mirror of
https://github.com/Swarsel/.dotfiles.git
synced 2025-12-06 09:07:21 +01:00
chore: milkywell host
This commit is contained in:
Leon Schwarzäugl
parent
2830b98729
commit
a8daed1d10
GPG key ID:
26A54C31F2A4FD84
13 changed files with 30 additions and 30 deletions
176
hosts/nixos/milkywell/default.nix
Normal file
176
hosts/nixos/milkywell/default.nix
Normal file
|
|
@ -0,0 +1,176 @@
|
|||
{ lib, config, globals, ... }:
|
||||
let
|
||||
primaryUser = config.swarselsystems.mainUser;
|
||||
sharedOptions = {
|
||||
isBtrfs = false;
|
||||
isLinux = true;
|
||||
};
|
||||
inherit (config.repo.secrets.common) workHostName;
|
||||
inherit (config.repo.secrets.local.syncthing) dev1 dev2 dev3 loc1;
|
||||
serviceDomain = config.repo.secrets.common.services.domains.syncthing2;
|
||||
in
|
||||
{
|
||||
imports = [
|
||||
./hardware-configuration.nix
|
||||
];
|
||||
|
||||
sops = {
|
||||
defaultSopsFile = lib.mkForce "/root/.dotfiles/secrets/milkywell/secrets.yaml";
|
||||
};
|
||||
|
||||
boot = {
|
||||
tmp.cleanOnBoot = true;
|
||||
loader.grub.device = "nodev";
|
||||
};
|
||||
zramSwap.enable = false;
|
||||
|
||||
networking = {
|
||||
nftables.enable = lib.mkForce false;
|
||||
hostName = "milkywell";
|
||||
enableIPv6 = false;
|
||||
domain = "subnet03112148.vcn03112148.oraclevcn.com";
|
||||
firewall = {
|
||||
allowedTCPPorts = [ 80 443 8384 9812 22000 27701 ];
|
||||
allowedUDPPorts = [ 21027 22000 ];
|
||||
extraCommands = ''
|
||||
iptables -I INPUT -m state --state NEW -p tcp --dport 80 -j ACCEPT
|
||||
iptables -I INPUT -m state --state NEW -p tcp --dport 443 -j ACCEPT
|
||||
iptables -I INPUT -m state --state NEW -p tcp --dport 27701 -j ACCEPT
|
||||
iptables -I INPUT -m state --state NEW -p tcp --dport 8384 -j ACCEPT
|
||||
iptables -I INPUT -m state --state NEW -p tcp --dport 3000 -j ACCEPT
|
||||
iptables -I INPUT -m state --state NEW -p tcp --dport 22000 -j ACCEPT
|
||||
iptables -I INPUT -m state --state NEW -p udp --dport 22000 -j ACCEPT
|
||||
iptables -I INPUT -m state --state NEW -p udp --dport 21027 -j ACCEPT
|
||||
iptables -I INPUT -m state --state NEW -p tcp --dport 9812 -j ACCEPT
|
||||
'';
|
||||
};
|
||||
};
|
||||
|
||||
hardware = {
|
||||
enableAllFirmware = lib.mkForce false;
|
||||
};
|
||||
|
||||
system.stateVersion = "23.11";
|
||||
|
||||
globals.services."syncthing-${config.networking.hostName}".domain = serviceDomain;
|
||||
|
||||
services = {
|
||||
nginx = {
|
||||
virtualHosts = {
|
||||
${serviceDomain} = {
|
||||
enableACME = true;
|
||||
forceSSL = true;
|
||||
acmeRoot = null;
|
||||
locations = {
|
||||
"/" = {
|
||||
proxyPass = "http://localhost:8384";
|
||||
extraConfig = ''
|
||||
client_max_body_size 0;
|
||||
'';
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
syncthing = {
|
||||
enable = true;
|
||||
guiAddress = "0.0.0.0:8384";
|
||||
openDefaultPorts = true;
|
||||
relay.enable = false;
|
||||
settings = {
|
||||
urAccepted = -1;
|
||||
devices = {
|
||||
"magicant" = {
|
||||
id = "VMWGEE2-4HDS2QO-KNQOVGN-LXLX6LA-666E4EK-ZBRYRRO-XFEX6FB-6E3XLQO";
|
||||
};
|
||||
"winters" = {
|
||||
id = "O7RWDMD-AEAHPP7-7TAVLKZ-BSWNBTU-2VA44MS-EYGUNBB-SLHKB3C-ZSLMOAA";
|
||||
};
|
||||
"${workHostName}" = {
|
||||
id = "YAPV4BV-I26WPTN-SIP32MV-SQP5TBZ-3CHMTCI-Z3D6EP2-MNDQGLP-53FT3AB";
|
||||
};
|
||||
"${dev1}" = {
|
||||
id = "OCCDGDF-IPZ6HHQ-5SSLQ3L-MSSL5ZW-IX5JTAM-PW4PYEK-BRNMJ7E-Q7YDMA7";
|
||||
};
|
||||
"${dev2}" = {
|
||||
id = "LPCFIIB-ENUM2V6-F2BWVZ6-F2HXCL2-BSBZXUF-TIMNKYB-7CATP7H-YU5D3AH";
|
||||
};
|
||||
"${dev3}" = {
|
||||
id = "LAUT2ZP-KEZY35H-AHR3ARD-URAREJI-2B22P5T-PIMUNWW-PQRDETU-7KIGNQR";
|
||||
};
|
||||
};
|
||||
folders = {
|
||||
"Default Folder" = lib.mkForce {
|
||||
path = "/var/lib/syncthing/Sync";
|
||||
type = "receiveonly";
|
||||
versioning = null;
|
||||
devices = [ "winters" "magicant" "${workHostName}" ];
|
||||
id = "default";
|
||||
};
|
||||
"Obsidian" = {
|
||||
path = "/var/lib/syncthing/Obsidian";
|
||||
type = "receiveonly";
|
||||
versioning = {
|
||||
type = "simple";
|
||||
params.keep = "5";
|
||||
};
|
||||
devices = [ "winters" "magicant" "${workHostName}" ];
|
||||
id = "yjvni-9eaa7";
|
||||
};
|
||||
"Org" = {
|
||||
path = "/var/lib/syncthing/Org";
|
||||
type = "receiveonly";
|
||||
versioning = {
|
||||
type = "simple";
|
||||
params.keep = "5";
|
||||
};
|
||||
devices = [ "winters" "magicant" "${workHostName}" ];
|
||||
id = "a7xnl-zjj3d";
|
||||
};
|
||||
"Vpn" = {
|
||||
path = "/var/lib/syncthing/Vpn";
|
||||
type = "receiveonly";
|
||||
versioning = {
|
||||
type = "simple";
|
||||
params.keep = "5";
|
||||
};
|
||||
devices = [ "winters" "magicant" "${workHostName}" ];
|
||||
id = "hgp9s-fyq3p";
|
||||
};
|
||||
"${loc1}" = {
|
||||
path = "/var/lib/syncthing/${loc1}";
|
||||
type = "receiveonly";
|
||||
versioning = {
|
||||
type = "simple";
|
||||
params.keep = "3";
|
||||
};
|
||||
devices = [ dev1 dev2 dev3 ];
|
||||
id = "5gsxv-rzzst";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
swarselsystems = lib.recursiveUpdate
|
||||
{
|
||||
info = "VM.Standard.E2.1.Micro";
|
||||
flakePath = "/root/.dotfiles";
|
||||
isImpermanence = false;
|
||||
isSecureBoot = false;
|
||||
isCrypted = false;
|
||||
profiles = {
|
||||
server.syncserver = true;
|
||||
};
|
||||
}
|
||||
sharedOptions;
|
||||
|
||||
home-manager.users."${primaryUser}" = {
|
||||
home.stateVersion = lib.mkForce "23.05";
|
||||
swarselsystems = lib.recursiveUpdate
|
||||
{ }
|
||||
sharedOptions;
|
||||
};
|
||||
|
||||
}
|
||||
38
hosts/nixos/milkywell/hardware-configuration.nix
Normal file
38
hosts/nixos/milkywell/hardware-configuration.nix
Normal file
|
|
@ -0,0 +1,38 @@
|
|||
{ config, lib, modulesPath, ... }: {
|
||||
imports = [
|
||||
(modulesPath + "/profiles/qemu-guest.nix")
|
||||
];
|
||||
|
||||
boot = {
|
||||
initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "virtio_scsi" "sd_mod" ];
|
||||
initrd.kernelModules = [ ];
|
||||
kernelModules = [ "kvm-amd" ];
|
||||
extraModulePackages = [ ];
|
||||
};
|
||||
|
||||
fileSystems = {
|
||||
"/" = {
|
||||
device = "/dev/disk/by-uuid/4b47378a-02eb-4548-bab8-59cbf379252a";
|
||||
fsType = "xfs";
|
||||
};
|
||||
|
||||
"/boot" = {
|
||||
device = "/dev/disk/by-uuid/2B75-2AD5";
|
||||
fsType = "vfat";
|
||||
};
|
||||
};
|
||||
|
||||
swapDevices = [
|
||||
{ device = "/dev/disk/by-uuid/f0126a93-753e-4769-ada8-7499a1efb3a9"; }
|
||||
];
|
||||
|
||||
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
|
||||
# (the default) this is the recommended approach. When using systemd-networkd it's
|
||||
# still possible to use this option, but it's recommended to use it in conjunction
|
||||
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
|
||||
networking.useDHCP = lib.mkDefault true;
|
||||
# networking.interfaces.ens3.useDHCP = lib.mkDefault true;
|
||||
|
||||
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
|
||||
hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
|
||||
}
|
||||
22
hosts/nixos/milkywell/secrets/pii.nix.enc
Normal file
22
hosts/nixos/milkywell/secrets/pii.nix.enc
Normal file
|
|
@ -0,0 +1,22 @@
|
|||
{
|
||||
"data": "ENC[AES256_GCM,data:4mDIWJ+WBn4c3US7Gby15hCtYYS6gYR1asm3SafO6/qyPKrcfKN42d2iIZEIPEq5yVj6OKt7ccFjQI2q3p8Dpb+HNYzHeGRcwBXKPL5hbVziP7Ik8pAYib7klUSmMelqOkc0aS1kyRyQzpvQoA6T7vNqEdm8kBR4SRs=,iv:7ZTbZh7TnCnfZ33g88Bsk3TISfhxz3+4cB1KiFucCMM=,tag:QgPChPUmZiB4AhH2xXturA==,type:str]",
|
||||
"sops": {
|
||||
"age": [
|
||||
{
|
||||
"recipient": "age1glge4e97vgqzh332mqs5990vteezu2m8k4wq3z35jk0q8czw3gks2d7a3h",
|
||||
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB1ZWxybEZUcjlIdmtOS3Az\nbGt2czliWHBlUWNsNDA0cTJLeXdFOXE1NHh3CllaWGh1ZEZINDhPMUdCZUQ3Ritj\ncTdpRFRHaFdBa3NPWk40WjVlaTlrQmMKLS0tIEZnYkc3Z2hzZXV1eGlsaktyckVT\nbTIrZ3BvZDNkRGpoZ2ZncVlwZysxMW8KU0vsVA9gG63M1ecqk918QHh7P+MSbKaM\nRv/HVAvCzNcMFwPUC7zF0jN0FpAl7eNGkniUMCzGyXHty4anSDyt1g==\n-----END AGE ENCRYPTED FILE-----\n"
|
||||
}
|
||||
],
|
||||
"lastmodified": "2025-06-11T13:01:41Z",
|
||||
"mac": "ENC[AES256_GCM,data:urkp4cEP8fzSvroewVTbVfFK4O03qKnd+Ch3ASJAo1xu++y+fuFFyRcvrY57xU32H+mK2ipSkl2FkeTYB2fNDpXzTIyCWGQPZ4i3doqmFkV1UPjjov8Cc/LY7eRQYj84pF9sFRMdAwtaUL3Kd4Ab45mO1fy7KYAW57zuUeZks/o=,iv:efnEEPHFu2EtRSyob3ozjHz4L1YHJ0AqzLb566pg5ZQ=,tag:VnrO5QFhdQFe9/7aJ9C/qw==,type:str]",
|
||||
"pgp": [
|
||||
{
|
||||
"created_at": "2025-06-11T12:59:00Z",
|
||||
"enc": "-----BEGIN PGP MESSAGE-----\n\nhQIMAwDh3VI7VctTARAAvlrXaui4wqN1kgpfcZMf53RsJYbZp6//miZzas2xKVW3\nyvtubrrYBrHGPEnUuoHexsN4xiQ0zayOn+eLrbv5+8/jhjL6cxtv894+iHYcgkD7\nDc9M4f57Lf7qF9lGTo1pgPKRf2GbHbHfDgUjz5XcIUD0WAz0PCkGQqutP5daw7wV\nMo+fKm6yOxb+e89rlOUY26/LSy+5WMIoQ03tcWu92UZeVRvtEL2LIDQJ3+gCEBrL\nPI0SU84tIl1At1TkKhJkcZ9axn0vOc+LzhcdZ3K5AkAlvnx6/+KdFiVj7xQNQyfN\nJJs3U1HKDca0R6efTRveEoi5nWew2FPGmRfOD34DorokM46Ol0l1c4gL+2LjvPUj\ntEG3slBFoKYbPuj6GSA2H3U2LcgVbPtZggr7VN7d4bLiqT/PkUa2jjAcsqyb+Twc\ng9nmCiWFvrGR76dpvSdx6oO6O/etMcWT9A4fYMPStXcnT32N4q+qrV/+nFZm4BLp\nWvDYkgVWmiAwYTcwuAHS12yH9ymEQMRanSNyzRqjax+GVN70B5nNU5sn8Ch0ex7Q\n6qJZq1j+i/OtNITvnnCdOxefntM4UZzyeyqvU+rZx40KepyVD2XFWkp+9abev0iL\nVbJK5PmNRRxqLaRWxJu2f/Jb86hy60XjCcsWGxuo67ZReRWOHIuyQB15tr3DdReF\nAgwDC9FRLmchgYQBD/49wGPgfs1G4Y0qcAoqZWbdpbcqCwYEzlRK1DJdjFTtE8LO\n+IpA03seoy7qCAp3v86qg7YwjydA+vCJUk7FRFbLiesKDxS1ZRwZSWHuM/v46rj4\nJoTqOPjuJDzed8dFdl4082PrQ0z+dXjsK/ua6d6eQRw6JEgpTLbv7f6Ru4RyM93h\n3wUodncoqcyZ/Wy7qLKCy10CTaD/RRpVrKt18J0L17Qbevmap6tqRZI11GWBnb+R\nqChAvuBQnhN19+MxgJ9AC20SqUht2pBvUXAhWf9vEGoygWR2kXuxyxK2XYu26zXa\nBb33xNAd2BZ/zr7fDnwjROkhRJ0YWk4GqaUCfo3zmT/OtHUzoyIvi0um7obOPzUk\n6RJw3q3siiUXavvTvgJMhCySwzHLtrPGYzCiHfkQc555yRqoz1XrdZOoQyba288y\niMFVzrIp+jlN+shNfsumGIgtogiYl3yI+Ecib7ozwIXDyOmBfsGUFLZkleGXWoH+\n/ZU3stAVFsSzOVkw656NWgsAEnqP1T7TGBMP1vibDPNZBp9aExA+1XLyVbr7sFJG\nWT9ypYorj7hF3UW1Ep/1fmcYovXICieKPR8sLVdWrPxRXArezfoqMAFhxdw6y87n\nQUrOTy8XOwsERmMOWhcU54NgdU21MDI3/sgh20KznNUU1iIOPQgfeobJ0rR/htJe\nAYaaMHhkJvSkiuXBKJIaz125xQrKvwLpB+OsuezPhT5Qn4MZUEoUa5Ft1GhiDqWM\nSB8o70nlAcw0CFvNlsYRZdVY5FACj81B1H6JH5eNUx6f2FVhcO61kc60LJvzug==\n=zX1v\n-----END PGP MESSAGE-----",
|
||||
"fp": "4BE7925262289B476DBBC17B76FD3810215AE097"
|
||||
}
|
||||
],
|
||||
"unencrypted_suffix": "_unencrypted",
|
||||
"version": "3.10.2"
|
||||
}
|
||||
}
|
||||
Loading…
Add table
Add a link
Reference in a new issue