set up disko, zfs, clamav aide, backup, nfs, zfs for oci and ups

4 files changed, 223 insertions, 14 deletions

diff --git a/hosts/bibus-lab/disko.nix b/hosts/bibus-lab/disko.nix
index 0691fc0..5d0f0b8 100644
--- a/hosts/bibus-lab/disko.nix
+++ b/hosts/bibus-lab/disko.nix
@@ -1,4 +1,215 @@
 {
   disko.devices = {
+    main = {
+      type = "disk";
+      device = "/dev/disk/by-id/";
+      content = {
+        type = "gpt";
+        partitions = {
+          ESP = {
+            size = "2G";
+            type = "EF00";
+            content = {
+              type = "flesystem";
+              format = "vfat";
+              mountpoint = "/boot";
+            };
+          };
+          zfs = {
+            size = "100%";
+            content = {
+              type = "zfs";
+              pool = "zroot";
+            };
+          };
+        };
+      };
+    };
+    hdd1 = {
+      type = "disk";
+      device = "/dev/disk/by-id/";
+      content = {
+        type = "gpt";
+        partitions = {
+          zfs = {
+            size = "100%";
+            content = {
+              type = "zfs";
+              pool = "tank";
+            };
+          };
+        };
+      };
+    };
+    hdd2 = {
+      type = "disk";
+      device = "/dev/disk/by-id/";
+      content = {
+        type = "gpt";
+        partitions = {
+          zfs = {
+            size = "100%";
+            content = {
+              type = "zfs";
+              pool = "tank";
+            };
+          };
+        };
+      };
+    };
+    hdd3 = {
+      type = "disk";
+      device = "/dev/disk/by-id/";
+      content = {
+        type = "gpt";
+        partitions = {
+          zfs = {
+            size = "100%";
+            content = {
+              type = "zfs";
+              pool = "tank";
+            };
+          };
+        };
+      };
+    };
+    zpool = {
+      zroot = {
+        type = "zpool";
+        rootTmpfs = true;
+        datasets = {
+          "rpool" = {
+            type = "zfs_fs";
+            options.mountpoint = "none";
+            encryption = "aes-256-gcm";
+            keyformat = "raw";
+            keylocation = "file:///mnt/zroot.key";
+            options = {
+              compression = "zstd";
+              atime = "off";
+            };
+          };
+          "rpool/root" = {
+            type = "zfs_fs";
+            mountpoint = "/";
+          };
+          "rpool/nix" = {
+            type = "zfs_fs";
+            mountpoint = "/nix";
+          };
+          "rpool/home" = {
+            type = "zfs_fs";
+            mountpoint = "/home";
+          };
+          "rpool/log" = {
+            type = "zfs_fs";
+            mountpoint = "/var/log";
+          };
+          "rpool/var/systemd" = {
+            type = "zfs_fs";
+            mountpoint = "/var/lib/systemd";
+          };
+          "rpool/var/acme" = {
+            type = "zfs_fs";
+            mountpoint = "/var/lib/acme";
+          };
+          "rpool/docker" = {
+            type = "zfs_fs";
+            mountpoint = "/var/lib/containers";
+          };
+          "rpool/appdata/configs" = {
+            type = "zfs_fs";
+            mountpoint = "/var/lib/appdata/configs";
+          };
+          "rpool/appdata/databases" = {
+            type = "zfs_fs";
+            mountpoint = "/var/lib/appdata/databases";
+            options.recordsize = "16K";
+          };
+          "rpool/appdata/monero" = {
+            type = "zfs_fs";
+            mountpoint = "/var/lib/monero";
+            options.recordsize = "8K";
+          };
+          "rpool/appdata/mail" = {
+            type = "zfs_fs";
+            mountpoint = "/var/vmail";
+            options = {
+              atime = "on";
+              recordsize = "64K";
+            };
+          };
+          "rpool/appdata/games" = {
+            type = "zfs_fs";
+            mountpoint = "/var/lib/games";
+            options.recordsize = "64K";
+          };
+        };
+      };
+      tank = {
+        type = "zpool";
+        mode = "raidz1";
+
+        datasets = {
+          "ztank" = {
+            type = "zfs_fs";
+            mountpoint = "none";
+            encryption = "aes-256-gcm";
+            keyformat = "raw";
+            keylocation = "file:///mnt/ztank.key";
+            options = {
+              compression = "zstd";
+              atime = "off";
+            };
+          };
+          "ztank/media" = {
+            type = "zfs_fs";
+            mountpoint = "/data/media";
+            options = {
+              compression = "none";
+              recordsize = "1M";
+            };
+          };
+          "ztank/vault" = {
+            type = "zfs_fs";
+            mountpoint = "/data/vault";
+          };
+          "ztank/vault/seafile" = {
+            type = "zfs_fs";
+            mountpoint = "/data/vault/seafile";
+            options.recordsize = "1M";
+          };
+          "ztank/vault/seafile/personal" = {
+            type = "zfs_fs";
+            mountpoint = "/data/vault/seafile/personal";
+          };
+          "ztank/vault/seafile/shared" = {
+            type = "zfs_fs";
+            mountpoint = "/data/vault/seafile/shared";
+            refquota = "1T";
+          };
+          "ztank/downloads/active" = {
+            type = "zfs_fs";
+            mountpoint = "/data/downloads/active";
+            options.recordsize = "16K";
+          };
+          "ztank/downloads/complete" = {
+            type = "zfs_fs";
+            mountpoint = "/data/downloads/complete";
+            options.recordsize = "1M";
+          };
+          "ztank/cctv" = {
+            type = "zfs_fs";
+            mountpoint = "/data/cctv";
+            options.recordsize = "1M";
+          };
+          "ztank/backups" = {
+            type = "zfs_fs";
+            mountpoint = "/data/backups";
+            options.recordsize = "1M";
+          };
+        };
+      };
+    };
   };
 }
diff --git a/hosts/desktop/configuration.nix b/hosts/desktop/configuration.nix
index c7fa49c..0f0f63e 100644
--- a/hosts/desktop/configuration.nix
+++ b/hosts/desktop/configuration.nix
@@ -57,10 +57,7 @@
       ssh.enable = true;
       firewall.enable = true;
       yggdrasil.enable = true;
-      i2p = {
-        enable = true;
-        enableBrowser = true;
-      };
+      i2p.enable = true;
       tor = {
         enable = true;
         enableBrowser = true;
diff --git a/hosts/thinkpad/configuration.nix b/hosts/thinkpad/configuration.nix
index c8947d3..0fe2945 100644
--- a/hosts/thinkpad/configuration.nix
+++ b/hosts/thinkpad/configuration.nix
@@ -44,20 +44,17 @@
       security = {
         enable = true;
         sandboxing.enable = true;
-        # antivirus.enable = true;
       };
-      ssh.enable = true;
       storage.enable = true;
-      tailscale.enable = true;
       users.enable = true;
     };
     srv = {
-      omnisearch.enable = true;
       bluetooth.enable = true;
-      i2p = {
-        enable = true;
-        enableBrowser = true;
-      };
+      tailscale.enable = true;
+      ssh.enable = true;
+      firewall.enable = true;
+      omnisearch.enable = true;
+      i2p.enable = true;
       tor = {
         enable = true;
         enableBrowser = true;
@@ -70,13 +67,16 @@
       gaming = {
         enable = true;
         games.enable = true;
-        steam.enable = true;
+        steam = {
+          enable = true;
+          enableSls = true;
+        };
       };
       moonlight.enable = true;
       virtualization.kvm.enable = true;
       kdeconnect.enable = true;
       nix-helper.enable = true;
-      monero.enable = true;
+      monero.wallet.enable = true;
       sops.enable = true;
       syncthing.enable = true;
       vpn.enable = true;
diff --git a/hosts/thinkpad/home.nix b/hosts/thinkpad/home.nix
index 9b6dd95..8676adc 100644
--- a/hosts/thinkpad/home.nix
+++ b/hosts/thinkpad/home.nix
@@ -64,5 +64,6 @@
   home.packages = with pkgs; [
     stow
     gimp
+    telegram-desktop
   ];
 }