diff options
Diffstat (limited to 'modules')
| -rw-r--r-- | modules/hardware.nix | 54 | ||||
| -rw-r--r-- | modules/media/config.nix | 15 | ||||
| -rw-r--r-- | modules/media/default.nix | 73 | ||||
| -rw-r--r-- | modules/network/default.nix | 37 | ||||
| -rw-r--r-- | modules/network/ssh.nix | 11 | ||||
| -rw-r--r-- | modules/users.nix | 20 |
6 files changed, 210 insertions, 0 deletions
diff --git a/modules/hardware.nix b/modules/hardware.nix new file mode 100644 index 0000000..f936109 --- /dev/null +++ b/modules/hardware.nix @@ -0,0 +1,54 @@ +{ lib, pkgs, modulesPath, ... }: +{ + imports = [ + (modulesPath + "/installer/scan/not-detected.nix") + ]; + + boot.initrd = { + availableKernelModules = [ "xhci_pci" "ahci" "nvme" "usb_storage" "sd_mod" ]; + kernelModules = [ ]; + }; + boot.kernelModules = [ + "kvm-intel" + "sd_mod" + ]; + hardware = { + enableAllFirmware = true; + cpu.intel.updateMicrocode = true; + }; + nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux"; + + # Bootloader + boot.loader = { + systemd-boot = { + enable = true; + configurationLimit = 30; + }; + timeout = 1; + efi.canTouchEfiVariables = true; + }; + + # File system + fileSystems = { + "/" = { + device = "/dev/disk/by-label/nixos"; + fsType = "ext4"; + }; + "/boot" = { + device = "/dev/disk/by-label/boot"; + fsType = "vfat"; + }; + "/media" = { + device = "/dev/disk/by-label/media"; + fsType = "ext4"; + options = [ "rw" "nofail" "x-systemd.automount" "x-systemd.mount-timeout=30s" ]; + }; + }; + swapDevices = [{ device = "/dev/disk/by-label/swap"; }]; + + networking.useDHCP = lib.mkDefault true; + powerManagement = { + enable = true; + cpuFreqGovernor = "powersave"; + }; +} diff --git a/modules/media/config.nix b/modules/media/config.nix new file mode 100644 index 0000000..1703901 --- /dev/null +++ b/modules/media/config.nix @@ -0,0 +1,15 @@ +rec { + mediaBaseDir = "/media"; + downloadsDir = "${mediaBaseDir}/_downloads"; + incompleteDownloadsDir = "${downloadsDir}/_incomplete"; + + tvDownloads = "${mediaBaseDir}/tv"; + moviesDownloads = "${mediaBaseDir}/movies"; + + radarrPort = 7878; + sonarrPort = 8989; + prowlarrPort = 9696; + jellyfinPort = 8096; + + group = "multimedia"; +} diff --git a/modules/media/default.nix b/modules/media/default.nix new file mode 100644 index 0000000..0708d8e --- /dev/null +++ b/modules/media/default.nix @@ -0,0 +1,73 @@ +{ pkgs, ... }: +let + config = import ./config.nix; +in +{ + systemd.tmpfiles.rules = [ + "d ${config.mediaBaseDir} 0770 - ${config.group} - -" + "d ${config.downloadsDir} 0770 - ${config.group} - -" + "d ${config.tvDownloads} 0770 - ${config.group} - -" + "d ${config.moviesDownloads} 0770 - ${config.group} - -" + ]; + users.groups."${config.group}" = { }; + users.users.bacchus.extraGroups = [ config.group ]; + + services.sonarr = { + enable = true; + openFirewall = true; + group = config.group; + settings = { + server.port = config.sonarrPort; + auth.enabled = false; + }; + }; + + services.radarr = { + enable = true; + openFirewall = true; + group = config.group; + settings = { + server.port = config.radarrPort; + auth.enabled = false; + }; + }; + + services.prowlarr = { + enable = true; + openFirewall = true; + settings = { + server.port = config.prowlarrPort; + }; + }; + + services.jellyfin = { + enable = true; + openFirewall = true; + group = config.group; + }; + + services.transmission = { + enable = true; + group = config.group; + settings = { + "download-dir" = config.downloadsDir; + "download-queue-enabled" = true; + "download-queue-size" = 5; + "peer-port" = 51413; + "peer-port-random-high" = 65535; + "peer-port-random-low" = 49152; + "prefetch-enabled" = true; + "rename-partial-files" = true; + "rpc-authentication-required" = false; + "rpc-bind-address" = "127.0.0.1"; + "rpc-enabled" = true; + "rpc-port" = 9091; + "rpc-whitelist-enabled" = true; + "script-torrent-done-enabled" = false; + "start-added-torrents" = true; + "trash-original-torrent-files" = false; + "umask" = 18; + "utp-enabled" = true; + }; + }; +} diff --git a/modules/network/default.nix b/modules/network/default.nix new file mode 100644 index 0000000..444f53c --- /dev/null +++ b/modules/network/default.nix @@ -0,0 +1,37 @@ +{ ... }: +let + private = import ../../config.private.nix; +in { + imports = [ ./ssh.nix ]; + + networking = { + hostName = "bacchus"; + + firewall = { + enable = true; + }; + + networkmanager = { + enable = true; + # wifi.powersave = true; + ensureProfiles.profiles = { + home-wifi = { + connection = { + id = "home-wifi"; + type = "wifi"; + autoconnect = true; + }; + wifi = { + mode = "infrastructure"; + ssid = private.wireless.ssid; + }; + wifi-security = { + auth-alg = "open"; + key-mgmt = "wpa-psk"; + psk = private.wireless.password; + }; + }; + }; + }; + }; +} diff --git a/modules/network/ssh.nix b/modules/network/ssh.nix new file mode 100644 index 0000000..e4e5b2a --- /dev/null +++ b/modules/network/ssh.nix @@ -0,0 +1,11 @@ +{ lib, ... }: +let + private = import ../../config.private.nix; +in { + services.sshd.enable = true; + + # Auth + # TODO: dont allow via password + # openssh.authorizedKeys.keys = private.ssh.authorizedKeys; + services.openssh.settings.PermitRootLogin = "yes"; +} diff --git a/modules/users.nix b/modules/users.nix new file mode 100644 index 0000000..0a08c2c --- /dev/null +++ b/modules/users.nix @@ -0,0 +1,20 @@ +{ pkgs, ... }: +let + private = import ../config.private.nix; +in { + users.users.root.password = private.passwords.root; + + users.users.bacchus = { + isNormalUser = true; + shell = pkgs.bash; + extraGroups = [ + "wheel" + "input" + "networkmanager" + "git" + "docker" + "transmission" + "multimedia" + ]; + }; +} |