root
84e4c68f0e
buildbot/nix-eval Build done.
buildbot/nix-build gitea:greg/nixos#checks.x86_64-linux.nixos-genesis Build done.
buildbot/nix-build gitea:greg/nixos#checks.x86_64-linux.nixos-exodus Build done.
buildbot/nix-build gitea:greg/nixos#checks.x86_64-linux.nixos-hosea Build done.
buildbot/nix-build gitea:greg/nixos#checks.x86_64-linux.nixos-isaiah Build done.
buildbot/nix-build gitea:greg/nixos#checks.x86_64-linux.nixos-jeremiah Build done.
buildbot/nix-build gitea:greg/nixos#checks.x86_64-linux.nixos-linode Build done.
buildbot/nix-build gitea:greg/nixos#checks.x86_64-linux.nixos-zeke Build done.
buildbot/nix-build Build done.
Per review feedback:
- nebula module now defaults unsafeRoutes to [{route=10.42.0.0/16 via=10.157.0.2}]
so all regular nodes get home LAN routing automatically
- genesis overrides unsafeRoutes=[] since it IS the routing node (avoids loop)
- exodus and all k3s nodes (hosea, isaiah, jeremiah, zeke) simplified to
nebula.enable = true only, relying on the new default
88 lines
2.4 KiB
Nix
88 lines
2.4 KiB
Nix
# Edit this configuration file to define what should be installed on
|
||
# your system. Help is available in the configuration.nix(5) man page
|
||
# and in the NixOS manual (accessible by running ‘nixos-help’).
|
||
|
||
{ lib, pkgs, ... }:
|
||
|
||
let
|
||
adblockUpdate = pkgs.writeShellApplication {
|
||
name = "adblock-update";
|
||
runtimeInputs = with pkgs; [
|
||
curl
|
||
gnused
|
||
systemd
|
||
];
|
||
text = ''
|
||
curl -s https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts | sed '1,33d' > /etc/adblock_hosts
|
||
curl -s https://adaway.org/hosts.txt | sed '1,24d' | sed 's/127.0.0.1/0.0.0.0/' >> /etc/adblock_hosts
|
||
|
||
# Custom domains that I need to preserve for some reason
|
||
for f in "segment.com" "segment.io" "branch.io" "dev.visualwebsiteoptimizer.com" "click.discord.com"; do
|
||
sed -i -e "/''${f}/d" /etc/adblock_hosts # Blocks Trelly content for house investors
|
||
done
|
||
|
||
systemctl restart dnsmasq
|
||
'';
|
||
};
|
||
in
|
||
{
|
||
imports = [
|
||
# Include the results of the hardware scan.
|
||
./hardware-configuration.nix
|
||
./networking.nix
|
||
];
|
||
|
||
greg = {
|
||
home = true;
|
||
gnome.enable = false;
|
||
nebula = {
|
||
enable = true;
|
||
# genesis IS the routing node for the home LAN — it does not route through itself.
|
||
# Override the module default (which points at genesis) to avoid a routing loop.
|
||
unsafeRoutes = [ ];
|
||
# genesis routes the home LAN (10.42.0.0/16) into the Nebula overlay.
|
||
# Sign genesis's cert with -subnets '10.42.0.0/16' (see secrets/nebula/README.md).
|
||
routesSubnet = "10.42.0.0/16";
|
||
};
|
||
proxies = {
|
||
};
|
||
};
|
||
|
||
# Bootloader.
|
||
boot.loader = {
|
||
efi = {
|
||
canTouchEfiVariables = true;
|
||
};
|
||
systemd-boot = {
|
||
enable = true;
|
||
configurationLimit = 10;
|
||
edk2-uefi-shell.enable = true;
|
||
};
|
||
};
|
||
|
||
environment.systemPackages = with pkgs; [
|
||
create_ssl
|
||
step-ca
|
||
];
|
||
|
||
networking.hostName = "genesis"; # Define your hostname.
|
||
|
||
systemd = {
|
||
services.adblock-update = {
|
||
after = [ "network-online.target" ];
|
||
requires = [ "network-online.target" ];
|
||
script = lib.getExe adblockUpdate;
|
||
serviceConfig.Type = "oneshot";
|
||
};
|
||
timers.adblock-update = {
|
||
wantedBy = [ "multi-user.target" ];
|
||
after = [ "network-online.target" ];
|
||
requires = [ "network-online.target" ];
|
||
timerConfig = {
|
||
OnCalendar = "daily";
|
||
Unit = "adblock-update.service";
|
||
};
|
||
};
|
||
};
|
||
}
|