Aner Zakobar
228 lines
9.2 KiB
Nix
228 lines
9.2 KiB
Nix
{ config, lib, pkgs, homeyConfig, ... }:
|
|
|
|
# Pi-main host configuration.
|
|
# This file declares which services run on this machine and any
|
|
# host-specific overrides. Hardware config lives in hardware.nix.
|
|
|
|
{
|
|
imports = [
|
|
./hardware.nix
|
|
];
|
|
|
|
# linux_rpi4 is the Raspberry Pi Foundation's kernel, sourced from nixpkgs
|
|
# and pre-built in cache.nixos.org. Avoids a multi-hour native compilation.
|
|
boot.kernelPackages = pkgs.linuxKernel.packages.linux_rpi4;
|
|
|
|
# -------------------------------------------------------------------------
|
|
# Identity
|
|
# -------------------------------------------------------------------------
|
|
networking.hostName = "pi-main";
|
|
|
|
# -------------------------------------------------------------------------
|
|
# WiFi — static IP, always connect to home network
|
|
# -------------------------------------------------------------------------
|
|
networking.wireless = {
|
|
enable = true;
|
|
# secretsFile is read by wpa_supplicant at runtime; values are literal
|
|
# (not env vars). The key name after "ext:" must match a line in the file
|
|
# formatted as: key_name=the-actual-password
|
|
secretsFile = config.sops.secrets."wifi/psk".path;
|
|
networks."Zakobar".pskRaw = "ext:wifi_psk";
|
|
};
|
|
|
|
# Static IP on wlan0
|
|
networking.interfaces.wlan0.ipv4.addresses = [{
|
|
address = "192.168.1.100";
|
|
prefixLength = 24;
|
|
}];
|
|
networking.defaultGateway = "192.168.1.1";
|
|
networking.nameservers = [ "1.1.1.1" "8.8.8.8" ];
|
|
|
|
# Disable DHCP on wlan0 — we're using a static address
|
|
networking.useDHCP = false;
|
|
networking.interfaces.wlan0.useDHCP = false;
|
|
|
|
# The secret file must contain exactly one line: wifi_psk=<your-password>
|
|
# Add it with: sops secrets/secrets.yaml → wifi/psk: "wifi_psk=YourPassword"
|
|
sops.secrets."wifi/psk" = { owner = "root"; mode = "0400"; };
|
|
|
|
# -------------------------------------------------------------------------
|
|
# Admin user
|
|
# -------------------------------------------------------------------------
|
|
users.users.admin = {
|
|
isNormalUser = true;
|
|
extraGroups = [ "wheel" "podman" ];
|
|
# Paste your SSH public key here
|
|
openssh.authorizedKeys.keys = [
|
|
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDfzDDO5juINctECmWlsYtGghEiX/RnTJ1cazLvOWSrPfsTyEd+B1+Ig8kFefNryjkpApfRXqj5KtLPNlpLfdVBrOIfhIveEp2MGqhgOGZFNVxQyXnZgii8Zdh4cqZ2O3pZpMsaAQBaJ9nH6dK0dJjicWT5f6TqwrVcInywRc5SuyizoSxoFmg7ch2rnlVi0j5XMVqdh8XLzHXZ7yWCzXy7+hWl/d7pwpyuzoK8dBw2EU9TauhgRDruom5Q9vWJTLStALC9pAIb0v9UFj9y+1zwx7pXsXp5F1g73EYrE4QR+QQ6z2LebuK280W0t+VA/fSCEB13DnkmofgqZQxX5MSCmrxZ5lTFp1FjW6yJo7As9FheF/GECowYkMRIx4IiQsjjHjZqlLRpLas11yAp6tGoZnw59hFo6Lu0Kva39jGVVmioYHtAeE5rD5w+v5kseJR4jlQ8aKB5yOjYUQOIz2AHQyoidgaeR2jPWqZUeRQbACI+/p3CHO45r3hrjATtGloBg0xF95Qws7Be3mjHVhbBLOoob8MdZ8nYAGnhlWrZphlkvXsHC6OUkuDJW00tmMjWXRlFwhFJ+nqUQCgLVjxVHQJ5rq9GeXBUuNXAeCm5BKBsdq+9qqVlt7D9iGyfr0lcZ7peKz/96KwPCWpG2En1Ur0/cVcbWnXEfG/xWO10tQ== cardno:24_758_470"
|
|
];
|
|
};
|
|
|
|
security.sudo.wheelNeedsPassword = false; # convenience on a home server
|
|
|
|
# -------------------------------------------------------------------------
|
|
# External HD
|
|
# -------------------------------------------------------------------------
|
|
homey.storage = {
|
|
# Replace with the actual by-id path of your USB drive.
|
|
# Find it: ls -la /dev/disk/by-id/ | grep -v part
|
|
device = "/dev/disk/by-label/homey-data";
|
|
mountPoint = "/mnt/data";
|
|
fsType = "ext4";
|
|
};
|
|
|
|
# -------------------------------------------------------------------------
|
|
# Services enabled on this host
|
|
# -------------------------------------------------------------------------
|
|
|
|
# Auth stack (run these together — authelia depends on openldap)
|
|
homey.openldap.enable = true;
|
|
homey.authelia.enable = true;
|
|
|
|
# Productivity
|
|
homey.gitea.enable = true;
|
|
homey.nextcloud.enable = true;
|
|
homey.phpldapadmin.enable = true;
|
|
|
|
# Media (enable when ready)
|
|
homey.jellyfin.enable = false;
|
|
homey.transmission.enable = false;
|
|
|
|
# Documents and recipes
|
|
homey.paperless.enable = true;
|
|
homey.mealie.enable = true;
|
|
|
|
# Reverse proxy + Cloudflare
|
|
homey.caddy.enable = true;
|
|
homey.cloudflared.enable = true;
|
|
|
|
# Nix binary cache
|
|
homey.attic.enable = true;
|
|
nix.settings = {
|
|
substituters = lib.mkAfter [ "https://attic.zakobar.com/main" ];
|
|
trusted-public-keys = lib.mkAfter [ "main:9SZt/6plBU7jjQzz90J7O011I13hmJvOMYouxNqExNQ=" ];
|
|
};
|
|
|
|
# CI/CD
|
|
homey.giteaRunner.enable = true;
|
|
|
|
# Eurovision voting app
|
|
homey.eurovote.enable = true;
|
|
|
|
# Monitoring stack
|
|
homey.uptimeKuma.enable = true;
|
|
homey.ntfy.enable = true;
|
|
# Generate with: ssh admin@192.168.1.100 'sudo ntfy webpush keys'
|
|
# Add private key to sops: ntfy/web_push_private_key
|
|
homey.ntfy.webPushPublicKey = "BE2qZVa3JEF741WTPtLevyhfP0I8bV0sD2a9-_y9NoyC40sgLpQi7bcoZesBwZEpRz8oiTVuoUFnHbckAsBQI5U";
|
|
homey.ntfy.webPushEmail = "aner@zakobar.com";
|
|
homey.monitoring.enable = true;
|
|
|
|
# Backups
|
|
homey.backup.enable = true;
|
|
# Where to send restic backups — set to your backup destination:
|
|
# "sftp:user@nas.local:/backups/homey"
|
|
# "b2:your-bucket-name:homey"
|
|
# "rclone:remote:homey"
|
|
homey.backup.repository = "s3:https://s3.us-east-005.backblazeb2.com/zakobar-home-backup";
|
|
|
|
# -------------------------------------------------------------------------
|
|
# Reliability hardening
|
|
# -------------------------------------------------------------------------
|
|
|
|
# Hardware watchdog — auto-reboot if the system hangs (e.g. blocked USB I/O).
|
|
# bcm2835_wdt exposes /dev/watchdog; systemd pets it every runtimeTime/2.
|
|
# If systemd itself stops responding, the hardware resets the Pi after 20s.
|
|
boot.kernelModules = [ "bcm2835_wdt" ];
|
|
systemd.watchdog = {
|
|
runtimeTime = "300s"; # 5 min — generous window for boot I/O storm on USB drive
|
|
rebootTime = "360s";
|
|
};
|
|
|
|
# Disable WiFi power save — the brcmfmac driver on RPi4 lets the chip sleep,
|
|
# causing it to miss packets and drop the connection under low traffic.
|
|
# Run once when the wlan0 interface appears (and on every re-plug/reconnect).
|
|
systemd.services.wifi-disable-power-save = {
|
|
description = "Disable WiFi power management on wlan0";
|
|
wantedBy = [ "multi-user.target" ];
|
|
after = [ "sys-subsystem-net-devices-wlan0.device" ];
|
|
bindsTo = [ "sys-subsystem-net-devices-wlan0.device" ];
|
|
serviceConfig = {
|
|
Type = "oneshot";
|
|
RemainAfterExit = true;
|
|
ExecStart = "${pkgs.iw}/bin/iw dev wlan0 set power_save off";
|
|
};
|
|
};
|
|
|
|
# Network watchdog — if the LAN gateway becomes unreachable, restart
|
|
# wpa_supplicant to force a fresh association. If the link is still
|
|
# dead 30 s later, reboot so the hardware watchdog doesn't have to.
|
|
# Runs every 2 min starting 5 min after boot.
|
|
systemd.services.network-watchdog = {
|
|
description = "Network connectivity watchdog";
|
|
after = [ "network-online.target" ];
|
|
serviceConfig = {
|
|
Type = "oneshot";
|
|
ExecStart = pkgs.writeShellScript "network-watchdog" ''
|
|
gateway="192.168.1.1"
|
|
if ! ${pkgs.iputils}/bin/ping -c 3 -W 10 "$gateway" > /dev/null 2>&1; then
|
|
echo "Gateway $gateway unreachable — restarting wpa_supplicant"
|
|
systemctl restart wpa_supplicant.service
|
|
sleep 30
|
|
if ! ${pkgs.iputils}/bin/ping -c 3 -W 10 "$gateway" > /dev/null 2>&1; then
|
|
echo "Still unreachable after wpa_supplicant restart — rebooting"
|
|
systemctl reboot
|
|
fi
|
|
fi
|
|
'';
|
|
};
|
|
};
|
|
|
|
systemd.timers.network-watchdog = {
|
|
description = "Periodic network connectivity check";
|
|
wantedBy = [ "timers.target" ];
|
|
timerConfig = {
|
|
OnBootSec = "5min";
|
|
OnUnitActiveSec = "2min";
|
|
Persistent = true;
|
|
};
|
|
};
|
|
|
|
# Compressed in-RAM swap via zstd. Pages evicted from RAM are compressed
|
|
# (~3:1 ratio) and stored in a 25% RAM region (~2 GB) rather than written
|
|
# to disk. Gives the OOM killer breathing room under PHP upload spikes.
|
|
# CPU overhead is negligible during normal operation.
|
|
zramSwap = {
|
|
enable = true;
|
|
algorithm = "zstd";
|
|
memoryPercent = 25;
|
|
};
|
|
|
|
# hdparm -B udev rule removed: USB-SATA bridges often don't support APM
|
|
# commands and hdparm can hang indefinitely, causing boot-time crashes.
|
|
environment.systemPackages = [ pkgs.hdparm pkgs.tmux ];
|
|
|
|
systemd.services.nextcloud-generate-previews = {
|
|
description = "Generate missing Nextcloud preview thumbnails";
|
|
after = [ "podman-nextcloud.service" ];
|
|
requires = [ "podman-nextcloud.service" ];
|
|
serviceConfig = {
|
|
Type = "oneshot";
|
|
ExecStart = "${pkgs.podman}/bin/podman exec -u www-data nextcloud php occ preview:generate-all";
|
|
};
|
|
};
|
|
|
|
# -------------------------------------------------------------------------
|
|
# Local DNS overrides (optional — makes LAN clients hit the Pi directly
|
|
# instead of going through Cloudflare for *.zakobar.com)
|
|
# -------------------------------------------------------------------------
|
|
# If you run Pi-hole or Adguard, add these records there instead.
|
|
# networking.extraHosts = ''
|
|
# 192.168.1.100 zakobar.com
|
|
# 192.168.1.100 auth.zakobar.com
|
|
# 192.168.1.100 git.zakobar.com
|
|
# 192.168.1.100 nextcloud.zakobar.com
|
|
# 192.168.1.100 ldapadmin.zakobar.com
|
|
# '';
|
|
}
|