kekl

hosts/kepler/config/boot.nix

@@ -0,0 +1,25 @@
+_:
+{
+  boot = {
+    loader = {
+      systemd-boot = {
+        enable = true;
+      };
+      efi = {
+        canTouchEfiVariables = true;
+      };
+    };
+    initrd.systemd.enable = true;
+    supportedFilesystems = [ "zfs" ];
+    
+    zfs = {
+      devNodes = "/dev/disk/by-id";
+      forceImportRoot = true;
+      forceImportAll = true;
+    };
+    kernelParams = [ "scsi_mod.scan=sync" "rootdelay=10" "zfs.zfs_arc_max=34359738368" ]; 
+    extraModprobeConfig = ''
+      options scsi_mod scan=sync
+    '';
+  };
+}

hosts/kepler/config/default.nix

@@ -0,0 +1,15 @@
+_:
+{
+  imports = [
+    ./boot.nix
+    ./networking.nix
+    ./gnupg.nix
+    ./pkgs.nix
+    ./system.nix
+    ./ssh.nix
+    ./jellyfin.nix
+    ./shell.nix
+    ./freedom/default.nix
+    ./docker/default.nix
+  ];
+}

hosts/kepler/config/docker/default.nix

@@ -0,0 +1,21 @@
+{ config, pkgs, ... }:
+{
+  virtualisation = {
+    oci-containers = {
+      backend = "docker";
+    };
+    docker = {
+      enable = true;
+      enableOnBoot = true;
+      rootless = {
+        enable = true;
+        setSocketVariable = true;
+      };
+    };
+  };
+  imports = [
+    ./gluetun.nix
+    ./qbittorrent.nix
+    ./jdownloader.nix
+  ];
+}

hosts/kepler/config/docker/gluetun.nix

@@ -0,0 +1,56 @@
+{ config, pkgs, ... }:
+let
+  protonvpnConfig = {
+    VPN_SERVICE_PROVIDER = "protonvpn";
+    VPN_PORT_FORWARDING = "on";
+    VPN_PORT_FORWARDING_PROVIDER="protonvpn";
+  };
+  gluetunConfig = {
+    SHADOWSOCKS = "on";
+    HTTPPROXY = "on";
+    HTTPPROXY_STEALTH = "on";
+
+    FIREWALL_OUTBOUND_SUBNETS="10.11.0.0/24";
+    DNS_UPSTREAM_RESOLVERS = "cloudflare"; 
+    
+    BLOCK_SURVEILLANCE="on";
+    BLOCK_ADS="on";
+    BLOCK_MALICIOUS="on";
+  };
+in
+{
+  virtualisation.oci-containers.containers = {
+    # protonvpn
+    pvpn-de-01 = {
+      autoStart = true;
+      image = "qmcgaw/gluetun:latest";
+      capabilities = { NET_ADMIN = true; };
+      devices = [ "/dev/net/tun:/dev/net/tun" ];
+      environmentFiles = [
+        "/etc/secrets/gluetun.env"
+      ];
+      environment = {
+        # GLUETUN ENV VARS #
+        VPN_TYPE="openvpn";
+        SERVER_COUNTRIES = "Germany";
+        VPN_INTERFACE="tun0";
+        
+      } // protonvpnConfig // gluetunConfig;
+      ports = [ 
+        # gluetun
+        "8000:8000" 
+        "7001:8388/tcp"
+        "7001:8388/udp"
+        "8001:8888"
+
+        # qbittorrent
+        "8080:8080"
+        "6881:6881/tcp"
+        "6881:6881/udp"
+
+        # jdownloader
+        "5800:5800"
+      ];
+    };
+  };
+}

hosts/kepler/config/docker/jdownloader.nix

@@ -0,0 +1,22 @@
+_:
+{
+  virtualisation.oci-containers.containers = {
+    # qbittorrent
+    jdownloader = {
+      autoStart = true;
+      image = "jlesage/jdownloader-2:latest";
+      networks = [
+        "container:pvpn-de-01"
+      ];
+      environment = {
+        TZ="Europe/Berlin";
+        KEEP_APP_RUNNING="1";
+        DARK_MODE="1";
+      };
+      volumes = [
+        "/srv/docker/jdownloader/config:/config:rw"
+        "/srv/docker/jdownloader/downloads:/output:rw"
+      ];
+    };
+  };
+}

hosts/kepler/config/docker/qbittorrent.nix

@@ -0,0 +1,21 @@
+_:
+{
+  virtualisation.oci-containers.containers = {
+    # qbittorrent
+    qbittorrent = {
+      autoStart = true;
+      image = "qbittorrentofficial/qbittorrent-nox:latest";
+      networks = [
+        "container:pvpn-de-01"
+      ];
+      environment = {
+        WEBUI_PORT = "8080";
+        TZ="Europe/Berlin";
+      };
+      volumes = [
+        "/srv/docker/qbittorrent/config:/config"
+        "/srv/docker/qbittorrent/downloads:/downloads"
+      ];
+    };
+  };
+}

hosts/kepler/config/freedom/default.nix

@@ -0,0 +1,9 @@
+_:
+{
+  imports = [
+    ./invidious.nix
+    ./nitter.nix
+    ./tor.nix
+    ./unbound.nix
+  ];
+}

hosts/kepler/config/freedom/invidious.nix

@@ -0,0 +1,9 @@
+{ config, pkgs, ... }:
+{
+  services = {
+    invidious = {
+      enable = true;
+      port = 3001;
+    };
+  };
+}

hosts/kepler/config/freedom/nitter.nix

@@ -0,0 +1,14 @@
+{ config, pkgs, ... }:
+{
+  services = {
+    nitter = {
+      enable = true;
+
+      server = {
+        https = true;
+        port = 3002;
+        hostname = "nitter twitter";
+      };
+    };
+  };
+}

hosts/kepler/config/freedom/tor.nix

@@ -0,0 +1,15 @@
+_:
+{
+  services.tor = {
+    enable = true;
+    enableGeoIP = true;
+    client = {
+      enable = true;
+      socksListenAddress = { 
+        IsolateDestAddr = true; 
+        addr = "10.11.0.10"; 
+        port = 9050;
+      };
+    };
+  };
+}

hosts/kepler/config/freedom/unbound.nix

@@ -0,0 +1,28 @@
+_:
+{
+  services.unbound = {
+    enable = true;
+    enableRootTrustAnchor = true;
+    settings = {
+      server = {
+        interface = [ "127.0.0.1" "10.11.0.10" ];
+
+        access-control = [
+          "127.0.0.0/8 allow"
+          "10.11.0.0/24 allow"
+        ];
+        
+        prefetch = true;
+        prefetch-key = true;
+        qname-minimisation = true;
+
+        hide-identity = true;
+        hide-version = true;
+
+        harden-glue = true;
+        harden-below-nxdomain = true;
+        harden-dnssec-stripped = true;
+      };
+    };
+  };
+}

hosts/kepler/config/git.nix

@@ -0,0 +1,4 @@
+_:
+{
+     
+}

hosts/kepler/config/gnupg.nix

@@ -0,0 +1,8 @@
+_:
+{
+  programs.gnupg.agent = {
+    enable = true;
+    enableSSHSupport = true;
+  };
+
+}

hosts/kepler/config/home/home.nix

@@ -0,0 +1,10 @@
+{ config, pkgs, ... }:
+{
+  home = {
+    username = "user";
+    homeDirectory = "/home/user";
+
+    enableNixpkgsReleaseCheck = false;
+    stateVersion = "26.05";
+  };
+}

hosts/kepler/config/jellyfin.nix

@@ -0,0 +1,9 @@
+{ config, pkgs, ... }:
+{
+  services = {
+    jellyfin = {
+      enable = true;
+      openFirewall = false;
+    };
+  };
+}

hosts/kepler/config/networking.nix

@@ -0,0 +1,22 @@
+_:
+{
+  networking = {
+    hostName = "kepler";
+    hostId = "a984053d";
+    networkmanager = { enable = true; };
+    firewall = { enable = false; };
+    
+    interfaces = { 
+      eno1 = {
+        ipv4.addresses = [{
+          address = "10.11.0.10";
+          prefixLength = 24;
+        }];
+      };
+    };
+    defaultGateway = {
+      address = "10.11.0.1";
+      interface = "eno1";
+    };
+  };
+}

hosts/kepler/config/pkgs.nix

@@ -0,0 +1,22 @@
+{ pkgs, ... }:
+{
+  environment.systemPackages = with pkgs; [
+    vim
+    wget
+    git
+    curl
+    fastfetch
+    net-tools
+    ethtool
+    dhcpcd
+    dig
+    usbutils
+    dhcpcd
+    host
+    dnslookup
+    drill
+    dig
+    tree
+    lsof
+  ];
+}

hosts/kepler/config/ssh.nix

@@ -0,0 +1,8 @@
+_:
+{
+  services = {
+    openssh = {
+      enable = true;
+    };
+  };
+}

hosts/kepler/config/system.nix

@@ -0,0 +1,7 @@
+_:
+{
+  nix.settings.experimental-features = [ "nix-command" "flakes" ];
+  system = {
+    stateVersion = "26.05";
+  };
+}