summaryrefslogtreecommitdiff
path: root/hosts
diff options
context:
space:
mode:
Diffstat (limited to 'hosts')
-rw-r--r--hosts/sif/default.nix102
-rw-r--r--hosts/sif/greetd/default.nix44
-rw-r--r--hosts/sif/greetd/wallpaper.pngbin0 -> 6073128 bytes
-rw-r--r--hosts/sif/hw.nix19
-rw-r--r--hosts/sif/libvirt/default.nix1
-rw-r--r--hosts/sif/mail/default.nix2
-rw-r--r--hosts/surtr/default.nix2
-rw-r--r--hosts/surtr/dns/default.nix2
-rw-r--r--hosts/surtr/dns/keys/immich.yggdrasil.li_acme24
-rw-r--r--hosts/surtr/dns/zones/li.yggdrasil.soa10
-rw-r--r--hosts/surtr/immich.nix66
-rw-r--r--hosts/surtr/tls/tsig_key.gup4
-rw-r--r--hosts/surtr/tls/tsig_keys/immich.yggdrasil.li24
-rw-r--r--hosts/vidhar/default.nix4
-rw-r--r--hosts/vidhar/immich.nix10
-rw-r--r--hosts/vidhar/network/ruleset.nft7
-rw-r--r--hosts/vidhar/pgbackrest/default.nix9
-rw-r--r--hosts/vidhar/postgresql.nix36
-rw-r--r--hosts/vidhar/zfs.nix2
19 files changed, 295 insertions, 73 deletions
diff --git a/hosts/sif/default.nix b/hosts/sif/default.nix
index 7c8da63a..32651e14 100644
--- a/hosts/sif/default.nix
+++ b/hosts/sif/default.nix
@@ -12,9 +12,8 @@ let
12in { 12in {
13 imports = with flake.nixosModules.systemProfiles; [ 13 imports = with flake.nixosModules.systemProfiles; [
14 ./hw.nix 14 ./hw.nix
15 ./mail ./libvirt 15 ./mail ./libvirt ./greetd
16 tmpfs-root bcachefs initrd-all-crypto-modules default-locale openssh rebuild-machines 16 tmpfs-root bcachefs initrd-all-crypto-modules default-locale openssh rebuild-machines niri-unstable networkmanager
17 networkmanager
18 flakeInputs.nixos-hardware.nixosModules.lenovo-thinkpad-p1 17 flakeInputs.nixos-hardware.nixosModules.lenovo-thinkpad-p1
19 flakeInputs.impermanence.nixosModules.impermanence 18 flakeInputs.impermanence.nixosModules.impermanence
20 flakeInputs.nixVirt.nixosModules.default 19 flakeInputs.nixVirt.nixosModules.default
@@ -27,6 +26,9 @@ in {
27 allowUnfree = true; 26 allowUnfree = true;
28 pulseaudio = true; 27 pulseaudio = true;
29 }; 28 };
29 extraOverlays = [
30 flakeInputs.niri-flake.overlays.niri
31 ];
30 }; 32 };
31 33
32 time.timeZone = null; 34 time.timeZone = null;
@@ -34,7 +36,6 @@ in {
34 boot = { 36 boot = {
35 initrd = { 37 initrd = {
36 systemd = { 38 systemd = {
37 enable = false;
38 emergencyAccess = config.users.users.root.hashedPassword; 39 emergencyAccess = config.users.users.root.hashedPassword;
39 }; 40 };
40 luks.devices = { 41 luks.devices = {
@@ -62,15 +63,20 @@ in {
62 plymouth.enable = true; 63 plymouth.enable = true;
63 64
64 kernelPackages = pkgs.linuxPackages_latest; 65 kernelPackages = pkgs.linuxPackages_latest;
65 extraModulePackages = with config.boot.kernelPackages; [ v4l2loopback ];
66 kernelModules = ["v4l2loopback"];
67 kernelPatches = [ 66 kernelPatches = [
68 { name = "edac-config"; 67 { name = "edac-config";
69 patch = null; 68 patch = null;
70 extraConfig = '' 69 extraStructuredConfig = with lib.kernel; {
71 EDAC y 70 EDAC = yes;
72 EDAC_IE31200 y 71 EDAC_IE31200 = yes;
73 ''; 72 };
73 }
74 { name = "zswap-default";
75 patch = null;
76 extraStructuredConfig = with lib.kernel; {
77 ZSWAP_DEFAULT_ON = yes;
78 ZSWAP_SHRINKER_DEFAULT_ON = yes;
79 };
74 } 80 }
75 ]; 81 ];
76 82
@@ -439,7 +445,7 @@ in {
439 }; 445 };
440 446
441 xserver = { 447 xserver = {
442 enable = true; 448 enable = false;
443 449
444 xkb = { 450 xkb = {
445 layout = "us"; 451 layout = "us";
@@ -465,46 +471,15 @@ in {
465 }; 471 };
466 libinput.enable = true; 472 libinput.enable = true;
467 473
468 greetd = { 474 envfs.enable = false;
469 enable = true;
470 # settings.default_session.command = let
471 # cfg = config.programs.regreet;
472 # in pkgs.writeShellScript "greeter" ''
473 # modprobe -r nvidia_drm
474
475 # exec ${pkgs.dbus}/bin/dbus-run-session ${lib.getExe pkgs.cage} ${lib.escapeShellArgs cfg.cageArgs} -- ${lib.getExe cfg.package}
476 # '';
477 };
478 };
479
480 programs.regreet = {
481 enable = true;
482 theme = {
483 package = pkgs.equilux-theme;
484 name = "Equilux-compact";
485 };
486 iconTheme = {
487 package = pkgs.paper-icon-theme;
488 name = "Paper-Mono-Dark";
489 };
490 font = {
491 package = pkgs.fira;
492 name = "Fira Sans";
493 # size = 6;
494 };
495 cageArgs = [ "-s" "-m" "last" ];
496 settings = {
497 GTK.application_prefer_dark_theme = true;
498 };
499 }; 475 };
500 programs.hyprland.enable = true;
501 476
502 systemd.tmpfiles.settings = { 477 systemd.tmpfiles.settings = {
503 "10-localtime"."/etc/localtime".L.argument = "/.bcachefs/etc/localtime"; 478 "10-localtime"."/etc/localtime".L.argument = "/.bcachefs/etc/localtime";
504 479
505 "10-regreet"."/var/cache/regreet/cache.toml".C.argument = toString ((pkgs.formats.toml {}).generate "cache.toml" { 480 "10-regreet"."/var/cache/regreet/cache.toml".C.argument = toString ((pkgs.formats.toml {}).generate "cache.toml" {
506 last_user = "gkleen"; 481 last_user = "gkleen";
507 user_to_last_sess.gkleen = "Hyprland"; 482 user_to_last_sess.gkleen = "niri";
508 }); 483 });
509 }; 484 };
510 485
@@ -614,15 +589,15 @@ in {
614 }; 589 };
615 590
616 nvidia = { 591 nvidia = {
617 open = true; 592 open = false;
618 modesetting.enable = true; 593 modesetting.enable = true;
619 powerManagement.enable = true; 594 powerManagement.enable = true;
620 prime = { 595 # prime = {
621 nvidiaBusId = "PCI:1:0:0"; 596 # nvidiaBusId = "PCI:1:0:0";
622 intelBusId = "PCI:0:2:0"; 597 # intelBusId = "PCI:0:2:0";
623 reverseSync.enable = true; 598 # reverseSync.enable = true;
624 offload.enableOffloadCmd = true; 599 # offload.enableOffloadCmd = true;
625 }; 600 # };
626 }; 601 };
627 602
628 graphics = { 603 graphics = {
@@ -696,6 +671,7 @@ in {
696 671
697 services.dbus.packages = with pkgs; 672 services.dbus.packages = with pkgs;
698 [ dbus dconf 673 [ dbus dconf
674 xdg-desktop-portal-gtk
699 ]; 675 ];
700 676
701 services.udisks2.enable = true; 677 services.udisks2.enable = true;
@@ -704,12 +680,8 @@ in {
704 light.enable = true; 680 light.enable = true;
705 wireshark.enable = true; 681 wireshark.enable = true;
706 dconf.enable = true; 682 dconf.enable = true;
707 }; 683 niri.enable = true;
708 684 fuse.userAllowOther = true;
709 zramSwap = {
710 enable = true;
711 algorithm = "zstd";
712 writebackDevice = "/dev/disk/by-label/swap";
713 }; 685 };
714 686
715 services.pcscd.enable = true; 687 services.pcscd.enable = true;
@@ -729,6 +701,16 @@ in {
729 environment.sessionVariables."GTK_USE_PORTAL" = "1"; 701 environment.sessionVariables."GTK_USE_PORTAL" = "1";
730 xdg.portal = { 702 xdg.portal = {
731 enable = true; 703 enable = true;
704 extraPortals = with pkgs; [ xdg-desktop-portal-gtk ];
705 config.niri = {
706 default = ["gnome" "gtk"];
707 "org.freedesktop.impl.portal.FileChooser" = ["gtk"];
708 "org.freedesktop.impl.portal.OpenFile" = ["gtk"];
709 "org.freedesktop.impl.portal.Access" = ["gtk"];
710 "org.freedesktop.impl.portal.Notification" = ["gtk"];
711 "org.freedesktop.impl.portal.Secret" = ["gnome-keyring"];
712 "org.freedesktop.impl.portal.Inhibit" = ["none"];
713 };
732 }; 714 };
733 715
734 environment.persistence."/.bcachefs" = { 716 environment.persistence."/.bcachefs" = {
@@ -736,11 +718,11 @@ in {
736 directories = [ 718 directories = [
737 "/nix" 719 "/nix"
738 "/root" 720 "/root"
721 "/home"
739 "/var/log" 722 "/var/log"
740 "/var/lib/sops-nix" 723 "/var/lib/sops-nix"
741 "/var/lib/nixos" 724 "/var/lib/nixos"
742 "/var/lib/systemd" 725 "/var/lib/systemd"
743 "/home"
744 "/var/lib/chrony" 726 "/var/lib/chrony"
745 "/var/lib/fprint" 727 "/var/lib/fprint"
746 "/var/lib/bluetooth" 728 "/var/lib/bluetooth"
@@ -769,6 +751,10 @@ in {
769 751
770 home-manager.sharedModules = [ flakeInputs.nixVirt.homeModules.default ]; 752 home-manager.sharedModules = [ flakeInputs.nixVirt.homeModules.default ];
771 753
754 environment.pathsToLink = [
755 "share/zsh"
756 ];
757
772 system.stateVersion = "24.11"; 758 system.stateVersion = "24.11";
773 }; 759 };
774} 760}
diff --git a/hosts/sif/greetd/default.nix b/hosts/sif/greetd/default.nix
new file mode 100644
index 00000000..f609fc05
--- /dev/null
+++ b/hosts/sif/greetd/default.nix
@@ -0,0 +1,44 @@
1{ pkgs, ... }:
2{
3 config = {
4 services.greetd = {
5 enable = true;
6 # settings.default_session.command = let
7 # cfg = config.programs.regreet;
8 # in pkgs.writeShellScript "greeter" ''
9 # modprobe -r nvidia_drm
10
11 # exec ${pkgs.dbus}/bin/dbus-run-session ${lib.getExe pkgs.cage} ${lib.escapeShellArgs cfg.cageArgs} -- ${lib.getExe cfg.package}
12 # '';
13 };
14 programs.regreet = {
15 enable = true;
16 theme = {
17 package = pkgs.equilux-theme;
18 name = "Equilux-compact";
19 };
20 iconTheme = {
21 package = pkgs.paper-icon-theme;
22 name = "Paper-Mono-Dark";
23 };
24 font = {
25 package = pkgs.fira;
26 name = "Fira Sans";
27 # size = 6;
28 };
29 cageArgs = [ "-s" "-m" "last" ];
30 settings = {
31 GTK.application_prefer_dark_theme = true;
32 widget.clock.format = "%F %H:%M:%S%:z";
33 background = {
34 path = pkgs.runCommand "wallpaper.png" {
35 buildInputs = with pkgs; [ imagemagick ];
36 } ''
37 magick ${./wallpaper.png} -filter Gaussian -resize 6.25% -define filter:sigma=2.5 -resize 1600% "$out"
38 '';
39 fit = "Cover";
40 };
41 };
42 };
43 };
44}
diff --git a/hosts/sif/greetd/wallpaper.png b/hosts/sif/greetd/wallpaper.png
new file mode 100644
index 00000000..20fc761a
--- /dev/null
+++ b/hosts/sif/greetd/wallpaper.png
Binary files differ
diff --git a/hosts/sif/hw.nix b/hosts/sif/hw.nix
index fc20ef7c..1bcf0261 100644
--- a/hosts/sif/hw.nix
+++ b/hosts/sif/hw.nix
@@ -8,15 +8,28 @@
8 options = [ "fmask=0033" "dmask=0022" ]; 8 options = [ "fmask=0033" "dmask=0022" ];
9 }; 9 };
10 "/.bcachefs" = 10 "/.bcachefs" =
11 { device = "/dev/mapper/sif-nvm0:/dev/mapper/sif-nvm1"; 11 { options = [
12 "x-systemd.requires=/dev/disk/by-id/dm-name-sif-nvm0"
13 "x-systemd.requires=/dev/disk/by-id/dm-name-sif-nvm1"
14 ];
15 device = "/dev/disk/by-uuid/fe7bdaac-d2f3-4535-a635-e2fb97ef3802";
12 fsType = "bcachefs"; 16 fsType = "bcachefs";
13 neededForBoot = true; 17 neededForBoot = true;
14 }; 18 };
15 "/var/lib/sops-nix".neededForBoot = true; 19 "/var/lib/sops-nix".neededForBoot = true;
16 "/var/lib/systemd".neededForBoot = true; 20 "/var/lib/systemd".neededForBoot = true;
17 }; 21 };
18 system.etc.overlay.enable = false; 22 swapDevices = [
19 systemd.sysusers.enable = false; 23 { label = "swap"; }
24 ];
25 # system.etc.overlay.enable = false;
26
27 boot.initrd.systemd.packages = [
28 (pkgs.writeTextDir "/etc/systemd/system/\\x2ebcachefs.mount.d/block_scan.conf" ''
29 [Mount]
30 Environment=BCACHEFS_BLOCK_SCAN=1
31 '')
32 ];
20 33
21 # boot.initrd.supportedFilesystems.bcachefs = true; 34 # boot.initrd.supportedFilesystems.bcachefs = true;
22 # boot.initrd.systemd.units."dev-sif-nvm0:-dev-sif-nvm1.device".enable = false; 35 # boot.initrd.systemd.units."dev-sif-nvm0:-dev-sif-nvm1.device".enable = false;
diff --git a/hosts/sif/libvirt/default.nix b/hosts/sif/libvirt/default.nix
index d0be7dff..9712d0d9 100644
--- a/hosts/sif/libvirt/default.nix
+++ b/hosts/sif/libvirt/default.nix
@@ -8,6 +8,7 @@ with flakeInputs.nixVirt.lib;
8 qemu.swtpm.enable = true; 8 qemu.swtpm.enable = true;
9 allowedBridges = ["virbr0" "rz-0971" "rz-2403"]; 9 allowedBridges = ["virbr0" "rz-0971" "rz-2403"];
10 }; 10 };
11 virtualisation.spiceUSBRedirection.enable = true;
11 virtualisation.libvirt = { 12 virtualisation.libvirt = {
12 enable = true; 13 enable = true;
13 swtpm.enable = true; 14 swtpm.enable = true;
diff --git a/hosts/sif/mail/default.nix b/hosts/sif/mail/default.nix
index f36cd599..8d6cd705 100644
--- a/hosts/sif/mail/default.nix
+++ b/hosts/sif/mail/default.nix
@@ -1,4 +1,4 @@
1{ config, pkgs, ... }: 1{ config, lib, pkgs, ... }:
2{ 2{
3 services.postfix = { 3 services.postfix = {
4 enable = true; 4 enable = true;
diff --git a/hosts/surtr/default.nix b/hosts/surtr/default.nix
index 223e1f10..b8a639d5 100644
--- a/hosts/surtr/default.nix
+++ b/hosts/surtr/default.nix
@@ -6,7 +6,7 @@ with lib;
6 imports = with flake.nixosModules.systemProfiles; [ 6 imports = with flake.nixosModules.systemProfiles; [
7 tmpfs-root qemu-guest openssh rebuild-machines zfs 7 tmpfs-root qemu-guest openssh rebuild-machines zfs
8 ./zfs.nix ./dns ./tls ./http ./bifrost ./matrix ./postgresql 8 ./zfs.nix ./dns ./tls ./http ./bifrost ./matrix ./postgresql
9 ./prometheus ./email ./vpn ./borg.nix ./etebase 9 ./prometheus ./email ./vpn ./borg.nix ./etebase ./immich.nix
10 ]; 10 ];
11 11
12 config = { 12 config = {
diff --git a/hosts/surtr/dns/default.nix b/hosts/surtr/dns/default.nix
index 53df798e..ee1d089d 100644
--- a/hosts/surtr/dns/default.nix
+++ b/hosts/surtr/dns/default.nix
@@ -157,7 +157,7 @@ in {
157 ${concatMapStringsSep "\n" mkZone [ 157 ${concatMapStringsSep "\n" mkZone [
158 { domain = "yggdrasil.li"; 158 { domain = "yggdrasil.li";
159 addACLs = { "yggdrasil.li" = ["ymir_acme_acl"]; }; 159 addACLs = { "yggdrasil.li" = ["ymir_acme_acl"]; };
160 acmeDomains = ["surtr.yggdrasil.li" "yggdrasil.li" "etesync.yggdrasil.li" "app.etesync.yggdrasil.li"]; 160 acmeDomains = ["surtr.yggdrasil.li" "yggdrasil.li" "etesync.yggdrasil.li" "immich.yggdrasil.li" "app.etesync.yggdrasil.li"];
161 } 161 }
162 { domain = "nights.email"; 162 { domain = "nights.email";
163 addACLs = { "nights.email" = ["ymir_acme_acl"]; }; 163 addACLs = { "nights.email" = ["ymir_acme_acl"]; };
diff --git a/hosts/surtr/dns/keys/immich.yggdrasil.li_acme b/hosts/surtr/dns/keys/immich.yggdrasil.li_acme
new file mode 100644
index 00000000..c31234bd
--- /dev/null
+++ b/hosts/surtr/dns/keys/immich.yggdrasil.li_acme
@@ -0,0 +1,24 @@
1{
2 "data": "ENC[AES256_GCM,data:1i27jx1E4nn8/iXEN90tnQve0MX0HcXyYZoQfga1djcESDARd7kX78jncqnSdEMJPIQCyq2zmvOwEiAwyofIjSBSW2teoxD1PybSZdyvKwOnwLqpVWxgw6LORUoN5c1y4+WmnQa1SJ0a1WJwZ3cFRa3LP5JPbZzmNCZWEg+yGwVHNMsmrBSrjLRFC1NPIfX69lWGZl5VIMw2/SoSMDcOsSURWIpVSEYe9LNrc4/cKQQC/rmpXBg9ekIa8xd7NQTcDZA42bDIBQxJzqkUNV3JeIrl0C+eQw==,iv:MEDhvUvy0PfcLGim06VXkiIGgkNgaQcYqGhJraaGC6M=,tag:43CdGFe5JXOsMCHrvgl+BA==,type:str]",
3 "sops": {
4 "kms": null,
5 "gcp_kms": null,
6 "azure_kv": null,
7 "hc_vault": null,
8 "age": [
9 {
10 "recipient": "age1rmmhetcmllq0ahl5qznlr0eya2zdxwl9h6y5wnl97d2wtyx5t99sm2u866",
11 "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBLOU5OL0xxVVE2dzVOYnhP\nMUlhYlpyZGZSamU4QkpObHJLS1NJdjdwcmtjCks0OElnaHZvb3BSNnYySnVPcEUx\nazdNVUpZZGRNOVNBVTVUNUdnaC9DM00KLS0tIHUxU2dHMCt4d3hJbXlSNzBKUk1W\na05uZVRwVlMrbEZ2WEkvUy9PUVhmWXcKemRLnCC2mAkCEbZ3bC+iZmIWQCQsI+ew\ni4mmc/mUkGx8/61SR571NXIKmxSx2U5L2IK1pIKy6G/xMkPq+wDgUQ==\n-----END AGE ENCRYPTED FILE-----\n"
12 },
13 {
14 "recipient": "age19a7j77w267z04zls7m28a8hj4a0g5af6ltye2d5wypg33c3l89csd4r9zq",
15 "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB5VnNUV2lRR292ZmpNeU51\nQ2YxcnVnd21ybGdpd0I1QlJuSEQwNGZYTDJrCml0YUdxaWJHTEFNYWVIY01jWGk2\nZEJSQ0VZcVV1bU9VZ3dBbUh3a0N1ekUKLS0tIFhvNnRqcnRUZFNYOVhuWkFrZ3Vk\nMjU0YnNDODJRYk9lVENLUU9KU2dkWm8KHqtuNtC39S4oiQFRhNT2OOUOY9KQvDYW\nvtcdR8MSZDE7jsqgLgGS/8lIc0GBbIwYWghgFsLmn2Bkdh2q/VuO9w==\n-----END AGE ENCRYPTED FILE-----\n"
16 }
17 ],
18 "lastmodified": "2025-01-03T15:31:39Z",
19 "mac": "ENC[AES256_GCM,data:NKUbtcQf2DfALfm9kwiirmwD3slfTh4HNIg8BT/xbySHfwsaFtmlZTkhavBNr+b5snR8opATVXnJPAoykxXq8q4G1yDeitnTw6x9KfwgyZKpbJANMTBZEwK+CnZbqYRas1bFC88+D0yWI1yUnle+NPQ8VUj+KxCiUNuWO80mWhE=,iv:2a7CawUQujcZuR1pmsm9L2KGKcrBRAOxiIWEKCkTCEM=,tag:j8caxyN2fvx2FnWXHkWKcw==,type:str]",
20 "pgp": null,
21 "unencrypted_suffix": "_unencrypted",
22 "version": "3.9.2"
23 }
24} \ No newline at end of file
diff --git a/hosts/surtr/dns/zones/li.yggdrasil.soa b/hosts/surtr/dns/zones/li.yggdrasil.soa
index 092d23ec..9af6232f 100644
--- a/hosts/surtr/dns/zones/li.yggdrasil.soa
+++ b/hosts/surtr/dns/zones/li.yggdrasil.soa
@@ -1,7 +1,7 @@
1$ORIGIN yggdrasil.li. 1$ORIGIN yggdrasil.li.
2$TTL 3600 2$TTL 3600
3@ IN SOA ns.yggdrasil.li. hostmaster.yggdrasil.li ( 3@ IN SOA ns.yggdrasil.li. hostmaster.yggdrasil.li (
4 2024102100 ; serial 4 2025010300 ; serial
5 10800 ; refresh 5 10800 ; refresh
6 3600 ; retry 6 3600 ; retry
7 604800 ; expire 7 604800 ; expire
@@ -69,6 +69,14 @@ _acme-challenge.app.etesync IN NS ns.yggdrasil.li.
69 69
70app.etesync IN HTTPS 1 . alpn="h2,h3" ipv4hint="202.61.241.61" ipv6hint="2a03:4000:52:ada::" 70app.etesync IN HTTPS 1 . alpn="h2,h3" ipv4hint="202.61.241.61" ipv6hint="2a03:4000:52:ada::"
71 71
72immich IN A 202.61.241.61
73immich IN AAAA 2a03:4000:52:ada::
74immich IN MX 0 surtr.yggdrasil.li
75immich IN TXT "v=spf1 redirect=surtr.yggdrasil.li"
76_acme-challenge.immich IN NS ns.yggdrasil.li.
77
78immich IN HTTPS 1 . alpn="h2,h3" ipv4hint="202.61.241.61" ipv6hint="2a03:4000:52:ada::"
79
72vidhar IN AAAA 2a03:4000:52:ada:4:1:: 80vidhar IN AAAA 2a03:4000:52:ada:4:1::
73vidhar IN MX 0 ymir.yggdrasil.li 81vidhar IN MX 0 ymir.yggdrasil.li
74vidhar IN TXT "v=spf1 redirect=yggdrasil.li" 82vidhar IN TXT "v=spf1 redirect=yggdrasil.li"
diff --git a/hosts/surtr/immich.nix b/hosts/surtr/immich.nix
new file mode 100644
index 00000000..61a55e77
--- /dev/null
+++ b/hosts/surtr/immich.nix
@@ -0,0 +1,66 @@
1{ config, ... }:
2
3{
4 config = {
5 security.acme.rfc2136Domains = {
6 "immich.yggdrasil.li" = {
7 restartUnits = ["nginx.service"];
8 };
9 };
10
11 services.nginx = {
12 upstreams."immich" = {
13 servers = {
14 "[2a03:4000:52:ada:4:1::]:2283" = {};
15 };
16 extraConfig = ''
17 keepalive 8;
18 '';
19 };
20 virtualHosts = {
21 "immich.yggdrasil.li" = {
22 kTLS = true;
23 http3 = true;
24 forceSSL = true;
25 sslCertificate = "/run/credentials/nginx.service/immich.yggdrasil.li.pem";
26 sslCertificateKey = "/run/credentials/nginx.service/immich.yggdrasil.li.key.pem";
27 sslTrustedCertificate = "/run/credentials/nginx.service/immich.yggdrasil.li.chain.pem";
28 extraConfig = ''
29 charset utf-8;
30 '';
31
32 locations = {
33 "/".extraConfig = ''
34 proxy_pass http://immich;
35
36 proxy_http_version 1.1;
37 proxy_set_header Upgrade $http_upgrade;
38 proxy_set_header Connection "upgrade";
39
40 proxy_redirect off;
41 proxy_set_header Host $host;
42 proxy_set_header X-Real-IP $remote_addr;
43 proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
44 proxy_set_header X-Forwarded-Host $server_name;
45 proxy_set_header X-Forwarded-Proto $scheme;
46
47 client_max_body_size 0;
48 proxy_request_buffering off;
49 proxy_buffering off;
50 '';
51 };
52 };
53 };
54 };
55
56 systemd.services.nginx = {
57 serviceConfig = {
58 LoadCredential = [
59 "immich.yggdrasil.li.key.pem:${config.security.acme.certs."immich.yggdrasil.li".directory}/key.pem"
60 "immich.yggdrasil.li.pem:${config.security.acme.certs."immich.yggdrasil.li".directory}/fullchain.pem"
61 "immich.yggdrasil.li.chain.pem:${config.security.acme.certs."immich.yggdrasil.li".directory}/chain.pem"
62 ];
63 };
64 };
65 };
66}
diff --git a/hosts/surtr/tls/tsig_key.gup b/hosts/surtr/tls/tsig_key.gup
index 3d81b603..825479e5 100644
--- a/hosts/surtr/tls/tsig_key.gup
+++ b/hosts/surtr/tls/tsig_key.gup
@@ -1,6 +1,6 @@
1#!/usr/bin/env zsh 1#!/usr/bin/env zsh
2 2
3keyFile=../dns/keys/${2:t}_acme.yaml 3keyFile=../dns/keys/${2:t}_acme
4gup -u $keyFile 4gup -u $keyFile
5sops -d --input-type=binary --output-type=binary ${keyFile} | yq -r '.key[0].secret' > $1 5sops -d --input-type=binary --output-type=binary ${keyFile} | yq -r '.key[0].secret' > $1
6sops -p '7ED22F4AA7BB55728B643DC5471B7D88E4EF66F8,30D3453B8CD02FE2A3E7C78C0FB536FB87AE8F51' --input-type=binary -e -i $1 \ No newline at end of file 6sops -p '7ED22F4AA7BB55728B643DC5471B7D88E4EF66F8,30D3453B8CD02FE2A3E7C78C0FB536FB87AE8F51' --input-type=binary -e -i $1
diff --git a/hosts/surtr/tls/tsig_keys/immich.yggdrasil.li b/hosts/surtr/tls/tsig_keys/immich.yggdrasil.li
new file mode 100644
index 00000000..73104cc1
--- /dev/null
+++ b/hosts/surtr/tls/tsig_keys/immich.yggdrasil.li
@@ -0,0 +1,24 @@
1{
2 "data": "ENC[AES256_GCM,data:COfmT91I4+yiPhN3Hi7BTqMHyKhdKtwlzT9vNgTZc7FWTHhfuTtCHQo/rhX0,iv:RDs//AT8peUhKwIRdchCScUr/PlEzyMzQPB90S4k3g4=,tag:Lh4BULmQ6+hC+Ed8s9k0Hw==,type:str]",
3 "sops": {
4 "kms": null,
5 "gcp_kms": null,
6 "azure_kv": null,
7 "hc_vault": null,
8 "age": [
9 {
10 "recipient": "age1rmmhetcmllq0ahl5qznlr0eya2zdxwl9h6y5wnl97d2wtyx5t99sm2u866",
11 "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBGVEQvU29uWnVjMS8xcGp1\nam5hZVN3ejAxaGdpVWNia0VxT0I3dzR4YlV3ClczOGd0ZDJmUDhqb2dEdm5VeUdX\nRlR1WDNYUU9qaTYrRzhYMXBTV1JjV1UKLS0tIHBONU55RWtRSkR6K2NTNFZrUEZj\nbktqY0xBdGtiZWFFV3JUUVZTOC9YV2MKI4Ytz1NZ9+Og0GzIt/bh6L3aJUeR476g\nyRNifW4eOHf4Ne02ElpEoq6woInkxk8Ou/SJVIRmEOhjwm+qbV17gQ==\n-----END AGE ENCRYPTED FILE-----\n"
12 },
13 {
14 "recipient": "age19a7j77w267z04zls7m28a8hj4a0g5af6ltye2d5wypg33c3l89csd4r9zq",
15 "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBVOVNydWcyYjFrZDR2WStu\nWkJQd3VTTGtqVzdLVFR1eFdPZXBtVFBzVXc4ClREQVpKeXlhWlBFQzVFL0VGME5K\nUUhoa3A1YWdvSkZVV1FQcUh5L3RoUmMKLS0tIHE4c3A1OTNXVk9xZHJPZTlSMlQ4\nZnZUTXdjUGZuN3NoSEFSSko1aU5aQUEKHcuI2+9q7DsDwRn7mfwcSyC7AixzCC0e\nhqnGaW0HxmtLeOFuSPLdFMhhockCYGEV/907i/X6EImepWC4cf3bqA==\n-----END AGE ENCRYPTED FILE-----\n"
16 }
17 ],
18 "lastmodified": "2025-01-03T15:31:40Z",
19 "mac": "ENC[AES256_GCM,data:soDFDk35A1ULzOosZNrbhvtG3NPJDpAtLP3xrDtCBxgSGQ0lWrQ0o3MaKaJoDXQv7g/vYghmSwjH+0In0Ib3OWg0WLAlhwTEsiAn1o4JNRu/wF5aqvazOiDzFu7cyWil4Lsphy5eZgtc4IUp75SlCQc71xlNLoxudPpdcSxNLWg=,iv:jBYUZbiWM5gxFA+ZdpxpZIkz3WfgFi59tXFp242/qr8=,tag:H7ihAryZ8be+BbaqXFhRRg==,type:str]",
20 "pgp": null,
21 "unencrypted_suffix": "_unencrypted",
22 "version": "3.9.2"
23 }
24} \ No newline at end of file
diff --git a/hosts/vidhar/default.nix b/hosts/vidhar/default.nix
index 42a9e80d..b0797d8a 100644
--- a/hosts/vidhar/default.nix
+++ b/hosts/vidhar/default.nix
@@ -4,7 +4,7 @@ with lib;
4 4
5{ 5{
6 imports = with flake.nixosModules.systemProfiles; [ 6 imports = with flake.nixosModules.systemProfiles; [
7 ./zfs.nix ./network ./samba.nix ./dns ./prometheus ./borg ./pgbackrest 7 ./zfs.nix ./network ./samba.nix ./dns ./prometheus ./borg ./pgbackrest ./postgresql.nix ./immich.nix
8 tmpfs-root zfs 8 tmpfs-root zfs
9 initrd-all-crypto-modules default-locale openssh rebuild-machines 9 initrd-all-crypto-modules default-locale openssh rebuild-machines
10 build-server 10 build-server
@@ -136,7 +136,7 @@ with lib;
136 wantedBy = ["basic.target"]; 136 wantedBy = ["basic.target"];
137 serviceConfig = { 137 serviceConfig = {
138 ExecStart = pkgs.writeShellScript "limit-pstate-start" '' 138 ExecStart = pkgs.writeShellScript "limit-pstate-start" ''
139 echo 60 > /sys/devices/system/cpu/intel_pstate/max_perf_pct 139 echo 50 > /sys/devices/system/cpu/intel_pstate/max_perf_pct
140 ''; 140 '';
141 RemainAfterExit = true; 141 RemainAfterExit = true;
142 ExecStop = pkgs.writeShellScript "limit-pstate-stop" '' 142 ExecStop = pkgs.writeShellScript "limit-pstate-stop" ''
diff --git a/hosts/vidhar/immich.nix b/hosts/vidhar/immich.nix
new file mode 100644
index 00000000..a1f145a8
--- /dev/null
+++ b/hosts/vidhar/immich.nix
@@ -0,0 +1,10 @@
1{ ... }:
2
3{
4 config = {
5 services.immich = {
6 enable = true;
7 host = "2a03:4000:52:ada:4:1::";
8 };
9 };
10}
diff --git a/hosts/vidhar/network/ruleset.nft b/hosts/vidhar/network/ruleset.nft
index 9f519302..10fd4c51 100644
--- a/hosts/vidhar/network/ruleset.nft
+++ b/hosts/vidhar/network/ruleset.nft
@@ -1,4 +1,5 @@
1define icmp_protos = { ipv6-icmp, icmp, igmp } 1define icmp_protos = { ipv6-icmp, icmp, igmp }
2define bifrost_surtr = 2a03:4000:52:ada:4::/128
2 3
3table arp filter { 4table arp filter {
4 limit lim_arp_local { 5 limit lim_arp_local {
@@ -90,6 +91,7 @@ table inet filter {
90 counter http-rx {} 91 counter http-rx {}
91 counter tftp-rx {} 92 counter tftp-rx {}
92 counter pgbackrest-rx {} 93 counter pgbackrest-rx {}
94 counter immich-rx {}
93 95
94 counter established-rx {} 96 counter established-rx {}
95 97
@@ -118,6 +120,7 @@ table inet filter {
118 counter http-tx {} 120 counter http-tx {}
119 counter tftp-tx {} 121 counter tftp-tx {}
120 counter pgbackrest-tx {} 122 counter pgbackrest-tx {}
123 counter immich-tx {}
121 124
122 counter tx {} 125 counter tx {}
123 126
@@ -193,6 +196,8 @@ table inet filter {
193 196
194 tcp dport 8432 counter name pgbackrest-rx accept 197 tcp dport 8432 counter name pgbackrest-rx accept
195 198
199 iifname bifrost tcp dport 2283 ip6 saddr $bifrost_surtr counter name immich-rx accept
200
196 ct state { established, related } counter name established-rx accept 201 ct state { established, related } counter name established-rx accept
197 202
198 203
@@ -240,6 +245,8 @@ table inet filter {
240 245
241 tcp sport 8432 counter name pgbackrest-tx accept 246 tcp sport 8432 counter name pgbackrest-tx accept
242 247
248 iifname bifrost tcp sport 2283 ip6 daddr $bifrost_surtr counter name immich-tx accept
249
243 250
244 counter name tx 251 counter name tx
245 } 252 }
diff --git a/hosts/vidhar/pgbackrest/default.nix b/hosts/vidhar/pgbackrest/default.nix
index ffb149f5..1e0828ce 100644
--- a/hosts/vidhar/pgbackrest/default.nix
+++ b/hosts/vidhar/pgbackrest/default.nix
@@ -130,8 +130,9 @@ in {
130 }; 130 };
131 131
132 systemd.tmpfiles.rules = [ 132 systemd.tmpfiles.rules = [
133 "d /var/lib/pgbackrest 0750 pgbackrest pgbackrest - -" 133 "d /var/lib/pgbackrest 0770 pgbackrest pgbackrest - -"
134 "d /var/spool/pgbackrest 0750 pgbackrest pgbackrest - -" 134 "d /var/spool/pgbackrest 0770 pgbackrest pgbackrest - -"
135 "d /tmp/pgbackrest 0770 pgbackrest pgbackrest - -"
135 ]; 136 ];
136 137
137 users = { 138 users = {
@@ -141,7 +142,9 @@ in {
141 isSystemUser = true; 142 isSystemUser = true;
142 home = "/var/lib/pgbackrest"; 143 home = "/var/lib/pgbackrest";
143 }; 144 };
144 groups.pgbackrest = {}; 145 groups.pgbackrest = {
146 members = [ "postgres" ];
147 };
145 }; 148 };
146 149
147 systemd.services."pgbackrest-tls-server".serviceConfig = { 150 systemd.services."pgbackrest-tls-server".serviceConfig = {
diff --git a/hosts/vidhar/postgresql.nix b/hosts/vidhar/postgresql.nix
new file mode 100644
index 00000000..7e44e69f
--- /dev/null
+++ b/hosts/vidhar/postgresql.nix
@@ -0,0 +1,36 @@
1{ pkgs, config, flake, flakeInputs, ... }:
2
3let
4 nixpkgs-pgbackrest = import (flakeInputs.nixpkgs-pgbackrest.outPath + "/pkgs/top-level") {
5 overlays = [ flake.overlays.libdscp ];
6 localSystem = config.nixpkgs.system;
7 };
8in {
9 config = {
10 services.postgresql = {
11 enable = true;
12 package = pkgs.postgresql_15;
13 };
14
15 services.pgbackrest = {
16 settings."vidhar" = {
17 pg1-path = config.services.postgresql.dataDir;
18
19 repo1-path = "/var/lib/pgbackrest";
20 repo1-retention-full-type = "time";
21 repo1-retention-full = 14;
22 repo1-retention-archive = 7;
23 };
24
25 backups."vidhar-daily" = {
26 stanza = "vidhar";
27 repo = "1";
28 timerConfig.OnCalendar = "daily";
29 };
30 };
31
32 systemd.services.postgresql.serviceConfig = {
33 ReadWritePaths = [ "/var/spool/pgbackrest" "/var/lib/pgbackrest/archive/vidhar" ];
34 };
35 };
36}
diff --git a/hosts/vidhar/zfs.nix b/hosts/vidhar/zfs.nix
index 518c3287..9d667fd6 100644
--- a/hosts/vidhar/zfs.nix
+++ b/hosts/vidhar/zfs.nix
@@ -34,7 +34,7 @@ with lib;
34 }; 34 };
35 35
36 "/etc/zfs/zfs-list.cache" = 36 "/etc/zfs/zfs-list.cache" =
37 { device = "ssd-raid1/local/zfs-zfs--list.cache"; 37 { device = "ssd-raid1/local/etc-zfs-zfs--list.cache";
38 fsType = "zfs"; 38 fsType = "zfs";
39 neededForBoot = true; 39 neededForBoot = true;
40 }; 40 };
generated by cgit v1.2.3 (git 2.25.1) at 2025-02-02 02:06:15 +0000