105 lines
4 KiB
Nix
105 lines
4 KiB
Nix
{ config, lib, pkgs, ... }:
|
|
|
|
{
|
|
imports =
|
|
[ # Include the results of the hardware scan.
|
|
./hardware-configuration.nix
|
|
../../modules/common.nix
|
|
];
|
|
|
|
boot.loader.grub.enable = false;
|
|
boot.loader.generic-extlinux-compatible.enable = true;
|
|
boot.loader.timeout = 1;
|
|
|
|
networking = {
|
|
hostName = "orangepihole"; # Define your hostname.
|
|
useNetworkd = true;
|
|
};
|
|
systemd.network.enable = true;
|
|
systemd.network.networks."40-end0" = {
|
|
matchConfig.Name = "end0";
|
|
address = [ "10.42.69.2/24" "fd72:3dd5:21ae:3c97::2/64" ];
|
|
dns = [ "10.42.69.2" "fd72:3dd5:21ae:3c97::2" ];
|
|
domains = [ "icanttype.org" ];
|
|
gateway = [ "10.42.69.1" ];
|
|
networkConfig.DHCPServer = true;
|
|
dhcpServerConfig = {
|
|
PoolOffset = 150;
|
|
EmitDNS = true;
|
|
DNS = "10.42.69.2";
|
|
EmitRouter = true;
|
|
Router = "10.42.69.1";
|
|
SendOption = [ "15:string:icanttype.org" "119:string:icanttype.org" ];
|
|
};
|
|
networkConfig.IPv6SendRA = true;
|
|
ipv6SendRAConfig.RouterLifetimeSec = 0;
|
|
ipv6SendRAConfig.EmitDNS = false;
|
|
ipv6Prefixes = [ { ipv6PrefixConfig.Prefix = "fd72:3dd5:21ae:3c97::/64"; } ];
|
|
};
|
|
time.timeZone = "America/New_York";
|
|
|
|
zramSwap.enable = true;
|
|
swapDevices = [ {device="/swapfile"; size=1024;}];
|
|
services.resolved.enable = true;
|
|
services.unbound = {
|
|
enable = true;
|
|
settings = {
|
|
server = {
|
|
qname-minimisation = "yes";
|
|
interface = [ "end0" ];
|
|
access-control = [ "10.0.0.0/8 allow" "fc::/7 allow" ];
|
|
};
|
|
include = [ "/etc/unbound/ads.conf" "/etc/unbound/local.conf" ];
|
|
};
|
|
};
|
|
|
|
systemd = {
|
|
services.adblock = {
|
|
startAt = "daily";
|
|
postStop = "systemctl reload unbound";
|
|
path = with pkgs; [ gawk wget ];
|
|
script = ''
|
|
wget -O - https://raw.githubusercontent.com/hagezi/dns-blocklists/main/unbound/light.blacklist.conf > /etc/unbound/new.conf
|
|
wget -O - https://raw.githubusercontent.com/hagezi/dns-blocklists/main/unbound/tif.blacklist.conf >> /etc/unbound/new.conf
|
|
echo 'local-zone: "iogames.space." always_nxdomain' >> /etc/unbound/new.conf
|
|
echo 'local-zone: "taming.io." always_nxdomain' >> /etc/unbound/new.conf
|
|
awk '!seen[$0]++' /etc/unbound/new.conf > /etc/unbound/ads.conf
|
|
rm /etc/unbound/new.conf
|
|
'';
|
|
};
|
|
};
|
|
users.users.root.openssh.authorizedKeys.keys = [
|
|
"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAgEApZvmNao6HvjOI3NQ96+Hu+N4MTw20KSvrx7ml8/PD4zb5GXo2sXRROHy0VclIXBEPKPKq93QGCMhfCR0jvr2tSib5CwrCMDnjjRxGJV36jhCE1mOV6TKis1MDdigg/7NSVf+eszUW4ed6CSDNFu3ooVZSwdf4Tja2672ROk1W59rDbfgs0Et7pRNnmWM1q+sTbD0eRbY9+0DXBhx5u4OVjp6eNNmO59WGErVvAAjOnZR3rw2LSX7MDrtzeCe1sdR/28WGPIIUVL8eCorlhzPB6PfrTL1Y/fbWAOGdvs6h+wTPX3ivTlrs8J5AXERCymp/CXIA1mwVjnM9zOklFhun+VvCNNJsZPSM62jrHfD4bP11y1kSt87TORGW517nWdS80oUY6MwxRcN2salwWzZA0sVjIHmvc4FkAuPHhdlMQpkym9fpFfR9taWlxU2NMP/+Quj3NaAPKksPvUGwos8lP8Z+QF5ljedNZFsC5/S0u6Fqoa26zRTnVki4KhfGPyKHXIUp9kNV7PRz4oRizHibUfp05xVMACtVIn+pQU7CaQEJCdYfLpo9gMDZ+6ZanmQX0vCUEyiaimrF/eSCkzjBtqSKMRHLd6ADEFEDxSr5nfaqgkddQVkQiBvngCnKwYcKfINA5mYIIFJZyLxpki03SHT6qGT541iHT3OX9F4MBc="
|
|
];
|
|
|
|
|
|
environment.systemPackages = with pkgs; [
|
|
git
|
|
vim # Do not forget to add an editor to edit configuration.nix! The Nano editor is also installed by default.
|
|
wget
|
|
];
|
|
|
|
services.openssh.enable = true;
|
|
|
|
networking.firewall.enable = false;
|
|
system.autoUpgrade = {
|
|
enable = true;
|
|
flake = "git+https://git.icanttype.org/cdombroski/nix-configs.git";
|
|
};
|
|
system.stateVersion = "23.11"; # Did you read the comment?
|
|
nix.buildMachines = [ {
|
|
hostName = "zeus";
|
|
systems = [ "x86_64-linux" "aarch64-linux" ];
|
|
protocol = "ssh-ng";
|
|
sshKey = "/root/.ssh/nixremote";
|
|
sshUser = "nixremote";
|
|
supportedFeatures = [ "nixos-test" "benchmark" "big-parallel" "kvm" ];
|
|
}];
|
|
nix.distributedBuilds = true;
|
|
nix.extraOptions = "builders-use-substitutes = true";
|
|
nix.settings.experimental-features = [ "nix-command" "flakes" ];
|
|
nix.gc.automatic = true;
|
|
nix.gc.options = "--delete-older-than 7d";
|
|
nix.optimise.automatic = true;
|
|
}
|
|
|