sept rice v2

nixos/consensus/configuration.nix

@@ -24,13 +24,14 @@
   };
   environment.systemPackages = with pkgs; [
     git
-    nvim-pkg
+    vim
     docker-compose
     tmux
   ];
   services = {
     # zfs.autoScrub.enable = true;
     # zfs.autoSnapshot.enable = true;
+    fstrim.enable = true;
     tailscale.enable = true;
     k3s = {
       enable = true;
@@ -46,6 +47,7 @@
       ignoreIP = [
         "172.16.0.0/12"
         "192.168.0.0/16"
+        "10.0.0.0/8"
         "tailc353f.ts.net"
       ];
 
@@ -93,10 +95,9 @@
     };
     nginx = {
       enable = false;
-      virtualHosts."img.consensus.tailc353f.ts.net" = {
-        # forceSSL = true;
-        # sslCertificate = "/etc/nginx/certs/consensus.tailc353f.ts.net.crt";
-        # sslCertificateKey = "/etc/nginx/certs/consensus.tailc353f.ts.net.key";
+      virtualHosts."img.10110110.xyz" = {
+        forceSSL = true;
+        useACMEHost = "10110110.xyz";
         locations."/" = {
           proxyPass = "http://localhost:${toString config.services.immich.port}";
           proxyWebsockets = true;
@@ -122,7 +123,7 @@
   swapDevices = [
     {
       device = "/swapfile";
-      size = 8 * 1024;
+      size = 16 * 1024;
     }
   ];
   virtualisation.docker.enable = true;

nixos/default.nix

@@ -4,14 +4,16 @@
   attrs,
   system,
   ...
-}: let
+}:
+let
   defaultModules = [
     ./configuration.nix
     inputs.sops-nix.nixosModules.sops
     inputs.nix-index-database.nixosModules.nix-index
     inputs.determinate.nixosModules.default
   ];
-in {
+in
+{
   t14 = inputs.nixpkgs.lib.nixosSystem {
     inherit pkgs;
     specialArgs = {
@@ -21,12 +23,10 @@ in {
         inherit (attrs) username;
       };
     };
-    modules =
-      defaultModules
-      ++ [
-        ./t14/configuration.nix
-        inputs.nixos-hardware.nixosModules.lenovo-thinkpad-t14-amd-gen1
-      ];
+    modules = defaultModules ++ [
+      ./t14/configuration.nix
+      inputs.nixos-hardware.nixosModules.lenovo-thinkpad-t14-amd-gen1
+    ];
   };
   consensus = inputs.nixpkgs.lib.nixosSystem {
     inherit pkgs;
@@ -37,10 +37,21 @@ in {
         inherit (attrs) username;
       };
     };
-    modules =
-      defaultModules
-      ++ [
-        ./consensus/configuration.nix
-      ];
+    modules = defaultModules ++ [
+      ./consensus/configuration.nix
+    ];
+  };
+  oracle = inputs.nixpkgs.lib.nixosSystem {
+    inherit pkgs;
+    specialArgs = {
+      inherit inputs system attrs;
+      host = {
+        hostName = "oracle1";
+        inherit (attrs) username;
+      };
+    };
+    modules = defaultModules ++ [
+      ./oracle/configuration.nix
+    ];
   };
 }

nixos/oracle/configuration.nix

@@ -0,0 +1,44 @@
+{ ... }:
+{
+  imports = [
+    ./hardware-configuration.nix
+  ];
+  boot.tmp.cleanOnBoot = true;
+  zramSwap.enable = true;
+  swapDevices = [
+    {
+      device = "/swapfile";
+      size = 16 * 1024;
+    }
+  ];
+  services = {
+    fail2ban.enable = true;
+    fail2ban.maxretry = 5;
+    fail2ban.bantime = "1h";
+    fail2ban.ignoreIP = [
+      "172.16.0.0/12"
+      "192.168.0.0/16"
+      "10.0.0.0/8"
+      "tailc353f.ts.net"
+    ];
+
+    fail2ban.bantime-increment = {
+      enable = true;
+      multipliers = "1 2 4 8 16 32 64 128 256";
+      maxtime = "24h";
+      overalljails = true;
+    };
+    tailscale.enable = true;
+    openssh.enable = true;
+  };
+  networking = {
+    domain = "";
+    hostId = "81238132";
+    hostName = "iofq-oracle-x840";
+  };
+  users.users.root.openssh.authorizedKeys.keys = [
+    ''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDcL53Gdrj5V9YDwKlCBIcgqiS+zHtOQpJlnOHTevJCJ e@t14''
+    ''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHM4Zr0PFN7QdOG2aJ+nuzRCK6caulrpY6bphA1Ppl8Y e@t14''
+  ];
+  system.stateVersion = "23.11";
+}

nixos/oracle/hardware-configuration.nix

@@ -0,0 +1,25 @@
+{ lib, modulesPath, ... }:
+{
+  imports = [ (modulesPath + "/profiles/qemu-guest.nix") ];
+  boot.loader.grub = {
+    efiSupport = true;
+    efiInstallAsRemovable = true;
+    device = "nodev";
+  };
+  fileSystems."/boot" = {
+    device = "/dev/disk/by-uuid/DC8B-AC35";
+    fsType = "vfat";
+  };
+  boot.initrd.availableKernelModules = [
+    "ata_piix"
+    "uhci_hcd"
+    "xen_blkfront"
+    "vmw_pvscsi"
+  ];
+  boot.initrd.kernelModules = [ "nvme" ];
+  fileSystems."/" = {
+    device = "/dev/sda1";
+    fsType = "ext4";
+  };
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+}

nixos/t14/configuration.nix

@@ -2,12 +2,10 @@
   pkgs,
   attrs,
   ...
-}:
-let
+}: let
   # Horrid workaround for https://github.com/nix-community/home-manager/issues/1011
   homeManagerSessionVars = "/etc/profiles/per-user/${attrs.username}/etc/profile.d/hm-session-vars.sh";
-in
-{
+in {
   imports = [
     ./hardware-configuration.nix
     ./backups.nix
@@ -26,7 +24,7 @@ in
     loader.systemd-boot.enable = true;
     loader.efi.canTouchEfiVariables = true;
     kernelPackages = pkgs.linuxPackages_latest;
-    blacklistedKernelModules = [ "bluetooth" ];
+    blacklistedKernelModules = ["bluetooth"];
   };
   # Networking
   networking = {
@@ -41,9 +39,9 @@ in
     };
     firewall = {
       enable = true;
-      allowedTCPPorts = [ 11111 ];
-      allowedUDPPorts = [ ];
-      trustedInterfaces = [ "tailscale0" ];
+      allowedTCPPorts = [11111];
+      allowedUDPPorts = [];
+      trustedInterfaces = ["tailscale0"];
       logRefusedConnections = true;
     };
   };
@@ -55,11 +53,11 @@ in
     };
   };
 
-  security.pam.services.swaylock = { };
+  security.pam.services.swaylock = {};
   xdg.portal = {
     enable = true;
     xdgOpenUsePortal = false;
-    extraPortals = [ pkgs.xdg-desktop-portal-gtk ];
+    extraPortals = [pkgs.xdg-desktop-portal-gtk];
   };
   programs = {
     light.enable = true;
@@ -70,6 +68,7 @@ in
     steam.enable = true;
     adb.enable = true;
     fish.enable = true; # enable vendor completions
+    nh.enable = true;
   };
 
   # workaround for wait-online killing nixos build
@@ -136,7 +135,7 @@ in
       enable = true;
       keyboards = {
         default = {
-          ids = [ "*" ];
+          ids = ["*"];
           settings = {
             main = {
               pause = "timeout(esc, 150, space)";
@@ -161,7 +160,7 @@ in
       nerd-fonts.ubuntu-mono
       spleen
     ];
-    fontconfig.defaultFonts.monospace = [ "UbuntuMono" ];
+    fontconfig.defaultFonts.monospace = ["UbuntuMono"];
   };
   system.stateVersion = "22.11";
 }