diff options
| author | Dylan <boss@tehbox.org> | 2026-10-17 22:02:09 +1300 |
|---|---|---|
| committer | Dylan <boss@tehbox.org> | 2026-10-17 22:04:40 +1300 |
| commit | 008b591a0a5942ae42f4c07a5abbee4dbd2d0743 (patch) | |
| tree | 0ae88a36bc00ede3b43b31489adae633dc54e8cd /modules/computers/nixnode.nix | |
| parent | 280e1bbe5e733128a451260685cc8ecd10a042a3 (diff) | |
| download | nixos-configuration-008b591a0a5942ae42f4c07a5abbee4dbd2d0743.tar.gz nixos-configuration-008b591a0a5942ae42f4c07a5abbee4dbd2d0743.zip | |
feat: Formatting changes
Diffstat (limited to 'modules/computers/nixnode.nix')
| -rw-r--r-- | modules/computers/nixnode.nix | 627 |
1 files changed, 324 insertions, 303 deletions
diff --git a/modules/computers/nixnode.nix b/modules/computers/nixnode.nix index 3cf6999..65400c2 100644 --- a/modules/computers/nixnode.nix +++ b/modules/computers/nixnode.nix @@ -1,347 +1,368 @@ { inputs, config, ... }: let - nixos = config.flake.modules.nixos; + nixos = config.flake.modules.nixos; in { - flake.nixosConfigurations.nixnode = inputs.nixpkgs.lib.nixosSystem { - modules = [ nixos.nixnode ]; - }; + flake.nixosConfigurations.nixnode = inputs.nixpkgs.lib.nixosSystem { + modules = [ nixos.nixnode ]; + }; - flake.modules.nixos.nixnode = - # Edit this configuration file to define what should be installed on - # your system. Help is available in the configuration.nix(5) man page, on - # https://search.nixos.org/options and in the NixOS manual (`nixos-help`). + flake.modules.nixos.nixnode = + # Edit this configuration file to define what should be installed on + # your system. Help is available in the configuration.nix(5) man page, on + # https://search.nixos.org/options and in the NixOS manual (`nixos-help`). - { config, lib, pkgs, ... }: + { + config, + lib, + pkgs, + ... + }: - { - imports = - [ - nixos.teh-nix - nixos.linode - inputs.STK.nixosModules.default - inputs.sops.nixosModules.sops - inputs.nixos-mailserver.nixosModules.default - inputs.neodrive-website.nixosModules.default - ]; + { + imports = [ + nixos.teh-nix + nixos.linode + inputs.STK.nixosModules.default + inputs.sops.nixosModules.sops + inputs.nixos-mailserver.nixosModules.default + inputs.neodrive-website.nixosModules.default + ]; - teh-nix.nix.enable = true; + teh-nix.nix.enable = true; - # Use the GRUB 2 boot loader. - boot.loader.grub.enable = true; - # boot.loader.grub.efiSupport = true; - # boot.loader.grub.efiInstallAsRemovable = true; - # boot.loader.efi.efiSysMountPoint = "/boot/efi"; - # Define on which hard drive you want to install Grub. - # boot.loader.grub.device = "/dev/sda"; # or "nodev" for efi only + # Use the GRUB 2 boot loader. + boot.loader.grub.enable = true; + # boot.loader.grub.efiSupport = true; + # boot.loader.grub.efiInstallAsRemovable = true; + # boot.loader.efi.efiSysMountPoint = "/boot/efi"; + # Define on which hard drive you want to install Grub. + # boot.loader.grub.device = "/dev/sda"; # or "nodev" for efi only - networking.hostName = "nixnode"; # Define your hostname. - # Pick only one of the below networking options. - # networking.wireless.enable = true; # Enables wireless support via wpa_supplicant. - networking.networkmanager.enable = true; # Easiest to use and most distros use this by default. + networking.hostName = "nixnode"; # Define your hostname. + # Pick only one of the below networking options. + # networking.wireless.enable = true; # Enables wireless support via wpa_supplicant. + networking.networkmanager.enable = true; # Easiest to use and most distros use this by default. - # Set your time zone. - time.timeZone = "NZ"; + # Set your time zone. + time.timeZone = "NZ"; - # Configure network proxy if necessary - # networking.proxy.default = "http://user:password@proxy:port/"; - # networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain"; + # Configure network proxy if necessary + # networking.proxy.default = "http://user:password@proxy:port/"; + # networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain"; - # Select internationalisation properties. - # i18n.defaultLocale = "en_US.UTF-8"; - # console = { - # font = "Lat2-Terminus16"; - # keyMap = "us"; - # useXkbConfcpfig = true; # use xkb.options in tty. - # }; + # Select internationalisation properties. + # i18n.defaultLocale = "en_US.UTF-8"; + # console = { + # font = "Lat2-Terminus16"; + # keyMap = "us"; + # useXkbConfcpfig = true; # use xkb.options in tty. + # }; - # Enable the X11 windowing system. - # services.xserver.enable = true; + # Enable the X11 windowing system. + # services.xserver.enable = true; - security.sudo.wheelNeedsPassword = false; + security.sudo.wheelNeedsPassword = false; - sops.defaultSopsFile = ../../secrets/general.yaml; - sops.defaultSopsFormat = "yaml"; + sops.defaultSopsFile = ../../secrets/general.yaml; + sops.defaultSopsFormat = "yaml"; - sops.age.keyFile = "/home/boss/.config/sops/age/keys.txt"; + sops.age.keyFile = "/home/boss/.config/sops/age/keys.txt"; - sops.secrets = { - #"wg/nixy/pub" = { }; - "wg/nixnode/priv" = { }; - "acme/linode" = { - owner = "acme"; - mode = "440"; - }; - "mail/boss" = { }; - "nginx/dashboard-htpasswd" = { - owner = "nginx"; - mode = "400"; - }; - }; + sops.secrets = { + #"wg/nixy/pub" = { }; + "wg/nixnode/priv" = { }; + "acme/linode" = { + owner = "acme"; + mode = "440"; + }; + "mail/boss" = { }; + "nginx/dashboard-htpasswd" = { + owner = "nginx"; + mode = "400"; + }; + }; - networking.firewall = { - enable = true; - allowedTCPPorts = [ 80 443 ]; - allowedUDPPorts = [ 51820 ]; - }; + networking.firewall = { + enable = true; + allowedTCPPorts = [ + 80 + 443 + ]; + allowedUDPPorts = [ 51820 ]; + }; - security.acme.acceptTerms = true; - # security.acme.useRoot = true; - security.acme.defaults.email = "boss@tehbox.org"; - # security.acme.certs = { - # "tehbox.org" = - # { - # webroot = "/var/lib/acme/acme-challenge/"; - # email = "boss@tehbox.org"; - # extraDomainNames = (map (sub: sub + ".tehbox.org" ) [ "www" "git" ]); - # #dnsProvider = "linode"; - # # dnsResolver = "92.123.94.2"; - # # dnsPropagationCheck = false; - # #environmentFile = environmentFile; - # }; - # }; - users.groups.acme.members = [ "nginx" ]; + security.acme.acceptTerms = true; + # security.acme.useRoot = true; + security.acme.defaults.email = "boss@tehbox.org"; + # security.acme.certs = { + # "tehbox.org" = + # { + # webroot = "/var/lib/acme/acme-challenge/"; + # email = "boss@tehbox.org"; + # extraDomainNames = (map (sub: sub + ".tehbox.org" ) [ "www" "git" ]); + # #dnsProvider = "linode"; + # # dnsResolver = "92.123.94.2"; + # # dnsPropagationCheck = false; + # #environmentFile = environmentFile; + # }; + # }; + users.groups.acme.members = [ "nginx" ]; - # Wireguard - networking = { - nat = { - enable = true; - externalInterface = "eth0"; - internalInterfaces = [ "wg0" ]; - }; + # Wireguard + networking = { + nat = { + enable = true; + externalInterface = "eth0"; + internalInterfaces = [ "wg0" ]; + }; - wireguard.interfaces.wg0 = { - ips = [ "10.100.0.1/24" ]; - listenPort = 51820; + wireguard.interfaces.wg0 = { + ips = [ "10.100.0.1/24" ]; + listenPort = 51820; - postSetup = '' -${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -s 10.100.0.0/24 -o eth0 -j MASQUERADE -''; - postShutdown = '' -${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -s 10.100.0.0/24 -o eth0 -j MASQUERADE -''; + postSetup = '' + ${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -s 10.100.0.0/24 -o eth0 -j MASQUERADE + ''; + postShutdown = '' + ${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -s 10.100.0.0/24 -o eth0 -j MASQUERADE + ''; - privateKeyFile = config.sops.secrets."wg/nixnode/priv".path; + privateKeyFile = config.sops.secrets."wg/nixnode/priv".path; - peers = [ - { - name = "nixy"; - publicKey = "FMkFU9k+YeCvj48+WDVglySgoncbITqkS//o2e+TClY="; - allowedIPs = [ "10.100.0.2/32" ]; - } - ]; - }; - }; + peers = [ + { + name = "nixy"; + publicKey = "FMkFU9k+YeCvj48+WDVglySgoncbITqkS//o2e+TClY="; + allowedIPs = [ "10.100.0.2/32" ]; + } + ]; + }; + }; - services.nginx = { - enable = true; - # Log the vhost at the start of each line ("vcombined") so goaccess - # can split traffic by subdomain - commonHttpConfig = '' -log_format vcombined '$host:$server_port $remote_addr - $remote_user [$time_local] ' - '"$request" $status $body_bytes_sent ' - '"$http_referer" "$http_user_agent"'; -access_log /var/log/nginx/access.log vcombined; -''; - # virtualHosts.${config.mailserver.fqdn}.enableACME = true; - virtualHosts = { - "tehbox.org" = { - root = "${inputs.self.packages.x86_64-linux.teh-website}/srv/www"; - serverAliases = [ "www.tehbox.org" ]; - enableACME = true; - forceSSL = true; - }; - "files.tehbox.org" = { - root = "/srv/files"; - enableACME = true; - forceSSL = true; - }; - # "stk.lug.ac" = { - # root = "${inputs.self.packages.x86_64-linux.stk-installers}/srv/www"; - # enableACME = true; - # forceSSL = true; - # locations."/".extraConfig = "autoindex on;\n"; - # }; - "dashboard.tehbox.org" = { - root = "/var/lib/goaccess/html"; - basicAuthFile = config.sops.secrets."nginx/dashboard-htpasswd".path; - enableACME = true; - forceSSL = true; - }; - "_" = { - globalRedirect = "tehbox.org"; - }; - }; - }; + services.nginx = { + enable = true; + # Log the vhost at the start of each line ("vcombined") so goaccess + # can split traffic by subdomain + commonHttpConfig = '' + log_format vcombined '$host:$server_port $remote_addr - $remote_user [$time_local] ' + '"$request" $status $body_bytes_sent ' + '"$http_referer" "$http_user_agent"'; + access_log /var/log/nginx/access.log vcombined; + ''; + # virtualHosts.${config.mailserver.fqdn}.enableACME = true; + virtualHosts = { + "tehbox.org" = { + root = "${inputs.self.packages.x86_64-linux.teh-website}/srv/www"; + serverAliases = [ "www.tehbox.org" ]; + enableACME = true; + forceSSL = true; + }; + "files.tehbox.org" = { + root = "/srv/files"; + enableACME = true; + forceSSL = true; + }; + # "stk.lug.ac" = { + # root = "${inputs.self.packages.x86_64-linux.stk-installers}/srv/www"; + # enableACME = true; + # forceSSL = true; + # locations."/".extraConfig = "autoindex on;\n"; + # }; + "dashboard.tehbox.org" = { + root = "/var/lib/goaccess/html"; + basicAuthFile = config.sops.secrets."nginx/dashboard-htpasswd".path; + enableACME = true; + forceSSL = true; + }; + "_" = { + globalRedirect = "tehbox.org"; + }; + }; + }; - # Web traffic dashboard, rebuilt from the nginx access log every 10 minutes. - # --persist/--restore keep the totals in /var/lib/goaccess/db across log rotations. - systemd.services.goaccess-report = { - description = "Build goaccess report for dashboard.tehbox.org"; - serviceConfig = { - Type = "oneshot"; - User = "nginx"; - Group = "nginx"; - StateDirectory = [ "goaccess" "goaccess/db" "goaccess/html" ]; - }; - script = '' -${pkgs.goaccess}/bin/goaccess /var/log/nginx/access.log \ - --log-format=VCOMBINED \ - --num-tests=0 \ - --no-query-string \ - --persist --restore --db-path=/var/lib/goaccess/db \ - --html-report-title="tehbox.org traffic" \ - -o /var/lib/goaccess/html/index.html -''; - }; - systemd.timers.goaccess-report = { - wantedBy = [ "timers.target" ]; - timerConfig = { - OnCalendar = "*:0/10"; - Persistent = true; - }; - }; + # Web traffic dashboard, rebuilt from the nginx access log every 10 minutes. + # --persist/--restore keep the totals in /var/lib/goaccess/db across log rotations. + systemd.services.goaccess-report = { + description = "Build goaccess report for dashboard.tehbox.org"; + serviceConfig = { + Type = "oneshot"; + User = "nginx"; + Group = "nginx"; + StateDirectory = [ + "goaccess" + "goaccess/db" + "goaccess/html" + ]; + }; + script = '' + ${pkgs.goaccess}/bin/goaccess /var/log/nginx/access.log \ + --log-format=VCOMBINED \ + --num-tests=0 \ + --no-query-string \ + --persist --restore --db-path=/var/lib/goaccess/db \ + --html-report-title="tehbox.org traffic" \ + -o /var/lib/goaccess/html/index.html + ''; + }; + systemd.timers.goaccess-report = { + wantedBy = [ "timers.target" ]; + timerConfig = { + OnCalendar = "*:0/10"; + Persistent = true; + }; + }; - teh-nix.services.cgit = { - enable = true; - authorizedKeys = config.users.users.boss.openssh.authorizedKeys.keys; - authorizedUsers = [ "boss" ]; - domain = "git.tehbox.org"; - enableACME = true; - # useACMEHost = "tehbox.org"; - forceSSL = true; - # onlySSL = true; - }; + teh-nix.services.cgit = { + enable = true; + authorizedKeys = config.users.users.boss.openssh.authorizedKeys.keys; + authorizedUsers = [ "boss" ]; + domain = "git.tehbox.org"; + enableACME = true; + # useACMEHost = "tehbox.org"; + forceSSL = true; + # onlySSL = true; + }; - services.neodrive-website = { - enable = true; - domain = "neodrive.tehbox.org"; - }; + services.neodrive-website = { + enable = true; + domain = "neodrive.tehbox.org"; + }; - services.znc = { - enable = true; - mutable = true; - useLegacyConfig = false; - openFirewall = true; - config = { - SSLCertFile = "/var/lib/acme/tehbox.org/key.pem"; - LoadModule = [ "webadmin" ]; - User.boss = { - Admin = true; - Pass.password = { - Method = "sha256"; - Hash = "401e8fed9a3ab1f93047b7465fd7cc6b0ca5aaed6b1c0482f0f4331ebdca8647"; - Salt = "*F_-,pqOdiJi;p)JoMnm"; - }; - }; - User.komodo = { - Admin = false; - Pass.password = { - Method = "sha256"; - Hash = "2c624debe3e2672383346230b6acad82192e40df05666481f792a9dd97d935cc"; - Salt = "q9At0+KZvmofZil(3us1"; - }; - }; - }; - }; + services.znc = { + enable = true; + mutable = true; + useLegacyConfig = false; + openFirewall = true; + config = { + SSLCertFile = "/var/lib/acme/tehbox.org/key.pem"; + LoadModule = [ "webadmin" ]; + User.boss = { + Admin = true; + Pass.password = { + Method = "sha256"; + Hash = "401e8fed9a3ab1f93047b7465fd7cc6b0ca5aaed6b1c0482f0f4331ebdca8647"; + Salt = "*F_-,pqOdiJi;p)JoMnm"; + }; + }; + User.komodo = { + Admin = false; + Pass.password = { + Method = "sha256"; + Hash = "2c624debe3e2672383346230b6acad82192e40df05666481f792a9dd97d935cc"; + Salt = "q9At0+KZvmofZil(3us1"; + }; + }; + }; + }; - services.openssh = { - enable = true; - settings.PermitRootLogin = "no"; - settings.PasswordAuthentication = false; - }; + services.openssh = { + enable = true; + settings.PermitRootLogin = "no"; + settings.PasswordAuthentication = false; + }; - services.superTuxKarts = { - enable = true; - port = 2759; - package = pkgs.superTuxKart; - serverOptions = { - server-name = "LUG STK server"; - server-mode = 3; - server-difficulty = 3; - server-max-players = 16; - track-voting = false; - voting-timeout = 15; - private-server-password = "lug@uoa"; - motd = "Server for LUG@UoA\nChampionship coming soon!"; - live-spectate = true; - server-configurable = true; - }; - }; + services.superTuxKarts = { + enable = true; + port = 2759; + package = pkgs.superTuxKart; + serverOptions = { + server-name = "LUG STK server"; + server-mode = 3; + server-difficulty = 3; + server-max-players = 16; + track-voting = false; + voting-timeout = 15; + private-server-password = "lug@uoa"; + motd = "Server for LUG@UoA\nChampionship coming soon!"; + live-spectate = true; + server-configurable = true; + }; + }; - mailserver = { - enable = true; - stateVersion = 3; - fqdn = "tehbox.org"; - domains = [ "tehbox.org" ]; + mailserver = { + enable = true; + stateVersion = 3; + fqdn = "tehbox.org"; + domains = [ "tehbox.org" ]; - x509.useACMEHost = config.mailserver.fqdn; + x509.useACMEHost = config.mailserver.fqdn; - loginAccounts = { - "boss@tehbox.org" = { - hashedPasswordFile = config.sops.secrets."mail/boss".path; - aliases = ["postmaster@tehbox.org"]; - }; - }; + loginAccounts = { + "boss@tehbox.org" = { + hashedPasswordFile = config.sops.secrets."mail/boss".path; + aliases = [ "postmaster@tehbox.org" ]; + }; + }; - # certificateScheme = "acme"; - }; + # certificateScheme = "acme"; + }; - users.users.boss = { - isNormalUser = true; - extraGroups = [ "wheel" "networkmanager"]; # Enable ‘sudo’ for the user. - home = "/home/boss"; - openssh.authorizedKeys.keys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJOukEKExoF6vr3vciQN8pBdd4FtZtRzqIGFJrUvllOY boss@nixy" ]; - }; - users.groups.files.members = [ "boss" "nginx" ]; - users.groups.nginx.members = [ "nginx" "znc" ]; + users.users.boss = { + isNormalUser = true; + extraGroups = [ + "wheel" + "networkmanager" + ]; # Enable ‘sudo’ for the user. + home = "/home/boss"; + openssh.authorizedKeys.keys = [ + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJOukEKExoF6vr3vciQN8pBdd4FtZtRzqIGFJrUvllOY boss@nixy" + ]; + }; + users.groups.files.members = [ + "boss" + "nginx" + ]; + users.groups.nginx.members = [ + "nginx" + "znc" + ]; - environment.systemPackages = with pkgs; [ - vim - emacs - inetutils - mtr - sysstat - git - goaccess - inputs.self.packages.x86_64-linux.teh-website - # inputs.self.packages.x86_64-linux.stk-installers - ]; + environment.systemPackages = with pkgs; [ + vim + emacs + inetutils + mtr + sysstat + git + goaccess + inputs.self.packages.x86_64-linux.teh-website + # inputs.self.packages.x86_64-linux.stk-installers + ]; + # Open ports in the firewall. + # networking.firewall.allowedTCPPorts = [ ... ]; + # networking.firewall.allowedUDPPorts = [ ... ]; + # Or disable the firewall altogether. + # networking.firewall.enable = false; - # Open ports in the firewall. - # networking.firewall.allowedTCPPorts = [ ... ]; - # networking.firewall.allowedUDPPorts = [ ... ]; - # Or disable the firewall altogether. - # networking.firewall.enable = false; + networking.usePredictableInterfaceNames = false; + networking.useDHCP = false; + networking.interfaces.eth0.useDHCP = true; - networking.usePredictableInterfaceNames = false; - networking.useDHCP = false; - networking.interfaces.eth0.useDHCP = true; + # Copy the NixOS configuration file and link it from the resulting system + # (/run/current-system/configuration.nix). This is useful in case you + # accidentally delete configuration.nix. + # system.copySystemConfiguration = true; - # Copy the NixOS configuration file and link it from the resulting system - # (/run/current-system/configuration.nix). This is useful in case you - # accidentally delete configuration.nix. - # system.copySystemConfiguration = true; + # This option defines the first version of NixOS you have installed on this particular machine, + # and is used to maintain compatibility with application data (e.g. databases) created on older NixOS versions. + # + # Most users should NEVER change this value after the initial install, for any reason, + # even if you've upgraded your system to a new NixOS release. + # + # This value does NOT affect the Nixpkgs version your packages and OS are pulled from, + # so changing it will NOT upgrade your system - see https://nixos.org/manual/nixos/stable/#sec-upgrading for how + # to actually do that. + # + # This value being lower than the current NixOS release does NOT mean your system is + # out of date, out of support, or vulnerable. + # + # Do NOT change this value unless you have manually inspected all the changes it would make to your configuration, + # and migrated your data accordingly. + # + # For more information, see `man configuration.nix` or https://nixos.org/manual/nixos/stable/options#opt-system.stateVersion . + system.stateVersion = "25.05"; # Did you read the comment? - # This option defines the first version of NixOS you have installed on this particular machine, - # and is used to maintain compatibility with application data (e.g. databases) created on older NixOS versions. - # - # Most users should NEVER change this value after the initial install, for any reason, - # even if you've upgraded your system to a new NixOS release. - # - # This value does NOT affect the Nixpkgs version your packages and OS are pulled from, - # so changing it will NOT upgrade your system - see https://nixos.org/manual/nixos/stable/#sec-upgrading for how - # to actually do that. - # - # This value being lower than the current NixOS release does NOT mean your system is - # out of date, out of support, or vulnerable. - # - # Do NOT change this value unless you have manually inspected all the changes it would make to your configuration, - # and migrated your data accordingly. - # - # For more information, see `man configuration.nix` or https://nixos.org/manual/nixos/stable/options#opt-system.stateVersion . - system.stateVersion = "25.05"; # Did you read the comment? - - }; + }; } |
