diff --git a/.sops.yaml b/.sops.yaml index 52f4dee..7314a89 100644 --- a/.sops.yaml +++ b/.sops.yaml @@ -7,10 +7,13 @@ keys: - &swarsel 4BE7925262289B476DBBC17B76FD3810215AE097 - &hosts - &bakery age1mjgw3nxlnqdj04mgjz3wn7fj2nl2nxla4p2r2fn4nkvayfgp09pqllxzyh - - &summers age18cgqlely56hgmhscllkmafwpjdk6dwep6ej3vkk97dzemp8jtuksqrrjjl + - &summers age14sjyqch8tzqexk2gv0qgrrg09f0s6hvwhsgjac3vs6sc5rzgpcxsyqda6u - &belchsfactory age1k73gy5em3js9zklnnkzp5hme9k04lny32fgahmzddknjw5c295asdyr4x6 + - &dgx age1ax5hqk6e2ekgfx5u7pl8ayc3vvhrehyvtvf07llaxhs5azpnny0qpltrns - &eagleland age1cmzh82q8k59yzceuuy2epmqu22g7m84gqvq056mhgehwpmvjadfsc3glc8 - &hintbooth age1wmx8y2hs83j2u5srdnfxljrzxm8jtxl6fr0mq7xf2ldxyglpzf2qq89rpx + - &hintbooth-adguardhome age1c2enwel9un28dcs4wg0vcyamx9a4a6g3walkhu8w5lqhmd804paq9d24as + - &hintbooth-nginx age1nanlervuderw4qskcuessycqy2yfmptl6nym9scgp9ky2265ssmq3u73r0 - &liliputsteps age1ly2endyt0y9xyddj6yuj4nw6fa3ltvzlvew4cr4lzs6dv8dkavpqadmyxx - &moonside age18quey88vge7xytclg2nuq4ncme86dg04lxwczqxczmdchnjg3p0saehsnh - &pyramid age15cx90pnp54xp5gxlt02yn9j2pz968wp3l5ukdkx55xuecp34e5pszjku4m @@ -18,9 +21,6 @@ keys: - &toto age16vzhcvz8tyxj8e0f47fy0z4p3dsg0ak4vl52ut3l07a0tz465cxslmhevl - &twothreetunnel age1g7atkxdlt4ymeh7v7aa2yzr2hq2qkvzrc4r49ugttm3n582ymv9qrmpk8d - &winters age1s0vssf9fey2l456hucppzx2x58xep279nsdcglvkqm30sr9ht37s8rvpza - - &dgx age1ax5hqk6e2ekgfx5u7pl8ayc3vvhrehyvtvf07llaxhs5azpnny0qpltrns - - &hintbooth-adguardhome age1c2enwel9un28dcs4wg0vcyamx9a4a6g3walkhu8w5lqhmd804paq9d24as - - &hintbooth-nginx age1nanlervuderw4qskcuessycqy2yfmptl6nym9scgp9ky2265ssmq3u73r0 creation_rules: - path_regex: secrets/repo/[^/]+\.(yaml|json|env|ini|enc)$ key_groups: @@ -56,6 +56,7 @@ creation_rules: - *swarsel age: - *twothreetunnel + - *summers - *eagleland - *hintbooth-nginx @@ -152,6 +153,146 @@ creation_rules: - *hintbooth - *hintbooth-nginx + - path_regex: hosts/nixos/x86_64-linux/summers/secrets/ankisync/[^/]+\.(yaml|json|env|ini|enc)$ + key_groups: + - pgp: + - *swarsel + age: + - *summers + + - path_regex: hosts/nixos/x86_64-linux/summers/secrets/atuin/[^/]+\.(yaml|json|env|ini|enc)$ + key_groups: + - pgp: + - *swarsel + age: + - *summers + + - path_regex: hosts/nixos/x86_64-linux/summers/secrets/audio/[^/]+\.(yaml|json|env|ini|enc)$ + key_groups: + - pgp: + - *swarsel + age: + - *summers + + - path_regex: hosts/nixos/x86_64-linux/summers/secrets/firefly/[^/]+\.(yaml|json|env|ini|enc)$ + key_groups: + - pgp: + - *swarsel + age: + - *summers + + - path_regex: hosts/nixos/x86_64-linux/summers/secrets/forgejo/[^/]+\.(yaml|json|env|ini|enc)$ + key_groups: + - pgp: + - *swarsel + age: + - *summers + + - path_regex: hosts/nixos/x86_64-linux/summers/secrets/freshrss/[^/]+\.(yaml|json|env|ini|enc)$ + key_groups: + - pgp: + - *swarsel + age: + - *summers + + - path_regex: hosts/nixos/x86_64-linux/summers/secrets/homebox/[^/]+\.(yaml|json|env|ini|enc)$ + key_groups: + - pgp: + - *swarsel + age: + - *summers + + - path_regex: hosts/nixos/x86_64-linux/summers/secrets/immich/[^/]+\.(yaml|json|env|ini|enc)$ + key_groups: + - pgp: + - *swarsel + age: + - *summers + + - path_regex: hosts/nixos/x86_64-linux/summers/secrets/jellyfin/[^/]+\.(yaml|json|env|ini|enc)$ + key_groups: + - pgp: + - *swarsel + age: + - *summers + + - path_regex: hosts/nixos/x86_64-linux/summers/secrets/kanidm/[^/]+\.(yaml|json|env|ini|enc)$ + key_groups: + - pgp: + - *swarsel + age: + - *summers + + - path_regex: hosts/nixos/x86_64-linux/summers/secrets/kavita/[^/]+\.(yaml|json|env|ini|enc)$ + key_groups: + - pgp: + - *swarsel + age: + - *summers + + - path_regex: hosts/nixos/x86_64-linux/summers/secrets/koillection/[^/]+\.(yaml|json|env|ini|enc)$ + key_groups: + - pgp: + - *swarsel + age: + - *summers + + - path_regex: hosts/nixos/x86_64-linux/summers/secrets/matrix/[^/]+\.(yaml|json|env|ini|enc)$ + key_groups: + - pgp: + - *swarsel + age: + - *summers + + - path_regex: hosts/nixos/x86_64-linux/summers/secrets/monitoring/[^/]+\.(yaml|json|env|ini|enc)$ + key_groups: + - pgp: + - *swarsel + age: + - *summers + + - path_regex: hosts/nixos/x86_64-linux/summers/secrets/nextcloud/[^/]+\.(yaml|json|env|ini|enc)$ + key_groups: + - pgp: + - *swarsel + age: + - *summers + + - path_regex: hosts/nixos/x86_64-linux/summers/secrets/paperless/[^/]+\.(yaml|json|env|ini|enc)$ + key_groups: + - pgp: + - *swarsel + age: + - *summers + + - path_regex: hosts/nixos/x86_64-linux/summers/secrets/postgresql/[^/]+\.(yaml|json|env|ini|enc)$ + key_groups: + - pgp: + - *swarsel + age: + - *summers + + - path_regex: hosts/nixos/x86_64-linux/summers/secrets/radicale/[^/]+\.(yaml|json|env|ini|enc)$ + key_groups: + - pgp: + - *swarsel + age: + - *summers + + - path_regex: hosts/nixos/x86_64-linux/summers/secrets/storage/[^/]+\.(yaml|json|env|ini|enc)$ + key_groups: + - pgp: + - *swarsel + age: + - *summers + + - path_regex: hosts/nixos/x86_64-linux/summers/secrets/transmission/[^/]+\.(yaml|json|env|ini|enc)$ + key_groups: + - pgp: + - *swarsel + age: + - *summers + - path_regex: hosts/darwin/x86_64-darwin/nbm-imba-166/secrets/[^/]+\.(yaml|json|env|ini|enc)$ key_groups: - pgp: diff --git a/SwarselSystems.org b/SwarselSystems.org index 5902178..0b0e101 100644 --- a/SwarselSystems.org +++ b/SwarselSystems.org @@ -1,15 +1,17 @@ #+title: SwarselSystems: NixOS + Emacs Configuration -#+PROPERTY: header-args:emacs-lisp :tangle files/emacs/init.el :mkdirp yes -#+PROPERTY: header-args:nix :mkdirp yes -#+PROPERTY: header-args:nix-ts :mkdirp yes -#+PROPERTY: header-args:shell :mkdirp yes #+EXPORT_FILE_NAME: site/index.html -#+OPTIONS: toc:6 author:nil creator:nil timestamp:nil validate:nil html-postamble:nil html-preamble:nil broken-links:mark #+HTML_HEAD: -#+macro: revision-date (eval (format-time-string "%F %T %z")) -#+macro: count-words (eval (count-words (point-min) (point-max))) -#+macro: count-lines (eval (count-lines (point-min) (point-max))) -#+macro: NOTE (eval "This file has {{{count-words}}} words spanning {{{count-lines}}} lines and was last revised on {{{revision-date}}}.") +#+OPTIONS: toc:6 author:nil creator:nil timestamp:nil validate:nil html-postamble:nil html-preamble:nil broken-links:mark +#+PROPERTY: header-args:config :eval never-export +#+PROPERTY: header-args:css :eval never-export +#+PROPERTY: header-args:emacs-lisp :tangle files/emacs/init.el :mkdirp yes :eval never-export +#+PROPERTY: header-args:markdown :eval never-export +#+PROPERTY: header-args:nix-ts :mkdirp yes :eval never-export +#+PROPERTY: header-args:shell :mkdirp yes :eval never-export +#+MACRO: revision-date (eval (format-time-string "%F %T %z")) +#+MACRO: count-words (eval (count-words (point-min) (point-max))) +#+MACRO: count-lines (eval (count-lines (point-min) (point-max))) +#+MACRO: NOTE (eval "This file has {{{count-words}}} words spanning {{{count-lines}}} lines and was last revised on {{{revision-date}}}.") *{{{NOTE(If you can see this, you might want to switch to [[https://swarsel.github.io/.dotfiles/][the hmtl version of this document]] in order to have working links and other QoL functions while reading this file.)}}}* @@ -472,9 +474,9 @@ The nix language supports the following types and how they look in the wild: - these hold name value pairs, e.g. ={ a = 3; }= - a "chain" of attributes, separated by dots, is called an =attribute path=, e.g. =config.environment.systemPackages= - in such a chain, all attributes but the last will be =attribute sets= - - =config.environment.systemPackages= is equivalent to ~config = { environment = { systemPackages = ; }; };~ + - =config.environment.systemPackages= is equivalent to =config = { environment = { systemPackages = ; }; };= - lists: [ ] - - these hold values, e.g. =[ { a == 3; } ]=. In this example, the list holds a single value, that is, the attribute set ={ a = 3; }=. + - these hold values, e.g. =[ { a = 3; } ]=. In this example, the list holds a single value, that is, the attribute set ={ a = 3; }=. - functions: =arg: body= - =arg= can be any of these data types, including functions - when =arg= is an attribute set, some special things apply: @@ -504,7 +506,7 @@ Calling by using a default value: Not passing =age= errors out: -#+begin_src bash :tangle no :exports both :results output +#+begin_src bash :tangle no :exports both :results discard :eval never-export swarsel-instantiate 'let f = {name ? "Default", age }: "${name} is ${age} years old"; in f { }' #+end_src @@ -520,12 +522,11 @@ error: at «string»:1:44: 1| let lib = import ; in let f = {name ? "Default", age }: "${name} is ${age} years old"; in f { } | ^ -[ Babel evaluation exited with code 1 ] #+end_example Passing a superfluous =another= errors out: -#+begin_src bash :tangle no :exports both :results output +#+begin_src bash :tangle no :exports both :results discard :eval never-export swarsel-instantiate 'let f = {name ? "Default", age }: "${name} is ${age} years old"; in f { age = "2"; another = "0"; }' #+end_src @@ -541,7 +542,6 @@ error: at «string»:1:44: 1| let lib = import ; in let f = {name ? "Default", age }: "${name} is ${age} years old"; in f { age = "2"; another = "0"; } | ^ -[ Babel evaluation exited with code 1 ] #+end_example @@ -589,7 +589,7 @@ This looks cumberesome on first sight, but is for example useful when referencin - this adds all attributes of the enclosing attribute - the following will error out: -#+begin_src bash :tangle no :exports both :results output +#+begin_src bash :tangle no :exports both :results discard :eval never-export swarsel-instantiate ' { a = true; @@ -605,7 +605,6 @@ This looks cumberesome on first sight, but is for example useful when referencin : 4| b = a; : | ^ : 5| } -: [ Babel evaluation exited with code 1 ] - however, =rec= makes =a= available to the scope (also note that the order of expressions does /not/ matter): @@ -625,7 +624,7 @@ This looks cumberesome on first sight, but is for example useful when referencin - this adds the passed set to the lexical scope of the enclosing expression: - the following will error out: -#+begin_src bash :tangle no :exports both :results output +#+begin_src bash :tangle no :exports both :results discard :eval never-export swarsel-instantiate ' let functions = { @@ -643,7 +642,6 @@ This looks cumberesome on first sight, but is for example useful when referencin : 7| print "ok" : | ^ : 8| -: [ Babel evaluation exited with code 1 ] - using =with= will make it work: @@ -713,7 +711,7 @@ This looks cumberesome on first sight, but is for example useful when referencin but: -#+begin_src bash :tangle no :exports both :results output +#+begin_src bash :tangle no :exports both :results discard :eval never-export swarsel-instantiate ' builtins.toString -1 ' @@ -732,7 +730,6 @@ error: … while evaluating the first argument of the subtraction error: expected an integer but found the built-in function 'toString': «primop toString» -[ Babel evaluation exited with code 1 ] #+end_example - Logical operators (=!=, ====, =!==, =<=, =>=, =>==, =<==, =&&=, =||=) @@ -1632,6 +1629,8 @@ A short overview over each input and what it does: The hydra module already exists in nixpkgs - however, because, I am also using [[https://github.com/shlevy/nix-plugins][nix-plugins]], I need to build all tools that are using nix against a specific nix version (this is also why I pull in =nix-eval-jobs= as a flake input). - [[https://github.com/thelegy/nixos-nftables-firewall][nixos-nftables-firewall]] This flake introduces a module that allows for more structurized nftables config. +- [[#h:c88d569e-70c4-4dd6-a959-be649fdeaa71][topologyPrivate]] + This input per default provides a simple output =topologyPrivate = false;=. This is the value that is normally used in the config. When I export my setup to a topology diagram, there are some public IPs and domains that I want to obfuscate. When doing that, I can then override this input. #+begin_src nix :noweb yes :tangle flake.nix { @@ -1712,6 +1711,7 @@ A short overview over each input and what it does: nix-minecraft.url = "github:Infinidoge/nix-minecraft"; simple-nixos-mailserver.url = "gitlab:simple-nixos-mailserver/nixos-mailserver/master"; nixos-nftables-firewall.url = "github:thelegy/nixos-nftables-firewall"; + topologyPrivate.url = "./files/topology/public"; }; outputs = @@ -2081,6 +2081,7 @@ Similar to [[#h:6ed1a641-dba8-4e85-a62e-be93264df57a][Packages (pkgs)]], we agai inherit (pkgs) lib; inherit (self.outputs) nodes; inherit inputs; + inherit (inputs.topologyPrivate) topologyPrivate; }; modules = [ ../modules/nixos/common/globals.nix @@ -2176,7 +2177,7 @@ The rest of the functions are used to build full NixOS systems as well as halfCo specialArgs = { inherit inputs outputs self minimal homeLib configName arch; inherit (config.pkgs.${arch}) lib; - inherit (config) nodes; + inherit (config) nodes topologyPrivate; globals = config.globals.${arch}; type = "nixos"; withHomeManager = true; @@ -2238,7 +2239,7 @@ The rest of the functions are used to build full NixOS systems as well as halfCo inputs.nix-darwin.lib.darwinSystem { specialArgs = { inherit inputs lib outputs self minimal configName; - inherit (config) nodes; + inherit (config) nodes topologyPrivate; withHomeManager = true; globals = config.globals.${arch}; }; @@ -2275,7 +2276,7 @@ The rest of the functions are used to build full NixOS systems as well as halfCo inherit pkgs; extraSpecialArgs = { inherit inputs lib outputs self configName arch type; - inherit (config) nodes; + inherit (config) nodes topologyPrivate; globals = config.globals.${arch}; minimal = false; }; @@ -2362,6 +2363,8 @@ The rest of the functions are used to build full NixOS systems as well as halfCo nodes = config.nixosConfigurations // config.darwinConfigurations // config.guestConfigurations; + + "@" = lib.mapAttrs (_: v: v.config.system.build.toplevel) config.nodes; }; } #+end_src @@ -2512,21 +2515,25 @@ Another note concerning [[https://flake.parts/][flake-parts]]: # trunk [ "eth1" ] # devices - [ "eth2" ] + [ "eth2" "eth5" "eth6" ] # home [ "eth3" "eth8" ] # guests - [ "eth4" "eth5" "eth6" "eth7" ] + [ "eth4" "eth7" ] ]; interfaces = { eth2 = { network = lib.mkForce "devices"; }; eth3 = { network = lib.mkForce "home"; }; + eth5 = { network = lib.mkForce "devices"; }; + eth6 = { network = lib.mkForce "devices"; }; eth7 = { network = lib.mkForce "guests"; }; eth8 = { network = lib.mkForce "home"; }; }; connections = { eth2 = mkConnection "nswitch" "eth1"; eth3 = mkConnection "bakery" "eth1"; + eth5 = mkConnection "ps4" "eth1"; + eth6 = mkConnection "ender3" "eth1"; eth7 = mkConnection "pc" "eth1"; eth8 = mkConnection "pyramid" "eth1"; }; @@ -2554,11 +2561,29 @@ Another note concerning [[https://flake.parts/][flake-parts]]: }; nswitch = mkDevice "Nintendo Switch" { - info = "Nintendo Switch"; + info = "Atmosphère 1.3.2 @ FW 19.0.1"; image = "${self}/files/topology-images/nintendo-switch.png"; interfaces.eth1 = { }; }; + ps4 = mkDevice "PlayStation 4" { + info = "GoldHEN @ FW 5.05"; + image = "${self}/files/topology-images/ps4.png"; + interfaces.eth1 = { }; + }; + + ender3 = mkDevice "Ender 3" { + info = "SKR V1.3, TMC2209 (Dual), TFT35"; + image = "${self}/files/topology-images/ender3.png"; + interfaces.eth1 = { }; + services = { + octoprint = { + name = "OctoPrint"; + icon = "${self}/files/topology-images/octoprint.png"; + }; + }; + }; + magicant = mkDevice "magicant" { icon = "${self}/files/topology-images/phone.png"; info = "Samsung Z Flip 6"; @@ -4183,7 +4208,7 @@ This is my main server that I run at home. It handles most tasks that require bi :CUSTOM_ID: h:0fdefb4f-ce53-4caf-89ed-5d79646f70f0 :END: #+begin_src nix-ts :tangle hosts/nixos/x86_64-linux/winters/hardware-configuration.nix - { config, lib, modulesPath, ... }: + { lib, modulesPath, ... }: { imports = @@ -4198,7 +4223,7 @@ This is my main server that I run at home. It handles most tasks that require bi extraModulePackages = [ ]; supportedFilesystems = [ "zfs" ]; - zfs.extraPools = [ "Vault" ]; + # zfs.extraPools = [ "Vault" ]; }; fileSystems = { @@ -4239,13 +4264,15 @@ This is my main server that I run at home. It handles most tasks that require bi :CUSTOM_ID: h:dc2233df-cd78-43cc-bb45-57568a83fb24 :END: #+begin_src nix-ts :tangle hosts/nixos/x86_64-linux/summers/default.nix - { self, inputs, lib, config, minimal, nodes, globals, confLib, ... }: + { self, inputs, lib, minimal, ... }: { imports = [ ./hardware-configuration.nix ./disk-config.nix + inputs.nixos-hardware.nixosModules.common-cpu-intel + "${self}/modules/nixos/optional/systemd-networkd-server-home.nix" "${self}/modules/nixos/optional/microvm-host.nix" ]; @@ -4262,22 +4289,25 @@ This is my main server that I run at home. It handles most tasks that require bi loader.efi.canTouchEfiVariables = true; }; - node.lockFromBootstrapping = lib.mkForce false; + hardware.enableRedistributableFirmware = true; swarselsystems = { info = "ASUS Z10PA-D8, 2* Intel Xeon E5-2650 v4, 128GB RAM"; flakePath = "/root/.dotfiles"; isImpermanence = true; - isSecureBoot = false; + isSecureBoot = true; isCrypted = true; isBtrfs = true; isLinux = true; isNixos = true; isSwap = false; + proxyHost = "twothreetunnel"; writeGlobalNetworks = false; - rootDisk = "/dev/disk/by-id/ata-TS128GMTS430S_H537280456"; - withMicroVMs = true; - localVLANs = [ "services" "home" ]; + networkKernelModules = [ "igb" ]; + rootDisk = "/dev/disk/by-id/ata-TS120GMTS420S_J024880123"; + withMicroVMs = false; + localVLANs = [ "services" "home" ]; # devices is only provided on interface for bmc + initrdVLAN = "home"; server = { wireguard.interfaces = { wgProxy = { @@ -4313,33 +4343,63 @@ This is my main server that I run at home. It handles most tasks that require bi }; swarselmodules.server = { + wireguard = true; + + nginx = true; # for php stuff + acme = false; # cert handled by proxy + + nfs = true; + kavita = true; restic = true; + jellyfin = true; + navidrome = true; + spotifyd = true; + mpd = true; + postgresql = true; + matrix = true; + nextcloud = true; + immich = true; + paperless = true; + transmission = true; + syncthing = true; + grafana = true; + freshrss = true; + kanidm = true; + firefly-iii = true; + koillection = true; + radicale = true; + atuin = true; + forgejo = true; + ankisync = true; + homebox = true; opkssh = true; }; - guests = lib.mkIf (!minimal && config.swarselsystems.withMicroVMs) ( - { } - // confLib.mkMicrovm "kavita" - // confLib.mkMicrovm "jellyfin" - // confLib.mkMicrovm "audio" - // confLib.mkMicrovm "postgresql" - // confLib.mkMicrovm "matrix" - // confLib.mkMicrovm "nextcloud" - // confLib.mkMicrovm "immich" - // confLib.mkMicrovm "paperless" - // confLib.mkMicrovm "transmission" - // confLib.mkMicrovm "storage" - // confLib.mkMicrovm "monitoring" - // confLib.mkMicrovm "freshrss" - // confLib.mkMicrovm "kanidm" - // confLib.mkMicrovm "firefly" - // confLib.mkMicrovm "koillection" - // confLib.mkMicrovm "radicale" - // confLib.mkMicrovm "atuin" - // confLib.mkMicrovm "forgejo" - // confLib.mkMicrovm "ankisync" - // confLib.mkMicrovm "homebox" - ); + # guests = lib.mkIf (!minimal && config.swarselsystems.withMicroVMs) ( + # { } + # // confLib.mkMicrovm "kavita" + # // confLib.mkMicrovm "jellyfin" + # // confLib.mkMicrovm "audio" + # // confLib.mkMicrovm "postgresql" + # // confLib.mkMicrovm "matrix" + # // confLib.mkMicrovm "nextcloud" + # // confLib.mkMicrovm "immich" + # // confLib.mkMicrovm "paperless" + # // confLib.mkMicrovm "transmission" + # // confLib.mkMicrovm "storage" + # // confLib.mkMicrovm "monitoring" + # // confLib.mkMicrovm "freshrss" + # // confLib.mkMicrovm "kanidm" + # // confLib.mkMicrovm "firefly" + # // confLib.mkMicrovm "koillection" + # // confLib.mkMicrovm "radicale" + # // confLib.mkMicrovm "atuin" + # // confLib.mkMicrovm "forgejo" + # // confLib.mkMicrovm "ankisync" + # // confLib.mkMicrovm "homebox" + # ); + + networking.nftables.firewall.zones.untrusted.interfaces = [ "lan" "bmc" ]; } @@ -4514,7 +4574,7 @@ This is my main server that I run at home. It handles most tasks that require bi :END: #+begin_src nix-ts :tangle hosts/nixos/x86_64-linux/summers/guests/kavita/default.nix - { self, config, lib, minimal, ... }: + { self, lib, minimal, ... }: { imports = [ "${self}/profiles/nixos/microvm" @@ -4565,7 +4625,7 @@ This is my main server that I run at home. It handles most tasks that require bi :END: #+begin_src nix-ts :tangle hosts/nixos/x86_64-linux/summers/guests/jellyfin/default.nix - { self, config, lib, minimal, ... }: + { self, lib, minimal, ... }: { imports = [ "${self}/profiles/nixos/microvm" @@ -4616,7 +4676,7 @@ This is my main server that I run at home. It handles most tasks that require bi :END: #+begin_src nix-ts :tangle hosts/nixos/x86_64-linux/summers/guests/audio/default.nix - { self, config, lib, minimal, ... }: + { self, lib, minimal, ... }: { imports = [ "${self}/profiles/nixos/microvm" @@ -4669,7 +4729,7 @@ This is my main server that I run at home. It handles most tasks that require bi :END: #+begin_src nix-ts :tangle hosts/nixos/x86_64-linux/summers/guests/postgresql/default.nix - { self, config, lib, minimal, ... }: + { self, lib, minimal, ... }: { imports = [ "${self}/profiles/nixos/microvm" @@ -4720,7 +4780,7 @@ This is my main server that I run at home. It handles most tasks that require bi :END: #+begin_src nix-ts :tangle hosts/nixos/x86_64-linux/summers/guests/matrix/default.nix - { self, config, lib, minimal, ... }: + { self, lib, minimal, ... }: { imports = [ "${self}/profiles/nixos/microvm" @@ -4771,7 +4831,7 @@ This is my main server that I run at home. It handles most tasks that require bi :END: #+begin_src nix-ts :tangle hosts/nixos/x86_64-linux/summers/guests/nextcloud/default.nix - { self, config, lib, minimal, ... }: + { self, lib, minimal, ... }: { imports = [ "${self}/profiles/nixos/microvm" @@ -4823,7 +4883,7 @@ This is my main server that I run at home. It handles most tasks that require bi :END: #+begin_src nix-ts :tangle hosts/nixos/x86_64-linux/summers/guests/immich/default.nix - { self, config, lib, minimal, ... }: + { self, lib, minimal, ... }: { imports = [ "${self}/profiles/nixos/microvm" @@ -4874,7 +4934,7 @@ This is my main server that I run at home. It handles most tasks that require bi :END: #+begin_src nix-ts :tangle hosts/nixos/x86_64-linux/summers/guests/paperless/default.nix - { self, config, lib, minimal, ... }: + { self, lib, minimal, ... }: { imports = [ "${self}/profiles/nixos/microvm" @@ -4925,7 +4985,7 @@ This is my main server that I run at home. It handles most tasks that require bi :END: #+begin_src nix-ts :tangle hosts/nixos/x86_64-linux/summers/guests/transmission/default.nix - { self, config, lib, minimal, ... }: + { self, lib, minimal, ... }: { imports = [ "${self}/profiles/nixos/microvm" @@ -4976,7 +5036,7 @@ This is my main server that I run at home. It handles most tasks that require bi :END: #+begin_src nix-ts :tangle hosts/nixos/x86_64-linux/summers/guests/storage/default.nix - { self, config, lib, minimal, ... }: + { self, lib, minimal, ... }: { imports = [ "${self}/profiles/nixos/microvm" @@ -5028,7 +5088,7 @@ This is my main server that I run at home. It handles most tasks that require bi :END: #+begin_src nix-ts :tangle hosts/nixos/x86_64-linux/summers/guests/monitoring/default.nix - { self, config, lib, minimal, ... }: + { self, lib, minimal, ... }: { imports = [ "${self}/profiles/nixos/microvm" @@ -5079,7 +5139,7 @@ This is my main server that I run at home. It handles most tasks that require bi :END: #+begin_src nix-ts :tangle hosts/nixos/x86_64-linux/summers/guests/freshrss/default.nix - { self, config, lib, minimal, ... }: + { self, lib, minimal, ... }: { imports = [ "${self}/profiles/nixos/microvm" @@ -5131,7 +5191,7 @@ This is my main server that I run at home. It handles most tasks that require bi :END: #+begin_src nix-ts :tangle hosts/nixos/x86_64-linux/summers/guests/kanidm/default.nix - { self, config, lib, minimal, ... }: + { self, lib, minimal, ... }: { imports = [ "${self}/profiles/nixos/microvm" @@ -5182,7 +5242,7 @@ This is my main server that I run at home. It handles most tasks that require bi :END: #+begin_src nix-ts :tangle hosts/nixos/x86_64-linux/summers/guests/firefly/default.nix - { self, config, lib, minimal, ... }: + { self, lib, minimal, ... }: { imports = [ "${self}/profiles/nixos/microvm" @@ -5234,7 +5294,7 @@ This is my main server that I run at home. It handles most tasks that require bi :END: #+begin_src nix-ts :tangle hosts/nixos/x86_64-linux/summers/guests/koillection/default.nix - { self, config, lib, minimal, ... }: + { self, lib, minimal, ... }: { imports = [ "${self}/profiles/nixos/microvm" @@ -5285,7 +5345,7 @@ This is my main server that I run at home. It handles most tasks that require bi :END: #+begin_src nix-ts :tangle hosts/nixos/x86_64-linux/summers/guests/radicale/default.nix - { self, config, lib, minimal, ... }: + { self, lib, minimal, ... }: { imports = [ "${self}/profiles/nixos/microvm" @@ -5336,7 +5396,7 @@ This is my main server that I run at home. It handles most tasks that require bi :END: #+begin_src nix-ts :tangle hosts/nixos/x86_64-linux/summers/guests/atuin/default.nix - { self, config, lib, minimal, ... }: + { self, lib, minimal, ... }: { imports = [ "${self}/profiles/nixos/microvm" @@ -5387,7 +5447,7 @@ This is my main server that I run at home. It handles most tasks that require bi :END: #+begin_src nix-ts :tangle hosts/nixos/x86_64-linux/summers/guests/forgejo/default.nix - { self, config, lib, minimal, ... }: + { self, lib, minimal, ... }: { imports = [ "${self}/profiles/nixos/microvm" @@ -5438,7 +5498,7 @@ This is my main server that I run at home. It handles most tasks that require bi :END: #+begin_src nix-ts :tangle hosts/nixos/x86_64-linux/summers/guests/ankisync/default.nix - { self, config, lib, minimal, ... }: + { self, lib, minimal, ... }: { imports = [ "${self}/profiles/nixos/microvm" @@ -5489,7 +5549,7 @@ This is my main server that I run at home. It handles most tasks that require bi :END: #+begin_src nix-ts :tangle hosts/nixos/x86_64-linux/summers/guests/homebox/default.nix - { self, config, lib, minimal, ... }: + { self, lib, minimal, ... }: { imports = [ "${self}/profiles/nixos/microvm" @@ -5589,9 +5649,10 @@ This is my main server that I run at home. It handles most tasks that require bi wgHome = { isServer = true; peers = [ - "winters" "hintbooth-adguardhome" "hintbooth-nginx" + "summers" + "winters" ]; }; }; @@ -7028,6 +7089,7 @@ This machine mainly acts as my proxy server to stand before my local machines. peers = [ "moonside" "winters" + "summers" "belchsfactory" "eagleland" "hintbooth-adguardhome" @@ -8477,6 +8539,14 @@ in type = types.nullOr types.str; default = null; }; + serviceAddress = mkOption { + type = types.nullOr types.str; + default = null; + }; + homeServiceAddress = mkOption { + type = types.nullOr types.str; + default = null; + }; isHome = mkOption { type = types.bool; default = false; @@ -9050,7 +9120,7 @@ This system, while highly pleasant to work with during everyday use, sometimes h secrets = lib.mkOption { readOnly = true; - default = lib.mapAttrs (_: x: importEncrypted x { inherit lib nodes inputs; }) config.repo.secretFiles; + default = lib.mapAttrs (_: x: importEncrypted x { inherit lib nodes inputs; inherit (inputs.topologyPrivate) topologyPrivate; }) config.repo.secretFiles; type = lib.types.unspecified; description = "Exposes the loaded repo secrets. This option is read-only."; }; @@ -9079,20 +9149,27 @@ This dynamically uses systemd boot or Lanzaboote depending on the minimal system #+begin_src nix-ts :tangle modules/nixos/common/lanzaboote.nix { lib, pkgs, config, minimal, ... }: + let + inherit (config.swarselsystems) isSecureBoot isImpermanence; + in { options.swarselmodules.lanzaboote = lib.mkEnableOption "lanzaboote config"; config = lib.mkIf config.swarselmodules.lanzaboote { - environment.systemPackages = lib.mkIf config.swarselsystems.isSecureBoot [ + environment.systemPackages = lib.mkIf isSecureBoot [ pkgs.sbctl ]; + environment.persistence."/persist" = lib.mkIf (isImpermanence && isSecureBoot) { + directories = [{ directory = "/var/lib/sbctl"; }]; + }; + boot = { loader = { efi.canTouchEfiVariables = true; - systemd-boot.enable = lib.swarselsystems.mkIfElse (minimal || !config.swarselsystems.isSecureBoot) (lib.mkForce true) (lib.mkForce false); + systemd-boot.enable = lib.swarselsystems.mkIfElse (minimal || !isSecureBoot) (lib.mkForce true) (lib.mkForce false); }; - lanzaboote = lib.mkIf (!minimal && config.swarselsystems.isSecureBoot) { + lanzaboote = lib.mkIf (!minimal && isSecureBoot) { enable = true; pkiBundle = "/var/lib/sbctl"; configurationLimit = 6; @@ -11686,6 +11763,7 @@ I also take some precautions in how I get networking information during stage 1. initrd = { secrets."/tmp${hostKeyPathBase}" = if minimal then (lib.mkForce generatedHostKey) else (lib.mkForce hostKeyPath); # need to mkForce this or it behaves stateful availableKernelModules = config.swarselsystems.networkKernelModules; + kernelModules = config.swarselsystems.networkKernelModules; # at least summers needs this to actually find the interfaces network = { enable = true; flushBeforeStage2 = true; @@ -12154,8 +12232,9 @@ This is the configuration to make [[#h:58c7563e-6954-42e6-a622-9d06523e8e24][Hin }) globals.networks.home-lan.vlans; selectVLANs = vlans: map (vlan: { VLAN = globals.networks.home-lan.vlans.${vlan}.id; }) vlans; + lan3VLANs = selectVLANs [ "home" "devices" "services" ]; + lan4VLANs = lan3VLANs; lan5VLANs = selectVLANs [ "home" "devices" "guests" ]; - lan4VLANs = selectVLANs [ "home" "services" ]; inherit (globals.general) homeDnsServer; in { @@ -12352,9 +12431,9 @@ This is the configuration to make [[#h:58c7563e-6954-42e6-a622-9d06523e8e24][Hin Bridge = "br"; ConfigureWithoutCarrier = true; }; - inherit bridgeVLANs; + bridgeVLANs = lan3VLANs; }; - # winters + # summers "30-lan4" = { matchConfig.MACAddress = config.repo.secrets.local.networking.networks.lan4.mac; linkConfig.RequiredForOnline = "enslaved"; @@ -12453,7 +12532,8 @@ This is the configuration to make [[#h:58c7563e-6954-42e6-a622-9d06523e8e24][Hin }; services.${serviceName} = { domain = serviceDomain; - inherit proxyAddress4 proxyAddress6 isHome; + inherit proxyAddress4 proxyAddress6 isHome serviceAddress; + homeServiceAddress = lib.mkIf isHome homeServiceAddress; }; }; @@ -12496,15 +12576,15 @@ This is the configuration to make [[#h:58c7563e-6954-42e6-a622-9d06523e8e24][Hin extraGroups = [ "video" "render" "users" ]; }; - nixpkgs.config.packageOverrides = pkgs: { - intel-vaapi-driver = pkgs.intel-vaapi-driver.override { enableHybridCodec = true; }; - }; + # nixpkgs.config.packageOverrides = pkgs: { + # intel-vaapi-driver = pkgs.intel-vaapi-driver.override { enableHybridCodec = true; }; + # }; hardware.graphics = { enable = true; extraPackages = with pkgs; [ intel-media-driver # LIBVA_DRIVER_NAME=iHD - intel-vaapi-driver # LIBVA_DRIVER_NAME=i965 (older but works better for Firefox/Chromium) + # intel-vaapi-driver # LIBVA_DRIVER_NAME=i965 (older but works better for Firefox/Chromium) libva-vdpau-driver libvdpau-va-gl ]; @@ -12523,7 +12603,8 @@ This is the configuration to make [[#h:58c7563e-6954-42e6-a622-9d06523e8e24][Hin }; services.${serviceName} = { domain = serviceDomain; - inherit proxyAddress4 proxyAddress6 isHome; + inherit proxyAddress4 proxyAddress6 isHome serviceAddress; + homeServiceAddress = lib.mkIf isHome homeServiceAddress; }; }; @@ -12603,7 +12684,8 @@ This is the configuration to make [[#h:58c7563e-6954-42e6-a622-9d06523e8e24][Hin }; services.${serviceName} = { domain = serviceDomain; - inherit proxyAddress4 proxyAddress6 isHome; + inherit proxyAddress4 proxyAddress6 isHome serviceAddress; + homeServiceAddress = lib.mkIf isHome homeServiceAddress; }; }; @@ -13096,7 +13178,8 @@ This is the configuration to make [[#h:58c7563e-6954-42e6-a622-9d06523e8e24][Hin }; services.${serviceName} = { domain = serviceDomain; - inherit proxyAddress4 proxyAddress6 isHome; + inherit proxyAddress4 proxyAddress6 isHome serviceAddress; + homeServiceAddress = lib.mkIf isHome homeServiceAddress; }; }; @@ -13394,7 +13477,8 @@ This is the configuration to make [[#h:58c7563e-6954-42e6-a622-9d06523e8e24][Hin globals.services.${serviceName} = { domain = serviceDomain; - inherit proxyAddress4 proxyAddress6 isHome; + inherit proxyAddress4 proxyAddress6 isHome serviceAddress; + homeServiceAddress = lib.mkIf isHome homeServiceAddress; }; services = { @@ -13468,7 +13552,8 @@ This is the configuration to make [[#h:58c7563e-6954-42e6-a622-9d06523e8e24][Hin }; services.${serviceName} = { domain = serviceDomain; - inherit proxyAddress4 proxyAddress6 isHome; + inherit proxyAddress4 proxyAddress6 isHome serviceAddress; + homeServiceAddress = lib.mkIf isHome homeServiceAddress; }; }; @@ -13555,7 +13640,8 @@ in }; services.${serviceName} = { domain = serviceDomain; - inherit proxyAddress4 proxyAddress6 isHome; + inherit proxyAddress4 proxyAddress6 isHome serviceAddress; + homeServiceAddress = lib.mkIf isHome homeServiceAddress; }; }; @@ -13918,7 +14004,8 @@ in }; services.${specificServiceName} = { domain = serviceDomain; - inherit proxyAddress4 proxyAddress6 isHome; + inherit proxyAddress4 proxyAddress6 isHome serviceAddress; + homeServiceAddress = lib.mkIf isHome homeServiceAddress; }; }; @@ -14138,7 +14225,8 @@ This section exposes several metrics that I use to check the health of my server }; services.${serviceName} = { domain = serviceDomain; - inherit proxyAddress4 proxyAddress6 isHome; + inherit proxyAddress4 proxyAddress6 isHome serviceAddress; + homeServiceAddress = lib.mkIf isHome homeServiceAddress; }; }; @@ -14291,6 +14379,10 @@ This section exposes several metrics that I use to check the health of my server nodes = let + extraConfig = '' + allow ${globals.networks.home-lan.vlans.services.cidrv4}; + allow ${globals.networks.home-lan.vlans.services.cidrv6}; + ''; genNginx = toAddress: extraConfigPre: { upstreams = { "${grafanaUpstream}" = { @@ -14337,7 +14429,7 @@ This section exposes several metrics that I use to check the health of my server "${globals.services.${serviceName}.subDomain}" = dns.lib.combinators.host proxyAddress4 proxyAddress6; }; ${webProxy}.services.nginx = genNginx serviceAddress ""; - ${homeWebProxy}.services.nginx = genNginx homeServiceAddress nginxAccessRules; + ${homeWebProxy}.services.nginx = genNginx homeServiceAddress (extraConfig + nginxAccessRules); }; }; } @@ -14371,7 +14463,8 @@ This is a WIP Jenkins instance. It is used to automatically build a new system w }; services.${serviceName} = { domain = serviceDomain; - inherit proxyAddress4 proxyAddress6 isHome; + inherit proxyAddress4 proxyAddress6 isHome serviceAddress; + homeServiceAddress = lib.mkIf isHome homeServiceAddress; }; }; @@ -14493,7 +14586,8 @@ FreshRSS claims to support HTTP header auth, but at least it does not work with globals.services.${serviceName} = { domain = serviceDomain; - inherit proxyAddress4 proxyAddress6 isHome; + inherit proxyAddress4 proxyAddress6 isHome serviceAddress; + homeServiceAddress = lib.mkIf isHome homeServiceAddress; }; services.${serviceName} = @@ -14601,7 +14695,8 @@ FreshRSS claims to support HTTP header auth, but at least it does not work with }; services.${serviceName} = { domain = serviceDomain; - inherit proxyAddress4 proxyAddress6 isHome; + inherit proxyAddress4 proxyAddress6 isHome serviceAddress; + homeServiceAddress = lib.mkIf isHome homeServiceAddress; }; }; @@ -14755,7 +14850,8 @@ FreshRSS claims to support HTTP header auth, but at least it does not work with }; services.${serviceName} = { domain = serviceDomain; - inherit proxyAddress4 proxyAddress6 isHome; + inherit proxyAddress4 proxyAddress6 isHome serviceAddress; + homeServiceAddress = lib.mkIf isHome homeServiceAddress; }; }; @@ -14877,7 +14973,8 @@ kanidm person credential create-reset-token }; services.${serviceName} = { domain = serviceDomain; - inherit proxyAddress4 proxyAddress6 isHome; + inherit proxyAddress4 proxyAddress6 isHome serviceAddress; + homeServiceAddress = lib.mkIf isHome homeServiceAddress; }; }; @@ -15201,12 +15298,17 @@ kanidm person credential create-reset-token systemd.services.${serviceName}.serviceConfig.RestartSec = "30"; - nodes = { + nodes = let + extraConfig = '' + allow ${globals.networks.home-lan.vlans.services.cidrv4}; + allow ${globals.networks.home-lan.vlans.services.cidrv6}; + ''; + in { ${dnsServer}.swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = { "${globals.services.${serviceName}.subDomain}" = dns.lib.combinators.host proxyAddress4 proxyAddress6; }; ${webProxy}.services.nginx = confLib.genNginx { inherit serviceAddress servicePort serviceDomain serviceName; protocol = "https"; noSslVerify = true; }; - ${homeWebProxy}.services.nginx = confLib.genNginx { inherit servicePort serviceDomain serviceName; protocol = "https"; noSslVerify = true; extraConfig = nginxAccessRules; serviceAddress = homeServiceAddress; }; + ${homeWebProxy}.services.nginx = confLib.genNginx { inherit servicePort serviceDomain serviceName; protocol = "https"; noSslVerify = true; extraConfig = extraConfig + nginxAccessRules; serviceAddress = homeServiceAddress; }; }; }; @@ -15223,7 +15325,7 @@ kanidm person credential create-reset-token { lib, config, globals, dns, confLib, ... }: let inherit (confLib.gen { name = "oauth2-proxy"; port = 3004; }) servicePort serviceName serviceUser serviceGroup serviceDomain serviceAddress proxyAddress4 proxyAddress6; - inherit (confLib.static) isHome isProxied webProxy homeWebProxy dnsServer homeProxyIf webProxyIf oauthServer nginxAccessRules; + inherit (confLib.static) isHome isProxied webProxy homeWebProxy dnsServer homeProxyIf webProxyIf oauthServer nginxAccessRules homeServiceAddress; kanidmDomain = globals.services.kanidm.domain; mainDomain = globals.domains.main; @@ -15375,7 +15477,8 @@ kanidm person credential create-reset-token }; services.${serviceName} = { domain = serviceDomain; - inherit proxyAddress4 proxyAddress6 isHome; + inherit proxyAddress4 proxyAddress6 isHome serviceAddress; + homeServiceAddress = lib.mkIf isHome homeServiceAddress; }; }; @@ -15433,14 +15536,16 @@ kanidm person credential create-reset-token extraConfig = '' proxy_set_header X-Scheme $scheme; proxy_set_header X-Auth-Request-Redirect $scheme://$host$request_uri; + allow ${globals.networks.home-lan.vlans.services.cidrv4}; + allow ${globals.networks.home-lan.vlans.services.cidrv6}; ''; in { ${dnsServer}.swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = { "${globals.services.${serviceName}.subDomain}" = dns.lib.combinators.host proxyAddress4 proxyAddress6; }; - ${webProxy}.services.nginx = confLib.genNginx { inherit servicePort serviceAddress serviceDomain serviceName extraConfig; protocol = "https"; }; - ${homeWebProxy}.services.nginx = confLib.genNginx { inherit servicePort serviceDomain serviceName; protocol = "https"; extraConfig = extraConfig + nginxAccessRules; serviceAddress = globals.hosts.${oauthServer}.wanAddress4; }; + ${webProxy}.services.nginx = confLib.genNginx { inherit servicePort serviceAddress serviceDomain serviceName extraConfig; }; + ${homeWebProxy}.services.nginx = confLib.genNginx { inherit servicePort serviceDomain serviceName; extraConfig = extraConfig + nginxAccessRules; serviceAddress = globals.hosts.${oauthServer}.wanAddress4; }; }; }; } @@ -15489,7 +15594,8 @@ kanidm person credential create-reset-token globals.services.${serviceName} = { domain = serviceDomain; - inherit proxyAddress4 proxyAddress6 isHome; + inherit proxyAddress4 proxyAddress6 isHome serviceAddress; + homeServiceAddress = lib.mkIf isHome homeServiceAddress; }; services = { @@ -15628,7 +15734,8 @@ in }; services.${serviceName} = { domain = serviceDomain; - inherit proxyAddress4 proxyAddress6 isHome; + inherit proxyAddress4 proxyAddress6 isHome serviceAddress; + homeServiceAddress = lib.mkIf isHome homeServiceAddress; }; }; @@ -15755,7 +15862,8 @@ in }; services.${serviceName} = { domain = serviceDomain; - inherit proxyAddress4 proxyAddress6 isHome; + inherit proxyAddress4 proxyAddress6 isHome serviceAddress; + homeServiceAddress = lib.mkIf isHome homeServiceAddress; }; }; @@ -15830,7 +15938,8 @@ in }; services.${serviceName} = { domain = serviceDomain; - inherit proxyAddress4 proxyAddress6 isHome; + inherit proxyAddress4 proxyAddress6 isHome serviceAddress; + homeServiceAddress = lib.mkIf isHome homeServiceAddress; }; }; @@ -16046,7 +16155,8 @@ in }; services.${serviceName} = { domain = serviceDomain; - inherit proxyAddress4 proxyAddress6 isHome; + inherit proxyAddress4 proxyAddress6 isHome serviceAddress; + homeServiceAddress = lib.mkIf isHome homeServiceAddress; }; }; @@ -16215,7 +16325,8 @@ in }; services.${serviceName} = { domain = serviceDomain; - inherit proxyAddress4 proxyAddress6 isHome; + inherit proxyAddress4 proxyAddress6 isHome serviceAddress; + homeServiceAddress = lib.mkIf isHome homeServiceAddress; }; }; @@ -16315,7 +16426,8 @@ in }; services.${serviceName} = { domain = serviceDomain; - inherit proxyAddress4 proxyAddress6 isHome; + inherit proxyAddress4 proxyAddress6 isHome serviceAddress; + homeServiceAddress = lib.mkIf isHome homeServiceAddress; }; }; @@ -16406,7 +16518,8 @@ in }; services.${serviceName} = { domain = serviceDomain; - inherit proxyAddress4 proxyAddress6 isHome; + inherit proxyAddress4 proxyAddress6 isHome serviceAddress; + homeServiceAddress = lib.mkIf isHome homeServiceAddress; }; }; @@ -16470,7 +16583,8 @@ in }; services.${serviceName} = { domain = serviceDomain; - inherit proxyAddress4 proxyAddress6 isHome; + inherit proxyAddress4 proxyAddress6 isHome serviceAddress; + homeServiceAddress = lib.mkIf isHome homeServiceAddress; }; }; @@ -16672,7 +16786,8 @@ or 2) use classic path addressing =aws s3 cp s3:/// [service2 ...]" >&2 + echo "Example: $0 hintbooth hosts/nixos/x86_64-linux adguardhome nginx" >&2 + exit 1 + fi + + HOST="$1" + ARCH_PATH="$2" + shift 2 + + for service in "$@"; do + cat <