From bf5f9f799e3013cf0ee0855fd6c56e701a054341 Mon Sep 17 00:00:00 2001 From: bogale Date: Tue, 6 Oct 2026 14:53:26 +0900 Subject: [PATCH] code organization --- common.nix | 174 +++++++-------------------------------- flake.nix | 10 ++- home/common.nix | 13 ++- ls | 0 marks | 6 +- mods/pxeboot.nix | 116 ++++++++++++++++++++++++++ server/configuration.nix | 31 ++++--- server/mods/web.nix | 92 +++++++++++---------- 8 files changed, 230 insertions(+), 212 deletions(-) delete mode 100644 ls create mode 100644 mods/pxeboot.nix diff --git a/common.nix b/common.nix index 6d6e21e..d82e778 100644 --- a/common.nix +++ b/common.nix @@ -1,18 +1,40 @@ { config, lib, pkgs, ... }: { - nix.settings.experimental-features = [ "nix-command" "flakes" ]; - system.stateVersion = "26.05"; time.timeZone = "Asia/Chita"; + system.stateVersion = "26.05"; + imports = [ ./mods/pxeboot.nix ]; i18n.defaultLocale = "ru_RU.UTF-8"; - console = { - keyMap = "ruwin_alt_sh-UTF-8"; - font = "cyr-sun16"; - }; - fileSystems = { - "/" = { options = [ "noatime" ]; }; - "/boot" = { options = [ "noatime" ]; }; - }; swapDevices = [ { device = "/var/swapfile"; } ]; + users.users.root.hashedPasswordFile = "/secrets/user/root-pw"; + nix.settings.experimental-features = [ "nix-command" "flakes" ]; + console = { + font = "cyr-sun16"; + keyMap = "ruwin_alt_sh-UTF-8"; + }; + environment.systemPackages = with pkgs; [ + jq _7zz sbctl + openssl grub2_efi + ]; + fileSystems = let + noatime = { options = [ "noatime" ]; }; + in { + "/" = noatime; + "/boot" = noatime; + }; + services = { + logind.settings.Login.HandleLidSwitch = "ignore"; + openssh = { + enable = true; + settings.PasswordAuthentication = false; + }; + }; + systemd.tmpfiles.rules = [ + "d /root/backup 0700 root root -" + "d /root/backup/base 0700 root root -" + "L /root/backup/base/nixos - - - - /etc/nixos" + "L /root/backup/base/secrets - - - - /secrets" + "L /root/backup/base/sbctl - - - - /var/lib/sbctl" + ]; boot = { kernelModules = [ "amneziawg" ]; kernelPackages = pkgs.linuxPackages_latest; @@ -23,7 +45,6 @@ panicOnChecksumMismatch = true; }; }; - users.users.root.hashedPasswordFile = "/secrets/user/root-pw"; networking = { firewall = { allowedTCPPorts = [ 53 80 2049 ]; @@ -79,135 +100,4 @@ }; }; }; - environment.systemPackages = with pkgs; [ - jq - _7zz - sbctl - openssl - grub2_efi - ]; - services = { - logind.settings.Login.HandleLidSwitch = "ignore"; - openssh = { - enable = true; - settings.PasswordAuthentication = false; - }; - nginx = { - enable = true; - recommendedTlsSettings = true; - recommendedGzipSettings = true; - recommendedOptimisation = true; - recommendedProxySettings = true; - recommendedBrotliSettings = true; - }; - nfs.server = { - enable = true; - exports = let - clients."10.2.0.0/16" = [ "mp" "rw" "no_root_squash" ]; - in { - "/srv/nfs/arch/root" = clients; - "/srv/nfs/fedora/root" = clients; - }; - }; - dnsmasq = { - enable = true; - settings = { - enable-ra = true; - no-resolv = true; - cache-size = 4096; - bogus-priv = true; - enable-tftp = true; - interface = "enp1s0"; - domain-needed = true; - tftp-root = "/srv/tftp"; - dhcp-boot = "grubx64.efi"; - dhcp-range = [ "10.2.0.2,10.2.255.254,12h" - "fc02::2,fc02::ffff:ffff:ffff:ffff,12h" ]; - server = [ "1.1.1.2" "2606:4700:4700::1112" - "1.0.0.2" "2606:4700:4700::1002" ]; - }; - }; - }; - virtualisation.oci-containers.containers.fedora-dracut = { - pull = "newer"; - autoStart = false; - entrypoint = "bash"; - image = "docker.io/fedora:latest"; - cmd = [ "/data/workdir/entry.sh" ]; - volumes = [ - "/var/lib/podman-dracut:/data/workdir" - "/srv/nfs/arch/lower:/data/arch:ro" - "/srv/nfs/fedora/lower:/data/fedora:ro" - ]; - }; - systemd = { - tmpfiles.rules = [ "d /var/lib/podman-dracut 0755 root root -" ]; - services.pxeboot = { - serviceConfig.Type = "oneshot"; - wantedBy = [ "multi-user.target" ]; - path = with pkgs; [ xz e2fsprogs grub2_efi util-linux ]; - script = let - resolv = pkgs.writeText "resolv.conf" '' - nameserver fc02::1 - nameserver 10.2.0.1 - options edns0 trust-ad - ''; - grubCfg = pkgs.writeText "grub.cfg" '' - set timeout=10 - set path=(http,$net_default_server)/local/boot/pxe - set nfs="rw ifname=ens0:$net_default_mac ip=$net_default_ip::$net_default_server:255.255.0.0::ens0:none root=nfs4:$net_default_server:/srv/nfs" - . $path/grub.cfg - ''; - entryScript = pkgs.writeText "entry.sh" '' - set -e - dnf install -y dracut-network nfs-utils - cd /data/workdir - for target in $(cd ..; ls | grep -v workdir); do - modsDir=../$target/usr/lib/modules/* - mkdir $target - cp $modsDir/vmlinuz $target - dracut -Nm "network-manager nfs" --zstd -k $modsDir --kver $(basename $modsDir) $target/initramfs - done - ''; - in '' - cd /srv/tftp - if [ ! -e grubx64.efi ]; then - grub-mkstandalone -O x86_64-efi --compress=xz --modules=efinet -o grubx64.efi /boot/grub/grub.cfg=${grubCfg} - fi - for distro in arch:arch/x86_64/airootfs.sfs fedora:LiveOS/squashfs.img; do - rootfs=''${distro##*:} - distro=''${distro%:*} - cd /srv/nfs/$distro - mkdir -p loop lower upper work root - mountpoint -q loop || mount $distro.iso loop - mountpoint -q lower || mount loop/$rootfs lower - mountpoint -q root || mount -t overlay overlay -o lowerdir=lower,upperdir=upper,workdir=work,nfs_export=on root - if [ ! -e upper/etc/resolv.conf ]; then - cd root/etc - rm -f resolv.conf - cp ${resolv} resolv.conf - chattr +i resolv.conf - fi - done - cd /srv/http/local/boot - if [ ! -e pxe ]; then - mkdir pxe - cp ${entryScript} /var/lib/podman-dracut/entry.sh - systemctl --wait start podman-fedora-dracut.service - for distro in arch: fedora:selinux=0; do - cmdline=''${distro##*:} - distro=''${distro%:*} - mv /var/lib/podman-dracut/$distro pxe - echo "menuentry $distro { - linux \$path/$distro/vmlinuz \$nfs/$distro/root $cmdline - initrd \$path/$distro/initramfs - }" >> pxe/grub.cfg - done - chmod -R 640 pxe - chgrp -R php pxe - chmod ug+x $(find pxe -type d) - fi - ''; - }; - }; } diff --git a/flake.nix b/flake.nix index 1668ffc..3664963 100644 --- a/flake.nix +++ b/flake.nix @@ -2,8 +2,8 @@ inputs = { nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable"; home-manager = { - url = "github:nix-community/home-manager"; inputs.nixpkgs.follows = "nixpkgs"; + url = "github:nix-community/home-manager"; }; }; outputs = inputs@{ self, nixpkgs, home-manager, ... }: { @@ -26,9 +26,11 @@ home-manager.useGlobalPkgs = true; home-manager.useUserPackages = true; home-manager.extraSpecialArgs = { inherit inputs; }; - home-manager.users.data = ./home/desktop/data.nix; - home-manager.users.root = ./home/desktop/root.nix; - home-manager.users.bogale = ./home/desktop/bogale.nix; + home-manager.users = { + data = ./home/desktop/data.nix; + root = ./home/desktop/root.nix; + bogale = ./home/desktop/bogale.nix; + }; } ]; }; diff --git a/home/common.nix b/home/common.nix index 2605fb0..f4b2813 100644 --- a/home/common.nix +++ b/home/common.nix @@ -2,16 +2,13 @@ { home.stateVersion = "26.05"; services.ssh-agent.enable = true; - home.packages = with pkgs; [ - ncdu - yt-dlp - ]; + home.packages = with pkgs; [ ncdu yt-dlp ]; programs = { home-manager.enable = true; bash = { enable = true; + shellAliases.la = "ls -lAtr"; historyControl = [ "ignoreboth" ]; - shellAliases = { la = "ls -lAtr"; }; }; ssh = { enable = true; @@ -50,9 +47,6 @@ unbind C-b set -g mouse on set -g prefix M-f - set-option -g focus-events on - set -s set-clipboard external - set-option -a terminal-features "xterm-256color:RGB" bind f send-prefix bind h select-pane -L bind j select-pane -D @@ -60,6 +54,9 @@ bind l select-pane -R bind u split-window -h bind i split-window -v + set -s set-clipboard external + set-option -g focus-events on + set-option -a terminal-features "xterm-256color:RGB" ''; }; }; diff --git a/ls b/ls deleted file mode 100644 index e69de29..0000000 diff --git a/marks b/marks index 9b2efb0..c80fb7f 100644 --- a/marks +++ b/marks @@ -1,15 +1,11 @@ installation: -secure erase / sanitize gdisk cryptsetup mkfs mount -copy private files +copy backup mkswap -s $SIZE -F /mnt/var/swapfile swapon /mnt/var/swapfile sbctl enroll-keys --yes-this-might-brick-my-machine nixos-install --flake "/mnt/etc/nixos#nixos" --no-channel-copy --no-root-passwd systemd-cryptenroll --tpm2-device=auto --tpm2-pcrs=0+2+7 - -todo: -- email tracking diff --git a/mods/pxeboot.nix b/mods/pxeboot.nix new file mode 100644 index 0000000..52c2e62 --- /dev/null +++ b/mods/pxeboot.nix @@ -0,0 +1,116 @@ +{ config, lib, pkgs, ... }: +{ + virtualisation.oci-containers.containers.fedora-dracut = { + pull = "newer"; + autoStart = false; + entrypoint = "bash"; + image = "docker.io/fedora:latest"; + cmd = [ "/data/workdir/entry.sh" ]; + volumes = [ + "/srv/nfs/arch/lower:/data/arch:ro" + "/var/lib/podman-dracut:/data/workdir" + "/srv/nfs/fedora/lower:/data/fedora:ro" + ]; + }; + services = { + nfs.server = { + enable = true; + exports = let + clients."10.2.0.0/16" = [ "mp" "rw" "no_root_squash" ]; + in { + "/srv/nfs/arch/root" = clients; + "/srv/nfs/fedora/root" = clients; + }; + }; + dnsmasq = { + enable = true; + settings = { + enable-ra = true; + no-resolv = true; + cache-size = 4096; + bogus-priv = true; + enable-tftp = true; + interface = "enp1s0"; + domain-needed = true; + tftp-root = "/srv/tftp"; + dhcp-boot = "grubx64.efi"; + server = [ "1.1.1.2" "2606:4700:4700::1112" + "1.0.0.2" "2606:4700:4700::1002" ]; + dhcp-range = [ "10.2.0.2,10.2.255.254,12h" + "fc02::2,fc02::ffff:ffff:ffff:ffff,12h" ]; + }; + }; + }; + systemd = { + tmpfiles.rules = [ "d /var/lib/podman-dracut 0755 root root -" ]; + services.pxeboot = { + serviceConfig.Type = "oneshot"; + #wantedBy = [ "multi-user.target" ]; + path = with pkgs; [ xz e2fsprogs grub2_efi util-linux ]; + script = let + resolv = pkgs.writeText "resolv.conf" '' + nameserver fc02::1 + nameserver 10.2.0.1 + options edns0 trust-ad + ''; + entryScript = pkgs.writeText "entry.sh" '' + set -e + dnf install -y dracut-network nfs-utils + cd /data/workdir + for target in $(cd ..; ls | grep -v workdir); do + modsDir=../$target/usr/lib/modules/* + mkdir $target + cp $modsDir/vmlinuz $target + dracut -Nm "network-manager nfs" --zstd -k $modsDir \ + --kver $(basename $modsDir) $target/initramfs + done + ''; + grubCfg = pkgs.writeText "grub.cfg" '' + set timeout=5 + #set path=(http,$net_default_server)/local/boot/pxe + set nfs="rw ip=dhcp root=nfs4:$net_default_server:/srv/nfs" + function load { + linux $path/$1/vmlinuz $nfs/$1/root $2 + initrd $path/$1/initramfs + } + menuentry Arch { + load arch + } + menuentry Fedora { + load fedora selinux=0 + } + ''; + in '' + for distro in arch:arch/x86_64/airootfs.sfs fedora:LiveOS/squashfs.img; do + rootfs=''${distro##*:} + distro=''${distro%:*} + cd /srv/nfs/$distro + mkdir -p loop work lower upper #root -> move to tmpfiles + mountpoint -q loop || mount $distro.iso loop + mountpoint -q lower || mount loop/$rootfs lower + mountpoint -q root || mount -t overlay overlay -o workdir=work,nfs_export=on,lowerdir=lower,upperdir=upper root + if [ ! -e upper/etc/resolv.conf ]; then + cd root/etc + rm -f resolv.conf + cp ${resolv} resolv.conf + chattr +i resolv.conf + fi + done + cd /srv + #either check of tftp dir, or file in tftp, if it forced to exists through tmpfiles + if [ ! -e grubx64.efi ]; then + grub-mkstandalone -O x86_64-efi --compress=xz -o grubx64.efi #--modules=efinet /boot/grub/grub.cfg=${grubCfg} + fi + if [ ! -e pxe ]; then + mkdir pxe + cp ${entryScript} /var/lib/podman-dracut/entry.sh + systemctl --wait start podman-fedora-dracut.service + mv /var/lib/podman-dracut/*/ pxe + chmod -R 640 pxe + chgrp -R php pxe + chmod ug+x $(find pxe -type d) + fi + ''; + }; + }; +} diff --git a/server/configuration.nix b/server/configuration.nix index e1fab52..e85bec7 100644 --- a/server/configuration.nix +++ b/server/configuration.nix @@ -8,6 +8,26 @@ "memmap=0x4000%0xbfb76000-4" "memmap=0x4000%0xbfb7a000-4" ]; + security.acme = { + acceptTerms = true; + defaults.email = "letsencrypt@bogaledev.ru"; + certs."bogaledev.ru" = { + validMinDays = 3; + dnsProvider = "cloudflare"; + extraDomainNames = [ "*.bogaledev.ru" ]; + credentialFiles = { "CF_DNS_API_TOKEN_FILE" = "/secrets/cf-token"; }; + reloadServices = [ "nginx.service" "dovecot.service" "postfix.service" ]; + }; + }; + systemd.tmpfiles.rules = [ + "d /root/backup/server 0700 root root -" + "L /root/backup/server/http - - - - /srv/http" + "L /root/backup/server/acme - - - - /var/lib/acme" + "L /root/backup/server/mail - - - - /var/spool/mail" + "L /root/backup/server/forgejo - - - - /var/lib/forgejo/dump" + "L /root/backup/server/vaultwarden - - - - /var/lib/vaultwarden" + "L /root/backup/server/postgresql - - - - /var/backup/postgresql" + ]; users = { groups = { php.gid = 1568; @@ -47,15 +67,4 @@ wifi-security.psk = "$BOGALE_2_4_PSK"; }; }; - security.acme = { - acceptTerms = true; - defaults.email = "letsencrypt@bogaledev.ru"; - certs."bogaledev.ru" = { - validMinDays = 3; - dnsProvider = "cloudflare"; - extraDomainNames = [ "*.bogaledev.ru" ]; - credentialFiles = { "CF_DNS_API_TOKEN_FILE" = "/secrets/cf-token"; }; - reloadServices = [ "nginx.service" "dovecot.service" "postfix.service" ]; - }; - }; } diff --git a/server/mods/web.nix b/server/mods/web.nix index d7a45c1..296ca2c 100644 --- a/server/mods/web.nix +++ b/server/mods/web.nix @@ -68,50 +68,58 @@ }; }; }; - nginx.virtualHosts."bogaledev.ru" = let - phpPool = '' - index index.php index.html; - location ~ \.php$ { - fastcgi_pass unix:${config.services.phpfpm.pools.php.socket}; - } - ''; - localNetworks = '' - allow fc00::/64; - allow fc01::/96; - allow fc02::/64; - allow 10.0.0.0/16; - allow 10.1.0.0/24; - allow 10.2.0.0/16; - deny all; - ''; - in { - quic = true; - addSSL = true; - default = true; - root = "/srv/http"; - useACMEHost = "bogaledev.ru"; - extraConfig = '' - add_header Alt-Svc 'h3=":443"; ma=2592000' always; - add_header X-Content-Type-Options "nosniff" always; - ''; - locations = { - "/".extraConfig = phpPool; - "/local/".extraConfig = "${phpPool} ${localNetworks}"; - "/git/".proxyPass = "http://unix:/run/forgejo/forgejo.sock:/"; - "/grafana/" = { - proxyWebsockets = true; - extraConfig = localNetworks; - proxyPass = "http://unix:/run/grafana/grafana.sock:/"; - }; - "/local/net/".extraConfig = '' - allow fc01::/64; - allow 10.1.0.0/16; + nginx = { + enable = true; + recommendedTlsSettings = true; + recommendedGzipSettings = true; + recommendedOptimisation = true; + recommendedProxySettings = true; + recommendedBrotliSettings = true; + virtualHosts.main = let + phpPool = '' + index index.php index.html; + location ~ \.php$ { + fastcgi_pass unix:${config.services.phpfpm.pools.php.socket}; + } + ''; + localNetworks = '' + allow fc00::/64; + allow fc01::/96; + allow fc02::/64; + allow 10.0.0.0/16; + allow 10.1.0.0/24; + allow 10.2.0.0/16; deny all; ''; - "/vw/" = { - proxyWebsockets = true; - extraConfig = localNetworks; - proxyPass = "http://localhost:46151"; + in { + quic = true; + default = true; + forceSSL = true; + root = "/srv/http"; + useACMEHost = "bogaledev.ru"; + extraConfig = '' + add_header Alt-Svc 'h3=":443"; ma=2592000' always; + add_header X-Content-Type-Options 'nosniff' always; + ''; + locations = { + "/".extraConfig = phpPool; + "/local/".extraConfig = "${phpPool} ${localNetworks}"; + "/git/".proxyPass = "http://unix:/run/forgejo/forgejo.sock:/"; + "/grafana/" = { + proxyWebsockets = true; + extraConfig = localNetworks; + proxyPass = "http://unix:/run/grafana/grafana.sock:/"; + }; + "/local/net/".extraConfig = '' + allow fc01::/64; + allow 10.1.0.0/16; + deny all; + ''; + "/vw/" = { + proxyWebsockets = true; + extraConfig = localNetworks; + proxyPass = "http://localhost:46151"; + }; }; }; };