From 76584937f15e59eb7d8bddf121c61df85ce9442b Mon Sep 17 00:00:00 2001 From: notohh Date: Thu, 30 Nov 2023 22:27:58 -0500 Subject: [PATCH] hosts: init haru --- hosts/default.nix | 20 ++++ hosts/deploy.nix | 10 ++ hosts/haru/default.nix | 33 +++++++ hosts/haru/hardware-configuration.nix | 29 ++++++ hosts/haru/home.nix | 14 +++ hosts/haru/networking.nix | 17 ++++ hosts/haru/services/blocky.nix | 132 ++++++++++++++++++++++++++ hosts/haru/services/default.nix | 5 + 8 files changed, 260 insertions(+) create mode 100644 hosts/haru/default.nix create mode 100644 hosts/haru/hardware-configuration.nix create mode 100644 hosts/haru/home.nix create mode 100644 hosts/haru/networking.nix create mode 100644 hosts/haru/services/blocky.nix create mode 100644 hosts/haru/services/default.nix diff --git a/hosts/default.nix b/hosts/default.nix index e2f93f0..0d03a03 100644 --- a/hosts/default.nix +++ b/hosts/default.nix @@ -173,4 +173,24 @@ in { } ]; }; + haru = nixosSystem { + inherit system; + specialArgs = {inherit inputs;}; + modules = [ + ./haru + sopsModule + hmModule + { + home-manager = { + useGlobalPkgs = true; + useUserPackages = true; + users.notoh = { + imports = [ + ./haru/home.nix + ]; + }; + }; + } + ]; + }; } diff --git a/hosts/deploy.nix b/hosts/deploy.nix index 9bf4510..ed64275 100644 --- a/hosts/deploy.nix +++ b/hosts/deploy.nix @@ -60,5 +60,15 @@ inputs: { sshOpts = ["-t" "-i" "~/.ssh/forgejo"]; magicRollback = true; }; + haru = { + hostname = "100.73.192.45"; + profiles.system = { + user = "root"; + path = activate.nixos inputs.self.nixosConfigurations.haru; + }; + sshUser = "root"; + sshOpts = ["-t" "-i" "~/.ssh/forgejo"]; + magicRollback = true; + }; }; } diff --git a/hosts/haru/default.nix b/hosts/haru/default.nix new file mode 100644 index 0000000..445de1b --- /dev/null +++ b/hosts/haru/default.nix @@ -0,0 +1,33 @@ +{...}: { + imports = [ + ./hardware-configuration.nix + ./services + ./networking.nix + ../../modules + ]; + + boot.loader = { + grub = { + enable = true; + configurationLimit = 5; + device = "/dev/sda"; + useOSProber = false; + }; + }; + + networking = { + hostName = "haru"; + }; + + services.xserver = { + layout = "us"; + xkbVariant = ""; + }; + + users.users.notoh.openssh.authorizedKeys.keys = [ + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDdSO5g6IZQUzeH0Xf7hEVjKZ4cAWn/DjN+GQ2Ujd+qD haru" + ]; + users.users.root.openssh.authorizedKeys.keys = [ + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMd8j1+fC/ng7l17rsxugVtlhurUe1ICizwA9lQkSuNY forgejo" + ]; +} diff --git a/hosts/haru/hardware-configuration.nix b/hosts/haru/hardware-configuration.nix new file mode 100644 index 0000000..9ee1122 --- /dev/null +++ b/hosts/haru/hardware-configuration.nix @@ -0,0 +1,29 @@ +{ + config, + lib, + pkgs, + modulesPath, + ... +}: { + imports = [ + (modulesPath + "/profiles/qemu-guest.nix") + ]; + + boot.initrd.availableKernelModules = ["ata_piix" "uhci_hcd" "virtio_pci" "virtio_scsi" "sd_mod" "sr_mod"]; + boot.initrd.kernelModules = []; + boot.kernelModules = []; + boot.extraModulePackages = []; + + fileSystems."/" = { + device = "/dev/disk/by-uuid/06177115-2e39-493b-81fb-5a1980ae0534"; + fsType = "ext4"; + }; + + swapDevices = [ + {device = "/dev/disk/by-uuid/c879fa21-fd80-422c-9aef-0becce5ff19c";} + ]; + + networking.useDHCP = lib.mkDefault true; + + nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux"; +} diff --git a/hosts/haru/home.nix b/hosts/haru/home.nix new file mode 100644 index 0000000..c7eafac --- /dev/null +++ b/hosts/haru/home.nix @@ -0,0 +1,14 @@ +{...}: { + imports = [ + ../../home + ]; + + systemd.user.startServices = "sd-switch"; + programs.home-manager.enable = true; + + home = { + username = "notoh"; + homeDirectory = "/home/notoh"; + stateVersion = "23.05"; + }; +} diff --git a/hosts/haru/networking.nix b/hosts/haru/networking.nix new file mode 100644 index 0000000..ccd8dbf --- /dev/null +++ b/hosts/haru/networking.nix @@ -0,0 +1,17 @@ +_: { + networking = { + networkmanager.enable = true; + nameservers = ["1.1.1.1"]; + firewall = { + enable = true; + }; + }; + environment.etc = { + "resolv.conf".text = '' + nameserver 1.1.1.1 + nameserver 1.0.0.1 + ''; + }; + + services.tailscale.enable = true; +} diff --git a/hosts/haru/services/blocky.nix b/hosts/haru/services/blocky.nix new file mode 100644 index 0000000..24b3296 --- /dev/null +++ b/hosts/haru/services/blocky.nix @@ -0,0 +1,132 @@ +{...}: { + networking.firewall.allowedTCPPorts = [53 4000]; + networking.firewall.allowedUDPPorts = [53]; + + services.blocky = { + enable = true; + settings = { + connectIPVersion = "v4"; + upstreamTimeout = "30s"; + startVerifyUpstream = false; + minTlsServeVersion = "1.2"; + log = { + level = "debug"; + privacy = true; + }; + ports = { + dns = 53; + http = 4000; + https = 443; + }; + upstream.default = [ + "1.1.1.1" + "1.0.0.1" + "9.9.9.9" + "https://1.1.1.1/dns-query" + "https://dns.quad9.net/dns-query" + "https://dns-unfiltered.adguard.com/dns-query" + ]; + blocking = { + loading = { + strategy = "fast"; + concurrency = 8; + }; + blackLists = { + ads = [ + "https://blocklistproject.github.io/Lists/ads.txt" + "https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts" + "https://adaway.org/hosts.txt" + "https://v.firebog.net/hosts/AdguardDNS.txt" + "https://v.firebog.net/hosts/Admiral.txt" + "https://raw.githubusercontent.com/anudeepND/blacklist/master/adservers.txt" + "https://s3.amazonaws.com/lists.disconnect.me/simple_ad.txt" + "https://v.firebog.net/hosts/Easylist.txt" + "https://pgl.yoyo.org/adservers/serverlist.php?hostformat=hosts&showintro=0&mimetype=plaintext" + "https://raw.githubusercontent.com/FadeMind/hosts.extras/master/UncheckyAds/hosts" + "https://raw.githubusercontent.com/bigdargon/hostsVN/master/hosts" + ]; + tracking = [ + "https://v.firebog.net/hosts/Easyprivacy.txt" + "https://v.firebog.net/hosts/Prigent-Ads.txt" + "https://raw.githubusercontent.com/FadeMind/hosts.extras/master/add.2o7Net/hosts" + "https://raw.githubusercontent.com/crazy-max/WindowsSpyBlocker/master/data/hosts/spy.txt" + "https://hostfiles.frogeye.fr/firstparty-trackers-hosts.txt" + ]; + malicious = [ + "https://raw.githubusercontent.com/DandelionSprout/adfilt/master/Alternate%20versions%20Anti-Malware%20List/AntiMalwareHosts.txt" + "https://osint.digitalside.it/Threat-Intel/lists/latestdomains.txt" + "https://s3.amazonaws.com/lists.disconnect.me/simple_malvertising.txt" + "https://v.firebog.net/hosts/Prigent-Crypto.txt" + "https://raw.githubusercontent.com/FadeMind/hosts.extras/master/add.Risk/hosts" + "https://v.firebog.net/hosts/RPiList-Phishing.txt" + "https://v.firebog.net/hosts/RPiList-Malware.txt" + ]; + misc = [ + "https://zerodot1.gitlab.io/CoinBlockerLists/hosts_browser" + "https://raw.githubusercontent.com/StevenBlack/hosts/master/alternates/fakenews-only/hosts" + ]; + }; + whiteLists = { + default = [ + "https://raw.githubusercontent.com/anudeepND/whitelist/master/domains/whitelist.txt" + # "https://raw.githubusercontent.com/anudeepND/whitelist/master/domains/optional-list.txt" + ]; + }; + clientGroupsBlock = { + default = [ + "ads" + "tracking" + "malicious" + "misc" + ]; + }; + }; + customDNS = { + customTTL = "1h"; + mapping = { + # infra + + "truenas.internal.flake.sh" = "192.168.1.199"; + "assistant.internal.flake.sh" = "192.168.1.189"; + "dashboard.internal.flake.sh" = "192.168.1.36"; + "udm.internal.flake.sh" = "192.168.1.1"; + "pve.internal.flake.sh" = "192.168.1.37"; + + # media + + "jellyfin.internal.flake.sh" = "192.168.1.36"; + "jellyseerr.internal.flake.sh" = "192.168.1.36"; + "sonarr.internal.flake.sh" = "192.168.1.54"; + "radarr.internal.flake.sh" = "192.168.1.54"; + "bazarr.internal.flake.sh" = "192.168.1.54"; + "prowlarr.internal.flake.sh" = "192.168.1.54"; + "stash.internal.flake.sh" = "192.168.1.36"; + + # misc + + "wallos.internal.flake.sh" = "192.168.1.36"; + }; + }; + redis = { + address = "100.94.214.100:6381"; + password = "blocky"; + database = 2; + required = false; + connectionAttempts = 10; + connectionCooldown = "5s"; + }; + caching = { + minTime = "2h"; + maxTime = "12h"; + maxItemsCount = 0; + prefetching = true; + prefetchExpires = "2h"; + prefetchThreshold = 5; + }; + prometheus = { + enable = true; + path = "/metrics"; + }; + }; + }; +} diff --git a/hosts/haru/services/default.nix b/hosts/haru/services/default.nix new file mode 100644 index 0000000..06c90a7 --- /dev/null +++ b/hosts/haru/services/default.nix @@ -0,0 +1,5 @@ +_: { + imports = [ + ./blocky.nix + ]; +}