upRootNutrition/dotfiles
upRootNutrition/dotfiles
1
0
Fork 0
mirror of https://gitlab.com/upRootNutrition/dotfiles.git synced 2025-12-08 05:49:25 -06:00
Code Issues Projects 1 Releases Packages Wiki Activity Actions

test: setting up nas structure

Browse source
This commit is contained in:
Nick 2025-12-07 01:38:13 -06:00
parent b5614b006f
commit 2fdadf15f0
17 changed files with 662 additions and 94 deletions
Download patch file Download diff file Expand all files Collapse all files

187
modules/nixos/nas/opencloud/config/default.nix Normal file
View file

@ -0,0 +1,187 @@
{
flake,
pkgs,
...
}:
let
inherit (flake.config.people) user0;
serviceCfg = {
name = "opencloud";
};
in
{
opencloudVM =
{
user,
ip,
mac,
userMac,
ssh,
host,
}:
{
microvm.vms = {
"${serviceCfg.name}-${user}" = {
autostart = true;
restartIfChanged = true;
config = {
system.stateVersion = "24.05";
time.timeZone = "America/Winnipeg";
users.users.root.openssh.authorizedKeys.keys = flake.config.people.users.${user0}.sshKeys;
services = {
opencloud = {
enable = true;
url = "https://${host}";
port = 9200;
address = "0.0.0.0";
stateDir = "/var/lib/${serviceCfg.name}";
environmentFile = "/run/secrets/${user}-env";
};
openssh = {
enable = true;
settings = {
PasswordAuthentication = false;
PermitRootLogin = "prohibit-password";
};
};
};
networking.firewall.allowedTCPPorts = [
22
587
9200
];
systemd = {
services = {
systemd-networkd.wantedBy = [ "multi-user.target" ];
opencloud = {
path = [ pkgs.inotify-tools ];
};
opencloud-fix-permissions = {
description = "Fix OpenCloud storage permissions";
after = [ "opencloud.service" ];
serviceConfig = {
Type = "oneshot";
ExecStart = pkgs.writeShellScript "fix-perms" ''
echo "Starting permission fix..."
OPENCLOUD_UID=$(id -u opencloud)
echo "OpenCloud UID: $OPENCLOUD_UID"
find /var/lib/opencloud/storage/users -type f ! -uid "$OPENCLOUD_UID" 2>/dev/null | while read -r file; do
echo "Fixing file: $file"
chown opencloud:opencloud "$file" 2>/dev/null || true
done
find /var/lib/opencloud/storage/users -type d ! -uid "$OPENCLOUD_UID" 2>/dev/null | while read -r dir; do
echo "Fixing dir: $dir"
chown opencloud:opencloud "$dir" 2>/dev/null || true
done
echo "Permission fix complete"
'';
User = "root";
};
};
};
timers.opencloud-fix-permissions = {
description = "Periodically fix OpenCloud storage permissions";
wantedBy = [ "timers.target" ];
timerConfig = {
OnBootSec = "30s";
OnUnitActiveSec = "2min";
Unit = "opencloud-fix-permissions.service";
};
};
network = {
enable = true;
networks."20-lan" = {
matchConfig.Name = "enp0s6";
addresses = [
{ Address = "${ip}/24"; }
];
routes = [
{
Destination = "0.0.0.0/0";
Gateway = "192.168.50.1";
}
];
dns = [
"1.1.1.1"
"8.8.8.8"
];
};
};
tmpfiles.rules = [
"d /var/lib/${serviceCfg.name} 0755 ${serviceCfg.name} ${serviceCfg.name} -"
"z /etc/opencloud 0700 ${serviceCfg.name} ${serviceCfg.name} -"
];
};
microvm = {
vcpu = 1;
mem = 512;
hypervisor = "qemu";
interfaces = [
{
type = "tap";
id = "vm-oc-${user}";
mac = mac;
}
{
type = "user";
id = "vmuser-cloud";
mac = userMac;
}
];
forwardPorts = [
{
from = "host";
host.port = ssh;
guest.port = 22;
}
];
shares = [
{
mountPoint = "/nix/.ro-store";
proto = "virtiofs";
source = "/nix/store";
tag = "read_only_nix_store";
}
{
mountPoint = "/var/lib/${serviceCfg.name}";
proto = "virtiofs";
source = "/mnt/storage/users/${user}/guests/${serviceCfg.name}/data";
tag = "${serviceCfg.name}_${user}_data";
}
{
mountPoint = "/etc/${serviceCfg.name}";
proto = "virtiofs";
source = "/mnt/storage/users/${user}/guests/${serviceCfg.name}/config";
tag = "${serviceCfg.name}_${user}_config";
}
{
mountPoint = "/run/secrets";
proto = "virtiofs";
source = "/run/secrets/${serviceCfg.name}";
tag = "host_secrets";
}
];
};
environment.systemPackages = builtins.attrValues {
inherit (pkgs)
inotify-tools
opencloud
;
};
};
};
};
systemd.tmpfiles.rules = [
"d /mnt/storage/users/${user}/guests/${serviceCfg.name} 0751 microvm wheel - -"
"d /mnt/storage/users/${user}/guests/${serviceCfg.name}/config 0751 microvm wheel - -"
"d /mnt/storage/users/${user}/guests/${serviceCfg.name}/data 0751 microvm wheel - -"
];
sops.secrets = {
"${serviceCfg.name}/${user}-env" = {
owner = "root";
mode = "0600";
};
};
};
}