add homelab, nc
This commit is contained in:
parent
ab7d7e6b81
commit
e179c6e9d5
10 changed files with 206 additions and 40 deletions
|
|
@ -4,7 +4,8 @@
|
|||
];
|
||||
environment.systemPackages = with pkgs; [
|
||||
git
|
||||
vim
|
||||
nvim-pkg
|
||||
docker-compose
|
||||
];
|
||||
boot.tmp.cleanOnBoot = true;
|
||||
zramSwap.enable = false;
|
||||
|
|
@ -14,6 +15,7 @@
|
|||
size = 4 * 1024;
|
||||
}
|
||||
];
|
||||
virtualisation.docker.enable = true;
|
||||
networking = {
|
||||
hostName = "consensus";
|
||||
firewall = {
|
||||
|
|
@ -21,19 +23,25 @@
|
|||
allowedTCPPorts = [
|
||||
22
|
||||
2022
|
||||
3610
|
||||
6443
|
||||
25565
|
||||
9002
|
||||
30001
|
||||
30303
|
||||
30304
|
||||
];
|
||||
allowedUDPPorts = [
|
||||
9002
|
||||
30001
|
||||
30303
|
||||
30304
|
||||
];
|
||||
logRefusedConnections = true;
|
||||
};
|
||||
};
|
||||
services = {
|
||||
tailscale.enable = true;
|
||||
k3s = {
|
||||
enable = true;
|
||||
role = "server";
|
||||
|
|
@ -58,7 +66,10 @@
|
|||
isNormalUser = true;
|
||||
extraGroups = ["wheel"];
|
||||
home = "/home/e";
|
||||
openssh.authorizedKeys.keys = [''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHM4Zr0PFN7QdOG2aJ+nuzRCK6caulrpY6bphA1Ppl8Y e@t14''];
|
||||
openssh.authorizedKeys.keys = [
|
||||
''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHM4Zr0PFN7QdOG2aJ+nuzRCK6caulrpY6bphA1Ppl8Y e@t14''
|
||||
''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAdo4PS8myKaKAdyIqSFj2VJ+oZ9DNRIp7PBz8IWKjjy''
|
||||
];
|
||||
};
|
||||
};
|
||||
security.sudo.wheelNeedsPassword = false;
|
||||
|
|
|
|||
|
|
@ -1,6 +1,7 @@
|
|||
{
|
||||
inputs,
|
||||
pkgs,
|
||||
pkgs-stable,
|
||||
attrs,
|
||||
system,
|
||||
...
|
||||
|
|
@ -38,7 +39,23 @@ in {
|
|||
defaultModules
|
||||
++ [
|
||||
./configuration.nix
|
||||
./consensus/./configuration.nix
|
||||
./consensus/configuration.nix
|
||||
];
|
||||
};
|
||||
nc = inputs.nixpkgs-stable.lib.nixosSystem {
|
||||
specialArgs = {
|
||||
pkgs = pkgs-stable;
|
||||
inherit inputs system attrs;
|
||||
host = {
|
||||
hostName = "consensus";
|
||||
inherit (attrs) username;
|
||||
};
|
||||
};
|
||||
modules =
|
||||
defaultModules
|
||||
++ [
|
||||
./configuration.nix
|
||||
./nc/configuration.nix
|
||||
];
|
||||
};
|
||||
}
|
||||
|
|
|
|||
87
nixos/nc/configuration.nix
Normal file
87
nixos/nc/configuration.nix
Normal file
|
|
@ -0,0 +1,87 @@
|
|||
{
|
||||
pkgs,
|
||||
...
|
||||
}: {
|
||||
imports = [
|
||||
./hardware-configuration.nix
|
||||
./k3s.nix
|
||||
];
|
||||
environment.systemPackages = with pkgs; [
|
||||
vim
|
||||
git
|
||||
docker-compose
|
||||
];
|
||||
programs.nix-index.enableBashIntegration = false;
|
||||
programs.nix-index.enableZshIntegration = false;
|
||||
programs.nix-index-database.comma.enable = true;
|
||||
time.timeZone = "America/Chicago";
|
||||
|
||||
virtualisation.docker = {
|
||||
enable = true;
|
||||
daemon.settings = {
|
||||
data-root = "/eth2/docker";
|
||||
};
|
||||
};
|
||||
# Enable flakes and unfree packages
|
||||
nix.settings = {
|
||||
auto-optimise-store = true;
|
||||
substituters = ["https://cache.nixos.org"];
|
||||
experimental-features = ["nix-command" "flakes"];
|
||||
};
|
||||
nix.gc = {
|
||||
automatic = true;
|
||||
dates = "00:00";
|
||||
options = "--delete-older-than 14d";
|
||||
};
|
||||
networking = {
|
||||
firewall = {
|
||||
enable = true;
|
||||
allowedTCPPorts = [
|
||||
22
|
||||
9000
|
||||
30001
|
||||
30303
|
||||
30304
|
||||
];
|
||||
logRefusedConnections = true;
|
||||
};
|
||||
};
|
||||
services = {
|
||||
tailscale.enable = true;
|
||||
openssh = {
|
||||
enable = true;
|
||||
settings = {
|
||||
PasswordAuthentication = false;
|
||||
PermitRootLogin = "prohibit-password";
|
||||
};
|
||||
};
|
||||
fail2ban.enable = true;
|
||||
};
|
||||
users.users = {
|
||||
root = {
|
||||
openssh.authorizedKeys.keys = [''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHM4Zr0PFN7QdOG2aJ+nuzRCK6caulrpY6bphA1Ppl8Y e@t14''];
|
||||
};
|
||||
e = {
|
||||
isNormalUser = true;
|
||||
extraGroups = [
|
||||
"wheel"
|
||||
"docker"
|
||||
];
|
||||
openssh.authorizedKeys.keys = [''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHM4Zr0PFN7QdOG2aJ+nuzRCK6caulrpY6bphA1Ppl8Y e@t14''];
|
||||
};
|
||||
hd = {
|
||||
isNormalUser = true;
|
||||
extraGroups = [
|
||||
"docker"
|
||||
];
|
||||
};
|
||||
charon = {
|
||||
isNormalUser = true;
|
||||
extraGroups = [
|
||||
"docker"
|
||||
];
|
||||
};
|
||||
};
|
||||
security.sudo.wheelNeedsPassword = false;
|
||||
system.stateVersion = "23.11";
|
||||
}
|
||||
20
nixos/nc/hardware-configuration.nix
Executable file
20
nixos/nc/hardware-configuration.nix
Executable file
|
|
@ -0,0 +1,20 @@
|
|||
{
|
||||
modulesPath,
|
||||
lib,
|
||||
config,
|
||||
...
|
||||
}: {
|
||||
imports = [ (modulesPath + "/profiles/qemu-guest.nix") ];
|
||||
boot.loader.grub.device = "/dev/vda";
|
||||
boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "xen_blkfront" "vmw_pvscsi" ];
|
||||
boot.initrd.kernelModules = [ "nvme" ];
|
||||
fileSystems."/" = { device = "/dev/vda3"; fsType = "ext4"; };
|
||||
boot = {
|
||||
kernelModules = ["kvm-intel"];
|
||||
tmp.cleanOnBoot = true;
|
||||
};
|
||||
|
||||
zramSwap.enable = false;
|
||||
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
|
||||
hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
|
||||
}
|
||||
16
nixos/nc/k3s.nix
Normal file
16
nixos/nc/k3s.nix
Normal file
|
|
@ -0,0 +1,16 @@
|
|||
{pkgs, ...}: {
|
||||
environment.systemPackages = with pkgs; [
|
||||
k3s
|
||||
];
|
||||
services.k3s = {
|
||||
enable = true;
|
||||
role = "server";
|
||||
extraFlags = toString [
|
||||
"--disable traefik"
|
||||
"--tls-san nc.tailc353f.ts.net"
|
||||
"--node-ip 100.67.112.98"
|
||||
"--advertise-address 100.67.112.98"
|
||||
"--node-external-ip 94.16.113.7"
|
||||
];
|
||||
};
|
||||
}
|
||||
|
|
@ -1,5 +1,4 @@
|
|||
{
|
||||
config,
|
||||
pkgs,
|
||||
attrs,
|
||||
...
|
||||
|
|
@ -9,7 +8,6 @@
|
|||
in {
|
||||
imports = [
|
||||
./hardware-configuration.nix
|
||||
./nano.nix
|
||||
./backups.nix
|
||||
];
|
||||
environment.systemPackages = with pkgs; [
|
||||
|
|
@ -21,14 +19,12 @@ in {
|
|||
boot = {
|
||||
loader.systemd-boot.enable = true;
|
||||
loader.efi.canTouchEfiVariables = true;
|
||||
supportedFilesystems = ["zfs"];
|
||||
kernelPackages = config.boot.zfs.package.latestCompatibleLinuxPackages;
|
||||
zfs.forceImportRoot = false;
|
||||
kernelPackages = pkgs.linuxPackages_latest;
|
||||
};
|
||||
# Networking
|
||||
networking = {
|
||||
hostId = "1185c58e";
|
||||
nameservers = ["1.1.1.1#one.one.one.one"];
|
||||
nameservers = ["100.114.91.10"];
|
||||
networkmanager = {
|
||||
enable = true;
|
||||
dns = "systemd-resolved";
|
||||
|
|
@ -67,11 +63,8 @@ in {
|
|||
resolved = {
|
||||
enable = true;
|
||||
fallbackDns = [
|
||||
"1.1.1.1#one.one.one.one"
|
||||
"1.1.1.1"
|
||||
];
|
||||
extraConfig = ''
|
||||
DNSOverTLS=yes
|
||||
'';
|
||||
};
|
||||
tailscale.enable = true;
|
||||
avahi.enable = true; # chromecast
|
||||
|
|
@ -80,7 +73,6 @@ in {
|
|||
alsa.enable = true;
|
||||
pulse.enable = true;
|
||||
};
|
||||
flatpak.enable = true;
|
||||
dbus.enable = true;
|
||||
|
||||
tlp = {
|
||||
|
|
@ -106,6 +98,10 @@ in {
|
|||
};
|
||||
};
|
||||
};
|
||||
udev.packages = [
|
||||
pkgs.ledger-udev-rules
|
||||
pkgs.trezor-udev-rules
|
||||
];
|
||||
};
|
||||
|
||||
# workaround for wait-online killing nixos build
|
||||
|
|
@ -122,6 +118,8 @@ in {
|
|||
pkgs.libGL
|
||||
];
|
||||
};
|
||||
hardware.ledger.enable = true;
|
||||
services.trezord.enable = true;
|
||||
|
||||
# Set a sane system-wide default font
|
||||
fonts.packages = with pkgs; [
|
||||
|
|
|
|||
|
|
@ -1,15 +0,0 @@
|
|||
_: {
|
||||
services.udev.extraRules = ''
|
||||
SUBSYSTEMS=="usb", ATTRS{idVendor}=="2581", ATTRS{idProduct}=="1b7c", MODE="0660", TAG+="uaccess", TAG+="udev-acl"
|
||||
SUBSYSTEMS=="usb", ATTRS{idVendor}=="2581", ATTRS{idProduct}=="2b7c", MODE="0660", TAG+="uaccess", TAG+="udev-acl"
|
||||
SUBSYSTEMS=="usb", ATTRS{idVendor}=="2581", ATTRS{idProduct}=="3b7c", MODE="0660", TAG+="uaccess", TAG+="udev-acl"
|
||||
SUBSYSTEMS=="usb", ATTRS{idVendor}=="2581", ATTRS{idProduct}=="4b7c", MODE="0660", TAG+="uaccess", TAG+="udev-acl"
|
||||
SUBSYSTEMS=="usb", ATTRS{idVendor}=="2581", ATTRS{idProduct}=="1807", MODE="0660", TAG+="uaccess", TAG+="udev-acl"
|
||||
SUBSYSTEMS=="usb", ATTRS{idVendor}=="2581", ATTRS{idProduct}=="1808", MODE="0660", TAG+="uaccess", TAG+="udev-acl"
|
||||
SUBSYSTEMS=="usb", ATTRS{idVendor}=="2c97", ATTRS{idProduct}=="0000", MODE="0660", TAG+="uaccess", TAG+="udev-acl"
|
||||
SUBSYSTEMS=="usb", ATTRS{idVendor}=="2c97", ATTRS{idProduct}=="0001", MODE="0660", TAG+="uaccess", TAG+="udev-acl"
|
||||
SUBSYSTEMS=="usb", ATTRS{idVendor}=="2c97", ATTRS{idProduct}=="0004", MODE="0660", TAG+="uaccess", TAG+="udev-acl"
|
||||
SUBSYSTEMS=="usb", ATTRS{idVendor}=="2c97", ATTRS{idProduct}=="1011", MODE="0660", GROUP="plugdev"
|
||||
SUBSYSTEMS=="usb", ATTRS{idVendor}=="2c97", ATTRS{idProduct}=="1015", MODE="0660", GROUP="plugdev"
|
||||
'';
|
||||
}
|
||||
Loading…
Add table
Add a link
Reference in a new issue