vno1-rp3b

hosts/vno1-rp3b/configuration.nix

@@ -0,0 +1,84 @@
+# Edit this configuration file to define what should be installed on
+# your system.  Help is available in the configuration.nix(5) man page
+# and in the NixOS manual (accessible by running `nixos-help`).
+{
+  config,
+  pkgs,
+  myData,
+  ...
+}: {
+  # previously:
+  # imports = [(modulesPath + "/installer/scan/not-detected.nix")];
+  # as of 23.05 that is:
+  hardware.enableRedistributableFirmware = true;
+
+  boot.initrd.availableKernelModules = ["usbhid"];
+  boot.initrd.kernelModules = [];
+  boot.kernelPackages = config.boot.zfs.package.latestCompatibleLinuxPackages;
+  boot.kernelModules = [];
+  boot.extraModulePackages = [];
+
+  fileSystems."/" = {
+    device = "/dev/disk/by-uuid/44444444-4444-4444-8888-888888888888";
+    fsType = "ext4";
+  };
+
+  swapDevices = [];
+
+  mj = {
+    stateVersion = "23.05";
+    timeZone = "Europe/Vilnius";
+    base = {
+      users.passwd = {
+        root.passwordFile = config.age.secrets.root-passwd-hash.path;
+        motiejus.passwordFile = config.age.secrets.motiejus-passwd-hash.path;
+      };
+      unitstatus = {
+        enable = true;
+        email = "motiejus+alerts@jakstys.lt";
+      };
+    };
+
+    services = {
+      postfix = {
+        enable = true;
+        saslPasswdPath = config.age.secrets.sasl-passwd.path;
+      };
+    };
+  };
+
+  services.tailscale.enable = true;
+
+  networking = {
+    hostId = "4bd17751";
+    hostName = "vno1-rp3b";
+    domain = "servers.jakst";
+    defaultGateway = "192.168.189.4";
+    nameservers = ["192.168.189.4"];
+    interfaces.enp3s0.ipv4.addresses = [
+      {
+        address = "192.168.189.5";
+        prefixLength = 24;
+      }
+    ];
+    firewall = {
+      allowedUDPPorts = [];
+      allowedTCPPorts = [];
+      logRefusedConnections = false;
+      checkReversePath = "loose"; # for tailscale
+    };
+  };
+
+  powerManagement.cpuFreqGovernor = "ondemand";
+
+  boot.loader.grub.enable = false;
+  boot.loader.generic-extlinux-compatible.enable = true;
+
+  security.rtkit.enable = true;
+  services.pipewire = {
+    enable = true;
+    alsa.enable = true;
+    alsa.support32Bit = true;
+    pulse.enable = true;
+  };
+}