BeiNacht/nixos-config
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

mini-2024-11-23-09-47-34

Browse Source
This commit is contained in:
Alexander Szczepanski
2024-11-23 09:47:34 +01:00
parent 585bd0df2a
commit 4b8e9eb89f
3 changed files with 186 additions and 56 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
flake.nix
View File

@ -105,6 +105,9 @@
system = "x86_64-linux";
specialArgs = {inherit inputs outputs;};
modules = [
inputs.nixos-hardware.nixosModules.common-cpu-intel
inputs.sops-nix.nixosModules.sops
impermanence.nixosModules.impermanence
./machine/mini/configuration.nix
];
};

151
machine/mini/configuration.nix
View File

@ -18,8 +18,6 @@
imports = [
./hardware-configuration.nix
inputs.nixos-hardware.nixosModules.common-cpu-intel
inputs.sops-nix.nixosModules.sops
../../configs/docker.nix
../../configs/common.nix
../../configs/user.nix
@ -59,7 +57,73 @@
efi.canTouchEfiVariables = true;
};
extraModulePackages = with pkgs.linuxPackages; [rtl88x2bu];
initrd = {
availableKernelModules = ["r8169"];
systemd.users.root.shell = "/bin/cryptsetup-askpass";
network = {
enable = true;
ssh = {
enable = true;
port = 22;
authorizedKeys = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOYEaT0gH9yJM2Al0B+VGXdZB/b2qjZK7n01Weq0TcmQ alex@framework"
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIN99h5reZdz9+DOyTRh8bPYWO+Dtv7TbkLbMdvi+Beio alex@desktop"
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIkURF5v9vRyEPhsK80kUgYh1vsS0APL4XyH4F3Fpyic alex@macbook"
];
hostKeys = ["/persist/pre_boot_ssh_key"];
};
};
luks.devices = {
root = {
device = "/dev/disk/by-uuid/9287df9c-ec3c-4cd8-af3a-d253f9418f7b";
preLVM = true;
};
};
postDeviceCommands = pkgs.lib.mkBefore ''
mkdir -p /mnt
# We first mount the btrfs root to /mnt
# so we can manipulate btrfs subvolumes.
mount -o subvol=/ /dev/mapper/lvm-root /mnt
# While we're tempted to just delete /root and create
# a new snapshot from /root-blank, /root is already
# populated at this point with a number of subvolumes,
# which makes `btrfs subvolume delete` fail.
# So, we remove them first.
#
# /root contains subvolumes:
# - /root/var/lib/portables
# - /root/var/lib/machines
#
# I suspect these are related to systemd-nspawn, but
# since I don't use it I'm not 100% sure.
# Anyhow, deleting these subvolumes hasn't resulted
# in any issues so far, except for fairly
# benign-looking errors from systemd-tmpfiles.
btrfs subvolume list -o /mnt/root |
cut -f9 -d' ' |
while read subvolume; do
echo "deleting /$subvolume subvolume..."
btrfs subvolume delete "/mnt/$subvolume"
done &&
echo "deleting /root subvolume..." &&
btrfs subvolume delete /mnt/root
echo "restoring blank /root subvolume..."
btrfs subvolume snapshot /mnt/root-blank /mnt/root
# Once we're done rolling back to a blank snapshot,
# we can unmount /mnt and continue on the boot process.
umount /mnt
'';
};
supportedFilesystems = ["btrfs"];
kernelPackages = pkgs.linuxPackages_latest;
extraModulePackages = with pkgs.linuxPackages_latest; [rtl88x2bu];
};
time.timeZone = "Europe/Berlin";
@ -69,13 +133,6 @@
firewall = {enable = false;};
interfaces = {
enp3s0.useDHCP = true;
# wlp0s20u1u1.useDHCP = true;
wlp0s20u1u2.ipv4.addresses = [
{
address = "192.168.12.1";
prefixLength = 24;
}
];
};
nftables.enable = true;
@ -109,11 +166,31 @@
# };
};
environment.systemPackages = with pkgs; [
environment = {
systemPackages = with pkgs; [
nyx
snapraid
mergerfs
];
persistence."/persist" = {
directories = [
# "/var/lib/docker"
"/var/lib/nixos"
"/var/lib/tor"
"/var/lib/tailscale"
"/var/lib/tuptime"
"/var/lib/vnstat"
];
files = [
"/etc/machine-id"
"/etc/NIXOS"
"/etc/ssh/ssh_host_ed25519_key"
"/etc/ssh/ssh_host_ed25519_key.pub"
"/etc/ssh/ssh_host_rsa_key"
"/etc/ssh/ssh_host_rsa_key.pub"
];
};
};
hardware = {
enableAllFirmware = true;
@ -214,49 +291,39 @@
extraUpFlags = "--advertise-exit-node --login-server=https://headscale.szczepan.ski";
};
samba = {
enable = true;
securityType = "user";
extraConfig = ''
workgroup = WORKGROUP
server string = server
netbios name = server
security = user
guest account = nobody
map to guest = bad user
logging = systemd
max log size = 50
'';
shares = {
storage = {
path = "/mnt/storage";
browseable = "yes";
"read only" = "no";
"guest ok" = "no";
"create mask" = "0644";
"directory mask" = "0755";
};
};
};
borgbackup.jobs.home = rec {
repo = "ssh://u278697-sub8@u278697.your-storagebox.de:23/./borg-backup-mini";
compression = "auto,zstd";
encryption = {
mode = "repokey-blake2";
passCommand = "cat ${config.sops.secrets.borg-key.path}";
};
extraCreateArgs = "--list --stats --verbose --checkpoint-interval 600 --exclude-caches";
environment.BORG_RSH = "ssh -o StrictHostKeyChecking=no -i /home/alex/.ssh/id_ed25519";
paths = ["/home/alex" "/var/lib"];
repo = "ssh://u278697-sub8@u278697.your-storagebox.de:23/./borg-backup-mini";
extraCreateArgs = "--stats --verbose --checkpoint-interval=600 --exclude-caches";
extraPruneArgs = [
"--save-space"
"--stats"
];
extraCompactArgs = [
"--cleanup-commits"
];
environment = {
BORG_RSH = "ssh -i /home/alex/.ssh/id_ed55129";
BORG_BASE_DIR = "/persist/borg";
};
readWritePaths = ["/persist/borg"];
paths = ["/home/alex" "/persist"];
startAt = "daily";
prune.keep = {
daily = 7;
weekly = 4;
monthly = 6;
};
extraPruneArgs = "--save-space --list --stats";
exclude = ["/home/alex/.cache"];
exclude = [
"/home/alex/mounted"
"/home/alex/.cache"
"/persist/borg"
];
};
};

80
machine/mini/hardware-configuration.nix
View File

@ -12,15 +12,78 @@
(modulesPath + "/installer/scan/not-detected.nix")
];
boot.initrd.availableKernelModules = ["ahci" "xhci_pci" "usbhid" "usb_storage" "sd_mod"];
boot.initrd.kernelModules = [];
boot.initrd.availableKernelModules = ["ahci" "xhci_pci" "usbhid" "usb_storage" "sd_mod" "sr_mod"];
boot.initrd.kernelModules = ["dm-snapshot"];
boot.kernelModules = ["kvm-intel"];
boot.extraModulePackages = [];
fileSystems = {
"/" = {
device = "/dev/disk/by-uuid/8be3b4e5-7219-4427-bba4-340f1dc4b868";
fsType = "ext4";
device = "/dev/disk/by-uuid/01449b4a-4863-47dd-b213-5aefd014cd2d";
fsType = "btrfs";
options = [
"subvol=root"
"discard=async"
"compress=zstd"
"nodiratime"
"noatime"
];
};
"/home" = {
device = "/dev/disk/by-uuid/01449b4a-4863-47dd-b213-5aefd014cd2d";
fsType = "btrfs";
options = [
"subvol=home"
"discard=async"
"compress=zstd"
"nodiratime"
"noatime"
];
};
"/nix" = {
device = "/dev/disk/by-uuid/01449b4a-4863-47dd-b213-5aefd014cd2d";
fsType = "btrfs";
options = [
"subvol=nix"
"discard=async"
"compress=zstd"
"nodiratime"
"noatime"
];
};
"/persist" = {
device = "/dev/disk/by-uuid/01449b4a-4863-47dd-b213-5aefd014cd2d";
fsType = "btrfs";
options = [
"subvol=persist"
"discard=async"
"compress=zstd"
"nodiratime"
"noatime"
];
neededForBoot = true;
};
"/var/log" = {
device = "/dev/disk/by-uuid/01449b4a-4863-47dd-b213-5aefd014cd2d";
fsType = "btrfs";
options = [
"subvol=log"
"discard=async"
"compress=zstd"
"nodiratime"
"noatime"
];
neededForBoot = true;
};
"/boot" = {
device = "/dev/disk/by-uuid/7222-8C3F";
fsType = "vfat";
options = ["fmask=0022" "dmask=0022"];
};
"/mnt/disk1" = {
@ -46,14 +109,11 @@
fsType = "ext4";
options = ["nofail" "x-systemd.automount"];
};
"/boot" = {
device = "/dev/disk/by-uuid/7C10-C8BD";
fsType = "vfat";
};
};
swapDevices = [{device = "/dev/disk/by-uuid/edb5324f-3cd2-4b8c-bb05-cca045adeaf6";}];
swapDevices = [
{device = "/dev/disk/by-uuid/e59a0c55-7859-40ad-bf55-345708a67816";}
];
hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
}