Andrea Ciceri
759b200b45
- `foot` fonts and background color - `helix` editor - `pass` related aliases in shell - `nix-index` automatic update - `sway`/`waybar` changes - new `beebox` host - `kodi` module - `coredns` for `hs`
397 lines
10 KiB
Nix
397 lines
10 KiB
Nix
{
|
|
fleetModules,
|
|
pkgs,
|
|
lib,
|
|
config,
|
|
...
|
|
}: {
|
|
imports =
|
|
[
|
|
./hardware-configuration.nix
|
|
]
|
|
++ fleetModules [
|
|
"common"
|
|
"ccr"
|
|
"ssh"
|
|
];
|
|
|
|
ccr = {
|
|
enable = true;
|
|
modules = [
|
|
"shell"
|
|
"git"
|
|
];
|
|
packages = [];
|
|
extraGroups = [
|
|
"wheel"
|
|
"fuse"
|
|
"networkmanager"
|
|
];
|
|
};
|
|
|
|
systemd.services.standby-sdb = {
|
|
description = "Set spindown time (sleep) for /dev/sdb ";
|
|
wantedBy = ["multi-user.target"];
|
|
serviceConfig = {
|
|
Type = "oneshot";
|
|
ExecStart = "${pkgs.hdparm}/bin/hdparm -B 127 -S 241 /dev/sdb";
|
|
};
|
|
};
|
|
|
|
systemd.services.standby-sdc = {
|
|
description = "Set spindown time (sleep) for /dev/sdc ";
|
|
wantedBy = ["multi-user.target"];
|
|
serviceConfig = {
|
|
Type = "oneshot";
|
|
ExecStart = "${pkgs.hdparm}/bin/hdparm -B 127 -S 241 /dev/sdc";
|
|
};
|
|
};
|
|
|
|
systemd.services.amuled.serviceConfig.Restart = pkgs.lib.mkForce "always";
|
|
|
|
users.users.amule = {
|
|
isNormalUser = false;
|
|
isSystemUser = true;
|
|
group = "amule";
|
|
};
|
|
users.groups."amule" = {};
|
|
|
|
services = {
|
|
samba-wsdd = {
|
|
enable = true;
|
|
workgroup = "WORKGROUP";
|
|
hostname = "nas";
|
|
discovery = true;
|
|
};
|
|
|
|
samba = {
|
|
enable = true;
|
|
securityType = "user";
|
|
extraConfig = ''
|
|
workgroup = WORKGROUP
|
|
server string = nas
|
|
netbios name = nas
|
|
security = user
|
|
map to guest = bad user
|
|
vfs objects = recycle
|
|
recycle:repository = .recycle
|
|
recycle:keeptree = yes
|
|
recycle:versions = yes
|
|
'';
|
|
shares = {
|
|
archivio = {
|
|
path = "/mnt/archivio/archivio";
|
|
comment = "archivio";
|
|
"force user" = "ccr";
|
|
browseable = "yes";
|
|
writeable = "yes";
|
|
"guest ok" = "yes";
|
|
"read only" = "no";
|
|
};
|
|
film = {
|
|
path = "/mnt/film/film";
|
|
comment = "film";
|
|
"force user" = "ccr";
|
|
browseable = "yes";
|
|
writeable = "yes";
|
|
"guest ok" = "yes";
|
|
"read only" = "no";
|
|
};
|
|
transmission = {
|
|
path = "/mnt/archivio/transmission";
|
|
comment = "transmission";
|
|
"force user" = "transmission";
|
|
browseable = "yes";
|
|
writeable = "yes";
|
|
"guest ok" = "yes";
|
|
"read only" = "no";
|
|
};
|
|
amule = {
|
|
path = "/mnt/archivio/amule";
|
|
comment = "amule";
|
|
"force user" = "ccr";
|
|
browseable = "yes";
|
|
writeable = "yes";
|
|
"guest ok" = "yes";
|
|
"read only" = "no";
|
|
};
|
|
musica = {
|
|
path = "/mnt/film/musica";
|
|
comment = "music";
|
|
"force user" = "ccr";
|
|
browseable = "yes";
|
|
writeable = "no";
|
|
"guest ok" = "yes";
|
|
"read only" = "no";
|
|
};
|
|
};
|
|
};
|
|
|
|
transmission = {
|
|
enable = true;
|
|
# following json is merged to this attrset, it must have `rpc-username` and `rpc-password`
|
|
credentialsFile = "/mnt/archivio/transmission/credentials.json";
|
|
settings = {
|
|
download-dir = "/mnt/archivio/transmission/";
|
|
incomplete-dir = "/mnt/archivio/transmission/.incomplete";
|
|
incomplete-dir-enabled = true;
|
|
|
|
rpc-port = 9091;
|
|
rpc-whitelist-enabled = false;
|
|
rpc-host-whitelist-enabled = false;
|
|
rpc-authentication-required = true;
|
|
};
|
|
};
|
|
|
|
amule = {
|
|
dataDir = "/mnt/archivio/amule";
|
|
enable = true;
|
|
user = "amule";
|
|
};
|
|
|
|
calibre-web = {
|
|
enable = true;
|
|
listen = {
|
|
ip = "0.0.0.0";
|
|
port = 9092;
|
|
};
|
|
options.calibreLibrary = "/mnt/archivio/calibre/";
|
|
openFirewall = true;
|
|
};
|
|
|
|
syncthing = {
|
|
enable = true;
|
|
guiAddress = "0.0.0.0:8384";
|
|
dataDir = "/mnt/archivio/syncthing";
|
|
user = "ccr";
|
|
overrideDevices = false;
|
|
overrideFolders = false;
|
|
folders = {
|
|
"/mnt/archivio/syncthing/camera" = {
|
|
id = "camera";
|
|
};
|
|
"/mnt/archivio/syncthing/orgzly" = {
|
|
id = "orgzly";
|
|
};
|
|
"/mnt/archivio/syncthing/roam" = {
|
|
id = "roam";
|
|
};
|
|
"/mnt/archivio/syncthing/whatsapp" = {
|
|
id = "whatsapp";
|
|
};
|
|
"/mnt/archivio/syncthing/calls" = {
|
|
id = "calls";
|
|
};
|
|
};
|
|
};
|
|
|
|
navidrome = {
|
|
enable = false;
|
|
settings = {
|
|
Address = "0.0.0.0";
|
|
Port = 9093;
|
|
MusicFolder = "/mnt/film/musica";
|
|
DataFolder = "/mnt/film/musica/.navidrome";
|
|
};
|
|
};
|
|
|
|
nginx = {
|
|
enable = true;
|
|
recommendedGzipSettings = true;
|
|
recommendedOptimisation = true;
|
|
recommendedProxySettings = true;
|
|
recommendedTlsSettings = true;
|
|
clientMaxBodySize = "10G"; # max file size for uploads
|
|
commonHttpConfig = ''
|
|
log_format upstream_time '$remote_addr - $remote_user [$time_local] '
|
|
'"$request" $status $body_bytes_sent '
|
|
'"$http_referer" "$http_user_agent"'
|
|
'rt=$request_time uct="$upstream_connect_time" uht="$upstream_header_time" urt="$upstream_response_time"';
|
|
'';
|
|
virtualHosts = {
|
|
"torrent.ccr.ydns.eu" = {
|
|
enableACME = true;
|
|
forceSSL = true;
|
|
locations."/" = {
|
|
proxyPass = "http://localhost:9091";
|
|
};
|
|
};
|
|
|
|
"sync.ccr.ydns.eu" = {
|
|
enableACME = true;
|
|
addSSL = true;
|
|
locations."/" = {
|
|
proxyPass = "http://localhost:8384";
|
|
};
|
|
};
|
|
|
|
"books.ccr.ydns.eu" = {
|
|
enableACME = true;
|
|
addSSL = true;
|
|
locations."/" = {
|
|
proxyPass = "http://localhost:9092";
|
|
};
|
|
};
|
|
|
|
"music.ccr.ydns.eu" = {
|
|
enableACME = true;
|
|
addSSL = true;
|
|
locations."/" = {
|
|
proxyPass = "http://localhost:9093";
|
|
};
|
|
};
|
|
|
|
"gate.ccr.ydns.eu" = {
|
|
enableACME = true;
|
|
addSSL = true;
|
|
locations."/" = {
|
|
proxyPass = "http://192.168.1.71:80";
|
|
};
|
|
};
|
|
};
|
|
};
|
|
};
|
|
|
|
systemd.services.ydns = let
|
|
ydnsUpdater = pkgs.writeScriptBin "ydnsUpdater" ''
|
|
USER="andrea.ciceri@autistici.org"
|
|
PASSWORD=$(cat /home/ccr/.ydns-password)
|
|
DOMAIN="ccr.ydns.eu"
|
|
for SUBDOMAIN in "books" "music" "sync" "torrent" "gate"
|
|
do
|
|
HOST="$SUBDOMAIN.$DOMAIN"
|
|
${pkgs.curl}/bin/curl --basic -u "$USER:$PASSWORD" --silent https://ydns.io/api/v1/update/?host=$HOST
|
|
done
|
|
${pkgs.curl}/bin/curl --basic -u "$USER:$PASSWORD" --silent https://ydns.io/api/v1/update/?host=$DOMAIN
|
|
'';
|
|
in {
|
|
description = "YDNS IP updater";
|
|
wantedBy = ["multi-user.target"];
|
|
after = ["network.target"];
|
|
serviceConfig = {
|
|
User = "root";
|
|
Type = "oneshot";
|
|
ExecStart = "${pkgs.bash}/bin/bash ${ydnsUpdater}/bin/ydnsUpdater";
|
|
};
|
|
};
|
|
|
|
# TODO It seems to not work
|
|
systemd.timers.ydnsUpdater = {
|
|
wantedBy = ["timers.target"];
|
|
partOf = ["ydnsUpdater.service"];
|
|
timerConfig = {
|
|
OnCalendar = "*-*-* *:00:00"; # hourly
|
|
Unit = "ydnsUpdater.service";
|
|
};
|
|
};
|
|
|
|
networking.firewall = {
|
|
enable = true;
|
|
allowPing = true;
|
|
allowedTCPPorts = [
|
|
80 # http
|
|
139 # samba
|
|
443 # https
|
|
445 # samba
|
|
4712 # amule
|
|
4711 # amule web gui
|
|
8384 # syncthing
|
|
53 # dns
|
|
];
|
|
allowedUDPPorts = [
|
|
137 # samba
|
|
138 # samba
|
|
51820 # wireguard
|
|
53 # dns
|
|
];
|
|
};
|
|
|
|
networking.nat.enable = true;
|
|
networking.nat.externalInterface = "enp0s10";
|
|
networking.nat.internalInterfaces = ["wg0"];
|
|
|
|
networking.wireguard.interfaces = {
|
|
# "wg0" is the network interface name. You can name the interface arbitrarily.
|
|
wg0 = {
|
|
# Determines the IP address and subnet of the server's end of the tunnel interface.
|
|
ips = ["10.100.0.1/24"];
|
|
|
|
# The port that WireGuard listens to. Must be accessible by the client.
|
|
listenPort = 51820;
|
|
|
|
# This allows the wireguard server to route your traffic to the internet and hence be like a VPN
|
|
# For this to work you have to set the dnsserver IP of your router (or dnsserver of choice) in your clients
|
|
postSetup = ''
|
|
${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -s 10.100.0.0/24 -o enp0s10 -j MASQUERADE
|
|
'';
|
|
|
|
# This undoes the above command
|
|
postShutdown = ''
|
|
${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -s 10.100.0.0/24 -o enp0s10 -j MASQUERADE
|
|
'';
|
|
|
|
# Path to the private key file.
|
|
#
|
|
# Note: The private key can also be included inline via the privateKey option,
|
|
# but this makes the private key world-readable; thus, using privateKeyFile is
|
|
# recommended.
|
|
privateKeyFile = "/home/ccr/wireguard-keys/private";
|
|
|
|
peers = [
|
|
# List of allowed peers.
|
|
{
|
|
# Feel free to give a meaning full name
|
|
# Public key of the peer (not a file path).
|
|
publicKey = "fCwjd75CefC9A7WqO7s3xfOk2nRcoTKfnAzDT6Lc5AA=";
|
|
# List of IPs assigned to this peer within the tunnel subnet. Used to configure routing.
|
|
allowedIPs = ["10.100.0.2/32"];
|
|
}
|
|
];
|
|
};
|
|
};
|
|
|
|
security.acme = {
|
|
acceptTerms = true;
|
|
defaults.email = "andrea.ciceri@autistici.org";
|
|
};
|
|
|
|
nix = {
|
|
gc = {
|
|
automatic = true;
|
|
options = lib.mkForce "--delete-older-than 3d";
|
|
};
|
|
};
|
|
|
|
powerManagement.cpuFreqGovernor = lib.mkDefault "powersave";
|
|
|
|
# TODO move away
|
|
networking.nameservers = [
|
|
# https://libreops.cc/radicaldns.html
|
|
"88.198.92.222"
|
|
"192.71.166.92"
|
|
];
|
|
|
|
#environment.etc."coredns/blocklist.hosts".source = ../blocklist.hosts;
|
|
|
|
services.coredns = {
|
|
enable = true;
|
|
config = ''
|
|
. {
|
|
# RadicalDNS Forwarding
|
|
forward . 88.198.92.222 192.71.166.92
|
|
cache
|
|
}
|
|
|
|
ccr.ydns.eu {
|
|
template IN A {
|
|
answer "{{ .Name }} 0 IN A 192.168.1.33"
|
|
}
|
|
}
|
|
*.ccr.ydns.eu {
|
|
template IN A {
|
|
answer "{{ .Name }} 0 IN A 192.168.1.33"
|
|
}
|
|
}
|
|
'';
|
|
};
|
|
}
|