iofq/nix
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

sept rice

Browse source
This commit is contained in:
iofq 2025-08-03 10:38:37 -05:00
parent 89ab499605
commit 66ba28aaf3
12 changed files with 572 additions and 293 deletions
Download patch file Download diff file Expand all files Collapse all files

11
nixos/consensus/backups.nix
View file

@ -1,10 +1,11 @@
{config, ...}: {
{ config, ... }:
{
sops = {
defaultSopsFile = ../../secrets/restic.yaml;
secrets = {
"b2-immich/env" = {};
"b2-immich/repo" = {};
"b2-immich/password" = {};
"b2-immich/env" = { };
"b2-immich/repo" = { };
"b2-immich/password" = { };
};
};
services.restic.backups = {
@ -15,7 +16,7 @@
passwordFile = config.sops.secrets."b2-immich/password".path;
paths = [
"/rice/immich"
"/srv/immich"
];
timerConfig = {
OnCalendar = "06:00";

55
nixos/consensus/configuration.nix
View file

@ -3,14 +3,17 @@
pkgs,
config,
...
}: {
}:
{
imports = [
./hardware-configuration.nix
./backups.nix
];
sops = {
secrets = {
"env" = {sopsFile = ../../secrets/cf-acme.yaml;};
"env" = {
sopsFile = ../../secrets/cf-acme.yaml;
};
};
};
documentation = {
@ -55,7 +58,7 @@
};
openssh = {
enable = true;
ports = [2022];
ports = [ 2022 ];
settings = {
PasswordAuthentication = false;
PermitRootLogin = "prohibit-password";
@ -81,19 +84,19 @@
];
};
immich = {
# enable = true;
enable = false;
port = 2283;
host = "localhost";
openFirewall = true;
machine-learning.enable = true;
mediaLocation = "/rice/immich";
mediaLocation = "/srv/immich";
};
nginx = {
enable = true;
virtualHosts."img.10110110.xyz" = {
useACMEHost = "10110110.xyz";
forceSSL = true;
enable = false;
virtualHosts."img.consensus.tailc353f.ts.net" = {
# forceSSL = true;
# sslCertificate = "/etc/nginx/certs/consensus.tailc353f.ts.net.crt";
# sslCertificateKey = "/etc/nginx/certs/consensus.tailc353f.ts.net.key";
locations."/" = {
proxyPass = "http://localhost:${toString config.services.immich.port}";
proxyWebsockets = true;
@ -145,31 +148,33 @@
};
users.users = {
root = {
openssh.authorizedKeys.keys = [''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHM4Zr0PFN7QdOG2aJ+nuzRCK6caulrpY6bphA1Ppl8Y e@t14''];
openssh.authorizedKeys.keys = [
''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHM4Zr0PFN7QdOG2aJ+nuzRCK6caulrpY6bphA1Ppl8Y e@t14''
];
};
e = {
isNormalUser = true;
extraGroups = ["wheel"];
extraGroups = [ "wheel" ];
home = "/home/e";
openssh.authorizedKeys.keys = [
''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHM4Zr0PFN7QdOG2aJ+nuzRCK6caulrpY6bphA1Ppl8Y e@t14''
''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAdo4PS8myKaKAdyIqSFj2VJ+oZ9DNRIp7PBz8IWKjjy''
''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJou+k8HtIWdlztpWog7fVfJgxJnRIo7c5xVPUBhBxhi'' # phone
];
};
};
security.sudo-rs.wheelNeedsPassword = false;
security.acme = {
acceptTerms = true;
defaults.email = "acme@10110110.xyz";
certs = {
"10110110.xyz" = {
domain = "*.10110110.xyz";
group = config.services.nginx.group;
dnsProvider = "cloudflare";
environmentFile = config.sops.secrets."env".path;
};
};
};
nix.settings.trusted-users = ["e"];
# security.acme = {
# acceptTerms = true;
# defaults.email = "acme@10110110.xyz";
# certs = {
# "10110110.xyz" = {
# domain = "*.10110110.xyz";
# group = config.services.nginx.group;
# dnsProvider = "cloudflare";
# environmentFile = config.sops.secrets."env".path;
# };
# };
# };
nix.settings.trusted-users = [ "e" ];
system.stateVersion = "23.11";
}

18
nixos/consensus/hardware-configuration.nix
View file

@ -2,11 +2,17 @@
lib,
modulesPath,
...
}: {
imports = [(modulesPath + "/profiles/qemu-guest.nix")];
}:
{
imports = [ (modulesPath + "/profiles/qemu-guest.nix") ];
boot.loader.grub.device = "/dev/nvme0n1";
boot.initrd.availableKernelModules = ["ata_piix" "uhci_hcd" "xen_blkfront" "vmw_pvscsi"];
boot.initrd.kernelModules = ["nvme"];
boot.initrd.availableKernelModules = [
"ata_piix"
"uhci_hcd"
"xen_blkfront"
"vmw_pvscsi"
];
boot.initrd.kernelModules = [ "nvme" ];
fileSystems."/" = {
device = "/dev/mapper/vg-root";
fsType = "btrfs";
@ -15,5 +21,9 @@
device = "/dev/mapper/vg-var";
fsType = "btrfs";
};
fileSystems."/srv" = {
device = "/dev/ext/srv";
fsType = "ext4";
};
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
}