From 280e1bbe5e733128a451260685cc8ecd10a042a3 Mon Sep 17 00:00:00 2001 From: Dylan Date: Sat, 17 Oct 2026 21:53:43 +1300 Subject: feat: Dendritic pattern This re-write was done with the help of claude, and still needs a decent amount of changes before it properly follows the dendritic pattern --- modules/computers/nixnode.nix | 347 ++++++++++++++++++++++++++++++++++++++++++ modules/computers/nixy.nix | 343 +++++++++++++++++++++++++++++++++++++++++ 2 files changed, 690 insertions(+) create mode 100644 modules/computers/nixnode.nix create mode 100644 modules/computers/nixy.nix (limited to 'modules/computers') diff --git a/modules/computers/nixnode.nix b/modules/computers/nixnode.nix new file mode 100644 index 0000000..3cf6999 --- /dev/null +++ b/modules/computers/nixnode.nix @@ -0,0 +1,347 @@ +{ inputs, config, ... }: +let + nixos = config.flake.modules.nixos; +in +{ + flake.nixosConfigurations.nixnode = inputs.nixpkgs.lib.nixosSystem { + modules = [ nixos.nixnode ]; + }; + + flake.modules.nixos.nixnode = + # Edit this configuration file to define what should be installed on + # your system. Help is available in the configuration.nix(5) man page, on + # https://search.nixos.org/options and in the NixOS manual (`nixos-help`). + + { config, lib, pkgs, ... }: + + { + imports = + [ + nixos.teh-nix + nixos.linode + inputs.STK.nixosModules.default + inputs.sops.nixosModules.sops + inputs.nixos-mailserver.nixosModules.default + inputs.neodrive-website.nixosModules.default + ]; + + teh-nix.nix.enable = true; + + # Use the GRUB 2 boot loader. + boot.loader.grub.enable = true; + # boot.loader.grub.efiSupport = true; + # boot.loader.grub.efiInstallAsRemovable = true; + # boot.loader.efi.efiSysMountPoint = "/boot/efi"; + # Define on which hard drive you want to install Grub. + # boot.loader.grub.device = "/dev/sda"; # or "nodev" for efi only + + networking.hostName = "nixnode"; # Define your hostname. + # Pick only one of the below networking options. + # networking.wireless.enable = true; # Enables wireless support via wpa_supplicant. + networking.networkmanager.enable = true; # Easiest to use and most distros use this by default. + + # Set your time zone. + time.timeZone = "NZ"; + + # Configure network proxy if necessary + # networking.proxy.default = "http://user:password@proxy:port/"; + # networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain"; + + # Select internationalisation properties. + # i18n.defaultLocale = "en_US.UTF-8"; + # console = { + # font = "Lat2-Terminus16"; + # keyMap = "us"; + # useXkbConfcpfig = true; # use xkb.options in tty. + # }; + + # Enable the X11 windowing system. + # services.xserver.enable = true; + + security.sudo.wheelNeedsPassword = false; + + sops.defaultSopsFile = ../../secrets/general.yaml; + sops.defaultSopsFormat = "yaml"; + + sops.age.keyFile = "/home/boss/.config/sops/age/keys.txt"; + + sops.secrets = { + #"wg/nixy/pub" = { }; + "wg/nixnode/priv" = { }; + "acme/linode" = { + owner = "acme"; + mode = "440"; + }; + "mail/boss" = { }; + "nginx/dashboard-htpasswd" = { + owner = "nginx"; + mode = "400"; + }; + }; + + networking.firewall = { + enable = true; + allowedTCPPorts = [ 80 443 ]; + allowedUDPPorts = [ 51820 ]; + }; + + security.acme.acceptTerms = true; + # security.acme.useRoot = true; + security.acme.defaults.email = "boss@tehbox.org"; + # security.acme.certs = { + # "tehbox.org" = + # { + # webroot = "/var/lib/acme/acme-challenge/"; + # email = "boss@tehbox.org"; + # extraDomainNames = (map (sub: sub + ".tehbox.org" ) [ "www" "git" ]); + # #dnsProvider = "linode"; + # # dnsResolver = "92.123.94.2"; + # # dnsPropagationCheck = false; + # #environmentFile = environmentFile; + # }; + # }; + users.groups.acme.members = [ "nginx" ]; + + # Wireguard + networking = { + nat = { + enable = true; + externalInterface = "eth0"; + internalInterfaces = [ "wg0" ]; + }; + + wireguard.interfaces.wg0 = { + ips = [ "10.100.0.1/24" ]; + listenPort = 51820; + + postSetup = '' +${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -s 10.100.0.0/24 -o eth0 -j MASQUERADE +''; + postShutdown = '' +${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -s 10.100.0.0/24 -o eth0 -j MASQUERADE +''; + + privateKeyFile = config.sops.secrets."wg/nixnode/priv".path; + + peers = [ + { + name = "nixy"; + publicKey = "FMkFU9k+YeCvj48+WDVglySgoncbITqkS//o2e+TClY="; + allowedIPs = [ "10.100.0.2/32" ]; + } + ]; + }; + }; + + services.nginx = { + enable = true; + # Log the vhost at the start of each line ("vcombined") so goaccess + # can split traffic by subdomain + commonHttpConfig = '' +log_format vcombined '$host:$server_port $remote_addr - $remote_user [$time_local] ' + '"$request" $status $body_bytes_sent ' + '"$http_referer" "$http_user_agent"'; +access_log /var/log/nginx/access.log vcombined; +''; + # virtualHosts.${config.mailserver.fqdn}.enableACME = true; + virtualHosts = { + "tehbox.org" = { + root = "${inputs.self.packages.x86_64-linux.teh-website}/srv/www"; + serverAliases = [ "www.tehbox.org" ]; + enableACME = true; + forceSSL = true; + }; + "files.tehbox.org" = { + root = "/srv/files"; + enableACME = true; + forceSSL = true; + }; + # "stk.lug.ac" = { + # root = "${inputs.self.packages.x86_64-linux.stk-installers}/srv/www"; + # enableACME = true; + # forceSSL = true; + # locations."/".extraConfig = "autoindex on;\n"; + # }; + "dashboard.tehbox.org" = { + root = "/var/lib/goaccess/html"; + basicAuthFile = config.sops.secrets."nginx/dashboard-htpasswd".path; + enableACME = true; + forceSSL = true; + }; + "_" = { + globalRedirect = "tehbox.org"; + }; + }; + }; + + # Web traffic dashboard, rebuilt from the nginx access log every 10 minutes. + # --persist/--restore keep the totals in /var/lib/goaccess/db across log rotations. + systemd.services.goaccess-report = { + description = "Build goaccess report for dashboard.tehbox.org"; + serviceConfig = { + Type = "oneshot"; + User = "nginx"; + Group = "nginx"; + StateDirectory = [ "goaccess" "goaccess/db" "goaccess/html" ]; + }; + script = '' +${pkgs.goaccess}/bin/goaccess /var/log/nginx/access.log \ + --log-format=VCOMBINED \ + --num-tests=0 \ + --no-query-string \ + --persist --restore --db-path=/var/lib/goaccess/db \ + --html-report-title="tehbox.org traffic" \ + -o /var/lib/goaccess/html/index.html +''; + }; + systemd.timers.goaccess-report = { + wantedBy = [ "timers.target" ]; + timerConfig = { + OnCalendar = "*:0/10"; + Persistent = true; + }; + }; + + teh-nix.services.cgit = { + enable = true; + authorizedKeys = config.users.users.boss.openssh.authorizedKeys.keys; + authorizedUsers = [ "boss" ]; + domain = "git.tehbox.org"; + enableACME = true; + # useACMEHost = "tehbox.org"; + forceSSL = true; + # onlySSL = true; + }; + + services.neodrive-website = { + enable = true; + domain = "neodrive.tehbox.org"; + }; + + services.znc = { + enable = true; + mutable = true; + useLegacyConfig = false; + openFirewall = true; + config = { + SSLCertFile = "/var/lib/acme/tehbox.org/key.pem"; + LoadModule = [ "webadmin" ]; + User.boss = { + Admin = true; + Pass.password = { + Method = "sha256"; + Hash = "401e8fed9a3ab1f93047b7465fd7cc6b0ca5aaed6b1c0482f0f4331ebdca8647"; + Salt = "*F_-,pqOdiJi;p)JoMnm"; + }; + }; + User.komodo = { + Admin = false; + Pass.password = { + Method = "sha256"; + Hash = "2c624debe3e2672383346230b6acad82192e40df05666481f792a9dd97d935cc"; + Salt = "q9At0+KZvmofZil(3us1"; + }; + }; + }; + }; + + services.openssh = { + enable = true; + settings.PermitRootLogin = "no"; + settings.PasswordAuthentication = false; + }; + + services.superTuxKarts = { + enable = true; + port = 2759; + package = pkgs.superTuxKart; + serverOptions = { + server-name = "LUG STK server"; + server-mode = 3; + server-difficulty = 3; + server-max-players = 16; + track-voting = false; + voting-timeout = 15; + private-server-password = "lug@uoa"; + motd = "Server for LUG@UoA\nChampionship coming soon!"; + live-spectate = true; + server-configurable = true; + }; + }; + + mailserver = { + enable = true; + stateVersion = 3; + fqdn = "tehbox.org"; + domains = [ "tehbox.org" ]; + + x509.useACMEHost = config.mailserver.fqdn; + + loginAccounts = { + "boss@tehbox.org" = { + hashedPasswordFile = config.sops.secrets."mail/boss".path; + aliases = ["postmaster@tehbox.org"]; + }; + }; + + # certificateScheme = "acme"; + }; + + users.users.boss = { + isNormalUser = true; + extraGroups = [ "wheel" "networkmanager"]; # Enable ‘sudo’ for the user. + home = "/home/boss"; + openssh.authorizedKeys.keys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJOukEKExoF6vr3vciQN8pBdd4FtZtRzqIGFJrUvllOY boss@nixy" ]; + }; + users.groups.files.members = [ "boss" "nginx" ]; + users.groups.nginx.members = [ "nginx" "znc" ]; + + environment.systemPackages = with pkgs; [ + vim + emacs + inetutils + mtr + sysstat + git + goaccess + inputs.self.packages.x86_64-linux.teh-website + # inputs.self.packages.x86_64-linux.stk-installers + ]; + + + # Open ports in the firewall. + # networking.firewall.allowedTCPPorts = [ ... ]; + # networking.firewall.allowedUDPPorts = [ ... ]; + # Or disable the firewall altogether. + # networking.firewall.enable = false; + + networking.usePredictableInterfaceNames = false; + networking.useDHCP = false; + networking.interfaces.eth0.useDHCP = true; + + # Copy the NixOS configuration file and link it from the resulting system + # (/run/current-system/configuration.nix). This is useful in case you + # accidentally delete configuration.nix. + # system.copySystemConfiguration = true; + + # This option defines the first version of NixOS you have installed on this particular machine, + # and is used to maintain compatibility with application data (e.g. databases) created on older NixOS versions. + # + # Most users should NEVER change this value after the initial install, for any reason, + # even if you've upgraded your system to a new NixOS release. + # + # This value does NOT affect the Nixpkgs version your packages and OS are pulled from, + # so changing it will NOT upgrade your system - see https://nixos.org/manual/nixos/stable/#sec-upgrading for how + # to actually do that. + # + # This value being lower than the current NixOS release does NOT mean your system is + # out of date, out of support, or vulnerable. + # + # Do NOT change this value unless you have manually inspected all the changes it would make to your configuration, + # and migrated your data accordingly. + # + # For more information, see `man configuration.nix` or https://nixos.org/manual/nixos/stable/options#opt-system.stateVersion . + system.stateVersion = "25.05"; # Did you read the comment? + + }; +} diff --git a/modules/computers/nixy.nix b/modules/computers/nixy.nix new file mode 100644 index 0000000..95820f5 --- /dev/null +++ b/modules/computers/nixy.nix @@ -0,0 +1,343 @@ +{ inputs, config, ... }: +let + nixos = config.flake.modules.nixos; + hm = config.flake.modules.homeManager; +in +{ + flake.nixosConfigurations.nixy = inputs.nixpkgs.lib.nixosSystem { + modules = [ nixos.nixy ]; + }; + + flake.modules.nixos.nixy = + # Edit this configuration file to define what should be installed on + # your system. Help is available in the configuration.nix(5) man page + # and in the NixOS manual (accessible by running ‘nixos-help’). + + { config, pkgs, ... }: + { + imports = + [ + nixos.teh-nix + nixos.my-pkgs + nixos.tuf + inputs.sops.nixosModules.sops + #inputs.spicetify-nix.nixosModules.default + inputs.home-manager.nixosModules.home-manager + inputs.stylix.nixosModules.stylix + ]; + + home-manager.useGlobalPkgs = true; + home-manager.useUserPackages = true; + home-manager.users.boss = hm.boss; + + teh-nix.nix.enable = true; + programs.nix-ld.enable = true; + programs.nix-ld.libraries = with pkgs; [ + # stdenv.cc.cc + glib + glibc + nspr + nss + dbus + atk + cups + cairo + gtk3 + alsa-lib + expat + fontconfig + freetype + libgbm + libnotify + libsecret + libxkbcommon + mesa + pango + libX11 + libXcomposite + libXcursor + libXdamage + libXext + libXfixes + libXi + libXrandr + libXrender + libXtst + libxcb + ]; + + # Use the systemd-boot EFI boot loader. + boot = { + loader.grub.enable = true; + loader.grub.device = "nodev"; + loader.grub.efiSupport = true; + loader.grub.enableCryptodisk = true; + # loader.grub.useOSProber = true; + loader.efi.canTouchEfiVariables = true; + kernel.sysctl."kernel.sysrq" = 502; + plymouth.enable = true; + }; + + + networking.hostName = "nixy"; # Define your hostname. + # Pick only one of the below networking options. + # networking.wireless.enable = true; # Enables wireless support via wpa_supplicant. + networking.networkmanager.enable = true; # Easiest to use and most distros use this by default. + + sops.defaultSopsFile = ../../secrets/general.yaml; + sops.defaultSopsFormat = "yaml"; + + sops.age.keyFile = "/home/boss/.config/sops/age/keys.txt"; + + sops.secrets = { + #"wg/nixnode/pub" = { }; + "wg/nixy/priv" = { + restartUnits = [ "nm-file-secret-agent.service" ]; + group = "networkmanager"; + mode = "440"; + }; + }; + + networking.firewall = { + allowedUDPPorts = [ 51820 ]; + allowedTCPPorts = [ 8081 ]; + }; + networking.networkmanager.ensureProfiles = { + profiles = { + wg-nixnode = { + connection = { + id = "wg-nixnode"; + autoconnect = "false"; + interface-name = "wg0"; + type = "wireguard"; + }; + ipv4 = { + address1 = "10.100.0.2/32"; + may-fail = "false"; + method = "manual"; + }; + ipv6 = { + method = "disabled"; + }; + wireguard = { + listen-port = "51820"; + private-key-flags = 1; + #private-key = "dummy"; + }; + proxy = { }; + "wireguard-peer./6bWy02DhOSjaeXk+ol5ATgEYDDJvL+mTO9SCNvfIUQ=" = { + allowed-ips = "0.0.0.0/0;"; + endpoint = "172.105.172.191:51820"; + persistent-keepalive = "25"; + }; + }; + }; + secrets.entries = [ + { + matchId = "wg-nixnode"; + matchType = "wireguard"; + matchSetting = "wireguard"; + key = "private-key"; + file = config.sops.secrets."wg/nixy/priv".path; + } + ]; + }; + + systemd.services."nm-file-secret-agent" = { + serviceConfig.User = "boss"; + }; + + + # Set your time zone. + time.timeZone = "NZ"; + + # Configure network proxy if necessary + # networking.proxy.default = "http://user:password@proxy:port/"; + # networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain"; + + # Select internationalisation properties. + i18n.defaultLocale = "en_US.UTF-8"; + console = { + font = "Lat2-Terminus16"; + #keyMap = "us"; + #useXkbConfig = true; # use xkbOptions in tty. + }; + + teh-nix.xorg = { + enable = true; + }; + + programs.hyprland = { + enable = false; + #package = inputs.hyprland.packages.${pkgs.system}.hyprland; + #portalPackage = inputs.hyprland.packages.${pkgs.system}.xdg-desktop-portal-hyprland; + }; + + security.pam.services.swaylock = {}; + + # Enable CUPS to print documents. + services.printing.enable = true; + services.printing.drivers = with pkgs;[ + hplip + ]; + services.avahi = { + enable = true; + nssmdns4 = true; + openFirewall = true; + }; + + # Enable sound. + #sound.enable = true; + services.pipewire = { + enable = true; + alsa.enable = false; + alsa.support32Bit = false; + pulse.enable = true; + }; + + services.upower.enable = true; + + # Enable touchpad support (enabled default in most desktopManager). + security.rtkit.enable = true; + services.libinput = { + enable = true; + mouse = { + accelProfile = "flat"; + }; + }; + + # Define a user account. Don't forget to set a password with ‘passwd’. + users.users.boss = { + isNormalUser = true; + extraGroups = [ "wheel" "networkmanager" "input" "uinput" ]; + }; + + fonts.packages = with pkgs; [ + #(nerdfonts.override { fonts = [ "Cousine" ]; }) + nerd-fonts.cousine + ]; + + # List packages installed in system profile. To search, run: + # $ nix search wget + environment.systemPackages = with pkgs; + [ + vim + firefox + pfetch + fastfetch + pinentry-gtk2 + git + nm-file-secret-agent + deploy-rs + ]; + documentation.dev.enable = true; + + hardware.graphics.enable32Bit = true; + programs.steam = { + enable = true; + package = pkgs.steam.override { + extraEnv = { + __NV_PRIME_RENDER_OFFLOAD=1; + __NV_PRIME_RENDER_OFFLOAD_PROVIDER="NVIDIA-G0"; + __GLX_VENDOR_LIBRARY_NAME="nvidia"; + __VK_LAYER_NV_optimus="NVIDIA_only"; + }; + }; + + extraCompatPackages = with pkgs; [ + proton-ge-bin + ]; + }; + + # Some programs need SUID wrappers, can be configured further or are + # started in user sessions. + # programs.mtr.enable = true; + programs.gnupg = { + agent = { + enable = true; + pinentryPackage = pkgs.pinentry-gtk2; + }; + # enableSSHSupport = true; + }; + + hardware.bluetooth.enable = true; # enables support for Bluetooth + hardware.bluetooth.powerOnBoot = true; # powers up the default Bluetooth controller on boot + services.blueman.enable = true; + + systemd.tmpfiles.rules = [ + "f /var/lib/systemd/linger/boss" # enables lingering + ]; + + # programs.dconf.enable = true; + + + services.ratbagd.enable = true; + + # xdg.portal.enable = true; + # services.flatpak.enable = true; + + stylix = { + enable = true; + + base16Scheme = "${pkgs.base16-schemes}/share/themes/material-palenight.yaml"; + + image = ../../wallpaper.png; + targets.grub.useWallpaper = true; + + opacity = { + terminal = 0.8; + }; + + polarity = "dark"; + + fonts = { + monospace = { + package = pkgs.nerd-fonts.cousine; + name = "Cousine Nerd Font Mono"; + }; + + serif = { + package = pkgs.dejavu_fonts; + name = "DejaVu Serif"; + }; + + sansSerif = { + package = pkgs.dejavu_fonts; + name = "DejaVu Sans"; + }; + + emoji = { + package = pkgs.noto-fonts-color-emoji; + name = "Noto Color Emoji"; + }; + + sizes = { + terminal = 10; + applications = 10; + desktop = 10; + popups = 10; + }; + }; + + cursor = { + package = pkgs.nordzy-cursor-theme; + name = "Nordzy-cursors"; + size = 20; + }; + }; + + # Copy the NixOS configuration file and link it from the resulting system + # (/run/current-system/configuration.nix). This is useful in case you + # accidentally delete configuration.nix. + # system.copySystemConfiguration = true; + + # This value determines the NixOS release from which the default + # settings for stateful data, like file locations and database versions + # on your system were taken. It‘s perfectly fine and recommended to leave + # this value at the release version of the first install of this system. + # Before changing this value read the documentation for this option + # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html). + system.stateVersion = "24.05"; # Did you read the comment? + + }; +} -- cgit v1.3.1