set up nanopi r5s with nixos again
5 files changed, 259 insertions(+), 8 deletions(-)
M flake.lock → flake.lock
@@ -226,7 +226,25 @@ } }, "flake-utils_3": { "inputs": { - "systems": "systems_5" + "systems": "systems_4" + }, + "locked": { + "lastModified": 1731533236, + "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=", + "owner": "numtide", + "repo": "flake-utils", + "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b", + "type": "github" + }, + "original": { + "owner": "numtide", + "repo": "flake-utils", + "type": "github" + } + }, + "flake-utils_4": { + "inputs": { + "systems": "systems_6" }, "locked": { "lastModified": 1731533236,@@ -390,6 +408,27 @@ "type": "git", "url": "https://git.alin.ovh/mycal" } }, + "nanopi": { + "inputs": { + "flake-utils": "flake-utils_3", + "nixpkgs": [ + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1764694773, + "narHash": "sha256-YbabnO3lpLCQiJcrso2oSmxP87QUvNzk7XcwOaijC1s=", + "owner": "bdew", + "repo": "nixos-nanopi", + "rev": "99e20547f2defa2f34eb0f86643469e7875beaac", + "type": "github" + }, + "original": { + "owner": "bdew", + "repo": "nixos-nanopi", + "type": "github" + } + }, "nix-darwin": { "inputs": { "nixpkgs": [@@ -606,7 +645,7 @@ "flake-parts": "flake-parts_2", "nixpkgs": [ "nixpkgs" ], - "systems": "systems_4" + "systems": "systems_5" }, "locked": { "lastModified": 1767361654,@@ -726,6 +765,7 @@ "flexoki": "flexoki", "home-manager": "home-manager", "minimal-emacs": "minimal-emacs", "mycal": "mycal", + "nanopi": "nanopi", "nix-rosetta-builder": "nix-rosetta-builder", "nixos-generators": "nixos-generators_2", "nixos-hardware": "nixos-hardware",@@ -741,7 +781,7 @@ } }, "searchix": { "inputs": { - "flake-utils": "flake-utils_3", + "flake-utils": "flake-utils_4", "gomod2nix": "gomod2nix_2", "nixpkgs": "nixpkgs_4", "pre-commit-hooks": "pre-commit-hooks",@@ -859,6 +899,21 @@ "type": "github" } }, "systems_5": { + "locked": { + "lastModified": 1681028828, + "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=", + "owner": "nix-systems", + "repo": "default", + "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e", + "type": "github" + }, + "original": { + "owner": "nix-systems", + "repo": "default", + "type": "github" + } + }, + "systems_6": { "locked": { "lastModified": 1681028828, "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
M flake.nix → flake.nix
@@ -6,6 +6,10 @@ }; nixos-hardware = { url = "github:NixOS/nixos-hardware"; }; + nanopi = { + url = "github:bdew/nixos-nanopi"; + inputs.nixpkgs.follows = "nixpkgs"; + }; nixpkgs.follows = "srvos/nixpkgs"; darwin = {@@ -123,14 +127,14 @@ common-gpu-nvidia-nonprime ] ); }; - nixosConfigurations.nano = nixpkgs.lib.nixosSystem { + nixosConfigurations.r5 = nixpkgs.lib.nixosSystem { system = "aarch64-linux"; modules = [ agenix.nixosModules.default srvos.nixosModules.server - srvos.nixosModules.mixins-systemd-boot - ./system/hosts/nano.nix - ./system/hosts/nano-hardware.nix + nanopi.nixosModules.r5s + ./system/hosts/r5s.nix + ./system/hosts/r5s-hardware.nix ]; }; nixosConfigurations.linde = nixpkgs.lib.nixosSystem {
M secrets/secrets.nix → secrets/secrets.nix
@@ -7,7 +7,7 @@ }; machines = { linde = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHHdh3J7dEmh9G+CVmzFEC8/ont35ZXpCFcpLUO863vC"; - nano = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICHevZUbjDEt2bPnoLmv9wH5vTh/BeKddwnFD3f3QtMz"; + nano = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAw70HIEZEBQ751WB9aA/mbk0aSebUsAiPIquQp0NcJ5"; }; secrets = with machines; {
A system/hosts/r5s-hardware.nix
@@ -0,0 +1,26 @@ +{ + lib, + modulesPath, + ... +}: + +{ + boot.initrd.availableKernelModules = [ ]; + boot.initrd.kernelModules = [ ]; + boot.kernelModules = [ ]; + boot.extraModulePackages = [ ]; + + fileSystems."/" = { + device = "/dev/disk/by-uuid/8734332f-5cf2-4a06-9bae-1dcd080da2b4"; + fsType = "ext4"; + }; + + fileSystems."/var/log" = { + device = "tmpfs"; + fsType = "tmpfs"; + }; + + swapDevices = [ ]; + + nixpkgs.hostPlatform = lib.mkDefault "aarch64-linux"; +}
A system/hosts/r5s.nix
@@ -0,0 +1,166 @@ +{ + lib, + pkgs, + ... +}: +let + hostName = "r5"; + domain = "home.arpa"; + tailnet = "fin-marlin.ts.net"; +in +{ + imports = [ + ../settings/configuration/nix-linux.nix + ]; + age.secrets = { + acme.file = ../../secrets/acme.age; + syncthing.file = ../../secrets/syncthing.age; + }; + + networking = { + useDHCP = true; + inherit domain hostName; + hosts = { + "fd7a:115c:a1e0::53" = [ + "tailscale" + "ts" + ]; + "192.168.100.1" = [ + "modem" + "pyur" + ]; + }; + nameservers = [ + "9.9.9.11" + "149.112.112.11" + "2620:fe::11" + "2620:fe::fe:11" + ]; + nftables.enable = true; + }; + systemd.network = { + enable = true; + }; + services.resolved = { + enable = true; + extraConfig = '' + DNS = + LLMNR = false + MulticastDNS = true + ''; + }; + + services.openssh.openFirewall = true; + + services.tailscale = { + enable = true; + }; + + time.timeZone = "Europe/Berlin"; + i18n.defaultLocale = "en_GB.UTF-8"; + + programs.vim.defaultEditor = false; + programs.neovim = { + enable = true; + defaultEditor = true; + vimAlias = true; + viAlias = true; + }; + + environment.systemPackages = with pkgs; [ + file + tree + lsof + knot-dns + ]; + + programs.fish.enable = true; + users.defaultUserShell = pkgs.fish; + + users.users.alin = { + isNormalUser = true; + extraGroups = [ "wheel" ]; + openssh.authorizedKeys.keys = [ + "ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBENXbdPPOq0mA+9bPklpUkikvIXjCEKE5IRwNPNMr5/Ta1J/ND737fexCjEb7YPoAJtaf0gD/JThQQi/RxDTvy4= alin@secretive.marvin.local" + ]; + }; + + users.users.root = { + openssh.authorizedKeys.keys = [ + "ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBHYUyDdw92TNXguAxcmcmZmn/7ECGdRp6ckjxU+5zCw3BCnsS5+xEvHBVnnFdJRoH2XpfMeJjE+fi67zFVhlbn4= root@secretive.marvin.local" + ]; + }; + + services.caddy = { + enable = true; + globalConfig = '' + pki { + ca home { + name "Home CA" + } + } + ''; + virtualHosts = { + "${hostName}.${domain}" = { + serverAliases = [ "${hostName}.${tailnet}" ]; + extraConfig = '' + tls { + issuer internal { + ca home + } + } + root /var/lib/caddy/ca + file_server browse + ''; + }; + "ca.${domain}" = { + extraConfig = '' + tls { + issuer internal { + ca home + } + } + acme_server { + allow { + domains *.test *.${domain} + } + } + ''; + }; + }; + }; + + nix = { + settings = { + max-jobs = 2; + builders-use-substitutes = true; + }; + }; + + system.autoUpgrade = { + enable = lib.mkForce false; + dates = "04:15"; + randomizedDelaySec = "59 min"; + flake = "git+https://git.alin.ovh/nixfiles"; + allowReboot = true; + rebootWindow = { + lower = "01:00"; + upper = "06:00"; + }; + }; + + services.timesyncd.enable = false; + services.chrony = { + enable = true; + extraConfig = '' + rtcdevice /dev/rtc0 + rtcfile /var/lib/chrony/rtc + rtcautotrim 30 + + allow 10.0.0.0/8 + allow fd12:d04f:65d:42::0/56 + ''; + }; + + system.stateVersion = "25.11"; +}