nixos/hosts/boron.cx.ts.hillion.co.uk/default.nix

133 lines
3.2 KiB
Nix
Raw Normal View History

2024-04-22 20:49:43 +01:00
{ config, pkgs, lib, ... }:
{
imports = [
./hardware-configuration.nix
];
config = {
system.stateVersion = "23.11";
networking.hostName = "boron";
networking.domain = "cx.ts.hillion.co.uk";
boot.loader.systemd-boot.enable = true;
boot.loader.efi.canTouchEfiVariables = true;
boot.kernelParams = [ "ip=dhcp" ];
boot.initrd = {
availableKernelModules = [ "igb" ];
network.enable = true;
clevis = {
enable = true;
useTang = true;
devices = {
"disk0-crypt".secretFile = "/data/disk_encryption.jwe";
"disk1-crypt".secretFile = "/data/disk_encryption.jwe";
2024-04-22 20:49:43 +01:00
};
};
};
custom.defaults = true;
## Kernel
### Explicitly use the latest kernel at time of writing because the LTS
### kernels available in NixOS do not seem to support this server's very
### modern hardware.
2024-05-23 22:03:41 +01:00
boot.kernelPackages = pkgs.linuxPackages_6_9;
## Enable btrfs compression
fileSystems."/data".options = [ "compress=zstd" ];
fileSystems."/nix".options = [ "compress=zstd" ];
2024-04-22 20:49:43 +01:00
## Impermanence
custom.impermanence.enable = true;
## Custom Services
custom = {
locations.autoServe = true;
2024-05-12 11:41:42 +01:00
www.global.enable = true;
2024-05-10 21:15:24 +01:00
services = {
gitea.actions = {
enable = true;
tokenSecret = ../../secrets/gitea/actions/boron.age;
};
};
2024-04-22 20:49:43 +01:00
};
2024-05-10 22:35:29 +01:00
services.nsd.interfaces = [
"138.201.252.214"
"2a01:4f8:173:23d2::2"
];
2024-04-22 20:49:43 +01:00
## Enable ZRAM to help with root on tmpfs
zramSwap = {
enable = true;
memoryPercent = 200;
algorithm = "zstd";
};
## Filesystems
services.btrfs.autoScrub = {
enable = true;
interval = "Tue, 02:00";
# By default both /data and /nix would be scrubbed. They are the same filesystem so this is wasteful.
fileSystems = [ "/data" ];
};
## Networking
boot.kernel.sysctl = {
"net.ipv4.ip_forward" = true;
"net.ipv6.conf.all.forwarding" = true;
};
networking = {
useDHCP = false;
interfaces = {
enp6s0 = {
name = "eth0";
useDHCP = true;
ipv6.addresses = [{
address = "2a01:4f8:173:23d2::2";
prefixLength = 64;
}];
};
};
defaultGateway6 = {
address = "fe80::1";
interface = "eth0";
};
};
networking.firewall = {
trustedInterfaces = [ "tailscale0" ];
allowedTCPPorts = lib.mkForce [ ];
allowedUDPPorts = lib.mkForce [ ];
interfaces = {
eth0 = {
allowedTCPPorts = lib.mkForce [
2024-05-12 11:33:08 +01:00
22 # SSH
3022 # SSH (Gitea) - redirected to 22
2024-05-10 22:35:29 +01:00
53 # DNS
2024-05-12 11:41:42 +01:00
80 # HTTP 1-2
443 # HTTPS 1-2
2024-05-18 16:41:53 +01:00
8080 # Unifi (inform)
2024-04-22 20:49:43 +01:00
];
allowedUDPPorts = lib.mkForce [
2024-05-10 22:35:29 +01:00
53 # DNS
2024-05-12 11:41:42 +01:00
443 # HTTP 3
2024-05-18 16:41:53 +01:00
3478 # Unifi STUN
2024-04-22 20:49:43 +01:00
];
};
};
};
## Tailscale
age.secrets."tailscale/boron.cx.ts.hillion.co.uk".file = ../../secrets/tailscale/boron.cx.ts.hillion.co.uk.age;
services.tailscale = {
2024-04-22 20:49:43 +01:00
enable = true;
authKeyFile = config.age.secrets."tailscale/boron.cx.ts.hillion.co.uk".path;
2024-04-22 20:49:43 +01:00
};
};
}