ma 1 omo: finish hw merge for omo

This commit is contained in:
makefu 2016-06-12 19:43:50 +02:00
parent 2f940d77f1
commit 3eee2d3c86
No known key found for this signature in database
GPG Key ID: 36F7711F3FC0F225
2 changed files with 29 additions and 24 deletions

View File

@ -5,9 +5,10 @@
{ config, pkgs, lib, ... }: { config, pkgs, lib, ... }:
let let
byid = dev: "/dev/disk/by-id/" + dev; byid = dev: "/dev/disk/by-id/" + dev;
keyFile = "/dev/disk/by-id/usb-Verbatim_STORE_N_GO_070B3CEE0B223954-0:0"; keyFile = byid "usb-Verbatim_STORE_N_GO_070B3CEE0B223954-0:0";
rootDisk = byid "ata-INTEL_SSDSA2M080G2GC_CVPO003402PB080BGN"; rootDisk = byid "ata-SanDisk_SD8SNAT128G1122_162099420904";
homePartition = byid "ata-INTEL_SSDSA2M080G2GC_CVPO003402PB080BGN-part3"; rootPartition = byid "ata-SanDisk_SD8SNAT128G1122_162099420904-part2";
primaryInterface = "enp1s0";
# cryptsetup luksFormat $dev --cipher aes-xts-plain64 -s 512 -h sha512 # cryptsetup luksFormat $dev --cipher aes-xts-plain64 -s 512 -h sha512
# cryptsetup luksAddKey $dev tmpkey # cryptsetup luksAddKey $dev tmpkey
# cryptsetup luksOpen $dev crypt0 --key-file tmpkey --keyfile-size=4096 # cryptsetup luksOpen $dev crypt0 --key-file tmpkey --keyfile-size=4096
@ -15,14 +16,14 @@ let
# omo Chassis: # omo Chassis:
# __FRONT_ # __FRONT_
# |* d2 | # |* d0 |
# | | # | |
# |* d3 | # |* d3 |
# | | # | |
# |* d0 | # |* d3 |
# | | # | |
# |* d1 |
# |* | # |* |
# |* d2 |
# | * r0 | # | * r0 |
# |_______| # |_______|
cryptDisk0 = byid "ata-ST2000DM001-1CH164_Z240XTT6"; cryptDisk0 = byid "ata-ST2000DM001-1CH164_Z240XTT6";
@ -38,27 +39,31 @@ in {
[ [
../. ../.
# TODO: unlock home partition via ssh # TODO: unlock home partition via ssh
../2configs/fs/single-partition-ext4.nix ../2configs/fs/sda-crypto-root.nix
../2configs/zsh-user.nix ../2configs/zsh-user.nix
../2configs/exim-retiolum.nix ../2configs/exim-retiolum.nix
../2configs/smart-monitor.nix ../2configs/smart-monitor.nix
../2configs/mail-client.nix ../2configs/mail-client.nix
../2configs/share-user-sftp.nix #../2configs/graphite-standalone.nix
../2configs/graphite-standalone.nix #../2configs/share-user-sftp.nix
../2configs/omo-share.nix ../2configs/omo-share.nix
## as long as pyload is not in nixpkgs:
# docker run -d -v /var/lib/pyload:/opt/pyload/pyload-config -v /media/crypt0/pyload:/opt/pyload/Downloads --name pyload --restart=always -p 8112:8000 -P writl/pyload
]; ];
krebs.retiolum.enable = true; krebs.retiolum.enable = true;
networking.firewall.trustedInterfaces = [ "enp3s0" ]; networking.firewall.trustedInterfaces = [ primaryInterface ];
# udp:137 udp:138 tcp:445 tcp:139 - samba, allowed in local net # udp:137 udp:138 tcp:445 tcp:139 - samba, allowed in local net
# tcp:80 - nginx for sharing files # tcp:80 - nginx for sharing files
# tcp:655 udp:655 - tinc # tcp:655 udp:655 - tinc
# tcp:8111 - graphite # tcp:8111 - graphite
# tcp:8112 - pyload
# tcp:9090 - sabnzbd # tcp:9090 - sabnzbd
# tcp:9200 - elasticsearch # tcp:9200 - elasticsearch
# tcp:5601 - kibana # tcp:5601 - kibana
networking.firewall.allowedUDPPorts = [ 655 ]; networking.firewall.allowedUDPPorts = [ 655 ];
networking.firewall.allowedTCPPorts = [ 80 655 5601 8111 9200 9090 ]; networking.firewall.allowedTCPPorts = [ 80 655 5601 8111 8112 9200 9090 ];
# services.openssh.allowSFTP = false; # services.openssh.allowSFTP = false;
@ -66,6 +71,9 @@ in {
services.sabnzbd.enable = true; services.sabnzbd.enable = true;
systemd.services.sabnzbd.environment.SSL_CERT_FILE = "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt"; systemd.services.sabnzbd.environment.SSL_CERT_FILE = "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt";
virtualisation.docker.enable = true;
# HDD Array stuff # HDD Array stuff
services.smartd.devices = builtins.map (x: { device = x; }) allDisks; services.smartd.devices = builtins.map (x: { device = x; }) allDisks;
@ -76,15 +84,11 @@ in {
disks = map toMapper [ 0 1 ]; disks = map toMapper [ 0 1 ];
parity = toMapper 2; parity = toMapper 2;
}; };
fileSystems = let fileSystems = let
cryptMount = name: cryptMount = name:
{ "/media/${name}" = { device = "/dev/mapper/${name}"; fsType = "xfs"; };}; { "/media/${name}" = { device = "/dev/mapper/${name}"; fsType = "xfs"; };};
in { in cryptMount "crypt0"
"/home" = {
device = "/dev/mapper/home";
fsType = "ext4";
};
} // cryptMount "crypt0"
// cryptMount "crypt1" // cryptMount "crypt1"
// cryptMount "crypt2"; // cryptMount "crypt2";
@ -101,15 +105,16 @@ in {
usbkey = name: device: { usbkey = name: device: {
inherit name device keyFile; inherit name device keyFile;
keyFileSize = 4096; keyFileSize = 4096;
allowDiscards = true;
}; };
in [ in [
(usbkey "home" homePartition) (usbkey "luksroot" rootPartition)
(usbkey "crypt0" cryptDisk0) (usbkey "crypt0" cryptDisk0)
(usbkey "crypt1" cryptDisk1) (usbkey "crypt1" cryptDisk1)
(usbkey "crypt2" cryptDisk2) (usbkey "crypt2" cryptDisk2)
]; ];
}; };
loader.grub.device = rootDisk; loader.grub.device = lib.mkForce rootDisk;
initrd.availableKernelModules = [ initrd.availableKernelModules = [
"ahci" "ahci"
@ -121,12 +126,12 @@ in {
"usbhid" "usbhid"
]; ];
kernelModules = [ "kvm-amd" ]; kernelModules = [ "kvm-intel" ];
extraModulePackages = [ ]; extraModulePackages = [ ];
}; };
hardware.enableAllFirmware = true; hardware.enableAllFirmware = true;
hardware.cpu.amd.updateMicrocode = true; hardware.cpu.intel.updateMicrocode = true;
zramSwap.enable = true; zramSwap.enable = true;

View File

@ -1,16 +1,16 @@
{ config, lib, pkgs, ... }: { config, lib, pkgs, ... }:
# sda: bootloader grub2 # sda: bootloader grub2
# sda1: boot ext4 (label nixboot) # sda1: boot ext4 (label nixboot) - must be unlocked on boot if required:
# boot.initrd.luks.devices = [ { name = "luksroot"; device = "/dev/sda2"; allowDiscards=true; }];
# sda2: cryptoluks -> ext4 # sda2: cryptoluks -> ext4
with config.krebs.lib; with config.krebs.lib;
{ {
boot = { boot = {
loader.grub.enable = true; loader.grub.enable = true;
loader.grub.version = 2; loader.grub.version = 2;
loader.grub.device = "/dev/sda"; loader.grub.device = lib.mkDefault "/dev/sda";
initrd.luks.devices = [ { name = "luksroot"; device = "/dev/sda2"; allowDiscards=true; }];
initrd.luks.cryptoModules = ["aes" "sha512" "sha1" "xts" ]; initrd.luks.cryptoModules = ["aes" "sha512" "sha1" "xts" ];
initrd.availableKernelModules = ["xhci_hcd" "ehci_pci" "ahci" "usb_storage" ]; initrd.availableKernelModules = ["xhci_hcd" "ehci_pci" "ahci" "usb_storage" ];
}; };