nixcfg/configuration.nix

129 lines
3.9 KiB
Nix
Raw Normal View History

2021-11-01 21:56:32 +00:00
# Edit this configuration file to define what should be installed on
# your system. Help is available in the configuration.nix(5) man page
# and in the NixOS manual (accessible by running nixos-help).
2021-11-02 10:49:28 +00:00
{ config, pkgs, ... } @ args:
2021-11-01 21:56:32 +00:00
2021-11-02 10:49:28 +00:00
# Configuration local for this cluster node (hostname, IP, etc)
2021-11-01 21:56:32 +00:00
{
imports =
[ # Include the results of the hardware scan.
./hardware-configuration.nix
# Include generic Deuxfleurs module
./deuxfleurs.nix
# Configuration for this deployment (a cluster)
./cluster.nix
2021-11-18 15:40:19 +00:00
# Configuration local for this Deuxfleurs site (set of nodes)
./site.nix
# Configuration local for this cluster node (hostname, IP, etc)
./node.nix
2021-11-01 21:56:32 +00:00
];
# The global useDHCP flag is deprecated, therefore explicitly set to false here.
# Per-interface useDHCP will be mandatory in the future, so this generated config
# replicates the default behaviour.
networking.useDHCP = false;
2021-11-02 09:15:37 +00:00
# networking.wireless.enable = true; # Enables wireless support via wpa_supplicant.
2021-11-01 21:56:32 +00:00
2021-11-16 16:39:23 +00:00
# Networking configuration (static IPs for each node is defined in node/*.nix)
2021-12-26 12:23:01 +00:00
networking.nameservers = [ "9.9.9.9" ];
2021-11-02 16:33:54 +00:00
2021-11-01 21:56:32 +00:00
# Set your time zone.
time.timeZone = "Europe/Paris";
# Select internationalisation properties.
# i18n.defaultLocale = "en_US.UTF-8";
console = {
font = "sun12x22";
keyMap = "fr";
};
# List packages installed in system profile. To search, run:
# $ nix search wget
environment.systemPackages = with pkgs; [
2021-12-26 12:23:01 +00:00
nmap
bind
inetutils
2021-11-01 21:56:32 +00:00
vim
tmux
2021-11-02 16:33:54 +00:00
ncdu
iotop
2021-11-02 19:45:21 +00:00
jnettop
nethogs
2021-11-01 21:56:32 +00:00
wget
htop
links
git
2021-12-30 12:27:39 +00:00
rclone
2021-11-18 15:45:13 +00:00
docker
2021-11-16 16:39:23 +00:00
docker-compose
2021-11-01 21:56:32 +00:00
];
2021-11-02 09:18:03 +00:00
programs.vim.defaultEditor = true;
2021-11-01 21:56:32 +00:00
# Enable network time
services.ntp.enable = true;
2021-12-26 12:23:01 +00:00
# Enable the OpenSSH daemon and disable password login.
2021-11-01 21:56:32 +00:00
services.openssh.enable = true;
2021-12-26 12:23:01 +00:00
services.openssh.passwordAuthentication = false;
# ---- CONFIG FOR DEUXFLEURS CLUSTER ----
2021-11-01 21:56:32 +00:00
2021-12-30 12:27:39 +00:00
# Mount Garage using Rclone
systemd.services.mountgarage = {
2022-01-10 20:36:27 +00:00
enable = false;
2021-12-30 12:27:39 +00:00
description = "Mount the Garage data store";
path = [
pkgs.fuse
pkgs.rclone
];
unitConfig = {
Type = "simple";
};
serviceConfig = {
ExecStartPre = "${pkgs.bash}/bin/sh -c \"mkdir -p /mnt/garage-staging; fusermount -u /mnt/garage-staging || exit 0\"";
ExecStart = "${pkgs.rclone}/bin/rclone --config /root/rclone.conf mount --vfs-cache-mode full --vfs-cache-max-size 1G --cache-dir /root/mountgarage-cache staging: /mnt/garage-staging";
};
wantedBy = [ "multi-user.target" ];
};
2021-11-01 21:56:32 +00:00
# Open ports in the firewall.
2021-12-13 10:30:41 +00:00
networking.firewall = {
2021-12-26 12:23:01 +00:00
enable = true;
# Allow anyone to connect on SSH port
2021-12-13 10:30:41 +00:00
allowedTCPPorts = [
(builtins.head ({ openssh.ports = [22]; } // config.services).openssh.ports)
2021-12-13 10:30:41 +00:00
];
2021-12-26 12:23:01 +00:00
# Allow specific hosts access to specific things in the cluster
2021-12-13 10:30:41 +00:00
extraCommands = ''
# Allow everything from router (usefull for UPnP/IGD)
iptables -A INPUT -s 192.168.1.254 -j ACCEPT
2022-01-19 12:30:18 +00:00
# Allow docker containers to access all ports
iptables -A INPUT -s 172.17.0.0/16 -j ACCEPT
2021-12-26 12:23:01 +00:00
2022-01-19 12:30:18 +00:00
# Allow other nodes on VPN to access all ports
iptables -A INPUT -s 10.42.0.0/16 -j ACCEPT
2021-12-13 10:30:41 +00:00
'';
2021-12-26 12:23:01 +00:00
# When stopping firewall, delete all rules that were configured manually above
2021-12-13 10:30:41 +00:00
extraStopCommands = ''
iptables -D INPUT -s 192.168.1.254 -j ACCEPT
2022-01-19 12:30:18 +00:00
iptables -D INPUT -s 172.17.0.0/16 -j ACCEPT
iptables -D INPUT -s 10.42.0.0/16 -j ACCEPT
2021-12-13 10:30:41 +00:00
'';
};
2021-11-01 21:56:32 +00:00
# This value determines the NixOS release from which the default
# settings for stateful data, like file locations and database versions
# on your system were taken. Its perfectly fine and recommended to leave
# this value at the release version of the first install of this system.
# Before changing this value read the documentation for this option
# (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
system.stateVersion = "21.05"; # Did you read the comment?
}