Archive Legacy Setup And Add Ansible Control Plane
This commit is contained in:
Dmitry
@@ -0,0 +1,23 @@
|
||||
{
|
||||
description = "Homelab NixOS hosts";
|
||||
|
||||
inputs = {
|
||||
nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.11";
|
||||
};
|
||||
|
||||
outputs = { nixpkgs, ... }: {
|
||||
nixosConfigurations.cloud-pc = nixpkgs.lib.nixosSystem {
|
||||
system = "x86_64-linux";
|
||||
modules = [
|
||||
./hosts/cloud-pc
|
||||
];
|
||||
};
|
||||
|
||||
nixosConfigurations.mini-pc = nixpkgs.lib.nixosSystem {
|
||||
system = "x86_64-linux";
|
||||
modules = [
|
||||
./hosts/mini-pc
|
||||
];
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,73 @@
|
||||
{ ... }:
|
||||
|
||||
{
|
||||
imports = [
|
||||
../../modules/base.nix
|
||||
../../modules/docker.nix
|
||||
../../modules/libvirtd.nix
|
||||
../../modules/zerotier.nix
|
||||
./firewall.nix
|
||||
./hardware.nix
|
||||
];
|
||||
|
||||
networking = {
|
||||
hostName = "cloud-pc";
|
||||
useDHCP = false;
|
||||
defaultGateway = "192.168.1.1";
|
||||
nameservers = [
|
||||
"192.168.1.1"
|
||||
"1.1.1.1"
|
||||
];
|
||||
|
||||
interfaces.enp2s0.ipv4.addresses = [
|
||||
{
|
||||
address = "192.168.1.5";
|
||||
prefixLength = 24;
|
||||
}
|
||||
];
|
||||
};
|
||||
|
||||
fileSystems."/opt/data" = {
|
||||
device = "/dev/disk/by-uuid/ae278333-4116-4225-9b95-595496fadd26";
|
||||
fsType = "ext4";
|
||||
options = [ "nofail" ];
|
||||
};
|
||||
|
||||
fileSystems."/opt/samba" = {
|
||||
device = "/dev/disk/by-uuid/89024d30-1ab6-4b2e-b23b-62837455b24a";
|
||||
fsType = "ext4";
|
||||
options = [ "nofail" ];
|
||||
};
|
||||
|
||||
fileSystems."/mnt/backup" = {
|
||||
device = "/dev/disk/by-uuid/940a9a4e-10cf-4380-9d22-a71549066561";
|
||||
fsType = "ext4";
|
||||
options = [ "nofail" ];
|
||||
};
|
||||
|
||||
systemd.tmpfiles.rules = [
|
||||
"d /opt/data/postgres 0755 ada users - -"
|
||||
"d /opt/data/nextcloud 0755 ada users - -"
|
||||
"d /opt/data/gitea 0755 ada users - -"
|
||||
"d /opt/data/gitea-runner 0755 ada users - -"
|
||||
"d /opt/data/syncthing 0755 ada users - -"
|
||||
"d /opt/data/zerotier 0755 ada users - -"
|
||||
"d /opt/configs/nextcloud 0755 ada users - -"
|
||||
"d /opt/configs/nextcloud/app 0755 ada users - -"
|
||||
"d /opt/configs/syncthing 0755 ada users - -"
|
||||
"d /opt/samba 0755 ada users - -"
|
||||
"d /opt/samba/media 0755 ada users - -"
|
||||
"d /opt/samba/documents 0755 ada users - -"
|
||||
"d /opt/samba/backups_win 0755 ada users - -"
|
||||
"d /mnt/backup 0755 ada users - -"
|
||||
"d /mnt/backup/restic 0755 ada users - -"
|
||||
"d /mnt/backup/restic/services 0755 ada users - -"
|
||||
"d /mnt/backup/restic/samba 0755 ada users - -"
|
||||
"d /mnt/backup/devices 0755 ada users - -"
|
||||
"d /mnt/backup/devices/proxmox 0755 ada users - -"
|
||||
"d /mnt/backup/devices/ada-x1 0755 ada users - -"
|
||||
"d /mnt/yandex 0755 ada users - -"
|
||||
];
|
||||
|
||||
system.stateVersion = "25.11";
|
||||
}
|
||||
@@ -0,0 +1,25 @@
|
||||
{
|
||||
networking.firewall = {
|
||||
enable = true;
|
||||
allowedTCPPorts = [
|
||||
22 # SSH
|
||||
139 # Samba (NetBIOS session)
|
||||
445 # Samba (SMB)
|
||||
2222 # Gitea SSH
|
||||
3002
|
||||
4567
|
||||
5432 # PostgreSQL
|
||||
7080
|
||||
8081
|
||||
8384 # Syncthing web UI
|
||||
22000 # Syncthing data transfer
|
||||
];
|
||||
allowedUDPPorts = [
|
||||
137 # Samba (NetBIOS name)
|
||||
138 # Samba (NetBIOS datagram)
|
||||
9993 # ZeroTier
|
||||
21027 # Syncthing discovery
|
||||
22000 # Syncthing data transfer
|
||||
];
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,31 @@
|
||||
# Do not modify this file! It was generated by ‘nixos-generate-config’
|
||||
# and may be overwritten by future invocations. Please make changes
|
||||
# to /etc/nixos/configuration.nix instead.
|
||||
{ config, lib, pkgs, modulesPath, ... }:
|
||||
|
||||
{
|
||||
imports =
|
||||
[ (modulesPath + "/installer/scan/not-detected.nix")
|
||||
];
|
||||
|
||||
boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "usbhid" "usb_storage" "sd_mod" ];
|
||||
boot.initrd.kernelModules = [ ];
|
||||
boot.kernelModules = [ "kvm-intel" ];
|
||||
boot.extraModulePackages = [ ];
|
||||
|
||||
fileSystems."/" =
|
||||
{ device = "/dev/disk/by-uuid/f729e8cb-5c37-45fe-bd0a-e511d79bb49c";
|
||||
fsType = "ext4";
|
||||
};
|
||||
|
||||
fileSystems."/boot" =
|
||||
{ device = "/dev/disk/by-uuid/8BA8-38FE";
|
||||
fsType = "vfat";
|
||||
options = [ "fmask=0022" "dmask=0022" ];
|
||||
};
|
||||
|
||||
swapDevices = [ ];
|
||||
|
||||
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
|
||||
hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
|
||||
}
|
||||
@@ -0,0 +1,72 @@
|
||||
{ ... }:
|
||||
|
||||
{
|
||||
imports = [
|
||||
../../modules/base.nix
|
||||
../../modules/docker.nix
|
||||
../../modules/libvirtd.nix
|
||||
../../modules/zerotier.nix
|
||||
./firewall.nix
|
||||
./hardware.nix
|
||||
];
|
||||
|
||||
networking = {
|
||||
hostName = "mini-pc";
|
||||
useDHCP = false;
|
||||
};
|
||||
|
||||
systemd.network = {
|
||||
enable = true;
|
||||
networks."10-lan" = {
|
||||
matchConfig.Name = "en*";
|
||||
networkConfig = {
|
||||
Address = "192.168.1.10/24";
|
||||
Gateway = "192.168.1.1";
|
||||
DNS = [
|
||||
"192.168.1.1"
|
||||
"1.1.1.1"
|
||||
];
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
services.resolved = {
|
||||
enable = true;
|
||||
fallbackDns = [ "1.1.1.1" "8.8.8.8" ];
|
||||
};
|
||||
|
||||
systemd.tmpfiles.rules = [
|
||||
"d /opt/data/adguard 0755 ada users - -"
|
||||
"d /opt/data/adguard/work 0755 ada users - -"
|
||||
"d /opt/data/caddy 0755 ada users - -"
|
||||
"d /opt/data/gitea-runner 0755 ada users - -"
|
||||
"d /opt/data/uptime-kuma 0755 ada users - -"
|
||||
"d /opt/data/vaultwarden 0755 ada users - -"
|
||||
"d /opt/data/zerotier 0755 ada users - -"
|
||||
"d /opt/configs/adguard 0755 ada users - -"
|
||||
"d /opt/configs/caddy 0755 ada users - -"
|
||||
"d /opt/configs/caddy/lego 0755 ada users - -"
|
||||
];
|
||||
|
||||
programs.bash.interactiveShellInit = ''
|
||||
proxy_on() {
|
||||
export http_proxy=http://192.168.1.10:10172
|
||||
export https_proxy=http://192.168.1.10:10172
|
||||
export HTTP_PROXY=http://192.168.1.10:10172
|
||||
export HTTPS_PROXY=http://192.168.1.10:10172
|
||||
export all_proxy=socks5://192.168.1.10:10171
|
||||
export ALL_PROXY=socks5://192.168.1.10:10171
|
||||
export ftp_proxy=http://192.168.1.10:10172
|
||||
export FTP_PROXY=http://192.168.1.10:10172
|
||||
export no_proxy=localhost,127.0.0.0/8,::1,192.168.1.0/24
|
||||
export NO_PROXY=localhost,127.0.0.0/8,::1,192.168.1.0/24
|
||||
}
|
||||
proxy_off() {
|
||||
unset http_proxy https_proxy HTTP_PROXY HTTPS_PROXY
|
||||
unset all_proxy ALL_PROXY ftp_proxy FTP_PROXY
|
||||
unset no_proxy NO_PROXY
|
||||
}
|
||||
'';
|
||||
|
||||
system.stateVersion = "25.11";
|
||||
}
|
||||
@@ -0,0 +1,28 @@
|
||||
{
|
||||
networking.firewall = {
|
||||
enable = true;
|
||||
allowedTCPPorts = [
|
||||
22 # SSH
|
||||
53 # DNS (AdGuard)
|
||||
80 # HTTP
|
||||
443 # HTTPS
|
||||
784 # DNS-over-QUIC
|
||||
853 # DNS-over-TLS
|
||||
3001 # Uptime Kuma
|
||||
3015
|
||||
4438
|
||||
5443
|
||||
8088
|
||||
10171 # v2raya SOCKS5 LAN
|
||||
10172 # v2raya HTTP proxy LAN
|
||||
10380
|
||||
];
|
||||
allowedUDPPorts = [
|
||||
53 # DNS
|
||||
443 # QUIC
|
||||
784 # DNS-over-QUIC
|
||||
9993 # ZeroTier
|
||||
5443
|
||||
];
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,31 @@
|
||||
# Do not modify this file! It was generated by ‘nixos-generate-config’
|
||||
# and may be overwritten by future invocations. Please make changes
|
||||
# to /etc/nixos/configuration.nix instead.
|
||||
{ config, lib, pkgs, modulesPath, ... }:
|
||||
|
||||
{
|
||||
imports =
|
||||
[ (modulesPath + "/installer/scan/not-detected.nix")
|
||||
];
|
||||
|
||||
boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "usb_storage" "usbhid" "sd_mod" "sdhci_pci" ];
|
||||
boot.initrd.kernelModules = [ ];
|
||||
boot.kernelModules = [ "kvm-intel" ];
|
||||
boot.extraModulePackages = [ ];
|
||||
|
||||
fileSystems."/" =
|
||||
{ device = "/dev/disk/by-uuid/a2fc1626-3301-44dd-9d00-fa7e8d216d25";
|
||||
fsType = "ext4";
|
||||
};
|
||||
|
||||
fileSystems."/boot" =
|
||||
{ device = "/dev/disk/by-uuid/73C2-3F45";
|
||||
fsType = "vfat";
|
||||
options = [ "fmask=0022" "dmask=0022" ];
|
||||
};
|
||||
|
||||
swapDevices = [ ];
|
||||
|
||||
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
|
||||
hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
|
||||
}
|
||||
@@ -0,0 +1,85 @@
|
||||
{ pkgs, ... }:
|
||||
|
||||
{
|
||||
nix = {
|
||||
settings = {
|
||||
experimental-features = [ "nix-command" "flakes" ];
|
||||
auto-optimise-store = true;
|
||||
};
|
||||
gc = {
|
||||
automatic = true;
|
||||
dates = "weekly";
|
||||
options = "--delete-older-than 30d";
|
||||
};
|
||||
};
|
||||
|
||||
boot = {
|
||||
tmp.cleanOnBoot = true;
|
||||
loader.systemd-boot.enable = true;
|
||||
loader.efi.canTouchEfiVariables = true;
|
||||
};
|
||||
|
||||
systemd.network.wait-online.anyInterface = true;
|
||||
|
||||
systemd.services.nix-daemon.environment = {
|
||||
HTTPS_PROXY = "http://192.168.1.10:10172";
|
||||
HTTP_PROXY = "http://192.168.1.10:10172";
|
||||
NO_PROXY = "localhost,127.0.0.0/8,::1,192.168.1.0/24";
|
||||
};
|
||||
|
||||
time.timeZone = "Europe/Moscow";
|
||||
|
||||
i18n.defaultLocale = "ru_RU.UTF-8";
|
||||
i18n.supportedLocales = [
|
||||
"ru_RU.UTF-8/UTF-8"
|
||||
"en_US.UTF-8/UTF-8"
|
||||
];
|
||||
|
||||
users.users.ada = {
|
||||
isNormalUser = true;
|
||||
shell = pkgs.bashInteractive;
|
||||
extraGroups = [
|
||||
"wheel"
|
||||
"docker"
|
||||
];
|
||||
openssh.authorizedKeys.keys = [
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIWNsUQmppB6cQccXX1ZaBbFIcmM6RmghsTVbG9TgoZB ada@ada-x1"
|
||||
];
|
||||
};
|
||||
|
||||
services.openssh = {
|
||||
enable = true;
|
||||
settings = {
|
||||
PasswordAuthentication = false;
|
||||
KbdInteractiveAuthentication = false;
|
||||
PermitRootLogin = "no";
|
||||
PubkeyAuthentication = true;
|
||||
};
|
||||
};
|
||||
|
||||
security.sudo.extraRules = [
|
||||
{
|
||||
users = [ "ada" ];
|
||||
commands = [
|
||||
{
|
||||
command = "/run/current-system/sw/bin/nixos-rebuild";
|
||||
options = [ "NOPASSWD" ];
|
||||
}
|
||||
];
|
||||
}
|
||||
];
|
||||
|
||||
environment.systemPackages = with pkgs; [
|
||||
git
|
||||
restic
|
||||
resticprofile
|
||||
htop
|
||||
];
|
||||
|
||||
systemd.tmpfiles.rules = [
|
||||
"d /opt/services 0755 ada users - -"
|
||||
"Z /opt/services - ada users - -"
|
||||
"d /opt/data 0755 ada users - -"
|
||||
"d /opt/configs 0755 ada users - -"
|
||||
];
|
||||
}
|
||||
@@ -0,0 +1,17 @@
|
||||
{ pkgs, ... }:
|
||||
|
||||
{
|
||||
virtualisation.docker = {
|
||||
enable = true;
|
||||
daemon.settings = {
|
||||
registry-mirrors = [
|
||||
"https://mirror.gcr.io"
|
||||
"https://dockerhub.timeweb.cloud"
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
environment.systemPackages = with pkgs; [
|
||||
docker-compose
|
||||
];
|
||||
}
|
||||
@@ -0,0 +1,10 @@
|
||||
{ pkgs, ... }:
|
||||
|
||||
{
|
||||
virtualisation.libvirtd = {
|
||||
enable = true;
|
||||
qemu.package = pkgs.qemu_kvm;
|
||||
};
|
||||
|
||||
users.users.ada.extraGroups = [ "libvirtd" ];
|
||||
}
|
||||
@@ -0,0 +1,6 @@
|
||||
{
|
||||
services.zerotierone = {
|
||||
enable = true;
|
||||
joinNetworks = [ "743993800fa5a34c" ];
|
||||
};
|
||||
}
|
||||
Reference in New Issue
Block a user