christoph/flake-nixinator
1
Fork 0
Code Activity

System/Thinknix: Add thinknix config

Browse Source
This commit is contained in:
Christoph Urlacher
2025-07-10 00:41:05 +02:00
parent a8b4a47cf6
commit 0dfc11363a
7 changed files with 229 additions and 33 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
system/default.nix
View File

@ -48,6 +48,7 @@ with mylib.networking; {
# Use podman on the desktops, the servers are
# already configured using docker though...
# TODO: Use podman on the servers
podman = !headless;
docker.rootless = true;
};

4
system/services/nginx-proxy-manager.nix
View File

@ -17,9 +17,7 @@
passwordFile = "${config.sops.secrets.docker-password.path}";
};
dependsOn = [
# "pihole"
];
dependsOn = [];
ports = [
"80:80"

38
system/services/portainer-agent.nix Normal file
View File

@ -0,0 +1,38 @@
{
config,
lib,
pkgs,
...
}: {
virtualisation.oci-containers.containers.portainer-agent = {
image = "portainer/agent:latest";
autoStart = true;
login = {
# Uses DockerHub by default
# registry = "";
# DockerHub Credentials
username = "christoph.urlacher@protonmail.com";
passwordFile = "${config.sops.secrets.docker-password.path}";
};
dependsOn = [];
ports = [
"9001:9001"
];
volumes = [
"/var/run/docker.sock:/var/run/docker.sock"
"/var/lib/docker/volumes:/var/lib/docker/volumes"
];
environment = {};
extraOptions = [
# This container needs to be accessible from another machine inside the LAN
# "--net=behind-nginx"
];
};
}

37
system/services/portainer.nix
View File

@ -4,32 +4,8 @@
pkgs,
...
}: {
# virtualisation.oci-containers.containers.portainer = {
# image = "portainer/portainer-ce:latest";
# autoStart = true;
# dependsOn = [];
# ports = [
# # "8000:8000"
# # "9443:9443"
# ];
# volumes = [
# "portainer_config:/data"
# "/var/run/docker.sock:/var/run/docker.sock"
# ];
# environment = {};
# extraOptions = [
# "--net=behind-nginx"
# ];
# };
virtualisation.oci-containers.containers.portainer-agent = {
image = "portainer/agent:latest";
virtualisation.oci-containers.containers.portainer = {
image = "portainer/portainer-ce:latest";
autoStart = true;
login = {
@ -44,19 +20,20 @@
dependsOn = [];
ports = [
"9001:9001"
# "8000:8000"
# "9443:9443"
];
volumes = [
"portainer_config:/data"
"/var/run/docker.sock:/var/run/docker.sock"
"/var/lib/docker/volumes:/var/lib/docker/volumes"
];
environment = {};
extraOptions = [
# This container needs to be accessible from another machine inside the LAN
# "--net=behind-nginx"
"--net=behind-nginx"
];
};
}

43
system/services/wireguard.nix Normal file
View File

@ -0,0 +1,43 @@
{
config,
lib,
pkgs,
...
}: {
virtualisation.oci-containers.containers.wireguard = {
image = "linuxserver/wireguard:latest";
autoStart = true;
login = {
# Uses DockerHub by default
# registry = "";
# DockerHub Credentials
username = "christoph.urlacher@protonmail.com";
passwordFile = "${config.sops.secrets.docker-password.path}";
};
dependsOn = [];
ports = [
"51820:51820"
];
volumes = [
"wireguard_vps_config:/config"
"wireguard_vps_modules:/lib/modules"
];
environment = {
PUID = "1000";
PGID = "1000";
TZ = "Europe/Berlin";
};
extraOptions = [
"--cap-add=NET_ADMIN"
"--cap-add=SYS_MODULE"
# "--net=behind-nginx"
];
};
}

74
system/thinknix/default.nix Normal file
View File

@ -0,0 +1,74 @@
{
inputs,
hostname,
lib,
mylib,
config,
pkgs,
system,
username,
headless,
...
}: {
imports = [
# Include the results of the hardware scan.
./hardware-configuration.nix
../modules
# General services
../services/adguard.nix
../services/nginx-proxy-manager.nix
../services/portainer.nix
../services/whats-up-docker.nix
../services/wireguard.nix
];
modules = {
docker.networks."behind-nginx" = {
disable_masquerade = false;
ipv6.enable = false;
};
network = {
useNetworkManager = false;
networks = {
"10-ether-1G" = mylib.networking.mkStaticSystemdNetwork {
interface = "ens18";
ips = ["192.168.86.26/24"];
routers = ["192.168.86.5"];
nameservers = ["127.0.0.1"];
routable = true;
};
};
allowedTCPPorts = [
53 # DNS
80 # HTTP
];
allowedUDPPorts = [
53 # DNS
67 # DHCP
];
};
};
services = {
# Configure keymap in X11
xserver = {
layout = "us";
xkbVariant = "altgr-intl";
};
qemuGuest.enable = true;
};
# This value determines the NixOS release from which the default
# settings for stateful data, like file locations and database versions
# on your system were taken. It‘s perfectly fine and recommended to leave
# this value at the release version of the first install of this system.
# Before changing this value read the documentation for this option
# (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
system.stateVersion = "23.05"; # Did you read the comment?
}

65
system/thinknix/hardware-configuration.nix Normal file
View File

@ -0,0 +1,65 @@
{
config,
lib,
pkgs,
modulesPath,
...
}: {
imports = [
(modulesPath + "/profiles/qemu-guest.nix")
];
boot = {
initrd.availableKernelModules = ["ata_piix" "uhci_hcd" "virtio_pci" "virtio_scsi" "sd_mod"];
initrd.kernelModules = [];
kernelModules = ["kvm-intel"];
extraModulePackages = [];
};
fileSystems = {
"/" = {
device = "/dev/disk/by-uuid/2d1b1f62-f008-4562-906e-5a63d854b18b";
fsType = "ext4";
options = ["defaults" "rw" "relatime"];
};
# Synology DS223j
"/media/synology-syncthing" = {
device = "192.168.86.15:/volume1/DockerVolumes";
fsType = "nfs";
options = ["defaults" "rw" "relatime" "_netdev" "bg" "soft"];
};
# SG Exos Mirror Shares
"/media/Movie" = {
device = "192.168.86.20:/mnt/SG Exos Mirror 18TB/Movie";
fsType = "nfs";
options = ["defaults" "rw" "relatime" "_netdev" "bg" "soft"];
};
"/media/Show" = {
device = "192.168.86.20:/mnt/SG Exos Mirror 18TB/Show";
fsType = "nfs";
options = ["defaults" "rw" "relatime" "_netdev" "bg" "soft"];
};
"/media/TV-Music" = {
device = "192.168.86.20:/mnt/SG Exos Mirror 18TB/Music";
fsType = "nfs";
options = ["defaults" "rw" "relatime" "_netdev" "bg" "soft"];
};
};
swapDevices = [];
hardware = {
enableAllFirmware = true;
enableRedistributableFirmware = true;
cpu.intel.updateMicrocode = true;
bluetooth.enable = false;
};
powerManagement.cpuFreqGovernor = lib.mkDefault "powersave";
}