iofq/nix
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

monorepo lab stuff, init zen

Browse source
This commit is contained in:
iofq 2025-12-27 22:26:02 -06:00
parent cfc15bba89
commit 645e09f9dd
54 changed files with 67498 additions and 406 deletions
Download patch file Download diff file Expand all files Collapse all files

165
nixos/consensus/configuration.nix
View file

@ -1,6 +1,6 @@
{
lib,
pkgs,
pkgs-unstable,
config,
...
}:
@ -16,105 +16,57 @@
};
};
};
documentation = {
enable = lib.mkDefault false;
info.enable = lib.mkDefault false;
man.enable = lib.mkDefault false;
nixos.enable = lib.mkDefault false;
};
environment.systemPackages = with pkgs; [
git
vim
docker-compose
tmux
];
system-net.openssh.ports = [2022];
services = {
# zfs.autoScrub.enable = true;
# zfs.autoSnapshot.enable = true;
zfs.autoScrub.enable = true;
zfs.autoSnapshot.enable = true;
fstrim.enable = true;
tailscale.enable = true;
nfs.server = {
enable = true;
exports = ''
/rice 192.168.1.0/24(rw,fsid=0,no_subtree_check) 100.87.58.70(rw,fsid=0,no_subtree_check)
'';
};
k3s = {
enable = true;
role = "server";
extraFlags = toString [
"--disable=traefik"
];
};
fail2ban = {
enable = true;
maxretry = 5;
bantime = "1h";
ignoreIP = [
"172.16.0.0/12"
"192.168.0.0/16"
"10.0.0.0/8"
"tailc353f.ts.net"
];
bantime-increment = {
enable = true;
multipliers = "1 2 4 8 16 32 64 128 256";
maxtime = "24h";
overalljails = true;
};
};
openssh = {
enable = true;
ports = [ 2022 ];
settings = {
PasswordAuthentication = false;
PermitRootLogin = "prohibit-password";
PermitEmptyPasswords = false;
PermitTunnel = false;
UseDns = false;
KbdInteractiveAuthentication = false;
X11Forwarding = false;
MaxAuthTries = 3;
MaxSessions = 2;
ClientAliveInterval = 300;
ClientAliveCountMax = 0;
TCPKeepAlive = false;
AllowTcpForwarding = false;
AllowAgentForwarding = false;
LogLevel = "VERBOSE";
};
hostKeys = [
{
path = "/etc/ssh/ssh_host_ed25519_key";
type = "ed25519";
}
"--flannel-iface=tailscale0"
];
};
immich = {
enable = false;
enable = true;
package = pkgs-unstable.immich;
port = 2283;
host = "localhost";
openFirewall = true;
machine-learning.enable = true;
mediaLocation = "/srv/immich";
mediaLocation = "/rice/immich";
accelerationDevices = null;
};
nginx = {
enable = true;
# virtualHosts."img.10110110.xyz" = {
# forceSSL = true;
# useACMEHost = "10110110.xyz";
# locations."/" = {
# proxyPass = "http://localhost:${toString config.services.immich.port}";
# proxyWebsockets = true;
# recommendedProxySettings = true;
# extraConfig = ''
# client_max_body_size 50000M;
# proxy_read_timeout 600s;
# proxy_send_timeout 600s;
# send_timeout 600s;
# '';
# };
# };
virtualHosts."fs.10110110.xyz" = {
virtualHosts."img.10110110.xyz" = {
forceSSL = true;
useACMEHost = "10110110.xyz";
root = "/var/www/nginx";
extraConfig = "autoindex on;";
locations."/" = {
proxyPass = "http://localhost:${toString config.services.immich.port}";
proxyWebsockets = true;
recommendedProxySettings = true;
extraConfig = ''
client_max_body_size 50000M;
proxy_read_timeout 600s;
proxy_send_timeout 600s;
send_timeout 600s;
'';
};
};
};
};
@ -122,64 +74,44 @@
kernel.sysctl = {
"vm.swappiness" = 6;
};
tmp.cleanOnBoot = true;
# supportedFilesystems = ["zfs"];
# zfs.forceImportRoot = false;
# zfs.extraPools = ["rice"];
};
networking = {
hostId = "91238132";
hostName = "consensus";
firewall = {
enable = true;
allowedTCPPorts = [
22
80
443
2022
8080
8443
2049 #nfs
8080 #unifi
8443 #unifi
10001
6443
25565
25566
9001
30303
10250
6443 #k8s
25565 #mc
25566 #mc
9001 #eth
30303 #eth
];
allowedUDPPorts = [
9001
30303
];
logRefusedConnections = true;
};
};
zramSwap.enable = false;
swapDevices = [
{
device = "/swapfile";
size = 16 * 1024;
}
];
virtualisation.docker.enable = true;
system-sys = {
zram = false;
swapSize = 16;
};
virtualisation.docker = {
enable = true;
extraOptions = "--dns 1.1.1.1";
};
users.users = {
root = {
openssh.authorizedKeys.keys = [
''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHM4Zr0PFN7QdOG2aJ+nuzRCK6caulrpY6bphA1Ppl8Y e@t14''
];
};
e = {
isNormalUser = true;
extraGroups = [ "wheel" ];
home = "/home/e";
openssh.authorizedKeys.keys = [
''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHM4Zr0PFN7QdOG2aJ+nuzRCK6caulrpY6bphA1Ppl8Y e@t14''
''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJou+k8HtIWdlztpWog7fVfJgxJnRIo7c5xVPUBhBxhi'' # phone
];
};
immich.extraGroups = [ "video" "render" ];
};
security.sudo-rs.wheelNeedsPassword = false;
security.acme = {
acceptTerms = true;
defaults.email = "acme@10110110.xyz";
@ -192,6 +124,11 @@
};
};
};
nix.settings.trusted-users = [ "e" ];
hardware.graphics = {
enable = true;
extraPackages = with pkgs; [
intel-media-driver # For Broadwell (2014) or newer processors. LIBVA_DRIVER_NAME=iHD
];
};
system.stateVersion = "23.11";
}