iofq/nix
1
0
Fork 0
Code Issues 1 Pull requests Projects Releases Packages Wiki Activity Actions

3/20
All checks were successful
/ check (push) Successful in 3m10s
Details
/ nvim-bundle (nvim) (push) Successful in 17m44s
Details

Browse source
This commit is contained in:
iofq 2026-03-07 12:05:37 -06:00
parent 817aa75f84
commit 235f903c1d
25 changed files with 523 additions and 269 deletions
Download patch file Download diff file Expand all files Collapse all files

143
nixos/zen/configuration.nix
View file

@ -8,31 +8,86 @@
imports = [
./hardware-configuration.nix
];
sops.secrets = {
"password" = {
sopsFile = ../../secrets/k8s.yaml;
};
forgejo-runner = {
sopsFile = ../../secrets/forgejo-runner.yaml;
boot = {
kernel.sysctl = {
"vm.swappiness" = 6;
};
};
sops = {
secrets = {
"password".sopsFile = ../../secrets/k8s.yaml;
forgejo-runner.sopsFile = ../../secrets/forgejo-runner.yaml;
"b2-immich/env".sopsFile = ../../secrets/restic.yaml;
"b2-immich/repo".sopsFile = ../../secrets/restic.yaml;
"b2-immich/password".sopsFile = ../../secrets/restic.yaml;
"cf-dns-key".sopsFile = ../../secrets/cf-acme.yaml;
};
};
services.restic.backups = {
b2-immich = {
initialize = true;
environmentFile = config.sops.secrets."b2-immich/env".path;
repositoryFile = config.sops.secrets."b2-immich/repo".path;
passwordFile = config.sops.secrets."b2-immich/password".path;
paths = [
"/tank/immich"
];
timerConfig = {
OnCalendar = "06:00";
};
pruneOpts = [
"--keep-daily 31"
"--keep-monthly 6"
"--keep-yearly 1"
];
};
};
machine.sys.zram = false;
networking = {
hostId = "81238132";
hostId = "44238132";
firewall = {
allowedTCPPorts = [
22
10250
25565 # mc
25566 # mc
2049 # nfs
];
interfaces."podman+" = {
allowedTCPPorts = [ 33393 ];
};
};
};
virtualisation.podman = {
enable = true;
services = {
zfs.autoScrub.enable = true;
zfs.autoSnapshot.enable = true;
fstrim.enable = true;
nfs.server.enable = true;
# immich = {
# enable = false;
# package = pkgs-unstable.immich;
# port = 2283;
# host = "localhost";
# openFirewall = true;
# machine-learning.enable = true;
# mediaLocation = "/rice/immich";
# accelerationDevices = null;
# };
# nginx = {
# enable = true;
# virtualHosts."img.10110110.xyz" = {
# forceSSL = true;
# useACMEHost = "10110110.xyz";
# locations."/" = {
# proxyPass = "http://localhost:${toString config.services.immich.port}";
# proxyWebsockets = true;
# recommendedProxySettings = true;
# extraConfig = ''
# client_max_body_size 50000M;
# proxy_read_timeout 600s;
# proxy_send_timeout 600s;
# send_timeout 600s;
# '';
# };
# };
# };
};
services.gitea-actions-runner = {
package = pkgs.forgejo-runner;
@ -40,9 +95,7 @@
enable = true;
name = host.hostName;
settings = {
runner = {
capacity = 3;
};
runner.capacity = 3;
cache = {
enable = true;
host = "host.containers.internal";
@ -61,25 +114,45 @@
];
};
};
services.k3s = {
enable = true;
role = "agent";
extraFlags = toString [
"--flannel-iface=tailscale0"
];
tokenFile = config.sops.secrets."password".path;
serverAddr = "https://consensus:6443";
# services.k3s = {
# enable = true;
# role = "agent";
# extraFlags = toString [
# "--flannel-iface=tailscale0"
# ];
# tokenFile = config.sops.secrets."password".path;
# serverAddr = "https://consensus:6443";
# };
# systemd.services.k3s = {
# preStart = ''
# until ${pkgs.tailscale}/bin/tailscale status; do
# sleep 1
# done
# '';
# };
security.acme = {
acceptTerms = true;
defaults.email = "acme@10110110.xyz";
certs = {
"10110110.xyz" = {
domain = "*.10110110.xyz";
# group = config.services.nginx.group;
dnsProvider = "cloudflare";
environmentFile = config.sops.secrets."cf-dns-key".path;
};
};
};
systemd.services.k3s = {
preStart = ''
until ${pkgs.tailscale}/bin/tailscale status; do
sleep 1
done
'';
virtualisation.podman.enable = true;
hardware = {
graphics.enable = true;
nvidia = {
modesetting.enable = true;
nvidiaSettings = true;
open = false;
package = config.boot.kernelPackages.nvidiaPackages.stable;
};
enableRedistributableFirmware = true;
firmware = [ pkgs.linux-firmware ];
};
services.logind.settings.Login.HandleLidSwitch = "ignore";
services.logind.settings.Login.HandleLidSwitchExternalPower = "ignore";
hardware.enableRedistributableFirmware = true;
hardware.firmware = [ pkgs.linux-firmware ];
system.stateVersion = "23.11";
}

75
nixos/zen/hardware-configuration.nix
View file

@ -1,14 +1,69 @@
{ lib, modulesPath, ... }:
{
imports = [ (modulesPath + "/profiles/qemu-guest.nix") ];
boot.loader.grub = {
efiSupport = true;
efiInstallAsRemovable = true;
device = "nodev";
config,
lib,
modulesPath,
...
}:
{
imports = [
(modulesPath + "/installer/scan/not-detected.nix")
];
boot = {
extraModulePackages = [ ];
initrd = {
availableKernelModules = [
"xhci_pci"
"ahci"
"usbhid"
"usb_storage"
"sd_mod"
];
kernelModules = [
"dm-snapshot"
"nvme"
];
};
kernelModules = [ "kvm-amd" ];
loader = {
efi = {
canTouchEfiVariables = true;
};
systemd-boot = {
enable = true;
};
};
supportedFilesystems = [
"zfs"
"nfs"
];
zfs = {
# extraPools = [ "rice" ];
forceImportRoot = false;
};
};
fileSystems."/boot" = { device = "/dev/disk/by-uuid/EECE-9ACB"; fsType = "vfat"; };
boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "xen_blkfront" "vmw_pvscsi" ];
boot.initrd.kernelModules = [ "nvme" ];
fileSystems."/" = { device = "/dev/sda2"; fsType = "ext4"; };
fileSystems = {
"/" = {
device = "/dev/mapper/nixos-root";
fsType = "btrfs";
};
"/boot" = {
device = "/dev/disk/by-uuid/7A75-7368";
fsType = "vfat";
options = [
"fmask=0022"
"dmask=0022"
];
};
"/nix/store" = {
device = "/dev/mapper/nixos-store";
fsType = "btrfs";
};
};
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
system.stateVersion = "25.11";
}

14
nixos/zen/llm.nix Normal file
View file

@ -0,0 +1,14 @@
{ pkgs-unstable, ... }:
{
services.llama-cpp = {
enable = true;
openFirewall = true;
host = "0.0.0.0";
model = "/srv/models/Qwen3.5-4B-Q6_K.gguf";
package = (
pkgs-unstable.llama-cpp.override {
cudaSupport = true;
}
);
};
}