Fix firewall and add back leash while I figure out why disko is failing
This commit is contained in:
parent
89e2715162
commit
9299782075
|
@ -81,6 +81,7 @@
|
||||||
lacros = mkNix [ ./hosts/lacros ]; # Dell Chromebook
|
lacros = mkNix [ ./hosts/lacros ]; # Dell Chromebook
|
||||||
redmond = mkNix [ ./hosts/redmond ]; # Lenovo Dual-Boot Laptop
|
redmond = mkNix [ ./hosts/redmond ]; # Lenovo Dual-Boot Laptop
|
||||||
treefruit = mkNix [ ./hosts/treefruit ]; # Macbook Pro 14,1
|
treefruit = mkNix [ ./hosts/treefruit ]; # Macbook Pro 14,1
|
||||||
|
leash = mkNix [ ./hosts/leash ]; # Portable Hard-Drive
|
||||||
|
|
||||||
cyberspark = mkNix [ ./hosts/cyberspark ]; # Dell Optiplex 7010
|
cyberspark = mkNix [ ./hosts/cyberspark ]; # Dell Optiplex 7010
|
||||||
bomberman = mkNix [ ./hosts/bomberman ]; # Oracle ARM
|
bomberman = mkNix [ ./hosts/bomberman ]; # Oracle ARM
|
||||||
|
|
|
@ -57,7 +57,7 @@ in {
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
# Additional entry to boot from the second GPU
|
# Use second GPU on boot
|
||||||
specialisation.gputwo.configuration = {
|
specialisation.gputwo.configuration = {
|
||||||
boot.kernelParams = commonKernelParams ++ [ "vfio-pci.ids=10de:2504,10de:228e" ];
|
boot.kernelParams = commonKernelParams ++ [ "vfio-pci.ids=10de:2504,10de:228e" ];
|
||||||
};
|
};
|
||||||
|
|
42
hosts/leash/boot/default.nix
Normal file
42
hosts/leash/boot/default.nix
Normal file
|
@ -0,0 +1,42 @@
|
||||||
|
{ config, pkgs, ... }:
|
||||||
|
{
|
||||||
|
boot = {
|
||||||
|
kernelPackages = pkgs.unstable.linuxPackages_latest;
|
||||||
|
kernel.sysctl."vm.max_map_count" = 2147483642;
|
||||||
|
kernelParams = [
|
||||||
|
"nvidia_drm.fbdev=1"
|
||||||
|
"nouveau.config=NvGspRm=1"
|
||||||
|
];
|
||||||
|
|
||||||
|
initrd.systemd = {
|
||||||
|
enable = true;
|
||||||
|
services.root-reset = {
|
||||||
|
description = "Reset root and snapshot last boot";
|
||||||
|
wantedBy = [ "initrd.target" ];
|
||||||
|
after = [ "dev-${config.networking.hostName}-root.device" ];
|
||||||
|
before = [ "sysroot.mount" ];
|
||||||
|
unitConfig.DefaultDependencies = "no";
|
||||||
|
serviceConfig.Type = "oneshot";
|
||||||
|
script = ''
|
||||||
|
mkdir -p /mnt
|
||||||
|
mount /dev/${config.networking.hostName}/root /mnt
|
||||||
|
|
||||||
|
if [[ -e /mnt/prev ]]; then
|
||||||
|
btrfs subvolume delete /mnt/prev
|
||||||
|
fi
|
||||||
|
|
||||||
|
btrfs subvolume snapshot /mnt/root /mnt/prev
|
||||||
|
|
||||||
|
btrfs subvolume list -o /mnt/root | cut -f9 -d' ' | while read subvolume; do
|
||||||
|
btrfs subvolume delete "/mnt/$subvolume"
|
||||||
|
done
|
||||||
|
|
||||||
|
btrfs subvolume delete /mnt/root
|
||||||
|
btrfs subvolume create /mnt/root
|
||||||
|
|
||||||
|
umount /mnt
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
}
|
15
hosts/leash/default.nix
Normal file
15
hosts/leash/default.nix
Normal file
|
@ -0,0 +1,15 @@
|
||||||
|
{ ... }:
|
||||||
|
{
|
||||||
|
imports = [
|
||||||
|
./boot
|
||||||
|
./disko
|
||||||
|
./hardware
|
||||||
|
../../modules/system
|
||||||
|
];
|
||||||
|
|
||||||
|
system.lanzaboote.enable = true;
|
||||||
|
system.wireguard.client.enable = false;
|
||||||
|
system.video.nvidia.enable = true;
|
||||||
|
|
||||||
|
networking.hostName = "leash";
|
||||||
|
}
|
96
hosts/leash/disko/default.nix
Normal file
96
hosts/leash/disko/default.nix
Normal file
|
@ -0,0 +1,96 @@
|
||||||
|
{ disko, config, ... }:
|
||||||
|
{
|
||||||
|
imports = [ disko.nixosModules.disko ];
|
||||||
|
|
||||||
|
disko.devices = {
|
||||||
|
disk = {
|
||||||
|
"${config.networking.hostName}" = {
|
||||||
|
type = "disk";
|
||||||
|
device = "/dev/sdi";
|
||||||
|
content = {
|
||||||
|
type = "gpt";
|
||||||
|
partitions = {
|
||||||
|
ESP = {
|
||||||
|
size = "2G";
|
||||||
|
type = "EF00";
|
||||||
|
content = {
|
||||||
|
type = "filesystem";
|
||||||
|
format = "vfat";
|
||||||
|
mountpoint = "/boot";
|
||||||
|
mountOptions = [ "umask=0077" ];
|
||||||
|
};
|
||||||
|
};
|
||||||
|
luks = {
|
||||||
|
size = "100%";
|
||||||
|
content = {
|
||||||
|
type = "luks";
|
||||||
|
name = "${config.networking.hostName}-disk";
|
||||||
|
settings.allowDiscards = true;
|
||||||
|
passwordFile = "/tmp/secret.key";
|
||||||
|
content = {
|
||||||
|
type = "lvm_pv";
|
||||||
|
vg = "${config.networking.hostName}";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
lvm_vg = {
|
||||||
|
"${config.networking.hostName}" = {
|
||||||
|
type = "lvm_vg";
|
||||||
|
lvs = {
|
||||||
|
root = {
|
||||||
|
size = "100%";
|
||||||
|
content = {
|
||||||
|
type = "btrfs";
|
||||||
|
extraArgs = [ "-f" ];
|
||||||
|
subvolumes = {
|
||||||
|
"/root" = {
|
||||||
|
mountpoint = "/";
|
||||||
|
mountOptions = [ "compress=zstd" "noatime" ];
|
||||||
|
};
|
||||||
|
"/prev" = {
|
||||||
|
mountpoint = "/prev";
|
||||||
|
mountOptions = [ "compress=zstd" "noatime" ];
|
||||||
|
};
|
||||||
|
"/nix" = {
|
||||||
|
mountpoint = "/nix";
|
||||||
|
mountOptions = [ "compress=zstd" "noatime" ];
|
||||||
|
};
|
||||||
|
|
||||||
|
# Impermanence
|
||||||
|
"/persist" = {
|
||||||
|
mountpoint = "/persist";
|
||||||
|
mountOptions = [ "compress=zstd" "noatime" ];
|
||||||
|
};
|
||||||
|
"/persist/.snapshots" = { };
|
||||||
|
|
||||||
|
"/jimbo" = {
|
||||||
|
mountpoint = "/persist/home/jimbo";
|
||||||
|
mountOptions = [ "compress=zstd" "noatime" ];
|
||||||
|
};
|
||||||
|
"/jimbo/.snapshots" = { };
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
swap = {
|
||||||
|
size = "2G";
|
||||||
|
content = {
|
||||||
|
type = "swap";
|
||||||
|
discardPolicy = "both";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
# Needed for impermanence
|
||||||
|
fileSystems = {
|
||||||
|
"/persist".neededForBoot = true;
|
||||||
|
"/persist/home/jimbo".neededForBoot = true;
|
||||||
|
};
|
||||||
|
}
|
35
hosts/leash/hardware/default.nix
Normal file
35
hosts/leash/hardware/default.nix
Normal file
|
@ -0,0 +1,35 @@
|
||||||
|
{ config, lib, modulesPath, ... }:
|
||||||
|
{
|
||||||
|
boot = {
|
||||||
|
initrd = {
|
||||||
|
availableKernelModules = [
|
||||||
|
"nvme"
|
||||||
|
"xhci_pci"
|
||||||
|
"ahci"
|
||||||
|
"usbhid"
|
||||||
|
"usb_storage"
|
||||||
|
"sd_mod"
|
||||||
|
];
|
||||||
|
kernelModules = [
|
||||||
|
"dm-snapshot"
|
||||||
|
"vfio"
|
||||||
|
"vfio_pci"
|
||||||
|
"vfio_iommu_type1"
|
||||||
|
"kvm-amd"
|
||||||
|
];
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
fileSystems = {
|
||||||
|
# Remote
|
||||||
|
"/home/jimbo/JimboNFS" = {
|
||||||
|
device = "${config.ips.wgSpan}.1:/export/JimboNFS";
|
||||||
|
fsType = "nfs4";
|
||||||
|
options = [ "x-systemd.automount" "_netdev" "nofail" "noauto" ];
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
networking.useDHCP = lib.mkDefault true;
|
||||||
|
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
|
||||||
|
hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
|
||||||
|
}
|
1
hosts/leash/id_ed25519.pub
Normal file
1
hosts/leash/id_ed25519.pub
Normal file
|
@ -0,0 +1 @@
|
||||||
|
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIC2lMkUd+BbXITE5LTg94hEzmA6UKsIIbaf5YOjGoLzl
|
|
@ -105,7 +105,8 @@
|
||||||
".local/share/ranger/bookmarks".text = ''
|
".local/share/ranger/bookmarks".text = ''
|
||||||
# Local files
|
# Local files
|
||||||
h:/home/jimbo/
|
h:/home/jimbo/
|
||||||
k:/home/jimbo/Downloads
|
k:/home/jimbo/Keepers
|
||||||
|
j:/home/jimbo/Downloads
|
||||||
v:/home/jimbo/Videos
|
v:/home/jimbo/Videos
|
||||||
c:/home/jimbo/.config
|
c:/home/jimbo/.config
|
||||||
l:/home/jimbo/.local
|
l:/home/jimbo/.local
|
||||||
|
|
|
@ -32,6 +32,7 @@
|
||||||
|
|
||||||
gtk3 = {
|
gtk3 = {
|
||||||
bookmarks = [
|
bookmarks = [
|
||||||
|
"file:///home/jimbo/Keepers"
|
||||||
"file:///home/jimbo/Downloads"
|
"file:///home/jimbo/Downloads"
|
||||||
"file:///home/jimbo/Documents"
|
"file:///home/jimbo/Documents"
|
||||||
"file:///home/jimbo/Videos"
|
"file:///home/jimbo/Videos"
|
||||||
|
|
|
@ -4,7 +4,7 @@
|
||||||
hideMounts = true;
|
hideMounts = true;
|
||||||
users.jimbo = {
|
users.jimbo = {
|
||||||
directories = [
|
directories = [
|
||||||
"Downloads"
|
"Keepers"
|
||||||
"Documents"
|
"Documents"
|
||||||
"Pictures"
|
"Pictures"
|
||||||
"Videos"
|
"Videos"
|
||||||
|
|
|
@ -14,11 +14,14 @@
|
||||||
networking = {
|
networking = {
|
||||||
firewall = {
|
firewall = {
|
||||||
allowPing = false;
|
allowPing = false;
|
||||||
extraInputRules = lib.mkIf (!config.system.firewall.server.enable) ''
|
extraInputRules = ''
|
||||||
ip saddr { ${config.ips.server}, ${config.ips.wgSpan}.1 } accept comment "Accept Server"
|
${lib.optionalString (!config.system.firewall.server.enable) ''
|
||||||
'' // lib.mkIf config.system.firewall.server.enable ''
|
ip saddr { ${config.ips.server}, ${config.ips.wgSpan}.1 } accept comment "Accept Server"
|
||||||
ip saddr { ${config.ips.localSpan}.0/24, ${config.ips.wgSpan}.0/24 } tcp dport 2049 accept comment "Accept NFS"
|
''}
|
||||||
ip saddr { ${config.ips.pc}, ${config.secrets.lunaIP}, ${config.secrets.cornIP} } tcp dport { 1935, 1945 } accept comment "Accept RTMP"
|
${lib.optionalString config.system.firewall.server.enable ''
|
||||||
|
ip saddr { ${config.ips.localSpan}.0/24, ${config.ips.wgSpan}.0/24 } tcp dport 2049 accept comment "Accept NFS"
|
||||||
|
ip saddr { ${config.ips.pc}, ${config.secrets.lunaIP}, ${config.secrets.cornIP} } tcp dport { 1935, 1945 } accept comment "Accept RTMP"
|
||||||
|
''}
|
||||||
'';
|
'';
|
||||||
};
|
};
|
||||||
|
|
||||||
|
|
Loading…
Reference in a new issue