216 lines
5.1 KiB
Nix
Executable File
216 lines
5.1 KiB
Nix
Executable File
# Edit this configuration file to define what should be installed on
|
|
# your system. Help is available in the configuration.nix(5) man page, on
|
|
# https://search.nixos.org/options and in the NixOS manual (`nixos-help`).
|
|
|
|
{
|
|
config,
|
|
pkgs,
|
|
namespace,
|
|
...
|
|
}:
|
|
{
|
|
imports = [
|
|
# Include the results of the hardware scan.
|
|
./hardware-configuration.nix
|
|
./filesystems.nix
|
|
./boot.nix
|
|
./apps.nix
|
|
./grafana.nix
|
|
# ./networking.nix - moved to modules/nixos/network
|
|
./ups.nix
|
|
./users.nix
|
|
./samba.nix
|
|
./services.nix
|
|
./sops.nix
|
|
];
|
|
|
|
services.kmscon.enable = true;
|
|
|
|
powerManagement.cpuFreqGovernor = "powersave";
|
|
|
|
${namespace} = {
|
|
bootloader.lanzaboote.enable = true;
|
|
desktop.cosmic.enable = false;
|
|
development = {
|
|
enable = true;
|
|
includeLanguages = [
|
|
"python"
|
|
"c"
|
|
];
|
|
includeContainers = true;
|
|
};
|
|
monitoring.enable = true;
|
|
hardware.nvidia = {
|
|
enable = true;
|
|
enableBeta = true;
|
|
enableOpen = true;
|
|
nvidiaSettings = true;
|
|
enableNvidiaDocker = true;
|
|
};
|
|
network = {
|
|
hostName = "jallen-nas";
|
|
ipv4 = {
|
|
address = "10.0.1.3/24";
|
|
method = "manual";
|
|
gateway = "10.0.1.1";
|
|
interface = "wlp6s0";
|
|
};
|
|
useNetworkd = true;
|
|
hostId = "4b501480";
|
|
nat = {
|
|
enable = true;
|
|
internalInterfaces = [ "ve-+" ];
|
|
externalInterface = "wlp6s0";
|
|
enableIPv6 = true;
|
|
};
|
|
firewall = {
|
|
enable = true;
|
|
allowPing = true;
|
|
allowedTCPPorts = [
|
|
8008 # restic
|
|
9000 # authentik
|
|
2342 # grafana
|
|
51820 # wireguard
|
|
1025
|
|
1143
|
|
10200
|
|
10300
|
|
8127
|
|
9980 # onlyoffice
|
|
4000 # netbootxyz
|
|
4080 # netbootxyz
|
|
3000 # gitea
|
|
2222 # gitea ssh
|
|
3300
|
|
9898
|
|
6754 # lubelogger
|
|
2283 # immich
|
|
4444 # code-server
|
|
9012
|
|
8192
|
|
];
|
|
allowedUDPPorts = [
|
|
8008 # restic
|
|
9000 # authentik
|
|
2342 # grafana
|
|
51820 # wireguard
|
|
1025
|
|
1143
|
|
10200
|
|
10300
|
|
8127
|
|
9980 # onlyoffice
|
|
4000 # netbootxyz
|
|
4080 # netbootxyz
|
|
3000 # gitea
|
|
2222 # gitea ssh
|
|
3300
|
|
9898
|
|
6754 # lubelogger
|
|
2283 # immich
|
|
4444 # code-server
|
|
9012
|
|
8192
|
|
];
|
|
trustedInterfaces = [ "tailscale0" ];
|
|
};
|
|
};
|
|
user = {
|
|
name = "admin";
|
|
linger = true;
|
|
};
|
|
};
|
|
|
|
security.tpm2 = {
|
|
enable = true;
|
|
};
|
|
|
|
# Configure environment
|
|
environment = {
|
|
etc.machine-id.text = ''
|
|
57cdf5fc27f3469f80d0a339f1238aeb
|
|
'';
|
|
|
|
systemPackages = with pkgs; [
|
|
attic-client
|
|
bcachefs-tools
|
|
cryptsetup
|
|
clevis
|
|
deconz
|
|
duperemove
|
|
efibootmgr
|
|
ffmpeg
|
|
ipset
|
|
llama-cpp
|
|
# inputs.nas-nixai.packages.x86_64-linux.nixai
|
|
networkmanagerapplet
|
|
nut
|
|
packagekit
|
|
pass
|
|
protonmail-bridge
|
|
protonvpn-cli
|
|
python3Packages.llama-cpp-python
|
|
qrencode
|
|
rcon
|
|
sbctl
|
|
tigervnc
|
|
tpm2-tools
|
|
tpm2-tss
|
|
];
|
|
};
|
|
|
|
# Configure programs
|
|
programs = {
|
|
virt-manager.enable = true;
|
|
coolercontrol = {
|
|
enable = true;
|
|
nvidiaSupport = true;
|
|
};
|
|
|
|
msmtp = {
|
|
enable = false;
|
|
accounts = {
|
|
default = {
|
|
auth = true;
|
|
tls_starttls = false;
|
|
host = "smtp.gmail.com";
|
|
user = "matt.l.jallen";
|
|
from = "matt.l.jallen@gmail.com";
|
|
passwordeval = "cat ${config.sops.secrets."jallen-nas/gitea/mail-key".path}";
|
|
};
|
|
};
|
|
defaults = {
|
|
port = 465;
|
|
tls = true;
|
|
};
|
|
};
|
|
};
|
|
|
|
hardware.fancontrol = {
|
|
enable = false;
|
|
config = ''
|
|
# Configuration file generated by pwmconfig, changes will be lost
|
|
# hwmon6/temp9_input -- chipset temp?
|
|
# hwmon2/temp1_input -- cpu temp?
|
|
# hwmon6/pwm5 -- chipset fan?
|
|
# hwmon6/pwm2, hwmon6/pwm3 -- cpu fans?
|
|
# hwmon6/pwm4 -- case fans?
|
|
|
|
INTERVAL=10
|
|
DEVPATH=hwmon2=devices/pci0000:00/0000:00:18.3 hwmon6=devices/platform/nct6775.656
|
|
DEVNAME=hwmon2=k10temp hwmon6=nct6798
|
|
FCTEMPS=hwmon6/pwm5=hwmon6/temp9_input hwmon6/pwm2=hwmon2/temp1_input hwmon6/pwm3=hwmon2/temp1_input hwmon6/pwm4=hwmon2/temp1_input
|
|
FCFANS=hwmon6/pwm5=hwmon6/fan5_input hwmon6/pwm2=hwmon6/fan2_input hwmon6/pwm3=hwmon6/fan3_input hwmon6/pwm4=hwmon6/fan4_input
|
|
MINTEMP=hwmon6/pwm5=20 hwmon6/pwm2=20 hwmon6/pwm3=20 hwmon6/pwm4=20
|
|
MAXTEMP=hwmon6/pwm5=60 hwmon6/pwm2=90 hwmon6/pwm3=90 hwmon6/pwm4=90
|
|
MINSTART=hwmon6/pwm5=16 hwmon6/pwm2=90 hwmon6/pwm3=45 hwmon6/pwm4=60
|
|
MINSTOP=hwmon6/pwm5=14 hwmon6/pwm2=0 hwmon6/pwm3=30 hwmon6/pwm4=45
|
|
MINPWM=hwmon6/pwm5=14 hwmon6/pwm2=0 hwmon6/pwm3=0 hwmon6/pwm4=0
|
|
MAXPWM=hwmon6/pwm5=255 hwmon6/pwm2=255 hwmon6/pwm3=255 hwmon6/pwm4=255
|
|
'';
|
|
};
|
|
|
|
# Additional virtualization beyond what's in development module
|
|
virtualisation.libvirtd.enable = true;
|
|
}
|