iso/configuration.nix

@@ -9,7 +9,7 @@
     initialPassword = "leonv";
   };
 
-  networking.hostName = "iso"; # Define your hostname.
+  networking.hostName = "gunther"; # Define your hostname.
   # Enable networking
   networking.networkmanager = {
     enable = true;
@@ -68,6 +68,25 @@
 
   system.stateVersion = "23.11"; # Did you read the comment?
 
+  # NFS setup
+  services.rpcbind.enable = true; # needed for NFS
+  systemd.mounts = [{
+    type = "nfs";
+    mountConfig = {
+      Options = "noatime";
+    };
+    what = "192.168.178.20:/volume1/MiniDrive";
+    where = "/MiniDrive";
+  }];
+
+  systemd.automounts = [{
+    wantedBy = [ "multi-user.target" ];
+    automountConfig = {
+      TimeoutIdleSec = "10";
+    };
+    where = "/MiniDrive";
+    }];
+
   # source zsh
   programs.zsh.enable = true;
   users.defaultUserShell = pkgs.zsh;
@@ -83,4 +102,4 @@
 
   # flakes
   nix.settings.experimental-features = [ "nix-command" "flakes" ];
-}
+}

willem/README.md

@@ -0,0 +1,20 @@
+# Willem
+
+Willem is a server running on a Raspberry Pi 400 offering the following services:
+- [Gitea](git.vatthauer.xyz)
+- [Vaultwarden](bitwarden.vatthauer.xyz)
+
+There are daily backups of the Gitea instance using Restic via B2.
+## Installation on Raspberry Pi 400
+### Resources
+- https://nixos.wiki/wiki/NixOS_on_ARM/Raspberry_Pi_4
+- https://nixos.wiki/wiki/NixOS_on_ARM#Installation
+
+### Step by step
+1. Follow the [generic installation steps](https://nixos.wiki/wiki/NixOS_on_ARM#Installation) to get NixOS up and running on the Pi.
+2. Generate the default `configuration.nix` via `sudo nixos-generate-config` and do a first rebuild `sudo nixos-rebuild switch`
+3. Somehow get this repository onto the machine and `cd` into it
+4. We need git: `nix-shell -p git`
+5. Build the flake via `sudo nixos-rebuild switch --flake .`
+6. At this point you can restart
+7. Login, set password, move the repository to `/home/leonv/nixos`

willem/configuration.nix

@@ -0,0 +1,68 @@
+# Edit this configuration file to define what should be installed on
+# your system.  Help is available in the configuration.nix(5) man page
+# and in the NixOS manual (accessible by running 'nixos-help').
+
+{ config, pkgs, lib, inputs, ... }:
+{
+  imports =
+    [
+      ./hardware-configuration.nix
+      ./services
+      ./programs
+    ];
+
+  # enable flakes
+  nix.settings.experimental-features = [ "nix-command" "flakes" ];
+
+  # Use the extlinux boot loader. (NixOS wants to enable GRUB by default)
+  boot.loader.grub.enable = false;
+  # Enables the generation of /boot/extlinux/extlinux.conf
+  boot.loader.generic-extlinux-compatible.enable = true;
+
+  networking.hostName = "willem"; # Define your hostname.
+  #networking.wireless.enable = true;  # Enables wireless support via wpa_supplicant.
+  networking.firewall.allowedTCPPorts = [ 22 80 443 631 8096 8920 ];
+  networking.firewall.allowedUDPPorts = [ 22 80 443 631 1900 7359 ];
+
+  # Set your time zone.
+  time.timeZone = "Europe/Berlin";
+
+  # Define a user account. Don't forget to set a password with 'passwd'.
+  users.users.leonv = {     
+    isNormalUser = true;
+    initialPassword = "leonv";
+    extraGroups = [ "wheel" ]; # Enable 'sudo' for the user.
+    packages = with pkgs; [
+    ];
+   };
+  users.defaultUserShell = pkgs.zsh;
+
+  # List packages installed in system profile.
+  environment.systemPackages = with pkgs; [
+    wget
+    git
+    zsh
+    oh-my-zsh
+    restic
+    # for hugo website
+    hugo
+    go
+  ];
+  environment.variables = {
+    EDITOR = "nvim";
+
+    # bitwarden key
+    YUBICO_CLIENT_ID = "${../nix-secrets/willem/vaultwarden/yubico-id}";
+    YUBICO_SECRET_KEY = "${../nix-secrets/willem/vaultwarden/yubico-secret}";
+  };
+  environment.shells = [ pkgs.zsh ];
+
+  nixpkgs.config.allowUnfreePredicate = pkg: builtins.elem (lib.getName pkg) [
+    "plexmediaserver"
+  ];
+
+  services.jellyfin.enable = true;
+
+  system.stateVersion = "23.11"; # Did you read the comment?
+}
+

willem/hardware-configuration.nix

@@ -0,0 +1,26 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports =
+    [ (modulesPath + "/installer/scan/not-detected.nix")
+    ];
+
+  boot.initrd.availableKernelModules = [ "xhci_pci" "usbhid" "usb_storage" "uas" "pcie-brcmstb" "reset-raspberrypi" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" =
+    { device = "/dev/disk/by-partuuid/45e5879b-02";
+      fsType = "ext4";
+    };
+
+  swapDevices = [ ];
+
+  networking.useDHCP = lib.mkDefault true;
+  nixpkgs.hostPlatform = lib.mkDefault "aarch64-linux";
+  powerManagement.cpuFreqGovernor = lib.mkDefault "ondemand";
+}

willem/programs/default.nix

@@ -0,0 +1,8 @@
+{
+    imports = [
+        ./neovim.nix
+        ./ssh.nix
+        ./starship.nix
+        ./zsh.nix
+    ];
+}

willem/programs/neovim.nix

@@ -0,0 +1,14 @@
+{ pkgs, ... }:
+{
+  programs.neovim = {
+    enable = true;
+    configure = {
+      customRC = '''';
+      packages.myVimPackage = with pkgs.vimPlugins; {
+        start = [ vim-nix ];
+      };
+    };
+    viAlias = true;
+    vimAlias = true;
+  };
+}

willem/programs/ssh.nix

@@ -0,0 +1,6 @@
+{
+  programs.ssh.startAgent = true;
+  programs.ssh.extraConfig = ''
+    AddKeysToAgent yes
+  '';
+}

willem/programs/starship.nix

@@ -0,0 +1,8 @@
+{
+  programs.starship = {
+    enable = true;
+    settings = {
+      gradle.symbol = "🐘";
+    };
+  };
+}

willem/programs/zsh.nix

@@ -0,0 +1,19 @@
+{
+  programs.zsh = {
+    enable = true;
+    shellAliases = {
+      clean = "sudo nix-env --delete-generations old --profile /nix/var/nix/profiles/system && sudo /nix/var/nix/profiles/system/bin/switch-to-configuration switch && sudo nix-store --gc";
+    };
+    shellInit = ''
+      function rebuild () {
+        sudo nixos-rebuild switch --flake "/home/leonv/nixos?submodules=1"
+        sudo cp -r /home/leonv/nixos /etc/
+      }
+    '';
+    ohMyZsh = {
+      enable = true;
+      plugins = [ "git" ];
+      theme = "dpoggi";
+    };
+  };
+}

willem/services/acme.nix

@@ -0,0 +1,10 @@
+{
+  security.acme.acceptTerms = true;
+  security.acme.certs = {
+    "git.vatthauer.xyz".email = "leonvatthauer@outlook.com";
+    "bitwarden.vatthauer.xyz".email = "leonvatthauer@outlook.com";
+    "video.vatthauer.xyz".email = "leonvatthauer@outlook.com";
+    "files.vatthauer.xyz".email = "leonvatthauer@outlook.com";
+    "vatthauer.xyz".email = "leonvatthauer@outlook.com";
+  };
+}

willem/services/ddns.nix

@@ -0,0 +1,16 @@
+{ pkgs, ... }:
+{
+  # dynamic dns
+  users.users.ddns = {
+    isSystemUser = true;
+    group = "ddns";
+  };
+  users.groups.ddns = {};
+  systemd.services.ddns-updater = {
+    enable = true;
+    serviceConfig.User = "ddns";
+    path = [ pkgs.curl ];
+    script = "${../../nix-secrets/willem/ddns/update}";
+    startAt = "hourly";
+  };
+}

willem/services/default.nix

@@ -0,0 +1,13 @@
+{ lib, pkgs, inputs, ... }:
+{
+    imports = [
+        ./acme.nix
+        ./ddns.nix
+        ./nginx.nix
+        ./forgejo.nix
+        ./printing.nix
+        ./restic.nix
+        ./ssh.nix
+        ./vaultwarden.nix
+    ];
+}

willem/services/forgejo.nix

@@ -0,0 +1,23 @@
+{ pkgs, ...}:
+{
+  services.forgejo = {
+    enable = true;
+    settings.DEFAULT.APP_NAME = "Lambda-Git";
+    package = pkgs.forgejo;
+    stateDir = "/forgejo";
+    database = {
+      type = "sqlite3";
+    };
+    dump = {
+      enable = true;
+      interval = "02:00";
+    };
+    settings.server = {
+      ROOT_URL = "https://git.vatthauer.xyz";
+      HTTP_PORT = 3001;
+      DOMAIN = "git.vatthauer.xyz";
+    };
+    settings.session.COOKIE_SECURE = true;
+    settings.service.DISABLE_REGISTRATION = true;
+  };
+}

willem/services/nginx.nix

@@ -0,0 +1,44 @@
+{ lib, pkgs, inputs, ... }:
+{
+  services.nginx = {
+    enable = true;
+    recommendedGzipSettings = true;
+    recommendedOptimisation = true;
+    recommendedProxySettings = true;
+    recommendedTlsSettings = true;
+  };
+
+  services.nginx.virtualHosts."git.vatthauer.xyz" = {
+    enableACME = true;
+    forceSSL = true;
+    locations."/" = {
+      proxyPass = "http://localhost:3001/";
+    };
+  };
+
+  services.nginx.virtualHosts."bitwarden.vatthauer.xyz" = {
+    enableACME = true;
+    forceSSL = true;
+    locations."/" = {
+      proxyPass = "http://localhost:8222/";
+    };
+  };
+
+  services.nginx.virtualHosts."video.vatthauer.xyz" = {
+    enableACME = true;
+    forceSSL = false;
+    locations."/" = {
+      proxyPass = "http://localhost:8096";
+    };
+  };
+  services.nginx.virtualHosts."vatthauer.xyz" = {
+    forceSSL = true;
+    enableACME = true;
+    root = pkgs.callPackage ./resumee-website.nix {};
+  };
+  services.nginx.virtualHosts."files.vatthauer.xyz" = {
+    forceSSL = true;
+    enableACME = true;
+    root = "/var/www";
+  };
+}

willem/services/printing.nix

@@ -0,0 +1,20 @@
+{ pkgs, ... }:
+{
+  # Enable CUPS to print documents.
+  services.avahi = {
+    enable = true;
+    publish.enable = true;
+    publish.userServices = true;
+  };
+  services.printing = {
+    enable = true;
+    drivers = [ pkgs.splix ];
+    browsing = true;
+    listenAddresses = [ "*:631" ];
+    allowFrom = [ "all" ];
+    defaultShared = true;
+    extraConf = ''
+      BrowseLocalProtocols all
+    '';
+  };
+}

willem/services/restic.nix

@@ -0,0 +1,17 @@
+{
+  services.restic.backups = {
+    giteaBackup = {
+      paths = [ "/gitea/dump" ];
+      # environmentFile = "/home/leonv/nixos/willem/private/gitea_backupCreds";
+      # passwordFile = "/home/leonv/nixos/willem/private/restic-password";
+      environmentFile = "${../../nix-secrets/willem/gitea/backupCreds}";
+      passwordFile = "${../../nix-secrets/willem/restic/password}";
+      repository = "b2:gitea-willem";
+      initialize = true;
+      timerConfig = {
+        OnCalendar = "04:00";
+        Persistent = true;
+      };
+    };
+  };
+}

willem/services/resumee-website.nix

@@ -0,0 +1,15 @@
+{ stdenv, git, go, hugo }:
+stdenv.mkDerivation {
+  name = "resumee-website";
+  version = "1.0";
+  src = builtins.fetchGit {
+    url = "https://git.vatthauer.xyz/leonv/resumee-website.git";
+    rev = "5cd0f5bb30da8d7297a15be3704e4d9efc73d8b4";
+  };
+  nativeBuildInputs = [ git go hugo ];
+  buildPhase = "hugo -d $out";
+  outputHashAlgo = "sha256";
+  outputHashMode = "recursive";
+  outputHash = "sha256-PQzuhxRrruBbEfUjhPGPeJkJ6vsbMJ+5Ojg4t11oNV8=";
+}
+

willem/services/ssh.nix

@@ -0,0 +1,4 @@
+{
+  # Enable the OpenSSH daemon.
+  services.openssh.enable = true;
+}

willem/services/vaultwarden.nix

@@ -0,0 +1,19 @@
+{
+  services.vaultwarden = {
+    enable = true;
+    config = {
+      DOMAIN = "https://bitwarden.vatthauer.xyz";
+      SIGNUPS_ALLOWED = false;
+
+      ROCKET_ADDRESS = "127.0.0.1";
+      ROCKET_PORT = 8222;
+
+      ROCKET_LOG = "critical";
+
+      ADMIN_TOKEN = "${../../nix-secrets/willem/vaultwarden/admin-token}";
+
+      YUBICO_CLIENT_ID = "${../../nix-secrets/willem/vaultwarden/yubico-id}";
+      YUBICO_SECRET_KEY = "${../../nix-secrets/willem/vaultwarden/yubico-secret}";
+    };
+  };
+}