blake/nix
1
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fin holocron zfs on snowbelle

Browse Source
This commit is contained in:
blake
2026-06-13 14:31:32 -05:00
parent a34c177b69
commit 087365d239
13 changed files with 92 additions and 630 deletions
Download Patch File Download Diff File Expand all files Collapse all files
hosts/nixos/lumiose/configuration.nix
+1 -1
View File
@@ -15,7 +15,7 @@
../../nixos
../../../users/blake
../../../modules/system
../../../modules/fileshares/holocron_new
../../../modules/fileshares/holocron
../../../modules/homelab
#../../../modules/gameservers/srcds
../../../modules/gameservers/minecraft_recpro
hosts/nixos/snowbelle/configuration.nix
+7 -7
View File
@@ -13,7 +13,7 @@
../../../users/blake
../../../modules/system
../../../modules/homelab
../../../modules/fileshares/holocron
#../../../modules/fileshares/holocron
#../../../modules/gameservers/minecraft_recpro
#../../../modules/gameservers/minecraft_modded
];
@@ -36,12 +36,12 @@
url = "https://up.blakedheld.xyz/api/push/kMoYviAuCL?status=up&msg=bigchilling&ping=";
};
};
holocron = {
ensure_perms.enable = true;
zfs.enable = true;
smb.enable = true;
nfs.enable = true;
};
# holocron = {
# ensure_perms.enable = true;
# zfs.enable = true;
# smb.enable = true;
# nfs.enable = true;
# };
homelab = {
enable = true;
modules/fileshares/holocron/copyparty/default.nix
-160
View File
@@ -1,160 +0,0 @@
{
pkgs,
config,
lib,
inputs,
...
}: let
service = "copyparty";
cfg = config.holocron.${service};
sec = config.sops.secrets;
homelab = config.homelab;
in {
imports = [inputs.copyparty.nixosModules.default];
options.holocron.${service} = {
enable = lib.mkEnableOption "enables ${service}";
# set port options
port = lib.mkOption {
type = lib.types.int;
default = 7902;
description = "set port for ${service} (default: ${toString cfg.port}";
};
url = lib.mkOption {
type = lib.types.str;
default = "${service}.${homelab.base_domain}";
description = "set domain for ${service}";
};
data_dir = lib.mkOption {
type = lib.types.str;
default = "/var/lib/${service}";
description = "set data directory for ${service}";
};
ids = lib.mkOption {
type = lib.types.int;
default = cfg.port;
description = "set uid and pid of ${service} user (matches port by default)";
};
backup = lib.mkOption {
type = lib.types.bool;
default = true;
description = "enable backups for ${service}";
};
};
config = lib.mkIf cfg.enable {
nixpkgs.overlays = [inputs.copyparty.overlays.default];
# declare ${service} group
users.groups.${service} = {
gid = lib.mkForce cfg.ids;
};
# declare ${service} user
users.users.${service} = {
description = lib.mkForce "${service} server user";
uid = lib.mkForce cfg.ids;
isSystemUser = true;
home = cfg.data_dir;
createHome = true;
group = service;
extraGroups = [ "media" "blake" "archives" ];
};
# enable the ${service} service
services.${service} = {
enable = true;
user = service;
group = service;
settings = {
i = "0.0.0.0";
p = [7902];
rproxy = 1;
};
accounts = {
blake = {
passwordFile = sec."copyparty_passwd".path;
};
};
groups = {
media = ["blake"];
};
volumes = {
"/archives" = {
path = "/holocron/archives";
access = {
r = "*";
A = "blake";
};
flags = {
chmod_f = 660;
chmod_d = 770;
#gid = ?;
};
};
"/media" = {
path = "/holocron/media";
access = {
r = "*";
w = "@media";
A = "blake";
};
flags = {
chmod_f = 660;
chmod_d = 770;
gid = "700";
};
};
"/users/blake" = {
path = "/holocron/users/blake";
access = {
A = "blake";
};
flags = {
chmod_f = 660;
chmod_d = 770;
gid = "1000";
};
};
};
};
# open firewall
networking.firewall.allowedTCPPorts = [cfg.port];
# add to caddy for reverse proxy
services.caddy.virtualHosts."${cfg.url}" = {
serverAliases = ["${service}.${homelab.public_domain}"];
extraConfig = ''
tls /etc/ssl/blakedheld.xyz.crt /etc/ssl/blakedheld.xyz.key
reverse_proxy 127.0.0.1:${toString cfg.port} {
}
'';
};
# add to glance (local service)
homelab.glance.links.system = [
{
title = service;
url = "https://${cfg.url}";
error-url = "http://${homelab.host_ip}:${toString cfg.port}";
check-url = "http://${homelab.host_ip}:${toString cfg.port}";
icon = "di:${service}";
}
];
sops.secrets = {
"${service}_passwd" = {
owner = service;
group = service;
};
};
# add to backups
homelab.backups.baks = {
${service} = {
paths = [cfg.data_dir];
};
};
};
}
modules/fileshares/holocron/default.nix
+2 -2
View File
@@ -10,8 +10,8 @@
./nfs
./smb
./zfs
#./syncthing
#./copyparty
./syncthing
# ./copyparty
./perms
];
modules/fileshares/holocron/smb/default.nix
+28 -9
View File
@@ -9,16 +9,20 @@ let
cfg = config.holocron.smb;
smb_shares = {
global = {
"ea support" = "yes";
"vfs objects" = "catia fruit streams_xattr";
# time machine specifc config, must be global
"fruit:aapl" = "yes";
"fruit:metadata" = "stream";
"fruit:model" = "MacSamba";
"fruit:posix_rename" = "yes";
"fruit:nfs_aces" = "no";
"fruit:metadata" = "stream";
"fruit:model" = "TimeCapsule";
"fruit:posix_rename" = "yes";
"fruit:veto_appledouble" = "no";
"fruit:wipe_intentionally_left_blank_rfork" = "yes";
"fruit:delete_empty_adfiles" = "yes";
"vfs objects" = "catia fruit streams_xattr";
"ea support" = "yes";
"spotlight" = "no";
"multicast dns register" = "no";
"min protocol" = "SMB2";
};
archives = {
path = "/holocron/archives";
@@ -30,14 +34,21 @@ let
};
timemachine = {
browseable = true;
"path" = "/holocron/archives/timemachine";
"path" = "/holocron/timemachine";
"valid users" = "blake";
"public" = "no";
"writeable" = "yes";
"force user" = "blake";
"fruit:aapl" = "yes";
# time machine specifc config
"fruit:time machine" = "yes";
"vfs objects" = "catia fruit streams_xattr";
"fruit:time machine max size" = "5T";
"case sensitive" = "yes";
"default case" = "lower";
"preserve case" = "no";
"short preserve case" = "no";
"create mask" = "0660";
"directory mask" = "0770";
"force group" = "blake";
};
users = {
path = "/holocron/users";
@@ -65,10 +76,17 @@ in {
# enable smb with all shares
services.samba = {
enable = true;
package = pkgs.sambaFull;
settings = smb_shares;
};
# Ensure Time Machine can discover the share without `tmutil`
# ensure time machine can discover the share without `tmutil`
services.avahi = {
enable = true;
openFirewall = true;
nssmdns4 = true;
publish.enable = true;
publish.userServices = true;
extraServiceFiles = {
timemachine = ''
<?xml version="1.0" standalone='no'?>
@@ -86,6 +104,7 @@ in {
</service>
<service>
<type>_adisk._tcp</type>
<port>0</port>
<txt-record>dk0=adVN=timemachine,adVF=0x82</txt-record>
<txt-record>sys=waMa=0,adVF=0x100</txt-record>
</service>
modules/fileshares/holocron/syncthing/default.nix
+5 -5
View File
@@ -7,7 +7,7 @@
service = "syncthing";
cfg = config.holocron.${service};
sec = config.sops.secrets;
url = "syncthing.snowbelle.blakedheld.xyz";
url = "syncthing.${config.networking.hostName}.blakedheld.xyz";
homelab = config.homelab;
in {
options.holocron.${service} = {
@@ -23,8 +23,8 @@ in {
guiAddress = "0.0.0.0:2222";
openDefaultPorts = true;
#extraFlags = ["--no-default-folder"];
key = sec."${service}/snowbelle/key".path;
cert = sec."${service}/snowbelle/cert".path;
key = sec."${service}/lumiose/key".path;
cert = sec."${service}/lumiose/cert".path;
settings = {
devices = {
"mudkip" = {id = "OV4NUQK-3YHRL5R-SIZGTNL-7VZFFUX-FOJ6NTS-C7ROXR7-I2Q2W7G-QERO7AO";};
@@ -55,11 +55,11 @@ in {
};
sops.secrets = {
"${service}/snowbelle/key" = {
"${service}/lumiose/key" = {
owner = "blake";
group = "blake";
};
"${service}/snowbelle/cert" = {
"${service}/lumiose/cert" = {
owner = "blake";
group = "blake";
};
modules/fileshares/holocron/zfs/default.nix
+46 -25
View File
@@ -5,6 +5,7 @@
...
}: let
cfg = config.holocron.zfs;
sec = config.sops.secrets;
in {
options.holocron.zfs = {
enable = lib.mkEnableOption "enables zfs";
@@ -12,28 +13,33 @@ in {
config = lib.mkIf cfg.enable {
# set network host id
networking.hostId = "3e6e7055";
# enable zfs support
boot.zfs.forceImportRoot = false;
boot.kernelModules = ["zfs"];
boot.supportedFilesystems = ["zfs"];
boot.zfs.forceImportRoot = false;
# boot.initrd.services.zfs.enable = true;
# boot.zfs.requestEncryptionCredentials = true;
# arc cache size
boot.kernelParams = ["zfs.zfs_arc_max=12884901888"];
# pools to import
#boot.zfs.extraPools = [ "holocron" "holocron/archives" "/holocron/media" "/holocron/users" ];
#boot.zfs.extraPools = [ "holocron" ];
boot.zfs.extraPools = ["holocron"];
# enable smart monitoring
services.smartd = {
enable = true;
autodetect = true;
defaults.monitored = "-a -o on -s (S/../.././05|L/../01/./05)";
notifications.mail = {
notifications = {
test = false;
mail = {
enable = true;
sender = "zfs@snowbelle.lan";
recipient = "blake";
sender = "alerts@blakedheld.xyz";
};
};
};
@@ -43,37 +49,52 @@ in {
autoScrub.interval = "weekly";
# email notifs
zed = {
enableMail = false;
enableMail = true;
settings = {
ZED_EMAIL_ADDR = ["root"];
ZED_EMAIL_ADDR = ["root" "blake"];
# send notification if scrub succeeds
ZED_NOTIFY_VERBOSE = true;
};
};
};
# install userspace tools for acl's
# install userspace tools for smart
environment.systemPackages = with pkgs; [smartmontools];
fileSystems."/holocron" = {
device = "holocron";
fsType = "zfs";
options = ["nofail"];
# mail test
services.mail.sendmailSetuidWrapper.enable = true;
programs.msmtp = {
enable = true;
setSendmail = true;
defaults = {
aliases = "/etc/aliases";
port = 587;
auth = "plain";
tls = "on";
tls_starttls = "on";
};
fileSystems."/holocron/archives" = {
device = "holocron/archives";
fsType = "zfs";
options = ["nofail"];
accounts.default = {
host = "smtp.mail.me.com";
user = "bdhelderman@icloud.com";
from = "alerts@blakedheld.xyz";
passwordeval = "/run/current-system/sw/bin/cat ${sec."email_pass".path}";
};
fileSystems."/holocron/users" = {
device = "holocron/users";
fsType = "zfs";
options = ["nofail"];
};
fileSystems."/holocron/media" = {
device = "holocron/media";
fsType = "zfs";
options = ["nofail"];
environment.etc.aliases.text = ''
root: me@blakedheld.xyz
blake: me@blakedheld.xyz
'';
sops.secrets = {
"email_pass" = {
owner = "blake";
group = "blake";
};
};
};
}
modules/fileshares/holocron_new/default.nix
-20
View File
@@ -1,20 +0,0 @@
{
pkgs,
config,
lib,
inputs,
...
}: {
# services show up in glance in reverse import order lmao
imports = [
./nfs
./smb
./zfs
./syncthing
# ./copyparty
./perms
];
# define the groups used for backups and archives
users.groups.archives = {gid = 727;};
}
modules/fileshares/holocron_new/nfs/default.nix
-28
View File
@@ -1,28 +0,0 @@
{
pkgs,
config,
lib,
...
}:
# define nfs exports
let
cfg = config.holocron.nfs;
nfs_exports = ''
/holocron/media *(ro,sync,no_subtree_check)
'';
#/holocron/users *(rw,sync,no_subtree_check,no_root_squash)
in {
options.holocron.nfs = {
enable = lib.mkEnableOption "enables nfs";
};
config = lib.mkIf cfg.enable {
# enable nfs with all exports
services.nfs = {
server = {
enable = true;
exports = nfs_exports;
};
};
};
}
modules/fileshares/holocron_new/perms/default.nix
-65
View File
@@ -1,65 +0,0 @@
{
config,
pkgs,
lib,
...
}: let
service = "ensure_perms";
cfg = config.holocron.${service};
# define variables for paths
archives_path = "/holocron/archives";
media_path = "/holocron/media";
users_path = "/holocron/users";
in {
options.holocron.ensure_perms = {
enable = lib.mkEnableOption "enables perms ensurence script";
};
config = lib.mkIf cfg.enable {
# service to run periodically to reset the perms on all zpools
# everything works fine without this, just for peace of mind
# and to clean up the ownership from the arr stack in /holocron/media
systemd.services.${service} = {
description = "ensure file permissions for archives, media and user folders";
serviceConfig = {
Type = "oneshot";
ExecStart = pkgs.writeShellScript "ensure_perms" ''
# Fix ownership for archives directory
echo "starting ${archives_path}"
chown -Rc root:archives ${archives_path}
find "${archives_path}" -type d -exec chmod 2770 "$@" {} +
find "${archives_path}" -type f -exec chmod 660 "$@" {} +
# Fix ownership for media directory
echo "starting ${media_path}"
chown -Rc root:media ${media_path}
find "${media_path}" -type d -exec chmod 2770 "$@" {} +
find "${media_path}" -type f -exec chmod 660 "$@" {} +
# Fix user directories
for user_dir in ${users_path}/*; do
if [ -d "$user_dir" ]; then
user=$(basename "$user_dir")
echo "starting $user_dir"
chown -Rc $user:$user $user_dir
find $user_dir -type d -exec chmod 2770 "$@" {} +
find $user_dir -type f -exec chmod 660 "$@" {} +
fi
done
echo "fin"
'';
};
};
systemd.timers.${service} = {
description = "run script to ensure_perms daily";
wantedBy = ["timers.target"];
timerConfig = {
OnCalendar = "03:30";
Persistent = true;
};
};
};
}
modules/fileshares/holocron_new/smb/default.nix
-116
View File
@@ -1,116 +0,0 @@
{
pkgs,
config,
lib,
...
}:
# define smb shares
let
cfg = config.holocron.smb;
smb_shares = {
global = {
# time machine specifc config, must be global
"fruit:aapl" = "yes";
"fruit:nfs_aces" = "no";
"fruit:metadata" = "stream";
"fruit:model" = "TimeCapsule";
"fruit:posix_rename" = "yes";
"fruit:veto_appledouble" = "no";
"fruit:wipe_intentionally_left_blank_rfork" = "yes";
"fruit:delete_empty_adfiles" = "yes";
"vfs objects" = "catia fruit streams_xattr";
"ea support" = "yes";
"spotlight" = "no";
"multicast dns register" = "no";
"min protocol" = "SMB2";
};
archives = {
path = "/holocron/archives";
browseable = true;
writable = true;
guestOk = false;
"create mask" = "0775";
"directory mask" = "0775";
};
timemachine = {
browseable = true;
"path" = "/holocron/timemachine";
"valid users" = "blake";
"public" = "no";
"writeable" = "yes";
"force user" = "blake";
# time machine specifc config
"fruit:time machine" = "yes";
"fruit:time machine max size" = "5T";
"case sensitive" = "yes";
"default case" = "lower";
"preserve case" = "no";
"short preserve case" = "no";
"create mask" = "0660";
"directory mask" = "0770";
"force group" = "blake";
};
users = {
path = "/holocron/users";
browseable = true;
writable = true;
guestOk = false;
"create mask" = "0660";
"directory mask" = "0770";
};
media = {
path = "/holocron/media";
browseable = true;
writable = true;
guestOk = false;
"create mask" = "0775";
"directory mask" = "0775";
};
};
in {
options.holocron.smb = {
enable = lib.mkEnableOption "enables smb";
};
config = lib.mkIf cfg.enable {
# enable smb with all shares
services.samba = {
enable = true;
package = pkgs.sambaFull;
settings = smb_shares;
};
# ensure time machine can discover the share without `tmutil`
services.avahi = {
enable = true;
openFirewall = true;
nssmdns4 = true;
publish.enable = true;
publish.userServices = true;
extraServiceFiles = {
timemachine = ''
<?xml version="1.0" standalone='no'?>
<!DOCTYPE service-group SYSTEM "avahi-service.dtd">
<service-group>
<name replace-wildcards="yes">%h</name>
<service>
<type>_smb._tcp</type>
<port>445</port>
</service>
<service>
<type>_device-info._tcp</type>
<port>0</port>
<txt-record>model=TimeCapsule8,119</txt-record>
</service>
<service>
<type>_adisk._tcp</type>
<port>0</port>
<txt-record>dk0=adVN=timemachine,adVF=0x82</txt-record>
<txt-record>sys=waMa=0,adVF=0x100</txt-record>
</service>
</service-group>
'';
};
};
};
}
modules/fileshares/holocron_new/syncthing/default.nix
-89
View File
@@ -1,89 +0,0 @@
{
pkgs,
config,
lib,
...
}: let
service = "syncthing";
cfg = config.holocron.${service};
sec = config.sops.secrets;
url = "syncthing.${config.networking.hostName}.blakedheld.xyz";
homelab = config.homelab;
in {
options.holocron.${service} = {
enable = lib.mkEnableOption "enables syncthing";
};
config = lib.mkIf cfg.enable {
services.syncthing = {
enable = true;
user = "blake";
group = "blake";
dataDir = "/var/lib/syncthing";
guiAddress = "0.0.0.0:2222";
openDefaultPorts = true;
#extraFlags = ["--no-default-folder"];
key = sec."${service}/lumiose/key".path;
cert = sec."${service}/lumiose/cert".path;
settings = {
devices = {
"mudkip" = {id = "OV4NUQK-3YHRL5R-SIZGTNL-7VZFFUX-FOJ6NTS-C7ROXR7-I2Q2W7G-QERO7AO";};
"zygarde" = {id = "UYLTF52-VVKUR7F-JN33HQZ-RFNWGL3-JER52LA-GZD2LPJ-QIFEE7K-MNMZRQ5";};
"yveltal" = {id = "ZVSQ4WJ-7OICYOZ-3ECES4X-KH37IPB-TKHKUJG-BSEGXVM-AHYY5C3-VKG44AX";};
"CEN-IT-07" = {id = "DPYKA4Z-3PX7JB2-FBEOXXX-SC7TLT2-QC5P2IR-SXOPJGX-QO3DMII-5B7UCA4";};
"CEN-IT-00007" = {id = "XBPXGYU-DUJSLDH-6BDNF4D-CO2COC3-N3FM6W5-IHZOJBM-Z2N77RI-IVAV5AH";};
};
folders = {
"holocron" = {
path = "/holocron/users/blake/holocron";
devices = ["mudkip" "zygarde" "CEN-IT-07" "CEN-IT-00007" "yveltal"];
id = "5voxg-c3he2";
versioning = {
type = "staggered";
fsPath = "/holocron/users/blake/holocron/.stversions";
params = {
cleanInterval = "3600";
maxAge = "0";
};
};
};
};
options = {
urAccepted = -1;
};
};
};
sops.secrets = {
"${service}/lumiose/key" = {
owner = "blake";
group = "blake";
};
"${service}/lumiose/cert" = {
owner = "blake";
group = "blake";
};
};
homelab.backups.baks = {
${service} = {paths = [config.services.syncthing.dataDir];};
};
services.caddy.virtualHosts."${url}" = {
extraConfig = ''
tls internal
reverse_proxy 127.0.0.1:2222
'';
};
# add to glance (local service)
homelab.glance.links.system = [
{
title = service;
url = "https://${url}";
error-url = "http://${homelab.host_ip}:2222";
check-url = "http://${homelab.host_ip}:2222";
icon = "di:${service}";
}
];
};
}
modules/fileshares/holocron_new/zfs/default.nix
-100
View File
@@ -1,100 +0,0 @@
{
pkgs,
config,
lib,
...
}: let
cfg = config.holocron.zfs;
sec = config.sops.secrets;
in {
options.holocron.zfs = {
enable = lib.mkEnableOption "enables zfs";
};
config = lib.mkIf cfg.enable {
# set network host id
# enable zfs support
boot.kernelModules = ["zfs"];
boot.supportedFilesystems = ["zfs"];
boot.zfs.forceImportRoot = false;
# boot.initrd.services.zfs.enable = true;
# boot.zfs.requestEncryptionCredentials = true;
# arc cache size
boot.kernelParams = ["zfs.zfs_arc_max=12884901888"];
# pools to import
boot.zfs.extraPools = ["holocron"];
# enable smart monitoring
services.smartd = {
enable = true;
autodetect = true;
defaults.monitored = "-a -o on -s (S/../.././05|L/../01/./05)";
notifications = {
test = false;
mail = {
enable = true;
recipient = "blake";
sender = "alerts@blakedheld.xyz";
};
};
};
# enable zfs
services.zfs = {
autoScrub.enable = true;
autoScrub.interval = "weekly";
# email notifs
zed = {
enableMail = true;
settings = {
ZED_EMAIL_ADDR = ["root" "blake"];
# send notification if scrub succeeds
ZED_NOTIFY_VERBOSE = true;
};
};
};
# install userspace tools for smart
environment.systemPackages = with pkgs; [smartmontools];
# mail test
services.mail.sendmailSetuidWrapper.enable = true;
programs.msmtp = {
enable = true;
setSendmail = true;
defaults = {
aliases = "/etc/aliases";
port = 587;
auth = "plain";
tls = "on";
tls_starttls = "on";
};
accounts.default = {
host = "smtp.mail.me.com";
user = "bdhelderman@icloud.com";
from = "alerts@blakedheld.xyz";
passwordeval = "/run/current-system/sw/bin/cat ${sec."email_pass".path}";
};
};
environment.etc.aliases.text = ''
root: me@blakedheld.xyz
blake: me@blakedheld.xyz
'';
sops.secrets = {
"email_pass" = {
owner = "blake";
group = "blake";
};
};
};
}