c2vi/dotfiles
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

has libvirtd in container in fusu-services.nix

Browse Source
This commit is contained in:
Sebastian Moser
2025-10-03 17:29:42 +02:00
parent 320570979e
commit d3f6e79b85
19 changed files with 827 additions and 256 deletions
Download Patch File Download Diff File Expand all files Collapse all files

60
hosts/fasu.nix
View File

@@ -6,22 +6,13 @@
../common/nixos.nix
../common/building.nix
inputs.disko.nixosModules.disko
inputs.home-manager.nixosModules.home-manager
../users/me/headless.nix
../users/root/default.nix
../users/server/headles.nix
];
fileSystems."/" = {
device = "/dev/disk/by-label/fasu-root";
fsType = "ext4";
};
fileSystems."/boot" = {
device = "/dev/disk/by-label/FASU-BOOT";
fsType = "vfat";
};
# allow acern to ssh into server
users.users.server.openssh.authorizedKeys.keys = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHTV1VoNAjMha5IP+qb8XABDo02pW3iN0yPBIbSqZA27 me@acern"
@@ -35,16 +26,6 @@
}
];
# Use the GRUB 2 boot loader.
boot.loader.grub = {
enable = true;
#device = "/dev/nbd1";
device = "nodev";
efiSupport = false;
extraConfig = ''
set timeout=2
'';
};
#fileSystems."/boot" = {
# device = "/dev/disk/by-label/fusu-boot";
@@ -124,4 +105,43 @@
};
};
############### disk config
boot.plymouth.enable = false;
boot.loader.grub.enable = true;
boot.loader.grub.efiSupport = false;
boot.loader.grub.efiInstallAsRemovable = false;
boot.loader.grub.devices = [ "nodev" ];
boot.loader.grub.extraConfig = ''
set timeout=2
'';
# the flash drive in use for fasu
disko.devices.disk.root.device = "/dev/nbd0";
disko.devices = {
disk = {
root = {
type = "disk";
content = {
type = "gpt";
partitions = {
biosboot = {
size = "2M";
type = "21686148-6449-6E6F-744E-656564454649"; # BIOS boot
};
root = {
size = "100%";
content = {
type = "filesystem";
format = "ext4";
mountpoint = "/";
};
};
};
};
};
};
};
}

5
hosts/fe.nix
View File

@@ -163,4 +163,9 @@
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
################################ services ############################
services.traefik = {
};
}

34
hosts/fusu.nix
View File

@@ -1,6 +1,7 @@
{ inputs, pkgs, secretsDir, ... }:
{
{ inputs, pkgs, secretsDir, config, system, ... }: let
in {
#disabledModules = [ "services/databases/couchdb.nix" ];
imports = [
@@ -14,6 +15,9 @@
../users/root/default.nix
../users/files/headless.nix
../users/server/headless.nix
inputs.arion.nixosModules.arion
../mods/fusu-services.nix
];
# mac address for wakeonlan: 00:19:99:fd:28:23
@@ -37,12 +41,19 @@
services.tailscale.enable = true;
services.resilio = {
# TODO: add the config for the share to here
enable = true;
enableWebUI = true;
httpListenAddr = "100.70.54.18";
checkForUpdates = false;
listeningPort = 44444;
};
networking.firewall.interfaces."tailscale0".allowedTCPPorts = [
44444 # resilio sync
9000 # resilio webui
];
boot.supportedFilesystems = [ "zfs" ];
@@ -55,15 +66,6 @@
fsType = "zfs";
};
virtualisation.libvirtd = {
enable = true;
qemuOvmf = true;
qemuSwtpm = true;
#qemuOvmfPackage = pkgs.OVMFFull;
};
virtualisation.docker.enable = true;
users.users.server.extraGroups = [ "docker" ];
# Use the GRUB 2 boot loader.
boot.loader.grub = {
enable = true;
@@ -98,12 +100,6 @@
networking.firewall.allowPing = true;
networking.firewall.enable = true;
networking.firewall.interfaces."tailscale0".allowedTCPPorts = [
443 # couchdb for obsidian live sync https
44444 # resilio sync
9000 # resilio webui
];
services.samba.openFirewall = true;
networking.firewall.allowedTCPPorts = [
@@ -154,6 +150,8 @@
fuse3
terraform
usbutils
qemu_full
libvirt
];
nix.settings = {

107
hosts/ki.nix
View File

@@ -1,13 +1,5 @@
{ lib, secretsDir, pkgs, inputs, unstable, ... }: let
myobs = pkgs.wrapOBS {
plugins = with pkgs.obs-studio-plugins; [
obs-ndi
obs-teleport
];
};
in {
imports = [
@@ -25,7 +17,9 @@ in {
services.tailscale.enable = true;
programs.nix-ld.enable = true;
networking.hostName = "mac";
services.keyd.enable = lib.mkForce false;
networking.hostName = "ki";
networking.firewall.enable = false;
services.avahi = {
enable = true;
@@ -60,6 +54,22 @@ in {
4410 # lan-mouse
];
services.resilio = {
enable = true;
enableWebUI = true;
httpListenAddr = "100.96.201.42";
checkForUpdates = false;
listeningPort = 44444;
};
users.users.me.extraGroups = [ "rslsync" ];
users.users.rslsync.extraGroups = [ "users" ];
users.users.me.homeMode = "770"; # important for resilio
networking.firewall.interfaces."tailscale0".allowedTCPPorts = [
44444 # resilio sync
9000 # resilio webui
];
swapDevices = [ { device = "/swapfile"; } ];
boot.kernelModules = [ "usbip_core" ];
@@ -70,6 +80,10 @@ in {
"aarch64-linux"
];
home-manager.users.me.home.file.".config/sway/config".text = ''
exec ${pkgs.wayvnc}/bin/wayvnc 0.0.0.0 6666
'';
virtualisation.libvirtd = {
enable = true;
qemuOvmf = true;
@@ -102,68 +116,16 @@ in {
'';
};
services.greetd = lib.mkForce {
enable = true;
settings = rec {
terminal.vt = 1;
initial_session = let
newerUnstableSrc = builtins.getFlake "nixpkgs/d0fc30899600b9b3466ddb260fd83deb486c32f1";
newerUnstable = import newerUnstableSrc.outPath {};
mySway = newerUnstable.sway.override {
sway-unwrapped = (newerUnstable.sway-unwrapped.overrideAttrs (prev: {
/*
src = pkgs.fetchFromGitHub {
owner = "WillPower3309";
repo = "swayfx";
rev = "";
hash = "";
};
*/
src = pkgs.fetchFromGitHub {
owner = "swaywm";
repo = "sway";
rev = "73c244fb4807a29c6599d42c15e8a8759225b2d6";
hash = "sha256-P2w1oRVUNBWajt8jZOxPXvBE29urbrhtORy+lfYqnF8=";
};
})).override {
wlroots = newerUnstable.wlroots.overrideAttrs (prev: {
version = "master";
src = pkgs.fetchFromGitLab {
domain = "gitlab.freedesktop.org";
owner = "wlroots";
repo = "wlroots";
rev = "master";
sha256 = "sha256-2FK6FGRpgf/YYqwJST0LVA/pnNRSUDrfrrp6mSwA0Fk=";
};
});
};
};
in {
#command = "${pkgs.greetd.tuigreet}/bin/tuigreet --time -d --env WLR_RENDERER_ALLOW_SOFTWARE=1 --cmd sway";
command = "${pkgs.greetd.tuigreet}/bin/tuigreet --time --cmd ${pkgs.writeScriptBin "run-sway" ''
export WLR_RENDERER_ALLOW_SOFTWARE=1
export SDL_VIDEODRIVER=wayland
export _JAVA_AWT_WM_NONREPARENTING=1
export QT_QPA_PLATFORM=wayland
export XDG_CURRENT_DESKTOP=sway
export XDG_SESSION_DESKTOP=sway
exec ${pkgs.lib.getExe mySway}
''}/bin/run-sway";
user = "me";
};
default_session = initial_session;
};
};
systemd.extraConfig = "DefaultLimitNOFILE=2048";
###################################################### the kiosk stuff
services.logind = {
extraConfig = ''
HandlePowerKey=suspend-then-hibernate
'';
lidSwitch = "ignore";
lidSwitchExternalPower = "ignore";
lidSwitchDocked = "ignore";
};
services.dbus.enable = true;
@@ -218,7 +180,7 @@ in {
};
wifi = {
mode = "ap";
ssid = "c2vi-mac";
ssid = "c2vi-ki";
};
wifi-security = {
@@ -297,6 +259,11 @@ in {
type = "gpt";
partitions = {
biosboot = {
size = "2M";
type = "21686148-6449-6E6F-744E-656564454649"; # BIOS boot
};
ESP = {
size = "1G";
type = "EF00";

31
hosts/le.nix
View File

@@ -124,7 +124,7 @@
3240 # usbip
];
networking.hostName = "lush";
networking.hostName = "le";
networking.networkmanager.enable = true;
@@ -136,7 +136,7 @@
type = "wifi";
interface-name = "wlan0";
autoconnect = true;
autoconnect-priority = "-200";
autoconnect-priority = "400";
};
wifi = {
@@ -156,6 +156,29 @@
};
};
hot = {
connection = {
id = "hot";
uuid = "ab51de8a-9742-465a-928b-be54a83ab6a3";
type = "wifi";
interface-name = "wlp3s0";
autoconnect-priority = "200";
};
wifi = {
mode = "ap";
ssid = "c2vi-le";
};
wifi-security = {
key-mgmt = "wpa-psk";
psk = builtins.readFile "${secretsDir}/wifi-password";
};
ipv4 = {
method = "shared";
};
};
hh40 = {
connection = {
id = "hh40";
@@ -163,7 +186,7 @@
type = "wifi";
interface-name = "wlan0";
autoconnect = true;
autoconnect-priority = "-999";
autoconnect-priority = "300";
};
wifi = {
@@ -188,7 +211,7 @@
id = "dhcp";
uuid = "c006389a-1697-4f77-91c3-95b466f85f13";
type = "ethernet";
autoconnect = "true";
autoconnect = true;
interface-name = "end0";
};

9
hosts/mac.nix
View File

@@ -24,6 +24,8 @@ in {
services.tailscale.enable = true;
programs.nix-ld.enable = true;
services.pid-fan-controller.enable = true;
networking.hostName = "mac";
networking.firewall.enable = false;
services.avahi = {
@@ -88,6 +90,7 @@ in {
};
environment.systemPackages = with pkgs; [
lm_sensors
linuxPackages.usbip
helvum
passt
@@ -216,7 +219,7 @@ in {
in {
#command = "${pkgs.greetd.tuigreet}/bin/tuigreet --time -d --env WLR_RENDERER_ALLOW_SOFTWARE=1 --cmd sway";
command = "${pkgs.greetd.tuigreet}/bin/tuigreet --time --cmd ${pkgs.writeScriptBin "run-sway" ''
command = "${pkgs.writeScriptBin "run-sway" ''
export WLR_RENDERER_ALLOW_SOFTWARE=1
export SDL_VIDEODRIVER=wayland
export _JAVA_AWT_WM_NONREPARENTING=1
@@ -353,6 +356,7 @@ in {
uuid = "e0103dac-7da0-4e32-a01b-487b8c4c813c";
type = "wifi";
interface-name = "wlp3s0";
autoconnect-priority = "200";
};
wifi = {
@@ -378,8 +382,8 @@ in {
id = "hot";
uuid = "ab51de8a-9742-465a-928b-be54a83ab6a3";
type = "wifi";
autoconnect = false;
interface-name = "wlp3s0";
autoconnect-priority = "100";
};
wifi = {
mode = "ap";
@@ -426,6 +430,7 @@ in {
uuid = "c006389a-1697-4f77-91c3-95b466f85f13";
type = "ethernet";
autoconnect = true;
autoconnect-priority = "200";
interface-name = "enp2s0";
};

79
hosts/main.nix
View File

@@ -1,5 +1,5 @@
{ pkgs, lib, workDir, self, secretsDir, config, inputs, system, pkgsUnstable, ... }:
{ pkgs, lib, persistentDir, self, secretsDir, config, inputs, system, pkgsUnstable, ... }:
{
# https://bugzilla.kernel.org/show_bug.cgi?id=110941
@@ -167,8 +167,15 @@
services.resilio = {
enable = true;
enableWebUI = true;
httpListenAddr = "100.71.47.106";
checkForUpdates = false;
listeningPort = 44444;
};
users.users.me.homeMode = "770"; # important for resilio
networking.firewall.interfaces."tailscale0".allowedTCPPorts = [
44444 # resilio sync
9000 # resilio webui
];
@@ -203,11 +210,11 @@
################# make firefox default browser
environment.sessionVariables.DEFAULT_BROWSER = "firefox"; # for electron apps
xdg.mime.defaultApplications = {
"text/html" = "firefox.desktop";
"x-scheme-handler/http" = "firefox.desktop";
"x-scheme-handler/https" = "firefox.desktop";
"x-scheme-handler/about" = "firefox.desktop";
"x-scheme-handler/unknown" = "firefox.desktop";
"text/html" = "firefox-nightly.desktop";
"x-scheme-handler/http" = "firefox-nightly.desktop";
"x-scheme-handler/https" = "firefox-nightly.desktop";
"x-scheme-handler/about" = "firefox-nightly.desktop";
"x-scheme-handler/unknown" = "firefox-nightly.desktop";
};
@@ -393,6 +400,62 @@
'';
# */
################################ extra home-manager config for main #############################
home-manager.users.me.programs.bash = {
bashrcExtra = ''
function rp () {
host=$1
if [[ "$host" == "mosatop" ]]
then
xfreerdp /u:"c2vi" /v:mosatop /p:$(cat ${secretsDir}/mosatop-rdp-password) /dynamic-resolution +clipboard +auto-reconnect /wm-class:"Microsoft Windows"
elif [[ "$host" == "acern" ]]
then
xfreerdp /u:"seb" /v:acern /p:$(cat ${secretsDir}/acern-rdp-password) /dynamic-resolution +clipboard +auto-reconnect /wm-class:"Microsoft Windows"
elif [[ "$host" == "mwin" ]]
then
xfreerdp /u:"me" /v:mac:4400 /p:$(cat /home/me/secrets/win-vm-pwd) /dynamic-resolution +clipboard +auto-reconnect +home-drive /wm-class:"Microsoft Windows";
elif [[ "$host" == "win" ]]
then
xfreerdp /u:"me" /v:192.168.122.141 /p:$(cat /home/me/secrets/win-vm-pwd) /dynamic-resolution +clipboard +auto-reconnect +home-drive /wm-class:"Microsoft Windows";
elif [[ "$host" == "phone" ]]
then
ssh phone "source ~/.bashrc && on"
${pkgs.rustdesk}/bin/rustdesk --connect 100.77.80.77
elif [[ "$host" == "fwin" ]]
then
${pkgs.remmina}/bin/remmina -c ${persistentDir}/remmina/fwin.remmina
elif [[ "$host" == "ki" ]]
then
${pkgs.remmina}/bin/remmina -c ${persistentDir}/remmina/ki.remmina
elif [[ "$host" == "mac" ]]
then
${pkgs.remmina}/bin/remmina -c ${persistentDir}/remmina/mac.remmina
elif [[ "$host" == "mandroid" ]]
then
${pkgs.remmina}/bin/remmina -c ${persistentDir}/remmina/mandroid.remmina
fi
}
complete -W "mosatop acern phone mwin win fwin ki mac mandroid" rp
'';
};
################################ my youtube blocking service #############################
environment.etc."host.conf" = {
# needed so that firefox does not ignore the hosts file
@@ -436,10 +499,6 @@
services.samba.openFirewall = true;
networking.firewall.interfaces."tailscale0".allowedTCPPorts = [
44444 # resilio sync
];
networking.firewall.allowedTCPPorts = [
5357 # wsdd
8888 # for general usage

2
hosts/te.nix
View File

@@ -289,7 +289,7 @@ in {
boot.loader.grub.enable = true;
boot.loader.grub.efiSupport = true;
boot.loader.grub.efiInstallAsRemovable = true;
boot.loader.grub.devices = [ "nodev" ];
boot.loader.grub.device = "nodev";
boot.initrd.availableKernelModules = [
"xhci_pci"
"ehci_pci"