waveringana/nixcfg
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

organization

Browse source
This commit is contained in:
waveringana 2025-06-17 19:34:05 -04:00
parent 440348d1e5
commit 7a31cdd170
3 changed files with 296 additions and 168 deletions
Download patch file Download diff file Expand all files Collapse all files

85
hosts/buer/default.nix
View file

@ -1,7 +1,9 @@
# hosts/valefar/configuration.nix (or default.nix) # hosts/buer/configuration.nix (or default.nix)
{ config, lib, pkgs, modulesPath, inputs, ... }: { config, lib, pkgs, modulesPath, inputs, ... }:
{ {
# =============================================================================
# IMPORTS
# =============================================================================
imports = [ imports = [
# Host-specific hardware # Host-specific hardware
./hardware.nix ./hardware.nix
@ -12,28 +14,47 @@
../../common/users.nix ../../common/users.nix
../../common/services.nix ../../common/services.nix
# Common secrets # Common secrets
../../host-secrets.nix ../../host-secrets.nix
]; ];
# =============================================================================
# SYSTEM CONFIGURATION
# =============================================================================
system.stateVersion = "24.11"; system.stateVersion = "24.11";
modules.garage.enable = true;
# pin host platform & microcode
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux"; nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
# Intel microcode updates
hardware.cpu.intel.updateMicrocode = lib.mkDefault hardware.cpu.intel.updateMicrocode = lib.mkDefault
config.hardware.enableRedistributableFirmware; config.hardware.enableRedistributableFirmware;
boot.loader.grub.enable = true; # =============================================================================
boot.loader.grub.device = "/dev/vda"; # CUSTOM MODULES
# =============================================================================
modules.garage.enable = true;
networking.hostName = "buer"; # =============================================================================
networking.hostId = "1418d29e"; # BOOT CONFIGURATION
networking.firewall.enable = false; # =============================================================================
networking.useDHCP = false; boot.loader.grub = {
systemd.network.enable = true; enable = true;
systemd.network.networks."10-wan" = { device = "/dev/vda";
};
# =============================================================================
# NETWORKING
# =============================================================================
networking = {
hostName = "buer";
hostId = "1418d29e";
firewall.enable = false;
useDHCP = false;
};
# Static IP configuration via systemd-networkd
systemd.network = {
enable = true;
networks."10-wan" = {
matchConfig.Name = "ens3"; matchConfig.Name = "ens3";
address = [ address = [
"103.251.165.107/24" "103.251.165.107/24"
@ -50,19 +71,11 @@
"5.255.125.240" "5.255.125.240"
]; ];
}; };
};
#boot.supportedFilesystems = [ "zfs" ]; # =============================================================================
#boot.kernelModules = [ "nct6775" "coretemp" ]; # VIRTUALIZATION
# =============================================================================
#services.zfs.autoScrub.enable = true;
#services.zfs.trim.enable = true;
environment.systemPackages = with pkgs; [
#lm_sensors
#code-server
inputs.agenix.packages.x86_64-linux.default
];
virtualisation.docker = { virtualisation.docker = {
enable = true; enable = true;
enableOnBoot = true; enableOnBoot = true;
@ -70,4 +83,24 @@
buildGoModule = pkgs.buildGo123Module; buildGoModule = pkgs.buildGo123Module;
}; };
}; };
# =============================================================================
# PACKAGES
# =============================================================================
environment.systemPackages = with pkgs; [
inputs.agenix.packages.x86_64-linux.default
];
# =============================================================================
# COMMENTED OUT / DISABLED
# =============================================================================
# ZFS support (not needed for this VPS)
# boot.supportedFilesystems = [ "zfs" ];
# boot.kernelModules = [ "nct6775" "coretemp" ];
# services.zfs.autoScrub.enable = true;
# services.zfs.trim.enable = true;
# Additional packages (not needed)
# lm_sensors
# code-server
} }

112
hosts/focalor/default.nix
View file

@ -1,7 +1,9 @@
# hosts/valefar/configuration.nix (or default.nix) # hosts/focalor/configuration.nix (or default.nix)
{ config, lib, system, pkgs, modulesPath, inputs, ... }: { config, lib, system, pkgs, modulesPath, inputs, ... }:
{ {
# =============================================================================
# IMPORTS
# =============================================================================
imports = [ imports = [
# Host-specific hardware # Host-specific hardware
./hardware.nix ./hardware.nix
@ -20,32 +22,45 @@
../../common/desktop/sway.nix ../../common/desktop/sway.nix
../../common/desktop/vnc.nix ../../common/desktop/vnc.nix
# Nvidia # Hardware-specific
../../common/nvidia.nix ../../common/nvidia.nix
# Common secrets # Common secrets (commented out)
# ../../host-secrets.nix # ../../host-secrets.nix
]; ];
# =============================================================================
# SYSTEM CONFIGURATION
# =============================================================================
system.stateVersion = "25.05"; system.stateVersion = "25.05";
# pin host platform & microcode
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux"; nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
# Cross-compilation support
boot.binfmt.emulatedSystems = [ "aarch64-linux" ]; boot.binfmt.emulatedSystems = [ "aarch64-linux" ];
nix.settings.extra-platforms = config.boot.binfmt.emulatedSystems; nix.settings.extra-platforms = config.boot.binfmt.emulatedSystems;
networking.hostName = "focalor"; # =============================================================================
networking.hostId = "84bdc587"; # NETWORKING
# =============================================================================
networking = {
hostName = "focalor";
hostId = "84bdc587";
firewall.enable = false;
firewall.trustedInterfaces = [ "tailscale0" ];
nameservers = [ "10.0.0.210" "1.1.1.1" ];
};
# Systemd networking with bridge
systemd.network = { systemd.network = {
enable = true; enable = true;
netdevs."br0" = { netdevs."br0" = {
netdevConfig = { netdevConfig = {
Name = "br0"; Name = "br0";
Kind = "bridge"; Kind = "bridge";
}; };
}; };
networks = { networks = {
"10-lan" = { "10-lan" = {
matchConfig.Name = ["enp5s0" "vm-*"]; matchConfig.Name = ["enp5s0" "vm-*"];
@ -53,6 +68,7 @@
Bridge = "br0"; Bridge = "br0";
}; };
}; };
"10-lan-bridge" = { "10-lan-bridge" = {
matchConfig.Name = "br0"; matchConfig.Name = "br0";
networkConfig = { networkConfig = {
@ -66,18 +82,7 @@
}; };
}; };
programs.steam.enable = true; # DNS resolution
networking = {
firewall.enable = false;
firewall.trustedInterfaces = [
"tailscale0"
];
nameservers = [ "10.0.0.210" "1.1.1.1" ];
#useDHCP = true;
#firewall.allowedTCPPorts = [22 80 443 2456 2457 9000 9001 9002];
};
services.resolved = { services.resolved = {
enable = true; enable = true;
dnssec = "true"; dnssec = "true";
@ -86,15 +91,28 @@
dnsovertls = "true"; dnsovertls = "true";
}; };
#boot.supportedFilesystems = [ "zfs" ]; # =============================================================================
#boot.kernelModules = [ "nct6775" "coretemp" ]; # FILESYSTEM & STORAGE
# =============================================================================
boot.supportedFilesystems = [ "nfs" ];
#services.zfs.autoScrub.enable = true; fileSystems."/mnt/storage" = {
#services.zfs.trim.enable = true; device = "valefar:/storage";
fsType = "nfs";
};
services.vscode-server.enable = true; # =============================================================================
services.vscode-server.nodejsPackage = pkgs.nodejs_20; # SERVICES
# =============================================================================
services.vscode-server = {
enable = true;
nodejsPackage = pkgs.nodejs_20;
};
# =============================================================================
# PROGRAMS & APPLICATIONS
# =============================================================================
programs.steam.enable = true;
programs.obs-studio = { programs.obs-studio = {
enable = true; enable = true;
@ -104,14 +122,9 @@
]; ];
}; };
environment.systemPackages = with pkgs; [ # =============================================================================
#lm_sensors # VIRTUALIZATION
#code-server # =============================================================================
inputs.agenix.packages.x86_64-linux.default
];
environment.sessionVariables.WLR_RENDERER = "vulkan";
virtualisation.docker = { virtualisation.docker = {
enable = true; enable = true;
enableOnBoot = true; enableOnBoot = true;
@ -120,6 +133,13 @@
}; };
}; };
# =============================================================================
# DESKTOP ENVIRONMENT
# =============================================================================
# Vulkan renderer for Wayland
environment.sessionVariables.WLR_RENDERER = "vulkan";
# XDG Portals
xdg.portal = { xdg.portal = {
enable = true; enable = true;
wlr.enable = true; wlr.enable = true;
@ -128,4 +148,28 @@
xdg-desktop-portal-gnome xdg-desktop-portal-gnome
]; ];
}; };
# =============================================================================
# PACKAGES
# =============================================================================
environment.systemPackages = with pkgs; [
inputs.agenix.packages.x86_64-linux.default
];
# =============================================================================
# COMMENTED OUT / DISABLED
# =============================================================================
# ZFS support (disabled for this host)
# boot.supportedFilesystems = [ "zfs" ];
# boot.kernelModules = [ "nct6775" "coretemp" ];
# services.zfs.autoScrub.enable = true;
# services.zfs.trim.enable = true;
# Additional packages (commented out)
# lm_sensors
# code-server
# DHCP (disabled in favor of systemd-networkd)
# useDHCP = true;
# firewall.allowedTCPPorts = [22 80 443 2456 2457 9000 9001 9002];
} }

195
hosts/valefar/default.nix
View file

@ -1,12 +1,13 @@
# hosts/valefar/configuration.nix (or default.nix) # hosts/valefar/configuration.nix (or default.nix)
{ config, lib, pkgs, modulesPath, inputs, ... }: { config, lib, pkgs, modulesPath, inputs, ... }:
{ {
# =============================================================================
# IMPORTS
# =============================================================================
imports = [ imports = [
# Host-specific hardware # Host-specific hardware
./hardware.nix ./hardware.nix
./secrets.nix ./secrets.nix
#../../common/nvidia.nix
# Common modules shared across hosts # Common modules shared across hosts
../../common/system.nix ../../common/system.nix
@ -16,33 +17,43 @@
# Common secrets # Common secrets
../../host-secrets.nix ../../host-secrets.nix
# Hardware-specific (commented out)
# ../../common/nvidia.nix
]; ];
# Enable modules # =============================================================================
# SYSTEM CONFIGURATION
# =============================================================================
system.stateVersion = "24.11";
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
# Intel microcode updates
hardware.cpu.intel.updateMicrocode = lib.mkDefault
config.hardware.enableRedistributableFirmware;
# =============================================================================
# CUSTOM MODULES
# =============================================================================
modules.garage.enable = true; modules.garage.enable = true;
modules.forgejo.enable = true; modules.forgejo.enable = true;
modules.immich.enable = true; modules.immich.enable = true;
system.stateVersion = "24.11"; # =============================================================================
# NETWORKING
# pin host platform & microcorre # =============================================================================
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
hardware.cpu.intel.updateMicrocode = lib.mkDefault
config.hardware.enableRedistributableFirmware;
networking.hostName = "valefar";
networking.hostId = "2a07da90";
networking = { networking = {
hostName = "valefar";
hostId = "2a07da90";
firewall.enable = false; firewall.enable = false;
firewall.trustedInterfaces = [ firewall.trustedInterfaces = [ "tailscale0" ];
"tailscale0"
];
nameservers = [ "10.0.0.210" "1.1.1.1" ]; nameservers = [ "10.0.0.210" "1.1.1.1" ];
useDHCP = true; useDHCP = true;
firewall.allowedTCPPorts = [22 80 443 2456 2457 9000 9001 9002]; firewall.allowedTCPPorts = [ 22 80 443 2049 2456 2457 9000 9001 9002 ];
firewall.allowedUDPPorts = [ 2049 ];
}; };
# DNS resolution
services.resolved = { services.resolved = {
enable = true; enable = true;
dnssec = "false"; dnssec = "false";
@ -51,13 +62,67 @@
dnsovertls = "false"; dnsovertls = "false";
}; };
boot.supportedFilesystems = [ "zfs" ]; # =============================================================================
boot.kernelModules = [ "nct6775" "coretemp" ]; # BOOT & FILESYSTEMS
# =============================================================================
boot = {
supportedFilesystems = [ "zfs" ];
kernelModules = [ "nct6775" "coretemp" ];
boot.zfs.extraPools = [ "garage" "storage" ]; zfs = {
boot.zfs.devNodes = "/dev/disk/by-id"; extraPools = [ "garage" "storage" ];
boot.zfs.forceImportAll = true; devNodes = "/dev/disk/by-id";
forceImportAll = true;
};
};
# =============================================================================
# ZFS CONFIGURATION
# =============================================================================
# ZFS import services
systemd.services.zfs-import-cache.enable = false;
systemd.services.zfs-import-scan = {
enable = true;
after = [ "systemd-udev-settle.service" ];
wants = [ "systemd-udev-settle.service" ];
};
# ZFS mount points
systemd.mounts = [
{
what = "garage";
where = "/garage";
type = "zfs";
after = [ "zfs-import-scan.service" ];
wants = [ "zfs-import-scan.service" ];
}
{
what = "storage";
where = "/storage";
type = "zfs";
after = [ "zfs-import-scan.service" ];
wants = [ "zfs-import-scan.service" ];
}
];
# ZFS maintenance
services.zfs = {
autoScrub.enable = true;
trim.enable = true;
};
# =============================================================================
# DIRECTORY STRUCTURE
# =============================================================================
systemd.tmpfiles.rules = [
"d /storage/immich 0755 immich immich -"
"d /storage/immich/photos 0755 immich immich -"
"Z /storage/immich 0755 immich immich -" # Recursively fix ownership of existing files
];
# =============================================================================
# NFS SERVER
# =============================================================================
services.nfs.server = { services.nfs.server = {
enable = true; enable = true;
exports = '' exports = ''
@ -65,59 +130,17 @@
''; '';
}; };
/*boot.kernelParams = [ "ip=dhcp" ]; # =============================================================================
boot.initrd = { # SERVICES
availableKernelModules = [ "r8169" ]; # =============================================================================
network = { services.vscode-server = {
enable = true; enable = true;
ssh = { nodejsPackage = pkgs.nodejs_20;
enable = true;
port = 22;
authorizedKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJ0pU82lV9dSjkgYbdh9utZ5CDM2dPN70S5fBqN1m3Pb" ];
hostKeys = [ "/etc/secrets/initrd/ssh_host_rsa_key" ];
shell = "/bin/cryptsetup-askpass";
};
};
};*/
systemd.services.zfs-import-cache.enable = false;
systemd.services.zfs-import-scan.enable = true;
systemd.services.zfs-import-scan = {
after = [ "systemd-udev-settle.service" ];
wants = [ "systemd-udev-settle.service" ];
}; };
systemd.mounts = [{ # =============================================================================
what = "garage"; # VIRTUALIZATION
where = "/garage"; # =============================================================================
type = "zfs";
after = [ "zfs-import-scan.service" ];
wants = [ "zfs-import-scan.service" ];
} {
what = "storage";
where = "/storage";
type = "zfs";
after = [ "zfs-import-scan.service" ];
wants = [ "zfs-import-scan.service" ];
}];
systemd.tmpfiles.rules = [
"d /storage/immich 0755 immich immich -"
];
services.zfs.autoScrub.enable = true;
services.zfs.trim.enable = true;
services.vscode-server.enable = true;
services.vscode-server.nodejsPackage = pkgs.nodejs_20;
environment.systemPackages = with pkgs; [
lm_sensors
code-server
inputs.agenix.packages.x86_64-linux.default
];
virtualisation.docker = { virtualisation.docker = {
enable = true; enable = true;
enableOnBoot = true; enableOnBoot = true;
@ -125,4 +148,32 @@
buildGoModule = pkgs.buildGo123Module; buildGoModule = pkgs.buildGo123Module;
}; };
}; };
# =============================================================================
# PACKAGES
# =============================================================================
environment.systemPackages = with pkgs; [
lm_sensors
code-server
inputs.agenix.packages.x86_64-linux.default
];
# =============================================================================
# COMMENTED OUT / DISABLED
# =============================================================================
# Remote unlock via SSH (commented out)
# boot.kernelParams = [ "ip=dhcp" ];
# boot.initrd = {
# availableKernelModules = [ "r8169" ];
# network = {
# enable = true;
# ssh = {
# enable = true;
# port = 22;
# authorizedKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJ0pU82lV9dSjkgYbdh9utZ5CDM2dPN70S5fBqN1m3Pb" ];
# hostKeys = [ "/etc/secrets/initrd/ssh_host_rsa_key" ];
# shell = "/bin/cryptsetup-askpass";
# };
# };
# };
} }