diff --git a/.gitea/workflows/check-nixos.yml b/.gitea/workflows/check-nixos.yml index 2b8c549..0645d9f 100644 --- a/.gitea/workflows/check-nixos.yml +++ b/.gitea/workflows/check-nixos.yml @@ -20,7 +20,9 @@ jobs: - name: Evaluate all NixOS hosts run: | set -euo pipefail - for host in nixos docker server nix-cache nix-minimal pxe-boot linode-minimal; do + hosts="$(nix --extra-experimental-features 'nix-command flakes' eval --json \ + .#nixosConfigurations --apply builtins.attrNames | jq -r '.[]')" + for host in $hosts; do echo "Evaluating ${host}" nix --extra-experimental-features 'nix-command flakes' eval \ ".#nixosConfigurations.${host}.config.system.build.toplevel.drvPath" --raw diff --git a/.github/workflows/check-nixos.yml b/.github/workflows/check-nixos.yml index 2b8c549..0645d9f 100644 --- a/.github/workflows/check-nixos.yml +++ b/.github/workflows/check-nixos.yml @@ -20,7 +20,9 @@ jobs: - name: Evaluate all NixOS hosts run: | set -euo pipefail - for host in nixos docker server nix-cache nix-minimal pxe-boot linode-minimal; do + hosts="$(nix --extra-experimental-features 'nix-command flakes' eval --json \ + .#nixosConfigurations --apply builtins.attrNames | jq -r '.[]')" + for host in $hosts; do echo "Evaluating ${host}" nix --extra-experimental-features 'nix-command flakes' eval \ ".#nixosConfigurations.${host}.config.system.build.toplevel.drvPath" --raw diff --git a/AGENTS.md b/AGENTS.md index 2eda899..6d8a001 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -5,15 +5,13 @@ This repository contains flake-based NixOS configurations for Wayne's LAN servers and workstation. -The flake currently exposes these NixOS configurations: - -- `nixos` -- `docker` -- `server` -- `nix-cache` -- `nix-minimal` -- `pxe-boot` -- `linode-minimal` +The flake exposes NixOS configurations named `-` +(platforms: `linode`, `proxmox`, `lxc`; build types: `minimal`, `nix-cache`, +`server`, `docker`, `gui`, `pxe-boot`), generated from `modules/platforms/*` +and `modules/build-types/*` by the `mkTarget` function in `flake.nix`. Not +every combination is built — `pxe-boot` has no `linode` variant. See +`README.md` for the full current target list; treat `flake.nix` as the +source of truth since this list can drift. Do not deploy, switch, reboot, repartition, format disks, or run destructive install commands from this repository unless explicitly asked. diff --git a/README.md b/README.md index bfddd70..d0f2661 100644 --- a/README.md +++ b/README.md @@ -5,17 +5,35 @@ workstation. ## Hosts -This flake currently defines: +Targets are named `-`, generated from two orthogonal +pieces composed in `flake.nix`: -| Host | Purpose | +- **Platforms** (what it runs on): `linode`, `proxmox`, `lxc` +- **Build types** (what it's for): `minimal`, `nix-cache`, `server`, `docker`, + `gui`, `pxe-boot` + +Not every combination exists — `pxe-boot` has no `linode` variant, since +PXE/DHCP/TFTP need LAN L2 adjacency that a Linode VPS doesn't have. The full +list: + +| Target | Purpose | | --- | --- | -| `nixos` | Main NixOS workstation / Cinnamon desktop | -| `docker` | Docker host for the main container stack | -| `server` | Storage, NFS, backup, and monitoring exporter host | -| `nix-cache` | Local Nix binary cache and remote builder | -| `nix-minimal` | Minimal NixOS host profile with SSHFS tooling | -| `pxe-boot` | HTTP/iPXE boot asset host | -| `linode-minimal` | Minimal NixOS host profile for Linode VPS instances | +| `linode-minimal` | Minimal NixOS host profile on a Linode VPS (real, deployed) | +| `proxmox-minimal` | Minimal NixOS host profile on Proxmox (real, deployed — previously the flat `nix-minimal` target) | +| `lxc-minimal` | Minimal NixOS host profile in a Proxmox LXC container | +| `linode-nix-cache` / `proxmox-nix-cache` / `lxc-nix-cache` | Local Nix binary cache and remote builder (`proxmox-nix-cache` is the real, deployed one — previously the flat `nix-cache` target) | +| `linode-server` / `proxmox-server` / `lxc-server` | Storage, NFS, backup, and monitoring exporter host (`proxmox-server` is the real, deployed one — previously the flat `server` target) | +| `linode-docker` / `proxmox-docker` / `lxc-docker` | Docker host for the main container stack (`proxmox-docker` is the real, deployed one — previously the flat `docker` target) | +| `linode-gui` / `proxmox-gui` / `lxc-gui` | Cinnamon desktop workstation (`proxmox-gui` is the real, deployed one — previously the flat `nixos` target) | +| `proxmox-pxe-boot` / `lxc-pxe-boot` | HTTP/iPXE boot asset host (`proxmox-pxe-boot` is the real, deployed one — previously the flat `pxe-boot` target) | + +Each buildtype's `hosts//host.nix` carries the per-machine identity +(hostname, hostId, per-machine secrets, `system.stateVersion`) that must stay +fixed regardless of which platform it's built for — see +`flake-target-refactor-spec.md` for the full rationale. Every deployed host +stamps its own active target name into `/etc/flake-target` at build time, so +`nixos-rebuild switch --flake .#$(cat /etc/flake-target)` always picks up the +right one even after a platform migration changes the flake attribute name. List hosts with: @@ -27,11 +45,13 @@ nix eval --json .#nixosConfigurations --apply builtins.attrNames | jq -r '.[]' | Path | Purpose | | --- | --- | -| `flake.nix` | Flake inputs and `nixosConfigurations` outputs | -| `hosts//configuration.nix` | Host-specific NixOS configuration | -| `hosts/nixos/home.nix` | Workstation-specific Home Manager config | -| `common/` | Shared NixOS, Home Manager, aliases, and hardware config | -| `modules/nix/` | Binary cache and remote builder client/server modules | +| `flake.nix` | Flake inputs, the `mkTarget` platform × build-type generator, and `nixosConfigurations` outputs | +| `hosts//host.nix` | Per-machine identity: hostname, hostId, per-machine secrets, `system.stateVersion` | +| `hosts/nixos/home.nix` | Workstation-specific Home Manager config (used by the `gui` build type) | +| `modules/platforms/` | Platform-specific config: virtualisation guest tools, boot method, hardware config (`linode.nix`, `proxmox.nix`, `lxc.nix`) | +| `modules/build-types/` | Build-type-specific config: what makes a system minimal/server/docker/gui/pxe-boot/nix-cache | +| `modules/common/` | Shared NixOS config, Home Manager, aliases imported by every host | +| `modules/nix-cache/` | Binary cache and remote builder client/server modules | | `docs/` | Operational notes for cache, builders, lock updates, and boot services | | `scripts/` | Codex setup and validation helpers | diff --git a/docs/flake-lock-automation.md b/docs/flake-lock-automation.md index 5bec8cf..f17e008 100644 --- a/docs/flake-lock-automation.md +++ b/docs/flake-lock-automation.md @@ -8,14 +8,10 @@ and to verify that declared NixOS hosts still evaluate after dependency updates. - A scheduled workflow runs `nix flake update` once per week. - On GitHub, any resulting `flake.lock` change is proposed through a pull request. - On Gitea, the workflow can commit and push `flake.lock` directly when PR automation is not configured. -- A separate CI workflow evaluates every configured host before merge: - - `nixos` - - `docker` - - `server` - - `nix-cache` - - `nix-minimal` - - `pxe-boot` - - `linode-minimal` +- A separate CI workflow evaluates every configured host before merge, listed + dynamically via `nix eval --json .#nixosConfigurations --apply builtins.attrNames` + rather than hand-enumerated, so it can't drift as `-` + targets are added or removed. See `README.md` for the current target list. ## Why hosts should stop using `--upgrade-all` @@ -24,9 +20,15 @@ and to verify that declared NixOS hosts still evaluate after dependency updates. Recommended rebuild command: ```bash -sudo nixos-rebuild switch --flake git+https://gitea.lan.ddnsgeek.com/beatzaplenty/nixos.git#$(hostname) +sudo nixos-rebuild switch --flake git+https://gitea.lan.ddnsgeek.com/beatzaplenty/nixos.git#$(cat /etc/flake-target) ``` +Flake attribute names are `-` (e.g. `proxmox-docker`) +and no longer match `hostname`, since a host's hostname stays fixed while +the platform backing it can change. Each `nixosConfiguration` stamps its own +active target name into `/etc/flake-target` at build time, which is what the +command above reads. + Using the committed lock file keeps all hosts aligned and makes updates auditable through CI and code review. Codex and automated review sessions must not run rebuilds. Limit checks to diff --git a/flake-target-refactor-spec.md b/flake-target-refactor-spec.md new file mode 100755 index 0000000..f7f2611 --- /dev/null +++ b/flake-target-refactor-spec.md @@ -0,0 +1,143 @@ +# Spec: Refactor Flake Targets into Platform × Build-Type Matrix + +## Context + +The flake at `~/nixos` currently defines these output targets (flat, ad-hoc naming): + +- `docker` +- `linode-minimal` +- `nix-cache` +- `nix-minimal` +- `nixos` +- `server` +- `pxe-boot` + +Some already follow a `platform-buildtype` convention (`linode-minimal`), most don't. +`~/nix-auto-installer` is a related repo and should be checked for any coupling to +these target names (scripts, docs, CI, or install automation that reference them by +name) before renaming anything. + +## Goal + +Restructure the flake so targets are generated from two orthogonal concepts: + +**Build types** (what the system is for): +- `minimal` +- `nix-cache` +- `server` +- `docker` +- `pxe-boot` +- `gui` + +**Platforms** (what it's deployed on): +- `linode` (Linode VM) +- `proxmox` (Proxmox VM) +- `lxc` (Proxmox LXC container) + +Final targets should be named consistently as `-`, e.g.: + +``` +linode-minimal proxmox-minimal lxc-minimal +linode-nix-cache proxmox-nix-cache lxc-nix-cache +linode-server proxmox-server lxc-server +linode-docker proxmox-docker lxc-docker +linode-pxe-boot proxmox-pxe-boot lxc-pxe-boot +linode-gui proxmox-gui lxc-gui +``` + +That's the full matrix (18 targets) if every build type applies to every platform. +See **Open Questions** below — some combinations may not make sense and should be +confirmed with me before being built out, not silently included or dropped. + +## Migration mapping (old → new) + +| Old target | New target | Notes | +|--------------------|------------------------------------------------------|-------| +| `linode-minimal` | `linode-minimal` | Already correct, keep as-is | +| `nix-minimal` | likely `proxmox-minimal` or a platform-less base module | Ambiguous — see Open Questions | +| `nix-cache` | base module consumed by `linode-nix-cache`, `proxmox-nix-cache`, `lxc-nix-cache` | Currently platform-less; needs to become a build-type module, not a standalone target | +| `server` | base module consumed by `linode-server`, `proxmox-server`, `lxc-server` | Same as above | +| `docker` | base module consumed by `linode-docker`, `proxmox-docker`, `lxc-docker` | Confirm docker actually makes sense as an LXC/VM guest build vs. a standalone container image — see Open Questions | +| `pxe-boot` | TBD — may stay a single target rather than a per-platform one | See Open Questions | +| `nixos` | TBD — unclear what this maps to in the new scheme | See Open Questions | + +## Open Questions (Claude Code: raise these with me before implementing, don't guess) + +1. **`nixos` target** — what is this currently used for (bare metal install, dev + shell, template)? It doesn't obviously map to any of the six build types. +2. **`nix-minimal` vs `linode-minimal`** — are these two different things, or is + `nix-minimal` a leftover/duplicate? +3. **`pxe-boot` and `gui` across all three platforms** — does PXE boot make sense + for an LXC container or a cloud VM (Linode), or is it inherently bare-metal/ + network-boot only and should remain a single non-platform target? Does `gui` + make sense inside an LXC container? +4. **`docker` as a build type** — is this "a NixOS host configured to run Docker" + (which would sensibly have linode/proxmox/lxc variants), or "a Docker container + image built by the flake" (which wouldn't take a platform prefix at all, since + it doesn't run on Linode/Proxmox/LXC as a guest OS)? These are structurally + different and change how it should be wired in. +5. Confirm whether all 18 combinations should actually exist, or whether this is + meant to produce only the combinations that are genuinely useful (e.g. maybe no + one needs `lxc-pxe-boot`). + +## Implementation approach + +1. **Inventory first.** Read the current `flake.nix` and any `nixosConfigurations`/ + `modules` structure. Map every existing target to what module(s) it actually + pulls in. Don't assume — confirm against the real file contents. +2. **Separate build-type and platform into their own module directories**, e.g.: + ``` + modules/build-types/minimal.nix + modules/build-types/nix-cache.nix + modules/build-types/server.nix + modules/build-types/docker.nix + modules/build-types/pxe-boot.nix + modules/build-types/gui.nix + + modules/platforms/linode.nix + modules/platforms/proxmox.nix + modules/platforms/lxc.nix + ``` + Build-type modules should contain only what makes a system "minimal" vs + "server" vs "gui", etc. Platform modules should contain only what's specific + to running as a Linode VM vs Proxmox VM vs LXC container (virtualisation + guest tools, boot method, filesystem/image format, LXC-specific constraints + like no kernel modules, etc). +3. **Generate the target matrix programmatically** in `flake.nix` rather than + hand-writing 18 near-identical `nixosConfigurations` entries — e.g. a small + function that takes a platform name and build-type name, composes the two + modules plus any shared base module, and produces the named output. This + keeps future build types/platforms a one-line addition rather than a copy-paste + job. +4. **Only build combinations we've confirmed make sense** (see Open Questions) — + don't emit all 18 by default if some are structurally invalid. +5. **Preserve existing working configs during the transition.** Don't delete the + old target names until their replacements build successfully — rename/alias + at the end, not the start, so there's no window where the flake is broken. + +## Verification + +For every new target produced: +```bash +nix flake check +nix build .#nixosConfigurations..config.system.build.toplevel +``` +Confirm each builds without evaluation errors before considering it done. If a +target fails to build, report which one and why rather than silently skipping it. + +## Deliverables + +- Refactored `flake.nix` using the composed module + generated-matrix approach. +- New `modules/build-types/*.nix` and `modules/platforms/*.nix` files. +- Old flat target names removed only after their replacements are verified. +- A short `README.md` (or section in existing docs) listing the final target + names and what each one is for. +- A summary at the end of what changed, what was removed, and any of the Open + Questions above that got resolved differently than expected. + +## Out of scope + +- Don't touch `~/nix-auto-installer` contents beyond checking it for references + to the old target names — if changes there are needed, flag them, don't make + them without confirming. +- Don't add new build types or platforms beyond the ones listed here. diff --git a/flake.nix b/flake.nix index 1d47bc0..dc4de9d 100644 --- a/flake.nix +++ b/flake.nix @@ -18,137 +18,70 @@ let system = "x86_64-linux"; + inherit (nixpkgs) lib; - # 🔧 Docker override (pin version here) -# dockerOverlay = final: prev: { -# docker = prev.docker_29; -# docker_cli = prev.docker_29; -# }; - - in { - - nixosConfigurations = { - - nixos = nixpkgs.lib.nixosSystem { + # Generates a nixosConfiguration from a platform (what it runs on) and + # a build type (what it's for), plus the per-identity host.nix that + # carries the bits that must stay fixed regardless of platform + # (hostName, hostId, per-machine secrets). Every build type except + # nix-cache itself consumes the nix-cache substituter and remote + # builder. + mkTarget = { platform, buildType, hostPath, homeFile ? ./modules/common/home.nix }: + nixpkgs.lib.nixosSystem { inherit system; modules = [ inputs.disko.nixosModules.disko - ./hosts/nixos/configuration.nix - ./modules/hardware-configuration/vm/proxmox.nix - - home-manager.nixosModules.home-manager { - home-manager.useGlobalPkgs = true; - home-manager.useUserPackages = true; - home-manager.users.nixos = import ./hosts/nixos/home.nix; + ./modules/common/configuration.nix + ./modules/platforms/${platform}.nix + ./modules/build-types/${buildType}.nix + hostPath + { environment.etc."flake-target".text = "${platform}-${buildType}"; } + home-manager.nixosModules.home-manager + { + home-manager = { + useGlobalPkgs = true; + useUserPackages = true; + users.nixos = import homeFile; + }; } + ] ++ lib.optionals (buildType != "nix-cache") [ + ./modules/nix-cache/client.nix + ./modules/remote-builder-client.nix ]; - specialArgs = { inherit inputs; }; }; -docker = nixpkgs.lib.nixosSystem { - inherit system; + # Generated platform x build-type matrix. pxe-boot has no linode + # variant (PXE/DHCP/TFTP need LAN L2 adjacency, which a Linode VPS + # doesn't have). + generatedTargets = { + linode-minimal = mkTarget { platform = "linode"; buildType = "minimal"; hostPath = ./hosts/linode-minimal/host.nix; }; + proxmox-minimal = mkTarget { platform = "proxmox"; buildType = "minimal"; hostPath = ./hosts/proxmox-minimal/host.nix; }; + lxc-minimal = mkTarget { platform = "lxc"; buildType = "minimal"; hostPath = ./hosts/lxc-minimal/host.nix; }; - # 🔧 create custom pkgs with overlay - pkgs = import nixpkgs { - inherit system; + linode-nix-cache = mkTarget { platform = "linode"; buildType = "nix-cache"; hostPath = ./hosts/nix-cache/host.nix; }; + proxmox-nix-cache = mkTarget { platform = "proxmox"; buildType = "nix-cache"; hostPath = ./hosts/nix-cache/host.nix; }; + lxc-nix-cache = mkTarget { platform = "lxc"; buildType = "nix-cache"; hostPath = ./hosts/nix-cache/host.nix; }; - overlays = [ - (final: prev: { - docker = prev.docker_29; - docker_cli = prev.docker_29; - }) - ]; - }; + linode-server = mkTarget { platform = "linode"; buildType = "server"; hostPath = ./hosts/server/host.nix; }; + proxmox-server = mkTarget { platform = "proxmox"; buildType = "server"; hostPath = ./hosts/server/host.nix; }; + lxc-server = mkTarget { platform = "lxc"; buildType = "server"; hostPath = ./hosts/server/host.nix; }; - modules = [ - inputs.disko.nixosModules.disko - ./hosts/docker/configuration.nix - ./modules/hardware-configuration/vm/proxmox.nix + linode-docker = mkTarget { platform = "linode"; buildType = "docker"; hostPath = ./hosts/docker/host.nix; }; + proxmox-docker = mkTarget { platform = "proxmox"; buildType = "docker"; hostPath = ./hosts/docker/host.nix; }; + lxc-docker = mkTarget { platform = "lxc"; buildType = "docker"; hostPath = ./hosts/docker/host.nix; }; - home-manager.nixosModules.home-manager { - home-manager.useGlobalPkgs = true; - home-manager.useUserPackages = true; - home-manager.users.nixos = import ./modules/common/home.nix; - } - ]; -}; + linode-gui = mkTarget { platform = "linode"; buildType = "gui"; hostPath = ./hosts/nixos/host.nix; homeFile = ./hosts/nixos/home.nix; }; + proxmox-gui = mkTarget { platform = "proxmox"; buildType = "gui"; hostPath = ./hosts/nixos/host.nix; homeFile = ./hosts/nixos/home.nix; }; + lxc-gui = mkTarget { platform = "lxc"; buildType = "gui"; hostPath = ./hosts/nixos/host.nix; homeFile = ./hosts/nixos/home.nix; }; - - server = nixpkgs.lib.nixosSystem { - inherit system; - modules = [ - inputs.disko.nixosModules.disko - ./hosts/server/configuration.nix - ./modules/hardware-configuration/vm/proxmox.nix - - home-manager.nixosModules.home-manager { - home-manager.useGlobalPkgs = true; - home-manager.useUserPackages = true; - home-manager.users.nixos = import ./modules/common/home.nix; - } - ]; - }; - - nix-cache = nixpkgs.lib.nixosSystem { - inherit system; - modules = [ - inputs.disko.nixosModules.disko - ./hosts/nix-cache/configuration.nix - ./modules/hardware-configuration/vm/proxmox.nix - - home-manager.nixosModules.home-manager { - home-manager.useGlobalPkgs = true; - home-manager.useUserPackages = true; - home-manager.users.nixos = import ./modules/common/home.nix; - } - ]; - }; - - nix-minimal = nixpkgs.lib.nixosSystem { - inherit system; - modules = [ - inputs.disko.nixosModules.disko - ./hosts/nix-minimal/configuration.nix - ./modules/hardware-configuration/vm/proxmox.nix - - home-manager.nixosModules.home-manager { - home-manager.useGlobalPkgs = true; - home-manager.useUserPackages = true; - home-manager.users.nixos = import ./modules/common/home.nix; - } - ]; - }; - - pxe-boot = nixpkgs.lib.nixosSystem { - inherit system; - modules = [ - inputs.disko.nixosModules.disko - ./hosts/pxe-boot/configuration.nix - ./modules/hardware-configuration/vm/proxmox.nix - - home-manager.nixosModules.home-manager { - home-manager.useGlobalPkgs = true; - home-manager.useUserPackages = true; - home-manager.users.nixos = import ./modules/common/home.nix; - } - ]; - }; - - linode-minimal = nixpkgs.lib.nixosSystem { - inherit system; - modules = [ - # inputs.disko.nixosModules.disko - ./hosts/linode-minimal/configuration.nix - ./modules/hardware-configuration/vm/linode.nix - - home-manager.nixosModules.home-manager { - home-manager.useGlobalPkgs = true; - home-manager.useUserPackages = true; - home-manager.users.nixos = import ./modules/common/home.nix; - } - ]; - }; + proxmox-pxe-boot = mkTarget { platform = "proxmox"; buildType = "pxe-boot"; hostPath = ./hosts/pxe-boot/host.nix; }; + lxc-pxe-boot = mkTarget { platform = "lxc"; buildType = "pxe-boot"; hostPath = ./hosts/pxe-boot/host.nix; }; }; + + in + { + + nixosConfigurations = generatedTargets; }; } diff --git a/hosts/docker/configuration.nix b/hosts/docker/configuration.nix deleted file mode 100644 index 01161b6..0000000 --- a/hosts/docker/configuration.nix +++ /dev/null @@ -1,70 +0,0 @@ -# Edit this configuration file to define what should be installed on -# your system. Help is available in the configuration.nix(5) man page, on -# https://search.nixos.org/options and in the NixOS manual (`nixos-help`). - -{ config, lib, pkgs, inputs, ... }: - -{ - imports = - [ - ../../modules/common/configuration.nix - ../../modules/nix-cache/client.nix - ../../modules/remote-builder-client.nix - ../../modules/docker/mount-data.nix - ../../modules/docker/enable-service.nix - ../../modules/tailscale/enable-service.nix - ../../modules/rotate-traefik-logs.nix - ../../modules/raspi/mount-data.nix - ../../modules/services/nextcloud-cron-job.nix - ../../modules/services/docker-health-to-gotify.nix - ../../modules/services/enable-rpcbind.nix - ../../modules/disko/proxmox.nix - ../../modules/boot/efi.nix - ]; - - - networking.hostName = "docker"; # Define your hostname. - networking.hostId = "007f0200"; - boot.zfs.forceImportRoot = false; - environment.systemPackages = with pkgs; [ - nfs-utils - ]; - boot.supportedFilesystems = [ "nfs" ]; - systemd.tmpfiles.rules = [ - "L+ /home/nixos/docker - - - - /mnt/docker/config" - "d /mnt/docker 0755 nixos users -" - "d /mnt/raspi-backup 0755 nixos users -" - ]; - users.users.nixos.extraGroups = [ "docker" ]; - services.openssh.settings.PermitRootLogin = "yes"; - - # Open ports in the firewall. - networking.firewall.allowedTCPPorts = [ 80 8080 443 8090 ]; - # networking.firewall.allowedUDPPorts = [ ... ]; - # Or disable the firewall altogether. - # networking.firewall.enable = false; - - # Copy the NixOS configuration file and link it from the resulting system - # (/run/current-system/configuration.nix). This is useful in case you - # accidentally delete configuration.nix. - # system.copySystemConfiguration = true; - - # This option defines the first version of NixOS you have installed on this particular machine, - # and is used to maintain compatibility with application data (e.g. databases) created on older NixOS versions. - # - # Most users should NEVER change this value after the initial install, for any reason, - # even if you've upgraded your system to a new NixOS release. - # - # This value does NOT affect the Nixpkgs version your packages and OS are pulled from, - # so changing it will NOT upgrade your system - see https://nixos.org/manual/nixos/stable/#sec-upgrading for how - # to actually do that. - # - # This value being lower than the current NixOS release does NOT mean your system is - # out of date, out of support, or vulnerable. - # - # Do NOT change this value unless you have manually inspected all the changes it would make to your configuration, - # and migrated your data accordingly. - # - # For more information, see `man configuration.nix` or https://nixos.org/manual/nixos/stable/options#opt-system.sta> - system.stateVersion = "25.05"; # Did you read the comment? -} diff --git a/hosts/docker/host.nix b/hosts/docker/host.nix new file mode 100644 index 0000000..b565aff --- /dev/null +++ b/hosts/docker/host.nix @@ -0,0 +1,11 @@ +{ ... }: + +{ + networking.hostName = "docker"; + networking.hostId = "007f0200"; + boot.zfs.forceImportRoot = false; + + # Preserved from the pre-refactor `docker` target — stateVersion must never + # be bumped on an already-installed machine. + system.stateVersion = "25.05"; +} diff --git a/hosts/linode-minimal/configuration.nix b/hosts/linode-minimal/configuration.nix deleted file mode 100644 index e6d44c0..0000000 --- a/hosts/linode-minimal/configuration.nix +++ /dev/null @@ -1,144 +0,0 @@ -# Edit this configuration file to define what should be installed on -# your system. Help is available in the configuration.nix(5) man page, on -# https://search.nixos.org/options and in the NixOS manual (`nixos-help`). - -{ config, lib, pkgs, ... }: - -{ - imports = - [ # Include the results of the hardware scan. - ../../modules/common/configuration.nix - ]; - - # Use the GRUB 2 boot loader. - boot.loader.grub.enable = true; - # boot.loader.grub.efiSupport = true; - # boot.loader.grub.efiInstallAsRemovable = true; - # boot.loader.efi.efiSysMountPoint = "/boot/efi"; - # Define on which hard drive you want to install Grub. - boot.loader.grub.device = "/dev/sda"; # or "nodev" for efi only - - # networking.hostName = "nixos"; # Define your hostname. - - # Configure network connections interactively with nmcli or nmtui. - networking.networkmanager.enable = true; - - # Set your time zone. - # time.timeZone = "Europe/Amsterdam"; - - # Configure network proxy if necessary - # networking.proxy.default = "http://user:password@proxy:port/"; - # networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain"; - - # Select internationalisation properties. - # i18n.defaultLocale = "en_US.UTF-8"; - # console = { - # font = "Lat2-Terminus16"; - # keyMap = "us"; - # useXkbConfig = true; # use xkb.options in tty. - # }; - - # Enable the X11 windowing system. - # services.xserver.enable = true; - - - - - # Configure keymap in X11 - # services.xserver.xkb.layout = "us"; - # services.xserver.xkb.options = "eurosign:e,caps:escape"; - - # Enable CUPS to print documents. - # services.printing.enable = true; - - # Enable sound. - # services.pulseaudio.enable = true; - # OR - # services.pipewire = { - # enable = true; - # pulse.enable = true; - # }; - - # Enable touchpad support (enabled default in most desktopManager). - # services.libinput.enable = true; - - # Define a user account. Don't forget to set a password with ‘passwd’. - # users.users.alice = { - # isNormalUser = true; - # extraGroups = [ "wheel" ]; # Enable ‘sudo’ for the user. - # packages = with pkgs; [ - # tree - # ]; - # }; - - # programs.firefox.enable = true; - - # List packages installed in system profile. - # You can use https://search.nixos.org/ to find more packages (and options). - # environment.systemPackages = with pkgs; [ - # vim # Do not forget to add an editor to edit configuration.nix! The Nano editor is also installed by default. - # wget - # ]; - - # Some programs need SUID wrappers, can be configured further or are - # started in user sessions. - # programs.mtr.enable = true; - # programs.gnupg.agent = { - # enable = true; - # enableSSHSupport = true; - # }; - -environment.systemPackages = with pkgs; [ - inetutils - mtr - sysstat -]; - -users.users.nixos = { - isNormalUser = true; - home = "/home/nixos"; - description = "nixos"; - extraGroups = [ "wheel" "networkmanager" ]; -}; - -networking.usePredictableInterfaceNames = false; -networking.useDHCP = false; -networking.interfaces.eth0.useDHCP = true; - - # Enable the OpenSSH daemon. - services.openssh = { - enable = true; -# settings.permitRootLogin = "yes"; -}; - # Open ports in the firewall. - # networking.firewall.allowedTCPPorts = [ ... ]; - # networking.firewall.allowedUDPPorts = [ ... ]; - # Or disable the firewall altogether. - # networking.firewall.enable = false; - - # Copy the NixOS configuration file and link it from the resulting system - # (/run/current-system/configuration.nix). This is useful in case you - # accidentally delete configuration.nix. - # system.copySystemConfiguration = true; - - # This option defines the first version of NixOS you have installed on this particular machine, - # and is used to maintain compatibility with application data (e.g. databases) created on older NixOS versions. - # - # Most users should NEVER change this value after the initial install, for any reason, - # even if you've upgraded your system to a new NixOS release. - # - # This value does NOT affect the Nixpkgs version your packages and OS are pulled from, - # so changing it will NOT upgrade your system - see https://nixos.org/manual/nixos/stable/#sec-upgrading for how - # to actually do that. - # - # This value being lower than the current NixOS release does NOT mean your system is - # out of date, out of support, or vulnerable. - # - # Do NOT change this value unless you have manually inspected all the changes it would make to your configuration, - # and migrated your data accordingly. - # - # For more information, see `man configuration.nix` or https://nixos.org/manual/nixos/stable/options#opt-system.stateVersion . - system.stateVersion = "26.05"; # Did you read the comment? - -} - diff --git a/hosts/linode-minimal/host.nix b/hosts/linode-minimal/host.nix new file mode 100644 index 0000000..40752df --- /dev/null +++ b/hosts/linode-minimal/host.nix @@ -0,0 +1,9 @@ +{ ... }: + +{ + networking.hostName = "linode-minimal"; + + # Preserved from the pre-refactor `linode-minimal` target — stateVersion + # must never be bumped on an already-installed machine. + system.stateVersion = "26.05"; +} diff --git a/hosts/lxc-minimal/host.nix b/hosts/lxc-minimal/host.nix new file mode 100644 index 0000000..8d2828d --- /dev/null +++ b/hosts/lxc-minimal/host.nix @@ -0,0 +1,9 @@ +{ ... }: + +{ + networking.hostName = "lxc-minimal"; + + # No pre-existing deployed machine to preserve — pin explicitly to the + # current release rather than let it silently default. + system.stateVersion = "26.05"; +} diff --git a/hosts/nix-cache/configuration.nix b/hosts/nix-cache/configuration.nix deleted file mode 100644 index d4fa1c7..0000000 --- a/hosts/nix-cache/configuration.nix +++ /dev/null @@ -1,55 +0,0 @@ -# Edit this configuration file to define what should be installed on -# your system. Help is available in the configuration.nix(5) man page, on -# https://search.nixos.org/options and in the NixOS manual (`nixos-help`). - -{ config, lib, pkgs, inputs, ... }: - -{ - imports = - [ # Include the results of the hardware scan. - ../../modules/common/configuration.nix - ../../modules/nix-cache/server.nix - ../../modules/beszel/enable-agent.nix - ../../modules/disko/proxmox.nix - ../../modules/boot/efi.nix - ]; - - networking.hostName = "nix-cache"; # Define your hostname. - -services.beszel.agent.environment = { -#DOCKER_HOST = "tcp://docker-socket-proxy:2375"; -#HUB_URL = "http://docker.sweet.home:8090"; -KEY = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFPR9kwtC4TAeTRu46A7+opZsYpxqkRJ+x/ZyB2GWCeG"; -TOKEN = "c9192e4c-7b5d-4910-8241-c2d68afadbac"; -}; - - # Open ports in the firewall. -# networking.firewall.allowedTCPPorts = [ 80 8080 443 ]; - # networking.firewall.allowedUDPPorts = [ ... ]; - # Or disable the firewall altogether. - # networking.firewall.enable = false; - - # Copy the NixOS configuration file and link it from the resulting system - # (/run/current-system/configuration.nix). This is useful in case you - # accidentally delete configuration.nix. - # system.copySystemConfiguration = true; - - # This option defines the first version of NixOS you have installed on this particular machine, - # and is used to maintain compatibility with application data (e.g. databases) created on older NixOS versions. - # - # Most users should NEVER change this value after the initial install, for any reason, - # even if you've upgraded your system to a new NixOS release. - # - # This value does NOT affect the Nixpkgs version your packages and OS are pulled from, - # so changing it will NOT upgrade your system - see https://nixos.org/manual/nixos/stable/#sec-upgrading for how - # to actually do that. - # - # This value being lower than the current NixOS release does NOT mean your system is - # out of date, out of support, or vulnerable. - # - # Do NOT change this value unless you have manually inspected all the changes it would make to your configuration, - # and migrated your data accordingly. - # - # For more information, see `man configuration.nix` or https://nixos.org/manual/nixos/stable/options#opt-system.sta> - system.stateVersion = "25.05"; # Did you read the comment? -} diff --git a/hosts/nix-cache/host.nix b/hosts/nix-cache/host.nix new file mode 100644 index 0000000..68b8313 --- /dev/null +++ b/hosts/nix-cache/host.nix @@ -0,0 +1,16 @@ +{ ... }: + +{ + networking.hostName = "nix-cache"; + + services.beszel.agent.environment = { + #DOCKER_HOST = "tcp://docker-socket-proxy:2375"; + #HUB_URL = "http://docker.sweet.home:8090"; + KEY = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFPR9kwtC4TAeTRu46A7+opZsYpxqkRJ+x/ZyB2GWCeG"; + TOKEN = "c9192e4c-7b5d-4910-8241-c2d68afadbac"; + }; + + # Preserved from the pre-refactor `nix-cache` target — stateVersion must + # never be bumped on an already-installed machine. + system.stateVersion = "25.05"; +} diff --git a/hosts/nix-minimal/configuration.nix b/hosts/nix-minimal/configuration.nix deleted file mode 100644 index 23147cc..0000000 --- a/hosts/nix-minimal/configuration.nix +++ /dev/null @@ -1,50 +0,0 @@ -# Edit this configuration file to define what should be installed on -# your system. Help is available in the configuration.nix(5) man page, on -# https://search.nixos.org/options and in the NixOS manual (`nixos-help`). - -{ config, lib, pkgs, ... }: - -{ - imports = - [ # Include the results of the hardware scan. - # inputs.disko.nixosModules.disko - ../../modules/common/configuration.nix - ../../modules/nix-cache/client.nix - ../../modules/remote-builder-client.nix - ../../modules/disko/proxmox.nix - ../../modules/boot/efi.nix - ]; - - networking.hostName = "nix-minimal"; # Define your hostname. - - - # Open ports in the firewall. -# networking.firewall.allowedTCPPorts = [ 80 8080 443 ]; - # networking.firewall.allowedUDPPorts = [ ... ]; - # Or disable the firewall altogether. - # networking.firewall.enable = false; - - # Copy the NixOS configuration file and link it from the resulting system - # (/run/current-system/configuration.nix). This is useful in case you - # accidentally delete configuration.nix. - # system.copySystemConfiguration = true; - - # This option defines the first version of NixOS you have installed on this particular machine, - # and is used to maintain compatibility with application data (e.g. databases) created on older NixOS versions. - # - # Most users should NEVER change this value after the initial install, for any reason, - # even if you've upgraded your system to a new NixOS release. - # - # This value does NOT affect the Nixpkgs version your packages and OS are pulled from, - # so changing it will NOT upgrade your system - see https://nixos.org/manual/nixos/stable/#sec-upgrading for how - # to actually do that. - # - # This value being lower than the current NixOS release does NOT mean your system is - # out of date, out of support, or vulnerable. - # - # Do NOT change this value unless you have manually inspected all the changes it would make to your configuration, - # and migrated your data accordingly. - # - # For more information, see `man configuration.nix` or https://nixos.org/manual/nixos/stable/options#opt-system.sta> - system.stateVersion = "25.05"; # Did you read the comment? -} diff --git a/hosts/nixos/configuration.nix b/hosts/nixos/configuration.nix deleted file mode 100644 index c81cb5e..0000000 --- a/hosts/nixos/configuration.nix +++ /dev/null @@ -1,135 +0,0 @@ -# Edit this configuration file to define what should be installed on -# your system. Help is available in the configuration.nix(5) man page -# and in the NixOS manual (accessible by running ‘nixos-help’). - -{ config, pkgs, lib, inputs, ... }: -let - nixosConfEditor = builtins.getFlake "github:snowfallorg/nixos-conf-editor"; -in { -#{ - environment.systemPackages = with pkgs; [ - inputs.nixos-conf-editor.packages.${pkgs.system}.nixos-conf-editor - nodejs - appimage-run - seahorse - vscode - p7zip - popsicle # balena-etcher - shotcut - gimp - pdfarranger - terminator - libreoffice-qt - transmission_4-qt - ]; - - - - imports = - [ # Include the results of the hardware scan. - ../../modules/common/configuration.nix - ../../modules/nix-cache/client.nix - ../../modules/remote-builder-client.nix - ../../modules/disko/proxmox.nix - ../../modules/boot/efi.nix - ]; - - # Bootloader. - boot.loader.grub.useOSProber = true; - - networking.hostName = "nixos"; # Define your hostname. - # networking.wireless.enable = true; # Enables wireless support via wpa_supplicant. - - # Select internationalisation properties. - # i18n.defaultLocale = "en_AU.UTF-8"; - - # i18n.extraLocaleSettings = { - # LC_ADDRESS = "en_AU.UTF-8"; - # LC_IDENTIFICATION = "en_AU.UTF-8"; - # LC_MEASUREMENT = "en_AU.UTF-8"; - # LC_MONETARY = "en_AU.UTF-8"; - # LC_NAME = "en_AU.UTF-8"; - # LC_NUMERIC = "en_AU.UTF-8"; - # LC_PAPER = "en_AU.UTF-8"; - # LC_TELEPHONE = "en_AU.UTF-8"; - # LC_TIME = "en_AU.UTF-8"; - # }; - - # Enable the X11 windowing system. - services.xserver.enable = true; - - # Enable the Cinnamon Desktop Environment. - services.xserver.displayManager.lightdm.enable = true; - services.xserver.desktopManager.cinnamon.enable = true; -# services.xserver.desktopManager.xfce.enable = true; - - # Configure keymap in X11 - services.xserver.xkb = { - layout = "au"; - variant = ""; - }; - - # Enable CUPS to print documents. - services.printing.enable = true; - - # Enable sound with pipewire. -# services.pulseaudio.enable = false; - security.rtkit.enable = true; - services.pipewire = { - enable = true; - alsa.enable = true; - alsa.support32Bit = true; - pulse.enable = true; - # If you want to use JACK applications, uncomment this - #jack.enable = true; - - # use the example session manager (no others are packaged yet so this is enabled by default, - # no need to redefine it in your config for now) - #media-session.enable = true; - }; - - # Enable touchpad support (enabled default in most desktopManager). - # services.xserver.libinput.enable = true; - - users.users.nixos.extraGroups = [ "networkmanager" ]; # Enable ‘sudo’ for the user. - - # Install firefox. - programs.firefox.enable = true; - - system.stateVersion = "25.05"; # Did you read the comment? - -services.xrdp.enable = true; -services.xrdp.defaultWindowManager = "cinnamon-session"; -services.xrdp.openFirewall = true; -nixpkgs.config.allowUnfree = true; - -services.gnome.gnome-keyring.enable = true; - -# security.pam.services.lightdm.enableGnomeKeyring = true; - -# services.gnome.gnome-keyring.enable = true; -security.pam.services.login.enableGnomeKeyring = true; - - services.xserver.displayManager.sessionCommands = '' - eval $(gnome-keyring-daemon --start --components=secrets,ssh) - export SSH_AUTH_SOCK - ''; - -# systemd.services.nextcloud-appimage = { -# enable = true; -# Unit = { -# Description = "Nextcloud AppImage client"; -# After = [ "graphical-session.target" ]; -# Wants = [ "graphical-session.target" ]; # optional but helpful -# }; -# Service = { -# ExecStart = "/run/current-system/sw/bin/appimage-run /home/nixos/Applications/Nextcloud.AppImage --background"; -# Restart = "on-failure"; -# # You can add RestartSec = "5s"; if you like -# }; -# Install = { -# WantedBy = [ "default.target" ]; -# }; -# }; - -} diff --git a/hosts/nixos/host.nix b/hosts/nixos/host.nix new file mode 100644 index 0000000..93c916d --- /dev/null +++ b/hosts/nixos/host.nix @@ -0,0 +1,9 @@ +{ ... }: + +{ + networking.hostName = "nixos"; + + # Preserved from the pre-refactor `nixos` target — stateVersion must never + # be bumped on an already-installed machine. + system.stateVersion = "25.05"; +} diff --git a/hosts/proxmox-minimal/host.nix b/hosts/proxmox-minimal/host.nix new file mode 100644 index 0000000..f1985a6 --- /dev/null +++ b/hosts/proxmox-minimal/host.nix @@ -0,0 +1,12 @@ +{ ... }: + +{ + # Preserves the hostname of the existing, already-deployed machine + # (previously the flat `nix-minimal` target) — the flake attribute name + # changed, the real machine's hostname did not. + networking.hostName = "nix-minimal"; + + # Preserved from the pre-refactor `nix-minimal` target — stateVersion must + # never be bumped on an already-installed machine. + system.stateVersion = "25.05"; +} diff --git a/hosts/pxe-boot/host.nix b/hosts/pxe-boot/host.nix new file mode 100644 index 0000000..e37020f --- /dev/null +++ b/hosts/pxe-boot/host.nix @@ -0,0 +1,9 @@ +{ ... }: + +{ + networking.hostName = "pxe-boot"; + + # Preserved from the pre-refactor `pxe-boot` target — stateVersion must + # never be bumped on an already-installed machine. + system.stateVersion = "25.05"; +} diff --git a/hosts/server/configuration.nix b/hosts/server/configuration.nix deleted file mode 100644 index d4befad..0000000 --- a/hosts/server/configuration.nix +++ /dev/null @@ -1,78 +0,0 @@ -# Edit this configuration file to define what should be installed on -# your system. Help is available in the configuration.nix(5) man page, on -# https://search.nixos.org/options and in the NixOS manual (`nixos-help`). - -{ config, lib, pkgs, inputs,... }: -{ - imports = - [ # Include the results of the hardware scan. - ../../modules/common/configuration.nix - ../../modules/nix-cache/client.nix - ../../modules/remote-builder-client.nix - ../../modules/beszel/enable-agent.nix - ../../modules/services/enable-rpcbind.nix - ../../modules/services/zfs/enable-service.nix -# ../../modules/services/zfs/auto-mount-volumes.nix - ../../modules/disko/proxmox.nix - ../../modules/boot/efi.nix - ]; - - - networking.hostName = "server"; # Define your hostname. - networking.hostId = "6689f93e"; - -boot.zfs.extraPools = [ "tank" ]; - -services.beszel.agent.environment = { -#DOCKER_HOST = "tcp://docker-socket-proxy:2375"; -#HUB_URL = "http://docker.sweet.home:8090"; -KEY = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFPR9kwtC4TAeTRu46A7+opZsYpxqkRJ+x/ZyB2GWCeG"; -TOKEN = "48e71783-35df-4ea0-a8c2-05bc5e020d2e"; -EXTRA_FILESYSTEMS="/tank/docker/volumes"; -LOG_LEVEL="debug"; -}; - - -systemd.services.nfs-server = { - after = [ "zfs-mount.service" ]; - requires = [ "zfs-mount.service" ]; -}; - -services.nfs.server = { - enable = true; - exports = '' - /tank/docker/config 192.168.2.0/24(rw,sync,no_subtree_check,no_root_squash) - /tank/docker/volumes 192.168.2.0/24(rw,sync,no_subtree_check,no_root_squash) - /tank/docker/databases 192.168.2.0/24(rw,sync,no_subtree_check,no_root_squash) - /tank/docker/nextcloud-data 192.168.2.0/24(rw,sync,no_subtree_check,no_root_squash) - /tank/raspi/volumes 192.168.2.0/24(rw,sync,no_subtree_check,no_root_squash) - ''; -}; - -networking.firewall.allowedTCPPorts = [ 111 2049 ]; - # networking.firewall.allowedUDPPorts = [ ... ]; - - # Copy the NixOS configuration file and link it from the resulting system - # (/run/current-system/configuration.nix). This is useful in case you - # accidentally delete configuration.nix. - # system.copySystemConfiguration = true; - - # This option defines the first version of NixOS you have installed on this particular machine, - # and is used to maintain compatibility with application data (e.g. databases) created on older NixOS versions. - # - # Most users should NEVER change this value after the initial install, for any reason, - # even if you've upgraded your system to a new NixOS release. - # - # This value does NOT affect the Nixpkgs version your packages and OS are pulled from, - # so changing it will NOT upgrade your system - see https://nixos.org/manual/nixos/stable/#sec-upgrading for how - # to actually do that. - # - # This value being lower than the current NixOS release does NOT mean your system is - # out of date, out of support, or vulnerable. - # - # Do NOT change this value unless you have manually inspected all the changes it would make to your configuration, - # and migrated your data accordingly. - # - # For more information, see `man configuration.nix` or https://nixos.org/manual/nixos/stable/options#opt-system.sta> - system.stateVersion = "25.05"; # Did you read the comment? -} diff --git a/hosts/server/host.nix b/hosts/server/host.nix new file mode 100644 index 0000000..bd35485 --- /dev/null +++ b/hosts/server/host.nix @@ -0,0 +1,19 @@ +{ ... }: + +{ + networking.hostName = "server"; + networking.hostId = "6689f93e"; + + services.beszel.agent.environment = { + #DOCKER_HOST = "tcp://docker-socket-proxy:2375"; + #HUB_URL = "http://docker.sweet.home:8090"; + KEY = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFPR9kwtC4TAeTRu46A7+opZsYpxqkRJ+x/ZyB2GWCeG"; + TOKEN = "48e71783-35df-4ea0-a8c2-05bc5e020d2e"; + EXTRA_FILESYSTEMS = "/tank/docker/volumes"; + LOG_LEVEL = "debug"; + }; + + # Preserved from the pre-refactor `server` target — stateVersion must never + # be bumped on an already-installed machine. + system.stateVersion = "25.05"; +} diff --git a/modules/build-types/docker.nix b/modules/build-types/docker.nix new file mode 100644 index 0000000..2572051 --- /dev/null +++ b/modules/build-types/docker.nix @@ -0,0 +1,40 @@ +{ pkgs, ... }: + +{ + # Pins the Docker Engine version, carried forward from the pre-refactor + # `docker` target's inline pkgs overlay. + nixpkgs.overlays = [ + (final: prev: { + docker = prev.docker_29; + docker_cli = prev.docker_29; + }) + ]; + + imports = [ + ../docker/mount-data.nix + ../docker/enable-service.nix + ../tailscale/enable-service.nix + ../rotate-traefik-logs.nix + ../raspi/mount-data.nix + ../services/nextcloud-cron-job.nix + ../services/docker-health-to-gotify.nix + ../services/enable-rpcbind.nix + ]; + + environment.systemPackages = with pkgs; [ + nfs-utils + ]; + + boot.supportedFilesystems = [ "nfs" ]; + + systemd.tmpfiles.rules = [ + "L+ /home/nixos/docker - - - - /mnt/docker/config" + "d /mnt/docker 0755 nixos users -" + "d /mnt/raspi-backup 0755 nixos users -" + ]; + + users.users.nixos.extraGroups = [ "docker" ]; + services.openssh.settings.PermitRootLogin = "yes"; + + networking.firewall.allowedTCPPorts = [ 80 8080 443 8090 ]; +} diff --git a/modules/build-types/gui.nix b/modules/build-types/gui.nix new file mode 100644 index 0000000..4215bd4 --- /dev/null +++ b/modules/build-types/gui.nix @@ -0,0 +1,57 @@ +{ config, pkgs, lib, inputs, ... }: + +{ + environment.systemPackages = with pkgs; [ + inputs.nixos-conf-editor.packages.${pkgs.system}.nixos-conf-editor + nodejs + appimage-run + seahorse + vscode + p7zip + popsicle # balena-etcher + shotcut + gimp + pdfarranger + terminator + libreoffice-qt + transmission_4-qt + ]; + + boot.loader.grub.useOSProber = true; + + services.xserver.enable = true; + services.xserver.displayManager.lightdm.enable = true; + services.xserver.desktopManager.cinnamon.enable = true; + + services.xserver.xkb = { + layout = "au"; + variant = ""; + }; + + services.printing.enable = true; + + security.rtkit.enable = true; + services.pipewire = { + enable = true; + alsa.enable = true; + alsa.support32Bit = true; + pulse.enable = true; + }; + + users.users.nixos.extraGroups = [ "networkmanager" ]; + + programs.firefox.enable = true; + + services.xrdp.enable = true; + services.xrdp.defaultWindowManager = "cinnamon-session"; + services.xrdp.openFirewall = true; + nixpkgs.config.allowUnfree = true; + + services.gnome.gnome-keyring.enable = true; + security.pam.services.login.enableGnomeKeyring = true; + + services.xserver.displayManager.sessionCommands = '' + eval $(gnome-keyring-daemon --start --components=secrets,ssh) + export SSH_AUTH_SOCK + ''; +} diff --git a/modules/build-types/minimal.nix b/modules/build-types/minimal.nix new file mode 100644 index 0000000..f0a0733 --- /dev/null +++ b/modules/build-types/minimal.nix @@ -0,0 +1,13 @@ +{ pkgs, ... }: + +{ + networking.networkmanager.enable = true; + + users.users.nixos.extraGroups = [ "networkmanager" ]; + + environment.systemPackages = with pkgs; [ + inetutils + mtr + sysstat + ]; +} diff --git a/modules/build-types/nix-cache.nix b/modules/build-types/nix-cache.nix new file mode 100644 index 0000000..2647b41 --- /dev/null +++ b/modules/build-types/nix-cache.nix @@ -0,0 +1,8 @@ +{ ... }: + +{ + imports = [ + ../nix-cache/server.nix + ../beszel/enable-agent.nix + ]; +} diff --git a/hosts/pxe-boot/configuration.nix b/modules/build-types/pxe-boot.nix similarity index 92% rename from hosts/pxe-boot/configuration.nix rename to modules/build-types/pxe-boot.nix index 2f7f6cd..08bd9f7 100644 --- a/hosts/pxe-boot/configuration.nix +++ b/modules/build-types/pxe-boot.nix @@ -91,17 +91,6 @@ let ''; in { - imports = - [ - ../../modules/common/configuration.nix - ../../modules/nix-cache/client.nix - ../../modules/remote-builder-client.nix - ../../modules/disko/proxmox.nix - ../../modules/boot/efi.nix - ]; - - networking.hostName = "pxe-boot"; - environment.systemPackages = with pkgs; [ ipxe ]; @@ -164,6 +153,4 @@ in networking.firewall.allowedTCPPorts = [ 80 ]; networking.firewall.allowedUDPPorts = [ 69 ]; - - system.stateVersion = "25.05"; } diff --git a/modules/build-types/server.nix b/modules/build-types/server.nix new file mode 100644 index 0000000..ae62882 --- /dev/null +++ b/modules/build-types/server.nix @@ -0,0 +1,28 @@ +{ ... }: + +{ + imports = [ + ../beszel/enable-agent.nix + ../services/zfs/enable-service.nix + ]; + + boot.zfs.extraPools = [ "tank" ]; + + systemd.services.nfs-server = { + after = [ "zfs-mount.service" ]; + requires = [ "zfs-mount.service" ]; + }; + + services.nfs.server = { + enable = true; + exports = '' + /tank/docker/config 192.168.2.0/24(rw,sync,no_subtree_check,no_root_squash) + /tank/docker/volumes 192.168.2.0/24(rw,sync,no_subtree_check,no_root_squash) + /tank/docker/databases 192.168.2.0/24(rw,sync,no_subtree_check,no_root_squash) + /tank/docker/nextcloud-data 192.168.2.0/24(rw,sync,no_subtree_check,no_root_squash) + /tank/raspi/volumes 192.168.2.0/24(rw,sync,no_subtree_check,no_root_squash) + ''; + }; + + networking.firewall.allowedTCPPorts = [ 111 2049 ]; +} diff --git a/modules/common/aliases.nix b/modules/common/aliases.nix index a0a32cf..4d08451 100644 --- a/modules/common/aliases.nix +++ b/modules/common/aliases.nix @@ -1,19 +1,24 @@ { config, pkgs, lib, ... }: let + # Flake attribute names are now - (e.g. proxmox-docker) + # and no longer match networking.hostName, since a host's hostname stays + # fixed while the platform backing it can change. Each nixosConfiguration + # stamps its own active target name into /etc/flake-target at build time. mySwitchCmd = '' sudo nixos-rebuild switch \ --no-write-lock-file \ --refresh \ - --flake git+https://gitea.lan.ddnsgeek.com/beatzaplenty/nixos.git#$(hostname) + --flake git+https://gitea.lan.ddnsgeek.com/beatzaplenty/nixos.git#$(cat /etc/flake-target) ''; myTestCmd = '' sudo nixos-rebuild test \ --no-write-lock-file \ --refresh \ - --flake git+https://gitea.lan.ddnsgeek.com/beatzaplenty/nixos.git#$(hostname) + --flake git+https://gitea.lan.ddnsgeek.com/beatzaplenty/nixos.git#$(cat /etc/flake-target) ''; -in { +in +{ programs.bash = { enable = true; shellAliases = { diff --git a/modules/platforms/linode.nix b/modules/platforms/linode.nix new file mode 100644 index 0000000..08ede8d --- /dev/null +++ b/modules/platforms/linode.nix @@ -0,0 +1,13 @@ +{ ... }: + +{ + imports = [ + ../hardware-configuration/vm/linode.nix + ]; + + networking = { + usePredictableInterfaceNames = false; + useDHCP = false; + interfaces.eth0.useDHCP = true; + }; +} diff --git a/modules/platforms/lxc.nix b/modules/platforms/lxc.nix new file mode 100644 index 0000000..77fe82c --- /dev/null +++ b/modules/platforms/lxc.nix @@ -0,0 +1,8 @@ +{ ... }: + +{ + boot.isContainer = true; + + boot.loader.grub.enable = false; + boot.loader.systemd-boot.enable = false; +} diff --git a/modules/platforms/proxmox.nix b/modules/platforms/proxmox.nix new file mode 100644 index 0000000..a5860a6 --- /dev/null +++ b/modules/platforms/proxmox.nix @@ -0,0 +1,9 @@ +{ ... }: + +{ + imports = [ + ../hardware-configuration/vm/proxmox.nix + ../boot/efi.nix + ../disko/proxmox.nix + ]; +}