numbus/numbus-server
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Updates. Bugfixes.

Browse Source
This commit is contained in:
Raphaël Numbus
2026-02-15 13:41:37 +01:00
parent a85de9a2c0
commit b3464e477b
6 changed files with 20 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
deploy.sh
+12 -7
View File
@@ -901,17 +901,22 @@ postrun_action() {
if gum confirm "➡️ I understand, 'yes' to proceed."; then
ssh_to_host 'bash -s' << EOF
echo "Enrolling boot disk key to TPM..."
if [[ ${#BOOT_DISKS_ID[@]} -eq 1 ]]; then
echo ${REMOTE_PASS} | sudo -S systemd-cryptenroll --tpm2-device=auto --tpm2-pcrs=0+7 --unlock-key-file=/etc/secrets/disks/boot-1 /dev/${BOOT_DISK_1_NAME}
elif [[ ${#BOOT_DISKS_ID[@]} -eq 2 ]]; then
echo ${REMOTE_PASS} | sudo -S systemd-cryptenroll --tpm2-device=auto --tpm2-pcrs=0+7 --unlock-key-file=/etc/secrets/disks/boot-1 /dev/${BOOT_DISK_1_NAME}
echo ${REMOTE_PASS} | sudo -S systemd-cryptenroll --tpm2-device=auto --tpm2-pcrs=0+7 --unlock-key-file=/etc/secrets/disks/boot-2 /dev/${BOOT_DISK_2_NAME}
fi
j=1
for i in ${!BOOT_DISKS_ID[@]}; do
if [[ echo "${BOOT_DISKS_ID[${i}]}" | grep -iq "nvme" ]]; then
DISK_PATH="/dev/${BOOT_DISKS_ID[${i}]}p2"
else
DISK_PATH="/dev/${BOOT_DISKS_ID[${i}]}2"
fi
echo ${REMOTE_PASS} | sudo -S systemd-cryptenroll --tpm2-device=auto --tpm2-pcrs=0+7 --unlock-key-file=/etc/secrets/disks/boot-${j} ${DISK_PATH}
((j++))
done
echo "Getting PCRS 15 hash..."
PCR_HASH=\$(echo ${REMOTE_PASS} | sudo -S systemd-analyze pcrs 15 --json=short)
sed -i "s|PCR_HASH|\${PCR_HASH}|" /etc/nixos/configuration.nix
echo ${REMOTE_PASS} | sudo -S sed -i "s|PCR_HASH|\${PCR_HASH}|" /etc/nixos/configuration.nix
EOF
else
echo "Skipping TPM configuration."
templates/nix-config/configuration.nix
+5
View File
@@ -47,6 +47,10 @@
boot.swraid.mdadmConf = "MAILADDR ${config.email.userAddress},${config.email.adminAddress}";
# boot.initrd.systemd.tpm2.enable = true;
boot.kernel.sysctl = {
vm.overcommit_memory=1;
};
# # TPM2 PCR check
# systemIdentity.enable = true;
# systemIdentity.pcr15 = "PCR_HASH";
@@ -122,6 +126,7 @@
# Enable Podman
virtualisation.podman.enable = true;
virtualisation.podman.defaultNetwork.settings.dns_enabled = true;
# Enable libvirt
# virtualisation.libvirtd.enable = true;
templates/nix-config/misc/networking.nix
+1 -1
View File
@@ -15,7 +15,7 @@
# Bridge configuration for VMs
networking.bridges.br0.interfaces = [ "TARGET_INTERFACE" ];
networking.interfaces.br0.useDHCP = false;
networking.nameservers = [ "9.9.9.9" ];
networking.nameservers = [ "HOME_SERVER_IP" "9.9.9.9" ];
networking.interfaces.br0.ipv4.addresses = [{
address = "HOME_SERVER_IP";
prefixLength = 24;
templates/nix-config/podman/frigate.nix
+1
View File
@@ -38,6 +38,7 @@ in
# --- frigate devices --- #
labels:
- traefik.enable=true
- traefik.docker.network=home-assistant_frontend
- traefik.http.services.frigate.loadbalancer.server.port=8971
- traefik.http.services.frigate.loadbalancer.server.scheme=http
- traefik.http.routers.frigate-https.entrypoints=websecure
templates/nix-config/podman/nextcloud.nix
-2
View File
@@ -24,8 +24,6 @@ in
- /run/user/1000/podman/podman.sock:/var/run/docker.sock:ro
environment:
APACHE_PORT: 11000
NEXTCLOUD_TRUSTED_DOMAINS: nextcloud.$DOMAIN_NAME nextcloud-aio.$DOMAIN_NAME
TRUSTED_PROXIES: 172.16.1.253
APACHE_IP_BINDING: 127.0.0.1
NEXTCLOUD_DATADIR: ${data_dir}
NEXTCLOUD_ENABLE_DRI_DEVICE: $NEXTCLOUD_ENABLE_DRI_DEVICE
templates/nix-config/podman/traefik.nix
+1 -2
View File
@@ -31,7 +31,6 @@ TRAEFIK_NETWORKS
- CF_DNS_API_TOKEN=$CF_DNS_API_TOKEN
labels:
- traefik.enable=true
- traefik.docker.network=home-assistant_frontend
- traefik.http.services.traefik.loadbalancer.server.port=8080
- traefik.http.services.traefik.loadbalancer.server.scheme=http
- traefik.http.routers.traefik-https.entrypoints=websecure
@@ -45,7 +44,7 @@ TRAEFIK_REF_NETWORKS
systemd.services.traefik = {
description = "Podman container : ${container_name}";
after = [ "numbus-activation-networked.service" "numbus-activation-chowned.service" ];
after = [ "numbus-activation.service" ];
wantedBy = [ "multi-user.target" ];
path = [ pkgs.podman pkgs.coreutils ];