poweredge-pro initial configHEADmaster

7 files changed, 256 insertions, 0 deletions

diff --git a/hosts/poweredge-pro/configuration.nix b/hosts/poweredge-pro/configuration.nix
new file mode 100644
index 0000000..fc6b854
--- /dev/null
+++ b/hosts/poweredge-pro/configuration.nix
@@ -0,0 +1,34 @@
+{ config, lib, pkgs, ... }: {
+	imports = [
+		./key.nix
+		./networking.nix
+		./fileshares.nix
+	];
+
+	# Setup bootloader
+	boot._loader.enable = true;
+
+	# Enable common options
+	_archetypes = {
+		profiles = {
+			headless = {
+				enable = true;
+				home.users.timmy.enable = true;
+			};
+			zfs.enable = true;
+			#cuda.enable = true;
+		};
+		collections.virtualization.enable = true;
+	};
+
+	# Import zfs pools
+	boot.zfs.extraPools = [ "VMDisk" "Storage" ];
+
+	# Enable user timmy
+	_users.timmy.enable = true;
+
+	# Without this, "ZFS requires networking.hostId to be set" will be raised
+	networking.hostId = "2c7d6b03";
+
+	system.stateVersion = "26.05";
+}
diff --git a/hosts/poweredge-pro/fileshares.nix b/hosts/poweredge-pro/fileshares.nix
new file mode 100644
index 0000000..9d68e3d
--- /dev/null
+++ b/hosts/poweredge-pro/fileshares.nix
@@ -0,0 +1,84 @@
+{ config, ... }: {
+	# Configure services
+	services._fileShares = {
+		enable = true;
+		smb.openFirewall = true;
+		smb.enableUnixPasswordSync = true;
+		nfs.openFirewall = true;
+	};
+
+	# Configure share groups
+	users.groups.chexx.gid = 3000;
+	users.groups.scans.gid = 3003;
+
+	# Shares
+	services._fileShares.shares = {
+		chexx = {
+			path = "/Storage/chexx";
+			smb = {
+				enable = true;
+				allowGroup = "chexx";
+				defaultFileMask = "0664";
+				defaultDirectoryMask = "0775";
+			};
+			nfs.enable = true;
+		};
+		scans = {
+			path = "/Storage/Scans";
+			smb = {
+				enable = true;
+				allowGroup = "scans";
+				defaultFileMask = "0664";
+				defaultDirectoryMask = "0775";
+			};
+			nfs.enable = true;
+		};
+		dacs = {
+			path = "/Storage/Users/Dacs";
+			smb = {
+				enable = true;
+				allowUser = "dacs";
+			};
+		};
+		tk = {
+			path = "/home/timmy";
+			nfs.enable = true;
+		};
+	};
+
+	# Configure password secrets for users
+	sops.secrets.smb-initial-pass = { sopsFile = ./resources/secrets/initial-pass.yaml; key = "smb-initial-pass"; };
+	sops.secrets.user-hashed-pass = { sopsFile = ./resources/secrets/initial-pass.yaml; key = "user-hashed-pass"; };
+
+	# Configure users
+	users.users.timmy.extraGroups = [ "chexx" "scans" ];
+	users.users.dacs = {
+		enable = true;
+		isNormalUser = true;
+		extraGroups = [ "chexx" "scans" ];
+		hashedPasswordFile = config.sops.secrets.user-hashed-pass.path;
+		uid = 3001;
+	};
+	users.users.kyle = {
+		enable = true;
+		isNormalUser = true;
+		extraGroups = [ "chexx" "scans" ];
+		hashedPasswordFile = config.sops.secrets.user-hashed-pass.path;
+		uid = 3002;
+	};
+	users.users.scanner = {
+		enable = true;
+		isSystemUser = true;
+		group = "scans";
+		hashedPasswordFile = config.sops.secrets.user-hashed-pass.path;
+		uid = 3003;
+	};
+
+	# Configure user enrollment for samba
+	services._fileShares.smb.enrollUsers = {
+		timmy   = { enable = true; passwordFile = config.sops.secrets.smb-initial-pass.path; };
+		dacs    = { enable = true; passwordFile = config.sops.secrets.smb-initial-pass.path; };
+		kyle    = { enable = true; passwordFile = config.sops.secrets.smb-initial-pass.path; };
+		scanner = { enable = true; passwordFile = config.sops.secrets.smb-initial-pass.path; };
+	};
+}
diff --git a/hosts/poweredge-pro/hardware-configuration.nix b/hosts/poweredge-pro/hardware-configuration.nix
new file mode 100644
index 0000000..cbe1137
--- /dev/null
+++ b/hosts/poweredge-pro/hardware-configuration.nix
@@ -0,0 +1,50 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports =
+    [ (modulesPath + "/installer/scan/not-detected.nix")
+    ];
+
+  boot.initrd.availableKernelModules = [ "ahci" "ehci_pci" "megaraid_sas" "usb_storage" "usbhid" "sd_mod" "sr_mod" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-intel" ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" =
+    { device = "nixos/root";
+      fsType = "zfs";
+      options = [ "zfsutil" ];
+    };
+
+  fileSystems."/nix" =
+    { device = "nixos/nix";
+      fsType = "zfs";
+      options = [ "zfsutil" ];
+    };
+
+  fileSystems."/var" =
+    { device = "nixos/var";
+      fsType = "zfs";
+      options = [ "zfsutil" ];
+    };
+
+  fileSystems."/home" =
+    { device = "nixos/home";
+      fsType = "zfs";
+      options = [ "zfsutil" ];
+    };
+
+  fileSystems."/boot" =
+    { device = "/dev/disk/by-uuid/186A-32C6";
+      fsType = "vfat";
+      options = [ "fmask=0022" "dmask=0022" ];
+    };
+
+  swapDevices = [ ];
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+}
diff --git a/hosts/poweredge-pro/key.nix b/hosts/poweredge-pro/key.nix
new file mode 100644
index 0000000..f5074f2
--- /dev/null
+++ b/hosts/poweredge-pro/key.nix
@@ -0,0 +1,23 @@
+{
+	# Nixos root
+	boot.initrd.systemd.enable = true;  # Default since 26.05
+	boot.initrd.supportedFilesystems.ext4 = true;
+
+	boot.initrd.systemd.mounts = [{
+	  what = "/dev/disk/by-label/key";
+	  where = "/key";
+	  type = "ext4";
+	  options = "ro";
+	  unitConfig.DefaultDependencies = "no";
+	  before = [ "zfs-import-nixos.service" ];
+	  requiredBy = [ "zfs-import-nixos.service" ];
+	}];
+
+	# Storage
+	sops.secrets."zfs-key-storage" = {
+		sopsFile = ./resources/secrets/zfs-key.yaml;
+		key = "storage";
+		path = "/etc/zfs/keys/storage.key";
+		mode = "0400";
+	};
+}
diff --git a/hosts/poweredge-pro/networking.nix b/hosts/poweredge-pro/networking.nix
new file mode 100644
index 0000000..1debc03
--- /dev/null
+++ b/hosts/poweredge-pro/networking.nix
@@ -0,0 +1,32 @@
+{
+	networking = {
+		useDHCP = false;
+		# Label lan and wan interfaces
+		_interfaceLabels = {
+			enable = true;
+			interfaces.mgmt0 = "44:a8:42:35:b7:09";
+			interfaces.lan0  = "44:a8:42:35:b7:0a";
+			interfaces.wan0  = "44:a8:42:35:b7:0b";
+			interfaces.lan1  = "44:a8:42:35:b7:0c";
+		};
+		# Create bridges
+		bridges = {
+			br-lan0.interfaces = [ "lan0" ];
+			br-wan0.interfaces = [ "wan0" ];
+			br-lan1.interfaces = [ "lan1" ];
+		};
+		interfaces.br-lan0.useDHCP = false;
+		interfaces.br-wan0.useDHCP = false;
+		interfaces.br-lan1.useDHCP = false;
+		# Setup mgmt0
+		interfaces.mgmt0.ipv4.addresses = [{
+			address = "192.168.77.11";
+			prefixLength = 24;
+		}];
+		defaultGateway = "192.168.77.1";
+		nameservers = [ "192.168.77.1" ];
+		# Firewall for vms
+		firewall.interfaces.mgmt0.allowedTCPPorts = [ 5900 5901 ];
+
+	};
+}
diff --git a/hosts/poweredge-pro/resources/secrets/initial-pass.yaml b/hosts/poweredge-pro/resources/secrets/initial-pass.yaml
new file mode 100644
index 0000000..a25a87d
--- /dev/null
+++ b/hosts/poweredge-pro/resources/secrets/initial-pass.yaml
@@ -0,0 +1,17 @@
+smb-initial-pass: ENC[AES256_GCM,data:+KANYy3NLfBQMA==,iv:sqd5D4wBldOZ5FSjzDLi75JpMMGD7HX//UZr6R9rCjU=,tag:ElnYlqFTjMLdR//7jm405w==,type:str]
+user-hashed-pass: ENC[AES256_GCM,data:YG51p0bCuOt1PslbeX3H9unN6FovZTL9GIZeyf4aPZXlhCdrhH9OOFTMOWRskQqyWShwATO5HY/XYzP5mVk+ljvMumK5OEsBYg==,iv:6Z6DKB0cBHt+rbW6t0nrj3uFhIdJzcMZX3Qt1FZpvdw=,tag:+I2Kui+oa9wv91CpLOo1yw==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBvUzN0VDA3cGJteHJsTUp1
+            U1Z6aFA1R2hMcnIxTE8rWkZEWTVWbmtlU0FFCldIdU5CYU5FS3p0QXYyczd6TmhM
+            alRkZUJJeVduWEtON1ZBWWk2ajgxUTAKLS0tIFM2V3hZNE95cUJ5bkF2WERZVEtQ
+            VWwvN3dYSzRreTY1dUF5ejY2N1BCWlkKX1OT8zm4wu5q0uLE4htS2HJzndOHLBHe
+            WK1XBlFQOa54oB29ehcE/1j0LtXUenAbqTTAHTsmTkokxyVemaZAjA==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1q8l3g3t6qjhsmz0gju0n535pz45d2c9crla8jcd5ftjlqe4fs3eqfqay0k
+    lastmodified: "2026-08-24T23:01:03Z"
+    mac: ENC[AES256_GCM,data:ODXwdFn0d8z9hcdCKoXeWCpJLyWF6QnVfkGDCE1pO23K3YHTqn7qGWYiuichJLMlfUNBdm7HuXvkuSoteua6qAiL9Us+r3vjpW8hIVZDrcja+EVHzweMgUEb66nrLwtIbDIx6nr8Bec2KcQ6dYJiJ7we3jyrXGFaJQ4wtRpRvmU=,iv:TOZkTVV5Nq/5IsRuv0Gr7yrB51busEAUkKSgQO83u00=,tag:Kk/01O6iqgiaHRFcwfhdtA==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.13.3
diff --git a/hosts/poweredge-pro/resources/secrets/zfs-key.yaml b/hosts/poweredge-pro/resources/secrets/zfs-key.yaml
new file mode 100644
index 0000000..20496b5
--- /dev/null
+++ b/hosts/poweredge-pro/resources/secrets/zfs-key.yaml
@@ -0,0 +1,16 @@
+storage: ENC[AES256_GCM,data:AnjXAapH0ClmXjKQCBoVtIijDIxSBVhjHXEMa7Y9RgXWQ7bfRtx3oDZIYgwLQMohr3NUu8Bj9PZ//4g6SKKCgA==,iv:OEFfEceYShoiHUoY+Q0jpPYEA6vWlLZMXVHd52gp0GI=,tag:GDnrorkbDUOLmcZeiuc9YA==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSByL21EZUdwZkR5K3JVVWc4
+            Sk5XRGFpSWtsWTNSVjN6cERKcDBibnZ1Z3pjCjU1S1JNcFFSakJHMnhwQ3BhcGI5
+            Tzg4R2hneHNYNmF0c1EvYkVDY3RYWkUKLS0tIHlaWHRPeXhXK05MMnJ5bzlLWUds
+            eGZkTlFYT2JtSVRnWm4wcXJ2RFcrd1UKFZNppEmn0TvF5/w32rZLXwaR/WfZyrZ+
+            d6IF1lNA1407phjt+SWsIcRpTQwcY7vdAv4Ozk8tW7LqM+T4xMVLkQ==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1q8l3g3t6qjhsmz0gju0n535pz45d2c9crla8jcd5ftjlqe4fs3eqfqay0k
+    lastmodified: "2026-08-23T03:15:49Z"
+    mac: ENC[AES256_GCM,data:2/UdlNsj3+oihVfgalj8DfFN1XWyY14x0/H3ydDXT6rJgjuFMPwjpNCFuzRP4mT99a46HGl74INfuKXNyFPXMW+eKG81vVHZgDsoipQwI8yUveyCfGezdIz4Rab5fTzXXrvXaXhIdovqDuCUj2FCaqosFvCPC0AtDVqoHuHlU8k=,iv:aBez26rU/252xYkpBVqv8ZrO2vhQm0RJJo/H7puGHQ4=,tag:NRSyINDS4wNF8g2hVRk6Xw==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.13.3