First config
This commit is contained in:
Jordan
@@ -0,0 +1,537 @@
|
|||||||
|
# Edit this configuration file to define what should be installed on
|
||||||
|
# your system. Help is available in the configuration.nix(5) man page, on
|
||||||
|
# https://search.nixos.org/options and in the NixOS manual (`nixos-help`).
|
||||||
|
{
|
||||||
|
config,
|
||||||
|
lib,
|
||||||
|
pkgs,
|
||||||
|
inputs,
|
||||||
|
...
|
||||||
|
}: {
|
||||||
|
imports = [
|
||||||
|
# Include the results of the hardware scan.
|
||||||
|
./hardware-configuration.nix
|
||||||
|
];
|
||||||
|
|
||||||
|
boot.loader.systemd-boot.enable = true;
|
||||||
|
boot.kernelModules = ["kvm-intel"];
|
||||||
|
boot.loader.systemd-boot.configurationLimit = 30;
|
||||||
|
boot.loader.efi.canTouchEfiVariables = true;
|
||||||
|
|
||||||
|
#
|
||||||
|
# hardware.graphics.enable = true;
|
||||||
|
#
|
||||||
|
# hardware.nvidia = {
|
||||||
|
# modesetting.enable = true;
|
||||||
|
#
|
||||||
|
# open = false; # Recommended for GTX 1060
|
||||||
|
#
|
||||||
|
# nvidiaSettings = true;
|
||||||
|
#
|
||||||
|
# package = config.boot.kernelPackages.nvidiaPackages.stable;
|
||||||
|
# };
|
||||||
|
#
|
||||||
|
# environment.sessionVariables = {
|
||||||
|
# NIXOS_OZONE_WL = "1";
|
||||||
|
# };
|
||||||
|
|
||||||
|
boot.kernel.sysctl = {
|
||||||
|
"net.ipv4.ip_forward" = 1;
|
||||||
|
"net.bridge.bridge-nf-call-iptables" = 1;
|
||||||
|
"net.ipv4.conf.all.forwarding" = 1;
|
||||||
|
"net.ipv6.conf.all.forwarding" = 1;
|
||||||
|
"net.ipv4.conf.all.proxy_arp" = 1;
|
||||||
|
"net.ipv4.conf.ens2.proxy_arp" = 1;
|
||||||
|
};
|
||||||
|
nixpkgs.config.allowUnfree = true;
|
||||||
|
|
||||||
|
fileSystems."/mnt/games" = {
|
||||||
|
device = "/dev/disk/by-uuid/969eb1a0-fb99-46d1-96cf-57a8644ee2d1";
|
||||||
|
fsType = "btrfs";
|
||||||
|
options = [
|
||||||
|
"users"
|
||||||
|
"compress=zstd"
|
||||||
|
"subvol=@games"
|
||||||
|
"nofail"
|
||||||
|
];
|
||||||
|
};
|
||||||
|
|
||||||
|
fileSystems."/mnt/photo" = {
|
||||||
|
device = "/dev/disk/by-uuid/969eb1a0-fb99-46d1-96cf-57a8644ee2d1";
|
||||||
|
fsType = "btrfs";
|
||||||
|
options = [
|
||||||
|
"users"
|
||||||
|
"compress=zstd"
|
||||||
|
"subvol=@Pictures"
|
||||||
|
"nofail"
|
||||||
|
];
|
||||||
|
};
|
||||||
|
|
||||||
|
fileSystems."/mnt/media" = {
|
||||||
|
device = "/dev/disk/by-uuid/969eb1a0-fb99-46d1-96cf-57a8644ee2d1";
|
||||||
|
fsType = "btrfs";
|
||||||
|
options = [
|
||||||
|
"users"
|
||||||
|
"compress=zstd"
|
||||||
|
"subvol=@media"
|
||||||
|
"nofail"
|
||||||
|
];
|
||||||
|
};
|
||||||
|
|
||||||
|
fileSystems."/mnt/winbackup" = {
|
||||||
|
device = "/dev/disk/by-uuid/969eb1a0-fb99-46d1-96cf-57a8644ee2d1";
|
||||||
|
fsType = "btrfs";
|
||||||
|
options = [
|
||||||
|
"users"
|
||||||
|
"compress=zstd"
|
||||||
|
"subvol=@winbackup"
|
||||||
|
"nofail"
|
||||||
|
];
|
||||||
|
};
|
||||||
|
|
||||||
|
fileSystems."/mnt/winhdd" = {
|
||||||
|
device = "/dev/sdb1";
|
||||||
|
fsType = "ntfs";
|
||||||
|
options = [
|
||||||
|
"users"
|
||||||
|
"windows_names"
|
||||||
|
"noatime"
|
||||||
|
"nofail"
|
||||||
|
];
|
||||||
|
};
|
||||||
|
|
||||||
|
virtualisation.libvirtd = {
|
||||||
|
"enable" = true;
|
||||||
|
allowedBridges = ["br0"];
|
||||||
|
};
|
||||||
|
|
||||||
|
virtualisation.docker.enable = true;
|
||||||
|
programs.virt-manager.enable = true;
|
||||||
|
|
||||||
|
programs.zsh.enable = true;
|
||||||
|
|
||||||
|
networking.hostName = "dogma-nixos"; # Define your hostname.
|
||||||
|
|
||||||
|
# Configure network connections interactively with nmcli or nmtui.
|
||||||
|
networking.networkmanager.enable = true;
|
||||||
|
networking.firewall.trustedInterfaces = ["br0"];
|
||||||
|
# Set your time zone.
|
||||||
|
time.timeZone = "America/Phoenix";
|
||||||
|
|
||||||
|
# Configure network proxy if necessary
|
||||||
|
# networking.proxy.default = "http://user:password@proxy:port/";
|
||||||
|
# networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";
|
||||||
|
|
||||||
|
# Select internationalisation properties.
|
||||||
|
i18n.defaultLocale = "en_US.UTF-8";
|
||||||
|
console = {
|
||||||
|
font = "Lat2-Terminus16";
|
||||||
|
useXkbConfig = true; # use xkb.options in tty.
|
||||||
|
};
|
||||||
|
|
||||||
|
# Enable the X11 windowing system.
|
||||||
|
services.xserver.enable = true;
|
||||||
|
services.xserver.xkb.layout = "us";
|
||||||
|
services.xserver.xkb.options = "caps:escape";
|
||||||
|
|
||||||
|
# Enable CUPS to print documents.
|
||||||
|
# services.printing.enable = true;
|
||||||
|
|
||||||
|
# Enable sound.
|
||||||
|
# services.pulseaudio.enable = true;
|
||||||
|
# OR
|
||||||
|
nix.settings.experimental-features = ["nix-command" "flakes"];
|
||||||
|
|
||||||
|
sops.age.keyFile = "/var/lib/sops-nix/keys.txt";
|
||||||
|
#sops.age.generateKey = true;
|
||||||
|
sops.defaultSopsFile = ./secrets/secrets.yaml;
|
||||||
|
|
||||||
|
sops.secrets = {
|
||||||
|
"factorio/service_username" = {};
|
||||||
|
"factorio/service_token" = {};
|
||||||
|
"factorio/gamepassword" = {};
|
||||||
|
"backblaze/apikey" = {};
|
||||||
|
"google/gmail" = {};
|
||||||
|
"caddy/acme_email" = {};
|
||||||
|
"dedyn/dnstoken" = {};
|
||||||
|
"dedyn/dnsuser" = {};
|
||||||
|
"github/token" = {};
|
||||||
|
"gitlab/token" = {};
|
||||||
|
"openai/legacy_token" = {};
|
||||||
|
};
|
||||||
|
|
||||||
|
sops.templates."factorio.json".content = builtins.toJSON {
|
||||||
|
service_username = config.sops.placeholder."factorio/service_username";
|
||||||
|
service_token = config.sops.placeholder."factorio/service_token";
|
||||||
|
gamepassword = config.sops.placeholder."factorio/gamepassword";
|
||||||
|
};
|
||||||
|
|
||||||
|
sops.templates."duplicity.env".content = builtins.toJSON {
|
||||||
|
service_username = config.sops.placeholder."factorio/service_username";
|
||||||
|
service_token = config.sops.placeholder."factorio/service_token";
|
||||||
|
gamepassword = config.sops.placeholder."factorio/gamepassword";
|
||||||
|
};
|
||||||
|
|
||||||
|
sops.templates."caddy.env" = {
|
||||||
|
owner = "root";
|
||||||
|
mode = "0600";
|
||||||
|
restartUnits = ["caddy.service"];
|
||||||
|
content = ''
|
||||||
|
ACME_EMAIL='${config.sops.placeholder."caddy/acme_email"}'
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
|
||||||
|
services.pipewire = {
|
||||||
|
enable = true;
|
||||||
|
pulse.enable = true;
|
||||||
|
};
|
||||||
|
|
||||||
|
# Enable touchpad support (enabled default in most desktopManager).
|
||||||
|
# services.libinput.enable = true;
|
||||||
|
|
||||||
|
# Define a user account. Don't forget to set a password with ‘passwd’.
|
||||||
|
users.defaultUserShell = pkgs.zsh;
|
||||||
|
|
||||||
|
services.getty.autologinUser = "mask";
|
||||||
|
users.users.mask = {
|
||||||
|
isNormalUser = true;
|
||||||
|
shell = pkgs.zsh;
|
||||||
|
|
||||||
|
# Enable ‘sudo’ for the user. packages = with pkgs; [
|
||||||
|
# tree
|
||||||
|
extraGroups = [
|
||||||
|
"wheel"
|
||||||
|
"libvirtd"
|
||||||
|
"media"
|
||||||
|
"uinput"
|
||||||
|
];
|
||||||
|
};
|
||||||
|
services.sunshine = {
|
||||||
|
enable = true;
|
||||||
|
autoStart = true;
|
||||||
|
capSysAdmin = true; # only needed for Wayland -- omit this when using with Xorg
|
||||||
|
openFirewall = true;
|
||||||
|
};
|
||||||
|
|
||||||
|
# programs.firefox.enable = true;
|
||||||
|
|
||||||
|
# List packages installed in system profile.
|
||||||
|
# You can use https://search.nixos.org/ to find more packages (and options).
|
||||||
|
|
||||||
|
programs.hyprland.enable = true; # enable Hyprland
|
||||||
|
programs.nix-ld = {
|
||||||
|
enable = true;
|
||||||
|
|
||||||
|
libraries = with pkgs; [
|
||||||
|
zlib
|
||||||
|
zstd
|
||||||
|
stdenv.cc.cc
|
||||||
|
curl
|
||||||
|
openssl
|
||||||
|
libssh
|
||||||
|
bzip2
|
||||||
|
libxml2
|
||||||
|
acl
|
||||||
|
libsodium
|
||||||
|
util-linux
|
||||||
|
xz
|
||||||
|
systemd
|
||||||
|
];
|
||||||
|
};
|
||||||
|
|
||||||
|
environment.systemPackages = with pkgs; [
|
||||||
|
stylua
|
||||||
|
gh
|
||||||
|
glab
|
||||||
|
gnupg
|
||||||
|
duplicity
|
||||||
|
wget
|
||||||
|
factorio-headless
|
||||||
|
dig
|
||||||
|
parted
|
||||||
|
tor-browser
|
||||||
|
jujutsu
|
||||||
|
caddy
|
||||||
|
clang
|
||||||
|
ansible
|
||||||
|
exiftool
|
||||||
|
gcc
|
||||||
|
home-manager
|
||||||
|
flaresolverr
|
||||||
|
docker-compose
|
||||||
|
virtio-win
|
||||||
|
spice
|
||||||
|
spice-gtk
|
||||||
|
OVMF
|
||||||
|
pigz
|
||||||
|
mpv
|
||||||
|
zed
|
||||||
|
wofi
|
||||||
|
wayvnc
|
||||||
|
pcmanfm
|
||||||
|
htop
|
||||||
|
rsync
|
||||||
|
tmux
|
||||||
|
git
|
||||||
|
kitty
|
||||||
|
python3
|
||||||
|
samba
|
||||||
|
deno
|
||||||
|
qbittorrent-nox
|
||||||
|
sonarr
|
||||||
|
radarr
|
||||||
|
jackett
|
||||||
|
jellyfin
|
||||||
|
curl
|
||||||
|
p7zip
|
||||||
|
dnsmasq
|
||||||
|
brave
|
||||||
|
keepassxc
|
||||||
|
sops
|
||||||
|
age
|
||||||
|
];
|
||||||
|
|
||||||
|
# Some programs need SUID wrappers, can be configured further or are
|
||||||
|
# started in user sessions.
|
||||||
|
# programs.mtr.enable = true;
|
||||||
|
# programs.gnupg.agent = { enable = true;
|
||||||
|
# enableSSHSupport = true;
|
||||||
|
# };
|
||||||
|
|
||||||
|
# List services that you want to enable:
|
||||||
|
|
||||||
|
# Enable the OpenSSH daemon.
|
||||||
|
services.openssh.enable = true;
|
||||||
|
|
||||||
|
services.caddy = {
|
||||||
|
enable = true;
|
||||||
|
globalConfig = ''
|
||||||
|
acme_ca https://acme.zerossl.com/v2/DV90
|
||||||
|
email {$ACME_EMAIL};
|
||||||
|
'';
|
||||||
|
|
||||||
|
#tls ${config.sops.secrets.zerossl_cert.path} ${config.sops.secrets.zerossl_private_key.path}
|
||||||
|
virtualHosts."centraldogma.dedyn.io:".extraConfig = ''
|
||||||
|
redir /jellyfin /jellyfin/
|
||||||
|
reverse_proxy /jellyfin/* 127.0.0.1:8096
|
||||||
|
|
||||||
|
redir /sonarr /sonarr/
|
||||||
|
reverse_proxy /sonarr/* 127.0.0.1:8989
|
||||||
|
|
||||||
|
redir /radarr /radarr/
|
||||||
|
reverse_proxy /radarr/* 127.0.0.1:7878
|
||||||
|
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
services.flaresolverr = {
|
||||||
|
enable = true;
|
||||||
|
};
|
||||||
|
services.samba = {
|
||||||
|
enable = true;
|
||||||
|
openFirewall = true;
|
||||||
|
settings = {
|
||||||
|
global = {
|
||||||
|
"security" = "user";
|
||||||
|
"workgroup" = "WORKGROUP";
|
||||||
|
"server string" = "smbnix";
|
||||||
|
"netbios name" = "smbnix";
|
||||||
|
#"use sendfile" = "yes";
|
||||||
|
#"max protocol" = "smb2";
|
||||||
|
# note: localhost is the ipv6 localhost ::1
|
||||||
|
"hosts allow" = "192.168.1.1/24 127.0.0.1 localhost";
|
||||||
|
"guest account" = "nobody";
|
||||||
|
"map to guest" = "bad user";
|
||||||
|
};
|
||||||
|
|
||||||
|
"games" = {
|
||||||
|
"path" = "/mnt/games";
|
||||||
|
"browseable" = "yes";
|
||||||
|
"read only" = "no";
|
||||||
|
"guest ok" = "no";
|
||||||
|
"create mask" = "0644";
|
||||||
|
"directory mask" = "0755";
|
||||||
|
};
|
||||||
|
|
||||||
|
"media" = {
|
||||||
|
"path" = "/mnt/media";
|
||||||
|
"browseable" = "yes";
|
||||||
|
"read only" = "no";
|
||||||
|
"guest ok" = "no";
|
||||||
|
"create mask" = "0644";
|
||||||
|
"directory mask" = "0755";
|
||||||
|
};
|
||||||
|
|
||||||
|
"photos" = {
|
||||||
|
"path" = "/mnt/photo";
|
||||||
|
"browseable" = "yes";
|
||||||
|
"read only" = "no";
|
||||||
|
"guest ok" = "no";
|
||||||
|
"create mask" = "0644";
|
||||||
|
"directory mask" = "0755";
|
||||||
|
};
|
||||||
|
"x" = {
|
||||||
|
"path" = "/home/mask/mounts/x";
|
||||||
|
"browseable" = "yes";
|
||||||
|
"read only" = "no";
|
||||||
|
"guest ok" = "no";
|
||||||
|
"create mask" = "0644";
|
||||||
|
"directory mask" = "0755";
|
||||||
|
};
|
||||||
|
"winhdd" = {
|
||||||
|
"path" = "/mnt/winhdd";
|
||||||
|
"browseable" = "yes";
|
||||||
|
"read only" = "no";
|
||||||
|
"guest ok" = "no";
|
||||||
|
"create mask" = "0644";
|
||||||
|
"directory mask" = "0755";
|
||||||
|
};
|
||||||
|
|
||||||
|
"winback" = {
|
||||||
|
"path" = "/mnt/winbackup";
|
||||||
|
"browseable" = "yes";
|
||||||
|
"read only" = "no";
|
||||||
|
"guest ok" = "no";
|
||||||
|
"create mask" = "0644";
|
||||||
|
"directory mask" = "0755";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
services.samba-wsdd = {
|
||||||
|
enable = true;
|
||||||
|
openFirewall = true;
|
||||||
|
};
|
||||||
|
|
||||||
|
networking.interfaces.enp6s0.useDHCP = false;
|
||||||
|
networking.interfaces.br0.useDHCP = true;
|
||||||
|
networking.bridges.br0.interfaces = ["enp6s0"];
|
||||||
|
|
||||||
|
# Open ports in the firewall.
|
||||||
|
# networking.firewall.allowedTCPPorts = [ ... ];
|
||||||
|
# networking.firewall.allowedUDPPorts = [ ... ];
|
||||||
|
# Or disable the firewall altogether.
|
||||||
|
|
||||||
|
# services.dnsmasq.enable = true;
|
||||||
|
# services.resolved.enable = false;
|
||||||
|
# networking.nameservers = ["1.1.1.1" "1.1.1.0"];
|
||||||
|
#
|
||||||
|
# services.dnsmasq.settings = {
|
||||||
|
# interface = "br0";
|
||||||
|
# bind-interface = true;
|
||||||
|
# server = [
|
||||||
|
# "1.1.1.1"
|
||||||
|
# "1.1.1.0"
|
||||||
|
# ];
|
||||||
|
# domain-needed = true;
|
||||||
|
# bogus-priv = true;
|
||||||
|
# };
|
||||||
|
|
||||||
|
#Services section
|
||||||
|
services.jackett = {
|
||||||
|
enable = true;
|
||||||
|
};
|
||||||
|
|
||||||
|
# services.duplicity = {
|
||||||
|
# enable = true;
|
||||||
|
# };
|
||||||
|
|
||||||
|
services.factorio = {
|
||||||
|
enable = true;
|
||||||
|
public = true;
|
||||||
|
requireUserVerification = true;
|
||||||
|
username = "TheMaskedMan95";
|
||||||
|
admins = ["TheMaskedMan95"];
|
||||||
|
game-name = "Realm of the Masked Men";
|
||||||
|
description = "No Dogs allowed";
|
||||||
|
extraSettingsFile = config.sops.templates."factorio.json".path;
|
||||||
|
saveName = "SPACExxxx";
|
||||||
|
openFirewall = true;
|
||||||
|
};
|
||||||
|
|
||||||
|
services.radarr = {
|
||||||
|
enable = true;
|
||||||
|
};
|
||||||
|
services.sonarr = {
|
||||||
|
enable = true;
|
||||||
|
};
|
||||||
|
|
||||||
|
services.transmission = {
|
||||||
|
enable = true; #Enable transmission daemon
|
||||||
|
openRPCPort = true; #Open firewall for RPC
|
||||||
|
settings = {
|
||||||
|
#Override default settings
|
||||||
|
rpc-bind-address = "0.0.0.0"; #Bind to own IP
|
||||||
|
rpc-whitelist = "127.0.0.1,192.168.1.86"; #Whitelist your remote machine (10.0.0.1 in this example)
|
||||||
|
download-dir = "/mnt/media/Downloads";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
services.adguardhome = {
|
||||||
|
enable = true;
|
||||||
|
# You can select any ip and port, just make sure to open firewalls where needed
|
||||||
|
host = "0.0.0.0";
|
||||||
|
port = 3003;
|
||||||
|
settings = {
|
||||||
|
allowDHCP = true;
|
||||||
|
dns = {
|
||||||
|
upstream_dns = [
|
||||||
|
# Example config with quad9
|
||||||
|
"9.9.9.9#dns.quad9.net"
|
||||||
|
"149.112.112.112#dns.quad9.net"
|
||||||
|
# Uncomment the following to use a local DNS service (e.g. Unbound)
|
||||||
|
# Additionally replace the address & port as needed
|
||||||
|
# "127.0.0.1:5335"
|
||||||
|
];
|
||||||
|
};
|
||||||
|
filtering = {
|
||||||
|
protection_enabled = true;
|
||||||
|
filtering_enabled = true;
|
||||||
|
|
||||||
|
parental_enabled = true; # Parental control-based DNS requests filtering.
|
||||||
|
safe_search = {
|
||||||
|
enabled = false; # Enforcing "Safe search" option for search engines, when possible.
|
||||||
|
};
|
||||||
|
};
|
||||||
|
# The following notation uses map
|
||||||
|
# to not have to manually create {enabled = true; url = "";} for every filter
|
||||||
|
# This is, however, fully optional
|
||||||
|
filters =
|
||||||
|
map (url: {
|
||||||
|
enabled = true;
|
||||||
|
url = url;
|
||||||
|
}) [
|
||||||
|
"https://adguardteam.github.io/HostlistsRegistry/assets/filter_9.txt" # The Big List of Hacked Malware Web Sites
|
||||||
|
"https://adguardteam.github.io/HostlistsRegistry/assets/filter_11.txt" # malicious url blocklist
|
||||||
|
];
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
#services.jellyfin = {
|
||||||
|
# enable = true;
|
||||||
|
#};
|
||||||
|
networking.firewall.enable = false;
|
||||||
|
#networking.networkmanager.ethernet.mtu = 9000;
|
||||||
|
|
||||||
|
# Copy the NixOS configuration file and link it from the resulting system
|
||||||
|
# (/run/current-system/configuration.nix). This is useful in case you
|
||||||
|
# accidentally delete configuration.nix.
|
||||||
|
# system.copySystemConfiguration = true;
|
||||||
|
|
||||||
|
# This option defines the first version of NixOS you have installed on this particular machine,
|
||||||
|
# and is used to maintain compatibility with application data (e.g. databases) created on older NixOS versions.
|
||||||
|
#
|
||||||
|
# Most users should NEVER change this value after the initial install, for any reason,
|
||||||
|
# even if you've upgraded your system to a new NixOS release.
|
||||||
|
#
|
||||||
|
# This value does NOT affect the Nixpkgs version your packages and OS are pulled from,
|
||||||
|
# so changing it will NOT upgrade your system - see https://nixos.org/manual/nixos/stable/#sec-upgrading for how
|
||||||
|
# to actually do that.
|
||||||
|
#
|
||||||
|
# This value being lower than the current NixOS release does NOT mean your system is
|
||||||
|
# out of date, out of support, or vulnerable.
|
||||||
|
#
|
||||||
|
# Do NOT change this value unless you have manually inspected all the changes it would make to your configuration,
|
||||||
|
# and migrated your data accordingly.
|
||||||
|
#
|
||||||
|
# For more information, see `man configuration.nix` or https://nixos.org/manual/nixos/stable/options#opt-system.stateVersion .
|
||||||
|
system.stateVersion = "25.11"; # Did you read the comment?
|
||||||
|
}
|
||||||
Reference in New Issue
Block a user