diff options
Diffstat (limited to 'hosts/tahoe')
19 files changed, 306 insertions, 0 deletions
diff --git a/hosts/tahoe/boot.nix b/hosts/tahoe/boot.nix new file mode 100644 index 0000000..f013f34 --- /dev/null +++ b/hosts/tahoe/boot.nix @@ -0,0 +1,17 @@ +{ ... }: + +{ + boot = { + # get an IP address on boot, so we can unlock the root disk remotely + kernelParams = [ "ip=dhcp" ]; + initrd = { + # driver for the NIC, required in order to get an IP address + kernelModules = [ "r8169" ]; + }; + }; + + my.system.boot = { + tmp = { clean = true; }; + initrd = { network.enable = true; }; + }; +} diff --git a/hosts/tahoe/default.nix b/hosts/tahoe/default.nix new file mode 100644 index 0000000..1998a51 --- /dev/null +++ b/hosts/tahoe/default.nix @@ -0,0 +1,22 @@ +{ config, pkgs, hostname, ... }: + +{ + imports = + [ ./boot.nix ./hardware.nix ./networking.nix ./home.nix ./services.nix ]; + + users.groups.nas.gid = 5000; + users.users.nas = { + uid = 5000; + group = "nas"; + isSystemUser = true; + }; + + # This value determines the NixOS release from which the default + # settings for stateful data, like file locations and database versions + # on your system were taken. It‘s perfectly fine and recommended to leave + # this value at the release version of the first install of this system. + # Before changing this value read the documentation for this option + # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html). + system.stateVersion = "21.11"; # Did you read the comment? +} + diff --git a/hosts/tahoe/hardware.nix b/hosts/tahoe/hardware.nix new file mode 100644 index 0000000..ab08490 --- /dev/null +++ b/hosts/tahoe/hardware.nix @@ -0,0 +1,63 @@ +# Do not modify this file! It was generated by ‘nixos-generate-config’ +# and may be overwritten by future invocations. Please make changes +# to /etc/nixos/configuration.nix instead. +{ config, lib, pkgs, modulesPath, ... }: + +{ + imports = [ (modulesPath + "/installer/scan/not-detected.nix") ]; + + boot.initrd.availableKernelModules = + [ "xhci_pci" "ahci" "nvme" "usbhid" "usb_storage" "sd_mod" ]; + boot.initrd.kernelModules = [ ]; + boot.extraModulePackages = [ ]; + + fileSystems."/" = { + device = "/dev/disk/by-uuid/128c2a5e-48f6-4d94-b196-fb5db500b36d"; + fsType = "btrfs"; + options = [ "subvol=nixos" ]; + }; + + boot.initrd.luks.devices."system".device = + "/dev/disk/by-uuid/0d11e090-d88f-4313-8a41-8ef52eea0870"; + + fileSystems."/home" = { + device = "/dev/disk/by-uuid/128c2a5e-48f6-4d94-b196-fb5db500b36d"; + fsType = "btrfs"; + options = [ "subvol=home" ]; + }; + + fileSystems."/.snapshots" = { + device = "/dev/disk/by-uuid/128c2a5e-48f6-4d94-b196-fb5db500b36d"; + fsType = "btrfs"; + options = [ "subvol=snapshots" ]; + }; + + fileSystems."/boot" = { + device = "/dev/disk/by-uuid/CBB9-B788"; + fsType = "vfat"; + }; + + fileSystems."/data/fast" = { + device = "/dev/disk/by-uuid/b9290b55-8ff6-4bd0-843d-a9e6f7a4df59"; + fsType = "btrfs"; + }; + + boot.initrd.luks.devices."raid-fast".device = + "/dev/disk/by-uuid/66c58a92-45fe-4b03-9be0-214ff67c177c"; + + fileSystems."/data/slow" = { + device = "/dev/disk/by-uuid/0f16db51-0ee7-48d8-9e48-653b85ecbf0a"; + fsType = "btrfs"; + }; + + boot.initrd.luks.devices."raid-slow".device = + "/dev/disk/by-uuid/d8b21267-d457-4522-91d9-5481b44dd0a5"; + + swapDevices = + [{ device = "/dev/disk/by-uuid/0f54b5ab-4fca-4c5a-a9eb-622553145163"; }]; + + my.hardware.amd.enable = true; + + # high-resolution display + hardware.video.hidpi.enable = lib.mkDefault true; +} diff --git a/hosts/tahoe/home.nix b/hosts/tahoe/home.nix new file mode 100644 index 0000000..2e56275 --- /dev/null +++ b/hosts/tahoe/home.nix @@ -0,0 +1,17 @@ +{ pkgs, ... }: + +{ + my.home = { + packages = { enable = true; }; + tmux.enable = true; + git.enable = true; + ssh.enable = true; + zsh.enable = true; + beets = { + enable = true; + musicDirectory = "/data/fast/music"; + }; + flac.enable = true; + yt-dlp.enable = true; + }; +} diff --git a/hosts/tahoe/networking.nix b/hosts/tahoe/networking.nix new file mode 100644 index 0000000..22a7251 --- /dev/null +++ b/hosts/tahoe/networking.nix @@ -0,0 +1,38 @@ +{ lib, ... }: + +{ + # Use systemd-networkd for networking + systemd.network = { + enable = true; + networks = { + enp42s0 = { + matchConfig.Name = "enp42s0"; + networkConfig = { DHCP = "yes"; }; + extraConfig = '' + [DHCPv4] + UseDNS=yes + UseDomains=yes + ''; + }; + }; + }; + + networking = { + hostName = "tahoe"; + useNetworkd = true; + useDHCP = false; + private-wireguard.enable = true; + firewall.enable = false; + }; + + services.nscd.enable = false; + system.nssModules = lib.mkForce [ ]; + + # Use systemd-resolved + services.resolved = { + enable = true; + dnssec = "false"; + }; + + my.services.tailscale.enable = true; +} diff --git a/hosts/tahoe/secrets/acme/credentials.age b/hosts/tahoe/secrets/acme/credentials.age new file mode 100644 index 0000000..1a3f92f --- /dev/null +++ b/hosts/tahoe/secrets/acme/credentials.age Binary files differdiff --git a/hosts/tahoe/secrets/acme/gcp_service_account.json.age b/hosts/tahoe/secrets/acme/gcp_service_account.json.age new file mode 100644 index 0000000..d90b0e5 --- /dev/null +++ b/hosts/tahoe/secrets/acme/gcp_service_account.json.age Binary files differdiff --git a/hosts/tahoe/secrets/drone/secrets.age b/hosts/tahoe/secrets/drone/secrets.age new file mode 100644 index 0000000..618bbc6 --- /dev/null +++ b/hosts/tahoe/secrets/drone/secrets.age Binary files differdiff --git a/hosts/tahoe/secrets/drone/shared-secrets b/hosts/tahoe/secrets/drone/shared-secrets new file mode 100644 index 0000000..47612be --- /dev/null +++ b/hosts/tahoe/secrets/drone/shared-secrets @@ -0,0 +1,5 @@ +DRONE_GITEA_CLIENT_ID=21ef7412-a58a-493c-beec-2e1dc27ebe79 +DRONE_GITEA_CLIENT_SECRET=GCXGi97PXxAoMTpHveMtNJXDyzdvI8jeC0TaEtCgpPab +DRONE_GITEA_SERVER=https://git.fcuny.net +DRONE_GIT_ALWAYS_AUTH=1 +DRONE_RPC_SECRET=d3daa6782d0f4ed66f7f557fa384ff8f diff --git a/hosts/tahoe/secrets/rclone/config.ini.age b/hosts/tahoe/secrets/rclone/config.ini.age new file mode 100644 index 0000000..1c4f7c0 --- /dev/null +++ b/hosts/tahoe/secrets/rclone/config.ini.age @@ -0,0 +1,11 @@ +age-encryption.org/v1 +-> ssh-ed25519 dtgBNg flk9dqXjiNJJcadn58Tkra0KoYp7ALlogSgryrOukns +Ha4UVvpR4xcYuf5zKPhStkghZby7SrDk+bwvHvO/j00 +-> ssh-ed25519 wtownA Ml9OWVPS8ikt2baMVaM7B4r/vi0tTaKTt+TmbZhr7xg +8kuan5CA93vCAyOclC+RX/RCh7G1XbTqLuGvg04mqLA +-> 7-grease +mfeTWZr97OI6k9CBqi+VbmiuNRc6wZHlonUnGS+b20UKp+ZfGjmczrvPeV7VhqH/ +4SPz9GwCWlJkJAtyPhfjb8X+2VJMxRTpLNfGn4WtADb151GQ +--- B/G2/6lOCuA82g23qiyi3ESh80fo1ejwKjTsw/wcDXA + 51m[BL(F SFkrI WCq ]%d C1cYE';b , $32S^2(Wqy,W%gU2 &{U#u읧F8 +|r \ No newline at end of file diff --git a/hosts/tahoe/secrets/rclone/gcs_service_account.json.age b/hosts/tahoe/secrets/rclone/gcs_service_account.json.age new file mode 100644 index 0000000..ff5260f --- /dev/null +++ b/hosts/tahoe/secrets/rclone/gcs_service_account.json.age Binary files differdiff --git a/hosts/tahoe/secrets/restic/repo-systems.age b/hosts/tahoe/secrets/restic/repo-systems.age new file mode 100644 index 0000000..cd39590 --- /dev/null +++ b/hosts/tahoe/secrets/restic/repo-systems.age @@ -0,0 +1,9 @@ +age-encryption.org/v1 +-> ssh-ed25519 dtgBNg I6aC5eB9FuJuQh0qEtjJ6Ho6UrybXBCIqeqErJtsOEc +uo23S1l1Fb2G+vG7GI7Nc+SPCl3d0Obc3tHPeDESAuw +-> ssh-ed25519 wtownA NoFRHiQRgQrHmTLJ5wi/rORy4J1Wf4iU6Hr+FlaFfyE +gZsVc9ptglFYrvE4gRl+L/RpkB9uVDOeAr3z9Dk4J4I +-> Pz-grease +iWN7 +--- t14q3Wr5y4TZFZmwGEf6ARvo63x2AEQhU4tnhdRrLa0 +S+sHt=@}CѦO{<jM=;* +9tٱ&:4 \ No newline at end of file diff --git a/hosts/tahoe/secrets/secrets.nix b/hosts/tahoe/secrets/secrets.nix new file mode 100644 index 0000000..01ff035 --- /dev/null +++ b/hosts/tahoe/secrets/secrets.nix @@ -0,0 +1,36 @@ +let + fcuny_aptos = + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIdlm/qoR/dnMjZhVSTtqFzkgN3Yf9eQ3pgKMiipg+dl"; + tahoe = + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEq1IQRvj2jofCHOO6M28w2SRdgtHU06NJvwAwv/b69F"; + all = [ fcuny_aptos tahoe ]; +in { + "wireguard_privatekey.age".publicKeys = all; + + "acme/credentials.age".publicKeys = all; + "acme/gcp_service_account.json.age" = { + publicKeys = all; + owner = "acme"; + }; + + "drone/secrets.age" = { + publicKeys = all; + owner = "drone"; + }; + + "syncthing/key.age" = { + publicKeys = all; + owner = "fcuny"; + }; + + "syncthing/cert.age" = { + publicKeys = all; + owner = "fcuny"; + }; + + "unifi/unifi-poller.age".publicKeys = all; + + "restic/repo-systems.age".publicKeys = all; + "rclone/config.ini.age".publicKeys = all; + "rclone/gcs_service_account.json.age".publicKeys = all; +} diff --git a/hosts/tahoe/secrets/syncthing/cert.age b/hosts/tahoe/secrets/syncthing/cert.age new file mode 100644 index 0000000..aceb120 --- /dev/null +++ b/hosts/tahoe/secrets/syncthing/cert.age Binary files differdiff --git a/hosts/tahoe/secrets/syncthing/key.age b/hosts/tahoe/secrets/syncthing/key.age new file mode 100644 index 0000000..8c22933 --- /dev/null +++ b/hosts/tahoe/secrets/syncthing/key.age @@ -0,0 +1,10 @@ +age-encryption.org/v1 +-> ssh-ed25519 dtgBNg ChSBoRw7XwKHqNfO43UkA1mL3gYzVrt9u2CYpxw6oSI +witLAp/ilF/wcWnGx0QReqe7mBdR3lZspzOjpEpMi1I +-> ssh-ed25519 wtownA NdY9VIDwwMlAfw39yIMsAGUMIRghUOBWlZ4ham9DRSc +HucEPuec5Y3MGvp3kIZa/NFWxSGPhL01qE1P4L24P8g +-> 2/x-grease Op@o& x +u7C9+kZlujVO76tqT07yS+pYtUa7lyTu4ksZeXhTlgAGP59Zl5tq7DkT +--- ddK2/N4jHQ2jB1nvuQWfElP+LR+pgQW0Ozzc3n7FhSs +<Yv(3yܲđk*r '- + wnv0|*@- Rԙ*rg[$f]X6+M6nsuD` =V{Àw 2E?"yWWXP2spa ng?<su=rEhb ^ `1VX;gv˜ ףp#U4@;kTô+btv5I"N1m h!8T``v[$ +:痙uj0c S(GVqtem+T>vRI \ No newline at end of file diff --git a/hosts/tahoe/secrets/traefik/gcp_service_account.json.age b/hosts/tahoe/secrets/traefik/gcp_service_account.json.age new file mode 100644 index 0000000..0f99905 --- /dev/null +++ b/hosts/tahoe/secrets/traefik/gcp_service_account.json.age Binary files differdiff --git a/hosts/tahoe/secrets/unifi/unifi-poller.age b/hosts/tahoe/secrets/unifi/unifi-poller.age new file mode 100644 index 0000000..4fb0e7f --- /dev/null +++ b/hosts/tahoe/secrets/unifi/unifi-poller.age @@ -0,0 +1,10 @@ +age-encryption.org/v1 +-> ssh-ed25519 dtgBNg uqkCRrdoOMyrsbpfK8+7LwHZ9HAtZVmPMDHMT24mHXk +BooBKT31kAEjWOHvx5B4g82R/Wl6f/1kp0BiEn6X6jE +-> ssh-ed25519 wtownA 7TZMv8CNmwIbYh6tHu5hzI+YmXem+u6Ni4dJ8brAyj4 +CUPF2SgqA/Rz9bnA2w1jvoZpWKTmFrKYACySbzXHrqU +-> *"=7-grease >"jI\ )%!Hr*2 }Br{nQX +Zo1RbBeC8QYmLO7rPbQCxe0YUGCYsf5xN4lXpqBNS42ZPg/oeIE1ZvYTU47p5SbE +CjuxcicfzgPApwp8o9s +--- M8GY2JUWDT87vxiZ4RrYjJp6yUW6Gz993Ens/65PPQo +~smwai!=Iy>F}Sb*.1&Kc \ No newline at end of file diff --git a/hosts/tahoe/secrets/wireguard_privatekey.age b/hosts/tahoe/secrets/wireguard_privatekey.age new file mode 100644 index 0000000..edd8bee --- /dev/null +++ b/hosts/tahoe/secrets/wireguard_privatekey.age @@ -0,0 +1,11 @@ +age-encryption.org/v1 +-> ssh-ed25519 dtgBNg qNmKLv3MGfcZrBGuX3/+WlJh/2W7ailKCl1XwC1Dczk +6Z5ZsPmBsDVIn/CTAgujuuQMc9UgYsjOU2FjcXOgzXM +-> ssh-ed25519 wtownA reQNIQYlaC/rWXO791VWzwdlSXe+Vo1dBU/yVLYEmhI +0kZxEr3DfYTSl2F0UzuZkHLWq/BGd1XqBddEl4Ml9SQ +-> kQ-grease Q^i|R~ &PWMBI U3Y<>Kji +pSfA5OfoiOKuMhBIgliAdmVPAQg97f9ZiNUABNP8KFzZiaGY9D1Co9rkkvOA97LR +rl3U8SfGb+RUyFB5lQZBkvH1tgz9GbakV2rRhZNGjabLO6V7NEVFa4ka3ODL4rlS +ggM +--- Yds61EVDl84C0IbJCRO5CRatN76JPxSauRkm8Ui8L4U +ZFΎĀ <ܠ0X}l!+P&,:y!Z Gd!vkhL;8MnvGlFJ0! \ No newline at end of file diff --git a/hosts/tahoe/services.nix b/hosts/tahoe/services.nix new file mode 100644 index 0000000..e665b15 --- /dev/null +++ b/hosts/tahoe/services.nix @@ -0,0 +1,57 @@ +{ config, ... }: +let secrets = config.age.secrets; +in { + my.services = { + samba = { + enable = true; + publicShares = [ "/data/fast/music" "/data/fast/videos" ]; + }; + navidrome = { + enable = true; + vhostName = "music.fcuny.xyz"; + musicFolder = "/data/fast/music"; + }; + unifi = { + enable = true; + vhostName = "unifi.fcuny.xyz"; + }; + prometheus = { enable = true; }; + grafana = { + enable = true; + vhostName = "dash.fcuny.xyz"; + }; + cgit = { + enable = true; + }; + gerrit = { + enable = true; + vhostName = "cl.fcuny.net"; + }; + sourcegraph = { + enable = true; + vhostName = "cs.fcuny.xyz"; + }; + drone = { + enable = true; + vhostName = "drone.fcuny.xyz"; + runners = [ "docker" "exec" ]; + sharedSecretFile = secrets."drone/secrets".path; + }; + rclone = { enable = true; }; + nginx = { enable = true; }; + transmission = { + enable = true; + vhostName = "bt.fcuny.xyz"; + }; + metrics-exporter = { enable = true; }; + syncthing.enable = true; + backup = { + enable = true; + repository = "/data/slow/backups/systems"; + timerConfig = { OnCalendar = "00:15"; }; + passwordFile = secrets."restic/repo-systems".path; + paths = + [ "/home" "/data/fast/music" "/data/fast/photos" "/data/fast/videos" ]; + }; + }; +} |