mirror of
https://github.com/nmasur/dotfiles
synced 2024-11-09 23:22:57 +00:00
improve hosts documentation
This commit is contained in:
parent
f0e1fc740f
commit
5bc10bef87
@ -3,6 +3,7 @@
|
|||||||
|
|
||||||
# How to install:
|
# How to install:
|
||||||
# https://blog.korfuri.fr/posts/2022/08/nixos-on-an-oracle-free-tier-ampere-machine/
|
# https://blog.korfuri.fr/posts/2022/08/nixos-on-an-oracle-free-tier-ampere-machine/
|
||||||
|
# These days, probably use nixos-anywhere instead.
|
||||||
|
|
||||||
{ inputs, globals, overlays, ... }:
|
{ inputs, globals, overlays, ... }:
|
||||||
|
|
||||||
@ -21,32 +22,38 @@ inputs.nixpkgs.lib.nixosSystem {
|
|||||||
server = true;
|
server = true;
|
||||||
networking.hostName = "flame";
|
networking.hostName = "flame";
|
||||||
|
|
||||||
|
# Not sure what's necessary but too afraid to remove anything
|
||||||
imports = [ (inputs.nixpkgs + "/nixos/modules/profiles/qemu-guest.nix") ];
|
imports = [ (inputs.nixpkgs + "/nixos/modules/profiles/qemu-guest.nix") ];
|
||||||
boot.initrd.availableKernelModules = [ "xhci_pci" "virtio_pci" "usbhid" ];
|
boot.initrd.availableKernelModules = [ "xhci_pci" "virtio_pci" "usbhid" ];
|
||||||
|
|
||||||
|
# File systems must be declared in order to boot
|
||||||
|
|
||||||
|
# This is the root filesystem containing NixOS
|
||||||
|
# I forgot to set a clean label for it
|
||||||
fileSystems."/" = {
|
fileSystems."/" = {
|
||||||
device = "/dev/disk/by-uuid/e1b6bd50-306d-429a-9f45-78f57bc597c3";
|
device = "/dev/disk/by-uuid/e1b6bd50-306d-429a-9f45-78f57bc597c3";
|
||||||
fsType = "ext4";
|
fsType = "ext4";
|
||||||
};
|
};
|
||||||
|
|
||||||
|
# This is the boot filesystem for systemd-boot
|
||||||
fileSystems."/boot" = {
|
fileSystems."/boot" = {
|
||||||
device = "/dev/disk/by-uuid/D5CA-237A";
|
device = "/dev/disk/by-uuid/D5CA-237A";
|
||||||
fsType = "vfat";
|
fsType = "vfat";
|
||||||
};
|
};
|
||||||
|
|
||||||
# Theming
|
# Theming
|
||||||
gui.enable = false;
|
|
||||||
theme = { colors = (import ../../colorscheme/gruvbox).dark; };
|
|
||||||
|
|
||||||
# Disable passwords, only use SSH key
|
# Server doesn't require GUI
|
||||||
publicKey =
|
gui.enable = false;
|
||||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB+AbmjGEwITk5CK9y7+Rg27Fokgj9QEjgc9wST6MA3s";
|
|
||||||
|
# Still require colors for programs like Neovim, K9S
|
||||||
|
theme = { colors = (import ../../colorscheme/gruvbox).dark; };
|
||||||
|
|
||||||
# Programs and services
|
# Programs and services
|
||||||
cloudflare.enable = true; # Proxy traffic with Cloudflare
|
cloudflare.enable = true; # Proxy traffic with Cloudflare
|
||||||
dotfiles.enable = true; # Clone dotfiles
|
dotfiles.enable = true; # Clone dotfiles
|
||||||
neovim.enable = true;
|
neovim.enable = true;
|
||||||
|
giteaRunner.enable = true;
|
||||||
services.caddy.enable = true;
|
services.caddy.enable = true;
|
||||||
services.grafana.enable = true;
|
services.grafana.enable = true;
|
||||||
services.openssh.enable = true;
|
services.openssh.enable = true;
|
||||||
@ -55,6 +62,7 @@ inputs.nixpkgs.lib.nixosSystem {
|
|||||||
services.vaultwarden.enable = true;
|
services.vaultwarden.enable = true;
|
||||||
services.minecraft-server.enable = true; # Setup Minecraft server
|
services.minecraft-server.enable = true; # Setup Minecraft server
|
||||||
|
|
||||||
|
# Allows private remote access over the internet
|
||||||
cloudflareTunnel = {
|
cloudflareTunnel = {
|
||||||
enable = true;
|
enable = true;
|
||||||
id = "bd250ee1-ed2e-42d2-b627-039f1eb5a4d2";
|
id = "bd250ee1-ed2e-42d2-b627-039f1eb5a4d2";
|
||||||
@ -63,8 +71,6 @@ inputs.nixpkgs.lib.nixosSystem {
|
|||||||
"ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBK/6oyVqjFGX3Uvrc3VS8J9sphxzAnRzKC85xgkHfYgR3TK6qBGXzHrknEj21xeZrr3G2y1UsGzphWJd9ZfIcdA= open-ssh-ca@cloudflareaccess.org";
|
"ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBK/6oyVqjFGX3Uvrc3VS8J9sphxzAnRzKC85xgkHfYgR3TK6qBGXzHrknEj21xeZrr3G2y1UsGzphWJd9ZfIcdA= open-ssh-ca@cloudflareaccess.org";
|
||||||
};
|
};
|
||||||
|
|
||||||
giteaRunner.enable = true;
|
|
||||||
|
|
||||||
# Nextcloud backup config
|
# Nextcloud backup config
|
||||||
backup.s3 = {
|
backup.s3 = {
|
||||||
endpoint = "s3.us-west-002.backblazeb2.com";
|
endpoint = "s3.us-west-002.backblazeb2.com";
|
||||||
@ -72,8 +78,9 @@ inputs.nixpkgs.lib.nixosSystem {
|
|||||||
accessKeyId = "0026b0e73b2e2c80000000005";
|
accessKeyId = "0026b0e73b2e2c80000000005";
|
||||||
};
|
};
|
||||||
|
|
||||||
# # Grant access to Jellyfin directories from Nextcloud
|
# Disable passwords, only use SSH key
|
||||||
# users.users.nextcloud.extraGroups = [ "jellyfin" ];
|
publicKey =
|
||||||
|
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB+AbmjGEwITk5CK9y7+Rg27Fokgj9QEjgc9wST6MA3s";
|
||||||
|
|
||||||
# # Wireguard config for Transmission
|
# # Wireguard config for Transmission
|
||||||
# wireguard.enable = true;
|
# wireguard.enable = true;
|
||||||
@ -104,9 +111,6 @@ inputs.nixpkgs.lib.nixosSystem {
|
|||||||
# # VPN port forwarding
|
# # VPN port forwarding
|
||||||
# services.transmission.settings.peer-port = 57599;
|
# services.transmission.settings.peer-port = 57599;
|
||||||
|
|
||||||
# # Grant access to Transmission directories from Jellyfin
|
|
||||||
# users.users.jellyfin.extraGroups = [ "transmission" ];
|
|
||||||
|
|
||||||
}
|
}
|
||||||
];
|
];
|
||||||
}
|
}
|
||||||
|
@ -13,11 +13,14 @@ inputs.nixpkgs.lib.nixosSystem {
|
|||||||
../../modules/common
|
../../modules/common
|
||||||
../../modules/nixos
|
../../modules/nixos
|
||||||
{
|
{
|
||||||
|
nixpkgs.overlays = overlays;
|
||||||
|
|
||||||
# Hardware
|
# Hardware
|
||||||
server = true;
|
server = true;
|
||||||
physical = true;
|
physical = true;
|
||||||
networking.hostName = "swan";
|
networking.hostName = "swan";
|
||||||
|
|
||||||
|
# Not sure what's necessary but too afraid to remove anything
|
||||||
boot.initrd.availableKernelModules =
|
boot.initrd.availableKernelModules =
|
||||||
[ "xhci_pci" "ahci" "nvme" "usb_storage" "sd_mod" ];
|
[ "xhci_pci" "ahci" "nvme" "usb_storage" "sd_mod" ];
|
||||||
|
|
||||||
@ -30,29 +33,43 @@ inputs.nixpkgs.lib.nixosSystem {
|
|||||||
"amdgpu.cik_support=1"
|
"amdgpu.cik_support=1"
|
||||||
"amdgpu.dc=1"
|
"amdgpu.dc=1"
|
||||||
];
|
];
|
||||||
|
|
||||||
|
# Required binary blobs to boot on this machine
|
||||||
hardware.enableRedistributableFirmware = true;
|
hardware.enableRedistributableFirmware = true;
|
||||||
|
|
||||||
|
# Prioritize efficiency over performance
|
||||||
powerManagement.cpuFreqGovernor = "powersave";
|
powerManagement.cpuFreqGovernor = "powersave";
|
||||||
|
|
||||||
|
# Allow firmware updates
|
||||||
hardware.cpu.intel.updateMicrocode = true;
|
hardware.cpu.intel.updateMicrocode = true;
|
||||||
|
|
||||||
# ZFS
|
# ZFS
|
||||||
zfs.enable = true;
|
zfs.enable = true;
|
||||||
# Generated with: head -c 8 /etc/machine-id
|
# Generated with: head -c 8 /etc/machine-id
|
||||||
networking.hostId = "600279f4"; # Random ID required for ZFS
|
networking.hostId = "600279f4"; # Random ID required for ZFS
|
||||||
|
|
||||||
|
# Sets root ext4 filesystem instead of declaring it manually
|
||||||
disko = {
|
disko = {
|
||||||
enableConfig = true;
|
enableConfig = true;
|
||||||
devices = (import ../../disks/root.nix { disk = "/dev/nvme0n1"; });
|
devices = (import ../../disks/root.nix { disk = "/dev/nvme0n1"; });
|
||||||
};
|
};
|
||||||
|
|
||||||
|
# Automatically load the ZFS pool on boot
|
||||||
boot.zfs.extraPools = [ "tank" ];
|
boot.zfs.extraPools = [ "tank" ];
|
||||||
|
|
||||||
|
# Theming
|
||||||
|
|
||||||
|
# Server doesn't require GUI
|
||||||
gui.enable = false;
|
gui.enable = false;
|
||||||
|
|
||||||
|
# Still require colors for programs like Neovim, K9S
|
||||||
theme = { colors = (import ../../colorscheme/gruvbox).dark; };
|
theme = { colors = (import ../../colorscheme/gruvbox).dark; };
|
||||||
nixpkgs.overlays = overlays;
|
|
||||||
|
# Programs and services
|
||||||
neovim.enable = true;
|
neovim.enable = true;
|
||||||
cloudflare.enable = true;
|
cloudflare.enable = true;
|
||||||
dotfiles.enable = true;
|
dotfiles.enable = true;
|
||||||
arrs.enable = true;
|
arrs.enable = true;
|
||||||
|
|
||||||
services.bind.enable = true;
|
services.bind.enable = true;
|
||||||
services.caddy.enable = true;
|
services.caddy.enable = true;
|
||||||
services.jellyfin.enable = true;
|
services.jellyfin.enable = true;
|
||||||
@ -63,6 +80,7 @@ inputs.nixpkgs.lib.nixosSystem {
|
|||||||
services.vmagent.enable = true;
|
services.vmagent.enable = true;
|
||||||
services.samba.enable = true;
|
services.samba.enable = true;
|
||||||
|
|
||||||
|
# Allows private remote access over the internet
|
||||||
cloudflareTunnel = {
|
cloudflareTunnel = {
|
||||||
enable = true;
|
enable = true;
|
||||||
id = "646754ac-2149-4a58-b51a-e1d0a1f3ade2";
|
id = "646754ac-2149-4a58-b51a-e1d0a1f3ade2";
|
||||||
@ -71,6 +89,7 @@ inputs.nixpkgs.lib.nixosSystem {
|
|||||||
"ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBCHF/UMtJqPFrf6f6GRY0ZFnkCW7b6sYgUTjTtNfRj1RdmNic1NoJZql7y6BrqQinZvy7nsr1UFDNWoHn6ah3tg= open-ssh-ca@cloudflareaccess.org";
|
"ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBCHF/UMtJqPFrf6f6GRY0ZFnkCW7b6sYgUTjTtNfRj1RdmNic1NoJZql7y6BrqQinZvy7nsr1UFDNWoHn6ah3tg= open-ssh-ca@cloudflareaccess.org";
|
||||||
};
|
};
|
||||||
|
|
||||||
|
# Send regular backups and litestream for DBs to an S3-like bucket
|
||||||
backup.s3 = {
|
backup.s3 = {
|
||||||
endpoint = "s3.us-west-002.backblazeb2.com";
|
endpoint = "s3.us-west-002.backblazeb2.com";
|
||||||
bucket = "noahmasur-backup";
|
bucket = "noahmasur-backup";
|
||||||
|
@ -17,14 +17,25 @@ inputs.nixpkgs.lib.nixosSystem {
|
|||||||
physical = true;
|
physical = true;
|
||||||
networking.hostName = "tempest";
|
networking.hostName = "tempest";
|
||||||
|
|
||||||
|
# Not sure what's necessary but too afraid to remove anything
|
||||||
boot.initrd.availableKernelModules =
|
boot.initrd.availableKernelModules =
|
||||||
[ "nvme" "xhci_pci" "ahci" "usb_storage" "usbhid" "sd_mod" ];
|
[ "nvme" "xhci_pci" "ahci" "usb_storage" "usbhid" "sd_mod" ];
|
||||||
|
|
||||||
|
# Graphics and VMs
|
||||||
boot.initrd.kernelModules = [ "amdgpu" ];
|
boot.initrd.kernelModules = [ "amdgpu" ];
|
||||||
boot.kernelModules = [ "kvm-amd" ];
|
boot.kernelModules = [ "kvm-amd" ];
|
||||||
services.xserver.videoDrivers = [ "amdgpu" ];
|
services.xserver.videoDrivers = [ "amdgpu" ];
|
||||||
|
|
||||||
|
# Required binary blobs to boot on this machine
|
||||||
hardware.enableRedistributableFirmware = true;
|
hardware.enableRedistributableFirmware = true;
|
||||||
|
|
||||||
|
# Prioritize performance over efficiency
|
||||||
powerManagement.cpuFreqGovernor = "performance";
|
powerManagement.cpuFreqGovernor = "performance";
|
||||||
|
|
||||||
|
# Allow firmware updates
|
||||||
hardware.cpu.amd.updateMicrocode = true;
|
hardware.cpu.amd.updateMicrocode = true;
|
||||||
|
|
||||||
|
# Helps reduce GPU fan noise under idle loads
|
||||||
hardware.fancontrol.enable = true;
|
hardware.fancontrol.enable = true;
|
||||||
hardware.fancontrol.config = ''
|
hardware.fancontrol.config = ''
|
||||||
# Configuration file generated by pwmconfig, changes will be lost
|
# Configuration file generated by pwmconfig, changes will be lost
|
||||||
@ -41,22 +52,31 @@ inputs.nixpkgs.lib.nixosSystem {
|
|||||||
MAXPWM=hwmon0/pwm1=240
|
MAXPWM=hwmon0/pwm1=240
|
||||||
'';
|
'';
|
||||||
|
|
||||||
|
# File systems must be declared in order to boot
|
||||||
|
|
||||||
|
# This is the root filesystem containing NixOS
|
||||||
fileSystems."/" = {
|
fileSystems."/" = {
|
||||||
device = "/dev/disk/by-label/nixos";
|
device = "/dev/disk/by-label/nixos";
|
||||||
fsType = "ext4";
|
fsType = "ext4";
|
||||||
};
|
};
|
||||||
|
|
||||||
|
# This is the boot filesystem for Grub
|
||||||
fileSystems."/boot" = {
|
fileSystems."/boot" = {
|
||||||
device = "/dev/disk/by-label/boot";
|
device = "/dev/disk/by-label/boot";
|
||||||
fsType = "vfat";
|
fsType = "vfat";
|
||||||
};
|
};
|
||||||
|
|
||||||
# Must be prepared ahead
|
# Secrets must be prepared ahead before deploying
|
||||||
|
# The SSH key will need to be added manually with: nix run .#loadkey
|
||||||
identityFile = "/home/${globals.user}/.ssh/id_ed25519";
|
identityFile = "/home/${globals.user}/.ssh/id_ed25519";
|
||||||
passwordHash = inputs.nixpkgs.lib.fileContents ../../misc/password.sha512;
|
passwordHash = inputs.nixpkgs.lib.fileContents ../../misc/password.sha512;
|
||||||
|
|
||||||
# Theming
|
# Theming
|
||||||
|
|
||||||
|
# Turn on all features related to desktop and graphical applications
|
||||||
gui.enable = true;
|
gui.enable = true;
|
||||||
|
|
||||||
|
# Set the system-wide theme, also used for non-graphical programs
|
||||||
theme = {
|
theme = {
|
||||||
colors = (import ../../colorscheme/gruvbox-dark).dark;
|
colors = (import ../../colorscheme/gruvbox-dark).dark;
|
||||||
dark = true;
|
dark = true;
|
||||||
@ -91,9 +111,12 @@ inputs.nixpkgs.lib.nixosSystem {
|
|||||||
leagueoflegends.enable = true;
|
leagueoflegends.enable = true;
|
||||||
ryujinx.enable = true;
|
ryujinx.enable = true;
|
||||||
};
|
};
|
||||||
services.vmagent.enable = true;
|
|
||||||
|
|
||||||
|
# Services will require the identityFile to work
|
||||||
|
services.vmagent.enable = true; # Enables Prometheus metrics
|
||||||
services.openssh.enable = true; # Required for Cloudflare tunnel
|
services.openssh.enable = true; # Required for Cloudflare tunnel
|
||||||
|
|
||||||
|
# Allows private remote access over the internet
|
||||||
cloudflareTunnel = {
|
cloudflareTunnel = {
|
||||||
enable = true;
|
enable = true;
|
||||||
id = "ac133a82-31fb-480c-942a-cdbcd4c58173";
|
id = "ac133a82-31fb-480c-942a-cdbcd4c58173";
|
||||||
@ -103,6 +126,8 @@ inputs.nixpkgs.lib.nixosSystem {
|
|||||||
};
|
};
|
||||||
|
|
||||||
# Allows requests to force machine to wake up
|
# Allows requests to force machine to wake up
|
||||||
|
# This network interface might change, needs to be set specifically for each machine.
|
||||||
|
# Or set usePredictableInterfaceNames = false
|
||||||
networking.interfaces.enp5s0.wakeOnLan.enable = true;
|
networking.interfaces.enp5s0.wakeOnLan.enable = true;
|
||||||
|
|
||||||
}
|
}
|
||||||
|
Loading…
Reference in New Issue
Block a user