mirrors_public/oddlama_nix-config
1
1
Fork 1
mirror of https://github.com/oddlama/nix-config.git synced 2025-10-10 23:00:39 +02:00
Code Activity

feat: finish vlan setup

Browse source
This commit is contained in:
oddlama 2024-12-20 01:05:17 +01:00
parent d0448757bf
commit 297d19fa0c
No known key found for this signature in database
GPG key ID: 14EFE510775FE39A
16 changed files with 115 additions and 100 deletions
Download patch file Download diff file Expand all files Collapse all files

30
hosts/sire/guests/grafana.nix
View file

@ -65,12 +65,13 @@ in
group = "influxdb2";
};
services.influxdb2.provision.organizations.machines.auths."grafana machines:telegraf (${config.node.name})" = {
readBuckets = [ "telegraf" ];
writeBuckets = [ "telegraf" ];
tokenFile =
nodes.sire-influxdb.config.age.secrets."grafana-influxdb-token-machines-${config.node.name}".path;
};
services.influxdb2.provision.organizations.machines.auths."grafana machines:telegraf (${config.node.name})" =
{
readBuckets = [ "telegraf" ];
writeBuckets = [ "telegraf" ];
tokenFile =
nodes.sire-influxdb.config.age.secrets."grafana-influxdb-token-machines-${config.node.name}".path;
};
age.secrets."grafana-influxdb-token-home-${config.node.name}" = {
inherit (config.age.secrets.grafana-influxdb-token-home) rekeyFile;
@ -78,12 +79,13 @@ in
group = "influxdb2";
};
services.influxdb2.provision.organizations.home.auths."grafana home:home_assistant (${config.node.name})" = {
readBuckets = [ "home_assistant" ];
writeBuckets = [ "home_assistant" ];
tokenFile =
nodes.sire-influxdb.config.age.secrets."grafana-influxdb-token-home-${config.node.name}".path;
};
services.influxdb2.provision.organizations.home.auths."grafana home:home_assistant (${config.node.name})" =
{
readBuckets = [ "home_assistant" ];
writeBuckets = [ "home_assistant" ];
tokenFile =
nodes.sire-influxdb.config.age.secrets."grafana-influxdb-token-home-${config.node.name}".path;
};
};
globals.services.grafana.domain = grafanaDomain;
@ -144,8 +146,8 @@ in
proxyWebsockets = true;
};
extraConfig = ''
allow ${globals.net.home-lan.cidrv4};
allow ${globals.net.home-lan.cidrv6};
allow ${globals.net.home-lan.vlans.services.cidrv4};
allow ${globals.net.home-lan.vlans.services.cidrv6};
deny all;
'';
};

4
hosts/sire/guests/immich.nix
View file

@ -249,8 +249,8 @@ in
proxy_read_timeout 600s;
proxy_send_timeout 600s;
send_timeout 600s;
allow ${globals.net.home-lan.cidrv4};
allow ${globals.net.home-lan.cidrv6};
allow ${globals.net.home-lan.vlans.services.cidrv4};
allow ${globals.net.home-lan.vlans.services.cidrv6};
deny all;
'';
};

4
hosts/sire/guests/paperless.nix
View file

@ -79,8 +79,8 @@ in
useACMEWildcardHost = true;
extraConfig = ''
client_max_body_size 512M;
allow ${globals.net.home-lan.cidrv4};
allow ${globals.net.home-lan.cidrv6};
allow ${globals.net.home-lan.vlans.services.cidrv4};
allow ${globals.net.home-lan.vlans.services.cidrv6};
deny all;
'';
locations."/" = {

7
hosts/sire/guests/samba.nix
View file

@ -148,9 +148,9 @@ in
};
globals.monitoring.tcp.samba = {
host = globals.net.home-lan.hosts.sire-samba.ipv4;
host = globals.net.home-lan.vlans.services.hosts.sire-samba.ipv4;
port = 445;
network = "home-lan";
network = "home-lan.vlans.services";
};
services.samba = {
@ -179,7 +179,8 @@ in
# Deny access to all hosts by default.
"hosts deny" = "0.0.0.0/0";
# Allow access to local network and TODO: wireguard
"hosts allow" = "${globals.net.home-lan.cidrv4} ${globals.net.home-lan.cidrv6}";
"hosts allow" =
"${globals.net.home-lan.vlans.services.cidrv4} ${globals.net.home-lan.vlans.services.cidrv6}";
# Don't advertise inaccessible shares to users
"access based share enum" = "yes";