From 989369d4881ef585c3770075d474e31d3acef976 Mon Sep 17 00:00:00 2001 From: JuliusFreudenberger Date: Sat, 18 Jan 2025 20:39:17 +0200 Subject: [PATCH 1/7] Add module to make timezone imperatively settable --- hosts/julius-framework/default.nix | 1 + modules/timezone-imperatively.nix | 10 ++++++++++ 2 files changed, 11 insertions(+) create mode 100644 modules/timezone-imperatively.nix diff --git a/hosts/julius-framework/default.nix b/hosts/julius-framework/default.nix index 33a2c9b..fd71247 100644 --- a/hosts/julius-framework/default.nix +++ b/hosts/julius-framework/default.nix @@ -13,6 +13,7 @@ ../../modules/laptop.nix ../../modules/network.nix ../../modules/locale.nix + ../../modules/timezone-imperatively.nix ../../modules/boot-login.nix ../../modules/fonts.nix ../../modules/cli-essentials.nix diff --git a/modules/timezone-imperatively.nix b/modules/timezone-imperatively.nix new file mode 100644 index 0000000..a5b9402 --- /dev/null +++ b/modules/timezone-imperatively.nix @@ -0,0 +1,10 @@ +{ + pkgs, + lib, + ... +}: { + # Set timezone to null to make it imperatively settable + time.timeZone = lib.mkForce null; + + services.tzupdate.enable = true; +} From 55d9d233fec636269b549989f355e1060d25c34b Mon Sep 17 00:00:00 2001 From: JuliusFreudenberger Date: Sat, 18 Jan 2025 20:40:08 +0200 Subject: [PATCH 2/7] Rename network.nix to network-client.nix It contains setting up NetworkManager which is not needed for servers --- hosts/julius-framework/default.nix | 3 +-- modules/{network.nix => network-client.nix} | 0 modules/system.nix | 23 --------------------- 3 files changed, 1 insertion(+), 25 deletions(-) rename modules/{network.nix => network-client.nix} (100%) delete mode 100644 modules/system.nix diff --git a/hosts/julius-framework/default.nix b/hosts/julius-framework/default.nix index fd71247..712c251 100644 --- a/hosts/julius-framework/default.nix +++ b/hosts/julius-framework/default.nix @@ -8,10 +8,9 @@ imports = [ ../../modules/nix.nix - ../../modules/system.nix ../../modules/firmware.nix ../../modules/laptop.nix - ../../modules/network.nix + ../../modules/network-client.nix ../../modules/locale.nix ../../modules/timezone-imperatively.nix ../../modules/boot-login.nix diff --git a/modules/network.nix b/modules/network-client.nix similarity index 100% rename from modules/network.nix rename to modules/network-client.nix diff --git a/modules/system.nix b/modules/system.nix deleted file mode 100644 index 0183808..0000000 --- a/modules/system.nix +++ /dev/null @@ -1,23 +0,0 @@ -{ - pkgs, - lib, - username, - ... -}: { - # do garbage collection weekly to keep disk usage low - nix = { - settings = { - experimental-features = ["nix-command" "flakes"]; - }; - - gc = { - automatic = lib.mkDefault true; - dates = lib.mkDefault "weekly"; - options = lib.mkDefault "--delete-older-than 7d"; - }; - }; - - # Allow unfree packages - nixpkgs.config.allowUnfree = true; - -} From 6080fa87150dbe8590db3f5c3884e9c4085ac7a5 Mon Sep 17 00:00:00 2001 From: JuliusFreudenberger Date: Sat, 18 Jan 2025 20:41:05 +0200 Subject: [PATCH 3/7] Add --flake option to command in README --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index deeeadd..31a8e72 100644 --- a/README.md +++ b/README.md @@ -13,6 +13,6 @@ Nix allows for easy to manage, collaborative, reproducible deployments. This mea After installed NixOS with `nix-command` & `flake` enabled, you can deploy this flake with the following command: ```bash -sudo nixos-rebuild switch .#nixos-test +sudo nixos-rebuild switch --flake .#nixos-test ``` From 59620edd40cdb89d96e63244763907ab09833b4f Mon Sep 17 00:00:00 2001 From: JuliusFreudenberger Date: Sat, 18 Jan 2025 20:42:26 +0200 Subject: [PATCH 4/7] Flake update --- flake.lock | 24 ++++++++++++------------ 1 file changed, 12 insertions(+), 12 deletions(-) diff --git a/flake.lock b/flake.lock index cd5906d..833a7ea 100644 --- a/flake.lock +++ b/flake.lock @@ -7,11 +7,11 @@ ] }, "locked": { - "lastModified": 1736492828, - "narHash": "sha256-iDvgL5dQerQnu2ERKAWGvWppG7cQ/0uKEfVY93ItvO4=", + "lastModified": 1737093527, + "narHash": "sha256-A3J+O+IUDSYuNvaQ0QHdkBnTzU188FXzqyhmXeRzUU4=", "owner": "AdnanHodzic", "repo": "auto-cpufreq", - "rev": "c0d9ec565a4c78247a4f70beb1c1ae74279673e2", + "rev": "cef9bfec79007c48d871feed547eb5d04c15b6e7", "type": "github" }, "original": { @@ -43,11 +43,11 @@ }, "nixos-hardware": { "locked": { - "lastModified": 1736441705, - "narHash": "sha256-OL7leZ6KBhcDF3nEKe4aZVfIm6xQpb1Kb+mxySIP93o=", + "lastModified": 1736978406, + "narHash": "sha256-oMr3PVIQ8XPDI8/x6BHxsWEPBRU98Pam6KGVwUh8MPk=", "owner": "NixOS", "repo": "nixos-hardware", - "rev": "8870dcaff63dfc6647fb10648b827e9d40b0a337", + "rev": "b678606690027913f3434dea3864e712b862dde5", "type": "github" }, "original": { @@ -59,11 +59,11 @@ }, "nixpkgs": { "locked": { - "lastModified": 1736549401, - "narHash": "sha256-ibkQrMHxF/7TqAYcQE+tOnIsSEzXmMegzyBWza6uHKM=", + "lastModified": 1736916166, + "narHash": "sha256-puPDoVKxkuNmYIGMpMQiK8bEjaACcCksolsG36gdaNQ=", "owner": "nixos", "repo": "nixpkgs", - "rev": "1dab772dd4a68a7bba5d9460685547ff8e17d899", + "rev": "e24b4c09e963677b1beea49d411cd315a024ad3a", "type": "github" }, "original": { @@ -75,11 +75,11 @@ }, "nixpkgs-unstable": { "locked": { - "lastModified": 1736523798, - "narHash": "sha256-Xb8mke6UCYjge9kPR9o4P1nVrhk7QBbKv3xQ9cj7h2s=", + "lastModified": 1737062831, + "narHash": "sha256-Tbk1MZbtV2s5aG+iM99U8FqwxU/YNArMcWAv6clcsBc=", "owner": "nixos", "repo": "nixpkgs", - "rev": "130595eba61081acde9001f43de3248d8888ac4a", + "rev": "5df43628fdf08d642be8ba5b3625a6c70731c19c", "type": "github" }, "original": { From 5bb38778dbc1235c3b094eb979fdc378f2bb3f57 Mon Sep 17 00:00:00 2001 From: JuliusFreudenberger Date: Sat, 18 Jan 2025 20:46:29 +0200 Subject: [PATCH 5/7] Add more server-centered modules for cli and networking --- modules/network-server.nix | 9 +++++++++ modules/server-cli.nix | 18 ++++++++++++++++++ 2 files changed, 27 insertions(+) create mode 100644 modules/network-server.nix create mode 100644 modules/server-cli.nix diff --git a/modules/network-server.nix b/modules/network-server.nix new file mode 100644 index 0000000..99645e8 --- /dev/null +++ b/modules/network-server.nix @@ -0,0 +1,9 @@ +{ + pkgs, + lib, + ... +}: { + networking = { + useDHCP = true; + }; +} diff --git a/modules/server-cli.nix b/modules/server-cli.nix new file mode 100644 index 0000000..c5c9d60 --- /dev/null +++ b/modules/server-cli.nix @@ -0,0 +1,18 @@ +{ + pkgs, + lib, + ... +}: { + environment.systemPackages = with pkgs; [ + wget + curl + git + + btrfs-progs + ]; + + programs = { + htop.enable = true; + vim.enable = true; + }; +} From 94a83326058180d89ebbb9e462fb03f869586bc7 Mon Sep 17 00:00:00 2001 From: JuliusFreudenberger Date: Sat, 18 Jan 2025 20:46:37 +0200 Subject: [PATCH 6/7] Add teleport module --- modules/teleport.nix | 52 ++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 52 insertions(+) create mode 100644 modules/teleport.nix diff --git a/modules/teleport.nix b/modules/teleport.nix new file mode 100644 index 0000000..5dc0b94 --- /dev/null +++ b/modules/teleport.nix @@ -0,0 +1,52 @@ +{ + pkgs, + lib, + config, + nodename, + ... +}: let + cfg = config.services.teleport; + in { + + config = lib.mkIf config.services.teleport.enable { + environment.systemPackages = [ cfg.package ]; + + services.teleport = { + settings = { + teleport = { + nodename = config.networking.hostName; + auth_servers = [ "tp.jfreudenberger.de:3023" ]; + log.severity = "ERROR"; + }; + ssh_service = { + enabled = true; + permit_user_env = true; + commands = [ + { + name = "hostname"; + command = ["${pkgs.nettools}/bin/hostname"]; + period = "1h"; + } + { + name = "IP"; + command = ["${pkgs.curl}/bin/curl" "ifconfig.me"]; + period = "1h"; + } + { + name = "UP"; + command = ["${pkgs.bash}/bin/bash" "-c" "${pkgs.procps}/bin/uptime -p | ${pkgs.coreutils}/bin/cut -c4- | ${pkgs.coreutils}/bin/cut -d',' -f1"]; + period = "1h"; + } + { + name = "teleport-version"; + command = ["${pkgs.bash}/bin/bash" "-c" "${cfg.package}/bin/teleport version | ${pkgs.coreutils}/bin/cut -d' ' -f2"]; + period = "12h"; + } + ]; + }; + proxy_service.enabled = false; + auth_service.enabled = false; + }; + }; + }; +} From 927cd07d84945f88b9cbefa9eee98c7a314717f1 Mon Sep 17 00:00:00 2001 From: JuliusFreudenberger Date: Sat, 18 Jan 2025 20:48:49 +0200 Subject: [PATCH 7/7] Add configuration for backup raspberry --- flake.nix | 12 +++ hosts/backup-raspberrypi/.gitignore | 1 + hosts/backup-raspberrypi/default.nix | 77 +++++++++++++++++++ .../hardware-configuration.nix | 33 ++++++++ 4 files changed, 123 insertions(+) create mode 100644 hosts/backup-raspberrypi/.gitignore create mode 100644 hosts/backup-raspberrypi/default.nix create mode 100644 hosts/backup-raspberrypi/hardware-configuration.nix diff --git a/flake.nix b/flake.nix index dc02f56..c48f0f9 100644 --- a/flake.nix +++ b/flake.nix @@ -72,7 +72,19 @@ home-manager.users.${username} = import ./users/${username}/home.nix; } ]; + }; + backup-raspberrypi = nixpkgs.lib.nixosSystem rec { + system = "aarch64"; + + specialArgs = { + inherit inputs outputs; + }; + + modules = [ + nixos-hardware.nixosModules.raspberry-pi-4 + ./hosts/backup-raspberrypi + ]; }; }; }; diff --git a/hosts/backup-raspberrypi/.gitignore b/hosts/backup-raspberrypi/.gitignore new file mode 100644 index 0000000..3ad48c3 --- /dev/null +++ b/hosts/backup-raspberrypi/.gitignore @@ -0,0 +1 @@ +teleport-cred.nix diff --git a/hosts/backup-raspberrypi/default.nix b/hosts/backup-raspberrypi/default.nix new file mode 100644 index 0000000..8f44813 --- /dev/null +++ b/hosts/backup-raspberrypi/default.nix @@ -0,0 +1,77 @@ +# Edit this configuration file to define what should be installed on +# your system. Help is available in the configuration.nix(5) man page +# and in the NixOS manual (accessible by running ‘nixos-help’). + +{ outputs, config, pkgs, ... }: + +{ + imports = + [ + ../../modules/nix.nix + ../../modules/network-server.nix + ../../modules/locale.nix + ../../modules/server-cli.nix + ../../modules/teleport.nix + ./teleport-cred.nix + + # Include the results of the hardware scan. + ./hardware-configuration.nix + ]; + + nixpkgs = { + overlays = [ + outputs.overlays.additions + ]; + }; + + # Bootloader. + # Use the extlinux boot loader. (NixOS wants to enable GRUB by default) + boot.loader.grub.enable = false; + # Enables the generation of /boot/extlinux/extlinux.conf + boot.loader.generic-extlinux-compatible.enable = true; + + fileSystems."/backups" = + { device = "/dev/disk/by-uuid/7ccdab55-fba4-47b8-aef2-74be0103f885"; + fsType = "btrfs"; + }; + + networking.hostName = "backup-raspberry"; # Define your hostname. + + users = { + users = { + julius = { + isNormalUser = true; + uid = 1000; + extraGroups = [ "wheel" "julius" ]; + }; + restic = { + isNormalUser = true; + uid = 1337; + extraGroups = [ "restic" ]; + }; + }; + groups = { + julius = { + gid = 1000; + }; + restic = { + gid = 1337; + }; + }; + }; + + location = { + latitude = 48.740556; + longitude = 9.310833; + }; + + # This value determines the NixOS release from which the default + # settings for stateful data, like file locations and database versions + # on your system were taken. It‘s perfectly fine and recommended to leave + # this value at the release version of the first install of this system. + # Before changing this value read the documentation for this option + # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html). + system.stateVersion = "24.11"; # Did you read the comment? + +} + diff --git a/hosts/backup-raspberrypi/hardware-configuration.nix b/hosts/backup-raspberrypi/hardware-configuration.nix new file mode 100644 index 0000000..236445a --- /dev/null +++ b/hosts/backup-raspberrypi/hardware-configuration.nix @@ -0,0 +1,33 @@ +# Do not modify this file! It was generated by ‘nixos-generate-config’ +# and may be overwritten by future invocations. Please make changes +# to /etc/nixos/configuration.nix instead. +{ config, lib, pkgs, modulesPath, ... }: + +{ + imports = + [ (modulesPath + "/installer/scan/not-detected.nix") + ]; + + boot.initrd.availableKernelModules = [ "xhci_pci" ]; + boot.initrd.kernelModules = [ ]; + boot.kernelModules = [ ]; + boot.extraModulePackages = [ ]; + + fileSystems."/" = + { device = "/dev/disk/by-label/NIXOS_SD"; + fsType = "ext4"; + }; + + swapDevices = [ ]; + + # Enables DHCP on each ethernet and wireless interface. In case of scripted networking + # (the default) this is the recommended approach. When using systemd-networkd it's + # still possible to use this option, but it's recommended to use it in conjunction + # with explicit per-interface declarations with `networking.interfaces..useDHCP`. + networking.useDHCP = lib.mkDefault true; + # networking.interfaces.end0.useDHCP = lib.mkDefault true; + # networking.interfaces.wlan0.useDHCP = lib.mkDefault true; + + nixpkgs.hostPlatform = lib.mkDefault "aarch64-linux"; +} +