diff --git a/deploy.sh b/deploy.sh old mode 100755 new mode 100644 diff --git a/nix-config/misc/networking.nix b/nix-config/misc/networking.nix deleted file mode 100644 index 352d648..0000000 --- a/nix-config/misc/networking.nix +++ /dev/null @@ -1,37 +0,0 @@ -{ config, pkgs, lib, ... }: - -{ - # Hostname - networking.hostName = "numbus-server"; - - # Enable networking and firewall - networking.interfaces.eth0.ipv4.addresses = [ - { - address = "HOME_SERVER_IP"; - prefixLength = 24; - } - ]; - networking.defaultGateway = "HOME_ROUTER_IP"; - networking.nameservers = [ "HOME_SERVER_IP" "9.9.9.9" ]; - networking.networkmanager.enable = true; - networking.nftables.enable = true; - networking.firewall.enable = true; - - networking.nftables.tables.nat = { - family = "ip"; - content = '' - chain prerouting { - type nat hook prerouting priority dstnat; policy accept; - tcp dport 80 redirect to :8080 - tcp dport 443 redirect to :8443 - tcp dport 53 redirect to :5353 - udp dport 53 redirect to :5353 - } - ''; - }; - - # Open ports in the firewall - networking.firewall.allowPing = true; - networking.firewall.allowedTCPPorts = [ 53 80 443 ]; - networking.firewall.allowedUDPPorts = [ 53 ]; -} \ No newline at end of file diff --git a/nix-config/configuration.nix b/templates/nix-config/configuration.nix similarity index 61% rename from nix-config/configuration.nix rename to templates/nix-config/configuration.nix index 2d10c4b..fbeda87 100644 --- a/nix-config/configuration.nix +++ b/templates/nix-config/configuration.nix @@ -6,10 +6,18 @@ (modulesPath + "/profiles/qemu-guest.nix") inputs.sops-nix.nixosModules.sops ./disks/disko.nix -# ./disks/snapraid.nix + ./misc/activation.nix + ./misc/mail.nix + ./misc/networking.nix + ./misc/smart.nix # ./disks/pcr-check.nix +# ./disks/snapraid.nix +# ./pcie-coral/coral.nix ]; + # Enable email notifications + email.enable = true; + # Hardware settings hardware.enableRedistributableFirmware = true; hardware.cpu.intel.updateMicrocode = true; @@ -22,19 +30,22 @@ sops.age.generateKey = true; sops.secrets."ssh_public_keys" = { owner = "numbus-admin"; path = "/etc/ssh/authorized_keys.d/numbus-admin"; }; sops.secrets."sender_email_address_password" = {}; - sops.secrets."docker/frigate" = { owner = "numbus-admin"; path = "/etc/docker-compose/frigate/.env"; }; - sops.secrets."docker/traefik" = { owner = "numbus-admin"; path = "/etc/docker-compose/traefik/.env"; }; - sops.secrets."docker/nextcloud" = { owner = "numbus-admin"; path = "/etc/docker-compose/nextcloud/.env"; }; - sops.secrets."docker/passbolt" = { owner = "numbus-admin"; path = "/etc/docker-compose/passbolt/.env"; }; - sops.secrets."docker/hass" = { owner = "numbus-admin"; path = "/etc/docker-compose/hass/.env"; }; - sops.secrets."docker/pihole" = { owner = "numbus-admin"; path = "/etc/docker-compose/pihole/.env"; }; - sops.secrets."docker/immich" = { owner = "numbus-admin"; path = "/etc/docker-compose/immich/.env"; }; + sops.secrets."podman/frigate" = { owner = "numbus-admin"; path = "/etc/podman/frigate/.env"; }; + sops.secrets."podman/gitea" = { owner = "numbus-admin"; path = "/etc/podman/gitea/.env"; }; + sops.secrets."podman/home_assistant" = { owner = "numbus-admin"; path = "/etc/podman/home-assistant/.env"; }; + sops.secrets."podman/immich" = { owner = "numbus-admin"; path = "/etc/podman/immich/.env"; }; + sops.secrets."podman/it_tools" = { owner = "numbus-admin"; path = "/etc/podman/it-tools/.env"; }; + sops.secrets."podman/nextcloud" = { owner = "numbus-admin"; path = "/etc/podman/nextcloud/.env"; }; + sops.secrets."podman/passbolt" = { owner = "numbus-admin"; path = "/etc/podman/passbolt/.env"; }; + sops.secrets."podman/pi_hole" = { owner = "numbus-admin"; path = "/etc/podman/pi-hole/.env"; }; + sops.secrets."podman/traefik" = { owner = "numbus-admin"; path = "/etc/podman/traefik/.env"; }; # Bootloader options boot.initrd.systemd.enable = true; - boot.initrd.systemd.tpm2.enable = true; boot.loader.systemd-boot.enable = true; boot.loader.efi.canTouchEfiVariables = true; + boot.swraid.mdadmConf = "MAILADDR ${config.email.userAddress},${config.email.adminAddress}"; +# boot.initrd.systemd.tpm2.enable = true; # TPM2 PCR check # systemIdentity.enable = true; @@ -65,15 +76,14 @@ }; # Enable SSH - services.openssh = { - enable = true; - }; + services.openssh.enable = true; # Allow unfree packages nixpkgs.config.allowUnfree = true; # Install packages environment.systemPackages = with pkgs; [ + git ncdu fastfetch tpm2-tss @@ -87,6 +97,12 @@ smartmontools cpufrequtils intel-gpu-tools + podman + podman-compose + podman-tui + snapraid + mergerfs + mergerfs-tools ]; # Power savings @@ -104,19 +120,25 @@ ]; }; - # Enable docker - virtualisation.docker.enable = true; - virtualisation.docker.daemon.settings = { - data-root = "/mnt/config-storage/docker-volumes/"; - }; + # Enable Podman + virtualisation.podman.enable = true; + virtualisation.podman.defaultNetwork.settings.dns_enabled = true; + + # Enable libvirt +# virtualisation.libvirtd.enable = true; +# programs.virt-manager.enable = true; # User account users.users.numbus-admin = { isNormalUser = true; description = "Numbus Admin"; - extraGroups = [ "networkmanager" "wheel" "docker" ]; + extraGroups = [ "wheel" ]; uid = 1000; initialPassword = "changeMe!"; + # required for auto start before user login + linger = true; + # required for rootless container with multiple users + autoSubUidGidRange = true; }; # Login message @@ -139,8 +161,16 @@ randomizedDelaySec = "45min"; }; + nix.gc = { + automatic = true; + dates = "weekly"; + options = "--delete-older-than 7d"; + }; + # Enable NixOS flakes nix.settings.experimental-features = [ "nix-command" "flakes" ]; + # Enable auto nix-store optimization + nix.settings.auto-optimise-store = true; system.stateVersion = "25.05"; } diff --git a/config-files/disks/boot-1.nix b/templates/nix-config/disks/boot-1.nix similarity index 100% rename from config-files/disks/boot-1.nix rename to templates/nix-config/disks/boot-1.nix diff --git a/config-files/disks/boot-2.nix b/templates/nix-config/disks/boot-2.nix similarity index 100% rename from config-files/disks/boot-2.nix rename to templates/nix-config/disks/boot-2.nix diff --git a/config-files/disks/content.nix b/templates/nix-config/disks/content.nix similarity index 100% rename from config-files/disks/content.nix rename to templates/nix-config/disks/content.nix diff --git a/config-files/disks/mirror.nix b/templates/nix-config/disks/mirror.nix similarity index 100% rename from config-files/disks/mirror.nix rename to templates/nix-config/disks/mirror.nix diff --git a/config-files/disks/parity.nix b/templates/nix-config/disks/parity.nix similarity index 100% rename from config-files/disks/parity.nix rename to templates/nix-config/disks/parity.nix diff --git a/config-files/disks/pcr-check.nix b/templates/nix-config/disks/pcr-check.nix similarity index 100% rename from config-files/disks/pcr-check.nix rename to templates/nix-config/disks/pcr-check.nix diff --git a/config-files/disks/snapraid.nix b/templates/nix-config/disks/snapraid.nix similarity index 100% rename from config-files/disks/snapraid.nix rename to templates/nix-config/disks/snapraid.nix diff --git a/config-files/disks/spindown.nix b/templates/nix-config/disks/spindown.nix similarity index 100% rename from config-files/disks/spindown.nix rename to templates/nix-config/disks/spindown.nix diff --git a/nix-config/flake.nix b/templates/nix-config/flake.nix similarity index 78% rename from nix-config/flake.nix rename to templates/nix-config/flake.nix index afd20fd..4fe1878 100644 --- a/nix-config/flake.nix +++ b/templates/nix-config/flake.nix @@ -9,11 +9,11 @@ sops-nix.url = "github:Mic92/sops-nix"; sops-nix.inputs.nixpkgs.follows = "nixpkgs"; # Power savings - autoaspm.url = "github:notthebee/AutoASPM"; + autoaspm.url = "git+https://git.notthebe.ee/notthebee/AutoASPM"; autoaspm.inputs.nixpkgs.follows = "nixpkgs"; }; - outputs = { self, nixpkgs, disko, sops-nix, ... }@inputs: let + outputs = { self, nixpkgs, disko, sops-nix, autoaspm, ... }@inputs: let # System definition system = "x86_64-linux"; pkgs = import nixpkgs { @@ -21,9 +21,9 @@ config.allowUnfree = true; }; - # Helper: collect every *.nix file inside ./docker as a list - dockerModules = let - dir = ../docker; + # Helper: collect every *.nix file inside ./podman as a list + podmanModules = let + dir = ./podman; entries = builtins.readDir dir; names = builtins.attrNames entries; nixNames = builtins.filter (n: builtins.match ".*\\.nix" n != null) names; @@ -43,8 +43,8 @@ # Core host configuration ./configuration.nix ./hardware-configuration.nix - # Docker services – automatically added from ./docker/*.nix - ] ++ dockerModules; + # Podman services – automatically added from ./podman/*.nix + ] ++ podmanModules; }; }; }; diff --git a/templates/nix-config/misc/activation.nix b/templates/nix-config/misc/activation.nix new file mode 100644 index 0000000..bb7961a --- /dev/null +++ b/templates/nix-config/misc/activation.nix @@ -0,0 +1,57 @@ +{ config, pkgs, ... }: + +{ + systemd.services.numbus-activation-chowned = { + description = "Numbus-Server activation : Correct permissions"; + wantedBy = [ "multi-user.target" "traefik.service" ]; + after = [ "network.target" "local-fs.target" ]; + path = [ pkgs.coreutils ]; + serviceConfig = { + Type = "oneshot"; + RemainAfterExit = true; + }; + script = '' + #!/usr/bin/env bash + + if [[ -e /home/numbus-admin/.numbus-server/chowned.true ]]; then + exit 0 + fi + + mkdir -p /mnt/config/ /mnt/data/ /mnt/data/nextcloud/ + mkdir -p /home/numbus-admin/.numbus-server/ + chown -R numbus-admin:users /mnt/config/ + chown -R numbus-admin:users /mnt/data/ + chown -R 100032:users /mnt/data/nextcloud/ + chown -R numbus-admin:users /home/numbus-admin/.numbus-server/ + + touch /home/numbus-admin/.numbus-server/chowned.true + ''; + }; + + systemd.services.numbus-activation-networked = { + description = "Numbus-Server activation : Create podman networks"; + wantedBy = [ "multi-user.target" "traefik.service" ]; + before = [ "traefik.service" ]; + after = [ "network.target" "local-fs.target" "numbus-activation-chowned.service" ]; + path = [ pkgs.podman pkgs.coreutils ]; + serviceConfig = { + User = "numbus-admin"; + Environment = [ "XDG_RUNTIME_DIR=/run/user/1000" ]; + Type = "oneshot"; + RemainAfterExit = true; + }; + script = '' + #!/usr/bin/env bash + + export PATH=$PATH:/run/wrappers/bin + + if [[ -e /home/numbus-admin/.numbus-server/networked.true ]]; then + exit 0 + fi + +PODMAN_NETWORKS + mkdir -p /home/numbus-admin/.numbus-server/ + touch /home/numbus-admin/.numbus-server/networked.true + ''; + }; +} \ No newline at end of file diff --git a/nix-config/misc/mail.nix b/templates/nix-config/misc/mail.nix similarity index 59% rename from nix-config/misc/mail.nix rename to templates/nix-config/misc/mail.nix index 03309d5..4fcfa67 100644 --- a/nix-config/misc/mail.nix +++ b/templates/nix-config/misc/mail.nix @@ -11,22 +11,32 @@ in fromAddress = lib.mkOption { description = "The 'from' address"; type = lib.types.str; - default = "no-reply@${DOMAIN_NAME}"; + default = "no-reply@DOMAIN_NAME"; }; - toAddress = lib.mkOption { + userAddress = lib.mkOption { description = "The 'to' address"; type = lib.types.str; - default = "${EMAIL_ADDRESS}"; + default = "EMAIL_ADDRESS"; + }; + adminAddress = lib.mkOption { + description = "The admin email address to receive alerts in copy"; + type = lib.types.str; + default = "admin@numbus.eu"; }; smtpServer = lib.mkOption { description = "The SMTP server address"; type = lib.types.str; - default = "${SENDER_EMAIL_DOMAIN}"; + default = "SENDER_MAIL_DOMAIN"; + }; + smtpPort = lib.mkOption { + description = "The SMTP port"; + type = lib.types.port; + default = 465; }; smtpUsername = lib.mkOption { description = "The SMTP username"; type = lib.types.str; - default = "${SENDER_EMAIL_ADDRESS}"; + default = "SENDER_MAIL_ADDRESS"; }; smtpPasswordPath = lib.mkOption { description = "Path to the secret containing SMTP password"; @@ -36,37 +46,29 @@ in }; config = lib.mkIf cfg.enable { + environment.etc."aliases".text = '' + root: ${config.email.userAddress}, ${config.email.adminAddress} + default: ${config.email.userAddress}, ${config.email.adminAddress} + ''; + programs.msmtp = { enable = true; + defaults = { + aliases = "/etc/aliases"; + timeout = 60; + syslog = "on"; + }; accounts.default = { auth = true; host = config.email.smtpServer; + port = config.email.smtpPort; from = config.email.fromAddress; user = config.email.smtpUsername; tls = true; + tls_starttls = false; passwordeval = "${pkgs.coreutils}/bin/cat ${config.email.smtpPasswordPath}"; }; }; }; ### Mail notifications configuration <-- - - - -### --> SMART disk heath - services.smartd = { - enable = true; - defaults.autodetected = "-a -o on -S on -s (S/../.././00|L/../../6/01) -n standby,q"; - notifications = { - wall = { - enable = true; - }; - mail = { - enable = true; - sender = config.email.fromAddress; - recipient = config.email.toAddress; - }; - }; - }; -### SMART disk heath <-- - } \ No newline at end of file diff --git a/templates/nix-config/misc/networking.nix b/templates/nix-config/misc/networking.nix new file mode 100644 index 0000000..a840b10 --- /dev/null +++ b/templates/nix-config/misc/networking.nix @@ -0,0 +1,33 @@ +{ config, pkgs, lib, ... }: + +{ + # Hostname + networking.hostName = "numbus-server"; + + networking.networkmanager.enable = false; + networking.resolvconf.enable = false; + + networking.nftables.enable = true; + networking.firewall.enable = true; + + # Allow rootless containers to bind to port 53 and up + boot.kernel.sysctl."net.ipv4.ip_unprivileged_port_start" = 53; + + # Bridge configuration for VMs + networking.bridges.br0.interfaces = [ "TARGET_INTERFACE" ]; + networking.interfaces.br0.useDHCP = false; + networking.nameservers = [ "127.0.0.1" "9.9.9.9" ]; + networking.interfaces.br0.ipv4.addresses = [{ + address = "HOME_SERVER_IP"; + prefixLength = 24; + }]; + networking.defaultGateway = { + address = "HOME_ROUTER_IP"; + interface = "br0"; + }; + + # Open ports in the firewall + networking.firewall.allowPing = true; + networking.firewall.allowedTCPPorts = [ 53 80 443 ]; + networking.firewall.allowedUDPPorts = [ 53 443 ]; +} \ No newline at end of file diff --git a/templates/nix-config/misc/smart.nix b/templates/nix-config/misc/smart.nix new file mode 100644 index 0000000..ca20ba5 --- /dev/null +++ b/templates/nix-config/misc/smart.nix @@ -0,0 +1,62 @@ +{ config, pkgs, ... }: + +let + smartd_notifier = pkgs.writeScript "smartd-notify.sh" '' + #!${pkgs.bash}/bin/bash + + # 1. Send Technical Email to Admin + ADMIN_EMAIL="${config.email.adminAddress}" + SUBJECT="Numbus Server Alert: $SMARTD_FAILTYPE on $SMARTD_DEVICE" + + TECH_BODY=" + SMARTD Alert Details: + Server owner: $OWNER_NAME + Device: $SMARTD_DEVICE + Type: $SMARTD_DEVICETYPE + Failure Type: $SMARTD_FAILTYPE + Message: $SMARTD_MESSAGE + + Full Message: + $SMARTD_FULLMESSAGE + " + printf "Subject: [ADMIN] $SUBJECT\n\n$TECH_BODY" | /run/wrappers/bin/sendmail -t "$ADMIN_EMAIL" + + # 2. Send Friendly Email to Owner + USER_EMAIL="${config.email.userAddress}" + OWNER_NAME=$(cat /etc/numbus-server/owner 2>/dev/null || echo "User") + + FRIENDLY_BODY="Cher/Chère $OWNER_NAME, + + Votre serveur a automatiquement détecté une panne matérielle de disque dur. + Ce genre de panne est tout à fait normal selon l'âge de votre matériel et n'entraîne + dans la grande majorité des cas aucune perte de données grâce au système de + stockage redondant préventif. + + Votre administrateur a été notifié de cette panne. Il vous recontactera dans de très + brefs délais afin de procéder au remplacement, si nécessaire, du disque dur défaillant. + + Merci de votre confiance, + L'équipe de support, + Numbus-Server." + + printf "Subject: [Alerte] Défaillance matérielle sur votre serveur Numbus\n\n$FRIENDLY_BODY" | /run/wrappers/bin/sendmail -t "$USER_EMAIL" + ''; +in +{ +### --> SMART disk heath + services.smartd = { + enable = true; + defaults.autodetected = "-a -o on -S on -s (S/../.././00|L/../../6/01) -n standby,q -M exec ${smartd_notifier}"; + notifications = { + wall = { + enable = true; + }; + mail = { + enable = true; + sender = config.email.fromAddress; + recipient = "${config.email.userAddress},${config.email.adminAddress}"; + }; + }; + }; +### SMART disk heath <-- +} \ No newline at end of file diff --git a/config-files/coral.nix b/templates/nix-config/pcie-coral/coral.nix similarity index 65% rename from config-files/coral.nix rename to templates/nix-config/pcie-coral/coral.nix index 726304c..c98c359 100644 --- a/config-files/coral.nix +++ b/templates/nix-config/pcie-coral/coral.nix @@ -1,8 +1,8 @@ { config, pkgs, ... }: let - libedgetpu = config.boot.kernelPackages.callPackage /etc/nixos/packages/libedgetpu.nix {}; - gasket = config.boot.kernelPackages.callPackage /etc/nixos/packages/gasket.nix {}; + libedgetpu = pkgs.callPackage ./libedgetpu.nix {}; + gasket = config.boot.kernelPackages.callPackage ./gasket.nix {}; in { diff --git a/config-files/packages/gasket.nix b/templates/nix-config/pcie-coral/gasket.nix similarity index 100% rename from config-files/packages/gasket.nix rename to templates/nix-config/pcie-coral/gasket.nix diff --git a/config-files/packages/libedgetpu.nix b/templates/nix-config/pcie-coral/libedgetpu.nix similarity index 100% rename from config-files/packages/libedgetpu.nix rename to templates/nix-config/pcie-coral/libedgetpu.nix diff --git a/config-files/docker/adguard.coming b/templates/nix-config/podman/adguard.coming similarity index 100% rename from config-files/docker/adguard.coming rename to templates/nix-config/podman/adguard.coming diff --git a/config-files/docker/frigate.nix b/templates/nix-config/podman/frigate.nix similarity index 100% rename from config-files/docker/frigate.nix rename to templates/nix-config/podman/frigate.nix diff --git a/config-files/docker/gitea.nix b/templates/nix-config/podman/gitea.nix similarity index 100% rename from config-files/docker/gitea.nix rename to templates/nix-config/podman/gitea.nix diff --git a/config-files/docker/home-assistant.nix b/templates/nix-config/podman/home-assistant.nix similarity index 100% rename from config-files/docker/home-assistant.nix rename to templates/nix-config/podman/home-assistant.nix diff --git a/config-files/docker/immich.nix b/templates/nix-config/podman/immich.nix similarity index 100% rename from config-files/docker/immich.nix rename to templates/nix-config/podman/immich.nix diff --git a/config-files/docker/it-tools.nix b/templates/nix-config/podman/it-tools.nix similarity index 100% rename from config-files/docker/it-tools.nix rename to templates/nix-config/podman/it-tools.nix diff --git a/config-files/docker/nextcloud.nix b/templates/nix-config/podman/nextcloud.nix similarity index 100% rename from config-files/docker/nextcloud.nix rename to templates/nix-config/podman/nextcloud.nix diff --git a/config-files/docker/passbolt.nix b/templates/nix-config/podman/passbolt.nix similarity index 100% rename from config-files/docker/passbolt.nix rename to templates/nix-config/podman/passbolt.nix diff --git a/config-files/docker/pi-hole.nix b/templates/nix-config/podman/pi-hole.nix similarity index 100% rename from config-files/docker/pi-hole.nix rename to templates/nix-config/podman/pi-hole.nix diff --git a/config-files/docker/traefik.nix b/templates/nix-config/podman/traefik.nix similarity index 100% rename from config-files/docker/traefik.nix rename to templates/nix-config/podman/traefik.nix diff --git a/config-files/sops-nix/.sops.yaml b/templates/nix-config/sops-nix/.sops.yaml similarity index 100% rename from config-files/sops-nix/.sops.yaml rename to templates/nix-config/sops-nix/.sops.yaml diff --git a/config-files/sops-nix/secrets.yaml b/templates/nix-config/sops-nix/secrets.yaml similarity index 100% rename from config-files/sops-nix/secrets.yaml rename to templates/nix-config/sops-nix/secrets.yaml diff --git a/config-files/docker/config/hass/configuration.yaml b/templates/podman-config/hass/configuration.yaml similarity index 100% rename from config-files/docker/config/hass/configuration.yaml rename to templates/podman-config/hass/configuration.yaml diff --git a/config-files/docker/config/hass/mosquitto.conf b/templates/podman-config/hass/mosquitto.conf similarity index 100% rename from config-files/docker/config/hass/mosquitto.conf rename to templates/podman-config/hass/mosquitto.conf diff --git a/config-files/docker/config/traefik/headers.yaml b/templates/podman-config/traefik/headers.yaml similarity index 100% rename from config-files/docker/config/traefik/headers.yaml rename to templates/podman-config/traefik/headers.yaml diff --git a/config-files/docker/config/traefik/nextcloud.yaml b/templates/podman-config/traefik/nextcloud.yaml similarity index 100% rename from config-files/docker/config/traefik/nextcloud.yaml rename to templates/podman-config/traefik/nextcloud.yaml diff --git a/config-files/docker/config/traefik/tls.yaml b/templates/podman-config/traefik/tls.yaml similarity index 100% rename from config-files/docker/config/traefik/tls.yaml rename to templates/podman-config/traefik/tls.yaml diff --git a/config-files/docker/config/traefik/traefik.yaml b/templates/podman-config/traefik/traefik.yaml similarity index 100% rename from config-files/docker/config/traefik/traefik.yaml rename to templates/podman-config/traefik/traefik.yaml diff --git a/config-files/scripts/numbus-server.conf b/templates/post-install/numbus-server.conf similarity index 100% rename from config-files/scripts/numbus-server.conf rename to templates/post-install/numbus-server.conf diff --git a/config-files/scripts/numbus-server.sh b/templates/post-install/numbus-server.sh similarity index 100% rename from config-files/scripts/numbus-server.sh rename to templates/post-install/numbus-server.sh