organization
This commit is contained in:
parent
440348d1e5
commit
7a31cdd170
3 changed files with 296 additions and 168 deletions
|
|
@ -1,7 +1,9 @@
|
|||
# hosts/valefar/configuration.nix (or default.nix)
|
||||
# hosts/buer/configuration.nix (or default.nix)
|
||||
{ config, lib, pkgs, modulesPath, inputs, ... }:
|
||||
|
||||
{
|
||||
# =============================================================================
|
||||
# IMPORTS
|
||||
# =============================================================================
|
||||
imports = [
|
||||
# Host-specific hardware
|
||||
./hardware.nix
|
||||
|
|
@ -12,28 +14,47 @@
|
|||
../../common/users.nix
|
||||
../../common/services.nix
|
||||
|
||||
|
||||
# Common secrets
|
||||
../../host-secrets.nix
|
||||
];
|
||||
|
||||
# =============================================================================
|
||||
# SYSTEM CONFIGURATION
|
||||
# =============================================================================
|
||||
system.stateVersion = "24.11";
|
||||
modules.garage.enable = true;
|
||||
|
||||
# pin host platform & microcode
|
||||
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
|
||||
|
||||
# Intel microcode updates
|
||||
hardware.cpu.intel.updateMicrocode = lib.mkDefault
|
||||
config.hardware.enableRedistributableFirmware;
|
||||
|
||||
boot.loader.grub.enable = true;
|
||||
boot.loader.grub.device = "/dev/vda";
|
||||
# =============================================================================
|
||||
# CUSTOM MODULES
|
||||
# =============================================================================
|
||||
modules.garage.enable = true;
|
||||
|
||||
networking.hostName = "buer";
|
||||
networking.hostId = "1418d29e";
|
||||
networking.firewall.enable = false;
|
||||
networking.useDHCP = false;
|
||||
systemd.network.enable = true;
|
||||
systemd.network.networks."10-wan" = {
|
||||
# =============================================================================
|
||||
# BOOT CONFIGURATION
|
||||
# =============================================================================
|
||||
boot.loader.grub = {
|
||||
enable = true;
|
||||
device = "/dev/vda";
|
||||
};
|
||||
|
||||
# =============================================================================
|
||||
# NETWORKING
|
||||
# =============================================================================
|
||||
networking = {
|
||||
hostName = "buer";
|
||||
hostId = "1418d29e";
|
||||
firewall.enable = false;
|
||||
useDHCP = false;
|
||||
};
|
||||
|
||||
# Static IP configuration via systemd-networkd
|
||||
systemd.network = {
|
||||
enable = true;
|
||||
networks."10-wan" = {
|
||||
matchConfig.Name = "ens3";
|
||||
address = [
|
||||
"103.251.165.107/24"
|
||||
|
|
@ -50,19 +71,11 @@
|
|||
"5.255.125.240"
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
#boot.supportedFilesystems = [ "zfs" ];
|
||||
#boot.kernelModules = [ "nct6775" "coretemp" ];
|
||||
|
||||
#services.zfs.autoScrub.enable = true;
|
||||
#services.zfs.trim.enable = true;
|
||||
|
||||
environment.systemPackages = with pkgs; [
|
||||
#lm_sensors
|
||||
#code-server
|
||||
inputs.agenix.packages.x86_64-linux.default
|
||||
];
|
||||
|
||||
# =============================================================================
|
||||
# VIRTUALIZATION
|
||||
# =============================================================================
|
||||
virtualisation.docker = {
|
||||
enable = true;
|
||||
enableOnBoot = true;
|
||||
|
|
@ -70,4 +83,24 @@
|
|||
buildGoModule = pkgs.buildGo123Module;
|
||||
};
|
||||
};
|
||||
|
||||
# =============================================================================
|
||||
# PACKAGES
|
||||
# =============================================================================
|
||||
environment.systemPackages = with pkgs; [
|
||||
inputs.agenix.packages.x86_64-linux.default
|
||||
];
|
||||
|
||||
# =============================================================================
|
||||
# COMMENTED OUT / DISABLED
|
||||
# =============================================================================
|
||||
# ZFS support (not needed for this VPS)
|
||||
# boot.supportedFilesystems = [ "zfs" ];
|
||||
# boot.kernelModules = [ "nct6775" "coretemp" ];
|
||||
# services.zfs.autoScrub.enable = true;
|
||||
# services.zfs.trim.enable = true;
|
||||
|
||||
# Additional packages (not needed)
|
||||
# lm_sensors
|
||||
# code-server
|
||||
}
|
||||
|
|
@ -1,7 +1,9 @@
|
|||
# hosts/valefar/configuration.nix (or default.nix)
|
||||
# hosts/focalor/configuration.nix (or default.nix)
|
||||
{ config, lib, system, pkgs, modulesPath, inputs, ... }:
|
||||
|
||||
{
|
||||
# =============================================================================
|
||||
# IMPORTS
|
||||
# =============================================================================
|
||||
imports = [
|
||||
# Host-specific hardware
|
||||
./hardware.nix
|
||||
|
|
@ -20,32 +22,45 @@
|
|||
../../common/desktop/sway.nix
|
||||
../../common/desktop/vnc.nix
|
||||
|
||||
# Nvidia
|
||||
# Hardware-specific
|
||||
../../common/nvidia.nix
|
||||
|
||||
# Common secrets
|
||||
# Common secrets (commented out)
|
||||
# ../../host-secrets.nix
|
||||
];
|
||||
|
||||
# =============================================================================
|
||||
# SYSTEM CONFIGURATION
|
||||
# =============================================================================
|
||||
system.stateVersion = "25.05";
|
||||
|
||||
# pin host platform & microcode
|
||||
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
|
||||
|
||||
# Cross-compilation support
|
||||
boot.binfmt.emulatedSystems = [ "aarch64-linux" ];
|
||||
nix.settings.extra-platforms = config.boot.binfmt.emulatedSystems;
|
||||
|
||||
networking.hostName = "focalor";
|
||||
networking.hostId = "84bdc587";
|
||||
# =============================================================================
|
||||
# NETWORKING
|
||||
# =============================================================================
|
||||
networking = {
|
||||
hostName = "focalor";
|
||||
hostId = "84bdc587";
|
||||
firewall.enable = false;
|
||||
firewall.trustedInterfaces = [ "tailscale0" ];
|
||||
nameservers = [ "10.0.0.210" "1.1.1.1" ];
|
||||
};
|
||||
|
||||
# Systemd networking with bridge
|
||||
systemd.network = {
|
||||
enable = true;
|
||||
|
||||
netdevs."br0" = {
|
||||
netdevConfig = {
|
||||
Name = "br0";
|
||||
Kind = "bridge";
|
||||
};
|
||||
};
|
||||
|
||||
networks = {
|
||||
"10-lan" = {
|
||||
matchConfig.Name = ["enp5s0" "vm-*"];
|
||||
|
|
@ -53,6 +68,7 @@
|
|||
Bridge = "br0";
|
||||
};
|
||||
};
|
||||
|
||||
"10-lan-bridge" = {
|
||||
matchConfig.Name = "br0";
|
||||
networkConfig = {
|
||||
|
|
@ -66,18 +82,7 @@
|
|||
};
|
||||
};
|
||||
|
||||
programs.steam.enable = true;
|
||||
|
||||
networking = {
|
||||
firewall.enable = false;
|
||||
firewall.trustedInterfaces = [
|
||||
"tailscale0"
|
||||
];
|
||||
nameservers = [ "10.0.0.210" "1.1.1.1" ];
|
||||
#useDHCP = true;
|
||||
#firewall.allowedTCPPorts = [22 80 443 2456 2457 9000 9001 9002];
|
||||
};
|
||||
|
||||
# DNS resolution
|
||||
services.resolved = {
|
||||
enable = true;
|
||||
dnssec = "true";
|
||||
|
|
@ -86,15 +91,28 @@
|
|||
dnsovertls = "true";
|
||||
};
|
||||
|
||||
#boot.supportedFilesystems = [ "zfs" ];
|
||||
#boot.kernelModules = [ "nct6775" "coretemp" ];
|
||||
# =============================================================================
|
||||
# FILESYSTEM & STORAGE
|
||||
# =============================================================================
|
||||
boot.supportedFilesystems = [ "nfs" ];
|
||||
|
||||
#services.zfs.autoScrub.enable = true;
|
||||
#services.zfs.trim.enable = true;
|
||||
fileSystems."/mnt/storage" = {
|
||||
device = "valefar:/storage";
|
||||
fsType = "nfs";
|
||||
};
|
||||
|
||||
services.vscode-server.enable = true;
|
||||
services.vscode-server.nodejsPackage = pkgs.nodejs_20;
|
||||
# =============================================================================
|
||||
# SERVICES
|
||||
# =============================================================================
|
||||
services.vscode-server = {
|
||||
enable = true;
|
||||
nodejsPackage = pkgs.nodejs_20;
|
||||
};
|
||||
|
||||
# =============================================================================
|
||||
# PROGRAMS & APPLICATIONS
|
||||
# =============================================================================
|
||||
programs.steam.enable = true;
|
||||
|
||||
programs.obs-studio = {
|
||||
enable = true;
|
||||
|
|
@ -104,14 +122,9 @@
|
|||
];
|
||||
};
|
||||
|
||||
environment.systemPackages = with pkgs; [
|
||||
#lm_sensors
|
||||
#code-server
|
||||
inputs.agenix.packages.x86_64-linux.default
|
||||
];
|
||||
|
||||
environment.sessionVariables.WLR_RENDERER = "vulkan";
|
||||
|
||||
# =============================================================================
|
||||
# VIRTUALIZATION
|
||||
# =============================================================================
|
||||
virtualisation.docker = {
|
||||
enable = true;
|
||||
enableOnBoot = true;
|
||||
|
|
@ -120,6 +133,13 @@
|
|||
};
|
||||
};
|
||||
|
||||
# =============================================================================
|
||||
# DESKTOP ENVIRONMENT
|
||||
# =============================================================================
|
||||
# Vulkan renderer for Wayland
|
||||
environment.sessionVariables.WLR_RENDERER = "vulkan";
|
||||
|
||||
# XDG Portals
|
||||
xdg.portal = {
|
||||
enable = true;
|
||||
wlr.enable = true;
|
||||
|
|
@ -128,4 +148,28 @@
|
|||
xdg-desktop-portal-gnome
|
||||
];
|
||||
};
|
||||
|
||||
# =============================================================================
|
||||
# PACKAGES
|
||||
# =============================================================================
|
||||
environment.systemPackages = with pkgs; [
|
||||
inputs.agenix.packages.x86_64-linux.default
|
||||
];
|
||||
|
||||
# =============================================================================
|
||||
# COMMENTED OUT / DISABLED
|
||||
# =============================================================================
|
||||
# ZFS support (disabled for this host)
|
||||
# boot.supportedFilesystems = [ "zfs" ];
|
||||
# boot.kernelModules = [ "nct6775" "coretemp" ];
|
||||
# services.zfs.autoScrub.enable = true;
|
||||
# services.zfs.trim.enable = true;
|
||||
|
||||
# Additional packages (commented out)
|
||||
# lm_sensors
|
||||
# code-server
|
||||
|
||||
# DHCP (disabled in favor of systemd-networkd)
|
||||
# useDHCP = true;
|
||||
# firewall.allowedTCPPorts = [22 80 443 2456 2457 9000 9001 9002];
|
||||
}
|
||||
|
|
@ -1,12 +1,13 @@
|
|||
# hosts/valefar/configuration.nix (or default.nix)
|
||||
{ config, lib, pkgs, modulesPath, inputs, ... }:
|
||||
|
||||
{
|
||||
# =============================================================================
|
||||
# IMPORTS
|
||||
# =============================================================================
|
||||
imports = [
|
||||
# Host-specific hardware
|
||||
./hardware.nix
|
||||
./secrets.nix
|
||||
#../../common/nvidia.nix
|
||||
|
||||
# Common modules shared across hosts
|
||||
../../common/system.nix
|
||||
|
|
@ -16,33 +17,43 @@
|
|||
|
||||
# Common secrets
|
||||
../../host-secrets.nix
|
||||
|
||||
# Hardware-specific (commented out)
|
||||
# ../../common/nvidia.nix
|
||||
];
|
||||
|
||||
# Enable modules
|
||||
# =============================================================================
|
||||
# SYSTEM CONFIGURATION
|
||||
# =============================================================================
|
||||
system.stateVersion = "24.11";
|
||||
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
|
||||
|
||||
# Intel microcode updates
|
||||
hardware.cpu.intel.updateMicrocode = lib.mkDefault
|
||||
config.hardware.enableRedistributableFirmware;
|
||||
|
||||
# =============================================================================
|
||||
# CUSTOM MODULES
|
||||
# =============================================================================
|
||||
modules.garage.enable = true;
|
||||
modules.forgejo.enable = true;
|
||||
modules.immich.enable = true;
|
||||
|
||||
system.stateVersion = "24.11";
|
||||
|
||||
# pin host platform & microcorre
|
||||
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
|
||||
hardware.cpu.intel.updateMicrocode = lib.mkDefault
|
||||
config.hardware.enableRedistributableFirmware;
|
||||
|
||||
networking.hostName = "valefar";
|
||||
networking.hostId = "2a07da90";
|
||||
|
||||
# =============================================================================
|
||||
# NETWORKING
|
||||
# =============================================================================
|
||||
networking = {
|
||||
hostName = "valefar";
|
||||
hostId = "2a07da90";
|
||||
firewall.enable = false;
|
||||
firewall.trustedInterfaces = [
|
||||
"tailscale0"
|
||||
];
|
||||
firewall.trustedInterfaces = [ "tailscale0" ];
|
||||
nameservers = [ "10.0.0.210" "1.1.1.1" ];
|
||||
useDHCP = true;
|
||||
firewall.allowedTCPPorts = [22 80 443 2456 2457 9000 9001 9002];
|
||||
firewall.allowedTCPPorts = [ 22 80 443 2049 2456 2457 9000 9001 9002 ];
|
||||
firewall.allowedUDPPorts = [ 2049 ];
|
||||
};
|
||||
|
||||
# DNS resolution
|
||||
services.resolved = {
|
||||
enable = true;
|
||||
dnssec = "false";
|
||||
|
|
@ -51,13 +62,67 @@
|
|||
dnsovertls = "false";
|
||||
};
|
||||
|
||||
boot.supportedFilesystems = [ "zfs" ];
|
||||
boot.kernelModules = [ "nct6775" "coretemp" ];
|
||||
# =============================================================================
|
||||
# BOOT & FILESYSTEMS
|
||||
# =============================================================================
|
||||
boot = {
|
||||
supportedFilesystems = [ "zfs" ];
|
||||
kernelModules = [ "nct6775" "coretemp" ];
|
||||
|
||||
boot.zfs.extraPools = [ "garage" "storage" ];
|
||||
boot.zfs.devNodes = "/dev/disk/by-id";
|
||||
boot.zfs.forceImportAll = true;
|
||||
zfs = {
|
||||
extraPools = [ "garage" "storage" ];
|
||||
devNodes = "/dev/disk/by-id";
|
||||
forceImportAll = true;
|
||||
};
|
||||
};
|
||||
|
||||
# =============================================================================
|
||||
# ZFS CONFIGURATION
|
||||
# =============================================================================
|
||||
# ZFS import services
|
||||
systemd.services.zfs-import-cache.enable = false;
|
||||
systemd.services.zfs-import-scan = {
|
||||
enable = true;
|
||||
after = [ "systemd-udev-settle.service" ];
|
||||
wants = [ "systemd-udev-settle.service" ];
|
||||
};
|
||||
|
||||
# ZFS mount points
|
||||
systemd.mounts = [
|
||||
{
|
||||
what = "garage";
|
||||
where = "/garage";
|
||||
type = "zfs";
|
||||
after = [ "zfs-import-scan.service" ];
|
||||
wants = [ "zfs-import-scan.service" ];
|
||||
}
|
||||
{
|
||||
what = "storage";
|
||||
where = "/storage";
|
||||
type = "zfs";
|
||||
after = [ "zfs-import-scan.service" ];
|
||||
wants = [ "zfs-import-scan.service" ];
|
||||
}
|
||||
];
|
||||
|
||||
# ZFS maintenance
|
||||
services.zfs = {
|
||||
autoScrub.enable = true;
|
||||
trim.enable = true;
|
||||
};
|
||||
|
||||
# =============================================================================
|
||||
# DIRECTORY STRUCTURE
|
||||
# =============================================================================
|
||||
systemd.tmpfiles.rules = [
|
||||
"d /storage/immich 0755 immich immich -"
|
||||
"d /storage/immich/photos 0755 immich immich -"
|
||||
"Z /storage/immich 0755 immich immich -" # Recursively fix ownership of existing files
|
||||
];
|
||||
|
||||
# =============================================================================
|
||||
# NFS SERVER
|
||||
# =============================================================================
|
||||
services.nfs.server = {
|
||||
enable = true;
|
||||
exports = ''
|
||||
|
|
@ -65,59 +130,17 @@
|
|||
'';
|
||||
};
|
||||
|
||||
/*boot.kernelParams = [ "ip=dhcp" ];
|
||||
boot.initrd = {
|
||||
availableKernelModules = [ "r8169" ];
|
||||
network = {
|
||||
# =============================================================================
|
||||
# SERVICES
|
||||
# =============================================================================
|
||||
services.vscode-server = {
|
||||
enable = true;
|
||||
ssh = {
|
||||
enable = true;
|
||||
port = 22;
|
||||
authorizedKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJ0pU82lV9dSjkgYbdh9utZ5CDM2dPN70S5fBqN1m3Pb" ];
|
||||
hostKeys = [ "/etc/secrets/initrd/ssh_host_rsa_key" ];
|
||||
shell = "/bin/cryptsetup-askpass";
|
||||
};
|
||||
};
|
||||
};*/
|
||||
|
||||
systemd.services.zfs-import-cache.enable = false;
|
||||
systemd.services.zfs-import-scan.enable = true;
|
||||
|
||||
systemd.services.zfs-import-scan = {
|
||||
after = [ "systemd-udev-settle.service" ];
|
||||
wants = [ "systemd-udev-settle.service" ];
|
||||
nodejsPackage = pkgs.nodejs_20;
|
||||
};
|
||||
|
||||
systemd.mounts = [{
|
||||
what = "garage";
|
||||
where = "/garage";
|
||||
type = "zfs";
|
||||
after = [ "zfs-import-scan.service" ];
|
||||
wants = [ "zfs-import-scan.service" ];
|
||||
} {
|
||||
what = "storage";
|
||||
where = "/storage";
|
||||
type = "zfs";
|
||||
after = [ "zfs-import-scan.service" ];
|
||||
wants = [ "zfs-import-scan.service" ];
|
||||
}];
|
||||
|
||||
systemd.tmpfiles.rules = [
|
||||
"d /storage/immich 0755 immich immich -"
|
||||
];
|
||||
|
||||
services.zfs.autoScrub.enable = true;
|
||||
services.zfs.trim.enable = true;
|
||||
|
||||
services.vscode-server.enable = true;
|
||||
services.vscode-server.nodejsPackage = pkgs.nodejs_20;
|
||||
|
||||
environment.systemPackages = with pkgs; [
|
||||
lm_sensors
|
||||
code-server
|
||||
inputs.agenix.packages.x86_64-linux.default
|
||||
];
|
||||
|
||||
# =============================================================================
|
||||
# VIRTUALIZATION
|
||||
# =============================================================================
|
||||
virtualisation.docker = {
|
||||
enable = true;
|
||||
enableOnBoot = true;
|
||||
|
|
@ -125,4 +148,32 @@
|
|||
buildGoModule = pkgs.buildGo123Module;
|
||||
};
|
||||
};
|
||||
|
||||
# =============================================================================
|
||||
# PACKAGES
|
||||
# =============================================================================
|
||||
environment.systemPackages = with pkgs; [
|
||||
lm_sensors
|
||||
code-server
|
||||
inputs.agenix.packages.x86_64-linux.default
|
||||
];
|
||||
|
||||
# =============================================================================
|
||||
# COMMENTED OUT / DISABLED
|
||||
# =============================================================================
|
||||
# Remote unlock via SSH (commented out)
|
||||
# boot.kernelParams = [ "ip=dhcp" ];
|
||||
# boot.initrd = {
|
||||
# availableKernelModules = [ "r8169" ];
|
||||
# network = {
|
||||
# enable = true;
|
||||
# ssh = {
|
||||
# enable = true;
|
||||
# port = 22;
|
||||
# authorizedKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJ0pU82lV9dSjkgYbdh9utZ5CDM2dPN70S5fBqN1m3Pb" ];
|
||||
# hostKeys = [ "/etc/secrets/initrd/ssh_host_rsa_key" ];
|
||||
# shell = "/bin/cryptsetup-askpass";
|
||||
# };
|
||||
# };
|
||||
# };
|
||||
}
|
||||
Loading…
Add table
Add a link
Reference in a new issue