torjus/nixos-servers
1
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects 1 Releases Wiki Activity

Initial commit

Browse Source
This commit is contained in:
Torjus Håkestad 2024-03-07 23:14:44 +01:00
commit 0ed396cd88
13 changed files with 341 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
.sops.yaml Normal file
View File

@ -0,0 +1,11 @@
keys:
- &admin_torjus age1lznyk4ee7e7x8n92cq2n87kz9920473ks5u9jlhd3dczfzq4wamqept56u
creation_rules:
- path_regex: secrets/[^/]+\.(yaml|json|env|ini)
key_groups:
- age:
- *admin_torjus
- path_regex: secrets/ns3/[^/]+\.(yaml|json|env|ini)
key_groups:
- age:
- *admin_torjus

96
flake.lock Normal file
View File

@ -0,0 +1,96 @@
{
"nodes": {
"nixpkgs": {
"locked": {
"lastModified": 1709677081,
"narHash": "sha256-tix36Y7u0rkn6mTm0lA45b45oab2cFLqAzDbJxeXS+c=",
"owner": "nixos",
"repo": "nixpkgs",
"rev": "880992dcc006a5e00dd0591446fdf723e6a51a64",
"type": "github"
},
"original": {
"owner": "nixos",
"ref": "nixos-23.11",
"repo": "nixpkgs",
"type": "github"
}
},
"nixpkgs-stable": {
"locked": {
"lastModified": 1709428628,
"narHash": "sha256-//ZCCnpVai/ShtO2vPjh3AWgo8riXCaret6V9s7Hew4=",
"owner": "NixOS",
"repo": "nixpkgs",
"rev": "66d65cb00b82ffa04ee03347595aa20e41fe3555",
"type": "github"
},
"original": {
"owner": "NixOS",
"ref": "release-23.11",
"repo": "nixpkgs",
"type": "github"
}
},
"nixpkgs-unstable": {
"locked": {
"lastModified": 1709703039,
"narHash": "sha256-6hqgQ8OK6gsMu1VtcGKBxKQInRLHtzulDo9Z5jxHEFY=",
"owner": "nixos",
"repo": "nixpkgs",
"rev": "9df3e30ce24fd28c7b3e2de0d986769db5d6225d",
"type": "github"
},
"original": {
"owner": "nixos",
"ref": "nixos-unstable",
"repo": "nixpkgs",
"type": "github"
}
},
"nixpkgs_2": {
"locked": {
"lastModified": 1709356872,
"narHash": "sha256-mvxCirJbtkP0cZ6ABdwcgTk0u3bgLoIoEFIoYBvD6+4=",
"owner": "NixOS",
"repo": "nixpkgs",
"rev": "458b097d81f90275b3fdf03796f0563844926708",
"type": "github"
},
"original": {
"owner": "NixOS",
"ref": "nixpkgs-unstable",
"repo": "nixpkgs",
"type": "github"
}
},
"root": {
"inputs": {
"nixpkgs": "nixpkgs",
"nixpkgs-unstable": "nixpkgs-unstable",
"sops-nix": "sops-nix"
}
},
"sops-nix": {
"inputs": {
"nixpkgs": "nixpkgs_2",
"nixpkgs-stable": "nixpkgs-stable"
},
"locked": {
"lastModified": 1709711091,
"narHash": "sha256-L0rSIU9IguTG4YqSj4B/02SyTEz55ACq5t8gXpzteYc=",
"owner": "Mic92",
"repo": "sops-nix",
"rev": "25dd60fdd08fcacee2567a26ba6b91fe098941dc",
"type": "github"
},
"original": {
"owner": "Mic92",
"repo": "sops-nix",
"type": "github"
}
}
},
"root": "root",
"version": 7
}

33
flake.nix Normal file
View File

@ -0,0 +1,33 @@
{
description = "Homelab v5 Nixos Server Configurations";
inputs = {
nixpkgs.url = "github:nixos/nixpkgs?ref=nixos-23.11";
nixpkgs-unstable.url = "github:nixos/nixpkgs?ref=nixos-unstable";
sops-nix.url = "github:Mic92/sops-nix";
};
outputs = { self, nixpkgs, nixpkgs-unstable, sops-nix, ... }@inputs:
let
system = "x86_64-linux";
overlay-unstable = final: prev: {
unstable = import nixpkgs-unstable {
inherit system;
config.allowUnfree = true;
};
};
in
{
nixosConfigurations = {
ns3 = nixpkgs.lib.nixosSystem {
inherit system;
specialArgs = { inherit inputs self sops-nix; };
modules = [
({ config, pkgs, ... }: { nixpkgs.overlays = [ overlay-unstable ]; })
./hosts/ns1
sops-nix.nixosModules.sops
];
};
};
};
}

52
hosts/ns3/configuration.nix Normal file
View File

@ -0,0 +1,52 @@
{ config, lib, pkgs, ... }:
{
imports =
[
./hardware-configuration.nix
../system
../services/ns/master-authorative.nix
];
nixpkgs.config.allowUnfree = true;
# Use the systemd-boot EFI boot loader.
boot.loader.systemd-boot.enable = true;
boot.loader.efi.canTouchEfiVariables = true;
boot.kernelModules = [ "v4l2loopback" ];
networking.hostName = "ns3.home.2rjus.net"; # Define your hostname.
networking.useNetworkd = true;
systemd.network.enable = true;
systemd.network.networks."ens18" = {
matchConfig.Name = "ens18";
address = [
"10.69.13.7/24"
];
routes = [
{ routeConfig.Gateway = "10.69.13.1"; }
];
linkConfig.RequiredForOnline = "routable";
};
time.timeZone = "Europe/Oslo";
nix.settings.experimental-features = [ "nix-command" "flakes" ];
environment.systemPackages = with pkgs; [
vim
wget
git
];
# Enable the OpenSSH daemon.
services.openssh.enable = true;
services.openssh.settings.PermitRootLogin = "yes";
# Open ports in the firewall.
# networking.firewall.allowedTCPPorts = [ ... ];
# networking.firewall.allowedUDPPorts = [ ... ];
# Or disable the firewall altogether.
networking.firewall.enable = false;
system.stateVersion = "23.11"; # Did you read the comment?
}

6
hosts/ns3/default.nix Normal file
View File

@ -0,0 +1,6 @@
{ ... }: {
imports = [
./hardware-configuration.nix
./configuration.nix
];
}

36
hosts/ns3/hardware-configuration.nix Normal file
View File

@ -0,0 +1,36 @@
{ config, lib, pkgs, modulesPath, ... }:
{
imports =
[
(modulesPath + "/profiles/qemu-guest.nix")
];
boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "virtio_scsi" "sd_mod" "sr_mod" ];
boot.initrd.kernelModules = [ ];
# boot.kernelModules = [ ];
# boot.extraModulePackages = [ ];
fileSystems."/" =
{
device = "/dev/disk/by-uuid/6889aba9-61ed-4687-ab10-e5cf4017ac8d";
fsType = "xfs";
};
fileSystems."/boot" =
{
device = "/dev/disk/by-uuid/BC07-3B7A";
fsType = "vfat";
};
swapDevices =
[{ device = "/dev/disk/by-uuid/64e5757b-6625-4dd2-aa2a-66ca93444d23"; }];
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
# (the default) this is the recommended approach. When using systemd-networkd it's
# still possible to use this option, but it's recommended to use it in conjunction
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
# networking.interfaces.ens18.useDHCP = lib.mkDefault true;
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
}

21
secrets/secrets.yaml Normal file
View File

@ -0,0 +1,21 @@
root_password_hash: ENC[AES256_GCM,data:wk/xEuf+qU3ezmondq9y3OIotXPI/L+TOErTjgJz58wEvQkApYkjc3bHaUTzOrmWjQBgDUENObzPmvQ8WKawUSJRVlpfOEr5TQ==,iv:I8Z3xJz3qoXBD7igx087A1fMwf8d29hQ4JEI3imRXdY=,tag:M80osQeWGG9AAA8BrMfhHA==,type:str]
sops:
kms: []
gcp_kms: []
azure_kv: []
hc_vault: []
age:
- recipient: age1lznyk4ee7e7x8n92cq2n87kz9920473ks5u9jlhd3dczfzq4wamqept56u
enc: |
-----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBsaDVkVGdtbFFnZmxJWTA2
OFFIaU50N1UrVGcrRkxHYTduZjU3ejY2cVdvCi8xQUQ5N0c4VE5sUUx4NG50aEk3
bzMrNFUwUlcrdS9OZllzTDd1ZTlKMkUKLS0tIHlta0grUTROLzJmRzcrYWVRMm9Q
WHhJRlNZZGFaZE83dEc4WklkVExhaFkK6q6WsqEJXveQ+8ISbGOHcjLGUf4KrIqX
lDBI9HtB5pxhOSYsX92ARCl95cOnqAHT6u2n5iHrGJKwtWml4ef0zA==
-----END AGE ENCRYPTED FILE-----
lastmodified: "2024-03-07T21:44:19Z"
mac: ENC[AES256_GCM,data:iyDz5zhOf4sQ2js+azNz3hP8W8YcIVRA4xglcRkvPSEmj2EzLm3Zv8XLHXFNIIYDBo2oQasYXaQSOW6rdHt0qwRv7mwTGHKreimTUi0eUAzXLhE8Pfwxk7V3XyuevGWgQc4UnAmmy0FOKaP+Rb74LoVUrXBT/2/Jq2U1pA+IZCA=,iv:LrhI0KWR3YovkjWBltPTA1JFFO2CJMLfdilAWC9V0Wo=,tag:xafFJVGY1zFYnCnr4M0Xvw==,type:str]
pgp: []
unencrypted_suffix: _unencrypted
version: 3.8.1

11
services/ns/master-authorative.nix Normal file
View File

@ -0,0 +1,11 @@
{ ... }: {
services.nsd = {
enable = true;
port = 8053;
"test.2rjus.net." = {
provideXFR = [ "10.69.0.0/16 NOKEY" ];
};
data = builtins.readFile ./zones-test-2rjus-net.conf;
};
}

39
services/ns/test-2rjus-net.conf Normal file
View File

@ -0,0 +1,39 @@
$ORIGIN test.2rjus.net.
$TTL 1800
@ IN SOA ns1.test.2rjus.net. admin.test.2rjus.net. (
2023 ; serial number
3600 ; refresh
900 ; retry
1209600 ; expire
120 ; ttl
)
IN NS ns1.test.2rjus.net.
IN NS ns2.test.2rjus.net.
IN NS ns3.test.2rjus.net.
; 10
gw IN A 10.69.10.1
; 12_CORE
virt-mini1 IN A 10.69.12.11
nas IN A 10.69.12.50
nzbget IN A 10.69.12.51
restic IN A 10.69.12.52
radarr IN A 10.69.12.53
sonarr IN A 10.69.12.54
bazarr IN A 10.69.12.55
mpnzb IN A 10.69.12.57
; 13_SVC
ns1 IN A 10.69.13.5
ns2 IN A 10.69.13.6
ns3 IN A 10.69.13.7
; 22_WLAN
unifi-ctrl IN A 10.69.22.5
; 30
media IN A 10.69.31.50
; 99_MGMT
sw1 IN A 10.69.99.2

7
system/default.nix Normal file
View File

@ -0,0 +1,7 @@
{ ... }: {
import = [
./sops.nix
./root-user.nix
./sshd.nix
];
}

13
system/root-user.nix Normal file
View File

@ -0,0 +1,13 @@
{ pkgs, config, ... }: {
programs.zsh.enable = true;
sops.secrets.root_password_hash = { };
sops.secrets.root_password_hash.neededForUsers = true;
users.users.root = {
shell = pkgs.zsh;
hashedPasswordFile = config.sops.secrets.root_password_hash.path;
opennsh.authorizedKeys.keys = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAwfb2jpKrBnCw28aevnH8HbE5YbcMXpdaVv2KmueDu6 torjus@gunter"
];
};
}

7
system/sops.nix Normal file
View File

@ -0,0 +1,7 @@
{ ... }: {
sops = {
defaultSopsFile = ./secrets/secrets.yaml;
age.keyFile = "/var/lib/sops-nix/key.txt";
age.generateKey = true;
};
}

9
system/sshd.nix Normal file
View File

@ -0,0 +1,9 @@
{ ... }: {
services.openssh = {
enable = true;
permitRootLogin = "no";
# TODO: Allow root login from certain hosts.
# Then dissallow rest.
passwordAuthentication = true;
};
}