From 17f2a16f485290e13bd45037e37ec7f076369220 Mon Sep 17 00:00:00 2001 From: Jimbo Date: Tue, 12 Nov 2024 04:25:51 -0500 Subject: [PATCH] Rename some hostnames --- flake.nix | 13 ++-- hosts/cyberspark/home/default.nix | 15 ----- hosts/{leash => extern}/boot/default.nix | 4 +- hosts/{leash => extern}/default.nix | 4 +- hosts/{leash => extern}/disko/default.nix | 3 +- hosts/{leash => extern}/hardware/default.nix | 9 ++- hosts/{firefly => extern}/id_ed25519.pub | 0 hosts/extern/wireguard/default.nix | 23 +++++++ .../{cyberspark/system => kitty}/default.nix | 2 +- hosts/kitty/firewall/default.nix | 45 +++++++++++++ .../system => kitty}/hardware/default.nix | 0 hosts/{cyberspark => kitty}/id_ed25519.pub | 0 hosts/kitty/wireguard/default.nix | 28 ++++++++ hosts/lacros/default.nix | 7 +- hosts/lacros/wireguard/default.nix | 23 +++++++ hosts/{treefruit => pomme}/home/default.nix | 0 hosts/{treefruit => pomme}/id_ed25519.pub | 0 .../system/boot/default.nix | 0 hosts/{treefruit => pomme}/system/default.nix | 0 .../system/hardware/default.nix | 0 hosts/{bomberman => prophet}/boot/default.nix | 0 hosts/{bomberman => prophet}/default.nix | 0 .../{bomberman => prophet}/disko/default.nix | 0 .../hardware/default.nix | 0 hosts/{bomberman => prophet}/id_ed25519.pub | 0 hosts/shuttle/home/default.nix | 9 --- hosts/shuttle/id_ed25519.pub | 1 - hosts/shuttle/system/boot/default.nix | 7 -- hosts/shuttle/system/default.nix | 32 --------- hosts/shuttle/system/hardware/default.nix | 40 ----------- hosts/{firefly => tower}/boot/default.nix | 2 +- hosts/{firefly => tower}/default.nix | 4 +- hosts/{firefly => tower}/disko/default.nix | 1 + hosts/tower/firewall/default.nix | 9 +++ hosts/{firefly => tower}/hardware/default.nix | 0 hosts/{leash => tower}/id_ed25519.pub | 0 hosts/{detritus => xenia}/boot/default.nix | 0 hosts/{detritus => xenia}/default.nix | 0 hosts/{detritus => xenia}/disko/default.nix | 0 .../{detritus => xenia}/hardware/default.nix | 0 hosts/{detritus => xenia}/id_ed25519.pub | 0 modules/home/sway/rules/default.nix | 7 +- .../system/accounts/users/jimbo/default.nix | 11 ++-- modules/system/devices/networking/default.nix | 6 +- .../devices/networking/firewall/default.nix | 66 ------------------- .../devices/networking/wireguard/default.nix | 63 ------------------ modules/system/services/general/default.nix | 1 + .../system/services/general/keyd/default.nix | 9 +-- .../services/general/sunshine/default.nix | 1 + .../system/services/general/tlp/default.nix | 4 ++ variables/ips/default.nix | 7 +- 51 files changed, 175 insertions(+), 281 deletions(-) delete mode 100644 hosts/cyberspark/home/default.nix rename hosts/{leash => extern}/boot/default.nix (95%) rename hosts/{leash => extern}/default.nix (69%) rename hosts/{leash => extern}/disko/default.nix (97%) rename hosts/{leash => extern}/hardware/default.nix (82%) rename hosts/{firefly => extern}/id_ed25519.pub (100%) create mode 100644 hosts/extern/wireguard/default.nix rename hosts/{cyberspark/system => kitty}/default.nix (94%) create mode 100644 hosts/kitty/firewall/default.nix rename hosts/{cyberspark/system => kitty}/hardware/default.nix (100%) rename hosts/{cyberspark => kitty}/id_ed25519.pub (100%) create mode 100644 hosts/kitty/wireguard/default.nix create mode 100644 hosts/lacros/wireguard/default.nix rename hosts/{treefruit => pomme}/home/default.nix (100%) rename hosts/{treefruit => pomme}/id_ed25519.pub (100%) rename hosts/{treefruit => pomme}/system/boot/default.nix (100%) rename hosts/{treefruit => pomme}/system/default.nix (100%) rename hosts/{treefruit => pomme}/system/hardware/default.nix (100%) rename hosts/{bomberman => prophet}/boot/default.nix (100%) rename hosts/{bomberman => prophet}/default.nix (100%) rename hosts/{bomberman => prophet}/disko/default.nix (100%) rename hosts/{bomberman => prophet}/hardware/default.nix (100%) rename hosts/{bomberman => prophet}/id_ed25519.pub (100%) delete mode 100644 hosts/shuttle/home/default.nix delete mode 100644 hosts/shuttle/id_ed25519.pub delete mode 100644 hosts/shuttle/system/boot/default.nix delete mode 100644 hosts/shuttle/system/default.nix delete mode 100644 hosts/shuttle/system/hardware/default.nix rename hosts/{firefly => tower}/boot/default.nix (100%) rename hosts/{firefly => tower}/default.nix (79%) rename hosts/{firefly => tower}/disko/default.nix (98%) create mode 100644 hosts/tower/firewall/default.nix rename hosts/{firefly => tower}/hardware/default.nix (100%) rename hosts/{leash => tower}/id_ed25519.pub (100%) rename hosts/{detritus => xenia}/boot/default.nix (100%) rename hosts/{detritus => xenia}/default.nix (100%) rename hosts/{detritus => xenia}/disko/default.nix (100%) rename hosts/{detritus => xenia}/hardware/default.nix (100%) rename hosts/{detritus => xenia}/id_ed25519.pub (100%) delete mode 100644 modules/system/devices/networking/firewall/default.nix delete mode 100644 modules/system/devices/networking/wireguard/default.nix create mode 100644 modules/system/services/general/tlp/default.nix diff --git a/flake.nix b/flake.nix index 339d62f..f42e846 100644 --- a/flake.nix +++ b/flake.nix @@ -74,17 +74,16 @@ in { # nixos-rebuild switch --flake /etc/nixos#hostname nixosConfigurations = { - firefly = mkNix [ ./hosts/firefly ]; # Main Desktop - detritus = mkNix [ ./hosts/detritus ]; # Acer Desktop + tower = mkNix [ ./hosts/tower ]; # Main Desktop - shuttle = mkNix [ ./hosts/shuttleworth ]; # Pinebook Pro lacros = mkNix [ ./hosts/lacros ]; # Dell Chromebook redmond = mkNix [ ./hosts/redmond ]; # Lenovo Dual-Boot Laptop - treefruit = mkNix [ ./hosts/treefruit ]; # Macbook Pro 14,1 - leash = mkNix [ ./hosts/leash ]; # Portable Hard-Drive + pomme = mkNix [ ./hosts/treefruit ]; # Macbook Pro 14,1 + extern = mkNix [ ./hosts/extern ]; # Portable Hard-Drive - cyberspark = mkNix [ ./hosts/cyberspark ]; # Dell Optiplex 7010 - bomberman = mkNix [ ./hosts/bomberman ]; # Oracle ARM + kitty = mkNix [ ./hosts/kitty ]; # Dell Optiplex 7010 + xenia = mkNix [ ./hosts/xenia ]; # Acer Veriton X2611G + prophet = mkNix [ ./hosts/prophet ]; # Oracle Neoverse-N1 }; # home-manager switch --flake /etc/nixos#username diff --git a/hosts/cyberspark/home/default.nix b/hosts/cyberspark/home/default.nix deleted file mode 100644 index f6f0850..0000000 --- a/hosts/cyberspark/home/default.nix +++ /dev/null @@ -1,15 +0,0 @@ -{ ... }: -{ - imports = [ - ../../../modules/home/users - ../../../modules/home/settings/nix - ../../../modules/home/programs/misc/headless - ../../../modules/home/programs/terminal/fastfetch - ../../../modules/home/programs/terminal/git - ../../../modules/home/programs/terminal/neovim - ../../../modules/home/programs/terminal/ranger - ../../../modules/home/programs/terminal/tmux - ../../../modules/home/programs/terminal/zsh - ../../../variables/domains - ]; -} diff --git a/hosts/leash/boot/default.nix b/hosts/extern/boot/default.nix similarity index 95% rename from hosts/leash/boot/default.nix rename to hosts/extern/boot/default.nix index 678b7f6..d984437 100644 --- a/hosts/leash/boot/default.nix +++ b/hosts/extern/boot/default.nix @@ -1,7 +1,7 @@ { config, pkgs, ... }: { boot = { - kernelPackages = pkgs.unstable.linuxPackages_latest; + kernelPackages = pkgs.linuxPackages_5_10; kernel.sysctl."vm.max_map_count" = 2147483642; kernelParams = [ "nvidia_drm.fbdev=1" @@ -13,8 +13,8 @@ services.root-reset = { description = "Reset root and snapshot last boot"; wantedBy = [ "initrd.target" ]; - after = [ "dev-${config.networking.hostName}-root.device" ]; before = [ "sysroot.mount" ]; + after = [ "dev-${config.networking.hostName}-root.device" ]; unitConfig.DefaultDependencies = "no"; serviceConfig.Type = "oneshot"; script = '' diff --git a/hosts/leash/default.nix b/hosts/extern/default.nix similarity index 69% rename from hosts/leash/default.nix rename to hosts/extern/default.nix index 8cea3ef..9874584 100644 --- a/hosts/leash/default.nix +++ b/hosts/extern/default.nix @@ -4,12 +4,12 @@ ./boot ./disko ./hardware + ./wireguard ../../modules/system ]; system.lanzaboote.enable = true; - system.wireguard.client.enable = false; system.video.nvidia.enable = true; - networking.hostName = "leash"; + networking.hostName = "extern"; } diff --git a/hosts/leash/disko/default.nix b/hosts/extern/disko/default.nix similarity index 97% rename from hosts/leash/disko/default.nix rename to hosts/extern/disko/default.nix index 714e3a9..571c8cc 100644 --- a/hosts/leash/disko/default.nix +++ b/hosts/extern/disko/default.nix @@ -6,11 +6,12 @@ disk = { "${config.networking.hostName}" = { type = "disk"; - device = "/dev/sdi"; + device = "/dev/sdh"; content = { type = "gpt"; partitions = { ESP = { + priority = 1; size = "2G"; type = "EF00"; content = { diff --git a/hosts/leash/hardware/default.nix b/hosts/extern/hardware/default.nix similarity index 82% rename from hosts/leash/hardware/default.nix rename to hosts/extern/hardware/default.nix index 5aaaa62..eb19a42 100644 --- a/hosts/leash/hardware/default.nix +++ b/hosts/extern/hardware/default.nix @@ -1,5 +1,7 @@ { config, lib, modulesPath, ... }: { + imports = [ (modulesPath + "/profiles/all-hardware.nix") ]; + boot = { initrd = { availableKernelModules = [ @@ -7,15 +9,12 @@ "xhci_pci" "ahci" "usbhid" + "uas" "usb_storage" "sd_mod" ]; kernelModules = [ "dm-snapshot" - "vfio" - "vfio_pci" - "vfio_iommu_type1" - "kvm-amd" ]; }; }; @@ -23,7 +22,7 @@ fileSystems = { # Remote "/home/jimbo/JimboNFS" = { - device = "${config.ips.wgSpan}.1:/export/JimboNFS"; + device = "10.100.0.1:/export/JimboNFS"; fsType = "nfs4"; options = [ "x-systemd.automount" "_netdev" "nofail" "noauto" ]; }; diff --git a/hosts/firefly/id_ed25519.pub b/hosts/extern/id_ed25519.pub similarity index 100% rename from hosts/firefly/id_ed25519.pub rename to hosts/extern/id_ed25519.pub diff --git a/hosts/extern/wireguard/default.nix b/hosts/extern/wireguard/default.nix new file mode 100644 index 0000000..4c90766 --- /dev/null +++ b/hosts/extern/wireguard/default.nix @@ -0,0 +1,23 @@ +{ lib, config, ... }: +{ + networking = { + firewall = { + allowedUDPPorts = [ 51820 ]; + trustedInterfaces = [ "wgc" ]; + }; + + wireguard.interfaces.wgc = { + ips = [ "10.100.0.20/24" ]; + listenPort = 51820; + privateKey = config.secrets.wgClientPriv; + peers = [ + { # Cyberspark Server + publicKey = "qnOT/lXOJMaQgDUdXpyfGZB2IEyUouRje2m/bCe9ux8="; + allowedIPs = [ "10.100.0.0/24" ]; + endpoint = "sv.${config.domains.jim1}:51820"; + persistentKeepalive = 25; + } + ]; + }; + }; +} diff --git a/hosts/cyberspark/system/default.nix b/hosts/kitty/default.nix similarity index 94% rename from hosts/cyberspark/system/default.nix rename to hosts/kitty/default.nix index 5979d3b..8b453ef 100644 --- a/hosts/cyberspark/system/default.nix +++ b/hosts/kitty/default.nix @@ -21,5 +21,5 @@ ../../../variables ]; - networking.hostName = "cyberspark"; + networking.hostName = "kitty"; } diff --git a/hosts/kitty/firewall/default.nix b/hosts/kitty/firewall/default.nix new file mode 100644 index 0000000..d304593 --- /dev/null +++ b/hosts/kitty/firewall/default.nix @@ -0,0 +1,45 @@ +{ lib, config, ... }: +{ + networking = { + firewall = { + allowPing = false; + extraInputRules = '' + ip saddr { ${config.ips.localSpan}.0/24, 10.100.0.0/24 } tcp dport 2049 accept comment "Accept NFS" + ip saddr { ${config.ips.pc}, ${config.secrets.lunaIP}, ${config.secrets.cornIP} } tcp dport { 1935, 1945 } accept comment "Accept RTMP" + ''; + }; + + # Nftables configuration only if server is enabled + nftables.tables.forwarding = { + family = "ip"; + content = '' + chain PREROUTING { + type nat hook prerouting priority dstnat; policy accept; + tcp dport 2211 dnat to ${config.ips.pc}:22 comment "SSH to PC" + tcp dport 2222 dnat to 10.100.0.19:22 comment "SSH to Oracle VM" + + udp dport { 27005, 27015, 7777 } dnat to ${config.ips.pc} comment "PC Hosted Games" + + tcp dport { 48010, 47989, 47984 } dnat to ${config.ips.pc} comment "PC Sunshine TCP" + udp dport { 47998, 47999, 48000 } dnat to ${config.ips.pc} comment "PC Sunshine UDP" + + tcp dport { 38010, 37989, 37984 } dnat to ${config.ips.vm} comment "VM Sunshine TCP" + udp dport { 37998, 37999, 38000 } dnat to ${config.ips.vm} comment "VM Sunshine UDP" + + udp dport { 7790, 7791, 7792 } dnat to ${config.ips.hx} comment "Deus Ex" + + ip saddr ${config.secrets.cornIP} tcp dport { 9943, 9944 } dnat to ${config.ips.vm} comment "VM ALVR TCP" + ip saddr ${config.secrets.cornIP} udp dport { 9943, 9944 } dnat to ${config.ips.vm} comment "VM ALVR UDP" + } + + chain POSTROUTING { + type nat hook postrouting priority 100; policy accept; + oifname "${config.ips.netInt}" masquerade + } + ''; + }; + }; + + # Enable IP forwarding for the server configuration + boot.kernel.sysctl."net.ipv4.ip_forward" = lib.mkIf config.system.firewall.server.enable 1; +} diff --git a/hosts/cyberspark/system/hardware/default.nix b/hosts/kitty/hardware/default.nix similarity index 100% rename from hosts/cyberspark/system/hardware/default.nix rename to hosts/kitty/hardware/default.nix diff --git a/hosts/cyberspark/id_ed25519.pub b/hosts/kitty/id_ed25519.pub similarity index 100% rename from hosts/cyberspark/id_ed25519.pub rename to hosts/kitty/id_ed25519.pub diff --git a/hosts/kitty/wireguard/default.nix b/hosts/kitty/wireguard/default.nix new file mode 100644 index 0000000..a8b26e5 --- /dev/null +++ b/hosts/kitty/wireguard/default.nix @@ -0,0 +1,28 @@ +{ lib, config, ... }: +{ + networking = { + firewall.allowedUDPPorts = [ 51820 ]; + + nat = { + enable = config.system.wireguard.server.enable; + externalInterface = "eno1"; + internalInterfaces = [ "wgs" ]; + }; + + wireguard.interfaces.wgs = { + ips = [ "10.100.0.1/24" ]; + listenPort = 51820; + privateKey = config.secrets.wgServerPriv; + peers = [ + { # NixOS Config Key + publicKey = "OKUH/h6YSURI4vgeTZKQD15QsqaygdbTn1mAWzQp9S0="; + allowedIPs = [ "10.100.0.16/28" ]; + } + { # Pixel 9 + publicKey = "dPCtjm67adMZCnyL1O2L+uUOk0RbjA9T/tht1r+qcE4="; + allowedIPs = [ "10.100.0.2/32" ]; + } + ]; + }; + }; +} diff --git a/hosts/lacros/default.nix b/hosts/lacros/default.nix index 5e8628f..7b20b9d 100644 --- a/hosts/lacros/default.nix +++ b/hosts/lacros/default.nix @@ -1,8 +1,10 @@ -{ config, lib, ... }: +{ lib, ... }: { imports = [ - ./hardware ./boot + ./disko + ./hardware + ./wireguard # Apps and programs ../../../modules/system @@ -30,5 +32,4 @@ }; networking.hostName = "lacros"; - networking.wireguard.interfaces."${config.ips.wgInt}".ips = [ "${config.ips.wgSpan}.18/24" ]; } diff --git a/hosts/lacros/wireguard/default.nix b/hosts/lacros/wireguard/default.nix new file mode 100644 index 0000000..88a6dce --- /dev/null +++ b/hosts/lacros/wireguard/default.nix @@ -0,0 +1,23 @@ +{ lib, config, ... }: +{ + networking = { + firewall = { + allowedUDPPorts = [ 51820 ]; + trustedInterfaces = [ "wgc" ]; + }; + + wireguard.interfaces.wgc = { + ips = [ "${config.ips.wgSpan}.18/24" ]; + listenPort = 51820; + privateKey = config.secrets.wgClientPriv; + peers = [ + { # Cyberspark Server + publicKey = "qnOT/lXOJMaQgDUdXpyfGZB2IEyUouRje2m/bCe9ux8="; + allowedIPs = [ "10.100.0.0/24" ]; + endpoint = "sv.${config.domains.jim1}:51820"; + persistentKeepalive = 25; + } + ]; + }; + }; +} diff --git a/hosts/treefruit/home/default.nix b/hosts/pomme/home/default.nix similarity index 100% rename from hosts/treefruit/home/default.nix rename to hosts/pomme/home/default.nix diff --git a/hosts/treefruit/id_ed25519.pub b/hosts/pomme/id_ed25519.pub similarity index 100% rename from hosts/treefruit/id_ed25519.pub rename to hosts/pomme/id_ed25519.pub diff --git a/hosts/treefruit/system/boot/default.nix b/hosts/pomme/system/boot/default.nix similarity index 100% rename from hosts/treefruit/system/boot/default.nix rename to hosts/pomme/system/boot/default.nix diff --git a/hosts/treefruit/system/default.nix b/hosts/pomme/system/default.nix similarity index 100% rename from hosts/treefruit/system/default.nix rename to hosts/pomme/system/default.nix diff --git a/hosts/treefruit/system/hardware/default.nix b/hosts/pomme/system/hardware/default.nix similarity index 100% rename from hosts/treefruit/system/hardware/default.nix rename to hosts/pomme/system/hardware/default.nix diff --git a/hosts/bomberman/boot/default.nix b/hosts/prophet/boot/default.nix similarity index 100% rename from hosts/bomberman/boot/default.nix rename to hosts/prophet/boot/default.nix diff --git a/hosts/bomberman/default.nix b/hosts/prophet/default.nix similarity index 100% rename from hosts/bomberman/default.nix rename to hosts/prophet/default.nix diff --git a/hosts/bomberman/disko/default.nix b/hosts/prophet/disko/default.nix similarity index 100% rename from hosts/bomberman/disko/default.nix rename to hosts/prophet/disko/default.nix diff --git a/hosts/bomberman/hardware/default.nix b/hosts/prophet/hardware/default.nix similarity index 100% rename from hosts/bomberman/hardware/default.nix rename to hosts/prophet/hardware/default.nix diff --git a/hosts/bomberman/id_ed25519.pub b/hosts/prophet/id_ed25519.pub similarity index 100% rename from hosts/bomberman/id_ed25519.pub rename to hosts/prophet/id_ed25519.pub diff --git a/hosts/shuttle/home/default.nix b/hosts/shuttle/home/default.nix deleted file mode 100644 index 0fa1a90..0000000 --- a/hosts/shuttle/home/default.nix +++ /dev/null @@ -1,9 +0,0 @@ -{ config, pkgs, ... }: -{ - imports = [ - ../../../modules/home - ../../../modules/home/programs/misc/remote-desktop - ]; - - wayland.windowManager.sway.config.output.${config.displays.dI}.scale = "1.3"; -} diff --git a/hosts/shuttle/id_ed25519.pub b/hosts/shuttle/id_ed25519.pub deleted file mode 100644 index 3d0e0ec..0000000 --- a/hosts/shuttle/id_ed25519.pub +++ /dev/null @@ -1 +0,0 @@ -ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIK+L723mCLy9/9UAXwkY3+06Oq22dOj+lDnA0lMLbrsR diff --git a/hosts/shuttle/system/boot/default.nix b/hosts/shuttle/system/boot/default.nix deleted file mode 100644 index 8022416..0000000 --- a/hosts/shuttle/system/boot/default.nix +++ /dev/null @@ -1,7 +0,0 @@ -{ pkgs, ... }: -{ - boot = { - kernelPackages = pkgs.linuxPackages_latest; - kernel.sysctl."vm.max_map_count" = 2147483642; - }; -} diff --git a/hosts/shuttle/system/default.nix b/hosts/shuttle/system/default.nix deleted file mode 100644 index 29a3ed1..0000000 --- a/hosts/shuttle/system/default.nix +++ /dev/null @@ -1,32 +0,0 @@ -{ config, lib, hardware, ... }: -{ - imports = [ - ./hardware - ./boot - - # Apps and programs - ../../../modules/system - ../../../modules/system/accounts - ../../../modules/system/desktop - ../../../modules/system/programs - ../../../modules/system/services - - # Devices and hardware - ../../../modules/system/devices - ../../../modules/system/devices/boot/extlinux - ../../../modules/system/devices/networking/wireless - ../../../modules/system/devices/networking/firewall/pc - ../../../modules/system/devices/networking/wireguard/pc - - # Extras - ../../../overlays - ../../../variables - - # Imports - hardware.nixosModules.pine64-pinebook-pro - ]; - - networking.hostName = "shuttle"; - hardware.opengl.driSupport32Bit = lib.mkForce false; - networking.wireguard.interfaces."${config.ips.wgInt}".ips = [ "${config.ips.wgSpan}.17/24" ]; -} diff --git a/hosts/shuttle/system/hardware/default.nix b/hosts/shuttle/system/hardware/default.nix deleted file mode 100644 index 5394ed0..0000000 --- a/hosts/shuttle/system/hardware/default.nix +++ /dev/null @@ -1,40 +0,0 @@ -{ config, lib, pkgs, modulesPath, ... }: -{ - boot = { - initrd = { - availableKernelModules = [ ]; - kernelModules = [ ]; - }; - blacklistedKernelModules = [ - "pcspkr" - ]; - }; - - fileSystems = { - "/" = { - device = "/dev/disk/by-uuid/25738e24-385e-4bcf-bff5-d0e6274003b6"; - fsType = "btrfs"; - }; - "/boot" = { - device = "/dev/disk/by-uuid/01D2-E962"; - fsType = "vfat"; - options = [ "fmask=0022" "dmask=0022" ]; - }; - "/home/jimbo/Downloads" = { - device = "/dev/disk/by-uuid/f0b6cf4e-9576-4ab5-96ae-2a7e57599a35"; - fsType = "btrfs"; - }; - "/home/jimbo/JimboNFS" = { - device = "${config.ips.wgSpan}.1:/export/JimboNFS"; - fsType = "nfs4"; - options = [ "x-systemd.automount" "_netdev" "nofail" "noauto" ]; - }; - }; - - swapDevices = [ - { device = "/dev/disk/by-uuid/95c43e5a-b53d-41fd-99a3-54181510070e"; } - ]; - - networking.useDHCP = lib.mkDefault true; - nixpkgs.hostPlatform = lib.mkDefault "aarch64-linux"; -} diff --git a/hosts/firefly/boot/default.nix b/hosts/tower/boot/default.nix similarity index 100% rename from hosts/firefly/boot/default.nix rename to hosts/tower/boot/default.nix index 46fe5a9..d306ad4 100644 --- a/hosts/firefly/boot/default.nix +++ b/hosts/tower/boot/default.nix @@ -30,8 +30,8 @@ in { services.root-reset = { description = "Reset root and snapshot last boot"; wantedBy = [ "initrd.target" ]; - after = [ "dev-${config.networking.hostName}-root.device" ]; before = [ "sysroot.mount" ]; + after = [ "dev-${config.networking.hostName}-root.device" ]; unitConfig.DefaultDependencies = "no"; serviceConfig.Type = "oneshot"; script = '' diff --git a/hosts/firefly/default.nix b/hosts/tower/default.nix similarity index 79% rename from hosts/firefly/default.nix rename to hosts/tower/default.nix index aba8770..a720838 100644 --- a/hosts/firefly/default.nix +++ b/hosts/tower/default.nix @@ -3,17 +3,17 @@ imports = [ ./boot ./disko + ./firewall ./hardware ../../modules/system ]; system.lanzaboote.enable = true; system.wireless.enable = false; - system.wireguard.client.enable = false; system.video.nvidia.enable = true; system.libvirtd.enable = true; environment.sessionVariables.NIXOS_OZONE_WL = "1"; - networking.hostName = "firefly"; + networking.hostName = "tower"; } diff --git a/hosts/firefly/disko/default.nix b/hosts/tower/disko/default.nix similarity index 98% rename from hosts/firefly/disko/default.nix rename to hosts/tower/disko/default.nix index ceed70d..da0b042 100644 --- a/hosts/firefly/disko/default.nix +++ b/hosts/tower/disko/default.nix @@ -11,6 +11,7 @@ type = "gpt"; partitions = { ESP = { + priority = 1; size = "2G"; type = "EF00"; content = { diff --git a/hosts/tower/firewall/default.nix b/hosts/tower/firewall/default.nix new file mode 100644 index 0000000..1eab0b4 --- /dev/null +++ b/hosts/tower/firewall/default.nix @@ -0,0 +1,9 @@ +{ ... }: +{ + networking.firewall = { + allowedUDPPorts = [ + 27015 # Half-Life + 7777 # Lethal Company + ]; + }; +} diff --git a/hosts/firefly/hardware/default.nix b/hosts/tower/hardware/default.nix similarity index 100% rename from hosts/firefly/hardware/default.nix rename to hosts/tower/hardware/default.nix diff --git a/hosts/leash/id_ed25519.pub b/hosts/tower/id_ed25519.pub similarity index 100% rename from hosts/leash/id_ed25519.pub rename to hosts/tower/id_ed25519.pub diff --git a/hosts/detritus/boot/default.nix b/hosts/xenia/boot/default.nix similarity index 100% rename from hosts/detritus/boot/default.nix rename to hosts/xenia/boot/default.nix diff --git a/hosts/detritus/default.nix b/hosts/xenia/default.nix similarity index 100% rename from hosts/detritus/default.nix rename to hosts/xenia/default.nix diff --git a/hosts/detritus/disko/default.nix b/hosts/xenia/disko/default.nix similarity index 100% rename from hosts/detritus/disko/default.nix rename to hosts/xenia/disko/default.nix diff --git a/hosts/detritus/hardware/default.nix b/hosts/xenia/hardware/default.nix similarity index 100% rename from hosts/detritus/hardware/default.nix rename to hosts/xenia/hardware/default.nix diff --git a/hosts/detritus/id_ed25519.pub b/hosts/xenia/id_ed25519.pub similarity index 100% rename from hosts/detritus/id_ed25519.pub rename to hosts/xenia/id_ed25519.pub diff --git a/modules/home/sway/rules/default.nix b/modules/home/sway/rules/default.nix index 97019b3..40e879f 100644 --- a/modules/home/sway/rules/default.nix +++ b/modules/home/sway/rules/default.nix @@ -18,7 +18,6 @@ "${config.ws.w6}" "${config.ws.w4a}" "${config.ws.w5a}" - "${config.ws.w6a}" ]; workspaces3 = [ "${config.ws.w7}" @@ -26,6 +25,9 @@ "${config.ws.w9}" "${config.ws.w7a}" "${config.ws.w8a}" + ]; + workspaces4 = [ + "${config.ws.w6a}" "${config.ws.w9a}" ]; assign = output: workspaces: @@ -37,7 +39,8 @@ in (assign "${config.displays.d1}" workspaces1) ++ (assign "${config.displays.d2}" workspaces2) ++ - (assign "${config.displays.d3}" workspaces3); + (assign "${config.displays.d3}" workspaces3) ++ + (assign "${config.displays.d4}" workspaces4); # Rules defaultWorkspace = config.ws.w1; diff --git a/modules/system/accounts/users/jimbo/default.nix b/modules/system/accounts/users/jimbo/default.nix index 3d23233..35dc138 100644 --- a/modules/system/accounts/users/jimbo/default.nix +++ b/modules/system/accounts/users/jimbo/default.nix @@ -6,16 +6,15 @@ hashedPassword = config.secrets.jimboAccPass; isNormalUser = true; openssh.authorizedKeys.keys = [ - (builtins.readFile ../../../../../hosts/firefly/id_ed25519.pub) - (builtins.readFile ../../../../../hosts/detritus/id_ed25519.pub) + (builtins.readFile ../../../../../hosts/tower/id_ed25519.pub) - (builtins.readFile ../../../../../hosts/shuttle/id_ed25519.pub) (builtins.readFile ../../../../../hosts/lacros/id_ed25519.pub) (builtins.readFile ../../../../../hosts/redmond/id_ed25519.pub) - (builtins.readFile ../../../../../hosts/treefruit/id_ed25519.pub) + (builtins.readFile ../../../../../hosts/pomme/id_ed25519.pub) - (builtins.readFile ../../../../../hosts/cyberspark/id_ed25519.pub) - (builtins.readFile ../../../../../hosts/bomberman/id_ed25519.pub) + (builtins.readFile ../../../../../hosts/kitty/id_ed25519.pub) + (builtins.readFile ../../../../../hosts/xenia/id_ed25519.pub) + (builtins.readFile ../../../../../hosts/prophet/id_ed25519.pub) "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJahAoF74BY6GCTsFkt1ADKaraFgJJozW1Y1aBTLK0j9 Pixel9" ]; diff --git a/modules/system/devices/networking/default.nix b/modules/system/devices/networking/default.nix index 8ac8acd..539cc69 100644 --- a/modules/system/devices/networking/default.nix +++ b/modules/system/devices/networking/default.nix @@ -1,10 +1,6 @@ { ... }: { - imports = [ - ./firewall - ./wireguard - ./wireless - ]; + imports = [ ./wireless ]; networking = { wireless.enable = false; diff --git a/modules/system/devices/networking/firewall/default.nix b/modules/system/devices/networking/firewall/default.nix deleted file mode 100644 index 3fb5214..0000000 --- a/modules/system/devices/networking/firewall/default.nix +++ /dev/null @@ -1,66 +0,0 @@ -{ lib, config, ... }: -{ - options.system.firewall = { - server = { - enable = lib.mkOption { - type = lib.types.bool; - default = false; - description = "Enable server firewall settings"; - }; - }; - }; - - config = { - networking = { - firewall = { - allowPing = false; - extraInputRules = '' - ${lib.optionalString (!config.system.firewall.server.enable) '' - ip saddr { ${config.ips.server}, 10.100.0.1 } accept comment "Accept Server" - ''} - ${lib.optionalString config.system.firewall.server.enable '' - ip saddr { ${config.ips.localSpan}.0/24, 10.100.0.0/24 } tcp dport 2049 accept comment "Accept NFS" - ip saddr { ${config.ips.pc}, ${config.secrets.lunaIP}, ${config.secrets.cornIP} } tcp dport { 1935, 1945 } accept comment "Accept RTMP" - ''} - ''; - }; - - # Nftables configuration only if server is enabled - nftables = lib.mkIf config.system.firewall.server.enable { - tables = { - forwarding = { - family = "ip"; - content = '' - chain PREROUTING { - type nat hook prerouting priority dstnat; policy accept; - tcp dport 2211 dnat to ${config.ips.pc}:22 comment "SSH to PC" - tcp dport 2222 dnat to 10.100.0.19:22 comment "SSH to Oracle VM" - - udp dport { 27005, 27015, 7777 } dnat to ${config.ips.pc} comment "PC Hosted Games" - - tcp dport { 58010, 57989, 57984 } dnat to ${config.ips.pc} comment "PC Sunshine TCP" - udp dport { 57998, 57999, 58000 } dnat to ${config.ips.pc} comment "PC Sunshine UDP" - - tcp dport { 38010, 37989, 37984 } dnat to ${config.ips.vm} comment "VM Sunshine TCP" - udp dport { 37998, 37999, 38000 } dnat to ${config.ips.vm} comment "VM Sunshine UDP" - - udp dport { 7790, 7791, 7792 } dnat to ${config.ips.hx} comment "Deus Ex" - - ip saddr ${config.secrets.cornIP} tcp dport { 9943, 9944 } dnat to ${config.ips.vm} comment "VM ALVR TCP" - ip saddr ${config.secrets.cornIP} udp dport { 9943, 9944 } dnat to ${config.ips.vm} comment "VM ALVR UDP" - } - - chain POSTROUTING { - type nat hook postrouting priority 100; policy accept; - oifname "${config.ips.netInt}" masquerade - } - ''; - }; - }; - }; - }; - - # Enable IP forwarding for the server configuration - boot.kernel.sysctl."net.ipv4.ip_forward" = lib.mkIf config.system.firewall.server.enable 1; - }; -} diff --git a/modules/system/devices/networking/wireguard/default.nix b/modules/system/devices/networking/wireguard/default.nix deleted file mode 100644 index 84ccf78..0000000 --- a/modules/system/devices/networking/wireguard/default.nix +++ /dev/null @@ -1,63 +0,0 @@ -{ lib, config, ... }: -{ - options.system.wireguard = { - client = { - enable = lib.mkOption { - type = lib.types.bool; - default = true; - description = "Enable WireGuard client"; - }; - }; - server = { - enable = lib.mkOption { - type = lib.types.bool; - default = false; - description = "Enable WireGuard server"; - }; - }; - }; - - config = { - networking = { - firewall.allowedUDPPorts = [ 51820 ]; - - nat = { - enable = config.system.wireguard.server.enable; - externalInterface = "${config.ips.netInt}"; - internalInterfaces = [ "wgs" ]; - }; - - wireguard.interfaces = { - wgc = lib.mkIf config.system.wireguard.client.enable { - # Define IP of client in per device config - listenPort = 51820; - privateKey = config.secrets.wgClientPriv; - peers = [ - { # NixOS Server - publicKey = "qnOT/lXOJMaQgDUdXpyfGZB2IEyUouRje2m/bCe9ux8="; - allowedIPs = [ "10.100.0.0/24" ]; - endpoint = "sv.${config.domains.jim1}:51820"; - persistentKeepalive = 25; - } - ]; - }; - - wgs = lib.mkIf config.system.wireguard.server.enable { - ips = [ "10.100.0.1/24" ]; - listenPort = 51820; - privateKey = config.secrets.wgServerPriv; - peers = [ - { # NixOS - publicKey = "OKUH/h6YSURI4vgeTZKQD15QsqaygdbTn1mAWzQp9S0="; - allowedIPs = [ "10.100.0.16/28" ]; - } - { # Pixel 9 - publicKey = "dPCtjm67adMZCnyL1O2L+uUOk0RbjA9T/tht1r+qcE4="; - allowedIPs = [ "10.100.0.2/32" ]; - } - ]; - }; - }; - }; - }; -} diff --git a/modules/system/services/general/default.nix b/modules/system/services/general/default.nix index 895f88e..d97e4b9 100644 --- a/modules/system/services/general/default.nix +++ b/modules/system/services/general/default.nix @@ -8,5 +8,6 @@ ./mpd ./ssh ./sunshine + ./tlp ]; } diff --git a/modules/system/services/general/keyd/default.nix b/modules/system/services/general/keyd/default.nix index 9d7cac5..08b0024 100644 --- a/modules/system/services/general/keyd/default.nix +++ b/modules/system/services/general/keyd/default.nix @@ -16,17 +16,12 @@ right = "noop"; }; - control = { + ctrlmod = { + backspace = "delete"; h = "left"; j = "down"; k = "up"; l = "right"; - g = "macro(C-h)"; - semicolon = "macro(C-l)"; - }; - - ctrlmod = { - backspace = "delete"; "1" = "f1"; "2" = "f2"; "3" = "f3"; diff --git a/modules/system/services/general/sunshine/default.nix b/modules/system/services/general/sunshine/default.nix index e91a2fb..d38c4a7 100644 --- a/modules/system/services/general/sunshine/default.nix +++ b/modules/system/services/general/sunshine/default.nix @@ -3,5 +3,6 @@ services.sunshine = { enable = config.system.desktop.enable; autoStart = false; + openFirewall = true; }; } diff --git a/modules/system/services/general/tlp/default.nix b/modules/system/services/general/tlp/default.nix new file mode 100644 index 0000000..097e7bc --- /dev/null +++ b/modules/system/services/general/tlp/default.nix @@ -0,0 +1,4 @@ +{ ... }: +{ + services.tlp.enable = true; +} diff --git a/variables/ips/default.nix b/variables/ips/default.nix index 5efaa65..4b6f5b9 100644 --- a/variables/ips/default.nix +++ b/variables/ips/default.nix @@ -6,11 +6,10 @@ }; config.ips = rec { - netInt = "eno1"; - localSpan = "10.0.0"; + localSpan = "10.1.0"; server = "${localSpan}.2"; - pc = "${localSpan}.3"; - vm = "${localSpan}.4"; + pc = "${localSpan}.4"; + vm = "${localSpan}.5"; hx = "${localSpan}.70"; }; }