Compare commits
1 Commits
feature/ho
...
a816a24a46
| Author | SHA1 | Date | |
|---|---|---|---|
a816a24a46
|
12
flake.lock
generated
12
flake.lock
generated
@@ -23,11 +23,11 @@
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1737057290,
|
||||
"narHash": "sha256-3Pe0yKlCc7EOeq1X/aJVDH0CtNL+tIBm49vpepwL1MQ=",
|
||||
"lastModified": 1736730523,
|
||||
"narHash": "sha256-mvTZ7fLKA6ggGnA8GZwcXV57EvVReRTCfi26xc08Q3g=",
|
||||
"owner": "nix-community",
|
||||
"repo": "nixos-generators",
|
||||
"rev": "d002ce9b6e7eb467cd1c6bb9aef9c35d191b5453",
|
||||
"rev": "74b8e31dd709760c86eed16b6c1d0b88d7360937",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -38,11 +38,11 @@
|
||||
},
|
||||
"nixpkgs": {
|
||||
"locked": {
|
||||
"lastModified": 1738142207,
|
||||
"narHash": "sha256-NGqpVVxNAHwIicXpgaVqJEJWeyqzoQJ9oc8lnK9+WC4=",
|
||||
"lastModified": 1736701207,
|
||||
"narHash": "sha256-jG/+MvjVY7SlTakzZ2fJ5dC3V1PrKKrUEOEE30jrOKA=",
|
||||
"owner": "NixOS",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "9d3ae807ebd2981d593cddd0080856873139aa40",
|
||||
"rev": "ed4a395ea001367c1f13d34b1e01aa10290f67d6",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
|
||||
16
flake.nix
16
flake.nix
@@ -9,13 +9,9 @@
|
||||
url = "github:nix-community/nixos-generators";
|
||||
inputs.nixpkgs.follows = "nixpkgs";
|
||||
};
|
||||
home-manager = {
|
||||
url = "github:nix-community/home-manager";
|
||||
inputs.nixpkgs.follows = "nixpkgs";
|
||||
};
|
||||
};
|
||||
|
||||
outputs = { self, nixpkgs, nixos-generators, home-manager }: {
|
||||
outputs = { self, nixpkgs, nixos-generators }: {
|
||||
nixosConfigurations = {
|
||||
Yura-PC = nixpkgs.lib.nixosSystem {
|
||||
system = "x86_64-linux";
|
||||
@@ -31,16 +27,6 @@
|
||||
./modules
|
||||
./hosts/common.nix
|
||||
./hosts/vm
|
||||
|
||||
home-manager.nixosModules.home-manager
|
||||
{
|
||||
home-manager.useGlobalPkgs = true;
|
||||
home-manager.useUserPackages = true;
|
||||
home-manager.users.jdoe = import ./home.nix;
|
||||
|
||||
# Optionally, use home-manager.extraSpecialArgs to pass
|
||||
# arguments to home.nix
|
||||
}
|
||||
];
|
||||
};
|
||||
router = nixpkgs.lib.nixosSystem {
|
||||
|
||||
@@ -23,16 +23,10 @@
|
||||
"sysrq_always_enabled=1"
|
||||
];
|
||||
|
||||
# https://nixos.wiki/wiki/OSX-KVM
|
||||
boot.extraModprobeConfig = ''
|
||||
options kvm_amd nested=1
|
||||
options kvm_amd emulate_invalid_guest_state=0
|
||||
options kvm ignore_msrs=1
|
||||
'';
|
||||
|
||||
boot.loader.timeout = 3;
|
||||
boot.loader.systemd-boot.configurationLimit = 5;
|
||||
boot.kernelPackages = pkgs.linuxKernel.packages.linux_6_12;
|
||||
boot.extraModulePackages = with config.boot.kernelPackages; [ zfs ];
|
||||
|
||||
# https://nixos.wiki/wiki/Accelerated_Video_Playback
|
||||
hardware.graphics = {
|
||||
@@ -110,7 +104,6 @@
|
||||
group = "cazzzer";
|
||||
extraGroups = [ "networkmanager" "wheel" "docker" "wireshark" "geoclue" ];
|
||||
packages = with pkgs; [
|
||||
# Python
|
||||
python3
|
||||
poetry
|
||||
|
||||
@@ -122,9 +115,6 @@
|
||||
nodejs_22
|
||||
pnpm
|
||||
bun
|
||||
|
||||
# Nix
|
||||
nixd
|
||||
];
|
||||
};
|
||||
|
||||
@@ -154,6 +144,7 @@
|
||||
virtualisation.docker.package = pkgs.docker_27;
|
||||
virtualisation.docker.storageDriver = "zfs";
|
||||
|
||||
|
||||
# https://discourse.nixos.org/t/firefox-does-not-use-kde-window-decorations-and-cursor/32132/3
|
||||
# programs.dconf.enable = true;
|
||||
# programs.firefox = {
|
||||
@@ -180,6 +171,31 @@
|
||||
|
||||
# For JetBrains stuff
|
||||
# https://github.com/NixOS/nixpkgs/issues/240444
|
||||
curl
|
||||
expat
|
||||
fontconfig
|
||||
freetype
|
||||
fuse
|
||||
fuse3
|
||||
glib
|
||||
icu
|
||||
libclang.lib
|
||||
libdbusmenu
|
||||
libsecret
|
||||
libxcrypt-legacy
|
||||
libxml2
|
||||
nss
|
||||
openssl
|
||||
python3
|
||||
stdenv.cc.cc
|
||||
xorg.libX11
|
||||
xorg.libXcursor
|
||||
xorg.libXext
|
||||
xorg.libXi
|
||||
xorg.libXrender
|
||||
xorg.libXtst
|
||||
xz
|
||||
zlib
|
||||
];
|
||||
|
||||
# attempt to fix flatpak firefox cjk fonts
|
||||
|
||||
@@ -1,11 +1,4 @@
|
||||
{ config, pkgs, inputs, ... }: {
|
||||
imports = [
|
||||
inputs.home-manager.nixosModules.home-manager
|
||||
];
|
||||
|
||||
home-manager.useGlobalPkgs = true;
|
||||
home-manager.useUserPackages = true;
|
||||
|
||||
{ config, pkgs, ... }: {
|
||||
# Allow unfree packages
|
||||
nixpkgs.config.allowUnfree = true;
|
||||
|
||||
|
||||
@@ -1,109 +1,96 @@
|
||||
# Edit this configuration file to define what should be installed on
|
||||
# your system. Help is available in the configuration.nix(5) man page
|
||||
# and in the NixOS manual (accessible by running ‘nixos-help’).
|
||||
|
||||
{ config, lib, pkgs, ... }:
|
||||
|
||||
let
|
||||
domain = "cazzzer.com";
|
||||
ldomain = "l.${domain}";
|
||||
|
||||
if_wan = "wan";
|
||||
if_lan = "lan";
|
||||
if_lan10 = "lan.10";
|
||||
if_lan20 = "lan.20";
|
||||
|
||||
wan_ip4 = "192.168.1.61/24";
|
||||
wan_gw4 = "192.168.1.254";
|
||||
|
||||
lan_p4 = "10.19.1"; # .0/24
|
||||
lan10_p4 = "10.19.10"; # .0/24
|
||||
lan20_p4 = "10.19.20"; # .0/24
|
||||
|
||||
pd_from_wan = ""; # ::/60
|
||||
lan_p6 = "${pd_from_wan}9"; # ::/64
|
||||
lan10_p6 = "${pd_from_wan}a"; # ::/64
|
||||
lan20_p6 = "${pd_from_wan}2"; # ::/64
|
||||
|
||||
ula_p = "fdab:07d3:581d"; # ::/48
|
||||
lan_ula_p = "${ula_p}:0001"; # ::/64
|
||||
lan10_ula_p = "${ula_p}:0010"; # ::/64
|
||||
lan20_ula_p = "${ula_p}:0020"; # ::/64
|
||||
lan_ula_addr = "${lan_ula_p}::1";
|
||||
lan10_ula_addr = "${lan10_ula_p}::1";
|
||||
lan20_ula_addr = "${lan20_ula_p}::1";
|
||||
lan_ip6 = "fd97:530d:73ec:f00::";
|
||||
in
|
||||
{
|
||||
imports =
|
||||
[ # Include the results of the hardware scan.
|
||||
./hardware-configuration.nix
|
||||
];
|
||||
mods.kb-input.enable = false;
|
||||
boot.growPartition = true;
|
||||
|
||||
# Bootloader.
|
||||
boot.loader.systemd-boot.enable = true;
|
||||
boot.loader.efi.canTouchEfiVariables = false;
|
||||
boot.loader.efi.canTouchEfiVariables = true;
|
||||
boot.plymouth.enable = true;
|
||||
boot.plymouth.theme = "breeze";
|
||||
boot.kernelParams = [
|
||||
"sysrq_always_enabled=1"
|
||||
];
|
||||
|
||||
boot.loader.systemd-boot.configurationLimit = 5;
|
||||
boot.kernelPackages = pkgs.linuxKernel.packages.linux_6_12;
|
||||
boot.growPartition = true;
|
||||
boot.extraModulePackages = with config.boot.kernelPackages; [ zfs ];
|
||||
|
||||
environment.etc.hosts.mode = "0644";
|
||||
networking.hostName = "grouter";
|
||||
|
||||
# It is impossible to do multiple prefix requests with networkd,
|
||||
# so I use dhcpcd for this
|
||||
# managed by cloud-init
|
||||
# networking.hostName = "nixos"; # Define your hostname.
|
||||
# networking.wireless.enable = true; # Enables wireless support via wpa_supplicant.
|
||||
|
||||
# Configure network proxy if necessary
|
||||
# networking.proxy.default = "http://user:password@proxy:port/";
|
||||
# networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";
|
||||
|
||||
# Enable networking
|
||||
# networking.networkmanager.enable = true;
|
||||
|
||||
# It is impossible to do multiple prefix requests with networkd
|
||||
# https://github.com/systemd/systemd/issues/22571
|
||||
networking.dhcpcd.enable = true;
|
||||
# https://github.com/systemd/systemd/issues/22571#issuecomment-2094905496
|
||||
# https://gist.github.com/csamsel/0f8cca3b2e64d7e4cc47819ec5ba9396
|
||||
networking.dhcpcd.extraConfig = ''
|
||||
# script /bin/true
|
||||
duid
|
||||
nodelay
|
||||
ipv6only
|
||||
# noarp
|
||||
# nodhcp
|
||||
nodhcp6
|
||||
# noipv4
|
||||
# noipv4ll
|
||||
noipv6rs
|
||||
|
||||
nohook resolv.conf, yp, hostname, ntp
|
||||
|
||||
option rapid_commit
|
||||
|
||||
interface ${if_wan}
|
||||
interface wan
|
||||
ipv6rs
|
||||
# ipv6ra_noautoconf
|
||||
dhcp6
|
||||
|
||||
# this doesn't play well with networkd
|
||||
# ia_na
|
||||
# ia_pd 1 ${if_lan}/0
|
||||
# ia_pd 2 ${if_lan10}/0
|
||||
# ia_pd 3 ${if_lan20}/0
|
||||
|
||||
# request the leases just for routing (so that the att box knows we're here)
|
||||
# actual ip assignments are static, based on $pd_from_wan
|
||||
ia_pd 1 -
|
||||
ia_pd 2 -
|
||||
# ia_pd 3 -
|
||||
# ia_pd 4 -
|
||||
# ia_pd 5 -
|
||||
# ia_pd 6 -
|
||||
# ia_pd 7 -
|
||||
# ia_pd 8 -
|
||||
# iaid 1
|
||||
# ia_na 0
|
||||
ia_na
|
||||
ia_pd 1 lan/0
|
||||
ia_pd 2 lan.10/0
|
||||
ia_pd 3 lan.20/0
|
||||
'';
|
||||
|
||||
networking.useNetworkd = true;
|
||||
systemd.network.enable = true;
|
||||
systemd.network = {
|
||||
# Global options
|
||||
config.networkConfig = {
|
||||
IPv4Forwarding = true;
|
||||
IPv6Forwarding = true;
|
||||
};
|
||||
|
||||
# This is applied by udev, not networkd
|
||||
# https://nixos.wiki/wiki/Systemd-networkd
|
||||
# https://nixos.org/manual/nixos/stable/#sec-rename-ifs
|
||||
links = {
|
||||
"10-wan" = {
|
||||
# matchConfig.Name = "enp6s18";
|
||||
matchConfig.PermanentMACAddress = "bc:24:11:4f:c9:c4";
|
||||
linkConfig.Name = if_wan;
|
||||
linkConfig.Name = "wan";
|
||||
};
|
||||
"10-lan" = {
|
||||
# matchConfig.Name = "enp6s18";
|
||||
matchConfig.PermanentMACAddress = "bc:24:11:83:d8:de";
|
||||
linkConfig.Name = if_lan;
|
||||
linkConfig.Name = "lan";
|
||||
};
|
||||
};
|
||||
|
||||
@@ -111,14 +98,14 @@ in
|
||||
"10-vlan10" = {
|
||||
netdevConfig = {
|
||||
Kind = "vlan";
|
||||
Name = if_lan10;
|
||||
Name = "lan.10";
|
||||
};
|
||||
vlanConfig.Id = 10;
|
||||
};
|
||||
"10-vlan20" = {
|
||||
netdevConfig = {
|
||||
Kind = "vlan";
|
||||
Name = if_lan20;
|
||||
Name = "lan.20";
|
||||
};
|
||||
vlanConfig.Id = 20;
|
||||
};
|
||||
@@ -126,212 +113,81 @@ in
|
||||
|
||||
networks = {
|
||||
"10-wan" = {
|
||||
matchConfig.Name = if_wan;
|
||||
matchConfig.Name = "wan";
|
||||
networkConfig = {
|
||||
# start a DHCP Client for IPv4 Addressing/Routing
|
||||
# DHCP = "ipv4";
|
||||
DHCP = "ipv4";
|
||||
# accept Router Advertisements for Stateless IPv6 Autoconfiguraton (SLAAC)
|
||||
# let dhcpcd handle this
|
||||
Address = [ wan_ip4 ];
|
||||
# let dhcpcd manage this
|
||||
IPv6AcceptRA = false;
|
||||
};
|
||||
routes = [ { Gateway = wan_gw4; } ];
|
||||
# make routing on this interface a dependency for network-online.target
|
||||
linkConfig.RequiredForOnline = "routable";
|
||||
|
||||
};
|
||||
"20-lan" = {
|
||||
matchConfig.Name = "lan";
|
||||
vlan = [
|
||||
if_lan10
|
||||
if_lan20
|
||||
"lan.10"
|
||||
"lan.20"
|
||||
];
|
||||
networkConfig = {
|
||||
IPv4Forwarding = true;
|
||||
IPv6SendRA = true;
|
||||
Address = [ "${lan_p4}.1/24" ];
|
||||
};
|
||||
ipv6Prefixes = [
|
||||
{
|
||||
# AddressAutoconfiguration = false;
|
||||
Prefix = "${lan_p6}::/64";
|
||||
Assign = true;
|
||||
# Token = [ "static:::1" "eui64" ];
|
||||
Token = [ "static:::1" ];
|
||||
}
|
||||
{
|
||||
Prefix = "${lan_ula_p}::/64";
|
||||
Assign = true;
|
||||
Token = [ "static:::1" ];
|
||||
}
|
||||
];
|
||||
ipv6SendRAConfig = {
|
||||
Managed = true;
|
||||
OtherInformation = true;
|
||||
EmitDNS = true;
|
||||
DNS = [ lan_ula_addr ];
|
||||
Address = [ "10.19.1.1/24" ];
|
||||
# IPMasquerade = "ipv4";
|
||||
IPMasquerade = "both";
|
||||
# DHCPServer = true;
|
||||
# DHCPPrefixDelegation = true;
|
||||
};
|
||||
# dhcpServerConfig = {
|
||||
# PoolOffset = 100;
|
||||
# PoolSize = 100;
|
||||
# };
|
||||
# dhcpPrefixDelegationConfig = {
|
||||
# UplinkInterface = "enp6s18";
|
||||
# SubnetId = 0;
|
||||
# Token = "static:::1";
|
||||
# };
|
||||
};
|
||||
"30-vlan10" = {
|
||||
matchConfig.Name = if_lan10;
|
||||
matchConfig.Name = "lan.10";
|
||||
networkConfig = {
|
||||
IPv6SendRA = true;
|
||||
Address = [ "${lan10_p4}.1/24" ];
|
||||
};
|
||||
ipv6Prefixes = [
|
||||
{
|
||||
Prefix = "${lan10_p6}::/64";
|
||||
Assign = true;
|
||||
Token = [ "static:::1" ];
|
||||
}
|
||||
{
|
||||
Prefix = "${lan10_ula_p}::/64";
|
||||
Assign = true;
|
||||
Token = [ "static:::1" ];
|
||||
}
|
||||
];
|
||||
};
|
||||
"30-vlan20" = {
|
||||
matchConfig.Name = if_lan20;
|
||||
matchConfig.Name = "lan.20";
|
||||
networkConfig = {
|
||||
IPv6SendRA = true;
|
||||
Address = [ "${lan20_p4}.1/24" ];
|
||||
};
|
||||
ipv6Prefixes = [
|
||||
{
|
||||
Prefix = "${lan20_p6}::/64";
|
||||
Assign = true;
|
||||
Token = [ "static:::1" ];
|
||||
}
|
||||
{
|
||||
Prefix = "${lan20_ula_p}::/64";
|
||||
Assign = true;
|
||||
Token = [ "static:::1" ];
|
||||
}
|
||||
];
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
networking.firewall.enable = false;
|
||||
networking.nftables.enable = true;
|
||||
networking.nftables.tables.firewall = {
|
||||
family = "inet";
|
||||
content = ''
|
||||
define WAN_IF = "${if_wan}"
|
||||
define LAN_IF = "${if_lan}"
|
||||
define LAN_IPV4_SUBNET = ${lan_p4}.0/24
|
||||
define LAN_IPV6_SUBNET = ${lan_p6}::/64
|
||||
define LAN_IPV6_ULA = ${lan_ula_p}::/64
|
||||
define LAN_IPV4_HOST = ${lan_p4}.100
|
||||
define LAN_IPV6_HOST = ${lan_p6}::1:1000
|
||||
|
||||
define ALLOWED_TCP_PORTS = { ssh, https, 19999 }
|
||||
define ALLOWED_UDP_PORTS = { domain }
|
||||
|
||||
chain input {
|
||||
type filter hook input priority filter; policy drop;
|
||||
|
||||
# Allow established and related connections
|
||||
ct state established,related accept
|
||||
|
||||
# Allow all traffic from loopback interface
|
||||
iifname lo accept
|
||||
|
||||
# Allow ICMPv6 on link local addrs
|
||||
ip6 nexthdr icmpv6 ip6 saddr fe80::/10 accept
|
||||
ip6 nexthdr icmpv6 ip6 daddr fe80::/10 accept # TODO: not sure if necessary
|
||||
|
||||
# Allow all ICMPv6 from LAN
|
||||
iifname $LAN_IF ip6 saddr { $LAN_IPV6_SUBNET, $LAN_IPV6_ULA } ip6 nexthdr icmpv6 accept
|
||||
# Allow DHCPv6 client traffic
|
||||
ip6 daddr { fe80::/10, ff02::/16 } udp dport dhcpv6-server accept
|
||||
|
||||
# Allow all ICMP from LAN
|
||||
iifname $LAN_IF ip saddr $LAN_IPV4_SUBNET ip protocol icmp accept
|
||||
|
||||
# Allow specific services from LAN
|
||||
iifname $LAN_IF ip saddr $LAN_IPV4_SUBNET tcp dport $ALLOWED_TCP_PORTS accept
|
||||
iifname $LAN_IF ip6 saddr { $LAN_IPV6_SUBNET, $LAN_IPV6_ULA } tcp dport $ALLOWED_TCP_PORTS accept
|
||||
iifname $LAN_IF ip saddr $LAN_IPV4_SUBNET udp dport $ALLOWED_UDP_PORTS accept
|
||||
iifname $LAN_IF ip6 saddr { $LAN_IPV6_SUBNET, $LAN_IPV6_ULA } udp dport $ALLOWED_UDP_PORTS accept
|
||||
|
||||
# Allow SSH from WAN (if needed)
|
||||
iifname $WAN_IF tcp dport ssh accept
|
||||
}
|
||||
|
||||
chain forward {
|
||||
type filter hook forward priority filter; policy drop;
|
||||
|
||||
# Allow established and related connections
|
||||
ct state established,related accept
|
||||
|
||||
# Port forwarding
|
||||
iifname $WAN_IF tcp dport https ip daddr $LAN_IPV4_HOST accept
|
||||
|
||||
# Allowed IPv6 ports
|
||||
iifname $WAN_IF tcp dport https ip6 daddr $LAN_IPV6_HOST accept
|
||||
|
||||
# Allow traffic from LAN to WAN
|
||||
iifname $LAN_IF ip saddr $LAN_IPV4_SUBNET oifname $WAN_IF accept
|
||||
iifname $LAN_IF ip6 saddr $LAN_IPV6_SUBNET oifname $WAN_IF accept
|
||||
}
|
||||
|
||||
chain output {
|
||||
# Accept anything out of self by default
|
||||
type filter hook output priority filter; policy accept;
|
||||
}
|
||||
|
||||
chain prerouting {
|
||||
# Initial step, accept by default
|
||||
type nat hook prerouting priority dstnat; policy accept;
|
||||
|
||||
# Port forwarding
|
||||
iifname $WAN_IF tcp dport https dnat ip to $LAN_IPV4_HOST
|
||||
}
|
||||
|
||||
chain postrouting {
|
||||
# Last step, accept by default
|
||||
type nat hook postrouting priority srcnat; policy accept;
|
||||
|
||||
# Masquerade LAN addrs
|
||||
# theoretically shouldn't need to check the input interface here,
|
||||
# as it would be filtered by the forwarding rules
|
||||
oifname $WAN_IF ip saddr $LAN_IPV4_SUBNET masquerade
|
||||
|
||||
# Optional IPv6 masquerading (big L if enabled)
|
||||
# oifname $WAN_IF ip6 saddr $LAN_IPV6_ULA masquerade
|
||||
}
|
||||
'';
|
||||
};
|
||||
|
||||
services.kea.dhcp4.enable = true;
|
||||
services.kea.dhcp4.settings = {
|
||||
interfaces-config.interfaces = [
|
||||
if_lan
|
||||
interfaces-config = {
|
||||
interfaces = [
|
||||
"lan"
|
||||
];
|
||||
dhcp-ddns.enable-updates = true;
|
||||
ddns-qualifying-suffix = "default.${ldomain}";
|
||||
};
|
||||
lease-database = {
|
||||
type = "memfile";
|
||||
persist = true;
|
||||
};
|
||||
subnet4 = [
|
||||
{
|
||||
id = 1;
|
||||
subnet = "${lan_p4}.0/24";
|
||||
ddns-qualifying-suffix = "lan.${ldomain}";
|
||||
pools = [ { pool = "${lan_p4}.100 - ${lan_p4}.199"; } ];
|
||||
subnet = "10.19.1.0/24";
|
||||
pools = [ { pool = "10.19.1.100 - 10.19.1.199"; } ];
|
||||
option-data = [
|
||||
{
|
||||
name = "routers";
|
||||
data = "${lan_p4}.1";
|
||||
data = "10.19.1.1";
|
||||
}
|
||||
{
|
||||
name = "domain-name-servers";
|
||||
data = "${lan_p4}.1";
|
||||
}
|
||||
];
|
||||
reservations = [
|
||||
{
|
||||
hw-address = "bc:24:11:b7:27:4d";
|
||||
hostname = "archy";
|
||||
ip-address = "${lan_p4}.69";
|
||||
data = "1.1.1.1";
|
||||
}
|
||||
];
|
||||
}
|
||||
@@ -340,177 +196,41 @@ in
|
||||
|
||||
services.kea.dhcp6.enable = true;
|
||||
services.kea.dhcp6.settings = {
|
||||
interfaces-config.interfaces = [
|
||||
if_lan
|
||||
interfaces-config = {
|
||||
interfaces = [
|
||||
"lan"
|
||||
];
|
||||
# TODO: https://kea.readthedocs.io/en/latest/arm/ddns.html#dual-stack-environments
|
||||
dhcp-ddns.enable-updates = true;
|
||||
ddns-qualifying-suffix = "default6.${ldomain}";
|
||||
};
|
||||
lease-database = {
|
||||
type = "memfile";
|
||||
persist = true;
|
||||
};
|
||||
subnet6 = [
|
||||
{
|
||||
id = 1;
|
||||
interface = if_lan;
|
||||
subnet = "${lan_p6}::/64";
|
||||
ddns-qualifying-suffix = "lan6.${ldomain}";
|
||||
rapid-commit = true;
|
||||
pools = [ { pool = "${lan_p6}::1:1000/116"; } ];
|
||||
reservations = [
|
||||
{
|
||||
duid = "00:04:59:c3:ce:9a:08:cf:fb:b7:fe:74:9c:e3:b7:44:bf:01";
|
||||
hostname = "archy";
|
||||
ip-addresses = [ "${lan_p6}::69" ];
|
||||
}
|
||||
subnet = "${lan_ip6}/64";
|
||||
pools = [ { pool = "${lan_ip6}1:1000/116"; } ];
|
||||
option-data = [
|
||||
];
|
||||
}
|
||||
];
|
||||
};
|
||||
|
||||
services.kea.dhcp-ddns.enable = true;
|
||||
services.kea.dhcp-ddns.settings = {
|
||||
forward-ddns = {
|
||||
ddns-domains = [
|
||||
{
|
||||
name = "${ldomain}.";
|
||||
dns-servers = [
|
||||
{
|
||||
ip-address = "::1";
|
||||
port = 1053;
|
||||
}
|
||||
];
|
||||
}
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
services.resolved.enable = false;
|
||||
networking.resolvconf.enable = true;
|
||||
networking.resolvconf.useLocalResolver = true;
|
||||
|
||||
services.adguardhome.enable = true;
|
||||
services.adguardhome.mutableSettings = false;
|
||||
services.adguardhome.settings = {
|
||||
dns = {
|
||||
bootstrap_dns = [ "1.1.1.1" "9.9.9.9" ];
|
||||
upstream_dns = [
|
||||
"quic://p0.freedns.controld.com" # Default upstream
|
||||
"[/${ldomain}/][::1]:1053" # Local domains to Knot (ddns)
|
||||
];
|
||||
};
|
||||
# https://adguard-dns.io/kb/general/dns-filtering-syntax/
|
||||
user_rules = [
|
||||
# DNS rewrites
|
||||
"|grouter.${domain}^$dnsrewrite=${lan_ula_addr}"
|
||||
|
||||
# Allowed exceptions
|
||||
"@@||googleads.g.doubleclick.net"
|
||||
];
|
||||
};
|
||||
|
||||
services.knot.enable = true;
|
||||
services.knot.settings = {
|
||||
server = {
|
||||
# listen = "0.0.0.0@1053";
|
||||
listen = "::1@1053";
|
||||
};
|
||||
# TODO: templates
|
||||
zone = [
|
||||
{
|
||||
domain = ldomain;
|
||||
storage = "/var/lib/knot/zones";
|
||||
file = "${ldomain}.zone";
|
||||
acl = [ "allow_localhost_update" ];
|
||||
}
|
||||
];
|
||||
acl = [
|
||||
{
|
||||
id = "allow_localhost_update";
|
||||
address = [ "::1" "127.0.0.1" ];
|
||||
action = [ "update" ];
|
||||
}
|
||||
];
|
||||
};
|
||||
# Ensure the zone file exists
|
||||
system.activationScripts.knotZoneFile = ''
|
||||
ZONE_DIR="/var/lib/knot/zones"
|
||||
ZONE_FILE="$ZONE_DIR/${ldomain}.zone"
|
||||
|
||||
# Create the directory if it doesn't exist
|
||||
mkdir -p "$ZONE_DIR"
|
||||
|
||||
# Check if the zone file exists
|
||||
if [ ! -f "$ZONE_FILE" ]; then
|
||||
# Create the zone file with a basic SOA record
|
||||
# Serial; Refresh; Retry; Expire; Negative Cache TTL;
|
||||
echo "${ldomain}. 3600 SOA ns.${ldomain}. admin.${ldomain}. 1 86400 900 691200 3600" > "$ZONE_FILE"
|
||||
echo "Created new zone file: $ZONE_FILE"
|
||||
else
|
||||
echo "Zone file already exists: $ZONE_FILE"
|
||||
fi
|
||||
|
||||
# Ensure proper ownership and permissions
|
||||
chown -R knot:knot "/var/lib/knot"
|
||||
chmod 644 "$ZONE_FILE"
|
||||
'';
|
||||
|
||||
# https://wiki.nixos.org/wiki/Prometheus
|
||||
services.prometheus = {
|
||||
enable = true;
|
||||
exporters = {
|
||||
# TODO: DNS, Kea, Knot, other exporters
|
||||
node = {
|
||||
enable = true;
|
||||
enabledCollectors = [ "systemd" ];
|
||||
};
|
||||
};
|
||||
scrapeConfigs = [
|
||||
{
|
||||
job_name = "node";
|
||||
static_configs = [{
|
||||
targets = [ "localhost:${toString config.services.prometheus.exporters.node.port}" ];
|
||||
}];
|
||||
}
|
||||
];
|
||||
};
|
||||
|
||||
# https://wiki.nixos.org/wiki/Grafana#Declarative_configuration
|
||||
services.grafana = {
|
||||
enable = true;
|
||||
settings.server.http_port = 3001;
|
||||
provision = {
|
||||
enable = true;
|
||||
datasources.settings.datasources = [
|
||||
{
|
||||
name = "Prometheus";
|
||||
type = "prometheus";
|
||||
url = "http://localhost:${toString config.services.prometheus.port}";
|
||||
}
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
services.caddy = {
|
||||
enable = true;
|
||||
virtualHosts."grouter.${domain}".extraConfig = ''
|
||||
reverse_proxy localhost:${toString config.services.grafana.settings.server.http_port}
|
||||
tls internal
|
||||
'';
|
||||
};
|
||||
|
||||
# services.netdata.enable = true;
|
||||
services.netdata.enable = true;
|
||||
|
||||
# Enable the X11 windowing system.
|
||||
# You can disable this if you're only using the Wayland session.
|
||||
services.xserver.enable = false;
|
||||
|
||||
# Enable the KDE Plasma Desktop Environment.
|
||||
# Useful for debugging with wireshark.
|
||||
services.displayManager.sddm.enable = false;
|
||||
services.displayManager.sddm.enable = true;
|
||||
services.displayManager.sddm.wayland.enable = true;
|
||||
services.desktopManager.plasma6.enable = true;
|
||||
# No need for audio in VM
|
||||
services.pipewire.enable = false;
|
||||
services.flatpak.enable = true;
|
||||
|
||||
# VM services
|
||||
services.cloud-init.enable = true;
|
||||
# services.cloud-init.network.enable = false;
|
||||
services.qemuGuest.enable = true;
|
||||
services.spice-vdagentd.enable = true;
|
||||
services.openssh.enable = true;
|
||||
@@ -537,35 +257,54 @@ in
|
||||
extraGroups = [ "wheel" "docker" "wireshark" ];
|
||||
};
|
||||
|
||||
# Install firefox.
|
||||
programs.firefox.enable = true;
|
||||
programs.fish.enable = true;
|
||||
programs.git.enable = true;
|
||||
programs.neovim.enable = true;
|
||||
|
||||
programs.bat.enable = true;
|
||||
programs.htop.enable = true;
|
||||
programs.wireshark.enable = true;
|
||||
programs.wireshark.package = pkgs.wireshark; # wireshark-cli by default
|
||||
|
||||
# List packages installed in system profile. To search, run:
|
||||
# $ nix search wget
|
||||
|
||||
# https://github.com/flatpak/flatpak/issues/2861
|
||||
xdg.portal.extraPortals = [ pkgs.xdg-desktop-portal-gtk ];
|
||||
|
||||
# workarounds.flatpak.enable = true;
|
||||
fonts.packages = with pkgs; [
|
||||
noto-fonts-cjk-sans
|
||||
noto-fonts-cjk-serif
|
||||
fantasque-sans-mono
|
||||
nerd-fonts.fantasque-sans-mono
|
||||
jetbrains-mono
|
||||
];
|
||||
|
||||
environment.systemPackages = with pkgs; [
|
||||
dust
|
||||
eza
|
||||
fastfetch
|
||||
fd
|
||||
host-spawn # for flatpaks
|
||||
kdePackages.flatpak-kcm
|
||||
kdePackages.filelight
|
||||
kdePackages.kate
|
||||
kdePackages.yakuake
|
||||
ldns
|
||||
lsof
|
||||
micro
|
||||
mpv
|
||||
ripgrep
|
||||
rustscan
|
||||
starship
|
||||
tealdeer
|
||||
waypipe
|
||||
whois
|
||||
zfs
|
||||
];
|
||||
|
||||
# networking.firewall.enable = false;
|
||||
|
||||
# This value determines the NixOS release from which the default
|
||||
# settings for stateful data, like file locations and database versions
|
||||
# on your system were taken. It‘s perfectly fine and recommended to leave
|
||||
|
||||
@@ -22,6 +22,7 @@
|
||||
|
||||
boot.loader.systemd-boot.configurationLimit = 5;
|
||||
boot.kernelPackages = pkgs.linuxKernel.packages.linux_6_12;
|
||||
boot.extraModulePackages = with config.boot.kernelPackages; [ zfs ];
|
||||
|
||||
environment.etc.hosts.mode = "0644";
|
||||
|
||||
|
||||
@@ -24,7 +24,7 @@ in {
|
||||
aggregated = pkgs.buildEnv {
|
||||
name = "system-fonts-and-icons";
|
||||
paths = builtins.attrValues {
|
||||
inherit (pkgs.kdePackages) breeze;
|
||||
inherit (pkgs.libsForQt5) breeze-qt5;
|
||||
inherit
|
||||
(pkgs)
|
||||
noto-fonts
|
||||
|
||||
Reference in New Issue
Block a user