Skip to content

Commit 3fbea62

Browse files
FlafyDevFlafyDev
committed
a
1 parent 4afed3f commit 3fbea62

File tree

23 files changed

+428
-441
lines changed

23 files changed

+428
-441
lines changed

‎flake.lock

Lines changed: 59 additions & 250 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎hosts/glint/default.nix

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
# TODO: glint rename to pika
12
{ config, pkgs, ssh, ... }:
23

34
{
@@ -37,6 +38,8 @@
3738
gnome-software
3839
];
3940

41+
games.enable = true;
42+
4043
fonts.enable = true;
4144
printers.enable = true;
4245

@@ -56,7 +59,7 @@
5659
vscode.enable = true;
5760
neovim.enable = true;
5861
cli-utils.enable = false;
59-
transmission.enable = true;
62+
transmission.enable = false;
6063
direnv.enable = true;
6164
fish.enable = true;
6265
foot.enable = true;

‎hosts/glint/modules/networking.nix

Lines changed: 76 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,76 @@
1+
{ssh, utils, lib, ...}: let
2+
inherit (utils) domains resolveHostname;
3+
in {
4+
networking.enable = true;
5+
6+
os.networking.networkmanager.enable = lib.mkForce true;
7+
os.networking.networkmanager.unmanaged = [
8+
"except-interface-name:wl*"
9+
];
10+
os.systemd.services."systemd-networkd".environment.SYSTEMD_LOG_LEVEL = "debug";
11+
os.systemd.network = {
12+
enable = true;
13+
wait-online.enable = true;
14+
networks = {
15+
"50-wired" = {
16+
enable = true;
17+
matchConfig.Name = "en*";
18+
networkConfig = {
19+
DHCP = "yes";
20+
};
21+
};
22+
# "50-wireless" = {
23+
# enable = true;
24+
# matchConfig.Name = "wl*";
25+
# networkConfig = {
26+
# DHCP = "yes";
27+
# };
28+
# };
29+
"50-wg_private" = {
30+
matchConfig.Name = "wg_private";
31+
networkConfig = {
32+
Address = [[''${resolveHostname "glint.wg_private"}/24'']];
33+
IPv6AcceptRA = false;
34+
DHCP = "no";
35+
};
36+
};
37+
};
38+
netdevs = {
39+
"50-wg_private" = {
40+
netdevConfig = {
41+
Name = "wg_private";
42+
Kind = "wireguard";
43+
};
44+
wireguardConfig = {
45+
PrivateKeyFile = ssh.glint.glint_wg_private.private;
46+
};
47+
wireguardPeers = [
48+
{
49+
PublicKey = builtins.readFile ssh.mane.mane_wg_private.public;
50+
AllowedIPs = [''${resolveHostname "mane.wg_private"}/32''];
51+
Endpoint = "${resolveHostname domains.personal}:51821";
52+
PersistentKeepalive = 25;
53+
}
54+
{
55+
PublicKey = builtins.readFile ssh.ope.ope_wg_private.public;
56+
AllowedIPs = [''${resolveHostname "ope.wg_private"}/32''];
57+
Endpoint = "${resolveHostname domains.personal}:51822";
58+
PersistentKeepalive = 25;
59+
}
60+
];
61+
};
62+
};
63+
};
64+
65+
os.networking.nftables.tables.filter = {
66+
family = "inet";
67+
content = ''
68+
chain input {
69+
type filter hook input priority 0; policy accept;
70+
meta nftrace set 1
71+
tcp dport 22 meta mark set 88 # SSH
72+
iifname wg_private meta mark set 88
73+
}
74+
'';
75+
};
76+
}

‎hosts/mane/modules/networking.nix

Lines changed: 43 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,18 @@
33
in {
44
networking.enable = true;
55

6+
os.systemd.services."systemd-networkd".environment.SYSTEMD_LOG_LEVEL = "debug";
7+
os.systemd.network = {
8+
enable = true;
9+
wait-online.enable = true;
10+
networks = {
11+
"50-ens3" = {
12+
matchConfig.Name = "ens3";
13+
networkConfig.DHCP = "yes";
14+
};
15+
};
16+
};
17+
618
# networking.notnft.namespaces.default.rules = with notnft.dsl; with payload; ruleset {
719
# filter = add table { family = f: f.inet; } {
820
# input = add chain { type = f: f.filter; hook = f: f.input; prio = 0; policy = f: f.accept; }
@@ -33,9 +45,10 @@ in {
3345
type filter hook input priority 0; policy accept;
3446
meta nftrace set 1
3547
tcp dport 22 meta mark set 88 # SSH
36-
udp dport 51820 meta mark set 88 # Wireguard
48+
udp dport 51820 meta mark set 88 # Wireguard wg_vps
49+
udp dport 51821 meta mark set 88 # Wireguard wg_private
3750
}
38-
51+
3952
chain prerouting {
4053
type nat hook prerouting priority -100; policy accept;
4154
meta nftrace set 1
@@ -44,6 +57,7 @@ in {
4457
8000
4558
} dnat ip to 10.10.10.11
4659
iifname "ens3" ip daddr ${resolveHostname domains.personal} tcp dport 8080 dnat ip to 10.10.10.10
60+
iifname "ens3" ip daddr ${resolveHostname domains.personal} udp dport 51822 dnat ip to 10.10.10.10
4761
}
4862
4963
chain postrouting {
@@ -71,29 +85,33 @@ in {
7185
}
7286
];
7387
};
74-
# wg_private = {
75-
# ips = ["10.10.11.1/24"];
76-
# listenPort = 51821;
77-
# privateKeyFile = ssh.mane.mane_wg_private.private;
78-
# peers = [
79-
# {
80-
# publicKey = builtins.readFile ssh.ope.ope_wg_private.public;
81-
# allowedIPs = ["10.10.11.10/32"];
82-
# }
83-
# {
84-
# publicKey = builtins.readFile ssh.mera.mera_wg_private.public;
85-
# allowedIPs = ["10.10.11.11/32"];
86-
# }
87-
# # {
88-
# # publicKey = builtins.readFile ssh.mera.bara_wg_vps.public;
89-
# # allowedIPs = ["10.10.11.12/32"];
90-
# # }
91-
# # {
92-
# # publicKey = builtins.readFile ssh.mera.noro_wg_vps.public;
93-
# # allowedIPs = ["10.10.11.13/32"];
94-
# # }
95-
# ];
96-
# };
88+
wg_private = {
89+
ips = [''${resolveHostname "mane.wg_private"}/24''];
90+
listenPort = 51821;
91+
privateKeyFile = ssh.mane.mane_wg_private.private;
92+
peers = [
93+
{
94+
publicKey = builtins.readFile ssh.ope.ope_wg_private.public;
95+
allowedIPs = [''${resolveHostname "ope.wg_private"}/32''];
96+
}
97+
{
98+
publicKey = builtins.readFile ssh.mera.mera_wg_private.public;
99+
allowedIPs = [''${resolveHostname "mera.wg_private"}/32''];
100+
}
101+
{
102+
publicKey = builtins.readFile ssh.glint.glint_wg_private.public;
103+
allowedIPs = [''${resolveHostname "glint.wg_private"}/32''];
104+
}
105+
# {
106+
# publicKey = builtins.readFile ssh.mera.bara_wg_vps.public;
107+
# allowedIPs = ["10.10.11.12/32"];
108+
# }
109+
# {
110+
# publicKey = builtins.readFile ssh.mera.noro_wg_vps.public;
111+
# allowedIPs = ["10.10.11.13/32"];
112+
# }
113+
];
114+
};
97115
};
98116
};
99117
}

‎hosts/mera/modules/networking.nix

Lines changed: 1 addition & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,7 @@ in
2323
type filter hook input priority 0; policy accept;
2424
tcp dport 22 meta mark set 88 # SSH
2525
tcp dport 5000 meta mark set 88 # Nextcloud
26+
iifname enp4s0 tcp dport 5432 meta mark set 88 # Postgres
2627
}
2728
'';
2829
};
@@ -81,24 +82,6 @@ in
8182
};
8283

8384
# os.networking = {
84-
# useNetworkd = false;
85-
86-
# networkmanager = {
87-
# enable = false;
88-
# };
89-
90-
# # I think can be deleted because of systemd.network
91-
# dhcpcd = {
92-
# wait = "background";
93-
# extraConfig = "noarp";
94-
# };
95-
96-
# # I think can be deleted because of systemd.network
97-
# defaultGateway = {
98-
# interface = "enp4s0";
99-
# address = "10.0.0.138";
100-
# };
101-
10285
# wireguard = {
10386
# enable = true;
10487
# interfaces = {

‎hosts/mera/modules/nginx-new.nix

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -89,7 +89,7 @@ in {
8989
"showcase.${domains.personal}" = {
9090
addSSL = true;
9191
locations."/" = {
92-
proxyPass = "http://127.0.0.1:8080";
92+
proxyPass = "http://10.10.15.1:8080";
9393
};
9494
};
9595
"emoji.${domains.personal}" = {

‎hosts/mera/modules/showcase-server.nix

Lines changed: 61 additions & 38 deletions
Original file line numberDiff line numberDiff line change
@@ -1,50 +1,73 @@
11
_: {
2-
os.environment.persistence = {
3-
"/persist2" = {
4-
hideMounts = true;
5-
directories = [
6-
{
7-
directory = "/var/lib/showcase-server";
8-
user = "root";
9-
group = "root";
10-
}
11-
];
2+
services.postgres.comb = {
3+
showcase = {
4+
initSql = ''
5+
CREATE ROLE "showcase" WITH LOGIN PASSWORD 'showcase';
6+
CREATE DATABASE "showcase" WITH
7+
OWNER "showcase"
8+
TEMPLATE template0
9+
ENCODING = "UTF8"
10+
LC_COLLATE = "C"
11+
LC_CTYPE = "C";
12+
'';
1213
};
1314
};
1415

15-
containers.cShowcaseServer = {
16-
autoStart = true;
17-
extraFlags = ["--network-namespace-path=/run/netns/vpn"];
1816

19-
bindMounts = {
20-
"/dev/dri".isReadOnly = false;
21-
"/run/opengl-driver".isReadOnly = false;
22-
"/run/user/1555".isReadOnly = false;
23-
"/var/lib/showcase-server".isReadOnly = false;
17+
os.services.showcaseServer = {
18+
enable = true;
19+
gdDir = "/persist2/var/lib/showcase-server/gd";
20+
postgres = {
21+
username = "showcase";
22+
password = "showcase";
2423
};
24+
};
2525

26-
# TODO: try true
27-
ephemeral = false;
26+
# os.environment.persistence = {
27+
# "/persist2" = {
28+
# hideMounts = true;
29+
# directories = [
30+
# {
31+
# directory = "/var/lib/showcase-server";
32+
# user = "root";
33+
# group = "root";
34+
# }
35+
# ];
36+
# };
37+
# };
2838

29-
config = {lib, ...}: {
30-
os = {
31-
hardware.graphics.enable = true;
32-
networking.firewall.enable = lib.mkForce false;
39+
# containers.cShowcaseServer = {
40+
# autoStart = true;
41+
# extraFlags = ["--network-namespace-path=/run/netns/vpn"];
3342

34-
services.showcaseServer = {
35-
enable = true;
36-
};
43+
# bindMounts = {
44+
# "/dev/dri".isReadOnly = false;
45+
# "/run/opengl-driver".isReadOnly = false;
46+
# "/run/user/1555".isReadOnly = false;
47+
# "/var/lib/showcase-server".isReadOnly = false;
48+
# };
3749

38-
systemd.services.showcase-server = {
39-
serviceConfig = {
40-
Restart = "always";
41-
RuntimeMaxSec = "1h";
42-
};
43-
};
50+
# # TODO: try true
51+
# ephemeral = false;
4452

45-
system.stateVersion = "24.05";
46-
};
47-
};
48-
};
49-
}
53+
# config = {lib, ...}: {
54+
# os = {
55+
# hardware.graphics.enable = true;
56+
# networking.firewall.enable = lib.mkForce false;
5057

58+
# services.showcaseServer = {
59+
# enable = true;
60+
# };
61+
62+
# systemd.services.showcase-server = {
63+
# serviceConfig = {
64+
# Restart = "always";
65+
# RuntimeMaxSec = "1h";
66+
# };
67+
# };
68+
69+
# system.stateVersion = "24.05";
70+
# };
71+
# };
72+
# };
73+
}

‎hosts/ope/modules/jellyfin.nix

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@ _: {
33

44
os.services.jellyfin = {
55
enable = true;
6+
group = "transmission";
67
};
78

89
os.users.users.jellyfin = {

0 commit comments

Comments
 (0)