Pr/move contabo containers and backup #77
29 changed files with 450 additions and 179 deletions
11
Justfile
11
Justfile
|
|
@ -196,22 +196,21 @@ hm-iterate-qtile:
|
|||
|
||||
# !!! DANGERIOUS !!! This wipes the disk which is configured for the given device.
|
||||
disk-prepare dir:
|
||||
just -v _device diskPrepare {{dir}} --argstr rebuildarg "dummy"
|
||||
just -v _device diskPrepare {{dir}}
|
||||
|
||||
disk-relabel dir previous:
|
||||
just -v _device diskRelabel {{dir}} --argstr rebuildarg "dummy" --argstr previousDiskId {{previous}}
|
||||
just -v _device diskRelabel {{dir}} --argstr previousDiskId {{previous}}
|
||||
|
||||
# Mount the target disk specified by device configuration directory. The 'dir' argument points to a device configuration, e.g. 'nix/os/devices/steveej-live-mmc-SL32G_0x259093f6'
|
||||
disk-mount dir:
|
||||
just -v _device diskMount {{dir}} --argstr rebuildarg "dummy"
|
||||
|
||||
just -v _device diskMount {{dir}}
|
||||
# Unmount target disk, specified by device configuration directory
|
||||
disk-umount dir:
|
||||
just -v _device diskUmount {{dir}} --argstr rebuildarg "dummy"
|
||||
just -v _device diskUmount {{dir}}
|
||||
|
||||
# Perform an offline installation on the mounted target disk, specified by device configuration directory
|
||||
disk-install dir: _render_templates
|
||||
just -v _device diskInstall {{dir}} --argstr rebuildarg "dummy"
|
||||
just -v _device diskInstall {{dir}}
|
||||
|
||||
verify-n-unlock sshserver attempts="10":
|
||||
#!/usr/bin/env bash
|
||||
|
|
|
|||
|
|
@ -1,70 +1,13 @@
|
|||
{ config
|
||||
, hostAddress
|
||||
, localAddress
|
||||
, subvolumes
|
||||
, targetPathSuffix ? ""
|
||||
}:
|
||||
|
||||
let
|
||||
unstablepkgs = import <channels-nixos-unstable> { config = config.nixpkgs.config; };
|
||||
|
||||
passwords = import ../../variables/passwords.crypt.nix;
|
||||
bucket = "bkp";
|
||||
subvolumeParentDir = "/var/lib";
|
||||
|
||||
subvolumeDir = "/var/lib/container-volumes";
|
||||
subvolumeSnapshot = "/var/lib/container-volumes.snapshot";
|
||||
|
||||
bkpSource = subvolumeSnapshot;
|
||||
bkpDestination = "/container/backup";
|
||||
cacheDir = "/var/lib/rclone-cachedir";
|
||||
|
||||
wasabiRc = pkgs: pkgs.writeText "rc" ''
|
||||
[wasabi-${bucket}]
|
||||
type = s3
|
||||
provider = Wasabi
|
||||
env_auth = false
|
||||
|
||||
#bkp user
|
||||
access_key_id = ${passwords.storage.wasabi.bkp.key}
|
||||
secret_access_key = ${passwords.storage.wasabi.bkp.secret}
|
||||
|
||||
region = us-east-1
|
||||
endpoint = s3.wasabisys.com
|
||||
location_constraint =
|
||||
acl =
|
||||
server_side_encryption =
|
||||
storage_class =
|
||||
'';
|
||||
|
||||
|
||||
bkp-mount-rclone-manual = pkgs: {
|
||||
enable = true;
|
||||
description = "bkp-mount-rclone-manual service";
|
||||
path = with pkgs; [ unstablepkgs.rclone utillinux ];
|
||||
serviceConfig = {
|
||||
Type = "notify";
|
||||
};
|
||||
script = ''
|
||||
export PATH="$PATH:/run/wrappers/bin"
|
||||
exec rclone --config ${wasabiRc pkgs} mount wasabi-${bucket}:${bucket} ${bkpDestination} \
|
||||
--stats=50m --stats-log-level=NOTICE \
|
||||
--cache-dir=${cacheDir} \
|
||||
--vfs-cache-mode=full
|
||||
|
||||
'';
|
||||
preStart = ''
|
||||
mkdir -p ${bkpDestination}
|
||||
mkdir -p ${cacheDir}
|
||||
'';
|
||||
postStop = ''
|
||||
sync
|
||||
umount ${bkpDestination} \
|
||||
|| umount -l ${bkpDestination} \
|
||||
|| :
|
||||
|
||||
rmdir ${bkpDestination}
|
||||
'';
|
||||
};
|
||||
|
||||
subvolumeParentDir = "/var/lib/container-volumes";
|
||||
|
||||
in {
|
||||
config = { pkgs, ... }: {
|
||||
|
|
@ -74,18 +17,14 @@ in {
|
|||
|
||||
environment.systemPackages = with pkgs; [
|
||||
btrfs-progs
|
||||
rdup rdedup
|
||||
iptraf-ng nethogs
|
||||
rclone
|
||||
btrbk
|
||||
];
|
||||
|
||||
networking.firewall.enable = true;
|
||||
|
||||
systemd.services."bkp-mount-rclone-manual" = bkp-mount-rclone-manual pkgs;
|
||||
|
||||
systemd.services."bkp-sync-rclone" = {
|
||||
systemd.services."bkp-sync" = {
|
||||
enable = true;
|
||||
description = "bkp-sync-rclone service";
|
||||
description = "bkp-sync service";
|
||||
|
||||
serviceConfig = {
|
||||
Type = "oneshot";
|
||||
|
|
@ -99,14 +38,10 @@ in {
|
|||
"bkp-run.service"
|
||||
];
|
||||
|
||||
path = with pkgs; [ unstablepkgs.rclone utillinux ];
|
||||
path = with pkgs; [ utillinux ];
|
||||
script = ''
|
||||
set -x
|
||||
echo Starting rclone sync...
|
||||
rclone --config ${wasabiRc pkgs} sync \
|
||||
${bkpDestination}/rdedup/ wasabi-${bucket}:${bucket}/rdedup/ \
|
||||
--stats=50m --stats-log-level=WARNING
|
||||
echo Finished rclone sync...
|
||||
true
|
||||
'';
|
||||
};
|
||||
|
||||
|
|
@ -119,41 +54,35 @@ in {
|
|||
};
|
||||
|
||||
partOf = [
|
||||
"bkp-sync-rclone.service"
|
||||
"bkp-sync.service"
|
||||
];
|
||||
|
||||
path = with pkgs; [ btrfs-progs rdup rdedup coreutils ];
|
||||
preStart = ''
|
||||
echo Creating new btrfs snapshot of ${subvolumeDir} at ${subvolumeSnapshot}
|
||||
btrfs subvolume snapshot -r ${subvolumeDir} ${subvolumeSnapshot}
|
||||
path = with pkgs; [ btrfs-progs btrbk coreutils ];
|
||||
|
||||
script = let
|
||||
bktrbkConf = pkgs.writeText "cfg" ''
|
||||
timestamp_format long
|
||||
ssh_identity ${passwords.storage.homeChBackup.keyPath}
|
||||
ssh_user ${passwords.storage.homeChBackup.user}
|
||||
ssh_compression no
|
||||
backend_remote btrfs-progs-sudo
|
||||
compat_remote busybox
|
||||
btrfs_commit_delete each
|
||||
snapshot_create onchange
|
||||
snapshot_preserve_min latest
|
||||
snapshot_preserve 7d 4w
|
||||
target_preserve_min no
|
||||
target_preserve 7d 4w 12m *y
|
||||
|
||||
volume ${subvolumeParentDir}
|
||||
target ${passwords.storage.homeChBackup.target}/container-volumes/${targetPathSuffix}
|
||||
${builtins.foldl' (sum: elem: sum + " subvolume " + elem + "\n") "" subvolumes}
|
||||
'';
|
||||
script = ''
|
||||
in ''
|
||||
#! ${pkgs.bash}/bin/bash
|
||||
set -Eeuxo pipefail
|
||||
|
||||
export RUST_BACKTRACE=1
|
||||
export TIMESTAMP=$(date +"%Y%m%d.%H%M%S")
|
||||
|
||||
echo Starting rdup/rdedup backup...
|
||||
for d in `ls -1 ${bkpSource}`; do
|
||||
echo Determining backup source size ${bkpSource}/$d...
|
||||
du -hs ${bkpSource}/$d
|
||||
rdup -x /dev/null ${bkpSource}/$d | rdedup -v -ttt --dir=${bkpDestination}/rdedup store $d-''${TIMESTAMP}
|
||||
done
|
||||
sync
|
||||
echo Finished rdup/rdedup backup...
|
||||
|
||||
echo Removing all previous backups...
|
||||
rdedup --dir=${bkpDestination}/rdedup list | grep -v ''${TIMESTAMP} | xargs echo rdedup --dir=${bkpDestination}/rdedup remove
|
||||
|
||||
echo Running rdedup garbage-collector...
|
||||
time rdedup -v -ttt --dir=${bkpDestination}/rdedup gc
|
||||
|
||||
echo Determining backup destination size ${bkpDestination}/rdedup...
|
||||
du -hs ${bkpDestination}/rdedup
|
||||
'';
|
||||
postStop = ''
|
||||
btrfs subvolume delete ${subvolumeSnapshot}
|
||||
btrbk -c ${bktrbkConf} --progress ''${@:-run}
|
||||
'';
|
||||
};
|
||||
|
||||
|
|
@ -164,9 +93,9 @@ in {
|
|||
timerConfig = {
|
||||
# Obtained using `systemd-analyze calendar "Wed 23:00"`
|
||||
# OnCalendar = "Wed *-*-* 23:00:00";
|
||||
OnStartupSec="2d";
|
||||
Unit = "bkp-sync-rclone.service";
|
||||
OnUnitInactiveSec="2d";
|
||||
OnStartupSec="1m";
|
||||
Unit = "bkp-sync.service";
|
||||
OnUnitInactiveSec="2h";
|
||||
Persistent="true";
|
||||
};
|
||||
};
|
||||
|
|
@ -176,10 +105,15 @@ in {
|
|||
|
||||
bindMounts = {
|
||||
"${subvolumeParentDir}" = {
|
||||
hostPath = "/var/lib/";
|
||||
hostPath = subvolumeParentDir;
|
||||
isReadOnly = false;
|
||||
};
|
||||
|
||||
"/etc/secrets/" = {
|
||||
hostPath = "/var/lib/container-volumes/backup/etc-secrets";
|
||||
isReadOnly = true;
|
||||
};
|
||||
|
||||
"/dev/fuse" = {
|
||||
hostPath = "/dev/fuse";
|
||||
isReadOnly = false;
|
||||
|
|
|
|||
|
|
@ -1,6 +1,7 @@
|
|||
{ hostAddress
|
||||
, localAddress
|
||||
, syncthingPort ? 22000
|
||||
, syncthingLocalAnnouncePort ? 21027
|
||||
}:
|
||||
|
||||
{
|
||||
|
|
@ -39,6 +40,11 @@
|
|||
hostPort = syncthingPort;
|
||||
protocol = "tcp";
|
||||
}
|
||||
{
|
||||
containerPort = 21027;
|
||||
hostPort = syncthingLocalAnnouncePort;
|
||||
protocol = "tcp";
|
||||
}
|
||||
];
|
||||
|
||||
inherit hostAddress localAddress;
|
||||
|
|
|
|||
|
|
@ -14,14 +14,23 @@
|
|||
domain = "www.stefanjunker.de";
|
||||
};
|
||||
|
||||
security.acme = {
|
||||
acceptTerms = true;
|
||||
certs."www.stefanjunker.de".email = "mail@stefanjunker.de";
|
||||
};
|
||||
|
||||
services.nginx.enable = true;
|
||||
services.nginx.virtualHosts."stefanjunker.de" = {
|
||||
services.nginx.virtualHosts."www.stefanjunker.de" = {
|
||||
default = true;
|
||||
onlySSL = true;
|
||||
root = "/var/www/stefanjunker.de/htdocs";
|
||||
|
||||
sslCertificate = "/etc/secrets/stefanjunker.de/nginx/nginx.crt";
|
||||
sslCertificateKey = "/etc/secrets/stefanjunker.de/nginx/nginx.key";
|
||||
enableACME = true;
|
||||
serverAliases = [
|
||||
"stefanjunker.de"
|
||||
];
|
||||
# sslCertificate = "/etc/secrets/stefanjunker.de/nginx/nginx.crt";
|
||||
# sslCertificateKey = "/etc/secrets/stefanjunker.de/nginx/nginx.key";
|
||||
|
||||
locations."/fi" = {
|
||||
index = "index.php";
|
||||
|
|
|
|||
|
|
@ -1,16 +1,23 @@
|
|||
{ pkgs ? import <channels-nixos-stable> {}
|
||||
{ dir
|
||||
, pkgs ? import <channels-nixos-stable> {}
|
||||
, ownLib ? import ../lib/default.nix { }
|
||||
, dir
|
||||
, rebuildarg
|
||||
, moreargs ? ""
|
||||
, diskId ? (import ((builtins.getEnv "PWD")+"/${dir}/hw.nix") {}).hardware.encryptedDisk.diskId
|
||||
, gitRoot ? "$(git rev-parse --show-toplevel)"
|
||||
, previousDiskId ? ""
|
||||
}:
|
||||
|
||||
# FIXME: why do these need explicit mentioning?
|
||||
# , moreargs ? ""
|
||||
# , rebuildarg ? ""
|
||||
, ...
|
||||
} @ args :
|
||||
|
||||
let
|
||||
rebuildargsSudo = [ "switch" "boot" ];
|
||||
rebuild = pkgs.writeScript "script" ''
|
||||
rebuild = {
|
||||
gitRoot
|
||||
, rebuildarg ? "dry-activate"
|
||||
, moreargs ? ""
|
||||
|
||||
, ...
|
||||
}: pkgs.writeScript "script" ''
|
||||
#!/usr/bin/env bash
|
||||
set -xe
|
||||
|
||||
|
|
@ -20,7 +27,7 @@ let
|
|||
[[ -e "''${NIXOS_CONFIG}" ]]
|
||||
|
||||
${if (builtins.elem rebuildarg rebuildargsSudo)
|
||||
&& builtins.match ".*--target-host.*" moreargs == null
|
||||
&& (builtins.match ".*--target-host.*" moreargs) == null
|
||||
then
|
||||
"sudo -E \\"
|
||||
else
|
||||
|
|
@ -35,6 +42,12 @@ let
|
|||
|
||||
in {
|
||||
recipes = {
|
||||
inherit rebuild;
|
||||
} // (import ./disk.nix { inherit pkgs ownLib dir rebuildarg moreargs diskId gitRoot previousDiskId; });
|
||||
rebuild = rebuild {
|
||||
inherit gitRoot;
|
||||
}
|
||||
# // pkgs.lib.attrsets.optionalAttrs (moreargs != "") { inherit moreargs; }
|
||||
# // pkgs.lib.attrsets.optionalAttrs (rebuildarg != "") { inherit rebuildarg; }
|
||||
;
|
||||
} // (import ./disk.nix (args // { inherit pkgs ownLib gitRoot; }))
|
||||
;
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,11 +1,12 @@
|
|||
{ pkgs
|
||||
, ownLib
|
||||
, dir
|
||||
, rebuildarg
|
||||
, moreargs
|
||||
, diskId
|
||||
, gitRoot
|
||||
, diskId ? (import ((builtins.getEnv "PWD")+"/${dir}/hw.nix") {}).hardware.opinionatedDisk.diskId
|
||||
, encrypted ? (import ((builtins.getEnv "PWD")+"/${dir}/hw.nix") {}).hardware.opinionatedDisk.encrypted
|
||||
, previousDiskId ? ""
|
||||
|
||||
, ...
|
||||
}:
|
||||
|
||||
let
|
||||
|
|
@ -16,7 +17,9 @@ in rec {
|
|||
#!/usr/bin/env bash
|
||||
set -xe
|
||||
echo Mounting ${diskId}
|
||||
${pkgs.lib.strings.optionalString encrypted ''
|
||||
sudo cryptsetup luksOpen ${ownLib.disk.bootLuksDevice diskId} ${ownLib.disk.luksName diskId}
|
||||
''}
|
||||
sleep 1
|
||||
sudo vgchange -ay ${ownLib.disk.volumeGroup diskId}
|
||||
sudo mkdir -p /mnt
|
||||
|
|
@ -32,7 +35,9 @@ in rec {
|
|||
sudo umount -Rl ${mntRootVol}
|
||||
sudo rmdir ${mntRootVol}
|
||||
sudo vgchange -an ${ownLib.disk.volumeGroup diskId}
|
||||
${pkgs.lib.strings.optionalString encrypted ''
|
||||
sudo cryptsetup close ${ownLib.disk.luksName diskId}
|
||||
''}
|
||||
sync
|
||||
'';
|
||||
|
||||
|
|
@ -56,7 +61,7 @@ in rec {
|
|||
#!/usr/bin/env bash
|
||||
set -xe
|
||||
|
||||
read -p "Continue to format ${ownLib.disk.bootGrubDevice diskId} (YES/n)?" choice
|
||||
read -p "Continue to format ${ownLib.disk.bootGrubDevice diskId} (YES/n)? " choice
|
||||
case "$choice" in
|
||||
YES ) echo "Continuing in 3 seconds..."; sleep 3;;
|
||||
n|N ) echo "Exiting..."; exit 0;;
|
||||
|
|
@ -100,12 +105,14 @@ in rec {
|
|||
|
||||
sleep 1
|
||||
|
||||
${pkgs.lib.strings.optionalString encrypted ''
|
||||
# Encrypt
|
||||
sudo cryptsetup luksFormat ${ownLib.disk.bootLuksDevice diskId} -
|
||||
sudo cryptsetup luksOpen ${ownLib.disk.bootLuksDevice diskId} ${ownLib.disk.luksName diskId}
|
||||
''}
|
||||
|
||||
# LVM
|
||||
sudo vgcreate ${ownLib.disk.volumeGroup diskId} ${ownLib.disk.luksPhysicalVolume diskId}
|
||||
sudo vgcreate ${ownLib.disk.volumeGroup diskId} ${ownLib.disk.lvmPv diskId encrypted}
|
||||
sudo lvcreate ${ownLib.disk.volumeGroup diskId} -L 2G -n swap
|
||||
sudo lvcreate ${ownLib.disk.volumeGroup diskId} -l 100%FREE -n root
|
||||
|
||||
|
|
@ -160,7 +167,9 @@ in rec {
|
|||
|
||||
|
||||
if test "${previousDiskId}"; then
|
||||
${pkgs.lib.strings.optionalString encrypted ''
|
||||
sudo cryptsetup luksOpen ${ownLib.disk.bootLuksDevice diskId} ${ownLib.disk.luksName diskId}
|
||||
''}
|
||||
sync
|
||||
sleep 1
|
||||
if sudo vgs ${previousDiskId}; then
|
||||
|
|
@ -168,6 +177,8 @@ in rec {
|
|||
sudo vgscan
|
||||
fi
|
||||
fi
|
||||
${pkgs.lib.strings.optionalString encrypted ''
|
||||
sudo cryptsetup close ${ownLib.disk.luksName diskId}
|
||||
''}
|
||||
'';
|
||||
}
|
||||
|
|
|
|||
8
nix/os/devices/srv0.home-ch.stefanjunker.de/boot.nix
Normal file
8
nix/os/devices/srv0.home-ch.stefanjunker.de/boot.nix
Normal file
|
|
@ -0,0 +1,8 @@
|
|||
{ lib
|
||||
, ...
|
||||
}:
|
||||
|
||||
{
|
||||
boot.loader.grub.efiSupport = true;
|
||||
boot.extraModulePackages = [ ];
|
||||
}
|
||||
|
|
@ -0,0 +1,15 @@
|
|||
{ ... }:
|
||||
|
||||
{
|
||||
disabledModules = [
|
||||
];
|
||||
imports = [
|
||||
../../profiles/common/configuration.nix
|
||||
../../modules/opinionatedDisk.nix
|
||||
|
||||
./system.nix
|
||||
./hw.nix
|
||||
./pkg.nix
|
||||
./boot.nix
|
||||
];
|
||||
}
|
||||
31
nix/os/devices/srv0.home-ch.stefanjunker.de/hw.nix
Normal file
31
nix/os/devices/srv0.home-ch.stefanjunker.de/hw.nix
Normal file
|
|
@ -0,0 +1,31 @@
|
|||
{ ... }:
|
||||
|
||||
let
|
||||
stage1Modules = [
|
||||
"aesni_intel"
|
||||
"kvm-intel"
|
||||
"aes_x86_64"
|
||||
|
||||
"virtio_balloon"
|
||||
"virtio_scsi"
|
||||
"virtio_net"
|
||||
"virtio_pci"
|
||||
"virtio_ring"
|
||||
"virtio"
|
||||
"scsi_mod"
|
||||
];
|
||||
|
||||
in
|
||||
{
|
||||
# TASK: new device
|
||||
hardware.opinionatedDisk = {
|
||||
enable = true;
|
||||
encrypted = false;
|
||||
diskId = "ata-Crucial_CT750MX300SSD1_16161311C7A6";
|
||||
};
|
||||
|
||||
boot.initrd.availableKernelModules = stage1Modules;
|
||||
boot.initrd.kernelModules = stage1Modules;
|
||||
boot.extraModprobeConfig = ''
|
||||
'';
|
||||
}
|
||||
53
nix/os/devices/srv0.home-ch.stefanjunker.de/pkg.nix
Normal file
53
nix/os/devices/srv0.home-ch.stefanjunker.de/pkg.nix
Normal file
|
|
@ -0,0 +1,53 @@
|
|||
{ config
|
||||
, pkgs
|
||||
, lib
|
||||
, ...
|
||||
}:
|
||||
|
||||
{
|
||||
nixpkgs.config.packageOverrides = pkgs: with pkgs; {
|
||||
nixPath = (import ../../../default.nix { versionsPath = ./versions.nix; }).nixPath;
|
||||
};
|
||||
home-manager.users.steveej = import ../../../home-manager/configuration/text-minimal.nix { inherit pkgs; };
|
||||
|
||||
nix.buildMachines = [
|
||||
{ hostName = "localhost";
|
||||
system = "x86_64-linux";
|
||||
supportedFeatures = ["kvm" "nixos-test" "big-parallel" "benchmark"];
|
||||
maxJobs = 4;
|
||||
}
|
||||
];
|
||||
|
||||
# services.hydra = {
|
||||
# enable = false;
|
||||
# hydraURL = "http://localhost:3000"; # externally visible URL
|
||||
# notificationSender = "hydra@${config.networking.hostName}.stefanjunker.de"; # e-mail of hydra service
|
||||
# # a standalone hydra will require you to unset the buildMachinesFiles list to avoid using a nonexistant /etc/nix/machines
|
||||
# buildMachinesFiles = [];
|
||||
# # you will probably also want, otherwise *everything* will be built from scratch
|
||||
# useSubstitutes = true;
|
||||
# };
|
||||
|
||||
# services.gitlab-runner = {
|
||||
# enable = false;
|
||||
|
||||
# extraPackages = with pkgs; [
|
||||
# bash
|
||||
# gitlab-runner
|
||||
# nix
|
||||
# gitFull
|
||||
# git-crypt
|
||||
# ];
|
||||
|
||||
# concurrent = 2;
|
||||
# checkInterval = 0;
|
||||
# services = {
|
||||
# nixRunner = {
|
||||
# executor = "shell";
|
||||
# runUntagged = true;
|
||||
# registrationConfigFile = "/etc/secrets/gitlab-runner/nix-runner.registration";
|
||||
# tagList = [ "nix" ];
|
||||
# };
|
||||
# };
|
||||
# };
|
||||
}
|
||||
93
nix/os/devices/srv0.home-ch.stefanjunker.de/system.nix
Normal file
93
nix/os/devices/srv0.home-ch.stefanjunker.de/system.nix
Normal file
|
|
@ -0,0 +1,93 @@
|
|||
{ pkgs
|
||||
, lib
|
||||
, config
|
||||
, ... }:
|
||||
|
||||
let
|
||||
keys = import ../../../variables/keys.nix;
|
||||
|
||||
in {
|
||||
# TASK: new device
|
||||
networking.hostName = "srv0"; # Define your hostname.
|
||||
# networking.domain = "home-ch.stefanjunker.de";
|
||||
|
||||
networking.firewall.enable = true;
|
||||
networking.firewall.allowedTCPPorts = [
|
||||
# iperf3
|
||||
5201
|
||||
];
|
||||
networking.firewall.logRefusedConnections = false;
|
||||
|
||||
networking.usePredictableInterfaceNames = false;
|
||||
networking.dhcpcd = {
|
||||
enable = true;
|
||||
persistent = true;
|
||||
};
|
||||
|
||||
networking.interfaces.eth0 = {
|
||||
useDHCP = true;
|
||||
# ipv6.addresses = [
|
||||
# { address = "2a02:c207:3003:2387::1"; prefixLength = 64; }
|
||||
# ];
|
||||
};
|
||||
|
||||
# networking.defaultGateway6 = {
|
||||
# address = "fe80::1";
|
||||
# interface = "eth0";
|
||||
# };
|
||||
|
||||
networking.nat = {
|
||||
enable = true;
|
||||
internalInterfaces = [ "ve-+" ];
|
||||
externalInterface = "eth0";
|
||||
};
|
||||
|
||||
# Kubernetes
|
||||
# services.kubernetes.roles = ["master" "node"];
|
||||
|
||||
# virtualization
|
||||
virtualisation = {
|
||||
docker.enable = true;
|
||||
};
|
||||
|
||||
nix.gc = {
|
||||
automatic = true;
|
||||
};
|
||||
|
||||
networking.useHostResolvConf = true;
|
||||
|
||||
containers = {
|
||||
webserver = import ../../containers/webserver.nix {
|
||||
hostAddress = "192.168.100.12";
|
||||
localAddress = "192.168.100.13";
|
||||
|
||||
httpsPort = 443;
|
||||
};
|
||||
|
||||
syncthing = import ../../containers/syncthing.nix {
|
||||
hostAddress = "192.168.100.14";
|
||||
localAddress = "192.168.100.15";
|
||||
|
||||
syncthingPort = 22000;
|
||||
};
|
||||
|
||||
backup = import ../../containers/backup.nix {
|
||||
inherit config;
|
||||
hostAddress = "192.168.100.16";
|
||||
localAddress = "192.168.100.17";
|
||||
subvolumes = [
|
||||
"webserver"
|
||||
"backup"
|
||||
"syncthing"
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
# This value determines the NixOS release from which the default
|
||||
# settings for stateful data, like file locations and database versions
|
||||
# on your system were taken. It‘s perfectly fine and recommended to leave
|
||||
# this value at the release version of the first install of this system.
|
||||
# Before changing this value read the documentation for this option
|
||||
# (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
|
||||
system.stateVersion = "20.03"; # Did you read the comment?
|
||||
}
|
||||
37
nix/os/devices/srv0.home-ch.stefanjunker.de/versions.nix
Normal file
37
nix/os/devices/srv0.home-ch.stefanjunker.de/versions.nix
Normal file
|
|
@ -0,0 +1,37 @@
|
|||
let
|
||||
nixpkgs = {
|
||||
url = "https://github.com/NixOS/nixpkgs/";
|
||||
ref = "nixos-20.09";
|
||||
rev = "51aaa3fa1b69559456f9bd4968bd5b179a784f67";
|
||||
};
|
||||
in
|
||||
|
||||
{
|
||||
inherit nixpkgs;
|
||||
"channels-nixos-stable" = nixpkgs;
|
||||
"channels-nixos-20.03" = {
|
||||
url = "https://github.com/NixOS/nixpkgs/";
|
||||
ref = "nixos-20.03";
|
||||
rev = "ff6fda61600cc60404bab5cb6b18b8636785b7bc";
|
||||
};
|
||||
"channels-nixos-19.09" = {
|
||||
url = "https://github.com/NixOS/nixpkgs/";
|
||||
ref = "nixos-19.09";
|
||||
rev = "75f4ba05c63be3f147bcc2f7bd4ba1f029cedcb1";
|
||||
};
|
||||
"channels-nixos-unstable" = {
|
||||
url = "https://github.com/NixOS/nixpkgs/";
|
||||
ref = "nixos-unstable";
|
||||
rev = "24c9b05ac53e422f1af81a156f1fd58499eb27fb";
|
||||
};
|
||||
"nixpkgs-master" = {
|
||||
url = "https://github.com/NixOS/nixpkgs/";
|
||||
ref = "master";
|
||||
rev = "9b3e35d991ea6a43f256069dcb2e006006730d05";
|
||||
};
|
||||
"home-manager-module" = {
|
||||
url = "https://github.com/nix-community/home-manager";
|
||||
ref = "release-20.09";
|
||||
rev = "7339784e07217ed0232e08d1ea33b610c94657d8";
|
||||
};
|
||||
}
|
||||
|
|
@ -0,0 +1,37 @@
|
|||
let
|
||||
nixpkgs = {
|
||||
url = "https://github.com/NixOS/nixpkgs/";
|
||||
ref = "nixos-20.09";
|
||||
rev = "<% git ls-remote https://github.com/nixos/nixpkgs nixos-20.09 | awk '{ print $1 }' | tr -d '\n' -%>";
|
||||
};
|
||||
in
|
||||
|
||||
{
|
||||
inherit nixpkgs;
|
||||
"channels-nixos-stable" = nixpkgs;
|
||||
"channels-nixos-20.03" = {
|
||||
url = "https://github.com/NixOS/nixpkgs/";
|
||||
ref = "nixos-20.03";
|
||||
rev = "<% git ls-remote https://github.com/nixos/nixpkgs nixos-20.03 | awk '{ print $1 }' | tr -d '\n' -%>";
|
||||
};
|
||||
"channels-nixos-19.09" = {
|
||||
url = "https://github.com/NixOS/nixpkgs/";
|
||||
ref = "nixos-19.09";
|
||||
rev = "<% git ls-remote https://github.com/nixos/nixpkgs nixos-19.09 | awk '{ print $1 }' | tr -d '\n' -%>";
|
||||
};
|
||||
"channels-nixos-unstable" = {
|
||||
url = "https://github.com/NixOS/nixpkgs/";
|
||||
ref = "nixos-unstable";
|
||||
rev = "<% git ls-remote https://github.com/nixos/nixpkgs nixos-unstable | awk '{ print $1 }' | tr -d '\n' -%>";
|
||||
};
|
||||
"nixpkgs-master" = {
|
||||
url = "https://github.com/NixOS/nixpkgs/";
|
||||
ref = "master";
|
||||
rev = "<% git ls-remote https://github.com/NixOS/nixpkgs.git master | head -n1 | awk '{ print $1 }' | tr -d '\n' -%>";
|
||||
};
|
||||
"home-manager-module" = {
|
||||
url = "https://github.com/nix-community/home-manager";
|
||||
ref = "release-20.09";
|
||||
rev = "<% git ls-remote https://github.com/nix-community/home-manager.git release-20.09 | awk '{ print $1 }' | tr -d '\n' -%>";
|
||||
};
|
||||
}
|
||||
|
|
@ -2,8 +2,6 @@
|
|||
|
||||
{
|
||||
# TASK: new device
|
||||
hardware.encryptedDisk = {
|
||||
enable = true;
|
||||
diskId = "usb-SanDisk_Extreme_Pro_12345978EC62-0:0";
|
||||
};
|
||||
hardware.opinionatedDisk.diskId = "usb-SanDisk_Extreme_Pro_12345978EC62-0:0";
|
||||
hardware.opinionatedDisk.encrypted = true;
|
||||
}
|
||||
|
|
|
|||
|
|
@ -4,7 +4,7 @@
|
|||
imports = [
|
||||
../../profiles/common/configuration.nix
|
||||
../../profiles/graphical/configuration.nix
|
||||
../../modules/encryptedDisk.nix
|
||||
../../modules/opinionatedDisk.nix
|
||||
|
||||
./system.nix
|
||||
./hw.nix
|
||||
|
|
|
|||
|
|
@ -18,8 +18,9 @@ let
|
|||
in
|
||||
{
|
||||
# TASK: new device
|
||||
hardware.encryptedDisk = {
|
||||
hardware.opinionatedDisk = {
|
||||
enable = true;
|
||||
encrypted = true;
|
||||
diskId = "nvme-SKHynix_HFS001TD9TNI-L2B0B_CJ0AN89731030AV3Q";
|
||||
};
|
||||
|
||||
|
|
|
|||
|
|
@ -2,7 +2,7 @@ let
|
|||
nixpkgs = {
|
||||
url = "https://github.com/NixOS/nixpkgs/";
|
||||
ref = "nixos-20.09";
|
||||
rev = "4a75ca4a4e7d14e7b0b0230b3ea57b5bd7c16218";
|
||||
rev = "c6b23ba64aea4b0e2163ff84990084a6bec455c5";
|
||||
};
|
||||
in
|
||||
|
||||
|
|
@ -15,12 +15,12 @@ in
|
|||
"channels-nixos-unstable" = {
|
||||
url = "https://github.com/NixOS/nixpkgs/";
|
||||
ref = "nixos-unstable";
|
||||
rev = "1a57d96edd156958b12782e8c8b6a374142a7248";
|
||||
rev = "56bb1b0f7a33e5d487dc2bf2e846794f4dcb4d01";
|
||||
};
|
||||
"nixpkgs-master" = {
|
||||
url = "https://github.com/NixOS/nixpkgs/";
|
||||
ref = "master";
|
||||
rev = "44c443a7a602e7752641aac21e4ad17061761290";
|
||||
rev = "174267e601bc2d525a685084d9712841b3ef93da";
|
||||
};
|
||||
"home-manager-module" = {
|
||||
url = "https://github.com/nix-community/home-manager";
|
||||
|
|
|
|||
|
|
@ -5,7 +5,7 @@
|
|||
];
|
||||
imports = [
|
||||
../../profiles/common/configuration.nix
|
||||
../../modules/encryptedDisk.nix
|
||||
../../modules/opinionatedDisk.nix
|
||||
|
||||
./system.nix
|
||||
./hw.nix
|
||||
|
|
|
|||
|
|
@ -18,8 +18,9 @@ let
|
|||
in
|
||||
{
|
||||
# TASK: new device
|
||||
hardware.encryptedDisk = {
|
||||
hardware.opinionatedDisk = {
|
||||
enable = true;
|
||||
encrypted = true;
|
||||
diskId = "scsi-0QEMU_QEMU_HARDDISK_drive-scsi0";
|
||||
};
|
||||
|
||||
|
|
|
|||
|
|
@ -114,24 +114,14 @@ in {
|
|||
sievePort = 4190;
|
||||
};
|
||||
|
||||
webserver = import ../../containers/webserver.nix {
|
||||
hostAddress = "192.168.100.12";
|
||||
localAddress = "192.168.100.13";
|
||||
|
||||
httpsPort = 443;
|
||||
};
|
||||
|
||||
syncthing = import ../../containers/syncthing.nix {
|
||||
hostAddress = "192.168.100.14";
|
||||
localAddress = "192.168.100.15";
|
||||
|
||||
syncthingPort = 22000;
|
||||
};
|
||||
|
||||
backup = import ../../containers/backup.nix {
|
||||
inherit config;
|
||||
hostAddress = "192.168.100.16";
|
||||
localAddress = "192.168.100.17";
|
||||
subvolumes = [
|
||||
"mailserver"
|
||||
"backup"
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
|
|
|
|||
|
|
@ -8,6 +8,9 @@ in
|
|||
|
||||
{
|
||||
inherit nixpkgs;
|
||||
nixos = nixpkgs // {
|
||||
suffix = "/nixos";
|
||||
};
|
||||
"channels-nixos-stable" = nixpkgs;
|
||||
"channels-nixos-20.03" = {
|
||||
url = "https://github.com/NixOS/nixpkgs/";
|
||||
|
|
|
|||
|
|
@ -48,5 +48,10 @@
|
|||
bootLuksDevice = diskId: "/dev/disk/by-partlabel/" + (shortenGptPartlabel ("3-"+diskId));
|
||||
luksName = diskId: (volumeGroup diskId)+"pv";
|
||||
luksPhysicalVolume = diskId: "/dev/mapper/" + (luksName diskId);
|
||||
lvmPv = diskId: encrypted:
|
||||
if encrypted == true
|
||||
then luksPhysicalVolume diskId
|
||||
else bootLuksDevice diskId
|
||||
;
|
||||
};
|
||||
}
|
||||
|
|
|
|||
|
|
@ -4,14 +4,18 @@
|
|||
with lib;
|
||||
|
||||
let
|
||||
cfg = config.hardware.encryptedDisk;
|
||||
cfg = config.hardware.opinionatedDisk;
|
||||
ownLib = import ../lib/default.nix { };
|
||||
in {
|
||||
options.hardware.encryptedDisk = {
|
||||
enable = mkEnableOption "Enable encrypted filesystem layout";
|
||||
options.hardware.opinionatedDisk = {
|
||||
enable = mkEnableOption "Enable opinionated filesystem layout";
|
||||
diskId = mkOption {
|
||||
type = types.str;
|
||||
};
|
||||
encrypted = mkOption {
|
||||
default = true;
|
||||
type = types.bool;
|
||||
};
|
||||
};
|
||||
|
||||
config = lib.mkIf cfg.enable {
|
||||
|
|
@ -36,10 +40,10 @@ in {
|
|||
|
||||
boot.loader.grub = {
|
||||
device = (ownLib.disk.bootGrubDevice cfg.diskId);
|
||||
enableCryptodisk = true;
|
||||
enableCryptodisk = cfg.encrypted;
|
||||
};
|
||||
|
||||
boot.initrd.luks.devices = builtins.listToAttrs [
|
||||
boot.initrd.luks.devices = lib.optionalAttrs cfg.encrypted (builtins.listToAttrs [
|
||||
{
|
||||
name =
|
||||
let
|
||||
|
|
@ -53,6 +57,6 @@ in {
|
|||
allowDiscards = true;
|
||||
};
|
||||
}
|
||||
];
|
||||
]);
|
||||
};
|
||||
}
|
||||
|
|
@ -2,7 +2,7 @@
|
|||
|
||||
{
|
||||
imports = [
|
||||
../../modules/encryptedDisk.nix
|
||||
../../modules/opinionatedDisk.nix
|
||||
|
||||
./pkg.nix
|
||||
./hw.nix
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
{ ... }:
|
||||
|
||||
{
|
||||
hardware.encryptedDisk.enable = true;
|
||||
hardware.opinionatedDisk.enable = true;
|
||||
hardware.enableAllFirmware = true;
|
||||
}
|
||||
|
|
|
|||
|
|
@ -44,4 +44,24 @@ in {
|
|||
keyring
|
||||
]);
|
||||
});
|
||||
|
||||
btrbk = super.btrbk.overrideAttrs(attrs: rec {
|
||||
version = "0.30.0";
|
||||
src = builtins.fetchurl {
|
||||
url = "https://digint.ch/download/btrbk/releases/${attrs.pname}-${version}.tar.xz";
|
||||
sha256 = "1wlp0z0ijv3cr155kp9c5l16dz4jf8h897ddnawaj9rj1zgfk9z8";
|
||||
};
|
||||
|
||||
# version = "2020-12-30";
|
||||
# src = builtins.fetchurl {
|
||||
# url = "https://github.com/digint/btrbk/archive/dd5991099ad778a3e0c5d11c770ad169c3095068.tar.gz";
|
||||
# sha256 = "0iyjgr1nv1n7mpsrgkrmb85sz3ycimmfvvhj08cvkjgl0r1762sb";
|
||||
# };
|
||||
|
||||
preFixup = ''
|
||||
wrapProgram $out/bin/btrbk \
|
||||
--set PERL5LIB $PERL5LIB \
|
||||
--prefix PATH ':' "${self.stdenv.lib.makeBinPath (with self; [ btrfs-progs bash mbuffer openssh ])}"
|
||||
'';
|
||||
});
|
||||
}
|
||||
|
|
|
|||
|
|
@ -44,7 +44,7 @@ in rec {
|
|||
nixpkgsWithPhp5 = pkgs.fetchFromGitHub {
|
||||
owner = "nixos";
|
||||
repo = "nixpkgs-channels";
|
||||
rev = "pkgs";
|
||||
rev = "846d8f8305192dcc3a63139102698b4ac6b9ef9f";
|
||||
sha256 = "1qifgc1q2i4g0ivpfjnxp4jl2cc82gfjws08dsllgw7q7kw4b4rb";
|
||||
};
|
||||
php5 = (pkgs.callPackage "${nixpkgsWithPhp5}/pkgs/development/interpreters/php/default.nix" {
|
||||
|
|
|
|||
Binary file not shown.
|
|
@ -3,7 +3,10 @@ _run_ssh_cmd cmd:
|
|||
|
||||
post-setup:
|
||||
just -v _run_ssh_cmd "opkg update"
|
||||
just -v _run_ssh_cmd "opkg install luci-ssl"
|
||||
just -v _run_ssh_cmd "opkg install luci-ssl luci-app-ddns"
|
||||
just -v _run_ssh_cmd "opkg install luci-app-samba samba36-server"
|
||||
just -v _run_ssh_cmd "opkg install block-mount blockd kmod-fs-vfat kmod-usb-storage usbutils"
|
||||
just -v _run_ssh_cmd "opkg install block-mount blockd kmod-fs-vfat kmod-usb-storage usbutils kmod-usb-storage-uas kmod-fs-btrfs btrfs-progs"
|
||||
# multiuser SFTP
|
||||
just -v _run_ssh_cmd "opkg install openssh-server openssh-sftp-server"
|
||||
just -v _run_ssh_cmd "opkg install sudo coreutils-readlink"
|
||||
just -v _run_ssh_cmd "/etc/init.d/uhttpd restart"
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue