cdombroski/nix-configs
1
0
Fork 0
Code Activity Actions
nix-configs/systems/zeus/configuration.nix

427 lines
16 KiB
Nix
Raw Normal View History

Import zeus config
2024-04-25 20:43:21 -04:00
# Edit this configuration file to define what should be installed on
# your system. Help is available in the configuration.nix(5) man page, on
# https://search.nixos.org/options and in the NixOS manual (`nixos-help`).
{ config, lib, pkgs, ... }:
{
imports =
[ # Include the results of the hardware scan.
./hardware-configuration.nix
];
# Use the GRUB 2 boot loader.
boot.loader.grub.enable = true;
boot.loader.grub.zfsSupport = true;
boot.loader.grub.extraEntries = ''
menuentry 'Debian GNU/Linux' --class debian --class gnu-linux --class gnu --class os $menuentry_id_option 'gnulinux-simple-/dev/sda4_/dev/sdb4_/dev/sdc4_/dev/sdd4' {
load_video
insmod gzio
if [ x$grub_platform = xxen ]; then insmod xzio; insmod lzopio; fi
insmod part_gpt
insmod part_gpt
insmod part_gpt
insmod part_gpt
insmod zfs
set root='hd3,gpt3'
if [ x$feature_platform_search_hint = xy ]; then
search --no-floppy --fs-uuid --set=root --hint-bios=hd3,gpt3 --hint-efi=hd3,gpt3 --hint-baremetal=ahci3,gpt3 --hint-bios=hd1,gpt3 --hint-efi=hd1,gpt3 --hint-baremetal=ahci1,gpt3 --hint-bios=hd2,gpt3 --hint-efi=hd2,gpt3 --hint-baremetal=ahci2,gpt3 --hint-bios=hd0,gpt3 --hint-efi=hd0,gpt3 --hint-baremetal=ahci0,gpt3 f8ecb74936118c7a
else
search --no-floppy --fs-uuid --set=root f8ecb74936118c7a
fi
echo 'Loading Linux 6.1.0-20-amd64 ...'
linux /BOOT/debian@/vmlinuz-6.1.0-20-amd64 root=ZFS=/ROOT/debian ro root=ZFS=rpool/ROOT/debian quiet splash
echo 'Loading initial ramdisk ...'
initrd /BOOT/debian@/initrd.img-6.1.0-20-amd64
}
'';
boot.kernelPackages = config.boot.zfs.package.latestCompatibleLinuxPackages;
# boot.loader.grub.efiSupport = true;
# boot.loader.grub.efiInstallAsRemovable = true;
# boot.loader.efi.efiSysMountPoint = "/boot/efi";
# Define on which hard drive you want to install Grub.
# boot.loader.grub.device = "/dev/sda"; # or "nodev" for efi only
boot.loader.grub.devices = [ "/dev/sda" "/dev/sdb" "/dev/sdc" "/dev/sdd" "/dev/sde" "/dev/sdf" ];
networking.hostName = "zeus"; # Define your hostname.
networking.hostId = (builtins.substring 0 8 (builtins.readFile "/etc/machine-id"));
boot.binfmt.emulatedSystems = [ "aarch64-linux" ];
# Pick only one of the below networking options.
# networking.wireless.enable = true; # Enables wireless support via wpa_supplicant.
# networking.networkmanager.enable = true; # Easiest to use and most distros use this by default.
networking.useNetworkd = true;
systemd.network.enable = true;
services.resolved.enable = true;
services.resolved.fallbackDns = [ "8.8.8.8" ];
systemd.network.netdevs = {
bond0 = {
netdevConfig = {
Name = "bond0";
Kind = "bond";
};
bondConfig = {
Mode = "active-backup";
};
};
lan-shim = {
netdevConfig = {
Name = "lan-shim";
Kind = "macvlan";
MACAddress = "3e:53:37:25:08:ef";
};
macvlanConfig = {
Mode = "bridge";
};
};
wg0 = {
netdevConfig = {
Name = "wg0";
Kind = "wireguard";
};
wireguardConfig = {
PrivateKeyFile = /etc/nixos/wireguard.priv;
ListenPort = 51821;
};
wireguardPeers = [{
wireguardPeerConfig = {
PublicKey = "ZT+n0XONAZ6dkiIJR+2bmTT9y7WTxDNdnZo5S7b8vxE=";
AllowedIPs = [ "10.98.0.0/31" ];
PresharedKeyFile = /etc/nixos/wireguard.psk;
PersistentKeepalive = 25;
Endpoint = "remote.kow.is:51821";
};
}];
};
};
systemd.network.networks = {
"00-bondage" = {
name = "en*";
networkConfig.Bond = "bond0";
};
bond0 = {
name = "bond0";
networkConfig.MACVLAN = "lan-shim";
};
lan-shim = {
name = "lan-shim";
address = [ "10.42.69.100/24" "fd72:3dd5:21ae:3c97:101b:87ff:fe86:5f01/64" ];
dns = [ "10.42.69.2" ];
domains = [ "icanttype.org" ];
gateway = [ "10.42.69.1" ];
};
wg0 = {
name = "wg0";
address = [ "10.98.0.0/31" "fd72:3dd5:21ae:ff1a::1/64" ];
};
};
# Set your time zone.
time.timeZone = "America/New_York";
# Configure network proxy if necessary
# networking.proxy.default = "http://user:password@proxy:port/";
# networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";
# Select internationalisation properties.
i18n.defaultLocale = "en_US.UTF-8";
# console = {
# font = "Lat2-Terminus16";
# keyMap = "us";
# useXkbConfig = true; # use xkb.options in tty.
# };
# Enable the X11 windowing system.
# services.xserver.enable = true;
# Configure keymap in X11
# services.xserver.xkb.layout = "us";
# services.xserver.xkb.options = "eurosign:e,caps:escape";
# Enable CUPS to print documents.
# services.printing.enable = true;
# Enable sound.
# sound.enable = true;
# hardware.pulseaudio.enable = true;
# Enable touchpad support (enabled default in most desktopManager).
# services.xserver.libinput.enable = true;
# Define a user account. Don't forget to set a password with ‘passwd’.
# users.users.alice = {
# isNormalUser = true;
# extraGroups = [ "wheel" ]; # Enable ‘sudo’ for the user.
# packages = with pkgs; [
# firefox
# tree
# ];
# };
virtualisation = {
containers.enable = true;
podman = {
enable = true;
dockerCompat = true;
defaultNetwork.settings.dns_enabled = true;
};
oci-containers.containers = {
dockerproxy = {
image = "ghcr.io/tecnativa/docker-socket-proxy:latest";
volumes = [ "/var/run/podman/podman.sock:/var/run/docker.sock:ro" ];
environment = {
CONTAINERS="1";
POST="0";
};
extraOptions = [ "--pull=newer" "--network=www"];
};
swag = {
image = "lscr.io/linuxserver/swag:2.9.0-ls292";
volumes = [ "swag-config:/config" ];
environment = {
TZ="America/New_York";
URL="icanttype.org";
VALIDATION="dns";
SUBDOMAINS="wildcard";
DNSPLUGIN="cloudflare";
DOCKER_HOST="dockerproxy";
DOCKER_MODS="linuxserver/mods:swag-dashboard|linuxserver/mods:swag-auto-proxy|linuxserver/mods:universal-docker|linuxserver/mods:universal-cloudflared";
CF_ZONE_ID="4e68852334290a922718696a0986e75a";
CF_ACCOUNT_ID="5c1c252b9d9a9af6ea3a5de8590f36fa";
CF_API_TOKEN="mRfY8ubtFUxzVuehI6WFipSQFIcstCNds7RF5FTQ";
CF_TUNNEL_NAME="icanttype.org";
CF_TUNNEL_PASSWORD="iZh4UYxVSo3S2H3XwwboM2z@mJEqYJkQ5yMTfd5p";
FILE__CF_TUNNEL_CONFIG="/config/tunnelconfig.yml";
EMAIL="cdombroski@gmail.com";
};
ports = [ "80:80" "443:443" ];
extraOptions = [ "--pull=newer" "--network=www" "--cap-add" "NET_ADMIN" "--network-alias=icanttype.org" ];
};
jellyfin = {
image = "lscr.io/linuxserver/jellyfin:latest";
volumes = [ "jellyfin-config:/config" "/video-data/media:/data/media" ];
environment.TZ="America/New_York";
labels.swag = "enable";
ports = [ "1900:1900/udp" "7359:7359/udp" ];
extraOptions = [ "--pull=newer" "--network=www" ];
};
zwave-js-ui = {
image = "docker.io/zwavejs/zwave-js-ui:latest";
volumes = [ "zwave-config:/usr/src/app/store" ];
environment.TZ = "America/New_York";
labels = { swag = "enable"; swag_url = "zwave.icanttype.org"; };
extraOptions = [ "--pull=newer" "--network=www" "--device=/dev/ttyACM0:/dev/zwave" ];
};
homeassistant = {
image = "lscr.io/linuxserver/homeassistant:latest";
volumes = [ "homeassistant-config:/config" ];
environment.TZ = "America/New_York";
labels.swag = "enable";
extraOptions = [ "--pull=newer" "--network=www" "--network=lan" ];
};
postgres = {
image = "docker.io/library/postgres:15";
volumes = [ "postgres-15:/var/lib/postgresql/data" ];
extraOptions = [ "--pull=newer" "--network=www" ];
};
# gogs = {
# image = "docker.io/gogs/gogs:latest";
# volumes = [ "gogs-data:/data" ];
# labels = {
# swag = "enable";
# swag_url = "git.icanttype.org";
# swag_port = "3000";
# };
# ports = [ "10022:22" ];
# extraOptions = [ "--pull=newer" "--network=www" ];
# };
calibre = {
image = "lscr.io/linuxserver/calibre:latest";
volumes = [ "calibre-config:/config" "/video-data:/data" ];
environment.TZ = "America/New_York";
labels.swag = "enable";
extraOptions = [ "--pull=newer" "--network=www" ];
};
calibre-web = {
image = "lscr.io/linuxserver/calibre-web:latest";
volumes = [ "calibre-web-config:/config" "/video-data:/data" ];
environment.TZ = "America/New_York";
labels.swag = "enable";
extraOptions = [ "--pull=newer" "--network=www" ];
};
flaresolverr = {
image = "ghcr.io/flaresolverr/flaresolverr:latest";
environment.LOG_LEVEL = "info";
extraOptions = [ "--pull=newer" "--network=www" ];
};
qbittorrent = {
image = "lscr.io/linuxserver/qbittorrent:latest";
volumes = [ "qbittorrent-config:/config" "/video-data/torrent:/data/torrent" ];
environment = {
TZ = "America/New_York";
UMASK_SET = "000";
DELUGE_LOGLEVEL = "error";
};
labels.swag = "enable";
ports = [ "34996:34996" "34996:34996/udp" ];
extraOptions = [ "--pull=newer" "--network=www" ];
};
prowlarr = {
image = "lscr.io/linuxserver/prowlarr:latest";
volumes = [ "prowlarr-config:/config" ];
environment.TZ = "America/New_York";
labels.swag = "enable";
extraOptions = [ "--pull=newer" "--network=www" ];
};
readarr = {
image = "lscr.io/linuxserver/readarr:develop";
volumes = [ "readarr-config:/config" "/video-data:/data" ];
environment.TZ = "America/New_York";
labels.swag = "enable";
extraOptions = [ "--pull=newer" "--network=www" ];
};
radarr = {
image = "lscr.io/linuxserver/radarr:latest";
volumes = [ "radarr-config:/config" "/video-data:/data" ];
environment.TZ = "America/New_York";
labels.swag = "enable";
extraOptions = [ "--pull=newer" "--network=www" ];
};
sonarr = {
image = "lscr.io/linuxserver/sonarr:latest";
volumes = [ "sonarr-config:/config" "/video-data:/data" ];
environment.TZ = "America/New_York";
labels.swag = "enable";
extraOptions = [ "--pull=newer" "--network=www" ];
};
static = {
image = "docker.io/library/nginx:alpine";
volumes = [ "/srv/docker/nginx/static:/usr/share/nginx/html:ro" "/srv/docker/nginx/config/static/default.conf:/etc/nginx/config.d/default.conf:ro" ];
labels = {
swag = "enable";
swag_url = "www.icanttype.org";
};
extraOptions = [ "--pull=newer" "--network=www" ];
};
forgejo = {
image = "codeberg.org/forgejo/forgejo:7";
volumes = [ "forgejo-data:/data" "/etc/localtime:/etc/localtime:ro" ];
labels = {
swag = "enable";
swag_url = "git.icanttype.org";
swag_port = "3000";
};
ports = [ "10022:22" ];
extraOptions = [ "--pull=newer" "--network=www" ];
};
docker_dind = {
image = "docker.io/library/docker:dind";
cmd = [ "dockerd" "-H" "tcp://0.0.0.0:2375" "--tls=false" ];
extraOptions = [ "--pull=newer" "--privileged" "--network=www" ];
};
runner = {
image = "code.forgejo.org/forgejo/runner:3.4.1";
dependsOn = [ "docker_dind" ];
environment.DOCKER_HOST = "tcp://docker_dind:2375";
volumes = [ "forgejo-runner:/data" ];
cmd = [ "forgejo-runner" "daemon" ];
extraOptions = [ "--pull=newer" "--network=www" ];
};
};
};
networking.firewall.interfaces."podman+" = {
allowedUDPPorts = [ 53 ];
allowedTCPPorts = [ 53 ];
};
users.users.root.openssh.authorizedKeys.keys = [
"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAgEApZvmNao6HvjOI3NQ96+Hu+N4MTw20KSvrx7ml8/PD4zb5GXo2sXRROHy0VclIXBEPKPKq93QGCMhfCR0jvr2tSib5CwrCMDnjjRxGJV36jhCE1mOV6TKis1MDdigg/7NSVf+eszUW4ed6CSDNFu3ooVZSwdf4Tja2672ROk1W59rDbfgs0Et7pRNnmWM1q+sTbD0eRbY9+0DXBhx5u4OVjp6eNNmO59WGErVvAAjOnZR3rw2LSX7MDrtzeCe1sdR/28WGPIIUVL8eCorlhzPB6PfrTL1Y/fbWAOGdvs6h+wTPX3ivTlrs8J5AXERCymp/CXIA1mwVjnM9zOklFhun+VvCNNJsZPSM62jrHfD4bP11y1kSt87TORGW517nWdS80oUY6MwxRcN2salwWzZA0sVjIHmvc4FkAuPHhdlMQpkym9fpFfR9taWlxU2NMP/+Quj3NaAPKksPvUGwos8lP8Z+QF5ljedNZFsC5/S0u6Fqoa26zRTnVki4KhfGPyKHXIUp9kNV7PRz4oRizHibUfp05xVMACtVIn+pQU7CaQEJCdYfLpo9gMDZ+6ZanmQX0vCUEyiaimrF/eSCkzjBtqSKMRHLd6ADEFEDxSr5nfaqgkddQVkQiBvngCnKwYcKfINA5mYIIFJZyLxpki03SHT6qGT541iHT3OX9F4MBc="
];
users.users.nixremote = {
description = "User for remote builds";
isNormalUser = true;
uid = 1100;
openssh.authorizedKeys.keys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIH7rvqA2VG9kOPHBNgfna0YA+jEjIR6ZAKrdgWVWQjCV root@orangepihole" ];
};
# List packages installed in system profile. To search, run:
# $ nix search wget
environment.systemPackages = with pkgs; [
vim # Do not forget to add an editor to edit configuration.nix! The Nano editor is also installed by default.
dive
podman-tui
docker-compose
wireguard-tools
nix-output-monitor
];
# Some programs need SUID wrappers, can be configured further or are
# started in user sessions.
# programs.mtr.enable = true;
# programs.gnupg.agent = {
# enable = true;
# enableSSHSupport = true;
# };
# programs.msmtp.enable = true;
programs.vim.defaultEditor = true;
nix = {
settings.experimental-features = [ "nix-command" "flakes" ];
settings.trusted-users = [ "nixremote" ];
gc = {
automatic = true;
options = "--delete-older-than 30d";
dates = "weekly";
};
optimise.automatic = true;
};
# List services that you want to enable:
# Enable the OpenSSH daemon.
services.openssh.enable = true;
services.zfs.autoScrub.enable = true;
# services.zfs.zed.settings = {
# ZED_EMAIL_ADDR = [ "cdombroski@gmail.com" ];
# ZED_EMAIL_PROG = "${pkgs.msmtp}/bin/msmtp";
# ZED_EMAIL_OPTS = "@ADDRESS@";
# ZED_USE_ENCLOSURE_LEDS = true;
# ZED_SCRUB_AFTER_RESILVER = true;
# };
# services.zfs.zed.enableMail = false;
# Open ports in the firewall.
# networking.firewall.allowedTCPPorts = [ ... ];
# networking.firewall.allowedUDPPorts = [ ... ];
# Or disable the firewall altogether.
# networking.firewall.enable = false;
# Copy the NixOS configuration file and link it from the resulting system
# (/run/current-system/configuration.nix). This is useful in case you
# accidentally delete configuration.nix.
# system.copySystemConfiguration = true;
# This option defines the first version of NixOS you have installed on this particular machine,
# and is used to maintain compatibility with application data (e.g. databases) created on older NixOS versions.
#
# Most users should NEVER change this value after the initial install, for any reason,
# even if you've upgraded your system to a new NixOS release.
#
# This value does NOT affect the Nixpkgs version your packages and OS are pulled from,
# so changing it will NOT upgrade your system.
#
# This value being lower than the current NixOS release does NOT mean your system is
# out of date, out of support, or vulnerable.
#
# Do NOT change this value unless you have manually inspected all the changes it would make to your configuration,
# and migrated your data accordingly.
#
# For more information, see `man configuration.nix` or https://nixos.org/manual/nixos/stable/options#opt-system.stateVersion .
system.stateVersion = "23.11"; # Did you read the comment?
Auto upgrade
2024-04-25 20:46:12 -04:00
system.autoUpgrade = {
enable = true;
flake = "git+https://git.icanttype.org/cdombroski/nix-configs.git";
};
Import zeus config
2024-04-25 20:43:21 -04:00
zramSwap.enable = true;
}
Copy permalink