summaryrefslogtreecommitdiff
path: root/hosts/toaster
diff options
context:
space:
mode:
Diffstat (limited to 'hosts/toaster')
-rw-r--r--hosts/toaster/amd.nix23
-rw-r--r--hosts/toaster/default.nix3
-rw-r--r--hosts/toaster/hardware-configuration.nix94
-rw-r--r--hosts/toaster/irc.nix3
-rw-r--r--hosts/toaster/network/default.nix49
-rw-r--r--hosts/toaster/network/dumpdvb.nix8
-rw-r--r--hosts/toaster/network/mullvad.nix99
-rw-r--r--hosts/toaster/network/oxalab.nix0
-rw-r--r--hosts/toaster/network/zw.nix107
-rw-r--r--hosts/toaster/secure-boot.nix3
-rw-r--r--hosts/toaster/zfs.nix36
11 files changed, 240 insertions, 185 deletions
diff --git a/hosts/toaster/amd.nix b/hosts/toaster/amd.nix
index 01eb155..66a93e6 100644
--- a/hosts/toaster/amd.nix
+++ b/hosts/toaster/amd.nix
@@ -1,4 +1,5 @@
-{ pkgs, config, ... }: {
+{ pkgs, config, ... }:
+{
boot.initrd.kernelModules = [ "amdgpu" ];
boot.kernelParams = [
@@ -6,14 +7,14 @@
"amd_pstate=active"
];
- # hardware.graphics = {
- # extraPackages = with pkgs; [
- # rocm-opencl-icd
- # rocm-opencl-runtime
- # amdvlk
- # ];
- # extraPackages32 = with pkgs; [
- # driversi686Linux.amdvlk
- # ];
- # };
+ # hardware.graphics = {
+ # extraPackages = with pkgs; [
+ # rocm-opencl-icd
+ # rocm-opencl-runtime
+ # amdvlk
+ # ];
+ # extraPackages32 = with pkgs; [
+ # driversi686Linux.amdvlk
+ # ];
+ # };
}
diff --git a/hosts/toaster/default.nix b/hosts/toaster/default.nix
index 860b582..c3b087d 100644
--- a/hosts/toaster/default.nix
+++ b/hosts/toaster/default.nix
@@ -1,4 +1,5 @@
-{ pkgs, ... }: {
+{ pkgs, ... }:
+{
imports = [
./amd.nix
./hardware-configuration.nix
diff --git a/hosts/toaster/hardware-configuration.nix b/hosts/toaster/hardware-configuration.nix
index 6a12195..69ebb66 100644
--- a/hosts/toaster/hardware-configuration.nix
+++ b/hosts/toaster/hardware-configuration.nix
@@ -1,54 +1,70 @@
# Do not modify this file! It was generated by ‘nixos-generate-config’
# and may be overwritten by future invocations. Please make changes
# to /etc/nixos/configuration.nix instead.
-{ config, lib, pkgs, modulesPath, ... }:
-
{
- imports =
- [
- (modulesPath + "/installer/scan/not-detected.nix")
- ];
+ config,
+ lib,
+ pkgs,
+ modulesPath,
+ ...
+}:
- boot.initrd.availableKernelModules = [ "nvme" "xhci_pci" "usb_storage" "usbhid" "sd_mod" ];
- boot.initrd.kernelModules = [ ];
- boot.kernelModules = [ "kvm-amd" ];
- boot.extraModulePackages = [ ];
- boot.zfs.extraPools = [ "zpool" ];
+{
+ imports = [
+ (modulesPath + "/installer/scan/not-detected.nix")
+ ];
- fileSystems."/" =
- { device = "zpool/root";
- fsType = "zfs";
- options = [ "zfsutil" ];
- };
+ boot.initrd.availableKernelModules = [
+ "nvme"
+ "xhci_pci"
+ "usb_storage"
+ "usbhid"
+ "sd_mod"
+ ];
+ boot.initrd.kernelModules = [ ];
+ boot.kernelModules = [ "kvm-amd" ];
+ boot.extraModulePackages = [ ];
+ boot.zfs.extraPools = [ "zpool" ];
- fileSystems."/nix" =
- { device = "zpool/nix";
- fsType = "zfs";
- options = [ "zfsutil" ];
- };
+ fileSystems."/" = {
+ device = "zpool/root";
+ fsType = "zfs";
+ options = [ "zfsutil" ];
+ };
- fileSystems."/home" =
- { device = "zpool/data/home";
- fsType = "zfs";
- options = [ "zfsutil" ];
- };
+ fileSystems."/nix" = {
+ device = "zpool/nix";
+ fsType = "zfs";
+ options = [ "zfsutil" ];
+ };
- fileSystems."/var" =
- { device = "zpool/data/var";
- fsType = "zfs";
- options = [ "zfsutil" ];
- };
+ fileSystems."/home" = {
+ device = "zpool/data/home";
+ fsType = "zfs";
+ options = [ "zfsutil" ];
+ };
- fileSystems."/boot" =
- { device = "/dev/disk/by-uuid/A170-F83D";
- fsType = "vfat";
- options = [ "fmask=0022" "dmask=0022" ];
- };
+ fileSystems."/var" = {
+ device = "zpool/data/var";
+ fsType = "zfs";
+ options = [ "zfsutil" ];
+ };
- swapDevices =
- [ { device = "/dev/disk/by-partuuid/037518f2-9fa0-44f0-9550-745e27bf1c1f";
- randomEncryption = true;}
+ fileSystems."/boot" = {
+ device = "/dev/disk/by-uuid/A170-F83D";
+ fsType = "vfat";
+ options = [
+ "fmask=0022"
+ "dmask=0022"
];
+ };
+
+ swapDevices = [
+ {
+ device = "/dev/disk/by-partuuid/037518f2-9fa0-44f0-9550-745e27bf1c1f";
+ randomEncryption = true;
+ }
+ ];
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
# (the default) this is the recommended approach. When using systemd-networkd it's
diff --git a/hosts/toaster/irc.nix b/hosts/toaster/irc.nix
index 85398ab..938fac3 100644
--- a/hosts/toaster/irc.nix
+++ b/hosts/toaster/irc.nix
@@ -1,4 +1,5 @@
-{ config, pkgs, ... }: {
+{ config, pkgs, ... }:
+{
environment.systemPackages = [ pkgs.senpai ];
sops.secrets = {
diff --git a/hosts/toaster/network/default.nix b/hosts/toaster/network/default.nix
index e633342..6d96c3c 100644
--- a/hosts/toaster/network/default.nix
+++ b/hosts/toaster/network/default.nix
@@ -1,4 +1,5 @@
-{ lib, config, ... }: {
+{ lib, config, ... }:
+{
imports = [
./mullvad.nix
./dumpdvb.nix
@@ -8,32 +9,34 @@
# Networkmanager shouldn't interfere with systemd managed interfaces
networking.networkmanager.unmanaged =
let
- systemd_netdevs = lib.attrsets.attrValues (lib.attrsets.mapAttrs (_name: value: value.netdevConfig.Name) config.systemd.network.netdevs);
+ systemd_netdevs = lib.attrsets.attrValues (
+ lib.attrsets.mapAttrs (_name: value: value.netdevConfig.Name) config.systemd.network.netdevs
+ );
in
systemd_netdevs;
- systemd.network = {
- enable = true;
- wait-online.enable = false; # uplink is managed by networkmanager
- };
+ systemd.network = {
+ enable = true;
+ wait-online.enable = false; # uplink is managed by networkmanager
+ };
- users.users."0xa".extraGroups = [ "networkmanager" ];
+ users.users."0xa".extraGroups = [ "networkmanager" ];
- networking = {
- hostName = "toaster";
- firewall.enable = true;
- wireguard.enable = true;
- };
+ networking = {
+ hostName = "toaster";
+ firewall.enable = true;
+ wireguard.enable = true;
+ };
- services.resolved = {
- enable = true;
- dnssec = "false";
- fallbackDns = [
- "9.9.9.9"
- "2620:fe::fe"
- "149.112.112.112"
- "2620:fe::9"
- ];
- };
+ services.resolved = {
+ enable = true;
+ dnssec = "false";
+ fallbackDns = [
+ "9.9.9.9"
+ "2620:fe::fe"
+ "149.112.112.112"
+ "2620:fe::9"
+ ];
+ };
- }
+}
diff --git a/hosts/toaster/network/dumpdvb.nix b/hosts/toaster/network/dumpdvb.nix
index 84074bd..d3fba93 100644
--- a/hosts/toaster/network/dumpdvb.nix
+++ b/hosts/toaster/network/dumpdvb.nix
@@ -1,4 +1,5 @@
-{ config, ... }: {
+{ config, ... }:
+{
systemd.network = {
# Wireguard
# Dump-dvb
@@ -27,7 +28,10 @@
IPv6AcceptRA = true;
};
routes = [
- { Gateway = "10.13.37.1"; Destination = "10.13.37.0/24"; }
+ {
+ Gateway = "10.13.37.1";
+ Destination = "10.13.37.0/24";
+ }
];
};
};
diff --git a/hosts/toaster/network/mullvad.nix b/hosts/toaster/network/mullvad.nix
index 8ad71b7..a3bfaec 100644
--- a/hosts/toaster/network/mullvad.nix
+++ b/hosts/toaster/network/mullvad.nix
@@ -1,10 +1,14 @@
-{ config, lib, ... }: {
+{ config, lib, ... }:
+{
systemd.network =
let
- pubkey = "BChJDLOwZu9Q1oH0UcrxcHP6xxHhyRbjrBUsE0e07Vk=";
+ pubkey = "BChJDLOwZu9Q1oH0UcrxcHP6xxHhyRbjrBUsE0e07Vk=";
endpoint = "169.150.196.15";
port = "51820";
- addr = [ "10.74.16.48/32" "fc00:bbbb:bbbb:bb01::b:102f/128" ];
+ addr = [
+ "10.74.16.48/32"
+ "fc00:bbbb:bbbb:bb01::b:102f/128"
+ ];
in
{
netdevs."10-wg-mullvad" = {
@@ -21,7 +25,10 @@
{
PublicKey = pubkey;
Endpoint = "${endpoint}:${port}";
- AllowedIPs = [ "0.0.0.0/0" "::0/0" ];
+ AllowedIPs = [
+ "0.0.0.0/0"
+ "::0/0"
+ ];
}
];
};
@@ -33,44 +40,52 @@
DNSDefaultRoute = true;
Domains = [ "~." ];
};
- routes = map
- (gate: {
- Gateway = gate;
- Table = 1000;
- }) [
- "0.0.0.0"
- "::"
- ];
+ routes =
+ map
+ (gate: {
+ Gateway = gate;
+ Table = 1000;
+ })
+ [
+ "0.0.0.0"
+ "::"
+ ];
- routingPolicyRules = [ {
- Family = "both";
- FirewallMark = 34952; # 0x8888
- InvertRule = true;
- Table = "1000";
- Priority = 100;
- }
- {
- Family = "both";
- SuppressPrefixLength = 0;
- Table = "main";
- Priority = 90;
- } ] ++ map (net: {
- # only route global addresses over VPN
- Priority = 80;
- To = net;
- }) [
- # Mullvad endpoint
- "${endpoint}/32"
- # "10.0.0.0/8"
- "10.13.37.0/24"
- # 0xa-mgmt
- "10.89.87.0/24"
- # "172.16.0.0/12"
- "172.16.0.0/12"
- # "182.168.0.0/16"
- "182.168.0.0/16"
- # "fc00::/7"
- ];
+ routingPolicyRules =
+ [
+ {
+ Family = "both";
+ FirewallMark = 34952; # 0x8888
+ InvertRule = true;
+ Table = "1000";
+ Priority = 100;
+ }
+ {
+ Family = "both";
+ SuppressPrefixLength = 0;
+ Table = "main";
+ Priority = 90;
+ }
+ ]
+ ++ map
+ (net: {
+ # only route global addresses over VPN
+ Priority = 80;
+ To = net;
+ })
+ [
+ # Mullvad endpoint
+ "${endpoint}/32"
+ # "10.0.0.0/8"
+ "10.13.37.0/24"
+ # 0xa-mgmt
+ "10.89.87.0/24"
+ # "172.16.0.0/12"
+ "172.16.0.0/12"
+ # "182.168.0.0/16"
+ "182.168.0.0/16"
+ # "fc00::/7"
+ ];
+ };
};
- };
}
diff --git a/hosts/toaster/network/oxalab.nix b/hosts/toaster/network/oxalab.nix
deleted file mode 100644
index e69de29..0000000
--- a/hosts/toaster/network/oxalab.nix
+++ /dev/null
diff --git a/hosts/toaster/network/zw.nix b/hosts/toaster/network/zw.nix
index af961be..71e75be 100644
--- a/hosts/toaster/network/zw.nix
+++ b/hosts/toaster/network/zw.nix
@@ -1,56 +1,61 @@
-{ config, ... }: {
- # zentralwerk
- systemd.network = {
- netdevs."10-wg-zentralwerk" = {
- netdevConfig = {
- Kind = "wireguard";
- Name = "wg-zentralwerk";
- Description = "Tunnel to the best basement in Dresden";
- };
- wireguardConfig = {
- PrivateKeyFile = config.sops.secrets."wg/zw".path;
- RouteTable = "off";
- };
- wireguardPeers = [
- {
- PublicKey = "PG2VD0EB+Oi+U5/uVMUdO5MFzn59fAck6hz8GUyLMRo=";
- Endpoint = "81.201.149.152:1337";
- AllowedIPs = [ "172.20.72.0/21" "172.22.90.0/24" "172.22.99.0/24" ];
- PersistentKeepalive = 25;
- }
- ];
+{ config, ... }:
+{
+ # zentralwerk
+ systemd.network = {
+ netdevs."10-wg-zentralwerk" = {
+ netdevConfig = {
+ Kind = "wireguard";
+ Name = "wg-zentralwerk";
+ Description = "Tunnel to the best basement in Dresden";
+ };
+ wireguardConfig = {
+ PrivateKeyFile = config.sops.secrets."wg/zw".path;
+ RouteTable = "off";
};
- networks."10-wg-zentralwerk" = {
- matchConfig.Name = "wg-zentralwerk";
- networkConfig = {
- Address = "172.20.76.226/21";
- IPv6AcceptRA = true;
- DNS = "172.20.73.8";
- Domains = [
- "~hq.c3d2.de"
- "~serv.zentralwerk.org"
- "~hq.zentralwerk.org"
- "~cluster.zentralwerk.org"
+ wireguardPeers = [
+ {
+ PublicKey = "PG2VD0EB+Oi+U5/uVMUdO5MFzn59fAck6hz8GUyLMRo=";
+ Endpoint = "81.201.149.152:1337";
+ AllowedIPs = [
+ "172.20.72.0/21"
+ "172.22.90.0/24"
+ "172.22.99.0/24"
];
- };
- routes = [
- {
- Gateway = "172.20.76.225";
- Destination = "172.20.72.0/21";
- Metric = 1023;
- }
- {
- Gateway = "172.20.76.225";
- Destination = "172.20.90.0/24";
- Metric = 1023;
- }
- {
- Gateway = "172.20.76.225";
- Destination = "172.22.99.0/24";
- Metric = 1023;
- }
-
+ PersistentKeepalive = 25;
+ }
+ ];
+ };
+ networks."10-wg-zentralwerk" = {
+ matchConfig.Name = "wg-zentralwerk";
+ networkConfig = {
+ Address = "172.20.76.226/21";
+ IPv6AcceptRA = true;
+ DNS = "172.20.73.8";
+ Domains = [
+ "~hq.c3d2.de"
+ "~serv.zentralwerk.org"
+ "~hq.zentralwerk.org"
+ "~cluster.zentralwerk.org"
];
};
+ routes = [
+ {
+ Gateway = "172.20.76.225";
+ Destination = "172.20.72.0/21";
+ Metric = 1023;
+ }
+ {
+ Gateway = "172.20.76.225";
+ Destination = "172.20.90.0/24";
+ Metric = 1023;
+ }
+ {
+ Gateway = "172.20.76.225";
+ Destination = "172.22.99.0/24";
+ Metric = 1023;
+ }
+
+ ];
};
- }
+ };
+}
diff --git a/hosts/toaster/secure-boot.nix b/hosts/toaster/secure-boot.nix
index 23424af..9d934e1 100644
--- a/hosts/toaster/secure-boot.nix
+++ b/hosts/toaster/secure-boot.nix
@@ -1,4 +1,5 @@
-{ pkgs, lib, ... }: {
+{ pkgs, lib, ... }:
+{
boot = {
bootspec.enable = true;
loader.systemd-boot.enable = lib.mkForce false;
diff --git a/hosts/toaster/zfs.nix b/hosts/toaster/zfs.nix
index 9a8b5aa..606627d 100644
--- a/hosts/toaster/zfs.nix
+++ b/hosts/toaster/zfs.nix
@@ -1,4 +1,10 @@
-{ pkgs, lib, config, ... }: {
+{
+ pkgs,
+ lib,
+ config,
+ ...
+}:
+{
services.fstrim.enable = true;
services.zfs = {
autoSnapshot.enable = true;
@@ -10,19 +16,21 @@
};
networking.hostId = "dca22577";
boot = {
- kernelPackages = let
- zfsCompatibleKernelPackages = lib.filterAttrs (
- name: kernelPackages:
- (builtins.match "linux_[0-9]+_[0-9]+" name) != null
- && (builtins.tryEval kernelPackages).success
- && (!kernelPackages.${config.boot.zfs.package.kernelModuleAttribute}.meta.broken)
- ) pkgs.linuxKernel.packages;
- latestKernelPackage = lib.last (
- lib.sort (a: b: (lib.versionOlder a.kernel.version b.kernel.version)) (
- builtins.attrValues zfsCompatibleKernelPackages
- )
- );
-in latestKernelPackage;
+ kernelPackages =
+ let
+ zfsCompatibleKernelPackages = lib.filterAttrs (
+ name: kernelPackages:
+ (builtins.match "linux_[0-9]+_[0-9]+" name) != null
+ && (builtins.tryEval kernelPackages).success
+ && (!kernelPackages.${config.boot.zfs.package.kernelModuleAttribute}.meta.broken)
+ ) pkgs.linuxKernel.packages;
+ latestKernelPackage = lib.last (
+ lib.sort (a: b: (lib.versionOlder a.kernel.version b.kernel.version)) (
+ builtins.attrValues zfsCompatibleKernelPackages
+ )
+ );
+ in
+ latestKernelPackage;
supportedFilesystems = [ "zfs" ];
kernelParams = [ "nohibernate" ];
plymouth.enable = false;
generated by cgit v1.3.1 (git 2.54.0) at 2026-07-28 15:31:18 +0000