Initial release

systems/bastion/bastion-actual.nix

@@ -0,0 +1,117 @@
+{ pkgs, ... }: {
+  networking.hostName = "bastion";
+  networking.hostId = "0d13f99b";
+
+  # WARNING: BUILT-IN ETHERNET HARDWARE IS BORKED!!!
+  # https://xcp-ng.org/docs/networking.html#intel-i218-i219-slow-speed
+  # https://serverfault.com/questions/581265/disable-tcp-checksum-offloading-on-kvm-virtual-network
+
+  imports = [
+    ./bastion_base.nix
+
+    ../../features/intelgpu.nix
+    ../../tweaks/powersave.nix
+  ];
+
+  boot.loader.grub.mirroredBoots = [
+    {
+      devices = [ "nodev" ];
+      path = "/boot0";
+    }
+    {
+      devices = [ "nodev" ];
+      path = "/boot1";
+    }
+  ];
+
+  fileSystems = {
+    "/boot0" = {
+      device = "/dev/disk/by-id/nvme-Samsung_SSD_970_EVO_Plus_500GB_S58SNG0MA07159M-part1";
+      fsType = "vfat";
+      options = [ "nofail" ];
+    };
+    "/boot1" = {
+      device = "/dev/disk/by-id/ata-PNY_CS900_1TB_SSD_PNY244624111201023FB-part1";
+      fsType = "vfat";
+      options = [ "nofail" ];
+    };
+
+    "/exports/Frigate" = {
+      device = "bastion-frigate";
+      fsType = "zfs";
+    };
+    "/exports/MyBook" = {
+      device = "MyBook/root";
+      fsType = "zfs";
+      options = [ "nofail" ];
+    };
+  };
+
+  ##############################################################################
+  ##############################################################################
+  ##############################################################################
+  # Networking
+
+  systemd.network.networks = {
+    "30-eno1" = {
+      matchConfig.Name = "eno1";
+      networkConfig.Bridge = "br0";
+      linkConfig.RequiredForOnline = "enslaved";
+    };
+    "30-enp0s20f0u8" = {
+      matchConfig.Name = "enp0s20f0u8";
+      networkConfig.Bridge = "br0";
+      linkConfig.RequiredForOnline = "enslaved";
+    };
+
+    "90-tinc" = {
+      matchConfig.Name = "tinc.mlaga97spa";
+      address = [ "10.86.84.105/32" ];
+      routes = [ { Destination = "10.86.84.0/24"; } ];
+    };
+  };
+
+  services.tinc.networks.mlaga97space = {
+    name = "bastion";
+    ed25519PrivateKeyFile = "/root/tinc/mlaga97space_ed25519_key.priv";
+
+    chroot = false;
+    settings.ConnectTo = [ "fortress" "citadel" ];
+  };
+
+  ##############################################################################
+  ##############################################################################
+  ##############################################################################
+  # Services
+
+  hardware.coral.pcie.enable = true;
+
+  services.apcupsd = {
+    enable = true;
+    configText = ''
+      UPSTYPE usb
+      NISIP 0.0.0.0
+      BATTERYLEVEL 5
+      MINUTES 3
+    '';
+  };
+
+  # TODO: Put scripts into version control
+  services.cron = {
+    enable = true;
+    mailto = "";
+    systemCronJobs = [
+
+      # Sync Restic from Archive to MyBook daily at 0600
+      "0 6 * * *  root  /home/lauren_lagarde/bin/SyncRestic > /dev/null"
+
+      # Copy footage from Frigate to MyBook and clear up space on both every 10 minutes
+      "*/10 * * * *  root  /home/lauren_lagarde/bin/MaintainFrigate > /dev/null"
+
+      # Grab a still photo from all cameras once per minute
+      "* * * * *  root  /home/lauren_lagarde/bin/GetAllCameraImages > /dev/null"
+
+      # TODO: Automatically Collate Camera Images Monthly
+    ];
+  };
+}

systems/bastion/bastion-in-training.nix

@@ -0,0 +1,43 @@
+{ ... }: {
+  networking.hostName = "bastion-in-training";
+  networking.hostId = "c3e44236";
+
+  imports = [
+    ./bastion_base.nix
+  ];
+
+  boot.zfs.devNodes = "/dev/vda2";
+  boot.initrd.availableKernelModules = [ "ahci" "xhci_pci" "virtio_pci" "sr_mod" "virtio_blk" ];
+
+  boot.loader.grub.mirroredBoots = [
+    {
+      devices = [ "nodev" ];
+      path = "/boot0";
+    }
+    {
+      devices = [ "nodev" ];
+      path = "/boot1";
+    }
+  ];
+
+  fileSystems = {
+    "/boot0" = {
+      device = "/dev/vda1";
+      fsType = "vfat";
+      options = [ "nofail" ];
+    };
+    "/boot1" = {
+      device = "/dev/vdb1";
+      fsType = "vfat";
+      options = [ "nofail" ];
+    };
+  };
+
+  systemd.network.networks = {
+    "30-enp1s0" = {
+      matchConfig.Name = "enp1s0";
+      networkConfig.Bridge = "br0";
+      linkConfig.RequiredForOnline = "enslaved";
+    };
+  };
+}

systems/bastion/bastion_base.nix

@@ -0,0 +1,127 @@
+{ pkgs, ... }: {
+  imports = [
+    # Base Config
+    ../../features/base.nix
+    ../../features/headless.nix
+
+    # Features
+    ../../features/br0.nix
+    ../../features/dockge.nix
+    ../../features/docker.nix
+    ../../features/libvirt.nix
+
+    # Tweaks
+    ../../tweaks/zfs.nix
+    ../../tweaks/zram.nix
+    ../../tweaks/disable_firewall.nix
+    ../../tweaks/systemd-resolved_nonsense.nix
+
+    # Dotspace
+    ../../secrets/dotspace.nix
+
+    # Users
+    ../../users/lauren_lagarde/lauren_lagarde.nix
+    ../../users/ashley_funkhouser/ashley_funkhouser.nix
+  ];
+
+  ##############################################################################
+  ##############################################################################
+  ##############################################################################
+  # Bootloader / Kernel
+
+  boot.loader.efi.canTouchEfiVariables = true;
+  boot.loader.grub = {
+    enable = true;
+    zfsSupport = true;
+    efiSupport = true;
+  };
+
+  ##############################################################################
+  ##############################################################################
+  ##############################################################################
+  # Local Filesystems
+
+  fileSystems = {
+    "/" = {
+      device = "bastion-root/root";
+      fsType = "zfs";
+    };
+  };
+
+  ##############################################################################
+  ##############################################################################
+  ##############################################################################
+  # Services
+
+  services.cron = {
+    enable = true;
+    mailto = "";
+    systemCronJobs = [
+      "* * * * *	lauren_lagarde		/home/lauren_lagarde/bin/PublishStats > /dev/null"
+    ];
+  };
+
+  services.samba = {
+    enable = true;
+    openFirewall = true;
+    settings = {
+      Frigate = {
+        path = "/exports/Frigate";
+        comment = "NVR Local Storage";
+        writable = "yes";
+        browseable = "yes";
+
+        "force user" = "nobody";
+        "force group" = "users";
+
+        "create mask" = "775";
+        "force create mode" = "775";
+        "security mask" = "775";
+        "force security mode" = "775";
+
+        "directory mask" = "2775";
+        "force directory mode" = "2775";
+        "directory security mask" = "2775";
+        "force directory security mode" = "2775";
+      };
+
+      MyBook = {
+        path = "/exports/MyBook";
+        comment = "External Storage";
+        writable = "yes";
+        browseable = "yes";
+
+        "force user" = "nobody";
+        "force group" = "users";
+
+        "create mask" = "775";
+        "force create mode" = "775";
+        "security mask" = "775";
+        "force security mode" = "775";
+
+        "directory mask" = "2775";
+        "force directory mode" = "2775";
+        "directory security mask" = "2775";
+        "force directory security mode" = "2775";
+      };
+    };
+  };
+
+  ##############################################################################
+  ##############################################################################
+  ##############################################################################
+  # System Users
+
+  users.users = {
+    bastion = {
+      isNormalUser = true;
+      extraGroups = [ "wheel" ];
+      initialHashedPassword = "$y$j9T$WThHVbTQdHbv4mI0m4EjK/$LA.4Uf95jD/rJpLVf0kbfH0wFBj4FHCimV6xiDfLOD/";
+    };
+    dotspace = {
+      isNormalUser = true;
+      shell = pkgs.shadow;
+      initialHashedPassword = "$y$j9T$cH1b/0aafCTaHyWigarb70$bS6WFrbYV4xUZwVtqDCepydOhEol1DqmokBfkGmvRcA";
+    };
+  };
+}