commit cfff0dedb3b70dbd08057fd39fa72f97b4f5889d Author: halbg0tt Date: Wed Jun 24 07:05:47 2026 +0200 first commit diff --git a/flake.nix b/flake.nix new file mode 100644 index 0000000..1358a82 --- /dev/null +++ b/flake.nix @@ -0,0 +1,28 @@ +{ + inputs = { + nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable"; + home-manager.url = "github:nix-community/home-manager"; + }; + outputs = { self, nixpkgs, home-manager, ... }@inputs: + let + system = "x86_64-linux"; + in { + nixosConfigurations.kepler = nixpkgs.lib.nixosSystem { + system = "x86_64-linux"; + specialArgs = { inherit inputs system; }; + modules = [ + ./hosts/kepler/configuration.nix + home-manager.nixosModules.home-manager + { + home-manager = { + useGlobalPkgs = true; + useUserPackages = true; + extraSpecialArgs = { inherit inputs; }; + users.user = ./mod/home/home.nix; + }; + } + ]; + }; + }; +} + diff --git a/hosts/kepler/configuration.nix b/hosts/kepler/configuration.nix new file mode 100644 index 0000000..1d17a95 --- /dev/null +++ b/hosts/kepler/configuration.nix @@ -0,0 +1,12 @@ +{ config, lib, pkgs, ... }: + +{ + imports = [ + ./hardware-configuration.nix + ../../mod/default.nix + ]; + + time.timeZone = "Europe/Berlin"; + +} + diff --git a/hosts/kepler/hardware-configuration.nix b/hosts/kepler/hardware-configuration.nix new file mode 100644 index 0000000..0361c64 --- /dev/null +++ b/hosts/kepler/hardware-configuration.nix @@ -0,0 +1,31 @@ +{ config, lib, pkgs, modulesPath, ... }: + +{ + imports = + [ (modulesPath + "/installer/scan/not-detected.nix") + ]; + + boot.initrd.availableKernelModules = [ "ehci_pci" "ahci" "mpt3sas" "usb_storage" "usbhid" "sd_mod" ]; + boot.initrd.kernelModules = [ ]; + boot.kernelModules = [ "kvm-intel" ]; + boot.extraModulePackages = [ ]; + + fileSystems."/" = + { device = "rpool/root"; + fsType = "zfs"; + }; + + fileSystems."/boot" = + { device = "/dev/disk/by-uuid/9B62-3696"; + fsType = "vfat"; + options = [ "fmask=0022" "dmask=0022" ]; + }; + fileSystems."/data/storage" = { + device = "data/storage"; + fsType = "zfs"; + }; + swapDevices = [ ]; + + nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux"; + hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware; +} diff --git a/mod/boot.nix b/mod/boot.nix new file mode 100644 index 0000000..15ba7ea --- /dev/null +++ b/mod/boot.nix @@ -0,0 +1,25 @@ +_: +{ + boot = { + loader = { + systemd-boot = { + enable = true; + }; + efi = { + canTouchEfiVariables = true; + }; + }; + initrd.systemd.enable = true; + supportedFilesystems = [ "zfs" ]; + + zfs = { + devNodes = "/dev/disk/by-id"; + forceImportRoot = true; + forceImportAll = true; + }; + kernelParams = [ "scsi_mod.scan=sync" "rootdelay=10" "zfs.zfs_arc_max=34359738368" ]; + extraModprobeConfig = '' + options scsi_mod scan=sync + ''; + }; +} diff --git a/mod/default.nix b/mod/default.nix new file mode 100644 index 0000000..8889bbb --- /dev/null +++ b/mod/default.nix @@ -0,0 +1,16 @@ +_: +{ + imports = [ + ./boot.nix + ./networking.nix + ./users.nix + ./gnupg.nix + ./pkgs.nix + ./system.nix + ./ssh.nix + ./time.nix + ./jellyfin.nix + ./freedom/default.nix + ./docker/default.nix + ]; +} diff --git a/mod/docker/default.nix b/mod/docker/default.nix new file mode 100644 index 0000000..ead158e --- /dev/null +++ b/mod/docker/default.nix @@ -0,0 +1,21 @@ +{ config, pkgs, ... }: +{ + virtualisation = { + oci-containers = { + backend = "docker"; + }; + docker = { + enable = true; + enableOnBoot = true; + rootless = { + enable = true; + setSocketVariable = true; + }; + }; + }; + imports = [ + ./gluetun.nix + ./qbittorrent.nix + ./jdownloader.nix + ]; +} diff --git a/mod/docker/gluetun.nix b/mod/docker/gluetun.nix new file mode 100644 index 0000000..04d84a2 --- /dev/null +++ b/mod/docker/gluetun.nix @@ -0,0 +1,56 @@ +{ config, pkgs, ... }: +let + protonvpnConfig = { + VPN_SERVICE_PROVIDER = "protonvpn"; + VPN_PORT_FORWARDING = "on"; + VPN_PORT_FORWARDING_PROVIDER="protonvpn"; + }; + gluetunConfig = { + SHADOWSOCKS = "on"; + HTTPPROXY = "on"; + HTTPPROXY_STEALTH = "on"; + + FIREWALL_OUTBOUND_SUBNETS="10.11.0.0/24"; + DNS_UPSTREAM_RESOLVERS = "cloudflare"; + + BLOCK_SURVEILLANCE="on"; + BLOCK_ADS="on"; + BLOCK_MALICIOUS="on"; + }; +in +{ + virtualisation.oci-containers.containers = { + # protonvpn + pvpn-de-01 = { + autoStart = true; + image = "qmcgaw/gluetun:latest"; + capabilities = { NET_ADMIN = true; }; + devices = [ "/dev/net/tun:/dev/net/tun" ]; + environmentFiles = [ + "/etc/secrets/gluetun.env" + ]; + environment = { + # GLUETUN ENV VARS # + VPN_TYPE="openvpn"; + SERVER_COUNTRIES = "Germany"; + VPN_INTERFACE="tun0"; + + } // protonvpnConfig // gluetunConfig; + ports = [ + # gluetun + "8000:8000" + "7001:8388/tcp" + "7001:8388/udp" + "8001:8888" + + # qbittorrent + "8080:8080" + "6881:6881/tcp" + "6881:6881/udp" + + # jdownloader + "5800:5800" + ]; + }; + }; +} diff --git a/mod/docker/jdownloader.nix b/mod/docker/jdownloader.nix new file mode 100644 index 0000000..0f8c8d1 --- /dev/null +++ b/mod/docker/jdownloader.nix @@ -0,0 +1,22 @@ +_: +{ + virtualisation.oci-containers.containers = { + # qbittorrent + jdownloader = { + autoStart = true; + image = "jlesage/jdownloader-2:latest"; + networks = [ + "container:pvpn-de-01" + ]; + environment = { + TZ="Europe/Berlin"; + KEEP_APP_RUNNING="1"; + DARK_MODE="1"; + }; + volumes = [ + "/srv/docker/jdownloader/config:/config:rw" + "/srv/docker/jdownloader/downloads:/output:rw" + ]; + }; + }; +} diff --git a/mod/docker/qbittorrent.nix b/mod/docker/qbittorrent.nix new file mode 100644 index 0000000..d0502d6 --- /dev/null +++ b/mod/docker/qbittorrent.nix @@ -0,0 +1,21 @@ +_: +{ + virtualisation.oci-containers.containers = { + # qbittorrent + qbittorrent = { + autoStart = true; + image = "qbittorrentofficial/qbittorrent-nox:latest"; + networks = [ + "container:pvpn-de-01" + ]; + environment = { + WEBUI_PORT = "8080"; + TZ="Europe/Berlin"; + }; + volumes = [ + "/srv/docker/qbittorrent/config:/config" + "/srv/docker/qbittorrent/downloads:/downloads" + ]; + }; + }; +} diff --git a/mod/freedom/default.nix b/mod/freedom/default.nix new file mode 100644 index 0000000..f859940 --- /dev/null +++ b/mod/freedom/default.nix @@ -0,0 +1,9 @@ +_: +{ + imports = [ + ./invidious.nix + ./nitter.nix + ./tor.nix + ./unbound.nix + ]; +} diff --git a/mod/freedom/invidious.nix b/mod/freedom/invidious.nix new file mode 100644 index 0000000..2fff7b2 --- /dev/null +++ b/mod/freedom/invidious.nix @@ -0,0 +1,9 @@ +{ config, pkgs, ... }: +{ + services = { + invidious = { + enable = true; + port = 3001; + }; + }; +} diff --git a/mod/freedom/nitter.nix b/mod/freedom/nitter.nix new file mode 100644 index 0000000..ff30fe3 --- /dev/null +++ b/mod/freedom/nitter.nix @@ -0,0 +1,14 @@ +{ config, pkgs, ... }: +{ + services = { + nitter = { + enable = true; + + server = { + https = true; + port = 3002; + hostname = "nitter twitter"; + }; + }; + }; +} diff --git a/mod/freedom/tor.nix b/mod/freedom/tor.nix new file mode 100644 index 0000000..1af76cc --- /dev/null +++ b/mod/freedom/tor.nix @@ -0,0 +1,15 @@ +_: +{ + services.tor = { + enable = true; + enableGeoIP = true; + client = { + enable = true; + socksListenAddress = { + IsolateDestAddr = true; + addr = "10.11.0.10"; + port = 9050; + }; + }; + }; +} diff --git a/mod/freedom/unbound.nix b/mod/freedom/unbound.nix new file mode 100644 index 0000000..28366c7 --- /dev/null +++ b/mod/freedom/unbound.nix @@ -0,0 +1,27 @@ +_: +{ + services.unbound = { + enable = true; + enableRootTrustAnchor = true; + + settings = { + server = { + interface = [ "0.0.0.0" "::0" ]; + + access-control = [ + "127.0.0.0/8 allow" + "10.11.0.0/24 allow" + ]; + + prefetch = true; + qname-minimisation = true; + + hide-identity = true; + hide-version = true; + + harden-glue = true; + harden-dnssec-stripped = true; + }; + }; + }; +} diff --git a/mod/git.nix b/mod/git.nix new file mode 100644 index 0000000..7f7c8ab --- /dev/null +++ b/mod/git.nix @@ -0,0 +1,4 @@ +_: +{ + +} diff --git a/mod/gnupg.nix b/mod/gnupg.nix new file mode 100644 index 0000000..c0aba4e --- /dev/null +++ b/mod/gnupg.nix @@ -0,0 +1,8 @@ +_: +{ + programs.gnupg.agent = { + enable = true; + enableSSHSupport = true; + }; + +} diff --git a/mod/home/home.nix b/mod/home/home.nix new file mode 100644 index 0000000..befb383 --- /dev/null +++ b/mod/home/home.nix @@ -0,0 +1,10 @@ +{ config, pkgs, ... }: +{ + home = { + username = "user"; + homeDirectory = "/home/user"; + + enableNixpkgsReleaseCheck = false; + stateVersion = "26.05"; + }; +} diff --git a/mod/jellyfin.nix b/mod/jellyfin.nix new file mode 100644 index 0000000..6e0192e --- /dev/null +++ b/mod/jellyfin.nix @@ -0,0 +1,9 @@ +{ config, pkgs, ... }: +{ + services = { + jellyfin = { + enable = true; + openFirewall = false; + }; + }; +} diff --git a/mod/networking.nix b/mod/networking.nix new file mode 100644 index 0000000..674b8f7 --- /dev/null +++ b/mod/networking.nix @@ -0,0 +1,22 @@ +_: +{ + networking = { + hostName = "kepler"; + hostId = "a984053d"; + networkmanager = { enable = true; }; + firewall = { enable = false; }; + + interfaces = { + eno1 = { + ipv4.addresses = [{ + address = "10.11.0.10"; + prefixLength = 24; + }]; + }; + }; + defaultGateway = { + address = "10.11.0.1"; + interface = "eno1"; + }; + }; +} diff --git a/mod/pkgs.nix b/mod/pkgs.nix new file mode 100644 index 0000000..ef756ce --- /dev/null +++ b/mod/pkgs.nix @@ -0,0 +1,13 @@ +{ pkgs, ... }: +{ + environment.systemPackages = with pkgs; [ + vim + wget + git + curl + fastfetch + net-tools + ethtool + dhcpcd + ]; +} diff --git a/mod/ssh.nix b/mod/ssh.nix new file mode 100644 index 0000000..798faae --- /dev/null +++ b/mod/ssh.nix @@ -0,0 +1,8 @@ +_: +{ + services = { + openssh = { + enable = true; + }; + }; +} diff --git a/mod/system.nix b/mod/system.nix new file mode 100644 index 0000000..1c8fca3 --- /dev/null +++ b/mod/system.nix @@ -0,0 +1,7 @@ +_: +{ + nix.settings.experimental-features = [ "nix-command" "flakes" ]; + system = { + stateVersion = "26.05"; + }; +} diff --git a/mod/time.nix b/mod/time.nix new file mode 100644 index 0000000..92f2aa3 --- /dev/null +++ b/mod/time.nix @@ -0,0 +1,4 @@ +_: +{ + time.timeZone = "Europe/Berlin"; +} diff --git a/mod/users.nix b/mod/users.nix new file mode 100644 index 0000000..2be8303 --- /dev/null +++ b/mod/users.nix @@ -0,0 +1,15 @@ +_: +{ + users.users.user = { + isNormalUser = true; + extraGroups = [ "wheel" "docker" "network" "plugdev" ]; + + openssh.authorizedKeys.keys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDdCJK3NBMbGwvSxXq0kp/FzWUU0l0D1WX8f4vBubtZ7" ]; + }; + security = { + doas = { + enable = true; + extraConfig = "permit nopass keepenv :wheel"; + }; + }; +}