From c7507b123f80929d1cad9dc08ffb547d991a635b Mon Sep 17 00:00:00 2001 From: sils Date: Tue, 7 Mar 2023 20:02:34 +0100 Subject: Fix: Try to fix ipv6 --- hosts/server1/networking.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'hosts/server1') diff --git a/hosts/server1/networking.nix b/hosts/server1/networking.nix index 26d6719..cc6d816 100644 --- a/hosts/server1/networking.nix +++ b/hosts/server1/networking.nix @@ -19,7 +19,7 @@ ]; ipv6.addresses = [ { - address = "2a03:4000:6a:3f3:6422:6dff:fe82:939b"; + address = "2a03:4000:6a:3f3::1"; prefixLength = 64; } { -- cgit 1.4.1 From 5a0cb28f369c104bb371974df876c8c705b0ee7e Mon Sep 17 00:00:00 2001 From: ene Date: Sat, 18 Mar 2023 16:21:45 +0100 Subject: Refactor: Use better file layout --- flake.nix | 27 +----------- hosts/server1/configuration.nix | 2 - hosts/server1/networking.nix | 1 - services/default.nix | 9 ---- services/services/acme.nix | 30 ------------- services/services/minecraft.nix | 26 ----------- services/services/nginx.nix | 15 ------- services/services/nix.nix | 18 -------- services/services/opensshd.nix | 18 -------- services/services/rust-motd.nix | 79 ---------------------------------- system/default.nix | 9 ++-- system/file_system_layouts/default.nix | 45 +++++++++++++++++++ system/hardware/default.nix | 9 ++++ system/mail/default.nix | 27 ++++++++++++ system/packages/default.nix | 9 ++++ system/services/acme/default.nix | 30 +++++++++++++ system/services/default.nix | 9 ++++ system/services/minecraft/default.nix | 26 +++++++++++ system/services/nginx/default.nix | 15 +++++++ system/services/nix/default.nix | 18 ++++++++ system/services/opensshd/default.nix | 18 ++++++++ system/services/rust-motd/default.nix | 79 ++++++++++++++++++++++++++++++++++ system/system/fileSystemLayouts.nix | 45 ------------------- system/system/hardware.nix | 9 ---- system/system/packages.nix | 9 ---- system/system/users.nix | 59 ------------------------- system/users/default.nix | 59 +++++++++++++++++++++++++ 27 files changed, 350 insertions(+), 350 deletions(-) delete mode 100644 services/default.nix delete mode 100644 services/services/acme.nix delete mode 100644 services/services/minecraft.nix delete mode 100644 services/services/nginx.nix delete mode 100644 services/services/nix.nix delete mode 100644 services/services/opensshd.nix delete mode 100644 services/services/rust-motd.nix create mode 100644 system/file_system_layouts/default.nix create mode 100644 system/hardware/default.nix create mode 100644 system/mail/default.nix create mode 100644 system/packages/default.nix create mode 100644 system/services/acme/default.nix create mode 100644 system/services/default.nix create mode 100644 system/services/minecraft/default.nix create mode 100644 system/services/nginx/default.nix create mode 100644 system/services/nix/default.nix create mode 100644 system/services/opensshd/default.nix create mode 100644 system/services/rust-motd/default.nix delete mode 100644 system/system/fileSystemLayouts.nix delete mode 100644 system/system/hardware.nix delete mode 100644 system/system/packages.nix delete mode 100644 system/system/users.nix create mode 100644 system/users/default.nix (limited to 'hosts/server1') diff --git a/flake.nix b/flake.nix index 554e168..36ae34e 100644 --- a/flake.nix +++ b/flake.nix @@ -20,32 +20,7 @@ ./hosts/server1/configuration.nix simple-nixos-mailserver.nixosModule { - mailserver = { - enable = true; - fqdn = "server1.vhack.eu"; - domains = ["vhack.eu"]; - - mailDirectory = "/srv/mail/vmail"; - dkimKeyDirectory = "/srv/mail/dkim"; - backup.snapshotRoot = "/srv/mail/backup"; - - loginAccounts = { - "sils@vhack.eu" = { - hashedPasswordFile = "/srv/mail/.secrets/silsmailpswd"; - }; - }; - - extraVirtualAliases = { - "abuse@vhack.eu" = ["sils@vhack.eu"]; - "postmaster@vhack.eu" = ["sils@vhack.eu"]; - "admin@vhack.eu" = ["sils@vhack.eu"]; - }; - - sieveDirectory = "/srv/mail/sieve"; - keyFile = "/var/lib/acme/server1.vhack.eu/key.pem"; - certificateScheme = 1; - certificateFile = "/var/lib/acme/server1.vhack.eu/fullchain.pem"; - }; + mailserver = import ./system/mail {}; } ]; }; diff --git a/hosts/server1/configuration.nix b/hosts/server1/configuration.nix index 729ef0f..694b6b4 100644 --- a/hosts/server1/configuration.nix +++ b/hosts/server1/configuration.nix @@ -3,8 +3,6 @@ ./networking.nix # network configuration that just works ../../system - - ../../services ]; boot.cleanTmpDir = true; diff --git a/hosts/server1/networking.nix b/hosts/server1/networking.nix index cc6d816..027bc27 100644 --- a/hosts/server1/networking.nix +++ b/hosts/server1/networking.nix @@ -44,6 +44,5 @@ }; services.udev.extraRules = '' ATTR{address}=="66:22:6d:82:93:9b", NAME="eth0" - ''; } diff --git a/services/default.nix b/services/default.nix deleted file mode 100644 index c301ba1..0000000 --- a/services/default.nix +++ /dev/null @@ -1,9 +0,0 @@ -{config, ...}: { - imports = [ - ./services/acme.nix - ./services/nginx.nix - ./services/nix.nix - ./services/opensshd.nix - ./services/rust-motd.nix - ]; -} diff --git a/services/services/acme.nix b/services/services/acme.nix deleted file mode 100644 index a163e77..0000000 --- a/services/services/acme.nix +++ /dev/null @@ -1,30 +0,0 @@ -{...}: { - users.users.nginx.extraGroups = ["acme"]; - - services.nginx = { - enable = true; - virtualHosts = { - "acmechallenge.vhack.eu" = { - serverAliases = ["*.vhack.eu"]; - locations."/.well-known/acme-challenge" = { - root = "/var/lib/acme/.challenges"; - }; - locations."/" = { - return = "301 https://$host$request_uri"; - }; - }; - }; - }; - - security.acme = { - acceptTerms = true; - defaults.email = "admin@vhack.eu"; - certs = { - "server1.vhack.eu" = { - webroot = "/var/lib/acme/.challenges"; - group = "nginx"; - extraDomainNames = ["imap.vhack.eu" "smtp.vhack.eu"]; - }; - }; - }; -} diff --git a/services/services/minecraft.nix b/services/services/minecraft.nix deleted file mode 100644 index 754c974..0000000 --- a/services/services/minecraft.nix +++ /dev/null @@ -1,26 +0,0 @@ -{ - config, - pkgs, - ... -}: { - users = { - groups.minecraft = {}; - users.minecraft = { - isSystemUser = true; - group = "minecraft"; - }; - }; - systemd.services.minecraft = { - wantedBy = ["multi-user.target"]; - after = "network.target"; - description = "Minecraft Server"; - serviceConfig = { - WorkingDirectory = "/srv/minecraft"; - User = "minecraft"; - Group = "minecraft"; - Restart = "always"; - ExecStart = "${pkgs.openjdk}/bin/java -Xms10G -Xmx10G -XX:+UseG1GC -XX:+ParallelRefProcEnabled -XX:MaxGCPauseMillis=200 -XX:+UnlockExperimentalVMOptions -XX:+DisableExplicitGC -XX:+AlwaysPreTouch -XX:G1NewSizePercent=30 -XX:G1MaxNewSizePercent=40 -XX:G1HeapRegionSize=8M -XX:G1ReservePercent=20 -XX:G1HeapWastePercent=5 -XX:G1MixedGCCountTarget=4 -XX:InitiatingHeapOccupancyPercent=15 -XX:G1MixedGCLiveThresholdPercent=90 -XX:G1RSetUpdatingPauseTimePercent=5 -XX:SurvivorRatio=32 -XX:+PerfDisableSharedMem -XX:MaxTenuringThreshold=1 -Dusing.aikars.flags=https://mcflags.emc.gs -Daikars.new.flags=true -jar paper.jar --nogui"; - SyslogIdentifier = "minecraft-server"; - }; - }; -} diff --git a/services/services/nginx.nix b/services/services/nginx.nix deleted file mode 100644 index 204783b..0000000 --- a/services/services/nginx.nix +++ /dev/null @@ -1,15 +0,0 @@ -{...}: { - networking.firewall = { - allowedTCPPorts = [80 443]; - }; - services.nginx = { - enable = true; - virtualHosts = { - "vhack.eu" = { - forceSSL = true; - enableACME = true; - root = "/srv/www/vhack.eu"; - }; - }; - }; -} diff --git a/services/services/nix.nix b/services/services/nix.nix deleted file mode 100644 index bd562ec..0000000 --- a/services/services/nix.nix +++ /dev/null @@ -1,18 +0,0 @@ -{ - config, - lib, - pkgs, - ... -}: { - nix = { - # gc = { - # automatic = true; - # dates = "daily"; - # options = "--delete-older-than 3"; - # }; - settings = { - auto-optimise-store = true; - experimental-features = ["nix-command" "flakes"]; - }; - }; -} diff --git a/services/services/opensshd.nix b/services/services/opensshd.nix deleted file mode 100644 index cb9f2ba..0000000 --- a/services/services/opensshd.nix +++ /dev/null @@ -1,18 +0,0 @@ -{ - config, - pkg, - ... -}: { - services.openssh = { - enable = true; - passwordAuthentication = false; - hostKeys = [ - { - comment = "key comment"; - path = "/srv/sshd/ssh_host_ed25519_key"; - rounds = 1000; - type = "ed25519"; - } - ]; - }; -} diff --git a/services/services/rust-motd.nix b/services/services/rust-motd.nix deleted file mode 100644 index 21bc1cd..0000000 --- a/services/services/rust-motd.nix +++ /dev/null @@ -1,79 +0,0 @@ -{ - config, - pkgs, - ... -}: { - programs.rust-motd = { - enable = true; - enableMotdInSSHD = true; - refreshInterval = "*:0/5"; # 0/5 means: hour 0 AND all hour wich match (0 + 5 * x) (is the same as: 0, 5, 10, 15, 20) - settings = { - global = { - progress_full_character = "="; - progress_empty_character = "-"; - progress_prefix = "["; - progress_suffix = "]"; - time_format = "%Y-%m-%d %H:%M:%S"; - }; - - banner = { - color = "red"; - command = "${pkgs.hostname}/bin/hostname | ${pkgs.figlet}/bin/figlet -f slant"; - # if you don't want a dependency on figlet, you can generate your - # banner however you want, put it in a file, and then use something like: - # command = "cat banner.txt" - }; - - # [weather] - # url = "https://wttr.in/New+York,New+York?0" - # proxy = "http://proxy:8080" - - # [service_status] - # Accounts = "accounts-daemon" - # Cron = "cron" - - # [docker_status] - # Local containers MUST start with a slash - # https://github.com/moby/moby/issues/6705 - #"/nextcloud-nextcloud-1" = "Nextcloud" - #"/nextcloud-nextcloud-mariadb-1" = "Nextcloud Database" - - uptime = { - prefix = "Uptime:"; - }; - - # [user_service_status] - # gpg-agent = "gpg-agent" - - #s_s_l_certs = { - # sort_method = "manual" - # - # certs = { - # CertName1 = "/path/to/cert1.pem" - # CertName2 = "/path/to/cert2.pem" - # } - #}; - - filesystems = { - root = "/"; - }; - - memory = { - swap_pos = "beside"; # or "below" or "none" - }; - - fail2_ban = { - jails = ["sshd"]; #, "anotherjail"] - }; - - last_login = { - sils = 2; - soispha = 2; - nightingale = 2; - }; - - last_run = { - }; - }; - }; -} diff --git a/system/default.nix b/system/default.nix index 2af4982..9aa5d9e 100644 --- a/system/default.nix +++ b/system/default.nix @@ -1,8 +1,9 @@ {config, ...}: { imports = [ - ./system/fileSystemLayouts.nix - ./system/hardware.nix - ./system/packages.nix - ./system/users.nix + ./file_system_layouts + ./hardware + ./packages + ./services + ./users ]; } diff --git a/system/file_system_layouts/default.nix b/system/file_system_layouts/default.nix new file mode 100644 index 0000000..9d03a05 --- /dev/null +++ b/system/file_system_layouts/default.nix @@ -0,0 +1,45 @@ +{ + modulesPath, + config, + lib, + ... +}: +with lib; let + cfg = config.system.fileSystemLayouts; +in { + options.system.fileSystemLayouts = { + mainDisk = mkOption { + type = lib.types.path; + example = literalExpression "/dev/disk/by-uuid/0442cb6d-f13a-4635-b487-fa76189774c5"; + description = lib.mdDoc "Path to the main disk"; + }; + }; + config = { + fileSystems = { + "/" = { + device = "tmpfs"; + fsType = "tmpfs"; + options = ["defaults" "size=2G" "mode=755"]; + }; + "/nix" = { + device = cfg.mainDisk; + fsType = "btrfs"; + options = ["subvol=nix" "compress-force=zstd"]; + }; + "/srv" = { + device = cfg.mainDisk; + fsType = "btrfs"; + options = ["subvol=storage" "compress-force=zstd"]; + }; + "/boot" = { + device = cfg.mainDisk; + options = ["subvol=boot" "compress-force=zstd"]; + }; + + "/etc/nixos" = { + device = "/srv/nix-config"; + options = ["bind"]; + }; + }; + }; +} diff --git a/system/hardware/default.nix b/system/hardware/default.nix new file mode 100644 index 0000000..c4c7dc9 --- /dev/null +++ b/system/hardware/default.nix @@ -0,0 +1,9 @@ +{modulesPath, ...}: { + imports = [ + (modulesPath + "/profiles/qemu-guest.nix") + (modulesPath + "/profiles/headless.nix") + ]; + boot.loader.grub.device = "/dev/vda"; + boot.initrd.availableKernelModules = ["ata_piix" "uhci_hcd" "xen_blkfront" "vmw_pvscsi"]; + boot.initrd.kernelModules = ["nvme" "btrfs"]; +} diff --git a/system/mail/default.nix b/system/mail/default.nix new file mode 100644 index 0000000..b09f8f1 --- /dev/null +++ b/system/mail/default.nix @@ -0,0 +1,27 @@ +# vim: ts=2 +{...}: { + enable = true; + fqdn = "server1.vhack.eu"; + domains = ["vhack.eu"]; + + mailDirectory = "/srv/mail/vmail"; + dkimKeyDirectory = "/srv/mail/dkim"; + backup.snapshotRoot = "/srv/mail/backup"; + + loginAccounts = { + "sils@vhack.eu" = { + hashedPasswordFile = "/srv/mail/.secrets/silsmailpswd"; + }; + }; + + extraVirtualAliases = { + "abuse@vhack.eu" = ["sils@vhack.eu"]; + "postmaster@vhack.eu" = ["sils@vhack.eu"]; + "admin@vhack.eu" = ["sils@vhack.eu"]; + }; + + sieveDirectory = "/srv/mail/sieve"; + keyFile = "/var/lib/acme/server1.vhack.eu/key.pem"; + certificateScheme = 1; + certificateFile = "/var/lib/acme/server1.vhack.eu/fullchain.pem"; +} diff --git a/system/packages/default.nix b/system/packages/default.nix new file mode 100644 index 0000000..4d33c6e --- /dev/null +++ b/system/packages/default.nix @@ -0,0 +1,9 @@ +{pkgs, ...}: { + environment.systemPackages = with pkgs; [ + jre_minimal + git + zsh + neovim + btrfs-progs + ]; +} diff --git a/system/services/acme/default.nix b/system/services/acme/default.nix new file mode 100644 index 0000000..a163e77 --- /dev/null +++ b/system/services/acme/default.nix @@ -0,0 +1,30 @@ +{...}: { + users.users.nginx.extraGroups = ["acme"]; + + services.nginx = { + enable = true; + virtualHosts = { + "acmechallenge.vhack.eu" = { + serverAliases = ["*.vhack.eu"]; + locations."/.well-known/acme-challenge" = { + root = "/var/lib/acme/.challenges"; + }; + locations."/" = { + return = "301 https://$host$request_uri"; + }; + }; + }; + }; + + security.acme = { + acceptTerms = true; + defaults.email = "admin@vhack.eu"; + certs = { + "server1.vhack.eu" = { + webroot = "/var/lib/acme/.challenges"; + group = "nginx"; + extraDomainNames = ["imap.vhack.eu" "smtp.vhack.eu"]; + }; + }; + }; +} diff --git a/system/services/default.nix b/system/services/default.nix new file mode 100644 index 0000000..acf20f5 --- /dev/null +++ b/system/services/default.nix @@ -0,0 +1,9 @@ +{config, ...}: { + imports = [ + ./acme + ./nginx + ./nix + ./opensshd + ./rust-motd + ]; +} diff --git a/system/services/minecraft/default.nix b/system/services/minecraft/default.nix new file mode 100644 index 0000000..754c974 --- /dev/null +++ b/system/services/minecraft/default.nix @@ -0,0 +1,26 @@ +{ + config, + pkgs, + ... +}: { + users = { + groups.minecraft = {}; + users.minecraft = { + isSystemUser = true; + group = "minecraft"; + }; + }; + systemd.services.minecraft = { + wantedBy = ["multi-user.target"]; + after = "network.target"; + description = "Minecraft Server"; + serviceConfig = { + WorkingDirectory = "/srv/minecraft"; + User = "minecraft"; + Group = "minecraft"; + Restart = "always"; + ExecStart = "${pkgs.openjdk}/bin/java -Xms10G -Xmx10G -XX:+UseG1GC -XX:+ParallelRefProcEnabled -XX:MaxGCPauseMillis=200 -XX:+UnlockExperimentalVMOptions -XX:+DisableExplicitGC -XX:+AlwaysPreTouch -XX:G1NewSizePercent=30 -XX:G1MaxNewSizePercent=40 -XX:G1HeapRegionSize=8M -XX:G1ReservePercent=20 -XX:G1HeapWastePercent=5 -XX:G1MixedGCCountTarget=4 -XX:InitiatingHeapOccupancyPercent=15 -XX:G1MixedGCLiveThresholdPercent=90 -XX:G1RSetUpdatingPauseTimePercent=5 -XX:SurvivorRatio=32 -XX:+PerfDisableSharedMem -XX:MaxTenuringThreshold=1 -Dusing.aikars.flags=https://mcflags.emc.gs -Daikars.new.flags=true -jar paper.jar --nogui"; + SyslogIdentifier = "minecraft-server"; + }; + }; +} diff --git a/system/services/nginx/default.nix b/system/services/nginx/default.nix new file mode 100644 index 0000000..204783b --- /dev/null +++ b/system/services/nginx/default.nix @@ -0,0 +1,15 @@ +{...}: { + networking.firewall = { + allowedTCPPorts = [80 443]; + }; + services.nginx = { + enable = true; + virtualHosts = { + "vhack.eu" = { + forceSSL = true; + enableACME = true; + root = "/srv/www/vhack.eu"; + }; + }; + }; +} diff --git a/system/services/nix/default.nix b/system/services/nix/default.nix new file mode 100644 index 0000000..bd562ec --- /dev/null +++ b/system/services/nix/default.nix @@ -0,0 +1,18 @@ +{ + config, + lib, + pkgs, + ... +}: { + nix = { + # gc = { + # automatic = true; + # dates = "daily"; + # options = "--delete-older-than 3"; + # }; + settings = { + auto-optimise-store = true; + experimental-features = ["nix-command" "flakes"]; + }; + }; +} diff --git a/system/services/opensshd/default.nix b/system/services/opensshd/default.nix new file mode 100644 index 0000000..cb9f2ba --- /dev/null +++ b/system/services/opensshd/default.nix @@ -0,0 +1,18 @@ +{ + config, + pkg, + ... +}: { + services.openssh = { + enable = true; + passwordAuthentication = false; + hostKeys = [ + { + comment = "key comment"; + path = "/srv/sshd/ssh_host_ed25519_key"; + rounds = 1000; + type = "ed25519"; + } + ]; + }; +} diff --git a/system/services/rust-motd/default.nix b/system/services/rust-motd/default.nix new file mode 100644 index 0000000..21bc1cd --- /dev/null +++ b/system/services/rust-motd/default.nix @@ -0,0 +1,79 @@ +{ + config, + pkgs, + ... +}: { + programs.rust-motd = { + enable = true; + enableMotdInSSHD = true; + refreshInterval = "*:0/5"; # 0/5 means: hour 0 AND all hour wich match (0 + 5 * x) (is the same as: 0, 5, 10, 15, 20) + settings = { + global = { + progress_full_character = "="; + progress_empty_character = "-"; + progress_prefix = "["; + progress_suffix = "]"; + time_format = "%Y-%m-%d %H:%M:%S"; + }; + + banner = { + color = "red"; + command = "${pkgs.hostname}/bin/hostname | ${pkgs.figlet}/bin/figlet -f slant"; + # if you don't want a dependency on figlet, you can generate your + # banner however you want, put it in a file, and then use something like: + # command = "cat banner.txt" + }; + + # [weather] + # url = "https://wttr.in/New+York,New+York?0" + # proxy = "http://proxy:8080" + + # [service_status] + # Accounts = "accounts-daemon" + # Cron = "cron" + + # [docker_status] + # Local containers MUST start with a slash + # https://github.com/moby/moby/issues/6705 + #"/nextcloud-nextcloud-1" = "Nextcloud" + #"/nextcloud-nextcloud-mariadb-1" = "Nextcloud Database" + + uptime = { + prefix = "Uptime:"; + }; + + # [user_service_status] + # gpg-agent = "gpg-agent" + + #s_s_l_certs = { + # sort_method = "manual" + # + # certs = { + # CertName1 = "/path/to/cert1.pem" + # CertName2 = "/path/to/cert2.pem" + # } + #}; + + filesystems = { + root = "/"; + }; + + memory = { + swap_pos = "beside"; # or "below" or "none" + }; + + fail2_ban = { + jails = ["sshd"]; #, "anotherjail"] + }; + + last_login = { + sils = 2; + soispha = 2; + nightingale = 2; + }; + + last_run = { + }; + }; + }; +} diff --git a/system/system/fileSystemLayouts.nix b/system/system/fileSystemLayouts.nix deleted file mode 100644 index 9d03a05..0000000 --- a/system/system/fileSystemLayouts.nix +++ /dev/null @@ -1,45 +0,0 @@ -{ - modulesPath, - config, - lib, - ... -}: -with lib; let - cfg = config.system.fileSystemLayouts; -in { - options.system.fileSystemLayouts = { - mainDisk = mkOption { - type = lib.types.path; - example = literalExpression "/dev/disk/by-uuid/0442cb6d-f13a-4635-b487-fa76189774c5"; - description = lib.mdDoc "Path to the main disk"; - }; - }; - config = { - fileSystems = { - "/" = { - device = "tmpfs"; - fsType = "tmpfs"; - options = ["defaults" "size=2G" "mode=755"]; - }; - "/nix" = { - device = cfg.mainDisk; - fsType = "btrfs"; - options = ["subvol=nix" "compress-force=zstd"]; - }; - "/srv" = { - device = cfg.mainDisk; - fsType = "btrfs"; - options = ["subvol=storage" "compress-force=zstd"]; - }; - "/boot" = { - device = cfg.mainDisk; - options = ["subvol=boot" "compress-force=zstd"]; - }; - - "/etc/nixos" = { - device = "/srv/nix-config"; - options = ["bind"]; - }; - }; - }; -} diff --git a/system/system/hardware.nix b/system/system/hardware.nix deleted file mode 100644 index c4c7dc9..0000000 --- a/system/system/hardware.nix +++ /dev/null @@ -1,9 +0,0 @@ -{modulesPath, ...}: { - imports = [ - (modulesPath + "/profiles/qemu-guest.nix") - (modulesPath + "/profiles/headless.nix") - ]; - boot.loader.grub.device = "/dev/vda"; - boot.initrd.availableKernelModules = ["ata_piix" "uhci_hcd" "xen_blkfront" "vmw_pvscsi"]; - boot.initrd.kernelModules = ["nvme" "btrfs"]; -} diff --git a/system/system/packages.nix b/system/system/packages.nix deleted file mode 100644 index 4d33c6e..0000000 --- a/system/system/packages.nix +++ /dev/null @@ -1,9 +0,0 @@ -{pkgs, ...}: { - environment.systemPackages = with pkgs; [ - jre_minimal - git - zsh - neovim - btrfs-progs - ]; -} diff --git a/system/system/users.nix b/system/system/users.nix deleted file mode 100644 index 34e1648..0000000 --- a/system/system/users.nix +++ /dev/null @@ -1,59 +0,0 @@ -{pkgs, ...}: { - users.mutableUsers = false; - users.defaultUserShell = pkgs.zsh; - - users.users = { - root = { - #uid = 0; - #initialHashedPassword = null; # to lock root - # Backup, if something happens. TODO remove this later - openssh.authorizedKeys.keys = [ - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIG63gxw8JePmrC8Fni0pLV4TnPBhCPmSV9FYEdva+6s7 sils" - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGBFuTNNn71Rhfnop2cdz3r/RhWWlCePnSBOhTBbu2ME soispha" - ]; - }; - - sils = { - name = "sils"; - isNormalUser = true; - home = "/srv/home/sils"; - initialHashedPassword = "$y$jFT$KpFnahVCE9JbE.5P3us8o.$ZzSxCusWqe3sL7b6DLgOXNNUf114tiiptM6T8lDxtKC"; # TODO CHANGE - uid = 1000; - extraGroups = [ - "wheel" - ]; - openssh.authorizedKeys.keys = [ - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIG63gxw8JePmrC8Fni0pLV4TnPBhCPmSV9FYEdva+6s7 sils" - ]; - }; - - soispha = { - name = "soispha"; - isNormalUser = true; - home = "/srv/home/soispha"; - initialHashedPassword = "$y$jFT$3.8XmUyukZvpExMUxDZkI.$IVrJgm8ysNDF/0vDD2kF6w73ozXgr1LMVRNN4Bq7pv1"; - uid = 1001; - extraGroups = [ - "wheel" - ]; - openssh.authorizedKeys.keys = [ - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGBFuTNNn71Rhfnop2cdz3r/RhWWlCePnSBOhTBbu2ME soispha" - ]; - }; - - nightingale = { - name = "nightingale"; - isNormalUser = true; - home = "/srv/home/nightingale"; - initialHashedPassword = null; # TODO CHANGE - uid = 1002; - extraGroups = [ - "wheel" - ]; - openssh.authorizedKeys.keys = [ - ]; - }; - }; -} -# vim: ts=2 - diff --git a/system/users/default.nix b/system/users/default.nix new file mode 100644 index 0000000..34e1648 --- /dev/null +++ b/system/users/default.nix @@ -0,0 +1,59 @@ +{pkgs, ...}: { + users.mutableUsers = false; + users.defaultUserShell = pkgs.zsh; + + users.users = { + root = { + #uid = 0; + #initialHashedPassword = null; # to lock root + # Backup, if something happens. TODO remove this later + openssh.authorizedKeys.keys = [ + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIG63gxw8JePmrC8Fni0pLV4TnPBhCPmSV9FYEdva+6s7 sils" + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGBFuTNNn71Rhfnop2cdz3r/RhWWlCePnSBOhTBbu2ME soispha" + ]; + }; + + sils = { + name = "sils"; + isNormalUser = true; + home = "/srv/home/sils"; + initialHashedPassword = "$y$jFT$KpFnahVCE9JbE.5P3us8o.$ZzSxCusWqe3sL7b6DLgOXNNUf114tiiptM6T8lDxtKC"; # TODO CHANGE + uid = 1000; + extraGroups = [ + "wheel" + ]; + openssh.authorizedKeys.keys = [ + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIG63gxw8JePmrC8Fni0pLV4TnPBhCPmSV9FYEdva+6s7 sils" + ]; + }; + + soispha = { + name = "soispha"; + isNormalUser = true; + home = "/srv/home/soispha"; + initialHashedPassword = "$y$jFT$3.8XmUyukZvpExMUxDZkI.$IVrJgm8ysNDF/0vDD2kF6w73ozXgr1LMVRNN4Bq7pv1"; + uid = 1001; + extraGroups = [ + "wheel" + ]; + openssh.authorizedKeys.keys = [ + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGBFuTNNn71Rhfnop2cdz3r/RhWWlCePnSBOhTBbu2ME soispha" + ]; + }; + + nightingale = { + name = "nightingale"; + isNormalUser = true; + home = "/srv/home/nightingale"; + initialHashedPassword = null; # TODO CHANGE + uid = 1002; + extraGroups = [ + "wheel" + ]; + openssh.authorizedKeys.keys = [ + ]; + }; + }; +} +# vim: ts=2 + -- cgit 1.4.1 From 7881651fba877dd9a79c4c32422cd7305f0306b5 Mon Sep 17 00:00:00 2001 From: ene Date: Sun, 19 Mar 2023 17:58:43 +0100 Subject: Fix(system/hardware): Use actually needed modules and UUID The old values did work, but these should just make things a bit clearer. --- hosts/server1/configuration.nix | 2 +- system/hardware/default.nix | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) (limited to 'hosts/server1') diff --git a/hosts/server1/configuration.nix b/hosts/server1/configuration.nix index 694b6b4..ad3d8a3 100644 --- a/hosts/server1/configuration.nix +++ b/hosts/server1/configuration.nix @@ -10,7 +10,7 @@ networking.hostName = "server1"; networking.domain = "vhack.eu"; - system.fileSystemLayouts.mainDisk = "/dev/vda3"; + system.fileSystemLayouts.mainDisk = "/dev/disk/by-uuid/7d960eb9-9334-4aef-9f7c-9a908a91a6db"; system.stateVersion = "22.11"; } diff --git a/system/hardware/default.nix b/system/hardware/default.nix index c4c7dc9..9fabafe 100644 --- a/system/hardware/default.nix +++ b/system/hardware/default.nix @@ -4,6 +4,6 @@ (modulesPath + "/profiles/headless.nix") ]; boot.loader.grub.device = "/dev/vda"; - boot.initrd.availableKernelModules = ["ata_piix" "uhci_hcd" "xen_blkfront" "vmw_pvscsi"]; - boot.initrd.kernelModules = ["nvme" "btrfs"]; + boot.initrd.availableKernelModules = ["ata_piix" "uhci_hcd" "virtio_pci" "sr_mod" "virtio_blk"]; + boot.initrd.kernelModules = []; } -- cgit 1.4.1 From 0b55d0277cd341eed9532677036e885c0ae038ed Mon Sep 17 00:00:00 2001 From: ene Date: Sun, 19 Mar 2023 18:01:16 +0100 Subject: Refactor(system/hardware): Move hardware to host The hardware settings are (somewhat) host specific, and putting them in `system` just builds the wrong expectations. --- hosts/server1/configuration.nix | 1 + hosts/server1/hardware.nix | 9 +++++++++ system/default.nix | 1 - system/hardware/default.nix | 9 --------- 4 files changed, 10 insertions(+), 10 deletions(-) create mode 100644 hosts/server1/hardware.nix delete mode 100644 system/hardware/default.nix (limited to 'hosts/server1') diff --git a/hosts/server1/configuration.nix b/hosts/server1/configuration.nix index ad3d8a3..891c5dc 100644 --- a/hosts/server1/configuration.nix +++ b/hosts/server1/configuration.nix @@ -1,6 +1,7 @@ {pkgs, ...}: { imports = [ ./networking.nix # network configuration that just works + ./hardware.nix ../../system ]; diff --git a/hosts/server1/hardware.nix b/hosts/server1/hardware.nix new file mode 100644 index 0000000..9fabafe --- /dev/null +++ b/hosts/server1/hardware.nix @@ -0,0 +1,9 @@ +{modulesPath, ...}: { + imports = [ + (modulesPath + "/profiles/qemu-guest.nix") + (modulesPath + "/profiles/headless.nix") + ]; + boot.loader.grub.device = "/dev/vda"; + boot.initrd.availableKernelModules = ["ata_piix" "uhci_hcd" "virtio_pci" "sr_mod" "virtio_blk"]; + boot.initrd.kernelModules = []; +} diff --git a/system/default.nix b/system/default.nix index 9aa5d9e..d67ada2 100644 --- a/system/default.nix +++ b/system/default.nix @@ -1,7 +1,6 @@ {config, ...}: { imports = [ ./file_system_layouts - ./hardware ./packages ./services ./users diff --git a/system/hardware/default.nix b/system/hardware/default.nix deleted file mode 100644 index 9fabafe..0000000 --- a/system/hardware/default.nix +++ /dev/null @@ -1,9 +0,0 @@ -{modulesPath, ...}: { - imports = [ - (modulesPath + "/profiles/qemu-guest.nix") - (modulesPath + "/profiles/headless.nix") - ]; - boot.loader.grub.device = "/dev/vda"; - boot.initrd.availableKernelModules = ["ata_piix" "uhci_hcd" "virtio_pci" "sr_mod" "virtio_blk"]; - boot.initrd.kernelModules = []; -} -- cgit 1.4.1 From 8711fb2f30e59e21a31e3d4b7634dc66ef5c5917 Mon Sep 17 00:00:00 2001 From: ene Date: Sun, 19 Mar 2023 18:42:33 +0100 Subject: Fix(hosts/server1/networking): Remove ipv6 route This is somewhat misconfigured, as it makes to config not compilable. I assume, that this route setting is needed, but believe, that having a compiling config is better. --- hosts/server1/networking.nix | 4 ---- 1 file changed, 4 deletions(-) (limited to 'hosts/server1') diff --git a/hosts/server1/networking.nix b/hosts/server1/networking.nix index 027bc27..ff83f52 100644 --- a/hosts/server1/networking.nix +++ b/hosts/server1/networking.nix @@ -34,10 +34,6 @@ } ]; ipv6.routes = [ - { - address = "fe80::1"; - prefixLength = 128; - } ]; }; }; -- cgit 1.4.1 From 25055f0921b0aed08e2d111fa295e0244fa44627 Mon Sep 17 00:00:00 2001 From: ene Date: Sun, 19 Mar 2023 19:20:12 +0100 Subject: Revert "Fix(hosts/server1/networking): Remove ipv6 route" The commit didn't work and effectively disabled ipv6 --- hosts/server1/networking.nix | 4 ++++ 1 file changed, 4 insertions(+) (limited to 'hosts/server1') diff --git a/hosts/server1/networking.nix b/hosts/server1/networking.nix index ff83f52..027bc27 100644 --- a/hosts/server1/networking.nix +++ b/hosts/server1/networking.nix @@ -34,6 +34,10 @@ } ]; ipv6.routes = [ + { + address = "fe80::1"; + prefixLength = 128; + } ]; }; }; -- cgit 1.4.1 From 7937ec74503243bb3e2782bc61b3aa61eacc6842 Mon Sep 17 00:00:00 2001 From: ene Date: Sun, 19 Mar 2023 20:16:17 +0100 Subject: Fix(hosts/server1/networking): Fix Gateways Assigning a specific interface for a gateway should make it easier for nixos to configure it. --- hosts/server1/networking.nix | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) (limited to 'hosts/server1') diff --git a/hosts/server1/networking.nix b/hosts/server1/networking.nix index 26d6719..dd86494 100644 --- a/hosts/server1/networking.nix +++ b/hosts/server1/networking.nix @@ -5,8 +5,14 @@ nameservers = [ "8.8.8.8" ]; - defaultGateway = "89.58.56.1"; - defaultGateway6 = "fe80::1"; + defaultGateway = { + address = "89.58.56.1"; + interface = "eth0"; + }; + defaultGateway6 = { + address = "fe80::1"; + interface = "eth0"; + }; dhcpcd.enable = false; usePredictableInterfaceNames = lib.mkForce false; interfaces = { -- cgit 1.4.1 From 9243e3d00215aff3abb47e6b868ebee2eb14c0ed Mon Sep 17 00:00:00 2001 From: ene Date: Sun, 19 Mar 2023 20:17:34 +0100 Subject: Fix(hosts/server1/networking): Correct ipv6 The used ips were straight up wrong. --- hosts/server1/networking.nix | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) (limited to 'hosts/server1') diff --git a/hosts/server1/networking.nix b/hosts/server1/networking.nix index dd86494..d3c5422 100644 --- a/hosts/server1/networking.nix +++ b/hosts/server1/networking.nix @@ -25,11 +25,7 @@ ]; ipv6.addresses = [ { - address = "2a03:4000:6a:3f3:6422:6dff:fe82:939b"; - prefixLength = 64; - } - { - address = "fe80::6422:6dff:fe82:939b"; + address = "2a03:4000:6a:3f3::1"; prefixLength = 64; } ]; -- cgit 1.4.1