init mindy

hosts/mindy/default.nix

@@ -0,0 +1,145 @@
+{
+	config,
+	modulesPath,
+	hostname,
+	inputs,
+	pkgs,
+	user,
+	constants,
+	...
+}: {
+	imports = [
+		(modulesPath + "/installer/scan/not-detected.nix")
+		(modulesPath + "/profiles/qemu-guest.nix")
+		./disk-config.nix
+		./hardware-configuration.nix
+		../../profiles/core.nix
+		../../profiles/fail2ban.nix
+		../../profiles/nixos.nix
+		../../profiles/postgresql.nix
+		../../profiles/tailscale.nix
+		inputs.disko.nixosModules.disko
+		inputs.sops-nix.nixosModules.sops
+	];
+
+	sops.secrets.mindy-pgbackrest = {
+		sopsFile = ../../secrets/mindy-pgbackrest;
+		format = "binary";
+	};
+
+	environment.systemPackages = [pkgs.pgbackrest];
+
+	environment.etc."pgbackrest/pgbackrest.conf".text = ''
+		[global]
+		repo1-type=s3
+		repo1-s3-endpoint=s3.eu-central-003.backblazeb2.com
+		repo1-s3-bucket=mindy-pgbackrest
+		repo1-s3-region=eu-central-003
+		repo1-path=/backups
+		repo1-retention-full=7
+		repo1-retention-diff=7
+		repo1-cipher-type=aes-256-cbc
+		compress-type=zst
+		compress-level=3
+		process-max=2
+		log-level-console=info
+		log-level-file=detail
+		log-path=/var/log/pgbackrest
+		spool-path=/var/spool/pgbackrest
+
+		[main]
+		pg1-path=/var/lib/postgresql/${config.services.postgresql.package.psqlSchema}
+		pg1-user=postgres
+	'';
+
+	systemd.services.pgbackrest-backup = {
+		description = "pgBackRest Full Backup";
+		after = ["postgresql.service"];
+		requires = ["postgresql.service"];
+		path = [pkgs.pgbackrest];
+		serviceConfig = {
+			Type = "oneshot";
+			User = "postgres";
+			EnvironmentFile = "/run/secrets/mindy-pgbackrest";
+		};
+		script = ''
+			pgbackrest --stanza=main backup --type=full
+		'';
+	};
+
+	systemd.timers.pgbackrest-backup = {
+		wantedBy = ["timers.target"];
+		timerConfig = {
+			OnCalendar = "daily";
+			Persistent = true;
+			RandomizedDelaySec = "1h";
+		};
+	};
+
+	systemd.services.pgbackrest-backup-diff = {
+		description = "pgBackRest Differential Backup";
+		after = ["postgresql.service"];
+		requires = ["postgresql.service"];
+		path = [pkgs.pgbackrest];
+		serviceConfig = {
+			Type = "oneshot";
+			User = "postgres";
+			EnvironmentFile = "/run/secrets/mindy-pgbackrest";
+		};
+		script = ''
+			pgbackrest --stanza=main backup --type=diff
+		'';
+	};
+
+	systemd.timers.pgbackrest-backup-diff = {
+		wantedBy = ["timers.target"];
+		timerConfig = {
+			OnCalendar = "hourly";
+			Persistent = true;
+			RandomizedDelaySec = "5m";
+		};
+	};
+
+	systemd.tmpfiles.rules = [
+		"d /var/lib/pgbackrest 0750 postgres postgres -"
+		"d /var/log/pgbackrest 0750 postgres postgres -"
+		"d /var/spool/pgbackrest 0750 postgres postgres -"
+	];
+
+	home-manager.users.${user} = {
+		pkgs,
+		lib,
+		...
+	}: {
+		_module.args = {inherit user constants inputs;};
+		imports = [
+			inputs.nixvim.homeModules.nixvim
+			../../profiles/bash.nix
+			../../profiles/bat.nix
+			../../profiles/direnv.nix
+			../../profiles/eza.nix
+			../../profiles/fish.nix
+			../../profiles/fzf.nix
+			../../profiles/git.nix
+			../../profiles/home.nix
+			../../profiles/jjui.nix
+			../../profiles/jujutsu.nix
+			../../profiles/lazygit.nix
+			../../profiles/neovim
+			../../profiles/ripgrep.nix
+			../../profiles/ssh.nix
+			../../profiles/starship.nix
+			../../profiles/zoxide.nix
+		];
+	};
+
+	services.openssh = {
+		enable = true;
+		settings = {
+			PermitRootLogin = "yes";
+			PasswordAuthentication = false;
+		};
+	};
+
+	networking.hostName = hostname;
+}

hosts/mindy/disk-config.nix

@@ -0,0 +1,37 @@
+{
+	disko.devices = {
+		disk = {
+			main = {
+				type = "disk";
+				device = "/dev/sda";
+				content = {
+					type = "gpt";
+					partitions = {
+						boot = {
+							size = "1M";
+							type = "EF02";
+						};
+						ESP = {
+							size = "512M";
+							type = "EF00";
+							content = {
+								type = "filesystem";
+								format = "vfat";
+								mountpoint = "/boot";
+								mountOptions = ["umask=0077"];
+							};
+						};
+						root = {
+							size = "100%";
+							content = {
+								type = "filesystem";
+								format = "ext4";
+								mountpoint = "/";
+							};
+						};
+					};
+				};
+			};
+		};
+	};
+}

hosts/mindy/hardware-configuration.nix

@@ -0,0 +1,18 @@
+{
+	lib,
+	modulesPath,
+	...
+}: {
+	imports = [
+		(modulesPath + "/profiles/qemu-guest.nix")
+	];
+
+	boot.initrd.availableKernelModules = ["ahci" "xhci_pci" "virtio_pci" "virtio_scsi" "sd_mod" "sr_mod"];
+	boot.initrd.kernelModules = [];
+	boot.kernelModules = [];
+	boot.extraModulePackages = [];
+
+	nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+
+	networking.useDHCP = lib.mkDefault true;
+}