From 393e92fe144d84599595cba47e5dd4846c1006b3 Mon Sep 17 00:00:00 2001 From: nyanloutre Date: Wed, 23 Apr 2025 11:15:31 +0200 Subject: [PATCH] global reformat with treefmt --- flake.nix | 143 +++--- pkgs/watcharr/default.nix | 21 +- systems/ASUS-G46VW/configuration.nix | 18 +- systems/ASUS-G46VW/hardware-configuration.nix | 43 +- systems/LoutreOS/configuration.nix | 12 +- systems/LoutreOS/hardware-configuration.nix | 294 ++++++------ systems/LoutreOS/medias.nix | 8 +- systems/LoutreOS/monitoring.nix | 62 ++- systems/LoutreOS/network.nix | 426 ++++++++++-------- systems/LoutreOS/services.nix | 63 ++- systems/LoutreOS/users.nix | 24 +- systems/LoutreOS/web.nix | 409 +++++++++-------- systems/PC-Fixe/configuration.nix | 31 +- systems/PC-Fixe/hardware-configuration.nix | 75 +-- systems/common-cli.nix | 39 +- systems/common-gui.nix | 34 +- treefmt.toml | 3 + 17 files changed, 979 insertions(+), 726 deletions(-) create mode 100644 treefmt.toml diff --git a/flake.nix b/flake.nix index 3654010..4efa9e8 100644 --- a/flake.nix +++ b/flake.nix @@ -21,81 +21,88 @@ }; }; - outputs = { - self, - nixpkgs, - nixpkgs-unstable, - nixpkgs-4a3fc4cf7, - simple-nixos-mailserver, - dogetipbot-telegram, - ipmihddtemp - }@inputs: { + outputs = + { + self, + nixpkgs, + nixpkgs-unstable, + nixpkgs-4a3fc4cf7, + simple-nixos-mailserver, + dogetipbot-telegram, + ipmihddtemp, + }@inputs: + { - packages.x86_64-linux = (import ./pkgs nixpkgs.legacyPackages.x86_64-linux); + packages.x86_64-linux = (import ./pkgs nixpkgs.legacyPackages.x86_64-linux); - nixosConfigurations.paul-fixe = nixpkgs-unstable.lib.nixosSystem { - system = "x86_64-linux"; - modules = [ - nixpkgs-unstable.nixosModules.notDetected - { - nixpkgs.config.allowUnfree = true; - nix = { - settings.experimental-features = [ "nix-command" "flakes" ]; - registry = { - nixpkgs.to = { - type = "path"; - path = nixpkgs-unstable.legacyPackages.x86_64-linux.path; + nixosConfigurations.paul-fixe = nixpkgs-unstable.lib.nixosSystem { + system = "x86_64-linux"; + modules = [ + nixpkgs-unstable.nixosModules.notDetected + { + nixpkgs.config.allowUnfree = true; + nix = { + settings.experimental-features = [ + "nix-command" + "flakes" + ]; + registry = { + nixpkgs.to = { + type = "path"; + path = nixpkgs-unstable.legacyPackages.x86_64-linux.path; + }; }; }; - }; - } - ./systems/PC-Fixe/configuration.nix - ]; - }; - - nixosConfigurations.loutreos = nixpkgs.lib.nixosSystem rec { - system = "x86_64-linux"; - specialArgs = { - inputs = inputs; - pkgs-4a3fc4cf7 = import nixpkgs-4a3fc4cf7 { - inherit system; - }; + } + ./systems/PC-Fixe/configuration.nix + ]; }; - modules = [ - nixpkgs-unstable.nixosModules.notDetected - simple-nixos-mailserver.nixosModule - dogetipbot-telegram.nixosModule - ipmihddtemp.nixosModule - { - nix = { - settings.experimental-features = [ "nix-command" "flakes" ]; - registry = { - nixpkgs.to = { - type = "path"; - path = nixpkgs.legacyPackages.x86_64-linux.path; + + nixosConfigurations.loutreos = nixpkgs.lib.nixosSystem rec { + system = "x86_64-linux"; + specialArgs = { + inputs = inputs; + pkgs-4a3fc4cf7 = import nixpkgs-4a3fc4cf7 { + inherit system; + }; + }; + modules = [ + nixpkgs-unstable.nixosModules.notDetected + simple-nixos-mailserver.nixosModule + dogetipbot-telegram.nixosModule + ipmihddtemp.nixosModule + { + nix = { + settings.experimental-features = [ + "nix-command" + "flakes" + ]; + registry = { + nixpkgs.to = { + type = "path"; + path = nixpkgs.legacyPackages.x86_64-linux.path; + }; }; }; - }; - systemd.services.watcharr = { - description = "Watcharr"; - after = [ "network.target" ]; - environment = { - PORT = "3005"; - WATCHARR_DATA = "/var/lib/watcharr"; + systemd.services.watcharr = { + description = "Watcharr"; + after = [ "network.target" ]; + environment = { + PORT = "3005"; + WATCHARR_DATA = "/var/lib/watcharr"; + }; + serviceConfig = { + DynamicUser = true; + StateDirectory = "watcharr"; + ExecStart = "${self.packages.x86_64-linux.watcharr}/bin/Watcharr"; + PrivateTmp = true; + }; + wantedBy = [ "multi-user.target" ]; }; - serviceConfig = { - DynamicUser = true; - StateDirectory = "watcharr"; - ExecStart = "${self.packages.x86_64-linux.watcharr}/bin/Watcharr"; - PrivateTmp = true; - }; - wantedBy = [ "multi-user.target" ]; - }; - } - ./systems/LoutreOS/configuration.nix - ]; + } + ./systems/LoutreOS/configuration.nix + ]; + }; + }; - - }; } - diff --git a/pkgs/watcharr/default.nix b/pkgs/watcharr/default.nix index 23422d7..dc3cbd0 100644 --- a/pkgs/watcharr/default.nix +++ b/pkgs/watcharr/default.nix @@ -1,13 +1,14 @@ -{ lib -, pkgs -, buildGoModule -, fetchFromGitHub -, buildNpmPackage -, nixosTests -, caddy -, testers -, installShellFiles -, stdenv +{ + lib, + pkgs, + buildGoModule, + fetchFromGitHub, + buildNpmPackage, + nixosTests, + caddy, + testers, + installShellFiles, + stdenv, }: let diff --git a/systems/ASUS-G46VW/configuration.nix b/systems/ASUS-G46VW/configuration.nix index 3f30d96..4ae46d8 100644 --- a/systems/ASUS-G46VW/configuration.nix +++ b/systems/ASUS-G46VW/configuration.nix @@ -5,12 +5,11 @@ { config, pkgs, ... }: { - imports = - [ - ../common-cli.nix - ../common-gui.nix - ./hardware-configuration.nix - ]; + imports = [ + ../common-cli.nix + ../common-gui.nix + ./hardware-configuration.nix + ]; boot.loader.systemd-boot.enable = true; boot.loader.efi.canTouchEfiVariables = true; @@ -56,7 +55,12 @@ users.extraUsers.paul = { isNormalUser = true; uid = 1000; - extraGroups = [ "wheel" "networkmanager" "wireshark" "dialout" ]; + extraGroups = [ + "wheel" + "networkmanager" + "wireshark" + "dialout" + ]; }; services.syncthing.enable = true; diff --git a/systems/ASUS-G46VW/hardware-configuration.nix b/systems/ASUS-G46VW/hardware-configuration.nix index 19c994e..e1590ef 100644 --- a/systems/ASUS-G46VW/hardware-configuration.nix +++ b/systems/ASUS-G46VW/hardware-configuration.nix @@ -1,14 +1,25 @@ # Do not modify this file! It was generated by ‘nixos-generate-config’ # and may be overwritten by future invocations. Please make changes # to /etc/nixos/configuration.nix instead. -{ config, lib, pkgs, ... }: +{ + config, + lib, + pkgs, + ... +}: { - imports = - [ - ]; + imports = [ + + ]; - boot.initrd.availableKernelModules = [ "xhci_pci" "ehci_pci" "ahci" "usb_storage" "sd_mod" ]; + boot.initrd.availableKernelModules = [ + "xhci_pci" + "ehci_pci" + "ahci" + "usb_storage" + "sd_mod" + ]; boot.kernelModules = [ "kvm-intel" ]; boot.extraModulePackages = [ ]; @@ -19,19 +30,19 @@ hardware.nvidia.optimus_prime.nvidiaBusId = "PCI:1:0:0"; hardware.nvidia.optimus_prime.intelBusId = "PCI:0:2:0"; - fileSystems."/" = - { device = "/dev/disk/by-uuid/7bd3a09b-b188-4ce7-bdcc-d5c5087edc86"; - fsType = "ext4"; - }; + fileSystems."/" = { + device = "/dev/disk/by-uuid/7bd3a09b-b188-4ce7-bdcc-d5c5087edc86"; + fsType = "ext4"; + }; - fileSystems."/boot" = - { device = "/dev/disk/by-uuid/A25A-1786"; - fsType = "vfat"; - }; + fileSystems."/boot" = { + device = "/dev/disk/by-uuid/A25A-1786"; + fsType = "vfat"; + }; - swapDevices = - [ { device = "/dev/disk/by-uuid/156cd5e8-715c-48a5-9df4-14565227a6c9"; } - ]; + swapDevices = [ + { device = "/dev/disk/by-uuid/156cd5e8-715c-48a5-9df4-14565227a6c9"; } + ]; nix.maxJobs = lib.mkDefault 8; powerManagement.cpuFreqGovernor = lib.mkDefault "performance"; diff --git a/systems/LoutreOS/configuration.nix b/systems/LoutreOS/configuration.nix index 001dfb7..2e49dde 100644 --- a/systems/LoutreOS/configuration.nix +++ b/systems/LoutreOS/configuration.nix @@ -1,4 +1,9 @@ -{ config, pkgs, inputs, ... }: +{ + config, + pkgs, + inputs, + ... +}: { imports = [ @@ -9,7 +14,10 @@ ./services.nix ]; - nix.settings.trusted-users = [ "root" "paul" ]; + nix.settings.trusted-users = [ + "root" + "paul" + ]; boot = { loader = { diff --git a/systems/LoutreOS/hardware-configuration.nix b/systems/LoutreOS/hardware-configuration.nix index 720b883..5421ad0 100644 --- a/systems/LoutreOS/hardware-configuration.nix +++ b/systems/LoutreOS/hardware-configuration.nix @@ -1,190 +1,202 @@ # Do not modify this file! It was generated by ‘nixos-generate-config’ # and may be overwritten by future invocations. Please make changes # to /etc/nixos/configuration.nix instead. -{ config, lib, pkgs, ... }: +{ + config, + lib, + pkgs, + ... +}: { - boot.initrd.availableKernelModules = [ "ahci" "xhci_pci" "nvme" "usbhid" "usb_storage" "sd_mod" "sr_mod" ]; + boot.initrd.availableKernelModules = [ + "ahci" + "xhci_pci" + "nvme" + "usbhid" + "usb_storage" + "sd_mod" + "sr_mod" + ]; boot.kernelModules = [ "kvm-intel" ]; boot.extraModulePackages = [ ]; - fileSystems."/" = - { device = "/dev/disk/by-uuid/fec13566-5528-4859-b185-ce37ac2665eb"; - fsType = "ext4"; - }; + fileSystems."/" = { + device = "/dev/disk/by-uuid/fec13566-5528-4859-b185-ce37ac2665eb"; + fsType = "ext4"; + }; - fileSystems."/boot" = - { device = "/dev/disk/by-uuid/5306-AD9A"; - fsType = "vfat"; - }; + fileSystems."/boot" = { + device = "/dev/disk/by-uuid/5306-AD9A"; + fsType = "vfat"; + }; - fileSystems."/var/lib/acme" = - { device = "loutrepool/var/acme"; - fsType = "zfs"; - }; + fileSystems."/var/lib/acme" = { + device = "loutrepool/var/acme"; + fsType = "zfs"; + }; - fileSystems."/var/certs" = - { device = "loutrepool/var/certs"; - fsType = "zfs"; - }; + fileSystems."/var/certs" = { + device = "loutrepool/var/certs"; + fsType = "zfs"; + }; - fileSystems."/var/lib/transmission" = - { device = "loutrepool/var/transmission"; - fsType = "zfs"; - }; + fileSystems."/var/lib/transmission" = { + device = "loutrepool/var/transmission"; + fsType = "zfs"; + }; - fileSystems."/var/lib/matrix-synapse" = - { device = "loutrepool/var/matrix-synapse"; - fsType = "zfs"; - }; + fileSystems."/var/lib/matrix-synapse" = { + device = "loutrepool/var/matrix-synapse"; + fsType = "zfs"; + }; - fileSystems."/var/lib/radarr" = - { device = "loutrepool/var/radarr"; - fsType = "zfs"; - }; + fileSystems."/var/lib/radarr" = { + device = "loutrepool/var/radarr"; + fsType = "zfs"; + }; - fileSystems."/var/lib/grafana" = - { device = "loutrepool/var/grafana"; - fsType = "zfs"; - }; + fileSystems."/var/lib/grafana" = { + device = "loutrepool/var/grafana"; + fsType = "zfs"; + }; - fileSystems."/var/lib/slimserver" = - { device = "loutrepool/var/slimserver"; - fsType = "zfs"; - }; + fileSystems."/var/lib/slimserver" = { + device = "loutrepool/var/slimserver"; + fsType = "zfs"; + }; - fileSystems."/var/db/influxdb" = - { device = "loutrepool/var/influxdb"; - fsType = "zfs"; - }; + fileSystems."/var/db/influxdb" = { + device = "loutrepool/var/influxdb"; + fsType = "zfs"; + }; - fileSystems."/var/lib/postgresql" = - { device = "loutrepool/var/postgresql"; - fsType = "zfs"; - }; + fileSystems."/var/lib/postgresql" = { + device = "loutrepool/var/postgresql"; + fsType = "zfs"; + }; - fileSystems."/var/lib/syncthing" = - { device = "loutrepool/var/syncthing"; - fsType = "zfs"; - }; + fileSystems."/var/lib/syncthing" = { + device = "loutrepool/var/syncthing"; + fsType = "zfs"; + }; - fileSystems."/mnt/medias/incomplete" = - { device = "loutrepool/torrent-dl"; - fsType = "zfs"; - }; + fileSystems."/mnt/medias/incomplete" = { + device = "loutrepool/torrent-dl"; + fsType = "zfs"; + }; - fileSystems."/mnt/medias" = - { device = "loutrepool/medias"; - fsType = "zfs"; - }; + fileSystems."/mnt/medias" = { + device = "loutrepool/medias"; + fsType = "zfs"; + }; - fileSystems."/var/sieve" = - { device = "loutrepool/var/sieve"; - fsType = "zfs"; - }; + fileSystems."/var/sieve" = { + device = "loutrepool/var/sieve"; + fsType = "zfs"; + }; - fileSystems."/var/vmail" = - { device = "loutrepool/var/vmail"; - fsType = "zfs"; - }; + fileSystems."/var/vmail" = { + device = "loutrepool/var/vmail"; + fsType = "zfs"; + }; - fileSystems."/var/lib/sonarr" = - { device = "loutrepool/var/sonarr"; - fsType = "zfs"; - }; + fileSystems."/var/lib/sonarr" = { + device = "loutrepool/var/sonarr"; + fsType = "zfs"; + }; - fileSystems."/var/lib/jackett" = - { device = "loutrepool/var/jackett"; - fsType = "zfs"; - }; + fileSystems."/var/lib/jackett" = { + device = "loutrepool/var/jackett"; + fsType = "zfs"; + }; - fileSystems."/var/lib/gitea" = - { device = "loutrepool/var/gitea"; - fsType = "zfs"; - }; + fileSystems."/var/lib/gitea" = { + device = "loutrepool/var/gitea"; + fsType = "zfs"; + }; - fileSystems."/var/lib/private/sdtdserver" = - { device = "loutrepool/var/sdtdserver"; - fsType = "zfs"; - }; + fileSystems."/var/lib/private/sdtdserver" = { + device = "loutrepool/var/sdtdserver"; + fsType = "zfs"; + }; - fileSystems."/var/lib/private/factorio" = - { device = "loutrepool/var/factorio"; - fsType = "zfs"; - }; + fileSystems."/var/lib/private/factorio" = { + device = "loutrepool/var/factorio"; + fsType = "zfs"; + }; - fileSystems."/var/dkim" = - { device = "loutrepool/var/dkim"; - fsType = "zfs"; - }; + fileSystems."/var/dkim" = { + device = "loutrepool/var/dkim"; + fsType = "zfs"; + }; - fileSystems."/var/vsftpd" = - { device = "loutrepool/var/vsftpd"; - fsType = "zfs"; - }; + fileSystems."/var/vsftpd" = { + device = "loutrepool/var/vsftpd"; + fsType = "zfs"; + }; # fileSystems."/mnt/backup" = # { device = "backup"; # fsType = "zfs"; # }; - fileSystems."/mnt/backup_loutre" = - { device = "loutrepool/backup"; - fsType = "zfs"; - }; + fileSystems."/mnt/backup_loutre" = { + device = "loutrepool/backup"; + fsType = "zfs"; + }; - fileSystems."/mnt/secrets" = - { device = "loutrepool/secrets"; - fsType = "zfs"; - }; + fileSystems."/mnt/secrets" = { + device = "loutrepool/secrets"; + fsType = "zfs"; + }; - fileSystems."/var/lib/minecraft" = - { device = "loutrepool/var/minecraft"; - fsType = "zfs"; - }; + fileSystems."/var/lib/minecraft" = { + device = "loutrepool/var/minecraft"; + fsType = "zfs"; + }; - fileSystems."/var/www" = - { device = "loutrepool/var/www"; - fsType = "zfs"; - }; + fileSystems."/var/www" = { + device = "loutrepool/var/www"; + fsType = "zfs"; + }; - fileSystems."/var/lib/mastodon" = - { device = "loutrepool/var/mastodon"; - fsType = "zfs"; - }; + fileSystems."/var/lib/mastodon" = { + device = "loutrepool/var/mastodon"; + fsType = "zfs"; + }; - fileSystems."/var/lib/hass" = - { device = "loutrepool/var/hass"; - fsType = "zfs"; - }; + fileSystems."/var/lib/hass" = { + device = "loutrepool/var/hass"; + fsType = "zfs"; + }; - fileSystems."/var/lib/nextcloud" = - { device = "loutrepool/var/nextcloud"; - fsType = "zfs"; - }; + fileSystems."/var/lib/nextcloud" = { + device = "loutrepool/var/nextcloud"; + fsType = "zfs"; + }; - fileSystems."/var/lib/private/photoprism" = - { device = "loutrepool/var/photoprism"; - fsType = "zfs"; - }; + fileSystems."/var/lib/private/photoprism" = { + device = "loutrepool/var/photoprism"; + fsType = "zfs"; + }; - fileSystems."/mnt/paul-home" = - { device = "loutrepool/zfs-replicate/paul-fixe/fastaf/home"; - fsType = "zfs"; - }; + fileSystems."/mnt/paul-home" = { + device = "loutrepool/zfs-replicate/paul-fixe/fastaf/home"; + fsType = "zfs"; + }; - fileSystems."/mnt/webdav" = - { device = "loutrepool/webdav"; - fsType = "zfs"; - }; + fileSystems."/mnt/webdav" = { + device = "loutrepool/webdav"; + fsType = "zfs"; + }; - swapDevices = - [ - { - device = "/var/swapfile"; - size = 8096; - } - ]; + swapDevices = [ + { + device = "/var/swapfile"; + size = 8096; + } + ]; nix.settings.max-jobs = lib.mkDefault 4; powerManagement.cpuFreqGovernor = lib.mkDefault "ondemand"; diff --git a/systems/LoutreOS/medias.nix b/systems/LoutreOS/medias.nix index fdd6518..f8a5a55 100644 --- a/systems/LoutreOS/medias.nix +++ b/systems/LoutreOS/medias.nix @@ -1,4 +1,10 @@ -{ config, lib, pkgs, pkgs-4a3fc4cf7, ... }: +{ + config, + lib, + pkgs, + pkgs-4a3fc4cf7, + ... +}: { services = { diff --git a/systems/LoutreOS/monitoring.nix b/systems/LoutreOS/monitoring.nix index e02a4fa..27b721e 100644 --- a/systems/LoutreOS/monitoring.nix +++ b/systems/LoutreOS/monitoring.nix @@ -1,4 +1,9 @@ -{ config, lib, pkgs, ... }: +{ + config, + lib, + pkgs, + ... +}: let domaine = "nyanlout.re"; @@ -23,28 +28,44 @@ in enable = true; extraConfig = { inputs = { - zfs = { poolMetrics = true; }; - net = { interfaces = [ "eno1" "eno2" "eno3" "eno4" ]; }; - netstat = {}; - cpu = { totalcpu = true; }; - kernel = {}; - mem = {}; - processes = {}; - system = {}; - disk = {}; + zfs = { + poolMetrics = true; + }; + net = { + interfaces = [ + "eno1" + "eno2" + "eno3" + "eno4" + ]; + }; + netstat = { }; + cpu = { + totalcpu = true; + }; + kernel = { }; + mem = { }; + processes = { }; + system = { }; + disk = { }; cgroup = [ { paths = [ "/sys/fs/cgroup/system.slice/*" ]; - files = ["memory.current" "cpu.stat"]; + files = [ + "memory.current" + "cpu.stat" + ]; } ]; - ipmi_sensor = { path = "${pkgs.ipmitool}/bin/ipmitool"; }; + ipmi_sensor = { + path = "${pkgs.ipmitool}/bin/ipmitool"; + }; smart = { path = "${pkgs.writeShellScriptBin "smartctl" "/run/wrappers/bin/sudo ${pkgs.smartmontools}/bin/smartctl $@"}/bin/smartctl"; }; - exec= [ + exec = [ { commands = [ "${pkgs.python3}/bin/python ${pkgs.writeText "zpool.py" '' @@ -76,7 +97,10 @@ in ]; }; outputs = { - influxdb = { database = "telegraf"; urls = [ "http://localhost:8086" ]; }; + influxdb = { + database = "telegraf"; + urls = [ "http://localhost:8086" ]; + }; }; }; }; @@ -122,6 +146,14 @@ in }; security.sudo.extraRules = [ - { commands = [ { command = "${pkgs.smartmontools}/bin/smartctl"; options = [ "NOPASSWD" ]; } ]; users = [ "telegraf" ]; } + { + commands = [ + { + command = "${pkgs.smartmontools}/bin/smartctl"; + options = [ "NOPASSWD" ]; + } + ]; + users = [ "telegraf" ]; + } ]; } diff --git a/systems/LoutreOS/network.nix b/systems/LoutreOS/network.nix index 1545a79..80ae72a 100644 --- a/systems/LoutreOS/network.nix +++ b/systems/LoutreOS/network.nix @@ -1,4 +1,9 @@ -{ config, pkgs, inputs, ... }: +{ + config, + pkgs, + inputs, + ... +}: { boot = { @@ -52,7 +57,10 @@ }; eno2 = { ipv4.addresses = [ - { address = "10.30.0.1"; prefixLength = 16; } + { + address = "10.30.0.1"; + prefixLength = 16; + } ]; }; enp0s21u1.useDHCP = true; @@ -110,18 +118,31 @@ firewall = { enable = true; - allowedTCPPorts = [ 80 443 ]; + allowedTCPPorts = [ + 80 + 443 + ]; allowedUDPPorts = [ ]; # Open ports on local netwok only interfaces.eno2 = { allowedTCPPorts = [ - 111 2049 4000 4001 4002 # NFS - 3483 9000 9090 # Slimserver + 111 + 2049 + 4000 + 4001 + 4002 # NFS + 3483 + 9000 + 9090 # Slimserver 1935 # RTMP ]; allowedUDPPorts = [ - 111 2049 4000 4001 4002 # NFS + 111 + 2049 + 4000 + 4001 + 4002 # NFS 3483 # Slimserver 67 # DHCP ]; @@ -142,8 +163,8 @@ }; serviceConfig = { LoadCredential = [ - "network.wireguard.private.wg0:/mnt/secrets/wireguard/wireguard.private" - "network.wireguard.preshared.wg0:/mnt/secrets/wireguard/wireguard.preshared" + "network.wireguard.private.wg0:/mnt/secrets/wireguard/wireguard.private" + "network.wireguard.preshared.wg0:/mnt/secrets/wireguard/wireguard.preshared" ]; }; }; @@ -162,204 +183,209 @@ # 51000: from all lookup fiber # first table encountered with a default route if fiber is up # 52000: from all lookup lte # first table encountered with a default route if fiber is down - systemd.network = let - routeTables = { - fiber = 1; - lte = 2; - vpn = 3; - }; - in { - enable = true; - - config = { - inherit routeTables; - addRouteTablesToIPRoute2 = true; - }; - - # Wireguard ARN device configuation - netdevs = { - "10-wg0" = { - netdevConfig = { - Kind = "wireguard"; - Name = "wg0"; - MTUBytes = "1450"; - }; - wireguardConfig = { - PrivateKey = "@network.wireguard.private.wg0"; - RouteTable = routeTables.vpn; - }; - wireguardPeers = [ - { - Endpoint = "89.234.141.83:8095"; - PublicKey = "t3+JkBfXI1uw8fa9P6JfxXJfTPm9cOHcgIN215UHg2g="; - PresharedKey = "@network.wireguard.preshared.wg0"; - AllowedIPs = ["0.0.0.0/0" "::/0"]; - PersistentKeepalive = 15; - } - ]; + systemd.network = + let + routeTables = { + fiber = 1; + lte = 2; + vpn = 3; }; - }; + in + { + enable = true; - networks = { - ######### - # FIBER # - ######### - - # Set route metric to highest priority - # Set DHCP client magic settings for Bouygues - "40-bouygues" = { - dhcpV4Config.RouteTable = routeTables.fiber; - - dhcpV6Config = { - DUIDRawData = "00:03:00:01:E8:AD:A6:21:73:68"; - WithoutRA = "solicit"; - }; - - ipv6AcceptRAConfig = { - DHCPv6Client = true; - RouteTable = routeTables.fiber; - }; - - networkConfig = { - KeepConfiguration = "dhcp-on-stop"; - IPv6AcceptRA = true; - DHCPPrefixDelegation = true; - }; - - # Static attribution of first IPv6 subnet - dhcpPrefixDelegationConfig.SubnetId = "0"; - - # Route everything to fiber link with a priority of 40000 - routingPolicyRules = [ - { - FirewallMark = 1; - Table = routeTables.fiber; - Priority = 41000; - Family = "both"; - } - { - Table = routeTables.fiber; - Priority = 51000; - Family = "both"; - } - ]; + config = { + inherit routeTables; + addRouteTablesToIPRoute2 = true; }; - # Don't check VLAN physical interface as it is not directly used - "40-eno1".linkConfig.RequiredForOnline = "no"; - - ####### - # LTE # - ####### - - # Set LTE route to lower priority - "40-enp0s21u1" = { - dhcpV4Config.RouteTable = routeTables.lte; - - # Route all to lte link with a priority of 50000 - routingPolicyRules = [ - { - FirewallMark = 2; - Table = routeTables.lte; - Priority = 42000; - Family = "both"; - } - { - Table = routeTables.lte; - Priority = 52000; - Family = "both"; - } - ]; - }; - - ####### - # VPN # - ####### - - # Wireguard ARN network configuation - "10-wg0" = { - matchConfig.Name = "wg0"; - address = [ - "89.234.141.196/32" - "2a00:5881:8119:400::1/128" - ]; - routingPolicyRules = [ - # Route outgoing emails to VPN table - { - IncomingInterface = "lo"; - DestinationPort = "25"; - Table = routeTables.vpn; - Priority = 60; - Family = "both"; - } - # Route packets originating from wg0 device to VPN table - # Allow server to respond on the wg0 interface requests - { - FirewallMark = 3; - Table = routeTables.vpn; - Priority = 43000; - Family = "both"; - } - ]; - }; - - ####### - # LAN # - ####### - - # LAN DHCP server config - "40-eno2" = { - networkConfig = { - IPv6SendRA = true; - DHCPPrefixDelegation = true; - DHCPServer = true; - IPMasquerade = "ipv4"; - }; - dhcpServerConfig = { - EmitRouter = true; - EmitDNS = true; - DNS = [ - # https://www.dns0.eu/fr - "193.110.81.0" - "185.253.5.0" - ]; - }; - dhcpServerStaticLeases = [ - # IPMI - { - Address = "10.30.1.1"; - MACAddress = "ac:1f:6b:4b:01:15"; - } - # paul-fixe - { - Address = "10.30.50.1"; - MACAddress = "b4:2e:99:ed:24:26"; - } - # salonled - { - Address = "10.30.40.1"; - MACAddress = "e0:98:06:85:e9:ce"; - } - # miroir-bleu - { - Address = "10.30.40.2"; - MACAddress = "e0:98:06:86:38:fc"; - } - # miroir-orange - { - Address = "10.30.40.3"; - MACAddress = "50:02:91:78:be:be"; - } - ]; - ipv6SendRAConfig = { - EmitDNS = true; - DNS = [ - # https://www.dns0.eu/fr - "2a0f:fc80::" - "2a0f:fc81::" + # Wireguard ARN device configuation + netdevs = { + "10-wg0" = { + netdevConfig = { + Kind = "wireguard"; + Name = "wg0"; + MTUBytes = "1450"; + }; + wireguardConfig = { + PrivateKey = "@network.wireguard.private.wg0"; + RouteTable = routeTables.vpn; + }; + wireguardPeers = [ + { + Endpoint = "89.234.141.83:8095"; + PublicKey = "t3+JkBfXI1uw8fa9P6JfxXJfTPm9cOHcgIN215UHg2g="; + PresharedKey = "@network.wireguard.preshared.wg0"; + AllowedIPs = [ + "0.0.0.0/0" + "::/0" + ]; + PersistentKeepalive = 15; + } ]; }; }; + + networks = { + ######### + # FIBER # + ######### + + # Set route metric to highest priority + # Set DHCP client magic settings for Bouygues + "40-bouygues" = { + dhcpV4Config.RouteTable = routeTables.fiber; + + dhcpV6Config = { + DUIDRawData = "00:03:00:01:E8:AD:A6:21:73:68"; + WithoutRA = "solicit"; + }; + + ipv6AcceptRAConfig = { + DHCPv6Client = true; + RouteTable = routeTables.fiber; + }; + + networkConfig = { + KeepConfiguration = "dhcp-on-stop"; + IPv6AcceptRA = true; + DHCPPrefixDelegation = true; + }; + + # Static attribution of first IPv6 subnet + dhcpPrefixDelegationConfig.SubnetId = "0"; + + # Route everything to fiber link with a priority of 40000 + routingPolicyRules = [ + { + FirewallMark = 1; + Table = routeTables.fiber; + Priority = 41000; + Family = "both"; + } + { + Table = routeTables.fiber; + Priority = 51000; + Family = "both"; + } + ]; + }; + + # Don't check VLAN physical interface as it is not directly used + "40-eno1".linkConfig.RequiredForOnline = "no"; + + ####### + # LTE # + ####### + + # Set LTE route to lower priority + "40-enp0s21u1" = { + dhcpV4Config.RouteTable = routeTables.lte; + + # Route all to lte link with a priority of 50000 + routingPolicyRules = [ + { + FirewallMark = 2; + Table = routeTables.lte; + Priority = 42000; + Family = "both"; + } + { + Table = routeTables.lte; + Priority = 52000; + Family = "both"; + } + ]; + }; + + ####### + # VPN # + ####### + + # Wireguard ARN network configuation + "10-wg0" = { + matchConfig.Name = "wg0"; + address = [ + "89.234.141.196/32" + "2a00:5881:8119:400::1/128" + ]; + routingPolicyRules = [ + # Route outgoing emails to VPN table + { + IncomingInterface = "lo"; + DestinationPort = "25"; + Table = routeTables.vpn; + Priority = 60; + Family = "both"; + } + # Route packets originating from wg0 device to VPN table + # Allow server to respond on the wg0 interface requests + { + FirewallMark = 3; + Table = routeTables.vpn; + Priority = 43000; + Family = "both"; + } + ]; + }; + + ####### + # LAN # + ####### + + # LAN DHCP server config + "40-eno2" = { + networkConfig = { + IPv6SendRA = true; + DHCPPrefixDelegation = true; + DHCPServer = true; + IPMasquerade = "ipv4"; + }; + dhcpServerConfig = { + EmitRouter = true; + EmitDNS = true; + DNS = [ + # https://www.dns0.eu/fr + "193.110.81.0" + "185.253.5.0" + ]; + }; + dhcpServerStaticLeases = [ + # IPMI + { + Address = "10.30.1.1"; + MACAddress = "ac:1f:6b:4b:01:15"; + } + # paul-fixe + { + Address = "10.30.50.1"; + MACAddress = "b4:2e:99:ed:24:26"; + } + # salonled + { + Address = "10.30.40.1"; + MACAddress = "e0:98:06:85:e9:ce"; + } + # miroir-bleu + { + Address = "10.30.40.2"; + MACAddress = "e0:98:06:86:38:fc"; + } + # miroir-orange + { + Address = "10.30.40.3"; + MACAddress = "50:02:91:78:be:be"; + } + ]; + ipv6SendRAConfig = { + EmitDNS = true; + DNS = [ + # https://www.dns0.eu/fr + "2a0f:fc80::" + "2a0f:fc81::" + ]; + }; + }; + }; }; - }; } diff --git a/systems/LoutreOS/services.nix b/systems/LoutreOS/services.nix index 2b49fa9..967130c 100644 --- a/systems/LoutreOS/services.nix +++ b/systems/LoutreOS/services.nix @@ -1,17 +1,24 @@ -{ config, lib, pkgs, ... }: +{ + config, + lib, + pkgs, + ... +}: with lib; let domaine = "nyanlout.re"; - sendMail = to: subject: message: pkgs.writeShellScriptBin "mail.sh" '' - ${pkgs.system-sendmail}/bin/sendmail ${to} <