summaryrefslogtreecommitdiffstats
path: root/makefu/1systems
diff options
context:
space:
mode:
authorlassulus <lass@aidsballs.de>2016-06-13 12:54:15 +0200
committerlassulus <lass@aidsballs.de>2016-06-13 12:54:15 +0200
commitb244441223ac192926da8465dea3273c225bbd68 (patch)
treeb688576b2219b6aefc5663f7d227016a590fc194 /makefu/1systems
parentf832a63ce045823c1aeafec48fbe32b78ed7cd6d (diff)
parentb9c0c46b4d0f9907f1b3fc96494be96abc60c8db (diff)
Merge remote-tracking branch 'gum/master'
Diffstat (limited to 'makefu/1systems')
-rw-r--r--makefu/1systems/omo.nix47
-rw-r--r--makefu/1systems/pornocauster.nix4
-rw-r--r--makefu/1systems/shoney.nix30
3 files changed, 59 insertions, 22 deletions
diff --git a/makefu/1systems/omo.nix b/makefu/1systems/omo.nix
index fbd06a9c7..e71055f54 100644
--- a/makefu/1systems/omo.nix
+++ b/makefu/1systems/omo.nix
@@ -5,9 +5,10 @@
{ config, pkgs, lib, ... }:
let
byid = dev: "/dev/disk/by-id/" + dev;
- keyFile = "/dev/disk/by-id/usb-Verbatim_STORE_N_GO_070B3CEE0B223954-0:0";
- rootDisk = byid "ata-INTEL_SSDSA2M080G2GC_CVPO003402PB080BGN";
- homePartition = byid "ata-INTEL_SSDSA2M080G2GC_CVPO003402PB080BGN-part3";
+ keyFile = byid "usb-Verbatim_STORE_N_GO_070B3CEE0B223954-0:0";
+ rootDisk = byid "ata-SanDisk_SD8SNAT128G1122_162099420904";
+ rootPartition = byid "ata-SanDisk_SD8SNAT128G1122_162099420904-part2";
+ primaryInterface = "enp1s0";
# cryptsetup luksFormat $dev --cipher aes-xts-plain64 -s 512 -h sha512
# cryptsetup luksAddKey $dev tmpkey
# cryptsetup luksOpen $dev crypt0 --key-file tmpkey --keyfile-size=4096
@@ -15,14 +16,14 @@ let
# omo Chassis:
# __FRONT_
- # |* d2 |
+ # |* d0 |
# | |
# |* d3 |
# | |
- # |* d0 |
+ # |* d3 |
# | |
- # |* d1 |
# |* |
+ # |* d2 |
# | * r0 |
# |_______|
cryptDisk0 = byid "ata-ST2000DM001-1CH164_Z240XTT6";
@@ -38,27 +39,31 @@ in {
[
../.
# TODO: unlock home partition via ssh
- ../2configs/fs/single-partition-ext4.nix
+ ../2configs/fs/sda-crypto-root.nix
../2configs/zsh-user.nix
../2configs/exim-retiolum.nix
../2configs/smart-monitor.nix
../2configs/mail-client.nix
- ../2configs/share-user-sftp.nix
- ../2configs/graphite-standalone.nix
+ #../2configs/graphite-standalone.nix
+ #../2configs/share-user-sftp.nix
../2configs/omo-share.nix
+
+ ## as long as pyload is not in nixpkgs:
+ # docker run -d -v /var/lib/pyload:/opt/pyload/pyload-config -v /media/crypt0/pyload:/opt/pyload/Downloads --name pyload --restart=always -p 8112:8000 -P writl/pyload
];
krebs.retiolum.enable = true;
- networking.firewall.trustedInterfaces = [ "enp3s0" ];
+ networking.firewall.trustedInterfaces = [ primaryInterface ];
# udp:137 udp:138 tcp:445 tcp:139 - samba, allowed in local net
# tcp:80 - nginx for sharing files
# tcp:655 udp:655 - tinc
# tcp:8111 - graphite
+ # tcp:8112 - pyload
# tcp:9090 - sabnzbd
# tcp:9200 - elasticsearch
# tcp:5601 - kibana
networking.firewall.allowedUDPPorts = [ 655 ];
- networking.firewall.allowedTCPPorts = [ 80 655 5601 8111 9200 9090 ];
+ networking.firewall.allowedTCPPorts = [ 80 655 5601 8111 8112 9200 9090 ];
# services.openssh.allowSFTP = false;
@@ -66,6 +71,9 @@ in {
services.sabnzbd.enable = true;
systemd.services.sabnzbd.environment.SSL_CERT_FILE = "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt";
+ virtualisation.docker.enable = true;
+
+
# HDD Array stuff
services.smartd.devices = builtins.map (x: { device = x; }) allDisks;
@@ -76,15 +84,11 @@ in {
disks = map toMapper [ 0 1 ];
parity = toMapper 2;
};
+
fileSystems = let
cryptMount = name:
{ "/media/${name}" = { device = "/dev/mapper/${name}"; fsType = "xfs"; };};
- in {
- "/home" = {
- device = "/dev/mapper/home";
- fsType = "ext4";
- };
- } // cryptMount "crypt0"
+ in cryptMount "crypt0"
// cryptMount "crypt1"
// cryptMount "crypt2";
@@ -101,15 +105,16 @@ in {
usbkey = name: device: {
inherit name device keyFile;
keyFileSize = 4096;
+ allowDiscards = true;
};
in [
- (usbkey "home" homePartition)
+ (usbkey "luksroot" rootPartition)
(usbkey "crypt0" cryptDisk0)
(usbkey "crypt1" cryptDisk1)
(usbkey "crypt2" cryptDisk2)
];
};
- loader.grub.device = rootDisk;
+ loader.grub.device = lib.mkForce rootDisk;
initrd.availableKernelModules = [
"ahci"
@@ -121,12 +126,12 @@ in {
"usbhid"
];
- kernelModules = [ "kvm-amd" ];
+ kernelModules = [ "kvm-intel" ];
extraModulePackages = [ ];
};
hardware.enableAllFirmware = true;
- hardware.cpu.amd.updateMicrocode = true;
+ hardware.cpu.intel.updateMicrocode = true;
zramSwap.enable = true;
diff --git a/makefu/1systems/pornocauster.nix b/makefu/1systems/pornocauster.nix
index fa39b121c..2fb93798a 100644
--- a/makefu/1systems/pornocauster.nix
+++ b/makefu/1systems/pornocauster.nix
@@ -31,6 +31,7 @@
# hardware specifics are in here
../2configs/hw/tp-x220.nix
+ ../2configs/hw/rtl8812au.nix
# mount points
../2configs/fs/sda-crypto-root-home.nix
# ../2configs/mediawiki.nix
@@ -59,7 +60,6 @@
networking.firewall.allowedUDPPorts = [ 665 ];
krebs.build.host = config.krebs.hosts.pornocauster;
-
krebs.hosts.omo.nets.retiolum.via.ip4.addr = "192.168.1.11";
krebs.retiolum = {
enable = true;
@@ -68,4 +68,6 @@
networking.extraHosts = ''
192.168.1.11 omo.local
'';
+ # hard dependency because otherwise the device will not be unlocked
+ boot.initrd.luks.devices = [ { name = "luksroot"; device = "/dev/sda2"; allowDiscards=true; }];
}
diff --git a/makefu/1systems/shoney.nix b/makefu/1systems/shoney.nix
new file mode 100644
index 000000000..ebe5222c3
--- /dev/null
+++ b/makefu/1systems/shoney.nix
@@ -0,0 +1,30 @@
+{ config, pkgs, ... }:
+let
+ ip = "64.137.235.70";
+ gw = "64.137.235.1";
+in {
+ imports = [
+ ../.
+ ../../tv/2configs/hw/CAC.nix
+ ../../tv/2configs/fs/CAC-CentOS-7-64bit.nix
+
+ ];
+
+ # minimal resources
+ services.nixosManual.enable = false;
+ programs.man.enable = false;
+ nix.gc.automatic = true;
+ nix.gc.dates = "03:10";
+
+ krebs = {
+ enable = true;
+ retiolum.enable = true;
+ build.host = config.krebs.hosts.shoney;
+ };
+ networking.interfaces.enp2s1.ip4 = [ {
+ address = ip;
+ prefixLength = 24;
+ } ];
+ networking.defaultGateway = gw;
+ networking.nameservers = [ "8.8.8.8" ];
+}