{ hostName, flake, config, pkgs, lib, ... }: { imports = with flake.nixosModules.systemProfiles; [ ./zfs.nix ./dsl.nix initrd-all-crypto-modules default-locale openssh rebuild-machines build-server initrd-ssh ]; config = { nixpkgs = { system = "x86_64-linux"; }; networking.hostId = "1e7ddd78"; environment.etc."machine-id".text = "1e7ddd784c525bba2a03d7c160c5da4e"; boot = { loader.grub = { enable = true; version = 2; device = "/dev/disk/by-id/ata-SuperMicro_SSD_SMC0515D95019BDF4083"; }; kernelPackages = pkgs.linuxPackages_latest; kernelModules = [ "kvm-intel" ]; kernelParams = [ "ip=10.141.0.1:::255.255.255.0::eno1:static" ]; tmpOnTmpfs = true; initrd = { supportedFilesystems = [ "zfs" ]; availableKernelModules = [ "ehci_pci" "ahci" "nvme" "isci" "xhci_pci" "usb_storage" "usbhid" "sd_mod" "sr_mod" "drbg" "rtsx_pci_sdmmc" "libsas" "scsi_transport_sas" "e1000e" ]; kernelModules = [ "dm-raid" "dm-integrity" "dm-snapshot" "dm-thin-pool" ]; luks.devices = { nvm0.device = "/dev/disk/by-label/${hostName}-nvm0"; nvm1.device = "/dev/disk/by-label/${hostName}-nvm1"; hdd0.device = "/dev/disk/by-label/${hostName}-hdd0"; hdd1.device = "/dev/disk/by-label/${hostName}-hdd1"; hdd2.device = "/dev/disk/by-label/${hostName}-hdd2"; hdd3.device = "/dev/disk/by-label/${hostName}-hdd3"; hdd4.device = "/dev/disk/by-label/${hostName}-hdd4"; hdd5.device = "/dev/disk/by-label/${hostName}-hdd5"; }; network.flushBeforeStage2 = false; }; supportedFilesystems = [ "zfs" ]; zfs = { enableUnstable = true; }; }; fileSystems = { "/" = { fsType = "tmpfs"; options = [ "mode=0755" ]; }; }; networking = { hostName = "vidhar"; domain = "yggdrasil"; search = [ "yggdrasil" ]; useDHCP = false; useNetworkd = true; interfaces."eno1" = { ipv4.addresses = [ { address = "10.141.0.1"; prefixLength = 24; } ]; }; firewall = { enable = true; allowPing = true; allowedTCPPorts = [ 22 # ssh ]; allowedUDPPorts = [ 51820 # wireguard ]; allowedUDPPortRanges = [ { from = 60000; to = 61000; } # mosh ]; extraCommands = '' ip46tables -D FORWARD -j nixos-fw-forward 2>/dev/null || true ip46tables -F nixos-fw-forward 2>/dev/null || true ip46tables -X nixos-fw-forward 2>/dev/null || true ip46tables -N nixos-fw-forward ip46tables -A nixos-fw-forward -i eno1 -j ACCEPT ip46tables -A nixos-fw-forward -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT ip6tables -A nixos-fw-forward -p icmpv6 --icmpv6-type redirect -j nixos-fw-log-refuse ip6tables -A nixos-fw-forward -p icmpv6 --icmpv6-type 139 -j nixos-fw-log-refuse ip6tables -A nixos-fw-forward -p icmpv6 -j ACCEPT ip46tables -A nixos-fw-forward -j nixos-fw-log-refuse ip46tables -A FORWARD -j nixos-fw-forward ip46tables -t nat -D POSTROUTING -j nixos-fw-postrouting 2>/dev/null || true ip46tables -t nat -F nixos-fw-postrouting 2>/dev/null || true ip46tables -t nat -X nixos-fw-postrouting 2>/dev/null || true ip46tables -t nat -N nixos-fw-postrouting iptables -t nat -A nixos-fw-postrouting -o dsl -j MASQUERADE ip46tables -t nat -A POSTROUTING -j nixos-fw-postrouting ip46tables -t mangle -D POSTROUTING -j nixos-fw-postrouting 2>/dev/null || true ip46tables -t mangle -F nixos-fw-postrouting 2>/dev/null || true ip46tables -t mangle -X nixos-fw-postrouting 2>/dev/null || true ip46tables -t mangle -N nixos-fw-postrouting ip46tables -t mangle -A nixos-fw-postrouting -o dsl -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu ip46tables -t mangle -A POSTROUTING -j nixos-fw-postrouting ''; }; }; services.dhcpd4 = { enable = true; interfaces = [ "eno1" ]; extraConfig = '' subnet 10.141.0.0 netmask 255.255.255.0 { range 10.141.0.128 10.141.0.254; option domain-name-servers 1.1.1.1, 1.0.0.1; option broadcast-address 10.141.0.255; option routers 10.141.0.1; option domain-name "asgard.yggdrasil"; } ''; machines = [ { ethernetAddress = "50:d4:f7:f3:0f:7e"; hostName = "gauss-ap01"; ipAddress = "10.141.0.64"; } ]; }; services.corerad = { enable = true; settings = { interfaces = [ { name = config.networking.pppInterface; monitor = true; verbose = true; } { name = "eno1"; advertise = true; verbose = true; prefix = [{ prefix = "::/64"; }]; route = [{ prefix = "::/0"; }]; } ]; }; }; boot.kernel.sysctl = { "net.ipv6.conf.all.forwarding" = true; "net.ipv6.conf.default.forwarding" = true; "net.ipv4.conf.all.forwarding" = true; "net.ipv4.conf.default.forwarding" = true; }; systemd.network.networks = { "eno2" = { matchConfig.Name = "eno2"; networkConfig.LinkLocalAddressing = "no"; }; "telekom" = { matchConfig.Name = "telekom"; networkConfig.LinkLocalAddressing = "no"; }; }; systemd.services."dhcpcd-telekom" = { wantedBy = [ "multi-user.target" "network-online.target" ]; bindsTo = [ "pppd-telekom.service" ]; after = [ "pppd-telekom.service" ]; wants = [ "network.target" ]; before = [ "network-online.target" ]; path = with pkgs; [ dhcpcd nettools openresolv ]; unitConfig.ConditionCapability = "CAP_NET_ADMIN"; stopIfChanged = false; serviceConfig = let dhcpcdConf = pkgs.writeText "dhcpcd.conf" '' duid vendorclassid ipv6only nooption domain_name_servers, domain_name, domain_search option classless_static_routes option interface_mtu option host_name option rapid_commit require dhcp_server_identifier slaac private noipv6rs # disable routing solicitation allowinterfaces dsl interface dsl ipv6rs # enable routing solicitation for WAN adapter ia_na 1 # request an IPv6 address ia_pd 1 eno1/0 # request a PD and assign it to the LAN waitip 6 ''; in { Type = "forking"; PIDFile = "/run/dhcpcd.pid"; ExecStart = "@${pkgs.dhcpcd}/sbin/dhcpcd dhcpcd --config ${dhcpcdConf}"; ExecReload = "${pkgs.dhcpcd}/sbin/dhcpcd --rebind"; Restart = "always"; }; }; services.timesyncd.enable = false; services.chrony = { enable = true; servers = []; extraConfig = '' pool time.cloudflare.com iburst nts pool nts.ntp.se iburst nts server nts.sth1.ntp.se iburst nts server nts.sth2.ntp.se iburst nts server ptbtime1.ptb.de iburst nts server ptbtime2.ptb.de iburst nts server ptbtime3.ptb.de iburst nts makestep 0.1 3 cmdport 0 ''; }; services.openssh = { enable = true; passwordAuthentication = false; challengeResponseAuthentication = false; extraConfig = '' AllowGroups ssh ''; }; users.groups."ssh" = { members = ["root"]; }; security.sudo.extraConfig = '' Defaults lecture = never ''; nix = { daemonCPUSchedPolicy = "batch"; daemonIOSchedClass = "idle"; gc = { automatic = true; options = "--delete-older-than 30d"; }; }; powerManagement = { enable = true; cpuFreqGovernor = "schedutil"; }; }; }