bryan/nixos
0
0
Fork 0
mirror of https://github.com/itme-brain/nixos.git synced 2026-03-23 16:29:42 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

added docker, removed cam net isolation

Browse source
This commit is contained in:
Bryan Ramos 2026-03-18 19:25:25 -04:00
parent 8f97be72f0
commit 3a57d7a9f5
7 changed files with 50 additions and 14 deletions
Download patch file Download diff file Expand all files Collapse all files

1
system/machines/desktop/default.nix
View file

@ -10,6 +10,7 @@
../../../user
../../keys
../../modules/sops
../../modules/docker
./hardware.nix
./system.nix
];

1
system/machines/desktop/hardware.nix
View file

@ -66,6 +66,7 @@ with lib;
nvidiaSettings = true;
package = config.boot.kernelPackages.nvidiaPackages.stable;
};
nvidia-container-toolkit.enable = true;
graphics = {
enable = true;
enable32Bit = true;

3
system/machines/desktop/system.nix
View file

@ -5,10 +5,13 @@ let
(user: user.modules.user.security.gpg.enable or false)
(lib.attrValues config.home-manager.users);
sysModules = config.modules.system;
in
{ system.stateVersion = "23.11";
modules.system.sops.enable = true;
modules.system.docker.enable = true;
# WiFi secrets
sops.secrets = let wifi = { sopsFile = ../../../secrets/system/wifi.yaml; }; in {

29
system/machines/server/system.nix
View file

@ -108,9 +108,16 @@
console.font = "Lat2-Terminus16";
boot.kernel.sysctl."net.ipv4.ip_forward" = 1;
networking = {
hostName = "server";
useDHCP = false;
nat = {
enable = true;
internalInterfaces = [ "enp2s0f1" ];
externalInterface = "enp2s0f0";
};
interfaces.enp2s0f0 = {
ipv4.addresses = [{
address = "192.168.0.154";
@ -130,17 +137,17 @@
enable = true;
allowedTCPPorts = [ 22 ];
allowedUDPPorts = [ 53 67 ]; # DNS + DHCP
extraCommands = ''
# Block camera MACs from forwarding (instant DROP, no timeouts)
iptables -A FORWARD -m mac --mac-source 00:1f:54:c2:d1:b1 -j DROP # cam4
iptables -A FORWARD -m mac --mac-source 00:1f:54:b2:9b:1d -j DROP # cam2/cam3
iptables -A FORWARD -m mac --mac-source 00:1f:54:a9:81:d1 -j DROP # cam1
'';
extraStopCommands = ''
iptables -D FORWARD -m mac --mac-source 00:1f:54:c2:d1:b1 -j DROP || true
iptables -D FORWARD -m mac --mac-source 00:1f:54:b2:9b:1d -j DROP || true
iptables -D FORWARD -m mac --mac-source 00:1f:54:a9:81:d1 -j DROP || true
'';
# extraCommands = ''
# # Block camera MACs from forwarding (instant DROP, no timeouts)
# iptables -A FORWARD -m mac --mac-source 00:1f:54:c2:d1:b1 -j DROP # cam4
# iptables -A FORWARD -m mac --mac-source 00:1f:54:b2:9b:1d -j DROP # cam2/cam3
# iptables -A FORWARD -m mac --mac-source 00:1f:54:a9:81:d1 -j DROP # cam1
# '';
# extraStopCommands = ''
# iptables -D FORWARD -m mac --mac-source 00:1f:54:c2:d1:b1 -j DROP || true
# iptables -D FORWARD -m mac --mac-source 00:1f:54:b2:9b:1d -j DROP || true
# iptables -D FORWARD -m mac --mac-source 00:1f:54:a9:81:d1 -j DROP || true
# '';
};
};

27
system/modules/docker/default.nix Normal file
View file

@ -0,0 +1,27 @@
{ pkgs, lib, config, ... }:
with lib;
let
cfg = config.modules.system.docker;
in
{
options.modules.system.docker = { enable = mkEnableOption "Enable Docker"; };
config = mkIf cfg.enable {
virtualisation.docker = {
enable = true;
# Explicit storage driver for ext4/xfs filesystems
storageDriver = "overlay2";
};
# Add docker package to system packages
environment.systemPackages = with pkgs; [
docker
docker-compose
];
# Add user to docker group
users.users.${config.user.name}.extraGroups = [ "docker" ];
};
}

1
system/modules/sops/default.nix
View file

@ -7,7 +7,6 @@ let
in
{
options.modules.system.sops = { enable = mkEnableOption "Enable sops-nix"; };
config = mkIf cfg.enable {
# Smartcard daemon for Yubikey (GPG, etc.)
services.pcscd.enable = true;

2
user/modules/utils/dev/default.nix
View file

@ -17,8 +17,6 @@ in
pkg-config
qrencode
docker
# Network/system tools
fping
wireguard-tools