1
0
Fork 0
dotfiles/system/hosts/argon.nix

217 lines
4.5 KiB
Nix
Raw Normal View History

2023-06-07 18:40:27 +00:00
args@{ pkgs, config, lib, ... }:
let
secret = import ../../secret/hosts/argon.nix;
ssh-keys = import ../shared/ssh-keys.nix;
in
{
imports = [
../../hardware/hosts/argon.nix
../../agenix/hosts/argon/config.nix
../shared/show-update-changelog.nix
../nixos/raspberry.nix
../nixos/ssh.nix
../nixos/git.nix
../nixos/acme-argon.nix
../nixos/nginx.nix
2023-09-04 10:45:06 +00:00
../nixos/nginx-argon.nix
2023-06-07 18:40:27 +00:00
(import ../nixos/adguardhome.nix (args // { inherit secret; }))
../nixos/attic.nix
(import ../nixos/forgejo-runner.nix (args // { name = "argon"; tag = "ubuntu-latest-arm64"; }))
2023-06-07 18:40:27 +00:00
../nixos/tailscale.nix
2023-08-20 23:08:23 +00:00
../nixos/unbound.nix
2023-06-17 15:40:05 +00:00
../nixos/uptime-kuma.nix
2023-06-07 18:40:27 +00:00
../nixos/weewx-proxy.nix
2023-06-10 18:48:07 +00:00
../nixos/container.nix
../nixos/adguardhome-sync.nix
2023-06-14 08:31:56 +00:00
../nixos/homebridge.nix
2023-06-07 18:40:27 +00:00
];
system.stateVersion = "22.11";
nix = {
package = pkgs.nixVersions.stable;
settings = {
auto-optimise-store = true;
substituters = [
"https://attic.cache.daniel.sx/nifoc-systems"
"https://attic.cache.daniel.sx/nifoc-ci"
2023-06-07 18:40:27 +00:00
"https://nifoc.cachix.org"
"https://nix-community.cachix.org"
];
trusted-public-keys = [
"nifoc-systems:eDDqVP5BFR6/1KvXbF9oUL8JahDdmbrsYtxlQ57LOTU="
"nifoc-ci:JpD9zqVQi8JuS7B8htPDOQZh08rhInMnGFS9RVhiuwk="
2023-06-07 18:40:27 +00:00
"nifoc.cachix.org-1:ymuftq7RgN/lf/iWXFK8gpwDSAGFaGBeliWe9u6q8II="
"nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
];
2023-10-25 21:31:32 +00:00
trusted-users = [
"root"
"nix-remote-builder"
];
2023-06-07 18:40:27 +00:00
};
gc = {
automatic = true;
dates = "weekly";
options = "--delete-older-than 14d";
};
extraOptions = ''
experimental-features = nix-command flakes
keep-derivations = true
keep-outputs = true
'';
};
environment.etc."nix/netrc".source = ../../secret/shared/nix-netrc;
boot = {
loader = {
grub.enable = false;
generic-extlinux-compatible.enable = true;
};
tmp.cleanOnBoot = true;
};
networking = {
hostName = "argon";
useNetworkd = true;
};
2023-06-10 18:48:07 +00:00
environment.etc."resolv.conf".text = lib.mkForce ''
nameserver 127.0.0.1
nameserver 10.0.0.110
options edns0 trust-ad
search .
'';
services.resolved.extraConfig = ''
DNSStubListener=no
'';
2023-06-07 18:40:27 +00:00
systemd.network = {
enable = true;
netdevs = {
"20-vlan10" = {
netdevConfig = {
Kind = "vlan";
Name = "vlan51";
};
vlanConfig.Id = 51;
};
"20-vlan20" = {
netdevConfig = {
Kind = "vlan";
Name = "vlan777";
};
vlanConfig.Id = 777;
};
};
networks = {
"10-lan" = {
matchConfig.Name = "end0";
vlan = [ "vlan51" "vlan777" ];
networkConfig = {
DHCP = "yes";
IPv6AcceptRA = true;
IPv6PrivacyExtensions = true;
};
linkConfig.RequiredForOnline = "routable";
ntp = [
"ptbtime1.ptb.de"
"ptbtime2.ptb.de"
"ptbtime3.ptb.de"
];
};
"20-iot" = {
matchConfig.Name = "vlan51";
networkConfig = {
DHCP = "no";
IPv6AcceptRA = false;
};
address = [ "10.0.51.5/24" ];
linkConfig.RequiredForOnline = "routable";
};
"30-modem" = {
matchConfig.Name = "vlan777";
networkConfig = {
DHCP = "no";
IPv6AcceptRA = false;
};
address = [ "192.168.1.5/24" ];
linkConfig.RequiredForOnline = "routable";
};
};
wait-online.extraArgs = [
"--interface=end0"
];
};
services.journald.extraConfig = ''
SystemMaxUse=512M
2023-10-11 12:41:14 +00:00
MaxRetentionSec=30day
2023-06-07 18:40:27 +00:00
'';
2023-11-12 21:40:40 +00:00
security.sudo.enable = true;
2023-06-07 18:40:27 +00:00
documentation = {
nixos.enable = false;
doc.enable = false;
};
services.hardware.argonone.enable = true;
2023-10-25 21:31:32 +00:00
programs = {
fish.enable = true;
zsh.enable = true;
htop.enable = true;
};
2023-06-07 18:40:27 +00:00
users.users = {
root = {
openssh.authorizedKeys.keys = [ ssh-keys.LAN ];
};
daniel = {
2023-09-16 11:08:38 +00:00
hashedPasswordFile = config.age.secrets.user-daniel-password.path;
2023-06-07 18:40:27 +00:00
isNormalUser = true;
home = "/home/daniel";
description = "Daniel";
extraGroups = [ "wheel" ];
shell = pkgs.fish;
openssh.authorizedKeys.keys = [ ssh-keys.LAN ];
};
2023-10-25 21:31:32 +00:00
nix-remote-builder = {
isNormalUser = true;
home = "/home/nix-remote-builder";
description = "Nix Remote Builder";
shell = pkgs.zsh;
openssh.authorizedKeys.keys = [ ssh-keys.NixRemoteBuilder ];
};
2023-06-07 18:40:27 +00:00
};
}