nix/nixos-config
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Lots of updates

Browse Source
This commit is contained in:
niten
2022-07-10 20:46:03 -07:00
parent a4ba216d71
commit d46a301f68
17 changed files with 698 additions and 226 deletions
Download Patch File Download Diff File Expand all files Collapse all files
config/hardware/spark.nix
+14 -14
View File
@@ -9,22 +9,23 @@
efi.canTouchEfiVariables = true;
};
initrd = {
availableKernelModules = [ "xhci_pci" "ahci" "usbhid" "sd_mod" "rtsx_usb_sdmmc" ];
availableKernelModules =
[ "xhci_pci" "ahci" "usbhid" "sd_mod" "rtsx_usb_sdmmc" ];
kernelModules = [ ];
};
kernelModules = [ "kvm-intel" ];
extraModulePackages = [ ];
};
fileSystems."/" =
{ device = "/dev/disk/by-label/nixos";
fsType = "ext4";
};
fileSystems."/" = {
device = "/dev/disk/by-label/nixos";
fsType = "ext4";
};
fileSystems."/boot" =
{ device = "/dev/disk/by-label/BOOT";
fsType = "vfat";
};
fileSystems."/boot" = {
device = "/dev/disk/by-label/BOOT";
fsType = "vfat";
};
hardware = {
bluetooth.enable = true;
@@ -48,12 +49,11 @@
};
interfaces = {
enp3s0 = {
useDHCP = false;
};
enp3s0 = { useDHCP = false; };
intif0 = {
macAddress = pkgs.lib.network.generate-mac-address config.instance.hostname "intif0";
# pkgs.lib.network.generate-mac-address config.instance.hostname "intif0";
macAddress = "02:47:A7:B2:B4:8D";
};
};
};
config/hardware/zbox.nix
+3 -2
View File
@@ -34,8 +34,7 @@
"/state" = {
device = "/dev/disk/by-label/zbox-data";
fsType = "btrfs";
options =
[ "noatime" "nodiratime" "compress=zstd" "noexec" "subvol=@state" ];
options = [ "noatime" "nodiratime" "compress=zstd" "subvol=@state" ];
};
"/nix" = {
@@ -85,6 +84,7 @@
};
networking = {
useDHCP = false;
macvlans = {
intif0 = {
interface = "eno1";
@@ -93,6 +93,7 @@
};
interfaces = {
eno1.useDHCP = false;
intif0 = {
# output of: echo clunk-intif0|md5sum|sed 's/^\(..\)\(..\)\(..\)\(..\)\(..\).*$/02:\1:\2:\3:\4:\5/'
macAddress = "02:dd:80:52:83:9b";
config/host-config/limina.nix
+1 -1
View File
@@ -100,7 +100,7 @@ in {
"L /root/.ssh/known_hosts - - - - /state/root/ssh/known_hosts"
];
security.acme.email = "niten@fudo.org";
security.acme.defaults.email = "niten@fudo.org";
networking.firewall.allowedTCPPorts = [ 80 443 ];
config/host-config/nostromo.nix
+18
View File
@@ -85,6 +85,24 @@ in {
target-file = "/run/services/postgres/db.passwd";
user = config.services.postgresql.superUser;
};
pricebot-auth-token = {
source-file =
config.fudo.secrets.files.service-secrets.nostromo."pricebot-auth.token";
target-file = "/run/services/pricebot/auth.token";
user = "root";
};
};
pricebot = {
enable = true;
mattermost-url = "https://chat.fudo.org";
mattermost-auth-token-file = host-secrets.pricebot-auth-token.target-file;
monitors = {
btc = {
mattermost-channel-id = "3m4bsxcrwbrmpqd4yawwh98q8o";
notify-user = "niten";
};
};
};
services = {
config/host-config/spark.nix
+6 -8
View File
@@ -1,21 +1,19 @@
{ config, lib, pkgs, ... }:
{
fudo.slynk.enable = true;
fudo = {
slynk.enable = true;
wallfly.location = "office";
};
networking = {
interfaces = {
intif0.useDHCP = true;
};
interfaces = { intif0.useDHCP = true; };
firewall.enable = false;
};
i18n.inputMethod = {
enabled = "fcitx5";
fcitx5.addons = with pkgs; [
fcitx5-chinese-addons
fcitx5-rime
];
fcitx5.addons = with pkgs; [ fcitx5-chinese-addons fcitx5-rime ];
};
# fudo.adguard-dns-proxy = {
config/host-config/system3.nix
+4 -1
View File
@@ -3,7 +3,10 @@
with lib;
let state-dir = "/state";
in {
fudo.slynk.enable = true;
fudo = {
slynk.enable = true;
wallfly.location = "office";
};
environment.systemPackages = with pkgs; [ opencv-java ];
config/host-config/wormhole0.nix
+27 -17
View File
@@ -26,7 +26,7 @@ in {
networking = {
hostName = hostname;
firewall.enable = false;
firewall = { enable = false; };
defaultGateway = {
address = "10.0.0.1";
@@ -41,7 +41,7 @@ in {
ipv4 = {
addresses = [{
address = primary-ip;
prefixLength = 24;
prefixLength = 16;
}];
};
};
@@ -75,6 +75,11 @@ in {
target-file = "/run/mosquitto-secrets/xiaoxuan.passwd";
user = mosquitto-user;
};
mosquitto-wallfly-passwd = {
source-file = host-passwds.mosquitto-wallfly;
target-file = "/run/mosquitto-secrets/wallfly.passwd";
user = mosquitto-user;
};
};
systemd = {
@@ -102,14 +107,14 @@ in {
};
tmpfiles.rules = [
"L /root/.gnupg - - - - ${state-dir}/user/root/gnupg"
"L /root/.ssh/id_rsa - - - - ${state-dir}/user/root/ssh/id_rsa"
"L /root/.ssh/id_rsa.pub - - - - ${state-dir}/user/root/ssh/id_rsa.pub"
"L /root/.ssh/known_hosts - - - - ${state-dir}/user/root/ssh/known_hosts"
"L /etc/adjtime - - - - ${state-dir}/etc/adjtime"
"d /state/services 0711 root root - -"
"L /root/.gnupg - - - - ${state-dir}/user/root/gnupg"
"L /root/.ssh/id_rsa - - - - ${state-dir}/user/root/ssh/id_rsa"
"L /root/.ssh/id_rsa.pub - - - - ${state-dir}/user/root/ssh/id_rsa.pub"
"L /root/.ssh/known_hosts - - - - ${state-dir}/user/root/ssh/known_hosts"
"L /etc/adjtime - - - - ${state-dir}/etc/adjtime"
"d /state/services 0711 root root - -"
"d ${zigbee2mqtt-statedir} 0700 ${zigbee2mqtt-user} - - -"
"d ${mosquitto-statedir} 0700 ${mosquitto-user} - - -"
"d ${mosquitto-statedir} 0700 ${mosquitto-user} - - -"
];
};
@@ -150,6 +155,7 @@ in {
listeners = [{
settings.allow_anonymous = false;
port = 1883;
address = "0.0.0.0";
users = {
zigbee2mqtt = {
passwordFile =
@@ -161,14 +167,18 @@ in {
host-secrets.mosquitto-home-assistant-passwd.target-file;
acl = [ "readwrite #" ];
};
niten = {
passwordFile = host-secrets.mosquitto-niten-passwd.target-file;
acl = [ "readwrite #" ];
};
xiaoxuan = {
passwordFile = host-secrets.mosquitto-xiaoxuan-passwd.target-file;
acl = [ "readwrite #" ];
};
# niten = {
# passwordFile = host-secrets.mosquitto-niten-passwd.target-file;
# acl = [ "readwrite #" ];
# };
# xiaoxuan = {
# passwordFile = host-secrets.mosquitto-xiaoxuan-passwd.target-file;
# acl = [ "readwrite #" ];
# };
# wallfly = {
# passwordFile = host-secrets.mosquitto-wallfly-passwd.target-file;
# acl = [ "readwrite homeassistant/binary_sensor/#" ];
# };
};
}];
};
config/host-config/zbox.nix
+26 -13
View File
@@ -1,25 +1,38 @@
{ config, lib, pkgs, ... }:
{
let state-dir = "/state";
in {
config = {
fudo.slynk.enable = true;
fudo = {
slynk.enable = true;
wallfly.location = "family_room";
};
environment.systemPackages = with pkgs; [ opencv-java ];
networking = {
useDHCP = false;
interfaces.intif0.useDHCP = true;
};
i18n.inputMethod = {
enabled = "fcitx5";
fcitx5.addons = with pkgs; [
fcitx5-chinese-addons
fcitx5-rime
];
firewall.enable = false;
};
hardware.bluetooth.enable = true;
hardware.xpadneo.enable = true;
i18n.inputMethod = {
enabled = "fcitx5";
fcitx5.addons = with pkgs; [ fcitx5-chinese-addons fcitx5-rime ];
};
systemd.tmpfiles.rules = [
"d ${state-dir}/lib/flatpak 0755 root root - -"
"d ${state-dir}/etc 0755 root root - -"
"L /var/lib/flatpak - - - - ${state-dir}/lib/flatpak"
"L /etc/adjtime - - - - ${state-dir}/etc/adjtime"
];
hardware = {
bluetooth = {
enable = true;
package = pkgs.bluezFull;
};
xpadneo.enable = true;
};
};
}
config/profile-config/common-ui.nix
+6 -67
View File
@@ -51,10 +51,11 @@ in {
};
pulse.enable = true;
jack.enable = true;
media-session = {
enable = true;
config.alsa-monitor = { api.alsa.headroom = 1024; };
};
wireplumber.enable = true;
# media-session = {
# enable = true;
# config.alsa-monitor = { api.alsa.headroom = 1024; };
# };
};
udev.packages = with pkgs; [ via ];
@@ -84,67 +85,5 @@ in {
services.flatpak.enable = enable-gui;
fonts = mkIf enable-gui {
fontDir.enable = true;
fontconfig.enable = true;
#fontconfig.antialias = true;
#fontconfig.penultimate.enable = true;
#fontconfig.subpixel.lcdfilter = "default";
fonts = with pkgs; [
cantarell_fonts
dejavu_fonts
dina-font
dosemu_fonts
fira-code
fira-code-symbols
freefont_ttf
liberation_ttf
mplus-outline-fonts
nerdfonts
noto-fonts
noto-fonts-cjk
noto-fonts-emoji
proggyfonts
terminus_font
ubuntu_font_family
ucsFonts
ultimate-oldschool-pc-font-pack
unifont
xorg.fontadobe100dpi
xorg.fontadobe75dpi
xorg.fontadobeutopia100dpi
xorg.fontadobeutopia75dpi
xorg.fontadobeutopiatype1
xorg.fontarabicmisc
xorg.fontbh100dpi
xorg.fontbh75dpi
xorg.fontbhlucidatypewriter100dpi
xorg.fontbhlucidatypewriter75dpi
xorg.fontbhttf
xorg.fontbhtype1
xorg.fontbitstream100dpi
xorg.fontbitstream75dpi
xorg.fontbitstreamtype1
xorg.fontcronyxcyrillic
xorg.fontcursormisc
xorg.fontdaewoomisc
xorg.fontdecmisc
xorg.fontibmtype1
xorg.fontisasmisc
xorg.fontjismisc
xorg.fontmicromisc
xorg.fontmisccyrillic
xorg.fontmiscethiopic
xorg.fontmiscmeltho
xorg.fontmiscmisc
xorg.fontmuttmisc
xorg.fontschumachermisc
xorg.fontscreencyrillic
xorg.fontsonymisc
xorg.fontsunmisc
xorg.fontwinitzkicyrillic
xorg.fontxfree86type1
];
};
fonts = mkIf enable-gui { fontDir.enable = true; };
}
config/profile-config/common.nix
+16 -3
View File
@@ -69,7 +69,7 @@ in {
proxiable = true;
};
kerberos = pkgs.heimdalFull;
kerberos = pkgs.heimdal;
};
services = {
@@ -84,6 +84,12 @@ in {
GSSAPIKeyExchange yes
GSSAPIStoreCredentialsOnRekey yes
'';
# FIXME: This is temporary! Getting error: Unsupported KEX algorithm "sntrup761x25519-sha512@openssh.com"
kexAlgorithms = [
"curve25519-sha256"
"curve25519-sha256@libssh.org"
"diffie-hellman-group-exchange-sha256"
];
};
fail2ban =
@@ -104,8 +110,8 @@ in {
(attrValues config.fileSystems);
in length btrfsFilesystems > 0;
# pcscd.enable = true;
# udev.packages = with pkgs; [ yubikey-personalization ];
pcscd.enable = true;
udev.packages = with pkgs; [ yubikey-personalization ];
};
networking.firewall = {
@@ -152,6 +158,7 @@ in {
# rollback results in sudo lectures after each reboot
Defaults lecture = never
'';
pam = {
enableSSHAgentAuth = true;
@@ -163,6 +170,12 @@ in {
# googleAuthenticator.enable = true;
};
};
# yubikey = {
# enable = true;
# debug = true;
# mode = "challenge-response";
# };
};
};
config/service/metrics.nix
+3
View File
@@ -236,6 +236,9 @@ in {
in "${alias}.${domain-name}";
state-directory = prometheus-cfg.state-directory;
private-network = is-private-network;
# TODO: prometheus 22.05 breaks dns_sd_configs
# Revert when fixed.
package = pkgs.pkgs2111.prometheus;
};
grafana = mkIf metricsMonitor {
config/service/wallfly-presence.nix
+92
View File
@@ -0,0 +1,92 @@
{ config, lib, pkgs, ... }:
with lib;
let
cfg = config.fudo.services.wallfly-presence;
hostname = config.instance.hostname;
domain-name = config.instance.local-domain;
site-name = config.instance.local-site;
mqtt-broker = cfg.mqtt.broker-host;
is-mqtt-broker = hostname == mqtt-broker;
site-users = config.fudo.sites."${config.instance.local-site}".local-users;
domain-users = config.fudo.domains."${domain-name}".local-users;
user-cfg = genAttrs (unique (site-users ++ domain-users)) (username: {
password-file =
pkgs.lib.passwd.stablerandom-passwd-file "wallfly-${username}"
config.instance.build-seed;
});
local-user-cfg =
filterAttrs (username: opts: hasAttr username config.instance.local-users)
user-cfg;
in {
options.fudo.services.wallfly-presence = with types; {
enable = mkEnableOption "Enable WallFly presence for the local site.";
mqtt = {
broker-host = mkOption {
type = str;
description = "Host to serve as local MQTT broker.";
};
port = mkOption {
type = port;
description = "Port on which to listen for MQTT connections.";
default = 1884;
};
listen-address = mkOption {
type = str;
description = "Address on which to listen for MQTT connections.";
default = "0.0.0.0";
};
};
};
config = mkIf cfg.enable {
fudo = {
secrets.host-secrets."${hostname}" = (mapAttrs' (username: userOpts:
nameValuePair "wallfly-user-${username}-passwd" {
source-file = userOpts.password-file;
target-file = "/run/wallfly-${username}/passwd";
user = username;
}) local-user-cfg) // (optionalAttrs is-mqtt-broker (mapAttrs'
(username: userOpts:
nameValuePair "wallfly-server-${username}-passwd" {
source-file = userOpts.password-file;
target-file = "/run/wallfly-mqtt/${username}.passwd";
user = config.systemd.services.mosquitto.serviceConfig.User;
}) user-cfg));
zones."${domain-name}" = {
aliases.mqtt = "${mqtt-broker}.${domain-name}";
};
wallfly = {
enable = true;
mqtt = {
broker-uri =
"tcp://${mqtt-broker}.${domain-name}:${toString cfg.mqtt.port}";
username = "wallfly-$USER";
password-file = "/run/wallfly-$USER/passwd";
};
};
};
services = {
mosquitto = mkIf (is-mqtt-broker) {
enable = true;
listeners = [{
settings.allow_anonymous = false;
port = cfg.mqtt.port;
address = cfg.mqtt.listen-address;
users = mapAttrs' (username: userOpts:
nameValuePair "wallfly-${username}" {
passwordFile = "/run/wallfly-mqtt/${username}.passwd";
acl = [ "readwrite homeassistant/binary_sensor/#" ];
}) user-cfg;
}];
};
};
};
}
config/services.nix
+1
View File
@@ -14,6 +14,7 @@
./service/metrics.nix
./service/postgresql.nix
./service/selby-forum.nix
./service/wallfly-presence.nix
# ./service/wireguard-gateway.nix
];
}
config/site-config/seattle.nix
+12 -1
View File
@@ -3,6 +3,11 @@
with lib;
let local-domain = "sea.fudo.org";
in {
fudo.services.wallfly-presence = {
enable = true;
mqtt.broker-host = "wormhole0";
};
fileSystems = {
# "/mnt/documents" = {
# device = "whitedwarf.${local-domain}:/volume1/Documents";
@@ -136,7 +141,8 @@ in {
description = "RPC security service for NFS client and server";
wantedBy = [ "auth-rpcgss-module.service" ];
conflicts = [ "umount.target" ];
after = [ "host-keytab-watcher.service" "rpc_pipefs.target" ];
after =
[ "host-keytab-watcher.service" "rpc_pipefs.target" "local-fs.target" ];
wants = [ "host-keytab-watcher.service" ];
requires = [ "rpc_pipefs.target" ];
partOf = [ "nfs-utils.service" ];
@@ -144,6 +150,7 @@ in {
serviceConfig = {
Type = "forking";
ExecStart = "${pkgs.nfs-utils}/bin/rpc.gssd";
Restart = "always";
};
};
@@ -158,12 +165,16 @@ in {
DefaultDependencies = false;
ConditionPathExists =
[ "|!/run/gssproxy.pid" "|!/proc/net/rpc/use-gss-proxy" ];
Restart = "always";
};
serviceConfig = {
Type = "forking";
ExecStart = "${pkgs.nfs-utils}/bin/rpc.svcgssd";
Restart = "always";
};
};
rpcbind.after = [ "local-fs.target" ];
};
services.printing = {
config/users.nix
+1 -1
View File
@@ -10,7 +10,7 @@
login-hashed-passwd =
"$6$a1q2Duoe35hd5$IaZGXPfqyGv9uq5DQm7DZq0vIHsUs39sLktBiBBqMiwl/f/Z4jSvNZLJp9DZJYe5u2qGBYh1ca.jsXvQA8FPZ/";
ssh-authorized-keys = [
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDoWkjyeIfgwm0b78weToVYOQSD0RQ0qbNzpsN5NokbIFv2/980kLtnYrQEgIJ/JwMLlT3uJYacbCT5/a6Fb8oLxNpj0AF1EKaWZ3Rrlg72Sq+9SEwJwWWmZizX83sovMwUBMaUp6jWLhAhPpzBW5pfc5YWoc89wxGbELSwzgt5EgHbSJgvDnaHSp3fVaY01wfDXbL/oO160iNe7wv2HLMZu/FkWBkIjz6HmoGJJzYM89bUpHbyYG28lmCHB/8UPog5/BsjOn3/qupgf4zh6mMdMsXLvbR2jVwVjxcEMj9N5nCvc+Y3oi7Mij6VNrWbhkaAJMEzeMhWYrF3/pFQxUqG37aK3d0gw9kp5tMDLIlAPX4y1lfA87pIzoa0+Alql0CJQA1IJvp9SFG7lBmSthWQLmZvwwfoGg/ZjF6rOgsVoZ8TizpQnydWJDr6NboU9LL9Oa64OM5Rs0AU3cR2UbOF4QIcWFJ/7oDe3dOnfZ8QYqx9eXJyxoAUpDanaaTHYBiAKkeOBwQU+MVLKCcONKw9FZclf/1TpDB5b3/JeUFANjHQTv0UXA4YYU7iCx6H7XB4qwwtU9O19CGQYYfCfULX12/fRpYJw6VJaQWyyU4Bn5dk/dcB2nGI36jwbLMfhbUTIApujioAnd/GQIMakHEZ1+syPhMx9BxMkZb99B0A1Q== openpgp:0x4EC95B64"
"sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIFPoobMZkyOmotVUMTFMYGOoDjZ++yMnf/S6JWCDj+9DAAAABHNzaDo= niten@system3"
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDGVez4of30f+j0cWKj5kYCKeFjyNsYvG9UbOMxF5hImD2lP5MSbFBv31gFgHjx3yCG4zQRZlpuyU5uWo0qIwe9N84/LcZcB9WrWKZXDmuof7zPFy0J+Hj+LVLDQI/mVXHNwkMhBMHpPrdwA05EYDAYCYklWT4cSByu10pHtST+olF8i+A+UQgUzgNZzdJVeiYZv6MBDTYsJWptGeDUkl2B0Es3gtbGYcCCfnyS3RC7DIXlDo3NBbAr7WaHY2MBbT+R/+jicn9E3IY3NCM5jENxqmvHy9MDsxEEYgFNm7IDwq4V1VRUWy277YsvRbmEaHb+osOA5u1VNN4z3UftOZcSZgR5C/vR71cENXoPt1YQpCzu7i38ojtvL+tDVEKT7sIovrQw8q1sszNlW2nXh8RSPiIq5TMnrV73MP0egKcr9n3tfxwi1BIkLjvfom/02BkTK9R9v+VMNhYU1YwROhORCiMIgoxUGiUvtH8u38JGr7E0hhMoAjCE5k80WPUivl0= niten@socrates"
];
home-directory = "/home/niten";