From eadb1e35ce9a7c6db67a503ab75c38c9c31434a0 Mon Sep 17 00:00:00 2001 From: beatzaplenty Date: Sun, 19 Jul 2026 14:51:37 +1000 Subject: [PATCH] Centralize shared values into variables.nix MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit One file (variables.nix) holding every value that was previously hardcoded and repeated across modules: LAN domain/CIDR, home/tailnet domains, cross-host references (nix-cache substituter hostname, NFS server hostname, remote-builder user), PXE/PBS IPs, timezone, and the primary username. Wired in via flake.nix's specialArgs (and home-manager's extraSpecialArgs for the two home.nix files), so any module picks it up by just adding `vars` to its function arguments — no explicit import needed. Two hosts (nix-cache, server) now derive their own networking.hostName from the same variable other hosts use to reach them, so there's exactly one place to change either identifier. Purely mechanical: every substituted value matches what was already there, confirmed by identical toplevel .drv paths for all 17 targets before and after. Co-Authored-By: Claude Sonnet 5 --- README.md | 1 + flake.nix | 4 +- hosts/nix-cache/host.nix | 4 +- hosts/nixos/home.nix | 100 +++++++++---------- hosts/server/host.nix | 6 +- modules/beszel/enable-agent.nix | 12 +-- modules/build-types/pxe-boot.nix | 4 +- modules/build-types/server.nix | 14 +-- modules/common/aliases.nix | 6 +- modules/common/configuration.nix | 39 ++++---- modules/common/home.nix | 63 ++++++------ modules/docker/mount-data.nix | 16 +-- modules/nix-cache/client.nix | 4 +- modules/nix-cache/server.nix | 24 +++-- modules/raspi/mount-data.nix | 38 +++---- modules/remote-builder-client.nix | 8 +- modules/services/docker-health-to-gotify.nix | 8 +- modules/services/nextcloud-cron-job.nix | 34 +++---- modules/tailscale/exit-node.nix | 4 +- variables.nix | 21 ++++ 20 files changed, 219 insertions(+), 191 deletions(-) create mode 100644 variables.nix diff --git a/README.md b/README.md index 590b2da..5964e05 100644 --- a/README.md +++ b/README.md @@ -46,6 +46,7 @@ nix eval --json .#nixosConfigurations --apply builtins.attrNames | jq -r '.[]' | Path | Purpose | | --- | --- | | `flake.nix` | Flake inputs, the `mkTarget` platform × build-type generator, and `nixosConfigurations` outputs | +| `variables.nix` | Single source of truth for shared values (LAN domain/CIDR, hostnames, timezone, primary username, storage root, ...) — passed to every module and Home Manager config as the `vars` argument via `specialArgs`/`extraSpecialArgs` | | `hosts//host.nix` | Per-machine identity: hostname, hostId, per-machine secrets, `system.stateVersion` | | `hosts/nixos/home.nix` | Workstation-specific Home Manager config (used by the `gui` build type) | | `modules/platforms/` | Platform-specific config: virtualisation guest tools, boot method, hardware config (`linode.nix`, `proxmox.nix`, `lxc.nix`) | diff --git a/flake.nix b/flake.nix index 644e8cf..9bd6053 100644 --- a/flake.nix +++ b/flake.nix @@ -23,6 +23,7 @@ let system = "x86_64-linux"; inherit (nixpkgs) lib; + vars = import ./variables.nix; # Generates a nixosConfiguration from a platform (what it runs on) and # a build type (what it's for), plus the per-identity host.nix that @@ -46,6 +47,7 @@ home-manager = { useGlobalPkgs = true; useUserPackages = true; + extraSpecialArgs = { inherit vars; }; users.nixos = import homeFile; }; } @@ -53,7 +55,7 @@ ./modules/nix-cache/client.nix ./modules/remote-builder-client.nix ]; - specialArgs = { inherit inputs; }; + specialArgs = { inherit inputs vars; }; }; # Generated platform x build-type matrix. pxe-boot has no linode diff --git a/hosts/nix-cache/host.nix b/hosts/nix-cache/host.nix index 971f247..53188f2 100644 --- a/hosts/nix-cache/host.nix +++ b/hosts/nix-cache/host.nix @@ -1,7 +1,7 @@ -{ config, ... }: +{ config, vars, ... }: { - networking.hostName = "nix-cache"; + networking.hostName = vars.nixCacheHost; sops.secrets."beszel-token".sopsFile = ../../secrets/nix-cache.yaml; sops.templates."nix-cache-beszel.env".content = '' diff --git a/hosts/nixos/home.nix b/hosts/nixos/home.nix index 3569aa1..eefc6e2 100644 --- a/hosts/nixos/home.nix +++ b/hosts/nixos/home.nix @@ -1,16 +1,16 @@ -{ config, pkgs, lib, ... }: +{ config, pkgs, lib, vars, ... }: { - imports = [ + imports = [ ../../modules/common/aliases.nix ]; - home.username = "nixos"; # your actual username - home.homeDirectory = "/home/nixos"; - home.stateVersion = "25.05"; # match your NixOS stateVersion + home.username = vars.primaryUser; + home.homeDirectory = "/home/${vars.primaryUser}"; + home.stateVersion = "25.05"; # match your NixOS stateVersion - programs.home-manager.enable = true; # mandatory to activate HM + programs.home-manager.enable = true; # mandatory to activate HM # Optional: packages home.packages = with pkgs; [ @@ -18,7 +18,7 @@ vim tmux nextcloud-client -# vscode + # vscode chromium ]; @@ -29,51 +29,51 @@ # Optional: enable bash (or zsh, fish...) programs.bash.enable = true; - services.nextcloud-client = { + services.nextcloud-client = { enable = true; # Optionally start in background directly startInBackground = true; }; -home.file = { - ".local/share/applications/proxmox-chromium-app.desktop".text = '' - [Desktop Entry] - Type=Application - Name=Proxmox (Chromium) - Exec=chromium --app=https://pve.sweet.home:8006 --window-size=1920,1080 --window-position=0,0 - Icon=/home/nixos/.local/share/icons/proxmox.png - Terminal=false - Categories=Hypervisor; - StartupWMClass=PVE - ''; - ".local/share/applications/pbs-chromium-app.desktop".text = '' - [Desktop Entry] - Type=Application - Name=Proxmox Backup Server (Chromium) - Exec=chromium --app=https://192.168.2.108:8007 --window-size=1920,1080 --window-position=0,0 - Icon=/home/nixos/.local/share/icons/proxmox.png - Terminal=false - Categories=backup; + home.file = { + ".local/share/applications/proxmox-chromium-app.desktop".text = '' + [Desktop Entry] + Type=Application + Name=Proxmox (Chromium) + Exec=chromium --app=https://pve.${vars.homeDomain}:8006 --window-size=1920,1080 --window-position=0,0 + Icon=${config.home.homeDirectory}/.local/share/icons/proxmox.png + Terminal=false + Categories=Hypervisor; + StartupWMClass=PVE + ''; + ".local/share/applications/pbs-chromium-app.desktop".text = '' + [Desktop Entry] + Type=Application + Name=Proxmox Backup Server (Chromium) + Exec=chromium --app=https://${vars.pbsIp}:8007 --window-size=1920,1080 --window-position=0,0 + Icon=${config.home.homeDirectory}/.local/share/icons/proxmox.png + Terminal=false + Categories=backup; - ''; - ".local/share/applications/proxmox-firefox-app.desktop".text = '' - [Desktop Entry] - Type=Application - Name=Proxmox (Firefox) - Exec=firefox --new-instance https://pve.sweet.home:8006 --profile ProxmoxWebApp --window-size=1920,1080 --class ProxmoxWebApp - Icon=/home/nixos/.local/share/icons/proxmox.png - Terminal=false - Categories=Hypervisor; - StartupWMClass=PVE - ''; - ".local/share/applications/pbs-firefox-app.desktop".text = '' - [Desktop Entry] - Type=Application - Name=Proxmox Backup Server (Firefox) - Exec=firefox --new-window https://192.168.2.108:8007 --profile PbsWebApp --window-size=1920,1080 --class PbsWebApp - Icon=/home/nixos/.local/share/icons/proxmox.png - Terminal=false - Categories=backup; - StartupWMClass=PBS - ''; -}; -} \ No newline at end of file + ''; + ".local/share/applications/proxmox-firefox-app.desktop".text = '' + [Desktop Entry] + Type=Application + Name=Proxmox (Firefox) + Exec=firefox --new-instance https://pve.${vars.homeDomain}:8006 --profile ProxmoxWebApp --window-size=1920,1080 --class ProxmoxWebApp + Icon=${config.home.homeDirectory}/.local/share/icons/proxmox.png + Terminal=false + Categories=Hypervisor; + StartupWMClass=PVE + ''; + ".local/share/applications/pbs-firefox-app.desktop".text = '' + [Desktop Entry] + Type=Application + Name=Proxmox Backup Server (Firefox) + Exec=firefox --new-window https://${vars.pbsIp}:8007 --profile PbsWebApp --window-size=1920,1080 --class PbsWebApp + Icon=${config.home.homeDirectory}/.local/share/icons/proxmox.png + Terminal=false + Categories=backup; + StartupWMClass=PBS + ''; + }; +} diff --git a/hosts/server/host.nix b/hosts/server/host.nix index c753856..e725cab 100644 --- a/hosts/server/host.nix +++ b/hosts/server/host.nix @@ -1,7 +1,7 @@ -{ config, ... }: +{ config, vars, ... }: { - networking.hostName = "server"; + networking.hostName = vars.nfsServerHost; networking.hostId = "6689f93e"; sops.secrets."beszel-token".sopsFile = ../../secrets/server.yaml; @@ -13,7 +13,7 @@ #DOCKER_HOST = "tcp://docker-socket-proxy:2375"; #HUB_URL = "http://docker.sweet.home:8090"; KEY = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFPR9kwtC4TAeTRu46A7+opZsYpxqkRJ+x/ZyB2GWCeG"; - EXTRA_FILESYSTEMS = "/tank/docker/volumes"; + EXTRA_FILESYSTEMS = "${vars.storageRoot}/docker/volumes"; LOG_LEVEL = "debug"; }; services.beszel.agent.environmentFile = config.sops.templates."server-beszel.env".path; diff --git a/modules/beszel/enable-agent.nix b/modules/beszel/enable-agent.nix index fb7d2cd..42aa4c7 100644 --- a/modules/beszel/enable-agent.nix +++ b/modules/beszel/enable-agent.nix @@ -1,9 +1,9 @@ -{ ... }: +{ vars, ... }: { -services.beszel.agent.enable = true; -services.beszel.agent.environment = { -#DOCKER_HOST = "tcp://docker-socket-proxy:2375"; -HUB_URL = "http://docker.sweet.home:8090"; -}; + services.beszel.agent.enable = true; + services.beszel.agent.environment = { + #DOCKER_HOST = "tcp://docker-socket-proxy:2375"; + HUB_URL = "http://docker.${vars.homeDomain}:8090"; + }; } diff --git a/modules/build-types/pxe-boot.nix b/modules/build-types/pxe-boot.nix index 08bd9f7..56a8e55 100644 --- a/modules/build-types/pxe-boot.nix +++ b/modules/build-types/pxe-boot.nix @@ -1,10 +1,10 @@ -{ config, lib, pkgs, inputs, ... }: +{ config, lib, pkgs, inputs, vars, ... }: let pxeRoot = "/srv/pxe"; httpRoot = "${pxeRoot}/http"; tftpRoot = "${pxeRoot}/tftp"; - pxeBaseUrl = "http://192.168.2.247"; + pxeBaseUrl = "http://${vars.pxeServerIp}"; bootIpxe = pkgs.writeText "boot.ipxe" '' #!ipxe diff --git a/modules/build-types/server.nix b/modules/build-types/server.nix index ae62882..ba6d3b6 100644 --- a/modules/build-types/server.nix +++ b/modules/build-types/server.nix @@ -1,4 +1,4 @@ -{ ... }: +{ vars, lib, ... }: { imports = [ @@ -6,7 +6,7 @@ ../services/zfs/enable-service.nix ]; - boot.zfs.extraPools = [ "tank" ]; + boot.zfs.extraPools = [ (lib.removePrefix "/" vars.storageRoot) ]; systemd.services.nfs-server = { after = [ "zfs-mount.service" ]; @@ -16,11 +16,11 @@ services.nfs.server = { enable = true; exports = '' - /tank/docker/config 192.168.2.0/24(rw,sync,no_subtree_check,no_root_squash) - /tank/docker/volumes 192.168.2.0/24(rw,sync,no_subtree_check,no_root_squash) - /tank/docker/databases 192.168.2.0/24(rw,sync,no_subtree_check,no_root_squash) - /tank/docker/nextcloud-data 192.168.2.0/24(rw,sync,no_subtree_check,no_root_squash) - /tank/raspi/volumes 192.168.2.0/24(rw,sync,no_subtree_check,no_root_squash) + ${vars.storageRoot}/docker/config ${vars.lanCidr}(rw,sync,no_subtree_check,no_root_squash) + ${vars.storageRoot}/docker/volumes ${vars.lanCidr}(rw,sync,no_subtree_check,no_root_squash) + ${vars.storageRoot}/docker/databases ${vars.lanCidr}(rw,sync,no_subtree_check,no_root_squash) + ${vars.storageRoot}/docker/nextcloud-data ${vars.lanCidr}(rw,sync,no_subtree_check,no_root_squash) + ${vars.storageRoot}/raspi/volumes ${vars.lanCidr}(rw,sync,no_subtree_check,no_root_squash) ''; }; diff --git a/modules/common/aliases.nix b/modules/common/aliases.nix index 4d08451..41bddc1 100644 --- a/modules/common/aliases.nix +++ b/modules/common/aliases.nix @@ -1,4 +1,4 @@ -{ config, pkgs, lib, ... }: +{ config, pkgs, lib, vars, ... }: let # Flake attribute names are now - (e.g. proxmox-docker) @@ -9,13 +9,13 @@ let sudo nixos-rebuild switch \ --no-write-lock-file \ --refresh \ - --flake git+https://gitea.lan.ddnsgeek.com/beatzaplenty/nixos.git#$(cat /etc/flake-target) + --flake git+https://${vars.lanDomain}/beatzaplenty/nixos.git#$(cat /etc/flake-target) ''; myTestCmd = '' sudo nixos-rebuild test \ --no-write-lock-file \ --refresh \ - --flake git+https://gitea.lan.ddnsgeek.com/beatzaplenty/nixos.git#$(cat /etc/flake-target) + --flake git+https://${vars.lanDomain}/beatzaplenty/nixos.git#$(cat /etc/flake-target) ''; in { diff --git a/modules/common/configuration.nix b/modules/common/configuration.nix index a3e1834..6920607 100644 --- a/modules/common/configuration.nix +++ b/modules/common/configuration.nix @@ -1,29 +1,30 @@ -{ config, lib, pkgs, ... }: +{ config, lib, pkgs, vars, ... }: { - imports = - [ # Include the results of the hardware scan. -# ./hardware-configuration.nix + imports = + [ + # Include the results of the hardware scan. + # ./hardware-configuration.nix ../set-locale.nix ]; # Use the GRUB 2 boot loader. # boot.loader.grub.enable = true; #boot.loader.grub.device = "/dev/sda"; # or "nodev" for efi only - networking.networkmanager.enable = true; # Easiest to use and most distros use this by default. + networking.networkmanager.enable = true; # Easiest to use and most distros use this by default. # Set your time zone. - time.timeZone = "Australia/Brisbane"; + time.timeZone = vars.timeZone; # Enable QEMU agent services.qemuGuest.enable = true; - # Enable docker-compose + # Enable docker-compose environment.systemPackages = with pkgs; [ - vim - btop - git - gcr + vim + btop + git + gcr ]; # Secrets shared by every host, decrypted at activation via each host's @@ -47,13 +48,13 @@ !include ${config.sops.templates."nix-github-token.conf".path} ''; -#Set root password -users.users.root = { - hashedPasswordFile = config.sops.secrets."root-hashedPassword".path; -}; + #Set root password + users.users.root = { + hashedPasswordFile = config.sops.secrets."root-hashedPassword".path; + }; # Define a user account. Don't forget to set a password with ‘passwd’. - users.users.nixos = { + users.users.${vars.primaryUser} = { isNormalUser = true; extraGroups = [ "wheel" ]; # Enable ‘sudo’ for the user. packages = with pkgs; [ @@ -61,8 +62,8 @@ users.users.root = { ]; hashedPasswordFile = config.sops.secrets."nixos-hashedPassword".path; openssh.authorizedKeys.keys = [ - "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCq/Q5LvIXlZwO2kdeAN5nLGZ59nZB7JHYMEszHxmNtGMzv1lM31jiPNsr0z2EKVZhE7OOfa2IF9rhWYD7JUA9G0yzdZ4WTXFNGVVOJoOVH6vAF3XCxoVilOEwTc7h2Wiy+rzd0B28/3spffzQQWJhY6GRQVa8j+6xAGF60Fcvl1vLosYT9Bn2ZbK4TCWOwAn2jqXIieGpZdn/UNZbGOeKRiCvhktDfMAzuQzN/9jMu/oF4pkPn2X1UrsQdNlvp0Ci8md612MozIpncQJyAF1ADhunr3sMx0isUXiqD29R5DS4TftpekqLNLak+zcxFa8N7DcRNp3DcKfJvyTkwQrR4r+b7lFLYOLHLagSso9CzeW/paAS2q9I5SBm/2DtE1diLLg2jZikYcstsu/G5RgvbzbKqjiaMwTdXC3AMvDxQrs7U5pDRZFzoofG3cpODbTm+uy3m0kP70z0M1K45UbDG0p+itnTu9x40JbQEgefbx38AItNvAIx1A8HO4I1VX28= wayne@stream" - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICMJhrfFayLBG+gWtO6oAvgambw5nWWgztiTFEaaaVRH debian@surface" + "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCq/Q5LvIXlZwO2kdeAN5nLGZ59nZB7JHYMEszHxmNtGMzv1lM31jiPNsr0z2EKVZhE7OOfa2IF9rhWYD7JUA9G0yzdZ4WTXFNGVVOJoOVH6vAF3XCxoVilOEwTc7h2Wiy+rzd0B28/3spffzQQWJhY6GRQVa8j+6xAGF60Fcvl1vLosYT9Bn2ZbK4TCWOwAn2jqXIieGpZdn/UNZbGOeKRiCvhktDfMAzuQzN/9jMu/oF4pkPn2X1UrsQdNlvp0Ci8md612MozIpncQJyAF1ADhunr3sMx0isUXiqD29R5DS4TftpekqLNLak+zcxFa8N7DcRNp3DcKfJvyTkwQrR4r+b7lFLYOLHLagSso9CzeW/paAS2q9I5SBm/2DtE1diLLg2jZikYcstsu/G5RgvbzbKqjiaMwTdXC3AMvDxQrs7U5pDRZFzoofG3cpODbTm+uy3m0kP70z0M1K45UbDG0p+itnTu9x40JbQEgefbx38AItNvAIx1A8HO4I1VX28= wayne@stream" + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICMJhrfFayLBG+gWtO6oAvgambw5nWWgztiTFEaaaVRH debian@surface" ]; }; @@ -88,4 +89,4 @@ users.users.root = { -} \ No newline at end of file +} diff --git a/modules/common/home.nix b/modules/common/home.nix index 143935d..2edb92e 100644 --- a/modules/common/home.nix +++ b/modules/common/home.nix @@ -1,22 +1,23 @@ -{ config, pkgs, lib, ... }: +{ config, pkgs, lib, vars, ... }: let remote = "root@proxmox-ip:/var/lib/vz/template/iso"; localMount = "${config.home.homeDirectory}/proxmox-iso"; -in { +in +{ imports = [ ./aliases.nix ]; - home.username = "nixos"; # your actual username - home.homeDirectory = "/home/nixos"; - home.stateVersion = "25.11"; # match your NixOS stateVersion + home.username = vars.primaryUser; + home.homeDirectory = "/home/${vars.primaryUser}"; + home.stateVersion = "25.11"; # match your NixOS stateVersion + + programs.home-manager.enable = true; # mandatory to activate HM + + programs.bash.enable = true; - programs.home-manager.enable = true; # mandatory to activate HM - -programs.bash.enable = true; - # GitHub access-tokens setting used to live here in plaintext; it's now # rendered system-wide from a sops-nix secret via nix.extraOptions in # modules/common/configuration.nix instead (covers the daemon for every @@ -35,31 +36,31 @@ programs.bash.enable = true; home.sessionVariables = { EDITOR = "nano"; }; -# systemd.user.services.mount-proxmox-iso = { -# Unit = { -# Description = "Mount Proxmox ISO dir via SSHFS"; -# After = [ "network-online.target" ]; -# Wants = [ "network-online.target" ]; -# }; + # systemd.user.services.mount-proxmox-iso = { + # Unit = { + # Description = "Mount Proxmox ISO dir via SSHFS"; + # After = [ "network-online.target" ]; + # Wants = [ "network-online.target" ]; + # }; -# Service = { -# Type = "simple"; -# ExecStartPre = "${pkgs.coreutils}/bin/mkdir -p ${localMount}"; -# ExecStart = "${pkgs.sshfs}/bin/sshfs -o IdentityFile=${config.home.homeDirectory}/.ssh/id_ed25519,allow_other,reconnect,ServerAliveInterval=15,ServerAliveCountMax=3 root@proxmox-ip:/var/lib/vz/template/iso ${localMount}"; -# ExecStop = "${pkgs.fuse3}/bin/fusermount3 -u ${localMount}"; -# Restart = "on-failure"; -# }; + # Service = { + # Type = "simple"; + # ExecStartPre = "${pkgs.coreutils}/bin/mkdir -p ${localMount}"; + # ExecStart = "${pkgs.sshfs}/bin/sshfs -o IdentityFile=${config.home.homeDirectory}/.ssh/id_ed25519,allow_other,reconnect,ServerAliveInterval=15,ServerAliveCountMax=3 root@proxmox-ip:/var/lib/vz/template/iso ${localMount}"; + # ExecStop = "${pkgs.fuse3}/bin/fusermount3 -u ${localMount}"; + # Restart = "on-failure"; + # }; -# Install = { -# WantedBy = [ "default.target" ]; -# }; -# }; + # Install = { + # WantedBy = [ "default.target" ]; + # }; + # }; # Optional: enable bash (or zsh, fish...) -# programs.bash.enable = true; + # programs.bash.enable = true; # Optional: manage dotfiles via symlinks -# home.file = { -# ".tmux.conf".source = ./dotfiles/tmux.conf; -# ".config/nvim/init.vim".source = ./dotfiles/init.vim; -# }; + # home.file = { + # ".tmux.conf".source = ./dotfiles/tmux.conf; + # ".config/nvim/init.vim".source = ./dotfiles/init.vim; + # }; } diff --git a/modules/docker/mount-data.nix b/modules/docker/mount-data.nix index 412acaa..557d4a3 100644 --- a/modules/docker/mount-data.nix +++ b/modules/docker/mount-data.nix @@ -1,8 +1,8 @@ -{ config, lib, pkgs, ... }: +{ config, lib, pkgs, vars, ... }: { fileSystems."/mnt/docker/config" = { - device = "server:/tank/docker/config"; + device = "${vars.nfsServerHost}:${vars.storageRoot}/docker/config"; fsType = "nfs"; options = [ @@ -14,7 +14,7 @@ }; fileSystems."/mnt/docker/databases" = { - device = "server:/tank/docker/databases"; + device = "${vars.nfsServerHost}:${vars.storageRoot}/docker/databases"; fsType = "nfs"; options = [ @@ -26,7 +26,7 @@ }; fileSystems."/mnt/docker/volumes" = { - device = "server:/tank/docker/volumes"; + device = "${vars.nfsServerHost}:${vars.storageRoot}/docker/volumes"; fsType = "nfs"; options = [ @@ -37,8 +37,8 @@ ]; }; - fileSystems."/mnt/nextcloud-data" = { - device = "server:/tank/docker/nextcloud-data"; + fileSystems."/mnt/nextcloud-data" = { + device = "${vars.nfsServerHost}:${vars.storageRoot}/docker/nextcloud-data"; fsType = "nfs"; options = [ @@ -49,8 +49,8 @@ ]; }; - fileSystems."/mnt/raspi-backup" = { - device = "server:/tank/raspi/volumes"; + fileSystems."/mnt/raspi-backup" = { + device = "${vars.nfsServerHost}:${vars.storageRoot}/raspi/volumes"; fsType = "nfs"; options = [ diff --git a/modules/nix-cache/client.nix b/modules/nix-cache/client.nix index ab60f0c..a1b2009 100644 --- a/modules/nix-cache/client.nix +++ b/modules/nix-cache/client.nix @@ -1,9 +1,9 @@ -{ ... }: +{ vars, ... }: { nix.settings = { substituters = [ - "http://nix-cache" + "http://${vars.nixCacheHost}" "https://cache.nixos.org/" ]; trusted-public-keys = [ diff --git a/modules/nix-cache/server.nix b/modules/nix-cache/server.nix index 9490484..de632c2 100644 --- a/modules/nix-cache/server.nix +++ b/modules/nix-cache/server.nix @@ -1,4 +1,4 @@ -{ config, pkgs, ... }: +{ config, pkgs, vars, ... }: { # Generate the binary cache key pair on the nix-cache host: @@ -17,7 +17,7 @@ services.nginx = { enable = true; recommendedProxySettings = true; - virtualHosts."nix-cache" = { + virtualHosts.${vars.nixCacheHost} = { locations."/" = { proxyPass = "http://${config.services.nix-serve.bindAddress}:${toString config.services.nix-serve.port}"; }; @@ -26,11 +26,11 @@ networking.firewall.allowedTCPPorts = [ 80 ]; - users.groups.nixremote = {}; + users.groups.${vars.remoteBuilderUser} = { }; - users.users.nixremote = { + users.users.${vars.remoteBuilderUser} = { isSystemUser = true; - group = "nixremote"; + group = vars.remoteBuilderUser; createHome = true; home = "/var/lib/nixremote"; shell = pkgs.bashInteractive; @@ -38,17 +38,19 @@ # openssh.authorizedKeys.keys = [ "ssh-ed25519 AAAA... client@host" ]; # # Avoid absolute keyFiles paths here because they break pure flake evaluation. - openssh.authorizedKeys.keys = ["ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFDEA1S2ikpObREgbP5uVBWMxIOGbY8B+Wx7VTZK1m6t root@server" - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPAYIT9ormlmxZ0SziyDQaUntnKI8HK9/s3Qac1ZKjP2 root@docker" - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKKKzoEPl/ZW9KBRHBcp6/ThOngGpwMv5EhkTlgC4aDf root@nixos" - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIGtOWOCS+ImHc7NehguoyD7PbonGosKMZqc9+QR3v/h root@nixos" - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHxXTQxFnArK5HXG7czeoybZebCGfxpUdusJkPn+BCSp root@server"]; + openssh.authorizedKeys.keys = [ + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFDEA1S2ikpObREgbP5uVBWMxIOGbY8B+Wx7VTZK1m6t root@server" + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPAYIT9ormlmxZ0SziyDQaUntnKI8HK9/s3Qac1ZKjP2 root@docker" + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKKKzoEPl/ZW9KBRHBcp6/ThOngGpwMv5EhkTlgC4aDf root@nixos" + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIGtOWOCS+ImHc7NehguoyD7PbonGosKMZqc9+QR3v/h root@nixos" + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHxXTQxFnArK5HXG7czeoybZebCGfxpUdusJkPn+BCSp root@server" + ]; }; services.openssh.enable = true; nix.settings = { - trusted-users = [ "root" "nixremote" ]; + trusted-users = [ "root" vars.remoteBuilderUser ]; experimental-features = [ "nix-command" "flakes" ]; auto-optimise-store = true; builders-use-substitutes = true; diff --git a/modules/raspi/mount-data.nix b/modules/raspi/mount-data.nix index 77a4a34..f439bb0 100644 --- a/modules/raspi/mount-data.nix +++ b/modules/raspi/mount-data.nix @@ -1,26 +1,26 @@ -{ ... }: +{ vars, ... }: { -fileSystems."/mnt/raspi" = { - device = "raspberrypi.tail13f623.ts.net:/home/raspi/raspi"; - fsType = "nfs4"; - options = [ - "nofail" - "_netdev" - "noatime" + fileSystems."/mnt/raspi" = { + device = "raspberrypi.${vars.tailnetDomain}:/home/raspi/raspi"; + fsType = "nfs4"; + options = [ + "nofail" + "_netdev" + "noatime" - # Don't mount until first access - "x-systemd.automount" + # Don't mount until first access + "x-systemd.automount" - # Unmount after 10 min idle - "x-systemd.idle-timeout=600" + # Unmount after 10 min idle + "x-systemd.idle-timeout=600" - # Give the Pi/Tailscale a little time to appear - "x-systemd.device-timeout=10s" + # Give the Pi/Tailscale a little time to appear + "x-systemd.device-timeout=10s" - # Explicitly use NFSv4.2 if supported - "nfsvers=4.2" - ]; -}; + # Explicitly use NFSv4.2 if supported + "nfsvers=4.2" + ]; + }; -} \ No newline at end of file +} diff --git a/modules/remote-builder-client.nix b/modules/remote-builder-client.nix index 1adad42..9bb81a1 100644 --- a/modules/remote-builder-client.nix +++ b/modules/remote-builder-client.nix @@ -1,4 +1,4 @@ -{ pkgs, ... }: +{ pkgs, vars, ... }: { # Install the remote builder key on each client host (do not commit private keys): @@ -9,9 +9,9 @@ nix.buildMachines = [ { - hostName = "nix-cache"; - sshUser = "nixremote"; - sshKey = "/root/.ssh/nixremote"; + hostName = vars.nixCacheHost; + sshUser = vars.remoteBuilderUser; + sshKey = "/root/.ssh/${vars.remoteBuilderUser}"; system = pkgs.stdenv.hostPlatform.system; maxJobs = 4; speedFactor = 2; diff --git a/modules/services/docker-health-to-gotify.nix b/modules/services/docker-health-to-gotify.nix index ab1fa33..e9f33e4 100644 --- a/modules/services/docker-health-to-gotify.nix +++ b/modules/services/docker-health-to-gotify.nix @@ -1,4 +1,4 @@ -{ pkgs, ... }: +{ pkgs, vars, ... }: { systemd.services.docker-health-to-gotify = { @@ -7,9 +7,9 @@ serviceConfig = { Type = "oneshot"; # Run as root so it can read /etc/secrets and access docker socket - # User = "root"; + # User = "root"; #EnvironmentFile = "-/etc/secrets/docker-health-alert.env"; - ExecStart = "${pkgs.bash}/bin/bash /home/nixos/docker/monitoring/gotify/docker-health-to-gotify.sh"; + ExecStart = "${pkgs.bash}/bin/bash /home/${vars.primaryUser}/docker/monitoring/gotify/docker-health-to-gotify.sh"; StandardOutput = "journal"; StandardError = "journal"; }; @@ -25,4 +25,4 @@ Persistent = true; }; }; -} \ No newline at end of file +} diff --git a/modules/services/nextcloud-cron-job.nix b/modules/services/nextcloud-cron-job.nix index 796e9c4..7ab856f 100644 --- a/modules/services/nextcloud-cron-job.nix +++ b/modules/services/nextcloud-cron-job.nix @@ -1,22 +1,22 @@ -{ pkgs, ... }: +{ pkgs, vars, ... }: { -# Create nextcloud cron scheduled task -systemd.services.nextcloud = { - description = "Nextcloud scheduled task"; - script = ''${pkgs.bash}/bin/bash ~/docker/services-up.sh --profile nextcloud exec -u 33 nextcloud-webapp php ./cron.php''; - serviceConfig = { - Type = "oneshot"; - User = "nixos"; + # Create nextcloud cron scheduled task + systemd.services.nextcloud = { + description = "Nextcloud scheduled task"; + script = ''${pkgs.bash}/bin/bash ~/docker/services-up.sh --profile nextcloud exec -u 33 nextcloud-webapp php ./cron.php''; + serviceConfig = { + Type = "oneshot"; + User = vars.primaryUser; + }; + path = with pkgs; [ docker docker-compose ]; }; - path = with pkgs; [ docker docker-compose ]; -}; -systemd.timers.nextcloud = { - wantedBy = [ "timers.target" ]; - timerConfig = { - OnCalendar = "*:0/5"; - Persistent = true; + systemd.timers.nextcloud = { + wantedBy = [ "timers.target" ]; + timerConfig = { + OnCalendar = "*:0/5"; + Persistent = true; + }; }; -}; -} \ No newline at end of file +} diff --git a/modules/tailscale/exit-node.nix b/modules/tailscale/exit-node.nix index f2f6750..73d9f8a 100644 --- a/modules/tailscale/exit-node.nix +++ b/modules/tailscale/exit-node.nix @@ -1,4 +1,4 @@ -{ ... }: +{ vars, ... }: { services.tailscale = { @@ -6,7 +6,7 @@ extraUpFlags = [ "--advertise-exit-node" - "--advertise-routes=192.168.2.0/24" + "--advertise-routes=${vars.lanCidr}" ]; }; } diff --git a/variables.nix b/variables.nix new file mode 100644 index 0000000..c1691b0 --- /dev/null +++ b/variables.nix @@ -0,0 +1,21 @@ +{ + # Network / domains + lanDomain = "gitea.lan.ddnsgeek.com"; # Gitea/DDNS domain + homeDomain = "sweet.home"; # base LAN domain for service subdomains (pve., docker.) + tailnetDomain = "tail13f623.ts.net"; # Tailscale MagicDNS suffix + lanCidr = "192.168.2.0/24"; # LAN subnet + pxeServerIp = "192.168.2.247"; # pxe-boot host's LAN IP + pbsIp = "192.168.2.108"; # Proxmox Backup Server LAN IP + + # Cross-host references (LAN hostnames/users other hosts reach over the network) + nixCacheHost = "nix-cache"; # substituter/remote-builder hostname + nfsServerHost = "server"; # NFS export source hostname + remoteBuilderUser = "nixremote"; # remote builder SSH user + + # System + timeZone = "Australia/Brisbane"; + primaryUser = "nixos"; # main interactive user on every host + + # Storage + storageRoot = "/tank"; # ZFS pool root on `server` +}