improve hosts documentation

This commit is contained in:
Noah Masur 2023-08-05 17:14:26 -04:00
parent f0e1fc740f
commit 5bc10bef87
3 changed files with 65 additions and 17 deletions

View File

@ -3,6 +3,7 @@
# How to install: # How to install:
# https://blog.korfuri.fr/posts/2022/08/nixos-on-an-oracle-free-tier-ampere-machine/ # https://blog.korfuri.fr/posts/2022/08/nixos-on-an-oracle-free-tier-ampere-machine/
# These days, probably use nixos-anywhere instead.
{ inputs, globals, overlays, ... }: { inputs, globals, overlays, ... }:
@ -21,32 +22,38 @@ inputs.nixpkgs.lib.nixosSystem {
server = true; server = true;
networking.hostName = "flame"; networking.hostName = "flame";
# Not sure what's necessary but too afraid to remove anything
imports = [ (inputs.nixpkgs + "/nixos/modules/profiles/qemu-guest.nix") ]; imports = [ (inputs.nixpkgs + "/nixos/modules/profiles/qemu-guest.nix") ];
boot.initrd.availableKernelModules = [ "xhci_pci" "virtio_pci" "usbhid" ]; boot.initrd.availableKernelModules = [ "xhci_pci" "virtio_pci" "usbhid" ];
# File systems must be declared in order to boot
# This is the root filesystem containing NixOS
# I forgot to set a clean label for it
fileSystems."/" = { fileSystems."/" = {
device = "/dev/disk/by-uuid/e1b6bd50-306d-429a-9f45-78f57bc597c3"; device = "/dev/disk/by-uuid/e1b6bd50-306d-429a-9f45-78f57bc597c3";
fsType = "ext4"; fsType = "ext4";
}; };
# This is the boot filesystem for systemd-boot
fileSystems."/boot" = { fileSystems."/boot" = {
device = "/dev/disk/by-uuid/D5CA-237A"; device = "/dev/disk/by-uuid/D5CA-237A";
fsType = "vfat"; fsType = "vfat";
}; };
# Theming # Theming
gui.enable = false;
theme = { colors = (import ../../colorscheme/gruvbox).dark; };
# Disable passwords, only use SSH key # Server doesn't require GUI
publicKey = gui.enable = false;
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB+AbmjGEwITk5CK9y7+Rg27Fokgj9QEjgc9wST6MA3s";
# Still require colors for programs like Neovim, K9S
theme = { colors = (import ../../colorscheme/gruvbox).dark; };
# Programs and services # Programs and services
cloudflare.enable = true; # Proxy traffic with Cloudflare cloudflare.enable = true; # Proxy traffic with Cloudflare
dotfiles.enable = true; # Clone dotfiles dotfiles.enable = true; # Clone dotfiles
neovim.enable = true; neovim.enable = true;
giteaRunner.enable = true;
services.caddy.enable = true; services.caddy.enable = true;
services.grafana.enable = true; services.grafana.enable = true;
services.openssh.enable = true; services.openssh.enable = true;
@ -55,6 +62,7 @@ inputs.nixpkgs.lib.nixosSystem {
services.vaultwarden.enable = true; services.vaultwarden.enable = true;
services.minecraft-server.enable = true; # Setup Minecraft server services.minecraft-server.enable = true; # Setup Minecraft server
# Allows private remote access over the internet
cloudflareTunnel = { cloudflareTunnel = {
enable = true; enable = true;
id = "bd250ee1-ed2e-42d2-b627-039f1eb5a4d2"; id = "bd250ee1-ed2e-42d2-b627-039f1eb5a4d2";
@ -63,8 +71,6 @@ inputs.nixpkgs.lib.nixosSystem {
"ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBK/6oyVqjFGX3Uvrc3VS8J9sphxzAnRzKC85xgkHfYgR3TK6qBGXzHrknEj21xeZrr3G2y1UsGzphWJd9ZfIcdA= open-ssh-ca@cloudflareaccess.org"; "ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBK/6oyVqjFGX3Uvrc3VS8J9sphxzAnRzKC85xgkHfYgR3TK6qBGXzHrknEj21xeZrr3G2y1UsGzphWJd9ZfIcdA= open-ssh-ca@cloudflareaccess.org";
}; };
giteaRunner.enable = true;
# Nextcloud backup config # Nextcloud backup config
backup.s3 = { backup.s3 = {
endpoint = "s3.us-west-002.backblazeb2.com"; endpoint = "s3.us-west-002.backblazeb2.com";
@ -72,8 +78,9 @@ inputs.nixpkgs.lib.nixosSystem {
accessKeyId = "0026b0e73b2e2c80000000005"; accessKeyId = "0026b0e73b2e2c80000000005";
}; };
# # Grant access to Jellyfin directories from Nextcloud # Disable passwords, only use SSH key
# users.users.nextcloud.extraGroups = [ "jellyfin" ]; publicKey =
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB+AbmjGEwITk5CK9y7+Rg27Fokgj9QEjgc9wST6MA3s";
# # Wireguard config for Transmission # # Wireguard config for Transmission
# wireguard.enable = true; # wireguard.enable = true;
@ -104,9 +111,6 @@ inputs.nixpkgs.lib.nixosSystem {
# # VPN port forwarding # # VPN port forwarding
# services.transmission.settings.peer-port = 57599; # services.transmission.settings.peer-port = 57599;
# # Grant access to Transmission directories from Jellyfin
# users.users.jellyfin.extraGroups = [ "transmission" ];
} }
]; ];
} }

View File

@ -13,11 +13,14 @@ inputs.nixpkgs.lib.nixosSystem {
../../modules/common ../../modules/common
../../modules/nixos ../../modules/nixos
{ {
nixpkgs.overlays = overlays;
# Hardware # Hardware
server = true; server = true;
physical = true; physical = true;
networking.hostName = "swan"; networking.hostName = "swan";
# Not sure what's necessary but too afraid to remove anything
boot.initrd.availableKernelModules = boot.initrd.availableKernelModules =
[ "xhci_pci" "ahci" "nvme" "usb_storage" "sd_mod" ]; [ "xhci_pci" "ahci" "nvme" "usb_storage" "sd_mod" ];
@ -30,29 +33,43 @@ inputs.nixpkgs.lib.nixosSystem {
"amdgpu.cik_support=1" "amdgpu.cik_support=1"
"amdgpu.dc=1" "amdgpu.dc=1"
]; ];
# Required binary blobs to boot on this machine
hardware.enableRedistributableFirmware = true; hardware.enableRedistributableFirmware = true;
# Prioritize efficiency over performance
powerManagement.cpuFreqGovernor = "powersave"; powerManagement.cpuFreqGovernor = "powersave";
# Allow firmware updates
hardware.cpu.intel.updateMicrocode = true; hardware.cpu.intel.updateMicrocode = true;
# ZFS # ZFS
zfs.enable = true; zfs.enable = true;
# Generated with: head -c 8 /etc/machine-id # Generated with: head -c 8 /etc/machine-id
networking.hostId = "600279f4"; # Random ID required for ZFS networking.hostId = "600279f4"; # Random ID required for ZFS
# Sets root ext4 filesystem instead of declaring it manually
disko = { disko = {
enableConfig = true; enableConfig = true;
devices = (import ../../disks/root.nix { disk = "/dev/nvme0n1"; }); devices = (import ../../disks/root.nix { disk = "/dev/nvme0n1"; });
}; };
# Automatically load the ZFS pool on boot
boot.zfs.extraPools = [ "tank" ]; boot.zfs.extraPools = [ "tank" ];
# Theming
# Server doesn't require GUI
gui.enable = false; gui.enable = false;
# Still require colors for programs like Neovim, K9S
theme = { colors = (import ../../colorscheme/gruvbox).dark; }; theme = { colors = (import ../../colorscheme/gruvbox).dark; };
nixpkgs.overlays = overlays;
# Programs and services
neovim.enable = true; neovim.enable = true;
cloudflare.enable = true; cloudflare.enable = true;
dotfiles.enable = true; dotfiles.enable = true;
arrs.enable = true; arrs.enable = true;
services.bind.enable = true; services.bind.enable = true;
services.caddy.enable = true; services.caddy.enable = true;
services.jellyfin.enable = true; services.jellyfin.enable = true;
@ -63,6 +80,7 @@ inputs.nixpkgs.lib.nixosSystem {
services.vmagent.enable = true; services.vmagent.enable = true;
services.samba.enable = true; services.samba.enable = true;
# Allows private remote access over the internet
cloudflareTunnel = { cloudflareTunnel = {
enable = true; enable = true;
id = "646754ac-2149-4a58-b51a-e1d0a1f3ade2"; id = "646754ac-2149-4a58-b51a-e1d0a1f3ade2";
@ -71,6 +89,7 @@ inputs.nixpkgs.lib.nixosSystem {
"ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBCHF/UMtJqPFrf6f6GRY0ZFnkCW7b6sYgUTjTtNfRj1RdmNic1NoJZql7y6BrqQinZvy7nsr1UFDNWoHn6ah3tg= open-ssh-ca@cloudflareaccess.org"; "ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBCHF/UMtJqPFrf6f6GRY0ZFnkCW7b6sYgUTjTtNfRj1RdmNic1NoJZql7y6BrqQinZvy7nsr1UFDNWoHn6ah3tg= open-ssh-ca@cloudflareaccess.org";
}; };
# Send regular backups and litestream for DBs to an S3-like bucket
backup.s3 = { backup.s3 = {
endpoint = "s3.us-west-002.backblazeb2.com"; endpoint = "s3.us-west-002.backblazeb2.com";
bucket = "noahmasur-backup"; bucket = "noahmasur-backup";

View File

@ -17,14 +17,25 @@ inputs.nixpkgs.lib.nixosSystem {
physical = true; physical = true;
networking.hostName = "tempest"; networking.hostName = "tempest";
# Not sure what's necessary but too afraid to remove anything
boot.initrd.availableKernelModules = boot.initrd.availableKernelModules =
[ "nvme" "xhci_pci" "ahci" "usb_storage" "usbhid" "sd_mod" ]; [ "nvme" "xhci_pci" "ahci" "usb_storage" "usbhid" "sd_mod" ];
# Graphics and VMs
boot.initrd.kernelModules = [ "amdgpu" ]; boot.initrd.kernelModules = [ "amdgpu" ];
boot.kernelModules = [ "kvm-amd" ]; boot.kernelModules = [ "kvm-amd" ];
services.xserver.videoDrivers = [ "amdgpu" ]; services.xserver.videoDrivers = [ "amdgpu" ];
# Required binary blobs to boot on this machine
hardware.enableRedistributableFirmware = true; hardware.enableRedistributableFirmware = true;
# Prioritize performance over efficiency
powerManagement.cpuFreqGovernor = "performance"; powerManagement.cpuFreqGovernor = "performance";
# Allow firmware updates
hardware.cpu.amd.updateMicrocode = true; hardware.cpu.amd.updateMicrocode = true;
# Helps reduce GPU fan noise under idle loads
hardware.fancontrol.enable = true; hardware.fancontrol.enable = true;
hardware.fancontrol.config = '' hardware.fancontrol.config = ''
# Configuration file generated by pwmconfig, changes will be lost # Configuration file generated by pwmconfig, changes will be lost
@ -41,22 +52,31 @@ inputs.nixpkgs.lib.nixosSystem {
MAXPWM=hwmon0/pwm1=240 MAXPWM=hwmon0/pwm1=240
''; '';
# File systems must be declared in order to boot
# This is the root filesystem containing NixOS
fileSystems."/" = { fileSystems."/" = {
device = "/dev/disk/by-label/nixos"; device = "/dev/disk/by-label/nixos";
fsType = "ext4"; fsType = "ext4";
}; };
# This is the boot filesystem for Grub
fileSystems."/boot" = { fileSystems."/boot" = {
device = "/dev/disk/by-label/boot"; device = "/dev/disk/by-label/boot";
fsType = "vfat"; fsType = "vfat";
}; };
# Must be prepared ahead # Secrets must be prepared ahead before deploying
# The SSH key will need to be added manually with: nix run .#loadkey
identityFile = "/home/${globals.user}/.ssh/id_ed25519"; identityFile = "/home/${globals.user}/.ssh/id_ed25519";
passwordHash = inputs.nixpkgs.lib.fileContents ../../misc/password.sha512; passwordHash = inputs.nixpkgs.lib.fileContents ../../misc/password.sha512;
# Theming # Theming
# Turn on all features related to desktop and graphical applications
gui.enable = true; gui.enable = true;
# Set the system-wide theme, also used for non-graphical programs
theme = { theme = {
colors = (import ../../colorscheme/gruvbox-dark).dark; colors = (import ../../colorscheme/gruvbox-dark).dark;
dark = true; dark = true;
@ -91,9 +111,12 @@ inputs.nixpkgs.lib.nixosSystem {
leagueoflegends.enable = true; leagueoflegends.enable = true;
ryujinx.enable = true; ryujinx.enable = true;
}; };
services.vmagent.enable = true;
# Services will require the identityFile to work
services.vmagent.enable = true; # Enables Prometheus metrics
services.openssh.enable = true; # Required for Cloudflare tunnel services.openssh.enable = true; # Required for Cloudflare tunnel
# Allows private remote access over the internet
cloudflareTunnel = { cloudflareTunnel = {
enable = true; enable = true;
id = "ac133a82-31fb-480c-942a-cdbcd4c58173"; id = "ac133a82-31fb-480c-942a-cdbcd4c58173";
@ -103,6 +126,8 @@ inputs.nixpkgs.lib.nixosSystem {
}; };
# Allows requests to force machine to wake up # Allows requests to force machine to wake up
# This network interface might change, needs to be set specifically for each machine.
# Or set usePredictableInterfaceNames = false
networking.interfaces.enp5s0.wakeOnLan.enable = true; networking.interfaces.enp5s0.wakeOnLan.enable = true;
} }