Lilac/Chickadee
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Compare commits

base: Lilac/Chickadee:main
Branches Tags
Lilac/Chickadee:main
..
compare: Lilac/Chickadee:75ad8e24b8c38363e2bc435e909d963503e0c076
Branches Tags
Lilac/Chickadee:main
1 Commits
main .. 75ad8e24b8
Author SHA1 Message Date
Lilac 75ad8e24b8 headscale works 2026-07-29 21:55:59 -04:00
20 changed files with 182 additions and 330 deletions
Expand all files Collapse all files
flake.lock
Generated
+15 -28
View File
@@ -9,11 +9,11 @@
"utils": "utils"
},
"locked": {
"lastModified": 1785518313,
"narHash": "sha256-anlq3YQDCsNrkNlu3HTg4dEIpRugwnyAVUxoPcBmA/U=",
"lastModified": 1781627888,
"narHash": "sha256-5yHuAh9k7rT7rtf3uRaXkiUyYvQE9oaCgzhprLm2mr8=",
"owner": "serokell",
"repo": "deploy-rs",
"rev": "b974715a27b49fadbf3bf6d85e26bcb3109daa6d",
"rev": "6d3087eedff75a715b40c0e124ba15d2dd7bec28",
"type": "github"
},
"original": {
@@ -79,11 +79,11 @@
]
},
"locked": {
"lastModified": 1785119570,
"narHash": "sha256-Rgs2xKnGLFWQscxUaXX07oyZeuMDOHEbqDOsgliLFGM=",
"lastModified": 1783740085,
"narHash": "sha256-qajyHfZY29G2oEQk+uHxmsJcRoBUBXP9maTpFlwP/dI=",
"owner": "nix-community",
"repo": "home-manager",
"rev": "d4fd24667c8cbef124bb70a20380cab75ec8474d",
"rev": "3cd22efe6471dc7365c822bd9ad73a21e55f38fb",
"type": "github"
},
"original": {
@@ -111,11 +111,11 @@
},
"nixpkgs_2": {
"locked": {
"lastModified": 1785599192,
"narHash": "sha256-dg4RTtDxnXY13UkJNdhmgTUTl0n/IJBlCigfO7nutZw=",
"lastModified": 1783703440,
"narHash": "sha256-O3/YajjWo001VUIgD8BwaRdSNLUFe7nZ1qV5TwhRBcw=",
"owner": "NixOS",
"repo": "nixpkgs",
"rev": "6d65bfc1bcef2ef39a239d38e577e92a89fb0f07",
"rev": "8f0500b9660505dc3cb647775fe9a978a74b5283",
"type": "github"
},
"original": {
@@ -125,22 +125,6 @@
"type": "github"
}
},
"nixpkgs_3": {
"locked": {
"lastModified": 1782175435,
"narHash": "sha256-EMzXKmnOtBQ2MnvpiNOm7E+kOMvdPrIKaeg52Tip2Uk=",
"owner": "NixOS",
"repo": "nixpkgs",
"rev": "89570f24e97e614aa34aa9ab1c927b6578a43775",
"type": "github"
},
"original": {
"owner": "NixOS",
"ref": "nixpkgs-unstable",
"repo": "nixpkgs",
"type": "github"
}
},
"root": {
"inputs": {
"deploy-rs": "deploy-rs",
@@ -153,7 +137,9 @@
},
"sops-nix": {
"inputs": {
"nixpkgs": "nixpkgs_3"
"nixpkgs": [
"nixpkgs"
]
},
"locked": {
"lastModified": 1783174389,
@@ -164,8 +150,9 @@
"type": "github"
},
"original": {
"id": "sops-nix",
"type": "indirect"
"owner": "Mic92",
"repo": "sops-nix",
"type": "github"
}
},
"systems": {
flake.nix
+7 -21
View File
@@ -8,6 +8,9 @@
home-manager.url = "github:nix-community/home-manager/release-26.05";
home-manager.inputs.nixpkgs.follows = "nixpkgs";
sops-nix.url = "github:Mic92/sops-nix";
sops-nix.inputs.nixpkgs.follows = "nixpkgs";
grasswren.url = "git+https://code.grasswren.net/Lilac/Grasswren.git?ref=main";
grasswren.flake = false;
};
@@ -20,6 +23,8 @@
specialArgs = { inherit inputs; };
modules = [
home-manager.nixosModules.home-manager
sops-nix.nixosModules.sops
./hosts/desktop/default.nix
];
};
@@ -28,18 +33,9 @@
system = "x86_64-linux";
specialArgs = { inherit inputs; };
modules = [
home-manager.nixosModules.home-manager
./hosts/vps/default.nix
];
};
backup = nixpkgs.lib.nixosSystem {
system = "x86_64-linux";
specialArgs = { inherit inputs; };
modules = [
home-manager.nixosModules.home-manager
./hosts/backup/default.nix
];
};
};
homeConfigurations.lilac = home-manager.lib.homeManagerConfiguration {
@@ -53,7 +49,7 @@
# nix run github:serokell/deploy-rs
deploy.nodes = {
vps = {
hostname = "10.0.0.3";
hostname = "vps.vpn";
sshUser = "root";
magicRollbackTimeout = 120;
profiles.system = {
@@ -64,7 +60,7 @@
};
desktop = {
hostname = "10.0.0.2";
hostname = "desktop.vpn";
sshUser = "root";
magicRollbackTimeout = 120;
profiles.system = {
@@ -72,16 +68,6 @@
remoteBuild = false;
path = deploy-rs.lib.x86_64-linux.activate.nixos self.nixosConfigurations.desktop;
};
};
backup = {
hostname = "10.0.0.4";
sshUser = "root";
magicRollbackTimeout = 120;
profiles.system = {
user = "root";
remoteBuild = false;
path = deploy-rs.lib.x86_64-linux.activate.nixos self.nixosConfigurations.backup;
};
};
};
checks = {
hosts/backup/default.nix
-109
View File
@@ -1,109 +0,0 @@
{ config, lib, pkgs, ... }:
{
imports = [ ./hardware-configuration.nix ../../modules/ssh.nix ];
networking.hostName = "backup";
users.users.lilac = {
isNormalUser = true;
group = "lilac";
extraGroups = [ "wheel" ];
};
users.groups.lilac = {};
home-manager = {
useGlobalPkgs = true;
useUserPackages = true;
users.lilac = import ../../home/lilac.nix;
};
programs.zsh.enable = true;
users.users.lilac.shell = pkgs.zsh;
security.sudo.wheelNeedsPassword = false;
time.timeZone = "America/Winnipeg";
systemd.sleep.settings.Sleep = {
AllowSuspend = "no";
AllowHibernation = "no";
AllowHybridSleep = "no";
AllowSuspendThenHibernate = "no";
};
i18n.defaultLocale = "en_US.UTF-8";
i18n.extraLocaleSettings = {
LC_ADDRESS = "en_US.UTF-8";
LC_IDENTIFICATION = "en_US.UTF-8";
LC_MEASUREMENT = "en_US.UTF-8";
LC_MONETARY = "en_US.UTF-8";
LC_NAME = "en_US.UTF-8";
LC_NUMERIC = "en_US.UTF-8";
LC_PAPER = "en_US.UTF-8";
LC_TELEPHONE = "en_US.UTF-8";
LC_TIME = "en_US.UTF-8";
};
services.xserver.enable = true;
services.displayManager.sddm.enable = true;
services.desktopManager.plasma6.enable = true;
services.xserver.xkb = {
layout = "us";
variant = "";
};
services.pulseaudio.enable = false;
security.rtkit.enable = true;
services.pipewire = {
enable = true;
alsa.enable = true;
alsa.support32Bit = true;
pulse.enable = true;
};
environment.systemPackages = with pkgs; [
whipper
flac
tor-browser
];
networking.wireless.enable = true;
networking.networkmanager.enable = true;
services.timesyncd.enable = true; # optional
networking = {
firewall = {
enable = true;
allowedUDPPorts = [ 51820 ];
trustedInterfaces = [ "wg0" ];
};
wireguard.interfaces."wg0" = {
ips = [ "10.0.0.4/24" ];
generatePrivateKeyFile = true;
privateKeyFile = "/var/lib/wireguard/wg0.key";
peers = [{
publicKey = "Tst6SiqoGLSoOAF9l5vT2vvR2RGJ/mFcoBL3BL5n90k=";
allowedIPs = [ "10.0.0.0/24" ];
endpoint = "216.128.177.13:51820";
persistentKeepalive = 25;
}];
};
};
nixpkgs.config.allowUnfree = true;
nix.settings.experimental-features = [ "nix-command" "flakes" ];
system.stateVersion = "26.05";
services.restic.server = {
enable = true;
listenAddress = "10.0.0.4:8000";
dataDir = "/var/lib/restic";
appendOnly = true;
extraFlags = [ "--no-auth" ];
};
networking.firewall.interfaces.wg0.allowedTCPPorts = [ 8000 ];
}
hosts/backup/hardware-configuration.nix
-32
View File
@@ -1,32 +0,0 @@
# Do not modify this file! It was generated by ‘nixos-generate-config’
# and may be overwritten by future invocations. Please make changes
# to /etc/nixos/configuration.nix instead.
{ config, lib, pkgs, modulesPath, ... }:
{
imports = [ (modulesPath + "/installer/scan/not-detected.nix") ];
boot.initrd.availableKernelModules = [ "xhci_pci" "ehci_pci" "ahci" "usb_storage" "sd_mod" "sdhci_pci" ];
boot.initrd.kernelModules = [ ];
boot.kernelModules = [ "kvm-intel" ];
boot.extraModulePackages = [ ];
boot.loader.systemd-boot.enable = true;
boot.loader.efi.canTouchEfiVariables = true;
boot.kernelPackages = pkgs.linuxPackages_latest;
fileSystems."/" = {
device = "/dev/disk/by-uuid/61b493e0-8c91-b7d1-4e336da06ff0";
fsType = "ext4";
};
fileSystems."/boot" =
{ device = "/dev/disk/by-uuid/E157-E223";
fsType = "vfat";
options = [ "fmask=0077" "dmask=0077" ];
};
swapDevices = [ ];
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
}
hosts/desktop/default.nix
+10 -40
View File
@@ -4,16 +4,19 @@
imports = [
./hardware-configuration.nix
../../modules/site/blog.nix
../../modules/site/code.nix
../../modules/site/mail.nix
../../modules/site/music.nix
../../modules/site/photo.nix
../../modules/site/vault.nix
../../modules/network.nix
../../modules/ssh.nix
../../modules/wireguard.nix
../../modules/headscale.nix
../../modules/tailscale.nix
../../modules/site.nix
../../modules/gitea.nix
../../modules/navidrome.nix
../../modules/immich.nix
];
network.node = "desktop";
networking.hostName = "desktop";
users.users.lilac = {
@@ -103,42 +106,9 @@
environment.systemPackages = with pkgs; [
whipper
flac
tor-browser
restic
];
programs.steam.enable = true;
networking = {
firewall = {
enable = true;
allowedUDPPorts = [ 51820 ];
trustedInterfaces = [ "wg0" ];
};
wireguard.interfaces."wg0" = {
ips = [ "10.0.0.2/24" ];
generatePrivateKeyFile = true;
privateKeyFile = "/var/lib/wireguard/wg0.key";
peers = [{
publicKey = "Tst6SiqoGLSoOAF9l5vT2vvR2RGJ/mFcoBL3BL5n90k=";
allowedIPs = [ "10.0.0.0/24" ];
endpoint = "216.128.177.13:51820";
persistentKeepalive = 25;
}];
};
};
nixpkgs.config.allowUnfree = true;
nix.settings.experimental-features = [ "nix-command" "flakes" ];
system.stateVersion = "26.05";
services.restic.backups.backup = {
repository = "rest:http://10.0.0.4:8000/backup";
initialize = true;
passwordFile = "/home/lilac/test-password";
paths = [ "/var/lib/immich" "/var/lib/music" "/var/lib/gitea" "/var/lib/vault-backup" ];
timerConfig.OnCalendar = "03:30";
pruneOpts = [ "--keep-daily 7" "--keep-weekly 4" "--keep-monthly 12" ];
};
}
hosts/vps/default.nix
+6 -64
View File
@@ -4,75 +4,17 @@
imports = [
./hardware-configuration.nix
../../modules/network.nix
../../modules/ssh.nix
../../modules/wireguard.nix
../../modules/tailscale.nix
../../modules/http-forwarding.nix
];
network.node = "vps";
networking.hostName = "vps";
users.users.lilac = {
isNormalUser = true;
group = "lilac";
extraGroups = [ "wheel" ];
};
users.groups.lilac = {};
home-manager = {
useGlobalPkgs = true;
useUserPackages = true;
users.lilac = import ../../home/lilac.nix;
};
programs.zsh.enable = true;
users.users.lilac.shell = pkgs.zsh;
security.sudo.wheelNeedsPassword = false;
# forwarding inbound network traffic over wireguard
networking = {
firewall = {
enable = true;
allowedTCPPorts = [ 80 443 ];
allowedUDPPorts = [ 51820 ];
trustedInterfaces = [ "wg0" ];
};
wireguard.interfaces."wg0" = {
ips = [ "10.0.0.3/24" ];
listenPort = 51820;
generatePrivateKeyFile = true;
privateKeyFile = "/var/lib/wireguard/wg0.key";
peers = [
{
allowedIPs = [ "10.0.0.1/32" ];
publicKey = "n+9eh8VUP9NCnjPL0Z/KPc0TQCQloXE2Ipc5+CBtJjU=";
}
{
allowedIPs = [ "10.0.0.2/32" ];
publicKey = "7BcwtszpzS4ABDwKwMaiJ7F35sJRa89fBbuh80Sk8Uk=";
}
{
allowedIPs = [ "10.0.0.4/32" ];
publicKey = "XjuV3wzkP03UUjYSJfY3OG3WWLRtoQBN7GokDEWhdhQ=";
}
];
};
nftables = {
enable = true;
tables.nat = {
family = "ip";
content = ''
chain prerouting {
type nat hook prerouting priority dstnat; policy accept;
iifname "enp1s0" tcp dport { 80, 443 } dnat to 10.0.0.2
}
chain postrouting {
type nat hook postrouting priority srcnat; policy accept;
oifname "wg0" masquerade
}
'';
};
};
};
boot.kernel.sysctl = {
"net.ipv4.ip_forward" = 1;
};
nix.settings.experimental-features = [ "nix-command" "flakes" ];
system.stateVersion = "26.05";
}
hosts/vps/hardware-configuration.nix
+2 -2
View File
@@ -7,11 +7,11 @@
extraModulePackages = [ ];
loader.systemd-boot.enable = true;
loader.efi.canTouchEfiVariables = true;
loader.efi.efiSysMountPoint = "/boot/efi";
loader.efi.efiSysMountPoint = "/boot";
};
fileSystems."/" = { device = "/dev/vda2"; fsType = "ext4"; };
fileSystems."/boot/efi" = { device = "/dev/vda1"; fsType = "vfat"; };
fileSystems."/boot" = { device = "/dev/vda1"; fsType = "vfat"; };
swapDevices = [ ];
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
modules/derp.yaml
+1
View File
File diff suppressed because one or more lines are too long
modules/site/mail.nix → modules/email.nix
View File
modules/site/code.nix → modules/gitea.nix
-2
View File
@@ -19,8 +19,6 @@
name = "gitea";
user = "gitea";
};
settings.service.DISABLE_REGISTRATION = true;
};
services.caddy = {
modules/site/vpn.nix → modules/headscale.nix
+9 -3
View File
@@ -1,11 +1,17 @@
{ config, lib, pkgs, ... }:
{
systemd.services.headscale.environment = {
GODEBUG = "netdns=go";
};
networking.enableIPv6 = false;
environment.etc."headscale/derp.yaml".source = ./derp.yaml;
services.headscale = {
enable = true;
settings = {
server_url = "https://vpn.grasswren.net";
listen_addr = "127.0.0.1:8080";
listen_addr = "0.0.0.0:8080";
database.type = "sqlite";
@@ -15,8 +21,8 @@
];
dns = {
magic_domain = true;
base_domain = "vpn.grasswren.net";
magic_dns = true;
base_domain = "vpn";
nameservers.global = [ "1.1.1.1" ];
};
};
modules/http-forwarding.nix
+28
View File
@@ -0,0 +1,28 @@
{ config, lib, pkgs, ... }:
{
networking.firewall.enable = true;
networking.firewall.allowedTCPPorts = [ 80 443 ];
networking.nftables.enable = true;
networking.nftables.tables.nat = {
family = "ip";
content = ''
chain prerouting {
type nat hook prerouting priority dstnat; policy accept;
iifname "enp1s0" tcp dport 80 dnat to 10.0.0.2:80
iifname "enp1s0" tcp dport 443 dnat to 10.0.0.2:443
}
chain postrouting {
type nat hook postrouting priority srcnat; policy accept;
oifname "wg0" masquerade
}
'';
};
boot.kernel.sysctl = {
"net.ipv4.ip_forward" = 1;
};
}
modules/site/photo.nix → modules/immich.nix
+1 -1
View File
@@ -10,7 +10,7 @@
services.caddy = {
enable = true;
virtualHosts."photo.grasswren.net".extraConfig = ''
virtualHosts."image.grasswren.net".extraConfig = ''
reverse_proxy localhost:2283
'';
};
modules/site/music.nix → modules/navidrome.nix
View File
modules/network.nix
+41
View File
@@ -0,0 +1,41 @@
{ config, lib, pkgs, ... }:
{
options.network = {
nodes = lib.mkOption { type = lib.types.attrsOf
(lib.types.submodule ({ name, config, ... }: {
options = {
id = lib.mkOption { type = lib.types.int; };
ssh = lib.mkOption { type = lib.types.str; };
vpn = lib.mkOption { type = lib.types.str; };
address-vpn = lib.mkOption { type = lib.types.str; };
address-pub = lib.mkOption { type = lib.types.nullOr lib.types.str; default = null; };
};
config = {
address-vpn = "10.0.0.${toString config.id}";
};
}));
};
node = lib.mkOption { type = lib.types.str; };
};
config.network = {
nodes = {
laptop = {
id = 1;
ssh = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKhCH6YN63AWFsR1wZ6wJdZ2jlTtYBSkY5FnLrWoLKeg";
vpn = "n+9eh8VUP9NCnjPL0Z/KPc0TQCQloXE2Ipc5+CBtJjU=";
};
desktop = {
id = 2;
ssh = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFdOUv+mUhnS2sbahlqcqm9Ili16/rOk2WAlMSXrjnHu";
vpn = "7BcwtszpzS4ABDwKwMaiJ7F35sJRa89fBbuh80Sk8Uk=";
};
vps = {
id = 3;
ssh = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGiiLFiy+UcOi0RgZ1Xvuzl4C5aiZ+bcGaOmQcI/UBXp";
vpn = "c5irm217aE+QVwHYmnQh4r91u2fZmQKBIWVgFVMaEwU=";
address-pub = "216.128.177.13";
};
};
};
}
modules/site/blog.nix → modules/site.nix
+6
View File
@@ -23,5 +23,11 @@ in
root * ${website}/blog
file_server
'';
virtualHosts."birds.grasswren.net".extraConfig = ''
encode
root * ${website}/birds
file_server
'';
};
}
modules/site/vault.nix
-21
View File
@@ -1,21 +0,0 @@
{ config, lib, pkgs, ... }:
{
services.vaultwarden = {
enable = true;
backupDir = "/var/lib/vault-backup";
config = {
DOMAIN = "https://vault.example.com";
SIGNUPS_ALLOWED = false;
ROCKET_ADDRESS = "127.0.0.1";
ROCKET_PORT = 8222;
};
};
services.caddy = {
enable = true;
virtualHosts."vault.grasswren.net".extraConfig = ''
reverse_proxy localhost:8222
'';
};
}
modules/ssh.nix
+12 -6
View File
@@ -1,9 +1,12 @@
{ config, lib, pkgs, ... }:
let
me = config.network.nodes.${config.network.node};
in
{
networking.firewall = {
enable = true;
interfaces.wg0.allowedTCPPorts = [ 22 ];
allowedTCPPorts = [ 22 ];
};
services.openssh = {
enable = true;
@@ -18,11 +21,14 @@
}];
};
users.users.lilac.openssh.authorizedKeys.keys = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKhCH6YN63AWFsR1wZ6wJdZ2jlTtYBSkY5FnLrWoLKeg"
];
users.users.root.openssh.authorizedKeys.keys = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKhCH6YN63AWFsR1wZ6wJdZ2jlTtYBSkY5FnLrWoLKeg"
config.network.nodes.laptop.ssh
config.network.nodes.desktop.ssh
];
users.users.lilac = lib.mkIf (config.network.node != "vps") {
openssh.authorizedKeys.keys = [
config.network.nodes.laptop.ssh
config.network.nodes.desktop.ssh
];
};
}
modules/tailscale.nix
+5
View File
@@ -0,0 +1,5 @@
{ config, lib, pkgs, ... }:
{
services.tailscale.enable = true;
}
modules/wireguard.nix
+38
View File
@@ -0,0 +1,38 @@
{ config, lib, pkgs, ... }:
let
me = config.network.nodes.${config.network.node};
in
{
networking = {
firewall = {
allowedUDPPorts = [ 51820 ];
trustedInterfaces = [ "wg0" ];
};
wireguard.interfaces."wg0" = {
ips = [ "${me.address-vpn}/24" ];
listenPort = 51820;
generatePrivateKeyFile = true;
privateKeyFile = "/var/lib/wireguard/wg0.key";
peers = lib.mapAttrsToList (name: peer: {
publicKey = peer.vpn;
allowedIPs =
if config.network.node == "vps"
then [ "${peer.address-vpn}/32" ]
else [ "10.0.0.0/24" ];
endpoint =
if peer.address-pub != null
then "${peer.address-pub}:51820"
else null;
persistentKeepalive =
if peer.address-pub != null
then 25
else null;
}) (lib.filterAttrs (name: _:
if config.network.node == "vps"
then name != "vps"
else name == "vps"
) config.network.nodes);
};
};
}