2015-12-16 12:06:44 +01:00
|
|
|
|
# Edit this configuration file to define what should be installed on
|
|
|
|
|
# your system. Help is available in the configuration.nix(5) man page
|
|
|
|
|
# and in the NixOS manual (accessible by running ‘nixos-help’).
|
|
|
|
|
|
2016-01-05 16:07:13 +01:00
|
|
|
|
{ config, pkgs, lib, ... }:
|
|
|
|
|
let
|
2016-07-27 00:05:59 +02:00
|
|
|
|
toMapper = id: "/media/crypt${builtins.toString id}";
|
2016-01-05 16:07:13 +01:00
|
|
|
|
byid = dev: "/dev/disk/by-id/" + dev;
|
2016-06-12 19:43:50 +02:00
|
|
|
|
keyFile = byid "usb-Verbatim_STORE_N_GO_070B3CEE0B223954-0:0";
|
|
|
|
|
rootDisk = byid "ata-SanDisk_SD8SNAT128G1122_162099420904";
|
|
|
|
|
rootPartition = byid "ata-SanDisk_SD8SNAT128G1122_162099420904-part2";
|
|
|
|
|
primaryInterface = "enp1s0";
|
2016-01-05 16:21:01 +01:00
|
|
|
|
# cryptsetup luksFormat $dev --cipher aes-xts-plain64 -s 512 -h sha512
|
|
|
|
|
# cryptsetup luksAddKey $dev tmpkey
|
2016-03-08 18:35:32 +01:00
|
|
|
|
# cryptsetup luksOpen $dev crypt0 --key-file tmpkey --keyfile-size=4096
|
2016-03-16 08:43:20 +01:00
|
|
|
|
# mkfs.xfs /dev/mapper/crypt0 -L crypt0
|
2016-03-05 10:59:09 +01:00
|
|
|
|
|
|
|
|
|
# omo Chassis:
|
|
|
|
|
# __FRONT_
|
2016-06-12 19:43:50 +02:00
|
|
|
|
# |* d0 |
|
2016-03-05 10:59:09 +01:00
|
|
|
|
# | |
|
|
|
|
|
# |* d3 |
|
|
|
|
|
# | |
|
2016-06-12 19:43:50 +02:00
|
|
|
|
# |* d3 |
|
2016-03-05 10:59:09 +01:00
|
|
|
|
# | |
|
|
|
|
|
# |* |
|
2016-06-12 19:43:50 +02:00
|
|
|
|
# |* d2 |
|
2016-03-05 10:59:09 +01:00
|
|
|
|
# | * r0 |
|
|
|
|
|
# |_______|
|
2016-01-05 16:07:13 +01:00
|
|
|
|
cryptDisk0 = byid "ata-ST2000DM001-1CH164_Z240XTT6";
|
|
|
|
|
cryptDisk1 = byid "ata-TP02000GB_TPW151006050068";
|
2016-03-08 18:35:32 +01:00
|
|
|
|
cryptDisk2 = byid "ata-ST4000DM000-1F2168_Z303HVSG";
|
|
|
|
|
# cryptDisk3 = byid "ata-WDC_WD20EARS-00MVWB0_WD-WMAZA1786907";
|
2016-01-05 16:07:13 +01:00
|
|
|
|
# all physical disks
|
2016-03-16 08:43:20 +01:00
|
|
|
|
|
|
|
|
|
# TODO callPackage ../3modules/MonitorDisks { disks = allDisks }
|
2016-07-27 00:05:59 +02:00
|
|
|
|
dataDisks = [ cryptDisk0 cryptDisk1 cryptDisk2 ];
|
|
|
|
|
allDisks = [ rootDisk ] ++ dataDisks;
|
2016-01-05 16:07:13 +01:00
|
|
|
|
in {
|
2015-12-16 12:06:44 +01:00
|
|
|
|
imports =
|
2016-01-03 06:07:35 +01:00
|
|
|
|
[
|
2016-02-15 16:27:11 +01:00
|
|
|
|
../.
|
2016-01-03 06:07:35 +01:00
|
|
|
|
# TODO: unlock home partition via ssh
|
2016-06-12 19:43:50 +02:00
|
|
|
|
../2configs/fs/sda-crypto-root.nix
|
2016-01-03 06:07:35 +01:00
|
|
|
|
../2configs/zsh-user.nix
|
2016-09-02 12:47:34 +02:00
|
|
|
|
../2configs/urlwatch.nix
|
2016-10-19 12:31:13 +02:00
|
|
|
|
../2configs/backup.nix
|
2015-12-16 12:06:44 +01:00
|
|
|
|
../2configs/exim-retiolum.nix
|
2016-01-03 06:07:35 +01:00
|
|
|
|
../2configs/smart-monitor.nix
|
2016-01-03 23:07:55 +01:00
|
|
|
|
../2configs/mail-client.nix
|
2016-09-02 12:47:34 +02:00
|
|
|
|
../2configs/disable_v6.nix
|
2016-06-12 19:43:50 +02:00
|
|
|
|
#../2configs/graphite-standalone.nix
|
|
|
|
|
#../2configs/share-user-sftp.nix
|
2016-02-01 22:01:41 +01:00
|
|
|
|
../2configs/omo-share.nix
|
2016-07-20 17:18:57 +02:00
|
|
|
|
../2configs/tinc/retiolum.nix
|
2016-08-22 18:43:38 +02:00
|
|
|
|
../2configs/torrent.nix
|
2016-06-12 19:43:50 +02:00
|
|
|
|
|
|
|
|
|
## as long as pyload is not in nixpkgs:
|
|
|
|
|
# docker run -d -v /var/lib/pyload:/opt/pyload/pyload-config -v /media/crypt0/pyload:/opt/pyload/Downloads --name pyload --restart=always -p 8112:8000 -P writl/pyload
|
2015-12-16 12:06:44 +01:00
|
|
|
|
];
|
2016-08-22 18:43:38 +02:00
|
|
|
|
makefu.full-populate = true;
|
2016-09-02 12:47:34 +02:00
|
|
|
|
krebs.rtorrent = {
|
|
|
|
|
downloadDir = lib.mkForce "/media/crypt0/torrent";
|
|
|
|
|
extraConfig = ''
|
|
|
|
|
upload_rate = 200
|
|
|
|
|
'';
|
2016-08-22 18:43:38 +02:00
|
|
|
|
};
|
|
|
|
|
users.groups.share = {
|
2016-10-20 20:54:38 +02:00
|
|
|
|
gid = (import <stockholm/lib>).genid "share";
|
2016-08-22 18:43:38 +02:00
|
|
|
|
members = [ "makefu" "misa" ];
|
|
|
|
|
};
|
2016-06-12 19:43:50 +02:00
|
|
|
|
networking.firewall.trustedInterfaces = [ primaryInterface ];
|
2016-01-27 22:20:32 +01:00
|
|
|
|
# udp:137 udp:138 tcp:445 tcp:139 - samba, allowed in local net
|
|
|
|
|
# tcp:80 - nginx for sharing files
|
|
|
|
|
# tcp:655 udp:655 - tinc
|
2016-04-03 21:52:16 +02:00
|
|
|
|
# tcp:8111 - graphite
|
2016-06-12 19:43:50 +02:00
|
|
|
|
# tcp:8112 - pyload
|
2016-04-03 21:52:16 +02:00
|
|
|
|
# tcp:9090 - sabnzbd
|
|
|
|
|
# tcp:9200 - elasticsearch
|
|
|
|
|
# tcp:5601 - kibana
|
2016-01-27 22:20:32 +01:00
|
|
|
|
networking.firewall.allowedUDPPorts = [ 655 ];
|
2016-06-12 19:43:50 +02:00
|
|
|
|
networking.firewall.allowedTCPPorts = [ 80 655 5601 8111 8112 9200 9090 ];
|
2016-01-27 22:20:32 +01:00
|
|
|
|
|
2016-01-14 12:42:52 +01:00
|
|
|
|
# services.openssh.allowSFTP = false;
|
2016-01-08 03:37:38 +01:00
|
|
|
|
|
|
|
|
|
# copy config from <secrets/sabnzbd.ini> to /var/lib/sabnzbd/
|
|
|
|
|
services.sabnzbd.enable = true;
|
|
|
|
|
systemd.services.sabnzbd.environment.SSL_CERT_FILE = "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt";
|
|
|
|
|
|
2016-06-12 19:43:50 +02:00
|
|
|
|
virtualisation.docker.enable = true;
|
2016-07-28 13:02:06 +02:00
|
|
|
|
makefu.ps3netsrv = {
|
|
|
|
|
enable = true;
|
|
|
|
|
servedir = "/media/cryptX/emu/ps3";
|
|
|
|
|
};
|
2016-01-08 03:37:38 +01:00
|
|
|
|
# HDD Array stuff
|
2016-01-05 16:07:13 +01:00
|
|
|
|
services.smartd.devices = builtins.map (x: { device = x; }) allDisks;
|
2016-01-08 03:37:38 +01:00
|
|
|
|
|
2016-07-27 00:05:59 +02:00
|
|
|
|
makefu.snapraid = {
|
2016-01-05 16:21:01 +01:00
|
|
|
|
enable = true;
|
|
|
|
|
disks = map toMapper [ 0 1 ];
|
|
|
|
|
parity = toMapper 2;
|
2016-01-03 06:07:35 +01:00
|
|
|
|
};
|
2016-06-12 19:43:50 +02:00
|
|
|
|
|
2016-07-27 00:05:59 +02:00
|
|
|
|
# TODO create folders in /media
|
|
|
|
|
system.activationScripts.createCryptFolders = ''
|
|
|
|
|
${lib.concatMapStringsSep "\n"
|
|
|
|
|
(d: "install -m 755 -d " + (toMapper d) )
|
|
|
|
|
[ 0 1 2 "X" ]}
|
|
|
|
|
'';
|
2016-07-30 18:43:21 +02:00
|
|
|
|
environment.systemPackages = with pkgs;[
|
|
|
|
|
mergerfs # hard requirement for mount
|
|
|
|
|
wol # wake up filepimp
|
2016-09-02 12:47:34 +02:00
|
|
|
|
f3
|
2016-07-30 18:43:21 +02:00
|
|
|
|
];
|
2016-01-05 16:21:01 +01:00
|
|
|
|
fileSystems = let
|
|
|
|
|
cryptMount = name:
|
|
|
|
|
{ "/media/${name}" = { device = "/dev/mapper/${name}"; fsType = "xfs"; };};
|
2016-06-12 19:43:50 +02:00
|
|
|
|
in cryptMount "crypt0"
|
2016-01-05 16:21:01 +01:00
|
|
|
|
// cryptMount "crypt1"
|
2016-07-27 00:05:59 +02:00
|
|
|
|
// cryptMount "crypt2"
|
|
|
|
|
// { "/media/cryptX" = {
|
|
|
|
|
device = (lib.concatMapStringsSep ":" (d: (toMapper d)) [ 0 1 2 ]);
|
|
|
|
|
fsType = "mergerfs";
|
|
|
|
|
options = [ "defaults" "allow_other" ];
|
|
|
|
|
};
|
|
|
|
|
};
|
2016-01-05 16:21:01 +01:00
|
|
|
|
|
2016-01-05 16:07:13 +01:00
|
|
|
|
powerManagement.powerUpCommands = lib.concatStrings (map (disk: ''
|
|
|
|
|
${pkgs.hdparm}/sbin/hdparm -S 100 ${disk}
|
|
|
|
|
${pkgs.hdparm}/sbin/hdparm -B 127 ${disk}
|
|
|
|
|
${pkgs.hdparm}/sbin/hdparm -y ${disk}
|
|
|
|
|
'') allDisks);
|
2016-01-08 03:37:38 +01:00
|
|
|
|
|
2016-01-27 22:20:32 +01:00
|
|
|
|
# crypto unlocking
|
2015-12-16 12:06:44 +01:00
|
|
|
|
boot = {
|
2016-01-03 06:07:35 +01:00
|
|
|
|
initrd.luks = {
|
2016-01-05 16:07:13 +01:00
|
|
|
|
devices = let
|
|
|
|
|
usbkey = name: device: {
|
|
|
|
|
inherit name device keyFile;
|
2016-01-03 06:07:35 +01:00
|
|
|
|
keyFileSize = 4096;
|
2016-06-12 19:43:50 +02:00
|
|
|
|
allowDiscards = true;
|
2016-01-05 16:07:13 +01:00
|
|
|
|
};
|
|
|
|
|
in [
|
2016-06-12 19:43:50 +02:00
|
|
|
|
(usbkey "luksroot" rootPartition)
|
2016-01-05 16:07:13 +01:00
|
|
|
|
(usbkey "crypt0" cryptDisk0)
|
|
|
|
|
(usbkey "crypt1" cryptDisk1)
|
2016-03-08 18:35:32 +01:00
|
|
|
|
(usbkey "crypt2" cryptDisk2)
|
2016-01-03 06:07:35 +01:00
|
|
|
|
];
|
|
|
|
|
};
|
2016-06-12 19:43:50 +02:00
|
|
|
|
loader.grub.device = lib.mkForce rootDisk;
|
2015-12-16 12:06:44 +01:00
|
|
|
|
|
|
|
|
|
initrd.availableKernelModules = [
|
|
|
|
|
"ahci"
|
2016-01-03 06:07:35 +01:00
|
|
|
|
"ohci_pci"
|
2015-12-16 12:06:44 +01:00
|
|
|
|
"ehci_pci"
|
2016-01-03 06:07:35 +01:00
|
|
|
|
"pata_atiixp"
|
|
|
|
|
"firewire_ohci"
|
|
|
|
|
"usb_storage"
|
|
|
|
|
"usbhid"
|
2015-12-16 12:06:44 +01:00
|
|
|
|
];
|
|
|
|
|
|
2016-06-12 19:43:50 +02:00
|
|
|
|
kernelModules = [ "kvm-intel" ];
|
2015-12-16 12:06:44 +01:00
|
|
|
|
extraModulePackages = [ ];
|
|
|
|
|
};
|
2016-07-11 20:45:34 +02:00
|
|
|
|
users.users.misa = {
|
|
|
|
|
uid = 9002;
|
|
|
|
|
name = "misa";
|
|
|
|
|
};
|
2015-12-16 12:06:44 +01:00
|
|
|
|
hardware.enableAllFirmware = true;
|
2016-06-12 19:43:50 +02:00
|
|
|
|
hardware.cpu.intel.updateMicrocode = true;
|
2015-12-16 12:06:44 +01:00
|
|
|
|
|
2016-01-08 03:37:38 +01:00
|
|
|
|
zramSwap.enable = true;
|
2016-01-03 06:07:35 +01:00
|
|
|
|
|
2016-01-27 22:00:50 +01:00
|
|
|
|
krebs.build.host = config.krebs.hosts.omo;
|
2015-12-16 12:06:44 +01:00
|
|
|
|
}
|