mirror of
https://github.com/RichieCahill/dotfiles.git
synced 2026-04-17 04:58:19 -04:00
Merge pull request #1 from RichieCahill/setting-up-jeeves
Setting up jeeves
This commit is contained in:
GitHub
173
flake.lock
generated
173
flake.lock
generated
@@ -9,11 +9,11 @@
|
||||
},
|
||||
"locked": {
|
||||
"dir": "pkgs/firefox-addons",
|
||||
"lastModified": 1725783932,
|
||||
"narHash": "sha256-ZrDE5yqkgiv0F34w1QFz1oZnNnReW0PEA6vjO6gx4Uc=",
|
||||
"lastModified": 1725940994,
|
||||
"narHash": "sha256-PCj5WMvCMg2g8gBNf3izt4rPu5b5Mi/7zxmXHit3N3U=",
|
||||
"owner": "rycee",
|
||||
"repo": "nur-expressions",
|
||||
"rev": "58ac93a2ade218ea5e4dae38246030c7342b1eb4",
|
||||
"rev": "93857a3619db67e72f5012ce3cb001e402b86dbe",
|
||||
"type": "gitlab"
|
||||
},
|
||||
"original": {
|
||||
@@ -23,6 +23,44 @@
|
||||
"type": "gitlab"
|
||||
}
|
||||
},
|
||||
"flake-compat": {
|
||||
"flake": false,
|
||||
"locked": {
|
||||
"lastModified": 1717312683,
|
||||
"narHash": "sha256-FrlieJH50AuvagamEvWMIE6D2OAnERuDboFDYAED/dE=",
|
||||
"owner": "nix-community",
|
||||
"repo": "flake-compat",
|
||||
"rev": "38fd3954cf65ce6faf3d0d45cd26059e059f07ea",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "nix-community",
|
||||
"repo": "flake-compat",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"flake-parts": {
|
||||
"inputs": {
|
||||
"nixpkgs-lib": [
|
||||
"nixos-cosmic",
|
||||
"nix-update",
|
||||
"nixpkgs"
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1719994518,
|
||||
"narHash": "sha256-pQMhCCHyQGRzdfAkdJ4cIWiw+JNuWsTX7f0ZYSyz0VY=",
|
||||
"owner": "hercules-ci",
|
||||
"repo": "flake-parts",
|
||||
"rev": "9227223f6d922fee3c7b190b2cc238a99527bbb7",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "hercules-ci",
|
||||
"repo": "flake-parts",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"flake-utils": {
|
||||
"locked": {
|
||||
"lastModified": 1629284811,
|
||||
@@ -63,11 +101,11 @@
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1725781935,
|
||||
"narHash": "sha256-o6LRtdpgBTzev9n243Ktu3rn0/qsv0frFyJwU6vJsdE=",
|
||||
"lastModified": 1725948275,
|
||||
"narHash": "sha256-4QOPemDQ9VRLQaAdWuvdDBhh+lEUOAnSMHhdr4nS1mk=",
|
||||
"owner": "nix-community",
|
||||
"repo": "home-manager",
|
||||
"rev": "ec4c6928bbacc89cf10e9c959a7a47cbaad95344",
|
||||
"rev": "e5fa72bad0c6f533e8d558182529ee2acc9454fe",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -98,13 +136,60 @@
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"nix-update": {
|
||||
"inputs": {
|
||||
"flake-parts": "flake-parts",
|
||||
"nixpkgs": [
|
||||
"nixos-cosmic",
|
||||
"nixpkgs"
|
||||
],
|
||||
"treefmt-nix": "treefmt-nix"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1725635983,
|
||||
"narHash": "sha256-haSfwdurfltqQ/7YEmDcmWLnWwvAgelIHnXsHG34P1k=",
|
||||
"owner": "lilyinstarlight",
|
||||
"repo": "nix-update",
|
||||
"rev": "ed54a7546affb3f8c9c3e10a6fa6fdb21756ec8f",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "lilyinstarlight",
|
||||
"repo": "nix-update",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"nixos-cosmic": {
|
||||
"inputs": {
|
||||
"flake-compat": "flake-compat",
|
||||
"nix-update": "nix-update",
|
||||
"nixpkgs": [
|
||||
"nixpkgs"
|
||||
],
|
||||
"nixpkgs-stable": "nixpkgs-stable",
|
||||
"rust-overlay": "rust-overlay"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1725932078,
|
||||
"narHash": "sha256-IATccCX01KHY3QDYmpCMu70WRWxJH4V7z9vp71RlSAs=",
|
||||
"owner": "lilyinstarlight",
|
||||
"repo": "nixos-cosmic",
|
||||
"rev": "0452cc841e9b30160ae48db636164fb7a6d6bb72",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "lilyinstarlight",
|
||||
"repo": "nixos-cosmic",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"nixos-hardware": {
|
||||
"locked": {
|
||||
"lastModified": 1725716377,
|
||||
"narHash": "sha256-7NzW9O/cAw7iWzRfh7Oo/SuSudL4a1YTKS6yoh3tMck=",
|
||||
"lastModified": 1725885300,
|
||||
"narHash": "sha256-5RLEnou1/GJQl+Wd+Bxaj7QY7FFQ9wjnFq1VNEaxTmc=",
|
||||
"owner": "nixos",
|
||||
"repo": "nixos-hardware",
|
||||
"rev": "04a1cda0c1725094a4db703cccbb956b7558f5a6",
|
||||
"rev": "166dee4f88a7e3ba1b7a243edb1aca822f00680e",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -132,11 +217,27 @@
|
||||
},
|
||||
"nixpkgs-stable": {
|
||||
"locked": {
|
||||
"lastModified": 1725693463,
|
||||
"narHash": "sha256-ZPzhebbWBOr0zRWW10FfqfbJlan3G96/h3uqhiFqmwg=",
|
||||
"lastModified": 1725826545,
|
||||
"narHash": "sha256-L64N1rpLlXdc94H+F6scnrbuEu+utC03cDDVvvJGOME=",
|
||||
"owner": "NixOS",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "f4c846aee8e1e29062aa8514d5e0ab270f4ec2f9",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "NixOS",
|
||||
"ref": "nixos-24.05",
|
||||
"repo": "nixpkgs",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"nixpkgs-stable_2": {
|
||||
"locked": {
|
||||
"lastModified": 1725826545,
|
||||
"narHash": "sha256-L64N1rpLlXdc94H+F6scnrbuEu+utC03cDDVvvJGOME=",
|
||||
"owner": "nixos",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "68e7dce0a6532e876980764167ad158174402c6f",
|
||||
"rev": "f4c846aee8e1e29062aa8514d5e0ab270f4ec2f9",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -158,7 +259,7 @@
|
||||
"nixpkgs"
|
||||
],
|
||||
"systems": "systems_2",
|
||||
"treefmt-nix": "treefmt-nix"
|
||||
"treefmt-nix": "treefmt-nix_2"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1723343306,
|
||||
@@ -178,13 +279,35 @@
|
||||
"inputs": {
|
||||
"firefox-addons": "firefox-addons",
|
||||
"home-manager": "home-manager",
|
||||
"nixos-cosmic": "nixos-cosmic",
|
||||
"nixos-hardware": "nixos-hardware",
|
||||
"nixpkgs": "nixpkgs",
|
||||
"nixpkgs-stable": "nixpkgs-stable",
|
||||
"nixpkgs-stable": "nixpkgs-stable_2",
|
||||
"system_tools": "system_tools",
|
||||
"systems": "systems_3"
|
||||
}
|
||||
},
|
||||
"rust-overlay": {
|
||||
"inputs": {
|
||||
"nixpkgs": [
|
||||
"nixos-cosmic",
|
||||
"nixpkgs"
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1725848835,
|
||||
"narHash": "sha256-u4lCr+tOEWhsFiww5G04U5jUNzaQJi0/ZMIDGiLeT14=",
|
||||
"owner": "oxalica",
|
||||
"repo": "rust-overlay",
|
||||
"rev": "2ef910a6276a2f34513d18f2f826a8dea72c3b3f",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "oxalica",
|
||||
"repo": "rust-overlay",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"system_tools": {
|
||||
"inputs": {
|
||||
"flake-utils": "flake-utils_2",
|
||||
@@ -252,6 +375,28 @@
|
||||
}
|
||||
},
|
||||
"treefmt-nix": {
|
||||
"inputs": {
|
||||
"nixpkgs": [
|
||||
"nixos-cosmic",
|
||||
"nix-update",
|
||||
"nixpkgs"
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1719887753,
|
||||
"narHash": "sha256-p0B2r98UtZzRDM5miGRafL4h7TwGRC4DII+XXHDHqek=",
|
||||
"owner": "numtide",
|
||||
"repo": "treefmt-nix",
|
||||
"rev": "bdb6355009562d8f9313d9460c0d3860f525bc6c",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "numtide",
|
||||
"repo": "treefmt-nix",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"treefmt-nix_2": {
|
||||
"inputs": {
|
||||
"nixpkgs": [
|
||||
"system_tools",
|
||||
|
||||
10
flake.nix
10
flake.nix
@@ -34,6 +34,11 @@
|
||||
url = "github:RichieCahill/system_tools";
|
||||
inputs.nixpkgs.follows = "nixpkgs";
|
||||
};
|
||||
|
||||
nixos-cosmic = {
|
||||
url = "github:lilyinstarlight/nixos-cosmic";
|
||||
inputs.nixpkgs.follows = "nixpkgs";
|
||||
};
|
||||
};
|
||||
|
||||
outputs = {
|
||||
@@ -41,6 +46,7 @@
|
||||
nixpkgs,
|
||||
home-manager,
|
||||
systems,
|
||||
nixos-cosmic,
|
||||
...
|
||||
} @ inputs: let
|
||||
inherit (self) outputs;
|
||||
@@ -65,6 +71,10 @@
|
||||
modules = [./systems/bob];
|
||||
specialArgs = {inherit inputs outputs;};
|
||||
};
|
||||
jeeves = lib.nixosSystem {
|
||||
modules = [./systems/jeeves];
|
||||
specialArgs = {inherit inputs outputs;};
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
|
||||
@@ -52,9 +52,7 @@
|
||||
id = "l62ul-lpweo"; # cspell:disable-line
|
||||
path = "/home/richie/notes";
|
||||
devices = [
|
||||
"phone"
|
||||
"jeeves"
|
||||
"rhapsody-in-green"
|
||||
];
|
||||
fsWatcherEnabled = true;
|
||||
};
|
||||
@@ -64,7 +62,6 @@
|
||||
devices = [
|
||||
"phone"
|
||||
"jeeves"
|
||||
"rhapsody-in-green"
|
||||
];
|
||||
fsWatcherEnabled = true;
|
||||
};
|
||||
@@ -74,7 +71,6 @@
|
||||
devices = [
|
||||
"phone"
|
||||
"jeeves"
|
||||
"rhapsody-in-green"
|
||||
];
|
||||
fsWatcherEnabled = true;
|
||||
};
|
||||
@@ -82,9 +78,9 @@
|
||||
id = "vprc5-3azqc"; # cspell:disable-line
|
||||
path = "/home/richie/music";
|
||||
devices = [
|
||||
"ipad"
|
||||
"phone"
|
||||
"jeeves"
|
||||
"rhapsody-in-green"
|
||||
];
|
||||
fsWatcherEnabled = true;
|
||||
};
|
||||
@@ -93,7 +89,6 @@
|
||||
path = "/home/richie/projects";
|
||||
devices = [
|
||||
"jeeves"
|
||||
"rhapsody-in-green"
|
||||
];
|
||||
fsWatcherEnabled = true;
|
||||
};
|
||||
|
||||
@@ -1,4 +1,5 @@
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
inputs,
|
||||
outputs,
|
||||
@@ -17,6 +18,8 @@
|
||||
./ssh.nix
|
||||
];
|
||||
|
||||
boot.kernelPackages = config.boot.zfs.package.latestCompatibleLinuxPackages;
|
||||
|
||||
security.auditd.enable = lib.mkDefault true;
|
||||
|
||||
programs = {
|
||||
|
||||
15
systems/common/optional/ssh_decrypt.nix
Normal file
15
systems/common/optional/ssh_decrypt.nix
Normal file
@@ -0,0 +1,15 @@
|
||||
{ config, ... }:
|
||||
{
|
||||
boot.initrd = {
|
||||
network = {
|
||||
enable = true;
|
||||
ssh = {
|
||||
enable = true;
|
||||
port = 2222;
|
||||
hostKeys = [ "/etc/ssh/initrd_ssh_host_ed25519_key" ];
|
||||
authorizedKeys = config.users.users.richie.openssh.authorizedKeys.keys;
|
||||
};
|
||||
};
|
||||
availableKernelModules = [ "igb" ];
|
||||
};
|
||||
}
|
||||
@@ -9,9 +9,9 @@
|
||||
settings = {
|
||||
devices = {
|
||||
phone.id = "LTGPLAE-M4ZDJTM-TZ3DJGY-SLLAVWF-CQDVEVS-RGCS75T-GAPZYK3-KUM6LA5"; # cspell:disable-line
|
||||
jeeves.id = "7YQ4UEW-OPQEBH4-6YKJH4B-ZCE3SAX-5EIK5JL-WJDIWUA-WA2N3D5-MNK6GAV"; # cspell:disable-line
|
||||
rhapsody-in-green.id = "INKUNKN-KILXGL5-2TQ5JTH-ORJOLOM-WYD2PYO-YRDLQIX-3AKZFWT-ZN7OJAE"; # cspell:disable-line
|
||||
bob.id = "YP6UYKF-KFZ3FG3-5XM3XM3-5Q24AZS-LZK67PN-LAERKU2-K4WMYBH-N57ZBA5"; # cspell:disable-line
|
||||
jeeves.id = "RCDU465-AIQRBEJ-VWC4EZF-2AMXABC-F3S4NFW-QA4ZUAQ-OVNUBLI-BUJJTA2"; # cspell:disable-line
|
||||
ipad.id = "KI76T3X-SFUGV2L-VSNYTKR-TSIUV5L-SHWD3HE-GQRGRCN-GY4UFMD-CW6Z6AX"; # cspell:disable-line
|
||||
bob.id = "CJIAPEJ-VO74RR4-F75VU6M-QNZAMYG-FYUJG7Y-6AT62HJ-355PRPL-PJFETAZ"; # cspell:disable-line
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
29
systems/jeeves/arch_mirror.nix
Normal file
29
systems/jeeves/arch_mirror.nix
Normal file
@@ -0,0 +1,29 @@
|
||||
{ inputs, pkgs, ... }:
|
||||
let
|
||||
vars = import ./vars.nix;
|
||||
in
|
||||
{
|
||||
virtualisation.oci-containers.containers.arch_mirror = {
|
||||
image = "ubuntu/apache2:latest";
|
||||
volumes = [
|
||||
"${../common/docker_templates}/file_server/sites/:/etc/apache2/sites-enabled/"
|
||||
"${vars.media_mirror}:/data"
|
||||
];
|
||||
ports = [ "800:80" ];
|
||||
extraOptions = [ "--network=web" ];
|
||||
autoStart = true;
|
||||
};
|
||||
|
||||
systemd.services.sync_mirror = {
|
||||
requires = [ "network-online.target" ];
|
||||
after = [ "network-online.target" ];
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
description = "validates startup";
|
||||
path = [ pkgs.rsync ];
|
||||
serviceConfig = {
|
||||
Environment = "MIRROR_DIR=${vars.media_mirror}/archlinux/";
|
||||
Type = "simple";
|
||||
ExecStart = "${inputs.system_tools.packages.x86_64-linux.default}/bin/sync_mirror";
|
||||
};
|
||||
};
|
||||
}
|
||||
115
systems/jeeves/default.nix
Normal file
115
systems/jeeves/default.nix
Normal file
@@ -0,0 +1,115 @@
|
||||
{ config, pkgs, ... }:
|
||||
let
|
||||
vars = import ./vars.nix;
|
||||
in
|
||||
{
|
||||
imports = [
|
||||
../../users/richie
|
||||
../common/global
|
||||
../common/optional/ssh_decrypt.nix
|
||||
../common/optional/syncthing_base.nix
|
||||
../common/optional/systemd-boot.nix
|
||||
../common/optional/zerotier.nix
|
||||
./arch_mirror.nix
|
||||
./docker
|
||||
./hardware.nix
|
||||
./networking.nix
|
||||
./programs.nix
|
||||
./services.nix
|
||||
];
|
||||
|
||||
boot.zfs.extraPools = [
|
||||
"media"
|
||||
"storage"
|
||||
"torrenting"
|
||||
];
|
||||
|
||||
services = {
|
||||
openssh.ports = [ 629 ];
|
||||
|
||||
plex = {
|
||||
enable = true;
|
||||
dataDir = vars.media_plex;
|
||||
};
|
||||
|
||||
smartd.enable = true;
|
||||
|
||||
sysstat.enable = true;
|
||||
|
||||
syncthing.guiAddress = "192.168.90.40:8384";
|
||||
syncthing.settings.folders = {
|
||||
"notes" = {
|
||||
id = "l62ul-lpweo"; # cspell:disable-line
|
||||
path = vars.media_notes;
|
||||
devices = [
|
||||
"bob"
|
||||
];
|
||||
fsWatcherEnabled = true;
|
||||
};
|
||||
"books" = {
|
||||
id = "6uppx-vadmy"; # cspell:disable-line
|
||||
path = "${vars.storage_syncthing}/books";
|
||||
devices = [
|
||||
"bob"
|
||||
"phone"
|
||||
];
|
||||
fsWatcherEnabled = true;
|
||||
};
|
||||
"important" = {
|
||||
id = "4ckma-gtshs"; # cspell:disable-line
|
||||
path = "${vars.storage_syncthing}/important";
|
||||
devices = [
|
||||
"bob"
|
||||
"phone"
|
||||
];
|
||||
fsWatcherEnabled = true;
|
||||
};
|
||||
"music" = {
|
||||
id = "vprc5-3azqc"; # cspell:disable-line
|
||||
path = "${vars.storage_syncthing}/music";
|
||||
devices = [
|
||||
"bob"
|
||||
"ipad"
|
||||
"phone"
|
||||
];
|
||||
fsWatcherEnabled = true;
|
||||
};
|
||||
"projects" = {
|
||||
id = "vyma6-lqqrz"; # cspell:disable-line
|
||||
path = "${vars.storage_syncthing}/projects";
|
||||
devices = [
|
||||
"bob"
|
||||
];
|
||||
fsWatcherEnabled = true;
|
||||
};
|
||||
};
|
||||
|
||||
zfs = {
|
||||
trim.enable = true;
|
||||
autoScrub.enable = true;
|
||||
};
|
||||
};
|
||||
systemd = {
|
||||
services."snapshot_manager" = {
|
||||
description = "ZFS Snapshot Manager";
|
||||
requires = [ "zfs-import.target" ];
|
||||
after = [ "zfs-import.target" ];
|
||||
serviceConfig = {
|
||||
Environment = "ZFS_BIN=${pkgs.zfs}/bin/zfs";
|
||||
Type = "oneshot";
|
||||
ExecStart = "${pkgs.python3}/bin/python3 ${vars.media_scripts}/ZFS/snapshot_manager.py --config-file='${./snapshot_config.toml}'";
|
||||
};
|
||||
};
|
||||
timers."snapshot_manager" = {
|
||||
wantedBy = [ "timers.target" ];
|
||||
timerConfig = {
|
||||
OnBootSec = "15m";
|
||||
OnUnitActiveSec = "15m";
|
||||
Unit = "snapshot_manager.service";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
|
||||
system.stateVersion = "24.05";
|
||||
}
|
||||
11
systems/jeeves/docker/default.nix
Normal file
11
systems/jeeves/docker/default.nix
Normal file
@@ -0,0 +1,11 @@
|
||||
{ lib, ... }:
|
||||
{
|
||||
imports =
|
||||
let
|
||||
files = builtins.attrNames (builtins.readDir ./.);
|
||||
nixFiles = builtins.filter (name: lib.hasSuffix ".nix" name && name != "default.nix") files;
|
||||
in
|
||||
map (file: ./. + "/${file}") nixFiles;
|
||||
|
||||
virtualisation.oci-containers.backend = "docker";
|
||||
}
|
||||
3
systems/jeeves/docker/docker_networks.md
Normal file
3
systems/jeeves/docker/docker_networks.md
Normal file
@@ -0,0 +1,3 @@
|
||||
# docker_networks
|
||||
|
||||
docker network create -d bridge web
|
||||
15
systems/jeeves/docker/filebrowser.nix
Normal file
15
systems/jeeves/docker/filebrowser.nix
Normal file
@@ -0,0 +1,15 @@
|
||||
let
|
||||
vars = import ../vars.nix;
|
||||
in
|
||||
{
|
||||
virtualisation.oci-containers.containers.filebrowser = {
|
||||
image = "hurlenko/filebrowser:latest";
|
||||
extraOptions = [ "--network=web" ];
|
||||
volumes = [
|
||||
"/zfs:/data"
|
||||
"${vars.media_docker_configs}/filebrowser:/config"
|
||||
];
|
||||
autoStart = true;
|
||||
user = "1000:users";
|
||||
};
|
||||
}
|
||||
68
systems/jeeves/docker/haproxy.cfg
Normal file
68
systems/jeeves/docker/haproxy.cfg
Normal file
@@ -0,0 +1,68 @@
|
||||
global
|
||||
log stdout format raw local0
|
||||
# stats socket /run/haproxy/admin.sock mode 660 level admin expose-fd listeners
|
||||
stats timeout 30s
|
||||
|
||||
defaults
|
||||
log global
|
||||
mode http
|
||||
retries 3
|
||||
maxconn 2000
|
||||
timeout connect 5s
|
||||
timeout client 50s
|
||||
timeout server 50s
|
||||
timeout http-request 10s
|
||||
timeout http-keep-alive 2s
|
||||
timeout queue 5s
|
||||
timeout tunnel 2m
|
||||
timeout client-fin 1s
|
||||
timeout server-fin 1s
|
||||
|
||||
|
||||
#Application Setup
|
||||
frontend ContentSwitching
|
||||
bind *:80
|
||||
bind *:443 ssl crt /etc/ssl/certs/cloudflare.pem
|
||||
mode http
|
||||
# tmmworkshop.com
|
||||
acl host_mirror hdr(host) -i mirror.tmmworkshop.com
|
||||
acl host_dndrules hdr(host) -i dndrules.tmmworkshop.com
|
||||
acl host_grafana hdr(host) -i grafana.tmmworkshop.com
|
||||
acl host_filebrowser hdr(host) -i filebrowser.tmmworkshop.com
|
||||
acl host_uptime_kuma hdr(host) -i uptimekuma-jeeves.tmmworkshop.com
|
||||
acl host_overseerr hdr(host) -i overseerr.tmmworkshop.com
|
||||
|
||||
use_backend mirror_nodes if host_mirror
|
||||
use_backend dndrules_nodes if host_dndrules
|
||||
use_backend grafana_nodes if host_grafana
|
||||
use_backend filebrowser_nodes if host_filebrowser
|
||||
use_backend uptime_kuma_nodes if host_uptime_kuma
|
||||
use_backend overseerr_nodes if host_overseerr
|
||||
|
||||
backend mirror_nodes
|
||||
mode http
|
||||
server server arch_mirror:80
|
||||
|
||||
backend mirror_rsync
|
||||
mode http
|
||||
server server arch_mirror:873
|
||||
|
||||
backend grafana_nodes
|
||||
mode http
|
||||
server server grafana:3000
|
||||
|
||||
backend dndrules_nodes
|
||||
mode http
|
||||
server server dnd_file_server:80
|
||||
|
||||
backend filebrowser_nodes
|
||||
mode http
|
||||
server server filebrowser:8080
|
||||
|
||||
backend uptime_kuma_nodes
|
||||
mode http
|
||||
server server uptime_kuma:3001
|
||||
|
||||
backend overseerr_nodes
|
||||
mode http
|
||||
server server overseerr:5055
|
||||
144
systems/jeeves/docker/internal.nix
Normal file
144
systems/jeeves/docker/internal.nix
Normal file
@@ -0,0 +1,144 @@
|
||||
let
|
||||
vars = import ../vars.nix;
|
||||
in
|
||||
{
|
||||
virtualisation.oci-containers.containers = {
|
||||
qbit = {
|
||||
image = "ghcr.io/linuxserver/qbittorrent:latest";
|
||||
ports = [
|
||||
"6881:6881"
|
||||
"6881:6881/udp"
|
||||
"8082:8082"
|
||||
"29432:29432"
|
||||
];
|
||||
volumes = [
|
||||
"${vars.media_docker_configs}/qbit:/config"
|
||||
"${vars.torrenting_qbit}:/data"
|
||||
];
|
||||
environment = {
|
||||
PUID = "600";
|
||||
PGID = "100";
|
||||
TZ = "America/New_York";
|
||||
WEBUI_PORT = "8082";
|
||||
};
|
||||
autoStart = true;
|
||||
};
|
||||
qbitvpn = {
|
||||
image = "binhex/arch-qbittorrentvpn:latest";
|
||||
extraOptions = [ "--cap-add=NET_ADMIN" ];
|
||||
ports = [
|
||||
"6882:6881"
|
||||
"6882:6881/udp"
|
||||
"8081:8081"
|
||||
"8118:8118"
|
||||
];
|
||||
volumes = [
|
||||
"${vars.media_docker_configs}/qbitvpn:/config"
|
||||
"${vars.torrenting_qbitvpn}:/data"
|
||||
"/etc/localtime:/etc/localtime:ro"
|
||||
];
|
||||
environment = {
|
||||
WEBUI_PORT = "8081";
|
||||
PUID = "600";
|
||||
PGID = "100";
|
||||
VPN_ENABLED = "yes";
|
||||
VPN_CLIENT = "openvpn";
|
||||
STRICT_PORT_FORWARD = "yes";
|
||||
ENABLE_PRIVOXY = "yes";
|
||||
LAN_NETWORK = "192.168.90.0/24";
|
||||
NAME_SERVERS = "1.1.1.1,1.0.0.1";
|
||||
UMASK = "000";
|
||||
DEBUG = "false";
|
||||
DELUGE_DAEMON_LOG_LEVEL = "debug";
|
||||
DELUGE_WEB_LOG_LEVEL = "debug";
|
||||
};
|
||||
environmentFiles = [/root/secrets/docker/qbitvpn];
|
||||
autoStart = true;
|
||||
};
|
||||
bazarr = {
|
||||
image = "ghcr.io/linuxserver/bazarr:latest";
|
||||
ports = [ "6767:6767" ];
|
||||
environment = {
|
||||
PUID = "600";
|
||||
PGID = "100";
|
||||
TZ = "America/New_York";
|
||||
};
|
||||
volumes = [
|
||||
"${vars.media_docker_configs}/bazarr:/config"
|
||||
"${vars.storage_plex}/movies:/movies"
|
||||
"${vars.storage_plex}/tv:/tv"
|
||||
];
|
||||
autoStart = true;
|
||||
};
|
||||
prowlarr = {
|
||||
image = "ghcr.io/linuxserver/prowlarr:latest";
|
||||
ports = [ "9696:9696" ];
|
||||
environment = {
|
||||
PUID = "600";
|
||||
PGID = "100";
|
||||
TZ = "America/New_York";
|
||||
};
|
||||
volumes = [ "${vars.media_docker_configs}/prowlarr:/config" ];
|
||||
autoStart = true;
|
||||
};
|
||||
radarr = {
|
||||
image = "ghcr.io/linuxserver/radarr:latest";
|
||||
ports = [ "7878:7878" ];
|
||||
environment = {
|
||||
PUID = "600";
|
||||
PGID = "100";
|
||||
TZ = "America/New_York";
|
||||
};
|
||||
volumes = [
|
||||
"${vars.media_docker_configs}/radarr:/config"
|
||||
"${vars.storage_plex}/movies:/movies"
|
||||
"${vars.torrenting_qbitvpn}:/data"
|
||||
];
|
||||
autoStart = true;
|
||||
};
|
||||
sonarr = {
|
||||
image = "ghcr.io/linuxserver/sonarr:latest";
|
||||
ports = [ "8989:8989" ];
|
||||
environment = {
|
||||
PUID = "600";
|
||||
PGID = "100";
|
||||
TZ = "America/New_York";
|
||||
};
|
||||
volumes = [
|
||||
"${vars.media_docker_configs}/sonarr:/config"
|
||||
"${vars.storage_plex}/tv:/tv"
|
||||
"${vars.torrenting_qbitvpn}:/data"
|
||||
];
|
||||
autoStart = true;
|
||||
};
|
||||
overseerr = {
|
||||
image = "ghcr.io/linuxserver/overseerr";
|
||||
environment = {
|
||||
PUID = "600";
|
||||
PGID = "100";
|
||||
TZ = "America/New_York";
|
||||
};
|
||||
volumes = [ "${vars.media_docker_configs}/overseerr:/config" ];
|
||||
dependsOn = [
|
||||
"radarr"
|
||||
"sonarr"
|
||||
];
|
||||
extraOptions = [ "--network=web" ];
|
||||
autoStart = true;
|
||||
};
|
||||
whisper = {
|
||||
image = "ghcr.io/linuxserver/faster-whisper:latest";
|
||||
ports = [ "10300:10300" ];
|
||||
environment = {
|
||||
PUID = "600";
|
||||
PGID = "100";
|
||||
TZ = "America/New_York";
|
||||
WHISPER_MODEL = "tiny-int8";
|
||||
WHISPER_LANG = "en";
|
||||
WHISPER_BEAM = "1";
|
||||
};
|
||||
volumes = [ "${vars.media_docker_configs}/whisper:/config" ];
|
||||
autoStart = true;
|
||||
};
|
||||
};
|
||||
}
|
||||
32
systems/jeeves/docker/postgresql.nix
Normal file
32
systems/jeeves/docker/postgresql.nix
Normal file
@@ -0,0 +1,32 @@
|
||||
let
|
||||
vars = import ../vars.nix;
|
||||
in
|
||||
{
|
||||
users = {
|
||||
users.postgres = {
|
||||
isSystemUser = true;
|
||||
group = "postgres";
|
||||
uid = 999;
|
||||
};
|
||||
groups.postgres = {
|
||||
gid = 999;
|
||||
};
|
||||
};
|
||||
|
||||
virtualisation.oci-containers.containers = {
|
||||
postgres = {
|
||||
image = "postgres:16";
|
||||
ports = [ "5432:5432" ];
|
||||
volumes = [ "${vars.media_database}/postgres:/var/lib/postgresql/data" ];
|
||||
environment = {
|
||||
POSTGRES_USER = "admin";
|
||||
POSTGRES_DB = "archive";
|
||||
POSTGRES_INITDB_ARGS = "--auth-host=scram-sha-256";
|
||||
};
|
||||
environmentFiles = [/root/secrets/docker/postgres];
|
||||
autoStart = true;
|
||||
user = "postgres:postgres";
|
||||
};
|
||||
};
|
||||
|
||||
}
|
||||
16
systems/jeeves/docker/uptime_kuma.nix
Normal file
16
systems/jeeves/docker/uptime_kuma.nix
Normal file
@@ -0,0 +1,16 @@
|
||||
let
|
||||
vars = import ../vars.nix;
|
||||
in
|
||||
{
|
||||
virtualisation.oci-containers.containers = {
|
||||
uptime_kuma = {
|
||||
image = "louislam/uptime-kuma:latest";
|
||||
volumes = [
|
||||
"${vars.media_docker_configs}/uptime_kuma:/app/data"
|
||||
"/var/run/docker.sock:/var/run/docker.sock"
|
||||
];
|
||||
extraOptions = [ "--network=web" ];
|
||||
autoStart = true;
|
||||
};
|
||||
};
|
||||
}
|
||||
56
systems/jeeves/docker/web.nix
Normal file
56
systems/jeeves/docker/web.nix
Normal file
@@ -0,0 +1,56 @@
|
||||
let
|
||||
vars = import ../vars.nix;
|
||||
in
|
||||
{
|
||||
virtualisation.oci-containers.containers = {
|
||||
grafana = {
|
||||
image = "grafana/grafana-enterprise:latest";
|
||||
volumes = [ "${vars.media_docker_configs}/grafana:/var/lib/grafana" ];
|
||||
user = "600:600";
|
||||
extraOptions = [ "--network=web" ];
|
||||
autoStart = true;
|
||||
};
|
||||
dnd_file_server = {
|
||||
image = "ubuntu/apache2:latest";
|
||||
volumes = [
|
||||
"${../../common/docker_templates}/file_server/sites/:/etc/apache2/sites-enabled/"
|
||||
"${vars.storage_main}/Table_Top/:/data"
|
||||
];
|
||||
extraOptions = [ "--network=web" ];
|
||||
autoStart = true;
|
||||
};
|
||||
haproxy = {
|
||||
image = "haproxy:latest";
|
||||
user = "600:600";
|
||||
environment = {
|
||||
TZ = "Etc/EST";
|
||||
};
|
||||
volumes = [
|
||||
"/root/secrets/docker/cloudflare.pem:/etc/ssl/certs/cloudflare.pem"
|
||||
"${./haproxy.cfg}:/usr/local/etc/haproxy/haproxy.cfg"
|
||||
];
|
||||
dependsOn = [
|
||||
"arch_mirror"
|
||||
"dnd_file_server"
|
||||
"filebrowser"
|
||||
"grafana"
|
||||
"overseerr"
|
||||
"uptime_kuma"
|
||||
];
|
||||
extraOptions = [ "--network=web" ];
|
||||
autoStart = true;
|
||||
};
|
||||
cloud_flare_tunnel = {
|
||||
image = "cloudflare/cloudflared:latest";
|
||||
user = "600:600";
|
||||
cmd = [
|
||||
"tunnel"
|
||||
"run"
|
||||
];
|
||||
environmentFiles = [/root/secrets/docker/cloud_flare_tunnel];
|
||||
dependsOn = [ "haproxy" ];
|
||||
extraOptions = [ "--network=web" ];
|
||||
autoStart = true;
|
||||
};
|
||||
};
|
||||
}
|
||||
58
systems/jeeves/hardware.nix
Normal file
58
systems/jeeves/hardware.nix
Normal file
@@ -0,0 +1,58 @@
|
||||
{ config, lib, modulesPath, ... }:
|
||||
|
||||
{
|
||||
imports =[ (modulesPath + "/installer/scan/not-detected.nix") ];
|
||||
|
||||
boot = {
|
||||
initrd = {
|
||||
availableKernelModules = [
|
||||
"ahci"
|
||||
"mpt3sas"
|
||||
"nvme"
|
||||
"sd_mod"
|
||||
"sr_mod"
|
||||
"usb_storage"
|
||||
"usbhid"
|
||||
"xhci_pci"
|
||||
];
|
||||
kernelModules = [ ];
|
||||
luks.devices = {
|
||||
"luks-root-pool-wwn-0x500a0751e6c3c01e-part2".device = "/dev/disk/by-id/wwn-0x500a0751e6c3c01e-part2";
|
||||
"luks-root-pool-wwn-0x500a0751e6c3c01c-part2".device = "/dev/disk/by-id/wwn-0x500a0751e6c3c01c-part2";
|
||||
};
|
||||
};
|
||||
kernelModules = [ "kvm-amd" ];
|
||||
extraModulePackages = [ ];
|
||||
};
|
||||
|
||||
fileSystems = {
|
||||
"/" = lib.mkDefault {
|
||||
device = "root_pool/root";
|
||||
fsType = "zfs";
|
||||
};
|
||||
|
||||
"/home" = {
|
||||
device = "root_pool/home";
|
||||
fsType = "zfs";
|
||||
};
|
||||
|
||||
"/var" = {
|
||||
device = "root_pool/var";
|
||||
fsType = "zfs";
|
||||
};
|
||||
|
||||
"/boot" = {
|
||||
device = "/dev/disk/by-id/wwn-0x500a0751e6c3c01e-part1";
|
||||
fsType = "vfat";
|
||||
options = [
|
||||
"fmask=0077"
|
||||
"dmask=0077"
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
swapDevices = [ ];
|
||||
|
||||
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
|
||||
hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
|
||||
}
|
||||
42
systems/jeeves/networking.nix
Normal file
42
systems/jeeves/networking.nix
Normal file
@@ -0,0 +1,42 @@
|
||||
{
|
||||
networking = {
|
||||
hostName = "jeeves";
|
||||
hostId = "0e15ce35";
|
||||
firewall.enable = false;
|
||||
useNetworkd = true;
|
||||
};
|
||||
|
||||
systemd.network = {
|
||||
enable = true;
|
||||
networks = {
|
||||
"10-1GB_Primary" = {
|
||||
matchConfig.Name = "enp98s0f0";
|
||||
DHCP = "yes";
|
||||
};
|
||||
};
|
||||
networks = {
|
||||
"10-1GB_Secondary" = {
|
||||
matchConfig.Name = "enp98s0f1";
|
||||
DHCP = "yes";
|
||||
};
|
||||
};
|
||||
networks = {
|
||||
"10-10GB_Primary" = {
|
||||
matchConfig.Name = "enp97s0f0np0";
|
||||
DHCP = "yes";
|
||||
linkConfig.RequiredForOnline = "routable";
|
||||
};
|
||||
};
|
||||
networks = {
|
||||
"10-10GB_Secondary" = {
|
||||
matchConfig.Name = "enp97s0f1np1";
|
||||
DHCP = "yes";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
services.zerotierone = {
|
||||
enable = true;
|
||||
joinNetworks = [ "e4da7455b2ae64ca" ];
|
||||
};
|
||||
}
|
||||
7
systems/jeeves/programs.nix
Normal file
7
systems/jeeves/programs.nix
Normal file
@@ -0,0 +1,7 @@
|
||||
{ pkgs, ... }:
|
||||
{
|
||||
environment.systemPackages = with pkgs; [
|
||||
filebot
|
||||
docker-compose
|
||||
];
|
||||
}
|
||||
7
systems/jeeves/scripts/plex_permission.sh
Normal file
7
systems/jeeves/scripts/plex_permission.sh
Normal file
@@ -0,0 +1,7 @@
|
||||
#!/bin/bash
|
||||
|
||||
plex_dir="/zfs/storage/plex/"
|
||||
|
||||
chown docker-service:users -R "$plex_dir"
|
||||
find "$plex_dir" -type f -exec chmod 664 {} \;
|
||||
find "$plex_dir" -type d -exec chmod 775 {} \;
|
||||
47
systems/jeeves/services.nix
Normal file
47
systems/jeeves/services.nix
Normal file
@@ -0,0 +1,47 @@
|
||||
{
|
||||
inputs,
|
||||
pkgs,
|
||||
...
|
||||
}:
|
||||
{
|
||||
systemd = {
|
||||
services = {
|
||||
plex_permission = {
|
||||
description = "maintains /zfs/storage/plex permissions";
|
||||
serviceConfig = {
|
||||
Type = "oneshot";
|
||||
ExecStart = "${pkgs.bash}/bin/bash ${./scripts/plex_permission.sh}";
|
||||
};
|
||||
};
|
||||
startup_validation = {
|
||||
requires = [ "network-online.target" ];
|
||||
after = [ "network-online.target" ];
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
description = "validates startup";
|
||||
path = [ pkgs.zfs ];
|
||||
serviceConfig = {
|
||||
EnvironmentFile = "/root/secrets/services/server-validation";
|
||||
Type = "oneshot";
|
||||
ExecStart = "${inputs.system_tools.packages.x86_64-linux.default}/bin/validate_jeeves";
|
||||
};
|
||||
};
|
||||
};
|
||||
timers = {
|
||||
plex_permission = {
|
||||
wantedBy = [ "timers.target" ];
|
||||
timerConfig = {
|
||||
OnBootSec = "1h";
|
||||
OnCalendar = "daily 03:00";
|
||||
Unit = "plex_permission.service";
|
||||
};
|
||||
};
|
||||
startup_validation = {
|
||||
wantedBy = [ "timers.target" ];
|
||||
timerConfig = {
|
||||
OnBootSec = "10min";
|
||||
Unit = "startup_validation.service";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
29
systems/jeeves/snapshot_config.toml
Normal file
29
systems/jeeves/snapshot_config.toml
Normal file
@@ -0,0 +1,29 @@
|
||||
["media/Notes"]
|
||||
15_min = 8
|
||||
hourly = 24
|
||||
daily = 30
|
||||
monthly = 12
|
||||
|
||||
["storage/plex"]
|
||||
15_min = 6
|
||||
hourly = 2
|
||||
daily = 1
|
||||
monthly = 0
|
||||
|
||||
["media/plex"]
|
||||
15_min = 6
|
||||
hourly = 2
|
||||
daily = 1
|
||||
monthly = 0
|
||||
|
||||
["media/notes"]
|
||||
15_min = 8
|
||||
hourly = 24
|
||||
daily = 30
|
||||
monthly = 12
|
||||
|
||||
["media/docker"]
|
||||
15_min = 3
|
||||
hourly = 12
|
||||
daily = 14
|
||||
monthly = 2
|
||||
23
systems/jeeves/vars.nix
Normal file
23
systems/jeeves/vars.nix
Normal file
@@ -0,0 +1,23 @@
|
||||
let
|
||||
zfs_media = "/zfs/media";
|
||||
zfs_storage = "/zfs/storage";
|
||||
zfs_torrenting = "/zfs/torrenting";
|
||||
in
|
||||
{
|
||||
inherit zfs_media zfs_storage zfs_torrenting;
|
||||
# media
|
||||
media_database = "${zfs_media}/syncthing/database";
|
||||
media_docker = "${zfs_media}/docker";
|
||||
media_docker_configs = "${zfs_media}/docker/configs";
|
||||
media_mirror = "${zfs_media}/mirror";
|
||||
media_notes = "${zfs_media}/notes";
|
||||
media_plex = "${zfs_media}/plex/";
|
||||
media_scripts = "${zfs_media}/scripts";
|
||||
# storage
|
||||
storage_main = "${zfs_storage}/main";
|
||||
storage_plex = "${zfs_storage}/plex";
|
||||
storage_syncthing = "${zfs_storage}/syncthing";
|
||||
# torrenting
|
||||
torrenting_qbit = "${zfs_torrenting}/qbit";
|
||||
torrenting_qbitvpn = "${zfs_torrenting}/qbitvpn";
|
||||
}
|
||||
@@ -28,6 +28,7 @@
|
||||
|
||||
"rspace" = "'for f in *\ *; do mv \"$f\" \"\${f// /_}\"; done'";
|
||||
"rebuild" = "sudo nixos-rebuild switch --flake /home/richie/projects/dotfiles#$HOST";
|
||||
"nix-test" = "nixos-rebuild test --flake /home/richie/projects/dotfiles";
|
||||
};
|
||||
};
|
||||
}
|
||||
|
||||
@@ -11,7 +11,6 @@
|
||||
neofetch
|
||||
rar
|
||||
ripgrep
|
||||
sops
|
||||
starship
|
||||
tmux
|
||||
zoxide
|
||||
|
||||
@@ -10,6 +10,12 @@
|
||||
port = 629;
|
||||
dynamicForwards = [ { port = 9050; } ];
|
||||
};
|
||||
unlock-jeeves = {
|
||||
hostname = "192.168.95.14";
|
||||
user = "root";
|
||||
identityFile = "~/.ssh/id_ed25519";
|
||||
port = 2222;
|
||||
};
|
||||
jeevesjr = {
|
||||
hostname = "192.168.90.35";
|
||||
user = "richie";
|
||||
|
||||
5
users/richie/systems/jeeves.nix
Normal file
5
users/richie/systems/jeeves.nix
Normal file
@@ -0,0 +1,5 @@
|
||||
{
|
||||
imports = [
|
||||
../home/global.nix
|
||||
];
|
||||
}
|
||||
Reference in New Issue
Block a user