This commit is contained in:
steveej 2023-03-21 13:38:22 +01:00
parent 0777ef46aa
commit 6befc79c8e
14 changed files with 189 additions and 198 deletions

View file

@ -1,31 +1,31 @@
{ hostAddress {
, localAddress hostAddress,
, syncthingPort ? 22000 localAddress,
, syncthingLocalAnnouncePort ? 21027 syncthingPort ? 22000,
, autoStart ? false syncthingLocalAnnouncePort ? 21027,
, autoStart ? false,
}: { }: {
config = config = {
{ config config,
, pkgs pkgs,
, ... ...
}: { }: {
system.stateVersion = "20.05"; # Did you read the comment? system.stateVersion = "20.05"; # Did you read the comment?
imports = [ ../profiles/containers/configuration.nix ]; imports = [../profiles/containers/configuration.nix];
networking.firewall.enable = true; networking.firewall.enable = true;
networking.firewall.allowedTCPPorts = [ networking.firewall.allowedTCPPorts = [
# syncthing gui # syncthing gui
8384 8384
]; ];
services.syncthing = { services.syncthing = {
enable = true; enable = true;
openDefaultPorts = true; openDefaultPorts = true;
guiAddress = "0.0.0.0:8384"; guiAddress = "0.0.0.0:8384";
};
}; };
};
inherit autoStart; inherit autoStart;
@ -36,7 +36,7 @@
}; };
}; };
extraFlags = [ "--resolv-conf=bind-host" ]; extraFlags = ["--resolv-conf=bind-host"];
privateNetwork = true; privateNetwork = true;
forwardPorts = [ forwardPorts = [

View file

@ -1,96 +1,94 @@
{ hostAddress
, localAddress
, httpPort ? 80
, httpsPort ? 443
, autoStart ? false
,
}:
let
passwords = import ../../variables/passwords.crypt.nix;
in
{ {
config = hostAddress,
{ config localAddress,
, pkgs httpPort ? 80,
, lib httpsPort ? 443,
, ... autoStart ? false,
}: { }: let
system.stateVersion = "22.05"; # Did you read the comment? passwords = import ../../variables/passwords.crypt.nix;
in {
config = {
config,
pkgs,
lib,
...
}: {
system.stateVersion = "22.05"; # Did you read the comment?
imports = [ ../profiles/containers/configuration.nix ]; imports = [../profiles/containers/configuration.nix];
networking.firewall.enable = false; networking.firewall.enable = false;
services.ddclientovh = { services.ddclientovh = {
enable = true; enable = true;
domain = "www.stefanjunker.de"; domain = "www.stefanjunker.de";
}; };
security.acme = { security.acme = {
acceptTerms = true; acceptTerms = true;
certs."www.stefanjunker.de".email = "mail@stefanjunker.de"; certs."www.stefanjunker.de".email = "mail@stefanjunker.de";
preliminarySelfsigned = true; preliminarySelfsigned = true;
# can be used for debugging # can be used for debugging
# server = "https://acme-staging-v02.api.letsencrypt.org/directory"; # server = "https://acme-staging-v02.api.letsencrypt.org/directory";
}; };
services.nginx.enable = true; services.nginx.enable = true;
services.nginx.recommendedProxySettings = true; services.nginx.recommendedProxySettings = true;
services.nginx.virtualHosts."www.stefanjunker.de" = { services.nginx.virtualHosts."www.stefanjunker.de" = {
default = true; default = true;
addSSL = true; addSSL = true;
listen = [ listen = [
{ {
addr = "0.0.0.0"; addr = "0.0.0.0";
port = httpPort; port = httpPort;
ssl = false; ssl = false;
} }
{ {
addr = "0.0.0.0"; addr = "0.0.0.0";
port = httpsPort; port = httpsPort;
ssl = true; ssl = true;
} }
]; ];
root = "/var/www/stefanjunker.de/htdocs"; root = "/var/www/stefanjunker.de/htdocs";
enableACME = true; enableACME = true;
locations."/hedgedoc/" = { proxyPass = "http://[::1]:3000/"; }; locations."/hedgedoc/" = {proxyPass = "http://[::1]:3000/";};
locations."/hedgedoc/socket.io/" = { locations."/hedgedoc/socket.io/" = {
proxyPass = "http://[::1]:3000/socket.io/"; proxyPass = "http://[::1]:3000/socket.io/";
proxyWebsockets = true; proxyWebsockets = true;
};
};
services.hedgedoc = {
enable = true;
settings = {
domain = "www.stefanjunker.de";
urlPath = "hedgedoc";
protocolUseSSL = true;
db = {
dialect = "sqlite";
storage = "/var/lib/hedgedoc/db.hedgedoc.sqlite";
};
allowAnonymous = false;
allowAnonymousEdits = false;
allowGravatar = false;
allowFreeURL = false;
defaultPermission = "private";
allowEmailRegister = false;
# oauth2 provider config
inherit (passwords.www_stefanjunker_de_hedgedoc) dropbox;
uploadsPath = "/var/lib/hedgedoc/uploads";
};
}; };
}; };
services.hedgedoc = {
enable = true;
settings = {
domain = "www.stefanjunker.de";
urlPath = "hedgedoc";
protocolUseSSL = true;
db = {
dialect = "sqlite";
storage = "/var/lib/hedgedoc/db.hedgedoc.sqlite";
};
allowAnonymous = false;
allowAnonymousEdits = false;
allowGravatar = false;
allowFreeURL = false;
defaultPermission = "private";
allowEmailRegister = false;
# oauth2 provider config
inherit (passwords.www_stefanjunker_de_hedgedoc) dropbox;
uploadsPath = "/var/lib/hedgedoc/uploads";
};
};
};
inherit autoStart; inherit autoStart;
bindMounts = { bindMounts = {
@ -115,7 +113,7 @@ in
}; };
}; };
extraFlags = [ "--resolv-conf=bind-host" ]; extraFlags = ["--resolv-conf=bind-host"];
privateNetwork = true; privateNetwork = true;
forwardPorts = [ forwardPorts = [

View file

@ -1,5 +1,5 @@
{ ... }: { {...}: {
disabledModules = [ ]; disabledModules = [];
imports = [ imports = [
../../profiles/common/configuration.nix ../../profiles/common/configuration.nix
../../modules/opinionatedDisk.nix ../../modules/opinionatedDisk.nix

View file

@ -1,5 +1,4 @@
{ ... }: {...}: let
let
stage1Modules = [ stage1Modules = [
"virtio_balloon" "virtio_balloon"
"virtio_scsi" "virtio_scsi"
@ -15,8 +14,7 @@ let
"pata_acpi" "pata_acpi"
"ata_generic" "ata_generic"
]; ];
in in {
{
hardware.opinionatedDisk = { hardware.opinionatedDisk = {
enable = true; enable = true;
encrypted = false; encrypted = false;

View file

@ -1,14 +1,16 @@
{ config {
, pkgs config,
, lib pkgs,
, ... lib,
...
}: { }: {
nixpkgs.config.packageOverrides = pkgs: nixpkgs.config.packageOverrides = pkgs:
with pkgs; { with pkgs; {
nixPath = nixPath =
(import ../../../default.nix { (import ../../../default.nix {
versionsPath = ./versions.nix; versionsPath = ./versions.nix;
}).nixPath; })
.nixPath;
}; };
home-manager.users.steveej = import ../../../home-manager/configuration/text-minimal.nix { home-manager.users.steveej = import ../../../home-manager/configuration/text-minimal.nix {
inherit pkgs; inherit pkgs;

View file

@ -1,12 +1,11 @@
{ pkgs
, lib
, config
, ...
}:
let
keys = import ../../../variables/keys.nix;
in
{ {
pkgs,
lib,
config,
...
}: let
keys = import ../../../variables/keys.nix;
in {
# TASK: new device # TASK: new device
networking.hostName = "sj-pvehtz0"; # Define your hostname. networking.hostName = "sj-pvehtz0"; # Define your hostname.
# networking.domain = ""; # networking.domain = "";
@ -31,7 +30,7 @@ in
"prefixLength" = 29; "prefixLength" = 29;
} }
]; ];
ipv6.addresses = [ ]; ipv6.addresses = [];
}; };
networking.defaultGateway = { networking.defaultGateway = {
@ -44,11 +43,11 @@ in
interface = "eth0"; interface = "eth0";
}; };
networking.nameservers = [ "1.1.1.1" ]; networking.nameservers = ["1.1.1.1"];
networking.nat = { networking.nat = {
enable = true; enable = true;
internalInterfaces = [ "ve-+" ]; internalInterfaces = ["ve-+"];
externalInterface = "eth0"; externalInterface = "eth0";
}; };
@ -56,12 +55,12 @@ in
# services.kubernetes.roles = ["master" "node"]; # services.kubernetes.roles = ["master" "node"];
# virtualization # virtualization
virtualisation = { docker.enable = true; }; virtualisation = {docker.enable = true;};
services.spice-vdagentd.enable = true; services.spice-vdagentd.enable = true;
services.qemuGuest.enable = true; services.qemuGuest.enable = true;
nix.gc = { automatic = true; }; nix.gc = {automatic = true;};
# networking.useHostResolvConf = true; # networking.useHostResolvConf = true;
@ -78,7 +77,8 @@ in
sievePort = 4190; sievePort = 4190;
}; };
webserver = import ../../containers/webserver.nix webserver =
import ../../containers/webserver.nix
{ {
autoStart = true; autoStart = true;

View file

@ -5,10 +5,9 @@ let
rev = '' rev = ''
a7cc81913bb3cd1ef05ed0ece048b773e1839e51''; a7cc81913bb3cd1ef05ed0ece048b773e1839e51'';
}; };
in in {
{
inherit nixpkgs; inherit nixpkgs;
nixos = nixpkgs // { suffix = "/nixos"; }; nixos = nixpkgs // {suffix = "/nixos";};
"channels-nixos-stable" = nixpkgs; "channels-nixos-stable" = nixpkgs;
"channels-nixos-unstable" = { "channels-nixos-unstable" = {
url = "https://github.com/NixOS/nixpkgs/"; url = "https://github.com/NixOS/nixpkgs/";

View file

@ -6,10 +6,9 @@ let
<% git ls-remote https://github.com/nixos/nixpkgs nixos-22.11 | awk '{ print $1 }' | tr -d ' <% git ls-remote https://github.com/nixos/nixpkgs nixos-22.11 | awk '{ print $1 }' | tr -d '
' -%>''; ' -%>'';
}; };
in in {
{
inherit nixpkgs; inherit nixpkgs;
nixos = nixpkgs // { suffix = "/nixos"; }; nixos = nixpkgs // {suffix = "/nixos";};
"channels-nixos-stable" = nixpkgs; "channels-nixos-stable" = nixpkgs;
"channels-nixos-unstable" = { "channels-nixos-unstable" = {
url = "https://github.com/NixOS/nixpkgs/"; url = "https://github.com/NixOS/nixpkgs/";

View file

@ -1,13 +1,12 @@
{ pkgs {
, lib pkgs,
, config lib,
, ... config,
}: ...
let }: let
keys = import ../../../variables/keys.nix; keys = import ../../../variables/keys.nix;
passwords = import ../../../variables/passwords.crypt.nix; passwords = import ../../../variables/passwords.crypt.nix;
in in {
{
# TASK: new device # TASK: new device
networking.hostName = "vmd102066"; # Define your hostname. networking.hostName = "vmd102066"; # Define your hostname.
networking.domain = "contaboserver.net"; networking.domain = "contaboserver.net";
@ -41,7 +40,7 @@ in
networking.nat = { networking.nat = {
enable = true; enable = true;
internalInterfaces = [ "ve-+" ]; internalInterfaces = ["ve-+"];
externalInterface = "eth0"; externalInterface = "eth0";
}; };
@ -49,7 +48,7 @@ in
# services.kubernetes.roles = ["master" "node"]; # services.kubernetes.roles = ["master" "node"];
# virtualization # virtualization
virtualisation = { docker.enable = true; }; virtualisation = {docker.enable = true;};
services.spice-vdagentd.enable = true; services.spice-vdagentd.enable = true;
services.qemuGuest.enable = true; services.qemuGuest.enable = true;
@ -57,18 +56,18 @@ in
systemd.services."sshd-status" = { systemd.services."sshd-status" = {
enable = true; enable = true;
description = "sshd-status service"; description = "sshd-status service";
path = [ pkgs.systemd ]; path = [pkgs.systemd];
script = '' script = ''
systemctl status sshd | grep -i tasks systemctl status sshd | grep -i tasks
''; '';
}; };
systemd.services.sshd.serviceConfig = { TasksMax = 32; }; systemd.services.sshd.serviceConfig = {TasksMax = 32;};
systemd.timers."sshd-status" = { systemd.timers."sshd-status" = {
description = "Timer to trigger sshd-status periodically"; description = "Timer to trigger sshd-status periodically";
enable = true; enable = true;
wantedBy = [ "timer.target" "multi-user.target" ]; wantedBy = ["timer.target" "multi-user.target"];
timerConfig = { timerConfig = {
OnActiveSec = "5s"; OnActiveSec = "5s";
OnUnitActiveSec = "5s"; OnUnitActiveSec = "5s";
@ -77,11 +76,11 @@ in
}; };
}; };
nix.gc = { automatic = true; }; nix.gc = {automatic = true;};
boot.initrd.network = { boot.initrd.network = {
enable = true; enable = true;
udhcpc.extraArgs = [ "-x hostname:${config.networking.hostName}" ]; udhcpc.extraArgs = ["-x hostname:${config.networking.hostName}"];
ssh = { ssh = {
enable = true; enable = true;
@ -110,7 +109,7 @@ in
inherit config; inherit config;
hostAddress = "192.168.100.16"; hostAddress = "192.168.100.16";
localAddress = "192.168.100.17"; localAddress = "192.168.100.17";
subvolumes = [ "mailserver" "webserver" "backup" "syncthing" ]; subvolumes = ["mailserver" "webserver" "backup" "syncthing"];
}; };
bkpTarget = import ../../containers/backup-target.nix { bkpTarget = import ../../containers/backup-target.nix {

View file

@ -5,8 +5,7 @@ let
rev = '' rev = ''
a7cc81913bb3cd1ef05ed0ece048b773e1839e51''; a7cc81913bb3cd1ef05ed0ece048b773e1839e51'';
}; };
in in {
{
inherit nixpkgs; inherit nixpkgs;
"channels-nixos-stable" = nixpkgs; "channels-nixos-stable" = nixpkgs;
"nixpkgs-master" = { "nixpkgs-master" = {

View file

@ -6,8 +6,7 @@ let
<% git ls-remote https://github.com/nixos/nixpkgs nixos-22.11 | awk '{ print $1 }' | tr -d ' <% git ls-remote https://github.com/nixos/nixpkgs nixos-22.11 | awk '{ print $1 }' | tr -d '
' -%>''; ' -%>'';
}; };
in in {
{
inherit nixpkgs; inherit nixpkgs;
"channels-nixos-stable" = nixpkgs; "channels-nixos-stable" = nixpkgs;
"nixpkgs-master" = { "nixpkgs-master" = {

View file

@ -1,7 +1,8 @@
{ config {
, pkgs config,
, lib pkgs,
, ... lib,
...
}: { }: {
nix.settings.trusted-public-keys = [ nix.settings.trusted-public-keys = [
# "hydra.nixos.org-1:CNHJZBh9K4tP3EKF6FkkgeVYsS3ohTl+oS0Qa8bezVs=" # "hydra.nixos.org-1:CNHJZBh9K4tP3EKF6FkkgeVYsS3ohTl+oS0Qa8bezVs="
@ -27,14 +28,14 @@
} }
''; '';
environment.variables = { NIX_PATH = lib.mkForce pkgs.nixPath; }; environment.variables = {NIX_PATH = lib.mkForce pkgs.nixPath;};
# Fonts, I18N, Date ... # Fonts, I18N, Date ...
fonts.fonts = [ pkgs.corefonts ]; fonts.fonts = [pkgs.corefonts];
console.font = "lat9w-16"; console.font = "lat9w-16";
i18n = { defaultLocale = "en_US.UTF-8"; }; i18n = {defaultLocale = "en_US.UTF-8";};
time.timeZone = "Etc/UTC"; time.timeZone = "Etc/UTC";
services.gpm.enable = true; services.gpm.enable = true;
@ -67,6 +68,6 @@
programs.zsh.enable = true; programs.zsh.enable = true;
users.defaultUserShell = pkgs.zsh; users.defaultUserShell = pkgs.zsh;
environment.pathsToLink = [ "/share/zsh" ]; environment.pathsToLink = ["/share/zsh"];
programs.fuse.userAllowOther = true; programs.fuse.userAllowOther = true;
} }

View file

@ -1,20 +1,18 @@
# This overlay is used for overriding upstream packages. # This overlay is used for overriding upstream packages.
self: super: self: super: let
let
sources = import ../../nix/sources.nix; sources = import ../../nix/sources.nix;
nixpkgs-master = import <nixpkgs-master> { inherit (super) config; }; nixpkgs-master = import <nixpkgs-master> {inherit (super) config;};
nixpkgs-unstable = nixpkgs-unstable =
import <channels-nixos-unstable> { inherit (super) config; }; import <channels-nixos-unstable> {inherit (super) config;};
in in {
{
inherit nixpkgs-master; inherit nixpkgs-master;
inherit nixpkgs-unstable; inherit nixpkgs-unstable;
# alacritty = nixpkgs-master.alacritty; # alacritty = nixpkgs-master.alacritty;
alacritty = super.stdenv.mkDerivation { alacritty = super.stdenv.mkDerivation {
name = "alacritty-custom"; name = "alacritty-custom";
buildInputs = [ super.makeWrapper ]; buildInputs = [super.makeWrapper];
phases = "installPhase"; phases = "installPhase";
installPhase = '' installPhase = ''
makeWrapper ${super.alacritty}/bin/alacritty $out/bin/alacritty \ makeWrapper ${super.alacritty}/bin/alacritty $out/bin/alacritty \

View file

@ -1,7 +1,6 @@
{ pkgs }: {pkgs}: let
let
in rec { in rec {
nixpkgs-master = import <nixpkgs-master> { }; nixpkgs-master = import <nixpkgs-master> {};
busyboxStatic = pkgs.busybox.override { busyboxStatic = pkgs.busybox.override {
enableStatic = true; enableStatic = true;
@ -11,10 +10,10 @@ in rec {
CONFIG_INSTALL_APPLET_SYMLINKS n CONFIG_INSTALL_APPLET_SYMLINKS n
''; '';
}; };
dropbearStatic = pkgs.dropbear.override { enableStatic = true; }; dropbearStatic = pkgs.dropbear.override {enableStatic = true;};
duplicacy = pkgs.callPackage ../pkgs/duplicacy { }; duplicacy = pkgs.callPackage ../pkgs/duplicacy {};
mfcl3770cdw = pkgs.callPackage ../pkgs/mfcl3770cdw.nix { }; mfcl3770cdw = pkgs.callPackage ../pkgs/mfcl3770cdw.nix {};
staruml = pkgs.callPackage ../pkgs/staruml.nix { staruml = pkgs.callPackage ../pkgs/staruml.nix {
inherit (pkgs.gnome2) GConf; inherit (pkgs.gnome2) GConf;
libgcrypt = pkgs.libgcrypt_1_5; libgcrypt = pkgs.libgcrypt_1_5;
@ -23,28 +22,28 @@ in rec {
pythonPackages = myPython; pythonPackages = myPython;
myPython = pkgs.python310.withPackages (ps: myPython = pkgs.python310.withPackages (ps:
with ps; with ps;
[ [
pep8 pep8
yapf yapf
flake8 flake8
# autopep8 (broken) # autopep8 (broken)
# pylint (broken) # pylint (broken)
ipython ipython
llfuse llfuse
dugong dugong
defusedxml defusedxml
wheel wheel
pip pip
virtualenv virtualenv
cffi cffi
pyopenssl pyopenssl
urllib3 urllib3
# mistune (insecure) # mistune (insecure)
sympy sympy
flask flask
pyaml pyaml
] ]
++ [ pkgs.pypi2nix pkgs.libffi ]); ++ [pkgs.pypi2nix pkgs.libffi]);
} }