JuliusFreudenberger/nix-config
1
0
Fork 0
Code Issues 1 Pull requests 1 Projects Releases Packages Wiki Activity Actions

Compare commits

base: JuliusFreudenberger:578386193bb95464ee6f834591cd82dfef430da3
Branches Tags
JuliusFreudenberger:main
JuliusFreudenberger:renovate/proxmox-3.x
..
compare: JuliusFreudenberger:923dca8ba2686bc7894a1dbe309b277450fb72d9
Branches Tags
JuliusFreudenberger:main
JuliusFreudenberger:renovate/proxmox-3.x

No commits in common. "578386193bb95464ee6f834591cd82dfef430da3" and "923dca8ba2686bc7894a1dbe309b277450fb72d9" have entirely different histories.
578386193b ... 923dca8ba2

14 changed files with 42 additions and 633 deletions
Download patch file Download diff file Expand all files Collapse all files

210
flake.lock generated
View file

@ -30,11 +30,11 @@
] ]
}, },
"locked": { "locked": {
"lastModified": 1780814819, "lastModified": 1778403279,
"narHash": "sha256-tCqZRB4pvZlcz2cMi7mfvhFRsfdkbFMP67jGNciogmc=", "narHash": "sha256-qOn95CiAxdt+x0YV5Qrc039HFpByEvURVCHPzCVr8tE=",
"owner": "AdnanHodzic", "owner": "AdnanHodzic",
"repo": "auto-cpufreq", "repo": "auto-cpufreq",
"rev": "f325b2a221ab9adb5bb729a1e5d7a45aea686382", "rev": "c1ba0fe5df2542681e8dfcef6b0aa0217cf9edb4",
"type": "github" "type": "github"
}, },
"original": { "original": {
@ -43,21 +43,6 @@
"type": "github" "type": "github"
} }
}, },
"crane": {
"locked": {
"lastModified": 1765145449,
"narHash": "sha256-aBVHGWWRzSpfL++LubA0CwOOQ64WNLegrYHwsVuVN7A=",
"owner": "ipetkov",
"repo": "crane",
"rev": "69f538cdce5955fcd47abfed4395dc6d5194c1c5",
"type": "github"
},
"original": {
"owner": "ipetkov",
"repo": "crane",
"type": "github"
}
},
"disko": { "disko": {
"inputs": { "inputs": {
"nixpkgs": [ "nixpkgs": [
@ -65,11 +50,11 @@
] ]
}, },
"locked": { "locked": {
"lastModified": 1780290312, "lastModified": 1777713215,
"narHash": "sha256-eTAlX0CwgB84Ts3GaBd944A3DRXVMzgA0EqroZBISUo=", "narHash": "sha256-8GzXDOXckDWwST8TY5DbwYFjdvQLlP7K9CLSVx6iTTo=",
"owner": "nix-community", "owner": "nix-community",
"repo": "disko", "repo": "disko",
"rev": "115e5211780054d8a890b41f0b7734cafad54dfe", "rev": "63b4e7e6cf75307c1d26ac3762b886b5b0247267",
"type": "github" "type": "github"
}, },
"original": { "original": {
@ -79,22 +64,6 @@
} }
}, },
"flake-compat": { "flake-compat": {
"flake": false,
"locked": {
"lastModified": 1761588595,
"narHash": "sha256-XKUZz9zewJNUj46b4AJdiRZJAvSZ0Dqj2BNfXvFlJC4=",
"owner": "edolstra",
"repo": "flake-compat",
"rev": "f387cd2afec9419c8ee37694406ca490c3f34ee5",
"type": "github"
},
"original": {
"owner": "edolstra",
"repo": "flake-compat",
"type": "github"
}
},
"flake-compat_2": {
"flake": false, "flake": false,
"locked": { "locked": {
"lastModified": 1696426674, "lastModified": 1696426674,
@ -110,7 +79,7 @@
"type": "github" "type": "github"
} }
}, },
"flake-compat_3": { "flake-compat_2": {
"locked": { "locked": {
"lastModified": 1747046372, "lastModified": 1747046372,
"narHash": "sha256-CIVLLkVgvHYbgI2UpXvIIBJ12HWgX+fjA8Xf8PUmqCY=", "narHash": "sha256-CIVLLkVgvHYbgI2UpXvIIBJ12HWgX+fjA8Xf8PUmqCY=",
@ -126,28 +95,6 @@
} }
}, },
"gitignore": { "gitignore": {
"inputs": {
"nixpkgs": [
"lanzaboote",
"pre-commit",
"nixpkgs"
]
},
"locked": {
"lastModified": 1709087332,
"narHash": "sha256-HG2cCnktfHsKV0s4XW83gU3F57gaTljL9KNSuG6bnQs=",
"owner": "hercules-ci",
"repo": "gitignore.nix",
"rev": "637db329424fd7e46cf4185293b9cc8c88c95394",
"type": "github"
},
"original": {
"owner": "hercules-ci",
"repo": "gitignore.nix",
"type": "github"
}
},
"gitignore_2": {
"inputs": { "inputs": {
"nixpkgs": [ "nixpkgs": [
"lazy-apps", "lazy-apps",
@ -197,11 +144,11 @@
] ]
}, },
"locked": { "locked": {
"lastModified": 1779506708, "lastModified": 1778401693,
"narHash": "sha256-QOD/CNm196nCJRheux/URi4/HE66fthdOMqCJoPP1Y0=", "narHash": "sha256-OVHdCqXXUF5UdGkH+FF2ZL06OLZjj2kvP2dIUmzVWoo=",
"owner": "nix-community", "owner": "nix-community",
"repo": "home-manager", "repo": "home-manager",
"rev": "3ee51fbdac8c8bdfe1e7e1fcaba6520a563f394f", "rev": "389b83002efc26f1145e89a6a8e6edc5a6435948",
"type": "github" "type": "github"
}, },
"original": { "original": {
@ -211,30 +158,6 @@
"type": "github" "type": "github"
} }
}, },
"lanzaboote": {
"inputs": {
"crane": "crane",
"nixpkgs": [
"nixpkgs"
],
"pre-commit": "pre-commit",
"rust-overlay": "rust-overlay"
},
"locked": {
"lastModified": 1765382359,
"narHash": "sha256-RJmgVDzjRI18BWVogG6wpsl1UCuV6ui8qr4DJ1LfWZ8=",
"owner": "nix-community",
"repo": "lanzaboote",
"rev": "e8c096ade12ec9130ff931b0f0e25d2f1bc63607",
"type": "github"
},
"original": {
"owner": "nix-community",
"ref": "v1.0.0",
"repo": "lanzaboote",
"type": "github"
}
},
"lazy-apps": { "lazy-apps": {
"inputs": { "inputs": {
"nixpkgs": [ "nixpkgs": [
@ -257,15 +180,12 @@
} }
}, },
"nixos-hardware": { "nixos-hardware": {
"inputs": {
"nixpkgs": "nixpkgs"
},
"locked": { "locked": {
"lastModified": 1780310866, "lastModified": 1778143761,
"narHash": "sha256-fPBRVf6A5xlACYcOI59shGrjURuvwu0lRsDoSCEXt/I=", "narHash": "sha256-lkesY6x2X2qxlqLM7CT2iM/0rP2JB7fruPN3h8POXmI=",
"owner": "NixOS", "owner": "NixOS",
"repo": "nixos-hardware", "repo": "nixos-hardware",
"rev": "4ed851c979641e28597a05086332d75cdc9e395f", "rev": "3bcaa367d4c550d687a17ac792fd5cda214ee871",
"type": "github" "type": "github"
}, },
"original": { "original": {
@ -277,15 +197,18 @@
}, },
"nixpkgs": { "nixpkgs": {
"locked": { "locked": {
"lastModified": 1767892417, "lastModified": 1778003029,
"narHash": "sha256-8bW3q88CEg2u4hSP66Vf4lpbLonHz7hqDNBMcCY7E9U=", "narHash": "sha256-q/nkKLDtHIyLjZpKhWk3cSK5IYsFqtMd6UtXF3ddjgA=",
"rev": "3497aa5c9457a9d88d71fa93a4a8368816fbeeba", "owner": "nixos",
"type": "tarball", "repo": "nixpkgs",
"url": "https://releases.nixos.org/nixos/unstable/nixos-26.05pre924538.3497aa5c9457/nixexprs.tar.xz" "rev": "0c88e1f2bdb93d5999019e99cb0e61e1fe2af4c5",
"type": "github"
}, },
"original": { "original": {
"type": "tarball", "owner": "nixos",
"url": "https://channels.nixos.org/nixos-unstable/nixexprs.tar.xz" "ref": "nixos-25.11",
"repo": "nixpkgs",
"type": "github"
} }
}, },
"nixpkgs-libvncserver": { "nixpkgs-libvncserver": {
@ -338,11 +261,11 @@
}, },
"nixpkgs-unstable": { "nixpkgs-unstable": {
"locked": { "locked": {
"lastModified": 1780243769, "lastModified": 1777954456,
"narHash": "sha256-x5UQuRsH3MqI0U9afaXSNqzTPSeZlRLvFAav2Ux1pNw=", "narHash": "sha256-hGdgeU2Nk87RAuZyYjyDjFL6LK7dAZN5RE9+hrDTkDU=",
"owner": "nixos", "owner": "nixos",
"repo": "nixpkgs", "repo": "nixpkgs",
"rev": "331800de5053fcebacf6813adb5db9c9dca22a0c", "rev": "549bd84d6279f9852cae6225e372cc67fb91a4c1",
"type": "github" "type": "github"
}, },
"original": { "original": {
@ -352,49 +275,10 @@
"type": "github" "type": "github"
} }
}, },
"nixpkgs_2": { "pre-commit-hooks": {
"locked": {
"lastModified": 1780511130,
"narHash": "sha256-2v9lT4ya59Lh1FqPeLnz1MoX9y/wz2huqfe9RtQZITk=",
"owner": "nixos",
"repo": "nixpkgs",
"rev": "535f3e6942cb1cead3929c604320d3db54b542b9",
"type": "github"
},
"original": {
"owner": "nixos",
"ref": "nixos-25.11",
"repo": "nixpkgs",
"type": "github"
}
},
"pre-commit": {
"inputs": { "inputs": {
"flake-compat": "flake-compat", "flake-compat": "flake-compat",
"gitignore": "gitignore", "gitignore": "gitignore",
"nixpkgs": [
"lanzaboote",
"nixpkgs"
]
},
"locked": {
"lastModified": 1765016596,
"narHash": "sha256-rhSqPNxDVow7OQKi4qS5H8Au0P4S3AYbawBSmJNUtBQ=",
"owner": "cachix",
"repo": "pre-commit-hooks.nix",
"rev": "548fc44fca28a5e81c5d6b846e555e6b9c2a5a3c",
"type": "github"
},
"original": {
"owner": "cachix",
"repo": "pre-commit-hooks.nix",
"type": "github"
}
},
"pre-commit-hooks": {
"inputs": {
"flake-compat": "flake-compat_2",
"gitignore": "gitignore_2",
"nixpkgs": [ "nixpkgs": [
"lazy-apps", "lazy-apps",
"nixpkgs" "nixpkgs"
@ -417,17 +301,17 @@
}, },
"proxmox-nixos": { "proxmox-nixos": {
"inputs": { "inputs": {
"flake-compat": "flake-compat_3", "flake-compat": "flake-compat_2",
"nixpkgs-libvncserver": "nixpkgs-libvncserver", "nixpkgs-libvncserver": "nixpkgs-libvncserver",
"nixpkgs-stable": "nixpkgs-stable_2", "nixpkgs-stable": "nixpkgs-stable_2",
"utils": "utils" "utils": "utils"
}, },
"locked": { "locked": {
"lastModified": 1779805430, "lastModified": 1777731636,
"narHash": "sha256-SyjG3ld9PyGVxjJOHmhOyWA3tbHgWqIDXBu28f/HLjE=", "narHash": "sha256-OkFcWIKnrl0n5ULcFnzmLjdfD7Z8IHtYLge3e7EuARs=",
"owner": "SaumonNet", "owner": "SaumonNet",
"repo": "proxmox-nixos", "repo": "proxmox-nixos",
"rev": "d2537c08100f135b609389a8cd98f6424339de8c", "rev": "22b690085bfb2b82cbbc8e9d637a67c9c704b6db",
"type": "github" "type": "github"
}, },
"original": { "original": {
@ -442,45 +326,23 @@
"auto-cpufreq": "auto-cpufreq", "auto-cpufreq": "auto-cpufreq",
"disko": "disko", "disko": "disko",
"home-manager": "home-manager_2", "home-manager": "home-manager_2",
"lanzaboote": "lanzaboote",
"lazy-apps": "lazy-apps", "lazy-apps": "lazy-apps",
"nixos-hardware": "nixos-hardware", "nixos-hardware": "nixos-hardware",
"nixpkgs": "nixpkgs_2", "nixpkgs": "nixpkgs",
"nixpkgs-unstable": "nixpkgs-unstable", "nixpkgs-unstable": "nixpkgs-unstable",
"proxmox-nixos": "proxmox-nixos", "proxmox-nixos": "proxmox-nixos",
"secrets": "secrets", "secrets": "secrets",
"systems": "systems_3" "systems": "systems_3"
} }
}, },
"rust-overlay": {
"inputs": {
"nixpkgs": [
"lanzaboote",
"nixpkgs"
]
},
"locked": {
"lastModified": 1765075567,
"narHash": "sha256-KFDCdQcHJ0hE3Nt5Gm5enRIhmtEifAjpxgUQ3mzSJpA=",
"owner": "oxalica",
"repo": "rust-overlay",
"rev": "769156779b41e8787a46ca3d7d76443aaf68be6f",
"type": "github"
},
"original": {
"owner": "oxalica",
"repo": "rust-overlay",
"type": "github"
}
},
"secrets": { "secrets": {
"flake": false, "flake": false,
"locked": { "locked": {
"lastModified": 1779441912, "lastModified": 1777152364,
"narHash": "sha256-Le50mFgpetFC8gyc1j3+oXEjRV3lZdeU2vqBtoWaAJo=", "narHash": "sha256-yS8TxtPFFf7xIDNbsErZUnTBLn2fnyCcC4On+t3v1Zs=",
"ref": "refs/heads/main", "ref": "refs/heads/main",
"rev": "847ed2f52fd5ff0ead5958d6932b219b4254a2bf", "rev": "bfb7da1297d73100a56a044d09792fc6e59357e6",
"revCount": 38, "revCount": 34,
"type": "git", "type": "git",
"url": "ssh://git@git.jfreudenberger.de/JuliusFreudenberger/nix-private.git" "url": "ssh://git@git.jfreudenberger.de/JuliusFreudenberger/nix-private.git"
}, },

40
flake.nix
View file

@ -38,10 +38,6 @@
darwin.follows = ""; darwin.follows = "";
}; };
}; };
lanzaboote = {
url = "github:nix-community/lanzaboote/v1.0.0";
inputs.nixpkgs.follows = "nixpkgs";
};
secrets = { secrets = {
url = "git+ssh://git@git.jfreudenberger.de/JuliusFreudenberger/nix-private.git"; url = "git+ssh://git@git.jfreudenberger.de/JuliusFreudenberger/nix-private.git";
flake = false; flake = false;
@ -59,7 +55,6 @@
proxmox-nixos, proxmox-nixos,
agenix, agenix,
disko, disko,
lanzaboote,
systems, systems,
... ...
} @ inputs: let } @ inputs: let
@ -163,23 +158,6 @@
]; ];
}; };
busch-gpu-docker = nixpkgs.lib.nixosSystem rec {
system = "x86_64-linux";
specialArgs = {
inherit inputs outputs;
pkgs-unstable = import nixpkgs-unstable {
inherit system;
};
};
modules = [
./hosts/busch-gpu-docker
disko.nixosModules.disko
agenix.nixosModules.default
];
};
srv01-hf = nixpkgs.lib.nixosSystem rec { srv01-hf = nixpkgs.lib.nixosSystem rec {
system = "x86_64-linux"; system = "x86_64-linux";
@ -215,24 +193,6 @@
]; ];
}; };
xcy = nixpkgs.lib.nixosSystem rec {
system = "x86_64-linux";
specialArgs = {
inherit inputs outputs;
pkgs-unstable = import nixpkgs-unstable {
inherit system;
};
};
modules = [
disko.nixosModules.disko
agenix.nixosModules.default
lanzaboote.nixosModules.lanzaboote
./hosts/xcy
];
};
}; };
homeConfigurations = { homeConfigurations = {

72
hosts/busch-gpu-docker/default.nix
View file

@ -1,72 +0,0 @@
{ inputs, outputs, config, lib, pkgs, pkgs-unstable, ... }:
{
imports =
[
../../modules/disko/legacy-full-ext4.nix
./secrets.nix
../../users/julius/nixos-server.nix
../../modules/nix.nix
../../modules/auto-upgrade.nix
../../modules/locale.nix
../../modules/server-cli.nix
../../modules/sshd.nix
../../modules/docker.nix
../../modules/hawser.nix
../../modules/netbird-client.nix
"${inputs.secrets}/modules/opkssh.nix"
# Include the results of the hardware scan.
./hardware-configuration.nix
];
# Use the GRUB 2 boot loader.
boot = {
loader.grub = {
enable = true;
};
tmp.useTmpfs = true;
};
hardware = {
graphics.enable = true;
nvidia = {
package = config.boot.kernelPackages.nvidiaPackages.legacy_470;
# TODO GTX 970 or GTX 960 driver 580 (>= 545)
};
nvidia-container-toolkit.enable = true;
};
nixpkgs.config.nvidia.acceptLicense = true;
services.xserver.videoDrivers = [ "nvidia" ];
networking.hostName = "docker-gpu"; # Define your hostname.
services.netbird-client = {
enable = true;
managementUrl = "https://netbird.jfreudenberger.de";
host.setupKey = "830217A8-BE0A-4919-A262-3CF7599487BA";
docker.setupKey = "C4C9FAE3-5FAE-4949-B8E8-BEDA3B954859";
dockerSubnet = "40";
};
services.hawser = {
enable = true;
dockhandServerUrl = "wss://dockhand-connect.jfreudenberger.de/api/hawser/connect";
tokenSecretFile = config.age.secrets.hawser-token;
};
# This option defines the first version of NixOS you have installed on this particular machine,
# and is used to maintain compatibility with application data (e.g. databases) created on older NixOS versions.
# Most users should NEVER change this value after the initial install, for any reason,
# even if you've upgraded your system to a new NixOS release.
# This value does NOT affect the Nixpkgs version your packages and OS are pulled from,
# so changing it will NOT upgrade your system - see https://nixos.org/manual/nixos/stable/#sec-upgrading for how
# to actually do that.
# This value being lower than the current NixOS release does NOT mean your system is
# out of date, out of support, or vulnerable.
# Do NOT change this value unless you have manually inspected all the changes it would make to your configuration,
# and migrated your data accordingly.
# For more information, see `man configuration.nix` or https://nixos.org/manual/nixos/stable/options#opt-system.stateVersion .
system.stateVersion = "25.05"; # Did you read the comment?
}

17
hosts/busch-gpu-docker/hardware-configuration.nix
View file

@ -1,17 +0,0 @@
# Do not modify this file! It was generated by ‘nixos-generate-config’
# and may be overwritten by future invocations. Please make changes
# to /etc/nixos/configuration.nix instead.
{ config, lib, pkgs, modulesPath, ... }:
{
imports =
[ (modulesPath + "/profiles/qemu-guest.nix")
];
boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "ehci_pci" "ahci" "virtio_pci" "virtio_scsi" "sd_mod" "sr_mod" ];
boot.initrd.kernelModules = [ ];
boot.kernelModules = [ "kvm-intel" ];
boot.extraModulePackages = [ ];
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
}

6
hosts/busch-gpu-docker/secrets.nix
View file

@ -1,6 +0,0 @@
{ inputs, ... }:
{
age.secrets = {
hawser-token.file = "${inputs.secrets}/secrets/busch-gpu-docker/hawser-token";
};
}

12
hosts/busch-main-docker/default.nix
View file

@ -4,7 +4,6 @@
imports = imports =
[ [
../../modules/disko/legacy-full-ext4.nix ../../modules/disko/legacy-full-ext4.nix
./secrets.nix
../../users/julius/nixos-server.nix ../../users/julius/nixos-server.nix
../../modules/nix.nix ../../modules/nix.nix
@ -13,14 +12,12 @@
../../modules/server-cli.nix ../../modules/server-cli.nix
../../modules/sshd.nix ../../modules/sshd.nix
../../modules/docker.nix ../../modules/docker.nix
../../modules/hawser.nix
../../modules/netbird-client.nix ../../modules/netbird-client.nix
"${inputs.secrets}/modules/opkssh.nix" "${inputs.secrets}/modules/opkssh.nix"
# Include the results of the hardware scan. # Include the results of the hardware scan.
./hardware-configuration.nix ./hardware-configuration.nix
]; ];
# Use the GRUB 2 boot loader. # Use the GRUB 2 boot loader.
boot = { boot = {
loader.grub = { loader.grub = {
@ -34,14 +31,7 @@
enable = true; enable = true;
managementUrl = "https://netbird.jfreudenberger.de"; managementUrl = "https://netbird.jfreudenberger.de";
host.setupKey = "DB64713B-FB23-49F1-A4A7-9B9E37B585D4"; host.setupKey = "DB64713B-FB23-49F1-A4A7-9B9E37B585D4";
docker.setupKey = "0028C8B8-BE57-4045-B16E-507B110AF24D"; docker.setupKey = "B9ECD884-B445-4156-8643-D0F34D64C200";
dockerSubnet = "30";
};
services.hawser = {
enable = true;
dockhandServerUrl = "wss://dockhand-connect.jfreudenberger.de/api/hawser/connect";
tokenSecretFile = config.age.secrets.hawser-token;
}; };
# This option defines the first version of NixOS you have installed on this particular machine, # This option defines the first version of NixOS you have installed on this particular machine,

6
hosts/busch-main-docker/secrets.nix
View file

@ -1,6 +0,0 @@
{ inputs, ... }:
{
age.secrets = {
hawser-token.file = "${inputs.secrets}/secrets/busch-main-docker/hawser-token";
};
}

104
hosts/xcy/default.nix
View file

@ -1,104 +0,0 @@
{ inputs, outputs, config, lib, pkgs, pkgs-unstable, ... }:
{
imports =
[
./secrets.nix
./disko.nix
../../users/julius/nixos-server.nix
../../modules/nix.nix
../../modules/locale.nix
../../modules/server-cli.nix
../../modules/sshd.nix
../../modules/docker.nix
../../modules/hawser.nix
../../modules/netbird-client.nix
../../modules/auto-upgrade.nix
"${inputs.secrets}/modules/opkssh.nix"
# Include the results of the hardware scan.
./hardware-configuration.nix
];
services.netbird-client = {
enable = true;
managementUrl = "https://netbird.jfreudenberger.de";
host.setupKey = "86D1861F-193B-44F5-9B03-1E34C126FA6F";
docker.setupKey = "A9715FB6-8BF2-4274-BE02-43740A3BD4D9";
};
services.hawser = {
enable = true;
dockhandServerUrl = "wss://dockhand-connect.jfreudenberger.de/api/hawser/connect";
tokenSecretFile = config.age.secrets.hawser-token;
};
networking.firewall = {
checkReversePath = "loose";
allowedTCPPorts = [
# Ports for Unifi Server
11443
5005
9543
6789
8080
8443
8444
11084
5671
8880
8881
8882
# Home assistant
8123
];
allowedUDPPorts = [
# Unifi Server
3478
5514
10003
];
};
boot.kernel.sysctl = {
"net.ipv4.conf.all.forwarding" = true;
"net.ipv6.conf.all.forwarding" = true;
};
boot = {
tmp.cleanOnBoot = true;
tmp.useTmpfs = true;
growPartition = true;
initrd.systemd.enable = true;
loader = {
efi.canTouchEfiVariables = true;
grub.enable = false;
systemd-boot.enable = false;
};
lanzaboote = {
enable = true;
pkiBundle = "/var/lib/sbctl";
extraEfiSysMountPoints = [
"/boot-fallback"
];
};
};
networking.hostName = "xcy"; # Define your hostname.
# This option defines the first version of NixOS you have installed on this particular machine,
# and is used to maintain compatibility with application data (e.g. databases) created on older NixOS versions.
# Most users should NEVER change this value after the initial install, for any reason,
# even if you've upgraded your system to a new NixOS release.
# This value does NOT affect the Nixpkgs version your packages and OS are pulled from,
# so changing it will NOT upgrade your system - see https://nixos.org/manual/nixos/stable/#sec-upgrading for how
# to actually do that.
# This value being lower than the current NixOS release does NOT mean your system is
# out of date, out of support, or vulnerable.
# Do NOT change this value unless you have manually inspected all the changes it would make to your configuration,
# and migrated your data accordingly.
# For more information, see `man configuration.nix` or https://nixos.org/manual/nixos/stable/options#opt-system.stateVersion .
system.stateVersion = "25.05"; # Did you read the comment?
}

103
hosts/xcy/disko.nix
View file

@ -1,103 +0,0 @@
{
disko.devices = {
disk = {
disk1 = {
type = "disk";
device = "/dev/disk/by-id/ata-Samsung_SSD_850_PRO_256GB_S251NX0H809669K";
content = {
type = "gpt";
partitions = {
MBR = {
type = "EF02"; # for grub MBR
size = "1M";
priority = 1; # Needs to be first partition
};
ESP = {
priority = 1;
name = "ESP";
size = "2G";
type = "EF00";
content = {
type = "filesystem";
format = "vfat";
mountpoint = "/boot";
mountOptions = [ "umask=0077" ];
};
};
crypt_p1 = {
size = "100%";
content = {
type = "luks";
name = "p1";
settings = {
allowDiscards = true;
};
};
};
};
};
};
disk2 = {
type = "disk";
device = "/dev/disk/by-id/nvme-eui.1843558044350001001b448b4495a259";
content = {
type = "gpt";
partitions = {
MBR = {
type = "EF02"; # for grub MBR
size = "1M";
priority = 1; # Needs to be first partition
};
ESP = {
priority = 1;
name = "ESP";
size = "2G";
type = "EF00";
content = {
type = "filesystem";
format = "vfat";
mountpoint = "/boot-fallback";
mountOptions = [ "umask=0077" ];
};
};
crypt_p2 = {
size = "100%";
content = {
type = "luks";
name = "p2";
settings = {
allowDiscards = true;
};
content = {
type = "btrfs";
extraArgs = [
"-d raid1"
"-m raid1"
"/dev/mapper/p1"
];
subvolumes = {
"/rootfs" = {
mountpoint = "/";
};
"/home" = {
mountOptions = [ "compress=zstd" ];
mountpoint = "/home";
};
"/nix" = {
mountOptions = [ "compress=zstd" "noatime" ];
mountpoint = "/nix";
};
"/swap" = {
mountpoint = "/.swapvol";
swap.swapfile.size = "32G";
};
};
};
};
};
};
};
};
};
};
}

25
hosts/xcy/hardware-configuration.nix
View file

@ -1,25 +0,0 @@
# Do not modify this file! It was generated by ‘nixos-generate-config’
# and may be overwritten by future invocations. Please make changes
# to /etc/nixos/configuration.nix instead.
{ config, lib, pkgs, modulesPath, ... }:
{
imports =
[ (modulesPath + "/installer/scan/not-detected.nix")
];
boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "nvme" "usb_storage" "usbhid" "sd_mod" "sr_mod" ];
boot.initrd.kernelModules = [ "dm-snapshot" ];
boot.kernelModules = [ "kvm-intel" ];
boot.extraModulePackages = [ ];
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
# (the default) this is the recommended approach. When using systemd-networkd it's
# still possible to use this option, but it's recommended to use it in conjunction
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
networking.useDHCP = lib.mkDefault true;
# networking.interfaces.enp1s0.useDHCP = lib.mkDefault true;
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
}

6
hosts/xcy/secrets.nix
View file

@ -1,6 +0,0 @@
{ inputs, ... }:
{
age.secrets = {
hawser-token.file = "${inputs.secrets}/secrets/xcy/hawser-token";
};
}

48
modules/hawser.nix
View file

@ -1,48 +0,0 @@
{
config,
lib,
...
}:
let
cfg = config.services.hawser;
in {
options.services.hawser = {
enable = lib.mkEnableOption "hawser, the agent for Dockhand";
agentName = lib.mkOption {
description = "Name of the hawser agent";
default = config.networking.hostName;
type = lib.types.str;
};
dockhandServerUrl = lib.mkOption {
description = "Websocket endpoint the hawser agent can use to connect to dockhand.";
example = "wss://your-dockhand.example.com/api/hawser/connect";
type = lib.types.str;
};
tokenSecretFile = lib.mkOption {
description = "Agenix secret containing the token as environment variable TOKEN";
type = lib.types.anything;
};
};
config = lib.mkIf cfg.enable {
virtualisation.oci-containers.containers = {
hawser = {
image = "ghcr.io/finsys/hawser:0.2.42";
volumes = [
"/var/run/docker.sock:/var/run/docker.sock"
];
environment = {
STACKS_DIR = "/opt/hawser-stacks";
DOCKHAND_SERVER_URL = cfg.dockhandServerUrl;
AGENT_NAME = cfg.agentName;
};
environmentFiles = [
cfg.tokenSecretFile.path
];
extraOptions = [
''--mount=type=volume,source=hawser-data,target=/opt/hawser-stacks,volume-driver=local''
];
};
};
};
}

11
modules/netbird-client.nix
View file

@ -10,7 +10,7 @@ let
cfg = config.services.netbird-client; cfg = config.services.netbird-client;
clientVersion = "0.71.2"; clientVersion = "0.69.0";
clientConfiguration = lib.types.submodule { clientConfiguration = lib.types.submodule {
options = { options = {
@ -37,11 +37,6 @@ in {
description = "Configuration for docker connection"; description = "Configuration for docker connection";
type = clientConfiguration; type = clientConfiguration;
}; };
dockerSubnet = lib.mkOption {
description = "Second part of ipv4 subnet";
type = lib.types.str;
default = "20";
};
}; };
config = lib.mkIf cfg.enable { config = lib.mkIf cfg.enable {
@ -62,8 +57,6 @@ in {
}; };
systemd.services.${config.services.netbird.clients.wt0.service.name}.path = [ pkgs.shadow ]; systemd.services.${config.services.netbird.clients.wt0.service.name}.path = [ pkgs.shadow ];
services.resolved.enable = true;
virtualisation.oci-containers.containers = { virtualisation.oci-containers.containers = {
netbird = { netbird = {
image = "netbirdio/netbird:${clientVersion}-rootless"; image = "netbirdio/netbird:${clientVersion}-rootless";
@ -99,7 +92,7 @@ in {
Type = "oneshot"; Type = "oneshot";
}; };
script = '' script = ''
docker network inspect webproxy || docker network create webproxy --ipv4 --ipv6 --subnet=172.${cfg.dockerSubnet}.0.0/16 --gateway=172.${cfg.dockerSubnet}.0.1 docker network inspect webproxy || docker network create webproxy --ipv4 --ipv6 --subnet=172.20.0.0/16 --gateway=172.20.0.1
''; '';
}; };
}; };

15
modules/netbird-docker.nix
View file

@ -10,8 +10,8 @@ let
cfg = config.services.netbird-docker; cfg = config.services.netbird-docker;
netbirdCfg = config.services.netbird; netbirdCfg = config.services.netbird;
serverVersion = "0.70.5"; serverVersion = "0.69.0";
dashboardVersion = "2.38.0"; dashboardVersion = "2.37.1";
in { in {
@ -34,14 +34,6 @@ in {
''; '';
type = lib.types.anything; type = lib.types.anything;
}; };
extraPorts = lib.mkOption {
description = ''
Extra ports to open for L4 routing.
Ports described in the config (https://docs.netbird.io/selfhosted/migration/enable-reverse-proxy#exposing-l4-ports) can be specified here.
'';
type = lib.types.listOf lib.types.str;
default = [ ];
};
}; };
}; };
}; };
@ -57,7 +49,6 @@ in {
}; };
config = lib.mkIf cfg.enable { config = lib.mkIf cfg.enable {
services.netbird.useRoutingFeatures = lib.mkDefault "server";
virtualisation.oci-containers.containers = { virtualisation.oci-containers.containers = {
netbird-dashboard = { netbird-dashboard = {
image = "netbirdio/dashboard:v${dashboardVersion}"; image = "netbirdio/dashboard:v${dashboardVersion}";
@ -176,7 +167,7 @@ in {
autoStart = true; autoStart = true;
ports = [ ports = [
"51820:51820/udp" "51820:51820/udp"
] ++ cfg.proxy.extraPorts; ];
networks = [ networks = [
"traefik" "traefik"
]; ];