mirror of
https://github.com/oqyude/nixos.git
synced 2026-10-07 20:47:14 +03:00
big refactoring
This commit is contained in:
+12
-15
@@ -1,18 +1,15 @@
|
||||
# Host: "default" (device: minimal)
|
||||
#
|
||||
# The host record lives in configurations/default.nix; this file is only the
|
||||
# module body. `xlib` (identity, dirs, helpers) arrives as a module argument.
|
||||
{
|
||||
deviceType = "minimal";
|
||||
modules = [
|
||||
(
|
||||
{
|
||||
inputs,
|
||||
...
|
||||
}:
|
||||
{
|
||||
imports = [
|
||||
inputs.self.nixosModules.default
|
||||
];
|
||||
|
||||
system.stateVersion = "26.05";
|
||||
}
|
||||
)
|
||||
inputs,
|
||||
...
|
||||
}:
|
||||
{
|
||||
imports = [
|
||||
inputs.self.nixosModules.default
|
||||
];
|
||||
|
||||
system.stateVersion = "26.05";
|
||||
}
|
||||
|
||||
@@ -1,18 +1,73 @@
|
||||
{ inputs, ... }@flakeContext:
|
||||
let
|
||||
lib = inputs.nixpkgs.lib;
|
||||
mkSystem = import ../lib/mkSystem.nix flakeContext;
|
||||
xlibLib = import ../lib/xlib.nix { inherit lib; };
|
||||
|
||||
# One record per host. The attribute name IS the hostname, so it is written
|
||||
# exactly once; `hostname` is only needed where the attribute name is not
|
||||
# the real hostname (the `default` entry).
|
||||
#
|
||||
# device device type, must be a key of `devices` in lib/xlib.nix
|
||||
# modules module body for this host
|
||||
hosts = {
|
||||
default = {
|
||||
hostname = "nixos";
|
||||
device = "minimal";
|
||||
modules = [ ./any.nix ];
|
||||
};
|
||||
atoridu = {
|
||||
device = "primary";
|
||||
modules = [ ./mini-pc.nix ];
|
||||
};
|
||||
rydiwo = {
|
||||
device = "secondary";
|
||||
modules = [ ./mini-laptop.nix ];
|
||||
};
|
||||
otreca = {
|
||||
device = "vds";
|
||||
modules = [ ./vds.nix ];
|
||||
};
|
||||
sapphira = {
|
||||
device = "server";
|
||||
modules = [ ./server.nix ];
|
||||
};
|
||||
wsl = {
|
||||
device = "wsl";
|
||||
modules = [ ./wsl.nix ];
|
||||
};
|
||||
};
|
||||
|
||||
mkHost =
|
||||
name:
|
||||
{
|
||||
device,
|
||||
modules,
|
||||
hostname ? name,
|
||||
...
|
||||
}:
|
||||
let
|
||||
xlib = xlibLib.mkXlib {
|
||||
inherit hostname;
|
||||
type = device;
|
||||
};
|
||||
in
|
||||
{
|
||||
inherit xlib;
|
||||
system = mkSystem { inherit xlib modules; };
|
||||
};
|
||||
in
|
||||
{
|
||||
nixosConfigurations = {
|
||||
default = mkSystem (import ./any.nix); # default
|
||||
atoridu = mkSystem (import ./mini-pc.nix); # atoridu
|
||||
rydiwo = mkSystem (import ./mini-laptop.nix); # rydiwo
|
||||
otreca = mkSystem (import ./vds.nix); # vds
|
||||
sapphira = mkSystem (import ./server.nix); # sapphira
|
||||
wsl = mkSystem (import ./wsl.nix); # wsl
|
||||
};
|
||||
nixosConfigurations = lib.mapAttrs' (
|
||||
name: spec: lib.nameValuePair name (mkHost name spec).system
|
||||
) hosts;
|
||||
|
||||
# Per-host xlib values, for code that lives outside the module system
|
||||
# (deploy, overlays, pkgs).
|
||||
xlib = lib.mapAttrs' (name: spec: lib.nameValuePair name (mkHost name spec).xlib) hosts;
|
||||
|
||||
nixOnDroidConfigurations = {
|
||||
epral = import ./mobile.nix flakeContext; # epral (Android via nix-on-droid)
|
||||
epral = import ./mobile.nix flakeContext; # epral (Android device via nix-on-droid)
|
||||
# Alias so a plain `nix-on-droid switch` from a local clone
|
||||
# (~/.config/nix-on-droid) picks up the device config without `#epral`.
|
||||
default = import ./mobile.nix flakeContext;
|
||||
|
||||
@@ -1,41 +1,37 @@
|
||||
# Host: "rydiwo" (device: secondary)
|
||||
#
|
||||
# The host record lives in configurations/default.nix; this file is only the
|
||||
# module body. `xlib` (identity, dirs, helpers) arrives as a module argument.
|
||||
{
|
||||
deviceType = "secondary";
|
||||
hostname = "rydiwo";
|
||||
modules = [
|
||||
(
|
||||
{
|
||||
lib,
|
||||
pkgs,
|
||||
xlib,
|
||||
inputs,
|
||||
...
|
||||
}:
|
||||
{
|
||||
imports = with inputs; [
|
||||
nixos-hardware.nixosModules.chuwi-minibook-x
|
||||
./hardware/mini-laptop.nix
|
||||
self.nixosModules.default
|
||||
];
|
||||
|
||||
boot = {
|
||||
kernelPackages = lib.mkDefault pkgs.linuxPackages_xanmod_stable;
|
||||
loader = {
|
||||
systemd-boot.enable = lib.mkDefault true;
|
||||
efi.canTouchEfiVariables = lib.mkDefault true;
|
||||
};
|
||||
};
|
||||
|
||||
fileSystems = xlib.helpers.mkNtfsMount {
|
||||
path = xlib.dirs.lamet-drive;
|
||||
uuid = "DC76BD3576BD116E";
|
||||
mask = "0000";
|
||||
};
|
||||
|
||||
xlib.ssh.enable = true;
|
||||
hardware.intel-gpu-tools.enable = true;
|
||||
|
||||
system.stateVersion = "26.05";
|
||||
}
|
||||
)
|
||||
lib,
|
||||
pkgs,
|
||||
xlib,
|
||||
inputs,
|
||||
...
|
||||
}:
|
||||
{
|
||||
imports = with inputs; [
|
||||
nixos-hardware.nixosModules.chuwi-minibook-x
|
||||
./hardware/mini-laptop.nix
|
||||
self.nixosModules.default
|
||||
];
|
||||
|
||||
boot = {
|
||||
kernelPackages = lib.mkDefault pkgs.linuxPackages_xanmod_stable;
|
||||
loader = {
|
||||
systemd-boot.enable = lib.mkDefault true;
|
||||
efi.canTouchEfiVariables = lib.mkDefault true;
|
||||
};
|
||||
};
|
||||
|
||||
fileSystems = xlib.helpers.mkNtfsMount {
|
||||
path = xlib.dirs.lamet-drive;
|
||||
uuid = "DC76BD3576BD116E";
|
||||
mask = "0000";
|
||||
};
|
||||
|
||||
host.ssh.enable = true;
|
||||
hardware.intel-gpu-tools.enable = true;
|
||||
|
||||
system.stateVersion = "26.05";
|
||||
}
|
||||
|
||||
+81
-80
@@ -1,83 +1,84 @@
|
||||
# Host: "atoridu" (device: primary)
|
||||
#
|
||||
# The host record lives in configurations/default.nix; this file is only the
|
||||
# module body. `xlib` (identity, dirs, helpers) arrives as a module argument.
|
||||
{
|
||||
deviceType = "primary";
|
||||
hostname = "atoridu";
|
||||
modules = [
|
||||
(
|
||||
{
|
||||
lib,
|
||||
pkgs,
|
||||
xlib,
|
||||
inputs,
|
||||
...
|
||||
}:
|
||||
{
|
||||
imports = with inputs; [
|
||||
./hardware/mini-pc.nix
|
||||
./disko/mini-pc.nix
|
||||
./hardware/logitech.nix
|
||||
self.nixosModules.default
|
||||
];
|
||||
|
||||
fileSystems = lib.listToAttrs (
|
||||
map (xlib.helpers.mkNtfsMount) [
|
||||
{
|
||||
path = xlib.dirs.therima-drive;
|
||||
uuid = "C0A2DDEFA2DDEA44";
|
||||
enable = false;
|
||||
}
|
||||
{
|
||||
path = xlib.dirs.vetymae-drive;
|
||||
uuid = "6408433908430A0E";
|
||||
enable = false;
|
||||
}
|
||||
{
|
||||
path = xlib.dirs.soptur-drive;
|
||||
uuid = "C00C56E40C56D54E";
|
||||
enable = false;
|
||||
}
|
||||
]
|
||||
);
|
||||
|
||||
boot = {
|
||||
kernelPackages = lib.mkDefault pkgs.linuxPackages_xanmod_stable;
|
||||
loader = {
|
||||
systemd-boot.enable = lib.mkDefault true;
|
||||
efi.canTouchEfiVariables = lib.mkDefault true;
|
||||
};
|
||||
};
|
||||
|
||||
services.xserver = {
|
||||
videoDrivers = [
|
||||
"amdgpu"
|
||||
];
|
||||
};
|
||||
services.pipewire = {
|
||||
enable = lib.mkDefault true;
|
||||
systemWide = true;
|
||||
alsa.enable = false;
|
||||
alsa.support32Bit = true;
|
||||
pulse.enable = true;
|
||||
jack.enable = true;
|
||||
extraConfig.pipewire = {
|
||||
"99-default.conf" = {
|
||||
"context.properties" = {
|
||||
"default.clock.rate" = 96000;
|
||||
"default.clock.allowed-rates" = [
|
||||
44100
|
||||
48000
|
||||
96000
|
||||
];
|
||||
"default.clock.quantum" = 1024;
|
||||
"default.clock.min-quantum" = 256;
|
||||
"default.clock.max-quantum" = 2048;
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
nixpkgs.config.pulseaudio = true;
|
||||
|
||||
system.stateVersion = "26.05";
|
||||
}
|
||||
)
|
||||
lib,
|
||||
pkgs,
|
||||
xlib,
|
||||
inputs,
|
||||
...
|
||||
}:
|
||||
{
|
||||
imports = with inputs; [
|
||||
./hardware/mini-pc.nix
|
||||
./disko/mini-pc.nix
|
||||
./hardware/logitech.nix
|
||||
self.nixosModules.default
|
||||
];
|
||||
|
||||
# mkNtfsMount returns a `{ "<path>" = { ... }; }` attrset (the shape
|
||||
# fileSystems itself wants), so several mounts are combined with
|
||||
# mergeAttrsList — not listToAttrs, which would demand `name`/`value`.
|
||||
#
|
||||
# These three ntfs3 drives are intentionally left unmounted. The entries
|
||||
# are kept commented out rather than deleted, so restoring a drive is a
|
||||
# matter of uncommenting its block. `enable = false` would declare a drive
|
||||
# without mounting it; dropping the field mounts it.
|
||||
fileSystems = lib.mergeAttrsList (
|
||||
map (xlib.helpers.mkNtfsMount) [
|
||||
# {
|
||||
# path = xlib.dirs.therima-drive;
|
||||
# uuid = "C0A2DDEFA2DDEA44";
|
||||
# }
|
||||
# {
|
||||
# path = xlib.dirs.vetymae-drive;
|
||||
# uuid = "6408433908430A0E";
|
||||
# }
|
||||
# {
|
||||
# path = xlib.dirs.soptur-drive;
|
||||
# uuid = "C00C56E40C56D54E";
|
||||
# }
|
||||
]
|
||||
);
|
||||
|
||||
boot = {
|
||||
kernelPackages = lib.mkDefault pkgs.linuxPackages_xanmod_stable;
|
||||
loader = {
|
||||
systemd-boot.enable = lib.mkDefault true;
|
||||
efi.canTouchEfiVariables = lib.mkDefault true;
|
||||
};
|
||||
};
|
||||
|
||||
services.xserver = {
|
||||
videoDrivers = [
|
||||
"amdgpu"
|
||||
];
|
||||
};
|
||||
services.pipewire = {
|
||||
enable = lib.mkDefault true;
|
||||
systemWide = true;
|
||||
alsa.enable = false;
|
||||
alsa.support32Bit = true;
|
||||
pulse.enable = true;
|
||||
jack.enable = true;
|
||||
extraConfig.pipewire = {
|
||||
"99-default.conf" = {
|
||||
"context.properties" = {
|
||||
"default.clock.rate" = 96000;
|
||||
"default.clock.allowed-rates" = [
|
||||
44100
|
||||
48000
|
||||
96000
|
||||
];
|
||||
"default.clock.quantum" = 1024;
|
||||
"default.clock.min-quantum" = 256;
|
||||
"default.clock.max-quantum" = 2048;
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
nixpkgs.config.pulseaudio = true;
|
||||
|
||||
system.stateVersion = "26.05";
|
||||
}
|
||||
|
||||
@@ -9,6 +9,7 @@ let
|
||||
# (essentials, users.nix, home-manager, sops-nix, disko, grub2-themes)
|
||||
# and nixpkgs.overlays are skipped so it evaluates under nix-on-droid's
|
||||
# module system (class = "nixOnDroid").
|
||||
xlib = import ../lib/xlib.nix { lib = inputs.nixpkgs.lib; };
|
||||
nixOnDroidModule =
|
||||
{
|
||||
lib,
|
||||
@@ -21,11 +22,6 @@ let
|
||||
inputs.self.nixosModules.strict
|
||||
];
|
||||
|
||||
xlib.device = {
|
||||
type = "termux";
|
||||
hostname = "epral";
|
||||
};
|
||||
|
||||
# Login shell. nix-on-droid writes /etc/passwd from user.shell on every
|
||||
# activation, so `chsh` is useless here — set it in nix instead.
|
||||
# (default is bashInteractive)
|
||||
@@ -120,6 +116,13 @@ inputs.nix-on-droid.lib.nixOnDroidConfiguration {
|
||||
nixOnDroidModule
|
||||
];
|
||||
extraSpecialArgs = {
|
||||
deviceType = "termux";
|
||||
# `xlib` is the same value shape NixOS hosts get (lib/mkSystem.nix);
|
||||
# the hostname lives here because nixOnDroidConfigurations is keyed by
|
||||
# both "epral" and the "default" alias, so it cannot come from the
|
||||
# attribute name.
|
||||
xlib = xlib.mkXlib {
|
||||
hostname = "epral";
|
||||
type = "termux";
|
||||
};
|
||||
};
|
||||
}
|
||||
|
||||
+76
-80
@@ -1,83 +1,79 @@
|
||||
# Host: "sapphira" (device: server)
|
||||
#
|
||||
# The host record lives in configurations/default.nix; this file is only the
|
||||
# module body. `xlib` (identity, dirs, helpers) arrives as a module argument.
|
||||
{
|
||||
deviceType = "server";
|
||||
hostname = "sapphira";
|
||||
modules = [
|
||||
(
|
||||
{
|
||||
lib,
|
||||
pkgs,
|
||||
xlib,
|
||||
inputs,
|
||||
...
|
||||
}:
|
||||
{
|
||||
imports = [
|
||||
./hardware/server.nix
|
||||
inputs.self.nixosModules.default
|
||||
];
|
||||
|
||||
boot = {
|
||||
# kernelPackages = pkgs.linuxPackages_xanmod_stable;
|
||||
hardwareScan = true;
|
||||
loader = {
|
||||
systemd-boot.enable = lib.mkDefault true;
|
||||
efi.canTouchEfiVariables = lib.mkDefault true;
|
||||
};
|
||||
};
|
||||
|
||||
hardware = {
|
||||
bluetooth.enable = true;
|
||||
graphics = {
|
||||
enable = true;
|
||||
extraPackages = with pkgs; [
|
||||
intel-media-driver
|
||||
intel-ocl
|
||||
intel-vaapi-driver
|
||||
];
|
||||
};
|
||||
intel-gpu-tools.enable = true;
|
||||
};
|
||||
|
||||
fileSystems =
|
||||
(xlib.helpers.mkExfatMount {
|
||||
path = xlib.dirs.archive-drive;
|
||||
label = "archive";
|
||||
})
|
||||
// (xlib.helpers.mkExfatMount {
|
||||
path = xlib.dirs.mobile-drive;
|
||||
uuid = "7EB1-DC99";
|
||||
})
|
||||
// (xlib.helpers.mkBindMount {
|
||||
what = xlib.dirs.services-folder;
|
||||
where = xlib.dirs.services-mnt-folder;
|
||||
})
|
||||
// {
|
||||
# External drive
|
||||
"${xlib.dirs.server-home}" = {
|
||||
device = "/dev/disk/by-uuid/37e53ebc-5343-a94d-9fe2-0ca39e13a8de";
|
||||
fsType = "ext4";
|
||||
};
|
||||
};
|
||||
|
||||
systemd.tmpfiles.rules = [
|
||||
"z ${xlib.dirs.services-mnt-folder} 0777 root root -"
|
||||
];
|
||||
|
||||
xlib.ssh.enable = true;
|
||||
|
||||
networking = {
|
||||
networkmanager.enable = true;
|
||||
firewall.enable = false;
|
||||
# nameservers = [
|
||||
# "192.168.1.1"
|
||||
# "127.0.0.1"
|
||||
# ];
|
||||
};
|
||||
|
||||
system = {
|
||||
stateVersion = "25.05";
|
||||
};
|
||||
}
|
||||
)
|
||||
lib,
|
||||
pkgs,
|
||||
xlib,
|
||||
inputs,
|
||||
...
|
||||
}:
|
||||
{
|
||||
imports = [
|
||||
./hardware/server.nix
|
||||
inputs.self.nixosModules.default
|
||||
];
|
||||
|
||||
boot = {
|
||||
# kernelPackages = pkgs.linuxPackages_xanmod_stable;
|
||||
hardwareScan = true;
|
||||
loader = {
|
||||
systemd-boot.enable = lib.mkDefault true;
|
||||
efi.canTouchEfiVariables = lib.mkDefault true;
|
||||
};
|
||||
};
|
||||
|
||||
hardware = {
|
||||
bluetooth.enable = true;
|
||||
graphics = {
|
||||
enable = true;
|
||||
extraPackages = with pkgs; [
|
||||
intel-media-driver
|
||||
intel-ocl
|
||||
intel-vaapi-driver
|
||||
];
|
||||
};
|
||||
intel-gpu-tools.enable = true;
|
||||
};
|
||||
|
||||
fileSystems =
|
||||
(xlib.helpers.mkExfatMount {
|
||||
path = xlib.dirs.archive-drive;
|
||||
label = "archive";
|
||||
})
|
||||
// (xlib.helpers.mkExfatMount {
|
||||
path = xlib.dirs.mobile-drive;
|
||||
uuid = "7EB1-DC99";
|
||||
})
|
||||
// (xlib.helpers.mkBindMount {
|
||||
what = xlib.dirs.services-folder;
|
||||
where = xlib.dirs.services-mnt-folder;
|
||||
})
|
||||
// {
|
||||
# External drive
|
||||
"${xlib.dirs.server-home}" = {
|
||||
device = "/dev/disk/by-uuid/37e53ebc-5343-a94d-9fe2-0ca39e13a8de";
|
||||
fsType = "ext4";
|
||||
};
|
||||
};
|
||||
|
||||
systemd.tmpfiles.rules = [
|
||||
"z ${xlib.dirs.services-mnt-folder} 0777 root root -"
|
||||
];
|
||||
|
||||
host.ssh.enable = true;
|
||||
|
||||
networking = {
|
||||
networkmanager.enable = true;
|
||||
firewall.enable = false;
|
||||
# nameservers = [
|
||||
# "192.168.1.1"
|
||||
# "127.0.0.1"
|
||||
# ];
|
||||
};
|
||||
|
||||
system = {
|
||||
stateVersion = "25.05";
|
||||
};
|
||||
}
|
||||
|
||||
+112
-117
@@ -1,122 +1,117 @@
|
||||
# Host: "otreca" (device: vds)
|
||||
#
|
||||
# The host record lives in configurations/default.nix; this file is only the
|
||||
# module body. `xlib` (identity, dirs, helpers) arrives as a module argument.
|
||||
{
|
||||
deviceType = "vds";
|
||||
hostname = "otreca";
|
||||
modules = [
|
||||
(
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
modulesPath,
|
||||
pkgs,
|
||||
xlib,
|
||||
inputs,
|
||||
...
|
||||
}:
|
||||
{
|
||||
imports = [
|
||||
(modulesPath + "/installer/scan/not-detected.nix")
|
||||
(modulesPath + "/profiles/qemu-guest.nix")
|
||||
lib,
|
||||
modulesPath,
|
||||
pkgs,
|
||||
xlib,
|
||||
inputs,
|
||||
...
|
||||
}:
|
||||
{
|
||||
imports = [
|
||||
(modulesPath + "/installer/scan/not-detected.nix")
|
||||
(modulesPath + "/profiles/qemu-guest.nix")
|
||||
|
||||
./disko/vds.nix
|
||||
./hardware/vds.nix
|
||||
./disko/vds.nix
|
||||
./hardware/vds.nix
|
||||
|
||||
inputs.self.nixosModules.default
|
||||
];
|
||||
|
||||
boot = {
|
||||
# kernelPackages = pkgs.linuxPackages_xanmod_stable;
|
||||
hardwareScan = true;
|
||||
loader = {
|
||||
grub = {
|
||||
enable = true;
|
||||
device = "nodev";
|
||||
useOSProber = false;
|
||||
efiSupport = false;
|
||||
};
|
||||
systemd-boot.enable = lib.mkDefault false;
|
||||
};
|
||||
kernel.sysctl = {
|
||||
"net.ipv4.tcp_syncookies" = 1;
|
||||
"net.ipv4.tcp_max_syn_backlog" = 4096;
|
||||
"net.ipv4.tcp_synack_retries" = 3;
|
||||
"net.ipv4.tcp_syn_retries" = 3;
|
||||
};
|
||||
};
|
||||
|
||||
xlib.ssh.enable = true;
|
||||
services.openssh.openFirewall = true;
|
||||
|
||||
services.tailscale = {
|
||||
enable = true;
|
||||
openFirewall = true;
|
||||
};
|
||||
networking = {
|
||||
nameservers = [
|
||||
"1.1.1.1"
|
||||
"8.8.8.8"
|
||||
];
|
||||
networkmanager.enable = true;
|
||||
tempAddresses = "disabled";
|
||||
dhcpcd = {
|
||||
enable = true;
|
||||
IPv6rs = false;
|
||||
};
|
||||
firewall = {
|
||||
enable = true;
|
||||
allowPing = true;
|
||||
};
|
||||
nftables = {
|
||||
enable = true;
|
||||
ruleset = ''
|
||||
table inet filter {
|
||||
chain input {
|
||||
type filter hook input priority 0;
|
||||
|
||||
# loopback
|
||||
iif lo accept
|
||||
|
||||
# уже установленные
|
||||
ct state established,related accept
|
||||
|
||||
# РЕЖЕМ SYN СРАЗУ
|
||||
tcp flags syn tcp dport {80,443} limit rate 20/second burst 40 packets accept
|
||||
tcp flags syn tcp dport {80,443} drop
|
||||
|
||||
# остальное по необходимости
|
||||
}
|
||||
}
|
||||
'';
|
||||
};
|
||||
enableIPv6 = false;
|
||||
interfaces.ens3 = {
|
||||
useDHCP = true;
|
||||
# ipv4.addresses = [
|
||||
# {
|
||||
# address = "31.57.158.109";
|
||||
# prefixLength = 24;
|
||||
# }
|
||||
# ];
|
||||
# ipv6.addresses = [
|
||||
# {
|
||||
# address = "2a13:7c00:6:102:f816:3eff:fe91:6b9e";
|
||||
# prefixLength = 64;
|
||||
# }
|
||||
# ];
|
||||
};
|
||||
# defaultGateway = {
|
||||
# address = "31.57.158.1";
|
||||
# interface = "ens3";
|
||||
# };
|
||||
# defaultGateway6 = {
|
||||
# address = "2a13:7c00:6:102::1";
|
||||
# interface = "ens3";
|
||||
# };
|
||||
};
|
||||
|
||||
system = {
|
||||
stateVersion = "25.05";
|
||||
};
|
||||
}
|
||||
)
|
||||
inputs.self.nixosModules.default
|
||||
];
|
||||
|
||||
boot = {
|
||||
# kernelPackages = pkgs.linuxPackages_xanmod_stable;
|
||||
hardwareScan = true;
|
||||
loader = {
|
||||
grub = {
|
||||
enable = true;
|
||||
device = "nodev";
|
||||
useOSProber = false;
|
||||
efiSupport = false;
|
||||
};
|
||||
systemd-boot.enable = lib.mkDefault false;
|
||||
};
|
||||
kernel.sysctl = {
|
||||
"net.ipv4.tcp_syncookies" = 1;
|
||||
"net.ipv4.tcp_max_syn_backlog" = 4096;
|
||||
"net.ipv4.tcp_synack_retries" = 3;
|
||||
"net.ipv4.tcp_syn_retries" = 3;
|
||||
};
|
||||
};
|
||||
|
||||
host.ssh.enable = true;
|
||||
services.openssh.openFirewall = true;
|
||||
|
||||
services.tailscale = {
|
||||
enable = true;
|
||||
openFirewall = true;
|
||||
};
|
||||
networking = {
|
||||
nameservers = [
|
||||
"1.1.1.1"
|
||||
"8.8.8.8"
|
||||
];
|
||||
networkmanager.enable = true;
|
||||
tempAddresses = "disabled";
|
||||
dhcpcd = {
|
||||
enable = true;
|
||||
IPv6rs = false;
|
||||
};
|
||||
firewall = {
|
||||
enable = true;
|
||||
allowPing = true;
|
||||
};
|
||||
nftables = {
|
||||
enable = true;
|
||||
ruleset = ''
|
||||
table inet filter {
|
||||
chain input {
|
||||
type filter hook input priority 0;
|
||||
|
||||
# loopback
|
||||
iif lo accept
|
||||
|
||||
# уже установленные
|
||||
ct state established,related accept
|
||||
|
||||
# РЕЖЕМ SYN СРАЗУ
|
||||
tcp flags syn tcp dport {80,443} limit rate 20/second burst 40 packets accept
|
||||
tcp flags syn tcp dport {80,443} drop
|
||||
|
||||
# остальное по необходимости
|
||||
}
|
||||
}
|
||||
'';
|
||||
};
|
||||
enableIPv6 = false;
|
||||
interfaces.ens3 = {
|
||||
useDHCP = true;
|
||||
# ipv4.addresses = [
|
||||
# {
|
||||
# address = "31.57.158.109";
|
||||
# prefixLength = 24;
|
||||
# }
|
||||
# ];
|
||||
# ipv6.addresses = [
|
||||
# {
|
||||
# address = "2a13:7c00:6:102:f816:3eff:fe91:6b9e";
|
||||
# prefixLength = 64;
|
||||
# }
|
||||
# ];
|
||||
};
|
||||
# defaultGateway = {
|
||||
# address = "31.57.158.1";
|
||||
# interface = "ens3";
|
||||
# };
|
||||
# defaultGateway6 = {
|
||||
# address = "2a13:7c00:6:102::1";
|
||||
# interface = "ens3";
|
||||
# };
|
||||
};
|
||||
|
||||
system = {
|
||||
stateVersion = "25.05";
|
||||
};
|
||||
}
|
||||
|
||||
+36
-41
@@ -1,44 +1,39 @@
|
||||
# Host: "wsl" (device: wsl)
|
||||
#
|
||||
# The host record lives in configurations/default.nix; this file is only the
|
||||
# module body. `xlib` (identity, dirs, helpers) arrives as a module argument.
|
||||
{
|
||||
deviceType = "wsl";
|
||||
hostname = "wsl";
|
||||
modules = [
|
||||
(
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
pkgs,
|
||||
modulesPath,
|
||||
xlib,
|
||||
inputs,
|
||||
...
|
||||
}:
|
||||
{
|
||||
imports = [
|
||||
inputs.nixos-wsl.nixosModules.default
|
||||
inputs.self.nixosModules.default
|
||||
];
|
||||
|
||||
hardware = {
|
||||
graphics.enable = true;
|
||||
};
|
||||
|
||||
networking = {
|
||||
firewall = {
|
||||
enable = false;
|
||||
allowPing = true;
|
||||
};
|
||||
enableIPv6 = true;
|
||||
};
|
||||
|
||||
wsl = {
|
||||
enable = true;
|
||||
startMenuLaunchers = true;
|
||||
useWindowsDriver = true;
|
||||
defaultUser = config.xlib.device.username;
|
||||
};
|
||||
|
||||
system.stateVersion = "24.11";
|
||||
}
|
||||
)
|
||||
lib,
|
||||
modulesPath,
|
||||
pkgs,
|
||||
xlib,
|
||||
inputs,
|
||||
...
|
||||
}:
|
||||
{
|
||||
imports = [
|
||||
inputs.nixos-wsl.nixosModules.default
|
||||
inputs.self.nixosModules.default
|
||||
];
|
||||
|
||||
hardware = {
|
||||
graphics.enable = true;
|
||||
};
|
||||
|
||||
networking = {
|
||||
firewall = {
|
||||
enable = false;
|
||||
allowPing = true;
|
||||
};
|
||||
enableIPv6 = true;
|
||||
};
|
||||
|
||||
wsl = {
|
||||
enable = true;
|
||||
startMenuLaunchers = true;
|
||||
useWindowsDriver = true;
|
||||
defaultUser = xlib.device.username;
|
||||
};
|
||||
|
||||
system.stateVersion = "24.11";
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user