restructure and cleanup
This commit is contained in:
@@ -1,70 +0,0 @@
|
||||
{
|
||||
disko.devices = {
|
||||
disk = {
|
||||
main = {
|
||||
type = "disk";
|
||||
device = ""; # disk id here
|
||||
content = {
|
||||
type = "gpt";
|
||||
partitions = {
|
||||
ESP = {
|
||||
size = "1G";
|
||||
type = "EF00";
|
||||
content = {
|
||||
type = "filesystem";
|
||||
format = "vfat";
|
||||
mountpoint = "/boot";
|
||||
mountOptions = [ "umask=0077" ];
|
||||
};
|
||||
};
|
||||
luks = {
|
||||
size = "100%";
|
||||
content = {
|
||||
type = "luks";
|
||||
name = "crypted";
|
||||
# disable settings.keyFile if you want to use interactive password entry
|
||||
#passwordFile = "/tmp/secret.key"; # Interactive
|
||||
settings = {
|
||||
allowDiscards = true;
|
||||
#keyFile = "/tmp/secret.key";
|
||||
};
|
||||
#additionalKeyFiles = [ "/tmp/additionalSecret.key" ];
|
||||
content = {
|
||||
type = "btrfs";
|
||||
extraArgs = [ "-f" ];
|
||||
subvolumes = {
|
||||
"@root" = {
|
||||
mountpoint = "/";
|
||||
mountOptions = [
|
||||
"compress=zstd"
|
||||
"noatime"
|
||||
];
|
||||
};
|
||||
"@home" = {
|
||||
mountpoint = "/home";
|
||||
mountOptions = [
|
||||
"compress=zstd"
|
||||
"noatime"
|
||||
];
|
||||
};
|
||||
"@nix" = {
|
||||
mountpoint = "/nix";
|
||||
mountOptions = [
|
||||
"compress=zstd"
|
||||
"noatime"
|
||||
];
|
||||
};
|
||||
"@swap" = {
|
||||
mountpoint = "/.swapvol";
|
||||
swap.swapfile.size = "32G";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -63,7 +63,7 @@
|
||||
};
|
||||
networking = {
|
||||
hostName = "lumiose"; # hostname
|
||||
#hostId = ""; # zfs wants this
|
||||
networking.hostId = "007f0200";
|
||||
networkmanager = {
|
||||
enable = true; # the goat
|
||||
dns = "systemd-resolved"; # the backup dancer!
|
||||
|
||||
@@ -46,43 +46,25 @@
|
||||
};
|
||||
homelab = {
|
||||
enable = true;
|
||||
|
||||
# services
|
||||
gitea.enable = true;
|
||||
glance.enable = true;
|
||||
immich.enable = true;
|
||||
vaultwarden.enable = true;
|
||||
#searx.enable = true;
|
||||
|
||||
# home assistant
|
||||
home.enable = true;
|
||||
# hass.enable = true;
|
||||
# mosquitto.enable = true;
|
||||
# zigbee2mqtt.enable = true;
|
||||
|
||||
# network
|
||||
tailscale.enable = true;
|
||||
caddy.enable = true;
|
||||
dnsmasq.enable = true;
|
||||
|
||||
# mediastack
|
||||
mediastack.enable = true;
|
||||
# jellyfin.enable = true;
|
||||
# audiobookshelf.enable = true;
|
||||
# yacreader.enable = true;
|
||||
# qbittorrent.enable = true;
|
||||
# sonarr.enable = true;
|
||||
# radarr.enable = true;
|
||||
# bazarr.enable = true;
|
||||
# prowlarr.enable = true;
|
||||
# flaresolverr.enable = true;
|
||||
|
||||
# system
|
||||
backups.enable = true;
|
||||
motd.enable = true;
|
||||
postfix.enable = true;
|
||||
uptime-kuma.enable = true;
|
||||
|
||||
# ai
|
||||
open-webui.enable = true;
|
||||
ollama.enable = true;
|
||||
|
||||
@@ -1,160 +0,0 @@
|
||||
{
|
||||
pkgs,
|
||||
config,
|
||||
lib,
|
||||
inputs,
|
||||
...
|
||||
}: let
|
||||
service = "copyparty";
|
||||
cfg = config.databank.${service};
|
||||
sec = config.sops.secrets;
|
||||
homelab = config.homelab;
|
||||
in {
|
||||
imports = [inputs.copyparty.nixosModules.default];
|
||||
|
||||
options.databank.${service} = {
|
||||
enable = lib.mkEnableOption "enables ${service}";
|
||||
|
||||
# set port options
|
||||
port = lib.mkOption {
|
||||
type = lib.types.int;
|
||||
default = 7902;
|
||||
description = "set port for ${service} (default: ${toString cfg.port}";
|
||||
};
|
||||
url = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "${service}.${homelab.base_domain}";
|
||||
description = "set domain for ${service}";
|
||||
};
|
||||
data_dir = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "/var/lib/${service}";
|
||||
description = "set data directory for ${service}";
|
||||
};
|
||||
ids = lib.mkOption {
|
||||
type = lib.types.int;
|
||||
default = cfg.port;
|
||||
description = "set uid and pid of ${service} user (matches port by default)";
|
||||
};
|
||||
backup = lib.mkOption {
|
||||
type = lib.types.bool;
|
||||
default = true;
|
||||
description = "enable backups for ${service}";
|
||||
};
|
||||
};
|
||||
|
||||
config = lib.mkIf cfg.enable {
|
||||
nixpkgs.overlays = [inputs.copyparty.overlays.default];
|
||||
# declare ${service} group
|
||||
users.groups.${service} = {
|
||||
gid = lib.mkForce cfg.ids;
|
||||
};
|
||||
|
||||
# declare ${service} user
|
||||
users.users.${service} = {
|
||||
description = lib.mkForce "${service} server user";
|
||||
uid = lib.mkForce cfg.ids;
|
||||
isSystemUser = true;
|
||||
home = cfg.data_dir;
|
||||
createHome = true;
|
||||
group = service;
|
||||
extraGroups = [ "media" "blake" "archives" ];
|
||||
};
|
||||
|
||||
# enable the ${service} service
|
||||
services.${service} = {
|
||||
enable = true;
|
||||
user = service;
|
||||
group = service;
|
||||
settings = {
|
||||
i = "0.0.0.0";
|
||||
p = [7902];
|
||||
rproxy = 1;
|
||||
};
|
||||
accounts = {
|
||||
blake = {
|
||||
passwordFile = sec."copyparty_passwd".path;
|
||||
};
|
||||
};
|
||||
groups = {
|
||||
media = ["blake"];
|
||||
};
|
||||
volumes = {
|
||||
"/archives" = {
|
||||
path = "/databank/archives";
|
||||
access = {
|
||||
r = "*";
|
||||
A = "blake";
|
||||
};
|
||||
flags = {
|
||||
chmod_f = 660;
|
||||
chmod_d = 770;
|
||||
#gid = ?;
|
||||
};
|
||||
};
|
||||
"/media" = {
|
||||
path = "/databank/media";
|
||||
access = {
|
||||
r = "*";
|
||||
w = "@media";
|
||||
A = "blake";
|
||||
};
|
||||
flags = {
|
||||
chmod_f = 660;
|
||||
chmod_d = 770;
|
||||
gid = "700";
|
||||
};
|
||||
};
|
||||
"/users/blake" = {
|
||||
path = "/databank/users/blake";
|
||||
access = {
|
||||
A = "blake";
|
||||
};
|
||||
flags = {
|
||||
chmod_f = 660;
|
||||
chmod_d = 770;
|
||||
gid = "1000";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
# open firewall
|
||||
networking.firewall.allowedTCPPorts = [cfg.port];
|
||||
|
||||
# add to caddy for reverse proxy
|
||||
services.caddy.virtualHosts."${cfg.url}" = {
|
||||
serverAliases = ["${service}.${homelab.public_domain}"];
|
||||
extraConfig = ''
|
||||
tls /etc/ssl/blakedheld.xyz.crt /etc/ssl/blakedheld.xyz.key
|
||||
reverse_proxy 127.0.0.1:${toString cfg.port} {
|
||||
}
|
||||
'';
|
||||
};
|
||||
|
||||
# add to glance (local service)
|
||||
homelab.glance.links.system = [
|
||||
{
|
||||
title = service;
|
||||
url = "https://${cfg.url}";
|
||||
error-url = "http://${homelab.host_ip}:${toString cfg.port}";
|
||||
check-url = "http://${homelab.host_ip}:${toString cfg.port}";
|
||||
icon = "di:${service}";
|
||||
}
|
||||
];
|
||||
|
||||
sops.secrets = {
|
||||
"${service}_passwd" = {
|
||||
owner = service;
|
||||
group = service;
|
||||
};
|
||||
};
|
||||
|
||||
# add to backups
|
||||
homelab.backups.baks = {
|
||||
${service} = {
|
||||
paths = [cfg.data_dir];
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -1,21 +0,0 @@
|
||||
{
|
||||
pkgs,
|
||||
config,
|
||||
lib,
|
||||
inputs,
|
||||
...
|
||||
}: {
|
||||
# services show up in glance in reverse import order lmao
|
||||
imports = [
|
||||
./nfs
|
||||
./smb
|
||||
./zfs
|
||||
./syncthing
|
||||
./copyparty
|
||||
./perms
|
||||
];
|
||||
|
||||
# define the groups used for backups and archives
|
||||
users.groups.archives = {gid = 727;};
|
||||
|
||||
}
|
||||
@@ -1,28 +0,0 @@
|
||||
{
|
||||
pkgs,
|
||||
config,
|
||||
lib,
|
||||
...
|
||||
}:
|
||||
# define nfs exports
|
||||
let
|
||||
cfg = config.databank.nfs;
|
||||
nfs_exports = ''
|
||||
/databank/media *(ro,sync,no_subtree_check)
|
||||
'';
|
||||
#/databank/users *(rw,sync,no_subtree_check,no_root_squash)
|
||||
in {
|
||||
options.databank.nfs = {
|
||||
enable = lib.mkEnableOption "enables nfs";
|
||||
};
|
||||
|
||||
config = lib.mkIf cfg.enable {
|
||||
# enable nfs with all exports
|
||||
services.nfs = {
|
||||
server = {
|
||||
enable = true;
|
||||
exports = nfs_exports;
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -1,65 +0,0 @@
|
||||
{
|
||||
config,
|
||||
pkgs,
|
||||
lib,
|
||||
...
|
||||
}: let
|
||||
service = "ensure_perms";
|
||||
cfg = config.databank.${service};
|
||||
|
||||
# define variables for paths
|
||||
archives_path = "/databank/archives";
|
||||
media_path = "/databank/media";
|
||||
users_path = "/databank/users";
|
||||
in {
|
||||
options.databank.ensure_perms = {
|
||||
enable = lib.mkEnableOption "enables perms ensurence script";
|
||||
};
|
||||
|
||||
config = lib.mkIf cfg.enable {
|
||||
# service to run periodically to reset the perms on all zpools
|
||||
# everything works fine without this, just for peace of mind
|
||||
# and to clean up the ownership from the arr stack in /databank/media
|
||||
systemd.services.${service} = {
|
||||
description = "ensure file permissions for archives, media and user folders";
|
||||
serviceConfig = {
|
||||
Type = "oneshot";
|
||||
ExecStart = pkgs.writeShellScript "ensure_perms" ''
|
||||
|
||||
# Fix ownership for archives directory
|
||||
echo "starting ${archives_path}"
|
||||
chown -Rc root:archives ${archives_path}
|
||||
find "${archives_path}" -type d -exec chmod 2770 "$@" {} +
|
||||
find "${archives_path}" -type f -exec chmod 660 "$@" {} +
|
||||
|
||||
# Fix ownership for media directory
|
||||
echo "starting ${media_path}"
|
||||
chown -Rc root:media ${media_path}
|
||||
find "${media_path}" -type d -exec chmod 2770 "$@" {} +
|
||||
find "${media_path}" -type f -exec chmod 660 "$@" {} +
|
||||
|
||||
# Fix user directories
|
||||
for user_dir in ${users_path}/*; do
|
||||
if [ -d "$user_dir" ]; then
|
||||
user=$(basename "$user_dir")
|
||||
echo "starting $user_dir"
|
||||
chown -Rc $user:$user $user_dir
|
||||
find $user_dir -type d -exec chmod 2770 "$@" {} +
|
||||
find $user_dir -type f -exec chmod 660 "$@" {} +
|
||||
fi
|
||||
done
|
||||
echo "fin"
|
||||
'';
|
||||
};
|
||||
};
|
||||
|
||||
systemd.timers.${service} = {
|
||||
description = "run script to ensure_perms daily";
|
||||
wantedBy = ["timers.target"];
|
||||
timerConfig = {
|
||||
OnCalendar = "03:30";
|
||||
Persistent = true;
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -1,59 +0,0 @@
|
||||
{
|
||||
pkgs,
|
||||
config,
|
||||
lib,
|
||||
...
|
||||
}:
|
||||
# define smb shares
|
||||
let
|
||||
cfg = config.databank.smb;
|
||||
smb_shares = {
|
||||
archives = {
|
||||
path = "/databank/archives";
|
||||
browseable = true;
|
||||
writable = true;
|
||||
guestOk = false;
|
||||
"create mask" = "0775";
|
||||
"directory mask" = "0775";
|
||||
};
|
||||
timemachine = {
|
||||
browseable = true;
|
||||
"path" = "/databank/archives/timemachine";
|
||||
"valid users" = "blake";
|
||||
"public" = "no";
|
||||
"writeable" = "yes";
|
||||
"force user" = "blake";
|
||||
"fruit:aapl" = "yes";
|
||||
"fruit:time machine" = "yes";
|
||||
"vfs objects" = "catia fruit streams_xattr";
|
||||
};
|
||||
users = {
|
||||
path = "/databank/users";
|
||||
browseable = true;
|
||||
writable = true;
|
||||
guestOk = false;
|
||||
"create mask" = "0660";
|
||||
"directory mask" = "0770";
|
||||
};
|
||||
media = {
|
||||
path = "/databank/media";
|
||||
browseable = true;
|
||||
writable = true;
|
||||
guestOk = false;
|
||||
"create mask" = "0775";
|
||||
"directory mask" = "0775";
|
||||
};
|
||||
};
|
||||
in {
|
||||
options.databank.smb = {
|
||||
enable = lib.mkEnableOption "enables smb";
|
||||
};
|
||||
|
||||
config = lib.mkIf cfg.enable {
|
||||
# enable smb with all shares
|
||||
services.samba = {
|
||||
enable = true;
|
||||
settings = smb_shares;
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -1,87 +0,0 @@
|
||||
{
|
||||
pkgs,
|
||||
config,
|
||||
lib,
|
||||
...
|
||||
}: let
|
||||
service = "syncthing";
|
||||
cfg = config.databank.${service};
|
||||
sec = config.sops.secrets;
|
||||
url = "syncthing.snowbelle.lan";
|
||||
homelab = config.homelab;
|
||||
in {
|
||||
options.databank.${service} = {
|
||||
enable = lib.mkEnableOption "enables syncthing";
|
||||
};
|
||||
|
||||
config = lib.mkIf cfg.enable {
|
||||
services.syncthing = {
|
||||
enable = true;
|
||||
user = "blake";
|
||||
group = "blake";
|
||||
dataDir = "/var/lib/syncthing";
|
||||
guiAddress = "0.0.0.0:2222";
|
||||
openDefaultPorts = true;
|
||||
#extraFlags = ["--no-default-folder"];
|
||||
key = sec."${service}/snowbelle/key".path;
|
||||
cert = sec."${service}/snowbelle/cert".path;
|
||||
settings = {
|
||||
devices = {
|
||||
"mudkip" = {id = "OV4NUQK-3YHRL5R-SIZGTNL-7VZFFUX-FOJ6NTS-C7ROXR7-I2Q2W7G-QERO7AO";};
|
||||
"zygarde" = {id = "UYLTF52-VVKUR7F-JN33HQZ-RFNWGL3-JER52LA-GZD2LPJ-QIFEE7K-MNMZRQ5";};
|
||||
"yveltal" = {id = "ZVSQ4WJ-7OICYOZ-3ECES4X-KH37IPB-TKHKUJG-BSEGXVM-AHYY5C3-VKG44AX";};
|
||||
"CEN-IT-07" = {id = "DPYKA4Z-3PX7JB2-FBEOXXX-SC7TLT2-QC5P2IR-SXOPJGX-QO3DMII-5B7UCA4";};
|
||||
"CEN-IT-00007" = {id = "XBPXGYU-DUJSLDH-6BDNF4D-CO2COC3-N3FM6W5-IHZOJBM-Z2N77RI-IVAV5AH";};
|
||||
};
|
||||
folders = {
|
||||
"databank" = {
|
||||
path = "/databank/users/blake/holocron";
|
||||
devices = ["mudkip" "zygarde" "CEN-IT-07" "CEN-IT-00007" "yveltal"];
|
||||
id = "5voxg-c3he2";
|
||||
versioning = {
|
||||
type = "staggered";
|
||||
fsPath = "/databank/users/blake/holocron/.stversions";
|
||||
params = {
|
||||
cleanInterval = "3600";
|
||||
maxAge = "0";
|
||||
};
|
||||
};
|
||||
|
||||
};
|
||||
};
|
||||
options = {
|
||||
urAccepted = -1;
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
sops.secrets = {
|
||||
"${service}/snowbelle/key" = {
|
||||
owner = "blake";
|
||||
group = "blake";
|
||||
};
|
||||
"${service}/snowbelle/cert" = {
|
||||
owner = "blake";
|
||||
group = "blake";
|
||||
};
|
||||
};
|
||||
homelab.backups.baks = {
|
||||
${service} = { paths = [ config.services.syncthing.dataDir ]; };
|
||||
};
|
||||
|
||||
services.caddy.virtualHosts."${url}" = {
|
||||
extraConfig = ''
|
||||
tls /etc/ssl/blakedheld.xyz.crt /etc/ssl/blakedheld.xyz.key
|
||||
reverse_proxy 127.0.0.1:2222
|
||||
'';
|
||||
};
|
||||
|
||||
# add to glance (local service)
|
||||
homelab.glance.links.system = [{
|
||||
title = service;
|
||||
url = "https://${url}";
|
||||
error-url = "http://${homelab.host_ip}:2222";
|
||||
check-url = "http://${homelab.host_ip}:2222";
|
||||
icon = "di:${service}"; }];
|
||||
};
|
||||
}
|
||||
@@ -1,78 +0,0 @@
|
||||
{
|
||||
pkgs,
|
||||
config,
|
||||
lib,
|
||||
...
|
||||
}: let
|
||||
cfg = config.databank.zfs;
|
||||
in {
|
||||
options.databank.zfs = {
|
||||
enable = lib.mkEnableOption "enables zfs";
|
||||
};
|
||||
|
||||
config = lib.mkIf cfg.enable {
|
||||
# set network host id
|
||||
networking.hostId = "3e6e7055";
|
||||
|
||||
# enable zfs support
|
||||
boot.kernelModules = ["zfs"];
|
||||
boot.supportedFilesystems = ["zfs"];
|
||||
|
||||
# arc cache size
|
||||
boot.kernelParams = [ "zfs.zfs_arc_max=12884901888" ];
|
||||
|
||||
# pools to import
|
||||
#boot.zfs.extraPools = [ "databank" "databank/archives" "/databank/media" "/databank/users" ];
|
||||
#boot.zfs.extraPools = [ "databank" ];
|
||||
|
||||
# enable smart monitoring
|
||||
services.smartd = {
|
||||
enable = true;
|
||||
autodetect = true;
|
||||
defaults.monitored = "-a -o on -s (S/../.././05|L/../01/./05)";
|
||||
notifications.mail = {
|
||||
enable = true;
|
||||
sender = "zfs@snowbelle.lan";
|
||||
};
|
||||
};
|
||||
|
||||
# enable zfs
|
||||
services.zfs = {
|
||||
autoScrub.enable = true;
|
||||
autoScrub.interval = "weekly";
|
||||
# email notifs
|
||||
zed = {
|
||||
enableMail = true;
|
||||
settings = {
|
||||
ZED_EMAIL_ADDR = ["root"];
|
||||
# send notification if scrub succeeds
|
||||
ZED_NOTIFY_VERBOSE = true;
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
# install userspace tools for acl's
|
||||
environment.systemPackages = with pkgs; [smartmontools];
|
||||
|
||||
fileSystems."/databank" = {
|
||||
device = "databank";
|
||||
fsType = "zfs";
|
||||
options = ["nofail"];
|
||||
};
|
||||
fileSystems."/databank/archives" = {
|
||||
device = "databank/archives";
|
||||
fsType = "zfs";
|
||||
options = ["nofail"];
|
||||
};
|
||||
fileSystems."/databank/users" = {
|
||||
device = "databank/users";
|
||||
fsType = "zfs";
|
||||
options = ["nofail"];
|
||||
};
|
||||
fileSystems."/databank/media" = {
|
||||
device = "databank/media";
|
||||
fsType = "zfs";
|
||||
options = ["nofail"];
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -1,160 +0,0 @@
|
||||
{
|
||||
pkgs,
|
||||
config,
|
||||
lib,
|
||||
inputs,
|
||||
...
|
||||
}: let
|
||||
service = "copyparty";
|
||||
cfg = config.holocron.${service};
|
||||
sec = config.sops.secrets;
|
||||
homelab = config.homelab;
|
||||
in {
|
||||
imports = [inputs.copyparty.nixosModules.default];
|
||||
|
||||
options.holocron.${service} = {
|
||||
enable = lib.mkEnableOption "enables ${service}";
|
||||
|
||||
# set port options
|
||||
port = lib.mkOption {
|
||||
type = lib.types.int;
|
||||
default = 7902;
|
||||
description = "set port for ${service} (default: ${toString cfg.port}";
|
||||
};
|
||||
url = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "${service}.${homelab.base_domain}";
|
||||
description = "set domain for ${service}";
|
||||
};
|
||||
data_dir = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "/var/lib/${service}";
|
||||
description = "set data directory for ${service}";
|
||||
};
|
||||
ids = lib.mkOption {
|
||||
type = lib.types.int;
|
||||
default = cfg.port;
|
||||
description = "set uid and pid of ${service} user (matches port by default)";
|
||||
};
|
||||
backup = lib.mkOption {
|
||||
type = lib.types.bool;
|
||||
default = true;
|
||||
description = "enable backups for ${service}";
|
||||
};
|
||||
};
|
||||
|
||||
config = lib.mkIf cfg.enable {
|
||||
nixpkgs.overlays = [inputs.copyparty.overlays.default];
|
||||
# declare ${service} group
|
||||
users.groups.${service} = {
|
||||
gid = lib.mkForce cfg.ids;
|
||||
};
|
||||
|
||||
# declare ${service} user
|
||||
users.users.${service} = {
|
||||
description = lib.mkForce "${service} server user";
|
||||
uid = lib.mkForce cfg.ids;
|
||||
isSystemUser = true;
|
||||
home = cfg.data_dir;
|
||||
createHome = true;
|
||||
group = service;
|
||||
extraGroups = [ "media" "blake" "archives" ];
|
||||
};
|
||||
|
||||
# enable the ${service} service
|
||||
services.${service} = {
|
||||
enable = true;
|
||||
user = service;
|
||||
group = service;
|
||||
settings = {
|
||||
i = "0.0.0.0";
|
||||
p = [7902];
|
||||
rproxy = 1;
|
||||
};
|
||||
accounts = {
|
||||
blake = {
|
||||
passwordFile = sec."copyparty_passwd".path;
|
||||
};
|
||||
};
|
||||
groups = {
|
||||
media = ["blake"];
|
||||
};
|
||||
volumes = {
|
||||
"/archives" = {
|
||||
path = "/holocron/archives";
|
||||
access = {
|
||||
r = "*";
|
||||
A = "blake";
|
||||
};
|
||||
flags = {
|
||||
chmod_f = 660;
|
||||
chmod_d = 770;
|
||||
#gid = ?;
|
||||
};
|
||||
};
|
||||
"/media" = {
|
||||
path = "/holocron/media";
|
||||
access = {
|
||||
r = "*";
|
||||
w = "@media";
|
||||
A = "blake";
|
||||
};
|
||||
flags = {
|
||||
chmod_f = 660;
|
||||
chmod_d = 770;
|
||||
gid = "700";
|
||||
};
|
||||
};
|
||||
"/users/blake" = {
|
||||
path = "/holocron/users/blake";
|
||||
access = {
|
||||
A = "blake";
|
||||
};
|
||||
flags = {
|
||||
chmod_f = 660;
|
||||
chmod_d = 770;
|
||||
gid = "1000";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
# open firewall
|
||||
networking.firewall.allowedTCPPorts = [cfg.port];
|
||||
|
||||
# add to caddy for reverse proxy
|
||||
services.caddy.virtualHosts."${cfg.url}" = {
|
||||
serverAliases = ["${service}.${homelab.public_domain}"];
|
||||
extraConfig = ''
|
||||
tls /etc/ssl/blakedheld.xyz.crt /etc/ssl/blakedheld.xyz.key
|
||||
reverse_proxy 127.0.0.1:${toString cfg.port} {
|
||||
}
|
||||
'';
|
||||
};
|
||||
|
||||
# add to glance (local service)
|
||||
homelab.glance.links.system = [
|
||||
{
|
||||
title = service;
|
||||
url = "https://${cfg.url}";
|
||||
error-url = "http://${homelab.host_ip}:${toString cfg.port}";
|
||||
check-url = "http://${homelab.host_ip}:${toString cfg.port}";
|
||||
icon = "di:${service}";
|
||||
}
|
||||
];
|
||||
|
||||
sops.secrets = {
|
||||
"${service}_passwd" = {
|
||||
owner = service;
|
||||
group = service;
|
||||
};
|
||||
};
|
||||
|
||||
# add to backups
|
||||
homelab.backups.baks = {
|
||||
${service} = {
|
||||
paths = [cfg.data_dir];
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -7,7 +7,7 @@
|
||||
service = "syncthing";
|
||||
cfg = config.holocron.${service};
|
||||
sec = config.sops.secrets;
|
||||
url = "syncthing.snowbelle.lan";
|
||||
url = "syncthing.${config.netowrking.}.lan";
|
||||
homelab = config.homelab;
|
||||
in {
|
||||
options.holocron.${service} = {
|
||||
@@ -46,7 +46,6 @@ in {
|
||||
maxAge = "0";
|
||||
};
|
||||
};
|
||||
|
||||
};
|
||||
};
|
||||
options = {
|
||||
@@ -71,17 +70,20 @@ in {
|
||||
|
||||
services.caddy.virtualHosts."${url}" = {
|
||||
extraConfig = ''
|
||||
tls /etc/ssl/blakedheld.xyz.crt /etc/ssl/blakedheld.xyz.key
|
||||
tls internal
|
||||
reverse_proxy 127.0.0.1:2222
|
||||
'';
|
||||
};
|
||||
|
||||
# add to glance (local service)
|
||||
homelab.glance.links.system = [{
|
||||
homelab.glance.links.system = [
|
||||
{
|
||||
title = service;
|
||||
url = "https://${url}";
|
||||
error-url = "http://${homelab.host_ip}:2222";
|
||||
check-url = "http://${homelab.host_ip}:2222";
|
||||
icon = "di:${service}"; }];
|
||||
icon = "di:${service}";
|
||||
}
|
||||
];
|
||||
};
|
||||
}
|
||||
|
||||
@@ -6,7 +6,6 @@
|
||||
}: let
|
||||
cfg = config.holocron.zfs;
|
||||
sec = config.sops.secrets;
|
||||
|
||||
in {
|
||||
options.holocron.zfs = {
|
||||
enable = lib.mkEnableOption "enables zfs";
|
||||
@@ -14,7 +13,6 @@ in {
|
||||
|
||||
config = lib.mkIf cfg.enable {
|
||||
# set network host id
|
||||
networking.hostId = "007f0200";
|
||||
|
||||
# enable zfs support
|
||||
boot.kernelModules = ["zfs"];
|
||||
@@ -62,7 +60,6 @@ in {
|
||||
# install userspace tools for smart
|
||||
environment.systemPackages = with pkgs; [smartmontools];
|
||||
|
||||
|
||||
# mail test
|
||||
|
||||
services.mail.sendmailSetuidWrapper.enable = true;
|
||||
@@ -98,6 +95,5 @@ in {
|
||||
group = "blake";
|
||||
};
|
||||
};
|
||||
|
||||
};
|
||||
}
|
||||
|
||||
@@ -48,7 +48,6 @@ in {
|
||||
};
|
||||
|
||||
config = lib.mkIf cfg.enable {
|
||||
|
||||
# declare ${service} user
|
||||
users.users.minecraft = lib.mkDefault {
|
||||
description = "minecraft server user";
|
||||
@@ -120,7 +119,7 @@ in {
|
||||
# };
|
||||
# };
|
||||
|
||||
# backups minecraft_recpro with borg!
|
||||
# backups minecraft_modded with borg!
|
||||
services.borgbackup.jobs.${service} = {
|
||||
archiveBaseName = service;
|
||||
repo = cfg.backup_repo;
|
||||
|
||||
@@ -8,16 +8,6 @@
|
||||
in {
|
||||
options.homelab = {
|
||||
enable = lib.mkEnableOption "enable homelab services and configuration";
|
||||
media_user = lib.mkOption {
|
||||
default = "media";
|
||||
type = lib.types.str;
|
||||
description = "user for media file permissions";
|
||||
};
|
||||
media_group = lib.mkOption {
|
||||
default = "media";
|
||||
type = lib.types.str;
|
||||
description = "group for media file permissions";
|
||||
};
|
||||
tz = lib.mkOption {
|
||||
default = "America/Chicago";
|
||||
type = lib.types.str;
|
||||
@@ -31,12 +21,12 @@ in {
|
||||
public_domain = lib.mkOption {
|
||||
default = "blakedheld.xyz";
|
||||
type = lib.types.str;
|
||||
description = "base domain used for reverse proxy";
|
||||
description = "public domain used for reverse proxy";
|
||||
};
|
||||
host_ip = lib.mkOption {
|
||||
default = "10.10.0.10";
|
||||
type = lib.types.str;
|
||||
description = "base domain used for reverse proxy";
|
||||
description = "base ip used for reverse proxy";
|
||||
};
|
||||
};
|
||||
|
||||
|
||||
@@ -1,13 +1,16 @@
|
||||
{ pkgs, config, lib, inputs, ... }:
|
||||
|
||||
let
|
||||
{
|
||||
pkgs,
|
||||
config,
|
||||
lib,
|
||||
inputs,
|
||||
...
|
||||
}: let
|
||||
nixservice = "home-assistant";
|
||||
service = "hass";
|
||||
cfg = config.homelab.${service};
|
||||
sec = config.sops.secrets;
|
||||
homelab = config.homelab;
|
||||
in
|
||||
{
|
||||
in {
|
||||
options.homelab.${service} = {
|
||||
enable = lib.mkEnableOption "enables ${service}";
|
||||
|
||||
@@ -44,7 +47,6 @@ in
|
||||
};
|
||||
|
||||
config = lib.mkIf cfg.enable {
|
||||
|
||||
# declare ${service} group
|
||||
users.groups.${service} = {gid = lib.mkForce cfg.ids;};
|
||||
|
||||
@@ -101,12 +103,15 @@ in
|
||||
};
|
||||
|
||||
# add to glance
|
||||
homelab.glance.links.services = [{
|
||||
homelab.glance.links.services = [
|
||||
{
|
||||
title = "home assistant";
|
||||
url = "https://hass.${homelab.public_domain}";
|
||||
error-url = "http://${homelab.host_ip}:${toString cfg.port}";
|
||||
check-url = "http://${homelab.host_ip}:${toString cfg.port}";
|
||||
icon = "di:${nixservice}"; }];
|
||||
icon = "di:${nixservice}";
|
||||
}
|
||||
];
|
||||
|
||||
# add to backups
|
||||
homelab.backups.baks = {
|
||||
@@ -114,9 +119,6 @@ in
|
||||
};
|
||||
};
|
||||
}
|
||||
|
||||
|
||||
|
||||
# here lies my tough, and I mean fucking tough, swing at
|
||||
# getting this to work bare metal, ggs ill see you again
|
||||
# - didnt take long
|
||||
@@ -158,4 +160,3 @@ in
|
||||
## };
|
||||
# };
|
||||
|
||||
|
||||
|
||||
@@ -1,46 +0,0 @@
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
pkgs,
|
||||
inputs,
|
||||
...
|
||||
}:
|
||||
|
||||
{
|
||||
imports = [
|
||||
../dots
|
||||
];
|
||||
|
||||
dots = {
|
||||
stylix = {
|
||||
enable = true;
|
||||
wallpaper = ../assets/wallpapers/yveltal.jpg;
|
||||
};
|
||||
|
||||
programs.enable = true;
|
||||
|
||||
kitty.enable = true;
|
||||
librewolf.enable = true;
|
||||
waybar.enable = true;
|
||||
dunst.enable = true;
|
||||
hypr.enable = true;
|
||||
tofi.enable = true;
|
||||
clipboard.enable = true;
|
||||
cursor.enable = true;
|
||||
|
||||
btop.enable = true;
|
||||
lf.enable = true;
|
||||
nvf.enable = true;
|
||||
zsh.enable = true;
|
||||
ssh.enable = true;
|
||||
gpg.enable = true;
|
||||
git.enable = true;
|
||||
xdg.enable = true;
|
||||
|
||||
libreoffice.enable = true;
|
||||
gnucash.enable = true;
|
||||
qalculate.enable = true;
|
||||
bitwarden.enable = true;
|
||||
};
|
||||
|
||||
}
|
||||
Reference in New Issue
Block a user