From ca9b9f62226092b50a17c360ec13df4688c88db3 Mon Sep 17 00:00:00 2001 From: Christoph Hollizeck Date: Mon, 25 Nov 2024 23:02:09 +0100 Subject: [PATCH 1/3] rp5: move things in separate configs, to be reused --- modules/nixos/services/openssh/default.nix | 29 +++++++++ .../nixos/services/remotebuild/default.nix | 48 ++++++++++++++ systems/aarch64-linux/nixberry/default.nix | 65 ++++--------------- systems/x86_64-linux/loptland/default.nix | 13 +--- 4 files changed, 92 insertions(+), 63 deletions(-) create mode 100644 modules/nixos/services/openssh/default.nix create mode 100644 modules/nixos/services/remotebuild/default.nix diff --git a/modules/nixos/services/openssh/default.nix b/modules/nixos/services/openssh/default.nix new file mode 100644 index 0000000..4ec9816 --- /dev/null +++ b/modules/nixos/services/openssh/default.nix @@ -0,0 +1,29 @@ +{ + lib, + config, + namespace, + ... +}: +let + cfg = config.${namespace}.services.openssh; + inherit (lib) mkIf mkEnableOption; +in +{ + options.${namespace}.services.openssh = { + enable = mkEnableOption "Enable SSH"; + }; + + config = mkIf cfg.enable { + services.openssh = { + enable = true; + settings = { + PasswordAuthentication = false; + KbdInteractiveAuthentication = false; + }; + }; + + services.fail2ban = { + enable = true; + }; + }; +} diff --git a/modules/nixos/services/remotebuild/default.nix b/modules/nixos/services/remotebuild/default.nix new file mode 100644 index 0000000..cd6b8ab --- /dev/null +++ b/modules/nixos/services/remotebuild/default.nix @@ -0,0 +1,48 @@ +{ + lib, + config, + namespace, + ... +}: +let + cfg = config.${namespace}.services.remotebuild; + inherit (lib) mkIf mkEnableOption; +in +{ + options.${namespace}.services.remotebuild = { + enable = mkEnableOption "Enable remotebuild"; + }; + + config = mkIf cfg.enable { + users.users.remotebuild = { + isNormalUser = true; + createHome = false; + group = "remotebuild"; + + openssh.authorizedKeys.keys = [ + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJYZjG+XPNoVHVdCel5MK4mwvtoFCqDY1WMI1yoU71Rd root@yggdrasil" + ]; + }; + + users.groups.remotebuild = { }; + + nix = { + nrBuildUsers = 64; + settings = { + trusted-users = [ "remotebuild" ]; + + min-free = 10 * 1024 * 1024; + max-free = 200 * 1024 * 1024; + + max-jobs = "auto"; + cores = 0; + }; + }; + + systemd.services.nix-daemon.serviceConfig = { + MemoryAccounting = true; + MemoryMax = "90%"; + OOMScoreAdjust = 500; + }; + }; +} diff --git a/systems/aarch64-linux/nixberry/default.nix b/systems/aarch64-linux/nixberry/default.nix index 5c7cb07..25f1f58 100644 --- a/systems/aarch64-linux/nixberry/default.nix +++ b/systems/aarch64-linux/nixberry/default.nix @@ -19,38 +19,6 @@ in raspberry-pi-5 ]; - security.sudo.wheelNeedsPassword = false; - users.users.remotebuild = { - isNormalUser = true; - createHome = false; - group = "remotebuild"; - - openssh.authorizedKeys.keys = [ - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJYZjG+XPNoVHVdCel5MK4mwvtoFCqDY1WMI1yoU71Rd root@yggdrasil" - ]; - }; - - users.groups.remotebuild = { }; - - nix = { - nrBuildUsers = 64; - settings = { - trusted-users = [ "remotebuild" ]; - - min-free = 10 * 1024 * 1024; - max-free = 200 * 1024 * 1024; - - max-jobs = "auto"; - cores = 0; - }; - }; - - systemd.services.nix-daemon.serviceConfig = { - MemoryAccounting = true; - MemoryMax = "90%"; - OOMScoreAdjust = 500; - }; - networking = { interfaces.wlan0 = { ipv4.addresses = [ @@ -74,16 +42,15 @@ in }; }; }; - }; - - networking.firewall = { - allowedTCPPorts = [ - 53 - 80 - ]; - allowedUDPPorts = [ - 53 - ]; + firewall = { + allowedTCPPorts = [ + 53 + 80 + ]; + allowedUDPPorts = [ + 53 + ]; + }; }; services.adguardhome = { @@ -125,7 +92,6 @@ in "https://adguardteam.github.io/HostlistsRegistry/assets/filter_24.txt" "https://adguardteam.github.io/HostlistsRegistry/assets/filter_47.txt" ]; - }; }; @@ -156,17 +122,14 @@ in }; }; - services.openssh = { - enable = true; - settings = { - PasswordAuthentication = false; - KbdInteractiveAuthentication = false; - }; - }; - ${namespace} = { submodules.basics = enabled; + services = { + openssh = enabled; + remotebuild = enabled; + }; + system = { # cachemiss for webkit gtk hardware.networking.enable = mkForce false; diff --git a/systems/x86_64-linux/loptland/default.nix b/systems/x86_64-linux/loptland/default.nix index d275c7b..f503838 100644 --- a/systems/x86_64-linux/loptland/default.nix +++ b/systems/x86_64-linux/loptland/default.nix @@ -29,18 +29,6 @@ in }; }; - services.openssh = { - enable = true; - settings = { - PasswordAuthentication = false; - KbdInteractiveAuthentication = false; - }; - }; - - services.fail2ban = { - enable = true; - }; - services.nginx = { enable = true; recommendedProxySettings = true; @@ -101,6 +89,7 @@ in enable = true; inherit sopsFile; }; + openssh = enabled; }; security = { From bc1a7c40921cf9ec78e6bb4579e67429fa56a1d8 Mon Sep 17 00:00:00 2001 From: Christoph Hollizeck Date: Mon, 25 Nov 2024 23:19:36 +0100 Subject: [PATCH 2/3] adguardhome: increase statistic retention time --- systems/aarch64-linux/nixberry/default.nix | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/systems/aarch64-linux/nixberry/default.nix b/systems/aarch64-linux/nixberry/default.nix index 25f1f58..cfbd7d5 100644 --- a/systems/aarch64-linux/nixberry/default.nix +++ b/systems/aarch64-linux/nixberry/default.nix @@ -92,6 +92,11 @@ in "https://adguardteam.github.io/HostlistsRegistry/assets/filter_24.txt" "https://adguardteam.github.io/HostlistsRegistry/assets/filter_47.txt" ]; + + statistics = { + enabled = true; + interval = "8760h"; + }; }; }; From 12cc5979f27976982078a185a243348cb59378a5 Mon Sep 17 00:00:00 2001 From: Christoph Hollizeck Date: Tue, 26 Nov 2024 17:05:20 +0100 Subject: [PATCH 3/3] rp5: add ethernet --- systems/aarch64-linux/nixberry/default.nix | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/systems/aarch64-linux/nixberry/default.nix b/systems/aarch64-linux/nixberry/default.nix index cfbd7d5..9c02222 100644 --- a/systems/aarch64-linux/nixberry/default.nix +++ b/systems/aarch64-linux/nixberry/default.nix @@ -20,7 +20,7 @@ in ]; networking = { - interfaces.wlan0 = { + interfaces.end0 = { ipv4.addresses = [ { address = ipAddress; @@ -29,6 +29,15 @@ in ]; useDHCP = true; }; + interfaces.wlan0 = { + ipv4.addresses = [ + { + address = "192.168.178.3"; + prefixLength = 24; + } + ]; + useDHCP = true; + }; defaultGateway = { address = "192.168.178.1"; interface = "wlan0";