diff options
Diffstat (limited to '')
| -rw-r--r-- | hosts/arrakis/default.nix | 302 | ||||
| -rw-r--r-- | hosts/arrakis/hardware-configuration.nix | 45 | ||||
| -rw-r--r-- | hosts/arrakis/services.nix | 118 |
3 files changed, 291 insertions, 174 deletions
diff --git a/hosts/arrakis/default.nix b/hosts/arrakis/default.nix index d4cb7f3..deaf2d5 100644 --- a/hosts/arrakis/default.nix +++ b/hosts/arrakis/default.nix @@ -2,10 +2,12 @@ boot = { initrd.kernelModules = [ "zfs" ]; kernel.sysctl = { + "kernel.hostname" = "arrakis.bitgnome.net"; "net.ipv4.ip_forward" = 1; - "net.ipv4.conf.all.proxy_arp" = 1; + "net.netfilter.nf_log_all_netns" = 1; + #"net.ipv4.conf.all.proxy_arp" = 1; }; - kernelPackages = pkgs.linuxPackages_6_12; + kernelPackages = pkgs.master.linuxPackages_7_2; loader = { efi = { canTouchEfiVariables = true; @@ -16,119 +18,126 @@ extraInstallCommands = '' ${pkgs.rsync}/bin/rsync -av --delete /efiboot/efi1/ /efiboot/efi2 ''; + memtest86.enable = true; }; timeout = 3; }; supportedFilesystems = [ "zfs" ]; - #zfs.package = pkgs.master.zfs; + zfs = { + forceImportRoot = false; + package = pkgs.master.zfs_2_4; + }; + }; + + environment.etc = { + "netns/vpn/resolv.conf".text = '' + nameserver 10.64.0.1 + options edns0 + ''; + + "nftables-vpn.conf".text = '' + # VPN firewall + + flush ruleset + + table inet filter { + chain input { + type filter hook input priority filter; policy drop; + + # established/related connections + ct state established,related accept + + # invalid connections + ct state invalid drop + + # loopback interface + iif lo accept + + # ICMP (routers may also want: mld-listener-query, nd-router-solicit) + #ip6 nexthdr icmpv6 icmpv6 type { destination-unreachable, echo-reply, echo-request, nd-neighbor-advert, nd-neighbor-solicit, nd-router-advert, packet-too-big, parameter-problem, time-exceeded } accept + ip protocol icmp icmp type { destination-unreachable, echo-reply, echo-request, parameter-problem, router-advertisement, source-quench, time-exceeded } accept + + # services + iifname veth.vpn tcp dport 8080 accept # qBittorrent + iifname veth.vpn tcp dport 9696 accept # Prowlarr + iifname wg1 tcp dport { 49152-65535 } accept # Transmission + + # drop everything else + counter drop + } + + chain output { + type filter hook output priority filter; policy drop; + counter accept + } + + chain forward { + type filter hook forward priority filter; policy drop; + } + } + ''; }; - environment.etc."nftables-vpn.conf".text = '' - # VPN firewall - - flush ruleset - - table inet filter { - chain input { - type filter hook input priority filter; policy drop; - - # established/related connections - ct state established,related accept - - # invalid connections - ct state invalid drop - - # loopback interface - iif lo accept - - # ICMP (routers may also want: mld-listener-query, nd-router-solicit) - #ip6 nexthdr icmpv6 icmpv6 type { destination-unreachable, echo-reply, echo-request, nd-neighbor-advert, nd-neighbor-solicit, nd-router-advert, packet-too-big, parameter-problem, time-exceeded } accept - ip protocol icmp icmp type { destination-unreachable, echo-reply, echo-request, parameter-problem, router-advertisement, source-quench, time-exceeded } accept - - # services - iif veth.vpn tcp dport 8080 accept # qBittorrent - iif veth.vpn tcp dport 9696 accept # Prowlarr - iifname wg1 tcp dport { 49152-65535 } accept # Transmission - } - - chain output { - type filter hook output priority filter; policy drop; - - # explicitly allow my DNS traffic without VPN - skuid nipsy ip daddr 192.168.1.1 tcp dport domain accept - skuid nipsy ip daddr 192.168.1.1 udp dport domain accept - - # explicitly allow my traffic without VPN - oifname veth.vpn skuid nipsy tcp sport 8080 accept # qBittorrent - oifname veth.vpn skuid nipsy tcp sport 9696 accept # Prowlarr - oifname veth.vpn skuid nipsy ip daddr 192.168.1.2 tcp dport { 7878, 8686, 8787, 8989 } accept # Prowlarr to { Radarr, Lidarr, Readarr, Sonarr } - - # allow any traffic out through VPN - oifname wg1 accept - - # drop everything else - counter drop - } - - chain forward { - type filter hook forward priority filter; policy drop; - } - } - ''; + environment.sessionVariables = { LIBVA_DRIVER_NAME = "iHD"; }; - environment.systemPackages = with pkgs; [ - angband - assaultcube - bsdgames - bzflag - extremetuxracer - #frozen-bubble - hedgewars - kobodeluxe - lidarr - mailutils - megacmd - moc - nethack - openttd - pixcat - prowlarr - qbittorrent-nox - radarr - rdiff-backup - readarr - #scorched3d - signal-desktop - sonarr - superTux - superTuxKart - umoria - warzone2100 - wpa_supplicant - xonotic-sdl - xpilot-ng + environment.systemPackages = [ + #pkgs.bitcoind + pkgs.firefox + pkgs.igir + pkgs.igsc + pkgs.intel-gpu-tools + pkgs.lftp + pkgs.lidarr + pkgs.mailutils + pkgs.megacmd + pkgs.prowlarr + pkgs.qbittorrent-nox + pkgs.radarr + pkgs.rdiff-backup + pkgs.readarr + pkgs.sonarr + pkgs.wineWow64Packages.stagingFull + pkgs.wpa_supplicant + pkgs.xdg-user-dirs ]; + hardware = { + #bluetooth.enable = true; + + graphics = { + enable = true; + extraPackages = [ + pkgs.intel-compute-runtime + pkgs.intel-media-driver + pkgs.intel-ocl + pkgs.vpl-gpu-rt + ]; + #extraPackages32 = [ pkgs.pkgsi686Linux.nvidia-vaapi-driver ]; + }; + }; + imports = [ ./disks.nix ./hardware-configuration.nix ./services.nix ../common/core - ../common/optional/adb.nix - ../common/optional/db.nix + #../common/optional/db.nix ../common/optional/dev.nix - ../common/optional/ebooks.nix + #../common/optional/ebooks.nix ../common/optional/games.nix ../common/optional/google-authenticator.nix ../common/optional/misc.nix ../common/optional/multimedia.nix - ../common/optional/pipewire.nix - ../common/optional/sdr.nix + #../common/optional/pipewire.nix + #../common/optional/sdr.nix ../common/optional/services/chrony.nix + ../common/optional/services/fwupd.nix ../common/optional/services/openssh.nix - ../common/optional/services/xorg.nix - ../common/optional/sound.nix + #../common/optional/services/xorg.nix + #../common/optional/sound.nix + ../common/optional/wdt.nix ../common/optional/zfs.nix + ../common/users/lin ../common/users/nipsy ../common/users/root ]; @@ -136,13 +145,12 @@ networking = { defaultGateway = { address = "192.168.1.1"; - interface = "wlp5s0"; + interface = "enp6s0"; }; - domain = "bitgnome.net"; hostId = "2ae4c89f"; hostName = "arrakis"; interfaces = { - wlp5s0 = { + enp6s0 = { ipv4.addresses = [ { address = "192.168.1.2"; prefixLength = 24; } ]; @@ -150,6 +158,9 @@ }; nameservers = [ "192.168.1.1" ]; nftables.enable = true; + search = [ + "bitgnome.net" + ]; useDHCP = false; wg-quick.interfaces = { wg0 = { @@ -193,6 +204,11 @@ presharedKeyFile = "${config.sops.secrets."wireguard/timetrad_psk".path}"; publicKey = "/lWCEMGRIr3Gl/3GQYuweAKylhH5H2KqamiXeocYFVM="; } + { # fangorn + allowedIPs = [ "10.4.20.9/32" ]; + presharedKeyFile = "${config.sops.secrets."wireguard/fangorn_psk".path}"; + publicKey = "G4oahOfaCR+ecXLGM2ilPYzqX6x8v/6z8VIo2vP2RC4="; + } { # ginaz allowedIPs = [ "10.4.20.254/32" ]; presharedKeyFile = "${config.sops.secrets."wireguard/ginaz_psk".path}"; @@ -216,35 +232,64 @@ nixpkgs = { config = { allowUnfree = true; - permittedInsecurePackages = [ - "aspnetcore-runtime-6.0.36" - "aspnetcore-runtime-wrapped-6.0.36" - "dotnet-sdk-6.0.428" - "dotnet-sdk-wrapped-6.0.428" - ]; }; hostPlatform = "x86_64-linux"; overlays = [ - inputs.nvidia-patch.overlays.default + #inputs.nvidia-patch.overlays.default outputs.overlays.additions - outputs.overlays.modifications + #outputs.overlays.kerneol-packages outputs.overlays.master-packages + outputs.overlays.modifications + #outputs.overlays.pr545346-packages outputs.overlays.stable-packages + #outputs.overlays.wine9_22-packages ]; }; - services.openssh.settings.X11Forwarding = true; - services.xserver.videoDrivers = [ "nvidia" ]; + programs = { + nix-ld = { + enable = true; + libraries = [ + pkgs.alsa-lib + pkgs.at-spi2-core + pkgs.cairo + pkgs.cups + pkgs.dbus + pkgs.fontconfig + pkgs.freetype + pkgs.glib + pkgs.libgbm + pkgs.libx11 + pkgs.libxcb + pkgs.libxext + pkgs.libxfixes + pkgs.libxkbcommon + pkgs.libxrandr + pkgs.nspr + pkgs.nss + pkgs.pango + pkgs.vulkan-loader + pkgs.libxcomposite + pkgs.libxdamage + ]; + }; + }; sops = { age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ]; defaultSopsFile = ../secrets/arrakis.yaml; secrets = { + "htpasswd" = { + owner = config.users.users.nginx.name; + group = config.users.users.nginx.group; + }; "nftables/ssh" = {}; "nix-access-token-github" = {}; + "ssh_config".path = "/root/.ssh/config"; "wireguard/arrakis_key" = {}; "wireguard/black-sheep_psk" = {}; + "wireguard/fangorn_psk" = {}; "wireguard/ginaz_psk" = {}; "wireguard/homer_psk" = {}; "wireguard/lilnasx_psk" = {}; @@ -266,6 +311,7 @@ system.stateVersion = "23.11"; systemd.services = { + jellyfin.environment.LIBVA_DRIVER_NAME = "iHD"; "lidarr" = { after = [ "network.target" ]; @@ -287,26 +333,41 @@ after = [ "zfs-import-data.service" ]; description = "Bind NFS exports to ZFS paths"; script = '' - ${pkgs.util-linux}/bin/mount /srv/nfs/keepers - ${pkgs.util-linux}/bin/mount /srv/nfs/movies - ${pkgs.util-linux}/bin/mount /srv/nfs/tv + ${pkgs.util-linux}/bin/mount --onlyonce /srv/caladan/audio || ${pkgs.coreutils}/bin/true + ${pkgs.util-linux}/bin/mount --onlyonce /srv/caladan/downloads || ${pkgs.coreutils}/bin/true + ${pkgs.util-linux}/bin/mount --onlyonce /srv/caladan/www || ${pkgs.coreutils}/bin/true + ${pkgs.util-linux}/bin/mount --onlyonce /srv/nfs/keepers || ${pkgs.coreutils}/bin/true + ${pkgs.util-linux}/bin/mount --onlyonce /srv/nfs/movies || ${pkgs.coreutils}/bin/true + ${pkgs.util-linux}/bin/mount --onlyonce /srv/nfs/tv || ${pkgs.coreutils}/bin/true ''; wantedBy = [ "local-fs.target" ]; }; "nftables-extra" = let rules_script = '' - ${pkgs.nftables}/bin/nft insert rule inet nixos-fw input 'iifname "wlp5s0" tcp dport { http, https } counter accept # 80, 443' - ${pkgs.nftables}/bin/nft insert rule inet nixos-fw input 'iifname "wlp5s0" udp dport { netbios-ns, netbios-dgm } counter accept # 137, 138' - ${pkgs.nftables}/bin/nft insert rule inet nixos-fw input 'iifname "wlp5s0" tcp dport { netbios-ssn, microsoft-ds } counter accept # 139, 445' - ${pkgs.nftables}/bin/nft insert rule inet nixos-fw input 'iifname "wlp5s0" tcp dport 2049 counter accept' - ${pkgs.nftables}/bin/nft insert rule inet nixos-fw input 'iifname "wlp5s0" udp dport { 2456, 2457 } counter accept # Valheim dedicated server' - ${pkgs.nftables}/bin/nft insert rule inet nixos-fw input 'iifname "wlp5s0" udp dport 5121 counter accept # Neverwinter Nights Server' + ${pkgs.nftables}/bin/nft create chain inet nixos-fw games || ${pkgs.nftables}/bin/nft flush chain inet nixos-fw games + ${pkgs.nftables}/bin/nft add rule inet nixos-fw games 'ip saddr 192.168.1.0/24 counter accept' + ${pkgs.nftables}/bin/nft add rule inet nixos-fw games 'ip saddr { 47.136.0.0-47.181.255.255 } counter accept # Andrew' + ${pkgs.nftables}/bin/nft add rule inet nixos-fw games 'ip saddr { 70.109.192.0/18, 70.110.0.0/15 } counter accept # Kyle' + ${pkgs.nftables}/bin/nft add rule inet nixos-fw games 'ip saddr { 70.251.128.0/17, 70.252.0.0/14 } counter accept # Trent' + ${pkgs.nftables}/bin/nft add rule inet nixos-fw games 'ip saddr { 99.10.64.0/18, 99.11.0.0/16, 99.12.0.0/14, 99.75.128.0/18, 99.16.0.0/12, 99.72.0.0/15, 99.64.0.0/13, 99.75.0.0/17, 99.74.0.0/16, 99.10.128.0/17, 99.32.0.0/11 } counter accept # Jimmy' + ${pkgs.nftables}/bin/nft add rule inet nixos-fw games 'ip saddr 108.192.0.0/10 counter accept # Court' + ${pkgs.nftables}/bin/nft add rule inet nixos-fw games 'ip saddr 136.32.0.0/11 counter accept # Jimmys friend James' + ${pkgs.nftables}/bin/nft add rule inet nixos-fw games 'counter drop' + ${pkgs.nftables}/bin/nft insert rule inet nixos-fw input 'iifname "enp6s0" tcp dport { http, https } counter accept # 80, 443' + ${pkgs.nftables}/bin/nft insert rule inet nixos-fw input 'iifname "enp6s0" udp dport { netbios-ns, netbios-dgm } counter accept # 137, 138' + ${pkgs.nftables}/bin/nft insert rule inet nixos-fw input 'iifname "enp6s0" tcp dport { netbios-ssn, microsoft-ds } counter accept # 139, 445' + ${pkgs.nftables}/bin/nft insert rule inet nixos-fw input 'iifname "enp6s0" tcp dport nfs counter accept # 2049' + ${pkgs.nftables}/bin/nft insert rule inet nixos-fw input 'iifname "enp6s0" udp dport { 2456, 2457 } jump games # Valheim dedicated server' + ${pkgs.nftables}/bin/nft insert rule inet nixos-fw input 'iifname "enp6s0" udp dport 5121 jump games # Neverwinter Nights dedicated server' + ${pkgs.nftables}/bin/nft insert rule inet nixos-fw input 'iifname "enp6s0" udp dport 7777 jump games # Abiotic Factor / Satisfactory dedicated server' + ${pkgs.nftables}/bin/nft insert rule inet nixos-fw input 'iifname "enp6s0" tcp dport { 7777, 8888 } jump games # Satisfactory dedicated server' ${pkgs.nftables}/bin/nft insert rule inet nixos-fw input 'iifname "veth.host" tcp dport { 7878, 8080, 8686, 8787, 8989 } counter accept # Radarr, Sabnzb, Lidarr, Sonarr, Readarr' - ${pkgs.nftables}/bin/nft insert rule inet nixos-fw input 'iifname "wlp5s0" tcp dport { 7878, 8080, 8686, 8787, 8989 } counter accept # Radarr, Sabnzb, Lidarr, Sonarr, Readarr' - ${pkgs.nftables}/bin/nft insert rule inet nixos-fw input 'iifname "wlp5s0" udp dport 15637 counter accept # Enshrouded' - ${pkgs.nftables}/bin/nft insert rule inet nixos-fw input 'iifname "wlp5s0" ip saddr 192.168.1.0/24 udp dport { 27031, 27036 } counter accept # Steam Remote Play' - ${pkgs.nftables}/bin/nft insert rule inet nixos-fw input 'iifname "wlp5s0" ip saddr 192.168.1.0/24 tcp dport { 27036, 27037 } counter accept # Steam Remote Play' - ${pkgs.nftables}/bin/nft insert rule inet nixos-fw input 'iifname "wlp5s0" udp dport 51820 counter accept # WireGuard' + ${pkgs.nftables}/bin/nft insert rule inet nixos-fw input 'iifname "enp6s0" tcp dport { 7878, 8080, 8686, 8787, 8989 } counter accept # Radarr, Sabnzb, Lidarr, Sonarr, Readarr' + ${pkgs.nftables}/bin/nft insert rule inet nixos-fw input 'iifname "enp6s0" udp dport 8211 jump games # Palworld dedicated server' + ${pkgs.nftables}/bin/nft insert rule inet nixos-fw input 'iifname "enp6s0" udp dport 9876-9878 jump games # V Rising dedicated server' + ${pkgs.nftables}/bin/nft insert rule inet nixos-fw input 'iifname "enp6s0" udp dport 15637 jump games # Enshrouded dedicated server' + ${pkgs.nftables}/bin/nft insert rule inet nixos-fw input 'iifname "enp6s0" udp dport 27015 jump games # Abiotic Factor dedicated server' + ${pkgs.nftables}/bin/nft insert rule inet nixos-fw input 'iifname "enp6s0" udp dport 51820 counter accept # WireGuard' ${pkgs.nftables}/bin/nft -f ${config.sops.secrets."nftables/ssh".path} ''; in { description = "nftables extra firewall rules"; @@ -421,7 +482,6 @@ }; wantedBy = [ "multi-user.target" ]; }; - }; systemd.paths."nftables-extra" = { diff --git a/hosts/arrakis/hardware-configuration.nix b/hosts/arrakis/hardware-configuration.nix index 3c508e5..59a787f 100644 --- a/hosts/arrakis/hardware-configuration.nix +++ b/hosts/arrakis/hardware-configuration.nix @@ -5,7 +5,7 @@ { imports = - [ #(modulesPath + "/installer/scan/not-detected.nix") + [ (modulesPath + "/installer/scan/not-detected.nix") ]; boot = { @@ -16,9 +16,31 @@ zfs.extraPools = [ "data" ]; }; - environment.sessionVariables = { - LIBVA_DRIVER_NAME = "nvidia"; - MOZ_DISABLE_RDD_SANDBOX = "1"; + fileSystems."/srv/caladan/audio" = { + device = "/data/home/nipsy/audio"; + fsType = "none"; + options = [ + "bind" + "noauto" + ]; + }; + + fileSystems."/srv/caladan/downloads" = { + device = "/data/home/nipsy/downloads"; + fsType = "none"; + options = [ + "bind" + "noauto" + ]; + }; + + fileSystems."/srv/caladan/www" = { + device = "/data/home/nipsy/www"; + fsType = "none"; + options = [ + "bind" + "noauto" + ]; }; fileSystems."/srv/nfs/keepers" = { @@ -47,19 +69,4 @@ "noauto" ]; }; - - hardware = { - bluetooth.enable = true; - graphics = { - enable = true; - extraPackages = with pkgs; [ nvidia-vaapi-driver ]; - extraPackages32 = with pkgs.pkgsi686Linux; [ nvidia-vaapi-driver ]; - }; - nvidia = { - modesetting.enable = true; - open = true; - package = pkgs.nvidia-patch.patch-nvenc (pkgs.nvidia-patch.patch-fbc config.boot.kernelPackages.nvidiaPackages.beta); - #package = config.boot.kernelPackages.nvidiaPackages.beta; - }; - }; } diff --git a/hosts/arrakis/services.nix b/hosts/arrakis/services.nix index ceb60c4..a3b733d 100644 --- a/hosts/arrakis/services.nix +++ b/hosts/arrakis/services.nix @@ -5,7 +5,7 @@ directory = * ''; - networking.firewall.allowedTCPPorts = [ 2049 ]; + networking.firewall.allowedTCPPorts = [ 2049 8333 ]; security.acme = { acceptTerms = true; @@ -19,15 +19,10 @@ services = { - avahi = { - enable = true; - nssmdns4 = true; - openFirewall = true; - }; - cgit = { "arrakis.bitgnome.net" = { enable = true; + gitHttpBackend.checkExportOkFiles = false; nginx.location = "/nipsy/git/"; scanPath = "/home/nipsy/www/git"; settings = { @@ -58,7 +53,7 @@ cron.enable = true; - #dictd.enable = true; + dictd.enable = true; iperf3.openFirewall = true; @@ -67,11 +62,27 @@ #package = pkgs.master.jellyfin; }; + minidlna = { + enable = true; + openFirewall = true; + settings = { + inotify = "yes"; + media_dir = [ + "A,/data/home/nipsy/www/media/music" + ]; + }; + }; + nfs = { server = { enable = true; exports = '' - /srv/nfs 192.168.1.0/24(ro,all_squash,insecure,crossmnt,subtree_check,fsid=0) + /srv/caladan/audio 192.168.1.4/32(rw,root_squash,fsid=1) + /srv/caladan/downloads 192.168.1.4/32(rw,root_squash,fsid=2) + /srv/caladan/www 192.168.1.4/32(rw,root_squash,fsid=3) + /srv/nfs/keepers 192.168.1.0/24(ro,all_squash,insecure,fsid=4) + /srv/nfs/movies 192.168.1.0/24(ro,all_squash,insecure,fsid=5) + /srv/nfs/tv 192.168.1.0/24(ro,all_squash,insecure,fsid=6) ''; }; settings = { @@ -87,8 +98,6 @@ nginx = let sys = lib.nixosSystem { - system = "x86_64-linux"; - modules = [ ({ config, pkgs, lib, modulesPath, ... }: { imports = [ @@ -97,9 +106,10 @@ ]; config = { - environment.systemPackages = with pkgs; [ - git - rsync + environment.systemPackages = [ + pkgs.git + pkgs.iperf + pkgs.rsync ]; nix.settings.experimental-features = [ "nix-command" "flakes" ]; @@ -109,8 +119,8 @@ openFirewall = true; settings = { - PasswordAuthentication = false; KbdInteractiveAuthentication = false; + PasswordAuthentication = false; }; }; @@ -120,6 +130,7 @@ }; }; }) + { nixpkgs.hostPlatform = "x86_64-linux"; } ]; }; @@ -217,10 +228,33 @@ }; "/nipsy" = { + tryFiles = "$uri $uri/ =404"; + }; + + "/nipsy/iso" = { + extraConfig = '' + autoindex on; + ''; + }; + + "/nipsy/media/ebooks" = { + basicAuthFile = "${config.sops.secrets.htpasswd.path}"; + extraConfig = '' + autoindex on; + ''; + }; + + "/nipsy/media/emu/mame" = { + basicAuthFile = "${config.sops.secrets.htpasswd.path}"; + extraConfig = '' + autoindex on; + ''; + }; + + "/nipsy/media/misc" = { extraConfig = '' autoindex on; ''; - tryFiles = "$uri $uri/ =404"; }; }; @@ -229,26 +263,36 @@ }; }; + openssh.settings = { + StreamLocalBindUnlink = true; + }; + postfix = let my_email = "nipsy@bitgnome.net"; in { enable = true; extraAliases = '' nipsy: ${my_email} ''; - hostname = "${config.networking.hostName}.${config.networking.domain}"; - relayHost = "mail.bitgnome.net"; - relayPort = 587; rootAlias = my_email; - sslCert = "/var/lib/acme/arrakis.bitgnome.net/fullchain.pem"; - sslKey = "/var/lib/acme/arrakis.bitgnome.net/key.pem"; + settings.main = { + myhostname = "arrakis.bitgnome.net"; + relayhost = [ + "[mail.bitgnome.net]:587" + ]; + smtpd_tls_chain_files = [ + "/var/lib/acme/arrakis.bitgnome.net/key.pem" + "/var/lib/acme/arrakis.bitgnome.net/fullchain.pem" + ]; + }; }; printing.enable = true; sabnzbd = { + configFile = "/home/nipsy/.sabnzbd/sabnzbd.ini"; enable = true; - user = "nipsy"; group = "nipsy"; - configFile = "/home/nipsy/.sabnzbd/sabnzbd.ini"; + package = pkgs.sabnzbd; + user = "nipsy"; }; samba = { @@ -291,41 +335,47 @@ device = "/dev/disk/by-id/nvme-WD_BLACK_SN850X_4000GB_23162P800014"; options = "-a -o on -S on -m ${my_email_addr}"; } - #{ - # device = "/dev/disk/by-id/ata-WDC_WD80EFAX-68KNBN0_VAHUEZNL"; - # options = "-a -o on -S on -s (S/../.././02|L/../../5/03) -m ${my_email_addr}"; - #} { - device = "/dev/disk/by-id/ata-WDC_WD80EFAX-68KNBN0_VAHUUSXL"; + device = "/dev/disk/by-id/ata-WDC_WUH722020ALE604_2LG5X74K"; options = "-a -o on -S on -s (S/../.././02|L/../../5/03) -m ${my_email_addr}"; } { - device = "/dev/disk/by-id/ata-WDC_WD80EFAX-68KNBN0_VAHV0H5L"; + device = "/dev/disk/by-id/ata-WDC_WUH722020ALE604_2LGHJAUF"; options = "-a -o on -S on -s (S/../.././02|L/../../5/03) -m ${my_email_addr}"; } { - device = "/dev/disk/by-id/ata-WDC_WD80EFAX-68KNBN0_VAHUK5EL"; + device = "/dev/disk/by-id/ata-WDC_WUH722020ALE604_2LG26NHF"; options = "-a -o on -S on -s (S/../.././02|L/../../5/03) -m ${my_email_addr}"; } { - device = "/dev/disk/by-id/ata-WDC_WD80EFAX-68KNBN0_VAHV5JEL"; + device = "/dev/disk/by-id/ata-WDC_WUH722020BLE6L4_8LKLLAAE"; options = "-a -o on -S on -s (S/../.././02|L/../../5/03) -m ${my_email_addr}"; } { - device = "/dev/disk/by-id/ata-WDC_WD80EFAX-68KNBN0_VAHUZ42L"; + device = "/dev/disk/by-id/ata-WDC_WUH722020BLE6L4_8LK84H9V"; options = "-a -o on -S on -s (S/../.././02|L/../../5/03) -m ${my_email_addr}"; } { - device = "/dev/disk/by-id/ata-WDC_WD80EFAX-68KNBN0_VAHV3BSL"; + device = "/dev/disk/by-id/ata-WDC_WUH722020BLE6L4_2LGKG71F"; options = "-a -o on -S on -s (S/../.././02|L/../../5/03) -m ${my_email_addr}"; } { - device = "/dev/disk/by-id/ata-WDC_WD80EFAX-68KNBN0_VAHV338L"; + device = "/dev/disk/by-id/ata-WDC_WUH722020BLE6L4_9AG00UKJ"; + options = "-a -o on -S on -s (S/../.././02|L/../../5/03) -m ${my_email_addr}"; + } + { + device = "/dev/disk/by-id/ata-WDC_WUH722020BLE6L4_8LG806ZA"; options = "-a -o on -S on -s (S/../.././02|L/../../5/03) -m ${my_email_addr}"; } ]; }; + udev.packages = [ + pkgs.vial + ]; + + #xserver.videoDrivers = [ "nvidia" ]; + }; #systemd.services.nginx.serviceConfig.ProtectHome = lib.mkForce false; |