1
1
Fork 0
nixos-configs/machine/catacomb/default.nix

213 lines
5.2 KiB
Nix
Raw Normal View History

{ pkgs, lib, ... }:
2021-01-27 04:18:30 +00:00
let
2023-08-02 01:51:00 +00:00
beatific = import ../../modules/beatific-config.nix;
in {
imports = [
./hardware-configuration.nix
./fileserver.nix
];
2021-01-27 04:18:30 +00:00
boot = {
loader = {
# Use the extlinux boot loader. (NixOS wants to enable GRUB by default)
2021-01-27 04:18:30 +00:00
grub.enable = false;
# Enables the generation of /boot/extlinux/extlinux.conf
generic-extlinux-compatible.enable = true;
2021-01-27 04:18:30 +00:00
};
supportedFilesystems = ["zfs"];
zfs.enableUnstable = true;
2021-01-27 04:18:30 +00:00
};
system.stateVersion = "22.11"; # Read the usual warning
2021-01-27 04:18:30 +00:00
swapDevices = [ { device = "/swap"; size = 1024; } ];
2021-01-27 04:18:30 +00:00
console.keyMap = "us";
i18n.defaultLocale = "en_US.UTF-8";
2021-01-27 04:18:30 +00:00
environment.systemPackages = with pkgs;
let
py3-packages = python-packages: with python-packages; [
flask
];
py3-with-packages = python3.withPackages py3-packages;
in [
wget vim curl git htop bash tmux psmisc man-pages pv lsof
2021-01-27 04:18:30 +00:00
zip unzip
py3-with-packages
usbutils
hdparm sdparm smartmontools gptfdisk gnufdisk
dosfstools
mkpasswd samba
#file-rename
rsync
2021-04-03 06:38:12 +00:00
rclone gnupg
2021-01-27 04:18:30 +00:00
];
2021-01-27 04:18:30 +00:00
networking = {
hostName = "catacomb";
hostId = "beeeeee5";
firewall = {
enable = true;
allowPing = true;
allowedTCPPorts = [ 22 139 445 ];
2021-01-27 04:18:30 +00:00
allowedUDPPorts = [ 137 138 ];
};
};
2022-11-27 00:04:40 +00:00
services.cron = {
enable = true;
systemCronJobs =
let
reassertPerms = pkgs.writeShellScript "reassert-nas-permissions.sh" ''
${pkgs.coreutils}/bin/chown -v -R tvb:nas /nas
${pkgs.findutils}/bin/find /nas -type d -exec ${pkgs.coreutils}/bin/chmod -v 750 {} \;
${pkgs.findutils}/bin/find /nas -type f -exec ${pkgs.coreutils}/bin/chmod -v 640 {} \;
'';
in [
"0 20 * * 1 root ${reassertPerms}"
"0 0 * * 1 tvb . /etc/profile; /home/tvb/gitea-backup"
];
};
2021-01-27 04:18:30 +00:00
services.openssh = {
enable = true;
passwordAuthentication = true;
};
services.ntp = {
enable = true;
servers = ["time.nist.gov"];
};
services.rsyncd.enable = true;
2023-05-03 02:01:01 +00:00
services.samba =
2021-01-27 04:18:30 +00:00
let
sambaShare = path: validUsers: {
path = path;
comment = "Samba share for ${path}";
browseable = "yes";
"read only" = "no";
"guest okay" = "no";
"create mask" = "0640";
"force create mode" = "0640";
"directory mask" = "0750";
"force directory mode" = "0750";
"valid users" = validUsers;
"force group" = ''nas'';
};
sambaShareRO = path: validUsers: {
path = path;
comment = "Read-only Samba share for ${path}";
browseable = "yes";
"read only" = "yes";
"guest okay" = "no";
"valid users" = validUsers;
"force group" = ''nas'';
};
in
{
enable = true;
securityType = "user";
extraConfig = ''
workgroup = beatific
server string = Catacomb Nix SMB
netbios name = catacomb
deadtime = 300
local master = yes
domain master = yes
preferred master = yes
guest account = nobody
map to guest = bad user
case sensitive = yes
veto files = /^.DS_Store$/^.Trash-1000$/
load printers = no
printcap name = /dev/null
printing = bsd
log file = /var/log/samba/client-%m.log
log level = 2
max log size = 64
hide dot files = no
2023-05-03 02:01:01 +00:00
hosts allow = 10.22.20., 192.168.1.
2021-01-27 04:18:30 +00:00
map archive = no
unix extensions = yes
ntlm auth = yes
'';
2023-05-03 02:01:01 +00:00
shares = let
homeShare = user: {
path = "/home/${user}";
comment = "${user}'s home folder";
browseable = "yes";
"read only" = "no";
"guest okay" = "no";
"create mask" = "0640";
"force create mode" = "0640";
"directory mask" = "0750";
"force directory mode" = "0750";
"valid users" = "${user}";
};
in {
tvb = homeShare "tvb";
katydid = homeShare "katydid";
2021-01-27 04:18:30 +00:00
};
2023-05-03 02:01:01 +00:00
};
services.nebula.networks.beatific = lib.recursiveUpdate beatific.nebula-defaults {
2022-11-27 00:26:18 +00:00
enable = true;
# Network certificate and host credentials
ca = "/etc/nebula/beatific/beatific.crt";
cert = "/etc/nebula/beatific/catacomb.crt";
key = "/etc/nebula/beatific/catacomb.key";
# Connect to the lighthouse at empyrean
# Note that this is a VPN address, not a public address
lighthouses = [ beatific.empyrean-vpn-ip ];
2022-11-27 00:26:18 +00:00
# Map the lighthouse address to its public address
staticHostMap = beatific.empyrean-host-map;
2022-11-27 00:26:18 +00:00
};
2021-01-27 04:18:30 +00:00
services.zfs = {
autoScrub = {
enable = true;
pools = ["catapool"];
interval = "monthly";
};
};
users.groups = {
nas = { gid = 1600; };
};
users.users.tvb = {
isNormalUser = true;
uid = 1001;
password = "badpassword";
extraGroups = ["wheel" "nas"];
openssh.authorizedKeys.keyFiles = [
../../keys/tvb.palamas.pub
../../keys/tvb.stagirite.pub
../../keys/tvb.vagrant.pub
2023-07-03 14:15:29 +00:00
../../keys/tvb.empyrean.pub
2021-01-27 04:18:30 +00:00
];
};
2023-04-29 23:12:58 +00:00
users.users.katydid = {
isNormalUser = true;
uid = 1002;
};
nix.settings.cores = 4;
2022-11-25 23:48:58 +00:00
nix.extraOptions = "experimental-features = nix-command flakes";
2021-01-27 04:18:30 +00:00
}