kurogeek
f121a3ec30
Upstream 07d9958739 was backported to linux-6.18.y as af98611ad109 (2026-10-15) and is in the 6.18.58 nixpkgs now builds for stellio. Applying the patch on top fails: patch(1) rejects all 10 hunks as already applied, so the kernel build has been broken since the nixpkgs bump brought 6.18.58.
93 lines
3.3 KiB
Nix
93 lines
3.3 KiB
Nix
{
|
|
config,
|
|
inputs,
|
|
lib,
|
|
pkgs,
|
|
...
|
|
}:
|
|
{
|
|
imports = [
|
|
inputs.matthew-hardware.nixosModules.mt7986a-glinet-gl-mt6000
|
|
];
|
|
|
|
config = {
|
|
hardware.mt7986a-glinet-gl-mt6000.enable = true;
|
|
hardware.mt7986a-glinet-gl-mt6000.zealous = true;
|
|
hardware.mt7986a-glinet-gl-mt6000.image.repart.enable = true;
|
|
|
|
nixpkgs.hostPlatform.system = "aarch64-linux";
|
|
nixpkgs.buildPlatform.system = "x86_64-linux";
|
|
|
|
system.stateVersion = "26.11";
|
|
clan.core.sops.defaultGroups = [ "admins" ];
|
|
|
|
clan.core.settings.name = "stellio";
|
|
clan.core.settings.machine.description = "Flint-2 router";
|
|
|
|
# Root is ext4 on the Flint 2's eMMC: keep steady-state writes off it.
|
|
# The journal is persistent but bounded (256M) and synced once a minute
|
|
# (the router needs logs for pppd/kea debugging and, after the Sep 2026
|
|
# unlogged reboots, for post-mortem; volatile storage left nothing).
|
|
# /tmp is tmpfs, no core dumps, and ext4 skips atime updates and
|
|
# flushes its journal every 60 s instead of 5 s so the small periodic
|
|
# writes (Kea leases, timesyncd clock, speedtest textfile, journal)
|
|
# coalesce. A power cut loses at most a minute of that state.
|
|
fileSystems."/".options = [
|
|
"noatime"
|
|
"commit=60"
|
|
];
|
|
boot.tmp.useTmpfs = true;
|
|
services.journald.settings.Journal = {
|
|
Storage = "persistent";
|
|
SystemMaxUse = "256M";
|
|
SyncIntervalSec = "1m";
|
|
};
|
|
systemd.coredump.enable = false;
|
|
|
|
# nixpkgs' services.blocky check runs the aarch64 blocky in a
|
|
# system.checks derivation, which an x86_64 builder without binfmt cannot
|
|
# execute (`--max-jobs 0` -> Exec format error). Validate the same YAML
|
|
# with the build host's blocky instead. Drop once cnx-network's router
|
|
# service carries this itself (router/dns: validate the Blocky config
|
|
# with the build host's binary).
|
|
services.blocky.enableConfigCheck = false;
|
|
system.checks = [
|
|
(pkgs.runCommand "check-blocky-config" { } ''
|
|
${lib.getExe pkgs.buildPackages.blocky} --config ${
|
|
(pkgs.formats.yaml { }).generate "blocky-config.yaml" config.services.blocky.settings
|
|
} validate && touch $out
|
|
'')
|
|
];
|
|
|
|
# The router service opens SSH only to the mgmt VLAN, the staging port
|
|
# and the ZeroTier mesh (inventories/router.nix). Also admit it over
|
|
# Yggdrasil (fleet-wide instance in inventories/default.nix) so the box
|
|
# stays reachable when ZeroTier's controller/relays are down. Scoped to
|
|
# the tunnel interface (clan-core's yggdrasil service names it `ygg`):
|
|
# only decrypted 200::/7 traffic arrives there, so a spoofed source on
|
|
# the WAN never matches.
|
|
networking.firewall.interfaces.${config.services.yggdrasil.settings.IfName}.allowedTCPPorts = [
|
|
22
|
|
];
|
|
|
|
systemd.services.heartbeat-push = {
|
|
description = "Heartbeat push to uptime monitor";
|
|
serviceConfig = {
|
|
Type = "oneshot";
|
|
ExecStart = "${pkgs.curl}/bin/curl -s -o /dev/null https://uptime.b4l.co.th/api/push/X0WCHAcY5gPf1U8If7BT1FLjpacZqGZu?status=up&msg=OK&ping=";
|
|
};
|
|
};
|
|
|
|
systemd.timers.heartbeat-push = {
|
|
description = "Heartbeat push timer";
|
|
wantedBy = [ "timers.target" ];
|
|
timerConfig = {
|
|
OnBootSec = "60s";
|
|
OnUnitActiveSec = "60s";
|
|
Unit = "heartbeat-push.service";
|
|
};
|
|
};
|
|
|
|
};
|
|
}
|