all repos — nixfiles @ 4ec17da5c6f0be2592f974e2d034405da37f0001

System and user configuration, managed by nix and home-manager

system/hosts/r5.nix (view raw)

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
{
  pkgs,
  ...
}:
let
  hostName = "r5";
  domain = "home.arpa";

  wan = "wan0";
  bridge = "br0";
in
{
  imports = [
    ../roles/home.nix
    ../roles/server.nix
    ../roles/router.nix
    ../roles/local-ca.nix
    ../roles/dynamic-dns.nix
    ../roles/exit-node.nix
    ../roles/tailscale-subnet-router.nix
    ../settings/hardware/usb-serial-tty.nix
  ];
  age.secrets = {
    acme.file = ../../secrets/acme.age;
    syncthing.file = ../../secrets/syncthing.age;
  };

  services.getty.autologinUser = "root";
  systemd.services."autovt@tty1".enable = false;

  nanopi.network.r8125 = true;
  networking = {
    inherit domain hostName;
    # see ../roles/router.nix for remaining settings
    nat = {
      externalInterface = wan;
      internalInterfaces = [ bridge ];
    };
  };

  systemd.network = {
    netdevs = {
      "20-${bridge}" = {
        netdevConfig = {
          Kind = "bridge";
          Name = "${bridge}";
        };
      };
    };
    networks = {
      "30-lan1" = {
        matchConfig.Path = "platform-3c0000000.pcie-*";
        networkConfig.Bridge = bridge;
        linkConfig.RequiredForOnline = "enslaved";
      };
      "30-lan2" = {
        matchConfig.Path = "platform-3c0400000.pcie-*";
        networkConfig.Bridge = bridge;
        linkConfig.RequiredForOnline = "enslaved";
      };
      "40-${bridge}" = {
        matchConfig.Name = bridge;
        bridgeConfig = { };
        linkConfig = {
          RequiredForOnline = "routable";
        };
        networkConfig = {
          BindCarrier = [
            "lan1"
            "lan2"
          ];
        };
      };
    };
  };

  environment.systemPackages = with pkgs; [
    file
    tree
    knot-dns
  ];

  users.users.alin = {
    isNormalUser = true;
    extraGroups = [ "wheel" ];
    openssh.authorizedKeys.keys = [
      "ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBENXbdPPOq0mA+9bPklpUkikvIXjCEKE5IRwNPNMr5/Ta1J/ND737fexCjEb7YPoAJtaf0gD/JThQQi/RxDTvy4= alin@secretive.marvin.local"
    ];
  };

  nix = {
    settings = {
      max-jobs = 2;
    };
  };

  boot.kernelModules = [
    "rtc_rk808"
    # this RTC supposedly has a battery, but doesn't seem to work
    # "rtc_hym8563"
  ];
  services.timesyncd.enable = false;
  services.chrony = {
    enable = true;
    makestep = {
      enable = true;
    };
    enableRTCTrimming = true;
    extraConfig = ''
      rtcdevice /dev/rtc0

      allow
    '';
  };

  system.stateVersion = "25.11";
}