1
0
Fork 0

Merge branch 'main' of ssh://code.8bitbuddhism.com/aires/nix-configuration

This commit is contained in:
Aires 2024-07-02 10:34:40 -04:00
commit 41f5b1ff11
3 changed files with 176 additions and 17 deletions

43
bin/install-nixos.sh Executable file
View file

@ -0,0 +1,43 @@
#!/usr/bin/env bash
# Script to install a brand new NixOS installation.
# Formats the drive provided, then runs nixos-install.
set -e
# Configuration parameters
ask_root_password=true # Prompt for a root user password
flakeDir="." # Where the flake.nix file is stored
boot_drive="/dev/disk/by-uuid/whatever" # The drive to install the bootloader to
root_drive="/dev/disk/by-id/whatever" # The partition to install NixOS to
if [ "$(id -u)" != "0" ]; then
echo "This script must be run as root" 1>&2
exit 1
fi
cryptsetup --allow-discards --label=nixos-crypt --type=luks2 luksFormat $root_drive
cryptsetup luksOpen $root_drive nixos-crypt
mount /dev/mapper/nixos-crypt /mnt
mkfs.btrfs -L nixos /mnt
btrfs subvolume create /mnt/@
btrfs subvolume create /mnt/@home
btrfs subvolume create /mnt/@log
btrfs subvolume create /mnt/@nix
btrfs subvolume create /mnt/@swap
umount /mnt
mount -o subvol=@ $root_drive /mnt
mkdir -p /mnt/{boot,home,var/log,nix,swap}
mount $boot_drive /mnt/boot
mount -o subvol=@home $root_drive /mnt/home
mount -o subvol=@log $root_drive /var/log
mount -o subvol=@nix $root_drive /mnt/nix
mount -o subvol=@swap $root_drive /mnt/swap
# Create swapfile
btrfs filesystem mkswapfile --size $(free -h --si | grep Mem: | awk '{print $2}') --uuid clear /mnt/swap/swapfile
nixos-install --verbose --root /mnt --flake $flakeDir $( (( ask_root_password == false )) && echo "--no-root-password" )
exit 0

View file

@ -28,11 +28,11 @@
]
},
"locked": {
"lastModified": 1719733833,
"narHash": "sha256-6h2EqZU9bL9rHlXE+2LCBgnDImejzbS+4dYsNDDFlkY=",
"lastModified": 1719864345,
"narHash": "sha256-e4Pw+30vFAxuvkSTaTypd9zYemB/QlWcH186dsGT+Ms=",
"owner": "nix-community",
"repo": "disko",
"rev": "d185770ea261fb5cf81aa5ad1791b93a7834d12c",
"rev": "544a80a69d6e2da04e4df7ec8210a858de8c7533",
"type": "github"
},
"original": {
@ -268,11 +268,11 @@
},
"nixos-hardware": {
"locked": {
"lastModified": 1719681865,
"narHash": "sha256-Lp+l1IsREVbz8WM35OJYZz8sAH0XOjrZWUXVB5bJ2qg=",
"lastModified": 1719895800,
"narHash": "sha256-xNbjISJTFailxass4LmdWeV4jNhAlmJPwj46a/GxE6M=",
"owner": "NixOS",
"repo": "nixos-hardware",
"rev": "a59f00f5ac65b19382617ba00f360f8bc07ed3ac",
"rev": "6e253f12b1009053eff5344be5e835f604bb64cd",
"type": "github"
},
"original": {
@ -316,11 +316,11 @@
},
"nixpkgs_2": {
"locked": {
"lastModified": 1719690277,
"narHash": "sha256-0xSej1g7eP2kaUF+JQp8jdyNmpmCJKRpO12mKl/36Kc=",
"lastModified": 1719848872,
"narHash": "sha256-H3+EC5cYuq+gQW8y0lSrrDZfH71LB4DAf+TDFyvwCNA=",
"owner": "nixos",
"repo": "nixpkgs",
"rev": "2741b4b489b55df32afac57bc4bfd220e8bf617e",
"rev": "00d80d13810dbfea8ab4ed1009b09100cca86ba8",
"type": "github"
},
"original": {

View file

@ -8,6 +8,28 @@
let
# Do not change this value! This tracks when NixOS was installed on your system.
stateVersion = "24.11";
start-services = pkgs.writeShellScriptBin "start-services" (
builtins.readFile ../Haven/start-haven.sh
);
services-root = "/storage/services";
subdomains = [
config.secrets.services.airsonic.url
config.secrets.services.cache.url
config.secrets.services.forgejo.url
config.secrets.services.gremlin-lab.url
];
namecheapCredentials = {
"NAMECHEAP_API_USER_FILE" = "${pkgs.writeText "namecheap-api-user" ''
${config.secrets.networking.namecheap.api.user}
''}";
"NAMECHEAP_API_KEY_FILE" = "${pkgs.writeText "namecheap-api-key" ''
${config.secrets.networking.namecheap.api.key}
''}";
};
in
{
imports = [ ./hardware-configuration.nix ];
@ -28,6 +50,7 @@ in
apps = {
development.enable = true;
tmux.enable = true;
#media.enable = true;
#office.enable = true;
#recording.enable = true;
@ -38,7 +61,7 @@ in
# Enable Secure Boot support.
bootloader = {
enable = true;
#secureboot.enable = true;
secureboot.enable = true;
tpm2.enable = true;
};
@ -58,17 +81,113 @@ in
};
};
packages = [
start-services
pkgs.htop
];
# Change how long old generations are kept for.
retentionPeriod = "14d";
retentionPeriod = "monthly";
services = {
autoUpgrade = {
acme = {
enable = true;
defaultEmail = config.secrets.users.aires.email;
certs = {
"${config.secrets.networking.primaryDomain}" = {
dnsProvider = "namecheap";
extraDomainNames = subdomains;
webroot = null; # Required in order to prevent a failed assertion
credentialFiles = namecheapCredentials;
};
"${config.secrets.networking.blogDomain}" = {
dnsProvider = "namecheap";
webroot = null; # Required in order to prevent a failed assertion
credentialFiles = namecheapCredentials;
};
};
};
apcupsd = {
enable = true;
configText = builtins.readFile ../Haven/etc/apcupsd.conf;
};
airsonic = {
enable = true;
home = "${services-root}/airsonic-advanced";
domain = config.secrets.networking.primaryDomain;
url = config.secrets.services.airsonic.url;
};
autoUpgrade = {
enable = false; # Don't update the system...
pushUpdates = true; # ...but do push updates remotely.
configDir = config.secrets.nixConfigFolder;
onCalendar = "daily";
user = config.users.users.aires.name;
};
virtualization.enable = true;
boinc.enable = true;
cache = {
enable = false; # Disable for now
secretKeyFile = "${services-root}/nix-cache/cache-priv-key.pem";
};
duplicacy-web = {
enable = true;
autostart = false;
environment = "/storage/backups/settings/Haven";
};
forgejo = {
enable = true;
home = "${services-root}/forgejo";
domain = config.secrets.networking.primaryDomain;
url = config.secrets.services.forgejo.url;
actions = {
enable = true;
token = config.secrets.services.forgejo.runner-token;
};
};
msmtp.enable = true;
nginx = {
enable = true;
autostart = false;
virtualHosts = {
"${config.secrets.networking.primaryDomain}" = {
default = true;
enableACME = true; # Enable Let's Encrypt
locations."/" = {
# Catchall vhost, will redirect users to Forgejo
return = "301 https://${config.secrets.services.forgejo.url}";
};
};
"${config.secrets.networking.blogDomain}" = {
useACMEHost = config.secrets.networking.blogDomain;
forceSSL = true;
root = "${services-root}/nginx/sites/${config.secrets.networking.blogDomain}";
};
"${config.secrets.services.gremlin-lab.url}" = {
useACMEHost = config.secrets.networking.primaryDomain;
forceSSL = true;
locations."/" = {
proxyPass = "http://${config.secrets.services.gremlin-lab.ip}";
proxyWebsockets = true;
extraConfig = "proxy_ssl_server_name on;";
};
};
};
};
ssh = {
enable = true;
ports = [ config.secrets.hosts.haven.ssh.port ];
};
virtualization = {
host = {
enable = true;
user = "aires";
vmBuilds = {
enable = true;
cores = 3;
ram = 4096;
};
};
};
};
ui = {
@ -83,8 +202,6 @@ in
# Define Flatpak packages to install.
packages = [
"com.github.tchx84.Flatseal"
"com.github.wwmm.easyeffects"
"md.obsidian.Obsidian"
"org.keepassxc.KeePassXC"
"org.mozilla.firefox"
];
@ -96,8 +213,7 @@ in
services = {
syncthing = {
enable = true;
autostart = true;
enableTray = false;
autostart = false;
};
};
};