geir/home-lab
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix: resolve sma user definition conflict between modules

Browse source 
- Remove duplicate sma user definition from incus.nix module
- The sma user is properly defined in modules/users/sma.nix with incus-admin group
- This resolves the isNormalUser/isSystemUser assertion failure blocking congenital-optimist rebuild
- Clean up grey-area configuration and modularize services
- Update SSH keys with correct IP addresses for grey-area and reverse-proxy
This commit is contained in:
Geir Okkenhaug Jerstad 2025-06-07 16:58:22 +02:00
parent a35d9ff420
commit fa2b84cf65
20 changed files with 540 additions and 232 deletions
Download patch file Download diff file Expand all files Collapse all files

77
machines/grey-area/configuration.nix
View file

@ -1,21 +1,25 @@
{ config, pkgs, ... }:
{
imports =
[ # Include the results of the hardware scan.
./hardware-configuration.nix
./starship.nix
./aliases.nix
./podman.nix
./libvirt.nix
./incus.nix
./jellyfin.nix
./tailscale.nix
./calibre-web.nix
./audiobook.nix
#./ollama.nix
./forgejo.nix
];
imports = [
# Hardware configuration
./hardware-configuration.nix
# Shared modules
../../modules/common/base.nix
../../modules/network/common.nix
../../modules/virtualization/podman.nix
../../modules/virtualization/libvirt.nix
../../modules/virtualization/incus.nix
../../modules/users/sma.nix
# Services
./services/jellyfin.nix
./services/calibre-web.nix
./services/audiobook.nix
./services/forgejo.nix
#./services/ollama.nix
];
# Swap zram
zramSwap = {
@ -36,7 +40,18 @@
fileSystems."/mnt/remote/media" = {
device = "sleeper-service:/mnt/storage";
fsType = "nfs";
options = [ "x-systemd.automount" ];
options = [
"x-systemd.automount"
"x-systemd.idle-timeout=60"
"x-systemd.device-timeout=10"
"x-systemd.mount-timeout=10"
"noauto"
"soft"
"intr"
"timeo=10"
"retrans=3"
"_netdev"
];
};
# Enable all unfree hardware support.
@ -48,11 +63,21 @@
# Networking
networking.hostName = "grey-area";
networking.networkmanager.enable = true;
networking.networkmanager.enable = true;
# Add hostname resolution for sleeper-service NFS server
networking.extraHosts = ''
10.0.0.8 sleeper-service
'';
# Set your time zone.
time.timeZone = "Europe/Oslo";
# Text mode configuration (headless server)
services.xserver.enable = false;
services.displayManager.defaultSession = "none";
boot.kernelParams = [ "systemd.unit=multi-user.target" ];
systemd.targets.graphical.enable = false;
i18n.defaultLocale = "en_US.UTF-8";
console = {
@ -60,19 +85,6 @@
keyMap = "no";
};
users.users.geir = {
isNormalUser = true;
extraGroups = [ "wheel"
"networkmanager"
"libvirt"
"podman"
"incus-admin"
];
packages = with pkgs; [
bottom fastfetch nerdfetch
];
};
environment.systemPackages = with pkgs; [
neovim emacs nano curl htop glances kitty
wget git inxi nethogs fastfetch
@ -84,12 +96,9 @@
services.openssh.settings.PasswordAuthentication = true;
# Enable Netdata
services.netdata.enable = true;
# Firewall
networking.firewall.enable = true;
networking.firewall.allowedTCPPorts = [ 22 19999 23231];
networking.firewall.allowedTCPPorts = [ 22 23231];
networking.firewall.allowedUDPPorts = [ 22 23231 ];
networking.nftables.enable = true;
system.stateVersion = "23.05"; # Do not change this, it maintains data compatibility.

20
machines/grey-area/nixos/aliases.nix
View file

@ -1,20 +0,0 @@
{ config, pkgs, ... }:
{
environment.systemPackages = with pkgs; [
tldr
eza
bat
ripgrep
];
environment.shellAliases = {
vi = "nvim";
vim = "nvim";
h = "tldr";
# oxidized
ls = "eza -l";
cat = "bat";
grep = "rg";
top = "btm --color gruvbox";
# some tools
};
}

14
machines/grey-area/nixos/incus.nix
View file

@ -1,14 +0,0 @@
{ config, pkgs, ... }:
{
virtualisation.incus = {
enable = true;
ui.enable = true;
package = pkgs.incus;
};
environment.systemPackages = with pkgs; [
incus
lxc
];
networking.firewall.allowedTCPPorts = [ 8443 ];
}

7
machines/grey-area/nixos/kitty.nix
View file

@ -1,7 +0,0 @@
{ config, pkgs, lib, ... }:
{
environment.systemPackages = with pkgs;
[
kitty kitty-themes termpdfpy
];
}

9
machines/grey-area/nixos/libvirt.nix
View file

@ -1,9 +0,0 @@
{ config, pkgs, ... }:
{
virtualisation.libvirtd.enable = true;
environment.systemPackages = with pkgs; [
qemu_kvm
libvirt
polkit
];
}

30
machines/grey-area/nixos/nextcloud.nix
View file

@ -1,30 +0,0 @@
{ pkgs, ... }:
{
# Nextcloud Config
environment.etc."nextcloud-admin-pass".text = "siKKerhet666";
services.nextcloud = {
enable = true;
hostName = "server1.tail807ea.ts.net";
# Ssl Let'encrypt
#hostName = "cloud.geokkjer.eu";
#https = true;
# Auto-update Nextcloud Apps
autoUpdateApps.enable = true;
# Set what time makes sense for you
autoUpdateApps.startAt = "05:00:00";
# enable redis cache
configureRedis = true;
# Create db locally , maybe not needed with sqlite
database.createLocally = true;
# Config options
config = {
dbtype = "sqlite";
adminpassFile = "/etc/nextcloud-admin-pass";
trustedProxies = [ "46.226.104.98" "100.75.29.52" ];
extraTrustedDomains = [ "localhost" "*.cloudflare.net" "*.tail807ea.ts.net" "46.226.104.98" "*.geokkjer.eu" ];
};
};
}

9
machines/grey-area/nixos/open-vscode-server.nix
View file

@ -1,9 +0,0 @@
{ pkgs, configs, ... }:
{
services.openvscode-server = {
enable = true;
telemetryLevel = "off";
port = 3003;
host = "0.0.0.0";
};
}

13
machines/grey-area/nixos/podman.nix
View file

@ -1,13 +0,0 @@
{ config, pkgs, ... }:
{
virtualisation.podman.enable = true;
virtualisation.podman.dockerCompat = true;
virtualisation.podman.dockerSocket.enable = true;
#virtualisation.defaultNetwork.settings.dns_enabled = true;
environment.systemPackages = with pkgs; [
podman-tui
podman-compose
];
}

6
machines/grey-area/nixos/starship.nix
View file

@ -1,6 +0,0 @@
{ pkgs, ... }:
{
environment.systemPackages = with pkgs; [
starship
];
}

18
machines/grey-area/nixos/tailscale.nix
View file

@ -1,18 +0,0 @@
{config, pkgs, ... }:
{
environment.systemPackages = with pkgs; [
tailscale
];
services.tailscale.enable = true;
networking.firewall = {
# trace: warning: Strict reverse path filtering breaks Tailscale exit node
# use and some subnet routing setups. Consider setting
# `networking.firewall.checkReversePath` = 'loose'
checkReversePath = "loose";
trustedInterfaces = [ "tailscale0" ];
};
}
#+end80808080 * nginx
#+begin_src nix

29
machines/grey-area/nixos/tty.nix
View file

@ -1,29 +0,0 @@
{ pkgs, ... }:
{
services.getty.greetingLine = ''\l'';
console = {
earlySetup = true;
# Joker palette
colors = [
"1b161f"
"ff5555"
"54c6b5"
"d5aa2a"
"bd93f9"
"ff79c6"
"8be9fd"
"bfbfbf"
"1b161f"
"ff6e67"
"5af78e"
"ffce50"
"caa9fa"
"ff92d0"
"9aedfe"
"e6e6e6"
];
};
}

26
machines/grey-area/nixos/writefreely.nix
View file

@ -1,26 +0,0 @@
{ pkgs, configs, ... }:
{
services.writefreely = {
enable = true;
admin.name = "geir@geokkjer.eu";
host = "blog.geokkjer.eu";
database = {
type = "sqlite3";
#filename = "writefreely.db";
#database = "writefreely";
};
nginx = {
# Enable Nginx and configure it to serve WriteFreely.
enable = true;
};
settings = {
server = {
port = 8088;
bind = "0.0.0.0";
};
};
};
networking.firewall.allowedTCPPorts = [ 8088 ];
networking.firewall.allowedUDPPorts = [ 8088 ];
}

4
machines/grey-area/services/forgejo.nix
View file

@ -13,9 +13,9 @@
DISABLE_REGISTRATION = true;
};
server = {
ROOT_URL = "http://apps:3000";
ROOT_URL = "https://git.geokkjer.eu";
SSH_DOMAIN = "git.geokkjer.eu";
SSH_PORT = 2222;
SSH_PORT = 1337;
};
repository = {
ENABLE_PUSH_CREATE_USER = true;