Merge remote-tracking branch 'prism/master'
This commit is contained in:
commit
45c39cddad
@ -16,6 +16,18 @@
|
|||||||
krebs.ci = {
|
krebs.ci = {
|
||||||
enable = true;
|
enable = true;
|
||||||
repos = {
|
repos = {
|
||||||
|
disko.urls = [
|
||||||
|
"http://cgit.gum.r/disko"
|
||||||
|
"http://cgit.hotdog.r/disko"
|
||||||
|
"http://cgit.ni.r/disko"
|
||||||
|
"http://cgit.prism.r/disko"
|
||||||
|
];
|
||||||
|
nix_writers.urls = [
|
||||||
|
"http://cgit.hotdog.r/nix-writers"
|
||||||
|
"http://cgit.ni.r/nix-writers"
|
||||||
|
"http://cgit.prism.r/nix-writers"
|
||||||
|
"https://git.ingolf-wagner.de/krebs/nix-writers.git"
|
||||||
|
];
|
||||||
stockholm.urls = [
|
stockholm.urls = [
|
||||||
"http://cgit.enklave.r/stockholm"
|
"http://cgit.enklave.r/stockholm"
|
||||||
"http://cgit.gum.r/stockholm"
|
"http://cgit.gum.r/stockholm"
|
||||||
|
@ -26,8 +26,8 @@ let
|
|||||||
|
|
||||||
hostname = config.networking.hostName;
|
hostname = config.networking.hostName;
|
||||||
getJobs = pkgs.writeDash "get_jobs" ''
|
getJobs = pkgs.writeDash "get_jobs" ''
|
||||||
nix-build --no-out-link ./ci.nix 2>&1 > /dev/null
|
nix-build --no-out-link --quiet -Q ./ci.nix > /dev/null
|
||||||
nix-instantiate --eval --strict --json ./ci.nix
|
nix-instantiate --quiet -Q --eval --strict --json ./ci.nix
|
||||||
'';
|
'';
|
||||||
|
|
||||||
imp = {
|
imp = {
|
||||||
@ -53,9 +53,12 @@ let
|
|||||||
nameValuePair name ''
|
nameValuePair name ''
|
||||||
sched.append(
|
sched.append(
|
||||||
schedulers.SingleBranchScheduler(
|
schedulers.SingleBranchScheduler(
|
||||||
change_filter=util.ChangeFilter(branch_re=".*"),
|
change_filter=util.ChangeFilter(
|
||||||
|
branch_re=".*",
|
||||||
|
project='${name}',
|
||||||
|
),
|
||||||
treeStableTimer=60,
|
treeStableTimer=60,
|
||||||
name="build-all-branches",
|
name="${name}-all-branches",
|
||||||
builderNames=[
|
builderNames=[
|
||||||
"${name}",
|
"${name}",
|
||||||
]
|
]
|
||||||
@ -97,6 +100,10 @@ let
|
|||||||
command=[
|
command=[
|
||||||
new_steps[new_step]
|
new_steps[new_step]
|
||||||
],
|
],
|
||||||
|
env={
|
||||||
|
"NIX_REMOTE": "daemon",
|
||||||
|
"NIX_PATH": "secrets=/var/src/stockholm/null:/var/src",
|
||||||
|
},
|
||||||
timeout=90001,
|
timeout=90001,
|
||||||
workdir='build', # TODO figure out why we need this?
|
workdir='build', # TODO figure out why we need this?
|
||||||
)])
|
)])
|
||||||
@ -121,7 +128,7 @@ let
|
|||||||
},
|
},
|
||||||
name="get_steps",
|
name="get_steps",
|
||||||
command=["${getJobs}"],
|
command=["${getJobs}"],
|
||||||
property="steps_json"
|
extract_fn=lambda rc, stdout, stderr: { 'steps_json': stdout },
|
||||||
))
|
))
|
||||||
f_${name}.addStep(StepToStartMoreSteps(command=["echo"])) # TODO remove dummy command from here
|
f_${name}.addStep(StepToStartMoreSteps(command=["echo"])) # TODO remove dummy command from here
|
||||||
|
|
||||||
|
@ -11,6 +11,8 @@ with (import <stockholm/lib>);
|
|||||||
|
|
||||||
environment.systemPackages = with pkgs; [
|
environment.systemPackages = with pkgs; [
|
||||||
ag
|
ag
|
||||||
|
brain
|
||||||
|
dic
|
||||||
nmap
|
nmap
|
||||||
git-preview
|
git-preview
|
||||||
];
|
];
|
||||||
|
@ -74,14 +74,8 @@ in {
|
|||||||
<stockholm/makefu/2configs/syncthing.nix>
|
<stockholm/makefu/2configs/syncthing.nix>
|
||||||
|
|
||||||
# <stockholm/makefu/2configs/opentracker.nix>
|
# <stockholm/makefu/2configs/opentracker.nix>
|
||||||
<stockholm/makefu/2configs/hub.nix>
|
<stockholm/makefu/2configs/dcpp/hub.nix>
|
||||||
{ # ncdc
|
<stockholm/makefu/2configs/dcpp/client.nix>
|
||||||
environment.systemPackages = [ pkgs.ncdc ];
|
|
||||||
networking.firewall = {
|
|
||||||
allowedUDPPorts = [ 51411 ];
|
|
||||||
allowedTCPPorts = [ 51411 ];
|
|
||||||
};
|
|
||||||
}
|
|
||||||
|
|
||||||
<stockholm/makefu/2configs/stats/client.nix>
|
<stockholm/makefu/2configs/stats/client.nix>
|
||||||
# <stockholm/makefu/2configs/logging/client.nix>
|
# <stockholm/makefu/2configs/logging/client.nix>
|
||||||
@ -103,55 +97,7 @@ in {
|
|||||||
# locations."/".proxyPass = "http://localhost:5000";
|
# locations."/".proxyPass = "http://localhost:5000";
|
||||||
# };
|
# };
|
||||||
#}
|
#}
|
||||||
{ # wireguard server
|
<stockholm/makefu/2configs/wireguard/server.nix>
|
||||||
|
|
||||||
# opkg install wireguard luci-proto-wireguard
|
|
||||||
|
|
||||||
# TODO: networking.nat
|
|
||||||
|
|
||||||
# boot.kernel.sysctl."net.ipv4.ip_forward" = 1;
|
|
||||||
# conf.all.proxy_arp =1
|
|
||||||
networking.firewall = {
|
|
||||||
allowedUDPPorts = [ 51820 ];
|
|
||||||
extraCommands = ''
|
|
||||||
iptables -t nat -A POSTROUTING -s 10.244.0.0/24 -o ${ext-if} -j MASQUERADE
|
|
||||||
'';
|
|
||||||
};
|
|
||||||
|
|
||||||
networking.wireguard.interfaces.wg0 = {
|
|
||||||
ips = [ "10.244.0.1/24" ];
|
|
||||||
listenPort = 51820;
|
|
||||||
privateKeyFile = (toString <secrets>) + "/wireguard.key";
|
|
||||||
allowedIPsAsRoutes = true;
|
|
||||||
peers = [
|
|
||||||
{
|
|
||||||
# x
|
|
||||||
allowedIPs = [ "10.244.0.2/32" ];
|
|
||||||
publicKey = "fe5smvKVy5GAn7EV4w4tav6mqIAKhGWQotm7dRuRt1g=";
|
|
||||||
}
|
|
||||||
{
|
|
||||||
# vbob
|
|
||||||
allowedIPs = [ "10.244.0.3/32" ];
|
|
||||||
publicKey = "Lju7EsCu1OWXhkhdNR7c/uiN60nr0TUPHQ+s8ULPQTw=";
|
|
||||||
}
|
|
||||||
{
|
|
||||||
# x-test
|
|
||||||
allowedIPs = [ "10.244.0.4/32" ];
|
|
||||||
publicKey = "vZ/AJpfDLJyU3DzvYeW70l4FNziVgSTumA89wGHG7XY=";
|
|
||||||
}
|
|
||||||
{
|
|
||||||
# work-router
|
|
||||||
allowedIPs = [ "10.244.0.5/32" ];
|
|
||||||
publicKey = "QJMwwYu/92koCASbHnR/vqe/rN00EV6/o7BGwLockDw=";
|
|
||||||
}
|
|
||||||
{
|
|
||||||
# workr
|
|
||||||
allowedIPs = [ "10.244.0.6/32" ];
|
|
||||||
publicKey = "OFhCF56BrV9tjqW1sxqXEKH/GdqamUT1SqZYSADl5GA=";
|
|
||||||
}
|
|
||||||
];
|
|
||||||
};
|
|
||||||
}
|
|
||||||
{ # iperf3
|
{ # iperf3
|
||||||
networking.firewall.allowedUDPPorts = [ 5201 ];
|
networking.firewall.allowedUDPPorts = [ 5201 ];
|
||||||
networking.firewall.allowedTCPPorts = [ 5201 ];
|
networking.firewall.allowedTCPPorts = [ 5201 ];
|
||||||
|
23
makefu/1systems/hardware/tsp-disk.json
Normal file
23
makefu/1systems/hardware/tsp-disk.json
Normal file
@ -0,0 +1,23 @@
|
|||||||
|
{
|
||||||
|
"type": "devices",
|
||||||
|
"content": {
|
||||||
|
"sda": {
|
||||||
|
"type": "table",
|
||||||
|
"format": "msdos",
|
||||||
|
"partitions": [
|
||||||
|
{ "type": "partition",
|
||||||
|
"part-type": "primary",
|
||||||
|
"start": "1M",
|
||||||
|
"end": "100%",
|
||||||
|
"bootable": true,
|
||||||
|
"content": {
|
||||||
|
"type": "filesystem",
|
||||||
|
"format": "ext4",
|
||||||
|
"mountpoint": "/"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
@ -4,52 +4,17 @@
|
|||||||
|
|
||||||
{ config, pkgs, lib, ... }:
|
{ config, pkgs, lib, ... }:
|
||||||
let
|
let
|
||||||
toMapper = id: "/media/crypt${builtins.toString id}";
|
primaryInterface = config.makefu.server.primary-itf;
|
||||||
byid = dev: "/dev/disk/by-id/" + dev;
|
|
||||||
keyFile = byid "usb-Verbatim_STORE_N_GO_070B3CEE0B223954-0:0";
|
|
||||||
rootDisk = byid "ata-SanDisk_SD8SNAT128G1122_162099420904";
|
|
||||||
rootPartition = byid "ata-SanDisk_SD8SNAT128G1122_162099420904-part2";
|
|
||||||
primaryInterface = "enp2s0";
|
|
||||||
firetv = "192.168.1.238";
|
|
||||||
# cryptsetup luksFormat $dev --cipher aes-xts-plain64 -s 512 -h sha512
|
|
||||||
# cryptsetup luksAddKey $dev tmpkey
|
|
||||||
# cryptsetup luksOpen $dev crypt0 --key-file tmpkey --keyfile-size=4096
|
|
||||||
# mkfs.xfs /dev/mapper/crypt0 -L crypt0
|
|
||||||
|
|
||||||
# omo Chassis:
|
|
||||||
# __FRONT_
|
|
||||||
# |* d0 |
|
|
||||||
# | |
|
|
||||||
# |* d1 |
|
|
||||||
# | |
|
|
||||||
# |* d3 |
|
|
||||||
# | |
|
|
||||||
# |* |
|
|
||||||
# |* d2 |
|
|
||||||
# | * |
|
|
||||||
# | * |
|
|
||||||
# |_______|
|
|
||||||
# cryptDisk0 = byid "ata-ST2000DM001-1CH164_Z240XTT6";
|
|
||||||
cryptDisk0 = byid "ata-ST8000DM004-2CX188_ZCT01PLV";
|
|
||||||
cryptDisk1 = byid "ata-TP02000GB_TPW151006050068";
|
|
||||||
cryptDisk2 = byid "ata-ST4000DM000-1F2168_Z303HVSG";
|
|
||||||
cryptDisk3 = byid "ata-ST8000DM004-2CX188_ZCT01SG4";
|
|
||||||
# cryptDisk3 = byid "ata-WDC_WD20EARS-00MVWB0_WD-WMAZA1786907";
|
|
||||||
# all physical disks
|
|
||||||
|
|
||||||
# TODO callPackage ../3modules/MonitorDisks { disks = allDisks }
|
|
||||||
dataDisks = [ cryptDisk0 cryptDisk1 cryptDisk2 cryptDisk3 ];
|
|
||||||
allDisks = [ rootDisk ] ++ dataDisks;
|
|
||||||
in {
|
in {
|
||||||
imports =
|
imports =
|
||||||
[
|
[
|
||||||
|
#./hw/omo.nix
|
||||||
|
./hw/tsp.nix
|
||||||
<stockholm/makefu>
|
<stockholm/makefu>
|
||||||
# TODO: unlock home partition via ssh
|
|
||||||
<stockholm/makefu/2configs/fs/sda-crypto-root.nix>
|
|
||||||
<stockholm/makefu/2configs/zsh-user.nix>
|
<stockholm/makefu/2configs/zsh-user.nix>
|
||||||
<stockholm/makefu/2configs/backup.nix>
|
<stockholm/makefu/2configs/backup.nix>
|
||||||
<stockholm/makefu/2configs/exim-retiolum.nix>
|
<stockholm/makefu/2configs/exim-retiolum.nix>
|
||||||
<stockholm/makefu/2configs/smart-monitor.nix>
|
# <stockholm/makefu/2configs/smart-monitor.nix>
|
||||||
<stockholm/makefu/2configs/mail-client.nix>
|
<stockholm/makefu/2configs/mail-client.nix>
|
||||||
<stockholm/makefu/2configs/mosh.nix>
|
<stockholm/makefu/2configs/mosh.nix>
|
||||||
<stockholm/makefu/2configs/tools/mobility.nix>
|
<stockholm/makefu/2configs/tools/mobility.nix>
|
||||||
@ -78,6 +43,7 @@ in {
|
|||||||
<stockholm/makefu/2configs/deployment/google-muell.nix>
|
<stockholm/makefu/2configs/deployment/google-muell.nix>
|
||||||
<stockholm/makefu/2configs/virtualisation/docker.nix>
|
<stockholm/makefu/2configs/virtualisation/docker.nix>
|
||||||
<stockholm/makefu/2configs/bluetooth-mpd.nix>
|
<stockholm/makefu/2configs/bluetooth-mpd.nix>
|
||||||
|
<stockholm/makefu/2configs/deployment/homeautomation>
|
||||||
{
|
{
|
||||||
hardware.pulseaudio.systemWide = true;
|
hardware.pulseaudio.systemWide = true;
|
||||||
makefu.mpd.musicDirectory = "/media/cryptX/music";
|
makefu.mpd.musicDirectory = "/media/cryptX/music";
|
||||||
@ -99,74 +65,9 @@ in {
|
|||||||
|
|
||||||
# Temporary:
|
# Temporary:
|
||||||
# <stockholm/makefu/2configs/temp/rst-issue.nix>
|
# <stockholm/makefu/2configs/temp/rst-issue.nix>
|
||||||
{ # ncdc
|
|
||||||
environment.systemPackages = [ pkgs.ncdc ];
|
|
||||||
networking.firewall = {
|
|
||||||
allowedUDPPorts = [ 51411 ];
|
|
||||||
allowedTCPPorts = [ 51411 ];
|
|
||||||
};
|
|
||||||
}
|
|
||||||
{
|
|
||||||
systemd.services.firetv = {
|
|
||||||
wantedBy = [ "multi-user.target" ];
|
|
||||||
serviceConfig = {
|
|
||||||
User = "nobody";
|
|
||||||
ExecStart = "${pkgs.python-firetv}/bin/firetv-server -d ${firetv}:5555";
|
|
||||||
};
|
|
||||||
};
|
|
||||||
nixpkgs.config.permittedInsecurePackages = [
|
|
||||||
"homeassistant-0.65.5"
|
|
||||||
];
|
|
||||||
services.home-assistant = {
|
|
||||||
config = {
|
|
||||||
homeassistant = {
|
|
||||||
name = "Home"; time_zone = "Europe/Berlin";
|
|
||||||
latitude = "48.7687";
|
|
||||||
longitude = "9.2478";
|
|
||||||
};
|
|
||||||
media_player = [
|
|
||||||
{ platform = "kodi";
|
|
||||||
host = firetv;
|
|
||||||
}
|
|
||||||
{ platform = "firetv";
|
|
||||||
# assumes python-firetv running
|
|
||||||
}
|
|
||||||
];
|
|
||||||
sensor = [
|
|
||||||
{ platform = "luftdaten";
|
|
||||||
name = "Ditzingen";
|
|
||||||
sensorid = "663";
|
|
||||||
monitored_conditions = [ "P1" "P2" ];
|
|
||||||
}
|
|
||||||
# https://www.home-assistant.io/cookbook/automation_for_rainy_days/
|
|
||||||
{ platform = "darksky";
|
|
||||||
api_key = "c73619e6ea79e553a585be06aacf3679";
|
|
||||||
language = "de";
|
|
||||||
monitored_conditions = [ "summary" "icon"
|
|
||||||
"nearest_storm_distance" "precip_probability"
|
|
||||||
"precip_intensity"
|
|
||||||
"temperature" # "temperature_high" "temperature_low"
|
|
||||||
"hourly_summary"
|
|
||||||
"uv_index" ];
|
|
||||||
units = "si" ;
|
|
||||||
update_interval = {
|
|
||||||
days = 0;
|
|
||||||
hours = 0;
|
|
||||||
minutes = 10;
|
|
||||||
seconds = 0;
|
|
||||||
};
|
|
||||||
}
|
|
||||||
];
|
|
||||||
frontend = { };
|
|
||||||
http = { };
|
|
||||||
};
|
|
||||||
enable = true;
|
|
||||||
#configDir = "/var/lib/hass";
|
|
||||||
};
|
|
||||||
}
|
|
||||||
];
|
];
|
||||||
makefu.full-populate = true;
|
makefu.full-populate = true;
|
||||||
makefu.server.primary-itf = primaryInterface;
|
|
||||||
krebs.rtorrent = {
|
krebs.rtorrent = {
|
||||||
downloadDir = lib.mkForce "/media/cryptX/torrent";
|
downloadDir = lib.mkForce "/media/cryptX/torrent";
|
||||||
extraConfig = ''
|
extraConfig = ''
|
||||||
@ -178,18 +79,6 @@ in {
|
|||||||
members = [ "makefu" "misa" ];
|
members = [ "makefu" "misa" ];
|
||||||
};
|
};
|
||||||
networking.firewall.trustedInterfaces = [ primaryInterface ];
|
networking.firewall.trustedInterfaces = [ primaryInterface ];
|
||||||
# udp:137 udp:138 tcp:445 tcp:139 - samba, allowed in local net
|
|
||||||
# tcp:80 - nginx for sharing files
|
|
||||||
# tcp:655 udp:655 - tinc
|
|
||||||
# tcp:8111 - graphite
|
|
||||||
# tcp:8112 - pyload
|
|
||||||
# tcp:9090 - sabnzbd
|
|
||||||
# tcp:9200 - elasticsearch
|
|
||||||
# tcp:5601 - kibana
|
|
||||||
networking.firewall.allowedUDPPorts = [ 655 ];
|
|
||||||
networking.firewall.allowedTCPPorts = [ 80 655 5601 8111 8112 9200 9090 ];
|
|
||||||
|
|
||||||
# services.openssh.allowSFTP = false;
|
|
||||||
|
|
||||||
# copy config from <secrets/sabnzbd.ini> to /var/lib/sabnzbd/
|
# copy config from <secrets/sabnzbd.ini> to /var/lib/sabnzbd/
|
||||||
services.sabnzbd.enable = true;
|
services.sabnzbd.enable = true;
|
||||||
@ -199,90 +88,11 @@ in {
|
|||||||
enable = true;
|
enable = true;
|
||||||
servedir = "/media/cryptX/emu/ps3";
|
servedir = "/media/cryptX/emu/ps3";
|
||||||
};
|
};
|
||||||
# HDD Array stuff
|
|
||||||
services.smartd.devices = builtins.map (x: { device = x; }) allDisks;
|
|
||||||
|
|
||||||
makefu.snapraid = {
|
|
||||||
enable = true;
|
|
||||||
# TODO: 3 is not protected
|
|
||||||
disks = map toMapper [ 0 1 ];
|
|
||||||
parity = toMapper 2;
|
|
||||||
};
|
|
||||||
|
|
||||||
# TODO create folders in /media
|
|
||||||
system.activationScripts.createCryptFolders = ''
|
|
||||||
${lib.concatMapStringsSep "\n"
|
|
||||||
(d: "install -m 755 -d " + (toMapper d) )
|
|
||||||
[ 0 1 2 "X" ]}
|
|
||||||
'';
|
|
||||||
environment.systemPackages = with pkgs;[
|
|
||||||
mergerfs # hard requirement for mount
|
|
||||||
wol # wake up filepimp
|
|
||||||
f3
|
|
||||||
];
|
|
||||||
fileSystems = let
|
|
||||||
cryptMount = name:
|
|
||||||
{ "/media/${name}" = {
|
|
||||||
device = "/dev/mapper/${name}"; fsType = "xfs";
|
|
||||||
options = [ "nofail" ];
|
|
||||||
};};
|
|
||||||
in cryptMount "crypt0"
|
|
||||||
// cryptMount "crypt1"
|
|
||||||
// cryptMount "crypt2"
|
|
||||||
// cryptMount "crypt3"
|
|
||||||
// { "/media/cryptX" = {
|
|
||||||
device = (lib.concatMapStringsSep ":" (d: (toMapper d)) [ 0 1 2 3 ]);
|
|
||||||
fsType = "mergerfs";
|
|
||||||
noCheck = true;
|
|
||||||
options = [ "defaults" "allow_other" "nofail" "nonempty" ];
|
|
||||||
};
|
|
||||||
};
|
|
||||||
|
|
||||||
powerManagement.powerUpCommands = lib.concatStrings (map (disk: ''
|
|
||||||
${pkgs.hdparm}/sbin/hdparm -S 100 ${disk}
|
|
||||||
${pkgs.hdparm}/sbin/hdparm -B 127 ${disk}
|
|
||||||
${pkgs.hdparm}/sbin/hdparm -y ${disk}
|
|
||||||
'') allDisks);
|
|
||||||
|
|
||||||
# crypto unlocking
|
|
||||||
boot = {
|
|
||||||
initrd.luks = {
|
|
||||||
devices = let
|
|
||||||
usbkey = name: device: {
|
|
||||||
inherit name device keyFile;
|
|
||||||
keyFileSize = 4096;
|
|
||||||
allowDiscards = true;
|
|
||||||
};
|
|
||||||
in [
|
|
||||||
(usbkey "luksroot" rootPartition)
|
|
||||||
(usbkey "crypt0" cryptDisk0)
|
|
||||||
(usbkey "crypt1" cryptDisk1)
|
|
||||||
(usbkey "crypt2" cryptDisk2)
|
|
||||||
(usbkey "crypt3" cryptDisk3)
|
|
||||||
];
|
|
||||||
};
|
|
||||||
loader.grub.device = lib.mkForce rootDisk;
|
|
||||||
|
|
||||||
initrd.availableKernelModules = [
|
|
||||||
"ahci"
|
|
||||||
"ohci_pci"
|
|
||||||
"ehci_pci"
|
|
||||||
"pata_atiixp"
|
|
||||||
"firewire_ohci"
|
|
||||||
"usb_storage"
|
|
||||||
"usbhid"
|
|
||||||
];
|
|
||||||
|
|
||||||
kernelModules = [ "kvm-intel" ];
|
|
||||||
extraModulePackages = [ ];
|
|
||||||
};
|
|
||||||
users.users.misa = {
|
users.users.misa = {
|
||||||
uid = 9002;
|
uid = 9002;
|
||||||
name = "misa";
|
name = "misa";
|
||||||
};
|
};
|
||||||
# hardware.enableAllFirmware = true;
|
|
||||||
hardware.enableRedistributableFirmware = true;
|
|
||||||
hardware.cpu.intel.updateMicrocode = true;
|
|
||||||
|
|
||||||
zramSwap.enable = true;
|
zramSwap.enable = true;
|
||||||
|
|
||||||
@ -290,8 +100,8 @@ in {
|
|||||||
nickname = "Reaktor|shack";
|
nickname = "Reaktor|shack";
|
||||||
workdir = "/var/lib/Reaktor/shack";
|
workdir = "/var/lib/Reaktor/shack";
|
||||||
channels = [ "#shackspace" ];
|
channels = [ "#shackspace" ];
|
||||||
plugins = with pkgs.ReaktorPlugins;[
|
plugins = with pkgs.ReaktorPlugins;
|
||||||
shack-correct
|
[ shack-correct
|
||||||
# stockholm-issue
|
# stockholm-issue
|
||||||
sed-plugin
|
sed-plugin
|
||||||
random-emoji ];
|
random-emoji ];
|
||||||
@ -300,8 +110,8 @@ in {
|
|||||||
nickname = "Reaktor|bgt";
|
nickname = "Reaktor|bgt";
|
||||||
workdir = "/var/lib/Reaktor/bgt";
|
workdir = "/var/lib/Reaktor/bgt";
|
||||||
channels = [ "#binaergewitter" ];
|
channels = [ "#binaergewitter" ];
|
||||||
plugins = with pkgs.ReaktorPlugins;[
|
plugins = with pkgs.ReaktorPlugins;
|
||||||
titlebot
|
[ titlebot
|
||||||
# stockholm-issue
|
# stockholm-issue
|
||||||
nixos-version
|
nixos-version
|
||||||
shack-correct
|
shack-correct
|
||||||
|
117
makefu/1systems/omo/hw/omo.nix
Normal file
117
makefu/1systems/omo/hw/omo.nix
Normal file
@ -0,0 +1,117 @@
|
|||||||
|
{ config, pkgs, lib, ... }:
|
||||||
|
let
|
||||||
|
toMapper = id: "/media/crypt${builtins.toString id}";
|
||||||
|
byid = dev: "/dev/disk/by-id/" + dev;
|
||||||
|
keyFile = byid "usb-Verbatim_STORE_N_GO_070B3CEE0B223954-0:0";
|
||||||
|
rootDisk = byid "ata-SanDisk_SD8SNAT128G1122_162099420904";
|
||||||
|
rootPartition = byid "ata-SanDisk_SD8SNAT128G1122_162099420904-part2";
|
||||||
|
primaryInterface = "enp2s0";
|
||||||
|
# cryptsetup luksFormat $dev --cipher aes-xts-plain64 -s 512 -h sha512
|
||||||
|
# cryptsetup luksAddKey $dev tmpkey
|
||||||
|
# cryptsetup luksOpen $dev crypt0 --key-file tmpkey --keyfile-size=4096
|
||||||
|
# mkfs.xfs /dev/mapper/crypt0 -L crypt0
|
||||||
|
|
||||||
|
# omo Chassis:
|
||||||
|
# __FRONT_
|
||||||
|
# |* d0 |
|
||||||
|
# | |
|
||||||
|
# |* d1 |
|
||||||
|
# | |
|
||||||
|
# |* d3 |
|
||||||
|
# | |
|
||||||
|
# |* |
|
||||||
|
# |* d2 |
|
||||||
|
# | * |
|
||||||
|
# | * |
|
||||||
|
# |_______|
|
||||||
|
# cryptDisk0 = byid "ata-ST2000DM001-1CH164_Z240XTT6";
|
||||||
|
cryptDisk0 = byid "ata-ST8000DM004-2CX188_ZCT01PLV";
|
||||||
|
cryptDisk1 = byid "ata-TP02000GB_TPW151006050068";
|
||||||
|
cryptDisk2 = byid "ata-ST4000DM000-1F2168_Z303HVSG";
|
||||||
|
cryptDisk3 = byid "ata-ST8000DM004-2CX188_ZCT01SG4";
|
||||||
|
# cryptDisk3 = byid "ata-WDC_WD20EARS-00MVWB0_WD-WMAZA1786907";
|
||||||
|
# all physical disks
|
||||||
|
|
||||||
|
# TODO callPackage ../3modules/MonitorDisks { disks = allDisks }
|
||||||
|
dataDisks = [ cryptDisk0 cryptDisk1 cryptDisk2 cryptDisk3 ];
|
||||||
|
allDisks = [ rootDisk ] ++ dataDisks;
|
||||||
|
in {
|
||||||
|
imports =
|
||||||
|
[ # TODO: unlock home partition via ssh
|
||||||
|
<stockholm/makefu/2configs/fs/sda-crypto-root.nix> ];
|
||||||
|
makefu.server.primary-itf = primaryInterface;
|
||||||
|
system.activationScripts.createCryptFolders = ''
|
||||||
|
${lib.concatMapStringsSep "\n"
|
||||||
|
(d: "install -m 755 -d " + (toMapper d) )
|
||||||
|
[ 0 1 2 "X" ]}
|
||||||
|
'';
|
||||||
|
|
||||||
|
makefu.snapraid = {
|
||||||
|
enable = true;
|
||||||
|
# TODO: 3 is not protected
|
||||||
|
disks = map toMapper [ 0 1 ];
|
||||||
|
parity = toMapper 2;
|
||||||
|
};
|
||||||
|
fileSystems = let
|
||||||
|
cryptMount = name:
|
||||||
|
{ "/media/${name}" = {
|
||||||
|
device = "/dev/mapper/${name}"; fsType = "xfs";
|
||||||
|
options = [ "nofail" ];
|
||||||
|
};};
|
||||||
|
in cryptMount "crypt0"
|
||||||
|
// cryptMount "crypt1"
|
||||||
|
// cryptMount "crypt2"
|
||||||
|
// cryptMount "crypt3"
|
||||||
|
// { "/media/cryptX" = {
|
||||||
|
device = (lib.concatMapStringsSep ":" (d: (toMapper d)) [ 0 1 2 3 ]);
|
||||||
|
fsType = "mergerfs";
|
||||||
|
noCheck = true;
|
||||||
|
options = [ "defaults" "allow_other" "nofail" "nonempty" ];
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
powerManagement.powerUpCommands = lib.concatStrings (map (disk: ''
|
||||||
|
${pkgs.hdparm}/sbin/hdparm -S 100 ${disk}
|
||||||
|
${pkgs.hdparm}/sbin/hdparm -B 127 ${disk}
|
||||||
|
${pkgs.hdparm}/sbin/hdparm -y ${disk}
|
||||||
|
'') allDisks);
|
||||||
|
|
||||||
|
# crypto unlocking
|
||||||
|
boot = {
|
||||||
|
initrd.luks = {
|
||||||
|
devices = let
|
||||||
|
usbkey = name: device: {
|
||||||
|
inherit name device keyFile;
|
||||||
|
keyFileSize = 4096;
|
||||||
|
allowDiscards = true;
|
||||||
|
};
|
||||||
|
in [
|
||||||
|
(usbkey "luksroot" rootPartition)
|
||||||
|
(usbkey "crypt0" cryptDisk0)
|
||||||
|
(usbkey "crypt1" cryptDisk1)
|
||||||
|
(usbkey "crypt2" cryptDisk2)
|
||||||
|
(usbkey "crypt3" cryptDisk3)
|
||||||
|
];
|
||||||
|
};
|
||||||
|
loader.grub.device = lib.mkForce rootDisk;
|
||||||
|
|
||||||
|
initrd.availableKernelModules = [
|
||||||
|
"ahci"
|
||||||
|
"ohci_pci"
|
||||||
|
"ehci_pci"
|
||||||
|
"pata_atiixp"
|
||||||
|
"firewire_ohci"
|
||||||
|
"usb_storage"
|
||||||
|
"usbhid"
|
||||||
|
];
|
||||||
|
|
||||||
|
kernelModules = [ "kvm-intel" ];
|
||||||
|
extraModulePackages = [ ];
|
||||||
|
};
|
||||||
|
environment.systemPackages = with pkgs;[
|
||||||
|
mergerfs # hard requirement for mount
|
||||||
|
];
|
||||||
|
hardware.enableRedistributableFirmware = true;
|
||||||
|
hardware.cpu.intel.updateMicrocode = true;
|
||||||
|
}
|
||||||
|
|
11
makefu/1systems/omo/hw/tsp-tools.nix
Normal file
11
makefu/1systems/omo/hw/tsp-tools.nix
Normal file
@ -0,0 +1,11 @@
|
|||||||
|
let
|
||||||
|
disko = import (builtins.fetchGit {
|
||||||
|
url = https://cgit.lassul.us/disko/;
|
||||||
|
rev = "9c9b62e15e4ac11d4379e66b974f1389daf939fe";
|
||||||
|
});
|
||||||
|
|
||||||
|
cfg = builtins.fromJSON (builtins.readFile ../../hardware/tsp-disk.json);
|
||||||
|
in ''
|
||||||
|
${disko.create cfg}
|
||||||
|
${disko.mount cfg}
|
||||||
|
''
|
32
makefu/1systems/omo/hw/tsp.nix
Normal file
32
makefu/1systems/omo/hw/tsp.nix
Normal file
@ -0,0 +1,32 @@
|
|||||||
|
{ pkgs, ... }:
|
||||||
|
with builtins;
|
||||||
|
let
|
||||||
|
disko = import (builtins.fetchGit {
|
||||||
|
url = https://cgit.lassul.us/disko/;
|
||||||
|
rev = "9c9b62e15e4ac11d4379e66b974f1389daf939fe";
|
||||||
|
});
|
||||||
|
cfg = fromJSON (readFile ../../hardware/tsp-disk.json);
|
||||||
|
primaryInterface = "enp1s0";
|
||||||
|
rootDisk = "/dev/sda"; # TODO same as disko uses
|
||||||
|
in {
|
||||||
|
imports = [
|
||||||
|
(disko.config cfg)
|
||||||
|
];
|
||||||
|
makefu.server.primary-itf = primaryInterface;
|
||||||
|
boot = {
|
||||||
|
loader.grub.device = rootDisk;
|
||||||
|
|
||||||
|
initrd.availableKernelModules = [
|
||||||
|
"ahci"
|
||||||
|
"ohci_pci"
|
||||||
|
"ehci_pci"
|
||||||
|
"pata_atiixp"
|
||||||
|
"firewire_ohci"
|
||||||
|
"usb_storage"
|
||||||
|
"usbhid"
|
||||||
|
];
|
||||||
|
|
||||||
|
kernelModules = [ "kvm-intel" ];
|
||||||
|
};
|
||||||
|
|
||||||
|
}
|
9
makefu/2configs/dcpp/client.nix
Normal file
9
makefu/2configs/dcpp/client.nix
Normal file
@ -0,0 +1,9 @@
|
|||||||
|
{ pkgs, ... }:
|
||||||
|
{ # ncdc
|
||||||
|
environment.systemPackages = [ pkgs.ncdc ];
|
||||||
|
networking.firewall = {
|
||||||
|
allowedUDPPorts = [ 51411 ];
|
||||||
|
allowedTCPPorts = [ 51411 ];
|
||||||
|
};
|
||||||
|
}
|
||||||
|
|
@ -30,6 +30,7 @@ let
|
|||||||
|
|
||||||
'') dict)}
|
'') dict)}
|
||||||
'';
|
'';
|
||||||
|
uhubDir = "/var/lib/uhub";
|
||||||
|
|
||||||
in {
|
in {
|
||||||
users.extraUsers = singleton {
|
users.extraUsers = singleton {
|
||||||
@ -65,21 +66,30 @@ in {
|
|||||||
PrivateTmp = true;
|
PrivateTmp = true;
|
||||||
PermissionsStartOnly = true;
|
PermissionsStartOnly = true;
|
||||||
ExecStartPre = pkgs.writeDash "uhub-pre" ''
|
ExecStartPre = pkgs.writeDash "uhub-pre" ''
|
||||||
cp ${toString <secrets/wildcard.krebsco.de.crt>} /tmp/uhub.crt
|
cp -f ${toString <secrets/wildcard.krebsco.de.crt>} ${uhubDir}/uhub.crt
|
||||||
cp ${toString <secrets/wildcard.krebsco.de.key>} /tmp/uhub.key
|
cp -f ${toString <secrets/wildcard.krebsco.de.key>} ${uhubDir}/uhub.key
|
||||||
cp ${toString <secrets/uhub.sql>} /tmp/uhub.sql
|
if test -d ${uhubDir};then
|
||||||
chown uhub /tmp/*
|
echo "Directory ${uhubDir} already exists, skipping db init"
|
||||||
|
else
|
||||||
|
echo "Copying sql user db"
|
||||||
|
cp ${toString <secrets/uhub.sql>} ${uhubDir}/uhub.sql
|
||||||
|
fi
|
||||||
|
chown -R uhub ${uhubDir}
|
||||||
'';
|
'';
|
||||||
|
|
||||||
};
|
};
|
||||||
|
users.users.uhub = {
|
||||||
|
home = uhubDir;
|
||||||
|
createHome = true;
|
||||||
|
};
|
||||||
services.uhub = {
|
services.uhub = {
|
||||||
enable = true;
|
enable = true;
|
||||||
port = 1511;
|
port = 1511;
|
||||||
enableTLS = true;
|
enableTLS = true;
|
||||||
hubConfig = ''
|
hubConfig = ''
|
||||||
hub_name = "krebshub"
|
hub_name = "krebshub"
|
||||||
tls_certificate = /tmp/uhub.crt
|
tls_certificate = ${uhubDir}/uhub.crt
|
||||||
tls_private_key = /tmp/uhub.key
|
tls_private_key = ${uhubDir}/uhub.key
|
||||||
registered_users_only = true
|
registered_users_only = true
|
||||||
'';
|
'';
|
||||||
plugins = {
|
plugins = {
|
||||||
@ -93,7 +103,7 @@ in {
|
|||||||
};
|
};
|
||||||
authSqlite = {
|
authSqlite = {
|
||||||
enable = true;
|
enable = true;
|
||||||
file = "/tmp/uhub.sql";
|
file = "${uhubDir}/uhub.sql";
|
||||||
};
|
};
|
||||||
|
|
||||||
};
|
};
|
61
makefu/2configs/deployment/homeautomation/default.nix
Normal file
61
makefu/2configs/deployment/homeautomation/default.nix
Normal file
@ -0,0 +1,61 @@
|
|||||||
|
{ pkgs, config, ... }:
|
||||||
|
let
|
||||||
|
firetv = "192.168.1.238";
|
||||||
|
in {
|
||||||
|
systemd.services.firetv = {
|
||||||
|
wantedBy = [ "multi-user.target" ];
|
||||||
|
serviceConfig = {
|
||||||
|
User = "nobody";
|
||||||
|
ExecStart = "${pkgs.python-firetv}/bin/firetv-server -d ${firetv}:5555";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
nixpkgs.config.permittedInsecurePackages = [
|
||||||
|
"homeassistant-0.65.5"
|
||||||
|
];
|
||||||
|
services.home-assistant = {
|
||||||
|
config = {
|
||||||
|
homeassistant = {
|
||||||
|
name = "Home"; time_zone = "Europe/Berlin";
|
||||||
|
latitude = "48.7687";
|
||||||
|
longitude = "9.2478";
|
||||||
|
};
|
||||||
|
media_player = [
|
||||||
|
{ platform = "kodi";
|
||||||
|
host = firetv;
|
||||||
|
}
|
||||||
|
{ platform = "firetv";
|
||||||
|
# assumes python-firetv running
|
||||||
|
}
|
||||||
|
];
|
||||||
|
sensor = [
|
||||||
|
{ platform = "luftdaten";
|
||||||
|
name = "Ditzingen";
|
||||||
|
sensorid = "663";
|
||||||
|
monitored_conditions = [ "P1" "P2" ];
|
||||||
|
}
|
||||||
|
# https://www.home-assistant.io/cookbook/automation_for_rainy_days/
|
||||||
|
{ platform = "darksky";
|
||||||
|
api_key = "c73619e6ea79e553a585be06aacf3679";
|
||||||
|
language = "de";
|
||||||
|
monitored_conditions = [ "summary" "icon"
|
||||||
|
"nearest_storm_distance" "precip_probability"
|
||||||
|
"precip_intensity"
|
||||||
|
"temperature" # "temperature_high" "temperature_low"
|
||||||
|
"hourly_summary"
|
||||||
|
"uv_index" ];
|
||||||
|
units = "si" ;
|
||||||
|
update_interval = {
|
||||||
|
days = 0;
|
||||||
|
hours = 0;
|
||||||
|
minutes = 10;
|
||||||
|
seconds = 0;
|
||||||
|
};
|
||||||
|
}
|
||||||
|
];
|
||||||
|
frontend = { };
|
||||||
|
http = { };
|
||||||
|
};
|
||||||
|
enable = true;
|
||||||
|
#configDir = "/var/lib/hass";
|
||||||
|
};
|
||||||
|
}
|
52
makefu/2configs/wireguard/server.nix
Normal file
52
makefu/2configs/wireguard/server.nix
Normal file
@ -0,0 +1,52 @@
|
|||||||
|
{ config, ... }:
|
||||||
|
let
|
||||||
|
ext-if = config.makefu.server.primary-itf;
|
||||||
|
in { # wireguard server
|
||||||
|
|
||||||
|
# opkg install wireguard luci-proto-wireguard
|
||||||
|
|
||||||
|
# TODO: networking.nat
|
||||||
|
|
||||||
|
# boot.kernel.sysctl."net.ipv4.ip_forward" = 1;
|
||||||
|
# conf.all.proxy_arp =1
|
||||||
|
networking.firewall = {
|
||||||
|
allowedUDPPorts = [ 51820 ];
|
||||||
|
extraCommands = ''
|
||||||
|
iptables -t nat -A POSTROUTING -s 10.244.0.0/24 -o ${ext-if} -j MASQUERADE
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
|
||||||
|
networking.wireguard.interfaces.wg0 = {
|
||||||
|
ips = [ "10.244.0.1/24" ];
|
||||||
|
listenPort = 51820;
|
||||||
|
privateKeyFile = (toString <secrets>) + "/wireguard.key";
|
||||||
|
allowedIPsAsRoutes = true;
|
||||||
|
peers = [
|
||||||
|
{
|
||||||
|
# x
|
||||||
|
allowedIPs = [ "10.244.0.2/32" ];
|
||||||
|
publicKey = "fe5smvKVy5GAn7EV4w4tav6mqIAKhGWQotm7dRuRt1g=";
|
||||||
|
}
|
||||||
|
{
|
||||||
|
# vbob
|
||||||
|
allowedIPs = [ "10.244.0.3/32" ];
|
||||||
|
publicKey = "Lju7EsCu1OWXhkhdNR7c/uiN60nr0TUPHQ+s8ULPQTw=";
|
||||||
|
}
|
||||||
|
{
|
||||||
|
# x-test
|
||||||
|
allowedIPs = [ "10.244.0.4/32" ];
|
||||||
|
publicKey = "vZ/AJpfDLJyU3DzvYeW70l4FNziVgSTumA89wGHG7XY=";
|
||||||
|
}
|
||||||
|
{
|
||||||
|
# work-router
|
||||||
|
allowedIPs = [ "10.244.0.5/32" ];
|
||||||
|
publicKey = "QJMwwYu/92koCASbHnR/vqe/rN00EV6/o7BGwLockDw=";
|
||||||
|
}
|
||||||
|
{
|
||||||
|
# workr
|
||||||
|
allowedIPs = [ "10.244.0.6/32" ];
|
||||||
|
publicKey = "OFhCF56BrV9tjqW1sxqXEKH/GdqamUT1SqZYSADl5GA=";
|
||||||
|
}
|
||||||
|
];
|
||||||
|
};
|
||||||
|
}
|
Loading…
Reference in New Issue
Block a user