129 lines
2.8 KiB
Nix
129 lines
2.8 KiB
Nix
|
# SPDX-FileCopyrightText: 2023 Luke Granger-Brown <depot@lukegb.com>
|
||
|
|
#
|
||
|
|
# SPDX-License-Identifier: Apache-2.0
|
||
|
|
|
||
|
|
{ depot, lib, pkgs, config, ... }:
|
||
|
|
{
|
||
|
|
imports = [
|
||
|
|
../lib/bgp.nix
|
||
|
|
../lib/zfs.nix
|
||
|
|
];
|
||
|
|
|
||
|
|
boot.initrd = {
|
||
|
|
availableKernelModules = [
|
||
|
|
"ehci_pci"
|
||
|
|
"ahci"
|
||
|
|
"usbhid"
|
||
|
|
"usb_storage"
|
||
|
|
"sd_mod"
|
||
|
|
"sr_mod"
|
||
|
|
"bnx2" # ethernet
|
||
|
|
];
|
||
|
|
network = {
|
||
|
|
enable = true;
|
||
|
|
ssh = {
|
||
|
|
enable = true;
|
||
|
|
hostKeys = ["/persist/etc/ssh/ssh_host_ed25519_key"];
|
||
|
|
authorizedKeys = map builtins.readFile config.users.users.lukegb.openssh.authorizedKeys.keyFiles;
|
||
|
|
};
|
||
|
|
postCommands = ''
|
||
|
|
echo "zfs load-key -a; killall zfs" >> /root/.profile
|
||
|
|
'';
|
||
|
|
};
|
||
|
|
};
|
||
|
|
boot.kernelParams = [
|
||
|
|
"ip=83.97.19.68::83.97.19.65:255.255.255.224:cofractal-ams01:eno1:none"
|
||
|
|
];
|
||
|
|
boot.kernelModules = [ "kvm-amd" ];
|
||
|
|
|
||
|
|
# Use the systemd-boot EFI boot loader.
|
||
|
|
boot.loader.systemd-boot.enable = true;
|
||
|
|
boot.loader.efi.canTouchEfiVariables = true;
|
||
|
|
|
||
|
|
powerManagement.cpuFreqGovernor = lib.mkDefault "performance";
|
||
|
|
services.zfs.rollbackOnBoot = {
|
||
|
|
enable = true;
|
||
|
|
snapshot = "tank/local/root@blank";
|
||
|
|
};
|
||
|
|
|
||
|
|
fileSystems = let
|
||
|
|
zfs = device: {
|
||
|
|
device = device;
|
||
|
|
fsType = "zfs";
|
||
|
|
};
|
||
|
|
in {
|
||
|
|
"/" = zfs "tank/local/root";
|
||
|
|
"/nix" = zfs "tank/local/nix";
|
||
|
|
"/tmp" = zfs "tank/local/tmp";
|
||
|
|
|
||
|
|
"/persist" = zfs "tank/safe/persist";
|
||
|
|
"/home" = zfs "tank/safe/home";
|
||
|
|
|
||
|
|
"/boot" = {
|
||
|
|
device = "/dev/disk/by-partlabel/ESP";
|
||
|
|
fsType = "vfat";
|
||
|
|
};
|
||
|
|
};
|
||
|
|
|
||
|
|
nix.settings.max-jobs = lib.mkDefault 8;
|
||
|
|
|
||
|
|
# Networking!
|
||
|
|
networking = {
|
||
|
|
hostName = "cofractal-ams01";
|
||
|
|
domain = "as205479.net";
|
||
|
|
hostId = "a1cf1a9f";
|
||
|
|
useNetworkd = true;
|
||
|
|
|
||
|
|
nameservers = [
|
||
|
|
"2001:4860:4860::8888"
|
||
|
|
"2001:4860:4860::8844"
|
||
|
|
"8.8.8.8"
|
||
|
|
"8.8.4.4"
|
||
|
|
];
|
||
|
|
defaultGateway = {
|
||
|
|
address = "83.97.19.65";
|
||
|
|
};
|
||
|
|
defaultGateway6 = {
|
||
|
|
address = "2a07:242:800:64::1";
|
||
|
|
};
|
||
|
|
};
|
||
|
|
# my.ip.tailscale = "100.111.191.21";
|
||
|
|
|
||
|
|
services.openssh.hostKeys = [
|
||
|
|
{
|
||
|
|
path = "/persist/etc/ssh/ssh_host_ed25519_key";
|
||
|
|
type = "ed25519";
|
||
|
|
}
|
||
|
|
{
|
||
|
|
path = "/persist/etc/ssh/ssh_host_rsa_key";
|
||
|
|
type = "rsa";
|
||
|
|
bits = 4096;
|
||
|
|
}
|
||
|
|
];
|
||
|
|
|
||
|
|
systemd.mounts = let
|
||
|
|
bindMount' = dir: {
|
||
|
|
unitConfig.RequiresMountsFor = dir;
|
||
|
|
options = "bind";
|
||
|
|
what = "/persist${dir}";
|
||
|
|
where = dir;
|
||
|
|
};
|
||
|
|
bindMountSvc = dir: svc: (bindMount' dir) // {
|
||
|
|
bindsTo = [svc];
|
||
|
|
partOf = [svc];
|
||
|
|
};
|
||
|
|
bindMountSvcDynamic = dir: svc: (bindMount' "/var/lib/private/${dir}") // {
|
||
|
|
requiredBy = [svc];
|
||
|
|
before = [svc];
|
||
|
|
wantedBy = ["multi-user.target"];
|
||
|
|
};
|
||
|
|
bindMount = dir: (bindMount' dir) // {
|
||
|
|
wantedBy = ["multi-user.target"];
|
||
|
|
};
|
||
|
|
in [
|
||
|
|
(bindMountSvc "/var/lib/tailscale" "tailscaled.service")
|
||
|
|
];
|
||
|
|
|
||
|
|
system.stateVersion = "23.05";
|
||
|
|
}
|