Initial commit
This commit is contained in:
commit
a4db9c8516
36 changed files with 15659 additions and 0 deletions
323
literal/crows_nest/configuration.org
Normal file
323
literal/crows_nest/configuration.org
Normal file
|
|
@ -0,0 +1,323 @@
|
|||
#+TITLE: Crows Nest Configuration
|
||||
* Crows Nest Configuration
|
||||
Configuration for Crows nest, an automation platform featuring Portainer, Ansible, and Gitlab
|
||||
|
||||
#+begin_src nix :noweb yes :tangle /home/shawnb/Development/falcon_nest/crows_nest/configuration.nix
|
||||
{ config, pkgs, modulesPath, lib, system, ... }:
|
||||
|
||||
{
|
||||
imports = [
|
||||
<<import-paths>>
|
||||
];
|
||||
|
||||
config = {
|
||||
<<boot-settings>>
|
||||
|
||||
<<nix-settings>>
|
||||
|
||||
<<networking-config>>
|
||||
|
||||
<<timey-wimey-stuff>>
|
||||
|
||||
<<services-config>>
|
||||
|
||||
# Some sane packages we need on every system
|
||||
environment.systemPackages = with pkgs; [
|
||||
vim # for emergencies
|
||||
git # for pulling nix flakes
|
||||
<<system-packages>>
|
||||
];
|
||||
|
||||
<<shell-configuration>>
|
||||
|
||||
<<file-system>>
|
||||
|
||||
<<system-information>>
|
||||
|
||||
<<user-config>>
|
||||
};
|
||||
}
|
||||
#+end_src
|
||||
** Imports
|
||||
#+NAME: imports
|
||||
#+begin_src nix :noweb-ref import-paths
|
||||
(modulesPath + "/profiles/qemu-guest.nix")
|
||||
(modulesPath + "/profiles/minimal.nix")
|
||||
# If for some reason "minimal" fails...
|
||||
#(modulesPath + "/profiles/base.nix")
|
||||
../virtualization/podman-utils.nix
|
||||
../virtualization/nebula-sync-oci.nix
|
||||
#+end_src
|
||||
** ISO Information
|
||||
#+NAME: iso-config
|
||||
#+begin_src nix
|
||||
# Let's get it booted in here
|
||||
(modulesPath + "/installer/cd-dvd/iso-image.nix")
|
||||
(modulesPath + "/installer/cd-dvd/installation-cd-minimal.nix")
|
||||
|
||||
# Provide an initial copy of the NixOS channel so that the user
|
||||
# doesn't need to run "nix-channel --update" first.
|
||||
(modulesPath + "/installer/cd-dvd/channel.nix")
|
||||
# EFI + USB bootable
|
||||
isoImage.makeEfiBootable = true;
|
||||
isoImage.makeUsbBootable = true;
|
||||
#+end_src
|
||||
** Boot Settings
|
||||
#+NAME: boot-settings
|
||||
#+begin_src nix :noweb-ref boot-settings
|
||||
boot.kernelPackages = pkgs.linuxPackages_latest;
|
||||
|
||||
# Use the boot drive for grub
|
||||
boot.loader.grub.enable = lib.mkDefault true;
|
||||
boot.loader.grub.devices = [ "nodev" ];
|
||||
|
||||
boot.growPartition = lib.mkDefault true;
|
||||
|
||||
# Workaround for busted ZFS kernels
|
||||
boot.supportedFilesystems = {
|
||||
zfs = lib.mkForce false;
|
||||
};
|
||||
#+end_src
|
||||
** Nix Settings
|
||||
#+NAME: nix-settings
|
||||
#+begin_src nix :noweb-ref nix-settings
|
||||
# Allow remote updates with flakes and non-root users
|
||||
nix.settings.trusted-users = [ "root" "@wheel" ];
|
||||
nix.settings.experimental-features = [ "nix-command" "flakes" ];
|
||||
#+end_src
|
||||
** Networking and Time Settings
|
||||
#+NAME: networking-config
|
||||
#+begin_src nix :var ports=network-ports :noweb-ref networking-config
|
||||
# Provide a default hostname
|
||||
networking.hostName = lib.mkDefault "crowsnest";
|
||||
|
||||
# Activate firewall
|
||||
networking.firewall.enable = true;
|
||||
|
||||
# Open firewall ports for Portainer
|
||||
networking.firewall.allowedTCPPorts = [80 443 2112 8000];
|
||||
#+end_src
|
||||
|
||||
#+NAME: timey-wimey-stuff
|
||||
#+begin_src nix :noweb-ref timey-wimey-stuff
|
||||
# Time Zone
|
||||
time.timeZone = "America/Chicago";
|
||||
#+end_src
|
||||
** System Packages
|
||||
#+NAME: system-packages
|
||||
#+begin_src nix :noweb-ref system-packages
|
||||
zsh
|
||||
bat
|
||||
eza
|
||||
podman-tui
|
||||
#+end_src
|
||||
** Shell Configuration
|
||||
#+NAME: shell-configuration
|
||||
#+begin_src nix :noweb-ref shell-configuration
|
||||
environment.shells = with pkgs; [ zsh ];
|
||||
users.defaultUserShell = pkgs.zsh;
|
||||
|
||||
programs.zsh = {
|
||||
shellAliases = {
|
||||
#.. = "cd ..";
|
||||
h = "cd ~";
|
||||
ls = "eza --icons -l -T -L=1";
|
||||
cat = "bat";
|
||||
};
|
||||
enable = lib.mkDefault true;
|
||||
autosuggestions.enable = lib.mkDefault true;
|
||||
};
|
||||
|
||||
#oh-my-zsh
|
||||
programs.zsh.ohMyZsh = {
|
||||
enable = lib.mkDefault true;
|
||||
theme = lib.mkDefault "jtriley";
|
||||
};
|
||||
#+end_src
|
||||
** File System
|
||||
#+NAME: file-system
|
||||
#+begin_src nix :noweb-ref file-system
|
||||
# Default filesystem
|
||||
fileSystems."/" = lib.mkDefault {
|
||||
device = "/dev/disk/by-label/nixos";
|
||||
autoResize = true;
|
||||
fsType = "ext4";
|
||||
};
|
||||
|
||||
fileSystems."/mnt/gitlab" = {
|
||||
device = "//10.0.0.49/Gitlab";
|
||||
fsType = "cifs";
|
||||
# options = [ "username=eddie" "password=yoursambapassword" "x-systemd.automount" "noauto" ];
|
||||
options = [ "x-systemd.automount" "noauto" ];
|
||||
}
|
||||
#+end_src
|
||||
** System Information
|
||||
#+NAME: system-information
|
||||
#+begin_src nix :noweb-ref system-information
|
||||
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
|
||||
system.stateVersion = lib.mkDefault "25.05";
|
||||
|
||||
# Let the VM take care of its own upgrades.
|
||||
system.autoUpgrade.enable = true;
|
||||
|
||||
# Clean Nix up after upgrades.
|
||||
programs.nh = {
|
||||
enable = true;
|
||||
clean.enable = true;
|
||||
clean.extraArgs = "--keep 5";
|
||||
};
|
||||
#+end_src
|
||||
** Users
|
||||
#+NAME: user-config
|
||||
#+begin_src nix :noweb-ref user-config
|
||||
# Add an admin user
|
||||
users.users.shawnb = lib.mkDefault {
|
||||
isNormalUser = true;
|
||||
hashedPassword = "";
|
||||
description = "Shawn Borton";
|
||||
extraGroups = [ "networkmanager" "wheel" ];
|
||||
openssh.authorizedKeys.keys = [
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILgyiCfvu21kVTfRyKjzpH+93k7Jsf+EqLfN6NtolHnf tech@shilohsvillage.com"
|
||||
];
|
||||
};
|
||||
#+end_src
|
||||
** Services
|
||||
#+NAME: services-config
|
||||
#+begin_src nix :noweb-ref services-config
|
||||
# Enable QEMU Guest for Proxmox
|
||||
services.qemuGuest.enable = lib.mkDefault true;
|
||||
|
||||
#OpenSSH
|
||||
security.sudo.wheelNeedsPassword = false; # Don't ask for passwords
|
||||
services.openssh = {
|
||||
enable = true;
|
||||
settings.PasswordAuthentication = false;
|
||||
settings.KbdInteractiveAuthentication = false;
|
||||
ports = [ 2112 ];
|
||||
};
|
||||
programs.ssh.startAgent = true;
|
||||
|
||||
#SOPS
|
||||
sops.defaultSopsFile = ../secrets/secrets.yaml;
|
||||
sops.defaultSopsFormat = "yaml";
|
||||
sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
|
||||
# sops.secrets."nebula-sync-primary" = {
|
||||
# owner = "nebula";
|
||||
# };
|
||||
# sops.secrets."nebula-sync-replicas" = {
|
||||
# owner = "nebula";
|
||||
# };
|
||||
#sops.age.keyFile = "/home/shawnb/Development/falcon_nest/sops/age/keys.txt";
|
||||
#sops.secrets."nebula-sync" = {
|
||||
# owner = config.users.users.nebula.name;
|
||||
#};
|
||||
#+end_src
|
||||
** OLD CONFIG :noexport:
|
||||
#+NAME: old_config
|
||||
#+begin_src nix
|
||||
{ config, pkgs, modulesPath, lib, system, ... }:
|
||||
|
||||
{
|
||||
#imports = [
|
||||
# (modulesPath + "/profiles/qemu-guest.nix")
|
||||
# (modulesPath + "/profiles/minimal.nix")
|
||||
# ../virtualization/podman-utils.nix
|
||||
# ../virtualization/portainer.nix
|
||||
#];
|
||||
|
||||
config = {
|
||||
#Provide a default hostname
|
||||
#networking.hostName = lib.mkDefault "crowsnest";
|
||||
|
||||
# Activate firewall
|
||||
#networking.firewall.enable = true;
|
||||
|
||||
# Open firewall ports for Portainer
|
||||
#networking.firewall.allowedTCPPorts = [ 2112 8000 9443 9000 ];
|
||||
|
||||
# Time Zone
|
||||
#time.timeZone = "America/Chicago";
|
||||
|
||||
# Enable QEMU Guest for Proxmox
|
||||
# services.qemuGuest.enable = lib.mkDefault true;
|
||||
|
||||
# Use the boot drive for grub
|
||||
# boot.loader.grub.enable = lib.mkDefault true;
|
||||
# boot.loader.grub.devices = [ "nodev" ];
|
||||
|
||||
# boot.growPartition = lib.mkDefault true;
|
||||
|
||||
# Allow remote updates with flakes and non-root users
|
||||
# nix.settings.trusted-users = [ "root" "@wheel" ];
|
||||
# nix.settings.experimental-features = [ "nix-command" "flakes" ];
|
||||
|
||||
# Some sane packages we need on every system
|
||||
# environment.systemPackages = with pkgs; [
|
||||
# vim # for emergencies
|
||||
# git # for pulling nix flakes
|
||||
# zsh
|
||||
# bat
|
||||
# eza
|
||||
# ];
|
||||
|
||||
# environment.shells = with pkgs; [ zsh ];
|
||||
# users.defaultUserShell = pkgs.zsh;
|
||||
# programs.zsh = {
|
||||
# shellAliases = {
|
||||
# #.. = "cd ..";
|
||||
# h = "cd ~";
|
||||
# ls = "eza --icons -l -T -L=1";
|
||||
# cat = "bat";
|
||||
# };
|
||||
# enable = lib.mkDefault true;
|
||||
# autosuggestions.enable = lib.mkDefault true;
|
||||
# };
|
||||
|
||||
# #oh-my-zsh
|
||||
# programs.zsh.ohMyZsh = {
|
||||
# enable = lib.mkDefault true;
|
||||
# theme = lib.mkDefault "jtriley";
|
||||
# };
|
||||
|
||||
# Default filesystem
|
||||
# fileSystems."/" = lib.mkDefault {
|
||||
# device = "/dev/disk/by-label/nixos";
|
||||
# autoResize = true;
|
||||
# fsType = "ext4";
|
||||
# };
|
||||
|
||||
# system.stateVersion = lib.mkDefault "25.05";
|
||||
|
||||
# # Let the VM take care of its own upgrades.
|
||||
# system.autoUpgrade.enable = true;
|
||||
|
||||
# # Clean Nix up after upgrades.
|
||||
# programs.nh = {
|
||||
# enable = true;
|
||||
# clean.enable = true;
|
||||
# clean.extraArgs = "--keep 5";
|
||||
# };
|
||||
|
||||
#security.sudo.wheelNeedsPassword = false; # Don't ask for passwords
|
||||
#services.openssh = {
|
||||
# enable = true;
|
||||
# settings.PasswordAuthentication = false;
|
||||
# settings.KbdInteractiveAuthentication = false;
|
||||
# ports = [ 2112 ];
|
||||
#};
|
||||
#programs.ssh.startAgent = true;
|
||||
|
||||
# Add an admin user
|
||||
#users.users.shawnb = lib.mkDefault {
|
||||
# isNormalUser = true;
|
||||
# hashedPassword = "";
|
||||
# description = "Shawn Borton";
|
||||
# extraGroups = [ "networkmanager" "wheel" ];
|
||||
# openssh.authorizedKeys.keys = [
|
||||
# "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILgyiCfvu21kVTfRyKjzpH+93k7Jsf+EqLfN6NtolHnf tech@shilohsvillage.com"
|
||||
# ];
|
||||
#};
|
||||
};
|
||||
}
|
||||
|
||||
#+end_src
|
||||
Loading…
Add table
Add a link
Reference in a new issue