summaryrefslogtreecommitdiff
path: root/hosts/sif
diff options
context:
space:
mode:
Diffstat (limited to 'hosts/sif')
-rw-r--r--hosts/sif/default.nix320
-rw-r--r--hosts/sif/hw.nix36
-rw-r--r--hosts/sif/mail/default.nix66
-rw-r--r--hosts/sif/mail/secrets.yaml33
-rw-r--r--hosts/sif/wacom.conf15
5 files changed, 470 insertions, 0 deletions
diff --git a/hosts/sif/default.nix b/hosts/sif/default.nix
new file mode 100644
index 00000000..b54b6caf
--- /dev/null
+++ b/hosts/sif/default.nix
@@ -0,0 +1,320 @@
1{ flake, pkgs, customUtils, lib, config, path, ... }:
2{
3 imports = with flake.nixosModules.systemProfiles; [
4 ./hw.nix
5 ./mail
6 initrd-all-crypto-modules default-locale openssh
7 ];
8
9 config = {
10 nixpkgs = {
11 system = "x86_64-linux";
12 config = {
13 allowUnfree = true;
14 };
15 };
16
17 boot = {
18 initrd = {
19 luks.devices = {
20 nvm0.device = "/dev/disk/by-uuid/fe641e81-0812-4181-a5f6-382ebba509bb";
21 nvm1.device = "/dev/disk/by-uuid/43df1ba8-1728-4193-8855-920a82d4494a";
22 };
23 availableKernelModules = [ "drbg" "nvme" "fbcon" "xhci_pci" "usb_storage" "sd_mod" "rtsx_pci_sdmmc" ];
24 kernelModules = [ "dm-raid" "dm-integrity" "dm-snapshot" "dm-thin-pool" ];
25 };
26
27 blacklistedKernelModules = [ "nouveau" ];
28
29 # Use the systemd-boot EFI boot loader.
30 loader = {
31 systemd-boot.enable = true;
32 efi.canTouchEfiVariables = true;
33 timeout = null;
34 };
35
36 plymouth.enable = true;
37
38 kernelPackages = pkgs.linuxPackages_latest;
39 kernelParams = [ "i915.fastboot=1" "intel_pstate=no_hwp" "acpi_backlight=vendor" "thinkpad-acpi.brightness_enable=1" "quiet" ];
40
41 tmpOnTmpfs = true;
42 };
43
44 networking = {
45 domain = "midgard.yggdrasil";
46 hosts = {
47 "127.0.0.1" = [ "sif.midgard.yggdrasil" "sif" ];
48 "::1" = [ "sif.midgard.yggdrasil" "sif" ];
49 };
50
51 firewall = {
52 enable = true;
53 allowedTCPPorts = [ 22 # ssh
54 8000 # quickserve
55 ];
56 };
57
58 networkmanager = {
59 enable = true;
60 dhcp = "internal";
61 dns = "dnsmasq";
62 extraConfig = ''
63 [connectivity]
64 uri=https://online.yggdrasil.li
65 '';
66 };
67
68 dhcpcd.enable = false;
69
70 interfaces.yggdrasil = {
71 virtual = true;
72 virtualType = config.services.tinc.networks.yggdrasil.interfaceType;
73 macAddress = "5c:93:21:c3:61:39";
74 };
75 };
76
77 environment.etc."NetworkManager/dnsmasq.d/libvirtd_dnsmasq.conf" = {
78 text = ''
79 server=/sif.libvirt/192.168.122.1
80 '';
81 };
82
83 powerManagement.enable = true;
84
85 environment.systemPackages = with pkgs; [
86 nvtop brightnessctl
87 ];
88
89 services = {
90 tinc.yggdrasil.enable = true;
91
92 uucp = {
93 enable = true;
94 nodeName = "sif";
95 remoteNodes = {
96 "ymir" = {
97 publicKeys = ["ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIG6KNtsCOl5fsZ4rV7udTulGMphJweLBoKapzerWNoLY root@ymir"];
98 hostnames = ["ymir.yggdrasil.li" "ymir.niflheim.yggdrasil"];
99 };
100 };
101
102 defaultCommands = lib.mkForce [];
103 };
104
105 avahi.enable = true;
106
107 fwupd.enable = true;
108
109 fprintd.enable = true;
110
111 blueman.enable = true;
112
113 colord.enable = true;
114
115 vnstat.enable = true;
116
117 logind = {
118 lidSwitch = "suspend";
119 lidSwitchDocked = "lock";
120 lidSwitchExternalPower = "lock";
121 };
122
123 atd = {
124 enable = true;
125 allowEveryone = true;
126 };
127
128 xserver = {
129 enable = true;
130
131 layout = "us";
132 xkbVariant = "dvp";
133 xkbOptions = "compose:caps";
134
135 displayManager.lightdm = {
136 enable = true;
137 greeters.gtk = {
138 clock-format = "%H:%M %a %b %_d";
139 indicators = ["~host" "~spacer" "~clock" "~session" "~power"];
140 theme = {
141 package = pkgs.equilux-theme;
142 name = "Equilux-compact";
143 };
144 iconTheme = {
145 package = pkgs.paper-icon-theme;
146 name = "Paper";
147 };
148 extraConfig = ''
149 background = #000000
150 user-background = false
151 active-monitor = #cursor
152 hide-user-image = true
153
154 [monitor: DP-2]
155 laptop = true
156 '';
157 };
158 };
159
160 displayManager.setupCommands = ''
161 ${pkgs.xorg.xinput}/bin/xinput disable 'SynPS/2 Synaptics TouchPad'
162 '';
163
164 desktopManager.xterm.enable = true;
165 windowManager.twm.enable = true;
166 displayManager.defaultSession = "xterm+twm";
167
168 wacom.enable = true;
169 libinput.enable = true;
170
171 dpi = 282;
172
173 videoDrivers = [ "nvidia" ];
174
175 screenSection = ''
176 Option "metamodes" "nvidia-auto-select +0+0 { ForceCompositionPipeline = On }"
177 '';
178
179 deviceSection = ''
180 Option "AccelMethod" "SNA"
181 Option "TearFree" "True"
182 '';
183
184 exportConfiguration = true;
185 };
186 };
187
188 users = {
189 users.gkleen.extraGroups = [ "media" ];
190 groups.media = {};
191 };
192
193 hardware = {
194 pulseaudio = {
195 enable = true;
196 package = with pkgs; pulseaudioFull;
197 support32Bit = true;
198 };
199
200 bluetooth = {
201 enable = true;
202 config = {
203 General = {
204 Enable = "Source,Sink,Media,Socket";
205 };
206 };
207 };
208
209 trackpoint = {
210 enable = true;
211 emulateWheel = true;
212 sensitivity = 255;
213 speed = 255;
214 };
215
216 nvidia = {
217 modesetting.enable = true;
218 prime = {
219 nvidiaBusId = "PCI:1:0:0";
220 intelBusId = "PCI:0:2:0";
221 sync.enable = true;
222 };
223 };
224
225 opengl = {
226 enable = true;
227 driSupport32Bit = true;
228 setLdLibraryPath = true;
229 };
230
231 firmware = [ pkgs.firmwareLinuxNonfree ];
232 };
233
234 sound.enable = true;
235
236 nix = {
237 autoOptimiseStore = true;
238 daemonNiceLevel = 10;
239 daemonIONiceLevel = 3;
240 };
241
242 environment.etc."X11/xorg.conf.d/50-wacom.conf".source = lib.mkForce ./wacom.conf;
243
244 systemd.services."ac-plugged" = {
245 description = "Inhibit handling of lid-switch and sleep";
246
247 path = with pkgs; [ systemd coreutils ];
248
249 script = ''
250 exec systemd-inhibit --what=handle-lid-switch --why="AC is connected" --mode=block sleep infinity
251 '';
252
253 serviceConfig = {
254 Type = "simple";
255 };
256 };
257
258 services.udev.extraRules = with pkgs; ''
259 SUBSYSTEM=="power_supply", ENV{POWER_SUPPLY_ONLINE}=="0", RUN+="${systemd}/bin/systemctl --no-block stop ac-plugged.service"
260 SUBSYSTEM=="power_supply", ENV{POWER_SUPPLY_ONLINE}=="1", RUN+="${systemd}/bin/systemctl --no-block start ac-plugged.service"
261 '';
262
263 services.borgbackup = {
264 snapshots = "btrfs";
265 prefix = "yggdrasil.midgard.sif.";
266 targets = {
267 "munin" = {
268 repo = "borg.munin:borg";
269 paths = [ "/home/gkleen" ];
270 prune = {
271 "home" =
272 [ "--keep-within" "24H"
273 "--keep-daily" "31"
274 "--keep-monthly" "12"
275 "--keep-yearly" "-1"
276 ];
277 };
278 keyFile = "/run/secrets/borg-repokey--borg_munin__borg";
279 };
280 };
281 };
282 sops.secrets.borg-repokey--borg_munin__borg = {
283 sopsFile = /. + path + "/modules/borgbackup/repokeys/borg_munin__borg.yaml";
284 key = "key";
285 };
286
287 services.btrfs.autoScrub = {
288 enable = true;
289 fileSystems = [ "/" "/home" ];
290 interval = "weekly";
291 };
292
293 systemd.services."nix-daemon".serviceConfig = {
294 MemoryAccounting = true;
295 MemoryHigh = "50%";
296 MemoryMax = "75%";
297 };
298
299 services.journald.extraConfig = ''
300 SystemMaxUse=100M
301 '';
302
303 services.dbus.packages = with pkgs;
304 [ dbus gnome3.dconf
305 ];
306
307 programs = {
308 light.enable = true;
309 wireshark.enable = true;
310 };
311
312 virtualisation.libvirtd = {
313 enable = true;
314 };
315
316 zramSwap.enable = true;
317
318 system.stateVersion = "20.03";
319 };
320}
diff --git a/hosts/sif/hw.nix b/hosts/sif/hw.nix
new file mode 100644
index 00000000..4a3e6c86
--- /dev/null
+++ b/hosts/sif/hw.nix
@@ -0,0 +1,36 @@
1{ config, lib, pkgs, ... }:
2
3{
4 fileSystems."/" =
5 { device = "/dev/disk/by-uuid/f094bf06-66f9-40a8-9ab2-2b54d05223d2";
6 fsType = "btrfs";
7 };
8
9 fileSystems."/boot" =
10 { device = "/dev/disk/by-uuid/B3A2-D029";
11 fsType = "vfat";
12 };
13
14 fileSystems."/home" =
15 { device = "/dev/disk/by-uuid/9e932072-3c56-4a9c-8da7-3163d2a8bf28";
16 fsType = "btrfs";
17 };
18
19 fileSystems."/var/media" =
20 { device = "/dev/disk/by-uuid/437eca70-d017-4d52-a1fa-2f4c7a87f096";
21 fsType = "btrfs";
22 };
23
24 swapDevices =
25 [ { device = "/dev/disk/by-uuid/50f3f856-cc17-4614-846a-34a14d5006ec"; }
26 ];
27
28 nix.maxJobs = 12;
29 powerManagement.cpuFreqGovernor = "powersave";
30 # High-DPI console
31 console.font = "${pkgs.terminus_font}/share/consolefonts/ter-u28n.psf.gz";
32
33 hardware.cpu.intel.updateMicrocode = true;
34
35 hardware.enableRedistributableFirmware = true;
36}
diff --git a/hosts/sif/mail/default.nix b/hosts/sif/mail/default.nix
new file mode 100644
index 00000000..2addba9d
--- /dev/null
+++ b/hosts/sif/mail/default.nix
@@ -0,0 +1,66 @@
1{ config, pkgs, ... }:
2{
3 services.postfix = {
4 enable = true;
5 enableSmtp = true;
6 enableSubmission = false;
7 setSendmail = true;
8 networksStyle = "host";
9 hostname = "sif.midgard.yggdrasil";
10 destination = [];
11 relayHost = "uucp:ymir";
12 recipientDelimiter = "+";
13 masterConfig = {
14 uucp = {
15 type = "unix";
16 private = true;
17 privileged = true;
18 chroot = false;
19 command = "pipe";
20 args = [ "flags=Fqhu" "user=uucp" ''argv=${config.security.wrapperDir}/uux -z -a $sender - $nexthop!rmail ($recipient)'' ];
21 };
22 };
23 transport = ''
24 odin.asgard.yggdrasil uucp:odin
25 '';
26 config = {
27 always_bcc = "gkleen+sent@odin.asgard.yggdrasil";
28
29 default_transport = "uucp:ymir";
30
31 inet_interfaces = "loopback-only";
32
33 authorized_submit_users = ["!uucp" "static:anyone"];
34 message_size_limit = "0";
35
36 sender_dependent_default_transport_maps = ''regexp:${pkgs.writeText "sender_relay" ''
37 /@(cip|stud)\.ifi\.(lmu|uni-muenchen)\.de$/ smtp:smtp.ifi.lmu.de
38 /@ifi\.(lmu|uni-muenchen)\.de$/ smtp:smtpin1.ifi.lmu.de:587
39 /@(campus\.)?lmu\.de$/ smtp:postout.lrz.de
40 ''}'';
41 sender_bcc_maps = ''texthash:${pkgs.writeText "sender_bcc" ''
42 uni2work@ifi.lmu.de uni2work@ifi.lmu.de
43 @ifi.lmu.de gregor.kleen@ifi.lmu.de
44 ''}'';
45
46 smtp_sasl_auth_enable = true;
47 smtp_sender_dependent_authentication = true;
48 smtp_sasl_tls_security_options = "noanonymous";
49 smtp_sasl_mechanism_filter = ["plain"];
50 smtp_sasl_password_maps = "texthash:/var/db/postfix/sasl_passwd";
51 smtp_cname_overrides_servername = false;
52 smtp_always_send_ehlo = true;
53
54 smtp_tls_loglevel = "1";
55 smtp_dns_support_level = "dnssec";
56 };
57 useDane = true;
58 };
59
60 sops.secrets.postfix-sasl-passwd = {
61 key = "sasl-passwd";
62 path = "/var/db/postfix/sasl_passwd";
63 owner = "postfix";
64 sopsFile = ./secrets.yaml;
65 };
66}
diff --git a/hosts/sif/mail/secrets.yaml b/hosts/sif/mail/secrets.yaml
new file mode 100644
index 00000000..00422f82
--- /dev/null
+++ b/hosts/sif/mail/secrets.yaml
@@ -0,0 +1,33 @@
1sasl-passwd: ENC[AES256_GCM,data:RDZHUgQJHH7IzJD5j+LOuQb4OuPopUEa6CwDRoD/FqoHFW/YKarF3Hxxu4HKA5GDf3SRrFOcPBXmf+0f1CucUQwJQh4nY4fmDVqrH0UXRowuAkIhYpt0sLXlzrOzSeZz788A9xK4AGPzEOx1va7GOqJIaPJ+pyyzazQsSgCJaFkUMriCfKbZ0zhRCr0pk2RPLOLKGuo2mDFf5c3EZYAn7vEzhZj+B3XbNWotV/JXTX7JPK6GPcsX2RMKEYBdmxZzrMCTTFU23W1DbiDJ01mxJh3ckIX+KTmaWNoVg4Tong1vBe2wxKchXajmykwFLJFR1Kj5wv4uAxy2qNvKtQIF/LJosG6LXcdk5QDQBXUINqswupBdV8lt08mk53JHLJPXcV8RpEHT3NUL,iv:2u203xTmUEfWIJDB2ZkOKzhYQrV4TGT7rfOd0md+VOw=,tag:RJ/iLbbq8B8dMmXGWjok/g==,type:str]
2sops:
3 kms: []
4 gcp_kms: []
5 azure_kv: []
6 hc_vault: []
7 lastmodified: '2021-01-02T19:29:40Z'
8 mac: ENC[AES256_GCM,data:g8wNpsFXiGoENSteWa1w1UkF8LQwnwtoeEHskKhGqAlCFtA1cVdyFSItm8/h1/eqJl/NWXRGU25XpZysCAkJi+uCq4bNGjV+gjqeIT8Dv5teQbVwthoFqkE/s3jew35+f29/xxb5Cro6EihlTrs5Lt3wExv2+NUdim1aeNgR+4Q=,iv:bj/igDT7GPiCjj4BwE7ihM8wR8CbJeXu/s550rc+QEw=,tag:KKt6tWlqxu5C/L/ZYbQL3g==,type:str]
9 pgp:
10 - created_at: '2021-01-02T19:29:14Z'
11 enc: |
12 -----BEGIN PGP MESSAGE-----
13
14 hF4Dgwm4NZSaLAcSAQdAE/883Tbc7WXuzOxjm5jVrOSbnYe+BEg75ijtZP2L3UMw
15 4mhqzy576jEQLPGrnMpX2zA2MwFAwGnMwC98sQ4vVTp/xgNQ0VHHNM4GnTi6VoUb
16 0l4BLgQrT6p2ul69ADecadWJsGm6roqMHrpNGZeeczDLOBIzrrwN4sL92jQiEPw9
17 Ih+EXJpJ1K4NouU1VRsfQPqJ6y+i295TnEgunlJeYc/MNQgBT4ABiPZgUZXnkhxl
18 =7rOv
19 -----END PGP MESSAGE-----
20 fp: F1AF20B9511B63F681A14E8D51AEFBCD1DEF68F8
21 - created_at: '2021-01-02T19:29:14Z'
22 enc: |
23 -----BEGIN PGP MESSAGE-----
24
25 hF4DXxoViZlp6dISAQdAGifJ6qk40VdF/WKaYa9v97PdSVkPvHZt+j0G8+ZDJSEw
26 8XC1622ElTWRCZ2bjUwMF77DMgMy3rEr8B7Bj6MnEzDd/Af63Np1cO+7juybxqhz
27 0l4BO6uZ+gCvKg45jWX0GE6ZBkoUTvh24djTngHFyIHDnpCxSB6s+jcYR9otco2F
28 ++E2pcoQR4GuOeyYa/8UsW+RzKWpCfskYbSIt4gAXyCt8ua1y5Rw0DEVdw91uJNC
29 =E/qh
30 -----END PGP MESSAGE-----
31 fp: 30D3453B8CD02FE2A3E7C78C0FB536FB87AE8F51
32 unencrypted_suffix: _unencrypted
33 version: 3.6.1
diff --git a/hosts/sif/wacom.conf b/hosts/sif/wacom.conf
new file mode 100644
index 00000000..864409f1
--- /dev/null
+++ b/hosts/sif/wacom.conf
@@ -0,0 +1,15 @@
1Section "InputClass"
2 Identifier "Wacom USB device class"
3 MatchUSBID "056a:*"
4 MatchDevicePath "/dev/input/event*"
5 Driver "wacom"
6EndSection
7
8Section "InputClass"
9 Identifier "calibration"
10 MatchProduct "Wacom USB device class"
11 Option "MinX" "58"
12 Option "MaxX" "30982"
13 Option "MinY" "87"
14 Option "MaxY" "17328"
15EndSection \ No newline at end of file
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-06 11:21:24 +0000