Compare commits
No commits in common. "master" and "nixvim" have entirely different histories.
|
|
@ -8,7 +8,6 @@ flakeDir="${FLAKE_DIR}" # Path to the flake file (and op
|
|||
update=false # Whether to update flake.lock (false by default)
|
||||
user=$(/run/current-system/sw/bin/whoami) # Which user account to use for git commands (defaults to whoever called the script)
|
||||
reboot=false
|
||||
remote=false
|
||||
remainingArgs="" # All remaining arguments that haven't yet been processed (will be passed to nixos-rebuild)
|
||||
|
||||
function usage() {
|
||||
|
|
@ -26,13 +25,12 @@ function usage() {
|
|||
echo " -o, --operation The nixos-rebuild operation to perform."
|
||||
echo " -f, --flake <path> The path to your flake.nix file (and optionally, the hostname to build)."
|
||||
echo " -U, --update Update and commit flake.lock."
|
||||
echo " -R, --build-host <user@host> Attempt build on remote host."
|
||||
echo " -r, --reboot Reboots system is there is a kernel or init update"
|
||||
echo " -u, --user Which user account to run git commands under."
|
||||
echo ""
|
||||
exit 2
|
||||
}
|
||||
|
||||
# Argument processing logic shamelessly stolen from https://stackoverflow.com/questions/192249/how-do-i-parse-command-line-arguments-in-bash
|
||||
POSITIONAL_ARGS=()
|
||||
while [[ $# -gt 0 ]]; do
|
||||
case "$1" in
|
||||
|
|
@ -41,6 +39,14 @@ while [[ $# -gt 0 ]]; do
|
|||
shift
|
||||
shift
|
||||
;;
|
||||
--update|--upgrade|-U)
|
||||
update=true
|
||||
shift
|
||||
;;
|
||||
--reboot|-r)
|
||||
reboot=true
|
||||
shift
|
||||
;;
|
||||
--operation|-o)
|
||||
operation="$2"
|
||||
shift
|
||||
|
|
@ -51,20 +57,6 @@ while [[ $# -gt 0 ]]; do
|
|||
shift
|
||||
shift
|
||||
;;
|
||||
--build-host | -R)
|
||||
remote=true
|
||||
host="$2"
|
||||
shift
|
||||
shift
|
||||
;;
|
||||
--update | --upgrade | -U)
|
||||
update=true
|
||||
shift
|
||||
;;
|
||||
--reboot | -r)
|
||||
reboot=true
|
||||
shift
|
||||
;;
|
||||
--help|-h)
|
||||
usage
|
||||
exit 0
|
||||
|
|
@ -75,7 +67,6 @@ while [[ $# -gt 0 ]]; do
|
|||
;;
|
||||
esac
|
||||
done
|
||||
|
||||
remainingArgs=${POSITIONAL_ARGS[@]}
|
||||
set -- "${POSITIONAL_ARGS[@]}" # restore positional parameters
|
||||
|
||||
|
|
@ -103,13 +94,7 @@ fi
|
|||
options="--flake $flakeDir $remainingArgs --use-remote-sudo"
|
||||
|
||||
echo "Running this operation: nixos-rebuild $operation $options"
|
||||
|
||||
if [ $remote = true ]; then
|
||||
echo "Attempting remote build..."
|
||||
/run/wrappers/bin/sudo -u root /run/current-system/sw/bin/nixos-rebuild $operation $options --build-host "$host"
|
||||
else
|
||||
/run/wrappers/bin/sudo -u root /run/current-system/sw/bin/nixos-rebuild $operation $options
|
||||
fi
|
||||
|
||||
echo "Checking if reboot is necessary"
|
||||
reboot_diff=$(diff <(readlink /run/booted-system/{initrd,kernel,kernel-modules}) <(readlink /nix/var/nix/profiles/system/{initrd,kernel,kernel-modules}))
|
||||
|
|
|
|||
75
flake.lock
75
flake.lock
|
|
@ -271,11 +271,11 @@
|
|||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1737043064,
|
||||
"narHash": "sha256-I/OuxGwXwRi5gnFPsyCvVR+IfFstA+QXEpHu1hvsgD8=",
|
||||
"lastModified": 1735882644,
|
||||
"narHash": "sha256-3FZAG+pGt3OElQjesCAWeMkQ7C/nB1oTHLRQ8ceP110=",
|
||||
"owner": "cachix",
|
||||
"repo": "git-hooks.nix",
|
||||
"rev": "94ee657f6032d913fe0ef49adaa743804635b0bb",
|
||||
"rev": "a5a961387e75ae44cc20f0a57ae463da5e959656",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
|
|
@ -460,11 +460,11 @@
|
|||
"nixpkgs-unstable": "nixpkgs-unstable"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1737481937,
|
||||
"narHash": "sha256-FJ0ATgYWavH3ZeA0ofTEMS+22HqYN2Lqu3G6IsqbKIg=",
|
||||
"lastModified": 1734508046,
|
||||
"narHash": "sha256-JN/PFBOVqWKc76zSdOunYoG5Q0m8W4zfrEh3V4EOIuk=",
|
||||
"owner": "fort-nix",
|
||||
"repo": "nix-bitcoin",
|
||||
"rev": "dc4d14e07324e43b8773e3eb5eb2a10c6b469287",
|
||||
"rev": "33dbb41d581b86decf421cb3835c426d557e0e9c",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
|
|
@ -501,16 +501,15 @@
|
|||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1736820923,
|
||||
"narHash": "sha256-SDuKLOWAh8VJRXlNWQn9QE99bjeEUAAbYXqrKGbsiyk=",
|
||||
"lastModified": 1736370755,
|
||||
"narHash": "sha256-iWcjToBpx4PUd74uqvIGAfqqVfyrvRLRauC/SxEKIF0=",
|
||||
"owner": "lnl7",
|
||||
"repo": "nix-darwin",
|
||||
"rev": "944c2b181792ae7ae6b20c0df3f44879c11706c9",
|
||||
"rev": "57733bd1dc81900e13438e5b4439239f1b29db0e",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "lnl7",
|
||||
"ref": "nix-darwin-24.11",
|
||||
"repo": "nix-darwin",
|
||||
"type": "github"
|
||||
}
|
||||
|
|
@ -539,11 +538,11 @@
|
|||
},
|
||||
"nix-secrets": {
|
||||
"locked": {
|
||||
"lastModified": 1737643624,
|
||||
"narHash": "sha256-RAnbZSi2yagPCpNcm3U3wA6FAzbhGUi9ifvnu6Du3Rs=",
|
||||
"lastModified": 1736984538,
|
||||
"narHash": "sha256-SAoVXTVwLL4hYpHQFJqI+91eIqIS0Mug0URqh6KqeIM=",
|
||||
"ref": "refs/heads/master",
|
||||
"rev": "5260822187ce58af680e5aceba8fb01f10415def",
|
||||
"revCount": 248,
|
||||
"rev": "b28890d455676809e9130945ea267fa16b02d44d",
|
||||
"revCount": 208,
|
||||
"type": "git",
|
||||
"url": "ssh://git@git.bitlab21.com/sam/nix-secrets.git"
|
||||
},
|
||||
|
|
@ -585,11 +584,11 @@
|
|||
},
|
||||
"nixpkgs-unstable": {
|
||||
"locked": {
|
||||
"lastModified": 1737370608,
|
||||
"narHash": "sha256-hFA6SmioeqvGW/XvZa9bxniAeulksCOcj3kokdNT/YE=",
|
||||
"lastModified": 1734126203,
|
||||
"narHash": "sha256-0XovF7BYP50rTD2v4r55tR5MuBLet7q4xIz6Rgh3BBU=",
|
||||
"owner": "NixOS",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "300081d0cc72df578b02d914df941b8ec62240e6",
|
||||
"rev": "71a6392e367b08525ee710a93af2e80083b5b3e2",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
|
|
@ -601,11 +600,11 @@
|
|||
},
|
||||
"nixpkgs-unstable_2": {
|
||||
"locked": {
|
||||
"lastModified": 1737469691,
|
||||
"narHash": "sha256-nmKOgAU48S41dTPIXAq0AHZSehWUn6ZPrUKijHAMmIk=",
|
||||
"lastModified": 1736883708,
|
||||
"narHash": "sha256-uQ+NQ0/xYU0N1CnXsa2zghgNaOPxWpMJXSUJJ9W7140=",
|
||||
"owner": "nixos",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "9e4d5190a9482a1fb9d18adf0bdb83c6e506eaab",
|
||||
"rev": "eb62e6aa39ea67e0b8018ba8ea077efe65807dc8",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
|
|
@ -633,11 +632,11 @@
|
|||
},
|
||||
"nixpkgs_3": {
|
||||
"locked": {
|
||||
"lastModified": 1737584761,
|
||||
"narHash": "sha256-xP8UQqo3XSXy92tQ+wFvps46rVHnIc8W7ShQ5CUQALo=",
|
||||
"lastModified": 1737053689,
|
||||
"narHash": "sha256-GcyT76HPi+HoWmUw0YfLJ48CqDOIxHXBSmjOSlfFQvA=",
|
||||
"owner": "nixos",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "f7b572b004be8e60c6727b3856a13efe17323212",
|
||||
"rev": "957c1f6e206281625f8e71a5d8944e9834a5699d",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
|
|
@ -649,11 +648,11 @@
|
|||
},
|
||||
"nixpkgs_4": {
|
||||
"locked": {
|
||||
"lastModified": 1737469691,
|
||||
"narHash": "sha256-nmKOgAU48S41dTPIXAq0AHZSehWUn6ZPrUKijHAMmIk=",
|
||||
"lastModified": 1736883708,
|
||||
"narHash": "sha256-uQ+NQ0/xYU0N1CnXsa2zghgNaOPxWpMJXSUJJ9W7140=",
|
||||
"owner": "nixos",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "9e4d5190a9482a1fb9d18adf0bdb83c6e506eaab",
|
||||
"rev": "eb62e6aa39ea67e0b8018ba8ea077efe65807dc8",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
|
|
@ -678,11 +677,11 @@
|
|||
"treefmt-nix": "treefmt-nix_2"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1737283156,
|
||||
"narHash": "sha256-FyHmM6vvz+UxCrPZo/poIaZBZejLHVKkAH4cjtUxZDA=",
|
||||
"lastModified": 1736598792,
|
||||
"narHash": "sha256-G6/9vT12RAxkNWQPEX9p8tTx/i8jJcmISpbVDGbEPGc=",
|
||||
"owner": "nix-community",
|
||||
"repo": "nixvim",
|
||||
"rev": "abcbd250b8a2c7aab1f4b2b9e01598ee24b42337",
|
||||
"rev": "2004ff4547f11d25da78f393fe797dde2b831ce7",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
|
|
@ -699,11 +698,11 @@
|
|||
"treefmt-nix": "treefmt-nix_3"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1737602136,
|
||||
"narHash": "sha256-Jr7tmhsZVAebD/TCpijDqcxr4w15wnPCOrlk+t4lrJA=",
|
||||
"lastModified": 1737052979,
|
||||
"narHash": "sha256-mWu8+PtK4cFlcWoixvQjODGzG4405tVczi7Gv7+XjXw=",
|
||||
"owner": "nix-community",
|
||||
"repo": "NUR",
|
||||
"rev": "80b6ff6a51dbebbe0bcc71858ae9a299e1207704",
|
||||
"rev": "515f3082e8381194afd691a797802efd31b2bae3",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
|
|
@ -784,11 +783,11 @@
|
|||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1737411508,
|
||||
"narHash": "sha256-j9IdflJwRtqo9WpM0OfAZml47eBblUHGNQTe62OUqTw=",
|
||||
"lastModified": 1736808430,
|
||||
"narHash": "sha256-wlgdf/n7bJMLBheqt1jmPoxJFrUP6FByKQFXuM9YvIk=",
|
||||
"owner": "mic92",
|
||||
"repo": "sops-nix",
|
||||
"rev": "015d461c16678fc02a2f405eb453abb509d4e1d4",
|
||||
"rev": "553c7cb22fed19fd60eb310423fdc93045c51ba8",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
|
|
@ -886,11 +885,11 @@
|
|||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1737103437,
|
||||
"narHash": "sha256-uPNWcYbhY2fjY3HOfRCR5jsfzdzemhfxLSxwjXYXqNc=",
|
||||
"lastModified": 1736154270,
|
||||
"narHash": "sha256-p2r8xhQZ3TYIEKBoiEhllKWQqWNJNoT9v64Vmg4q8Zw=",
|
||||
"owner": "numtide",
|
||||
"repo": "treefmt-nix",
|
||||
"rev": "d1ed3b385f8130e392870cfb1dbfaff8a63a1899",
|
||||
"rev": "13c913f5deb3a5c08bb810efd89dc8cb24dd968b",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
|
|
|
|||
|
|
@ -1,5 +1,5 @@
|
|||
{
|
||||
description = "Nixos Config";
|
||||
description = "Nix Config";
|
||||
|
||||
inputs = {
|
||||
# Nixpkgs
|
||||
|
|
@ -118,7 +118,7 @@
|
|||
merlin = nixpkgs.lib.nixosSystem {
|
||||
inherit specialArgs;
|
||||
modules = [
|
||||
./hosts/merlin
|
||||
./hosts/nebula
|
||||
home-manager.nixosModules.home-manager
|
||||
{
|
||||
home-manager.extraSpecialArgs = specialArgs;
|
||||
|
|
|
|||
|
|
@ -26,6 +26,7 @@
|
|||
pkgs.hunspellDicts.en_US
|
||||
pkgs.set_wm_class
|
||||
pkgs.xorg.xkill
|
||||
pkgs.krita
|
||||
pkgs.R
|
||||
pkgs.gimp
|
||||
pkgs.gajim
|
||||
|
|
|
|||
|
|
@ -1,11 +0,0 @@
|
|||
{
|
||||
...
|
||||
}: {
|
||||
imports = [
|
||||
./users/admin
|
||||
./common/core
|
||||
./common/optional/git.nix
|
||||
./common/optional/sops.nix
|
||||
];
|
||||
|
||||
}
|
||||
|
|
@ -1,4 +1,4 @@
|
|||
{ outputs, ... }:
|
||||
{ config, pkgs, lib, outputs, ... }:
|
||||
|
||||
{
|
||||
home.username = "admin";
|
||||
|
|
@ -7,16 +7,6 @@
|
|||
imports = [
|
||||
] ++ (builtins.attrValues outputs.homeManagerModules); # import all homeManagerModules?
|
||||
|
||||
programs.ssh = {
|
||||
enable = true;
|
||||
matchBlocks = {
|
||||
"git.bitlab21.com" = {
|
||||
identitiesOnly = true;
|
||||
identityFile = ["~/.ssh/deploy_key-ssh-ed25519"];
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
home.packages = [
|
||||
];
|
||||
|
||||
|
|
@ -27,7 +17,6 @@
|
|||
];
|
||||
|
||||
home.sessionVariables = {
|
||||
EDITOR = "nvim";
|
||||
};
|
||||
|
||||
programs.home-manager.enable = true;
|
||||
|
|
|
|||
|
|
@ -11,11 +11,13 @@
|
|||
fsType = "btrfs"; # one of ext4 or btrfs. Use btrfs if using impermanence
|
||||
dev = "/dev/nvme0n1"; # depends on target hardware
|
||||
encrypted = true; # currrently only applies to btrfs
|
||||
btrfsMountDevice = "/dev/mapper/crypted";
|
||||
btrfsMountDevice =
|
||||
if encrypted
|
||||
then "/dev/mapper/crypted"
|
||||
else "/dev/root_vg/root";
|
||||
user = "sam";
|
||||
impermanence = true;
|
||||
piholeIp = configVars.networking.addresses.pihole.ip;
|
||||
merlinIp = configVars.networking.addresses.merlin.ip;
|
||||
gatewayIp = configVars.networking.addresses.gateway.ip;
|
||||
in {
|
||||
imports = [
|
||||
|
|
@ -46,11 +48,9 @@ in {
|
|||
../common/optional/pipewire.nix
|
||||
../common/optional/openssh.nix
|
||||
../common/optional/dwm.nix
|
||||
|
||||
../common/optional/fileserver/nfs-client/media.nix
|
||||
../common/optional/fileserver/nfs-client/photos.nix
|
||||
../common/optional/fileserver/nfs-client/personal.nix
|
||||
|
||||
../common/optional/nfs-mounts/media.nix
|
||||
../common/optional/nfs-mounts/homeshare.nix
|
||||
../common/optional/nfs-mounts/photos.nix
|
||||
../common/optional/printing.nix
|
||||
../common/optional/backlight.nix
|
||||
../common/optional/xmodmap-arrow-remaps.nix
|
||||
|
|
@ -58,21 +58,19 @@ in {
|
|||
../common/optional/gaming.nix
|
||||
../common/optional/powersave.nix
|
||||
../common/optional/restic-backup.nix
|
||||
../common/optional/distributed-builds/local-machine.nix
|
||||
|
||||
# This machine is used for remote building
|
||||
../common/optional/distributed-builds/remote-builder-machine.nix
|
||||
|
||||
# ../../modules/nixos
|
||||
outputs.nixosModules.nixosAutoUpgrade
|
||||
];
|
||||
|
||||
boot = {
|
||||
supportedFilesystems = ["nfs"];
|
||||
blacklistedKernelModules = ["snd_hda_intel" "snd_soc_skl"];
|
||||
kernelModules = ["iwlwifi"];
|
||||
initrd.kernelModules = ["thinkpad-acpi" "acpi-call" "nfs"];
|
||||
# BUG: Using older linux kernel because of build errors
|
||||
# see https://github.com/NixOS/nixpkgs/issues/375605
|
||||
# kernelPackages = pkgs.linuxPackagesFor pkgs.linux_latest;
|
||||
kernelPackages = pkgs.linuxKernel.packages.linux_6_12;
|
||||
initrd.kernelModules = ["thinkpad-acpi" "acpi-call"];
|
||||
kernelPackages = pkgs.linuxPackagesFor pkgs.linux_latest;
|
||||
extraModulePackages = [
|
||||
config.boot.kernelPackages.acpi_call
|
||||
];
|
||||
|
|
@ -94,10 +92,9 @@ in {
|
|||
enable = true;
|
||||
persistent = true;
|
||||
reboot = false;
|
||||
remote = "remotebuild@${merlinIp}";
|
||||
pushUpdates = false;
|
||||
configDir = "/etc/nixos";
|
||||
onCalendar = "*-*-* 08:00:00";
|
||||
onCalendar = "daily";
|
||||
user = "sam";
|
||||
};
|
||||
|
||||
|
|
@ -107,8 +104,15 @@ in {
|
|||
xkb.options = "caps:swapescape";
|
||||
dpi = 196;
|
||||
upscaleDefaultCursor = true;
|
||||
# FIXME this doesnt work for some reason
|
||||
# displayManager.sessionCommands = pkgs.writeShellScriptBin "key-remaps" ''
|
||||
# ${pkgs.xorg.xmodmap}/bin/xmodmap -e "keycode 64 = Mode_switch"
|
||||
# ${pkgs.xorg.xmodmap}/bin/xmodmap -e "keycode 43 = h H Left H"
|
||||
# ${pkgs.xorg.xmodmap}/bin/xmodmap -e "keycode 44 = j J Down J"
|
||||
# ${pkgs.xorg.xmodmap}/bin/xmodmap -e "keycode 45 = k K Up K"
|
||||
# ${pkgs.xorg.xmodmap}/bin/xmodmap -e "keycode 46 = l L Right L"
|
||||
# '';
|
||||
};
|
||||
|
||||
# enable oom killer when system ram drops below 5% free
|
||||
earlyoom = {
|
||||
enable = true;
|
||||
|
|
@ -161,6 +165,18 @@ in {
|
|||
powerManagement.finegrained = true;
|
||||
open = false;
|
||||
nvidiaSettings = true;
|
||||
# # FIXME issue with stable nvidia driver and latest linux kernel
|
||||
# # use mkDriver to specify newer nvidia driver that is compatible
|
||||
# # see: https://github.com/NixOS/nixpkgs/issues/341844#issuecomment-2351075413
|
||||
# # and https://discourse.nixos.org/t/builder-for-nvidia-x11-550-78-6-10-drv-failed-with-exit-code-2/49360/32
|
||||
# package = config.boot.kernelPackages.nvidiaPackages.mkDriver {
|
||||
# version = "555.58.02";
|
||||
# sha256_64bit = "sha256-xctt4TPRlOJ6r5S54h5W6PT6/3Zy2R4ASNFPu8TSHKM=";
|
||||
# sha256_aarch64 = "sha256-wb20isMrRg8PeQBU96lWJzBMkjfySAUaqt4EgZnhyF8=";
|
||||
# openSha256 = "sha256-8hyRiGB+m2hL3c9MDA/Pon+Xl6E788MZ50WrrAGUVuY=";
|
||||
# settingsSha256 = "sha256-ZpuVZybW6CFN/gz9rx+UJvQ715FZnAOYfHn5jt5Z2C8=";
|
||||
# persistencedSha256 = "sha256-a1D7ZZmcKFWfPjjH1REqPM5j/YLWKnbkP9qfRyIyxAw=";
|
||||
# };
|
||||
};
|
||||
# https://bbs.archlinux.org/viewtopic.php?id=297276 for NVreg_EnableGpuFirmware fix
|
||||
# https://discourse.nixos.org/t/how-to-use-nvidia-prime-offload-to-run-the-x-server-on-the-integrated-board/9091/15
|
||||
|
|
|
|||
|
|
@ -1,36 +0,0 @@
|
|||
{
|
||||
device ? throw "Must define a device, e.g. /dev/sda",
|
||||
fsModule ? "Must specify submodule"
|
||||
}:
|
||||
{
|
||||
disko.devices = {
|
||||
disk = {
|
||||
main = {
|
||||
type = "disk";
|
||||
inherit device;
|
||||
content = {
|
||||
type = "gpt";
|
||||
partitions = {
|
||||
ESP = {
|
||||
priority = 1;
|
||||
name = "ESP";
|
||||
start = "1M";
|
||||
end = "128M";
|
||||
type = "EF00";
|
||||
content = {
|
||||
type = "filesystem";
|
||||
format = "vfat";
|
||||
mountpoint = "/boot";
|
||||
mountOptions = ["umask=0077"];
|
||||
};
|
||||
};
|
||||
root = {
|
||||
size = "100%";
|
||||
content = import "${fsModule}";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
@ -19,6 +19,7 @@
|
|||
"/swap" = {
|
||||
mountOptions = [ "noatime" ];
|
||||
mountpoint = "/.swapvol";
|
||||
swap.swapfile.size = "8192M";
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,8 +1,11 @@
|
|||
{ device, fsType, encrypted, impermanence, ... }:
|
||||
let
|
||||
fsModule = if impermanence then ./${fsType}/persist.nix else ./${fsType}/standard.nix;
|
||||
basic = import ./basic.nix { inherit device; fsModule = fsModule; };
|
||||
basic = import ./${fsType}/basic.nix { inherit device; };
|
||||
lvm = import ./lvm.nix { inherit device; fsModule = fsModule; };
|
||||
luks = import ./luks.nix { inherit device; fsModule = fsModule; };
|
||||
in
|
||||
if fsType == "btrfs" && encrypted then luks
|
||||
else basic
|
||||
if fsType == "ext4" then basic
|
||||
else if fsType == "btrfs" && encrypted then luks
|
||||
else if fsType == "btrfs" then lvm
|
||||
else null
|
||||
|
|
|
|||
|
|
@ -1,4 +1,5 @@
|
|||
{config, ...}: let
|
||||
{config, ...}:
|
||||
let
|
||||
openVpnPwd = config.sops.secrets."software/proton/openvpn_password".path;
|
||||
openVpnUser = config.sops.secrets."software/proton/openvpn_user".path;
|
||||
in {
|
||||
|
|
@ -7,18 +8,6 @@ in {
|
|||
"software/proton/openvpn_user" = {};
|
||||
};
|
||||
|
||||
networking = {
|
||||
firewall = {
|
||||
enable = true;
|
||||
allowedTCPPorts = [
|
||||
6887
|
||||
];
|
||||
allowedUDPPorts = [
|
||||
6887
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
virtualisation.arion = {
|
||||
backend = "podman-socket";
|
||||
projects.arrstack = {
|
||||
|
|
@ -42,7 +31,6 @@ in {
|
|||
VPN_SERVICE_PROVIDER = "protonvpn";
|
||||
VPN_TYPE = "openvpn";
|
||||
SERVER_COUNTRIES = "Switzerland";
|
||||
VPN_PORT_FORWARDING = "on";
|
||||
};
|
||||
devices = ["/dev/net/tun:/dev/net/tun"];
|
||||
};
|
||||
|
|
@ -53,7 +41,7 @@ in {
|
|||
restart = "always";
|
||||
volumes = [
|
||||
"/srv/docker/media-server/arrstack/qbittorrent:/config"
|
||||
"/media/media/downloads:/downloads"
|
||||
"/media/media:/media"
|
||||
];
|
||||
environment = {
|
||||
TZ="Europe/London";
|
||||
|
|
@ -64,6 +52,7 @@ in {
|
|||
};
|
||||
network_mode = "service:gluetun";
|
||||
};
|
||||
|
||||
};
|
||||
};
|
||||
};
|
||||
|
|
|
|||
|
|
@ -1,7 +1,8 @@
|
|||
{config, ...}: {
|
||||
{
|
||||
sops.secrets = {
|
||||
"software/photoprism" = {
|
||||
path = "/etc/photoprism/options.yml";
|
||||
path = "/run/secrets/photoprism/config.yaml";
|
||||
mode = "0600";
|
||||
};
|
||||
};
|
||||
virtualisation.arion = {
|
||||
|
|
@ -10,7 +11,7 @@
|
|||
settings = {
|
||||
services.photoprism.service = {
|
||||
ports = [
|
||||
"2342:2342"
|
||||
"8096:8096"
|
||||
];
|
||||
container_name = "photoprism";
|
||||
image = "photoprism/photoprism:latest";
|
||||
|
|
@ -20,10 +21,10 @@
|
|||
"/media/photos/sam/originals:/photoprism/originals"
|
||||
"/media/photos/sam/imports:/photoprism/import"
|
||||
"/srv/docker/photoprism/storage:/photoprism/storage"
|
||||
"${config.sops.secrets."software/photoprism".path}:/etc/photoprism/options.yml"
|
||||
"/run/secrets/photoprism/config.yaml:/etc/photoprism/config.yaml"
|
||||
];
|
||||
environment = {
|
||||
PHOTOPRISM_CONFIG_PATH = "/etc/photoprism";
|
||||
PHOTOPRISM_CONFIG_PATH = "/etc/photoprism/config.yaml";
|
||||
PHOTOPRISM_INIT = "intel";
|
||||
PHOTOPRISM_ORIGINALS_LIMIT = 5000;
|
||||
PHOTOPRISM_HTTP_COMPRESSION = "gzip";
|
||||
|
|
|
|||
|
|
@ -1,29 +0,0 @@
|
|||
{
|
||||
virtualisation.arion = {
|
||||
backend = "podman-socket";
|
||||
projects.syncthing = {
|
||||
settings = {
|
||||
services.syncthing.service = {
|
||||
ports = [
|
||||
"8384:8384"
|
||||
"22000:22000/tcp"
|
||||
"22000:22000/udp"
|
||||
"21027:21027/udp"
|
||||
];
|
||||
container_name = "syncthing";
|
||||
image = "lscr.io/linuxserver/syncthing:latest";
|
||||
restart = "always";
|
||||
environment = {
|
||||
PUID = "1000";
|
||||
GUID = "1000";
|
||||
|
||||
};
|
||||
volumes = [
|
||||
"/srv/docker/syncthing/appdata/config:/config"
|
||||
"/srv/docker/syncthing/data:/data"
|
||||
];
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
@ -3,28 +3,29 @@ let
|
|||
remoteMachineIp = configVars.networking.addresses.remote-builder.ip;
|
||||
in
|
||||
{
|
||||
# nix.distributedBuilds = true;
|
||||
# nix.settings.builders-use-substitutes = true;
|
||||
# nix.settings.max-jobs = 0;
|
||||
# nix.settings.trusted-substituters = ["ssh://${remoteMachineIp}"];
|
||||
# nix.settings.substituters = ["ssh://${remoteMachineIp}"];
|
||||
#
|
||||
# nix.buildMachines = [
|
||||
# {
|
||||
# hostName = "remotebuild@${remoteMachineIp}";
|
||||
# speedFactor = 1;
|
||||
# maxJobs = 10;
|
||||
# sshKey = "/root/.ssh/remotebuild";
|
||||
# system = pkgs.stdenv.hostPlatform.system;
|
||||
# supportedFeatures = [ "nixos-test" "benchmark" "big-parallel" "kvm" ];
|
||||
# }
|
||||
# ];
|
||||
nix.distributedBuilds = true;
|
||||
nix.settings.builders-use-substitutes = true;
|
||||
nix.settings.max-jobs = 0;
|
||||
nix.settings.trusted-substituters = ["ssh://${remoteMachineIp}"];
|
||||
nix.settings.substituters = ["ssh://${remoteMachineIp}"];
|
||||
|
||||
programs.ssh.knownHosts = {
|
||||
"merlin" = {
|
||||
publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFSGyrQvwa7gj0tG/EX3siWzGT9badUkD0yw0YGkcNeQ root@merlin";
|
||||
};
|
||||
};
|
||||
nix.buildMachines = [
|
||||
{
|
||||
hostName = "remotebuild@${remoteMachineIp}";
|
||||
speedFactor = 1;
|
||||
maxJobs = 10;
|
||||
sshKey = "/root/.ssh/remotebuild";
|
||||
system = pkgs.stdenv.hostPlatform.system;
|
||||
supportedFeatures = [ "nixos-test" "benchmark" "big-parallel" "kvm" ];
|
||||
}
|
||||
];
|
||||
|
||||
# TODO: set known host here when have static ip on main server
|
||||
# programs.ssh.knownHosts = {
|
||||
# "merlin" = {
|
||||
# publicKey = "server pubkey";
|
||||
# };
|
||||
# };
|
||||
|
||||
programs.ssh.extraConfig = ''
|
||||
Host ${remoteMachineIp}
|
||||
|
|
|
|||
|
|
@ -0,0 +1,27 @@
|
|||
{...}:
|
||||
{
|
||||
fileSystems."/exports" = {
|
||||
device = "/dev/vdb1";
|
||||
fsType = "ext4";
|
||||
};
|
||||
|
||||
services.nfs.server = {
|
||||
enable = true;
|
||||
# fixed rpc.statd port; for firewall
|
||||
lockdPort = 4001;
|
||||
mountdPort = 4002;
|
||||
statdPort = 4000;
|
||||
extraNfsdConfig = '''';
|
||||
exports = ''
|
||||
/exports *(rw,insecure,all_squash)
|
||||
'';
|
||||
};
|
||||
# open nfs ports
|
||||
networking.firewall = {
|
||||
enable = true;
|
||||
# for NFSv3; view with `rpcinfo -p`
|
||||
allowedTCPPorts = [ 111 2049 4000 4001 4002 20048 ];
|
||||
allowedUDPPorts = [ 111 2049 4000 4001 4002 20048 ];
|
||||
};
|
||||
}
|
||||
|
||||
|
|
@ -1,10 +0,0 @@
|
|||
{configVars, pkgs, ...}: let
|
||||
fileserverIp = configVars.networking.addresses.fileserver.ip;
|
||||
in {
|
||||
environment.systemPackages = [pkgs.nfs-utils];
|
||||
fileSystems."/media/media" = {
|
||||
device = "${fileserverIp}:/srv/export/media";
|
||||
fsType = "nfs";
|
||||
options = ["noatime" "_netdev"];
|
||||
};
|
||||
}
|
||||
|
|
@ -1,10 +0,0 @@
|
|||
{configVars, pkgs, ...}: let
|
||||
fileserverIp = configVars.networking.addresses.fileserver.ip;
|
||||
in {
|
||||
environment.systemPackages = [pkgs.nfs-utils];
|
||||
fileSystems."/media/personal" = {
|
||||
device = "${fileserverIp}:/srv/export/personal";
|
||||
fsType = "nfs";
|
||||
options = ["noatime" "_netdev"];
|
||||
};
|
||||
}
|
||||
|
|
@ -1,10 +0,0 @@
|
|||
{configVars, pkgs, ...}: let
|
||||
fileserverIp = configVars.networking.addresses.fileserver.ip;
|
||||
in {
|
||||
environment.systemPackages = [pkgs.nfs-utils];
|
||||
fileSystems."/media/photos" = {
|
||||
device = "${fileserverIp}:/srv/export/photos";
|
||||
fsType = "nfs";
|
||||
options = ["noatime" "_netdev"];
|
||||
};
|
||||
}
|
||||
|
|
@ -1,42 +0,0 @@
|
|||
{configVars, ...}:
|
||||
let
|
||||
homeshareDataLocation = configVars.locations.homeshareDataLocation;
|
||||
subnetIp = configVars.networking.addresses.subnet.ip;
|
||||
in {
|
||||
fileSystems."/srv/export/photos" = {
|
||||
device = "${homeshareDataLocation}/photos";
|
||||
options = [ "bind" ];
|
||||
};
|
||||
|
||||
fileSystems."/srv/export/personal" = {
|
||||
device = "${homeshareDataLocation}/personal";
|
||||
options = [ "bind" ];
|
||||
};
|
||||
|
||||
fileSystems."/srv/export/media" = {
|
||||
device = "${homeshareDataLocation}/media";
|
||||
options = [ "bind" ];
|
||||
};
|
||||
services.nfs.server = {
|
||||
enable = true;
|
||||
# fixed rpc.statd port; for firewall
|
||||
lockdPort = 4001;
|
||||
mountdPort = 4002;
|
||||
statdPort = 4000;
|
||||
extraNfsdConfig = '''';
|
||||
exports = ''
|
||||
/srv/export/photos ${subnetIp}/24(rw,sync,no_subtree_check)
|
||||
/srv/export/media ${subnetIp}/24(rw,sync,no_subtree_check)
|
||||
/srv/export/personal ${subnetIp}/24(rw,sync,no_subtree_check)
|
||||
'';
|
||||
};
|
||||
# open nfs ports
|
||||
networking.firewall = {
|
||||
enable = true;
|
||||
# for NFSv3; view with `rpcinfo -p`
|
||||
allowedTCPPorts = [ 111 2049 4000 4001 4002 20048 ];
|
||||
allowedUDPPorts = [ 111 2049 4000 4001 4002 20048 ];
|
||||
};
|
||||
}
|
||||
|
||||
|
||||
|
|
@ -0,0 +1,9 @@
|
|||
{
|
||||
fileSystems."/media/homeshare" = {
|
||||
device = "10.0.10.30:/mnt/homeshare";
|
||||
fsType = "nfs";
|
||||
options = [ "noatime" "_netdev" ];
|
||||
};
|
||||
}
|
||||
|
||||
|
||||
|
|
@ -0,0 +1,9 @@
|
|||
{configVars, ...}: let
|
||||
mediaDataMountPoint = configVars.locations.mediaDataMountPoint;
|
||||
in {
|
||||
fileSystems.${mediaDataMountPoint} = {
|
||||
device = "10.0.10.30:/mnt/media";
|
||||
fsType = "nfs";
|
||||
options = ["noatime" "_netdev"];
|
||||
};
|
||||
}
|
||||
|
|
@ -0,0 +1,9 @@
|
|||
{configVars, ...}: let
|
||||
photosDataMountPoint = configVars.locations.photosDataMountPoint;
|
||||
in {
|
||||
fileSystems.${photosDataMountPoint} = {
|
||||
device = "10.0.10.30:/mnt/photos";
|
||||
fsType = "nfs";
|
||||
options = ["noatime" "_netdev" "ro"];
|
||||
};
|
||||
}
|
||||
|
|
@ -65,16 +65,6 @@ in {
|
|||
pkgs.apacheHttpd
|
||||
];
|
||||
|
||||
services.prometheus = {
|
||||
exporters = {
|
||||
node = {
|
||||
enable = true;
|
||||
enabledCollectors = ["systemd"];
|
||||
openFirewall = true;
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
services.openssh = {
|
||||
enable = true;
|
||||
settings.PasswordAuthentication = false;
|
||||
|
|
|
|||
|
|
@ -17,14 +17,6 @@ in {
|
|||
];
|
||||
};
|
||||
|
||||
services.restic.backups = {
|
||||
daily = {
|
||||
paths = [
|
||||
baseddataData
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
networking.nat.enable = true;
|
||||
networking.nat.internalInterfaces = ["ve-+"];
|
||||
networking.nat.externalInterface = "br0";
|
||||
|
|
@ -295,16 +287,6 @@ in {
|
|||
};
|
||||
};
|
||||
|
||||
services.prometheus = {
|
||||
exporters = {
|
||||
node = {
|
||||
enable = true;
|
||||
enabledCollectors = ["systemd"];
|
||||
openFirewall = true;
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
services.openssh = {
|
||||
enable = true;
|
||||
settings.PasswordAuthentication = false;
|
||||
|
|
|
|||
|
|
@ -3,15 +3,14 @@
|
|||
lib,
|
||||
inputs,
|
||||
configVars,
|
||||
config,
|
||||
outputs,
|
||||
...
|
||||
}: let
|
||||
containerName = "docker";
|
||||
containerIp = configVars.networking.addresses.docker.ip;
|
||||
gatewayIp = configVars.networking.addresses.gateway.ip;
|
||||
dockerContainerData = configVars.locations.dockerContainerData;
|
||||
homeshareDataLocation = configVars.locations.homeshareDataLocation;
|
||||
mediaDataMountPoint = configVars.locations.mediaDataMountPoint;
|
||||
photosDataMountPoint = configVars.locations.photosDataMountPoint;
|
||||
pubKeys = lib.filesystem.listFilesRecursive ../../users/keys;
|
||||
arion = inputs.arion;
|
||||
sops-nix = inputs.sops-nix;
|
||||
|
|
@ -25,6 +24,8 @@ in {
|
|||
paths = [
|
||||
dockerContainerData
|
||||
];
|
||||
exclude = [
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
|
|
@ -45,14 +46,6 @@ in {
|
|||
];
|
||||
extraFlags = ["--private-users-ownership=chown"];
|
||||
allowedDevices = [
|
||||
{
|
||||
node = "/dev/nvidia0";
|
||||
modifier = "rwm";
|
||||
}
|
||||
{
|
||||
node = "/dev/nvidiactl";
|
||||
modifier = "rwm";
|
||||
}
|
||||
{
|
||||
node = "/dev/fuse";
|
||||
modifier = "rwm";
|
||||
|
|
@ -86,11 +79,7 @@ in {
|
|||
nixpkgs = pkgs.path;
|
||||
bindMounts = {
|
||||
"/media/photos" = {
|
||||
hostPath = "${homeshareDataLocation}/photos";
|
||||
isReadOnly = false;
|
||||
};
|
||||
"/run/opengl-driver/lib" = {
|
||||
hostPath = "/run/opengl-driver/lib";
|
||||
hostPath = photosDataMountPoint;
|
||||
isReadOnly = false;
|
||||
};
|
||||
"/dev/dri" = {
|
||||
|
|
@ -98,7 +87,7 @@ in {
|
|||
isReadOnly = false;
|
||||
};
|
||||
"/media/media" = {
|
||||
hostPath = "${homeshareDataLocation}/media";
|
||||
hostPath = mediaDataMountPoint;
|
||||
isReadOnly = false;
|
||||
};
|
||||
"/srv/docker" = {
|
||||
|
|
@ -119,13 +108,7 @@ in {
|
|||
secretsDirectory = builtins.toString inputs.nix-secrets;
|
||||
secretsFile = "${secretsDirectory}/secrets.yaml";
|
||||
in {
|
||||
|
||||
nixpkgs.overlays = [
|
||||
outputs.overlays.unstable-packages
|
||||
];
|
||||
|
||||
networking = {
|
||||
enableIPv6 = false;
|
||||
defaultGateway = "${gatewayIp}";
|
||||
interfaces.eth0.ipv4.addresses = [
|
||||
{
|
||||
|
|
@ -141,26 +124,6 @@ in {
|
|||
useHostResolvConf = lib.mkForce false;
|
||||
};
|
||||
|
||||
hardware.graphics = {
|
||||
enable = true;
|
||||
};
|
||||
|
||||
nixpkgs.config.allowUnfreePredicate = pkg:
|
||||
builtins.elem (lib.getName pkg) [
|
||||
"nvidia-x11"
|
||||
"nvidia-settings"
|
||||
"nvidia-persistenced"
|
||||
];
|
||||
|
||||
services.xserver.videoDrivers = ["nvidia"];
|
||||
hardware.nvidia = {
|
||||
modesetting.enable = true;
|
||||
powerManagement.enable = false;
|
||||
open = false;
|
||||
nvidiaSettings = false;
|
||||
package = config.boot.kernelPackages.nvidiaPackages.stable;
|
||||
};
|
||||
|
||||
services.resolved.enable = true;
|
||||
|
||||
sops = {
|
||||
|
|
@ -178,7 +141,6 @@ in {
|
|||
../arion-containers/arrstack.nix
|
||||
../arion-containers/jellyfin.nix
|
||||
../arion-containers/photoprism.nix
|
||||
../arion-containers/syncthing.nix
|
||||
];
|
||||
|
||||
environment.systemPackages = [
|
||||
|
|
@ -188,13 +150,10 @@ in {
|
|||
pkgs.dive
|
||||
pkgs.podman-tui
|
||||
pkgs.podman-compose
|
||||
pkgs.unstable.nvidia-container-toolkit
|
||||
];
|
||||
|
||||
virtualisation = {
|
||||
containers.cdi.dynamic.nvidia.enable = true;
|
||||
podman = {
|
||||
enableNvidia = true;
|
||||
enable = true;
|
||||
dockerSocket.enable = true;
|
||||
defaultNetwork.settings.dns_enabled = true;
|
||||
|
|
@ -216,16 +175,6 @@ in {
|
|||
};
|
||||
};
|
||||
|
||||
services.prometheus = {
|
||||
exporters = {
|
||||
node = {
|
||||
enable = true;
|
||||
enabledCollectors = ["systemd"];
|
||||
openFirewall = true;
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
services.openssh = {
|
||||
enable = true;
|
||||
settings.PasswordAuthentication = false;
|
||||
|
|
|
|||
|
|
@ -1,195 +0,0 @@
|
|||
{
|
||||
pkgs,
|
||||
lib,
|
||||
configVars,
|
||||
...
|
||||
}: let
|
||||
containerName = "metrics-server";
|
||||
containerIp = configVars.networking.addresses.metrics-server.ip;
|
||||
|
||||
dockerContainerIp = configVars.networking.addresses.docker.ip;
|
||||
smWorkerIp = configVars.networking.addresses.sm-worker.ip;
|
||||
merlinIp = configVars.networking.addresses.merlin.ip;
|
||||
bdWorker = configVars.networking.addresses.bd-worker.ip;
|
||||
pihole = configVars.networking.addresses.pihole.ip;
|
||||
bitcoinNode = configVars.networking.addresses.bitcoin-node.ip;
|
||||
postres = configVars.networking.addresses.postgres.ip;
|
||||
backupServer = configVars.networking.addresses.backup-server.ip;
|
||||
|
||||
http_endpoints = configVars.metrics-server.blackbox.http_endpoints;
|
||||
|
||||
gatewayIp = configVars.networking.addresses.gateway.ip;
|
||||
metricsServerContainerData = configVars.locations.metricsServerContainerData;
|
||||
pubKeys = lib.filesystem.listFilesRecursive ../../users/keys;
|
||||
in {
|
||||
networking.nat.enable = true;
|
||||
networking.nat.internalInterfaces = ["ve-+"];
|
||||
networking.nat.externalInterface = "br0";
|
||||
|
||||
services.restic.backups = {
|
||||
daily = {
|
||||
paths = [
|
||||
metricsServerContainerData
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
environment.persistence."/persist" = {
|
||||
hideMounts = true;
|
||||
directories = [
|
||||
"/var/lib/nixos-containers/${containerName}"
|
||||
];
|
||||
};
|
||||
|
||||
containers."${containerName}" = {
|
||||
enableTun = true;
|
||||
autoStart = true;
|
||||
privateNetwork = true;
|
||||
hostBridge = "br0";
|
||||
nixpkgs = pkgs.path;
|
||||
bindMounts = {
|
||||
"/var/lib/" = {
|
||||
hostPath = metricsServerContainerData;
|
||||
isReadOnly = false;
|
||||
};
|
||||
};
|
||||
|
||||
config = {
|
||||
pkgs,
|
||||
lib,
|
||||
config,
|
||||
...
|
||||
}: {
|
||||
networking = {
|
||||
defaultGateway = "${gatewayIp}";
|
||||
interfaces.eth0.ipv4.addresses = [
|
||||
{
|
||||
"address" = "${containerIp}";
|
||||
"prefixLength" = 24;
|
||||
}
|
||||
];
|
||||
firewall = {
|
||||
enable = true;
|
||||
allowedTCPPorts = [
|
||||
config.services.prometheus.port
|
||||
config.services.grafana.port
|
||||
config.services.prometheus.exporters.blackbox.port
|
||||
];
|
||||
};
|
||||
useHostResolvConf = lib.mkForce false;
|
||||
};
|
||||
|
||||
services.resolved.enable = true;
|
||||
|
||||
imports = [
|
||||
];
|
||||
|
||||
environment.systemPackages = [
|
||||
pkgs.vim
|
||||
pkgs.git
|
||||
];
|
||||
|
||||
services.prometheus = {
|
||||
enable = true;
|
||||
port = 9001;
|
||||
scrapeConfigs = [
|
||||
{
|
||||
job_name = "node_exporter";
|
||||
static_configs = [
|
||||
{
|
||||
targets = [
|
||||
"${dockerContainerIp}:9100"
|
||||
"${smWorkerIp}:9100"
|
||||
"${merlinIp}:9100"
|
||||
"${bdWorker}:9100"
|
||||
"${pihole}:9100"
|
||||
"${bitcoinNode}:9100"
|
||||
"${postres}:9100"
|
||||
"${backupServer}:9100"
|
||||
];
|
||||
}
|
||||
];
|
||||
}
|
||||
|
||||
{
|
||||
job_name = "blackbox";
|
||||
scrape_interval = "30s";
|
||||
scrape_timeout = "15s";
|
||||
metrics_path = "/probe";
|
||||
params.module = ["http_basic"];
|
||||
relabel_configs = [
|
||||
{
|
||||
source_labels = ["__address__"];
|
||||
target_label = "__param_target";
|
||||
}
|
||||
{
|
||||
source_labels = ["__param_target"];
|
||||
target_label = "instance";
|
||||
}
|
||||
{
|
||||
target_label = "__address__";
|
||||
replacement = "${config.services.prometheus.exporters.blackbox.listenAddress}:${toString config.services.prometheus.exporters.blackbox.port}";
|
||||
}
|
||||
];
|
||||
static_configs = [
|
||||
{targets = http_endpoints;}
|
||||
];
|
||||
}
|
||||
];
|
||||
};
|
||||
|
||||
services.grafana = {
|
||||
enable = true;
|
||||
settings.server = {
|
||||
http_port = 2342;
|
||||
http_addr = "0.0.0.0";
|
||||
};
|
||||
};
|
||||
|
||||
services.prometheus = {
|
||||
exporters = {
|
||||
blackbox = {
|
||||
enable = true;
|
||||
configFile = pkgs.writeText "blackbox-conf.yaml" ''
|
||||
modules:
|
||||
http_basic:
|
||||
prober: http
|
||||
timeout: 5s
|
||||
http:
|
||||
preferred_ip_protocol: ip4
|
||||
valid_http_versions: ["HTTP/1.1", "HTTP/2"]
|
||||
method: GET
|
||||
fail_if_ssl: false
|
||||
fail_if_not_ssl: true
|
||||
tls_config:
|
||||
insecure_skip_verify: true
|
||||
tcp_connect:
|
||||
prober: tcp
|
||||
tcp:
|
||||
preferred_ip_protocol: ip4
|
||||
|
||||
'';
|
||||
};
|
||||
node = {
|
||||
enable = true;
|
||||
enabledCollectors = ["systemd"];
|
||||
port = 9002;
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
services.openssh = {
|
||||
enable = true;
|
||||
settings.PasswordAuthentication = false;
|
||||
};
|
||||
|
||||
users.users = {
|
||||
root = {
|
||||
openssh.authorizedKeys.keys = lib.lists.forEach pubKeys (key: builtins.readFile key);
|
||||
};
|
||||
};
|
||||
|
||||
system.stateVersion = "24.05";
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
@ -10,7 +10,6 @@
|
|||
containerIp = configVars.networking.addresses.bitcoin-node.ip;
|
||||
mempoolPort = configVars.networking.addresses.bitcoin-node.services.mempool.port;
|
||||
bitcoinNodeContainerData = configVars.locations.bitcoinNodeContainerData;
|
||||
bitcoindData = configVars.locations.bitcoindData;
|
||||
gatewayIp = configVars.networking.addresses.gateway.ip;
|
||||
allowip = configVars.networking.addresses.bitcoin-node.services.bitcoind.allowip;
|
||||
pubKeys = lib.filesystem.listFilesRecursive ../../users/keys;
|
||||
|
|
@ -22,7 +21,7 @@ in {
|
|||
bitcoinNodeContainerData
|
||||
];
|
||||
exclude = [
|
||||
"${bitcoindData}"
|
||||
"${bitcoinNodeContainerData}/bitcoind"
|
||||
"${bitcoinNodeContainerData}/electrs"
|
||||
];
|
||||
};
|
||||
|
|
@ -49,10 +48,6 @@ in {
|
|||
hostPath = bitcoinNodeContainerData;
|
||||
isReadOnly = false;
|
||||
};
|
||||
"/var/lib/bitcoind" = {
|
||||
hostPath = bitcoindData;
|
||||
isReadOnly = false;
|
||||
};
|
||||
};
|
||||
|
||||
config = {
|
||||
|
|
@ -186,16 +181,6 @@ in {
|
|||
lnd.public = true;
|
||||
};
|
||||
|
||||
services.prometheus = {
|
||||
exporters = {
|
||||
node = {
|
||||
enable = true;
|
||||
enabledCollectors = ["systemd"];
|
||||
openFirewall = true;
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
services.openssh = {
|
||||
enable = true;
|
||||
settings.PasswordAuthentication = false;
|
||||
|
|
|
|||
|
|
@ -8,7 +8,7 @@
|
|||
containerName = "pihole";
|
||||
containerIp = configVars.networking.addresses.pihole.ip;
|
||||
gatewayIp = configVars.networking.addresses.gateway.ip;
|
||||
piholeContainerData = configVars.locations.piholeContainerData;
|
||||
piholeContainerData = configVars.locations.dockerContainerData;
|
||||
pubKeys = lib.filesystem.listFilesRecursive ../../users/keys;
|
||||
arion = inputs.arion;
|
||||
in {
|
||||
|
|
@ -16,6 +16,16 @@ in {
|
|||
networking.nat.internalInterfaces = ["ve-+"];
|
||||
networking.nat.externalInterface = "br0";
|
||||
|
||||
services.restic.backups = {
|
||||
daily = {
|
||||
paths = [
|
||||
piholeContainerData
|
||||
];
|
||||
exclude = [
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
environment.persistence."/persist" = {
|
||||
hideMounts = true;
|
||||
directories = [
|
||||
|
|
@ -68,7 +78,7 @@ in {
|
|||
useHostResolvConf = lib.mkForce false;
|
||||
};
|
||||
|
||||
services.resolved.enable = false;
|
||||
services.resolved.enable = true;
|
||||
|
||||
imports = [
|
||||
arion.nixosModules.arion
|
||||
|
|
@ -79,8 +89,6 @@ in {
|
|||
pkgs.vim
|
||||
pkgs.git
|
||||
pkgs.arion
|
||||
pkgs.lsof
|
||||
pkgs.podman-compose
|
||||
];
|
||||
|
||||
virtualisation = {
|
||||
|
|
@ -94,16 +102,6 @@ in {
|
|||
|
||||
networking.firewall.interfaces."podman+".allowedUDPPorts = [53];
|
||||
|
||||
services.prometheus = {
|
||||
exporters = {
|
||||
node = {
|
||||
enable = true;
|
||||
enabledCollectors = ["systemd"];
|
||||
openFirewall = true;
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
services.openssh = {
|
||||
enable = true;
|
||||
settings.PasswordAuthentication = false;
|
||||
|
|
|
|||
|
|
@ -123,16 +123,6 @@ in {
|
|||
# EOF
|
||||
# '';
|
||||
|
||||
services.prometheus = {
|
||||
exporters = {
|
||||
node = {
|
||||
enable = true;
|
||||
enabledCollectors = ["systemd"];
|
||||
openFirewall = true;
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
services.openssh = {
|
||||
enable = true;
|
||||
settings.PasswordAuthentication = false;
|
||||
|
|
|
|||
|
|
@ -24,14 +24,6 @@ in {
|
|||
];
|
||||
};
|
||||
|
||||
services.restic.backups = {
|
||||
daily = {
|
||||
paths = [
|
||||
semitamapsData
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
containers."${containerName}" = {
|
||||
enableTun = true;
|
||||
|
||||
|
|
@ -108,7 +100,6 @@ in {
|
|||
pkgs.vim
|
||||
pkgs.git
|
||||
pkgs.arion
|
||||
pkgs.podman-compose
|
||||
pkgs.jdk
|
||||
];
|
||||
|
||||
|
|
@ -137,16 +128,6 @@ in {
|
|||
};
|
||||
};
|
||||
|
||||
services.prometheus = {
|
||||
exporters = {
|
||||
node = {
|
||||
enable = true;
|
||||
enabledCollectors = ["systemd"];
|
||||
openFirewall = true;
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
services.openssh = {
|
||||
enable = true;
|
||||
settings.PasswordAuthentication = false;
|
||||
|
|
|
|||
|
|
@ -4,10 +4,13 @@
|
|||
hideMounts = true;
|
||||
directories = [
|
||||
"/etc/nixos"
|
||||
"/srv"
|
||||
"/var/log"
|
||||
"/var/lib/nixos"
|
||||
"/var/lib/systemd/coredump"
|
||||
"/etc/NetworkManager/system-connections"
|
||||
"/var/lib/flatpak"
|
||||
"/run/secrets-for-users"
|
||||
];
|
||||
files = [
|
||||
"/etc/ssh/ssh_host_ed25519_key"
|
||||
|
|
|
|||
|
|
@ -14,11 +14,6 @@ in {
|
|||
sops.secrets = {};
|
||||
services.restic.backups = {
|
||||
daily = {
|
||||
timerConfig = {
|
||||
OnCalendar = "*-*-* 20:00:00";
|
||||
Persistent = true;
|
||||
RandomizedDelaySec = "4h";
|
||||
};
|
||||
initialize = true;
|
||||
passwordFile = passwordFile;
|
||||
paths = [
|
||||
|
|
|
|||
|
|
@ -1,31 +1,31 @@
|
|||
{
|
||||
pkgs,
|
||||
inputs,
|
||||
config,
|
||||
lib,
|
||||
...
|
||||
}: let
|
||||
{ pkgs, inputs, config, lib, ... }:
|
||||
let
|
||||
ifTheyExist = groups: builtins.filter (group: builtins.hasAttr group config.users.groups) groups;
|
||||
username = "admin";
|
||||
pubKeys = lib.filesystem.listFilesRecursive ../keys;
|
||||
pubKeys = lib.filesystem.listFilesRecursive (../keys);
|
||||
hostname = config.networking.hostName;
|
||||
sopsHashedPasswordFile = config.sops.secrets."passwords/${username}".path;
|
||||
sopsHashedPasswordFile = lib.optionalString (lib.hasAttr "sops-nix" inputs) config.sops.secrets."passwords/${username}".path;
|
||||
secretsDirectory = builtins.toString inputs.nix-secrets;
|
||||
secretsFile = "${secretsDirectory}/secrets.yaml";
|
||||
in {
|
||||
|
||||
in
|
||||
{
|
||||
users.users.${username} = {
|
||||
isNormalUser = true;
|
||||
shell = pkgs.zsh;
|
||||
shell = pkgs.zsh; # default shell
|
||||
hashedPasswordFile = sopsHashedPasswordFile;
|
||||
openssh.authorizedKeys.keys = lib.lists.forEach pubKeys (key: builtins.readFile key);
|
||||
|
||||
extraGroups = [
|
||||
"wheel"
|
||||
] ++ ifTheyExist [
|
||||
"docker"
|
||||
"lxc"
|
||||
"git"
|
||||
"podman"
|
||||
];
|
||||
};
|
||||
|
||||
environment.persistence."/persist" = {
|
||||
directories = [
|
||||
"/home/${username}"
|
||||
packages = with pkgs; [
|
||||
];
|
||||
};
|
||||
|
||||
|
|
@ -44,9 +44,6 @@ in {
|
|||
mode = "0644";
|
||||
owner = "${username}";
|
||||
};
|
||||
"github-access-token" = {
|
||||
mode = "0655";
|
||||
};
|
||||
};
|
||||
|
||||
programs.zsh.enable = true;
|
||||
|
|
|
|||
|
|
@ -133,7 +133,6 @@ in {
|
|||
environment.persistence."/persist" = {
|
||||
directories = [
|
||||
"/home/${username}"
|
||||
"/var/lib/tailscale"
|
||||
];
|
||||
};
|
||||
|
||||
|
|
|
|||
|
|
@ -1,42 +1,21 @@
|
|||
{
|
||||
inputs,
|
||||
configVars,
|
||||
lib,
|
||||
config,
|
||||
outputs,
|
||||
...
|
||||
}: let
|
||||
{ inputs, ... }:
|
||||
let
|
||||
# Disko setup
|
||||
fsType = "btrfs"; # one of ext4 or btrfs. Use btrfs if using impermanence
|
||||
dev = "/dev/disk/by-id/wwn-0x5001b448b5f7cc7f";
|
||||
dev = "/dev/disk/by-id/ata-QEMU_HARDDISK_QM00005";
|
||||
encrypted = false; # currrently only applies to btrfs
|
||||
btrfsMountDevice = "/dev/disk/by-id/wwn-0x5001b448b5f7cc7f-part2";
|
||||
impermanence = true;
|
||||
|
||||
homeshareDataLocation = configVars.locations.homeshareDataLocation;
|
||||
|
||||
piholeIp = configVars.networking.addresses.pihole.ip;
|
||||
gatewayIp = configVars.networking.addresses.gateway.ip;
|
||||
merlinIp = configVars.networking.addresses.merlin.ip;
|
||||
in {
|
||||
imports = [
|
||||
impermanence = false;
|
||||
user = "admin";
|
||||
in
|
||||
{
|
||||
imports =
|
||||
[
|
||||
# Create users for this host
|
||||
../common/users/admin
|
||||
../common/users/${user}
|
||||
|
||||
# Disk configuration
|
||||
# Root disk configuration
|
||||
inputs.disko.nixosModules.disko
|
||||
(import ../common/disks {
|
||||
device = dev;
|
||||
impermanence = impermanence;
|
||||
fsType = fsType;
|
||||
encrypted = encrypted;
|
||||
})
|
||||
|
||||
# Impermanence
|
||||
../common/optional/persistence.nix
|
||||
(import ../common/disks/btrfs/impermanence.nix {
|
||||
btrfsMountDevice = btrfsMountDevice;
|
||||
lib = lib;
|
||||
})
|
||||
(import ../common/disks { device = dev; impermanence = impermanence; fsType = fsType; encrypted = encrypted; })
|
||||
|
||||
# Import core options
|
||||
./hardware-configuration.nix
|
||||
|
|
@ -44,26 +23,9 @@ in {
|
|||
|
||||
# Import optional options
|
||||
../common/optional/openssh.nix
|
||||
../common/optional/restic-backup.nix
|
||||
../common/optional/docker.nix
|
||||
../common/optional/nix-ld.nix
|
||||
../common/optional/fileserver/nfs-server/homeshare.nix
|
||||
../common/optional/docker
|
||||
../common/optional/docker/postgres.nix
|
||||
|
||||
# Nixos containers
|
||||
../common/optional/nixos-containers/docker.nix
|
||||
../common/optional/nixos-containers/baseddata-worker.nix
|
||||
../common/optional/nixos-containers/pihole.nix
|
||||
../common/optional/nixos-containers/semitamaps-worker.nix
|
||||
../common/optional/nixos-containers/nix-bitcoin.nix
|
||||
../common/optional/nixos-containers/postgres.nix
|
||||
../common/optional/nixos-containers/baseddata-worker.nix
|
||||
../common/optional/nixos-containers/backup-server.nix
|
||||
../common/optional/nixos-containers/metrics-server.nix
|
||||
|
||||
# This machine is used for remote building
|
||||
../common/optional/distributed-builds/remote-builder-machine.nix
|
||||
|
||||
outputs.nixosModules.nixosAutoUpgrade
|
||||
];
|
||||
|
||||
boot = {
|
||||
|
|
@ -74,102 +36,17 @@ in {
|
|||
};
|
||||
};
|
||||
|
||||
fileSystems."/mnt/main-ssd" = {
|
||||
device = "/dev/disk/by-uuid/ba884006-e813-4b67-9fe6-62aea08b3b59";
|
||||
fsType = "ext4";
|
||||
};
|
||||
|
||||
fileSystems."/mnt/btcnode" = {
|
||||
device = "/dev/disk/by-uuid/1dc56ec7-322f-44be-b6ad-79360fdfef93";
|
||||
fsType = "btrfs";
|
||||
};
|
||||
|
||||
networking = {
|
||||
hostName = "merlin";
|
||||
nameservers = ["${piholeIp}" "${gatewayIp}" "8.8.8.8"];
|
||||
defaultGateway = "${gatewayIp}";
|
||||
useDHCP = false;
|
||||
networkmanager.enable = true;
|
||||
enableIPv6 = false;
|
||||
bridges = {
|
||||
br0 = {
|
||||
interfaces = ["eth0"];
|
||||
};
|
||||
};
|
||||
interfaces.br0 = {
|
||||
ipv4.addresses = [
|
||||
{
|
||||
"address" = "${merlinIp}";
|
||||
"prefixLength" = 24;
|
||||
}
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
environment.persistence."/persist" = {
|
||||
directories = [
|
||||
"/etc/zpool"
|
||||
"/var/lib/tailscale"
|
||||
];
|
||||
};
|
||||
|
||||
services.restic.backups = {
|
||||
daily = {
|
||||
paths = [
|
||||
homeshareDataLocation
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
# Enable OpenGL
|
||||
hardware.graphics = {
|
||||
enable = true;
|
||||
};
|
||||
|
||||
# enable tailscale
|
||||
services.tailscale.useRoutingFeatures = "server";
|
||||
services.tailscale.enable = true;
|
||||
|
||||
nixpkgs.config.allowUnfreePredicate = pkg:
|
||||
builtins.elem (lib.getName pkg) [
|
||||
"nvidia-x11"
|
||||
"nvidia-settings"
|
||||
"nvidia-persistenced"
|
||||
];
|
||||
|
||||
# Load nvidia driver
|
||||
services.xserver.videoDrivers = ["nvidia"];
|
||||
hardware.nvidia = {
|
||||
modesetting.enable = true;
|
||||
powerManagement.enable = false;
|
||||
open = false;
|
||||
nvidiaSettings = false;
|
||||
package = config.boot.kernelPackages.nvidiaPackages.stable;
|
||||
};
|
||||
|
||||
system.services.nixosAutoUpgrade = {
|
||||
enable = true;
|
||||
persistent = false;
|
||||
reboot = true;
|
||||
pushUpdates = true;
|
||||
configDir = "/etc/nixos";
|
||||
onCalendar = "*-*-* 03:00:00";
|
||||
user = "admin";
|
||||
};
|
||||
|
||||
services.prometheus = {
|
||||
exporters = {
|
||||
node = {
|
||||
enable = true;
|
||||
enabledCollectors = ["systemd"];
|
||||
openFirewall = true;
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
boot.supportedFilesystems = [ "zfs" ];
|
||||
boot.zfs.forceImportRoot = false;
|
||||
networking.hostId = "18aec5d7";
|
||||
boot.zfs.extraPools = ["deepzfs" "nvme-zpool"];
|
||||
boot.zfs.extraPools = [ "zspeed" ];
|
||||
|
||||
services.libinput.enable = true;
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -4,6 +4,9 @@
|
|||
{ config, lib, pkgs, modulesPath, ... }:
|
||||
|
||||
{
|
||||
imports =
|
||||
[ (modulesPath + "/profiles/qemu-guest.nix")
|
||||
];
|
||||
|
||||
boot.initrd.availableKernelModules = [ "ahci" "xhci_pci" "virtio_pci" "sr_mod" "virtio_blk" ];
|
||||
boot.initrd.kernelModules = [ "dm-snapshot" ];
|
||||
|
|
|
|||
|
|
@ -18,7 +18,6 @@
|
|||
impermanence = true;
|
||||
piholeIp = configVars.networking.addresses.pihole.ip;
|
||||
gatewayIp = configVars.networking.addresses.gateway.ip;
|
||||
merlinIp = configVars.networking.addresses.merlin.ip;
|
||||
semitaIp = configVars.networking.addresses.semita.ip;
|
||||
in {
|
||||
imports = [
|
||||
|
|
@ -55,12 +54,30 @@ in {
|
|||
../common/optional/gaming.nix
|
||||
../common/optional/restic-backup.nix
|
||||
|
||||
../common/optional/distributed-builds/local-machine.nix
|
||||
# nfs mounts
|
||||
../common/optional/nfs-mounts/media.nix
|
||||
../common/optional/nfs-mounts/homeshare.nix
|
||||
../common/optional/nfs-mounts/photos.nix
|
||||
|
||||
# nixos-containers
|
||||
../common/optional/nixos-containers/nix-bitcoin.nix
|
||||
../common/optional/nixos-containers/postgres.nix
|
||||
../common/optional/nixos-containers/baseddata-worker.nix
|
||||
../common/optional/nixos-containers/semitamaps-worker.nix
|
||||
../common/optional/nixos-containers/backup-server.nix
|
||||
../common/optional/nixos-containers/docker.nix
|
||||
# ../common/optional/nixos-containers/pihole.nix
|
||||
|
||||
# # Build nix derivations on remote machine
|
||||
# ../common/optional/distributed-builds/local-machine.nix
|
||||
|
||||
outputs.nixosModules.nixosAutoUpgrade
|
||||
];
|
||||
|
||||
services.tailscale.useRoutingFeatures = "server";
|
||||
fileSystems."/mnt/main-ssd" = {
|
||||
device = "/dev/disk/by-uuid/ba884006-e813-4b67-9fe6-62aea08b3b59";
|
||||
fsType = "ext4";
|
||||
};
|
||||
|
||||
boot = {
|
||||
blacklistedKernelModules = ["snd_hda_intel" "snd_soc_skl"];
|
||||
|
|
@ -87,11 +104,10 @@ in {
|
|||
system.services.nixosAutoUpgrade = {
|
||||
enable = true;
|
||||
persistent = true;
|
||||
remote = "remotebuild@${merlinIp}";
|
||||
reboot = false;
|
||||
pushUpdates = false;
|
||||
pushUpdates = true;
|
||||
configDir = "/etc/nixos";
|
||||
onCalendar = "*-*-* 06:00:00";
|
||||
onCalendar = "daily";
|
||||
user = "sam";
|
||||
};
|
||||
|
||||
|
|
|
|||
|
|
@ -3,7 +3,6 @@
|
|||
config,
|
||||
lib,
|
||||
configVars,
|
||||
outputs,
|
||||
...
|
||||
}: let
|
||||
# Disko setup
|
||||
|
|
@ -44,10 +43,9 @@ in {
|
|||
# Import optional options
|
||||
../common/optional/openssh.nix
|
||||
../common/optional/persistence.nix
|
||||
# ../common/optional/fileserver/media.nix
|
||||
../common/optional/nfs-mounts/media.nix
|
||||
../common/optional/gaming.nix
|
||||
../common/optional/printing.nix
|
||||
outputs.nixosModules.nixosAutoUpgrade
|
||||
];
|
||||
|
||||
boot = {
|
||||
|
|
@ -77,16 +75,6 @@ in {
|
|||
services.displayManager.defaultSession = "cinnamon";
|
||||
services.libinput.enable = true;
|
||||
|
||||
system.services.nixosAutoUpgrade = {
|
||||
enable = true;
|
||||
persistent = true;
|
||||
reboot = false;
|
||||
pushUpdates = false;
|
||||
configDir = "/etc/nixos";
|
||||
onCalendar = "*-*-* 07:00:00";
|
||||
user = "media";
|
||||
};
|
||||
|
||||
services.xserver = {
|
||||
enable = true;
|
||||
videoDrivers = ["nvidia"];
|
||||
|
|
@ -102,6 +90,7 @@ in {
|
|||
# Enable OpenGL
|
||||
hardware.opengl = {
|
||||
enable = true;
|
||||
driSupport = true;
|
||||
driSupport32Bit = true;
|
||||
};
|
||||
|
||||
|
|
|
|||
|
|
@ -25,10 +25,6 @@ in
|
|||
description = "Automatically reboots the system if there is a kernel or systemd update.";
|
||||
default = false;
|
||||
};
|
||||
remote = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
description = "Attempts build on remote host <user@host>.";
|
||||
};
|
||||
onCalendar = lib.mkOption {
|
||||
default = "daily";
|
||||
type = lib.types.str;
|
||||
|
|
@ -76,12 +72,11 @@ in
|
|||
unitConfig.RequiresMountsFor = cfg.configDir;
|
||||
script = lib.strings.concatStrings [
|
||||
"${auto-update-nixos}/bin/auto-update-nixos --operation ${cfg.operation} "
|
||||
(if cfg.configDir != "" then "--flake ${cfg.configDir} " else "")
|
||||
(if cfg.user != "" then "--user ${cfg.user} " else "")
|
||||
(if cfg.pushUpdates then "--update " else "")
|
||||
(if cfg.reboot then "--reboot " else "")
|
||||
(if cfg.remote != "" then "--build-host ${cfg.remote} " else "")
|
||||
cfg.extraFlags
|
||||
(lib.mkIf (cfg.configDir != "") "--flake ${cfg.configDir} ").content
|
||||
(lib.mkIf (cfg.user != "") "--user ${cfg.user} ").content
|
||||
(lib.mkIf (cfg.pushUpdates) "--update ").content
|
||||
(lib.mkIf (cfg.reboot) "--reboot ").content
|
||||
(lib.mkIf (cfg.extraFlags != "") cfg.extraFlags).content
|
||||
];
|
||||
};
|
||||
timers."nixos-upgrade" = {
|
||||
|
|
|
|||
|
|
@ -40,48 +40,41 @@ trap cleanup EXIT
|
|||
# Create the directory for target host keys
|
||||
install -d -m755 "$temp$persist/etc/ssh"
|
||||
|
||||
# Extract ssh keys from secrets
|
||||
echo "Extracting ssh keys"
|
||||
ssh_private_key=$(nix-shell -p sops --run "SOPS_AGE_KEY_FILE=~/.config/sops/age/keys.txt sops -d --extract '[""\"ssh_keys""\"][""\"$hostname""\"][""\"id_ed25519""\"]' ~/.local/share/src/nix-secrets/secrets.yaml")
|
||||
echo "$ssh_private_key" > $temp$persist/etc/ssh/ssh_host_ed25519_key
|
||||
ssh_pub_key=$(nix-shell -p sops --run "SOPS_AGE_KEY_FILE=~/.config/sops/age/keys.txt sops -d --extract '[""\"ssh_keys""\"][""\"$hostname""\"][""\"id_ed25519.pub""\"]' ~/.local/share/src/nix-secrets/secrets.yaml")
|
||||
echo "$ssh_pub_key" > $temp$persist/etc/ssh/ssh_host_ed25519_key.pub
|
||||
# Create ssh keys
|
||||
echo "Creating '$hostname' ssh keys"
|
||||
ssh-keygen -t ed25519 -f "$temp$persist/etc/ssh/ssh_host_ed25519_key" -C root@"$hostname" -N ""
|
||||
|
||||
# # Extract luks key from secrets
|
||||
# luks_secret=$(nix-shell -p sops --run "SOPS_AGE_KEY_FILE=~/.config/sops/age/keys.txt sops -d --extract '[""\"luks_passphrase""\"][""\"$hostname""\"]' ~/.local/share/src/nix-secrets/secrets.yaml")
|
||||
# echo "$luks_secret" > /tmp/luks_secret.key
|
||||
# Extract luks key from secrets
|
||||
luks_secret=$(nix-shell -p sops --run "SOPS_AGE_KEY_FILE=~/.config/sops/age/keys.txt sops -d --extract '[""\"luks_passphrase""\"][""\"$hostname""\"]' ~/.local/share/src/nix-secrets/secrets.yaml")
|
||||
echo "$luks_secret" > /tmp/luks_secret.key
|
||||
|
||||
# # Create ssh keys
|
||||
# echo "Creating '$hostname' ssh keys"
|
||||
# ssh-keygen -t ed25519 -f "$temp$persist/etc/ssh/ssh_host_ed25519_key" -C root@"$hostname" -N ""
|
||||
# Generate age key from target host and user public ssh key
|
||||
echo "Generating age key from target host and user ssh key"
|
||||
HOST_AGE_KEY=$(nix-shell -p ssh-to-age --run "cat $temp$persist/etc/ssh/ssh_host_ed25519_key.pub | ssh-to-age")
|
||||
echo -e "Host age key:\n$HOST_AGE_KEY\n"
|
||||
|
||||
# # Generate age key from target host and user public ssh key
|
||||
# echo "Generating age key from target host and user ssh key"
|
||||
# HOST_AGE_KEY=$(nix-shell -p ssh-to-age --run "cat $temp$persist/etc/ssh/ssh_host_ed25519_key.pub | ssh-to-age")
|
||||
# echo -e "Host age key:\n$HOST_AGE_KEY\n"
|
||||
# Update .sops.yaml with new age key:
|
||||
SOPS_FILE="$HOME/.local/share/src/nix-secrets/.sops.yaml"
|
||||
sed -i "{
|
||||
# Remove any * and & entries for this host
|
||||
/[*&]$hostname/ d;
|
||||
# Inject a new age: entry
|
||||
# n matches the first line following age: and p prints it, then we transform it while reusing the spacing
|
||||
/age:/{n; p; s/\(.*- \*\).*/\1$hostname/};
|
||||
# Inject a new hosts: entry
|
||||
/&hosts:/{n; p; s/\(.*- &\).*/\1$hostname $HOST_AGE_KEY/}
|
||||
}" "$SOPS_FILE"
|
||||
|
||||
# # Update .sops.yaml with new age key:
|
||||
# SOPS_FILE="$HOME/.local/share/src/nix-secrets/.sops.yaml"
|
||||
# sed -i "{
|
||||
# # Remove any * and & entries for this host
|
||||
# /[*&]$hostname/ d;
|
||||
# # Inject a new age: entry
|
||||
# # n matches the first line following age: and p prints it, then we transform it while reusing the spacing
|
||||
# /age:/{n; p; s/\(.*- \*\).*/\1$hostname/};
|
||||
# # Inject a new hosts: entry
|
||||
# /&hosts:/{n; p; s/\(.*- &\).*/\1$hostname $HOST_AGE_KEY/}
|
||||
# }" "$SOPS_FILE"
|
||||
|
||||
# # Commit and push changes to sops file
|
||||
# just update-sops-secrets && just update-flake-secrets && just update-flake
|
||||
# Commit and push changes to sops file
|
||||
just update-sops-secrets && just update-flake-secrets && just update-flake
|
||||
|
||||
# Copy current nix config over to target
|
||||
echo "copying current nix config to host"
|
||||
cp -pr . "$temp$persist/etc/nixos"
|
||||
|
||||
# Install Nixos to target
|
||||
SHELL=/bin/sh nix run github:nix-community/nixos-anywhere/1.6.0 -- --extra-files "$temp" --flake .#"$config" root@"$ip" -i "$HOME/.ssh/id_ed25519"
|
||||
echo $?
|
||||
SHELL=/bin/sh nix run github:nix-community/nixos-anywhere/1.3.0 -- --extra-files "$temp" --disk-encryption-keys /tmp/luks_secret.key /tmp/luks_secret.key --flake .#"$config" root@"$ip" -i "$HOME/.ssh/id_ed25519"
|
||||
[ $? != 0 ] && echo "Error installing Nixos" && exit 1
|
||||
|
||||
## Delete keys from local known_hosts
|
||||
echo "Deleting host from known_hosts"
|
||||
|
|
|
|||
|
|
@ -3,22 +3,18 @@
|
|||
inherit (inputs.nix-secrets)
|
||||
networking
|
||||
email
|
||||
metrics-server
|
||||
;
|
||||
locations = {
|
||||
mediaDataMountPoint = "/media/media";
|
||||
photosDataMountPoint = "/media/photos";
|
||||
personalDataMountPoint = "/media/personal";
|
||||
homeshareDataLocation = "/mnt/main-ssd/homeshare";
|
||||
metricsServerContainerData = "/mnt/main-ssd/metrics-server";
|
||||
|
||||
dockerContainerData = "/mnt/main-ssd/docker";
|
||||
piholeContainerData = "/mnt/main-ssd/docker/pihole";
|
||||
baseddataData = "/mnt/main-ssd/baseddata-data";
|
||||
bitcoinNodeContainerData = "/mnt/main-ssd/nix-bitcoin";
|
||||
bitcoindData = "/mnt/btcnode/bitcoind";
|
||||
backupContainerData = "/mnt/deepzfs/backup";
|
||||
postgresContainerData = "/mnt/nvme-zpool/postgresql";
|
||||
semitamapsData = "/mnt/nvme-zpool/semitamaps-data";
|
||||
backupContainerData = "/mnt/main-ssd/backup";
|
||||
postgresContainerData = "/mnt/main-ssd/postgresql";
|
||||
semitamapsData = "/mnt/main-ssd/semitamaps-data";
|
||||
baseddataData = "/mnt/main-ssd/baseddata-data";
|
||||
};
|
||||
|
||||
}
|
||||
|
|
|
|||
Loading…
Reference in New Issue