Simon Bruder
816004e80b
This implements a crude mechanism for signalling my router to add the packets to its own qdisc. The way in which this is implemented with nftables is hacky because of NixOS’ limitations on build-time checking (which obviously can’t know about the existence of cgroups on the target).
56 lines
1.2 KiB
Nix
56 lines
1.2 KiB
Nix
{ config, lib, pkgs, ... }:
|
|
{
|
|
imports = [
|
|
./hardware-configuration.nix
|
|
../../modules
|
|
../../users/simon
|
|
|
|
./services/languagetool.nix
|
|
./services/media-backup.nix
|
|
./services/media.nix
|
|
./services/photoprism.nix
|
|
./services/torrent.nix
|
|
];
|
|
|
|
sbruder = {
|
|
wireguard.home.enable = true;
|
|
nginx.hardening.enable = true;
|
|
restic.system = {
|
|
enable = true;
|
|
qos = true;
|
|
extraPaths = [
|
|
"/data"
|
|
];
|
|
extraExcludes = [
|
|
"/data/cold/media/video"
|
|
"/data/cold/misc"
|
|
"/data/cold/torrent"
|
|
"/data/hot/torrent"
|
|
"/data/media/video"
|
|
"/data/torrent"
|
|
];
|
|
prune = true;
|
|
};
|
|
unfree.allowSoftware = true;
|
|
};
|
|
|
|
services.nginx = {
|
|
enable = true;
|
|
|
|
recommendedGzipSettings = true;
|
|
recommendedOptimisation = true;
|
|
recommendedProxySettings = true;
|
|
recommendedTlsSettings = true;
|
|
};
|
|
networking.firewall.allowedTCPPorts = [ 80 443 ];
|
|
systemd.services.nginx.serviceConfig.SupplementaryGroups = lib.singleton "keys";
|
|
|
|
services.syncthing.enable = true;
|
|
|
|
services.udisks2.enable = true; # does not have gui, but often deals with removable storage
|
|
|
|
networking.hostName = "fuuko";
|
|
|
|
system.stateVersion = "20.09";
|
|
}
|