From c6b6a3e6c702834eac2b633db2ed4c397b4ae113 Mon Sep 17 00:00:00 2001 From: adikro Date: Mon, 18 May 2026 15:25:50 +0200 Subject: set up disko, zfs, clamav aide, backup, nfs, zfs for oci and ups --- os/srv/aide.nix | 30 ++++++++++++++++++++++++++++++ os/srv/backup.nix | 34 ++++++++++++++++++++++++++++++++++ os/srv/clamav.nix | 27 +++++++++++++++++++++++++++ os/srv/default.nix | 6 ++++++ os/srv/nfs.nix | 23 +++++++++++++++++++++++ os/srv/oci.nix | 23 ++++++++++++++--------- os/srv/ups.nix | 35 +++++++++++++++++++++++++++++++++++ os/srv/wireguard.nix | 9 +++++++++ os/srv/zfs.nix | 52 ++++++++++++++++++++++++++++++++++++++++++++++++++++ 9 files changed, 230 insertions(+), 9 deletions(-) create mode 100644 os/srv/aide.nix create mode 100644 os/srv/backup.nix create mode 100644 os/srv/clamav.nix create mode 100644 os/srv/nfs.nix create mode 100644 os/srv/ups.nix create mode 100644 os/srv/wireguard.nix create mode 100644 os/srv/zfs.nix (limited to 'os/srv') diff --git a/os/srv/aide.nix b/os/srv/aide.nix new file mode 100644 index 0000000..8bd4c6a --- /dev/null +++ b/os/srv/aide.nix @@ -0,0 +1,30 @@ +{ + config, + lib, + pkgs, + ... +}: +let + cfg = config.os.srv.aide; +in +{ + options.os.srv.aide.enable = lib.mkEnableOption "enables aide checking"; + config = lib.mkIf cfg.enable { + systemd = { + services.aide-check = { + description = "Daily File Integrity Operational Check"; + serviceConfig = { + Type = "oneshot"; + ExecStart = "${pkgs.aide}/bin/aide --check"; + }; + }; + timers.aide-check = { + wantedBy = [ "timers.target" ]; + timerConfig = { + OnCalendar = "daily"; + Persistent = true; + }; + }; + }; + }; +} diff --git a/os/srv/backup.nix b/os/srv/backup.nix new file mode 100644 index 0000000..dad9b66 --- /dev/null +++ b/os/srv/backup.nix @@ -0,0 +1,34 @@ +{ config, lib, ... }: +let + cfg = config.os.srv.backup; +in +{ + options.os.srv.backup.enable = lib.mkEnableOption "enables backups"; + config = lib.mkIf cfg.enable { + services.sanoid = { + enable = true; + templates.production = { + hourly = 36; + daily = 30; + monthly = 3; + }; + datasets."zroot/rpool/appdata/databases".useTemplate = [ "production" ]; + datasets."ztank/vault".useTemplates = [ "production" ]; + }; + services.syncoid = { + enable = true; + commands = { + "sync-db" = { + source = "zroot/rpool/appdata/databases"; + target = "ztank/backups/nvme/databases"; + sendOptions = "w"; + }; + "sync-configs" = { + source = "zroot/rpool/appdata/configs"; + target = "ztank/backups/nvme/configs"; + sendOptions = "w"; + }; + }; + }; + }; +} diff --git a/os/srv/clamav.nix b/os/srv/clamav.nix new file mode 100644 index 0000000..cc84802 --- /dev/null +++ b/os/srv/clamav.nix @@ -0,0 +1,27 @@ +{ + config, + lib, + pkgs, + ... +}: +let + cfg = config.os.srv.clamav; +in +{ + options.os.srv.clamav.enable = lib.mkEnableOption "enables clamav scanning"; + config = lib.mkIf cfg.enable { + services.clamav = { + daemon = { + enable = true; + settings = { + MaxThreads = 20; + MaxQueue = 100; + }; + }; + scanner.enable = true; + updater.enable = true; + fangfrisch.enable = true; + }; + environment.systemPackages = [ pkgs.aide ]; + }; +} diff --git a/os/srv/default.nix b/os/srv/default.nix index 76351e2..d42fdb9 100644 --- a/os/srv/default.nix +++ b/os/srv/default.nix @@ -1,7 +1,10 @@ { ... }: { imports = [ + ./aide.nix + ./backup.nix ./bluetooth.nix + ./clamav.nix ./compat.nix ./crowdsec.nix ./fail2ban.nix @@ -11,6 +14,7 @@ ./i2p.nix ./kdeconnect.nix ./monero.nix + ./nfs.nix ./nginx.nix ./nix-helper.nix ./oci.nix @@ -25,6 +29,8 @@ ./tor.nix ./virtualization.nix ./vpn.nix + ./wireguard.nix ./yggdrasil.nix + ./zfs.nix ]; } diff --git a/os/srv/nfs.nix b/os/srv/nfs.nix new file mode 100644 index 0000000..9e5b16f --- /dev/null +++ b/os/srv/nfs.nix @@ -0,0 +1,23 @@ +{ config, lib, ... }: +let + cfg = config.os.srv.nfs; +in +{ + options.os.srv.nfs.enable = lib.mkEnableOption "enables nfs drive sharing"; + config = lib.mkIf cfg.enable { + services.nfs.server = { + enable = true; + + # TODO exports + exports = '' + /data 192.168.1.0/24(ro,fsid=0,no_subtree_check) + + /data/media 192.168.1.0/24(ro,nohide,insecure,no_subtree_check,async) + + /data/backups 192.168.1.50(rw,nohide,no_subtree_check,sync,no_root_squash) + ''; + }; + + networking.firewall.allowedTCPPorts = [ 2049 ]; + }; +} diff --git a/os/srv/oci.nix b/os/srv/oci.nix index 0d781a7..ea680fd 100644 --- a/os/srv/oci.nix +++ b/os/srv/oci.nix @@ -10,19 +10,24 @@ in { options.os.srv.oci.enable = lib.mkEnableOption "OCI container support via Podman"; config = lib.mkIf cfg.enable { - virtualisation.podman = { - enable = true; - dockerCompat = true; - defaultNetwork.settings.dns_enabled = true; - autoPrune = { + virtualisation = { + containers = { enable = true; - dates = "weekly"; - flags = [ "--all" ]; + storage.settings.driver = "zfs"; }; + podman = { + enable = true; + dockerCompat = true; + defaultNetwork.settings.dns_enabled = true; + autoPrune = { + enable = true; + dates = "weekly"; + flags = [ "--all" ]; + }; + }; + oci-containers.backend = "podman"; }; - virtualisation.oci-containers.backend = "podman"; - environment.systemPackages = with pkgs; [ podman-tui podman-compose diff --git a/os/srv/ups.nix b/os/srv/ups.nix new file mode 100644 index 0000000..8a36007 --- /dev/null +++ b/os/srv/ups.nix @@ -0,0 +1,35 @@ +{ config, lib, ... }: +let + cfg = config.os.srv.ups; +in +{ + options.os.srv.ups.enable = lib.mkEnableOption "enables smooth shutdown on power loss"; + config = lib.mkIf cfg.enable { + power.ups = { + enable = true; + mode = "standalone"; + + ups.main = { + driver = "usbhid-ups"; + port = "auto"; + description = "Main Server UPS"; + }; + users.upsmon = { + # TODO make password + passwordFile = "sops"; + upsmon = "master"; + }; + upsmon.monitor.main = { + system = "main@localhost"; + user = "upsmon"; + # TODO password + passwordFile = "sops"; + type = "master"; + }; + settings = { + MINSUPPLIES = 1; + POWERDOWNFLAG = "/run/killpower"; + }; + }; + }; +} diff --git a/os/srv/wireguard.nix b/os/srv/wireguard.nix new file mode 100644 index 0000000..4b9dbc4 --- /dev/null +++ b/os/srv/wireguard.nix @@ -0,0 +1,9 @@ +{ config, lib, ... }: +let + cfg = config.os.srv.wireguard; +in +{ + options.os.srv.wireguard.enable = lib.mkEnableOption "enables wireguard vpn"; + config = lib.mkIf cfg.enable { + }; +} diff --git a/os/srv/zfs.nix b/os/srv/zfs.nix new file mode 100644 index 0000000..fadfd82 --- /dev/null +++ b/os/srv/zfs.nix @@ -0,0 +1,52 @@ +{ config, lib, ... }: +let + cfg = config.os.srv.zfs; +in +{ + options.os.srv.zfs.enable = lib.mkEnableOption "enables zfs drive maintnance"; + config = lib.mkIf cfg.enable { + assertions = [ + { + assertion = config.os.core.drivers.kernel == "zfs"; + message = "ZFS requires the zfs supported kernel"; + } + ]; + boot = { + kernelParams = [ "zfs.zfs_arc_max=34359738368" ]; + supportedFilesystems = [ "zfs" ]; + initrd = { + supportedFilesystems = [ "zfs" ]; + # fileSystems."/mnt" = { + # device = "/dev/disk/by-label/KEYS"; + # fsType = "vfat"; + # options = [ "ro" ]; + # }; + }; + }; + services.zfs = { + autoScrub = { + enable = true; + interval = "weekly"; + }; + trim.enable = true; + zed = { + enableMail = true; + settings = { + ZED_DEBUG_LOG = "/var/log/zed.debug.log"; + + ZED_EMAIL_ADDR = [ "adikro@disroot.org" ]; + ZED_EMAIL_PROG = "mail"; + ZED_EMAIL_OPTS = "-s '@SUBJECT@' @ADDRESS@"; + + ZED_NOTIFY_INTERVAL_SECS = 3600; + ZED_NOTIFY_VERBOSE = false; + + ZED_USE_ENCLOSURE_LEDS = true; + ZED_SCRUB_AFTER_RESILVER = false; + + }; + }; + }; + networking.hostId = "4e3e22e1"; + }; +} -- cgit v1.3