First config
This commit is contained in:
Jordan
@@ -0,0 +1,537 @@
|
||||
# Edit this configuration file to define what should be installed on
|
||||
# your system. Help is available in the configuration.nix(5) man page, on
|
||||
# https://search.nixos.org/options and in the NixOS manual (`nixos-help`).
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
pkgs,
|
||||
inputs,
|
||||
...
|
||||
}: {
|
||||
imports = [
|
||||
# Include the results of the hardware scan.
|
||||
./hardware-configuration.nix
|
||||
];
|
||||
|
||||
boot.loader.systemd-boot.enable = true;
|
||||
boot.kernelModules = ["kvm-intel"];
|
||||
boot.loader.systemd-boot.configurationLimit = 30;
|
||||
boot.loader.efi.canTouchEfiVariables = true;
|
||||
|
||||
#
|
||||
# hardware.graphics.enable = true;
|
||||
#
|
||||
# hardware.nvidia = {
|
||||
# modesetting.enable = true;
|
||||
#
|
||||
# open = false; # Recommended for GTX 1060
|
||||
#
|
||||
# nvidiaSettings = true;
|
||||
#
|
||||
# package = config.boot.kernelPackages.nvidiaPackages.stable;
|
||||
# };
|
||||
#
|
||||
# environment.sessionVariables = {
|
||||
# NIXOS_OZONE_WL = "1";
|
||||
# };
|
||||
|
||||
boot.kernel.sysctl = {
|
||||
"net.ipv4.ip_forward" = 1;
|
||||
"net.bridge.bridge-nf-call-iptables" = 1;
|
||||
"net.ipv4.conf.all.forwarding" = 1;
|
||||
"net.ipv6.conf.all.forwarding" = 1;
|
||||
"net.ipv4.conf.all.proxy_arp" = 1;
|
||||
"net.ipv4.conf.ens2.proxy_arp" = 1;
|
||||
};
|
||||
nixpkgs.config.allowUnfree = true;
|
||||
|
||||
fileSystems."/mnt/games" = {
|
||||
device = "/dev/disk/by-uuid/969eb1a0-fb99-46d1-96cf-57a8644ee2d1";
|
||||
fsType = "btrfs";
|
||||
options = [
|
||||
"users"
|
||||
"compress=zstd"
|
||||
"subvol=@games"
|
||||
"nofail"
|
||||
];
|
||||
};
|
||||
|
||||
fileSystems."/mnt/photo" = {
|
||||
device = "/dev/disk/by-uuid/969eb1a0-fb99-46d1-96cf-57a8644ee2d1";
|
||||
fsType = "btrfs";
|
||||
options = [
|
||||
"users"
|
||||
"compress=zstd"
|
||||
"subvol=@Pictures"
|
||||
"nofail"
|
||||
];
|
||||
};
|
||||
|
||||
fileSystems."/mnt/media" = {
|
||||
device = "/dev/disk/by-uuid/969eb1a0-fb99-46d1-96cf-57a8644ee2d1";
|
||||
fsType = "btrfs";
|
||||
options = [
|
||||
"users"
|
||||
"compress=zstd"
|
||||
"subvol=@media"
|
||||
"nofail"
|
||||
];
|
||||
};
|
||||
|
||||
fileSystems."/mnt/winbackup" = {
|
||||
device = "/dev/disk/by-uuid/969eb1a0-fb99-46d1-96cf-57a8644ee2d1";
|
||||
fsType = "btrfs";
|
||||
options = [
|
||||
"users"
|
||||
"compress=zstd"
|
||||
"subvol=@winbackup"
|
||||
"nofail"
|
||||
];
|
||||
};
|
||||
|
||||
fileSystems."/mnt/winhdd" = {
|
||||
device = "/dev/sdb1";
|
||||
fsType = "ntfs";
|
||||
options = [
|
||||
"users"
|
||||
"windows_names"
|
||||
"noatime"
|
||||
"nofail"
|
||||
];
|
||||
};
|
||||
|
||||
virtualisation.libvirtd = {
|
||||
"enable" = true;
|
||||
allowedBridges = ["br0"];
|
||||
};
|
||||
|
||||
virtualisation.docker.enable = true;
|
||||
programs.virt-manager.enable = true;
|
||||
|
||||
programs.zsh.enable = true;
|
||||
|
||||
networking.hostName = "dogma-nixos"; # Define your hostname.
|
||||
|
||||
# Configure network connections interactively with nmcli or nmtui.
|
||||
networking.networkmanager.enable = true;
|
||||
networking.firewall.trustedInterfaces = ["br0"];
|
||||
# Set your time zone.
|
||||
time.timeZone = "America/Phoenix";
|
||||
|
||||
# Configure network proxy if necessary
|
||||
# networking.proxy.default = "http://user:password@proxy:port/";
|
||||
# networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";
|
||||
|
||||
# Select internationalisation properties.
|
||||
i18n.defaultLocale = "en_US.UTF-8";
|
||||
console = {
|
||||
font = "Lat2-Terminus16";
|
||||
useXkbConfig = true; # use xkb.options in tty.
|
||||
};
|
||||
|
||||
# Enable the X11 windowing system.
|
||||
services.xserver.enable = true;
|
||||
services.xserver.xkb.layout = "us";
|
||||
services.xserver.xkb.options = "caps:escape";
|
||||
|
||||
# Enable CUPS to print documents.
|
||||
# services.printing.enable = true;
|
||||
|
||||
# Enable sound.
|
||||
# services.pulseaudio.enable = true;
|
||||
# OR
|
||||
nix.settings.experimental-features = ["nix-command" "flakes"];
|
||||
|
||||
sops.age.keyFile = "/var/lib/sops-nix/keys.txt";
|
||||
#sops.age.generateKey = true;
|
||||
sops.defaultSopsFile = ./secrets/secrets.yaml;
|
||||
|
||||
sops.secrets = {
|
||||
"factorio/service_username" = {};
|
||||
"factorio/service_token" = {};
|
||||
"factorio/gamepassword" = {};
|
||||
"backblaze/apikey" = {};
|
||||
"google/gmail" = {};
|
||||
"caddy/acme_email" = {};
|
||||
"dedyn/dnstoken" = {};
|
||||
"dedyn/dnsuser" = {};
|
||||
"github/token" = {};
|
||||
"gitlab/token" = {};
|
||||
"openai/legacy_token" = {};
|
||||
};
|
||||
|
||||
sops.templates."factorio.json".content = builtins.toJSON {
|
||||
service_username = config.sops.placeholder."factorio/service_username";
|
||||
service_token = config.sops.placeholder."factorio/service_token";
|
||||
gamepassword = config.sops.placeholder."factorio/gamepassword";
|
||||
};
|
||||
|
||||
sops.templates."duplicity.env".content = builtins.toJSON {
|
||||
service_username = config.sops.placeholder."factorio/service_username";
|
||||
service_token = config.sops.placeholder."factorio/service_token";
|
||||
gamepassword = config.sops.placeholder."factorio/gamepassword";
|
||||
};
|
||||
|
||||
sops.templates."caddy.env" = {
|
||||
owner = "root";
|
||||
mode = "0600";
|
||||
restartUnits = ["caddy.service"];
|
||||
content = ''
|
||||
ACME_EMAIL='${config.sops.placeholder."caddy/acme_email"}'
|
||||
'';
|
||||
};
|
||||
|
||||
services.pipewire = {
|
||||
enable = true;
|
||||
pulse.enable = true;
|
||||
};
|
||||
|
||||
# Enable touchpad support (enabled default in most desktopManager).
|
||||
# services.libinput.enable = true;
|
||||
|
||||
# Define a user account. Don't forget to set a password with ‘passwd’.
|
||||
users.defaultUserShell = pkgs.zsh;
|
||||
|
||||
services.getty.autologinUser = "mask";
|
||||
users.users.mask = {
|
||||
isNormalUser = true;
|
||||
shell = pkgs.zsh;
|
||||
|
||||
# Enable ‘sudo’ for the user. packages = with pkgs; [
|
||||
# tree
|
||||
extraGroups = [
|
||||
"wheel"
|
||||
"libvirtd"
|
||||
"media"
|
||||
"uinput"
|
||||
];
|
||||
};
|
||||
services.sunshine = {
|
||||
enable = true;
|
||||
autoStart = true;
|
||||
capSysAdmin = true; # only needed for Wayland -- omit this when using with Xorg
|
||||
openFirewall = true;
|
||||
};
|
||||
|
||||
# programs.firefox.enable = true;
|
||||
|
||||
# List packages installed in system profile.
|
||||
# You can use https://search.nixos.org/ to find more packages (and options).
|
||||
|
||||
programs.hyprland.enable = true; # enable Hyprland
|
||||
programs.nix-ld = {
|
||||
enable = true;
|
||||
|
||||
libraries = with pkgs; [
|
||||
zlib
|
||||
zstd
|
||||
stdenv.cc.cc
|
||||
curl
|
||||
openssl
|
||||
libssh
|
||||
bzip2
|
||||
libxml2
|
||||
acl
|
||||
libsodium
|
||||
util-linux
|
||||
xz
|
||||
systemd
|
||||
];
|
||||
};
|
||||
|
||||
environment.systemPackages = with pkgs; [
|
||||
stylua
|
||||
gh
|
||||
glab
|
||||
gnupg
|
||||
duplicity
|
||||
wget
|
||||
factorio-headless
|
||||
dig
|
||||
parted
|
||||
tor-browser
|
||||
jujutsu
|
||||
caddy
|
||||
clang
|
||||
ansible
|
||||
exiftool
|
||||
gcc
|
||||
home-manager
|
||||
flaresolverr
|
||||
docker-compose
|
||||
virtio-win
|
||||
spice
|
||||
spice-gtk
|
||||
OVMF
|
||||
pigz
|
||||
mpv
|
||||
zed
|
||||
wofi
|
||||
wayvnc
|
||||
pcmanfm
|
||||
htop
|
||||
rsync
|
||||
tmux
|
||||
git
|
||||
kitty
|
||||
python3
|
||||
samba
|
||||
deno
|
||||
qbittorrent-nox
|
||||
sonarr
|
||||
radarr
|
||||
jackett
|
||||
jellyfin
|
||||
curl
|
||||
p7zip
|
||||
dnsmasq
|
||||
brave
|
||||
keepassxc
|
||||
sops
|
||||
age
|
||||
];
|
||||
|
||||
# Some programs need SUID wrappers, can be configured further or are
|
||||
# started in user sessions.
|
||||
# programs.mtr.enable = true;
|
||||
# programs.gnupg.agent = { enable = true;
|
||||
# enableSSHSupport = true;
|
||||
# };
|
||||
|
||||
# List services that you want to enable:
|
||||
|
||||
# Enable the OpenSSH daemon.
|
||||
services.openssh.enable = true;
|
||||
|
||||
services.caddy = {
|
||||
enable = true;
|
||||
globalConfig = ''
|
||||
acme_ca https://acme.zerossl.com/v2/DV90
|
||||
email {$ACME_EMAIL};
|
||||
'';
|
||||
|
||||
#tls ${config.sops.secrets.zerossl_cert.path} ${config.sops.secrets.zerossl_private_key.path}
|
||||
virtualHosts."centraldogma.dedyn.io:".extraConfig = ''
|
||||
redir /jellyfin /jellyfin/
|
||||
reverse_proxy /jellyfin/* 127.0.0.1:8096
|
||||
|
||||
redir /sonarr /sonarr/
|
||||
reverse_proxy /sonarr/* 127.0.0.1:8989
|
||||
|
||||
redir /radarr /radarr/
|
||||
reverse_proxy /radarr/* 127.0.0.1:7878
|
||||
|
||||
'';
|
||||
};
|
||||
services.flaresolverr = {
|
||||
enable = true;
|
||||
};
|
||||
services.samba = {
|
||||
enable = true;
|
||||
openFirewall = true;
|
||||
settings = {
|
||||
global = {
|
||||
"security" = "user";
|
||||
"workgroup" = "WORKGROUP";
|
||||
"server string" = "smbnix";
|
||||
"netbios name" = "smbnix";
|
||||
#"use sendfile" = "yes";
|
||||
#"max protocol" = "smb2";
|
||||
# note: localhost is the ipv6 localhost ::1
|
||||
"hosts allow" = "192.168.1.1/24 127.0.0.1 localhost";
|
||||
"guest account" = "nobody";
|
||||
"map to guest" = "bad user";
|
||||
};
|
||||
|
||||
"games" = {
|
||||
"path" = "/mnt/games";
|
||||
"browseable" = "yes";
|
||||
"read only" = "no";
|
||||
"guest ok" = "no";
|
||||
"create mask" = "0644";
|
||||
"directory mask" = "0755";
|
||||
};
|
||||
|
||||
"media" = {
|
||||
"path" = "/mnt/media";
|
||||
"browseable" = "yes";
|
||||
"read only" = "no";
|
||||
"guest ok" = "no";
|
||||
"create mask" = "0644";
|
||||
"directory mask" = "0755";
|
||||
};
|
||||
|
||||
"photos" = {
|
||||
"path" = "/mnt/photo";
|
||||
"browseable" = "yes";
|
||||
"read only" = "no";
|
||||
"guest ok" = "no";
|
||||
"create mask" = "0644";
|
||||
"directory mask" = "0755";
|
||||
};
|
||||
"x" = {
|
||||
"path" = "/home/mask/mounts/x";
|
||||
"browseable" = "yes";
|
||||
"read only" = "no";
|
||||
"guest ok" = "no";
|
||||
"create mask" = "0644";
|
||||
"directory mask" = "0755";
|
||||
};
|
||||
"winhdd" = {
|
||||
"path" = "/mnt/winhdd";
|
||||
"browseable" = "yes";
|
||||
"read only" = "no";
|
||||
"guest ok" = "no";
|
||||
"create mask" = "0644";
|
||||
"directory mask" = "0755";
|
||||
};
|
||||
|
||||
"winback" = {
|
||||
"path" = "/mnt/winbackup";
|
||||
"browseable" = "yes";
|
||||
"read only" = "no";
|
||||
"guest ok" = "no";
|
||||
"create mask" = "0644";
|
||||
"directory mask" = "0755";
|
||||
};
|
||||
};
|
||||
};
|
||||
services.samba-wsdd = {
|
||||
enable = true;
|
||||
openFirewall = true;
|
||||
};
|
||||
|
||||
networking.interfaces.enp6s0.useDHCP = false;
|
||||
networking.interfaces.br0.useDHCP = true;
|
||||
networking.bridges.br0.interfaces = ["enp6s0"];
|
||||
|
||||
# Open ports in the firewall.
|
||||
# networking.firewall.allowedTCPPorts = [ ... ];
|
||||
# networking.firewall.allowedUDPPorts = [ ... ];
|
||||
# Or disable the firewall altogether.
|
||||
|
||||
# services.dnsmasq.enable = true;
|
||||
# services.resolved.enable = false;
|
||||
# networking.nameservers = ["1.1.1.1" "1.1.1.0"];
|
||||
#
|
||||
# services.dnsmasq.settings = {
|
||||
# interface = "br0";
|
||||
# bind-interface = true;
|
||||
# server = [
|
||||
# "1.1.1.1"
|
||||
# "1.1.1.0"
|
||||
# ];
|
||||
# domain-needed = true;
|
||||
# bogus-priv = true;
|
||||
# };
|
||||
|
||||
#Services section
|
||||
services.jackett = {
|
||||
enable = true;
|
||||
};
|
||||
|
||||
# services.duplicity = {
|
||||
# enable = true;
|
||||
# };
|
||||
|
||||
services.factorio = {
|
||||
enable = true;
|
||||
public = true;
|
||||
requireUserVerification = true;
|
||||
username = "TheMaskedMan95";
|
||||
admins = ["TheMaskedMan95"];
|
||||
game-name = "Realm of the Masked Men";
|
||||
description = "No Dogs allowed";
|
||||
extraSettingsFile = config.sops.templates."factorio.json".path;
|
||||
saveName = "SPACExxxx";
|
||||
openFirewall = true;
|
||||
};
|
||||
|
||||
services.radarr = {
|
||||
enable = true;
|
||||
};
|
||||
services.sonarr = {
|
||||
enable = true;
|
||||
};
|
||||
|
||||
services.transmission = {
|
||||
enable = true; #Enable transmission daemon
|
||||
openRPCPort = true; #Open firewall for RPC
|
||||
settings = {
|
||||
#Override default settings
|
||||
rpc-bind-address = "0.0.0.0"; #Bind to own IP
|
||||
rpc-whitelist = "127.0.0.1,192.168.1.86"; #Whitelist your remote machine (10.0.0.1 in this example)
|
||||
download-dir = "/mnt/media/Downloads";
|
||||
};
|
||||
};
|
||||
|
||||
services.adguardhome = {
|
||||
enable = true;
|
||||
# You can select any ip and port, just make sure to open firewalls where needed
|
||||
host = "0.0.0.0";
|
||||
port = 3003;
|
||||
settings = {
|
||||
allowDHCP = true;
|
||||
dns = {
|
||||
upstream_dns = [
|
||||
# Example config with quad9
|
||||
"9.9.9.9#dns.quad9.net"
|
||||
"149.112.112.112#dns.quad9.net"
|
||||
# Uncomment the following to use a local DNS service (e.g. Unbound)
|
||||
# Additionally replace the address & port as needed
|
||||
# "127.0.0.1:5335"
|
||||
];
|
||||
};
|
||||
filtering = {
|
||||
protection_enabled = true;
|
||||
filtering_enabled = true;
|
||||
|
||||
parental_enabled = true; # Parental control-based DNS requests filtering.
|
||||
safe_search = {
|
||||
enabled = false; # Enforcing "Safe search" option for search engines, when possible.
|
||||
};
|
||||
};
|
||||
# The following notation uses map
|
||||
# to not have to manually create {enabled = true; url = "";} for every filter
|
||||
# This is, however, fully optional
|
||||
filters =
|
||||
map (url: {
|
||||
enabled = true;
|
||||
url = url;
|
||||
}) [
|
||||
"https://adguardteam.github.io/HostlistsRegistry/assets/filter_9.txt" # The Big List of Hacked Malware Web Sites
|
||||
"https://adguardteam.github.io/HostlistsRegistry/assets/filter_11.txt" # malicious url blocklist
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
#services.jellyfin = {
|
||||
# enable = true;
|
||||
#};
|
||||
networking.firewall.enable = false;
|
||||
#networking.networkmanager.ethernet.mtu = 9000;
|
||||
|
||||
# Copy the NixOS configuration file and link it from the resulting system
|
||||
# (/run/current-system/configuration.nix). This is useful in case you
|
||||
# accidentally delete configuration.nix.
|
||||
# system.copySystemConfiguration = true;
|
||||
|
||||
# This option defines the first version of NixOS you have installed on this particular machine,
|
||||
# and is used to maintain compatibility with application data (e.g. databases) created on older NixOS versions.
|
||||
#
|
||||
# Most users should NEVER change this value after the initial install, for any reason,
|
||||
# even if you've upgraded your system to a new NixOS release.
|
||||
#
|
||||
# This value does NOT affect the Nixpkgs version your packages and OS are pulled from,
|
||||
# so changing it will NOT upgrade your system - see https://nixos.org/manual/nixos/stable/#sec-upgrading for how
|
||||
# to actually do that.
|
||||
#
|
||||
# This value being lower than the current NixOS release does NOT mean your system is
|
||||
# out of date, out of support, or vulnerable.
|
||||
#
|
||||
# Do NOT change this value unless you have manually inspected all the changes it would make to your configuration,
|
||||
# and migrated your data accordingly.
|
||||
#
|
||||
# For more information, see `man configuration.nix` or https://nixos.org/manual/nixos/stable/options#opt-system.stateVersion .
|
||||
system.stateVersion = "25.11"; # Did you read the comment?
|
||||
}
|
||||
Reference in New Issue
Block a user