erik
894f88c71e
- nixosConfigurations.mercury: aarch64, sd-image-aarch64, imports common.nix - static net placeholders (CHANGE-ME), hostname mercury - DNS service left undecided: commented pihole (services.pihole-ftl) + adguardhome - no sops yet (add with the service if it needs a secret)
50 lines
1.9 KiB
Nix
50 lines
1.9 KiB
Nix
{ config, pkgs, lib, ... }:
|
|
|
|
# mercury — Raspberry Pi 3B+ (aarch64). Network DNS + DHCP (+ adblock).
|
|
# Boots from an SD image (see flake: nixosConfigurations.mercury), so there is
|
|
# no disko / hardware-configuration here — the sd-image module provides them.
|
|
{
|
|
imports = [
|
|
../../common.nix # shared base: user / ssh / nix / firewall
|
|
# ../../services/<dns>.nix # add once the DNS service is chosen (below)
|
|
];
|
|
|
|
networking.hostName = "mercury";
|
|
|
|
# ---- Static networking ----
|
|
# A DNS/DHCP server must have a fixed address. Fill in the Pi's real values
|
|
# (from `ip -brief a` / `ip route` on the running Pi). eth0 = the Pi's NIC.
|
|
networking.useDHCP = false;
|
|
networking.usePredictableInterfaceNames = false; # keep it named eth0
|
|
networking.interfaces.eth0.ipv4.addresses = [
|
|
{ address = "10.0.0.2"; prefixLength = 24; } # CHANGE-ME: the Pi's IP
|
|
];
|
|
networking.defaultGateway = { address = "10.0.0.1"; interface = "eth0"; }; # CHANGE-ME
|
|
# Upstream resolvers for the box itself (the adblock DNS forwards to these).
|
|
networking.nameservers = [ "1.1.1.1" "9.9.9.9" ];
|
|
|
|
# ---- DNS + adblock + DHCP — pick ONE, then open its ports below ----
|
|
#
|
|
# Option A: pihole (native module)
|
|
# services.pihole-ftl = {
|
|
# enable = true;
|
|
# # dhcp, lists, upstreams, local records...
|
|
# };
|
|
#
|
|
# Option B: AdGuard Home (native module, fully declarative)
|
|
# services.adguardhome = {
|
|
# enable = true;
|
|
# settings = {
|
|
# dns.upstream_dns = [ "1.1.1.1" "9.9.9.9" ];
|
|
# # filters (adlists), rewrites (local DNS), dhcp static leases...
|
|
# };
|
|
# };
|
|
#
|
|
# Then open the ports this service needs:
|
|
# networking.firewall.allowedTCPPorts = [ 53 80 ]; # DNS + web UI
|
|
# networking.firewall.allowedUDPPorts = [ 53 67 ]; # DNS + DHCP
|
|
|
|
# Do not modify after first flash.
|
|
system.stateVersion = "26.05";
|
|
}
|