Refactor.
This commit is contained in:
parent
69088478f0
commit
667f337363
14 changed files with 173 additions and 164 deletions
|
@ -1,10 +0,0 @@
|
|||
{
|
||||
# Passwordless sudo
|
||||
security.sudo.wheelNeedsPassword = false;
|
||||
|
||||
# Enable all terminfo (for ghostty)
|
||||
environment.enableAllTerminfo = true;
|
||||
|
||||
# Enable SSH server
|
||||
services.openssh.enable = true;
|
||||
}
|
|
@ -1,23 +0,0 @@
|
|||
{
|
||||
# Define a user account.
|
||||
users.users.docker = {
|
||||
isNormalUser = true;
|
||||
linger = true;
|
||||
extraGroups = [
|
||||
"wheel"
|
||||
"docker"
|
||||
];
|
||||
openssh.authorizedKeys.keys = [
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIETPyuxUVEmYyEW6PVC6BXqkhULHd/RvMm8fMbYhjTMV fern@muskduck"
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKzW4epTmK01kGVXcuAXUNJQPltnogf4uab9FA5m8S3n fern@pardalote"
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBEJYq1fMxVOzCMfE/td6DtWS8nUk76U9seYD3Z9RYAz u0_a399@fairywren"
|
||||
"sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIMoJvPcUJDVVzO4dHROCFNlgJdDZSP5xyPx2s40zcx5QAAAABHNzaDo= YubiKey5NFC"
|
||||
];
|
||||
};
|
||||
|
||||
# Auto login
|
||||
services.getty.autologinUser = "docker";
|
||||
|
||||
# Enable docker
|
||||
virtualisation.docker.enable = true;
|
||||
}
|
164
flake.nix
164
flake.nix
|
@ -6,11 +6,12 @@
|
|||
lanzaboote.url = "github:nix-community/lanzaboote"; # Secure boot.
|
||||
nixos-hardware.url = "github:NixOS/nixos-hardware"; # Hardware specific config.
|
||||
sops-nix.url = "github:Mic92/sops-nix"; # Secrets management.
|
||||
# Secrets repo.
|
||||
secrets = {
|
||||
url = "git+ssh://git@docker.local:222/fern/secrets?ref=main";
|
||||
flake = false;
|
||||
}; # Secrets repo.
|
||||
|
||||
};
|
||||
|
||||
# Updated packages.
|
||||
fluffychat2.url = "github:NixOS/nixpkgs?ref=pull/419632/head"; # FluffyChat 2.0.0
|
||||
feishin0_17.url = "github:NixOS/nixpkgs?ref=pull/414929/head"; # Feishin 0.17.0
|
||||
|
@ -27,97 +28,88 @@
|
|||
feishin0_17,
|
||||
...
|
||||
}:
|
||||
let
|
||||
mkHost =
|
||||
with nixpkgs.lib;
|
||||
{
|
||||
hostname,
|
||||
suite,
|
||||
platform,
|
||||
user ? "fern",
|
||||
extraModules ? [ ],
|
||||
}:
|
||||
nixosSystem rec {
|
||||
system = platform;
|
||||
|
||||
specialArgs = {
|
||||
inherit user;
|
||||
secrets = builtins.toString inputs.secrets;
|
||||
fluffychat2 = import fluffychat2 { inherit system; };
|
||||
feishin0_17 = import feishin0_17 { inherit system; };
|
||||
};
|
||||
|
||||
modules = [
|
||||
./suites/common.nix
|
||||
./suites/${suite}.nix
|
||||
./hosts/${suite}/${hostname}.nix
|
||||
{ networking.hostName = hostname; }
|
||||
] ++ extraModules;
|
||||
};
|
||||
in
|
||||
{
|
||||
# ThinkPad T480
|
||||
nixosConfigurations.muskduck = nixpkgs.lib.nixosSystem rec {
|
||||
system = "x86_64-linux";
|
||||
|
||||
specialArgs = {
|
||||
fluffychat2 = import fluffychat2 { inherit system; };
|
||||
feishin0_17 = import feishin0_17 { inherit system; };
|
||||
nixosConfigurations = {
|
||||
# Laptops.
|
||||
muskduck = mkHost {
|
||||
hostname = "muskduck";
|
||||
suite = "laptop";
|
||||
platform = "x86_64-linux";
|
||||
extraModules = [
|
||||
lanzaboote.nixosModules.lanzaboote
|
||||
nixos-hardware.nixosModules.lenovo-thinkpad-t480
|
||||
];
|
||||
};
|
||||
|
||||
modules = [
|
||||
{ networking.hostName = "muskduck"; }
|
||||
|
||||
lanzaboote.nixosModules.lanzaboote
|
||||
nixos-hardware.nixosModules.lenovo-thinkpad-t480
|
||||
|
||||
./configuration/common.nix
|
||||
./configuration/desktop.nix
|
||||
|
||||
./hosts/muskduck.nix # Include the results of the hardware scan.
|
||||
];
|
||||
};
|
||||
|
||||
### Proxmox Guests ###
|
||||
|
||||
nixosConfigurations.vm-minecraft = nixpkgs.lib.nixosSystem {
|
||||
system = "x86_64-linux";
|
||||
|
||||
modules = [
|
||||
{ networking.hostName = "minecraft"; }
|
||||
|
||||
./configuration/common.nix
|
||||
|
||||
./configuration/server/common.nix
|
||||
./configuration/server/vm.nix
|
||||
./configuration/server/docker.nix
|
||||
|
||||
./hosts/vm-minecraft.nix # Include the results of the hardware scan.
|
||||
];
|
||||
};
|
||||
|
||||
nixosConfigurations.vm-docker = nixpkgs.lib.nixosSystem {
|
||||
system = "x86_64-linux";
|
||||
|
||||
modules = [
|
||||
{ networking.hostName = "docker"; }
|
||||
|
||||
./configuration/common.nix
|
||||
|
||||
./configuration/server/common.nix
|
||||
./configuration/server/vm.nix
|
||||
./configuration/server/docker.nix
|
||||
|
||||
./hosts/vm-docker.nix # Include the results of the hardware scan.
|
||||
];
|
||||
};
|
||||
|
||||
nixosConfigurations.lxc-technitium = nixpkgs.lib.nixosSystem {
|
||||
system = "x86_64-linux";
|
||||
|
||||
modules = [
|
||||
{ networking.hostName = "technitium"; }
|
||||
|
||||
./configuration/common.nix
|
||||
|
||||
./configuration/server/common.nix
|
||||
./configuration/server/containers/common.nix
|
||||
|
||||
./configuration/server/containers/technitium.nix
|
||||
];
|
||||
};
|
||||
|
||||
nixosConfigurations.lxc-firefox-syncserver = nixpkgs.lib.nixosSystem {
|
||||
system = "x86_64-linux";
|
||||
|
||||
specialArgs = {
|
||||
secrets = builtins.toString inputs.secrets;
|
||||
# Servers.
|
||||
weebill = mkHost {
|
||||
hostname = "weebill";
|
||||
suite = "server";
|
||||
platform = "aarch64-linux";
|
||||
user = "docker";
|
||||
extraModules = [
|
||||
nixos-hardware.nixosModules.raspberry-pi-4
|
||||
];
|
||||
};
|
||||
|
||||
modules = [
|
||||
sops-nix.nixosModules.sops
|
||||
|
||||
{ networking.hostName = "firefox-syncserver"; }
|
||||
|
||||
./configuration/common.nix
|
||||
# Virtual machines.
|
||||
vm-docker = mkHost {
|
||||
hostname = "docker";
|
||||
suite = "vm";
|
||||
user = "docker";
|
||||
platform = "x86_64-linux";
|
||||
};
|
||||
|
||||
./configuration/server/common.nix
|
||||
./configuration/server/containers/common.nix
|
||||
vm-minecraft = mkHost {
|
||||
hostname = "minecraft";
|
||||
suite = "vm";
|
||||
user = "docker";
|
||||
platform = "x86_64-linux";
|
||||
};
|
||||
|
||||
./configuration/server/containers/firefox-syncserver.nix
|
||||
];
|
||||
# LXC containers.
|
||||
lxc-technitium = mkHost {
|
||||
hostname = "technitium";
|
||||
suite = "lxc";
|
||||
platform = "x86_64-linux";
|
||||
};
|
||||
|
||||
lxc-firefox-syncserver = mkHost {
|
||||
hostname = "firefox-syncserver";
|
||||
suite = "lxc";
|
||||
platform = "x86_64-linux";
|
||||
extraModules = [
|
||||
sops-nix.nixosModules.sops
|
||||
];
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
|
@ -1,24 +1,12 @@
|
|||
{
|
||||
config,
|
||||
lib,
|
||||
modulesPath,
|
||||
...
|
||||
}:
|
||||
|
||||
{
|
||||
imports = [
|
||||
(modulesPath + "/installer/scan/not-detected.nix")
|
||||
];
|
||||
|
||||
boot.initrd.availableKernelModules = [
|
||||
"xhci_pci"
|
||||
"nvme"
|
||||
"usb_storage"
|
||||
"sd_mod"
|
||||
];
|
||||
boot.initrd.kernelModules = [ ];
|
||||
|
||||
boot.kernelModules = [ "kvm-intel" ];
|
||||
boot.extraModulePackages = [ ];
|
||||
|
||||
fileSystems."/" = {
|
||||
device = "/dev/disk/by-uuid/63d79656-aa5b-466a-b369-be5eac3f51ab";
|
||||
|
@ -37,10 +25,5 @@
|
|||
];
|
||||
};
|
||||
|
||||
swapDevices = [ ];
|
||||
|
||||
networking.useDHCP = lib.mkDefault true;
|
||||
|
||||
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
|
||||
hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
|
||||
hardware.cpu.intel.updateMicrocode = true;
|
||||
}
|
|
@ -7,7 +7,7 @@
|
|||
secrets."firefox_syncserver/sync_master_secret" = {};
|
||||
};
|
||||
|
||||
# syncserver-rs service.
|
||||
# Enable Firefox sync service.
|
||||
services.mysql.package = pkgs.mariadb;
|
||||
|
||||
services.firefox-syncserver = {
|
||||
|
@ -22,5 +22,6 @@
|
|||
};
|
||||
};
|
||||
|
||||
# Open Firefox sync service port.
|
||||
networking.firewall.allowedTCPPorts = [ 5000 ];
|
||||
}
|
|
@ -1,4 +1,5 @@
|
|||
{
|
||||
# Enable Technitium DNS server.
|
||||
services.technitium-dns-server = {
|
||||
enable = true;
|
||||
openFirewall = true;
|
26
hosts/server/weebill.nix
Normal file
26
hosts/server/weebill.nix
Normal file
|
@ -0,0 +1,26 @@
|
|||
{ pkgs, ... }:
|
||||
{
|
||||
boot = {
|
||||
kernelPackages = pkgs.linuxKernel.packages.linux_rpi4;
|
||||
initrd.availableKernelModules = [
|
||||
"xhci_pci"
|
||||
"usbhid"
|
||||
"usb_storage"
|
||||
];
|
||||
loader = {
|
||||
grub.enable = false;
|
||||
generic-extlinux-compatible.enable = true;
|
||||
};
|
||||
};
|
||||
|
||||
fileSystems = {
|
||||
"/" = {
|
||||
device = "/dev/disk/by-label/NIXOS_SD";
|
||||
fsType = "ext4";
|
||||
options = [ "noatime" ];
|
||||
};
|
||||
};
|
||||
|
||||
# Open ports for DHCP server.
|
||||
networking.firewall.allowedUDPPorts = [ 53 67 ];
|
||||
}
|
|
@ -1,4 +1,10 @@
|
|||
{ pkgs, ... }:
|
||||
{
|
||||
pkgs,
|
||||
lib,
|
||||
user,
|
||||
...
|
||||
}:
|
||||
with lib;
|
||||
{
|
||||
# NixOS version.
|
||||
system.stateVersion = "25.05";
|
||||
|
@ -12,6 +18,9 @@
|
|||
# Allow unfree packages.
|
||||
nixpkgs.config.allowUnfree = true;
|
||||
|
||||
# Enable redistributable firmware.
|
||||
hardware.enableRedistributableFirmware = true;
|
||||
|
||||
# Set time zone.
|
||||
time.timeZone = "Australia/Perth";
|
||||
|
||||
|
@ -36,6 +45,19 @@
|
|||
variant = "";
|
||||
};
|
||||
|
||||
# Enable networking.
|
||||
networking.networkmanager.enable = true;
|
||||
|
||||
# Define a user account.
|
||||
users.users.${user} = {
|
||||
isNormalUser = true;
|
||||
description = mkIf (user == "fern") "Fern Garden";
|
||||
extraGroups = [
|
||||
"wheel"
|
||||
"networkmanager"
|
||||
];
|
||||
};
|
||||
|
||||
# Use fish shell
|
||||
programs.fish = {
|
||||
enable = true;
|
|
@ -5,14 +5,14 @@
|
|||
fluffychat2,
|
||||
...
|
||||
}:
|
||||
|
||||
with lib;
|
||||
{
|
||||
# Configure the bootloader.
|
||||
boot = {
|
||||
# Enable secure boot.
|
||||
bootspec.enable = true;
|
||||
initrd.systemd.enable = true;
|
||||
loader.systemd-boot.enable = lib.mkForce false;
|
||||
loader.systemd-boot.enable = mkForce false;
|
||||
loader.efi.canTouchEfiVariables = true;
|
||||
|
||||
lanzaboote = {
|
||||
|
@ -43,19 +43,6 @@
|
|||
# Enable smart card support (for YubiKey).
|
||||
services.pcscd.enable = true;
|
||||
|
||||
# Enable networking.
|
||||
networking.networkmanager.enable = true;
|
||||
|
||||
# Define a user account.
|
||||
users.users.fern = {
|
||||
isNormalUser = true;
|
||||
description = "Fern Garden";
|
||||
extraGroups = [
|
||||
"networkmanager"
|
||||
"wheel"
|
||||
];
|
||||
};
|
||||
|
||||
# Encrypt user's home with fscrypt
|
||||
security.pam.enableFscrypt = true;
|
||||
|
||||
|
@ -178,7 +165,7 @@
|
|||
};
|
||||
|
||||
# Enable CPU frequency scaling management.
|
||||
services.power-profiles-daemon.enable = lib.mkForce false; # enabled by gnome
|
||||
services.power-profiles-daemon.enable = mkForce false; # enabled by gnome
|
||||
services.tlp.enable = lib.mkForce false; # enabled by nixos-hardware
|
||||
services.auto-cpufreq.enable = true;
|
||||
}
|
||||
}
|
|
@ -1,8 +1,10 @@
|
|||
{ modulesPath, ... }:
|
||||
{
|
||||
# Import Proxmox LXC configuration.
|
||||
modulesPath,
|
||||
...
|
||||
}:
|
||||
{
|
||||
imports = [
|
||||
(modulesPath + "/virtualisation/proxmox-lxc.nix")
|
||||
./server.nix
|
||||
];
|
||||
}
|
||||
|
||||
}
|
23
suites/server.nix
Normal file
23
suites/server.nix
Normal file
|
@ -0,0 +1,23 @@
|
|||
{ user, lib, ... }:
|
||||
with lib;
|
||||
{
|
||||
# Passwordless sudo
|
||||
security.sudo.wheelNeedsPassword = false;
|
||||
|
||||
# Enable all terminfo (for ghostty)
|
||||
environment.enableAllTerminfo = true;
|
||||
|
||||
# Enable SSH server
|
||||
services.openssh.enable = true;
|
||||
|
||||
users.users.${user}.openssh.authorizedKeys.keys = [
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIETPyuxUVEmYyEW6PVC6BXqkhULHd/RvMm8fMbYhjTMV fern@muskduck"
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKzW4epTmK01kGVXcuAXUNJQPltnogf4uab9FA5m8S3n fern@pardalote"
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBEJYq1fMxVOzCMfE/td6DtWS8nUk76U9seYD3Z9RYAz u0_a399@fairywren"
|
||||
"sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIMoJvPcUJDVVzO4dHROCFNlgJdDZSP5xyPx2s40zcx5QAAAABHNzaDo= YubiKey5NFC"
|
||||
];
|
||||
|
||||
# Enable docker.
|
||||
virtualisation.docker.enable = mkIf (user == "docker") true;
|
||||
users.users.${user}.extraGroups = mkIf (user == "docker") [ "docker" ];
|
||||
}
|
|
@ -1,8 +1,13 @@
|
|||
{ lib, modulesPath, ... }:
|
||||
{
|
||||
# Import qemu guest configuration.
|
||||
modulesPath,
|
||||
lib,
|
||||
...
|
||||
}:
|
||||
with lib;
|
||||
{
|
||||
imports = [
|
||||
(modulesPath + "/profiles/qemu-guest.nix")
|
||||
./server.nix
|
||||
];
|
||||
|
||||
# Load kernel modules.
|
||||
|
@ -17,7 +22,7 @@
|
|||
boot.kernelModules = [ "kvm-intel" ];
|
||||
|
||||
# Enable DHCP.
|
||||
networking.useDHCP = lib.mkDefault true;
|
||||
networking.useDHCP = mkDefault true;
|
||||
|
||||
# Configure the bootloader.
|
||||
boot.loader.grub = {
|
Loading…
Add table
Add a link
Reference in a new issue