summaryrefslogtreecommitdiff
path: root/hosts
diff options
context:
space:
mode:
Diffstat (limited to 'hosts')
-rw-r--r--hosts/toaster/amd-new-pstate.nix5
-rw-r--r--hosts/toaster/amd.nix16
-rw-r--r--hosts/toaster/default.nix63
-rw-r--r--hosts/toaster/hardware-configuration.nix94
-rw-r--r--hosts/toaster/irc.nix9
-rw-r--r--hosts/toaster/network-vpns.nix210
-rw-r--r--hosts/toaster/network.nix57
-rw-r--r--hosts/toaster/secrets.nix20
-rw-r--r--hosts/toaster/secure-boot.nix12
-rw-r--r--hosts/toaster/stateful-network.nix39
-rw-r--r--hosts/toaster/zfs.nix19
11 files changed, 0 insertions, 544 deletions
diff --git a/hosts/toaster/amd-new-pstate.nix b/hosts/toaster/amd-new-pstate.nix
deleted file mode 100644
index 179cce3..0000000
--- a/hosts/toaster/amd-new-pstate.nix
+++ /dev/null
@@ -1,5 +0,0 @@
-{ ... }:
-{
- # use new amd pstate driver
- boot.kernelParams = [ "amd_pstate=active" ];
-}
diff --git a/hosts/toaster/amd.nix b/hosts/toaster/amd.nix
deleted file mode 100644
index 07aa493..0000000
--- a/hosts/toaster/amd.nix
+++ /dev/null
@@ -1,16 +0,0 @@
-{ pkgs, config, ... }: {
- boot.initrd.kernelModules = [ "amdgpu" ];
-
- hardware.opengl = {
- driSupport = true;
- driSupport32Bit = true;
- extraPackages = with pkgs; [
- rocm-opencl-icd
- rocm-opencl-runtime
- amdvlk
- ];
- extraPackages32 = with pkgs; [
- driversi686Linux.amdvlk
- ];
- };
-}
diff --git a/hosts/toaster/default.nix b/hosts/toaster/default.nix
deleted file mode 100644
index cac9bad..0000000
--- a/hosts/toaster/default.nix
+++ /dev/null
@@ -1,63 +0,0 @@
-{ pkgs, ... }: {
- imports = [
- ./amd.nix
- ./amd-new-pstate.nix
- ./hardware-configuration.nix
- ./irc.nix
- ./stateful-network.nix
- ./secrets.nix
- ./secure-boot.nix
- ./zfs.nix
- ];
-
- nixpkgs.config.allowUnfree = true;
-
- # Use the systemd-boot EFI boot loader.
- boot.loader.systemd-boot.enable = true;
- boot.loader.efi.canTouchEfiVariables = true;
- hardware.enableAllFirmware = true;
-
- # update the firmware
- services.fwupd.enable = true;
-
- # Set your time zone.
- time.timeZone = "Europe/Amsterdam";
-
- # Select internationalisation properties.
- i18n = {
- defaultLocale = "en_US.UTF-8";
- supportedLocales = [ "all" ];
- };
-
- users.users.grue = {
- extraGroups = [
- "wheel"
- "video"
- "plugdev"
- "dialout"
- "bluetooth"
- "libvirtd"
- ];
- group = "users";
- home = "/home/grue";
- isNormalUser = true;
- uid = 1000;
- };
-
- programs.steam.enable = true;
-
- environment.systemPackages = with pkgs; [
- factorio
- ];
-
- services.emacs.defaultEditor = false;
-
- # This value determines the NixOS release from which the default
- # settings for stateful data, like file locations and database versions
- # on your system were taken. It‘s perfectly fine and recommended to leave
- # this value at the release version of the first install of this system.
- # Before changing this value read the documentation for this option
- # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
- system.stateVersion = "23.05"; # Did you read the comment?
-
-}
diff --git a/hosts/toaster/hardware-configuration.nix b/hosts/toaster/hardware-configuration.nix
deleted file mode 100644
index 7e3b087..0000000
--- a/hosts/toaster/hardware-configuration.nix
+++ /dev/null
@@ -1,94 +0,0 @@
-# Do not modify this file! It was generated by ‘nixos-generate-config’
-# and may be overwritten by future invocations. Please make changes
-# to /etc/nixos/configuration.nix instead.
-{ config, lib, pkgs, modulesPath, ... }:
-
-{
- imports =
- [
- (modulesPath + "/installer/scan/not-detected.nix")
- ];
-
- boot.initrd.availableKernelModules = [ "nvme" "xhci_pci" "usb_storage" "sd_mod" ];
- boot.initrd.kernelModules = [ ];
- boot.kernelModules = [ "kvm-amd" ];
- boot.extraModulePackages = [ ];
-
- fileSystems."/" =
- {
- device = "toasterpool/nixos/root";
- fsType = "zfs";
- options = [ "zfsutil" ];
- };
-
- fileSystems."/nix" =
- {
- device = "toasterpool/nixos/nix";
- fsType = "zfs";
- options = [ "zfsutil" ];
- };
-
- fileSystems."/var" =
- {
- device = "toasterpool/userdata/var";
- fsType = "zfs";
- options = [ "zfsutil" ];
- };
-
- fileSystems."/var/lib" =
- {
- device = "toasterpool/userdata/var/lib";
- fsType = "zfs";
- options = [ "zfsutil" ];
- };
-
- fileSystems."/var/log" =
- {
- device = "toasterpool/userdata/var/log";
- fsType = "zfs";
- options = [ "zfsutil" ];
- };
-
- fileSystems."/home" =
- {
- device = "toasterpool/userdata/home";
- fsType = "zfs";
- options = [ "zfsutil" ];
- };
-
- fileSystems."/home/grue" =
- {
- device = "toasterpool/userdata/home/grue";
- fsType = "zfs";
- options = [ "zfsutil" ];
- };
-
- fileSystems."/boot" =
- {
- device = "/dev/disk/by-uuid/7663-6239";
- fsType = "vfat";
- options = [ "X-mount.mkdir" ];
- };
-
- swapDevices = [
- {
- device = "/dev/disk/by-id/nvme-eui.ace42e002621ff2b2ee4ac0000000001-part2";
- randomEncryption = true;
- }
- ];
-
- # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
- # (the default) this is the recommended approach. When using systemd-networkd it's
- # still possible to use this option, but it's recommended to use it in conjunction
- # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
- networking.useDHCP = lib.mkDefault true;
-
- networking.interfaces.enp1s0f0.useDHCP = lib.mkDefault true;
- #networking.interfaces.wlp2s0.useDHCP = lib.mkDefault true;
- networking.interfaces.wlan0.useDHCP = lib.mkDefault true;
-
- nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
- hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
-
- # services.fprintd.enable = true;
-}
diff --git a/hosts/toaster/irc.nix b/hosts/toaster/irc.nix
deleted file mode 100644
index 85398ab..0000000
--- a/hosts/toaster/irc.nix
+++ /dev/null
@@ -1,9 +0,0 @@
-{ config, pkgs, ... }: {
- environment.systemPackages = [ pkgs.senpai ];
-
- sops.secrets = {
- "irc/senpai" = {
- owner = config.users.users.grue.name;
- };
- };
-}
diff --git a/hosts/toaster/network-vpns.nix b/hosts/toaster/network-vpns.nix
deleted file mode 100644
index 888d8bb..0000000
--- a/hosts/toaster/network-vpns.nix
+++ /dev/null
@@ -1,210 +0,0 @@
-{ config, ... }: {
-
- systemd.network = {
- # Wireguard
- # Dump-dvb
- netdevs."30-wg-dumpdvb" = {
- netdevConfig = {
- Kind = "wireguard";
- Name = "wg-dumpdvb";
- Description = "dvb.solutions enterprise network";
- };
- wireguardConfig = {
- PrivateKeyFile = config.sops.secrets."wg/dvb".path;
- };
- wireguardPeers = [
- {
- wireguardPeerConfig = {
- PublicKey = "WDvCObJ0WgCCZ0ORV2q4sdXblBd8pOPZBmeWr97yphY=";
- Endpoint = "academicstrokes.com:51820";
- AllowedIPs = [ "10.13.37.0/24" ];
- PersistentKeepalive = 25;
- };
- }
- ];
- };
- networks."30-wg-dumpdvb" = {
- matchConfig.Name = "wg-dumpdvb";
- networkConfig = {
- Address = "10.13.37.3/24";
- IPv6AcceptRA = true;
- };
- routes = [
- { routeConfig = { Gateway = "10.13.37.1"; Destination = "10.13.37.0/24"; }; }
- ];
- };
-
- # oxalab
- netdevs."10-wg-oxalab" = {
- netdevConfig = {
- Kind = "wireguard";
- Name = "wg-oxalab";
- Description = "lab of oxa";
- };
- wireguardConfig = {
- PrivateKeyFile = config.sops.secrets."wg/oxalab".path;
- };
- wireguardPeers = [
- {
- wireguardPeerConfig = {
- PublicKey = "5nCVC21BL+1r70OGwA4Q6Z/gcPLC3+ZF8sTurdn7N0E=";
- Endpoint = "95.216.166.21:51820";
- AllowedIPs = [ "10.66.66.0/24" ];
- PersistentKeepalive = 25;
- };
- }
- ];
- };
- networks."10-wg-oxalab" = {
- matchConfig.Name = "wg-oxalab";
- networkConfig = {
- Address = "10.66.66.10/24";
- IPv6AcceptRA = true;
- };
- routes = [
- { routeConfig = { Gateway = "10.66.66.1"; Destination = "10.66.66.1/24"; }; }
- ];
- };
-
-
- # zentralwerk
- netdevs."10-wg-zentralwerk" = {
- netdevConfig = {
- Kind = "wireguard";
- Name = "wg-zentralwerk";
- Description = "Tunnel to the best basement in Dresden";
- };
- wireguardConfig = {
- PrivateKeyFile = config.sops.secrets."wg/zw".path;
- RouteTable = "off";
- };
- wireguardPeers = [
- {
- wireguardPeerConfig = {
- PublicKey = "PG2VD0EB+Oi+U5/uVMUdO5MFzn59fAck6hz8GUyLMRo=";
- Endpoint = "81.201.149.152:1337";
- AllowedIPs = [ "172.20.72.0/21" "172.22.90.0/24" "172.22.99.0/24" ];
- PersistentKeepalive = 25;
- };
- }
- ];
- };
- networks."10-wg-zentralwerk" = {
- matchConfig.Name = "wg-zentralwerk";
- networkConfig = {
- Address = "172.20.76.226/21";
- IPv6AcceptRA = true;
- DNS = "172.20.73.8";
- Domains = [
- "~hq.c3d2.de"
- "~serv.zentralwerk.org"
- "~hq.zentralwerk.org"
- "~cluster.zentralwerk.org"
- ];
- };
- routes = [
- {
- routeConfig = {
- Gateway = "172.20.76.225";
- Destination = "172.20.72.0/21";
- Metric = 1023;
- };
- }
- {
- routeConfig = {
- Gateway = "172.20.76.225";
- Destination = "172.20.90.0/24";
- Metric = 1023;
- };
- }
- {
- routeConfig = {
- Gateway = "172.20.76.225";
- Destination = "172.22.99.0/24";
- Metric = 1023;
- };
- }
-
- ];
- };
-
- # VPN
- netdevs."10-wg-mullvad" = {
- netdevConfig = {
- Kind = "wireguard";
- Name = "wg-mullvad";
- };
- wireguardConfig = {
- PrivateKeyFile = config.sops.secrets."wg/mullvad".path;
- FirewallMark = 34952; # 0x8888
- RouteTable = "off";
- };
- wireguardPeers = [
- {
- wireguardPeerConfig = {
- PublicKey = "BChJDLOwZu9Q1oH0UcrxcHP6xxHhyRbjrBUsE0e07Vk=";
- Endpoint = "169.150.196.15:51820";
- AllowedIPs = [ "0.0.0.0/0" "::0/0" ];
- };
- }
- ];
- };
- networks."10-wg-mullvad" = {
- matchConfig.Name = "wg-mullvad";
- address = [ "10.66.157.228/32" "fc00:bbbb:bbbb:bb01::3:9de3/128" ];
- networkConfig = {
- DNS = "10.64.0.1";
- DNSDefaultRoute = true;
- Domains = [ "~." ];
- };
- routes = map
- (gate: {
- routeConfig = {
- Gateway = gate;
- Table = 1000;
- };
- }) [
- "0.0.0.0"
- "::"
- ];
-
- routingPolicyRules = [
- {
- routingPolicyRuleConfig = {
- Family = "both";
- FirewallMark = 34952; # 0x8888
- InvertRule = true;
- Table = "1000";
- Priority = 100;
- };
- }
- {
- routingPolicyRuleConfig = {
- Family = "both";
- SuppressPrefixLength = 0;
- Table = "main";
- Priority = 90;
- };
- }
- ] ++ map
- (net: {
- # only route global addresses over VPN
- routingPolicyRuleConfig = {
- Priority = 80;
- To = net;
- };
- }) [
- # Mullvad endpoint
- "169.150.196.15/32"
- # "10.0.0.0/8"
- "10.13.37.0/24"
- "10.66.66.0/24"
- # "172.16.0.0/12"
- "172.16.0.0/12"
- # "182.168.0.0/16"
- "182.168.0.0/16"
- # "fc00::/7"
- ];
- };
- };
-}
diff --git a/hosts/toaster/network.nix b/hosts/toaster/network.nix
deleted file mode 100644
index 26def6b..0000000
--- a/hosts/toaster/network.nix
+++ /dev/null
@@ -1,57 +0,0 @@
-{ config, pkgs, ... }: {
- environment.systemPackages = with pkgs; [ iwgtk ];
-
- networking = {
- hostName = "toaster";
- firewall.enable = true;
- networkmanager.enable = false;
- useNetworkd = true;
- wireguard.enable = true;
- wireless.iwd.enable = true;
- };
-
- services.resolved = {
- enable = true;
- dnssec = "allow-downgrade";
- fallbackDns = [
- "9.9.9.9"
- "2620:fe::fe"
- "149.112.112.112"
- "2620:fe::9"
- ];
- };
-
- # workaround for networkd waiting for shit
- systemd.services.systemd-networkd-wait-online.serviceConfig.ExecStart = [
- "" # clear old command
- "${config.systemd.package}/lib/systemd/systemd-networkd-wait-online --any"
- ];
-
- systemd.network = {
- enable = true;
-
- networks."10-ether" = {
- matchConfig.MACAddress = "e8:80:88:2f:c6:70";
- networkConfig = {
- DHCP = "yes";
- IPv6AcceptRA = true;
- };
- };
- networks."10-dock" = {
- matchConfig.Name = "enp5s0f4u1u1";
- networkConfig = {
- DHCP = "yes";
- IPv6AcceptRA = true;
- };
- dhcpV4Config = { RouteMetric = 666; };
- };
- networks."10-wlan" = {
- # matchConfig.MACAddress = "04:7b:cb:2a:aa:8c";
- matchConfig.Name = "wlan0";
- networkConfig = {
- DHCP = "yes";
- IPv6AcceptRA = true;
- };
- };
- };
-}
diff --git a/hosts/toaster/secrets.nix b/hosts/toaster/secrets.nix
deleted file mode 100644
index 4cf23d7..0000000
--- a/hosts/toaster/secrets.nix
+++ /dev/null
@@ -1,20 +0,0 @@
-{ config, ... }:
-{
- sops.defaultSopsFile = ../../secrets/toaster/secrets.yaml;
- sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
-
- sops.secrets = {
- "wg/zw" = {
- owner = config.users.users.systemd-network.name;
- };
- "wg/dvb" = {
- owner = config.users.users.systemd-network.name;
- };
- "wg/mullvad" = {
- owner = config.users.users.systemd-network.name;
- };
- "wg/oxalab" = {
- owner = config.users.users.systemd-network.name;
- };
- };
-}
diff --git a/hosts/toaster/secure-boot.nix b/hosts/toaster/secure-boot.nix
deleted file mode 100644
index d18e1cb..0000000
--- a/hosts/toaster/secure-boot.nix
+++ /dev/null
@@ -1,12 +0,0 @@
-{ pkgs, lib, ... }: {
- boot = {
- bootspec.enable = true;
- loader.systemd-boot.enable = lib.mkForce false;
- lanzaboote = {
- enable = true;
- pkiBundle = "/etc/secureboot";
- };
- };
-
- environment.systemPackages = [ pkgs.sbctl ];
-}
diff --git a/hosts/toaster/stateful-network.nix b/hosts/toaster/stateful-network.nix
deleted file mode 100644
index 2bb0e04..0000000
--- a/hosts/toaster/stateful-network.nix
+++ /dev/null
@@ -1,39 +0,0 @@
-{ pkgs, ... }: {
- users.users.grue.extraGroups = [ "networkmanager" ];
-
- networking = {
- hostName = "toaster";
- firewall.enable = true;
- wireguard.enable = true;
- };
-
- services.resolved = {
- enable = true;
- dnssec = "allow-downgrade";
- fallbackDns = [
- "9.9.9.9"
- "2620:fe::fe"
- "149.112.112.112"
- "2620:fe::9"
- ];
- };
-
- # fixup the rpfilter fucking up the networkmanager wireguard
- networking.firewall = {
- # if packets are still dropped, they will show up in dmesg
- logReversePathDrops = true;
- # wireguard trips rpfilter up
- extraCommands = ''
- ip46tables -t mangle -I nixos-fw-rpfilter -p udp -m udp --sport 51820 -j RETURN
- ip46tables -t mangle -I nixos-fw-rpfilter -p udp -m udp --dport 51820 -j RETURN
- ip46tables -t mangle -I nixos-fw-rpfilter -p udp -m udp --sport 1337 -j RETURN
- ip46tables -t mangle -I nixos-fw-rpfilter -p udp -m udp --dport 1337 -j RETURN
- '';
- extraStopCommands = ''
- ip46tables -t mangle -D nixos-fw-rpfilter -p udp -m udp --sport 51820 -j RETURN || true
- ip46tables -t mangle -D nixos-fw-rpfilter -p udp -m udp --dport 51820 -j RETURN || true
- ip46tables -t mangle -D nixos-fw-rpfilter -p udp -m udp --sport 1337 -j RETURN || true
- ip46tables -t mangle -D nixos-fw-rpfilter -p udp -m udp --dport 1337 -j RETURN || true
- '';
- };
-}
diff --git a/hosts/toaster/zfs.nix b/hosts/toaster/zfs.nix
deleted file mode 100644
index f4bdeea..0000000
--- a/hosts/toaster/zfs.nix
+++ /dev/null
@@ -1,19 +0,0 @@
-{ pkgs, ... }: {
- services.fstrim.enable = true;
- services.zfs = {
- autoSnapshot.enable = true;
- trim.enable = true;
- autoScrub = {
- enable = true;
- pools = [ "toasterpool" ];
- };
- };
- networking.hostId = "dca22577";
- boot = {
- kernelPackages = pkgs.zfs.latestCompatibleLinuxPackages;
- supportedFilesystems = [ "zfs" ];
- kernelParams = [ "nohibernate" ];
- plymouth.enable = false;
- tmp.useTmpfs = true;
- };
-}
generated by cgit v1.3.1 (git 2.54.0) at 2026-07-28 02:09:20 +0000