parent
3f81a20e87
commit
77164adab6
12 changed files with 412 additions and 485 deletions
|
|
@ -1,14 +1,16 @@
|
|||
{
|
||||
inputs,
|
||||
pkgs,
|
||||
host,
|
||||
...
|
||||
}: {
|
||||
}:
|
||||
{
|
||||
# Create plugdev group
|
||||
networking.hostName = host.hostName;
|
||||
time.timeZone = "America/Chicago";
|
||||
users = {
|
||||
groups.plugdev = {};
|
||||
groups.${host.username} = {};
|
||||
groups.plugdev = { };
|
||||
groups.${host.username} = { };
|
||||
users.${host.username} = {
|
||||
isNormalUser = true;
|
||||
group = "${host.username}";
|
||||
|
|
@ -31,23 +33,29 @@
|
|||
|
||||
# Enable flakes and unfree packages
|
||||
nix = {
|
||||
package = pkgs.nixVersions.nix_2_31; # https://github.com/serokell/deploy-rs/issues/340
|
||||
registry.nixpkgs.flake = inputs.nixpkgs;
|
||||
settings = {
|
||||
auto-optimise-store = true;
|
||||
substituters = [
|
||||
"https://nix-community.cachix.org"
|
||||
"https://install.determinate.systems"
|
||||
"https://nvim-treesitter-main.cachix.org"
|
||||
];
|
||||
trusted-public-keys = [
|
||||
"nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
|
||||
"cache.flakehub.com-3:hJuILl5sVK4iKm86JzgdXW12Y2Hwd5G07qKtHTOcDCM="
|
||||
"nvim-treesitter-main.cachix.org-1:cbwE6blfW5+BkXXyeAXoVSu1gliqPLHo2m98E4hWfZQ="
|
||||
];
|
||||
trusted-users = [host.username];
|
||||
experimental-features = ["nix-command" "flakes"];
|
||||
lazy-trees = true;
|
||||
trusted-users = [ host.username ];
|
||||
experimental-features = [
|
||||
"nix-command"
|
||||
"flakes"
|
||||
];
|
||||
# lazy-trees = true; # https://github.com/serokell/deploy-rs/issues/340
|
||||
};
|
||||
channel.enable = false;
|
||||
nixPath = ["nixpkgs=flake:nixpkgs"];
|
||||
nixPath = [ "nixpkgs=flake:nixpkgs" ];
|
||||
gc = {
|
||||
automatic = true;
|
||||
dates = "00:00";
|
||||
|
|
|
|||
|
|
@ -8,7 +8,6 @@
|
|||
imports = [
|
||||
./hardware-configuration.nix
|
||||
./backups.nix
|
||||
./forgejo-runner.nix
|
||||
];
|
||||
sops = {
|
||||
secrets = {
|
||||
|
|
@ -95,49 +94,55 @@
|
|||
mediaLocation = "/srv/immich";
|
||||
};
|
||||
nginx = {
|
||||
enable = false;
|
||||
virtualHosts."img.10110110.xyz" = {
|
||||
enable = true;
|
||||
# virtualHosts."img.10110110.xyz" = {
|
||||
# forceSSL = true;
|
||||
# useACMEHost = "10110110.xyz";
|
||||
# locations."/" = {
|
||||
# proxyPass = "http://localhost:${toString config.services.immich.port}";
|
||||
# proxyWebsockets = true;
|
||||
# recommendedProxySettings = true;
|
||||
# extraConfig = ''
|
||||
# client_max_body_size 50000M;
|
||||
# proxy_read_timeout 600s;
|
||||
# proxy_send_timeout 600s;
|
||||
# send_timeout 600s;
|
||||
# '';
|
||||
# };
|
||||
# };
|
||||
virtualHosts."fs.10110110.xyz" = {
|
||||
forceSSL = true;
|
||||
useACMEHost = "10110110.xyz";
|
||||
locations."/" = {
|
||||
proxyPass = "http://localhost:${toString config.services.immich.port}";
|
||||
proxyWebsockets = true;
|
||||
recommendedProxySettings = true;
|
||||
extraConfig = ''
|
||||
client_max_body_size 50000M;
|
||||
proxy_read_timeout 600s;
|
||||
proxy_send_timeout 600s;
|
||||
send_timeout 600s;
|
||||
'';
|
||||
};
|
||||
root = "/var/www/nginx";
|
||||
extraConfig = "autoindex on;";
|
||||
};
|
||||
};
|
||||
};
|
||||
boot = {
|
||||
kernel.sysctl = {
|
||||
"vm.swappiness" = 6;
|
||||
};
|
||||
tmp.cleanOnBoot = true;
|
||||
# supportedFilesystems = ["zfs"];
|
||||
# zfs.forceImportRoot = false;
|
||||
# zfs.extraPools = ["rice"];
|
||||
};
|
||||
networking.hostId = "91238132";
|
||||
zramSwap.enable = false;
|
||||
swapDevices = [
|
||||
{
|
||||
device = "/swapfile";
|
||||
size = 16 * 1024;
|
||||
}
|
||||
];
|
||||
virtualisation.docker.enable = true;
|
||||
networking = {
|
||||
hostId = "91238132";
|
||||
hostName = "consensus";
|
||||
firewall = {
|
||||
enable = true;
|
||||
allowedTCPPorts = [
|
||||
22
|
||||
80
|
||||
443
|
||||
2022
|
||||
8080
|
||||
8443
|
||||
10001
|
||||
6443
|
||||
25565
|
||||
25566
|
||||
9001
|
||||
30303
|
||||
];
|
||||
|
|
@ -147,7 +152,17 @@
|
|||
];
|
||||
logRefusedConnections = true;
|
||||
};
|
||||
|
||||
};
|
||||
zramSwap.enable = false;
|
||||
swapDevices = [
|
||||
{
|
||||
device = "/swapfile";
|
||||
size = 16 * 1024;
|
||||
}
|
||||
];
|
||||
virtualisation.docker.enable = true;
|
||||
|
||||
users.users = {
|
||||
root = {
|
||||
openssh.authorizedKeys.keys = [
|
||||
|
|
@ -165,18 +180,18 @@
|
|||
};
|
||||
};
|
||||
security.sudo-rs.wheelNeedsPassword = false;
|
||||
# security.acme = {
|
||||
# acceptTerms = true;
|
||||
# defaults.email = "acme@10110110.xyz";
|
||||
# certs = {
|
||||
# "10110110.xyz" = {
|
||||
# domain = "*.10110110.xyz";
|
||||
# group = config.services.nginx.group;
|
||||
# dnsProvider = "cloudflare";
|
||||
# environmentFile = config.sops.secrets."env".path;
|
||||
# };
|
||||
# };
|
||||
# };
|
||||
security.acme = {
|
||||
acceptTerms = true;
|
||||
defaults.email = "acme@10110110.xyz";
|
||||
certs = {
|
||||
"10110110.xyz" = {
|
||||
domain = "*.10110110.xyz";
|
||||
group = config.services.nginx.group;
|
||||
dnsProvider = "cloudflare";
|
||||
environmentFile = config.sops.secrets."env".path;
|
||||
};
|
||||
};
|
||||
};
|
||||
nix.settings.trusted-users = [ "e" ];
|
||||
system.stateVersion = "23.11";
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,24 +0,0 @@
|
|||
{ pkgs, config, ... }:
|
||||
{
|
||||
sops = {
|
||||
secrets = {
|
||||
"forgejo-runner" = {
|
||||
sopsFile = ../../secrets/forgejo-runner.yaml;
|
||||
};
|
||||
};
|
||||
};
|
||||
services.gitea-actions-runner = {
|
||||
package = pkgs.forgejo-actions-runner;
|
||||
instances.default = {
|
||||
enable = true;
|
||||
name = "runner-1";
|
||||
url = "https://git.10110110.xyz";
|
||||
tokenFile = config.sops.secrets."forgejo-runner".path;
|
||||
labels = [
|
||||
"ubuntu-latest:docker://node:20-bullseye"
|
||||
"nix-upstream-latest:docker://nixos/nix:latest"
|
||||
"native:host"
|
||||
];
|
||||
};
|
||||
};
|
||||
}
|
||||
43
nixos/consensus/hypervisor/configuration.nix
Normal file
43
nixos/consensus/hypervisor/configuration.nix
Normal file
|
|
@ -0,0 +1,43 @@
|
|||
{ name, attrs, ... }:
|
||||
{
|
||||
systemd.network = {
|
||||
enable = true;
|
||||
networks."20-lan" = {
|
||||
matchConfig.Type = "ether";
|
||||
networkConfig = {
|
||||
Address = [ (attrs.${name}.ipv4 + attrs.${name}.subnet) ];
|
||||
Gateway = "10.0.0.1";
|
||||
DNS = [ "1.1.1.1" ];
|
||||
IPv6AcceptRA = true;
|
||||
DHCP = "no";
|
||||
};
|
||||
};
|
||||
};
|
||||
services.openssh = {
|
||||
enable = true;
|
||||
settings.PasswordAuthentication = false;
|
||||
settings.KbdInteractiveAuthentication = false;
|
||||
};
|
||||
networking.firewall = {
|
||||
enable = true;
|
||||
allowedTCPPorts = [ 22 ];
|
||||
allowedUDPPorts = [ ];
|
||||
logRefusedConnections = true;
|
||||
};
|
||||
users.users = {
|
||||
root = {
|
||||
openssh.authorizedKeys.keys = [
|
||||
''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIItTJm2iu/5xacOoh4/JAvMtHE62duDlVVXpvVP+uQMR root@htz''
|
||||
''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILU2TUxKyGKoZ68IG4hw23RmxVf72u5K9W0StkgTr0b2 e@t14''
|
||||
];
|
||||
};
|
||||
e = {
|
||||
isNormalUser = true;
|
||||
extraGroups = [ "wheel" ];
|
||||
openssh.authorizedKeys.keys = [
|
||||
''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIItTJm2iu/5xacOoh4/JAvMtHE62duDlVVXpvVP+uQMR root@htz''
|
||||
''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILU2TUxKyGKoZ68IG4hw23RmxVf72u5K9W0StkgTr0b2 e@t14''
|
||||
];
|
||||
};
|
||||
};
|
||||
}
|
||||
37
nixos/consensus/hypervisor/default.nix
Normal file
37
nixos/consensus/hypervisor/default.nix
Normal file
|
|
@ -0,0 +1,37 @@
|
|||
{ lib, pkgs, ... }:
|
||||
let
|
||||
attrs = {
|
||||
forgejo-runner = {
|
||||
ipv4 = "10.0.0.2";
|
||||
subnet = "/24";
|
||||
mac = "02:00:00:00:00:01";
|
||||
};
|
||||
};
|
||||
genVMConfig = name: addr: {
|
||||
restartIfChanged = true;
|
||||
pkgs = pkgs;
|
||||
config = {
|
||||
microvm = {
|
||||
shares = lib.mkIf (addr.ro-store == true) [
|
||||
{
|
||||
source = "/nix/store";
|
||||
mountPoint = "/nix/.ro-store";
|
||||
tag = "ro-store";
|
||||
proto = "virtiofs";
|
||||
}
|
||||
];
|
||||
interfaces = [
|
||||
{
|
||||
type = "tap";
|
||||
id = name;
|
||||
mac = attrs.${name}.mac;
|
||||
}
|
||||
];
|
||||
};
|
||||
}
|
||||
// import ./configuration.nix { inherit name attrs; };
|
||||
};
|
||||
in
|
||||
{
|
||||
microvm.vms = lib.mapAttrs genVMConfig attrs;
|
||||
}
|
||||
35
nixos/consensus/hypervisor/forgejo-runner.nix
Normal file
35
nixos/consensus/hypervisor/forgejo-runner.nix
Normal file
|
|
@ -0,0 +1,35 @@
|
|||
{
|
||||
inputs,
|
||||
pkgs,
|
||||
...
|
||||
}:
|
||||
{
|
||||
pkgs = pkgs;
|
||||
config =
|
||||
{ config, ... }:
|
||||
{
|
||||
imports = [
|
||||
inputs.sops-nix.nixosModules.sops
|
||||
];
|
||||
sops = {
|
||||
secrets = {
|
||||
forgejo-runner = {
|
||||
sopsFile = ../../secrets/forgejo-runner.yaml;
|
||||
};
|
||||
};
|
||||
};
|
||||
services.gitea-actions-runner = {
|
||||
package = pkgs.forgejo-actions-runner;
|
||||
instances.default = {
|
||||
enable = true;
|
||||
name = "runner-1";
|
||||
url = "https://git.10110110.xyz";
|
||||
tokenFile = config.sops.secrets.forgejo-runner.path;
|
||||
labels = [
|
||||
"ubuntu-latest:docker://node:20-bullseye"
|
||||
"nix-upstream-latest:docker://nixos/nix:latest"
|
||||
];
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
@ -10,7 +10,7 @@ let
|
|||
./configuration.nix
|
||||
inputs.sops-nix.nixosModules.sops
|
||||
inputs.nix-index-database.nixosModules.nix-index
|
||||
inputs.determinate.nixosModules.default
|
||||
# inputs.determinate.nixosModules.default # https://github.com/serokell/deploy-rs/issues/340
|
||||
];
|
||||
in
|
||||
{
|
||||
|
|
@ -38,6 +38,7 @@ in
|
|||
};
|
||||
};
|
||||
modules = defaultModules ++ [
|
||||
inputs.microvm.nixosModules.host
|
||||
./consensus/configuration.nix
|
||||
];
|
||||
};
|
||||
|
|
|
|||
|
|
@ -2,10 +2,12 @@
|
|||
pkgs,
|
||||
attrs,
|
||||
...
|
||||
}: let
|
||||
}:
|
||||
let
|
||||
# Horrid workaround for https://github.com/nix-community/home-manager/issues/1011
|
||||
homeManagerSessionVars = "/etc/profiles/per-user/${attrs.username}/etc/profile.d/hm-session-vars.sh";
|
||||
in {
|
||||
in
|
||||
{
|
||||
imports = [
|
||||
./hardware-configuration.nix
|
||||
./backups.nix
|
||||
|
|
@ -24,14 +26,18 @@ in {
|
|||
loader.systemd-boot.enable = true;
|
||||
loader.efi.canTouchEfiVariables = true;
|
||||
kernelPackages = pkgs.linuxPackages_latest;
|
||||
blacklistedKernelModules = ["bluetooth"];
|
||||
blacklistedKernelModules = [ "bluetooth" ];
|
||||
kernel.sysctl = {
|
||||
"net.core.rmem_max" = 4194304;
|
||||
"net.core.wmem_max" = 4194304;
|
||||
};
|
||||
};
|
||||
# Networking
|
||||
networking = {
|
||||
hostId = "1185c58e";
|
||||
nameservers = [
|
||||
"9.9.9.9"
|
||||
"1.1.1.1"
|
||||
"9.9.9.9"
|
||||
];
|
||||
networkmanager = {
|
||||
enable = true;
|
||||
|
|
@ -39,9 +45,9 @@ in {
|
|||
};
|
||||
firewall = {
|
||||
enable = true;
|
||||
allowedTCPPorts = [11111];
|
||||
allowedUDPPorts = [];
|
||||
trustedInterfaces = ["tailscale0"];
|
||||
allowedTCPPorts = [ 11111 ];
|
||||
allowedUDPPorts = [ ];
|
||||
trustedInterfaces = [ "tailscale0" ];
|
||||
logRefusedConnections = true;
|
||||
};
|
||||
};
|
||||
|
|
@ -53,11 +59,11 @@ in {
|
|||
};
|
||||
};
|
||||
|
||||
security.pam.services.swaylock = {};
|
||||
security.pam.services.swaylock = { };
|
||||
xdg.portal = {
|
||||
enable = true;
|
||||
xdgOpenUsePortal = false;
|
||||
extraPortals = [pkgs.xdg-desktop-portal-gtk];
|
||||
extraPortals = [ pkgs.xdg-desktop-portal-gtk ];
|
||||
};
|
||||
programs = {
|
||||
light.enable = true;
|
||||
|
|
@ -87,7 +93,6 @@ in {
|
|||
enable32Bit = true;
|
||||
extraPackages = [
|
||||
pkgs.mesa
|
||||
pkgs.amdvlk
|
||||
pkgs.libGL
|
||||
];
|
||||
};
|
||||
|
|
@ -135,7 +140,7 @@ in {
|
|||
enable = true;
|
||||
keyboards = {
|
||||
default = {
|
||||
ids = ["*"];
|
||||
ids = [ "*" ];
|
||||
settings = {
|
||||
main = {
|
||||
pause = "timeout(esc, 150, space)";
|
||||
|
|
@ -160,7 +165,7 @@ in {
|
|||
nerd-fonts.ubuntu-mono
|
||||
spleen
|
||||
];
|
||||
fontconfig.defaultFonts.monospace = ["UbuntuMono"];
|
||||
fontconfig.defaultFonts.monospace = [ "UbuntuMono" ];
|
||||
};
|
||||
system.stateVersion = "22.11";
|
||||
}
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue