Feature/adding jeeves (#112)
* Feature/factorio (#109) * add factorio * add factorio server * add new user * fixed typo * jeeves base * allow jeeves to be built into an ISO Signed-off-by: ahuston-0 <aliceghuston@gmail.com> * server-side fixes * Disable sops on jeeves temporarily Signed-off-by: ahuston-0 <aliceghuston@gmail.com> * fix flake.nix inputs Signed-off-by: ahuston-0 <aliceghuston@gmail.com> * add sops for jeeves * update jeeves age key Signed-off-by: ahuston-0 <aliceghuston@gmail.com> * efi variables fix? Signed-off-by: ahuston-0 <aliceghuston@gmail.com> * updating sops * remove alice Signed-off-by: ahuston-0 <aliceghuston@gmail.com> * remove richie Signed-off-by: ahuston-0 <aliceghuston@gmail.com> * usbguard :( Signed-off-by: ahuston-0 <aliceghuston@gmail.com> * remove iso from image Signed-off-by: ahuston-0 <aliceghuston@gmail.com> * add alice zt * restore home-manager Signed-off-by: ahuston-0 <aliceghuston@gmail.com> * fix comment Signed-off-by: ahuston-0 <aliceghuston@gmail.com> * add jeeves key Signed-off-by: ahuston-0 <aliceghuston@gmail.com> * restore original config Signed-off-by: ahuston-0 <aliceghuston@gmail.com> * revert canTouchEfiVariables keeping it in line with other servers Signed-off-by: ahuston-0 <aliceghuston@gmail.com> * removed working-config.nix * Get rid of dummy user Signed-off-by: ahuston-0 <aliceghuston@gmail.com> * change formatter to nixfmt-rfc-style Signed-off-by: ahuston-0 <aliceghuston@gmail.com> * update lock Signed-off-by: ahuston-0 <aliceghuston@gmail.com> * added plex * initial format Signed-off-by: ahuston-0 <aliceghuston@gmail.com> * removed lib.mkDefault from PermitRootLogin --------- Signed-off-by: ahuston-0 <aliceghuston@gmail.com> Co-authored-by: Dennis <52411861+DerDennisOP@users.noreply.github.com> Co-authored-by: Richie Cahill <richie@tmmworkshop.com>
This commit is contained in:
GitHub
101
systems/jeeves/configuration.nix
Normal file
101
systems/jeeves/configuration.nix
Normal file
@ -0,0 +1,101 @@
|
||||
{ pkgs, lib, ... }:
|
||||
{
|
||||
time.timeZone = "America/New_York";
|
||||
console.keyMap = "us";
|
||||
networking = {
|
||||
hostId = "1beb3027";
|
||||
firewall.enable = false;
|
||||
};
|
||||
|
||||
boot = {
|
||||
zfs.extraPools = [
|
||||
"Media"
|
||||
"Storage"
|
||||
"Torenting"
|
||||
];
|
||||
filesystem = "zfs";
|
||||
useSystemdBoot = true;
|
||||
};
|
||||
|
||||
virtualisation = {
|
||||
docker = {
|
||||
enable = true;
|
||||
recommendedDefaults = true;
|
||||
logDriver = "local";
|
||||
storageDriver = "overlay2";
|
||||
daemon."settings" = {
|
||||
experimental = true;
|
||||
data-root = "/var/lib/docker";
|
||||
exec-opts = [ "native.cgroupdriver=systemd" ];
|
||||
log-opts = {
|
||||
max-size = "10m";
|
||||
max-file = "5";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
podman = {
|
||||
enable = true;
|
||||
recommendedDefaults = true;
|
||||
};
|
||||
};
|
||||
|
||||
environment = {
|
||||
systemPackages = with pkgs; [ docker-compose ];
|
||||
etc = {
|
||||
# Creates /etc/lynis/custom.prf
|
||||
"lynis/custom.prf" = {
|
||||
text = ''
|
||||
skip-test=BANN-7126
|
||||
skip-test=BANN-7130
|
||||
skip-test=DEB-0520
|
||||
skip-test=DEB-0810
|
||||
skip-test=FIRE-4513
|
||||
skip-test=HRDN-7222
|
||||
skip-test=KRNL-5820
|
||||
skip-test=LOGG-2190
|
||||
skip-test=LYNIS
|
||||
skip-test=TOOL-5002
|
||||
'';
|
||||
mode = "0440";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
services = {
|
||||
nfs.server.enable = true;
|
||||
|
||||
openssh.ports = [ 629 ];
|
||||
|
||||
plex = {
|
||||
enable = true;
|
||||
dataDir = "/ZFS/Media/Plex/";
|
||||
};
|
||||
|
||||
smartd.enable = true;
|
||||
|
||||
sysstat.enable = true;
|
||||
|
||||
usbguard = {
|
||||
enable = false;
|
||||
rules = ''
|
||||
allow id 1532:0241
|
||||
'';
|
||||
};
|
||||
|
||||
zfs = {
|
||||
trim.enable = true;
|
||||
autoScrub.enable = true;
|
||||
};
|
||||
|
||||
zerotierone = {
|
||||
enable = true;
|
||||
joinNetworks = [
|
||||
"e4da7455b2ae64ca"
|
||||
"52b337794f23c1d4"
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
system.stateVersion = "23.11";
|
||||
}
|
||||
7
systems/jeeves/default.nix
Normal file
7
systems/jeeves/default.nix
Normal file
@ -0,0 +1,7 @@
|
||||
{ ... }:
|
||||
{
|
||||
users = [
|
||||
"alice"
|
||||
"richie"
|
||||
];
|
||||
}
|
||||
55
systems/jeeves/hardware.nix
Normal file
55
systems/jeeves/hardware.nix
Normal file
@ -0,0 +1,55 @@
|
||||
# Do not modify this file! It was generated by ‘nixos-generate-config’
|
||||
# and may be overwritten by future invocations. Please make changes
|
||||
# to /etc/nixos/configuration.nix instead.
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
pkgs,
|
||||
modulesPath,
|
||||
...
|
||||
}:
|
||||
|
||||
{
|
||||
imports = [ (modulesPath + "/installer/scan/not-detected.nix") ];
|
||||
|
||||
boot.initrd.availableKernelModules = [
|
||||
"mpt3sas"
|
||||
"nvme"
|
||||
"xhci_pci"
|
||||
"ahci"
|
||||
"uas"
|
||||
"usb_storage"
|
||||
"usbhid"
|
||||
"sd_mod"
|
||||
"sr_mod"
|
||||
];
|
||||
boot.initrd.kernelModules = [ "dm-snapshot" ];
|
||||
boot.kernelModules = [ "kvm-amd" ];
|
||||
boot.extraModulePackages = [ ];
|
||||
|
||||
fileSystems."/" = {
|
||||
device = "/dev/disk/by-uuid/0f78fa87-30be-4173-b0fa-eaa956cf83aa";
|
||||
fsType = "ext4";
|
||||
};
|
||||
|
||||
fileSystems."/boot" = {
|
||||
device = "/dev/disk/by-uuid/BB77-2647";
|
||||
fsType = "vfat";
|
||||
};
|
||||
|
||||
swapDevices = [ { device = "/dev/disk/by-uuid/4c797a94-be32-43d3-89ac-7f02912c7cf5"; } ];
|
||||
|
||||
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
|
||||
# (the default) this is the recommended approach. When using systemd-networkd it's
|
||||
# still possible to use this option, but it's recommended to use it in conjunction
|
||||
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
|
||||
networking.useDHCP = lib.mkDefault true;
|
||||
# networking.interfaces.enp38s0f3u2u2c2.useDHCP = lib.mkDefault true;
|
||||
# networking.interfaces.enp97s0f0np0.useDHCP = lib.mkDefault true;
|
||||
# networking.interfaces.enp97s0f1np1.useDHCP = lib.mkDefault true;
|
||||
# networking.interfaces.enp98s0f0.useDHCP = lib.mkDefault true;
|
||||
# networking.interfaces.enp98s0f1.useDHCP = lib.mkDefault true;
|
||||
|
||||
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
|
||||
hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
|
||||
}
|
||||
61
systems/jeeves/secrets.yaml
Normal file
61
systems/jeeves/secrets.yaml
Normal file
@ -0,0 +1,61 @@
|
||||
hello: ENC[AES256_GCM,data:y98ZcYZQSYP8GBFysKvD292lU1EPa0o/wV7EHPLelIIHl8bWE5Lz27KUsCnzNQ==,iv:zU9zBeNyAyiLs30ftxrATG/X/U7Z7euLqjDKmg0Lh7Y=,tag:MG61sKRBEvE7T/oWO3rGpA==,type:str]
|
||||
sops:
|
||||
kms: []
|
||||
gcp_kms: []
|
||||
azure_kv: []
|
||||
hc_vault: []
|
||||
age:
|
||||
- recipient: age128ehc0ssgwnuv4r8ayfyu7r80e82xrkmv63g7h9y9q4mhk4w9dyqfymc2w
|
||||
enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBTREhIRUd1K3JCM29mVHVv
|
||||
d2Q4eFBLWnRUTGEzelZOMS9ScXNyV3ZGbHpNCjNCSEhmTDQ4VUtta0RXdXJUY0da
|
||||
Vld5WDlJS3oyWkk5KzUzam9PYXZSa1kKLS0tIHJuaktpU3hnUWEwZzc4eHNjSitI
|
||||
bVhXamJyMWMvODUvajk2aDZnQ1k1blEKoNIYxUA+k+DA+1WYq5BSa0iXuQ2Lctuy
|
||||
9W7OO2m+QGzjdLLM0uS7WWGXWP2cDDgUGcqozTqM0Oqi2/OY0Bo3Jg==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
lastmodified: "2023-12-29T20:01:04Z"
|
||||
mac: ENC[AES256_GCM,data:9tUmPHyKY42lT1EfbDK7Es9MIdiR5A0rs/ST89baJMANGIN+oKQzkzDujG2WM8hxvgApl/GuIdy5ZBNZlUM0iYxFUd2a0UBDyjw+xTzWIuQr2/TuI8/cOgp04Kk+M9wNlLzE/dJAXsaqBo0EaHpfwKo/3/J53UfiIZrOtAZv+Qg=,iv:E79aJdvhkG2PfsO06QQa2Pzs3yiSHDARpZtM+uxiZJE=,tag:UwEcwBm22Ep2U2mhDgpQ0w==,type:str]
|
||||
pgp:
|
||||
- created_at: "2024-03-02T20:52:17Z"
|
||||
enc: |-
|
||||
-----BEGIN PGP MESSAGE-----
|
||||
|
||||
hQIMA84hNUGIgI/nARAAxQSkqnR75Rd1htAv7esbpmXlrZH+frTL6V4jGoAiqTeF
|
||||
TSA46E2nl7rVqPTws74OOb+O5bN3OkHSmmWzIbj6Pc8YnqY4t9N69zoCHtsbI1kn
|
||||
FQ4WwUdzofIUMKwF+E31/knyKbf/IjSKTZKcDQmn6QErOdDmsN9/z6+ixLt+rdsz
|
||||
lKwMX8axgmwgRsWI1Xhlb1qs4TZxheQQ4A4WYYNB1NhH0ZTIehI+FGe+wHh36UXf
|
||||
cY/Z7KRLdozoLsuuAIAoXx/dr3KpwuyKHfp9MdZLzO/tvS9vA1i+tKRXmiDs2uuv
|
||||
itCOTrt1H7LEpUfdBYD9ll2mdiRnVzR4DxNnGLPkxsyAglejTxR897DcYFC9xhie
|
||||
X6UfKTOIeAGXVUqphp8HB0CEFBW982246kDSKdOI/R3+X4T5fvMpLTb5XvkOlCIi
|
||||
JUwXxoq3SA06a8WCS6QH8jLnXrcCKzX1TJh0RzT7/RUvKDN6uxxccxOksMExvgBG
|
||||
nqfOcLiCXBzluCseDgmjcW0/arm1d88Kd7ayMv25CX1Py5uRRQOkqqnCdNIk5Yy5
|
||||
0R+KyOPeZPThVTE1DhJ3QyF499XMoFjerHyanwIlvkAQtet1k8EKih1KSD9N38ga
|
||||
K1HRowhoPMkszsU6+LZYL3MD0aUkfz53b7JvzIxYsfJgztwg3ki0qteEXUNyLMTS
|
||||
XgG9xHF63wa7IwBtKgQKX/CVCwpg5EuNfwbACbIQAC9QZ/F6z+Ud2UJkSs94UUF4
|
||||
aOGb2P1QFvLbP7m+7TNmvuLT5BDcS2XE0IWRDilkeiFU6ijGW8+iQ5oTzv+TmA0=
|
||||
=JbRX
|
||||
-----END PGP MESSAGE-----
|
||||
fp: F63832C3080D6E1AC77EECF80B4245FFE305BC82
|
||||
- created_at: "2024-03-02T20:52:17Z"
|
||||
enc: |-
|
||||
-----BEGIN PGP MESSAGE-----
|
||||
|
||||
hQIMA29thaGx06tOARAAm8GMWZxxY1UBYK7p60Hlw2qCOH7KZ5cby8vm9dWz3Tnt
|
||||
+YKW2SsRniwY6KaSVvnUuRBY75BF6jahW6+h9Nvhsrsvq680UIaQtO6l6KmtnxHV
|
||||
S6vEDmvoFZVWG1xOEGYHVQ+GF9elIwuYrzST1OU3vATMstMxrm0WQJ2lOq7YpuGi
|
||||
hNoMK3nMxpmTlT49CYn2sGX3PlNA4qDOVo/fwL5m3lV5mKzJNs7q8IakbPZm6yqR
|
||||
wGjfkHq3ZlKnTUC66sBX8yvSoZ2cM6vrYhxgb1Um8z9BKLpAb7Rr9AXB5IUWxSkz
|
||||
jXyEi9aDySDxv2HkjP3fE4D5wtC1neS8YsYDBcSsqoXt5sKAs1DOvzLbIOkObH3Y
|
||||
uSxozoGJu5CVnBrOpxXdNf1RMnww85uxSAupiLQ2fsC/0AaeGB8dPYIZr/WekWAR
|
||||
RF3igqZX7KVRuomUOt9fwJoHnRr1GWCHqYTB3P7/e52JcmCggBRLcnhC/1MKgMtN
|
||||
RJh8Uuu9aXCBfR148W+s76xIdVwypPWbk8l911TdL1eRKx+d+kxAa1ugIqihvkBQ
|
||||
sGjZltEe0ogAsDpS0Cy/HRH8Yz1Qk2gTh1QZiv865aVVfWu0OTU27TlfCyMQQCkO
|
||||
LtBfOWylV6pJG3aaO2QA+4f4ab8flxdg8DrmBlhudzYY2goHIcfe+CdPygrKB/nS
|
||||
XgEx1HFw47B1YJxY7FiFgEwnI6/AJuf136u1i484nVYXAr5PtnyaXH7kqVozHouT
|
||||
sPkE1v7+EpOIbhEdXQxbSG0AXKomUwu4SJgxSitdTajAQYfHHfTVjdnUqyl8QHw=
|
||||
=wX5X
|
||||
-----END PGP MESSAGE-----
|
||||
fp: 29F5017C95D9E60B1B1E8407072B0E0B8312DFE3
|
||||
unencrypted_suffix: _unencrypted
|
||||
version: 3.8.1
|
||||
Reference in New Issue
Block a user