code organization

common.nix

@@ -1,18 +1,40 @@
 { config, lib, pkgs, ... }:
 {
-  nix.settings.experimental-features = [ "nix-command" "flakes" ];
-  system.stateVersion = "26.05";
   time.timeZone = "Asia/Chita";
+  system.stateVersion = "26.05";
+  imports = [ ./mods/pxeboot.nix ];
   i18n.defaultLocale = "ru_RU.UTF-8";
-  console = {
-    keyMap = "ruwin_alt_sh-UTF-8";
-    font = "cyr-sun16";
-  };
-  fileSystems = {
-    "/" = { options = [ "noatime" ]; };
-    "/boot" = { options = [ "noatime" ]; };
-  };
   swapDevices = [ { device = "/var/swapfile"; } ];
+  users.users.root.hashedPasswordFile = "/secrets/user/root-pw";
+  nix.settings.experimental-features = [ "nix-command" "flakes" ];
+  console = {
+    font = "cyr-sun16";
+    keyMap = "ruwin_alt_sh-UTF-8";
+  };
+  environment.systemPackages = with pkgs; [
+    jq _7zz sbctl
+    openssl grub2_efi
+  ];
+  fileSystems = let
+    noatime = { options = [ "noatime" ]; };
+  in {
+    "/" = noatime;
+    "/boot" = noatime;
+  };
+  services = {
+    logind.settings.Login.HandleLidSwitch = "ignore";
+    openssh = {
+      enable = true;
+      settings.PasswordAuthentication = false;
+    };
+  };
+  systemd.tmpfiles.rules = [
+    "d /root/backup 0700 root root -"
+    "d /root/backup/base 0700 root root -"
+    "L /root/backup/base/nixos - - - - /etc/nixos"
+    "L /root/backup/base/secrets - - - - /secrets"
+    "L /root/backup/base/sbctl - - - - /var/lib/sbctl"
+  ];
   boot = {
     kernelModules = [ "amneziawg" ];
     kernelPackages = pkgs.linuxPackages_latest;
@@ -23,7 +45,6 @@
       panicOnChecksumMismatch = true;
     };
   };
-  users.users.root.hashedPasswordFile = "/secrets/user/root-pw";
   networking = {
     firewall = {
       allowedTCPPorts = [ 53 80 2049 ];
@@ -79,135 +100,4 @@
       };
     };
   };
-  environment.systemPackages = with pkgs; [
-    jq
-    _7zz
-    sbctl
-    openssl
-    grub2_efi
-  ];
-  services = {
-    logind.settings.Login.HandleLidSwitch = "ignore";
-    openssh = {
-      enable = true;
-      settings.PasswordAuthentication = false;
-    };
-    nginx = {
-      enable = true;
-      recommendedTlsSettings = true;
-      recommendedGzipSettings = true;
-      recommendedOptimisation = true;
-      recommendedProxySettings = true;
-      recommendedBrotliSettings = true;
-    };
-    nfs.server = {
-      enable = true;
-      exports = let
-        clients."10.2.0.0/16" = [ "mp" "rw" "no_root_squash" ];
-      in {
-        "/srv/nfs/arch/root" = clients;
-        "/srv/nfs/fedora/root" = clients;
-      };
-    };
-    dnsmasq = {
-      enable = true;
-      settings = {
-        enable-ra = true;
-        no-resolv = true;
-        cache-size = 4096;
-        bogus-priv = true;
-        enable-tftp = true;
-        interface = "enp1s0";
-        domain-needed = true;
-        tftp-root = "/srv/tftp";
-        dhcp-boot = "grubx64.efi";
-        dhcp-range = [ "10.2.0.2,10.2.255.254,12h"
-        "fc02::2,fc02::ffff:ffff:ffff:ffff,12h" ];
-        server = [ "1.1.1.2" "2606:4700:4700::1112"
-        "1.0.0.2" "2606:4700:4700::1002" ];
-      };
-    };
-  };
-  virtualisation.oci-containers.containers.fedora-dracut = {
-    pull = "newer";
-    autoStart = false;
-    entrypoint = "bash";
-    image = "docker.io/fedora:latest";
-    cmd = [ "/data/workdir/entry.sh" ];
-    volumes = [
-      "/var/lib/podman-dracut:/data/workdir"
-      "/srv/nfs/arch/lower:/data/arch:ro"
-      "/srv/nfs/fedora/lower:/data/fedora:ro"
-    ];
-  };
-  systemd = {
-    tmpfiles.rules = [ "d /var/lib/podman-dracut 0755 root root -" ];
-    services.pxeboot = {
-      serviceConfig.Type = "oneshot";
-      wantedBy = [ "multi-user.target" ];
-      path = with pkgs; [ xz e2fsprogs grub2_efi util-linux ];
-      script = let
-        resolv = pkgs.writeText "resolv.conf" ''
-          nameserver fc02::1
-          nameserver 10.2.0.1
-          options edns0 trust-ad
-        '';
-        grubCfg = pkgs.writeText "grub.cfg" ''
-          set timeout=10
-          set path=(http,$net_default_server)/local/boot/pxe
-          set nfs="rw ifname=ens0:$net_default_mac ip=$net_default_ip::$net_default_server:255.255.0.0::ens0:none root=nfs4:$net_default_server:/srv/nfs"
-          . $path/grub.cfg
-        '';
-        entryScript = pkgs.writeText "entry.sh" ''
-          set -e
-          dnf install -y dracut-network nfs-utils
-          cd /data/workdir
-          for target in $(cd ..; ls | grep -v workdir); do
-            modsDir=../$target/usr/lib/modules/*
-            mkdir $target
-            cp $modsDir/vmlinuz $target
-            dracut -Nm "network-manager nfs" --zstd -k $modsDir --kver $(basename $modsDir) $target/initramfs
-          done
-        '';
-      in ''
-        cd /srv/tftp
-        if [ ! -e grubx64.efi ]; then
-          grub-mkstandalone -O x86_64-efi --compress=xz --modules=efinet -o grubx64.efi /boot/grub/grub.cfg=${grubCfg}
-        fi
-        for distro in arch:arch/x86_64/airootfs.sfs fedora:LiveOS/squashfs.img; do
-          rootfs=''${distro##*:}
-          distro=''${distro%:*}
-          cd /srv/nfs/$distro
-          mkdir -p loop lower upper work root
-          mountpoint -q loop || mount $distro.iso loop
-          mountpoint -q lower || mount loop/$rootfs lower
-          mountpoint -q root || mount -t overlay overlay -o lowerdir=lower,upperdir=upper,workdir=work,nfs_export=on root
-          if [ ! -e upper/etc/resolv.conf ]; then
-            cd root/etc
-            rm -f resolv.conf
-            cp ${resolv} resolv.conf
-            chattr +i resolv.conf
-          fi
-        done
-        cd /srv/http/local/boot
-        if [ ! -e pxe ]; then
-          mkdir pxe
-          cp ${entryScript} /var/lib/podman-dracut/entry.sh
-          systemctl --wait start podman-fedora-dracut.service
-          for distro in arch: fedora:selinux=0; do
-            cmdline=''${distro##*:}
-            distro=''${distro%:*}
-            mv /var/lib/podman-dracut/$distro pxe
-            echo "menuentry $distro {
-              linux \$path/$distro/vmlinuz \$nfs/$distro/root $cmdline
-              initrd \$path/$distro/initramfs
-            }" >> pxe/grub.cfg
-          done
-          chmod -R 640 pxe
-          chgrp -R php pxe
-          chmod ug+x $(find pxe -type d)
-        fi
-      '';
-    };
-  };
 }

flake.nix

@@ -2,8 +2,8 @@
   inputs = {
     nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
     home-manager = {
-      url = "github:nix-community/home-manager";
       inputs.nixpkgs.follows = "nixpkgs";
+      url = "github:nix-community/home-manager";
     };
   };
   outputs = inputs@{ self, nixpkgs, home-manager, ... }: {
@@ -26,9 +26,11 @@
             home-manager.useGlobalPkgs = true;
             home-manager.useUserPackages = true;
             home-manager.extraSpecialArgs = { inherit inputs; };
-            home-manager.users.data = ./home/desktop/data.nix;
+            home-manager.users = {
-            home-manager.users.root = ./home/desktop/root.nix;
+              data = ./home/desktop/data.nix;
-            home-manager.users.bogale = ./home/desktop/bogale.nix;
+              root = ./home/desktop/root.nix;
+              bogale = ./home/desktop/bogale.nix;
+            };
           }
         ];
       };

home/common.nix

@@ -2,16 +2,13 @@
 {
   home.stateVersion = "26.05";
   services.ssh-agent.enable = true;
-  home.packages = with pkgs; [
+  home.packages = with pkgs; [ ncdu yt-dlp ];
-    ncdu
-    yt-dlp
-  ];
   programs = {
     home-manager.enable = true;
     bash = {
       enable = true;
+      shellAliases.la = "ls -lAtr";
       historyControl = [ "ignoreboth" ];
-      shellAliases = { la = "ls -lAtr"; };
     };
     ssh = {
       enable = true;
@@ -50,9 +47,6 @@
         unbind C-b
         set -g mouse on
         set -g prefix M-f
-        set-option -g focus-events on
-        set -s set-clipboard external
-        set-option -a terminal-features "xterm-256color:RGB"
         bind f send-prefix
         bind h select-pane -L
         bind j select-pane -D
@@ -60,6 +54,9 @@
         bind l select-pane -R
         bind u split-window -h
         bind i split-window -v
+        set -s set-clipboard external
+        set-option -g focus-events on
+        set-option -a terminal-features "xterm-256color:RGB"
       '';
     };
   };

marks

@@ -1,15 +1,11 @@
 installation:
-secure erase / sanitize
 gdisk
 cryptsetup
 mkfs
 mount
-copy private files
+copy backup
 mkswap -s $SIZE -F /mnt/var/swapfile
 swapon /mnt/var/swapfile
 sbctl enroll-keys --yes-this-might-brick-my-machine
 nixos-install --flake "/mnt/etc/nixos#nixos" --no-channel-copy --no-root-passwd
 systemd-cryptenroll --tpm2-device=auto --tpm2-pcrs=0+2+7 <LUKS_DEV>
-
-todo:
-- email tracking

mods/pxeboot.nix

@@ -0,0 +1,116 @@
+{ config, lib, pkgs, ... }:
+{
+  virtualisation.oci-containers.containers.fedora-dracut = {
+    pull = "newer";
+    autoStart = false;
+    entrypoint = "bash";
+    image = "docker.io/fedora:latest";
+    cmd = [ "/data/workdir/entry.sh" ];
+    volumes = [
+      "/srv/nfs/arch/lower:/data/arch:ro"
+      "/var/lib/podman-dracut:/data/workdir"
+      "/srv/nfs/fedora/lower:/data/fedora:ro"
+    ];
+  };
+  services = {
+    nfs.server = {
+      enable = true;
+      exports = let
+        clients."10.2.0.0/16" = [ "mp" "rw" "no_root_squash" ];
+      in {
+        "/srv/nfs/arch/root" = clients;
+        "/srv/nfs/fedora/root" = clients;
+      };
+    };
+    dnsmasq = {
+      enable = true;
+      settings = {
+        enable-ra = true;
+        no-resolv = true;
+        cache-size = 4096;
+        bogus-priv = true;
+        enable-tftp = true;
+        interface = "enp1s0";
+        domain-needed = true;
+        tftp-root = "/srv/tftp";
+        dhcp-boot = "grubx64.efi";
+        server = [ "1.1.1.2" "2606:4700:4700::1112"
+        "1.0.0.2" "2606:4700:4700::1002" ];
+        dhcp-range = [ "10.2.0.2,10.2.255.254,12h"
+        "fc02::2,fc02::ffff:ffff:ffff:ffff,12h" ];
+      };
+    };
+  };
+  systemd = {
+    tmpfiles.rules = [ "d /var/lib/podman-dracut 0755 root root -" ];
+    services.pxeboot = {
+      serviceConfig.Type = "oneshot";
+      #wantedBy = [ "multi-user.target" ];
+      path = with pkgs; [ xz e2fsprogs grub2_efi util-linux ];
+      script = let
+        resolv = pkgs.writeText "resolv.conf" ''
+          nameserver fc02::1
+          nameserver 10.2.0.1
+          options edns0 trust-ad
+        '';
+        entryScript = pkgs.writeText "entry.sh" ''
+          set -e
+          dnf install -y dracut-network nfs-utils
+          cd /data/workdir
+          for target in $(cd ..; ls | grep -v workdir); do
+            modsDir=../$target/usr/lib/modules/*
+            mkdir $target
+            cp $modsDir/vmlinuz $target
+            dracut -Nm "network-manager nfs" --zstd -k $modsDir \
+              --kver $(basename $modsDir) $target/initramfs
+          done
+        '';
+        grubCfg = pkgs.writeText "grub.cfg" ''
+          set timeout=5
+          #set path=(http,$net_default_server)/local/boot/pxe
+          set nfs="rw ip=dhcp root=nfs4:$net_default_server:/srv/nfs"
+          function load {
+            linux $path/$1/vmlinuz $nfs/$1/root $2
+            initrd $path/$1/initramfs
+          }
+          menuentry Arch {
+            load arch
+          }
+          menuentry Fedora {
+            load fedora selinux=0
+          }
+        '';
+      in ''
+        for distro in arch:arch/x86_64/airootfs.sfs fedora:LiveOS/squashfs.img; do
+          rootfs=''${distro##*:}
+          distro=''${distro%:*}
+          cd /srv/nfs/$distro
+          mkdir -p loop work lower upper #root -> move to tmpfiles
+          mountpoint -q loop || mount $distro.iso loop
+          mountpoint -q lower || mount loop/$rootfs lower
+          mountpoint -q root || mount -t overlay overlay -o workdir=work,nfs_export=on,lowerdir=lower,upperdir=upper root
+          if [ ! -e upper/etc/resolv.conf ]; then
+            cd root/etc
+            rm -f resolv.conf
+            cp ${resolv} resolv.conf
+            chattr +i resolv.conf
+          fi
+        done
+        cd /srv
+        #either check of tftp dir, or file in tftp, if it forced to exists through tmpfiles
+        if [ ! -e grubx64.efi ]; then
+          grub-mkstandalone -O x86_64-efi --compress=xz -o grubx64.efi #--modules=efinet /boot/grub/grub.cfg=${grubCfg}
+        fi
+        if [ ! -e pxe ]; then
+          mkdir pxe
+          cp ${entryScript} /var/lib/podman-dracut/entry.sh
+          systemctl --wait start podman-fedora-dracut.service
+          mv /var/lib/podman-dracut/*/ pxe
+          chmod -R 640 pxe
+          chgrp -R php pxe
+          chmod ug+x $(find pxe -type d)
+        fi
+      '';
+    };
+  };
+}

server/configuration.nix

@@ -8,6 +8,26 @@
     "memmap=0x4000%0xbfb76000-4"
     "memmap=0x4000%0xbfb7a000-4"
   ];
+  security.acme = {
+    acceptTerms = true;
+    defaults.email = "letsencrypt@bogaledev.ru";
+    certs."bogaledev.ru" = {
+      validMinDays = 3;
+      dnsProvider = "cloudflare";
+      extraDomainNames = [ "*.bogaledev.ru" ];
+      credentialFiles = { "CF_DNS_API_TOKEN_FILE" = "/secrets/cf-token"; };
+      reloadServices = [ "nginx.service" "dovecot.service" "postfix.service" ];
+    };
+  };
+  systemd.tmpfiles.rules = [
+    "d /root/backup/server 0700 root root -"
+    "L /root/backup/server/http - - - - /srv/http"
+    "L /root/backup/server/acme - - - - /var/lib/acme"
+    "L /root/backup/server/mail - - - - /var/spool/mail"
+    "L /root/backup/server/forgejo - - - - /var/lib/forgejo/dump"
+    "L /root/backup/server/vaultwarden - - - - /var/lib/vaultwarden"
+    "L /root/backup/server/postgresql - - - - /var/backup/postgresql"
+  ];
   users = {
     groups = {
       php.gid = 1568;
@@ -47,15 +67,4 @@
       wifi-security.psk = "$BOGALE_2_4_PSK";
     };
   };
-  security.acme = {
-    acceptTerms = true;
-    defaults.email = "letsencrypt@bogaledev.ru";
-    certs."bogaledev.ru" = {
-      validMinDays = 3;
-      dnsProvider = "cloudflare";
-      extraDomainNames = [ "*.bogaledev.ru" ];
-      credentialFiles = { "CF_DNS_API_TOKEN_FILE" = "/secrets/cf-token"; };
-      reloadServices = [ "nginx.service" "dovecot.service" "postfix.service" ];
-    };
-  };
 }

server/mods/web.nix

@@ -68,7 +68,14 @@
         };
       };
     };
-    nginx.virtualHosts."bogaledev.ru" = let
+    nginx = {
+      enable = true;
+      recommendedTlsSettings = true;
+      recommendedGzipSettings = true;
+      recommendedOptimisation = true;
+      recommendedProxySettings = true;
+      recommendedBrotliSettings = true;
+      virtualHosts.main = let
         phpPool = ''
           index index.php index.html;
           location ~ \.php$ {
@@ -86,13 +93,13 @@
         '';
       in {
         quic = true;
-      addSSL = true;
         default = true;
+        forceSSL = true;
         root = "/srv/http";
         useACMEHost = "bogaledev.ru";
         extraConfig = ''
           add_header Alt-Svc 'h3=":443"; ma=2592000' always;
-        add_header X-Content-Type-Options "nosniff" always;
+          add_header X-Content-Type-Options 'nosniff' always;
         '';
         locations = {
           "/".extraConfig = phpPool;
@@ -116,4 +123,5 @@
         };
       };
     };
+  };
 }