Lithospherical/nix-config
1
0
Fork 0
forked from jan-leila/nix-config
Code Pull requests Activity

added pihole config to defiant

Browse source
This commit is contained in:
Leyla Becker 2024-09-23 23:11:49 -05:00
parent 4515bab713
commit 8772c46323
2 changed files with 89 additions and 45 deletions
Download patch file Download diff file Expand all files Collapse all files

130
enviroments/server/default.nix
View file

@ -48,27 +48,43 @@
}; };
config = { config = {
# virtualisation.oci-containers.containers.pihole = { sops.secrets = {
# image = "pihole/pihole:2024.07.0"; "services/pi-hole" = {
# environment = { sopsFile = ../../secrets/defiant-services.yaml;
# TZ = time.timeZone; };
# WEBPASSWORD_FILE = "..."; # TODO: set this from secrets file/config that is set to secrets file (I think this also needs to be mounted in volumns?) };
# };
# volumes = [ # Runtime
# "/home/docker/pihole:/etc/pihole:rw" # TODO; set this based on configs virtualisation.podman = {
# ]; enable = true;
# ports = [ autoPrune.enable = true;
# "53:53/tcp" dockerCompat = true;
# "53:53/udp" defaultNetwork.settings = {
# "3000:80/tcp" # TODO: bind container ip address? # Required for container networking to be able to use names.
# ]; dns_enabled = true;
# log-driver = "journald"; };
# extraOptions = [ };
# "--ip=172.18.1.5" # TODO: set this to some ip address from configs virtualisation.oci-containers.backend = "podman";
# "--network-alias=pihole" # TODO: set this from configs
# "--network=nas_default" virtualisation.oci-containers.containers.pihole = {
# ]; image = "pihole/pihole:2024.07.0";
# }; hostname = "pihole";
volumes = [
"/home/pihole:/etc/pihole:rw" # TODO; set this based on configs
"${config.sops.secrets."services/pi-hole".path}:/var/lib/pihole/webpassword.txt"
];
environment = {
TZ = config.time.timeZone;
WEBPASSWORD_FILE = "/var/lib/pihole/webpassword.txt";
PIHOLE_UID = toString config.users.users.pihole.uid;
PIHOLE_GID = toString config.users.groups.pihole.gid;
};
log-driver = "journald";
extraOptions = [
"--ip=192.168.1.201" # TODO: set this to some ip address from configs
"--network=macvlan"
];
};
systemd = { systemd = {
tmpfiles.rules = [ tmpfiles.rules = [
@ -78,28 +94,45 @@
"d /home/jellyfin/cache 755 jellyfin jellyfin_media -" "d /home/jellyfin/cache 755 jellyfin jellyfin_media -"
"d /home/forgejo 750 forgejo forgejo -" "d /home/forgejo 750 forgejo forgejo -"
"d /home/forgejo/data 750 forgejo forgejo -" "d /home/forgejo/data 750 forgejo forgejo -"
# "d /home/pihole 750 pihole pihole -" "d /home/pihole 750 pihole pihole -"
]; ];
# services = { services = {
# pihole = { "podman-pihole" = {
# serviceConfig = { serviceConfig = {
# Restart = lib.mkOverride 500 "always"; Restart = lib.mkOverride 500 "always";
# }; };
# after = [ after = [
# "podman-network-nas_default.service" "podman-network-macvlan.service"
# ]; ];
# requires = [ requires = [
# "podman-network-nas_default.service" "podman-network-macvlan.service"
# ]; ];
# partOf = [ partOf = [
# "podman-compose-nas-root.target" "podman-compose-root.target"
# ]; ];
# wantedBy = [ wantedBy = [
# "podman-compose-nas-root.target" "podman-compose-root.target"
# ]; ];
# }; };
# };
"podman-network-macvlan" = {
path = [ pkgs.podman ];
serviceConfig = {
Type = "oneshot";
RemainAfterExit = true;
ExecStop = "podman network rm -f macvlan";
};
# TODO: check subnet against pi-hole ip address
# TODO: make lan configurable
# TODO: make parent interface configurable
script = ''
podman network inspect macvlan || podman network create --driver macvlan --subnet 192.168.1.0/24 --gateway 192.168.1.1 --opt parent=bond0 macvlan
'';
partOf = [ "podman-compose-root.target" ];
wantedBy = [ "podman-compose-root.target" ];
};
};
# disable computer sleeping # disable computer sleeping
targets = { targets = {
@ -107,10 +140,23 @@
suspend.enable = false; suspend.enable = false;
hibernate.enable = false; hibernate.enable = false;
hybrid-sleep.enable = false; hybrid-sleep.enable = false;
# Root service
# When started, this will automatically create all resources and start
# the containers. When stopped, this will teardown all resources.
"podman-compose-root" = {
unitConfig = {
Description = "Root target for podman targets.";
};
wantedBy = [ "multi-user.target" ];
};
}; };
}; };
services = { services = {
# DNS stub needs to be disabled so pi hole can bind
# resolved.extraConfig = "DNSStubListener=no";
nfs.server = { nfs.server = {
enable = true; enable = true;
exports = '' exports = ''
@ -200,7 +246,7 @@
defaults.email = "jan-leila@protonmail.com"; defaults.email = "jan-leila@protonmail.com";
}; };
networking.firewall.allowedTCPPorts = [2049 8081]; networking.firewall.allowedTCPPorts = [53 2049 3000 8081];
environment.systemPackages = [ environment.systemPackages = [
config.services.headscale.package config.services.headscale.package

4
hosts/defiant/hardware-configuration.nix
View file

@ -54,19 +54,17 @@
"30-enp4s0" = { "30-enp4s0" = {
matchConfig.Name = "enp4s0"; matchConfig.Name = "enp4s0";
networkConfig.Bond = "bond0"; networkConfig.Bond = "bond0";
DHCP = "ipv4";
}; };
"30-enp5s0" = { "30-enp5s0" = {
matchConfig.Name = "enp5s0"; matchConfig.Name = "enp5s0";
networkConfig.Bond = "bond0"; networkConfig.Bond = "bond0";
DHCP = "ipv4";
}; };
"40-bond0" = { "40-bond0" = {
matchConfig.Name = "bond0"; matchConfig.Name = "bond0";
linkConfig.RequiredForOnline = "carrier"; linkConfig.RequiredForOnline = "carrier";
networkConfig.LinkLocalAddressing = "no"; networkConfig.LinkLocalAddressing = "no";
networkConfig.DHCP = "yes"; DHCP = "ipv4";
address = [ address = [
# configure addresses including subnet mask # configure addresses including subnet mask