fern/flock
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Refactor.

Browse source
This commit is contained in:
Fern Garden 2025-07-08 22:26:33 +08:00
parent 69088478f0
commit 667f337363
14 changed files with 173 additions and 164 deletions
Download patch file Download diff file Expand all files Collapse all files

10
configuration/server/common.nix
View file

@ -1,10 +0,0 @@
{
# Passwordless sudo
security.sudo.wheelNeedsPassword = false;
# Enable all terminfo (for ghostty)
environment.enableAllTerminfo = true;
# Enable SSH server
services.openssh.enable = true;
}

23
configuration/server/docker.nix
View file

@ -1,23 +0,0 @@
{
# Define a user account.
users.users.docker = {
isNormalUser = true;
linger = true;
extraGroups = [
"wheel"
"docker"
];
openssh.authorizedKeys.keys = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIETPyuxUVEmYyEW6PVC6BXqkhULHd/RvMm8fMbYhjTMV fern@muskduck"
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKzW4epTmK01kGVXcuAXUNJQPltnogf4uab9FA5m8S3n fern@pardalote"
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBEJYq1fMxVOzCMfE/td6DtWS8nUk76U9seYD3Z9RYAz u0_a399@fairywren"
"sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIMoJvPcUJDVVzO4dHROCFNlgJdDZSP5xyPx2s40zcx5QAAAABHNzaDo= YubiKey5NFC"
];
};
# Auto login
services.getty.autologinUser = "docker";
# Enable docker
virtualisation.docker.enable = true;
}

160
flake.nix
View file

@ -6,10 +6,11 @@
lanzaboote.url = "github:nix-community/lanzaboote"; # Secure boot.
nixos-hardware.url = "github:NixOS/nixos-hardware"; # Hardware specific config.
sops-nix.url = "github:Mic92/sops-nix"; # Secrets management.
# Secrets repo.
secrets = {
url = "git+ssh://git@docker.local:222/fern/secrets?ref=main";
flake = false;
}; # Secrets repo.
};
# Updated packages.
fluffychat2.url = "github:NixOS/nixpkgs?ref=pull/419632/head"; # FluffyChat 2.0.0
@ -27,97 +28,88 @@
feishin0_17,
...
}:
let
mkHost =
with nixpkgs.lib;
{
hostname,
suite,
platform,
user ? "fern",
extraModules ? [ ],
}:
nixosSystem rec {
system = platform;
specialArgs = {
inherit user;
secrets = builtins.toString inputs.secrets;
fluffychat2 = import fluffychat2 { inherit system; };
feishin0_17 = import feishin0_17 { inherit system; };
};
modules = [
./suites/common.nix
./suites/${suite}.nix
./hosts/${suite}/${hostname}.nix
{ networking.hostName = hostname; }
] ++ extraModules;
};
in
{
# ThinkPad T480
nixosConfigurations.muskduck = nixpkgs.lib.nixosSystem rec {
system = "x86_64-linux";
specialArgs = {
fluffychat2 = import fluffychat2 { inherit system; };
feishin0_17 = import feishin0_17 { inherit system; };
nixosConfigurations = {
# Laptops.
muskduck = mkHost {
hostname = "muskduck";
suite = "laptop";
platform = "x86_64-linux";
extraModules = [
lanzaboote.nixosModules.lanzaboote
nixos-hardware.nixosModules.lenovo-thinkpad-t480
];
};
modules = [
{ networking.hostName = "muskduck"; }
lanzaboote.nixosModules.lanzaboote
nixos-hardware.nixosModules.lenovo-thinkpad-t480
./configuration/common.nix
./configuration/desktop.nix
./hosts/muskduck.nix # Include the results of the hardware scan.
];
};
### Proxmox Guests ###
nixosConfigurations.vm-minecraft = nixpkgs.lib.nixosSystem {
system = "x86_64-linux";
modules = [
{ networking.hostName = "minecraft"; }
./configuration/common.nix
./configuration/server/common.nix
./configuration/server/vm.nix
./configuration/server/docker.nix
./hosts/vm-minecraft.nix # Include the results of the hardware scan.
];
};
nixosConfigurations.vm-docker = nixpkgs.lib.nixosSystem {
system = "x86_64-linux";
modules = [
{ networking.hostName = "docker"; }
./configuration/common.nix
./configuration/server/common.nix
./configuration/server/vm.nix
./configuration/server/docker.nix
./hosts/vm-docker.nix # Include the results of the hardware scan.
];
};
nixosConfigurations.lxc-technitium = nixpkgs.lib.nixosSystem {
system = "x86_64-linux";
modules = [
{ networking.hostName = "technitium"; }
./configuration/common.nix
./configuration/server/common.nix
./configuration/server/containers/common.nix
./configuration/server/containers/technitium.nix
];
};
nixosConfigurations.lxc-firefox-syncserver = nixpkgs.lib.nixosSystem {
system = "x86_64-linux";
specialArgs = {
secrets = builtins.toString inputs.secrets;
# Servers.
weebill = mkHost {
hostname = "weebill";
suite = "server";
platform = "aarch64-linux";
user = "docker";
extraModules = [
nixos-hardware.nixosModules.raspberry-pi-4
];
};
modules = [
sops-nix.nixosModules.sops
# Virtual machines.
vm-docker = mkHost {
hostname = "docker";
suite = "vm";
user = "docker";
platform = "x86_64-linux";
};
{ networking.hostName = "firefox-syncserver"; }
vm-minecraft = mkHost {
hostname = "minecraft";
suite = "vm";
user = "docker";
platform = "x86_64-linux";
};
./configuration/common.nix
# LXC containers.
lxc-technitium = mkHost {
hostname = "technitium";
suite = "lxc";
platform = "x86_64-linux";
};
./configuration/server/common.nix
./configuration/server/containers/common.nix
./configuration/server/containers/firefox-syncserver.nix
];
lxc-firefox-syncserver = mkHost {
hostname = "firefox-syncserver";
suite = "lxc";
platform = "x86_64-linux";
extraModules = [
sops-nix.nixosModules.sops
];
};
};
};
}

21
hosts/muskduck.nix → hosts/laptop/muskduck.nix
View file

@ -1,24 +1,12 @@
{
config,
lib,
modulesPath,
...
}:
{
imports = [
(modulesPath + "/installer/scan/not-detected.nix")
];
boot.initrd.availableKernelModules = [
"xhci_pci"
"nvme"
"usb_storage"
"sd_mod"
];
boot.initrd.kernelModules = [ ];
boot.kernelModules = [ "kvm-intel" ];
boot.extraModulePackages = [ ];
fileSystems."/" = {
device = "/dev/disk/by-uuid/63d79656-aa5b-466a-b369-be5eac3f51ab";
@ -37,10 +25,5 @@
];
};
swapDevices = [ ];
networking.useDHCP = lib.mkDefault true;
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
hardware.cpu.intel.updateMicrocode = true;
}

3
configuration/server/containers/firefox-syncserver.nix → hosts/lxc/firefox-syncserver.nix
View file

@ -7,7 +7,7 @@
secrets."firefox_syncserver/sync_master_secret" = {};
};
# syncserver-rs service.
# Enable Firefox sync service.
services.mysql.package = pkgs.mariadb;
services.firefox-syncserver = {
@ -22,5 +22,6 @@
};
};
# Open Firefox sync service port.
networking.firewall.allowedTCPPorts = [ 5000 ];
}

1
configuration/server/containers/technitium.nix → hosts/lxc/technitium.nix
View file

@ -1,4 +1,5 @@
{
# Enable Technitium DNS server.
services.technitium-dns-server = {
enable = true;
openFirewall = true;

26
hosts/server/weebill.nix Normal file
View file

@ -0,0 +1,26 @@
{ pkgs, ... }:
{
boot = {
kernelPackages = pkgs.linuxKernel.packages.linux_rpi4;
initrd.availableKernelModules = [
"xhci_pci"
"usbhid"
"usb_storage"
];
loader = {
grub.enable = false;
generic-extlinux-compatible.enable = true;
};
};
fileSystems = {
"/" = {
device = "/dev/disk/by-label/NIXOS_SD";
fsType = "ext4";
options = [ "noatime" ];
};
};
# Open ports for DHCP server.
networking.firewall.allowedUDPPorts = [ 53 67 ];
}

0
hosts/vm-docker.nix → hosts/vm/docker.nix
View file

0
hosts/vm-minecraft.nix → hosts/vm/minecraft.nix
View file

24
configuration/common.nix → suites/common.nix
View file

@ -1,4 +1,10 @@
{ pkgs, ... }:
{
pkgs,
lib,
user,
...
}:
with lib;
{
# NixOS version.
system.stateVersion = "25.05";
@ -12,6 +18,9 @@
# Allow unfree packages.
nixpkgs.config.allowUnfree = true;
# Enable redistributable firmware.
hardware.enableRedistributableFirmware = true;
# Set time zone.
time.timeZone = "Australia/Perth";
@ -36,6 +45,19 @@
variant = "";
};
# Enable networking.
networking.networkmanager.enable = true;
# Define a user account.
users.users.${user} = {
isNormalUser = true;
description = mkIf (user == "fern") "Fern Garden";
extraGroups = [
"wheel"
"networkmanager"
];
};
# Use fish shell
programs.fish = {
enable = true;

19
configuration/desktop.nix → suites/laptop.nix
View file

@ -5,14 +5,14 @@
fluffychat2,
...
}:
with lib;
{
# Configure the bootloader.
boot = {
# Enable secure boot.
bootspec.enable = true;
initrd.systemd.enable = true;
loader.systemd-boot.enable = lib.mkForce false;
loader.systemd-boot.enable = mkForce false;
loader.efi.canTouchEfiVariables = true;
lanzaboote = {
@ -43,19 +43,6 @@
# Enable smart card support (for YubiKey).
services.pcscd.enable = true;
# Enable networking.
networking.networkmanager.enable = true;
# Define a user account.
users.users.fern = {
isNormalUser = true;
description = "Fern Garden";
extraGroups = [
"networkmanager"
"wheel"
];
};
# Encrypt user's home with fscrypt
security.pam.enableFscrypt = true;
@ -178,7 +165,7 @@
};
# Enable CPU frequency scaling management.
services.power-profiles-daemon.enable = lib.mkForce false; # enabled by gnome
services.power-profiles-daemon.enable = mkForce false; # enabled by gnome
services.tlp.enable = lib.mkForce false; # enabled by nixos-hardware
services.auto-cpufreq.enable = true;
}

8
configuration/server/containers/common.nix → suites/lxc.nix
View file

@ -1,8 +1,10 @@
{ modulesPath, ... }:
{
# Import Proxmox LXC configuration.
modulesPath,
...
}:
{
imports = [
(modulesPath + "/virtualisation/proxmox-lxc.nix")
./server.nix
];
}

23
suites/server.nix Normal file
View file

@ -0,0 +1,23 @@
{ user, lib, ... }:
with lib;
{
# Passwordless sudo
security.sudo.wheelNeedsPassword = false;
# Enable all terminfo (for ghostty)
environment.enableAllTerminfo = true;
# Enable SSH server
services.openssh.enable = true;
users.users.${user}.openssh.authorizedKeys.keys = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIETPyuxUVEmYyEW6PVC6BXqkhULHd/RvMm8fMbYhjTMV fern@muskduck"
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKzW4epTmK01kGVXcuAXUNJQPltnogf4uab9FA5m8S3n fern@pardalote"
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBEJYq1fMxVOzCMfE/td6DtWS8nUk76U9seYD3Z9RYAz u0_a399@fairywren"
"sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIMoJvPcUJDVVzO4dHROCFNlgJdDZSP5xyPx2s40zcx5QAAAABHNzaDo= YubiKey5NFC"
];
# Enable docker.
virtualisation.docker.enable = mkIf (user == "docker") true;
users.users.${user}.extraGroups = mkIf (user == "docker") [ "docker" ];
}

11
configuration/server/vm.nix → suites/vm.nix
View file

@ -1,8 +1,13 @@
{ lib, modulesPath, ... }:
{
# Import qemu guest configuration.
modulesPath,
lib,
...
}:
with lib;
{
imports = [
(modulesPath + "/profiles/qemu-guest.nix")
./server.nix
];
# Load kernel modules.
@ -17,7 +22,7 @@
boot.kernelModules = [ "kvm-intel" ];
# Enable DHCP.
networking.useDHCP = lib.mkDefault true;
networking.useDHCP = mkDefault true;
# Configure the bootloader.
boot.loader.grub = {