commit 7a31cdd170e8c47052ab0a20848ef3cbfd22e745 · nekomimi.pet/nixcfg

+74 -41

hosts/buer/default.nix

···

       1
       -
       # hosts/valefar/configuration.nix (or default.nix)

     

       2
        
       { config, lib, pkgs, modulesPath, inputs, ... }:

     

       3
       -
       

     

       4
        
       {

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       5
        
         imports = [

     

       6
        
           # Host-specific hardware

     

       7
        
           ./hardware.nix

     
···

       12
        
           ../../common/users.nix

     

       13
        
           ../../common/services.nix

     

       14
        
           

     

       15
       -
       

     

       16
        
           # Common secrets

     

       17
        
           ../../host-secrets.nix

     

       18
        
         ];

     

       19
        
       

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       20
        
         system.stateVersion = "24.11";

     

       21
       -
         modules.garage.enable = true;

     

       22
       -
       

     

       23
       -
         # pin host platform & microcode

     

       24
       -
         nixpkgs.hostPlatform               = lib.mkDefault "x86_64-linux";

     

       25
        
         hardware.cpu.intel.updateMicrocode = lib.mkDefault

     

       26
        
           config.hardware.enableRedistributableFirmware;

     

       27
        
       

     

       28
       -
         boot.loader.grub.enable = true;

     

       29
       -
         boot.loader.grub.device = "/dev/vda";

     

       0
        
       
     

       0
        
       
     

       30
        
       

     

       31
       -
         networking.hostName = "buer";

     

       32
       -
         networking.hostId = "1418d29e";

     

       33
       -
         networking.firewall.enable = false;

     

       34
       -
         networking.useDHCP = false;

     

       35
       -
         systemd.network.enable = true;

     

       36
       -
         systemd.network.networks."10-wan" = {

     

       37
       -
           matchConfig.Name = "ens3";

     

       38
       -
           address = [

     

       39
       -
             "103.251.165.107/24"

     

       40
       -
             "2a04:52c0:0135:48d1::2/48"

     

       41
       -
           ];

     

       42
       -
           gateway = [

     

       43
       -
             "103.251.165.1"

     

       44
       -
             "2a04:52c0:0135::1"

     

       45
       -
           ];

     

       46
       -
           dns = [

     

       47
       -
             "2a01:6340:1:20:4::10"

     

       48
       -
             "2a04:52c0:130:2a5c::10"

     

       49
       -
             "185.31.172.240"

     

       50
       -
             "5.255.125.240"

     

       51
       -
           ];

     

       52
        
         };

     

       53
       -
         

     

       54
       -
         #boot.supportedFilesystems = [ "zfs" ];

     

       55
       -
         #boot.kernelModules = [ "nct6775" "coretemp" ];

     

       56
        
       

     

       57
       -
         #services.zfs.autoScrub.enable = true;

     

       58
       -
         #services.zfs.trim.enable = true;

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       59
        
       

     

       60
       -
         environment.systemPackages = with pkgs; [

     

       61
       -
           #lm_sensors

     

       62
       -
           #code-server

     

       63
       -
           inputs.agenix.packages.x86_64-linux.default

     

       64
       -
         ];

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       65
        
       

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       66
        
         virtualisation.docker = {

     

       67
        
           enable = true;

     

       68
        
           enableOnBoot = true;

     
···

       70
        
             buildGoModule = pkgs.buildGo123Module;

     

       71
        
           };

     

       72
        
         };

     

       73
       -
       }

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0

···

       1
       +
       # hosts/buer/configuration.nix (or default.nix)

     

       2
        
       { config, lib, pkgs, modulesPath, inputs, ... }:

     

       0
        
       
     

       3
        
       {

     

       4
       +
         # =============================================================================

     

       5
       +
         # IMPORTS

     

       6
       +
         # =============================================================================

     

       7
        
         imports = [

     

       8
        
           # Host-specific hardware

     

       9
        
           ./hardware.nix

     
···

       14
        
           ../../common/users.nix

     

       15
        
           ../../common/services.nix

     

       16
        
           

     

       0
        
       
     

       17
        
           # Common secrets

     

       18
        
           ../../host-secrets.nix

     

       19
        
         ];

     

       20
        
       

     

       21
       +
         # =============================================================================

     

       22
       +
         # SYSTEM CONFIGURATION

     

       23
       +
         # =============================================================================

     

       24
        
         system.stateVersion = "24.11";

     

       25
       +
         nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";

     

       26
       +
         

     

       27
       +
         # Intel microcode updates

     

       0
        
       
     

       28
        
         hardware.cpu.intel.updateMicrocode = lib.mkDefault

     

       29
        
           config.hardware.enableRedistributableFirmware;

     

       30
        
       

     

       31
       +
         # =============================================================================

     

       32
       +
         # CUSTOM MODULES

     

       33
       +
         # =============================================================================

     

       34
       +
         modules.garage.enable = true;

     

       35
        
       

     

       36
       +
         # =============================================================================

     

       37
       +
         # BOOT CONFIGURATION

     

       38
       +
         # =============================================================================

     

       39
       +
         boot.loader.grub = {

     

       40
       +
           enable = true;

     

       41
       +
           device = "/dev/vda";

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       42
        
         };

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       43
        
       

     

       44
       +
         # =============================================================================

     

       45
       +
         # NETWORKING

     

       46
       +
         # =============================================================================

     

       47
       +
         networking = {

     

       48
       +
           hostName = "buer";

     

       49
       +
           hostId = "1418d29e";

     

       50
       +
           firewall.enable = false;

     

       51
       +
           useDHCP = false;

     

       52
       +
         };

     

       53
        
       

     

       54
       +
         # Static IP configuration via systemd-networkd

     

       55
       +
         systemd.network = {

     

       56
       +
           enable = true;

     

       57
       +
           networks."10-wan" = {

     

       58
       +
             matchConfig.Name = "ens3";

     

       59
       +
             address = [

     

       60
       +
               "103.251.165.107/24"

     

       61
       +
               "2a04:52c0:0135:48d1::2/48"

     

       62
       +
             ];

     

       63
       +
             gateway = [

     

       64
       +
               "103.251.165.1"

     

       65
       +
               "2a04:52c0:0135::1"

     

       66
       +
             ];

     

       67
       +
             dns = [

     

       68
       +
               "2a01:6340:1:20:4::10"

     

       69
       +
               "2a04:52c0:130:2a5c::10"

     

       70
       +
               "185.31.172.240"

     

       71
       +
               "5.255.125.240"

     

       72
       +
             ];

     

       73
       +
           };

     

       74
       +
         };

     

       75
        
       

     

       76
       +
         # =============================================================================

     

       77
       +
         # VIRTUALIZATION

     

       78
       +
         # =============================================================================

     

       79
        
         virtualisation.docker = {

     

       80
        
           enable = true;

     

       81
        
           enableOnBoot = true;

     
···

       83
        
             buildGoModule = pkgs.buildGo123Module;

     

       84
        
           };

     

       85
        
         };

     

       86
       +
       

     

       87
       +
         # =============================================================================

     

       88
       +
         # PACKAGES

     

       89
       +
         # =============================================================================

     

       90
       +
         environment.systemPackages = with pkgs; [

     

       91
       +
           inputs.agenix.packages.x86_64-linux.default

     

       92
       +
         ];

     

       93
       +
       

     

       94
       +
         # =============================================================================

     

       95
       +
         # COMMENTED OUT / DISABLED

     

       96
       +
         # =============================================================================

     

       97
       +
         # ZFS support (not needed for this VPS)

     

       98
       +
         # boot.supportedFilesystems = [ "zfs" ];

     

       99
       +
         # boot.kernelModules = [ "nct6775" "coretemp" ];

     

       100
       +
         # services.zfs.autoScrub.enable = true;

     

       101
       +
         # services.zfs.trim.enable = true;

     

       102
       +
         

     

       103
       +
         # Additional packages (not needed)

     

       104
       +
         # lm_sensors

     

       105
       +
         # code-server

     

       106
       +
       }

+89 -45

hosts/focalor/default.nix

···

       1
       -
       # hosts/valefar/configuration.nix (or default.nix)

     

       2
        
       { config, lib, system, pkgs, modulesPath, inputs, ... }:

     

       3
       -
       

     

       4
        
       {

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       5
        
         imports = [

     

       6
        
           # Host-specific hardware

     

       7
        
           ./hardware.nix

     
···

       14
        
           ../../common/services.nix

     

       15
        
           ../../common/efi.nix

     

       16
        
           ../../common/bluetooth.nix

     

       17
       -
       

     

       18
        
           # Desktop modules

     

       19
        
           ../../common/desktop/core.nix

     

       20
        
           ../../common/desktop/sway.nix

     

       21
        
           ../../common/desktop/vnc.nix

     

       22
       -
       

     

       23
       -
           # Nvidia

     

       24
        
           ../../common/nvidia.nix

     

       25
        
           

     

       26
       -
           # Common secrets

     

       27
       -
           #../../host-secrets.nix

     

       28
        
         ];

     

       29
        
       

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       30
        
         system.stateVersion = "25.05";

     

       31
       -
       

     

       32
       -
         # pin host platform & microcode

     

       33
       -
         nixpkgs.hostPlatform               = lib.mkDefault "x86_64-linux";

     

       34
       -
       

     

       35
        
         boot.binfmt.emulatedSystems = [ "aarch64-linux" ];

     

       36
        
         nix.settings.extra-platforms = config.boot.binfmt.emulatedSystems;

     

       37
        
       

     

       38
       -
         networking.hostName = "focalor";

     

       39
       -
         networking.hostId = "84bdc587";

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       40
        
       

     

       0
        
       
     

       41
        
         systemd.network = {

     

       42
        
           enable = true;

     

       0
        
       
     

       43
        
           netdevs."br0" = {

     

       44
        
             netdevConfig = {

     

       45
        
               Name = "br0";

     

       46
        
               Kind = "bridge";

     

       47
        
             };

     

       48
        
           };

     

       0
        
       
     

       49
        
           networks = {

     

       50
        
             "10-lan" = {

     

       51
        
               matchConfig.Name = ["enp5s0" "vm-*"];

     
···

       53
        
                 Bridge = "br0";

     

       54
        
               };

     

       55
        
             };

     

       0
        
       
     

       56
        
             "10-lan-bridge" = {

     

       57
        
               matchConfig.Name = "br0";

     

       58
        
               networkConfig = {

     
···

       66
        
           };

     

       67
        
         };

     

       68
        
       

     

       69
       -
         programs.steam.enable = true;

     

       70
       -
       

     

       71
       -
         networking = {

     

       72
       -
           firewall.enable = false;

     

       73
       -
           firewall.trustedInterfaces = [

     

       74
       -
       	    "tailscale0"

     

       75
       -
           ];

     

       76
       -
           nameservers   = [ "10.0.0.210" "1.1.1.1" ];

     

       77
       -
           #useDHCP       = true;

     

       78
       -
           #firewall.allowedTCPPorts = [22 80 443 2456 2457 9000 9001 9002]; 

     

       79
       -
         };

     

       80
       -
       

     

       81
        
         services.resolved = {

     

       82
       -
           enable      = true;

     

       83
       -
           dnssec      = "true";

     

       84
       -
           domains     = [ "~." ];

     

       85
        
           fallbackDns = [ "10.0.0.210" "1.0.0.1#one.one.one.one" ];

     

       86
       -
           dnsovertls  = "true";

     

       87
        
         };

     

       88
       -
         

     

       89
       -
         #boot.supportedFilesystems = [ "zfs" ];

     

       90
       -
         #boot.kernelModules = [ "nct6775" "coretemp" ];

     

       91
        
       

     

       92
       -
         #services.zfs.autoScrub.enable = true;

     

       93
       -
         #services.zfs.trim.enable = true;

     

       0
        
       
     

       0
        
       
     

       94
        
         

     

       95
       -
         services.vscode-server.enable = true;

     

       96
       -
         services.vscode-server.nodejsPackage = pkgs.nodejs_20;

     

       0
        
       
     

       0
        
       
     

       97
        
       

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       98
        
       

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       99
        
         programs.obs-studio = {

     

       100
        
           enable = true;

     

       101
        
           enableVirtualCamera = true;

     
···

       104
        
           ];

     

       105
        
         };

     

       106
        
       

     

       107
       -
         environment.systemPackages = with pkgs; [

     

       108
       -
           #lm_sensors

     

       109
       -
           #code-server

     

       110
       -
           inputs.agenix.packages.x86_64-linux.default

     

       111
       -
         ];

     

       112
       -
       

     

       113
       -
         environment.sessionVariables.WLR_RENDERER = "vulkan";

     

       114
       -
       

     

       115
        
         virtualisation.docker = {

     

       116
        
           enable = true;

     

       117
        
           enableOnBoot = true;

     
···

       120
        
           };

     

       121
        
         };

     

       122
        
       

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       123
        
         xdg.portal = {

     

       124
        
           enable = true;

     

       125
        
           wlr.enable = true;

     
···

       128
        
             xdg-desktop-portal-gnome

     

       129
        
           ];

     

       130
        
         };

     

       131
       -
       }

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0

···

       1
       +
       # hosts/focalor/configuration.nix (or default.nix)

     

       2
        
       { config, lib, system, pkgs, modulesPath, inputs, ... }:

     

       0
        
       
     

       3
        
       {

     

       4
       +
         # =============================================================================

     

       5
       +
         # IMPORTS

     

       6
       +
         # =============================================================================

     

       7
        
         imports = [

     

       8
        
           # Host-specific hardware

     

       9
        
           ./hardware.nix

     
···

       16
        
           ../../common/services.nix

     

       17
        
           ../../common/efi.nix

     

       18
        
           ../../common/bluetooth.nix

     

       19
       +
           

     

       20
        
           # Desktop modules

     

       21
        
           ../../common/desktop/core.nix

     

       22
        
           ../../common/desktop/sway.nix

     

       23
        
           ../../common/desktop/vnc.nix

     

       24
       +
           

     

       25
       +
           # Hardware-specific

     

       26
        
           ../../common/nvidia.nix

     

       27
        
           

     

       28
       +
           # Common secrets (commented out)

     

       29
       +
           # ../../host-secrets.nix

     

       30
        
         ];

     

       31
        
       

     

       32
       +
         # =============================================================================

     

       33
       +
         # SYSTEM CONFIGURATION

     

       34
       +
         # =============================================================================

     

       35
        
         system.stateVersion = "25.05";

     

       36
       +
         nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";

     

       37
       +
         

     

       38
       +
         # Cross-compilation support

     

       0
        
       
     

       39
        
         boot.binfmt.emulatedSystems = [ "aarch64-linux" ];

     

       40
        
         nix.settings.extra-platforms = config.boot.binfmt.emulatedSystems;

     

       41
        
       

     

       42
       +
         # =============================================================================

     

       43
       +
         # NETWORKING

     

       44
       +
         # =============================================================================

     

       45
       +
         networking = {

     

       46
       +
           hostName = "focalor";

     

       47
       +
           hostId = "84bdc587";

     

       48
       +
           firewall.enable = false;

     

       49
       +
           firewall.trustedInterfaces = [ "tailscale0" ];

     

       50
       +
           nameservers = [ "10.0.0.210" "1.1.1.1" ];

     

       51
       +
         };

     

       52
        
       

     

       53
       +
         # Systemd networking with bridge

     

       54
        
         systemd.network = {

     

       55
        
           enable = true;

     

       56
       +
           

     

       57
        
           netdevs."br0" = {

     

       58
        
             netdevConfig = {

     

       59
        
               Name = "br0";

     

       60
        
               Kind = "bridge";

     

       61
        
             };

     

       62
        
           };

     

       63
       +
           

     

       64
        
           networks = {

     

       65
        
             "10-lan" = {

     

       66
        
               matchConfig.Name = ["enp5s0" "vm-*"];

     
···

       68
        
                 Bridge = "br0";

     

       69
        
               };

     

       70
        
             };

     

       71
       +
             

     

       72
        
             "10-lan-bridge" = {

     

       73
        
               matchConfig.Name = "br0";

     

       74
        
               networkConfig = {

     
···

       82
        
           };

     

       83
        
         };

     

       84
        
       

     

       85
       +
         # DNS resolution

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       86
        
         services.resolved = {

     

       87
       +
           enable = true;

     

       88
       +
           dnssec = "true";

     

       89
       +
           domains = [ "~." ];

     

       90
        
           fallbackDns = [ "10.0.0.210" "1.0.0.1#one.one.one.one" ];

     

       91
       +
           dnsovertls = "true";

     

       92
        
         };

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       93
        
       

     

       94
       +
         # =============================================================================

     

       95
       +
         # FILESYSTEM & STORAGE

     

       96
       +
         # =============================================================================

     

       97
       +
         boot.supportedFilesystems = [ "nfs" ];

     

       98
        
         

     

       99
       +
         fileSystems."/mnt/storage" = {

     

       100
       +
           device = "valefar:/storage";

     

       101
       +
           fsType = "nfs";

     

       102
       +
         };

     

       103
        
       

     

       104
       +
         # =============================================================================

     

       105
       +
         # SERVICES

     

       106
       +
         # =============================================================================

     

       107
       +
         services.vscode-server = {

     

       108
       +
           enable = true;

     

       109
       +
           nodejsPackage = pkgs.nodejs_20;

     

       110
       +
         };

     

       111
        
       

     

       112
       +
         # =============================================================================

     

       113
       +
         # PROGRAMS & APPLICATIONS

     

       114
       +
         # =============================================================================

     

       115
       +
         programs.steam.enable = true;

     

       116
       +
         

     

       117
        
         programs.obs-studio = {

     

       118
        
           enable = true;

     

       119
        
           enableVirtualCamera = true;

     
···

       122
        
           ];

     

       123
        
         };

     

       124
        
       

     

       125
       +
         # =============================================================================

     

       126
       +
         # VIRTUALIZATION

     

       127
       +
         # =============================================================================

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       128
        
         virtualisation.docker = {

     

       129
        
           enable = true;

     

       130
        
           enableOnBoot = true;

     
···

       133
        
           };

     

       134
        
         };

     

       135
        
       

     

       136
       +
         # =============================================================================

     

       137
       +
         # DESKTOP ENVIRONMENT

     

       138
       +
         # =============================================================================

     

       139
       +
         # Vulkan renderer for Wayland

     

       140
       +
         environment.sessionVariables.WLR_RENDERER = "vulkan";

     

       141
       +
         

     

       142
       +
         # XDG Portals

     

       143
        
         xdg.portal = {

     

       144
        
           enable = true;

     

       145
        
           wlr.enable = true;

     
···

       148
        
             xdg-desktop-portal-gnome

     

       149
        
           ];

     

       150
        
         };

     

       151
       +
       

     

       152
       +
         # =============================================================================

     

       153
       +
         # PACKAGES

     

       154
       +
         # =============================================================================

     

       155
       +
         environment.systemPackages = with pkgs; [

     

       156
       +
           inputs.agenix.packages.x86_64-linux.default

     

       157
       +
         ];

     

       158
       +
       

     

       159
       +
         # =============================================================================

     

       160
       +
         # COMMENTED OUT / DISABLED

     

       161
       +
         # =============================================================================

     

       162
       +
         # ZFS support (disabled for this host)

     

       163
       +
         # boot.supportedFilesystems = [ "zfs" ];

     

       164
       +
         # boot.kernelModules = [ "nct6775" "coretemp" ];

     

       165
       +
         # services.zfs.autoScrub.enable = true;

     

       166
       +
         # services.zfs.trim.enable = true;

     

       167
       +
         

     

       168
       +
         # Additional packages (commented out)

     

       169
       +
         # lm_sensors

     

       170
       +
         # code-server

     

       171
       +
         

     

       172
       +
         # DHCP (disabled in favor of systemd-networkd)

     

       173
       +
         # useDHCP = true;

     

       174
       +
         # firewall.allowedTCPPorts = [22 80 443 2456 2457 9000 9001 9002];

     

       175
       +
       }

+126 -75

hosts/valefar/default.nix

···

       1
        
       # hosts/valefar/configuration.nix (or default.nix)

     

       2
        
       { config, lib, pkgs, modulesPath, inputs, ... }:

     

       3
       -
       

     

       4
        
       {

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       5
        
         imports = [

     

       6
        
           # Host-specific hardware

     

       7
        
           ./hardware.nix

     

       8
        
           ./secrets.nix

     

       9
       -
           #../../common/nvidia.nix

     

       10
        
           

     

       11
        
           # Common modules shared across hosts

     

       12
        
           ../../common/system.nix

     
···

       16
        
           

     

       17
        
           # Common secrets

     

       18
        
           ../../host-secrets.nix

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       19
        
         ];

     

       20
        
       

     

       21
       -
         # Enable modules

     

       22
       -
         modules.garage.enable = true;

     

       23
       -
         modules.forgejo.enable = true;

     

       24
       -
         modules.immich.enable = true;

     

       25
       -
       

     

       26
        
         system.stateVersion = "24.11";

     

       27
       -
       

     

       28
       -
         # pin host platform & microcorre

     

       29
       -
         nixpkgs.hostPlatform               = lib.mkDefault "x86_64-linux";

     

       30
        
         hardware.cpu.intel.updateMicrocode = lib.mkDefault

     

       31
        
           config.hardware.enableRedistributableFirmware;

     

       32
        
       

     

       33
       -
         networking.hostName = "valefar";

     

       34
       -
         networking.hostId = "2a07da90";

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       35
        
       

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       36
        
         networking = {

     

       0
        
       
     

       0
        
       
     

       37
        
           firewall.enable = false;

     

       38
       -
           firewall.trustedInterfaces = [

     

       39
       -
       	    "tailscale0"

     

       40
       -
           ];

     

       41
       -
           nameservers   = [ "10.0.0.210" "1.1.1.1" ];

     

       42
       -
           useDHCP       = true;

     

       43
       -
           firewall.allowedTCPPorts = [22 80 443 2456 2457 9000 9001 9002]; 

     

       44
        
         };

     

       45
        
       

     

       0
        
       
     

       46
        
         services.resolved = {

     

       47
       -
           enable      = true;

     

       48
       -
           dnssec      = "false";

     

       49
       -
           domains     = [ "~." ];

     

       50
        
           fallbackDns = [ "10.0.0.210" "1.1.1.1" ];

     

       51
       -
           dnsovertls  = "false";

     

       52
        
         };

     

       53
       -
         

     

       54
       -
         boot.supportedFilesystems = [ "zfs" ];

     

       55
       -
         boot.kernelModules = [ "nct6775" "coretemp" ];

     

       56
        
       

     

       57
       -
         boot.zfs.extraPools = [ "garage" "storage" ];

     

       58
       -
         boot.zfs.devNodes = "/dev/disk/by-id";

     

       59
       -
         boot.zfs.forceImportAll = true;

     

       60
       -
       

     

       61
       -
         services.nfs.server = {

     

       62
       -
           enable = true;

     

       63
       -
           exports = ''

     

       64
       -
             /storage *(rw,sync,no_subtree_check,no_root_squash)

     

       65
       -
           '';

     

       66
       -
         };

     

       67
       -
       

     

       68
       -
         /*boot.kernelParams = [ "ip=dhcp" ];

     

       69
       -
         boot.initrd = {

     

       70
       -
           availableKernelModules = [ "r8169" ];

     

       71
       -
           network = {

     

       72
       -
             enable = true;

     

       73
       -
             ssh = {

     

       74
       -
               enable = true;

     

       75
       -
               port = 22;

     

       76
       -
               authorizedKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJ0pU82lV9dSjkgYbdh9utZ5CDM2dPN70S5fBqN1m3Pb" ];

     

       77
       -
               hostKeys = [ "/etc/secrets/initrd/ssh_host_rsa_key" ];

     

       78
       -
               shell = "/bin/cryptsetup-askpass";

     

       79
       -
             };

     

       80
        
           };

     

       81
       -
         };*/

     

       82
        
       

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       83
        
         systemd.services.zfs-import-cache.enable = false;

     

       84
       -
         systemd.services.zfs-import-scan.enable = true;

     

       85
       -
       

     

       86
        
         systemd.services.zfs-import-scan = {

     

       0
        
       
     

       87
        
           after = [ "systemd-udev-settle.service" ];

     

       88
        
           wants = [ "systemd-udev-settle.service" ];

     

       89
        
         };

     

       90
        
       

     

       91
       -
         systemd.mounts = [{

     

       92
       -
           what = "garage";

     

       93
       -
           where = "/garage";

     

       94
       -
           type = "zfs";

     

       95
       -
           after = [ "zfs-import-scan.service" ];

     

       96
       -
           wants = [ "zfs-import-scan.service" ];

     

       97
       -
         } {

     

       98
       -
           what = "storage";

     

       99
       -
           where = "/storage";

     

       100
       -
           type = "zfs";

     

       101
       -
           after = [ "zfs-import-scan.service" ];

     

       102
       -
           wants = [ "zfs-import-scan.service" ];

     

       103
       -
         }];

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       104
        
       

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       105
        
         systemd.tmpfiles.rules = [

     

       106
        
           "d /storage/immich 0755 immich immich -"

     

       0
        
       
     

       0
        
       
     

       107
        
         ];

     

       108
        
       

     

       109
       -
         services.zfs.autoScrub.enable = true;

     

       110
       -
         services.zfs.trim.enable = true;

     

       111
       -
       

     

       112
       -
         services.vscode-server.enable = true;

     

       113
       -
         services.vscode-server.nodejsPackage = pkgs.nodejs_20;

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       114
        
       

     

       115
       -
         environment.systemPackages = with pkgs; [

     

       116
       -
           lm_sensors

     

       117
       -
           code-server

     

       118
       -
           inputs.agenix.packages.x86_64-linux.default

     

       119
       -
         ];

     

       0
        
       
     

       0
        
       
     

       120
        
       

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       121
        
         virtualisation.docker = {

     

       122
        
           enable = true;

     

       123
        
           enableOnBoot = true;

     
···

       125
        
             buildGoModule = pkgs.buildGo123Module;

     

       126
        
           };

     

       127
        
         };

     

       128
       -
       }

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0

···

       1
        
       # hosts/valefar/configuration.nix (or default.nix)

     

       2
        
       { config, lib, pkgs, modulesPath, inputs, ... }:

     

       0
        
       
     

       3
        
       {

     

       4
       +
         # =============================================================================

     

       5
       +
         # IMPORTS

     

       6
       +
         # =============================================================================

     

       7
        
         imports = [

     

       8
        
           # Host-specific hardware

     

       9
        
           ./hardware.nix

     

       10
        
           ./secrets.nix

     

       0
        
       
     

       11
        
           

     

       12
        
           # Common modules shared across hosts

     

       13
        
           ../../common/system.nix

     
···

       17
        
           

     

       18
        
           # Common secrets

     

       19
        
           ../../host-secrets.nix

     

       20
       +
           

     

       21
       +
           # Hardware-specific (commented out)

     

       22
       +
           # ../../common/nvidia.nix

     

       23
        
         ];

     

       24
        
       

     

       25
       +
         # =============================================================================

     

       26
       +
         # SYSTEM CONFIGURATION

     

       27
       +
         # =============================================================================

     

       0
        
       
     

       0
        
       
     

       28
        
         system.stateVersion = "24.11";

     

       29
       +
         nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";

     

       30
       +
         

     

       31
       +
         # Intel microcode updates

     

       32
        
         hardware.cpu.intel.updateMicrocode = lib.mkDefault

     

       33
        
           config.hardware.enableRedistributableFirmware;

     

       34
        
       

     

       35
       +
         # =============================================================================

     

       36
       +
         # CUSTOM MODULES

     

       37
       +
         # =============================================================================

     

       38
       +
         modules.garage.enable = true;

     

       39
       +
         modules.forgejo.enable = true;

     

       40
       +
         modules.immich.enable = true;

     

       41
        
       

     

       42
       +
         # =============================================================================

     

       43
       +
         # NETWORKING

     

       44
       +
         # =============================================================================

     

       45
        
         networking = {

     

       46
       +
           hostName = "valefar";

     

       47
       +
           hostId = "2a07da90";

     

       48
        
           firewall.enable = false;

     

       49
       +
           firewall.trustedInterfaces = [ "tailscale0" ];

     

       50
       +
           nameservers = [ "10.0.0.210" "1.1.1.1" ];

     

       51
       +
           useDHCP = true;

     

       52
       +
           firewall.allowedTCPPorts = [ 22 80 443 2049 2456 2457 9000 9001 9002 ];

     

       53
       +
           firewall.allowedUDPPorts = [ 2049 ];

     

       0
        
       
     

       54
        
         };

     

       55
        
       

     

       56
       +
         # DNS resolution

     

       57
        
         services.resolved = {

     

       58
       +
           enable = true;

     

       59
       +
           dnssec = "false";

     

       60
       +
           domains = [ "~." ];

     

       61
        
           fallbackDns = [ "10.0.0.210" "1.1.1.1" ];

     

       62
       +
           dnsovertls = "false";

     

       63
        
         };

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       64
        
       

     

       65
       +
         # =============================================================================

     

       66
       +
         # BOOT & FILESYSTEMS

     

       67
       +
         # =============================================================================

     

       68
       +
         boot = {

     

       69
       +
           supportedFilesystems = [ "zfs" ];

     

       70
       +
           kernelModules = [ "nct6775" "coretemp" ];

     

       71
       +
           

     

       72
       +
           zfs = {

     

       73
       +
             extraPools = [ "garage" "storage" ];

     

       74
       +
             devNodes = "/dev/disk/by-id";

     

       75
       +
             forceImportAll = true;

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       76
        
           };

     

       77
       +
         };

     

       78
        
       

     

       79
       +
         # =============================================================================

     

       80
       +
         # ZFS CONFIGURATION

     

       81
       +
         # =============================================================================

     

       82
       +
         # ZFS import services

     

       83
        
         systemd.services.zfs-import-cache.enable = false;

     

       0
        
       
     

       0
        
       
     

       84
        
         systemd.services.zfs-import-scan = {

     

       85
       +
           enable = true;

     

       86
        
           after = [ "systemd-udev-settle.service" ];

     

       87
        
           wants = [ "systemd-udev-settle.service" ];

     

       88
        
         };

     

       89
        
       

     

       90
       +
         # ZFS mount points

     

       91
       +
         systemd.mounts = [

     

       92
       +
           {

     

       93
       +
             what = "garage";

     

       94
       +
             where = "/garage";

     

       95
       +
             type = "zfs";

     

       96
       +
             after = [ "zfs-import-scan.service" ];

     

       97
       +
             wants = [ "zfs-import-scan.service" ];

     

       98
       +
           }

     

       99
       +
           {

     

       100
       +
             what = "storage";

     

       101
       +
             where = "/storage";

     

       102
       +
             type = "zfs";

     

       103
       +
             after = [ "zfs-import-scan.service" ];

     

       104
       +
             wants = [ "zfs-import-scan.service" ];

     

       105
       +
           }

     

       106
       +
         ];

     

       107
        
       

     

       108
       +
         # ZFS maintenance

     

       109
       +
         services.zfs = {

     

       110
       +
           autoScrub.enable = true;

     

       111
       +
           trim.enable = true;

     

       112
       +
         };

     

       113
       +
       

     

       114
       +
         # =============================================================================

     

       115
       +
         # DIRECTORY STRUCTURE

     

       116
       +
         # =============================================================================

     

       117
        
         systemd.tmpfiles.rules = [

     

       118
        
           "d /storage/immich 0755 immich immich -"

     

       119
       +
           "d /storage/immich/photos 0755 immich immich -"

     

       120
       +
           "Z /storage/immich 0755 immich immich -"  # Recursively fix ownership of existing files

     

       121
        
         ];

     

       122
        
       

     

       123
       +
         # =============================================================================

     

       124
       +
         # NFS SERVER

     

       125
       +
         # =============================================================================

     

       126
       +
         services.nfs.server = {

     

       127
       +
           enable = true;

     

       128
       +
           exports = ''

     

       129
       +
             /storage *(rw,sync,no_subtree_check,no_root_squash)

     

       130
       +
           '';

     

       131
       +
         };

     

       132
        
       

     

       133
       +
         # =============================================================================

     

       134
       +
         # SERVICES

     

       135
       +
         # =============================================================================

     

       136
       +
         services.vscode-server = {

     

       137
       +
           enable = true;

     

       138
       +
           nodejsPackage = pkgs.nodejs_20;

     

       139
       +
         };

     

       140
        
       

     

       141
       +
         # =============================================================================

     

       142
       +
         # VIRTUALIZATION

     

       143
       +
         # =============================================================================

     

       144
        
         virtualisation.docker = {

     

       145
        
           enable = true;

     

       146
        
           enableOnBoot = true;

     
···

       148
        
             buildGoModule = pkgs.buildGo123Module;

     

       149
        
           };

     

       150
        
         };

     

       151
       +
       

     

       152
       +
         # =============================================================================

     

       153
       +
         # PACKAGES

     

       154
       +
         # =============================================================================

     

       155
       +
         environment.systemPackages = with pkgs; [

     

       156
       +
           lm_sensors

     

       157
       +
           code-server

     

       158
       +
           inputs.agenix.packages.x86_64-linux.default

     

       159
       +
         ];

     

       160
       +
       

     

       161
       +
         # =============================================================================

     

       162
       +
         # COMMENTED OUT / DISABLED

     

       163
       +
         # =============================================================================

     

       164
       +
         # Remote unlock via SSH (commented out)

     

       165
       +
         # boot.kernelParams = [ "ip=dhcp" ];

     

       166
       +
         # boot.initrd = {

     

       167
       +
         #   availableKernelModules = [ "r8169" ];

     

       168
       +
         #   network = {

     

       169
       +
         #     enable = true;

     

       170
       +
         #     ssh = {

     

       171
       +
         #       enable = true;

     

       172
       +
         #       port = 22;

     

       173
       +
         #       authorizedKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJ0pU82lV9dSjkgYbdh9utZ5CDM2dPN70S5fBqN1m3Pb" ];

     

       174
       +
         #       hostKeys = [ "/etc/secrets/initrd/ssh_host_rsa_key" ];

     

       175
       +
         #       shell = "/bin/cryptsetup-askpass";

     

       176
       +
         #     };

     

       177
       +
         #   };

     

       178
       +
         # };

     

       179
       +
       }