diff --git a/configuration.nix b/configuration.nix new file mode 100644 index 0000000..ba9fb81 --- /dev/null +++ b/configuration.nix @@ -0,0 +1,537 @@ +# Edit this configuration file to define what should be installed on +# your system. Help is available in the configuration.nix(5) man page, on +# https://search.nixos.org/options and in the NixOS manual (`nixos-help`). +{ + config, + lib, + pkgs, + inputs, + ... +}: { + imports = [ + # Include the results of the hardware scan. + ./hardware-configuration.nix + ]; + + boot.loader.systemd-boot.enable = true; + boot.kernelModules = ["kvm-intel"]; + boot.loader.systemd-boot.configurationLimit = 30; + boot.loader.efi.canTouchEfiVariables = true; + + # + # hardware.graphics.enable = true; + # + # hardware.nvidia = { + # modesetting.enable = true; + # + # open = false; # Recommended for GTX 1060 + # + # nvidiaSettings = true; + # + # package = config.boot.kernelPackages.nvidiaPackages.stable; + # }; + # + # environment.sessionVariables = { + # NIXOS_OZONE_WL = "1"; + # }; + + boot.kernel.sysctl = { + "net.ipv4.ip_forward" = 1; + "net.bridge.bridge-nf-call-iptables" = 1; + "net.ipv4.conf.all.forwarding" = 1; + "net.ipv6.conf.all.forwarding" = 1; + "net.ipv4.conf.all.proxy_arp" = 1; + "net.ipv4.conf.ens2.proxy_arp" = 1; + }; + nixpkgs.config.allowUnfree = true; + + fileSystems."/mnt/games" = { + device = "/dev/disk/by-uuid/969eb1a0-fb99-46d1-96cf-57a8644ee2d1"; + fsType = "btrfs"; + options = [ + "users" + "compress=zstd" + "subvol=@games" + "nofail" + ]; + }; + + fileSystems."/mnt/photo" = { + device = "/dev/disk/by-uuid/969eb1a0-fb99-46d1-96cf-57a8644ee2d1"; + fsType = "btrfs"; + options = [ + "users" + "compress=zstd" + "subvol=@Pictures" + "nofail" + ]; + }; + + fileSystems."/mnt/media" = { + device = "/dev/disk/by-uuid/969eb1a0-fb99-46d1-96cf-57a8644ee2d1"; + fsType = "btrfs"; + options = [ + "users" + "compress=zstd" + "subvol=@media" + "nofail" + ]; + }; + + fileSystems."/mnt/winbackup" = { + device = "/dev/disk/by-uuid/969eb1a0-fb99-46d1-96cf-57a8644ee2d1"; + fsType = "btrfs"; + options = [ + "users" + "compress=zstd" + "subvol=@winbackup" + "nofail" + ]; + }; + + fileSystems."/mnt/winhdd" = { + device = "/dev/sdb1"; + fsType = "ntfs"; + options = [ + "users" + "windows_names" + "noatime" + "nofail" + ]; + }; + + virtualisation.libvirtd = { + "enable" = true; + allowedBridges = ["br0"]; + }; + + virtualisation.docker.enable = true; + programs.virt-manager.enable = true; + + programs.zsh.enable = true; + + networking.hostName = "dogma-nixos"; # Define your hostname. + + # Configure network connections interactively with nmcli or nmtui. + networking.networkmanager.enable = true; + networking.firewall.trustedInterfaces = ["br0"]; + # Set your time zone. + time.timeZone = "America/Phoenix"; + + # Configure network proxy if necessary + # networking.proxy.default = "http://user:password@proxy:port/"; + # networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain"; + + # Select internationalisation properties. + i18n.defaultLocale = "en_US.UTF-8"; + console = { + font = "Lat2-Terminus16"; + useXkbConfig = true; # use xkb.options in tty. + }; + + # Enable the X11 windowing system. + services.xserver.enable = true; + services.xserver.xkb.layout = "us"; + services.xserver.xkb.options = "caps:escape"; + + # Enable CUPS to print documents. + # services.printing.enable = true; + + # Enable sound. + # services.pulseaudio.enable = true; + # OR + nix.settings.experimental-features = ["nix-command" "flakes"]; + + sops.age.keyFile = "/var/lib/sops-nix/keys.txt"; + #sops.age.generateKey = true; + sops.defaultSopsFile = ./secrets/secrets.yaml; + + sops.secrets = { + "factorio/service_username" = {}; + "factorio/service_token" = {}; + "factorio/gamepassword" = {}; + "backblaze/apikey" = {}; + "google/gmail" = {}; + "caddy/acme_email" = {}; + "dedyn/dnstoken" = {}; + "dedyn/dnsuser" = {}; + "github/token" = {}; + "gitlab/token" = {}; + "openai/legacy_token" = {}; + }; + + sops.templates."factorio.json".content = builtins.toJSON { + service_username = config.sops.placeholder."factorio/service_username"; + service_token = config.sops.placeholder."factorio/service_token"; + gamepassword = config.sops.placeholder."factorio/gamepassword"; + }; + + sops.templates."duplicity.env".content = builtins.toJSON { + service_username = config.sops.placeholder."factorio/service_username"; + service_token = config.sops.placeholder."factorio/service_token"; + gamepassword = config.sops.placeholder."factorio/gamepassword"; + }; + + sops.templates."caddy.env" = { + owner = "root"; + mode = "0600"; + restartUnits = ["caddy.service"]; + content = '' + ACME_EMAIL='${config.sops.placeholder."caddy/acme_email"}' + ''; + }; + + services.pipewire = { + enable = true; + pulse.enable = true; + }; + + # Enable touchpad support (enabled default in most desktopManager). + # services.libinput.enable = true; + + # Define a user account. Don't forget to set a password with ‘passwd’. + users.defaultUserShell = pkgs.zsh; + + services.getty.autologinUser = "mask"; + users.users.mask = { + isNormalUser = true; + shell = pkgs.zsh; + + # Enable ‘sudo’ for the user. packages = with pkgs; [ + # tree + extraGroups = [ + "wheel" + "libvirtd" + "media" + "uinput" + ]; + }; + services.sunshine = { + enable = true; + autoStart = true; + capSysAdmin = true; # only needed for Wayland -- omit this when using with Xorg + openFirewall = true; + }; + + # programs.firefox.enable = true; + + # List packages installed in system profile. + # You can use https://search.nixos.org/ to find more packages (and options). + + programs.hyprland.enable = true; # enable Hyprland + programs.nix-ld = { + enable = true; + + libraries = with pkgs; [ + zlib + zstd + stdenv.cc.cc + curl + openssl + libssh + bzip2 + libxml2 + acl + libsodium + util-linux + xz + systemd + ]; + }; + + environment.systemPackages = with pkgs; [ + stylua + gh + glab + gnupg + duplicity + wget + factorio-headless + dig + parted + tor-browser + jujutsu + caddy + clang + ansible + exiftool + gcc + home-manager + flaresolverr + docker-compose + virtio-win + spice + spice-gtk + OVMF + pigz + mpv + zed + wofi + wayvnc + pcmanfm + htop + rsync + tmux + git + kitty + python3 + samba + deno + qbittorrent-nox + sonarr + radarr + jackett + jellyfin + curl + p7zip + dnsmasq + brave + keepassxc + sops + age + ]; + + # Some programs need SUID wrappers, can be configured further or are + # started in user sessions. + # programs.mtr.enable = true; + # programs.gnupg.agent = { enable = true; + # enableSSHSupport = true; + # }; + + # List services that you want to enable: + + # Enable the OpenSSH daemon. + services.openssh.enable = true; + + services.caddy = { + enable = true; + globalConfig = '' + acme_ca https://acme.zerossl.com/v2/DV90 + email {$ACME_EMAIL}; + ''; + + #tls ${config.sops.secrets.zerossl_cert.path} ${config.sops.secrets.zerossl_private_key.path} + virtualHosts."centraldogma.dedyn.io:".extraConfig = '' + redir /jellyfin /jellyfin/ + reverse_proxy /jellyfin/* 127.0.0.1:8096 + + redir /sonarr /sonarr/ + reverse_proxy /sonarr/* 127.0.0.1:8989 + + redir /radarr /radarr/ + reverse_proxy /radarr/* 127.0.0.1:7878 + + ''; + }; + services.flaresolverr = { + enable = true; + }; + services.samba = { + enable = true; + openFirewall = true; + settings = { + global = { + "security" = "user"; + "workgroup" = "WORKGROUP"; + "server string" = "smbnix"; + "netbios name" = "smbnix"; + #"use sendfile" = "yes"; + #"max protocol" = "smb2"; + # note: localhost is the ipv6 localhost ::1 + "hosts allow" = "192.168.1.1/24 127.0.0.1 localhost"; + "guest account" = "nobody"; + "map to guest" = "bad user"; + }; + + "games" = { + "path" = "/mnt/games"; + "browseable" = "yes"; + "read only" = "no"; + "guest ok" = "no"; + "create mask" = "0644"; + "directory mask" = "0755"; + }; + + "media" = { + "path" = "/mnt/media"; + "browseable" = "yes"; + "read only" = "no"; + "guest ok" = "no"; + "create mask" = "0644"; + "directory mask" = "0755"; + }; + + "photos" = { + "path" = "/mnt/photo"; + "browseable" = "yes"; + "read only" = "no"; + "guest ok" = "no"; + "create mask" = "0644"; + "directory mask" = "0755"; + }; + "x" = { + "path" = "/home/mask/mounts/x"; + "browseable" = "yes"; + "read only" = "no"; + "guest ok" = "no"; + "create mask" = "0644"; + "directory mask" = "0755"; + }; + "winhdd" = { + "path" = "/mnt/winhdd"; + "browseable" = "yes"; + "read only" = "no"; + "guest ok" = "no"; + "create mask" = "0644"; + "directory mask" = "0755"; + }; + + "winback" = { + "path" = "/mnt/winbackup"; + "browseable" = "yes"; + "read only" = "no"; + "guest ok" = "no"; + "create mask" = "0644"; + "directory mask" = "0755"; + }; + }; + }; + services.samba-wsdd = { + enable = true; + openFirewall = true; + }; + + networking.interfaces.enp6s0.useDHCP = false; + networking.interfaces.br0.useDHCP = true; + networking.bridges.br0.interfaces = ["enp6s0"]; + + # Open ports in the firewall. + # networking.firewall.allowedTCPPorts = [ ... ]; + # networking.firewall.allowedUDPPorts = [ ... ]; + # Or disable the firewall altogether. + + # services.dnsmasq.enable = true; + # services.resolved.enable = false; + # networking.nameservers = ["1.1.1.1" "1.1.1.0"]; + # + # services.dnsmasq.settings = { + # interface = "br0"; + # bind-interface = true; + # server = [ + # "1.1.1.1" + # "1.1.1.0" + # ]; + # domain-needed = true; + # bogus-priv = true; + # }; + + #Services section + services.jackett = { + enable = true; + }; + + # services.duplicity = { + # enable = true; + # }; + + services.factorio = { + enable = true; + public = true; + requireUserVerification = true; + username = "TheMaskedMan95"; + admins = ["TheMaskedMan95"]; + game-name = "Realm of the Masked Men"; + description = "No Dogs allowed"; + extraSettingsFile = config.sops.templates."factorio.json".path; + saveName = "SPACExxxx"; + openFirewall = true; + }; + + services.radarr = { + enable = true; + }; + services.sonarr = { + enable = true; + }; + + services.transmission = { + enable = true; #Enable transmission daemon + openRPCPort = true; #Open firewall for RPC + settings = { + #Override default settings + rpc-bind-address = "0.0.0.0"; #Bind to own IP + rpc-whitelist = "127.0.0.1,192.168.1.86"; #Whitelist your remote machine (10.0.0.1 in this example) + download-dir = "/mnt/media/Downloads"; + }; + }; + + services.adguardhome = { + enable = true; + # You can select any ip and port, just make sure to open firewalls where needed + host = "0.0.0.0"; + port = 3003; + settings = { + allowDHCP = true; + dns = { + upstream_dns = [ + # Example config with quad9 + "9.9.9.9#dns.quad9.net" + "149.112.112.112#dns.quad9.net" + # Uncomment the following to use a local DNS service (e.g. Unbound) + # Additionally replace the address & port as needed + # "127.0.0.1:5335" + ]; + }; + filtering = { + protection_enabled = true; + filtering_enabled = true; + + parental_enabled = true; # Parental control-based DNS requests filtering. + safe_search = { + enabled = false; # Enforcing "Safe search" option for search engines, when possible. + }; + }; + # The following notation uses map + # to not have to manually create {enabled = true; url = "";} for every filter + # This is, however, fully optional + filters = + map (url: { + enabled = true; + url = url; + }) [ + "https://adguardteam.github.io/HostlistsRegistry/assets/filter_9.txt" # The Big List of Hacked Malware Web Sites + "https://adguardteam.github.io/HostlistsRegistry/assets/filter_11.txt" # malicious url blocklist + ]; + }; + }; + + #services.jellyfin = { + # enable = true; + #}; + networking.firewall.enable = false; + #networking.networkmanager.ethernet.mtu = 9000; + + # Copy the NixOS configuration file and link it from the resulting system + # (/run/current-system/configuration.nix). This is useful in case you + # accidentally delete configuration.nix. + # system.copySystemConfiguration = true; + + # This option defines the first version of NixOS you have installed on this particular machine, + # and is used to maintain compatibility with application data (e.g. databases) created on older NixOS versions. + # + # Most users should NEVER change this value after the initial install, for any reason, + # even if you've upgraded your system to a new NixOS release. + # + # This value does NOT affect the Nixpkgs version your packages and OS are pulled from, + # so changing it will NOT upgrade your system - see https://nixos.org/manual/nixos/stable/#sec-upgrading for how + # to actually do that. + # + # This value being lower than the current NixOS release does NOT mean your system is + # out of date, out of support, or vulnerable. + # + # Do NOT change this value unless you have manually inspected all the changes it would make to your configuration, + # and migrated your data accordingly. + # + # For more information, see `man configuration.nix` or https://nixos.org/manual/nixos/stable/options#opt-system.stateVersion . + system.stateVersion = "25.11"; # Did you read the comment? +}