haccfiles/hosts/parsons/configuration.nix

106 lines
2.6 KiB
Nix
Raw Normal View History

2021-07-29 20:31:52 +00:00
{ config, lib, pkgs, sources, modules, ... }:
{
imports = [
2021-08-06 18:54:40 +00:00
../../common
2021-07-29 20:31:52 +00:00
./hardware.nix
modules.encboot
modules.network.nftables
modules.nftnat
sources.nix-hexchen.nixosModules.profiles.nopersist
2021-08-06 17:40:57 +00:00
2022-11-09 23:40:25 +00:00
../../services/nextcloud.nix
2021-08-07 12:27:49 +00:00
../../services/mattermost.nix
../../services/thelounge.nix
2021-08-07 13:14:15 +00:00
../../services/murmur.nix
2021-08-07 18:27:04 +00:00
../../services/hedgedoc-hacc.nix
../../services/hedgedoc-i4f.nix
2021-08-07 21:26:56 +00:00
../../services/mail.nix
2022-07-09 17:36:24 +00:00
../../services/gitea.nix
2021-08-08 22:09:37 +00:00
../../services/nginx-pages.nix
2021-09-28 11:13:25 +00:00
../../services/vaultwarden.nix
2023-01-22 01:25:07 +00:00
../../services/tracktrain.nix
2022-04-30 20:43:12 +00:00
../../services/uffd.nix
2021-08-11 20:31:25 +00:00
./lxc.nix
2021-07-29 20:31:52 +00:00
];
2022-11-14 17:14:22 +00:00
hexchen.bindmounts."/var/lib/acme" = "/persist/var/lib/acme";
# fileSystems."/var/lib/acme" = {
# device = "/persist/var/lib/acme";
# fsType = "bind";
# };
2021-07-29 20:31:52 +00:00
hexchen.encboot = {
enable = true;
dataset = "-a";
networkDrivers = [ "igb" ];
};
sops.defaultSopsFile = ../../secrets.yaml;
sops.age.sshKeyPaths = [ "/persist/ssh/ssh_host_ed25519_key" ];
2021-07-29 20:31:52 +00:00
boot.loader.grub.enable = true;
boot.loader.grub.devices = [ "/dev/nvme0n1" "/dev/nvme1n1" ];
boot.supportedFilesystems = [ "zfs" ];
networking.hostId = "b2867696";
networking.useDHCP = true;
2021-08-04 13:59:35 +00:00
networking.nftables.enable = true;
hexchen.nftables.nat.enable = true;
networking.nat.internalInterfaces = ["ve-+"];
networking.nat.externalInterface = "enp35s0";
2021-07-29 20:31:52 +00:00
networking.hostName = "parsons";
2021-08-07 19:19:06 +00:00
networking.interfaces.enp35s0.ipv6.addresses = [{
address = "2a01:4f9:3a:2ddb::1";
prefixLength = 64;
}];
networking.defaultGateway6 = {
address = "fe80::1";
interface = "enp35s0";
};
boot = {
kernelModules = [ "nf_nat_ftp" ];
kernel.sysctl = {
"net.ipv4.conf.all.forwarding" = lib.mkOverride 90 true;
"net.ipv4.conf.default.forwarding" = lib.mkOverride 90 true;
};
};
2021-08-07 19:19:06 +00:00
2021-08-07 19:24:59 +00:00
services.nginx = {
enable = true;
recommendedProxySettings = true;
virtualHosts = {
"parsons.hacc.space" = {
default = true;
locations."/".return = "404";
};
"hacc.space" = {
enableACME = true;
forceSSL = true;
locations."/".return = "302 https://hacc.earth";
};
};
};
2021-08-06 17:40:57 +00:00
networking.firewall.allowedTCPPorts = [ 80 443 ];
2021-08-06 18:49:27 +00:00
services.restic.backups.tardis = {
passwordFile = "/persist/restic/system";
environmentFile = "/persist/restic/system.s3creds";
2021-08-06 18:49:27 +00:00
paths = [
"/home"
"/persist"
];
pruneOpts = [
"--keep-daily 7"
"--keep-weekly 5"
"--keep-monthly 3"
];
repository = "b2:tardis-parsons:system";
};
2021-07-29 20:31:52 +00:00
system.stateVersion = "21.05";
}