cilly/flakes
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

Merge branch 'tmp/caramel' into staging/20221003

Browse source
This commit is contained in:
LavaDesu 2022-10-03 21:01:11 +07:00
commit a6ea2431f0
Signed by: cilly
GPG key ID: 6500251E087653C9
14 changed files with 133 additions and 41 deletions
Download patch file Download diff file Expand all files Collapse all files

29
flake.nix
View file

@ -52,13 +52,13 @@
mkSystem =
if !(self ? rev) then throw "Dirty git tree detected." else
nixpkgs: name: arch: enableGUI: nixpkgs.lib.nixosSystem {
nixpkgs: name: arch: enableGUI: extraModules: nixpkgs.lib.nixosSystem {
system = arch;
modules = [
{ nixpkgs.overlays = overlays; }
agenix.nixosModules.age
(./hosts + "/${name}")
];
] ++ extraModules;
specialArgs = {
inherit inputs enableGUI;
modules = import ./modules { lib = nixpkgs.lib; };
@ -66,10 +66,16 @@
};
in
{
nixosConfigurations."blossom" = mkSystem nixpkgs "blossom" "x86_64-linux" true;
nixosConfigurations."blossom" = mkSystem nixpkgs "blossom" "x86_64-linux" true [];
nixosConfigurations."caramel" = mkSystem nixpkgs-porcupine "caramel" "aarch64-linux" false;
nixosConfigurations."sugarcane" = mkSystem nixpkgs-porcupine "sugarcane" "x86_64-linux" false;
nixosConfigurations."caramel" = mkSystem nixpkgs-porcupine "caramel" "aarch64-linux" false [{
nixpkgs.overlays = [
(self: super: {
makeModulesClosure = x: super.makeModulesClosure (x // { allowMissing = true; });
})
];
}];
nixosConfigurations."sugarcane" = mkSystem nixpkgs-porcupine "sugarcane" "x86_64-linux" false [];
packages."x86_64-linux" =
let
@ -92,18 +98,7 @@
{
inherit (pkgs) nixUnstable;
caramel-iso = nixos-generators.nixosGenerate {
inherit pkgs;
format = "sd-aarch64";
modules = [
agenix.nixosModules.age
./hosts/caramel
];
specialArgs = {
inherit inputs;
modules = import ./modules { lib = nixpkgs-porcupine.lib; };
};
};
caramel-img = self.nixosConfigurations."caramel".config.system.build.sdImage;
};
# TODO: currently broken

13
hosts/caramel/default.nix
View file

@ -1,4 +1,4 @@
{ config, inputs, modules, overlays, pkgs, ... }: {
{ config, inputs, modules, modulesPath, overlays, pkgs, ... }: {
networking.hostName = "caramel";
system.stateVersion = "21.11";
time.timeZone = "Asia/Phnom_Penh";
@ -12,6 +12,7 @@
};
imports =
(with modules.system; [
"${builtins.toString modulesPath}/installer/sd-card/sd-image-aarch64.nix"
inputs.home-manager-porcupine.nixosModule
base
@ -19,19 +20,23 @@
input
nix-porcupine
security
transmission
wireguard
./filesystem.nix
./kernel.nix
./image.nix
./networking.nix
./packages.nix
../../users/hana
]) ++
(with modules.services; [
nginx
postgres
synapse
# nginx
# postgres
# synapse
jellyfin
sonarr
tmptsync
unbound
vaultwarden

26
hosts/caramel/filesystem.nix
View file

@ -1,4 +1,4 @@
{ config, ... }:
{ config, lib, ... }:
let
bind = src: {
depends = [ "/persist" ];
@ -9,16 +9,31 @@ let
};
in {
fileSystems = {
"/" = {
"/" = lib.mkForce {
device = "rootfs";
fsType = "tmpfs";
options = [ "defaults" "size=2G" "mode=755" ];
options = [ "defaults" "size=1G" "mode=755" ];
};
"/nix" = {
# "/nix" = {
# device = "overlayfs";
# fsType = "overlay";
# options = [
# "lowerdir=/mnt/image/nix"
# "upperdir=/persist/nix-overlay"
# "workdir=/persist/.overlaytmp"
# ];
# noCheck = true;
# depends = [ "/mnt/image" "/persist" ];
# };
"/nix" = (bind "/mnt/image/nix") // { depends = [ "/mnt/image" ]; };
"/mnt/image" = {
device = "/dev/disk/by-label/NIXOS_SD";
fsType = "ext4";
options = [ "defaults" "noatime" ];
neededForBoot = true;
};
"/persist" = {
@ -28,9 +43,8 @@ in {
neededForBoot = true;
};
"/var/persist" = bind "/persist";
"/var/lib/acme" = bind "/persist/acme";
"/var/log/journal" = bind "/persist/journal";
"/boot" = (bind "/nix/persist/boot") // { depends = [ "/nix" ]; };
"/boot" = (bind "/mnt/image/boot") // { depends = [ "/mnt/image" ]; };
};
}

29
hosts/caramel/image.nix Normal file
View file

@ -0,0 +1,29 @@
{ config, lib, pkgs, ... }: {
sdImage.expandOnBoot = false;
boot.postBootCommands = ''
# On the first boot do some maintenance tasks
if [ -f /mnt/image/nix-path-registration ]; then
set -euo pipefail
set -x
# Figure out device names for the boot device and root filesystem.
rootPart=$(${pkgs.util-linux}/bin/findmnt -n -o SOURCE /mnt/image)
bootDevice=$(lsblk -npo PKNAME $rootPart)
partNum=$(lsblk -npo MAJ:MIN $rootPart | ${pkgs.gawk}/bin/awk -F: '{print $2}')
# Resize the root partition and the filesystem to fit the disk
echo ",+," | sfdisk -N$partNum --no-reread $bootDevice
${pkgs.parted}/bin/partprobe
${pkgs.e2fsprogs}/bin/resize2fs $rootPart
# Register the contents of the initial Nix store
${config.nix.package.out}/bin/nix-store --load-db < /mnt/image/nix-path-registration
# nixos-rebuild also requires a "system" profile and an /etc/NIXOS tag.
touch /etc/NIXOS
${config.nix.package.out}/bin/nix-env -p /nix/var/nix/profiles/system --set /run/current-system
# Prevents this from running on later boots.
rm -f /mnt/image/nix-path-registration
fi
'';
}

12
hosts/caramel/kernel.nix
View file

@ -1,11 +1,15 @@
{ config, inputs, pkgs, ... }: {
{ config, inputs, lib, pkgs, ... }: {
imports = [
inputs.nixos-hardware.nixosModules.raspberry-pi-4
];
hardware.raspberry-pi."4".fkms-3d.enable = true;
boot.kernel.sysctl = {
"kernel.core_pattern" = "|/bin/false";
"kernel.sysrq" = 1;
boot = {
initrd.kernelModules = [ "overlay" ];
supportedFilesystems = lib.mkForce [ "btrfs" "vfat" ];
kernel.sysctl = {
"kernel.core_pattern" = "|/bin/false";
"kernel.sysrq" = 1;
};
};
}

2
hosts/sugarcane/filesystem.nix
View file

@ -22,7 +22,7 @@ in {
neededForBoot = true;
};
"/var/persist" = bind "/nix/persist";
"/persist" = bind "/nix/persist";
"/var/log/journal" = bind "/nix/persist/journal";
"/boot" = bind "/nix/persist/boot";
};

2
modules/default.nix
View file

@ -15,8 +15,10 @@ let
);
in {
services = mkAttrsFromPaths [
./services/jellyfin.nix
./services/nginx.nix
./services/postgres.nix
./services/sonarr.nix
./services/synapse.nix
./services/tmptsync.nix
./services/unbound.nix

28
modules/services/jellyfin.nix Normal file
View file

@ -0,0 +1,28 @@
{ ... }:
let
dir = "/persist/jellyfin";
in
{
fileSystems."/var/lib/jellyfin" = {
depends = [ "/persist" ];
device = dir;
fsType = "none";
options = [ "bind" ];
};
system.activationScripts."jellyfin-create-bind-mount" = {
deps = [ "users" "groups" ];
text = ''
mkdir -p ${dir}
chown jellyfin:jellyfin ${dir}
chmod 700 ${dir}
'';
};
systemd.tmpfiles.rules = [
"d /tmp/jelly-transcodes 700 jellyfin jellyfin"
"L+ /var/lib/jellyfin/transcodes - - - - /tmp/jelly-transcodes"
];
services.jellyfin = {
enable = true;
openFirewall = true;
};
}

11
modules/services/sonarr.nix Normal file
View file

@ -0,0 +1,11 @@
{ ... }:
let
dir = "/persist/sonarr";
in
{
services.sonarr = {
enable = true;
dataDir = dir;
openFirewall = true;
};
}

10
modules/system/base.nix
View file

@ -1,10 +1,10 @@
{ config, enableGUI, inputs, modules, overlays, ... }: {
environment.etc = {
"machine-id".source = "/var/persist/machine-id";
"ssh/ssh_host_rsa_key".source = "/var/persist/ssh_host_rsa_key";
"ssh/ssh_host_rsa_key.pub".source = "/var/persist/ssh_host_rsa_key.pub";
"ssh/ssh_host_ed25519_key".source = "/var/persist/ssh_host_ed25519_key";
"ssh/ssh_host_ed25519_key.pub".source = "/var/persist/ssh_host_ed25519_key.pub";
"machine-id".source = "/persist/machine-id";
"ssh/ssh_host_rsa_key".source = "/persist/ssh_host_rsa_key";
"ssh/ssh_host_rsa_key.pub".source = "/persist/ssh_host_rsa_key.pub";
"ssh/ssh_host_ed25519_key".source = "/persist/ssh_host_ed25519_key";
"ssh/ssh_host_ed25519_key.pub".source = "/persist/ssh_host_ed25519_key.pub";
};
environment.pathsToLink = [ "/share/zsh" ];

4
modules/system/security.nix
View file

@ -15,12 +15,12 @@
hostKeys = [
{
bits = 4096;
path = "/var/persist/ssh_host_rsa_key";
path = "/persist/ssh_host_rsa_key";
rounds = 100;
type = "rsa";
}
{
path = "/var/persist/ssh_host_ed25519_key";
path = "/persist/ssh_host_ed25519_key";
rounds = 100;
type = "ed25519";
}

2
modules/system/transmission.nix
View file

@ -12,6 +12,8 @@
alt-speed-time-enabled = true;
alt-speed-time-end = 1380;
alt-speed-up = 256;
download-dir = "/persist/transmission/Downloads";
incomplete-dir = "/persist/transmission/.incomplete";
ratio-limit-enabled = true;
rpc-bind-address = "0.0.0.0";
rpc-enabled = true;

2
res/authorized_keys Normal file
View file

@ -0,0 +1,2 @@
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPru5eTBvHJ4ZmrrzPRHCGM09wQP/ZHSaKYalDuBVO15 rin@blossom
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJ5l9t8dc6mPsKKYqZlPKvhOdyqz+DS5UOcvHuh3uVGt @strawberry

4
users/hana/default.nix
View file

@ -24,8 +24,8 @@
];
programs.git.signing.signByDefault = lib.mkForce false;
programs.zsh.history.path = lib.mkForce "/nix/persist/hana/zsh_history";
programs.zsh.history.path = lib.mkForce "/persist/hana/zsh_history";
home.file.".ssh/authorized_keys".source = config.lib.file.mkOutOfStoreSymlink "/nix/persist/hana/authorized_keys";
home.file.".ssh/authorized_keys".source = ../../res/authorized_keys;
};
}