stockholm/makefu/1systems/omo/config.nix

205 lines
6.5 KiB
Nix
Raw Normal View History

2015-12-16 11:06:44 +00:00
# Edit this configuration file to define what should be installed on
# your system. Help is available in the configuration.nix(5) man page
# and in the NixOS manual (accessible by running nixos-help).
2016-01-05 15:07:13 +00:00
{ config, pkgs, lib, ... }:
let
2016-07-26 22:05:59 +00:00
toMapper = id: "/media/crypt${builtins.toString id}";
2016-01-05 15:07:13 +00:00
byid = dev: "/dev/disk/by-id/" + dev;
2016-06-12 17:43:50 +00:00
keyFile = byid "usb-Verbatim_STORE_N_GO_070B3CEE0B223954-0:0";
rootDisk = byid "ata-SanDisk_SD8SNAT128G1122_162099420904";
rootPartition = byid "ata-SanDisk_SD8SNAT128G1122_162099420904-part2";
primaryInterface = "enp1s0";
# cryptsetup luksFormat $dev --cipher aes-xts-plain64 -s 512 -h sha512
# cryptsetup luksAddKey $dev tmpkey
2016-03-08 17:35:32 +00:00
# cryptsetup luksOpen $dev crypt0 --key-file tmpkey --keyfile-size=4096
2016-03-16 07:43:20 +00:00
# mkfs.xfs /dev/mapper/crypt0 -L crypt0
2016-03-05 09:59:09 +00:00
# omo Chassis:
# __FRONT_
2016-06-12 17:43:50 +00:00
# |* d0 |
2016-03-05 09:59:09 +00:00
# | |
# |* d3 |
# | |
2016-06-12 17:43:50 +00:00
# |* d3 |
2016-03-05 09:59:09 +00:00
# | |
# |* |
2016-06-12 17:43:50 +00:00
# |* d2 |
2016-03-05 09:59:09 +00:00
# | * r0 |
# |_______|
2016-01-05 15:07:13 +00:00
cryptDisk0 = byid "ata-ST2000DM001-1CH164_Z240XTT6";
cryptDisk1 = byid "ata-TP02000GB_TPW151006050068";
2016-03-08 17:35:32 +00:00
cryptDisk2 = byid "ata-ST4000DM000-1F2168_Z303HVSG";
# cryptDisk3 = byid "ata-WDC_WD20EARS-00MVWB0_WD-WMAZA1786907";
2016-01-05 15:07:13 +00:00
# all physical disks
2016-03-16 07:43:20 +00:00
# TODO callPackage ../3modules/MonitorDisks { disks = allDisks }
2016-07-26 22:05:59 +00:00
dataDisks = [ cryptDisk0 cryptDisk1 cryptDisk2 ];
allDisks = [ rootDisk ] ++ dataDisks;
2016-01-05 15:07:13 +00:00
in {
2015-12-16 11:06:44 +00:00
imports =
2016-01-03 05:07:35 +00:00
[
<stockholm/makefu>
2016-01-03 05:07:35 +00:00
# TODO: unlock home partition via ssh
<stockholm/makefu/2configs/fs/sda-crypto-root.nix>
<stockholm/makefu/2configs/zsh-user.nix>
<stockholm/makefu/2configs/backup.nix>
<stockholm/makefu/2configs/exim-retiolum.nix>
<stockholm/makefu/2configs/smart-monitor.nix>
<stockholm/makefu/2configs/mail-client.nix>
# <stockholm/makefu/2configs/disable_v6.nix>
#<stockholm/makefu/2configs/graphite-standalone.nix>
#<stockholm/makefu/2configs/share-user-sftp.nix>
<stockholm/makefu/2configs/share/omo.nix>
<stockholm/makefu/2configs/tinc/retiolum.nix>
2017-05-25 21:19:36 +00:00
# Logging
<stockholm/makefu/2configs/stats/server.nix #influx + grafana>
<stockholm/makefu/2configs/stats/client.nix>
<stockholm/makefu/2configs/stats/external/aralast.nix # logs to influx>
2017-05-02 12:04:39 +00:00
# services
<stockholm/makefu/2configs/syncthing.nix>
<stockholm/makefu/2configs/mqtt.nix>
# <stockholm/makefu/2configs/logging/central-logging-client.nix>
2017-02-04 13:35:29 +00:00
# <stockholm/makefu/2configs/torrent.nix>
# <stockholm/makefu/2configs/elchos/search.nix>
# <stockholm/makefu/2configs/elchos/log.nix>
# <stockholm/makefu/2configs/elchos/irc-token.nix>
2016-06-12 17:43:50 +00:00
## as long as pyload is not in nixpkgs:
# docker run -d -v /var/lib/pyload:/opt/pyload/pyload-config -v /media/crypt0/pyload:/opt/pyload/Downloads --name pyload --restart=always -p 8112:8000 -P writl/pyload
2015-12-16 11:06:44 +00:00
];
2016-08-22 16:43:38 +00:00
makefu.full-populate = true;
makefu.server.primary-itf = primaryInterface;
2016-09-02 10:47:34 +00:00
krebs.rtorrent = {
downloadDir = lib.mkForce "/media/crypt0/torrent";
extraConfig = ''
upload_rate = 200
'';
2016-08-22 16:43:38 +00:00
};
users.groups.share = {
2016-10-20 18:54:38 +00:00
gid = (import <stockholm/lib>).genid "share";
2016-08-22 16:43:38 +00:00
members = [ "makefu" "misa" ];
};
2016-06-12 17:43:50 +00:00
networking.firewall.trustedInterfaces = [ primaryInterface ];
2016-01-27 21:20:32 +00:00
# udp:137 udp:138 tcp:445 tcp:139 - samba, allowed in local net
# tcp:80 - nginx for sharing files
# tcp:655 udp:655 - tinc
2016-04-03 19:52:16 +00:00
# tcp:8111 - graphite
2016-06-12 17:43:50 +00:00
# tcp:8112 - pyload
2016-04-03 19:52:16 +00:00
# tcp:9090 - sabnzbd
# tcp:9200 - elasticsearch
# tcp:5601 - kibana
2016-01-27 21:20:32 +00:00
networking.firewall.allowedUDPPorts = [ 655 ];
2016-06-12 17:43:50 +00:00
networking.firewall.allowedTCPPorts = [ 80 655 5601 8111 8112 9200 9090 ];
2016-01-27 21:20:32 +00:00
2016-01-14 11:42:52 +00:00
# services.openssh.allowSFTP = false;
2016-01-08 02:37:38 +00:00
# copy config from <secrets/sabnzbd.ini> to /var/lib/sabnzbd/
services.sabnzbd.enable = true;
systemd.services.sabnzbd.environment.SSL_CERT_FILE = "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt";
2016-06-12 17:43:50 +00:00
virtualisation.docker.enable = true;
2016-07-28 11:02:06 +00:00
makefu.ps3netsrv = {
enable = true;
servedir = "/media/cryptX/emu/ps3";
};
2016-01-08 02:37:38 +00:00
# HDD Array stuff
2016-01-05 15:07:13 +00:00
services.smartd.devices = builtins.map (x: { device = x; }) allDisks;
2016-01-08 02:37:38 +00:00
2016-07-26 22:05:59 +00:00
makefu.snapraid = {
enable = true;
disks = map toMapper [ 0 1 ];
parity = toMapper 2;
2016-01-03 05:07:35 +00:00
};
2016-06-12 17:43:50 +00:00
2016-07-26 22:05:59 +00:00
# TODO create folders in /media
system.activationScripts.createCryptFolders = ''
${lib.concatMapStringsSep "\n"
(d: "install -m 755 -d " + (toMapper d) )
[ 0 1 2 "X" ]}
'';
environment.systemPackages = with pkgs;[
2016-07-30 16:43:21 +00:00
mergerfs # hard requirement for mount
wol # wake up filepimp
2016-09-02 10:47:34 +00:00
f3
2016-07-30 16:43:21 +00:00
];
fileSystems = let
cryptMount = name:
{ "/media/${name}" = { device = "/dev/mapper/${name}"; fsType = "xfs"; };};
2016-06-12 17:43:50 +00:00
in cryptMount "crypt0"
// cryptMount "crypt1"
2016-07-26 22:05:59 +00:00
// cryptMount "crypt2"
// { "/media/cryptX" = {
device = (lib.concatMapStringsSep ":" (d: (toMapper d)) [ 0 1 2 ]);
fsType = "mergerfs";
noCheck = true;
options = [ "defaults" "allow_other" "nofail" "nonempty" ];
2016-07-26 22:05:59 +00:00
};
};
2016-01-05 15:07:13 +00:00
powerManagement.powerUpCommands = lib.concatStrings (map (disk: ''
${pkgs.hdparm}/sbin/hdparm -S 100 ${disk}
${pkgs.hdparm}/sbin/hdparm -B 127 ${disk}
${pkgs.hdparm}/sbin/hdparm -y ${disk}
'') allDisks);
2016-01-08 02:37:38 +00:00
2016-01-27 21:20:32 +00:00
# crypto unlocking
2015-12-16 11:06:44 +00:00
boot = {
2016-01-03 05:07:35 +00:00
initrd.luks = {
2016-01-05 15:07:13 +00:00
devices = let
usbkey = name: device: {
inherit name device keyFile;
2016-01-03 05:07:35 +00:00
keyFileSize = 4096;
2016-06-12 17:43:50 +00:00
allowDiscards = true;
2016-01-05 15:07:13 +00:00
};
in [
2016-06-12 17:43:50 +00:00
(usbkey "luksroot" rootPartition)
2016-01-05 15:07:13 +00:00
(usbkey "crypt0" cryptDisk0)
(usbkey "crypt1" cryptDisk1)
2016-03-08 17:35:32 +00:00
(usbkey "crypt2" cryptDisk2)
2016-01-03 05:07:35 +00:00
];
};
2016-06-12 17:43:50 +00:00
loader.grub.device = lib.mkForce rootDisk;
2015-12-16 11:06:44 +00:00
initrd.availableKernelModules = [
"ahci"
2016-01-03 05:07:35 +00:00
"ohci_pci"
2015-12-16 11:06:44 +00:00
"ehci_pci"
2016-01-03 05:07:35 +00:00
"pata_atiixp"
"firewire_ohci"
"usb_storage"
"usbhid"
2015-12-16 11:06:44 +00:00
];
2016-06-12 17:43:50 +00:00
kernelModules = [ "kvm-intel" ];
2015-12-16 11:06:44 +00:00
extraModulePackages = [ ];
};
2016-07-11 18:45:34 +00:00
users.users.misa = {
uid = 9002;
name = "misa";
};
2017-05-25 21:19:36 +00:00
# hardware.enableAllFirmware = true;
hardware.enableRedistributableFirmware = true;
2016-06-12 17:43:50 +00:00
hardware.cpu.intel.updateMicrocode = true;
2015-12-16 11:06:44 +00:00
2016-01-08 02:37:38 +00:00
zramSwap.enable = true;
2016-01-03 05:07:35 +00:00
2017-03-24 12:03:46 +00:00
krebs.Reaktor.reaktor = {
nickname = "Reaktor|bot";
channels = [ "#krebs" "#shackspace" "#binaergewitter" ];
plugins = with pkgs.ReaktorPlugins;[
titlebot
# stockholm-issue
nixos-version
shack-correct
sed-plugin
random-emoji ];
};
2016-01-27 21:00:50 +00:00
krebs.build.host = config.krebs.hosts.omo;
2015-12-16 11:06:44 +00:00
}