From c4a99482cfc538616b740d59175e28fa18820235 Mon Sep 17 00:00:00 2001 From: Ahwx Date: Sat, 17 May 2025 18:20:19 +0200 Subject: [PATCH 1/9] feat: adds packages, import dns file; chore: cleanup some zfs stuff --- hosts/lily/default.nix | 18 +++--------------- 1 file changed, 3 insertions(+), 15 deletions(-) diff --git a/hosts/lily/default.nix b/hosts/lily/default.nix index acc1a6c..8d47c90 100644 --- a/hosts/lily/default.nix +++ b/hosts/lily/default.nix @@ -16,6 +16,7 @@ in imports = [ ./hardware-configuration.nix ./variables.nix + ./dns.nix ./../../modules/core/default.router.nix ]; @@ -87,20 +88,7 @@ in environment.systemPackages = with pkgs; [ kitty.terminfo - zfs + tcpdump + dnsutils ]; - - networking.hostId = "8ddb2a9b"; - - services.zfs = { - autoScrub.enable = true; - trim.enable = true; - }; - - # boot.zfs.extraPools = [ "terrabite" ]; - - # fileSystems."/terrabite/main" = { - # device = "terrabite/main"; - # fsType = "zfs"; - # }; } From 232e57415a12ff5f1495af80ac1f8a2ff5c5dd20 Mon Sep 17 00:00:00 2001 From: Ahwx Date: Sat, 17 May 2025 18:20:32 +0200 Subject: [PATCH 2/9] feat: enable dnsmasq --- hosts/lily/dns.nix | 12 ++++++++++++ 1 file changed, 12 insertions(+) create mode 100644 hosts/lily/dns.nix diff --git a/hosts/lily/dns.nix b/hosts/lily/dns.nix new file mode 100644 index 0000000..32263f0 --- /dev/null +++ b/hosts/lily/dns.nix @@ -0,0 +1,12 @@ +{ lib, config, ... }: +{ + services = { + dnsmasq = { + enable = true; + settings = { + cache-size = 10000; + server = [ "127.0.0.1#53" ]; + }; + }; + }; +} From 02dea23351a671fe967c70bea8018fcbc159e07e Mon Sep 17 00:00:00 2001 From: Ahwx Date: Sun, 18 May 2025 14:07:34 +0200 Subject: [PATCH 3/9] refactor: prettier --- hosts/dandelion/default.nix | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/hosts/dandelion/default.nix b/hosts/dandelion/default.nix index 6ecda6d..98e0a49 100644 --- a/hosts/dandelion/default.nix +++ b/hosts/dandelion/default.nix @@ -1,4 +1,9 @@ -{ pkgs, config, ... }: +{ + lib, + pkgs, + config, + ... +}: { imports = [ ./hardware-configuration.nix From eb6151b1ac5066964b93e82506b39706ac9d4b0b Mon Sep 17 00:00:00 2001 From: Ahwx Date: Sun, 18 May 2025 14:08:48 +0200 Subject: [PATCH 4/9] feat: import wireguard to lily, import lily's services, disable firewall temporarily; chore: remove an old zfs line --- hosts/lily/default.nix | 5 +++-- hosts/lily/wireguard.nix | 3 +++ 2 files changed, 6 insertions(+), 2 deletions(-) create mode 100644 hosts/lily/wireguard.nix diff --git a/hosts/lily/default.nix b/hosts/lily/default.nix index 8d47c90..2d36d14 100644 --- a/hosts/lily/default.nix +++ b/hosts/lily/default.nix @@ -17,7 +17,9 @@ in ./hardware-configuration.nix ./variables.nix ./dns.nix + ./wireguard.nix ./../../modules/core/default.router.nix + ./../../modules/services/lily.nix ]; liv = { @@ -26,7 +28,6 @@ in }; boot = { - supportedFilesystems = [ "zfs" ]; loader.grub = { enable = true; device = "/dev/sda"; @@ -52,7 +53,7 @@ in networking = { firewall = { - enable = true; + enable = false; allowPing = true; # allow ssh on *all* interfaces, even wan. diff --git a/hosts/lily/wireguard.nix b/hosts/lily/wireguard.nix new file mode 100644 index 0000000..0db3279 --- /dev/null +++ b/hosts/lily/wireguard.nix @@ -0,0 +1,3 @@ +{ + +} From 88177be9a7ce93e3d80520e5a3422267e0f8e35e Mon Sep 17 00:00:00 2001 From: Ahwx Date: Sun, 18 May 2025 14:09:08 +0200 Subject: [PATCH 5/9] feat: adds unifi service so that lily can host that --- modules/services/unifi.nix | 66 ++++++++++++++++++++++++++++++++++++++ 1 file changed, 66 insertions(+) create mode 100644 modules/services/unifi.nix diff --git a/modules/services/unifi.nix b/modules/services/unifi.nix new file mode 100644 index 0000000..c206c3d --- /dev/null +++ b/modules/services/unifi.nix @@ -0,0 +1,66 @@ +{ pkgs, lib, ... }: + +{ + services.unifi = { + enable = true; + unifiPackage = pkgs.unifi8; + mongodbPackage = pkgs.mongodb-7_0; + }; + # services.nginx = { + # enable = true; + # recommendedProxySettings = true; + + # virtualHosts."unifi.local" = { + # forceSSL = true; + # useACMEHost = "unifi.local"; + # locations."/" = { + # proxyPass = "https://127.0.0.1:8443"; + # proxyWebsockets = true; + # }; + # }; + # }; + # virtualisation.oci-containers.containers."unifi" = { + # image = "lscr.io/linuxserver/unifi-network-application:latest"; + # autoStart = true; + # environmentFiles = [ /run/unifi/container-vars.env ]; + # volumes = [ + # "/etc/localtime:/etc/localtime:ro" + # "/run/unifi/data:/config" + # ]; + # ports = [ + # "8443:8443" # web admin UI + # "3478:3478/udp" # STUN + # "10001:10001/udp" # AP discovery + # "8080:8080" # device communication + # "6789:6789/udp" # mobile throughput test (assumption: wifiman) + # "5514:5514/udp" # remote syslog (optional) + # ]; + # dependsOn = [ + # "unifi-mongo" + # ]; + # log-driver = "journald"; + # }; + # virtualisation.oci-containers.containers."unifi-mongo" = { + # image = "mongo:latest"; + # autoStart = true; + # volumes = [ + # "/etc/localtime:/etc/localtime:ro" + # "/run/unifi/mongo/db:/data/db" + # "/run/unifi/mongo/init-mongo.js:/docker-entrypoint-initdb.d/init-mongo.js:ro" + # ]; + # log-driver = "journald"; + # }; + + networking.firewall.interfaces."lan0" = { + allowedTCPPorts = [ + 8443 # web admin UI + 8080 # device communication + ]; + allowedUDPPorts = [ + 6789 # mobile throughput test (assumption: wifiman) + 5514 # remote syslog (optional) + 3478 # STUN + 10001 # AP discovery + ]; + }; +} From f11ba8c63c7ee8c854334daed01b90e2d7624b0d Mon Sep 17 00:00:00 2001 From: Ahwx Date: Sun, 18 May 2025 14:09:33 +0200 Subject: [PATCH 6/9] feat: adds services for lily to run --- modules/services/lily.nix | 9 +++++++++ 1 file changed, 9 insertions(+) create mode 100644 modules/services/lily.nix diff --git a/modules/services/lily.nix b/modules/services/lily.nix new file mode 100644 index 0000000..2e33b08 --- /dev/null +++ b/modules/services/lily.nix @@ -0,0 +1,9 @@ +{ ... }: +{ + imports = + [ (import ./docker.nix) ] + ++ [ (import ./monitoring.nix) ] + ++ [ (import ./smart-monitoring.nix) ] + ++ [ (import ./unifi.nix) ] + ++ [ (import ./grafana.nix) ]; +} From 9d40b2a439f0816865d1cffd316b8286c9a89d49 Mon Sep 17 00:00:00 2001 From: Ahwx Date: Sun, 18 May 2025 14:09:40 +0200 Subject: [PATCH 7/9] feat: adds tailscale --- modules/services/tailscale.nix | 3 +++ 1 file changed, 3 insertions(+) create mode 100644 modules/services/tailscale.nix diff --git a/modules/services/tailscale.nix b/modules/services/tailscale.nix new file mode 100644 index 0000000..d886410 --- /dev/null +++ b/modules/services/tailscale.nix @@ -0,0 +1,3 @@ +{ + services.tailscale.enable = true; +} From 7c9ab547e08323374f298909ef8c822fedd1b113 Mon Sep 17 00:00:00 2001 From: Ahwx Date: Sun, 18 May 2025 20:44:36 +0200 Subject: [PATCH 8/9] feat: adds dnsmasq and settings --- hosts/lily/dns.nix | 23 +++++++++++++++++++++-- 1 file changed, 21 insertions(+), 2 deletions(-) diff --git a/hosts/lily/dns.nix b/hosts/lily/dns.nix index 32263f0..b754a51 100644 --- a/hosts/lily/dns.nix +++ b/hosts/lily/dns.nix @@ -4,8 +4,27 @@ dnsmasq = { enable = true; settings = { - cache-size = 10000; - server = [ "127.0.0.1#53" ]; + cache-size = 10000; # Specifies the size of the DNS query cache. It will store up to n cached DNS queries to improve response times for frequently accessed domains. + server = [ + "9.9.9.9" + "149.112.112.112" + ]; + domain-needed = true; # Ensures that DNS queries are only forwarded for domains that are not found in the local configuration. + bogus-priv = true; # Blocks DNS queries for private IP address ranges to prevent accidental exposure of private resources. + no-resolv = true; # Prevents dnsmasq from using /etc/resolv.conf for DNS server configuration. + + # configure DHCP server; get leases by running: `cat /var/lib/dnsmasq/dnsmasq.leases` + dhcp-range = [ "br-lan,172.16.10.50,172.16.10.254,24h" ]; + interface = "br-lan"; + dhcp-host = "172.16.10.1"; + + # local sets the local domain name to "n". Combinded with expand-hosts = true, it will add a .local suffix to any local defined name when trying to resolve it. + local = "/local/"; + domain = "local"; + expand-hosts = true; + + no-hosts = true; # Prevents the use of /etc/hosts. This ensures that the local hosts file is not used to override DNS resolution. + address = "/booping.local/172.16.10.1"; }; }; }; From 0f2e67f35595a2a2fbc0e494ac18c16e7a3e225b Mon Sep 17 00:00:00 2001 From: Ahwx Date: Sun, 18 May 2025 20:47:41 +0200 Subject: [PATCH 9/9] feat: enables tailscale for lily --- modules/services/lily.nix | 1 + 1 file changed, 1 insertion(+) diff --git a/modules/services/lily.nix b/modules/services/lily.nix index 2e33b08..2774318 100644 --- a/modules/services/lily.nix +++ b/modules/services/lily.nix @@ -5,5 +5,6 @@ ++ [ (import ./monitoring.nix) ] ++ [ (import ./smart-monitoring.nix) ] ++ [ (import ./unifi.nix) ] + ++ [ (import ./tailscale.nix) ] ++ [ (import ./grafana.nix) ]; }