set up disko, zfs, clamav aide, backup, nfs, zfs for oci and ups

16 files changed, 464 insertions, 55 deletions

diff --git a/flake.lock b/flake.lock
index 0d417f2..1d7b54e 100644
--- a/flake.lock
+++ b/flake.lock
@@ -294,11 +294,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1779027260,
-        "narHash": "sha256-ZbgWWFQmSyM3HQ31nAZk2hJ7OSeNr9uRFHL8jCifY9M=",
+        "lastModified": 1779103424,
+        "narHash": "sha256-hBYJz5jnRDjACPrwdD064zwMW+s5bdNlG/lNQipLhgM=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "bcb774cfc3268120cd61808629f9aa7dad3750a2",
+        "rev": "dd71501fb7005264feb4de78444a2e1518cd4f66",
         "type": "github"
       },
       "original": {
@@ -502,11 +502,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1779034340,
-        "narHash": "sha256-zhMjgfsnNPcZtMhhWoeyaUV7JVEJ4rm5YJ0whwTfo8M=",
+        "lastModified": 1779099457,
+        "narHash": "sha256-u73aVD/lUmmT3JV+kPDztl7zPwQKd0eobD1AbJltaGs=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "88e6bd5c2db9e0b098d8ccb081f35fe33f0f3186",
+        "rev": "8792fab9d4a6454a9201675f01326f827ce35ead",
         "type": "github"
       },
       "original": {
@@ -620,11 +620,11 @@
         "systems": "systems_2"
       },
       "locked": {
-        "lastModified": 1779023681,
-        "narHash": "sha256-K7RLGyiK3J6wHr/JDxXdlGF0+0DEsdBf1w9mXjSyL8I=",
+        "lastModified": 1779092748,
+        "narHash": "sha256-NliK7JRrPh44IbVwoLi/s7dleSfwoGXgu69d1PjhYdw=",
         "owner": "nix-community",
         "repo": "nixvim",
-        "rev": "0d05726bfb060f6559f6d64c1d427f3663dba178",
+        "rev": "2e60ad952a9f4b0a1c275a79a1a44c8e3a088789",
         "type": "github"
       },
       "original": {
diff --git a/hosts/bibus-lab/disko.nix b/hosts/bibus-lab/disko.nix
index 0691fc0..5d0f0b8 100644
--- a/hosts/bibus-lab/disko.nix
+++ b/hosts/bibus-lab/disko.nix
@@ -1,4 +1,215 @@
 {
   disko.devices = {
+    main = {
+      type = "disk";
+      device = "/dev/disk/by-id/";
+      content = {
+        type = "gpt";
+        partitions = {
+          ESP = {
+            size = "2G";
+            type = "EF00";
+            content = {
+              type = "flesystem";
+              format = "vfat";
+              mountpoint = "/boot";
+            };
+          };
+          zfs = {
+            size = "100%";
+            content = {
+              type = "zfs";
+              pool = "zroot";
+            };
+          };
+        };
+      };
+    };
+    hdd1 = {
+      type = "disk";
+      device = "/dev/disk/by-id/";
+      content = {
+        type = "gpt";
+        partitions = {
+          zfs = {
+            size = "100%";
+            content = {
+              type = "zfs";
+              pool = "tank";
+            };
+          };
+        };
+      };
+    };
+    hdd2 = {
+      type = "disk";
+      device = "/dev/disk/by-id/";
+      content = {
+        type = "gpt";
+        partitions = {
+          zfs = {
+            size = "100%";
+            content = {
+              type = "zfs";
+              pool = "tank";
+            };
+          };
+        };
+      };
+    };
+    hdd3 = {
+      type = "disk";
+      device = "/dev/disk/by-id/";
+      content = {
+        type = "gpt";
+        partitions = {
+          zfs = {
+            size = "100%";
+            content = {
+              type = "zfs";
+              pool = "tank";
+            };
+          };
+        };
+      };
+    };
+    zpool = {
+      zroot = {
+        type = "zpool";
+        rootTmpfs = true;
+        datasets = {
+          "rpool" = {
+            type = "zfs_fs";
+            options.mountpoint = "none";
+            encryption = "aes-256-gcm";
+            keyformat = "raw";
+            keylocation = "file:///mnt/zroot.key";
+            options = {
+              compression = "zstd";
+              atime = "off";
+            };
+          };
+          "rpool/root" = {
+            type = "zfs_fs";
+            mountpoint = "/";
+          };
+          "rpool/nix" = {
+            type = "zfs_fs";
+            mountpoint = "/nix";
+          };
+          "rpool/home" = {
+            type = "zfs_fs";
+            mountpoint = "/home";
+          };
+          "rpool/log" = {
+            type = "zfs_fs";
+            mountpoint = "/var/log";
+          };
+          "rpool/var/systemd" = {
+            type = "zfs_fs";
+            mountpoint = "/var/lib/systemd";
+          };
+          "rpool/var/acme" = {
+            type = "zfs_fs";
+            mountpoint = "/var/lib/acme";
+          };
+          "rpool/docker" = {
+            type = "zfs_fs";
+            mountpoint = "/var/lib/containers";
+          };
+          "rpool/appdata/configs" = {
+            type = "zfs_fs";
+            mountpoint = "/var/lib/appdata/configs";
+          };
+          "rpool/appdata/databases" = {
+            type = "zfs_fs";
+            mountpoint = "/var/lib/appdata/databases";
+            options.recordsize = "16K";
+          };
+          "rpool/appdata/monero" = {
+            type = "zfs_fs";
+            mountpoint = "/var/lib/monero";
+            options.recordsize = "8K";
+          };
+          "rpool/appdata/mail" = {
+            type = "zfs_fs";
+            mountpoint = "/var/vmail";
+            options = {
+              atime = "on";
+              recordsize = "64K";
+            };
+          };
+          "rpool/appdata/games" = {
+            type = "zfs_fs";
+            mountpoint = "/var/lib/games";
+            options.recordsize = "64K";
+          };
+        };
+      };
+      tank = {
+        type = "zpool";
+        mode = "raidz1";
+
+        datasets = {
+          "ztank" = {
+            type = "zfs_fs";
+            mountpoint = "none";
+            encryption = "aes-256-gcm";
+            keyformat = "raw";
+            keylocation = "file:///mnt/ztank.key";
+            options = {
+              compression = "zstd";
+              atime = "off";
+            };
+          };
+          "ztank/media" = {
+            type = "zfs_fs";
+            mountpoint = "/data/media";
+            options = {
+              compression = "none";
+              recordsize = "1M";
+            };
+          };
+          "ztank/vault" = {
+            type = "zfs_fs";
+            mountpoint = "/data/vault";
+          };
+          "ztank/vault/seafile" = {
+            type = "zfs_fs";
+            mountpoint = "/data/vault/seafile";
+            options.recordsize = "1M";
+          };
+          "ztank/vault/seafile/personal" = {
+            type = "zfs_fs";
+            mountpoint = "/data/vault/seafile/personal";
+          };
+          "ztank/vault/seafile/shared" = {
+            type = "zfs_fs";
+            mountpoint = "/data/vault/seafile/shared";
+            refquota = "1T";
+          };
+          "ztank/downloads/active" = {
+            type = "zfs_fs";
+            mountpoint = "/data/downloads/active";
+            options.recordsize = "16K";
+          };
+          "ztank/downloads/complete" = {
+            type = "zfs_fs";
+            mountpoint = "/data/downloads/complete";
+            options.recordsize = "1M";
+          };
+          "ztank/cctv" = {
+            type = "zfs_fs";
+            mountpoint = "/data/cctv";
+            options.recordsize = "1M";
+          };
+          "ztank/backups" = {
+            type = "zfs_fs";
+            mountpoint = "/data/backups";
+            options.recordsize = "1M";
+          };
+        };
+      };
+    };
   };
 }
diff --git a/hosts/desktop/configuration.nix b/hosts/desktop/configuration.nix
index c7fa49c..0f0f63e 100644
--- a/hosts/desktop/configuration.nix
+++ b/hosts/desktop/configuration.nix
@@ -57,10 +57,7 @@
       ssh.enable = true;
       firewall.enable = true;
       yggdrasil.enable = true;
-      i2p = {
-        enable = true;
-        enableBrowser = true;
-      };
+      i2p.enable = true;
       tor = {
         enable = true;
         enableBrowser = true;
diff --git a/hosts/thinkpad/configuration.nix b/hosts/thinkpad/configuration.nix
index c8947d3..0fe2945 100644
--- a/hosts/thinkpad/configuration.nix
+++ b/hosts/thinkpad/configuration.nix
@@ -44,20 +44,17 @@
       security = {
         enable = true;
         sandboxing.enable = true;
-        # antivirus.enable = true;
       };
-      ssh.enable = true;
       storage.enable = true;
-      tailscale.enable = true;
       users.enable = true;
     };
     srv = {
-      omnisearch.enable = true;
       bluetooth.enable = true;
-      i2p = {
-        enable = true;
-        enableBrowser = true;
-      };
+      tailscale.enable = true;
+      ssh.enable = true;
+      firewall.enable = true;
+      omnisearch.enable = true;
+      i2p.enable = true;
       tor = {
         enable = true;
         enableBrowser = true;
@@ -70,13 +67,16 @@
       gaming = {
         enable = true;
         games.enable = true;
-        steam.enable = true;
+        steam = {
+          enable = true;
+          enableSls = true;
+        };
       };
       moonlight.enable = true;
       virtualization.kvm.enable = true;
       kdeconnect.enable = true;
       nix-helper.enable = true;
-      monero.enable = true;
+      monero.wallet.enable = true;
       sops.enable = true;
       syncthing.enable = true;
       vpn.enable = true;
diff --git a/hosts/thinkpad/home.nix b/hosts/thinkpad/home.nix
index 9b6dd95..8676adc 100644
--- a/hosts/thinkpad/home.nix
+++ b/hosts/thinkpad/home.nix
@@ -64,5 +64,6 @@
   home.packages = with pkgs; [
     stow
     gimp
+    telegram-desktop
   ];
 }
diff --git a/os/core/drivers.nix b/os/core/drivers.nix
index ca5ecc4..d6b2cec 100644
--- a/os/core/drivers.nix
+++ b/os/core/drivers.nix
@@ -39,8 +39,8 @@ in
     kernel = lib.mkOption {
       type = lib.types.enum [
         "stable"
-        "unstable"
         "zen"
+        "zfs"
         "hardened"
       ];
       default = "stable";
@@ -107,7 +107,7 @@ in
               "stable" = pkgs.linuxPackages_latest;
               "zen" = pkgs.linuxPackages_zen;
               "hardened" = pkgs.linuxPackages_hardened;
-              # "unstable" = pkgs.linuxPackages.;
+              "zfs" = config.boot.zfs.package.latestCompatibleLinuxPackages;
             };
           in
           kernels.${cfg.kernel} or kernels."stable";
diff --git a/os/core/security.nix b/os/core/security.nix
index c401a14..f69ab1f 100644
--- a/os/core/security.nix
+++ b/os/core/security.nix
@@ -58,27 +58,6 @@ in
           apparmor-bin-utils
         ];
       })
-      (lib.mkIf cfg.antivirus.enable {
-        services.clamav = {
-          daemon = {
-            enable = true;
-            settings = {
-              OnAccessIncludePath = [ "/home/${username}" ];
-              OnAccessPrevention = true;
-              OnAccessExcludeUname = "clamav";
-              MaxThreads = 20;
-              MaxQueue = 100;
-            };
-          };
-          scanner.enable = true;
-          updater.enable = true;
-          fangfrisch.enable = true;
-          # massive performance hit
-          # clamonacc.enable = true;
-        };
-        boot.kernel.sysctl."fs.inotify.max_user_watches" = 524288;
-        users.users.${username}.extraGroups = [ "clamav" ];
-      })
       {
         services.gnome.gnome-keyring.enable = true;
 
diff --git a/os/srv/aide.nix b/os/srv/aide.nix
new file mode 100644
index 0000000..8bd4c6a
--- /dev/null
+++ b/os/srv/aide.nix
@@ -0,0 +1,30 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.os.srv.aide;
+in
+{
+  options.os.srv.aide.enable = lib.mkEnableOption "enables aide checking";
+  config = lib.mkIf cfg.enable {
+    systemd = {
+      services.aide-check = {
+        description = "Daily File Integrity Operational Check";
+        serviceConfig = {
+          Type = "oneshot";
+          ExecStart = "${pkgs.aide}/bin/aide --check";
+        };
+      };
+      timers.aide-check = {
+        wantedBy = [ "timers.target" ];
+        timerConfig = {
+          OnCalendar = "daily";
+          Persistent = true;
+        };
+      };
+    };
+  };
+}
diff --git a/os/srv/backup.nix b/os/srv/backup.nix
new file mode 100644
index 0000000..dad9b66
--- /dev/null
+++ b/os/srv/backup.nix
@@ -0,0 +1,34 @@
+{ config, lib, ... }:
+let
+  cfg = config.os.srv.backup;
+in
+{
+  options.os.srv.backup.enable = lib.mkEnableOption "enables backups";
+  config = lib.mkIf cfg.enable {
+    services.sanoid = {
+      enable = true;
+      templates.production = {
+        hourly = 36;
+        daily = 30;
+        monthly = 3;
+      };
+      datasets."zroot/rpool/appdata/databases".useTemplate = [ "production" ];
+      datasets."ztank/vault".useTemplates = [ "production" ];
+    };
+    services.syncoid = {
+      enable = true;
+      commands = {
+        "sync-db" = {
+          source = "zroot/rpool/appdata/databases";
+          target = "ztank/backups/nvme/databases";
+          sendOptions = "w";
+        };
+        "sync-configs" = {
+          source = "zroot/rpool/appdata/configs";
+          target = "ztank/backups/nvme/configs";
+          sendOptions = "w";
+        };
+      };
+    };
+  };
+}
diff --git a/os/srv/clamav.nix b/os/srv/clamav.nix
new file mode 100644
index 0000000..cc84802
--- /dev/null
+++ b/os/srv/clamav.nix
@@ -0,0 +1,27 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.os.srv.clamav;
+in
+{
+  options.os.srv.clamav.enable = lib.mkEnableOption "enables clamav scanning";
+  config = lib.mkIf cfg.enable {
+    services.clamav = {
+      daemon = {
+        enable = true;
+        settings = {
+          MaxThreads = 20;
+          MaxQueue = 100;
+        };
+      };
+      scanner.enable = true;
+      updater.enable = true;
+      fangfrisch.enable = true;
+    };
+    environment.systemPackages = [ pkgs.aide ];
+  };
+}
diff --git a/os/srv/default.nix b/os/srv/default.nix
index 76351e2..d42fdb9 100644
--- a/os/srv/default.nix
+++ b/os/srv/default.nix
@@ -1,7 +1,10 @@
 { ... }:
 {
   imports = [
+    ./aide.nix
+    ./backup.nix
     ./bluetooth.nix
+    ./clamav.nix
     ./compat.nix
     ./crowdsec.nix
     ./fail2ban.nix
@@ -11,6 +14,7 @@
     ./i2p.nix
     ./kdeconnect.nix
     ./monero.nix
+    ./nfs.nix
     ./nginx.nix
     ./nix-helper.nix
     ./oci.nix
@@ -25,6 +29,8 @@
     ./tor.nix
     ./virtualization.nix
     ./vpn.nix
+    ./wireguard.nix
     ./yggdrasil.nix
+    ./zfs.nix
   ];
 }
diff --git a/os/srv/nfs.nix b/os/srv/nfs.nix
new file mode 100644
index 0000000..9e5b16f
--- /dev/null
+++ b/os/srv/nfs.nix
@@ -0,0 +1,23 @@
+{ config, lib, ... }:
+let
+  cfg = config.os.srv.nfs;
+in
+{
+  options.os.srv.nfs.enable = lib.mkEnableOption "enables nfs drive sharing";
+  config = lib.mkIf cfg.enable {
+    services.nfs.server = {
+      enable = true;
+
+      # TODO exports
+      exports = ''
+        /data 192.168.1.0/24(ro,fsid=0,no_subtree_check)
+
+        /data/media 192.168.1.0/24(ro,nohide,insecure,no_subtree_check,async)
+
+        /data/backups 192.168.1.50(rw,nohide,no_subtree_check,sync,no_root_squash)
+      '';
+    };
+
+    networking.firewall.allowedTCPPorts = [ 2049 ];
+  };
+}
diff --git a/os/srv/oci.nix b/os/srv/oci.nix
index 0d781a7..ea680fd 100644
--- a/os/srv/oci.nix
+++ b/os/srv/oci.nix
@@ -10,19 +10,24 @@ in
 {
   options.os.srv.oci.enable = lib.mkEnableOption "OCI container support via Podman";
   config = lib.mkIf cfg.enable {
-    virtualisation.podman = {
-      enable = true;
-      dockerCompat = true;
-      defaultNetwork.settings.dns_enabled = true;
-      autoPrune = {
+    virtualisation = {
+      containers = {
         enable = true;
-        dates = "weekly";
-        flags = [ "--all" ];
+        storage.settings.driver = "zfs";
       };
+      podman = {
+        enable = true;
+        dockerCompat = true;
+        defaultNetwork.settings.dns_enabled = true;
+        autoPrune = {
+          enable = true;
+          dates = "weekly";
+          flags = [ "--all" ];
+        };
+      };
+      oci-containers.backend = "podman";
     };
 
-    virtualisation.oci-containers.backend = "podman";
-
     environment.systemPackages = with pkgs; [
       podman-tui
       podman-compose
diff --git a/os/srv/ups.nix b/os/srv/ups.nix
new file mode 100644
index 0000000..8a36007
--- /dev/null
+++ b/os/srv/ups.nix
@@ -0,0 +1,35 @@
+{ config, lib, ... }:
+let
+  cfg = config.os.srv.ups;
+in
+{
+  options.os.srv.ups.enable = lib.mkEnableOption "enables smooth shutdown on power loss";
+  config = lib.mkIf cfg.enable {
+    power.ups = {
+      enable = true;
+      mode = "standalone";
+
+      ups.main = {
+        driver = "usbhid-ups";
+        port = "auto";
+        description = "Main Server UPS";
+      };
+      users.upsmon = {
+        # TODO make password
+        passwordFile = "sops";
+        upsmon = "master";
+      };
+      upsmon.monitor.main = {
+        system = "main@localhost";
+        user = "upsmon";
+        # TODO password
+        passwordFile = "sops";
+        type = "master";
+      };
+      settings = {
+        MINSUPPLIES = 1;
+        POWERDOWNFLAG = "/run/killpower";
+      };
+    };
+  };
+}
diff --git a/os/srv/wireguard.nix b/os/srv/wireguard.nix
new file mode 100644
index 0000000..4b9dbc4
--- /dev/null
+++ b/os/srv/wireguard.nix
@@ -0,0 +1,9 @@
+{ config, lib, ... }:
+let
+  cfg = config.os.srv.wireguard;
+in
+{
+  options.os.srv.wireguard.enable = lib.mkEnableOption "enables wireguard vpn";
+  config = lib.mkIf cfg.enable {
+  };
+}
diff --git a/os/srv/zfs.nix b/os/srv/zfs.nix
new file mode 100644
index 0000000..fadfd82
--- /dev/null
+++ b/os/srv/zfs.nix
@@ -0,0 +1,52 @@
+{ config, lib, ... }:
+let
+  cfg = config.os.srv.zfs;
+in
+{
+  options.os.srv.zfs.enable = lib.mkEnableOption "enables zfs drive maintnance";
+  config = lib.mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = config.os.core.drivers.kernel == "zfs";
+        message = "ZFS requires the zfs supported kernel";
+      }
+    ];
+    boot = {
+      kernelParams = [ "zfs.zfs_arc_max=34359738368" ];
+      supportedFilesystems = [ "zfs" ];
+      initrd = {
+        supportedFilesystems = [ "zfs" ];
+        # fileSystems."/mnt" = {
+        #   device = "/dev/disk/by-label/KEYS";
+        #   fsType = "vfat";
+        #   options = [ "ro" ];
+        # };
+      };
+    };
+    services.zfs = {
+      autoScrub = {
+        enable = true;
+        interval = "weekly";
+      };
+      trim.enable = true;
+      zed = {
+        enableMail = true;
+        settings = {
+          ZED_DEBUG_LOG = "/var/log/zed.debug.log";
+
+          ZED_EMAIL_ADDR = [ "adikro@disroot.org" ];
+          ZED_EMAIL_PROG = "mail";
+          ZED_EMAIL_OPTS = "-s '@SUBJECT@' @ADDRESS@";
+
+          ZED_NOTIFY_INTERVAL_SECS = 3600;
+          ZED_NOTIFY_VERBOSE = false;
+
+          ZED_USE_ENCLOSURE_LEDS = true;
+          ZED_SCRUB_AFTER_RESILVER = false;
+
+        };
+      };
+    };
+    networking.hostId = "4e3e22e1";
+  };
+}