51 lines
1 KiB
Nix
51 lines
1 KiB
Nix
{
|
|
config,
|
|
lib,
|
|
pkgs,
|
|
modulesPath,
|
|
...
|
|
}:
|
|
let
|
|
directory = "/storage";
|
|
storage = "${directory}/storage";
|
|
in
|
|
{
|
|
boot.swraid.enable = true;
|
|
boot.swraid.mdadmConf = ''
|
|
ARRAY /dev/md0 metadata=1.2 name=fili:0 UUID=0796fee2:0d9f2908:24af61b0:1250fa0e
|
|
'';
|
|
# todo: email notifications (through PROGRAM)
|
|
|
|
fileSystems.storage = {
|
|
mountPoint = "${storage}";
|
|
device = "/dev/md0";
|
|
fsType = "btrfs";
|
|
options = [
|
|
"compress=zstd"
|
|
];
|
|
};
|
|
|
|
# for vpn in containers
|
|
fileSystems."/tmp/net_cls" = {
|
|
device = "net_cls";
|
|
fsType = "cgroup";
|
|
options = [ "net_cls" ];
|
|
};
|
|
|
|
# don't allow execute permissions for "other" people
|
|
# (not root user and not in storage group)
|
|
# to effectively disallow people outside the storage group
|
|
# to access /storage
|
|
systemd.tmpfiles.rules = [
|
|
"d ${directory} 0777 root ${config.users.groups.storage.name}"
|
|
];
|
|
|
|
users.groups.storage = {
|
|
name = "storage";
|
|
members = [ config.users.users.jana.name ];
|
|
};
|
|
|
|
networking.firewall.allowedTCPPorts = [
|
|
2049
|
|
];
|
|
}
|