setup services, firewall, secrets etc
This commit is contained in:
parent
86ee681687
commit
e96523d7c2
|
|
@ -12,10 +12,10 @@
|
|||
imports = [
|
||||
# If you want to use modules your own flake exports (from modules/nixos):
|
||||
# outputs.nixosModules.example
|
||||
outputs.nixosModules.qbittorrent
|
||||
|
||||
# Or modules from other flakes (such as nixos-hardware):
|
||||
# inputs.hardware.nixosModules.common-cpu-amd
|
||||
# inputs.hardware.nixosModules.common-ssd
|
||||
inputs.agenix.nixosModules.default
|
||||
|
||||
# You can also split up your configuration and import pieces of it here:
|
||||
# ./users.nix
|
||||
|
|
@ -23,8 +23,9 @@
|
|||
# Import common configurations
|
||||
../common/system-tools.nix
|
||||
|
||||
# Import our docker containers
|
||||
./containers
|
||||
# Import services
|
||||
./services/traefik
|
||||
./services/media-stack
|
||||
|
||||
# Import your generated (nixos-generate-config) hardware configuration
|
||||
./hardware-configuration.nix
|
||||
|
|
@ -86,49 +87,149 @@
|
|||
firewall = {
|
||||
enable = true;
|
||||
allowedTCPPorts = [
|
||||
53 # pihole-FTL (DNS)
|
||||
53 # adguardhome (DNS)
|
||||
80 # traefik (HTTP)
|
||||
443 # traefik (HTTPS)
|
||||
8096 # jellyfin
|
||||
32372 # qbittorrent
|
||||
|
||||
];
|
||||
allowedUDPPorts = [
|
||||
53 # pihole-FTL (DNS)
|
||||
53 # adguardhome (DNS)
|
||||
80 # traefik (HTTP)
|
||||
443 # traefik (HTTPS)
|
||||
8096 # jellyfin
|
||||
32372 # qbittorrent
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
boot.loader = {
|
||||
systemd-boot.enable = true;
|
||||
efi = {
|
||||
boot = {
|
||||
loader = {
|
||||
systemd-boot.enable = true;
|
||||
efi = {
|
||||
canTouchEfiVariables = true;
|
||||
efiSysMountPoint = "/boot/efi";
|
||||
};
|
||||
};
|
||||
kernel.sysctl = {
|
||||
# Allow listening on TCP & UDP ports below 1024
|
||||
"net.ipv4.ip_unprivileged_port_start" = 0;
|
||||
};
|
||||
};
|
||||
|
||||
programs.zsh.enable = true;
|
||||
# Setup environment
|
||||
environment = {
|
||||
# Symlink /bin/sh to POSIX-Complient shell
|
||||
binsh = "${pkgs.bash}/bin/bash";
|
||||
shells = with pkgs; [ zsh ];
|
||||
|
||||
users.users = {
|
||||
admin = {
|
||||
isNormalUser = true;
|
||||
extraGroups = [ "networkmanager" "wheel" "docker" ];
|
||||
shell = pkgs.zsh;
|
||||
openssh.authorizedKeys.keyFiles = [ ../fuchsia/id_ed25519_sk.pub ];
|
||||
# Install packages, prefix with 'unstable.' to use overlay
|
||||
systemPackages = with pkgs; [
|
||||
inputs.agenix.packages."${system}".default
|
||||
];
|
||||
};
|
||||
|
||||
programs = {
|
||||
zsh.enable = true;
|
||||
};
|
||||
|
||||
services = {
|
||||
# This setups a SSH server. Very important if you're setting up a headless system.
|
||||
# Feel free to remove if you don't need it.
|
||||
openssh = {
|
||||
enable = true;
|
||||
# Forbid root login through SSH.
|
||||
settings.PermitRootLogin = "no";
|
||||
# Use keys only. Remove if you want to SSH using password (not recommended)
|
||||
settings.PasswordAuthentication = false;
|
||||
};
|
||||
|
||||
# Privacy protection center
|
||||
adguardhome = {
|
||||
enable = true;
|
||||
openFirewall = true;
|
||||
settings = {
|
||||
# Web interface IP address to listen on.
|
||||
bind_port = 3000;
|
||||
# Web interface IP port to listen on.
|
||||
bind_host = "0.0.0.0";
|
||||
# Custom DNS responses
|
||||
dns.rewrites = [
|
||||
{ domain = "kanto.dev";
|
||||
answer = "192.168.1.102";
|
||||
}
|
||||
{ domain = "*.kanto.dev";
|
||||
answer = "kanto.dev";
|
||||
}
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
# Home automation that puts local control and privacy first.
|
||||
home-assistant = {
|
||||
enable = true;
|
||||
openFirewall = true;
|
||||
extraComponents = [
|
||||
# Components required to complete the onboarding
|
||||
"esphome"
|
||||
"met"
|
||||
"radio_browser"
|
||||
|
||||
"adguard"
|
||||
"jellyfin"
|
||||
];
|
||||
config = {
|
||||
# Includes dependencies for a basic setup
|
||||
# https://www.home-assistant.io/integrations/defaultoconfig/
|
||||
default_config = {};
|
||||
http = {
|
||||
use_x_forwarded_for = true;
|
||||
trusted_proxies = [
|
||||
"192.168.1.102"
|
||||
];
|
||||
};
|
||||
};
|
||||
configDir = "/var/lib/home-assistant";
|
||||
};
|
||||
|
||||
# Sandbox game developed by Mojang Studios
|
||||
minecraft-server = {
|
||||
enable = true;
|
||||
openFirewall = true;
|
||||
dataDir = "/var/lib/minecraft";
|
||||
declarative = true;
|
||||
serverProperties = {
|
||||
gamemode = "survival";
|
||||
level-name = "kanto";
|
||||
difficulty = "easy";
|
||||
server-port = 43000;
|
||||
motd = "A Caterpie May Change Into A Butterfree, But The Heart That Beats Inside Remains The Same.";
|
||||
};
|
||||
eula = true;
|
||||
};
|
||||
};
|
||||
|
||||
# This setups a SSH server. Very important if you're setting up a headless system.
|
||||
# Feel free to remove if you don't need it.
|
||||
services.openssh = {
|
||||
enable = true;
|
||||
# Forbid root login through SSH.
|
||||
settings.PermitRootLogin = "no";
|
||||
# Use keys only. Remove if you want to SSH using password (not recommended)
|
||||
settings.PasswordAuthentication = false;
|
||||
# Configure your system-wide user settings (groups, etc), add more users as needed.
|
||||
users = {
|
||||
users = {
|
||||
# System administator
|
||||
sabrina = {
|
||||
isNormalUser = true;
|
||||
extraGroups = [ "networkmanager" "wheel" "media" ];
|
||||
openssh.authorizedKeys.keyFiles = [ ../fuchsia/id_ed25519_sk.pub ];
|
||||
shell = pkgs.zsh;
|
||||
};
|
||||
};
|
||||
|
||||
# Additional groups to create.
|
||||
groups = {
|
||||
media.members = [
|
||||
"jellyfin"
|
||||
"sonarr"
|
||||
"radarr"
|
||||
"lidarr"
|
||||
"qbittorrent"
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
# https://nixos.wiki/wiki/FAQ/When_do_I_update_stateVersion
|
||||
|
|
|
|||
41
nixos/viridian/services/media-stack/default.nix
Normal file
41
nixos/viridian/services/media-stack/default.nix
Normal file
|
|
@ -0,0 +1,41 @@
|
|||
{ ... }:
|
||||
|
||||
{
|
||||
services = {
|
||||
# Volunteer-built media solution that puts you in control of your media
|
||||
jellyfin = {
|
||||
enable = true;
|
||||
openFirewall = true;
|
||||
};
|
||||
# PVR for Usenet and BitTorrent users
|
||||
sonarr = {
|
||||
enable = true;
|
||||
openFirewall = true;
|
||||
dataDir = "/var/lib/sonarr";
|
||||
};
|
||||
# Movie collection manager for Usenet and BitTorrent users
|
||||
radarr = {
|
||||
enable = true;
|
||||
openFirewall = true;
|
||||
dataDir = "/var/lib/radarr";
|
||||
};
|
||||
# Music collection manager for Usenet and BitTorrent users
|
||||
lidarr = {
|
||||
enable = true;
|
||||
openFirewall = true;
|
||||
dataDir = "/var/lib/lidarr";
|
||||
};
|
||||
# Indexer manager/proxy built on the popular arr .net/reactjs base stack to integrate with your various PVR apps.
|
||||
prowlarr = {
|
||||
enable = true;
|
||||
openFirewall = true;
|
||||
};
|
||||
# Open-source software alternative to µTorrent
|
||||
qbittorrent = {
|
||||
enable = true;
|
||||
openFirewall = true;
|
||||
port = 8080;
|
||||
};
|
||||
};
|
||||
}
|
||||
|
||||
Loading…
Reference in a new issue