1
0
Fork 0
nix-configuration/hosts/Haven/default.nix

180 lines
5 KiB
Nix
Raw Normal View History

{
pkgs,
home-manager,
lib,
config,
...
}:
2024-02-29 14:53:34 +00:00
let
start-haven = pkgs.writeShellScriptBin "start-haven" (builtins.readFile ./start-haven.sh);
services-root = "/storage/services";
2024-05-24 03:50:42 +00:00
subdomains = [
config.secrets.services.airsonic.url
2024-05-24 21:33:37 +00:00
config.secrets.services.cache.url
2024-05-24 03:50:42 +00:00
config.secrets.services.forgejo.url
2024-05-24 15:56:23 +00:00
config.secrets.services.gremlin-lab.url
];
2024-06-25 18:27:58 +00:00
namecheapCredentials = {
"NAMECHEAP_API_USER_FILE" = "${pkgs.writeText "namecheap-api-user" ''
${config.secrets.networking.namecheap.api.user}
''}";
"NAMECHEAP_API_KEY_FILE" = "${pkgs.writeText "namecheap-api-key" ''
${config.secrets.networking.namecheap.api.key}
''}";
};
2024-02-29 14:53:34 +00:00
in
{
imports = [ ./hardware-configuration.nix ];
system.stateVersion = "24.05";
2024-02-29 14:53:34 +00:00
aux.system = {
apps.tmux.enable = true;
2024-06-24 22:19:27 +00:00
# Configure the bootloader.
bootloader = {
enable = true;
secureboot.enable = true;
tpm2.enable = true;
};
# Use Disko to partition and format disks
disko = {
enable = false;
primaryDiskID = "nvme-eui.002538da11443b4d";
swapFile = {
enable = true;
size = "16G";
};
};
2024-06-24 22:19:27 +00:00
# Change the default text editor. Options are "emacs", "nano", or "vim".
editor = "nano";
2024-06-24 17:08:18 +00:00
gpu.amd.enable = true;
2024-06-24 22:19:27 +00:00
2024-06-24 22:28:22 +00:00
packages = [
start-haven
pkgs.htop
];
2024-06-24 22:19:27 +00:00
# Keep old generations for one month.
retentionPeriod = "monthly";
services = {
2024-05-21 00:52:57 +00:00
acme = {
enable = true;
2024-05-21 00:56:48 +00:00
defaultEmail = config.secrets.users.aires.email;
2024-05-21 00:52:57 +00:00
certs = {
"${config.secrets.networking.primaryDomain}" = {
dnsProvider = "namecheap";
extraDomainNames = subdomains;
webroot = null; # Required in order to prevent a failed assertion
2024-06-25 18:27:58 +00:00
credentialFiles = namecheapCredentials;
2024-05-21 00:52:57 +00:00
};
"${config.secrets.networking.blogDomain}" = {
dnsProvider = "namecheap";
webroot = null; # Required in order to prevent a failed assertion
2024-06-25 18:27:58 +00:00
credentialFiles = namecheapCredentials;
};
2024-05-21 00:52:57 +00:00
};
};
apcupsd = {
enable = true;
configText = builtins.readFile ./etc/apcupsd.conf;
};
airsonic = {
enable = true;
home = "${services-root}/airsonic-advanced";
2024-06-25 18:13:15 +00:00
domain = config.secrets.networking.primaryDomain;
url = config.secrets.services.airsonic.url;
};
2024-06-24 16:24:21 +00:00
autoUpgrade = {
2024-06-24 22:19:27 +00:00
enable = false; # Don't update the system...
pushUpdates = true; # ...but do push updates remotely.
2024-06-24 16:24:21 +00:00
configDir = config.secrets.nixConfigFolder;
onCalendar = "daily";
user = config.users.users.aires.name;
};
2024-05-21 00:52:57 +00:00
boinc.enable = true;
2024-05-24 21:33:37 +00:00
cache = {
enable = false; # Disable for now
secretKeyFile = "${services-root}/nix-cache/cache-priv-key.pem";
2024-05-24 21:33:37 +00:00
};
duplicacy-web = {
enable = true;
autostart = false;
environment = "/storage/backups/settings/Haven";
};
forgejo = {
enable = true;
home = "${services-root}/forgejo";
2024-06-25 18:13:15 +00:00
domain = config.secrets.networking.primaryDomain;
url = config.secrets.services.forgejo.url;
2024-06-04 18:18:45 +00:00
actions = {
enable = true;
token = config.secrets.services.forgejo.runner-token;
};
};
msmtp.enable = true;
2024-05-21 00:52:57 +00:00
nginx = {
enable = true;
autostart = false;
virtualHosts = {
"${config.secrets.networking.primaryDomain}" = {
default = true;
enableACME = true; # Enable Let's Encrypt
locations."/" = {
# Catchall vhost, will redirect users to Forgejo
return = "301 https://${config.secrets.services.forgejo.url}";
2024-05-21 00:52:57 +00:00
};
};
"${config.secrets.networking.blogDomain}" = {
useACMEHost = config.secrets.networking.blogDomain;
forceSSL = true;
2024-06-19 18:26:32 +00:00
root = "${services-root}/nginx/sites/${config.secrets.networking.blogDomain}";
};
2024-05-24 15:56:23 +00:00
"${config.secrets.services.gremlin-lab.url}" = {
useACMEHost = config.secrets.networking.primaryDomain;
forceSSL = true;
locations."/" = {
proxyPass = "http://${config.secrets.services.gremlin-lab.ip}";
proxyWebsockets = true;
extraConfig = "proxy_ssl_server_name on;";
};
};
2024-05-21 00:52:57 +00:00
};
};
ssh = {
enable = true;
ports = [ config.secrets.hosts.haven.ssh.port ];
};
2024-05-22 20:47:55 +00:00
virtualization = {
2024-06-25 18:13:15 +00:00
host = {
enable = true;
user = "aires";
vmBuilds = {
enable = true;
cores = 3;
ram = 4096;
};
};
2024-05-22 20:47:55 +00:00
};
};
users.aires = {
enable = true;
services.syncthing = {
enable = true;
autostart = false;
};
};
};
2024-02-29 14:53:34 +00:00
2024-05-21 00:52:57 +00:00
# TODO: VPN (Check out Wireguard)
# Allow Haven to be a build target for other architectures (mainly ARM64)
boot.binfmt.emulatedSystems = [ "aarch64-linux" ];
}