diff options
| -rw-r--r-- | flake.nix | 33 | ||||
| -rw-r--r-- | hosts/aperture/default.nix | 72 | ||||
| -rw-r--r-- | hosts/aperture/disko.nix | 64 | ||||
| -rw-r--r-- | hosts/aperture/testbed.nix | 28 |
4 files changed, 188 insertions, 9 deletions
@@ -71,15 +71,17 @@ treefmt = forAllSystems (pkgs: _: treefmt-nix.lib.evalModule pkgs ./modules/treefmt.nix); in { - packages = (lib.recursiveUpdate - (forAllSystems ( - pkgs: _system: { - bulwark = pkgs.callPackage ./packages/bulwark/package.nix { }; + packages = ( + lib.recursiveUpdate + (forAllSystems ( + pkgs: _system: { + bulwark = pkgs.callPackage ./packages/bulwark/package.nix { }; + } + )) + { + "x86_64-linux".full-iso = self.nixosConfigurations.full-iso.config.system.build.isoImage; } - )) - { - "x86_64-linux".full-iso = self.nixosConfigurations.full-iso.config.system.build.isoImage; - }); + ); # for `nix fmt` formatter = forAllSystems (_: system: treefmt.${system}.config.build.wrapper); @@ -144,7 +146,20 @@ disko.nixosModules.disko sops-nix.nixosModules.default ]; - + }; + aperture = nixpkgs.lib.nixosSystem { + specialArgs = { + inherit inputs; + }; + system = "x86_64-linux"; + modules = [ + ./modules + ./users/wilkuu-server.nix + ./hosts/aperture + home-manager.nixosModules.default + disko.nixosModules.default + sops-nix.nixosModules.default + ]; }; }; }; diff --git a/hosts/aperture/default.nix b/hosts/aperture/default.nix new file mode 100644 index 0000000..ded949c --- /dev/null +++ b/hosts/aperture/default.nix @@ -0,0 +1,72 @@ +{ lib, modulesPath, ... }: +{ + imports = [ + (modulesPath + "/profiles/qemu-guest.nix") + ./disko.nix + ./testbed.nix + ]; + + boot.initrd.availableKernelModules = [ + "uhci_hcd" + "ehci_pci" + "ahci" + "virtio_pci" + "virtio_scsi" + "sd_mod" + "sr_mod" + ]; + boot.initrd.kernelModules = [ ]; + boot.kernelModules = [ "kvm-intel" ]; + boot.extraModulePackages = [ ]; + + # Enables DHCP on each ethernet and wireless interface. In case of scripted networking + # (the default) this is the recommended approach. When using systemd-networkd it's + # still possible to use this option, but it's recommended to use it in conjunction + # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`. + networking = { + useDHCP = true; + hostName = "aperture"; + nftables.enable = true; + useNetworkd = true; + }; + + systemd.network = { + enable = true; + networks."10-uplink" = { + matchConfig.Type = "ether"; + networkConfig = { + DHCP = "ipv4"; + IPv6AcceptRA = "yes"; + }; + linkConfig = { + RequiredForOnline = "yes"; + }; + }; + }; + + boot.loader.efi.canTouchEfiVariables = lib.mkDefault true; + boot.loader.limine = { + efiSupport = true; + enable = true; + secureBoot = { + enable = false; + }; + }; + + # SSH Access + services.openssh = { + enable = true; + ports = [ 22 ]; + openFirewall = true; + allowSFTP = true; + settings = { + PasswordAuthentication = false; + AllowUsers = [ "wilkuu" ]; + X11Forwarding = true; + PermitRootLogin = "no"; + }; + }; + + + nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux"; +} diff --git a/hosts/aperture/disko.nix b/hosts/aperture/disko.nix new file mode 100644 index 0000000..9727cd3 --- /dev/null +++ b/hosts/aperture/disko.nix @@ -0,0 +1,64 @@ +{ ... }: +{ + services.btrfs.autoScrub = { + enable = true; + interval = "weekly"; + }; + + disko.devices = { + disk = { + main = { + device = "/dev/vda"; + content = { + type = "gpt"; + partitions = { + ESP = { + type = "EF00"; + size = "512M"; + content = { + type = "filesystem"; + format = "vfat"; + mountpoint = "/boot"; + mountOptions = [ "umask=0077" ]; + }; + }; + root = { + size = "100%"; + content = { + type = "btrfs"; + extraArgs = [ "-f" ]; + subvolumes = { + # Subvolume name is different from mountpoint + "/rootfs" = { + mountOptions = [ "compress=zstd" ]; + mountpoint = "/"; + }; + # Subvolume name is the same as the mountpoint + "/home" = { + mountOptions = [ "compress=zstd" ]; + mountpoint = "/home"; + }; + # Parent is not mounted so the mountpoint must be set + "/nix" = { + mountOptions = [ + "compress=zstd" + "noatime" + ]; + mountpoint = "/nix"; + }; + # Subvolume for the swapfile + "/swap" = { + mountpoint = "/.swapvol"; + swap = { + swapfile.size = "8G"; + }; + }; + }; + }; + }; + }; + }; + }; + }; + }; +} diff --git a/hosts/aperture/testbed.nix b/hosts/aperture/testbed.nix new file mode 100644 index 0000000..479de4a --- /dev/null +++ b/hosts/aperture/testbed.nix @@ -0,0 +1,28 @@ +{ ... }: +{ + imports = [ ../../services/mail2.nix ]; + wilkuu.services.test_endpoint = { + enable = true; + doACME = false; + port = 9999; + domain = "test.aperture.local"; + }; + + wilkuu.services.mail = { + enable = true; + doACME = false; + defaultDomain = "mail.aperture.local"; + domains = [ "mail.aperture.local" ]; + wellKnownDomains = [ "aperture.local" ]; + startupMode = "bootstrap"; + }; + + lldap = { + enable = false; + environmentFile = null; + settings = { + + + }; + }; +} |