forked from Fachschaft/nixConfig
linting and formatting existing code
This commit is contained in:
parent
f5b2ddaf11
commit
0d528669f1
GPG key ID:
42DED0E2D8F04FB6
11 changed files with 202 additions and 182 deletions
|
|
@ -28,6 +28,6 @@
|
|||
};
|
||||
};
|
||||
|
||||
outputs = inputs@{ flake-parts, ... }:
|
||||
flake-parts.lib.mkFlake { inherit inputs; } (import ./flake-module.nix);
|
||||
outputs = inputs @ {flake-parts, ...}:
|
||||
flake-parts.lib.mkFlake {inherit inputs;} (import ./flake-module.nix);
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,20 +1,30 @@
|
|||
# copied and adopted from maralorns config
|
||||
|
||||
# This automatically searches for nixos configs in ./machines/${name}/configuration.nix
|
||||
# and exposes them as outputs.nixosConfigurations.${name}
|
||||
{ withSystem, lib, inputs, ... }: {
|
||||
{
|
||||
withSystem,
|
||||
lib,
|
||||
inputs,
|
||||
...
|
||||
}: {
|
||||
flake = {
|
||||
nixosConfigurations = withSystem "x86_64-linux" ({ pkgs, ... }:
|
||||
let
|
||||
nixosConfigurations = withSystem "x86_64-linux" ({pkgs, ...}: let
|
||||
machines = builtins.attrNames (builtins.readDir ./machines);
|
||||
makeSystem = name:
|
||||
makeSystem = name: let
|
||||
importedConfig = import (./. + "/machines/${name}/configuration.nix");
|
||||
systemConfig =
|
||||
if lib.isFunction importedConfig
|
||||
then x: importedConfig (x // {flake-inputs = inputs;})
|
||||
else importedConfig;
|
||||
in
|
||||
pkgs.nixos {
|
||||
imports = [
|
||||
(import (./. + "/machines/${name}/configuration.nix") inputs)
|
||||
systemConfig
|
||||
inputs.sops-nix.nixosModules.sops
|
||||
inputs.impermanence.nixosModules.impermanence
|
||||
];
|
||||
};
|
||||
in lib.genAttrs machines makeSystem);
|
||||
in
|
||||
lib.genAttrs machines makeSystem);
|
||||
};
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,19 +1,17 @@
|
|||
flake-inputs:
|
||||
{config, pkgs, lib, ... }: {
|
||||
|
||||
imports = [
|
||||
./hardware-configuration.nix
|
||||
../../modules/jitsi.nix
|
||||
../../roles
|
||||
./network.nix
|
||||
];
|
||||
{
|
||||
imports = [
|
||||
./hardware-configuration.nix
|
||||
../../modules/jitsi.nix
|
||||
../../roles
|
||||
./network.nix
|
||||
];
|
||||
|
||||
services.mathebau-jitsi = {
|
||||
enable = true;
|
||||
hostName = "meet.mathebau.de";
|
||||
};
|
||||
|
||||
# System configuration here
|
||||
# System configuration here
|
||||
networking.hostName = "ghatanothoa";
|
||||
system.stateVersion = "23.11";
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,15 +1,15 @@
|
|||
{config, lib, pkgs, modulesPath, ...}: {
|
||||
imports = [ ];
|
||||
{lib, ...}: {
|
||||
imports = [];
|
||||
|
||||
fileSystems."/" = {
|
||||
device = "gha-root";
|
||||
fsType = "tmpfs";
|
||||
options = [ "size=1G" "mode=755" ];
|
||||
options = ["size=1G" "mode=755"];
|
||||
};
|
||||
fileSystems."/persist" = {
|
||||
device = "/dev/disk/by-uuid/e0a160ef-7d46-4705-9152-a6b602898136";
|
||||
fsType = "btrfs";
|
||||
options = [ "subvol=persist" ];
|
||||
options = ["subvol=persist"];
|
||||
neededForBoot = true;
|
||||
};
|
||||
fileSystems."/boot" = {
|
||||
|
|
@ -19,11 +19,10 @@
|
|||
fileSystems."/nix" = {
|
||||
device = "/dev/disk/by-uuid/e0a160ef-7d46-4705-9152-a6b602898136";
|
||||
fsType = "btrfs";
|
||||
options = [ "subvol=nix" ];
|
||||
options = ["subvol=nix"];
|
||||
};
|
||||
|
||||
swapDevices =
|
||||
[{ device = "/dev/disk/by-uuid/e6e3ba6b-c9f5-4960-b56d-f49760d76a4a"; }];
|
||||
swapDevices = [{device = "/dev/disk/by-uuid/e6e3ba6b-c9f5-4960-b56d-f49760d76a4a";}];
|
||||
|
||||
nix.settings.max-jobs = lib.mkDefault 4;
|
||||
|
||||
|
|
|
|||
|
|
@ -1,15 +1,16 @@
|
|||
# We sohuld put that config somewhere in roles and give it a parameter or something,
|
||||
# everyone gets the same nameserver and the same prefixLength and address vs defaultGateway alsways
|
||||
# depend on the same thing
|
||||
# depend on the same thing
|
||||
{
|
||||
imports = [ ];
|
||||
imports = [];
|
||||
networking = {
|
||||
interfaces.enX0.ipv4.addresses = [ {
|
||||
address = "192.168.0.25";
|
||||
prefixLength = 16;
|
||||
} ];
|
||||
interfaces.enX0.ipv4.addresses = [
|
||||
{
|
||||
address = "192.168.0.25";
|
||||
prefixLength = 16;
|
||||
}
|
||||
];
|
||||
defaultGateway = "192.168.0.152";
|
||||
nameservers = ["130.83.2.22" "130.83.56.60" "130.83.22.60" "130.82.22.63"];
|
||||
};
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -1,47 +1,47 @@
|
|||
{lib, config, ...} :
|
||||
|
||||
let
|
||||
inherit (lib)
|
||||
{
|
||||
lib,
|
||||
config,
|
||||
...
|
||||
}: let
|
||||
inherit
|
||||
(lib)
|
||||
mkEnableOption
|
||||
mkIf
|
||||
mkOption
|
||||
types
|
||||
;
|
||||
cfg = config.impermanence;
|
||||
in
|
||||
in {
|
||||
imports = [];
|
||||
|
||||
{
|
||||
imports = [ ];
|
||||
|
||||
options.impermanence = {
|
||||
enable = mkEnableOption "impermanence";
|
||||
storagePath = mkOption {
|
||||
type = types.path;
|
||||
default = "/persist";
|
||||
description = "The path where persistent data is stored";
|
||||
options.impermanence = {
|
||||
enable = mkEnableOption "impermanence";
|
||||
storagePath = mkOption {
|
||||
type = types.path;
|
||||
default = "/persist";
|
||||
description = "The path where persistent data is stored";
|
||||
};
|
||||
name = mkOption {
|
||||
type = types.str;
|
||||
default = "persist";
|
||||
description = "the name of the persistent data store";
|
||||
};
|
||||
};
|
||||
name = mkOption {
|
||||
type = types.str;
|
||||
default = "persist";
|
||||
description = "the name of the persistent data store";
|
||||
};
|
||||
};
|
||||
|
||||
config = mkIf cfg.enable {
|
||||
environment.persistence.${cfg.name} = {
|
||||
persistentStoragePath = cfg.storagePath;
|
||||
directories = [
|
||||
"/var/log"
|
||||
"/var/lib/nixos"
|
||||
];
|
||||
files = [
|
||||
"/etc/ssh/ssh_host_ed25519_key"
|
||||
"/etc/ssh/ssh_host_ed25519_key.pub"
|
||||
"/etc/ssh/ssh_host_rsa_key"
|
||||
"/etc/ssh/ssh_host_rsa_key.pub"
|
||||
];
|
||||
config = mkIf cfg.enable {
|
||||
environment.persistence.${cfg.name} = {
|
||||
persistentStoragePath = cfg.storagePath;
|
||||
directories = [
|
||||
"/var/log"
|
||||
"/var/lib/nixos"
|
||||
];
|
||||
files = [
|
||||
"/etc/ssh/ssh_host_ed25519_key"
|
||||
"/etc/ssh/ssh_host_ed25519_key.pub"
|
||||
"/etc/ssh/ssh_host_rsa_key"
|
||||
"/etc/ssh/ssh_host_rsa_key.pub"
|
||||
];
|
||||
};
|
||||
environment.etc.machine-id.source = "${cfg.storagePath}/machine-id";
|
||||
};
|
||||
environment.etc.machine-id.source = "${cfg.storagePath}/machine-id";
|
||||
};
|
||||
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,16 +1,21 @@
|
|||
{pkgs, config, lib, modulesPath, ...}:
|
||||
let
|
||||
inherit (lib)
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
modulesPath,
|
||||
...
|
||||
}: let
|
||||
inherit
|
||||
(lib)
|
||||
mkIf
|
||||
mkEnableOption
|
||||
mkOption
|
||||
head;
|
||||
head
|
||||
;
|
||||
inherit (lib.types) str;
|
||||
cfg = config.services.mathebau-jitsi;
|
||||
in
|
||||
{
|
||||
in {
|
||||
imports = [(modulesPath + "/services/web-apps/jitsi-meet.nix")];
|
||||
|
||||
|
||||
options.services.mathebau-jitsi = {
|
||||
enable = mkEnableOption "mathebau jitsi service";
|
||||
hostName = mkOption {
|
||||
|
|
@ -23,18 +28,25 @@ in
|
|||
};
|
||||
|
||||
config = mkIf cfg.enable {
|
||||
services.jitsi-meet = {
|
||||
enable = true;
|
||||
hostName = cfg.hostName;
|
||||
config = {
|
||||
defaultLang = "de";
|
||||
services = {
|
||||
jitsi-meet = {
|
||||
enable = true;
|
||||
config = {
|
||||
defaultLang = "de";
|
||||
};
|
||||
inherit (cfg) hostName;
|
||||
};
|
||||
};
|
||||
services.jitsi-videobridge = {
|
||||
openFirewall = true;
|
||||
nat = {
|
||||
publicAddress = "130.83.2.184";
|
||||
localAddress = cfg.localAddress;
|
||||
jitsi-videobridge = {
|
||||
openFirewall = true;
|
||||
nat = {
|
||||
publicAddress = "130.83.2.184";
|
||||
inherit (cfg) localAddress;
|
||||
};
|
||||
};
|
||||
#We are behind a reverse proxy that handles TLS
|
||||
nginx.virtualHosts."${cfg.hostName}" = {
|
||||
enableACME = false;
|
||||
forceSSL = false;
|
||||
};
|
||||
};
|
||||
environment.persistence.${config.impermanence.name} = {
|
||||
|
|
@ -43,13 +55,7 @@ in
|
|||
"/var/lib/prosody"
|
||||
];
|
||||
};
|
||||
#We are behind a reverse proxy that handles TLS
|
||||
services.nginx.virtualHosts."${cfg.hostName}" = {
|
||||
enableACME = false;
|
||||
forceSSL = false;
|
||||
};
|
||||
|
||||
#The network ports for HTTP(S) are not opened automatically
|
||||
networking.firewall.allowedTCPPorts = [ 80 443 ];
|
||||
#The network ports for HTTP(S) are not opened automatically
|
||||
networking.firewall.allowedTCPPorts = [80 443];
|
||||
};
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,37 +1,34 @@
|
|||
{lib, ...} :
|
||||
with lib;
|
||||
|
||||
let
|
||||
{lib, ...}:
|
||||
with lib; let
|
||||
admins = {
|
||||
nerf = {
|
||||
hashedPassword =
|
||||
"$y$j9T$SJcjUIcs3JYuM5oyxfEQa/$tUBQT07FK4cb9xm.A6ZKVnFIPNOYMOKC6Dt6hadCuJ7";
|
||||
keys = [
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEdA4LpEGUUmN8esFyrNZXFb2GiBID9/S6zzhcnofQuP nerf@nerflap2"
|
||||
];
|
||||
hashedPassword = "$y$j9T$SJcjUIcs3JYuM5oyxfEQa/$tUBQT07FK4cb9xm.A6ZKVnFIPNOYMOKC6Dt6hadCuJ7";
|
||||
keys = [
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEdA4LpEGUUmN8esFyrNZXFb2GiBID9/S6zzhcnofQuP nerf@nerflap2"
|
||||
];
|
||||
};
|
||||
gonne = {
|
||||
hashedPassword =
|
||||
"$6$EtGpHEcFkOi0yUWp$slXf0CvIUrhdqaoCrQ5YwtYu2IVuE1RGGst4fnDPRLWVm.lYx0ruvSAF2/vw/sLbW37ORJjlb0NHQ.kSG7cVY/";
|
||||
keys = [
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFopCUadohY3wg9AoEup9TDRDMyEPSLsQoCnN4lsKCrr gonne@mathebau.de NixOS"
|
||||
];
|
||||
hashedPassword = "$6$EtGpHEcFkOi0yUWp$slXf0CvIUrhdqaoCrQ5YwtYu2IVuE1RGGst4fnDPRLWVm.lYx0ruvSAF2/vw/sLbW37ORJjlb0NHQ.kSG7cVY/";
|
||||
keys = [
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFopCUadohY3wg9AoEup9TDRDMyEPSLsQoCnN4lsKCrr gonne@mathebau.de NixOS"
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
mkAdmin = name :
|
||||
{hashedPassword, keys}: {
|
||||
mkAdmin = name: {
|
||||
hashedPassword,
|
||||
keys,
|
||||
}: {
|
||||
"${name}" = {
|
||||
isNormalUser = true;
|
||||
createHome = true;
|
||||
extraGroups = [ "wheel" ];
|
||||
extraGroups = ["wheel"];
|
||||
group = "users";
|
||||
home = "/home/${name}";
|
||||
openssh.authorizedKeys = { inherit keys; };
|
||||
openssh.authorizedKeys = {inherit keys;};
|
||||
inherit hashedPassword;
|
||||
};
|
||||
};
|
||||
|
||||
in {
|
||||
users.users = mkMerge (mapAttrsToList mkAdmin admins);
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,62 +1,72 @@
|
|||
{pkgs, config, lib, modulesPath, ...} : {
|
||||
|
||||
imports = [
|
||||
./admins.nix
|
||||
./nix_keys.nix
|
||||
./prometheusNodeExporter.nix
|
||||
(modulesPath + "/virtualisation/xen-domU.nix")
|
||||
../modules/impermanence.nix
|
||||
{
|
||||
pkgs,
|
||||
lib,
|
||||
modulesPath,
|
||||
...
|
||||
}: {
|
||||
imports = [
|
||||
./admins.nix
|
||||
./nix_keys.nix
|
||||
./prometheusNodeExporter.nix
|
||||
(modulesPath + "/virtualisation/xen-domU.nix")
|
||||
../modules/impermanence.nix
|
||||
];
|
||||
nix = {
|
||||
extraOptions = ''
|
||||
experimental-features = nix-command flakes
|
||||
builders-use-substitutes = true
|
||||
'';
|
||||
};
|
||||
|
||||
networking = {
|
||||
firewall = { # these shoud be default, but better make sure!
|
||||
enable = true;
|
||||
allowPing = true;
|
||||
};
|
||||
nftables.enable = true;
|
||||
useDHCP = false; # We don't speak DHCP and even if we would, we should enable it per interface
|
||||
# hosts = # TODO write something to autogenerate ip adresses!
|
||||
};
|
||||
|
||||
users = {
|
||||
mutableUsers = false;
|
||||
users.root.hashedPassword = "!";
|
||||
};
|
||||
|
||||
impermanence.enable = true;
|
||||
|
||||
sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
|
||||
|
||||
environment = {
|
||||
systemPackages = builtins.attrValues {
|
||||
inherit (pkgs)
|
||||
htop lsof tmux btop;
|
||||
};
|
||||
};
|
||||
|
||||
services = {
|
||||
journald.extraConfig = "SystemMaxUse=5G";
|
||||
|
||||
nginx = {
|
||||
recommendedOptimisation = true;
|
||||
recommendedGzipSettings = true;
|
||||
recommendedTlsSettings = true;
|
||||
nix = {
|
||||
extraOptions = ''
|
||||
experimental-features = nix-command flakes
|
||||
builders-use-substitutes = true
|
||||
'';
|
||||
};
|
||||
|
||||
openssh = {
|
||||
enable = true;
|
||||
settings = {
|
||||
PermitRootLogin = "no";
|
||||
PasswordAuthentication = false;
|
||||
networking = {
|
||||
firewall = {
|
||||
# these shoud be default, but better make sure!
|
||||
enable = true;
|
||||
allowPing = true;
|
||||
};
|
||||
nftables.enable = true;
|
||||
useDHCP = false; # We don't speak DHCP and even if we would, we should enable it per interface
|
||||
# hosts = # TODO write something to autogenerate ip adresses!
|
||||
};
|
||||
|
||||
users = {
|
||||
mutableUsers = false;
|
||||
users.root.hashedPassword = "!";
|
||||
};
|
||||
|
||||
impermanence.enable = true;
|
||||
|
||||
sops.age.sshKeyPaths = ["/etc/ssh/ssh_host_ed25519_key"];
|
||||
|
||||
environment = {
|
||||
systemPackages = builtins.attrValues {
|
||||
inherit
|
||||
(pkgs)
|
||||
htop
|
||||
lsof
|
||||
tmux
|
||||
btop
|
||||
;
|
||||
};
|
||||
};
|
||||
#Prevent clock drift due to interaction problem with xen hardware clock
|
||||
timesyncd.enable = lib.mkForce true;
|
||||
};
|
||||
|
||||
services = {
|
||||
journald.extraConfig = "SystemMaxUse=5G";
|
||||
|
||||
nginx = {
|
||||
recommendedOptimisation = true;
|
||||
recommendedGzipSettings = true;
|
||||
recommendedTlsSettings = true;
|
||||
};
|
||||
|
||||
openssh = {
|
||||
enable = true;
|
||||
settings = {
|
||||
PermitRootLogin = "no";
|
||||
PasswordAuthentication = false;
|
||||
};
|
||||
};
|
||||
#Prevent clock drift due to interaction problem with xen hardware clock
|
||||
timesyncd.enable = lib.mkForce true;
|
||||
};
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,5 +1,5 @@
|
|||
{
|
||||
imports = [ ];
|
||||
imports = [];
|
||||
nix.settings.trusted-public-keys = [
|
||||
"nerflap2-1:pDZCg0oo9PxNQxwVSQSvycw7WXTl53PGvVeZWvxuqJc="
|
||||
"gonne.mathebau.de-1:FsXFyFiBFE/JxC9MCkt/WuiXjx5dkRI9RXj0FxOQrV0="
|
||||
|
|
|
|||
|
|
@ -1,15 +1,14 @@
|
|||
{config, ...}:
|
||||
{
|
||||
imports = [ ];
|
||||
{config, ...}: {
|
||||
imports = [];
|
||||
services.prometheus.exporters.node = {
|
||||
enable = true;
|
||||
port = 9100;
|
||||
# Aligned with https://git.rwth-aachen.de/fsdmath/server/prometheus/-/blob/main/node_exporter/etc/default/prometheus-node-exporter
|
||||
# It was compiled along the following steps:
|
||||
# 1. Does the current Debian release supports the collector?
|
||||
# 2. Is the collector depracated in the latest release?
|
||||
# 3. Could you probably use the collected metrics for monitoring or are they useless because they make no sense in our context
|
||||
# (e.g. power adapter inside a VM, use fibre port connection)?
|
||||
# Aligned with https://git.rwth-aachen.de/fsdmath/server/prometheus/-/blob/main/node_exporter/etc/default/prometheus-node-exporter
|
||||
# It was compiled along the following steps:
|
||||
# 1. Does the current Debian release supports the collector?
|
||||
# 2. Is the collector depracated in the latest release?
|
||||
# 3. Could you probably use the collected metrics for monitoring or are they useless because they make no sense in our context
|
||||
# (e.g. power adapter inside a VM, use fibre port connection)?
|
||||
disabledCollectors = [
|
||||
"arp"
|
||||
"bcache"
|
||||
|
|
@ -35,6 +34,6 @@
|
|||
"processes"
|
||||
];
|
||||
};
|
||||
networking.firewall.allowedTCPPorts = [ 9100 ];
|
||||
environment.persistence.${config.impermanence.name}.directories = [ "/var/lib/${config.services.prometheus.stateDir}" ];
|
||||
networking.firewall.allowedTCPPorts = [9100];
|
||||
environment.persistence.${config.impermanence.name}.directories = ["/var/lib/${config.services.prometheus.stateDir}"];
|
||||
}
|
||||
|
|
|
|||
Loading…
Reference in a new issue