nix/nixos/beefcake.nix

878 lines
23 KiB
Nix
Raw Normal View History

2023-10-12 22:54:05 -05:00
/*
if ur fans get loud:
# enable manual fan control
sudo nix run nixpkgs#ipmitool -- raw 0x30 0x30 0x01 0x00
# set fan speed to last byte as decimal
sudo nix run nixpkgs#ipmitool -- raw 0x30 0x30 0x02 0xff 0x00
*/
2023-10-03 11:52:44 -05:00
{
2024-02-21 21:14:46 -06:00
# inputs,
2024-02-16 16:52:58 -06:00
# outputs,
2024-02-21 22:15:41 -06:00
lib,
2024-02-21 22:06:36 -06:00
api-lyte-dev,
2024-02-21 20:39:10 -06:00
config,
2023-10-03 11:52:44 -05:00
pkgs,
...
2024-02-16 16:32:14 -06:00
}: let
inherit (pkgs) system;
in {
2024-02-16 16:52:58 -06:00
imports =
[
../modules/nixos/intel.nix
../modules/nixos/fonts.nix
]
++ [
2024-02-21 22:06:36 -06:00
api-lyte-dev.nixosModules.api-lyte-dev
2024-02-21 21:14:46 -06:00
2024-02-16 16:52:58 -06:00
# inputs.nix-minecraft.nixosModules.minecraft-servers
];
2024-02-21 22:59:49 -06:00
home-manager.users.daniel = {
# imports = with outputs.homeManagerModules; [
# ];
home = {
stateVersion = "24.05";
};
};
nixpkgs.overlays = [
# inputs.nix-minecraft.overlay
2023-09-06 00:57:08 -05:00
];
2023-09-05 21:46:55 -05:00
2023-10-03 11:52:44 -05:00
boot.initrd.availableKernelModules = ["ehci_pci" "megaraid_sas" "usbhid" "uas" "sd_mod"];
boot.kernelModules = ["kvm-intel"];
2023-09-05 21:46:55 -05:00
2023-10-03 11:52:44 -05:00
fileSystems."/" = {
device = "/dev/disk/by-uuid/0747dcba-f590-42e6-89c8-6cb2f9114d64";
fsType = "ext4";
options = [
"usrquota"
];
};
2023-09-05 21:46:55 -05:00
2023-10-03 11:52:44 -05:00
fileSystems."/boot" = {
device = "/dev/disk/by-uuid/7E3C-9018";
fsType = "vfat";
};
2023-09-05 21:46:55 -05:00
2023-10-03 11:52:44 -05:00
fileSystems."/storage" = {
device = "/dev/disk/by-uuid/ea8258d7-54d1-430e-93b3-e15d33231063";
fsType = "btrfs";
options = [
"compress=zstd:5"
"space_cache=v2"
];
};
2023-09-05 21:46:55 -05:00
2023-09-06 00:57:08 -05:00
services.nix-serve = {
enable = true;
secretKeyFile = "/var/cache-priv-key.pem";
};
2023-09-04 11:40:30 -05:00
2024-02-21 22:06:36 -06:00
services.api-lyte-dev = rec {
enable = true;
port = 5757;
stateDir = "/var/lib/api-lyte-dev";
configFile = config.sops.secrets."api.lyte.dev".path;
user = "api-lyte-dev";
group = user;
};
2023-09-04 11:40:30 -05:00
2024-02-21 22:13:32 -06:00
systemd.services.api-lyte-dev.environment = {
2024-02-21 22:15:41 -06:00
RELEASE_HOST = lib.mkForce "api.lyte.dev";
2024-02-21 22:13:32 -06:00
LOG_LEVEL = "debug";
};
2023-09-04 11:40:30 -05:00
sops = {
2024-01-04 18:55:30 -06:00
defaultSopsFile = ../secrets/beefcake/secrets.yml;
2023-09-04 11:40:30 -05:00
age = {
2023-10-03 11:52:44 -05:00
sshKeyPaths = ["/etc/ssh/ssh_host_ed25519_key"];
2023-09-04 11:40:30 -05:00
keyFile = "/var/lib/sops-nix/key.txt";
generateKey = true;
};
secrets = {
# example-key = {
# # see these and other options' documentation here:
# # https://github.com/Mic92/sops-nix#set-secret-permissionowner-and-allow-services-to-access-it
# # set permissions:
# # mode = "0440";
# # owner = config.users.users.nobody.name;
# # group = config.users.users.nobody.group;
# # restart service when a secret changes or is newly initialized
# # restartUnits = [ "home-assistant.service" ];
# # symlink to certain directories
# path = "/var/lib/my-example-key/secrets.yaml";
# # for use as a user password
# # neededForUsers = true;
# };
# subdirectory
# "myservice/my_subdir/my_secret" = { };
"api.lyte.dev" = {
2024-02-16 16:52:58 -06:00
# path = "${config.services.api-lyte-dev.stateDir}/secrets.json";
2023-10-05 10:41:31 -05:00
# TODO: would be cool to assert that it's correctly-formatted JSON? probably should be done in a pre-commit hook?
2023-09-04 11:40:30 -05:00
mode = "0440";
2024-02-21 22:06:36 -06:00
owner = config.services.api-lyte-dev.user;
group = config.services.api-lyte-dev.group;
2023-09-04 11:40:30 -05:00
};
2023-11-02 13:33:45 -05:00
"jland.env" = {
path = "/var/lib/jland/jland.env";
# TODO: would be cool to assert that it's correctly-formatted JSON? probably should be done in a pre-commit hook?
mode = "0440";
2024-02-21 20:39:10 -06:00
owner = config.users.users.jland.name;
group = config.users.groups.jland.name;
2023-11-02 13:33:45 -05:00
};
2023-09-28 12:29:21 -05:00
plausible-admin-password = {
# TODO: path = "${config.systemd.services.plausible.serviceConfig.WorkingDirectory}/plausible-admin-password.txt";
path = "/var/lib/plausible/plausible-admin-password";
mode = "0440";
2024-02-21 20:39:10 -06:00
owner = config.systemd.services.plausible.serviceConfig.User;
group = config.systemd.services.plausible.serviceConfig.Group;
2023-09-28 12:29:21 -05:00
};
plausible-secret-key-base = {
path = "/var/lib/plausible/plausible-secret-key-base";
mode = "0440";
2024-02-21 20:39:10 -06:00
owner = config.systemd.services.plausible.serviceConfig.User;
group = config.systemd.services.plausible.serviceConfig.Group;
2023-09-28 12:29:21 -05:00
};
2023-10-20 16:24:50 -05:00
nextcloud-admin-password = {
path = "/var/lib/nextcloud/admin-password";
mode = "0440";
2024-02-21 21:14:46 -06:00
# owner = config.services.nextcloud.serviceConfig.User;
# group = config.services.nextcloud.serviceConfig.Group;
2023-10-20 16:24:50 -05:00
};
2023-09-04 11:40:30 -05:00
};
};
# TODO: non-root processes and services that access secrets need to be part of
# the 'keys' group
2023-10-04 21:34:20 -05:00
# maybe this will fix plausible?
2023-09-04 11:40:30 -05:00
# systemd.services.some-service = {
# serviceConfig.SupplementaryGroups = [ config.users.groups.keys.name ];
# };
# or
# users.users.example-user.extraGroups = [ config.users.groups.keys.name ];
# TODO: directory attributes for /storage subdirectories?
# example: user daniel should be able to write to /storage/files.lyte.dev and
# caddy should be able to serve it
# TODO: declarative directory quotas? for storage/$USER and /home/$USER
# TODO: would be nice to get ALL the storage stuff declared in here
# should I be using btrfs subvolumes? can I capture file ownership, perimssions, and ACLs?
boot.loader.systemd-boot.enable = true;
boot.loader.efi.canTouchEfiVariables = true;
systemd.tmpfiles.rules = [
"d /var/spool/samba 1777 root root -"
];
networking.hostName = "beefcake";
2023-09-28 12:29:21 -05:00
users.extraGroups = {
2023-10-03 11:52:44 -05:00
"plausible" = {};
2023-10-16 16:50:55 -05:00
"nextcloud" = {};
2023-10-03 11:52:44 -05:00
"lytedev" = {};
2023-09-28 12:29:21 -05:00
};
2023-10-03 11:52:44 -05:00
users.groups.daniel.members = ["daniel"];
users.groups.nixadmin.members = ["daniel"];
2023-09-04 11:40:30 -05:00
users.users.daniel = {
2023-10-20 16:24:50 -05:00
packages = [pkgs.weechat];
2023-09-04 11:40:30 -05:00
extraGroups = [
"nixadmin" # write access to /etc/nixos/ files
"wheel" # sudo access
"caddy" # write access to /storage/files.lyte.dev
"users" # general users group
"jellyfin" # write access to /storage/jellyfin
2023-11-02 14:38:37 -05:00
"jland"
2024-02-21 22:32:05 -06:00
"flanilla"
2023-09-04 11:40:30 -05:00
];
};
users.users.lytedev = {
# for running my services and applications and stuff
isNormalUser = true;
2024-02-21 20:39:10 -06:00
openssh.authorizedKeys.keys = config.users.users.daniel.openssh.authorizedKeys.keys;
2023-09-04 11:40:30 -05:00
group = "lytedev";
};
users.users.ben = {
isNormalUser = true;
2023-10-03 11:52:44 -05:00
packages = [pkgs.vim];
2023-09-04 11:40:30 -05:00
openssh.authorizedKeys.keys = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKUfLZ+IX85p9355Po2zP1H2tAxiE0rE6IYb8Sf+eF9T ben@benhany.com"
];
};
users.users.alan = {
isNormalUser = true;
2023-10-03 11:52:44 -05:00
packages = [pkgs.vim];
2023-09-04 11:40:30 -05:00
openssh.authorizedKeys.keys = [
""
];
};
users.users.restic = {
# used for other machines to backup to
isNormalUser = true;
2023-10-03 11:52:44 -05:00
openssh.authorizedKeys.keys =
[
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJbPqzKB09U+i4Kqu136yOjflLZ/J7pYsNulTAd4x903 root@chromebox.h.lyte.dev"
]
2024-02-21 20:39:10 -06:00
++ config.users.users.daniel.openssh.authorizedKeys.keys;
2023-09-04 11:40:30 -05:00
};
users.users.guest = {
2023-09-06 00:57:08 -05:00
# used for anonymous samba access
2023-09-04 11:40:30 -05:00
isSystemUser = true;
2023-09-06 00:57:08 -05:00
group = "users";
2023-09-04 11:40:30 -05:00
createHome = true;
};
2023-09-28 12:29:21 -05:00
users.users.plausible = {
# used for anonymous samba access
isSystemUser = true;
createHome = false;
group = "plausible";
};
2023-11-02 14:38:37 -05:00
users.groups.jland = {
gid = 982;
};
2024-02-21 22:32:05 -06:00
users.groups.flanilla = {
};
users.users.jland = {
2023-11-02 14:38:37 -05:00
uid = 986;
# used for running the jland minecraft server
isSystemUser = true;
createHome = false;
group = "jland";
};
2024-02-21 22:32:05 -06:00
users.users.flanilla = {
isSystemUser = true;
createHome = false;
group = "flanilla";
};
2023-10-16 16:50:55 -05:00
users.users.nextcloud = {
# used for anonymous samba access
isSystemUser = true;
createHome = false;
group = "nextcloud";
};
2024-02-21 22:22:40 -06:00
environment.systemPackages = with pkgs; [
linuxquota
htop
bottom
2024-02-21 22:59:49 -06:00
curl
xh
2024-02-21 22:22:40 -06:00
];
2023-09-04 11:40:30 -05:00
# TODO: make the client declarative? right now I think it's manually git
# clone'd to /root
systemd.services.deno-netlify-ddns-client = {
serviceConfig.Type = "oneshot";
2023-10-03 11:52:44 -05:00
path = with pkgs; [curl bash];
2023-09-04 11:40:30 -05:00
environment = {
NETLIFY_DDNS_RC_FILE = "/root/deno-netlify-ddns-client/.env";
};
script = ''
bash /root/deno-netlify-ddns-client/netlify-ddns-client.sh
'';
};
systemd.timers.deno-netlify-ddns-client = {
2023-10-03 11:52:44 -05:00
wantedBy = ["timers.target"];
partOf = ["deno-netlify-ddns-client.service"];
2023-09-04 11:40:30 -05:00
timerConfig = {
OnBootSec = "10sec";
OnUnitActiveSec = "5min";
Unit = "deno-netlify-ddns-client.service";
};
};
services.caddy = {
enable = true;
2023-10-04 21:34:20 -05:00
email = "daniel@lyte.dev";
2023-09-04 11:40:30 -05:00
adapter = "caddyfile";
# acmeCA = "https://acme-staging-v02.api.letsencrypt.org/directory";
2023-09-28 12:29:21 -05:00
# TODO: there are some hardcoded ports here!
# https://github.com/NixOS/nixpkgs/blob/04af42f3b31dba0ef742d254456dc4c14eedac86/nixos/modules/services/misc/lidarr.nix#L72
2023-10-04 21:34:20 -05:00
# TODO: customize the files.lyte.dev template?
2024-02-21 20:39:10 -06:00
configFile = pkgs.writeText "Caddyfile" ''
video.lyte.dev {
reverse_proxy :8096
}
dev.h.lyte.dev {
reverse_proxy :8000
}
2024-02-21 22:36:05 -06:00
atuin.h.lyte.dev {
reverse_proxy :${toString config.services.atuin.port}
}
2024-02-21 20:39:10 -06:00
# lidarr.h.lyte.dev {
# reverse_proxy :8686
# }
# radarr.h.lyte.dev {
# reverse_proxy :7878
# }
# sonarr.h.lyte.dev {
# reverse_proxy :8989
# }
# bazarr.h.lyte.dev {
# reverse_proxy :$${toString config.services.bazarr.listenPort}
# }
bw.lyte.dev {
reverse_proxy :${toString config.services.vaultwarden.config.ROCKET_PORT}
}
2024-02-21 22:06:36 -06:00
api.lyte.dev {
reverse_proxy :${toString config.services.api-lyte-dev.port}
}
2024-02-21 20:39:10 -06:00
a.lyte.dev {
reverse_proxy :${toString config.services.plausible.server.port}
}
nextcloud.lyte.dev {
reverse_proxy :${toString 9999}
}
git.lyte.dev {
reverse_proxy :${toString config.services.gitea.settings.server.HTTP_PORT}
}
files.lyte.dev {
file_server browse {
# browse template
# hide .*
root /storage/files.lyte.dev
}
}
nix.h.lyte.dev {
reverse_proxy :${toString config.services.nix-serve.port}
}
# proxy everything else to chromebox
:80 {
reverse_proxy 10.0.0.5:80
}
:443 {
reverse_proxy 10.0.0.5:443
}
'';
2023-09-04 11:40:30 -05:00
};
services.vaultwarden = {
enable = true;
config = {
DOMAIN = "https://bw.lyte.dev";
SIGNUPS_ALLOWED = "false";
ROCKET_ADDRESS = "127.0.0.1";
ROCKET_PORT = 8222;
};
};
2023-11-21 18:38:02 -06:00
# services.gitea-actions-runner.instances.main = {
# # TODO: simple git-based automation would be dope? maybe especially for
# # mirroring to github super easy?
# enable = false;
# };
2023-11-21 18:27:53 -06:00
2023-09-04 11:40:30 -05:00
services.gitea = {
enable = true;
appName = "git.lyte.dev";
stateDir = "/storage/gitea";
settings = {
server = {
ROOT_URL = "https://git.lyte.dev";
HTTP_ADDR = "127.0.0.1";
HTTP_PORT = 3088;
DOMAIN = "git.lyte.dev";
};
2023-11-21 18:27:53 -06:00
actions = {
ENABLED = true;
};
2023-09-04 11:40:30 -05:00
service = {
DISABLE_REGISTRATION = true;
};
session = {
COOKIE_SECURE = true;
};
log = {
# TODO: raise the log level
LEVEL = "Debug";
};
ui = {
THEMES = "catppuccin-mocha-sapphire,gitea,arc-green,auto,pitchblack";
DEFAULT_THEME = "catppuccin-mocha-sapphire";
};
};
lfs = {
enable = true;
};
dump = {
enable = true;
};
database = {
# TODO: move to postgres?
type = "sqlite3";
};
};
# TODO: ensure we're not doing the same dumb thing we were doing on the old host and eating storage
services.clickhouse.enable = true;
2023-09-28 12:29:21 -05:00
systemd.services.plausible.serviceConfig.User = "plausible";
systemd.services.plausible.serviceConfig.Group = "plausible";
2023-09-04 11:40:30 -05:00
services.plausible = {
2023-09-28 12:29:21 -05:00
# TODO: enable
enable = false;
2023-09-04 11:40:30 -05:00
database = {
clickhouse.setup = true;
postgres = {
setup = false;
dbname = "plausible";
};
};
server = {
baseUrl = "http://beefcake.hare-cod.ts.net:8899";
disableRegistration = true;
port = 8899;
2024-02-16 16:52:58 -06:00
# secretKeybaseFile = config.sops.secrets.plausible-secret-key-base.path;
2023-09-04 11:40:30 -05:00
};
adminUser = {
activate = false;
email = "daniel@lyte.dev";
2024-02-16 16:52:58 -06:00
# passwordFile = config.sops.secrets.plausible-admin-password.path;
2023-09-04 11:40:30 -05:00
};
};
services.postgresql = {
enable = true;
2024-02-21 22:59:49 -06:00
ensureDatabases = [
"daniel"
"plausible"
"nextcloud"
# "atuin"
];
2023-09-04 11:40:30 -05:00
ensureUsers = [
{
name = "daniel";
ensureDBOwnership = true;
2023-09-04 11:40:30 -05:00
}
{
name = "plausible";
ensureDBOwnership = true;
2023-09-04 11:40:30 -05:00
}
2023-10-16 16:50:55 -05:00
{
name = "nextcloud";
ensureDBOwnership = true;
2023-10-16 16:50:55 -05:00
}
2024-02-21 22:59:49 -06:00
# {
# name = "atuin";
# ensureDBOwnership = true;
# }
2023-09-04 11:40:30 -05:00
];
dataDir = "/storage/postgres";
enableTCPIP = true;
package = pkgs.postgresql_15;
authentication = pkgs.lib.mkOverride 10 ''
#type database DBuser auth-method
2023-10-03 11:52:44 -05:00
local all postgres peer map=superuser_map
local all daniel peer map=superuser_map
local sameuser all peer map=superuser_map
2023-09-04 11:40:30 -05:00
local plausible plausible peer map=superuser_map
2023-10-16 16:50:55 -05:00
local nextcloud nextcloud peer map=superuser_map
2024-02-21 22:59:49 -06:00
local atuin atuin peer map=superuser_map
2023-09-04 11:40:30 -05:00
# lan ipv4
2024-02-21 22:59:49 -06:00
host all all 192.168.0.0/16 trust
host all all 10.0.0.0/24 trust
2023-09-04 11:40:30 -05:00
# tailnet ipv4
host all all 100.64.0.0/10 trust
'';
identMap = ''
# ArbitraryMapName systemUser DBUser
2024-02-21 22:59:49 -06:00
superuser_map root postgres
superuser_map postgres postgres
superuser_map daniel postgres
# Let other names login as themselves
superuser_map /^(.*)$ \1
2023-09-04 11:40:30 -05:00
'';
};
services.postgresqlBackup = {
enable = true;
backupAll = true;
compression = "none"; # hoping for deduplication here?
location = "/storage/postgres-backups";
startAt = "*-*-* 03:00:00";
};
services.tailscale = {
useRoutingFeatures = "server";
};
services.jellyfin = {
enable = true;
2023-10-04 21:34:20 -05:00
openFirewall = false;
2023-09-04 11:40:30 -05:00
# uses port 8096 by default, configurable from admin UI
};
# NOTE: this server's xeon chips DO NOT seem to support quicksync or graphics in general
# but I can probably throw in a crappy GPU (or a big, cheap ebay GPU for ML
# stuff, too?) and get good transcoding performance
# jellyfin hardware encoding
# hardware.opengl = {
# enable = true;
# extraPackages = with pkgs; [
# intel-media-driver
# vaapiIntel
# vaapiVdpau
# libvdpau-va-gl
# intel-compute-runtime
# ];
# };
# nixpkgs.config.packageOverrides = pkgs: {
# vaapiIntel = pkgs.vaapiIntel.override { enableHybridCodec = true; };
# };
services.openssh = {
listenAddresses = [
2023-10-03 11:52:44 -05:00
{
addr = "0.0.0.0";
port = 64022;
}
{
addr = "0.0.0.0";
port = 22;
}
2023-09-04 11:40:30 -05:00
];
};
# services.lidarr = {
# enable = true;
# dataDir = "/storage/lidarr";
# };
2023-09-28 12:29:21 -05:00
# services.radarr = {
# enable = true;
# dataDir = "/storage/radarr";
# };
2023-09-28 12:29:21 -05:00
# services.sonarr = {
# enable = true;
# dataDir = "/storage/sonarr";
# };
2023-09-28 12:29:21 -05:00
# services.bazarr = {
# enable = true;
# listenPort = 6767;
# };
2023-09-28 12:29:21 -05:00
2024-02-21 20:33:50 -06:00
services.samba-wsdd = {
enable = true;
};
2023-09-04 11:40:30 -05:00
services.samba = {
enable = true;
openFirewall = true;
securityType = "user";
2024-02-21 20:33:50 -06:00
# not needed since I don't think I use printer sharing?
# https://nixos.wiki/wiki/Samba#Printer_sharing
# package = pkgs.sambaFull; # broken last I checked in nixpkgs?
2023-09-04 11:40:30 -05:00
extraConfig = ''
workgroup = WORKGROUP
server string = beefcake
netbios name = beefcake
security = user
#use sendfile = yes
#max protocol = smb2
# note: localhost is the ipv6 localhost ::1
2023-11-07 21:30:26 -06:00
hosts allow = 192.168.0.0/16 127.0.0.1 localhost
2023-09-04 11:40:30 -05:00
hosts deny = 0.0.0.0/0
guest account = nobody
map to guest = bad user
2024-02-21 20:39:10 -06:00
# load printers = yes
# printing = cups
# printcap name = cups
2023-09-04 11:40:30 -05:00
'';
shares = {
libre = {
path = "/storage/libre";
browseable = "yes";
"read only" = "no";
"guest ok" = "yes";
"create mask" = "0666";
"directory mask" = "0777";
"force user" = "nobody";
"force group" = "users";
};
public = {
path = "/storage/public";
browseable = "yes";
"read only" = "no";
"guest ok" = "yes";
"create mask" = "0664";
"directory mask" = "0775";
"force user" = "nobody";
"force group" = "users";
};
family = {
path = "/storage/family";
browseable = "yes";
"read only" = "no";
"guest ok" = "no";
"create mask" = "0664";
"directory mask" = "0775";
"force user" = "nobody";
"force group" = "family";
};
daniel = {
path = "/storage/daniel";
browseable = "yes";
"read only" = "no";
"guest ok" = "no";
"create mask" = "0640";
"directory mask" = "0750";
"force user" = "daniel";
"force group" = "users";
};
2024-02-21 20:33:50 -06:00
# printers = {
# comment = "All Printers";
# path = "/var/spool/samba";
# public = "yes";
# browseable = "yes";
# # to allow user 'guest account' to print.
# "guest ok" = "yes";
# writable = "no";
# printable = "yes";
# "create mode" = 0700;
# };
2023-09-04 11:40:30 -05:00
};
};
# paths:
# TODO: move previous backups over and put here
# clickhouse and plausible analytics once they're up and running?
2023-11-01 13:01:56 -05:00
services.restic.backups = let
defaults = {
2023-09-04 11:40:30 -05:00
passwordFile = "/root/restic-localbackup-password";
paths = [
"/storage/files.lyte.dev"
"/storage/daniel"
"/storage/gitea" # TODO: should maybe use configuration.nix's services.gitea.dump ?
2023-11-01 13:01:56 -05:00
"/storage/postgres-backups"
2023-09-04 11:40:30 -05:00
# https://github.com/dani-garcia/vaultwarden/wiki/Backing-up-your-vault
# specifically, https://github.com/dani-garcia/vaultwarden/wiki/Backing-up-your-vault#sqlite-database-files
2023-11-01 13:01:56 -05:00
"/var/lib/bitwarden_rs" # does this need any sqlite preprocessing?
2023-09-04 11:40:30 -05:00
2023-11-01 13:01:56 -05:00
# TODO: backup *arr configs?
2023-09-04 11:40:30 -05:00
];
initialize = true;
2023-11-01 13:01:56 -05:00
exclude = [];
2023-09-04 11:40:30 -05:00
timerConfig = {
OnCalendar = "04:45";
};
};
2023-11-01 13:01:56 -05:00
in {
local =
defaults
// {
repository = "/storage/backups/local";
};
rascal =
defaults
// {
extraOptions = [
"sftp.command='ssh beefcake@rascal -i /root/.ssh/id_ed25519 -s sftp'"
];
repository = "sftp://beefcake@rascal://storage/backups/beefcake";
};
2023-09-04 11:40:30 -05:00
# TODO: add ruby?
2023-11-01 13:01:56 -05:00
benland =
defaults
// {
extraOptions = [
"sftp.command='ssh daniel@n.benhaney.com -p 10022 -i /root/.ssh/id_ed25519 -s sftp'"
];
repository = "sftp://daniel@n.benhaney.com://storage/backups/beefcake";
2023-09-04 11:40:30 -05:00
};
};
# services.minecraft-servers.servers.jland = {
# enable = true;
# package = pkgs.fabricServers.fabric-1_19_2.override {loaderVersion = "0.14.9";};
# # Monumental Experience, modpack version 2.2.53, minecraft version 1.19.2
# # https://www.curseforge.com/minecraft/modpacks/monumental-experience/files/4826863
# # $ nix run nixpkgs#packwiz curseforge import Monumental+Experience-2.2.53.zip
# };
2024-02-21 22:27:58 -06:00
services.atuin = {
enable = true;
2024-02-21 22:36:05 -06:00
database = {
2024-02-21 22:59:49 -06:00
createLocally = true;
# uri = "postgresql://atuin@localhost:5432/atuin";
2024-02-21 22:36:05 -06:00
};
2024-02-21 23:32:47 -06:00
openRegistration = false;
2024-02-21 22:27:58 -06:00
};
2023-11-02 13:33:45 -05:00
virtualisation.oci-containers.backend = "podman";
virtualisation.oci-containers.containers = {
minecraft-jland = {
autoStart = false;
# sending commands: https://docker-minecraft-server.readthedocs.io/en/latest/commands/
image = "docker.io/itzg/minecraft-server";
2024-02-16 16:52:58 -06:00
# user = "${toString config.users.users.jland.uid}:${toString config.users.groups.jland.gid}";
extraOptions = [
"--tty"
"--interactive"
];
environment = {
EULA = "true";
2024-02-16 16:52:58 -06:00
# UID = toString config.users.users.jland.uid;
# GID = toString config.users.groups.jland.gid;
STOP_SERVER_ANNOUNCE_DELAY = "20";
TZ = "America/Chicago";
2023-11-07 17:09:05 -06:00
VERSION = "1.20.1";
2023-11-02 14:38:37 -05:00
MEMORY = "8G";
MAX_MEMORY = "16G";
TYPE = "FORGE";
2023-11-07 17:09:05 -06:00
FORGE_VERSION = "47.1.3";
2023-11-03 13:13:47 -05:00
ALLOW_FLIGHT = "true";
ENABLE_QUERY = "true";
2023-11-02 14:38:37 -05:00
2023-11-07 17:09:05 -06:00
MODPACK = "/data/origination-files/Server-Files-0.2.14.zip";
2023-11-02 14:38:37 -05:00
# TYPE = "AUTO_CURSEFORGE";
# CF_SLUG = "monumental-experience";
# CF_FILE_ID = "4826863"; # 2.2.53
# due to
# Nov 02 13:45:22 beefcake minecraft-jland[2738672]: me.itzg.helpers.errors.GenericException: The modpack authors have indicated this file is not allowed for project distribution. Please download the client zip file from https://www.curseforge.com/minecraft/modpacks/monumental-experience and pass via CF_MODPACK_ZIP environment variable or place indownloads repo directory.
# we must upload manually
# CF_MODPACK_ZIP = "/data/origination-files/Monumental+Experience-2.2.53.zip";
# ENABLE_AUTOPAUSE = "true"; # TODO: must increate or disable max-tick-time
# May also have mod/loader incompatibilities?
# https://docker-minecraft-server.readthedocs.io/en/latest/misc/autopause-autostop/autopause/
};
environmentFiles = [
2024-02-16 16:52:58 -06:00
# config.sops.secrets."jland.env".path
];
ports = ["26965:25565"];
volumes = [
"/storage/jland/data:/data"
"/storage/jland/worlds:/worlds"
];
};
2024-02-21 22:18:54 -06:00
minecraft-flanilla = {
autoStart = true;
image = "docker.io/itzg/minecraft-server";
2024-02-21 22:32:05 -06:00
user = "${toString config.users.users.flanilla.uid}:${toString config.users.groups.flanilla.gid}";
2024-02-21 22:18:54 -06:00
extraOptions = ["--tty" "--interactive"];
environment = {
EULA = "true";
2024-02-21 22:32:05 -06:00
UID = toString config.users.users.flanilla.uid;
GID = toString config.users.groups.flanilla.gid;
2024-02-21 22:18:54 -06:00
STOP_SERVER_ANNOUNCE_DELAY = "20";
TZ = "America/Chicago";
VERSION = "1.20.4";
OPS = "lytedev";
MODE = "creative";
DIFFICULTY = "peaceful";
ONLINE_MODE = "false";
2024-02-21 22:18:54 -06:00
MEMORY = "8G";
MAX_MEMORY = "16G";
ALLOW_FLIGHT = "true";
ENABLE_QUERY = "true";
};
environmentFiles = [
# config.sops.secrets."flanilla.env".path
];
2024-02-21 22:22:40 -06:00
ports = ["26966:25565"];
2024-02-21 22:18:54 -06:00
volumes = [
"/storage/flanilla/data:/data"
"/storage/flanilla/worlds:/worlds"
];
};
};
2023-09-04 11:40:30 -05:00
networking.firewall.allowedTCPPorts = [
80 # http (caddy)
443 # https (caddy)
# 5357 # ???
22 # ssh
2023-11-07 21:30:26 -06:00
6667 # soju irc bouncer
2024-01-19 09:39:21 -06:00
8000 # random development stuff
2023-09-04 11:40:30 -05:00
64022 # ssh (for ben?)
2024-02-21 22:27:58 -06:00
25565
26965
26966
2023-09-04 11:40:30 -05:00
];
networking.firewall.allowedUDPPorts = [
# 53 # DNS
# 3702 # ???
64020 # mosh (for ben?)
];
networking.firewall.allowedUDPPortRanges = [
{
# mosh
from = 60000;
to = 60010;
}
];
networking.firewall = {
enable = true;
allowPing = true;
};
2023-11-07 21:30:26 -06:00
services.soju = {
enable = true;
listen = ["irc+insecure://:6667"];
};
2023-09-06 00:57:08 -05:00
system.stateVersion = "22.05";
2023-09-04 11:40:30 -05:00
}