131 lines
4 KiB
Nix
131 lines
4 KiB
Nix
{ config, pkgs, lib, ... }:
|
||
|
||
let
|
||
cryptsetup = "${pkgs.cryptsetup}/bin/cryptsetup";
|
||
unlockLuksService = label: keyfile: overwrites:
|
||
lib.attrsets.recursiveUpdate {
|
||
description = "Unlock luks encrypted device '${label}'";
|
||
bindsTo = [ "dev-${label}.device" ];
|
||
after = [ "dev-${label}.device" ];
|
||
serviceConfig = {
|
||
Type = "oneshot";
|
||
RemainAfterExit = true;
|
||
ExecStart = ''
|
||
${cryptsetup} luksOpen --key-file ${keyfile} /dev/${label} ${label}opened
|
||
'';
|
||
ExecStop = ''
|
||
${cryptsetup} luksClose ${label}opened
|
||
'';
|
||
};
|
||
} overwrites;
|
||
|
||
disks = {
|
||
FRA = "8ae45289-82ed-4cf1-9d68-a0e26e5d9bb5";
|
||
BER = "85ce2e58-72fc-4a66-a376-565bb4fc39a1";
|
||
HND = "4a3765fc-155e-453d-a348-d1782447bcfe";
|
||
LEJ = "5e3c2c1e-73f6-43e6-b8f3-71c923cbeb6d";
|
||
};
|
||
|
||
in {
|
||
|
||
boot.loader.systemd-boot.enable = true;
|
||
boot.loader.efi.canTouchEfiVariables = true;
|
||
boot.supportedFilesystems = [ "zfs" ];
|
||
|
||
networking.hostName = "elysia-clarki";
|
||
networking.useDHCP = false;
|
||
networking.interfaces.eno1.useDHCP = true;
|
||
networking.hostId = "265bb40a";
|
||
|
||
virtualisation = {
|
||
podman = {
|
||
enable = true;
|
||
# Create a `docker` alias for podman, to use it as a drop-in replacement
|
||
dockerCompat = true;
|
||
dockerSocket.enable = true;
|
||
defaultNetwork.dnsname.enable = true;
|
||
};
|
||
oci-containers.backend = "podman";
|
||
};
|
||
|
||
|
||
services.fwupd.enable = true;
|
||
|
||
services.udev.customRules = [{
|
||
name = "85-rename-and-unlock-disks";
|
||
# Create a rule per entry in disks
|
||
rules = lib.concatStringsSep "\n" (lib.attrsets.mapAttrsToList
|
||
(alias: uuid: ''
|
||
SUBSYSTEM=="block", ENV{ID_FS_UUID}=="${uuid}", SYMLINK+="${alias}", TAG+="systemd"
|
||
'') disks);
|
||
}];
|
||
|
||
# Unlock all luks devices and import the zfs pools if necessary
|
||
systemd.services."luks-open-FRA" =
|
||
unlockLuksService "FRA" "/root/keys/fra" { };
|
||
systemd.services."luks-open-BER" = unlockLuksService "BER" "/root/keys/ber" {
|
||
serviceConfig.ExecStartPost = "${pkgs.zfs}/bin/zpool import zBER";
|
||
};
|
||
systemd.services."luks-open-HND" = unlockLuksService "HND" "/root/keys/hnd" {
|
||
serviceConfig.ExecStartPost = "${pkgs.zfs}/bin/zpool import zHND";
|
||
};
|
||
systemd.services."luks-open-LEJ" =
|
||
unlockLuksService "LEJ" "/root/keys/lej" { };
|
||
|
||
systemd.mounts = [
|
||
{
|
||
what = "/dev/mapper/FRAopened";
|
||
where = "/srv/fra";
|
||
type = "ext4";
|
||
wantedBy = [ "default.target" ];
|
||
requires = [ "luks-open-FRA.service" ];
|
||
after = [ "luks-open-FRA.service" ];
|
||
}
|
||
{
|
||
what = "/dev/mapper/vg_lej-lv_lej";
|
||
where = "/srv/lej";
|
||
type = "ext4";
|
||
wantedBy = [ "default.target" ];
|
||
requires = [ "luks-open-LEJ.service" ];
|
||
after = [ "luks-open-LEJ.service" ];
|
||
}
|
||
];
|
||
|
||
services.restic.server = {
|
||
enable = true;
|
||
dataDir = "/srv/hnd/restic";
|
||
listenAddress = "0.0.0.0:8000";
|
||
extraFlags = [ "--no-auth" ];
|
||
};
|
||
networking.firewall.allowedTCPPorts = [ 8000 ];
|
||
systemd.services.restic-rest-server.unitConfig = {
|
||
Requires = lib.mkForce [ "network.target" "luks-open-HND.service" ];
|
||
After = lib.mkForce [ "network.target" "luks-open-HND.service" ];
|
||
};
|
||
|
||
services.ddclient = {
|
||
enable = true;
|
||
protocol = "dyndns2";
|
||
server = "dynv6.com";
|
||
username = "none";
|
||
# Fixup using secret scheme
|
||
passwordFile = "/root/ddclient-password";
|
||
zone = "home.dyn.tammena.rocks";
|
||
domains = [
|
||
"bak.home.dyn.tammena.rocks"
|
||
"cache.home.dyn.tammena.rocks"
|
||
"elysia-clarki.home.dyn.tammena.rocks"
|
||
];
|
||
ipv6 = true;
|
||
};
|
||
|
||
# This value determines the NixOS release from which the default
|
||
# settings for stateful data, like file locations and database versions
|
||
# on your system were taken. It‘s perfectly fine and recommended to leave
|
||
# this value at the release version of the first install of this system.
|
||
# Before changing this value read the documentation for this option
|
||
# (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
|
||
system.stateVersion = "21.05"; # Did you read the comment?
|
||
|
||
}
|