fin holocron zfs on snowbelle
This commit is contained in:
@@ -1,160 +0,0 @@
|
||||
{
|
||||
pkgs,
|
||||
config,
|
||||
lib,
|
||||
inputs,
|
||||
...
|
||||
}: let
|
||||
service = "copyparty";
|
||||
cfg = config.holocron.${service};
|
||||
sec = config.sops.secrets;
|
||||
homelab = config.homelab;
|
||||
in {
|
||||
imports = [inputs.copyparty.nixosModules.default];
|
||||
|
||||
options.holocron.${service} = {
|
||||
enable = lib.mkEnableOption "enables ${service}";
|
||||
|
||||
# set port options
|
||||
port = lib.mkOption {
|
||||
type = lib.types.int;
|
||||
default = 7902;
|
||||
description = "set port for ${service} (default: ${toString cfg.port}";
|
||||
};
|
||||
url = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "${service}.${homelab.base_domain}";
|
||||
description = "set domain for ${service}";
|
||||
};
|
||||
data_dir = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "/var/lib/${service}";
|
||||
description = "set data directory for ${service}";
|
||||
};
|
||||
ids = lib.mkOption {
|
||||
type = lib.types.int;
|
||||
default = cfg.port;
|
||||
description = "set uid and pid of ${service} user (matches port by default)";
|
||||
};
|
||||
backup = lib.mkOption {
|
||||
type = lib.types.bool;
|
||||
default = true;
|
||||
description = "enable backups for ${service}";
|
||||
};
|
||||
};
|
||||
|
||||
config = lib.mkIf cfg.enable {
|
||||
nixpkgs.overlays = [inputs.copyparty.overlays.default];
|
||||
# declare ${service} group
|
||||
users.groups.${service} = {
|
||||
gid = lib.mkForce cfg.ids;
|
||||
};
|
||||
|
||||
# declare ${service} user
|
||||
users.users.${service} = {
|
||||
description = lib.mkForce "${service} server user";
|
||||
uid = lib.mkForce cfg.ids;
|
||||
isSystemUser = true;
|
||||
home = cfg.data_dir;
|
||||
createHome = true;
|
||||
group = service;
|
||||
extraGroups = [ "media" "blake" "archives" ];
|
||||
};
|
||||
|
||||
# enable the ${service} service
|
||||
services.${service} = {
|
||||
enable = true;
|
||||
user = service;
|
||||
group = service;
|
||||
settings = {
|
||||
i = "0.0.0.0";
|
||||
p = [7902];
|
||||
rproxy = 1;
|
||||
};
|
||||
accounts = {
|
||||
blake = {
|
||||
passwordFile = sec."copyparty_passwd".path;
|
||||
};
|
||||
};
|
||||
groups = {
|
||||
media = ["blake"];
|
||||
};
|
||||
volumes = {
|
||||
"/archives" = {
|
||||
path = "/holocron/archives";
|
||||
access = {
|
||||
r = "*";
|
||||
A = "blake";
|
||||
};
|
||||
flags = {
|
||||
chmod_f = 660;
|
||||
chmod_d = 770;
|
||||
#gid = ?;
|
||||
};
|
||||
};
|
||||
"/media" = {
|
||||
path = "/holocron/media";
|
||||
access = {
|
||||
r = "*";
|
||||
w = "@media";
|
||||
A = "blake";
|
||||
};
|
||||
flags = {
|
||||
chmod_f = 660;
|
||||
chmod_d = 770;
|
||||
gid = "700";
|
||||
};
|
||||
};
|
||||
"/users/blake" = {
|
||||
path = "/holocron/users/blake";
|
||||
access = {
|
||||
A = "blake";
|
||||
};
|
||||
flags = {
|
||||
chmod_f = 660;
|
||||
chmod_d = 770;
|
||||
gid = "1000";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
# open firewall
|
||||
networking.firewall.allowedTCPPorts = [cfg.port];
|
||||
|
||||
# add to caddy for reverse proxy
|
||||
services.caddy.virtualHosts."${cfg.url}" = {
|
||||
serverAliases = ["${service}.${homelab.public_domain}"];
|
||||
extraConfig = ''
|
||||
tls /etc/ssl/blakedheld.xyz.crt /etc/ssl/blakedheld.xyz.key
|
||||
reverse_proxy 127.0.0.1:${toString cfg.port} {
|
||||
}
|
||||
'';
|
||||
};
|
||||
|
||||
# add to glance (local service)
|
||||
homelab.glance.links.system = [
|
||||
{
|
||||
title = service;
|
||||
url = "https://${cfg.url}";
|
||||
error-url = "http://${homelab.host_ip}:${toString cfg.port}";
|
||||
check-url = "http://${homelab.host_ip}:${toString cfg.port}";
|
||||
icon = "di:${service}";
|
||||
}
|
||||
];
|
||||
|
||||
sops.secrets = {
|
||||
"${service}_passwd" = {
|
||||
owner = service;
|
||||
group = service;
|
||||
};
|
||||
};
|
||||
|
||||
# add to backups
|
||||
homelab.backups.baks = {
|
||||
${service} = {
|
||||
paths = [cfg.data_dir];
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -10,8 +10,8 @@
|
||||
./nfs
|
||||
./smb
|
||||
./zfs
|
||||
#./syncthing
|
||||
#./copyparty
|
||||
./syncthing
|
||||
# ./copyparty
|
||||
./perms
|
||||
];
|
||||
|
||||
|
||||
@@ -9,16 +9,20 @@ let
|
||||
cfg = config.holocron.smb;
|
||||
smb_shares = {
|
||||
global = {
|
||||
"ea support" = "yes";
|
||||
"vfs objects" = "catia fruit streams_xattr";
|
||||
# time machine specifc config, must be global
|
||||
"fruit:aapl" = "yes";
|
||||
"fruit:metadata" = "stream";
|
||||
"fruit:model" = "MacSamba";
|
||||
"fruit:posix_rename" = "yes";
|
||||
"fruit:nfs_aces" = "no";
|
||||
"fruit:metadata" = "stream";
|
||||
"fruit:model" = "TimeCapsule";
|
||||
"fruit:posix_rename" = "yes";
|
||||
"fruit:veto_appledouble" = "no";
|
||||
"fruit:wipe_intentionally_left_blank_rfork" = "yes";
|
||||
"fruit:delete_empty_adfiles" = "yes";
|
||||
"vfs objects" = "catia fruit streams_xattr";
|
||||
"ea support" = "yes";
|
||||
"spotlight" = "no";
|
||||
"multicast dns register" = "no";
|
||||
"min protocol" = "SMB2";
|
||||
};
|
||||
archives = {
|
||||
path = "/holocron/archives";
|
||||
@@ -30,14 +34,21 @@ let
|
||||
};
|
||||
timemachine = {
|
||||
browseable = true;
|
||||
"path" = "/holocron/archives/timemachine";
|
||||
"path" = "/holocron/timemachine";
|
||||
"valid users" = "blake";
|
||||
"public" = "no";
|
||||
"writeable" = "yes";
|
||||
"force user" = "blake";
|
||||
"fruit:aapl" = "yes";
|
||||
# time machine specifc config
|
||||
"fruit:time machine" = "yes";
|
||||
"vfs objects" = "catia fruit streams_xattr";
|
||||
"fruit:time machine max size" = "5T";
|
||||
"case sensitive" = "yes";
|
||||
"default case" = "lower";
|
||||
"preserve case" = "no";
|
||||
"short preserve case" = "no";
|
||||
"create mask" = "0660";
|
||||
"directory mask" = "0770";
|
||||
"force group" = "blake";
|
||||
};
|
||||
users = {
|
||||
path = "/holocron/users";
|
||||
@@ -65,10 +76,17 @@ in {
|
||||
# enable smb with all shares
|
||||
services.samba = {
|
||||
enable = true;
|
||||
package = pkgs.sambaFull;
|
||||
settings = smb_shares;
|
||||
};
|
||||
# Ensure Time Machine can discover the share without `tmutil`
|
||||
|
||||
# ensure time machine can discover the share without `tmutil`
|
||||
services.avahi = {
|
||||
enable = true;
|
||||
openFirewall = true;
|
||||
nssmdns4 = true;
|
||||
publish.enable = true;
|
||||
publish.userServices = true;
|
||||
extraServiceFiles = {
|
||||
timemachine = ''
|
||||
<?xml version="1.0" standalone='no'?>
|
||||
@@ -86,6 +104,7 @@ in {
|
||||
</service>
|
||||
<service>
|
||||
<type>_adisk._tcp</type>
|
||||
<port>0</port>
|
||||
<txt-record>dk0=adVN=timemachine,adVF=0x82</txt-record>
|
||||
<txt-record>sys=waMa=0,adVF=0x100</txt-record>
|
||||
</service>
|
||||
|
||||
@@ -7,7 +7,7 @@
|
||||
service = "syncthing";
|
||||
cfg = config.holocron.${service};
|
||||
sec = config.sops.secrets;
|
||||
url = "syncthing.snowbelle.blakedheld.xyz";
|
||||
url = "syncthing.${config.networking.hostName}.blakedheld.xyz";
|
||||
homelab = config.homelab;
|
||||
in {
|
||||
options.holocron.${service} = {
|
||||
@@ -23,8 +23,8 @@ in {
|
||||
guiAddress = "0.0.0.0:2222";
|
||||
openDefaultPorts = true;
|
||||
#extraFlags = ["--no-default-folder"];
|
||||
key = sec."${service}/snowbelle/key".path;
|
||||
cert = sec."${service}/snowbelle/cert".path;
|
||||
key = sec."${service}/lumiose/key".path;
|
||||
cert = sec."${service}/lumiose/cert".path;
|
||||
settings = {
|
||||
devices = {
|
||||
"mudkip" = {id = "OV4NUQK-3YHRL5R-SIZGTNL-7VZFFUX-FOJ6NTS-C7ROXR7-I2Q2W7G-QERO7AO";};
|
||||
@@ -55,11 +55,11 @@ in {
|
||||
};
|
||||
|
||||
sops.secrets = {
|
||||
"${service}/snowbelle/key" = {
|
||||
"${service}/lumiose/key" = {
|
||||
owner = "blake";
|
||||
group = "blake";
|
||||
};
|
||||
"${service}/snowbelle/cert" = {
|
||||
"${service}/lumiose/cert" = {
|
||||
owner = "blake";
|
||||
group = "blake";
|
||||
};
|
||||
|
||||
@@ -5,6 +5,7 @@
|
||||
...
|
||||
}: let
|
||||
cfg = config.holocron.zfs;
|
||||
sec = config.sops.secrets;
|
||||
in {
|
||||
options.holocron.zfs = {
|
||||
enable = lib.mkEnableOption "enables zfs";
|
||||
@@ -12,28 +13,33 @@ in {
|
||||
|
||||
config = lib.mkIf cfg.enable {
|
||||
# set network host id
|
||||
networking.hostId = "3e6e7055";
|
||||
|
||||
# enable zfs support
|
||||
boot.zfs.forceImportRoot = false;
|
||||
boot.kernelModules = ["zfs"];
|
||||
boot.supportedFilesystems = ["zfs"];
|
||||
boot.zfs.forceImportRoot = false;
|
||||
# boot.initrd.services.zfs.enable = true;
|
||||
# boot.zfs.requestEncryptionCredentials = true;
|
||||
|
||||
# arc cache size
|
||||
boot.kernelParams = ["zfs.zfs_arc_max=12884901888"];
|
||||
|
||||
# pools to import
|
||||
#boot.zfs.extraPools = [ "holocron" "holocron/archives" "/holocron/media" "/holocron/users" ];
|
||||
#boot.zfs.extraPools = [ "holocron" ];
|
||||
boot.zfs.extraPools = ["holocron"];
|
||||
|
||||
# enable smart monitoring
|
||||
|
||||
services.smartd = {
|
||||
enable = true;
|
||||
autodetect = true;
|
||||
defaults.monitored = "-a -o on -s (S/../.././05|L/../01/./05)";
|
||||
notifications.mail = {
|
||||
enable = true;
|
||||
sender = "zfs@snowbelle.lan";
|
||||
notifications = {
|
||||
test = false;
|
||||
mail = {
|
||||
enable = true;
|
||||
recipient = "blake";
|
||||
sender = "alerts@blakedheld.xyz";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
@@ -43,37 +49,52 @@ in {
|
||||
autoScrub.interval = "weekly";
|
||||
# email notifs
|
||||
zed = {
|
||||
enableMail = false;
|
||||
enableMail = true;
|
||||
settings = {
|
||||
ZED_EMAIL_ADDR = ["root"];
|
||||
ZED_EMAIL_ADDR = ["root" "blake"];
|
||||
# send notification if scrub succeeds
|
||||
ZED_NOTIFY_VERBOSE = true;
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
# install userspace tools for acl's
|
||||
# install userspace tools for smart
|
||||
environment.systemPackages = with pkgs; [smartmontools];
|
||||
|
||||
fileSystems."/holocron" = {
|
||||
device = "holocron";
|
||||
fsType = "zfs";
|
||||
options = ["nofail"];
|
||||
# mail test
|
||||
|
||||
services.mail.sendmailSetuidWrapper.enable = true;
|
||||
|
||||
programs.msmtp = {
|
||||
enable = true;
|
||||
setSendmail = true;
|
||||
|
||||
defaults = {
|
||||
aliases = "/etc/aliases";
|
||||
port = 587;
|
||||
auth = "plain";
|
||||
tls = "on";
|
||||
tls_starttls = "on";
|
||||
};
|
||||
|
||||
accounts.default = {
|
||||
host = "smtp.mail.me.com";
|
||||
user = "bdhelderman@icloud.com";
|
||||
from = "alerts@blakedheld.xyz";
|
||||
passwordeval = "/run/current-system/sw/bin/cat ${sec."email_pass".path}";
|
||||
};
|
||||
};
|
||||
fileSystems."/holocron/archives" = {
|
||||
device = "holocron/archives";
|
||||
fsType = "zfs";
|
||||
options = ["nofail"];
|
||||
};
|
||||
fileSystems."/holocron/users" = {
|
||||
device = "holocron/users";
|
||||
fsType = "zfs";
|
||||
options = ["nofail"];
|
||||
};
|
||||
fileSystems."/holocron/media" = {
|
||||
device = "holocron/media";
|
||||
fsType = "zfs";
|
||||
options = ["nofail"];
|
||||
|
||||
environment.etc.aliases.text = ''
|
||||
root: me@blakedheld.xyz
|
||||
blake: me@blakedheld.xyz
|
||||
'';
|
||||
|
||||
sops.secrets = {
|
||||
"email_pass" = {
|
||||
owner = "blake";
|
||||
group = "blake";
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user