2 files changed, 0 insertions, 202 deletions
diff --git a/hosts/eos/default.nix b/hosts/eos/default.nix
deleted file mode 100644
index 1c5347e7..00000000
--- a/hosts/eos/default.nix
+++ /dev/null
@@ -1,101 +0,0 @@
-{ flake, config, pkgs, lib, ... }:
-with lib;
-{
-  imports = with flake.nixosModules.systemProfiles; [
-    nfsroot
-  ];
-  config = {
-    nixpkgs = {
-      system = "x86_64-linux";
-      config = {
-        allowUnfree = true;
-      };
-    };
-    boot = {
-      initrd = {
-        availableKernelModules = [ "nvme" "ahci" "xhci_pci" "usbhid" "sd_mod" "sr_mod" ];
-        kernelModules = [ "igb" ];
-      };
-      kernelModules = [ "kvm-amd" ];
-      extraModulePackages = [ ];
-      plymouth.enable = true;
-      tmpOnTmpfs = true;
-    };
-    hardware = {
-      enableRedistributableFirmware = true;
-      cpu.amd.updateMicrocode = config.hardware.enableRedistributableFirmware;
-      nvidia = {
-        modesetting.enable = true;
-        powerManagement.enable = true;
-      };
-      opengl.enable = true;
-    };
-    environment.etc."machine-id".text = "f457b21333f1491e916521151ff5d468";
-    networking = {
-      hostId = "f457b213";
-      domain = "asgard.yggdrasil";
-      search = [ "asgard.yggdrasil" "yggdrasil" ];
-      hosts = {
-        "127.0.0.1" = [ "eos.asgard.yggdrasil" "eos" ];
-        "::1" = [ "eos.asgard.yggdrasil" "eos" ];
-      };
-      firewall.enable = false;
-      nftables = {
-        enable = true;
-        rulesetFile = ./ruleset.nft;
-      };
-    };
-    services.resolved = {
-      llmnr = "false";
-    };
-    zramSwap.enable = true;
-    system.stateVersion = config.system.nixos.release; # No state
-    time.timeZone = "Europe/Berlin";
-    time.hardwareClockInLocalTime = true;
-    i18n.defaultLocale = "en_DK.UTF-8";
-    environment.systemPackages = with pkgs; [ cifs-utils ];
-    security.pam.mount = {
-      enable = true;
-      extraVolumes = [
-        "<volume sgrp=\"users\" fstype=\"cifs\" server=\"vidhar.lan.yggdrasil\" path=\"home-eos\" mountpoint=\"~\" />"
-        "<volume sgrp=\"users\" fstype=\"cifs\" server=\"vidhar.lan.yggdrasil\" path=\"%(USER)\" mountpoint=\"/run/media/%(USER)/vidhar\" />"
-      ];
-    };
-    services.xserver = {
-      enable = true;
-      displayManager.sddm = {
-        enable = true;
-        settings = {
-          Users.HideUsers = "gkleen";
-        };
-      };
-      desktopManager.plasma5.enable = true;
-      videoDrivers = [ "nvidia" ];
-    };
-  };
-}
diff --git a/hosts/eos/ruleset.nft b/hosts/eos/ruleset.nft
deleted file mode 100644
index 7b38a059..00000000
--- a/hosts/eos/ruleset.nft
+++ /dev/null
@@ -1,101 +0,0 @@
-define icmp_protos = {ipv6-icmp, icmp, igmp}
-table arp filter {
-  limit lim_arp {
-    rate over 50 mbytes/second burst 50 mbytes
-  }
-  chain input {
-    type filter hook input priority filter
-    policy accept
-    limit name lim_arp counter drop
-    counter
-  }
-  chain output {
-    type filter hook output priority filter
-    policy accept
-    limit name lim_arp counter drop
-    counter
-  }
-}
-table inet filter {
-  limit lim_reject {
-    rate over 1000/second burst 1000 packets
-  }
-  limit lim_icmp {
-    rate over 50 mbytes/second burst 50 mbytes
-  }
-  chain forward {
-    type filter hook forward priority filter
-    policy drop
-    ct state invalid log level debug prefix "drop invalid forward: " counter drop
-    iifname lo counter accept
-    limit name lim_reject log level debug prefix "drop forward: " counter drop
-    log level debug prefix "reject forward: " counter
-    meta l4proto tcp ct state new counter reject with tcp reset
-    ct state new counter reject
-    counter
-  }
-  chain input {
-    type filter hook input priority filter
-    policy drop
-    ct state invalid log level debug prefix "drop invalid input: " counter drop
-    iifname lo counter accept
-    iif != lo ip daddr 127.0.0.1/8 counter reject
-    iif != lo ip6 daddr ::1/128 counter reject
-    meta l4proto $icmp_protos limit name lim_icmp counter drop
-    meta l4proto $icmp_protos counter accept
-    tcp dport 22 counter accept
-    udp dport 60000-61000 counter accept
-    ct state {established, related} counter accept
-    limit name lim_reject log level debug prefix "drop input: " counter drop
-    log level debug prefix "reject input: " counter
-    meta l4proto tcp ct state new counter reject with tcp reset
-    ct state new counter reject
-    counter
-  }
-  chain output {
-    type filter hook output priority filter
-    policy accept
-    oifname lo counter accept
-    meta l4proto $icmp_protos limit name lim_icmp counter drop
-    meta l4proto $icmp_protos counter accept
-    counter
-  }
-}
-\ No newline at end of file

diff --git a/hosts/eos/default.nix b/hosts/eos/default.nix deleted file mode 100644 index 1c5347e7..00000000 --- a/hosts/eos/default.nix +++ /dev/null
@@ -1,101 +0,0 @@
1	{ flake, config, pkgs, lib, ... }:
2
3	with lib;
4
5	{
6	imports = with flake.nixosModules.systemProfiles; [
7	nfsroot
8	];
9
10	config = {
11	nixpkgs = {
12	system = "x86_64-linux";
13	config = {
14	allowUnfree = true;
15	};
16	};
17
18	boot = {
19	initrd = {
20	availableKernelModules = [ "nvme" "ahci" "xhci_pci" "usbhid" "sd_mod" "sr_mod" ];
21	kernelModules = [ "igb" ];
22	};
23	kernelModules = [ "kvm-amd" ];
24	extraModulePackages = [ ];
25
26	plymouth.enable = true;
27
28	tmpOnTmpfs = true;
29	};
30
31	hardware = {
32	enableRedistributableFirmware = true;
33	cpu.amd.updateMicrocode = config.hardware.enableRedistributableFirmware;
34
35	nvidia = {
36	modesetting.enable = true;
37	powerManagement.enable = true;
38	};
39
40	opengl.enable = true;
41	};
42
43	environment.etc."machine-id".text = "f457b21333f1491e916521151ff5d468";
44
45	networking = {
46	hostId = "f457b213";
47
48	domain = "asgard.yggdrasil";
49	search = [ "asgard.yggdrasil" "yggdrasil" ];
50
51	hosts = {
52	"127.0.0.1" = [ "eos.asgard.yggdrasil" "eos" ];
53	"::1" = [ "eos.asgard.yggdrasil" "eos" ];
54	};
55
56	firewall.enable = false;
57	nftables = {
58	enable = true;
59	rulesetFile = ./ruleset.nft;
60	};
61	};
62
63	services.resolved = {
64	llmnr = "false";
65	};
66
67	zramSwap.enable = true;
68
69	system.stateVersion = config.system.nixos.release; # No state
70
71
72	time.timeZone = "Europe/Berlin";
73	time.hardwareClockInLocalTime = true;
74	i18n.defaultLocale = "en_DK.UTF-8";
75
76
77	environment.systemPackages = with pkgs; [ cifs-utils ];
78
79	security.pam.mount = {
80	enable = true;
81	extraVolumes = [
82	"<volume sgrp=\"users\" fstype=\"cifs\" server=\"vidhar.lan.yggdrasil\" path=\"home-eos\" mountpoint=\"~\" />"
83	"<volume sgrp=\"users\" fstype=\"cifs\" server=\"vidhar.lan.yggdrasil\" path=\"%(USER)\" mountpoint=\"/run/media/%(USER)/vidhar\" />"
84	];
85	};
86
87
88	services.xserver = {
89	enable = true;
90	displayManager.sddm = {
91	enable = true;
92	settings = {
93	Users.HideUsers = "gkleen";
94	};
95	};
96	desktopManager.plasma5.enable = true;
97
98	videoDrivers = [ "nvidia" ];
99	};
100	};
101	}


diff --git a/hosts/eos/ruleset.nft b/hosts/eos/ruleset.nft deleted file mode 100644 index 7b38a059..00000000 --- a/hosts/eos/ruleset.nft +++ /dev/null
@@ -1,101 +0,0 @@
1	define icmp_protos = {ipv6-icmp, icmp, igmp}
2
3	table arp filter {
4	limit lim_arp {
5	rate over 50 mbytes/second burst 50 mbytes
6	}
7
8	chain input {
9	type filter hook input priority filter
10	policy accept
11
12	limit name lim_arp counter drop
13
14	counter
15	}
16
17	chain output {
18	type filter hook output priority filter
19	policy accept
20
21	limit name lim_arp counter drop
22
23	counter
24	}
25	}
26
27	table inet filter {
28	limit lim_reject {
29	rate over 1000/second burst 1000 packets
30	}
31
32	limit lim_icmp {
33	rate over 50 mbytes/second burst 50 mbytes
34	}
35
36
37	chain forward {
38	type filter hook forward priority filter
39	policy drop
40
41
42	ct state invalid log level debug prefix "drop invalid forward: " counter drop
43
44
45	iifname lo counter accept
46
47
48	limit name lim_reject log level debug prefix "drop forward: " counter drop
49	log level debug prefix "reject forward: " counter
50	meta l4proto tcp ct state new counter reject with tcp reset
51	ct state new counter reject
52
53
54	counter
55	}
56
57	chain input {
58	type filter hook input priority filter
59	policy drop
60
61
62	ct state invalid log level debug prefix "drop invalid input: " counter drop
63
64
65	iifname lo counter accept
66	iif != lo ip daddr 127.0.0.1/8 counter reject
67	iif != lo ip6 daddr ::1/128 counter reject
68
69	meta l4proto $icmp_protos limit name lim_icmp counter drop
70	meta l4proto $icmp_protos counter accept
71
72	tcp dport 22 counter accept
73	udp dport 60000-61000 counter accept
74
75
76	ct state {established, related} counter accept
77
78
79	limit name lim_reject log level debug prefix "drop input: " counter drop
80	log level debug prefix "reject input: " counter
81	meta l4proto tcp ct state new counter reject with tcp reset
82	ct state new counter reject
83
84
85	counter
86	}
87
88	chain output {
89	type filter hook output priority filter
90	policy accept
91
92
93	oifname lo counter accept
94
95	meta l4proto $icmp_protos limit name lim_icmp counter drop
96	meta l4proto $icmp_protos counter accept
97
98
99	counter
100	}
101	} \ No newline at end of file