Compare commits
21 commits
376a622549
...
4cfe0a7846
Author | SHA1 | Date | |
---|---|---|---|
Bruno BELANYI | 4cfe0a7846 | ||
Bruno BELANYI | b31ecd0250 | ||
Bruno BELANYI | 044ad20349 | ||
Bruno BELANYI | 0a251fa775 | ||
Bruno BELANYI | bc8758dd95 | ||
Bruno BELANYI | cc42b3f3d8 | ||
Bruno BELANYI | feccb7ba2b | ||
Bruno BELANYI | 93729ccfa7 | ||
Bruno BELANYI | e77e65201c | ||
Bruno BELANYI | e55308b596 | ||
Bruno BELANYI | 07737b5076 | ||
Bruno BELANYI | 8b67a1da8e | ||
Bruno BELANYI | 52399cbb3e | ||
Bruno BELANYI | 2ba35fd5e0 | ||
Bruno BELANYI | 3653918237 | ||
Bruno BELANYI | 89a43e8bad | ||
Bruno BELANYI | ed1a5b4924 | ||
Bruno BELANYI | f581ef7113 | ||
Bruno BELANYI | dbb6b38eba | ||
Bruno BELANYI | cb0f8e91a0 | ||
Bruno BELANYI | d0b926251d |
|
@ -23,6 +23,8 @@ in
|
|||
(lib.mkIf cfg.wireless.enable {
|
||||
networking.networkmanager.enable = true;
|
||||
|
||||
# IWD needs persistence if enabled
|
||||
|
||||
# Persist NetworkManager files
|
||||
my.system.persist.files = [
|
||||
"/var/lib/NetworkManager/secret_key"
|
||||
|
|
|
@ -39,5 +39,7 @@ in
|
|||
extraGroups = [ "docker" ]; # Give access to the daemon
|
||||
};
|
||||
users.groups.drone-runner-docker = { };
|
||||
|
||||
# FIXME: persistence?
|
||||
};
|
||||
}
|
||||
|
|
|
@ -63,5 +63,7 @@ in
|
|||
group = "drone-runner-exec";
|
||||
};
|
||||
users.groups.drone-runner-exec = { };
|
||||
|
||||
# FIXME: persistence?
|
||||
};
|
||||
}
|
||||
|
|
|
@ -50,5 +50,7 @@ in
|
|||
inherit (cfg) port;
|
||||
};
|
||||
};
|
||||
|
||||
# FIXME: persistence?
|
||||
};
|
||||
}
|
||||
|
|
|
@ -72,6 +72,16 @@ in
|
|||
};
|
||||
};
|
||||
|
||||
my.services.backup = {
|
||||
paths = [
|
||||
"/var/lib/${config.systemd.services.mealie.serviceConfig.StateDirectory}"
|
||||
];
|
||||
};
|
||||
|
||||
my.system.persist.directories = [
|
||||
"/var/lib/${config.systemd.services.mealie.serviceConfig.StateDirectory}"
|
||||
];
|
||||
|
||||
services.fail2ban.jails = {
|
||||
mealie = ''
|
||||
enabled = true
|
||||
|
|
|
@ -130,5 +130,10 @@ in
|
|||
inherit (cfg.grafana) port;
|
||||
};
|
||||
};
|
||||
|
||||
my.system.persist.directories = [
|
||||
config.services.grafana.dataDir
|
||||
"/var/lib/${config.services.prometheus.stateDir}"
|
||||
];
|
||||
};
|
||||
}
|
||||
|
|
|
@ -53,6 +53,10 @@ in
|
|||
};
|
||||
};
|
||||
|
||||
my.system.persist.directories = [
|
||||
"/var/lib/${config.systemd.services.navidrome.serviceConfig.StateDirectory}"
|
||||
];
|
||||
|
||||
services.fail2ban.jails = {
|
||||
navidrome = ''
|
||||
enabled = true
|
||||
|
|
|
@ -46,5 +46,7 @@ in
|
|||
];
|
||||
};
|
||||
};
|
||||
|
||||
# FIXME: persistence?
|
||||
};
|
||||
}
|
||||
|
|
|
@ -92,6 +92,11 @@ in
|
|||
];
|
||||
};
|
||||
|
||||
my.system.persist.directories = [
|
||||
config.services.nextcloud.home
|
||||
config.services.nextcloud.datadir
|
||||
];
|
||||
|
||||
services.fail2ban.jails = {
|
||||
nextcloud = ''
|
||||
enabled = true
|
||||
|
|
|
@ -486,5 +486,9 @@ in
|
|||
}
|
||||
];
|
||||
};
|
||||
|
||||
my.system.persist.directories = [
|
||||
config.users.user.acme.home
|
||||
];
|
||||
};
|
||||
}
|
||||
|
|
|
@ -146,5 +146,10 @@ in
|
|||
config.services.paperless.mediaDir
|
||||
];
|
||||
};
|
||||
|
||||
my.system.persist.directories = [
|
||||
config.services.paperless-ng.dataDir
|
||||
config.services.paperless-ng.mediaDir
|
||||
];
|
||||
};
|
||||
}
|
||||
|
|
|
@ -54,6 +54,10 @@ in
|
|||
};
|
||||
};
|
||||
|
||||
my.system.persist.directories = [
|
||||
"/var/lib/${config.systemd.services.stirling-pdf.serviceConfig.StateDirectory}"
|
||||
];
|
||||
|
||||
services.fail2ban.jails = {
|
||||
stirling-pdf = ''
|
||||
enabled = true
|
||||
|
|
|
@ -51,5 +51,10 @@ in
|
|||
inherit (cfg) port;
|
||||
};
|
||||
};
|
||||
|
||||
my.system.persist.directories = [
|
||||
config.systemd.services.podgrab.environment.CONFIG
|
||||
config.systemd.services.podgrab.environment.DATA
|
||||
];
|
||||
};
|
||||
}
|
||||
|
|
|
@ -24,5 +24,9 @@ in
|
|||
(config.services.postgresqlBackup.location + "/*.prev.sql.gz")
|
||||
];
|
||||
};
|
||||
|
||||
my.system.persist.directories = [
|
||||
config.services.postgresqlBackup.location
|
||||
];
|
||||
};
|
||||
}
|
||||
|
|
|
@ -18,6 +18,13 @@ in
|
|||
};
|
||||
})
|
||||
|
||||
# Only persist directory if the actual service is enabled
|
||||
(lib.mkIf config.services.postgresql.enable {
|
||||
my.system.persist.directories = [
|
||||
config.services.postgresql.dataDir
|
||||
];
|
||||
})
|
||||
|
||||
# Taken from the manual
|
||||
(lib.mkIf cfg.upgradeScript {
|
||||
environment.systemPackages =
|
||||
|
|
|
@ -53,6 +53,11 @@ in
|
|||
};
|
||||
};
|
||||
|
||||
my.system.persist.directories = [
|
||||
cfg.downloadDirectory
|
||||
"/var/lib/${config.systemd.services.pyload.StateDirectory}"
|
||||
];
|
||||
|
||||
services.fail2ban.jails = {
|
||||
pyload = ''
|
||||
enabled = true
|
||||
|
|
|
@ -46,5 +46,9 @@ in
|
|||
# Because Quassel does not use the socket, I simply trust its connection
|
||||
authentication = "host quassel quassel localhost trust";
|
||||
};
|
||||
|
||||
my.system.persist.directories = [
|
||||
config.services.quassel.dataDir
|
||||
];
|
||||
};
|
||||
}
|
||||
|
|
|
@ -22,5 +22,9 @@ in
|
|||
forceSSL = true;
|
||||
useACMEHost = config.networking.domain;
|
||||
};
|
||||
|
||||
my.system.persist.directories = [
|
||||
config.services.rss-bridge.dataDir
|
||||
];
|
||||
};
|
||||
}
|
||||
|
|
|
@ -24,6 +24,10 @@ in
|
|||
};
|
||||
};
|
||||
|
||||
my.system.persist.files = [
|
||||
config.services.sabnzbd.configFile
|
||||
];
|
||||
|
||||
services.fail2ban.jails = {
|
||||
sabnzbd = ''
|
||||
enabled = true
|
||||
|
|
|
@ -19,6 +19,16 @@ let
|
|||
enable = true;
|
||||
group = "media";
|
||||
};
|
||||
|
||||
my.system.persist.directories =
|
||||
let
|
||||
# Bazarr breaks the mold unfortunately
|
||||
dataDir =
|
||||
if service != "bazarr"
|
||||
then config.services.${service}.dataDir
|
||||
else config.users.user.${service}.home;
|
||||
in
|
||||
[ dataDir ];
|
||||
};
|
||||
|
||||
mkRedirection = service: {
|
||||
|
|
|
@ -83,6 +83,19 @@ in
|
|||
};
|
||||
};
|
||||
|
||||
my.services.backup = {
|
||||
paths = [
|
||||
"/var/lib/${config.systemd.services.tandoor-recipes.StateDirectory}"
|
||||
config.systemd.services.tandoor-recipes.environment.MEDIA_ROOT
|
||||
];
|
||||
};
|
||||
|
||||
my.system.persist.directories = [
|
||||
"/var/lib/${config.systemd.services.tandoor-recipes.StateDirectory}"
|
||||
config.systemd.services.tandoor-recipes.environment.MEDIA_ROOT
|
||||
];
|
||||
|
||||
|
||||
# NOTE: unfortunately tandoor-recipes does not log connection failures for fail2ban
|
||||
};
|
||||
}
|
||||
|
|
|
@ -91,6 +91,10 @@ in
|
|||
allowedUDPPorts = [ cfg.peerPort ];
|
||||
};
|
||||
|
||||
my.system.persist.directories = [
|
||||
config.services.transmission.home
|
||||
];
|
||||
|
||||
# NOTE: unfortunately transmission does not log connection failures for fail2ban
|
||||
};
|
||||
}
|
||||
|
|
|
@ -100,6 +100,10 @@ in
|
|||
];
|
||||
};
|
||||
|
||||
my.system.persist.directories = [
|
||||
config.services.vikunja.settings.files.basepath
|
||||
];
|
||||
|
||||
# NOTE: unfortunately vikunja does not log connection failures for fail2ban
|
||||
};
|
||||
}
|
||||
|
|
|
@ -38,5 +38,7 @@ in
|
|||
];
|
||||
};
|
||||
};
|
||||
|
||||
# FIXME: persistence?
|
||||
};
|
||||
}
|
||||
|
|
|
@ -62,5 +62,7 @@ in
|
|||
];
|
||||
};
|
||||
};
|
||||
|
||||
# FIXME: persistence?
|
||||
};
|
||||
}
|
||||
|
|
|
@ -61,5 +61,7 @@ in
|
|||
port = cfg.rpcPort;
|
||||
};
|
||||
};
|
||||
|
||||
# FIXME: persistence
|
||||
};
|
||||
}
|
||||
|
|
|
@ -58,6 +58,10 @@ in
|
|||
"/var/log" # Logs
|
||||
"/var/lib/nixos" # UID/GID maps
|
||||
"/var/lib/systemd/coredump" # Coredumps
|
||||
|
||||
"/var/lib/systemd" # FIXME: needed?
|
||||
"/var/spool" # FIXME: needed?
|
||||
"/var/tmp" # FIXME: needed?
|
||||
]
|
||||
++ cfg.directories
|
||||
;
|
||||
|
|
|
@ -65,5 +65,7 @@ in
|
|||
# Allow resolution of '.local' addresses
|
||||
nssmdns4 = true;
|
||||
};
|
||||
|
||||
# FIXME: persistence?
|
||||
};
|
||||
}
|
||||
|
|
Loading…
Reference in a new issue