Initial commit
This commit is contained in:
parent
cf5e23eaa7
commit
825b68fc93
|
|
@ -0,0 +1,257 @@
|
||||||
|
{ pkgs, ... }:
|
||||||
|
|
||||||
|
{
|
||||||
|
disabledModules = [ "system/boot/loader/raspberrypi/raspberrypi.nix" ];
|
||||||
|
imports = [ ./modules/system/boot/loader/raspberrypi/raspberrypi.nix ];
|
||||||
|
|
||||||
|
boot = {
|
||||||
|
kernelPackages = pkgs.linuxPackages_rpi4;
|
||||||
|
supportedFilesystems = ["zfs"];
|
||||||
|
zfs.enableUnstable = true;
|
||||||
|
loader = {
|
||||||
|
grub.enable = false;
|
||||||
|
raspberryPi = {
|
||||||
|
enable = true;
|
||||||
|
version = 4;
|
||||||
|
configurationLimit = 1;
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
# MAKE SURE THESE ARE RIGHT OR THE PI WILL NOT BOOT
|
||||||
|
fileSystems = {
|
||||||
|
"/" = {
|
||||||
|
fsType = "ext4";
|
||||||
|
device = "/dev/disk/by-label/NIXOS_SD";
|
||||||
|
};
|
||||||
|
"/boot" = {
|
||||||
|
fsType = "vfat";
|
||||||
|
device = "/dev/disk/by-label/NIXOS_BOOT";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
hardware.enableRedistributableFirmware = true;
|
||||||
|
|
||||||
|
swapDevices = [ { device = "/swap"; size = 1024; } ];
|
||||||
|
|
||||||
|
console.keyMap = "us";
|
||||||
|
i18n.defaultLocale = "en_US.UTF-8";
|
||||||
|
|
||||||
|
environment.systemPackages = with pkgs;
|
||||||
|
let
|
||||||
|
py3-packages = python-packages: with python-packages; [
|
||||||
|
flask
|
||||||
|
];
|
||||||
|
py3-with-packages = python3.withPackages py3-packages;
|
||||||
|
in [
|
||||||
|
wget vim curl git htop bash tmux psmisc manpages pv lsof
|
||||||
|
zip unzip
|
||||||
|
nginx
|
||||||
|
py3-with-packages
|
||||||
|
usbutils
|
||||||
|
hdparm sdparm smartmontools gptfdisk gnufdisk
|
||||||
|
dosfstools
|
||||||
|
mkpasswd samba
|
||||||
|
tinc_pre
|
||||||
|
#file-rename
|
||||||
|
rsync
|
||||||
|
];
|
||||||
|
|
||||||
|
networking = {
|
||||||
|
hostName = "catacomb";
|
||||||
|
hostId = "beeeeee5";
|
||||||
|
firewall = {
|
||||||
|
enable = true;
|
||||||
|
allowPing = true;
|
||||||
|
allowedTCPPorts = [ 22 80 139 445 7473 ];
|
||||||
|
allowedUDPPorts = [ 137 138 ];
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
security = {
|
||||||
|
hideProcessInformation = true;
|
||||||
|
};
|
||||||
|
|
||||||
|
services.cron = {
|
||||||
|
enable = true;
|
||||||
|
systemCronJobs = [
|
||||||
|
"* 20 * * 1 root /root/reassert-nas-permissions.sh"
|
||||||
|
];
|
||||||
|
};
|
||||||
|
|
||||||
|
services.openssh = {
|
||||||
|
enable = true;
|
||||||
|
passwordAuthentication = true;
|
||||||
|
};
|
||||||
|
|
||||||
|
services.nginx = {
|
||||||
|
enable = true;
|
||||||
|
|
||||||
|
virtualHosts."catacomb-server" = {
|
||||||
|
listen = [ { addr = "10.7.3.16"; } ];
|
||||||
|
root = "/nas";
|
||||||
|
locations."/".tryFiles = "\$uri @indexer";
|
||||||
|
locations."@indexer".extraConfig = "
|
||||||
|
proxy_buffering off;
|
||||||
|
proxy_pass http://127.0.0.1:5000;
|
||||||
|
";
|
||||||
|
};
|
||||||
|
|
||||||
|
virtualHosts."guest-server" = {
|
||||||
|
listen = [ { addr = "10.7.3.16"; port = 7473; } ];
|
||||||
|
extraConfig = "
|
||||||
|
access_log /var/log/nginx/access.guest-server.log;
|
||||||
|
";
|
||||||
|
locations."/".extraConfig = "
|
||||||
|
proxy_buffering off;
|
||||||
|
proxy_pass http://127.0.0.1:7473/;
|
||||||
|
";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
services.ntp = {
|
||||||
|
enable = true;
|
||||||
|
servers = ["time.nist.gov"];
|
||||||
|
};
|
||||||
|
|
||||||
|
services.rsyncd.enable = true;
|
||||||
|
|
||||||
|
services.samba =
|
||||||
|
let
|
||||||
|
sambaShare = path: validUsers: {
|
||||||
|
path = path;
|
||||||
|
comment = "Samba share for ${path}";
|
||||||
|
browseable = "yes";
|
||||||
|
"read only" = "no";
|
||||||
|
"guest okay" = "no";
|
||||||
|
"create mask" = "0640";
|
||||||
|
"force create mode" = "0640";
|
||||||
|
"directory mask" = "0750";
|
||||||
|
"force directory mode" = "0750";
|
||||||
|
"valid users" = validUsers;
|
||||||
|
"force group" = ''nas'';
|
||||||
|
};
|
||||||
|
sambaShareRO = path: validUsers: {
|
||||||
|
path = path;
|
||||||
|
comment = "Read-only Samba share for ${path}";
|
||||||
|
browseable = "yes";
|
||||||
|
"read only" = "yes";
|
||||||
|
"guest okay" = "no";
|
||||||
|
"valid users" = validUsers;
|
||||||
|
"force group" = ''nas'';
|
||||||
|
};
|
||||||
|
in
|
||||||
|
{
|
||||||
|
enable = true;
|
||||||
|
securityType = "user";
|
||||||
|
extraConfig = ''
|
||||||
|
workgroup = beatific
|
||||||
|
server string = Catacomb Nix SMB
|
||||||
|
netbios name = catacomb
|
||||||
|
deadtime = 300
|
||||||
|
|
||||||
|
local master = yes
|
||||||
|
domain master = yes
|
||||||
|
preferred master = yes
|
||||||
|
|
||||||
|
guest account = nobody
|
||||||
|
map to guest = bad user
|
||||||
|
|
||||||
|
case sensitive = yes
|
||||||
|
veto files = /^.DS_Store$/^.Trash-1000$/
|
||||||
|
|
||||||
|
load printers = no
|
||||||
|
printcap name = /dev/null
|
||||||
|
printing = bsd
|
||||||
|
|
||||||
|
log file = /var/log/samba/client-%m.log
|
||||||
|
log level = 2
|
||||||
|
max log size = 64
|
||||||
|
|
||||||
|
hide dot files = no
|
||||||
|
hosts allow = 10.7.3.
|
||||||
|
map archive = no
|
||||||
|
unix extensions = yes
|
||||||
|
|
||||||
|
ntlm auth = yes
|
||||||
|
'';
|
||||||
|
shares = {
|
||||||
|
audioRO = sambaShareRO "/nas/audio" ''@nas'';
|
||||||
|
docRO = sambaShareRO "/nas/doc/" ''@nas'';
|
||||||
|
gameRO = sambaShareRO "/nas/game/" ''@nas'';
|
||||||
|
imageRO = sambaShareRO "/nas/image" ''@nas'';
|
||||||
|
videoRO = sambaShareRO "/nas/video" ''@nas'';
|
||||||
|
audio = sambaShare "/nas/audio" ''@nas'';
|
||||||
|
doc = sambaShare "/nas/doc/" ''@nas'';
|
||||||
|
game = sambaShare "/nas/game/" ''@nas'';
|
||||||
|
image = sambaShare "/nas/image" ''@nas'';
|
||||||
|
video = sambaShare "/nas/video" ''@nas'';
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
services.tinc.networks = {
|
||||||
|
beatific = {
|
||||||
|
name = "catacomb";
|
||||||
|
listenAddress = "0.0.0.0";
|
||||||
|
chroot = false;
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
services.zfs = {
|
||||||
|
autoScrub = {
|
||||||
|
enable = true;
|
||||||
|
pools = ["catapool"];
|
||||||
|
interval = "monthly";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
systemd.services.host-server = {
|
||||||
|
enable = true;
|
||||||
|
description = "catapool host index server";
|
||||||
|
serviceConfig = {
|
||||||
|
Type = "simple";
|
||||||
|
ExecStart = "/nas-indexer/host-server/run.sh";
|
||||||
|
Restart = "on-failure";
|
||||||
|
User = "tvb";
|
||||||
|
WorkingDirectory = "/nas-indexer/host-server";
|
||||||
|
};
|
||||||
|
requires = [ "zfs.target" ];
|
||||||
|
wantedBy = [ "multi-user.target" ];
|
||||||
|
};
|
||||||
|
|
||||||
|
systemd.services.guest-server = {
|
||||||
|
enable = true;
|
||||||
|
description = "catapool guest index server";
|
||||||
|
serviceConfig = {
|
||||||
|
Type = "simple";
|
||||||
|
ExecStart = "/nas-indexer/guest-server/run.sh";
|
||||||
|
Restart = "on-failure";
|
||||||
|
User = "tvb";
|
||||||
|
WorkingDirectory = "/nas-indexer/guest-server";
|
||||||
|
};
|
||||||
|
requires = [ "zfs.target" ];
|
||||||
|
wantedBy = [ "multi-user.target" ];
|
||||||
|
};
|
||||||
|
|
||||||
|
users.groups = {
|
||||||
|
nas = { gid = 1600; };
|
||||||
|
};
|
||||||
|
|
||||||
|
users.users.tvb = {
|
||||||
|
isNormalUser = true;
|
||||||
|
uid = 1001;
|
||||||
|
password = "badpassword";
|
||||||
|
extraGroups = ["wheel" "nas"];
|
||||||
|
shell = pkgs.bash;
|
||||||
|
openssh.authorizedKeys.keyFiles = [
|
||||||
|
./keys/tvb.palamas.pub
|
||||||
|
./keys/tvb.stagirite.pub
|
||||||
|
./keys/monitor.isidore.pub
|
||||||
|
];
|
||||||
|
};
|
||||||
|
#./keys/tvb.empyrean.pub
|
||||||
|
|
||||||
|
users.users.nginx.extraGroups = ["nas"];
|
||||||
|
|
||||||
|
nix.buildCores = 4;
|
||||||
|
}
|
||||||
|
|
@ -0,0 +1 @@
|
||||||
|
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCzx37PqIaJVWdQs5meVgI4Cg1GRGk6srrix0AUvQeaBS9MOVtJLi+HfnNkcW4GPk9qVlz1E7ciQ7YUw+ny7QbHxcbib2Tawwfk3cx9xiNcN6UI9EzF/rTbNB2Cex8A4sEr5UvoE0BjT5yPaXyrjn8vLksGWq4dlZBM3xeJqe3KP+OxPL0vik3SVGOr/6ZQ7H9cwX5+/p6rCWQuVtwZMcaE6QyXYg5J5FQUaIrFvKbOVklJIkQSbXGzIYQO/QlQC0xWGBapJtGQw/lsQ3YqnFSMkkw8qrKbde07rg8p1FSuqTu+a1ePK+/F4klNel174+39YSobY2/6biPP3Uj/Yhorf4Tw141tIT75e3ebtK5faatQmNOyXcA7LULXK7XemJkZy8PmbNNTeBIKyoI6XQdzk95gpb2C4LEJmV040YMgXhOIiKsHQVgss9FuC+oP5jXWU/JuNXBRHa1IpJjcJhIhg7jnh6ZNZHyK0EpeUs3Zp7usv7mz6CGwb04yvTsWOhZRc+6EoHaHyrNvFPfkPeGsZzxhIbprCyDMtKWsI9GCtztcRhQWBgornUVEs5CurLJBbClQTrZLVv2fn9UnXWPYZTLYL7aFwRIGyKr8ZOOMFxbLOGdeFlqc5TGCP416e8PZvhE+BuDmxiKtQJ/dsQFqVzvOZb2WQRsYRPYvvXbvUw== monitor@isidore
|
||||||
|
|
@ -0,0 +1 @@
|
||||||
|
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC1h/6CedtyFIjFTT7M5e0dEKJkhPbCQ1RLhtj/83H//AK6bzRbWfnKzSH0VXpsHjaU/Ipc1Jl2fQ23r8i/QyKHUKK7xPeGcY5J7oIHVggkEKW2n9R27Ml9BriKxx6ltButnwSOVYk7dyNhz93GYTTEF3ydh4X7HP2Cv7rh5fbca3s69GXRjOVGmIuuVbaJiaMmiWhBI4LYtqwpo1zGXMjfNlXcMFw7VA4EG2UpkJkcWeyN/AI3ZS/YybcTQNCAg+Xnk94CVys/b5wTuGWRplDrRlNR00MUWpr94+u/xk+sC4/6vT7je2W4GjA1jTq4XmewTEV4cxOu+l1jtHZBgvHho5X0fOogdN52MkjuaXzByZB/Br5xTkBRv0tDf5haX4HzuBC29yU9rt62SEQRzvZxObCCGDcIYR/1HTgjDZkRuwgO/1RoRh5SvwbptvPwpBMvx25S//ZJESLO++lqxjgRZSr/05YpZ5diffEIGd1J0Jz0NGv4XBPcMBnSMKFmdwOy+5jnBbW2OjPQaPslXHEKYTfOByzCA8LgppkxvmL08GIjxYfEljioHR5by+Z6SjG1VvifMFA6FN/+DN6ZH0LmeOMa5YM1Zl3bx5RaANpnSNvi6rmxkQa1oMaK0l482FvpVkg6o1h9si/AeNTEbiX9ozHdjekfuzBSk6Jfo6xw+Q== tvb@empyrean
|
||||||
|
|
@ -0,0 +1 @@
|
||||||
|
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDCKsKkD9S2gRlRgdf3JD06dRTGUQkDgBMWn+2kqVEPA/K1W/f083+odyXLVeg4IWV/fOwVKBgi9YNTavM8hkKRDGElkVq6Y8slApgu1k51QiKvAqqj4yJKE28pMCeHGGfTBdXbaRAaAfsD7Oh7dHOoadBIxUcq4RjN84+srhR2/p7xN+5rlp/uljU85uPA6JhW4tFEjsAQPUBnlI2EMf6SjKScuYsf5kiyE740NxPPpFSaKIU09dR/oR/nXORqOTzJbWC5tRlpeRFrKDrTeoAZnsl+vjqtVjJRIVjJoON50u3W9qfFKcPcfgtqUbpi1D8Xk8cibGo/0I8ruIwuZrD4Q9v1zGUGbXnAVwoJ5Yn8uVcHnFCbqndN+bDA5M0Fe7zLk6/ui9Z3LJdTWD2aT7mTSmW+5puHlNsAnqD1du1Yh7QbJSBNPdJCq/hceb4JKxUpFH8AXZ6km8j4GTYw0BhPYk2OFrFOG/KUOo1Ez8KRGIkisRTqJU2kFhQ5oSKmD+JbtDA5L6X8ibAUNh67eBJUXRvG/AWUeDDoVdYmEj6yCEi5MrcNJY+b41ywa8mTjjEJlsg+oUdD+1RA9c3px+98ulauhyFw2WfUVQc0ihCDqqqXYkwl0jK3e9Uwlgn4Lkwj9jTsWRwalAoJTXwIPbaAiwDH+UhfiPoLl5yHuoFXdw== tvb@palamas
|
||||||
|
|
@ -0,0 +1 @@
|
||||||
|
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDAbmOSvKJoW+akurv/tMD/jfaDuDg0S/FvIMAOS9WauBI9JyMaQh5NfV+fhOSbjqmvrdm+dGttthqi56MZ090Qps1340TGjY6mVap36pa+fZWSajnUjCW+Tk5T0CqbWJkeDvKwSxY73lhBG4QG+SUFkDvhR6XZXfVksJZ++3aaoSmw6E0LCVL4+CAjTf7lm6Zs9Tq62Skf/5tKhk9ASk+QwBTKpPj/0ZKtBDLJfzrwvT+6K2jFohWPKMXkgZiVFVhbIMatdyZo+Mi+To4YDicyf4KW8OuE0zYb06naWeCgEKH8nSB6xEnosdzrhNwkyJi1TEJHmsn1+PjJ/KWWBOTDFVgueWF0ql2ERAtY/hbe36lNBf0lLRzxIugbxMdix8Oqjy0E9wI3E9/X7j0JGHkDzbzX6xeaTwIRFEFtKqK4zcqOMbUWVujUEnOvIKS9dP4uP08gH9HaIE/0bTb+6RRLmnDA9T6dVXc+dCGMAeqxhZYwuO9XJNxXp4byPFRC29OdEShNp9Yqt9sgLMepAzzFiIXgzIcjg5AOnn2qv4SId2rslX0hkMN05a+Cxn2qAj1ign3BuYRzMnaHyA+R+oHN9314/hTYF7wlYws6Fu3P229arfE2d4UqvnMRmY8vWAjfJr40FyRCxS/6qdVPgJWVevkPx69MMJ+BKAomc/s7fw== tvb@stagirite
|
||||||
Loading…
Reference in New Issue