nix/nixos-config
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Various changes, and added a live-disk config.

Browse Source
This commit is contained in:
niten
2021-07-16 12:57:36 -07:00
parent df7761b11b
commit 7b889633d8
14 changed files with 190 additions and 57 deletions
Download Patch File Download Diff File Expand all files Collapse all files
config/hardware/lambda.nix
+43 -10
View File
@@ -1,8 +1,13 @@
{ config, lib, pkgs, ... }:
{
with lib;
let
in {
imports = [ <nixpkgs/nixos/modules/installer/scan/not-detected.nix> ];
system.stateVersion = "21.05";
boot = {
initrd = {
availableKernelModules = [
@@ -19,34 +24,62 @@
};
kernelModules = [ "kvm-amd" ];
kernelPackages = pkgs.linuxPackages_latest;
kernelPackages = pkgs.linuxPackages.zfs;
supportedFilesystems = [ "zfs" ];
loader.grub = {
enable = true;
version = 2;
device = "/dev/disk/by-label/nixos-root";
device = "/dev/disk/by-label/lambda-root";
};
};
fileSystems = {
"/" = {
device = "/dev/disk/by-label/nixos-root";
fsType = "btrfs";
"/boot" = {
device = "/dev/disk/by-label/lambda-boot";
fsType = "ext4";
};
"/boot" = {
device = "/dev/disk/by-label/nixos-boot";
fsType = "ext4";
"/" = {
device = "lambda/transient/root";
fsType = "zfs";
};
"/nix" = {
device = "lambda/transient/nix";
fsType = "zfs";
};
"/var/log" = {
device = "lambda/transient/logs";
fsType = "zfs";
neededForBoot = true;
};
"/home" = {
device = "lambda/persistent/home";
fsType = "zfs";
};
"/state" = {
device = "lambda/persistent/state";
fsType = "zfs";
};
};
swapDevices = [{ device = "/dev/disk/by-label/nixos-swap"; }];
boot.initrd.postDeviceCommands = lib.mkAfter ''
${pkgs.zfs}/bin/zfs rollback -r lambda/transient/root@blank
'';
swapDevices = [{ device = "/dev/disk/by-label/lambda-swap"; }];
nix.maxJobs = lib.mkDefault 12;
hardware.bluetooth.enable = false;
networking = {
hostId = substring 0 8 (fileContents /etc/machine-id);
macvlans = {
intif0 = {
interface = "enp3s0f1";
config/hardware/plato.nix
+2 -3
View File
@@ -1,7 +1,6 @@
{ config, lib, pkgs, ... }:
with lib;
{
with lib; {
imports = [ <nixpkgs/nixos/modules/installer/scan/not-detected.nix> ];
boot = {
@@ -18,7 +17,7 @@ with lib;
};
supportedFilesystems = [ "zfs" ];
kernelPackages = pkgs.linuxPackages_latest;
kernelPackages = pkgs.linuxPackages.zfs;
};
fileSystems = {
config/host-config/lambda.nix
+29 -21
View File
@@ -5,13 +5,6 @@ let
shinobi-od-port = "7082";
in {
# TODO: remove?
nixpkgs.config.permittedInsecurePackages = [
"openssh-with-gssapi-8.4p1" # CVE-2021-28041
];
fudo.slynk.enable = true;
networking = {
interfaces = {
enp3s0f0.useDHCP = false;
@@ -23,19 +16,34 @@ in {
};
};
fudo.secrets.host-secrets.lambda = {
host-keytab = {
source-file = /state/secrets/kerberos/lambda.keytab;
target-file = "/etc/krb5.keytab";
user = "root";
fudo.secrets = {
host-secrets.lambda = {
host-keytab = {
source-file = /state/secrets/kerberos/lambda.keytab;
target-file = "/etc/krb5.keytab";
user = "root";
};
};
secret-group = "fudo-secrets";
secret-users = [ "niten" ];
secret-paths = [ "/state/secrets" ];
};
fudo.ipfs = {
enable = true;
users = [ "niten" ];
api-address = "/ip4/0.0.0.0/tcp/5001";
};
systemd.tmpfiles.rules = [
"L /root/.gnupg - - - - /state/root/gnupg"
# "L /root/.emacs.d - - - - /state/root/emacs.d"
"L /root/.ssh/id_rsa - - - - /state/root/ssh/id_rsa"
"L /root/.ssh/id_rsa.pub - - - - /state/root/ssh/id_rsa.pub"
"L /root/.ssh/known_hosts - - - - /state/root/ssh/known_hosts"
"L /etc/ssh/ssh_host_ed25519_key - - - - /state/ssh/ssh_host_ed25519_key"
"L /etc/ssh/ssh_host_rsa_key - - - - /state/ssh/ssh_host_rsa_key"
];
security.sudo.extraConfig = ''
# Due to rollback, sudo will lecture after every reboot
Defaults lecture = never
'';
virtualisation = {
docker = {
@@ -50,10 +58,10 @@ in {
image = "shinobisystems/shinobi:latest";
ports = [ "${shinobi-port}:8080" ];
volumes = [
"/srv/shinobi/plugins:/home/Shinobi/plugins"
"/srv/shinobi/config:/home/Shinobi/config"
"/srv/shinobi/videos:/home/Shinobi/videos"
"/srv/shinobi/db-data:/var/lib/mysql"
"/state/shinobi/plugins:/home/Shinobi/plugins"
"/state/shinobi/config:/home/Shinobi/config"
"/state/shinobi/videos:/home/Shinobi/videos"
"/state/shinobi/db-data:/var/lib/mysql"
"/etc/localtime:/etc/localtime:ro"
];
};
config/host-config/nostromo.nix
+6
View File
@@ -37,6 +37,12 @@ in {
# };
# };
fudo.ipfs = {
enable = true;
users = [ "niten" ];
api-address = "/ip4/0.0.0.0/tcp/5001";
};
virtualisation = {
libvirtd = {
enable = true;
config/profile-config/common-ui.nix
+3 -3
View File
@@ -25,7 +25,7 @@ in {
xserver = mkIf enable-gui {
enable = true;
desktopManager.gnome3.enable = true;
desktopManager.gnome.enable = true;
displayManager.gdm = {
enable = true;
@@ -68,7 +68,7 @@ in {
console.font =
lib.mkDefault "${pkgs.terminus_font}/share/consolefonts/ter-g18n.psf.gz";
services.gnome3 = mkIf enable-gui {
services.gnome = mkIf enable-gui {
evolution-data-server.enable = mkForce false;
gnome-user-share.enable = mkForce false;
};
@@ -76,7 +76,7 @@ in {
programs.steam.enable = enable-gui;
fonts = mkIf enable-gui {
enableFontDir = true;
fontDir.enable = true;
fontconfig.enable = true;
#fontconfig.antialias = true;
#fontconfig.penultimate.enable = true;
config/profile-config/common.nix
+1 -2
View File
@@ -28,6 +28,7 @@ in {
# TODO: remove?
nixpkgs.config.permittedInsecurePackages = [
"openssh-with-gssapi-8.4p1" # CVE-2021-28041
"zfs-kernel"
];
nixpkgs.config.allowUnfree = true;
@@ -135,6 +136,4 @@ in {
};
};
};
services.dbus.socketActivated = true;
}
config/profile-config/server.nix
-2
View File
@@ -50,8 +50,6 @@ in {
system.autoUpgrade.enable = false;
security = { hideProcessInformation = true; };
networking.networkmanager.enable = mkForce false;
services = {