motiejus
/
config
1
Fork 0
Code Packages Releases Activity

nix fmt

This commit is contained in:
Motiejus Jakštys 2024-07-29 15:39:54 +03:00
parent 3da42ead11
commit 9ea80639a3
51 changed files with 2040 additions and 1758 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

216
data.nix
View File

@ -65,32 +65,45 @@ rec {
jakstIP = "100.89.176.4";
};
"vno3-rp3b.servers.jakst" = rec {
extraHostNames = [jakstIP];
extraHostNames = [ jakstIP ];
publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBudUFFEBpUVdr26vLJup8Hk6wj1iDbOPPQnJbv6GUGC";
jakstIP = "100.89.176.2";
};
"fra1-a.servers.jakst" = rec {
extraHostNames = ["fra1-a.jakstys.lt" publicIP jakstIP];
extraHostNames = [
"fra1-a.jakstys.lt"
publicIP
jakstIP
];
publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFj9Ktw9SZQlHe/Pl5MI7PRUcCyTgZgZ0SsvWUmO0wBM";
initrdPubKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGtYwVhfmdHRK8YcaRQ3JGSIOK55lEMNSPh33Z0iI+pO";
publicIP = "168.119.184.134";
jakstIP = "100.89.176.5";
system = "aarch64-linux";
supportedFeatures = ["nixos-test" "benchmark" "big-parallel" "kvm" "gccarch-armv8-a"];
supportedFeatures = [
"nixos-test"
"benchmark"
"big-parallel"
"kvm"
"gccarch-armv8-a"
];
};
"fwminex.motiejus.jakst" = rec {
extraHostNames = [jakstIP vno1IP];
extraHostNames = [
jakstIP
vno1IP
];
publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHlWSZ/H6DR5i5aCrlrEQLVF9MXNvls/pjlLPLaav3f+";
jakstIP = "100.89.176.6";
vno1IP = "192.168.189.10";
};
"mtworx.motiejus.jakst" = rec {
extraHostNames = [jakstIP];
extraHostNames = [ jakstIP ];
publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDRrsOkKkpJ9ZJYhEdxjwrmdVYoPcGDGtcGfBkkpVF6l";
jakstIP = "100.89.176.20";
};
"vno1-vinc.vincentas.jakst" = rec {
extraHostNames = [jakstIP];
extraHostNames = [ jakstIP ];
publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJIwK7et5NBM+vaffiwpKLSAJwKfwMhCZwl1JyXo79uL";
jakstIP = "100.89.176.7";
};
@ -118,15 +131,14 @@ rec {
range = "100.89.176.0-100.89.191.255";
sshPattern = "100.89.176.*"; # until we have more hosts
};
motiejus.cidrs = let
mHosts =
attrVals [
motiejus.cidrs =
let
mHosts = attrVals [
"mxp10.motiejus.jakst"
"mtworx.motiejus.jakst"
"fwminex.motiejus.jakst"
]
hosts;
in
] hosts;
in
builtins.catAttrs "jakstIP" mHosts;
vno1 = {
@ -136,99 +148,103 @@ rec {
vno3.cidr = "192.168.100.0/24";
};
e11syncZone = let
vno1 = hosts."vno1-oh2.servers.jakst".publicIP;
fra1a = hosts."fra1-a.servers.jakst".publicIP;
in ''
$ORIGIN 11sync.net.
$TTL 3600
@ SOA ns1.11sync.net. motiejus.11sync.net. (2024011500 86400 86400 86400 86400)
@ NS ns1.11sync.net.
@ NS ns2.11sync.net.
@ A ${vno1}
@ TXT google-site-verification=nvUYd7_ShhPKvTn_Xbw-vPFONOhPeaYQsGp34DbV-80
@ TXT "hosted-email-verify=qeuysotu"
@ MX 10 aspmx1.migadu.com.
@ MX 20 aspmx2.migadu.com.
@ TXT "v=spf1 include:spf.migadu.com -all"
ns1 A ${vno1}
ns2 A ${fra1a}
www A ${vno1}
admin A ${hosts."fra1-a.servers.jakst".jakstIP}
key1._domainkey CNAME key1.11sync.net._domainkey.migadu.com.
key2._domainkey CNAME key2.11sync.net._domainkey.migadu.com.
key3._domainkey CNAME key3.11sync.net._domainkey.migadu.com.
_dmarc TXT "v=DMARC1; p=quarantine;"
autoconfig CNAME autoconfig.migadu.com.
_autodiscover._tcp SRV 0 1 443 autodiscover.migadu.com.
_submissions._tcp SRV 0 1 465 smtp.migadu.com.
_imaps._tcp SRV 0 1 993 imap.migadu.com.
_pop3s._tcp SRV 0 1 995 pop.migadu.com.
_github-challenge-11sync-org TXT "ff5e813c58"
'';
e11syncZone =
let
vno1 = hosts."vno1-oh2.servers.jakst".publicIP;
fra1a = hosts."fra1-a.servers.jakst".publicIP;
in
''
$ORIGIN 11sync.net.
$TTL 3600
@ SOA ns1.11sync.net. motiejus.11sync.net. (2024011500 86400 86400 86400 86400)
@ NS ns1.11sync.net.
@ NS ns2.11sync.net.
@ A ${vno1}
@ TXT google-site-verification=nvUYd7_ShhPKvTn_Xbw-vPFONOhPeaYQsGp34DbV-80
@ TXT "hosted-email-verify=qeuysotu"
@ MX 10 aspmx1.migadu.com.
@ MX 20 aspmx2.migadu.com.
@ TXT "v=spf1 include:spf.migadu.com -all"
ns1 A ${vno1}
ns2 A ${fra1a}
www A ${vno1}
admin A ${hosts."fra1-a.servers.jakst".jakstIP}
key1._domainkey CNAME key1.11sync.net._domainkey.migadu.com.
key2._domainkey CNAME key2.11sync.net._domainkey.migadu.com.
key3._domainkey CNAME key3.11sync.net._domainkey.migadu.com.
_dmarc TXT "v=DMARC1; p=quarantine;"
autoconfig CNAME autoconfig.migadu.com.
_autodiscover._tcp SRV 0 1 443 autodiscover.migadu.com.
_submissions._tcp SRV 0 1 465 smtp.migadu.com.
_imaps._tcp SRV 0 1 993 imap.migadu.com.
_pop3s._tcp SRV 0 1 995 pop.migadu.com.
_github-challenge-11sync-org TXT "ff5e813c58"
'';
jakstysLTZone = let
fra1a = hosts."fra1-a.servers.jakst".publicIP;
vno1 = hosts."vno1-oh2.servers.jakst".publicIP;
in ''
$ORIGIN jakstys.lt.
$TTL 86400
@ SOA ns1.jakstys.lt. motiejus.jakstys.lt. (2023100800 86400 86400 86400 86400)
@ NS ns1.jakstys.lt.
@ NS ns2.jakstys.lt.
@ A ${vno1}
www A ${vno1}
ns1 A ${vno1}
ns2 A ${fra1a}
vpn A ${vno1}
git A ${vno1}
auth A ${vno1}
dl A ${vno1}
fra1-a A ${fra1a}
vno1 A ${vno1}
jakstysLTZone =
let
fra1a = hosts."fra1-a.servers.jakst".publicIP;
vno1 = hosts."vno1-oh2.servers.jakst".publicIP;
in
''
$ORIGIN jakstys.lt.
$TTL 86400
@ SOA ns1.jakstys.lt. motiejus.jakstys.lt. (2023100800 86400 86400 86400 86400)
@ NS ns1.jakstys.lt.
@ NS ns2.jakstys.lt.
@ A ${vno1}
www A ${vno1}
ns1 A ${vno1}
ns2 A ${fra1a}
vpn A ${vno1}
git A ${vno1}
auth A ${vno1}
dl A ${vno1}
fra1-a A ${fra1a}
vno1 A ${vno1}
@ TXT google-site-verification=sU99fmO8gEJF-0lbOY-IzkovC6MXsP3Gozqrs8BR5OM
@ TXT hosted-email-verify=rvyd6h64
@ MX 10 aspmx1.migadu.com.
@ MX 20 aspmx2.migadu.com.
* MX 10 aspmx1.migadu.com.
* MX 20 aspmx2.migadu.com.
key1._domainkey CNAME key1.jakstys.lt._domainkey.migadu.com.
key2._domainkey CNAME key2.jakstys.lt._domainkey.migadu.com.
key3._domainkey CNAME key3.jakstys.lt._domainkey.migadu.com.
@ TXT "v=spf1 include:spf.migadu.com -all"
_dmarc TXT "v=DMARC1; p=quarantine;"
* MX 10 aspmx1.migadu.com.
* MX 20 aspmx2.migadu.com.
autoconfig CNAME autoconfig.migadu.com.
_autodiscover._tcp SRV 0 1 443 autodiscover.migadu.com.
_submissions._tcp SRV 0 1 465 smtp.migadu.com.
_imaps._tcp SRV 0 1 993 imap.migadu.com.
_pop3s._tcp SRV 0 1 995 imap.migadu.com.
@ TXT google-site-verification=sU99fmO8gEJF-0lbOY-IzkovC6MXsP3Gozqrs8BR5OM
@ TXT hosted-email-verify=rvyd6h64
@ MX 10 aspmx1.migadu.com.
@ MX 20 aspmx2.migadu.com.
* MX 10 aspmx1.migadu.com.
* MX 20 aspmx2.migadu.com.
key1._domainkey CNAME key1.jakstys.lt._domainkey.migadu.com.
key2._domainkey CNAME key2.jakstys.lt._domainkey.migadu.com.
key3._domainkey CNAME key3.jakstys.lt._domainkey.migadu.com.
@ TXT "v=spf1 include:spf.migadu.com -all"
_dmarc TXT "v=DMARC1; p=quarantine;"
* MX 10 aspmx1.migadu.com.
* MX 20 aspmx2.migadu.com.
autoconfig CNAME autoconfig.migadu.com.
_autodiscover._tcp SRV 0 1 443 autodiscover.migadu.com.
_submissions._tcp SRV 0 1 465 smtp.migadu.com.
_imaps._tcp SRV 0 1 993 imap.migadu.com.
_pop3s._tcp SRV 0 1 995 imap.migadu.com.
grafana A ${hosts."vno1-oh2.servers.jakst".jakstIP}
_acme-challenge.grafana CNAME _acme-endpoint.grafana
_acme-endpoint.grafana NS ns._acme-endpoint.grafana
ns._acme-endpoint.grafana A ${vno1}
grafana A ${hosts."vno1-oh2.servers.jakst".jakstIP}
_acme-challenge.grafana CNAME _acme-endpoint.grafana
_acme-endpoint.grafana NS ns._acme-endpoint.grafana
ns._acme-endpoint.grafana A ${vno1}
irc A ${hosts."vno1-oh2.servers.jakst".jakstIP}
_acme-challenge.irc CNAME _acme-endpoint.irc
_acme-endpoint.irc NS ns._acme-endpoint.irc
ns._acme-endpoint.irc A ${vno1}
irc A ${hosts."vno1-oh2.servers.jakst".jakstIP}
_acme-challenge.irc CNAME _acme-endpoint.irc
_acme-endpoint.irc NS ns._acme-endpoint.irc
ns._acme-endpoint.irc A ${vno1}
hass A ${hosts."vno1-oh2.servers.jakst".jakstIP}
_acme-challenge.hass CNAME _acme-endpoint.hass
_acme-endpoint.hass NS ns._acme-endpoint.hass
ns._acme-endpoint.hass A ${vno1}
hass A ${hosts."vno1-oh2.servers.jakst".jakstIP}
_acme-challenge.hass CNAME _acme-endpoint.hass
_acme-endpoint.hass NS ns._acme-endpoint.hass
ns._acme-endpoint.hass A ${vno1}
bitwarden A ${hosts."vno1-oh2.servers.jakst".jakstIP}
_acme-challenge.bitwarden CNAME _acme-endpoint.bitwarden
_acme-endpoint.bitwarden NS ns._acme-endpoint.bitwarden
ns._acme-endpoint.bitwarden A ${vno1}
bitwarden A ${hosts."vno1-oh2.servers.jakst".jakstIP}
_acme-challenge.bitwarden CNAME _acme-endpoint.bitwarden
_acme-endpoint.bitwarden NS ns._acme-endpoint.bitwarden
ns._acme-endpoint.bitwarden A ${vno1}
hdd A ${hosts."vno3-rp3b.servers.jakst".jakstIP}
_acme-challenge.hdd CNAME _acme-endpoint.hdd
_acme-endpoint.hdd NS ns._acme-endpoint.hdd
ns._acme-endpoint.hdd A ${vno1}
'';
hdd A ${hosts."vno3-rp3b.servers.jakst".jakstIP}
_acme-challenge.hdd CNAME _acme-endpoint.hdd
_acme-endpoint.hdd NS ns._acme-endpoint.hdd
ns._acme-endpoint.hdd A ${vno1}
'';
}

235
flake.nix
View File

@ -61,65 +61,68 @@
extra-experimental-features = "nix-command flakes";
};
outputs = {
self,
nixpkgs,
nixpkgs-unstable,
agenix,
deploy-rs,
flake-utils,
home-manager,
nixos-hardware,
nix-index-database,
pre-commit-hooks,
nur,
nixgl,
...
} @ inputs: let
myData = import ./data.nix;
outputs =
{
self,
nixpkgs,
nixpkgs-unstable,
agenix,
deploy-rs,
flake-utils,
home-manager,
nixos-hardware,
nix-index-database,
pre-commit-hooks,
nur,
nixgl,
...
}@inputs:
let
myData = import ./data.nix;
overlays = [
nur.overlay
nixgl.overlay
overlays = [
nur.overlay
nixgl.overlay
(_self: super: {deploy-rs-pkg = super.deploy-rs;})
deploy-rs.overlay
(_self: super: {
deploy-rs = {
deploy-rs = super.deploy-rs-pkg;
inherit (super.deploy-rs) lib;
(_self: super: { deploy-rs-pkg = super.deploy-rs; })
deploy-rs.overlay
(_self: super: {
deploy-rs = {
deploy-rs = super.deploy-rs-pkg;
inherit (super.deploy-rs) lib;
};
deploy-rs-pkg = null;
})
(_: super: {
compressDrv = super.callPackage ./pkgs/compress-drv { };
compressDrvWeb = super.callPackage ./pkgs/compress-drv/web.nix { };
tmuxbash = super.callPackage ./pkgs/tmuxbash.nix { };
btrfs-auto-snapshot = super.callPackage ./pkgs/btrfs-auto-snapshot.nix { };
nicer = super.callPackage ./pkgs/nicer.nix { };
pkgs-unstable = import nixpkgs-unstable { inherit (super) system; };
})
];
mkVM =
system:
nixpkgs.lib.nixosSystem {
inherit system;
modules = [
{ nixpkgs.overlays = overlays; }
./hosts/vm/configuration.nix
./modules
./modules/profiles/desktop
home-manager.nixosModules.home-manager
];
specialArgs = {
inherit myData;
} // inputs;
};
deploy-rs-pkg = null;
})
(_: super: {
compressDrv = super.callPackage ./pkgs/compress-drv {};
compressDrvWeb = super.callPackage ./pkgs/compress-drv/web.nix {};
tmuxbash = super.callPackage ./pkgs/tmuxbash.nix {};
btrfs-auto-snapshot = super.callPackage ./pkgs/btrfs-auto-snapshot.nix {};
nicer = super.callPackage ./pkgs/nicer.nix {};
pkgs-unstable = import nixpkgs-unstable {
inherit (super) system;
};
})
];
mkVM = system:
nixpkgs.lib.nixosSystem {
inherit system;
modules = [
{nixpkgs.overlays = overlays;}
./hosts/vm/configuration.nix
./modules
./modules/profiles/desktop
home-manager.nixosModules.home-manager
];
specialArgs = {inherit myData;} // inputs;
};
in
in
{
nixosConfigurations = {
vm-x86_64 = mkVM "x86_64-linux";
@ -128,7 +131,7 @@
mtworx = nixpkgs.lib.nixosSystem {
system = "x86_64-linux";
modules = [
{nixpkgs.overlays = overlays;}
{ nixpkgs.overlays = overlays; }
./hosts/mtworx/configuration.nix
home-manager.nixosModules.home-manager
nixos-hardware.nixosModules.lenovo-thinkpad-x1-11th-gen
@ -147,13 +150,15 @@
}
];
specialArgs = {inherit myData;} // inputs;
specialArgs = {
inherit myData;
} // inputs;
};
vno1-oh2 = nixpkgs.lib.nixosSystem {
system = "x86_64-linux";
modules = [
{nixpkgs.overlays = overlays;}
{ nixpkgs.overlays = overlays; }
./hosts/vno1-oh2/configuration.nix
./modules
@ -184,13 +189,15 @@
}
];
specialArgs = {inherit myData;} // inputs;
specialArgs = {
inherit myData;
} // inputs;
};
fwminex = nixpkgs.lib.nixosSystem {
system = "x86_64-linux";
modules = [
{nixpkgs.overlays = overlays;}
{ nixpkgs.overlays = overlays; }
./hosts/fwminex/configuration.nix
home-manager.nixosModules.home-manager
nixos-hardware.nixosModules.framework-12th-gen-intel
@ -207,13 +214,15 @@
}
];
specialArgs = {inherit myData;} // inputs;
specialArgs = {
inherit myData;
} // inputs;
};
vno3-rp3b = nixpkgs.lib.nixosSystem {
system = "aarch64-linux";
modules = [
{nixpkgs.overlays = overlays;}
{ nixpkgs.overlays = overlays; }
./hosts/vno3-rp3b/configuration.nix
./modules
@ -232,13 +241,15 @@
}
];
specialArgs = {inherit myData;} // inputs;
specialArgs = {
inherit myData;
} // inputs;
};
fra1-a = nixpkgs.lib.nixosSystem {
system = "aarch64-linux";
modules = [
{nixpkgs.overlays = overlays;}
{ nixpkgs.overlays = overlays; }
agenix.nixosModules.default
home-manager.nixosModules.home-manager
@ -256,7 +267,9 @@
}
];
specialArgs = {inherit myData;} // inputs;
specialArgs = {
inherit myData;
} // inputs;
};
};
@ -266,8 +279,7 @@
profiles = {
system = {
sshUser = "motiejus";
path =
self.nixosConfigurations.vno1-oh2.pkgs.deploy-rs.lib.activate.nixos self.nixosConfigurations.vno1-oh2;
path = self.nixosConfigurations.vno1-oh2.pkgs.deploy-rs.lib.activate.nixos self.nixosConfigurations.vno1-oh2;
user = "root";
};
};
@ -278,8 +290,7 @@
profiles = {
system = {
sshUser = "motiejus";
path =
self.nixosConfigurations.fwminex.pkgs.deploy-rs.lib.activate.nixos self.nixosConfigurations.fwminex;
path = self.nixosConfigurations.fwminex.pkgs.deploy-rs.lib.activate.nixos self.nixosConfigurations.fwminex;
user = "root";
};
};
@ -290,8 +301,7 @@
profiles = {
system = {
sshUser = "motiejus";
path =
self.nixosConfigurations.mtworx.pkgs.deploy-rs.lib.activate.nixos self.nixosConfigurations.mtworx;
path = self.nixosConfigurations.mtworx.pkgs.deploy-rs.lib.activate.nixos self.nixosConfigurations.mtworx;
user = "root";
};
};
@ -302,8 +312,7 @@
profiles = {
system = {
sshUser = "motiejus";
path =
self.nixosConfigurations.vno3-rp3b.pkgs.deploy-rs.lib.activate.nixos self.nixosConfigurations.vno3-rp3b;
path = self.nixosConfigurations.vno3-rp3b.pkgs.deploy-rs.lib.activate.nixos self.nixosConfigurations.vno3-rp3b;
user = "root";
};
};
@ -314,51 +323,55 @@
profiles = {
system = {
sshUser = "motiejus";
path =
self.nixosConfigurations.fra1-a.pkgs.deploy-rs.lib.activate.nixos self.nixosConfigurations.fra1-a;
path = self.nixosConfigurations.fra1-a.pkgs.deploy-rs.lib.activate.nixos self.nixosConfigurations.fra1-a;
user = "root";
};
};
};
};
checks =
builtins.mapAttrs (
system: deployLib:
deployLib.deployChecks self.deploy
// {
pre-commit-check = inputs.pre-commit-hooks.lib.${system}.run {
src = ./.;
hooks = {
alejandra.enable = true;
deadnix.enable = true;
statix.enable = true;
};
checks = builtins.mapAttrs (
system: deployLib:
let
pkgs = import nixpkgs { inherit system overlays; };
in
deployLib.deployChecks self.deploy
// {
pre-commit-check = inputs.pre-commit-hooks.lib.${system}.run {
src = ./.;
hooks = {
nixfmt = {
enable = true;
package = pkgs.nixfmt-rfc-style;
};
deadnix.enable = true;
statix.enable = true;
};
};
compress-drv-test = let
pkgs = import nixpkgs {inherit system overlays;};
in
pkgs.callPackage ./pkgs/compress-drv/test.nix {};
}
)
deploy-rs.lib;
compress-drv-test = pkgs.callPackage ./pkgs/compress-drv/test.nix { };
}
) deploy-rs.lib;
}
// flake-utils.lib.eachDefaultSystem (system: let
pkgs = import nixpkgs {inherit system overlays;};
in {
devShells.default = pkgs.mkShellNoCC {
GIT_AUTHOR_EMAIL = "motiejus@jakstys.lt";
packages = [
pkgs.nix-output-monitor
pkgs.rage
pkgs.age-plugin-yubikey
pkgs.deploy-rs.deploy-rs
agenix.packages.${system}.agenix
];
inherit (self.checks.${system}.pre-commit-check) shellHook;
};
// flake-utils.lib.eachDefaultSystem (
system:
let
pkgs = import nixpkgs { inherit system overlays; };
in
{
devShells.default = pkgs.mkShellNoCC {
GIT_AUTHOR_EMAIL = "motiejus@jakstys.lt";
packages = [
pkgs.nix-output-monitor
pkgs.rage
pkgs.age-plugin-yubikey
pkgs.deploy-rs.deploy-rs
agenix.packages.${system}.agenix
];
inherit (self.checks.${system}.pre-commit-check) shellHook;
};
formatter = pkgs.alejandra;
});
formatter = pkgs.nixfmt-rfc-style;
}
);
}

67
hosts/fra1-a/configuration.nix
View File

@ -4,25 +4,31 @@
myData,
modulesPath,
...
}: {
imports = [(modulesPath + "/profiles/qemu-guest.nix")];
}:
{
imports = [ (modulesPath + "/profiles/qemu-guest.nix") ];
zfs-root = {
boot = {
enable = true;
devNodes = "/dev/disk/by-id/";
bootDevices = ["scsi-0QEMU_QEMU_HARDDISK_36151096"];
bootDevices = [ "scsi-0QEMU_QEMU_HARDDISK_36151096" ];
immutable = false;
availableKernelModules = ["xhci_pci" "virtio_pci" "virtio_scsi" "usbhid" "sr_mod" "virtio_gpu"];
availableKernelModules = [
"xhci_pci"
"virtio_pci"
"virtio_scsi"
"usbhid"
"sr_mod"
"virtio_gpu"
];
removableEfi = true;
kernelParams = ["console=tty"];
kernelParams = [ "console=tty" ];
sshUnlock = {
enable = true;
authorizedKeys =
(builtins.attrValues myData.people_pubkeys)
++ [
myData.hosts."vno1-oh2.servers.jakst".publicKey
];
authorizedKeys = (builtins.attrValues myData.people_pubkeys) ++ [
myData.hosts."vno1-oh2.servers.jakst".publicKey
];
};
};
};
@ -46,7 +52,7 @@
snapshot = {
enable = true;
mountpoints = ["/var/lib"];
mountpoints = [ "/var/lib" ];
};
};
@ -79,22 +85,24 @@
];
enable = true;
sshAllowSubnets = [myData.subnets.tailscale.sshPattern];
sshAllowSubnets = [ myData.subnets.tailscale.sshPattern ];
uidgid = myData.uidgid.updaterbot-deployee;
};
};
zfsunlock = {
enable = false;
targets."vno1-oh2.servers.jakst" = let
host = myData.hosts."vno1-oh2.servers.jakst";
in {
sshEndpoint = host.publicIP;
pingEndpoint = host.jakstIP;
remotePubkey = host.initrdPubKey;
pwFile = config.age.secrets.zfs-passphrase-vno1-oh2.path;
startAt = "*-*-* *:00/5:00";
};
targets."vno1-oh2.servers.jakst" =
let
host = myData.hosts."vno1-oh2.servers.jakst";
in
{
sshEndpoint = host.publicIP;
pingEndpoint = host.jakstIP;
remotePubkey = host.initrdPubKey;
pwFile = config.age.secrets.zfs-passphrase-vno1-oh2.path;
startAt = "*-*-* *:00/5:00";
};
};
};
};
@ -120,7 +128,10 @@
nsd = {
enable = true;
interfaces = ["0.0.0.0" "::"];
interfaces = [
"0.0.0.0"
"::"
];
zones = {
"jakstys.lt.".data = myData.jakstysLTZone;
"11sync.net.".data = myData.e11syncZone;
@ -134,8 +145,16 @@
domain = "servers.jakst";
useDHCP = true;
firewall = {
allowedUDPPorts = [53 443];
allowedTCPPorts = [22 53 80 443];
allowedUDPPorts = [
53
443
];
allowedTCPPorts = [
22
53
80
443
];
};
};

42
hosts/fwminex/configuration.nix
View File

@ -3,20 +3,28 @@
pkgs,
config,
...
}: let
}:
let
nvme = "/dev/disk/by-id/nvme-Samsung_SSD_970_EVO_Plus_2TB_S6P1NS0TA01331A_1";
in {
in
{
imports = [
../../modules
../../modules/profiles/btrfs
];
boot = {
kernelModules = ["kvm-intel"];
kernelModules = [ "kvm-intel" ];
loader.systemd-boot.enable = true;
initrd = {
kernelModules = ["usb_storage"];
availableKernelModules = ["xhci_pci" "thunderbolt" "nvme" "usbhid" "tpm_tis"];
kernelModules = [ "usb_storage" ];
availableKernelModules = [
"xhci_pci"
"thunderbolt"
"nvme"
"usbhid"
"tpm_tis"
];
systemd.enableTpm2 = true;
luks.devices = {
luksroot = {
@ -44,7 +52,7 @@ in {
"/" = {
device = "/dev/mapper/luksroot";
fsType = "btrfs";
options = ["compress=zstd"];
options = [ "compress=zstd" ];
};
"/boot" = {
device = "${nvme}-part1";
@ -86,18 +94,20 @@ in {
verboseLogs = false;
};
remote-builder.client = let
host = myData.hosts."fra1-a.servers.jakst";
in {
enable = true;
inherit (host) system supportedFeatures;
hostName = host.jakstIP;
sshKey = "/etc/ssh/ssh_host_ed25519_key";
};
remote-builder.client =
let
host = myData.hosts."fra1-a.servers.jakst";
in
{
enable = true;
inherit (host) system supportedFeatures;
hostName = host.jakstIP;
sshKey = "/etc/ssh/ssh_host_ed25519_key";
};
node_exporter = {
enable = true;
extraSubnets = [myData.subnets.vno1.cidr];
extraSubnets = [ myData.subnets.vno1.cidr ];
};
deployerbot = {
@ -127,7 +137,7 @@ in {
enable = true;
uidgid = myData.uidgid.updaterbot-deployee;
sshAllowSubnets = with myData.subnets; [tailscale.sshPattern];
sshAllowSubnets = with myData.subnets; [ tailscale.sshPattern ];
};
};

48
hosts/mtworx/configuration.nix
View File

@ -1,10 +1,8 @@
{
config,
myData,
...
}: let
{ config, myData, ... }:
let
nvme = "/dev/disk/by-id/nvme-WD_PC_SN810_SDCQNRY-1T00-1201_23234W800017";
in {
in
{
imports = [
../../shared/work
../../modules
@ -14,10 +12,16 @@ in {
];
boot = {
kernelModules = ["kvm-intel"];
kernelModules = [ "kvm-intel" ];
loader.systemd-boot.enable = true;
initrd = {
availableKernelModules = ["xhci_pci" "thunderbolt" "nvme" "usbhid" "tpm_tis"];
availableKernelModules = [
"xhci_pci"
"thunderbolt"
"nvme"
"usbhid"
"tpm_tis"
];
systemd = {
enableTpm2 = true;
emergencyAccess = true;
@ -26,7 +30,7 @@ in {
luksroot = {
device = "${nvme}-part3";
allowDiscards = true;
crypttabExtraOpts = ["tpm2-device=auto"];
crypttabExtraOpts = [ "tpm2-device=auto" ];
};
};
};
@ -43,7 +47,7 @@ in {
"/" = {
device = "/dev/mapper/luksroot";
fsType = "btrfs";
options = ["compress=zstd"];
options = [ "compress=zstd" ];
};
"/boot" = {
device = "${nvme}-part1";
@ -81,18 +85,20 @@ in {
toUser = config.mj.username;
};
remote-builder.client = let
host = myData.hosts."fra1-a.servers.jakst";
in {
enable = true;
inherit (host) system supportedFeatures;
hostName = host.jakstIP;
sshKey = "/etc/ssh/ssh_host_ed25519_key";
};
remote-builder.client =
let
host = myData.hosts."fra1-a.servers.jakst";
in
{
enable = true;
inherit (host) system supportedFeatures;
hostName = host.jakstIP;
sshKey = "/etc/ssh/ssh_host_ed25519_key";
};
node_exporter = {
enable = true;
extraSubnets = [myData.subnets.vno1.cidr];
extraSubnets = [ myData.subnets.vno1.cidr ];
};
deployerbot = {
@ -104,7 +110,7 @@ in {
enable = true;
uidgid = myData.uidgid.updaterbot-deployee;
sshAllowSubnets = with myData.subnets; [tailscale.sshPattern];
sshAllowSubnets = with myData.subnets; [ tailscale.sshPattern ];
};
};
@ -131,7 +137,7 @@ in {
};
};
users.extraGroups.vboxusers.members = ["motiejus"];
users.extraGroups.vboxusers.members = [ "motiejus" ];
security.tpm2.enable = true;

14
hosts/vm/configuration.nix
View File

@ -1,8 +1,5 @@
{ self, modulesPath, ... }:
{
self,
modulesPath,
...
}: {
imports = [
"${modulesPath}/profiles/all-hardware.nix"
"${modulesPath}/installer/cd-dvd/iso-image.nix"
@ -21,7 +18,10 @@
};
boot.loader.systemd-boot.enable = true;
boot.supportedFilesystems = ["zfs" "btrfs"];
boot.supportedFilesystems = [
"zfs"
"btrfs"
];
isoImage = {
isoName = "toolshed-${self.lastModifiedDate}.iso";
@ -31,7 +31,7 @@
makeUsbBootable = true; # USB booting
};
swapDevices = [];
swapDevices = [ ];
services = {
getty.autologinUser = "nixos";
@ -45,7 +45,7 @@
networking = {
hostName = "vm";
domain = "jakstys.lt";
firewall.allowedTCPPorts = [22];
firewall.allowedTCPPorts = [ 22 ];
hostId = "abefef01";
};
}

362
hosts/vno1-oh2/configuration.nix
View File

@ -4,12 +4,13 @@
pkgs,
myData,
...
}: {
}:
{
zfs-root = {
boot = {
enable = true;
devNodes = "/dev/disk/by-id/";
bootDevices = ["nvme-Samsung_SSD_970_EVO_Plus_2TB_S6P1NX0TA00913P"];
bootDevices = [ "nvme-Samsung_SSD_970_EVO_Plus_2TB_S6P1NX0TA00913P" ];
immutable = false;
availableKernelModules = [
"ahci"
@ -26,14 +27,14 @@
];
sshUnlock = {
enable = true;
authorizedKeys =
(builtins.attrValues myData.people_pubkeys)
++ [myData.hosts."fra1-a.servers.jakst".publicKey];
authorizedKeys = (builtins.attrValues myData.people_pubkeys) ++ [
myData.hosts."fra1-a.servers.jakst".publicKey
];
};
};
};
boot.binfmt.emulatedSystems = ["aarch64-linux"];
boot.binfmt.emulatedSystems = [ "aarch64-linux" ];
mj = {
stateVersion = "23.05";
@ -50,7 +51,11 @@
snapshot = {
enable = true;
mountpoints = ["/home" "/var/lib" "/var/log"];
mountpoints = [
"/home"
"/var/lib"
"/var/log"
];
};
zfsborg = {
@ -73,9 +78,7 @@
"tailscale"
"private/soju"
];
patterns = [
"- gitea/data/repo-archive/"
];
patterns = [ "- gitea/data/repo-archive/" ];
backup_at = "*-*-* 01:00:00 UTC";
prune.keep = {
within = "1d";
@ -86,7 +89,9 @@
}
{
mountpoint = "/var/lib";
repo = "borgstor@${myData.hosts."vno3-rp3b.servers.jakst".jakstIP}:${config.networking.hostName}.${config.networking.domain}-var_lib";
repo = "borgstor@${
myData.hosts."vno3-rp3b.servers.jakst".jakstIP
}:${config.networking.hostName}.${config.networking.domain}-var_lib";
paths = [
"bitwarden_rs"
"caddy"
@ -98,9 +103,7 @@
"tailscale"
"private/soju"
];
patterns = [
"- gitea/data/repo-archive/"
];
patterns = [ "- gitea/data/repo-archive/" ];
backup_at = "*-*-* 01:00:00 UTC";
}
@ -108,7 +111,7 @@
{
mountpoint = "/var/log";
repo = "zh2769@zh2769.rsync.net:${config.networking.hostName}.${config.networking.domain}-var_log";
paths = ["caddy"];
paths = [ "caddy" ];
patterns = [
"+ caddy/access-jakstys.lt.log-*.zst"
"- *"
@ -117,8 +120,10 @@
}
{
mountpoint = "/var/log";
repo = "borgstor@${myData.hosts."vno3-rp3b.servers.jakst".jakstIP}:${config.networking.hostName}.${config.networking.domain}-var_log";
paths = ["caddy"];
repo = "borgstor@${
myData.hosts."vno3-rp3b.servers.jakst".jakstIP
}:${config.networking.hostName}.${config.networking.domain}-var_log";
paths = [ "caddy" ];
patterns = [
"+ caddy/access-jakstys.lt.log-*.zst"
"- *"
@ -138,7 +143,9 @@
}
{
mountpoint = "/home";
repo = "borgstor@${myData.hosts."vno3-rp3b.servers.jakst".jakstIP}:${config.networking.hostName}.${config.networking.domain}-home-motiejus-annex2";
repo = "borgstor@${
myData.hosts."vno3-rp3b.servers.jakst".jakstIP
}:${config.networking.hostName}.${config.networking.domain}-home-motiejus-annex2";
paths = [
"motiejus/annex2"
"motiejus/.config/syncthing"
@ -157,7 +164,7 @@
services = {
friendlyport.ports = [
{
subnets = [myData.subnets.tailscale.cidr];
subnets = [ myData.subnets.tailscale.cidr ];
tcp = with myData.ports; [
80
443
@ -181,18 +188,20 @@
subnetCIDR = myData.subnets.tailscale.cidr;
};
nsd-acme = let
accountKey = config.age.secrets.letsencrypt-account-key.path;
in {
enable = true;
zones = {
"irc.jakstys.lt".accountKey = accountKey;
"hdd.jakstys.lt".accountKey = accountKey;
"hass.jakstys.lt".accountKey = accountKey;
"grafana.jakstys.lt".accountKey = accountKey;
"bitwarden.jakstys.lt".accountKey = accountKey;
nsd-acme =
let
accountKey = config.age.secrets.letsencrypt-account-key.path;
in
{
enable = true;
zones = {
"irc.jakstys.lt".accountKey = accountKey;
"hdd.jakstys.lt".accountKey = accountKey;
"hass.jakstys.lt".accountKey = accountKey;
"grafana.jakstys.lt".accountKey = accountKey;
"bitwarden.jakstys.lt".accountKey = accountKey;
};
};
};
deployerbot = {
follower = {
@ -202,7 +211,7 @@
];
enable = true;
sshAllowSubnets = [myData.subnets.tailscale.sshPattern];
sshAllowSubnets = [ myData.subnets.tailscale.sshPattern ];
uidgid = myData.uidgid.updaterbot-deployee;
};
};
@ -228,25 +237,29 @@
zfsunlock = {
enable = true;
targets."fra1-a.servers.jakst" = let
host = myData.hosts."fra1-a.servers.jakst";
in {
sshEndpoint = host.publicIP;
pingEndpoint = host.jakstIP;
remotePubkey = host.initrdPubKey;
pwFile = config.age.secrets.zfs-passphrase-fra1-a.path;
startAt = "*-*-* *:00/5:00";
};
targets."fra1-a.servers.jakst" =
let
host = myData.hosts."fra1-a.servers.jakst";
in
{
sshEndpoint = host.publicIP;
pingEndpoint = host.jakstIP;
remotePubkey = host.initrdPubKey;
pwFile = config.age.secrets.zfs-passphrase-fra1-a.path;
startAt = "*-*-* *:00/5:00";
};
};
remote-builder.client = let
host = myData.hosts."fra1-a.servers.jakst";
in {
enable = true;
inherit (host) system supportedFeatures;
hostName = host.jakstIP;
sshKey = "/etc/ssh/ssh_host_ed25519_key";
};
remote-builder.client =
let
host = myData.hosts."fra1-a.servers.jakst";
in
{
enable = true;
inherit (host) system supportedFeatures;
hostName = host.jakstIP;
sshKey = "/etc/ssh/ssh_host_ed25519_key";
};
};
};
@ -301,25 +314,27 @@
"www.jakstys.lt".extraConfig = ''
redir https://jakstys.lt
'';
"irc.jakstys.lt".extraConfig = let
gamja = pkgs.compressDrvWeb (pkgs.gamja.override {
gamjaConfig = {
server = {
url = "irc.jakstys.lt:6698";
nick = "motiejus";
"irc.jakstys.lt".extraConfig =
let
gamja = pkgs.compressDrvWeb (pkgs.gamja.override {
gamjaConfig = {
server = {
url = "irc.jakstys.lt:6698";
nick = "motiejus";
};
};
};
}) {};
in ''
@denied not remote_ip ${myData.subnets.tailscale.cidr}
abort @denied
tls {$CREDENTIALS_DIRECTORY}/irc.jakstys.lt-cert.pem {$CREDENTIALS_DIRECTORY}/irc.jakstys.lt-key.pem
}) { };
in
''
@denied not remote_ip ${myData.subnets.tailscale.cidr}
abort @denied
tls {$CREDENTIALS_DIRECTORY}/irc.jakstys.lt-cert.pem {$CREDENTIALS_DIRECTORY}/irc.jakstys.lt-key.pem
root * ${gamja}
file_server browse {
precompressed br gzip
}
'';
root * ${gamja}
file_server browse {
precompressed br gzip
}
'';
"dl.jakstys.lt".extraConfig = ''
root * /var/www/dl
file_server browse {
@ -452,47 +467,52 @@
evaluation_interval = "1m";
};
scrapeConfigs = let
port = builtins.toString myData.ports.exporters.node;
in [
{
job_name = "prometheus";
static_configs = [{targets = ["127.0.0.1:${toString myData.ports.prometheus}"];}];
}
{
job_name = "caddy";
static_configs = [{targets = ["127.0.0.1:${toString myData.ports.exporters.caddy}"];}];
}
{
job_name = "${config.networking.hostName}.${config.networking.domain}";
static_configs = [{targets = ["127.0.0.1:${port}"];}];
}
{
job_name = "fra1-a.servers.jakst";