aboutsummaryrefslogtreecommitdiff
path: root/hosts/sagittarius
diff options
context:
space:
mode:
Diffstat (limited to 'hosts/sagittarius')
-rw-r--r--hosts/sagittarius/default.nix57
-rw-r--r--hosts/sagittarius/hardware.nix31
-rw-r--r--hosts/sagittarius/home.nix23
-rw-r--r--hosts/sagittarius/ssh.nix10
-rw-r--r--hosts/sagittarius/web/acme.nix10
-rw-r--r--hosts/sagittarius/web/blog.nix14
-rw-r--r--hosts/sagittarius/web/default.nix8
-rw-r--r--hosts/sagittarius/web/git.nix8
-rw-r--r--hosts/sagittarius/web/matrix.nix115
-rw-r--r--hosts/sagittarius/web/mediadb.nix19
10 files changed, 295 insertions, 0 deletions
diff --git a/hosts/sagittarius/default.nix b/hosts/sagittarius/default.nix
new file mode 100644
index 0000000..6bf1a22
--- /dev/null
+++ b/hosts/sagittarius/default.nix
@@ -0,0 +1,57 @@
+{ pkgs, ... }: {
+ imports = [
+ # Include the results of the hardware scan.
+ ./hardware.nix
+ ./home.nix
+ ./ssh.nix
+ ./web
+ ];
+
+ boot.loader.grub.device = "/dev/sda";
+ time.timeZone = "Europe/Helsinki";
+
+ networking = {
+ hostName = "sagittarius";
+ useNetworkd = true;
+ firewall.allowedTCPPorts = [ 22 ];
+ };
+ systemd.network = {
+ enable = true;
+ networks."10-wan" = {
+ matchConfig.Name = "enp1s0";
+ networkConfig.DHCP = "ipv4";
+ address = [ "2a01:4f9:c012:c7a7::/64" ];
+ routes = [{ routeConfig.Gateway = "fe80::1"; }];
+ };
+ };
+
+ # Select internationalisation properties.
+ i18n.defaultLocale = "en_US.UTF-8";
+
+ programs.gnupg.agent = {
+ enable = true;
+ enableSSHSupport = true;
+ };
+
+ users.users = {
+ ascella = {
+ isNormalUser = true;
+ extraGroups = [ "wheel" ];
+ openssh.authorizedKeys.keys = [
+ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKiDCf9LMx9diW5BveEju9w2Xv2kk7qKCyLESLyymzih ihp@ihp-laptop"
+ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHOsgD2+McS1+FFMKV9N620ta4DqHCYR1LqyoIR+AwU7 osiris@underworld"
+ ];
+ };
+ };
+
+ programs.zsh.enable = true;
+ users.defaultUserShell = pkgs.zsh;
+
+ # This value determines the NixOS release from which the default
+ # settings for stateful data, like file locations and database versions
+ # on your system were taken. It‘s perfectly fine and recommended to leave
+ # this value at the release version of the first install of this system.
+ # Before changing this value read the documentation for this option
+ # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
+ system.stateVersion = "23.05"; # Did you read the comment?
+}
diff --git a/hosts/sagittarius/hardware.nix b/hosts/sagittarius/hardware.nix
new file mode 100644
index 0000000..783b081
--- /dev/null
+++ b/hosts/sagittarius/hardware.nix
@@ -0,0 +1,31 @@
+# Do not modify this file! It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations. Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+ imports =
+ [ (modulesPath + "/profiles/qemu-guest.nix")
+ ];
+
+ boot.initrd.availableKernelModules = [ "ahci" "xhci_pci" "virtio_pci" "virtio_scsi" "sd_mod" "sr_mod" ];
+ boot.initrd.kernelModules = [ ];
+ boot.kernelModules = [ ];
+ boot.extraModulePackages = [ ];
+
+ fileSystems."/" =
+ { device = "/dev/disk/by-uuid/34d333d4-2298-47c7-b015-5c3e2fd1a27e";
+ fsType = "ext4";
+ };
+
+ swapDevices = [ ];
+
+ # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+ # (the default) this is the recommended approach. When using systemd-networkd it's
+ # still possible to use this option, but it's recommended to use it in conjunction
+ # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+ networking.useDHCP = lib.mkDefault true;
+ # networking.interfaces.enp1s0.useDHCP = lib.mkDefault true;
+
+ nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+}
diff --git a/hosts/sagittarius/home.nix b/hosts/sagittarius/home.nix
new file mode 100644
index 0000000..4c5999d
--- /dev/null
+++ b/hosts/sagittarius/home.nix
@@ -0,0 +1,23 @@
+{ home-manager, flakeRoot, ... }: {
+ home-manager.useGlobalPkgs = true;
+ home-manager.useUserPackages = true;
+ home-manager.sharedModules = [{ imports = [ (flakeRoot + /share/home) ]; }];
+
+ home-manager.users.ascella = {
+ programs.direnv = {
+ enable = true;
+ nix-direnv.enable = true;
+ };
+
+ home.stateVersion = "23.05";
+ };
+
+ home-manager.users.root = {
+ programs.direnv = {
+ enable = true;
+ nix-direnv.enable = true;
+ };
+
+ home.stateVersion = "23.05";
+ };
+}
diff --git a/hosts/sagittarius/ssh.nix b/hosts/sagittarius/ssh.nix
new file mode 100644
index 0000000..8c80a53
--- /dev/null
+++ b/hosts/sagittarius/ssh.nix
@@ -0,0 +1,10 @@
+{ ... }: {
+ services.openssh = {
+ enable = true;
+ settings = {
+ PermitRootLogin = "no";
+ PasswordAuthentication = false;
+ AllowUsers = [ "ascella" ];
+ };
+ };
+}
diff --git a/hosts/sagittarius/web/acme.nix b/hosts/sagittarius/web/acme.nix
new file mode 100644
index 0000000..4cde574
--- /dev/null
+++ b/hosts/sagittarius/web/acme.nix
@@ -0,0 +1,10 @@
+{ ... }: {
+ security.acme = {
+ acceptTerms = true;
+ defaults = {
+ email = "miran.bastaja04@gmail.com";
+ dnsProvider = "porkbun";
+ credentialsFile = "/var/secrets/porkbun.env";
+ };
+ };
+}
diff --git a/hosts/sagittarius/web/blog.nix b/hosts/sagittarius/web/blog.nix
new file mode 100644
index 0000000..1226bd7
--- /dev/null
+++ b/hosts/sagittarius/web/blog.nix
@@ -0,0 +1,14 @@
+{ ... }: {
+ imports = [ ./acme.nix ];
+ networking.firewall.allowedTCPPorts = [ 80 443 ];
+
+ services.nginx = {
+ enable = true;
+
+ virtualHosts."sorre.xyz" = {
+ enableACME = true;
+ forceSSL = true;
+ root = "/var/www/blog";
+ };
+ };
+}
diff --git a/hosts/sagittarius/web/default.nix b/hosts/sagittarius/web/default.nix
new file mode 100644
index 0000000..3fc702e
--- /dev/null
+++ b/hosts/sagittarius/web/default.nix
@@ -0,0 +1,8 @@
+{ ... }: {
+ imports = [
+ ./blog.nix
+ ./matrix.nix
+ ./mediadb.nix
+ # ./git.nix
+ ];
+}
diff --git a/hosts/sagittarius/web/git.nix b/hosts/sagittarius/web/git.nix
new file mode 100644
index 0000000..732f7d0
--- /dev/null
+++ b/hosts/sagittarius/web/git.nix
@@ -0,0 +1,8 @@
+{ ... }: {
+ services.gitDaemon = {
+ enable = true;
+ repositories = [ "/srv/git/" ];
+ exportAll = true;
+ basePath = "/srv/git/";
+ };
+}
diff --git a/hosts/sagittarius/web/matrix.nix b/hosts/sagittarius/web/matrix.nix
new file mode 100644
index 0000000..fc32044
--- /dev/null
+++ b/hosts/sagittarius/web/matrix.nix
@@ -0,0 +1,115 @@
+{ pkgs, config, ... }:
+let
+ server_name = "sorre.xyz";
+ matrix_hostname = "matrix.${server_name}";
+ #admin_email = "gloss_unranked088@simplelogin.com";
+
+ # Build a dervation that stores the content of `${server_name}/.well-known/matrix/server`
+ well_known_server = pkgs.writeText "well-known-matrix-server" ''
+ {
+ "m.server": "${matrix_hostname}"
+ }
+ '';
+
+ # Build a dervation that stores the content of `${server_name}/.well-known/matrix/client`
+ well_known_client = pkgs.writeText "well-known-matrix-client" ''
+ {
+ "m.homeserver": {
+ "base_url": "https://${matrix_hostname}"
+ }
+ }
+ '';
+in
+{
+ imports = [ ./acme.nix ];
+
+ networking.firewall.allowedTCPPorts = [ 80 443 8448 ];
+ networking.firewall.allowedUDPPorts = [ 80 443 8448 ];
+
+ services.matrix-conduit = {
+ enable = true;
+ # Currently conduit seems to have no substituter for the flake, which means
+ # that the compilation would be done on the server, therefore we're using
+ # the (prebuilt) nixpkgs version of it for now.
+ #package = inputs.conduit.packages.${pkgs.system}.default;
+ package = pkgs.matrix-conduit;
+ settings.global.server_name = server_name;
+ settings.global.allow_registration = false;
+ };
+
+ services.nginx = {
+ enable = true;
+ recommendedProxySettings = true;
+
+ virtualHosts."${matrix_hostname}" = {
+ enableACME = true;
+ forceSSL = true;
+
+ listen = [
+ {
+ addr = "0.0.0.0";
+ port = 443;
+ ssl = true;
+ }
+ {
+ addr = "[::]";
+ port = 443;
+ ssl = true;
+ }
+ {
+ addr = "0.0.0.0";
+ port = 8448;
+ ssl = true;
+ }
+ {
+ addr = "[::]";
+ port = 8448;
+ ssl = true;
+ }
+ ];
+ locations."/_matrix/" = {
+ proxyPass = "http://backend_conduit$request_uri";
+ proxyWebsockets = true;
+ extraConfig = ''
+ proxy_set_header Host $host;
+ proxy_buffering off;
+ '';
+ };
+ extraConfig = ''
+ merge_slashes off;
+ '';
+ };
+
+ virtualHosts."${server_name}" = {
+ enableACME = true;
+ forceSSL = true;
+
+ locations = {
+ "=/.well-known/matrix/server" = {
+ alias = "${well_known_server}";
+ extraConfig = ''
+ # Set the header since by default NGINX thinks it's just bytes
+ default_type application/json;
+ '';
+ };
+ "=/.well-known/matrix/client" = {
+ # Use the contents of the derivation built previously
+ alias = "${well_known_client}";
+
+ extraConfig = ''
+ # Set the header since by default NGINX thinks it's just bytes
+ default_type application/json;
+
+ # https://matrix.org/docs/spec/client_server/r0.4.0#web-browser-clients
+ add_header Access-Control-Allow-Origin "*";
+ '';
+ };
+ };
+ };
+
+ upstreams."backend_conduit".servers = {
+ "[::1]:${toString config.services.matrix-conduit.settings.global.port}" =
+ { };
+ };
+ };
+}
diff --git a/hosts/sagittarius/web/mediadb.nix b/hosts/sagittarius/web/mediadb.nix
new file mode 100644
index 0000000..78d76cd
--- /dev/null
+++ b/hosts/sagittarius/web/mediadb.nix
@@ -0,0 +1,19 @@
+{ pkgs, ... }: {
+ networking.firewall.allowedTCPPorts = [ 5432 ];
+
+ services.postgresql = {
+ enable = true;
+ package = pkgs.postgresql_15_jit;
+ enableTCPIP = true;
+ enableJIT = true;
+
+ settings = { password_encryption = "scram-sha-256"; };
+
+ authentication = ''
+ # TYPE DATABASE USER ADDRESS METHOD
+ local all postgres peer
+ host all postgres all reject
+ host all all all scram-sha-256
+ '';
+ }; # end of services.postgreslq
+}
generated by cgit v1.3.1 (git 2.54.0) at 2026-10-27 19:33:39 +0000