formatting
This commit is contained in:
Giulio De Pasquale
parent
522e4b7bbc
commit
91ef8ff1e2
29
flake.nix
29
flake.nix
@ -8,7 +8,8 @@
|
||||
};
|
||||
};
|
||||
|
||||
outputs = inputs @ { self, nixpkgs, nixos-unstable, home-manager }: let
|
||||
outputs = inputs@{ self, nixpkgs, nixos-unstable, home-manager }:
|
||||
let
|
||||
system = "x86_64-linux";
|
||||
|
||||
pkgs = import nixpkgs {
|
||||
@ -22,15 +23,33 @@
|
||||
config.allowUnfree = true;
|
||||
};
|
||||
|
||||
utils = import ./lib { inherit pkgs unstable nixpkgs nixos-unstable home-manager; };
|
||||
utils = import ./lib {
|
||||
inherit pkgs unstable nixpkgs nixos-unstable home-manager;
|
||||
};
|
||||
|
||||
inherit (utils) host;
|
||||
inherit (utils) user;
|
||||
in {
|
||||
nixosConfigurations = {
|
||||
architect = host.mkHost { name = "architect"; users = [ { user = "giulio"; roles = [ "git" ]; } ]; };
|
||||
gAluminum = host.mkHost { name = "gAluminum"; users = [ { user = "giulio"; roles = [ "desktop" "ssh" "git" ]; } ]; roles = [ "gnome" ]; };
|
||||
proxy = host.mkHost { name = "proxy"; users = []; };
|
||||
architect = host.mkHost {
|
||||
name = "architect";
|
||||
users = [{
|
||||
user = "giulio";
|
||||
roles = [ "git" ];
|
||||
}];
|
||||
};
|
||||
gAluminum = host.mkHost {
|
||||
name = "gAluminum";
|
||||
users = [{
|
||||
user = "giulio";
|
||||
roles = [ "desktop" "ssh" "git" ];
|
||||
}];
|
||||
roles = [ "gnome" ];
|
||||
};
|
||||
proxy = host.mkHost {
|
||||
name = "proxy";
|
||||
users = [ ];
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
|
||||
@ -1,5 +1,4 @@
|
||||
with import ./network.nix;
|
||||
{
|
||||
with import ./network.nix; {
|
||||
services = {
|
||||
bazarr.enable = true;
|
||||
|
||||
|
||||
@ -1,5 +1,4 @@
|
||||
{ config, pkgs, ... }:
|
||||
{
|
||||
{ config, pkgs, ... }: {
|
||||
services.fail2ban = {
|
||||
enable = true;
|
||||
package = pkgs.fail2ban;
|
||||
|
||||
@ -50,7 +50,9 @@ in {
|
||||
|
||||
chain POSTROUTING {
|
||||
type nat hook postrouting priority srcnat; policy accept;
|
||||
oifname ${wan-if} ip saddr {${lib.concatStringsSep "," towan-wg}} masquerade
|
||||
oifname ${wan-if} ip saddr {${
|
||||
lib.concatStringsSep "," towan-wg
|
||||
}} masquerade
|
||||
}
|
||||
}
|
||||
|
||||
@ -132,14 +134,22 @@ in {
|
||||
ct state established,related accept
|
||||
|
||||
# client to client
|
||||
ip saddr {${lib.concatStringsSep "," c2c-wg}} ip daddr {${lib.concatStringsSep "," c2c-wg}} accept
|
||||
ip saddr {${lib.concatStringsSep "," c2c-wg}} ip daddr {${
|
||||
lib.concatStringsSep "," c2c-wg
|
||||
}} accept
|
||||
|
||||
# gdevices talking to everyone in VPN
|
||||
ip saddr {${lib.concatStringsSep "," gdevices-wg}} ip daddr ${vpn-net} accept
|
||||
ip saddr {${lib.concatStringsSep "," gamenet-wg}} ip daddr {${lib.concatStringsSep "," gamenet-wg}} accept
|
||||
ip saddr {${
|
||||
lib.concatStringsSep "," gdevices-wg
|
||||
}} ip daddr ${vpn-net} accept
|
||||
ip saddr {${
|
||||
lib.concatStringsSep "," gamenet-wg
|
||||
}} ip daddr {${lib.concatStringsSep "," gamenet-wg}} accept
|
||||
|
||||
# nat to wan
|
||||
oifname ${wan-if} ip saddr {${lib.concatStringsSep "," towan-wg}} accept
|
||||
oifname ${wan-if} ip saddr {${
|
||||
lib.concatStringsSep "," towan-wg
|
||||
}} accept
|
||||
|
||||
jump filter_drop
|
||||
}
|
||||
|
||||
@ -1,5 +1,4 @@
|
||||
with import ./network.nix;
|
||||
{
|
||||
with import ./network.nix; {
|
||||
services.gitea = {
|
||||
enable = true;
|
||||
database.type = "sqlite3";
|
||||
|
||||
@ -4,46 +4,47 @@
|
||||
{ config, lib, pkgs, modulesPath, ... }:
|
||||
|
||||
{
|
||||
imports =
|
||||
[ (modulesPath + "/installer/scan/not-detected.nix")
|
||||
];
|
||||
imports = [ (modulesPath + "/installer/scan/not-detected.nix") ];
|
||||
|
||||
boot.initrd.availableKernelModules = [ "nvme" "xhci_pci" "ahci" "usbhid" "usb_storage" "sd_mod" ];
|
||||
boot.initrd.availableKernelModules =
|
||||
[ "nvme" "xhci_pci" "ahci" "usbhid" "usb_storage" "sd_mod" ];
|
||||
boot.initrd.kernelModules = [ ];
|
||||
boot.kernelModules = [ "kvm-amd" ];
|
||||
boot.extraModulePackages = [ ];
|
||||
|
||||
fileSystems."/" =
|
||||
{ device = "zpool/nixos/root";
|
||||
fileSystems."/" = {
|
||||
device = "zpool/nixos/root";
|
||||
fsType = "zfs";
|
||||
};
|
||||
|
||||
fileSystems."/home" =
|
||||
{ device = "zpool/data/home";
|
||||
fileSystems."/home" = {
|
||||
device = "zpool/data/home";
|
||||
fsType = "zfs";
|
||||
};
|
||||
|
||||
fileSystems."/media" =
|
||||
{ device = "datapool/media";
|
||||
fileSystems."/media" = {
|
||||
device = "datapool/media";
|
||||
fsType = "zfs";
|
||||
};
|
||||
|
||||
fileSystems."/secrets" =
|
||||
{ device = "backedpool/secrets";
|
||||
fileSystems."/secrets" = {
|
||||
device = "backedpool/secrets";
|
||||
fsType = "zfs";
|
||||
};
|
||||
|
||||
fileSystems."/var/lib" =
|
||||
{ device = "backedpool/services";
|
||||
fileSystems."/var/lib" = {
|
||||
device = "backedpool/services";
|
||||
fsType = "zfs";
|
||||
};
|
||||
|
||||
fileSystems."/boot" =
|
||||
{ device = "/dev/disk/by-uuid/AF19-5616";
|
||||
fileSystems."/boot" = {
|
||||
device = "/dev/disk/by-uuid/AF19-5616";
|
||||
fsType = "vfat";
|
||||
};
|
||||
|
||||
|
||||
swapDevices = [ { device = "/dev/zpool/data/swap"; size = 40000; } ];
|
||||
swapDevices = [{
|
||||
device = "/dev/zpool/data/swap";
|
||||
size = 40000;
|
||||
}];
|
||||
|
||||
}
|
||||
|
||||
@ -1,11 +1,8 @@
|
||||
{ pkgs, ... }:
|
||||
|
||||
with import ./network.nix;
|
||||
{
|
||||
with import ./network.nix; {
|
||||
disabledModules = [ "services/misc/jellyfin.nix" ];
|
||||
imports = [
|
||||
./modules/jellyfin.nix
|
||||
];
|
||||
imports = [ ./modules/jellyfin.nix ];
|
||||
|
||||
services = {
|
||||
jellyfin = {
|
||||
|
||||
@ -1,7 +1,6 @@
|
||||
{ pkgs, config, tmp, ... }:
|
||||
|
||||
with import ./network.nix;
|
||||
{
|
||||
with import ./network.nix; {
|
||||
services = {
|
||||
matrix-synapse = {
|
||||
enable = true;
|
||||
@ -22,21 +21,17 @@ with import ./network.nix;
|
||||
- "#gaming:matrix.giugl.io"
|
||||
- "#movies:matrix.giugl.io"
|
||||
'';
|
||||
listeners = [
|
||||
{
|
||||
listeners = [{
|
||||
port = 8008;
|
||||
bind_address = "::1";
|
||||
type = "http";
|
||||
tls = false;
|
||||
x_forwarded = true;
|
||||
resources = [
|
||||
{
|
||||
resources = [{
|
||||
names = [ "client" "federation" ];
|
||||
compress = false;
|
||||
}
|
||||
];
|
||||
}
|
||||
];
|
||||
}];
|
||||
}];
|
||||
turn_uris = [
|
||||
"turns:turn.giugl.io:5349?transport=udp"
|
||||
"turns:turn.giugl.io:5349?transport=tcp"
|
||||
@ -48,14 +43,10 @@ with import ./network.nix;
|
||||
postgresql = {
|
||||
enable = true;
|
||||
ensureDatabases = [ "synapse" ];
|
||||
ensureUsers = [
|
||||
{
|
||||
ensureUsers = [{
|
||||
name = "matrix-synapse";
|
||||
ensurePermissions = {
|
||||
"DATABASE synapse" = "ALL PRIVILEGES";
|
||||
};
|
||||
}
|
||||
];
|
||||
ensurePermissions = { "DATABASE synapse" = "ALL PRIVILEGES"; };
|
||||
}];
|
||||
};
|
||||
|
||||
nginx.virtualHosts = {
|
||||
@ -64,15 +55,13 @@ with import ./network.nix;
|
||||
enableACME = true;
|
||||
forceSSL = true;
|
||||
locations."= /.well-known/matrix/server".extraConfig =
|
||||
let
|
||||
server = { "m.server" = "${matrixdomain}:443"; };
|
||||
let server = { "m.server" = "${matrixdomain}:443"; };
|
||||
in ''
|
||||
add_header Content-Type application/json;
|
||||
return 200 '${builtins.toJSON server}';
|
||||
'';
|
||||
|
||||
locations."= /.well-known/matrix/client".extraConfig =
|
||||
let
|
||||
locations."= /.well-known/matrix/client".extraConfig = let
|
||||
client = {
|
||||
"m.homeserver" = { "base_url" = "https://${matrixdomain}:443"; };
|
||||
"m.identity_server" = { "base_url" = "https://vector.im"; };
|
||||
@ -84,7 +73,6 @@ with import ./network.nix;
|
||||
return 200 '${builtins.toJSON client}';
|
||||
'';
|
||||
|
||||
|
||||
locations."/".extraConfig = ''
|
||||
return 404;
|
||||
'';
|
||||
|
||||
@ -1,14 +1,11 @@
|
||||
{ config, pkgs, ... }:
|
||||
|
||||
with import ./network.nix;
|
||||
{
|
||||
with import ./network.nix; {
|
||||
services.minecraft-server = {
|
||||
enable = true;
|
||||
eula = true;
|
||||
declarative = true;
|
||||
serverProperties = {
|
||||
motd = "Welcome on the RuNas server!";
|
||||
};
|
||||
serverProperties = { motd = "Welcome on the RuNas server!"; };
|
||||
};
|
||||
|
||||
networking.extraHosts = ''
|
||||
|
||||
@ -1,5 +1,4 @@
|
||||
with import ./network.nix;
|
||||
{
|
||||
with import ./network.nix; {
|
||||
services = {
|
||||
minio.enable = true;
|
||||
|
||||
|
||||
@ -2,10 +2,8 @@
|
||||
|
||||
with lib;
|
||||
|
||||
let
|
||||
cfg = config.services.jellyfin;
|
||||
in
|
||||
{
|
||||
let cfg = config.services.jellyfin;
|
||||
in {
|
||||
options = {
|
||||
services.jellyfin = {
|
||||
enable = mkEnableOption "Jellyfin Media Server";
|
||||
@ -56,7 +54,8 @@ in
|
||||
SupplementaryGroups = [ "video" ];
|
||||
StateDirectory = "jellyfin";
|
||||
CacheDirectory = "jellyfin";
|
||||
ExecStart = "${cfg.package}/bin/jellyfin --datadir '/var/lib/${StateDirectory}' --cachedir '/var/cache/${CacheDirectory}'";
|
||||
ExecStart =
|
||||
"${cfg.package}/bin/jellyfin --datadir '/var/lib/${StateDirectory}' --cachedir '/var/cache/${CacheDirectory}'";
|
||||
Restart = "on-failure";
|
||||
|
||||
# Security options:
|
||||
@ -111,9 +110,7 @@ in
|
||||
};
|
||||
};
|
||||
|
||||
users.groups = mkIf (cfg.group == "jellyfin") {
|
||||
jellyfin = {};
|
||||
};
|
||||
users.groups = mkIf (cfg.group == "jellyfin") { jellyfin = { }; };
|
||||
|
||||
networking.firewall = mkIf cfg.openFirewall {
|
||||
# from https://jellyfin.org/docs/general/networking/index.html
|
||||
|
||||
@ -51,11 +51,22 @@ rec {
|
||||
wolfsonhouse-wg = "10.3.0.203";
|
||||
|
||||
# groups
|
||||
gdevices-wg = [ galuminum-wg oneplus-wg ipad-wg gbeast-wg peppiniell-wg padulino-wg ];
|
||||
gdevices-wg =
|
||||
[ galuminum-wg oneplus-wg ipad-wg gbeast-wg peppiniell-wg padulino-wg ];
|
||||
routers-wg = [ hotpottino-wg angellane-wg dodino-wg wolfsonhouse-wg ];
|
||||
c2c-wg = [ ] ++ gdevices-wg;
|
||||
towan-wg = [ shield-wg parisaphone-wg parisapc-wg ] ++ gdevices-wg ++ routers-wg;
|
||||
gamenet-wg = [ andrew-wg galuminum-wg gbeast-wg mikey-wg andrewdesktop-wg mikeylaptop-wg flavio-wg salvatore-wg ];
|
||||
towan-wg = [ shield-wg parisaphone-wg parisapc-wg ] ++ gdevices-wg
|
||||
++ routers-wg;
|
||||
gamenet-wg = [
|
||||
andrew-wg
|
||||
galuminum-wg
|
||||
gbeast-wg
|
||||
mikey-wg
|
||||
andrewdesktop-wg
|
||||
mikeylaptop-wg
|
||||
flavio-wg
|
||||
salvatore-wg
|
||||
];
|
||||
|
||||
# domains
|
||||
sonarrdomain = "htson.giugl.io";
|
||||
|
||||
@ -1,7 +1,6 @@
|
||||
{ pkgs, ... }:
|
||||
|
||||
with import ./network.nix;
|
||||
{
|
||||
with import ./network.nix; {
|
||||
services = {
|
||||
mysql.enable = true;
|
||||
mysql.package = pkgs.unstable.mysql80;
|
||||
|
||||
@ -1,5 +1,4 @@
|
||||
with import ./network.nix;
|
||||
{
|
||||
with import ./network.nix; {
|
||||
services = {
|
||||
nzbget.enable = true;
|
||||
|
||||
|
||||
@ -1,7 +1,6 @@
|
||||
{ pkgs, ... }:
|
||||
|
||||
with import ./network.nix;
|
||||
{
|
||||
with import ./network.nix; {
|
||||
services.plex = {
|
||||
enable = true;
|
||||
package = pkgs.unstable.plex;
|
||||
@ -75,9 +74,7 @@ with import ./network.nix;
|
||||
proxy_redirect off;
|
||||
proxy_buffering off;
|
||||
'';
|
||||
locations."/" = {
|
||||
proxyPass = "http://localhost:32400";
|
||||
};
|
||||
locations."/" = { proxyPass = "http://localhost:32400"; };
|
||||
};
|
||||
};
|
||||
|
||||
|
||||
@ -1,7 +1,6 @@
|
||||
{ pkgs, ... }:
|
||||
|
||||
with import ./network.nix;
|
||||
{
|
||||
with import ./network.nix; {
|
||||
services = {
|
||||
prowlarr.enable = true;
|
||||
|
||||
|
||||
@ -1,5 +1,4 @@
|
||||
with import ./network.nix;
|
||||
{
|
||||
with import ./network.nix; {
|
||||
services = {
|
||||
radarr.enable = true;
|
||||
|
||||
|
||||
@ -1,5 +1,4 @@
|
||||
with import ./network.nix;
|
||||
{
|
||||
with import ./network.nix; {
|
||||
services = {
|
||||
sonarr.enable = true;
|
||||
|
||||
|
||||
@ -1,7 +1,6 @@
|
||||
with import ./network.nix;
|
||||
|
||||
let
|
||||
domain = "httra.giugl.io";
|
||||
let domain = "httra.giugl.io";
|
||||
in {
|
||||
services = {
|
||||
transmission = {
|
||||
|
||||
@ -1,5 +1,4 @@
|
||||
with import ./network.nix;
|
||||
{
|
||||
with import ./network.nix; {
|
||||
networking = {
|
||||
extraHosts = ''
|
||||
${architect-wg} architect.devs.giugl.io
|
||||
@ -37,14 +36,12 @@ with import ./network.nix;
|
||||
interfaces.${proxy-if} = {
|
||||
ips = [ "10.4.0.2/32" ];
|
||||
privateKeyFile = "/secrets/wireguard/proxy.key";
|
||||
peers = [
|
||||
{
|
||||
peers = [{
|
||||
publicKey = "WmJBpXpYebcmJEF8nVTKMqQK01KyBe42vzc38K66rVs=";
|
||||
allowedIPs = [ "10.4.0.1/32" ];
|
||||
endpoint = "giugl.io:1195";
|
||||
persistentKeepalive = 21;
|
||||
}
|
||||
];
|
||||
}];
|
||||
};
|
||||
|
||||
interfaces.${vpn-if} = {
|
||||
@ -71,77 +68,66 @@ with import ./network.nix;
|
||||
publicKey = "DPpd+P/hV1XLuvdcrCRv1sgz8BeZt1y5D6VehNuhjSQ=";
|
||||
}
|
||||
|
||||
|
||||
{
|
||||
# Manduria
|
||||
allowedIPs = [ manduria-wg ];
|
||||
publicKey = "wT38oXvDQ8g0hI+pAXQobOWf/Wott2zhwo8TLvXK400=";
|
||||
}
|
||||
|
||||
|
||||
{
|
||||
# Antonio
|
||||
allowedIPs = [ antonio-wg ];
|
||||
publicKey = "SPndCvEzuLHtGAQV8u/4dfLlFHoPcXS3L98oFOwTljc=";
|
||||
}
|
||||
|
||||
|
||||
{
|
||||
# Eleonora
|
||||
allowedIPs = [ eleonora-wg ];
|
||||
publicKey = "SL54f1ZeieFyn5X5UAPmypP10GV/c419O94vCzGHFhg=";
|
||||
}
|
||||
|
||||
|
||||
{
|
||||
# padulino
|
||||
allowedIPs = [ padulino-wg ];
|
||||
publicKey = "sk2Wr2OesND9jcuP/8k7BirSpR4pNNbS9gBkbOxZxwg=";
|
||||
}
|
||||
|
||||
|
||||
{
|
||||
# GBEAST
|
||||
allowedIPs = [ gbeast-wg ];
|
||||
publicKey = "XiK+wk+DErz0RmCWRxuaJN1cvdj+3DoiU6tcR+uZfAI=";
|
||||
}
|
||||
|
||||
|
||||
{
|
||||
# parisa-phone
|
||||
allowedIPs = [ parisaphone-wg ];
|
||||
publicKey = "t9EUnIkfr1b2HPlTXi17+AKMMe5VfeKq7exRVAwaai0=";
|
||||
}
|
||||
|
||||
|
||||
{
|
||||
# parisa-pc
|
||||
allowedIPs = [ parisapc-wg ];
|
||||
publicKey = "b2QzZDTgGQbNXSCLYB4KUzq0/099pH2T8H5BckfNSTQ=";
|
||||
}
|
||||
|
||||
|
||||
{
|
||||
# peppiniell
|
||||
allowedIPs = [ peppiniell-wg ];
|
||||
publicKey = "bzoW3Rx+7Un9hx/2opgBQJmmnZ/hgj1lQ2FnonCHjTc=";
|
||||
}
|
||||
|
||||
|
||||
{
|
||||
# angellane
|
||||
allowedIPs = [ angellane-wg ];
|
||||
publicKey = "MZ+nZklHpBxTL7QN9QJpBBx7yOYRZLONfvqAnuk85x0=";
|
||||
}
|
||||
|
||||
|
||||
{
|
||||
# hotpottino
|
||||
allowedIPs = [ hotpottino-wg ];
|
||||
publicKey = "YqtzTWqGBs2GwSPNO0aRSV4nvJDW3UHHt6fV4UC7vnU=";
|
||||
}
|
||||
|
||||
|
||||
{
|
||||
# shield
|
||||
allowedIPs = [ shield-wg ];
|
||||
|
||||
@ -1,12 +1,8 @@
|
||||
{ config, pkgs, ... }:
|
||||
|
||||
let
|
||||
hostname = "gAluminum";
|
||||
let hostname = "gAluminum";
|
||||
in {
|
||||
imports = [
|
||||
./hardware.nix
|
||||
./wireguard.nix
|
||||
];
|
||||
imports = [ ./hardware.nix ./wireguard.nix ];
|
||||
|
||||
boot = {
|
||||
supportedFilesystems = [ "ntfs" ];
|
||||
@ -51,4 +47,3 @@ in {
|
||||
environment.systemPackages = with pkgs; [ efibootmgr ];
|
||||
system.stateVersion = "21.05"; # Did you read the comment?
|
||||
}
|
||||
|
||||
|
||||
@ -4,22 +4,21 @@
|
||||
{ config, lib, pkgs, modulesPath, ... }:
|
||||
|
||||
{
|
||||
imports =
|
||||
[ (modulesPath + "/installer/scan/not-detected.nix")
|
||||
];
|
||||
imports = [ (modulesPath + "/installer/scan/not-detected.nix") ];
|
||||
|
||||
boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "nvme" "usb_storage" "sd_mod" "rtsx_pci_sdmmc" ];
|
||||
boot.initrd.availableKernelModules =
|
||||
[ "xhci_pci" "ahci" "nvme" "usb_storage" "sd_mod" "rtsx_pci_sdmmc" ];
|
||||
boot.initrd.kernelModules = [ "dm-snapshot" ];
|
||||
boot.kernelModules = [ "kvm-intel" ];
|
||||
boot.extraModulePackages = [ ];
|
||||
|
||||
fileSystems."/" =
|
||||
{ device = "/dev/disk/by-uuid/92ad62ff-627e-4fd7-9ced-0c0716d3f848";
|
||||
fileSystems."/" = {
|
||||
device = "/dev/disk/by-uuid/92ad62ff-627e-4fd7-9ced-0c0716d3f848";
|
||||
fsType = "ext4";
|
||||
};
|
||||
|
||||
fileSystems."/boot/efi" =
|
||||
{ device = "/dev/disk/by-uuid/3008-4A28";
|
||||
fileSystems."/boot/efi" = {
|
||||
device = "/dev/disk/by-uuid/3008-4A28";
|
||||
fsType = "vfat";
|
||||
};
|
||||
|
||||
|
||||
@ -4,14 +4,12 @@
|
||||
address = [ "10.3.0.2/32" ];
|
||||
privateKeyFile = "/etc/wireguard/giupi.key";
|
||||
dns = [ "10.3.0.1" ];
|
||||
peers = [
|
||||
{
|
||||
peers = [{
|
||||
publicKey = "I4glUMvIGjjhvQMKhwGc8copPl2t9Us/YYRjT0BKuiw=";
|
||||
allowedIPs = [ "0.0.0.0/0" ];
|
||||
endpoint = "architect.devs.giugl.io:1194";
|
||||
persistentKeepalive = 25;
|
||||
}
|
||||
];
|
||||
}];
|
||||
};
|
||||
};
|
||||
}
|
||||
|
||||
@ -54,8 +54,7 @@ in {
|
||||
from = min-port;
|
||||
to = max-port;
|
||||
}];
|
||||
in
|
||||
{
|
||||
in {
|
||||
allowedUDPPortRanges = range;
|
||||
allowedUDPPorts = [ 5349 ];
|
||||
#allowedTCPPortRanges = range;
|
||||
|
||||
@ -1,12 +1,8 @@
|
||||
{ config, pkgs, ... }:
|
||||
|
||||
{
|
||||
imports = [
|
||||
./hardware-configuration.nix
|
||||
./coturn.nix
|
||||
./wireguard.nix
|
||||
./ssh.nix
|
||||
];
|
||||
imports =
|
||||
[ ./hardware-configuration.nix ./coturn.nix ./wireguard.nix ./ssh.nix ];
|
||||
|
||||
boot.loader.grub = {
|
||||
enable = true;
|
||||
@ -28,4 +24,3 @@
|
||||
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCuURERnIFe2XbNu6AsPe2DO11RuaHxVGUcaoJUsIB1F+VOggOVLhxSenOPYLm6NvvGeXVi95G5Sm1UZRcJEEkvxus4bSViV4t/Q2azfYFE27yRH/IeMMoWNPGYNm5Bok2qFb4vHifra9FffwXnOzr0nDDTdHXCft4TO5nsenLJwqu5zOO1CR7J52otY7LheNPyzbGxgIkB3Y7LeOj1+/xXSOJ379NOL2RQBobsg7k442WCX7tU6AC1ct3W+93tcJUUdzJKTT9TJ+XmhdjXNWhDd+QZUNAMr+nKoEdExHp0H40/wIhcLD2OV95gX4i/YBzCg4OQOqZqWiibiEQfGTSAh5aD+nX/PqjXf0XSLEUOA81biLFu28oO8gocjwnhgqmlghvO4SG1rs6uZ8EyPyWsrVMjy8B9FX4aloKqua3aicgC+upjLl3x+KkMJizlMB5Ew7KOjPsjXwMqeJmeBOEd6TSEctttR+lIp+/368FtwXeBxzx9MBT4620mnjWtVKM= giulio@gAluminum"
|
||||
];
|
||||
}
|
||||
|
||||
|
||||
@ -4,17 +4,16 @@
|
||||
{ config, lib, pkgs, modulesPath, ... }:
|
||||
|
||||
{
|
||||
imports =
|
||||
[ (modulesPath + "/profiles/qemu-guest.nix")
|
||||
];
|
||||
imports = [ (modulesPath + "/profiles/qemu-guest.nix") ];
|
||||
|
||||
boot.initrd.availableKernelModules = [ "ata_piix" "virtio_pci" "virtio_scsi" "xhci_pci" "sd_mod" "sr_mod" ];
|
||||
boot.initrd.availableKernelModules =
|
||||
[ "ata_piix" "virtio_pci" "virtio_scsi" "xhci_pci" "sd_mod" "sr_mod" ];
|
||||
boot.initrd.kernelModules = [ ];
|
||||
boot.kernelModules = [ ];
|
||||
boot.extraModulePackages = [ ];
|
||||
|
||||
fileSystems."/" =
|
||||
{ device = "/dev/disk/by-uuid/8b5bcd4a-02b8-4e11-b856-eda792b8b7b8";
|
||||
fileSystems."/" = {
|
||||
device = "/dev/disk/by-uuid/8b5bcd4a-02b8-4e11-b856-eda792b8b7b8";
|
||||
fsType = "ext4";
|
||||
};
|
||||
|
||||
|
||||
@ -11,13 +11,11 @@ in {
|
||||
enable = true;
|
||||
externalInterface = wan_if;
|
||||
internalInterfaces = [ wg_if ];
|
||||
forwardPorts = [
|
||||
{
|
||||
forwardPorts = [{
|
||||
destination = "10.4.0.2:1194";
|
||||
proto = "udp";
|
||||
sourcePort = 1194;
|
||||
}
|
||||
];
|
||||
}];
|
||||
};
|
||||
|
||||
wireguard = {
|
||||
@ -34,12 +32,10 @@ in {
|
||||
/run/current-system/sw/bin/iptables -t nat -D POSTROUTING -o ${wg_if} -j MASQUERADE
|
||||
'';
|
||||
|
||||
peers = [
|
||||
{
|
||||
peers = [{
|
||||
allowedIPs = [ "10.4.0.2" "10.3.0.0/24" ];
|
||||
publicKey = "73oFhyQA3mgX4GmN6ul5HuOsgxa4INlzCPsyuXna0AA=";
|
||||
}
|
||||
];
|
||||
}];
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
@ -1,5 +1,6 @@
|
||||
{ pkgs, unstable, nixpkgs, nixos-unstable, home-manager, ...}:
|
||||
rec {
|
||||
{ pkgs, unstable, nixpkgs, nixos-unstable, home-manager, ... }: rec {
|
||||
user = import ./user.nix { inherit pkgs; };
|
||||
host = import ./host.nix { inherit pkgs nixpkgs unstable nixos-unstable home-manager user; };
|
||||
host = import ./host.nix {
|
||||
inherit pkgs nixpkgs unstable nixos-unstable home-manager user;
|
||||
};
|
||||
}
|
||||
|
||||
@ -6,6 +6,8 @@
|
||||
mkRole = role: import (../roles/home + "/${role}.nix");
|
||||
roles_mod = (map (r: mkRole r) roles);
|
||||
in {
|
||||
users.groups.plugdev = { };
|
||||
|
||||
fileSystems."/home/${name}/Downloads" = {
|
||||
device = "tmpfs";
|
||||
fsType = "tmpfs";
|
||||
@ -15,9 +17,10 @@
|
||||
users.users.${name} = {
|
||||
isNormalUser = true;
|
||||
shell = pkgs.zsh;
|
||||
extraGroups = [ "wheel" ];
|
||||
extraGroups = [ "wheel" "plugdev" ];
|
||||
};
|
||||
|
||||
home-manager.users.${name}.imports = [ ../roles/home/common.nix ] ++ roles_mod;
|
||||
home-manager.users.${name}.imports = [ ../roles/home/common.nix ]
|
||||
++ roles_mod;
|
||||
};
|
||||
}
|
||||
|
||||
@ -1,5 +1,4 @@
|
||||
{ ... }:
|
||||
{
|
||||
{ ... }: {
|
||||
security.acme.acceptTerms = true;
|
||||
security.acme.email = "sysadmin@giugl.io";
|
||||
}
|
||||
|
||||
@ -22,11 +22,7 @@
|
||||
};
|
||||
};
|
||||
|
||||
nixpkgs = {
|
||||
config = {
|
||||
allowUnfree = true;
|
||||
};
|
||||
};
|
||||
nixpkgs = { config = { allowUnfree = true; }; };
|
||||
|
||||
fonts.fonts = with pkgs; [ cascadia-code ];
|
||||
|
||||
|
||||
@ -15,7 +15,12 @@
|
||||
|
||||
programs.neovim = {
|
||||
enable = true;
|
||||
extraPackages = with pkgs; [ nodePackages.prettier cmake-format clang-tools rustfmt ];
|
||||
extraPackages = with pkgs; [
|
||||
nodePackages.prettier
|
||||
cmake-format
|
||||
clang-tools
|
||||
rustfmt
|
||||
];
|
||||
extraConfig = ''
|
||||
" syntax
|
||||
syntax enable
|
||||
|
||||
@ -9,8 +9,7 @@ let
|
||||
name = "guake";
|
||||
package = pkgs.guake;
|
||||
});
|
||||
in
|
||||
{
|
||||
in {
|
||||
imports = [ ./gnome.nix ];
|
||||
|
||||
nixpkgs.config.allowUnfree = true;
|
||||
|
||||
@ -144,9 +144,7 @@
|
||||
identityFile = "~/.ssh/imacmanduria";
|
||||
};
|
||||
|
||||
"bitbucket.org" = {
|
||||
identityFile = "~/.ssh/bitbucket";
|
||||
};
|
||||
"bitbucket.org" = { identityFile = "~/.ssh/bitbucket"; };
|
||||
|
||||
"the.al" = {
|
||||
user = "git";
|
||||
|
||||
Loading…
Reference in New Issue
Block a user