9 files changed, 230 insertions, 9 deletions
diff --git a/os/srv/aide.nix b/os/srv/aide.nix
new file mode 100644
index 0000000..8bd4c6a
--- /dev/null
+++ b/os/srv/aide.nix
@@ -0,0 +1,30 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.os.srv.aide;
+in
+{
+  options.os.srv.aide.enable = lib.mkEnableOption "enables aide checking";
+  config = lib.mkIf cfg.enable {
+    systemd = {
+      services.aide-check = {
+        description = "Daily File Integrity Operational Check";
+        serviceConfig = {
+          Type = "oneshot";
+          ExecStart = "${pkgs.aide}/bin/aide --check";
+        };
+      };
+      timers.aide-check = {
+        wantedBy = [ "timers.target" ];
+        timerConfig = {
+          OnCalendar = "daily";
+          Persistent = true;
+        };
+      };
+    };
+  };
+}
diff --git a/os/srv/backup.nix b/os/srv/backup.nix
new file mode 100644
index 0000000..dad9b66
--- /dev/null
+++ b/os/srv/backup.nix
@@ -0,0 +1,34 @@
+{ config, lib, ... }:
+let
+  cfg = config.os.srv.backup;
+in
+{
+  options.os.srv.backup.enable = lib.mkEnableOption "enables backups";
+  config = lib.mkIf cfg.enable {
+    services.sanoid = {
+      enable = true;
+      templates.production = {
+        hourly = 36;
+        daily = 30;
+        monthly = 3;
+      };
+      datasets."zroot/rpool/appdata/databases".useTemplate = [ "production" ];
+      datasets."ztank/vault".useTemplates = [ "production" ];
+    };
+    services.syncoid = {
+      enable = true;
+      commands = {
+        "sync-db" = {
+          source = "zroot/rpool/appdata/databases";
+          target = "ztank/backups/nvme/databases";
+          sendOptions = "w";
+        };
+        "sync-configs" = {
+          source = "zroot/rpool/appdata/configs";
+          target = "ztank/backups/nvme/configs";
+          sendOptions = "w";
+        };
+      };
+    };
+  };
+}
diff --git a/os/srv/clamav.nix b/os/srv/clamav.nix
new file mode 100644
index 0000000..cc84802
--- /dev/null
+++ b/os/srv/clamav.nix
@@ -0,0 +1,27 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.os.srv.clamav;
+in
+{
+  options.os.srv.clamav.enable = lib.mkEnableOption "enables clamav scanning";
+  config = lib.mkIf cfg.enable {
+    services.clamav = {
+      daemon = {
+        enable = true;
+        settings = {
+          MaxThreads = 20;
+          MaxQueue = 100;
+        };
+      };
+      scanner.enable = true;
+      updater.enable = true;
+      fangfrisch.enable = true;
+    };
+    environment.systemPackages = [ pkgs.aide ];
+  };
+}
diff --git a/os/srv/default.nix b/os/srv/default.nix
index 76351e2..d42fdb9 100644
--- a/os/srv/default.nix
+++ b/os/srv/default.nix
@@ -1,7 +1,10 @@
 { ... }:
 {
   imports = [
+    ./aide.nix
+    ./backup.nix
     ./bluetooth.nix
+    ./clamav.nix
     ./compat.nix
     ./crowdsec.nix
     ./fail2ban.nix
@@ -11,6 +14,7 @@
     ./i2p.nix
     ./kdeconnect.nix
     ./monero.nix
+    ./nfs.nix
     ./nginx.nix
     ./nix-helper.nix
     ./oci.nix
@@ -25,6 +29,8 @@
     ./tor.nix
     ./virtualization.nix
     ./vpn.nix
+    ./wireguard.nix
     ./yggdrasil.nix
+    ./zfs.nix
   ];
 }
diff --git a/os/srv/nfs.nix b/os/srv/nfs.nix
new file mode 100644
index 0000000..9e5b16f
--- /dev/null
+++ b/os/srv/nfs.nix
@@ -0,0 +1,23 @@
+{ config, lib, ... }:
+let
+  cfg = config.os.srv.nfs;
+in
+{
+  options.os.srv.nfs.enable = lib.mkEnableOption "enables nfs drive sharing";
+  config = lib.mkIf cfg.enable {
+    services.nfs.server = {
+      enable = true;
+
+      # TODO exports
+      exports = ''
+        /data 192.168.1.0/24(ro,fsid=0,no_subtree_check)
+
+        /data/media 192.168.1.0/24(ro,nohide,insecure,no_subtree_check,async)
+
+        /data/backups 192.168.1.50(rw,nohide,no_subtree_check,sync,no_root_squash)
+      '';
+    };
+
+    networking.firewall.allowedTCPPorts = [ 2049 ];
+  };
+}
diff --git a/os/srv/oci.nix b/os/srv/oci.nix
index 0d781a7..ea680fd 100644
--- a/os/srv/oci.nix
+++ b/os/srv/oci.nix
@@ -10,19 +10,24 @@ in
 {
   options.os.srv.oci.enable = lib.mkEnableOption "OCI container support via Podman";
   config = lib.mkIf cfg.enable {
-    virtualisation.podman = {
-      enable = true;
-      dockerCompat = true;
-      defaultNetwork.settings.dns_enabled = true;
-      autoPrune = {
+    virtualisation = {
+      containers = {
         enable = true;
-        dates = "weekly";
-        flags = [ "--all" ];
+        storage.settings.driver = "zfs";
       };
+      podman = {
+        enable = true;
+        dockerCompat = true;
+        defaultNetwork.settings.dns_enabled = true;
+        autoPrune = {
+          enable = true;
+          dates = "weekly";
+          flags = [ "--all" ];
+        };
+      };
+      oci-containers.backend = "podman";
     };
 
-    virtualisation.oci-containers.backend = "podman";
-
     environment.systemPackages = with pkgs; [
       podman-tui
       podman-compose
diff --git a/os/srv/ups.nix b/os/srv/ups.nix
new file mode 100644
index 0000000..8a36007
--- /dev/null
+++ b/os/srv/ups.nix
@@ -0,0 +1,35 @@
+{ config, lib, ... }:
+let
+  cfg = config.os.srv.ups;
+in
+{
+  options.os.srv.ups.enable = lib.mkEnableOption "enables smooth shutdown on power loss";
+  config = lib.mkIf cfg.enable {
+    power.ups = {
+      enable = true;
+      mode = "standalone";
+
+      ups.main = {
+        driver = "usbhid-ups";
+        port = "auto";
+        description = "Main Server UPS";
+      };
+      users.upsmon = {
+        # TODO make password
+        passwordFile = "sops";
+        upsmon = "master";
+      };
+      upsmon.monitor.main = {
+        system = "main@localhost";
+        user = "upsmon";
+        # TODO password
+        passwordFile = "sops";
+        type = "master";
+      };
+      settings = {
+        MINSUPPLIES = 1;
+        POWERDOWNFLAG = "/run/killpower";
+      };
+    };
+  };
+}
diff --git a/os/srv/wireguard.nix b/os/srv/wireguard.nix
new file mode 100644
index 0000000..4b9dbc4
--- /dev/null
+++ b/os/srv/wireguard.nix
@@ -0,0 +1,9 @@
+{ config, lib, ... }:
+let
+  cfg = config.os.srv.wireguard;
+in
+{
+  options.os.srv.wireguard.enable = lib.mkEnableOption "enables wireguard vpn";
+  config = lib.mkIf cfg.enable {
+  };
+}
diff --git a/os/srv/zfs.nix b/os/srv/zfs.nix
new file mode 100644
index 0000000..fadfd82
--- /dev/null
+++ b/os/srv/zfs.nix
@@ -0,0 +1,52 @@
+{ config, lib, ... }:
+let
+  cfg = config.os.srv.zfs;
+in
+{
+  options.os.srv.zfs.enable = lib.mkEnableOption "enables zfs drive maintnance";
+  config = lib.mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = config.os.core.drivers.kernel == "zfs";
+        message = "ZFS requires the zfs supported kernel";
+      }
+    ];
+    boot = {
+      kernelParams = [ "zfs.zfs_arc_max=34359738368" ];
+      supportedFilesystems = [ "zfs" ];
+      initrd = {
+        supportedFilesystems = [ "zfs" ];
+        # fileSystems."/mnt" = {
+        #   device = "/dev/disk/by-label/KEYS";
+        #   fsType = "vfat";
+        #   options = [ "ro" ];
+        # };
+      };
+    };
+    services.zfs = {
+      autoScrub = {
+        enable = true;
+        interval = "weekly";
+      };
+      trim.enable = true;
+      zed = {
+        enableMail = true;
+        settings = {
+          ZED_DEBUG_LOG = "/var/log/zed.debug.log";
+
+          ZED_EMAIL_ADDR = [ "adikro@disroot.org" ];
+          ZED_EMAIL_PROG = "mail";
+          ZED_EMAIL_OPTS = "-s '@SUBJECT@' @ADDRESS@";
+
+          ZED_NOTIFY_INTERVAL_SECS = 3600;
+          ZED_NOTIFY_VERBOSE = false;
+
+          ZED_USE_ENCLOSURE_LEDS = true;
+          ZED_SCRUB_AFTER_RESILVER = false;
+
+        };
+      };
+    };
+    networking.hostId = "4e3e22e1";
+  };
+}