-10

README.md

··· 35 35 - Vaultwarden password manager 36 36 - Beszel 37 37 38 38 - ### 🥧 Morax (Raspberry Pi 4) 39 39 - **Hardware**: Raspberry Pi 4 40 40 - 41 41 - **Services**: 42 42 - - Pi-hole DNS filtering 43 43 - - Speedtest monitoring (every 10 minutes) 44 44 - - Headscale connection 45 45 - 46 46 - **Notes**: Direct gigabit connection from router - looking to add more services to utilize bandwidth 47 47 - 48 38 ### 🍎 Gabriel 49 39 **Hardware**: M4 16gb Mac Mini 50 40

+8

common/bluetooth.nix

··· 1 1 + { config, lib ,... }: 2 2 + 3 3 + { 4 4 + hardware.bluetooth.enable = true; 5 5 + hardware.bluetooth.powerOnBoot = true; 6 6 + 7 7 + services.blueman.enable = true; 8 8 + }

+17 -2

common/desktop/core.nix

··· 5 5 #ghostty 6 6 kitty 7 7 vscode 8 8 - inputs.zen-browser.packages."${system}".default 9 8 fastfetch 10 9 hyfetch 11 10 sway-contrib.grimshot 12 12 - discord 11 11 + pamixer 12 12 + 13 13 + firefox 14 14 + chromium 15 15 + kpcli 16 16 + eyedropper 17 17 + krita 18 18 + xfce.thunar 19 19 + libreoffice 20 20 + signal-desktop 21 21 + haruna 22 22 + 23 23 + inputs.zen-browser.packages."${system}".default 24 24 + ]; 25 25 + 26 26 + fonts.packages = [ 27 27 + pkgs.nerd-fonts.fira-code 13 28 ]; 14 29 15 30 environment.sessionVariables.NIXOS_OZONE_WL = "1";

+3

common/desktop/sway.nix

··· 17 17 mako 18 18 ]; 19 19 20 20 + services.dbus.enable = true; 21 21 + 20 22 programs.sway = { 21 23 enable = true; 22 24 wrapperFeatures.gtk = true; 25 25 + package = pkgs.swayfx; 23 26 }; 24 27 25 28 environment.sessionVariables = {

+2 -2

common/desktop/vnc.nix

··· 2 2 3 3 { 4 4 services.xserver.enable = true; 5 5 - services.xserver.displayManager.sddm.enable = true; 6 6 - services.xserver.desktopManager.plasma5.enable = true; 5 5 + services.displayManager.sddm.enable = true; 6 6 + services.desktopManager.plasma6.enable = true; 7 7 8 8 services.xrdp.enable = true; 9 9 services.xrdp.defaultWindowManager = "startplasma-x11";

+1 -1

common/nvidia.nix

··· 31 31 # supported GPUs is at: 32 32 # https://github.com/NVIDIA/open-gpu-kernel-modules#compatible-gpus 33 33 # Only available from driver 515.43.04+ 34 34 - open = false; 34 34 + open = true; 35 35 36 36 # Enable the Nvidia settings menu, 37 37 # accessible via `nvidia-settings`.

+67

common/python-cuda-dev.nix

··· 1 1 + { 2 2 + description = "A Nix-flake-based PyTorch development environment"; 3 3 + 4 4 + # CUDA binaries are cached by the community. 5 5 + nixConfig = { 6 6 + extra-substituters = [ 7 7 + "https://nix-community.cachix.org" 8 8 + ]; 9 9 + extra-trusted-public-keys = [ 10 10 + "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs=" 11 11 + ]; 12 12 + }; 13 13 + 14 14 + inputs.nixpkgs.url = "https://flakehub.com/f/NixOS/nixpkgs/0.1.*.tar.gz"; 15 15 + 16 16 + outputs = { 17 17 + self, 18 18 + nixpkgs, 19 19 + }: let 20 20 + supportedSystems = ["x86_64-linux" "aarch64-linux" "x86_64-darwin" "aarch64-darwin"]; 21 21 + forEachSupportedSystem = f: 22 22 + nixpkgs.lib.genAttrs supportedSystems (system: 23 23 + f { 24 24 + pkgs = import nixpkgs { 25 25 + inherit system; 26 26 + config.allowUnfree = true; 27 27 + }; 28 28 + }); 29 29 + in { 30 30 + devShells = forEachSupportedSystem ({pkgs}: let 31 31 + libs = [ 32 32 + # PyTorch and Numpy depends on the following libraries. 33 33 + pkgs.cudaPackages.cudatoolkit 34 34 + pkgs.cudaPackages.cudnn 35 35 + pkgs.stdenv.cc.cc.lib 36 36 + pkgs.zlib 37 37 + 38 38 + # PyTorch also needs to know where your local "lib/libcuda.so" lives. 39 39 + # If you're not on NixOS, you should provide the right path (likely 40 40 + # another one). 41 41 + "/run/opengl-driver" 42 42 + ]; 43 43 + in { 44 44 + default = pkgs.mkShell { 45 45 + packages = [ 46 46 + pkgs.python312 47 47 + pkgs.python312Packages.venvShellHook 48 48 + ]; 49 49 + 50 50 + env = { 51 51 + CC = "${pkgs.gcc}/bin/gcc"; # For `torch.compile`. 52 52 + LD_LIBRARY_PATH = pkgs.lib.makeLibraryPath libs; 53 53 + }; 54 54 + 55 55 + venvDir = ".venv"; 56 56 + postVenvCreation = '' 57 57 + # This is run only when creating the virtual environment. 58 58 + pip install torch==2.5.1 numpy==2.2.2 59 59 + ''; 60 60 + postShellHook = '' 61 61 + # This is run every time you enter the devShell. 62 62 + python3 -c "import torch; print('CUDA available' if torch.cuda.is_available() else 'CPU only')" 63 63 + ''; 64 64 + }; 65 65 + }); 66 66 + }; 67 67 + }

+8 -1

common/services.nix

··· 1 1 - { config, pkgs, ... }: 1 1 + { config, pkgs, lib, ... }: 2 2 { 3 3 # system packages + services 4 4 environment.systemPackages = with pkgs; [ ··· 15 15 zfs 16 16 nixos-generators 17 17 sqlite 18 18 + bun 19 19 + unzip 18 20 ]; 19 21 20 22 services.openssh.enable = true; 21 23 services.printing.enable = true; 22 24 services.tailscale.enable = true; 23 25 services.tailscale.useRoutingFeatures = "both"; 26 26 + services.tailscale.authKeyFile = lib.mkIf (config ? age && config.age ? secrets) 27 27 + config.age.secrets."headscale-authkey".path; 28 28 + services.tailscale.extraUpFlags = [ 29 29 + "--login-server=https://headscale.nekomimi.pet" 30 30 + ]; 24 31 }

+253 -45

flake.lock

··· 8 8 "systems": "systems" 9 9 }, 10 10 "locked": { 11 11 - "lastModified": 1747575206, 12 12 - "narHash": "sha256-NwmAFuDUO/PFcgaGGr4j3ozG9Pe5hZ/ogitWhY+D81k=", 11 11 + "lastModified": 1760836749, 12 12 + "narHash": "sha256-wyT7Pl6tMFbFrs8Lk/TlEs81N6L+VSybPfiIgzU8lbQ=", 13 13 "owner": "ryantm", 14 14 "repo": "agenix", 15 15 - "rev": "4835b1dc898959d8547a871ef484930675cb47f1", 15 15 + "rev": "2f0f812f69f3eb4140157fe15e12739adf82e32a", 16 16 "type": "github" 17 17 }, 18 18 "original": { ··· 26 26 "nixpkgs": "nixpkgs_2" 27 27 }, 28 28 "locked": { 29 29 - "lastModified": 1748080874, 30 30 - "narHash": "sha256-sUebEzAkrY8Aq5G0GHFyRddmRNGP/a2iTtV7ISNvi/c=", 29 29 + "lastModified": 1760953099, 30 30 + "narHash": "sha256-sOKx2YcHa+lWEvaEOIGqLN2WWk1Wf5z6KM02tdfhMtw=", 31 31 "owner": "catppuccin", 32 32 "repo": "nix", 33 33 - "rev": "0ba11b12be81f0849a89ed17ab635164ea8f0112", 33 33 + "rev": "f5b21876888265d2fee7fb0640d1b66a1c1c6503", 34 34 "type": "github" 35 35 }, 36 36 "original": { ··· 61 61 "type": "github" 62 62 } 63 63 }, 64 64 + "disko": { 65 65 + "inputs": { 66 66 + "nixpkgs": "nixpkgs_3" 67 67 + }, 68 68 + "locked": { 69 69 + "lastModified": 1736864502, 70 70 + "narHash": "sha256-ItkIZyebGvNH2dK9jVGzJHGPtb6BSWLN8Gmef16NeY0=", 71 71 + "owner": "nix-community", 72 72 + "repo": "disko", 73 73 + "rev": "0141aabed359f063de7413f80d906e1d98c0c123", 74 74 + "type": "github" 75 75 + }, 76 76 + "original": { 77 77 + "owner": "nix-community", 78 78 + "ref": "v1.11.0", 79 79 + "repo": "disko", 80 80 + "type": "github" 81 81 + } 82 82 + }, 83 83 + "flake-compat": { 84 84 + "locked": { 85 85 + "lastModified": 1696426674, 86 86 + "narHash": "sha256-kvjfFW7WAETZlt09AgDn1MrtKzP7t90Vf7vypd3OL1U=", 87 87 + "owner": "edolstra", 88 88 + "repo": "flake-compat", 89 89 + "rev": "0f9255e01c2351cc7d116c072cb317785dd33b33", 90 90 + "type": "github" 91 91 + }, 92 92 + "original": { 93 93 + "owner": "edolstra", 94 94 + "repo": "flake-compat", 95 95 + "type": "github" 96 96 + } 97 97 + }, 64 98 "flake-utils": { 65 99 "inputs": { 66 100 "systems": "systems_2" ··· 84 118 "systems": "systems_3" 85 119 }, 86 120 "locked": { 121 121 + "lastModified": 1731533236, 122 122 + "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=", 123 123 + "owner": "numtide", 124 124 + "repo": "flake-utils", 125 125 + "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b", 126 126 + "type": "github" 127 127 + }, 128 128 + "original": { 129 129 + "owner": "numtide", 130 130 + "repo": "flake-utils", 131 131 + "type": "github" 132 132 + } 133 133 + }, 134 134 + "flake-utils_3": { 135 135 + "inputs": { 136 136 + "systems": "systems_5" 137 137 + }, 138 138 + "locked": { 87 139 "lastModified": 1681202837, 88 140 "narHash": "sha256-H+Rh19JDwRtpVPAWp64F+rlEtxUWBAQW28eAi3SRSzg=", 89 141 "owner": "numtide", ··· 140 192 ] 141 193 }, 142 194 "locked": { 143 143 - "lastModified": 1748737919, 144 144 - "narHash": "sha256-5kvBbLYdp+n7Ftanjcs6Nv+UO6sBhelp6MIGJ9nWmjQ=", 195 195 + "lastModified": 1761235135, 196 196 + "narHash": "sha256-cux9xeceLIER1lBxUa1gMafkz7gg5ntcUmJBynWdBWI=", 145 197 "owner": "nix-community", 146 198 "repo": "home-manager", 147 147 - "rev": "5675a9686851d9626560052a032c4e14e533c1fa", 199 199 + "rev": "0adf9ba3f567da2d53af581a857aacf671aaa547", 148 200 "type": "github" 149 201 }, 150 202 "original": { ··· 161 213 ] 162 214 }, 163 215 "locked": { 164 164 - "lastModified": 1743604125, 165 165 - "narHash": "sha256-ZD61DNbsBt1mQbinAaaEqKaJk2RFo9R/j+eYWeGMx7A=", 216 216 + "lastModified": 1752603129, 217 217 + "narHash": "sha256-S+wmHhwNQ5Ru689L2Gu8n1OD6s9eU9n9mD827JNR+kw=", 166 218 "owner": "nix-community", 167 219 "repo": "home-manager", 168 168 - "rev": "180fd43eea296e62ae68e079fcf56aba268b9a1a", 220 220 + "rev": "e8c19a3cec2814c754f031ab3ae7316b64da085b", 169 221 "type": "github" 170 222 }, 171 223 "original": { ··· 177 229 "lix": { 178 230 "flake": false, 179 231 "locked": { 180 180 - "lastModified": 1746827285, 181 181 - "narHash": "sha256-hsFe4Tsqqg4l+FfQWphDtjC79WzNCZbEFhHI8j2KJzw=", 182 182 - "rev": "47aad376c87e2e65967f17099277428e4b3f8e5a", 232 232 + "lastModified": 1753223229, 233 233 + "narHash": "sha256-tkT4aCZZE6IEmjYotOzKKa2rV3pGpH3ZREeQn7ACgdU=", 234 234 + "rev": "7ac20fc47cf2f1b7469c7a2f379e5a3a51a6789a", 183 235 "type": "tarball", 184 184 - "url": "https://git.lix.systems/api/v1/repos/lix-project/lix/archive/47aad376c87e2e65967f17099277428e4b3f8e5a.tar.gz?rev=47aad376c87e2e65967f17099277428e4b3f8e5a" 236 236 + "url": "https://git.lix.systems/api/v1/repos/lix-project/lix/archive/7ac20fc47cf2f1b7469c7a2f379e5a3a51a6789a.tar.gz?rev=7ac20fc47cf2f1b7469c7a2f379e5a3a51a6789a" 185 237 }, 186 238 "original": { 187 239 "type": "tarball", 188 188 - "url": "https://git.lix.systems/lix-project/lix/archive/2.93.0.tar.gz" 240 240 + "url": "https://git.lix.systems/lix-project/lix/archive/release-2.93.tar.gz" 189 241 } 190 242 }, 191 243 "lix-module": { ··· 198 250 ] 199 251 }, 200 252 "locked": { 201 201 - "lastModified": 1746838955, 202 202 - "narHash": "sha256-11R4K3iAx4tLXjUs+hQ5K90JwDABD/XHhsM9nkeS5N8=", 203 203 - "rev": "cd2a9c028df820a83ca2807dc6c6e7abc3dfa7fc", 253 253 + "lastModified": 1753282722, 254 254 + "narHash": "sha256-KYMUrTV7H/RR5/HRnjV5R3rRIuBXMemyJzTLi50NFTs=", 255 255 + "rev": "46a9e8fcfe4be72b4c7c8082ee11d2c42da1e873", 204 256 "type": "tarball", 205 205 - "url": "https://git.lix.systems/api/v1/repos/lix-project/nixos-module/archive/cd2a9c028df820a83ca2807dc6c6e7abc3dfa7fc.tar.gz" 257 257 + "url": "https://git.lix.systems/api/v1/repos/lix-project/nixos-module/archive/46a9e8fcfe4be72b4c7c8082ee11d2c42da1e873.tar.gz?rev=46a9e8fcfe4be72b4c7c8082ee11d2c42da1e873" 206 258 }, 207 259 "original": { 208 260 "type": "tarball", 209 209 - "url": "https://git.lix.systems/lix-project/nixos-module/archive/2.93.0.tar.gz" 261 261 + "url": "https://git.lix.systems/lix-project/nixos-module/archive/2.93.3-1.tar.gz" 262 262 + } 263 263 + }, 264 264 + "microvm": { 265 265 + "inputs": { 266 266 + "flake-utils": "flake-utils_2", 267 267 + "nixpkgs": [ 268 268 + "nixpkgs" 269 269 + ], 270 270 + "spectrum": "spectrum" 271 271 + }, 272 272 + "locked": { 273 273 + "lastModified": 1760574296, 274 274 + "narHash": "sha256-S3gIp6Wd9vQ2RYDxcbHM2CIYgDtogbwzSdu38WABKaQ=", 275 275 + "owner": "astro", 276 276 + "repo": "microvm.nix", 277 277 + "rev": "42628f7c61b02d385ce2cb1f66f9be333ac20140", 278 278 + "type": "github" 279 279 + }, 280 280 + "original": { 281 281 + "owner": "astro", 282 282 + "repo": "microvm.nix", 283 283 + "type": "github" 210 284 } 211 285 }, 212 286 "nixos-hardware": { 213 287 "locked": { 214 214 - "lastModified": 1748942041, 215 215 - "narHash": "sha256-HEu2gTct7nY0tAPRgBtqYepallryBKR1U8B4v2zEEqA=", 288 288 + "lastModified": 1760958188, 289 289 + "narHash": "sha256-2m1S4jl+GEDtlt2QqeHil8Ny456dcGSKJAM7q3j/BFU=", 216 290 "owner": "nixos", 217 291 "repo": "nixos-hardware", 218 218 - "rev": "fc7c4714125cfaa19b048e8aaf86b9c53e04d853", 292 292 + "rev": "d6645c340ef7d821602fd2cd199e8d1eed10afbc", 219 293 "type": "github" 220 294 }, 221 295 "original": { ··· 227 301 }, 228 302 "nixpkgs": { 229 303 "locked": { 230 230 - "lastModified": 1745391562, 231 231 - "narHash": "sha256-sPwcCYuiEopaafePqlG826tBhctuJsLx/mhKKM5Fmjo=", 304 304 + "lastModified": 1754028485, 305 305 + "narHash": "sha256-IiiXB3BDTi6UqzAZcf2S797hWEPCRZOwyNThJIYhUfk=", 232 306 "owner": "NixOS", 233 307 "repo": "nixpkgs", 234 234 - "rev": "8a2f738d9d1f1d986b5a4cd2fd2061a7127237d7", 308 308 + "rev": "59e69648d345d6e8fef86158c555730fa12af9de", 235 309 "type": "github" 236 310 }, 237 311 "original": { 238 312 "owner": "NixOS", 239 239 - "ref": "nixos-unstable", 313 313 + "ref": "nixos-25.05", 240 314 "repo": "nixpkgs", 241 315 "type": "github" 242 316 } 243 317 }, 318 318 + "nixpkgs-stable": { 319 319 + "locked": { 320 320 + "lastModified": 1748437600, 321 321 + "narHash": "sha256-hYKMs3ilp09anGO7xzfGs3JqEgUqFMnZ8GMAqI6/k04=", 322 322 + "owner": "NixOS", 323 323 + "repo": "nixpkgs", 324 324 + "rev": "7282cb574e0607e65224d33be8241eae7cfe0979", 325 325 + "type": "github" 326 326 + }, 327 327 + "original": { 328 328 + "id": "nixpkgs", 329 329 + "ref": "nixos-25.05", 330 330 + "type": "indirect" 331 331 + } 332 332 + }, 333 333 + "nixpkgs-unstable": { 334 334 + "locked": { 335 335 + "lastModified": 1723637854, 336 336 + "narHash": "sha256-med8+5DSWa2UnOqtdICndjDAEjxr5D7zaIiK4pn0Q7c=", 337 337 + "owner": "NixOS", 338 338 + "repo": "nixpkgs", 339 339 + "rev": "c3aa7b8938b17aebd2deecf7be0636000d62a2b9", 340 340 + "type": "github" 341 341 + }, 342 342 + "original": { 343 343 + "id": "nixpkgs", 344 344 + "ref": "nixos-unstable", 345 345 + "type": "indirect" 346 346 + } 347 347 + }, 244 348 "nixpkgs_2": { 245 349 "locked": { 246 246 - "lastModified": 1744463964, 247 247 - "narHash": "sha256-LWqduOgLHCFxiTNYi3Uj5Lgz0SR+Xhw3kr/3Xd0GPTM=", 350 350 + "lastModified": 1760524057, 351 351 + "narHash": "sha256-EVAqOteLBFmd7pKkb0+FIUyzTF61VKi7YmvP1tw4nEw=", 248 352 "owner": "NixOS", 249 353 "repo": "nixpkgs", 250 250 - "rev": "2631b0b7abcea6e640ce31cd78ea58910d31e650", 354 354 + "rev": "544961dfcce86422ba200ed9a0b00dd4b1486ec5", 251 355 "type": "github" 252 356 }, 253 357 "original": { ··· 259 363 }, 260 364 "nixpkgs_3": { 261 365 "locked": { 262 262 - "lastModified": 1748162331, 263 263 - "narHash": "sha256-rqc2RKYTxP3tbjA+PB3VMRQNnjesrT0pEofXQTrMsS8=", 366 366 + "lastModified": 1736241350, 367 367 + "narHash": "sha256-CHd7yhaDigUuJyDeX0SADbTM9FXfiWaeNyY34FL1wQU=", 368 368 + "owner": "NixOS", 369 369 + "repo": "nixpkgs", 370 370 + "rev": "8c9fd3e564728e90829ee7dbac6edc972971cd0f", 371 371 + "type": "github" 372 372 + }, 373 373 + "original": { 374 374 + "owner": "NixOS", 375 375 + "ref": "nixpkgs-unstable", 376 376 + "repo": "nixpkgs", 377 377 + "type": "github" 378 378 + } 379 379 + }, 380 380 + "nixpkgs_4": { 381 381 + "locked": { 382 382 + "lastModified": 1761016216, 383 383 + "narHash": "sha256-G/iC4t/9j/52i/nm+0/4ybBmAF4hzR8CNHC75qEhjHo=", 264 384 "owner": "nixos", 265 385 "repo": "nixpkgs", 266 266 - "rev": "7c43f080a7f28b2774f3b3f43234ca11661bf334", 386 386 + "rev": "481cf557888e05d3128a76f14c76397b7d7cc869", 267 387 "type": "github" 268 388 }, 269 389 "original": { ··· 273 393 "type": "github" 274 394 } 275 395 }, 276 276 - "nixpkgs_4": { 396 396 + "nixpkgs_5": { 277 397 "locked": { 278 398 "lastModified": 1682134069, 279 399 "narHash": "sha256-TnI/ZXSmRxQDt2sjRYK/8j8iha4B4zP2cnQCZZ3vp7k=", ··· 287 407 "type": "indirect" 288 408 } 289 409 }, 410 410 + "proxmox-nixos": { 411 411 + "inputs": { 412 412 + "flake-compat": "flake-compat", 413 413 + "nixpkgs-stable": "nixpkgs-stable", 414 414 + "nixpkgs-unstable": "nixpkgs-unstable", 415 415 + "utils": "utils" 416 416 + }, 417 417 + "locked": { 418 418 + "lastModified": 1758650077, 419 419 + "narHash": "sha256-ZeRtJimtk0Faiq7DPZEQNGipda3TaR4QXp0TAzu934Q=", 420 420 + "owner": "SaumonNet", 421 421 + "repo": "proxmox-nixos", 422 422 + "rev": "ce8768f43b4374287cd8b88d8fa9c0061e749d9a", 423 423 + "type": "github" 424 424 + }, 425 425 + "original": { 426 426 + "owner": "SaumonNet", 427 427 + "repo": "proxmox-nixos", 428 428 + "type": "github" 429 429 + } 430 430 + }, 290 431 "root": { 291 432 "inputs": { 292 433 "agenix": "agenix", 293 434 "catppuccin": "catppuccin", 435 435 + "disko": "disko", 294 436 "home-manager": "home-manager_2", 295 437 "lix-module": "lix-module", 438 438 + "microvm": "microvm", 296 439 "nixos-hardware": "nixos-hardware", 297 297 - "nixpkgs": "nixpkgs_3", 440 440 + "nixpkgs": "nixpkgs_4", 441 441 + "proxmox-nixos": "proxmox-nixos", 298 442 "vscode-server": "vscode-server", 299 443 "zen-browser": "zen-browser" 300 444 } 301 445 }, 446 446 + "spectrum": { 447 447 + "flake": false, 448 448 + "locked": { 449 449 + "lastModified": 1759482047, 450 450 + "narHash": "sha256-H1wiXRQHxxPyMMlP39ce3ROKCwI5/tUn36P8x6dFiiQ=", 451 451 + "ref": "refs/heads/main", 452 452 + "rev": "c5d5786d3dc938af0b279c542d1e43bce381b4b9", 453 453 + "revCount": 996, 454 454 + "type": "git", 455 455 + "url": "https://spectrum-os.org/git/spectrum" 456 456 + }, 457 457 + "original": { 458 458 + "type": "git", 459 459 + "url": "https://spectrum-os.org/git/spectrum" 460 460 + } 461 461 + }, 302 462 "systems": { 303 463 "locked": { 304 464 "lastModified": 1681028828, ··· 344 504 "type": "github" 345 505 } 346 506 }, 507 507 + "systems_4": { 508 508 + "locked": { 509 509 + "lastModified": 1681028828, 510 510 + "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=", 511 511 + "owner": "nix-systems", 512 512 + "repo": "default", 513 513 + "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e", 514 514 + "type": "github" 515 515 + }, 516 516 + "original": { 517 517 + "owner": "nix-systems", 518 518 + "repo": "default", 519 519 + "type": "github" 520 520 + } 521 521 + }, 522 522 + "systems_5": { 523 523 + "locked": { 524 524 + "lastModified": 1681028828, 525 525 + "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=", 526 526 + "owner": "nix-systems", 527 527 + "repo": "default", 528 528 + "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e", 529 529 + "type": "github" 530 530 + }, 531 531 + "original": { 532 532 + "owner": "nix-systems", 533 533 + "repo": "default", 534 534 + "type": "github" 535 535 + } 536 536 + }, 537 537 + "utils": { 538 538 + "inputs": { 539 539 + "systems": "systems_4" 540 540 + }, 541 541 + "locked": { 542 542 + "lastModified": 1710146030, 543 543 + "narHash": "sha256-SZ5L6eA7HJ/nmkzGG7/ISclqe6oZdOZTNoesiInkXPQ=", 544 544 + "owner": "numtide", 545 545 + "repo": "flake-utils", 546 546 + "rev": "b1d9ab70662946ef0850d488da1c9019f3a9752a", 547 547 + "type": "github" 548 548 + }, 549 549 + "original": { 550 550 + "owner": "numtide", 551 551 + "repo": "flake-utils", 552 552 + "type": "github" 553 553 + } 554 554 + }, 347 555 "vscode-server": { 348 556 "inputs": { 349 349 - "flake-utils": "flake-utils_2", 350 350 - "nixpkgs": "nixpkgs_4" 557 557 + "flake-utils": "flake-utils_3", 558 558 + "nixpkgs": "nixpkgs_5" 351 559 }, 352 560 "locked": { 353 353 - "lastModified": 1729422940, 354 354 - "narHash": "sha256-DlvJv33ml5UTKgu4b0HauOfFIoDx6QXtbqUF3vWeRCY=", 561 561 + "lastModified": 1753541826, 562 562 + "narHash": "sha256-foGgZu8+bCNIGeuDqQ84jNbmKZpd+JvnrL2WlyU4tuU=", 355 563 "owner": "nix-community", 356 564 "repo": "nixos-vscode-server", 357 357 - "rev": "8b6db451de46ecf9b4ab3d01ef76e59957ff549f", 565 565 + "rev": "6d5f074e4811d143d44169ba4af09b20ddb6937d", 358 566 "type": "github" 359 567 }, 360 568 "original": { ··· 371 579 ] 372 580 }, 373 581 "locked": { 374 374 - "lastModified": 1748742977, 375 375 - "narHash": "sha256-xacIevJ94ZOlNLOcFOAm3PiV7zXZr4G8FD7sJ9jKuz4=", 582 582 + "lastModified": 1761180075, 583 583 + "narHash": "sha256-V4WLeUQ4gCGZiVihlXWBOZ/1FNcL0jM4zgTY1haJLvY=", 376 584 "owner": "0xc000022070", 377 585 "repo": "zen-browser-flake", 378 378 - "rev": "a9d3d70bc49c513a6e48ab24e279e014ab463bc6", 586 586 + "rev": "771a2604606905d8c0ffe3b818dc2cc5bd1405d8", 379 587 "type": "github" 380 588 }, 381 589 "original": {

+36 -34

flake.nix

··· 4 4 nixpkgs.url = "github:nixos/nixpkgs/nixos-25.05"; 5 5 nixos-hardware.url = "github:nixos/nixos-hardware/master"; 6 6 7 7 + proxmox-nixos.url = "github:SaumonNet/proxmox-nixos"; 8 8 + 7 9 lix-module = { 8 8 - url = "https://git.lix.systems/lix-project/nixos-module/archive/2.93.0.tar.gz"; 10 10 + url = "https://git.lix.systems/lix-project/nixos-module/archive/2.93.3-1.tar.gz"; 9 11 inputs.nixpkgs.follows = "nixpkgs"; 10 12 }; 11 13 ··· 15 17 url = "github:0xc000022070/zen-browser-flake"; 16 18 inputs.nixpkgs.follows = "nixpkgs"; 17 19 }; 18 18 - #microvm.url = "github:astro/microvm.nix"; 19 19 - #microvm.inputs.nixpkgs.follows = "nixpkgs"; 20 20 + microvm.url = "github:astro/microvm.nix"; 21 21 + microvm.inputs.nixpkgs.follows = "nixpkgs"; 22 22 + 23 23 + disko.url = "github:nix-community/disko/v1.11.0"; 20 24 21 25 catppuccin.url = "github:catppuccin/nix"; 22 26 home-manager = { ··· 45 49 system = "x86_64-linux"; 46 50 }; 47 51 modules = [ 52 52 + agenix.nixosModules.default 53 53 + 48 54 ./hosts/focalor 49 55 lix-module.nixosModules.default 50 50 - 51 51 - /*microvm.nixosModules.host 52 52 - { 53 53 - microvm.autostart = [ 54 54 - "windows" 55 55 - ]; 56 56 - }*/ 57 57 - 58 56 vscode-server.nixosModules.default 59 59 - agenix.nixosModules.default 60 60 - 61 57 catppuccin.nixosModules.catppuccin 62 62 - 63 58 home-manager.nixosModules.home-manager 64 59 { 65 60 home-manager.useGlobalPkgs = true; ··· 73 68 system = "x86_64-linux"; 74 69 }; 75 70 } 71 71 + 72 72 + { imports = builtins.attrValues nixosModules; } 76 73 ]; 77 74 }; 78 75 ··· 83 80 system = "x86_64-linux"; 84 81 }; 85 82 modules = [ 83 83 + agenix.nixosModules.default 84 84 + 86 85 ./hosts/valefar 87 86 lix-module.nixosModules.default 88 88 - 89 87 vscode-server.nixosModules.default 90 90 - agenix.nixosModules.default 88 88 + 89 89 + proxmox-nixos.nixosModules.proxmox-ve 90 90 + 91 91 + ({ pkgs, lib, ... }: { 92 92 + services.proxmox-ve = { 93 93 + enable = true; 94 94 + ipAddress = "10.0.0.30"; 95 95 + }; 96 96 + 97 97 + nixpkgs.overlays = [ 98 98 + proxmox-nixos.overlays.x86_64-linux 99 99 + ]; 100 100 + }) 91 101 92 102 { imports = builtins.attrValues nixosModules; } 93 103 ]; ··· 103 113 ./hosts/buer 104 114 105 115 agenix.nixosModules.default 116 116 + 117 117 + { imports = builtins.attrValues nixosModules; } 106 118 ]; 107 119 }; 108 120 109 109 - morax = nixpkgs.lib.nixosSystem { 121 121 + baal = nixpkgs.lib.nixosSystem { 110 122 system = "aarch64-linux"; 111 123 specialArgs = { 112 124 inherit inputs; 113 125 system = "aarch64-linux"; 114 126 }; 115 127 modules = [ 116 116 - ./hosts/morax 117 117 - nixos-hardware.nixosModules.raspberry-pi-4 118 118 - 128 128 + ./hosts/baal 129 129 + 119 130 agenix.nixosModules.default 131 131 + disko.nixosModules.disko 132 132 + 133 133 + { imports = builtins.attrValues nixosModules; } 134 134 + 120 135 ]; 121 136 }; 122 122 - 123 123 - 124 124 - # Easy to add more hosts 125 125 - /* 126 126 - server2 = nixpkgs.lib.nixosSystem { 127 127 - system = "x86_64-linux"; 128 128 - modules = [ 129 129 - ./hosts/server2 130 130 - agenix.nixosModules.default 131 131 - # different services for server2 132 132 - ]; 133 133 - }; 134 134 - */ 135 137 }; 136 138 }; 137 137 - } 139 139 + }

+81 -13

home/regent/home.nix

··· 1 1 - { config, pkgs, system, inputs, ... }: 1 1 + { config, pkgs, system, inputs, lib, ... }: 2 2 3 3 { 4 4 home.username = "regent"; ··· 13 13 };*/ 14 14 ghostty.enable = true; 15 15 ghostty.flavor = "mocha"; 16 16 + nvim.enable = true; 17 17 + nvim.flavor = "mocha"; 16 18 }; 17 19 18 20 programs.ghostty.enable = true; ··· 21 23 theme = "catppuccin-mocha"; 22 24 }; 23 25 24 24 - home.pointerCursor = { 26 26 + programs.neovim.enable = true; 27 27 + programs.neovim = { 28 28 + extraPackages = with pkgs; [ 29 29 + lua-language-server 30 30 + stylua 31 31 + ripgrep 32 32 + ]; 33 33 + 34 34 + plugins = with pkgs.vimPlugins; [ 35 35 + lazy-nvim 36 36 + ]; 37 37 + }; 38 38 + 39 39 + home.pointerCursor = { 25 40 gtk.enable = true; 26 41 package = pkgs.phinger-cursors; 27 42 name = "Phinger-cursors-light"; ··· 61 76 62 77 63 78 * { 64 64 - font-family: FantasqueSansMono Nerd Font; 79 79 + font-family: 'Fira Code', monospace; 65 80 font-size: 17px; 66 81 min-height: 0; 67 82 } ··· 71 86 margin: 0px; 72 87 border: 0px; 73 88 /*background-color:rgb(0, 0, 0);*/ 74 74 - background-color: rgba(0, 0, 0, 0.9); 89 89 + background-color: @base; 75 90 color: @text; 76 91 } 77 92 ··· 82 97 #workspaces { 83 98 border-radius: 1rem; 84 99 margin: 5px; 85 85 - background-color: @surface0; 86 100 margin-left: 1rem; 101 101 + background-color: rgba(0, 0, 0, 0.21); 87 102 } 88 88 - 89 103 90 104 #workspaces button { 91 105 color: @lavender; ··· 96 110 #workspaces button.active { 97 111 color: @sky; 98 112 border-radius: 1rem; 113 113 + background-color: rgba(255, 255, 255, 0.5); 99 114 } 100 115 101 116 #workspaces button:hover { ··· 111 126 #pulseaudio, 112 127 #custom-lock, 113 128 #custom-power { 114 114 - background-color: @surface0; 115 129 padding: 0.5rem 1rem; 116 130 margin: 5px 0; 131 131 + color: @text; 117 132 } 118 133 119 134 #clock { 120 120 - color: @blue; 135 135 + color: @text; 121 136 border-radius: 0px 1rem 1rem 0px; 122 137 margin-right: 1rem; 123 138 } 124 124 - 125 139 ''; 126 140 settings = { 127 141 mainBar = { 128 142 layer = "top"; 129 143 position = "top"; 130 130 - height = 34; 144 144 + mod = "dock"; 145 145 + exclusive = true; 146 146 + passthrough = false; 147 147 + #gtk-layer-shell = true; 148 148 + height = 0; 131 149 output = [ 132 150 "HDMI-A-1" 151 151 + "DP-3" 133 152 "DP-2" 134 153 ]; 135 135 - modules-left = [ "sway/workspaces" ]; 154 154 + modules-left = [ 155 155 + "sway/workspaces" 156 156 + ]; 136 157 modules-center = [ "sway/window" ]; 137 137 - modules-right = [ "clock" ]; 158 158 + modules-right = [ 159 159 + "pulseaudio" 160 160 + "clock" 161 161 + ]; 138 162 139 163 "sway/workspaces" = { 140 164 disable-scroll = true; 141 141 - sort-by-name = true; 165 165 + }; 166 166 + tray = { 167 167 + icon-size = 13; 168 168 + tooltip = false; 169 169 + spacing = 10; 170 170 + }; 171 171 + network = { 172 172 + format = "󰖩 {essid}"; 173 173 + format-disconnected = "󰖪 disconnected"; 174 174 + }; 175 175 + clock = { 176 176 + format = " {:%I:%M %p %m/%d} "; 177 177 + tooltip-format = '' 178 178 + <big>{:%Y %B}</big> 179 179 + <tt><small>{calendar}</small></tt>''; 180 180 + }; 181 181 + 182 182 + pulseaudio = { 183 183 + format = "{icon} {volume}%"; 184 184 + tooltip = false; 185 185 + format-muted = " Muted"; 186 186 + on-click = "pamixer -t"; 187 187 + on-scroll-up = "pamixer -i 5"; 188 188 + on-scroll-down = "pamixer -d 5"; 189 189 + scroll-step = 5; 190 190 + format-icons = { 191 191 + headphone = ""; 192 192 + hands-free = ""; 193 193 + headset = ""; 194 194 + phone = ""; 195 195 + portable = ""; 196 196 + car = ""; 197 197 + default = [ "" "" "" ]; 198 198 + }; 199 199 + }; 200 200 + 201 201 + "pulseaudio#microphone" = { 202 202 + format = "{format_source}"; 203 203 + tooltip = false; 204 204 + format-source = " {volume}%"; 205 205 + format-source-muted = " Muted"; 206 206 + on-click = "pamixer --default-source -t"; 207 207 + on-scroll-up = "pamixer --default-source -i 5"; 208 208 + on-scroll-down = "pamixer --default-source -d 5"; 209 209 + scroll-step = 5; 142 210 }; 143 211 }; 144 212 };

+7

host-secrets.nix

··· 31 31 group = "garage"; 32 32 mode = "0400"; 33 33 }; 34 34 + 35 35 + "headscale-authkey" = { 36 36 + file = ./secrets/headscale-authkey.age; 37 37 + owner = "regent"; 38 38 + group = "users"; 39 39 + mode = "0400"; 40 40 + }; 34 41 }; 35 42 }

+58

hosts/baal/default.nix

··· 1 1 + { config, lib, pkgs, modulesPath, inputs, ... }: 2 2 + { 3 3 + imports = [ 4 4 + ./hardware.nix 5 5 + ./secrets.nix 6 6 + 7 7 + ../../common/system.nix 8 8 + ../../common/users.nix 9 9 + ../../common/services.nix 10 10 + 11 11 + ../../host-secrets.nix 12 12 + ]; 13 13 + 14 14 + boot = { 15 15 + loader = { 16 16 + systemd-boot.enable = true; 17 17 + efi = { 18 18 + canTouchEfiVariables = true; 19 19 + efiSysMountPoint = "/boot"; 20 20 + }; 21 21 + }; 22 22 + initrd.systemd.enable = true; 23 23 + }; 24 24 + 25 25 + system.stateVersion = "24.11"; 26 26 + nixpkgs.hostPlatform = lib.mkDefault "aarch64-linux"; 27 27 + 28 28 + systemd.targets.multi-user.enable = true; 29 29 + 30 30 + networking = { 31 31 + hostName = "baal"; 32 32 + hostId = "aaaaaaaa"; 33 33 + networkmanager.enable = true; 34 34 + }; 35 35 + 36 36 + services.fail2ban = { 37 37 + enable = true; 38 38 + # Ban IP after 5 failures 39 39 + maxretry = 5; 40 40 + ignoreIP = [ 41 41 + "10.0.0.0/8" "172.16.0.0/12" "192.168.0.0/16" "100.64.0.0/10" 42 42 + ]; 43 43 + bantime = "24h"; # Ban IPs for one day on the first ban 44 44 + bantime-increment = { 45 45 + enable = true; # Enable increment of bantime after each violation 46 46 + multipliers = "1 2 4 8 16 32 64"; 47 47 + maxtime = "168h"; # Do not ban for more than 1 week 48 48 + overalljails = true; # Calculate the bantime based on all the violations 49 49 + }; 50 50 + }; 51 51 + 52 52 + virtualisation.docker = { 53 53 + enable = true; 54 54 + enableOnBoot = true; 55 55 + }; 56 56 + 57 57 + documentation.enable = false; 58 58 + }

+55

hosts/baal/hardware.nix

··· 1 1 + # Do not modify this file! It was generated by ‘nixos-generate-config’ 2 2 + # and may be overwritten by future invocations. Please make changes 3 3 + # to /etc/nixos/configuration.nix instead. 4 4 + { config, lib, pkgs, modulesPath, ... }: 5 5 + 6 6 + { 7 7 + imports = 8 8 + [ (modulesPath + "/profiles/qemu-guest.nix") 9 9 + ]; 10 10 + 11 11 + boot.initrd.availableKernelModules = [ "xhci_pci" "virtio_pci" "virtio_scsi" "usbhid" ]; 12 12 + boot.initrd.kernelModules = [ ]; 13 13 + boot.kernelModules = [ ]; 14 14 + boot.extraModulePackages = [ ]; 15 15 + 16 16 + # Enables DHCP on each ethernet and wireless interface. In case of scripted networking 17 17 + # (the default) this is the recommended approach. When using systemd-networkd it's 18 18 + # still possible to use this option, but it's recommended to use it in conjunction 19 19 + # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`. 20 20 + networking.useDHCP = lib.mkDefault true; 21 21 + # networking.interfaces.enp0s6.useDHCP = lib.mkDefault true; 22 22 + 23 23 + nixpkgs.hostPlatform = lib.mkDefault "aarch64-linux"; 24 24 + 25 25 + disko.devices = { 26 26 + disk = { 27 27 + main = { 28 28 + type = "disk"; 29 29 + device = "/dev/sda"; 30 30 + content = { 31 31 + type = "gpt"; 32 32 + partitions = { 33 33 + boot = { 34 34 + size = "512M"; 35 35 + type = "EF00"; 36 36 + content = { 37 37 + type = "filesystem"; 38 38 + format = "vfat"; 39 39 + mountpoint = "/boot"; 40 40 + }; 41 41 + }; 42 42 + root = { 43 43 + size = "100%"; 44 44 + content = { 45 45 + type = "filesystem"; 46 46 + format = "ext4"; 47 47 + mountpoint = "/"; 48 48 + }; 49 49 + }; 50 50 + }; 51 51 + }; 52 52 + }; 53 53 + }; 54 54 + }; 55 55 + }

+3

hosts/baal/secrets.nix

··· 1 1 + { 2 2 + 3 3 + }

+105 -44

hosts/buer/default.nix

··· 1 1 - # hosts/valefar/configuration.nix (or default.nix) 1 1 + # hosts/buer/configuration.nix (or default.nix) 2 2 { config, lib, pkgs, modulesPath, inputs, ... }: 3 3 - 4 3 { 4 4 + # ============================================================================= 5 5 + # IMPORTS 6 6 + # ============================================================================= 5 7 imports = [ 6 8 # Host-specific hardware 7 9 ./hardware.nix ··· 12 14 ../../common/users.nix 13 15 ../../common/services.nix 14 16 15 15 - 16 17 # Common secrets 17 18 ../../host-secrets.nix 18 19 ]; 19 20 21 21 + # ============================================================================= 22 22 + # SYSTEM CONFIGURATION 23 23 + # ============================================================================= 20 24 system.stateVersion = "24.11"; 25 25 + nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux"; 26 26 + 27 27 + # Intel microcode updates 28 28 + hardware.cpu.intel.updateMicrocode = lib.mkDefault 29 29 + config.hardware.enableRedistributableFirmware; 30 30 + 31 31 + # ============================================================================= 32 32 + # CUSTOM MODULES 33 33 + # ============================================================================= 21 34 modules.garage.enable = true; 35 35 + modules.seaweedfs.clusters.default = { 36 36 + package = pkgs.seaweedfs; 22 37 23 23 - # pin host platform & microcode 24 24 - nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux"; 25 25 - hardware.cpu.intel.updateMicrocode = lib.mkDefault 26 26 - config.hardware.enableRedistributableFirmware; 38 38 + masters.main = { 39 39 + openFirewall = true; 40 40 + ip = "fs.nkp.pet"; 41 41 + volumePreallocate = true; 42 42 + 43 43 + defaultReplication = { 44 44 + dataCenter = 0; 45 45 + rack = 0; 46 46 + server = 0; 47 47 + }; 48 48 + }; 49 49 + }; 50 50 + 51 51 + # ============================================================================= 52 52 + # BOOT CONFIGURATION 53 53 + # ============================================================================= 54 54 + boot.loader.grub = { 55 55 + enable = true; 56 56 + device = "/dev/vda"; 57 57 + }; 27 58 28 28 - boot.loader.grub.enable = true; 29 29 - boot.loader.grub.device = "/dev/vda"; 59 59 + # ============================================================================= 60 60 + # NETWORKING 61 61 + # ============================================================================= 62 62 + networking = { 63 63 + hostName = "buer"; 64 64 + hostId = "1418d29e"; 65 65 + firewall.enable = false; 66 66 + useDHCP = false; 67 67 + }; 30 68 31 31 - networking.hostName = "buer"; 32 32 - networking.hostId = "1418d29e"; 33 33 - networking.firewall.enable = false; 34 34 - networking.useDHCP = false; 35 35 - systemd.network.enable = true; 36 36 - systemd.network.networks."10-wan" = { 37 37 - matchConfig.Name = "ens3"; 38 38 - address = [ 39 39 - "103.251.165.107/24" 40 40 - "2a04:52c0:0135:48d1::2/48" 69 69 + services.fail2ban = { 70 70 + enable = true; 71 71 + # Ban IP after 5 failures 72 72 + maxretry = 5; 73 73 + ignoreIP = [ 74 74 + "10.0.0.0/8" "172.16.0.0/12" "192.168.0.0/16" "100.64.0.0/10" 41 75 ]; 42 42 - gateway = [ 43 43 - "103.251.165.1" 44 44 - "2a04:52c0:0135::1" 45 45 - ]; 46 46 - dns = [ 47 47 - "2a01:6340:1:20:4::10" 48 48 - "2a04:52c0:130:2a5c::10" 49 49 - "185.31.172.240" 50 50 - "5.255.125.240" 51 51 - ]; 76 76 + bantime = "24h"; # Ban IPs for one day on the first ban 77 77 + bantime-increment = { 78 78 + enable = true; # Enable increment of bantime after each violation 79 79 + multipliers = "1 2 4 8 16 32 64"; 80 80 + maxtime = "168h"; # Do not ban for more than 1 week 81 81 + overalljails = true; # Calculate the bantime based on all the violations 82 82 + }; 52 83 }; 53 53 - 54 54 - #boot.supportedFilesystems = [ "zfs" ]; 55 55 - #boot.kernelModules = [ "nct6775" "coretemp" ]; 56 84 57 57 - #services.zfs.autoScrub.enable = true; 58 58 - #services.zfs.trim.enable = true; 59 59 - 60 60 - environment.systemPackages = with pkgs; [ 61 61 - #lm_sensors 62 62 - #code-server 63 63 - inputs.agenix.packages.x86_64-linux.default 64 64 - ]; 85 85 + # Static IP configuration via systemd-networkd 86 86 + systemd.network = { 87 87 + enable = true; 88 88 + networks."10-wan" = { 89 89 + matchConfig.Name = "ens3"; 90 90 + address = [ 91 91 + "103.251.165.107/24" 92 92 + "2a04:52c0:0135:48d1::2/48" 93 93 + ]; 94 94 + gateway = [ 95 95 + "103.251.165.1" 96 96 + "2a04:52c0:0135::1" 97 97 + ]; 98 98 + dns = [ 99 99 + "2a01:6340:1:20:4::10" 100 100 + "2a04:52c0:130:2a5c::10" 101 101 + "185.31.172.240" 102 102 + "5.255.125.240" 103 103 + ]; 104 104 + }; 105 105 + }; 65 106 107 107 + # ============================================================================= 108 108 + # VIRTUALIZATION 109 109 + # ============================================================================= 66 110 virtualisation.docker = { 67 111 enable = true; 68 112 enableOnBoot = true; 69 69 - package = pkgs.docker.override { 70 70 - buildGoModule = pkgs.buildGo123Module; 71 71 - }; 72 113 }; 73 73 - } 114 114 + 115 115 + # ============================================================================= 116 116 + # PACKAGES 117 117 + # ============================================================================= 118 118 + environment.systemPackages = with pkgs; [ 119 119 + inputs.agenix.packages.x86_64-linux.default 120 120 + ]; 121 121 + 122 122 + # ============================================================================= 123 123 + # COMMENTED OUT / DISABLED 124 124 + # ============================================================================= 125 125 + # ZFS support (not needed for this VPS) 126 126 + # boot.supportedFilesystems = [ "zfs" ]; 127 127 + # boot.kernelModules = [ "nct6775" "coretemp" ]; 128 128 + # services.zfs.autoScrub.enable = true; 129 129 + # services.zfs.trim.enable = true; 130 130 + 131 131 + # Additional packages (not needed) 132 132 + # lm_sensors 133 133 + # code-server 134 134 + }

-46

hosts/focalor/backup.nix

··· 1 1 - # Do not modify this file! It was generated by ‘nixos-generate-config’ 2 2 - # and may be overwritten by future invocations. Please make changes 3 3 - # to /etc/nixos/configuration.nix instead. 4 4 - { config, lib, pkgs, modulesPath, ... }: 5 5 - 6 6 - { 7 7 - imports = 8 8 - [ (modulesPath + "/installer/scan/not-detected.nix") 9 9 - ]; 10 10 - 11 11 - boot.initrd.availableKernelModules = [ "nvme" "xhci_pci" "ahci" "usbhid" "sd_mod" ]; 12 12 - boot.initrd.kernelModules = [ 13 13 - "vfio" "vfio_iommu_type1" "vfio_pci" 14 14 - "nvidia" "nvidia-modeset" "nvidia_uvm" "nvidia_drm" 15 15 - ]; 16 16 - boot.kernelModules = [ "kvm-amd" ]; 17 17 - boot.kernelParams = [ 18 18 - "amd_iommu=on" 19 19 - "vfio-pci.ids=10de:2484,10de228b,1022:149c,15b7:5045" 20 20 - ]; 21 21 - boot.extraModulePackages = [ ]; 22 22 - 23 23 - fileSystems."/" = 24 24 - { device = "/dev/disk/by-uuid/2009b305-f22d-4d5c-a9d3-c49a2303232b"; 25 25 - fsType = "ext4"; 26 26 - }; 27 27 - 28 28 - fileSystems."/boot" = 29 29 - { device = "/dev/disk/by-uuid/E53C-502F"; 30 30 - fsType = "vfat"; 31 31 - options = [ "fmask=0077" "dmask=0077" ]; 32 32 - }; 33 33 - 34 34 - swapDevices = [ ]; 35 35 - 36 36 - # Enables DHCP on each ethernet and wireless interface. In case of scripted networking 37 37 - # (the default) this is the recommended approach. When using systemd-networkd it's 38 38 - # still possible to use this option, but it's recommended to use it in conjunction 39 39 - # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`. 40 40 - networking.useDHCP = lib.mkDefault true; 41 41 - # networking.interfaces.enp5s0.useDHCP = lib.mkDefault true; 42 42 - # networking.interfaces.wlp4s0.useDHCP = lib.mkDefault true; 43 43 - 44 44 - nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux"; 45 45 - hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware; 46 46 - }

+108 -43

hosts/focalor/default.nix

··· 1 1 - # hosts/valefar/configuration.nix (or default.nix) 1 1 + # hosts/focalor/configuration.nix (or default.nix) 2 2 { config, lib, system, pkgs, modulesPath, inputs, ... }: 3 3 - 4 3 { 4 4 + # ============================================================================= 5 5 + # IMPORTS 6 6 + # ============================================================================= 5 7 imports = [ 6 8 # Host-specific hardware 7 9 ./hardware.nix 8 10 ./secrets.nix 9 9 - #./vfio.nix 11 11 + ./vfio.nix 10 12 11 13 # Common modules shared across hosts 12 14 ../../common/system.nix 13 15 ../../common/users.nix 14 16 ../../common/services.nix 15 17 ../../common/efi.nix 16 16 - 18 18 + ../../common/bluetooth.nix 19 19 + 17 20 # Desktop modules 18 21 ../../common/desktop/core.nix 19 22 ../../common/desktop/sway.nix 20 23 ../../common/desktop/vnc.nix 21 21 - 22 22 - # Nvidia 24 24 + 25 25 + # Hardware-specific 23 26 ../../common/nvidia.nix 24 27 25 28 # Common secrets 26 26 - #../../host-secrets.nix 29 29 + ../../host-secrets.nix 27 30 ]; 28 31 29 29 - system.stateVersion = "25.05"; 30 30 - 31 31 - # pin host platform & microcode 32 32 - nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux"; 32 32 + services.syncthing = { 33 33 + enable = true; 34 34 + openDefaultPorts = true; 35 35 + user = "regent"; 36 36 + dataDir = "/home/regent"; 37 37 + configDir = "/home/regent/.config/syncthing"; 38 38 + }; 33 39 40 40 + # ============================================================================= 41 41 + # SYSTEM CONFIGURATION 42 42 + # ============================================================================= 43 43 + system.stateVersion = "25.05"; 44 44 + nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux"; 45 45 + 46 46 + # Cross-compilation support 34 47 boot.binfmt.emulatedSystems = [ "aarch64-linux" ]; 48 48 + nix.settings.extra-platforms = config.boot.binfmt.emulatedSystems; 35 49 36 36 - networking.hostName = "focalor"; 37 37 - networking.hostId = "84bdc587"; 50 50 + # ============================================================================= 51 51 + # NETWORKING 52 52 + # ============================================================================= 53 53 + networking = { 54 54 + hostName = "focalor"; 55 55 + hostId = "84bdc587"; 56 56 + firewall.enable = false; 57 57 + firewall.trustedInterfaces = [ "tailscale0" ]; 58 58 + nameservers = [ "10.0.0.210" "1.1.1.1" ]; 59 59 + }; 38 60 61 61 + # Systemd networking with bridge 39 62 systemd.network = { 40 63 enable = true; 64 64 + 41 65 netdevs."br0" = { 42 66 netdevConfig = { 43 67 Name = "br0"; 44 68 Kind = "bridge"; 45 69 }; 46 70 }; 71 71 + 47 72 networks = { 48 73 "10-lan" = { 49 74 matchConfig.Name = ["enp5s0" "vm-*"]; ··· 51 76 Bridge = "br0"; 52 77 }; 53 78 }; 79 79 + 54 80 "10-lan-bridge" = { 55 81 matchConfig.Name = "br0"; 56 82 networkConfig = { ··· 64 90 }; 65 91 }; 66 92 67 67 - /*networking = { 68 68 - firewall.enable = false; 69 69 - firewall.trustedInterfaces = [ 70 70 - "tailscale0" 71 71 - ]; 72 72 - nameservers = [ "10.0.0.210" "1.1.1.1" ]; 73 73 - useDHCP = true; 74 74 - firewall.allowedTCPPorts = [22 80 443 2456 2457 9000 9001 9002]; 75 75 - };*/ 76 76 - 93 93 + # DNS resolution 77 94 services.resolved = { 78 78 - enable = true; 79 79 - dnssec = "true"; 80 80 - domains = [ "~." ]; 95 95 + enable = true; 96 96 + dnssec = "true"; 97 97 + domains = [ "~." ]; 81 98 fallbackDns = [ "10.0.0.210" "1.0.0.1#one.one.one.one" ]; 82 82 - dnsovertls = "true"; 99 99 + dnsovertls = "true"; 83 100 }; 84 84 - 85 85 - #boot.supportedFilesystems = [ "zfs" ]; 86 86 - #boot.kernelModules = [ "nct6775" "coretemp" ]; 87 101 88 88 - #services.zfs.autoScrub.enable = true; 89 89 - #services.zfs.trim.enable = true; 102 102 + # ============================================================================= 103 103 + # FILESYSTEM & STORAGE 104 104 + # ============================================================================= 105 105 + boot.supportedFilesystems = [ "nfs" ]; 90 106 91 91 - services.vscode-server.enable = true; 92 92 - services.vscode-server.nodejsPackage = pkgs.nodejs_20; 107 107 + /*fileSystems."/mnt/storage" = { 108 108 + device = "valefar:/storage"; 109 109 + fsType = "nfs"; 110 110 + };*/ 93 111 94 94 - environment.systemPackages = with pkgs; [ 95 95 - #lm_sensors 96 96 - #code-server 97 97 - inputs.agenix.packages.x86_64-linux.default 98 98 - ]; 112 112 + # ============================================================================= 113 113 + # SERVICES 114 114 + # ============================================================================= 115 115 + services.vscode-server = { 116 116 + enable = true; 117 117 + nodejsPackage = pkgs.nodejs_20; 118 118 + }; 99 119 100 100 - environment.sessionVariables.WLR_RENDERER = "vulkan"; 120 120 + # ============================================================================= 121 121 + # PROGRAMS & APPLICATIONS 122 122 + # ============================================================================= 123 123 + programs.steam.enable = true; 124 124 + 125 125 + programs.obs-studio = { 126 126 + enable = true; 127 127 + enableVirtualCamera = true; 128 128 + plugins = with pkgs.obs-studio-plugins; [ 129 129 + droidcam-obs 130 130 + ]; 131 131 + }; 101 132 133 133 + # ============================================================================= 134 134 + # VIRTUALIZATION 135 135 + # ============================================================================= 102 136 virtualisation.docker = { 103 137 enable = true; 104 138 enableOnBoot = true; 105 105 - package = pkgs.docker.override { 106 106 - buildGoModule = pkgs.buildGo123Module; 107 107 - }; 108 139 }; 109 140 141 141 + # ============================================================================= 142 142 + # DESKTOP ENVIRONMENT 143 143 + # ============================================================================= 144 144 + # Vulkan renderer for Wayland 145 145 + environment.sessionVariables.WLR_RENDERER = "vulkan"; 146 146 + 147 147 + # XDG Portals 110 148 xdg.portal = { 111 149 enable = true; 112 150 wlr.enable = true; ··· 115 153 xdg-desktop-portal-gnome 116 154 ]; 117 155 }; 156 156 + 157 157 + # ============================================================================= 158 158 + # PACKAGES 159 159 + # ============================================================================= 160 160 + environment.systemPackages = with pkgs; [ 161 161 + inputs.agenix.packages.x86_64-linux.default 162 162 + prismlauncher 163 163 + temurin-bin 164 164 + signal-desktop 165 165 + ]; 166 166 + 167 167 + # ============================================================================= 168 168 + # COMMENTED OUT / DISABLED 169 169 + # ============================================================================= 170 170 + # ZFS support (disabled for this host) 171 171 + # boot.supportedFilesystems = [ "zfs" ]; 172 172 + # boot.kernelModules = [ "nct6775" "coretemp" ]; 173 173 + # services.zfs.autoScrub.enable = true; 174 174 + # services.zfs.trim.enable = true; 175 175 + 176 176 + # Additional packages (commented out) 177 177 + # lm_sensors 178 178 + # code-server 179 179 + 180 180 + # DHCP (disabled in favor of systemd-networkd) 181 181 + networking.useDHCP = false; 182 182 + # firewall.allowedTCPPorts = [22 80 443 2456 2457 9000 9001 9002]; 118 183 }

+5 -1

hosts/focalor/hardware.nix

··· 9 9 ]; 10 10 11 11 boot.initrd.availableKernelModules = [ "nvme" "xhci_pci" "ahci" "uas" "usbhid" "sd_mod" ]; 12 12 - boot.initrd.kernelModules = [ ]; 12 12 + # boot.initrd.kernelModules = [ "vfio" "vfio_iommu_type1" "vfio_pci" ]; 13 13 boot.kernelModules = [ "kvm-amd" ]; 14 14 + boot.kernelParams = [ 15 15 + "amd_iommu=on" 16 16 + # "vfio-pci.ids=10de:2484,10de228b,1022:149c,15b7:5045,1dbe:5236,1022:149c" 17 17 + ]; 14 18 boot.extraModulePackages = [ ]; 15 19 16 20 fileSystems."/" =

+62

hosts/focalor/scripts/vm-win11-hook.sh

··· 1 1 + #!/run/current-system/sw/bin/bash 2 2 + 3 3 + echo "qemu-hook: ${1} ${2}" >> /tmp/qemu-hook.log 4 4 + 5 5 + set -x 6 6 + 7 7 + readonly GUEST_NAME="$1" 8 8 + readonly HOOK_NAME="$2" 9 9 + readonly STATE_NAME="$3" 10 10 + 11 11 + function start_hook() { 12 12 + # Stops GUI 13 13 + systemctl isolate multi-user.target 14 14 + 15 15 + # Avoids race condition 16 16 + sleep 2 17 17 + 18 18 + # Unloads the NVIDIA drivers 19 19 + modprobe -r nvidia_drm 20 20 + modprobe -r nvidia_uvm 21 21 + modprobe -r nvidia_modeset 22 22 + modprobe -r nvidia 23 23 + 24 24 + # Other code you might want to run 25 25 + } 26 26 + 27 27 + function revert_hook() { 28 28 + virsh nodedev-reattach pci_0000_0a_00_0 29 29 + virsh nodedev-reattach pci_0000_0a_00_1 30 30 + virsh nodedev-reattach pci_0000_06_00_1 31 31 + virsh nodedev-reattach pci_0000_06_00_3 32 32 + virsh nodedev-reattach pci_0000_0c_00_3 33 33 + 34 34 + modprobe -r vfio-pci 35 35 + 36 36 + # Loads the NVIDIA drivers 37 37 + modprobe nvidia_modeset 38 38 + modprobe nvidia_uvm 39 39 + modprobe nvidia_drm 40 40 + modprobe nvidia 41 41 + 42 42 + modprobe -r xhci_pci 43 43 + modprobe xhci_pci 44 44 + 45 45 + # Starts the UI again 46 46 + systemctl restart display-manager 47 47 + systemctl isolate graphical.target 48 48 + } 49 49 + 50 50 + # I am not using the script from Passthrough-Post 51 51 + # because hooks option saves it to /var/lib/libvirt/hooks/qemu.d. 52 52 + # It's simpler to just rewrite it for NixOS. 53 53 + if [[ "$GUEST_NAME" != "win11" ]]; then 54 54 + exit 0 55 55 + fi 56 56 + 57 57 + if [[ "$HOOK_NAME" == "prepare" && "$STATE_NAME" == "begin" ]]; then 58 58 + #start_hook 59 59 + echo "do nothing" 60 60 + elif [[ "$HOOK_NAME" == "release" && "$STATE_NAME" == "end" ]]; then 61 61 + revert_hook 62 62 + fi

+21 -8

hosts/focalor/vfio.nix

··· 9 9 package = pkgs.qemu_kvm; 10 10 runAsRoot = true; 11 11 swtpm.enable = true; 12 12 - ovmf = { 13 13 - enable = true; 14 14 - packages = [(pkgs.OVMF.override { 15 15 - secureBoot = true; 16 16 - tpmSupport = true; 17 17 - }).fd]; 12 12 + }; 13 13 + hooks.qemu = { 14 14 + win11 = ./scripts/vm-win11-hook.sh; 15 15 + }; 16 16 + }; 17 17 + 18 18 + systemd.services.libvirtd = { 19 19 + path = let 20 20 + env = pkgs.buildEnv { 21 21 + name = "qemu-hook-env"; 22 22 + paths = with pkgs; [ 23 23 + bash 24 24 + libvirt 25 25 + kmod 26 26 + systemd 27 27 + ripgrep 28 28 + sd 29 29 + ]; 18 30 }; 19 19 - }; 31 31 + in 32 32 + [ env ]; 20 33 }; 21 34 22 35 users.extraUsers.regent.extraGroups = [ "libvirtd" ]; 23 23 - } 36 36 + }

-45

hosts/morax/default.nix

··· 1 1 - { config, lib, pkgs, modulesPath, inputs, ... }: 2 2 - 3 3 - { 4 4 - imports = [ 5 5 - ./hardware.nix 6 6 - ./secrets.nix 7 7 - 8 8 - ../../common/system.nix 9 9 - ../../common/users.nix 10 10 - ../../common/services.nix 11 11 - ../../host-secrets.nix 12 12 - ]; 13 13 - 14 14 - system.stateVersion = "25.05"; 15 15 - 16 16 - nixpkgs.hostPlatform = lib.mkDefault "aarch64-linux"; 17 17 - hardware.enableRedistributableFirmware = true; 18 18 - hardware.enableAllHardware = lib.mkForce false; #https://github.com/NixOS/nixpkgs/issues/154163#issuecomment-2868994145 19 19 - 20 20 - networking = { 21 21 - hostName = "morax"; 22 22 - hostId = "2631a44a"; 23 23 - firewall.enable = false; 24 24 - defaultGateway = { 25 25 - address = "10.0.0.1"; 26 26 - interface = "eth0"; 27 27 - }; 28 28 - nameservers = [ "1.1.1.1" ]; 29 29 - interfaces.eth0 = { 30 30 - ipv4.addresses = [{ 31 31 - address = "10.0.0.210"; 32 32 - prefixLength = 24; 33 33 - }]; 34 34 - }; 35 35 - }; 36 36 - 37 37 - environment.systemPackages = with pkgs; [ 38 38 - inputs.agenix.packages.aarch64-linux.default 39 39 - ]; 40 40 - 41 41 - virtualisation.docker = { 42 42 - enable = true; 43 43 - enableOnBoot = true; 44 44 - }; 45 45 - }

-34

hosts/morax/hardware.nix

··· 1 1 - # Do not modify this file! It was generated by ‘nixos-generate-config’ 2 2 - # and may be overwritten by future invocations. Please make changes 3 3 - # to /etc/nixos/configuration.nix instead. 4 4 - { config, lib, pkgs, modulesPath, ... }: 5 5 - 6 6 - { 7 7 - imports = 8 8 - [ (modulesPath + "/installer/scan/not-detected.nix") 9 9 - ]; 10 10 - 11 11 - boot.initrd.availableKernelModules = [ "xhci_pci" ]; 12 12 - boot.initrd.kernelModules = [ ]; 13 13 - boot.kernelModules = [ ]; 14 14 - boot.extraModulePackages = [ ]; 15 15 - 16 16 - fileSystems."/" = 17 17 - { device = "/dev/disk/by-uuid/44444444-4444-4444-8888-888888888888"; 18 18 - fsType = "ext4"; 19 19 - }; 20 20 - 21 21 - swapDevices = [ ]; 22 22 - 23 23 - # Enables DHCP on each ethernet and wireless interface. In case of scripted networking 24 24 - # (the default) this is the recommended approach. When using systemd-networkd it's 25 25 - # still possible to use this option, but it's recommended to use it in conjunction 26 26 - # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`. 27 27 - networking.useDHCP = lib.mkDefault true; 28 28 - # networking.interfaces.docker0.useDHCP = lib.mkDefault true; 29 29 - # networking.interfaces.eth0.useDHCP = lib.mkDefault true; 30 30 - # networking.interfaces.tailscale0.useDHCP = lib.mkDefault true; 31 31 - # networking.interfaces.wlan0.useDHCP = lib.mkDefault true; 32 32 - 33 33 - nixpkgs.hostPlatform = lib.mkDefault "aarch64-linux"; 34 34 - }

-3

hosts/morax/secrets.nix

··· 1 1 - { 2 2 - 3 3 - }

+64

hosts/valefar/backup.nix

··· 1 1 + # Do not modify this file! It was generated by ‘nixos-generate-config’ 2 2 + # and may be overwritten by future invocations. Please make changes 3 3 + # to /etc/nixos/configuration.nix instead. 4 4 + { config, lib, pkgs, modulesPath, ... }: 5 5 + 6 6 + { 7 7 + imports = 8 8 + [ (modulesPath + "/installer/scan/not-detected.nix") 9 9 + ]; 10 10 + 11 11 + boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "nvme" "mpt3sas" "sd_mod" ]; 12 12 + boot.initrd.kernelModules = [ ]; 13 13 + boot.kernelModules = [ "kvm-amd" ]; 14 14 + boot.extraModulePackages = [ ]; 15 15 + 16 16 + fileSystems."/" = { 17 17 + device = "/dev/disk/by-uuid/17b399da-2210-4493-9ae3-c65b20b992a0"; 18 18 + fsType = "ext4"; 19 19 + }; 20 20 + 21 21 + fileSystems."/boot" = 22 22 + { device = "/dev/disk/by-uuid/6340-211B"; 23 23 + fsType = "vfat"; 24 24 + options = [ "fmask=0022" "dmask=0022" ]; 25 25 + }; 26 26 + 27 27 + /* fileSystems."/garage" = { 28 28 + device = "garage"; 29 29 + fsType = "zfs"; 30 30 + }; 31 31 + 32 32 + fileSystems."/storage" = { 33 33 + device = "storage"; 34 34 + fsType = "zfs"; 35 35 + };*/ 36 36 + 37 37 + swapDevices = [ ]; 38 38 + 39 39 + # Fan Control 40 40 + hardware.fancontrol = { 41 41 + enable = false; 42 42 + config = '' 43 43 + INTERVAL=10 44 44 + DEVPATH=hwmon1=devices/platform/nct6775.2592 hwmon2=devices/platform/coretemp.0 45 45 + DEVNAME=hwmon1=nct6795 hwmon2=coretemp 46 46 + FCTEMPS=hwmon1/pwm2=hwmon2/temp1_input hwmon1/pwm3=hwmon2/temp1_input 47 47 + FCFANS=hwmon1/pwm2=hwmon1/fan2_input hwmon1/pwm3=hwmon1/fan3_input 48 48 + MINTEMP=hwmon1/pwm2=20 hwmon1/pwm3=20 49 49 + MAXTEMP=hwmon1/pwm2=65 hwmon1/pwm3=60 50 50 + MINSTART=hwmon1/pwm2=38 hwmon1/pwm3=75 51 51 + MINSTOP=hwmon1/pwm2=28 hwmon1/pwm3=75 52 52 + MINPWM=hwmon1/pwm2=28 hwmon1/pwm3=75 53 53 + MAXPWM=hwmon1/pwm2=150 hwmon1/pwm3=105 54 54 + ''; 55 55 + }; 56 56 + 57 57 + # Enables DHCP on each ethernet and wireless interface. In case of scripted networking 58 58 + # (the default) this is the recommended approach. When using systemd-networkd it's 59 59 + # still possible to use this option, but it's recommended to use it in conjunction 60 60 + # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`. 61 61 + networking.useDHCP = lib.mkDefault true; 62 62 + hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware; 63 63 + # networking.interfaces.enp0s31f6.useDHCP = lib.mkDefault true; 64 64 + }

+256 -73

hosts/valefar/default.nix

··· 1 1 # hosts/valefar/configuration.nix (or default.nix) 2 2 - { config, lib, pkgs, modulesPath, inputs, ... }: 3 3 - 2 2 + { config, lib, pkgs, modulesPath, microvm, inputs, ... }: 4 3 { 4 4 + # ============================================================================= 5 5 + # IMPORTS 6 6 + # ============================================================================= 5 7 imports = [ 6 6 - # Host-specific hardware 7 8 ./hardware.nix 8 9 ./secrets.nix 9 9 - #../../common/nvidia.nix 10 10 + ../../common/nvidia.nix 11 11 + 12 12 + ../../host-secrets.nix 10 13 11 11 - # Common modules shared across hosts 12 14 ../../common/system.nix 13 15 ../../common/users.nix 14 16 ../../common/services.nix 15 17 ../../common/efi.nix 16 18 17 17 - # Common secrets 18 18 - ../../host-secrets.nix 19 19 + ../../common/nvidia.nix 19 20 ]; 20 21 21 21 - # Enable modules 22 22 + # ============================================================================= 23 23 + # SYSTEM CONFIGURATION 24 24 + # ============================================================================= 25 25 + system.stateVersion = "24.11"; 26 26 + nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux"; 27 27 + 28 28 + hardware.cpu.amd.updateMicrocode = lib.mkDefault 29 29 + config.hardware.enableRedistributableFirmware; 30 30 + 31 31 + # ============================================================================= 32 32 + # CUSTOM MODULES 33 33 + # ============================================================================= 22 34 modules.garage.enable = true; 23 35 modules.forgejo.enable = true; 36 36 + modules.immich.enable = true; 37 37 + modules.github-runners.enable = true; 24 38 25 25 - system.stateVersion = "24.11"; 39 39 + # ============================================================================= 40 40 + # NETWORKING 41 41 + # ============================================================================= 42 42 + /*networking = { 43 43 + hostName = "valefar"; 44 44 + hostId = "2a07da90"; 45 45 + firewall.enable = false; 46 46 + firewall.trustedInterfaces = [ "tailscale0" ]; 47 47 + nameservers = [ "10.0.0.210" "1.1.1.1" ]; 48 48 + useDHCP = true; 49 49 + firewall.allowedTCPPorts = [ 22 80 443 2049 2456 2457 9000 9001 9002 ]; 50 50 + firewall.allowedUDPPorts = [ 2049 ]; 51 51 + };*/ 52 52 + networking.useNetworkd = true; 53 53 + systemd.network.enable = true; 54 54 + networking.hostName = "valefar"; 55 55 + networking.hostId = "2a07da90"; 56 56 + networking.firewall.enable = false; 26 57 27 27 - # pin host platform & microcode 28 28 - nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux"; 29 29 - hardware.cpu.intel.updateMicrocode = lib.mkDefault 30 30 - config.hardware.enableRedistributableFirmware; 58 58 + services.proxmox-ve.bridges = [ "vmbr0" ]; 31 59 32 32 - networking.hostName = "valefar"; 33 33 - networking.hostId = "2a07da90"; 60 60 + systemd.network.networks."10-lan" = { 61 61 + matchConfig.Name = ["enp6s0"]; 62 62 + networkConfig = { 63 63 + Bridge = "vmbr0"; 64 64 + }; 65 65 + }; 66 66 + systemd.network.netdevs."br0" = { 67 67 + netdevConfig = { 68 68 + Name = "vmbr0"; 69 69 + Kind = "bridge"; 70 70 + }; 71 71 + }; 34 72 35 35 - networking = { 36 36 - firewall.enable = false; 37 37 - firewall.trustedInterfaces = [ 38 38 - "tailscale0" 39 39 - ]; 40 40 - nameservers = [ "10.0.0.210" "1.1.1.1" ]; 41 41 - useDHCP = true; 42 42 - firewall.allowedTCPPorts = [22 80 443 2456 2457 9000 9001 9002]; 73 73 + systemd.network.networks."10-lan-bridge" = { 74 74 + matchConfig.Name = "vmbr0"; 75 75 + networkConfig = { 76 76 + Address = ["10.0.0.30/24" "2601:5c2:8400:26c0::30/64"]; 77 77 + Gateway = "10.0.0.1"; 78 78 + DNS = ["10.0.0.210" "1.1.1.1" "1.0.0.1"]; 79 79 + IPv6AcceptRA = true; 80 80 + }; 81 81 + linkConfig.RequiredForOnline = "routable"; 43 82 }; 44 83 84 84 + # DNS resolution 45 85 services.resolved = { 46 46 - enable = true; 47 47 - dnssec = "false"; 48 48 - domains = [ "~." ]; 86 86 + enable = true; 87 87 + dnssec = "false"; 88 88 + domains = [ "~." ]; 49 89 fallbackDns = [ "10.0.0.210" "1.1.1.1" ]; 50 50 - dnsovertls = "false"; 90 90 + dnsovertls = "false"; 51 91 }; 52 52 - 53 53 - boot.supportedFilesystems = [ "zfs" ]; 54 54 - boot.kernelModules = [ "nct6775" "coretemp" ]; 55 92 56 56 - boot.zfs.extraPools = [ "garage" "storage" ]; 57 57 - boot.zfs.devNodes = "/dev/disk/by-id"; 58 58 - boot.zfs.forceImportAll = true; 59 59 - 60 60 - /*boot.kernelParams = [ "ip=dhcp" ]; 61 61 - boot.initrd = { 62 62 - availableKernelModules = [ "r8169" ]; 63 63 - network = { 64 64 - enable = true; 65 65 - ssh = { 66 66 - enable = true; 67 67 - port = 22; 68 68 - authorizedKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJ0pU82lV9dSjkgYbdh9utZ5CDM2dPN70S5fBqN1m3Pb" ]; 69 69 - hostKeys = [ "/etc/secrets/initrd/ssh_host_rsa_key" ]; 70 70 - shell = "/bin/cryptsetup-askpass"; 71 71 - }; 93 93 + # ============================================================================= 94 94 + # BOOT & FILESYSTEMS 95 95 + # ============================================================================= 96 96 + boot = { 97 97 + supportedFilesystems = [ "zfs" ]; 98 98 + kernelModules = [ "nct6775" "coretemp" ]; 99 99 + 100 100 + zfs = { 101 101 + extraPools = [ "garage" "storage" ]; 102 102 + devNodes = "/dev/disk/by-id"; 103 103 + forceImportAll = true; 72 104 }; 73 73 - };*/ 105 105 + }; 74 106 107 107 + # ============================================================================= 108 108 + # ZFS CONFIGURATION 109 109 + # ============================================================================= 110 110 + # ZFS import services 75 111 systemd.services.zfs-import-cache.enable = false; 76 76 - systemd.services.zfs-import-scan.enable = true; 77 77 - 78 112 systemd.services.zfs-import-scan = { 113 113 + enable = true; 79 114 after = [ "systemd-udev-settle.service" ]; 80 115 wants = [ "systemd-udev-settle.service" ]; 81 116 }; 82 117 118 118 + # ZFS mount points 83 119 systemd.mounts = [ 84 84 - { 85 85 - what = "garage"; 86 86 - where = "/garage"; 87 87 - type = "zfs"; 88 88 - after = [ "zfs-import-scan.service" ]; 89 89 - wants = [ "zfs-import-scan.service" ]; 90 90 - } 91 91 - { 92 92 - what = "storage"; 93 93 - where = "/storage"; 94 94 - type = "zfs"; 95 95 - after = [ "zfs-import-scan.service" ]; 96 96 - wants = [ "zfs-import-scan.service" ]; 97 97 - } 98 98 - ]; 120 120 + { 121 121 + what = "garage"; 122 122 + where = "/garage"; 123 123 + type = "zfs"; 124 124 + after = [ "zfs-import-scan.service" ]; 125 125 + wants = [ "zfs-import-scan.service" ]; 126 126 + } 127 127 + { 128 128 + what = "storage"; 129 129 + where = "/storage"; 130 130 + type = "zfs"; 131 131 + after = [ "zfs-import-scan.service" ]; 132 132 + wants = [ "zfs-import-scan.service" ]; 133 133 + } 134 134 + ]; 135 135 + 136 136 + # ZFS maintenance 137 137 + services.zfs = { 138 138 + autoScrub.enable = true; 139 139 + trim.enable = true; 140 140 + }; 141 141 + 142 142 + # ============================================================================= 143 143 + # DIRECTORY STRUCTURE 144 144 + # ============================================================================= 145 145 + systemd.tmpfiles.rules = [ 146 146 + "d /storage/immich 0755 immich immich -" 147 147 + "d /storage/immich/photos 0755 immich immich -" 148 148 + "Z /storage/immich 0755 immich immich -" 149 149 + "d /storage/tm_share 0755 regent users" 150 150 + "Z /garage/ 0755 garage garage -" 151 151 + ]; 99 152 100 100 - services.zfs.autoScrub.enable = true; 101 101 - services.zfs.trim.enable = true; 153 153 + # ============================================================================= 154 154 + # NFS SERVER 155 155 + # ============================================================================= 156 156 + services.nfs.server = { 157 157 + enable = true; 158 158 + exports = '' 159 159 + /storage *(rw,sync,no_subtree_check,no_root_squash) 160 160 + ''; 161 161 + }; 102 162 103 103 - services.vscode-server.enable = true; 104 104 - services.vscode-server.nodejsPackage = pkgs.nodejs_20; 163 163 + services.samba = { 164 164 + enable = true; 165 165 + settings = { 166 166 + global = { 167 167 + "workgroup" = "WORKGROUP"; 168 168 + "server string" = "valefar"; 169 169 + "netbios name" = "valefar"; 170 170 + "security" = "user"; 105 171 172 172 + "hosts allow" = "100.64.0.0/10 10.0.0.0/24 127.0.0.1 localhost"; 173 173 + "hosts deny" = "0.0.0.0/0"; 174 174 + "guest account" = "nobody"; 175 175 + "map to guest" = "bad user"; 176 176 + }; 177 177 + 178 178 + "tm_share" = { 179 179 + "path" = "/storage/tm_share"; 180 180 + "valid users" = "regent"; 181 181 + "public" = "yes"; 182 182 + "writeable" = "yes"; 183 183 + "force user" = "regent"; 184 184 + "fruit:aapl" = "yes"; 185 185 + "fruit:time machine" = "yes"; 186 186 + "vfs objects" = "catia fruit streams_xattr"; 187 187 + }; 188 188 + }; 189 189 + }; 190 190 + 191 191 + services.netatalk = { 192 192 + enable = true; 193 193 + settings = { 194 194 + time-machine = { 195 195 + path = "/storage/timemachine"; 196 196 + "valid users" = "regent"; 197 197 + "time machine" = true; 198 198 + }; 199 199 + }; 200 200 + }; 201 201 + 202 202 + services.avahi = { 203 203 + enable = true; 204 204 + nssmdns = true; 205 205 + publish = { 206 206 + enable = true; 207 207 + userServices = true; 208 208 + }; 209 209 + 210 210 + extraServiceFiles = { 211 211 + timemachine = '' 212 212 + <?xml version="1.0" standalone='no'?> 213 213 + <!DOCTYPE service-group SYSTEM "avahi-service.dtd"> 214 214 + <service-group> 215 215 + <name replace-wildcards="yes">%h</name> 216 216 + <service> 217 217 + <type>_smb._tcp</type> 218 218 + <port>445</port> 219 219 + </service> 220 220 + <service> 221 221 + <type>_device-info._tcp</type> 222 222 + <port>0</port> 223 223 + <txt-record>model=TimeCapsule8,119</txt-record> 224 224 + </service> 225 225 + <service> 226 226 + <type>_adisk._tcp</type> 227 227 + <!-- 228 228 + change tm_share to share name, if you changed it. 229 229 + --> 230 230 + <txt-record>dk0=adVN=tm_share,adVF=0x82</txt-record> 231 231 + <txt-record>sys=waMa=0,adVF=0x100</txt-record> 232 232 + </service> 233 233 + </service-group> 234 234 + ''; 235 235 + }; 236 236 + }; 237 237 + 238 238 + # ============================================================================= 239 239 + # SERVICES 240 240 + # ============================================================================= 241 241 + services.vscode-server = { 242 242 + enable = true; 243 243 + nodejsPackage = pkgs.nodejs_20; 244 244 + }; 245 245 + 246 246 + services.ollama = { 247 247 + enable = true; 248 248 + loadModels = ["deepseek-r1:1.5b" "gemma3:12b"]; 249 249 + acceleration = "cuda"; 250 250 + }; 251 251 + 252 252 + services.open-webui.enable = true; 253 253 + 254 254 + # ============================================================================= 255 255 + # VIRTUALIZATION 256 256 + # ============================================================================= 257 257 + virtualisation.docker = { 258 258 + enable = true; 259 259 + enableOnBoot = true; 260 260 + }; 261 261 + 262 262 + services.fail2ban = { 263 263 + enable = true; 264 264 + # Ban IP after 5 failures 265 265 + maxretry = 5; 266 266 + ignoreIP = [ 267 267 + "10.0.0.0/8" "172.16.0.0/12" "192.168.0.0/16" "100.64.0.0/10" 268 268 + ]; 269 269 + bantime = "24h"; # Ban IPs for one day on the first ban 270 270 + bantime-increment = { 271 271 + enable = true; # Enable increment of bantime after each violation 272 272 + multipliers = "1 2 4 8 16 32 64"; 273 273 + maxtime = "168h"; # Do not ban for more than 1 week 274 274 + overalljails = true; # Calculate the bantime based on all the violations 275 275 + }; 276 276 + }; 277 277 + 278 278 + # ============================================================================= 279 279 + # PACKAGES 280 280 + # ============================================================================= 106 281 environment.systemPackages = with pkgs; [ 107 282 lm_sensors 108 283 code-server 109 284 inputs.agenix.packages.x86_64-linux.default 110 285 ]; 111 286 112 112 - virtualisation.docker = { 113 113 - enable = true; 114 114 - enableOnBoot = true; 115 115 - package = pkgs.docker.override { 116 116 - buildGoModule = pkgs.buildGo123Module; 287 287 + 288 288 + # ============================================================================= 289 289 + # VIRTUAL MACHINES 290 290 + # ============================================================================= 291 291 + /*systemd.services."microvm@".after = [ "microvm-virtiofsd@%i.service" ]; 292 292 + 293 293 + microvm.vms = { 294 294 + gameservers = { 295 295 + config = import ./gamevm.nix; 117 296 }; 118 297 }; 298 298 + 299 299 + microvm.autostart = [ 300 300 + "gameservers" 301 301 + ];*/ 119 302 }

+12 -36

hosts/valefar/hardware.nix

··· 8 8 [ (modulesPath + "/installer/scan/not-detected.nix") 9 9 ]; 10 10 11 11 - boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "nvme" "mpt3sas" "sd_mod" ]; 11 11 + boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "mpt3sas" "nvme" "usbhid" "uas" "sd_mod" ]; 12 12 boot.initrd.kernelModules = [ ]; 13 13 boot.kernelModules = [ "kvm-amd" ]; 14 14 boot.extraModulePackages = [ ]; 15 15 16 16 - fileSystems."/" = { 17 17 - device = "/dev/disk/by-uuid/17b399da-2210-4493-9ae3-c65b20b992a0"; 18 18 - fsType = "ext4"; 19 19 - }; 16 16 + fileSystems."/" = 17 17 + { device = "/dev/disk/by-uuid/e02d1d07-3bc8-4d1d-a301-6d589f4b4b6d"; 18 18 + fsType = "ext4"; 19 19 + }; 20 20 21 21 fileSystems."/boot" = 22 22 - { device = "/dev/disk/by-uuid/6340-211B"; 22 22 + { device = "/dev/disk/by-uuid/B3DE-0187"; 23 23 fsType = "vfat"; 24 24 options = [ "fmask=0022" "dmask=0022" ]; 25 25 }; 26 26 27 27 - /* fileSystems."/garage" = { 28 28 - device = "garage"; 29 29 - fsType = "zfs"; 30 30 - }; 31 31 - 32 32 - fileSystems."/storage" = { 33 33 - device = "storage"; 34 34 - fsType = "zfs"; 35 35 - };*/ 36 36 - 37 37 - swapDevices = [ ]; 38 38 - 39 39 - # Fan Control 40 40 - hardware.fancontrol = { 41 41 - enable = false; 42 42 - config = '' 43 43 - INTERVAL=10 44 44 - DEVPATH=hwmon1=devices/platform/nct6775.2592 hwmon2=devices/platform/coretemp.0 45 45 - DEVNAME=hwmon1=nct6795 hwmon2=coretemp 46 46 - FCTEMPS=hwmon1/pwm2=hwmon2/temp1_input hwmon1/pwm3=hwmon2/temp1_input 47 47 - FCFANS=hwmon1/pwm2=hwmon1/fan2_input hwmon1/pwm3=hwmon1/fan3_input 48 48 - MINTEMP=hwmon1/pwm2=20 hwmon1/pwm3=20 49 49 - MAXTEMP=hwmon1/pwm2=65 hwmon1/pwm3=60 50 50 - MINSTART=hwmon1/pwm2=38 hwmon1/pwm3=75 51 51 - MINSTOP=hwmon1/pwm2=28 hwmon1/pwm3=75 52 52 - MINPWM=hwmon1/pwm2=28 hwmon1/pwm3=75 53 53 - MAXPWM=hwmon1/pwm2=150 hwmon1/pwm3=105 54 54 - ''; 55 55 - }; 27 27 + swapDevices = 28 28 + [ { device = "/dev/disk/by-uuid/c8f24f31-49e0-486c-9f63-1d31b2e36ce9"; } 29 29 + ]; 56 30 57 31 # Enables DHCP on each ethernet and wireless interface. In case of scripted networking 58 32 # (the default) this is the recommended approach. When using systemd-networkd it's 59 33 # still possible to use this option, but it's recommended to use it in conjunction 60 34 # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`. 61 35 networking.useDHCP = lib.mkDefault true; 36 36 + # networking.interfaces.enp6s0.useDHCP = lib.mkDefault true; 37 37 + 38 38 + nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux"; 62 39 hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware; 63 63 - # networking.interfaces.enp0s31f6.useDHCP = lib.mkDefault true; 64 40 }

+63 -4

modules/caddy/default.nix

··· 8 8 let 9 9 cfg = config.modules.caddy; 10 10 caddyMetricsPort = 2019; 11 11 + 12 12 + # Generate Caddyfile content from the proxy configuration 13 13 + generateCaddyfile = proxies: 14 14 + let 15 15 + proxyEntries = mapAttrsToList (domain: upstreams: 16 16 + let 17 17 + upstreamList = if isList upstreams then upstreams else [upstreams]; 18 18 + upstreamStr = concatStringsSep " " upstreamList; 19 19 + in '' 20 20 + ${domain} { 21 21 + reverse_proxy ${upstreamStr} 22 22 + 23 23 + # Optional: Add some common headers for better proxying 24 24 + header_up Host {upstream_hostport} 25 25 + header_up X-Real-IP {remote_host} 26 26 + header_up X-Forwarded-For {remote_host} 27 27 + header_up X-Forwarded-Proto {scheme} 28 28 + } 29 29 + '') proxies; 30 30 + in 31 31 + concatStringsSep "\n\n" proxyEntries; 32 32 + 11 33 in 12 34 { 13 35 options = { 14 36 modules = { 15 15 - caddy = { enable = mkEnableOption "Deploy Caddy"; }; 37 37 + caddy = { 38 38 + enable = mkEnableOption "Deploy Caddy"; 39 39 + 40 40 + reverseProxies = mkOption { 41 41 + type = types.attrsOf (types.either types.str (types.listOf types.str)); 42 42 + default = {}; 43 43 + description = "Attribute set of domain to upstream mappings for reverse proxying. Upstreams can be a single string or a list of strings for load balancing."; 44 44 + example = { 45 45 + "notes.nekomimi.pet" = "valefar:3009"; 46 46 + "git.nekomimi.pet" = ["morax:3000" "valefar:3000"]; # Load balance between multiple upstreams 47 47 + "api.nekomimi.pet" = ["server1:8080" "server2:8080" "server3:8080"]; 48 48 + }; 49 49 + }; 50 50 + 51 51 + extraConfig = mkOption { 52 52 + type = types.lines; 53 53 + default = ""; 54 54 + description = "Extra Caddyfile configuration to append"; 55 55 + }; 56 56 + 57 57 + email = mkOption { 58 58 + type = types.nullOr types.str; 59 59 + default = null; 60 60 + description = "Email address for ACME certificate registration"; 61 61 + }; 62 62 + }; 16 63 }; 17 64 }; 18 65 ··· 29 76 30 77 services.caddy = { 31 78 enable = true; 32 32 - /* package = pkgs.caddy.withPlugins { 33 33 - plugins = [ "github.com/caddy-dns/cloudflare@v0.0.0-20240703190432-89f16b99c18e"]; 34 34 - hash = "sha256-JVkUkDKdat4aALJHQCq1zorJivVCdyBT+7UhqTvaFLw="; 79 79 + /*package = pkgs.caddy.withPlugins { 80 80 + plugins = [ "github.com/caddy-dns/cloudflare@v0.2.1"]; 81 81 + hash = "sha256-1niaf801sijvjrqvw998y8x7b43a0g162h3ry530qwl8lrgkapii"; 35 82 };*/ 83 83 + 84 84 + extraConfig = '' 85 85 + ${optionalString (cfg.email != null) '' 86 86 + { 87 87 + email ${cfg.email} 88 88 + } 89 89 + ''} 90 90 + 91 91 + ${generateCaddyfile cfg.reverseProxies} 92 92 + 93 93 + ${cfg.extraConfig} 94 94 + ''; 36 95 }; 37 96 38 97 systemd.services.caddy = {

+3 -2

modules/forgejo/default.nix

··· 37 37 SSH_LISTEN_PORT = 2222; 38 38 SSH_PORT = 2222; 39 39 START_SSH_SERVER = true; 40 40 + SSH_DOMAIN = "sgit.nekomimi.pet"; 40 41 }; 41 41 - # service.DISABLE_REGISTRATION = true; 42 42 + service.DISABLE_REGISTRATION = true; 42 43 actions = { 43 44 ENABLED = true; 44 45 DEFAULT_ACTIONS_URL = "github"; ··· 46 47 }; 47 48 }; 48 49 }; 49 49 - } 50 50 + }

+4 -4

modules/garage/default.nix

··· 16 16 config = mkIf cfg.enable { 17 17 services.garage = { 18 18 enable = true; 19 19 - package = pkgs.garage; 19 19 + package = pkgs.garage_2; 20 20 settings = { 21 21 metadata_dir = "/garage/metadata"; 22 22 data_dir = "/garage/data"; 23 23 db_engine = "lmdb"; 24 24 - replication_mode = "2"; 24 24 + replication_factor = 2; 25 25 rpc_bind_addr = "[::]:3901"; 26 26 rpc_public_addr = "${config.networking.hostName}:3901"; 27 27 rpc_secret_file = config.age.secrets."garage-rpc-secret".path; ··· 41 41 metrics_token_file = config.age.secrets."garage-metrics-token".path; 42 42 }; 43 43 bootstrap_peers = [ 44 44 - "d548d0c9ae9aec9e26fe0bd2ca3efe75f654fa350bad5cb02bc9aebc9850ba8f@[2a04:52c0:135:48d1::2]:3901" # buer 45 45 - "5504cb25910dcef4a4312006691d651c099cde7c3a88df9ca79aa350571e6e65@[2601:5c2:8400:26c0:4ecc:6aff:fef7:98ca]:3901" #valefar 44 44 + "d548d0c9ae9aec9e26fe0bd2ca3efe75f654fa350bad5cb02bc9aebc9850ba8f@[buer]:3901" 45 45 + "5504cb25910dcef4a4312006691d651c099cde7c3a88df9ca79aa350571e6e65@[valefar]:3901" 46 46 ]; 47 47 }; 48 48 };

+12 -3

modules/github-runners/default.nix

··· 34 34 services.github-runners = { 35 35 simplelink = { 36 36 enable = true; 37 37 - name = "simplelink"; 37 37 + name = "simplelink-" + config.networking.hostName; 38 38 url = "https://github.com/waveringana/simplelink"; 39 39 - token = config.age.secrets."build-token".path; 39 39 + tokenFile = config.age.secrets."build-token".path; 40 40 + user = "regent"; 41 41 + group = "docker"; 42 42 + extraPackages = extraPackages; 43 43 + }; 44 44 + embedder = { 45 45 + enable = true; 46 46 + name = "embedder-" + config.networking.hostName; 47 47 + url = "https://github.com/waveringana/embedder"; 48 48 + tokenFile = config.age.secrets."build-token".path; 40 49 user = "regent"; 41 50 group = "docker"; 42 51 extraPackages = extraPackages; 43 43 - }; 52 52 + }; 44 53 }; 45 54 }; 46 55 }

+229

modules/headscale/default.nix

··· 1 1 + { config, lib, pkgs, ... }: 2 2 + 3 3 + with lib; 4 4 + let 5 5 + cfg = config.modules.headscale; 6 6 + in 7 7 + { 8 8 + options = { 9 9 + modules = { 10 10 + headscale = { 11 11 + enable = mkEnableOption "Deploy headscale"; 12 12 + 13 13 + oidcClientSecretPath = mkOption { 14 14 + type = types.str; 15 15 + default = "/etc/headscale/oidc_client_secret.key"; 16 16 + description = "Path to OIDC client secret file"; 17 17 + example = "config.age.secrets.headscale-oidc-key.path"; 18 18 + }; 19 19 + 20 20 + litestream = { 21 21 + enable = mkEnableOption "Enable litestream for headscale database backups"; 22 22 + 23 23 + replicas = mkOption { 24 24 + type = types.listOf (types.attrsOf types.anything); 25 25 + default = []; 26 26 + description = "List of litestream replica configurations"; 27 27 + example = [ 28 28 + { 29 29 + url = "s3://your-backup-bucket/headscale/db"; 30 30 + access-key-id = "$LITESTREAM_ACCESS_KEY_ID"; 31 31 + secret-access-key = "$LITESTREAM_SECRET_ACCESS_KEY"; 32 32 + region = "us-east-1"; 33 33 + } 34 34 + ]; 35 35 + }; 36 36 + 37 37 + backupPath = mkOption { 38 38 + type = types.nullOr types.str; 39 39 + default = null; 40 40 + description = "Local backup path (alternative to S3)"; 41 41 + example = "/backup/headscale"; 42 42 + }; 43 43 + 44 44 + syncInterval = mkOption { 45 45 + type = types.str; 46 46 + default = "1s"; 47 47 + description = "How often to sync to replicas"; 48 48 + }; 49 49 + 50 50 + retention = mkOption { 51 51 + type = types.str; 52 52 + default = "72h"; 53 53 + description = "How long to retain snapshots"; 54 54 + }; 55 55 + 56 56 + environmentFile = mkOption { 57 57 + type = types.nullOr types.path; 58 58 + default = null; 59 59 + description = "Environment file containing S3 credentials (can be agenix secret)"; 60 60 + example = "config.age.secrets.litestream-env.path"; 61 61 + }; 62 62 + }; 63 63 + }; 64 64 + }; 65 65 + }; 66 66 + 67 67 + config = mkIf cfg.enable { 68 68 + services.headscale = { 69 69 + enable = true; 70 70 + address = "0.0.0.0"; 71 71 + port = 8080; 72 72 + 73 73 + settings = { 74 74 + server_url = "https://headscale.nekomimi.pet"; 75 75 + 76 76 + # Metrics and gRPC 77 77 + metrics_listen_addr = "127.0.0.1:9090"; 78 78 + grpc_listen_addr = "127.0.0.1:50443"; 79 79 + grpc_allow_insecure = false; 80 80 + 81 81 + # Prefixes 82 82 + prefixes = { 83 83 + v4 = "100.64.0.0/10"; 84 84 + v6 = "fd7a:115c:a1e0::/48"; 85 85 + allocation = "sequential"; 86 86 + }; 87 87 + 88 88 + # Database 89 89 + database = { 90 90 + type = "sqlite"; 91 91 + sqlite = { 92 92 + path = "/var/lib/headscale/db.sqlite"; 93 93 + write_ahead_log = true; 94 94 + }; 95 95 + }; 96 96 + 97 97 + # Noise 98 98 + noise = { 99 99 + private_key_path = "/var/lib/headscale/noise_private.key"; 100 100 + }; 101 101 + 102 102 + # DERP 103 103 + derp = { 104 104 + urls = [ 105 105 + "https://controlplane.tailscale.com/derpmap/default" 106 106 + ]; 107 107 + paths = []; 108 108 + auto_update_enabled = true; 109 109 + update_frequency = "24h"; 110 110 + server = { 111 111 + enabled = false; 112 112 + region_id = 999; 113 113 + region_code = "headscale"; 114 114 + region_name = "Headscale Embedded DERP"; 115 115 + stun_listen_addr = "0.0.0.0:3478"; 116 116 + private_key_path = "/var/lib/headscale/derp_server_private.key"; 117 117 + automatically_add_embedded_derp_region = true; 118 118 + ipv4 = "1.2.3.4"; 119 119 + ipv6 = "2001:db8::1"; 120 120 + }; 121 121 + }; 122 122 + 123 123 + # DNS 124 124 + dns = { 125 125 + magic_dns = true; 126 126 + base_domain = "dns.sharkgirl.pet"; 127 127 + nameservers = { 128 128 + global = [ 129 129 + "100.64.0.7" 130 130 + "1.1.1.1" 131 131 + "1.0.0.1" 132 132 + "2606:4700:4700::1111" 133 133 + "2606:4700:4700::1001" 134 134 + ]; 135 135 + }; 136 136 + search_domains = []; 137 137 + }; 138 138 + 139 139 + # OIDC with configurable secret path 140 140 + oidc = { 141 141 + only_start_if_oidc_is_available = true; 142 142 + issuer = "https://pocketid.nekomimi.pet"; 143 143 + client_id = "f345acad-3eac-45b7-9d91-57f388987a57"; 144 144 + client_secret_path = cfg.oidcClientSecretPath; 145 145 + pkce = { 146 146 + enabled = true; 147 147 + method = "S256"; 148 148 + }; 149 149 + }; 150 150 + 151 151 + # Policy 152 152 + policy = { 153 153 + mode = "database"; 154 154 + }; 155 155 + 156 156 + # TLS/ACME 157 157 + acme_url = "https://acme-v02.api.letsencrypt.org/directory"; 158 158 + acme_email = ""; 159 159 + tls_letsencrypt_hostname = ""; 160 160 + tls_letsencrypt_cache_dir = "/var/lib/headscale/cache"; 161 161 + tls_letsencrypt_challenge_type = "HTTP-01"; 162 162 + tls_letsencrypt_listen = ":http"; 163 163 + tls_cert_path = ""; 164 164 + tls_key_path = ""; 165 165 + 166 166 + # Logging 167 167 + log = { 168 168 + format = "text"; 169 169 + level = "info"; 170 170 + }; 171 171 + 172 172 + # Misc settings 173 173 + disable_check_updates = false; 174 174 + ephemeral_node_inactivity_timeout = "30m"; 175 175 + unix_socket = "/var/run/headscale/headscale.sock"; 176 176 + unix_socket_permission = "0770"; 177 177 + logtail = { 178 178 + enabled = false; 179 179 + }; 180 180 + randomize_client_port = false; 181 181 + }; 182 182 + }; 183 183 + 184 184 + # Configurable Litestream for SQLite database backups 185 185 + services.litestream = mkIf cfg.litestream.enable { 186 186 + enable = true; 187 187 + settings = { 188 188 + dbs = [ 189 189 + { 190 190 + path = "/var/lib/headscale/db.sqlite"; 191 191 + sync-interval = cfg.litestream.syncInterval; 192 192 + retention = cfg.litestream.retention; 193 193 + replicas = 194 194 + # Use custom replicas if provided 195 195 + if cfg.litestream.replicas != [] then 196 196 + cfg.litestream.replicas 197 197 + # Otherwise use local backup if path is provided 198 198 + else if cfg.litestream.backupPath != null then 199 199 + [{ path = cfg.litestream.backupPath; }] 200 200 + # Default empty (user must configure) 201 201 + else 202 202 + []; 203 203 + } 204 204 + ]; 205 205 + }; 206 206 + }; 207 207 + 208 208 + # Configure systemd service to use agenix secrets 209 209 + systemd.services.headscale.serviceConfig = mkMerge [ 210 210 + { 211 211 + SupplementaryGroups = [ "headscale-secrets" ]; 212 212 + } 213 213 + # Add environment file for litestream if specified 214 214 + (mkIf (cfg.litestream.enable && cfg.litestream.environmentFile != null) { 215 215 + EnvironmentFile = cfg.litestream.environmentFile; 216 216 + }) 217 217 + ]; 218 218 + 219 219 + # Configure litestream service with environment file if specified 220 220 + systemd.services.litestream = mkIf (cfg.litestream.enable && cfg.litestream.environmentFile != null) { 221 221 + serviceConfig = { 222 222 + EnvironmentFile = cfg.litestream.environmentFile; 223 223 + }; 224 224 + }; 225 225 + 226 226 + # Create a group for accessing secrets 227 227 + users.groups.headscale-secrets = {}; 228 228 + }; 229 229 + }

+28

modules/immich/default.nix

··· 1 1 + { config, lib, pkgs, ... }: 2 2 + 3 3 + with lib; 4 4 + let 5 5 + cfg = config.modules.immich; 6 6 + 7 7 + immichRoot = "/storage/immich"; #TODO make this configurable through nix 8 8 + immichPhotos = "${immichRoot}/photos"; 9 9 + in 10 10 + { 11 11 + options = { 12 12 + modules = { 13 13 + immich = { 14 14 + enable = mkEnableOption "Deploy immich"; 15 15 + }; 16 16 + }; 17 17 + }; 18 18 + 19 19 + config = mkIf cfg.enable { 20 20 + services.immich = { 21 21 + enable = true; 22 22 + port = 2283; 23 23 + host = "0.0.0.0"; 24 24 + mediaLocation = immichPhotos; 25 25 + settings = null; 26 26 + }; 27 27 + }; 28 28 + }

+42

modules/monero/default.nix

··· 1 1 + { config, lib, pkgs, ... }: 2 2 + 3 3 + with lib; 4 4 + let 5 5 + cfg = config.modules.monero; 6 6 + 7 7 + #TODO make this configurable through nix 8 8 + address = "46Ev6Vk4QeQZTr14tRjksTT2VPhi4jKB48mGz31rpUUci2Bvg9PHZj9GLK3VceWDc13tkUbzmqQz8eKR3hkD9bUKFKHLrzg"; 9 9 + dataDir = "/storage/monero"; 10 10 + miningThreads = 6; 11 11 + user = "regent"; 12 12 + password = "AnRPCPasswordChangedImperatively"; 13 13 + rpcAddress = "127.0.0.1"; 14 14 + rpcPort = 18081; 15 15 + in 16 16 + { 17 17 + options = { 18 18 + modules = { 19 19 + monero = { 20 20 + enable = mkEnableOption "Deploy monero node"; 21 21 + }; 22 22 + }; 23 23 + }; 24 24 + 25 25 + config = mkIf cfg.enable { 26 26 + services.monero = { 27 27 + enable = true; 28 28 + dataDir = dataDir; 29 29 + rpc = { 30 30 + user = user; 31 31 + password = password; 32 32 + address = rpcAddress; 33 33 + port = rpcPort; 34 34 + }; 35 35 + mining = { 36 36 + enable = true; 37 37 + threads = miningThreads; 38 38 + address = address; 39 39 + }; 40 40 + }; 41 41 + }; 42 42 + }

+858

modules/seaweedfs/default.nix

··· 1 1 + /*https://hg.sr.ht/~dermetfan/seaweedfs-nixos/browse/seaweedfs.nix?rev=tip*/ 2 2 + 3 3 + { config, lib, pkgs, ... }: 4 4 + 5 5 + with lib; 6 6 + 7 7 + let 8 8 + cfg = config.modules.seaweedfs; 9 9 + 10 10 + clusterModule = cluster: { 11 11 + options = { 12 12 + package = mkOption { 13 13 + type = types.package; 14 14 + default = pkgs.seaweedfs; 15 15 + }; 16 16 + 17 17 + security.grpc = let 18 18 + auth = mkOption { 19 19 + type = with types; nullOr (submodule { 20 20 + options = { 21 21 + cert = mkOption { type = path; }; 22 22 + key = mkOption { type = path; }; 23 23 + }; 24 24 + }); 25 25 + default = null; 26 26 + }; 27 27 + in { 28 28 + ca = mkOption { 29 29 + type = with types; nullOr str; 30 30 + default = null; 31 31 + }; 32 32 + 33 33 + master = auth; 34 34 + volume = auth; 35 35 + filer = auth; 36 36 + client = auth; 37 37 + msgBroker = auth; 38 38 + }; 39 39 + 40 40 + masters = mkOption { 41 41 + type = with types; attrsOf (submodule (masterModule cluster.config)); 42 42 + default = {}; 43 43 + description = "SeaweedFS masters"; 44 44 + }; 45 45 + 46 46 + volumes = mkOption { 47 47 + type = with types; attrsOf (submodule (volumeModule cluster.config)); 48 48 + default = {}; 49 49 + description = "SeaweedFS volumes"; 50 50 + }; 51 51 + 52 52 + filers = mkOption { 53 53 + type = with types; attrsOf (submodule (filerModule cluster.config)); 54 54 + default = {}; 55 55 + description = "SeaweedFS filers"; 56 56 + }; 57 57 + 58 58 + webdavs = mkOption { 59 59 + type = with types; attrsOf (submodule (webdavModule cluster.config)); 60 60 + default = {}; 61 61 + description = "SeaweedFS WebDAV servers"; 62 62 + }; 63 63 + 64 64 + instances = mkOption { 65 65 + type = with types; attrsOf (submodule instanceModule); 66 66 + description = "SeaweedFS instances"; 67 67 + default = 68 68 + mapAttrs' (name: master: nameValuePair 69 69 + "master-${name}" 70 70 + { 71 71 + inherit (master) cluster configs; 72 72 + 73 73 + command = "master"; 74 74 + 75 75 + args = with master; 76 76 + [ 77 77 + "-port=${toString port}" 78 78 + "-volumeSizeLimitMB=${toString volumeSizeLimitMB}" 79 79 + ] ++ 80 80 + optional (cpuprofile != "") "-cpuprofile=${cpuprofile}" ++ 81 81 + optional (defaultReplication != null) ("-defaultReplication=${defaultReplication.code}") ++ 82 82 + optional disableHttp "-disableHttp" ++ 83 83 + optional (garbageThreshold != "") "-garbageThreshold=${garbageThreshold}" ++ 84 84 + optional (ip != "") "-ip=${ip}" ++ 85 85 + optional (master."ip.bind" != "") "-ip.bind=${master."ip.bind"}" ++ 86 86 + optional (mdir != "") "-mdir=${mdir}" ++ 87 87 + optional (memprofile != "") "-memprofile=${memprofile}" ++ 88 88 + optional metrics.enable "-metrics.address=${metrics.address.text}" ++ 89 89 + optional (metrics.intervalSeconds != null) "-metrics.intervalSeconds=${toString metrics.intervalSeconds}" ++ 90 90 + optional (peers != []) ("-peers=" + (concatStringsSep "," (map (peer: peer.text) peers))) ++ 91 91 + optional resumeState "-resumeState" ++ 92 92 + optional volumePreallocate "-volumePreallocate" ++ 93 93 + optional (whiteList != []) ("-whiteList=" + (concatStringsSep "," whiteList)); 94 94 + } 95 95 + ) cluster.config.masters // 96 96 + mapAttrs' (name: volume: nameValuePair 97 97 + "volume-${name}" 98 98 + { 99 99 + inherit (volume) cluster configs; 100 100 + 101 101 + command = "volume"; 102 102 + 103 103 + args = with volume; 104 104 + [ 105 105 + "-port=${toString port}" 106 106 + "-dir=${concatStringsSep "," dir}" 107 107 + "-fileSizeLimitMB=${toString fileSizeLimitMB}" 108 108 + "-idleTimeout=${toString idleTimeout}" 109 109 + "-index=${index}" 110 110 + "-minFreeSpacePercent=${toString minFreeSpacePercent}" 111 111 + "-preStopSeconds=${toString preStopSeconds}" 112 112 + ] ++ 113 113 + optional (compactionMBps != null) ("-compactionMBps=${compactionMBps}") ++ 114 114 + optional (cpuprofile != "") "-cpuprofile=${cpuprofile}" ++ 115 115 + optional (dataCenter != "") "-dataCenter=${dataCenter}" ++ 116 116 + optional volume."images.fix.orientation" "-images.fix.orientation" ++ 117 117 + optional (ip != "") "-ip=${ip}" ++ 118 118 + optional (volume."ip.bind" != "") "-ip.bind=${volume."ip.bind"}" ++ 119 119 + optional (max != []) "-max=${concatStringsSep "," (map toString max)}" ++ 120 120 + optional (memprofile != "") "-memprofile=${memprofile}" ++ 121 121 + optional (metricsPort != null) "-metricsPort=${toString metricsPort}" ++ 122 122 + optional (mserver != []) ("-mserver=" + (concatStringsSep "," (map (mserver: mserver.text) mserver))) ++ 123 123 + optional (volume."port.public" != null) "-port.public=${toString volume."port.public"}" ++ 124 124 + optional pprof "-pprof" ++ 125 125 + optional (publicUrl != "") "-publicUrl=${publicUrl}" ++ 126 126 + optional (rack != "") "-rack=${rack}" ++ 127 127 + optional (!volume."read.redirect") "-read.redirect=false" ++ 128 128 + optional (whiteList != []) ("-whiteList=" + (concatStringsSep "," whiteList)); 129 129 + 130 130 + systemdService.preStart = "mkdir -p ${concatStringsSep " " volume.dir}"; 131 131 + } 132 132 + ) cluster.config.volumes // 133 133 + mapAttrs' (name: filer: nameValuePair 134 134 + "filer-${name}" 135 135 + { 136 136 + inherit (filer) cluster configs; 137 137 + 138 138 + command = "filer"; 139 139 + 140 140 + args = with filer; 141 141 + [ 142 142 + "-port=${toString port}" 143 143 + "-dirListLimit=${toString dirListLimit}" 144 144 + "-maxMB=${toString maxMB}" 145 145 + ] ++ 146 146 + optional (collection != "") "-collection=${collection}" ++ 147 147 + optional (dataCenter != "") "-dataCenter=${dataCenter}" ++ 148 148 + optional (defaultReplicaPlacement != null) ("-defaultReplicaPlacement=${defaultReplicaPlacement.code}") ++ 149 149 + optional disableDirListing "-disableDirListing" ++ 150 150 + optional disableHttp "-disableHttp" ++ 151 151 + optional encryptVolumeData "-encryptVolumeData" ++ 152 152 + optional (ip != "") "-ip=${ip}" ++ 153 153 + optional (filer."ip.bind" != "") "-ip.bind=${filer."ip.bind"}" ++ 154 154 + optional (master != []) ("-master=" + (concatStringsSep "," (map (master: master.text) master))) ++ 155 155 + optional (metricsPort != null) "-metricsPort=${toString metricsPort}" ++ 156 156 + optional (peers != []) ("-peers=" + (concatStringsSep "," (map (peer: peer.text) peers))) ++ 157 157 + optional (filer."port.readonly" != null) "-port.readonly=${toString filer."port.readonly"}" ++ 158 158 + optional (rack != "") "-rack=${rack}" ++ 159 159 + optionals s3.enable [ 160 160 + "-s3" 161 161 + "-s3.port=${toString filer.s3.port}" 162 162 + ] ++ 163 163 + optional (s3.enable && s3."cert.file" != "") "-s3.cert.file=${s3."cert.file"}" ++ 164 164 + optional (s3.enable && s3."key.file" != "") "-s3.key.file=${s3."key.file"}" ++ 165 165 + optional (s3.enable && s3.config != "") "-s3.config=${s3.config}" ++ 166 166 + optional (s3.enable && s3.domainName != []) "-s3.domainName=${concatStringsSep "," s3.domainName}"; 167 167 + 168 168 + systemdService.preStart = let 169 169 + conf = filer.configs.filer.leveldb2 or {}; 170 170 + in optionalString (conf ? "dir") "mkdir -p ${conf.dir}"; 171 171 + } 172 172 + ) cluster.config.filers // 173 173 + mapAttrs' (name: webdav: nameValuePair 174 174 + "webdav-${name}" 175 175 + { 176 176 + inherit (webdav) cluster; 177 177 + 178 178 + command = "webdav"; 179 179 + 180 180 + args = with webdav; 181 181 + [ 182 182 + "-port=${toString port}" 183 183 + "-filer=${filer.text}" 184 184 + "-cacheCapacityMB=${toString cacheCapacityMB}" 185 185 + ] ++ 186 186 + optional (collection != "") "-collection=${collection}" ++ 187 187 + optional (cacheDir != "") "-cacheDir=${cacheDir}"; 188 188 + } 189 189 + ) cluster.config.webdavs; 190 190 + }; 191 191 + }; 192 192 + }; 193 193 + 194 194 + commonModule = cluster: common: { 195 195 + options = { 196 196 + cluster = mkOption { 197 197 + type = types.submodule clusterModule; 198 198 + internal = true; 199 199 + }; 200 200 + 201 201 + openFirewall = mkEnableOption "open the firewall"; 202 202 + }; 203 203 + 204 204 + config = { inherit cluster; }; 205 205 + }; 206 206 + 207 207 + masterModule = cluster: master: { 208 208 + imports = [ (commonModule cluster) ]; 209 209 + 210 210 + options = { 211 211 + configs = mkOption { 212 212 + type = with types; attrsOf attrs; 213 213 + default.master.maintenance = { 214 214 + scripts = '' 215 215 + ec.encode -fullPercent=95 -quietFor=1h 216 216 + ec.rebuild -force 217 217 + ec.balance -force 218 218 + volume.balance -force 219 219 + volume.fix.replication 220 220 + ''; 221 221 + sleep_minutes = 17; 222 222 + }; 223 223 + }; 224 224 + 225 225 + cpuprofile = mkOption { 226 226 + type = types.str; 227 227 + default = ""; 228 228 + }; 229 229 + 230 230 + defaultReplication = mkOption { 231 231 + type = types.submodule replicationModule; 232 232 + default = {}; 233 233 + }; 234 234 + 235 235 + disableHttp = mkEnableOption "disable HTTP requests, gRPC only"; 236 236 + 237 237 + garbageThreshold = mkOption { 238 238 + type = types.str; 239 239 + default = ""; 240 240 + }; 241 241 + 242 242 + ip = mkOption { 243 243 + type = types.str; 244 244 + default = config.networking.hostName; 245 245 + }; 246 246 + 247 247 + "ip.bind" = mkOption { 248 248 + type = types.str; 249 249 + default = "0.0.0.0"; 250 250 + }; 251 251 + 252 252 + mdir = mkOption { 253 253 + type = types.str; 254 254 + default = "."; 255 255 + }; 256 256 + 257 257 + memprofile = mkOption { 258 258 + type = types.str; 259 259 + default = ""; 260 260 + }; 261 261 + 262 262 + metrics = { 263 263 + enable = mkEnableOption "Prometheus"; 264 264 + 265 265 + address = mkOption { 266 266 + type = types.submodule ipPortModule; 267 267 + default = {}; 268 268 + }; 269 269 + 270 270 + intervalSeconds = mkOption { 271 271 + type = types.ints.unsigned; 272 272 + default = 15; 273 273 + }; 274 274 + }; 275 275 + 276 276 + peers = mkOption { 277 277 + type = peersType; 278 278 + default = mapAttrsIpPort master.config.cluster.masters; 279 279 + }; 280 280 + 281 281 + port = mkOption { 282 282 + type = types.port; 283 283 + default = 9333; 284 284 + }; 285 285 + 286 286 + resumeState = mkEnableOption "resume previous state on master server"; 287 287 + 288 288 + volumePreallocate = mkEnableOption "preallocate disk space for volumes"; 289 289 + 290 290 + volumeSizeLimitMB = mkOption { 291 291 + type = types.ints.unsigned; 292 292 + default = 30000; 293 293 + }; 294 294 + 295 295 + whiteList = mkOption { 296 296 + type = with types; listOf str; 297 297 + default = []; 298 298 + }; 299 299 + }; 300 300 + }; 301 301 + 302 302 + volumeModule = cluster: volume: { 303 303 + imports = [ (commonModule cluster) ]; 304 304 + 305 305 + options = { 306 306 + configs = mkOption { 307 307 + type = with types; attrsOf attrs; 308 308 + default = {}; 309 309 + }; 310 310 + 311 311 + compactionMBps = mkOption { 312 312 + type = with types; nullOr ints.unsigned; 313 313 + default = null; 314 314 + }; 315 315 + 316 316 + cpuprofile = mkOption { 317 317 + type = types.str; 318 318 + default = ""; 319 319 + }; 320 320 + 321 321 + dataCenter = mkOption { 322 322 + type = types.str; 323 323 + default = ""; 324 324 + }; 325 325 + 326 326 + dir = mkOption { 327 327 + type = with types; listOf str; 328 328 + default = [ "/var/lib/seaweedfs/${cluster._module.args.name}/volume-${volume.config._module.args.name}" ]; 329 329 + }; 330 330 + 331 331 + fileSizeLimitMB = mkOption { 332 332 + type = types.ints.unsigned; 333 333 + default = 256; 334 334 + }; 335 335 + 336 336 + idleTimeout = mkOption{ 337 337 + type = types.ints.unsigned; 338 338 + default = 30; 339 339 + }; 340 340 + 341 341 + "images.fix.orientation" = mkEnableOption "adjustment of jpg orientation when uploading"; 342 342 + 343 343 + index = mkOption { 344 344 + type = types.enum [ 345 345 + "memory" 346 346 + "leveldb" 347 347 + "leveldbMedium" 348 348 + "leveldbLarge" 349 349 + ]; 350 350 + default = "memory"; 351 351 + }; 352 352 + 353 353 + ip = mkOption { 354 354 + type = types.str; 355 355 + default = config.networking.hostName; 356 356 + }; 357 357 + 358 358 + "ip.bind" = mkOption { 359 359 + type = types.str; 360 360 + default = "0.0.0.0"; 361 361 + }; 362 362 + 363 363 + max = mkOption { 364 364 + type = with types; listOf ints.unsigned; 365 365 + default = [ 8 ]; 366 366 + }; 367 367 + 368 368 + memprofile = mkOption { 369 369 + type = types.str; 370 370 + default = ""; 371 371 + }; 372 372 + 373 373 + metricsPort = mkOption { 374 374 + type = with types; nullOr port; 375 375 + default = null; 376 376 + }; 377 377 + 378 378 + minFreeSpacePercent = mkOption { 379 379 + type = types.ints.unsigned; 380 380 + default = 1; 381 381 + }; 382 382 + 383 383 + mserver = mkOption { 384 384 + type = peersType; 385 385 + default = mapAttrsIpPort volume.config.cluster.masters; 386 386 + }; 387 387 + 388 388 + port = mkOption { 389 389 + type = types.port; 390 390 + default = 8080; 391 391 + }; 392 392 + 393 393 + "port.public" = mkOption { 394 394 + type = with types; nullOr port; 395 395 + default = null; 396 396 + }; 397 397 + 398 398 + pprof = mkEnableOption "pprof http handlers. precludes -memprofile and -cpuprofile"; 399 399 + 400 400 + preStopSeconds = mkOption { 401 401 + type = types.int; 402 402 + default = 10; 403 403 + }; 404 404 + 405 405 + publicUrl = mkOption { 406 406 + type = types.str; 407 407 + default = ""; 408 408 + }; 409 409 + 410 410 + rack = mkOption { 411 411 + type = types.str; 412 412 + default = ""; 413 413 + }; 414 414 + 415 415 + "read.redirect" = mkOption { 416 416 + type = types.bool; 417 417 + default = true; 418 418 + }; 419 419 + 420 420 + whiteList = mkOption { 421 421 + type = with types; listOf str; 422 422 + default = []; 423 423 + }; 424 424 + }; 425 425 + }; 426 426 + 427 427 + filerModule = cluster: filer: { 428 428 + imports = [ (commonModule cluster) ]; 429 429 + 430 430 + options = { 431 431 + configs = mkOption { 432 432 + type = with types; attrsOf attrs; 433 433 + default.filer.leveldb2 = { 434 434 + enabled = true; 435 435 + dir = "/var/lib/seaweedfs/${cluster._module.args.name}/filer-${filer.config._module.args.name}/filerldb2"; 436 436 + }; 437 437 + }; 438 438 + 439 439 + collection = mkOption { 440 440 + type = types.str; 441 441 + default = ""; 442 442 + }; 443 443 + 444 444 + dataCenter = mkOption { 445 445 + type = types.str; 446 446 + default = ""; 447 447 + }; 448 448 + 449 449 + defaultReplicaPlacement = mkOption { 450 450 + type = with types; nullOr (submodule replicationModule); 451 451 + default = null; 452 452 + }; 453 453 + 454 454 + dirListLimit = mkOption { 455 455 + type = types.ints.unsigned; 456 456 + default = 100000; 457 457 + }; 458 458 + 459 459 + disableDirListing = mkEnableOption "turn off directory listing"; 460 460 + 461 461 + disableHttp = mkEnableOption "disable http request, only gRpc operations are allowed"; 462 462 + 463 463 + encryptVolumeData = mkEnableOption "encrypt data on volume servers"; 464 464 + 465 465 + ip = mkOption { 466 466 + type = types.str; 467 467 + default = config.networking.hostName; 468 468 + }; 469 469 + 470 470 + "ip.bind" = mkOption { 471 471 + type = types.str; 472 472 + default = "0.0.0.0"; 473 473 + }; 474 474 + 475 475 + master = mkOption { 476 476 + type = peersType; 477 477 + default = mapAttrsIpPort filer.config.cluster.masters; 478 478 + }; 479 479 + 480 480 + maxMB = mkOption { 481 481 + type = types.ints.unsigned; 482 482 + default = 32; 483 483 + }; 484 484 + 485 485 + metricsPort = mkOption { 486 486 + type = with types; nullOr port; 487 487 + default = null; 488 488 + }; 489 489 + 490 490 + peers = mkOption { 491 491 + type = peersType; 492 492 + default = mapAttrsIpPort filer.config.cluster.filers; 493 493 + }; 494 494 + 495 495 + port = mkOption { 496 496 + type = types.port; 497 497 + default = 8888; 498 498 + }; 499 499 + 500 500 + "port.readonly" = mkOption { 501 501 + type = with types; nullOr port; 502 502 + default = null; 503 503 + }; 504 504 + 505 505 + rack = mkOption { 506 506 + type = types.str; 507 507 + default = ""; 508 508 + }; 509 509 + 510 510 + s3 = { 511 511 + enable = mkEnableOption "whether to start S3 gateway"; 512 512 + 513 513 + "cert.file" = mkOption { 514 514 + type = types.path; 515 515 + default = ""; 516 516 + }; 517 517 + 518 518 + config = mkOption { 519 519 + type = types.path; 520 520 + default = ""; 521 521 + }; 522 522 + 523 523 + domainName = mkOption { 524 524 + type = with types; listOf str; 525 525 + default = []; 526 526 + }; 527 527 + 528 528 + "key.file" = mkOption { 529 529 + type = types.path; 530 530 + default = ""; 531 531 + }; 532 532 + 533 533 + port = mkOption { 534 534 + type = types.port; 535 535 + default = 8333; 536 536 + }; 537 537 + }; 538 538 + }; 539 539 + }; 540 540 + 541 541 + webdavModule = cluster: webdav: { 542 542 + imports = [ (commonModule cluster) ]; 543 543 + 544 544 + options = { 545 545 + cacheCapacityMB = mkOption { 546 546 + type = types.int; 547 547 + default = 1000; 548 548 + }; 549 549 + 550 550 + cacheDir = mkOption { 551 551 + type = types.str; 552 552 + default = "."; 553 553 + }; 554 554 + 555 555 + collection = mkOption { 556 556 + type = types.str; 557 557 + default = ""; 558 558 + }; 559 559 + 560 560 + filer = mkOption { 561 561 + type = types.submodule ipPortModule; 562 562 + default = { 563 563 + ip = "127.0.0.1"; 564 564 + port = 8888; 565 565 + }; 566 566 + }; 567 567 + 568 568 + port = mkOption { 569 569 + type = types.port; 570 570 + default = 7333; 571 571 + }; 572 572 + }; 573 573 + }; 574 574 + 575 575 + instanceModule = instance: { 576 576 + options = { 577 577 + cluster = mkOption { 578 578 + type = types.submodule clusterModule; 579 579 + internal = true; 580 580 + }; 581 581 + 582 582 + command = mkOption { 583 583 + type = types.enum [ 584 584 + "server" 585 585 + "master" 586 586 + "volume" 587 587 + "mount" 588 588 + "filer" 589 589 + "filer.replicate" 590 590 + "filer.sync" 591 591 + "s3" 592 592 + "msgBroker" 593 593 + "watch" 594 594 + "webdav" 595 595 + ]; 596 596 + }; 597 597 + 598 598 + logArgs = mkOption { 599 599 + type = with types; listOf str; 600 600 + default = []; 601 601 + }; 602 602 + 603 603 + args = mkOption { 604 604 + type = with types; listOf str; 605 605 + default = []; 606 606 + }; 607 607 + 608 608 + configs = mkOption { 609 609 + type = with types; attrsOf attrs; 610 610 + default = {}; 611 611 + }; 612 612 + 613 613 + package = mkOption { 614 614 + type = types.package; 615 615 + default = instance.config.cluster.package; 616 616 + }; 617 617 + 618 618 + systemdService = mkOption { 619 619 + type = types.attrs; 620 620 + default = {}; 621 621 + }; 622 622 + }; 623 623 + 624 624 + config = { 625 625 + logArgs = [ "-logtostderr" ]; 626 626 + 627 627 + systemdService.path = optional (instance.config.command == "mount") pkgs.fuse; 628 628 + }; 629 629 + }; 630 630 + 631 631 + replicationModule = replication: { 632 632 + options = { 633 633 + dataCenter = mkOption { 634 634 + type = types.ints.between 0 9; 635 635 + default = 0; 636 636 + }; 637 637 + 638 638 + rack = mkOption { 639 639 + type = types.ints.between 0 9; 640 640 + default = 0; 641 641 + }; 642 642 + 643 643 + server = mkOption { 644 644 + type = types.ints.between 0 9; 645 645 + default = 0; 646 646 + }; 647 647 + 648 648 + code = mkOption { 649 649 + readOnly = true; 650 650 + internal = true; 651 651 + type = types.str; 652 652 + default = with replication.config; "${toString dataCenter}${toString rack}${toString server}"; 653 653 + }; 654 654 + }; 655 655 + }; 656 656 + 657 657 + peersType = with types; listOf (submodule ipPortModule); 658 658 + 659 659 + ipPortModule = ipPort: { 660 660 + options = { 661 661 + ip = mkOption { 662 662 + type = types.str; 663 663 + }; 664 664 + 665 665 + port = mkOption { 666 666 + type = types.port; 667 667 + }; 668 668 + 669 669 + text = mkOption { 670 670 + internal = true; 671 671 + readOnly = true; 672 672 + type = types.str; 673 673 + default = with ipPort.config; "${ip}:${toString port}"; 674 674 + }; 675 675 + }; 676 676 + }; 677 677 + 678 678 + mapAttrsIpPort = attrs: mapAttrsToList (name: value: { inherit (value) ip port; }) attrs; 679 679 + 680 680 + toTOML = with generators; toINI { 681 681 + mkKeyValue = mkKeyValueDefault { 682 682 + mkValueString = v: 683 683 + if isString v 684 684 + then ( 685 685 + if hasInfix "\n" v 686 686 + then '' 687 687 + """ 688 688 + ${removeSuffix "\n" v} 689 689 + """ 690 690 + '' 691 691 + else ''"${v}"'' 692 692 + ) 693 693 + else mkValueStringDefault {} v; 694 694 + } "="; 695 695 + }; 696 696 + 697 697 + flattenAttrs = separator: attrs: let 698 698 + /* 699 699 + attrs = { 700 700 + a = { 701 701 + m1 = {}; 702 702 + m2 = {}; 703 703 + }; 704 704 + b = { 705 705 + m1 = {}; 706 706 + }; 707 707 + } 708 708 + */ 709 709 + 710 710 + /* 711 711 + step1 = { 712 712 + a = [ 713 713 + { name = "a-m1"; value = {}; } 714 714 + { name = "a-m2"; value = {}; } 715 715 + ]; 716 716 + b = [ 717 717 + { name = "b-m1"; value = {}; } 718 718 + ]; 719 719 + }; 720 720 + */ 721 721 + step1 = mapAttrs (outerName: outerValues: 722 722 + mapAttrsToList (innerName: innerValues: nameValuePair 723 723 + "${outerName}${separator}${innerName}" 724 724 + innerValues 725 725 + ) outerValues 726 726 + ) attrs; 727 727 + 728 728 + /* 729 729 + step2 = [ 730 730 + [ 731 731 + { name = "a-m1"; value = {}; } 732 732 + { name = "a-m2"; value = {}; } 733 733 + ] 734 734 + [ 735 735 + { name = "b-m1"; value = {}; } 736 736 + ] 737 737 + ]; 738 738 + */ 739 739 + step2 = mapAttrsToList (name: value: value) step1; 740 740 + 741 741 + /* 742 742 + step3 = [ 743 743 + { name = "a-m1"; value = {}; } 744 744 + { name = "a-m2"; value = {}; } 745 745 + { name = "b-m1"; value = {}; } 746 746 + ]; 747 747 + */ 748 748 + step3 = flatten step2; 749 749 + in 750 750 + /* 751 751 + { 752 752 + a-m1 = {}; 753 753 + a-m2 = {}; 754 754 + b-m1 = {}; 755 755 + }; 756 756 + */ 757 757 + builtins.listToAttrs step3; 758 758 + in { 759 759 + options.modules.seaweedfs = { 760 760 + clusters = mkOption { 761 761 + type = with types; attrsOf (submodule clusterModule); 762 762 + default = {}; 763 763 + description = "SeaweedFS clusters"; 764 764 + }; 765 765 + }; 766 766 + 767 767 + config = { 768 768 + systemd.services = mapAttrs' 769 769 + (name: instance: nameValuePair "seaweedfs-${name}" instance) 770 770 + (flattenAttrs "-" ( 771 771 + mapAttrs (clusterName: cluster: 772 772 + mapAttrs (instanceName: instance: with instance; recursiveUpdate systemdService rec { 773 773 + description = "SeaweedFS ${clusterName} ${instanceName}"; 774 774 + wants = [ "network.target" ]; 775 775 + after = wants; 776 776 + wantedBy = [ "multi-user.target" ]; 777 777 + preStart = with serviceConfig; '' 778 778 + ${ 779 779 + let securityFile = config.environment.etc."seaweedfs/${clusterName}/security.toml"; 780 780 + in optionalString securityFile.enable "ln -s /etc/${securityFile.target} ${WorkingDirectory}/" 781 781 + } 782 782 + 783 783 + # TODO replace find usage with statically known condition 784 784 + find -L /etc/${ConfigurationDirectory} -type f -exec ln -s '{}' ${WorkingDirectory}/ \; 785 785 + 786 786 + ${optionalString (systemdService ? preStart) systemdService.preStart} 787 787 + ''; 788 788 + serviceConfig = rec { 789 789 + ExecStart = "${package}/bin/weed ${concatStringsSep " " logArgs} ${command} ${concatStringsSep " " args}"; 790 790 + Restart = "on-failure"; 791 791 + Type = "exec"; 792 792 + ConfigurationDirectory = "seaweedfs/${clusterName}/${instanceName}"; 793 793 + RuntimeDirectory = ConfigurationDirectory; 794 794 + RuntimeDirectoryPreserve = "restart"; 795 795 + WorkingDirectory = "/run/${RuntimeDirectory}"; 796 796 + }; 797 797 + }) cluster.instances 798 798 + ) cfg.clusters 799 799 + )); 800 800 + 801 801 + environment.etc = 802 802 + (mapAttrs' (name: cluster: 803 803 + let file = "seaweedfs/${name}/security.toml"; 804 804 + in nameValuePair file { 805 805 + enable = config.environment.etc.${file}.text != ""; 806 806 + text = with cluster.security.grpc; toTOML ( 807 807 + (if ca == null then {} else { grpc.ca = ca; }) // 808 808 + (if master == null then {} else { "grpc.master" = { inherit (master) cert key; }; }) // 809 809 + (if volume == null then {} else { "grpc.volume" = { inherit (volume) cert key; }; }) // 810 810 + (if filer == null then {} else { "grpc.filer" = { inherit (filer) cert key; }; }) // 811 811 + (if client == null then {} else { "grpc.client" = { inherit (client) cert key; }; }) // 812 812 + (if msgBroker == null then {} else { "grpc.msg_broker" = { inherit (msgBroker) cert key; }; }) 813 813 + ); 814 814 + } 815 815 + ) cfg.clusters) // 816 816 + (mapAttrs' 817 817 + (name: config: nameValuePair 818 818 + "seaweedfs/${name}.toml" 819 819 + { text = toTOML config; } 820 820 + ) 821 821 + (flattenAttrs "/" ( 822 822 + mapAttrs (clusterName: cluster: 823 823 + flattenAttrs "/" ( 824 824 + mapAttrs 825 825 + (instanceName: instance: instance.configs) 826 826 + cluster.instances 827 827 + ) 828 828 + ) cfg.clusters 829 829 + )) 830 830 + ); 831 831 + 832 832 + networking.firewall.allowedTCPPorts = let 833 833 + modulesToPorts = extraPorts: mapAttrsToList (name: module: 834 834 + with module; 835 835 + optionals openFirewall ( 836 836 + [ port (port + 10000) ] ++ 837 837 + (filter (p: p != null) (extraPorts module)) 838 838 + ) 839 839 + ); 840 840 + in flatten (mapAttrsToList (clusterName: cluster: 841 841 + modulesToPorts 842 842 + (master: []) 843 843 + cluster.masters ++ 844 844 + 845 845 + modulesToPorts 846 846 + (volume: with volume; [ metricsPort volume."port.public" ]) 847 847 + cluster.volumes ++ 848 848 + 849 849 + modulesToPorts 850 850 + (filer: with filer; [ metricsPort filer."port.readonly" s3.port]) 851 851 + cluster.filers ++ 852 852 + 853 853 + modulesToPorts 854 854 + (webdav: []) 855 855 + cluster.webdavs 856 856 + ) cfg.clusters); 857 857 + }; 858 858 + }

secrets/build-token.age

This is a binary file and will not be displayed.

secrets/garage-admin-token.age

This is a binary file and will not be displayed.

secrets/garage-metrics-token.age

This is a binary file and will not be displayed.

secrets/garage-rpc-secret.age

This is a binary file and will not be displayed.

secrets/headscale-authkey.age

This is a binary file and will not be displayed.

+11

secrets/headscale-oidc-key.path

··· 1 1 + age-encryption.org/v1 2 2 + -> ssh-ed25519 i9wBeA Gtd2ftibBF2166KCpJiJt1W9kbwrTybKx4O561e7oQw 3 3 + 3ci7PJxYqoglIml6YiyJrffteIZN0aUWDN5z4sogcfs 4 4 + -> ssh-ed25519 du7llw zxlkrcUyO4q4CsRAYMr8vp7LzdK2E/O9fQrCi6TxYXs 5 5 + q3xdu3He3SXg29mKS8Fv3YWt2CkENucPtPYtXmw+dx4 6 6 + -> ssh-ed25519 YYzA7Q VQFwGeDchwrEiI3mPsNK1yGQKupTnh5jLxLhVlPbbzU 7 7 + tsPNihdGL/2VumVXuOKRnfPw7LBlr5xKOODAKY5ROyc 8 8 + -> ssh-ed25519 3RWqPQ YrxOoecRxIrNHq93LvFMgk2h83a0Z3UtsYeXKeQd1xo 9 9 + lUM0BU8KTBjR13TGQj88n5BA4b9JAjZALfu9fTSmpu8 10 10 + --- 8WCStyJ9IerfsQD3pL4ag8tnmt7hBXZxR+aCfv4BjS0 11 11 + 7�E�rY�)�GI���G�*K�b����b+��>�m�{����K�!��m�����J:���{��2/��

+9 -3

secrets/secrets.nix

··· 2 2 regent = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJ0pU82lV9dSjkgYbdh9utZ5CDM2dPN70S5fBqN1m3Pb regent@orobas.local"; 3 3 users = [ regent ]; 4 4 5 5 - valefar = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJlXq2lSfiWwRwIxsxhffW5FDGmjt0QKYN+BaikmRR71"; 6 6 - buer = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMVhjwDcO8eleSoR8a37ZGGPvkHEgV+c8SYcy07SayPB root@nixos"; 7 7 - systems = [ valefar buer ]; 5 5 + valefar = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIPu8CVFsnUxhvABEqv4+EBBOL8tva5HJFoV3hElAlD0"; 6 6 + buer = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMVhjwDcO8eleSoR8a37ZGGPvkHEgV+c8SYcy07SayPB"; 7 7 + focalor = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIA518oTmTp5VG60/dBrLu7rlV1hh8muhMattoiGfmrei"; 8 8 + baal = "AAAAC3NzaC1lZDI1NTE5AAAAILdjRWunQNFeTTdnw4GaqL9G34oo4QuvrRE/jvxLdK1C"; 9 9 + systems = [ valefar buer focalor]; 8 10 in 9 11 { 10 12 #"secret1.age".publicKeys = [ user1 system1 ]; 11 13 "build-token.age".publicKeys = users ++ systems; 14 14 + 12 15 "garage-rpc-secret.age".publicKeys = users ++ systems; 13 16 "garage-admin-token.age".publicKeys = users ++ systems; 14 17 "garage-metrics-token.age".publicKeys = users ++ systems; 18 18 + 19 19 + "headscale-authkey.age".publicKeys = users ++ systems; 20 20 + "headscale-oidc-key.path".publicKeys = users ++ systems; 15 21 }