tbarnouin/nixos-hypervisor
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Format using alejandra
All checks were successful
/ Build Nix targets (push) Successful in 3m36s
Details

Browse source
This commit is contained in:
Théo Barnouin 2025-01-23 14:13:19 +01:00
parent 1a25b198ef
commit 781ce2d5e9
24 changed files with 610 additions and 505 deletions
Download patch file Download diff file Expand all files Collapse all files

14
services/authentik/default.nix
View file

@ -1,14 +1,18 @@
{ inputs, config, lib, authentik-nix, ... }:
let
cfg = config.services.vm_authentik;
in
{
inputs,
config,
lib,
authentik-nix,
...
}: let
cfg = config.services.vm_authentik;
in {
options.services.vm_authentik = {
enable = lib.mkEnableOption "Enable minimal config";
};
config = lib.mkIf cfg.enable {
networking = {
firewall.allowedTCPPorts = [ 9000 9300 9443 ];
firewall.allowedTCPPorts = [9000 9300 9443];
};
};
}

3
services/default.nix
View file

@ -1,5 +1,4 @@
{ inputs, ... }:
{
{inputs, ...}: {
imports = [
./nginx
./gitea

13
services/gitea/default.nix
View file

@ -1,8 +1,11 @@
{ config, pkgs, lib, ... }:
let
cfg = config.services.vm_gitea;
in
{
config,
pkgs,
lib,
...
}: let
cfg = config.services.vm_gitea;
in {
options.services.vm_gitea = {
enable = lib.mkEnableOption "Enable minimal config";
db_ip = lib.mkOption {
@ -27,6 +30,6 @@ in
passwordFile = "/run/secrets/gitea/gitea-dbpass";
};
};
networking.firewall.allowedTCPPorts = [ 3000 ];
networking.firewall.allowedTCPPorts = [3000];
};
}

209
services/grafana/default.nix
View file

@ -1,8 +1,11 @@
{ lib, config, pkgs, ... }:
let
cfg = config.services.vm_grafana;
in
{
lib,
config,
pkgs,
...
}: let
cfg = config.services.vm_grafana;
in {
options.services.vm_grafana = {
enable = lib.mkEnableOption "Enable minimal config";
vm_ip = lib.mkOption {
@ -19,16 +22,16 @@ in
};
};
config = lib.mkIf cfg.enable {
age.secrets ={
age.secrets = {
grafana-db = {
file = ./secrets/grafana-db.age;
file = ./secrets/grafana-db.age;
owner = "grafana";
};
grafana-oauth_secret = {
file = ./secrets/grafana-oauth_secret.age;
file = ./secrets/grafana-oauth_secret.age;
owner = "grafana";
};
kuma-token.file = ./secrets/kuma-token.age;
kuma-token.file = ./secrets/kuma-token.age;
};
services.rsyslogd = {
enable = true;
@ -59,22 +62,22 @@ in
serve_from_sub_path = false;
};
database = {
type = "postgres";
host = "${cfg.pgsql_ip}:5432";
name = "grafana";
user = "grafana";
type = "postgres";
host = "${cfg.pgsql_ip}:5432";
name = "grafana";
user = "grafana";
password = "\$__file{${config.age.secrets.grafana-db.path}}";
};
"auth.generic_oauth" = {
enabled = "true";
name = "authentik";
enabled = "true";
name = "authentik";
allow_sign_up = "true";
client_id = "9HV82G8F92Jcbw4nP8eppMcPpLcAw5uYpejfReLy";
client_id = "9HV82G8F92Jcbw4nP8eppMcPpLcAw5uYpejfReLy";
client_secret = "\$__file{${config.age.secrets.grafana-oauth_secret.path}}";
scopes = "openid email profile";
auth_url = "https://authentik.le43.eu/application/o/authorize/";
token_url = "https://authentik.le43.eu/application/o/token/";
api_url = "https://authentik.le43.eu/application/o/userinfo/";
scopes = "openid email profile";
auth_url = "https://authentik.le43.eu/application/o/authorize/";
token_url = "https://authentik.le43.eu/application/o/token/";
api_url = "https://authentik.le43.eu/application/o/userinfo/";
role_attribute_path = "contains(groups, 'admin') && 'Admin' || contains(groups, 'admin') && 'Editor' || 'Viewer';role_attribute_strict = false";
allow_assign_grafana_admin = "true";
};
@ -88,95 +91,125 @@ in
job_name = "kuma";
scrape_interval = "30s";
scheme = "http";
static_configs = [{
targets = [ "192.168.1.90:3001" ];
}];
static_configs = [
{
targets = ["192.168.1.90:3001"];
}
];
basic_auth.username = "tbarnouin";
basic_auth.password_file = config.age.secrets.kuma-token.path;
}
{
job_name = "grafana";
static_configs = [{
targets = [ "127.0.0.1:9002" ];
}];
static_configs = [
{
targets = ["127.0.0.1:9002"];
}
];
}
{
job_name = "openmediavault_cadvisor";
static_configs = [{
targets = [ "192.168.1.125:8080" ];
}];
static_configs = [
{
targets = ["192.168.1.125:8080"];
}
];
}
{
job_name = "opportunity";
static_configs = [{
targets = [ "192.168.1.125:9100" ];
}];
static_configs = [
{
targets = ["192.168.1.125:9100"];
}
];
}
{
job_name = "nginx";
static_configs = [{
targets = [ "${cfg.proxy_ip}:9002" ];
}];
static_configs = [
{
targets = ["${cfg.proxy_ip}:9002"];
}
];
}
{
job_name = "redis";
static_configs = [{
targets = [ "192.168.1.16:9002" ];
}];
static_configs = [
{
targets = ["192.168.1.16:9002"];
}
];
}
{
job_name = "ingenuity";
static_configs = [{
targets = [ "192.168.1.90:9100" ];
}];
static_configs = [
{
targets = ["192.168.1.90:9100"];
}
];
}
{
job_name = "gitea";
static_configs = [{
targets = [ "192.168.1.14:9100" ];
}];
static_configs = [
{
targets = ["192.168.1.14:9100"];
}
];
}
{
job_name = "postgresql";
static_configs = [{
targets = [ "192.168.1.13:9100" ];
}];
static_configs = [
{
targets = ["192.168.1.13:9100"];
}
];
}
{
job_name = "nextcloud";
static_configs = [{
targets = [ "192.168.1.44:9100" ];
}];
static_configs = [
{
targets = ["192.168.1.44:9100"];
}
];
}
{
job_name = "deluge";
static_configs = [{
targets = [ "192.168.1.18:9100" ];
}];
static_configs = [
{
targets = ["192.168.1.18:9100"];
}
];
}
{
job_name = "netbox";
static_configs = [{
targets = [ "192.168.1.45:9100" ];
}];
static_configs = [
{
targets = ["192.168.1.45:9100"];
}
];
}
{
job_name = "jellyfin";
static_configs = [{
targets = [ "192.168.1.42:9100" ];
}];
static_configs = [
{
targets = ["192.168.1.42:9100"];
}
];
}
{
job_name = "authentik-ldap";
static_configs = [{
targets = [ "192.168.1.41:9100" ];
}];
static_configs = [
{
targets = ["192.168.1.41:9100"];
}
];
}
{
job_name = "authentik";
static_configs = [{
targets = [ "192.168.1.25:9002" ];
}];
static_configs = [
{
targets = ["192.168.1.25:9002"];
}
];
}
];
};
@ -202,16 +235,18 @@ in
chunk_retain_period = "30s";
};
schema_config = {
configs = [{
from = "2022-06-06";
store = "boltdb-shipper";
object_store = "filesystem";
schema = "v13";
index = {
prefix = "index_";
period = "24h";
};
}];
configs = [
{
from = "2022-06-06";
store = "boltdb-shipper";
object_store = "filesystem";
schema = "v13";
index = {
prefix = "index_";
period = "24h";
};
}
];
};
storage_config = {
boltdb_shipper = {
@ -255,14 +290,16 @@ in
positions = {
filename = "/tmp/positions.yaml";
};
clients = [{
url = "http://127.0.0.1:3100/loki/api/v1/push";
}];
clients = [
{
url = "http://127.0.0.1:3100/loki/api/v1/push";
}
];
scrape_configs = [
{
job_name = "syslog";
syslog = {
listen_address = "0.0.0.0:1514";
listen_address = "0.0.0.0:1514";
listen_protocol = "tcp";
idle_timeout = "60s";
labels = {
@ -271,27 +308,27 @@ in
};
relabel_configs = [
{
source_labels = [ "__syslog_message_hostname" ];
source_labels = ["__syslog_message_hostname"];
target_label = "host";
}
{
source_labels = [ "__syslog_message_hostname" ];
source_labels = ["__syslog_message_hostname"];
target_label = "hostname";
}
{
source_labels = [ "__syslog_message_severity" ];
source_labels = ["__syslog_message_severity"];
target_label = "level";
}
{
source_labels = [ "__syslog_message_app_name" ];
source_labels = ["__syslog_message_app_name"];
target_label = "application";
}
{
source_labels = [ "__syslog_message_facility" ];
source_labels = ["__syslog_message_facility"];
target_label = "facility";
}
{
source_labels = [ "__syslog_connection_hostname" ];
source_labels = ["__syslog_connection_hostname"];
target_label = "connection_hostname";
}
];
@ -301,7 +338,7 @@ in
};
# Open ports in the firewall.
networking.firewall.allowedTCPPorts = [ 3000 3100 3101 8086 9001 1514 514 ];
networking.firewall.allowedUDPPorts = [ 514 ];
networking.firewall.allowedTCPPorts = [3000 3100 3101 8086 9001 1514 514];
networking.firewall.allowedUDPPorts = [514];
};
}

13
services/jellyfin/default.nix
View file

@ -1,13 +1,16 @@
{ lib, config, pkgs, ... }:
let
cfg = config.services.vm_jellyfin;
in
{
lib,
config,
pkgs,
...
}: let
cfg = config.services.vm_jellyfin;
in {
options.services.vm_jellyfin = {
enable = lib.mkEnableOption "Enable minimal config";
};
config = lib.mkIf cfg.enable {
environment.systemPackages = [ pkgs.cifs-utils ];
environment.systemPackages = [pkgs.cifs-utils];
services.jellyfin = {
enable = true;
user = "tbarnouin";

53
services/minimalConfig/default.nix
View file

@ -1,20 +1,25 @@
{ config, pkgs, lib, inputs, modulesPath, ... }:
{
config,
pkgs,
lib,
inputs,
modulesPath,
...
}: {
imports = [
./lxc.nix
./vm.nix
];
nix = {
settings.experimental-features = [ "nix-command" "flakes" ];
settings.trusted-users = [ "root" "@wheel" ];
settings.experimental-features = ["nix-command" "flakes"];
settings.trusted-users = ["root" "@wheel"];
};
networking = {
firewall = {
enable = true;
allowedTCPPorts = [ 22 9002 ];
allowedTCPPorts = [22 9002];
};
};
@ -22,7 +27,7 @@
console.keyMap = "fr";
i18n.defaultLocale = "fr_FR.UTF-8";
environment.sessionVariables = rec {
TERM = "xterm-256color";
TERM = "xterm-256color";
};
nix.gc = {
@ -35,7 +40,7 @@
users = {
users.tbarnouin = {
isNormalUser = true;
extraGroups = [ "wheel" ];
extraGroups = ["wheel"];
shell = pkgs.zsh;
openssh.authorizedKeys.keys = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAxccGxdfOFXeEClqz3ULl94ubzaJnk4pUus+ek18G0B tbarnouin@nixos"
@ -58,7 +63,7 @@
};
ohMyZsh = {
enable = true;
plugins = [ "git" ];
plugins = ["git"];
theme = "bira";
};
};
@ -70,21 +75,21 @@
nixpkgs.config.allowUnfree = true;
environment = {
localBinInPath = true;
systemPackages = with pkgs; [
vim
bash
wget
curl
git
htop
tree
dig
ncdu
nmap
iperf3
netcat-openbsd
];
};
systemPackages = with pkgs; [
vim
bash
wget
curl
git
htop
tree
dig
ncdu
nmap
iperf3
netcat-openbsd
];
};
services = {
openssh = {
@ -110,7 +115,7 @@
exporters = {
node = {
enable = true;
enabledCollectors = [ "systemd" ];
enabledCollectors = ["systemd"];
port = 9002;
};
};

11
services/minimalConfig/lxc.nix
View file

@ -1,8 +1,11 @@
{lib, config, modulesPath, ...}:
let
cfg = config.services.lxc;
in
{
lib,
config,
modulesPath,
...
}: let
cfg = config.services.lxc;
in {
options.services.lxc = {
enable = lib.mkEnableOption "Enable LXC container config";
};

11
services/minimalConfig/vm.nix
View file

@ -1,8 +1,11 @@
{lib, config, modulesPath, ...}:
let
cfg = config.services.vm;
in
{
lib,
config,
modulesPath,
...
}: let
cfg = config.services.vm;
in {
options.services.vm = {
enable = lib.mkEnableOption "Enable LXC container config";
};

19
services/nextcloud/default.nix
View file

@ -1,8 +1,11 @@
{ lib, config, pkgs, ... }:
let
cfg = config.services.vm_nextcloud;
in
{
lib,
config,
pkgs,
...
}: let
cfg = config.services.vm_nextcloud;
in {
options.services.vm_nextcloud = {
enable = lib.mkEnableOption "Enable minimal config";
proxy_ip = lib.mkOption {
@ -53,8 +56,8 @@ in
"opcache.memory_consumption" = "512";
};
settings = {
trusted_proxies = [ "${cfg.proxy_ip}" ];
trusted_domains = [ "${cfg.proxy_ip}" ];
trusted_proxies = ["${cfg.proxy_ip}"];
trusted_domains = ["${cfg.proxy_ip}"];
overwriteprotocol = "http";
overwrite.cli.url = "http://${cfg.proxy_ip}/cloud/";
"overwritehost" = "${cfg.proxy_ip}";
@ -68,11 +71,11 @@ in
dbuser = "nextcloud";
dbtype = "pgsql";
dbpassFile = "/run/secrets/nextcloud/nextcloud-dbpass";
adminuser = "tbarnouin";
adminuser = "tbarnouin";
adminpassFile = "/run/secrets/nextcloud/nextcloud-adminpass";
};
};
};
networking.firewall.allowedTCPPorts = [ 80 ];
networking.firewall.allowedTCPPorts = [80];
};
}

13
services/nginx/default.nix
View file

@ -1,8 +1,11 @@
{ config, pkgs, lib, ... }:
let
cfg = config.services.vm_nginx;
in
{
config,
pkgs,
lib,
...
}: let
cfg = config.services.vm_nginx;
in {
options.services.vm_nginx = {
enable = lib.mkEnableOption "Enable minimal config";
};
@ -158,6 +161,6 @@ in
};
};
};
networking.firewall.allowedTCPPorts = [ 80 443 ];
networking.firewall.allowedTCPPorts = [80 443];
};
}

17
services/onlyoffice/default.nix
View file

@ -1,8 +1,11 @@
{ config, pkgs, lib, ... }:
let
cfg = config.services.vm_onlyoffice;
in
{
config,
pkgs,
lib,
...
}: let
cfg = config.services.vm_onlyoffice;
in {
options.services.vm_onlyoffice = {
enable = lib.mkEnableOption "Enable OnlyOffice service";
pgsql_ip = lib.mkOption {
@ -13,11 +16,11 @@ in
config = lib.mkIf cfg.enable {
age.secrets = {
office-dbpass = {
file = ./secrets/office-dbpass.age;
file = ./secrets/office-dbpass.age;
owner = "onlyoffice";
};
office-jwtpass = {
file = ./secrets/office-jwtpass.age;
file = ./secrets/office-jwtpass.age;
owner = "onlyoffice";
};
};
@ -33,6 +36,6 @@ in
jwtSecretFile = config.age.secrets.office-jwtpass.path;
};
};
networking.firewall.allowedTCPPorts = [ 80 4369 5432 5672 6379 8000 8080 ];
networking.firewall.allowedTCPPorts = [80 4369 5432 5672 6379 8000 8080];
};
}

13
services/postgresql/default.nix
View file

@ -1,8 +1,11 @@
{ lib, config, pkgs, ... }:
let
cfg = config.services.vm_postgresql;
in
{
lib,
config,
pkgs,
...
}: let
cfg = config.services.vm_postgresql;
in {
options.services.vm_postgresql = {
enable = lib.mkEnableOption "Enable minimal config";
};
@ -44,6 +47,6 @@ in
alter user nextcloud with password 'password';
'';
};
networking.firewall.allowedTCPPorts = [ 5432 ];
networking.firewall.allowedTCPPorts = [5432];
};
}

15
services/redis/default.nix
View file

@ -1,8 +1,11 @@
{ config, pkgs, lib, ... }:
let
cfg = config.services.vm_redis;
in
{
config,
pkgs,
lib,
...
}: let
cfg = config.services.vm_redis;
in {
options.services.vm_redis = {
enable = lib.mkEnableOption "Enable minimal config";
};
@ -16,8 +19,8 @@ in
settings = {
protected-mode = "no";
};
};
};
};
networking.firewall.allowedTCPPorts = [ 6379 ];
networking.firewall.allowedTCPPorts = [6379];
};
}