falcon-nest/literal/crows_nest/configuration.org

Crows Nest Configuration

• Crows Nest Configuration
  • Imports
  • ISO Information
  • Boot Settings
  • Nix Settings
  • Networking and Time Settings
  • System Packages
  • Shell Configuration
  • File System
  • System Information
  • Users
  • Services

Crows Nest Configuration

Configuration for Crows nest, an automation platform featuring Portainer, Ansible, and Gitlab

{ config, pkgs, modulesPath, lib, system, ... }:

{
  imports = [
    <<import-paths>>
  ];

  config = {
    <<boot-settings>>

    <<nix-settings>>

    <<networking-config>>

    <<timey-wimey-stuff>>

    <<services-config>>

    # Some sane packages we need on every system
    environment.systemPackages = with pkgs; [
      vim # for emergencies
      git # for pulling nix flakes
      <<system-packages>>
    ];

    <<shell-configuration>>

    <<file-system>>

    <<system-information>>

    <<user-config>>
  };
}

Imports

(modulesPath + "/profiles/qemu-guest.nix")
(modulesPath + "/profiles/minimal.nix")
# If for some reason "minimal" fails...
#(modulesPath + "/profiles/base.nix")
../virtualization/podman-utils.nix
../virtualization/nebula-sync-oci.nix

ISO Information

# Let's get it booted in here
(modulesPath + "/installer/cd-dvd/iso-image.nix")
(modulesPath + "/installer/cd-dvd/installation-cd-minimal.nix")

# Provide an initial copy of the NixOS channel so that the user
# doesn't need to run "nix-channel --update" first.
(modulesPath + "/installer/cd-dvd/channel.nix")
# EFI + USB bootable
isoImage.makeEfiBootable = true;
isoImage.makeUsbBootable = true;

Boot Settings

boot.kernelPackages = pkgs.linuxPackages_latest;

# Use the boot drive for grub
boot.loader.grub.enable = lib.mkDefault true;
boot.loader.grub.devices = [ "nodev" ];

boot.growPartition = lib.mkDefault true;

# Workaround for busted ZFS kernels
boot.supportedFilesystems = {
  zfs = lib.mkForce false;
};

Nix Settings

# Allow remote updates with flakes and non-root users
nix.settings.trusted-users = [ "root" "@wheel" ];
nix.settings.experimental-features = [ "nix-command" "flakes" ];

Networking and Time Settings

# Provide a default hostname
networking.hostName = lib.mkDefault "crowsnest";

# Activate firewall
networking.firewall.enable = true;

# Open firewall ports for Portainer
networking.firewall.allowedTCPPorts = [80 443 2112 8000];

# Time Zone
time.timeZone = "America/Chicago";

System Packages

zsh
bat
eza
podman-tui

Shell Configuration

environment.shells = with pkgs; [ zsh ];
users.defaultUserShell = pkgs.zsh;

programs.zsh = {
  shellAliases = {
    #.. = "cd ..";
    h = "cd ~";
    ls = "eza --icons -l -T -L=1";
    cat = "bat";
  };
  enable = lib.mkDefault true;
  autosuggestions.enable = lib.mkDefault true;
};

#oh-my-zsh
programs.zsh.ohMyZsh = {
  enable = lib.mkDefault true;
  theme = lib.mkDefault "jtriley";
};

File System

# Default filesystem
fileSystems."/" = lib.mkDefault {
  device = "/dev/disk/by-label/nixos";
  autoResize = true;
  fsType = "ext4";
};

fileSystems."/mnt/gitlab" = {
  device = "//10.0.0.49/Gitlab";
  fsType = "cifs";
  # options = [ "username=eddie" "password=yoursambapassword" "x-systemd.automount" "noauto" ];
  options = [ "x-systemd.automount" "noauto" ];
}

System Information

nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
system.stateVersion = lib.mkDefault "25.05";

# Let the VM take care of its own upgrades.
system.autoUpgrade.enable = true;

# Clean Nix up after upgrades.
programs.nh = {
  enable = true;
  clean.enable = true;
  clean.extraArgs = "--keep 5";
};

Users

# Add an admin user
users.users.shawnb = lib.mkDefault {
  isNormalUser = true;
  hashedPassword = "";
  description = "Shawn Borton";
  extraGroups = [ "networkmanager" "wheel" ];
  openssh.authorizedKeys.keys = [
    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILgyiCfvu21kVTfRyKjzpH+93k7Jsf+EqLfN6NtolHnf tech@shilohsvillage.com"
  ];
};

Services

# Enable QEMU Guest for Proxmox
services.qemuGuest.enable = lib.mkDefault true;

#OpenSSH
security.sudo.wheelNeedsPassword = false; # Don't ask for passwords
services.openssh = {
  enable = true;
  settings.PasswordAuthentication = false;
  settings.KbdInteractiveAuthentication = false;
  ports = [ 2112 ];
};
programs.ssh.startAgent = true;

#SOPS
sops.defaultSopsFile = ../secrets/secrets.yaml;
sops.defaultSopsFormat = "yaml";
sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
 # sops.secrets."nebula-sync-primary" = {
   # owner = "nebula";
 # };
 # sops.secrets."nebula-sync-replicas" = {
   # owner = "nebula";
 # };
#sops.age.keyFile = "/home/shawnb/Development/falcon_nest/sops/age/keys.txt";
#sops.secrets."nebula-sync" = {
#  owner = config.users.users.nebula.name;
#};