aboutsummaryrefslogtreecommitdiff
path: root/nixos/configurations
diff options
context:
space:
mode:
Diffstat (limited to 'nixos/configurations')
-rw-r--r--nixos/configurations/adm-omnia.nix4
-rw-r--r--nixos/configurations/adm-omnia2.nix4
-rw-r--r--nixos/configurations/errol.nix6
-rw-r--r--nixos/configurations/lipwig.nix45
-rw-r--r--nixos/configurations/ridcully.nix6
-rw-r--r--nixos/configurations/spt-mox.nix2
-rw-r--r--nixos/configurations/spt-mox2.nix2
-rw-r--r--nixos/configurations/spt-omnia.nix86
8 files changed, 47 insertions, 108 deletions
diff --git a/nixos/configurations/adm-omnia.nix b/nixos/configurations/adm-omnia.nix
index 069dfb0..056a68e 100644
--- a/nixos/configurations/adm-omnia.nix
+++ b/nixos/configurations/adm-omnia.nix
@@ -26,12 +26,12 @@ in {
enable = false;
ar9287 = {
interface = "wlp1s0";
- bssids = ["04:f0:21:23:3d:ce" "08:f0:21:23:3d:ce" "0c:f0:21:23:3d:ce"];
+ bssids = config.secrets.wifiMacs.adm-omnia.ar9287;
channel = 11;
};
qca988x = {
interface = "wlp3s0";
- bssids = ["04:f0:21:24:0b:4e" "08:f0:21:24:0b:4e" "0c:f0:21:24:0b:4e"];
+ bssids = config.secrets.wifiMacs.adm-omnia.qca988x;
channel = 36;
};
};
diff --git a/nixos/configurations/adm-omnia2.nix b/nixos/configurations/adm-omnia2.nix
index 45b8dc4..8b47e63 100644
--- a/nixos/configurations/adm-omnia2.nix
+++ b/nixos/configurations/adm-omnia2.nix
@@ -15,12 +15,12 @@
enable = true;
ar9287 = {
interface = "wlp2s0";
- bssids = ["12:f0:21:23:2b:00" "12:f0:21:23:2b:01" "12:f0:21:23:2b:02"];
+ bssids = config.secrets.wifiMacs.adm-omnia2.ar9287;
channel = 11;
};
qca988x = {
interface = "wlp1s0";
- bssids = ["12:f0:21:23:2b:03" "12:f0:21:23:2b:04" "12:f0:21:23:2b:05"];
+ bssids = config.secrets.wifiMacs.adm-omnia2.qca988x;
channel = 36;
};
};
diff --git a/nixos/configurations/errol.nix b/nixos/configurations/errol.nix
index fd348e8..407cf82 100644
--- a/nixos/configurations/errol.nix
+++ b/nixos/configurations/errol.nix
@@ -26,6 +26,7 @@ in {
"encroot" = "/dev/disk/by-uuid/7c412ae6-6016-45af-8c2a-8fcc394dbbe6";
"enchdd1" = "/dev/disk/by-uuid/87f16080-5ff6-43dd-89f3-307455a46fbe";
"enchdd2" = "/dev/disk/by-uuid/be4a33fa-8bc6-431d-a3ac-787668f223ed";
+ #"encback" = "/dev/disk/by-uuid/1bd8c637-f71e-4fb0-96de-b660c4f1afaf";
};
fileSystems = {
"/" = {
@@ -53,6 +54,11 @@ in {
fsType = "btrfs";
options = ["compress=lzo" "subvol=@home"];
};
+ #"/back" = {
+ # device = "/dev/mapper/encback";
+ # fsType = "btrfs";
+ # options = ["compress=lzo"];
+ #};
};
services.btrfs.autoScrub = {
enable = true;
diff --git a/nixos/configurations/lipwig.nix b/nixos/configurations/lipwig.nix
index 1a137db..7476ab6 100644
--- a/nixos/configurations/lipwig.nix
+++ b/nixos/configurations/lipwig.nix
@@ -25,6 +25,13 @@
};
wireguard = true;
openvpn.oldpersonal = true;
+ borgjobs = {
+ postgresql.dumpCommand = pkgs.writeScript "postgreqsl-backup.sh" ''
+ /run/wrappers/bin/sudo -u postgres /run/current-system/sw/bin/pg_dumpall
+ '';
+ nextcloud_data.paths = "/nas/nextcloud/data";
+ sync_data.paths = "/nas/sync";
+ };
};
boot.loader.systemd-boot.enable = false;
@@ -43,20 +50,6 @@
fsType = "fuse.bindfs";
options = ["map=syncthing/nextcloud:@syncthing/@nextcloud"];
};
- "/nas/spt" = {
- device = "nas@omnia.spt:/data/nas";
- fsType = "fuse.sshfs";
- options = [
- "allow_other"
- "_netdev"
- "x-systemd.automount"
- "reconnect"
- "identityfile=/run/secrets/nas.ssh.priv"
- "idmap=user"
- "uid=nextcloud"
- "gid=nextcloud"
- ];
- };
};
networking = {
@@ -205,7 +198,7 @@
# Nextcloud ################################################################
services.nextcloud = {
enable = true;
- package = pkgs.nextcloud28;
+ package = pkgs.nextcloud29;
https = true;
hostName = "cloud.cynerd.cz";
datadir = "/nas/nextcloud";
@@ -214,7 +207,6 @@
adminpassFile = "/run/secrets/nextcloud.admin.pass";
dbtype = "pgsql";
dbhost = "/run/postgresql";
- dbtableprefix = "oc_";
};
settings = {
#log_type = "systemd";
@@ -248,20 +240,25 @@
twofactor_webauthn
;
# Additional modules can be fetched with:
- # NEXTCLOUD_VERSIONS=28 nix run nixpkgs#nc4nix -- -apps "passwords,integration_homeassistant,integration_github,integration_gitlab"
+ # NEXTCLOUD_VERSIONS=29 nix run nixpkgs#nc4nix -- -apps "passwords,money,integration_github,integration_gitlab"
passwords = pkgs.fetchNextcloudApp {
- url = "https://git.mdns.eu/api/v4/projects/45/packages/generic/passwords/2024.7.0/passwords.tar.gz";
- sha256 = "1RwLOE2aUwISMF/WcYmL8sKs+KXBlYv0OHw8PizrGCY=";
+ url = "https://git.mdns.eu/api/v4/projects/45/packages/generic/passwords/2024.9.0/passwords.tar.gz";
+ sha256 = "L+jumcussL0c9xNMg/GMs1GSd1IY9wUvC8ZEg+3U+sc=";
license = "agpl3Plus";
};
integration_github = pkgs.fetchNextcloudApp {
- url = "https://github.com/nextcloud-releases/integration_github/releases/download/v2.0.7/integration_github-v2.0.7.tar.gz";
- sha256 = "x4BrBdrvmbdwZcZL6FLAY27B5OpkXIsw92XsD076Aqg=";
+ url = "https://github.com/nextcloud-releases/integration_github/releases/download/v3.0.0/integration_github-v3.0.0.tar.gz";
+ sha256 = "ruLN4lw3Vy8OavTYm1g2L9q1wusRP0a+BpvfXkrZI3A=";
license = "agpl3Plus";
};
integration_gitlab = pkgs.fetchNextcloudApp {
- url = "https://github.com/nextcloud-releases/integration_gitlab/releases/download/v3.0.1/integration_gitlab-v3.0.1.tar.gz";
- sha256 = "FAF5CHwAVm55QS9NO8B5zsvJ0BWa7Mwfw6kYr2js0Es=";
+ url = "https://github.com/nextcloud-releases/integration_gitlab/releases/download/v3.1.2/integration_gitlab-v3.1.2.tar.gz";
+ sha256 = "nCH0DqYmr4T856sOU5PhSK6WAHIF9mnYThgytxEbkNA=";
+ license = "agpl3Plus";
+ };
+ money = pkgs.fetchNextcloudApp {
+ url = "https://github.com/powerpaul17/nc_money/releases/download/v0.29.0/money.tar.gz";
+ sha256 = "EXcY69z5h6rT0RdkmOhQYKSWmVBr2zaWuSRj/m5dMkI=";
license = "agpl3Plus";
};
};
@@ -278,7 +275,7 @@
}
];
ensureDatabases = ["nextcloud"];
- extraPlugins = ps: with ps; [timescaledb];
+ #extraPlugins = ps: with ps; [timescaledb];
};
# SearX ####################################################################
diff --git a/nixos/configurations/ridcully.nix b/nixos/configurations/ridcully.nix
index 2be1a7a..ff3b5a0 100644
--- a/nixos/configurations/ridcully.nix
+++ b/nixos/configurations/ridcully.nix
@@ -26,6 +26,7 @@ in {
cynerd.autounlock = {
"encroot" = "/dev/disk/by-uuid/bc7d2ba4-6e04-4c49-b40c-3aecd1a86c71";
"enchdd" = "/dev/disk/by-uuid/7fee3cda-efa0-47cd-8832-fdead9a7e6db";
+ "encback" = "/dev/disk/by-uuid/b426cbe7-fba2-473b-90f9-9ebe3e34b76e";
};
fileSystems = {
"/" = {
@@ -48,6 +49,11 @@ in {
fsType = "btrfs";
options = ["compress=lzo" "subvol=@home"];
};
+ "/back" = {
+ device = "/dev/mapper/encback";
+ fsType = "btrfs";
+ options = ["compress=lzo"];
+ };
};
services.btrfs.autoScrub = {
enable = true;
diff --git a/nixos/configurations/spt-mox.nix b/nixos/configurations/spt-mox.nix
index 0bc7627..989df29 100644
--- a/nixos/configurations/spt-mox.nix
+++ b/nixos/configurations/spt-mox.nix
@@ -17,7 +17,7 @@
enable = true;
qca988x = {
interface = "wlp1s0";
- bssids = ["04:f0:21:24:24:d2" "08:f0:21:24:24:d2"];
+ bssids = config.secrets.wifiMacs.spt-mox.qca988x;
channel = 7;
};
};
diff --git a/nixos/configurations/spt-mox2.nix b/nixos/configurations/spt-mox2.nix
index af0796c..b416671 100644
--- a/nixos/configurations/spt-mox2.nix
+++ b/nixos/configurations/spt-mox2.nix
@@ -20,7 +20,7 @@
enable = true;
qca988x = {
interface = "wlp1s0";
- bssids = ["04:f0:21:45:d3:47" "08:f0:21:45:d3:47"];
+ bssids = config.secrets.wifiMacs.spt-mox2.qca988x;
channel = 1;
};
};
diff --git a/nixos/configurations/spt-omnia.nix b/nixos/configurations/spt-omnia.nix
index 29fe8c4..e55e34f 100644
--- a/nixos/configurations/spt-omnia.nix
+++ b/nixos/configurations/spt-omnia.nix
@@ -1,14 +1,10 @@
-{
- config,
- pkgs,
- ...
-}: let
+{config, ...}: let
hosts = config.cynerd.hosts.spt;
in {
turris.board = "omnia";
deploy = {
enable = true;
- ssh.host = "omnia.spt";
+ ssh.host = "spt.cynerd.cz";
};
cynerd = {
@@ -28,12 +24,12 @@ in {
enable = true;
ar9287 = {
interface = "wlp1s0";
- bssids = ["04:f0:21:24:21:93" "08:f0:21:24:21:93"];
+ bssids = config.secrets.wifiMacs.spt-omnia.ar9287;
channel = 11;
};
qca988x = {
interface = "wlp3s0";
- bssids = ["04:f0:21:23:16:64" "08:f0:21:23:16:64"];
+ bssids = config.secrets.wifiMacs.spt-omnia.qca988x;
channel = 36;
};
};
@@ -45,71 +41,15 @@ in {
SystemMaxUse=8G
'';
- environment = {
- etc.crypttab.text = ''
- nas UUID=3472bef9-cbae-48bd-873e-fd4858a0b72f /run/secrets/luks-spt-omnia-nas.key luks
- nassec UUID=016e9e75-bbc8-4b24-8bb7-c800c8f6a500 /run/secrets/luks-spt-omnia-nas.key luks
- '';
- systemPackages = with pkgs; [
- cryptsetup
- ];
- };
- fileSystems = {
- "/data" = {
- device = "/dev/mapper/nas";
- fsType = "btrfs";
- options = ["compress=lzo" "subvol=@data" "nofail"];
- };
- "/srv" = {
- device = "/dev/mapper/nas";
- fsType = "btrfs";
- options = ["compress=lzo" "subvol=@srv" "nofail"];
- depends = ["/data"];
- };
- };
services.btrfs.autoScrub = {
enable = true;
- fileSystems = ["/" "/data"];
+ fileSystems = ["/"];
};
- services.udev.packages = [
- (pkgs.writeTextFile rec {
- name = "queue_depth_sata.rules";
- destination = "/etc/udev/rules.d/50-${name}";
- text = ''
- SUBSYSTEMS=="pci", DRIVER=="ahci", ATTR{device}!="0x0612", GOTO="turris_pci_end"
- ACTION=="add|change", SUBSYSTEM=="scsi", ATTR{vendor}=="ATA", ATTR{queue_depth}="1"
- LABEL="turris_pci_end"
- '';
- })
- ];
- users = {
- groups.nas = {};
- users = {
- nas = {
- group = "nas";
- openssh.authorizedKeys.keyFiles = [
- (config.personal-secrets + "/unencrypted/nas.pub")
- (config.personal-secrets + "/unencrypted/nas-spt.pub")
- ];
- isNormalUser = true;
- home = "/data/nas";
- homeMode = "770";
- };
- cynerd.extraGroups = ["nas"];
- };
- };
- services.openssh = {
- settings.Macs = ["hmac-sha2-256"]; # Allow sha2-256 for Nexcloud access
- extraConfig = ''
- Match User nas
- X11Forwarding no
- AllowTcpForwarding no
- AllowAgentForwarding no
- ForceCommand internal-sftp -d /data/nas
- '';
+ services.fail2ban = {
+ enable = true;
+ ignoreIP = ["10.8.1.0/24" "10.8.2.0/24"];
};
- services.fail2ban.enable = true;
networking.useDHCP = false;
systemd.network = {
@@ -187,14 +127,4 @@ in {
tcp flags syn tcp option maxseg size set rt mtu comment "Needed for PPPoE to fix IPv4"
iifname {"home", "personalvpn", "wg"} oifname {"home", "personalvpn", "wg"} accept
'';
-
- services.syncthing = {
- enable = false;
- openDefaultPorts = true;
-
- overrideDevices = false;
- overrideFolders = false;
-
- dataDir = "/data"; # TODO this can't be the location
- };
}
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-14 07:15:38 +0000