73 lines
1.8 KiB
Nix
73 lines
1.8 KiB
Nix
{ pkgs, ... }:
|
|
|
|
{
|
|
imports = [
|
|
../secrets/machines/back.nix
|
|
../system/baremetal-server.nix
|
|
../system/ucode-intel.nix
|
|
../system/zfs.nix
|
|
];
|
|
|
|
system.stateVersion = "23.11";
|
|
|
|
boot.initrd = {
|
|
availableKernelModules = [ "hpsa" "aesni_intel" "tg3" ];
|
|
luks.devices.nixos-root.device = "/dev/md1";
|
|
};
|
|
|
|
boot.swraid = {
|
|
enable = true;
|
|
mdadmConf = ''
|
|
DEVICE partitions
|
|
ARRAY /dev/md0 level=raid1 num-devices=2 metadata=1.0 name=nixos:0 UUID=8b85ad8d:07770d93:de437327:626744b3
|
|
ARRAY /dev/md1 level=raid1 num-devices=2 metadata=1.2 name=nixos:1 UUID=fa799b6d:76859754:7bf68be4:d184553c
|
|
PROGRAM ${pkgs.toybox}/bin/true
|
|
'';
|
|
};
|
|
|
|
boot.kernelParams = [ "zfs.zfs_arc_max=34359738368" ]; # 32 GiB
|
|
|
|
fileSystems."/" = {
|
|
device = "/dev/mapper/nixos-root";
|
|
fsType = "btrfs";
|
|
options = [ "noatime" "subvol=@" ];
|
|
};
|
|
|
|
fileSystems."/home" = {
|
|
device = "/dev/mapper/nixos-root";
|
|
fsType = "btrfs";
|
|
options = [ "subvol=@home" ];
|
|
};
|
|
|
|
fileSystems."/nix" = {
|
|
device = "/dev/mapper/nixos-root";
|
|
fsType = "btrfs";
|
|
options = [ "noatime" "subvol=@nix" ];
|
|
};
|
|
|
|
fileSystems."/var/log" = {
|
|
device = "/dev/mapper/nixos-root";
|
|
fsType = "btrfs";
|
|
options = [ "noatime" "compress=zstd" "subvol=@log" ];
|
|
};
|
|
|
|
fileSystems."/boot" = {
|
|
device = "/dev/md0";
|
|
fsType = "vfat";
|
|
};
|
|
|
|
users.users.backup = {
|
|
isNormalUser = true;
|
|
uid = 2000;
|
|
createHome = false;
|
|
openssh.authorizedKeys.keys = let
|
|
restrictCmd =
|
|
''command="${pkgs.rrsync}/bin/rrsync -wo -no-del /tank/",restrict'';
|
|
in [
|
|
"${restrictCmd} ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAO9LOBcl04ddGijyDSuUXH47Qt6TZISUDwDr1wrm+Ou tank.c8h4.io"
|
|
];
|
|
};
|
|
|
|
services.openssh.settings.AllowUsers = [ "backup" ];
|
|
}
|