From dafda65208099540988f6d9fd657971e82035058 Mon Sep 17 00:00:00 2001 From: ant Date: Tue, 10 Jun 2025 22:41:18 +0200 Subject: [PATCH] add os config for hs --- flake.nix | 7 +- os/hs/configuration.nix | 209 +++++++++++++++++++++++++++++++ os/hs/disks.nix | 10 ++ os/hs/hardware-configuration.nix | 40 ++++++ os/hs/syncthing.nix | 58 +++++++++ 5 files changed, 323 insertions(+), 1 deletion(-) create mode 100644 os/hs/configuration.nix create mode 100644 os/hs/disks.nix create mode 100644 os/hs/hardware-configuration.nix create mode 100644 os/hs/syncthing.nix diff --git a/flake.nix b/flake.nix index cf0ae41..caee268 100644 --- a/flake.nix +++ b/flake.nix @@ -99,5 +99,10 @@ ./os/moon.nix ]; }; - }; + + nixosConfigurations.hs = nixpkgs.lib.nixosSystem { + system = "x86_64-linux"; + modules = [ ./os/hs/configuration.nix ]; + }; + }; } diff --git a/os/hs/configuration.nix b/os/hs/configuration.nix new file mode 100644 index 0000000..77944ff --- /dev/null +++ b/os/hs/configuration.nix @@ -0,0 +1,209 @@ +{ config, pkgs, ... }: + +let + sshKeys = [ + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAM15boHYClgaBXAIyWSjbJd3W/bwcIE6YZwLu/K+Ipp ant@nixos" + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKCTCKcHgCZOlGeCEz0+HcoYMyXzFy3l3igsG+nhMC8Z ant@moon" + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB5zrLxiyG6T5eupXT/wqhvtt8Cuak4DtPEzCyksqa1a ant@allegro" + ]; + domain = "antoinev.freeboxos.fr"; + # ./ssh/authorized_keys_root; +in { + imports = [ + ./hardware-configuration.nix + ./syncthing.nix + ./disks.nix + ]; + + nix.settings = { experimental-features = [ "nix-command" "flakes" ]; }; + + boot.kernelParams = [ "ip=dhcp" ]; + boot = { + loader.systemd-boot.enable = true; + loader.efi.canTouchEfiVariables = true; + initrd = { + availableKernelModules = [ "r8169" ]; + network = { + enable = true; + ssh = { + enable = true; + port = 22; + authorizedKeys = sshKeys; + hostKeys = [ "/etc/ssh/ssh_host_ed25519_key" ]; + shell = "/bin/cryptsetup-askpass"; + }; + }; + }; + }; + + hardware.graphics = { + enable = true; + enable32Bit = true; + extraPackages = with pkgs; [ nvidia-vaapi-driver ]; + + }; + + hardware.nvidia.package = + config.boot.kernelPackages.nvidiaPackages.legacy_535; + + services.xserver.videoDrivers = [ "nvidia" ]; + + networking.hostName = "hs"; # Define your hostname. + networking.networkmanager.enable = true; + networking.domain = domain; + + time.timeZone = "Europe/Paris"; + i18n.defaultLocale = "fr_FR.UTF-8"; + i18n.extraLocaleSettings = { + LC_ADDRESS = "fr_FR.UTF-8"; + LC_IDENTIFICATION = "fr_FR.UTF-8"; + LC_MEASUREMENT = "fr_FR.UTF-8"; + LC_MONETARY = "fr_FR.UTF-8"; + LC_NAME = "fr_FR.UTF-8"; + LC_NUMERIC = "fr_FR.UTF-8"; + LC_PAPER = "fr_FR.UTF-8"; + LC_TELEPHONE = "fr_FR.UTF-8"; + LC_TIME = "fr_FR.UTF-8"; + }; + services.xserver.xkb = { + layout = "fr"; + variant = ""; + }; + console.keyMap = "fr"; + + users.users.ant = { + isNormalUser = true; + description = "ant"; + extraGroups = [ "networkmanager" "wheel" ]; + openssh.authorizedKeys.keys = sshKeys; + }; + security.sudo.wheelNeedsPassword = false; + + nixpkgs.config.allowUnfree = true; + environment.systemPackages = with pkgs; [ neovim tmux nh git curl wget htop ]; + + # Some programs need SUID wrappers, can be configured further or are + # started in user sessions. + # programs.mtr.enable = true; + # programs.gnupg.agent = { + # enable = true; + # enableSSHSupport = true; + # }; + + # List services that you want to enable: + + # Enable the OpenSSH daemon. + services.openssh = { + enable = true; + settings.PasswordAuthentication = false; + }; + users.users.root.openssh.authorizedKeys.keys = sshKeys; + + programs.fish = { + enable = true; + interactiveShellInit = '' + set -gx fish_greeting + ''; + }; + users.defaultUserShell = pkgs.fish; + + # Open ports in the firewall. + networking.firewall.allowedTCPPorts = [ + 80 + 443 # ssl + 25565 + ]; + networking.firewall.allowedUDPPorts = [ 25565 ]; + # Or disable the firewall altogether. + # networking.firewall.enable = false; + + networking.interfaces.enp10s0.wakeOnLan.enable = true; + + systemd.services.ragnamod = { + enable = true; + after = [ "network.target" ]; + wantedBy = [ "default.target" ]; + description = "Ragnamod server"; + path = [ pkgs.jre ]; + serviceConfig = { + Type = "simple"; + ExecStart = "/home/ant/ragnamod/startserver.sh"; + User = "ant"; + }; + }; + + services.glances = { + enable = true; + openFirewall = true; + }; + + services.immich = { + enable = true; + accelerationDevices = null; + }; + users.users.immich.extraGroups = [ "video" "render" ]; + + services.nginx = { + enable = true; + recommendedGzipSettings = true; + recommendedOptimisation = true; + recommendedProxySettings = true; + recommendedTlsSettings = true; + virtualHosts = let + reverseProxy = port: { + enableACME = true; + forceSSL = true; + locations."/" = { + proxyPass = "http://127.0.0.1:${builtins.toString port}"; + proxyWebsockets = true; + }; + }; + in { + "immich.antoinevaure.fr" = { + enableACME = true; + forceSSL = true; + locations."/" = { + proxyWebsockets = true; + recommendedProxySettings = true; + extraConfig = '' + client_max_body_size 50000M; + proxy_read_timeout 600s; + proxy_send_timeout 600s; + send_timeout 600s; + ''; + proxyPass = + "http://localhost:${builtins.toString config.services.immich.port}"; + }; + }; + + # "jellyfin.${domain}" = (reverseProxy 8096); + # "sonarr.${domain}" = (reverseProxy 8989); + # "radarr.${domain}" = (reverseProxy 7878); + # "qbittorrent.${domain}" = (reverseProxy qbittorrentPort); + "git.antoinevaure.fr" = (reverseProxy 2999); + # "nextcloud.${domain}" = { + # enableACME = true; + # forceSSL = true; + # }; + }; + }; + + services.gitea = { + enable = true; + settings.server.HTTP_PORT = 2999; + settings.service.DISABLE_REGISTRATION = true; + settings.server.DOMAIN = "git.antoinevaure.fr"; + settings.server.ROOT_URL = "https://git.antoinevaure.fr/"; + settings.repository = { + ENABLE_PUSH_CREATE_USER = true; + ENABLE_PUSH_CREATE_ORG = true; + }; + }; + + security.acme = { + acceptTerms = true; + defaults.email = "contact@antoinevaure.fr"; + }; + + system.stateVersion = "24.11"; +} diff --git a/os/hs/disks.nix b/os/hs/disks.nix new file mode 100644 index 0000000..4d16f7d --- /dev/null +++ b/os/hs/disks.nix @@ -0,0 +1,10 @@ +{ config, pkgs, ... }: { + environment.etc.crypttab.text = '' + cryptstorage UUID=25ba8562-0029-4802-9a98-a6a1d51637d3 /root/disk1_key + ''; + + fileSystems."/disk1" = + { device = "/dev/disk/by-uuid/5143b73f-8474-4467-86b1-73552785c9f9"; + fsType = "ext4"; + }; +} diff --git a/os/hs/hardware-configuration.nix b/os/hs/hardware-configuration.nix new file mode 100644 index 0000000..bc5dd4b --- /dev/null +++ b/os/hs/hardware-configuration.nix @@ -0,0 +1,40 @@ +# Do not modify this file! It was generated by ‘nixos-generate-config’ +# and may be overwritten by future invocations. Please make changes +# to /etc/nixos/configuration.nix instead. +{ config, lib, pkgs, modulesPath, ... }: + +{ + imports = + [ (modulesPath + "/installer/scan/not-detected.nix") + ]; + + boot.initrd.availableKernelModules = [ "nvme" "xhci_pci" "ahci" "usbhid" "usb_storage" "sd_mod" ]; + boot.initrd.kernelModules = [ ]; + boot.kernelModules = [ "kvm-amd" ]; + boot.extraModulePackages = [ ]; + + fileSystems."/" = + { device = "/dev/disk/by-uuid/0844f6dd-b3b9-4a25-8435-e24775f8a5c9"; + fsType = "ext4"; + }; + + boot.initrd.luks.devices."luks-1f257dc8-c436-4a5c-8652-8d9b35faa34f".device = "/dev/disk/by-uuid/1f257dc8-c436-4a5c-8652-8d9b35faa34f"; + + fileSystems."/boot" = + { device = "/dev/disk/by-uuid/CD7C-CD77"; + fsType = "vfat"; + options = [ "fmask=0077" "dmask=0077" ]; + }; + + swapDevices = [ ]; + + # Enables DHCP on each ethernet and wireless interface. In case of scripted networking + # (the default) this is the recommended approach. When using systemd-networkd it's + # still possible to use this option, but it's recommended to use it in conjunction + # with explicit per-interface declarations with `networking.interfaces..useDHCP`. + networking.useDHCP = lib.mkDefault true; + # networking.interfaces.enp10s0.useDHCP = lib.mkDefault true; + + nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux"; + hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware; +} diff --git a/os/hs/syncthing.nix b/os/hs/syncthing.nix new file mode 100644 index 0000000..2e1c28c --- /dev/null +++ b/os/hs/syncthing.nix @@ -0,0 +1,58 @@ +{ config, pkgs, ... }: { + services.syncthing = { + enable = true; + openDefaultPorts = true; + # group = "syncthing"; + # user = "syncthing"; + # dataDir = "/home/syncthing/shares"; + # configDir = "/home/syncthing/config"; + overrideDevices = + true; # overrides any devices added or deleted through the WebUI + overrideFolders = + true; # overrides any folders added or deleted through the WebUI + settings = { + devices = { + "home" = { + id = + "FRCTEHB-WI3Q3CH-6MPKKRX-FTJMOCK-44K2D32-ORM52ZI-S2GTX2X-IRUSAQ5"; + }; + "android" = { + id = + "4Z7HDYB-C56BONH-JRBN5D7-LDFNHQJ-5BQDLVU-O3SMBPI-3VZTL7V-ERGU2Q5"; + }; + "allegro" = { + id = + "CLANFN6-Q26KKQL-S6OZ4JW-75CM2JC-R47DIWM-G7RBX7T-B4TJPTS-5U3ZRQH"; + }; + }; + folders = { + "~/notes" = { + id = "njhxw-6wmte"; + devices = [ + "home" + "android" + "allegro" + ]; # Which devices to share the folder with + }; + + "~/android_dcim" = { + id = "3ku25-ww5zg"; + devices = [ + "home" + "android" + "allegro" + ]; # Which devices to share the folder with + }; + + "~/passdb" = { + id = "eo3io-kbitv"; + devices = [ + "home" + "android" + "allegro" + ]; # Which devices to share the folder with + }; + }; + }; + }; +}