serviceConfig = {
|
||||
StateDirectory = "zwave";
|
||||
StateDirectoryMode = pkgs.lib.mkForce "0777";
|
||||
@@ -50,74 +68,12 @@ in
|
||||
};
|
||||
|
||||
|
||||
# Podman 3.4, which is in NixOS 21.11 does not support creating multiple network interfaces during launch. Starting in Podman
|
||||
# 4.0 (NixOS 22.05) that will be possible. For now, adding this sidecar service that executes after every time the Home Assistant
|
||||
# container is started will do the necessary Podman commands to attach the container to the interface for VLAN 66. Once we
|
||||
# upgrade to NixOS 22.05 this service can go away and we can explicitly add two "--network" options to the Home Assistant container
|
||||
systemd.services."home-assistant-network-attach" = {
|
||||
requires = service_list;
|
||||
path = [ pkgs.podman pkgs.coreutils ];
|
||||
script = "sleep 10 && podman network connect podman66 home-assistant";
|
||||
wantedBy = service_list;
|
||||
serviceConfig = {
|
||||
Type = "oneshot";
|
||||
};
|
||||
};
|
||||
|
||||
# This ensures that Podman has a separate network configured to attach to my IOT VLAN so that Home Assistant is able to communicate
|
||||
# with my devices as well as with the rest of the LAN.
|
||||
systemd.services.podman66 = {
|
||||
wantedBy = service_list;
|
||||
before = service_list;
|
||||
path = [ pkgs.podman ];
|
||||
script = "podman network create -d macvlan -o parent=vlan66 --subnet 192.168.66.0/24 --ip-range 192.168.66.192/26 --gateway 192.168.66.1 podman66 || true";
|
||||
serviceConfig = {
|
||||
Type = "oneshot";
|
||||
};
|
||||
};
|
||||
|
||||
# I do not want to have to remember the port number for Home Assistant's UI, so we use Nginx to proxy communication from
|
||||
# smart.thehellings.lan to the Home Assistant UI
|
||||
# After the first activation of this container, before you can access the Home Assistant UI, you need to ensure that the
|
||||
# Home Assistant's configuration at /var/lib/hass/configuration.yaml includes the following option. Update the IP address
|
||||
# if you have changed the value of your default podman network.
|
||||
# ```yaml
|
||||
# http:
|
||||
# use_x_forwarded_for: true
|
||||
# trusted_proxies:
|
||||
# - "10.88.0.1"
|
||||
# ```
|
||||
# Home assistant will not accept connections from the proxy if these values are not set. If you are adding those values
|
||||
# manually after initial creation of the containers, then you will need to issue `systemctl restart podman-home-assistant.service`
|
||||
# for Home Assistant to pick up the new values. After that, proxy connections should work well. If you are sitting behind
|
||||
# multiple layers of proxies, then add more of them in the list. The list also accepts subnet notation in case you have
|
||||
# multiple potentially incoming connections. So you could do "10.88.0.1/24", according to the docs. However, that has not
|
||||
# worked in my testing, as Home Assistant throws an error on start up saying that value is invalid
|
||||
greg.proxies."smart.thehellings.lan".target = "http://127.0.0.1:8123";
|
||||
|
||||
# Ensure that both ports are up and running. We keep 8123 directly open because we are on the LAN and sometimes want to connect
|
||||
# directly for troubleshooting Nginx configuration
|
||||
networking.firewall = {
|
||||
enable = true;
|
||||
allowedTCPPorts = [ 80 8123 ];
|
||||
};
|
||||
|
||||
# No data is secure unless it is backed up! So we back up the data on this node to our NAS using Syncthing, from there we will
|
||||
# handle things like off site
|
||||
services.syncthing = {
|
||||
enable = true;
|
||||
folders = {
|
||||
"asdf-fdsa" = {
|
||||
enable = true;
|
||||
path = "/var/lib/hass";
|
||||
devices = [ "nas" ];
|
||||
};
|
||||
|
||||
"zwave-live" = {
|
||||
enable = true;
|
||||
path = "/var/lib/zwave";
|
||||
devices = [ "nas" ];
|
||||
};
|
||||
};
|
||||
allowedTCPPorts = [ 80 8091 8123 ];
|
||||
};
|
||||
}
|
||||
|
||||
@@ -20,11 +20,6 @@
|
||||
address = "192.168.66.2";
|
||||
prefixLength = 24;
|
||||
} ];
|
||||
|
||||
vlan67.ipv4.addresses = [ {
|
||||
address = "192.168.67.2";
|
||||
prefixLength = 24;
|
||||
} ];
|
||||
};
|
||||
|
||||
vlans = {
|
||||
@@ -32,10 +27,6 @@
|
||||
id = 66;
|
||||
interface = "eth0";
|
||||
};
|
||||
vlan67 = {
|
||||
id = 67;
|
||||
interface = "eth0";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
|
||||
@@ -2,7 +2,7 @@
|
||||
{
|
||||
|
||||
imports = [
|
||||
"${nixpkgs}/nixos/modules/installer/cd-dvd/installation-cd-base.nix"
|
||||
"${nixpkgs}/nixos/modules/installer/cd-dvd/installation-cd-graphical-calamares-gnome.nix"
|
||||
];
|
||||
|
||||
networking.networkmanager.enable = lib.mkForce false;
|
||||
|
||||
@@ -0,0 +1,15 @@
|
||||
{ ... }:
|
||||
|
||||
{
|
||||
# Use the systemd-boot EFI boot loader.
|
||||
#boot.loader.systemd-boot.enable = true;
|
||||
boot.loader.grub.device = "/dev/nvme0n1";
|
||||
boot.loader.grub.useOSProber = true;
|
||||
boot.loader.grub.extraEntries = ''
|
||||
menuentry "Windows" {
|
||||
chainloader (hd0,2)+1
|
||||
}
|
||||
'';
|
||||
boot.loader.efi.canTouchEfiVariables = true;
|
||||
networking.interfaces.enp4s0.useDHCP = true;
|
||||
}
|
||||
@@ -0,0 +1,15 @@
|
||||
{ ... }:
|
||||
|
||||
{
|
||||
imports = [
|
||||
./boot.nix
|
||||
./hardware-configuration.nix
|
||||
./podman.nix
|
||||
./printing.nix
|
||||
./virt.nix
|
||||
];
|
||||
programs.steam.enable = true;
|
||||
networking.hostName = "jude";
|
||||
greg.tailscale.enable = true;
|
||||
greg.gnome.enable= true;
|
||||
}
|
||||
@@ -0,0 +1,24 @@
|
||||
# Do not modify this file! It was generated by ‘nixos-generate-config’
|
||||
# and may be overwritten by future invocations. Please make changes
|
||||
# to /etc/nixos/configuration.nix instead.
|
||||
{ config, lib, pkgs, modulesPath, ... }:
|
||||
|
||||
{
|
||||
imports =
|
||||
[ (modulesPath + "/installer/scan/not-detected.nix")
|
||||
];
|
||||
|
||||
boot.initrd.availableKernelModules = [ "nvme" "xhci_pci" "ahci" "usbhid" "usb_storage" "sd_mod" ];
|
||||
boot.initrd.kernelModules = [ ];
|
||||
boot.kernelModules = [ "kvm-amd" ];
|
||||
boot.extraModulePackages = [ ];
|
||||
|
||||
fileSystems."/" =
|
||||
{ device = "/dev/disk/by-uuid/27ae91ed-32e9-411e-8227-0d99e360fbbf";
|
||||
fsType = "btrfs";
|
||||
};
|
||||
|
||||
swapDevices = [ ];
|
||||
|
||||
hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
|
||||
}
|
||||
@@ -0,0 +1,8 @@
|
||||
{ ... }:
|
||||
|
||||
{
|
||||
virtualisation.podman = {
|
||||
enable = true;
|
||||
dockerCompat = true;
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,12 @@
|
||||
{ pkgs, ... }:
|
||||
|
||||
{
|
||||
# ipp://printer.thehellings.lan:631/ - generic postscript printer
|
||||
services.printing = {
|
||||
enable = true;
|
||||
drivers = with pkgs; [
|
||||
gutenprint
|
||||
gutenprintBin
|
||||
];
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,31 @@
|
||||
{ pkgs, ... }:
|
||||
|
||||
{
|
||||
environment.systemPackages = with pkgs; [
|
||||
ansible
|
||||
libguestfs
|
||||
packer
|
||||
virt-manager
|
||||
vagrant
|
||||
];
|
||||
|
||||
# Give my user access to the libvirtd process
|
||||
users.users.greg.extraGroups = [ "libvirtd" ];
|
||||
|
||||
virtualisation = {
|
||||
libvirtd = {
|
||||
enable = true;
|
||||
onBoot = "ignore"; # Do not auto-restart VMs on boot, unless they are marked autostart
|
||||
};
|
||||
|
||||
waydroid = {
|
||||
enable = true;
|
||||
};
|
||||
|
||||
virtualbox.host.enable = true;
|
||||
};
|
||||
|
||||
users.extraGroups.vboxusers.members = [ "greg" ];
|
||||
|
||||
boot.extraModprobeConfig = "options kvm_amd nested=1";
|
||||
}
|
||||
@@ -0,0 +1,15 @@
|
||||
{ ... }:
|
||||
|
||||
{
|
||||
imports = [
|
||||
./hardware-configuration.nix
|
||||
];
|
||||
# Bootloader.
|
||||
boot.loader.systemd-boot.enable = true;
|
||||
boot.loader.efi.canTouchEfiVariables = true;
|
||||
boot.loader.efi.efiSysMountPoint = "/boot/efi";
|
||||
# Graphics, please
|
||||
greg.gnome.enable = true;
|
||||
# Set host name
|
||||
networking.hostName = "lappy";
|
||||
}
|
||||
@@ -0,0 +1,39 @@
|
||||
# Do not modify this file! It was generated by ‘nixos-generate-config’
|
||||
# and may be overwritten by future invocations. Please make changes
|
||||
# to /etc/nixos/configuration.nix instead.
|
||||
{ config, lib, pkgs, modulesPath, ... }:
|
||||
|
||||
{
|
||||
imports =
|
||||
[ (modulesPath + "/installer/scan/not-detected.nix")
|
||||
];
|
||||
|
||||
boot.initrd.availableKernelModules = [ "xhci_pci" "ehci_pci" "ahci" "usb_storage" "sd_mod" "sr_mod" "rtsx_usb_sdmmc" ];
|
||||
boot.initrd.kernelModules = [ ];
|
||||
boot.kernelModules = [ "kvm-intel" ];
|
||||
boot.extraModulePackages = [ ];
|
||||
|
||||
fileSystems."/" =
|
||||
{ device = "/dev/disk/by-uuid/63bcc80e-0501-4aef-bb58-30bb83881055";
|
||||
fsType = "ext4";
|
||||
};
|
||||
|
||||
fileSystems."/boot/efi" =
|
||||
{ device = "/dev/disk/by-uuid/C617-B2B1";
|
||||
fsType = "vfat";
|
||||
};
|
||||
|
||||
swapDevices =
|
||||
[ { device = "/dev/disk/by-uuid/bc4f24a3-5969-4bcb-95f4-f80109e36ebb"; }
|
||||
];
|
||||
|
||||
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
|
||||
# (the default) this is the recommended approach. When using systemd-networkd it's
|
||||
# still possible to use this option, but it's recommended to use it in conjunction
|
||||
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
|
||||
networking.useDHCP = lib.mkDefault true;
|
||||
# networking.interfaces.enp7s0.useDHCP = lib.mkDefault true;
|
||||
# networking.interfaces.wlp6s0.useDHCP = lib.mkDefault true;
|
||||
|
||||
hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
|
||||
}
|
||||
@@ -10,6 +10,7 @@
|
||||
];
|
||||
greg.home = false;
|
||||
greg.linode.enable = true;
|
||||
greg.tailscale.enable = true;
|
||||
networking.hostName = "linode";
|
||||
networking.domain = "thehellings.com";
|
||||
}
|
||||
|
||||
@@ -25,13 +25,9 @@
|
||||
enableACME = true;
|
||||
};
|
||||
|
||||
services.syncthing.folders."nextcloud-backup" = {
|
||||
path = "${config.services.nextcloud.datadir}";
|
||||
enable = true;
|
||||
devices = [ "nas" ];
|
||||
greg.backup.jobs.nextcloud = {
|
||||
src = "/var/lib/nextcloud";
|
||||
dest = "nextcloud-backup";
|
||||
user = "nextcloud";
|
||||
};
|
||||
|
||||
services.cron.systemCronJobs = [
|
||||
"59 2 * * * root chmod -R a+r ${config.services.syncthing.folders.nextcloud-backup.path} && find ${config.services.syncthing.folders.nextcloud-backup.path} -type d -exec chmod a+x '{}' \\;"
|
||||
];
|
||||
}
|
||||
|
||||
@@ -5,7 +5,7 @@ in
|
||||
{
|
||||
security.acme = {
|
||||
acceptTerms = true;
|
||||
email = "greg.hellings@gmail.com";
|
||||
defaults.email = "greg.hellings@gmail.com";
|
||||
};
|
||||
|
||||
services.nginx = {
|
||||
@@ -30,5 +30,6 @@ in
|
||||
greg.proxies."thehellings.com" = {
|
||||
target = "http://${homepage}/";
|
||||
ssl = true;
|
||||
genAliases = false;
|
||||
};
|
||||
}
|
||||
|
||||
+18
-12
@@ -27,25 +27,31 @@ root root postgres
|
||||
'';
|
||||
};
|
||||
|
||||
services.postgresqlBackup.enable = true;
|
||||
services.postgresqlBackup = {
|
||||
enable = true;
|
||||
databases = [
|
||||
"nextcloud"
|
||||
"synapse"
|
||||
];
|
||||
};
|
||||
|
||||
services.logrotate = {
|
||||
enable = true;
|
||||
paths = {
|
||||
postgres = {
|
||||
settings = {
|
||||
postgresBackup = {
|
||||
enable = true;
|
||||
path = "${config.services.postgresqlBackup.location}/*.gz";
|
||||
files = "${config.services.postgresqlBackup.location}/*.gz";
|
||||
};
|
||||
postgresLog = {
|
||||
enable = true;
|
||||
files = "/var/lib/postgresql/*/log/*.log";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
services.syncthing.folders."postgres-backups" = {
|
||||
path = "${config.services.postgresqlBackup.location}";
|
||||
enable = true;
|
||||
devices = [ "nas" ];
|
||||
greg.backup.jobs.postgresql = {
|
||||
src = "/var/backup/postgresql";
|
||||
dest = "linode-postgres";
|
||||
user = "postgres";
|
||||
};
|
||||
|
||||
services.cron.systemCronJobs = [
|
||||
"59 2 * * * root chmod -R a+r ${config.services.postgresqlBackup.location} && find ${config.services.postgresqlBackup.location} -type d -exec chmod a+x '{}' \\;"
|
||||
];
|
||||
}
|
||||
|
||||
+22
-18
@@ -74,26 +74,30 @@ return 200 '${builtins.toJSON client}';
|
||||
|
||||
services.matrix-synapse = {
|
||||
enable = true;
|
||||
database_name = "synapse";
|
||||
database_user = "matrix-synapse";
|
||||
# Identify ourselves as the root of our own domain
|
||||
server_name = "thehellings.com";
|
||||
#registration_shared_secret = "B9EoPr2WV9hzwc7uL2Sx1JmvCeKDEOGCpB0uginQcQtEH4wzRtkSIdo7lltrjSQa";
|
||||
# Bind a single listener to localhost only, disable SSL/TLS, and put
|
||||
# it behind an nginx proxy
|
||||
listeners = [ {
|
||||
port = 8448;
|
||||
bind_address = "127.0.0.1";
|
||||
type = "http"; # Offload SSL/TLS to Nginx
|
||||
tls = false;
|
||||
resources = [ {
|
||||
names = [ "client" "federation" ];
|
||||
compress = false; # Offload compressiong to Nginx
|
||||
settings = {
|
||||
database.args = {
|
||||
user = "matrix-synapse";
|
||||
database = "synapse";
|
||||
};
|
||||
server_name = "thehellings.com";
|
||||
#registration_shared_secret = "B9EoPr2WV9hzwc7uL2Sx1JmvCeKDEOGCpB0uginQcQtEH4wzRtkSIdo7lltrjSQa";
|
||||
# Bind a single listener to localhost only, disable SSL/TLS, and put
|
||||
# it behind an nginx proxy
|
||||
listeners = [ {
|
||||
port = 8448;
|
||||
bind_addresses = ["127.0.0.1"];
|
||||
type = "http"; # Offload SSL/TLS to Nginx
|
||||
tls = false;
|
||||
resources = [ {
|
||||
names = [ "client" "federation" ];
|
||||
compress = false; # Offload compressiong to Nginx
|
||||
} ];
|
||||
} ];
|
||||
} ];
|
||||
app_service_config_files = [
|
||||
"/etc/${fbRegistrationFile}"
|
||||
];
|
||||
app_service_config_files = [
|
||||
"/etc/${fbRegistrationFile}"
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
# Open networking ports for the server
|
||||
|
||||
Reference in New Issue
Block a user