erik
5dddc9d2fb
- services.tailscale auto-registers with headscale using a sops pre-auth key - trust tailscale0 so LAN services are reachable over the tailnet - fix missing semicolon on audiobookshelf extraGroups
58 lines
2.5 KiB
Nix
58 lines
2.5 KiB
Nix
{ config, pkgs, lib, ... }:
|
|
|
|
# Real-host config: hardware + disk layout + bootloader + shared services.
|
|
{
|
|
imports = [
|
|
./hardware-configuration.nix
|
|
./disk-config.nix # disko: OS-disk partitions + filesystems
|
|
./secrets.nix # sops-nix: samba password etc.
|
|
./services.nix
|
|
];
|
|
|
|
# ---- Boot ----
|
|
# systemd-boot for UEFI. If ZimaBlade boots legacy/BIOS, switch to grub.
|
|
boot.loader.systemd-boot.enable = true;
|
|
boot.loader.efi.canTouchEfiVariables = true;
|
|
|
|
# Root lives on the ZimaBlade eMMC (mmcblk0). nixos-generate-config runs in
|
|
# the RAM installer and does NOT detect these, so pin them here (merged with
|
|
# hardware-configuration.nix) or stage-1 can't mount root and the box panics.
|
|
boot.initrd.availableKernelModules = [ "mmc_block" "sdhci_pci" "sdhci_acpi" ];
|
|
|
|
# Trust wheel users so `nixos-rebuild --target-host darman@…` can push a
|
|
# laptop-built (unsigned) closure without a signature error.
|
|
nix.settings.trusted-users = [ "root" "@wheel" ];
|
|
|
|
# Warm reboot hangs at firmware reset on this board (cold power-cycle works).
|
|
# Force the PCI-chipset reset method. If a warm `reboot` still hangs, try the
|
|
# next value: acpi -> bios -> cold -> efi.
|
|
boot.kernelParams = [ "reboot=pci" ];
|
|
|
|
# ---- NAS data array ----
|
|
# Existing ext4 on the mdadm RAID0 over sda+sdb (md0, 29.1T).
|
|
# Mounted, NOT formatted; kept out of disko so it is never wiped.
|
|
# ⚠️ RAID0 = no redundancy: either 16TB disk failing loses ALL data.
|
|
boot.swraid.enable = true; # assemble the mdadm array at boot
|
|
fileSystems."/mnt/data" = {
|
|
# fs UUID (stable) — the array may enumerate as /dev/md127, so avoid /dev/md0.
|
|
device = "/dev/disk/by-uuid/dadbff6f-652e-49b2-bfed-eb1308ab8b78";
|
|
fsType = "ext4";
|
|
options = [ "nofail" ]; # don't block boot if the array is degraded/absent
|
|
};
|
|
|
|
# ---- Tailscale (via self-hosted headscale) ----
|
|
# Auto-registers on boot using a headscale pre-auth key from sops.
|
|
# Generate the key on the headscale server, e.g.:
|
|
# headscale preauthkeys create --user <user> --expiration 1h
|
|
# then put it in secrets/jupiter.yaml (./edit_secrets, key: tailscale_authkey).
|
|
services.tailscale = {
|
|
enable = true;
|
|
openFirewall = true; # UDP 41641 for direct connections
|
|
authKeyFile = config.sops.secrets.tailscale_authkey.path;
|
|
extraUpFlags = [ "--login-server=https://vpn.mgaction.town" ];
|
|
};
|
|
# Reach jupiter's services (ssh, samba, audiobookshelf) over the tailnet
|
|
# without opening those ports on the LAN.
|
|
networking.firewall.trustedInterfaces = [ "tailscale0" ];
|
|
}
|