nicknase27/nicksOs
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

init

Browse Source
This commit is contained in:
nicknase27
2026-07-25 23:26:39 +02:00
commit fadcad2d0b
23 changed files with 714 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
View File
flake.lock
Generated
+196
View File
@@ -0,0 +1,196 @@
{
"nodes": {
"agenix": {
"inputs": {
"darwin": "darwin",
"home-manager": "home-manager",
"nixpkgs": "nixpkgs",
"systems": "systems"
},
"locked": {
"lastModified": 1770165109,
"narHash": "sha256-9VnK6Oqai65puVJ4WYtCTvlJeXxMzAp/69HhQuTdl/I=",
"owner": "ryantm",
"repo": "agenix",
"rev": "b027ee29d959fda4b60b57566d64c98a202e0feb",
"type": "github"
},
"original": {
"owner": "ryantm",
"repo": "agenix",
"type": "github"
}
},
"blueprint": {
"inputs": {
"nixpkgs": [
"unifi-os-server",
"nixpkgs"
],
"systems": "systems_2"
},
"locked": {
"lastModified": 1776249299,
"narHash": "sha256-Dt9t1TGRmJFc0xVYhttNBD6QsAgHOHCArqGa0AyjrJY=",
"owner": "numtide",
"repo": "blueprint",
"rev": "56131e8628f173d24a27f6d27c0215eff57e40dd",
"type": "github"
},
"original": {
"owner": "numtide",
"repo": "blueprint",
"type": "github"
}
},
"darwin": {
"inputs": {
"nixpkgs": [
"agenix",
"nixpkgs"
]
},
"locked": {
"lastModified": 1744478979,
"narHash": "sha256-dyN+teG9G82G+m+PX/aSAagkC+vUv0SgUw3XkPhQodQ=",
"owner": "lnl7",
"repo": "nix-darwin",
"rev": "43975d782b418ebf4969e9ccba82466728c2851b",
"type": "github"
},
"original": {
"owner": "lnl7",
"ref": "master",
"repo": "nix-darwin",
"type": "github"
}
},
"home-manager": {
"inputs": {
"nixpkgs": [
"agenix",
"nixpkgs"
]
},
"locked": {
"lastModified": 1745494811,
"narHash": "sha256-YZCh2o9Ua1n9uCvrvi5pRxtuVNml8X2a03qIFfRKpFs=",
"owner": "nix-community",
"repo": "home-manager",
"rev": "abfad3d2958c9e6300a883bd443512c55dfeb1be",
"type": "github"
},
"original": {
"owner": "nix-community",
"repo": "home-manager",
"type": "github"
}
},
"nixpkgs": {
"locked": {
"lastModified": 1754028485,
"narHash": "sha256-IiiXB3BDTi6UqzAZcf2S797hWEPCRZOwyNThJIYhUfk=",
"owner": "NixOS",
"repo": "nixpkgs",
"rev": "59e69648d345d6e8fef86158c555730fa12af9de",
"type": "github"
},
"original": {
"owner": "NixOS",
"ref": "nixos-25.05",
"repo": "nixpkgs",
"type": "github"
}
},
"nixpkgs_2": {
"locked": {
"lastModified": 1784796856,
"narHash": "sha256-wWFrV5/Qbm+lyt5x20E/bSbfJiGKMo4RCxZV8cl/WZI=",
"owner": "nixos",
"repo": "nixpkgs",
"rev": "e2587caef70cea85dd97d7daab492899902dbf5d",
"type": "github"
},
"original": {
"owner": "nixos",
"ref": "nixos-unstable",
"repo": "nixpkgs",
"type": "github"
}
},
"nixpkgs_3": {
"locked": {
"lastModified": 1776169885,
"narHash": "sha256-l/iNYDZ4bGOAFQY2q8y5OAfBBtrDAaPuRQqWaFHVRXM=",
"owner": "NixOS",
"repo": "nixpkgs",
"rev": "4bd9165a9165d7b5e33ae57f3eecbcb28fb231c9",
"type": "github"
},
"original": {
"owner": "NixOS",
"ref": "nixos-unstable",
"repo": "nixpkgs",
"type": "github"
}
},
"root": {
"inputs": {
"agenix": "agenix",
"nixpkgs": "nixpkgs_2",
"unifi-os-server": "unifi-os-server"
}
},
"systems": {
"locked": {
"lastModified": 1681028828,
"narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
"owner": "nix-systems",
"repo": "default",
"rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
"type": "github"
},
"original": {
"owner": "nix-systems",
"repo": "default",
"type": "github"
}
},
"systems_2": {
"locked": {
"lastModified": 1681028828,
"narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
"owner": "nix-systems",
"repo": "default",
"rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
"type": "github"
},
"original": {
"owner": "nix-systems",
"repo": "default",
"type": "github"
}
},
"unifi-os-server": {
"inputs": {
"blueprint": "blueprint",
"nixpkgs": "nixpkgs_3"
},
"locked": {
"lastModified": 1783941815,
"narHash": "sha256-9S5fNoQpSipPSRijOhgB0JHsZlLQxJzEzgM8Ia9SJz4=",
"owner": "rcambrj",
"repo": "unifi-os-server",
"rev": "075e542294406a2f3449e06dab12765ce56958c3",
"type": "github"
},
"original": {
"owner": "rcambrj",
"repo": "unifi-os-server",
"type": "github"
}
}
},
"root": "root",
"version": 7
}
flake.nix
+32
View File
@@ -0,0 +1,32 @@
{
description = "Nixos config flake";
inputs = {
nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";
agenix.url = "github:ryantm/agenix";
unifi-os-server.url = "github:rcambrj/unifi-os-server";
# home-manager = {
# url = "github:nix-community/home-manager";
# inputs.nixpkgs.follows = "nixpkgs";
# };
};
outputs = { self, nixpkgs, agenix, unifi-os-server, ... }@inputs: {
# use "nixos", or your hostname as the name of the configuration
# it's a better practice than "default" shown in the video
nixosConfigurations.Hermes= nixpkgs.lib.nixosSystem {
specialArgs = {inherit inputs;};
modules = [
./hosts/hermes/configuration.nix
./hosts/hermes/hardware-configuration.nix
./modules/homelab.nix
./modules/security.nix
./modules/system.nix
agenix.nixosModules.default
unifi-os-server.nixosModules.unifi-os-server
# inputs.home-manager.nixosModules.default
];
};
};
}
hosts/hermes/configuration.nix
+66
View File
@@ -0,0 +1,66 @@
{
config,
lib,
pkgs,
inputs,
...
}: {
imports = [
];
nix.settings.experimental-features = ["nix-command" "flakes"];
nixpkgs.config.allowUnfree = true;
# Use the systemd-boot EFI boot loader.
boot.loader.systemd-boot.enable = true;
boot.loader.efi.canTouchEfiVariables = true;
# Use latest kernel.
boot.kernelPackages = pkgs.linuxPackages_latest;
networking.hostName = "Hermes"; # Define your hostname.
networking.networkmanager.enable = true;
networking.nameservers = ["1.1.1.1" "1.0.0.1"];
# Set your time zone.
time.timeZone = "Europe/Berlin";
users.users.nick = {
isNormalUser = true;
shell = pkgs.zsh;
extraGroups = ["wheel"]; # Enable ‘sudo’ for the user.
packages = with pkgs; [
];
};
programs.zsh = {
enable = true;
};
environment.systemPackages = with pkgs; [
inputs.agenix.packages."${system}".default
neovim
wget
curl
git
fastfetch
rsync
starship
eza
net-tools
alejandra
nixd
];
networking.firewall.enable = false;
networking.firewall.allowedTCPPorts = [8222];
networking.nftables.enable = true;
age.identityPaths = [
"/etc/ssh/id_ed25519"
];
system.stateVersion = "26.05"; # Did you read the comment?
}
hosts/hermes/hardware-configuration.nix
+77
View File
@@ -0,0 +1,77 @@
{
config,
lib,
pkgs,
modulesPath,
...
}: {
imports = [
(modulesPath + "/profiles/qemu-guest.nix")
];
boot.initrd.availableKernelModules = ["ahci" "xhci_pci" "virtio_pci" "sr_mod" "virtio_blk"];
boot.initrd.kernelModules = [];
boot.kernelModules = ["kvm-amd"];
boot.extraModulePackages = [];
fileSystems."/" = {
device = "/dev/disk/by-uuid/4a3884e7-5c89-4987-8482-3b3640d2aebf";
fsType = "btrfs";
options = ["subvol=@"];
};
fileSystems."/home" = {
device = "/dev/disk/by-uuid/4a3884e7-5c89-4987-8482-3b3640d2aebf";
fsType = "btrfs";
options = ["subvol=@home"];
};
fileSystems."/nix" = {
device = "/dev/disk/by-uuid/4a3884e7-5c89-4987-8482-3b3640d2aebf";
fsType = "btrfs";
options = ["subvol=@nix"];
};
fileSystems."/.snapshots" = {
device = "/dev/disk/by-uuid/4a3884e7-5c89-4987-8482-3b3640d2aebf";
fsType = "btrfs";
options = ["subvol=@snapshots"];
};
fileSystems."/var/log" = {
device = "/dev/disk/by-uuid/4a3884e7-5c89-4987-8482-3b3640d2aebf";
fsType = "btrfs";
options = ["subvol=@log"];
};
fileSystems."/boot" = {
device = "/dev/disk/by-uuid/5802-1BBF";
fsType = "vfat";
options = ["fmask=0022" "dmask=0022"];
};
fileSystems."/mnt/media" = {
device = "//10.0.0.5/media";
fsType = "cifs";
options = ["credentials=${config.age.secrets.smb.path}" "x-systemd.automount" "nofail" "noperm" "x-systemd.after=network-online.target" "x-systemd.automount-options=--timeout=30" "_netdev"];
};
fileSystems."/mnt/backups" = {
device = "//10.0.0.5/infra/backups";
fsType = "cifs";
options = ["credentials=${config.age.secrets.smb.path}" "x-systemd.automount" "nofail" "noperm" "x-systemd.after=network-online.target" "x-systemd.automount-options=--timeout=30" "_netdev"];
};
swapDevices = [
{device = "/dev/disk/by-uuid/ecbbcef6-c4c2-4cfe-bcd2-5a2e599c3009";}
];
age.secrets.smb = {
file = ../../secrets/smb.age;
path = "/run/secrets/smb";
};
systemd.network.wait-online.enable = true;
hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
}
modules/homelab.nix
+13
View File
@@ -0,0 +1,13 @@
{
pkgs,
lib,
...
}: {
imports = [
./services/vaultwarden.nix
./services/navidrome.nix
./services/caddy.nix
./services/unifi.nix
./services/gitea.nix
];
}
modules/security.nix
+6
View File
@@ -0,0 +1,6 @@
{ pkgs, lib, config, ... }:
{
imports = [
./security/ssh.nix
];
}
modules/security/ssh.nix
+21
View File
@@ -0,0 +1,21 @@
{
pkgs,
lib,
...
}: {
services.openssh = {
enable = true;
openFirewall = true;
settings = {
PasswordAuthentication = false;
KbdInteractiveAuthentication = false;
PermitRootLogin = "no";
AllowUsers = ["nick" "gitea"];
MaxAuthTries = 3;
PerSourcePenalties = "crash:3600s authfail:3600s max:86400s";
};
};
users.users."nick".openssh.authorizedKeys.keys = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJwouafzGDRGeMJQbm9ME/1CSkXicdL7TthJjWkhyLYd nick@Theseus"
];
}
modules/services/caddy.nix
+85
View File
@@ -0,0 +1,85 @@
{
pkgs,
lib,
config,
...
}: {
services.caddy = {
enable = true;
environmentFile = "/run/secrets/caddy.env";
package = pkgs.caddy.withPlugins {
plugins = ["github.com/caddy-dns/cloudflare@v0.2.4"];
hash = "sha256-7GoH8YLCoPmPExQxoga2FHB58zQDoZVf1BBwkVi0SsQ=";
};
globalConfig = ''
email {$EMAIL}
acme_dns cloudflare {$CLOUDFLARE} {
resolvers 1.1.1.1:53 1.0.0.1:53
}
'';
# Public
virtualHosts = {
"nicknase27.com" = {
extraConfig = ''
respond "Blank" 200
'';
};
"nv.nicknase27.com" = {
extraConfig = ''
reverse_proxy localhost:4533
'';
serverAliases = ["music.nicknase27.com"];
};
"vt.nicknase27.com" = {
extraConfig = ''
reverse_proxy localhost:8222
'';
serverAliases = ["vault.nicknase27.com"];
};
"git.nicknase27.com" = {
extraConfig = ''
reverse_proxy localhost:3000
'';
};
"jf.nicknase27.com" = {
extraConfig = ''
reverse_proxy 10.0.0.5:8096
'';
serverAliases = ["watch.nicknase27.com"];
};
# Local
"opn.nicknase27.com" = {
extraConfig = ''
reverse_proxy 10.0.0.1:80
'';
};
"ui.nicknase27.com" = {
extraConfig = ''
reverse_proxy https://localhost:11443 {
transport http {
tls_insecure_skip_verify
}
}
'';
};
"storage.nicknase27.com" = {
extraConfig = ''
reverse_proxy 10.0.0.5:80
'';
};
"photos.nicknase27.com" = {
extraConfig = ''
reverse_proxy 10.0.0.5:2283
'';
};
};
};
age.secrets.caddy = {
file = ../../secrets/caddy.age;
path = "/run/secrets/caddy.env";
};
}
modules/services/gitea.nix
+26
View File
@@ -0,0 +1,26 @@
{
pkgs,
config,
lib,
...
}: {
services.gitea = {
enable = true;
database = {
type = "sqlite3";
passwordFile = "${config.age.secrets.gitea-db.path}";
};
settings = {
server = {
DOMAIN = "git.nicknase27.com";
ROOT_URL = "https://git.nicknase27.com";
};
};
};
age.secrets.gitea-db = {
file = ../../secrets/gitea-db.age;
path = "/run/secrets/gitea-db";
mode = "777";
};
}
modules/services/navidrome.nix
+56
View File
@@ -0,0 +1,56 @@
{
pkgs,
lib,
config,
...
}: {
services.navidrome = {
#Settings
enable = true;
openFirewall = true;
settings = {
Address = "0.0.0.0";
Port = 4533;
DataFolder = "/var/lib/navidrome";
BaseURL = "https://nv.nicknase27.com";
# Library
MusicFolder = "/mnt/media/music";
AlbumPlayCountMode = "normalized";
AutoImportPlaylists = false;
PID.Track = "musicbrainz_trackid|albumid,discnumber,tracknumber,title";
PID.Album = "musicbrainz_albumid|albumartistid,album,albumversion,musicbrainz_acoustid";
# UI / Features
DefaultTheme = "Spotify-ish";
EnableDownloads = true;
DefaultDownloadableShare = true;
EnableInsightsCollector = false;
EnableSharing = true;
EnableStarRating = true;
DefaultUIVolume = 100;
LastFM.Enabled = true;
};
#Plugins
plugins = with pkgs.navidromePlugins; [
discord-rich-presence
];
#Environment
environmentFile = "/run/secrets/navidrome.env";
};
age.secrets.navidrome = {
file = ../../secrets/navidrome.age;
path = "/run/secrets/navidrome.env";
};
systemd.services = {
navidrome = {
after = ["mnt-media.mount"];
requires = ["mnt-media.mount"];
};
};
}
modules/services/unifi.nix
+16
View File
@@ -0,0 +1,16 @@
{
pkgs,
lib,
config,
...
}: {
virtualisation.podman.enable = true;
virtualisation.oci-containers.backend = "podman";
services.unifi-os-server = {
enable = true;
uosSystemIP = "10.0.0.10";
openFirewallUiPort = true;
openFirewallServicePorts = true;
};
}
modules/services/vaultwarden.nix
+24
View File
@@ -0,0 +1,24 @@
{
pkgs,
lib,
...
}: {
services.vaultwarden = {
enable = true;
dbBackend = "sqlite";
backupDir = "/var/local/vaultwarden/backup";
config = {
DOMAIN = "https://vt.nicknase27.com";
SIGNUPS_ALLOWED = "true";
ROCKET_ADDRESS = "0.0.0.0";
ROCKET_PORT = 8222;
ROCKET_LOG = "critical";
};
environmentFile = ["/run/secrets/vaultwarden.env"];
};
age.secrets.vaultwarden = {
file = ../../secrets/vaultwarden.age;
path = "/run/secrets/vaultwarden.env";
};
}
modules/system.nix
+7
View File
@@ -0,0 +1,7 @@
{ pkgs, lib, config, ... }:
{
imports = [
./system/garbage-collection.nix
./system/backups.nix
];
}
modules/system/backups.nix
+33
View File
@@ -0,0 +1,33 @@
{
pkgs,
config,
lib,
...
}: {
services.restic.backups.hermes = {
initialize = true;
repository = "/mnt/backups/";
passwordFile = config.age.secrets.restic.path;
paths = [
"/var/lib"
];
timerConfig = {
OnCalendar = "daily";
RandomizedDelaySec = "1h";
};
pruneOpts = [
"--keep-daily=7"
"--keep-weekly=4"
"--keep-monthly=12"
];
};
age.secrets.restic = {
file = ../../secrets/restic.age;
};
}
modules/system/garbage-collection.nix
+16
View File
@@ -0,0 +1,16 @@
{
pkgs,
lib,
config,
...
}: {
nix = {
gc = {
automatic = true;
dates = "weekly";
options = "--delete-older-than 30d";
};
optimise.automatic = true;
};
}
secrets/caddy.age
BIN
View File
Binary file not shown.
secrets/gitea-db.age
BIN
View File
Binary file not shown.
secrets/navidrome.age
+5
View File
@@ -0,0 +1,5 @@
age-encryption.org/v1
-> ssh-ed25519 dq4eSg Bq3jE4tZijPeR0roGJHQA7JH914Evpn6z1WGRllF5Bg
/b27LMvQPH3GLDPCCBye1rkwmGfCyP9q6G5sejPMWis
--- Vyv4jpwB4CKfE0jALdWEydsowc/4aRV4iz8UvkWxibQ
ü ~¯:üx‰­5Ûº5›À°îf�àƒŸËDƒÅ$¿ÃÊ«cѽ÷]y¸ýììÀ"dÒ Ê8a»×õ?ÿº9ùdÚ t¶þÈ`ÝB‚Ïó,j�-û·±YS¹E^@(¬ÄK[Ï2 fñænh��ãk}¦>tbqxôc:‹ê�(d.wj©�
secrets/restic.age
+8
View File
@@ -0,0 +1,8 @@
age-encryption.org/v1
-> ssh-ed25519 dq4eSg oxAzXUKcoOjUxNB4tZII/ytFF6DRjm7duIS9Ds/2Zwo
xm7nHystUY8VeCPKUHIkWrDsXHLJTsYMZX8tKtp5VYI
-> ssh-ed25519 xLUmZQ zrJy1kKXBVSKyKUXGT2Cpi9SW46Kxuz7SCviY/56HFw
dWs2+G1D7oTpHc71xOlqy8nWYjw+Qw2JsQ23X5JrU5Q
--- XojFhUQJoBobIDxGDG9rW52zmf4K3Z73Iiu9EpTSQB0
¶f¿5q—r¦#ç4;.°õ|ÒS–ãíRòajQdÅð«_j`óÐÝwè¼Ó Çô;ôþ€�î=ÂxñÕ$Lˆ†1ÅÐÂ=2VÛa—
secrets/secrets.nix
+15
View File
@@ -0,0 +1,15 @@
let
hermes = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIF+0IQBasZ9MUZxF7hlx3aH00pEIgpkuWh5ZVRmOLpMN nick@Hermes";
theseus = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJwouafzGDRGeMJQbm9ME/1CSkXicdL7TthJjWkhyLYd nick@Theseus";
systems = [hermes theseus];
in {
"caddy.age".publicKeys = systems;
"restic.age".publicKeys = systems;
"smb.age".publicKeys = systems;
"gitea-db.age".publicKeys = systems;
#"wireguard-private.age".publicKeys = systems;
#"wireguard-public.age".publicKeys = systems;
"navidrome.age".publicKeys = systems;
"vaultwarden.age".publicKeys = systems;
}
secrets/smb.age
+7
View File
@@ -0,0 +1,7 @@
age-encryption.org/v1
-> ssh-ed25519 dq4eSg B7XhfVlAF4n2nOiakXwfDlmabbeYctB5kfGHQeTBIg8
QRMGoqZ+3m9eCh4JtSvrMkwB8REo/SFy/E5x1acZLnQ
-> ssh-ed25519 xLUmZQ kx3yrLGzWjAY2xfF6wqND5aYZMxlDkSW1NKeoylxrhk
Tz8/KjlcYO0MCiypLQWNuZID+BJXmJ3vQH3c22Bbs/A
--- tlKKxD/3yE85aBdrMC6o5gr86RBo8qNJPJdEJ6gbkxE
.Ëß¼hå9‹>Ým¸HÏpI‹yZÉ7%ª!-4ÝgèÎyñ¥·Πo>¾éeŒA¬dEN±lƒÝZ.È7NÖ蜘"›”tØ# ÇPó{R†}ïŒÄ7P÷_¾eØÌÙ
secrets/vaultwarden.age
+5
View File
@@ -0,0 +1,5 @@
age-encryption.org/v1
-> ssh-ed25519 dq4eSg kIejU5J8ePOW65gY/72byCy5jQk/y4TBwuJ+Ss/fpmg
UI2cKAJ3sOwSKmlavV0SZ3sFnCNEwbGpled1QMQPppU
--- vpqeBDI2Vbds2jih32m5uqVmgsFlZMbfwsqTvEND6pY
`áŠí!e~Y@ž®>0#[ô)Â�±Å4èg^Á¿óî1©°A@Ý;8 ”0*É1ÁÅÏëKÖbÄôRGœˆ\uaïA·“Ø_£ä9ðå’Á;iÆ�G