c2vi/dotfiles
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
0cffb9cb548aee0f2f7c046ab5fcc25f7c154fb0
dotfiles/hosts/fusu.nix
Sebastian Moser a4e3c42595 ..
2025-04-22 22:59:04 +02:00

395 lines
10 KiB
Nix
Raw Blame History

{ inputs, pkgs, secretsDir, ... }:
{
#disabledModules = [ "services/databases/couchdb.nix" ];
imports = [
#"${inputs.nixpkgs-unstable}/nixos/modules/services/databases/couchdb.nix"
../common/all.nix
../common/nixos.nix
../common/building.nix
inputs.home-manager.nixosModules.home-manager
../users/me/headless.nix
../users/root/default.nix
../users/files/headless.nix
../users/server/headless.nix
];
# mac address for wakeonlan: 00:19:99:fd:28:23
# allow acern to ssh into server
#users.users.server.openssh.authorizedKeys.keys = [
#"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHTV1VoNAjMha5IP+qb8XABDo02pW3iN0yPBIbSqZA27 me@acern"
#];
# allow server user to shutdown fusu
#security.sudo.extraRules = [
#{
#users = [ "server" ];
#commands = [ { command = "/run/current-system/sw/bin/shutdown"; options = [ "SETENV" "NOPASSWD" ]; } ];
#}
#];
services.tailscale.enable = true;
services.resilio = {
# TODO: add the config for the share to here
enable = true;
enableWebUI = true;
httpListenAddr = "100.70.54.18";
};
boot.supportedFilesystems = [ "zfs" ];
boot.zfs.package = pkgs.zfs_unstable;
boot.zfs.forceImportRoot = false;
networking.hostId = "7552c83e";
fileSystems."/home/files/storage" = {
device = "storage";
fsType = "zfs";
};
virtualisation.libvirtd = {
enable = true;
qemuOvmf = true;
qemuSwtpm = true;
#qemuOvmfPackage = pkgs.OVMFFull;
};
virtualisation.docker.enable = true;
users.users.server.extraGroups = [ "docker" ];
# Use the GRUB 2 boot loader.
boot.loader.grub = {
enable = true;
#device = "/dev/disk/by-id/ata-TOSHIBA_MQ04ABF100_11MYT5RBT";
device = "nodev"; # don't install, when i do nixre -h fusu ... but when installing onto the two discs (sata hdd and nvme ssd) change to the device like above
efiSupport = false;
extraConfig = ''
set timeout=2
'';
};
#fileSystems."/boot" = {
# device = "/dev/disk/by-label/fusu-boot";
# fsType = "fat32";
#};
services.openssh = {
enable = true;
# require public key authentication for better security
settings.PasswordAuthentication = false;
settings.KbdInteractiveAuthentication = false;
settings.PermitRootLogin = "yes";
ports = [ 49388 ];
settings.X11Forwarding = true;
extraConfig = ''
X11UseLocalhost no
'';
};
networking.firewall.allowPing = true;
networking.firewall.enable = true;
networking.firewall.interfaces."tailscale0".allowedTCPPorts = [
443 # couchdb for obsidian live sync https
44444 # resilio sync
9000 # resilio webui
];
services.samba.openFirewall = true;
networking.firewall.allowedTCPPorts = [
8888 # for general usage
9999 # for general usage
8080 # for mitm proxy
5901 # vnc
5357 # wsdd
8080 # for mitm proxy
49388
49389
49390
49391
49392
49393
];
networking.firewall.allowedTCPPortRanges = [
{ from = 25500; to = 27777;} # minecraft
];
networking.firewall.allowedUDPPortRanges = [
{ from = 27700; to = 28800;} # minecraft
];
networking.firewall.allowedUDPPorts = [
3702 # wsdd
67 # allow DHCP traffic
53 # allow dns
];
networking.networkmanager.enable = false; # Easiest to use and most distros use this by default.
# to build rpi images
boot.binfmt.emulatedSystems = [
"aarch64-linux"
];
environment.systemPackages = with pkgs; [
ntfs3g
virtiofsd
bcache-tools
su
fuse3
terraform
usbutils
];
nix.settings = {
trusted-public-keys = [
"sebastian@c2vi.dev:0tIXGRJMLaI9H1ZPdU4gh+BikUuBVHtk+e1B5HggdZo="
];
trusted-users = [ "me" ];
};
networking.useDHCP = false;
networking.bridges = {
"br0" = {
interfaces = [ "enp0s25" ];
};
};
networking.interfaces.br0.ipv4.addresses = [ {
address = "192.168.1.2";
prefixLength = 24;
} ];
networking = {
usePredictableInterfaceNames = true;
defaultGateway = {
address = "192.168.1.1";
interface = "br0";
};
hostName = "fusu";
nameservers = [ "1.1.1.1" "8.8.8.8" ];
};
############################ couchdb for Obsidian Live sync
#services.couchdb.enable = true;
#services.couchdb.extraConfigFiles = [ "/home/files/storage/files/stuff/obsidian-live-sync/local.ini" ];
#services.couchdb.databaseDir = "/home/files/storage/files/stuff/obsidian-live-sync/data";
############################ update ip service
systemd.services.update-ip =
let
update-ip = pkgs.writeShellApplication {
name = "update-ip";
runtimeInputs = with pkgs; [ curl w3m ];
text = ''
ip=$(curl my.ip.fi)
curl "http://dynv6.com/api/update?hostname=${builtins.readFile "${secretsDir}/dns-name-two"}&ipv4=$ip&token=${builtins.readFile "${secretsDir}/dns-name-two-token"}"
curl "https://dynamicdns.park-your-domain.com/update?host=home&domain=${builtins.readFile "${secretsDir}/dns-name"}&password=${builtins.readFile "${secretsDir}/dns-name-token"}&ip=$ip"
# https://www.namecheap.com/support/knowledgebase/article.aspx/29/11/how-to-dynamically-update-the-hosts-ip-with-an-https-request/
'';
};
#curl "https://dynamicdns.park-your-domain.com/update?host=mc&domain=c2vi.dev&password=${builtins.readFile "${secretsDir}/dns-name-token"}&ip=$ip"
in
{
enable = true;
description = "dyndns ip updates";
unitConfig = {
Type = "simple";
};
serviceConfig = {
Restart = "always";
RestartSec = "500s";
ExecStart = "${update-ip}/bin/update-ip";
};
wantedBy = [ "multi-user.target" ];
};
###################################### get oci ampere vm ####################################
systemd.services.oci-ampere =
let
oci-ampere = pkgs.writeShellApplication {
name = "oci-ampere";
runtimeInputs = with pkgs; [ terraform ];
text = ''
if [[ -f /home/me/here/oci-ampere-vm/not_gotten ]]
then
echo not gotten....................................
pwd
cd /home/me/here/oci-ampere-vm
terraform apply -auto-approve && rm /home/me/here/oci-ampere-vm/not_gotten
else
echo gotten!!!!!!!!!!!!!!!!!!!!!
fi
'';
};
in
{
enable = false;
description = "get a oci ampere vm";
unitConfig = {
Type = "simple";
};
serviceConfig = {
Restart = "always";
RestartSec = "500s";
ExecStart = "${oci-ampere}/bin/oci-ampere";
};
wantedBy = [ "multi-user.target" ];
};
################################ samba ######################################
services.samba-wsdd.enable = true; # make shares visible for windows 10 clients
# needed see: [[samba problems]] in my obsidian vault
users.users.files.group = "files";
users.groups.files = {};
services.samba = {
enable = true;
securityType = "user";
settings = {
global = {
"server role" = "standalone server";
"map to guest" = "bad user";
"usershare allow guests" = "yes";
# "hosts allow" = "192.168.1 127.0.0.1 localhost";
# "hosts deny" = "0.0.0.0/0";
"workgroup" = "WORKGROUP";
"security" = "user";
};
files = {
"valid users" = "files";
"comment" = "all my files";
"path" = "/home/files/storage/files";
"browsable" = "no";
"read only" = "no";
"guest ok" = "no";
"force user" = "files";
"force group" = "files";
"force create mode" = "0777";
# Papierkorb
"vfs object" = "recycle";
"recycle:repository" = "/home/files/storage/files/trash-files";
"recycle:keeptree" = "Yes";
"recycle:versions" = "Yes";
"recycle:touch" = "Yes";
"recycle:touch_mtime" = "Yes";
"recycle:maxsize" = "80000";
};
lan = {
"comment" = "gastordner";
"path" = "/home/files/storage/lan";
"read only" = "no";
"guest ok" = "yes";
"force user" = "files";
"force group" = "files";
"force create mode" = "0777";
# Papierkorb
"vfs object" = "recycle";
"recycle:repository" = "/home/files/storage/files/trash-lan";
"recycle:keeptree" = "No";
"recycle:versions" = "Yes";
"recycle:touch" = "Yes";
"recycle:touch_mtime" = "Yes";
"recycle:maxsize" = "8000";
};
mama = {
"comment" = "Meine Dateien auf Mamas Laptop";
"path" = "/home/files/storage/files/stuff/Mamas-Laptop";
"browsable" = "no";
"read only" = "no";
"guest ok" = "no";
"valid users" = "mamafiles";
"force user" = "files";
"force group" = "files";
"force create mode" = "0777";
};
};
};
############################## backup to onedrive ##################################
# needs that
programs.fuse.userAllowOther = true; # otherwise the root user has no acces to the mount
systemd.services.rclone-mount-backup = {
enable = false;
description = "Mount rclone backup folder";
unitConfig = {
Type = "simple";
};
serviceConfig = {
ExecStart = "${pkgs.bash}/bin/bash -c 'export PATH=/run/wrappers/bin:$PATH; id; ${pkgs.rclone}/bin/rclone mount --allow-non-empty --allow-other --vfs-cache-max-size 2G --vfs-cache-mode full backup: /home/files/backup'";
User = "files";
Group = "files";
};
wantedBy = [ "multi-user.target" ];
};
services.borgbackup.jobs.files = {
#user = "files";
extraCreateArgs = "--verbose --list --filter=AMECbchfs --stats --checkpoint-interval 600";
extraArgs = "--progress";
paths = "/home/files/storage";
doInit = false;
repo = "/home/files/backup/dateien-backup-borg-repo";
compression = "lzma,9";
startAt = "weekly";
user = "files";
group = "files";
postCreate = ''
echo create done!!!!!
'';
extraPruneArgs = "--stats --list --save-space";
patterns = [
"- /home/files/storage/files/no-backup"
];
encryption.mode = "repokey-blake2";
encryption.passCommand = "cat /home/files/secrets/borg-passphrase";
environment.BORG_KEY_FILE = "/home/files/secrets/borg-key";
prune.keep = {
#within = "1w"; # Keep all archives from the last day
daily = 7;
weekly = 7;
monthly = -1; # Keep at least one archive for each month
};
};
}
Reference in New Issue View Git Blame Copy Permalink