config/hosts/vno1-oh2/configuration.nix

138 lines
3.3 KiB
Nix
Raw Normal View History

2023-07-22 16:05:44 +03:00
{
config,
pkgs,
myData,
...
}: {
zfs-root = {
boot = {
enable = true;
devNodes = "/dev/disk/by-id/";
bootDevices = ["nvme-Samsung_SSD_970_EVO_Plus_2TB_S6P1NX0TA00913P"];
immutable = false;
availableKernelModules = ["ahci" "xhci_pci" "nvme" "usbhid" "sdhci_pci" "r8169"];
removableEfi = true;
kernelParams = [
"ip=192.168.189.1::192.168.189.4:255.255.255.0:vno1-oh2.jakstys.lt:enp3s0:off"
];
sshUnlock = {
enable = true;
2023-07-23 15:23:09 +03:00
authorizedKeys =
(builtins.attrValues myData.people_pubkeys)
++ [myData.hosts."hel1-a.servers.jakst".publicKey];
2023-07-22 16:05:44 +03:00
};
};
};
mj = {
stateVersion = "23.05";
timeZone = "Europe/Vilnius";
base = {
zfs.enable = true;
2023-07-22 16:05:44 +03:00
users.passwd = {
root.passwordFile = config.age.secrets.root-passwd-hash.path;
motiejus.passwordFile = config.age.secrets.motiejus-passwd-hash.path;
};
2023-07-26 13:09:40 +03:00
snapshot = {
enable = true;
mountpoints = ["/home"];
};
2023-07-26 14:23:12 +03:00
zfsborg = {
enable = true;
passwordPath = config.age.secrets.borgbackup-password.path;
2023-07-26 14:39:34 +03:00
sshKeyPath = "/etc/ssh/ssh_host_ed25519_key";
2023-07-26 14:23:12 +03:00
mountpoints = {
"/home" = {
repo = "zh2769@zh2769.rsync.net:${config.networking.hostName}.${config.networking.domain}-home-motiejus-annex2";
paths = [
"/home/.snapshot-latest/motiejus/annex2"
2023-07-26 15:31:05 +03:00
"/home/.snapshot-latest/motiejus/.config/syncthing"
2023-07-26 14:23:12 +03:00
];
backup_at = "*-*-* 00:05:00";
};
};
};
unitstatus = {
enable = true;
email = "motiejus+alerts@jakstys.lt";
};
2023-07-22 16:05:44 +03:00
};
2023-07-24 09:23:20 +03:00
2023-07-26 13:26:11 +03:00
services = {
postfix = {
enable = true;
saslPasswdPath = config.age.secrets.sasl-passwd.path;
};
2023-07-26 11:36:54 +03:00
2023-07-26 13:26:11 +03:00
syncthing = {
enable = true;
dataDir = "/home/motiejus/";
user = "motiejus";
group = "users";
};
zfsunlock = {
enable = true;
targets."hel1-a.servers.jakst" = {
sshEndpoint = myData.hosts."hel1-a.servers.jakst".publicIP;
pingEndpoint = "hel1-a.servers.jakst";
remotePubkey = myData.hosts."hel1-a.servers.jakst".initrdPubKey;
pwFile = config.age.secrets.zfs-passphrase-hel1-a.path;
startAt = "*-*-* *:00/5:00";
};
2023-07-24 09:23:20 +03:00
};
};
2023-07-22 16:05:44 +03:00
};
2023-07-24 16:31:38 +03:00
users = {
users = {
2023-07-24 16:46:30 +03:00
# TODO: git config --global user.email bot@jakstys.lt
2023-07-24 16:31:38 +03:00
updaterbot = {
description = "Dear Updater Bot";
home = "/var/lib/updaterbot";
useDefaultShell = true;
group = "updaterbot";
isSystemUser = true;
createHome = true;
uid = myData.uidgid.updaterbot;
};
};
groups = {
updaterbot.gid = myData.uidgid.updaterbot;
};
};
2023-07-24 16:42:12 +03:00
nix.settings.trusted-users = ["updaterbot"];
2023-07-22 16:05:44 +03:00
services = {
tailscale.enable = true;
nsd = {
enable = true;
interfaces = ["0.0.0.0" "::"];
zones = {
"jakstys.lt.".data = myData.jakstysLTZone;
};
};
};
networking = {
hostId = "f9117e1b";
hostName = "vno1-oh2";
2023-07-26 11:36:54 +03:00
domain = "servers.jakst";
2023-07-22 16:05:44 +03:00
defaultGateway = "192.168.189.4";
nameservers = ["192.168.189.4"];
interfaces.enp3s0.ipv4.addresses = [
{
address = "192.168.189.1";
prefixLength = 24;
}
];
};
}