vps-arm-2024-08-30-18-52-45
This commit is contained in:
Alexander Szczepanski
190
machine/vps-arm/configuration.nix
Executable file
190
machine/vps-arm/configuration.nix
Executable file
@ -0,0 +1,190 @@
|
||||
{ config, lib, pkgs, outputs, inputs, ... }:
|
||||
let
|
||||
secrets = import ../../configs/secrets.nix;
|
||||
be = import ../../configs/borg-exclude.nix;
|
||||
in
|
||||
{
|
||||
nixpkgs = {
|
||||
overlays = [
|
||||
outputs.overlays.additions
|
||||
outputs.overlays.modifications
|
||||
outputs.overlays.unstable-packages
|
||||
];
|
||||
config = {
|
||||
allowUnfree = true;
|
||||
};
|
||||
};
|
||||
|
||||
imports = [
|
||||
./hardware-configuration.nix
|
||||
../../configs/common.nix
|
||||
../../configs/docker.nix
|
||||
../../configs/user.nix
|
||||
|
||||
../../services/adguardhome.nix
|
||||
../../services/frigate.nix
|
||||
../../services/gitea.nix
|
||||
../../services/nextcloud.nix
|
||||
../../services/rustdesk-server.nix
|
||||
../../services/uptime-kuma.nix
|
||||
../../services/headscale.nix
|
||||
../../services/goaccess.nix
|
||||
];
|
||||
|
||||
boot.loader = {
|
||||
systemd-boot.enable = true;
|
||||
efi.canTouchEfiVariables = true;
|
||||
};
|
||||
|
||||
time.timeZone = "Europe/Berlin";
|
||||
|
||||
networking = {
|
||||
hostName = "vps-arm"; # Define your hostname.
|
||||
nftables.enable = true;
|
||||
useDHCP = false;
|
||||
defaultGateway6 = {
|
||||
address = "fe80::1";
|
||||
interface = "enp7s0";
|
||||
};
|
||||
interfaces.enp7s0 = {
|
||||
useDHCP = true;
|
||||
ipv6.addresses = [{
|
||||
address = "2a0a:4cc0:1:124c::1";
|
||||
prefixLength = 64;
|
||||
}];
|
||||
};
|
||||
firewall = {
|
||||
allowPing = true;
|
||||
allowedTCPPorts = [
|
||||
53 # adguardhome DNS
|
||||
80 # nginxs
|
||||
443 # nginx
|
||||
853 # adguardhome DoT
|
||||
];
|
||||
allowedUDPPorts = [
|
||||
53 # adguardhome
|
||||
80 # nginx
|
||||
443 # nginx
|
||||
853 # adguardhome DoT
|
||||
3478 # headscale
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
environment.systemPackages = with pkgs; [
|
||||
goaccess
|
||||
xd
|
||||
nyx
|
||||
headscale
|
||||
];
|
||||
|
||||
programs = {
|
||||
mtr.enable = true;
|
||||
fuse.userAllowOther = true;
|
||||
};
|
||||
|
||||
security.acme = {
|
||||
defaults.email = "webmaster@szczepan.ski";
|
||||
acceptTerms = true;
|
||||
};
|
||||
|
||||
services = {
|
||||
dnscrypt-proxy2.enable = lib.mkForce false;
|
||||
|
||||
nginx = {
|
||||
enable = true;
|
||||
|
||||
recommendedGzipSettings = true;
|
||||
recommendedOptimisation = true;
|
||||
recommendedProxySettings = true;
|
||||
recommendedTlsSettings = true;
|
||||
clientMaxBodySize = "0";
|
||||
|
||||
commonHttpConfig = ''
|
||||
log_format main '$host $remote_addr - $remote_user [$time_local] $upstream_cache_status "$request" '
|
||||
'$status $body_bytes_sent "$http_referer" '
|
||||
'"$http_user_agent" "$http_x_forwarded_for" "$gzip_ratio" '
|
||||
'$request_time $upstream_response_time $pipe';
|
||||
access_log /var/log/nginx/access.log main;
|
||||
'';
|
||||
|
||||
virtualHosts = {
|
||||
"szczepan.ski" = {
|
||||
forceSSL = true;
|
||||
enableACME = true;
|
||||
globalRedirect = "alexander.szczepan.ski";
|
||||
};
|
||||
"alexander.szczepan.ski" = {
|
||||
forceSSL = true;
|
||||
enableACME = true;
|
||||
root = "/var/www/alexander.szczepan.ski";
|
||||
locations = {
|
||||
"/" = {
|
||||
tryFiles = "$uri $uri.html $uri/ =404";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
"homeassistant.szczepan.ski" = {
|
||||
forceSSL = true;
|
||||
enableACME = true;
|
||||
locations = {
|
||||
"/" = {
|
||||
proxyPass = "http://mini.main.szczepan.ski:8123/";
|
||||
proxyWebsockets = true;
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
};
|
||||
};
|
||||
|
||||
tailscale = {
|
||||
enable = true;
|
||||
useRoutingFeatures = "both";
|
||||
openFirewall = true;
|
||||
};
|
||||
|
||||
fail2ban = {
|
||||
enable = true;
|
||||
bantime = "7d";
|
||||
|
||||
jails = {
|
||||
sshd = {
|
||||
settings = {
|
||||
filter = "sshd";
|
||||
maxretry = 4;
|
||||
action = ''iptables[name=ssh, port=ssh, protocol=tcp]'';
|
||||
enabled = true;
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
borgbackup.jobs.home = rec {
|
||||
compression = "auto,zstd";
|
||||
encryption = {
|
||||
mode = "repokey-blake2";
|
||||
passphrase = secrets.borg-key;
|
||||
};
|
||||
extraCreateArgs =
|
||||
"--stats --verbose --checkpoint-interval 600 --exclude-caches";
|
||||
environment.BORG_RSH = "ssh -i /home/alex/.ssh/id_borg_rsa";
|
||||
paths = [ "/home/alex" "/var/lib" ];
|
||||
repo = secrets.borg-repo;
|
||||
startAt = "daily";
|
||||
prune.keep = {
|
||||
daily = 4;
|
||||
weekly = 2;
|
||||
monthly = 2;
|
||||
};
|
||||
extraPruneArgs = "--save-space --stats";
|
||||
exclude = [
|
||||
"/home/alex/mounted"
|
||||
"/home/alex/.cache"
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
system.stateVersion = "24.05";
|
||||
}
|
||||
37
machine/vps-arm/hardware-configuration.nix
Normal file
37
machine/vps-arm/hardware-configuration.nix
Normal file
@ -0,0 +1,37 @@
|
||||
# Do not modify this file! It was generated by ‘nixos-generate-config’
|
||||
# and may be overwritten by future invocations. Please make changes
|
||||
# to /etc/nixos/configuration.nix instead.
|
||||
{ config, lib, pkgs, modulesPath, ... }:
|
||||
|
||||
{
|
||||
imports =
|
||||
[ (modulesPath + "/profiles/qemu-guest.nix")
|
||||
];
|
||||
|
||||
boot.initrd.availableKernelModules = [ "xhci_pci" "virtio_scsi" "sr_mod" ];
|
||||
boot.initrd.kernelModules = [ ];
|
||||
boot.kernelModules = [ ];
|
||||
boot.extraModulePackages = [ ];
|
||||
|
||||
fileSystems."/" =
|
||||
{ device = "/dev/disk/by-uuid/332b05c2-56cc-4b0b-b906-54b6b87542cd";
|
||||
fsType = "ext4";
|
||||
};
|
||||
|
||||
fileSystems."/boot" =
|
||||
{ device = "/dev/disk/by-uuid/3D20-21CC";
|
||||
fsType = "vfat";
|
||||
options = [ "fmask=0022" "dmask=0022" ];
|
||||
};
|
||||
|
||||
swapDevices = [ ];
|
||||
|
||||
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
|
||||
# (the default) this is the recommended approach. When using systemd-networkd it's
|
||||
# still possible to use this option, but it's recommended to use it in conjunction
|
||||
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
|
||||
networking.useDHCP = lib.mkDefault true;
|
||||
# networking.interfaces.enp7s0.useDHCP = lib.mkDefault true;
|
||||
|
||||
nixpkgs.hostPlatform = lib.mkDefault "aarch64-linux";
|
||||
}
|
||||
Reference in New Issue
Block a user