first commit

flake.nix

@@ -0,0 +1,28 @@
+{
+  inputs = {
+    nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";
+    home-manager.url = "github:nix-community/home-manager";
+  };
+  outputs = { self, nixpkgs, home-manager, ... }@inputs:
+    let
+      system = "x86_64-linux";
+    in {
+    nixosConfigurations.kepler = nixpkgs.lib.nixosSystem {
+      system = "x86_64-linux";
+      specialArgs = { inherit inputs system; };
+      modules = [
+        ./hosts/kepler/configuration.nix
+        home-manager.nixosModules.home-manager
+        {
+          home-manager = {
+            useGlobalPkgs = true;
+            useUserPackages = true;
+            extraSpecialArgs = { inherit inputs; };
+            users.user = ./mod/home/home.nix;
+          };
+        }
+      ];
+    };
+  };
+}
+

hosts/kepler/configuration.nix

@@ -0,0 +1,12 @@
+{ config, lib, pkgs, ... }:
+
+{
+  imports = [
+    ./hardware-configuration.nix
+    ../../mod/default.nix
+  ];
+
+  time.timeZone = "Europe/Berlin";
+
+}
+

hosts/kepler/hardware-configuration.nix

@@ -0,0 +1,31 @@
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports =
+    [ (modulesPath + "/installer/scan/not-detected.nix")
+    ];
+
+  boot.initrd.availableKernelModules = [ "ehci_pci" "ahci" "mpt3sas" "usb_storage" "usbhid" "sd_mod" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-intel" ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" =
+    { device = "rpool/root";
+      fsType = "zfs";
+    };
+
+  fileSystems."/boot" =
+    { device = "/dev/disk/by-uuid/9B62-3696";
+      fsType = "vfat";
+      options = [ "fmask=0022" "dmask=0022" ];
+    };
+  fileSystems."/data/storage" = {
+      device = "data/storage";
+      fsType = "zfs";
+  };
+  swapDevices = [ ];
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+}

mod/boot.nix

@@ -0,0 +1,25 @@
+_:
+{
+  boot = {
+    loader = {
+      systemd-boot = {
+        enable = true;
+      };
+      efi = {
+        canTouchEfiVariables = true;
+      };
+    };
+    initrd.systemd.enable = true;
+    supportedFilesystems = [ "zfs" ];
+    
+    zfs = {
+      devNodes = "/dev/disk/by-id";
+      forceImportRoot = true;
+      forceImportAll = true;
+    };
+    kernelParams = [ "scsi_mod.scan=sync" "rootdelay=10" "zfs.zfs_arc_max=34359738368" ]; 
+    extraModprobeConfig = ''
+      options scsi_mod scan=sync
+    '';
+  };
+}

mod/default.nix

@@ -0,0 +1,16 @@
+_:
+{
+  imports = [
+    ./boot.nix
+    ./networking.nix
+    ./users.nix
+    ./gnupg.nix
+    ./pkgs.nix
+    ./system.nix
+    ./ssh.nix
+    ./time.nix
+    ./jellyfin.nix
+    ./freedom/default.nix
+    ./docker/default.nix
+  ];
+}

mod/docker/default.nix

@@ -0,0 +1,21 @@
+{ config, pkgs, ... }:
+{
+  virtualisation = {
+    oci-containers = {
+      backend = "docker";
+    };
+    docker = {
+      enable = true;
+      enableOnBoot = true;
+      rootless = {
+        enable = true;
+        setSocketVariable = true;
+      };
+    };
+  };
+  imports = [
+    ./gluetun.nix
+    ./qbittorrent.nix
+    ./jdownloader.nix
+  ];
+}

mod/docker/gluetun.nix

@@ -0,0 +1,56 @@
+{ config, pkgs, ... }:
+let
+  protonvpnConfig = {
+    VPN_SERVICE_PROVIDER = "protonvpn";
+    VPN_PORT_FORWARDING = "on";
+    VPN_PORT_FORWARDING_PROVIDER="protonvpn";
+  };
+  gluetunConfig = {
+    SHADOWSOCKS = "on";
+    HTTPPROXY = "on";
+    HTTPPROXY_STEALTH = "on";
+
+    FIREWALL_OUTBOUND_SUBNETS="10.11.0.0/24";
+    DNS_UPSTREAM_RESOLVERS = "cloudflare"; 
+    
+    BLOCK_SURVEILLANCE="on";
+    BLOCK_ADS="on";
+    BLOCK_MALICIOUS="on";
+  };
+in
+{
+  virtualisation.oci-containers.containers = {
+    # protonvpn
+    pvpn-de-01 = {
+      autoStart = true;
+      image = "qmcgaw/gluetun:latest";
+      capabilities = { NET_ADMIN = true; };
+      devices = [ "/dev/net/tun:/dev/net/tun" ];
+      environmentFiles = [
+        "/etc/secrets/gluetun.env"
+      ];
+      environment = {
+        # GLUETUN ENV VARS #
+        VPN_TYPE="openvpn";
+        SERVER_COUNTRIES = "Germany";
+        VPN_INTERFACE="tun0";
+        
+      } // protonvpnConfig // gluetunConfig;
+      ports = [ 
+        # gluetun
+        "8000:8000" 
+        "7001:8388/tcp"
+        "7001:8388/udp"
+        "8001:8888"
+
+        # qbittorrent
+        "8080:8080"
+        "6881:6881/tcp"
+        "6881:6881/udp"
+
+        # jdownloader
+        "5800:5800"
+      ];
+    };
+  };
+}

mod/docker/jdownloader.nix

@@ -0,0 +1,22 @@
+_:
+{
+  virtualisation.oci-containers.containers = {
+    # qbittorrent
+    jdownloader = {
+      autoStart = true;
+      image = "jlesage/jdownloader-2:latest";
+      networks = [
+        "container:pvpn-de-01"
+      ];
+      environment = {
+        TZ="Europe/Berlin";
+        KEEP_APP_RUNNING="1";
+        DARK_MODE="1";
+      };
+      volumes = [
+        "/srv/docker/jdownloader/config:/config:rw"
+        "/srv/docker/jdownloader/downloads:/output:rw"
+      ];
+    };
+  };
+}

mod/docker/qbittorrent.nix

@@ -0,0 +1,21 @@
+_:
+{
+  virtualisation.oci-containers.containers = {
+    # qbittorrent
+    qbittorrent = {
+      autoStart = true;
+      image = "qbittorrentofficial/qbittorrent-nox:latest";
+      networks = [
+        "container:pvpn-de-01"
+      ];
+      environment = {
+        WEBUI_PORT = "8080";
+        TZ="Europe/Berlin";
+      };
+      volumes = [
+        "/srv/docker/qbittorrent/config:/config"
+        "/srv/docker/qbittorrent/downloads:/downloads"
+      ];
+    };
+  };
+}

mod/freedom/default.nix

@@ -0,0 +1,9 @@
+_:
+{
+  imports = [
+    ./invidious.nix
+    ./nitter.nix
+    ./tor.nix
+    ./unbound.nix
+  ];
+}

mod/freedom/invidious.nix

@@ -0,0 +1,9 @@
+{ config, pkgs, ... }:
+{
+  services = {
+    invidious = {
+      enable = true;
+      port = 3001;
+    };
+  };
+}

mod/freedom/nitter.nix

@@ -0,0 +1,14 @@
+{ config, pkgs, ... }:
+{
+  services = {
+    nitter = {
+      enable = true;
+
+      server = {
+        https = true;
+        port = 3002;
+        hostname = "nitter twitter";
+      };
+    };
+  };
+}

mod/freedom/tor.nix

@@ -0,0 +1,15 @@
+_:
+{
+  services.tor = {
+    enable = true;
+    enableGeoIP = true;
+    client = {
+      enable = true;
+      socksListenAddress = { 
+        IsolateDestAddr = true; 
+        addr = "10.11.0.10"; 
+        port = 9050;
+      };
+    };
+  };
+}

mod/freedom/unbound.nix

@@ -0,0 +1,27 @@
+_:
+{
+  services.unbound = {
+    enable = true;
+    enableRootTrustAnchor = true;
+
+    settings = {
+      server = {
+        interface = [ "0.0.0.0" "::0" ];
+
+        access-control = [
+          "127.0.0.0/8 allow"
+          "10.11.0.0/24 allow"
+        ];
+
+        prefetch = true;
+        qname-minimisation = true;
+
+        hide-identity = true;
+        hide-version = true;
+
+        harden-glue = true;
+        harden-dnssec-stripped = true;
+      };
+    };
+  };
+}

mod/git.nix

@@ -0,0 +1,4 @@
+_:
+{
+     
+}

mod/gnupg.nix

@@ -0,0 +1,8 @@
+_:
+{
+  programs.gnupg.agent = {
+    enable = true;
+    enableSSHSupport = true;
+  };
+
+}

mod/home/home.nix

@@ -0,0 +1,10 @@
+{ config, pkgs, ... }:
+{
+  home = {
+    username = "user";
+    homeDirectory = "/home/user";
+
+    enableNixpkgsReleaseCheck = false;
+    stateVersion = "26.05";
+  };
+}

mod/jellyfin.nix

@@ -0,0 +1,9 @@
+{ config, pkgs, ... }:
+{
+  services = {
+    jellyfin = {
+      enable = true;
+      openFirewall = false;
+    };
+  };
+}

mod/networking.nix

@@ -0,0 +1,22 @@
+_:
+{
+  networking = {
+    hostName = "kepler";
+    hostId = "a984053d";
+    networkmanager = { enable = true; };
+    firewall = { enable = false; };
+    
+    interfaces = { 
+      eno1 = {
+        ipv4.addresses = [{
+          address = "10.11.0.10";
+          prefixLength = 24;
+        }];
+      };
+    };
+    defaultGateway = {
+      address = "10.11.0.1";
+      interface = "eno1";
+    };
+  };
+}

mod/pkgs.nix

@@ -0,0 +1,13 @@
+{ pkgs, ... }:
+{
+  environment.systemPackages = with pkgs; [
+    vim
+    wget
+    git
+    curl
+    fastfetch
+    net-tools
+    ethtool
+    dhcpcd
+  ];
+}

mod/ssh.nix

@@ -0,0 +1,8 @@
+_:
+{
+  services = {
+    openssh = {
+      enable = true;
+    };
+  };
+}

mod/system.nix

@@ -0,0 +1,7 @@
+_:
+{
+  nix.settings.experimental-features = [ "nix-command" "flakes" ];
+  system = {
+    stateVersion = "26.05";
+  };
+}

mod/time.nix

@@ -0,0 +1,4 @@
+_:
+{
+  time.timeZone = "Europe/Berlin";
+}

mod/users.nix

@@ -0,0 +1,15 @@
+_:
+{
+  users.users.user = {
+    isNormalUser = true;
+    extraGroups = [ "wheel" "docker" "network" "plugdev" ];
+  
+    openssh.authorizedKeys.keys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDdCJK3NBMbGwvSxXq0kp/FzWUU0l0D1WX8f4vBubtZ7" ];
+  };
+  security = {
+    doas = {
+      enable = true;
+      extraConfig = "permit nopass keepenv :wheel";
+    };
+  };
+}