Dominik Polakovics
53d73142ae
- Introduced a new module for a11ywatch with Podman support, creating a bridge network and defining backend and frontend containers. - Configured Nginx to serve the a11ywatch application with SSL and ACME support. - Added user and group configurations for a11ywatch. - Created a systemd service to ensure the Podman network exists on boot. Implement Firefox Container Controller extension and host - Added a module for the Firefox Container Controller extension, allowing installation via Nix. - Created a native messaging host for the extension to communicate with the container controller. - Included CLI helpers to enqueue commands for showing and hiding containers. Enable fingerprint authentication in PAM - Configured fingerprint authentication for login, sudo, and swaylock services. Setup Raspberry Pi OS image creation script - Developed a script to create a read-only Raspberry Pi OS Lite image with Snapcast client. - Included configuration for Wi-Fi, hostname, and Snapcast server. - Implemented user and group setup for Snapcast client and ensured necessary services are enabled. Document Raspberry Pi Zero W setup instructions - Added detailed instructions for configuring Raspberry Pi OS on Zero W, including disabling unused services and setting up Snapcast client. Create test configuration script for NixOS - Implemented a script to perform dry-builds for NixOS configurations, allowing for easy validation of host configurations.
135 lines
3.9 KiB
Nix
135 lines
3.9 KiB
Nix
{ lib, pkgs, config, ... }: let
|
|
hostname = "web-02";
|
|
json = pkgs.formats.json { };
|
|
impermanence = builtins.fetchTarball "https://github.com/nix-community/impermanence/archive/master.tar.gz";
|
|
in {
|
|
microvm.vms = {
|
|
web = {
|
|
pkgs = import pkgs.path {
|
|
config = {
|
|
permittedInsecurePackages = [
|
|
# needed for matrix
|
|
"olm-3.2.16"
|
|
];
|
|
};
|
|
};
|
|
config = {
|
|
microvm = {
|
|
mem = 4096;
|
|
# hypervisor = "cloud-hypervisor";
|
|
shares = [
|
|
{
|
|
source = "/nix/store";
|
|
mountPoint = "/nix/.ro-store";
|
|
tag = "ro-store";
|
|
proto = "virtiofs";
|
|
}
|
|
{
|
|
source = "/var/lib/microvms/persist/web-02";
|
|
mountPoint = "/persist";
|
|
tag = "persist";
|
|
proto = "virtiofs";
|
|
}
|
|
];
|
|
volumes = [
|
|
{
|
|
image = "rootfs.img";
|
|
mountPoint = "/";
|
|
size = 102400;
|
|
}
|
|
];
|
|
interfaces = [
|
|
{
|
|
type = "tap";
|
|
id = "vm-${hostname}";
|
|
mac = "02:00:00:00:01:01";
|
|
}
|
|
];
|
|
};
|
|
|
|
imports = [
|
|
"${impermanence}/nixos.nix"
|
|
../network-prefix.nix
|
|
../../utils/modules/sops.nix
|
|
../../utils/modules/lego/lego.nix
|
|
../../modules/tinder-api.nix
|
|
# ../../utils/modules/borgbackup.nix
|
|
|
|
./zammad.nix
|
|
./proxies.nix
|
|
./matrix.nix
|
|
];
|
|
|
|
networkPrefix = config.networkPrefix;
|
|
|
|
time.timeZone = "Europe/Vienna";
|
|
|
|
systemd.network.networks."10-lan" = {
|
|
matchConfig.PermanentMACAddress = "02:00:00:00:01:01";
|
|
address = [ "${config.networkPrefix}.97.5/24" ];
|
|
gateway = [ "${config.networkPrefix}.97.1" ];
|
|
dns = [ "${config.networkPrefix}.97.1" ];
|
|
};
|
|
|
|
fileSystems."/persist".neededForBoot = lib.mkForce true;
|
|
environment.persistence."/persist-local" = {
|
|
directories = [
|
|
"/var/lib/zammad"
|
|
"/var/lib/postgresql"
|
|
"/var/log"
|
|
"/var/lib/systemd/coredump"
|
|
];
|
|
};
|
|
|
|
environment.systemPackages = with pkgs; [
|
|
vim # my preferred editor
|
|
];
|
|
|
|
networking.hostName = hostname;
|
|
|
|
services.openssh = {
|
|
enable = true;
|
|
hostKeys = [
|
|
{
|
|
path = "/persist/etc/ssh/ssh_host_ed25519_key";
|
|
type = "ed25519";
|
|
}
|
|
{
|
|
path = "/persist/etc/ssh/ssh_host_rsa_key";
|
|
type = "rsa";
|
|
bits = 4096;
|
|
}
|
|
];
|
|
};
|
|
users.users.root.openssh.authorizedKeys.keys = [
|
|
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDN/2SAFm50kraB1fepAizox/QRXxB7WbqVbH+5OPalDT47VIJGNKOKhixQoqhABHxEoLxdf/C83wxlCVlPV9poLfDgVkA3Lyt5r3tSFQ6QjjOJAgchWamMsxxyGBedhKvhiEzcr/Lxytnoz3kjDG8fqQJwEpdqMmJoMUfyL2Rqp16u+FQ7d5aJtwO8EUqovhMaNO7rggjPpV/uMOg+tBxxmscliN7DLuP4EMTA/FwXVzcFNbOx3K9BdpMRAaSJt4SWcJO2cS2KHA5n/H+PQI7nz5KN3Yr/upJN5fROhi/SHvK39QOx12Pv7FCuWlc+oR68vLaoCKYhnkl3DnCfc7A7"
|
|
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIRQuPqH5fdX3KEw7DXzWEdO3AlUn1oSmtJtHB71ICoH Generated By Termius"
|
|
];
|
|
|
|
services.nginx = {
|
|
enable = true;
|
|
recommendedTlsSettings = true;
|
|
recommendedOptimisation = true;
|
|
recommendedGzipSettings = true;
|
|
recommendedProxySettings = true;
|
|
};
|
|
|
|
# backups
|
|
# borgbackup.repo = "u149513-sub2@u149513-sub2.your-backup.de:borg";
|
|
|
|
|
|
sops.age.sshKeyPaths = [ "/persist/etc/ssh/ssh_host_ed25519_key" ];
|
|
sops.defaultSopsFile = ./secrets.yaml;
|
|
|
|
networking.firewall = {
|
|
enable = true;
|
|
allowedTCPPorts = [ 22 80 443 ];
|
|
};
|
|
|
|
|
|
system.stateVersion = "22.05";
|
|
};
|
|
};
|
|
};
|
|
}
|