challenger+defiant: Set bind-mount fsType=none

hosts/challenger/configuration.nix

@@ -49,13 +49,23 @@
   security.polkit.enable = true; # Required for nextcloud
 
   nixpkgs.config.allowUnfreePredicate = pkg: builtins.elem (lib.getName pkg) [
-       "nvidia-x11"
+    "nvidia-kernel-modules"
-       "nvidia-settings"
+    "nvidia-settings"
+    "nvidia-x11"
   ];
 
   hardware.nvidia = {
     modesetting.enable = true;
     open = false;
+    # https://github.com/sircam-html/nixos-conf/blob/main/guides/nvidia-nixos-guide.md
+    package = config.boot.kernelPackages.nvidiaPackages.mkDriver {
+      version            = "580.142";
+      sha256_64bit       = "sha256-IJFfzz/+icNVDPk7YKBKKFRTFQ2S4kaOGRGkNiBEdWM=";
+      sha256_aarch64     = "sha256-0000000000000000000000000000000000000000000=";
+      openSha256         = "sha256-0000000000000000000000000000000000000000000=";
+      settingsSha256     = "sha256-BnrIlj5AvXTfqg/qcBt2OS9bTDDZd3uhf5jqOtTMTQM=";
+      persistencedSha256 = "sha256-0000000000000000000000000000000000000000000=";
+    };
   };
 
   hardware.graphics.enable = true;

hosts/challenger/exports.nix

@@ -4,6 +4,7 @@
     "/export/riker-backup" = {
       device = "/tank/backup/riker";
       options = [ "bind" ];
+      fsType = "none";
     };
   };
 

hosts/challenger/filesystems.nix

@@ -9,6 +9,7 @@
     zfs = {
       extraPools = [ "tank" ];
       requestEncryptionCredentials = false;
+      forceImportRoot = false;
     };
     supportedFilesystems = [ "zfs" ];
   };

hosts/challenger/services/frigate.nix

@@ -5,6 +5,7 @@
       device = "/tank/nvr/frigate";
       depends = [ "/tank/nvr/frigate" ];
       options = [ "bind" ];
+      fsType = "none";
     };
   };
 

hosts/challenger/services/nextcloud.nix

@@ -5,7 +5,7 @@ let
 in {
   services.nextcloud = {
     enable = true;
-    package = pkgs.nextcloud32;
+    package = pkgs.nextcloud33;
     inherit hostName;
     home = "/tank/nextcloud";
     https = true;
@@ -75,7 +75,7 @@ in {
 
   environment.systemPackages = [
     cfg.occ # "occ CMD" in the docs -> "sudo -u nextcloud nextcloud-occ CMD"
-    pkgs.nodejs_20 # For Recognize; Put /run/current-system/sw/bin/node in the "node_binary" field in the web UI -> Memories
+    pkgs.nodejs # For Recognize; Put /run/current-system/sw/bin/node in the "node_binary" field in the web UI -> Memories
   ];
 
   sops.secrets."nextcloud/adminpass" = {

hosts/defiant/filesystems.nix

@@ -3,7 +3,11 @@
   # Boot drives are defined in ./hardware-configuration.nix
 
   boot = {
-    zfs.extraPools = [ "tank" ];
+    zfs = {
+      extraPools = [ "tank" ];
+      forceImportRoot = false;
+    };
+
     supportedFilesystems = [ "zfs" ];
   };
   services.prometheus.exporters.zfs.enable = true;

hosts/defiant/libvirt.nix

@@ -11,6 +11,7 @@
   fileSystems."/var/lib/libvirt/images" = {
     device = "/tank/iso";
     options = [ "bind" ];
+    fsType = "none";
   };
 
   # On a gui-enabled machine, connect with:

hosts/defiant/services/monitoring/grafana.nix

@@ -9,10 +9,15 @@ in {
 
     # TODO: Migrate sqlite to postgres
 
-    settings.server = {
+    settings = {
-      domain = "grafana.home.feal.no";
+      server = {
-      http_port = 2342;
+        domain = "grafana.home.feal.no";
-      http_addr = "127.0.0.1";
+        http_port = 2342;
+        http_addr = "127.0.0.1";
+      };
+      security = {
+        secret_key = "SW2YcwTIb9zpOOhoPsMm"; # TODO - Rotate
+      };
     };
 
     provision = {

hosts/defiant/services/monitoring/snmp-exporter.nix

@@ -1,12 +1,13 @@
 { config, pkgs, ... }:
 
 {
-  services.prometheus.exporters.snmp = {
+  # TODO - Fix. Broken in 26.05
-    enable = true;
+  # services.prometheus.exporters.snmp = {
-    configurationPath = ./snmp-exporter-conf.yml;
+  #   enable = true;
-    # snmp.yml is built from
+  #   configurationPath = ./snmp-exporter-conf.yml;
-    # https://github.com/prometheus/snmp_exporter/blob/main/snmp.yml
+  #   # snmp.yml is built from
-    # and
+  #   # https://github.com/prometheus/snmp_exporter/blob/main/snmp.yml
-    # https://global.download.synology.com/download/Document/Software/DeveloperGuide/Firmware/DSM/All/enu/Synology_DiskStation_MIB_Guide.pdf
+  #   # and
-  };
+  #   # https://global.download.synology.com/download/Document/Software/DeveloperGuide/Firmware/DSM/All/enu/Synology_DiskStation_MIB_Guide.pdf
+  # };
 }

hosts/defiant/services/pihole.nix

@@ -4,7 +4,7 @@ let
   dnsHost = "192.168.10.175";
   webuiListen = "127.0.1.2:5053";
 in {
-  # Flame - Homelab dashboard/linktree
+  # Pihole - Ad-blocking DNS recursor and authoritative DNS/DHCP
   virtualisation.oci-containers.containers = {
     pihole = {
       image = "pihole/pihole";

hosts/defiant/services/wireguard.nix

@@ -16,10 +16,10 @@ in {
       privateKeyFile = "/etc/wireguard/defiant.private";
 
       postSetup = ''
-        ${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -s 10.100.0.0/24 -d 192.168.10.0/24 -o eth0 -j MASQUERADE
+        ${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -s 10.100.0.0/24 -d 192.168.10.0/24 -o enp3s0 -j MASQUERADE
       '';
       postShutdown = ''
-        ${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -s 10.100.0.0/24 -d 192.168.10.0/24 -o eth0 -j MASQUERADE
+        ${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -s 10.100.0.0/24 -d 192.168.10.0/24 -o enp3s0 -j MASQUERADE
       '';
 
       peers = (import ../../../common/wireguard-peers.nix);