dotfiles/hosts/swan/default.nix

145 lines
4.0 KiB
Nix
Raw Normal View History

2023-02-18 15:24:54 +00:00
# The Swan
# System configuration for my home NAS server
2024-04-13 13:03:44 +00:00
{
inputs,
globals,
overlays,
...
}:
2023-02-18 15:24:54 +00:00
2024-06-19 16:51:16 +00:00
inputs.nixpkgs.lib.nixosSystem rec {
2023-02-18 15:24:54 +00:00
system = "x86_64-linux";
2024-06-19 16:51:16 +00:00
specialArgs = {
pkgs-stable = import inputs.nixpkgs-stable { inherit system; };
2024-06-19 16:51:16 +00:00
pkgs-caddy = import inputs.nixpkgs-caddy { inherit system; };
};
2023-02-18 15:24:54 +00:00
modules = [
2023-03-20 03:36:15 +00:00
globals
inputs.home-manager.nixosModules.home-manager
inputs.disko.nixosModules.disko
../../modules/common
../../modules/nixos
2023-02-18 15:24:54 +00:00
{
2023-08-05 21:14:26 +00:00
nixpkgs.overlays = overlays;
2023-07-01 21:33:24 +00:00
# Hardware
2023-02-18 15:24:54 +00:00
server = true;
physical = true;
2023-02-27 02:50:24 +00:00
networking.hostName = "swan";
2023-08-05 21:14:26 +00:00
# Not sure what's necessary but too afraid to remove anything
2024-04-13 13:03:44 +00:00
boot.initrd.availableKernelModules = [
"xhci_pci"
"ahci"
"nvme"
"usb_storage"
"sd_mod"
];
2023-07-01 21:33:24 +00:00
# Required for transcoding
boot.initrd.kernelModules = [ "amdgpu" ];
boot.kernelParams = [
"radeon.si_support=0"
"amdgpu.si_support=1"
"radeon.cik_support=0"
"amdgpu.cik_support=1"
"amdgpu.dc=1"
];
2023-08-05 21:14:26 +00:00
# Required binary blobs to boot on this machine
hardware.enableRedistributableFirmware = true;
2023-07-01 21:33:24 +00:00
2023-08-05 21:14:26 +00:00
# Prioritize efficiency over performance
powerManagement.cpuFreqGovernor = "powersave";
2023-08-05 21:14:26 +00:00
# Allow firmware updates
hardware.cpu.intel.updateMicrocode = true;
2023-02-26 13:23:31 +00:00
# ZFS
2023-02-27 02:50:24 +00:00
zfs.enable = true;
2023-07-01 21:33:24 +00:00
# Generated with: head -c 8 /etc/machine-id
networking.hostId = "600279f4"; # Random ID required for ZFS
2023-08-05 21:14:26 +00:00
# Sets root ext4 filesystem instead of declaring it manually
disko = {
enableConfig = true;
2023-02-27 01:49:46 +00:00
devices = (import ../../disks/root.nix { disk = "/dev/nvme0n1"; });
};
2023-08-05 21:14:26 +00:00
2024-10-12 15:18:54 +00:00
zramSwap.enable = true;
swapDevices = [
{
device = "/swapfile";
size = 4 * 1024; # 4 GB
}
];
boot.zfs = {
# Automatically load the ZFS pool on boot
extraPools = [ "tank" ];
# Only try to decrypt datasets with keyfiles
2024-04-13 13:03:44 +00:00
requestEncryptionCredentials = [
"tank/archive"
"tank/generic"
"tank/nextcloud"
"tank/generic/git"
2024-04-13 13:03:44 +00:00
];
# If password is requested and fails, continue to boot eventually
passwordTimeout = 300;
};
2023-02-26 13:23:31 +00:00
2023-08-05 21:14:26 +00:00
# Theming
# Server doesn't require GUI
2023-02-18 15:24:54 +00:00
gui.enable = false;
2023-08-05 21:14:26 +00:00
# Still require colors for programs like Neovim, K9S
2024-04-13 13:03:44 +00:00
theme = {
colors = (import ../../colorscheme/gruvbox-dark).dark;
2024-04-13 13:03:44 +00:00
};
2023-08-05 21:14:26 +00:00
# Programs and services
atuin.enable = true;
2023-02-27 02:50:24 +00:00
neovim.enable = true;
cloudflare.enable = true;
2023-07-01 21:33:24 +00:00
dotfiles.enable = true;
arrs.enable = true;
filebrowser.enable = true;
2024-10-12 15:18:54 +00:00
services.audiobookshelf.enable = true;
2023-07-18 03:52:37 +00:00
services.bind.enable = true;
services.caddy.enable = true;
services.jellyfin.enable = true;
services.nextcloud.enable = true;
services.calibre-web.enable = true;
services.openssh.enable = true;
2023-07-16 13:50:58 +00:00
services.prometheus.enable = false;
services.vmagent.enable = true;
services.samba.enable = true;
services.paperless.enable = true;
2024-01-17 00:58:01 +00:00
services.postgresql.enable = true;
system.autoUpgrade.enable = false;
2023-02-18 15:24:54 +00:00
2023-08-05 21:14:26 +00:00
# Allows private remote access over the internet
2023-06-19 12:30:30 +00:00
cloudflareTunnel = {
enable = true;
id = "646754ac-2149-4a58-b51a-e1d0a1f3ade2";
credentialsFile = ../../private/cloudflared-swan.age;
2024-04-13 13:03:44 +00:00
ca = "ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBCHF/UMtJqPFrf6f6GRY0ZFnkCW7b6sYgUTjTtNfRj1RdmNic1NoJZql7y6BrqQinZvy7nsr1UFDNWoHn6ah3tg= open-ssh-ca@cloudflareaccess.org";
2023-06-19 12:30:30 +00:00
};
2023-08-05 21:14:26 +00:00
# Send regular backups and litestream for DBs to an S3-like bucket
2023-02-28 02:02:45 +00:00
backup.s3 = {
endpoint = "s3.us-west-002.backblazeb2.com";
bucket = "noahmasur-backup";
accessKeyId = "0026b0e73b2e2c80000000005";
};
2023-02-18 15:24:54 +00:00
# Disable passwords, only use SSH key
2024-03-24 17:16:20 +00:00
publicKeys = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB+AbmjGEwITk5CK9y7+Rg27Fokgj9QEjgc9wST6MA3s personal"
];
2023-02-18 15:24:54 +00:00
}
];
}