emelie/nix-deploy
1
0
Fork 0
Code Issues 1 Pull requests 1 Projects Releases Wiki Activity

Disable minimal profile

Browse source
This commit is contained in:
Amanda Graven 2023-11-29 15:09:10 +01:00
parent b43a55bb9f
commit ed2a33f3a6
Signed by: amanda
GPG key ID: F747582C5608F4CB
12 changed files with 131 additions and 94 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
.EditorConfig Normal file
View file

@ -0,0 +1,4 @@
root = true
[*.nix]
indent_style = "tab"

12
Makefile Normal file
View file

@ -0,0 +1,12 @@
all: result
.PHONY: update result deploy
result:
nix build -f deploy/default.nix
update:
cd config/sources && niv update
deploy:
./result

12
config/common/configuration/documentation.nix Normal file
View file

@ -0,0 +1,12 @@
{ ... }:
{
# Some docs fail to build, so we need to disable some of it
documentation = {
enable = true;
man.enable = true;
doc.enable = true;
dev.enable = false;
nixos.enable = false;
};
}

1
config/hosts/grondahl/configuration.nix
View file

@ -6,6 +6,7 @@
./hardware-configuration.nix ./hardware-configuration.nix
./data/secrets/secrets.nix ./data/secrets/secrets.nix
../../common/configuration/nix.nix ../../common/configuration/nix.nix
../../common/configuration/documentation.nix
../../common/services/ssh.nix ../../common/services/ssh.nix
../../common/services/tailscale.nix ../../common/services/tailscale.nix
../../common/users.nix ../../common/users.nix

2
config/hosts/grondahl/hardware-configuration.nix
View file

@ -2,7 +2,7 @@
{ {
imports = imports =
[ (modulesPath + "/profiles/qemu-guest.nix") [ (modulesPath + "/profiles/qemu-guest.nix")
(modulesPath + "/profiles/minimal.nix") #(modulesPath + "/profiles/minimal.nix")
]; ];
boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "virtio_scsi" "sr_mod" "virtio_blk" ]; boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "virtio_scsi" "sr_mod" "virtio_blk" ];

154
config/hosts/rudiger/configuration.nix
View file

@ -1,92 +1,92 @@
{ config, pkgs, ... }: { config, pkgs, ... }:
{ {
imports = imports = [
[ ./hardware-configuration.nix
./hardware-configuration.nix ./data/secrets/secrets.nix
./data/secrets/secrets.nix ../../common/configuration/nix.nix
../../common/configuration/nix.nix ../../common/configuration/documentation.nix
../../common/services/ssh.nix ../../common/services/ssh.nix
../../common/services/tailscale.nix ../../common/services/tailscale.nix
../../common/users.nix ../../common/users.nix
./services/acme.nix ./services/acme.nix
./services/nextcloud.nix ./services/nextcloud.nix
./services/nginx.nix ./services/nginx.nix
./services/postgres.nix ./services/postgres.nix
./services/redis.nix ./services/redis.nix
./services/restic.nix ./services/restic.nix
]; ];
boot.loader.grub.enable = true; boot.loader.grub.enable = true;
boot.loader.grub.device = "/dev/sda"; boot.loader.grub.device = "/dev/sda";
boot.kernelPackages = config.boot.zfs.package.latestCompatibleLinuxPackages; boot.kernelPackages = config.boot.zfs.package.latestCompatibleLinuxPackages;
boot.supportedFilesystems = ["zfs"]; boot.supportedFilesystems = ["zfs"];
services.zfs.autoSnapshot.enable = false; services.zfs.autoSnapshot.enable = false;
services.zfs.autoScrub.enable = true; services.zfs.autoScrub.enable = true;
time.timeZone = "Europe/Copenhagen"; time.timeZone = "Europe/Copenhagen";
networking = { networking = {
hostName = "rudiger"; hostName = "rudiger";
hostId = "8c7b66a4"; hostId = "8c7b66a4";
useDHCP = false; useDHCP = false;
tempAddresses = "disabled"; tempAddresses = "disabled";
interfaces = { interfaces = {
"ens3" = { "ens3" = {
ipv4.addresses = [ { ipv4.addresses = [ {
address = "202.61.202.170"; address = "202.61.202.170";
prefixLength = 22; prefixLength = 22;
} ]; } ];
ipv6.addresses = [ { ipv6.addresses = [ {
address = "2a03:4000:5a:c61::1"; address = "2a03:4000:5a:c61::1";
prefixLength = 64; prefixLength = 64;
} ]; } ];
}; };
}; };
defaultGateway = "202.61.200.1"; defaultGateway = "202.61.200.1";
defaultGateway6 = { defaultGateway6 = {
address = "fe80::1"; address = "fe80::1";
interface = "ens3"; interface = "ens3";
}; };
nameservers = [ "1.1.1.1" "1.0.0.1" "2606:4700:4700::1111" "2606:4700:4700::1001" ]; nameservers = [ "1.1.1.1" "1.0.0.1" "2606:4700:4700::1111" "2606:4700:4700::1001" ];
}; };
nix.settings = { nix.settings = {
auto-optimise-store = true; auto-optimise-store = true;
trusted-users = [ trusted-users = [
"root" "root"
"@wheel" "@wheel"
]; ];
}; };
environment.systemPackages = with pkgs; [ environment.systemPackages = with pkgs; [
vim vim
wget wget
htop htop
iotop iotop
dig dig
tailscale tailscale
]; ];
security.sudo.wheelNeedsPassword = false; security.sudo.wheelNeedsPassword = false;
systemd.services."nextcloud-setup" = { systemd.services."nextcloud-setup" = {
requires = [ "postgresql.service" "redis.service" ]; requires = [ "postgresql.service" "redis.service" ];
after = [ "postgresql.service" "redis.service" ]; after = [ "postgresql.service" "redis.service" ];
}; };
users.groups.redis.members = [ "nextcloud" ]; users.groups.redis.members = [ "nextcloud" ];
users.groups.backup.members = [ "nextcloud" "postgres" ]; users.groups.backup.members = [ "nextcloud" "postgres" ];
networking.firewall = { networking.firewall = {
allowedTCPPorts = [ 22 80 443 ]; allowedTCPPorts = [ 22 80 443 ];
allowedUDPPorts = [ config.services.tailscale.port ]; allowedUDPPorts = [ config.services.tailscale.port ];
trustedInterfaces = [ "tailscale0" ]; trustedInterfaces = [ "tailscale0" ];
enable = true; enable = true;
checkReversePath = "loose"; checkReversePath = "loose";
}; };
# networking.firewall.allowedUDPPorts = [ ... ]; # networking.firewall.allowedUDPPorts = [ ... ];
system.stateVersion = "21.05"; system.stateVersion = "21.05";
} }

2
config/hosts/rudiger/hardware-configuration.nix
View file

@ -3,7 +3,7 @@
{ {
imports = imports =
[ (modulesPath + "/profiles/qemu-guest.nix") [ (modulesPath + "/profiles/qemu-guest.nix")
(modulesPath + "/profiles/minimal.nix") #(modulesPath + "/profiles/minimal.nix")
]; ];
boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "virtio_scsi" "sd_mod" "sr_mod" ]; boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "virtio_scsi" "sd_mod" "sr_mod" ];

4
config/hosts/rudiger/services/nextcloud.nix
View file

@ -2,7 +2,7 @@
{ {
services.nextcloud = { services.nextcloud = {
enable = true; enable = true;
# Disables server-side file encryption for stronger SSL # Disable server-side file encryption for stronger SSL
enableBrokenCiphersForSSE = false; enableBrokenCiphersForSSE = false;
hostName = "cloud.graven.dev"; hostName = "cloud.graven.dev";
https = true; https = true;
@ -15,7 +15,7 @@
dbtype = "pgsql"; dbtype = "pgsql";
dbuser = "nextcloud"; dbuser = "nextcloud";
dbhost = "/run/postgresql"; # nextcloud will add /.s.PGSQL.5432 by itself dbhost = "/run/postgresql"; # nextcloud will add /.s.PGSQL.5432 by itself
dbname = "nextcloud"; dbname = "nextcloud";
defaultPhoneRegion = "DK"; defaultPhoneRegion = "DK";
adminpassFile = builtins.toString config.secrets.files.nc_admin_pass.file; adminpassFile = builtins.toString config.secrets.files.nc_admin_pass.file;
adminuser = "root"; adminuser = "root";

1
config/hosts/wind/configuration.nix
View file

@ -4,6 +4,7 @@
imports = [ imports = [
./hardware-configuration.nix ./hardware-configuration.nix
../../common/configuration/nix.nix ../../common/configuration/nix.nix
../../common/configuration/documentation.nix
../../common/services/ssh.nix ../../common/services/ssh.nix
../../common/services/tailscale.nix ../../common/services/tailscale.nix
../../common/users.nix ../../common/users.nix

2
config/hosts/wind/hardware-configuration.nix
View file

@ -6,7 +6,7 @@
{ {
imports = imports =
[ (modulesPath + "/profiles/qemu-guest.nix") [ (modulesPath + "/profiles/qemu-guest.nix")
(modulesPath + "/profiles/minimal.nix") #(modulesPath + "/profiles/minimal.nix")
#(modulesPath + "/profiles/hardened.nix") #(modulesPath + "/profiles/hardened.nix")
]; ];

24
config/sources/nix/sources.json
View file

@ -5,10 +5,10 @@
"homepage": "https://github.com/nmattia/niv", "homepage": "https://github.com/nmattia/niv",
"owner": "nmattia", "owner": "nmattia",
"repo": "niv", "repo": "niv",
"rev": "723f0eeb969a730db3c30f977c2b66b9dce9fe4a", "rev": "7b76374b2b44152bfbf41fcb60162c2ce9182e7a",
"sha256": "0016l7230gd2kdh0g2w573r9a2krqb7x4ifcjhhsn4h1bwap7qr0", "sha256": "1ql11hzgxdahj9x0b20b70izcmayb22rinrg82kgp5z19bvpsgrp",
"type": "tarball", "type": "tarball",
"url": "https://github.com/nmattia/niv/archive/723f0eeb969a730db3c30f977c2b66b9dce9fe4a.tar.gz", "url": "https://github.com/nmattia/niv/archive/7b76374b2b44152bfbf41fcb60162c2ce9182e7a.tar.gz",
"url_template": "https://github.com/<owner>/<repo>/archive/<rev>.tar.gz" "url_template": "https://github.com/<owner>/<repo>/archive/<rev>.tar.gz"
}, },
"nixos-hardware": { "nixos-hardware": {
@ -17,10 +17,10 @@
"homepage": "", "homepage": "",
"owner": "NixOS", "owner": "NixOS",
"repo": "nixos-hardware", "repo": "nixos-hardware",
"rev": "72d53d51704295f1645d20384cd13aecc182f624", "rev": "8772491ed75f150f02552c60694e1beff9f46013",
"sha256": "0amvmkxp2x3sf1ya066wrsjn57q8vdhqi6fbsmyyvz04fpmq2m75", "sha256": "07m3i4g10ka2klmqfpqfxjfsnidk3cw53andqr33lxhy7rrvf6x2",
"type": "tarball", "type": "tarball",
"url": "https://github.com/NixOS/nixos-hardware/archive/72d53d51704295f1645d20384cd13aecc182f624.tar.gz", "url": "https://github.com/NixOS/nixos-hardware/archive/8772491ed75f150f02552c60694e1beff9f46013.tar.gz",
"url_template": "https://github.com/<owner>/<repo>/archive/<rev>.tar.gz" "url_template": "https://github.com/<owner>/<repo>/archive/<rev>.tar.gz"
}, },
"nixpkgs": { "nixpkgs": {
@ -29,10 +29,10 @@
"homepage": "", "homepage": "",
"owner": "NixOS", "owner": "NixOS",
"repo": "nixpkgs", "repo": "nixpkgs",
"rev": "679cadfdfed2b90311a247b2d6ef6dfd3d6cab73", "rev": "5b528f99f73c4fad127118a8c1126b5e003b01a9",
"sha256": "05iybhlry8sg6qdgf7qx1d8rvq43ph32qgpar53g8yja300x0swz", "sha256": "0pchhv9rrki70j0rrpj8pgj29cl7a595s6msh05ah5naasn3n17i",
"type": "tarball", "type": "tarball",
"url": "https://github.com/NixOS/nixpkgs/archive/679cadfdfed2b90311a247b2d6ef6dfd3d6cab73.tar.gz", "url": "https://github.com/NixOS/nixpkgs/archive/5b528f99f73c4fad127118a8c1126b5e003b01a9.tar.gz",
"url_template": "https://github.com/<owner>/<repo>/archive/<rev>.tar.gz" "url_template": "https://github.com/<owner>/<repo>/archive/<rev>.tar.gz"
}, },
"nixus": { "nixus": {
@ -41,10 +41,10 @@
"homepage": "", "homepage": "",
"owner": "Infinisil", "owner": "Infinisil",
"repo": "nixus", "repo": "nixus",
"rev": "b54dc6b332d4f26df1bed34c18ccec3d41e1ac40", "rev": "3d829c74b3dff74f211ef21d64def233532e9e5d",
"sha256": "120ip3549sm1z79p7fvm0kv6gn0v7yb6nr530q25xdz537gq3a3p", "sha256": "1vwg567jafcwaikkbdgckyirhnb0hd7r8x25j5wsb5a5563bpi65",
"type": "tarball", "type": "tarball",
"url": "https://github.com/Infinisil/nixus/archive/b54dc6b332d4f26df1bed34c18ccec3d41e1ac40.tar.gz", "url": "https://github.com/Infinisil/nixus/archive/3d829c74b3dff74f211ef21d64def233532e9e5d.tar.gz",
"url_template": "https://github.com/<owner>/<repo>/archive/<rev>.tar.gz" "url_template": "https://github.com/<owner>/<repo>/archive/<rev>.tar.gz"
} }
} }

7
shell.nix Normal file
View file

@ -0,0 +1,7 @@
{ pkgs ? import <nixpkgs> {} }:
pkgs.mkShell {
packages = with pkgs; [
niv
];
}