feat(dural): dedicated dns host

hosts/default.nix

@@ -50,5 +50,13 @@ in
         inputs.nixos-hardware.nixosModules.raspberry-pi-4
       ];
     })
+
+    (mkSystem' {
+      hostname = "dural";
+      system = "x86_64-linux";
+      extraModules = [
+        inputs.disko.nixosModules.disko
+      ];
+    })
   ];
 }

hosts/dural/adguard.nix

@@ -0,0 +1,64 @@
+{
+  config,
+  lib,
+  ...
+}:
+let
+  inherit (lib) mkIf;
+  cfg = config.services.adguardhome;
+in
+{
+  config = {
+    networking.firewall.allowedUDPPorts = mkIf cfg.openFirewall [ cfg.settings.dns.port ];
+
+    services.adguardhome = {
+      enable = true;
+      port = 3000;
+      openFirewall = true;
+      settings = {
+        http = {
+          address = "127.0.0.1:${toString cfg.port}";
+        };
+        auth_attempts = 5;
+        block_auth_min = 10;
+        dns = {
+          bind_hosts = [ "0.0.0.0" ];
+          port = 53;
+          upstream_mode = "load_balance";
+          #upstream_dns_file = config.age.secrets.adguard-dns-list.path;
+          fallback_dns = [ "9.9.9.9" ];
+        };
+        clients = {
+          persistent = [
+            {
+              ids = [
+                "100.64.0.1"
+                "192.168.178.20"
+              ];
+              name = "brontes";
+              tags = [ "device_pc" ];
+            }
+            {
+              ids = [
+                "100.64.0.2"
+                "192.168.178.53"
+              ];
+              name = "oneplus9";
+              tags = [ "device_phone" ];
+            }
+            {
+              ids = [ "100.64.0.5" ];
+              name = "marr";
+              tags = [ "device_laptop" ];
+            }
+            {
+              ids = [ "100.64.0.4" ];
+              name = "shan";
+              tags = [ "device_pc" ];
+            }
+          ];
+        };
+      };
+    };
+  };
+}

hosts/dural/default.nix

@@ -0,0 +1,7 @@
+{ ... }:
+{
+  imports = [
+    ./adguard.nix
+    ./disko.nix
+  ];
+}

hosts/dural/disko.nix

@@ -0,0 +1,19 @@
+{ lib, ... }:
+let
+  inherit (lib.my.disko) mkSwap mkBoot mkRoot;
+in
+{
+  disko.devices.disk.builtin = {
+    device = "/dev/sda";
+    type = "disk";
+    imageSize = "16G";
+    content = {
+      type = "gpt";
+      partitions = {
+        ESP = mkBoot "1G";
+        swap = mkSwap "4G";
+        root = mkRoot "100%" "ext4";
+      };
+    };
+  };
+}

hosts/raptus/container-root.nix

@@ -1,36 +0,0 @@
-{ pkgs, ... }:
-
-{
-  # Runtime
-  virtualisation.podman = {
-    enable = true;
-    autoPrune.enable = true;
-    dockerCompat = true;
-  };
-  virtualisation.oci-containers.backend = "podman";
-
-  # Networks
-  systemd.services."podman-network-test_default" = {
-    path = [ pkgs.podman ];
-    serviceConfig = {
-      Type = "oneshot";
-      RemainAfterExit = true;
-      ExecStop = "podman network rm -f test_default";
-    };
-    script = ''
-      podman network inspect test_default || podman network create test_default
-    '';
-    partOf = [ "podman-compose-test-root.target" ];
-    wantedBy = [ "podman-compose-test-root.target" ];
-  };
-
-  # Root service
-  # When started, this will automatically create all resources and start
-  # the containers. When stopped, this will teardown all resources.
-  systemd.targets."podman-compose-test-root" = {
-    unitConfig = {
-      Description = "Root target generated by compose2nix.";
-    };
-    wantedBy = [ "multi-user.target" ];
-  };
-}

hosts/raptus/obsidian-livesync/default.nix

@@ -1,52 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-{
-  virtualisation.oci-containers.containers."obsidian-livesync" = {
-    image = "couchdb";
-    environmentFiles = [ config.age.secrets.couchdb.path ];
-    volumes = [
-      "${./local.ini}:/opt/couchdb/etc/local.ini:rw"
-      "test_dbdata:/opt/couchdb/data:rw"
-    ];
-    ports = [ "5984:5984/tcp" ];
-    log-driver = "journald";
-    extraOptions = [
-      "--network-alias=couchserver"
-      "--network=test_default"
-    ];
-  };
-  systemd.services."podman-obsidian-livesync" = {
-    serviceConfig = {
-      Restart = lib.mkOverride 500 "always";
-    };
-    after = [
-      "podman-network-test_default.service"
-      "podman-volume-test_dbdata.service"
-    ];
-    requires = [
-      "podman-network-test_default.service"
-      "podman-volume-test_dbdata.service"
-    ];
-    partOf = [ "podman-compose-test-root.target" ];
-    wantedBy = [ "podman-compose-test-root.target" ];
-  };
-
-  # Volumes
-  systemd.services."podman-volume-test_dbdata" = {
-    path = [ pkgs.podman ];
-    serviceConfig = {
-      Type = "oneshot";
-      RemainAfterExit = true;
-    };
-    script = ''
-      podman volume inspect test_dbdata || podman volume create test_dbdata
-    '';
-    partOf = [ "podman-compose-test-root.target" ];
-    wantedBy = [ "podman-compose-test-root.target" ];
-  };
-
-}

parts/lib/functions.nix

@@ -8,7 +8,6 @@ let
   inherit (lib) mkOption;
 in
 {
-
   # Verify the existence of a binary inside of a derivation.
   # Returns the path to the binary or throws.
   checkPath =
@@ -92,7 +91,7 @@ in
       };
     };
     mkSwap = size: {
-      size = "32G";
+      inherit size;
       content = {
         type = "swap";
         randomEncryption = true;