about summary refs log tree commit diff
path: root/hosts/tahoe
diff options
context:
space:
mode:
Diffstat (limited to 'hosts/tahoe')
-rw-r--r--hosts/tahoe/boot.nix17
-rw-r--r--hosts/tahoe/default.nix22
-rw-r--r--hosts/tahoe/hardware.nix63
-rw-r--r--hosts/tahoe/home.nix17
-rw-r--r--hosts/tahoe/networking.nix38
-rw-r--r--hosts/tahoe/secrets/acme/credentials.agebin0 -> 461 bytes
-rw-r--r--hosts/tahoe/secrets/acme/gcp_service_account.json.agebin0 -> 2763 bytes
-rw-r--r--hosts/tahoe/secrets/drone/secrets.agebin0 -> 697 bytes
-rw-r--r--hosts/tahoe/secrets/drone/shared-secrets5
-rw-r--r--hosts/tahoe/secrets/rclone/config.ini.age11
-rw-r--r--hosts/tahoe/secrets/rclone/gcs_service_account.json.agebin0 -> 2660 bytes
-rw-r--r--hosts/tahoe/secrets/restic/repo-systems.age9
-rw-r--r--hosts/tahoe/secrets/secrets.nix36
-rw-r--r--hosts/tahoe/secrets/syncthing/cert.agebin0 -> 1248 bytes
-rw-r--r--hosts/tahoe/secrets/syncthing/key.age10
-rw-r--r--hosts/tahoe/secrets/traefik/gcp_service_account.json.agebin0 -> 2827 bytes
-rw-r--r--hosts/tahoe/secrets/unifi/unifi-poller.age10
-rw-r--r--hosts/tahoe/secrets/wireguard_privatekey.age11
-rw-r--r--hosts/tahoe/services.nix57
19 files changed, 306 insertions, 0 deletions
diff --git a/hosts/tahoe/boot.nix b/hosts/tahoe/boot.nix
new file mode 100644
index 0000000..f013f34
--- /dev/null
+++ b/hosts/tahoe/boot.nix
@@ -0,0 +1,17 @@
+{ ... }:
+
+{
+  boot = {
+    # get an IP address on boot, so we can unlock the root disk remotely
+    kernelParams = [ "ip=dhcp" ];
+    initrd = {
+      # driver for the NIC, required in order to get an IP address
+      kernelModules = [ "r8169" ];
+    };
+  };
+
+  my.system.boot = {
+    tmp = { clean = true; };
+    initrd = { network.enable = true; };
+  };
+}
diff --git a/hosts/tahoe/default.nix b/hosts/tahoe/default.nix
new file mode 100644
index 0000000..1998a51
--- /dev/null
+++ b/hosts/tahoe/default.nix
@@ -0,0 +1,22 @@
+{ config, pkgs, hostname, ... }:
+
+{
+  imports =
+    [ ./boot.nix ./hardware.nix ./networking.nix ./home.nix ./services.nix ];
+
+  users.groups.nas.gid = 5000;
+  users.users.nas = {
+    uid = 5000;
+    group = "nas";
+    isSystemUser = true;
+  };
+
+  # This value determines the NixOS release from which the default
+  # settings for stateful data, like file locations and database versions
+  # on your system were taken. It‘s perfectly fine and recommended to leave
+  # this value at the release version of the first install of this system.
+  # Before changing this value read the documentation for this option
+  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
+  system.stateVersion = "21.11"; # Did you read the comment?
+}
+
diff --git a/hosts/tahoe/hardware.nix b/hosts/tahoe/hardware.nix
new file mode 100644
index 0000000..ab08490
--- /dev/null
+++ b/hosts/tahoe/hardware.nix
@@ -0,0 +1,63 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports = [ (modulesPath + "/installer/scan/not-detected.nix") ];
+
+  boot.initrd.availableKernelModules =
+    [ "xhci_pci" "ahci" "nvme" "usbhid" "usb_storage" "sd_mod" ];
+  boot.initrd.kernelModules = [ ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" = {
+    device = "/dev/disk/by-uuid/128c2a5e-48f6-4d94-b196-fb5db500b36d";
+    fsType = "btrfs";
+    options = [ "subvol=nixos" ];
+  };
+
+  boot.initrd.luks.devices."system".device =
+    "/dev/disk/by-uuid/0d11e090-d88f-4313-8a41-8ef52eea0870";
+
+  fileSystems."/home" = {
+    device = "/dev/disk/by-uuid/128c2a5e-48f6-4d94-b196-fb5db500b36d";
+    fsType = "btrfs";
+    options = [ "subvol=home" ];
+  };
+
+  fileSystems."/.snapshots" = {
+    device = "/dev/disk/by-uuid/128c2a5e-48f6-4d94-b196-fb5db500b36d";
+    fsType = "btrfs";
+    options = [ "subvol=snapshots" ];
+  };
+
+  fileSystems."/boot" = {
+    device = "/dev/disk/by-uuid/CBB9-B788";
+    fsType = "vfat";
+  };
+
+  fileSystems."/data/fast" = {
+    device = "/dev/disk/by-uuid/b9290b55-8ff6-4bd0-843d-a9e6f7a4df59";
+    fsType = "btrfs";
+  };
+
+  boot.initrd.luks.devices."raid-fast".device =
+    "/dev/disk/by-uuid/66c58a92-45fe-4b03-9be0-214ff67c177c";
+
+  fileSystems."/data/slow" = {
+    device = "/dev/disk/by-uuid/0f16db51-0ee7-48d8-9e48-653b85ecbf0a";
+    fsType = "btrfs";
+  };
+
+  boot.initrd.luks.devices."raid-slow".device =
+    "/dev/disk/by-uuid/d8b21267-d457-4522-91d9-5481b44dd0a5";
+
+  swapDevices =
+    [{ device = "/dev/disk/by-uuid/0f54b5ab-4fca-4c5a-a9eb-622553145163"; }];
+
+  my.hardware.amd.enable = true;
+
+  # high-resolution display
+  hardware.video.hidpi.enable = lib.mkDefault true;
+}
diff --git a/hosts/tahoe/home.nix b/hosts/tahoe/home.nix
new file mode 100644
index 0000000..2e56275
--- /dev/null
+++ b/hosts/tahoe/home.nix
@@ -0,0 +1,17 @@
+{ pkgs, ... }:
+
+{
+  my.home = {
+    packages = { enable = true; };
+    tmux.enable = true;
+    git.enable = true;
+    ssh.enable = true;
+    zsh.enable = true;
+    beets = {
+      enable = true;
+      musicDirectory = "/data/fast/music";
+    };
+    flac.enable = true;
+    yt-dlp.enable = true;
+  };
+}
diff --git a/hosts/tahoe/networking.nix b/hosts/tahoe/networking.nix
new file mode 100644
index 0000000..22a7251
--- /dev/null
+++ b/hosts/tahoe/networking.nix
@@ -0,0 +1,38 @@
+{ lib, ... }:
+
+{
+  # Use systemd-networkd for networking
+  systemd.network = {
+    enable = true;
+    networks = {
+      enp42s0 = {
+        matchConfig.Name = "enp42s0";
+        networkConfig = { DHCP = "yes"; };
+        extraConfig = ''
+          [DHCPv4]
+          UseDNS=yes
+          UseDomains=yes
+        '';
+      };
+    };
+  };
+
+  networking = {
+    hostName = "tahoe";
+    useNetworkd = true;
+    useDHCP = false;
+    private-wireguard.enable = true;
+    firewall.enable = false;
+  };
+
+  services.nscd.enable = false;
+  system.nssModules = lib.mkForce [ ];
+
+  # Use systemd-resolved
+  services.resolved = {
+    enable = true;
+    dnssec = "false";
+  };
+
+  my.services.tailscale.enable = true;
+}
diff --git a/hosts/tahoe/secrets/acme/credentials.age b/hosts/tahoe/secrets/acme/credentials.age
new file mode 100644
index 0000000..1a3f92f
--- /dev/null
+++ b/hosts/tahoe/secrets/acme/credentials.age
Binary files differdiff --git a/hosts/tahoe/secrets/acme/gcp_service_account.json.age b/hosts/tahoe/secrets/acme/gcp_service_account.json.age
new file mode 100644
index 0000000..d90b0e5
--- /dev/null
+++ b/hosts/tahoe/secrets/acme/gcp_service_account.json.age
Binary files differdiff --git a/hosts/tahoe/secrets/drone/secrets.age b/hosts/tahoe/secrets/drone/secrets.age
new file mode 100644
index 0000000..618bbc6
--- /dev/null
+++ b/hosts/tahoe/secrets/drone/secrets.age
Binary files differdiff --git a/hosts/tahoe/secrets/drone/shared-secrets b/hosts/tahoe/secrets/drone/shared-secrets
new file mode 100644
index 0000000..47612be
--- /dev/null
+++ b/hosts/tahoe/secrets/drone/shared-secrets
@@ -0,0 +1,5 @@
+DRONE_GITEA_CLIENT_ID=21ef7412-a58a-493c-beec-2e1dc27ebe79
+DRONE_GITEA_CLIENT_SECRET=GCXGi97PXxAoMTpHveMtNJXDyzdvI8jeC0TaEtCgpPab
+DRONE_GITEA_SERVER=https://git.fcuny.net
+DRONE_GIT_ALWAYS_AUTH=1
+DRONE_RPC_SECRET=d3daa6782d0f4ed66f7f557fa384ff8f
diff --git a/hosts/tahoe/secrets/rclone/config.ini.age b/hosts/tahoe/secrets/rclone/config.ini.age
new file mode 100644
index 0000000..1c4f7c0
--- /dev/null
+++ b/hosts/tahoe/secrets/rclone/config.ini.age
@@ -0,0 +1,11 @@
+age-encryption.org/v1
+-> ssh-ed25519 dtgBNg flk9dqXjiNJJcadn58Tkra0KoYp7ALlogSgryrOukns
+Ha4UVvpR4xcYuf5zKPhStkghZby7SrDk+bwvHvO/j00
+-> ssh-ed25519 wtownA Ml9OWVPS8ikt2baMVaM7B4r/vi0tTaKTt+TmbZhr7xg
+8kuan5CA93vCAyOclC+RX/RCh7G1XbTqLuGvg04mqLA
+-> 7-grease
+mfeTWZr97OI6k9CBqi+VbmiuNRc6wZHlonUnGS+b20UKp+ZfGjmczrvPeV7VhqH/
+4SPz9GwCWlJkJAtyPhfjb8X+2VJMxRTpLNfGn4WtADb151GQ
+--- B/G2/6lOCuA82g23qiyi3ESh80fo1ejwKjTsw/wcDXA
+51m[BL(FSFkrIWCq	]%dC1cYE';b,$32S^2(Wqy,W%gU2&{U#u읧F8
+|r
\ No newline at end of file
diff --git a/hosts/tahoe/secrets/rclone/gcs_service_account.json.age b/hosts/tahoe/secrets/rclone/gcs_service_account.json.age
new file mode 100644
index 0000000..ff5260f
--- /dev/null
+++ b/hosts/tahoe/secrets/rclone/gcs_service_account.json.age
Binary files differdiff --git a/hosts/tahoe/secrets/restic/repo-systems.age b/hosts/tahoe/secrets/restic/repo-systems.age
new file mode 100644
index 0000000..cd39590
--- /dev/null
+++ b/hosts/tahoe/secrets/restic/repo-systems.age
@@ -0,0 +1,9 @@
+age-encryption.org/v1
+-> ssh-ed25519 dtgBNg I6aC5eB9FuJuQh0qEtjJ6Ho6UrybXBCIqeqErJtsOEc
+uo23S1l1Fb2G+vG7GI7Nc+SPCl3d0Obc3tHPeDESAuw
+-> ssh-ed25519 wtownA NoFRHiQRgQrHmTLJ5wi/rORy4J1Wf4iU6Hr+FlaFfyE
+gZsVc9ptglFYrvE4gRl+L/RpkB9uVDOeAr3z9Dk4J4I
+-> Pz-grease
+iWN7
+--- t14q3Wr5y4TZFZmwGEf6ARvo63x2AEQhU4tnhdRrLa0
+S+sHt=@}CѦO{<jM=;*+9tٱ&:4
\ No newline at end of file
diff --git a/hosts/tahoe/secrets/secrets.nix b/hosts/tahoe/secrets/secrets.nix
new file mode 100644
index 0000000..01ff035
--- /dev/null
+++ b/hosts/tahoe/secrets/secrets.nix
@@ -0,0 +1,36 @@
+let
+  fcuny_aptos =
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIdlm/qoR/dnMjZhVSTtqFzkgN3Yf9eQ3pgKMiipg+dl";
+  tahoe =
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEq1IQRvj2jofCHOO6M28w2SRdgtHU06NJvwAwv/b69F";
+  all = [ fcuny_aptos tahoe ];
+in {
+  "wireguard_privatekey.age".publicKeys = all;
+
+  "acme/credentials.age".publicKeys = all;
+  "acme/gcp_service_account.json.age" = {
+    publicKeys = all;
+    owner = "acme";
+  };
+
+  "drone/secrets.age" = {
+    publicKeys = all;
+    owner = "drone";
+  };
+
+  "syncthing/key.age" = {
+    publicKeys = all;
+    owner = "fcuny";
+  };
+
+  "syncthing/cert.age" = {
+    publicKeys = all;
+    owner = "fcuny";
+  };
+
+  "unifi/unifi-poller.age".publicKeys = all;
+
+  "restic/repo-systems.age".publicKeys = all;
+  "rclone/config.ini.age".publicKeys = all;
+  "rclone/gcs_service_account.json.age".publicKeys = all;
+}
diff --git a/hosts/tahoe/secrets/syncthing/cert.age b/hosts/tahoe/secrets/syncthing/cert.age
new file mode 100644
index 0000000..aceb120
--- /dev/null
+++ b/hosts/tahoe/secrets/syncthing/cert.age
Binary files differdiff --git a/hosts/tahoe/secrets/syncthing/key.age b/hosts/tahoe/secrets/syncthing/key.age
new file mode 100644
index 0000000..8c22933
--- /dev/null
+++ b/hosts/tahoe/secrets/syncthing/key.age
@@ -0,0 +1,10 @@
+age-encryption.org/v1
+-> ssh-ed25519 dtgBNg ChSBoRw7XwKHqNfO43UkA1mL3gYzVrt9u2CYpxw6oSI
+witLAp/ilF/wcWnGx0QReqe7mBdR3lZspzOjpEpMi1I
+-> ssh-ed25519 wtownA NdY9VIDwwMlAfw39yIMsAGUMIRghUOBWlZ4ham9DRSc
+HucEPuec5Y3MGvp3kIZa/NFWxSGPhL01qE1P4L24P8g
+-> 2/x-grease Op@o& x
+u7C9+kZlujVO76tqT07yS+pYtUa7lyTu4ksZeXhTlgAGP59Zl5tq7DkT
+--- ddK2/N4jHQ2jB1nvuQWfElP+LR+pgQW0Ozzc3n7FhSs
+<Yv(3yܲđk*r '-+wnv0|*@-Rԙ*rg[$f]X6+M6nsuD`=V{Àw2E?"yWWXP2spang?<su=rEhb^`1VX;gv˜ףp#U4@;kTô+btv򋏚5I"N1mh!8T``v[$
+:痙uj0cS(GVqtem+T>vRI
\ No newline at end of file
diff --git a/hosts/tahoe/secrets/traefik/gcp_service_account.json.age b/hosts/tahoe/secrets/traefik/gcp_service_account.json.age
new file mode 100644
index 0000000..0f99905
--- /dev/null
+++ b/hosts/tahoe/secrets/traefik/gcp_service_account.json.age
Binary files differdiff --git a/hosts/tahoe/secrets/unifi/unifi-poller.age b/hosts/tahoe/secrets/unifi/unifi-poller.age
new file mode 100644
index 0000000..4fb0e7f
--- /dev/null
+++ b/hosts/tahoe/secrets/unifi/unifi-poller.age
@@ -0,0 +1,10 @@
+age-encryption.org/v1
+-> ssh-ed25519 dtgBNg uqkCRrdoOMyrsbpfK8+7LwHZ9HAtZVmPMDHMT24mHXk
+BooBKT31kAEjWOHvx5B4g82R/Wl6f/1kp0BiEn6X6jE
+-> ssh-ed25519 wtownA 7TZMv8CNmwIbYh6tHu5hzI+YmXem+u6Ni4dJ8brAyj4
+CUPF2SgqA/Rz9bnA2w1jvoZpWKTmFrKYACySbzXHrqU
+-> *"=7-grease >"jI\ )%!Hr*2 }Br{nQX
+Zo1RbBeC8QYmLO7rPbQCxe0YUGCYsf5xN4lXpqBNS42ZPg/oeIE1ZvYTU47p5SbE
+CjuxcicfzgPApwp8o9s
+--- M8GY2JUWDT87vxiZ4RrYjJp6yUW6Gz993Ens/65PPQo
+~smwai!=Iy>F}Sb*.1&Kc
\ No newline at end of file
diff --git a/hosts/tahoe/secrets/wireguard_privatekey.age b/hosts/tahoe/secrets/wireguard_privatekey.age
new file mode 100644
index 0000000..edd8bee
--- /dev/null
+++ b/hosts/tahoe/secrets/wireguard_privatekey.age
@@ -0,0 +1,11 @@
+age-encryption.org/v1
+-> ssh-ed25519 dtgBNg qNmKLv3MGfcZrBGuX3/+WlJh/2W7ailKCl1XwC1Dczk
+6Z5ZsPmBsDVIn/CTAgujuuQMc9UgYsjOU2FjcXOgzXM
+-> ssh-ed25519 wtownA reQNIQYlaC/rWXO791VWzwdlSXe+Vo1dBU/yVLYEmhI
+0kZxEr3DfYTSl2F0UzuZkHLWq/BGd1XqBddEl4Ml9SQ
+-> kQ-grease Q^i|R~ &PWMBI U3Y<>Kji
+pSfA5OfoiOKuMhBIgliAdmVPAQg97f9ZiNUABNP8KFzZiaGY9D1Co9rkkvOA97LR
+rl3U8SfGb+RUyFB5lQZBkvH1tgz9GbakV2rRhZNGjabLO6V7NEVFa4ka3ODL4rlS
+ggM
+--- Yds61EVDl84C0IbJCRO5CRatN76JPxSauRkm8Ui8L4U
+ZFΎĀ <ܠ0X}l!+P&,:y!ZGd!vkhL;8MnvGlFJ0!
\ No newline at end of file
diff --git a/hosts/tahoe/services.nix b/hosts/tahoe/services.nix
new file mode 100644
index 0000000..e665b15
--- /dev/null
+++ b/hosts/tahoe/services.nix
@@ -0,0 +1,57 @@
+{ config, ... }:
+let secrets = config.age.secrets;
+in {
+  my.services = {
+    samba = {
+      enable = true;
+      publicShares = [ "/data/fast/music" "/data/fast/videos" ];
+    };
+    navidrome = {
+      enable = true;
+      vhostName = "music.fcuny.xyz";
+      musicFolder = "/data/fast/music";
+    };
+    unifi = {
+      enable = true;
+      vhostName = "unifi.fcuny.xyz";
+    };
+    prometheus = { enable = true; };
+    grafana = {
+      enable = true;
+      vhostName = "dash.fcuny.xyz";
+    };
+    cgit = {
+      enable = true;
+    };
+    gerrit = {
+      enable = true;
+      vhostName = "cl.fcuny.net";
+    };
+    sourcegraph = {
+      enable = true;
+      vhostName = "cs.fcuny.xyz";
+    };
+    drone = {
+      enable = true;
+      vhostName = "drone.fcuny.xyz";
+      runners = [ "docker" "exec" ];
+      sharedSecretFile = secrets."drone/secrets".path;
+    };
+    rclone = { enable = true; };
+    nginx = { enable = true; };
+    transmission = {
+      enable = true;
+      vhostName = "bt.fcuny.xyz";
+    };
+    metrics-exporter = { enable = true; };
+    syncthing.enable = true;
+    backup = {
+      enable = true;
+      repository = "/data/slow/backups/systems";
+      timerConfig = { OnCalendar = "00:15"; };
+      passwordFile = secrets."restic/repo-systems".path;
+      paths =
+        [ "/home" "/data/fast/music" "/data/fast/photos" "/data/fast/videos" ];
+    };
+  };
+}