Lilac/Chickadee
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

move old hosts to single file

Browse Source
This commit is contained in:
Lilac
2026-09-23 17:39:36 -04:00
parent 41c4fd235a
commit a21f35a83b
13 changed files with 273 additions and 400 deletions
Download Patch File Download Diff File Expand all files Collapse all files
hosts/backup.nix
+102
View File
@@ -0,0 +1,102 @@
{ config, lib, pkgs, modulesPath, ... }:
{
imports = [
(modulesPath + "/installer/scan/not-detected.nix")
../modules/backup-server.nix
../modules/ssh.nix
../lilac.nix
];
networking.hostName = "backup";
time.timeZone = "America/Winnipeg";
systemd.sleep.settings.Sleep = {
AllowSuspend = "no";
AllowHibernation = "no";
AllowHybridSleep = "no";
AllowSuspendThenHibernate = "no";
};
i18n.defaultLocale = "en_US.UTF-8";
i18n.extraLocaleSettings = {
LC_ADDRESS = "en_US.UTF-8";
LC_IDENTIFICATION = "en_US.UTF-8";
LC_MEASUREMENT = "en_US.UTF-8";
LC_MONETARY = "en_US.UTF-8";
LC_NAME = "en_US.UTF-8";
LC_NUMERIC = "en_US.UTF-8";
LC_PAPER = "en_US.UTF-8";
LC_TELEPHONE = "en_US.UTF-8";
LC_TIME = "en_US.UTF-8";
};
services.xserver.enable = true;
services.displayManager.sddm.enable = true;
services.desktopManager.plasma6.enable = true;
services.xserver.xkb = {
layout = "us";
variant = "";
};
services.pulseaudio.enable = false;
security.rtkit.enable = true;
services.pipewire = {
enable = true;
alsa.enable = true;
alsa.support32Bit = true;
pulse.enable = true;
};
networking.wireless.enable = true;
networking.networkmanager.enable = true;
networking = {
firewall = {
enable = true;
allowedUDPPorts = [ 51820 ];
trustedInterfaces = [ "wg0" ];
};
wireguard.interfaces."wg0" = {
ips = [ "10.0.0.4/32" ];
generatePrivateKeyFile = true;
privateKeyFile = "/var/lib/wireguard/wg0.key";
peers = [{
publicKey = "Tst6SiqoGLSoOAF9l5vT2vvR2RGJ/mFcoBL3BL5n90k=";
allowedIPs = [ "10.0.0.0/24" ];
endpoint = "216.128.177.13:51820";
persistentKeepalive = 25;
}];
};
};
nixpkgs.config.allowUnfree = true;
nix.settings.experimental-features = [ "nix-command" "flakes" ];
system.stateVersion = "26.05";
boot.initrd.availableKernelModules = [ "xhci_pci" "ehci_pci" "ahci" "usb_storage" "sd_mod" "sdhci_pci" ];
boot.initrd.kernelModules = [ ];
boot.kernelModules = [ "kvm-intel" ];
boot.extraModulePackages = [ ];
boot.loader.systemd-boot.enable = true;
boot.loader.efi.canTouchEfiVariables = true;
boot.kernelPackages = pkgs.linuxPackages_latest;
fileSystems."/" = {
device = "/dev/disk/by-uuid/61b493e0-8c91-b7d1-4e336da06ff0";
fsType = "ext4";
};
fileSystems."/boot" = {
device = "/dev/disk/by-uuid/E157-E223";
fsType = "vfat";
options = [ "fmask=0077" "dmask=0077" ];
};
swapDevices = [ ];
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
}
hosts/backup/default.nix
-90
View File
@@ -1,90 +0,0 @@
{ config, lib, pkgs, ... }:
{
imports = [
./hardware-configuration.nix
../../modules/backup-server.nix
../../modules/ssh.nix
../../lilac.nix
];
networking.hostName = "backup";
time.timeZone = "America/Winnipeg";
systemd.sleep.settings.Sleep = {
AllowSuspend = "no";
AllowHibernation = "no";
AllowHybridSleep = "no";
AllowSuspendThenHibernate = "no";
};
i18n.defaultLocale = "en_US.UTF-8";
i18n.extraLocaleSettings = {
LC_ADDRESS = "en_US.UTF-8";
LC_IDENTIFICATION = "en_US.UTF-8";
LC_MEASUREMENT = "en_US.UTF-8";
LC_MONETARY = "en_US.UTF-8";
LC_NAME = "en_US.UTF-8";
LC_NUMERIC = "en_US.UTF-8";
LC_PAPER = "en_US.UTF-8";
LC_TELEPHONE = "en_US.UTF-8";
LC_TIME = "en_US.UTF-8";
};
services.xserver.enable = true;
services.displayManager.sddm.enable = true;
services.desktopManager.plasma6.enable = true;
services.xserver.xkb = {
layout = "us";
variant = "";
};
services.pulseaudio.enable = false;
security.rtkit.enable = true;
services.pipewire = {
enable = true;
alsa.enable = true;
alsa.support32Bit = true;
pulse.enable = true;
};
environment.systemPackages = with pkgs; [
whipper
flac
tor-browser
];
networking.wireless.enable = true;
networking.networkmanager.enable = true;
services.timesyncd.enable = true; # optional
networking = {
firewall = {
enable = true;
allowedUDPPorts = [ 51820 ];
trustedInterfaces = [ "wg0" ];
};
wireguard.interfaces."wg0" = {
ips = [ "10.0.0.4/24" ];
generatePrivateKeyFile = true;
privateKeyFile = "/var/lib/wireguard/wg0.key";
peers = [{
publicKey = "Tst6SiqoGLSoOAF9l5vT2vvR2RGJ/mFcoBL3BL5n90k=";
allowedIPs = [ "10.0.0.0/24" ];
endpoint = "216.128.177.13:51820";
persistentKeepalive = 25;
}];
};
};
nixpkgs.config.allowUnfree = true;
nix.settings.experimental-features = [ "nix-command" "flakes" ];
system.stateVersion = "26.05";
networking.firewall.interfaces.wg0.allowedTCPPorts = [ 8000 ];
}
hosts/backup/hardware-configuration.nix
-32
View File
@@ -1,32 +0,0 @@
# Do not modify this file! It was generated by ‘nixos-generate-config’
# and may be overwritten by future invocations. Please make changes
# to /etc/nixos/configuration.nix instead.
{ config, lib, pkgs, modulesPath, ... }:
{
imports = [ (modulesPath + "/installer/scan/not-detected.nix") ];
boot.initrd.availableKernelModules = [ "xhci_pci" "ehci_pci" "ahci" "usb_storage" "sd_mod" "sdhci_pci" ];
boot.initrd.kernelModules = [ ];
boot.kernelModules = [ "kvm-intel" ];
boot.extraModulePackages = [ ];
boot.loader.systemd-boot.enable = true;
boot.loader.efi.canTouchEfiVariables = true;
boot.kernelPackages = pkgs.linuxPackages_latest;
fileSystems."/" = {
device = "/dev/disk/by-uuid/61b493e0-8c91-b7d1-4e336da06ff0";
fsType = "ext4";
};
fileSystems."/boot" =
{ device = "/dev/disk/by-uuid/E157-E223";
fsType = "vfat";
options = [ "fmask=0077" "dmask=0077" ];
};
swapDevices = [ ];
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
}
hosts/desktop/default.nix → hosts/desktop.nix
+49 -36
View File
@@ -1,19 +1,19 @@
{ config, lib, pkgs, ... }:
{ config, lib, pkgs, modulesPath, ... }:
{
imports = [
./hardware-configuration.nix
(modulesPath + "/installer/scan/not-detected.nix")
../../modules/backup.nix
../../modules/blog.nix
../../modules/code.nix
../../modules/mail.nix
../../modules/music.nix
../../modules/photo.nix
../../modules/ssh.nix
../../modules/vault.nix
../modules/backup.nix
../modules/blog.nix
../modules/code.nix
../modules/mail.nix
../modules/music.nix
../modules/photo.nix
../modules/ssh.nix
../modules/vault.nix
../../lilac.nix
../lilac.nix
];
networking.hostName = "desktop";
@@ -50,14 +50,6 @@
pulse.enable = true;
};
services.sunshine = {
enable = true;
autoStart = true;
capSysAdmin = true;
openFirewall = true;
};
networking.firewall.interfaces.wg0.allowedTCPPorts = [ 47984 47989 47990 48010 ];
networking.firewall.interfaces.wg0.allowedUDPPorts = [ 47998 47999 48000 48002 48010 ];
services.displayManager.autoLogin.enable = true;
services.displayManager.autoLogin.user = "lilac";
@@ -88,34 +80,55 @@
environment.systemPackages = with pkgs; [
whipper
flac
tor-browser
restic
restic
];
programs.steam.enable = true;
networking = {
firewall = {
enable = true;
allowedUDPPorts = [ 51820 ];
trustedInterfaces = [ "wg0" ];
};
enable = true;
allowedUDPPorts = [ 51820 ];
trustedInterfaces = [ "wg0" ];
};
wireguard.interfaces."wg0" = {
ips = [ "10.0.0.2/24" ];
generatePrivateKeyFile = true;
privateKeyFile = "/var/lib/wireguard/wg0.key";
peers = [{
wireguard.interfaces."wg0" = {
ips = [ "10.0.0.2/32" ];
generatePrivateKeyFile = true;
privateKeyFile = "/var/lib/wireguard/wg0.key";
peers = [{
publicKey = "Tst6SiqoGLSoOAF9l5vT2vvR2RGJ/mFcoBL3BL5n90k=";
allowedIPs = [ "10.0.0.0/24" ];
endpoint = "216.128.177.13:51820";
persistentKeepalive = 25;
}];
};
allowedIPs = [ "10.0.0.0/24" ];
endpoint = "216.128.177.13:51820";
persistentKeepalive = 25;
}];
};
};
nixpkgs.config.allowUnfree = true;
nix.settings.experimental-features = [ "nix-command" "flakes" ];
system.stateVersion = "26.05";
boot.initrd.availableKernelModules = [ "xhci_pci" "ehci_pci" "ahci" "usbhid" "sd_mod" ];
boot.initrd.kernelModules = [ ];
boot.kernelModules = [ ];
boot.extraModulePackages = [ ];
boot.loader.systemd-boot.enable = true;
boot.loader.efi.canTouchEfiVariables = true;
boot.kernelPackages = pkgs.linuxPackages_latest;
boot.kernelParams = [ "amdgpu.runpm=0" ];
fileSystems."/" = {
device = "/dev/disk/by-uuid/d7450680-7d53-4842-83c5-7fc32526dff1";
fsType = "ext4";
};
fileSystems."/boot" = {
device = "/dev/disk/by-uuid/D148-4AB8";
fsType = "vfat";
options = [ "fmask=0077" "dmask=0077" ];
};
swapDevices = [ ];
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
}
hosts/desktop/hardware-configuration.nix
-38
View File
@@ -1,38 +0,0 @@
# Do not modify this file! It was generated by ‘nixos-generate-config’
# and may be overwritten by future invocations. Please make changes
# to /etc/nixos/configuration.nix instead.
{ config, lib, pkgs, modulesPath, ... }:
{
imports =
[ (modulesPath + "/installer/scan/not-detected.nix")
];
boot.initrd.availableKernelModules = [ "xhci_pci" "ehci_pci" "ahci" "usbhid" "sd_mod" ];
boot.initrd.kernelModules = [ ];
boot.kernelModules = [ ];
boot.extraModulePackages = [ ];
boot.loader.systemd-boot.enable = true;
boot.loader.efi.canTouchEfiVariables = true;
boot.kernelPackages = pkgs.linuxPackages_latest;
boot.kernelParams = [
"amdgpu.runpm=0"
];
fileSystems."/" =
{ device = "/dev/disk/by-uuid/d7450680-7d53-4842-83c5-7fc32526dff1";
fsType = "ext4";
};
fileSystems."/boot" =
{ device = "/dev/disk/by-uuid/D148-4AB8";
fsType = "vfat";
options = [ "fmask=0077" "dmask=0077" ];
};
swapDevices = [ ];
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
}
hosts/laptop/default.nix → hosts/laptop.nix
+24 -5
View File
@@ -1,10 +1,10 @@
{ config, pkgs, ... }:
{ config, lib, pkgs, modulesPath, ... }:
{
imports = [
./hardware-configuration.nix
../../lilac.nix
(modulesPath + "/installer/scan/not-detected.nix")
../lilac.nix
];
boot.loader.systemd-boot.enable = true;
@@ -67,7 +67,7 @@
};
wireguard.interfaces."wg0" = {
ips = [ "10.0.0.1/24" ];
ips = [ "10.0.0.1/32" ];
generatePrivateKeyFile = true;
privateKeyFile = "/var/lib/wireguard/wg0.key";
peers = [{
@@ -83,4 +83,23 @@
nixpkgs.config.allowUnfree = true;
system.stateVersion = "26.05";
boot.initrd.availableKernelModules = [ "nvme" "xhci_pci" "thunderbolt" "usb_storage" "sd_mod" ];
boot.initrd.kernelModules = [ ];
boot.kernelModules = [ "kvm-amd" ];
boot.extraModulePackages = [ ];
fileSystems."/" = {
device = "/dev/disk/by-uuid/379e6dd2-af45-4abc-8ff0-802791f76636";
fsType = "ext4";
};
fileSystems."/boot" = {
device = "/dev/disk/by-uuid/D852-8C36";
fsType = "vfat";
options = [ "fmask=0077" "dmask=0077" ];
};
swapDevices = [ ];
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
}
hosts/laptop/hardware-configuration.nix
-31
View File
@@ -1,31 +0,0 @@
# Do not modify this file! It was generated by ‘nixos-generate-config’
# and may be overwritten by future invocations. Please make changes
# to /etc/nixos/configuration.nix instead.
{ config, lib, pkgs, modulesPath, ... }:
{
imports =
[ (modulesPath + "/installer/scan/not-detected.nix")
];
boot.initrd.availableKernelModules = [ "nvme" "xhci_pci" "thunderbolt" "usb_storage" "sd_mod" ];
boot.initrd.kernelModules = [ ];
boot.kernelModules = [ "kvm-amd" ];
boot.extraModulePackages = [ ];
fileSystems."/" =
{ device = "/dev/disk/by-uuid/379e6dd2-af45-4abc-8ff0-802791f76636";
fsType = "ext4";
};
fileSystems."/boot" =
{ device = "/dev/disk/by-uuid/D852-8C36";
fsType = "vfat";
options = [ "fmask=0077" "dmask=0077" ];
};
swapDevices = [ ];
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
}
hosts/vps.nix
+82
View File
@@ -0,0 +1,82 @@
{ config, lib, pkgs, ... }:
{
imports = [
../modules/ssh.nix
../lilac.nix
];
networking.hostName = "vps";
# forwarding inbound network traffic over wireguard
networking = {
firewall = {
enable = true;
allowedTCPPorts = [ 80 443 ];
allowedUDPPorts = [ 51820 ];
trustedInterfaces = [ "wg0" ];
};
wireguard.interfaces."wg0" = {
ips = [ "10.0.0.3/32" ];
listenPort = 51820;
generatePrivateKeyFile = true;
privateKeyFile = "/var/lib/wireguard/wg0.key";
peers = [
{
allowedIPs = [ "10.0.0.1/32" ];
publicKey = "guKFJGQW946HXWjca/biMYH1nJKw0fguLjzGXKZ7Bxw=";
}
{
allowedIPs = [ "10.0.0.2/32" ];
publicKey = "7BcwtszpzS4ABDwKwMaiJ7F35sJRa89fBbuh80Sk8Uk=";
}
{
allowedIPs = [ "10.0.0.4/32" ];
publicKey = "XjuV3wzkP03UUjYSJfY3OG3WWLRtoQBN7GokDEWhdhQ=";
}
];
};
nftables = {
enable = true;
tables.nat = {
family = "ip";
content = ''
chain prerouting {
type nat hook prerouting priority dstnat; policy accept;
iifname "enp1s0" tcp dport { 80, 443 } dnat to 10.0.0.2
}
chain postrouting {
type nat hook postrouting priority srcnat; policy accept;
oifname "wg0" masquerade
}
'';
};
};
};
boot.kernel.sysctl = {
"net.ipv4.ip_forward" = 1;
};
nix.settings.experimental-features = [ "nix-command" "flakes" ];
system.stateVersion = "26.05";
boot = {
initrd.availableKernelModules = [ "ahci" "xhci_pci" "virtio_pci" "sr_mod" "virtio_blk" ];
kernelModules = [ ];
extraModulePackages = [ ];
loader.systemd-boot.enable = true;
loader.efi.canTouchEfiVariables = true;
loader.efi.efiSysMountPoint = "/boot/efi";
};
fileSystems."/" = { device = "/dev/vda2"; fsType = "ext4"; };
fileSystems."/boot/efi" = { device = "/dev/vda1"; fsType = "vfat"; };
swapDevices = [ ];
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
virtualisation.hypervGuest.enable = true;
}
hosts/vps/default.nix
-65
View File
@@ -1,65 +0,0 @@
{ config, lib, pkgs, ... }:
{
imports = [
./hardware-configuration.nix
../../modules/ssh.nix
../../lilac.nix
];
networking.hostName = "vps";
# forwarding inbound network traffic over wireguard
networking = {
firewall = {
enable = true;
allowedTCPPorts = [ 80 443 ];
allowedUDPPorts = [ 51820 ];
trustedInterfaces = [ "wg0" ];
};
wireguard.interfaces."wg0" = {
ips = [ "10.0.0.3/24" ];
listenPort = 51820;
generatePrivateKeyFile = true;
privateKeyFile = "/var/lib/wireguard/wg0.key";
peers = [
{
allowedIPs = [ "10.0.0.1/32" ];
publicKey = "guKFJGQW946HXWjca/biMYH1nJKw0fguLjzGXKZ7Bxw=";
}
{
allowedIPs = [ "10.0.0.2/32" ];
publicKey = "7BcwtszpzS4ABDwKwMaiJ7F35sJRa89fBbuh80Sk8Uk=";
}
{
allowedIPs = [ "10.0.0.4/32" ];
publicKey = "XjuV3wzkP03UUjYSJfY3OG3WWLRtoQBN7GokDEWhdhQ=";
}
];
};
nftables = {
enable = true;
tables.nat = {
family = "ip";
content = ''
chain prerouting {
type nat hook prerouting priority dstnat; policy accept;
iifname "enp1s0" tcp dport { 80, 443 } dnat to 10.0.0.2
}
chain postrouting {
type nat hook postrouting priority srcnat; policy accept;
oifname "wg0" masquerade
}
'';
};
};
};
boot.kernel.sysctl = {
"net.ipv4.ip_forward" = 1;
};
nix.settings.experimental-features = [ "nix-command" "flakes" ];
system.stateVersion = "26.05";
}
hosts/vps/hardware-configuration.nix
-19
View File
@@ -1,19 +0,0 @@
{ config, lib, pkgs, ... }:
{
boot = {
initrd.availableKernelModules = [ "ahci" "xhci_pci" "virtio_pci" "sr_mod" "virtio_blk" ];
kernelModules = [ ];
extraModulePackages = [ ];
loader.systemd-boot.enable = true;
loader.efi.canTouchEfiVariables = true;
loader.efi.efiSysMountPoint = "/boot/efi";
};
fileSystems."/" = { device = "/dev/vda2"; fsType = "ext4"; };
fileSystems."/boot/efi" = { device = "/dev/vda1"; fsType = "vfat"; };
swapDevices = [ ];
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
virtualisation.hypervGuest.enable = true;
}