remove old hosts voyager and felixalbpc
This commit is contained in:
@@ -1,47 +0,0 @@
|
||||
{ config, pkgs, lib, ... }:
|
||||
{
|
||||
services.borgbackup.jobs =
|
||||
let
|
||||
borgJob = name: {
|
||||
environment.BORG_RSH = "ssh -i /root/.ssh/fealsyn1";
|
||||
environment.BORG_REMOTE_PATH = "/usr/local/bin/borg";
|
||||
repo = "ssh://backup@feal-syn1.home.feal.no/volume2/backup/borg/voyager/${name}";
|
||||
compression = "auto,zstd";
|
||||
};
|
||||
in {
|
||||
postgresDaily = borgJob "postgres::daily" // {
|
||||
paths = "/var/backup/postgres";
|
||||
startAt = "*-*-* 05:15:00"; # 2 hours after postgresqlBackup
|
||||
extraInitArgs = "--storage-quota 10G";
|
||||
encryption = {
|
||||
mode = "repokey-blake2";
|
||||
passCommand = "cat ${config.sops.secrets."borg/postgres".path}";
|
||||
};
|
||||
};
|
||||
|
||||
postgresWeekly = borgJob "postgres::weekly" // {
|
||||
paths = "/var/backup/postgres";
|
||||
startAt = "Mon *-*-* 05:15:00"; # 2 hours after postgresqlBackup
|
||||
extraInitArgs = "--storage-quota 10G";
|
||||
encryption = {
|
||||
mode = "repokey-blake2";
|
||||
passCommand = "cat ${config.sops.secrets."borg/postgres".path}";
|
||||
};
|
||||
};
|
||||
|
||||
transmission = borgJob "transmission::weekly" // {
|
||||
paths = "/var/lib/transmission";
|
||||
startAt = "weekly";
|
||||
encryption = {
|
||||
mode = "repokey-blake2";
|
||||
passCommand = "cat ${config.sops.secrets."borg/transmission".path}";
|
||||
};
|
||||
};
|
||||
|
||||
# TODO: timemachine, nextcloud, komga, calibre
|
||||
|
||||
};
|
||||
|
||||
sops.secrets."borg/postgres" = { };
|
||||
sops.secrets."borg/transmission" = { };
|
||||
}
|
||||
@@ -1,51 +0,0 @@
|
||||
{ config, pkgs, ... }:
|
||||
|
||||
{
|
||||
imports =
|
||||
[
|
||||
../../base.nix
|
||||
../../common/metrics-exporters.nix
|
||||
./hardware-configuration.nix
|
||||
./backup.nix
|
||||
./exports.nix
|
||||
./filesystems.nix
|
||||
|
||||
./services/fancontrol.nix
|
||||
./services/podgrab.nix
|
||||
./services/snappymail.nix
|
||||
./services/timemachine.nix
|
||||
];
|
||||
|
||||
networking = {
|
||||
hostName = "voyager";
|
||||
bridges.br0.interfaces = [ "eno1" ];
|
||||
interfaces.br0.useDHCP = false;
|
||||
interfaces.br0.ipv4.addresses = [
|
||||
{ address = "192.168.10.165"; prefixLength = 24; }
|
||||
];
|
||||
|
||||
hostId = "8e84b235";
|
||||
defaultGateway = "192.168.10.1";
|
||||
};
|
||||
|
||||
sops.defaultSopsFile = ../../secrets/voyager/voyager.yaml;
|
||||
|
||||
environment.variables = { EDITOR = "vim"; };
|
||||
environment.systemPackages = with pkgs; [
|
||||
zfs
|
||||
];
|
||||
|
||||
virtualisation.docker.enable = true;
|
||||
virtualisation.oci-containers.backend = "docker";
|
||||
|
||||
users.users."amalieem" = {
|
||||
isNormalUser = true;
|
||||
home = "/home/amalieem";
|
||||
openssh.authorizedKeys.keys = [
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID7e+BAoXIFmTeeBYAVImQAcyx6SCoYCErA7h16OGL70 amalieem@wentworth"
|
||||
];
|
||||
};
|
||||
|
||||
system.stateVersion = "22.11";
|
||||
}
|
||||
|
||||
@@ -1,27 +0,0 @@
|
||||
{ config, pkgs, lib, ... }:
|
||||
{
|
||||
fileSystems = {
|
||||
"/export/riker-backup" = {
|
||||
device = "/tank/backup/riker";
|
||||
options = [ "bind" ];
|
||||
};
|
||||
"/export/defiant-backup" = {
|
||||
device = "/tank/backup/defiant";
|
||||
options = [ "bind" ];
|
||||
};
|
||||
};
|
||||
|
||||
# Enable nfs4 only
|
||||
services.nfs.server = {
|
||||
enable = true;
|
||||
exports = ''
|
||||
/export 192.168.10.4(rw,fsid=0,no_subtree_check) 192.168.10.5(rw,fsid=0,no_subtree_check) 192.168.10.2(rw,fsid=0,no_subtree_check) 192.168.10.175(rw,fsid=0,no_subtree_check)
|
||||
/export/riker-backup 192.168.10.2(rw,nohide,no_subtree_check,no_root_squash)
|
||||
/export/doyle-backup 192.168.10.2(rw,nohide,no_subtree_check,no_root_squash)
|
||||
/export/defiant-backup 192.168.10.175(rw,nohide,no_subtree_check,async,no_root_squash)
|
||||
'';
|
||||
};
|
||||
|
||||
networking.firewall.allowedTCPPorts = [ 111 2049 20048 ];
|
||||
networking.firewall.allowedUDPPorts = [ 111 20048];
|
||||
}
|
||||
@@ -1,42 +0,0 @@
|
||||
{ config, pkgs, lib, ... }:
|
||||
{
|
||||
# Boot drives are defined in ./hardware-configuration.nix
|
||||
|
||||
environment.systemPackages = with pkgs; [ cifs-utils ];
|
||||
|
||||
# Local zfs
|
||||
boot = {
|
||||
zfs.extraPools = [ "tank" ];
|
||||
supportedFilesystems = [ "zfs" ];
|
||||
kernelPackages = config.boot.zfs.package.latestCompatibleLinuxPackages;
|
||||
};
|
||||
services.zfs.autoScrub = {
|
||||
enable = true;
|
||||
interval = "Wed *-*-8..14 00:00:00";
|
||||
};
|
||||
|
||||
# Network mounts (import)
|
||||
fileSystems = {
|
||||
"/mnt/feal-syn1/media" = {
|
||||
device = "feal-syn1.home.feal.no:/volume2/media";
|
||||
fsType = "nfs";
|
||||
options = [ "vers=3" ];
|
||||
#options = [ "x-systemd.automount" "noauto" ];
|
||||
};
|
||||
"/mnt/feal-syn1/nfs_proxmox" = {
|
||||
device = "//feal-syn1.home.feal.no/nfs_proxmox";
|
||||
fsType = "cifs";
|
||||
options = let
|
||||
# this line prevents hanging on network split
|
||||
automount_opts = "x-systemd.automount,noauto,x-systemd.idle-timeout=60,x-systemd.device-timeout=5s,x-systemd.mount-timeout=5s";
|
||||
|
||||
in ["${automount_opts},credentials=/etc/feal-syn1-credentials"];
|
||||
};
|
||||
|
||||
"/var/backup" = {
|
||||
device = "/tank/backup/voyager";
|
||||
options = [ "bind "];
|
||||
};
|
||||
};
|
||||
|
||||
}
|
||||
@@ -1,38 +0,0 @@
|
||||
# Do not modify this file! It was generated by ‘nixos-generate-config’
|
||||
# and may be overwritten by future invocations. Please make changes
|
||||
# to /etc/nixos/configuration.nix instead.
|
||||
{ config, lib, pkgs, modulesPath, ... }:
|
||||
|
||||
{
|
||||
imports =
|
||||
[ (modulesPath + "/installer/scan/not-detected.nix")
|
||||
];
|
||||
|
||||
boot.initrd.availableKernelModules = [ "ehci_pci" "ahci" "mpt3sas" "usbhid" "usb_storage" "sd_mod" "sr_mod" ];
|
||||
boot.initrd.kernelModules = [ ];
|
||||
boot.kernelModules = [ "kvm-intel" ];
|
||||
boot.extraModulePackages = [ ];
|
||||
|
||||
fileSystems."/" =
|
||||
{ device = "/dev/disk/by-uuid/a6465c1c-4c93-423d-84a9-e4ecb9520741";
|
||||
fsType = "ext4";
|
||||
};
|
||||
|
||||
fileSystems."/boot" =
|
||||
{ device = "/dev/disk/by-uuid/D0C1-97CE";
|
||||
fsType = "vfat";
|
||||
};
|
||||
|
||||
swapDevices = [ ];
|
||||
|
||||
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
|
||||
# (the default) this is the recommended approach. When using systemd-networkd it's
|
||||
# still possible to use this option, but it's recommended to use it in conjunction
|
||||
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
|
||||
# networking.interfaces.eno1.useDHCP = lib.mkDefault true;
|
||||
# networking.interfaces.eno2.useDHCP = lib.mkDefault true;
|
||||
# networking.interfaces.idrac.useDHCP = lib.mkDefault true;
|
||||
|
||||
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
|
||||
hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
|
||||
}
|
||||
@@ -1,12 +0,0 @@
|
||||
{ pkgs, lib, ... }:
|
||||
{
|
||||
imports = [
|
||||
./../../home/base.nix
|
||||
];
|
||||
|
||||
programs = {
|
||||
zsh.shellAliases."rebuild" = "sudo nixos-rebuild switch --flake /config";
|
||||
};
|
||||
|
||||
home.stateVersion = "23.05";
|
||||
}
|
||||
@@ -1,102 +0,0 @@
|
||||
{ config, pkgs, lib, ... }:
|
||||
|
||||
let
|
||||
inherit (lib) mkDefault mkEnableOption mkForce mkIf mkOption mkPackageOption generators types;
|
||||
|
||||
cfg = config.services.snappymail;
|
||||
maxUploadSize = "256M";
|
||||
in {
|
||||
options.services.snappymail = {
|
||||
enable = mkEnableOption "Snappymail";
|
||||
|
||||
package = mkPackageOption pkgs "snappymail" { };
|
||||
|
||||
dataDir = mkOption {
|
||||
type = types.str;
|
||||
default = "/var/lib/snappymail";
|
||||
description = "State directory for snappymail";
|
||||
};
|
||||
|
||||
hostname = mkOption {
|
||||
type = types.nullOr types.str;
|
||||
default = null;
|
||||
example = "mail.example.com";
|
||||
description = "Enable nginx with this hostname, null disables nginx";
|
||||
};
|
||||
|
||||
user = mkOption {
|
||||
type = types.str;
|
||||
default = "snappymail";
|
||||
description = "System user under which snappymail runs";
|
||||
};
|
||||
|
||||
group = mkOption {
|
||||
type = types.str;
|
||||
default = "snappymail";
|
||||
description = "System group under which snappymail runs";
|
||||
};
|
||||
};
|
||||
|
||||
config = mkIf cfg.enable {
|
||||
users.users = mkIf (cfg.user == "snappymail") {
|
||||
snappymail = {
|
||||
description = "Snappymail service";
|
||||
group = cfg.group;
|
||||
home = cfg.dataDir;
|
||||
isSystemUser = true;
|
||||
};
|
||||
};
|
||||
|
||||
users.groups = mkIf (cfg.group == "snappymail") {
|
||||
snappymail = {};
|
||||
};
|
||||
|
||||
services.phpfpm.pools.snappymail = {
|
||||
user = cfg.user;
|
||||
group = cfg.group;
|
||||
phpOptions = generators.toKeyValue {} {
|
||||
upload_max_filesize = maxUploadSize;
|
||||
post_max_size = maxUploadSize;
|
||||
memory_limit = maxUploadSize;
|
||||
};
|
||||
|
||||
settings = {
|
||||
"listen.owner" = config.services.nginx.user;
|
||||
"listen.group" = config.services.nginx.group;
|
||||
"pm" = "ondemand";
|
||||
"pm.max_children" = 32;
|
||||
"pm.process_idle_timeout" = "10s";
|
||||
"pm.max_requests" = 500;
|
||||
};
|
||||
};
|
||||
|
||||
services.nginx = mkIf (cfg.hostname != null) {
|
||||
virtualHosts."${cfg.hostname}" = {
|
||||
locations."/".extraConfig = ''
|
||||
index index.php;
|
||||
autoindex on;
|
||||
autoindex_exact_size off;
|
||||
autoindex_localtime on;
|
||||
'';
|
||||
locations."^~ /data".extraConfig = ''
|
||||
deny all;
|
||||
'';
|
||||
locations."~ \\.php$".extraConfig = ''
|
||||
include ${config.services.nginx.package}/conf/fastcgi_params;
|
||||
|
||||
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
|
||||
fastcgi_pass unix:${config.services.phpfpm.pools.snappymail.socket};
|
||||
'';
|
||||
extraConfig = ''
|
||||
client_max_body_size ${maxUploadSize};
|
||||
'';
|
||||
|
||||
root = if (cfg.package == pkgs.snappymail) then
|
||||
pkgs.snappymail.override {
|
||||
dataPath = cfg.dataDir;
|
||||
}
|
||||
else cfg.package;
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -1,63 +0,0 @@
|
||||
{ config, lib, pkgs, ... }:
|
||||
{
|
||||
systemd.timers."fancontrol" = {
|
||||
wantedBy = [ "timers.target" ];
|
||||
timerConfig = {
|
||||
OnCalendar="*:0/3";
|
||||
Unit = "fancontrol.service";
|
||||
};
|
||||
};
|
||||
|
||||
systemd.services."fancontrol" = {
|
||||
environment = {
|
||||
TEMP_MIN_FALLING = "50";
|
||||
TEMP_MAX_RISING = "56";
|
||||
TEMP_CRIT = "70";
|
||||
|
||||
LOW_FAN_SPEED = "0x10";
|
||||
};
|
||||
|
||||
script = ''
|
||||
SET_FAN_MANUAL="0x30 0x30 0x01 0x00" # Enable manual control
|
||||
SET_FAN_AUTO="0x30 0x30 0x01 0x01" # Disable manual control
|
||||
|
||||
SET_FAN_LOW="0x30 0x30 0x02 0xff $LOW_FAN_SPEED"
|
||||
SET_FAN_MAX="0x30 0x30 0x02 0xff 0x64" # force 100%
|
||||
|
||||
|
||||
# Get all temperatures readings starting with "Temp ", find all two digit numbers followed by spaces, find the largest one, trim the trailing space
|
||||
maxcoretemp=$(${pkgs.ipmitool}/bin/ipmitool sdr type temperature | grep '^Temp ' | grep -Po '\d{2} ' | sort -nr | head -n1 | xargs)
|
||||
|
||||
# Verify that we read a valid number
|
||||
ISNUMBER='^[0-9]+$'
|
||||
if ! [[ $maxcoretemp =~ $ISNUMBER ]] ; then
|
||||
echo "Error: could not read temperature" >&2
|
||||
exit 2
|
||||
fi
|
||||
|
||||
echo "Highest measured CPU temperature: '$maxcoretemp'"
|
||||
|
||||
if [ "$maxcoretemp" -gt "$TEMP_CRIT" ]; then
|
||||
echo "TOO HOT, CRITICAL CPU TEMP"
|
||||
${pkgs.ipmitool}/bin/ipmitool raw $SET_FAN_MANUAL
|
||||
${pkgs.ipmitool}/bin/ipmitool raw $SET_FAN_MAX
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if [ "$maxcoretemp" -gt "$TEMP_MAX_RISING" ]; then
|
||||
echo "TOO HOT, switching to IDRAC fan controL"
|
||||
${pkgs.ipmitool}/bin/ipmitool raw $SET_FAN_AUTO
|
||||
exit 0
|
||||
fi
|
||||
|
||||
if [ "$maxcoretemp" -lt "$TEMP_MIN_FALLING" ]; then
|
||||
echo "Sufficiently cooled, stepping down fans"
|
||||
${pkgs.ipmitool}/bin/ipmitool raw $SET_FAN_MANUAL
|
||||
${pkgs.ipmitool}/bin/ipmitool raw $SET_FAN_LOW
|
||||
exit 0
|
||||
fi
|
||||
|
||||
echo "Temperature is between limits, doing nothing..."
|
||||
'';
|
||||
};
|
||||
}
|
||||
@@ -1,22 +0,0 @@
|
||||
{ config, pkgs, lib, ... }:
|
||||
let
|
||||
cfg = config.services.podgrab;
|
||||
domain = "podgrab.home.feal.no";
|
||||
in {
|
||||
sops.secrets."podgrab/password" = { };
|
||||
|
||||
services.podgrab = {
|
||||
enable = true;
|
||||
port = 5104;
|
||||
passwordFile = config.sops.secrets."podgrab/password".path;
|
||||
};
|
||||
|
||||
services.nginx.virtualHosts.${domain} = {
|
||||
locations."/".proxyPass = "http://localhost:${toString cfg.port}";
|
||||
};
|
||||
|
||||
fileSystems."/tank/media/jellyfin/Podcasts" = {
|
||||
device = "/var/lib/podgrab/data";
|
||||
options = [ "bind "];
|
||||
};
|
||||
}
|
||||
@@ -1,17 +0,0 @@
|
||||
{ config, lib, pkgs, ... }:
|
||||
{
|
||||
imports = [ ../modules/snappymail.nix ];
|
||||
|
||||
services.snappymail = {
|
||||
enable = true;
|
||||
hostname = "mail.home.feal.no";
|
||||
};
|
||||
services.nginx.virtualHosts."${config.services.snappymail.hostname}" = let
|
||||
certPath = "/etc/ssl-snakeoil/home.feal.no";
|
||||
in {
|
||||
addSSL = true;
|
||||
|
||||
sslCertificate = "${certPath}.crt";
|
||||
sslCertificateKey = "${certPath}.key";
|
||||
};
|
||||
}
|
||||
@@ -1,10 +0,0 @@
|
||||
{ config, pkgs, lib, ... }:
|
||||
{
|
||||
# WIP
|
||||
security.polkit.enable = true; # Required for libvirt
|
||||
virtualisation.libvirtd.enable = true;
|
||||
programs.dconf.enable = true;
|
||||
environment.systemPackages = with pkgs; [ virt-manager ];
|
||||
users.users.felixalb.extraGroups = [ "libvirtd" ];
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user