mirror of
https://github.com/willemml/dotfiles.nix.git
synced 2025-04-12 19:27:17 +00:00
Adds glassbox host
This commit is contained in:
parent
7db994fba7
commit
440b84f9e7
GPG key ID:
C3DE5DF6198DACBD
3 changed files with 225 additions and 124 deletions
|
|
@ -72,6 +72,7 @@
|
||||||
x86_64-live = mkNixos "x86_64" [./nixos/hosts/x86_64-live.nix];
|
x86_64-live = mkNixos "x86_64" [./nixos/hosts/x86_64-live.nix];
|
||||||
aarch64-live = mkNixos "aarch64" [./nixos/hosts/aarch64-live.nix];
|
aarch64-live = mkNixos "aarch64" [./nixos/hosts/aarch64-live.nix];
|
||||||
|
|
||||||
|
glassbox = mkNixos "x86_64" [./nixos/hosts/glassbox.nix];
|
||||||
nixbox = mkNixos "x86_64" [./nixos/hosts/nixbox.nix];
|
nixbox = mkNixos "x86_64" [./nixos/hosts/nixbox.nix];
|
||||||
thinkpad = mkNixos "x86_64" [./nixos/hosts/thinkpad.nix];
|
thinkpad = mkNixos "x86_64" [./nixos/hosts/thinkpad.nix];
|
||||||
voyager = mkNixos "aarch64" [./nixos/hosts/voyager];
|
voyager = mkNixos "aarch64" [./nixos/hosts/voyager];
|
||||||
|
|
|
||||||
57
nixos/hosts/glassbox.nix
Normal file
57
nixos/hosts/glassbox.nix
Normal file
|
|
@ -0,0 +1,57 @@
|
||||||
|
# Do not modify this file! It was generated by ‘nixos-generate-config’
|
||||||
|
# and may be overwritten by future invocations. Please make changes
|
||||||
|
# to /etc/nixos/configuration.nix instead.
|
||||||
|
{
|
||||||
|
config,
|
||||||
|
lib,
|
||||||
|
pkgs,
|
||||||
|
modulesPath,
|
||||||
|
...
|
||||||
|
}: {
|
||||||
|
imports = [
|
||||||
|
(modulesPath + "/installer/scan/not-detected.nix")
|
||||||
|
../profiles/hyprland.nix
|
||||||
|
../profiles/default.nix
|
||||||
|
../users/willem/home/linux.nix
|
||||||
|
../modules/zerotier.nix
|
||||||
|
];
|
||||||
|
|
||||||
|
boot.initrd.availableKernelModules = ["vmd" "xhci_pci" "nvme" "ahci" "usbhid" "usb_storage" "sd_mod"];
|
||||||
|
boot.initrd.kernelModules = [];
|
||||||
|
boot.kernelModules = ["kvm-intel"];
|
||||||
|
boot.extraModulePackages = [];
|
||||||
|
|
||||||
|
boot.loader.systemd-boot.enable = true;
|
||||||
|
boot.loader.efi.canTouchEfiVariables = true;
|
||||||
|
|
||||||
|
hardware.opengl.driSupport = true;
|
||||||
|
hardware.opengl.enable = true;
|
||||||
|
|
||||||
|
hardware.nvidia = {
|
||||||
|
modesetting.enable = true;
|
||||||
|
powerManagement.enable = false;
|
||||||
|
powerManagement.finegrained = false;
|
||||||
|
open = false;
|
||||||
|
nvidiaSettings = true;
|
||||||
|
};
|
||||||
|
|
||||||
|
fileSystems."/" = {
|
||||||
|
device = "/dev/disk/by-uuid/4e9a4d87-4b00-413b-84c0-62e737a012a9";
|
||||||
|
fsType = "ext4";
|
||||||
|
};
|
||||||
|
|
||||||
|
fileSystems."/boot" = {
|
||||||
|
device = "/dev/disk/by-uuid/1641-A38E";
|
||||||
|
fsType = "vfat";
|
||||||
|
};
|
||||||
|
|
||||||
|
swapDevices = [];
|
||||||
|
|
||||||
|
networking.hostName = "glassbox";
|
||||||
|
networking.useDHCP = lib.mkDefault true;
|
||||||
|
|
||||||
|
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
|
||||||
|
|
||||||
|
powerManagement.cpuFreqGovernor = lib.mkDefault "performance";
|
||||||
|
hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
|
||||||
|
}
|
||||||
|
|
@ -6,159 +6,202 @@
|
||||||
...
|
...
|
||||||
}: let
|
}: let
|
||||||
torrent_group_id = 987;
|
torrent_group_id = 987;
|
||||||
in {
|
in
|
||||||
imports = [
|
{
|
||||||
(modulesPath + "/installer/scan/not-detected.nix")
|
imports = [
|
||||||
../profiles/hyprland.nix
|
(modulesPath + "/installer/scan/not-detected.nix")
|
||||||
../profiles/default.nix
|
../profiles/hyprland.nix
|
||||||
../users/willem/home/linux.nix
|
../profiles/default.nix
|
||||||
../modules/zerotier.nix
|
../users/willem/home/linux.nix
|
||||||
];
|
../modules/zerotier.nix
|
||||||
|
];
|
||||||
|
|
||||||
boot.initrd.availableKernelModules = ["xhci_pci" "ahci" "nvme" "usbhid" "usb_storage" "sd_mod"];
|
boot.initrd.availableKernelModules = ["xhci_pci" "ahci" "nvme" "usbhid" "usb_storage" "sd_mod"];
|
||||||
boot.initrd.kernelModules = [];
|
boot.initrd.kernelModules = [];
|
||||||
boot.kernelModules = ["amdgpu"];
|
boot.kernelModules = ["amdgpu"];
|
||||||
boot.extraModulePackages = [];
|
boot.extraModulePackages = [];
|
||||||
|
|
||||||
boot.loader.systemd-boot.enable = true;
|
boot.loader.systemd-boot.enable = true;
|
||||||
boot.loader.efi.canTouchEfiVariables = true;
|
boot.loader.efi.canTouchEfiVariables = true;
|
||||||
|
|
||||||
boot.supportedFilesystems = ["zfs"];
|
boot.supportedFilesystems = ["zfs"];
|
||||||
boot.zfs.forceImportRoot = false;
|
boot.zfs.forceImportRoot = false;
|
||||||
networking.hostId = "06818aaa";
|
networking.hostId = "06818aaa";
|
||||||
|
|
||||||
hardware.opengl.driSupport = true;
|
hardware.opengl.driSupport = true;
|
||||||
hardware.opengl.enable = true;
|
hardware.opengl.enable = true;
|
||||||
|
|
||||||
hardware.opengl.extraPackages = with pkgs; [
|
hardware.opengl.extraPackages = with pkgs; [
|
||||||
amdvlk
|
amdvlk
|
||||||
];
|
];
|
||||||
|
|
||||||
fileSystems."/" = {
|
fileSystems."/" = {
|
||||||
device = "/dev/disk/by-uuid/24855432-019b-43d9-9b83-9135b9dc31a6";
|
device = "/dev/disk/by-uuid/24855432-019b-43d9-9b83-9135b9dc31a6";
|
||||||
fsType = "ext4";
|
fsType = "ext4";
|
||||||
};
|
|
||||||
|
|
||||||
fileSystems."/boot" = {
|
|
||||||
device = "/dev/disk/by-uuid/F2E9-F515";
|
|
||||||
fsType = "vfat";
|
|
||||||
};
|
|
||||||
|
|
||||||
boot.zfs.extraPools = ["zpool"];
|
|
||||||
|
|
||||||
swapDevices = [{device = "/dev/disk/by-uuid/36bb51f0-f56d-4408-b61c-7905789a7304";}];
|
|
||||||
|
|
||||||
environment.systemPackages = [pkgs.zfs];
|
|
||||||
|
|
||||||
services.zfs.autoScrub.enable = true;
|
|
||||||
|
|
||||||
services.jellyfin.enable = true;
|
|
||||||
|
|
||||||
users.groups.torrent.gid = torrent_group_id;
|
|
||||||
|
|
||||||
services.transmission = {
|
|
||||||
enable = false;
|
|
||||||
|
|
||||||
package = pkgs.transmission_4;
|
|
||||||
|
|
||||||
group = "torrent";
|
|
||||||
|
|
||||||
settings = rec {
|
|
||||||
download-dir = "/zpool/media/torrents";
|
|
||||||
incomplete-dir = "/zpool/media/torrents/.incomplete";
|
|
||||||
incomplete-dir-enabled = true;
|
|
||||||
peer-port = 51413;
|
|
||||||
rpc-enabled = true;
|
|
||||||
rpc-bind-address = "0.0.0.0";
|
|
||||||
rpc-whitelist-enabled = false;
|
|
||||||
rpc-whitelist = "10.1.2.*,127.0.0.*";
|
|
||||||
rpc-host-whitelist-enabled = false;
|
|
||||||
};
|
};
|
||||||
};
|
|
||||||
|
|
||||||
networking.nftables.enable = true;
|
fileSystems."/boot" = {
|
||||||
networking.nftables.flushRuleset = true;
|
device = "/dev/disk/by-uuid/F2E9-F515";
|
||||||
|
fsType = "vfat";
|
||||||
|
};
|
||||||
|
|
||||||
networking.nftables.tables."nixos-fw".content = lib.mkForce "";
|
boot.zfs.extraPools = ["zpool"];
|
||||||
|
|
||||||
networking.nftables.ruleset = ''
|
swapDevices = [{device = "/dev/disk/by-uuid/36bb51f0-f56d-4408-b61c-7905789a7304";}];
|
||||||
table inet filter {
|
|
||||||
chain input {
|
|
||||||
type filter hook input priority 0;
|
|
||||||
|
|
||||||
# accept all localhost and zerotier traffic
|
environment.systemPackages = [pkgs.zfs];
|
||||||
iifname lo accept
|
|
||||||
iifname "zt*" accept
|
|
||||||
|
|
||||||
# accept traffic sent by us
|
services.zfs.autoScrub.enable = true;
|
||||||
ct state {established, related} accept
|
|
||||||
|
|
||||||
# ICMP
|
services.jellyfin.enable = true;
|
||||||
# routers may also want: mld-listener-query, nd-router-solicit
|
|
||||||
ip protocol icmp icmp type { destination-unreachable, router-advertisement, time-exceeded, parameter-problem } accept
|
|
||||||
|
|
||||||
# allow "ping"
|
users.groups.torrent.gid = torrent_group_id;
|
||||||
ip protocol icmp icmp type echo-request accept
|
|
||||||
|
|
||||||
# jellyfin
|
services.transmission = {
|
||||||
tcp dport 8096 accept
|
enable = false;
|
||||||
tcp dport 8920 accept
|
|
||||||
udp dport 1900 accept
|
|
||||||
udp dport 7359 accept
|
|
||||||
|
|
||||||
# transmission web ui
|
package = pkgs.transmission_4;
|
||||||
tcp dport 9091 accept
|
|
||||||
|
|
||||||
# zerotier
|
group = "torrent";
|
||||||
udp dport 9993 accept
|
|
||||||
tcp dport 9993 accept
|
|
||||||
|
|
||||||
# ssh
|
settings = rec {
|
||||||
tcp dport 22 accept
|
download-dir = "/zpool/media/torrents";
|
||||||
|
incomplete-dir = "/zpool/media/torrents/.incomplete";
|
||||||
|
incomplete-dir-enabled = true;
|
||||||
|
peer-port = 51413;
|
||||||
|
rpc-enabled = true;
|
||||||
|
rpc-bind-address = "0.0.0.0";
|
||||||
|
rpc-whitelist-enabled = false;
|
||||||
|
rpc-whitelist = "10.1.2.*,127.0.0.*";
|
||||||
|
rpc-host-whitelist-enabled = false;
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
iifname "tun0" tcp dport 51413 accept
|
networking.nftables.enable = true;
|
||||||
iifname "tun0" udp dport 51413 accept
|
networking.nftables.flushRuleset = true;
|
||||||
|
|
||||||
iifname {lo, "zt*"} tcp dport 9091 accept
|
networking.nftables.tables."nixos-fw".content = lib.mkForce "";
|
||||||
|
|
||||||
iifname "tun0" skgid ${toString torrent_group_id} accept
|
networking.nftables.ruleset = ''
|
||||||
|
table inet filter {
|
||||||
|
chain input {
|
||||||
|
type filter hook input priority 0;
|
||||||
|
|
||||||
# drop all other packets
|
# accept all localhost and zerotier traffic
|
||||||
counter drop
|
iifname lo accept
|
||||||
#accept
|
iifname "zt*" accept
|
||||||
|
|
||||||
|
# accept traffic sent by us
|
||||||
|
ct state {established, related} accept
|
||||||
|
|
||||||
|
# ICMP
|
||||||
|
# routers may also want: mld-listener-query, nd-router-solicit
|
||||||
|
ip protocol icmp icmp type { destination-unreachable, router-advertisement, time-exceeded, parameter-problem } accept
|
||||||
|
|
||||||
|
# allow "ping"
|
||||||
|
ip protocol icmp icmp type echo-request accept
|
||||||
|
|
||||||
|
# jellyfin
|
||||||
|
tcp dport 8096 accept
|
||||||
|
tcp dport 8920 accept
|
||||||
|
udp dport 1900 accept
|
||||||
|
udp dport 7359 accept
|
||||||
|
|
||||||
|
# transmission web ui
|
||||||
|
tcp dport 9091 accept
|
||||||
|
|
||||||
|
# zerotier
|
||||||
|
udp dport 9993 accept
|
||||||
|
tcp dport 9993 accept
|
||||||
|
|
||||||
|
# ssh
|
||||||
|
tcp dport 22 accept
|
||||||
|
|
||||||
|
iifname "tun0" tcp dport 51413 accept
|
||||||
|
iifname "tun0" udp dport 51413 accept
|
||||||
|
|
||||||
|
iifname {lo, "zt*"} tcp dport 9091 accept
|
||||||
|
|
||||||
|
iifname "tun0" skgid ${toString torrent_group_id} accept
|
||||||
|
|
||||||
|
# drop all other packets
|
||||||
|
counter drop
|
||||||
|
#accept
|
||||||
|
}
|
||||||
|
|
||||||
|
chain output {
|
||||||
|
type filter hook output priority 0;
|
||||||
|
|
||||||
|
tcp dport 53 accept
|
||||||
|
udp dport 53 accept
|
||||||
|
|
||||||
|
oifname {"lo", "zt*"} tcp sport 9091 accept
|
||||||
|
|
||||||
|
skgid ${toString torrent_group_id} oifname != "tun0" counter drop
|
||||||
|
|
||||||
|
# zerotier
|
||||||
|
oifname "zt*" accept
|
||||||
|
udp dport 9993 accept
|
||||||
|
tcp dport 9993 accept
|
||||||
|
|
||||||
|
accept
|
||||||
|
}
|
||||||
|
|
||||||
|
chain forward {
|
||||||
|
type filter hook forward priority 0;
|
||||||
|
|
||||||
|
accept
|
||||||
|
}
|
||||||
}
|
}
|
||||||
|
'';
|
||||||
|
|
||||||
chain output {
|
networking.useDHCP = lib.mkDefault true;
|
||||||
type filter hook output priority 0;
|
|
||||||
|
|
||||||
tcp dport 53 accept
|
networking.hostName = "nixbox";
|
||||||
udp dport 53 accept
|
|
||||||
|
|
||||||
oifname {"lo", "zt*"} tcp sport 9091 accept
|
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
|
||||||
|
powerManagement.cpuFreqGovernor = lib.mkDefault "performance";
|
||||||
|
hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
|
||||||
|
}
|
||||||
|
# Do not modify this file! It was generated by ‘nixos-generate-config’
|
||||||
|
# and may be overwritten by future invocations. Please make changes
|
||||||
|
# to /etc/nixos/configuration.nix instead.
|
||||||
|
{
|
||||||
|
config,
|
||||||
|
lib,
|
||||||
|
pkgs,
|
||||||
|
modulesPath,
|
||||||
|
...
|
||||||
|
}: {
|
||||||
|
imports = [
|
||||||
|
(modulesPath + "/installer/scan/not-detected.nix")
|
||||||
|
];
|
||||||
|
|
||||||
skgid ${toString torrent_group_id} oifname != "tun0" counter drop
|
boot.initrd.availableKernelModules = ["vmd" "xhci_pci" "nvme" "ahci" "usbhid" "usb_storage" "sd_mod"];
|
||||||
|
boot.initrd.kernelModules = [];
|
||||||
|
boot.kernelModules = ["kvm-intel"];
|
||||||
|
boot.extraModulePackages = [];
|
||||||
|
|
||||||
# zerotier
|
fileSystems."/" = {
|
||||||
oifname "zt*" accept
|
device = "/dev/disk/by-uuid/4e9a4d87-4b00-413b-84c0-62e737a012a9";
|
||||||
udp dport 9993 accept
|
fsType = "ext4";
|
||||||
tcp dport 9993 accept
|
};
|
||||||
|
|
||||||
accept
|
fileSystems."/boot" = {
|
||||||
}
|
device = "/dev/disk/by-uuid/1641-A38E";
|
||||||
|
fsType = "vfat";
|
||||||
|
};
|
||||||
|
|
||||||
chain forward {
|
swapDevices = [];
|
||||||
type filter hook forward priority 0;
|
|
||||||
|
|
||||||
accept
|
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
|
||||||
}
|
# (the default) this is the recommended approach. When using systemd-networkd it's
|
||||||
}
|
# still possible to use this option, but it's recommended to use it in conjunction
|
||||||
'';
|
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
|
||||||
|
networking.useDHCP = lib.mkDefault true;
|
||||||
|
# networking.interfaces.enp6s0.useDHCP = lib.mkDefault true;
|
||||||
|
# networking.interfaces.wlo1.useDHCP = lib.mkDefault true;
|
||||||
|
|
||||||
networking.useDHCP = lib.mkDefault true;
|
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
|
||||||
|
hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
|
||||||
networking.hostName = "nixbox";
|
}
|
||||||
|
|
||||||
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
|
|
||||||
powerManagement.cpuFreqGovernor = lib.mkDefault "performance";
|
|
||||||
hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
|
|
||||||
}
|
|
||||||
|
|
|
||||||
Loading…
Add table
Reference in a new issue