Add NixOS configuration files. This is a foundation git commit that has now been deployed and working
This commit is contained in:
parent
d09ab1d526
commit
5b980771d9
GPG key ID:
087F0A95E5766D72
15 changed files with 4842 additions and 2 deletions
267
nix-system-configs/build/configuration.nix
Normal file
267
nix-system-configs/build/configuration.nix
Normal file
|
|
@ -0,0 +1,267 @@
|
|||
# Edit this configuration file to define what should be installed on
|
||||
# your system. Help is available in the configuration.nix(5) man page
|
||||
# and in the NixOS manual (accessible by running ‘nixos-help’).
|
||||
{
|
||||
config,
|
||||
pkgs,
|
||||
...
|
||||
}: {
|
||||
# Add Lix instead of Nix
|
||||
|
||||
nixpkgs.overlays = [
|
||||
(final: prev: {
|
||||
inherit
|
||||
(prev.lixPackageSets.stable)
|
||||
nixpkgs-review
|
||||
nix-eval-jobs
|
||||
nix-fast-build
|
||||
colmena
|
||||
;
|
||||
})
|
||||
];
|
||||
|
||||
nix.package = pkgs.lixPackageSets.stable.lix;
|
||||
|
||||
imports = [
|
||||
# Include the results of the hardware scan.
|
||||
./hardware-configuration.nix
|
||||
];
|
||||
|
||||
# Enable Rsymc
|
||||
services.rsync.enable = true;
|
||||
|
||||
# Passwordless sudo for wheel group
|
||||
security.sudo.wheelNeedsPassword = false;
|
||||
|
||||
# Hardware U2F support - Passwordless sudo with hardware key
|
||||
security.pam.u2f = {
|
||||
enable = true;
|
||||
settings = {
|
||||
authfile = "/etc/u2f_keys";
|
||||
cue = true;
|
||||
pinverification = 0; # No PIN verification
|
||||
userpresence = 1; # Require user presence (touch)
|
||||
};
|
||||
};
|
||||
|
||||
# Add to your configuration.nix
|
||||
# Optimize builds
|
||||
nix.settings = {
|
||||
# Enable parallel building
|
||||
max-jobs = "auto";
|
||||
cores = 0; # Use all available cores
|
||||
|
||||
# Optimize store operations
|
||||
auto-optimise-store = true;
|
||||
|
||||
# Build settings
|
||||
sandbox = true;
|
||||
keep-outputs = true;
|
||||
keep-derivations = true;
|
||||
};
|
||||
|
||||
# Enable distributed builds (optional, for your VM setup)
|
||||
nix.buildMachines = [];
|
||||
nix.distributedBuilds = false;
|
||||
|
||||
# Optimize garbage collection
|
||||
nix.gc = {
|
||||
automatic = true;
|
||||
dates = "weekly";
|
||||
options = "--delete-older-than 30d";
|
||||
};
|
||||
|
||||
# Increase build speed with tmpfs for builds (if you have enough RAM)
|
||||
# Comment out if low on memory
|
||||
systemd.services.nix-daemon.environment = {
|
||||
TMPDIR = "/tmp";
|
||||
};
|
||||
boot.tmp.useTmpfs = true;
|
||||
boot.tmp.tmpfsSize = "50%"; # Adjust based on your 62GB RAM
|
||||
|
||||
# For image building specifically
|
||||
virtualisation.vmVariant = {
|
||||
virtualisation = {
|
||||
memorySize = 4096; # Adjust for build-vm
|
||||
cores = 2;
|
||||
};
|
||||
};
|
||||
|
||||
# SSH Agent authentication
|
||||
security.pam.sshAgentAuth.enable = true;
|
||||
|
||||
# Automatic upgrades
|
||||
system.autoUpgrade = {
|
||||
enable = true; # Set to true for automatic updates
|
||||
dates = "daily";
|
||||
allowReboot = false;
|
||||
};
|
||||
|
||||
# Bootloader.
|
||||
boot.loader.systemd-boot.enable = true;
|
||||
boot.loader.efi.canTouchEfiVariables = true;
|
||||
|
||||
# Enable Tailscale
|
||||
services.tailscale.enable = true;
|
||||
|
||||
networking.hostName = "nixos-build-machine"; # Define your hostname.
|
||||
# networking.wireless.enable = true; # Enables wireless support via wpa_supplicant.
|
||||
|
||||
# Configure network proxy if necessary
|
||||
# networking.proxy.default = "http://user:password@proxy:port/";
|
||||
# networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";
|
||||
|
||||
# Enable networking
|
||||
networking.networkmanager.enable = true;
|
||||
|
||||
# Set your time zone.
|
||||
time.timeZone = "Europe/Copenhagen";
|
||||
|
||||
# Select internationalisation properties.
|
||||
i18n.defaultLocale = "en_AU.UTF-8";
|
||||
|
||||
i18n.extraLocaleSettings = {
|
||||
LC_ADDRESS = "en_AU.UTF-8";
|
||||
LC_IDENTIFICATION = "en_AU.UTF-8";
|
||||
LC_MEASUREMENT = "en_AU.UTF-8";
|
||||
LC_MONETARY = "en_AU.UTF-8";
|
||||
LC_NAME = "en_AU.UTF-8";
|
||||
LC_NUMERIC = "en_AU.UTF-8";
|
||||
LC_PAPER = "en_AU.UTF-8";
|
||||
LC_TELEPHONE = "en_AU.UTF-8";
|
||||
LC_TIME = "en_AU.UTF-8";
|
||||
};
|
||||
|
||||
# Configure keymap in X11
|
||||
services.xserver.xkb = {
|
||||
layout = "au";
|
||||
variant = "";
|
||||
};
|
||||
|
||||
# Define a user account. Don't forget to set a password with ‘passwd’.
|
||||
users.users.nixosbm = {
|
||||
isNormalUser = true;
|
||||
description = "NixOS Build Machine";
|
||||
extraGroups = ["networkmanager" "wheel"];
|
||||
packages = with pkgs; [];
|
||||
};
|
||||
|
||||
# Remote builder server setup
|
||||
users.users.nixremote = {
|
||||
isNormalUser = true;
|
||||
description = "Nix Remote Builder";
|
||||
home = "/home/nixremote";
|
||||
createHome = true;
|
||||
|
||||
# Lock the user account (no login shell)
|
||||
shell = pkgs.shadow;
|
||||
|
||||
# SSH key for remote builds
|
||||
openssh.authorizedKeys.keys = [
|
||||
# Add the public key from your client machines here
|
||||
# Example: "ssh-ed25519 AAAAC3... root@client-machine"
|
||||
];
|
||||
};
|
||||
|
||||
systemd.tmpfiles.rules = [
|
||||
"z /home/nixremote 0555 nixremote nixremote - -"
|
||||
"z /home/nixremote/.ssh 0555 nixremote nixremote - -"
|
||||
];
|
||||
|
||||
# Allow unfree packages
|
||||
nixpkgs.config.allowUnfree = true;
|
||||
|
||||
# List packages installed in system profile. To search, run:
|
||||
# $ nix search wget
|
||||
environment.systemPackages = with pkgs; [
|
||||
# vim # Do not forget to add an editor to edit configuration.nix! The Nano editor is also installed by default.
|
||||
wget
|
||||
fastfetch
|
||||
hyfetch
|
||||
helix
|
||||
];
|
||||
|
||||
# Some programs need SUID wrappers, can be configured further or are
|
||||
# started in user sessions.
|
||||
# programs.mtr.enable = true;
|
||||
programs.gnupg.agent = {
|
||||
enable = true;
|
||||
enableSSHSupport = true;
|
||||
};
|
||||
|
||||
# List services that you want to enable:
|
||||
|
||||
# Enable the OpenSSH daemon.
|
||||
services.openssh.enable = true;
|
||||
|
||||
# Open ports in the firewall.
|
||||
# networking.firewall.allowedTCPPorts = [ ... ];
|
||||
# networking.firewall.allowedUDPPorts = [ ... ];
|
||||
# Or disable the firewall altogether.
|
||||
# networking.firewall.enable = false;
|
||||
|
||||
# Attach the system to the IPFire network: set a static IP on the Proxmox bridge (ens18)
|
||||
# Adjust `ens18` and the address below to your environment.
|
||||
networking.interfaces.ens18.ipv4.addresses = [
|
||||
{
|
||||
address = "10.1.1.3";
|
||||
#dns = "10.1.1.2";
|
||||
prefixLength = 24;
|
||||
}
|
||||
];
|
||||
networking.defaultGateway = "10.1.1.1";
|
||||
environment.etc."resolv.conf".text = ''
|
||||
nameserver 10.1.1.2
|
||||
'';
|
||||
|
||||
# This value determines the NixOS release from which the default
|
||||
# settings for stateful data, like file locations and database versions
|
||||
# on your system were taken. It‘s perfectly fine and recommended to leave
|
||||
# this value at the release version of the first install of this system.
|
||||
# Before changing this value read the documentation for this option
|
||||
# (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
|
||||
system.stateVersion = "25.11"; # Did you read the comment?
|
||||
|
||||
# THE FOLLOWING CODE BLOCK IS FOR COPYING TO OTHER CONFIGURATIONS, NOT FOR THIS FILE
|
||||
# nix.distributedBuilds = true;
|
||||
# nix.buildMachines = [
|
||||
# {
|
||||
# hostName = "nixos-build-machine";
|
||||
# system = "x86_64-linux";
|
||||
# sshUser = "nixremote";
|
||||
# sshKey = "/root/.ssh/nixremote";
|
||||
# maxJobs = 4;
|
||||
# speedFactor = 2;
|
||||
# supportedFeatures = [ "nixos-test" "benchmark" "big-parallel" "kvm" ];
|
||||
# }
|
||||
# ];
|
||||
#
|
||||
# Generate SSH key for remote building
|
||||
#systemd.services.generate-nixremote-key = {
|
||||
# description = "Generate SSH key for remote Nix builds";
|
||||
# wantedBy = [ "multi-user.target" ];
|
||||
# serviceConfig = {
|
||||
# Type = "oneshot";
|
||||
# RemainAfterExit = true;
|
||||
# };
|
||||
# script = ''
|
||||
# if [ ! -f /root/.ssh/nixremote ]; then
|
||||
# ${pkgs.openssh}/bin/ssh-keygen -t ed25519 -f /root/.ssh/nixremote -N "" -C "nix-remote-builder"
|
||||
# fi
|
||||
# '';
|
||||
#};
|
||||
#
|
||||
#programs.ssh.extraConfig = ''
|
||||
# Host nixos-build-machine
|
||||
# HostName 192.168.1.175
|
||||
# IdentitiesOnly yes
|
||||
# IdentityFile /root/.ssh/nixremote
|
||||
# User nixremoteStrictHostKeyChecking accept-new
|
||||
#'';
|
||||
#
|
||||
# Manual step required: After rebuilding the client, copy /root/.ssh/nixremote.pub
|
||||
# from the client to the build machine's users.users.nixremote.openssh.authorizedKeys.keys list,
|
||||
# then rebuild the build machine.
|
||||
# i.e on the client: run "cat /root.ssh/nixremote.pub"
|
||||
# and copy the output to the build machine's configuration.nix
|
||||
}
|
||||
180
nix-system-configs/database/configuration.nix
Normal file
180
nix-system-configs/database/configuration.nix
Normal file
|
|
@ -0,0 +1,180 @@
|
|||
# Edit this configuration file to define what should be installed on
|
||||
# your system. Help is available in the configuration.nix(5) man page
|
||||
# and in the NixOS manual (accessible by running ‘nixos-help’).
|
||||
{
|
||||
config,
|
||||
pkgs,
|
||||
...
|
||||
}: {
|
||||
# Add Lix instead of Nix
|
||||
nixpkgs.overlays = [
|
||||
(final: prev: {
|
||||
inherit
|
||||
(prev.lixPackageSets.stable)
|
||||
nixpkgs-review
|
||||
nix-eval-jobs
|
||||
nix-fast-build
|
||||
colmena
|
||||
;
|
||||
})
|
||||
];
|
||||
nix.package = pkgs.lixPackageSets.stable.lix;
|
||||
|
||||
imports = [
|
||||
# Include the results of the hardware scan.
|
||||
./hardware-configuration.nix
|
||||
];
|
||||
|
||||
# Bootloader.
|
||||
boot.loader.systemd-boot.enable = true;
|
||||
boot.loader.efi.canTouchEfiVariables = true;
|
||||
|
||||
networking.hostName = "nixosdd"; # Define your hostname.
|
||||
# networking.wireless.enable = true; # Enables wireless support via wpa_supplicant.
|
||||
|
||||
# Configure network proxy if necessary
|
||||
# networking.proxy.default = "http://user:password@proxy:port/";
|
||||
# networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";
|
||||
|
||||
# Enable networking
|
||||
networking.networkmanager.enable = true;
|
||||
|
||||
# Set your time zone.
|
||||
time.timeZone = "Europe/Copenhagen";
|
||||
|
||||
# Select internationalisation properties.
|
||||
i18n.defaultLocale = "en_AU.UTF-8";
|
||||
|
||||
i18n.extraLocaleSettings = {
|
||||
LC_ADDRESS = "en_AU.UTF-8";
|
||||
LC_IDENTIFICATION = "en_AU.UTF-8";
|
||||
LC_MEASUREMENT = "en_AU.UTF-8";
|
||||
LC_MONETARY = "en_AU.UTF-8";
|
||||
LC_NAME = "en_AU.UTF-8";
|
||||
LC_NUMERIC = "en_AU.UTF-8";
|
||||
LC_PAPER = "en_AU.UTF-8";
|
||||
LC_TELEPHONE = "en_AU.UTF-8";
|
||||
LC_TIME = "en_AU.UTF-8";
|
||||
};
|
||||
|
||||
# Enable the X11 windowing system.
|
||||
services.xserver.enable = true;
|
||||
|
||||
# Enable the GNOME Desktop Environment.
|
||||
services.xserver.displayManager.gdm.enable = true;
|
||||
services.xserver.desktopManager.gnome.enable = true;
|
||||
|
||||
# Configure keymap in X11
|
||||
services.xserver.xkb = {
|
||||
layout = "us";
|
||||
variant = "";
|
||||
};
|
||||
|
||||
# Enable CUPS to print documents.
|
||||
services.printing.enable = true;
|
||||
|
||||
# Enable sound with pipewire.
|
||||
services.pulseaudio.enable = false;
|
||||
security.rtkit.enable = true;
|
||||
services.pipewire = {
|
||||
enable = true;
|
||||
alsa.enable = true;
|
||||
alsa.support32Bit = true;
|
||||
pulse.enable = true;
|
||||
# If you want to use JACK applications, uncomment this
|
||||
#jack.enable = true;
|
||||
|
||||
# use the example session manager (no others are packaged yet so this is enabled by default,
|
||||
# no need to redefine it in your config for now)
|
||||
#media-session.enable = true;
|
||||
};
|
||||
|
||||
# Enable touchpad support (enabled default in most desktopManager).
|
||||
# services.xserver.libinput.enable = true;
|
||||
|
||||
# Define a user account. Don't forget to set a password with ‘passwd’.
|
||||
users.users.nixosdd = {
|
||||
isNormalUser = true;
|
||||
description = "NixOS Dedicated Database";
|
||||
extraGroups = ["networkmanager" "wheel"];
|
||||
packages = with pkgs; [
|
||||
# thunderbird
|
||||
];
|
||||
};
|
||||
|
||||
# Enable Tailscale
|
||||
services.tailscale.enable = true;
|
||||
|
||||
# Install firefox.
|
||||
programs.firefox.enable = true;
|
||||
|
||||
# Allow unfree packages
|
||||
nixpkgs.config.allowUnfree = true;
|
||||
|
||||
# List packages installed in system profile. To search, run:
|
||||
# $ nix search wget
|
||||
environment.systemPackages = with pkgs; [
|
||||
# vim # Do not forget to add an editor to edit configuration.nix! The Nano editor is also installed by default.
|
||||
wget
|
||||
helix
|
||||
fastfetch
|
||||
hyfetch
|
||||
pgadmin4
|
||||
];
|
||||
|
||||
# Some programs need SUID wrappers, can be configured further or are
|
||||
# started in user sessions.
|
||||
programs.mtr.enable = true;
|
||||
programs.gnupg.agent = {
|
||||
enable = true;
|
||||
enableSSHSupport = true;
|
||||
};
|
||||
|
||||
# List services that you want to enable:
|
||||
|
||||
# Enable PostgreSQL
|
||||
services.postgresql = {
|
||||
enable = true;
|
||||
enableTCPIP = true;
|
||||
ensureDatabases = ["forgejo"];
|
||||
settings = {
|
||||
listen_addresses = "*";
|
||||
};
|
||||
authentication = pkgs.lib.mkOverride 10 ''
|
||||
local all all trust
|
||||
host all all 10.1.1.4/32 scram-sha-256
|
||||
host all all 127.0.0.1/32 trust
|
||||
host all all ::1/128 trust
|
||||
'';
|
||||
};
|
||||
|
||||
# Enable the OpenSSH daemon.
|
||||
services.openssh.enable = true;
|
||||
|
||||
# Open ports in the firewall.
|
||||
networking.firewall.allowedTCPPorts = [5432]; # PostgreSQL default port
|
||||
# networking.firewall.allowedUDPPorts = [ ... ];
|
||||
# Or disable the firewall altogether.
|
||||
# networking.firewall.enable = false;
|
||||
|
||||
# Attach the system to the IPFire network: set a static IP on the Proxmox bridge (ens18)
|
||||
# Adjust `ens18` and the address below to your environment.
|
||||
networking.interfaces.ens18.ipv4.addresses = [
|
||||
{
|
||||
address = "10.1.1.251";
|
||||
prefixLength = 24;
|
||||
}
|
||||
];
|
||||
networking.defaultGateway = "10.1.1.1";
|
||||
environment.etc."resolv.conf".text = ''
|
||||
nameserver 10.1.1.2
|
||||
'';
|
||||
|
||||
# This value determines the NixOS release from which the default
|
||||
# settings for stateful data, like file locations and database versions
|
||||
# on your system were taken. It‘s perfectly fine and recommended to leave
|
||||
# this value at the release version of the first install of this system.
|
||||
# Before changing this value read the documentation for this option
|
||||
# (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
|
||||
system.stateVersion = "25.11"; # Did you read the comment?
|
||||
}
|
||||
391
nix-system-configs/dns/configuration-knot.nix
Normal file
391
nix-system-configs/dns/configuration-knot.nix
Normal file
|
|
@ -0,0 +1,391 @@
|
|||
# Edit this configuration file to define what should be installed on
|
||||
# your system. Help is available in the configuration-knot.nix(5) man page
|
||||
# and in the NixOS manual (accessible by running ‘nixos-help’).
|
||||
{
|
||||
config,
|
||||
pkgs,
|
||||
lib,
|
||||
...
|
||||
}: let
|
||||
home-manager = builtins.fetchTarball "https://github.com/nix-community/home-manager/archive/release-25.11.tar.gz";
|
||||
in {
|
||||
# Home Manager Configuration
|
||||
imports = [
|
||||
(import "${home-manager}/nixos")
|
||||
];
|
||||
|
||||
## Ensure that configuration is copied after installing this NixOS image
|
||||
system.copySystemConfiguration = true;
|
||||
|
||||
# Use Lix instead of Nix
|
||||
nixpkgs.overlays = [
|
||||
(final: prev: {
|
||||
inherit
|
||||
(prev.lixPackageSets.stable)
|
||||
nixpkgs-review
|
||||
nix-eval-jobs
|
||||
nix-fast-build
|
||||
colmena
|
||||
;
|
||||
})
|
||||
];
|
||||
|
||||
nix.package = pkgs.lixPackageSets.stable.lix;
|
||||
|
||||
# Bootloader - GRUB for Proxmox
|
||||
# Bootloader - systemd-boot with UEFI
|
||||
boot.loader.grub.enable = lib.mkForce false;
|
||||
boot. loader.systemd-boot.enable = true;
|
||||
boot.loader.efi.canTouchEfiVariables = false;
|
||||
boot.loader.efi.efiSysMountPoint = "/boot";
|
||||
|
||||
# Proxmox configuration
|
||||
proxmox.qemuConf = {
|
||||
bios = "ovmf"; # Use OVMF for UEFI
|
||||
};
|
||||
|
||||
boot.initrd.availableKernelModules = ["virtio_pci" "virtio_scsi" "ahci" "sd_mod"];
|
||||
|
||||
networking.hostName = "nixosp"; # Define your hostname.
|
||||
#networking.wireless.enable = true; # Enables wireless support via wpa_supplicant.
|
||||
|
||||
# Enable Rsymc
|
||||
services.rsync.enable = true;
|
||||
|
||||
# Configure network proxy if necessary
|
||||
# networking.proxy.default = "http://user:password@proxy:port/";
|
||||
# networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";
|
||||
|
||||
# Enable networking
|
||||
networking.networkmanager.enable = true;
|
||||
networking.useDHCP = lib.mkDefault true;
|
||||
# Serial console for Proxmox
|
||||
boot.kernelParams = ["console=tty0" "console=ttyS0,115200"];
|
||||
# Enable QEMU Guest for Proxmox integration
|
||||
services.qemuGuest.enable = true;
|
||||
services.spice-vdagentd.enable = true;
|
||||
|
||||
# Enable SSH
|
||||
services.openssh = {
|
||||
enable = true;
|
||||
ports = [22];
|
||||
settings = {
|
||||
PasswordAuthentication = false;
|
||||
AllowUsers = null;
|
||||
UseDns = true;
|
||||
PermitRootLogin = "no";
|
||||
};
|
||||
};
|
||||
|
||||
# Set your time zone.
|
||||
time.timeZone = "Europe/Copenhagen";
|
||||
|
||||
# Select internationalisation properties.
|
||||
i18n.defaultLocale = "en_GB.UTF-8";
|
||||
|
||||
i18n.extraLocaleSettings = {
|
||||
LC_ADDRESS = "et_EE.UTF-8";
|
||||
LC_IDENTIFICATION = "et_EE.UTF-8";
|
||||
LC_MEASUREMENT = "et_EE.UTF-8";
|
||||
LC_MONETARY = "et_EE.UTF-8";
|
||||
LC_NAME = "et_EE.UTF-8";
|
||||
LC_NUMERIC = "et_EE.UTF-8";
|
||||
LC_PAPER = "et_EE.UTF-8";
|
||||
LC_TELEPHONE = "et_EE.UTF-8";
|
||||
LC_TIME = "et_EE.UTF-8";
|
||||
};
|
||||
|
||||
# Configure keymap in X11
|
||||
services.xserver.xkb = {
|
||||
layout = "us";
|
||||
variant = "";
|
||||
};
|
||||
|
||||
# Enable Seatd for Wayland sessions
|
||||
# IMPORTANT: Enable seatd service for River WM
|
||||
services.seatd = {
|
||||
enable = true;
|
||||
logLevel = "info";
|
||||
};
|
||||
|
||||
# Enable the gnome-keyring secrets vault.
|
||||
# Will be exposed through DBus to programs willing to store secrets.
|
||||
services.gnome.gnome-keyring.enable = true;
|
||||
|
||||
# Enable Sway window manager
|
||||
programs.sway = {
|
||||
enable = true;
|
||||
wrapperFeatures.gtk = true;
|
||||
};
|
||||
|
||||
services.greetd = {
|
||||
enable = true;
|
||||
settings = {
|
||||
default_session = {
|
||||
command = "${pkgs.tuigreet}/bin/tuigreet --time --cmd sway";
|
||||
user = "greeter";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
# Configure security to allow seatd access
|
||||
security.polkit.enable = true;
|
||||
|
||||
# Configure GPU support
|
||||
hardware.graphics = {
|
||||
enable = true;
|
||||
enable32Bit = true;
|
||||
};
|
||||
|
||||
# Define a user account. Don't forget to set a password with ‘passwd’.
|
||||
# Copy this later to generate more custom users.
|
||||
users.users.nixosp = {
|
||||
isNormalUser = true;
|
||||
description = "NixOS Playground";
|
||||
extraGroups = ["networkmanager" "wheel" "seat"];
|
||||
packages = with pkgs; [];
|
||||
initialPassword = "nixos"; # Simple, change on first login
|
||||
};
|
||||
|
||||
home-manager.users.nixosp = {pkgs, ...}: {
|
||||
home.packages = [
|
||||
pkgs.atool
|
||||
pkgs.httpie
|
||||
pkgs.alacritty # Terminal emulator
|
||||
pkgs.hyfetch # Add fetching packages
|
||||
pkgs.macchina
|
||||
pkgs.wayland # Wayland display server
|
||||
pkgs.wlroots # Wayland compositor library
|
||||
pkgs.maple-mono.NF # Font for better terminal appearance
|
||||
pkgs.wl-clipboard # Clipboard utilities for Wayland
|
||||
pkgs.mako # Wayland Sway Notification Daemon
|
||||
pkgs.btop # Resource monitor
|
||||
];
|
||||
|
||||
# Set Alacritty as the default terminal emulator
|
||||
home.sessionVariables = {
|
||||
TERMINAL = "alacritty";
|
||||
};
|
||||
|
||||
# Use Zsh as the default shell
|
||||
programs.zsh.enable = true;
|
||||
|
||||
# Configure Alacritty as the default terminal emulator
|
||||
programs.alacritty = {
|
||||
enable = true;
|
||||
settings = {
|
||||
# Window configuration
|
||||
window = {
|
||||
opacity = 1.0;
|
||||
padding = {
|
||||
x = 10;
|
||||
y = 10;
|
||||
};
|
||||
};
|
||||
|
||||
# Font configuration - fixes spacing isues
|
||||
font = {
|
||||
normal = {
|
||||
family = "Maple Mono NF";
|
||||
style = "Regular";
|
||||
};
|
||||
bold = {
|
||||
family = "Maple Mono NF";
|
||||
style = "Bold";
|
||||
};
|
||||
italic = {
|
||||
family = "Maple Mono NF";
|
||||
style = "Italic";
|
||||
};
|
||||
bold_italic = {
|
||||
family = "Maple Mono NF";
|
||||
style = "Bold Italic";
|
||||
};
|
||||
size = 14.0;
|
||||
};
|
||||
|
||||
# Colors (optional - using default Alacritty colors)
|
||||
colors = {
|
||||
primary = {
|
||||
background = "#1e1e2e";
|
||||
foreground = "#cdd6f4";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
# Configure Hyfetch system info fetcher
|
||||
programs.hyfetch = {
|
||||
enable = true;
|
||||
settings = {
|
||||
preset = "lesbian"; # Use lesbian flag preset
|
||||
mode = "rgb"; # Use RGB color mode
|
||||
lightness = 0.55; # Set to 55% brightness
|
||||
backend = "macchina"; # Use macchina as the backend
|
||||
logo_size = "small"; # Make small logo
|
||||
pride_month_disable = false; # Enable pride month mode (or true to disable)
|
||||
pride_month_shown = []; # List of shown pride month flags
|
||||
color_align = {
|
||||
mode = "horizontal";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
# The state version is required and should stay at the version you
|
||||
# originally installed.
|
||||
home.stateVersion = "25.11";
|
||||
};
|
||||
|
||||
# Allow unfree packages
|
||||
nixpkgs.config.allowUnfree = true;
|
||||
|
||||
# Passwordless sudo for wheel group
|
||||
security.sudo.wheelNeedsPassword = false;
|
||||
|
||||
# Hardware U2F support - Passwordless sudo with hardware key
|
||||
security.pam.u2f = {
|
||||
enable = true;
|
||||
settings = {
|
||||
authfile = "/etc/u2f_keys";
|
||||
cue = true;
|
||||
pinverification = 0; # No PIN verification
|
||||
userpresence = 1; # Require user presence (touch)
|
||||
};
|
||||
};
|
||||
|
||||
# SSH Agent authentication
|
||||
security.pam.sshAgentAuth.enable = true;
|
||||
|
||||
# Automatic upgrades
|
||||
system.autoUpgrade = {
|
||||
enable = true; # Set to true for automatic updates
|
||||
dates = "daily";
|
||||
allowReboot = false;
|
||||
};
|
||||
|
||||
# System packages
|
||||
environment.systemPackages = with pkgs; [
|
||||
# Network tools
|
||||
wget
|
||||
curl
|
||||
dig
|
||||
tcpdump
|
||||
ethtool
|
||||
iptables
|
||||
nftables
|
||||
iproute2
|
||||
bridge-utils
|
||||
netcat-gnu
|
||||
traceroute
|
||||
mtr
|
||||
|
||||
# Add the ability to create NixOS images
|
||||
nixos-generators
|
||||
|
||||
# Monitoring
|
||||
btop
|
||||
htop
|
||||
iotop
|
||||
bandwhich
|
||||
|
||||
# Editors
|
||||
micro
|
||||
vim
|
||||
helix
|
||||
|
||||
# System info
|
||||
fastfetch
|
||||
lshw
|
||||
pciutils
|
||||
usbutils
|
||||
|
||||
# Filesystem utilities
|
||||
btrfs-progs
|
||||
e2fsprogs
|
||||
ntfs3g
|
||||
dosfstools
|
||||
os-prober
|
||||
|
||||
# Development tools
|
||||
knot-dns
|
||||
];
|
||||
|
||||
# Enable zram swap
|
||||
zramSwap = {
|
||||
enable = true;
|
||||
memoryPercent = 50;
|
||||
};
|
||||
|
||||
# Some programs need SUID wrappers, can be configured further or are
|
||||
# started in user sessions.
|
||||
# programs.mtr.enable = true;
|
||||
# programs.gnupg.agent = {
|
||||
# enable = true;
|
||||
# enableSSHSupport = true;
|
||||
# };
|
||||
|
||||
# Attach the system to the IPFire network: set a static IP on the Proxmox bridge (vmbr0)
|
||||
# Adjust `vmbr0` and the address below to your environment.
|
||||
networking.interfaces.vmbr0.ipv4.addresses = [
|
||||
{
|
||||
address = "192.168.2.6";
|
||||
prefixLength = 24;
|
||||
} # Using this IP for DNS server
|
||||
];
|
||||
networking.defaultGateway = "192.168.2.1";
|
||||
|
||||
# Make the system use your new DNS by default (optional)
|
||||
networking.nameservers = ["192.168.2.6"];
|
||||
|
||||
# Expose DNS ports to the LAN
|
||||
networking.firewall.allowedUDPPorts = lib.mkDefault [53];
|
||||
networking.firewall.allowedTCPPorts = lib.mkDefault [53];
|
||||
|
||||
# Knot configuration using YAML-like settings supported by the Nix module
|
||||
services.knot = {
|
||||
enable = true;
|
||||
|
||||
settings = {
|
||||
server = [
|
||||
{
|
||||
listen = ["192.168.2.6@53"];
|
||||
identity = "knot-homelab";
|
||||
pid-file = "/var/run/knot.pid";
|
||||
# worker-count = 2;
|
||||
}
|
||||
];
|
||||
|
||||
control = [
|
||||
{
|
||||
listen = "127.0.0.1@7520";
|
||||
}
|
||||
];
|
||||
|
||||
log = [
|
||||
{
|
||||
target = "syslog";
|
||||
any = "info";
|
||||
}
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
# List services that you want to enable:
|
||||
|
||||
# Enable the OpenSSH daemon.
|
||||
# services.openssh.enable = true;
|
||||
|
||||
# Open ports in the firewall.
|
||||
# networking.firewall.allowedTCPPorts = [ ... ];
|
||||
# networking.firewall.allowedUDPPorts = [ ... ];
|
||||
# Or disable the firewall altogether.
|
||||
# networking.firewall.enable = false;
|
||||
|
||||
# This value determines the NixOS release from which the default
|
||||
# settings for stateful data, like file locations and database versions
|
||||
# on your system were taken. It‘s perfectly fine and recommended to leave
|
||||
# this value at the release version of the first install of this system.
|
||||
# Before changing this value read the documentation for this option
|
||||
# (e.g. man configuration-knot.nix or on https://nixos.org/nixos/options.html).
|
||||
system.stateVersion = "25.11"; # Did you read the comment?
|
||||
}
|
||||
687
nix-system-configs/dns/configuration-pihole-green.nix
Normal file
687
nix-system-configs/dns/configuration-pihole-green.nix
Normal file
|
|
@ -0,0 +1,687 @@
|
|||
# Edit this configuration file to define what should be installed on
|
||||
# your system. Help is available in the configuration-knot.nix(5) man page
|
||||
# and in the NixOS manual (accessible by running 'nixos-help').
|
||||
{
|
||||
config,
|
||||
pkgs,
|
||||
lib,
|
||||
...
|
||||
}: let
|
||||
home-manager = builtins.fetchTarball "https://github.com/nix-community/home-manager/archive/release-25.11.tar.gz";
|
||||
in {
|
||||
# Home Manager Configuration
|
||||
imports = [
|
||||
(import "${home-manager}/nixos")
|
||||
];
|
||||
|
||||
## Ensure that configuration is copied after installing this NixOS image
|
||||
system.copySystemConfiguration = true;
|
||||
|
||||
# Use Lix instead of Nix
|
||||
nixpkgs.overlays = [
|
||||
(final: prev: {
|
||||
inherit
|
||||
(prev. lixPackageSets.stable)
|
||||
nixpkgs-review
|
||||
nix-eval-jobs
|
||||
nix-fast-build
|
||||
colmena
|
||||
;
|
||||
})
|
||||
];
|
||||
|
||||
nix. package = pkgs.lixPackageSets.stable. lix;
|
||||
|
||||
# Bootloader - GRUB for Proxmox
|
||||
# Bootloader - systemd-boot with UEFI
|
||||
boot.loader.grub.enable = lib.mkForce false;
|
||||
boot.loader.systemd-boot.enable = true;
|
||||
boot.loader.efi.canTouchEfiVariables = false;
|
||||
boot.loader.efi.efiSysMountPoint = "/boot";
|
||||
|
||||
# Proxmox configuration
|
||||
proxmox.qemuConf = {
|
||||
bios = "ovmf"; # Use OVMF for UEFI
|
||||
};
|
||||
boot.initrd.availableKernelModules = ["virtio_pci" "virtio_scsi" "ahci" "sd_mod"];
|
||||
|
||||
networking.hostName = "piholeprg"; # Define your hostname.
|
||||
#networking.wireless.enable = true; # Enables wireless support via wpa_supplicant.
|
||||
|
||||
# Enable Rsymc
|
||||
services.rsync.enable = true;
|
||||
|
||||
# Configure network proxy if necessary
|
||||
# networking.proxy.default = "http://user:password@proxy:port/";
|
||||
# networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";
|
||||
|
||||
# Enable networking
|
||||
networking.networkmanager. enable = true;
|
||||
networking. useDHCP = lib.mkDefault true;
|
||||
# Serial console for Proxmox
|
||||
boot.kernelParams = ["console=tty0" "console=ttyS0,115200"];
|
||||
# Enable QEMU Guest for Proxmox integration
|
||||
services.qemuGuest.enable = true;
|
||||
services.spice-vdagentd.enable = true;
|
||||
|
||||
# Enable SSH
|
||||
services.openssh = {
|
||||
enable = true;
|
||||
ports = [22];
|
||||
settings = {
|
||||
PasswordAuthentication = false;
|
||||
AllowUsers = null;
|
||||
UseDns = true;
|
||||
PermitRootLogin = "no";
|
||||
};
|
||||
};
|
||||
|
||||
# Set your time zone.
|
||||
time. timeZone = "Europe/Copenhagen";
|
||||
|
||||
# Select internationalisation properties.
|
||||
i18n.defaultLocale = "en_GB.UTF-8";
|
||||
|
||||
i18n.extraLocaleSettings = {
|
||||
LC_ADDRESS = "et_EE.UTF-8";
|
||||
LC_IDENTIFICATION = "et_EE.UTF-8";
|
||||
LC_MEASUREMENT = "et_EE.UTF-8";
|
||||
LC_MONETARY = "et_EE.UTF-8";
|
||||
LC_NAME = "et_EE.UTF-8";
|
||||
LC_NUMERIC = "et_EE.UTF-8";
|
||||
LC_PAPER = "et_EE.UTF-8";
|
||||
LC_TELEPHONE = "et_EE.UTF-8";
|
||||
LC_TIME = "et_EE.UTF-8";
|
||||
};
|
||||
|
||||
# Configure keymap in X11
|
||||
services.xserver. xkb = {
|
||||
layout = "us";
|
||||
variant = "";
|
||||
};
|
||||
|
||||
# Enable Seatd for Wayland sessions
|
||||
# IMPORTANT: Enable seatd service for River WM
|
||||
services.seatd = {
|
||||
enable = true;
|
||||
logLevel = "info";
|
||||
};
|
||||
|
||||
# Enable the gnome-keyring secrets vault.
|
||||
# Will be exposed through DBus to programs willing to store secrets.
|
||||
services. gnome.gnome-keyring.enable = true;
|
||||
|
||||
# Enable Sway window manager
|
||||
programs.sway = {
|
||||
enable = true;
|
||||
wrapperFeatures.gtk = true;
|
||||
};
|
||||
|
||||
services.greetd = {
|
||||
enable = true;
|
||||
settings = {
|
||||
default_session = {
|
||||
command = "${pkgs.tuigreet}/bin/tuigreet --time --cmd sway";
|
||||
user = "greeter";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
# Configure security to allow seatd access
|
||||
security.polkit.enable = true;
|
||||
|
||||
# Configure GPU support
|
||||
hardware.graphics = {
|
||||
enable = true;
|
||||
enable32Bit = true;
|
||||
};
|
||||
|
||||
# Define a user account. Don't forget to set a password with 'passwd'.
|
||||
# Copy this later to generate more custom users.
|
||||
users.users.piholeprg = {
|
||||
isNormalUser = true;
|
||||
description = "NixOS Playground";
|
||||
extraGroups = ["networkmanager" "wheel" "seat"];
|
||||
packages = with pkgs; [];
|
||||
initialPassword = "nixos"; # Simple, change on first login
|
||||
};
|
||||
|
||||
home-manager.users.piholeprg = {pkgs, ...}: {
|
||||
home.packages = [
|
||||
pkgs.atool
|
||||
pkgs.httpie
|
||||
pkgs.alacritty # Terminal emulator
|
||||
pkgs. hyfetch # Add fetching packages
|
||||
pkgs.macchina
|
||||
pkgs.wayland # Wayland display server
|
||||
pkgs.wlroots # Wayland compositor library
|
||||
pkgs.maple-mono. NF # Font for better terminal appearance
|
||||
pkgs.wl-clipboard # Clipboard utilities for Wayland
|
||||
pkgs.mako # Wayland Sway Notification Daemon
|
||||
pkgs.btop # Resource monitor
|
||||
];
|
||||
|
||||
# Configure LibreWolf browser
|
||||
programs.librewolf = {
|
||||
enable = true;
|
||||
# Enable WebGL, cookies and history
|
||||
settings = {
|
||||
"webgl.disabled" = false;
|
||||
"privacy.resistFingerprinting" = true;
|
||||
"privacy.clearOnShutdown. history" = false;
|
||||
"privacy.clearOnShutdown.cookies" = true;
|
||||
};
|
||||
};
|
||||
|
||||
# Set Alacritty as the default terminal emulator
|
||||
home.sessionVariables = {
|
||||
TERMINAL = "alacritty";
|
||||
};
|
||||
|
||||
# Use Zsh as the default shell
|
||||
programs.zsh. enable = true;
|
||||
|
||||
# Configure Alacritty as the default terminal emulator
|
||||
programs.alacritty = {
|
||||
enable = true;
|
||||
settings = {
|
||||
# Window configuration
|
||||
window = {
|
||||
opacity = 1.0;
|
||||
padding = {
|
||||
x = 10;
|
||||
y = 10;
|
||||
};
|
||||
};
|
||||
|
||||
# Font configuration - fixes spacing issues
|
||||
font = {
|
||||
normal = {
|
||||
family = "Maple Mono NF";
|
||||
style = "Regular";
|
||||
};
|
||||
bold = {
|
||||
family = "Maple Mono NF";
|
||||
style = "Bold";
|
||||
};
|
||||
italic = {
|
||||
family = "Maple Mono NF";
|
||||
style = "Italic";
|
||||
};
|
||||
bold_italic = {
|
||||
family = "Maple Mono NF";
|
||||
style = "Bold Italic";
|
||||
};
|
||||
size = 14.0;
|
||||
};
|
||||
|
||||
# Colors (optional - using default Alacritty colors)
|
||||
colors = {
|
||||
primary = {
|
||||
background = "#1e1e2e";
|
||||
foreground = "#cdd6f4";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
# Configure Hyfetch system info fetcher
|
||||
programs.hyfetch = {
|
||||
enable = true;
|
||||
settings = {
|
||||
preset = "lesbian"; # Use lesbian flag preset
|
||||
mode = "rgb"; # Use RGB color mode
|
||||
lightness = 0.55; # Set to 55% brightness
|
||||
backend = "macchina"; # Use macchina as the backend
|
||||
logo_size = "small"; # Make small logo
|
||||
pride_month_disable = false; # Enable pride month mode (or true to disable)
|
||||
pride_month_shown = []; # List of shown pride month flags
|
||||
color_align = {
|
||||
mode = "horizontal";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
# The state version is required and should stay at the version you
|
||||
# originally installed.
|
||||
home.stateVersion = "25.11";
|
||||
};
|
||||
|
||||
# Allow unfree packages
|
||||
nixpkgs.config.allowUnfree = true;
|
||||
|
||||
# Passwordless sudo for wheel group
|
||||
security.sudo. wheelNeedsPassword = false;
|
||||
|
||||
# Hardware U2F support - Passwordless sudo with hardware key
|
||||
security.pam.u2f = {
|
||||
enable = true;
|
||||
settings = {
|
||||
authfile = "/etc/u2f_keys";
|
||||
cue = true;
|
||||
pinverification = 0; # No PIN verification
|
||||
userpresence = 1; # Require user presence (touch)
|
||||
};
|
||||
};
|
||||
|
||||
# SSH Agent authentication
|
||||
security.pam.sshAgentAuth. enable = true;
|
||||
|
||||
# Automatic upgrades
|
||||
system.autoUpgrade = {
|
||||
enable = true; # Set to true for automatic updates
|
||||
dates = "daily";
|
||||
allowReboot = false;
|
||||
};
|
||||
|
||||
# System packages
|
||||
environment.systemPackages = with pkgs; [
|
||||
# Network tools
|
||||
wget
|
||||
curl
|
||||
dig
|
||||
tcpdump
|
||||
ethtool
|
||||
iptables
|
||||
nftables
|
||||
iproute2
|
||||
bridge-utils
|
||||
netcat-gnu
|
||||
traceroute
|
||||
mtr
|
||||
|
||||
# Add the ability to create NixOS images
|
||||
nixos-generators
|
||||
|
||||
# Monitoring
|
||||
btop
|
||||
htop
|
||||
iotop
|
||||
bandwhich
|
||||
|
||||
# Editors
|
||||
micro
|
||||
vim
|
||||
helix
|
||||
|
||||
# System info
|
||||
fastfetch
|
||||
lshw
|
||||
pciutils
|
||||
usbutils
|
||||
|
||||
# Filesystem utilities
|
||||
btrfs-progs
|
||||
e2fsprogs
|
||||
ntfs3g
|
||||
dosfstools
|
||||
os-prober
|
||||
|
||||
# Development tools
|
||||
knot-dns
|
||||
|
||||
# Browser for web interface access
|
||||
librewolf
|
||||
];
|
||||
|
||||
# Enable zram swap
|
||||
zramSwap = {
|
||||
enable = true;
|
||||
memoryPercent = 50;
|
||||
};
|
||||
|
||||
# Some programs need SUID wrappers, can be configured further or are
|
||||
# started in user sessions.
|
||||
# programs.mtr.enable = true;
|
||||
# programs.gnupg.agent = {
|
||||
# enable = true;
|
||||
# enableSSHSupport = true;
|
||||
# };
|
||||
|
||||
networking = {
|
||||
hosts = {
|
||||
"10.1.123.1" = ["ipfire.server.prg" "ipfire"];
|
||||
"10.1.123.2" = ["pi-hole.server.prg" "pi-hole"];
|
||||
# "10.1.123.15" = ["nas.server.prg" "nas"];
|
||||
};
|
||||
};
|
||||
|
||||
#
|
||||
# Services
|
||||
#
|
||||
services = {
|
||||
# I'm not actually using the dnsmasq service. Pi-hole provides
|
||||
# it's own dnsmasq. I'm using Nix' ability to manage the
|
||||
# dnsmasq-style configuration file that Pi-hole utilizes.
|
||||
dnsmasq = {
|
||||
enable = false;
|
||||
settings = {
|
||||
address = [
|
||||
#"/feelinsonice-hrd.appspot.com/ # Block Snapchat"
|
||||
#"/feelinsonice. appspot.com/ # Block Snapchat"
|
||||
#"/snapchat.com/ # Block Snapchat"
|
||||
];
|
||||
dhcp-name-match = [
|
||||
#"set: hostname-ignore,wpad"
|
||||
#"set:hostname-ignore,localhost"
|
||||
];
|
||||
# Set DHCP option 6 to the DNS server you nodes should use.
|
||||
dhcp-option = [
|
||||
"vendor: MSFT,2,1i"
|
||||
"6,10.1.123.2"
|
||||
];
|
||||
domain = [
|
||||
"server.prg,192.168.33.0/24,local"
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
pihole-ftl = {
|
||||
enable = true;
|
||||
lists = [
|
||||
{
|
||||
url = "https://raw.githubusercontent.com/StevenBlack/hosts/master/alternates/fakenews-gambling-porn/hosts";
|
||||
type = "block";
|
||||
enabled = true;
|
||||
description = "Steven Black's HOSTS - Usual, porn, gambling, fakenews etc. block";
|
||||
}
|
||||
];
|
||||
openFirewallDNS = true;
|
||||
openFirewallDHCP = true;
|
||||
openFirewallWebserver = true;
|
||||
queryLogDeleter.enable = true;
|
||||
settings = {
|
||||
# See https://docs.pi-hole.net/ftldns/configfile/
|
||||
dhcp = {
|
||||
active = true; # <-- SET TO TRUE ONLY WHEN YOU'RE READY!
|
||||
end = "10.1.123.254";
|
||||
hosts = [
|
||||
# Add new statics here
|
||||
];
|
||||
ipv6 = true;
|
||||
leaseTime = "1h";
|
||||
start = "10.1.123.122";
|
||||
rapidCommit = true;
|
||||
multiDNS = true; # This ensures that DNS is there, because some people's computers might yeet the given DNS server still
|
||||
resolver = {
|
||||
resolveIPv6 = false;
|
||||
};
|
||||
router = "10.1.123.1";
|
||||
};
|
||||
|
||||
### COMMENT THIS AFTER INSTALLATION!
|
||||
misc. readOnly = false;
|
||||
dns = {
|
||||
cnameRecords = [
|
||||
#"color-printer,office-printer"
|
||||
#"color-printer. homelab. me,office-printer.homelab.me"
|
||||
];
|
||||
domain = "server.prg";
|
||||
domainNeeded = true;
|
||||
expandHosts = true;
|
||||
interface = "ens18";
|
||||
hosts = [
|
||||
"10.1.123.1 ipfire"
|
||||
"10.1.123.2 pi-hole"
|
||||
#"10.1.123.15 nas"
|
||||
];
|
||||
upstreams = ["127.0.0.1#5335"]; # Pointing to Unbound
|
||||
};
|
||||
ntp = {
|
||||
ipv4.active = true;
|
||||
ipv6.active = true;
|
||||
sync.active = true;
|
||||
};
|
||||
webserver = {
|
||||
api = {
|
||||
# To manage the web login:
|
||||
# 1) Temporarily set misc.readOnly to false in
|
||||
# configuration.nix and switch to it.
|
||||
# 2) Manually set a password:
|
||||
# Pi-hole web console > Settings > All settings >
|
||||
# Webserver and API > webserver. api.password > Value: ******
|
||||
# 3) Read the generated hash:
|
||||
# sudo pihole-FTL --config webserver.api.pwhash
|
||||
};
|
||||
session = {
|
||||
timeout = 43200; # 12h
|
||||
};
|
||||
};
|
||||
};
|
||||
useDnsmasqConfig = true;
|
||||
};
|
||||
|
||||
pihole-web = {
|
||||
enable = true;
|
||||
ports = [80];
|
||||
};
|
||||
|
||||
resolved = {
|
||||
extraConfig = ''
|
||||
DNSStubListener=no
|
||||
MulticastDNS=off
|
||||
'';
|
||||
};
|
||||
|
||||
# Unbound recursive DNS server configuration
|
||||
# Based on Pi-hole + Unbound guide: https://docs.pi-hole.net/guides/dns/unbound/
|
||||
unbound = {
|
||||
enable = true;
|
||||
package = pkgs.unbound-with-systemd;
|
||||
|
||||
settings = {
|
||||
server = {
|
||||
# Listen only on localhost for Pi-hole queries
|
||||
interface = ["127.0.0.1"];
|
||||
port = 5335;
|
||||
|
||||
# Access control - only allow localhost
|
||||
access-control = [
|
||||
"127.0.0.0/8 allow"
|
||||
"0.0.0.0/0 refuse"
|
||||
];
|
||||
|
||||
# Enable both IPv4 and IPv6
|
||||
do-ip4 = true;
|
||||
do-ip6 = true;
|
||||
do-udp = true;
|
||||
do-tcp = true;
|
||||
|
||||
# Prefer IPv4 (recommended for most setups)
|
||||
prefer-ip6 = false;
|
||||
|
||||
# Security enhancements
|
||||
harden-glue = true;
|
||||
harden-dnssec-stripped = true;
|
||||
use-caps-for-id = false; # Prevents DNSSEC issues
|
||||
|
||||
# Performance optimizations from Pi-hole guide
|
||||
edns-buffer-size = 1232; # Prevents UDP fragmentation
|
||||
prefetch = true; # Prefetch expiring cache entries
|
||||
|
||||
# Threading (1 thread sufficient for most home setups)
|
||||
num-threads = 1;
|
||||
|
||||
# Increase socket buffer for high query rates
|
||||
so-rcvbuf = "1m";
|
||||
|
||||
# Privacy - ensure no queries leak to public IPs
|
||||
private-address = [
|
||||
"192.168.0.0/16"
|
||||
"169.254.0.0/16"
|
||||
"172.16.0.0/12"
|
||||
"10.0.0.0/8"
|
||||
"fd00::/8"
|
||||
"fe80::/10"
|
||||
# RFC6303 addresses
|
||||
"192.0.2.0/24"
|
||||
"198.51.100.0/24"
|
||||
"203.0.113.0/24"
|
||||
"255.255.255.255/32"
|
||||
"2001:db8::/32"
|
||||
];
|
||||
|
||||
# Logging configuration (set to 0 for production, higher for debugging)
|
||||
verbosity = 0;
|
||||
log-queries = false;
|
||||
|
||||
# Additional security
|
||||
hide-identity = true;
|
||||
hide-version = true;
|
||||
|
||||
# Cache settings
|
||||
cache-min-ttl = 0;
|
||||
cache-max-ttl = 86400;
|
||||
|
||||
# Hardening options
|
||||
harden-below-nxdomain = true;
|
||||
harden-referral-path = false;
|
||||
harden-algo-downgrade = false;
|
||||
};
|
||||
|
||||
# Optional: Forward to encrypted DNS (comment out for pure recursive)
|
||||
# Uncomment below to use Quad9 with DNS-over-TLS
|
||||
# forward-zone = [
|
||||
# {
|
||||
# name = ". ";
|
||||
# forward-addr = [
|
||||
# "9.9.9.9@853#dns.quad9.net"
|
||||
# "149.112.112.112@853#dns.quad9.net"
|
||||
# ];
|
||||
# forward-tls-upstream = true;
|
||||
# }
|
||||
# ];
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
# Systemd configuration for Unbound and Pi-hole integration
|
||||
systemd = {
|
||||
# Create necessary directories and files
|
||||
tmpfiles.rules = [
|
||||
# Silence benign FTL. log warning
|
||||
"f /etc/pihole/versions 0644 pihole pihole - -"
|
||||
|
||||
# Unbound directories (if needed for custom configs)
|
||||
"d /var/lib/unbound 0755 unbound unbound - -"
|
||||
];
|
||||
|
||||
services = {
|
||||
# Ensure Unbound starts before Pi-hole FTL
|
||||
pihole-ftl = {
|
||||
after = ["unbound.service"];
|
||||
wants = ["unbound.service"];
|
||||
};
|
||||
|
||||
# Automatic root hints updater (runs monthly)
|
||||
unbound-root-hints-updater = {
|
||||
description = "Update Unbound Root Hints";
|
||||
serviceConfig = {
|
||||
Type = "oneshot";
|
||||
ExecStart = "${pkgs.writeShellScript "update-root-hints" ''
|
||||
#!/usr/bin/env bash
|
||||
set -euo pipefail
|
||||
|
||||
HINTS_FILE="/var/lib/unbound/root. hints"
|
||||
TEMP_FILE=$(mktemp)
|
||||
|
||||
echo "Downloading latest root hints..."
|
||||
${pkgs.curl}/bin/curl -sf https://www.internic.net/domain/named.root -o "$TEMP_FILE"
|
||||
|
||||
if [ -s "$TEMP_FILE" ]; then
|
||||
mv "$TEMP_FILE" "$HINTS_FILE"
|
||||
chown unbound:unbound "$HINTS_FILE"
|
||||
chmod 644 "$HINTS_FILE"
|
||||
echo "Root hints updated successfully"
|
||||
systemctl restart unbound. service
|
||||
else
|
||||
echo "Failed to download root hints"
|
||||
rm -f "$TEMP_FILE"
|
||||
exit 1
|
||||
fi
|
||||
''}";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
timers = {
|
||||
# Run root hints update monthly
|
||||
unbound-root-hints-updater = {
|
||||
description = "Monthly Unbound Root Hints Update";
|
||||
wantedBy = ["timers.target"];
|
||||
timerConfig = {
|
||||
OnCalendar = "monthly";
|
||||
Persistent = true;
|
||||
RandomizedDelaySec = "1h";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
# System activation scripts
|
||||
system.activationScripts = {
|
||||
print-pi-hole = {
|
||||
text = builtins.trace "Building the pi-hole configuration..." "";
|
||||
};
|
||||
|
||||
# Initialize unbound root hints on first boot
|
||||
unbound-root-hints = {
|
||||
text = ''
|
||||
if [ ! -f /var/lib/unbound/root.hints ]; then
|
||||
echo "Initializing Unbound root hints..."
|
||||
${pkgs.curl}/bin/curl -sf https://www.internic.net/domain/named.root \
|
||||
-o /var/lib/unbound/root.hints || true
|
||||
if [ -f /var/lib/unbound/root.hints ]; then
|
||||
chown unbound:unbound /var/lib/unbound/root. hints
|
||||
chmod 644 /var/lib/unbound/root.hints
|
||||
fi
|
||||
fi
|
||||
'';
|
||||
};
|
||||
|
||||
# Fix socket buffer size warning
|
||||
unbound-socket-buffer = {
|
||||
text = ''
|
||||
# Set kernel parameter for unbound socket buffer
|
||||
if [ "$(sysctl -n net. core.rmem_max)" -lt 1048576 ]; then
|
||||
echo "Setting net.core.rmem_max=1048576 for Unbound"
|
||||
sysctl -w net.core.rmem_max=1048576 || true
|
||||
fi
|
||||
'';
|
||||
};
|
||||
};
|
||||
|
||||
# Make socket buffer size permanent
|
||||
boot.kernel.sysctl = {
|
||||
"net.core.rmem_max" = 1048576; # 1MB for Unbound
|
||||
};
|
||||
|
||||
# Attach the system to the IPFire network: set a static IP on the Proxmox bridge (ens18)
|
||||
# Adjust `ens18` and the address below to your environment.
|
||||
networking.interfaces.ens18.ipv4.addresses = [
|
||||
{
|
||||
address = "10.1.123.2";
|
||||
prefixLength = 24;
|
||||
} # Using this IP for DNS server
|
||||
];
|
||||
networking.defaultGateway = "10.1.123.1";
|
||||
|
||||
# List services that you want to enable:
|
||||
|
||||
# Enable the OpenSSH daemon.
|
||||
# services.openssh.enable = true;
|
||||
|
||||
# Open ports in the firewall.
|
||||
# networking.firewall.allowedTCPPorts = [ ... ];
|
||||
# networking.firewall.allowedUDPPorts = [ ... ];
|
||||
# Or disable the firewall altogether.
|
||||
# networking.firewall.enable = false;
|
||||
|
||||
# This value determines the NixOS release from which the default
|
||||
# settings for stateful data, like file locations and database versions
|
||||
# on your system were taken. It's perfectly fine and recommended to leave
|
||||
# this value at the release version of the first install of this system.
|
||||
# Before changing this value read the documentation for this option
|
||||
# (e.g. man configuration-knot. nix or on https://nixos.org/nixos/options.html).
|
||||
system.stateVersion = "25.11"; # Did you read the comment?
|
||||
}
|
||||
688
nix-system-configs/dns/configuration-pihole-inside-system.nix
Normal file
688
nix-system-configs/dns/configuration-pihole-inside-system.nix
Normal file
|
|
@ -0,0 +1,688 @@
|
|||
# Edit this configuration file to define what should be installed on
|
||||
# your system. Help is available in the configuration-knot.nix(5) man page
|
||||
# and in the NixOS manual (accessible by running 'nixos-help').
|
||||
{
|
||||
config,
|
||||
pkgs,
|
||||
lib,
|
||||
...
|
||||
}: let
|
||||
home-manager = builtins.fetchTarball "https://github.com/nix-community/home-manager/archive/release-25.11.tar.gz";
|
||||
in {
|
||||
# Home Manager Configuration
|
||||
imports = [
|
||||
(import "${home-manager}/nixos")
|
||||
];
|
||||
|
||||
## Ensure that configuration is copied after installing this NixOS image
|
||||
system.copySystemConfiguration = true;
|
||||
|
||||
# Use Lix instead of Nix
|
||||
nixpkgs.overlays = [
|
||||
(final: prev: {
|
||||
inherit
|
||||
(prev. lixPackageSets.stable)
|
||||
nixpkgs-review
|
||||
nix-eval-jobs
|
||||
nix-fast-build
|
||||
colmena
|
||||
;
|
||||
})
|
||||
];
|
||||
|
||||
nix. package = pkgs.lixPackageSets.stable. lix;
|
||||
|
||||
# Bootloader - GRUB for Proxmox
|
||||
# Bootloader - systemd-boot with UEFI
|
||||
boot.loader.grub.enable = lib.mkForce false;
|
||||
boot.loader.systemd-boot.enable = true;
|
||||
boot.loader.efi.canTouchEfiVariables = false;
|
||||
boot.loader.efi.efiSysMountPoint = "/boot";
|
||||
|
||||
# Proxmox configuration
|
||||
proxmox.qemuConf = {
|
||||
bios = "ovmf"; # Use OVMF for UEFI
|
||||
};
|
||||
|
||||
boot.initrd.availableKernelModules = ["virtio_pci" "virtio_scsi" "ahci" "sd_mod"];
|
||||
|
||||
networking.hostName = "piholeprg"; # Define your hostname.
|
||||
#networking.wireless.enable = true; # Enables wireless support via wpa_supplicant.
|
||||
|
||||
# Enable Rsymc
|
||||
services.rsync.enable = true;
|
||||
|
||||
# Configure network proxy if necessary
|
||||
# networking.proxy.default = "http://user:password@proxy:port/";
|
||||
# networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";
|
||||
|
||||
# Enable networking
|
||||
networking.networkmanager. enable = true;
|
||||
networking. useDHCP = lib.mkDefault true;
|
||||
# Serial console for Proxmox
|
||||
boot.kernelParams = ["console=tty0" "console=ttyS0,115200"];
|
||||
# Enable QEMU Guest for Proxmox integration
|
||||
services.qemuGuest.enable = true;
|
||||
services.spice-vdagentd.enable = true;
|
||||
|
||||
# Enable SSH
|
||||
services.openssh = {
|
||||
enable = true;
|
||||
ports = [22];
|
||||
settings = {
|
||||
PasswordAuthentication = false;
|
||||
AllowUsers = null;
|
||||
UseDns = true;
|
||||
PermitRootLogin = "no";
|
||||
};
|
||||
};
|
||||
|
||||
# Set your time zone.
|
||||
time. timeZone = "Europe/Copenhagen";
|
||||
|
||||
# Select internationalisation properties.
|
||||
i18n.defaultLocale = "en_GB.UTF-8";
|
||||
|
||||
i18n.extraLocaleSettings = {
|
||||
LC_ADDRESS = "et_EE.UTF-8";
|
||||
LC_IDENTIFICATION = "et_EE.UTF-8";
|
||||
LC_MEASUREMENT = "et_EE.UTF-8";
|
||||
LC_MONETARY = "et_EE.UTF-8";
|
||||
LC_NAME = "et_EE.UTF-8";
|
||||
LC_NUMERIC = "et_EE.UTF-8";
|
||||
LC_PAPER = "et_EE.UTF-8";
|
||||
LC_TELEPHONE = "et_EE.UTF-8";
|
||||
LC_TIME = "et_EE.UTF-8";
|
||||
};
|
||||
|
||||
# Configure keymap in X11
|
||||
services.xserver. xkb = {
|
||||
layout = "us";
|
||||
variant = "";
|
||||
};
|
||||
|
||||
# Enable Seatd for Wayland sessions
|
||||
# IMPORTANT: Enable seatd service for River WM
|
||||
services.seatd = {
|
||||
enable = true;
|
||||
logLevel = "info";
|
||||
};
|
||||
|
||||
# Enable the gnome-keyring secrets vault.
|
||||
# Will be exposed through DBus to programs willing to store secrets.
|
||||
services. gnome.gnome-keyring.enable = true;
|
||||
|
||||
# Enable Sway window manager
|
||||
programs.sway = {
|
||||
enable = true;
|
||||
wrapperFeatures.gtk = true;
|
||||
};
|
||||
|
||||
services.greetd = {
|
||||
enable = true;
|
||||
settings = {
|
||||
default_session = {
|
||||
command = "${pkgs.tuigreet}/bin/tuigreet --time --cmd sway";
|
||||
user = "greeter";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
# Configure security to allow seatd access
|
||||
security.polkit.enable = true;
|
||||
|
||||
# Configure GPU support
|
||||
hardware.graphics = {
|
||||
enable = true;
|
||||
enable32Bit = true;
|
||||
};
|
||||
|
||||
# Define a user account. Don't forget to set a password with 'passwd'.
|
||||
# Copy this later to generate more custom users.
|
||||
users.users.piholeprg = {
|
||||
isNormalUser = true;
|
||||
description = "NixOS Playground";
|
||||
extraGroups = ["networkmanager" "wheel" "seat"];
|
||||
packages = with pkgs; [];
|
||||
initialPassword = "nixos"; # Simple, change on first login
|
||||
};
|
||||
|
||||
home-manager.users.piholeprg = {pkgs, ...}: {
|
||||
home.packages = [
|
||||
pkgs.atool
|
||||
pkgs.httpie
|
||||
pkgs.alacritty # Terminal emulator
|
||||
pkgs. hyfetch # Add fetching packages
|
||||
pkgs.macchina
|
||||
pkgs.wayland # Wayland display server
|
||||
pkgs.wlroots # Wayland compositor library
|
||||
pkgs.maple-mono. NF # Font for better terminal appearance
|
||||
pkgs.wl-clipboard # Clipboard utilities for Wayland
|
||||
pkgs.mako # Wayland Sway Notification Daemon
|
||||
pkgs.btop # Resource monitor
|
||||
];
|
||||
|
||||
# Configure LibreWolf browser
|
||||
programs.librewolf = {
|
||||
enable = true;
|
||||
# Enable WebGL, cookies and history
|
||||
settings = {
|
||||
"webgl.disabled" = false;
|
||||
"privacy.resistFingerprinting" = true;
|
||||
"privacy.clearOnShutdown. history" = false;
|
||||
"privacy.clearOnShutdown.cookies" = true;
|
||||
};
|
||||
};
|
||||
|
||||
# Set Alacritty as the default terminal emulator
|
||||
home.sessionVariables = {
|
||||
TERMINAL = "alacritty";
|
||||
};
|
||||
|
||||
# Use Zsh as the default shell
|
||||
programs.zsh. enable = true;
|
||||
|
||||
# Configure Alacritty as the default terminal emulator
|
||||
programs.alacritty = {
|
||||
enable = true;
|
||||
settings = {
|
||||
# Window configuration
|
||||
window = {
|
||||
opacity = 1.0;
|
||||
padding = {
|
||||
x = 10;
|
||||
y = 10;
|
||||
};
|
||||
};
|
||||
|
||||
# Font configuration - fixes spacing issues
|
||||
font = {
|
||||
normal = {
|
||||
family = "Maple Mono NF";
|
||||
style = "Regular";
|
||||
};
|
||||
bold = {
|
||||
family = "Maple Mono NF";
|
||||
style = "Bold";
|
||||
};
|
||||
italic = {
|
||||
family = "Maple Mono NF";
|
||||
style = "Italic";
|
||||
};
|
||||
bold_italic = {
|
||||
family = "Maple Mono NF";
|
||||
style = "Bold Italic";
|
||||
};
|
||||
size = 14.0;
|
||||
};
|
||||
|
||||
# Colors (optional - using default Alacritty colors)
|
||||
colors = {
|
||||
primary = {
|
||||
background = "#1e1e2e";
|
||||
foreground = "#cdd6f4";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
# Configure Hyfetch system info fetcher
|
||||
programs.hyfetch = {
|
||||
enable = true;
|
||||
settings = {
|
||||
preset = "lesbian"; # Use lesbian flag preset
|
||||
mode = "rgb"; # Use RGB color mode
|
||||
lightness = 0.55; # Set to 55% brightness
|
||||
backend = "macchina"; # Use macchina as the backend
|
||||
logo_size = "small"; # Make small logo
|
||||
pride_month_disable = false; # Enable pride month mode (or true to disable)
|
||||
pride_month_shown = []; # List of shown pride month flags
|
||||
color_align = {
|
||||
mode = "horizontal";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
# The state version is required and should stay at the version you
|
||||
# originally installed.
|
||||
home.stateVersion = "25.11";
|
||||
};
|
||||
|
||||
# Allow unfree packages
|
||||
nixpkgs.config.allowUnfree = true;
|
||||
|
||||
# Passwordless sudo for wheel group
|
||||
security.sudo. wheelNeedsPassword = false;
|
||||
|
||||
# Hardware U2F support - Passwordless sudo with hardware key
|
||||
security.pam.u2f = {
|
||||
enable = true;
|
||||
settings = {
|
||||
authfile = "/etc/u2f_keys";
|
||||
cue = true;
|
||||
pinverification = 0; # No PIN verification
|
||||
userpresence = 1; # Require user presence (touch)
|
||||
};
|
||||
};
|
||||
|
||||
# SSH Agent authentication
|
||||
security.pam.sshAgentAuth. enable = true;
|
||||
|
||||
# Automatic upgrades
|
||||
system.autoUpgrade = {
|
||||
enable = true; # Set to true for automatic updates
|
||||
dates = "daily";
|
||||
allowReboot = false;
|
||||
};
|
||||
|
||||
# System packages
|
||||
environment.systemPackages = with pkgs; [
|
||||
# Network tools
|
||||
wget
|
||||
curl
|
||||
dig
|
||||
tcpdump
|
||||
ethtool
|
||||
iptables
|
||||
nftables
|
||||
iproute2
|
||||
bridge-utils
|
||||
netcat-gnu
|
||||
traceroute
|
||||
mtr
|
||||
|
||||
# Add the ability to create NixOS images
|
||||
nixos-generators
|
||||
|
||||
# Monitoring
|
||||
btop
|
||||
htop
|
||||
iotop
|
||||
bandwhich
|
||||
|
||||
# Editors
|
||||
micro
|
||||
vim
|
||||
helix
|
||||
|
||||
# System info
|
||||
fastfetch
|
||||
lshw
|
||||
pciutils
|
||||
usbutils
|
||||
|
||||
# Filesystem utilities
|
||||
btrfs-progs
|
||||
e2fsprogs
|
||||
ntfs3g
|
||||
dosfstools
|
||||
os-prober
|
||||
|
||||
# Development tools
|
||||
knot-dns
|
||||
|
||||
# Browser for web interface access
|
||||
librewolf
|
||||
];
|
||||
|
||||
# Enable zram swap
|
||||
zramSwap = {
|
||||
enable = true;
|
||||
memoryPercent = 50;
|
||||
};
|
||||
|
||||
# Some programs need SUID wrappers, can be configured further or are
|
||||
# started in user sessions.
|
||||
# programs.mtr.enable = true;
|
||||
# programs.gnupg.agent = {
|
||||
# enable = true;
|
||||
# enableSSHSupport = true;
|
||||
# };
|
||||
|
||||
networking = {
|
||||
hosts = {
|
||||
"10.1.1.1" = ["ipfire.server.prg" "ipfire"];
|
||||
"10.1.1.2" = ["pi-hole.server.prg" "pi-hole"];
|
||||
# "10.1.1.15" = ["nas.server.prg" "nas"];
|
||||
};
|
||||
};
|
||||
|
||||
#
|
||||
# Services
|
||||
#
|
||||
services = {
|
||||
# I'm not actually using the dnsmasq service. Pi-hole provides
|
||||
# it's own dnsmasq. I'm using Nix' ability to manage the
|
||||
# dnsmasq-style configuration file that Pi-hole utilizes.
|
||||
dnsmasq = {
|
||||
enable = false;
|
||||
settings = {
|
||||
address = [
|
||||
#"/feelinsonice-hrd.appspot.com/ # Block Snapchat"
|
||||
#"/feelinsonice. appspot.com/ # Block Snapchat"
|
||||
#"/snapchat.com/ # Block Snapchat"
|
||||
];
|
||||
dhcp-name-match = [
|
||||
#"set: hostname-ignore,wpad"
|
||||
#"set:hostname-ignore,localhost"
|
||||
];
|
||||
# Set DHCP option 6 to the DNS server you nodes should use.
|
||||
dhcp-option = [
|
||||
"vendor: MSFT,2,1i"
|
||||
"6,10.1.1.2"
|
||||
];
|
||||
domain = [
|
||||
"server.prg,192.168.33.0/24,local"
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
pihole-ftl = {
|
||||
enable = true;
|
||||
lists = [
|
||||
{
|
||||
url = "https://raw.githubusercontent.com/StevenBlack/hosts/master/alternates/fakenews-gambling-porn/hosts";
|
||||
type = "block";
|
||||
enabled = true;
|
||||
description = "Steven Black's HOSTS - Usual, porn, gambling, fakenews etc. block";
|
||||
}
|
||||
];
|
||||
openFirewallDNS = true;
|
||||
openFirewallDHCP = true;
|
||||
openFirewallWebserver = true;
|
||||
queryLogDeleter.enable = true;
|
||||
settings = {
|
||||
# See https://docs.pi-hole.net/ftldns/configfile/
|
||||
dhcp = {
|
||||
active = true; # <-- SET TO TRUE ONLY WHEN YOU'RE READY!
|
||||
end = "10.1.1.254";
|
||||
hosts = [
|
||||
# Add new statics here
|
||||
];
|
||||
ipv6 = true;
|
||||
leaseTime = "24h";
|
||||
multiDNS = true; # This ensures that DNS is there, because some people's computers might yeet the given DNS server still
|
||||
start = "10.1.1.122";
|
||||
rapidCommit = true;
|
||||
resolver = {
|
||||
resolveIPv6 = false;
|
||||
};
|
||||
router = "10.1.1.1";
|
||||
};
|
||||
|
||||
### COMMENT THIS AFTER INSTALLATION!
|
||||
misc. readOnly = false;
|
||||
dns = {
|
||||
cnameRecords = [
|
||||
#"color-printer,office-printer"
|
||||
#"color-printer. homelab. me,office-printer.homelab.me"
|
||||
];
|
||||
domain = "server.prg";
|
||||
domainNeeded = true;
|
||||
expandHosts = true;
|
||||
interface = "ens18";
|
||||
hosts = [
|
||||
"10.1.1.1 ipfire"
|
||||
"10.1.1.2 pi-hole"
|
||||
#"10.1.1.15 nas"
|
||||
];
|
||||
upstreams = ["127.0.0.1#5335"]; # Pointing to Unbound
|
||||
};
|
||||
ntp = {
|
||||
ipv4.active = true;
|
||||
ipv6.active = true;
|
||||
sync.active = true;
|
||||
};
|
||||
webserver = {
|
||||
api = {
|
||||
# To manage the web login:
|
||||
# 1) Temporarily set misc.readOnly to false in
|
||||
# configuration.nix and switch to it.
|
||||
# 2) Manually set a password:
|
||||
# Pi-hole web console > Settings > All settings >
|
||||
# Webserver and API > webserver. api.password > Value: ******
|
||||
# 3) Read the generated hash:
|
||||
# sudo pihole-FTL --config webserver.api.pwhash
|
||||
};
|
||||
session = {
|
||||
timeout = 43200; # 12h
|
||||
};
|
||||
};
|
||||
};
|
||||
useDnsmasqConfig = true;
|
||||
};
|
||||
|
||||
pihole-web = {
|
||||
enable = true;
|
||||
ports = [80];
|
||||
};
|
||||
|
||||
resolved = {
|
||||
extraConfig = ''
|
||||
DNSStubListener=no
|
||||
MulticastDNS=off
|
||||
'';
|
||||
};
|
||||
|
||||
# Unbound recursive DNS server configuration
|
||||
# Based on Pi-hole + Unbound guide: https://docs.pi-hole.net/guides/dns/unbound/
|
||||
unbound = {
|
||||
enable = true;
|
||||
package = pkgs.unbound-with-systemd;
|
||||
|
||||
settings = {
|
||||
server = {
|
||||
# Listen only on localhost for Pi-hole queries
|
||||
interface = ["127.0.0.1"];
|
||||
port = 5335;
|
||||
|
||||
# Access control - only allow localhost
|
||||
access-control = [
|
||||
"127.0.0.0/8 allow"
|
||||
"0.0.0.0/0 refuse"
|
||||
];
|
||||
|
||||
# Enable both IPv4 and IPv6
|
||||
do-ip4 = true;
|
||||
do-ip6 = true;
|
||||
do-udp = true;
|
||||
do-tcp = true;
|
||||
|
||||
# Prefer IPv4 (recommended for most setups)
|
||||
prefer-ip6 = false;
|
||||
|
||||
# Security enhancements
|
||||
harden-glue = true;
|
||||
harden-dnssec-stripped = true;
|
||||
use-caps-for-id = false; # Prevents DNSSEC issues
|
||||
|
||||
# Performance optimizations from Pi-hole guide
|
||||
edns-buffer-size = 1232; # Prevents UDP fragmentation
|
||||
prefetch = true; # Prefetch expiring cache entries
|
||||
|
||||
# Threading (1 thread sufficient for most home setups)
|
||||
num-threads = 1;
|
||||
|
||||
# Increase socket buffer for high query rates
|
||||
so-rcvbuf = "1m";
|
||||
|
||||
# Privacy - ensure no queries leak to public IPs
|
||||
private-address = [
|
||||
"192.168.0.0/16"
|
||||
"169.254.0.0/16"
|
||||
"172.16.0.0/12"
|
||||
"10.0.0.0/8"
|
||||
"fd00::/8"
|
||||
"fe80::/10"
|
||||
# RFC6303 addresses
|
||||
"192.0.2.0/24"
|
||||
"198.51.100.0/24"
|
||||
"203.0.113.0/24"
|
||||
"255.255.255.255/32"
|
||||
"2001:db8::/32"
|
||||
];
|
||||
|
||||
# Logging configuration (set to 0 for production, higher for debugging)
|
||||
verbosity = 0;
|
||||
log-queries = false;
|
||||
|
||||
# Additional security
|
||||
hide-identity = true;
|
||||
hide-version = true;
|
||||
|
||||
# Cache settings
|
||||
cache-min-ttl = 0;
|
||||
cache-max-ttl = 86400;
|
||||
|
||||
# Hardening options
|
||||
harden-below-nxdomain = true;
|
||||
harden-referral-path = false;
|
||||
harden-algo-downgrade = false;
|
||||
};
|
||||
|
||||
# Optional: Forward to encrypted DNS (comment out for pure recursive)
|
||||
# Uncomment below to use Quad9 with DNS-over-TLS
|
||||
# forward-zone = [
|
||||
# {
|
||||
# name = ". ";
|
||||
# forward-addr = [
|
||||
# "9.9.9.9@853#dns.quad9.net"
|
||||
# "149.112.112.112@853#dns.quad9.net"
|
||||
# ];
|
||||
# forward-tls-upstream = true;
|
||||
# }
|
||||
# ];
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
# Systemd configuration for Unbound and Pi-hole integration
|
||||
systemd = {
|
||||
# Create necessary directories and files
|
||||
tmpfiles.rules = [
|
||||
# Silence benign FTL. log warning
|
||||
"f /etc/pihole/versions 0644 pihole pihole - -"
|
||||
|
||||
# Unbound directories (if needed for custom configs)
|
||||
"d /var/lib/unbound 0755 unbound unbound - -"
|
||||
];
|
||||
|
||||
services = {
|
||||
# Ensure Unbound starts before Pi-hole FTL
|
||||
pihole-ftl = {
|
||||
after = ["unbound.service"];
|
||||
wants = ["unbound.service"];
|
||||
};
|
||||
|
||||
# Automatic root hints updater (runs monthly)
|
||||
unbound-root-hints-updater = {
|
||||
description = "Update Unbound Root Hints";
|
||||
serviceConfig = {
|
||||
Type = "oneshot";
|
||||
ExecStart = "${pkgs.writeShellScript "update-root-hints" ''
|
||||
#!/usr/bin/env bash
|
||||
set -euo pipefail
|
||||
|
||||
HINTS_FILE="/var/lib/unbound/root. hints"
|
||||
TEMP_FILE=$(mktemp)
|
||||
|
||||
echo "Downloading latest root hints..."
|
||||
${pkgs.curl}/bin/curl -sf https://www.internic.net/domain/named.root -o "$TEMP_FILE"
|
||||
|
||||
if [ -s "$TEMP_FILE" ]; then
|
||||
mv "$TEMP_FILE" "$HINTS_FILE"
|
||||
chown unbound:unbound "$HINTS_FILE"
|
||||
chmod 644 "$HINTS_FILE"
|
||||
echo "Root hints updated successfully"
|
||||
systemctl restart unbound. service
|
||||
else
|
||||
echo "Failed to download root hints"
|
||||
rm -f "$TEMP_FILE"
|
||||
exit 1
|
||||
fi
|
||||
''}";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
timers = {
|
||||
# Run root hints update monthly
|
||||
unbound-root-hints-updater = {
|
||||
description = "Monthly Unbound Root Hints Update";
|
||||
wantedBy = ["timers.target"];
|
||||
timerConfig = {
|
||||
OnCalendar = "monthly";
|
||||
Persistent = true;
|
||||
RandomizedDelaySec = "1h";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
# System activation scripts
|
||||
system.activationScripts = {
|
||||
print-pi-hole = {
|
||||
text = builtins.trace "Building the pi-hole configuration..." "";
|
||||
};
|
||||
|
||||
# Initialize unbound root hints on first boot
|
||||
unbound-root-hints = {
|
||||
text = ''
|
||||
if [ ! -f /var/lib/unbound/root.hints ]; then
|
||||
echo "Initializing Unbound root hints..."
|
||||
${pkgs.curl}/bin/curl -sf https://www.internic.net/domain/named.root \
|
||||
-o /var/lib/unbound/root.hints || true
|
||||
if [ -f /var/lib/unbound/root.hints ]; then
|
||||
chown unbound:unbound /var/lib/unbound/root. hints
|
||||
chmod 644 /var/lib/unbound/root.hints
|
||||
fi
|
||||
fi
|
||||
'';
|
||||
};
|
||||
|
||||
# Fix socket buffer size warning
|
||||
unbound-socket-buffer = {
|
||||
text = ''
|
||||
# Set kernel parameter for unbound socket buffer
|
||||
if [ "$(sysctl -n net. core.rmem_max)" -lt 1048576 ]; then
|
||||
echo "Setting net.core.rmem_max=1048576 for Unbound"
|
||||
sysctl -w net.core.rmem_max=1048576 || true
|
||||
fi
|
||||
'';
|
||||
};
|
||||
};
|
||||
|
||||
# Make socket buffer size permanent
|
||||
boot.kernel.sysctl = {
|
||||
"net.core.rmem_max" = 1048576; # 1MB for Unbound
|
||||
};
|
||||
|
||||
# Attach the system to the IPFire network: set a static IP on the Proxmox bridge (ens18)
|
||||
# Adjust `ens18` and the address below to your environment.
|
||||
networking.interfaces.ens18.ipv4.addresses = [
|
||||
{
|
||||
address = "10.1.1.2";
|
||||
prefixLength = 24;
|
||||
} # Using this IP for DNS server
|
||||
];
|
||||
networking.defaultGateway = "10.1.1.1";
|
||||
|
||||
# List services that you want to enable:
|
||||
|
||||
# Enable the OpenSSH daemon.
|
||||
# services.openssh.enable = true;
|
||||
|
||||
# Open ports in the firewall.
|
||||
# networking.firewall.allowedTCPPorts = [ ... ];
|
||||
# networking.firewall.allowedUDPPorts = [ ... ];
|
||||
# Or disable the firewall altogether.
|
||||
# networking.firewall.enable = false;
|
||||
|
||||
# This value determines the NixOS release from which the default
|
||||
# settings for stateful data, like file locations and database versions
|
||||
# on your system were taken. It's perfectly fine and recommended to leave
|
||||
# this value at the release version of the first install of this system.
|
||||
# Before changing this value read the documentation for this option
|
||||
# (e.g. man configuration-knot. nix or on https://nixos.org/nixos/options.html).
|
||||
system.stateVersion = "25.11"; # Did you read the comment?
|
||||
}
|
||||
688
nix-system-configs/dns/configuration-pihole-orange.nix
Normal file
688
nix-system-configs/dns/configuration-pihole-orange.nix
Normal file
|
|
@ -0,0 +1,688 @@
|
|||
# Edit this configuration file to define what should be installed on
|
||||
# your system. Help is available in the configuration-knot.nix(5) man page
|
||||
# and in the NixOS manual (accessible by running 'nixos-help').
|
||||
{
|
||||
config,
|
||||
pkgs,
|
||||
lib,
|
||||
...
|
||||
}: let
|
||||
home-manager = builtins.fetchTarball "https://github.com/nix-community/home-manager/archive/release-25.11.tar.gz";
|
||||
in {
|
||||
# Home Manager Configuration
|
||||
imports = [
|
||||
(import "${home-manager}/nixos")
|
||||
];
|
||||
|
||||
## Ensure that configuration is copied after installing this NixOS image
|
||||
system.copySystemConfiguration = true;
|
||||
|
||||
# Use Lix instead of Nix
|
||||
nixpkgs.overlays = [
|
||||
(final: prev: {
|
||||
inherit
|
||||
(prev. lixPackageSets.stable)
|
||||
nixpkgs-review
|
||||
nix-eval-jobs
|
||||
nix-fast-build
|
||||
colmena
|
||||
;
|
||||
})
|
||||
];
|
||||
|
||||
nix. package = pkgs.lixPackageSets.stable. lix;
|
||||
|
||||
# Bootloader - GRUB for Proxmox
|
||||
# Bootloader - systemd-boot with UEFI
|
||||
boot.loader.grub.enable = lib.mkForce false;
|
||||
boot.loader.systemd-boot.enable = true;
|
||||
boot.loader.efi.canTouchEfiVariables = false;
|
||||
boot.loader.efi.efiSysMountPoint = "/boot";
|
||||
|
||||
# Proxmox configuration
|
||||
proxmox.qemuConf = {
|
||||
bios = "ovmf"; # Use OVMF for UEFI
|
||||
};
|
||||
|
||||
boot.initrd.availableKernelModules = ["virtio_pci" "virtio_scsi" "ahci" "sd_mod"];
|
||||
|
||||
networking.hostName = "piholeprg"; # Define your hostname.
|
||||
#networking.wireless.enable = true; # Enables wireless support via wpa_supplicant.
|
||||
|
||||
# Enable Rsymc
|
||||
services.rsync.enable = true;
|
||||
|
||||
# Configure network proxy if necessary
|
||||
# networking.proxy.default = "http://user:password@proxy:port/";
|
||||
# networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";
|
||||
|
||||
# Enable networking
|
||||
networking.networkmanager. enable = true;
|
||||
networking. useDHCP = lib.mkDefault true;
|
||||
# Serial console for Proxmox
|
||||
boot.kernelParams = ["console=tty0" "console=ttyS0,115200"];
|
||||
# Enable QEMU Guest for Proxmox integration
|
||||
services.qemuGuest.enable = true;
|
||||
services.spice-vdagentd.enable = true;
|
||||
|
||||
# Enable SSH
|
||||
services.openssh = {
|
||||
enable = true;
|
||||
ports = [22];
|
||||
settings = {
|
||||
PasswordAuthentication = false;
|
||||
AllowUsers = null;
|
||||
UseDns = true;
|
||||
PermitRootLogin = "no";
|
||||
};
|
||||
};
|
||||
|
||||
# Set your time zone.
|
||||
time. timeZone = "Europe/Copenhagen";
|
||||
|
||||
# Select internationalisation properties.
|
||||
i18n.defaultLocale = "en_GB.UTF-8";
|
||||
|
||||
i18n.extraLocaleSettings = {
|
||||
LC_ADDRESS = "et_EE.UTF-8";
|
||||
LC_IDENTIFICATION = "et_EE.UTF-8";
|
||||
LC_MEASUREMENT = "et_EE.UTF-8";
|
||||
LC_MONETARY = "et_EE.UTF-8";
|
||||
LC_NAME = "et_EE.UTF-8";
|
||||
LC_NUMERIC = "et_EE.UTF-8";
|
||||
LC_PAPER = "et_EE.UTF-8";
|
||||
LC_TELEPHONE = "et_EE.UTF-8";
|
||||
LC_TIME = "et_EE.UTF-8";
|
||||
};
|
||||
|
||||
# Configure keymap in X11
|
||||
services.xserver. xkb = {
|
||||
layout = "us";
|
||||
variant = "";
|
||||
};
|
||||
|
||||
# Enable Seatd for Wayland sessions
|
||||
# IMPORTANT: Enable seatd service for River WM
|
||||
services.seatd = {
|
||||
enable = true;
|
||||
logLevel = "info";
|
||||
};
|
||||
|
||||
# Enable the gnome-keyring secrets vault.
|
||||
# Will be exposed through DBus to programs willing to store secrets.
|
||||
services. gnome.gnome-keyring.enable = true;
|
||||
|
||||
# Enable Sway window manager
|
||||
programs.sway = {
|
||||
enable = true;
|
||||
wrapperFeatures.gtk = true;
|
||||
};
|
||||
|
||||
services.greetd = {
|
||||
enable = true;
|
||||
settings = {
|
||||
default_session = {
|
||||
command = "${pkgs.tuigreet}/bin/tuigreet --time --cmd sway";
|
||||
user = "greeter";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
# Configure security to allow seatd access
|
||||
security.polkit.enable = true;
|
||||
|
||||
# Configure GPU support
|
||||
hardware.graphics = {
|
||||
enable = true;
|
||||
enable32Bit = true;
|
||||
};
|
||||
|
||||
# Define a user account. Don't forget to set a password with 'passwd'.
|
||||
# Copy this later to generate more custom users.
|
||||
users.users.piholeprg = {
|
||||
isNormalUser = true;
|
||||
description = "NixOS Playground";
|
||||
extraGroups = ["networkmanager" "wheel" "seat"];
|
||||
packages = with pkgs; [];
|
||||
initialPassword = "nixos"; # Simple, change on first login
|
||||
};
|
||||
|
||||
home-manager.users.piholeprg = {pkgs, ...}: {
|
||||
home.packages = [
|
||||
pkgs.atool
|
||||
pkgs.httpie
|
||||
pkgs.alacritty # Terminal emulator
|
||||
pkgs. hyfetch # Add fetching packages
|
||||
pkgs.macchina
|
||||
pkgs.wayland # Wayland display server
|
||||
pkgs.wlroots # Wayland compositor library
|
||||
pkgs.maple-mono. NF # Font for better terminal appearance
|
||||
pkgs.wl-clipboard # Clipboard utilities for Wayland
|
||||
pkgs.mako # Wayland Sway Notification Daemon
|
||||
pkgs.btop # Resource monitor
|
||||
];
|
||||
|
||||
# Configure LibreWolf browser
|
||||
programs.librewolf = {
|
||||
enable = true;
|
||||
# Enable WebGL, cookies and history
|
||||
settings = {
|
||||
"webgl.disabled" = false;
|
||||
"privacy.resistFingerprinting" = true;
|
||||
"privacy.clearOnShutdown. history" = false;
|
||||
"privacy.clearOnShutdown.cookies" = true;
|
||||
};
|
||||
};
|
||||
|
||||
# Set Alacritty as the default terminal emulator
|
||||
home.sessionVariables = {
|
||||
TERMINAL = "alacritty";
|
||||
};
|
||||
|
||||
# Use Zsh as the default shell
|
||||
programs.zsh. enable = true;
|
||||
|
||||
# Configure Alacritty as the default terminal emulator
|
||||
programs.alacritty = {
|
||||
enable = true;
|
||||
settings = {
|
||||
# Window configuration
|
||||
window = {
|
||||
opacity = 1.0;
|
||||
padding = {
|
||||
x = 10;
|
||||
y = 10;
|
||||
};
|
||||
};
|
||||
|
||||
# Font configuration - fixes spacing issues
|
||||
font = {
|
||||
normal = {
|
||||
family = "Maple Mono NF";
|
||||
style = "Regular";
|
||||
};
|
||||
bold = {
|
||||
family = "Maple Mono NF";
|
||||
style = "Bold";
|
||||
};
|
||||
italic = {
|
||||
family = "Maple Mono NF";
|
||||
style = "Italic";
|
||||
};
|
||||
bold_italic = {
|
||||
family = "Maple Mono NF";
|
||||
style = "Bold Italic";
|
||||
};
|
||||
size = 14.0;
|
||||
};
|
||||
|
||||
# Colors (optional - using default Alacritty colors)
|
||||
colors = {
|
||||
primary = {
|
||||
background = "#1e1e2e";
|
||||
foreground = "#cdd6f4";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
# Configure Hyfetch system info fetcher
|
||||
programs.hyfetch = {
|
||||
enable = true;
|
||||
settings = {
|
||||
preset = "lesbian"; # Use lesbian flag preset
|
||||
mode = "rgb"; # Use RGB color mode
|
||||
lightness = 0.55; # Set to 55% brightness
|
||||
backend = "macchina"; # Use macchina as the backend
|
||||
logo_size = "small"; # Make small logo
|
||||
pride_month_disable = false; # Enable pride month mode (or true to disable)
|
||||
pride_month_shown = []; # List of shown pride month flags
|
||||
color_align = {
|
||||
mode = "horizontal";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
# The state version is required and should stay at the version you
|
||||
# originally installed.
|
||||
home.stateVersion = "25.11";
|
||||
};
|
||||
|
||||
# Allow unfree packages
|
||||
nixpkgs.config.allowUnfree = true;
|
||||
|
||||
# Passwordless sudo for wheel group
|
||||
security.sudo. wheelNeedsPassword = false;
|
||||
|
||||
# Hardware U2F support - Passwordless sudo with hardware key
|
||||
security.pam.u2f = {
|
||||
enable = true;
|
||||
settings = {
|
||||
authfile = "/etc/u2f_keys";
|
||||
cue = true;
|
||||
pinverification = 0; # No PIN verification
|
||||
userpresence = 1; # Require user presence (touch)
|
||||
};
|
||||
};
|
||||
|
||||
# SSH Agent authentication
|
||||
security.pam.sshAgentAuth. enable = true;
|
||||
|
||||
# Automatic upgrades
|
||||
system.autoUpgrade = {
|
||||
enable = true; # Set to true for automatic updates
|
||||
dates = "daily";
|
||||
allowReboot = false;
|
||||
};
|
||||
|
||||
# System packages
|
||||
environment.systemPackages = with pkgs; [
|
||||
# Network tools
|
||||
wget
|
||||
curl
|
||||
dig
|
||||
tcpdump
|
||||
ethtool
|
||||
iptables
|
||||
nftables
|
||||
iproute2
|
||||
bridge-utils
|
||||
netcat-gnu
|
||||
traceroute
|
||||
mtr
|
||||
|
||||
# Add the ability to create NixOS images
|
||||
nixos-generators
|
||||
|
||||
# Monitoring
|
||||
btop
|
||||
htop
|
||||
iotop
|
||||
bandwhich
|
||||
|
||||
# Editors
|
||||
micro
|
||||
vim
|
||||
helix
|
||||
|
||||
# System info
|
||||
fastfetch
|
||||
lshw
|
||||
pciutils
|
||||
usbutils
|
||||
|
||||
# Filesystem utilities
|
||||
btrfs-progs
|
||||
e2fsprogs
|
||||
ntfs3g
|
||||
dosfstools
|
||||
os-prober
|
||||
|
||||
# Development tools
|
||||
knot-dns
|
||||
|
||||
# Browser for web interface access
|
||||
librewolf
|
||||
];
|
||||
|
||||
# Enable zram swap
|
||||
zramSwap = {
|
||||
enable = true;
|
||||
memoryPercent = 50;
|
||||
};
|
||||
|
||||
# Some programs need SUID wrappers, can be configured further or are
|
||||
# started in user sessions.
|
||||
# programs.mtr.enable = true;
|
||||
# programs.gnupg.agent = {
|
||||
# enable = true;
|
||||
# enableSSHSupport = true;
|
||||
# };
|
||||
|
||||
networking = {
|
||||
hosts = {
|
||||
"10.1.121.1" = ["ipfire.server.prg" "ipfire"];
|
||||
"10.1.121.2" = ["pi-hole.server.prg" "pi-hole"];
|
||||
# "10.1.121.15" = ["nas.server.prg" "nas"];
|
||||
};
|
||||
};
|
||||
|
||||
#
|
||||
# Services
|
||||
#
|
||||
services = {
|
||||
# I'm not actually using the dnsmasq service. Pi-hole provides
|
||||
# it's own dnsmasq. I'm using Nix' ability to manage the
|
||||
# dnsmasq-style configuration file that Pi-hole utilizes.
|
||||
dnsmasq = {
|
||||
enable = false;
|
||||
settings = {
|
||||
address = [
|
||||
#"/feelinsonice-hrd.appspot.com/ # Block Snapchat"
|
||||
#"/feelinsonice. appspot.com/ # Block Snapchat"
|
||||
#"/snapchat.com/ # Block Snapchat"
|
||||
];
|
||||
dhcp-name-match = [
|
||||
#"set: hostname-ignore,wpad"
|
||||
#"set:hostname-ignore,localhost"
|
||||
];
|
||||
# Set DHCP option 6 to the DNS server you nodes should use.
|
||||
dhcp-option = [
|
||||
"vendor: MSFT,2,1i"
|
||||
"6,10.1.121.2"
|
||||
];
|
||||
domain = [
|
||||
"server.prg,192.168.33.0/24,local"
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
pihole-ftl = {
|
||||
enable = true;
|
||||
lists = [
|
||||
{
|
||||
url = "https://raw.githubusercontent.com/StevenBlack/hosts/master/alternates/fakenews-gambling-porn/hosts";
|
||||
type = "block";
|
||||
enabled = true;
|
||||
description = "Steven Black's HOSTS - Usual, porn, gambling, fakenews etc. block";
|
||||
}
|
||||
];
|
||||
openFirewallDNS = true;
|
||||
openFirewallDHCP = true;
|
||||
openFirewallWebserver = true;
|
||||
queryLogDeleter.enable = true;
|
||||
settings = {
|
||||
# See https://docs.pi-hole.net/ftldns/configfile/
|
||||
dhcp = {
|
||||
active = true; # <-- SET TO TRUE ONLY WHEN YOU'RE READY!
|
||||
end = "10.1.121.254";
|
||||
hosts = [
|
||||
# Add new statics here
|
||||
];
|
||||
ipv6 = true;
|
||||
leaseTime = "24h";
|
||||
multiDNS = true; # This ensures that DNS is there, because some people's computers might yeet the given DNS server still
|
||||
start = "10.1.121.122";
|
||||
rapidCommit = true;
|
||||
resolver = {
|
||||
resolveIPv6 = false;
|
||||
};
|
||||
router = "10.1.121.1";
|
||||
};
|
||||
|
||||
### COMMENT THIS AFTER INSTALLATION!
|
||||
misc. readOnly = false;
|
||||
dns = {
|
||||
cnameRecords = [
|
||||
#"color-printer,office-printer"
|
||||
#"color-printer. homelab. me,office-printer.homelab.me"
|
||||
];
|
||||
domain = "server.prg";
|
||||
domainNeeded = true;
|
||||
expandHosts = true;
|
||||
interface = "ens18";
|
||||
hosts = [
|
||||
"10.1.121.1 ipfire"
|
||||
"10.1.121.2 pi-hole"
|
||||
#"10.1.121.15 nas"
|
||||
];
|
||||
upstreams = ["127.0.0.1#5335"]; # Pointing to Unbound
|
||||
};
|
||||
ntp = {
|
||||
ipv4.active = true;
|
||||
ipv6.active = true;
|
||||
sync.active = true;
|
||||
};
|
||||
webserver = {
|
||||
api = {
|
||||
# To manage the web login:
|
||||
# 1) Temporarily set misc.readOnly to false in
|
||||
# configuration.nix and switch to it.
|
||||
# 2) Manually set a password:
|
||||
# Pi-hole web console > Settings > All settings >
|
||||
# Webserver and API > webserver. api.password > Value: ******
|
||||
# 3) Read the generated hash:
|
||||
# sudo pihole-FTL --config webserver.api.pwhash
|
||||
};
|
||||
session = {
|
||||
timeout = 43200; # 12h
|
||||
};
|
||||
};
|
||||
};
|
||||
useDnsmasqConfig = true;
|
||||
};
|
||||
|
||||
pihole-web = {
|
||||
enable = true;
|
||||
ports = [80];
|
||||
};
|
||||
|
||||
resolved = {
|
||||
extraConfig = ''
|
||||
DNSStubListener=no
|
||||
MulticastDNS=off
|
||||
'';
|
||||
};
|
||||
|
||||
# Unbound recursive DNS server configuration
|
||||
# Based on Pi-hole + Unbound guide: https://docs.pi-hole.net/guides/dns/unbound/
|
||||
unbound = {
|
||||
enable = true;
|
||||
package = pkgs.unbound-with-systemd;
|
||||
|
||||
settings = {
|
||||
server = {
|
||||
# Listen only on localhost for Pi-hole queries
|
||||
interface = ["127.0.0.1"];
|
||||
port = 5335;
|
||||
|
||||
# Access control - only allow localhost
|
||||
access-control = [
|
||||
"127.0.0.0/8 allow"
|
||||
"0.0.0.0/0 refuse"
|
||||
];
|
||||
|
||||
# Enable both IPv4 and IPv6
|
||||
do-ip4 = true;
|
||||
do-ip6 = true;
|
||||
do-udp = true;
|
||||
do-tcp = true;
|
||||
|
||||
# Prefer IPv4 (recommended for most setups)
|
||||
prefer-ip6 = false;
|
||||
|
||||
# Security enhancements
|
||||
harden-glue = true;
|
||||
harden-dnssec-stripped = true;
|
||||
use-caps-for-id = false; # Prevents DNSSEC issues
|
||||
|
||||
# Performance optimizations from Pi-hole guide
|
||||
edns-buffer-size = 1232; # Prevents UDP fragmentation
|
||||
prefetch = true; # Prefetch expiring cache entries
|
||||
|
||||
# Threading (1 thread sufficient for most home setups)
|
||||
num-threads = 1;
|
||||
|
||||
# Increase socket buffer for high query rates
|
||||
so-rcvbuf = "1m";
|
||||
|
||||
# Privacy - ensure no queries leak to public IPs
|
||||
private-address = [
|
||||
"192.168.0.0/16"
|
||||
"169.254.0.0/16"
|
||||
"172.16.0.0/12"
|
||||
"10.0.0.0/8"
|
||||
"fd00::/8"
|
||||
"fe80::/10"
|
||||
# RFC6303 addresses
|
||||
"192.0.2.0/24"
|
||||
"198.51.100.0/24"
|
||||
"203.0.113.0/24"
|
||||
"255.255.255.255/32"
|
||||
"2001:db8::/32"
|
||||
];
|
||||
|
||||
# Logging configuration (set to 0 for production, higher for debugging)
|
||||
verbosity = 0;
|
||||
log-queries = false;
|
||||
|
||||
# Additional security
|
||||
hide-identity = true;
|
||||
hide-version = true;
|
||||
|
||||
# Cache settings
|
||||
cache-min-ttl = 0;
|
||||
cache-max-ttl = 86400;
|
||||
|
||||
# Hardening options
|
||||
harden-below-nxdomain = true;
|
||||
harden-referral-path = false;
|
||||
harden-algo-downgrade = false;
|
||||
};
|
||||
|
||||
# Optional: Forward to encrypted DNS (comment out for pure recursive)
|
||||
# Uncomment below to use Quad9 with DNS-over-TLS
|
||||
# forward-zone = [
|
||||
# {
|
||||
# name = ". ";
|
||||
# forward-addr = [
|
||||
# "9.9.9.9@853#dns.quad9.net"
|
||||
# "149.112.112.112@853#dns.quad9.net"
|
||||
# ];
|
||||
# forward-tls-upstream = true;
|
||||
# }
|
||||
# ];
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
# Systemd configuration for Unbound and Pi-hole integration
|
||||
systemd = {
|
||||
# Create necessary directories and files
|
||||
tmpfiles.rules = [
|
||||
# Silence benign FTL. log warning
|
||||
"f /etc/pihole/versions 0644 pihole pihole - -"
|
||||
|
||||
# Unbound directories (if needed for custom configs)
|
||||
"d /var/lib/unbound 0755 unbound unbound - -"
|
||||
];
|
||||
|
||||
services = {
|
||||
# Ensure Unbound starts before Pi-hole FTL
|
||||
pihole-ftl = {
|
||||
after = ["unbound.service"];
|
||||
wants = ["unbound.service"];
|
||||
};
|
||||
|
||||
# Automatic root hints updater (runs monthly)
|
||||
unbound-root-hints-updater = {
|
||||
description = "Update Unbound Root Hints";
|
||||
serviceConfig = {
|
||||
Type = "oneshot";
|
||||
ExecStart = "${pkgs.writeShellScript "update-root-hints" ''
|
||||
#!/usr/bin/env bash
|
||||
set -euo pipefail
|
||||
|
||||
HINTS_FILE="/var/lib/unbound/root. hints"
|
||||
TEMP_FILE=$(mktemp)
|
||||
|
||||
echo "Downloading latest root hints..."
|
||||
${pkgs.curl}/bin/curl -sf https://www.internic.net/domain/named.root -o "$TEMP_FILE"
|
||||
|
||||
if [ -s "$TEMP_FILE" ]; then
|
||||
mv "$TEMP_FILE" "$HINTS_FILE"
|
||||
chown unbound:unbound "$HINTS_FILE"
|
||||
chmod 644 "$HINTS_FILE"
|
||||
echo "Root hints updated successfully"
|
||||
systemctl restart unbound. service
|
||||
else
|
||||
echo "Failed to download root hints"
|
||||
rm -f "$TEMP_FILE"
|
||||
exit 1
|
||||
fi
|
||||
''}";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
timers = {
|
||||
# Run root hints update monthly
|
||||
unbound-root-hints-updater = {
|
||||
description = "Monthly Unbound Root Hints Update";
|
||||
wantedBy = ["timers.target"];
|
||||
timerConfig = {
|
||||
OnCalendar = "monthly";
|
||||
Persistent = true;
|
||||
RandomizedDelaySec = "1h";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
# System activation scripts
|
||||
system.activationScripts = {
|
||||
print-pi-hole = {
|
||||
text = builtins.trace "Building the pi-hole configuration..." "";
|
||||
};
|
||||
|
||||
# Initialize unbound root hints on first boot
|
||||
unbound-root-hints = {
|
||||
text = ''
|
||||
if [ ! -f /var/lib/unbound/root.hints ]; then
|
||||
echo "Initializing Unbound root hints..."
|
||||
${pkgs.curl}/bin/curl -sf https://www.internic.net/domain/named.root \
|
||||
-o /var/lib/unbound/root.hints || true
|
||||
if [ -f /var/lib/unbound/root.hints ]; then
|
||||
chown unbound:unbound /var/lib/unbound/root. hints
|
||||
chmod 644 /var/lib/unbound/root.hints
|
||||
fi
|
||||
fi
|
||||
'';
|
||||
};
|
||||
|
||||
# Fix socket buffer size warning
|
||||
unbound-socket-buffer = {
|
||||
text = ''
|
||||
# Set kernel parameter for unbound socket buffer
|
||||
if [ "$(sysctl -n net. core.rmem_max)" -lt 1048576 ]; then
|
||||
echo "Setting net.core.rmem_max=1048576 for Unbound"
|
||||
sysctl -w net.core.rmem_max=1048576 || true
|
||||
fi
|
||||
'';
|
||||
};
|
||||
};
|
||||
|
||||
# Make socket buffer size permanent
|
||||
boot.kernel.sysctl = {
|
||||
"net.core.rmem_max" = 1048576; # 1MB for Unbound
|
||||
};
|
||||
|
||||
# Attach the system to the IPFire network: set a static IP on the Proxmox bridge (ens18)
|
||||
# Adjust `ens18` and the address below to your environment.
|
||||
networking.interfaces.ens18.ipv4.addresses = [
|
||||
{
|
||||
address = "10.1.121.2";
|
||||
prefixLength = 24;
|
||||
} # Using this IP for DNS server
|
||||
];
|
||||
networking.defaultGateway = "10.1.121.1";
|
||||
|
||||
# List services that you want to enable:
|
||||
|
||||
# Enable the OpenSSH daemon.
|
||||
# services.openssh.enable = true;
|
||||
|
||||
# Open ports in the firewall.
|
||||
# networking.firewall.allowedTCPPorts = [ ... ];
|
||||
# networking.firewall.allowedUDPPorts = [ ... ];
|
||||
# Or disable the firewall altogether.
|
||||
# networking.firewall.enable = false;
|
||||
|
||||
# This value determines the NixOS release from which the default
|
||||
# settings for stateful data, like file locations and database versions
|
||||
# on your system were taken. It's perfectly fine and recommended to leave
|
||||
# this value at the release version of the first install of this system.
|
||||
# Before changing this value read the documentation for this option
|
||||
# (e.g. man configuration-knot. nix or on https://nixos.org/nixos/options.html).
|
||||
system.stateVersion = "25.11"; # Did you read the comment?
|
||||
}
|
||||
|
|
@ -0,0 +1,61 @@
|
|||
version: '3.3'
|
||||
services:
|
||||
partdb:
|
||||
container_name: partdb
|
||||
# By default Part-DB will be running under Port 8080, you can change it here
|
||||
ports:
|
||||
- '633:80'
|
||||
volumes:
|
||||
# By default
|
||||
- ./uploads:/var/www/html/uploads
|
||||
- ./public_media:/var/www/html/public/media
|
||||
- ./db:/var/www/html/var/db
|
||||
restart: unless-stopped
|
||||
image: jbtronics/part-db1:latest
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.routers.myservice.rule=Host(`myservice.YOUR.DOMAIN`)"
|
||||
- "traefik.http.routers.myservice.entrypoints=websecure"
|
||||
- "traefik.http.services.myservice.loadbalancer. server.port=80"
|
||||
depends_on:
|
||||
- database
|
||||
environment:
|
||||
# Replace 4321112sss with the value of MYSQL_PASSWORD from below
|
||||
- DATABASE_URL=mysql://partdb:4321112sss@database:3306/partdb
|
||||
# In docker env logs will be redirected to stderr
|
||||
- APP_ENV=docker
|
||||
|
||||
# Uncomment this, if you want to use the automatic database migration feature. With this you do not have to
|
||||
# run the doctrine:migrations:migrate commands on installation or upgrade. A database backup is written to the uploads/
|
||||
# folder (under .automigration-backup), so you can restore it, if the migration fails.
|
||||
# This feature is currently experimental, so use it at your own risk!
|
||||
- DB_AUTOMIGRATE=true
|
||||
|
||||
# You can configure Part-DB using the webUI or environment variables
|
||||
# However you can add any other environment configuration you want here
|
||||
# See .env file for all available options or https://docs.part-db.de/configuration.html
|
||||
|
||||
# Override value if you want to show a given text on homepage.
|
||||
# When this is commented out the webUI can be used to configure the banner
|
||||
#- BANNER=This is a test banner<br>with a line break
|
||||
|
||||
# If you need to install additional composer packages (e.g., for specific mailer transports), you can specify them here:
|
||||
# - COMPOSER_EXTRA_PACKAGES=symfony/mailgun-mailer symfony/sendgrid-mailer
|
||||
|
||||
database:
|
||||
container_name: partdb_database
|
||||
image: mysql:8.0
|
||||
restart: unless-stopped
|
||||
command: --default-authentication-plugin=mysql_native_password --log-bin-trust-function-creators=1
|
||||
environment:
|
||||
# Change this Password
|
||||
MYSQL_ROOT_PASSWORD: jijoioajdiojasdas1123
|
||||
MYSQL_DATABASE: partdb
|
||||
MYSQL_USER: partdb
|
||||
MYSQL_PASSWORD: 4321112sss
|
||||
# Uncomment the following line if you need to access, your MySQL database from outside of docker (e.g. for debugging), normally you should leave that disabled
|
||||
#ports:
|
||||
# - '4306:3306'
|
||||
volumes:
|
||||
- ./mysql:/var/lib/mysql
|
||||
|
||||
418
nix-system-configs/forgejo/forgejo-git-post.nix
Normal file
418
nix-system-configs/forgejo/forgejo-git-post.nix
Normal file
|
|
@ -0,0 +1,418 @@
|
|||
# Edit this configuration file to define what should be installed on
|
||||
# your system. Help is available in the configuration-knot.nix(5) man page
|
||||
# and in the NixOS manual (accessible by running ‘nixos-help’).
|
||||
{
|
||||
config,
|
||||
pkgs,
|
||||
lib,
|
||||
...
|
||||
}: let
|
||||
home-manager = builtins.fetchTarball "https://github.com/nix-community/home-manager/archive/release-25.11.tar.gz";
|
||||
cfg = config.services.forgejo;
|
||||
srv = cfg.settings.server;
|
||||
in {
|
||||
# Home Manager Configuration
|
||||
imports = [
|
||||
# Include the results of the hardware scan.
|
||||
(import "${home-manager}/nixos")
|
||||
];
|
||||
|
||||
networking.hostName = "forgejoprg"; # Define your hostname.
|
||||
# BE SURE TO FIND AND REPLACE ALL INSTANCES OF THIS HOSTNAME IN THE CONFIGURATION FILES
|
||||
# Define a user account. Don't forget to set a password with ‘passwd’.
|
||||
|
||||
users.users.forgejoprg = {
|
||||
isNormalUser = true;
|
||||
description = "NixOS Playground";
|
||||
extraGroups = ["networkmanager" "wheel" "seat"];
|
||||
packages = with pkgs; [];
|
||||
initialPassword = "nixos"; # Simple, change on first login
|
||||
};
|
||||
|
||||
home-manager.users.forgejoprg = {pkgs, ...}: {
|
||||
home.packages = [
|
||||
pkgs.atool
|
||||
pkgs.httpie
|
||||
pkgs.alacritty # Terminal emulator
|
||||
pkgs.hyfetch # Add fetching packages
|
||||
pkgs.macchina
|
||||
pkgs.wayland # Wayland display server
|
||||
pkgs.wlroots # Wayland compositor library
|
||||
pkgs.maple-mono.NF # Font for better terminal appearance
|
||||
pkgs.wl-clipboard # Clipboard utilities for Wayland
|
||||
pkgs.mako # Wayland Sway Notification Daemon
|
||||
pkgs.btop # Resource monitor
|
||||
];
|
||||
|
||||
# Set Alacritty as the default terminal emulator
|
||||
home.sessionVariables = {
|
||||
TERMINAL = "alacritty";
|
||||
};
|
||||
|
||||
# Use Zsh as the default shell
|
||||
programs.zsh.enable = true;
|
||||
|
||||
# Configure Alacritty as the default terminal emulator
|
||||
programs.alacritty = {
|
||||
enable = true;
|
||||
settings = {
|
||||
# Window configuration
|
||||
window = {
|
||||
opacity = 1.0;
|
||||
padding = {
|
||||
x = 10;
|
||||
y = 10;
|
||||
};
|
||||
};
|
||||
|
||||
# Font configuration - fixes spacing issues
|
||||
font = {
|
||||
normal = {
|
||||
family = "Maple Mono NF";
|
||||
style = "Regular";
|
||||
};
|
||||
bold = {
|
||||
family = "Maple Mono NF";
|
||||
style = "Bold";
|
||||
};
|
||||
italic = {
|
||||
family = "Maple Mono NF";
|
||||
style = "Italic";
|
||||
};
|
||||
bold_italic = {
|
||||
family = "Maple Mono NF";
|
||||
style = "Bold Italic";
|
||||
};
|
||||
size = 14.0;
|
||||
};
|
||||
|
||||
# Colors (optional - using default Alacritty colors)
|
||||
colors = {
|
||||
primary = {
|
||||
background = "#1e1e2e";
|
||||
foreground = "#cdd6f4";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
# Configure Hyfetch system info fetcher
|
||||
programs.hyfetch = {
|
||||
enable = true;
|
||||
settings = {
|
||||
preset = "lesbian"; # Use lesbian flag preset
|
||||
mode = "rgb"; # Use RGB color mode
|
||||
lightness = 0.55; # Set to 55% brightness
|
||||
backend = "macchina"; # Use macchina as the backend
|
||||
logo_size = "small"; # Make small logo
|
||||
pride_month_disable = false; # Enable pride month mode (or true to disable)
|
||||
pride_month_shown = []; # List of shown pride month flags
|
||||
color_align = {
|
||||
mode = "horizontal";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
# The state version is required and should stay at the version you
|
||||
# originally installed.
|
||||
home.stateVersion = "25.11";
|
||||
};
|
||||
|
||||
# Use Lix instead of Nix
|
||||
nixpkgs.overlays = [
|
||||
(final: prev: {
|
||||
inherit
|
||||
(prev.lixPackageSets.stable)
|
||||
nixpkgs-review
|
||||
nix-eval-jobs
|
||||
nix-fast-build
|
||||
colmena
|
||||
;
|
||||
})
|
||||
];
|
||||
nix.package = pkgs.lixPackageSets.stable.lix;
|
||||
|
||||
# Enable Fedgejo service
|
||||
services.nginx = {
|
||||
enable = true;
|
||||
virtualHosts."git.prg.local" = {
|
||||
# Remove forceSSL and enableACME for local network
|
||||
# forceSSL = true;
|
||||
# enableACME = true;
|
||||
extraConfig = ''
|
||||
client_max_body_size 512M;
|
||||
'';
|
||||
locations."/".proxyPass = "http://localhost:${toString srv.HTTP_PORT}";
|
||||
};
|
||||
};
|
||||
|
||||
# Enable PostgreSQL for Forgejo
|
||||
services.postgresql.enable = true;
|
||||
|
||||
# Forgejo configuration
|
||||
services.forgejo = {
|
||||
enable = true;
|
||||
database = {
|
||||
type = "postgres";
|
||||
host = "10.1.1.251"; # IP of your database server
|
||||
name = "forgejo";
|
||||
user = "forgejo";
|
||||
passwordFile = "/home/nixosbm/manual_builds/password.txt"; # Store password in a separate file for security
|
||||
};
|
||||
lfs.enable = true;
|
||||
|
||||
settings = {
|
||||
server = {
|
||||
DOMAIN = "git.prg.local";
|
||||
ROOT_URL = "http://${srv.DOMAIN}/";
|
||||
HTTP_PORT = 3000;
|
||||
# SSH integration
|
||||
SSH_PORT = lib.head config.services.openssh.ports;
|
||||
};
|
||||
|
||||
# Temporarily allow registration to create admin user
|
||||
service.DISABLE_REGISTRATION = false;
|
||||
|
||||
# Enable Actions support
|
||||
actions = {
|
||||
ENABLED = true;
|
||||
DEFAULT_ACTIONS_URL = "github";
|
||||
};
|
||||
|
||||
# Optional: Email configuration
|
||||
# mailer = {
|
||||
# ENABLED = false;
|
||||
# };
|
||||
};
|
||||
};
|
||||
|
||||
# Bootloader - GRUB for Legacy BIOS
|
||||
boot.loader.systemd-boot.enable = lib.mkForce false;
|
||||
boot.loader.grub = {
|
||||
enable = true;
|
||||
device = "/dev/vda"; # Install GRUB to the disk
|
||||
efiSupport = false; # Disable UEFI
|
||||
};
|
||||
boot.initrd.availableKernelModules = ["virtio_pci" "virtio_scsi" "ahci" "sd_mod"];
|
||||
fileSystems."/" = {
|
||||
device = "/dev/vda1";
|
||||
fsType = "ext4"; # Use "btrfs" or "xfs" if you formatted it differently
|
||||
};
|
||||
|
||||
# Enable Rsync
|
||||
services.rsync.enable = true;
|
||||
|
||||
# Configure network proxy if necessary
|
||||
# networking.proxy.default = "http://user:password@proxy:port/";
|
||||
# networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";
|
||||
|
||||
# Enable SSH
|
||||
services.openssh = {
|
||||
enable = true;
|
||||
ports = [22];
|
||||
settings = {
|
||||
PasswordAuthentication = false;
|
||||
AllowUsers = null;
|
||||
UseDns = true;
|
||||
PermitRootLogin = "no";
|
||||
};
|
||||
};
|
||||
|
||||
# Set your time zone.
|
||||
time.timeZone = "Europe/Copenhagen";
|
||||
|
||||
# Select internationalisation properties.
|
||||
i18n.defaultLocale = "en_AU.UTF-8";
|
||||
|
||||
i18n.extraLocaleSettings = {
|
||||
LC_ADDRESS = "et_EE.UTF-8";
|
||||
LC_IDENTIFICATION = "et_EE.UTF-8";
|
||||
LC_MEASUREMENT = "et_EE.UTF-8";
|
||||
LC_MONETARY = "et_EE.UTF-8";
|
||||
LC_NAME = "et_EE.UTF-8";
|
||||
LC_NUMERIC = "et_EE.UTF-8";
|
||||
LC_PAPER = "et_EE.UTF-8";
|
||||
LC_TELEPHONE = "et_EE.UTF-8";
|
||||
LC_TIME = "et_EE.UTF-8";
|
||||
};
|
||||
|
||||
# Configure keymap in X11
|
||||
services.xserver.xkb = {
|
||||
layout = "us";
|
||||
variant = "";
|
||||
};
|
||||
|
||||
# Enable Seatd for Wayland sessions
|
||||
# IMPORTANT: Enable seatd service for River WM
|
||||
services.seatd = {
|
||||
enable = true;
|
||||
logLevel = "info";
|
||||
};
|
||||
|
||||
# Enable the gnome-keyring secrets vault.
|
||||
# Will be exposed through DBus to programs willing to store secrets.
|
||||
services.gnome.gnome-keyring.enable = true;
|
||||
|
||||
# Enable Sway window manager
|
||||
programs.sway = {
|
||||
enable = true;
|
||||
wrapperFeatures.gtk = true;
|
||||
};
|
||||
|
||||
services.greetd = {
|
||||
enable = true;
|
||||
settings = {
|
||||
default_session = {
|
||||
command = "${pkgs.tuigreet}/bin/tuigreet --time --cmd sway";
|
||||
user = "greeter";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
# Configure security to allow seatd access
|
||||
security.polkit.enable = true;
|
||||
|
||||
# Allow unfree packages
|
||||
nixpkgs.config.allowUnfree = true;
|
||||
|
||||
# Passwordless sudo for wheel group
|
||||
security.sudo.wheelNeedsPassword = false;
|
||||
|
||||
# Hardware U2F support - Passwordless sudo with hardware key
|
||||
security.pam.u2f = {
|
||||
enable = true;
|
||||
settings = {
|
||||
authfile = "/etc/u2f_keys";
|
||||
cue = true;
|
||||
pinverification = 0; # No PIN verification
|
||||
userpresence = 1; # Require user presence (touch)
|
||||
};
|
||||
};
|
||||
|
||||
# SSH Agent authentication
|
||||
security.pam.sshAgentAuth.enable = true;
|
||||
|
||||
# Automatic upgrades
|
||||
system.autoUpgrade = {
|
||||
enable = true; # Set to true for automatic updates
|
||||
dates = "daily";
|
||||
allowReboot = false;
|
||||
};
|
||||
|
||||
# System packages
|
||||
environment.systemPackages = with pkgs; [
|
||||
# Network tools
|
||||
wget
|
||||
curl
|
||||
dig
|
||||
tcpdump
|
||||
ethtool
|
||||
iptables
|
||||
nftables
|
||||
iproute2
|
||||
bridge-utils
|
||||
netcat-gnu
|
||||
traceroute
|
||||
mtr
|
||||
arp-scan
|
||||
|
||||
# Monitoring
|
||||
btop
|
||||
htop
|
||||
iotop
|
||||
|
||||
# Editors
|
||||
micro
|
||||
vim
|
||||
helix
|
||||
|
||||
# System info
|
||||
fastfetch
|
||||
lshw
|
||||
pciutils
|
||||
usbutils
|
||||
];
|
||||
|
||||
# Enable zram swap
|
||||
zramSwap = {
|
||||
enable = true;
|
||||
memoryPercent = 50;
|
||||
};
|
||||
|
||||
# Some programs need SUID wrappers, can be configured further or are
|
||||
# started in user sessions.
|
||||
# programs.mtr.enable = true;
|
||||
# programs.gnupg.agent = {
|
||||
# enable = true;
|
||||
# enableSSHSupport = true;
|
||||
# };
|
||||
|
||||
# List services that you want to enable:
|
||||
|
||||
# Open ports in the firewall.
|
||||
networking.firewall.allowedTCPPorts = [3000];
|
||||
# networking.firewall.allowedUDPPorts = [ ... ];
|
||||
# Or disable the firewall altogether.
|
||||
# networking.firewall.enable = false;
|
||||
|
||||
# Attach the system to the IPFire network: set a static IP on the Proxmox bridge (ens18)
|
||||
# Adjust `ens18` and the address below to your environment.
|
||||
networking.interfaces.ens18.ipv4.addresses = [
|
||||
{
|
||||
address = "10.1.1.4";
|
||||
prefixLength = 24;
|
||||
}
|
||||
];
|
||||
networking.defaultGateway = "10.1.1.1";
|
||||
|
||||
# THE FOLLOWING CODE BLOCK IS FOR COPYING TO OTHER CONFIGURATIONS, NOT FOR THIS FILE
|
||||
nix.distributedBuilds = true;
|
||||
nix.buildMachines = [
|
||||
{
|
||||
hostName = "nixos-build-machine";
|
||||
system = "x86_64-linux";
|
||||
sshUser = "nixremote";
|
||||
sshKey = "/root/.ssh/nixremote";
|
||||
maxJobs = 4;
|
||||
speedFactor = 2;
|
||||
supportedFeatures = ["nixos-test" "benchmark" "big-parallel" "kvm"];
|
||||
}
|
||||
];
|
||||
|
||||
# Generate SSH key for remote building
|
||||
systemd.services.generate-nixremote-key = {
|
||||
description = "Generate SSH key for remote Nix builds";
|
||||
wantedBy = ["multi-user.target"];
|
||||
serviceConfig = {
|
||||
Type = "oneshot";
|
||||
RemainAfterExit = true;
|
||||
};
|
||||
script = ''
|
||||
if [ ! -f /root/.ssh/nixremote ]; then
|
||||
${pkgs.openssh}/bin/ssh-keygen -t ed25519 -f /root/.ssh/nixremote -N "" -C "nix-remote-builder"
|
||||
fi
|
||||
'';
|
||||
};
|
||||
|
||||
programs.ssh.extraConfig = ''
|
||||
Host nixos-build-machine
|
||||
HostName 10.1.1.3
|
||||
IdentitiesOnly yes
|
||||
IdentityFile /root/.ssh/nixremote
|
||||
User nixremoteStrictHostKeyChecking accept-new
|
||||
'';
|
||||
|
||||
# Manual step required: After rebuilding the client, copy /root/.ssh/nixremote.pub
|
||||
# from the client to the build machine's users.users.nixremote.openssh.authorizedKeys.keys list,
|
||||
# then rebuild the build machine.
|
||||
# i.e on the client: run "cat /root.ssh/nixremote.pub"
|
||||
# and copy the output to the build machine's configuration.nix
|
||||
|
||||
# This value determines the NixOS release from which the default
|
||||
# settings for stateful data, like file locations and database versions
|
||||
# on your system were taken. It‘s perfectly fine and recommended to leave
|
||||
# this value at the release version of the first install of this system.
|
||||
# Before changing this value read the documentation for this option
|
||||
# (e.g. man configuration-knot.nix or on https://nixos.org/nixos/options.html).
|
||||
system.stateVersion = "25.11"; # Did you read the comment?
|
||||
}
|
||||
415
nix-system-configs/forgejo/forgejo-git.nix
Normal file
415
nix-system-configs/forgejo/forgejo-git.nix
Normal file
|
|
@ -0,0 +1,415 @@
|
|||
# Edit this configuration file to define what should be installed on
|
||||
# your system. Help is available in the configuration-knot.nix(5) man page
|
||||
# and in the NixOS manual (accessible by running ‘nixos-help’).
|
||||
{
|
||||
config,
|
||||
pkgs,
|
||||
lib,
|
||||
...
|
||||
}: let
|
||||
home-manager = builtins.fetchTarball "https://github.com/nix-community/home-manager/archive/release-25.11.tar.gz";
|
||||
cfg = config.services.forgejo;
|
||||
srv = cfg.settings.server;
|
||||
in {
|
||||
# Home Manager Configuration
|
||||
imports = [
|
||||
# Include the results of the hardware scan.
|
||||
(import "${home-manager}/nixos")
|
||||
];
|
||||
|
||||
networking.hostName = "forgejoprg"; # Define your hostname.
|
||||
# BE SURE TO FIND AND REPLACE ALL INSTANCES OF THIS HOSTNAME IN THE CONFIGURATION FILES
|
||||
# Define a user account. Don't forget to set a password with ‘passwd’.
|
||||
|
||||
users.users.forgejoprg = {
|
||||
isNormalUser = true;
|
||||
description = "NixOS Playground";
|
||||
extraGroups = ["networkmanager" "wheel" "seat"];
|
||||
packages = with pkgs; [];
|
||||
initialPassword = "nixos"; # Simple, change on first login
|
||||
};
|
||||
|
||||
home-manager.users.forgejoprg = {pkgs, ...}: {
|
||||
home.packages = [
|
||||
pkgs.atool
|
||||
pkgs.httpie
|
||||
pkgs.alacritty # Terminal emulator
|
||||
pkgs.hyfetch # Add fetching packages
|
||||
pkgs.macchina
|
||||
pkgs.wayland # Wayland display server
|
||||
pkgs.wlroots # Wayland compositor library
|
||||
pkgs.maple-mono.NF # Font for better terminal appearance
|
||||
pkgs.wl-clipboard # Clipboard utilities for Wayland
|
||||
pkgs.mako # Wayland Sway Notification Daemon
|
||||
pkgs.btop # Resource monitor
|
||||
];
|
||||
|
||||
# Set Alacritty as the default terminal emulator
|
||||
home.sessionVariables = {
|
||||
TERMINAL = "alacritty";
|
||||
};
|
||||
|
||||
# Use Zsh as the default shell
|
||||
programs.zsh.enable = true;
|
||||
|
||||
# Configure Alacritty as the default terminal emulator
|
||||
programs.alacritty = {
|
||||
enable = true;
|
||||
settings = {
|
||||
# Window configuration
|
||||
window = {
|
||||
opacity = 1.0;
|
||||
padding = {
|
||||
x = 10;
|
||||
y = 10;
|
||||
};
|
||||
};
|
||||
|
||||
# Font configuration - fixes spacing issues
|
||||
font = {
|
||||
normal = {
|
||||
family = "Maple Mono NF";
|
||||
style = "Regular";
|
||||
};
|
||||
bold = {
|
||||
family = "Maple Mono NF";
|
||||
style = "Bold";
|
||||
};
|
||||
italic = {
|
||||
family = "Maple Mono NF";
|
||||
style = "Italic";
|
||||
};
|
||||
bold_italic = {
|
||||
family = "Maple Mono NF";
|
||||
style = "Bold Italic";
|
||||
};
|
||||
size = 14.0;
|
||||
};
|
||||
|
||||
# Colors (optional - using default Alacritty colors)
|
||||
colors = {
|
||||
primary = {
|
||||
background = "#1e1e2e";
|
||||
foreground = "#cdd6f4";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
# Configure Hyfetch system info fetcher
|
||||
programs.hyfetch = {
|
||||
enable = true;
|
||||
settings = {
|
||||
preset = "lesbian"; # Use lesbian flag preset
|
||||
mode = "rgb"; # Use RGB color mode
|
||||
lightness = 0.55; # Set to 55% brightness
|
||||
backend = "macchina"; # Use macchina as the backend
|
||||
logo_size = "small"; # Make small logo
|
||||
pride_month_disable = false; # Enable pride month mode (or true to disable)
|
||||
pride_month_shown = []; # List of shown pride month flags
|
||||
color_align = {
|
||||
mode = "horizontal";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
# The state version is required and should stay at the version you
|
||||
# originally installed.
|
||||
home.stateVersion = "25.11";
|
||||
};
|
||||
|
||||
# Use Lix instead of Nix
|
||||
nixpkgs.overlays = [
|
||||
(final: prev: {
|
||||
inherit
|
||||
(prev.lixPackageSets.stable)
|
||||
nixpkgs-review
|
||||
nix-eval-jobs
|
||||
nix-fast-build
|
||||
colmena
|
||||
;
|
||||
})
|
||||
];
|
||||
nix.package = pkgs.lixPackageSets.stable.lix;
|
||||
|
||||
# Enable Fedgejo service
|
||||
services.nginx = {
|
||||
enable = true;
|
||||
virtualHosts."git.prg.local" = {
|
||||
# Remove forceSSL and enableACME for local network
|
||||
# forceSSL = true;
|
||||
# enableACME = true;
|
||||
extraConfig = ''
|
||||
client_max_body_size 512M;
|
||||
'';
|
||||
locations."/".proxyPass = "http://localhost:${toString srv.HTTP_PORT}";
|
||||
};
|
||||
};
|
||||
|
||||
# Enable PostgreSQL for Forgejo
|
||||
services.postgresql.enable = true;
|
||||
|
||||
# Forgejo configuration
|
||||
services.forgejo = {
|
||||
enable = true;
|
||||
database = {
|
||||
type = "postgres";
|
||||
host = "10.1.1.251"; # IP of your database server
|
||||
name = "forgejo";
|
||||
user = "forgejo";
|
||||
passwordFile = "/home/nixosbm/manual_builds/password.txt"; # Store password in a separate file for security
|
||||
};
|
||||
lfs.enable = true;
|
||||
|
||||
settings = {
|
||||
server = {
|
||||
DOMAIN = "git.prg.local";
|
||||
ROOT_URL = "http://${srv.DOMAIN}/";
|
||||
HTTP_PORT = 3000;
|
||||
# SSH integration
|
||||
SSH_PORT = lib.head config.services.openssh.ports;
|
||||
};
|
||||
|
||||
# Temporarily allow registration to create admin user
|
||||
service.DISABLE_REGISTRATION = false;
|
||||
|
||||
# Enable Actions support
|
||||
actions = {
|
||||
ENABLED = true;
|
||||
DEFAULT_ACTIONS_URL = "github";
|
||||
};
|
||||
|
||||
# Optional: Email configuration
|
||||
# mailer = {
|
||||
# ENABLED = false;
|
||||
# };
|
||||
};
|
||||
};
|
||||
|
||||
# Bootloader - GRUB for Legacy BIOS
|
||||
boot.loader.systemd-boot.enable = lib.mkForce false;
|
||||
boot.loader.grub = {
|
||||
enable = true;
|
||||
device = "/dev/vda"; # Install GRUB to the disk
|
||||
efiSupport = false; # Disable UEFI
|
||||
};
|
||||
boot.initrd.availableKernelModules = ["virtio_pci" "virtio_scsi" "ahci" "sd_mod"];
|
||||
virtualisation.diskSize = 19432; # 96GB in MiB
|
||||
|
||||
# Enable Rsymc
|
||||
services.rsync.enable = true;
|
||||
|
||||
# Configure network proxy if necessary
|
||||
# networking.proxy.default = "http://user:password@proxy:port/";
|
||||
# networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";
|
||||
|
||||
# Enable SSH
|
||||
services.openssh = {
|
||||
enable = true;
|
||||
ports = [22];
|
||||
settings = {
|
||||
PasswordAuthentication = false;
|
||||
AllowUsers = null;
|
||||
UseDns = true;
|
||||
PermitRootLogin = "no";
|
||||
};
|
||||
};
|
||||
|
||||
# Set your time zone.
|
||||
time.timeZone = "Europe/Copenhagen";
|
||||
|
||||
# Select internationalisation properties.
|
||||
i18n.defaultLocale = "en_AU.UTF-8";
|
||||
|
||||
i18n.extraLocaleSettings = {
|
||||
LC_ADDRESS = "et_EE.UTF-8";
|
||||
LC_IDENTIFICATION = "et_EE.UTF-8";
|
||||
LC_MEASUREMENT = "et_EE.UTF-8";
|
||||
LC_MONETARY = "et_EE.UTF-8";
|
||||
LC_NAME = "et_EE.UTF-8";
|
||||
LC_NUMERIC = "et_EE.UTF-8";
|
||||
LC_PAPER = "et_EE.UTF-8";
|
||||
LC_TELEPHONE = "et_EE.UTF-8";
|
||||
LC_TIME = "et_EE.UTF-8";
|
||||
};
|
||||
|
||||
# Configure keymap in X11
|
||||
services.xserver.xkb = {
|
||||
layout = "us";
|
||||
variant = "";
|
||||
};
|
||||
|
||||
# Enable Seatd for Wayland sessions
|
||||
# IMPORTANT: Enable seatd service for River WM
|
||||
services.seatd = {
|
||||
enable = true;
|
||||
logLevel = "info";
|
||||
};
|
||||
|
||||
# Enable the gnome-keyring secrets vault.
|
||||
# Will be exposed through DBus to programs willing to store secrets.
|
||||
services.gnome.gnome-keyring.enable = true;
|
||||
|
||||
# Enable Sway window manager
|
||||
programs.sway = {
|
||||
enable = true;
|
||||
wrapperFeatures.gtk = true;
|
||||
};
|
||||
|
||||
services.greetd = {
|
||||
enable = true;
|
||||
settings = {
|
||||
default_session = {
|
||||
command = "${pkgs.tuigreet}/bin/tuigreet --time --cmd sway";
|
||||
user = "greeter";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
# Configure security to allow seatd access
|
||||
security.polkit.enable = true;
|
||||
|
||||
# Allow unfree packages
|
||||
nixpkgs.config.allowUnfree = true;
|
||||
|
||||
# Passwordless sudo for wheel group
|
||||
security.sudo.wheelNeedsPassword = false;
|
||||
|
||||
# Hardware U2F support - Passwordless sudo with hardware key
|
||||
security.pam.u2f = {
|
||||
enable = true;
|
||||
settings = {
|
||||
authfile = "/etc/u2f_keys";
|
||||
cue = true;
|
||||
pinverification = 0; # No PIN verification
|
||||
userpresence = 1; # Require user presence (touch)
|
||||
};
|
||||
};
|
||||
|
||||
# SSH Agent authentication
|
||||
security.pam.sshAgentAuth.enable = true;
|
||||
|
||||
# Automatic upgrades
|
||||
system.autoUpgrade = {
|
||||
enable = true; # Set to true for automatic updates
|
||||
dates = "daily";
|
||||
allowReboot = false;
|
||||
};
|
||||
|
||||
# System packages
|
||||
environment.systemPackages = with pkgs; [
|
||||
# Network tools
|
||||
wget
|
||||
curl
|
||||
dig
|
||||
tcpdump
|
||||
ethtool
|
||||
iptables
|
||||
nftables
|
||||
iproute2
|
||||
bridge-utils
|
||||
netcat-gnu
|
||||
traceroute
|
||||
mtr
|
||||
arp-scan
|
||||
|
||||
# Monitoring
|
||||
btop
|
||||
htop
|
||||
iotop
|
||||
|
||||
# Editors
|
||||
micro
|
||||
vim
|
||||
helix
|
||||
|
||||
# System info
|
||||
fastfetch
|
||||
lshw
|
||||
pciutils
|
||||
usbutils
|
||||
];
|
||||
|
||||
# Enable zram swap
|
||||
zramSwap = {
|
||||
enable = true;
|
||||
memoryPercent = 50;
|
||||
};
|
||||
|
||||
# Some programs need SUID wrappers, can be configured further or are
|
||||
# started in user sessions.
|
||||
# programs.mtr.enable = true;
|
||||
# programs.gnupg.agent = {
|
||||
# enable = true;
|
||||
# enableSSHSupport = true;
|
||||
# };
|
||||
|
||||
# List services that you want to enable:
|
||||
|
||||
# Open ports in the firewall.
|
||||
networking.firewall.allowedTCPPorts = [3000];
|
||||
# networking.firewall.allowedUDPPorts = [ ... ];
|
||||
# Or disable the firewall altogether.
|
||||
# networking.firewall.enable = false;
|
||||
|
||||
# Attach the system to the IPFire network: set a static IP on the Proxmox bridge (ens18)
|
||||
# Adjust `ens18` and the address below to your environment.
|
||||
networking.interfaces.ens18.ipv4.addresses = [
|
||||
{
|
||||
address = "10.1.1.4";
|
||||
prefixLength = 24;
|
||||
}
|
||||
];
|
||||
networking.defaultGateway = "10.1.1.1";
|
||||
|
||||
# THE FOLLOWING CODE BLOCK IS FOR COPYING TO OTHER CONFIGURATIONS, NOT FOR THIS FILE
|
||||
nix.distributedBuilds = true;
|
||||
nix.buildMachines = [
|
||||
{
|
||||
hostName = "nixos-build-machine";
|
||||
system = "x86_64-linux";
|
||||
sshUser = "nixremote";
|
||||
sshKey = "/root/.ssh/nixremote";
|
||||
maxJobs = 4;
|
||||
speedFactor = 2;
|
||||
supportedFeatures = ["nixos-test" "benchmark" "big-parallel" "kvm"];
|
||||
}
|
||||
];
|
||||
|
||||
# Generate SSH key for remote building
|
||||
systemd.services.generate-nixremote-key = {
|
||||
description = "Generate SSH key for remote Nix builds";
|
||||
wantedBy = ["multi-user.target"];
|
||||
serviceConfig = {
|
||||
Type = "oneshot";
|
||||
RemainAfterExit = true;
|
||||
};
|
||||
script = ''
|
||||
if [ ! -f /root/.ssh/nixremote ]; then
|
||||
${pkgs.openssh}/bin/ssh-keygen -t ed25519 -f /root/.ssh/nixremote -N "" -C "nix-remote-builder"
|
||||
fi
|
||||
'';
|
||||
};
|
||||
|
||||
programs.ssh.extraConfig = ''
|
||||
Host nixos-build-machine
|
||||
HostName 10.1.1.3
|
||||
IdentitiesOnly yes
|
||||
IdentityFile /root/.ssh/nixremote
|
||||
User nixremoteStrictHostKeyChecking accept-new
|
||||
'';
|
||||
|
||||
# Manual step required: After rebuilding the client, copy /root/.ssh/nixremote.pub
|
||||
# from the client to the build machine's users.users.nixremote.openssh.authorizedKeys.keys list,
|
||||
# then rebuild the build machine.
|
||||
# i.e on the client: run "cat /root.ssh/nixremote.pub"
|
||||
# and copy the output to the build machine's configuration.nix
|
||||
|
||||
# This value determines the NixOS release from which the default
|
||||
# settings for stateful data, like file locations and database versions
|
||||
# on your system were taken. It‘s perfectly fine and recommended to leave
|
||||
# this value at the release version of the first install of this system.
|
||||
# Before changing this value read the documentation for this option
|
||||
# (e.g. man configuration-knot.nix or on https://nixos.org/nixos/options.html).
|
||||
system.stateVersion = "25.11"; # Did you read the comment?
|
||||
}
|
||||
330
nix-system-configs/gateway/gateway.nix
Executable file
330
nix-system-configs/gateway/gateway.nix
Executable file
|
|
@ -0,0 +1,330 @@
|
|||
# Edit this configuration file to define what should be installed on
|
||||
# your system. Help is available in the configuration-knot.nix(5) man page
|
||||
# and in the NixOS manual (accessible by running ‘nixos-help’).
|
||||
{
|
||||
config,
|
||||
pkgs,
|
||||
lib,
|
||||
...
|
||||
}: let
|
||||
home-manager = builtins.fetchTarball "https://github.com/nix-community/home-manager/archive/release-25.11.tar.gz";
|
||||
in {
|
||||
# Home Manager Configuration
|
||||
imports = [
|
||||
# Include the results of the hardware scan.
|
||||
./hardware-configuration.nix
|
||||
(import "${home-manager}/nixos")
|
||||
];
|
||||
|
||||
# Use Lix instead of Nix
|
||||
nixpkgs.overlays = [
|
||||
(final: prev: {
|
||||
inherit
|
||||
(prev.lixPackageSets.stable)
|
||||
nixpkgs-review
|
||||
nix-eval-jobs
|
||||
nix-fast-build
|
||||
colmena
|
||||
;
|
||||
})
|
||||
];
|
||||
|
||||
nix.package = pkgs.lixPackageSets.stable.lix;
|
||||
|
||||
# Bootloader.
|
||||
boot.loader.systemd-boot.enable = false;
|
||||
boot.loader.grub = {
|
||||
default = 0;
|
||||
enable = true;
|
||||
useOSProber = true;
|
||||
efiSupport = true;
|
||||
efiInstallAsRemovable = true;
|
||||
device = "nodev";
|
||||
};
|
||||
|
||||
#boot.loader.efi.canTouchEfiVariables = true;
|
||||
boot.loader.efi.efiSysMountPoint = "/boot";
|
||||
|
||||
networking.hostName = "nixosp"; # Define your hostname.
|
||||
#networking.wireless.enable = true; # Enables wireless support via wpa_supplicant.
|
||||
|
||||
# Enable Rsymc
|
||||
services.rsync.enable = true;
|
||||
|
||||
# Configure network proxy if necessary
|
||||
# networking.proxy.default = "http://user:password@proxy:port/";
|
||||
# networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";
|
||||
|
||||
# Enable networking
|
||||
networking.networkmanager.enable = true;
|
||||
networking.interfaces.wlo1.ipv4.addresses = [
|
||||
{
|
||||
address = "192.168.1.15";
|
||||
prefixLength = 32;
|
||||
}
|
||||
];
|
||||
|
||||
# Enable SSH
|
||||
services.openssh = {
|
||||
enable = true;
|
||||
ports = [22];
|
||||
settings = {
|
||||
PasswordAuthentication = false;
|
||||
AllowUsers = null;
|
||||
UseDns = true;
|
||||
PermitRootLogin = "no";
|
||||
};
|
||||
};
|
||||
|
||||
# Set your time zone.
|
||||
time.timeZone = "Europe/Copenhagen";
|
||||
|
||||
# Select internationalisation properties.
|
||||
i18n.defaultLocale = "en_GB.UTF-8";
|
||||
|
||||
i18n.extraLocaleSettings = {
|
||||
LC_ADDRESS = "et_EE.UTF-8";
|
||||
LC_IDENTIFICATION = "et_EE.UTF-8";
|
||||
LC_MEASUREMENT = "et_EE.UTF-8";
|
||||
LC_MONETARY = "et_EE.UTF-8";
|
||||
LC_NAME = "et_EE.UTF-8";
|
||||
LC_NUMERIC = "et_EE.UTF-8";
|
||||
LC_PAPER = "et_EE.UTF-8";
|
||||
LC_TELEPHONE = "et_EE.UTF-8";
|
||||
LC_TIME = "et_EE.UTF-8";
|
||||
};
|
||||
|
||||
# Configure keymap in X11
|
||||
services.xserver.xkb = {
|
||||
layout = "us";
|
||||
variant = "";
|
||||
};
|
||||
|
||||
# Enable Seatd for Wayland sessions
|
||||
# IMPORTANT: Enable seatd service for River WM
|
||||
services.seatd = {
|
||||
enable = true;
|
||||
logLevel = "info";
|
||||
};
|
||||
|
||||
# Enable the gnome-keyring secrets vault.
|
||||
# Will be exposed through DBus to programs willing to store secrets.
|
||||
services.gnome.gnome-keyring.enable = true;
|
||||
|
||||
# Enable Sway window manager
|
||||
programs.sway = {
|
||||
enable = true;
|
||||
wrapperFeatures.gtk = true;
|
||||
};
|
||||
|
||||
services.greetd = {
|
||||
enable = true;
|
||||
settings = {
|
||||
default_session = {
|
||||
command = "${pkgs.tuigreet}/bin/tuigreet --time --cmd sway";
|
||||
user = "greeter";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
# Configure security to allow seatd access
|
||||
security.polkit.enable = true;
|
||||
|
||||
# Configure GPU support
|
||||
hardware.graphics = {
|
||||
enable = true;
|
||||
enable32Bit = true;
|
||||
};
|
||||
|
||||
# Define a user account. Don't forget to set a password with ‘passwd’.
|
||||
# Copy this later to generate more custom users.
|
||||
users.users.nixosp = {
|
||||
isNormalUser = true;
|
||||
description = "NixOS Playground";
|
||||
extraGroups = ["networkmanager" "wheel" "seat"];
|
||||
packages = with pkgs; [];
|
||||
};
|
||||
|
||||
home-manager.users.nixosp = {pkgs, ...}: {
|
||||
home.packages = [
|
||||
pkgs.atool
|
||||
pkgs.httpie
|
||||
pkgs.alacritty # Terminal emulator
|
||||
pkgs.hyfetch # Add fetching packages
|
||||
pkgs.macchina
|
||||
pkgs.wayland # Wayland display server
|
||||
pkgs.wlroots # Wayland compositor library
|
||||
pkgs.maple-mono.NF # Font for better terminal appearance
|
||||
pkgs.wl-clipboard # Clipboard utilities for Wayland
|
||||
pkgs.mako # Wayland Sway Notification Daemon
|
||||
pkgs.btop # Resource monitor
|
||||
];
|
||||
|
||||
# Set Alacritty as the default terminal emulator
|
||||
home.sessionVariables = {
|
||||
TERMINAL = "alacritty";
|
||||
};
|
||||
|
||||
# Use Zsh as the default shell
|
||||
programs.zsh.enable = true;
|
||||
|
||||
# Configure Alacritty as the default terminal emulator
|
||||
programs.alacritty = {
|
||||
enable = true;
|
||||
settings = {
|
||||
# Window configuration
|
||||
window = {
|
||||
opacity = 1.0;
|
||||
padding = {
|
||||
x = 10;
|
||||
y = 10;
|
||||
};
|
||||
};
|
||||
|
||||
# Font configuration - fixes spacing issues
|
||||
font = {
|
||||
normal = {
|
||||
family = "Maple Mono NF";
|
||||
style = "Regular";
|
||||
};
|
||||
bold = {
|
||||
family = "Maple Mono NF";
|
||||
style = "Bold";
|
||||
};
|
||||
italic = {
|
||||
family = "Maple Mono NF";
|
||||
style = "Italic";
|
||||
};
|
||||
bold_italic = {
|
||||
family = "Maple Mono NF";
|
||||
style = "Bold Italic";
|
||||
};
|
||||
size = 14.0;
|
||||
};
|
||||
|
||||
# Colors (optional - using default Alacritty colors)
|
||||
colors = {
|
||||
primary = {
|
||||
background = "#1e1e2e";
|
||||
foreground = "#cdd6f4";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
# Configure Hyfetch system info fetcher
|
||||
programs.hyfetch = {
|
||||
enable = true;
|
||||
settings = {
|
||||
preset = "lesbian"; # Use lesbian flag preset
|
||||
mode = "rgb"; # Use RGB color mode
|
||||
lightness = 0.55; # Set to 55% brightness
|
||||
backend = "fastfetch"; # Use macchina as the backend
|
||||
logo_size = "small"; # Make small logo
|
||||
pride_month_disable = false; # Enable pride month mode (or true to disable)
|
||||
pride_month_shown = []; # List of shown pride month flags
|
||||
color_align = {
|
||||
mode = "horizontal";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
# The state version is required and should stay at the version you
|
||||
# originally installed.
|
||||
home.stateVersion = "25.11";
|
||||
};
|
||||
|
||||
# Allow unfree packages
|
||||
nixpkgs.config.allowUnfree = true;
|
||||
|
||||
# Passwordless sudo for wheel group
|
||||
security.sudo.wheelNeedsPassword = false;
|
||||
|
||||
# Hardware U2F support - Passwordless sudo with hardware key
|
||||
security.pam.u2f = {
|
||||
enable = true;
|
||||
settings = {
|
||||
authfile = "/etc/u2f_keys";
|
||||
cue = true;
|
||||
pinverification = 0; # No PIN verification
|
||||
userpresence = 1; # Require user presence (touch)
|
||||
};
|
||||
};
|
||||
|
||||
# SSH Agent authentication
|
||||
security.pam.sshAgentAuth.enable = true;
|
||||
|
||||
# Automatic upgrades
|
||||
system.autoUpgrade = {
|
||||
enable = true; # Set to true for automatic updates
|
||||
dates = "daily";
|
||||
allowReboot = false;
|
||||
};
|
||||
|
||||
# System packages
|
||||
environment.systemPackages = with pkgs; [
|
||||
# Network tools
|
||||
wget
|
||||
curl
|
||||
dig
|
||||
tcpdump
|
||||
ethtool
|
||||
iptables
|
||||
nftables
|
||||
iproute2
|
||||
bridge-utils
|
||||
netcat-gnu
|
||||
traceroute
|
||||
mtr
|
||||
|
||||
# Monitoring
|
||||
btop
|
||||
htop
|
||||
iotop
|
||||
bandwhich
|
||||
|
||||
# Editors
|
||||
micro
|
||||
vim
|
||||
helix
|
||||
|
||||
# System info
|
||||
fastfetch
|
||||
lshw
|
||||
pciutils
|
||||
usbutils
|
||||
];
|
||||
|
||||
# Enable zram swap
|
||||
zramSwap = {
|
||||
enable = true;
|
||||
memoryPercent = 50;
|
||||
};
|
||||
|
||||
# Some programs need SUID wrappers, can be configured further or are
|
||||
# started in user sessions.
|
||||
# programs.mtr.enable = true;
|
||||
# programs.gnupg.agent = {
|
||||
# enable = true;
|
||||
# enableSSHSupport = true;
|
||||
# };
|
||||
|
||||
# List services that you want to enable:
|
||||
|
||||
# Enable the OpenSSH daemon.
|
||||
# services.openssh.enable = true;
|
||||
|
||||
# Open ports in the firewall.
|
||||
# networking.firewall.allowedTCPPorts = [ ... ];
|
||||
# networking.firewall.allowedUDPPorts = [ ... ];
|
||||
# Or disable the firewall altogether.
|
||||
# networking.firewall.enable = false;
|
||||
|
||||
# This value determines the NixOS release from which the default
|
||||
# settings for stateful data, like file locations and database versions
|
||||
# on your system were taken. It‘s perfectly fine and recommended to leave
|
||||
# this value at the release version of the first install of this system.
|
||||
# Before changing this value read the documentation for this option
|
||||
# (e.g. man configuration-knot.nix or on https://nixos.org/nixos/options.html).
|
||||
system.stateVersion = "25.11"; # Did you read the comment?
|
||||
}
|
||||
|
|
@ -256,7 +256,6 @@
|
|||
];
|
||||
};
|
||||
|
||||
|
||||
# Passwordless sudo for wheel group
|
||||
security.sudo.wheelNeedsPassword = false;
|
||||
|
||||
|
|
|
|||
358
nix-system-configs/prg-blank-setup/blank-proxmox-partition.nix
Normal file
358
nix-system-configs/prg-blank-setup/blank-proxmox-partition.nix
Normal file
|
|
@ -0,0 +1,358 @@
|
|||
# Edit this configuration file to define what should be installed on
|
||||
# your system. Help is available in the configuration-knot.nix(5) man page
|
||||
# and in the NixOS manual (accessible by running ‘nixos-help’).
|
||||
{
|
||||
config,
|
||||
pkgs,
|
||||
lib,
|
||||
...
|
||||
}: let
|
||||
home-manager = builtins.fetchTarball "https://github.com/nix-community/home-manager/archive/release-25.11.tar.gz";
|
||||
in {
|
||||
# Home Manager Configuration
|
||||
imports = [
|
||||
(import "${home-manager}/nixos")
|
||||
];
|
||||
|
||||
## Ensure that configuration is copied after installing this NixOS image
|
||||
system.copySystemConfiguration = true;
|
||||
|
||||
# Use Lix instead of Nix
|
||||
nixpkgs.overlays = [
|
||||
(final: prev: {
|
||||
inherit
|
||||
(prev.lixPackageSets.stable)
|
||||
nixpkgs-review
|
||||
nix-eval-jobs
|
||||
nix-fast-build
|
||||
colmena
|
||||
;
|
||||
})
|
||||
];
|
||||
|
||||
nix.package = pkgs.lixPackageSets.stable.lix;
|
||||
|
||||
# Bootloader - GRUB for Proxmox
|
||||
# Bootloader - systemd-boot with UEFI
|
||||
boot.loader.grub.enable = lib.mkForce false;
|
||||
boot.loader.systemd-boot.enable = true;
|
||||
boot.loader.efi.canTouchEfiVariables = false;
|
||||
boot.loader.efi.efiSysMountPoint = "/boot";
|
||||
|
||||
# Proxmox configuration
|
||||
proxmox.qemuConf = {
|
||||
bios = "ovmf"; # Use OVMF for UEFI
|
||||
};
|
||||
|
||||
boot.initrd.availableKernelModules = ["virtio_pci" "virtio_scsi" "ahci" "sd_mod"];
|
||||
|
||||
networking.hostName = "nixosp"; # Define your hostname.
|
||||
#networking.wireless.enable = true; # Enables wireless support via wpa_supplicant.
|
||||
|
||||
# Enable Rsymc
|
||||
services.rsync.enable = true;
|
||||
|
||||
# Configure network proxy if necessary
|
||||
# networking.proxy.default = "http://user:password@proxy:port/";
|
||||
# networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";
|
||||
|
||||
# Enable networking
|
||||
networking.networkmanager.enable = true;
|
||||
networking.useDHCP = lib.mkDefault true;
|
||||
# Serial console for Proxmox
|
||||
boot.kernelParams = ["console=tty0" "console=ttyS0,115200"];
|
||||
# Enable QEMU Guest for Proxmox integration
|
||||
services.qemuGuest.enable = true;
|
||||
services.spice-vdagentd.enable = true;
|
||||
|
||||
# Enable SSH
|
||||
services.openssh = {
|
||||
enable = true;
|
||||
ports = [22];
|
||||
settings = {
|
||||
PasswordAuthentication = false;
|
||||
AllowUsers = null;
|
||||
UseDns = true;
|
||||
PermitRootLogin = "no";
|
||||
};
|
||||
};
|
||||
|
||||
# Set your time zone.
|
||||
time.timeZone = "Europe/Copenhagen";
|
||||
|
||||
# Select internationalisation properties.
|
||||
i18n.defaultLocale = "en_GB.UTF-8";
|
||||
|
||||
i18n.extraLocaleSettings = {
|
||||
LC_ADDRESS = "et_EE.UTF-8";
|
||||
LC_IDENTIFICATION = "et_EE.UTF-8";
|
||||
LC_MEASUREMENT = "et_EE.UTF-8";
|
||||
LC_MONETARY = "et_EE.UTF-8";
|
||||
LC_NAME = "et_EE.UTF-8";
|
||||
LC_NUMERIC = "et_EE.UTF-8";
|
||||
LC_PAPER = "et_EE.UTF-8";
|
||||
LC_TELEPHONE = "et_EE.UTF-8";
|
||||
LC_TIME = "et_EE.UTF-8";
|
||||
};
|
||||
|
||||
# Configure keymap in X11
|
||||
services.xserver.xkb = {
|
||||
layout = "us";
|
||||
variant = "";
|
||||
};
|
||||
|
||||
# Enable Seatd for Wayland sessions
|
||||
# IMPORTANT: Enable seatd service for River WM
|
||||
services.seatd = {
|
||||
enable = true;
|
||||
logLevel = "info";
|
||||
};
|
||||
|
||||
# Enable the gnome-keyring secrets vault.
|
||||
# Will be exposed through DBus to programs willing to store secrets.
|
||||
services.gnome.gnome-keyring.enable = true;
|
||||
|
||||
# Enable Sway window manager
|
||||
programs.sway = {
|
||||
enable = true;
|
||||
wrapperFeatures.gtk = true;
|
||||
};
|
||||
|
||||
services.greetd = {
|
||||
enable = true;
|
||||
settings = {
|
||||
default_session = {
|
||||
command = "${pkgs.tuigreet}/bin/tuigreet --time --cmd sway";
|
||||
user = "greeter";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
# Configure security to allow seatd access
|
||||
security.polkit.enable = true;
|
||||
|
||||
# Define a user account. Don't forget to set a password with ‘passwd’.
|
||||
# Copy this later to generate more custom users.
|
||||
users.users.nixosp = {
|
||||
isNormalUser = true;
|
||||
description = "NixOS Playground";
|
||||
extraGroups = ["networkmanager" "wheel" "seat"];
|
||||
packages = with pkgs; [];
|
||||
initialPassword = "nixos"; # Simple, change on first login
|
||||
};
|
||||
|
||||
# Configure LibreWolf browser
|
||||
programs.librewolf = {
|
||||
enable = true;
|
||||
# Enable WebGL, cookies and history
|
||||
settings = {
|
||||
"webgl.disabled" = false;
|
||||
"privacy.resistFingerprinting" = true;
|
||||
"privacy.clearOnShutdown.history" = false;
|
||||
"privacy.clearOnShutdown.cookies" = true;
|
||||
};
|
||||
};
|
||||
|
||||
home-manager.users.nixosp = {pkgs, ...}: {
|
||||
home.packages = [
|
||||
pkgs.atool
|
||||
pkgs.httpie
|
||||
pkgs.alacritty # Terminal emulator
|
||||
pkgs.hyfetch # Add fetching packages
|
||||
pkgs.macchina # System info backend
|
||||
pkgs.wayland # Wayland display server
|
||||
pkgs.wlroots # Wayland compositor library
|
||||
pkgs.maple-mono.NF # Font for better terminal appearance
|
||||
pkgs.wl-clipboard # Clipboard utilities for Wayland
|
||||
pkgs.mako # Wayland Sway Notification Daemon
|
||||
pkgs.btop # Resource monitor
|
||||
];
|
||||
|
||||
# Set Alacritty as the default terminal emulator
|
||||
home.sessionVariables = {
|
||||
TERMINAL = "alacritty";
|
||||
};
|
||||
|
||||
# Use Zsh as the default shell
|
||||
programs.zsh.enable = true;
|
||||
|
||||
# Configure Alacritty as the default terminal emulator
|
||||
programs.alacritty = {
|
||||
enable = true;
|
||||
settings = {
|
||||
# Window configuration
|
||||
window = {
|
||||
opacity = 1.0;
|
||||
padding = {
|
||||
x = 10;
|
||||
y = 10;
|
||||
};
|
||||
};
|
||||
|
||||
# Font configuration - fixes spacing issues
|
||||
font = {
|
||||
normal = {
|
||||
family = "Maple Mono NF";
|
||||
style = "Regular";
|
||||
};
|
||||
bold = {
|
||||
family = "Maple Mono NF";
|
||||
style = "Bold";
|
||||
};
|
||||
italic = {
|
||||
family = "Maple Mono NF";
|
||||
style = "Italic";
|
||||
};
|
||||
bold_italic = {
|
||||
family = "Maple Mono NF";
|
||||
style = "Bold Italic";
|
||||
};
|
||||
size = 14.0;
|
||||
};
|
||||
|
||||
# Colors (optional - using default Alacritty colors)
|
||||
colors = {
|
||||
primary = {
|
||||
background = "#1e1e2e";
|
||||
foreground = "#cdd6f4";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
# Configure Hyfetch system info fetcher
|
||||
programs.hyfetch = {
|
||||
enable = true;
|
||||
settings = {
|
||||
preset = "lesbian"; # Use lesbian flag preset
|
||||
mode = "rgb"; # Use RGB color mode
|
||||
lightness = 0.55; # Set to 55% brightness
|
||||
backend = "macchina"; # Use macchina as the backend
|
||||
logo_size = "small"; # Make small logo
|
||||
pride_month_disable = false; # Enable pride month mode (or true to disable)
|
||||
pride_month_shown = []; # List of shown pride month flags
|
||||
color_align = {
|
||||
mode = "horizontal";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
# The state version is required and should stay at the version you
|
||||
# originally installed.
|
||||
home.stateVersion = "25.11";
|
||||
};
|
||||
|
||||
# Allow unfree packages
|
||||
nixpkgs.config.allowUnfree = true;
|
||||
|
||||
# Passwordless sudo for wheel group
|
||||
security.sudo.wheelNeedsPassword = false;
|
||||
|
||||
# Hardware U2F support - Passwordless sudo with hardware key
|
||||
security.pam.u2f = {
|
||||
enable = true;
|
||||
settings = {
|
||||
authfile = "/etc/u2f_keys";
|
||||
cue = true;
|
||||
pinverification = 0; # No PIN verification
|
||||
userpresence = 1; # Require user presence (touch)
|
||||
};
|
||||
};
|
||||
|
||||
# SSH Agent authentication
|
||||
security.pam.sshAgentAuth.enable = true;
|
||||
|
||||
# Automatic upgrades
|
||||
system.autoUpgrade = {
|
||||
enable = true; # Set to true for automatic updates
|
||||
dates = "daily";
|
||||
allowReboot = false;
|
||||
};
|
||||
|
||||
# System packages
|
||||
environment.systemPackages = with pkgs; [
|
||||
# Network tools
|
||||
wget
|
||||
curl
|
||||
dig
|
||||
tcpdump
|
||||
ethtool
|
||||
iptables
|
||||
nftables
|
||||
iproute2
|
||||
bridge-utils
|
||||
netcat-gnu
|
||||
traceroute
|
||||
mtr
|
||||
|
||||
# Add the ability to create NixOS images
|
||||
nixos-generators
|
||||
|
||||
# Monitoring
|
||||
btop
|
||||
htop
|
||||
iotop
|
||||
bandwhich
|
||||
|
||||
# Editors
|
||||
micro
|
||||
vim
|
||||
helix
|
||||
|
||||
# System info
|
||||
fastfetch
|
||||
lshw
|
||||
pciutils
|
||||
usbutils
|
||||
|
||||
# Filesystem utilities
|
||||
btrfs-progs
|
||||
e2fsprogs
|
||||
ntfs3g
|
||||
dosfstools
|
||||
os-prober
|
||||
];
|
||||
|
||||
# Enable zram swap
|
||||
zramSwap = {
|
||||
enable = true;
|
||||
memoryPercent = 50;
|
||||
};
|
||||
|
||||
# Some programs need SUID wrappers, can be configured further or are
|
||||
# started in user sessions.
|
||||
# programs.mtr.enable = true;
|
||||
# programs.gnupg.agent = {
|
||||
# enable = true;
|
||||
# enableSSHSupport = true;
|
||||
# };
|
||||
|
||||
# Attach the system to the IPFire network: set a static IP on the Proxmox bridge (vmbr0)
|
||||
# Adjust `vmbr0` and the address below to your environment.
|
||||
networking.interfaces.vmbr0.ipv4.addresses = [
|
||||
{
|
||||
address = "10.1.1.22";
|
||||
prefixLength = 24;
|
||||
}
|
||||
];
|
||||
networking.defaultGateway = "10.1.1.1";
|
||||
|
||||
# List services that you want to enable:
|
||||
|
||||
# Enable the OpenSSH daemon.
|
||||
# services.openssh.enable = true;
|
||||
|
||||
# Open ports in the firewall.
|
||||
# networking.firewall.allowedTCPPorts = [ ... ];
|
||||
# networking.firewall.allowedUDPPorts = [ ... ];
|
||||
# Or disable the firewall altogether.
|
||||
# networking.firewall.enable = false;
|
||||
|
||||
# This value determines the NixOS release from which the default
|
||||
# settings for stateful data, like file locations and database versions
|
||||
# on your system were taken. It‘s perfectly fine and recommended to leave
|
||||
# this value at the release version of the first install of this system.
|
||||
# Before changing this value read the documentation for this option
|
||||
# (e.g. man configuration-knot.nix or on https://nixos.org/nixos/options.html).
|
||||
system.stateVersion = "25.11"; # Did you read the comment?
|
||||
}
|
||||
354
nix-system-configs/prg-blank-setup/example.nix
Executable file
354
nix-system-configs/prg-blank-setup/example.nix
Executable file
|
|
@ -0,0 +1,354 @@
|
|||
# Edit this configuration file to define what should be installed on
|
||||
# your system. Help is available in the configuration-knot.nix(5) man page
|
||||
# and in the NixOS manual (accessible by running ‘nixos-help’).
|
||||
{
|
||||
config,
|
||||
pkgs,
|
||||
lib,
|
||||
...
|
||||
}: let
|
||||
home-manager = builtins.fetchTarball "https://github.com/nix-community/home-manager/archive/release-25.11.tar.gz";
|
||||
in {
|
||||
# Home Manager Configuration
|
||||
imports = [
|
||||
# Include the results of the hardware scan.
|
||||
./hardware-configuration.nix
|
||||
(import "${home-manager}/nixos")
|
||||
];
|
||||
|
||||
networking.hostName = "nixosp"; # Define your hostname.
|
||||
# BE SURE TO FIND AND REPLACE ALL INSTANCES OF THIS HOSTNAME IN THE CONFIGURATION FILES
|
||||
# Define a user account. Don't forget to set a password with ‘passwd’.
|
||||
|
||||
users.users.nixosp = {
|
||||
isNormalUser = true;
|
||||
description = "NixOS Playground";
|
||||
extraGroups = ["networkmanager" "wheel" "seat"];
|
||||
packages = with pkgs; [];
|
||||
};
|
||||
|
||||
home-manager.users.nixosp = {pkgs, ...}: {
|
||||
home.packages = [
|
||||
pkgs.atool
|
||||
pkgs.httpie
|
||||
pkgs.alacritty # Terminal emulator
|
||||
pkgs.hyfetch # Add fetching packages
|
||||
pkgs.macchina
|
||||
pkgs.wayland # Wayland display server
|
||||
pkgs.wlroots # Wayland compositor library
|
||||
pkgs.maple-mono.NF # Font for better terminal appearance
|
||||
pkgs.wl-clipboard # Clipboard utilities for Wayland
|
||||
pkgs.mako # Wayland Sway Notification Daemon
|
||||
pkgs.btop # Resource monitor
|
||||
];
|
||||
|
||||
# Set Alacritty as the default terminal emulator
|
||||
home.sessionVariables = {
|
||||
TERMINAL = "alacritty";
|
||||
};
|
||||
|
||||
# Use Zsh as the default shell
|
||||
programs.zsh.enable = true;
|
||||
|
||||
# Configure Alacritty as the default terminal emulator
|
||||
programs.alacritty = {
|
||||
enable = true;
|
||||
settings = {
|
||||
# Window configuration
|
||||
window = {
|
||||
opacity = 1.0;
|
||||
padding = {
|
||||
x = 10;
|
||||
y = 10;
|
||||
};
|
||||
};
|
||||
|
||||
# Font configuration - fixes spacing issues
|
||||
font = {
|
||||
normal = {
|
||||
family = "Maple Mono NF";
|
||||
style = "Regular";
|
||||
};
|
||||
bold = {
|
||||
family = "Maple Mono NF";
|
||||
style = "Bold";
|
||||
};
|
||||
italic = {
|
||||
family = "Maple Mono NF";
|
||||
style = "Italic";
|
||||
};
|
||||
bold_italic = {
|
||||
family = "Maple Mono NF";
|
||||
style = "Bold Italic";
|
||||
};
|
||||
size = 14.0;
|
||||
};
|
||||
|
||||
# Colors (optional - using default Alacritty colors)
|
||||
colors = {
|
||||
primary = {
|
||||
background = "#1e1e2e";
|
||||
foreground = "#cdd6f4";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
# Configure Hyfetch system info fetcher
|
||||
programs.hyfetch = {
|
||||
enable = true;
|
||||
settings = {
|
||||
preset = "lesbian"; # Use lesbian flag preset
|
||||
mode = "rgb"; # Use RGB color mode
|
||||
lightness = 0.55; # Set to 55% brightness
|
||||
backend = "macchina"; # Use macchina as the backend
|
||||
logo_size = "small"; # Make small logo
|
||||
pride_month_disable = false; # Enable pride month mode (or true to disable)
|
||||
pride_month_shown = []; # List of shown pride month flags
|
||||
color_align = {
|
||||
mode = "horizontal";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
# The state version is required and should stay at the version you
|
||||
# originally installed.
|
||||
home.stateVersion = "25.11";
|
||||
};
|
||||
|
||||
# Use Lix instead of Nix
|
||||
nixpkgs.overlays = [
|
||||
(final: prev: {
|
||||
inherit
|
||||
(prev.lixPackageSets.stable)
|
||||
nixpkgs-review
|
||||
nix-eval-jobs
|
||||
nix-fast-build
|
||||
colmena
|
||||
;
|
||||
})
|
||||
];
|
||||
|
||||
nix.package = pkgs.lixPackageSets.stable.lix;
|
||||
|
||||
# Enable Bootloader for Proxmox partition setup
|
||||
boot.loader.systemd-boot.enable = lib.mkForce false;
|
||||
boot.loader.grub = {
|
||||
enable = true;
|
||||
device = "/dev/vda"; # Install GRUB to the disk
|
||||
efiSupport = false; # Disable UEFI
|
||||
};
|
||||
boot.initrd.availableKernelModules = ["virtio_pci" "virtio_scsi" "ahci" "sd_mod"];
|
||||
fileSystems."/" = {
|
||||
device = "/dev/vda1";
|
||||
fsType = "ext4"; # Use "btrfs" or "xfs" if you formatted it differently
|
||||
};
|
||||
# virtualisation.diskSize = 19432; # 96GB in MiB
|
||||
|
||||
#networking.wireless.enable = true; # Enables wireless support via wpa_supplicant.
|
||||
|
||||
# Enable Rsymc
|
||||
services.rsync.enable = true;
|
||||
|
||||
# Configure network proxy if necessary
|
||||
# networking.proxy.default = "http://user:password@proxy:port/";
|
||||
# networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";
|
||||
|
||||
# Enable networking
|
||||
networking.networkmanager.enable = true;
|
||||
networking.interfaces.wlo1.ipv4.addresses = [
|
||||
{
|
||||
address = "192.168.1.15";
|
||||
prefixLength = 32;
|
||||
}
|
||||
];
|
||||
|
||||
# Enable SSH
|
||||
services.openssh = {
|
||||
enable = true;
|
||||
ports = [22];
|
||||
settings = {
|
||||
PasswordAuthentication = false;
|
||||
AllowUsers = null;
|
||||
UseDns = true;
|
||||
PermitRootLogin = "no";
|
||||
};
|
||||
};
|
||||
|
||||
# Set your time zone.
|
||||
time.timeZone = "Europe/Copenhagen";
|
||||
|
||||
# Select internationalisation properties.
|
||||
i18n.defaultLocale = "en_GB.UTF-8";
|
||||
|
||||
i18n.extraLocaleSettings = {
|
||||
LC_ADDRESS = "et_EE.UTF-8";
|
||||
LC_IDENTIFICATION = "et_EE.UTF-8";
|
||||
LC_MEASUREMENT = "et_EE.UTF-8";
|
||||
LC_MONETARY = "et_EE.UTF-8";
|
||||
LC_NAME = "et_EE.UTF-8";
|
||||
LC_NUMERIC = "et_EE.UTF-8";
|
||||
LC_PAPER = "et_EE.UTF-8";
|
||||
LC_TELEPHONE = "et_EE.UTF-8";
|
||||
LC_TIME = "et_EE.UTF-8";
|
||||
};
|
||||
|
||||
# Configure keymap in X11
|
||||
services.xserver.xkb = {
|
||||
layout = "us";
|
||||
variant = "";
|
||||
};
|
||||
|
||||
# Enable Seatd for Wayland sessions
|
||||
# IMPORTANT: Enable seatd service for River WM
|
||||
services.seatd = {
|
||||
enable = true;
|
||||
logLevel = "info";
|
||||
};
|
||||
|
||||
# Enable the gnome-keyring secrets vault.
|
||||
# Will be exposed through DBus to programs willing to store secrets.
|
||||
services.gnome.gnome-keyring.enable = true;
|
||||
|
||||
# Enable Sway window manager
|
||||
programs.sway = {
|
||||
enable = true;
|
||||
wrapperFeatures.gtk = true;
|
||||
};
|
||||
|
||||
services.greetd = {
|
||||
enable = true;
|
||||
settings = {
|
||||
default_session = {
|
||||
command = "${pkgs.tuigreet}/bin/tuigreet --time --cmd sway";
|
||||
user = "greeter";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
# Configure security to allow seatd access
|
||||
security.polkit.enable = true;
|
||||
|
||||
# Configure GPU support
|
||||
hardware.graphics = {
|
||||
enable = true;
|
||||
enable32Bit = true;
|
||||
};
|
||||
|
||||
# Allow unfree packages
|
||||
nixpkgs.config.allowUnfree = true;
|
||||
|
||||
# Passwordless sudo for wheel group
|
||||
security.sudo.wheelNeedsPassword = false;
|
||||
|
||||
# Hardware U2F support - Passwordless sudo with hardware key
|
||||
security.pam.u2f = {
|
||||
enable = true;
|
||||
settings = {
|
||||
authfile = "/etc/u2f_keys";
|
||||
cue = true;
|
||||
pinverification = 0; # No PIN verification
|
||||
userpresence = 1; # Require user presence (touch)
|
||||
};
|
||||
};
|
||||
|
||||
# SSH Agent authentication
|
||||
security.pam.sshAgentAuth.enable = true;
|
||||
|
||||
# Automatic upgrades
|
||||
system.autoUpgrade = {
|
||||
enable = true; # Set to true for automatic updates
|
||||
dates = "daily";
|
||||
allowReboot = false;
|
||||
};
|
||||
|
||||
# System packages
|
||||
environment.systemPackages = with pkgs; [
|
||||
# Network tools
|
||||
wget
|
||||
curl
|
||||
dig
|
||||
tcpdump
|
||||
ethtool
|
||||
iptables
|
||||
nftables
|
||||
iproute2
|
||||
bridge-utils
|
||||
netcat-gnu
|
||||
traceroute
|
||||
mtr
|
||||
|
||||
# Monitoring
|
||||
btop
|
||||
htop
|
||||
iotop
|
||||
bandwhich
|
||||
|
||||
# Editors
|
||||
micro
|
||||
vim
|
||||
helix
|
||||
|
||||
# Add ability to generate NixOS images
|
||||
nixos-generators
|
||||
|
||||
# System info
|
||||
fastfetch
|
||||
lshw
|
||||
pciutils
|
||||
usbutils
|
||||
|
||||
# Filesystem utilities
|
||||
btrfs-progs
|
||||
e2fsprogs
|
||||
ntfs3g
|
||||
dosfstools
|
||||
os-prober
|
||||
];
|
||||
|
||||
# Enable zram swap
|
||||
zramSwap = {
|
||||
enable = true;
|
||||
memoryPercent = 50;
|
||||
};
|
||||
|
||||
# Some programs need SUID wrappers, can be configured further or are
|
||||
# started in user sessions.
|
||||
# programs.mtr.enable = true;
|
||||
# programs.gnupg.agent = {
|
||||
# enable = true;
|
||||
# enableSSHSupport = true;
|
||||
# };
|
||||
|
||||
# List services that you want to enable:
|
||||
|
||||
# Enable the OpenSSH daemon.
|
||||
# services.openssh.enable = true;
|
||||
|
||||
# Open ports in the firewall.
|
||||
# networking.firewall.allowedTCPPorts = [ ... ];
|
||||
# networking.firewall.allowedUDPPorts = [ ... ];
|
||||
# Or disable the firewall altogether.
|
||||
# networking.firewall.enable = false;
|
||||
|
||||
# Attach the system to the IPFire network: set a static IP on the Proxmox bridge (ens18)
|
||||
# Adjust `ens18` and the address below to your environment.
|
||||
networking.interfaces.ens18.ipv4.addresses = [
|
||||
{
|
||||
address = "10.1.1.XXX";
|
||||
prefixLength = 24;
|
||||
}
|
||||
];
|
||||
networking.defaultGateway = "10.1.1.1";
|
||||
environment.etc."resolv.conf".text = ''
|
||||
nameserver 10.1.1.2
|
||||
'';
|
||||
|
||||
# This value determines the NixOS release from which the default
|
||||
# settings for stateful data, like file locations and database versions
|
||||
# on your system were taken. It‘s perfectly fine and recommended to leave
|
||||
# this value at the release version of the first install of this system.
|
||||
# Before changing this value read the documentation for this option
|
||||
# (e.g. man configuration-knot.nix or on https://nixos.org/nixos/options.html).
|
||||
system.stateVersion = "25.11"; # Did you read the comment?
|
||||
}
|
||||
Loading…
Add table
Add a link
Reference in a new issue