diff --git a/configuration.nix b/configuration.nix deleted file mode 100644 index 6e9ea91..0000000 --- a/configuration.nix +++ /dev/null @@ -1,150 +0,0 @@ -# Edit this configuration file to define what should be installed on -# your system. Help is available in the configuration.nix(5) man page -# and in the NixOS manual (accessible by running ‘nixos-help’). - -{ config, lib, pkgs, ... }: - -let - my = config.my; -in -{ - imports = - [ - # Include the results of the hardware scan. - ./hardware-configuration.nix - # Include my secrets - ./secrets - # Include my services - ./services - ]; - - nix = { - package = pkgs.nixFlakes; - extraOptions = '' - experimental-features = nix-command flakes - ''; - }; - - # Use the GRUB 2 boot loader. - boot.loader.grub.enable = true; - boot.loader.grub.version = 2; - # Define on which hard drive you want to install Grub. - boot.loader.grub.device = "/dev/sda"; # or "nodev" for efi only - - networking.hostName = "porthos"; # Define your hostname. - networking.domain = "test.belanyi.fr"; # Define your domain. - - # Set your time zone. - time.timeZone = "Europe/Paris"; - - # The global useDHCP flag is deprecated, therefore explicitly set to false here. - # Per-interface useDHCP will be mandatory in the future, so this generated config - # replicates the default behaviour. - networking.useDHCP = false; - networking.interfaces.bond0.useDHCP = true; - networking.interfaces.bonding_masters.useDHCP = true; - networking.interfaces.dummy0.useDHCP = true; - networking.interfaces.erspan0.useDHCP = true; - networking.interfaces.eth0.useDHCP = true; - networking.interfaces.eth1.useDHCP = true; - networking.interfaces.gre0.useDHCP = true; - networking.interfaces.gretap0.useDHCP = true; - networking.interfaces.ifb0.useDHCP = true; - networking.interfaces.ifb1.useDHCP = true; - networking.interfaces.ip6tnl0.useDHCP = true; - networking.interfaces.sit0.useDHCP = true; - networking.interfaces.teql0.useDHCP = true; - networking.interfaces.tunl0.useDHCP = true; - - # Select internationalisation properties. - i18n.defaultLocale = "en_US.UTF-8"; - - users.mutableUsers = false; # I want it to be declarative. - - # Define user accounts and passwords. - users.users.root.hashedPassword = my.secrets.users.root.hashedPassword; - users.users.ambroisie = { - hashedPassword = my.secrets.users.ambroisie.hashedPassword; - description = "Bruno BELANYI"; - isNormalUser = true; - extraGroups = [ "wheel" ]; # Enable ‘sudo’ for the user. - openssh.authorizedKeys.keys = with builtins; let - contents = readDir ./ssh; - names = attrNames contents; - files = filter (name: contents.${name} == "regular") names; - keys = map (basename: readFile (./ssh + "/${basename}")) files; - in - keys; - }; - - # List packages installed in system profile. To search, run: - # $ nix search wget - environment.systemPackages = with pkgs; [ - git - git-crypt - mosh - vim - wget - ]; - - # List services that you want to enable: - my.services = { - # Gitea forge - gitea.enable = true; - # Meta-indexers - indexers = { - jackett.enable = true; - nzbhydra.enable = true; - }; - # Jellyfin media server - jellyfin.enable = true; - # Matrix backend and Element chat front-end - matrix = { - enable = true; - secret = my.secrets.matrix.secret; - }; - # Nextcloud self-hosted cloud - nextcloud = { - enable = true; - password = my.secrets.nextcloud.password; - }; - # The whole *arr software suite - pirate.enable = true; - # Regular backups - postgresql-backup.enable = true; - # An IRC client daemon - quassel.enable = true; - # RSS provider for websites that do not provide any feeds - rss-bridge.enable = true; - # Usenet client - sabnzbd.enable = true; - # Torrent client and webui - transmission = { - enable = true; - username = "Ambroisie"; - password = my.secrets.transmission.password; - }; - }; - - programs.gnupg.agent = { - enable = true; - enableSSHSupport = true; - }; - - programs.mosh.enable = true; # Opens the relevant UDP ports. - - # Enable the OpenSSH daemon. - services.openssh.enable = true; - services.openssh.permitRootLogin = "no"; - services.openssh.passwordAuthentication = false; - - # This value determines the NixOS release from which the default - # settings for stateful data, like file locations and database versions - # on your system were taken. It‘s perfectly fine and recommended to leave - # this value at the release version of the first install of this system. - # Before changing this value read the documentation for this option - # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html). - system.stateVersion = "20.09"; # Did you read the comment? - - nixpkgs.config.allowUnfree = true; # Because I don't care *that* much. -} diff --git a/flake.nix b/flake.nix index e505309..f38849b 100644 --- a/flake.nix +++ b/flake.nix @@ -19,7 +19,7 @@ else throw "Refusing to build from a dirty Git tree!"; }) { nixpkgs.overlays = [ nur.overlay ]; } - ./configuration.nix + ./porthos.nix ]; }; }; diff --git a/hardware-configuration.nix b/hardware-configuration.nix deleted file mode 100644 index 8d8113b..0000000 --- a/hardware-configuration.nix +++ /dev/null @@ -1,27 +0,0 @@ -# Do not modify this file! It was generated by ‘nixos-generate-config’ -# and may be overwritten by future invocations. Please make changes -# to /etc/nixos/configuration.nix instead. -{ config, lib, pkgs, modulesPath, ... }: - -{ - imports = - [ - (modulesPath + "/installer/scan/not-detected.nix") - ]; - - boot.initrd.availableKernelModules = [ "uhci_hcd" "ahci" "usbhid" ]; - boot.initrd.kernelModules = [ "dm-snapshot" ]; - boot.kernelModules = [ "kvm-intel" ]; - boot.extraModulePackages = [ ]; - - fileSystems."/" = - { - device = "/dev/disk/by-uuid/d89efc61-6b03-4190-b488-301c919e2431"; - fsType = "ext4"; - }; - - swapDevices = - [{ device = "/dev/disk/by-uuid/1a261204-2e78-496f-8a8d-d29bfa770306"; }]; - - powerManagement.cpuFreqGovernor = lib.mkDefault "ondemand"; -} diff --git a/modules/default.nix b/modules/default.nix new file mode 100644 index 0000000..41f6110 --- /dev/null +++ b/modules/default.nix @@ -0,0 +1,11 @@ +# Common modules +{ ... }: + +{ + imports = [ + ./language.nix + ./nix.nix + ./packages.nix + ./users.nix + ]; +} diff --git a/modules/language.nix b/modules/language.nix new file mode 100644 index 0000000..48d9f30 --- /dev/null +++ b/modules/language.nix @@ -0,0 +1,7 @@ +# Language settings +{ ... }: + +{ + # Select internationalisation properties. + i18n.defaultLocale = "en_US.UTF-8"; +} diff --git a/modules/nix.nix b/modules/nix.nix new file mode 100644 index 0000000..fb601a5 --- /dev/null +++ b/modules/nix.nix @@ -0,0 +1,11 @@ +# Nix related settings +{ pkgs, ... }: + +{ + nix = { + package = pkgs.nixFlakes; + extraOptions = '' + experimental-features = nix-command flakes + ''; + }; +} diff --git a/modules/packages.nix b/modules/packages.nix new file mode 100644 index 0000000..3278e72 --- /dev/null +++ b/modules/packages.nix @@ -0,0 +1,16 @@ +# Common packages +{ pkgs, ... }: + +{ + # List packages installed in system profile. To search, run: + # $ nix search wget + environment.systemPackages = with pkgs; [ + git + git-crypt + mosh + vim + wget + ]; + + nixpkgs.config.allowUnfree = true; # Because I don't care *that* much. +} diff --git a/modules/users.nix b/modules/users.nix new file mode 100644 index 0000000..1b1b709 --- /dev/null +++ b/modules/users.nix @@ -0,0 +1,25 @@ +# User setup +{ config, ... }: +let + my = config.my; +in +{ + users.mutableUsers = false; # I want it to be declarative. + + # Define user accounts and passwords. + users.users.root.hashedPassword = my.secrets.users.root.hashedPassword; + users.users.ambroisie = { + hashedPassword = my.secrets.users.ambroisie.hashedPassword; + description = "Bruno BELANYI"; + isNormalUser = true; + extraGroups = [ "wheel" ]; # Enable ‘sudo’ for the user. + openssh.authorizedKeys.keys = with builtins; let + keyDir = ../ssh; + contents = readDir keyDir; + names = attrNames contents; + files = filter (name: contents.${name} == "regular") names; + keys = map (basename: readFile (keyDir + "/${basename}")) files; + in + keys; + }; +} diff --git a/porthos.nix b/porthos.nix new file mode 100644 index 0000000..2eda025 --- /dev/null +++ b/porthos.nix @@ -0,0 +1,23 @@ +# Porthos self-hosted server +{ ... }: + +{ + imports = [ + # Include generic settings + ./modules + # Include porthos-specific modules + ./porthos + # Include my secrets + ./secrets + # Include my services + ./services + ]; + + # This value determines the NixOS release from which the default + # settings for stateful data, like file locations and database versions + # on your system were taken. It‘s perfectly fine and recommended to leave + # this value at the release version of the first install of this system. + # Before changing this value read the documentation for this option + # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html). + system.stateVersion = "20.09"; # Did you read the comment? +} diff --git a/porthos/boot.nix b/porthos/boot.nix new file mode 100644 index 0000000..a102743 --- /dev/null +++ b/porthos/boot.nix @@ -0,0 +1,15 @@ +# Boot configuration +{ ... }: + +{ + # Use the GRUB 2 boot loader. + boot.loader.grub.enable = true; + boot.loader.grub.version = 2; + # Define on which hard drive you want to install Grub. + boot.loader.grub.device = "/dev/sda"; + + boot.initrd.availableKernelModules = [ "uhci_hcd" "ahci" "usbhid" ]; + boot.initrd.kernelModules = [ "dm-snapshot" ]; + boot.kernelModules = [ "kvm-intel" ]; + boot.extraModulePackages = [ ]; +} diff --git a/porthos/default.nix b/porthos/default.nix new file mode 100644 index 0000000..596a0f1 --- /dev/null +++ b/porthos/default.nix @@ -0,0 +1,11 @@ +# Porthos specific settings +{ ... }: + +{ + imports = [ + ./boot.nix + ./hardware.nix + ./networking.nix + ./services.nix + ]; +} diff --git a/porthos/hardware.nix b/porthos/hardware.nix new file mode 100644 index 0000000..8705bc7 --- /dev/null +++ b/porthos/hardware.nix @@ -0,0 +1,20 @@ +# Hardware configuration +{ lib, modulesPath, ... }: + +{ + imports = + [ + (modulesPath + "/installer/scan/not-detected.nix") + ]; + + fileSystems."/" = + { + device = "/dev/disk/by-uuid/d89efc61-6b03-4190-b488-301c919e2431"; + fsType = "ext4"; + }; + + swapDevices = + [{ device = "/dev/disk/by-uuid/1a261204-2e78-496f-8a8d-d29bfa770306"; }]; + + powerManagement.cpuFreqGovernor = lib.mkDefault "ondemand"; +} diff --git a/porthos/networking.nix b/porthos/networking.nix new file mode 100644 index 0000000..1d0ac03 --- /dev/null +++ b/porthos/networking.nix @@ -0,0 +1,27 @@ +# Networking configuration +{ ... }: + +{ + networking.hostName = "porthos"; # Define your hostname. + networking.domain = "test.belanyi.fr"; # Define your domain. + + + # The global useDHCP flag is deprecated, therefore explicitly set to false here. + # Per-interface useDHCP will be mandatory in the future, so this generated config + # replicates the default behaviour. + networking.useDHCP = false; + networking.interfaces.bond0.useDHCP = true; + networking.interfaces.bonding_masters.useDHCP = true; + networking.interfaces.dummy0.useDHCP = true; + networking.interfaces.erspan0.useDHCP = true; + networking.interfaces.eth0.useDHCP = true; + networking.interfaces.eth1.useDHCP = true; + networking.interfaces.gre0.useDHCP = true; + networking.interfaces.gretap0.useDHCP = true; + networking.interfaces.ifb0.useDHCP = true; + networking.interfaces.ifb1.useDHCP = true; + networking.interfaces.ip6tnl0.useDHCP = true; + networking.interfaces.sit0.useDHCP = true; + networking.interfaces.teql0.useDHCP = true; + networking.interfaces.tunl0.useDHCP = true; +} diff --git a/porthos/services.nix b/porthos/services.nix new file mode 100644 index 0000000..d75f7ca --- /dev/null +++ b/porthos/services.nix @@ -0,0 +1,57 @@ +# Deployed services +{ config, ... }: +let + my = config.my; +in +{ + # List services that you want to enable: + my.services = { + # Gitea forge + gitea.enable = true; + # Meta-indexers + indexers = { + jackett.enable = true; + nzbhydra.enable = true; + }; + # Jellyfin media server + jellyfin.enable = true; + # Matrix backend and Element chat front-end + matrix = { + enable = true; + secret = my.secrets.matrix.secret; + }; + # Nextcloud self-hosted cloud + nextcloud = { + enable = true; + password = my.secrets.nextcloud.password; + }; + # The whole *arr software suite + pirate.enable = true; + # Regular backups + postgresql-backup.enable = true; + # An IRC client daemon + quassel.enable = true; + # RSS provider for websites that do not provide any feeds + rss-bridge.enable = true; + # Usenet client + sabnzbd.enable = true; + # Torrent client and webui + transmission = { + enable = true; + username = "Ambroisie"; + password = my.secrets.transmission.password; + }; + }; + + programs.gnupg.agent = { + enable = true; + enableSSHSupport = true; + }; + + programs.mosh.enable = true; # Opens the relevant UDP ports. + + # Enable the OpenSSH daemon. + services.openssh.enable = true; + services.openssh.permitRootLogin = "no"; + services.openssh.passwordAuthentication = false; +}