323 lines
8.2 KiB
Org Mode
323 lines
8.2 KiB
Org Mode
#+TITLE: Crows Nest Configuration
|
|
* Crows Nest Configuration
|
|
Configuration for Crows nest, an automation platform featuring Portainer, Ansible, and Gitlab
|
|
|
|
#+begin_src nix :noweb yes :tangle /home/shawnb/Development/falcon_nest/crows_nest/configuration.nix
|
|
{ config, pkgs, modulesPath, lib, system, ... }:
|
|
|
|
{
|
|
imports = [
|
|
<<import-paths>>
|
|
];
|
|
|
|
config = {
|
|
<<boot-settings>>
|
|
|
|
<<nix-settings>>
|
|
|
|
<<networking-config>>
|
|
|
|
<<timey-wimey-stuff>>
|
|
|
|
<<services-config>>
|
|
|
|
# Some sane packages we need on every system
|
|
environment.systemPackages = with pkgs; [
|
|
vim # for emergencies
|
|
git # for pulling nix flakes
|
|
<<system-packages>>
|
|
];
|
|
|
|
<<shell-configuration>>
|
|
|
|
<<file-system>>
|
|
|
|
<<system-information>>
|
|
|
|
<<user-config>>
|
|
};
|
|
}
|
|
#+end_src
|
|
** Imports
|
|
#+NAME: imports
|
|
#+begin_src nix :noweb-ref import-paths
|
|
(modulesPath + "/profiles/qemu-guest.nix")
|
|
(modulesPath + "/profiles/minimal.nix")
|
|
# If for some reason "minimal" fails...
|
|
#(modulesPath + "/profiles/base.nix")
|
|
../virtualization/podman-utils.nix
|
|
../virtualization/nebula-sync-oci.nix
|
|
#+end_src
|
|
** ISO Information
|
|
#+NAME: iso-config
|
|
#+begin_src nix
|
|
# Let's get it booted in here
|
|
(modulesPath + "/installer/cd-dvd/iso-image.nix")
|
|
(modulesPath + "/installer/cd-dvd/installation-cd-minimal.nix")
|
|
|
|
# Provide an initial copy of the NixOS channel so that the user
|
|
# doesn't need to run "nix-channel --update" first.
|
|
(modulesPath + "/installer/cd-dvd/channel.nix")
|
|
# EFI + USB bootable
|
|
isoImage.makeEfiBootable = true;
|
|
isoImage.makeUsbBootable = true;
|
|
#+end_src
|
|
** Boot Settings
|
|
#+NAME: boot-settings
|
|
#+begin_src nix :noweb-ref boot-settings
|
|
boot.kernelPackages = pkgs.linuxPackages_latest;
|
|
|
|
# Use the boot drive for grub
|
|
boot.loader.grub.enable = lib.mkDefault true;
|
|
boot.loader.grub.devices = [ "nodev" ];
|
|
|
|
boot.growPartition = lib.mkDefault true;
|
|
|
|
# Workaround for busted ZFS kernels
|
|
boot.supportedFilesystems = {
|
|
zfs = lib.mkForce false;
|
|
};
|
|
#+end_src
|
|
** Nix Settings
|
|
#+NAME: nix-settings
|
|
#+begin_src nix :noweb-ref nix-settings
|
|
# Allow remote updates with flakes and non-root users
|
|
nix.settings.trusted-users = [ "root" "@wheel" ];
|
|
nix.settings.experimental-features = [ "nix-command" "flakes" ];
|
|
#+end_src
|
|
** Networking and Time Settings
|
|
#+NAME: networking-config
|
|
#+begin_src nix :var ports=network-ports :noweb-ref networking-config
|
|
# Provide a default hostname
|
|
networking.hostName = lib.mkDefault "crowsnest";
|
|
|
|
# Activate firewall
|
|
networking.firewall.enable = true;
|
|
|
|
# Open firewall ports for Portainer
|
|
networking.firewall.allowedTCPPorts = [80 443 2112 8000];
|
|
#+end_src
|
|
|
|
#+NAME: timey-wimey-stuff
|
|
#+begin_src nix :noweb-ref timey-wimey-stuff
|
|
# Time Zone
|
|
time.timeZone = "America/Chicago";
|
|
#+end_src
|
|
** System Packages
|
|
#+NAME: system-packages
|
|
#+begin_src nix :noweb-ref system-packages
|
|
zsh
|
|
bat
|
|
eza
|
|
podman-tui
|
|
#+end_src
|
|
** Shell Configuration
|
|
#+NAME: shell-configuration
|
|
#+begin_src nix :noweb-ref shell-configuration
|
|
environment.shells = with pkgs; [ zsh ];
|
|
users.defaultUserShell = pkgs.zsh;
|
|
|
|
programs.zsh = {
|
|
shellAliases = {
|
|
#.. = "cd ..";
|
|
h = "cd ~";
|
|
ls = "eza --icons -l -T -L=1";
|
|
cat = "bat";
|
|
};
|
|
enable = lib.mkDefault true;
|
|
autosuggestions.enable = lib.mkDefault true;
|
|
};
|
|
|
|
#oh-my-zsh
|
|
programs.zsh.ohMyZsh = {
|
|
enable = lib.mkDefault true;
|
|
theme = lib.mkDefault "jtriley";
|
|
};
|
|
#+end_src
|
|
** File System
|
|
#+NAME: file-system
|
|
#+begin_src nix :noweb-ref file-system
|
|
# Default filesystem
|
|
fileSystems."/" = lib.mkDefault {
|
|
device = "/dev/disk/by-label/nixos";
|
|
autoResize = true;
|
|
fsType = "ext4";
|
|
};
|
|
|
|
fileSystems."/mnt/gitlab" = {
|
|
device = "//10.0.0.49/Gitlab";
|
|
fsType = "cifs";
|
|
# options = [ "username=eddie" "password=yoursambapassword" "x-systemd.automount" "noauto" ];
|
|
options = [ "x-systemd.automount" "noauto" ];
|
|
}
|
|
#+end_src
|
|
** System Information
|
|
#+NAME: system-information
|
|
#+begin_src nix :noweb-ref system-information
|
|
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
|
|
system.stateVersion = lib.mkDefault "25.05";
|
|
|
|
# Let the VM take care of its own upgrades.
|
|
system.autoUpgrade.enable = true;
|
|
|
|
# Clean Nix up after upgrades.
|
|
programs.nh = {
|
|
enable = true;
|
|
clean.enable = true;
|
|
clean.extraArgs = "--keep 5";
|
|
};
|
|
#+end_src
|
|
** Users
|
|
#+NAME: user-config
|
|
#+begin_src nix :noweb-ref user-config
|
|
# Add an admin user
|
|
users.users.shawnb = lib.mkDefault {
|
|
isNormalUser = true;
|
|
hashedPassword = "";
|
|
description = "Shawn Borton";
|
|
extraGroups = [ "networkmanager" "wheel" ];
|
|
openssh.authorizedKeys.keys = [
|
|
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILgyiCfvu21kVTfRyKjzpH+93k7Jsf+EqLfN6NtolHnf tech@shilohsvillage.com"
|
|
];
|
|
};
|
|
#+end_src
|
|
** Services
|
|
#+NAME: services-config
|
|
#+begin_src nix :noweb-ref services-config
|
|
# Enable QEMU Guest for Proxmox
|
|
services.qemuGuest.enable = lib.mkDefault true;
|
|
|
|
#OpenSSH
|
|
security.sudo.wheelNeedsPassword = false; # Don't ask for passwords
|
|
services.openssh = {
|
|
enable = true;
|
|
settings.PasswordAuthentication = false;
|
|
settings.KbdInteractiveAuthentication = false;
|
|
ports = [ 2112 ];
|
|
};
|
|
programs.ssh.startAgent = true;
|
|
|
|
#SOPS
|
|
sops.defaultSopsFile = ../secrets/secrets.yaml;
|
|
sops.defaultSopsFormat = "yaml";
|
|
sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
|
|
# sops.secrets."nebula-sync-primary" = {
|
|
# owner = "nebula";
|
|
# };
|
|
# sops.secrets."nebula-sync-replicas" = {
|
|
# owner = "nebula";
|
|
# };
|
|
#sops.age.keyFile = "/home/shawnb/Development/falcon_nest/sops/age/keys.txt";
|
|
#sops.secrets."nebula-sync" = {
|
|
# owner = config.users.users.nebula.name;
|
|
#};
|
|
#+end_src
|
|
** OLD CONFIG :noexport:
|
|
#+NAME: old_config
|
|
#+begin_src nix
|
|
{ config, pkgs, modulesPath, lib, system, ... }:
|
|
|
|
{
|
|
#imports = [
|
|
# (modulesPath + "/profiles/qemu-guest.nix")
|
|
# (modulesPath + "/profiles/minimal.nix")
|
|
# ../virtualization/podman-utils.nix
|
|
# ../virtualization/portainer.nix
|
|
#];
|
|
|
|
config = {
|
|
#Provide a default hostname
|
|
#networking.hostName = lib.mkDefault "crowsnest";
|
|
|
|
# Activate firewall
|
|
#networking.firewall.enable = true;
|
|
|
|
# Open firewall ports for Portainer
|
|
#networking.firewall.allowedTCPPorts = [ 2112 8000 9443 9000 ];
|
|
|
|
# Time Zone
|
|
#time.timeZone = "America/Chicago";
|
|
|
|
# Enable QEMU Guest for Proxmox
|
|
# services.qemuGuest.enable = lib.mkDefault true;
|
|
|
|
# Use the boot drive for grub
|
|
# boot.loader.grub.enable = lib.mkDefault true;
|
|
# boot.loader.grub.devices = [ "nodev" ];
|
|
|
|
# boot.growPartition = lib.mkDefault true;
|
|
|
|
# Allow remote updates with flakes and non-root users
|
|
# nix.settings.trusted-users = [ "root" "@wheel" ];
|
|
# nix.settings.experimental-features = [ "nix-command" "flakes" ];
|
|
|
|
# Some sane packages we need on every system
|
|
# environment.systemPackages = with pkgs; [
|
|
# vim # for emergencies
|
|
# git # for pulling nix flakes
|
|
# zsh
|
|
# bat
|
|
# eza
|
|
# ];
|
|
|
|
# environment.shells = with pkgs; [ zsh ];
|
|
# users.defaultUserShell = pkgs.zsh;
|
|
# programs.zsh = {
|
|
# shellAliases = {
|
|
# #.. = "cd ..";
|
|
# h = "cd ~";
|
|
# ls = "eza --icons -l -T -L=1";
|
|
# cat = "bat";
|
|
# };
|
|
# enable = lib.mkDefault true;
|
|
# autosuggestions.enable = lib.mkDefault true;
|
|
# };
|
|
|
|
# #oh-my-zsh
|
|
# programs.zsh.ohMyZsh = {
|
|
# enable = lib.mkDefault true;
|
|
# theme = lib.mkDefault "jtriley";
|
|
# };
|
|
|
|
# Default filesystem
|
|
# fileSystems."/" = lib.mkDefault {
|
|
# device = "/dev/disk/by-label/nixos";
|
|
# autoResize = true;
|
|
# fsType = "ext4";
|
|
# };
|
|
|
|
# system.stateVersion = lib.mkDefault "25.05";
|
|
|
|
# # Let the VM take care of its own upgrades.
|
|
# system.autoUpgrade.enable = true;
|
|
|
|
# # Clean Nix up after upgrades.
|
|
# programs.nh = {
|
|
# enable = true;
|
|
# clean.enable = true;
|
|
# clean.extraArgs = "--keep 5";
|
|
# };
|
|
|
|
#security.sudo.wheelNeedsPassword = false; # Don't ask for passwords
|
|
#services.openssh = {
|
|
# enable = true;
|
|
# settings.PasswordAuthentication = false;
|
|
# settings.KbdInteractiveAuthentication = false;
|
|
# ports = [ 2112 ];
|
|
#};
|
|
#programs.ssh.startAgent = true;
|
|
|
|
# Add an admin user
|
|
#users.users.shawnb = lib.mkDefault {
|
|
# isNormalUser = true;
|
|
# hashedPassword = "";
|
|
# description = "Shawn Borton";
|
|
# extraGroups = [ "networkmanager" "wheel" ];
|
|
# openssh.authorizedKeys.keys = [
|
|
# "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILgyiCfvu21kVTfRyKjzpH+93k7Jsf+EqLfN6NtolHnf tech@shilohsvillage.com"
|
|
# ];
|
|
#};
|
|
};
|
|
}
|
|
|
|
#+end_src
|