340 lines
8.6 KiB
Nix
Executable File
340 lines
8.6 KiB
Nix
Executable File
{
|
|
config,
|
|
lib,
|
|
pkgs,
|
|
outputs,
|
|
inputs,
|
|
...
|
|
}: let
|
|
secrets = import ../../configs/secrets.nix;
|
|
be = import ../../configs/borg-exclude.nix;
|
|
in {
|
|
nixpkgs = {
|
|
overlays = [
|
|
outputs.overlays.additions
|
|
outputs.overlays.modifications
|
|
outputs.overlays.unstable-packages
|
|
];
|
|
config = {
|
|
allowUnfree = true;
|
|
};
|
|
};
|
|
|
|
imports = [
|
|
./hardware-configuration.nix
|
|
../../configs/common.nix
|
|
../../configs/docker.nix
|
|
../../configs/user.nix
|
|
|
|
../../services/adguardhome.nix
|
|
../../services/frigate.nix
|
|
../../services/gitea.nix
|
|
../../services/nextcloud.nix
|
|
# ../../services/rustdesk-server.nix
|
|
../../services/uptime-kuma.nix
|
|
../../services/headscale.nix
|
|
../../services/goaccess.nix
|
|
];
|
|
|
|
sops = {
|
|
defaultSopsFile = ../../secrets-vps-arm.yaml;
|
|
validateSopsFiles = true;
|
|
age = {
|
|
sshKeyPaths = ["/persist/etc/ssh/ssh_host_ed25519_key"];
|
|
keyFile = "/persist/var/lib/sops-nix/key.txt";
|
|
generateKey = true;
|
|
};
|
|
|
|
secrets = {
|
|
borg-key = {
|
|
owner = config.users.users.alex.name;
|
|
group = config.users.users.alex.group;
|
|
};
|
|
|
|
goaccess-htpasswd = {
|
|
owner = config.services.nginx.user;
|
|
group = config.services.nginx.group;
|
|
};
|
|
|
|
frigate-htpasswd = {
|
|
owner = config.services.nginx.user;
|
|
group = config.services.nginx.group;
|
|
};
|
|
|
|
nextcloud-password = {
|
|
owner = "nextcloud";
|
|
group = "nextcloud";
|
|
};
|
|
|
|
gitea-password = {
|
|
owner = config.services.gitea.user;
|
|
group = config.services.gitea.group;
|
|
};
|
|
|
|
hashedPassword = {
|
|
neededForUsers = true;
|
|
sopsFile = ../../secrets.yaml;
|
|
};
|
|
};
|
|
};
|
|
|
|
boot = {
|
|
loader = {
|
|
efi.canTouchEfiVariables = true;
|
|
grub = {
|
|
enable = true;
|
|
device = "nodev";
|
|
efiSupport = true;
|
|
enableCryptodisk = true;
|
|
};
|
|
};
|
|
|
|
kernelPackages = pkgs.linuxPackages_latest;
|
|
supportedFilesystems = ["btrfs"];
|
|
kernelParams = ["ip=dhcp"];
|
|
initrd = {
|
|
availableKernelModules = ["virtio-pci"];
|
|
systemd.users.root.shell = "/bin/cryptsetup-askpass";
|
|
network = {
|
|
enable = true;
|
|
ssh = {
|
|
enable = true;
|
|
port = 22;
|
|
authorizedKeys = [
|
|
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOYEaT0gH9yJM2Al0B+VGXdZB/b2qjZK7n01Weq0TcmQ alex@framework"
|
|
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIN99h5reZdz9+DOyTRh8bPYWO+Dtv7TbkLbMdvi+Beio alex@desktop"
|
|
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIkURF5v9vRyEPhsK80kUgYh1vsS0APL4XyH4F3Fpyic alex@macbook"
|
|
];
|
|
hostKeys = ["/persist/pre_boot_ssh_key"];
|
|
};
|
|
};
|
|
luks.devices = {
|
|
root = {
|
|
device = "/dev/disk/by-uuid/d17f6d8b-aec8-4c48-834d-f88d6308e281";
|
|
preLVM = true;
|
|
};
|
|
};
|
|
|
|
postDeviceCommands = pkgs.lib.mkBefore ''
|
|
mkdir -p /mnt
|
|
|
|
# We first mount the btrfs root to /mnt
|
|
# so we can manipulate btrfs subvolumes.
|
|
mount -o subvol=/ /dev/mapper/lvm-root /mnt
|
|
|
|
# While we're tempted to just delete /root and create
|
|
# a new snapshot from /root-blank, /root is already
|
|
# populated at this point with a number of subvolumes,
|
|
# which makes `btrfs subvolume delete` fail.
|
|
# So, we remove them first.
|
|
#
|
|
# /root contains subvolumes:
|
|
# - /root/var/lib/portables
|
|
# - /root/var/lib/machines
|
|
#
|
|
# I suspect these are related to systemd-nspawn, but
|
|
# since I don't use it I'm not 100% sure.
|
|
# Anyhow, deleting these subvolumes hasn't resulted
|
|
# in any issues so far, except for fairly
|
|
# benign-looking errors from systemd-tmpfiles.
|
|
btrfs subvolume list -o /mnt/root |
|
|
cut -f9 -d' ' |
|
|
while read subvolume; do
|
|
echo "deleting /$subvolume subvolume..."
|
|
btrfs subvolume delete "/mnt/$subvolume"
|
|
done &&
|
|
echo "deleting /root subvolume..." &&
|
|
btrfs subvolume delete /mnt/root
|
|
|
|
echo "restoring blank /root subvolume..."
|
|
btrfs subvolume snapshot /mnt/root-blank /mnt/root
|
|
|
|
# Once we're done rolling back to a blank snapshot,
|
|
# we can unmount /mnt and continue on the boot process.
|
|
umount /mnt
|
|
'';
|
|
};
|
|
};
|
|
|
|
time.timeZone = "Europe/Berlin";
|
|
|
|
networking = {
|
|
hostName = "vps-arm"; # Define your hostname.
|
|
nftables.enable = true;
|
|
useDHCP = false;
|
|
defaultGateway6 = {
|
|
address = "fe80::1";
|
|
interface = "enp7s0";
|
|
};
|
|
interfaces.enp7s0 = {
|
|
useDHCP = true;
|
|
ipv6.addresses = [
|
|
{
|
|
address = "2a0a:4cc0:1:124c::1";
|
|
prefixLength = 64;
|
|
}
|
|
];
|
|
};
|
|
firewall = {
|
|
allowPing = true;
|
|
allowedTCPPorts = [
|
|
53 # adguardhome DNS
|
|
80 # nginxs
|
|
443 # nginx
|
|
853 # adguardhome DoT
|
|
];
|
|
allowedUDPPorts = [
|
|
53 # adguardhome
|
|
80 # nginx
|
|
443 # nginx
|
|
853 # adguardhome DoT
|
|
3478 # headscale
|
|
];
|
|
};
|
|
};
|
|
|
|
environment = {
|
|
systemPackages = with pkgs; [
|
|
goaccess
|
|
xd
|
|
nyx
|
|
headscale
|
|
];
|
|
persistence."/persist" = {
|
|
directories = [
|
|
"/var/lib/acme"
|
|
# "/var/lib/docker"
|
|
"/var/lib/fail2ban"
|
|
"/var/lib/frigate"
|
|
"/var/lib/gitea"
|
|
"/var/lib/headscale"
|
|
"/var/lib/nextcloud"
|
|
"/var/lib/nixos"
|
|
"/var/lib/postgresql"
|
|
"/var/lib/private"
|
|
"/var/lib/redis-nextcloud"
|
|
"/var/lib/tailscale"
|
|
"/var/lib/tuptime"
|
|
"/var/lib/vnstat"
|
|
"/var/www"
|
|
];
|
|
files = [
|
|
"/etc/machine-id"
|
|
"/etc/NIXOS"
|
|
"/etc/ssh/ssh_host_ed25519_key"
|
|
"/etc/ssh/ssh_host_ed25519_key.pub"
|
|
"/etc/ssh/ssh_host_rsa_key"
|
|
"/etc/ssh/ssh_host_rsa_key.pub"
|
|
];
|
|
};
|
|
};
|
|
|
|
programs = {
|
|
mtr.enable = true;
|
|
fuse.userAllowOther = true;
|
|
};
|
|
|
|
security.acme = {
|
|
defaults.email = "webmaster@szczepan.ski";
|
|
acceptTerms = true;
|
|
};
|
|
|
|
services = {
|
|
dnscrypt-proxy2.enable = lib.mkForce false;
|
|
|
|
nginx = {
|
|
enable = true;
|
|
|
|
recommendedGzipSettings = true;
|
|
recommendedOptimisation = true;
|
|
recommendedProxySettings = true;
|
|
recommendedTlsSettings = true;
|
|
clientMaxBodySize = "0";
|
|
|
|
commonHttpConfig = ''
|
|
log_format main '$host $remote_addr - $remote_user [$time_local] $upstream_cache_status "$request" '
|
|
'$status $body_bytes_sent "$http_referer" '
|
|
'"$http_user_agent" "$http_x_forwarded_for" "$gzip_ratio" '
|
|
'$request_time $upstream_response_time $pipe';
|
|
access_log /var/log/nginx/access.log main;
|
|
'';
|
|
|
|
virtualHosts = {
|
|
"szczepan.ski" = {
|
|
forceSSL = true;
|
|
enableACME = true;
|
|
globalRedirect = "alexander.szczepan.ski";
|
|
};
|
|
"alexander.szczepan.ski" = {
|
|
forceSSL = true;
|
|
enableACME = true;
|
|
root = "/var/www/alexander.szczepan.ski";
|
|
locations = {
|
|
"/" = {
|
|
tryFiles = "$uri $uri.html $uri/ =404";
|
|
};
|
|
};
|
|
};
|
|
|
|
"homeassistant.szczepan.ski" = {
|
|
forceSSL = true;
|
|
enableACME = true;
|
|
locations = {
|
|
"/" = {
|
|
proxyPass = "http://mini.main.szczepan.ski:8123/";
|
|
proxyWebsockets = true;
|
|
};
|
|
};
|
|
};
|
|
};
|
|
};
|
|
|
|
tailscale = {
|
|
enable = true;
|
|
useRoutingFeatures = "both";
|
|
openFirewall = true;
|
|
};
|
|
|
|
fail2ban = {
|
|
enable = true;
|
|
bantime = "7d";
|
|
|
|
jails = {
|
|
sshd = {
|
|
settings = {
|
|
filter = "sshd";
|
|
maxretry = 4;
|
|
action = ''iptables[name=ssh, port=ssh, protocol=tcp]'';
|
|
enabled = true;
|
|
};
|
|
};
|
|
};
|
|
};
|
|
|
|
borgbackup.jobs.home = rec {
|
|
compression = "auto,zstd";
|
|
encryption = {
|
|
mode = "repokey-blake2";
|
|
passCommand = "cat ${config.sops.secrets.borg-key.path}";
|
|
};
|
|
extraCreateArgs = "--stats --verbose --checkpoint-interval 600 --exclude-caches";
|
|
environment.BORG_RSH = "ssh -i /home/alex/.ssh/id_borg_rsa";
|
|
paths = ["/home/alex" "/persist"];
|
|
repo = "ssh://u278697-sub3@u278697.your-storagebox.de:23/./borg-arm";
|
|
startAt = "daily";
|
|
prune.keep = {
|
|
daily = 4;
|
|
weekly = 2;
|
|
monthly = 2;
|
|
};
|
|
extraPruneArgs = "--save-space --stats";
|
|
exclude = [
|
|
"/home/alex/mounted"
|
|
"/home/alex/.cache"
|
|
];
|
|
};
|
|
};
|
|
|
|
system.stateVersion = "25.05";
|
|
}
|