steveej/infra
1
0
Fork 0
Code Issues 2 Pull requests Projects Releases Packages Wiki Activity Actions

WIP everything

Browse source
This commit is contained in:
steveej 2024-01-18 14:59:17 +00:00
parent 2a23c7fdbe
commit 26f0bde4b3
29 changed files with 1630 additions and 423 deletions
Download patch file Download diff file Expand all files Collapse all files

83
nix/os/devices/steveej-t14/system.nix
View file

@ -1,11 +1,11 @@
{
pkgs,
lib,
config,
nodeName,
repoFlake,
...
}: let
{ pkgs
, lib
, config
, nodeName
, repoFlake
, ...
}:
let
passwords = import ../../../variables/passwords.crypt.nix;
localTcpPorts = [
@ -24,7 +24,8 @@
21027
];
in {
in
{
imports = [
../../snippets/nix-settings-holo-chain.nix
];
@ -44,16 +45,16 @@ in {
sshUser = "nix-remote-builder";
protocol = "ssh-ng";
system = "x86_64-linux";
maxJobs = 24;
maxJobs = 32;
speedFactor = 100;
supportedFeatures = repoFlake.nixosConfigurations.router0-dmz0.config.nix.settings.system-features ++ [];
supportedFeatures = repoFlake.nixosConfigurations.router0-dmz0.config.nix.settings.system-features ++ [ ];
}
];
networking.extraHosts = ''
'';
networking.bridges."virbr1".interfaces = [];
networking.bridges."virbr1".interfaces = [ ];
networking.interfaces."virbr1".ipv4.addresses = [
{
address = "10.254.254.254";
@ -86,7 +87,7 @@ in {
# virtualization
virtualisation = {
libvirtd = {enable = true;};
libvirtd = { enable = true; };
virtualbox.host = {
enable = false;
@ -107,11 +108,11 @@ in {
enable = true;
package = lib.mkForce pkgs.gnome3.gvfs;
};
environment.systemPackages = with pkgs; [lxqt.lxqt-policykit]; # provides a default authentification client for policykit
environment.systemPackages = with pkgs; [ lxqt.lxqt-policykit ]; # provides a default authentification client for policykit
security.pki.certificateFiles = ["${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt"];
security.pki.certificateFiles = [ "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt" ];
services.xserver.videoDrivers = lib.mkForce ["amdgpu"];
services.xserver.videoDrivers = lib.mkForce [ "amdgpu" ];
services.xserver.serverFlagsSection = ''
Option "BlankTime" "0"
Option "StandbyTime" "0"
@ -123,35 +124,37 @@ in {
hardware.ledger.enable = true;
services.zerotierone = {
enable = true;
joinNetworks = [
# moved to the service below as it's now secret
];
};
# services.zerotierone = {
# enable = false;
# joinNetworks = [
# # moved to the service below as it's now secret
# ];
# };
systemd.services.zerotieroneSecretNetworks = {
enable = false;
requiredBy = ["zerotierone.service"];
partOf = ["zerotierone.service"];
# systemd.services.zerotieroneSecretNetworks = {
# enable = false;
# requiredBy = [ "zerotierone.service" ];
# partOf = [ "zerotierone.service" ];
serviceConfig.Type = "oneshot";
serviceConfig.RemainAfterExit = true;
# serviceConfig.Type = "oneshot";
# serviceConfig.RemainAfterExit = true;
script = let
secret = config.sops.secrets.zerotieroneNetworks;
in ''
# include the secret's hash to trigger a restart on change
# ${builtins.hashString "sha256" (builtins.toJSON secret)}
# script =
# let
# secret = config.sops.secrets.zerotieroneNetworks;
# in
# ''
# # include the secret's hash to trigger a restart on change
# # ${builtins.hashString "sha256" (builtins.toJSON secret)}
${config.systemd.services.zerotierone.preStart}
# ${config.systemd.services.zerotierone.preStart}
rm -rf /var/lib/zerotier-one/networks.d/*.conf
for network in `grep -v '#' ${secret.path}`; do
touch /var/lib/zerotier-one/networks.d/''${network}.conf
done
'';
};
# rm -rf /var/lib/zerotier-one/networks.d/*.conf
# for network in `grep -v '#' ${secret.path}`; do
# touch /var/lib/zerotier-one/networks.d/''${network}.conf
# done
# '';
# };
sops.secrets.zerotieroneNetworks = {
sopsFile = ../../../../secrets/zerotierone.txt;