From a21f35a83b4ce7d17fe0341f74c5c6dfca2ff385 Mon Sep 17 00:00:00 2001 From: Lilac Date: Wed, 23 Sep 2026 17:39:36 -0400 Subject: [PATCH] move old hosts to single file --- flake.lock | 88 ++---------------- flake.nix | 10 +- hosts/backup.nix | 102 +++++++++++++++++++++ hosts/backup/default.nix | 90 ------------------ hosts/backup/hardware-configuration.nix | 32 ------- hosts/{desktop/default.nix => desktop.nix} | 85 +++++++++-------- hosts/desktop/hardware-configuration.nix | 38 -------- hosts/{laptop/default.nix => laptop.nix} | 29 +++++- hosts/laptop/hardware-configuration.nix | 31 ------- hosts/vps.nix | 82 +++++++++++++++++ hosts/vps/default.nix | 65 ------------- hosts/vps/hardware-configuration.nix | 19 ---- modules/vault.nix | 2 +- 13 files changed, 273 insertions(+), 400 deletions(-) create mode 100644 hosts/backup.nix delete mode 100644 hosts/backup/default.nix delete mode 100644 hosts/backup/hardware-configuration.nix rename hosts/{desktop/default.nix => desktop.nix} (56%) delete mode 100644 hosts/desktop/hardware-configuration.nix rename hosts/{laptop/default.nix => laptop.nix} (70%) delete mode 100644 hosts/laptop/hardware-configuration.nix create mode 100644 hosts/vps.nix delete mode 100644 hosts/vps/default.nix delete mode 100644 hosts/vps/hardware-configuration.nix diff --git a/flake.lock b/flake.lock index b1a8cf5..40696d0 100644 --- a/flake.lock +++ b/flake.lock @@ -9,11 +9,11 @@ "utils": "utils" }, "locked": { - "lastModified": 1788879443, - "narHash": "sha256-qb9sL86UCUEd3SYAda4ItN1NV0vhMSdbpA64WckvVI0=", + "lastModified": 1789404474, + "narHash": "sha256-UXFQ7tFiwn8sPz0EV4CBB2PCf/ZiGIHWn/6MXk81Lxs=", "owner": "serokell", "repo": "deploy-rs", - "rev": "414ac5f35d79aabe5a0bf52451d8cf61eadf6c88", + "rev": "e760371d631165e7d8de5b0dcf148e21ec4c16f0", "type": "github" }, "original": { @@ -22,23 +22,6 @@ "type": "github" } }, - "disko": { - "inputs": { - "nixpkgs": "nixpkgs" - }, - "locked": { - "lastModified": 1781152676, - "narHash": "sha256-RxWs5ND31KzTG7wvMM+PMfUjyNpmIEr999lqNARaM5o=", - "owner": "nix-community", - "repo": "disko", - "rev": "ff8702b4de27f72b4c78573dfb89ec74e36abdf1", - "type": "github" - }, - "original": { - "id": "disko", - "type": "indirect" - } - }, "flake-compat": { "flake": false, "locked": { @@ -79,11 +62,11 @@ ] }, "locked": { - "lastModified": 1789182507, - "narHash": "sha256-9nt4W0HNNP84B+b37yRs9Zxat1ZR5guJxEZDEjAgex4=", + "lastModified": 1789267039, + "narHash": "sha256-LWiBv9yAYFi2LPbUhDGHPGKYskJQjj2fw12OlyO1uQo=", "owner": "nix-community", "repo": "home-manager", - "rev": "b1d1b60084970f9d1e2b72662639dab6d039be71", + "rev": "ec172013fa62135f58fb58dd17ae9651e8f39727", "type": "github" }, "original": { @@ -95,27 +78,11 @@ }, "nixpkgs": { "locked": { - "lastModified": 1780930886, - "narHash": "sha256-rppURzHviaQN131F+nLiLdGfcb0uCd9gGP0E5+iw9MI=", + "lastModified": 1789998861, + "narHash": "sha256-62XMQD4WLdMAfdT0/8gJmPH2dKeTw908ryNloAplTr8=", "owner": "NixOS", "repo": "nixpkgs", - "rev": "8c3cede7ddc26bd659d2d383b5610efbd2c7a16e", - "type": "github" - }, - "original": { - "owner": "NixOS", - "ref": "nixpkgs-unstable", - "repo": "nixpkgs", - "type": "github" - } - }, - "nixpkgs_2": { - "locked": { - "lastModified": 1789114715, - "narHash": "sha256-ugpsyk3NM2s87vXfUiIIiibbJ4Pp0JPS5p/3mfs+q+c=", - "owner": "NixOS", - "repo": "nixpkgs", - "rev": "21a67dc470149f337cecafbe965d8d252a390518", + "rev": "1e8bc658fc985ef27ccd66d107d767b32bb7ef98", "type": "github" }, "original": { @@ -125,47 +92,12 @@ "type": "github" } }, - "nixpkgs_3": { - "locked": { - "lastModified": 1782175435, - "narHash": "sha256-EMzXKmnOtBQ2MnvpiNOm7E+kOMvdPrIKaeg52Tip2Uk=", - "owner": "NixOS", - "repo": "nixpkgs", - "rev": "89570f24e97e614aa34aa9ab1c927b6578a43775", - "type": "github" - }, - "original": { - "owner": "NixOS", - "ref": "nixpkgs-unstable", - "repo": "nixpkgs", - "type": "github" - } - }, "root": { "inputs": { "deploy-rs": "deploy-rs", - "disko": "disko", "grasswren": "grasswren", "home-manager": "home-manager", - "nixpkgs": "nixpkgs_2", - "sops-nix": "sops-nix" - } - }, - "sops-nix": { - "inputs": { - "nixpkgs": "nixpkgs_3" - }, - "locked": { - "lastModified": 1788914643, - "narHash": "sha256-4GuMPW90JSxXWDPUB9M+1m7fYbe3H0apOd86/zBQ2Kw=", - "owner": "Mic92", - "repo": "sops-nix", - "rev": "13616fff713a9f94055c66f15687ebdc17a335df", - "type": "github" - }, - "original": { - "id": "sops-nix", - "type": "indirect" + "nixpkgs": "nixpkgs" } }, "systems": { diff --git a/flake.nix b/flake.nix index 8707e13..4c514aa 100644 --- a/flake.nix +++ b/flake.nix @@ -12,7 +12,7 @@ grasswren.flake = false; }; - outputs = inputs@{ self, nixpkgs, deploy-rs, disko, home-manager, sops-nix, grasswren, ... }: + outputs = inputs@{ self, nixpkgs, deploy-rs, home-manager, grasswren, ... }: { nixosConfigurations = { laptop = nixpkgs.lib.nixosSystem { @@ -20,7 +20,7 @@ specialArgs = { inherit inputs; }; modules = [ home-manager.nixosModules.home-manager - ./hosts/laptop/default.nix + ./hosts/laptop.nix ]; }; @@ -29,7 +29,7 @@ specialArgs = { inherit inputs; }; modules = [ home-manager.nixosModules.home-manager - ./hosts/desktop/default.nix + ./hosts/desktop.nix ]; }; @@ -38,7 +38,7 @@ specialArgs = { inherit inputs; }; modules = [ home-manager.nixosModules.home-manager - ./hosts/vps/default.nix + ./hosts/vps.nix ]; }; @@ -47,7 +47,7 @@ specialArgs = { inherit inputs; }; modules = [ home-manager.nixosModules.home-manager - ./hosts/backup/default.nix + ./hosts/backup.nix ]; }; }; diff --git a/hosts/backup.nix b/hosts/backup.nix new file mode 100644 index 0000000..9dc3470 --- /dev/null +++ b/hosts/backup.nix @@ -0,0 +1,102 @@ +{ config, lib, pkgs, modulesPath, ... }: + +{ + imports = [ + (modulesPath + "/installer/scan/not-detected.nix") + + ../modules/backup-server.nix + ../modules/ssh.nix + + ../lilac.nix + ]; + + networking.hostName = "backup"; + + time.timeZone = "America/Winnipeg"; + + systemd.sleep.settings.Sleep = { + AllowSuspend = "no"; + AllowHibernation = "no"; + AllowHybridSleep = "no"; + AllowSuspendThenHibernate = "no"; + }; + + i18n.defaultLocale = "en_US.UTF-8"; + i18n.extraLocaleSettings = { + LC_ADDRESS = "en_US.UTF-8"; + LC_IDENTIFICATION = "en_US.UTF-8"; + LC_MEASUREMENT = "en_US.UTF-8"; + LC_MONETARY = "en_US.UTF-8"; + LC_NAME = "en_US.UTF-8"; + LC_NUMERIC = "en_US.UTF-8"; + LC_PAPER = "en_US.UTF-8"; + LC_TELEPHONE = "en_US.UTF-8"; + LC_TIME = "en_US.UTF-8"; + }; + + services.xserver.enable = true; + services.displayManager.sddm.enable = true; + services.desktopManager.plasma6.enable = true; + services.xserver.xkb = { + layout = "us"; + variant = ""; + }; + + services.pulseaudio.enable = false; + security.rtkit.enable = true; + services.pipewire = { + enable = true; + alsa.enable = true; + alsa.support32Bit = true; + pulse.enable = true; + }; + + networking.wireless.enable = true; + networking.networkmanager.enable = true; + + networking = { + firewall = { + enable = true; + allowedUDPPorts = [ 51820 ]; + trustedInterfaces = [ "wg0" ]; + }; + + wireguard.interfaces."wg0" = { + ips = [ "10.0.0.4/32" ]; + generatePrivateKeyFile = true; + privateKeyFile = "/var/lib/wireguard/wg0.key"; + peers = [{ + publicKey = "Tst6SiqoGLSoOAF9l5vT2vvR2RGJ/mFcoBL3BL5n90k="; + allowedIPs = [ "10.0.0.0/24" ]; + endpoint = "216.128.177.13:51820"; + persistentKeepalive = 25; + }]; + }; + }; + + nixpkgs.config.allowUnfree = true; + nix.settings.experimental-features = [ "nix-command" "flakes" ]; + system.stateVersion = "26.05"; + + boot.initrd.availableKernelModules = [ "xhci_pci" "ehci_pci" "ahci" "usb_storage" "sd_mod" "sdhci_pci" ]; + boot.initrd.kernelModules = [ ]; + boot.kernelModules = [ "kvm-intel" ]; + boot.extraModulePackages = [ ]; + boot.loader.systemd-boot.enable = true; + boot.loader.efi.canTouchEfiVariables = true; + boot.kernelPackages = pkgs.linuxPackages_latest; + + fileSystems."/" = { + device = "/dev/disk/by-uuid/61b493e0-8c91-b7d1-4e336da06ff0"; + fsType = "ext4"; + }; + fileSystems."/boot" = { + device = "/dev/disk/by-uuid/E157-E223"; + fsType = "vfat"; + options = [ "fmask=0077" "dmask=0077" ]; + }; + swapDevices = [ ]; + + nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux"; + hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware; +} diff --git a/hosts/backup/default.nix b/hosts/backup/default.nix deleted file mode 100644 index 80226da..0000000 --- a/hosts/backup/default.nix +++ /dev/null @@ -1,90 +0,0 @@ -{ config, lib, pkgs, ... }: - -{ - imports = [ - ./hardware-configuration.nix - - ../../modules/backup-server.nix - ../../modules/ssh.nix - - ../../lilac.nix - ]; - - networking.hostName = "backup"; - - time.timeZone = "America/Winnipeg"; - - systemd.sleep.settings.Sleep = { - AllowSuspend = "no"; - AllowHibernation = "no"; - AllowHybridSleep = "no"; - AllowSuspendThenHibernate = "no"; - }; - - i18n.defaultLocale = "en_US.UTF-8"; - i18n.extraLocaleSettings = { - LC_ADDRESS = "en_US.UTF-8"; - LC_IDENTIFICATION = "en_US.UTF-8"; - LC_MEASUREMENT = "en_US.UTF-8"; - LC_MONETARY = "en_US.UTF-8"; - LC_NAME = "en_US.UTF-8"; - LC_NUMERIC = "en_US.UTF-8"; - LC_PAPER = "en_US.UTF-8"; - LC_TELEPHONE = "en_US.UTF-8"; - LC_TIME = "en_US.UTF-8"; - }; - - services.xserver.enable = true; - services.displayManager.sddm.enable = true; - services.desktopManager.plasma6.enable = true; - services.xserver.xkb = { - layout = "us"; - variant = ""; - }; - - services.pulseaudio.enable = false; - security.rtkit.enable = true; - services.pipewire = { - enable = true; - alsa.enable = true; - alsa.support32Bit = true; - pulse.enable = true; - }; - - environment.systemPackages = with pkgs; [ - whipper - flac - tor-browser - ]; - - networking.wireless.enable = true; - networking.networkmanager.enable = true; - - services.timesyncd.enable = true; # optional - -networking = { - firewall = { - enable = true; - allowedUDPPorts = [ 51820 ]; - trustedInterfaces = [ "wg0" ]; - }; - - wireguard.interfaces."wg0" = { - ips = [ "10.0.0.4/24" ]; - generatePrivateKeyFile = true; - privateKeyFile = "/var/lib/wireguard/wg0.key"; - peers = [{ - publicKey = "Tst6SiqoGLSoOAF9l5vT2vvR2RGJ/mFcoBL3BL5n90k="; - allowedIPs = [ "10.0.0.0/24" ]; - endpoint = "216.128.177.13:51820"; - persistentKeepalive = 25; - }]; - }; - }; - - nixpkgs.config.allowUnfree = true; - nix.settings.experimental-features = [ "nix-command" "flakes" ]; - system.stateVersion = "26.05"; - - networking.firewall.interfaces.wg0.allowedTCPPorts = [ 8000 ]; -} diff --git a/hosts/backup/hardware-configuration.nix b/hosts/backup/hardware-configuration.nix deleted file mode 100644 index 9bee810..0000000 --- a/hosts/backup/hardware-configuration.nix +++ /dev/null @@ -1,32 +0,0 @@ -# Do not modify this file! It was generated by ‘nixos-generate-config’ -# and may be overwritten by future invocations. Please make changes -# to /etc/nixos/configuration.nix instead. -{ config, lib, pkgs, modulesPath, ... }: - -{ - imports = [ (modulesPath + "/installer/scan/not-detected.nix") ]; - - boot.initrd.availableKernelModules = [ "xhci_pci" "ehci_pci" "ahci" "usb_storage" "sd_mod" "sdhci_pci" ]; - boot.initrd.kernelModules = [ ]; - boot.kernelModules = [ "kvm-intel" ]; - boot.extraModulePackages = [ ]; - boot.loader.systemd-boot.enable = true; - boot.loader.efi.canTouchEfiVariables = true; - boot.kernelPackages = pkgs.linuxPackages_latest; - - fileSystems."/" = { - device = "/dev/disk/by-uuid/61b493e0-8c91-b7d1-4e336da06ff0"; - fsType = "ext4"; - }; - - fileSystems."/boot" = - { device = "/dev/disk/by-uuid/E157-E223"; - fsType = "vfat"; - options = [ "fmask=0077" "dmask=0077" ]; - }; - - swapDevices = [ ]; - - nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux"; - hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware; -} diff --git a/hosts/desktop/default.nix b/hosts/desktop.nix similarity index 56% rename from hosts/desktop/default.nix rename to hosts/desktop.nix index 94f023e..559b743 100644 --- a/hosts/desktop/default.nix +++ b/hosts/desktop.nix @@ -1,19 +1,19 @@ -{ config, lib, pkgs, ... }: +{ config, lib, pkgs, modulesPath, ... }: { imports = [ - ./hardware-configuration.nix + (modulesPath + "/installer/scan/not-detected.nix") - ../../modules/backup.nix - ../../modules/blog.nix - ../../modules/code.nix - ../../modules/mail.nix - ../../modules/music.nix - ../../modules/photo.nix - ../../modules/ssh.nix - ../../modules/vault.nix + ../modules/backup.nix + ../modules/blog.nix + ../modules/code.nix + ../modules/mail.nix + ../modules/music.nix + ../modules/photo.nix + ../modules/ssh.nix + ../modules/vault.nix - ../../lilac.nix + ../lilac.nix ]; networking.hostName = "desktop"; @@ -50,14 +50,6 @@ pulse.enable = true; }; - services.sunshine = { - enable = true; - autoStart = true; - capSysAdmin = true; - openFirewall = true; - }; - networking.firewall.interfaces.wg0.allowedTCPPorts = [ 47984 47989 47990 48010 ]; - networking.firewall.interfaces.wg0.allowedUDPPorts = [ 47998 47999 48000 48002 48010 ]; services.displayManager.autoLogin.enable = true; services.displayManager.autoLogin.user = "lilac"; @@ -88,34 +80,55 @@ environment.systemPackages = with pkgs; [ whipper - flac - tor-browser - restic + restic ]; programs.steam.enable = true; networking = { firewall = { - enable = true; - allowedUDPPorts = [ 51820 ]; - trustedInterfaces = [ "wg0" ]; - }; + enable = true; + allowedUDPPorts = [ 51820 ]; + trustedInterfaces = [ "wg0" ]; + }; - wireguard.interfaces."wg0" = { - ips = [ "10.0.0.2/24" ]; - generatePrivateKeyFile = true; - privateKeyFile = "/var/lib/wireguard/wg0.key"; - peers = [{ + wireguard.interfaces."wg0" = { + ips = [ "10.0.0.2/32" ]; + generatePrivateKeyFile = true; + privateKeyFile = "/var/lib/wireguard/wg0.key"; + peers = [{ publicKey = "Tst6SiqoGLSoOAF9l5vT2vvR2RGJ/mFcoBL3BL5n90k="; - allowedIPs = [ "10.0.0.0/24" ]; - endpoint = "216.128.177.13:51820"; - persistentKeepalive = 25; - }]; - }; + allowedIPs = [ "10.0.0.0/24" ]; + endpoint = "216.128.177.13:51820"; + persistentKeepalive = 25; + }]; + }; }; nixpkgs.config.allowUnfree = true; nix.settings.experimental-features = [ "nix-command" "flakes" ]; system.stateVersion = "26.05"; + + boot.initrd.availableKernelModules = [ "xhci_pci" "ehci_pci" "ahci" "usbhid" "sd_mod" ]; + boot.initrd.kernelModules = [ ]; + boot.kernelModules = [ ]; + boot.extraModulePackages = [ ]; + boot.loader.systemd-boot.enable = true; + boot.loader.efi.canTouchEfiVariables = true; + boot.kernelPackages = pkgs.linuxPackages_latest; + boot.kernelParams = [ "amdgpu.runpm=0" ]; + + fileSystems."/" = { + device = "/dev/disk/by-uuid/d7450680-7d53-4842-83c5-7fc32526dff1"; + fsType = "ext4"; + }; + fileSystems."/boot" = { + device = "/dev/disk/by-uuid/D148-4AB8"; + fsType = "vfat"; + options = [ "fmask=0077" "dmask=0077" ]; + }; + swapDevices = [ ]; + + nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux"; + hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware; } diff --git a/hosts/desktop/hardware-configuration.nix b/hosts/desktop/hardware-configuration.nix deleted file mode 100644 index 547ce48..0000000 --- a/hosts/desktop/hardware-configuration.nix +++ /dev/null @@ -1,38 +0,0 @@ -# Do not modify this file! It was generated by ‘nixos-generate-config’ -# and may be overwritten by future invocations. Please make changes -# to /etc/nixos/configuration.nix instead. -{ config, lib, pkgs, modulesPath, ... }: - -{ - imports = - [ (modulesPath + "/installer/scan/not-detected.nix") - ]; - - boot.initrd.availableKernelModules = [ "xhci_pci" "ehci_pci" "ahci" "usbhid" "sd_mod" ]; - boot.initrd.kernelModules = [ ]; - boot.kernelModules = [ ]; - boot.extraModulePackages = [ ]; - boot.loader.systemd-boot.enable = true; - boot.loader.efi.canTouchEfiVariables = true; - boot.kernelPackages = pkgs.linuxPackages_latest; - - boot.kernelParams = [ - "amdgpu.runpm=0" - ]; - - fileSystems."/" = - { device = "/dev/disk/by-uuid/d7450680-7d53-4842-83c5-7fc32526dff1"; - fsType = "ext4"; - }; - - fileSystems."/boot" = - { device = "/dev/disk/by-uuid/D148-4AB8"; - fsType = "vfat"; - options = [ "fmask=0077" "dmask=0077" ]; - }; - - swapDevices = [ ]; - - nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux"; - hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware; -} diff --git a/hosts/laptop/default.nix b/hosts/laptop.nix similarity index 70% rename from hosts/laptop/default.nix rename to hosts/laptop.nix index 5ff5001..9aa5966 100644 --- a/hosts/laptop/default.nix +++ b/hosts/laptop.nix @@ -1,10 +1,10 @@ -{ config, pkgs, ... }: +{ config, lib, pkgs, modulesPath, ... }: { imports = [ - ./hardware-configuration.nix - - ../../lilac.nix + (modulesPath + "/installer/scan/not-detected.nix") + + ../lilac.nix ]; boot.loader.systemd-boot.enable = true; @@ -67,7 +67,7 @@ }; wireguard.interfaces."wg0" = { - ips = [ "10.0.0.1/24" ]; + ips = [ "10.0.0.1/32" ]; generatePrivateKeyFile = true; privateKeyFile = "/var/lib/wireguard/wg0.key"; peers = [{ @@ -83,4 +83,23 @@ nixpkgs.config.allowUnfree = true; system.stateVersion = "26.05"; + + boot.initrd.availableKernelModules = [ "nvme" "xhci_pci" "thunderbolt" "usb_storage" "sd_mod" ]; + boot.initrd.kernelModules = [ ]; + boot.kernelModules = [ "kvm-amd" ]; + boot.extraModulePackages = [ ]; + + fileSystems."/" = { + device = "/dev/disk/by-uuid/379e6dd2-af45-4abc-8ff0-802791f76636"; + fsType = "ext4"; + }; + fileSystems."/boot" = { + device = "/dev/disk/by-uuid/D852-8C36"; + fsType = "vfat"; + options = [ "fmask=0077" "dmask=0077" ]; + }; + swapDevices = [ ]; + + nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux"; + hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware; } diff --git a/hosts/laptop/hardware-configuration.nix b/hosts/laptop/hardware-configuration.nix deleted file mode 100644 index e7943c8..0000000 --- a/hosts/laptop/hardware-configuration.nix +++ /dev/null @@ -1,31 +0,0 @@ -# Do not modify this file! It was generated by ‘nixos-generate-config’ -# and may be overwritten by future invocations. Please make changes -# to /etc/nixos/configuration.nix instead. -{ config, lib, pkgs, modulesPath, ... }: - -{ - imports = - [ (modulesPath + "/installer/scan/not-detected.nix") - ]; - - boot.initrd.availableKernelModules = [ "nvme" "xhci_pci" "thunderbolt" "usb_storage" "sd_mod" ]; - boot.initrd.kernelModules = [ ]; - boot.kernelModules = [ "kvm-amd" ]; - boot.extraModulePackages = [ ]; - - fileSystems."/" = - { device = "/dev/disk/by-uuid/379e6dd2-af45-4abc-8ff0-802791f76636"; - fsType = "ext4"; - }; - - fileSystems."/boot" = - { device = "/dev/disk/by-uuid/D852-8C36"; - fsType = "vfat"; - options = [ "fmask=0077" "dmask=0077" ]; - }; - - swapDevices = [ ]; - - nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux"; - hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware; -} diff --git a/hosts/vps.nix b/hosts/vps.nix new file mode 100644 index 0000000..72d3485 --- /dev/null +++ b/hosts/vps.nix @@ -0,0 +1,82 @@ +{ config, lib, pkgs, ... }: + +{ + imports = [ + ../modules/ssh.nix + + ../lilac.nix + ]; + + networking.hostName = "vps"; + + # forwarding inbound network traffic over wireguard + networking = { + firewall = { + enable = true; + allowedTCPPorts = [ 80 443 ]; + allowedUDPPorts = [ 51820 ]; + trustedInterfaces = [ "wg0" ]; + }; + + wireguard.interfaces."wg0" = { + ips = [ "10.0.0.3/32" ]; + listenPort = 51820; + generatePrivateKeyFile = true; + privateKeyFile = "/var/lib/wireguard/wg0.key"; + peers = [ + { + allowedIPs = [ "10.0.0.1/32" ]; + publicKey = "guKFJGQW946HXWjca/biMYH1nJKw0fguLjzGXKZ7Bxw="; + } + { + allowedIPs = [ "10.0.0.2/32" ]; + publicKey = "7BcwtszpzS4ABDwKwMaiJ7F35sJRa89fBbuh80Sk8Uk="; + } + { + allowedIPs = [ "10.0.0.4/32" ]; + publicKey = "XjuV3wzkP03UUjYSJfY3OG3WWLRtoQBN7GokDEWhdhQ="; + } + ]; + }; + + nftables = { + enable = true; + tables.nat = { + family = "ip"; + content = '' + chain prerouting { + type nat hook prerouting priority dstnat; policy accept; + iifname "enp1s0" tcp dport { 80, 443 } dnat to 10.0.0.2 + } + chain postrouting { + type nat hook postrouting priority srcnat; policy accept; + oifname "wg0" masquerade + } + ''; + }; + }; + }; + + boot.kernel.sysctl = { + "net.ipv4.ip_forward" = 1; + }; + + nix.settings.experimental-features = [ "nix-command" "flakes" ]; + system.stateVersion = "26.05"; + + boot = { + initrd.availableKernelModules = [ "ahci" "xhci_pci" "virtio_pci" "sr_mod" "virtio_blk" ]; + kernelModules = [ ]; + extraModulePackages = [ ]; + loader.systemd-boot.enable = true; + loader.efi.canTouchEfiVariables = true; + loader.efi.efiSysMountPoint = "/boot/efi"; + }; + + fileSystems."/" = { device = "/dev/vda2"; fsType = "ext4"; }; + fileSystems."/boot/efi" = { device = "/dev/vda1"; fsType = "vfat"; }; + swapDevices = [ ]; + + nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux"; + virtualisation.hypervGuest.enable = true; +} diff --git a/hosts/vps/default.nix b/hosts/vps/default.nix deleted file mode 100644 index eefe05b..0000000 --- a/hosts/vps/default.nix +++ /dev/null @@ -1,65 +0,0 @@ -{ config, lib, pkgs, ... }: - -{ - imports = [ - ./hardware-configuration.nix - - ../../modules/ssh.nix - - ../../lilac.nix - ]; - - networking.hostName = "vps"; - - # forwarding inbound network traffic over wireguard - networking = { - firewall = { - enable = true; - allowedTCPPorts = [ 80 443 ]; - allowedUDPPorts = [ 51820 ]; - trustedInterfaces = [ "wg0" ]; - }; - wireguard.interfaces."wg0" = { - ips = [ "10.0.0.3/24" ]; - listenPort = 51820; - generatePrivateKeyFile = true; - privateKeyFile = "/var/lib/wireguard/wg0.key"; - peers = [ - { - allowedIPs = [ "10.0.0.1/32" ]; - publicKey = "guKFJGQW946HXWjca/biMYH1nJKw0fguLjzGXKZ7Bxw="; - } - { - allowedIPs = [ "10.0.0.2/32" ]; - publicKey = "7BcwtszpzS4ABDwKwMaiJ7F35sJRa89fBbuh80Sk8Uk="; - } - { - allowedIPs = [ "10.0.0.4/32" ]; - publicKey = "XjuV3wzkP03UUjYSJfY3OG3WWLRtoQBN7GokDEWhdhQ="; - } - ]; - }; - nftables = { - enable = true; - tables.nat = { - family = "ip"; - content = '' - chain prerouting { - type nat hook prerouting priority dstnat; policy accept; - iifname "enp1s0" tcp dport { 80, 443 } dnat to 10.0.0.2 - } - chain postrouting { - type nat hook postrouting priority srcnat; policy accept; - oifname "wg0" masquerade - } - ''; - }; - }; - }; - boot.kernel.sysctl = { - "net.ipv4.ip_forward" = 1; - }; - - nix.settings.experimental-features = [ "nix-command" "flakes" ]; - system.stateVersion = "26.05"; -} diff --git a/hosts/vps/hardware-configuration.nix b/hosts/vps/hardware-configuration.nix deleted file mode 100644 index b47f04e..0000000 --- a/hosts/vps/hardware-configuration.nix +++ /dev/null @@ -1,19 +0,0 @@ -{ config, lib, pkgs, ... }: - -{ - boot = { - initrd.availableKernelModules = [ "ahci" "xhci_pci" "virtio_pci" "sr_mod" "virtio_blk" ]; - kernelModules = [ ]; - extraModulePackages = [ ]; - loader.systemd-boot.enable = true; - loader.efi.canTouchEfiVariables = true; - loader.efi.efiSysMountPoint = "/boot/efi"; - }; - - fileSystems."/" = { device = "/dev/vda2"; fsType = "ext4"; }; - fileSystems."/boot/efi" = { device = "/dev/vda1"; fsType = "vfat"; }; - swapDevices = [ ]; - - nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux"; - virtualisation.hypervGuest.enable = true; -} diff --git a/modules/vault.nix b/modules/vault.nix index 1e307d7..054c46b 100644 --- a/modules/vault.nix +++ b/modules/vault.nix @@ -5,7 +5,7 @@ enable = true; backupDir = "/var/lib/vault-backup"; config = { - DOMAIN = "https://vault.example.com"; + DOMAIN = "https://vault.grasswren.net"; SIGNUPS_ALLOWED = false; ROCKET_ADDRESS = "127.0.0.1"; ROCKET_PORT = 8222;