mirror of
https://github.com/Swarsel/.dotfiles.git
synced 2025-12-06 09:07:21 +01:00
feat: Add automatic formatting for .nix files
This commit is contained in:
Swarsel
parent
9dc9a1fe1b
commit
72d321f478
GPG key ID:
26A54C31F2A4FD84
46 changed files with 3204 additions and 3164 deletions
|
|
@ -1,41 +1,43 @@
|
|||
{ pkgs, modulesPath, ... }:
|
||||
{
|
||||
pkgs,
|
||||
modulesPath,
|
||||
...
|
||||
}: {
|
||||
imports = [
|
||||
(modulesPath + "/virtualisation/proxmox-lxc.nix")
|
||||
];
|
||||
|
||||
{
|
||||
imports = [
|
||||
(modulesPath + "/virtualisation/proxmox-lxc.nix")
|
||||
];
|
||||
environment.systemPackages = with pkgs; [
|
||||
git
|
||||
gnupg
|
||||
ssh-to-age
|
||||
];
|
||||
|
||||
environment.systemPackages = with pkgs; [
|
||||
git
|
||||
gnupg
|
||||
ssh-to-age
|
||||
];
|
||||
services.xserver = {
|
||||
layout = "us";
|
||||
xkbVariant = "altgr-intl";
|
||||
};
|
||||
|
||||
services.xserver = {
|
||||
layout = "us";
|
||||
xkbVariant = "altgr-intl";
|
||||
};
|
||||
nix.settings.experimental-features = ["nix-command" "flakes"];
|
||||
|
||||
nix.settings.experimental-features = ["nix-command" "flakes"];
|
||||
proxmoxLXC = {
|
||||
manageNetwork = true; # manage network myself
|
||||
manageHostName = false; # manage hostname myself
|
||||
};
|
||||
networking = {
|
||||
hostName = "TEMPLATE"; # Define your hostname.
|
||||
useDHCP = true;
|
||||
enableIPv6 = false;
|
||||
firewall.enable = false;
|
||||
};
|
||||
services.openssh = {
|
||||
enable = true;
|
||||
settings.PermitRootLogin = "yes";
|
||||
};
|
||||
users.users.root.openssh.authorizedKeys.keyFiles = [
|
||||
../../../secrets/keys/authorized_keys
|
||||
];
|
||||
# users.users.root.password = "TEMPLATE";
|
||||
|
||||
proxmoxLXC = {
|
||||
manageNetwork = true; # manage network myself
|
||||
manageHostName = false; # manage hostname myself
|
||||
};
|
||||
networking = {
|
||||
hostName = "TEMPLATE"; # Define your hostname.
|
||||
useDHCP = true;
|
||||
enableIPv6 = false;
|
||||
firewall.enable = false;
|
||||
};
|
||||
services.openssh = {
|
||||
enable = true;
|
||||
settings.PermitRootLogin = "yes";
|
||||
};
|
||||
users.users.root.openssh.authorizedKeys.keyFiles = [
|
||||
../../../secrets/keys/authorized_keys
|
||||
];
|
||||
# users.users.root.password = "TEMPLATE";
|
||||
|
||||
system.stateVersion = "23.05"; # TEMPLATE - but probably no need to change
|
||||
}
|
||||
system.stateVersion = "23.05"; # TEMPLATE - but probably no need to change
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,22 +1,20 @@
|
|||
# Do not modify this file! It was generated by ‘nixos-generate-config’
|
||||
# and may be overwritten by future invocations. Please make changes
|
||||
# to /etc/nixos/configuration.nix instead.
|
||||
{ lib, ... }:
|
||||
{lib, ...}: {
|
||||
imports = [];
|
||||
|
||||
{
|
||||
imports = [ ];
|
||||
boot.initrd.availableKernelModules = ["ahci" "xhci_pci" "vfio_pci" "usbhid"];
|
||||
boot.initrd.kernelModules = [];
|
||||
boot.kernelModules = ["kvm-intel"];
|
||||
boot.extraModulePackages = [];
|
||||
|
||||
boot.initrd.availableKernelModules = [ "ahci" "xhci_pci" "vfio_pci" "usbhid" ];
|
||||
boot.initrd.kernelModules = [ ];
|
||||
boot.kernelModules = [ "kvm-intel" ];
|
||||
boot.extraModulePackages = [ ];
|
||||
fileSystems."/" = {
|
||||
device = "/dev/mapper/pve-vm--120--disk--0";
|
||||
fsType = "ext4";
|
||||
};
|
||||
|
||||
fileSystems."/" =
|
||||
{ device = "/dev/mapper/pve-vm--120--disk--0";
|
||||
fsType = "ext4";
|
||||
};
|
||||
|
||||
swapDevices = [ ];
|
||||
swapDevices = [];
|
||||
|
||||
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
|
||||
# (the default) this is the recommended approach. When using systemd-networkd it's
|
||||
|
|
|
|||
|
|
@ -1,70 +1,71 @@
|
|||
{ config, pkgs, modulesPath, ... }:
|
||||
{
|
||||
config,
|
||||
pkgs,
|
||||
modulesPath,
|
||||
...
|
||||
}: {
|
||||
imports = [
|
||||
(modulesPath + "/virtualisation/proxmox-lxc.nix")
|
||||
./hardware-configuration.nix
|
||||
];
|
||||
|
||||
{
|
||||
imports = [
|
||||
(modulesPath + "/virtualisation/proxmox-lxc.nix")
|
||||
./hardware-configuration.nix
|
||||
environment.systemPackages = with pkgs; [
|
||||
git
|
||||
gnupg
|
||||
ssh-to-age
|
||||
calibre
|
||||
];
|
||||
|
||||
users.groups.lxc_shares = {
|
||||
gid = 10000;
|
||||
members = [
|
||||
"kavita"
|
||||
"calibre-web"
|
||||
"root"
|
||||
];
|
||||
};
|
||||
|
||||
environment.systemPackages = with pkgs; [
|
||||
git
|
||||
gnupg
|
||||
ssh-to-age
|
||||
calibre
|
||||
];
|
||||
services.xserver = {
|
||||
layout = "us";
|
||||
xkbVariant = "altgr-intl";
|
||||
};
|
||||
|
||||
users.groups.lxc_shares = {
|
||||
gid = 10000;
|
||||
members = [
|
||||
"kavita"
|
||||
"calibre-web"
|
||||
"root"
|
||||
];
|
||||
};
|
||||
nix.settings.experimental-features = ["nix-command" "flakes"];
|
||||
|
||||
services.xserver = {
|
||||
layout = "us";
|
||||
xkbVariant = "altgr-intl";
|
||||
};
|
||||
sops = {
|
||||
age.sshKeyPaths = ["/etc/ssh/sops"];
|
||||
defaultSopsFile = "/.dotfiles/secrets/calibre/secrets.yaml";
|
||||
validateSopsFiles = false;
|
||||
secrets.kavita = {owner = "kavita";};
|
||||
};
|
||||
proxmoxLXC = {
|
||||
manageNetwork = true; # manage network myself
|
||||
manageHostName = false; # manage hostname myself
|
||||
};
|
||||
networking = {
|
||||
hostName = "calibre"; # Define your hostname.
|
||||
useDHCP = true;
|
||||
enableIPv6 = false;
|
||||
firewall.enable = false;
|
||||
};
|
||||
services.openssh = {
|
||||
enable = true;
|
||||
settings.PermitRootLogin = "yes";
|
||||
};
|
||||
users.users.root.openssh.authorizedKeys.keyFiles = [
|
||||
../../../secrets/keys/authorized_keys
|
||||
];
|
||||
|
||||
nix.settings.experimental-features = ["nix-command" "flakes"];
|
||||
system.stateVersion = "23.05"; # TEMPLATE - but probably no need to change
|
||||
|
||||
sops = {
|
||||
age.sshKeyPaths = [ "/etc/ssh/sops" ];
|
||||
defaultSopsFile = "/.dotfiles/secrets/calibre/secrets.yaml";
|
||||
validateSopsFiles = false;
|
||||
secrets.kavita = { owner = "kavita";};
|
||||
};
|
||||
proxmoxLXC = {
|
||||
manageNetwork = true; # manage network myself
|
||||
manageHostName = false; # manage hostname myself
|
||||
};
|
||||
networking = {
|
||||
hostName = "calibre"; # Define your hostname.
|
||||
useDHCP = true;
|
||||
enableIPv6 = false;
|
||||
firewall.enable = false;
|
||||
};
|
||||
services.openssh = {
|
||||
enable = true;
|
||||
settings.PermitRootLogin = "yes";
|
||||
};
|
||||
users.users.root.openssh.authorizedKeys.keyFiles = [
|
||||
../../../secrets/keys/authorized_keys
|
||||
];
|
||||
environment.shellAliases = {
|
||||
nswitch = "cd /.dotfiles; git pull; nixos-rebuild --flake .#$(hostname) switch; cd -;";
|
||||
};
|
||||
|
||||
system.stateVersion = "23.05"; # TEMPLATE - but probably no need to change
|
||||
|
||||
environment.shellAliases = {
|
||||
nswitch = "cd /.dotfiles; git pull; nixos-rebuild --flake .#$(hostname) switch; cd -;";
|
||||
};
|
||||
|
||||
services.kavita = {
|
||||
enable = true;
|
||||
user = "kavita";
|
||||
port = 8080;
|
||||
tokenKeyFile = config.sops.secrets.kavita.path;
|
||||
};
|
||||
|
||||
|
||||
}
|
||||
services.kavita = {
|
||||
enable = true;
|
||||
user = "kavita";
|
||||
port = 8080;
|
||||
tokenKeyFile = config.sops.secrets.kavita.path;
|
||||
};
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,27 +1,25 @@
|
|||
# Do not modify this file! It was generated by ‘nixos-generate-config’
|
||||
# and may be overwritten by future invocations. Please make changes
|
||||
# to /etc/nixos/configuration.nix instead.
|
||||
{ lib, ... }:
|
||||
{lib, ...}: {
|
||||
imports = [];
|
||||
|
||||
{
|
||||
imports = [ ];
|
||||
boot.initrd.availableKernelModules = ["ahci" "xhci_pci" "vfio_pci" "usbhid"];
|
||||
boot.initrd.kernelModules = [];
|
||||
boot.kernelModules = ["kvm-intel"];
|
||||
boot.extraModulePackages = [];
|
||||
|
||||
boot.initrd.availableKernelModules = [ "ahci" "xhci_pci" "vfio_pci" "usbhid" ];
|
||||
boot.initrd.kernelModules = [ ];
|
||||
boot.kernelModules = [ "kvm-intel" ];
|
||||
boot.extraModulePackages = [ ];
|
||||
fileSystems."/" = {
|
||||
device = "/dev/mapper/pve-vm--121--disk--0";
|
||||
fsType = "ext4";
|
||||
};
|
||||
|
||||
fileSystems."/" =
|
||||
{ device = "/dev/mapper/pve-vm--121--disk--0";
|
||||
fsType = "ext4";
|
||||
};
|
||||
fileSystems."/media/Videos" = {
|
||||
device = "//192.168.1.3/Eternor";
|
||||
fsType = "cifs";
|
||||
};
|
||||
|
||||
fileSystems."/media/Videos" =
|
||||
{ device = "//192.168.1.3/Eternor";
|
||||
fsType = "cifs";
|
||||
};
|
||||
|
||||
swapDevices = [ ];
|
||||
swapDevices = [];
|
||||
|
||||
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
|
||||
# (the default) this is the recommended approach. When using systemd-networkd it's
|
||||
|
|
|
|||
|
|
@ -1,6 +1,9 @@
|
|||
{ config, pkgs, modulesPath, ... }:
|
||||
|
||||
{
|
||||
config,
|
||||
pkgs,
|
||||
modulesPath,
|
||||
...
|
||||
}: {
|
||||
imports = [
|
||||
(modulesPath + "/virtualisation/proxmox-lxc.nix")
|
||||
./hardware-configuration.nix
|
||||
|
|
@ -21,7 +24,7 @@
|
|||
};
|
||||
|
||||
users.users.jellyfin = {
|
||||
extraGroups = [ "video" "render" ];
|
||||
extraGroups = ["video" "render"];
|
||||
};
|
||||
|
||||
services.xserver = {
|
||||
|
|
@ -56,13 +59,13 @@
|
|||
};
|
||||
|
||||
nixpkgs.config.packageOverrides = pkgs: {
|
||||
vaapiIntel = pkgs.vaapiIntel.override { enableHybridCodec = true; };
|
||||
vaapiIntel = pkgs.vaapiIntel.override {enableHybridCodec = true;};
|
||||
};
|
||||
hardware.graphics = {
|
||||
enable = true;
|
||||
extraPackages = with pkgs; [
|
||||
intel-media-driver # LIBVA_DRIVER_NAME=iHD
|
||||
vaapiIntel # LIBVA_DRIVER_NAME=i965 (older but works better for Firefox/Chromium)
|
||||
vaapiIntel # LIBVA_DRIVER_NAME=i965 (older but works better for Firefox/Chromium)
|
||||
vaapiVdpau
|
||||
libvdpau-va-gl
|
||||
];
|
||||
|
|
@ -73,5 +76,4 @@
|
|||
user = "jellyfin";
|
||||
# openFirewall = true; # this works only for the default ports
|
||||
};
|
||||
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,22 +1,20 @@
|
|||
# Do not modify this file! It was generated by ‘nixos-generate-config’
|
||||
# and may be overwritten by future invocations. Please make changes
|
||||
# to /etc/nixos/configuration.nix instead.
|
||||
{ lib, ... }:
|
||||
{lib, ...}: {
|
||||
imports = [];
|
||||
|
||||
{
|
||||
imports = [ ];
|
||||
boot.initrd.availableKernelModules = ["ahci" "xhci_pci" "vfio_pci" "usbhid"];
|
||||
boot.initrd.kernelModules = [];
|
||||
boot.kernelModules = ["kvm-intel"];
|
||||
boot.extraModulePackages = [];
|
||||
|
||||
boot.initrd.availableKernelModules = [ "ahci" "xhci_pci" "vfio_pci" "usbhid" ];
|
||||
boot.initrd.kernelModules = [ ];
|
||||
boot.kernelModules = [ "kvm-intel" ];
|
||||
boot.extraModulePackages = [ ];
|
||||
fileSystems."/" = {
|
||||
device = "/dev/mapper/pve-vm--102--disk--0";
|
||||
fsType = "ext4";
|
||||
};
|
||||
|
||||
fileSystems."/" =
|
||||
{ device = "/dev/mapper/pve-vm--102--disk--0";
|
||||
fsType = "ext4";
|
||||
};
|
||||
|
||||
swapDevices = [ ];
|
||||
swapDevices = [];
|
||||
|
||||
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
|
||||
# (the default) this is the recommended approach. When using systemd-networkd it's
|
||||
|
|
|
|||
|
|
@ -1,8 +1,12 @@
|
|||
{ config, pkgs, modulesPath, sops, ... }: let
|
||||
{
|
||||
config,
|
||||
pkgs,
|
||||
modulesPath,
|
||||
sops,
|
||||
...
|
||||
}: let
|
||||
matrixDomain = "matrix2.swarsel.win";
|
||||
in {
|
||||
|
||||
|
||||
services = {
|
||||
xserver = {
|
||||
layout = "us";
|
||||
|
|
@ -11,35 +15,36 @@ in {
|
|||
openssh = {
|
||||
enable = true;
|
||||
settings.PermitRootLogin = "yes";
|
||||
listenAddresses = [{
|
||||
port = 22;
|
||||
addr = "0.0.0.0";
|
||||
}];
|
||||
listenAddresses = [
|
||||
{
|
||||
port = 22;
|
||||
addr = "0.0.0.0";
|
||||
}
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
|
||||
nix.settings.experimental-features = ["nix-command" "flakes"];
|
||||
|
||||
|
||||
proxmoxLXC = {
|
||||
manageNetwork = true; # manage network myself
|
||||
manageHostName = false; # manage hostname myself
|
||||
};
|
||||
|
||||
|
||||
networking = {
|
||||
useDHCP = true;
|
||||
enableIPv6 = false;
|
||||
};
|
||||
|
||||
|
||||
users.users.root.openssh.authorizedKeys.keyFiles = [
|
||||
../../../secrets/keys/authorized_keys
|
||||
];
|
||||
|
||||
|
||||
system.stateVersion = "23.05"; # TEMPLATE - but probably no need to change
|
||||
|
||||
|
||||
environment.shellAliases = {
|
||||
nswitch = "cd /.dotfiles; git pull; nixos-rebuild --flake .#$(hostname) switch; cd -;";
|
||||
};
|
||||
|
||||
|
||||
imports = [
|
||||
(modulesPath + "/virtualisation/proxmox-lxc.nix")
|
||||
|
|
@ -62,25 +67,25 @@ in {
|
|||
];
|
||||
|
||||
sops = {
|
||||
age.sshKeyPaths = [ "/etc/ssh/sops" ];
|
||||
age.sshKeyPaths = ["/etc/ssh/sops"];
|
||||
defaultSopsFile = "/.dotfiles/secrets/matrix/secrets.yaml";
|
||||
validateSopsFiles = false;
|
||||
secrets = {
|
||||
matrixsharedsecret = {owner="matrix-synapse";};
|
||||
mautrixtelegram_as = {owner="matrix-synapse";};
|
||||
mautrixtelegram_hs = {owner="matrix-synapse";};
|
||||
mautrixtelegram_api_id = {owner="matrix-synapse";};
|
||||
mautrixtelegram_api_hash = {owner="matrix-synapse";};
|
||||
matrixsharedsecret = {owner = "matrix-synapse";};
|
||||
mautrixtelegram_as = {owner = "matrix-synapse";};
|
||||
mautrixtelegram_hs = {owner = "matrix-synapse";};
|
||||
mautrixtelegram_api_id = {owner = "matrix-synapse";};
|
||||
mautrixtelegram_api_hash = {owner = "matrix-synapse";};
|
||||
};
|
||||
templates = {
|
||||
"matrix_user_register.sh".content = ''
|
||||
register_new_matrix_user -k ${config.sops.placeholder.matrixsharedsecret} http://localhost:8008
|
||||
'';
|
||||
register_new_matrix_user -k ${config.sops.placeholder.matrixsharedsecret} http://localhost:8008
|
||||
'';
|
||||
matrixshared = {
|
||||
owner = "matrix-synapse";
|
||||
content = ''
|
||||
registration_shared_secret: ${config.sops.placeholder.matrixsharedsecret}
|
||||
'';
|
||||
'';
|
||||
};
|
||||
mautrixtelegram = {
|
||||
owner = "matrix-synapse";
|
||||
|
|
@ -89,7 +94,7 @@ in {
|
|||
MAUTRIX_TELEGRAM_APPSERVICE_HS_TOKEN=${config.sops.placeholder.mautrixtelegram_hs}
|
||||
MAUTRIX_TELEGRAM_TELEGRAM_API_ID=${config.sops.placeholder.mautrixtelegram_api_id}
|
||||
MAUTRIX_TELEGRAM_TELEGRAM_API_HASH=${config.sops.placeholder.mautrixtelegram_api_hash}
|
||||
'';
|
||||
'';
|
||||
};
|
||||
};
|
||||
};
|
||||
|
|
@ -97,27 +102,27 @@ in {
|
|||
services.postgresql = {
|
||||
enable = true;
|
||||
initialScript = pkgs.writeText "synapse-init.sql" ''
|
||||
CREATE ROLE "matrix-synapse" WITH LOGIN PASSWORD 'synapse';
|
||||
CREATE DATABASE "matrix-synapse" WITH OWNER "matrix-synapse"
|
||||
TEMPLATE template0
|
||||
LC_COLLATE = "C"
|
||||
LC_CTYPE = "C";
|
||||
CREATE ROLE "mautrix-telegram" WITH LOGIN PASSWORD 'telegram';
|
||||
CREATE DATABASE "mautrix-telegram" WITH OWNER "mautrix-telegram"
|
||||
TEMPLATE template0
|
||||
LC_COLLATE = "C"
|
||||
LC_CTYPE = "C";
|
||||
CREATE ROLE "mautrix-whatsapp" WITH LOGIN PASSWORD 'whatsapp';
|
||||
CREATE DATABASE "mautrix-whatsapp" WITH OWNER "mautrix-whatsapp"
|
||||
TEMPLATE template0
|
||||
LC_COLLATE = "C"
|
||||
LC_CTYPE = "C";
|
||||
CREATE ROLE "mautrix-signal" WITH LOGIN PASSWORD 'signal';
|
||||
CREATE DATABASE "mautrix-signal" WITH OWNER "mautrix-signal"
|
||||
TEMPLATE template0
|
||||
LC_COLLATE = "C"
|
||||
LC_CTYPE = "C";
|
||||
'';
|
||||
CREATE ROLE "matrix-synapse" WITH LOGIN PASSWORD 'synapse';
|
||||
CREATE DATABASE "matrix-synapse" WITH OWNER "matrix-synapse"
|
||||
TEMPLATE template0
|
||||
LC_COLLATE = "C"
|
||||
LC_CTYPE = "C";
|
||||
CREATE ROLE "mautrix-telegram" WITH LOGIN PASSWORD 'telegram';
|
||||
CREATE DATABASE "mautrix-telegram" WITH OWNER "mautrix-telegram"
|
||||
TEMPLATE template0
|
||||
LC_COLLATE = "C"
|
||||
LC_CTYPE = "C";
|
||||
CREATE ROLE "mautrix-whatsapp" WITH LOGIN PASSWORD 'whatsapp';
|
||||
CREATE DATABASE "mautrix-whatsapp" WITH OWNER "mautrix-whatsapp"
|
||||
TEMPLATE template0
|
||||
LC_COLLATE = "C"
|
||||
LC_CTYPE = "C";
|
||||
CREATE ROLE "mautrix-signal" WITH LOGIN PASSWORD 'signal';
|
||||
CREATE DATABASE "mautrix-signal" WITH OWNER "mautrix-signal"
|
||||
TEMPLATE template0
|
||||
LC_COLLATE = "C"
|
||||
LC_CTYPE = "C";
|
||||
'';
|
||||
};
|
||||
|
||||
services.matrix-synapse = {
|
||||
|
|
@ -132,14 +137,15 @@ in {
|
|||
server_name = matrixDomain;
|
||||
public_baseurl = "https://${matrixDomain}";
|
||||
listeners = [
|
||||
{ port = 8008;
|
||||
bind_addresses = [ "0.0.0.0" ];
|
||||
{
|
||||
port = 8008;
|
||||
bind_addresses = ["0.0.0.0"];
|
||||
type = "http";
|
||||
tls = false;
|
||||
x_forwarded = true;
|
||||
resources = [
|
||||
{
|
||||
names = [ "client" "federation" ];
|
||||
names = ["client" "federation"];
|
||||
compress = true;
|
||||
}
|
||||
];
|
||||
|
|
@ -160,7 +166,7 @@ in {
|
|||
domain = matrixDomain;
|
||||
};
|
||||
appservice = {
|
||||
address= "http://localhost:29317";
|
||||
address = "http://localhost:29317";
|
||||
hostname = "0.0.0.0";
|
||||
port = "29317";
|
||||
provisioning.enabled = true;
|
||||
|
|
@ -189,16 +195,16 @@ in {
|
|||
args = {
|
||||
width = 256;
|
||||
height = 256;
|
||||
fps = 30; # only for webm
|
||||
background = "020202"; # only for gif, transparency not supported
|
||||
fps = 30; # only for webm
|
||||
background = "020202"; # only for gif, transparency not supported
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
systemd.services.mautrix-telegram.path = with pkgs; [
|
||||
lottieconverter # for animated stickers conversion, unfree package
|
||||
ffmpeg # if converting animated stickers to webm (very slow!)
|
||||
lottieconverter # for animated stickers conversion, unfree package
|
||||
ffmpeg # if converting animated stickers to webm (very slow!)
|
||||
];
|
||||
|
||||
services.mautrix-whatsapp = {
|
||||
|
|
@ -209,7 +215,7 @@ in {
|
|||
domain = matrixDomain;
|
||||
};
|
||||
appservice = {
|
||||
address= "http://localhost:29318";
|
||||
address = "http://localhost:29318";
|
||||
hostname = "0.0.0.0";
|
||||
port = 29318;
|
||||
database = {
|
||||
|
|
@ -255,8 +261,7 @@ in {
|
|||
domain = matrixDomain;
|
||||
};
|
||||
appservice = {
|
||||
|
||||
address= "http://localhost:29328";
|
||||
address = "http://localhost:29328";
|
||||
hostname = "0.0.0.0";
|
||||
port = 29328;
|
||||
database = {
|
||||
|
|
@ -282,7 +287,7 @@ in {
|
|||
# messages out after a while.
|
||||
|
||||
systemd.timers."restart-bridges" = {
|
||||
wantedBy = [ "timers.target" ];
|
||||
wantedBy = ["timers.target"];
|
||||
timerConfig = {
|
||||
OnBootSec = "1d";
|
||||
OnUnitActiveSec = "1d";
|
||||
|
|
@ -292,14 +297,13 @@ in {
|
|||
|
||||
systemd.services."restart-bridges" = {
|
||||
script = ''
|
||||
systemctl restart mautrix-whatsapp.service
|
||||
systemctl restart mautrix-signal.service
|
||||
systemctl restart mautrix-telegram.service
|
||||
'';
|
||||
systemctl restart mautrix-whatsapp.service
|
||||
systemctl restart mautrix-signal.service
|
||||
systemctl restart mautrix-telegram.service
|
||||
'';
|
||||
serviceConfig = {
|
||||
Type = "oneshot";
|
||||
User = "root";
|
||||
};
|
||||
};
|
||||
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,22 +1,20 @@
|
|||
# Do not modify this file! It was generated by ‘nixos-generate-config’
|
||||
# and may be overwritten by future invocations. Please make changes
|
||||
# to /etc/nixos/configuration.nix instead.
|
||||
{ lib, ... }:
|
||||
{lib, ...}: {
|
||||
imports = [];
|
||||
|
||||
{
|
||||
imports = [ ];
|
||||
boot.initrd.availableKernelModules = ["ahci" "xhci_pci" "vfio_pci" "usbhid"];
|
||||
boot.initrd.kernelModules = [];
|
||||
boot.kernelModules = ["kvm-intel"];
|
||||
boot.extraModulePackages = [];
|
||||
|
||||
boot.initrd.availableKernelModules = [ "ahci" "xhci_pci" "vfio_pci" "usbhid" ];
|
||||
boot.initrd.kernelModules = [ ];
|
||||
boot.kernelModules = [ "kvm-intel" ];
|
||||
boot.extraModulePackages = [ ];
|
||||
fileSystems."/" = {
|
||||
device = "/dev/mapper/pve-vm--119--disk--0";
|
||||
fsType = "ext4";
|
||||
};
|
||||
|
||||
fileSystems."/" =
|
||||
{ device = "/dev/mapper/pve-vm--119--disk--0";
|
||||
fsType = "ext4";
|
||||
};
|
||||
|
||||
swapDevices = [ ];
|
||||
swapDevices = [];
|
||||
|
||||
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
|
||||
# (the default) this is the recommended approach. When using systemd-networkd it's
|
||||
|
|
|
|||
|
|
@ -1,5 +1,9 @@
|
|||
{ config, pkgs, modulesPath, ... }:
|
||||
{
|
||||
config,
|
||||
pkgs,
|
||||
modulesPath,
|
||||
...
|
||||
}: {
|
||||
imports = [
|
||||
(modulesPath + "/virtualisation/proxmox-lxc.nix")
|
||||
./hardware-configuration.nix
|
||||
|
|
@ -21,12 +25,12 @@
|
|||
nix.settings.experimental-features = ["nix-command" "flakes"];
|
||||
|
||||
sops = {
|
||||
age.sshKeyPaths = [ "/etc/ssh/sops" ];
|
||||
age.sshKeyPaths = ["/etc/ssh/sops"];
|
||||
defaultSopsFile = "/.dotfiles/secrets/nginx/secrets.yaml";
|
||||
validateSopsFiles = false;
|
||||
secrets.dnstokenfull = {owner="acme";};
|
||||
secrets.dnstokenfull = {owner = "acme";};
|
||||
templates."certs.secret".content = ''
|
||||
CF_DNS_API_TOKEN=${config.sops.placeholder.dnstokenfull}
|
||||
CF_DNS_API_TOKEN=${config.sops.placeholder.dnstokenfull}
|
||||
'';
|
||||
};
|
||||
proxmoxLXC = {
|
||||
|
|
@ -69,7 +73,6 @@
|
|||
recommendedOptimisation = true;
|
||||
recommendedGzipSettings = true;
|
||||
virtualHosts = {
|
||||
|
||||
"stash.swarsel.win" = {
|
||||
enableACME = true;
|
||||
forceSSL = true;
|
||||
|
|
@ -79,7 +82,7 @@
|
|||
proxyPass = "https://192.168.1.5";
|
||||
extraConfig = ''
|
||||
client_max_body_size 0;
|
||||
'';
|
||||
'';
|
||||
};
|
||||
# "/push/" = {
|
||||
# proxyPass = "http://192.168.2.5:7867";
|
||||
|
|
@ -101,13 +104,12 @@
|
|||
"~ ^(/_matrix|/_synapse/client)" = {
|
||||
proxyPass = "http://192.168.1.23:8008";
|
||||
extraConfig = ''
|
||||
client_max_body_size 0;
|
||||
'';
|
||||
client_max_body_size 0;
|
||||
'';
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
|
||||
"sound.swarsel.win" = {
|
||||
enableACME = true;
|
||||
forceSSL = true;
|
||||
|
|
@ -117,13 +119,13 @@
|
|||
proxyPass = "http://192.168.1.13:4040";
|
||||
proxyWebsockets = true;
|
||||
extraConfig = ''
|
||||
proxy_redirect http:// https://;
|
||||
proxy_read_timeout 600s;
|
||||
proxy_send_timeout 600s;
|
||||
proxy_buffering off;
|
||||
proxy_request_buffering off;
|
||||
client_max_body_size 0;
|
||||
'';
|
||||
proxy_redirect http:// https://;
|
||||
proxy_read_timeout 600s;
|
||||
proxy_send_timeout 600s;
|
||||
proxy_buffering off;
|
||||
proxy_request_buffering off;
|
||||
client_max_body_size 0;
|
||||
'';
|
||||
};
|
||||
};
|
||||
};
|
||||
|
|
@ -136,8 +138,8 @@
|
|||
"/" = {
|
||||
proxyPass = "http://192.168.1.24:28981";
|
||||
extraConfig = ''
|
||||
client_max_body_size 0;
|
||||
'';
|
||||
client_max_body_size 0;
|
||||
'';
|
||||
};
|
||||
};
|
||||
};
|
||||
|
|
@ -150,8 +152,8 @@
|
|||
"/" = {
|
||||
proxyPass = "http://192.168.1.16:8096";
|
||||
extraConfig = ''
|
||||
client_max_body_size 0;
|
||||
'';
|
||||
client_max_body_size 0;
|
||||
'';
|
||||
};
|
||||
};
|
||||
};
|
||||
|
|
@ -164,8 +166,8 @@
|
|||
"~ ^(/_matrix|/_synapse/client)" = {
|
||||
proxyPass = "http://192.168.1.20:8008";
|
||||
extraConfig = ''
|
||||
client_max_body_size 0;
|
||||
'';
|
||||
client_max_body_size 0;
|
||||
'';
|
||||
};
|
||||
};
|
||||
};
|
||||
|
|
@ -178,8 +180,8 @@
|
|||
"/" = {
|
||||
proxyPass = "http://192.168.1.22:8080";
|
||||
extraConfig = ''
|
||||
client_max_body_size 0;
|
||||
'';
|
||||
client_max_body_size 0;
|
||||
'';
|
||||
};
|
||||
};
|
||||
};
|
||||
|
|
@ -192,13 +194,11 @@
|
|||
"/" = {
|
||||
proxyPass = "https://192.168.1.7";
|
||||
extraConfig = ''
|
||||
client_max_body_size 0;
|
||||
'';
|
||||
client_max_body_size 0;
|
||||
'';
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
};
|
||||
};
|
||||
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,22 +1,20 @@
|
|||
# Do not modify this file! It was generated by ‘nixos-generate-config’
|
||||
# and may be overwritten by future invocations. Please make changes
|
||||
# to /etc/nixos/configuration.nix instead.
|
||||
{ lib, ... }:
|
||||
{lib, ...}: {
|
||||
imports = [];
|
||||
|
||||
{
|
||||
imports = [ ];
|
||||
boot.initrd.availableKernelModules = ["ahci" "xhci_pci" "vfio_pci" "usbhid"];
|
||||
boot.initrd.kernelModules = [];
|
||||
boot.kernelModules = ["kvm-intel"];
|
||||
boot.extraModulePackages = [];
|
||||
|
||||
boot.initrd.availableKernelModules = [ "ahci" "xhci_pci" "vfio_pci" "usbhid" ];
|
||||
boot.initrd.kernelModules = [ ];
|
||||
boot.kernelModules = [ "kvm-intel" ];
|
||||
boot.extraModulePackages = [ ];
|
||||
fileSystems."/" = {
|
||||
device = "/dev/mapper/pve-vm--117--disk--0";
|
||||
fsType = "ext4";
|
||||
};
|
||||
|
||||
fileSystems."/" =
|
||||
{ device = "/dev/mapper/pve-vm--117--disk--0";
|
||||
fsType = "ext4";
|
||||
};
|
||||
|
||||
swapDevices = [ ];
|
||||
swapDevices = [];
|
||||
|
||||
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
|
||||
# (the default) this is the recommended approach. When using systemd-networkd it's
|
||||
|
|
|
|||
|
|
@ -1,14 +1,14 @@
|
|||
{ config, pkgs, modulesPath, ... }:
|
||||
|
||||
{
|
||||
|
||||
config,
|
||||
pkgs,
|
||||
modulesPath,
|
||||
...
|
||||
}: {
|
||||
imports = [
|
||||
(modulesPath + "/virtualisation/proxmox-lxc.nix")
|
||||
./hardware-configuration.nix
|
||||
];
|
||||
|
||||
|
||||
|
||||
|
||||
services = {
|
||||
xserver = {
|
||||
layout = "us";
|
||||
|
|
@ -17,36 +17,36 @@
|
|||
openssh = {
|
||||
enable = true;
|
||||
settings.PermitRootLogin = "yes";
|
||||
listenAddresses = [{
|
||||
port = 22;
|
||||
addr = "0.0.0.0";
|
||||
}];
|
||||
listenAddresses = [
|
||||
{
|
||||
port = 22;
|
||||
addr = "0.0.0.0";
|
||||
}
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
|
||||
nix.settings.experimental-features = ["nix-command" "flakes"];
|
||||
|
||||
|
||||
proxmoxLXC = {
|
||||
manageNetwork = true; # manage network myself
|
||||
manageHostName = false; # manage hostname myself
|
||||
};
|
||||
|
||||
|
||||
networking = {
|
||||
useDHCP = true;
|
||||
enableIPv6 = false;
|
||||
};
|
||||
|
||||
|
||||
users.users.root.openssh.authorizedKeys.keyFiles = [
|
||||
../../../secrets/keys/authorized_keys
|
||||
];
|
||||
|
||||
|
||||
system.stateVersion = "23.05"; # TEMPLATE - but probably no need to change
|
||||
|
||||
|
||||
environment.shellAliases = {
|
||||
nswitch = "cd /.dotfiles; git pull; nixos-rebuild --flake .#$(hostname) switch; cd -;";
|
||||
};
|
||||
|
||||
|
||||
|
||||
users.groups.lxc_shares = {
|
||||
gid = 10000;
|
||||
|
|
@ -68,10 +68,10 @@
|
|||
};
|
||||
|
||||
sops = {
|
||||
age.sshKeyPaths = [ "/etc/ssh/sops" ];
|
||||
age.sshKeyPaths = ["/etc/ssh/sops"];
|
||||
defaultSopsFile = "/root/.dotfiles/secrets/paperless/secrets.yaml";
|
||||
validateSopsFiles = false;
|
||||
secrets.admin = { owner = "paperless";};
|
||||
secrets.admin = {owner = "paperless";};
|
||||
};
|
||||
|
||||
services.paperless = {
|
||||
|
|
@ -90,5 +90,4 @@
|
|||
};
|
||||
};
|
||||
};
|
||||
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,28 +1,26 @@
|
|||
# Do not modify this file! It was generated by ‘nixos-generate-config’
|
||||
# and may be overwritten by future invocations. Please make changes
|
||||
# to /etc/nixos/configuration.nix instead.
|
||||
{ lib, ... }:
|
||||
{lib, ...}: {
|
||||
imports = [];
|
||||
|
||||
{
|
||||
imports = [ ];
|
||||
boot.initrd.availableKernelModules = ["ahci" "xhci_pci" "vfio_pci" "usbhid"];
|
||||
boot.initrd.kernelModules = [];
|
||||
boot.kernelModules = ["kvm-intel"];
|
||||
boot.extraModulePackages = [];
|
||||
|
||||
boot.initrd.availableKernelModules = [ "ahci" "xhci_pci" "vfio_pci" "usbhid" ];
|
||||
boot.initrd.kernelModules = [ ];
|
||||
boot.kernelModules = [ "kvm-intel" ];
|
||||
boot.extraModulePackages = [ ];
|
||||
fileSystems."/" = {
|
||||
device = "/mnt/data/images/118/vm-118-disk-0.raw";
|
||||
fsType = "ext4";
|
||||
options = ["loop"];
|
||||
};
|
||||
|
||||
fileSystems."/" =
|
||||
{ device = "/mnt/data/images/118/vm-118-disk-0.raw";
|
||||
fsType = "ext4";
|
||||
options = [ "loop" ];
|
||||
};
|
||||
fileSystems."/media" = {
|
||||
device = "//192.168.1.3/Eternor";
|
||||
fsType = "cifs";
|
||||
};
|
||||
|
||||
fileSystems."/media" =
|
||||
{ device = "//192.168.1.3/Eternor";
|
||||
fsType = "cifs";
|
||||
};
|
||||
|
||||
swapDevices = [ ];
|
||||
swapDevices = [];
|
||||
|
||||
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
|
||||
# (the default) this is the recommended approach. When using systemd-networkd it's
|
||||
|
|
|
|||
|
|
@ -1,14 +1,14 @@
|
|||
{ config, pkgs, modulesPath, ... }:
|
||||
|
||||
{
|
||||
|
||||
config,
|
||||
pkgs,
|
||||
modulesPath,
|
||||
...
|
||||
}: {
|
||||
imports = [
|
||||
(modulesPath + "/virtualisation/proxmox-lxc.nix")
|
||||
./hardware-configuration.nix
|
||||
];
|
||||
|
||||
|
||||
|
||||
|
||||
services = {
|
||||
xserver = {
|
||||
layout = "us";
|
||||
|
|
@ -17,36 +17,36 @@
|
|||
openssh = {
|
||||
enable = true;
|
||||
settings.PermitRootLogin = "yes";
|
||||
listenAddresses = [{
|
||||
port = 22;
|
||||
addr = "0.0.0.0";
|
||||
}];
|
||||
listenAddresses = [
|
||||
{
|
||||
port = 22;
|
||||
addr = "0.0.0.0";
|
||||
}
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
|
||||
nix.settings.experimental-features = ["nix-command" "flakes"];
|
||||
|
||||
|
||||
proxmoxLXC = {
|
||||
manageNetwork = true; # manage network myself
|
||||
manageHostName = false; # manage hostname myself
|
||||
};
|
||||
|
||||
|
||||
networking = {
|
||||
useDHCP = true;
|
||||
enableIPv6 = false;
|
||||
};
|
||||
|
||||
|
||||
users.users.root.openssh.authorizedKeys.keyFiles = [
|
||||
../../../secrets/keys/authorized_keys
|
||||
];
|
||||
|
||||
|
||||
system.stateVersion = "23.05"; # TEMPLATE - but probably no need to change
|
||||
|
||||
|
||||
environment.shellAliases = {
|
||||
nswitch = "cd /.dotfiles; git pull; nixos-rebuild --flake .#$(hostname) switch; cd -;";
|
||||
};
|
||||
|
||||
|
||||
|
||||
proxmoxLXC.privileged = true; # manage hostname myself
|
||||
|
||||
|
|
@ -73,13 +73,13 @@
|
|||
isSystemUser = true;
|
||||
uid = 61593;
|
||||
group = "navidrome";
|
||||
extraGroups = [ "audio" "utmp" ];
|
||||
extraGroups = ["audio" "utmp"];
|
||||
};
|
||||
|
||||
mpd = {
|
||||
isSystemUser = true;
|
||||
group = "mpd";
|
||||
extraGroups = [ "audio" "utmp" ];
|
||||
extraGroups = ["audio" "utmp"];
|
||||
};
|
||||
};
|
||||
};
|
||||
|
|
@ -103,10 +103,10 @@
|
|||
];
|
||||
|
||||
sops = {
|
||||
age.sshKeyPaths = [ "/etc/ssh/sops" ];
|
||||
age.sshKeyPaths = ["/etc/ssh/sops"];
|
||||
defaultSopsFile = "/.dotfiles/secrets/sound/secrets.yaml";
|
||||
validateSopsFiles = false;
|
||||
secrets.mpdpass = { owner = "mpd";};
|
||||
secrets.mpdpass = {owner = "mpd";};
|
||||
};
|
||||
|
||||
services.navidrome = {
|
||||
|
|
|
|||
|
|
@ -1,22 +1,20 @@
|
|||
# Do not modify this file! It was generated by ‘nixos-generate-config’
|
||||
# and may be overwritten by future invocations. Please make changes
|
||||
# to /etc/nixos/configuration.nix instead.
|
||||
{ lib, ... }:
|
||||
{lib, ...}: {
|
||||
imports = [];
|
||||
|
||||
{
|
||||
imports = [ ];
|
||||
boot.initrd.availableKernelModules = ["ahci" "xhci_pci" "vfio_pci" "usbhid"];
|
||||
boot.initrd.kernelModules = [];
|
||||
boot.kernelModules = ["kvm-intel"];
|
||||
boot.extraModulePackages = [];
|
||||
|
||||
boot.initrd.availableKernelModules = [ "ahci" "xhci_pci" "vfio_pci" "usbhid" ];
|
||||
boot.initrd.kernelModules = [ ];
|
||||
boot.kernelModules = [ "kvm-intel" ];
|
||||
boot.extraModulePackages = [ ];
|
||||
fileSystems."/" = {
|
||||
device = "/dev/mapper/pve-vm--123--disk--0";
|
||||
fsType = "ext4";
|
||||
};
|
||||
|
||||
fileSystems."/" =
|
||||
{ device = "/dev/mapper/pve-vm--123--disk--0";
|
||||
fsType = "ext4";
|
||||
};
|
||||
|
||||
swapDevices = [ ];
|
||||
swapDevices = [];
|
||||
|
||||
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
|
||||
# (the default) this is the recommended approach. When using systemd-networkd it's
|
||||
|
|
|
|||
|
|
@ -1,14 +1,13 @@
|
|||
{ pkgs, modulesPath, ... }:
|
||||
|
||||
{
|
||||
|
||||
pkgs,
|
||||
modulesPath,
|
||||
...
|
||||
}: {
|
||||
imports = [
|
||||
(modulesPath + "/virtualisation/proxmox-lxc.nix")
|
||||
./hardware-configuration.nix
|
||||
];
|
||||
|
||||
|
||||
|
||||
|
||||
services = {
|
||||
xserver = {
|
||||
layout = "us";
|
||||
|
|
@ -17,36 +16,36 @@
|
|||
openssh = {
|
||||
enable = true;
|
||||
settings.PermitRootLogin = "yes";
|
||||
listenAddresses = [{
|
||||
port = 22;
|
||||
addr = "0.0.0.0";
|
||||
}];
|
||||
listenAddresses = [
|
||||
{
|
||||
port = 22;
|
||||
addr = "0.0.0.0";
|
||||
}
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
|
||||
nix.settings.experimental-features = ["nix-command" "flakes"];
|
||||
|
||||
|
||||
proxmoxLXC = {
|
||||
manageNetwork = true; # manage network myself
|
||||
manageHostName = false; # manage hostname myself
|
||||
};
|
||||
|
||||
|
||||
networking = {
|
||||
useDHCP = true;
|
||||
enableIPv6 = false;
|
||||
};
|
||||
|
||||
|
||||
users.users.root.openssh.authorizedKeys.keyFiles = [
|
||||
../../../secrets/keys/authorized_keys
|
||||
];
|
||||
|
||||
|
||||
system.stateVersion = "23.05"; # TEMPLATE - but probably no need to change
|
||||
|
||||
|
||||
environment.shellAliases = {
|
||||
nswitch = "cd /.dotfiles; git pull; nixos-rebuild --flake .#$(hostname) switch; cd -;";
|
||||
};
|
||||
|
||||
|
||||
|
||||
proxmoxLXC.privileged = true; # manage hostname myself
|
||||
|
||||
|
|
@ -58,7 +57,7 @@
|
|||
isSystemUser = true;
|
||||
uid = 65136;
|
||||
group = "spotifyd";
|
||||
extraGroups = [ "audio" "utmp" ];
|
||||
extraGroups = ["audio" "utmp"];
|
||||
};
|
||||
|
||||
sound = {
|
||||
|
|
@ -89,5 +88,4 @@
|
|||
};
|
||||
};
|
||||
};
|
||||
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,22 +1,20 @@
|
|||
# Do not modify this file! It was generated by ‘nixos-generate-config’
|
||||
# and may be overwritten by future invocations. Please make changes
|
||||
# to /etc/nixos/configuration.nix instead.
|
||||
{ lib, ... }:
|
||||
{lib, ...}: {
|
||||
imports = [];
|
||||
|
||||
{
|
||||
imports = [ ];
|
||||
boot.initrd.availableKernelModules = ["ahci" "xhci_pci" "vfio_pci" "usbhid"];
|
||||
boot.initrd.kernelModules = [];
|
||||
boot.kernelModules = ["kvm-intel"];
|
||||
boot.extraModulePackages = [];
|
||||
|
||||
boot.initrd.availableKernelModules = [ "ahci" "xhci_pci" "vfio_pci" "usbhid" ];
|
||||
boot.initrd.kernelModules = [ ];
|
||||
boot.kernelModules = [ "kvm-intel" ];
|
||||
boot.extraModulePackages = [ ];
|
||||
fileSystems."/" = {
|
||||
device = "/dev/mapper/pve-vm--122--disk--0";
|
||||
fsType = "ext4";
|
||||
};
|
||||
|
||||
fileSystems."/" =
|
||||
{ device = "/dev/mapper/pve-vm--122--disk--0";
|
||||
fsType = "ext4";
|
||||
};
|
||||
|
||||
swapDevices = [ ];
|
||||
swapDevices = [];
|
||||
|
||||
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
|
||||
# (the default) this is the recommended approach. When using systemd-networkd it's
|
||||
|
|
|
|||
|
|
@ -1,6 +1,9 @@
|
|||
{ config, pkgs, modulesPath, ... }:
|
||||
|
||||
{
|
||||
config,
|
||||
pkgs,
|
||||
modulesPath,
|
||||
...
|
||||
}: {
|
||||
imports = [
|
||||
(modulesPath + "/virtualisation/proxmox-lxc.nix")
|
||||
./hardware-configuration.nix
|
||||
|
|
@ -45,12 +48,12 @@
|
|||
nix.settings.experimental-features = ["nix-command" "flakes"];
|
||||
|
||||
sops = {
|
||||
age.sshKeyPaths = [ "/etc/ssh/sops" ];
|
||||
age.sshKeyPaths = ["/etc/ssh/sops"];
|
||||
defaultSopsFile = "/.dotfiles/secrets/transmission/secrets.yaml";
|
||||
validateSopsFiles = false;
|
||||
};
|
||||
|
||||
boot.kernelModules = [ "tun" ];
|
||||
boot.kernelModules = ["tun"];
|
||||
proxmoxLXC = {
|
||||
manageNetwork = true; # manage network myself
|
||||
manageHostName = false; # manage hostname myself
|
||||
|
|
@ -83,38 +86,40 @@
|
|||
networking.iproute2 = {
|
||||
enable = true;
|
||||
rttablesExtraConfig = ''
|
||||
200 vpn
|
||||
'';
|
||||
200 vpn
|
||||
'';
|
||||
};
|
||||
environment.etc = {
|
||||
"openvpn/iptables.sh" =
|
||||
{ source = ../../../scripts/server1/iptables.sh;
|
||||
mode = "0755";
|
||||
};
|
||||
"openvpn/update-resolv-conf" =
|
||||
{ source = ../../../scripts/server1/update-resolv-conf;
|
||||
mode = "0755";
|
||||
};
|
||||
"openvpn/routing.sh" =
|
||||
{ source = ../../../scripts/server1/routing.sh;
|
||||
mode = "0755";
|
||||
};
|
||||
"openvpn/ca.rsa.2048.crt" =
|
||||
{ source = ../../../secrets/certs/ca.rsa.2048.crt;
|
||||
mode = "0644";
|
||||
};
|
||||
"openvpn/crl.rsa.2048.pem" =
|
||||
{ source = ../../../secrets/certs/crl.rsa.2048.pem;
|
||||
mode = "0644";
|
||||
};
|
||||
"openvpn/iptables.sh" = {
|
||||
source = ../../../scripts/server1/iptables.sh;
|
||||
mode = "0755";
|
||||
};
|
||||
"openvpn/update-resolv-conf" = {
|
||||
source = ../../../scripts/server1/update-resolv-conf;
|
||||
mode = "0755";
|
||||
};
|
||||
"openvpn/routing.sh" = {
|
||||
source = ../../../scripts/server1/routing.sh;
|
||||
mode = "0755";
|
||||
};
|
||||
"openvpn/ca.rsa.2048.crt" = {
|
||||
source = ../../../secrets/certs/ca.rsa.2048.crt;
|
||||
mode = "0644";
|
||||
};
|
||||
"openvpn/crl.rsa.2048.pem" = {
|
||||
source = ../../../secrets/certs/crl.rsa.2048.pem;
|
||||
mode = "0644";
|
||||
};
|
||||
};
|
||||
services.openssh = {
|
||||
enable = true;
|
||||
settings.PermitRootLogin = "yes";
|
||||
listenAddresses = [{
|
||||
port = 22;
|
||||
addr = "0.0.0.0";
|
||||
}];
|
||||
listenAddresses = [
|
||||
{
|
||||
port = 22;
|
||||
addr = "0.0.0.0";
|
||||
}
|
||||
];
|
||||
};
|
||||
users.users.root.openssh.authorizedKeys.keyFiles = [
|
||||
../../../secrets/keys/authorized_keys
|
||||
|
|
@ -138,44 +143,44 @@
|
|||
};
|
||||
|
||||
pia.content = ''
|
||||
${config.sops.placeholder.vpnuser}
|
||||
${config.sops.placeholder.vpnpass}
|
||||
'';
|
||||
${config.sops.placeholder.vpnuser}
|
||||
${config.sops.placeholder.vpnpass}
|
||||
'';
|
||||
|
||||
vpn.content = ''
|
||||
client
|
||||
dev tun
|
||||
proto ${config.sops.placeholder.vpnprot}
|
||||
remote ${config.sops.placeholder.vpnloc}
|
||||
resolv-retry infinite
|
||||
nobind
|
||||
persist-key
|
||||
persist-tun
|
||||
cipher aes-128-cbc
|
||||
auth sha1
|
||||
tls-client
|
||||
remote-cert-tls server
|
||||
client
|
||||
dev tun
|
||||
proto ${config.sops.placeholder.vpnprot}
|
||||
remote ${config.sops.placeholder.vpnloc}
|
||||
resolv-retry infinite
|
||||
nobind
|
||||
persist-key
|
||||
persist-tun
|
||||
cipher aes-128-cbc
|
||||
auth sha1
|
||||
tls-client
|
||||
remote-cert-tls server
|
||||
|
||||
auth-user-pass ${config.sops.templates.pia.path}
|
||||
compress
|
||||
verb 1
|
||||
reneg-sec 0
|
||||
auth-user-pass ${config.sops.templates.pia.path}
|
||||
compress
|
||||
verb 1
|
||||
reneg-sec 0
|
||||
|
||||
crl-verify /etc/openvpn/crl.rsa.2048.pem
|
||||
ca /etc/openvpn/ca.rsa.2048.crt
|
||||
crl-verify /etc/openvpn/crl.rsa.2048.pem
|
||||
ca /etc/openvpn/ca.rsa.2048.crt
|
||||
|
||||
disable-occ
|
||||
dhcp-option DNS 209.222.18.222
|
||||
dhcp-option DNS 209.222.18.218
|
||||
dhcp-option DNS 8.8.8.8
|
||||
route-noexec
|
||||
'';
|
||||
disable-occ
|
||||
dhcp-option DNS 209.222.18.222
|
||||
dhcp-option DNS 209.222.18.218
|
||||
dhcp-option DNS 8.8.8.8
|
||||
route-noexec
|
||||
'';
|
||||
};
|
||||
secrets = {
|
||||
vpnuser = {};
|
||||
rpcuser = {owner="vpn";};
|
||||
rpcuser = {owner = "vpn";};
|
||||
vpnpass = {};
|
||||
rpcpass = {owner="vpn";};
|
||||
rpcpass = {owner = "vpn";};
|
||||
vpnprot = {};
|
||||
vpnloc = {};
|
||||
};
|
||||
|
|
@ -194,77 +199,74 @@
|
|||
user = "vpn";
|
||||
group = "lxc_shares";
|
||||
settings = {
|
||||
|
||||
alt-speed-down= 8000;
|
||||
alt-speed-enabled= false;
|
||||
alt-speed-time-begin= 0;
|
||||
alt-speed-time-day= 127;
|
||||
alt-speed-time-enabled= true;
|
||||
alt-speed-time-end= 360;
|
||||
alt-speed-up= 2000;
|
||||
bind-address-ipv4= "0.0.0.0";
|
||||
bind-address-ipv6= "::";
|
||||
blocklist-enabled= false;
|
||||
blocklist-url= "http://www.example.com/blocklist";
|
||||
cache-size-mb= 4;
|
||||
dht-enabled= false;
|
||||
download-dir= "/media/Eternor/New";
|
||||
download-limit= 100;
|
||||
download-limit-enabled= 0;
|
||||
download-queue-enabled= true;
|
||||
download-queue-size= 5;
|
||||
encryption= 2;
|
||||
idle-seeding-limit= 30;
|
||||
idle-seeding-limit-enabled= false;
|
||||
incomplete-dir= "/var/lib/transmission-daemon/Downloads";
|
||||
incomplete-dir-enabled= false;
|
||||
lpd-enabled= false;
|
||||
max-peers-global= 200;
|
||||
message-level= 1;
|
||||
peer-congestion-algorithm= "";
|
||||
peer-id-ttl-hours= 6;
|
||||
peer-limit-global= 100;
|
||||
peer-limit-per-torrent= 40;
|
||||
peer-port= 22371;
|
||||
peer-port-random-high= 65535;
|
||||
peer-port-random-low= 49152;
|
||||
peer-port-random-on-start= false;
|
||||
peer-socket-tos= "default";
|
||||
pex-enabled= false;
|
||||
port-forwarding-enabled= false;
|
||||
preallocation= 1;
|
||||
prefetch-enabled= true;
|
||||
queue-stalled-enabled= true;
|
||||
queue-stalled-minutes= 30;
|
||||
ratio-limit= 2;
|
||||
ratio-limit-enabled= false;
|
||||
rename-partial-files= true;
|
||||
rpc-authentication-required= true;
|
||||
rpc-bind-address= "0.0.0.0";
|
||||
rpc-enabled= true;
|
||||
rpc-host-whitelist= "";
|
||||
rpc-host-whitelist-enabled= true;
|
||||
rpc-port= 9091;
|
||||
rpc-url= "/transmission/";
|
||||
rpc-whitelist= "127.0.0.1,192.168.3.2";
|
||||
rpc-whitelist-enabled= true;
|
||||
scrape-paused-torrents-enabled= true;
|
||||
script-torrent-done-enabled= false;
|
||||
seed-queue-enabled= false;
|
||||
seed-queue-size= 10;
|
||||
speed-limit-down= 6000;
|
||||
speed-limit-down-enabled= true;
|
||||
speed-limit-up= 500;
|
||||
speed-limit-up-enabled= true;
|
||||
start-added-torrents= true;
|
||||
trash-original-torrent-files= false;
|
||||
umask= 2;
|
||||
upload-limit= 100;
|
||||
upload-limit-enabled= 0;
|
||||
upload-slots-per-torrent= 14;
|
||||
utp-enabled= false;
|
||||
alt-speed-down = 8000;
|
||||
alt-speed-enabled = false;
|
||||
alt-speed-time-begin = 0;
|
||||
alt-speed-time-day = 127;
|
||||
alt-speed-time-enabled = true;
|
||||
alt-speed-time-end = 360;
|
||||
alt-speed-up = 2000;
|
||||
bind-address-ipv4 = "0.0.0.0";
|
||||
bind-address-ipv6 = "::";
|
||||
blocklist-enabled = false;
|
||||
blocklist-url = "http://www.example.com/blocklist";
|
||||
cache-size-mb = 4;
|
||||
dht-enabled = false;
|
||||
download-dir = "/media/Eternor/New";
|
||||
download-limit = 100;
|
||||
download-limit-enabled = 0;
|
||||
download-queue-enabled = true;
|
||||
download-queue-size = 5;
|
||||
encryption = 2;
|
||||
idle-seeding-limit = 30;
|
||||
idle-seeding-limit-enabled = false;
|
||||
incomplete-dir = "/var/lib/transmission-daemon/Downloads";
|
||||
incomplete-dir-enabled = false;
|
||||
lpd-enabled = false;
|
||||
max-peers-global = 200;
|
||||
message-level = 1;
|
||||
peer-congestion-algorithm = "";
|
||||
peer-id-ttl-hours = 6;
|
||||
peer-limit-global = 100;
|
||||
peer-limit-per-torrent = 40;
|
||||
peer-port = 22371;
|
||||
peer-port-random-high = 65535;
|
||||
peer-port-random-low = 49152;
|
||||
peer-port-random-on-start = false;
|
||||
peer-socket-tos = "default";
|
||||
pex-enabled = false;
|
||||
port-forwarding-enabled = false;
|
||||
preallocation = 1;
|
||||
prefetch-enabled = true;
|
||||
queue-stalled-enabled = true;
|
||||
queue-stalled-minutes = 30;
|
||||
ratio-limit = 2;
|
||||
ratio-limit-enabled = false;
|
||||
rename-partial-files = true;
|
||||
rpc-authentication-required = true;
|
||||
rpc-bind-address = "0.0.0.0";
|
||||
rpc-enabled = true;
|
||||
rpc-host-whitelist = "";
|
||||
rpc-host-whitelist-enabled = true;
|
||||
rpc-port = 9091;
|
||||
rpc-url = "/transmission/";
|
||||
rpc-whitelist = "127.0.0.1,192.168.3.2";
|
||||
rpc-whitelist-enabled = true;
|
||||
scrape-paused-torrents-enabled = true;
|
||||
script-torrent-done-enabled = false;
|
||||
seed-queue-enabled = false;
|
||||
seed-queue-size = 10;
|
||||
speed-limit-down = 6000;
|
||||
speed-limit-down-enabled = true;
|
||||
speed-limit-up = 500;
|
||||
speed-limit-up-enabled = true;
|
||||
start-added-torrents = true;
|
||||
trash-original-torrent-files = false;
|
||||
umask = 2;
|
||||
upload-limit = 100;
|
||||
upload-limit-enabled = 0;
|
||||
upload-slots-per-torrent = 14;
|
||||
utp-enabled = false;
|
||||
};
|
||||
};
|
||||
|
||||
|
||||
}
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue