bryan/nixos
0
0
Fork 0
mirror of https://github.com/itme-brain/nixos.git synced 2026-05-08 06:50:11 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

init

Browse source
This commit is contained in:
Bryan Ramos 2026-04-15 20:58:07 -04:00
commit 864c69fe61
147 changed files with 11233 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

253
system/machines/server/system.nix Normal file
View file

@ -0,0 +1,253 @@
{ pkgs, lib, config, ... }:
{ system.stateVersion = "25.11";
imports = [ ./modules ];
modules.system.sops.enable = true;
# Camera RTSP credentials (used by frigate/go2rtc)
sops.secrets = let
cameras = { sopsFile = ../../../secrets/system/cameras.yaml; };
llama = { sopsFile = ../../../secrets/system/llama.yaml; };
in {
"RTSP_USER" = cameras;
"RTSP_PASS" = cameras;
"LLAMA_API_KEY" = llama // { owner = config.user.name; };
};
# API key auth for ai.ramos.codes — nginx validates Bearer token against sops secret
sops.templates."nginx-ai-auth.conf" = {
content = ''
if ($api_key != "${config.sops.placeholder."LLAMA_API_KEY"}") {
return 401 '{"error": "Invalid API key"}';
}
'';
owner = "nginx";
};
# MCP endpoint auth — validates X-API-Key header
sops.templates."nginx-mcp-auth.conf" = {
content = ''
if ($http_x_api_key != "${config.sops.placeholder."LLAMA_API_KEY"}") {
return 401 '{"error": "Unauthorized"}';
}
'';
owner = "nginx";
};
modules.system = {
nginx = {
enable = true;
};
sandpack.enable = true;
forgejo.enable = true;
frigate.enable = true;
immich.enable = true;
webdav.enable = false;
wstunnel.enable = true;
wireguard = {
enable = true;
peers = [
{
publicKey = "HRFsVXn3jeqKQLQIl0cB6KC/qia7M1gQf2lqG5HDxF8=";
allowedIPs = [ "10.8.0.2/32" ];
}
{
publicKey = "eY2JTwuvzLLVnyhUTop0I+7qO2swFSjo12So4Yzkamk=";
allowedIPs = [ "10.8.0.3/32" ];
}
];
};
# bitcoin = {
# enable = true;
# electrum.enable = true;
# clightning.enable = true;
# };
backup = {
enable = true;
recipients = [
"${config.user.keys.age.yubikey}"
"${config.machines.keys.desktop.ssh}"
];
paths = [ "/root/.config/rclone" ];
destination = "gdrive:backups/server";
schedule = "daily";
keepLast = 2;
};
};
users.users = {
${config.user.name} = {
isNormalUser = true;
extraGroups = config.user.groups;
openssh.authorizedKeys.keys = [
"${config.machines.keys.desktop.ssh}"
];
};
};
nix = {
channel.enable = false;
package = pkgs.nixVersions.stable;
extraOptions = "experimental-features = nix-command flakes";
settings = {
auto-optimise-store = true;
trusted-users = [ "${config.user.name}" ];
};
gc = {
automatic = true;
dates = "weekly";
options = "--delete-older-than 30d";
};
};
boot.loader = {
timeout = 3;
grub = {
enable = true;
devices = [ "nodev" ];
efiSupport = true;
efiInstallAsRemovable = true; # HP Z230 UEFI ignores custom boot entries
configurationLimit = 5;
splashImage = null;
};
efi = {
canTouchEfiVariables = false; # Not needed with efiInstallAsRemovable
efiSysMountPoint = "/boot";
};
};
environment.systemPackages = with pkgs; [
wget
git
vim
htop
dmidecode
];
security.sudo = {
wheelNeedsPassword = false;
execWheelOnly = true;
};
time = {
timeZone = "America/New_York";
hardwareClockInLocalTime = true;
};
services.timesyncd = lib.mkDefault {
enable = true;
servers = [
"0.pool.ntp.org"
"1.pool.ntp.org"
"2.pool.ntp.org"
"3.pool.ntp.org"
];
};
i18n.defaultLocale = "en_US.UTF-8";
console.font = "Lat2-Terminus16";
boot.kernel.sysctl."net.ipv4.ip_forward" = 1;
networking = {
hostName = "server";
useDHCP = false;
nat = {
enable = true;
internalInterfaces = [ "enp2s0f1" ];
externalInterface = "enp2s0f0";
};
interfaces.enp2s0f0 = {
ipv4.addresses = [{
address = "192.168.0.154";
prefixLength = 24;
}];
};
# Camera network - isolated, no gateway
interfaces.enp2s0f1 = {
ipv4.addresses = [{
address = "192.168.1.1";
prefixLength = 24;
}];
};
defaultGateway = "192.168.0.1";
nameservers = [ "1.1.1.1" "8.8.8.8" ];
firewall = {
enable = true;
allowedTCPPorts = [ 22 ];
allowedUDPPorts = [ 53 67 ]; # DNS + DHCP
# extraCommands = ''
# # Block camera MACs from forwarding (instant DROP, no timeouts)
# iptables -A FORWARD -m mac --mac-source 00:1f:54:c2:d1:b1 -j DROP # cam4
# iptables -A FORWARD -m mac --mac-source 00:1f:54:b2:9b:1d -j DROP # cam2/cam3
# iptables -A FORWARD -m mac --mac-source 00:1f:54:a9:81:d1 -j DROP # cam1
# '';
# extraStopCommands = ''
# iptables -D FORWARD -m mac --mac-source 00:1f:54:c2:d1:b1 -j DROP || true
# iptables -D FORWARD -m mac --mac-source 00:1f:54:b2:9b:1d -j DROP || true
# iptables -D FORWARD -m mac --mac-source 00:1f:54:a9:81:d1 -j DROP || true
# '';
};
};
services.dnsmasq = {
enable = true;
settings = {
# All *.ramos.codes subdomains -> local server
address = "/.ramos.codes/192.168.0.154";
# Except www, http, https and bare domain -> forward to upstream
server = [
"/www.ramos.codes/1.1.1.1"
"/http.ramos.codes/1.1.1.1"
"/https.ramos.codes/1.1.1.1"
"/ramos.codes/1.1.1.1"
"1.1.1.1"
"8.8.8.8"
];
cache-size = 1000;
# Camera network DHCP (isolated - no gateway = no internet)
interface = [ "enp2s0f1" "wg0" ];
bind-interfaces = true;
dhcp-range = "192.168.1.100,192.168.1.200,24h";
# Static DHCP reservations for cameras
dhcp-host = [
"00:1f:54:c2:d1:b1,192.168.1.194,cam4"
"00:1f:54:b2:9b:1d,192.168.1.147,cam2"
"00:1f:54:a9:81:d1,192.168.1.167,cam1"
];
};
};
systemd.services.dnsmasq = {
after = [ "wireguard-wg0.service" ];
wants = [ "wireguard-wg0.service" ];
};
services.fail2ban = {
enable = true;
maxretry = 5;
bantime = "1h";
ignoreIP = [
"127.0.0.1/8"
"192.168.0.0/24"
"10.8.0.0/24"
];
};
services.openssh = {
enable = true;
startWhenNeeded = true;
settings = {
X11Forwarding = false;
PasswordAuthentication = false;
PermitRootLogin = "no";
};
};
}