summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
Diffstat
-rw-r--r--flake.lock18
-rw-r--r--hosts/bibus-lab/disko.nix211
-rw-r--r--hosts/desktop/configuration.nix5
-rw-r--r--hosts/thinkpad/configuration.nix20
-rw-r--r--hosts/thinkpad/home.nix1
-rw-r--r--os/core/drivers.nix4
-rw-r--r--os/core/security.nix21
-rw-r--r--os/srv/aide.nix30
-rw-r--r--os/srv/backup.nix34
-rw-r--r--os/srv/clamav.nix27
-rw-r--r--os/srv/default.nix6
-rw-r--r--os/srv/nfs.nix23
-rw-r--r--os/srv/oci.nix23
-rw-r--r--os/srv/ups.nix35
-rw-r--r--os/srv/wireguard.nix9
-rw-r--r--os/srv/zfs.nix52
16 files changed, 464 insertions, 55 deletions
diff --git a/flake.lock b/flake.lock
index 0d417f2..1d7b54e 100644
--- a/flake.lock
+++ b/flake.lock
@@ -294,11 +294,11 @@
]
},
"locked": {
- "lastModified": 1779027260,
- "narHash": "sha256-ZbgWWFQmSyM3HQ31nAZk2hJ7OSeNr9uRFHL8jCifY9M=",
+ "lastModified": 1779103424,
+ "narHash": "sha256-hBYJz5jnRDjACPrwdD064zwMW+s5bdNlG/lNQipLhgM=",
"owner": "nix-community",
"repo": "home-manager",
- "rev": "bcb774cfc3268120cd61808629f9aa7dad3750a2",
+ "rev": "dd71501fb7005264feb4de78444a2e1518cd4f66",
"type": "github"
},
"original": {
@@ -502,11 +502,11 @@
},
"nixos-hardware": {
"locked": {
- "lastModified": 1779034340,
- "narHash": "sha256-zhMjgfsnNPcZtMhhWoeyaUV7JVEJ4rm5YJ0whwTfo8M=",
+ "lastModified": 1779099457,
+ "narHash": "sha256-u73aVD/lUmmT3JV+kPDztl7zPwQKd0eobD1AbJltaGs=",
"owner": "NixOS",
"repo": "nixos-hardware",
- "rev": "88e6bd5c2db9e0b098d8ccb081f35fe33f0f3186",
+ "rev": "8792fab9d4a6454a9201675f01326f827ce35ead",
"type": "github"
},
"original": {
@@ -620,11 +620,11 @@
"systems": "systems_2"
},
"locked": {
- "lastModified": 1779023681,
- "narHash": "sha256-K7RLGyiK3J6wHr/JDxXdlGF0+0DEsdBf1w9mXjSyL8I=",
+ "lastModified": 1779092748,
+ "narHash": "sha256-NliK7JRrPh44IbVwoLi/s7dleSfwoGXgu69d1PjhYdw=",
"owner": "nix-community",
"repo": "nixvim",
- "rev": "0d05726bfb060f6559f6d64c1d427f3663dba178",
+ "rev": "2e60ad952a9f4b0a1c275a79a1a44c8e3a088789",
"type": "github"
},
"original": {
diff --git a/hosts/bibus-lab/disko.nix b/hosts/bibus-lab/disko.nix
index 0691fc0..5d0f0b8 100644
--- a/hosts/bibus-lab/disko.nix
+++ b/hosts/bibus-lab/disko.nix
@@ -1,4 +1,215 @@
{
disko.devices = {
+ main = {
+ type = "disk";
+ device = "/dev/disk/by-id/";
+ content = {
+ type = "gpt";
+ partitions = {
+ ESP = {
+ size = "2G";
+ type = "EF00";
+ content = {
+ type = "flesystem";
+ format = "vfat";
+ mountpoint = "/boot";
+ };
+ };
+ zfs = {
+ size = "100%";
+ content = {
+ type = "zfs";
+ pool = "zroot";
+ };
+ };
+ };
+ };
+ };
+ hdd1 = {
+ type = "disk";
+ device = "/dev/disk/by-id/";
+ content = {
+ type = "gpt";
+ partitions = {
+ zfs = {
+ size = "100%";
+ content = {
+ type = "zfs";
+ pool = "tank";
+ };
+ };
+ };
+ };
+ };
+ hdd2 = {
+ type = "disk";
+ device = "/dev/disk/by-id/";
+ content = {
+ type = "gpt";
+ partitions = {
+ zfs = {
+ size = "100%";
+ content = {
+ type = "zfs";
+ pool = "tank";
+ };
+ };
+ };
+ };
+ };
+ hdd3 = {
+ type = "disk";
+ device = "/dev/disk/by-id/";
+ content = {
+ type = "gpt";
+ partitions = {
+ zfs = {
+ size = "100%";
+ content = {
+ type = "zfs";
+ pool = "tank";
+ };
+ };
+ };
+ };
+ };
+ zpool = {
+ zroot = {
+ type = "zpool";
+ rootTmpfs = true;
+ datasets = {
+ "rpool" = {
+ type = "zfs_fs";
+ options.mountpoint = "none";
+ encryption = "aes-256-gcm";
+ keyformat = "raw";
+ keylocation = "file:///mnt/zroot.key";
+ options = {
+ compression = "zstd";
+ atime = "off";
+ };
+ };
+ "rpool/root" = {
+ type = "zfs_fs";
+ mountpoint = "/";
+ };
+ "rpool/nix" = {
+ type = "zfs_fs";
+ mountpoint = "/nix";
+ };
+ "rpool/home" = {
+ type = "zfs_fs";
+ mountpoint = "/home";
+ };
+ "rpool/log" = {
+ type = "zfs_fs";
+ mountpoint = "/var/log";
+ };
+ "rpool/var/systemd" = {
+ type = "zfs_fs";
+ mountpoint = "/var/lib/systemd";
+ };
+ "rpool/var/acme" = {
+ type = "zfs_fs";
+ mountpoint = "/var/lib/acme";
+ };
+ "rpool/docker" = {
+ type = "zfs_fs";
+ mountpoint = "/var/lib/containers";
+ };
+ "rpool/appdata/configs" = {
+ type = "zfs_fs";
+ mountpoint = "/var/lib/appdata/configs";
+ };
+ "rpool/appdata/databases" = {
+ type = "zfs_fs";
+ mountpoint = "/var/lib/appdata/databases";
+ options.recordsize = "16K";
+ };
+ "rpool/appdata/monero" = {
+ type = "zfs_fs";
+ mountpoint = "/var/lib/monero";
+ options.recordsize = "8K";
+ };
+ "rpool/appdata/mail" = {
+ type = "zfs_fs";
+ mountpoint = "/var/vmail";
+ options = {
+ atime = "on";
+ recordsize = "64K";
+ };
+ };
+ "rpool/appdata/games" = {
+ type = "zfs_fs";
+ mountpoint = "/var/lib/games";
+ options.recordsize = "64K";
+ };
+ };
+ };
+ tank = {
+ type = "zpool";
+ mode = "raidz1";
+
+ datasets = {
+ "ztank" = {
+ type = "zfs_fs";
+ mountpoint = "none";
+ encryption = "aes-256-gcm";
+ keyformat = "raw";
+ keylocation = "file:///mnt/ztank.key";
+ options = {
+ compression = "zstd";
+ atime = "off";
+ };
+ };
+ "ztank/media" = {
+ type = "zfs_fs";
+ mountpoint = "/data/media";
+ options = {
+ compression = "none";
+ recordsize = "1M";
+ };
+ };
+ "ztank/vault" = {
+ type = "zfs_fs";
+ mountpoint = "/data/vault";
+ };
+ "ztank/vault/seafile" = {
+ type = "zfs_fs";
+ mountpoint = "/data/vault/seafile";
+ options.recordsize = "1M";
+ };
+ "ztank/vault/seafile/personal" = {
+ type = "zfs_fs";
+ mountpoint = "/data/vault/seafile/personal";
+ };
+ "ztank/vault/seafile/shared" = {
+ type = "zfs_fs";
+ mountpoint = "/data/vault/seafile/shared";
+ refquota = "1T";
+ };
+ "ztank/downloads/active" = {
+ type = "zfs_fs";
+ mountpoint = "/data/downloads/active";
+ options.recordsize = "16K";
+ };
+ "ztank/downloads/complete" = {
+ type = "zfs_fs";
+ mountpoint = "/data/downloads/complete";
+ options.recordsize = "1M";
+ };
+ "ztank/cctv" = {
+ type = "zfs_fs";
+ mountpoint = "/data/cctv";
+ options.recordsize = "1M";
+ };
+ "ztank/backups" = {
+ type = "zfs_fs";
+ mountpoint = "/data/backups";
+ options.recordsize = "1M";
+ };
+ };
+ };
+ };
};
}
diff --git a/hosts/desktop/configuration.nix b/hosts/desktop/configuration.nix
index c7fa49c..0f0f63e 100644
--- a/hosts/desktop/configuration.nix
+++ b/hosts/desktop/configuration.nix
@@ -57,10 +57,7 @@
ssh.enable = true;
firewall.enable = true;
yggdrasil.enable = true;
- i2p = {
- enable = true;
- enableBrowser = true;
- };
+ i2p.enable = true;
tor = {
enable = true;
enableBrowser = true;
diff --git a/hosts/thinkpad/configuration.nix b/hosts/thinkpad/configuration.nix
index c8947d3..0fe2945 100644
--- a/hosts/thinkpad/configuration.nix
+++ b/hosts/thinkpad/configuration.nix
@@ -44,20 +44,17 @@
security = {
enable = true;
sandboxing.enable = true;
- # antivirus.enable = true;
};
- ssh.enable = true;
storage.enable = true;
- tailscale.enable = true;
users.enable = true;
};
srv = {
- omnisearch.enable = true;
bluetooth.enable = true;
- i2p = {
- enable = true;
- enableBrowser = true;
- };
+ tailscale.enable = true;
+ ssh.enable = true;
+ firewall.enable = true;
+ omnisearch.enable = true;
+ i2p.enable = true;
tor = {
enable = true;
enableBrowser = true;
@@ -70,13 +67,16 @@
gaming = {
enable = true;
games.enable = true;
- steam.enable = true;
+ steam = {
+ enable = true;
+ enableSls = true;
+ };
};
moonlight.enable = true;
virtualization.kvm.enable = true;
kdeconnect.enable = true;
nix-helper.enable = true;
- monero.enable = true;
+ monero.wallet.enable = true;
sops.enable = true;
syncthing.enable = true;
vpn.enable = true;
diff --git a/hosts/thinkpad/home.nix b/hosts/thinkpad/home.nix
index 9b6dd95..8676adc 100644
--- a/hosts/thinkpad/home.nix
+++ b/hosts/thinkpad/home.nix
@@ -64,5 +64,6 @@
home.packages = with pkgs; [
stow
gimp
+ telegram-desktop
];
}
diff --git a/os/core/drivers.nix b/os/core/drivers.nix
index ca5ecc4..d6b2cec 100644
--- a/os/core/drivers.nix
+++ b/os/core/drivers.nix
@@ -39,8 +39,8 @@ in
kernel = lib.mkOption {
type = lib.types.enum [
"stable"
- "unstable"
"zen"
+ "zfs"
"hardened"
];
default = "stable";
@@ -107,7 +107,7 @@ in
"stable" = pkgs.linuxPackages_latest;
"zen" = pkgs.linuxPackages_zen;
"hardened" = pkgs.linuxPackages_hardened;
- # "unstable" = pkgs.linuxPackages.;
+ "zfs" = config.boot.zfs.package.latestCompatibleLinuxPackages;
};
in
kernels.${cfg.kernel} or kernels."stable";
diff --git a/os/core/security.nix b/os/core/security.nix
index c401a14..f69ab1f 100644
--- a/os/core/security.nix
+++ b/os/core/security.nix
@@ -58,27 +58,6 @@ in
apparmor-bin-utils
];
})
- (lib.mkIf cfg.antivirus.enable {
- services.clamav = {
- daemon = {
- enable = true;
- settings = {
- OnAccessIncludePath = [ "/home/${username}" ];
- OnAccessPrevention = true;
- OnAccessExcludeUname = "clamav";
- MaxThreads = 20;
- MaxQueue = 100;
- };
- };
- scanner.enable = true;
- updater.enable = true;
- fangfrisch.enable = true;
- # massive performance hit
- # clamonacc.enable = true;
- };
- boot.kernel.sysctl."fs.inotify.max_user_watches" = 524288;
- users.users.${username}.extraGroups = [ "clamav" ];
- })
{
services.gnome.gnome-keyring.enable = true;
diff --git a/os/srv/aide.nix b/os/srv/aide.nix
new file mode 100644
index 0000000..8bd4c6a
--- /dev/null
+++ b/os/srv/aide.nix
@@ -0,0 +1,30 @@
+{
+ config,
+ lib,
+ pkgs,
+ ...
+}:
+let
+ cfg = config.os.srv.aide;
+in
+{
+ options.os.srv.aide.enable = lib.mkEnableOption "enables aide checking";
+ config = lib.mkIf cfg.enable {
+ systemd = {
+ services.aide-check = {
+ description = "Daily File Integrity Operational Check";
+ serviceConfig = {
+ Type = "oneshot";
+ ExecStart = "${pkgs.aide}/bin/aide --check";
+ };
+ };
+ timers.aide-check = {
+ wantedBy = [ "timers.target" ];
+ timerConfig = {
+ OnCalendar = "daily";
+ Persistent = true;
+ };
+ };
+ };
+ };
+}
diff --git a/os/srv/backup.nix b/os/srv/backup.nix
new file mode 100644
index 0000000..dad9b66
--- /dev/null
+++ b/os/srv/backup.nix
@@ -0,0 +1,34 @@
+{ config, lib, ... }:
+let
+ cfg = config.os.srv.backup;
+in
+{
+ options.os.srv.backup.enable = lib.mkEnableOption "enables backups";
+ config = lib.mkIf cfg.enable {
+ services.sanoid = {
+ enable = true;
+ templates.production = {
+ hourly = 36;
+ daily = 30;
+ monthly = 3;
+ };
+ datasets."zroot/rpool/appdata/databases".useTemplate = [ "production" ];
+ datasets."ztank/vault".useTemplates = [ "production" ];
+ };
+ services.syncoid = {
+ enable = true;
+ commands = {
+ "sync-db" = {
+ source = "zroot/rpool/appdata/databases";
+ target = "ztank/backups/nvme/databases";
+ sendOptions = "w";
+ };
+ "sync-configs" = {
+ source = "zroot/rpool/appdata/configs";
+ target = "ztank/backups/nvme/configs";
+ sendOptions = "w";
+ };
+ };
+ };
+ };
+}
diff --git a/os/srv/clamav.nix b/os/srv/clamav.nix
new file mode 100644
index 0000000..cc84802
--- /dev/null
+++ b/os/srv/clamav.nix
@@ -0,0 +1,27 @@
+{
+ config,
+ lib,
+ pkgs,
+ ...
+}:
+let
+ cfg = config.os.srv.clamav;
+in
+{
+ options.os.srv.clamav.enable = lib.mkEnableOption "enables clamav scanning";
+ config = lib.mkIf cfg.enable {
+ services.clamav = {
+ daemon = {
+ enable = true;
+ settings = {
+ MaxThreads = 20;
+ MaxQueue = 100;
+ };
+ };
+ scanner.enable = true;
+ updater.enable = true;
+ fangfrisch.enable = true;
+ };
+ environment.systemPackages = [ pkgs.aide ];
+ };
+}
diff --git a/os/srv/default.nix b/os/srv/default.nix
index 76351e2..d42fdb9 100644
--- a/os/srv/default.nix
+++ b/os/srv/default.nix
@@ -1,7 +1,10 @@
{ ... }:
{
imports = [
+ ./aide.nix
+ ./backup.nix
./bluetooth.nix
+ ./clamav.nix
./compat.nix
./crowdsec.nix
./fail2ban.nix
@@ -11,6 +14,7 @@
./i2p.nix
./kdeconnect.nix
./monero.nix
+ ./nfs.nix
./nginx.nix
./nix-helper.nix
./oci.nix
@@ -25,6 +29,8 @@
./tor.nix
./virtualization.nix
./vpn.nix
+ ./wireguard.nix
./yggdrasil.nix
+ ./zfs.nix
];
}
diff --git a/os/srv/nfs.nix b/os/srv/nfs.nix
new file mode 100644
index 0000000..9e5b16f
--- /dev/null
+++ b/os/srv/nfs.nix
@@ -0,0 +1,23 @@
+{ config, lib, ... }:
+let
+ cfg = config.os.srv.nfs;
+in
+{
+ options.os.srv.nfs.enable = lib.mkEnableOption "enables nfs drive sharing";
+ config = lib.mkIf cfg.enable {
+ services.nfs.server = {
+ enable = true;
+
+ # TODO exports
+ exports = ''
+ /data 192.168.1.0/24(ro,fsid=0,no_subtree_check)
+
+ /data/media 192.168.1.0/24(ro,nohide,insecure,no_subtree_check,async)
+
+ /data/backups 192.168.1.50(rw,nohide,no_subtree_check,sync,no_root_squash)
+ '';
+ };
+
+ networking.firewall.allowedTCPPorts = [ 2049 ];
+ };
+}
diff --git a/os/srv/oci.nix b/os/srv/oci.nix
index 0d781a7..ea680fd 100644
--- a/os/srv/oci.nix
+++ b/os/srv/oci.nix
@@ -10,19 +10,24 @@ in
{
options.os.srv.oci.enable = lib.mkEnableOption "OCI container support via Podman";
config = lib.mkIf cfg.enable {
- virtualisation.podman = {
- enable = true;
- dockerCompat = true;
- defaultNetwork.settings.dns_enabled = true;
- autoPrune = {
+ virtualisation = {
+ containers = {
enable = true;
- dates = "weekly";
- flags = [ "--all" ];
+ storage.settings.driver = "zfs";
};
+ podman = {
+ enable = true;
+ dockerCompat = true;
+ defaultNetwork.settings.dns_enabled = true;
+ autoPrune = {
+ enable = true;
+ dates = "weekly";
+ flags = [ "--all" ];
+ };
+ };
+ oci-containers.backend = "podman";
};
- virtualisation.oci-containers.backend = "podman";
-
environment.systemPackages = with pkgs; [
podman-tui
podman-compose
diff --git a/os/srv/ups.nix b/os/srv/ups.nix
new file mode 100644
index 0000000..8a36007
--- /dev/null
+++ b/os/srv/ups.nix
@@ -0,0 +1,35 @@
+{ config, lib, ... }:
+let
+ cfg = config.os.srv.ups;
+in
+{
+ options.os.srv.ups.enable = lib.mkEnableOption "enables smooth shutdown on power loss";
+ config = lib.mkIf cfg.enable {
+ power.ups = {
+ enable = true;
+ mode = "standalone";
+
+ ups.main = {
+ driver = "usbhid-ups";
+ port = "auto";
+ description = "Main Server UPS";
+ };
+ users.upsmon = {
+ # TODO make password
+ passwordFile = "sops";
+ upsmon = "master";
+ };
+ upsmon.monitor.main = {
+ system = "main@localhost";
+ user = "upsmon";
+ # TODO password
+ passwordFile = "sops";
+ type = "master";
+ };
+ settings = {
+ MINSUPPLIES = 1;
+ POWERDOWNFLAG = "/run/killpower";
+ };
+ };
+ };
+}
diff --git a/os/srv/wireguard.nix b/os/srv/wireguard.nix
new file mode 100644
index 0000000..4b9dbc4
--- /dev/null
+++ b/os/srv/wireguard.nix
@@ -0,0 +1,9 @@
+{ config, lib, ... }:
+let
+ cfg = config.os.srv.wireguard;
+in
+{
+ options.os.srv.wireguard.enable = lib.mkEnableOption "enables wireguard vpn";
+ config = lib.mkIf cfg.enable {
+ };
+}
diff --git a/os/srv/zfs.nix b/os/srv/zfs.nix
new file mode 100644
index 0000000..fadfd82
--- /dev/null
+++ b/os/srv/zfs.nix
@@ -0,0 +1,52 @@
+{ config, lib, ... }:
+let
+ cfg = config.os.srv.zfs;
+in
+{
+ options.os.srv.zfs.enable = lib.mkEnableOption "enables zfs drive maintnance";
+ config = lib.mkIf cfg.enable {
+ assertions = [
+ {
+ assertion = config.os.core.drivers.kernel == "zfs";
+ message = "ZFS requires the zfs supported kernel";
+ }
+ ];
+ boot = {
+ kernelParams = [ "zfs.zfs_arc_max=34359738368" ];
+ supportedFilesystems = [ "zfs" ];
+ initrd = {
+ supportedFilesystems = [ "zfs" ];
+ # fileSystems."/mnt" = {
+ # device = "/dev/disk/by-label/KEYS";
+ # fsType = "vfat";
+ # options = [ "ro" ];
+ # };
+ };
+ };
+ services.zfs = {
+ autoScrub = {
+ enable = true;
+ interval = "weekly";
+ };
+ trim.enable = true;
+ zed = {
+ enableMail = true;
+ settings = {
+ ZED_DEBUG_LOG = "/var/log/zed.debug.log";
+
+ ZED_EMAIL_ADDR = [ "adikro@disroot.org" ];
+ ZED_EMAIL_PROG = "mail";
+ ZED_EMAIL_OPTS = "-s '@SUBJECT@' @ADDRESS@";
+
+ ZED_NOTIFY_INTERVAL_SECS = 3600;
+ ZED_NOTIFY_VERBOSE = false;
+
+ ZED_USE_ENCLOSURE_LEDS = true;
+ ZED_SCRUB_AFTER_RESILVER = false;
+
+ };
+ };
+ };
+ networking.hostId = "4e3e22e1";
+ };
+}
generated by cgit v1.3 (git 2.53.0) at 2026-08-16 23:29:09 +0000