diff --git a/flake.nix b/flake.nix index cdd9ced..eb2d901 100644 --- a/flake.nix +++ b/flake.nix @@ -90,7 +90,7 @@ }; - galadriel = nixpkgs.lib.nixosSystem { + galadriel = nixpkgs.lib.nixosSystem { system = "x86_64-linux"; specialArgs = { inherit inputs; @@ -104,10 +104,21 @@ ozai.nixosModules.ozai ozai-webui.nixosModules.ozai-webui ]; - }; + }; + gandalf = nixpkgs.lib.nixosSystem { + system = "x86_64-linux"; + specialArgs = { + inherit inputs; + }; + modules = [ + ./machines/gandalf/configuration.nix + ({ config, pkgs, ... }: { nixpkgs.overlays = [ overlay-unstable ]; }) + sops-nix.nixosModules.sops + ]; + }; - elrond = nixpkgs.lib.nixosSystem { + elrond = nixpkgs.lib.nixosSystem { system = "x86_64-linux"; specialArgs = { inherit inputs; @@ -119,8 +130,8 @@ inputs.ozai.nixosModules.ozai inputs.ozai-webui.nixosModules.ozai-webui ]; - }; - }; + }; + }; devShells.x86_64-linux = { diff --git a/machines/gandalf/configuration.nix b/machines/gandalf/configuration.nix new file mode 100644 index 0000000..fc1384d --- /dev/null +++ b/machines/gandalf/configuration.nix @@ -0,0 +1,146 @@ +# Edit this configuration file to define what should be installed on +# your system. Help is available in the configuration.nix(5) man page +# and in the NixOS manual (accessible by running ‘nixos-help’). + +{ config, pkgs, lib, ... }: +{ + imports = + [ # Include the results of the hardware scan. + ./hardware-configuration.nix + ../../profiles/base.nix + ]; + + # Use the systemd-boot EFI boot loader. + boot.loader.systemd-boot.enable = true; + boot.loader.efi.canTouchEfiVariables = true; + + # The global useDHCP flag is deprecated, therefore explicitly set to false here. + # Per-interface useDHCP will be mandatory in the future, so this generated config + # replicates the default behaviour. + networking.useDHCP = true; + # networking.interfaces.ens3.useDHCP = true; # Interface is not constant. I really only want to use dhcp att all so could remove this in favor of the old way. + networking.hostName = "gandalf"; # Define your hostname. + + boot.kernel.sysctl = { + "net.ipv4.conf.all.forwarding" = true; + "net.ipv6.conf.all.forwarding" = true; + }; + + + # List packages installed in system profile. To search, run: + # $ nix search wget + environment.systemPackages = with pkgs; [ + git + wget + tailscale + ]; + + users.users.gunalx = { # Define a user account. Don't forget to set a password with ‘passwd’. + isNormalUser = true; + extraGroups = [ "wheel" ]; # Enable ‘sudo’ for the user. + initialPassword = "pw123"; # this is changed imedeately. + }; + + +#sequrity managment through kanidm +# systemd.services.kanidm = let +# certName = config.services.nginx.virtualHosts.${config.services.kanidm.serverSettings.domain}.useACMEHost; +# in { +# requires = [ "acme-finished-${certName}.target" ]; +# serviceConfig.LoadCredential = let +# certDir = config.security.acme.certs.${certName}.directory; +# in [ +# "fullchain.pem:${certDir}/fullchain.pem" +# "key.pem:${certDir}/key.pem" +# ]; +# }; +# +# services.kanidm = { +# enableServer = true; +# #enablePam = true; +# serverSettings = let +# credsDir = "/run/credentials/kanidm.service"; +# #credsDir = "/var/lib/acme/${config.networking.domain}"; #the files are here but not readable +# in { +# origin = "https://${config.services.kanidm.serverSettings.domain}"; +# domain = "auth.${config.networking.domain}"; +# tls_chain = "${credsDir}/fullchain.pem"; +# tls_key = "${credsDir}/key.pem"; +# bindaddress = "localhost:8300"; +# }; +# +# clientSettings = { +# # This should be at /etc/kanidm/config or ~/.config/kanidm, and configures the kanidm command line tool +# uri = "${config.services.kanidm.serverSettings.bindaddress}"; +# verify_ca = true; +# verify_hostnames = true; +# }; + # }; +# +# #environment = { +# # etc."kanidm/config".text = '' +# # uri="https://auth.${config.networking.domain}" +# # ''; +# #}; + + +#vpn stuff +# #need to run at fresh install to create namespace: headscale namespaces create +# services.headscale = { +# enable = true; +# user = "headscale"; +# address = "127.0.0.1"; +# port = 8080; +# settings = { +# logtail.enabled = false; +# metrics_listen_addr = "127.0.0.1:9090"; +# server_url = "https://${"vpn."+config.networking.domain}"; +# dns_config = { +# base_domain = "${config.networking.domain}"; +# magic_dns = true; +# nameservers = [ +# "1.1.1.1" +# ]; +# }; +# +# ##should really implement with fex github and kanidm +# #oidc = { +# # issuer = "{config.services.kanidm.serverSettings.origin}"; +# # allowed_domains = Domains; +# #}; +# }; +# }; + + users.users."root".openssh.authorizedKeys.keys = [ + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHTExYoT3+flrd2wPYiT7sFFDmAUqi2YAz0ldQg7WMop" + ]; + users.users."gunalx".openssh.authorizedKeys.keys = [ + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHTExYoT3+flrd2wPYiT7sFFDmAUqi2YAz0ldQg7WMop" + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEj+Y0RUrSaF8gUW8m2BY6i8e7/0bUWhu8u8KW+AoHDh gunalx@nixos" + ]; + + #firewall options + networking.firewall = { + enable = true; + checkReversePath = "loose"; + trustedInterfaces = [ "tailscale0" ]; + allowedUDPPorts = [ + 80 + 443 + 25565 + config.services.tailscale.port + #config.services.headscale.port + ]; + allowedTCPPorts = config.networking.firewall.allowedUDPPorts; + }; + + + # This value determines the NixOS release from which the default + # settings for stateful data, like file locations and database versions + # on your system were taken. It's perfectly fine and recommended to leave + # this value at the release version of the first install of this system. + # Before changing this value read the documentation for this option + # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html). + system.stateVersion = "23.05"; # Did you read the comment? + +} diff --git a/machines/gandalf/hardware-configuration.nix b/machines/gandalf/hardware-configuration.nix new file mode 100644 index 0000000..ed5efd7 --- /dev/null +++ b/machines/gandalf/hardware-configuration.nix @@ -0,0 +1,48 @@ +# Do not modify this file! It was generated by ‘nixos-generate-config’ +# and may be overwritten by future invocations. Please make changes +# to /etc/nixos/configuration.nix instead. +{ config, lib, pkgs, modulesPath, ... }: + +{ + imports = + [ (modulesPath + "/installer/scan/not-detected.nix") + ]; + + boot.initrd.availableKernelModules = [ "ahci" "xhci_pci" "nvme" "usbhid" "usb_storage" "sd_mod" ]; + boot.initrd.kernelModules = [ "dm-snapshot" ]; + boot.kernelModules = [ "kvm-intel" ]; + boot.extraModulePackages = [ ]; + + fileSystems."/" = + { device = "/dev/disk/by-uuid/a7b19945-9e59-4684-be34-1fd756239c55"; + fsType = "ext4"; + }; + + fileSystems."/boot" = + { device = "/dev/disk/by-uuid/B2B1-2206"; + fsType = "vfat"; + }; + + swapDevices = + [ { device = "/dev/disk/by-uuid/e2235b7c-f801-4c75-8d9e-15861c4b7e50"; } + ]; + + # Enables DHCP on each ethernet and wireless interface. In case of scripted networking + # (the default) this is the recommended approach. When using systemd-networkd it's + # still possible to use this option, but it's recommended to use it in conjunction + # with explicit per-interface declarations with `networking.interfaces..useDHCP`. + networking.useDHCP = lib.mkDefault true; + # networking.interfaces.eno1.useDHCP = lib.mkDefault true; + # networking.interfaces.eno2.useDHCP = lib.mkDefault true; + # networking.interfaces.eno3.useDHCP = lib.mkDefault true; + # networking.interfaces.eno4.useDHCP = lib.mkDefault true; + # networking.interfaces.enp0s21u2.useDHCP = lib.mkDefault true; + # networking.interfaces.enp4s0.useDHCP = lib.mkDefault true; + # networking.interfaces.enp5s0.useDHCP = lib.mkDefault true; + # networking.interfaces.enp6s0.useDHCP = lib.mkDefault true; + # networking.interfaces.enp7s0.useDHCP = lib.mkDefault true; + # networking.interfaces.enp8s0.useDHCP = lib.mkDefault true; + + nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux"; + hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware; +}