feat: integrated lb host into the config
parent
5455af3d42
commit
a16c36c7e4
|
@ -0,0 +1,94 @@
|
|||
{ config, pkgs, ... }:
|
||||
|
||||
{
|
||||
nix = {
|
||||
package = pkgs.nixFlakes;
|
||||
extraOptions = ''
|
||||
experimental-features = nix-command flakes
|
||||
'';
|
||||
optimise.automatic = true;
|
||||
gc = {
|
||||
automatic = true;
|
||||
options = "--delete-older-than 30d";
|
||||
};
|
||||
};
|
||||
|
||||
time.timeZone = "Europe/Madrid";
|
||||
|
||||
# Select internationalisation properties.
|
||||
i18n.defaultLocale = "en_US.UTF-8";
|
||||
console = {
|
||||
font = "Lat2-Terminus16";
|
||||
keyMap = "us";
|
||||
};
|
||||
|
||||
security = {
|
||||
doas = {
|
||||
enable = true;
|
||||
extraRules = [{
|
||||
groups = [ "wheel" ];
|
||||
keepEnv = true;
|
||||
noPass = true;
|
||||
}];
|
||||
};
|
||||
sudo.enable = false;
|
||||
};
|
||||
|
||||
environment.systemPackages = with pkgs; [ git vim wget just ripgrep ];
|
||||
|
||||
services.openssh = {
|
||||
enable = true;
|
||||
settings = {
|
||||
PermitRootLogin = "no";
|
||||
PasswordAuthentication = false;
|
||||
};
|
||||
|
||||
hostKeys = [{
|
||||
path = "/etc/ssh/ssh_host_ed25519_key";
|
||||
type = "ed25519";
|
||||
}];
|
||||
|
||||
knownHosts = {
|
||||
"*.monotremata.xyz,10.*,narwhal,suricata,pikvm,caladan,fugu,lb,snitch,trantor,capibara,axolotl" =
|
||||
{
|
||||
certAuthority = true;
|
||||
publicKey =
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHperHwojXZeo3QWAu1f3kiCKeaHHSqBXJM6ZZEefxdd host_ca";
|
||||
};
|
||||
};
|
||||
|
||||
extraConfig = ''
|
||||
HostCertificate /etc/ssh/ssh_host_ed25519_key-cert.pub
|
||||
TrustedUserCAKeys /etc/ssh/user_ca.pub
|
||||
'';
|
||||
};
|
||||
|
||||
users.mutableUsers = false;
|
||||
users.groups = {
|
||||
dags.gid = 506;
|
||||
};
|
||||
users.users = {
|
||||
|
||||
root = {
|
||||
initialHashedPassword = "$6$tzMk5I1KZlx7byaO$BvlSz7Cgo1g09e4RpxAjrZEuCptzjibF8nDWDfnOImTbz61Py/qzATDAa7HwAC3JyiZxb.2slTb.vA.f25ypd1";
|
||||
};
|
||||
|
||||
rilla = {
|
||||
uid = 1000;
|
||||
isNormalUser = true;
|
||||
extraGroups = [ "wheel" ]; # Enable ‘sudo’ for the user.
|
||||
initialHashedPassword = "$6$tzMk5I1KZlx7byaO$BvlSz7Cgo1g09e4RpxAjrZEuCptzjibF8nDWDfnOImTbz61Py/qzATDAa7HwAC3JyiZxb.2slTb.vA.f25ypd1";
|
||||
};
|
||||
|
||||
dags = {
|
||||
uid = 506;
|
||||
group = "dags";
|
||||
extraGroups = [ "wheel" ];
|
||||
createHome = false;
|
||||
isSystemUser = true;
|
||||
password = "*";
|
||||
useDefaultShell = true;
|
||||
};
|
||||
|
||||
};
|
||||
}
|
|
@ -1,14 +1,6 @@
|
|||
{ config, pkgs, ... }:
|
||||
|
||||
{
|
||||
nix = {
|
||||
package = pkgs.nixUnstable;
|
||||
extraOptions = ''
|
||||
experimental-features = nix-command flakes
|
||||
'';
|
||||
optimise.automatic = true;
|
||||
};
|
||||
|
||||
# boot.binfmt.emulatedSystems = [ "aarch64-linux" "qemu-aarch64" ];
|
||||
|
||||
networking = {
|
||||
|
@ -49,47 +41,13 @@
|
|||
};
|
||||
};
|
||||
|
||||
# Set your time zone.
|
||||
time.timeZone = "Europe/Madrid";
|
||||
|
||||
# Configure network proxy if necessary
|
||||
# networking.proxy.default = "http://user:password@proxy:port/";
|
||||
# networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";
|
||||
|
||||
# Select internationalisation properties.
|
||||
i18n.defaultLocale = "en_US.UTF-8";
|
||||
console = {
|
||||
font = "Lat2-Terminus16";
|
||||
keyMap = "us";
|
||||
};
|
||||
|
||||
services.dbus.enable = true;
|
||||
|
||||
services.xserver = {
|
||||
enable = true;
|
||||
layout = "us";
|
||||
xkbVariant = "altgr-intl";
|
||||
xkbOptions = "caps:escape";
|
||||
displayManager.startx.enable = true;
|
||||
libinput.enable = true;
|
||||
extraConfig = ''
|
||||
Section "InputClass"
|
||||
Identifier "trackball"
|
||||
MatchProduct "Clearly Superior Technologies. CST Laser Trackball"
|
||||
Driver "libinput"
|
||||
Option "ButtonMapping" "3 2 1 4 5"
|
||||
Option "AccelerationProfile" "0"
|
||||
Option "AccelerationScheme" "predictable"
|
||||
Option "AccelerationNumerator" "3"
|
||||
Option "AccelSpeed" "-0.9"
|
||||
EndSection
|
||||
'';
|
||||
};
|
||||
|
||||
services.tor.enable = true;
|
||||
|
||||
services.udev = { packages = [ pkgs.android-udev-rules ]; };
|
||||
|
||||
services.avahi.enable = true;
|
||||
|
||||
# Enable CUPS to print documents.
|
||||
|
@ -109,16 +67,6 @@
|
|||
jack.enable = true;
|
||||
};
|
||||
|
||||
security.doas = {
|
||||
enable = true;
|
||||
extraRules = [{
|
||||
groups = [ "wheel" ];
|
||||
keepEnv = true;
|
||||
noPass = true;
|
||||
}];
|
||||
};
|
||||
security.sudo.enable = true;
|
||||
|
||||
security.pam.services = {
|
||||
swaylock.text = ''
|
||||
auth include login
|
||||
|
@ -159,20 +107,15 @@
|
|||
# wget
|
||||
# firefox
|
||||
# ];
|
||||
environment.systemPackages = with pkgs; [ dmidecode flashrom git mbuffer ];
|
||||
environment.systemPackages = with pkgs; [ dmidecode flashrom mbuffer ];
|
||||
|
||||
# Enable touchpad support (enabled default in most desktopManager).
|
||||
|
||||
# Define a user account. Don't forget to set a password with ‘passwd’.
|
||||
users = {
|
||||
mutableUsers = false;
|
||||
groups = { plugdev = { }; };
|
||||
users = {
|
||||
root.initialHashedPassword =
|
||||
"$6$3TVh31LfZQFaZi8T$9.cNxrApCaAetC8wRJXxA5U9n4Hbta3CoggvG0HntTQ6sCRQWIV01EhIjdzJoZZ1kqF2ItWkF8Sqprl5raUKY0";
|
||||
rilla = {
|
||||
uid = 1000;
|
||||
isNormalUser = true;
|
||||
shell = pkgs.zsh;
|
||||
extraGroups = [
|
||||
"wheel"
|
||||
|
@ -192,19 +135,10 @@
|
|||
startGid = 100000;
|
||||
count = 65536;
|
||||
}];
|
||||
initialHashedPassword =
|
||||
"$6$tzMk5I1KZlx7byaO$BvlSz7Cgo1g09e4RpxAjrZEuCptzjibF8nDWDfnOImTbz61Py/qzATDAa7HwAC3JyiZxb.2slTb.vA.f25ypd1";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
# Some programs need SUID wrappers, can be configured further or are
|
||||
# started in user sessions.
|
||||
# programs.mtr.enable = true;
|
||||
# programs.gnupg.agent = {
|
||||
# enable = true;
|
||||
# enableSSHSupport = true;
|
||||
# };
|
||||
programs.mosh.enable = true;
|
||||
programs.zsh.enable = true;
|
||||
programs.slock.enable = true;
|
||||
|
@ -212,37 +146,8 @@
|
|||
programs.fuse.userAllowOther = true;
|
||||
programs.nix-ld.enable = true;
|
||||
|
||||
# List services that you want to enable:
|
||||
|
||||
services.pcscd.enable = true;
|
||||
|
||||
services.openssh = {
|
||||
enable = true;
|
||||
settings = {
|
||||
PermitRootLogin = "no";
|
||||
PasswordAuthentication = false;
|
||||
};
|
||||
|
||||
hostKeys = [{
|
||||
path = "/etc/ssh/ssh_host_ed25519_key";
|
||||
type = "ed25519";
|
||||
}];
|
||||
|
||||
knownHosts = {
|
||||
"*.monotremata.xyz,10.*,narwhal,suricata,pikvm,caladan,fugu,lb,snitch,trantor,capibara,axolotl" =
|
||||
{
|
||||
certAuthority = true;
|
||||
publicKey =
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHperHwojXZeo3QWAu1f3kiCKeaHHSqBXJM6ZZEefxdd host_ca";
|
||||
};
|
||||
};
|
||||
|
||||
extraConfig = ''
|
||||
HostCertificate /etc/ssh/ssh_host_ed25519_key-cert.pub
|
||||
TrustedUserCAKeys /etc/ssh/user_ca.pub
|
||||
'';
|
||||
};
|
||||
|
||||
virtualisation = {
|
||||
docker.enable = true;
|
||||
podman = {
|
||||
|
@ -277,16 +182,6 @@
|
|||
hardware.bluetooth.enable = true;
|
||||
services.blueman.enable = true;
|
||||
|
||||
fileSystems = {
|
||||
"/" = {
|
||||
device = "tmpfs";
|
||||
fsType = "tmpfs";
|
||||
options = [ "defaults" "size=2G" "mode=755" ];
|
||||
};
|
||||
};
|
||||
|
||||
swapDevices = [{ device = "/swap/swapfile"; }];
|
||||
|
||||
environment.persistence = {
|
||||
|
||||
"/mnt/persist" = {
|
13
flake.nix
13
flake.nix
|
@ -29,7 +29,7 @@
|
|||
};
|
||||
|
||||
modules = [
|
||||
./trantor.nix
|
||||
./hosts/trantor.nix
|
||||
home-manager.nixosModules.home-manager
|
||||
impermanence.nixosModules.impermanence
|
||||
];
|
||||
|
@ -44,12 +44,21 @@
|
|||
};
|
||||
|
||||
modules = [
|
||||
./capibara.nix
|
||||
./hosts/capibara.nix
|
||||
nixos-hardware.nixosModules.lenovo-thinkpad-x230
|
||||
home-manager.nixosModules.home-manager
|
||||
impermanence.nixosModules.impermanence
|
||||
];
|
||||
};
|
||||
|
||||
lb = nixpkgs-stable.lib.nixosSystem {
|
||||
system = "aarch64-linux";
|
||||
specialArgs = { impermanence = impermanence; };
|
||||
modules = [
|
||||
./hosts/lb.nix
|
||||
impermanence.nixosModules.impermanence
|
||||
];
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
|
@ -1,6 +1,3 @@
|
|||
# Do not modify this file! It was generated by ‘nixos-generate-config’
|
||||
# and may be overwritten by future invocations. Please make changes
|
||||
# to /etc/nixos/configuration.nix instead.
|
||||
{ config, lib, pkgs, modulesPath, ... }:
|
||||
|
||||
{
|
||||
|
|
|
@ -0,0 +1,21 @@
|
|||
{ config, lib, pkgs, modulesPath, ... }:
|
||||
|
||||
{
|
||||
imports = [ (modulesPath + "/installer/scan/not-detected.nix") ];
|
||||
|
||||
boot.initrd.availableKernelModules = [ "usbhid" "usb_storage" "sr_mod" ];
|
||||
boot.initrd.kernelModules = [ ];
|
||||
boot.kernelModules = [ ];
|
||||
boot.extraModulePackages = [ ];
|
||||
|
||||
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
|
||||
# (the default) this is the recommended approach. When using systemd-networkd it's
|
||||
# still possible to use this option, but it's recommended to use it in conjunction
|
||||
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
|
||||
networking.useDHCP = lib.mkDefault true;
|
||||
# networking.interfaces.enu1u1.useDHCP = lib.mkDefault true;
|
||||
# networking.interfaces.wlan0.useDHCP = lib.mkDefault true;
|
||||
|
||||
nixpkgs.hostPlatform = lib.mkDefault "aarch64-linux";
|
||||
powerManagement.cpuFreqGovernor = lib.mkDefault "ondemand";
|
||||
}
|
|
@ -24,14 +24,25 @@ let
|
|||
|
||||
in
|
||||
{
|
||||
imports = [ ./hardware-configuration/capibara.nix ./common.nix ];
|
||||
imports = [
|
||||
../hardware-configuration/capibara.nix
|
||||
../common
|
||||
../common/desktop.nix
|
||||
];
|
||||
|
||||
home-manager = {
|
||||
users.rilla.imports =
|
||||
[ home/capibara.nix "${impermanence}/home-manager.nix" ];
|
||||
users.rilla.imports = [
|
||||
../home/capibara.nix
|
||||
"${impermanence}/home-manager.nix"
|
||||
];
|
||||
};
|
||||
|
||||
fileSystems = {
|
||||
"/" = {
|
||||
device = "tmpfs";
|
||||
fsType = "tmpfs";
|
||||
options = [ "defaults" "size=2G" "mode=755" ];
|
||||
};
|
||||
|
||||
"/mnt/btr_root" = {
|
||||
device = "/dev/mapper/root";
|
||||
|
@ -110,6 +121,8 @@ in
|
|||
|
||||
};
|
||||
|
||||
swapDevices = [{ device = "/swap/swapfile"; }];
|
||||
|
||||
environment.etc = {
|
||||
crypttab = {
|
||||
text = ''
|
|
@ -0,0 +1,106 @@
|
|||
{ config, pkgs, impermanence, ... }:
|
||||
|
||||
{
|
||||
imports = [
|
||||
./hardware-configuration/lb.nix
|
||||
../common
|
||||
];
|
||||
|
||||
boot.loader = {
|
||||
grub.enable = false;
|
||||
raspberryPi = {
|
||||
enable = true;
|
||||
version = 3;
|
||||
firmwareConfig = ''
|
||||
gpu_mem=16
|
||||
'';
|
||||
};
|
||||
};
|
||||
boot.readOnlyNixStore = true;
|
||||
boot.kernelParams = [ "console=tty1" ];
|
||||
boot.tmp.cleanOnBoot = true;
|
||||
|
||||
fileSystems = {
|
||||
|
||||
"/" = {
|
||||
device = "tmpfs";
|
||||
fsType = "tmpfs";
|
||||
options = [ "size=500M" "mode=755" ];
|
||||
};
|
||||
|
||||
"/boot" = {
|
||||
device = "/dev/mmcblk0p1";
|
||||
fsType = "vfat";
|
||||
options = [ "ro" ];
|
||||
};
|
||||
|
||||
"/nix" = {
|
||||
device = "/dev/mmcblk0p2";
|
||||
fsType = "ext4";
|
||||
};
|
||||
|
||||
"/state" = {
|
||||
device = "/dev/mmcblk0p3";
|
||||
fsType = "btrfs";
|
||||
options = [ "subvol=state" "compress=zstd" "ro" ];
|
||||
neededForBoot = true;
|
||||
};
|
||||
|
||||
"/mnt/btr_pool" = {
|
||||
device = "/dev/mmcblk0p3";
|
||||
fsType = "btrfs";
|
||||
options = [ "subvolid=5" "compress=zstd" ];
|
||||
};
|
||||
|
||||
"/mnt/data" = {
|
||||
device = "/dev/mmcblk0p3";
|
||||
fsType = "btrfs";
|
||||
options = [ "subvol=data" "compress=zstd" ];
|
||||
};
|
||||
|
||||
"/srv/certs" = {
|
||||
device = "/dev/mmcblk0p3";
|
||||
fsType = "btrfs";
|
||||
options = [ "subvol=certs" "compress=zstd" ];
|
||||
};
|
||||
|
||||
};
|
||||
|
||||
swapDevices = [ ];
|
||||
|
||||
environment.persistence."/state" = {
|
||||
files = [
|
||||
"/etc/machine-id"
|
||||
"/etc/nix/id_rsa"
|
||||
"/etc/ssh/ssh_host_ed25519_key"
|
||||
"/etc/ssh/ssh_host_ed25519_key.pub"
|
||||
"/etc/ssh/ssh_host_ed25519_key-cert.pub"
|
||||
"/etc/ssh/user_ca.pub"
|
||||
"/etc/nixos"
|
||||
];
|
||||
};
|
||||
|
||||
networking.hostName = "lb";
|
||||
networking.firewall.allowedTCPPorts = [ 80 443 ];
|
||||
|
||||
services.nginx = {
|
||||
enable = true;
|
||||
virtualHosts = {
|
||||
|
||||
"homer.monotremata.xyz" = {
|
||||
sslCertificate = "/srv/certs/acme/monotremata.xyz/fullchain.pem";
|
||||
sslCertificateKey = "/srv/certs/acme/monotremata.xyz/key.pem";
|
||||
addSSL = true;
|
||||
onlySSL = true;
|
||||
locations."/" = {
|
||||
recommendedProxySettings = true;
|
||||
proxyWebsockets = true;
|
||||
proxyPass = "http://narwhal:8020/";
|
||||
};
|
||||
};
|
||||
|
||||
};
|
||||
};
|
||||
|
||||
system.stateVersion = "23.05";
|
||||
}
|
|
@ -6,15 +6,28 @@
|
|||
|
||||
let home = "/home/rilla";
|
||||
in {
|
||||
imports = [ ./hardware-configuration/trantor.nix ./common.nix ];
|
||||
imports = [
|
||||
../hardware-configuration/trantor.nix
|
||||
../common
|
||||
../common/desktop.nix
|
||||
];
|
||||
|
||||
home-manager = {
|
||||
users.rilla.imports =
|
||||
[ home/trantor.nix "${impermanence}/home-manager.nix" ];
|
||||
users.rilla.imports = [
|
||||
../home/trantor.nix
|
||||
"${impermanence}/home-manager.nix"
|
||||
];
|
||||
extraSpecialArgs.stablePkgs = stablePkgs;
|
||||
};
|
||||
|
||||
fileSystems = {
|
||||
|
||||
"/" = {
|
||||
device = "tmpfs";
|
||||
fsType = "tmpfs";
|
||||
options = [ "defaults" "size=2G" "mode=755" ];
|
||||
};
|
||||
|
||||
"/boot/efi" = {
|
||||
device = "/dev/disk/by-uuid/0BFA-9A66";
|
||||
fsType = "vfat";
|
||||
|
@ -103,6 +116,8 @@ in {
|
|||
|
||||
};
|
||||
|
||||
swapDevices = [{ device = "/swap/swapfile"; }];
|
||||
|
||||
environment.etc = {
|
||||
crypttab = {
|
||||
text = ''
|
Loading…
Reference in New Issue