112 lines
3.3 KiB
Nix
112 lines
3.3 KiB
Nix
{
|
||
config,
|
||
pkgs,
|
||
...
|
||
}: {
|
||
boot.loader.grub.enable = true;
|
||
boot.loader.grub.version = 2;
|
||
boot.loader.grub.device = "/dev/sda";
|
||
|
||
networking.hostId = "94d2a920";
|
||
networking.hostName = "cornu-aspersum";
|
||
networking.interfaces.ens3.useDHCP = true;
|
||
|
||
settings.ssh.openOutsideVPN = true;
|
||
|
||
users.users = {
|
||
root = {
|
||
hashedPassword = "$6$Yb1gdlKIpY1hRW1X$uUcNFuNnK2JFFN55Tkc.fPV.4I7RJvIfLEQayVP1utfkmjF0f/EHjtypxq11jR5NUUIJFQLW6ffajjduA2689.";
|
||
};
|
||
};
|
||
|
||
sops.defaultSopsFile = ../secrets/hosts/cornu-aspersum/secrets.yaml;
|
||
sops.age.sshKeyPaths = ["/etc/ssh/ssh_host_ed25519_key"];
|
||
|
||
sops.secrets.gladosEnv = {};
|
||
services.glados = {
|
||
enable = true;
|
||
dataCollector.enable = true;
|
||
envFile = config.sops.secrets.gladosEnv.path;
|
||
};
|
||
|
||
# === Run grafana, mainly for ccqcraft.de ===
|
||
services.grafana = {
|
||
enable = true;
|
||
domain = "data.ccqcraft.de";
|
||
port = 2342;
|
||
addr = "127.0.0.1";
|
||
auth.anonymous.enable = false;
|
||
};
|
||
services.nginx.virtualHosts.${config.services.grafana.domain} = {
|
||
enableACME = true;
|
||
forceSSL = true;
|
||
serverAliases = ["data.tammena.rocks"];
|
||
locations."/" = {
|
||
proxyPass = "http://127.0.0.1:${toString config.services.grafana.port}";
|
||
proxyWebsockets = true;
|
||
};
|
||
};
|
||
|
||
# Run radicale with infcloud interface for me and Marie
|
||
services.radicaleWithInfcloud.enable = true;
|
||
|
||
systemd.services.glados.serviceConfig.SupplementaryGroups = [config.users.groups.keys.name];
|
||
|
||
services.qemuGuest.enable = true;
|
||
|
||
services.bind = {
|
||
enable = true;
|
||
cacheNetworks = ["any"];
|
||
forwarders = ["100.100.100.100"];
|
||
listenOn = ["any"];
|
||
listenOnIpv6 = ["any"];
|
||
zones."home" = let
|
||
cornu-aspersum = {
|
||
v4 = "100.86.42.110";
|
||
v6 = "fd7a:115c:a1e0:ab12:4843:cd96:6256:2a6e";
|
||
};
|
||
faunus-ater = {
|
||
v4 = "100.108.135.4";
|
||
v6 = "fd7a:115c:a1e0:ab12:4843:cd96:626c:8704";
|
||
};
|
||
point = domain: host: ''
|
||
${domain} AAAA ${host.v6}
|
||
${domain} A ${host.v4}
|
||
'';
|
||
in {
|
||
master = true;
|
||
# TODO: Fix TTLs
|
||
file = pkgs.writeText "home-zone" ''
|
||
$TTL 1
|
||
@ IN SOA home. malte.home. (
|
||
5 ; Serial
|
||
1 ; Refresh
|
||
1 ; Retry
|
||
1 ; Expire
|
||
1) ; Negative Cache TTL
|
||
@ NS home.
|
||
${point "home." cornu-aspersum}
|
||
${point "foto" faunus-ater}
|
||
${point "mc" cornu-aspersum}
|
||
${point "doc" faunus-ater}
|
||
${point "sheet" faunus-ater}
|
||
${point "media" faunus-ater}
|
||
${point "file" faunus-ater}
|
||
${point "stats" faunus-ater}
|
||
${point "cache" faunus-ater}
|
||
${point "hydra" faunus-ater}
|
||
'';
|
||
};
|
||
};
|
||
networking.firewall.allowedTCPPorts = [53];
|
||
networking.firewall.allowedUDPPorts = [53];
|
||
|
||
# This value determines the NixOS release from which the default
|
||
# settings for stateful data, like file locations and database versions
|
||
# on your system were taken. It‘s perfectly fine and recommended to leave
|
||
# this value at the release version of the first install of this system.
|
||
# Before changing this value read the documentation for this option
|
||
# (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
|
||
system.stateVersion = "21.05"; # Did you read the comment?
|
||
}
|