summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
Diffstat
-rw-r--r--common.nix133
-rw-r--r--neko/configuration.nix7
-rw-r--r--neko/hardware-configuration.nix50
3 files changed, 71 insertions, 119 deletions
diff --git a/common.nix b/common.nix
index b959dda..8ad9303 100644
--- a/common.nix
+++ b/common.nix
@@ -19,16 +19,18 @@ in
# This value determines the NixOS release from which the default
# settings for stateful data, like file locations and database versions
- # on your system were taken. It‘s perfectly fine and recommended to leave
+ # on your system were taken. It's perfectly fine and recommended to leave
# this value at the release version of the first install of this system.
# Before changing this value read the documentation for this option
# (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
- system.stateVersion = "22.11"; # Did you read the comment?
+ system.stateVersion = "23.05"; # Did you read the comment?
+
+ # use the latest kernel
+ boot.kernelPackages = pkgs.linuxPackages_latest;
# Use the systemd-boot EFI boot loader.
boot.loader.systemd-boot.enable = true;
boot.loader.efi.canTouchEfiVariables = true;
- boot.loader.efi.efiSysMountPoint = "/boot";
# use a high resolution
boot.loader.systemd-boot.consoleMode = "max";
@@ -39,52 +41,6 @@ in
# setup the console stuff early
console.earlySetup = true;
- # zfs & NTFS for Windows stuff
- boot.kernelPackages = config.boot.zfs.package.latestCompatibleLinuxPackages;
- boot.supportedFilesystems = [ "zfs" "ntfs" ];
- services.zfs.autoScrub.enable = true;
- services.zfs.trim.enable = true;
-
- # persistent nix
- fileSystems."/nix" = {
- device = "zroot/nix";
- fsType = "zfs";
- };
-
- # persistent homes
- fileSystems."/home" = {
- device = "zroot/home";
- fsType = "zfs";
- };
-
- # non persistent root
- fileSystems."/" = {
- device = "none";
- fsType = "tmpfs";
- options = [ "defaults" "size=8G" "mode=755" ];
- };
-
- # bind mount persistent nixos config, per host different
- fileSystems."/etc/nixos" = {
- device = "/home/cullmann/install/nixos/${config.networking.hostName}";
- options = [ "bind" ];
- };
-
- # bind mount persistent root home
- fileSystems."/root" = {
- device = "/home/root";
- options = [ "bind" ];
- };
-
- # some stuff is needed to early for environment.persistence
- environment.etc = {
- # stable host keys
- "ssh/ssh_host_rsa_key".source = "/nix/persistent/ssh_host_rsa_key";
- "ssh/ssh_host_rsa_key.pub".source = "/nix/persistent/ssh_host_rsa_key.pub";
- "ssh/ssh_host_ed25519_key".source = "/nix/persistent/ssh_host_ed25519_key";
- "ssh/ssh_host_ed25519_key.pub".source = "/nix/persistent/ssh_host_ed25519_key.pub";
- };
-
# keep some stuff persistent
environment.persistence."/nix/persistent" = {
directories = [
@@ -104,41 +60,25 @@ in
# ensure firewall is up, allow ssh and http in
networking.firewall.enable = true;
- networking.firewall.allowedTCPPorts = [ 22 80 ];
+ networking.firewall.logRefusedConnections = false;
- # secure dns with local resolve via fritz.box
- networking = {
- nameservers = [ "127.0.0.1" "::1" ];
- dhcpcd.extraConfig = "nohook resolv.conf";
- resolvconf.useLocalResolver = true;
- };
- environment.etc = {
- forwarding_rules = {
- text = ''
- fritz.box 192.168.13.1
- '';
- };
- };
- services.dnscrypt-proxy2 = {
+ # OpenSSH daemon config
+ services.openssh = {
+ # enable with public key only auth
enable = true;
- settings = {
- ipv6_servers = true;
- require_dnssec = true;
- sources.public-resolvers = {
- urls = [
- "https://raw.githubusercontent.com/DNSCrypt/dnscrypt-resolvers/master/v3/public-resolvers.md"
- "https://download.dnscrypt.info/resolvers-list/v3/public-resolvers.md"
- ];
- cache_file = "/nix/persistent/public-resolvers.md";
- minisign_key = "RWQf6LRCGA9i53mlYecO4IzT51TGPpvWucNSCh1CBM0QTaLn73Y7GFO3";
- };
- forwarding_rules = "/etc/forwarding_rules";
- };
- };
- systemd.services.dnscrypt-proxy2.serviceConfig = {
- StateDirectory = "dnscrypt-proxy";
+ settings.PasswordAuthentication = false;
+ settings.KbdInteractiveAuthentication = false;
+
+ # only ed25519 keys, make them persistent
+ hostKeys = [{
+ path = "/nix/persistent/ssh_host_ed25519_key";
+ type = "ed25519";
+ }];
};
+ # guard the ssh service
+ services.sshguard.enable = true;
+
# block some crap, see https://github.com/StevenBlack/hosts#nixos
networking.extraHosts = let
hostsPath = https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts;
@@ -305,14 +245,6 @@ in
# proper lutris gaming for 32-bit stuff
hardware.opengl.driSupport32Bit = true;
- # Enable the OpenSSH daemon.
- services.openssh = {
- enable = true;
- startWhenNeeded = true;
- settings.PasswordAuthentication = false;
- settings.PermitRootLogin = "yes";
- };
-
# virus scanner, we only want the updater running
services.clamav.updater.enable = true;
@@ -334,8 +266,8 @@ in
from = "noreply@home.local";
host = "babylon2k.com";
port = "587";
- user = builtins.readFile "/home/root/nixos/mailuser";
- password = builtins.readFile "/home/root/nixos/mailpassword";
+ user = builtins.readFile "/data/nixos/mailuser.secret";
+ password = builtins.readFile "/data/nixos/mailpassword.secret";
};
};
defaults = {
@@ -352,20 +284,6 @@ in
};
};
- # allow the ZFS service to send mails
- services.zfs.zed.settings = {
- ZED_DEBUG_LOG = "/tmp/zed.debug.log";
- ZED_EMAIL_ADDR = [ "root" ];
- ZED_EMAIL_PROG = "${pkgs.msmtp}/bin/msmtp";
- ZED_EMAIL_OPTS = "@ADDRESS@";
-
- ZED_NOTIFY_INTERVAL_SECS = 3600;
- ZED_NOTIFY_VERBOSE = true;
-
- ZED_USE_ENCLOSURE_LEDS = true;
- ZED_SCRUB_AFTER_RESILVER = true;
- };
-
# use ZSH per default
users.defaultUserShell = pkgs.zsh;
@@ -397,9 +315,6 @@ in
Defaults lecture = never
'';
- # use some small web server to have easy file sharing at home
- services.nginx.enable = true;
-
# no need for upower
services.upower.enable = pkgs.lib.mkForce false;
@@ -422,7 +337,7 @@ in
users.users.root = {
# init password
- hashedPassword = builtins.readFile "/home/root/nixos/passwd";
+ hashedPassword = builtins.readFile "/data/nixos/password.secret";
# use same keys as my main user
openssh.authorizedKeys.keys = pkgs.lib.splitString "\n" (builtins.readFile "/home/cullmann/.ssh/authorized_keys");
@@ -462,7 +377,7 @@ in
extraGroups = [ "wheel" ];
# init password
- hashedPassword = builtins.readFile "/home/root/nixos/passwd";
+ hashedPassword = builtins.readFile "/data/nixos/password.secret";
};
home-manager.users.cullmann = { pkgs, ... }: {
diff --git a/neko/configuration.nix b/neko/configuration.nix
index fe794fa..7b8f3e8 100644
--- a/neko/configuration.nix
+++ b/neko/configuration.nix
@@ -1,6 +1,6 @@
# Edit this configuration file to define what should be installed on
# your system. Help is available in the configuration.nix(5) man page
-# and in the NixOS manual (accessible by running ‘nixos-help’).
+# and in the NixOS manual (accessible by running `nixos-help`).
{ config, pkgs, ... }:
@@ -11,10 +11,9 @@
./hardware-configuration.nix
# Shared config of all machines
- /home/cullmann/install/nixos/common.nix
+ /data/nixos/common.nix
];
- # host name & id
+ # host name
networking.hostName = "neko";
- networking.hostId = "eb707291";
}
diff --git a/neko/hardware-configuration.nix b/neko/hardware-configuration.nix
index 99d8b67..27a1a93 100644
--- a/neko/hardware-configuration.nix
+++ b/neko/hardware-configuration.nix
@@ -9,26 +9,64 @@
];
boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "nvme" "usbhid" "usb_storage" "sd_mod" ];
- boot.initrd.kernelModules = [ "i915" ];
+ boot.initrd.kernelModules = [ ];
boot.kernelModules = [ "kvm-intel" ];
boot.extraModulePackages = [ ];
- # Intel ARC
- boot.kernelParams = [ "i915.force_probe=56a0" "i915.enable_guc=1" ];
+ fileSystems."/" =
+ { device = "none";
+ fsType = "tmpfs";
+ };
fileSystems."/boot" =
- { device = "/dev/disk/by-uuid/9CF2-12FF";
+ { device = "/dev/disk/by-uuid/D6ED-7B8C";
fsType = "vfat";
};
fileSystems."/boot-fallback" =
- { device = "/dev/disk/by-uuid/9CF2-9E07";
+ { device = "/dev/disk/by-uuid/D6ED-BC4A";
fsType = "vfat";
};
+ boot.initrd.luks.devices."crypt-disk1".device = "/dev/disk/by-uuid/d24c36a7-d39c-4de5-8fc0-33ff0262e964";
+ boot.initrd.luks.devices."crypt-disk1".allowDiscards = true;
+ boot.initrd.luks.devices."crypt-disk1".bypassWorkqueues = true;
+ boot.initrd.luks.devices."crypt-disk2".device = "/dev/disk/by-uuid/cde8caa0-be38-4ff8-a3b3-aa82bc587550";
+ boot.initrd.luks.devices."crypt-disk2".allowDiscards = true;
+ boot.initrd.luks.devices."crypt-disk2".bypassWorkqueues = true;
+
+ fileSystems."/nix" =
+ { device = "/dev/mapper/crypt-disk1";
+ fsType = "btrfs";
+ options = [ "device=/dev/mapper/crypt-disk2" "subvol=nix" "noatime" "compress=zstd" ];
+ };
+
+ fileSystems."/data" =
+ { device = "/dev/mapper/crypt-disk1";
+ fsType = "btrfs";
+ options = [ "device=/dev/mapper/crypt-disk2" "subvol=data" "noatime" "compress=zstd" ];
+ };
+
+ fileSystems."/home" =
+ { device = "/data/home";
+ fsType = "none";
+ options = [ "bind" ];
+ };
+
+ fileSystems."/root" =
+ { device = "/data/root";
+ fsType = "none";
+ options = [ "bind" ];
+ };
+
+ fileSystems."/etc/nixos" =
+ { device = "/data/nixos/neko";
+ fsType = "none";
+ options = [ "bind" ];
+ };
+
swapDevices = [ ];
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
- powerManagement.cpuFreqGovernor = lib.mkDefault "powersave";
hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
}
generated by cgit v1.2.3 (git 2.25.1) at 2024-09-19 23:50:11 +0000