-2

README.md

reviewed

··· 17 17 | **odin** | Main workstation with AMD GPU, Docker, Coder server, Valheim game server | x86_64-linux | 18 18 | **misaki** | NAS/Server with ZFS, Plex, Jellyfin, Immich, Nginx reverse proxy | x86_64-linux | 19 19 | **shizuri** | Steam/gaming machine with LXQt desktop and XRDP | x86_64-linux | 20 20 - | **edge** | Solana validator node with Agave software | x86_64-linux | 21 20 | **touma-wsl** | WSL2 NixOS configuration | x86_64-linux | 22 21 | **aleister-noah** | macOS workstation (Home Manager only) | aarch64-darwin | 23 22 ··· 37 36 │ ├── odin/ 38 37 │ ├── misaki/ 39 38 │ ├── shizuri/ 40 40 - │ ├── edge/ 41 39 │ └── touma-wsl.nix 42 40 ├── overlays/ # Package overlays 43 41 ├── secrets/ # Encrypted secrets (agenix)

-6

flake.nix

reviewed

··· 186 186 ]; 187 187 enableNFTables = false; 188 188 }; 189 189 - nixosConfigurations.edge = basicSystem { 190 190 - useUnstable = true; 191 191 - modules = [ 192 192 - ./host-specific/edge/configuration.nix 193 193 - ]; 194 194 - }; 195 189 homeConfigurations."noah-aleister" = home-manager.lib.homeManagerConfiguration { 196 190 pkgs = import nixpkgs { 197 191 system = "aarch64-darwin";

-207

host-specific/edge/configuration.nix

reviewed

··· 1 1 - # Edit this configuration file to define what should be installed on 2 2 - # your system. Help is available in the configuration.nix(5) man page, on 3 3 - # https://search.nixos.org/options and in the NixOS manual (`nixos-help`). 4 4 - 5 5 - { 6 6 - config, 7 7 - lib, 8 8 - pkgs, 9 9 - inputs, 10 10 - ... 11 11 - }: 12 12 - let 13 13 - system = pkgs.stdenv.targetPlatform.system; 14 14 - agave = (builtins.getFlake "/home/noah/repos/agave"); 15 15 - in 16 16 - { 17 17 - imports = [ 18 18 - # Include the results of the hardware scan. 19 19 - ./hardware-configuration.nix 20 20 - agave.nixosModules.default 21 21 - ]; 22 22 - 23 23 - nix.settings.experimental-features = [ 24 24 - "nix-command" 25 25 - "flakes" 26 26 - ]; 27 27 - 28 28 - # Use the systemd-boot EFI boot loader. 29 29 - boot.loader.systemd-boot.enable = true; 30 30 - #boot.loader.grub.device = "nodev"; 31 31 - #boot.loader.grub.efiSupport = true; 32 32 - #boot.loader.grub.useOSProber = true; 33 33 - boot.loader.efi.canTouchEfiVariables = true; 34 34 - 35 35 - # Use latest kernel. 36 36 - boot.kernelPackages = pkgs.linuxPackages_latest; 37 37 - 38 38 - networking.hostName = "edge"; # Define your hostname. 39 39 - 40 40 - # Configure network connections interactively with nmcli or nmtui. 41 41 - networking.networkmanager.enable = true; 42 42 - 43 43 - # Set your time zone. 44 44 - # time.timeZone = "Europe/Amsterdam"; 45 45 - 46 46 - # Configure network proxy if necessary 47 47 - # networking.proxy.default = "http://user:password@proxy:port/"; 48 48 - # networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain"; 49 49 - 50 50 - # Select internationalisation properties. 51 51 - i18n.defaultLocale = "en_US.UTF-8"; 52 52 - console = { 53 53 - font = "Lat2-Terminus16"; 54 54 - keyMap = "us"; 55 55 - #useXkbConfig = true; # use xkb.options in tty. 56 56 - }; 57 57 - 58 58 - # Enable the X11 windowing system. 59 59 - # services.xserver.enable = true; 60 60 - 61 61 - # Configure keymap in X11 62 62 - # services.xserver.xkb.layout = "us"; 63 63 - # services.xserver.xkb.options = "eurosign:e,caps:escape"; 64 64 - 65 65 - # Enable CUPS to print documents. 66 66 - # services.printing.enable = true; 67 67 - 68 68 - # Enable sound. 69 69 - # services.pulseaudio.enable = true; 70 70 - # OR 71 71 - # services.pipewire = { 72 72 - # enable = true; 73 73 - # pulse.enable = true; 74 74 - # }; 75 75 - 76 76 - # Enable touchpad support (enabled default in most desktopManager). 77 77 - # services.libinput.enable = true; 78 78 - 79 79 - # Define a user account. Don't forget to set a password with ‘passwd’. 80 80 - # users.users.alice = { 81 81 - # isNormalUser = true; 82 82 - # extraGroups = [ "wheel" ]; # Enable ‘sudo’ for the user. 83 83 - # packages = with pkgs; [ 84 84 - # tree 85 85 - # ]; 86 86 - # }; 87 87 - 88 88 - # programs.firefox.enable = true; 89 89 - 90 90 - # List packages installed in system profile. 91 91 - # You can use https://search.nixos.org/ to find more packages (and options). 92 92 - environment.systemPackages = with pkgs; [ 93 93 - neovim 94 94 - wget 95 95 - git 96 96 - htop 97 97 - inputs.agenix.packages."${system}".agenix 98 98 - agave.packages.${system}.solana 99 99 - agave.packages.${system}.solana-keygen 100 100 - ]; 101 101 - 102 102 - services.tailscale.useRoutingFeatures = "both"; 103 103 - 104 104 - # Some programs need SUID wrappers, can be configured further or are 105 105 - # started in user sessions. 106 106 - # programs.mtr.enable = true; 107 107 - # programs.gnupg.agent = { 108 108 - # enable = true; 109 109 - # enableSSHSupport = true; 110 110 - # }; 111 111 - 112 112 - # List services that you want to enable: 113 113 - 114 114 - # Enable the OpenSSH daemon. 115 115 - services.openssh.enable = true; 116 116 - services.openssh.openFirewall = true; 117 117 - 118 118 - # Open ports in the firewall. 119 119 - # networking.firewall.allowedTCPPorts = [ ... ]; 120 120 - # networking.firewall.allowedUDPPorts = [ ... ]; 121 121 - # Or disable the firewall altogether. 122 122 - networking.firewall.enable = true; 123 123 - networking.firewall = { 124 124 - allowPing = true; 125 125 - allowedUDPPorts = [ ]; 126 126 - allowedUDPPortRanges = [ 127 127 - # Agave 128 128 - { 129 129 - from = 8000; 130 130 - to = 8020; 131 131 - } 132 132 - ]; 133 133 - allowedTCPPorts = [ 134 134 - 2375 135 135 - 3000 136 136 - # Agave 137 137 - 8001 138 138 - 8899 139 139 - 8900 140 140 - 10000 141 141 - ]; 142 142 - }; 143 143 - security.pam.loginLimits = [ 144 144 - { 145 145 - domain = "*"; 146 146 - type = "soft"; 147 147 - item = "nofile"; 148 148 - value = "100000"; 149 149 - } 150 150 - { 151 151 - domain = "*"; 152 152 - type = "hard"; 153 153 - item = "nofile"; 154 154 - value = "1000000"; 155 155 - } 156 156 - ]; 157 157 - 158 158 - age.secrets.validator-identity = { 159 159 - file = ../../secrets/validator-identity.age; 160 160 - owner = "sol"; 161 161 - group = "sol"; 162 162 - }; 163 163 - services.ambient-validator = { 164 164 - enable = true; 165 165 - package = agave.packages.${system}.ambient-validator; 166 166 - # this needs to be a secret 167 167 - identityKeypair = config.age.secrets.validator-identity.path; 168 168 - rpcBindAddress = "0.0.0.0"; 169 169 - geyserPluginConfig = { 170 170 - libpath = "${agave.packages.${system}.yellowstone-geyser}/lib/libyellowstone_grpc_geyser.so"; 171 171 - log = { 172 172 - level = "info"; 173 173 - }; 174 174 - tokio = { 175 175 - worker_threads = 4; 176 176 - affinity = null; 177 177 - }; 178 178 - grpc = { 179 179 - address = "0.0.0.0:10000"; 180 180 - }; 181 181 - }; 182 182 - }; 183 183 - # Copy the NixOS configuration file and link it from the resulting system 184 184 - # (/run/current-system/configuration.nix). This is useful in case you 185 185 - # accidentally delete configuration.nix. 186 186 - # system.copySystemConfiguration = true; 187 187 - 188 188 - # This option defines the first version of NixOS you have installed on this particular machine, 189 189 - # and is used to maintain compatibility with application data (e.g. databases) created on older NixOS versions. 190 190 - # 191 191 - # Most users should NEVER change this value after the initial install, for any reason, 192 192 - # even if you've upgraded your system to a new NixOS release. 193 193 - # 194 194 - # This value does NOT affect the Nixpkgs version your packages and OS are pulled from, 195 195 - # so changing it will NOT upgrade your system - see https://nixos.org/manual/nixos/stable/#sec-upgrading for how 196 196 - # to actually do that. 197 197 - # 198 198 - # This value being lower than the current NixOS release does NOT mean your system is 199 199 - # out of date, out of support, or vulnerable. 200 200 - # 201 201 - # Do NOT change this value unless you have manually inspected all the changes it would make to your configuration, 202 202 - # and migrated your data accordingly. 203 203 - # 204 204 - # For more information, see `man configuration.nix` or https://nixos.org/manual/nixos/stable/options#opt-system.stateVersion . 205 205 - system.stateVersion = "25.11"; # Did you read the comment? 206 206 - 207 207 - }

-60

host-specific/edge/hardware-configuration.nix

reviewed

··· 1 1 - # Do not modify this file! It was generated by ‘nixos-generate-config’ 2 2 - # and may be overwritten by future invocations. Please make changes 3 3 - # to /etc/nixos/configuration.nix instead. 4 4 - { 5 5 - config, 6 6 - lib, 7 7 - pkgs, 8 8 - modulesPath, 9 9 - ... 10 10 - }: 11 11 - 12 12 - { 13 13 - imports = [ 14 14 - (modulesPath + "/installer/scan/not-detected.nix") 15 15 - ]; 16 16 - 17 17 - boot.initrd.availableKernelModules = [ 18 18 - "nvme" 19 19 - "xhci_pci" 20 20 - "ahci" 21 21 - "usbhid" 22 22 - ]; 23 23 - boot.initrd.kernelModules = [ ]; 24 24 - boot.kernelModules = [ "kvm-amd" ]; 25 25 - boot.extraModulePackages = [ ]; 26 26 - 27 27 - fileSystems."/" = { 28 28 - device = "/dev/disk/by-uuid/8101a0a8-a8c6-4083-85b6-c136d3c80f2e"; 29 29 - fsType = "ext4"; 30 30 - }; 31 31 - 32 32 - fileSystems."/boot" = { 33 33 - device = "/dev/disk/by-uuid/E7AD-32DA"; 34 34 - fsType = "vfat"; 35 35 - options = [ 36 36 - "fmask=0077" 37 37 - "dmask=0077" 38 38 - ]; 39 39 - }; 40 40 - 41 41 - swapDevices = [ ]; 42 42 - 43 43 - nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux"; 44 44 - hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware; 45 45 - boot.swraid = { 46 46 - enable = true; 47 47 - #mdadmConf = '' 48 48 - # ARRAY /dev/md126 metadata=1.2 UUID=27cd6eab:f0304d07:b859f0f2:1a8f29b7 49 49 - # MAILADDR noah 50 50 - #''; 51 51 - }; 52 52 - 53 53 - # stuff for Agave 54 54 - boot.kernel.sysctl."net.core.rmem_default" = 134217728; 55 55 - boot.kernel.sysctl."net.core.rmem_max" = 134217728; 56 56 - boot.kernel.sysctl."net.core.wmem_default" = 134217728; 57 57 - boot.kernel.sysctl."net.core.wmem_max" = 134217728; 58 58 - boot.kernel.sysctl."vm.max_map_count" = 1000000; 59 59 - boot.kernel.sysctl."fs.nr_open" = 1000000; 60 60 - }

-3

secrets/secrets.nix

reviewed

··· 5 5 "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIChbA8oSqYgmjIGYjlpAPLf+Nl6IlcSb2Zmh/Hl6xm88 noah@accelerator" 6 6 ]; 7 7 misaki = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO+Rcf4Lr+JPWGKQol6eAml6SMgERkGJWgN7y1qYUUvX root@nixos"; 8 8 - edge = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINCmFKYXpQf1E8E7fj5s+3R33HPRjPhXrv++FCKYBCd4 root@nixos"; 9 8 odin = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJIuvOXEK7M2i/Q8FeableBS+L20zwQpLetOuFGUhba2 root@nixos"; 10 9 touma-wsl = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFeyj52bQ/nf5k4HwDckeHy8wU3weDtY6IF6VlUJ/hAH root@nixos"; 11 10 shizuri = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIaMdVtl8UlDa9kI/PO62Glu/PeJXfgXNsVg92b+BibE root@nixos"; 12 11 hosts = [ 13 12 misaki 14 14 - edge 15 13 odin 16 14 touma-wsl 17 15 shizuri ··· 24 22 misaki 25 23 noah 26 24 ]; 27 27 - "validator-identity.age".publicKeys = [ edge ]; 28 25 "catgirl-libera.age".publicKeys = noah; 29 26 "garage_rpc_secret.age".publicKeys = [ misaki ] ++ noah; 30 27 "garage_admin_secret.age".publicKeys = [ misaki ] ++ noah;

secrets/validator-identity.age

reviewed

This is a binary file and will not be displayed.