From f212c874b59a2249290a4fdde75483bb74a45e82 Mon Sep 17 00:00:00 2001 From: aloslider <53711835+aloslider@users.noreply.github.com> Date: Sun, 10 May 2026 11:46:58 +0300 Subject: [PATCH] WIP --- flake.lock | 17 ++ flake.nix | 58 +++--- home/benq/core/default.nix | 5 +- home/benq/core/packages.nix | 10 + home/benq/core/{zsh.nix => podman.nix} | 3 +- .../core/selfhosted/containers/common.nix | 18 ++ .../core/selfhosted/containers/default.nix | 53 +++++ .../selfhosted/containers/homarr/default.nix | 40 ++++ .../selfhosted/containers/netbird/config.nix | 195 ++++++++++++++++++ .../selfhosted/containers/netbird/default.nix | 110 ++++++++++ .../containers/pocket-id/config.nix | 20 ++ .../containers/pocket-id/default.nix | 45 ++++ .../containers/vaultwarden/config.nix | 26 +++ .../containers/vaultwarden/default.nix | 39 ++++ home/benq/core/selfhosted/default.nix | 7 + home/benq/core/selfhosted/network.nix | 11 + home/benq/core/sops.nix | 18 ++ home/benq/homelab.nix | 13 +- hosts/common/core/default.nix | 2 + hosts/common/core/disko.nix | 3 +- hosts/common/core/netbird.nix | 4 + hosts/common/core/packages.nix | 7 +- hosts/common/core/sops.nix | 2 +- hosts/common/core/zsh.nix | 5 + hosts/common/optional/docker.nix | 18 -- hosts/common/users/benq.nix | 8 +- hosts/homelab/boot.nix | 5 +- hosts/homelab/configuration.nix | 3 +- hosts/homelab/network.nix | 24 +-- 29 files changed, 689 insertions(+), 80 deletions(-) create mode 100644 home/benq/core/packages.nix rename home/benq/core/{zsh.nix => podman.nix} (54%) create mode 100644 home/benq/core/selfhosted/containers/common.nix create mode 100644 home/benq/core/selfhosted/containers/default.nix create mode 100644 home/benq/core/selfhosted/containers/homarr/default.nix create mode 100644 home/benq/core/selfhosted/containers/netbird/config.nix create mode 100644 home/benq/core/selfhosted/containers/netbird/default.nix create mode 100644 home/benq/core/selfhosted/containers/pocket-id/config.nix create mode 100644 home/benq/core/selfhosted/containers/pocket-id/default.nix create mode 100644 home/benq/core/selfhosted/containers/vaultwarden/config.nix create mode 100644 home/benq/core/selfhosted/containers/vaultwarden/default.nix create mode 100644 home/benq/core/selfhosted/default.nix create mode 100644 home/benq/core/selfhosted/network.nix create mode 100644 home/benq/core/sops.nix create mode 100644 hosts/common/core/netbird.nix create mode 100644 hosts/common/core/zsh.nix delete mode 100644 hosts/common/optional/docker.nix diff --git a/flake.lock b/flake.lock index f6bf473..739fa87 100644 --- a/flake.lock +++ b/flake.lock @@ -18,6 +18,22 @@ "type": "github" } }, + "dotfiles": { + "flake": false, + "locked": { + "lastModified": 1778400209, + "narHash": "sha256-mEGIHZaTmQulmWLg3C8r0wdpEllFcKWeAt+3FLa4grM=", + "owner": "aloslider", + "repo": "dotfiles", + "rev": "e01f5de3b98f3c85997db571eeaef855bbda80a3", + "type": "github" + }, + "original": { + "owner": "aloslider", + "repo": "dotfiles", + "type": "github" + } + }, "home-manager": { "inputs": { "nixpkgs": [ @@ -89,6 +105,7 @@ "root": { "inputs": { "disko": "disko", + "dotfiles": "dotfiles", "home-manager": "home-manager", "nixpkgs": "nixpkgs_2", "sops-nix": "sops-nix" diff --git a/flake.nix b/flake.nix index ac3eb12..e3a4d1e 100644 --- a/flake.nix +++ b/flake.nix @@ -1,40 +1,46 @@ { inputs = { nixpkgs.url = "github:nixos/nixpkgs?ref=nixos-unstable"; + disko.url = "github:nix-community/disko"; + dotfiles = { + url = "github:aloslider/dotfiles"; + flake = false; + }; home-manager = { url = "github:nix-community/home-manager"; inputs.nixpkgs.follows = "nixpkgs"; }; - disko.url = "github:nix-community/disko"; sops-nix.url = "github:mic92/sops-nix"; }; - outputs = { self, nixpkgs, ... }@inputs: - let - system = "x86_64-linux"; - pkgs = nixpkgs; - customLib = pkgs.lib.extend ( - self: super: { - custom = ( - import ./lib { - inherit (pkgs) lib; - } - ); - } - ); - in - { - nixosConfigurations = { - homelab = pkgs.lib.nixosSystem { - inherit system; - specialArgs = { - inherit inputs; - lib = customLib; + outputs = + { self, nixpkgs, ... }@inputs: + let + system = "x86_64-linux"; + pkgs = nixpkgs; + customLib = pkgs.lib.extend ( + self: super: { + custom = ( + import ./lib { + inherit (pkgs) lib; + } + ); + } + ); + in + { + nixosConfigurations = { + homelab = pkgs.lib.nixosSystem { + inherit system; + specialArgs = { + inherit inputs; + inherit (inputs) disko; + lib = customLib; + }; + modules = [ + ./hosts/homelab/configuration.nix + ]; }; - modules = [ - ./hosts/homelab/configuration.nix - ]; }; }; - }; } diff --git a/home/benq/core/default.nix b/home/benq/core/default.nix index 3549d8c..3951a21 100644 --- a/home/benq/core/default.nix +++ b/home/benq/core/default.nix @@ -2,6 +2,9 @@ { imports = [ ./git.nix - ./zsh.nix + ./packages.nix + ./podman.nix + ./selfhosted + ./sops.nix ]; } diff --git a/home/benq/core/packages.nix b/home/benq/core/packages.nix new file mode 100644 index 0000000..47b6e3e --- /dev/null +++ b/home/benq/core/packages.nix @@ -0,0 +1,10 @@ +{ config, pkgs, ... }: +{ + home.packages = with pkgs; [ + chezmoi + fzf + lazygit + lazydocker + sops + ]; +} diff --git a/home/benq/core/zsh.nix b/home/benq/core/podman.nix similarity index 54% rename from home/benq/core/zsh.nix rename to home/benq/core/podman.nix index e3e52db..426fd91 100644 --- a/home/benq/core/zsh.nix +++ b/home/benq/core/podman.nix @@ -1,7 +1,6 @@ { config, ... }: { - programs.zsh = { + services.podman = { enable = true; - envExtra = ""; }; } diff --git a/home/benq/core/selfhosted/containers/common.nix b/home/benq/core/selfhosted/containers/common.nix new file mode 100644 index 0000000..4937bb2 --- /dev/null +++ b/home/benq/core/selfhosted/containers/common.nix @@ -0,0 +1,18 @@ +{ config, lib, ... }: +with lib; +{ + options.selfhosted.common = { + networkName = mkOption { + type = types.str; + }; + dataDir = mkOption { + type = types.str; + }; + }; + + config = { + sops.secrets = { + "domains/serv" = { }; + }; + }; +} diff --git a/home/benq/core/selfhosted/containers/default.nix b/home/benq/core/selfhosted/containers/default.nix new file mode 100644 index 0000000..7f89f89 --- /dev/null +++ b/home/benq/core/selfhosted/containers/default.nix @@ -0,0 +1,53 @@ +{ config, ... }: +let + prefix = "sh-"; + cfg = config.selfhosted; +in +{ + imports = [ + ./common.nix + + ./homarr + ./netbird + ./pocket-id + ./vaultwarden + ]; + + config.selfhosted = { + common = { + networkName = "selfhosted"; + dataDir = "/mnt/data"; + }; + homarr = { + name = "${prefix}homarr"; + subdomain = "dash"; + }; + netbird = + let + nbPrefix = "${prefix}nb-"; + in + { + subdomain = "nb"; + traefik = { + name = "${nbPrefix}traefik"; + }; + dashboard = { + name = "${nbPrefix}dashboard"; + }; + server = { + name = "${nbPrefix}server"; + }; + proxy = { + name = "${nbPrefix}proxy"; + }; + }; + pocket-id = { + name = "${prefix}pocket-id"; + subdomain = "id"; + }; + vaultwarden = { + name = "${prefix}vaultwarden"; + subdomain = "vault"; + }; + }; +} diff --git a/home/benq/core/selfhosted/containers/homarr/default.nix b/home/benq/core/selfhosted/containers/homarr/default.nix new file mode 100644 index 0000000..8fd6a0a --- /dev/null +++ b/home/benq/core/selfhosted/containers/homarr/default.nix @@ -0,0 +1,40 @@ +{ config, lib, ... }: +with lib; +let + common = config.selfhosted.common; + cfg = config.selfhosted.homarr; + hostDataPath = "${common.dataDir}/homarr/data"; +in +{ + options.selfhosted.homarr = { + name = mkOption { + type = types.str; + }; + subdomain = mkOption { + type = types.str; + }; + }; + + config = { + sops.secrets = { + "homarr/enc_key" = { }; + }; + + services.podman.containers."${cfg.name}" = { + image = "ghcr.io/homarr-labs/homarr:v1.60.0"; + network = common.networkName; + environment = { + SECRET_ENCRYPTION_KEY = "${config.sops.secrets."homarr/enc_key".path}"; + }; + volumes = [ + "${hostDataPath}:/appdata" + ]; + autoStart = true; + extraConfig = { + Quadlet = { + DefaultDependencies = false; + }; + }; + }; + }; +} diff --git a/home/benq/core/selfhosted/containers/netbird/config.nix b/home/benq/core/selfhosted/containers/netbird/config.nix new file mode 100644 index 0000000..c0212e8 --- /dev/null +++ b/home/benq/core/selfhosted/containers/netbird/config.nix @@ -0,0 +1,195 @@ +{ config, ... }: +let + cfg = config.selfhosted.netbird; + poCfg = config.selfhosted.pocket-id; + domain = config.sops.placeholder."domains/serv"; + fullDomain = "${cfg.subdomain}.${domain}"; +in +{ + sops.secrets = { + "netbird/traefik/letsEncryptEmail" = { }; + "netbird/auth/client_id" = { }; + "netbird/auth/client_secret" = { }; + "netbird/server/auth_secret" = { }; + "netbird/server/enc_key" = { }; + "netbird/proxy/token" = { }; + }; + + sops.templates."nb-traefik.yaml".content = '' + log: + level: INFO + + providers: + file: + filename: /etc/traefik/dynamic.yaml + + entryPoints: + web: + address: ":80" + http: + redirections: + entryPoint: + to: websecure + scheme: https + + websecure: + address: ":443" + + certificatesResolvers: + letsencrypt: + acme: + email: ${config.sops.placeholder."netbird/traefik/letsEncryptEmail"} + storage: /letsencrypt/acme.json + tlsChallenge: true + ''; + + sops.templates."nb-traefik-dynamic.yaml".content = + let + nbServerName = "nb-server"; + nbServerH2cName = "nb-server-h2c"; + nbDashboardName = "nb-dashboard"; + in + '' + http: + routers: + nb-relay: + rule: Host(`${fullDomain}`) && PathPrefix(`/relay`) + entryPoints: + - websecure + tls: + certResolver: letsencrypt + service: ${nbServerName} + priority: 110 + + nb-ws-signal: + rule: Host(`${fullDomain}`) && PathPrefix(`/ws-proxy/signal`) + entryPoints: + - websecure + tls: + certResolver: letsencrypt + service: ${nbServerName} + priority: 110 + + nb-ws-management: + rule: Host(`${fullDomain}`) && PathPrefix(`/ws-proxy/management`) + entryPoints: + - websecure + tls: + certResolver: letsencrypt + service: ${nbServerName} + priority: 110 + + nb-grpc-signal: + rule: Host(`${fullDomain}`) && PathPrefix(`/signalexchange.SignalExchange/`) + entryPoints: + - websecure + tls: + certResolver: letsencrypt + service: ${nbServerH2cName} + priority: 100 + + nb-grpc-management: + rule: Host(`${fullDomain}`) && PathPrefix(`/management.ManagementService/`) + entryPoints: + - websecure + tls: + certResolver: letsencrypt + service: ${nbServerH2cName} + priority: 100 + + nb-api: + rule: Host(`${fullDomain}`) && PathPrefix(`/api`) + entryPoints: + - websecure + tls: + certResolver: letsencrypt + service: ${nbServerName} + priority: 90 + + ${nbDashboardName}: + rule: Host(`${fullDomain}`) + entryPoints: + - websecure + tls: + certResolver: letsencrypt + service: ${nbDashboardName} + priority: 10 + + services: + ${nbServerName}: + loadBalancer: + servers: + - url: http://${cfg.server.name}:80 + + ${nbServerH2cName}: + loadBalancer: + servers: + - url: http://${cfg.server.name}:80 + scheme: h2c + + ${nbDashboardName}: + loadBalancer: + servers: + - url: http://${cfg.dashboard.name}:80 + tcp: + serversTransports: + pp-v2: + proxyProtocol: + version: 2 + ''; + + sops.templates."nb-dashboard.env".content = '' + NETBIRD_MGMT_API_ENDPOINT=https://${fullDomain} + NETBIRD_MGMT_GRPC_API_ENDPOINT=https://${fullDomain} + + AUTH_AUDIENCE=${cfg.dashboard.name} + AUTH_CLIENT_ID=${config.sops.placeholder."netbird/auth/client_id"} + AUTH_CLIENT_SECRET=${config.sops.placeholder."netbird/auth/client_secret"} + AUTH_AUTHORITY=https://${poCfg.subdomain}.${domain} + USE_AUTH0=false + AUTH_SUPPORTED_SCOPES=openid profile email groups + AUTH_REDIRECT_URI=/nb-auth + AUTH_SILENT_REDIRECT_URI=/nb-silent-auth + + LETSENCRYPT_DOMAIN=none + LETSENCRYPT_EMAIL=${config.sops.placeholder."netbird/traefik/letsEncryptEmail"} + ''; + + sops.templates."nb-config.yaml".content = '' + server: + listenAddress: ":80" + exposedAddress: "https://${fullDomain}" + stunPorts: + - 3478 + metricsPort: 9090 + healthcheckAddress: ":9000" + logLevel: "info" + logFile: "console" + + authSecret: "${config.sops.placeholder."netbird/server/auth_secret"}" + + auth: + issuer: "https://${poCfg.subdomain}.${domain}" + clientID: "${config.sops.placeholder."netbird/auth/client_id"}" + clientSecret: "${config.sops.placeholder."netbird/auth/client_secret"}" + + reverseProxy: + trustedHTTPProxies: + - "127.0.0.1/32" + + store: + engine: "sqlite" + encryptionKey: "${config.sops.placeholder."netbird/server/enc_key"}" + ''; + + sops.templates."nb-proxy.env".content = '' + NB_PROXY_DOMAIN=${fullDomain} + NB_PROXY_TOKEN=${config.sops.placeholder."netbird/proxy/token"} + NB_PROXY_MANAGEMENT_ADDRESS=http://${cfg.server.name}:80 + NB_PROXY_ALLOW_INSECURE=true + NB_PROXY_ADDRESS=:8443 + NB_PROXY_ACME_CERTIFICATES=true + NB_PROXY_ACME_CHALLENGE_TYPE=tls-alpn-01 + NB_PROXY_CERTIFICATE_DIRECTORY=/certs + ''; +} diff --git a/home/benq/core/selfhosted/containers/netbird/default.nix b/home/benq/core/selfhosted/containers/netbird/default.nix new file mode 100644 index 0000000..8663fd0 --- /dev/null +++ b/home/benq/core/selfhosted/containers/netbird/default.nix @@ -0,0 +1,110 @@ +{ + config, + lib, + pkgs, + ... +}: +with lib; +let + common = config.selfhosted.common; + cfg = config.selfhosted.netbird; + hostDataPath = "${common.dataDir}/netbird"; +in +{ + imports = [ + ./config.nix + ]; + + options.selfhosted.netbird = { + subdomain = mkOption { + type = types.str; + }; + traefik = { + name = mkOption { + type = types.str; + }; + }; + dashboard = { + name = mkOption { + type = types.str; + }; + }; + server = { + name = mkOption { + type = types.str; + }; + }; + proxy = { + name = mkOption { + type = types.str; + }; + }; + }; + + config = { + services.podman.containers.${cfg.traefik.name} = { + image = "traefik:v3.6"; + network = common.networkName; + ports = [ + "0.0.0.0:80:80" + "0.0.0.0:443:443" + ]; + autoStart = true; + volumes = [ + "${hostDataPath}/traefik/letsencrypt:/letsencrypt" + "${config.sops.templates."nb-traefik.yaml".path}:/etc/traefik/config.yaml" + "${config.sops.templates."nb-traefik-dynamic.yaml".path}:/etc/traefik/dynamic.yaml" + ]; + extraConfig = { + Quadlet = { + DefaultDependencies = false; + }; + }; + }; + + services.podman.containers.${cfg.dashboard.name} = { + image = "netbirdio/dashboard:v2.37.1"; + network = common.networkName; + environmentFile = [ "${config.sops.templates."nb-dashboard.env".path}" ]; + autoStart = true; + extraConfig = { + Quadlet = { + DefaultDependencies = false; + }; + }; + }; + + services.podman.containers.${cfg.server.name} = { + image = "netbirdio/netbird-server:0.70.5"; + network = common.networkName; + ports = [ + "0.0.0.0:3478:3478/udp" + ]; + autoStart = true; + volumes = [ + "${hostDataPath}/server/data:/var/lib/netbird" + "${config.sops.templates."nb-config.yaml".path}:/etc/netbird/config.yaml" + ]; + extraConfig = { + Quadlet = { + DefaultDependencies = false; + }; + }; + }; + + services.podman.containers.${cfg.proxy.name} = { + image = "netbirdio/reverse-proxy:0.70.5"; + network = common.networkName; + environmentFile = [ "${config.sops.templates."nb-proxy.env".path}" ]; + autoStart = true; + volumes = [ + "${hostDataPath}/proxy/certs:/certs" + ]; + extraConfig = { + Quadlet = { + DefaultDependencies = false; + }; + }; + }; + }; +} diff --git a/home/benq/core/selfhosted/containers/pocket-id/config.nix b/home/benq/core/selfhosted/containers/pocket-id/config.nix new file mode 100644 index 0000000..6e71a03 --- /dev/null +++ b/home/benq/core/selfhosted/containers/pocket-id/config.nix @@ -0,0 +1,20 @@ +{ config, ... }: +let + cfg = config.selfhosted.pocket-id; +in +{ + sops.secrets = { + "pocket_id/enc_key" = { }; + }; + + sops.templates."pocket-id.env" = { + content = '' + APP_URL=https://${cfg.subdomain}.${config.sops.placeholder."domains/serv"} + ENCRYPTION_KEY=${config.sops.placeholder."pocket_id/enc_key"} + TRUST_PROXY=true + ANALYTICS_DISABLED=true + PUID=1000 + PGID=1000 + ''; + }; +} diff --git a/home/benq/core/selfhosted/containers/pocket-id/default.nix b/home/benq/core/selfhosted/containers/pocket-id/default.nix new file mode 100644 index 0000000..f0079f5 --- /dev/null +++ b/home/benq/core/selfhosted/containers/pocket-id/default.nix @@ -0,0 +1,45 @@ +{ config, lib, ... }: +with lib; +let + common = config.selfhosted.common; + cfg = config.selfhosted.pocket-id; + hostDataPath = "${common.dataDir}/pocket-id/data"; +in +{ + imports = [ + ./config.nix + ]; + + options.selfhosted.pocket-id = { + name = mkOption { + type = types.str; + }; + subdomain = mkOption { + type = types.str; + }; + }; + + config = { + services.podman.containers.${cfg.name} = { + image = "ghcr.io/pocket-id/pocket-id:v2"; + network = common.networkName; + environmentFile = [ "${config.sops.templates."pocket-id.env".path}" ]; + volumes = [ + "${hostDataPath}:/app/data" + ]; + autoStart = true; + extraConfig = { + Quadlet = { + DefaultDependencies = false; + }; + Container = { + HealthCmd = ''"/app/pocket-id" "healthcheck"''; + HealthInterval = "1m30s"; + HealthTimeout = "5s"; + HealthRetries = "2"; + HealthStartPeriod = "10s"; + }; + }; + }; + }; +} diff --git a/home/benq/core/selfhosted/containers/vaultwarden/config.nix b/home/benq/core/selfhosted/containers/vaultwarden/config.nix new file mode 100644 index 0000000..2259e03 --- /dev/null +++ b/home/benq/core/selfhosted/containers/vaultwarden/config.nix @@ -0,0 +1,26 @@ +{ config, ... }: +let + cfg = config.selfhosted.vaultwarden; + poCfg = config.selfhosted.pocket-id; + domain = config.sops.placeholder."domains/serv"; +in +{ + sops.secrets = { + "vaultwarden/client_id" = { }; + "vaultwarden/client_secret" = { }; + }; + + sops.templates."vaultwarden.env".content = '' + DOMAIN=https://${cfg.subdomain}.${domain} + LOG_LEVEL=info,vaultwarden::sso=debug + SIGNUPS_ALLOWED=false + SSO_ENABLED=false + SSO_DEBUG_TOKENS=true + SSO_ONLY=false + SSO_AUTHORITY=https://${poCfg.subdomain}.${domain} + SSO_CLIENT_ID=${config.sops.placeholder."vaultwarden/client_id"} + SSO_CLIENT_SECRET=${config.sops.placeholder."vaultwarden/client_secret"} + SSO_AUTH_ONLY_NOT_SESSION=true + SSO_PKCE=true + ''; +} diff --git a/home/benq/core/selfhosted/containers/vaultwarden/default.nix b/home/benq/core/selfhosted/containers/vaultwarden/default.nix new file mode 100644 index 0000000..9ede3cb --- /dev/null +++ b/home/benq/core/selfhosted/containers/vaultwarden/default.nix @@ -0,0 +1,39 @@ +{ config, lib, ... }: +with lib; +let + common = config.selfhosted.common; + cfg = config.selfhosted.vaultwarden; + hostDataPath = "${common.dataDir}/vaultwarden/data"; +in +{ + imports = [ + ./config.nix + ]; + + options.selfhosted.vaultwarden = { + enable = mkEnableOption "Enable container"; + name = mkOption { + type = types.str; + }; + subdomain = mkOption { + type = types.str; + }; + }; + + config = { + services.podman.containers.${cfg.name} = { + image = "docker.io/vaultwarden/server:1.36.0"; + network = config.selfhosted.common.networkName; + environmentFile = [ "${config.sops.templates."vaultwarden.env".path}" ]; + volumes = [ + "${hostDataPath}:/data" + ]; + autoStart = true; + extraConfig = { + Quadlet = { + DefaultDependencies = false; + }; + }; + }; + }; +} diff --git a/home/benq/core/selfhosted/default.nix b/home/benq/core/selfhosted/default.nix new file mode 100644 index 0000000..38b8556 --- /dev/null +++ b/home/benq/core/selfhosted/default.nix @@ -0,0 +1,7 @@ +{ config, ... }: +{ + imports = [ + ./network.nix + ./containers + ]; +} diff --git a/home/benq/core/selfhosted/network.nix b/home/benq/core/selfhosted/network.nix new file mode 100644 index 0000000..727bb85 --- /dev/null +++ b/home/benq/core/selfhosted/network.nix @@ -0,0 +1,11 @@ +{ config, ... }: +let + common = config.selfhosted.common; +in +{ + services.podman = { + networks.${common.networkName} = { + driver = "bridge"; + }; + }; +} diff --git a/home/benq/core/sops.nix b/home/benq/core/sops.nix new file mode 100644 index 0000000..2833169 --- /dev/null +++ b/home/benq/core/sops.nix @@ -0,0 +1,18 @@ +{ config, dotfiles, sops-nix, ... }: +{ + imports = [ + sops-nix.homeManagerModules.sops + ]; + + sops = { + defaultSopsFile = "${dotfiles}/dot_config/sops/secrets.yaml"; + age.keyFile = "${config.xdg.configHome}/age/key.txt"; + }; + + home.file.".sops.yaml".source = "${dotfiles}/dot_sops.yaml"; + + xdg.configFile."sops" = { + source = "${dotfiles}/dot_config/sops"; + recursive = true; + }; +} diff --git a/home/benq/homelab.nix b/home/benq/homelab.nix index ec61cfd..7c69929 100644 --- a/home/benq/homelab.nix +++ b/home/benq/homelab.nix @@ -1,8 +1,8 @@ { config, - pkgs, - lib, inputs, + lib, + pkgs, ... }: { @@ -11,6 +11,9 @@ ]; home-manager = { + extraSpecialArgs = { + inherit (inputs) disko dotfiles sops-nix; + }; useGlobalPkgs = true; useUserPackages = true; users.benq = @@ -22,15 +25,11 @@ "home/benq/core" ] ++ (map (f: "home/benq/optional/${f}") [ + ]) )) ]; - home.packages = with pkgs; [ - chezmoi - lazygit - lazydocker - ]; home.stateVersion = "25.05"; }; }; diff --git a/hosts/common/core/default.nix b/hosts/common/core/default.nix index 9c365f3..e4c5490 100644 --- a/hosts/common/core/default.nix +++ b/hosts/common/core/default.nix @@ -3,8 +3,10 @@ imports = [ ./disko.nix ./locale.nix + ./netbird.nix ./nix.nix ./packages.nix ./sops.nix + ./zsh.nix ]; } diff --git a/hosts/common/core/disko.nix b/hosts/common/core/disko.nix index fe7a645..9bff97e 100644 --- a/hosts/common/core/disko.nix +++ b/hosts/common/core/disko.nix @@ -2,7 +2,6 @@ config, disko, lib, - inputs, ... }: with lib; @@ -11,7 +10,7 @@ let in { imports = [ - inputs.disko.nixosModules.disko + disko.nixosModules.disko ]; options.disko.cfg = { diff --git a/hosts/common/core/netbird.nix b/hosts/common/core/netbird.nix new file mode 100644 index 0000000..f7b3f32 --- /dev/null +++ b/hosts/common/core/netbird.nix @@ -0,0 +1,4 @@ +{ config, ... }: +{ + services.netbird.enable = true; +} diff --git a/hosts/common/core/packages.nix b/hosts/common/core/packages.nix index 7243bea..4ce2c7a 100644 --- a/hosts/common/core/packages.nix +++ b/hosts/common/core/packages.nix @@ -1,8 +1,13 @@ { congif, pkgs, ... }: { environment.systemPackages = with pkgs; [ + age + bind + btop git - neovim + jq + openssl tmux + tree ]; } diff --git a/hosts/common/core/sops.nix b/hosts/common/core/sops.nix index 66172de..7835f45 100644 --- a/hosts/common/core/sops.nix +++ b/hosts/common/core/sops.nix @@ -10,7 +10,7 @@ validateSopsFiles = false; secrets = { benq-password = { - neededForUsers = true; + neededForUsers = true; }; }; }; diff --git a/hosts/common/core/zsh.nix b/hosts/common/core/zsh.nix new file mode 100644 index 0000000..e7cedef --- /dev/null +++ b/hosts/common/core/zsh.nix @@ -0,0 +1,5 @@ +{ config, ... }: +{ + # programs.zsh.enable = true; + programs.nix-ld.enable = true; +} diff --git a/hosts/common/optional/docker.nix b/hosts/common/optional/docker.nix deleted file mode 100644 index 11846bb..0000000 --- a/hosts/common/optional/docker.nix +++ /dev/null @@ -1,18 +0,0 @@ -{ config, pkgs, ... }: -{ - virtualisation.docker = { - enable = true; - rootless = { - enable = true; - setSocketVariable = true; - }; - }; - security.wrappers = { - docker-rootlesskit = { - owner = "root"; - group = "root"; - capabilities = "cap_net_bind_service+ep"; - source = "${pkgs.rootlesskit}/bin/rootlesskit"; - }; - }; -} diff --git a/hosts/common/users/benq.nix b/hosts/common/users/benq.nix index 6a95952..608c2ed 100644 --- a/hosts/common/users/benq.nix +++ b/hosts/common/users/benq.nix @@ -1,7 +1,7 @@ { config, lib, - inputs, + pkgs, ... }: with lib; @@ -9,11 +9,16 @@ with lib; users = { mutableUsers = false; users.benq = { + shell = pkgs.zsh; isNormalUser = true; + ignoreShellProgramCheck = true; hashedPasswordFile = config.sops.secrets.benq-password.path; openssh.authorizedKeys.keys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAeIuJzR68xA4ugJjtWbwvaWEU852Hg9FAAhXNw8ou43 benq" ]; + linger = true; + subUidRanges = [ { startUid = 100000; count = 65536; } ]; + subGidRanges = [ { startGid = 100000; count = 65536; } ]; extraGroups = let ifTheyExist = groups: filter (group: hasAttr group config.users.groups) groups; @@ -21,7 +26,6 @@ with lib; flatten [ "wheel" (ifTheyExist [ - "docker" "git" "networkmanager" "video" diff --git a/hosts/homelab/boot.nix b/hosts/homelab/boot.nix index aa56b83..e332487 100644 --- a/hosts/homelab/boot.nix +++ b/hosts/homelab/boot.nix @@ -1,7 +1,10 @@ { config, ... }: { boot.loader = { - systemd-boot.enable = true; + systemd-boot = { + enable = true; + configurationLimit = 5; + }; efi.canTouchEfiVariables = true; }; } diff --git a/hosts/homelab/configuration.nix b/hosts/homelab/configuration.nix index d4299f7..ee48fe9 100644 --- a/hosts/homelab/configuration.nix +++ b/hosts/homelab/configuration.nix @@ -1,6 +1,7 @@ { config, lib, + pkgs, ... }: { @@ -16,7 +17,6 @@ ] ++ (map (f: "hosts/common/optional/${f}") [ "bbr.nix" - "docker.nix" "endlessh.nix" "fail2ban.nix" "openssh.nix" @@ -25,5 +25,6 @@ ]; disko.cfg.mainDevice = "/dev/disk/by-id/ata-AMD_R5M120G8_07092225C0040"; + environment.shells = [ pkgs.zsh ]; system.stateVersion = "26.05"; } diff --git a/hosts/homelab/network.nix b/hosts/homelab/network.nix index 4f0141e..5601ba0 100644 --- a/hosts/homelab/network.nix +++ b/hosts/homelab/network.nix @@ -2,25 +2,13 @@ { networking = { hostName = "homelab"; - useDHCP = false; - dhcpcd.enable = false; - defaultGateway = "192.168.88.1"; - nameservers = [ "192.168.88.1" ]; - - interfaces.enp7s0.ipv4.addresses = [ - { - address = "192.168.88.5"; - prefixLength = 24; - } - ]; - firewall = { - allowedTCPPorts = [ - 22 - 80 - 443 - ]; - allowedUDPPorts = [ ]; + allowedTCPPorts = [ 22 80 443 6969 ]; + allowedUDPPorts = [ 3478 ]; }; }; + + boot.kernel.sysctl = { + "net.ipv4.ip_unprivileged_port_start" = 80; + }; }