add homelab, nc

nixos/nc/configuration.nix

@@ -0,0 +1,87 @@
+{
+  pkgs,
+  ...
+}: {
+  imports = [
+    ./hardware-configuration.nix
+    ./k3s.nix
+  ];
+  environment.systemPackages = with pkgs; [
+    vim
+    git
+    docker-compose
+  ];
+  programs.nix-index.enableBashIntegration = false;
+  programs.nix-index.enableZshIntegration = false;
+  programs.nix-index-database.comma.enable = true;
+  time.timeZone = "America/Chicago";
+
+  virtualisation.docker = {
+    enable = true;
+    daemon.settings = {
+      data-root = "/eth2/docker";
+    };
+  };
+  # Enable flakes and unfree packages
+  nix.settings = {
+    auto-optimise-store = true;
+    substituters = ["https://cache.nixos.org"];
+    experimental-features = ["nix-command" "flakes"];
+  };
+  nix.gc = {
+    automatic = true;
+    dates = "00:00";
+    options = "--delete-older-than 14d";
+  };
+  networking = {
+    firewall = {
+      enable = true;
+      allowedTCPPorts = [
+        22
+        9000
+        30001
+        30303
+        30304
+      ];
+      logRefusedConnections = true;
+    };
+  };
+  services = {
+    tailscale.enable = true;
+    openssh = {
+      enable = true;
+      settings = {
+        PasswordAuthentication = false;
+        PermitRootLogin = "prohibit-password";
+      };
+    };
+    fail2ban.enable = true;
+  };
+  users.users = {
+    root = {
+      openssh.authorizedKeys.keys = [''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHM4Zr0PFN7QdOG2aJ+nuzRCK6caulrpY6bphA1Ppl8Y e@t14''];
+    };
+    e = {
+      isNormalUser = true;
+      extraGroups = [
+        "wheel"
+        "docker"
+      ];
+      openssh.authorizedKeys.keys = [''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHM4Zr0PFN7QdOG2aJ+nuzRCK6caulrpY6bphA1Ppl8Y e@t14''];
+    };
+    hd = {
+      isNormalUser = true;
+      extraGroups = [
+        "docker"
+      ];
+    };
+    charon = {
+      isNormalUser = true;
+      extraGroups = [
+        "docker"
+      ];
+    };
+  };
+  security.sudo.wheelNeedsPassword = false;
+  system.stateVersion = "23.11";
+}

nixos/nc/hardware-configuration.nix

@@ -0,0 +1,20 @@
+{
+  modulesPath,
+  lib,
+  config,
+  ...
+}: {
+  imports = [ (modulesPath + "/profiles/qemu-guest.nix") ];
+  boot.loader.grub.device = "/dev/vda";
+  boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "xen_blkfront" "vmw_pvscsi" ];
+  boot.initrd.kernelModules = [ "nvme" ];
+  fileSystems."/" = { device = "/dev/vda3"; fsType = "ext4"; };
+  boot = {
+    kernelModules = ["kvm-intel"];
+    tmp.cleanOnBoot = true;
+  };
+
+  zramSwap.enable = false;
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+}

nixos/nc/k3s.nix

@@ -0,0 +1,16 @@
+{pkgs, ...}: {
+  environment.systemPackages = with pkgs; [
+    k3s
+  ];
+  services.k3s = {
+    enable = true;
+    role = "server";
+    extraFlags = toString [
+      "--disable traefik"
+      "--tls-san nc.tailc353f.ts.net"
+      "--node-ip 100.67.112.98"
+      "--advertise-address 100.67.112.98"
+      "--node-external-ip 94.16.113.7"
+    ];
+  };
+}