Home/Thinknix: Add thinknix config

home/christoph/thinknix/default.nix

@@ -0,0 +1,20 @@
+{
+  pkgs,
+  nixosConfig,
+  config,
+  lib,
+  username,
+  ...
+}: {
+  imports = [
+    ../../modules
+  ];
+
+  config = {
+    home.packages = with pkgs; [
+      docker-compose
+    ];
+
+    home.stateVersion = "23.05";
+  };
+}

system/default.nix

@@ -48,6 +48,7 @@ with mylib.networking; {
 
       # Use podman on the desktops, the servers are
       # already configured using docker though...
+      # TODO: Use podman on the servers
       podman = !headless;
       docker.rootless = true;
     };

system/modules/docker/default.nix

@@ -15,6 +15,8 @@ in {
       })
     ];
 
+    networking.firewall.trustedInterfaces = ["docker0" "podman0"];
+
     virtualisation = {
       docker = {
         enable = !docker.podman;
@@ -61,5 +63,74 @@ in {
         else "docker"; # "docker" or "podman"
       libvirtd.enable = true;
     };
+
+    systemd.services = let
+      cli =
+        if docker.podman
+        then "${config.virtualisation.podman.package}/bin/podman"
+        else "${config.virtualisation.docker.package}/bin/docker";
+
+      mkDockerNetwork = name: options:
+        builtins.concatStringsSep "\n" [
+          # Make sure to return true on fail to not crash
+          ''
+            check=$(${cli} network inspect ${name} || true)
+            if [ -z "$check" ]; then
+          ''
+
+          (builtins.concatStringsSep " " [
+            "${cli} network create"
+
+            # Disable masquerading
+            (lib.mkIf
+              options.disable_masquerade
+              ''-o "com.docker.network.bridge.enable_ip_masquerade"="false"'')
+
+            # Enable ipv6
+            (lib.mkIf
+              options.ipv6.enable
+              "--ipv6")
+            (lib.mkIf
+              (builtins.hasAttr "gateway" options.ipv6)
+              ''--gateway="${options.ipv6.gateway}"'')
+            (lib.mkIf
+              (builtins.hasAttrs "subnet" options.ipv6)
+              ''--subnet="${options.ipv6.subnet}"'')
+
+            "${name}"
+          ])
+
+          ''
+            else
+              echo "${name} already exists!"
+            fi
+          ''
+        ];
+
+      mkPodmanNetwork = name: options:
+        builtins.concatStringsSep "\n" [
+          ''
+            ehco "Can't create Podman networks (yet)!"
+          ''
+        ];
+
+      mkSystemdNetworkService = name: options: let
+        toolName =
+          if docker.podman
+          then "Podman"
+          else "Docker";
+      in {
+        description = "Creates the ${toolName} network \"${name}\"";
+        after = ["network.target"];
+        wantedBy = ["multi-user.target"];
+
+        serviceConfig.Type = "oneshot";
+        script =
+          if docker.podman
+          then (mkPodmanNetwork name options)
+          else (mkDockerNetwork name options);
+      };
+    in
+      lib.mkMerge (builtins.mapAttrs mkSystemdNetworkService docker.networks);
   };
 }

system/modules/docker/options.nix

@@ -7,4 +7,48 @@
 
   podman = lib.mkEnableOption "Use podman instead of docker";
   docker.rootless = lib.mkEnableOption "Use rootless docker (no effect if podman is used)";
+
+  networks = lib.mkOption {
+    type = lib.types.attrsOf (lib.types.submodule ({
+      lib,
+      mylib,
+      ...
+    }: {
+      options = {
+        disable_masquerade = lib.mkEnableOption "Disable IP masquerading for this network";
+
+        ipv6 = {
+          enable = lib.mkEnableOption "Enable IPv6 for this network";
+
+          gateway = lib.mkOption {
+            type = lib.types.nullOr lib.types.str;
+            description = "The IPv6 gateway for this network";
+            example = "2000::1";
+            default = null;
+          };
+
+          subnet = lib.mkOption {
+            type = lib.types.nullOr lib.types.str;
+            description = "The IVv6 subnet mask for this network";
+            example = "2000::/80";
+            default = null;
+          };
+        };
+      };
+    }));
+    description = "Docker/Podman networks to create";
+    example = ''
+      {
+        behind-nginx = {
+          disable_masquerade = false;
+          ipv6 = {
+            enable = true;
+            gateway = "2000::1";
+            subnet = "2000::/80";
+          };
+        }
+      }
+    '';
+    default = {};
+  };
 }

system/servenix/default.nix

@@ -31,11 +31,16 @@
     ../services/nextcloud.nix
     ../services/nginx-proxy-manager.nix
     ../services/paperless.nix
-    ../services/portainer.nix
+    ../services/portainer-agent.nix
     ../services/whats-up-docker.nix
   ];
 
   modules = {
+    docker.networks."behind-nginx" = {
+      disable_masquerade = false;
+      ipv6.enable = false;
+    };
+
     network = {
       useNetworkManager = false;
 
@@ -70,41 +75,12 @@
     ];
   };
 
-  networking.firewall.trustedInterfaces = ["docker0" "podman0"];
-
-  systemd.services.init-behind-nginx-docker-network = {
-    description = "Create a docker network bridge for all services behind nginx-proxy-manager.";
-    after = ["network.target"];
-    wantedBy = ["multi-user.target"];
-
-    serviceConfig.Type = "oneshot";
-    script = let
-      cli = "${config.virtualisation.docker.package}/bin/docker";
-      network = "behind-nginx";
-    in ''
-      # Put a true at the end to prevent getting non-zero return code, which will
-      # crash the whole service.
-      check=$(${cli} network ls | grep ${network} || true)
-      if [ -z "$check" ]; then
-        # TODO: Disable IP masquerading to show individual containers in AdGuard/Pi-Hole
-        #       - Disabling this prevents containers from having internet connection. DNS issue?
-        # ${cli} network create -o "com.docker.network.bridge.enable_ip_masquerade"="false" ${network}
-
-        # ${cli} network create --ipv6 --gateway="2000::1" --subnet="2000::/80" ${network}
-        ${cli} network create ${network}
-      else
-        echo "${network} already exists in docker"
-      fi
-    '';
-  };
-
   # List services that you want to enable:
   services = {
     # Configure keymap in X11
     xserver = {
       xkb.layout = "us";
       xkb.variant = "altgr-intl";
-
       videoDrivers = ["nvidia"];
     };
 

system/services/nginx-proxy-manager.nix

@@ -17,9 +17,7 @@
       passwordFile = "${config.sops.secrets.docker-password.path}";
     };
 
-    dependsOn = [
-      # "pihole"
-    ];
+    dependsOn = [];
 
     ports = [
       "80:80"

system/services/portainer-agent.nix

@@ -0,0 +1,38 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}: {
+  virtualisation.oci-containers.containers.portainer-agent = {
+    image = "portainer/agent:latest";
+    autoStart = true;
+
+    login = {
+      # Uses DockerHub by default
+      # registry = "";
+
+      # DockerHub Credentials
+      username = "christoph.urlacher@protonmail.com";
+      passwordFile = "${config.sops.secrets.docker-password.path}";
+    };
+
+    dependsOn = [];
+
+    ports = [
+      "9001:9001"
+    ];
+
+    volumes = [
+      "/var/run/docker.sock:/var/run/docker.sock"
+      "/var/lib/docker/volumes:/var/lib/docker/volumes"
+    ];
+
+    environment = {};
+
+    extraOptions = [
+      # This container needs to be accessible from another machine inside the LAN
+      # "--net=behind-nginx"
+    ];
+  };
+}

system/services/portainer.nix

@@ -4,32 +4,8 @@
   pkgs,
   ...
 }: {
-  # virtualisation.oci-containers.containers.portainer = {
-  #   image = "portainer/portainer-ce:latest";
-  #   autoStart = true;
-
-  #   dependsOn = [];
-
-  #   ports = [
-  #     # "8000:8000"
-  #     # "9443:9443"
-  #   ];
-
-  #   volumes = [
-  #     "portainer_config:/data"
-
-  #     "/var/run/docker.sock:/var/run/docker.sock"
-  #   ];
-
-  #   environment = {};
-
-  #   extraOptions = [
-  #     "--net=behind-nginx"
-  #   ];
-  # };
-
-  virtualisation.oci-containers.containers.portainer-agent = {
-    image = "portainer/agent:latest";
+  virtualisation.oci-containers.containers.portainer = {
+    image = "portainer/portainer-ce:latest";
     autoStart = true;
 
     login = {
@@ -44,19 +20,20 @@
     dependsOn = [];
 
     ports = [
-      "9001:9001"
+      # "8000:8000"
+      # "9443:9443"
     ];
 
     volumes = [
+      "portainer_config:/data"
+
       "/var/run/docker.sock:/var/run/docker.sock"
-      "/var/lib/docker/volumes:/var/lib/docker/volumes"
     ];
 
     environment = {};
 
     extraOptions = [
-      # This container needs to be accessible from another machine inside the LAN
-      # "--net=behind-nginx"
+      "--net=behind-nginx"
     ];
   };
 }

system/services/wireguard.nix

@@ -0,0 +1,43 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}: {
+  virtualisation.oci-containers.containers.wireguard = {
+    image = "linuxserver/wireguard:latest";
+    autoStart = true;
+
+    login = {
+      # Uses DockerHub by default
+      # registry = "";
+
+      # DockerHub Credentials
+      username = "christoph.urlacher@protonmail.com";
+      passwordFile = "${config.sops.secrets.docker-password.path}";
+    };
+
+    dependsOn = [];
+
+    ports = [
+      "51820:51820"
+    ];
+
+    volumes = [
+      "wireguard_vps_config:/config"
+      "wireguard_vps_modules:/lib/modules"
+    ];
+
+    environment = {
+      PUID = "1000";
+      PGID = "1000";
+      TZ = "Europe/Berlin";
+    };
+
+    extraOptions = [
+      "--cap-add=NET_ADMIN"
+      "--cap-add=SYS_MODULE"
+      # "--net=behind-nginx"
+    ];
+  };
+}

system/thinknix/default.nix

@@ -0,0 +1,74 @@
+{
+  inputs,
+  hostname,
+  lib,
+  mylib,
+  config,
+  pkgs,
+  system,
+  username,
+  headless,
+  ...
+}: {
+  imports = [
+    # Include the results of the hardware scan.
+    ./hardware-configuration.nix
+
+    ../modules
+
+    # General services
+    ../services/adguard.nix
+    ../services/nginx-proxy-manager.nix
+    ../services/portainer.nix
+    ../services/whats-up-docker.nix
+    ../services/wireguard.nix
+  ];
+
+  modules = {
+    docker.networks."behind-nginx" = {
+      disable_masquerade = false;
+      ipv6.enable = false;
+    };
+
+    network = {
+      useNetworkManager = false;
+
+      networks = {
+        "10-ether-1G" = mylib.networking.mkStaticSystemdNetwork {
+          interface = "ens18";
+          ips = ["192.168.86.26/24"];
+          routers = ["192.168.86.5"];
+          nameservers = ["127.0.0.1"];
+          routable = true;
+        };
+      };
+
+      allowedTCPPorts = [
+        53 # DNS
+        80 # HTTP
+      ];
+      allowedUDPPorts = [
+        53 # DNS
+        67 # DHCP
+      ];
+    };
+  };
+
+  services = {
+    # Configure keymap in X11
+    xserver = {
+      layout = "us";
+      xkbVariant = "altgr-intl";
+    };
+
+    qemuGuest.enable = true;
+  };
+
+  # This value determines the NixOS release from which the default
+  # settings for stateful data, like file locations and database versions
+  # on your system were taken. It‘s perfectly fine and recommended to leave
+  # this value at the release version of the first install of this system.
+  # Before changing this value read the documentation for this option
+  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
+  system.stateVersion = "23.05"; # Did you read the comment?
+}

system/thinknix/hardware-configuration.nix

@@ -0,0 +1,65 @@
+{
+  config,
+  lib,
+  pkgs,
+  modulesPath,
+  ...
+}: {
+  imports = [
+    (modulesPath + "/profiles/qemu-guest.nix")
+  ];
+
+  boot = {
+    initrd.availableKernelModules = ["ata_piix" "uhci_hcd" "virtio_pci" "virtio_scsi" "sd_mod"];
+    initrd.kernelModules = [];
+    kernelModules = ["kvm-intel"];
+    extraModulePackages = [];
+  };
+
+  fileSystems = {
+    "/" = {
+      device = "/dev/disk/by-uuid/2d1b1f62-f008-4562-906e-5a63d854b18b";
+      fsType = "ext4";
+      options = ["defaults" "rw" "relatime"];
+    };
+
+    # Synology DS223j
+
+    "/media/synology-syncthing" = {
+      device = "192.168.86.15:/volume1/DockerVolumes";
+      fsType = "nfs";
+      options = ["defaults" "rw" "relatime" "_netdev" "bg" "soft"];
+    };
+
+    # SG Exos Mirror Shares
+
+    "/media/Movie" = {
+      device = "192.168.86.20:/mnt/SG Exos Mirror 18TB/Movie";
+      fsType = "nfs";
+      options = ["defaults" "rw" "relatime" "_netdev" "bg" "soft"];
+    };
+
+    "/media/Show" = {
+      device = "192.168.86.20:/mnt/SG Exos Mirror 18TB/Show";
+      fsType = "nfs";
+      options = ["defaults" "rw" "relatime" "_netdev" "bg" "soft"];
+    };
+
+    "/media/TV-Music" = {
+      device = "192.168.86.20:/mnt/SG Exos Mirror 18TB/Music";
+      fsType = "nfs";
+      options = ["defaults" "rw" "relatime" "_netdev" "bg" "soft"];
+    };
+  };
+
+  swapDevices = [];
+
+  hardware = {
+    enableAllFirmware = true;
+    enableRedistributableFirmware = true;
+    cpu.intel.updateMicrocode = true;
+    bluetooth.enable = false;
+  };
+
+  powerManagement.cpuFreqGovernor = lib.mkDefault "powersave";
+}