1
0
Fork 0
nix-configuration/hosts/Dimaga/default.nix

237 lines
6.7 KiB
Nix
Raw Normal View History

{
config,
lib,
pkgs,
...
}:
2024-07-01 09:48:29 -04:00
let
# Do not change this value! This tracks when NixOS was installed on your system.
stateVersion = "24.11";
hostName = "Dimaga";
2024-07-02 10:02:46 -04:00
2024-09-02 11:06:57 -04:00
# Where to store service files
2024-07-02 10:02:46 -04:00
services-root = "/storage/services";
2024-09-02 11:06:57 -04:00
# Script to start services
start-services = pkgs.writeShellScriptBin "start-services" (builtins.readFile ./start-services.sh);
2024-07-02 10:02:46 -04:00
2024-09-02 11:06:57 -04:00
# Credentials for interacting with the Namecheap API
2024-07-02 10:02:46 -04:00
namecheapCredentials = {
"NAMECHEAP_API_USER_FILE" = "${pkgs.writeText "namecheap-api-user" ''
${config.secrets.networking.namecheap.api.user}
''}";
"NAMECHEAP_API_KEY_FILE" = "${pkgs.writeText "namecheap-api-key" ''
${config.secrets.networking.namecheap.api.key}
''}";
};
2024-09-02 11:06:57 -04:00
# List of subdomains to add to the TLS certificate
subdomains = [
config.secrets.services.deluge.url
config.secrets.services.forgejo.url
config.secrets.services.gremlin-lab.url
config.secrets.services.jellyfin.url
config.secrets.services.netdata.url
];
2024-07-01 09:48:29 -04:00
in
{
imports = [ ./hardware-configuration.nix ];
system.stateVersion = stateVersion;
networking.hostName = hostName;
2024-07-01 09:48:29 -04:00
###*** Configure your system below this line. ***###
# Set your time zone.
# To see all available timezones, run `timedatectl list-timezones`.
time.timeZone = "America/New_York";
# Build Nix packages for other hosts.
2024-08-11 19:09:02 -04:00
# Runs every day at 4 AM
2024-09-02 11:06:57 -04:00
systemd = {
services."build-hosts" = {
serviceConfig = {
Type = "oneshot";
User = "root";
};
path = config.aux.system.corePackages;
script = ''
cd ${config.secrets.nixConfigFolder}
nh os build . --hostname Khanda
'';
};
2024-09-02 11:06:57 -04:00
timers."build-hosts" = {
wants = [ "network-online.target" ];
after = [ "network-online.target" ];
wantedBy = [ "timers.target" ];
timerConfig = {
OnCalendar = "04:00";
Persistent = true;
Unit = "build-hosts.service";
};
};
};
2024-07-01 09:48:29 -04:00
# Configure the system.
aux.system = {
# Enable to allow unfree (e.g. closed source) packages.
# Some settings may override this (e.g. enabling Nvidia GPU support).
# https://nixos.org/manual/nixpkgs/stable/#sec-allow-unfree
allowUnfree = true;
# Enable Secure Boot support.
bootloader = {
enable = true;
2024-07-02 10:02:46 -04:00
secureboot.enable = true;
2024-07-01 09:48:29 -04:00
tpm2.enable = true;
};
# Change the default text editor. Options are "emacs", "nano", or "vim".
editor = "nano";
# Enable GPU support.
gpu = {
intel.enable = true;
nvidia = {
2024-07-01 15:51:05 -04:00
enable = true;
2024-07-01 09:48:29 -04:00
hybrid = {
2024-07-01 15:51:05 -04:00
enable = true;
busIDs.nvidia = "PCI:3:0:0";
busIDs.intel = "PCI:0:2:0";
2024-07-01 09:48:29 -04:00
};
};
};
packages = [ start-services ];
# Enable support for primary RAID array
raid.sapana.enable = true;
2024-07-02 10:02:46 -04:00
2024-07-01 09:48:29 -04:00
# Change how long old generations are kept for.
2024-08-05 10:07:39 -04:00
retentionPeriod = "30d";
2024-07-01 09:48:29 -04:00
services = {
2024-07-02 10:02:46 -04:00
acme = {
2024-07-01 09:48:29 -04:00
enable = true;
2024-07-02 10:02:46 -04:00
defaultEmail = config.secrets.users.aires.email;
certs = {
2024-09-02 11:06:57 -04:00
"${config.secrets.networking.domains.primary}" = {
2024-07-02 10:02:46 -04:00
dnsProvider = "namecheap";
extraDomainNames = subdomains;
webroot = null; # Required in order to prevent a failed assertion
credentialFiles = namecheapCredentials;
};
2024-09-02 11:06:57 -04:00
"${config.secrets.networking.domains.blog}" = {
2024-07-02 10:02:46 -04:00
dnsProvider = "namecheap";
webroot = null; # Required in order to prevent a failed assertion
credentialFiles = namecheapCredentials;
};
};
};
apcupsd = {
enable = true;
configText = builtins.readFile ./etc/apcupsd.conf;
2024-07-02 10:02:46 -04:00
};
autoUpgrade = {
enable = false; # Don't update the system...
pushUpdates = true; # ...but do push updates remotely.
2024-07-01 09:48:29 -04:00
configDir = config.secrets.nixConfigFolder;
onCalendar = "daily";
user = config.users.users.aires.name;
};
2024-07-02 10:02:46 -04:00
boinc.enable = true;
2024-08-26 12:54:38 -04:00
deluge = {
enable = true;
home = "${services-root}/deluge";
2024-09-02 11:06:57 -04:00
domain = config.secrets.networking.domains.primary;
2024-08-26 12:54:38 -04:00
url = config.secrets.services.deluge.url;
};
2024-07-02 10:02:46 -04:00
duplicacy-web = {
enable = true;
home = "/storage/backups/settings/Haven";
2024-07-02 10:02:46 -04:00
};
forgejo = {
enable = true;
home = "${services-root}/forgejo";
2024-09-02 11:06:57 -04:00
domain = config.secrets.networking.domains.primary;
2024-07-02 10:02:46 -04:00
url = config.secrets.services.forgejo.url;
actions = {
enable = true;
token = config.secrets.services.forgejo.runner-token;
};
};
jellyfin = {
enable = true;
home = "${services-root}/jellyfin";
2024-09-02 11:06:57 -04:00
domain = config.secrets.networking.domains.primary;
url = config.secrets.services.jellyfin.url;
};
2024-07-02 10:02:46 -04:00
msmtp.enable = true;
2024-08-04 17:55:02 -04:00
netdata = {
enable = true;
2024-09-02 11:06:57 -04:00
domain = config.secrets.networking.domains.primary;
type = "parent";
2024-08-04 17:55:02 -04:00
url = config.secrets.services.netdata.url;
2024-08-04 18:27:55 -04:00
auth = {
user = config.users.users.aires.name;
password = config.secrets.services.netdata.password;
apiKey = config.secrets.services.netdata.apiKey;
2024-08-04 18:27:55 -04:00
};
2024-08-04 17:55:02 -04:00
};
2024-07-02 10:02:46 -04:00
nginx = {
enable = true;
autostart = false;
virtualHosts = {
2024-09-02 11:06:57 -04:00
"${config.secrets.networking.domains.primary}" = {
2024-07-02 10:02:46 -04:00
default = true;
enableACME = true; # Enable Let's Encrypt
locations."/" = {
# Catchall vhost, will redirect users to Forgejo
return = "301 https://${config.secrets.services.forgejo.url}";
};
};
2024-09-02 11:06:57 -04:00
"${config.secrets.networking.domains.blog}" = {
useACMEHost = config.secrets.networking.domains.blog;
2024-07-02 10:02:46 -04:00
forceSSL = true;
2024-09-02 11:06:57 -04:00
root = "${services-root}/nginx/sites/${config.secrets.networking.domains.blog}";
2024-07-02 10:02:46 -04:00
};
"${config.secrets.services.gremlin-lab.url}" = {
2024-09-02 11:06:57 -04:00
useACMEHost = config.secrets.networking.domains.primary;
2024-07-02 10:02:46 -04:00
forceSSL = true;
locations."/" = {
proxyPass = "http://${config.secrets.services.gremlin-lab.ip}";
proxyWebsockets = true;
extraConfig = "proxy_ssl_server_name on;";
};
};
};
};
ssh = {
enable = true;
ports = [ config.secrets.hosts.dimaga.ssh.port ];
2024-07-02 10:02:46 -04:00
};
virtualization.host = {
enable = true;
user = "aires";
vmBuilds = {
2024-07-02 10:02:46 -04:00
enable = true;
cores = 3;
ram = 3072;
2024-07-02 10:02:46 -04:00
};
};
2024-07-01 09:48:29 -04:00
};
# Install Gnome
ui.desktops.gnome.enable = true;
2024-07-01 09:48:29 -04:00
users.aires = {
enable = true;
services = {
syncthing = {
enable = true;
2024-07-02 10:02:46 -04:00
autostart = false;
2024-07-01 09:48:29 -04:00
};
};
};
};
}