Skip to content

Commit d7e3c82

Browse files
randomizedcoderrandomizedcoder
committed
pi5-1
1 parent 7463492 commit d7e3c82

File tree

12 files changed

+312
-62
lines changed

12 files changed

+312
-62
lines changed

‎arm/pi5-1/.gitignore‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,4 @@
11
result
22
./result
3+
old-result
4+
./old-result

‎arm/pi5-1/Makefile‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,13 @@
11

22
# https://wiki.nixos.org/wiki/NixOS_on_ARM/Building_Images#Compiling_through_binfmt_QEMU
33
all:
4-
nix build .#packages.aarch64-linux.sdcard
4+
nix build .#packages.aarch64-linux.sdcard;
55

6+
update:
7+
sudo nix flake update;
68

79
flash:
8-
sudo dd if=/nix/store/z5bdj3iczgzm3qjgn6lvjswd0lmflkza-nixos-sd-image-24.11.20250119.107d5ef-aarch64-linux.img/sd-image/nixos-sd-image-24.11.20250119.107d5ef-aarch64-linux.img of=/dev/sda bs=10MB oflag=dsync status=progress
10+
sudo dd if=/nix/store/z5bdj3iczgzm3qjgn6lvjswd0lmflkza-nixos-sd-image-24.11.20250119.107d5ef-aarch64-linux.img/sd-image/nixos-sd-image-24.11.20250119.107d5ef-aarch64-linux.img of=/dev/sda bs=10MB oflag=dsync status=progress;
911

1012
# this was copied from video: https://www.youtube.com/watch?v=6Le0IbPRzOE
1113
# time. 53.54

‎arm/pi5-1/configuration.nix‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
#
2+
# arm/pi5-1/configuration.nix
3+
#
4+
5+
{ config, pkgs, lib, ... }:
6+
7+
# https://nixos.wiki/wiki/FAQ#How_can_I_install_a_package_from_unstable_while_remaining_on_the_stable_channel.3F
8+
# https://discourse.nixos.org/t/differences-between-nix-channels/13998
9+
10+
{
11+
# https://nixos.wiki/wiki/NixOS_modules
12+
imports =
13+
[
14+
./sysctl.nix
15+
./services.ssh.nix
16+
./nodeExporter.nix
17+
./docker-daemon.nix
18+
];
19+
20+
# https://nixos.wiki/wiki/Nix_Cookbook
21+
nix = {
22+
settings = {
23+
auto-optimise-store = true;
24+
#experimental-features = [ "nix-command" "flakes" ];
25+
experimental-features = [ "nix-command" "flakes" ];
26+
27+
download-buffer-size = "100000000";
28+
};
29+
30+
gc = {
31+
automatic = true; # Enable automatic execution of the task
32+
dates = "weekly"; # Schedule the task to run weekly
33+
options = "--delete-older-than 10d"; # Specify options for the task: delete files older than 10 days
34+
randomizedDelaySec = "14m"; # Introduce a randomized delay of up to 14 minutes before executing the task
35+
};
36+
};
37+
38+
networking.firewall.enable = true;
39+
40+
services.lldpd.enable = true;
41+
42+
services.timesyncd.enable = true;
43+
44+
services.fstrim.enable = true;
45+
46+
nixpkgs.config = {
47+
allowUnfree = true;
48+
};
49+
}

‎arm/pi5-1/docker-daemon.nix‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
2+
{ config, pkgs, ... }:
3+
4+
{
5+
# https://nixos.wiki/wiki/Docker
6+
# https://search.nixos.org/options?from=0&size=50&sort=alpha_asc&query=virtualisation.docker
7+
# https://search.nixos.org/options?channel=24.05&show=virtualisation.docker.extraOptions&from=0&size=50&sort=alpha_asc&type=packages&query=virtualisation.docker
8+
# https://github.com/NixOS/nixpkgs/issues/68349
9+
virtualisation.docker.enable = true;
10+
virtualisation.docker.daemon.settings = {
11+
data-root = "/home/das/docker/";
12+
userland-proxy = false;
13+
experimental = true;
14+
ipv6 = true;
15+
fixed-cidr-v6 = "fd00::/80";
16+
metrics-addr = "0.0.0.0:9323";
17+
# log-driver = "json-file";
18+
# log-opts.max-size = "10m";
19+
# log-opts.max-file = "10";
20+
};
21+
#this doesn't work
22+
#virtualisation.docker.daemon.settings.log-opts.max-size = "10m";
23+
# https://docs.docker.com/reference/cli/dockerd/
24+
#virtualisation.docker.extraOptions = "--userland-proxy=false";
25+
#virtualisation.docker.extraOptions = "--log-opt=max-size=10m";
26+
#virtualisation.docker.extraOptions = "--ipv6";
27+
}

‎arm/pi5-1/extra-config.nix‎

Lines changed: 0 additions & 11 deletions
This file was deleted.

‎arm/pi5-1/flake.nix‎

Lines changed: 13 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,16 @@
11
{
22
description = "Base system for raspberry pi 5";
33
inputs = {
4-
nixpkgs.url = "nixpkgs/nixos-24.11";
4+
nixpkgs.url = "nixpkgs/nixos-unstable";
5+
# nixpkgs.url = "nixpkgs/nixos-24.11";
6+
# nixpkgs-unstable.url = "github:nixos/nixpkgs/nixos-unstable";
57
nixos-generators = {
68
url = "github:nix-community/nixos-generators";
79
inputs.nixpkgs.follows = "nixpkgs";
810
};
911
};
1012

13+
#outputs = { self, nixpkgs, nixpkgs-unstable, nixos-generators, ... }:
1114
outputs = { self, nixpkgs, nixos-generators, ... }:
1215
{
1316
nixosModules = {
@@ -28,6 +31,14 @@
2831
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGMCFUMSCFJX95eLfm7P9r72NBp9I1FiXwNwJ+x/HGPV das@t"
2932
];
3033
};
34+
brent = {
35+
password = "admin123";
36+
isNormalUser = true;
37+
extraGroups = [ "wheel" ];
38+
openssh.authorizedKeys.keys = [
39+
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBHhM04LlDK/gOItDXa2mzMof6LhXT9IBJ9liFPEn0xJ brent@mckee.is"
40+
];
41+
};
3142
};
3243
};
3344
};
@@ -37,7 +48,7 @@
3748
system = "aarch64-linux";
3849
format = "sd-aarch64";
3950
modules = [
40-
./extra-config.nix
51+
./configuration.nix
4152
self.nixosModules.system
4253
self.nixosModules.users
4354
( { ... }: {

‎arm/pi5-1/nodeExporter.nix‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
{ config, pkgs, ... }:
2+
{
3+
# https://nixos.org/manual/nixos/stable/#module-services-prometheus-exporters
4+
# https://github.com/NixOS/nixpkgs/blob/nixos-24.05/nixos/modules/services/monitoring/prometheus/default.nix
5+
services.prometheus.exporters.node = {
6+
enable = true;
7+
port = 9000;
8+
# https://github.com/NixOS/nixpkgs/blob/nixos-24.05/nixos/modules/services/monitoring/prometheus/exporters.nix
9+
enabledCollectors = [ "systemd" ];
10+
# /nix/store/zgsw0yx18v10xa58psanfabmg95nl2bb-node_exporter-1.8.1/bin/node_exporter --help
11+
extraFlags = [
12+
"--collector.ethtool"
13+
"--collector.softirqs"
14+
"--collector.tcpstat"
15+
#"--collector.wifi"
16+
"--collector.filesystem.ignored-mount-points='/nix/store'"];
17+
};
18+
19+
# https://search.nixos.org/options?channel=24.05&from=200&size=50&sort=relevance&type=packages&query=services.prometheus.exporters
20+
services.prometheus.exporters.systemd.enable = true;
21+
services.prometheus.exporters.smartctl.enable = true;
22+
services.prometheus.exporters.process.enable = true;
23+
}

‎arm/pi5-1/services.ssh.nix‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
{ pkgs, config, ... }:
2+
{
3+
# https://nixos.wiki/wiki/SSH
4+
# https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/services/networking/ssh/sshd.nix
5+
# https://github.com/NixOS/nixpkgs/blob/47457869d5b12bdd72303d6d2ba4bfcc26fe8531/nixos/modules/services/security/sshguard.nix
6+
services.openssh = {
7+
enable = true;
8+
openFirewall = true;
9+
settings = {
10+
# default key algos: https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/services/networking/ssh/sshd.nix#L546
11+
# KexAlgorithms = [
12+
# "mlkem768x25519-sha256"
13+
# "sntrup761x25519-sha512"
14+
# "sntrup761x25519-sha512@openssh.com"
15+
# "curve25519-sha256"
16+
# "curve25519-sha256@libssh.org"
17+
# "diffie-hellman-group-exchange-sha256"
18+
# ];
19+
Ciphers = [
20+
"chacha20-poly1305@openssh.com"
21+
"aes256-gcm@openssh.com"
22+
"aes128-gcm@openssh.com"
23+
# shortned default list
24+
];
25+
Macs = [
26+
"hmac-sha2-512-etm@openssh.com"
27+
"hmac-sha2-256-etm@openssh.com"
28+
"umac-128-etm@openssh.com"
29+
];
30+
# HostKeyAlgorithms = [
31+
# "ssh-ed25519-cert-v01@openssh.com"
32+
# "sk-ssh-ed25519-cert-v01@openssh.com"
33+
# "rsa-sha2-512-cert-v01@openssh.com"
34+
# "rsa-sha2-256-cert-v01@openssh.com"
35+
# "ssh-ed25519"
36+
# "sk-ssh-ed25519@openssh.com"
37+
# "rsa-sha2-512"
38+
# "rsa-sha2-256"
39+
# ];
40+
UsePAM = true;
41+
KbdInteractiveAuthentication = true;
42+
PermitRootLogin = "prohibit-password";
43+
PasswordAuthentication = false;
44+
ChallengeResponseAuthentication = false;
45+
X11Forwarding = false;
46+
GatewayPorts = "no";
47+
};
48+
};
49+
50+
services.sshguard.enable = true;
51+
}

‎arm/pi5-1/sysctl.nix‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
{ config, pkgs, ... }:
2+
3+
{
4+
# https://www.kernel.org/doc/html/latest/networking/ip-sysctl.html
5+
boot.kernel.sysctl = {
6+
# detect dead connections more quickly
7+
"net.ipv4.tcp_keepalive_intvl" = 30;
8+
#net.ipv4.tcp_keepalive_intvl = 75
9+
"net.ipv4.tcp_keepalive_probes" = 4;
10+
#net.ipv4.tcp_keepalive_probes = 9
11+
"net.ipv4.tcp_keepalive_time" = 120;
12+
#net.ipv4.tcp_keepalive_time = 7200
13+
# 30 * 4 = 120 seconds. / 60 = 2 minutes
14+
# default: 75 seconds * 9 = 675 seconds. /60 = 11.25 minutes
15+
"net.ipv4.tcp_rmem" = "4096 1000000 16000000";
16+
"net.ipv4.tcp_wmem" = "4096 1000000 16000000";
17+
#net.ipv4.tcp_rmem = 4096 131072 6291456
18+
#net.ipv4.tcp_wmem = 4096 16384 4194304
19+
# https://github.com/torvalds/linux/blob/master/Documentation/networking/ip-sysctl.rst?plain=1#L1042
20+
# https://lwn.net/Articles/560082/
21+
"net.ipv4.tcp_notsent_lowat" = "131072";
22+
#net.ipv4.tcp_notsent_lowat = 4294967295
23+
# enable Enable reuse of TIME-WAIT sockets globally
24+
"net.ipv4.tcp_tw_reuse" = 1;
25+
#net.ipv4.tcp_tw_reuse=2
26+
"net.ipv4.tcp_timestamps" = 1;
27+
"net.ipv4.tcp_ecn" = 1;
28+
"net.core.default_qdisc" = "cake";
29+
"net.ipv4.tcp_congestion_control" = "cubic";
30+
#net.ipv4.tcp_congestion_control=bbr
31+
"net.core.rmem_default" = 26214400;
32+
"net.core.rmem_max" = 26214400;
33+
"net.core.wmem_default" = 26214400;
34+
"net.core.wmem_max" = 26214400;
35+
#net.core.optmem_max = 20480
36+
#net.core.rmem_default = 212992
37+
#net.core.rmem_max = 212992
38+
#net.core.wmem_default = 212992
39+
#net.core.wmem_max = 212992
40+
"net.ipv4.ip_local_port_range" = "1025 65535";
41+
#net.ipv4.ip_local_port_range ="32768 60999"
42+
};
43+
}

‎hp/hp4/configuration.nix‎

Lines changed: 48 additions & 47 deletions
Original file line numberDiff line numberDiff line change
@@ -47,6 +47,7 @@
4747
./trafficserver.nix
4848
./athens.nix
4949
./remote-builder.nix
50+
./services.ssh.nix
5051
];
5152

5253
# Bootloader.
@@ -190,54 +191,54 @@
190191
enableSSHSupport = true;
191192
};
192193

193-
# https://nixos.wiki/wiki/SSH
194-
# https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/services/networking/ssh/sshd.nix
195-
# https://github.com/NixOS/nixpkgs/blob/47457869d5b12bdd72303d6d2ba4bfcc26fe8531/nixos/modules/services/security/sshguard.nix
196-
services.openssh = {
197-
enable = true;
198-
openFirewall = true;
199-
settings = {
200-
# default key algos: https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/services/networking/ssh/sshd.nix#L546
201-
# KexAlgorithms = [
202-
# "mlkem768x25519-sha256"
203-
# "sntrup761x25519-sha512"
204-
# "sntrup761x25519-sha512@openssh.com"
205-
# "curve25519-sha256"
206-
# "curve25519-sha256@libssh.org"
207-
# "diffie-hellman-group-exchange-sha256"
208-
# ];
209-
Ciphers = [
210-
"chacha20-poly1305@openssh.com"
211-
"aes256-gcm@openssh.com"
212-
"aes128-gcm@openssh.com"
213-
# shortned default list
214-
];
215-
Macs = [
216-
"hmac-sha2-512-etm@openssh.com"
217-
"hmac-sha2-256-etm@openssh.com"
218-
"umac-128-etm@openssh.com"
219-
];
220-
# HostKeyAlgorithms = [
221-
# "ssh-ed25519-cert-v01@openssh.com"
222-
# "sk-ssh-ed25519-cert-v01@openssh.com"
223-
# "rsa-sha2-512-cert-v01@openssh.com"
224-
# "rsa-sha2-256-cert-v01@openssh.com"
225-
# "ssh-ed25519"
226-
# "sk-ssh-ed25519@openssh.com"
227-
# "rsa-sha2-512"
228-
# "rsa-sha2-256"
229-
# ];
230-
UsePAM = true;
231-
KbdInteractiveAuthentication = true;
232-
PermitRootLogin = "prohibit-password";
233-
PasswordAuthentication = false;
234-
ChallengeResponseAuthentication = false;
235-
X11Forwarding = false;
236-
GatewayPorts = "no";
237-
};
238-
};
194+
# # https://nixos.wiki/wiki/SSH
195+
# # https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/services/networking/ssh/sshd.nix
196+
# # https://github.com/NixOS/nixpkgs/blob/47457869d5b12bdd72303d6d2ba4bfcc26fe8531/nixos/modules/services/security/sshguard.nix
197+
# services.openssh = {
198+
# enable = true;
199+
# openFirewall = true;
200+
# settings = {
201+
# # default key algos: https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/services/networking/ssh/sshd.nix#L546
202+
# # KexAlgorithms = [
203+
# # "mlkem768x25519-sha256"
204+
# # "sntrup761x25519-sha512"
205+
# # "sntrup761x25519-sha512@openssh.com"
206+
# # "curve25519-sha256"
207+
# # "curve25519-sha256@libssh.org"
208+
# # "diffie-hellman-group-exchange-sha256"
209+
# # ];
210+
# Ciphers = [
211+
# "chacha20-poly1305@openssh.com"
212+
# "aes256-gcm@openssh.com"
213+
# "aes128-gcm@openssh.com"
214+
# # shortned default list
215+
# ];
216+
# Macs = [
217+
# "hmac-sha2-512-etm@openssh.com"
218+
# "hmac-sha2-256-etm@openssh.com"
219+
# "umac-128-etm@openssh.com"
220+
# ];
221+
# # HostKeyAlgorithms = [
222+
# # "ssh-ed25519-cert-v01@openssh.com"
223+
# # "sk-ssh-ed25519-cert-v01@openssh.com"
224+
# # "rsa-sha2-512-cert-v01@openssh.com"
225+
# # "rsa-sha2-256-cert-v01@openssh.com"
226+
# # "ssh-ed25519"
227+
# # "sk-ssh-ed25519@openssh.com"
228+
# # "rsa-sha2-512"
229+
# # "rsa-sha2-256"
230+
# # ];
231+
# UsePAM = true;
232+
# KbdInteractiveAuthentication = true;
233+
# PermitRootLogin = "prohibit-password";
234+
# PasswordAuthentication = false;
235+
# ChallengeResponseAuthentication = false;
236+
# X11Forwarding = false;
237+
# GatewayPorts = "no";
238+
# };
239+
# };
239240

240-
services.sshguard.enable = true;
241+
# services.sshguard.enable = true;
241242

242243
# search for serivces url
243244
#https://github.com/search?q=repo%3ANixOS%2Fnixpkgs+path%3A%2F%5Enixos%5C%2Fmodules%5C%2Fservices%5C%2F%2F+openssh&type=code

0 commit comments

Comments
 (0)