aboutsummaryrefslogtreecommitdiff
path: root/nixos/configurations
diff options
context:
space:
mode:
Diffstat (limited to 'nixos/configurations')
-rw-r--r--nixos/configurations/adm-mpd.nix58
-rw-r--r--nixos/configurations/adm-omnia.nix114
-rw-r--r--nixos/configurations/adm-omnia2.nix18
-rw-r--r--nixos/configurations/albert.nix41
-rw-r--r--nixos/configurations/binky.nix19
-rw-r--r--nixos/configurations/dean.nix1
-rw-r--r--nixos/configurations/errol.nix104
-rw-r--r--nixos/configurations/gaspode.nix1
-rw-r--r--nixos/configurations/lipwig.nix212
-rw-r--r--nixos/configurations/ridcully.nix26
-rw-r--r--nixos/configurations/spt-mox.nix146
-rw-r--r--nixos/configurations/spt-mox2.nix11
-rw-r--r--nixos/configurations/spt-mpd.nix1
-rw-r--r--nixos/configurations/spt-omnia.nix130
14 files changed, 527 insertions, 355 deletions
diff --git a/nixos/configurations/adm-mpd.nix b/nixos/configurations/adm-mpd.nix
index ac3b4de..47ac008 100644
--- a/nixos/configurations/adm-mpd.nix
+++ b/nixos/configurations/adm-mpd.nix
@@ -5,26 +5,18 @@
}: let
inherit (lib) filterAttrs;
in {
- nixpkgs.hostPlatform.system = "aarch64-linux";
+ system.stateVersion = "24.05";
- fileSystems = {
- "/" = {
- device = "/dev/mmcblk0p2";
- options = ["compress=lzo" "subvol=@nix"];
- };
- "/home" = {
- device = "/dev/mmcblk0p2";
- options = ["compress=lzo" "subvol=@home"];
- };
- "/boot" = {
- device = "/dev/mmcblk0p1";
- };
+ cynerd.rpi = 3;
+ deploy = {
+ enable = true;
+ ssh.host = "nixos@mpd.adm";
};
networking.wireless = {
enable = true;
networks = filterAttrs (n: _: n == "Nela") config.secrets.wifiNetworks;
- environmentFile = "/run/secrets/wifi.env";
+ secretsFile = "/run/secrets/wifi.secrets";
userControlled.enable = true;
};
@@ -33,24 +25,24 @@ in {
#alsa.enable = true;
#pulse.enable = true;
#};
- hardware.pulseaudio = {
- enable = true;
- systemWide = true;
- zeroconf.publish.enable = true;
- };
+ #hardware.pulseaudio = {
+ # enable = true;
+ # systemWide = true;
+ # zeroconf.publish.enable = true;
+ #};
- services.spotifyd = {
- enable = true;
- settings.global = {
- device_name = "Adámkovi";
- device = "sysdefault";
- mixer = "Master";
- bitrate = 320;
- cache_path = "/var/cahe/spotify";
- no_audio_cache = true;
- volume_normalisation = true;
- normalisation_pregain = -10;
- initial_volume = 60;
- };
- };
+ #services.spotifyd = {
+ # enable = true;
+ # settings.global = {
+ # device_name = "Adámkovi";
+ # device = "sysdefault";
+ # mixer = "Master";
+ # bitrate = 320;
+ # cache_path = "/var/cahe/spotify";
+ # no_audio_cache = true;
+ # volume_normalisation = true;
+ # normalisation_pregain = -10;
+ # initial_volume = 60;
+ # };
+ #};
}
diff --git a/nixos/configurations/adm-omnia.nix b/nixos/configurations/adm-omnia.nix
index 672788a..55ee733 100644
--- a/nixos/configurations/adm-omnia.nix
+++ b/nixos/configurations/adm-omnia.nix
@@ -1,59 +1,105 @@
-{config, ...}: {
+{config, ...}: let
+ hosts = config.cynerd.hosts.adm;
+in {
+ system.stateVersion = "24.05";
+
turris.board = "omnia";
+ deploy = {
+ enable = true;
+ ssh.host = "adm.cynerd.cz";
+ };
cynerd = {
router = {
enable = true;
wan = "pppoe-wan";
- lanIP = config.cynerd.hosts.adm.omnia;
+ lanIP = hosts.omnia;
+ staticLeases = {
+ "70:85:c2:4a:59:f2" = hosts.ridcully;
+ "7c:b0:c2:bb:9c:ca" = hosts.albert;
+ "4c:d5:77:0d:85:d9" = hosts.binky;
+ "b8:27:eb:49:54:5a" = hosts.mpd;
+ };
+ guestStaticLeases = {
+ "f4:a9:97:a4:bd:59" = hosts.printer;
+ };
};
wifiAP.adm = {
enable = true;
- ar9287.interface = "wlp3s0";
- qca988x.interface = "wlp2s0";
+ ar9287 = {
+ interface = "wlp2s0";
+ bssids = config.secrets.wifiMacs.adm-omnia.ar9287;
+ channel = 7;
+ };
+ qca988x = {
+ interface = "wlp1s0";
+ bssids = config.secrets.wifiMacs.adm-omnia.qca988x;
+ channel = 44;
+ };
};
+ wireguard = true;
monitoring.speedtest = true;
};
+ services.journald.extraConfig = ''
+ SystemMaxUse=8G
+ '';
+
+ services.btrfs.autoScrub = {
+ enable = true;
+ fileSystems = ["/"];
+ };
+
+ services.fail2ban = {
+ enable = true;
+ ignoreIP = ["10.8.1.0/24" "10.8.2.0/24"];
+ };
+
networking.useDHCP = false;
systemd.network = {
networks = {
"end2" = {
- matchConfig.Name = "end2";
- #networkConfig = {
- # DHCP = "ipv6";
- # IPv6AcceptRA = "yes";
- # DHCPPrefixDelegation = "yes";
- #};
- #dhcpPrefixDelegationConfig = {
- # UplinkInterface = ":self";
- # SubnetId = 0;
- # Announce = "no";
- #};
+ matchConfig.Name = "end2"; # Ensure that it is managed by systemd-networkd
+ networkConfig.IPv6AcceptRA = false;
+ };
+ "pppoe-wan" = {
+ matchConfig.Name = "pppoe-wan";
+ networkConfig = {
+ BindCarrier = "end2";
+ DHCP = "ipv6";
+ IPv6AcceptRA = "no";
+ DHCPPrefixDelegation = "yes";
+ DNS = "1.1.1.1";
+ };
+ dhcpV6Config = {
+ PrefixDelegationHint = "::/56";
+ UseDNS = "no";
+ };
+ dhcpPrefixDelegationConfig = {
+ UplinkInterface = ":self";
+ SubnetId = 0;
+ Announce = "no";
+ };
linkConfig.RequiredForOnline = "routable";
};
"lan-brlan" = {
- matchConfig.Name = "lan[1-4]";
+ matchConfig.Name = "lan4";
networkConfig.Bridge = "brlan";
bridgeVLANs = [
{
- bridgeVLANConfig = {
- EgressUntagged = 1;
- PVID = 1;
- };
+ EgressUntagged = 1;
+ PVID = 1;
}
- {bridgeVLANConfig.VLAN = 2;}
+ {VLAN = 2;}
];
};
- "lan0-guest" = {
- matchConfig.Name = "lan0";
+ "lan-guest" = {
+ matchConfig.Name = "lan[0-3]";
networkConfig.Bridge = "brlan";
bridgeVLANs = [
{
- bridgeVLANConfig = {
- EgressUntagged = 2;
- PVID = 2;
- };
+ EgressUntagged = 2;
+ PVID = 2;
}
];
};
@@ -68,14 +114,22 @@
lcp-echo-interval 1
lcp-echo-failure 5
lcp-echo-adaptive
- +ipv6
defaultroute
defaultroute6
- usepeerdns
+ #usepeerdns
maxfail 1
user O2
password 02
'';
};
- systemd.services."pppd-wan".after = ["sys-subsystem-net-devices-end2.device"];
+ systemd.services."pppd-wan" = {
+ after = ["sys-subsystem-net-devices-end2.device"];
+ partOf = ["systemd-networkd.service"];
+ };
+ # TODO limit NSS clamping to just pppoe-wan
+ networking.firewall.extraForwardRules = ''
+ tcp flags syn tcp option maxseg size set rt mtu comment "Needed for PPPoE to fix IPv4"
+ iifname {"home", "wg"} oifname {"home", "wg"} accept
+ iifname "home" oifname "guest" accept comment "Allow home to access guest devices"
+ '';
}
diff --git a/nixos/configurations/adm-omnia2.nix b/nixos/configurations/adm-omnia2.nix
index 19ee446..fc5a92d 100644
--- a/nixos/configurations/adm-omnia2.nix
+++ b/nixos/configurations/adm-omnia2.nix
@@ -1,4 +1,6 @@
{config, ...}: {
+ system.stateVersion = "24.05";
+
turris.board = "omnia";
deploy = {
enable = true;
@@ -14,13 +16,13 @@
wifiAP.adm = {
enable = true;
ar9287 = {
- interface = "wlp1s0";
- bssids = ["12:f0:21:23:2b:00" "12:f0:21:23:2b:01" "12:f0:21:23:2b:02"];
+ interface = "wlp2s0";
+ bssids = config.secrets.wifiMacs.adm-omnia2.ar9287;
channel = 11;
};
qca988x = {
- interface = "wlp2s0";
- bssids = ["12:f0:21:23:2b:03" "12:f0:21:23:2b:04" "12:f0:21:23:2b:05"];
+ interface = "wlp1s0";
+ bssids = config.secrets.wifiMacs.adm-omnia2.qca988x;
channel = 36;
};
};
@@ -45,12 +47,10 @@
networkConfig.Bridge = "brlan";
bridgeVLANs = [
{
- bridgeVLANConfig = {
- EgressUntagged = 1;
- PVID = 1;
- };
+ EgressUntagged = 1;
+ PVID = 1;
}
- {bridgeVLANConfig.VLAN = 2;}
+ {VLAN = 2;}
];
};
};
diff --git a/nixos/configurations/albert.nix b/nixos/configurations/albert.nix
deleted file mode 100644
index a6a4ee1..0000000
--- a/nixos/configurations/albert.nix
+++ /dev/null
@@ -1,41 +0,0 @@
-{
- nixpkgs.hostPlatform.system = "x86_64-linux";
-
- cynerd = {
- desktop = {
- enable = true;
- laptop = true;
- };
- wifiClient = true;
- openvpn = {
- oldpersonal = true;
- };
- };
-
- boot.initrd.availableKernelModules = ["xhci_pci" "usb_storage" "sd_mod"];
-
- hardware.cpu.intel.updateMicrocode = true;
-
- fileSystems = {
- "/" = {
- device = "/dev/disk/by-uuid/1c9bafac-fcf8-41c4-b394-bca5917ca82d";
- fsType = "btrfs";
- options = ["compress=lzo" "subvol=@nix"];
- };
- "/home" = {
- device = "/dev/disk/by-uuid/1c9bafac-fcf8-41c4-b394-bca5917ca82d";
- fsType = "btrfs";
- options = ["compress=lzo" "subvol=@home"];
- };
- "/boot" = {
- device = "/dev/disk/by-uuid/E403-124B";
- fsType = "vfat";
- };
-
- "/home2" = {
- device = "/dev/disk/by-uuid/55e177a1-215e-475b-ba9c-771b5fa3f8f0";
- fsType = "btrfs";
- options = ["compress=lzo" "subvol=@home"];
- };
- };
-}
diff --git a/nixos/configurations/binky.nix b/nixos/configurations/binky.nix
index 6dfb6a5..6111637 100644
--- a/nixos/configurations/binky.nix
+++ b/nixos/configurations/binky.nix
@@ -1,6 +1,11 @@
-{lib, ...}: let
+{
+ lib,
+ pkgs,
+ ...
+}: let
inherit (lib) mkDefault;
in {
+ system.stateVersion = "24.05";
nixpkgs.hostPlatform.system = "x86_64-linux";
deploy = {
enable = true;
@@ -75,7 +80,7 @@ in {
DHCP = "yes";
IPv6AcceptRA = "yes";
};
- routes = [{routeConfig.Metric = 1088;}];
+ routes = [{Metric = 1088;}];
linkConfig.RequiredForOnline = "routable";
};
};
@@ -84,14 +89,8 @@ in {
services.syncthing = {
enable = true;
- user = mkDefault "cynerd";
- group = mkDefault "cynerd";
- openDefaultPorts = true;
-
- overrideDevices = false;
- overrideFolders = false;
-
dataDir = "/home/cynerd";
- configDir = "/home/cynerd/.config/syncthing";
};
+
+ environment.systemPackages = [pkgs.heroic];
}
diff --git a/nixos/configurations/dean.nix b/nixos/configurations/dean.nix
index 187e148..dfb03e1 100644
--- a/nixos/configurations/dean.nix
+++ b/nixos/configurations/dean.nix
@@ -1,4 +1,5 @@
{pkgs, ...}: {
+ system.stateVersion = "24.05";
turris.board = "mox";
deploy.enable = true;
diff --git a/nixos/configurations/errol.nix b/nixos/configurations/errol.nix
index fd348e8..f986631 100644
--- a/nixos/configurations/errol.nix
+++ b/nixos/configurations/errol.nix
@@ -6,6 +6,7 @@
}: let
inherit (lib) mkDefault;
in {
+ system.stateVersion = "24.05";
nixpkgs.hostPlatform.system = "x86_64-linux";
deploy.enable = true;
@@ -26,6 +27,7 @@ in {
"encroot" = "/dev/disk/by-uuid/7c412ae6-6016-45af-8c2a-8fcc394dbbe6";
"enchdd1" = "/dev/disk/by-uuid/87f16080-5ff6-43dd-89f3-307455a46fbe";
"enchdd2" = "/dev/disk/by-uuid/be4a33fa-8bc6-431d-a3ac-787668f223ed";
+ #"encback" = "/dev/disk/by-uuid/1bd8c637-f71e-4fb0-96de-b660c4f1afaf";
};
fileSystems = {
"/" = {
@@ -53,6 +55,11 @@ in {
fsType = "btrfs";
options = ["compress=lzo" "subvol=@home"];
};
+ #"/back" = {
+ # device = "/dev/mapper/encback";
+ # fsType = "btrfs";
+ # options = ["compress=lzo"];
+ #};
};
services.btrfs.autoScrub = {
enable = true;
@@ -83,75 +90,42 @@ in {
pkgs.nvtopPackages.amd
];
- services.syncthing = {
- enable = true;
- user = mkDefault "cynerd";
- group = mkDefault "cynerd";
- openDefaultPorts = true;
-
- overrideDevices = false;
- overrideFolders = false;
-
- dataDir = "/home/cynerd";
- configDir = "/home/cynerd/.config/syncthing";
- };
-
- nixpkgs.config.permittedInsecurePackages = ["openssl-1.1.1w"]; # TODO
- services.home-assistant = {
- enable = true;
- openFirewall = true;
- configDir = "/var/lib/hass";
- config = {
- homeassistant = {
- name = "SPT";
- latitude = "!secret latitude";
- longitude = "!secret longitude";
- elevation = "!secret elevation";
- time_zone = "Europe/Prague";
- country = "CZ";
- };
- http.server_port = 8808;
- mqtt = {
- sensor = import ../modules/home-assistant/sensors.nix;
- light = import ../modules/home-assistant/light.nix;
- };
- default_config = {};
- automation = "!include automations.yaml";
- };
- extraComponents = ["met"];
- package = pkgs.home-assistant.override {
- extraPackages = pkgs:
- with pkgs; [
- securetar
- pyipp
- ];
+ ##############################################################################
+ services = {
+ syncthing = {
+ enable = true;
+ dataDir = "/home/cynerd";
};
- };
- services.zigbee2mqtt = {
- enable = true;
- settings = {
- serial.port = "/dev/serial/by-id/usb-ITEAD_SONOFF_Zigbee_3.0_USB_Dongle_Plus_V2_20220812153849-if00";
- mqtt = {
- server = "mqtt://${config.cynerd.hosts.spt.mox}:1883";
- user = "zigbee2mqtt";
- password = "!secret.yaml mqtt_password";
- };
- advanced = {
- network_key = "!secret.yaml network_key";
- homeassistant_legacy_entity_attributes = false;
- legacy_api = false;
- legacy_availability_payload = false;
- last_seen = "epoch";
+ home-assistant = {
+ enable = true;
+ openFirewall = true;
+ configDir = "/var/lib/hass";
+ config = {
+ homeassistant = {
+ name = "SPT";
+ latitude = "!secret latitude";
+ longitude = "!secret longitude";
+ elevation = "!secret elevation";
+ time_zone = "Europe/Prague";
+ country = "CZ";
+ };
+ http.server_port = 8808;
+ mqtt = {
+ sensor = import ../home-assistant/sensors.nix;
+ light = import ../home-assistant/light.nix;
+ };
+ default_config = {};
+ automation = "!include automations.yaml";
};
- frontend = true;
- availability = true;
- homeassistant = {
- legacy_triggers = false;
+ extraComponents = ["met"];
+ package = pkgs.home-assistant.override {
+ extraPackages = pkgs:
+ with pkgs; [
+ securetar
+ pyipp
+ ];
};
- device_options.legacy = false;
- permit_join = false;
- devices = config.secrets.zigbee2mqttDevices;
};
};
}
diff --git a/nixos/configurations/gaspode.nix b/nixos/configurations/gaspode.nix
index 78d8277..5d6d090 100644
--- a/nixos/configurations/gaspode.nix
+++ b/nixos/configurations/gaspode.nix
@@ -1,4 +1,5 @@
{
+ system.stateVersion = "25.05";
nixpkgs.hostPlatform.system = "armv7l-linux";
fileSystems = {
diff --git a/nixos/configurations/lipwig.nix b/nixos/configurations/lipwig.nix
index e6ec96a..5855b6d 100644
--- a/nixos/configurations/lipwig.nix
+++ b/nixos/configurations/lipwig.nix
@@ -7,6 +7,7 @@
imports = [inputModules.vpsadminos];
config = {
+ system.stateVersion = "24.05";
nixpkgs.hostPlatform.system = "x86_64-linux";
deploy = {
@@ -19,12 +20,14 @@
hw = false;
drives = false;
};
- syncthing = {
- enable = false;
- baseDir = "/nas";
- };
wireguard = true;
- openvpn.oldpersonal = true;
+ borgjobs = {
+ postgresql.dumpCommand = pkgs.writeScript "postgreqsl-backup.sh" ''
+ /run/wrappers/bin/sudo -u postgres /run/current-system/sw/bin/pg_dumpall
+ '';
+ nextcloud_data.paths = "/nas/nextcloud/data";
+ sync_data.paths = "/sync";
+ };
};
boot.loader.systemd-boot.enable = false;
@@ -33,27 +36,16 @@
"/nas" = {
device = "172.16.128.63:/nas/2682";
fsType = "nfs";
+ options = [
+ "_netdev"
+ "x-systemd.automount"
+ ];
};
"/nas/nextcloud-sync" = {
- device = "/nas/sync";
+ device = "/sync";
fsType = "fuse.bindfs";
options = ["map=syncthing/nextcloud:@syncthing/@nextcloud"];
};
- "/nas/spt" = {
- device = "nas@omnia.spt:/data/nas";
- fsType = "fuse.sshfs";
- options = [
- "noauto"
- "x-systemd.automount"
- "_netdev"
- "reconnect"
- "identityfile=/run/secrets/nas.ssh.priv"
- "allow_other"
- "idmap=user"
- "uid=nextcloud"
- "gid=nextcloud"
- ];
- };
};
networking = {
@@ -104,8 +96,8 @@
root = "${pkgs.cgit}/cgit";
locations."/".tryFiles = "$uri @cgit";
locations."@cgit".extraConfig = ''
+ fastcgi_pass unix:${config.services.fcgiwrap.instances.cgit.socket.address};
fastcgi_param SCRIPT_FILENAME ${pkgs.cgit}/cgit/cgit.cgi;
- fastcgi_pass unix:${config.services.fcgiwrap.socketAddress};
fastcgi_param PATH_INFO $uri;
fastcgi_param QUERY_STRING $args;
fastcgi_param HTTP_HOST $server_name;
@@ -115,28 +107,42 @@
forceSSL = true;
useACMEHost = "cynerd.cz";
};
+ "office.cynerd.cz" = {
+ forceSSL = true;
+ useACMEHost = "cynerd.cz";
+ };
"grafana.cynerd.cz" = {
forceSSL = true;
useACMEHost = "cynerd.cz";
locations."/" = {
- proxyPass = "http://127.0.0.1:${toString config.services.grafana.settings.server.http_port}/";
- extraConfig = "proxy_set_header Host $host;";
+ proxyPass = "http://localhost:${toString config.services.grafana.settings.server.http_port}";
proxyWebsockets = true;
+ recommendedProxySettings = true;
};
};
+ "searx.cynerd.cz" = {
+ forceSSL = true;
+ useACMEHost = "cynerd.cz";
+ locations."/".extraConfig = ''
+ uwsgi_pass "unix:///run/searx/searx.sock";
+ include ${config.services.nginx.package}/conf/uwsgi_params;
+ '';
+ };
};
};
- services.fcgiwrap = {
- enable = true;
- inherit (config.services.nginx) group;
+ services.fcgiwrap.instances.cgit = {
+ process.user = "git";
+ socket = {inherit (config.services.nginx) user group;};
};
security.acme = {
acceptTerms = true;
defaults.email = "cynerd+acme@email.cz";
certs."cynerd.cz".extraDomainNames = [
- "git.cynerd.cz"
"cloud.cynerd.cz"
+ "office.cynerd.cz"
+ "git.cynerd.cz"
"grafana.cynerd.cz"
+ "searx.cynerd.cz"
];
};
@@ -193,7 +199,7 @@
# Nextcloud ################################################################
services.nextcloud = {
enable = true;
- package = pkgs.nextcloud28;
+ package = pkgs.nextcloud31;
https = true;
hostName = "cloud.cynerd.cz";
datadir = "/nas/nextcloud";
@@ -202,11 +208,25 @@
adminpassFile = "/run/secrets/nextcloud.admin.pass";
dbtype = "pgsql";
dbhost = "/run/postgresql";
- dbtableprefix = "oc_";
};
settings = {
#log_type = "systemd";
+ default_locale = "CZ";
default_phone_region = "CZ";
+ default_timezone = "Europe/Prague";
+ enabledPreviewProviders = [
+ "OC\\Preview\\BMP"
+ "OC\\Preview\\GIF"
+ "OC\\Preview\\JPEG"
+ "OC\\Preview\\Krita"
+ "OC\\Preview\\MarkDown"
+ "OC\\Preview\\MP3"
+ "OC\\Preview\\OpenDocument"
+ "OC\\Preview\\PNG"
+ "OC\\Preview\\TXT"
+ "OC\\Preview\\XBitmap"
+ "OC\\Preview\\HEIC"
+ ];
};
phpExtraExtensions = php: [php.pgsql php.pdo_pgsql];
phpOptions = {
@@ -225,58 +245,146 @@
forms
groupfolders
impersonate
- maps
memories
notes
+ onlyoffice
phonetrack
previewgenerator
spreed
tasks
- twofactor_nextcloud_notification
twofactor_webauthn
;
# Additional modules can be fetched with:
- # NEXTCLOUD_VERSIONS=28 nix run nixpkgs#nc4nix -- -apps "passwords,integration_homeassistant,integration_github,integration_gitlab"
- passwords = pkgs.fetchNextcloudApp {
- url = "https://git.mdns.eu/api/v4/projects/45/packages/generic/passwords/2024.2.0/passwords.tar.gz";
- sha256 = "0s5z6pxkcwmhlbzy9s2g0s05n1iqjmxr2jqxz7ayklin9kcgr3h7";
- license = "gpl3";
- };
+ # NEXTCLOUD_VERSIONS=30 nix run nixpkgs#nc4nix -- -apps "passwords,money,integration_github,integration_gitlab"
integration_github = pkgs.fetchNextcloudApp {
- url = "https://github.com/nextcloud-releases/integration_github/releases/download/v2.0.6/integration_github-v2.0.6.tar.gz";
- sha256 = "0rjdlsalayb21nmh3j5bl42dcbavxka2r5g9csagz7vc9dl0qrw6";
- license = "gpl3";
+ url = "https://github.com/nextcloud-releases/integration_github/releases/download/v3.1.1/integration_github-v3.1.1.tar.gz";
+ hash = "sha256-nm463H33WyXTJkb7+OSsunARNuSl5nc3uGClgwkVvhM=";
+ license = "agpl3Plus";
};
integration_gitlab = pkgs.fetchNextcloudApp {
- url = "https://github.com/nextcloud-releases/integration_gitlab/releases/download/v1.0.18/integration_gitlab-v1.0.18.tar.gz";
- sha256 = "13vlbr7sigqrh480a9zp7zl9nbzb4pk8m1zzlqv9lkzj3zywp7mi";
- license = "gpl3";
+ url = "https://github.com/nextcloud-releases/integration_gitlab/releases/download/v3.1.2/integration_gitlab-v3.1.2.tar.gz";
+ hash = "sha256-nCH0DqYmr4T856sOU5PhSK6WAHIF9mnYThgytxEbkNA=";
+ license = "agpl3Plus";
+ };
+ money = pkgs.fetchNextcloudApp {
+ url = "https://github.com/powerpaul17/nc_money/releases/download/v0.30.0/money.tar.gz";
+ hash = "sha256-4gHm6sF9S+1G1naRTr+eR8ZyjCpB3viXTzRCNQFUtF0=";
+ license = "agpl3Plus";
+ };
+ passwords = pkgs.fetchNextcloudApp {
+ url = "https://git.mdns.eu/api/v4/projects/45/packages/generic/passwords/2025.5.1/passwords.tar.gz";
+ hash = "sha256-v4IVpqbTN3TKORESFX+sJsiSrLkUc0b5Stj8CmznSIw=";
+ license = "agpl3Plus";
+ };
+ maps = pkgs.fetchNextcloudApp {
+ url = "https://github.com/nextcloud/maps/releases/download/v1.6.0-3-nightly/maps-1.6.0-3-nightly.tar.gz";
+ hash = "sha256-E0S/CwXyye19lcuiONEQCyHJqlL0ZG1A9Q7oOTEZH1g=";
+ license = "agpl3Plus";
};
};
};
+ # OnlyOffice ###############################################################
+ services.onlyoffice = {
+ enable = true;
+ hostname = "office.cynerd.cz";
+ };
# Postgresql ###############################################################
services.postgresql = {
enable = true;
ensureUsers = [
+ {name = "cynerd";}
{
name = "nextcloud";
ensureDBOwnership = true;
}
];
ensureDatabases = ["nextcloud"];
+ #extraPlugins = ps: with ps; [timescaledb];
};
- # Old Syncthing ############################################################
- services.syncthing = {
+ # SearX ####################################################################
+ services.searx = {
enable = true;
- openDefaultPorts = true;
-
- overrideDevices = false;
- overrideFolders = false;
+ environmentFile = "/run/secrets/searx.env";
+ settings = {
+ server.secret_key = "@SEARX_SECRET_KEY@";
+ search = {
+ autocomplete = "google";
+ autocomplete_min = 2;
+ };
+ ui = {
+ query_in_title = true;
+ infinite_scroll = true;
+ center_alignment = true;
+ hotkeys = "vim";
+ };
+ engines = [
+ {
+ name = "seznam";
+ disabled = false;
+ }
+ {
+ name = "material icons";
+ disabled = false;
+ }
+ {
+ name = "svgrepo";
+ disabled = false;
+ }
+ {
+ name = "peertube";
+ disabled = false;
+ }
+ {
+ name = "lib.rs";
+ disabled = false;
+ }
+ {
+ name = "gitlab";
+ disabled = false;
+ }
+ {
+ name = "sourcehut";
+ disabled = false;
+ }
+ {
+ name = "free software directory";
+ disabled = false;
+ }
+ {
+ name = "cppreference";
+ disabled = false;
+ }
+ {
+ name = "searchcode code";
+ disabled = false;
+ }
+ {
+ name = "imdb";
+ disabled = false;
+ }
+ {
+ name = "tmdb";
+ disabled = false;
+ }
+ ];
+ };
+ runInUwsgi = true;
+ uwsgiConfig = {
+ socket = "/run/searx/searx.sock";
+ chmod-socket = "660";
+ };
+ redisCreateLocally = true;
+ };
+ users.groups.searx.members = ["nginx"];
- dataDir = "/nas/sync";
- configDir = "/nas/sync/.syncthing";
+ # Syncthing ################################################################
+ services.syncthing = {
+ enable = true;
+ user = "syncthing";
+ group = "syncthing";
+ dataDir = "/sync";
};
};
}
diff --git a/nixos/configurations/ridcully.nix b/nixos/configurations/ridcully.nix
index 66daf1b..0b2705c 100644
--- a/nixos/configurations/ridcully.nix
+++ b/nixos/configurations/ridcully.nix
@@ -5,6 +5,7 @@
}: let
inherit (lib) mkDefault;
in {
+ system.stateVersion = "24.05";
nixpkgs.hostPlatform.system = "x86_64-linux";
deploy.enable = true;
@@ -26,6 +27,7 @@ in {
cynerd.autounlock = {
"encroot" = "/dev/disk/by-uuid/bc7d2ba4-6e04-4c49-b40c-3aecd1a86c71";
"enchdd" = "/dev/disk/by-uuid/7fee3cda-efa0-47cd-8832-fdead9a7e6db";
+ "encback" = "/dev/disk/by-uuid/b426cbe7-fba2-473b-90f9-9ebe3e34b76e";
};
fileSystems = {
"/" = {
@@ -48,16 +50,24 @@ in {
fsType = "btrfs";
options = ["compress=lzo" "subvol=@home"];
};
+ "/back" = {
+ device = "/dev/mapper/encback";
+ fsType = "btrfs";
+ options = ["compress=lzo"];
+ };
};
services.btrfs.autoScrub = {
enable = true;
fileSystems = ["/" "/home2"];
};
- #networking.vlans."enp6s0.adm" = {
- #id = 2;
- #interface = "enp6s0";
- #};
+ networking = {
+ useNetworkd = true;
+ useDHCP = true;
+ };
+ systemd.network = {
+ wait-online.enable = false;
+ };
environment.systemPackages = [
pkgs.nvtopPackages.amd
@@ -65,15 +75,7 @@ in {
services.syncthing = {
enable = true;
- user = mkDefault "cynerd";
- group = mkDefault "cynerd";
- openDefaultPorts = true;
-
- overrideDevices = false;
- overrideFolders = false;
-
dataDir = "/home/cynerd";
- configDir = "/home/cynerd/.config/syncthing";
};
# Force nix to use less jobs
diff --git a/nixos/configurations/spt-mox.nix b/nixos/configurations/spt-mox.nix
index 4e29bca..8af976c 100644
--- a/nixos/configurations/spt-mox.nix
+++ b/nixos/configurations/spt-mox.nix
@@ -1,12 +1,17 @@
-{config, ...}: {
+{
+ config,
+ pkgs,
+ ...
+}: {
+ system.stateVersion = "24.05";
turris.board = "mox";
deploy = {
enable = true;
ssh.host = "mox.spt";
+ configurationLimit = 8;
};
cynerd = {
- home-assistant = true;
monitoring.drives = false;
switch = {
enable = true;
@@ -17,19 +22,21 @@
enable = true;
qca988x = {
interface = "wlp1s0";
- bssids = ["04:f0:21:24:24:d2" "08:f0:21:24:24:d2"];
+ bssids = config.secrets.wifiMacs.spt-mox.qca988x;
channel = 7;
};
};
};
- services.journald.extraConfig = ''
- SystemMaxUse=512M
- '';
+ services = {
+ journald.extraConfig = ''
+ SystemMaxUse=512M
+ '';
- services.btrfs.autoScrub = {
- enable = true;
- fileSystems = ["/"];
+ btrfs.autoScrub = {
+ enable = true;
+ fileSystems = ["/"];
+ };
};
networking = {
@@ -42,13 +49,126 @@
networkConfig.Bridge = "brlan";
bridgeVLANs = [
{
- bridgeVLANConfig = {
- EgressUntagged = 1;
- PVID = 1;
+ EgressUntagged = 1;
+ PVID = 1;
+ }
+ {VLAN = 2;}
+ ];
+ };
+ };
+
+ ##############################################################################
+ networking.firewall.allowedTCPPorts = [
+ 1883 # Mosquitto
+ ];
+ services = {
+ mosquitto = {
+ enable = true;
+ listeners = [
+ {
+ users = {
+ cynerd = {
+ acl = ["readwrite #"];
+ passwordFile = "/run/secrets/mosquitto.cynerd.pass";
+ };
+ telegraf = {
+ acl = ["read bigclown/node/#"];
+ passwordFile = "/run/secrets/mosquitto.telegraf.pass";
+ };
+ homeassistant = {
+ acl = [
+ "readwrite homeassistant/#"
+ "readwrite bigclown/#"
+ "readwrite zigbee2mqtt/#"
+ ];
+ passwordFile = "/run/secrets/mosquitto.homeassistant.pass";
+ };
+ bigclown = {
+ acl = ["readwrite bigclown/#"];
+ passwordFile = "/run/secrets/mosquitto.bigclown.pass";
+ };
+ zigbee2mqtt = {
+ acl = [
+ "readwrite homeassistant/#"
+ "readwrite zigbee2mqtt/#"
+ ];
+ passwordFile = "/run/secrets/mosquitto.zigbee2mqtt.pass";
+ };
};
}
- {bridgeVLANConfig.VLAN = 2;}
];
};
+
+ telegraf.extraConfig = {
+ outputs.influxdb_v2 = [
+ {
+ urls = ["http://cynerd.cz:8086"];
+ token = "$INFLUX_TOKEN";
+ organization = "personal";
+ bucket = "bigclown";
+ tagpass.source = ["bigclown"];
+ }
+ ];
+ inputs.mqtt_consumer = let
+ consumer = data_type: topics: {
+ tags = {source = "bigclown";};
+ servers = ["tcp://localhost:1883"];
+ inherit topics;
+ username = "telegraf";
+ password = "$MQTT_PASSWORD";
+ data_format = "value";
+ inherit data_type;
+ topic_parsing = [
+ {
+ topic = "bigclown/node/+/+/+/+";
+ measurement = "_/_/_/_/_/measurement";
+ tags = "_/_/device/field/_/_";
+ }
+ ];
+ };
+ in [
+ (consumer "float" [
+ "bigclown/node/+/battery/+/voltage"
+ "bigclown/node/+/thermometer/+/temperature"
+ "bigclown/node/+/hygrometer/+/relative-humidity"
+ "bigclown/node/+/lux-meter/+/illuminance"
+ "bigclown/node/+/barometer/+/pressure"
+ "bigclown/node/+/pir/+/event-count"
+ "bigclown/node/+/push-button/+/event-count"
+ ])
+ (consumer "boolean" [
+ "bigclown/node/+/flood-detector/+/alarm"
+ ])
+ ];
+ processors.pivot = [
+ {
+ tag_key = "field";
+ value_key = "value";
+ tagpass.source = ["bigclown"];
+ }
+ ];
+ };
+
+ bcg = {
+ enable = true;
+ device = "/dev/ttyUSB0";
+ baseTopicPrefix = "bigclown/";
+ environmentFiles = ["/run/secrets/bigclown.env"];
+ mqtt = {
+ username = "bigclown";
+ password = "\${MQTT_PASSWORD}";
+ };
+ };
+ };
+
+ systemd.services = {
+ telegraf.wants = ["mosquitto.service"];
+
+ bigclown-leds = {
+ description = "Bigclown LEDs control";
+ wantedBy = ["multi-user.target"];
+ wants = ["mosquitto.service"];
+ serviceConfig.ExecStart = "${pkgs.bigclown-leds}/bin/bigclown-leds /run/secrets/bigclown-leds.ini";
+ };
};
}
diff --git a/nixos/configurations/spt-mox2.nix b/nixos/configurations/spt-mox2.nix
index 9ffde96..fd2c074 100644
--- a/nixos/configurations/spt-mox2.nix
+++ b/nixos/configurations/spt-mox2.nix
@@ -1,4 +1,5 @@
{config, ...}: {
+ system.stateVersion = "24.05";
turris.board = "mox";
deploy = {
enable = true;
@@ -16,7 +17,7 @@
enable = true;
qca988x = {
interface = "wlp1s0";
- bssids = ["04:f0:21:45:d3:47" "08:f0:21:45:d3:47"];
+ bssids = config.secrets.wifiMacs.spt-mox2.qca988x;
channel = 1;
};
};
@@ -41,12 +42,10 @@
networkConfig.Bridge = "brlan";
bridgeVLANs = [
{
- bridgeVLANConfig = {
- EgressUntagged = 1;
- PVID = 1;
- };
+ EgressUntagged = 1;
+ PVID = 1;
}
- {bridgeVLANConfig.VLAN = 2;}
+ {VLAN = 2;}
];
};
};
diff --git a/nixos/configurations/spt-mpd.nix b/nixos/configurations/spt-mpd.nix
index b212932..1849d9b 100644
--- a/nixos/configurations/spt-mpd.nix
+++ b/nixos/configurations/spt-mpd.nix
@@ -2,6 +2,7 @@
imports = [inputModules.nixos-hardware.raspberry-pi-2];
config = {
+ system.stateVersion = "24.05";
nixpkgs.hostPlatform.system = "armv7l-linux";
fileSystems = {
diff --git a/nixos/configurations/spt-omnia.nix b/nixos/configurations/spt-omnia.nix
index e97f29f..1809b2a 100644
--- a/nixos/configurations/spt-omnia.nix
+++ b/nixos/configurations/spt-omnia.nix
@@ -1,14 +1,11 @@
-{
- config,
- pkgs,
- ...
-}: let
+{config, ...}: let
hosts = config.cynerd.hosts.spt;
in {
+ system.stateVersion = "24.05";
turris.board = "omnia";
deploy = {
enable = true;
- ssh.host = "omnia.spt";
+ ssh.host = "spt.cynerd.cz";
};
cynerd = {
@@ -28,12 +25,12 @@ in {
enable = true;
ar9287 = {
interface = "wlp1s0";
- bssids = ["04:f0:21:24:21:93" "08:f0:21:24:21:93"];
+ bssids = config.secrets.wifiMacs.spt-omnia.ar9287;
channel = 11;
};
qca988x = {
- interface = "wlp3s0";
- bssids = ["04:f0:21:23:16:64" "08:f0:21:23:16:64"];
+ interface = "wlp2s0";
+ bssids = config.secrets.wifiMacs.spt-omnia.qca988x;
channel = 36;
};
};
@@ -45,71 +42,15 @@ in {
SystemMaxUse=8G
'';
- environment = {
- etc.crypttab.text = ''
- nas UUID=3472bef9-cbae-48bd-873e-fd4858a0b72f /run/secrets/luks-spt-omnia-nas.key luks
- nassec UUID=016e9e75-bbc8-4b24-8bb7-c800c8f6a500 /run/secrets/luks-spt-omnia-nas.key luks
- '';
- systemPackages = with pkgs; [
- cryptsetup
- ];
- };
- fileSystems = {
- "/data" = {
- device = "/dev/mapper/nas";
- fsType = "btrfs";
- options = ["compress=lzo" "subvol=@data" "nofail"];
- };
- "/srv" = {
- device = "/dev/mapper/nas";
- fsType = "btrfs";
- options = ["compress=lzo" "subvol=@srv" "nofail"];
- depends = ["/data"];
- };
- };
services.btrfs.autoScrub = {
enable = true;
- fileSystems = ["/" "/data"];
+ fileSystems = ["/"];
};
- services.udev.packages = [
- (pkgs.writeTextFile rec {
- name = "queue_depth_sata.rules";
- destination = "/etc/udev/rules.d/50-${name}";
- text = ''
- SUBSYSTEMS=="pci", DRIVER=="ahci", ATTR{device}!="0x0612", GOTO="turris_pci_end"
- ACTION=="add|change", SUBSYSTEM=="scsi", ATTR{vendor}=="ATA", ATTR{queue_depth}="1"
- LABEL="turris_pci_end"
- '';
- })
- ];
- users = {
- groups.nas = {};
- users = {
- nas = {
- group = "nas";
- openssh.authorizedKeys.keyFiles = [
- (config.personal-secrets + "/unencrypted/nas.pub")
- (config.personal-secrets + "/unencrypted/nas-spt.pub")
- ];
- isNormalUser = true;
- home = "/data/nas";
- homeMode = "770";
- };
- cynerd.extraGroups = ["nas"];
- };
- };
- services.openssh = {
- settings.Macs = ["hmac-sha2-256"]; # Allow sha2-256 for Nexcloud access
- extraConfig = ''
- Match User nas
- X11Forwarding no
- AllowTcpForwarding no
- AllowAgentForwarding no
- ForceCommand internal-sftp -d /data/nas
- '';
+ services.fail2ban = {
+ enable = true;
+ ignoreIP = ["10.8.1.0/24" "10.8.2.0/24"];
};
- services.fail2ban.enable = true;
networking.useDHCP = false;
systemd.network = {
@@ -156,12 +97,10 @@ in {
networkConfig.Bridge = "brlan";
bridgeVLANs = [
{
- bridgeVLANConfig = {
- EgressUntagged = 1;
- PVID = 1;
- };
+ EgressUntagged = 1;
+ PVID = 1;
}
- {bridgeVLANConfig.VLAN = 2;}
+ {VLAN = 2;}
];
};
};
@@ -183,20 +122,43 @@ in {
password metronet
'';
};
- systemd.services."pppd-wan".after = ["sys-subsystem-net-devices-end2.848.device"];
+ systemd.services."pppd-wan" = {
+ after = ["sys-subsystem-net-devices-end2.848.device"];
+ partOf = ["systemd-networkd.service"];
+ };
# TODO limit NSS clamping to just pppoe-wan
networking.firewall.extraForwardRules = ''
tcp flags syn tcp option maxseg size set rt mtu comment "Needed for PPPoE to fix IPv4"
- iifname {"home", "personalvpn", "wg"} oifname {"home", "personalvpn", "wg"} accept
+ iifname {"home", "wg"} oifname {"home", "wg"} accept
'';
- services.syncthing = {
- enable = false;
- openDefaultPorts = true;
-
- overrideDevices = false;
- overrideFolders = false;
-
- dataDir = "/data"; # TODO this can't be the location
+ ##############################################################################
+ services = {
+ zigbee2mqtt = {
+ enable = true;
+ settings = {
+ serial.port = "/dev/serial/by-id/usb-ITEAD_SONOFF_Zigbee_3.0_USB_Dongle_Plus_V2_20220812153849-if00";
+ mqtt = {
+ server = "mqtt://${config.cynerd.hosts.spt.mox}:1883";
+ user = "zigbee2mqtt";
+ password = "!secret.yaml mqtt_password";
+ };
+ advanced = {
+ network_key = "!secret.yaml network_key";
+ homeassistant_legacy_entity_attributes = false;
+ legacy_api = false;
+ legacy_availability_payload = false;
+ last_seen = "epoch";
+ };
+ frontend = true;
+ availability = true;
+ homeassistant = {
+ legacy_triggers = false;
+ };
+ device_options.legacy = false;
+ permit_join = false;
+ devices = config.secrets.zigbee2mqttDevices;
+ };
+ };
};
}
generated by cgit v1.2.3 (git 2.25.1) at 2025-07-01 14:03:57 +0000