nix/nixos-config
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Upgrade to 22.05 (and much else)

Browse Source
This commit is contained in:
niten
2022-06-01 13:57:58 -07:00
parent e9e61e24d4
commit a4ba216d71
16 changed files with 548 additions and 368 deletions
Download Patch File Download Diff File Expand all files Collapse all files
config/host-config/lambda.nix
+55 -55
View File
@@ -84,65 +84,65 @@ in {
Defaults lecture = never
'';
services.nginx = {
enable = true;
recommendedOptimisation = true;
recommendedProxySettings = true;
recommendedGzipSettings = true;
# services.nginx = {
# enable = true;
# recommendedOptimisation = true;
# recommendedProxySettings = true;
# recommendedGzipSettings = true;
virtualHosts."home.sea.fudo.org" = {
locations."/" = {
proxyPass = "http://localhost:${toString home-assistant-port}";
proxyWebsockets = true;
};
};
};
# virtualHosts."home.sea.fudo.org" = {
# locations."/" = {
# proxyPass = "http://localhost:${toString home-assistant-port}";
# proxyWebsockets = true;
# };
# };
# };
virtualisation = {
docker = {
enable = true;
enableOnBoot = true;
autoPrune = { enable = true; };
};
# virtualisation = {
# docker = {
# enable = true;
# enableOnBoot = true;
# autoPrune = { enable = true; };
# };
oci-containers = {
backend = "docker";
containers = {
home-assistant = {
image = "homeassistant/home-assistant:stable";
autoStart = true;
environment.TZ = config.time.timeZone;
# ports = [ "${toString home-assistant-port}:8123" ];
volumes = [ "/state/services/home-assistant:/config" ];
extraOptions = [ "--network=host" "--device=/dev/ttyACM0" ];
};
# oci-containers = {
# backend = "docker";
# containers = {
# home-assistant = {
# image = "homeassistant/home-assistant:stable";
# autoStart = true;
# environment.TZ = config.time.timeZone;
# # ports = [ "${toString home-assistant-port}:8123" ];
# volumes = [ "/state/services/home-assistant:/config" ];
# extraOptions = [ "--network=host" "--device=/dev/ttyACM0" ];
# };
# shinobi = {
# image = "shinobisystems/shinobi:latest";
# ports = [ "${shinobi-port}:8080" ];
# volumes = [
# "/state/shinobi/plugins:/home/Shinobi/plugins"
# "/state/shinobi/config:/home/Shinobi/config"
# "/state/shinobi/videos:/home/Shinobi/videos"
# "/state/shinobi/db-data:/var/lib/mysql"
# "/etc/localtime:/etc/localtime:ro"
# ];
# };
# # shinobi = {
# # image = "shinobisystems/shinobi:latest";
# # ports = [ "${shinobi-port}:8080" ];
# # volumes = [
# # "/state/shinobi/plugins:/home/Shinobi/plugins"
# # "/state/shinobi/config:/home/Shinobi/config"
# # "/state/shinobi/videos:/home/Shinobi/videos"
# # "/state/shinobi/db-data:/var/lib/mysql"
# # "/etc/localtime:/etc/localtime:ro"
# # ];
# # };
# shinobi-od = {
# image = "shinobisystems/shinobi-tensorflow:latest";
# volumes =
# [ "/srv/shinobi/od-config:/home/Shinobi/docker-plugins/tensorflow" ];
# ports = [ "${shinobi-od-port}:8082" ];
# environment = {
# PLUGIN_HOST = "panopticon.sea.fudo.org";
# PLUGIN_PORT = shinobi-port;
# PLUGIN_KEY = "30sWllylOxsDcE4vQXEPaXNfe5DiB3";
# };
# };
# # shinobi-od = {
# # image = "shinobisystems/shinobi-tensorflow:latest";
# # volumes =
# # [ "/srv/shinobi/od-config:/home/Shinobi/docker-plugins/tensorflow" ];
# # ports = [ "${shinobi-od-port}:8082" ];
# # environment = {
# # PLUGIN_HOST = "panopticon.sea.fudo.org";
# # PLUGIN_PORT = shinobi-port;
# # PLUGIN_KEY = "30sWllylOxsDcE4vQXEPaXNfe5DiB3";
# # };
# # };
# photoprism = { image = "photoprism/photoprism"; };
};
};
};
# # photoprism = { image = "photoprism/photoprism"; };
# };
# };
# };
}
config/host-config/legatus.nix
+8 -6
View File
@@ -31,9 +31,7 @@ in {
security.acme.email = "admin@legatus.fudo.org";
systemd.tmpfiles.rules = [
"L /etc/adjtime - - - - /state/etc/adjtime"
];
systemd.tmpfiles.rules = [ "L /etc/adjtime - - - - /state/etc/adjtime" ];
environment.systemPackages = local-packages;
@@ -57,7 +55,7 @@ in {
# # };
# };
fudo = {
fudo = {
hosts.legatus.external-interfaces = [ "extif0" ];
services = {
@@ -69,10 +67,14 @@ in {
ipropd-keytab = host-secrets.heimdal-ipropd-keytab.target-file;
};
};
chat = {
state-directory = "/state/services/chat";
external-interface = "extif0";
};
};
secrets.host-secrets.legatus = let
files = config.fudo.secrets.files;
secrets.host-secrets.legatus = let files = config.fudo.secrets.files;
in {
# postgres-keytab = {
# source-file = files.service-keytabs.procul.postgres;
config/host-config/nostromo.nix
+18 -14
View File
@@ -24,20 +24,24 @@ in {
# Hopefully this'll help with NFS...
boot.kernelModules = [ "rpcsec_gss_krb5" ];
services.nfs = {
# See ../user-config.nix for the user@REALM -> user mapping
server = {
enable = true;
createMountPoints = false;
exports = let
exportList = [
"/export/documents 10.0.0.0/24(rw,sync,no_root_squash,no_subtree_check,fsid=10,sec=krb5p)"
"/export/downloads 10.0.0.0/24(rw,sync,no_root_squash,no_subtree_check,fsid=11,sec=krb5i)"
"/export/projects 10.0.0.0/24(rw,sync,no_root_squash,no_subtree_check,fsid=12,sec=krb5p)"
];
in ''
${concatStringsSep "\n" exportList}
'';
services = {
murmur.enable = true;
nfs = {
# See ../user-config.nix for the user@REALM -> user mapping
server = {
enable = true;
createMountPoints = false;
exports = let
exportList = [
"/export/documents 10.0.0.0/24(rw,sync,no_root_squash,no_subtree_check,fsid=10,sec=krb5p)"
"/export/downloads 10.0.0.0/24(rw,sync,no_root_squash,no_subtree_check,fsid=11,sec=krb5i)"
"/export/projects 10.0.0.0/24(rw,sync,no_root_squash,no_subtree_check,fsid=12,sec=krb5p)"
];
in ''
${concatStringsSep "\n" exportList}
'';
};
};
};
config/host-config/procul.nix
+9 -15
View File
@@ -12,8 +12,7 @@ let
site = config.fudo.sites.${site-name};
host-fqdn = "${hostname}.${domain-name}";
local-networks =
domain.local-networks ++ site.local-networks;
local-networks = domain.local-networks ++ site.local-networks;
local-packages = with pkgs; [ ldns.examples ];
@@ -23,10 +22,9 @@ let
host-certs = config.fudo.acme.host-domains.${hostname};
grafana-database-password =
pkgs.lib.passwd.stablerandom-passwd-file
"grafana-database-password-${hostname}"
"grafana-database-password-${hostname}-${config.instance.build-seed}";
grafana-database-password = pkgs.lib.passwd.stablerandom-passwd-file
"grafana-database-password-${hostname}"
"grafana-database-password-${hostname}-${config.instance.build-seed}";
in {
networking = {
@@ -136,8 +134,7 @@ in {
# };
};
secrets.host-secrets.procul = let
files = config.fudo.secrets.files;
secrets.host-secrets.procul = let files = config.fudo.secrets.files;
in {
# postgres-keytab = {
# source-file = files.service-keytabs.procul.postgres;
@@ -199,9 +196,7 @@ in {
allowed-networks = [ "1.1.1.1/32" "1.0.0.1/32" "localhost" "link-local" ];
};
services.mail-server = {
state-directory = "/srv/mailserver";
};
services.mail-server = { state-directory = "/srv/mailserver"; };
# mail-server = {
# enable = true;
@@ -257,6 +252,7 @@ in {
state-directory = "/var/lib/kerberos";
master-key-file = host-secrets.heimdal-master-key.target-file;
};
ldap.state-directory = "/state/services/ldap";
};
dns.zones."informis.land" = {
enable = true;
@@ -303,8 +299,7 @@ in {
};
gituser = {
password-file =
host-secrets.postgres-gitea-password.target-file;
password-file = host-secrets.postgres-gitea-password.target-file;
databases = {
git = {
access = "CONNECT";
@@ -332,8 +327,7 @@ in {
state-dir = "/srv/git/state";
database = {
user = "gituser";
password-file =
host-secrets.gitea-database-password.target-file;
password-file = host-secrets.gitea-database-password.target-file;
hostname = "127.0.0.1";
name = "git";
};
config/host-config/wormhole0.nix
+41 -12
View File
@@ -2,6 +2,7 @@
with lib;
let
hostname = "wormhole0";
primary-ip = "10.0.0.3";
state-dir = "/state";
zigbee2mqtt-statedir = "${state-dir}/services/zigbee2mqtt";
@@ -13,19 +14,17 @@ let
mosquitto-user = config.systemd.services.mosquitto.serviceConfig.User;
zigbee2mqtt-passwd-file =
pkgs.lib.passwd.random-passwd-file "zigbee2mqtt-passwd" 20;
home-assistant-passwd-file =
pkgs.lib.passwd.stablerandom-passwd-file "home-assistant-passwd"
pkgs.lib.passwd.stablerandom-passwd-file "zigbee2mqtt-passwd"
config.instance.build-seed;
host-secrets = config.fudo.secrets.host-secrets.wormhole0;
host-secrets = config.fudo.secrets.host-secrets.${hostname};
host-passwds = config.fudo.secrets.files.service-passwords.${hostname};
in {
boot.kernel.sysctl = { "net.ipv4.ip_forward" = true; };
networking = {
hostName = "wormhole0";
hostName = hostname;
firewall.enable = false;
@@ -55,17 +54,27 @@ in {
dhcpcd.extraConfig = concatStringsSep "\n" [ "nogateway" ];
};
fudo.secrets.host-secrets.wormhole0 = {
fudo.secrets.host-secrets.${hostname} = {
mosquitto-zigbee2mqtt-passwd = {
source-file = zigbee2mqtt-passwd-file;
target-file = "/run/mosquitto-secrets/zigbee2mqtt.passwd";
user = mosquitto-user;
};
mosquitto-home-assistant-passwd = {
source-file = home-assistant-passwd-file;
source-file = host-passwds.mosquitto-home-assistant;
target-file = "/run/mosquitto-secrets/home-assistant.passwd";
user = mosquitto-user;
};
mosquitto-niten-passwd = {
source-file = host-passwds.mosquitto-niten;
target-file = "/run/mosquitto-secrets/niten.passwd";
user = mosquitto-user;
};
mosquitto-xiaoxuan-passwd = {
source-file = host-passwds.mosquitto-xiaoxuan;
target-file = "/run/mosquitto-secrets/xiaoxuan.passwd";
user = mosquitto-user;
};
};
systemd = {
@@ -82,9 +91,14 @@ in {
};
};
zigbee2mqtt.after =
[ config.fudo.secrets.secret-target "mosquitto.service" ];
mosquitto.after = [ config.fudo.secrets.secret-target ];
zigbee2mqtt = {
after = [ config.fudo.secrets.secret-target "mosquitto.service" ];
restartIfChanged = true;
};
mosquitto = {
after = [ config.fudo.secrets.secret-target ];
restartIfChanged = true;
};
};
tmpfiles.rules = [
@@ -104,7 +118,6 @@ in {
in { dialout.members = [ zigbee2mqtt-user ]; };
services = {
blueman.enable = true;
openssh.hostKeys = [
{
path = "${state-dir}/ssh/ssh_host_rsa_key";
@@ -148,6 +161,14 @@ in {
host-secrets.mosquitto-home-assistant-passwd.target-file;
acl = [ "readwrite #" ];
};
niten = {
passwordFile = host-secrets.mosquitto-niten-passwd.target-file;
acl = [ "readwrite #" ];
};
xiaoxuan = {
passwordFile = host-secrets.mosquitto-xiaoxuan-passwd.target-file;
acl = [ "readwrite #" ];
};
};
}];
};
@@ -155,6 +176,7 @@ in {
zigbee2mqtt = {
enable = true;
dataDir = zigbee2mqtt-statedir;
package = pkgs.pkgsUnstable.zigbee2mqtt;
settings = {
homeassistant = true;
permit_join = true;
@@ -167,8 +189,15 @@ in {
# described https://www.zigbee2mqtt.io/guide/configuration/mqtt.html#server-connection
# Weird, though.
};
advanced.log_level = "debug";
};
};
avahi = {
enable = true;
reflector = true;
interfaces = [ "intif0" "worm0" ];
};
};
virtualisation = {
config/host-config/wormhole0/converters/AQSZB-110.js
+11
View File
@@ -0,0 +1,11 @@
const definition = {
zigbeeModel: ['AQSZB-110'],
model: 'AQSZB-110',
vendor: 'Frient',
description: 'Frient Air Quarity Sensor',
fromZigbee: [fz.temperature],
toZigbee: [],
exposes: [e.battery(), e.temperature(), e.humidity()],
};
module.exports = definition;