code organization
This commit is contained in:
parent
3175211f7c
commit
bf5f9f799e
8 changed files with 227 additions and 209 deletions
174
common.nix
174
common.nix
|
|
@ -1,18 +1,40 @@
|
|||
{ config, lib, pkgs, ... }:
|
||||
{
|
||||
nix.settings.experimental-features = [ "nix-command" "flakes" ];
|
||||
system.stateVersion = "26.05";
|
||||
time.timeZone = "Asia/Chita";
|
||||
system.stateVersion = "26.05";
|
||||
imports = [ ./mods/pxeboot.nix ];
|
||||
i18n.defaultLocale = "ru_RU.UTF-8";
|
||||
console = {
|
||||
keyMap = "ruwin_alt_sh-UTF-8";
|
||||
font = "cyr-sun16";
|
||||
};
|
||||
fileSystems = {
|
||||
"/" = { options = [ "noatime" ]; };
|
||||
"/boot" = { options = [ "noatime" ]; };
|
||||
};
|
||||
swapDevices = [ { device = "/var/swapfile"; } ];
|
||||
users.users.root.hashedPasswordFile = "/secrets/user/root-pw";
|
||||
nix.settings.experimental-features = [ "nix-command" "flakes" ];
|
||||
console = {
|
||||
font = "cyr-sun16";
|
||||
keyMap = "ruwin_alt_sh-UTF-8";
|
||||
};
|
||||
environment.systemPackages = with pkgs; [
|
||||
jq _7zz sbctl
|
||||
openssl grub2_efi
|
||||
];
|
||||
fileSystems = let
|
||||
noatime = { options = [ "noatime" ]; };
|
||||
in {
|
||||
"/" = noatime;
|
||||
"/boot" = noatime;
|
||||
};
|
||||
services = {
|
||||
logind.settings.Login.HandleLidSwitch = "ignore";
|
||||
openssh = {
|
||||
enable = true;
|
||||
settings.PasswordAuthentication = false;
|
||||
};
|
||||
};
|
||||
systemd.tmpfiles.rules = [
|
||||
"d /root/backup 0700 root root -"
|
||||
"d /root/backup/base 0700 root root -"
|
||||
"L /root/backup/base/nixos - - - - /etc/nixos"
|
||||
"L /root/backup/base/secrets - - - - /secrets"
|
||||
"L /root/backup/base/sbctl - - - - /var/lib/sbctl"
|
||||
];
|
||||
boot = {
|
||||
kernelModules = [ "amneziawg" ];
|
||||
kernelPackages = pkgs.linuxPackages_latest;
|
||||
|
|
@ -23,7 +45,6 @@
|
|||
panicOnChecksumMismatch = true;
|
||||
};
|
||||
};
|
||||
users.users.root.hashedPasswordFile = "/secrets/user/root-pw";
|
||||
networking = {
|
||||
firewall = {
|
||||
allowedTCPPorts = [ 53 80 2049 ];
|
||||
|
|
@ -79,135 +100,4 @@
|
|||
};
|
||||
};
|
||||
};
|
||||
environment.systemPackages = with pkgs; [
|
||||
jq
|
||||
_7zz
|
||||
sbctl
|
||||
openssl
|
||||
grub2_efi
|
||||
];
|
||||
services = {
|
||||
logind.settings.Login.HandleLidSwitch = "ignore";
|
||||
openssh = {
|
||||
enable = true;
|
||||
settings.PasswordAuthentication = false;
|
||||
};
|
||||
nginx = {
|
||||
enable = true;
|
||||
recommendedTlsSettings = true;
|
||||
recommendedGzipSettings = true;
|
||||
recommendedOptimisation = true;
|
||||
recommendedProxySettings = true;
|
||||
recommendedBrotliSettings = true;
|
||||
};
|
||||
nfs.server = {
|
||||
enable = true;
|
||||
exports = let
|
||||
clients."10.2.0.0/16" = [ "mp" "rw" "no_root_squash" ];
|
||||
in {
|
||||
"/srv/nfs/arch/root" = clients;
|
||||
"/srv/nfs/fedora/root" = clients;
|
||||
};
|
||||
};
|
||||
dnsmasq = {
|
||||
enable = true;
|
||||
settings = {
|
||||
enable-ra = true;
|
||||
no-resolv = true;
|
||||
cache-size = 4096;
|
||||
bogus-priv = true;
|
||||
enable-tftp = true;
|
||||
interface = "enp1s0";
|
||||
domain-needed = true;
|
||||
tftp-root = "/srv/tftp";
|
||||
dhcp-boot = "grubx64.efi";
|
||||
dhcp-range = [ "10.2.0.2,10.2.255.254,12h"
|
||||
"fc02::2,fc02::ffff:ffff:ffff:ffff,12h" ];
|
||||
server = [ "1.1.1.2" "2606:4700:4700::1112"
|
||||
"1.0.0.2" "2606:4700:4700::1002" ];
|
||||
};
|
||||
};
|
||||
};
|
||||
virtualisation.oci-containers.containers.fedora-dracut = {
|
||||
pull = "newer";
|
||||
autoStart = false;
|
||||
entrypoint = "bash";
|
||||
image = "docker.io/fedora:latest";
|
||||
cmd = [ "/data/workdir/entry.sh" ];
|
||||
volumes = [
|
||||
"/var/lib/podman-dracut:/data/workdir"
|
||||
"/srv/nfs/arch/lower:/data/arch:ro"
|
||||
"/srv/nfs/fedora/lower:/data/fedora:ro"
|
||||
];
|
||||
};
|
||||
systemd = {
|
||||
tmpfiles.rules = [ "d /var/lib/podman-dracut 0755 root root -" ];
|
||||
services.pxeboot = {
|
||||
serviceConfig.Type = "oneshot";
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
path = with pkgs; [ xz e2fsprogs grub2_efi util-linux ];
|
||||
script = let
|
||||
resolv = pkgs.writeText "resolv.conf" ''
|
||||
nameserver fc02::1
|
||||
nameserver 10.2.0.1
|
||||
options edns0 trust-ad
|
||||
'';
|
||||
grubCfg = pkgs.writeText "grub.cfg" ''
|
||||
set timeout=10
|
||||
set path=(http,$net_default_server)/local/boot/pxe
|
||||
set nfs="rw ifname=ens0:$net_default_mac ip=$net_default_ip::$net_default_server:255.255.0.0::ens0:none root=nfs4:$net_default_server:/srv/nfs"
|
||||
. $path/grub.cfg
|
||||
'';
|
||||
entryScript = pkgs.writeText "entry.sh" ''
|
||||
set -e
|
||||
dnf install -y dracut-network nfs-utils
|
||||
cd /data/workdir
|
||||
for target in $(cd ..; ls | grep -v workdir); do
|
||||
modsDir=../$target/usr/lib/modules/*
|
||||
mkdir $target
|
||||
cp $modsDir/vmlinuz $target
|
||||
dracut -Nm "network-manager nfs" --zstd -k $modsDir --kver $(basename $modsDir) $target/initramfs
|
||||
done
|
||||
'';
|
||||
in ''
|
||||
cd /srv/tftp
|
||||
if [ ! -e grubx64.efi ]; then
|
||||
grub-mkstandalone -O x86_64-efi --compress=xz --modules=efinet -o grubx64.efi /boot/grub/grub.cfg=${grubCfg}
|
||||
fi
|
||||
for distro in arch:arch/x86_64/airootfs.sfs fedora:LiveOS/squashfs.img; do
|
||||
rootfs=''${distro##*:}
|
||||
distro=''${distro%:*}
|
||||
cd /srv/nfs/$distro
|
||||
mkdir -p loop lower upper work root
|
||||
mountpoint -q loop || mount $distro.iso loop
|
||||
mountpoint -q lower || mount loop/$rootfs lower
|
||||
mountpoint -q root || mount -t overlay overlay -o lowerdir=lower,upperdir=upper,workdir=work,nfs_export=on root
|
||||
if [ ! -e upper/etc/resolv.conf ]; then
|
||||
cd root/etc
|
||||
rm -f resolv.conf
|
||||
cp ${resolv} resolv.conf
|
||||
chattr +i resolv.conf
|
||||
fi
|
||||
done
|
||||
cd /srv/http/local/boot
|
||||
if [ ! -e pxe ]; then
|
||||
mkdir pxe
|
||||
cp ${entryScript} /var/lib/podman-dracut/entry.sh
|
||||
systemctl --wait start podman-fedora-dracut.service
|
||||
for distro in arch: fedora:selinux=0; do
|
||||
cmdline=''${distro##*:}
|
||||
distro=''${distro%:*}
|
||||
mv /var/lib/podman-dracut/$distro pxe
|
||||
echo "menuentry $distro {
|
||||
linux \$path/$distro/vmlinuz \$nfs/$distro/root $cmdline
|
||||
initrd \$path/$distro/initramfs
|
||||
}" >> pxe/grub.cfg
|
||||
done
|
||||
chmod -R 640 pxe
|
||||
chgrp -R php pxe
|
||||
chmod ug+x $(find pxe -type d)
|
||||
fi
|
||||
'';
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
|
|||
10
flake.nix
10
flake.nix
|
|
@ -2,8 +2,8 @@
|
|||
inputs = {
|
||||
nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
|
||||
home-manager = {
|
||||
url = "github:nix-community/home-manager";
|
||||
inputs.nixpkgs.follows = "nixpkgs";
|
||||
url = "github:nix-community/home-manager";
|
||||
};
|
||||
};
|
||||
outputs = inputs@{ self, nixpkgs, home-manager, ... }: {
|
||||
|
|
@ -26,9 +26,11 @@
|
|||
home-manager.useGlobalPkgs = true;
|
||||
home-manager.useUserPackages = true;
|
||||
home-manager.extraSpecialArgs = { inherit inputs; };
|
||||
home-manager.users.data = ./home/desktop/data.nix;
|
||||
home-manager.users.root = ./home/desktop/root.nix;
|
||||
home-manager.users.bogale = ./home/desktop/bogale.nix;
|
||||
home-manager.users = {
|
||||
data = ./home/desktop/data.nix;
|
||||
root = ./home/desktop/root.nix;
|
||||
bogale = ./home/desktop/bogale.nix;
|
||||
};
|
||||
}
|
||||
];
|
||||
};
|
||||
|
|
|
|||
|
|
@ -2,16 +2,13 @@
|
|||
{
|
||||
home.stateVersion = "26.05";
|
||||
services.ssh-agent.enable = true;
|
||||
home.packages = with pkgs; [
|
||||
ncdu
|
||||
yt-dlp
|
||||
];
|
||||
home.packages = with pkgs; [ ncdu yt-dlp ];
|
||||
programs = {
|
||||
home-manager.enable = true;
|
||||
bash = {
|
||||
enable = true;
|
||||
shellAliases.la = "ls -lAtr";
|
||||
historyControl = [ "ignoreboth" ];
|
||||
shellAliases = { la = "ls -lAtr"; };
|
||||
};
|
||||
ssh = {
|
||||
enable = true;
|
||||
|
|
@ -50,9 +47,6 @@
|
|||
unbind C-b
|
||||
set -g mouse on
|
||||
set -g prefix M-f
|
||||
set-option -g focus-events on
|
||||
set -s set-clipboard external
|
||||
set-option -a terminal-features "xterm-256color:RGB"
|
||||
bind f send-prefix
|
||||
bind h select-pane -L
|
||||
bind j select-pane -D
|
||||
|
|
@ -60,6 +54,9 @@
|
|||
bind l select-pane -R
|
||||
bind u split-window -h
|
||||
bind i split-window -v
|
||||
set -s set-clipboard external
|
||||
set-option -g focus-events on
|
||||
set-option -a terminal-features "xterm-256color:RGB"
|
||||
'';
|
||||
};
|
||||
};
|
||||
|
|
|
|||
0
ls
0
ls
6
marks
6
marks
|
|
@ -1,15 +1,11 @@
|
|||
installation:
|
||||
secure erase / sanitize
|
||||
gdisk
|
||||
cryptsetup
|
||||
mkfs
|
||||
mount
|
||||
copy private files
|
||||
copy backup
|
||||
mkswap -s $SIZE -F /mnt/var/swapfile
|
||||
swapon /mnt/var/swapfile
|
||||
sbctl enroll-keys --yes-this-might-brick-my-machine
|
||||
nixos-install --flake "/mnt/etc/nixos#nixos" --no-channel-copy --no-root-passwd
|
||||
systemd-cryptenroll --tpm2-device=auto --tpm2-pcrs=0+2+7 <LUKS_DEV>
|
||||
|
||||
todo:
|
||||
- email tracking
|
||||
|
|
|
|||
116
mods/pxeboot.nix
Normal file
116
mods/pxeboot.nix
Normal file
|
|
@ -0,0 +1,116 @@
|
|||
{ config, lib, pkgs, ... }:
|
||||
{
|
||||
virtualisation.oci-containers.containers.fedora-dracut = {
|
||||
pull = "newer";
|
||||
autoStart = false;
|
||||
entrypoint = "bash";
|
||||
image = "docker.io/fedora:latest";
|
||||
cmd = [ "/data/workdir/entry.sh" ];
|
||||
volumes = [
|
||||
"/srv/nfs/arch/lower:/data/arch:ro"
|
||||
"/var/lib/podman-dracut:/data/workdir"
|
||||
"/srv/nfs/fedora/lower:/data/fedora:ro"
|
||||
];
|
||||
};
|
||||
services = {
|
||||
nfs.server = {
|
||||
enable = true;
|
||||
exports = let
|
||||
clients."10.2.0.0/16" = [ "mp" "rw" "no_root_squash" ];
|
||||
in {
|
||||
"/srv/nfs/arch/root" = clients;
|
||||
"/srv/nfs/fedora/root" = clients;
|
||||
};
|
||||
};
|
||||
dnsmasq = {
|
||||
enable = true;
|
||||
settings = {
|
||||
enable-ra = true;
|
||||
no-resolv = true;
|
||||
cache-size = 4096;
|
||||
bogus-priv = true;
|
||||
enable-tftp = true;
|
||||
interface = "enp1s0";
|
||||
domain-needed = true;
|
||||
tftp-root = "/srv/tftp";
|
||||
dhcp-boot = "grubx64.efi";
|
||||
server = [ "1.1.1.2" "2606:4700:4700::1112"
|
||||
"1.0.0.2" "2606:4700:4700::1002" ];
|
||||
dhcp-range = [ "10.2.0.2,10.2.255.254,12h"
|
||||
"fc02::2,fc02::ffff:ffff:ffff:ffff,12h" ];
|
||||
};
|
||||
};
|
||||
};
|
||||
systemd = {
|
||||
tmpfiles.rules = [ "d /var/lib/podman-dracut 0755 root root -" ];
|
||||
services.pxeboot = {
|
||||
serviceConfig.Type = "oneshot";
|
||||
#wantedBy = [ "multi-user.target" ];
|
||||
path = with pkgs; [ xz e2fsprogs grub2_efi util-linux ];
|
||||
script = let
|
||||
resolv = pkgs.writeText "resolv.conf" ''
|
||||
nameserver fc02::1
|
||||
nameserver 10.2.0.1
|
||||
options edns0 trust-ad
|
||||
'';
|
||||
entryScript = pkgs.writeText "entry.sh" ''
|
||||
set -e
|
||||
dnf install -y dracut-network nfs-utils
|
||||
cd /data/workdir
|
||||
for target in $(cd ..; ls | grep -v workdir); do
|
||||
modsDir=../$target/usr/lib/modules/*
|
||||
mkdir $target
|
||||
cp $modsDir/vmlinuz $target
|
||||
dracut -Nm "network-manager nfs" --zstd -k $modsDir \
|
||||
--kver $(basename $modsDir) $target/initramfs
|
||||
done
|
||||
'';
|
||||
grubCfg = pkgs.writeText "grub.cfg" ''
|
||||
set timeout=5
|
||||
#set path=(http,$net_default_server)/local/boot/pxe
|
||||
set nfs="rw ip=dhcp root=nfs4:$net_default_server:/srv/nfs"
|
||||
function load {
|
||||
linux $path/$1/vmlinuz $nfs/$1/root $2
|
||||
initrd $path/$1/initramfs
|
||||
}
|
||||
menuentry Arch {
|
||||
load arch
|
||||
}
|
||||
menuentry Fedora {
|
||||
load fedora selinux=0
|
||||
}
|
||||
'';
|
||||
in ''
|
||||
for distro in arch:arch/x86_64/airootfs.sfs fedora:LiveOS/squashfs.img; do
|
||||
rootfs=''${distro##*:}
|
||||
distro=''${distro%:*}
|
||||
cd /srv/nfs/$distro
|
||||
mkdir -p loop work lower upper #root -> move to tmpfiles
|
||||
mountpoint -q loop || mount $distro.iso loop
|
||||
mountpoint -q lower || mount loop/$rootfs lower
|
||||
mountpoint -q root || mount -t overlay overlay -o workdir=work,nfs_export=on,lowerdir=lower,upperdir=upper root
|
||||
if [ ! -e upper/etc/resolv.conf ]; then
|
||||
cd root/etc
|
||||
rm -f resolv.conf
|
||||
cp ${resolv} resolv.conf
|
||||
chattr +i resolv.conf
|
||||
fi
|
||||
done
|
||||
cd /srv
|
||||
#either check of tftp dir, or file in tftp, if it forced to exists through tmpfiles
|
||||
if [ ! -e grubx64.efi ]; then
|
||||
grub-mkstandalone -O x86_64-efi --compress=xz -o grubx64.efi #--modules=efinet /boot/grub/grub.cfg=${grubCfg}
|
||||
fi
|
||||
if [ ! -e pxe ]; then
|
||||
mkdir pxe
|
||||
cp ${entryScript} /var/lib/podman-dracut/entry.sh
|
||||
systemctl --wait start podman-fedora-dracut.service
|
||||
mv /var/lib/podman-dracut/*/ pxe
|
||||
chmod -R 640 pxe
|
||||
chgrp -R php pxe
|
||||
chmod ug+x $(find pxe -type d)
|
||||
fi
|
||||
'';
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
@ -8,6 +8,26 @@
|
|||
"memmap=0x4000%0xbfb76000-4"
|
||||
"memmap=0x4000%0xbfb7a000-4"
|
||||
];
|
||||
security.acme = {
|
||||
acceptTerms = true;
|
||||
defaults.email = "letsencrypt@bogaledev.ru";
|
||||
certs."bogaledev.ru" = {
|
||||
validMinDays = 3;
|
||||
dnsProvider = "cloudflare";
|
||||
extraDomainNames = [ "*.bogaledev.ru" ];
|
||||
credentialFiles = { "CF_DNS_API_TOKEN_FILE" = "/secrets/cf-token"; };
|
||||
reloadServices = [ "nginx.service" "dovecot.service" "postfix.service" ];
|
||||
};
|
||||
};
|
||||
systemd.tmpfiles.rules = [
|
||||
"d /root/backup/server 0700 root root -"
|
||||
"L /root/backup/server/http - - - - /srv/http"
|
||||
"L /root/backup/server/acme - - - - /var/lib/acme"
|
||||
"L /root/backup/server/mail - - - - /var/spool/mail"
|
||||
"L /root/backup/server/forgejo - - - - /var/lib/forgejo/dump"
|
||||
"L /root/backup/server/vaultwarden - - - - /var/lib/vaultwarden"
|
||||
"L /root/backup/server/postgresql - - - - /var/backup/postgresql"
|
||||
];
|
||||
users = {
|
||||
groups = {
|
||||
php.gid = 1568;
|
||||
|
|
@ -47,15 +67,4 @@
|
|||
wifi-security.psk = "$BOGALE_2_4_PSK";
|
||||
};
|
||||
};
|
||||
security.acme = {
|
||||
acceptTerms = true;
|
||||
defaults.email = "letsencrypt@bogaledev.ru";
|
||||
certs."bogaledev.ru" = {
|
||||
validMinDays = 3;
|
||||
dnsProvider = "cloudflare";
|
||||
extraDomainNames = [ "*.bogaledev.ru" ];
|
||||
credentialFiles = { "CF_DNS_API_TOKEN_FILE" = "/secrets/cf-token"; };
|
||||
reloadServices = [ "nginx.service" "dovecot.service" "postfix.service" ];
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
|
|||
|
|
@ -68,50 +68,58 @@
|
|||
};
|
||||
};
|
||||
};
|
||||
nginx.virtualHosts."bogaledev.ru" = let
|
||||
phpPool = ''
|
||||
index index.php index.html;
|
||||
location ~ \.php$ {
|
||||
fastcgi_pass unix:${config.services.phpfpm.pools.php.socket};
|
||||
}
|
||||
'';
|
||||
localNetworks = ''
|
||||
allow fc00::/64;
|
||||
allow fc01::/96;
|
||||
allow fc02::/64;
|
||||
allow 10.0.0.0/16;
|
||||
allow 10.1.0.0/24;
|
||||
allow 10.2.0.0/16;
|
||||
deny all;
|
||||
'';
|
||||
in {
|
||||
quic = true;
|
||||
addSSL = true;
|
||||
default = true;
|
||||
root = "/srv/http";
|
||||
useACMEHost = "bogaledev.ru";
|
||||
extraConfig = ''
|
||||
add_header Alt-Svc 'h3=":443"; ma=2592000' always;
|
||||
add_header X-Content-Type-Options "nosniff" always;
|
||||
'';
|
||||
locations = {
|
||||
"/".extraConfig = phpPool;
|
||||
"/local/".extraConfig = "${phpPool} ${localNetworks}";
|
||||
"/git/".proxyPass = "http://unix:/run/forgejo/forgejo.sock:/";
|
||||
"/grafana/" = {
|
||||
proxyWebsockets = true;
|
||||
extraConfig = localNetworks;
|
||||
proxyPass = "http://unix:/run/grafana/grafana.sock:/";
|
||||
};
|
||||
"/local/net/".extraConfig = ''
|
||||
allow fc01::/64;
|
||||
allow 10.1.0.0/16;
|
||||
nginx = {
|
||||
enable = true;
|
||||
recommendedTlsSettings = true;
|
||||
recommendedGzipSettings = true;
|
||||
recommendedOptimisation = true;
|
||||
recommendedProxySettings = true;
|
||||
recommendedBrotliSettings = true;
|
||||
virtualHosts.main = let
|
||||
phpPool = ''
|
||||
index index.php index.html;
|
||||
location ~ \.php$ {
|
||||
fastcgi_pass unix:${config.services.phpfpm.pools.php.socket};
|
||||
}
|
||||
'';
|
||||
localNetworks = ''
|
||||
allow fc00::/64;
|
||||
allow fc01::/96;
|
||||
allow fc02::/64;
|
||||
allow 10.0.0.0/16;
|
||||
allow 10.1.0.0/24;
|
||||
allow 10.2.0.0/16;
|
||||
deny all;
|
||||
'';
|
||||
"/vw/" = {
|
||||
proxyWebsockets = true;
|
||||
extraConfig = localNetworks;
|
||||
proxyPass = "http://localhost:46151";
|
||||
in {
|
||||
quic = true;
|
||||
default = true;
|
||||
forceSSL = true;
|
||||
root = "/srv/http";
|
||||
useACMEHost = "bogaledev.ru";
|
||||
extraConfig = ''
|
||||
add_header Alt-Svc 'h3=":443"; ma=2592000' always;
|
||||
add_header X-Content-Type-Options 'nosniff' always;
|
||||
'';
|
||||
locations = {
|
||||
"/".extraConfig = phpPool;
|
||||
"/local/".extraConfig = "${phpPool} ${localNetworks}";
|
||||
"/git/".proxyPass = "http://unix:/run/forgejo/forgejo.sock:/";
|
||||
"/grafana/" = {
|
||||
proxyWebsockets = true;
|
||||
extraConfig = localNetworks;
|
||||
proxyPass = "http://unix:/run/grafana/grafana.sock:/";
|
||||
};
|
||||
"/local/net/".extraConfig = ''
|
||||
allow fc01::/64;
|
||||
allow 10.1.0.0/16;
|
||||
deny all;
|
||||
'';
|
||||
"/vw/" = {
|
||||
proxyWebsockets = true;
|
||||
extraConfig = localNetworks;
|
||||
proxyPass = "http://localhost:46151";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue