Fix firewall and add back leash while I figure out why disko is failing
This commit is contained in:
parent
89e2715162
commit
9299782075
|
|
@ -81,6 +81,7 @@
|
|||
lacros = mkNix [ ./hosts/lacros ]; # Dell Chromebook
|
||||
redmond = mkNix [ ./hosts/redmond ]; # Lenovo Dual-Boot Laptop
|
||||
treefruit = mkNix [ ./hosts/treefruit ]; # Macbook Pro 14,1
|
||||
leash = mkNix [ ./hosts/leash ]; # Portable Hard-Drive
|
||||
|
||||
cyberspark = mkNix [ ./hosts/cyberspark ]; # Dell Optiplex 7010
|
||||
bomberman = mkNix [ ./hosts/bomberman ]; # Oracle ARM
|
||||
|
|
|
|||
|
|
@ -57,7 +57,7 @@ in {
|
|||
};
|
||||
};
|
||||
|
||||
# Additional entry to boot from the second GPU
|
||||
# Use second GPU on boot
|
||||
specialisation.gputwo.configuration = {
|
||||
boot.kernelParams = commonKernelParams ++ [ "vfio-pci.ids=10de:2504,10de:228e" ];
|
||||
};
|
||||
|
|
|
|||
42
hosts/leash/boot/default.nix
Normal file
42
hosts/leash/boot/default.nix
Normal file
|
|
@ -0,0 +1,42 @@
|
|||
{ config, pkgs, ... }:
|
||||
{
|
||||
boot = {
|
||||
kernelPackages = pkgs.unstable.linuxPackages_latest;
|
||||
kernel.sysctl."vm.max_map_count" = 2147483642;
|
||||
kernelParams = [
|
||||
"nvidia_drm.fbdev=1"
|
||||
"nouveau.config=NvGspRm=1"
|
||||
];
|
||||
|
||||
initrd.systemd = {
|
||||
enable = true;
|
||||
services.root-reset = {
|
||||
description = "Reset root and snapshot last boot";
|
||||
wantedBy = [ "initrd.target" ];
|
||||
after = [ "dev-${config.networking.hostName}-root.device" ];
|
||||
before = [ "sysroot.mount" ];
|
||||
unitConfig.DefaultDependencies = "no";
|
||||
serviceConfig.Type = "oneshot";
|
||||
script = ''
|
||||
mkdir -p /mnt
|
||||
mount /dev/${config.networking.hostName}/root /mnt
|
||||
|
||||
if [[ -e /mnt/prev ]]; then
|
||||
btrfs subvolume delete /mnt/prev
|
||||
fi
|
||||
|
||||
btrfs subvolume snapshot /mnt/root /mnt/prev
|
||||
|
||||
btrfs subvolume list -o /mnt/root | cut -f9 -d' ' | while read subvolume; do
|
||||
btrfs subvolume delete "/mnt/$subvolume"
|
||||
done
|
||||
|
||||
btrfs subvolume delete /mnt/root
|
||||
btrfs subvolume create /mnt/root
|
||||
|
||||
umount /mnt
|
||||
'';
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
15
hosts/leash/default.nix
Normal file
15
hosts/leash/default.nix
Normal file
|
|
@ -0,0 +1,15 @@
|
|||
{ ... }:
|
||||
{
|
||||
imports = [
|
||||
./boot
|
||||
./disko
|
||||
./hardware
|
||||
../../modules/system
|
||||
];
|
||||
|
||||
system.lanzaboote.enable = true;
|
||||
system.wireguard.client.enable = false;
|
||||
system.video.nvidia.enable = true;
|
||||
|
||||
networking.hostName = "leash";
|
||||
}
|
||||
96
hosts/leash/disko/default.nix
Normal file
96
hosts/leash/disko/default.nix
Normal file
|
|
@ -0,0 +1,96 @@
|
|||
{ disko, config, ... }:
|
||||
{
|
||||
imports = [ disko.nixosModules.disko ];
|
||||
|
||||
disko.devices = {
|
||||
disk = {
|
||||
"${config.networking.hostName}" = {
|
||||
type = "disk";
|
||||
device = "/dev/sdi";
|
||||
content = {
|
||||
type = "gpt";
|
||||
partitions = {
|
||||
ESP = {
|
||||
size = "2G";
|
||||
type = "EF00";
|
||||
content = {
|
||||
type = "filesystem";
|
||||
format = "vfat";
|
||||
mountpoint = "/boot";
|
||||
mountOptions = [ "umask=0077" ];
|
||||
};
|
||||
};
|
||||
luks = {
|
||||
size = "100%";
|
||||
content = {
|
||||
type = "luks";
|
||||
name = "${config.networking.hostName}-disk";
|
||||
settings.allowDiscards = true;
|
||||
passwordFile = "/tmp/secret.key";
|
||||
content = {
|
||||
type = "lvm_pv";
|
||||
vg = "${config.networking.hostName}";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
lvm_vg = {
|
||||
"${config.networking.hostName}" = {
|
||||
type = "lvm_vg";
|
||||
lvs = {
|
||||
root = {
|
||||
size = "100%";
|
||||
content = {
|
||||
type = "btrfs";
|
||||
extraArgs = [ "-f" ];
|
||||
subvolumes = {
|
||||
"/root" = {
|
||||
mountpoint = "/";
|
||||
mountOptions = [ "compress=zstd" "noatime" ];
|
||||
};
|
||||
"/prev" = {
|
||||
mountpoint = "/prev";
|
||||
mountOptions = [ "compress=zstd" "noatime" ];
|
||||
};
|
||||
"/nix" = {
|
||||
mountpoint = "/nix";
|
||||
mountOptions = [ "compress=zstd" "noatime" ];
|
||||
};
|
||||
|
||||
# Impermanence
|
||||
"/persist" = {
|
||||
mountpoint = "/persist";
|
||||
mountOptions = [ "compress=zstd" "noatime" ];
|
||||
};
|
||||
"/persist/.snapshots" = { };
|
||||
|
||||
"/jimbo" = {
|
||||
mountpoint = "/persist/home/jimbo";
|
||||
mountOptions = [ "compress=zstd" "noatime" ];
|
||||
};
|
||||
"/jimbo/.snapshots" = { };
|
||||
};
|
||||
};
|
||||
};
|
||||
swap = {
|
||||
size = "2G";
|
||||
content = {
|
||||
type = "swap";
|
||||
discardPolicy = "both";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
# Needed for impermanence
|
||||
fileSystems = {
|
||||
"/persist".neededForBoot = true;
|
||||
"/persist/home/jimbo".neededForBoot = true;
|
||||
};
|
||||
}
|
||||
35
hosts/leash/hardware/default.nix
Normal file
35
hosts/leash/hardware/default.nix
Normal file
|
|
@ -0,0 +1,35 @@
|
|||
{ config, lib, modulesPath, ... }:
|
||||
{
|
||||
boot = {
|
||||
initrd = {
|
||||
availableKernelModules = [
|
||||
"nvme"
|
||||
"xhci_pci"
|
||||
"ahci"
|
||||
"usbhid"
|
||||
"usb_storage"
|
||||
"sd_mod"
|
||||
];
|
||||
kernelModules = [
|
||||
"dm-snapshot"
|
||||
"vfio"
|
||||
"vfio_pci"
|
||||
"vfio_iommu_type1"
|
||||
"kvm-amd"
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
fileSystems = {
|
||||
# Remote
|
||||
"/home/jimbo/JimboNFS" = {
|
||||
device = "${config.ips.wgSpan}.1:/export/JimboNFS";
|
||||
fsType = "nfs4";
|
||||
options = [ "x-systemd.automount" "_netdev" "nofail" "noauto" ];
|
||||
};
|
||||
};
|
||||
|
||||
networking.useDHCP = lib.mkDefault true;
|
||||
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
|
||||
hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
|
||||
}
|
||||
1
hosts/leash/id_ed25519.pub
Normal file
1
hosts/leash/id_ed25519.pub
Normal file
|
|
@ -0,0 +1 @@
|
|||
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIC2lMkUd+BbXITE5LTg94hEzmA6UKsIIbaf5YOjGoLzl
|
||||
|
|
@ -105,7 +105,8 @@
|
|||
".local/share/ranger/bookmarks".text = ''
|
||||
# Local files
|
||||
h:/home/jimbo/
|
||||
k:/home/jimbo/Downloads
|
||||
k:/home/jimbo/Keepers
|
||||
j:/home/jimbo/Downloads
|
||||
v:/home/jimbo/Videos
|
||||
c:/home/jimbo/.config
|
||||
l:/home/jimbo/.local
|
||||
|
|
|
|||
|
|
@ -32,6 +32,7 @@
|
|||
|
||||
gtk3 = {
|
||||
bookmarks = [
|
||||
"file:///home/jimbo/Keepers"
|
||||
"file:///home/jimbo/Downloads"
|
||||
"file:///home/jimbo/Documents"
|
||||
"file:///home/jimbo/Videos"
|
||||
|
|
|
|||
|
|
@ -4,7 +4,7 @@
|
|||
hideMounts = true;
|
||||
users.jimbo = {
|
||||
directories = [
|
||||
"Downloads"
|
||||
"Keepers"
|
||||
"Documents"
|
||||
"Pictures"
|
||||
"Videos"
|
||||
|
|
|
|||
|
|
@ -14,11 +14,14 @@
|
|||
networking = {
|
||||
firewall = {
|
||||
allowPing = false;
|
||||
extraInputRules = lib.mkIf (!config.system.firewall.server.enable) ''
|
||||
ip saddr { ${config.ips.server}, ${config.ips.wgSpan}.1 } accept comment "Accept Server"
|
||||
'' // lib.mkIf config.system.firewall.server.enable ''
|
||||
ip saddr { ${config.ips.localSpan}.0/24, ${config.ips.wgSpan}.0/24 } tcp dport 2049 accept comment "Accept NFS"
|
||||
ip saddr { ${config.ips.pc}, ${config.secrets.lunaIP}, ${config.secrets.cornIP} } tcp dport { 1935, 1945 } accept comment "Accept RTMP"
|
||||
extraInputRules = ''
|
||||
${lib.optionalString (!config.system.firewall.server.enable) ''
|
||||
ip saddr { ${config.ips.server}, ${config.ips.wgSpan}.1 } accept comment "Accept Server"
|
||||
''}
|
||||
${lib.optionalString config.system.firewall.server.enable ''
|
||||
ip saddr { ${config.ips.localSpan}.0/24, ${config.ips.wgSpan}.0/24 } tcp dport 2049 accept comment "Accept NFS"
|
||||
ip saddr { ${config.ips.pc}, ${config.secrets.lunaIP}, ${config.secrets.cornIP} } tcp dport { 1935, 1945 } accept comment "Accept RTMP"
|
||||
''}
|
||||
'';
|
||||
};
|
||||
|
||||
|
|
|
|||
Loading…
Reference in a new issue