1
0
Fork 0

mediaserver: init

This commit is contained in:
Daniel Kempkens 2023-04-13 16:45:01 +02:00
parent d924a259d0
commit 6d5812c1dd
Signed by: daniel
SSH key fingerprint: SHA256:Ks/MyhQYcPRQiwMKLAKquWCdCPe3JXlb1WttgnAoSeM
7 changed files with 228 additions and 0 deletions

View file

@ -0,0 +1,7 @@
{
age.secrets = {
user-daniel-password = {
file = ./user/danielPassword.age;
};
};
}

View file

@ -0,0 +1,13 @@
-----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IE10R3A2ZyBMUzZP
MS9jajNJaUZnQzU2cjlLUlZSU0k5YzNEdTF2VlZ1WVhRa3daaVNRCmM2OHJtYXVt
akpqS3IxUHloR3N1R2tvM1FXZm9XL2t6Y2xYaDFpUVVPZ3MKLT4gc3NoLWVkMjU1
MTkgWTk0WWlnIDB6OEdkc0JoQjdTQjM2RmNQK1NLVDF0OXEvM09EQVJqQ1c0Z3Rl
dXZaRHMKcGQwK2dwNEI4R0MwZFkwT0hSNithc1FjZkxna2RzbHd5bEx5N2w3bjZt
dwotPiBASEAhLWdyZWFzZSBUKwpGTXUvOHhFMEJSc0tEWUF4dFB3dTJNZ3dvc1p4
R0c1VS9EQ2kKLS0tIDQ4T2RzQTJXZ0tSOTN4bnM1NzIrb2JrVHA0ODM5NkxYczN4
aW55eFp2VlkKflcGYpyoxjqM+0ZWERBYXstYzpWVW/2FWBRbfDFUBwISHp5qJdJz
joR+bIe2Gf18qRZf7NOvpqfOsl8sU+kfYKb1mG4bTZ4fsR8X24fDFgsJw6VLHgPj
7ksFOkH+VEFEsIBTdccYs9QMUvBA0PrDbk/UylQGpCpzRjEGyCijLGpuPjWZ+O+Y
ZeKPaQ==
-----END AGE ENCRYPTED FILE-----

View file

@ -57,6 +57,13 @@
inherit inputs; inherit inputs;
}; };
mediaserver = import ./system/flakes/mediaserver.nix {
inherit (inputs) nixpkgs;
inherit (inputs) home-manager;
inherit (inputs) ragenix;
inherit inputs;
};
adsb-antenna = import ./system/flakes/adsb-antenna.nix { adsb-antenna = import ./system/flakes/adsb-antenna.nix {
inherit (inputs) nixpkgs; inherit (inputs) nixpkgs;
inherit (inputs) home-manager; inherit (inputs) home-manager;
@ -71,6 +78,7 @@
nixosConfigurations = { nixosConfigurations = {
sail = sail.system; sail = sail.system;
attic = attic.system; attic = attic.system;
mediaserver = mediaserver.system;
adsb-antenna = adsb-antenna.system; adsb-antenna = adsb-antenna.system;
}; };
}; };

View file

@ -0,0 +1,40 @@
{ pkgs, modulesPath, ... }:
{
imports = [ (modulesPath + "/profiles/qemu-guest.nix") ];
boot = {
loader = {
systemd-boot.enable = true;
efi.canTouchEfiVariables = true;
};
initrd = {
availableKernelModules = [ "ata_piix" "xhci_pci" "ahci" "sd_mod" "sr_mod" ];
kernelModules = [ "tls" ];
};
kernelPackages = pkgs.linuxPackages_latest;
kernelModules = [ "kvm-intel" "tcp_bbr" ];
kernel.sysctl = {
"net.core.default_qdisc" = "fq";
"net.ipv4.tcp_congestion_control" = "bbr";
"net.core.rmem_max" = 2500000;
};
};
fileSystems = {
"/" = {
device = "/dev/disk/by-label/NIXROOT";
fsType = "ext4";
};
"/boot" = {
device = "/dev/disk/by-label/NIXBOOT";
fsType = "vfat";
};
};
hardware.cpu.intel.updateMicrocode = false;
}

View file

@ -3,9 +3,11 @@ let
system-sail = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBJMs1BqZ+MC7XBwV+dZW8EmaZt2cOg/xcOBPS9KSzIl"; system-sail = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBJMs1BqZ+MC7XBwV+dZW8EmaZt2cOg/xcOBPS9KSzIl";
system-attic = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHe6N3LfPxu7KNsyuI8YE3R0OHLTxNw5+WhuQjKL6PUr"; system-attic = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHe6N3LfPxu7KNsyuI8YE3R0OHLTxNw5+WhuQjKL6PUr";
system-mediaserver = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDlB0cL5CtTOyARWSE2yUsNU4JHUPmr71710mZHzsmbX";
sail = [ user-daniel system-sail ]; sail = [ user-daniel system-sail ];
attic = [ user-daniel system-attic ]; attic = [ user-daniel system-attic ];
mediaserver = [ user-daniel system-mediaserver ];
in in
{ {
# sail # sail
@ -52,4 +54,7 @@ in
"agenix/hosts/attic/tailscale/authkey.age".publicKeys = attic; "agenix/hosts/attic/tailscale/authkey.age".publicKeys = attic;
"agenix/hosts/attic/atticd/environment.age".publicKeys = attic; "agenix/hosts/attic/atticd/environment.age".publicKeys = attic;
# mediaserver
"agenix/hosts/mediaserver/user/danielPassword.age".publicKeys = mediaserver;
} }

View file

@ -0,0 +1,40 @@
{ nixpkgs, home-manager, ragenix, inputs, ... }:
let
overlay-attic = inputs.attic.overlays.default;
overlay-neovim = inputs.neovim-nightly-overlay.overlay;
overlay-nifoc = inputs.nifoc-overlay.overlay;
nixpkgsConfig = {
overlays = [
overlay-attic
overlay-neovim
overlay-nifoc
];
config = {
allowUnfree = true;
allowBroken = true;
};
};
in
{
system = nixpkgs.lib.nixosSystem {
system = "x86_64-linux";
modules = [
../hosts/mediaserver.nix
home-manager.nixosModules.home-manager
ragenix.nixosModules.default
{
nixpkgs = nixpkgsConfig;
nix.nixPath = [ "nixpkgs=${nixpkgs}" ];
home-manager.useGlobalPkgs = true;
home-manager.useUserPackages = true;
home-manager.users.daniel = import ../../home/hosts/mediaserver.nix;
}
];
};
}

View file

@ -0,0 +1,115 @@
args@{ pkgs, config, lib, ... }:
let
ssh-keys = import ../shared/ssh-keys.nix;
in
{
imports = [
../../hardware/hosts/mediaserver.nix
../../agenix/hosts/mediaserver/config.nix
../nixos/ssh.nix
../nixos/git.nix
];
system.stateVersion = "22.11";
nix = {
package = pkgs.nixVersions.stable;
settings = {
auto-optimise-store = true;
substituters = [
"https://attic.cache.daniel.sx/nifoc-systems"
"https://nifoc.cachix.org"
"https://nix-community.cachix.org"
"https://wurzelpfropf.cachix.org"
];
trusted-public-keys = [
"nifoc-systems:eDDqVP5BFR6/1KvXbF9oUL8JahDdmbrsYtxlQ57LOTU="
"nifoc.cachix.org-1:ymuftq7RgN/lf/iWXFK8gpwDSAGFaGBeliWe9u6q8II="
"nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
"wurzelpfropf.cachix.org-1:ilZwK5a6wJqVr7Fyrzp4blIEkGK+LJT0QrpWr1qBNq0="
];
};
gc = {
automatic = true;
dates = "weekly";
options = "--delete-older-than 14d";
};
extraOptions = ''
experimental-features = nix-command flakes
extra-platforms = aarch64-linux
keep-derivations = true
keep-outputs = true
post-build-hook = ${../../home/programs/scripts/attic-system-cache}
'';
};
environment.etc."nix/netrc".source = ../../secret/shared/nix-netrc;
boot = {
cleanTmpDir = true;
binfmt.emulatedSystems = [ "aarch64-linux" ];
};
zramSwap.enable = true;
networking = {
hostName = "mediaserver";
useNetworkd = true;
};
systemd.network = {
enable = true;
networks = {
"10-lan" = {
matchConfig.Name = "ens3";
networkConfig = {
DHCP = "yes";
IPv6AcceptRA = true;
};
linkConfig.RequiredForOnline = "routable";
ntp = [
"ptbtime1.ptb.de"
"ptbtime2.ptb.de"
"ptbtime3.ptb.de"
];
};
};
};
services.journald.extraConfig = ''
SystemMaxUse=1G
'';
documentation = {
nixos.enable = false;
doc.enable = false;
};
programs.fish.enable = true;
users.users = {
root = {
openssh.authorizedKeys.keys = [ ssh-keys.LAN ];
};
daniel = {
passwordFile = config.age.secrets.user-daniel-password.path;
isNormalUser = true;
home = "/home/daniel";
description = "Daniel";
extraGroups = [ "wheel" ];
shell = pkgs.fish;
openssh.authorizedKeys.keys = [ ssh-keys.LAN ];
};
};
}