nix-configs/nixos-configurations/orangepihole.nix

{
  config,
  pkgs,
  modulesPath,
  ezModules,
  lib,
  inputs,
  ...
}:

{
  imports = [
    # Include the results of the hardware scan.
    "${modulesPath}/installer/scan/not-detected.nix"
    inputs.impermanence.nixosModules.impermanence
    ezModules.networkd-base
  ];

  boot = {
    loader = {
      grub.enable = false;
      generic-extlinux-compatible.enable = true;
      timeout = 1;
    };
    tmp.cleanOnBoot = true;
  };

  fileSystems = {
    "/" = {
      device = "none";
      fsType = "tmpfs";
      options = [
        "defaults"
        "mode=755"
      ];
    };
    "/persist" = {
      device = "/dev/disk/by-uuid/6df53c4f-42b6-478b-8be4-f7887ad18b5b";
      fsType = "btrfs";
      neededForBoot = true;
      options = [
        "compress=lzo"
        "autodefrag"
        "defaults"
        "subvol=@nixos/root"
      ];
    };
    "/boot" = {
      device = "/dev/disk/by-uuid/a4d76da9-b8eb-4615-9d64-a36e1383da80";
      fsType = "ext4";
      options = [ "defaults" ];
    };
    "/nix" = {
      device = "/dev/disk/by-uuid/6df53c4f-42b6-478b-8be4-f7887ad18b5b";
      fsType = "btrfs";
      options = [
        "compress=lzo"
        "autodefrag"
        "defaults"
        "subvol=@nixos/nix"
      ];
    };
  };

  networking = {
    hostName = "orangepihole"; # Define your hostname.
    firewall = {
      allowedUDPPorts = [
        53
        67
        68
      ];
      allowedTCPPorts = [ 53 ];
    };
    useDHCP = lib.mkDefault true;
  };
  systemd.network.networks."40-end0" = {
    matchConfig.Name = "end0";
    address = [
      "10.42.69.2/24"
      "fd72:3dd5:21ae:3c97::2/64"
    ];
    dns = [
      "10.42.69.2"
      "fd72:3dd5:21ae:3c97::2"
    ];
    domains = [ "icanttype.org" ];
    gateway = [ "10.42.69.1" ];
    networkConfig.DHCPServer = true;
    dhcpServerConfig = {
      PoolOffset = 150;
      EmitDNS = true;
      DNS = "10.42.69.2";
      EmitRouter = true;
      Router = "10.42.69.1";
      SendOption = [
        "15:string:icanttype.org"
        "119:string:icanttype.org"
      ];
    };
    networkConfig.IPv6SendRA = true;
    ipv6SendRAConfig = {
      RouterLifetimeSec = 0;
      EmitDNS = false;
    };
    ipv6Prefixes = [ { ipv6PrefixConfig.Prefix = "fd72:3dd5:21ae:3c97::/64"; } ];
  };
  zramSwap.enable = true;
  swapDevices = [
    {
      device = "/persist/swapfile";
      size = 1024;
    }
  ];
  services = {
    unbound = {
      enable = true;
      localControlSocketPath = "/var/lib/unbound/control.sock";
      settings = {
        server = {
          do-ip6 = "no";
          qname-minimisation = "yes";
          interface = [ "end0" ];
          access-control = [
            "10.0.0.0/8 allow"
            "fc::/7 allow"
          ];
        };
        include = [
          "/etc/unbound/ads.conf"
          "${../configs/unbound-local.conf}"
        ];
      };
    };
    journald.storage = "volatile";
  };

  systemd = {
    services.adblock = {
      startAt = "daily";
      postStop = "systemctl try-reload-or-restart unbound";
      path = with pkgs; [
        gawk
        wget
      ];
      script = ''
        	wget -nv -O - https://raw.githubusercontent.com/hagezi/dns-blocklists/main/unbound/tif.blacklist.conf > /tmp/new.conf
                echo 'local-zone: "tiktok.com." always_nxdomain' >> /tmp/new.conf
        	echo 'local-zone: "iogames.space." always_nxdomain' >> /tmp/new.conf
        	echo 'local-zone: "taming.io." always_nxdomain' >> /tmp/new.conf
                awk '!seen[$0]++' /tmp/new.conf > /etc/unbound/ads.conf
                rm /tmp/new.conf
      '';
    };
  };

  environment = {
    systemPackages = with pkgs; [
      vim # Do not forget to add an editor to edit configuration.nix! The Nano editor is also installed by default.
      wget
    ];
    persistence."/persist" = {
      hideMounts = true;
      directories = [
        "/var/lib/nixos"
        "/var/lib/systemd"
        "/tmp"
      ];
      files = [
        "/etc/machine-id"
        "/etc/adjtime"
        "/etc/ssh/ssh_host_rsa_key"
        "/etc/ssh/ssh_host_rsa_key.pub"
        "/etc/ssh/ssh_host_ed25519_key"
        "/etc/ssh/ssh_host_ed25519_key.pub"
        "/etc/unbound/ads.conf"
      ];
    };
  };

  system.stateVersion = "23.11"; # Did you read the comment?
  sops.secrets."nixremote/sshkey" = { };
  nix = {
    distributedBuilds = true;
    settings.max-jobs = 0;
    buildMachines = [
      {
        hostName = "zeus";
        systems = [
          "x86_64-linux"
          "aarch64-linux"
        ];
        protocol = "ssh-ng";
        sshKey = config.sops.secrets."nixremote/sshkey".path;
        sshUser = "nixremote";
        supportedFeatures = [
          "nixos-test"
          "benchmark"
          "big-parallel"
          "kvm"
        ];
      }
    ];
  };
  programs.ssh.extraConfig = ''
    Host zeus
    User nixremote
    StrictHostKeyChecking accept-new
    IdentitiesOnly yes
    IdentityFile ${config.sops.secrets."nixremote/sshkey".path}
  '';
  nixpkgs.hostPlatform = lib.mkDefault "aarch64-linux";
}