diff --git a/.gitea/workflows/nixos-switch-cloud-pc.yml b/.gitea/workflows/nixos-switch-cloud-pc.yml index a41349a..c0dab74 100644 --- a/.gitea/workflows/nixos-switch-cloud-pc.yml +++ b/.gitea/workflows/nixos-switch-cloud-pc.yml @@ -5,7 +5,10 @@ on: push: paths: - ".gitea/workflows/nixos-switch-cloud-pc.yml" - - "nixos/**" + - "nixos/flake.nix" + - "nixos/flake.lock" + - "nixos/modules/**" + - "nixos/hosts/cloud-pc/**" jobs: switch: diff --git a/.gitea/workflows/nixos-switch-mini-pc.yml b/.gitea/workflows/nixos-switch-mini-pc.yml index daa710a..f443060 100644 --- a/.gitea/workflows/nixos-switch-mini-pc.yml +++ b/.gitea/workflows/nixos-switch-mini-pc.yml @@ -5,7 +5,10 @@ on: push: paths: - ".gitea/workflows/nixos-switch-mini-pc.yml" - - "nixos/**" + - "nixos/flake.nix" + - "nixos/flake.lock" + - "nixos/modules/**" + - "nixos/hosts/mini-pc/**" jobs: switch: diff --git a/nixos/flake.nix b/nixos/flake.nix index 994b44c..9977beb 100644 --- a/nixos/flake.nix +++ b/nixos/flake.nix @@ -9,14 +9,14 @@ nixosConfigurations.cloud-pc = nixpkgs.lib.nixosSystem { system = "x86_64-linux"; modules = [ - ./hosts/cloud-pc.nix + ./hosts/cloud-pc ]; }; nixosConfigurations.mini-pc = nixpkgs.lib.nixosSystem { system = "x86_64-linux"; modules = [ - ./hosts/mini-pc.nix + ./hosts/mini-pc ]; }; }; diff --git a/nixos/hosts/cloud-pc.nix b/nixos/hosts/cloud-pc/default.nix similarity index 83% rename from nixos/hosts/cloud-pc.nix rename to nixos/hosts/cloud-pc/default.nix index b396b6c..326353d 100644 --- a/nixos/hosts/cloud-pc.nix +++ b/nixos/hosts/cloud-pc/default.nix @@ -1,11 +1,12 @@ -{ pkgs, ... }: +{ ... }: { imports = [ - ../modules/base.nix - ../modules/docker.nix - ../modules/firewall.nix - ./hardware-configuration.nix + ../../modules/base.nix + ../../modules/docker.nix + ../../modules/libvirtd.nix + ../../modules/firewall.nix + ./hardware.nix ]; networking = { @@ -46,13 +47,6 @@ boot.loader.systemd-boot.enable = true; boot.loader.efi.canTouchEfiVariables = true; - virtualisation.libvirtd = { - enable = true; - qemu = { - package = pkgs.qemu_kvm; - }; - }; - services.zerotierone = { enable = true; joinNetworks = [ @@ -84,5 +78,12 @@ "d /mnt/yandex 0755 ada users - -" ]; + services.gitea-actions-runner.instances."cloud-pc-nixos" = { + name = "cloud-pc-nixos"; + url = "https://git.example.com"; # поменяй на свой URL + tokenFile = "/etc/gitea-runner/cloud-pc-nixos.token"; + labels = [ "cloud-pc-nixos" ]; + }; + system.stateVersion = "25.11"; } diff --git a/nixos/hosts/cloud-pc/hardware.nix b/nixos/hosts/cloud-pc/hardware.nix new file mode 100644 index 0000000..5c41fe3 --- /dev/null +++ b/nixos/hosts/cloud-pc/hardware.nix @@ -0,0 +1,31 @@ +# Do not modify this file! It was generated by ‘nixos-generate-config’ +# and may be overwritten by future invocations. Please make changes +# to /etc/nixos/configuration.nix instead. +{ config, lib, pkgs, modulesPath, ... }: + +{ + imports = + [ (modulesPath + "/installer/scan/not-detected.nix") + ]; + + boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "usbhid" "usb_storage" "sd_mod" ]; + boot.initrd.kernelModules = [ ]; + boot.kernelModules = [ "kvm-intel" ]; + boot.extraModulePackages = [ ]; + + fileSystems."/" = + { device = "/dev/disk/by-uuid/f729e8cb-5c37-45fe-bd0a-e511d79bb49c"; + fsType = "ext4"; + }; + + fileSystems."/boot" = + { device = "/dev/disk/by-uuid/8BA8-38FE"; + fsType = "vfat"; + options = [ "fmask=0022" "dmask=0022" ]; + }; + + swapDevices = [ ]; + + nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux"; + hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware; +} diff --git a/nixos/hosts/mini-pc.nix b/nixos/hosts/mini-pc/default.nix similarity index 74% rename from nixos/hosts/mini-pc.nix rename to nixos/hosts/mini-pc/default.nix index bdf7cd0..626f6e2 100644 --- a/nixos/hosts/mini-pc.nix +++ b/nixos/hosts/mini-pc/default.nix @@ -1,21 +1,17 @@ -{ pkgs, ... }: +{ ... }: { imports = [ - ../modules/base.nix - ../modules/docker.nix - ../modules/firewall-mini-pc.nix - ./mini-pc-hardware-configuration.nix + ../../modules/base.nix + ../../modules/docker.nix + ../../modules/libvirtd.nix + ../../modules/firewall-mini-pc.nix + ./hardware.nix ]; networking = { hostName = "mini-pc"; useDHCP = false; - defaultGateway = "192.168.1.1"; - nameservers = [ - "192.168.1.1" - "1.1.1.1" - ]; }; systemd.network = { @@ -38,13 +34,6 @@ boot.loader.systemd-boot.enable = true; boot.loader.efi.canTouchEfiVariables = true; - virtualisation.libvirtd = { - enable = true; - qemu = { - package = pkgs.qemu_kvm; - }; - }; - services.zerotierone = { enable = true; joinNetworks = [ @@ -65,5 +54,12 @@ "d /opt/configs/caddy/lego 0755 ada users - -" ]; + services.gitea-actions-runner.instances."mini-pc-nixos" = { + name = "mini-pc-nixos"; + url = "https://git.example.com"; # поменяй на свой URL + tokenFile = "/etc/gitea-runner/mini-pc-nixos.token"; + labels = [ "mini-pc-nixos" ]; + }; + system.stateVersion = "25.11"; } diff --git a/nixos/hosts/mini-pc/hardware.nix b/nixos/hosts/mini-pc/hardware.nix new file mode 100644 index 0000000..f42eeba --- /dev/null +++ b/nixos/hosts/mini-pc/hardware.nix @@ -0,0 +1,31 @@ +# Do not modify this file! It was generated by ‘nixos-generate-config’ +# and may be overwritten by future invocations. Please make changes +# to /etc/nixos/configuration.nix instead. +{ config, lib, pkgs, modulesPath, ... }: + +{ + imports = + [ (modulesPath + "/installer/scan/not-detected.nix") + ]; + + boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "usb_storage" "usbhid" "sd_mod" "sdhci_pci" ]; + boot.initrd.kernelModules = [ ]; + boot.kernelModules = [ "kvm-intel" ]; + boot.extraModulePackages = [ ]; + + fileSystems."/" = + { device = "/dev/disk/by-uuid/a2fc1626-3301-44dd-9d00-fa7e8d216d25"; + fsType = "ext4"; + }; + + fileSystems."/boot" = + { device = "/dev/disk/by-uuid/73C2-3F45"; + fsType = "vfat"; + options = [ "fmask=0022" "dmask=0022" ]; + }; + + swapDevices = [ ]; + + nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux"; + hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware; +} diff --git a/nixos/modules/base.nix b/nixos/modules/base.nix index 57c9689..2d47461 100644 --- a/nixos/modules/base.nix +++ b/nixos/modules/base.nix @@ -1,10 +1,19 @@ { pkgs, ... }: { - nix.settings.experimental-features = [ - "nix-command" - "flakes" - ]; + nix = { + settings = { + experimental-features = [ "nix-command" "flakes" ]; + auto-optimise-store = true; + }; + gc = { + automatic = true; + dates = "weekly"; + options = "--delete-older-than 30d"; + }; + }; + + boot.tmp.cleanOnBoot = true; time.timeZone = "Europe/Moscow"; @@ -20,7 +29,6 @@ extraGroups = [ "wheel" "docker" - "libvirtd" ]; openssh.authorizedKeys.keys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIWNsUQmppB6cQccXX1ZaBbFIcmM6RmghsTVbG9TgoZB ada@ada-x1" diff --git a/nixos/modules/firewall-mini-pc.nix b/nixos/modules/firewall-mini-pc.nix index 6953d9c..d4d71f8 100644 --- a/nixos/modules/firewall-mini-pc.nix +++ b/nixos/modules/firewall-mini-pc.nix @@ -2,13 +2,13 @@ networking.firewall = { enable = true; allowedTCPPorts = [ - 22 - 53 - 80 - 443 - 784 - 853 - 3001 + 22 # SSH + 53 # DNS (AdGuard) + 80 # HTTP + 443 # HTTPS + 784 # DNS-over-QUIC + 853 # DNS-over-TLS + 3001 # Uptime Kuma 3015 4438 5443 @@ -16,10 +16,10 @@ 10380 ]; allowedUDPPorts = [ - 53 - 443 - 784 - 9993 + 53 # DNS + 443 # QUIC + 784 # DNS-over-QUIC + 9993 # ZeroTier 5443 ]; }; diff --git a/nixos/modules/firewall.nix b/nixos/modules/firewall.nix index 80e7fae..d039930 100644 --- a/nixos/modules/firewall.nix +++ b/nixos/modules/firewall.nix @@ -2,24 +2,24 @@ networking.firewall = { enable = true; allowedTCPPorts = [ - 22 - 139 - 445 - 2222 + 22 # SSH + 139 # Samba (NetBIOS session) + 445 # Samba (SMB) + 2222 # Gitea SSH 3002 4567 - 5432 + 5432 # PostgreSQL 7080 8081 - 8384 - 22000 + 8384 # Syncthing web UI + 22000 # Syncthing data transfer ]; allowedUDPPorts = [ - 137 - 138 - 9993 - 21027 - 22000 + 137 # Samba (NetBIOS name) + 138 # Samba (NetBIOS datagram) + 9993 # ZeroTier + 21027 # Syncthing discovery + 22000 # Syncthing data transfer ]; }; } diff --git a/nixos/modules/libvirtd.nix b/nixos/modules/libvirtd.nix new file mode 100644 index 0000000..ec3338a --- /dev/null +++ b/nixos/modules/libvirtd.nix @@ -0,0 +1,10 @@ +{ pkgs, ... }: + +{ + virtualisation.libvirtd = { + enable = true; + qemu.package = pkgs.qemu_kvm; + }; + + users.users.ada.extraGroups = [ "libvirtd" ]; +}