Lucas/Homelab
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Reorganization

Browse source
This commit is contained in:
Lucas Thelen 2025-10-04 00:49:49 +00:00
parent 2821a76450
commit aa3b8519f9
21 changed files with 241 additions and 204 deletions
Download patch file Download diff file Expand all files Collapse all files

28
CLAUDE.md
View file

@ -23,25 +23,34 @@ This is a NixOS homelab configuration using Nix flakes. The setup includes a sel
### Flake Structure
- `flake.nix` - Main flake definition with inputs (nixpkgs, agenix, personal site)
- `configuration.nix` - Default NixOS configuration (mostly commented out)
- `system.nix` - System-level settings (boot, power management)
- `packages.nix` - System packages (neovim, git, tools)
- `users.nix` - User configuration for lucas user with fish shell
- `configuration.nix` - Legacy configuration (minimal, contains system.stateVersion)
### Modular Organization
- `networking/` - Network configuration modules
- `config/` - Shared configuration options
- `common.nix` - Common options used across modules (domain, user, networking, etc.)
- `modules/core/` - Core system functionality
- `boot.nix` - Boot loader and Nix settings
- `server-power.nix` - Server power management (disable sleep/hibernation)
- `packages.nix` - System packages (neovim, git, tools)
- `modules/hardware/` - Hardware-specific configurations
- `hardware-configuration.nix` - Hardware scan results
- `modules/users/` - User management
- `lucas.nix` - User configuration with fish shell and multimedia group
- `modules/networking/` - Network configuration modules
- `host.nix` - Static IP, firewall, Avahi discovery
- `ssh.nix` - SSH daemon configuration
- `adblock.nix` - Ad blocking setup
- `vpn-host.nix` - Tailscale VPN with auto-connect
- `services/` - Service modules
- `modules/services/` - Service modules
- `jellyfin.nix` - Media server with Deluge torrent client
- `site.nix` - Nginx reverse proxy, ACME SSL, Route53 DDNS
- `forgejo.nix` - Git server
- `calibre-web.nix` - Ebook server
### Secret Management
- Uses agenix for encrypted secrets
- `secrets/aws.age` - AWS credentials for Route53 updates
- `tailscale.age` - Tailscale authentication key
- `secrets/tailscale.age` - Tailscale authentication key
### Key Services
- **Jellyfin**: Media server on port 8096, proxied via jellyfin.per-aspera.space
@ -60,6 +69,9 @@ This is a NixOS homelab configuration using Nix flakes. The setup includes a sel
- System is configured as a server (no hibernation/suspend)
- Uses systemd-boot EFI bootloader
- Multimedia group for media file permissions at /data/media
- Modular configuration with shared options in `config/common.nix`
- Decoupled modules reduce hard-coded dependencies
- Fish shell is the default for the lucas user
- ACME certificates automatically managed for per-aspera.space domain
- Use `nix flake check` and `nix flake build` to test building without having to do nixos-rebuild
- New files will need to be tracked by `git add` to be able to be used by nix flakes

72
config/common.nix Normal file
View file

@ -0,0 +1,72 @@
# Common configuration options used across modules
{ lib, ... }:
{
options.homelab = {
domain = lib.mkOption {
type = lib.types.str;
default = "per-aspera.space";
description = "Primary domain for the homelab";
};
user = lib.mkOption {
type = lib.types.str;
default = "lucas";
description = "Primary user for the homelab";
};
networking = {
interface = lib.mkOption {
type = lib.types.str;
default = "enp0s31f6";
description = "Primary network interface";
};
staticIP = lib.mkOption {
type = lib.types.str;
default = "192.168.0.10";
description = "Static IP address";
};
gateway = lib.mkOption {
type = lib.types.str;
default = "192.168.0.1";
description = "Default gateway";
};
nameservers = lib.mkOption {
type = lib.types.listOf lib.types.str;
default = [ "205.171.3.25" "8.8.8.8" ];
description = "DNS nameservers";
};
};
aws = {
hostedZoneId = lib.mkOption {
type = lib.types.str;
default = "Z09728753LLLNSYFXIBIM";
description = "AWS Route53 hosted zone ID";
};
};
mediaGroup = lib.mkOption {
type = lib.types.str;
default = "multimedia";
description = "Group name for media access";
};
};
# Set default configuration values
config.homelab = {
domain = "per-aspera.space";
user = "lucas";
networking = {
interface = "enp0s31f6";
staticIP = "192.168.0.10";
gateway = "192.168.0.1";
nameservers = [ "205.171.3.25" "8.8.8.8" ];
};
aws.hostedZoneId = "Z09728753LLLNSYFXIBIM";
mediaGroup = "multimedia";
};
}

118
configuration.nix
View file

@ -1,119 +1,9 @@
# Edit this configuration file to define what should be installed on
# your system. Help is available in the configuration.nix(5) man page, on
# https://search.nixos.org/options and in the NixOS manual (`nixos-help`).
# Legacy configuration.nix - most functionality moved to modules
{ config, lib, pkgs, ... }:
{
imports = [ # Include the results of the hardware scan.
./hardware-configuration.nix
];
# Use the systemd-boot EFI boot loader.
boot.loader.systemd-boot.enable = true;
boot.loader.efi.canTouchEfiVariables = true;
# networking.hostName = "nixos"; # Define your hostname.
# Pick only one of the below networking options.
# networking.wireless.enable = true; # Enables wireless support via wpa_supplicant.
# networking.networkmanager.enable = true; # Easiest to use and most distros use this by default.
# Set your time zone.
# time.timeZone = "Europe/Amsterdam";
# Configure network proxy if necessary
# networking.proxy.default = "http://user:password@proxy:port/";
# networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";
# Select internationalisation properties.
# i18n.defaultLocale = "en_US.UTF-8";
# console = {
# font = "Lat2-Terminus16";
# keyMap = "us";
# useXkbConfig = true; # use xkb.options in tty.
# };
# Enable the X11 windowing system.
# services.xserver.enable = true;
# Configure keymap in X11
# services.xserver.xkb.layout = "us";
# services.xserver.xkb.options = "eurosign:e,caps:escape";
# Enable CUPS to print documents.
# services.printing.enable = true;
# Enable sound.
# services.pulseaudio.enable = true;
# OR
# services.pipewire = {
# enable = true;
# pulse.enable = true;
# };
# Enable touchpad support (enabled default in most desktopManager).
# services.libinput.enable = true;
# Define a user account. Don't forget to set a password with ‘passwd’.
# users.users.alice = {
# isNormalUser = true;
# extraGroups = [ "wheel" ]; # Enable ‘sudo’ for the user.
# packages = with pkgs; [
# tree
# ];
# };
# programs.firefox.enable = true;
# List packages installed in system profile.
# You can use https://search.nixos.org/ to find more packages (and options).
# environment.systemPackages = with pkgs; [
# vim # Do not forget to add an editor to edit configuration.nix! The Nano editor is also installed by default.
# wget
# ];
# Some programs need SUID wrappers, can be configured further or are
# started in user sessions.
# programs.mtr.enable = true;
# programs.gnupg.agent = {
# enable = true;
# enableSSHSupport = true;
# };
# List services that you want to enable:
# Enable the OpenSSH daemon.
# services.openssh.enable = true;
# Open ports in the firewall.
# networking.firewall.allowedTCPPorts = [ ... ];
# networking.firewall.allowedUDPPorts = [ ... ];
# Or disable the firewall altogether.
# networking.firewall.enable = false;
# Copy the NixOS configuration file and link it from the resulting system
# (/run/current-system/configuration.nix). This is useful in case you
# accidentally delete configuration.nix.
# system.copySystemConfiguration = true;
# This option defines the first version of NixOS you have installed on this particular machine,
# and is used to maintain compatibility with application data (e.g. databases) created on older NixOS versions.
#
# Most users should NEVER change this value after the initial install, for any reason,
# even if you've upgraded your system to a new NixOS release.
#
# This value does NOT affect the Nixpkgs version your packages and OS are pulled from,
# so changing it will NOT upgrade your system - see https://nixos.org/manual/nixos/stable/#sec-upgrading for how
# to actually do that.
#
# This value being lower than the current NixOS release does NOT mean your system is
# out of date, out of support, or vulnerable.
#
# Do NOT change this value unless you have manually inspected all the changes it would make to your configuration,
# and migrated your data accordingly.
#
# For more information, see `man configuration.nix` or https://nixos.org/manual/nixos/stable/options#opt-system.stateVersion .
system.stateVersion = "25.05"; # Did you read the comment?
# This value defines the first version of NixOS you have installed on this particular machine.
# Do NOT change this value unless you have manually inspected all the changes it would make.
system.stateVersion = "25.05";
}

42
flake.nix
View file

@ -18,22 +18,40 @@
specialArgs = { inherit inputs; };
modules = [
# Common configuration options
./config/common.nix
# External modules
agenix.nixosModules.default
./system.nix
# Core system modules
./modules/core/boot.nix
./modules/core/server-power.nix
./modules/core/packages.nix
# Hardware
./modules/hardware/hardware-configuration.nix
# Users
./modules/users/lucas.nix
# Networking
./modules/networking/host.nix
./modules/networking/ssh.nix
./modules/networking/adblock.nix
./modules/networking/vpn-host.nix
# Services
./modules/services/jellyfin.nix
./modules/services/site.nix
./modules/services/forgejo.nix
./modules/services/calibre-web.nix
# Legacy configuration and secrets
./configuration.nix
./hardware-configuration.nix
./networking/host.nix
./packages.nix
./users.nix
./networking/ssh.nix
./networking/adblock.nix
./networking/vpn-host.nix
./services/jellyfin.nix
./services/site.nix
./services/forgejo.nix
{
environment.systemPackages = [ agenix.packages.x86_64-linux.default ];
age.secrets.tailscale.file = ./tailscale.age;
age.secrets.tailscale.file = ./secrets/tailscale.age;
age.secrets.aws.file = ./secrets/aws.age;
nixpkgs.config.allowUnfree = true;
}

11
modules/core/boot.nix Normal file
View file

@ -0,0 +1,11 @@
# Boot configuration
{ config, lib, pkgs, ... }:
{
# Use the systemd-boot EFI boot loader
boot.loader.systemd-boot.enable = true;
boot.loader.efi.canTouchEfiVariables = true;
# Enable flakes
nix.settings.experimental-features = [ "nix-command" "flakes" ];
}

5
packages.nix → modules/core/packages.nix
View file

@ -1,4 +1,7 @@
{ config, lib, pkgs, ... }: {
# System-wide packages
{ config, lib, pkgs, ... }:
{
environment.systemPackages = with pkgs; [
neovim
vimPlugins.LazyVim

15
modules/core/server-power.nix Normal file
View file

@ -0,0 +1,15 @@
# Server power management - disable sleep/hibernation
{ config, lib, pkgs, ... }:
{
# Don't turn off when lid is closed (for laptop servers)
services.logind.lidSwitchExternalPower = "ignore";
# Disable all sleep modes - this is a server!
systemd.sleep.extraConfig = ''
AllowSuspend=no
AllowHibernation=no
AllowHybridSleep=no
AllowSuspendThenHibernate=no
'';
}

0
hardware-configuration.nix → modules/hardware/hardware-configuration.nix
View file

0
networking/adblock.nix → modules/networking/adblock.nix
View file

16
networking/host.nix → modules/networking/host.nix
View file

@ -1,4 +1,7 @@
{ config, lib, pkgs, ... }: {
# Network host configuration with static IP and Avahi discovery
{ config, lib, pkgs, ... }:
{
services.avahi = {
enable = true;
nssmdns4 = true;
@ -11,24 +14,23 @@
};
networking = {
nameservers = [ "205.171.3.25" "8.8.8.8" ];
nameservers = config.homelab.networking.nameservers;
enableIPv6 = false;
# Avahi port
firewall.allowedUDPPorts = [ 5353 ];
hostName = "homelab";
interfaces.enp0s31f6 = {
interfaces.${config.homelab.networking.interface} = {
ipv4.addresses = [{
address = "192.168.0.10";
address = config.homelab.networking.staticIP;
prefixLength = 24;
}];
};
defaultGateway = {
address = "192.168.0.1";
interface = "enp0s31f6";
address = config.homelab.networking.gateway;
interface = config.homelab.networking.interface;
};
};
}

0
networking/ssh.nix → modules/networking/ssh.nix
View file

0
networking/vpn-host.nix → modules/networking/vpn-host.nix
View file

25
modules/services/calibre-web.nix Normal file
View file

@ -0,0 +1,25 @@
{ pkgs, ... }: {
users.users.lucas.extraGroups = [ "multimedia" ];
networking.firewall.allowedTCPPorts = [ 8083 ];
systemd.tmpfiles.rules = [
"d /data/calibre 0770 - multimedia - -"
"d /data/calibre/library 0770 - multimedia - -"
"d /data/calibre/config 0770 - multimedia - -"
];
services.calibre-web = {
enable = true;
listen = {
ip = "0.0.0.0";
port = 8083;
};
options = { calibreLibrary = "/data/calibre/library"; };
user = "calibre-web";
group = "multimedia";
};
environment.systemPackages = with pkgs; [ calibre ];
}

0
services/forgejo.nix → modules/services/forgejo.nix
View file

29
modules/services/jellyfin.nix Normal file
View file

@ -0,0 +1,29 @@
# Jellyfin media server with Deluge torrent client
{ config, pkgs, ... }:
{
systemd.tmpfiles.rules = [
"d /data - - - - -"
"d /data/media 0770 - ${config.homelab.mediaGroup} - -"
"d /data/shows 0770 - ${config.homelab.mediaGroup} - -"
];
services.jellyfin = {
enable = true;
openFirewall = true;
group = config.homelab.mediaGroup;
};
environment.systemPackages = with pkgs; [
jellyfin
jellyfin-web
jellyfin-ffmpeg
];
services.deluge = {
enable = true;
web.enable = true;
web.openFirewall = true;
group = config.homelab.mediaGroup;
};
}

5
services/site.nix → modules/services/site.nix
View file

@ -1,7 +1,8 @@
# Website hosting with Nginx reverse proxy and Route53 DDNS
{ config, pkgs, inputs, lib, ... }:
let
domain = "per-aspera.space";
hostedZoneId = "Z09728753LLLNSYFXIBIM";
domain = config.homelab.domain;
hostedZoneId = config.homelab.aws.hostedZoneId;
# Configurable list of DNS records to update
dnsRecords = [

17
modules/users/lucas.nix Normal file
View file

@ -0,0 +1,17 @@
# User configuration for lucas
{ config, lib, pkgs, ... }:
{
programs.fish.enable = true;
users.users.${config.homelab.user} = {
isNormalUser = true;
extraGroups = [ "wheel" config.homelab.mediaGroup ];
shell = pkgs.fish;
packages = with pkgs; [ eza claude-code ];
hashedPassword = "$6$X.mw03yY/VFjDThj$t1I68HZz6NBihZGhiJ6Ct8ZuOufX6ZX9pydnK4puTjT1XKfMO1FY5VL1DwywJHrXOEJtohV99TmrABfjdBQY21";
};
# Create multimedia group for media services
users.groups.${config.homelab.mediaGroup} = { };
}

0
tailscale.age → secrets/tailscale.age
View file

26
services/jellyfin.nix
View file

@ -1,26 +0,0 @@
{ pkgs, ... }: {
users.groups.multimedia = { };
users.users.lucas.extraGroups = [ "multimedia" ];
systemd.tmpfiles.rules =
[ "d /data - - - - -" "d /data/media 0770 - multimedia - -" ];
services.jellyfin = {
enable = true;
openFirewall = true;
group = "multimedia";
};
environment.systemPackages = with pkgs; [
jellyfin
jellyfin-web
jellyfin-ffmpeg
];
services.deluge = {
enable = true;
web.enable = true;
web.openFirewall = true;
group = "multimedia";
};
}

17
system.nix
View file

@ -1,17 +0,0 @@
{ config, lib, pkgs, ... }: {
# System boots
boot.loader.systemd-boot.enable = true;
boot.loader.efi.canTouchEfiVariables = true;
nix.settings.experimental-features = [ "nix-command" "flakes" ];
# Don't turn off when lid is closed
services.logind.lidSwitchExternalPower = "ignore";
# Don't hybernate. You're a server!
systemd.sleep.extraConfig = ''
AllowSuspend=no
AllowHibernation=no
AllowHybridSleep=no
AllowSuspendThenHibernate=no
'';
}

15
users.nix
View file

@ -1,15 +0,0 @@
{ config, lib, pkgs, ... }: {
programs.fish.enable = true;
users.users.lucas = {
isNormalUser = true;
extraGroups = [ "wheel" ];
shell = pkgs.fish;
packages = with pkgs; [ eza claude-code ];
hashedPassword =
"$6$X.mw03yY/VFjDThj$t1I68HZz6NBihZGhiJ6Ct8ZuOufX6ZX9pydnK4puTjT1XKfMO1FY5VL1DwywJHrXOEJtohV99TmrABfjdBQY21";
};
}