diff options
| -rw-r--r-- | flake.nix | 14 | ||||
| -rw-r--r-- | home-modules/desktop/wayland/default.nix | 1 | ||||
| -rw-r--r-- | hosts/omega-relay/default.nix | 43 | ||||
| -rw-r--r-- | hosts/omega-relay/firewall.nix | 53 | ||||
| -rw-r--r-- | hosts/omega-relay/vm.nix | 38 | ||||
| -rw-r--r-- | hosts/test_vm/default.nix | 2 | ||||
| -rw-r--r-- | modules/virt.nix | 2 | ||||
| -rw-r--r-- | users/user-common.nix | 2 | ||||
| -rw-r--r-- | users/wilkuu-server.nix | 53 |
9 files changed, 206 insertions, 2 deletions
@@ -102,6 +102,20 @@ inputs.sops-nix.nixosModules.sops ]; }; + omega-relay = nixpkgs.lib.nixosSystem { + specialArgs = { + inherit inputs; + }; + system = "x86_64-linux"; + modules = [ + ./modules + ./hosts/omega-relay + ./users/wilkuu-server.nix + inputs.home-manager.nixosModules.default + inputs.sops-nix.nixosModules.sops.nix + ]; + + }; vm-shell = nixpkgs.lib.nixosSystem { specialArgs = { inherit inputs; diff --git a/home-modules/desktop/wayland/default.nix b/home-modules/desktop/wayland/default.nix index 87ab13b..27b1176 100644 --- a/home-modules/desktop/wayland/default.nix +++ b/home-modules/desktop/wayland/default.nix @@ -6,6 +6,7 @@ ]; xdg.portal = { enable = true; + config.common.default = "*"; extraPortals = [ pkgs.xdg-desktop-portal-gtk ]; diff --git a/hosts/omega-relay/default.nix b/hosts/omega-relay/default.nix new file mode 100644 index 0000000..73bb853 --- /dev/null +++ b/hosts/omega-relay/default.nix @@ -0,0 +1,43 @@ +{ pkgs, lib, config, ...}: { + imports = [ + ./firewall.nix + ./vm.nix + ]; + + addons = { + desktop.hyprland.enable = lib.mkForce false; + desktop.xfce.enable = lib.mkForce false; + + virtialisation.guest = config.addons.virtualization.isTestVM; + gpg.enable = true; + }; + + boot.loader.grub = { + useOSProber = true; + }; + + networking.hostName = "omega-relay"; + services.resolved = { + enable = true; + dnsovertls = "opportunistic"; + }; + + services.openssh = { + enable = true; + ports = [ 22 ]; + openFirewall = true; + allowSFTP = true; + settings = { + PasswordAuthentication = false; + AllowUsers = [ "wilkuu" ]; + X11Forwarding = false; + PermitRootLogin = "no"; + PrintMotd = true; + }; + }; + + + + + +} diff --git a/hosts/omega-relay/firewall.nix b/hosts/omega-relay/firewall.nix new file mode 100644 index 0000000..7b04813 --- /dev/null +++ b/hosts/omega-relay/firewall.nix @@ -0,0 +1,53 @@ +{ ... }: +let + baseTCP = [ + 20 22 433 + ]; + baseUDP = [ + 16555 # Wireguard + ]; + baseTCPRanges = [ + ]; + + baseUDPRanges = [ + ]; + + secureTCP = [ + ]; + + secureUDP = [ + ]; + + secureTCPRanges = [ + ]; + + secureUDPRanges = [ + ]; +in +{ + networking.nftables.enable = true; + networking.firewall = { + enable = true; + checkReversePath = false; + allowedTCPPorts = baseTCP; + allowedUDPPorts = baseUDP; + allowedUDPPortRanges = baseUDPRanges; + allowedTCPPortRanges = baseTCPRanges; + interfaces = { + "wg-home" = { + allowedTCPPorts = secureTCP; + allowedUDPPorts = secureUDP; + allowedUDPPortRanges = secureUDPRanges; + allowedTCPPortRanges = secureTCPRanges; + }; + }; + trustedInterfaces = [ + "docker0" + "br-*" + "veth*" + "vnet*" + "virbr*" + ]; + + }; +} diff --git a/hosts/omega-relay/vm.nix b/hosts/omega-relay/vm.nix new file mode 100644 index 0000000..e2b80d1 --- /dev/null +++ b/hosts/omega-relay/vm.nix @@ -0,0 +1,38 @@ +{lib, config,...}: let + tcpFromHost = gport: hport: { + from = "host"; + proto = "tcp"; + host = { + port = hport; + address = "10.0.69.1"; + }; + guest = { + port = gport; + address = "10.0.69.2"; + }; + }; +in { + virtualisation.vmVariant = { + addons.virtualisation.isTestVM = true; + fileSystems."/" = { + device = "none"; + fsType = "tmpfs"; + options = [ + "defaults" + "size=2G" + "mode=755" + ]; + }; + virtualization = { + forwardPorts = [ + (tcpFromHost 80 8080) + (tcpFromHost 22 8022) + ]; + virtualisation = { + memorySize = 2048; # Use 2048MiB memory. + cores = 3; + graphics = true; + }; + }; + }; +} diff --git a/hosts/test_vm/default.nix b/hosts/test_vm/default.nix index 6dd2fc1..14ca75b 100644 --- a/hosts/test_vm/default.nix +++ b/hosts/test_vm/default.nix @@ -5,7 +5,7 @@ boot.loader.systemd-boot.enable = true; boot.loader.efi.canTouchEfiVariables = true; - networking.hostName = "cookie_vm"; # Define your hostname. + networking.hostName = "omega-relay"; # Define your hostname. networking.networkmanager.enable = true; programs.nix-ld.enable = true; diff --git a/modules/virt.nix b/modules/virt.nix index 53bd70a..7799bff 100644 --- a/modules/virt.nix +++ b/modules/virt.nix @@ -11,6 +11,7 @@ in options.addons.virtualisation = { host = lib.mkEnableOption "Allow to host vm's and containers"; guest = lib.mkEnableOption "Enable guest agents"; + isTestVM = lib.mkEnableOption "Enabled if the system is a test VM"; }; config = lib.mkMerge ([ @@ -34,6 +35,7 @@ in }) (lib.mkIf cfg.guest { services.spice-vdagentd.enable = true; + services.qemuGuest.enable = true; }) ]); } diff --git a/users/user-common.nix b/users/user-common.nix index b9f246f..28bf606 100644 --- a/users/user-common.nix +++ b/users/user-common.nix @@ -7,7 +7,7 @@ # Pass host config to HM (Common config) # TODO: Move this somewhere else. home-manager = { - useUserPackages = true; + # useUserPackages = true; useGlobalPkgs = true; backupFileExtension = "bak"; diff --git a/users/wilkuu-server.nix b/users/wilkuu-server.nix new file mode 100644 index 0000000..ae32068 --- /dev/null +++ b/users/wilkuu-server.nix @@ -0,0 +1,53 @@ +{ + pkgs, + lib, + ... +}: +{ + imports = [ ./user-common.nix ]; + programs.zsh.enable = true; + programs.adb.enable = true; + users.users.wilkuu = { + shell = pkgs.zsh; + isNormalUser = true; + initialPassword = "PleazeChangeThis123"; + extraGroups = [ + "wheel" + "adbusers" + "networkmanager" + "input" + "docker" + "adbusers" + "libvirtd" + "libvirt" + ]; # Enable ‘sudo’ for the user. + packages = with pkgs; [ + home-manager + ]; + }; + + home-manager.users.wilkuu = { + imports = [ ../home-modules ]; + + homeapps.presets = lib.genAttrs + ["base" "utils" "dev" "browser"] + (_: {enable = true; }); + # homeapps.vnc = true; + + services.wayvnc = { + enable = true; + autoStart = false; + settings = { + # Todo, bind to vpn and LAN explicitly somehow + address = "0.0.0.0"; + port = 5900; + }; + }; + + home.username = "wilkuu"; + home.homeDirectory = "/home/wilkuu"; + home.stateVersion = "24.11"; + programs.home-manager.enable = true; + }; + +} |