setup services, firewall, secrets etc

This commit is contained in:
♥ Minnie ♥ 2023-11-05 14:14:06 +00:00
parent 86ee681687
commit e96523d7c2
2 changed files with 168 additions and 26 deletions

View file

@ -12,10 +12,10 @@
imports = [
# If you want to use modules your own flake exports (from modules/nixos):
# outputs.nixosModules.example
outputs.nixosModules.qbittorrent
# Or modules from other flakes (such as nixos-hardware):
# inputs.hardware.nixosModules.common-cpu-amd
# inputs.hardware.nixosModules.common-ssd
inputs.agenix.nixosModules.default
# You can also split up your configuration and import pieces of it here:
# ./users.nix
@ -23,8 +23,9 @@
# Import common configurations
../common/system-tools.nix
# Import our docker containers
./containers
# Import services
./services/traefik
./services/media-stack
# Import your generated (nixos-generate-config) hardware configuration
./hardware-configuration.nix
@ -86,49 +87,149 @@
firewall = {
enable = true;
allowedTCPPorts = [
53 # pihole-FTL (DNS)
53 # adguardhome (DNS)
80 # traefik (HTTP)
443 # traefik (HTTPS)
8096 # jellyfin
32372 # qbittorrent
];
allowedUDPPorts = [
53 # pihole-FTL (DNS)
53 # adguardhome (DNS)
80 # traefik (HTTP)
443 # traefik (HTTPS)
8096 # jellyfin
32372 # qbittorrent
];
};
};
boot.loader = {
systemd-boot.enable = true;
efi = {
boot = {
loader = {
systemd-boot.enable = true;
efi = {
canTouchEfiVariables = true;
efiSysMountPoint = "/boot/efi";
};
};
kernel.sysctl = {
# Allow listening on TCP & UDP ports below 1024
"net.ipv4.ip_unprivileged_port_start" = 0;
};
};
programs.zsh.enable = true;
# Setup environment
environment = {
# Symlink /bin/sh to POSIX-Complient shell
binsh = "${pkgs.bash}/bin/bash";
shells = with pkgs; [ zsh ];
users.users = {
admin = {
isNormalUser = true;
extraGroups = [ "networkmanager" "wheel" "docker" ];
shell = pkgs.zsh;
openssh.authorizedKeys.keyFiles = [ ../fuchsia/id_ed25519_sk.pub ];
# Install packages, prefix with 'unstable.' to use overlay
systemPackages = with pkgs; [
inputs.agenix.packages."${system}".default
];
};
programs = {
zsh.enable = true;
};
services = {
# This setups a SSH server. Very important if you're setting up a headless system.
# Feel free to remove if you don't need it.
openssh = {
enable = true;
# Forbid root login through SSH.
settings.PermitRootLogin = "no";
# Use keys only. Remove if you want to SSH using password (not recommended)
settings.PasswordAuthentication = false;
};
# Privacy protection center
adguardhome = {
enable = true;
openFirewall = true;
settings = {
# Web interface IP address to listen on.
bind_port = 3000;
# Web interface IP port to listen on.
bind_host = "0.0.0.0";
# Custom DNS responses
dns.rewrites = [
{ domain = "kanto.dev";
answer = "192.168.1.102";
}
{ domain = "*.kanto.dev";
answer = "kanto.dev";
}
];
};
};
# Home automation that puts local control and privacy first.
home-assistant = {
enable = true;
openFirewall = true;
extraComponents = [
# Components required to complete the onboarding
"esphome"
"met"
"radio_browser"
"adguard"
"jellyfin"
];
config = {
# Includes dependencies for a basic setup
# https://www.home-assistant.io/integrations/defaultoconfig/
default_config = {};
http = {
use_x_forwarded_for = true;
trusted_proxies = [
"192.168.1.102"
];
};
};
configDir = "/var/lib/home-assistant";
};
# Sandbox game developed by Mojang Studios
minecraft-server = {
enable = true;
openFirewall = true;
dataDir = "/var/lib/minecraft";
declarative = true;
serverProperties = {
gamemode = "survival";
level-name = "kanto";
difficulty = "easy";
server-port = 43000;
motd = "A Caterpie May Change Into A Butterfree, But The Heart That Beats Inside Remains The Same.";
};
eula = true;
};
};
# This setups a SSH server. Very important if you're setting up a headless system.
# Feel free to remove if you don't need it.
services.openssh = {
enable = true;
# Forbid root login through SSH.
settings.PermitRootLogin = "no";
# Use keys only. Remove if you want to SSH using password (not recommended)
settings.PasswordAuthentication = false;
# Configure your system-wide user settings (groups, etc), add more users as needed.
users = {
users = {
# System administator
sabrina = {
isNormalUser = true;
extraGroups = [ "networkmanager" "wheel" "media" ];
openssh.authorizedKeys.keyFiles = [ ../fuchsia/id_ed25519_sk.pub ];
shell = pkgs.zsh;
};
};
# Additional groups to create.
groups = {
media.members = [
"jellyfin"
"sonarr"
"radarr"
"lidarr"
"qbittorrent"
];
};
};
# https://nixos.wiki/wiki/FAQ/When_do_I_update_stateVersion

View file

@ -0,0 +1,41 @@
{ ... }:
{
services = {
# Volunteer-built media solution that puts you in control of your media
jellyfin = {
enable = true;
openFirewall = true;
};
# PVR for Usenet and BitTorrent users
sonarr = {
enable = true;
openFirewall = true;
dataDir = "/var/lib/sonarr";
};
# Movie collection manager for Usenet and BitTorrent users
radarr = {
enable = true;
openFirewall = true;
dataDir = "/var/lib/radarr";
};
# Music collection manager for Usenet and BitTorrent users
lidarr = {
enable = true;
openFirewall = true;
dataDir = "/var/lib/lidarr";
};
# Indexer manager/proxy built on the popular arr .net/reactjs base stack to integrate with your various PVR apps.
prowlarr = {
enable = true;
openFirewall = true;
};
# Open-source software alternative to µTorrent
qbittorrent = {
enable = true;
openFirewall = true;
port = 8080;
};
};
}