sarek: intialize service config. Move firewall to base.nix

This commit is contained in:
Felix Albrigtsen 2023-10-05 23:44:58 +02:00
parent 199b2293c1
commit dd6ca2642b
7 changed files with 51 additions and 19 deletions

View File

@ -68,6 +68,8 @@
'';
};
networking.firewall.allowedTCPPorts = [ 22 ];
users.users.felixalb = {
isNormalUser = true;
extraGroups = [ "wheel" ];

View File

@ -64,7 +64,7 @@
)
];
networking.firewall.allowedTCPPorts = [ 80 22 3100 ];
networking.firewall.allowedTCPPorts = [ 80 3100 ];
# system.copySystemConfiguration = true;

View File

@ -31,7 +31,6 @@
"nvidia-x11"
"nvidia-settings"
];
networking.firewall.allowedTCPPorts = [ 22 ];
system.stateVersion = "23.05";
}

View File

@ -7,7 +7,9 @@
../../base.nix
../../common/metrics-exporters.nix
./services/nginx.nix
./services/postgresql.nix
./services/flame.nix
];
# Boot and console is handled by proxmoxLXC.
@ -27,13 +29,10 @@
hostId = "15dd36bc";
};
sops.defaultSopsFile = ../../secrets/sarek/edison.yaml;
sops.defaultSopsFile = ../../secrets/sarek/sarek.yaml;
environment.variables = { EDITOR = "vim"; };
environment.systemPackages = with pkgs; [
];
networking.firewall.allowedTCPPorts = [ 22 ];
virtualisation.docker.enable = true;
virtualisation.oci-containers.backend = "docker";
system.stateVersion = "23.05";
}

View File

@ -0,0 +1,24 @@
{ config, pkgs, lib, ... }:
let
domain = "flame.home.feal.no";
host = "127.0.1.2";
port = "5005";
in {
# Flame - Homelab dashboard/linktree
virtualisation.oci-containers.containers = {
flame = {
image = "pawelmalak/flame";
ports = [ "${host}:${port}:5005" ];
volumes = [
"/var/lib/flame/data:/app/data/"
];
};
};
services.nginx.virtualHosts."${domain}" = {
locations."/" = {
proxyPass = "http://${host}:${port}";
};
};
}

View File

@ -0,0 +1,19 @@
{ config, values, ... }:
{
services.nginx = {
enable = true;
enableReload = true;
recommendedProxySettings = true;
recommendedTlsSettings = true;
recommendedGzipSettings = true;
recommendedOptimisation = true;
};
networking.firewall.allowedTCPPorts = [ 80 443 ];
/* security.acme = { */
/* acceptTerms = true; */
/* email = "felix@albrigtsen.it"; */
/* }; */
}

View File

@ -103,20 +103,9 @@
sslCertificateKey = "${certPath}.key";
};
/* virtualisation.podman = { */
/* enable = true; */
/* dockerCompat = true; # Make `docker` shell alias */
/* defaultNetwork.settings.dns_enabled = true; */
/* }; */
/* virtualisation.oci-containers.backend = "podman"; */
virtualisation.docker.enable = true;
virtualisation.oci-containers.backend = "docker";
networking.firewall.allowedTCPPorts = [ 22 ];
system.stateVersion = "22.11";
}