blob: d3c6cbeba9dcd177e3bd361690c5777189c07015 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
|
{ config, pkgs, lib, ... }:
{
imports = [
./net.nix
<stockholm/krebs>
<stockholm/krebs/2configs>
<stockholm/krebs/2configs/secret-passwords.nix>
<stockholm/krebs/2configs/hw/x220.nix>
# see documentation in included getty-for-esp.nix:
# brain hosts/puyak/root
<stockholm/krebs/2configs/hw/getty-for-esp.nix>
## initrd unlocking
# (brain hosts/puyak/luks-ssd;echo) | ssh root@$(brain krebs-secrets/puyak/initrd/hostname) 'cat > /crypt-ramfs/passphrase'
<stockholm/krebs/2configs/tor/initrd.nix>
<stockholm/krebs/2configs/binary-cache/nixos.nix>
<stockholm/krebs/2configs/binary-cache/prism.nix>
## news host
<stockholm/krebs/2configs/container-networking.nix>
<stockholm/krebs/2configs/syncthing.nix>
### shackspace ###
# handle the worlddomination map via coap
<stockholm/krebs/2configs/shack/worlddomination.nix>
<stockholm/krebs/2configs/shack/ssh-keys.nix>
# drivedroid.shack for shackphone
<stockholm/krebs/2configs/shack/drivedroid.nix>
# <stockholm/krebs/2configs/shack/nix-cacher.nix>
# Say if muell will be collected
<stockholm/krebs/2configs/shack/muell_caller.nix>
# provide muellshack api: muell.shack
<stockholm/krebs/2configs/shack/muellshack.nix>
# send mail if muell was not handled
<stockholm/krebs/2configs/shack/muell_mail.nix>
# provide light control api
<stockholm/krebs/2configs/shack/node-light.nix> # light.shack lounge.light.shack power.light.shack openhab.shack lightapi.shack
# light.shack web-ui
<stockholm/krebs/2configs/shack/light.shack.nix> #light.shack
# fetch the u300 power stats
<stockholm/krebs/2configs/shack/power/u300-power.nix>
{ # do not log to /var/spool/log
services.nginx.appendHttpConfig = ''
map $request_method $loggable {
default 1;
GET 0;
}
log_format vhost '$host $remote_addr - $remote_user '
'[$time_local] "$request" $status '
'$body_bytes_sent "$http_referer" '
'"$http_user_agent"';
error_log stderr;
access_log syslog:server=unix:/dev/log vhost;
'';
services.journald.rateLimitBurst = 10000;
}
# create samba share for anonymous usage with the laser and 3d printer pc
<stockholm/krebs/2configs/shack/share.nix>
# mobile.lounge.mpd.shack
<stockholm/krebs/2configs/shack/mobile.mpd.nix>
# hass.shack
<stockholm/krebs/2configs/shack/glados>
# connect to git.shackspace.de as group runner for rz
<stockholm/krebs/2configs/shack/gitlab-runner.nix>
# Statistics collection and visualization
# <stockholm/krebs/2configs/shack/graphite.nix> # graphiteApi is broken and unused(hopefully)
## Collect data from mqtt.shack and store in graphite database
<stockholm/krebs/2configs/shack/mqtt_sub.nix>
## Collect radioactive data and put into graphite
<stockholm/krebs/2configs/shack/radioactive.nix>
## mqtt.shack
<stockholm/krebs/2configs/shack/mqtt.nix>
## influx.shack
<stockholm/krebs/2configs/shack/influx.nix>
## Collect local statistics via collectd and send to collectd
# <stockholm/krebs/2configs/stats/shack-client.nix>
# <stockholm/krebs/2configs/stats/shack-debugging.nix>
## netbox.shack: Netbox is disabled as nobody seems to be using it anyway
# <stockholm/krebs/2configs/shack/netbox.nix>
# grafana.shack
<stockholm/krebs/2configs/shack/grafana.nix>
# shackdns.shack
# replacement for leases.shack and shackles.shack
<stockholm/krebs/2configs/shack/shackDNS.nix>
# monitoring: prometheus.shack
<stockholm/krebs/2configs/shack/prometheus/node.nix>
<stockholm/krebs/2configs/shack/prometheus/server.nix>
<stockholm/krebs/2configs/shack/prometheus/blackbox.nix>
#<stockholm/krebs/2configs/shack/prometheus/unifi.nix>
# TODO: alertmanager 0.24+ supports telegram
# <stockholm/krebs/2configs/shack/prometheus/alertmanager-telegram.nix>
];
krebs.build.host = config.krebs.hosts.puyak;
krebs.hosts.puyak.ssh.privkey.path = "${config.krebs.secret.directory}/ssh.id_ed25519";
sound.enable = false;
boot = {
loader.systemd-boot.enable = true;
loader.efi.canTouchEfiVariables = true;
initrd.luks.devices.luksroot.device = "/dev/sda3";
initrd.availableKernelModules = [ "xhci_hcd" "ehci_pci" "ahci" "usb_storage" ];
kernelModules = [ "kvm-intel" ];
extraModprobeConfig = ''
options thinkpad_acpi fan_control=1
'';
};
fileSystems = {
"/" = {
device = "/dev/mapper/pool-root";
fsType = "btrfs";
options = ["defaults" "noatime" "ssd" "compress=lzo"];
};
"/boot" = {
device = "/dev/sda2";
};
"/bku" = {
device = "/dev/mapper/pool-bku";
fsType = "btrfs";
options = ["defaults" "noatime" "ssd" "compress=lzo"];
};
"/home" = {
device = "/dev/mapper/pool-home";
fsType = "btrfs";
options = ["defaults" "noatime" "ssd" "compress=lzo"];
};
"/tmp" = {
device = "tmpfs";
fsType = "tmpfs";
options = ["nosuid" "nodev" "noatime"];
};
};
services.logind.lidSwitch = "ignore";
services.logind.lidSwitchExternalPower = "ignore";
environment.systemPackages = [ pkgs.zsh ];
system.activationScripts."disengage fancontrol" = ''
echo level disengaged > /proc/acpi/ibm/fan
'';
users.users.joerg = {
openssh.authorizedKeys.keys = [ config.krebs.users.mic92.pubkey ];
isNormalUser = true;
shell = "/run/current-system/sw/bin/zsh";
};
system.stateVersion = lib.mkForce "24.05";
}
|
