autumn/nixos-conf
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

add hoardfrost

Browse Source
This commit is contained in:
autumn
2025-10-27 13:09:00 -06:00
parent eb1283157a
commit 4c1dcec61b
19 changed files with 979 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
system/services/containerization/docker.nix Normal file
View File

@@ -0,0 +1,12 @@
{config, pkgs, ...}:
{
environment.systemPackages = with pkgs;[
podman
docker-compose
];
virtualisation = {
docker.enable = true;
};
users.users.autumn.extraGroups = ["docker"];
}

38
system/services/containerization/mealie.nix Normal file
View File

@@ -0,0 +1,38 @@
{config, pkgs, ...}:
{
virtualisation.oci-containers.containers = {
mealie = {
image = "ghcr.io/mealie-recipes/mealie:v3.3.2";
ports = [
"9000:9000"
];
volumes = [
"/home/autumn/mealie/mealie-data:/app/data"
];
environment = {
DB_ENGINE= "postgres";
POSTGRES_USER = "mealie";
POSTGRES_PASSWORD = "mealie";
POSTGRES_SERVER = "localhost:5432";
POSTGRES_PORT = "5432";
POSTGRES_DB = "mealie";
TZ = "America/Denver";
};
dependsOn = [
"postgres-mealie"
];
};
postgres-mealie = {
image = "postgres:17";
environment = {
POSTGRES_USER = "mealie";
POSTGRES_PASSWORD = "mealie";
PGUSER = "mealie";
POSTGRES_DB = "mealie";
};
volumes = [
"/home/autumn/mealie/mealie-pgdata:/var/lib/postgresql/data"
];
};
};
}

19
system/services/containerization/stirlingpdf.nix Normal file
View File

@@ -0,0 +1,19 @@
{config, pkgs, ...}:
{
virtualisation.oci-containers.containers.stirling-pdf = {
image = "stirlingtools/stirling-pdf:latest";
ports = ["8079:8080"];
volumes = [
"/home/autumn/StirlingPDF/trainingData:/usr/share/tessdata"
"/home/autumn/StirlingPDF/extraConfigs:/configs"
"/home/autumn/StirlingPDF/customFiles:/customFiles/"
"/home/autumn/StirlingPDF/logs:/logs/"
"/home/autumn/StirlingPDF/pipeline:/pipeline/"
];
environment = {
DISABLE_ADDITIONAL_FEATURES="true";
LANGS="en_US";
};
};
}

55
system/services/containerization/transtun.nix Normal file
View File

@@ -0,0 +1,55 @@
{config, pkgs, ...}:
{
virtualisation.oci-containers.containers.transmission-openvpn = {
image = "haugene/transmission-openvpn:latest";
ports = [
"9091:9091"
];
volumes = [
"/home/autumn/transtun/holding-cell:/data"
"/home/autumn/transtun/mullvad_userpass.txt:/config/openvpn-credentials.txt"
"/home/autumn/transtun/notify-download.sh:/etc/transmission/notify-download.sh:ro"
];
environment = {
OPENVPN_PROVIDER = "MULLVAD";
OPENVPN_USERNAME = "9413153196446212";
OPENVPN_CONFIG = "ca_van";
LOCAL_NETWORK = "10.0.0.0/16";
OPENVPN_OPTS = "--dev tun0";
TRANSMISSION_RPC_BIND_ADDRESS = "0.0.0.0";
TRANSMISSION_RPC_WHITELIST = "*";
TRANSMISSION_RPC_WHITELIST_ENABLED = "false";
TRANSMISSION_SCRIPT_TORRENT_DONE_ENABLED = "true";
TRANSMISSION_SCRIPT_TORRENT_DONE_FILENAME = "/etc/transmission/notify-download.sh";
};
extraOptions = [
"--cap-add=NET_ADMIN"
"--cap-add=SYS_MODULE"
"--device=/dev/net/tun:/dev/net/tun"
"--privileged"
];
autoStart = true;
};
# Firefox browser container (working version without VPN)
virtualisation.oci-containers.containers.torrent-browser = {
image = "jlesage/firefox:latest";
ports = [
"8080:5800" # Firefox web interface
];
environment = {
DISPLAY = ":0";
APP_NAME = "Torrent Browser";
APP_ICON = "https://raw.githubusercontent.com/jlesage/docker-templates/master/jlesage/images/firefox-icon.png";
};
autoStart = true;
};
}

7
system/services/endlessh.nix Normal file
View File

@@ -0,0 +1,7 @@
{config, pkgs, ...}:
{
services.endlessh = {
enable = true;
port = 22;
};
}

118
system/services/hickory-dns-bak.nix Normal file
View File

@@ -0,0 +1,118 @@
{ config, pkgs, lib, ... }:
# Define your DNS records declaratively
let
dnsRecords = {
"lan." = {
ttl = 86400; # Time-to-live for records in this zone
ns = [ "hoardfrost.lan." ]; # Nameserver record
soa = {
nameServer = "hoardfrost.lan.";
adminEmail = "root.lan.";
serial = "2025091901"; # Update this serial number with each change
refresh = "3600";
retry = "1800";
expire = "604800";
minimum = "86400";
};
# Define your host records (A for IPv4, AAAA for IPv6)
records = {
# Your NixOS server acting as the DNS server
hoardfrost = [
{ type = "A"; content = "10.0.0.217"; }
{ type = "AAAA"; content = "2601:282:180:630::803b"; }
];
# Other devices on your local network
router = [
{ type = "A"; content = "10.0.0.1"; }
{ type = "AAAA"; content = "fe80::1"; }
];
yukigekko = [
{ type = "A"; content = "10.0.0.210"; }
{ type = "AAAA"; content = "2601:282:180:630::e2e"; }
];
wesbos = [
{ type = "A"; content = "10.0.0.110";}
# { type = "AAAA"; content = "";}
];
wsl-hive = [
{type = "A"; content = "172.18.84.193";}
{type = "AAAA"; content = "fe80::215:5dff:fec1:e4b5";}
];
};
};
};
# This function generates the zone file string from the Nix expression
generateZoneFile = zoneName: zoneConfig:
let
soaRecord = "${zoneName} ${toString zoneConfig.ttl} IN SOA ${zoneConfig.soa.nameServer} ${zoneConfig.soa.adminEmail} ( ${zoneConfig.soa.serial} ${zoneConfig.soa.refresh} ${zoneConfig.soa.retry} ${zoneConfig.soa.expire} ${zoneConfig.soa.minimum} )";
nsRecords = lib.concatStringsSep "\n" (lib.map (ns: "${zoneName} ${toString zoneConfig.ttl} IN NS ${ns}") zoneConfig.ns);
hostRecords = lib.concatStringsSep "\n" (lib.flatten (lib.mapAttrsToList (hostname: records:
lib.map (record: "${hostname}.${zoneName} ${toString zoneConfig.ttl} IN ${record.type} ${record.content}") records
) zoneConfig.records));
in
''
$ORIGIN ${zoneName}
${soaRecord}
${nsRecords}
${hostRecords}
'';
# Generate the zone file using the `generateZoneFile` function
lanZoneFile = pkgs.writeText "lan.zone" (generateZoneFile "lan." dnsRecords."lan.");
# Configure hickory-dns with the generated zone file
hickoryConfig = pkgs.writeText "hickory-config.toml" ''
listen_addrs_ipv4 = ["127.0.0.1", "10.0.0.217"] # Change to your NixOS server's IPv4
listen_addrs_ipv6 = ["::1", "fe80::215:5dff:fec1:e4b5"] # Change to your NixOS server's IPv6
# Configure as an authoritative server for the local zone
[[zones]]
zone = "lan."
zone_type = "Primary"
file = "${lanZoneFile}"
# Configure as a recursive resolver for all other queries
[[recursor]]
# All queries *not* matching the "lan." zone will be forwarded here.
[[recursor.forwarders]]
name_servers = ["8.8.8.8:53", "[2001:4860:4860::8888]:53"]
# All other DNS queries will be handled recursively, starting from the root hints.
'';
in
{
systemd.services.hickory-dns = {
enable = true;
description = "Hickory DNS with local zone";
wantedBy = [ "multi-user.target" ];
serviceConfig = {
Type = "simple";
User = "hickory";
Group = "hickory";
ExecStart = "${pkgs.hickory-dns}/bin/hickory-dns -c ${hickoryConfig}";
Restart = "on-failure";
AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" ];
DynamicUser = true;
StateDirectory = "hickory";
};
};
users.groups.hickory = {};
users.users.hickory = {
isSystemUser = true;
group = "hickory";
};
environment.systemPackages = [ pkgs.hickory-dns ];
# Configure your NixOS machine to use itself as the DNS resolver
services.resolved.enable = false;
networking.nameservers = [ "127.0.0.1" "fdaa:a00:0:1::100" ];
}

151
system/services/hickory-dns.nix Normal file
View File

@@ -0,0 +1,151 @@
{ config, pkgs, lib, ... }:
# Define your DNS records declaratively
let
dnsRecords = {
"lan." = {
ttl = 86400; # Time-to-live for records in this zone
ns = [ "hoardfrost.lan." ]; # Nameserver record
soa = {
nameServer = "hoardfrost.lan.";
adminEmail = "root.lan.";
serial = "2025012001"; # Increment serial for changes
refresh = "3600";
retry = "1800";
expire = "604800";
minimum = "86400";
};
# Define your host records (A for IPv4, AAAA for IPv6)
records = {
# Your NixOS server acting as the DNS server
hoardfrost = [
{ type = "A"; content = "10.0.0.217"; }
{ type = "AAAA"; content = "2601:282:180:630::cc03"; }
];
# Other devices on your local network
router = [
{ type = "A"; content = "10.0.0.1"; }
{ type = "AAAA"; content = "fe80::1"; }
];
yukigekko = [
{ type = "A"; content = "10.0.0.210"; }
{ type = "AAAA"; content = "2601:282:180:630::e2e"; }
];
wesbos = [
{ type = "A"; content = "10.0.0.110";}
# { type = "AAAA"; content = "";}
];
wsl-hive = [
{type = "A"; content = "172.18.84.193";}
{type = "AAAA"; content = "fe80::215:5dff:fec1:e813";}
];
};
};
};
# This function generates the zone file string from the Nix expression
generateZoneFile = zoneName: zoneConfig:
let
soaRecord = "${zoneName} ${toString zoneConfig.ttl} IN SOA ${zoneConfig.soa.nameServer} ${zoneConfig.soa.adminEmail} ( ${zoneConfig.soa.serial} ${zoneConfig.soa.refresh} ${zoneConfig.soa.retry} ${zoneConfig.soa.expire} ${zoneConfig.soa.minimum} )";
nsRecords = lib.concatStringsSep "\n" (map (ns: "${zoneName} ${toString zoneConfig.ttl} IN NS ${ns}") zoneConfig.ns);
hostRecords = lib.concatStringsSep "\n" (lib.flatten (lib.mapAttrsToList (hostname: records:
map (record: "${hostname}.${zoneName} ${toString zoneConfig.ttl} IN ${record.type} ${record.content}") records
) zoneConfig.records));
in
''
$ORIGIN ${zoneName}
${soaRecord}
${nsRecords}
${hostRecords}
'';
# Generate the zone file using the `generateZoneFile` function
lanZoneFile = pkgs.writeText "lan.zone" (generateZoneFile "lan." dnsRecords."lan.");
# Configure hickory-dns with the generated zone file
hickoryConfig = pkgs.writeText "hickory-config.toml" ''
listen_addrs_ipv4 = ["127.0.0.1", "10.0.0.217"] # Change to your NixOS server's IPv4
listen_addrs_ipv6 = ["::1", "2601:282:180:630::cc03"] # Change to your NixOS server's IPv6
# Configure as an authoritative server for the local zone
[[zones]]
zone = "lan."
zone_type = "Primary"
file = "${lanZoneFile}"
# Note: Recursive resolution is not supported in Hickory DNS 0.25.2
# This server will only serve the local zone
'';
in
{
systemd.services.hickory-dns = {
enable = true;
description = "Hickory DNS authoritative server for local zone";
wantedBy = [ "multi-user.target" ];
serviceConfig = {
Type = "simple";
User = "hickory";
Group = "hickory";
ExecStart = "${pkgs.hickory-dns}/bin/hickory-dns -c ${hickoryConfig}";
Restart = "on-failure";
AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" ];
DynamicUser = true;
StateDirectory = "hickory";
};
};
users.groups.hickory = {};
users.users.hickory = {
isSystemUser = true;
group = "hickory";
};
environment.systemPackages = [ pkgs.hickory-dns ];
# Configure systemd-resolved to use Unbound
services.resolved.enable = true;
services.resolved.dnssec = "false";
services.resolved.extraConfig = ''
DNS=127.0.0.1@5353
'';
# Configure Unbound as recursive resolver for external queries
services.unbound = {
enable = true;
settings = {
server = {
interface = [ "127.0.0.1" ];
port = 5353; # Use different port to avoid conflict with Hickory DNS
access-control = [ "127.0.0.1 allow" ];
hide-identity = true;
hide-version = true;
};
forward-zone = [
{
name = "lan.";
forward-addr = [ "127.0.0.1@53" ]; # Forward lan. queries to Hickory DNS
}
{
name = ".";
forward-addr = [
"8.8.8.8#dns.google"
"2001:4860:4860::8888#dns.google"
];
}
];
};
};
# Configure NetworkManager to use systemd-resolved and ignore DHCP DNS
networking.networkmanager.dns = "systemd-resolved";
networking.networkmanager.settings.main.dns = "none";
# Set the system to use local DNS
networking.nameservers = [ "127.0.0.1" ];
}

8
system/services/openssh.nix Normal file
View File

@@ -0,0 +1,8 @@
{config, pkgs, ...}:
{
services.openssh = {
enable = true;
passwordAuthentication = true;
ports = [2022];
};
}

44
system/services/samba.nix Normal file
View File

@@ -0,0 +1,44 @@
{config, pkgs, ...}:
{
services.samba = {
enable = true;
# securityType = "user";
openFirewall = true;
settings = {
global = {
"workgroup" = "WORKGROUP";
"server string" = "smbnix";
# "netbios name" = "smbnix";
"security" = "user";
};
"public" = {
"path" = "/srv/samba/hoardfrost/mainstore";
"browseable" = "yes";
public = "yes";
"read only" = "no";
"guest ok" = "yes";
"create mask" = "0644";
"directory mask" = "0755";
# "force user" = "autumn";
# "force group" = "groupname";
"valid users" = "autumn lia madeleine";
};
"private" = {
"path" = "/srv/samba/hoardfrost/private";
"browseable" = "yes";
"read only" = "no";
"guest ok" = "no";
"create mask" = "0644";
"directory mask" = "0755";
"force user" = "autumn";
# "force group" = "groupname";
"valid users" = "autumn";
};
};
};
services.samba-wsdd = {
enable = true;
openFirewall = true;
discovery = true;
};
}

7
system/services/tailscale.nix Normal file
View File

@@ -0,0 +1,7 @@
{config, pkgs, ...}:
{
services.tailscale = {
enable = true;
};
}