porthos: split into modules
I have separated the modules into host-specific settings, and generic settings that ought to be shared by every host. I only have the 'porthos' host for now, but intend to also add my laptop 'aramis' at some point to this repository.
This commit is contained in:
parent
d1d33fd1d1
commit
3b148ad684
|
|
@ -1,150 +0,0 @@
|
|||
# Edit this configuration file to define what should be installed on
|
||||
# your system. Help is available in the configuration.nix(5) man page
|
||||
# and in the NixOS manual (accessible by running ‘nixos-help’).
|
||||
|
||||
{ config, lib, pkgs, ... }:
|
||||
|
||||
let
|
||||
my = config.my;
|
||||
in
|
||||
{
|
||||
imports =
|
||||
[
|
||||
# Include the results of the hardware scan.
|
||||
./hardware-configuration.nix
|
||||
# Include my secrets
|
||||
./secrets
|
||||
# Include my services
|
||||
./services
|
||||
];
|
||||
|
||||
nix = {
|
||||
package = pkgs.nixFlakes;
|
||||
extraOptions = ''
|
||||
experimental-features = nix-command flakes
|
||||
'';
|
||||
};
|
||||
|
||||
# Use the GRUB 2 boot loader.
|
||||
boot.loader.grub.enable = true;
|
||||
boot.loader.grub.version = 2;
|
||||
# Define on which hard drive you want to install Grub.
|
||||
boot.loader.grub.device = "/dev/sda"; # or "nodev" for efi only
|
||||
|
||||
networking.hostName = "porthos"; # Define your hostname.
|
||||
networking.domain = "test.belanyi.fr"; # Define your domain.
|
||||
|
||||
# Set your time zone.
|
||||
time.timeZone = "Europe/Paris";
|
||||
|
||||
# The global useDHCP flag is deprecated, therefore explicitly set to false here.
|
||||
# Per-interface useDHCP will be mandatory in the future, so this generated config
|
||||
# replicates the default behaviour.
|
||||
networking.useDHCP = false;
|
||||
networking.interfaces.bond0.useDHCP = true;
|
||||
networking.interfaces.bonding_masters.useDHCP = true;
|
||||
networking.interfaces.dummy0.useDHCP = true;
|
||||
networking.interfaces.erspan0.useDHCP = true;
|
||||
networking.interfaces.eth0.useDHCP = true;
|
||||
networking.interfaces.eth1.useDHCP = true;
|
||||
networking.interfaces.gre0.useDHCP = true;
|
||||
networking.interfaces.gretap0.useDHCP = true;
|
||||
networking.interfaces.ifb0.useDHCP = true;
|
||||
networking.interfaces.ifb1.useDHCP = true;
|
||||
networking.interfaces.ip6tnl0.useDHCP = true;
|
||||
networking.interfaces.sit0.useDHCP = true;
|
||||
networking.interfaces.teql0.useDHCP = true;
|
||||
networking.interfaces.tunl0.useDHCP = true;
|
||||
|
||||
# Select internationalisation properties.
|
||||
i18n.defaultLocale = "en_US.UTF-8";
|
||||
|
||||
users.mutableUsers = false; # I want it to be declarative.
|
||||
|
||||
# Define user accounts and passwords.
|
||||
users.users.root.hashedPassword = my.secrets.users.root.hashedPassword;
|
||||
users.users.ambroisie = {
|
||||
hashedPassword = my.secrets.users.ambroisie.hashedPassword;
|
||||
description = "Bruno BELANYI";
|
||||
isNormalUser = true;
|
||||
extraGroups = [ "wheel" ]; # Enable ‘sudo’ for the user.
|
||||
openssh.authorizedKeys.keys = with builtins; let
|
||||
contents = readDir ./ssh;
|
||||
names = attrNames contents;
|
||||
files = filter (name: contents.${name} == "regular") names;
|
||||
keys = map (basename: readFile (./ssh + "/${basename}")) files;
|
||||
in
|
||||
keys;
|
||||
};
|
||||
|
||||
# List packages installed in system profile. To search, run:
|
||||
# $ nix search wget
|
||||
environment.systemPackages = with pkgs; [
|
||||
git
|
||||
git-crypt
|
||||
mosh
|
||||
vim
|
||||
wget
|
||||
];
|
||||
|
||||
# List services that you want to enable:
|
||||
my.services = {
|
||||
# Gitea forge
|
||||
gitea.enable = true;
|
||||
# Meta-indexers
|
||||
indexers = {
|
||||
jackett.enable = true;
|
||||
nzbhydra.enable = true;
|
||||
};
|
||||
# Jellyfin media server
|
||||
jellyfin.enable = true;
|
||||
# Matrix backend and Element chat front-end
|
||||
matrix = {
|
||||
enable = true;
|
||||
secret = my.secrets.matrix.secret;
|
||||
};
|
||||
# Nextcloud self-hosted cloud
|
||||
nextcloud = {
|
||||
enable = true;
|
||||
password = my.secrets.nextcloud.password;
|
||||
};
|
||||
# The whole *arr software suite
|
||||
pirate.enable = true;
|
||||
# Regular backups
|
||||
postgresql-backup.enable = true;
|
||||
# An IRC client daemon
|
||||
quassel.enable = true;
|
||||
# RSS provider for websites that do not provide any feeds
|
||||
rss-bridge.enable = true;
|
||||
# Usenet client
|
||||
sabnzbd.enable = true;
|
||||
# Torrent client and webui
|
||||
transmission = {
|
||||
enable = true;
|
||||
username = "Ambroisie";
|
||||
password = my.secrets.transmission.password;
|
||||
};
|
||||
};
|
||||
|
||||
programs.gnupg.agent = {
|
||||
enable = true;
|
||||
enableSSHSupport = true;
|
||||
};
|
||||
|
||||
programs.mosh.enable = true; # Opens the relevant UDP ports.
|
||||
|
||||
# Enable the OpenSSH daemon.
|
||||
services.openssh.enable = true;
|
||||
services.openssh.permitRootLogin = "no";
|
||||
services.openssh.passwordAuthentication = false;
|
||||
|
||||
# This value determines the NixOS release from which the default
|
||||
# settings for stateful data, like file locations and database versions
|
||||
# on your system were taken. It‘s perfectly fine and recommended to leave
|
||||
# this value at the release version of the first install of this system.
|
||||
# Before changing this value read the documentation for this option
|
||||
# (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
|
||||
system.stateVersion = "20.09"; # Did you read the comment?
|
||||
|
||||
nixpkgs.config.allowUnfree = true; # Because I don't care *that* much.
|
||||
}
|
||||
|
|
@ -19,7 +19,7 @@
|
|||
else throw "Refusing to build from a dirty Git tree!";
|
||||
})
|
||||
{ nixpkgs.overlays = [ nur.overlay ]; }
|
||||
./configuration.nix
|
||||
./porthos.nix
|
||||
];
|
||||
};
|
||||
};
|
||||
|
|
|
|||
|
|
@ -1,27 +0,0 @@
|
|||
# Do not modify this file! It was generated by ‘nixos-generate-config’
|
||||
# and may be overwritten by future invocations. Please make changes
|
||||
# to /etc/nixos/configuration.nix instead.
|
||||
{ config, lib, pkgs, modulesPath, ... }:
|
||||
|
||||
{
|
||||
imports =
|
||||
[
|
||||
(modulesPath + "/installer/scan/not-detected.nix")
|
||||
];
|
||||
|
||||
boot.initrd.availableKernelModules = [ "uhci_hcd" "ahci" "usbhid" ];
|
||||
boot.initrd.kernelModules = [ "dm-snapshot" ];
|
||||
boot.kernelModules = [ "kvm-intel" ];
|
||||
boot.extraModulePackages = [ ];
|
||||
|
||||
fileSystems."/" =
|
||||
{
|
||||
device = "/dev/disk/by-uuid/d89efc61-6b03-4190-b488-301c919e2431";
|
||||
fsType = "ext4";
|
||||
};
|
||||
|
||||
swapDevices =
|
||||
[{ device = "/dev/disk/by-uuid/1a261204-2e78-496f-8a8d-d29bfa770306"; }];
|
||||
|
||||
powerManagement.cpuFreqGovernor = lib.mkDefault "ondemand";
|
||||
}
|
||||
11
modules/default.nix
Normal file
11
modules/default.nix
Normal file
|
|
@ -0,0 +1,11 @@
|
|||
# Common modules
|
||||
{ ... }:
|
||||
|
||||
{
|
||||
imports = [
|
||||
./language.nix
|
||||
./nix.nix
|
||||
./packages.nix
|
||||
./users.nix
|
||||
];
|
||||
}
|
||||
7
modules/language.nix
Normal file
7
modules/language.nix
Normal file
|
|
@ -0,0 +1,7 @@
|
|||
# Language settings
|
||||
{ ... }:
|
||||
|
||||
{
|
||||
# Select internationalisation properties.
|
||||
i18n.defaultLocale = "en_US.UTF-8";
|
||||
}
|
||||
11
modules/nix.nix
Normal file
11
modules/nix.nix
Normal file
|
|
@ -0,0 +1,11 @@
|
|||
# Nix related settings
|
||||
{ pkgs, ... }:
|
||||
|
||||
{
|
||||
nix = {
|
||||
package = pkgs.nixFlakes;
|
||||
extraOptions = ''
|
||||
experimental-features = nix-command flakes
|
||||
'';
|
||||
};
|
||||
}
|
||||
16
modules/packages.nix
Normal file
16
modules/packages.nix
Normal file
|
|
@ -0,0 +1,16 @@
|
|||
# Common packages
|
||||
{ pkgs, ... }:
|
||||
|
||||
{
|
||||
# List packages installed in system profile. To search, run:
|
||||
# $ nix search wget
|
||||
environment.systemPackages = with pkgs; [
|
||||
git
|
||||
git-crypt
|
||||
mosh
|
||||
vim
|
||||
wget
|
||||
];
|
||||
|
||||
nixpkgs.config.allowUnfree = true; # Because I don't care *that* much.
|
||||
}
|
||||
25
modules/users.nix
Normal file
25
modules/users.nix
Normal file
|
|
@ -0,0 +1,25 @@
|
|||
# User setup
|
||||
{ config, ... }:
|
||||
let
|
||||
my = config.my;
|
||||
in
|
||||
{
|
||||
users.mutableUsers = false; # I want it to be declarative.
|
||||
|
||||
# Define user accounts and passwords.
|
||||
users.users.root.hashedPassword = my.secrets.users.root.hashedPassword;
|
||||
users.users.ambroisie = {
|
||||
hashedPassword = my.secrets.users.ambroisie.hashedPassword;
|
||||
description = "Bruno BELANYI";
|
||||
isNormalUser = true;
|
||||
extraGroups = [ "wheel" ]; # Enable ‘sudo’ for the user.
|
||||
openssh.authorizedKeys.keys = with builtins; let
|
||||
keyDir = ../ssh;
|
||||
contents = readDir keyDir;
|
||||
names = attrNames contents;
|
||||
files = filter (name: contents.${name} == "regular") names;
|
||||
keys = map (basename: readFile (keyDir + "/${basename}")) files;
|
||||
in
|
||||
keys;
|
||||
};
|
||||
}
|
||||
23
porthos.nix
Normal file
23
porthos.nix
Normal file
|
|
@ -0,0 +1,23 @@
|
|||
# Porthos self-hosted server
|
||||
{ ... }:
|
||||
|
||||
{
|
||||
imports = [
|
||||
# Include generic settings
|
||||
./modules
|
||||
# Include porthos-specific modules
|
||||
./porthos
|
||||
# Include my secrets
|
||||
./secrets
|
||||
# Include my services
|
||||
./services
|
||||
];
|
||||
|
||||
# This value determines the NixOS release from which the default
|
||||
# settings for stateful data, like file locations and database versions
|
||||
# on your system were taken. It‘s perfectly fine and recommended to leave
|
||||
# this value at the release version of the first install of this system.
|
||||
# Before changing this value read the documentation for this option
|
||||
# (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
|
||||
system.stateVersion = "20.09"; # Did you read the comment?
|
||||
}
|
||||
15
porthos/boot.nix
Normal file
15
porthos/boot.nix
Normal file
|
|
@ -0,0 +1,15 @@
|
|||
# Boot configuration
|
||||
{ ... }:
|
||||
|
||||
{
|
||||
# Use the GRUB 2 boot loader.
|
||||
boot.loader.grub.enable = true;
|
||||
boot.loader.grub.version = 2;
|
||||
# Define on which hard drive you want to install Grub.
|
||||
boot.loader.grub.device = "/dev/sda";
|
||||
|
||||
boot.initrd.availableKernelModules = [ "uhci_hcd" "ahci" "usbhid" ];
|
||||
boot.initrd.kernelModules = [ "dm-snapshot" ];
|
||||
boot.kernelModules = [ "kvm-intel" ];
|
||||
boot.extraModulePackages = [ ];
|
||||
}
|
||||
11
porthos/default.nix
Normal file
11
porthos/default.nix
Normal file
|
|
@ -0,0 +1,11 @@
|
|||
# Porthos specific settings
|
||||
{ ... }:
|
||||
|
||||
{
|
||||
imports = [
|
||||
./boot.nix
|
||||
./hardware.nix
|
||||
./networking.nix
|
||||
./services.nix
|
||||
];
|
||||
}
|
||||
20
porthos/hardware.nix
Normal file
20
porthos/hardware.nix
Normal file
|
|
@ -0,0 +1,20 @@
|
|||
# Hardware configuration
|
||||
{ lib, modulesPath, ... }:
|
||||
|
||||
{
|
||||
imports =
|
||||
[
|
||||
(modulesPath + "/installer/scan/not-detected.nix")
|
||||
];
|
||||
|
||||
fileSystems."/" =
|
||||
{
|
||||
device = "/dev/disk/by-uuid/d89efc61-6b03-4190-b488-301c919e2431";
|
||||
fsType = "ext4";
|
||||
};
|
||||
|
||||
swapDevices =
|
||||
[{ device = "/dev/disk/by-uuid/1a261204-2e78-496f-8a8d-d29bfa770306"; }];
|
||||
|
||||
powerManagement.cpuFreqGovernor = lib.mkDefault "ondemand";
|
||||
}
|
||||
27
porthos/networking.nix
Normal file
27
porthos/networking.nix
Normal file
|
|
@ -0,0 +1,27 @@
|
|||
# Networking configuration
|
||||
{ ... }:
|
||||
|
||||
{
|
||||
networking.hostName = "porthos"; # Define your hostname.
|
||||
networking.domain = "test.belanyi.fr"; # Define your domain.
|
||||
|
||||
|
||||
# The global useDHCP flag is deprecated, therefore explicitly set to false here.
|
||||
# Per-interface useDHCP will be mandatory in the future, so this generated config
|
||||
# replicates the default behaviour.
|
||||
networking.useDHCP = false;
|
||||
networking.interfaces.bond0.useDHCP = true;
|
||||
networking.interfaces.bonding_masters.useDHCP = true;
|
||||
networking.interfaces.dummy0.useDHCP = true;
|
||||
networking.interfaces.erspan0.useDHCP = true;
|
||||
networking.interfaces.eth0.useDHCP = true;
|
||||
networking.interfaces.eth1.useDHCP = true;
|
||||
networking.interfaces.gre0.useDHCP = true;
|
||||
networking.interfaces.gretap0.useDHCP = true;
|
||||
networking.interfaces.ifb0.useDHCP = true;
|
||||
networking.interfaces.ifb1.useDHCP = true;
|
||||
networking.interfaces.ip6tnl0.useDHCP = true;
|
||||
networking.interfaces.sit0.useDHCP = true;
|
||||
networking.interfaces.teql0.useDHCP = true;
|
||||
networking.interfaces.tunl0.useDHCP = true;
|
||||
}
|
||||
57
porthos/services.nix
Normal file
57
porthos/services.nix
Normal file
|
|
@ -0,0 +1,57 @@
|
|||
# Deployed services
|
||||
{ config, ... }:
|
||||
let
|
||||
my = config.my;
|
||||
in
|
||||
{
|
||||
# List services that you want to enable:
|
||||
my.services = {
|
||||
# Gitea forge
|
||||
gitea.enable = true;
|
||||
# Meta-indexers
|
||||
indexers = {
|
||||
jackett.enable = true;
|
||||
nzbhydra.enable = true;
|
||||
};
|
||||
# Jellyfin media server
|
||||
jellyfin.enable = true;
|
||||
# Matrix backend and Element chat front-end
|
||||
matrix = {
|
||||
enable = true;
|
||||
secret = my.secrets.matrix.secret;
|
||||
};
|
||||
# Nextcloud self-hosted cloud
|
||||
nextcloud = {
|
||||
enable = true;
|
||||
password = my.secrets.nextcloud.password;
|
||||
};
|
||||
# The whole *arr software suite
|
||||
pirate.enable = true;
|
||||
# Regular backups
|
||||
postgresql-backup.enable = true;
|
||||
# An IRC client daemon
|
||||
quassel.enable = true;
|
||||
# RSS provider for websites that do not provide any feeds
|
||||
rss-bridge.enable = true;
|
||||
# Usenet client
|
||||
sabnzbd.enable = true;
|
||||
# Torrent client and webui
|
||||
transmission = {
|
||||
enable = true;
|
||||
username = "Ambroisie";
|
||||
password = my.secrets.transmission.password;
|
||||
};
|
||||
};
|
||||
|
||||
programs.gnupg.agent = {
|
||||
enable = true;
|
||||
enableSSHSupport = true;
|
||||
};
|
||||
|
||||
programs.mosh.enable = true; # Opens the relevant UDP ports.
|
||||
|
||||
# Enable the OpenSSH daemon.
|
||||
services.openssh.enable = true;
|
||||
services.openssh.permitRootLogin = "no";
|
||||
services.openssh.passwordAuthentication = false;
|
||||
}
|
||||
Loading…
Reference in a new issue