{ pkgs, ... }: { imports = [ ./hardware-configuration.nix ./fileserver.nix ]; boot = { loader = { # Use the extlinux boot loader. (NixOS wants to enable GRUB by default) grub.enable = false; # Enables the generation of /boot/extlinux/extlinux.conf generic-extlinux-compatible.enable = true; }; supportedFilesystems = ["zfs"]; zfs.enableUnstable = true; }; system.stateVersion = "22.11"; # Read the usual warning swapDevices = [ { device = "/swap"; size = 1024; } ]; console.keyMap = "us"; i18n.defaultLocale = "en_US.UTF-8"; environment.systemPackages = with pkgs; let py3-packages = python-packages: with python-packages; [ flask ]; py3-with-packages = python3.withPackages py3-packages; in [ wget vim curl git htop bash tmux psmisc man-pages pv lsof zip unzip py3-with-packages usbutils hdparm sdparm smartmontools gptfdisk gnufdisk dosfstools mkpasswd samba tinc_pre #file-rename rsync rclone gnupg ]; networking = { hostName = "catacomb"; hostId = "beeeeee5"; firewall = { enable = true; allowPing = true; allowedTCPPorts = [ 22 139 445 ]; allowedUDPPorts = [ 137 138 ]; }; }; services.cron = { enable = true; systemCronJobs = let reassertPerms = pkgs.writeShellScript "reassert-nas-permissions.sh" '' ${pkgs.coreutils}/bin/chown -v -R tvb:nas /nas ${pkgs.findutils}/bin/find /nas -type d -exec ${pkgs.coreutils}/bin/chmod -v 750 {} \; ${pkgs.findutils}/bin/find /nas -type f -exec ${pkgs.coreutils}/bin/chmod -v 640 {} \; ''; in [ "0 20 * * 1 root ${reassertPerms}" "0 0 * * 1 tvb . /etc/profile; /home/tvb/gitea-backup" ]; }; services.openssh = { enable = true; passwordAuthentication = true; }; services.ntp = { enable = true; servers = ["time.nist.gov"]; }; services.rsyncd.enable = true; /*services.samba = let sambaShare = path: validUsers: { path = path; comment = "Samba share for ${path}"; browseable = "yes"; "read only" = "no"; "guest okay" = "no"; "create mask" = "0640"; "force create mode" = "0640"; "directory mask" = "0750"; "force directory mode" = "0750"; "valid users" = validUsers; "force group" = ''nas''; }; sambaShareRO = path: validUsers: { path = path; comment = "Read-only Samba share for ${path}"; browseable = "yes"; "read only" = "yes"; "guest okay" = "no"; "valid users" = validUsers; "force group" = ''nas''; }; in { enable = true; securityType = "user"; extraConfig = '' workgroup = beatific server string = Catacomb Nix SMB netbios name = catacomb deadtime = 300 local master = yes domain master = yes preferred master = yes guest account = nobody map to guest = bad user case sensitive = yes veto files = /^.DS_Store$/^.Trash-1000$/ load printers = no printcap name = /dev/null printing = bsd log file = /var/log/samba/client-%m.log log level = 2 max log size = 64 hide dot files = no hosts allow = 10.7.3. map archive = no unix extensions = yes ntlm auth = yes ''; shares = { audioRO = sambaShareRO "/nas/audio" ''@nas''; docRO = sambaShareRO "/nas/doc/" ''@nas''; gameRO = sambaShareRO "/nas/game/" ''@nas''; imageRO = sambaShareRO "/nas/image" ''@nas''; videoRO = sambaShareRO "/nas/video" ''@nas''; #audio = sambaShare "/nas/audio" ''@nas''; #doc = sambaShare "/nas/doc/" ''@nas''; #game = sambaShare "/nas/game/" ''@nas''; #image = sambaShare "/nas/image" ''@nas''; #video = sambaShare "/nas/video" ''@nas''; }; };*/ services.nebula.networks.beatific = { enable = true; # Network certificate and host credentials ca = "/etc/nebula/beatific/beatific.crt"; cert = "/etc/nebula/beatific/catacomb.crt"; key = "/etc/nebula/beatific/catacomb.key"; listen.port = 4242; # Connect to the lighthouse at empyrean # Note that this is a VPN address, not a public address lighthouses = [ "10.22.20.1" ]; # Map the lighthouse address to its public address staticHostMap = { "10.22.20.1" = [ "vpn.alogoulogoi.com:4242" ]; }; # Don't filter anything at the VPN level firewall.outbound = [ { port = "any"; proto = "any"; host = "any"; } ]; firewall.inbound = [ { port = "any"; proto = "any"; host = "any"; } ]; settings = { # Enable UDP holepunching both ways, which allows nodes to establish more direct connections with each other punchy = { punch = true; response = true; }; }; }; services.zfs = { autoScrub = { enable = true; pools = ["catapool"]; interval = "monthly"; }; }; users.groups = { nas = { gid = 1600; }; }; users.users.tvb = { isNormalUser = true; uid = 1001; password = "badpassword"; extraGroups = ["wheel" "nas"]; openssh.authorizedKeys.keyFiles = [ ../../keys/tvb.palamas.pub ../../keys/tvb.stagirite.pub ../../keys/tvb.vagrant.pub ../../keys/monitor.isidore.pub ../../keys/inquisitor.conduit.pub ]; }; #./keys/tvb.empyrean.pub nix.settings.cores = 4; nix.extraOptions = "experimental-features = nix-command flakes"; }