path: root/configuration.nix

# Edit this configuration file to define what should be installed on
# your system.  Help is available in the configuration.nix(5) man page
# and in the NixOS manual (accessible by running ‘nixos-help’).

{ config, pkgs, ... }:

{
  imports =
    [ # Include the results of the hardware scan.
      ./hardware-configuration.nix
      ./cgit.nix
    ];
  services.xserver.videoDrivers = [ "nvidia" ];
  hardware.opengl.enable = true;

  # Use the systemd-boot EFI boot loader.
  boot.loader.systemd-boot.enable = true;
  boot.loader.efi.canTouchEfiVariables = true;
  boot.supportedFilesystems = ["zfs"];
  boot.zfs.forceImportRoot = false;
  boot.zfs.extraPools = ["pool"];
  services.zfs.autoScrub.enable = true;

  networking.hostName = "vandoorn-server"; # Define your hostname.
  networking.hostId = "0f647db6";
  # networking.wireless.enable = true;  # Enables wireless support via wpa_supplicant.

  # Set your time zone.
  time.timeZone = "America/Pacific";

  # The global useDHCP flag is deprecated, therefore explicitly set to false here.
  # Per-interface useDHCP will be mandatory in the future, so this generated config
  # replicates the default behaviour.
  networking.useDHCP = false;
  networking.interfaces.enp7s0.useDHCP = true;

  # Configure network proxy if necessary
  # networking.proxy.default = "http://user:password@proxy:port/";
  # networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";

  # Select internationalisation properties.
  # i18n.defaultLocale = "en_US.UTF-8";
  # console = {
  #   font = "Lat2-Terminus16";
  #   keyMap = "us";
  # };

  # Enable the X11 windowing system.
  # services.xserver.enable = true;

  # Configure keymap in X11
  # services.xserver.layout = "us";
  # services.xserver.xkbOptions = "eurosign:e";

  # Enable CUPS to print documents.
  # services.printing.enable = true;

  # Enable sound.
  # sound.enable = true;
  # hardware.pulseaudio.enable = true;

  # Enable touchpad support (enabled default in most desktopManager).
  # services.xserver.libinput.enable = true;

  # Define a user account. Don't forget to set a password with ‘passwd’.
  users.users.nick = {
    isNormalUser = true;
    group = "nick";
    extraGroups = [ "wheel" ]; # Enable ‘sudo’ for the user.
  };

  users.users.peter = {
    isNormalUser = true;
  };

  # List packages installed in system profile. To search, run:
  # $ nix search wget
  environment.systemPackages = with pkgs; [
     dos2unix
     tailscale
     python3
     wget
     inetutils
     vim
     lm_sensors
     lshw
     ngrok
     flac
     lame
     imagemagick
     neofetch
     ffmpeg
     htop
     parted
     tree
     firefox
     smartmontools
     config.services.samba.package
     git
     unzip
     nodejs-16_x
     libstdcxx5
     cgit
     rclone
  ];

  # Some programs need SUID wrappers, can be configured further or are
  # started in user sessions.
  # programs.mtr.enable = true;
  # programs.gnupg.agent = {
  #   enable = true;
  #   enableSSHSupport = true;
  # };

  # List services that you want to enable:

  # Enable the OpenSSH daemon.
  services.openssh.enable = true;
  services.openssh.permitRootLogin = "no";
  services.openssh.passwordAuthentication = false;


  networking.firewall.enable = true;
  networking.firewall.checkReversePath = "loose";
  networking.firewall.allowedTCPPorts = [
    6789 # nzbget
    6595 # deemix
    548  # AFP
    80   # nginx
  ];
  networking.firewall.allowPing = true;

  services.cron = {
    enable = true;
    systemCronJobs = [
      # Scrub MDADM RAIDs the first of every month
      "0 0 1 * *     root    echo repair > /sys/block/md126/md/sync_action"
      "0 0 1 * *     root    echo repair > /sys/block/md127/md/sync_action"
      # Sync home folder back to old drives every night
      "0 0 * * *     root    ./home/nick/sync-home.sh"
    ];
  };

  services = {
      netatalk = {
        enable = true;

        settings = {
          "home" = {
            path = "/mnt/pool/home";
            "valid users" = "nick";
          };
          "media-libraries" = {
            path = "/mnt/pool/media/libraries";
            "valid users" = "nick";
          };
        };
      };

      avahi = {
        openFirewall = true;
        enable = true;
        nssmdns = true;

        publish = {
          enable = true;
          userServices = true;
        };
      };
    };

  services.samba = {
    enable = true;
    securityType = "user";
    openFirewall = true;
    extraConfig = ''
      server role = standalone server
      workgroup = WORKGROUP
      server string = vandoorn-server
      netbios name = vandoorn-server
      security = user
      guest account = nobody
      map to guest = bad user
      wide links = yes
      unix extensions = no
      follow symlinks = yes
    '';
    shares = {
      media-libraries = {
        path = "/mnt/pool/media/libraries";
        browseable = "yes";
        "valid users" = ["nick" "peter"];
        "read only" = "no";
        "guest ok" = "no";
        "create mask" = "0644";
        "directory mask" = "0755";
      };
      home = {
        path = "/mnt/pool/home";
        browseable = "yes";
        "valid users" = ["nick" "peter"];
        "read only" = "no";
        "guest ok" = "no";
        "create mask" = "0644";
        "directory mask" = "0755";
      };
      downloads = {
        path = "/mnt/pool/media/downloads";
        browseable = "yes";
        "valid users" = ["nick"];
        "read only" = "no";
        "guest ok" = "no";
        "create mask" = "0644";
        "directory mask" = "0755";
      };

    };
  };
  services.tailscale.enable = true;

  programs.msmtp = {
    enable = true;
    setSendmail = true;
    defaults = {
      aliases = "/etc/aliases";
      port = 465;
      tls_trust_file = "/etc/ssl/certs/ca-certificates.crt";
      tls = "on";
      auth = "login";
      tls_starttls = "off";
    };
    accounts = {
      default = {
        auth = true;
        tls = true;
        # try setting `tls_starttls` to `false` if sendmail hangs
        tls_starttls = false;
        from = "homeserver@nvandoorn.com";
        host = "smtp.fastmail.com";
        user = "nick@nv.delivery";
        passwordeval = "cat /home/nick/secrets/smtp_password.txt";
      };
    };
  };

  services.smartd = {
    enable = true;
    autodetect = true;
    notifications = {
      mail = {
        enable = true;
      };
      test = true;
    };
  };

  users.groups.git.members = [
    "git"
    "nick"
  ];
  users.groups.nick.members = [
    "nick"
  ];
  users.groups.media.members = [
    "deluge"
    "sonarr"
    "radarr"
    "nzbget"
    "deemix"
  ];
  users.groups.family.members = [
    "nick"
    "peter"
  ];

  services.nzbget.enable = true;
  services.nzbget.group = "media";

  services.deluge.enable = true;
  services.deluge.group = "media";
  services.deluge.web.enable = true;
  services.deluge.web.openFirewall = true;

  services.radarr.enable = true;
  services.radarr.group = "media";
  services.radarr.openFirewall = true;

  services.sonarr.enable = true;
  services.sonarr.group = "media";
  services.sonarr.openFirewall = true;

  services.jellyfin.enable = true;
  services.jellyfin.openFirewall = true;

  services.plex = let
      master = import
          (builtins.fetchTarball https://github.com/nixos/nixpkgs/tarball/master)
          { config = config.nixpkgs.config; };
  in {
      enable = true;
      openFirewall = true;
      package = master.plex;
  };

  users.users.deemix = {
    isSystemUser = true;
    group = "media";
    home = "/var/lib/deemix";
  };

  users.users.git = {
    isSystemUser = true;
    group = "git";
  };

  systemd.services.deemix = {
    description = "Deemix";
    after = [ "network.target" ];
    wantedBy = [ "multi-user.target" ];

    serviceConfig = {
      Type = "simple";
      User = "deemix";
      Group = "media";
      ExecStart = "${pkgs.nodejs-16_x}/bin/node ${pkgs.callPackage ./deemix.nix {}}/server/dist/app.js --host 0.0.0.0";
      Environment = "DEEMIX_DATA_DIR=/var/lib/deemix/";
      Restart = "on-failure";
      UMask = "0002";
    };
  };

  services.fcgiwrap.enable = true;
  services.nginx.enable = true;
  security.acme.defaults.email = "vandoorn.nick@gmail.com";
  security.acme.acceptTerms = true;
  services.nginx.virtualHosts."localhost" = {
    cgit = {
      enable = true;
      virtual-root = "/";
      scan-path = "/srv/git";
      root-title = "nvd-git";
      root-desc = "Nicholas Van Doorn's home Git server";
      include = [
        (builtins.toFile "cgitrc-extra-2" ''
          enable-http-clone=1
        '')
      ];
    };
  };

  nixpkgs.config.allowUnfree = true;

  # This value determines the NixOS release from which the default
  # settings for stateful data, like file locations and database versions
  # on your system were taken. It‘s perfectly fine and recommended to leave
  # this value at the release version of the first install of this system.
  # Before changing this value read the documentation for this option
  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
  system.stateVersion = "20.09"; # Did you read the comment?
}