summaryrefslogtreecommitdiffstats
path: root/makefu/1systems
diff options
context:
space:
mode:
Diffstat (limited to 'makefu/1systems')
-rw-r--r--makefu/1systems/filepimp.nix25
-rw-r--r--makefu/1systems/gum.nix11
-rw-r--r--makefu/1systems/omo.nix98
-rw-r--r--makefu/1systems/pnp.nix67
-rw-r--r--makefu/1systems/pornocauster.nix16
-rw-r--r--makefu/1systems/vbob.nix1
-rw-r--r--makefu/1systems/wry.nix20
7 files changed, 164 insertions, 74 deletions
diff --git a/makefu/1systems/filepimp.nix b/makefu/1systems/filepimp.nix
index 66ea2ce90..2d008cee6 100644
--- a/makefu/1systems/filepimp.nix
+++ b/makefu/1systems/filepimp.nix
@@ -9,28 +9,35 @@
[ # Include the results of the hardware scan.
../2configs/fs/single-partition-ext4.nix
../2configs/tinc-basic-retiolum.nix
+ ../2configs/smart-monitor.nix
];
krebs.build.host = config.krebs.hosts.filepimp;
-
+ services.smartd.devices = [
+ { device = "/dev/sda"; }
+ { device = "/dev/sdb"; }
+ { device = "/dev/sdc"; }
+ { device = "/dev/sdd"; }
+ { device = "/dev/sde"; }
+ ];
# AMD N54L
boot = {
- loader.grub.device = "/dev/sda";
+ loader.grub.device = "/dev/sde";
initrd.availableKernelModules = [
- "usb_storage"
"ahci"
- "xhci_hcd"
- "ata_piix"
- "uhci_hcd"
+ "ohci_pci"
"ehci_pci"
+ "pata_atiixp"
+ "usb_storage"
+ "usbhid"
];
- kernelModules = [ ];
+ kernelModules = [ "kvm-amd" ];
extraModulePackages = [ ];
};
-
hardware.enableAllFirmware = true;
hardware.cpu.amd.updateMicrocode = true;
- networking.firewall.allowPing = true;
+ zramSwap.enable = true;
+ zramSwap.numDevices = 2;
}
diff --git a/makefu/1systems/gum.nix b/makefu/1systems/gum.nix
index 417a020fa..ac7524506 100644
--- a/makefu/1systems/gum.nix
+++ b/makefu/1systems/gum.nix
@@ -6,18 +6,22 @@ let
internal-ip = head config.krebs.build.host.nets.retiolum.addrs4;
in {
imports = [
- # TODO: copy this config or move to krebs
../2configs/tinc-basic-retiolum.nix
../2configs/headless.nix
../2configs/fs/simple-swap.nix
../2configs/fs/single-partition-ext4.nix
+ ../2configs/smart-monitor.nix
# ../2configs/iodined.nix
../2configs/git/cgit-retiolum.nix
../2configs/mattermost-docker.nix
../2configs/nginx/euer.test.nix
- ];
+ ../2configs/exim-retiolum.nix
+ ../2configs/urlwatch.nix
+
+ ];
+ services.smartd.devices = [ { device = "/dev/sda";} ];
nixpkgs.config.packageOverrides = pkgs: { tinc = pkgs.tinc_pre; };
###### stable
@@ -28,6 +32,9 @@ in {
ListenAddress = ${external-ip} 655
ListenAddress = ${external-ip} 21031
'';
+ krebs.nginx.servers.cgit.server-names = [
+ "cgit.euer.krebsco.de"
+ ];
# Chat
environment.systemPackages = with pkgs;[
diff --git a/makefu/1systems/omo.nix b/makefu/1systems/omo.nix
index 6ae79398a..552af4e4f 100644
--- a/makefu/1systems/omo.nix
+++ b/makefu/1systems/omo.nix
@@ -2,36 +2,110 @@
# your system. Help is available in the configuration.nix(5) man page
# and in the NixOS manual (accessible by running ‘nixos-help’).
-{ config, pkgs, ... }:
-
-{
+{ config, pkgs, lib, ... }:
+let
+ byid = dev: "/dev/disk/by-id/" + dev;
+ keyFile = "/dev/disk/by-id/usb-Verbatim_STORE_N_GO_070B3CEE0B223954-0:0";
+ rootDisk = byid "ata-INTEL_SSDSA2M080G2GC_CVPO003402PB080BGN";
+ homePartition = byid "ata-INTEL_SSDSA2M080G2GC_CVPO003402PB080BGN-part3";
+ # cryptsetup luksFormat $dev --cipher aes-xts-plain64 -s 512 -h sha512
+ # cryptsetup luksAddKey $dev tmpkey
+ # cryptsetup luksOpen $dev crypt0
+ # mkfs.xfs /dev/mapper/crypt0 -L crypt0
+ cryptDisk0 = byid "ata-ST2000DM001-1CH164_Z240XTT6";
+ cryptDisk1 = byid "ata-TP02000GB_TPW151006050068";
+ cryptDisk2 = byid "ata-WDC_WD20EARS-00MVWB0_WD-WCAZA5548487";
+ # all physical disks
+ allDisks = [ rootDisk cryptDisk0 cryptDisk1 cryptDisk2 ];
+in {
imports =
- [ # Include the results of the hardware scan.
+ [
+ # TODO: unlock home partition via ssh
../2configs/fs/single-partition-ext4.nix
../2configs/tinc-basic-retiolum.nix
+ ../2configs/zsh-user.nix
../2configs/exim-retiolum.nix
+ ../2configs/smart-monitor.nix
+ ../2configs/mail-client.nix
+ ../2configs/share-user-sftp.nix
+ ../2configs/nginx/omo-share.nix
+ ../3modules
];
+ # services.openssh.allowSFTP = false;
krebs.build.host = config.krebs.hosts.omo;
+ krebs.build.source.git.nixpkgs.rev = "d0e3cca04edd5d1b3d61f188b4a5f61f35cdf1ce";
+
+ # copy config from <secrets/sabnzbd.ini> to /var/lib/sabnzbd/
+ services.sabnzbd.enable = true;
+ systemd.services.sabnzbd.environment.SSL_CERT_FILE = "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt";
+
+ # HDD Array stuff
+ services.smartd.devices = builtins.map (x: { device = x; }) allDisks;
+
+ makefu.snapraid = let
+ toMapper = id: "/media/crypt${builtins.toString id}";
+ in {
+ enable = true;
+ disks = map toMapper [ 0 1 ];
+ parity = toMapper 2;
+ };
+ fileSystems = let
+ cryptMount = name:
+ { "/media/${name}" = { device = "/dev/mapper/${name}"; fsType = "xfs"; };};
+ in {
+ "/home" = {
+ device = "/dev/mapper/home";
+ fsType = "ext4";
+ };
+ } // cryptMount "crypt0"
+ // cryptMount "crypt1"
+ // cryptMount "crypt2";
+
+ powerManagement.powerUpCommands = lib.concatStrings (map (disk: ''
+ ${pkgs.hdparm}/sbin/hdparm -S 100 ${disk}
+ ${pkgs.hdparm}/sbin/hdparm -B 127 ${disk}
+ ${pkgs.hdparm}/sbin/hdparm -y ${disk}
+ '') allDisks);
- # AMD E350
boot = {
- loader.grub.device = "/dev/sda";
+ initrd.luks = {
+ devices = let
+ usbkey = name: device: {
+ inherit name device keyFile;
+ keyFileSize = 4096;
+ };
+ in [
+ (usbkey "home" homePartition)
+ (usbkey "crypt0" cryptDisk0)
+ (usbkey "crypt1" cryptDisk1)
+ (usbkey "crypt2" cryptDisk2)
+ ];
+ };
+ loader.grub.device = rootDisk;
initrd.availableKernelModules = [
- "usb_storage"
"ahci"
- "xhci_hcd"
- "ata_piix"
- "uhci_hcd"
+ "ohci_pci"
"ehci_pci"
+ "pata_atiixp"
+ "firewire_ohci"
+ "usb_storage"
+ "usbhid"
];
- kernelModules = [ ];
+ kernelModules = [ "kvm-amd" ];
extraModulePackages = [ ];
};
+ networking.firewall.allowedUDPPorts = [ 655 ];
+ # 8080: sabnzbd
+ networking.firewall.allowedTCPPorts = [ 80 655 8080 ];
+
hardware.enableAllFirmware = true;
hardware.cpu.amd.updateMicrocode = true;
- networking.firewall.allowPing = true;
+ zramSwap.enable = true;
+ zramSwap.numDevices = 2;
+
+
}
diff --git a/makefu/1systems/pnp.nix b/makefu/1systems/pnp.nix
index 161bfa3e9..51c124bbe 100644
--- a/makefu/1systems/pnp.nix
+++ b/makefu/1systems/pnp.nix
@@ -1,62 +1,51 @@
-# Edit this configuration file to define what should be installed on
-# your system. Help is available in the configuration.nix(5) man page
-# and in the NixOS manual (accessible by running ‘nixos-help’).
-
+# Usage:
+# NIX_PATH=secrets=/home/makefu/secrets/wry:nixpkgs=/var/src/nixpkgs nix-build -A users.makefu.pnp.config.system.build.vm
+# result/bin/run-pnp-vm -virtfs local,path=/home/makefu/secrets/pnp,security_model=none,mount_tag=secrets
{ config, pkgs, ... }:
{
imports =
- [ # Include the results of the hardware scan.
- # Base
+ [
../2configs/tinc-basic-retiolum.nix
../2configs/headless.nix
+ ../../krebs/3modules/Reaktor.nix
- # HW/FS
-
- # enables virtio kernel modules in initrd
+ # these will be overwritten by qemu-vm.nix but will be used if the system
+ # is directly deployed
<nixpkgs/nixos/modules/profiles/qemu-guest.nix>
../2configs/fs/vm-single-partition.nix
- # Services
- ../2configs/git/cgit-retiolum.nix
-
- ## Reaktor
- ## \/ are only plugins, must enable Reaktor explicitly
- ../2configs/Reaktor/stockholmLentil.nix
- ../2configs/Reaktor/simpleExtend.nix
- ../2configs/Reaktor/random-emoji.nix
- ../2configs/Reaktor/titlebot.nix
- ../2configs/Reaktor/shack-correct.nix
-
- ../2configs/exim-retiolum.nix
- ../2configs/urlwatch.nix
-
- # ../2configs/graphite-standalone.nix
+ # config.system.build.vm
+ <nixpkgs/nixos/modules/virtualisation/qemu-vm.nix>
];
- krebs.urlwatch.verbose = true;
- krebs.Reaktor.enable = true;
- krebs.Reaktor.debug = true;
- krebs.Reaktor.nickname = "Reaktor|bot";
- krebs.Reaktor.extraEnviron = {
- REAKTOR_CHANNELS = "#krebs,#binaergewitter,#shackspace";
+ virtualisation.graphics = false;
+ # also export secrets, see Usage above
+ fileSystems = pkgs.lib.mkVMOverride {
+ "${builtins.toString <secrets>}" =
+ { device = "secrets";
+ fsType = "9p";
+ options = "trans=virtio,version=9p2000.L,cache=loose";
+ neededForBoot = true;
+ };
+ };
+
+ krebs.Reaktor = {
+ enable = true;
+ debug = true;
+ extraEnviron = {
+ REAKTOR_HOST = "cd.retiolum";
+ };
+ plugins = with pkgs.ReaktorPlugins; [ stockholm-issue nixos-version sed-plugin ];
+ channels = [ "#retiolum" ];
};
krebs.build.host = config.krebs.hosts.pnp;
nixpkgs.config.packageOverrides = pkgs: { tinc = pkgs.tinc_pre; };
-
networking.firewall.allowedTCPPorts = [
- # nginx runs on 80
- 80
- # graphite-web runs on 8080, carbon cache runs on 2003 tcp and udp
- # 8080 2003
-
- # smtp
25
];
- # networking.firewall.allowedUDPPorts = [ 2003 ];
-
}
diff --git a/makefu/1systems/pornocauster.nix b/makefu/1systems/pornocauster.nix
index 28b77d330..d7fa8edc5 100644
--- a/makefu/1systems/pornocauster.nix
+++ b/makefu/1systems/pornocauster.nix
@@ -26,6 +26,7 @@
# services
../2configs/git/brain-retiolum.nix
../2configs/tor.nix
+ # ../2configs/buildbot-standalone.nix
# hardware specifics are in here
../2configs/hw/tp-x220.nix
@@ -34,16 +35,18 @@
# ../2configs/mediawiki.nix
#../2configs/wordpress.nix
];
+ hardware.sane.enable = true;
+ hardware.sane.extraBackends = [ pkgs.samsungUnifiedLinuxDriver ];
nixpkgs.config.packageOverrides = pkgs: {
tinc = pkgs.tinc_pre;
- buildbot = let
- pkgs1509 = import (fetchTarball https://github.com/NixOS/nixpkgs-channels/archive/nixos-unstable.tar.gz) {};
- in pkgs1509.buildbot;
};
- makefu.buildbot.master.enable = true;
- #krebs.Reaktor.enable = true;
- #krebs.Reaktor.nickname = "makefu|r";
+ krebs.Reaktor = {
+ enable = false;
+ nickname = "makefu|r";
+ plugins = with pkgs.ReaktorPlugins; [ nixos-version random-emoji ];
+ };
+
# nix.binaryCaches = [ "http://acng.shack/nixos" "https://cache.nixos.org" ];
environment.systemPackages = with pkgs;[
@@ -58,6 +61,7 @@
hardware.pulseaudio.configFile = pkgs.writeText "pulse-default-pa" ''
${builtins.readFile "${config.hardware.pulseaudio.package}/etc/pulse/default.pa"}
load-module module-alsa-sink device=hw:0,3 sink_properties=device.description="HDMIOutput" sink_name="HDMI"'';
+ networking.firewall.enable = false;
networking.firewall.allowedTCPPorts = [
25
];
diff --git a/makefu/1systems/vbob.nix b/makefu/1systems/vbob.nix
index a24cefd0d..b8c02cb67 100644
--- a/makefu/1systems/vbob.nix
+++ b/makefu/1systems/vbob.nix
@@ -59,7 +59,6 @@ in {
buildbot
buildbot-slave
get
- genid
];
networking.firewall.allowedTCPPorts = [
diff --git a/makefu/1systems/wry.nix b/makefu/1systems/wry.nix
index cd2b3f657..f022311c9 100644
--- a/makefu/1systems/wry.nix
+++ b/makefu/1systems/wry.nix
@@ -18,8 +18,6 @@ in {
../2configs/iodined.nix
- # Reaktor
- ../2configs/Reaktor/simpleExtend.nix
# other nginx
../2configs/nginx/euer.wiki.nix
@@ -29,9 +27,21 @@ in {
# collectd
../2configs/collectd/collectd-base.nix
];
+
krebs.build.host = config.krebs.hosts.wry;
- krebs.Reaktor.enable = true;
+ krebs.Reaktor = {
+ nickname = "Reaktor|bot";
+ channels = [ "#krebs" "#shackspace" "#binaergewitter" ];
+ enable = true;
+ plugins = with pkgs.ReaktorPlugins;[
+ titlebot
+ # stockholm-issue
+ nixos-version
+ shack-correct
+ sed-plugin
+ random-emoji ];
+ };
# bepasty to listen only on the correct interfaces
krebs.bepasty.servers.internal.nginx.listen = [ "${internal-ip}:80" ];
@@ -59,11 +69,11 @@ in {
};
networking = {
- firewall = {
+ firewall = {
allowPing = true;
logRefusedConnections = false;
allowedTCPPorts = [ 53 80 443 ];
- allowedUDPPorts = [ 655 ];
+ allowedUDPPorts = [ 655 53 ];
};
interfaces.enp2s1.ip4 = [{
address = external-ip;
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-08 16:50:50 +0000