Initial commit.
This commit is contained in:
commit
67823cbed6
51 changed files with 1714 additions and 0 deletions
84
hosts/hub/apps/dev.nix
Normal file
84
hosts/hub/apps/dev.nix
Normal file
|
|
@ -0,0 +1,84 @@
|
|||
{
|
||||
services = {
|
||||
postgresql = {
|
||||
ensureDatabases = [ "dev" ];
|
||||
ensureUsers = [
|
||||
{
|
||||
name = "dev";
|
||||
ensureDBOwnership = true;
|
||||
}
|
||||
];
|
||||
};
|
||||
authelia.instances.main.settings.access_control.rules = [
|
||||
{
|
||||
domain = "dev.thewordnerd.info";
|
||||
policy = "bypass";
|
||||
}
|
||||
];
|
||||
};
|
||||
|
||||
containers.dev = {
|
||||
autoStart = true;
|
||||
privateNetwork = true;
|
||||
hostAddress = "192.168.0.1";
|
||||
localAddress = "192.168.0.2";
|
||||
config =
|
||||
{
|
||||
config,
|
||||
pkgs,
|
||||
lib,
|
||||
...
|
||||
}:
|
||||
{
|
||||
services.gitea = {
|
||||
enable = true;
|
||||
appName = "Nolan's projects";
|
||||
settings = {
|
||||
server = {
|
||||
ROOT_URL = "https://dev.thewordnerd.info";
|
||||
DOMAIN = "dev.thewordnerd.info";
|
||||
DISABLE_SSH = true;
|
||||
LANDING_PAGE = "explore";
|
||||
};
|
||||
service = {
|
||||
DISABLE_REGISTRATION = true;
|
||||
# ENABLE_REVERSE_PROXY_AUTHENTICATION = true;
|
||||
# ENABLE_REVERSE_PROXY_AUTO_REGISTRATION = true;
|
||||
};
|
||||
security = {
|
||||
REVERSE_PROXY_AUTHENTICATION_USER = "Remote-User";
|
||||
REVERSE_PROXY_AUTHENTICATION_EMAIL = "Remote-Email";
|
||||
REVERSE_PROXY_AUTHENTICATION_FULL_NAME = "Remote-Name";
|
||||
REVERSE_PROXY_TRUSTED_PROXIES = "192.168.0.0/24";
|
||||
};
|
||||
};
|
||||
lfs.enable = true;
|
||||
database = {
|
||||
type = "postgres";
|
||||
name = "dev";
|
||||
user = "dev";
|
||||
socket = "/run/postgresql";
|
||||
createDatabase = false;
|
||||
};
|
||||
};
|
||||
networking = {
|
||||
firewall.allowedTCPPorts = [ 3000 ];
|
||||
useHostResolvConf = lib.mkForce false;
|
||||
};
|
||||
services.resolved.enable = true;
|
||||
};
|
||||
bindMounts = {
|
||||
"/run/postgresql/.s.PGSQL.5432" = {
|
||||
hostPath = "/run/postgresql/.s.PGSQL.5432";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
services.caddy.virtualHosts."dev.thewordnerd.info".extraConfig = ''
|
||||
forward_auth localhost:9091 {
|
||||
uri /api/authz/forward-auth
|
||||
copy_headers Remote-User Remote-Groups Remote-Email Remote-Name
|
||||
}
|
||||
reverse_proxy dev:3000
|
||||
'';
|
||||
}
|
||||
72
hosts/hub/apps/nextcloud.nix
Normal file
72
hosts/hub/apps/nextcloud.nix
Normal file
|
|
@ -0,0 +1,72 @@
|
|||
{
|
||||
services.postgresql = {
|
||||
ensureDatabases = [ "nextcloud" ];
|
||||
ensureUsers = [
|
||||
{
|
||||
name = "nextcloud";
|
||||
ensureDBOwnership = true;
|
||||
}
|
||||
];
|
||||
};
|
||||
|
||||
containers.nextcloud = {
|
||||
autoStart = true;
|
||||
privateNetwork = true;
|
||||
hostAddress = "192.168.0.1";
|
||||
localAddress = "192.168.0.3";
|
||||
config =
|
||||
{
|
||||
config,
|
||||
pkgs,
|
||||
lib,
|
||||
...
|
||||
}:
|
||||
{
|
||||
environment.etc."nextcloud-admin-pass".text = "admin";
|
||||
nixpkgs.config.allowUnfree = true;
|
||||
services = {
|
||||
nextcloud = {
|
||||
enable = true;
|
||||
hostName = "nextcloud.thewordnerd.info";
|
||||
package = pkgs.nextcloud30;
|
||||
configureRedis = true;
|
||||
maxUploadSize = "16G";
|
||||
autoUpdateApps.enable = true;
|
||||
notify_push.enable = true;
|
||||
webfinger = true;
|
||||
settings = {
|
||||
overwriteprotocol = "https";
|
||||
trusted_proxies = [ "192.168.0.1" ];
|
||||
default_phone_region = "US";
|
||||
};
|
||||
config = {
|
||||
dbtype = "pgsql";
|
||||
dbhost = "/run/postgresql";
|
||||
adminpassFile = "/etc/nextcloud-admin-pass";
|
||||
};
|
||||
};
|
||||
onlyoffice = {
|
||||
enable = true;
|
||||
hostname = "onlyoffice.thewordnerd.info";
|
||||
};
|
||||
resolved.enable = true;
|
||||
};
|
||||
networking = {
|
||||
firewall.allowedTCPPorts = [ 80 ];
|
||||
useHostResolvConf = lib.mkForce false;
|
||||
};
|
||||
virtualisation.podman = {
|
||||
enable = true;
|
||||
dockerCompat = true;
|
||||
dockerSocket.enable = true;
|
||||
};
|
||||
};
|
||||
bindMounts = {
|
||||
"/run/postgresql/.s.PGSQL.5432" = {
|
||||
hostPath = "/run/postgresql/.s.PGSQL.5432";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
services.caddy.virtualHosts."nextcloud.thewordnerd.info".extraConfig = ''reverse_proxy nextcloud'';
|
||||
}
|
||||
137
hosts/hub/default.nix
Normal file
137
hosts/hub/default.nix
Normal file
|
|
@ -0,0 +1,137 @@
|
|||
# Edit this configuration file to define what should be installed on
|
||||
# your system. Help is available in the configuration.nix(5) man page, on
|
||||
# https://search.nixos.org/options and in the NixOS manual (`nixos-help`).
|
||||
|
||||
{ config, ... }:
|
||||
|
||||
{
|
||||
imports = [
|
||||
./hardware-configuration.nix
|
||||
../../roles/zfs.nix
|
||||
../../base.nix
|
||||
../../users/root.nix
|
||||
../../roles/tailscale.nix
|
||||
../../roles/lldap.nix
|
||||
../../roles/authelia.nix
|
||||
../../roles/podman.nix
|
||||
../../roles/minio.nix
|
||||
../../roles/caddy.nix
|
||||
../../roles/vscode-remote.nix
|
||||
../../roles/postgres.nix
|
||||
./apps/dev.nix
|
||||
./apps/nextcloud.nix
|
||||
];
|
||||
|
||||
boot.loader.grub = {
|
||||
enable = true;
|
||||
zfsSupport = true;
|
||||
efiSupport = true;
|
||||
efiInstallAsRemovable = true;
|
||||
mirroredBoots = [
|
||||
{
|
||||
devices = [ "nodev" ];
|
||||
path = "/boot";
|
||||
}
|
||||
];
|
||||
};
|
||||
|
||||
networking = {
|
||||
hostName = "thewordnerd";
|
||||
hostId = "91312b0a";
|
||||
nat = {
|
||||
enable = true;
|
||||
internalInterfaces = [ "ve-+" ];
|
||||
externalInterface = "enp5s0";
|
||||
enableIPv6 = true;
|
||||
};
|
||||
};
|
||||
|
||||
services.openssh.openFirewall = false;
|
||||
|
||||
time.timeZone = "America/Chicago";
|
||||
|
||||
i18n.defaultLocale = "en_US.UTF-8";
|
||||
console.keyMap = "us";
|
||||
|
||||
# Enable the Flakes feature and the accompanying new nix command-line tool
|
||||
nix.settings.experimental-features = [
|
||||
"nix-command"
|
||||
"flakes"
|
||||
];
|
||||
|
||||
age.secrets.cloudflareApi.file = ../../secrets/cloudflare_api.age;
|
||||
security.acme = {
|
||||
acceptTerms = true;
|
||||
defaults.email = "nolan@thewordnerd.info";
|
||||
certs."thewordnerd.info" = {
|
||||
domain = "*.thewordnerd.info";
|
||||
dnsProvider = "cloudflare";
|
||||
environmentFile = config.age.secrets.cloudflareApi.path;
|
||||
};
|
||||
certs."hub.thewordnerd.info" = {
|
||||
dnsProvider = "cloudflare";
|
||||
environmentFile = config.age.secrets.cloudflareApi.path;
|
||||
};
|
||||
};
|
||||
|
||||
age.secrets.ldap.file = ../../secrets/ldap.age;
|
||||
mailserver = {
|
||||
enable = true;
|
||||
fqdn = "thewordnerd.info";
|
||||
domains = [
|
||||
"thewordnerd.info"
|
||||
"lightsout.games"
|
||||
];
|
||||
ldap = {
|
||||
enable = true;
|
||||
uris = [ "ldap://localhost:3890" ];
|
||||
bind = {
|
||||
dn = "uid=service,ou=people,dc=thewordnerd,dc=info";
|
||||
passwordFile = config.age.secrets.ldap.path;
|
||||
};
|
||||
searchBase = "ou=people,dc=thewordnerd,dc=info";
|
||||
};
|
||||
certificateScheme = "acme";
|
||||
enableManageSieve = true;
|
||||
fullTextSearch = {
|
||||
enable = true;
|
||||
# index new email as they arrive
|
||||
autoIndex = true;
|
||||
# this only applies to plain text attachments, binary attachments are never indexed
|
||||
indexAttachments = true;
|
||||
enforced = "body";
|
||||
};
|
||||
};
|
||||
|
||||
services.caddy.virtualHosts."users.thewordnerd.info".extraConfig =
|
||||
''reverse_proxy localhost:17170'';
|
||||
|
||||
services.caddy.virtualHosts."auth.thewordnerd.info".extraConfig = ''
|
||||
reverse_proxy localhost:9091
|
||||
'';
|
||||
|
||||
services.caddy.virtualHosts."www.thewordnerd.info".extraConfig = ''
|
||||
file_server
|
||||
root * /var/www/thewordnerd.info
|
||||
header /.well-known/matrix/* content-type application/json
|
||||
'';
|
||||
|
||||
# This option defines the first version of NixOS you have installed on this particular machine,
|
||||
# and is used to maintain compatibility with application data (e.g. databases) created on older NixOS versions.
|
||||
#
|
||||
# Most users should NEVER change this value after the initial install, for any reason,
|
||||
# even if you've upgraded your system to a new NixOS release.
|
||||
#
|
||||
# This value does NOT affect the Nixpkgs version your packages and OS are pulled from,
|
||||
# so changing it will NOT upgrade your system - see https://nixos.org/manual/nixos/stable/#sec-upgrading for how
|
||||
# to actually do that.
|
||||
#
|
||||
# This value being lower than the current NixOS release does NOT mean your system is
|
||||
# out of date, out of support, or vulnerable.
|
||||
#
|
||||
# Do NOT change this value unless you have manually inspected all the changes it would make to your configuration,
|
||||
# and migrated your data accordingly.
|
||||
#
|
||||
# For more information, see `man configuration.nix` or https://nixos.org/manual/nixos/stable/options#opt-system.stateVersion .
|
||||
system.stateVersion = "24.11"; # Did you read the comment?
|
||||
}
|
||||
53
hosts/hub/hardware-configuration.nix
Normal file
53
hosts/hub/hardware-configuration.nix
Normal file
|
|
@ -0,0 +1,53 @@
|
|||
# Do not modify this file! It was generated by ‘nixos-generate-config’
|
||||
# and may be overwritten by future invocations. Please make changes
|
||||
# to /etc/nixos/configuration.nix instead.
|
||||
{ config, lib, pkgs, modulesPath, ... }:
|
||||
|
||||
{
|
||||
imports =
|
||||
[ (modulesPath + "/installer/scan/not-detected.nix")
|
||||
];
|
||||
|
||||
boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "nvme" ];
|
||||
boot.initrd.kernelModules = [ ];
|
||||
boot.kernelModules = [ "kvm-intel" ];
|
||||
boot.extraModulePackages = [ ];
|
||||
|
||||
fileSystems."/" =
|
||||
{ device = "zpool/root";
|
||||
fsType = "zfs";
|
||||
};
|
||||
|
||||
fileSystems."/nix" =
|
||||
{ device = "zpool/nix";
|
||||
fsType = "zfs";
|
||||
};
|
||||
|
||||
fileSystems."/var" =
|
||||
{ device = "zpool/var";
|
||||
fsType = "zfs";
|
||||
};
|
||||
|
||||
fileSystems."/home" =
|
||||
{ device = "zpool/home";
|
||||
fsType = "zfs";
|
||||
};
|
||||
|
||||
fileSystems."/boot" =
|
||||
{ device = "/dev/disk/by-uuid/8ADD-D5B1";
|
||||
fsType = "vfat";
|
||||
options = [ "fmask=0022" "dmask=0022" ];
|
||||
};
|
||||
|
||||
swapDevices = [ ];
|
||||
|
||||
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
|
||||
# (the default) this is the recommended approach. When using systemd-networkd it's
|
||||
# still possible to use this option, but it's recommended to use it in conjunction
|
||||
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
|
||||
networking.useDHCP = lib.mkDefault true;
|
||||
# networking.interfaces.enp5s0.useDHCP = lib.mkDefault true;
|
||||
|
||||
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
|
||||
hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
|
||||
}
|
||||
Loading…
Add table
Add a link
Reference in a new issue