....
This commit is contained in:
Sebastian Moser
223
hosts/fusu.nix
223
hosts/fusu.nix
@@ -1,5 +1,5 @@
|
||||
|
||||
{ inputs, pkgs, ... }:
|
||||
{ inputs, pkgs, secretsDir, ... }:
|
||||
{
|
||||
imports = [
|
||||
../common/all.nix
|
||||
@@ -30,6 +30,8 @@
|
||||
#];
|
||||
|
||||
|
||||
|
||||
|
||||
boot.supportedFilesystems = [ "zfs" ];
|
||||
boot.zfs.package = pkgs.zfs_unstable;
|
||||
boot.zfs.forceImportRoot = false;
|
||||
@@ -89,6 +91,21 @@
|
||||
8080 # for mitm proxy
|
||||
5901 # vnc
|
||||
|
||||
5357 # wsdd
|
||||
8080 # for mitm proxy
|
||||
|
||||
49388
|
||||
49389
|
||||
49390
|
||||
49391
|
||||
49392
|
||||
49393
|
||||
];
|
||||
|
||||
networking.firewall.allowedUDPPorts = [
|
||||
3702 # wsdd
|
||||
67 # allow DHCP traffic
|
||||
53 # allow dns
|
||||
];
|
||||
|
||||
networking.networkmanager.enable = false; # Easiest to use and most distros use this by default.
|
||||
@@ -101,6 +118,11 @@
|
||||
environment.systemPackages = with pkgs; [
|
||||
ntfs3g
|
||||
virtiofsd
|
||||
bcache-tools
|
||||
su
|
||||
fuse3
|
||||
terraform
|
||||
usbutils
|
||||
];
|
||||
|
||||
nix.settings = {
|
||||
@@ -131,4 +153,203 @@
|
||||
nameservers = [ "1.1.1.1" "8.8.8.8" ];
|
||||
};
|
||||
|
||||
|
||||
############################ update ip service
|
||||
|
||||
systemd.services.update-ip =
|
||||
let
|
||||
update-ip = pkgs.writeShellApplication {
|
||||
name = "update-ip";
|
||||
|
||||
runtimeInputs = with pkgs; [ curl w3m ];
|
||||
|
||||
text = ''
|
||||
ip=$(curl my.ip.fi)
|
||||
curl "http://dynv6.com/api/update?hostname=${builtins.readFile "${secretsDir}/dns-name-two"}&ipv4=$ip&token=${builtins.readFile "${secretsDir}/dns-name-two-token"}"
|
||||
curl "https://dynamicdns.park-your-domain.com/update?host=home&domain=${builtins.readFile "${secretsDir}/dns-name"}&password=${builtins.readFile "${secretsDir}/dns-name-token"}&ip=$ip"
|
||||
|
||||
# https://www.namecheap.com/support/knowledgebase/article.aspx/29/11/how-to-dynamically-update-the-hosts-ip-with-an-https-request/
|
||||
'';
|
||||
};
|
||||
#curl "https://dynamicdns.park-your-domain.com/update?host=mc&domain=c2vi.dev&password=${builtins.readFile "${secretsDir}/dns-name-token"}&ip=$ip"
|
||||
in
|
||||
{
|
||||
enable = true;
|
||||
description = "dyndns ip updates";
|
||||
unitConfig = {
|
||||
Type = "simple";
|
||||
};
|
||||
serviceConfig = {
|
||||
Restart = "always";
|
||||
RestartSec = "500s";
|
||||
ExecStart = "${update-ip}/bin/update-ip";
|
||||
};
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
};
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
###################################### get oci ampere vm ####################################
|
||||
|
||||
systemd.services.oci-ampere =
|
||||
let
|
||||
oci-ampere = pkgs.writeShellApplication {
|
||||
name = "oci-ampere";
|
||||
|
||||
runtimeInputs = with pkgs; [ terraform ];
|
||||
|
||||
text = ''
|
||||
if [[ -f /home/me/here/oci-ampere-vm/not_gotten ]]
|
||||
then
|
||||
echo not gotten....................................
|
||||
pwd
|
||||
cd /home/me/here/oci-ampere-vm
|
||||
terraform apply -auto-approve && rm /home/me/here/oci-ampere-vm/not_gotten
|
||||
else
|
||||
echo gotten!!!!!!!!!!!!!!!!!!!!!
|
||||
fi
|
||||
'';
|
||||
};
|
||||
in
|
||||
{
|
||||
enable = false;
|
||||
description = "get a oci ampere vm";
|
||||
unitConfig = {
|
||||
Type = "simple";
|
||||
};
|
||||
serviceConfig = {
|
||||
Restart = "always";
|
||||
RestartSec = "500s";
|
||||
ExecStart = "${oci-ampere}/bin/oci-ampere";
|
||||
};
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
};
|
||||
|
||||
|
||||
################################ samba ######################################
|
||||
services.samba-wsdd.enable = true; # make shares visible for windows 10 clients
|
||||
|
||||
# needed see: [[samba problems]] in my obsidian vault
|
||||
users.users.files.group = "files";
|
||||
users.groups.files = {};
|
||||
|
||||
services.samba = {
|
||||
enable = true;
|
||||
securityType = "user";
|
||||
extraConfig = ''
|
||||
server role = standalone server
|
||||
map to guest = bad user
|
||||
usershare allow guests = yes
|
||||
hosts allow = 192.168.0.0/16
|
||||
hosts deny = 0.0.0.0
|
||||
workgroup = WORKGROUP
|
||||
security = user
|
||||
'';
|
||||
shares = {
|
||||
files = {
|
||||
"valid users" = "files";
|
||||
"comment" = "all my files";
|
||||
"path" = "/home/files/storage/files";
|
||||
"browsable" = "no";
|
||||
"read only" = "no";
|
||||
"guest ok" = "no";
|
||||
"force user" = "files";
|
||||
"force group" = "files";
|
||||
"force create mode" = "0777";
|
||||
# Papierkorb
|
||||
"vfs object" = "recycle";
|
||||
"recycle:repository" = "/home/files/storage/files/trash-files";
|
||||
"recycle:keeptree" = "Yes";
|
||||
"recycle:versions" = "Yes";
|
||||
"recycle:touch" = "Yes";
|
||||
"recycle:touch_mtime" = "Yes";
|
||||
"recycle:maxsize" = "80000";
|
||||
};
|
||||
lan = {
|
||||
"comment" = "gastordner";
|
||||
"path" = "/home/files/storage/lan";
|
||||
"read only" = "no";
|
||||
"guest ok" = "yes";
|
||||
"force user" = "files";
|
||||
"force group" = "files";
|
||||
"force create mode" = "0777";
|
||||
# Papierkorb
|
||||
"vfs object" = "recycle";
|
||||
"recycle:repository" = "/home/files/storage/files/trash-lan";
|
||||
"recycle:keeptree" = "No";
|
||||
"recycle:versions" = "Yes";
|
||||
"recycle:touch" = "Yes";
|
||||
"recycle:touch_mtime" = "Yes";
|
||||
"recycle:maxsize" = "8000";
|
||||
};
|
||||
mama = {
|
||||
"comment" = "Meine Dateien auf Mamas Laptop";
|
||||
"path" = "/home/files/storage/files/stuff/Mamas-Laptop";
|
||||
"browsable" = "no";
|
||||
"read only" = "no";
|
||||
"guest ok" = "no";
|
||||
"valid users" = "mamafiles";
|
||||
"force user" = "files";
|
||||
"force group" = "files";
|
||||
"force create mode" = "0777";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
############################## backup to onedrive ##################################
|
||||
# needs that
|
||||
programs.fuse.userAllowOther = true; # otherwise the root user has no acces to the mount
|
||||
|
||||
systemd.services.rclone-mount-backup = {
|
||||
enable = false;
|
||||
description = "Mount rclone backup folder";
|
||||
unitConfig = {
|
||||
Type = "simple";
|
||||
};
|
||||
serviceConfig = {
|
||||
ExecStart = "${pkgs.bash}/bin/bash -c 'export PATH=/run/wrappers/bin:$PATH; id; ${pkgs.rclone}/bin/rclone mount --allow-non-empty --allow-other --vfs-cache-max-size 2G --vfs-cache-mode full backup: /home/files/backup'";
|
||||
User = "files";
|
||||
Group = "files";
|
||||
};
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
};
|
||||
|
||||
services.borgbackup.jobs.files = {
|
||||
#user = "files";
|
||||
extraCreateArgs = "--verbose --list --filter=AMECbchfs --stats --checkpoint-interval 600";
|
||||
extraArgs = "--progress";
|
||||
paths = "/home/files/storage";
|
||||
doInit = false;
|
||||
repo = "/home/files/backup/dateien-backup-borg-repo";
|
||||
compression = "lzma,9";
|
||||
startAt = "weekly";
|
||||
user = "files";
|
||||
group = "files";
|
||||
postCreate = ''
|
||||
echo create done!!!!!
|
||||
'';
|
||||
extraPruneArgs = "--stats --list --save-space";
|
||||
patterns = [
|
||||
"- /home/files/storage/files/no-backup"
|
||||
];
|
||||
|
||||
encryption.mode = "repokey-blake2";
|
||||
encryption.passCommand = "cat /home/files/secrets/borg-passphrase";
|
||||
|
||||
environment.BORG_KEY_FILE = "/home/files/secrets/borg-key";
|
||||
|
||||
prune.keep = {
|
||||
#within = "1w"; # Keep all archives from the last day
|
||||
daily = 7;
|
||||
weekly = 7;
|
||||
monthly = -1; # Keep at least one archive for each month
|
||||
};
|
||||
|
||||
};
|
||||
|
||||
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user