organization
This commit is contained in:
parent
440348d1e5
commit
7a31cdd170
3 changed files with 296 additions and 168 deletions
|
|
@ -1,12 +1,13 @@
|
|||
# hosts/valefar/configuration.nix (or default.nix)
|
||||
{ config, lib, pkgs, modulesPath, inputs, ... }:
|
||||
|
||||
{
|
||||
# =============================================================================
|
||||
# IMPORTS
|
||||
# =============================================================================
|
||||
imports = [
|
||||
# Host-specific hardware
|
||||
./hardware.nix
|
||||
./secrets.nix
|
||||
#../../common/nvidia.nix
|
||||
|
||||
# Common modules shared across hosts
|
||||
../../common/system.nix
|
||||
|
|
@ -16,48 +17,112 @@
|
|||
|
||||
# Common secrets
|
||||
../../host-secrets.nix
|
||||
|
||||
# Hardware-specific (commented out)
|
||||
# ../../common/nvidia.nix
|
||||
];
|
||||
|
||||
# Enable modules
|
||||
# =============================================================================
|
||||
# SYSTEM CONFIGURATION
|
||||
# =============================================================================
|
||||
system.stateVersion = "24.11";
|
||||
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
|
||||
|
||||
# Intel microcode updates
|
||||
hardware.cpu.intel.updateMicrocode = lib.mkDefault
|
||||
config.hardware.enableRedistributableFirmware;
|
||||
|
||||
# =============================================================================
|
||||
# CUSTOM MODULES
|
||||
# =============================================================================
|
||||
modules.garage.enable = true;
|
||||
modules.forgejo.enable = true;
|
||||
modules.immich.enable = true;
|
||||
|
||||
system.stateVersion = "24.11";
|
||||
|
||||
# pin host platform & microcorre
|
||||
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
|
||||
hardware.cpu.intel.updateMicrocode = lib.mkDefault
|
||||
config.hardware.enableRedistributableFirmware;
|
||||
|
||||
networking.hostName = "valefar";
|
||||
networking.hostId = "2a07da90";
|
||||
|
||||
# =============================================================================
|
||||
# NETWORKING
|
||||
# =============================================================================
|
||||
networking = {
|
||||
hostName = "valefar";
|
||||
hostId = "2a07da90";
|
||||
firewall.enable = false;
|
||||
firewall.trustedInterfaces = [
|
||||
"tailscale0"
|
||||
];
|
||||
nameservers = [ "10.0.0.210" "1.1.1.1" ];
|
||||
useDHCP = true;
|
||||
firewall.allowedTCPPorts = [22 80 443 2456 2457 9000 9001 9002];
|
||||
firewall.trustedInterfaces = [ "tailscale0" ];
|
||||
nameservers = [ "10.0.0.210" "1.1.1.1" ];
|
||||
useDHCP = true;
|
||||
firewall.allowedTCPPorts = [ 22 80 443 2049 2456 2457 9000 9001 9002 ];
|
||||
firewall.allowedUDPPorts = [ 2049 ];
|
||||
};
|
||||
|
||||
# DNS resolution
|
||||
services.resolved = {
|
||||
enable = true;
|
||||
dnssec = "false";
|
||||
domains = [ "~." ];
|
||||
enable = true;
|
||||
dnssec = "false";
|
||||
domains = [ "~." ];
|
||||
fallbackDns = [ "10.0.0.210" "1.1.1.1" ];
|
||||
dnsovertls = "false";
|
||||
dnsovertls = "false";
|
||||
};
|
||||
|
||||
boot.supportedFilesystems = [ "zfs" ];
|
||||
boot.kernelModules = [ "nct6775" "coretemp" ];
|
||||
|
||||
boot.zfs.extraPools = [ "garage" "storage" ];
|
||||
boot.zfs.devNodes = "/dev/disk/by-id";
|
||||
boot.zfs.forceImportAll = true;
|
||||
# =============================================================================
|
||||
# BOOT & FILESYSTEMS
|
||||
# =============================================================================
|
||||
boot = {
|
||||
supportedFilesystems = [ "zfs" ];
|
||||
kernelModules = [ "nct6775" "coretemp" ];
|
||||
|
||||
zfs = {
|
||||
extraPools = [ "garage" "storage" ];
|
||||
devNodes = "/dev/disk/by-id";
|
||||
forceImportAll = true;
|
||||
};
|
||||
};
|
||||
|
||||
# =============================================================================
|
||||
# ZFS CONFIGURATION
|
||||
# =============================================================================
|
||||
# ZFS import services
|
||||
systemd.services.zfs-import-cache.enable = false;
|
||||
systemd.services.zfs-import-scan = {
|
||||
enable = true;
|
||||
after = [ "systemd-udev-settle.service" ];
|
||||
wants = [ "systemd-udev-settle.service" ];
|
||||
};
|
||||
|
||||
# ZFS mount points
|
||||
systemd.mounts = [
|
||||
{
|
||||
what = "garage";
|
||||
where = "/garage";
|
||||
type = "zfs";
|
||||
after = [ "zfs-import-scan.service" ];
|
||||
wants = [ "zfs-import-scan.service" ];
|
||||
}
|
||||
{
|
||||
what = "storage";
|
||||
where = "/storage";
|
||||
type = "zfs";
|
||||
after = [ "zfs-import-scan.service" ];
|
||||
wants = [ "zfs-import-scan.service" ];
|
||||
}
|
||||
];
|
||||
|
||||
# ZFS maintenance
|
||||
services.zfs = {
|
||||
autoScrub.enable = true;
|
||||
trim.enable = true;
|
||||
};
|
||||
|
||||
# =============================================================================
|
||||
# DIRECTORY STRUCTURE
|
||||
# =============================================================================
|
||||
systemd.tmpfiles.rules = [
|
||||
"d /storage/immich 0755 immich immich -"
|
||||
"d /storage/immich/photos 0755 immich immich -"
|
||||
"Z /storage/immich 0755 immich immich -" # Recursively fix ownership of existing files
|
||||
];
|
||||
|
||||
# =============================================================================
|
||||
# NFS SERVER
|
||||
# =============================================================================
|
||||
services.nfs.server = {
|
||||
enable = true;
|
||||
exports = ''
|
||||
|
|
@ -65,59 +130,17 @@
|
|||
'';
|
||||
};
|
||||
|
||||
/*boot.kernelParams = [ "ip=dhcp" ];
|
||||
boot.initrd = {
|
||||
availableKernelModules = [ "r8169" ];
|
||||
network = {
|
||||
enable = true;
|
||||
ssh = {
|
||||
enable = true;
|
||||
port = 22;
|
||||
authorizedKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJ0pU82lV9dSjkgYbdh9utZ5CDM2dPN70S5fBqN1m3Pb" ];
|
||||
hostKeys = [ "/etc/secrets/initrd/ssh_host_rsa_key" ];
|
||||
shell = "/bin/cryptsetup-askpass";
|
||||
};
|
||||
};
|
||||
};*/
|
||||
|
||||
systemd.services.zfs-import-cache.enable = false;
|
||||
systemd.services.zfs-import-scan.enable = true;
|
||||
|
||||
systemd.services.zfs-import-scan = {
|
||||
after = [ "systemd-udev-settle.service" ];
|
||||
wants = [ "systemd-udev-settle.service" ];
|
||||
# =============================================================================
|
||||
# SERVICES
|
||||
# =============================================================================
|
||||
services.vscode-server = {
|
||||
enable = true;
|
||||
nodejsPackage = pkgs.nodejs_20;
|
||||
};
|
||||
|
||||
systemd.mounts = [{
|
||||
what = "garage";
|
||||
where = "/garage";
|
||||
type = "zfs";
|
||||
after = [ "zfs-import-scan.service" ];
|
||||
wants = [ "zfs-import-scan.service" ];
|
||||
} {
|
||||
what = "storage";
|
||||
where = "/storage";
|
||||
type = "zfs";
|
||||
after = [ "zfs-import-scan.service" ];
|
||||
wants = [ "zfs-import-scan.service" ];
|
||||
}];
|
||||
|
||||
systemd.tmpfiles.rules = [
|
||||
"d /storage/immich 0755 immich immich -"
|
||||
];
|
||||
|
||||
services.zfs.autoScrub.enable = true;
|
||||
services.zfs.trim.enable = true;
|
||||
|
||||
services.vscode-server.enable = true;
|
||||
services.vscode-server.nodejsPackage = pkgs.nodejs_20;
|
||||
|
||||
environment.systemPackages = with pkgs; [
|
||||
lm_sensors
|
||||
code-server
|
||||
inputs.agenix.packages.x86_64-linux.default
|
||||
];
|
||||
|
||||
# =============================================================================
|
||||
# VIRTUALIZATION
|
||||
# =============================================================================
|
||||
virtualisation.docker = {
|
||||
enable = true;
|
||||
enableOnBoot = true;
|
||||
|
|
@ -125,4 +148,32 @@
|
|||
buildGoModule = pkgs.buildGo123Module;
|
||||
};
|
||||
};
|
||||
}
|
||||
|
||||
# =============================================================================
|
||||
# PACKAGES
|
||||
# =============================================================================
|
||||
environment.systemPackages = with pkgs; [
|
||||
lm_sensors
|
||||
code-server
|
||||
inputs.agenix.packages.x86_64-linux.default
|
||||
];
|
||||
|
||||
# =============================================================================
|
||||
# COMMENTED OUT / DISABLED
|
||||
# =============================================================================
|
||||
# Remote unlock via SSH (commented out)
|
||||
# boot.kernelParams = [ "ip=dhcp" ];
|
||||
# boot.initrd = {
|
||||
# availableKernelModules = [ "r8169" ];
|
||||
# network = {
|
||||
# enable = true;
|
||||
# ssh = {
|
||||
# enable = true;
|
||||
# port = 22;
|
||||
# authorizedKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJ0pU82lV9dSjkgYbdh9utZ5CDM2dPN70S5fBqN1m3Pb" ];
|
||||
# hostKeys = [ "/etc/secrets/initrd/ssh_host_rsa_key" ];
|
||||
# shell = "/bin/cryptsetup-askpass";
|
||||
# };
|
||||
# };
|
||||
# };
|
||||
}
|
||||
Loading…
Add table
Add a link
Reference in a new issue