add os config for hs
This commit is contained in:
ant
parent
ccd3e64936
commit
dafda65208
5 changed files with 323 additions and 1 deletions
209
os/hs/configuration.nix
Normal file
209
os/hs/configuration.nix
Normal file
|
|
@ -0,0 +1,209 @@
|
|||
{ config, pkgs, ... }:
|
||||
|
||||
let
|
||||
sshKeys = [
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAM15boHYClgaBXAIyWSjbJd3W/bwcIE6YZwLu/K+Ipp ant@nixos"
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKCTCKcHgCZOlGeCEz0+HcoYMyXzFy3l3igsG+nhMC8Z ant@moon"
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB5zrLxiyG6T5eupXT/wqhvtt8Cuak4DtPEzCyksqa1a ant@allegro"
|
||||
];
|
||||
domain = "antoinev.freeboxos.fr";
|
||||
# ./ssh/authorized_keys_root;
|
||||
in {
|
||||
imports = [
|
||||
./hardware-configuration.nix
|
||||
./syncthing.nix
|
||||
./disks.nix
|
||||
];
|
||||
|
||||
nix.settings = { experimental-features = [ "nix-command" "flakes" ]; };
|
||||
|
||||
boot.kernelParams = [ "ip=dhcp" ];
|
||||
boot = {
|
||||
loader.systemd-boot.enable = true;
|
||||
loader.efi.canTouchEfiVariables = true;
|
||||
initrd = {
|
||||
availableKernelModules = [ "r8169" ];
|
||||
network = {
|
||||
enable = true;
|
||||
ssh = {
|
||||
enable = true;
|
||||
port = 22;
|
||||
authorizedKeys = sshKeys;
|
||||
hostKeys = [ "/etc/ssh/ssh_host_ed25519_key" ];
|
||||
shell = "/bin/cryptsetup-askpass";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
hardware.graphics = {
|
||||
enable = true;
|
||||
enable32Bit = true;
|
||||
extraPackages = with pkgs; [ nvidia-vaapi-driver ];
|
||||
|
||||
};
|
||||
|
||||
hardware.nvidia.package =
|
||||
config.boot.kernelPackages.nvidiaPackages.legacy_535;
|
||||
|
||||
services.xserver.videoDrivers = [ "nvidia" ];
|
||||
|
||||
networking.hostName = "hs"; # Define your hostname.
|
||||
networking.networkmanager.enable = true;
|
||||
networking.domain = domain;
|
||||
|
||||
time.timeZone = "Europe/Paris";
|
||||
i18n.defaultLocale = "fr_FR.UTF-8";
|
||||
i18n.extraLocaleSettings = {
|
||||
LC_ADDRESS = "fr_FR.UTF-8";
|
||||
LC_IDENTIFICATION = "fr_FR.UTF-8";
|
||||
LC_MEASUREMENT = "fr_FR.UTF-8";
|
||||
LC_MONETARY = "fr_FR.UTF-8";
|
||||
LC_NAME = "fr_FR.UTF-8";
|
||||
LC_NUMERIC = "fr_FR.UTF-8";
|
||||
LC_PAPER = "fr_FR.UTF-8";
|
||||
LC_TELEPHONE = "fr_FR.UTF-8";
|
||||
LC_TIME = "fr_FR.UTF-8";
|
||||
};
|
||||
services.xserver.xkb = {
|
||||
layout = "fr";
|
||||
variant = "";
|
||||
};
|
||||
console.keyMap = "fr";
|
||||
|
||||
users.users.ant = {
|
||||
isNormalUser = true;
|
||||
description = "ant";
|
||||
extraGroups = [ "networkmanager" "wheel" ];
|
||||
openssh.authorizedKeys.keys = sshKeys;
|
||||
};
|
||||
security.sudo.wheelNeedsPassword = false;
|
||||
|
||||
nixpkgs.config.allowUnfree = true;
|
||||
environment.systemPackages = with pkgs; [ neovim tmux nh git curl wget htop ];
|
||||
|
||||
# Some programs need SUID wrappers, can be configured further or are
|
||||
# started in user sessions.
|
||||
# programs.mtr.enable = true;
|
||||
# programs.gnupg.agent = {
|
||||
# enable = true;
|
||||
# enableSSHSupport = true;
|
||||
# };
|
||||
|
||||
# List services that you want to enable:
|
||||
|
||||
# Enable the OpenSSH daemon.
|
||||
services.openssh = {
|
||||
enable = true;
|
||||
settings.PasswordAuthentication = false;
|
||||
};
|
||||
users.users.root.openssh.authorizedKeys.keys = sshKeys;
|
||||
|
||||
programs.fish = {
|
||||
enable = true;
|
||||
interactiveShellInit = ''
|
||||
set -gx fish_greeting
|
||||
'';
|
||||
};
|
||||
users.defaultUserShell = pkgs.fish;
|
||||
|
||||
# Open ports in the firewall.
|
||||
networking.firewall.allowedTCPPorts = [
|
||||
80
|
||||
443 # ssl
|
||||
25565
|
||||
];
|
||||
networking.firewall.allowedUDPPorts = [ 25565 ];
|
||||
# Or disable the firewall altogether.
|
||||
# networking.firewall.enable = false;
|
||||
|
||||
networking.interfaces.enp10s0.wakeOnLan.enable = true;
|
||||
|
||||
systemd.services.ragnamod = {
|
||||
enable = true;
|
||||
after = [ "network.target" ];
|
||||
wantedBy = [ "default.target" ];
|
||||
description = "Ragnamod server";
|
||||
path = [ pkgs.jre ];
|
||||
serviceConfig = {
|
||||
Type = "simple";
|
||||
ExecStart = "/home/ant/ragnamod/startserver.sh";
|
||||
User = "ant";
|
||||
};
|
||||
};
|
||||
|
||||
services.glances = {
|
||||
enable = true;
|
||||
openFirewall = true;
|
||||
};
|
||||
|
||||
services.immich = {
|
||||
enable = true;
|
||||
accelerationDevices = null;
|
||||
};
|
||||
users.users.immich.extraGroups = [ "video" "render" ];
|
||||
|
||||
services.nginx = {
|
||||
enable = true;
|
||||
recommendedGzipSettings = true;
|
||||
recommendedOptimisation = true;
|
||||
recommendedProxySettings = true;
|
||||
recommendedTlsSettings = true;
|
||||
virtualHosts = let
|
||||
reverseProxy = port: {
|
||||
enableACME = true;
|
||||
forceSSL = true;
|
||||
locations."/" = {
|
||||
proxyPass = "http://127.0.0.1:${builtins.toString port}";
|
||||
proxyWebsockets = true;
|
||||
};
|
||||
};
|
||||
in {
|
||||
"immich.antoinevaure.fr" = {
|
||||
enableACME = true;
|
||||
forceSSL = true;
|
||||
locations."/" = {
|
||||
proxyWebsockets = true;
|
||||
recommendedProxySettings = true;
|
||||
extraConfig = ''
|
||||
client_max_body_size 50000M;
|
||||
proxy_read_timeout 600s;
|
||||
proxy_send_timeout 600s;
|
||||
send_timeout 600s;
|
||||
'';
|
||||
proxyPass =
|
||||
"http://localhost:${builtins.toString config.services.immich.port}";
|
||||
};
|
||||
};
|
||||
|
||||
# "jellyfin.${domain}" = (reverseProxy 8096);
|
||||
# "sonarr.${domain}" = (reverseProxy 8989);
|
||||
# "radarr.${domain}" = (reverseProxy 7878);
|
||||
# "qbittorrent.${domain}" = (reverseProxy qbittorrentPort);
|
||||
"git.antoinevaure.fr" = (reverseProxy 2999);
|
||||
# "nextcloud.${domain}" = {
|
||||
# enableACME = true;
|
||||
# forceSSL = true;
|
||||
# };
|
||||
};
|
||||
};
|
||||
|
||||
services.gitea = {
|
||||
enable = true;
|
||||
settings.server.HTTP_PORT = 2999;
|
||||
settings.service.DISABLE_REGISTRATION = true;
|
||||
settings.server.DOMAIN = "git.antoinevaure.fr";
|
||||
settings.server.ROOT_URL = "https://git.antoinevaure.fr/";
|
||||
settings.repository = {
|
||||
ENABLE_PUSH_CREATE_USER = true;
|
||||
ENABLE_PUSH_CREATE_ORG = true;
|
||||
};
|
||||
};
|
||||
|
||||
security.acme = {
|
||||
acceptTerms = true;
|
||||
defaults.email = "contact@antoinevaure.fr";
|
||||
};
|
||||
|
||||
system.stateVersion = "24.11";
|
||||
}
|
||||
10
os/hs/disks.nix
Normal file
10
os/hs/disks.nix
Normal file
|
|
@ -0,0 +1,10 @@
|
|||
{ config, pkgs, ... }: {
|
||||
environment.etc.crypttab.text = ''
|
||||
cryptstorage UUID=25ba8562-0029-4802-9a98-a6a1d51637d3 /root/disk1_key
|
||||
'';
|
||||
|
||||
fileSystems."/disk1" =
|
||||
{ device = "/dev/disk/by-uuid/5143b73f-8474-4467-86b1-73552785c9f9";
|
||||
fsType = "ext4";
|
||||
};
|
||||
}
|
||||
40
os/hs/hardware-configuration.nix
Normal file
40
os/hs/hardware-configuration.nix
Normal file
|
|
@ -0,0 +1,40 @@
|
|||
# Do not modify this file! It was generated by ‘nixos-generate-config’
|
||||
# and may be overwritten by future invocations. Please make changes
|
||||
# to /etc/nixos/configuration.nix instead.
|
||||
{ config, lib, pkgs, modulesPath, ... }:
|
||||
|
||||
{
|
||||
imports =
|
||||
[ (modulesPath + "/installer/scan/not-detected.nix")
|
||||
];
|
||||
|
||||
boot.initrd.availableKernelModules = [ "nvme" "xhci_pci" "ahci" "usbhid" "usb_storage" "sd_mod" ];
|
||||
boot.initrd.kernelModules = [ ];
|
||||
boot.kernelModules = [ "kvm-amd" ];
|
||||
boot.extraModulePackages = [ ];
|
||||
|
||||
fileSystems."/" =
|
||||
{ device = "/dev/disk/by-uuid/0844f6dd-b3b9-4a25-8435-e24775f8a5c9";
|
||||
fsType = "ext4";
|
||||
};
|
||||
|
||||
boot.initrd.luks.devices."luks-1f257dc8-c436-4a5c-8652-8d9b35faa34f".device = "/dev/disk/by-uuid/1f257dc8-c436-4a5c-8652-8d9b35faa34f";
|
||||
|
||||
fileSystems."/boot" =
|
||||
{ device = "/dev/disk/by-uuid/CD7C-CD77";
|
||||
fsType = "vfat";
|
||||
options = [ "fmask=0077" "dmask=0077" ];
|
||||
};
|
||||
|
||||
swapDevices = [ ];
|
||||
|
||||
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
|
||||
# (the default) this is the recommended approach. When using systemd-networkd it's
|
||||
# still possible to use this option, but it's recommended to use it in conjunction
|
||||
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
|
||||
networking.useDHCP = lib.mkDefault true;
|
||||
# networking.interfaces.enp10s0.useDHCP = lib.mkDefault true;
|
||||
|
||||
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
|
||||
hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
|
||||
}
|
||||
58
os/hs/syncthing.nix
Normal file
58
os/hs/syncthing.nix
Normal file
|
|
@ -0,0 +1,58 @@
|
|||
{ config, pkgs, ... }: {
|
||||
services.syncthing = {
|
||||
enable = true;
|
||||
openDefaultPorts = true;
|
||||
# group = "syncthing";
|
||||
# user = "syncthing";
|
||||
# dataDir = "/home/syncthing/shares";
|
||||
# configDir = "/home/syncthing/config";
|
||||
overrideDevices =
|
||||
true; # overrides any devices added or deleted through the WebUI
|
||||
overrideFolders =
|
||||
true; # overrides any folders added or deleted through the WebUI
|
||||
settings = {
|
||||
devices = {
|
||||
"home" = {
|
||||
id =
|
||||
"FRCTEHB-WI3Q3CH-6MPKKRX-FTJMOCK-44K2D32-ORM52ZI-S2GTX2X-IRUSAQ5";
|
||||
};
|
||||
"android" = {
|
||||
id =
|
||||
"4Z7HDYB-C56BONH-JRBN5D7-LDFNHQJ-5BQDLVU-O3SMBPI-3VZTL7V-ERGU2Q5";
|
||||
};
|
||||
"allegro" = {
|
||||
id =
|
||||
"CLANFN6-Q26KKQL-S6OZ4JW-75CM2JC-R47DIWM-G7RBX7T-B4TJPTS-5U3ZRQH";
|
||||
};
|
||||
};
|
||||
folders = {
|
||||
"~/notes" = {
|
||||
id = "njhxw-6wmte";
|
||||
devices = [
|
||||
"home"
|
||||
"android"
|
||||
"allegro"
|
||||
]; # Which devices to share the folder with
|
||||
};
|
||||
|
||||
"~/android_dcim" = {
|
||||
id = "3ku25-ww5zg";
|
||||
devices = [
|
||||
"home"
|
||||
"android"
|
||||
"allegro"
|
||||
]; # Which devices to share the folder with
|
||||
};
|
||||
|
||||
"~/passdb" = {
|
||||
id = "eo3io-kbitv";
|
||||
devices = [
|
||||
"home"
|
||||
"android"
|
||||
"allegro"
|
||||
]; # Which devices to share the folder with
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
Loading…
Add table
Add a link
Reference in a new issue