oysteikt/nix-dotfiles
oysteikt
/
nix-dotfiles
2
1
Fork 0
Code Issues Pull Requests Activity

tsuki: move to bare metal, set up zfs

This commit is contained in:
Oystein Kristoffer Tveit 2024-01-23 05:24:47 +01:00
parent 3a52ba8901
commit 0d3e805611
Signed by: oysteikt
GPG Key ID: 9F2F7D8250F35146
15 changed files with 180 additions and 109 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

64
hosts/tsuki/configuration.nix
View File

@ -1,7 +1,7 @@
{ config, lib, secrets, modulesPath, ... }: { config, lib, secrets, modulesPath, ... }:
{ {
imports = [ imports = [
(modulesPath + "/profiles/qemu-guest.nix") ./hardware-configuration.nix
./services/atuin.nix ./services/atuin.nix
./services/borg.nix ./services/borg.nix
@ -32,14 +32,12 @@
headless = true; headless = true;
dataDrives = { dataDrives = {
drives = { drives = {
backup = "/data2/backup"; backup = "/data/backup";
momiji = "/data2/momiji"; cirno = "/data/cirno";
cirno = "/data2/cirno"; media = "/data/media";
media = "/data2/media"; home = "/home";
postgres = "/data2/postgres";
home = "/data2/home";
}; };
default = "/data2/momiji"; default = "/data";
}; };
}; };
@ -88,62 +86,24 @@
sops.secrets."drives/cirno/credentials" = {}; sops.secrets."drives/cirno/credentials" = {};
fileSystems = let
nfsDrive = drivename: {
device = "10.0.0.36:/mnt/PoolsClosed/${drivename}";
fsType = "nfs";
options = [ "vers=3" "local_lock=all" ];
};
in {
"/" = {
device = "/dev/disk/by-uuid/54b9fd58-0df5-410c-ab87-766860967653";
fsType = "btrfs";
};
"/boot" = {
device = "/dev/disk/by-uuid/0A60-2885";
fsType = "vfat";
};
"/data2/backup" = nfsDrive "backup";
"/data2/momiji" = nfsDrive "momiji";
"/data2/media" = nfsDrive "media";
"/data2/postgres" = nfsDrive "postgres";
"/data2/home" = nfsDrive "home";
"/data2/cirno" = {
device = "//10.0.0.36/cirno";
fsType = "cifs";
options = [
"vers=3.0"
"cred=${config.sops.secrets."drives/cirno/credentials".path}"
"rw"
"uid=1000"
];
};
};
swapDevices = [{ device = "/dev/disk/by-uuid/92a1a33f-89a8-45de-a45e-6c303172cd7f"; }];
virtualisation = { virtualisation = {
docker.enable = true; docker.enable = true;
}; };
services.zfs.autoScrub.enable = true;
boot = { boot = {
initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "virtio_scsi" "sd_mod" "sr_mod" ]; zfs.requestEncryptionCredentials = false;
initrd.kernelModules = [ ];
kernelModules = [ ];
extraModulePackages = [ ];
loader = { loader = {
grub = { grub = {
enable = true; enable = true;
efiSupport = true; efiSupport = true;
fsIdentifier = "label";
device = "nodev";
efiInstallAsRemovable = true; efiInstallAsRemovable = true;
mirroredBoots = [
{ devices = [ "nodev" ]; path = "/boot"; }
];
}; };
# efi.efiSysMountPoint = "/boot/efi";
# efi.canTouchEfiVariables = true;
}; };
}; };
} }

80
hosts/tsuki/hardware-configuration.nix Normal file
View File

@ -0,0 +1,80 @@
# Do not modify this file! It was generated by ‘nixos-generate-config’
# and may be overwritten by future invocations. Please make changes
# to /etc/nixos/configuration.nix instead.
{ config, lib, pkgs, modulesPath, ... }:
{
imports =
[ (modulesPath + "/installer/scan/not-detected.nix")
];
boot.initrd.availableKernelModules = [ "uhci_hcd" "ehci_pci" "ata_piix" "megaraid_sas" "usb_storage" "usbhid" "sd_mod" "sr_mod" ];
boot.initrd.kernelModules = [ "dm-snapshot" ];
boot.kernelModules = [ "kvm-intel" ];
boot.extraModulePackages = [ ];
fileSystems."/" =
{ device = "momiji/root";
fsType = "zfs";
};
fileSystems."/data" =
{ device = "momiji/data";
fsType = "zfs";
};
fileSystems."/nix" =
{ device = "momiji/nix";
fsType = "zfs";
};
fileSystems."/home" =
{ device = "momiji/home";
fsType = "zfs";
};
fileSystems."/var" =
{ device = "momiji/var";
fsType = "zfs";
};
fileSystems."/var/lib/postgresql" =
{ device = "momiji/data/postgres";
fsType = "zfs";
};
fileSystems."/var/lib/minecraft" =
{ device = "momiji/data/minecraft";
fsType = "zfs";
};
fileSystems."/data/media" =
{ device = "momiji/data/media";
fsType = "zfs";
};
fileSystems."/data/backup" =
{ device = "momiji/data/backup";
fsType = "zfs";
};
fileSystems."/boot" =
{ device = "/dev/disk/by-uuid/66C8-A92E";
fsType = "vfat";
};
swapDevices = [ ];
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
# (the default) this is the recommended approach. When using systemd-networkd it's
# still possible to use this option, but it's recommended to use it in conjunction
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
networking.useDHCP = lib.mkDefault true;
# networking.interfaces.eno1.useDHCP = lib.mkDefault true;
# networking.interfaces.eno2.useDHCP = lib.mkDefault true;
# networking.interfaces.eno3.useDHCP = lib.mkDefault true;
# networking.interfaces.eno4.useDHCP = lib.mkDefault true;
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
}

3
hosts/tsuki/services/gitea/default.nix
View File

@ -27,11 +27,10 @@ in {
user = "git"; user = "git";
package = unstable-pkgs.gitea; package = unstable-pkgs.gitea;
stateDir = "${config.machineVars.dataDrives.default}/var/gitea";
dump = { dump = {
enable = true; enable = true;
interval = "weekly"; interval = "weekly";
backupDir = "/data/backup/gitea";
}; };
database = { database = {

1
hosts/tsuki/services/grafana/default.nix
View File

@ -19,7 +19,6 @@
services.grafana = { services.grafana = {
enable = true; enable = true;
dataDir = "${config.machineVars.dataDrives.default}/var/grafana";
provision = { provision = {
enable = true; enable = true;

3
hosts/tsuki/services/headscale.nix
View File

@ -14,9 +14,6 @@
services.headscale = { services.headscale = {
enable = true; enable = true;
# TODO: make PR
# dataDir = "${config.machineVars.dataDrives.default}/var/headscale";
port = 39304; port = 39304;
settings = { settings = {

1
hosts/tsuki/services/hedgedoc.nix
View File

@ -8,7 +8,6 @@
services.hedgedoc = { services.hedgedoc = {
enable = true; enable = true;
workDir = "${config.machineVars.dataDrives.default}/var/hedgedoc";
environmentFile = config.sops.secrets."hedgedoc/env".path; environmentFile = config.sops.secrets."hedgedoc/env".path;
settings = { settings = {
domain = "docs.nani.wtf"; domain = "docs.nani.wtf";

2
hosts/tsuki/services/matrix/default.nix
View File

@ -14,7 +14,7 @@
services.matrix-synapse-next = { services.matrix-synapse-next = {
enable = true; enable = true;
enableNginx = true; enableNginx = true;
dataDir = "${config.machineVars.dataDrives.default}/var/matrix"; dataDir = "/var/lib/matrix";
workers = { workers = {
federationSenders = 3; federationSenders = 3;

106
hosts/tsuki/services/minecraft/default.nix
View File

@ -1,13 +1,77 @@
{ pkgs, lib, config, inputs, secrets, ... }: { pkgs, lib, config, inputs, secrets, ... }:
let
cfg = config.services.minecraft-servers;
# See https://docs.papermc.io/paper/aikars-flags
jvmOpts = lib.concatStringsSep " " [
"-Xms5G"
"-Xmx15G"
"-XX:+UseG1GC"
"-XX:+ParallelRefProcEnabled"
"-XX:MaxGCPauseMillis=200"
"-XX:+UnlockExperimentalVMOptions"
"-XX:+DisableExplicitGC"
"-XX:+AlwaysPreTouch"
"-XX:G1NewSizePercent=30"
"-XX:G1MaxNewSizePercent=40"
"-XX:G1HeapRegionSize=8M"
"-XX:G1ReservePercent=20"
"-XX:G1HeapWastePercent=5"
"-XX:G1MixedGCCountTarget=4"
"-XX:InitiatingHeapOccupancyPercent=15"
"-XX:G1MixedGCLiveThresholdPercent=90"
"-XX:G1RSetUpdatingPauseTimePercent=5"
"-XX:SurvivorRatio=32"
"-XX:+PerfDisableSharedMem"
"-XX:MaxTenuringThreshold=1"
"-Dusing.aikars.flags=https://mcflags.emc.gs"
"-Daikars.new.flags=true"
];
# serverPackage = inputs.minecraft.packages.x86_64-linux.paper-server-1_20_2;
# serverPackage = pkgs.paperServers.paper-1_20_2;
# lazymc-config = ((pkgs.formats.toml { }).generate "lazymc.toml" {
# # public = {
# # version = builtins.head
# # (builtins.match "([[:digit:]].*[[:digit:]]*.[[:digit:]]*)-build.*" serverPackage.version);
# # protocol = 765;
# # };
# server = {
# directory = "${cfg.dataDir}/kakuland";
# command = "${serverPackage}/bin/minecraft-server ${jvmOpts}";
# freeze_process = false;
# probe_on_start = true;
# };
# rcon = {
# enabled = true;
# password = "mcrcond";
# randomize_password = false;
# };
# advanced.rewrite_server_properties = false;
# }).override {
# runCommand = pkgs.runCommandLocal;
# };
# lazymcServerPackage = pkgs.writeShellScriptBin "minecraft-server" ''
# exec ${lib.getExe pkgs.lazymc} -c ${lazymc-config}
# '';
in
{ {
# ugly hack for https://github.com/Infinidoge/nix-minecraft/pull/54
services.minecraft-server.dataDir = "/srv/minecraft";
services.minecraft-servers = { services.minecraft-servers = {
enable = true; enable = true;
eula = true; eula = true;
openFirewall = true; openFirewall = true;
dataDir = "${config.machineVars.dataDrives.default}/var/minecraft"; dataDir = "/var/lib/minecraft";
servers.kakuland = { servers.kakuland = {
enable = true; enable = true;
# package = lazymcServerPackage;
package = pkgs.paperServers.paper-1_20_4;
serverProperties = { serverProperties = {
allow-flight = true; allow-flight = true;
allow-nether = true; allow-nether = true;
@ -18,7 +82,6 @@
enable-command-block = false; enable-command-block = false;
enable-jmx-monitoring = false; enable-jmx-monitoring = false;
enable-query = false; enable-query = false;
enable-rcon = false;
enable-status = true; enable-status = true;
enforce-secure-profile = false; enforce-secure-profile = false;
enforce-whitelist = false; enforce-whitelist = false;
@ -47,14 +110,16 @@
pvp = true; pvp = true;
# "query.port" = 25565; # "query.port" = 25565;
rate-limit = 0; rate-limit = 0;
# rcon.password= enable-rcon = true;
# rcon.port=25575 "rcon.password" = "mcrcond";
"rcon.port" = 25575;
require-resource-pack = false; require-resource-pack = false;
# resource-pack= # resource-pack=
# resource-pack-prompt= # resource-pack-prompt=
# resource-pack-sha1= # resource-pack-sha1=
server-ip = "0.0.0.0"; server-ip = "0.0.0.0";
server-port = 25565; server-port = 25565;
# server-port = 25566;
simulation-distance = 10; simulation-distance = 10;
spawn-animals = true; spawn-animals = true;
spawn-monsters = true; spawn-monsters = true;
@ -67,33 +132,7 @@
white-list = true; white-list = true;
}; };
package = inputs.minecraft.packages.x86_64-linux.paper-server; inherit jvmOpts;
# See https://docs.papermc.io/paper/aikars-flags
jvmOpts = lib.concatStringsSep " " [
"-Xms5G"
"-Xmx15G"
"-XX:+UseG1GC"
"-XX:+ParallelRefProcEnabled"
"-XX:MaxGCPauseMillis=200"
"-XX:+UnlockExperimentalVMOptions"
"-XX:+DisableExplicitGC"
"-XX:+AlwaysPreTouch"
"-XX:G1NewSizePercent=30"
"-XX:G1MaxNewSizePercent=40"
"-XX:G1HeapRegionSize=8M"
"-XX:G1ReservePercent=20"
"-XX:G1HeapWastePercent=5"
"-XX:G1MixedGCCountTarget=4"
"-XX:InitiatingHeapOccupancyPercent=15"
"-XX:G1MixedGCLiveThresholdPercent=90"
"-XX:G1RSetUpdatingPauseTimePercent=5"
"-XX:SurvivorRatio=32"
"-XX:+PerfDisableSharedMem"
"-XX:MaxTenuringThreshold=1"
"-Dusing.aikars.flags=https://mcflags.emc.gs"
"-Daikars.new.flags=true"
];
symlinks = let symlinks = let
rawFile = file: pkgs.runCommandLocal (builtins.baseNameOf file) {} '' rawFile = file: pkgs.runCommandLocal (builtins.baseNameOf file) {} ''
@ -147,6 +186,9 @@
systemd.services.minecraft-server-kakuland.requires = [ "postgresql.service" ]; systemd.services.minecraft-server-kakuland.requires = [ "postgresql.service" ];
systemd.services.minecraft-server-kakuland.after = [ systemd.services.minecraft-server-kakuland.after = [
"postgresql.service" "postgresql.service"
"data2-momiji.mount" # "data2-momiji.mount"
]; ];
networking.firewall.allowedTCPPorts = [ 25565 ];
networking.firewall.allowedUDPPorts = [ 25565 ];
} }

2
hosts/tsuki/services/minecraft/pluginConfigs/serverBackup.nix
View File

@ -45,7 +45,7 @@
BackupLimiter = 0; BackupLimiter = 0;
KeepUniqueBackups = false; KeepUniqueBackups = false;
UpdateAvailableMessage = true; UpdateAvailableMessage = true;
BackupDestination = "Backups/"; BackupDestination = "/data/backup/minecraft/kakuland";
# Ftp = { # Ftp = {
# UploadBackup = false; # UploadBackup = false;

12
hosts/tsuki/services/osuchan.nix
View File

@ -1,12 +1,12 @@
{ secrets, config, ... }: { config, ... }:
{ {
sops.secrets."osuchan/envfile" = {
restartUnits = [ "osuchan.service" ];
};
services.osuchan = { services.osuchan = {
enable = true; enable = true;
port = 9283; port = 9283;
secretFile = "${config.machineVars.dataDrives.default}/keys/osuchan/envfile"; secretFile = config.sops.secrets."osuchan/envfile".path;
}; };
systemd.services.osuchan.after = [
"data2-momiji.mount"
];
} }

1
hosts/tsuki/services/plex.nix
View File

@ -4,7 +4,6 @@ in {
services.plex = { services.plex = {
enable = true; enable = true;
openFirewall = true; openFirewall = true;
dataDir = "${config.machineVars.dataDrives.default}/var/plex";
}; };
systemd.services.plex.serviceConfig = { systemd.services.plex.serviceConfig = {

6
hosts/tsuki/services/postgres.nix
View File

@ -10,7 +10,6 @@ in {
host all all 127.0.0.1/32 trust host all all 127.0.0.1/32 trust
host all all ::1/128 trust host all all ::1/128 trust
''; '';
dataDir = "${config.machineVars.dataDrives.drives.postgres}/${config.services.postgresql.package.psqlSchema}";
settings = { settings = {
max_connections = 150; max_connections = 150;
}; };
@ -18,16 +17,15 @@ in {
services.postgresqlBackup = { services.postgresqlBackup = {
enable = true; enable = true;
location = "${config.machineVars.dataDrives.drives.backup}/postgres"; location = "/data/backup/postgres";
backupAll = true; backupAll = true;
}; };
systemd.services.postgresqlBackup = { systemd.services.postgresqlBackup = {
requires = [ "postgresql.service" "data2-backup.mount" ]; requires = [ "postgresql.service" ];
}; };
systemd.services.postgresql = { systemd.services.postgresql = {
requires = [ "data2-postgres.mount" ];
serviceConfig = { serviceConfig = {
Restart = "always"; Restart = "always";
RestartSec = 3; RestartSec = 3;

4
hosts/tsuki/services/scrapers/nhk-easy-news/default.nix
View File

@ -14,9 +14,7 @@ in {
ProtectHome = true; ProtectHome = true;
ProtectProc = "invisible"; ProtectProc = "invisible";
ProtectSystem = "strict"; ProtectSystem = "strict";
WorkingDirectory = "/var/lib/nhk_easy_news_scraper"; WorkingDirectory = "/data/scrapers/nhk-easy-news";
StateDirectory = "nhk_easy_news_scraper";
StateDirectoryMode = "0755";
}; };
}; };

1
hosts/tsuki/services/taskserver.nix
View File

@ -12,7 +12,6 @@
enable = true; enable = true;
fqdn = "todo.nani.wtf"; fqdn = "todo.nani.wtf";
listenPort = 19233; listenPort = 19233;
dataDir = "${config.machineVars.dataDrives.default}/var/taskserver";
organisations.h7x4 = { organisations.h7x4 = {
groups = [ "users" ]; groups = [ "users" ];

3
secrets/default.yaml
View File

@ -22,7 +22,8 @@ postgres:
grafana: ENC[AES256_GCM,data:bsxzS/xkNdSJvOSQfZY8RRK03ckfKAoYeiZlgrSxXVqTEQ==,iv:wb8bFITgGLToagEczdm7MwUmXl3tyYmrYqSZOblEz0I=,tag:ZboMGI4QdmOK+LVBDCl2Pg==,type:str] grafana: ENC[AES256_GCM,data:bsxzS/xkNdSJvOSQfZY8RRK03ckfKAoYeiZlgrSxXVqTEQ==,iv:wb8bFITgGLToagEczdm7MwUmXl3tyYmrYqSZOblEz0I=,tag:ZboMGI4QdmOK+LVBDCl2Pg==,type:str]
pgadmin: pgadmin:
oauth2_secret: ENC[AES256_GCM,data:A1Upe1Ja76++ZdOx5YhuKjpaont4m5ChRzn/YVpJbnFzWy1tFlBkOr6UgBj7Wopg,iv:hY+b7AVSrSgHu/10reIjUjJ8+yR4FrZe2JgGiAowfGs=,tag:thy6O1Y3FGTWaQXqlU9aYg==,type:str] oauth2_secret: ENC[AES256_GCM,data:A1Upe1Ja76++ZdOx5YhuKjpaont4m5ChRzn/YVpJbnFzWy1tFlBkOr6UgBj7Wopg,iv:hY+b7AVSrSgHu/10reIjUjJ8+yR4FrZe2JgGiAowfGs=,tag:thy6O1Y3FGTWaQXqlU9aYg==,type:str]
initialPassword: ENC[AES256_GCM,data:674lqcGTDCOYBNocf0LQuQB1cbMus0iZOcvwbadpAXrF4DPQSetqrg==,iv:y8hfzLh6i7LxR11fmM9T0z2t7202JMAiZzi/1iCWPvM=,tag:lHwCBWaWsArrAJ0rZ8Xk/w==,type:str] osuchan:
envfile: ENC[AES256_GCM,data:gaO+3haU1jMkqRm1PiSSd4oTcoPvgbsRHWfhPnXJbFSv4cXsqeS1xRrbZZftu5g2nfr+vb8ljtmGyk3dVLOHo5SzVQlJzcJNKoVp9XTLlmbC1AuKjxv3p7dWyD71n5reO52uDlbNJQPMzgOw70DM7wTffCaLbDUIyB+bPcESxiYHC2S3kITZErCdJczEKpRPjS0wM9kjENN9HN1WobhquZ1w7gXfXIx174QUV3LdJMrhaibzDZEu4dBaxVkxbKRa78bPNCN6LVD4U1woG0IeIh6CGCGtGghIkhcUIZsUauXPw7g/uQHPcJF3/h64I7477j9D1Qrrz0bN3kU9jyAro5jv1hcRUS6b,iv:zbJol31niHWz+0DXGE4vm2T7aXAZfbdj0rN7xlSctGg=,tag:kDCQUPjeHWMWQ22tE8ar4A==,type:str]
sops: sops:
kms: [] kms: []
gcp_kms: [] gcp_kms: []