forked from Fachschaft/nixConfig
Compare commits
No commits in common. "145d2aee96ab39d0028a16d05da3e62688f84890" and "22d8749f7ae707bdd89fb70b1d2ba27eda8d2e0a" have entirely different histories.
145d2aee96
...
22d8749f7a
15 changed files with 189 additions and 297 deletions
2
.gitignore
vendored
2
.gitignore
vendored
|
@ -2,4 +2,4 @@
|
||||||
# Ignore build outputs from performing a nix-build or `nix build` command
|
# Ignore build outputs from performing a nix-build or `nix build` command
|
||||||
result
|
result
|
||||||
result-*
|
result-*
|
||||||
.pre-commit-config.yaml
|
|
||||||
|
|
|
@ -170,10 +170,6 @@ In your hardware
|
||||||
configuration you should basically only write you filesystem layout and your hostPlatform. The bootloading stuff
|
configuration you should basically only write you filesystem layout and your hostPlatform. The bootloading stuff
|
||||||
is already taken care of by `../../roles`.
|
is already taken care of by `../../roles`.
|
||||||
|
|
||||||
The `flake-inputs` argument is optional, but you can use it if you need to get a hold of the flake inputs,
|
|
||||||
else this is a complete normal nixos system configuration module (with a lot of settings already imorted
|
|
||||||
from `../../roles`).
|
|
||||||
|
|
||||||
As of moment of writing `network.nix` should contain ip, nameserver and default gateway setup. As parts of
|
As of moment of writing `network.nix` should contain ip, nameserver and default gateway setup. As parts of
|
||||||
this is constant across all systems and will undergo refactor soon.
|
this is constant across all systems and will undergo refactor soon.
|
||||||
|
|
||||||
|
|
|
@ -1,48 +1,28 @@
|
||||||
{inputs, ...}: {
|
{inputs, ...}:
|
||||||
|
{
|
||||||
# debug = true;
|
# debug = true;
|
||||||
# We only define machines config in this flake yet, so we only include
|
# We only define machines config in this flake yet, so we only include
|
||||||
# the module that builds these. This file might get fuller, if we need to
|
# the module that builds these. This file might get fuller, if we need to
|
||||||
# build our own packages, that are not flakes.
|
# build our own packages, that are not flakes.
|
||||||
imports = [
|
imports = [ ./nixos/flake-module.nix
|
||||||
./nixos/flake-module.nix
|
|
||||||
inputs.pre-commit-hooks.flakeModule
|
|
||||||
# To import a flake module
|
# To import a flake module
|
||||||
# 1. Add foo to inputs
|
# 1. Add foo to inputs
|
||||||
# 2. Add foo as a parameter to the outputs function
|
# 2. Add foo as a parameter to the outputs function
|
||||||
# 3. Add here: foo.flakeModule
|
# 3. Add here: foo.flakeModule
|
||||||
|
|
||||||
];
|
];
|
||||||
systems = ["x86_64-linux"];
|
systems = [ "x86_64-linux"];
|
||||||
perSystem = {
|
# perSystem = { config, self', inputs', pkgs, system, ... }: {
|
||||||
config,
|
|
||||||
inputs',
|
|
||||||
pkgs,
|
|
||||||
...
|
|
||||||
}: {
|
|
||||||
devShells.default = pkgs.mkShell {
|
|
||||||
shellHook = config.pre-commit.installationScript;
|
|
||||||
};
|
|
||||||
|
|
||||||
pre-commit = {
|
|
||||||
check.enable = true;
|
|
||||||
pkgs = inputs'.nixpkgs.legacyPackages;
|
|
||||||
settings.hooks = {
|
|
||||||
nil.enable = true;
|
|
||||||
statix.enable = true;
|
|
||||||
deadnix.enable = true;
|
|
||||||
alejandra.enable = true;
|
|
||||||
};
|
|
||||||
};
|
|
||||||
|
|
||||||
# Per-system attributes can be defined here. The self' and inputs'
|
# Per-system attributes can be defined here. The self' and inputs'
|
||||||
# module parameters provide easy access to attributes of the same
|
# module parameters provide easy access to attributes of the same
|
||||||
# system.
|
# system.
|
||||||
};
|
|
||||||
|
|
||||||
# Equivalent to inputs'.nixpkgs.legacyPackages.hello;
|
# Equivalent to inputs'.nixpkgs.legacyPackages.hello;
|
||||||
# flake = {
|
# };
|
||||||
|
# flake = {
|
||||||
# The usual flake attributes can be defined here, including system-
|
# The usual flake attributes can be defined here, including system-
|
||||||
# agnostic ones like nixosModule and system-enumerating ones, although
|
# agnostic ones like nixosModule and system-enumerating ones, although
|
||||||
# those are more easily expressed in perSystem.
|
# those are more easily expressed in perSystem.
|
||||||
|
|
||||||
# };
|
# };
|
||||||
}
|
}
|
||||||
|
|
56
flake.lock
56
flake.lock
|
@ -33,24 +33,6 @@
|
||||||
"type": "indirect"
|
"type": "indirect"
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
"flake-utils": {
|
|
||||||
"inputs": {
|
|
||||||
"systems": "systems"
|
|
||||||
},
|
|
||||||
"locked": {
|
|
||||||
"lastModified": 1685518550,
|
|
||||||
"narHash": "sha256-o2d0KcvaXzTrPRIo0kOLV0/QXHhDQ5DTi+OxcjO8xqY=",
|
|
||||||
"owner": "numtide",
|
|
||||||
"repo": "flake-utils",
|
|
||||||
"rev": "a1720a10a6cfe8234c0e93907ffe81be440f4cef",
|
|
||||||
"type": "github"
|
|
||||||
},
|
|
||||||
"original": {
|
|
||||||
"owner": "numtide",
|
|
||||||
"repo": "flake-utils",
|
|
||||||
"type": "github"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"impermanence": {
|
"impermanence": {
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1694622745,
|
"lastModified": 1694622745,
|
||||||
|
@ -153,35 +135,12 @@
|
||||||
"type": "github"
|
"type": "github"
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
"pre-commit-hooks": {
|
|
||||||
"inputs": {
|
|
||||||
"flake-compat": [],
|
|
||||||
"flake-utils": "flake-utils",
|
|
||||||
"gitignore": [],
|
|
||||||
"nixpkgs": [],
|
|
||||||
"nixpkgs-stable": []
|
|
||||||
},
|
|
||||||
"locked": {
|
|
||||||
"lastModified": 1699271226,
|
|
||||||
"narHash": "sha256-8Jt1KW3xTjolD6c6OjJm9USx/jmL+VVmbooADCkdDfU=",
|
|
||||||
"owner": "cachix",
|
|
||||||
"repo": "pre-commit-hooks.nix",
|
|
||||||
"rev": "ea758da1a6dcde6dc36db348ed690d09b9864128",
|
|
||||||
"type": "github"
|
|
||||||
},
|
|
||||||
"original": {
|
|
||||||
"owner": "cachix",
|
|
||||||
"repo": "pre-commit-hooks.nix",
|
|
||||||
"type": "github"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"root": {
|
"root": {
|
||||||
"inputs": {
|
"inputs": {
|
||||||
"flake-parts": "flake-parts",
|
"flake-parts": "flake-parts",
|
||||||
"impermanence": "impermanence",
|
"impermanence": "impermanence",
|
||||||
"nixos-mailserver": "nixos-mailserver",
|
"nixos-mailserver": "nixos-mailserver",
|
||||||
"nixpkgs": "nixpkgs",
|
"nixpkgs": "nixpkgs",
|
||||||
"pre-commit-hooks": "pre-commit-hooks",
|
|
||||||
"sops-nix": "sops-nix"
|
"sops-nix": "sops-nix"
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
|
@ -206,21 +165,6 @@
|
||||||
"type": "github"
|
"type": "github"
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
"systems": {
|
|
||||||
"locked": {
|
|
||||||
"lastModified": 1681028828,
|
|
||||||
"narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
|
|
||||||
"owner": "nix-systems",
|
|
||||||
"repo": "default",
|
|
||||||
"rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
|
|
||||||
"type": "github"
|
|
||||||
},
|
|
||||||
"original": {
|
|
||||||
"owner": "nix-systems",
|
|
||||||
"repo": "default",
|
|
||||||
"type": "github"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"utils": {
|
"utils": {
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1605370193,
|
"lastModified": 1605370193,
|
||||||
|
|
13
flake.nix
13
flake.nix
|
@ -17,17 +17,8 @@
|
||||||
impermanence = {
|
impermanence = {
|
||||||
url = "github:nix-community/impermanence";
|
url = "github:nix-community/impermanence";
|
||||||
};
|
};
|
||||||
pre-commit-hooks = {
|
|
||||||
url = "github:cachix/pre-commit-hooks.nix";
|
|
||||||
inputs = {
|
|
||||||
flake-compat.follows = "";
|
|
||||||
gitignore.follows = "";
|
|
||||||
nixpkgs-stable.follows = "";
|
|
||||||
nixpkgs.follows = "";
|
|
||||||
};
|
|
||||||
};
|
|
||||||
};
|
};
|
||||||
|
|
||||||
outputs = inputs @ {flake-parts, ...}:
|
outputs = inputs@{ flake-parts, ... }:
|
||||||
flake-parts.lib.mkFlake {inherit inputs;} (import ./flake-module.nix);
|
flake-parts.lib.mkFlake { inherit inputs; } (import ./flake-module.nix);
|
||||||
}
|
}
|
||||||
|
|
|
@ -1,30 +1,20 @@
|
||||||
# copied and adopted from maralorns config
|
# copied and adopted from maralorns config
|
||||||
|
|
||||||
# This automatically searches for nixos configs in ./machines/${name}/configuration.nix
|
# This automatically searches for nixos configs in ./machines/${name}/configuration.nix
|
||||||
# and exposes them as outputs.nixosConfigurations.${name}
|
# and exposes them as outputs.nixosConfigurations.${name}
|
||||||
{
|
{ withSystem, lib, inputs, ... }: {
|
||||||
withSystem,
|
|
||||||
lib,
|
|
||||||
inputs,
|
|
||||||
...
|
|
||||||
}: {
|
|
||||||
flake = {
|
flake = {
|
||||||
nixosConfigurations = withSystem "x86_64-linux" ({pkgs, ...}: let
|
nixosConfigurations = withSystem "x86_64-linux" ({ pkgs, ... }:
|
||||||
|
let
|
||||||
machines = builtins.attrNames (builtins.readDir ./machines);
|
machines = builtins.attrNames (builtins.readDir ./machines);
|
||||||
makeSystem = name: let
|
makeSystem = name:
|
||||||
importedModule = import (./. + "/machines/${name}/configuration.nix");
|
|
||||||
configModule =
|
|
||||||
if lib.isFunction importedModule
|
|
||||||
then importedModule inputs
|
|
||||||
else importedModule;
|
|
||||||
in
|
|
||||||
pkgs.nixos {
|
pkgs.nixos {
|
||||||
imports = [
|
imports = [
|
||||||
configModule
|
(import (./. + "/machines/${name}/configuration.nix") inputs)
|
||||||
inputs.sops-nix.nixosModules.sops
|
inputs.sops-nix.nixosModules.sops
|
||||||
inputs.impermanence.nixosModules.impermanence
|
inputs.impermanence.nixosModules.impermanence
|
||||||
];
|
];
|
||||||
};
|
};
|
||||||
in
|
in lib.genAttrs machines makeSystem);
|
||||||
lib.genAttrs machines makeSystem);
|
|
||||||
};
|
};
|
||||||
}
|
}
|
||||||
|
|
|
@ -1,17 +1,19 @@
|
||||||
{
|
flake-inputs:
|
||||||
imports = [
|
{config, pkgs, lib, ... }: {
|
||||||
|
|
||||||
|
imports = [
|
||||||
./hardware-configuration.nix
|
./hardware-configuration.nix
|
||||||
../../modules/jitsi.nix
|
../../modules/jitsi.nix
|
||||||
../../roles
|
../../roles
|
||||||
./network.nix
|
./network.nix
|
||||||
];
|
];
|
||||||
|
|
||||||
services.mathebau-jitsi = {
|
services.mathebau-jitsi = {
|
||||||
enable = true;
|
enable = true;
|
||||||
hostName = "meet.mathebau.de";
|
hostName = "meet.mathebau.de";
|
||||||
};
|
};
|
||||||
|
|
||||||
# System configuration here
|
# System configuration here
|
||||||
networking.hostName = "ghatanothoa";
|
networking.hostName = "ghatanothoa";
|
||||||
system.stateVersion = "23.11";
|
system.stateVersion = "23.11";
|
||||||
}
|
}
|
||||||
|
|
|
@ -1,15 +1,15 @@
|
||||||
{lib, ...}: {
|
{config, lib, pkgs, modulesPath, ...}: {
|
||||||
imports = [];
|
imports = [ ];
|
||||||
|
|
||||||
fileSystems."/" = {
|
fileSystems."/" = {
|
||||||
device = "gha-root";
|
device = "gha-root";
|
||||||
fsType = "tmpfs";
|
fsType = "tmpfs";
|
||||||
options = ["size=1G" "mode=755"];
|
options = [ "size=1G" "mode=755" ];
|
||||||
};
|
};
|
||||||
fileSystems."/persist" = {
|
fileSystems."/persist" = {
|
||||||
device = "/dev/disk/by-uuid/e0a160ef-7d46-4705-9152-a6b602898136";
|
device = "/dev/disk/by-uuid/e0a160ef-7d46-4705-9152-a6b602898136";
|
||||||
fsType = "btrfs";
|
fsType = "btrfs";
|
||||||
options = ["subvol=persist"];
|
options = [ "subvol=persist" ];
|
||||||
neededForBoot = true;
|
neededForBoot = true;
|
||||||
};
|
};
|
||||||
fileSystems."/boot" = {
|
fileSystems."/boot" = {
|
||||||
|
@ -19,10 +19,11 @@
|
||||||
fileSystems."/nix" = {
|
fileSystems."/nix" = {
|
||||||
device = "/dev/disk/by-uuid/e0a160ef-7d46-4705-9152-a6b602898136";
|
device = "/dev/disk/by-uuid/e0a160ef-7d46-4705-9152-a6b602898136";
|
||||||
fsType = "btrfs";
|
fsType = "btrfs";
|
||||||
options = ["subvol=nix"];
|
options = [ "subvol=nix" ];
|
||||||
};
|
};
|
||||||
|
|
||||||
swapDevices = [{device = "/dev/disk/by-uuid/e6e3ba6b-c9f5-4960-b56d-f49760d76a4a";}];
|
swapDevices =
|
||||||
|
[{ device = "/dev/disk/by-uuid/e6e3ba6b-c9f5-4960-b56d-f49760d76a4a"; }];
|
||||||
|
|
||||||
nix.settings.max-jobs = lib.mkDefault 4;
|
nix.settings.max-jobs = lib.mkDefault 4;
|
||||||
|
|
||||||
|
|
|
@ -2,15 +2,14 @@
|
||||||
# everyone gets the same nameserver and the same prefixLength and address vs defaultGateway alsways
|
# everyone gets the same nameserver and the same prefixLength and address vs defaultGateway alsways
|
||||||
# depend on the same thing
|
# depend on the same thing
|
||||||
{
|
{
|
||||||
imports = [];
|
imports = [ ];
|
||||||
networking = {
|
networking = {
|
||||||
interfaces.enX0.ipv4.addresses = [
|
interfaces.enX0.ipv4.addresses = [ {
|
||||||
{
|
|
||||||
address = "192.168.0.25";
|
address = "192.168.0.25";
|
||||||
prefixLength = 16;
|
prefixLength = 16;
|
||||||
}
|
} ];
|
||||||
];
|
|
||||||
defaultGateway = "192.168.0.152";
|
defaultGateway = "192.168.0.152";
|
||||||
nameservers = ["130.83.2.22" "130.83.56.60" "130.83.22.60" "130.82.22.63"];
|
nameservers = ["130.83.2.22" "130.83.56.60" "130.83.22.60" "130.82.22.63"];
|
||||||
};
|
};
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
|
@ -1,20 +1,19 @@
|
||||||
{
|
{lib, config, ...} :
|
||||||
lib,
|
|
||||||
config,
|
let
|
||||||
...
|
inherit (lib)
|
||||||
}: let
|
|
||||||
inherit
|
|
||||||
(lib)
|
|
||||||
mkEnableOption
|
mkEnableOption
|
||||||
mkIf
|
mkIf
|
||||||
mkOption
|
mkOption
|
||||||
types
|
types
|
||||||
;
|
;
|
||||||
cfg = config.impermanence;
|
cfg = config.impermanence;
|
||||||
in {
|
in
|
||||||
imports = [];
|
|
||||||
|
|
||||||
options.impermanence = {
|
{
|
||||||
|
imports = [ ];
|
||||||
|
|
||||||
|
options.impermanence = {
|
||||||
enable = mkEnableOption "impermanence";
|
enable = mkEnableOption "impermanence";
|
||||||
storagePath = mkOption {
|
storagePath = mkOption {
|
||||||
type = types.path;
|
type = types.path;
|
||||||
|
@ -26,9 +25,9 @@ in {
|
||||||
default = "persist";
|
default = "persist";
|
||||||
description = "the name of the persistent data store";
|
description = "the name of the persistent data store";
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
config = mkIf cfg.enable {
|
config = mkIf cfg.enable {
|
||||||
environment.persistence.${cfg.name} = {
|
environment.persistence.${cfg.name} = {
|
||||||
persistentStoragePath = cfg.storagePath;
|
persistentStoragePath = cfg.storagePath;
|
||||||
directories = [
|
directories = [
|
||||||
|
@ -43,5 +42,6 @@ in {
|
||||||
];
|
];
|
||||||
};
|
};
|
||||||
environment.etc.machine-id.source = "${cfg.storagePath}/machine-id";
|
environment.etc.machine-id.source = "${cfg.storagePath}/machine-id";
|
||||||
};
|
};
|
||||||
|
|
||||||
}
|
}
|
||||||
|
|
|
@ -1,19 +1,14 @@
|
||||||
{
|
{pkgs, config, lib, modulesPath, ...}:
|
||||||
config,
|
let
|
||||||
lib,
|
inherit (lib)
|
||||||
modulesPath,
|
|
||||||
...
|
|
||||||
}: let
|
|
||||||
inherit
|
|
||||||
(lib)
|
|
||||||
mkIf
|
mkIf
|
||||||
mkEnableOption
|
mkEnableOption
|
||||||
mkOption
|
mkOption
|
||||||
head
|
head;
|
||||||
;
|
|
||||||
inherit (lib.types) str;
|
inherit (lib.types) str;
|
||||||
cfg = config.services.mathebau-jitsi;
|
cfg = config.services.mathebau-jitsi;
|
||||||
in {
|
in
|
||||||
|
{
|
||||||
imports = [(modulesPath + "/services/web-apps/jitsi-meet.nix")];
|
imports = [(modulesPath + "/services/web-apps/jitsi-meet.nix")];
|
||||||
|
|
||||||
options.services.mathebau-jitsi = {
|
options.services.mathebau-jitsi = {
|
||||||
|
@ -30,16 +25,16 @@ in {
|
||||||
config = mkIf cfg.enable {
|
config = mkIf cfg.enable {
|
||||||
services.jitsi-meet = {
|
services.jitsi-meet = {
|
||||||
enable = true;
|
enable = true;
|
||||||
|
hostName = cfg.hostName;
|
||||||
config = {
|
config = {
|
||||||
defaultLang = "de";
|
defaultLang = "de";
|
||||||
};
|
};
|
||||||
inherit (cfg) hostName;
|
|
||||||
};
|
};
|
||||||
services.jitsi-videobridge = {
|
services.jitsi-videobridge = {
|
||||||
openFirewall = true;
|
openFirewall = true;
|
||||||
nat = {
|
nat = {
|
||||||
publicAddress = "130.83.2.184";
|
publicAddress = "130.83.2.184";
|
||||||
inherit (cfg) localAddress;
|
localAddress = cfg.localAddress;
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
environment.persistence.${config.impermanence.name} = {
|
environment.persistence.${config.impermanence.name} = {
|
||||||
|
@ -55,6 +50,6 @@ in {
|
||||||
};
|
};
|
||||||
|
|
||||||
#The network ports for HTTP(S) are not opened automatically
|
#The network ports for HTTP(S) are not opened automatically
|
||||||
networking.firewall.allowedTCPPorts = [80 443];
|
networking.firewall.allowedTCPPorts = [ 80 443 ];
|
||||||
};
|
};
|
||||||
}
|
}
|
||||||
|
|
|
@ -1,34 +1,37 @@
|
||||||
{lib, ...}:
|
{lib, ...} :
|
||||||
with lib; let
|
with lib;
|
||||||
|
|
||||||
|
let
|
||||||
admins = {
|
admins = {
|
||||||
nerf = {
|
nerf = {
|
||||||
hashedPassword = "$y$j9T$SJcjUIcs3JYuM5oyxfEQa/$tUBQT07FK4cb9xm.A6ZKVnFIPNOYMOKC6Dt6hadCuJ7";
|
hashedPassword =
|
||||||
|
"$y$j9T$SJcjUIcs3JYuM5oyxfEQa/$tUBQT07FK4cb9xm.A6ZKVnFIPNOYMOKC6Dt6hadCuJ7";
|
||||||
keys = [
|
keys = [
|
||||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEdA4LpEGUUmN8esFyrNZXFb2GiBID9/S6zzhcnofQuP nerf@nerflap2"
|
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEdA4LpEGUUmN8esFyrNZXFb2GiBID9/S6zzhcnofQuP nerf@nerflap2"
|
||||||
];
|
];
|
||||||
};
|
};
|
||||||
gonne = {
|
gonne = {
|
||||||
hashedPassword = "$6$EtGpHEcFkOi0yUWp$slXf0CvIUrhdqaoCrQ5YwtYu2IVuE1RGGst4fnDPRLWVm.lYx0ruvSAF2/vw/sLbW37ORJjlb0NHQ.kSG7cVY/";
|
hashedPassword =
|
||||||
|
"$6$EtGpHEcFkOi0yUWp$slXf0CvIUrhdqaoCrQ5YwtYu2IVuE1RGGst4fnDPRLWVm.lYx0ruvSAF2/vw/sLbW37ORJjlb0NHQ.kSG7cVY/";
|
||||||
keys = [
|
keys = [
|
||||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFopCUadohY3wg9AoEup9TDRDMyEPSLsQoCnN4lsKCrr gonne@mathebau.de NixOS"
|
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFopCUadohY3wg9AoEup9TDRDMyEPSLsQoCnN4lsKCrr gonne@mathebau.de NixOS"
|
||||||
];
|
];
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
mkAdmin = name: {
|
mkAdmin = name :
|
||||||
hashedPassword,
|
{hashedPassword, keys}: {
|
||||||
keys,
|
|
||||||
}: {
|
|
||||||
"${name}" = {
|
"${name}" = {
|
||||||
isNormalUser = true;
|
isNormalUser = true;
|
||||||
createHome = true;
|
createHome = true;
|
||||||
extraGroups = ["wheel"];
|
extraGroups = [ "wheel" ];
|
||||||
group = "users";
|
group = "users";
|
||||||
home = "/home/${name}";
|
home = "/home/${name}";
|
||||||
openssh.authorizedKeys = {inherit keys;};
|
openssh.authorizedKeys = { inherit keys; };
|
||||||
inherit hashedPassword;
|
inherit hashedPassword;
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
in {
|
in {
|
||||||
users.users = mkMerge (mapAttrsToList mkAdmin admins);
|
users.users = mkMerge (mapAttrsToList mkAdmin admins);
|
||||||
}
|
}
|
||||||
|
|
|
@ -1,56 +1,46 @@
|
||||||
{
|
{pkgs, config, lib, modulesPath, ...} : {
|
||||||
pkgs,
|
|
||||||
lib,
|
imports = [
|
||||||
modulesPath,
|
|
||||||
...
|
|
||||||
}: {
|
|
||||||
imports = [
|
|
||||||
./admins.nix
|
./admins.nix
|
||||||
./nix_keys.nix
|
./nix_keys.nix
|
||||||
./prometheusNodeExporter.nix
|
./prometheusNodeExporter.nix
|
||||||
(modulesPath + "/virtualisation/xen-domU.nix")
|
(modulesPath + "/virtualisation/xen-domU.nix")
|
||||||
../modules/impermanence.nix
|
../modules/impermanence.nix
|
||||||
];
|
];
|
||||||
nix = {
|
nix = {
|
||||||
extraOptions = ''
|
extraOptions = ''
|
||||||
experimental-features = nix-command flakes
|
experimental-features = nix-command flakes
|
||||||
builders-use-substitutes = true
|
builders-use-substitutes = true
|
||||||
'';
|
'';
|
||||||
};
|
};
|
||||||
|
|
||||||
networking = {
|
networking = {
|
||||||
firewall = {
|
firewall = { # these shoud be default, but better make sure!
|
||||||
# these shoud be default, but better make sure!
|
|
||||||
enable = true;
|
enable = true;
|
||||||
allowPing = true;
|
allowPing = true;
|
||||||
};
|
};
|
||||||
nftables.enable = true;
|
nftables.enable = true;
|
||||||
useDHCP = false; # We don't speak DHCP and even if we would, we should enable it per interface
|
useDHCP = false; # We don't speak DHCP and even if we would, we should enable it per interface
|
||||||
# hosts = # TODO write something to autogenerate ip adresses!
|
# hosts = # TODO write something to autogenerate ip adresses!
|
||||||
};
|
};
|
||||||
|
|
||||||
users = {
|
users = {
|
||||||
mutableUsers = false;
|
mutableUsers = false;
|
||||||
users.root.hashedPassword = "!";
|
users.root.hashedPassword = "!";
|
||||||
};
|
};
|
||||||
|
|
||||||
impermanence.enable = true;
|
impermanence.enable = true;
|
||||||
|
|
||||||
sops.age.sshKeyPaths = ["/etc/ssh/ssh_host_ed25519_key"];
|
sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
|
||||||
|
|
||||||
environment = {
|
environment = {
|
||||||
systemPackages = builtins.attrValues {
|
systemPackages = builtins.attrValues {
|
||||||
inherit
|
inherit (pkgs)
|
||||||
(pkgs)
|
htop lsof tmux btop;
|
||||||
htop
|
|
||||||
lsof
|
|
||||||
tmux
|
|
||||||
btop
|
|
||||||
;
|
|
||||||
};
|
|
||||||
};
|
};
|
||||||
|
};
|
||||||
|
|
||||||
services = {
|
services = {
|
||||||
journald.extraConfig = "SystemMaxUse=5G";
|
journald.extraConfig = "SystemMaxUse=5G";
|
||||||
|
|
||||||
nginx = {
|
nginx = {
|
||||||
|
@ -66,7 +56,7 @@
|
||||||
PasswordAuthentication = false;
|
PasswordAuthentication = false;
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
#Prevent clock drift due to interaction problem with xen hardware clock
|
#Prevent clock drift due to interaction problem with xen hardware clock
|
||||||
timesyncd.enable = lib.mkForce true;
|
timesyncd.enable = lib.mkForce true;
|
||||||
};
|
};
|
||||||
}
|
}
|
||||||
|
|
|
@ -1,5 +1,5 @@
|
||||||
{
|
{
|
||||||
imports = [];
|
imports = [ ];
|
||||||
nix.settings.trusted-public-keys = [
|
nix.settings.trusted-public-keys = [
|
||||||
"nerflap2-1:pDZCg0oo9PxNQxwVSQSvycw7WXTl53PGvVeZWvxuqJc="
|
"nerflap2-1:pDZCg0oo9PxNQxwVSQSvycw7WXTl53PGvVeZWvxuqJc="
|
||||||
"gonne.mathebau.de-1:FsXFyFiBFE/JxC9MCkt/WuiXjx5dkRI9RXj0FxOQrV0="
|
"gonne.mathebau.de-1:FsXFyFiBFE/JxC9MCkt/WuiXjx5dkRI9RXj0FxOQrV0="
|
||||||
|
|
|
@ -1,5 +1,6 @@
|
||||||
{config, ...}: {
|
{config, ...}:
|
||||||
imports = [];
|
{
|
||||||
|
imports = [ ];
|
||||||
services.prometheus.exporters.node = {
|
services.prometheus.exporters.node = {
|
||||||
enable = true;
|
enable = true;
|
||||||
port = 9100;
|
port = 9100;
|
||||||
|
@ -34,6 +35,6 @@
|
||||||
"processes"
|
"processes"
|
||||||
];
|
];
|
||||||
};
|
};
|
||||||
networking.firewall.allowedTCPPorts = [9100];
|
networking.firewall.allowedTCPPorts = [ 9100 ];
|
||||||
environment.persistence.${config.impermanence.name}.directories = ["/var/lib/${config.services.prometheus.stateDir}"];
|
environment.persistence.${config.impermanence.name}.directories = [ "/var/lib/${config.services.prometheus.stateDir}" ];
|
||||||
}
|
}
|
||||||
|
|
Loading…
Reference in a new issue