nekomimi.pet / nixcfg
my nix configs for my servers and desktop
fork atom

Compare changes

Choose any two refs to compare.

options
unified split
Changed files
+296 -153
common
python-cuda-dev.nix
services.nix
flake.lock
flake.nix
hosts
baal
default.nix
buer
default.nix
focalor
default.nix
vfio.nix
valefar
default.nix
gamevm.nix
+67
common/python-cuda-dev.nix 
···

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     
···

       
1

       
+

       
{


     

       
2

       
+

       
  description = "A Nix-flake-based PyTorch development environment";


     

       
3

       
+

       



     

       
4

       
+

       
  # CUDA binaries are cached by the community.


     

       
5

       
+

       
  nixConfig = {


     

       
6

       
+

       
    extra-substituters = [


     

       
7

       
+

       
      "https://nix-community.cachix.org"


     

       
8

       
+

       
    ];


     

       
9

       
+

       
    extra-trusted-public-keys = [


     

       
10

       
+

       
      "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="


     

       
11

       
+

       
    ];


     

       
12

       
+

       
  };


     

       
13

       
+

       



     

       
14

       
+

       
  inputs.nixpkgs.url = "https://flakehub.com/f/NixOS/nixpkgs/0.1.*.tar.gz";


     

       
15

       
+

       



     

       
16

       
+

       
  outputs = {


     

       
17

       
+

       
    self,


     

       
18

       
+

       
    nixpkgs,


     

       
19

       
+

       
  }: let


     

       
20

       
+

       
    supportedSystems = ["x86_64-linux" "aarch64-linux" "x86_64-darwin" "aarch64-darwin"];


     

       
21

       
+

       
    forEachSupportedSystem = f:


     

       
22

       
+

       
      nixpkgs.lib.genAttrs supportedSystems (system:


     

       
23

       
+

       
        f {


     

       
24

       
+

       
          pkgs = import nixpkgs {


     

       
25

       
+

       
            inherit system;


     

       
26

       
+

       
            config.allowUnfree = true;


     

       
27

       
+

       
          };


     

       
28

       
+

       
        });


     

       
29

       
+

       
  in {


     

       
30

       
+

       
    devShells = forEachSupportedSystem ({pkgs}: let


     

       
31

       
+

       
      libs = [


     

       
32

       
+

       
        # PyTorch and Numpy depends on the following libraries.


     

       
33

       
+

       
        pkgs.cudaPackages.cudatoolkit


     

       
34

       
+

       
        pkgs.cudaPackages.cudnn


     

       
35

       
+

       
        pkgs.stdenv.cc.cc.lib


     

       
36

       
+

       
        pkgs.zlib


     

       
37

       
+

       



     

       
38

       
+

       
        # PyTorch also needs to know where your local "lib/libcuda.so" lives.


     

       
39

       
+

       
        # If you're not on NixOS, you should provide the right path (likely


     

       
40

       
+

       
        # another one).


     

       
41

       
+

       
        "/run/opengl-driver"


     

       
42

       
+

       
      ];


     

       
43

       
+

       
    in {


     

       
44

       
+

       
      default = pkgs.mkShell {


     

       
45

       
+

       
        packages = [


     

       
46

       
+

       
          pkgs.python312


     

       
47

       
+

       
          pkgs.python312Packages.venvShellHook


     

       
48

       
+

       
        ];


     

       
49

       
+

       



     

       
50

       
+

       
        env = {


     

       
51

       
+

       
          CC = "${pkgs.gcc}/bin/gcc"; # For `torch.compile`.


     

       
52

       
+

       
          LD_LIBRARY_PATH = pkgs.lib.makeLibraryPath libs;


     

       
53

       
+

       
        };


     

       
54

       
+

       



     

       
55

       
+

       
        venvDir = ".venv";


     

       
56

       
+

       
        postVenvCreation = ''


     

       
57

       
+

       
          # This is run only when creating the virtual environment.


     

       
58

       
+

       
          pip install torch==2.5.1 numpy==2.2.2


     

       
59

       
+

       
        '';


     

       
60

       
+

       
        postShellHook = ''


     

       
61

       
+

       
          # This is run every time you enter the devShell.


     

       
62

       
+

       
          python3 -c "import torch; print('CUDA available' if torch.cuda.is_available() else 'CPU only')"


     

       
63

       
+

       
        '';


     

       
64

       
+

       
      };


     

       
65

       
+

       
    });


     

       
66

       
+

       
  };


     

       
67

       
+

       
}
+1
common/services.nix 
···

       
16

       
 

       
    nixos-generators


     

       
17

       
 

       
    sqlite


     

       
18

       
 

       
    bun


     

       

       

       
     

       
19

       
 

       
  ];


     

       
20

       
 

       



     

       
21

       
 

       
  services.openssh.enable         = true;


     
···

       
16

       
 

       
    nixos-generators


     

       
17

       
 

       
    sqlite


     

       
18

       
 

       
    bun


     

       
19

       
+

       
    unzip


     

       
20

       
 

       
  ];


     

       
21

       
 

       



     

       
22

       
 

       
  services.openssh.enable         = true;
+150 -50
flake.lock 
···

       
8

       
 

       
        "systems": "systems"


     

       
9

       
 

       
      },


     

       
10

       
 

       
      "locked": {


     

       
11

       
-

       
        "lastModified": 1750173260,


     

       
12

       
-

       
        "narHash": "sha256-9P1FziAwl5+3edkfFcr5HeGtQUtrSdk/MksX39GieoA=",


     

       
13

       
 

       
        "owner": "ryantm",


     

       
14

       
 

       
        "repo": "agenix",


     

       
15

       
-

       
        "rev": "531beac616433bac6f9e2a19feb8e99a22a66baf",


     

       
16

       
 

       
        "type": "github"


     

       
17

       
 

       
      },


     

       
18

       
 

       
      "original": {


     
···

       
26

       
 

       
        "nixpkgs": "nixpkgs_2"


     

       
27

       
 

       
      },


     

       
28

       
 

       
      "locked": {


     

       
29

       
-

       
        "lastModified": 1751880463,


     

       
30

       
-

       
        "narHash": "sha256-aSQllMKqsTYAUp4yhpspZn0Hj5yIj7Mh4UD5iyk5iMM=",


     

       
31

       
 

       
        "owner": "catppuccin",


     

       
32

       
 

       
        "repo": "nix",


     

       
33

       
-

       
        "rev": "9474347c69e93e392f194dda7a57c641ba4b998e",


     

       
34

       
 

       
        "type": "github"


     

       
35

       
 

       
      },


     

       
36

       
 

       
      "original": {


     
···

       
80

       
 

       
        "type": "github"


     

       
81

       
 

       
      }


     

       
82

       
 

       
    },


     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       
83

       
 

       
    "flake-utils": {


     

       
84

       
 

       
      "inputs": {


     

       
85

       
 

       
        "systems": "systems_2"


     
···

       
118

       
 

       
    },


     

       
119

       
 

       
    "flake-utils_3": {


     

       
120

       
 

       
      "inputs": {


     

       
121

       
-

       
        "systems": "systems_4"


     

       
122

       
 

       
      },


     

       
123

       
 

       
      "locked": {


     

       
124

       
 

       
        "lastModified": 1681202837,


     
···

       
177

       
 

       
        ]


     

       
178

       
 

       
      },


     

       
179

       
 

       
      "locked": {


     

       
180

       
-

       
        "lastModified": 1751824240,


     

       
181

       
-

       
        "narHash": "sha256-aDDC0CHTlL7QDKWWhdbEgVPK6KwWt+ca0QkmHYZxMzI=",


     

       
182

       
 

       
        "owner": "nix-community",


     

       
183

       
 

       
        "repo": "home-manager",


     

       
184

       
-

       
        "rev": "fd9e55f5fac45a26f6169310afca64d56b681935",


     

       
185

       
 

       
        "type": "github"


     

       
186

       
 

       
      },


     

       
187

       
 

       
      "original": {


     
···

       
198

       
 

       
        ]


     

       
199

       
 

       
      },


     

       
200

       
 

       
      "locked": {


     

       
201

       
-

       
        "lastModified": 1743604125,


     

       
202

       
-

       
        "narHash": "sha256-ZD61DNbsBt1mQbinAaaEqKaJk2RFo9R/j+eYWeGMx7A=",


     

       
203

       
 

       
        "owner": "nix-community",


     

       
204

       
 

       
        "repo": "home-manager",


     

       
205

       
-

       
        "rev": "180fd43eea296e62ae68e079fcf56aba268b9a1a",


     

       
206

       
 

       
        "type": "github"


     

       
207

       
 

       
      },


     

       
208

       
 

       
      "original": {


     
···

       
214

       
 

       
    "lix": {


     

       
215

       
 

       
      "flake": false,


     

       
216

       
 

       
      "locked": {


     

       
217

       
-

       
        "lastModified": 1746827285,


     

       
218

       
-

       
        "narHash": "sha256-hsFe4Tsqqg4l+FfQWphDtjC79WzNCZbEFhHI8j2KJzw=",


     

       
219

       
-

       
        "rev": "47aad376c87e2e65967f17099277428e4b3f8e5a",


     

       
220

       
 

       
        "type": "tarball",


     

       
221

       
-

       
        "url": "https://git.lix.systems/api/v1/repos/lix-project/lix/archive/47aad376c87e2e65967f17099277428e4b3f8e5a.tar.gz?rev=47aad376c87e2e65967f17099277428e4b3f8e5a"


     

       
222

       
 

       
      },


     

       
223

       
 

       
      "original": {


     

       
224

       
 

       
        "type": "tarball",


     

       
225

       
-

       
        "url": "https://git.lix.systems/lix-project/lix/archive/2.93.0.tar.gz"


     

       
226

       
 

       
      }


     

       
227

       
 

       
    },


     

       
228

       
 

       
    "lix-module": {


     
···

       
235

       
 

       
        ]


     

       
236

       
 

       
      },


     

       
237

       
 

       
      "locked": {


     

       
238

       
-

       
        "lastModified": 1746838955,


     

       
239

       
-

       
        "narHash": "sha256-11R4K3iAx4tLXjUs+hQ5K90JwDABD/XHhsM9nkeS5N8=",


     

       
240

       
-

       
        "rev": "cd2a9c028df820a83ca2807dc6c6e7abc3dfa7fc",


     

       
241

       
 

       
        "type": "tarball",


     

       
242

       
-

       
        "url": "https://git.lix.systems/api/v1/repos/lix-project/nixos-module/archive/cd2a9c028df820a83ca2807dc6c6e7abc3dfa7fc.tar.gz"


     

       
243

       
 

       
      },


     

       
244

       
 

       
      "original": {


     

       
245

       
 

       
        "type": "tarball",


     

       
246

       
-

       
        "url": "https://git.lix.systems/lix-project/nixos-module/archive/2.93.0.tar.gz"


     

       
247

       
 

       
      }


     

       
248

       
 

       
    },


     

       
249

       
 

       
    "microvm": {


     
···

       
255

       
 

       
        "spectrum": "spectrum"


     

       
256

       
 

       
      },


     

       
257

       
 

       
      "locked": {


     

       
258

       
-

       
        "lastModified": 1751732733,


     

       
259

       
-

       
        "narHash": "sha256-MuaFFGHdShvGdHKrd3PUI2om+njixdG/1dGlglRdK8Q=",


     

       
260

       
 

       
        "owner": "astro",


     

       
261

       
 

       
        "repo": "microvm.nix",


     

       
262

       
-

       
        "rev": "9d3d845ccb1a3f81747d027e95b110d4637468d0",


     

       
263

       
 

       
        "type": "github"


     

       
264

       
 

       
      },


     

       
265

       
 

       
      "original": {


     
···

       
270

       
 

       
    },


     

       
271

       
 

       
    "nixos-hardware": {


     

       
272

       
 

       
      "locked": {


     

       
273

       
-

       
        "lastModified": 1751432711,


     

       
274

       
-

       
        "narHash": "sha256-136MeWtckSHTN9Z2WRNRdZ8oRP3vyx3L8UxeBYE+J9w=",


     

       
275

       
 

       
        "owner": "nixos",


     

       
276

       
 

       
        "repo": "nixos-hardware",


     

       
277

       
-

       
        "rev": "497ae1357f1ac97f1aea31a4cb74ad0d534ef41f",


     

       
278

       
 

       
        "type": "github"


     

       
279

       
 

       
      },


     

       
280

       
 

       
      "original": {


     
···

       
286

       
 

       
    },


     

       
287

       
 

       
    "nixpkgs": {


     

       
288

       
 

       
      "locked": {


     

       
289

       
-

       
        "lastModified": 1745391562,


     

       
290

       
-

       
        "narHash": "sha256-sPwcCYuiEopaafePqlG826tBhctuJsLx/mhKKM5Fmjo=",


     

       
291

       
 

       
        "owner": "NixOS",


     

       
292

       
 

       
        "repo": "nixpkgs",


     

       
293

       
-

       
        "rev": "8a2f738d9d1f1d986b5a4cd2fd2061a7127237d7",


     

       
294

       
 

       
        "type": "github"


     

       
295

       
 

       
      },


     

       
296

       
 

       
      "original": {


     

       
297

       
 

       
        "owner": "NixOS",


     

       
298

       
-

       
        "ref": "nixos-unstable",


     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       
299

       
 

       
        "repo": "nixpkgs",


     

       

       

       
     

       
300

       
 

       
        "type": "github"


     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       
301

       
 

       
      }


     

       
302

       
 

       
    },


     

       
303

       
 

       
    "nixpkgs_2": {


     

       
304

       
 

       
      "locked": {


     

       
305

       
-

       
        "lastModified": 1750776420,


     

       
306

       
-

       
        "narHash": "sha256-/CG+w0o0oJ5itVklOoLbdn2dGB0wbZVOoDm4np6w09A=",


     

       
307

       
 

       
        "owner": "NixOS",


     

       
308

       
 

       
        "repo": "nixpkgs",


     

       
309

       
-

       
        "rev": "30a61f056ac492e3b7cdcb69c1e6abdcf00e39cf",


     

       
310

       
 

       
        "type": "github"


     

       
311

       
 

       
      },


     

       
312

       
 

       
      "original": {


     
···

       
334

       
 

       
    },


     

       
335

       
 

       
    "nixpkgs_4": {


     

       
336

       
 

       
      "locked": {


     

       
337

       
-

       
        "lastModified": 1751637120,


     

       
338

       
-

       
        "narHash": "sha256-xVNy/XopSfIG9c46nRmPaKfH1Gn/56vQ8++xWA8itO4=",


     

       
339

       
 

       
        "owner": "nixos",


     

       
340

       
 

       
        "repo": "nixpkgs",


     

       
341

       
-

       
        "rev": "1fd8bada0b6117e6c7eb54aad5813023eed37ccb",


     

       
342

       
 

       
        "type": "github"


     

       
343

       
 

       
      },


     

       
344

       
 

       
      "original": {


     

       
345

       
 

       
        "owner": "nixos",


     

       
346

       
-

       
        "ref": "nixos-unstable",


     

       
347

       
 

       
        "repo": "nixpkgs",


     

       
348

       
 

       
        "type": "github"


     

       
349

       
 

       
      }


     
···

       
362

       
 

       
        "type": "indirect"


     

       
363

       
 

       
      }


     

       
364

       
 

       
    },


     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       
365

       
 

       
    "root": {


     

       
366

       
 

       
      "inputs": {


     

       
367

       
 

       
        "agenix": "agenix",


     
···

       
372

       
 

       
        "microvm": "microvm",


     

       
373

       
 

       
        "nixos-hardware": "nixos-hardware",


     

       
374

       
 

       
        "nixpkgs": "nixpkgs_4",


     

       

       

       
     

       
375

       
 

       
        "vscode-server": "vscode-server",


     

       
376

       
 

       
        "zen-browser": "zen-browser"


     

       
377

       
 

       
      }


     
···

       
379

       
 

       
    "spectrum": {


     

       
380

       
 

       
      "flake": false,


     

       
381

       
 

       
      "locked": {


     

       
382

       
-

       
        "lastModified": 1751265943,


     

       
383

       
-

       
        "narHash": "sha256-XoHSo6GEElzRUOYAEg/jlh5c8TDsyDESFIux3nU/NMc=",


     

       
384

       
 

       
        "ref": "refs/heads/main",


     

       
385

       
-

       
        "rev": "37c8663fab86fdb202fece339ef7ac7177ffc201",


     

       
386

       
-

       
        "revCount": 904,


     

       
387

       
 

       
        "type": "git",


     

       
388

       
 

       
        "url": "https://spectrum-os.org/git/spectrum"


     

       
389

       
 

       
      },


     
···

       
452

       
 

       
        "type": "github"


     

       
453

       
 

       
      }


     

       
454

       
 

       
    },


     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       
455

       
 

       
    "vscode-server": {


     

       
456

       
 

       
      "inputs": {


     

       
457

       
 

       
        "flake-utils": "flake-utils_3",


     

       
458

       
 

       
        "nixpkgs": "nixpkgs_5"


     

       
459

       
 

       
      },


     

       
460

       
 

       
      "locked": {


     

       
461

       
-

       
        "lastModified": 1750353031,


     

       
462

       
-

       
        "narHash": "sha256-Bx7DOPLhkr8Z60U9Qw4l0OidzHoqLDKQH5rDV5ef59A=",


     

       
463

       
 

       
        "owner": "nix-community",


     

       
464

       
 

       
        "repo": "nixos-vscode-server",


     

       
465

       
-

       
        "rev": "4ec4859b12129c0436b0a471ed1ea6dd8a317993",


     

       
466

       
 

       
        "type": "github"


     

       
467

       
 

       
      },


     

       
468

       
 

       
      "original": {


     
···

       
479

       
 

       
        ]


     

       
480

       
 

       
      },


     

       
481

       
 

       
      "locked": {


     

       
482

       
-

       
        "lastModified": 1751858709,


     

       
483

       
-

       
        "narHash": "sha256-xghd1GDPRSa6aD6tEk2JCuQDZWdHITlCA/stwSVoZJQ=",


     

       
484

       
 

       
        "owner": "0xc000022070",


     

       
485

       
 

       
        "repo": "zen-browser-flake",


     

       
486

       
-

       
        "rev": "216dd333fa41aa013bf8aab9322d7c1a2aee5b4a",


     

       
487

       
 

       
        "type": "github"


     

       
488

       
 

       
      },


     

       
489

       
 

       
      "original": {


     
···

       
8

       
 

       
        "systems": "systems"


     

       
9

       
 

       
      },


     

       
10

       
 

       
      "locked": {


     

       
11

       
+

       
        "lastModified": 1760836749,


     

       
12

       
+

       
        "narHash": "sha256-wyT7Pl6tMFbFrs8Lk/TlEs81N6L+VSybPfiIgzU8lbQ=",


     

       
13

       
 

       
        "owner": "ryantm",


     

       
14

       
 

       
        "repo": "agenix",


     

       
15

       
+

       
        "rev": "2f0f812f69f3eb4140157fe15e12739adf82e32a",


     

       
16

       
 

       
        "type": "github"


     

       
17

       
 

       
      },


     

       
18

       
 

       
      "original": {


     
···

       
26

       
 

       
        "nixpkgs": "nixpkgs_2"


     

       
27

       
 

       
      },


     

       
28

       
 

       
      "locked": {


     

       
29

       
+

       
        "lastModified": 1760953099,


     

       
30

       
+

       
        "narHash": "sha256-sOKx2YcHa+lWEvaEOIGqLN2WWk1Wf5z6KM02tdfhMtw=",


     

       
31

       
 

       
        "owner": "catppuccin",


     

       
32

       
 

       
        "repo": "nix",


     

       
33

       
+

       
        "rev": "f5b21876888265d2fee7fb0640d1b66a1c1c6503",


     

       
34

       
 

       
        "type": "github"


     

       
35

       
 

       
      },


     

       
36

       
 

       
      "original": {


     
···

       
80

       
 

       
        "type": "github"


     

       
81

       
 

       
      }


     

       
82

       
 

       
    },


     

       
83

       
+

       
    "flake-compat": {


     

       
84

       
+

       
      "locked": {


     

       
85

       
+

       
        "lastModified": 1696426674,


     

       
86

       
+

       
        "narHash": "sha256-kvjfFW7WAETZlt09AgDn1MrtKzP7t90Vf7vypd3OL1U=",


     

       
87

       
+

       
        "owner": "edolstra",


     

       
88

       
+

       
        "repo": "flake-compat",


     

       
89

       
+

       
        "rev": "0f9255e01c2351cc7d116c072cb317785dd33b33",


     

       
90

       
+

       
        "type": "github"


     

       
91

       
+

       
      },


     

       
92

       
+

       
      "original": {


     

       
93

       
+

       
        "owner": "edolstra",


     

       
94

       
+

       
        "repo": "flake-compat",


     

       
95

       
+

       
        "type": "github"


     

       
96

       
+

       
      }


     

       
97

       
+

       
    },


     

       
98

       
 

       
    "flake-utils": {


     

       
99

       
 

       
      "inputs": {


     

       
100

       
 

       
        "systems": "systems_2"


     
···

       
133

       
 

       
    },


     

       
134

       
 

       
    "flake-utils_3": {


     

       
135

       
 

       
      "inputs": {


     

       
136

       
+

       
        "systems": "systems_5"


     

       
137

       
 

       
      },


     

       
138

       
 

       
      "locked": {


     

       
139

       
 

       
        "lastModified": 1681202837,


     
···

       
192

       
 

       
        ]


     

       
193

       
 

       
      },


     

       
194

       
 

       
      "locked": {


     

       
195

       
+

       
        "lastModified": 1761235135,


     

       
196

       
+

       
        "narHash": "sha256-cux9xeceLIER1lBxUa1gMafkz7gg5ntcUmJBynWdBWI=",


     

       
197

       
 

       
        "owner": "nix-community",


     

       
198

       
 

       
        "repo": "home-manager",


     

       
199

       
+

       
        "rev": "0adf9ba3f567da2d53af581a857aacf671aaa547",


     

       
200

       
 

       
        "type": "github"


     

       
201

       
 

       
      },


     

       
202

       
 

       
      "original": {


     
···

       
213

       
 

       
        ]


     

       
214

       
 

       
      },


     

       
215

       
 

       
      "locked": {


     

       
216

       
+

       
        "lastModified": 1752603129,


     

       
217

       
+

       
        "narHash": "sha256-S+wmHhwNQ5Ru689L2Gu8n1OD6s9eU9n9mD827JNR+kw=",


     

       
218

       
 

       
        "owner": "nix-community",


     

       
219

       
 

       
        "repo": "home-manager",


     

       
220

       
+

       
        "rev": "e8c19a3cec2814c754f031ab3ae7316b64da085b",


     

       
221

       
 

       
        "type": "github"


     

       
222

       
 

       
      },


     

       
223

       
 

       
      "original": {


     
···

       
229

       
 

       
    "lix": {


     

       
230

       
 

       
      "flake": false,


     

       
231

       
 

       
      "locked": {


     

       
232

       
+

       
        "lastModified": 1753223229,


     

       
233

       
+

       
        "narHash": "sha256-tkT4aCZZE6IEmjYotOzKKa2rV3pGpH3ZREeQn7ACgdU=",


     

       
234

       
+

       
        "rev": "7ac20fc47cf2f1b7469c7a2f379e5a3a51a6789a",


     

       
235

       
 

       
        "type": "tarball",


     

       
236

       
+

       
        "url": "https://git.lix.systems/api/v1/repos/lix-project/lix/archive/7ac20fc47cf2f1b7469c7a2f379e5a3a51a6789a.tar.gz?rev=7ac20fc47cf2f1b7469c7a2f379e5a3a51a6789a"


     

       
237

       
 

       
      },


     

       
238

       
 

       
      "original": {


     

       
239

       
 

       
        "type": "tarball",


     

       
240

       
+

       
        "url": "https://git.lix.systems/lix-project/lix/archive/release-2.93.tar.gz"


     

       
241

       
 

       
      }


     

       
242

       
 

       
    },


     

       
243

       
 

       
    "lix-module": {


     
···

       
250

       
 

       
        ]


     

       
251

       
 

       
      },


     

       
252

       
 

       
      "locked": {


     

       
253

       
+

       
        "lastModified": 1753282722,


     

       
254

       
+

       
        "narHash": "sha256-KYMUrTV7H/RR5/HRnjV5R3rRIuBXMemyJzTLi50NFTs=",


     

       
255

       
+

       
        "rev": "46a9e8fcfe4be72b4c7c8082ee11d2c42da1e873",


     

       
256

       
 

       
        "type": "tarball",


     

       
257

       
+

       
        "url": "https://git.lix.systems/api/v1/repos/lix-project/nixos-module/archive/46a9e8fcfe4be72b4c7c8082ee11d2c42da1e873.tar.gz?rev=46a9e8fcfe4be72b4c7c8082ee11d2c42da1e873"


     

       
258

       
 

       
      },


     

       
259

       
 

       
      "original": {


     

       
260

       
 

       
        "type": "tarball",


     

       
261

       
+

       
        "url": "https://git.lix.systems/lix-project/nixos-module/archive/2.93.3-1.tar.gz"


     

       
262

       
 

       
      }


     

       
263

       
 

       
    },


     

       
264

       
 

       
    "microvm": {


     
···

       
270

       
 

       
        "spectrum": "spectrum"


     

       
271

       
 

       
      },


     

       
272

       
 

       
      "locked": {


     

       
273

       
+

       
        "lastModified": 1760574296,


     

       
274

       
+

       
        "narHash": "sha256-S3gIp6Wd9vQ2RYDxcbHM2CIYgDtogbwzSdu38WABKaQ=",


     

       
275

       
 

       
        "owner": "astro",


     

       
276

       
 

       
        "repo": "microvm.nix",


     

       
277

       
+

       
        "rev": "42628f7c61b02d385ce2cb1f66f9be333ac20140",


     

       
278

       
 

       
        "type": "github"


     

       
279

       
 

       
      },


     

       
280

       
 

       
      "original": {


     
···

       
285

       
 

       
    },


     

       
286

       
 

       
    "nixos-hardware": {


     

       
287

       
 

       
      "locked": {


     

       
288

       
+

       
        "lastModified": 1760958188,


     

       
289

       
+

       
        "narHash": "sha256-2m1S4jl+GEDtlt2QqeHil8Ny456dcGSKJAM7q3j/BFU=",


     

       
290

       
 

       
        "owner": "nixos",


     

       
291

       
 

       
        "repo": "nixos-hardware",


     

       
292

       
+

       
        "rev": "d6645c340ef7d821602fd2cd199e8d1eed10afbc",


     

       
293

       
 

       
        "type": "github"


     

       
294

       
 

       
      },


     

       
295

       
 

       
      "original": {


     
···

       
301

       
 

       
    },


     

       
302

       
 

       
    "nixpkgs": {


     

       
303

       
 

       
      "locked": {


     

       
304

       
+

       
        "lastModified": 1754028485,


     

       
305

       
+

       
        "narHash": "sha256-IiiXB3BDTi6UqzAZcf2S797hWEPCRZOwyNThJIYhUfk=",


     

       
306

       
 

       
        "owner": "NixOS",


     

       
307

       
 

       
        "repo": "nixpkgs",


     

       
308

       
+

       
        "rev": "59e69648d345d6e8fef86158c555730fa12af9de",


     

       
309

       
 

       
        "type": "github"


     

       
310

       
 

       
      },


     

       
311

       
 

       
      "original": {


     

       
312

       
 

       
        "owner": "NixOS",


     

       
313

       
+

       
        "ref": "nixos-25.05",


     

       
314

       
+

       
        "repo": "nixpkgs",


     

       
315

       
+

       
        "type": "github"


     

       
316

       
+

       
      }


     

       
317

       
+

       
    },


     

       
318

       
+

       
    "nixpkgs-stable": {


     

       
319

       
+

       
      "locked": {


     

       
320

       
+

       
        "lastModified": 1748437600,


     

       
321

       
+

       
        "narHash": "sha256-hYKMs3ilp09anGO7xzfGs3JqEgUqFMnZ8GMAqI6/k04=",


     

       
322

       
+

       
        "owner": "NixOS",


     

       
323

       
 

       
        "repo": "nixpkgs",


     

       
324

       
+

       
        "rev": "7282cb574e0607e65224d33be8241eae7cfe0979",


     

       
325

       
 

       
        "type": "github"


     

       
326

       
+

       
      },


     

       
327

       
+

       
      "original": {


     

       
328

       
+

       
        "id": "nixpkgs",


     

       
329

       
+

       
        "ref": "nixos-25.05",


     

       
330

       
+

       
        "type": "indirect"


     

       
331

       
+

       
      }


     

       
332

       
+

       
    },


     

       
333

       
+

       
    "nixpkgs-unstable": {


     

       
334

       
+

       
      "locked": {


     

       
335

       
+

       
        "lastModified": 1723637854,


     

       
336

       
+

       
        "narHash": "sha256-med8+5DSWa2UnOqtdICndjDAEjxr5D7zaIiK4pn0Q7c=",


     

       
337

       
+

       
        "owner": "NixOS",


     

       
338

       
+

       
        "repo": "nixpkgs",


     

       
339

       
+

       
        "rev": "c3aa7b8938b17aebd2deecf7be0636000d62a2b9",


     

       
340

       
+

       
        "type": "github"


     

       
341

       
+

       
      },


     

       
342

       
+

       
      "original": {


     

       
343

       
+

       
        "id": "nixpkgs",


     

       
344

       
+

       
        "ref": "nixos-unstable",


     

       
345

       
+

       
        "type": "indirect"


     

       
346

       
 

       
      }


     

       
347

       
 

       
    },


     

       
348

       
 

       
    "nixpkgs_2": {


     

       
349

       
 

       
      "locked": {


     

       
350

       
+

       
        "lastModified": 1760524057,


     

       
351

       
+

       
        "narHash": "sha256-EVAqOteLBFmd7pKkb0+FIUyzTF61VKi7YmvP1tw4nEw=",


     

       
352

       
 

       
        "owner": "NixOS",


     

       
353

       
 

       
        "repo": "nixpkgs",


     

       
354

       
+

       
        "rev": "544961dfcce86422ba200ed9a0b00dd4b1486ec5",


     

       
355

       
 

       
        "type": "github"


     

       
356

       
 

       
      },


     

       
357

       
 

       
      "original": {


     
···

       
379

       
 

       
    },


     

       
380

       
 

       
    "nixpkgs_4": {


     

       
381

       
 

       
      "locked": {


     

       
382

       
+

       
        "lastModified": 1761016216,


     

       
383

       
+

       
        "narHash": "sha256-G/iC4t/9j/52i/nm+0/4ybBmAF4hzR8CNHC75qEhjHo=",


     

       
384

       
 

       
        "owner": "nixos",


     

       
385

       
 

       
        "repo": "nixpkgs",


     

       
386

       
+

       
        "rev": "481cf557888e05d3128a76f14c76397b7d7cc869",


     

       
387

       
 

       
        "type": "github"


     

       
388

       
 

       
      },


     

       
389

       
 

       
      "original": {


     

       
390

       
 

       
        "owner": "nixos",


     

       
391

       
+

       
        "ref": "nixos-25.05",


     

       
392

       
 

       
        "repo": "nixpkgs",


     

       
393

       
 

       
        "type": "github"


     

       
394

       
 

       
      }


     
···

       
407

       
 

       
        "type": "indirect"


     

       
408

       
 

       
      }


     

       
409

       
 

       
    },


     

       
410

       
+

       
    "proxmox-nixos": {


     

       
411

       
+

       
      "inputs": {


     

       
412

       
+

       
        "flake-compat": "flake-compat",


     

       
413

       
+

       
        "nixpkgs-stable": "nixpkgs-stable",


     

       
414

       
+

       
        "nixpkgs-unstable": "nixpkgs-unstable",


     

       
415

       
+

       
        "utils": "utils"


     

       
416

       
+

       
      },


     

       
417

       
+

       
      "locked": {


     

       
418

       
+

       
        "lastModified": 1758650077,


     

       
419

       
+

       
        "narHash": "sha256-ZeRtJimtk0Faiq7DPZEQNGipda3TaR4QXp0TAzu934Q=",


     

       
420

       
+

       
        "owner": "SaumonNet",


     

       
421

       
+

       
        "repo": "proxmox-nixos",


     

       
422

       
+

       
        "rev": "ce8768f43b4374287cd8b88d8fa9c0061e749d9a",


     

       
423

       
+

       
        "type": "github"


     

       
424

       
+

       
      },


     

       
425

       
+

       
      "original": {


     

       
426

       
+

       
        "owner": "SaumonNet",


     

       
427

       
+

       
        "repo": "proxmox-nixos",


     

       
428

       
+

       
        "type": "github"


     

       
429

       
+

       
      }


     

       
430

       
+

       
    },


     

       
431

       
 

       
    "root": {


     

       
432

       
 

       
      "inputs": {


     

       
433

       
 

       
        "agenix": "agenix",


     
···

       
438

       
 

       
        "microvm": "microvm",


     

       
439

       
 

       
        "nixos-hardware": "nixos-hardware",


     

       
440

       
 

       
        "nixpkgs": "nixpkgs_4",


     

       
441

       
+

       
        "proxmox-nixos": "proxmox-nixos",


     

       
442

       
 

       
        "vscode-server": "vscode-server",


     

       
443

       
 

       
        "zen-browser": "zen-browser"


     

       
444

       
 

       
      }


     
···

       
446

       
 

       
    "spectrum": {


     

       
447

       
 

       
      "flake": false,


     

       
448

       
 

       
      "locked": {


     

       
449

       
+

       
        "lastModified": 1759482047,


     

       
450

       
+

       
        "narHash": "sha256-H1wiXRQHxxPyMMlP39ce3ROKCwI5/tUn36P8x6dFiiQ=",


     

       
451

       
 

       
        "ref": "refs/heads/main",


     

       
452

       
+

       
        "rev": "c5d5786d3dc938af0b279c542d1e43bce381b4b9",


     

       
453

       
+

       
        "revCount": 996,


     

       
454

       
 

       
        "type": "git",


     

       
455

       
 

       
        "url": "https://spectrum-os.org/git/spectrum"


     

       
456

       
 

       
      },


     
···

       
519

       
 

       
        "type": "github"


     

       
520

       
 

       
      }


     

       
521

       
 

       
    },


     

       
522

       
+

       
    "systems_5": {


     

       
523

       
+

       
      "locked": {


     

       
524

       
+

       
        "lastModified": 1681028828,


     

       
525

       
+

       
        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",


     

       
526

       
+

       
        "owner": "nix-systems",


     

       
527

       
+

       
        "repo": "default",


     

       
528

       
+

       
        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",


     

       
529

       
+

       
        "type": "github"


     

       
530

       
+

       
      },


     

       
531

       
+

       
      "original": {


     

       
532

       
+

       
        "owner": "nix-systems",


     

       
533

       
+

       
        "repo": "default",


     

       
534

       
+

       
        "type": "github"


     

       
535

       
+

       
      }


     

       
536

       
+

       
    },


     

       
537

       
+

       
    "utils": {


     

       
538

       
+

       
      "inputs": {


     

       
539

       
+

       
        "systems": "systems_4"


     

       
540

       
+

       
      },


     

       
541

       
+

       
      "locked": {


     

       
542

       
+

       
        "lastModified": 1710146030,


     

       
543

       
+

       
        "narHash": "sha256-SZ5L6eA7HJ/nmkzGG7/ISclqe6oZdOZTNoesiInkXPQ=",


     

       
544

       
+

       
        "owner": "numtide",


     

       
545

       
+

       
        "repo": "flake-utils",


     

       
546

       
+

       
        "rev": "b1d9ab70662946ef0850d488da1c9019f3a9752a",


     

       
547

       
+

       
        "type": "github"


     

       
548

       
+

       
      },


     

       
549

       
+

       
      "original": {


     

       
550

       
+

       
        "owner": "numtide",


     

       
551

       
+

       
        "repo": "flake-utils",


     

       
552

       
+

       
        "type": "github"


     

       
553

       
+

       
      }


     

       
554

       
+

       
    },


     

       
555

       
 

       
    "vscode-server": {


     

       
556

       
 

       
      "inputs": {


     

       
557

       
 

       
        "flake-utils": "flake-utils_3",


     

       
558

       
 

       
        "nixpkgs": "nixpkgs_5"


     

       
559

       
 

       
      },


     

       
560

       
 

       
      "locked": {


     

       
561

       
+

       
        "lastModified": 1753541826,


     

       
562

       
+

       
        "narHash": "sha256-foGgZu8+bCNIGeuDqQ84jNbmKZpd+JvnrL2WlyU4tuU=",


     

       
563

       
 

       
        "owner": "nix-community",


     

       
564

       
 

       
        "repo": "nixos-vscode-server",


     

       
565

       
+

       
        "rev": "6d5f074e4811d143d44169ba4af09b20ddb6937d",


     

       
566

       
 

       
        "type": "github"


     

       
567

       
 

       
      },


     

       
568

       
 

       
      "original": {


     
···

       
579

       
 

       
        ]


     

       
580

       
 

       
      },


     

       
581

       
 

       
      "locked": {


     

       
582

       
+

       
        "lastModified": 1761180075,


     

       
583

       
+

       
        "narHash": "sha256-V4WLeUQ4gCGZiVihlXWBOZ/1FNcL0jM4zgTY1haJLvY=",


     

       
584

       
 

       
        "owner": "0xc000022070",


     

       
585

       
 

       
        "repo": "zen-browser-flake",


     

       
586

       
+

       
        "rev": "771a2604606905d8c0ffe3b818dc2cc5bd1405d8",


     

       
587

       
 

       
        "type": "github"


     

       
588

       
 

       
      },


     

       
589

       
 

       
      "original": {
+17 -3
flake.nix 
···

       
1

       
 

       
# flake.nix


     

       
2

       
 

       
{


     

       
3

       
 

       
  inputs = {


     

       
4

       
-

       
    nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";


     

       
5

       
 

       
    nixos-hardware.url = "github:nixos/nixos-hardware/master";


     

       
6

       
 

       



     

       

       

       
     

       

       

       
     

       
7

       
 

       
    lix-module = {


     

       
8

       
-

       
      url = "https://git.lix.systems/lix-project/nixos-module/archive/2.93.0.tar.gz";


     

       
9

       
 

       
      inputs.nixpkgs.follows = "nixpkgs";


     

       
10

       
 

       
    };


     

       
11

       
 

       



     
···

       
83

       
 

       
            ./hosts/valefar


     

       
84

       
 

       
            lix-module.nixosModules.default


     

       
85

       
 

       
            vscode-server.nixosModules.default


     

       
86

       
-

       
            microvm.nixosModules.host


     

       
87

       
 

       
            


     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       
88

       
 

       
            { imports = builtins.attrValues nixosModules; }


     

       
89

       
 

       
          ];


     

       
90

       
 

       
        };


     
···

       
1

       
 

       
# flake.nix


     

       
2

       
 

       
{


     

       
3

       
 

       
  inputs = {


     

       
4

       
+

       
    nixpkgs.url = "github:nixos/nixpkgs/nixos-25.05";


     

       
5

       
 

       
    nixos-hardware.url = "github:nixos/nixos-hardware/master";


     

       
6

       
 

       



     

       
7

       
+

       
    proxmox-nixos.url = "github:SaumonNet/proxmox-nixos";


     

       
8

       
+

       



     

       
9

       
 

       
    lix-module = {


     

       
10

       
+

       
      url = "https://git.lix.systems/lix-project/nixos-module/archive/2.93.3-1.tar.gz";


     

       
11

       
 

       
      inputs.nixpkgs.follows = "nixpkgs";


     

       
12

       
 

       
    };


     

       
13

       
 

       



     
···

       
85

       
 

       
            ./hosts/valefar


     

       
86

       
 

       
            lix-module.nixosModules.default


     

       
87

       
 

       
            vscode-server.nixosModules.default


     

       

       

       
     

       
88

       
 

       
            


     

       
89

       
+

       
            proxmox-nixos.nixosModules.proxmox-ve


     

       
90

       
+

       



     

       
91

       
+

       
            ({ pkgs, lib, ... }: {


     

       
92

       
+

       
              services.proxmox-ve = {


     

       
93

       
+

       
                enable = true;


     

       
94

       
+

       
                ipAddress = "10.0.0.30";


     

       
95

       
+

       
              };


     

       
96

       
+

       



     

       
97

       
+

       
              nixpkgs.overlays = [


     

       
98

       
+

       
                proxmox-nixos.overlays.x86_64-linux


     

       
99

       
+

       
              ];


     

       
100

       
+

       
            }) 


     

       
101

       
+

       



     

       
102

       
 

       
            { imports = builtins.attrValues nixosModules; }


     

       
103

       
 

       
          ];


     

       
104

       
 

       
        };
+16
hosts/baal/default.nix 
···

       
33

       
 

       
    networkmanager.enable = true;


     

       
34

       
 

       
  };


     

       
35

       
 

       



     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       
36

       
 

       
  virtualisation.docker = {


     

       
37

       
 

       
    enable = true;


     

       
38

       
 

       
    enableOnBoot = true;


     
···

       
33

       
 

       
    networkmanager.enable = true;


     

       
34

       
 

       
  };


     

       
35

       
 

       



     

       
36

       
+

       
    services.fail2ban = {


     

       
37

       
+

       
    enable = true;


     

       
38

       
+

       
    # Ban IP after 5 failures


     

       
39

       
+

       
    maxretry = 5;


     

       
40

       
+

       
    ignoreIP = [


     

       
41

       
+

       
      "10.0.0.0/8" "172.16.0.0/12" "192.168.0.0/16" "100.64.0.0/10"


     

       
42

       
+

       
    ];


     

       
43

       
+

       
    bantime = "24h"; # Ban IPs for one day on the first ban


     

       
44

       
+

       
    bantime-increment = {


     

       
45

       
+

       
      enable = true; # Enable increment of bantime after each violation


     

       
46

       
+

       
      multipliers = "1 2 4 8 16 32 64";


     

       
47

       
+

       
      maxtime = "168h"; # Do not ban for more than 1 week


     

       
48

       
+

       
      overalljails = true; # Calculate the bantime based on all the violations


     

       
49

       
+

       
    };


     

       
50

       
+

       
  };


     

       
51

       
+

       



     

       
52

       
 

       
  virtualisation.docker = {


     

       
53

       
 

       
    enable = true;


     

       
54

       
 

       
    enableOnBoot = true;
+16
hosts/buer/default.nix 
···

       
66

       
 

       
    useDHCP = false;


     

       
67

       
 

       
  };


     

       
68

       
 

       



     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       
69

       
 

       
  # Static IP configuration via systemd-networkd


     

       
70

       
 

       
  systemd.network = {


     

       
71

       
 

       
    enable = true;


     
···

       
66

       
 

       
    useDHCP = false;


     

       
67

       
 

       
  };


     

       
68

       
 

       



     

       
69

       
+

       
    services.fail2ban = {


     

       
70

       
+

       
    enable = true;


     

       
71

       
+

       
    # Ban IP after 5 failures


     

       
72

       
+

       
    maxretry = 5;


     

       
73

       
+

       
    ignoreIP = [


     

       
74

       
+

       
      "10.0.0.0/8" "172.16.0.0/12" "192.168.0.0/16" "100.64.0.0/10"


     

       
75

       
+

       
    ];


     

       
76

       
+

       
    bantime = "24h"; # Ban IPs for one day on the first ban


     

       
77

       
+

       
    bantime-increment = {


     

       
78

       
+

       
      enable = true; # Enable increment of bantime after each violation


     

       
79

       
+

       
      multipliers = "1 2 4 8 16 32 64";


     

       
80

       
+

       
      maxtime = "168h"; # Do not ban for more than 1 week


     

       
81

       
+

       
      overalljails = true; # Calculate the bantime based on all the violations


     

       
82

       
+

       
    };


     

       
83

       
+

       
  };


     

       
84

       
+

       



     

       
85

       
 

       
  # Static IP configuration via systemd-networkd


     

       
86

       
 

       
  systemd.network = {


     

       
87

       
 

       
    enable = true;
-3
hosts/focalor/default.nix 
···

       
136

       
 

       
  virtualisation.docker = {


     

       
137

       
 

       
    enable = true;


     

       
138

       
 

       
    enableOnBoot = true;


     

       
139

       
-

       
    package = pkgs.docker.override {


     

       
140

       
-

       
      buildGoModule = pkgs.buildGo123Module;


     

       
141

       
-

       
    };


     

       
142

       
 

       
  };


     

       
143

       
 

       



     

       
144

       
 

       
  # =============================================================================


     
···

       
136

       
 

       
  virtualisation.docker = {


     

       
137

       
 

       
    enable = true;


     

       
138

       
 

       
    enableOnBoot = true;


     

       

       

       
     

       

       

       
     

       

       

       
     

       
139

       
 

       
  };


     

       
140

       
 

       



     

       
141

       
 

       
  # =============================================================================
-7
hosts/focalor/vfio.nix 
···

       
9

       
 

       
      package = pkgs.qemu_kvm;


     

       
10

       
 

       
      runAsRoot = true;


     

       
11

       
 

       
      swtpm.enable = true;


     

       
12

       
-

       
      ovmf = {


     

       
13

       
-

       
        enable = true;


     

       
14

       
-

       
        packages = [(pkgs.OVMF.override {


     

       
15

       
-

       
          secureBoot = true;


     

       
16

       
-

       
          tpmSupport = true;


     

       
17

       
-

       
        }).fd];


     

       
18

       
-

       
      };


     

       
19

       
 

       
    };


     

       
20

       
 

       
    hooks.qemu = {


     

       
21

       
 

       
      win11 = ./scripts/vm-win11-hook.sh;


     
···

       
9

       
 

       
      package = pkgs.qemu_kvm;


     

       
10

       
 

       
      runAsRoot = true;


     

       
11

       
 

       
      swtpm.enable = true;


     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       
12

       
 

       
    };


     

       
13

       
 

       
    hooks.qemu = {


     

       
14

       
 

       
      win11 = ./scripts/vm-win11-hook.sh;
+29 -10
hosts/valefar/default.nix 
···

       
5

       
 

       
  # IMPORTS


     

       
6

       
 

       
  # =============================================================================


     

       
7

       
 

       
  imports = [


     

       
8

       
-

       
    # Host-specific hardware


     

       
9

       
 

       
    ./hardware.nix


     

       
10

       
 

       
    ./secrets.nix


     

       
11

       
 

       
    ../../common/nvidia.nix


     

       
12

       
 

       



     

       
13

       
-

       
    # Common secrets


     

       
14

       
 

       
    ../../host-secrets.nix


     

       
15

       
 

       
    


     

       
16

       
-

       
    # Common modules shared across hosts


     

       
17

       
 

       
    ../../common/system.nix


     

       
18

       
 

       
    ../../common/users.nix


     

       
19

       
 

       
    ../../common/services.nix


     

       
20

       
 

       
    ../../common/efi.nix


     

       
21

       
 

       
    


     

       
22

       
-

       
    # Hardware-specific (commented out)


     

       
23

       
 

       
    ../../common/nvidia.nix


     

       
24

       
 

       
  ];


     

       
25

       
 

       



     
···

       
59

       
 

       
  networking.hostId = "2a07da90";


     

       
60

       
 

       
  networking.firewall.enable = false;


     

       
61

       
 

       



     

       

       

       
     

       

       

       
     

       
62

       
 

       
  systemd.network.networks."10-lan" = {


     

       
63

       
-

       
    matchConfig.Name = ["enp6s0" "vm-*"];


     

       
64

       
 

       
    networkConfig = {


     

       
65

       
-

       
      Bridge = "br0";


     

       
66

       
 

       
    };


     

       
67

       
 

       
  };


     

       
68

       
 

       
  systemd.network.netdevs."br0" = {


     

       
69

       
 

       
    netdevConfig = {


     

       
70

       
-

       
      Name = "br0";


     

       
71

       
 

       
      Kind = "bridge";


     

       
72

       
 

       
    };


     

       
73

       
 

       
  };


     

       
74

       
 

       



     

       
75

       
 

       
  systemd.network.networks."10-lan-bridge" = {


     

       
76

       
-

       
    matchConfig.Name = "br0";


     

       
77

       
 

       
    networkConfig = {


     

       
78

       
 

       
      Address = ["10.0.0.30/24" "2601:5c2:8400:26c0::30/64"];


     

       
79

       
 

       
      Gateway = "10.0.0.1";


     
···

       
245

       
 

       
    nodejsPackage = pkgs.nodejs_20;


     

       
246

       
 

       
  };


     

       
247

       
 

       



     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       
248

       
 

       
  # =============================================================================


     

       
249

       
 

       
  # VIRTUALIZATION


     

       
250

       
 

       
  # =============================================================================


     

       
251

       
 

       
  virtualisation.docker = {


     

       
252

       
 

       
    enable = true;


     

       
253

       
 

       
    enableOnBoot = true;


     

       
254

       
-

       
    package = pkgs.docker.override {


     

       
255

       
-

       
      buildGoModule = pkgs.buildGo123Module;


     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       

       

       
     

       
256

       
 

       
    };


     

       
257

       
 

       
  };


     

       
258

       
 

       



     
···

       
5

       
 

       
  # IMPORTS


     

       
6

       
 

       
  # =============================================================================


     

       
7

       
 

       
  imports = [


     

       

       

       
     

       
8

       
 

       
    ./hardware.nix


     

       
9

       
 

       
    ./secrets.nix


     

       
10

       
 

       
    ../../common/nvidia.nix


     

       
11

       
 

       



     

       

       

       
     

       
12

       
 

       
    ../../host-secrets.nix


     

       
13

       
 

       
    


     

       

       

       
     

       
14

       
 

       
    ../../common/system.nix


     

       
15

       
 

       
    ../../common/users.nix


     

       
16

       
 

       
    ../../common/services.nix


     

       
17

       
 

       
    ../../common/efi.nix


     

       
18

       
 

       
    


     

       

       

       
     

       
19

       
 

       
    ../../common/nvidia.nix


     

       
20

       
 

       
  ];


     

       
21

       
 

       



     
···

       
55

       
 

       
  networking.hostId = "2a07da90";


     

       
56

       
 

       
  networking.firewall.enable = false;


     

       
57

       
 

       



     

       
58

       
+

       
  services.proxmox-ve.bridges = [ "vmbr0" ];


     

       
59

       
+

       



     

       
60

       
 

       
  systemd.network.networks."10-lan" = {


     

       
61

       
+

       
    matchConfig.Name = ["enp6s0"];


     

       
62

       
 

       
    networkConfig = {


     

       
63

       
+

       
      Bridge = "vmbr0";


     

       
64

       
 

       
    };


     

       
65

       
 

       
  };


     

       
66

       
 

       
  systemd.network.netdevs."br0" = {


     

       
67

       
 

       
    netdevConfig = {


     

       
68

       
+

       
      Name = "vmbr0";


     

       
69

       
 

       
      Kind = "bridge";


     

       
70

       
 

       
    };


     

       
71

       
 

       
  };


     

       
72

       
 

       



     

       
73

       
 

       
  systemd.network.networks."10-lan-bridge" = {


     

       
74

       
+

       
    matchConfig.Name = "vmbr0";


     

       
75

       
 

       
    networkConfig = {


     

       
76

       
 

       
      Address = ["10.0.0.30/24" "2601:5c2:8400:26c0::30/64"];


     

       
77

       
 

       
      Gateway = "10.0.0.1";


     
···

       
243

       
 

       
    nodejsPackage = pkgs.nodejs_20;


     

       
244

       
 

       
  };


     

       
245

       
 

       



     

       
246

       
+

       
  services.ollama = {


     

       
247

       
+

       
    enable = true;


     

       
248

       
+

       
    loadModels = ["deepseek-r1:1.5b" "gemma3:12b"];


     

       
249

       
+

       
    acceleration = "cuda";


     

       
250

       
+

       
  };


     

       
251

       
+

       



     

       
252

       
+

       
  services.open-webui.enable = true;


     

       
253

       
+

       



     

       
254

       
 

       
  # =============================================================================


     

       
255

       
 

       
  # VIRTUALIZATION


     

       
256

       
 

       
  # =============================================================================


     

       
257

       
 

       
  virtualisation.docker = {


     

       
258

       
 

       
    enable = true;


     

       
259

       
 

       
    enableOnBoot = true;


     

       
260

       
+

       
  };


     

       
261

       
+

       



     

       
262

       
+

       
  services.fail2ban = {


     

       
263

       
+

       
    enable = true;


     

       
264

       
+

       
    # Ban IP after 5 failures


     

       
265

       
+

       
    maxretry = 5;


     

       
266

       
+

       
    ignoreIP = [


     

       
267

       
+

       
      "10.0.0.0/8" "172.16.0.0/12" "192.168.0.0/16" "100.64.0.0/10"


     

       
268

       
+

       
    ];


     

       
269

       
+

       
    bantime = "24h"; # Ban IPs for one day on the first ban


     

       
270

       
+

       
    bantime-increment = {


     

       
271

       
+

       
      enable = true; # Enable increment of bantime after each violation


     

       
272

       
+

       
      multipliers = "1 2 4 8 16 32 64";


     

       
273

       
+

       
      maxtime = "168h"; # Do not ban for more than 1 week


     

       
274

       
+

       
      overalljails = true; # Calculate the bantime based on all the violations


     

       
275

       
 

       
    };


     

       
276

       
 

       
  };


     

       
277
-80
hosts/valefar/gamevm.nix 
···

       
1

       
-

       
{ config, lib, pkgs, modulesPath, microvm, inputs, ... }:


     

       
2

       
-

       



     

       
3

       
-

       
{


     

       
4

       
-

       
  # =============================================================================


     

       
5

       
-

       
  # IMPORTS


     

       
6

       
-

       
  # =============================================================================


     

       
7

       
-

       
  imports = [


     

       
8

       
-

       
      # Common modules shared across hosts


     

       
9

       
-

       
    ../../common/system.nix


     

       
10

       
-

       
    ../../common/users.nix


     

       
11

       
-

       
    ../../common/services.nix


     

       
12

       
-

       
  ];


     

       
13

       
-

       



     

       
14

       
-

       
  system.stateVersion = "25.05";


     

       
15

       
-

       
  networking.hostName = "gameservers";


     

       
16

       
-

       



     

       
17

       
-

       
  virtualisation.docker = {


     

       
18

       
-

       
    enable = true;


     

       
19

       
-

       
    enableOnBoot = true;


     

       
20

       
-

       
  };


     

       
21

       
-

       



     

       
22

       
-

       
  systemd.network.networks."20-lan" = {


     

       
23

       
-

       
    matchConfig.Type = "ether";


     

       
24

       
-

       
    networkConfig = {


     

       
25

       
-

       
      Address = [


     

       
26

       
-

       
        "10.0.0.31/24"


     

       
27

       
-

       
        "2601:5c2:8400:26c0::31/64"


     

       
28

       
-

       
      ];


     

       
29

       
-

       
      Gateway = "10.0.0.1";


     

       
30

       
-

       
      DNS = [


     

       
31

       
-

       
        "10.0.0.210"


     

       
32

       
-

       
        "1.1.1.1"


     

       
33

       
-

       
        "1.0.0.1"


     

       
34

       
-

       
      ];


     

       
35

       
-

       
      IPv6AcceptRA = true;


     

       
36

       
-

       
      DHCP = "no";


     

       
37

       
-

       
    };


     

       
38

       
-

       
  };


     

       
39

       
-

       



     

       
40

       
-

       
  systemd.network.networks."19-docker" = {


     

       
41

       
-

       
    matchConfig.Name = "veth*";


     

       
42

       
-

       
    linkConfig = {


     

       
43

       
-

       
      Unmanaged = true;


     

       
44

       
-

       
    };


     

       
45

       
-

       
  };


     

       
46

       
-

       



     

       
47

       
-

       
  microvm = {


     

       
48

       
-

       
    interfaces = [


     

       
49

       
-

       
      {


     

       
50

       
-

       
        type = "tap";


     

       
51

       
-

       
        id = "vm-test1";


     

       
52

       
-

       
        mac = "02:00:00:00:00:01";


     

       
53

       
-

       
      }


     

       
54

       
-

       
    ];


     

       
55

       
-

       



     

       
56

       
-

       
    shares = [


     

       
57

       
-

       
      {


     

       
58

       
-

       
        source = "/nix/store";


     

       
59

       
-

       
        mountPoint = "/nix/.ro-store";


     

       
60

       
-

       
        tag = "ro-store";


     

       
61

       
-

       
        proto = "virtiofs";


     

       
62

       
-

       
      }


     

       
63

       
-

       
      {


     

       
64

       
-

       
        source = "/etc/ssh";


     

       
65

       
-

       
        mountPoint = "/etc/ssh";


     

       
66

       
-

       
        tag = "ssh";


     

       
67

       
-

       
        proto = "virtiofs";


     

       
68

       
-

       
      }


     

       
69

       
-

       
      {


     

       
70

       
-

       
        source = "/home/regent/gamedata";


     

       
71

       
-

       
        mountPoint = "/root/gamedata";


     

       
72

       
-

       
        tag = "gamedata";


     

       
73

       
-

       
        proto = "virtiofs";


     

       
74

       
-

       
      }


     

       
75

       
-

       
    ];


     

       
76

       
-

       



     

       
77

       
-

       
    vcpu = 4;


     

       
78

       
-

       
    mem = 8192;


     

       
79

       
-

       
  };


     

       
80

       
-

       
}

     
···