oysteikt/nix-dotfiles
1
3
Fork 0
Code Issues 156 Pull Requests Actions Activity

tsuki: move to different machine and reinit

Browse Source
This commit is contained in:
Oystein Kristoffer Tveit
2025-10-24 12:22:01 +09:00
parent 6a4337e34f
commit 47ddf0cd1e
12 changed files with 367 additions and 275 deletions
Download Patch File Download Diff File Expand all files Collapse all files
hosts/tsuki/configuration.nix
+51 -29
View File
@@ -1,38 +1,41 @@
{ config, pkgs, lib, modulesPath, ... }:
{
imports = [
(modulesPath + "/profiles/qemu-guest.nix")
./disk-config.nix
./hardware-configuration.nix
./services/atuin.nix
./services/borg.nix
./services/gitea-runners.nix
./services/grafana
./services/headscale.nix
# ./services/borg.nix
# ./services/gitea-runners.nix
# ./services/grafana
# ./services/headscale.nix
./services/hedgedoc.nix
./services/kanidm.nix
./services/matrix
./services/minecraft
# ./services/minecraft
./services/nginx
./services/osuchan.nix
./services/plex.nix
# ./services/plex.nix
./services/postgres.nix
./services/samba.nix
./services/taskserver.nix
# ./services/samba.nix
# ./services/taskserver.nix
./services/vaultwarden.nix
./services/vscode-server.nix
./services/wstunnel.nix
# ./services/vscode-server.nix
# ./services/wstunnel.nix
./services/scrapers/nhk-easy-news/default.nix
# ./services/scrapers/nhk-easy-news/default.nix
];
system.stateVersion = "22.05";
system.stateVersion = "25.05";
machineVars = {
headless = true;
dataDrives = {
drives = {
backup = "/data/backup";
cirno = "/data/cirno";
# cirno = "/data/cirno";
media = "/data/media";
home = "/home";
};
@@ -51,7 +54,7 @@
networking = {
hostName = "tsuki";
hostId = "8425e349";
hostId = "1cb0971f";
networkmanager.enable = true;
interfaces.ens18.useDHCP = true;
firewall.enable=true;
@@ -71,32 +74,51 @@
};
};
sops.secrets."drives/cirno/password" = { };
sops.templates."drive-cirno.creds".content = ''
username=h7x4
password=${config.sops.placeholder."drives/cirno/password"}
'';
# sops.secrets."drives/cirno/password" = { };
# sops.templates."drive-cirno.creds".content = ''
# username=h7x4
# password=${config.sops.placeholder."drives/cirno/password"}
# '';
virtualisation = {
docker.enable = true;
};
services.resolved.extraConfig = ''
MulticastDNS=no
'';
services.zfs.trim.enable = true;
services.zfs.autoScrub.enable = true;
boot = {
kernelPackages = pkgs.linuxPackages_6_15;
zfs.requestEncryptionCredentials = false;
zfs.package = pkgs.zfs_2_3;
loader = {
grub = {
boot.initrd = {
network = {
enable = true;
udhcpc.enable = true;
flushBeforeStage2 = true;
ssh = {
enable = true;
efiSupport = true;
efiInstallAsRemovable = true;
mirroredBoots = [
{ devices = [ "nodev" ]; path = "/boot"; }
port = 22;
authorizedKeys = [
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC0aYHsiqfLCA0prSmEi6hZeQPCGxZYR7gp+3U99POUWJyycSVqXMhgVZHT8VEYGf+EZ/y5nL1bvna7ChBwQBzInB2mRW+TCLL3h1w9t/27vTHe3wV+fowTooD/paOErmWFO4yDBEJ3cYFMXowAd3GfvsBSFGPSsvSxghSzWj+kfhIFkXD02LZxn/hBQyCT6irp3Hwx1cBu8ic/l2ln64SLARuEmj4ITaafNC5wD2Gr5Jf3q+T9QtJeFPXSpJD7MtVMJ1VpgpfGBvlEYKggiQjxgu2BXHv1w3KIfyltTwhrcqHvttaJSuR5TreAgQ5+dZHmMr6XX8rFG+HEa8gND6NjGjHrJBxp53qgPtLAmBddvf8xQMYiq6+XST16nlRaAsjU3yr3VqCt7XhJiS2IV8JiIV3dok8nxzDX9sjdZeGchdnAnU6lcxDgnBvAcJRaWHwMCG8Ty9sJ4otgjr5A1GxRBndJIIuKzjpdtsrCAHg/K2zqFoKPJxN/K9zDWKNy0aEy2Akl3LgHF2QIuG5pUOmbyvbF8AoTudaz6Zu6JpVwOb9T9avFJBH4RHQ3mK0faBkrEmnkAg6JnDDMIt0XLALl88rI4kbdkVvJ2kaodvq799TCCw1PwMidgWX63LemWVBx+CL9ebXrsOkOthhMhkeaFXY9Am3Ee7rfD1tq3PGU1w== h7x4"
];
hostKeys = [ "/etc/ssh/ssh_host_ed25519_key" ];
};
postCommands = ''
export NIX_SSL_CERT_FILE='${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt'
echo 'zfs load-key -a; killall zfs; exit' >> /root/.profile
'';
};
};
boot.kernelPackages = pkgs.linuxPackages;
boot.zfs.package = pkgs.zfs_2_3;
boot.loader = {
efi.canTouchEfiVariables = true;
systemd-boot.enable = true;
systemd-boot.consoleMode = "1";
# zfs.requestEncryptionCredentials = false;
};
}
hosts/tsuki/disk-config.nix
+155
View File
@@ -0,0 +1,155 @@
{ ... }:
{
disko.devices = {
disk = {
nvme1 = {
type = "disk";
device = "/dev/nvme0n1";
content = {
type = "gpt";
partitions = {
ESP = {
content = {
format = "vfat";
mountpoint = "/boot";
type = "filesystem";
};
name = "boot";
size = "1G";
type = "EF00";
};
zfs = {
size = "100%";
content = {
type = "zfs";
pool = "zroot";
};
};
};
};
};
nvme2 = {
type = "disk";
device = "/dev/nvme1n1";
content = {
type = "gpt";
partitions = {
# No boot partition here
zfs = {
start = "1G";
size = "100%";
content = {
type = "zfs";
pool = "zroot";
};
};
};
};
};
};
zpool = {
zroot = {
type = "zpool";
mode = {
topology = {
type = "topology";
vdev = [
{
mode = "mirror";
members = [ "nvme1" "nvme2" ];
}
];
};
};
options = {
ashift = "12";
# trim handled by systemd timer
autotrim = "off";
};
rootFsOptions = {
acltype = "posixacl";
canmount = "off";
compression = "zstd";
dedup = "on";
devices = "off";
dnodesize = "auto";
mountpoint = "none";
normalization = "formD";
relatime = "on";
xattr = "sa";
encryption = "aes-256-gcm";
keyformat = "passphrase";
keylocation = "prompt";
};
postCreateHook = ''
zfs set keylocation=prompt zroot;
'';
datasets = let
root = "nixos";
legacyMount = mountpoint: {
type = "zfs_fs";
options.mountpoint = "legacy";
inherit mountpoint;
};
in {
"${root}" = {
type = "zfs_fs";
options.mountpoint = "none";
};
"${root}/root" = legacyMount "/";
"${root}/nix" = legacyMount "/nix";
"${root}/var" = legacyMount "/var";
"${root}/var/cache" = legacyMount "/var/cache";
"${root}/var/log" = legacyMount "/var/log";
"${root}/var/lib" = legacyMount "/var/lib";
"${root}/var/lib/containers/storage" = legacyMount "/var/lib/containers/storage";
"${root}/var/lib/containers/storage/volumes" = legacyMount "/var/lib/containers/storage/volumes";
"${root}/var/lib/postgresql" = (legacyMount "/var/lib/postgresql") // {
options = {
mountpoint = "legacy";
recordsize = "16k";
primarycache = "all";
};
};
"${root}/home" = legacyMount "/home";
"${root}/data" = legacyMount "/data";
"${root}/data/minecraft" = legacyMount "/data/minecraft";
"${root}/data/backup" = (legacyMount "/data/backup") // {
options = {
mountpoint = "legacy";
compression = "zstd-15";
};
};
"${root}/data/media" = (legacyMount "/data/media") // {
options = {
mountpoint = "legacy";
recordsize = "512k";
};
};
"reserved" = {
type = "zfs_fs";
options = {
mountpoint = "none";
refreservation = "10G";
};
};
};
};
};
};
}
hosts/tsuki/hardware-configuration.nix
+5 -60
View File
@@ -8,73 +8,18 @@
[ (modulesPath + "/installer/scan/not-detected.nix")
];
boot.initrd.availableKernelModules = [ "uhci_hcd" "ehci_pci" "ata_piix" "megaraid_sas" "usb_storage" "usbhid" "sd_mod" "sr_mod" ];
boot.initrd.kernelModules = [ "dm-snapshot" ];
boot.kernelModules = [ "kvm-intel" ];
boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "nvme" "igb" ];
boot.initrd.kernelModules = [ ];
boot.kernelModules = [ "kvm-amd" ];
boot.extraModulePackages = [ ];
fileSystems."/" =
{ device = "momiji/root";
fsType = "zfs";
};
fileSystems."/data" =
{ device = "momiji/data";
fsType = "zfs";
};
fileSystems."/nix" =
{ device = "momiji/nix";
fsType = "zfs";
};
fileSystems."/home" =
{ device = "momiji/home";
fsType = "zfs";
};
fileSystems."/var" =
{ device = "momiji/var";
fsType = "zfs";
};
fileSystems."/var/lib/postgresql" =
{ device = "momiji/data/postgres";
fsType = "zfs";
};
fileSystems."/var/lib/minecraft" =
{ device = "momiji/data/minecraft";
fsType = "zfs";
};
fileSystems."/data/media" =
{ device = "momiji/data/media";
fsType = "zfs";
};
fileSystems."/data/backup" =
{ device = "momiji/data/backup";
fsType = "zfs";
};
fileSystems."/boot" =
{ device = "/dev/disk/by-uuid/66C8-A92E";
fsType = "vfat";
};
swapDevices = [ ];
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
# (the default) this is the recommended approach. When using systemd-networkd it's
# still possible to use this option, but it's recommended to use it in conjunction
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
networking.useDHCP = lib.mkDefault true;
# networking.interfaces.eno1.useDHCP = lib.mkDefault true;
# networking.interfaces.eno2.useDHCP = lib.mkDefault true;
# networking.interfaces.eno3.useDHCP = lib.mkDefault true;
# networking.interfaces.eno4.useDHCP = lib.mkDefault true;
# networking.interfaces.enp41s0.useDHCP = lib.mkDefault true;
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
}
hosts/tsuki/services/kanidm.nix
+1 -1
View File
@@ -17,7 +17,7 @@ in {
};
services.kanidm = {
# package = pkgs.kanidm;
package = pkgs.kanidm_1_7;
enableServer = true;
# enablePAM = true;
serverSettings = let
hosts/tsuki/services/matrix/stickers/default.nix
+1 -1
View File
@@ -78,7 +78,7 @@
id = "hutao";
title = "Hu Tao";
stickers = ./json/hutao.json;
hash = "sha256-8JM34WXl4doyF3HuJL3pfKf26wKVEAs3eqj+b40ggQk=";
hash = "sha256-CQhO3ra/oCCZM8pWZZjA4suDkIQ1Q3W0WIShFIe5O0Q=";
};
pokemonPiplup = {
hosts/tsuki/services/nginx/default.nix
+19 -17
View File
@@ -54,21 +54,23 @@
sa = config.local.socketActivation;
in {
"atuin".servers."unix:${sa.atuin.newSocketAddress}" = { };
"dynmap".servers."localhost:8123" = { };
"grafana".servers."unix:/run/grafana/grafana.sock" = { };
"headscale".servers."localhost:${s srv.headscale.port}" = { };
# "dynmap".servers."localhost:8123" = { };
# "grafana".servers."unix:/run/grafana/grafana.sock" = { };
# "headscale".servers."localhost:${s srv.headscale.port}" = { };
"hedgedoc".servers."unix:${srv.hedgedoc.settings.path}" = { };
"idrac".servers."10.0.0.201" = { };
# "idrac".servers."10.0.0.201" = { };
"irc-matrix-bridge-media".servers."localhost:${s srv.matrix-appservice-irc.settings.ircService.mediaProxy.bindPort}" = { };
"kanidm".servers."localhost:8300" = { };
"osuchan".servers."localhost:${s srv.osuchan.port}" = { };
"plex".servers."localhost:32400" = { };
"vaultwarden".servers."unix:${sa.vaultwarden.newSocketAddress}" = { };
"wstunnel".servers = let
inherit (config.services.wstunnel.servers."ws-tsuki".listen) host port;
in {
"${host}:${s port}" = { };
};
# "plex".servers."localhost:32400" = { };
# "vaultwarden".servers."unix:${sa.vaultwarden.newSocketAddress}" = { };
# "vaultwarden".servers."unix:${sa.vaultwarden.newSocketAddress}" = { };
"vaultwarden".servers."${srv.vaultwarden.config.ROCKET_ADDRESS}:${toString srv.vaultwarden.config.ROCKET_PORT}" = { };
# "wstunnel".servers = let
# inherit (config.services.wstunnel.servers."ws-tsuki".listen) host port;
# in {
# "${host}:${s port}" = { };
# };
};
virtualHosts = let
@@ -167,7 +169,7 @@
locations."/_synapse".proxyPass = "http://$synapse_backend";
})
(proxy ["irc-matrix"] "http://irc-matrix-bridge-media" {})
# (host ["madmin"] { root = "${pkgs.synapse-admin}/"; })
# (host ["cache"] { root = "/var/lib/nix-cache"; })
# (proxy ["slack-bot"] "http://localhost:9898" {})
@@ -192,11 +194,11 @@
return 301 $scheme://git.pvv.ntnu.no$request_uri;
'';
})
(proxy ["idrac"] "https://idrac" {})
(proxy ["log"] "http://grafana" enableWebsockets)
(proxy ["map"] "http://dynmap" {})
# (proxy ["idrac"] "https://idrac" {})
# (proxy ["log"] "http://grafana" enableWebsockets)
# (proxy ["map"] "http://dynmap" {})
(proxy ["osu"] "http://osuchan" {})
(proxy ["plex"] "http://plex" enableWebsockets)
# (proxy ["plex"] "http://plex" enableWebsockets)
# (proxy ["vpn"] "http://headscale" {
# locations."/" = {
# proxyWebsockets = true;
@@ -208,7 +210,7 @@
# };
# })
(proxy ["ws"] "http://wstunnel" enableWebsockets)
# (proxy ["ws"] "http://wstunnel" enableWebsockets)
(host ["h7x4-stickers"] {})
(host ["pingu-stickers"] {})
hosts/tsuki/services/vaultwarden.nix
+7 -6
View File
@@ -21,6 +21,7 @@ in {
systemd.services.vaultwarden = lib.mkIf cfg.enable {
requires = [ "postgresql.service" ];
serviceConfig.StateDirectory = "vaultwarden";
};
services.postgresql = lib.mkIf cfg.enable {
@@ -32,10 +33,10 @@ in {
}];
};
local.socketActivation.vaultwarden = {
enable = cfg.enable;
originalSocketAddress = "${cfg.config.ROCKET_ADDRESS}:${toString cfg.config.ROCKET_PORT}";
newSocketAddress = "/run/vaultwarden.sock";
privateNamespace = false;
};
# local.socketActivation.vaultwarden = {
# enable = cfg.enable;
# originalSocketAddress = "${cfg.config.ROCKET_ADDRESS}:${toString cfg.config.ROCKET_PORT}";
# newSocketAddress = "/run/vaultwarden.sock";
# privateNamespace = false;
# };
}