Many changes over time
This commit is contained in:
+15
-15
@@ -4,7 +4,7 @@ with lib;
|
||||
let
|
||||
|
||||
in {
|
||||
system.stateVersion = "21.05";
|
||||
system.stateVersion = "21.11";
|
||||
|
||||
boot = {
|
||||
loader = {
|
||||
@@ -35,38 +35,38 @@ in {
|
||||
"/boot" = {
|
||||
device = "/dev/disk/by-label/SYS3-BOOT";
|
||||
fsType = "vfat";
|
||||
options = [ "noexec" ];
|
||||
options = [ "noexec" "noatime" ];
|
||||
};
|
||||
|
||||
"/" = {
|
||||
device = "system3-root";
|
||||
fsType = "tmpfs";
|
||||
options = [ "mode=755" ];
|
||||
options = [ "mode=755" "noexec" ];
|
||||
};
|
||||
|
||||
"/nix" = {
|
||||
device = "/dev/disk/by-label/system3";
|
||||
fsType = "btrfs";
|
||||
options = [ "subvol=nix" "compress=zstd" "noatime" ];
|
||||
device = "/dev/disk/by-label/system3-data";
|
||||
fsType = "btrfs";
|
||||
options = [ "subvol=@nix" "compress=zstd" "noatime" ];
|
||||
};
|
||||
|
||||
"/var/log" = {
|
||||
device = "/dev/disk/by-label/system3";
|
||||
fsType = "btrfs";
|
||||
options = [ "subvol=log" "compress=zstd" "noatime" "noexec" ];
|
||||
device = "/dev/disk/by-label/system3-data";
|
||||
fsType = "btrfs";
|
||||
options = [ "subvol=@logs" "compress=zstd" "noatime" "noexec" ];
|
||||
neededForBoot = true;
|
||||
};
|
||||
|
||||
"/state" = {
|
||||
device = "/dev/disk/by-label/system3";
|
||||
fsType = "btrfs";
|
||||
options = [ "subvol=state" "compress=zstd" "noatime" ];
|
||||
device = "/dev/disk/by-label/system3-data";
|
||||
fsType = "btrfs";
|
||||
options = [ "subvol=@state" "compress=zstd" "noatime" ];
|
||||
};
|
||||
|
||||
"/home" = {
|
||||
device = "/dev/disk/by-label/system3";
|
||||
fsType = "btrfs";
|
||||
options = [ "subvol=home" "compress=zstd" "noatime" ];
|
||||
device = "/dev/disk/by-label/system3-data";
|
||||
fsType = "btrfs";
|
||||
options = [ "subvol=@home" "compress=zstd" "noatime" ];
|
||||
};
|
||||
};
|
||||
|
||||
|
||||
@@ -1,71 +1,89 @@
|
||||
{ config, lib, pkgs, modulesPath, ... }:
|
||||
|
||||
with lib; {
|
||||
system.stateVersion = "22.05";
|
||||
system.stateVersion = "21.11";
|
||||
|
||||
imports = [ (modulesPath + "/installer/scan/not-detected.nix") ];
|
||||
|
||||
boot = {
|
||||
initrd = {
|
||||
availableKernelModules = [ "xhci_pci" "usbhid" "usb_storage" ];
|
||||
availableKernelModules =
|
||||
[ "xhci_pci" "ehci_pci" "ahci" "usbhid" "usb_storage" "sd_mod" ];
|
||||
kernelModules = [ ];
|
||||
};
|
||||
loader = {
|
||||
grub.enable = false;
|
||||
# generic-extlinux-compatible.enable = true;
|
||||
raspberryPi = {
|
||||
enable = true;
|
||||
version = 4;
|
||||
};
|
||||
systemd-boot.enable = true;
|
||||
efi.canTouchEfiVariables = true;
|
||||
};
|
||||
|
||||
tmpOnTmpfs = true;
|
||||
|
||||
kernelModules = [ ];
|
||||
kernelPackages = pkgs.linuxPackages_rpi4;
|
||||
kernelParams = [
|
||||
"8250.nr_uarts=1"
|
||||
"console=ttyAMA0,115200"
|
||||
"console=tty1"
|
||||
];
|
||||
tmpOnTmpfs = false;
|
||||
|
||||
kernelModules = [ "kvm-intel" ];
|
||||
extraModulePackages = [ ];
|
||||
};
|
||||
|
||||
hardware = {
|
||||
bluetooth.enable = false;
|
||||
enableRedistributableFirmware = true;
|
||||
# raspberry-pi."4".fkms-3d.enable = true;
|
||||
};
|
||||
|
||||
fileSystems = {
|
||||
"/" = {
|
||||
device = "/dev/disk/by-label/NIXOS_SD";
|
||||
fsType = "ext4";
|
||||
options = [ "noatime" ];
|
||||
device = "wormhole0-root";
|
||||
fsType = "tmpfs";
|
||||
options = [ "mode=755" "noexec" "noatime" "nodiratime" ];
|
||||
};
|
||||
|
||||
"/boot" = {
|
||||
device = "/dev/disk/by-label/FIRMWARE";
|
||||
device = "/dev/disk/by-label/WORMBOOT";
|
||||
fsType = "vfat";
|
||||
options = [ "noatime" ];
|
||||
options = [ "noexec" "noatime" "nodiratime" ];
|
||||
};
|
||||
|
||||
"/nix" = {
|
||||
device = "/dev/disk/by-label/wormhole0-data";
|
||||
fsType = "btrfs";
|
||||
options = [ "subvol=@nix" "compress=zstd" "noatime" "nodiratime" ];
|
||||
};
|
||||
|
||||
"/var/log" = {
|
||||
device = "/dev/disk/by-label/wormhole0-data";
|
||||
fsType = "btrfs";
|
||||
options =
|
||||
[ "subvol=@logs" "compress=zstd" "noatime" "nodiratime" "noexec" ];
|
||||
};
|
||||
|
||||
"/state" = {
|
||||
device = "/dev/disk/by-label/wormhole0-data";
|
||||
fsType = "btrfs";
|
||||
options =
|
||||
[ "subvol=@state" "compress=zstd" "noatime" "nodiratime" "noexec" ];
|
||||
};
|
||||
};
|
||||
|
||||
swapDevices = [ ];
|
||||
swapDevices = [{ device = "/dev/disk/by-label/wormhole0-swap"; }];
|
||||
|
||||
networking = {
|
||||
useDHCP = mkDefault false;
|
||||
|
||||
macvlans = {
|
||||
intif0 = {
|
||||
interface = "eth0";
|
||||
interface = "enp1s0";
|
||||
mode = "bridge";
|
||||
};
|
||||
wormif0 = {
|
||||
interface = "enp3s0";
|
||||
mode = "bridge";
|
||||
};
|
||||
};
|
||||
|
||||
interfaces = {
|
||||
eth0.useDHCP = false;
|
||||
intif0.macAddress = "02:fa:d4:07:cf:f4";
|
||||
enp1s0.useDHCP = false;
|
||||
enp3s0.useDHCP = false;
|
||||
intif0.macAddress =
|
||||
pkgs.lib.network.generate-mac-address "wormhole0" "intif0";
|
||||
wormif0.macAddress =
|
||||
pkgs.lib.network.generate-mac-address "wormhole0" "wormif0";
|
||||
};
|
||||
};
|
||||
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
{ config, lib, pkgs, ... }:
|
||||
|
||||
{
|
||||
{
|
||||
boot = {
|
||||
loader = {
|
||||
systemd-boot.enable = true;
|
||||
@@ -12,7 +12,7 @@
|
||||
kernelModules = [ ];
|
||||
};
|
||||
kernelModules = [ "kvm-intel" ];
|
||||
kernelPackages = pkgs.linuxPackages_latest;
|
||||
# kernelPackages = pkgs.linuxPackages_latest;
|
||||
extraModulePackages = [ ];
|
||||
};
|
||||
|
||||
@@ -34,7 +34,8 @@
|
||||
"/state" = {
|
||||
device = "/dev/disk/by-label/zbox-data";
|
||||
fsType = "btrfs";
|
||||
options = [ "noatime" "nodiratime" "compress=zstd" "noexec" "subvol=@state" ];
|
||||
options =
|
||||
[ "noatime" "nodiratime" "compress=zstd" "noexec" "subvol=@state" ];
|
||||
};
|
||||
|
||||
"/nix" = {
|
||||
@@ -46,7 +47,8 @@
|
||||
"/var/log" = {
|
||||
device = "/dev/disk/by-label/zbox-data";
|
||||
fsType = "btrfs";
|
||||
options = [ "noatime" "nodiratime" "compress=zstd" "noexec" "subvol=@logs" ];
|
||||
options =
|
||||
[ "noatime" "nodiratime" "compress=zstd" "noexec" "subvol=@logs" ];
|
||||
};
|
||||
|
||||
"/home" = {
|
||||
|
||||
@@ -92,8 +92,7 @@ in {
|
||||
|
||||
virtualHosts."home.sea.fudo.org" = {
|
||||
locations."/" = {
|
||||
proxyPass =
|
||||
"http://localhost:${toString home-assistant-port}";
|
||||
proxyPass = "http://localhost:${toString home-assistant-port}";
|
||||
proxyWebsockets = true;
|
||||
};
|
||||
};
|
||||
@@ -113,10 +112,9 @@ in {
|
||||
image = "homeassistant/home-assistant:stable";
|
||||
autoStart = true;
|
||||
environment.TZ = config.time.timeZone;
|
||||
ports = [ "${toString home-assistant-port}:8123" ];
|
||||
volumes = [
|
||||
"/state/services/home-assistant:/config"
|
||||
];
|
||||
# ports = [ "${toString home-assistant-port}:8123" ];
|
||||
volumes = [ "/state/services/home-assistant:/config" ];
|
||||
extraOptions = [ "--network=host" "--device=/dev/ttyACM0" ];
|
||||
};
|
||||
|
||||
# shinobi = {
|
||||
|
||||
+32
-100
@@ -20,10 +20,17 @@ in {
|
||||
|
||||
intif0 = {
|
||||
useDHCP = false;
|
||||
ipv4.addresses = [{
|
||||
address = primary-ip;
|
||||
prefixLength = 16;
|
||||
}];
|
||||
ipv4 = {
|
||||
addresses = [{
|
||||
address = primary-ip;
|
||||
prefixLength = 16;
|
||||
}];
|
||||
routes = [{
|
||||
address = "192.168.86.0";
|
||||
prefixLength = 24;
|
||||
via = "10.0.0.3";
|
||||
}];
|
||||
};
|
||||
};
|
||||
intif1 = { useDHCP = false; };
|
||||
intif2 = { useDHCP = false; };
|
||||
@@ -79,38 +86,8 @@ in {
|
||||
};
|
||||
};
|
||||
|
||||
# virtualisation = {
|
||||
# docker = {
|
||||
# enable = true;
|
||||
# autoPrune.enable = true;
|
||||
# enableOnBoot = true;
|
||||
# };
|
||||
|
||||
# oci-containers = {
|
||||
# backend = "docker";
|
||||
# containers = {
|
||||
# pihole = {
|
||||
# image = "pihole/pihole:2021.10";
|
||||
# autoStart = true;
|
||||
# ports = [ "5353:53/tcp" "5353:53/udp" "3080:80/tcp" ];
|
||||
# environment = {
|
||||
# # ServerIP = primary-ip;
|
||||
# VIRTUAL_HOST = "dns-hole.sea.fudo.org";
|
||||
# DNS1 = "${primary-ip}#${toString dns-proxy-port}";
|
||||
# };
|
||||
# volumes = [
|
||||
# "/state/pihole/etc-pihole/:/etc/pihole/"
|
||||
# "/state/pihole/etc-dnsmasq.d/:/etc/dnsmasq.d/"
|
||||
# ];
|
||||
# };
|
||||
# };
|
||||
# };
|
||||
# };
|
||||
|
||||
# Support for statelessness
|
||||
environment.etc = {
|
||||
# TODO: replace with current config
|
||||
# nixos.source = "/state/nixos";
|
||||
NIXOS.source = "/state/etc/NIXOS";
|
||||
"host-config.nix".source = "/state/etc/host-config.nix";
|
||||
};
|
||||
@@ -123,79 +100,34 @@ in {
|
||||
"L /root/.ssh/known_hosts - - - - /state/root/ssh/known_hosts"
|
||||
];
|
||||
|
||||
# security.acme.certs."sea-camera.fudo.link".email = "niten@fudo.org";
|
||||
security.acme.email = "niten@fudo.org";
|
||||
|
||||
networking.firewall.allowedTCPPorts = [ 80 443 ];
|
||||
|
||||
systemd.services.nginx.requires = [ "bind.service" ];
|
||||
|
||||
services = {
|
||||
# nginx = {
|
||||
# enable = true;
|
||||
# recommendedGzipSettings = true;
|
||||
# recommendedOptimisation = true;
|
||||
# recommendedProxySettings = true;
|
||||
nginx = {
|
||||
enable = true;
|
||||
recommendedGzipSettings = true;
|
||||
recommendedOptimisation = true;
|
||||
recommendedProxySettings = true;
|
||||
|
||||
# virtualHosts = {
|
||||
# "dns-hole.${domain-name}" = {
|
||||
# serverAliases = [
|
||||
# "pi-hole.${domain-name}"
|
||||
# "pihole.${domain-name}"
|
||||
# "hole.${domain-name}"
|
||||
# "pi-hole"
|
||||
# "pihole"
|
||||
# "dns-hole"
|
||||
# "hole"
|
||||
# ];
|
||||
|
||||
# locations."/" = { proxyPass = "http://127.0.0.1:3080"; };
|
||||
# };
|
||||
|
||||
# ## This keeps failing, too many requests...give it a rest for now
|
||||
# # "sea-camera.fudo.link" = {
|
||||
# # enableACME = true;
|
||||
# # forceSSL = true;
|
||||
|
||||
# # locations."/" = {
|
||||
# # # proxyPass = "http://cargo.sea.fudo.org:5000/webman/3rdparty/SurveillanceStation/";
|
||||
# # proxyPass = "http://cargo.sea.fudo.org:5000/";
|
||||
|
||||
# # extraConfig = ''
|
||||
# # proxy_http_version 1.1;
|
||||
# # proxy_set_header Upgrade $http_upgrade;
|
||||
# # proxy_set_header Connection "Upgrade";
|
||||
|
||||
# # proxy_set_header Host $host;
|
||||
# # # proxy_set_header X-Real-IP $remote_addr;
|
||||
# # # proxy_set_header X-Forwarded-By $server_addr:$server_port;
|
||||
# # # proxy_set_header X-Forwarded-For $remote_addr;
|
||||
# # # proxy_set_header X-Forwarded-Proto $scheme;
|
||||
# # '';
|
||||
# # };
|
||||
# # };
|
||||
|
||||
# # "sea-camera-od.fudo.link" = {
|
||||
# # enableACME = true;
|
||||
# # forceSSL = true;
|
||||
|
||||
# # locations."/" = {
|
||||
# # proxyPass = "http://panopticon-od.sea.fudo.org";
|
||||
|
||||
# # extraConfig = ''
|
||||
# # proxy_http_version 1.1;
|
||||
# # proxy_set_header Upgrade $http_upgrade;
|
||||
# # proxy_set_header Connection "Upgrade";
|
||||
|
||||
# # proxy_set_header Host $host;
|
||||
# # proxy_set_header X-Real-IP $remote_addr;
|
||||
# # proxy_set_header X-Forwarded-By $server_addr:$server_port;
|
||||
# # proxy_set_header X-Forwarded-For $remote_addr;
|
||||
# # proxy_set_header X-Forwarded-Proto $scheme;
|
||||
# # '';
|
||||
# # };
|
||||
# # };
|
||||
# };
|
||||
# };
|
||||
virtualHosts = {
|
||||
"sea-home.fudo.link" = {
|
||||
enableACME = true;
|
||||
forceSSL = true;
|
||||
locations."/" = {
|
||||
proxyPass = "http://home-assist.sea.fudo.org/";
|
||||
extraConfig = ''
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Upgrade $http_upgrade;
|
||||
proxy_set_header Connection "Upgrade";
|
||||
'';
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
openssh = {
|
||||
hostKeys = [
|
||||
|
||||
@@ -1,5 +1,6 @@
|
||||
{ config, lib, pkgs, ... }:
|
||||
|
||||
with lib;
|
||||
let state-dir = "/state";
|
||||
in {
|
||||
fudo.slynk.enable = true;
|
||||
@@ -17,10 +18,12 @@ in {
|
||||
"L /root/.ssh/id_rsa.pub - - - - ${state-dir}/user/root/ssh/id_rsa.pub"
|
||||
"L /root/.ssh/known_hosts - - - - ${state-dir}/user/root/ssh/known_hosts"
|
||||
"L /var/lib/flatpak - - - - ${state-dir}/lib/flatpak"
|
||||
"L /etc/adjtime - - - - ${state-dir}/etc/adjtime"
|
||||
];
|
||||
|
||||
services = {
|
||||
blueman.enable = true;
|
||||
|
||||
openssh.hostKeys = [
|
||||
{
|
||||
path = "${state-dir}/ssh/ssh_host_rsa_key";
|
||||
@@ -30,40 +33,13 @@ in {
|
||||
{
|
||||
path = "${state-dir}/ssh/ssh_host_ed25519_key";
|
||||
type = "ed25519";
|
||||
bits = 4096;
|
||||
}
|
||||
];
|
||||
};
|
||||
|
||||
environment.etc = {
|
||||
"ssh/ssh_host_rsa_key" = {
|
||||
source = "${state-dir}/ssh/ssh_host_rsa_key";
|
||||
user = "root";
|
||||
group = "root";
|
||||
mode = "0400";
|
||||
};
|
||||
"ssh/ssh_host_rsa_key.pub" = {
|
||||
source = "${state-dir}/ssh/ssh_host_rsa_key.pub";
|
||||
user = "root";
|
||||
group = "root";
|
||||
mode = "0444";
|
||||
};
|
||||
"ssh/ssh_host_ed25519_key" = {
|
||||
source = "${state-dir}/ssh/ssh_host_ed25519_key";
|
||||
user = "root";
|
||||
group = "root";
|
||||
mode = "0400";
|
||||
};
|
||||
"ssh/ssh_host_ed25519_key.pub" = {
|
||||
source = "${state-dir}/ssh/ssh_host_ed25519_key.pub";
|
||||
user = "root";
|
||||
group = "root";
|
||||
mode = "0444";
|
||||
};
|
||||
nixos.source = "/etc/nixos-live";
|
||||
"host-config.nix".source = "${state-dir}/host/host-config.nix";
|
||||
adjtime.source = "${state-dir}/host/adjtime";
|
||||
NIXOS.source = "${state-dir}/host/NIXOS";
|
||||
NIXOS.source = "${state-dir}/etc/NIXOS";
|
||||
};
|
||||
|
||||
hardware = {
|
||||
@@ -73,9 +49,4 @@ in {
|
||||
};
|
||||
xpadneo.enable = true;
|
||||
};
|
||||
|
||||
security.sudo.extraConfig = ''
|
||||
# Due to rollback, sudo will lecture after every reboot
|
||||
Defaults lecture = never
|
||||
'';
|
||||
}
|
||||
|
||||
@@ -3,8 +3,27 @@
|
||||
with lib;
|
||||
let
|
||||
primary-ip = "10.0.0.3";
|
||||
state-dir = "/state";
|
||||
zigbee2mqtt-statedir = "${state-dir}/services/zigbee2mqtt";
|
||||
mosquitto-statedir = "${state-dir}/services/mosquitto";
|
||||
home-assistant-port = 8123;
|
||||
|
||||
zigbee2mqtt-user = config.systemd.services.zigbee2mqtt.serviceConfig.User;
|
||||
|
||||
mosquitto-user = config.systemd.services.mosquitto.serviceConfig.User;
|
||||
|
||||
zigbee2mqtt-passwd-file =
|
||||
pkgs.lib.passwd.random-passwd-file "zigbee2mqtt-passwd" 20;
|
||||
|
||||
home-assistant-passwd-file =
|
||||
pkgs.lib.passwd.stablerandom-passwd-file "home-assistant-passwd"
|
||||
config.instance.build-seed;
|
||||
|
||||
host-secrets = config.fudo.secrets.host-secrets.wormhole0;
|
||||
|
||||
in {
|
||||
boot.kernel.sysctl = { "net.ipv4.ip_forward" = true; };
|
||||
|
||||
networking = {
|
||||
hostName = "wormhole0";
|
||||
|
||||
@@ -19,24 +38,163 @@ in {
|
||||
|
||||
interfaces = {
|
||||
intif0 = {
|
||||
ipv4.addresses = [{
|
||||
address = primary-ip;
|
||||
prefixLength = 24;
|
||||
}];
|
||||
useDHCP = false;
|
||||
ipv4 = {
|
||||
addresses = [{
|
||||
address = primary-ip;
|
||||
prefixLength = 24;
|
||||
}];
|
||||
};
|
||||
};
|
||||
|
||||
wlan0.useDHCP = true;
|
||||
wormif0.useDHCP = true;
|
||||
|
||||
wlp2s0.useDHCP = false;
|
||||
};
|
||||
|
||||
dhcpcd.extraConfig = concatStringsSep "\n" [ "nogateway" ];
|
||||
};
|
||||
|
||||
fudo.secrets.host-secrets.wormhole0 = {
|
||||
mosquitto-zigbee2mqtt-passwd = {
|
||||
source-file = zigbee2mqtt-passwd-file;
|
||||
target-file = "/run/mosquitto-secrets/zigbee2mqtt.passwd";
|
||||
user = mosquitto-user;
|
||||
};
|
||||
mosquitto-home-assistant-passwd = {
|
||||
source-file = home-assistant-passwd-file;
|
||||
target-file = "/run/mosquitto-secrets/home-assistant.passwd";
|
||||
user = mosquitto-user;
|
||||
};
|
||||
};
|
||||
|
||||
nix = {
|
||||
# settings = {
|
||||
# auto-optimise-store = true;
|
||||
# };
|
||||
gc = {
|
||||
automatic = true;
|
||||
dates = "weekly";
|
||||
options = "--delete-older-than 30d";
|
||||
systemd = {
|
||||
services = {
|
||||
wormhole-route = {
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
after = [ "network-online.target" ];
|
||||
serviceConfig = {
|
||||
ExecStart =
|
||||
"${pkgs.iproute2}/bin/ip route add 192.168.86.0/24 dev wormif0";
|
||||
ExecStop =
|
||||
"${pkgs.iproute2}/bin/ip route del 192.168.86.0/24 dev wormif0";
|
||||
RemainAfterExit = true;
|
||||
};
|
||||
};
|
||||
|
||||
zigbee2mqtt.after =
|
||||
[ config.fudo.secrets.secret-target "mosquitto.service" ];
|
||||
mosquitto.after = [ config.fudo.secrets.secret-target ];
|
||||
};
|
||||
|
||||
tmpfiles.rules = [
|
||||
"L /root/.gnupg - - - - ${state-dir}/user/root/gnupg"
|
||||
"L /root/.ssh/id_rsa - - - - ${state-dir}/user/root/ssh/id_rsa"
|
||||
"L /root/.ssh/id_rsa.pub - - - - ${state-dir}/user/root/ssh/id_rsa.pub"
|
||||
"L /root/.ssh/known_hosts - - - - ${state-dir}/user/root/ssh/known_hosts"
|
||||
"L /etc/adjtime - - - - ${state-dir}/etc/adjtime"
|
||||
"d /state/services 0711 root root - -"
|
||||
"d ${zigbee2mqtt-statedir} 0700 ${zigbee2mqtt-user} - - -"
|
||||
"d ${mosquitto-statedir} 0700 ${mosquitto-user} - - -"
|
||||
];
|
||||
};
|
||||
|
||||
users.groups = let
|
||||
zigbee2mqtt-user = config.systemd.services.zigbee2mqtt.serviceConfig.User;
|
||||
in { dialout.members = [ zigbee2mqtt-user ]; };
|
||||
|
||||
services = {
|
||||
blueman.enable = true;
|
||||
openssh.hostKeys = [
|
||||
{
|
||||
path = "${state-dir}/ssh/ssh_host_rsa_key";
|
||||
type = "rsa";
|
||||
bits = 4096;
|
||||
}
|
||||
{
|
||||
path = "${state-dir}/ssh/ssh_host_ed25519_key";
|
||||
type = "ed25519";
|
||||
}
|
||||
];
|
||||
|
||||
nginx = {
|
||||
enable = true;
|
||||
recommendedOptimisation = true;
|
||||
recommendedProxySettings = true;
|
||||
recommendedGzipSettings = true;
|
||||
|
||||
virtualHosts."home-assist.sea.fudo.org" = {
|
||||
locations."/" = {
|
||||
proxyPass = "http://localhost:${toString home-assistant-port}";
|
||||
proxyWebsockets = true;
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
mosquitto = {
|
||||
enable = true;
|
||||
dataDir = mosquitto-statedir;
|
||||
listeners = [{
|
||||
settings.allow_anonymous = false;
|
||||
port = 1883;
|
||||
users = {
|
||||
zigbee2mqtt = {
|
||||
passwordFile =
|
||||
host-secrets.mosquitto-zigbee2mqtt-passwd.target-file;
|
||||
acl = [ "readwrite #" ];
|
||||
};
|
||||
home-assistant = {
|
||||
passwordFile =
|
||||
host-secrets.mosquitto-home-assistant-passwd.target-file;
|
||||
acl = [ "readwrite #" ];
|
||||
};
|
||||
};
|
||||
}];
|
||||
};
|
||||
|
||||
zigbee2mqtt = {
|
||||
enable = true;
|
||||
dataDir = zigbee2mqtt-statedir;
|
||||
settings = {
|
||||
homeassistant = true;
|
||||
permit_join = true;
|
||||
serial.port = "/dev/ttyUSB0";
|
||||
mqtt = {
|
||||
server = "mqtt://127.0.0.1:1883";
|
||||
user = "zigbee2mqtt";
|
||||
password = readFile zigbee2mqtt-passwd-file;
|
||||
# TODO: could make a yaml file containing password
|
||||
# described https://www.zigbee2mqtt.io/guide/configuration/mqtt.html#server-connection
|
||||
# Weird, though.
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
virtualisation = {
|
||||
docker = {
|
||||
enable = true;
|
||||
enableOnBoot = true;
|
||||
autoPrune.enable = true;
|
||||
};
|
||||
|
||||
oci-containers = {
|
||||
backend = "docker";
|
||||
containers = {
|
||||
home-assistant = {
|
||||
image = "homeassistant/home-assistant:stable";
|
||||
autoStart = true;
|
||||
environment.TZ = config.time.timeZone;
|
||||
#ports = [ "${toString home-assistant-port}:8123" ];
|
||||
volumes = [ "/state/services/home-assistant:/config" ];
|
||||
extraOptions = [ "--network=host" ];
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
security.sudo.extraConfig = ''
|
||||
# Due to rollback, sudo will lecture after every reboot
|
||||
Defaults lecture = never
|
||||
'';
|
||||
}
|
||||
|
||||
@@ -37,6 +37,26 @@ in {
|
||||
};
|
||||
|
||||
trezord.enable = true;
|
||||
|
||||
gnome = mkIf enable-gui {
|
||||
evolution-data-server.enable = mkForce false;
|
||||
gnome-user-share.enable = mkForce false;
|
||||
};
|
||||
|
||||
pipewire = {
|
||||
enable = true;
|
||||
alsa = {
|
||||
enable = true;
|
||||
support32Bit = true;
|
||||
};
|
||||
pulse.enable = true;
|
||||
jack.enable = true;
|
||||
};
|
||||
};
|
||||
|
||||
security = {
|
||||
rtkit.enable = true;
|
||||
sudo.extraConfig = "Defaults lecture = never";
|
||||
};
|
||||
|
||||
hardware = {
|
||||
@@ -47,22 +67,15 @@ in {
|
||||
driSupport = true;
|
||||
driSupport32Bit = true;
|
||||
};
|
||||
|
||||
pulseaudio.enable = false;
|
||||
};
|
||||
|
||||
sound.enable = true;
|
||||
hardware.pulseaudio = {
|
||||
enable = true;
|
||||
support32Bit = config.hardware.pulseaudio.enable;
|
||||
};
|
||||
|
||||
# console.font =
|
||||
# lib.mkDefault "${pkgs.terminus_font}/share/consolefonts/ter-g18n.psf.gz";
|
||||
|
||||
services.gnome = mkIf enable-gui {
|
||||
evolution-data-server.enable = mkForce false;
|
||||
gnome-user-share.enable = mkForce false;
|
||||
};
|
||||
|
||||
services.flatpak.enable = enable-gui;
|
||||
|
||||
fonts = mkIf enable-gui {
|
||||
|
||||
@@ -40,6 +40,11 @@ in {
|
||||
extraOptions = ''
|
||||
experimental-features = nix-command flakes
|
||||
'';
|
||||
gc = {
|
||||
automatic = true;
|
||||
dates = "weekly";
|
||||
options = "--delete-older-than 7d";
|
||||
};
|
||||
};
|
||||
|
||||
nixpkgs.config.allowUnfree = true;
|
||||
|
||||
@@ -7,64 +7,66 @@ let
|
||||
try-attr = attr: set: if (hasAttr attr set) then set.${attr} else null;
|
||||
|
||||
in {
|
||||
config = mkIf has-secret-files (let
|
||||
keytab-file = try-attr hostname config.fudo.secrets.files.host-keytabs;
|
||||
in mkIf (keytab-file != null) {
|
||||
## This doesn't seem to work...timing?
|
||||
# environment.etc."krb5.keytab" = mkIf (keytab-file != null) {
|
||||
# source =
|
||||
# config.fudo.secrets.host-secrets.${hostname}.host-keytab.target-file;
|
||||
# user = "root";
|
||||
# group = "root";
|
||||
# mode = "0400";
|
||||
# };
|
||||
config = mkIf has-secret-files
|
||||
(let keytab-file = try-attr hostname config.fudo.secrets.files.host-keytabs;
|
||||
in mkIf (keytab-file != null) {
|
||||
## This doesn't seem to work...timing?
|
||||
# environment.etc."krb5.keytab" = mkIf (keytab-file != null) {
|
||||
# source =
|
||||
# config.fudo.secrets.host-secrets.${hostname}.host-keytab.target-file;
|
||||
# user = "root";
|
||||
# group = "root";
|
||||
# mode = "0400";
|
||||
# };
|
||||
|
||||
systemd = let
|
||||
host-keytab = config.fudo.secrets.host-secrets.${hostname}.host-keytab.target-file;
|
||||
in {
|
||||
paths."${hostname}-keytab-watcher" = {
|
||||
wantedBy = [ "default.target" ];
|
||||
description = "Watch host keytab for changes.";
|
||||
pathConfig = {
|
||||
PathChanged = host-keytab;
|
||||
Unit = "${hostname}-keytab-watcher.service";
|
||||
};
|
||||
};
|
||||
|
||||
services = {
|
||||
"${hostname}-keytab-watcher" = {
|
||||
description = "When host keytab is available or changed, activate copy job.";
|
||||
path = with pkgs; [ systemd ];
|
||||
serviceConfig = {
|
||||
Type = "oneshot";
|
||||
systemd = let
|
||||
host-keytab =
|
||||
config.fudo.secrets.host-secrets.${hostname}.host-keytab.target-file;
|
||||
in {
|
||||
paths."${hostname}-keytab-watcher" = {
|
||||
wantedBy = [ "default.target" ];
|
||||
description = "Watch host keytab for changes.";
|
||||
pathConfig = {
|
||||
PathChanged = host-keytab;
|
||||
Unit = "${hostname}-keytab-watcher.service";
|
||||
};
|
||||
script = "systemctl restart ${hostname}-copy-keytab.service";
|
||||
};
|
||||
|
||||
"${hostname}-copy-keytab" = {
|
||||
description = "Copy the host krb5.keytab into place once it's available.";
|
||||
serviceConfig = {
|
||||
Type = "oneshot";
|
||||
RemainAfterExit = true;
|
||||
ExecStart = pkgs.writeShellScript "${hostname}-copy-keytab.sh" ''
|
||||
[ -f ${host-keytab} ] || exit 1
|
||||
[ -f /etc/krb5.keytab ] && rm /etc/krb5.keytab
|
||||
cp ${host-keytab} /etc/krb5.keytab
|
||||
chown root:root /etc/krb5.keytab
|
||||
chmod 0400 /etc/krb5.keytab
|
||||
'';
|
||||
ExecStop = pkgs.writeShellScript "${hostname}-remove-keytab.sh" ''
|
||||
rm -f /etc/krb5.keytab
|
||||
'';
|
||||
services = {
|
||||
"${hostname}-keytab-watcher" = {
|
||||
description =
|
||||
"When host keytab is available or changed, activate copy job.";
|
||||
path = with pkgs; [ systemd ];
|
||||
serviceConfig = { Type = "oneshot"; };
|
||||
script = "systemctl restart ${hostname}-copy-keytab.service";
|
||||
};
|
||||
|
||||
"${hostname}-copy-keytab" = {
|
||||
description =
|
||||
"Copy the host krb5.keytab into place once it's available.";
|
||||
serviceConfig = {
|
||||
Type = "simple";
|
||||
RemainAfterExit = true;
|
||||
ExecStart = pkgs.writeShellScript "${hostname}-copy-keytab.sh" ''
|
||||
[ -f ${host-keytab} ] || exit 1
|
||||
[ -f /etc/krb5.keytab ] && rm /etc/krb5.keytab
|
||||
cp ${host-keytab} /etc/krb5.keytab
|
||||
chown root:root /etc/krb5.keytab
|
||||
chmod 0400 /etc/krb5.keytab
|
||||
'';
|
||||
ExecStop = pkgs.writeShellScript "${hostname}-remove-keytab.sh" ''
|
||||
rm -f /etc/krb5.keytab
|
||||
'';
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
fudo.secrets.host-secrets.${hostname}.host-keytab = mkIf (keytab-file != null) {
|
||||
source-file = keytab-file;
|
||||
target-file = "/run/kerberos/krb5.keytab";
|
||||
user = "root";
|
||||
};
|
||||
});
|
||||
fudo.secrets.host-secrets.${hostname}.host-keytab =
|
||||
mkIf (keytab-file != null) {
|
||||
source-file = keytab-file;
|
||||
target-file = "/run/kerberos/krb5.keytab";
|
||||
user = "root";
|
||||
};
|
||||
});
|
||||
}
|
||||
|
||||
@@ -30,20 +30,20 @@ in {
|
||||
# };
|
||||
"/mnt/cargo_video" = {
|
||||
device = "cargo.${local-domain}:/volume1/video";
|
||||
fsType = "nfs";
|
||||
options = [ "comment=systemd.automount" "nfsvers=4.2" ];
|
||||
fsType = "nfs4";
|
||||
options = [ "sec=krb5i" "x-systemd.automount" ];
|
||||
};
|
||||
"/mnt/photo" = {
|
||||
device = "cargo.${local-domain}:/volume1/pictures";
|
||||
fsType = "nfs";
|
||||
options = [ "comment=systemd.automount" "nfsvers=4.2" ];
|
||||
fsType = "nfs4";
|
||||
options = [ "sec=krb5i" "x-systemd.automount" ];
|
||||
};
|
||||
|
||||
# "proto=tcp"
|
||||
|
||||
# # NOTE: these are pointing directly to nostromo so the krb lookup works
|
||||
"/net/documents" = {
|
||||
device = "nostromo.sea.fudo.org:/export/documents";
|
||||
device = "nostromo.${local-domain}:/export/documents";
|
||||
fsType = "nfs4";
|
||||
options = [
|
||||
"sec=krb5p"
|
||||
@@ -54,7 +54,7 @@ in {
|
||||
];
|
||||
};
|
||||
"/net/downloads" = {
|
||||
device = "nostromo.sea.fudo.org:/export/downloads";
|
||||
device = "nostromo.${local-domain}:/export/downloads";
|
||||
fsType = "nfs4";
|
||||
options = [
|
||||
"sec=krb5i"
|
||||
@@ -65,7 +65,7 @@ in {
|
||||
];
|
||||
};
|
||||
"/net/projects" = {
|
||||
device = "nostromo.sea.fudo.org:/export/projects";
|
||||
device = "nostromo.${local-domain}:/export/projects";
|
||||
fsType = "nfs4";
|
||||
options = [
|
||||
"sec=krb5p"
|
||||
@@ -91,14 +91,24 @@ in {
|
||||
# script = "${pkgs.systemd}/bin/systemctl restart rpc-gssd.service";
|
||||
# };
|
||||
|
||||
services.host-keytab-watcher = {
|
||||
wantedBy = [ "rpc-gssd.service" "rpc-svcgssd.service" ];
|
||||
before = [ "rpc-gssd.service" "rpc-svcgssd.service" ];
|
||||
unitConfig = { ConditionPathExists = [ "/etc/krb5.keytab" ]; };
|
||||
serviceConfig = {
|
||||
ExecStart = "${pkgs.coreutils}/bin/sleep 500";
|
||||
TimeoutStartSec = "3600";
|
||||
RemainAfterExit = true;
|
||||
services = {
|
||||
# host-keytab-watcher = {
|
||||
# wantedBy = [ "rpc-gssd.service" "rpc-svcgssd.service" ];
|
||||
# before = [ "rpc-gssd.service" "rpc-svcgssd.service" ];
|
||||
# serviceConfig = {
|
||||
# ExecStart = "${pkgs.coreutils}/bin/sleep 500";
|
||||
# TimeoutStartSec = "3600";
|
||||
# RemainAfterExit = true;
|
||||
# };
|
||||
# };
|
||||
|
||||
rpc-gssd = {
|
||||
after = [ config.fudo.secrets.secret-target ];
|
||||
unitConfig = { ConditionPathExists = mkForce [ ]; };
|
||||
};
|
||||
rpc-svcgssd = {
|
||||
after = [ config.fudo.secrets.secret-target ];
|
||||
unitConfig = { ConditionPathExists = mkForce [ ]; };
|
||||
};
|
||||
};
|
||||
};
|
||||
@@ -117,7 +127,7 @@ in {
|
||||
# in [
|
||||
# {
|
||||
# enable = true;
|
||||
# what = "nostromo.sea.fudo.org:/export/documents";
|
||||
# what = "nostromo.${local-domain}:/export/documents";
|
||||
# where = "/net/documents";
|
||||
# type = "nfs";
|
||||
# options = mkOpts [
|
||||
@@ -131,7 +141,7 @@ in {
|
||||
# }
|
||||
# {
|
||||
# enable = true;
|
||||
# what = "nostromo.sea.fudo.org:/export/downloads";
|
||||
# what = "nostromo.${local-domain}:/export/downloads";
|
||||
# where = "/net/downloads";
|
||||
# type = "nfs";
|
||||
# options = mkOpts [
|
||||
@@ -145,7 +155,7 @@ in {
|
||||
# }
|
||||
# {
|
||||
# enable = true;
|
||||
# what = "nostromo.sea.fudo.org:/export/projects";
|
||||
# what = "nostromo.${local-domain}:/export/projects";
|
||||
# where = "/net/projects";
|
||||
# type = "nfs";
|
||||
# options = mkOpts [
|
||||
@@ -165,12 +175,12 @@ in {
|
||||
drivers = [
|
||||
# pkgs.brlaser
|
||||
# pkgs.brgenml1lpr
|
||||
# pkgs.brgenml1cupswrapper
|
||||
pkgs.brgenml1cupswrapper
|
||||
# pkgs.hll2380dw-cups
|
||||
|
||||
# pkgs.hll2380dw-lpr
|
||||
];
|
||||
};
|
||||
|
||||
environment.systemPackages = with pkgs; [ hll2380dw-cups ];
|
||||
# environment.systemPackages = with pkgs; [ hll2380dw-cups ];
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user