diff options
| -rw-r--r-- | config/default.nix | 2 | ||||
| -rw-r--r-- | config/networking/default.nix | 25 | ||||
| -rw-r--r-- | config/networking/services/firewall/ruleset.nix | 12 | ||||
| -rw-r--r-- | config/nix/default.nix (renamed from config/nix.nix) | 2 | ||||
| -rw-r--r-- | config/nix/remote-builds.nix | 29 | ||||
| -rw-r--r-- | flake.lock | 19 | ||||
| -rw-r--r-- | flake.nix | 4 |
7 files changed, 88 insertions, 5 deletions
diff --git a/config/default.nix b/config/default.nix index 81e202a..5af99ea 100644 --- a/config/default.nix +++ b/config/default.nix @@ -5,7 +5,7 @@ ./environment.nix ./hardware ./networking - ./nix.nix + ./nix ./users.nix ]; diff --git a/config/networking/default.nix b/config/networking/default.nix index 409ce3b..fb8dafe 100644 --- a/config/networking/default.nix +++ b/config/networking/default.nix @@ -78,7 +78,13 @@ in { prefix = "192.168.2"; prefixLength = 24; }; - machines.self.ip = "192.168.2.1"; + machines = { + self.ip = "192.168.2.1"; + hephaistos = { + ip = "192.168.2.2"; + mac = "f4:a4:75:a1:a2:93"; + }; + }; }; iot = { interfaces = ["wlp1s0-iot"]; @@ -131,6 +137,23 @@ in { address = ifaces.all."${interface}".machines.livebox.ip; }; + hosts = let + withMachines = + # [{machines: AttrSet, ...}] + lib.collect (value: builtins.isAttrs value.machines or false) + config.personal.networking.interfaces.all; + machineToHost = + # String -> {ip: String, ...} -> { name: String, value: String } + name: {ip, ...}: lib.nameValuePair ip "${name}.local"; + pruneMachines = + # AttrSet -> {{ip: String, ...}} + lib.filterAttrs (name: value: name != "self" && (builtins.isString value.ip or false)); + hosts = + # [{machines: AttrSet, ...}] -> [{String}] + lib.forEach withMachines ({machines, ...}: lib.mapAttrs' machineToHost (pruneMachines machines)); + in + lib.zipAttrs hosts; + useDHCP = false; dhcpcd.enable = false; diff --git a/config/networking/services/firewall/ruleset.nix b/config/networking/services/firewall/ruleset.nix index 3418ef8..ba9b39d 100644 --- a/config/networking/services/firewall/ruleset.nix +++ b/config/networking/services/firewall/ruleset.nix @@ -5,6 +5,10 @@ sonos-play1 sonos-move ; + inherit + (interfaces.all.wan.machines) + hephaistos + ; }; makeTable = args: { @@ -195,7 +199,13 @@ in { + ssdp + sonos.player-controller + sonos.controller-player; - wan_wan.rules = with rulesCommon; syncthing + kdeconnect; + wan_wan.rules = with rulesCommon; + syncthing + + kdeconnect + + '' + ip daddr ${machines.hephaistos.ip} \ + ${ssh} + ''; forward = makeBaseChain "filter" "forward" { rules = with rulesCommon; conntrack diff --git a/config/nix.nix b/config/nix/default.nix index 182aa1b..a9d79cc 100644 --- a/config/nix.nix +++ b/config/nix/default.nix @@ -1,4 +1,6 @@ {lib, ...}: { + imports = [./remote-builds.nix]; + personal.nix = { enable = true; autoUpgrade.enable = true; diff --git a/config/nix/remote-builds.nix b/config/nix/remote-builds.nix new file mode 100644 index 0000000..2bca883 --- /dev/null +++ b/config/nix/remote-builds.nix @@ -0,0 +1,29 @@ +{...}: { + programs.ssh = { + extraConfig = '' + Host hephaistos.local + # Prevent using ssh-agent or another keyfile, useful for testing + IdentitiesOnly yes + IdentityFile /root/.ssh/nixremote + # The weakly privileged user on the remote builder – if not set, 'root' is used – which will hopefully fail + User nixremote + ''; + knownHosts."hephaistos.local".publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIPMlRcOB8142XkF8uFCLbyYhcqp4LioChXKAM3EGqSa"; + }; + + nix = { + distributedBuilds = true; + buildMachines = [ + { + hostName = "hephaistos.local"; + system = "x86_64-linux"; + # Nix custom ssh-variant that avoids lots of "trusted-users" settings pain + protocol = "ssh-ng"; + maxJobs = 4; + speedFactor = 4; + supportedFeatures = ["nixos-test" "benchmark" "big-parallel" "kvm"]; + mandatoryFeatures = []; + } + ]; + }; +} @@ -65,6 +65,22 @@ "type": "indirect" } }, + "nixpkgs-beta": { + "locked": { + "lastModified": 1732981179, + "narHash": "sha256-F7thesZPvAMSwjRu0K8uFshTk3ZZSNAsXTIFvXBT+34=", + "owner": "NixOS", + "repo": "nixpkgs", + "rev": "62c435d93bf046a5396f3016472e8f7c8e2aed65", + "type": "github" + }, + "original": { + "owner": "NixOS", + "ref": "release-24.11", + "repo": "nixpkgs", + "type": "github" + } + }, "nixpkgs-lib": { "locked": { "lastModified": 1722555339, @@ -111,7 +127,8 @@ "inputs": { "my-nixpkgs": "my-nixpkgs", "nixos-hardware": "nixos-hardware", - "nixpkgs": "nixpkgs_2" + "nixpkgs": "nixpkgs_2", + "nixpkgs-beta": "nixpkgs-beta" } } }, @@ -2,10 +2,12 @@ inputs = { my-nixpkgs.url = "github:qaristote/my-nixpkgs"; nixpkgs.url = "github:NixOS/nixpkgs/release-24.05"; + nixpkgs-beta.url = "github:NixOS/nixpkgs/release-24.11"; }; outputs = { nixpkgs, + nixpkgs-beta, my-nixpkgs, nixos-hardware, ... @@ -14,7 +16,7 @@ system = "x86_64-linux"; commonModules = [ my-nixpkgs.nixosModules.personal - ({...}: {nixpkgs.overlays = [my-nixpkgs.overlays.personal];}) + ({...}: {nixpkgs.overlays = [my-nixpkgs.overlays.personal (_: _: {inherit (nixpkgs-beta.legacyPackages."${system}") nixos-rebuild;})];}) ]; in { kerberos = nixpkgs.lib.nixosSystem { |