Merge branch 'main' of github.personal:Polensky/nixos

Makefile

@@ -3,7 +3,7 @@ build-pi-image:
 
 # Doest work yet
 rebuild-pi:
-	nixos-rebuild switch --flake .#pi --target-host polen@192.168.1.241 --use-remote-sudo
+	NIX_SSHOPTS="-o IdentitiesOnly=yes -i ~/.ssh/id_rsa" nixos-rebuild switch --flake .#pi --target-host pi --build-host server --use-remote-sudo
 
 deploy-server:
 	nixos-rebuild switch --flake .#server --target-host server --build-host server --use-remote-sudo

devices/pi/configuration.nix

@@ -1,12 +1,16 @@
-{ inputs, config, pkgs, lib, ... }:
-
-let
+{
+  inputs,
+  config,
+  pkgs,
+  lib,
+  ...
+}: let
   user = "polen";
   hostname = "pi";
 in {
   boot = {
     kernelPackages = pkgs.linuxKernel.packages.linux_rpi3;
-    initrd.availableKernelModules = [ "xhci_pci" "usbhid" "usb_storage" ];
+    initrd.availableKernelModules = ["xhci_pci" "usbhid" "usb_storage"];
     loader = {
       grub.enable = false;
       generic-extlinux-compatible.enable = true;
@@ -17,51 +21,59 @@ in {
     "/" = {
       device = "/dev/disk/by-label/NIXOS_SD";
       fsType = "ext4";
-      options = [ "noatime" ];
+      options = ["noatime"];
     };
   };
 
-	#sops.defaultSopsFile = ../../secrets/secrets.yaml;
-	#sops.defaultSopsFormat = "yaml";
-	#sops.age.keyFile = "/home/polen/.config/sops/age/keys.txt";
-	#sops.secrets.pi_user_pass.neededForUsers = true;
+  swapDevices = [
+    {
+      device = "/var/lib/swapfile";
+      size = 10 * 1024;
+    }
+  ];
+
+  #sops.defaultSopsFile = ../../secrets/secrets.yaml;
+  #sops.defaultSopsFormat = "yaml";
+  #sops.age.keyFile = "/home/polen/.config/sops/age/keys.txt";
+  #sops.secrets.pi_user_pass.neededForUsers = true;
 
   networking = {
-		networkmanager.enable = true;
-		wireless.enable = false;
+    networkmanager.enable = true;
+    wireless.enable = false;
     hostName = hostname;
-		firewall.allowedTCPPorts = [ 80 443 ];
+    firewall.allowedTCPPorts = [80 443];
   };
 
-	services.caddy = {
-		enable = true;
-		virtualHosts."mealie.polensky.me".extraConfig = ''
-			reverse_proxy http://localhost:9925
-		'';
-	};
+  services.caddy = {
+    enable = true;
+    virtualHosts."mealie.polensky.me".extraConfig = ''
+      reverse_proxy http://192.168.1.242:9000
+    '';
+  };
 
-	nix.settings.trusted-users = [ user ];
+  services.prometheus.exporters = {
+    node.enable = true;
+    node.openFirewall = true;
+  };
 
-  environment.systemPackages = with pkgs; [ 
-		htop-vim
-		neovim 
-		tmux 
-		curl
-		wget
-		git
-		ranger
-	];
+  nix.settings.trusted-users = [user];
+
+  environment.systemPackages = with pkgs; [
+    htop-vim
+    neovim
+    curl
+    wget
+    ranger
+  ];
 
   services.openssh.enable = true;
 
-	virtualisation.docker.enable = true;
-
   users = {
     mutableUsers = false;
     users."${user}" = {
       isNormalUser = true;
       #hashedPasswordFile = config.sops.secrets.pi_user_pass.path;
-      extraGroups = [ "wheel" "docker" ];
+      extraGroups = ["wheel" "docker"];
     };
   };
 

devices/server/configuration.nix

@@ -17,8 +17,49 @@ in {
   };
   #boot.kernelModules = ["msr"];
 
+  boot.binfmt.emulatedSystems = ["aarch64-linux"];
+
   services.openssh.enable = true;
 
+  # observability
+  services = {
+    grafana = {
+      enable = true;
+      settings = {
+        server = {
+          http_addr = "0.0.0.0";
+          http_port = 3000;
+        };
+      };
+    };
+    prometheus = {
+      enable = true;
+      exporters = {
+        node.enable = true;
+      };
+      scrapeConfigs = [
+        {
+          job_name = "node-exporters-lan";
+          static_configs = [
+            {
+              targets = ["192.168.1.241:9100"];
+              labels = {
+                instance = "pi";
+              };
+            }
+            {
+              targets = ["127.0.0.1:9100"];
+              labels = {
+                instance = "server";
+              };
+            }
+          ];
+        }
+      ];
+    };
+  };
+
+  # media
   services = {
     jellyfin = {
       inherit user;
@@ -34,23 +75,37 @@ in {
     taskchampion-sync-server = {
       inherit user;
       enable = true;
+      host = "0.0.0.0";
+    };
+    mealie = {
+      enable = true;
+      settings = {
+        ALLOW_SIGNUP = "false";
+        PUID = 1000;
+        PGID = 1000;
+        TZ = "Canada/Eastern";
+        MAX_WORKERS = 1;
+        WEB_CONCURRENCY = 1;
+        #BASE_URL = "https://mealie.polensky.me";
+      };
     };
   };
 
   networking = {
     hostName = "server";
     firewall.allowedTCPPorts = [
+      9090 # prometheus
+      3000 # grafana
       8096 # jellyfin
       9091 # transmission
+      9000 # mealie
       10222 # taskchampion-sync-server
     ];
   };
 
   time.timeZone = "America/Toronto";
 
-  users.users.user = {
-    isNormalUser = true;
-    description = user;
+  users.users."${user}" = {
     extraGroups = ["wheel" "transmission" "jellyfin"];
     shell = pkgs.zsh;
     openssh.authorizedKeys.keys = [

devices/xps13/configuration.nix

@@ -29,14 +29,14 @@
   nix = {
     settings.experimental-features = ["nix-command" "flakes"];
     settings.trusted-users = ["polen"];
-    # settings.extra-platforms = config.boot.binfmt.emulatedSystems;
+    settings.extra-platforms = config.boot.binfmt.emulatedSystems;
     gc = {
       automatic = true;
       dates = "weekly";
       options = "--delete-older-than 15d";
     };
   };
-  # boot.binfmt.emulatedSystems = ["aarch64-linux"];
+  boot.binfmt.emulatedSystems = ["aarch64-linux"];
 
   # Configure network proxy if necessary
   # networking.proxy.default = "http://user:password@proxy:port/";