summaryrefslogtreecommitdiffstats
path: root/makefu/1systems/omo.nix
diff options
context:
space:
mode:
authorlassulus <lass@aidsballs.de>2016-02-01 15:19:04 +0100
committerlassulus <lass@aidsballs.de>2016-02-01 15:19:04 +0100
commitb7e2a64c3205a36b850dd1990146e0aeab5dbf5e (patch)
tree1434c93427bee20fb515168c6a2705eb04aa2970 /makefu/1systems/omo.nix
parent72dc2dd7fa54c77e08052efed21f68758fa533a2 (diff)
parentb38a821c31de84af6567073bd65ac76c5fc02b5d (diff)
Merge remote-tracking branch 'gum/master'
Diffstat (limited to 'makefu/1systems/omo.nix')
-rw-r--r--makefu/1systems/omo.nix44
1 files changed, 38 insertions, 6 deletions
diff --git a/makefu/1systems/omo.nix b/makefu/1systems/omo.nix
index 552af4e4f..19183fea8 100644
--- a/makefu/1systems/omo.nix
+++ b/makefu/1systems/omo.nix
@@ -31,10 +31,45 @@ in {
../2configs/nginx/omo-share.nix
../3modules
];
+ networking.firewall.trustedInterfaces = [ "enp3s0" ];
+ # udp:137 udp:138 tcp:445 tcp:139 - samba, allowed in local net
+ # tcp:80 - nginx for sharing files
+ # tcp:655 udp:655 - tinc
+ # tcp:8080 - sabnzbd
+ networking.firewall.allowedUDPPorts = [ 655 ];
+ networking.firewall.allowedTCPPorts = [ 80 655 8080 ];
+
# services.openssh.allowSFTP = false;
- krebs.build.host = config.krebs.hosts.omo;
krebs.build.source.git.nixpkgs.rev = "d0e3cca04edd5d1b3d61f188b4a5f61f35cdf1ce";
+ # samba share /media/crypt1/share
+ users.users.smbguest = {
+ name = "smbguest";
+ uid = config.ids.uids.smbguest;
+ description = "smb guest user";
+ home = "/var/empty";
+ };
+ services.samba = {
+ enable = true;
+ shares = {
+ winshare = {
+ path = "/media/crypt1/share";
+ "read only" = "no";
+ browseable = "yes";
+ "guest ok" = "yes";
+ };
+ };
+ extraConfig = ''
+ guest account = smbguest
+ map to guest = bad user
+ # disable printing
+ load printers = no
+ printing = bsd
+ printcap name = /dev/null
+ disable spoolss = yes
+ '';
+ };
+
# copy config from <secrets/sabnzbd.ini> to /var/lib/sabnzbd/
services.sabnzbd.enable = true;
systemd.services.sabnzbd.environment.SSL_CERT_FILE = "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt";
@@ -67,6 +102,7 @@ in {
${pkgs.hdparm}/sbin/hdparm -y ${disk}
'') allDisks);
+ # crypto unlocking
boot = {
initrd.luks = {
devices = let
@@ -97,15 +133,11 @@ in {
extraModulePackages = [ ];
};
- networking.firewall.allowedUDPPorts = [ 655 ];
- # 8080: sabnzbd
- networking.firewall.allowedTCPPorts = [ 80 655 8080 ];
-
hardware.enableAllFirmware = true;
hardware.cpu.amd.updateMicrocode = true;
zramSwap.enable = true;
zramSwap.numDevices = 2;
-
+ krebs.build.host = config.krebs.hosts.omo;
}