add os config for hs
This commit is contained in:
ant
parent
ccd3e64936
commit
dafda65208
5 changed files with 323 additions and 1 deletions
|
|
@ -99,5 +99,10 @@
|
||||||
./os/moon.nix
|
./os/moon.nix
|
||||||
];
|
];
|
||||||
};
|
};
|
||||||
|
|
||||||
|
nixosConfigurations.hs = nixpkgs.lib.nixosSystem {
|
||||||
|
system = "x86_64-linux";
|
||||||
|
modules = [ ./os/hs/configuration.nix ];
|
||||||
|
};
|
||||||
};
|
};
|
||||||
}
|
}
|
||||||
|
|
|
||||||
209
os/hs/configuration.nix
Normal file
209
os/hs/configuration.nix
Normal file
|
|
@ -0,0 +1,209 @@
|
||||||
|
{ config, pkgs, ... }:
|
||||||
|
|
||||||
|
let
|
||||||
|
sshKeys = [
|
||||||
|
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAM15boHYClgaBXAIyWSjbJd3W/bwcIE6YZwLu/K+Ipp ant@nixos"
|
||||||
|
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKCTCKcHgCZOlGeCEz0+HcoYMyXzFy3l3igsG+nhMC8Z ant@moon"
|
||||||
|
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB5zrLxiyG6T5eupXT/wqhvtt8Cuak4DtPEzCyksqa1a ant@allegro"
|
||||||
|
];
|
||||||
|
domain = "antoinev.freeboxos.fr";
|
||||||
|
# ./ssh/authorized_keys_root;
|
||||||
|
in {
|
||||||
|
imports = [
|
||||||
|
./hardware-configuration.nix
|
||||||
|
./syncthing.nix
|
||||||
|
./disks.nix
|
||||||
|
];
|
||||||
|
|
||||||
|
nix.settings = { experimental-features = [ "nix-command" "flakes" ]; };
|
||||||
|
|
||||||
|
boot.kernelParams = [ "ip=dhcp" ];
|
||||||
|
boot = {
|
||||||
|
loader.systemd-boot.enable = true;
|
||||||
|
loader.efi.canTouchEfiVariables = true;
|
||||||
|
initrd = {
|
||||||
|
availableKernelModules = [ "r8169" ];
|
||||||
|
network = {
|
||||||
|
enable = true;
|
||||||
|
ssh = {
|
||||||
|
enable = true;
|
||||||
|
port = 22;
|
||||||
|
authorizedKeys = sshKeys;
|
||||||
|
hostKeys = [ "/etc/ssh/ssh_host_ed25519_key" ];
|
||||||
|
shell = "/bin/cryptsetup-askpass";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
hardware.graphics = {
|
||||||
|
enable = true;
|
||||||
|
enable32Bit = true;
|
||||||
|
extraPackages = with pkgs; [ nvidia-vaapi-driver ];
|
||||||
|
|
||||||
|
};
|
||||||
|
|
||||||
|
hardware.nvidia.package =
|
||||||
|
config.boot.kernelPackages.nvidiaPackages.legacy_535;
|
||||||
|
|
||||||
|
services.xserver.videoDrivers = [ "nvidia" ];
|
||||||
|
|
||||||
|
networking.hostName = "hs"; # Define your hostname.
|
||||||
|
networking.networkmanager.enable = true;
|
||||||
|
networking.domain = domain;
|
||||||
|
|
||||||
|
time.timeZone = "Europe/Paris";
|
||||||
|
i18n.defaultLocale = "fr_FR.UTF-8";
|
||||||
|
i18n.extraLocaleSettings = {
|
||||||
|
LC_ADDRESS = "fr_FR.UTF-8";
|
||||||
|
LC_IDENTIFICATION = "fr_FR.UTF-8";
|
||||||
|
LC_MEASUREMENT = "fr_FR.UTF-8";
|
||||||
|
LC_MONETARY = "fr_FR.UTF-8";
|
||||||
|
LC_NAME = "fr_FR.UTF-8";
|
||||||
|
LC_NUMERIC = "fr_FR.UTF-8";
|
||||||
|
LC_PAPER = "fr_FR.UTF-8";
|
||||||
|
LC_TELEPHONE = "fr_FR.UTF-8";
|
||||||
|
LC_TIME = "fr_FR.UTF-8";
|
||||||
|
};
|
||||||
|
services.xserver.xkb = {
|
||||||
|
layout = "fr";
|
||||||
|
variant = "";
|
||||||
|
};
|
||||||
|
console.keyMap = "fr";
|
||||||
|
|
||||||
|
users.users.ant = {
|
||||||
|
isNormalUser = true;
|
||||||
|
description = "ant";
|
||||||
|
extraGroups = [ "networkmanager" "wheel" ];
|
||||||
|
openssh.authorizedKeys.keys = sshKeys;
|
||||||
|
};
|
||||||
|
security.sudo.wheelNeedsPassword = false;
|
||||||
|
|
||||||
|
nixpkgs.config.allowUnfree = true;
|
||||||
|
environment.systemPackages = with pkgs; [ neovim tmux nh git curl wget htop ];
|
||||||
|
|
||||||
|
# Some programs need SUID wrappers, can be configured further or are
|
||||||
|
# started in user sessions.
|
||||||
|
# programs.mtr.enable = true;
|
||||||
|
# programs.gnupg.agent = {
|
||||||
|
# enable = true;
|
||||||
|
# enableSSHSupport = true;
|
||||||
|
# };
|
||||||
|
|
||||||
|
# List services that you want to enable:
|
||||||
|
|
||||||
|
# Enable the OpenSSH daemon.
|
||||||
|
services.openssh = {
|
||||||
|
enable = true;
|
||||||
|
settings.PasswordAuthentication = false;
|
||||||
|
};
|
||||||
|
users.users.root.openssh.authorizedKeys.keys = sshKeys;
|
||||||
|
|
||||||
|
programs.fish = {
|
||||||
|
enable = true;
|
||||||
|
interactiveShellInit = ''
|
||||||
|
set -gx fish_greeting
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
users.defaultUserShell = pkgs.fish;
|
||||||
|
|
||||||
|
# Open ports in the firewall.
|
||||||
|
networking.firewall.allowedTCPPorts = [
|
||||||
|
80
|
||||||
|
443 # ssl
|
||||||
|
25565
|
||||||
|
];
|
||||||
|
networking.firewall.allowedUDPPorts = [ 25565 ];
|
||||||
|
# Or disable the firewall altogether.
|
||||||
|
# networking.firewall.enable = false;
|
||||||
|
|
||||||
|
networking.interfaces.enp10s0.wakeOnLan.enable = true;
|
||||||
|
|
||||||
|
systemd.services.ragnamod = {
|
||||||
|
enable = true;
|
||||||
|
after = [ "network.target" ];
|
||||||
|
wantedBy = [ "default.target" ];
|
||||||
|
description = "Ragnamod server";
|
||||||
|
path = [ pkgs.jre ];
|
||||||
|
serviceConfig = {
|
||||||
|
Type = "simple";
|
||||||
|
ExecStart = "/home/ant/ragnamod/startserver.sh";
|
||||||
|
User = "ant";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
services.glances = {
|
||||||
|
enable = true;
|
||||||
|
openFirewall = true;
|
||||||
|
};
|
||||||
|
|
||||||
|
services.immich = {
|
||||||
|
enable = true;
|
||||||
|
accelerationDevices = null;
|
||||||
|
};
|
||||||
|
users.users.immich.extraGroups = [ "video" "render" ];
|
||||||
|
|
||||||
|
services.nginx = {
|
||||||
|
enable = true;
|
||||||
|
recommendedGzipSettings = true;
|
||||||
|
recommendedOptimisation = true;
|
||||||
|
recommendedProxySettings = true;
|
||||||
|
recommendedTlsSettings = true;
|
||||||
|
virtualHosts = let
|
||||||
|
reverseProxy = port: {
|
||||||
|
enableACME = true;
|
||||||
|
forceSSL = true;
|
||||||
|
locations."/" = {
|
||||||
|
proxyPass = "http://127.0.0.1:${builtins.toString port}";
|
||||||
|
proxyWebsockets = true;
|
||||||
|
};
|
||||||
|
};
|
||||||
|
in {
|
||||||
|
"immich.antoinevaure.fr" = {
|
||||||
|
enableACME = true;
|
||||||
|
forceSSL = true;
|
||||||
|
locations."/" = {
|
||||||
|
proxyWebsockets = true;
|
||||||
|
recommendedProxySettings = true;
|
||||||
|
extraConfig = ''
|
||||||
|
client_max_body_size 50000M;
|
||||||
|
proxy_read_timeout 600s;
|
||||||
|
proxy_send_timeout 600s;
|
||||||
|
send_timeout 600s;
|
||||||
|
'';
|
||||||
|
proxyPass =
|
||||||
|
"http://localhost:${builtins.toString config.services.immich.port}";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
# "jellyfin.${domain}" = (reverseProxy 8096);
|
||||||
|
# "sonarr.${domain}" = (reverseProxy 8989);
|
||||||
|
# "radarr.${domain}" = (reverseProxy 7878);
|
||||||
|
# "qbittorrent.${domain}" = (reverseProxy qbittorrentPort);
|
||||||
|
"git.antoinevaure.fr" = (reverseProxy 2999);
|
||||||
|
# "nextcloud.${domain}" = {
|
||||||
|
# enableACME = true;
|
||||||
|
# forceSSL = true;
|
||||||
|
# };
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
services.gitea = {
|
||||||
|
enable = true;
|
||||||
|
settings.server.HTTP_PORT = 2999;
|
||||||
|
settings.service.DISABLE_REGISTRATION = true;
|
||||||
|
settings.server.DOMAIN = "git.antoinevaure.fr";
|
||||||
|
settings.server.ROOT_URL = "https://git.antoinevaure.fr/";
|
||||||
|
settings.repository = {
|
||||||
|
ENABLE_PUSH_CREATE_USER = true;
|
||||||
|
ENABLE_PUSH_CREATE_ORG = true;
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
security.acme = {
|
||||||
|
acceptTerms = true;
|
||||||
|
defaults.email = "contact@antoinevaure.fr";
|
||||||
|
};
|
||||||
|
|
||||||
|
system.stateVersion = "24.11";
|
||||||
|
}
|
||||||
10
os/hs/disks.nix
Normal file
10
os/hs/disks.nix
Normal file
|
|
@ -0,0 +1,10 @@
|
||||||
|
{ config, pkgs, ... }: {
|
||||||
|
environment.etc.crypttab.text = ''
|
||||||
|
cryptstorage UUID=25ba8562-0029-4802-9a98-a6a1d51637d3 /root/disk1_key
|
||||||
|
'';
|
||||||
|
|
||||||
|
fileSystems."/disk1" =
|
||||||
|
{ device = "/dev/disk/by-uuid/5143b73f-8474-4467-86b1-73552785c9f9";
|
||||||
|
fsType = "ext4";
|
||||||
|
};
|
||||||
|
}
|
||||||
40
os/hs/hardware-configuration.nix
Normal file
40
os/hs/hardware-configuration.nix
Normal file
|
|
@ -0,0 +1,40 @@
|
||||||
|
# Do not modify this file! It was generated by ‘nixos-generate-config’
|
||||||
|
# and may be overwritten by future invocations. Please make changes
|
||||||
|
# to /etc/nixos/configuration.nix instead.
|
||||||
|
{ config, lib, pkgs, modulesPath, ... }:
|
||||||
|
|
||||||
|
{
|
||||||
|
imports =
|
||||||
|
[ (modulesPath + "/installer/scan/not-detected.nix")
|
||||||
|
];
|
||||||
|
|
||||||
|
boot.initrd.availableKernelModules = [ "nvme" "xhci_pci" "ahci" "usbhid" "usb_storage" "sd_mod" ];
|
||||||
|
boot.initrd.kernelModules = [ ];
|
||||||
|
boot.kernelModules = [ "kvm-amd" ];
|
||||||
|
boot.extraModulePackages = [ ];
|
||||||
|
|
||||||
|
fileSystems."/" =
|
||||||
|
{ device = "/dev/disk/by-uuid/0844f6dd-b3b9-4a25-8435-e24775f8a5c9";
|
||||||
|
fsType = "ext4";
|
||||||
|
};
|
||||||
|
|
||||||
|
boot.initrd.luks.devices."luks-1f257dc8-c436-4a5c-8652-8d9b35faa34f".device = "/dev/disk/by-uuid/1f257dc8-c436-4a5c-8652-8d9b35faa34f";
|
||||||
|
|
||||||
|
fileSystems."/boot" =
|
||||||
|
{ device = "/dev/disk/by-uuid/CD7C-CD77";
|
||||||
|
fsType = "vfat";
|
||||||
|
options = [ "fmask=0077" "dmask=0077" ];
|
||||||
|
};
|
||||||
|
|
||||||
|
swapDevices = [ ];
|
||||||
|
|
||||||
|
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
|
||||||
|
# (the default) this is the recommended approach. When using systemd-networkd it's
|
||||||
|
# still possible to use this option, but it's recommended to use it in conjunction
|
||||||
|
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
|
||||||
|
networking.useDHCP = lib.mkDefault true;
|
||||||
|
# networking.interfaces.enp10s0.useDHCP = lib.mkDefault true;
|
||||||
|
|
||||||
|
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
|
||||||
|
hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
|
||||||
|
}
|
||||||
58
os/hs/syncthing.nix
Normal file
58
os/hs/syncthing.nix
Normal file
|
|
@ -0,0 +1,58 @@
|
||||||
|
{ config, pkgs, ... }: {
|
||||||
|
services.syncthing = {
|
||||||
|
enable = true;
|
||||||
|
openDefaultPorts = true;
|
||||||
|
# group = "syncthing";
|
||||||
|
# user = "syncthing";
|
||||||
|
# dataDir = "/home/syncthing/shares";
|
||||||
|
# configDir = "/home/syncthing/config";
|
||||||
|
overrideDevices =
|
||||||
|
true; # overrides any devices added or deleted through the WebUI
|
||||||
|
overrideFolders =
|
||||||
|
true; # overrides any folders added or deleted through the WebUI
|
||||||
|
settings = {
|
||||||
|
devices = {
|
||||||
|
"home" = {
|
||||||
|
id =
|
||||||
|
"FRCTEHB-WI3Q3CH-6MPKKRX-FTJMOCK-44K2D32-ORM52ZI-S2GTX2X-IRUSAQ5";
|
||||||
|
};
|
||||||
|
"android" = {
|
||||||
|
id =
|
||||||
|
"4Z7HDYB-C56BONH-JRBN5D7-LDFNHQJ-5BQDLVU-O3SMBPI-3VZTL7V-ERGU2Q5";
|
||||||
|
};
|
||||||
|
"allegro" = {
|
||||||
|
id =
|
||||||
|
"CLANFN6-Q26KKQL-S6OZ4JW-75CM2JC-R47DIWM-G7RBX7T-B4TJPTS-5U3ZRQH";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
folders = {
|
||||||
|
"~/notes" = {
|
||||||
|
id = "njhxw-6wmte";
|
||||||
|
devices = [
|
||||||
|
"home"
|
||||||
|
"android"
|
||||||
|
"allegro"
|
||||||
|
]; # Which devices to share the folder with
|
||||||
|
};
|
||||||
|
|
||||||
|
"~/android_dcim" = {
|
||||||
|
id = "3ku25-ww5zg";
|
||||||
|
devices = [
|
||||||
|
"home"
|
||||||
|
"android"
|
||||||
|
"allegro"
|
||||||
|
]; # Which devices to share the folder with
|
||||||
|
};
|
||||||
|
|
||||||
|
"~/passdb" = {
|
||||||
|
id = "eo3io-kbitv";
|
||||||
|
devices = [
|
||||||
|
"home"
|
||||||
|
"android"
|
||||||
|
"allegro"
|
||||||
|
]; # Which devices to share the folder with
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
}
|
||||||
Loading…
Add table
Add a link
Reference in a new issue