wow

hosts/server/hikari/default/.sops.yaml

@@ -0,0 +1,7 @@
+creation_rules:
+  - path_regex: secrets/.*\.ya?ml$
+    age:
+      - age1mgels4hjl7l07gcnt72g86kvhrvd82fha9kuvlp46mpks7unrpmqvy959u # mizuki
+      - age1dcvh6q9953es9fvt8rq8rdgcktlt64asn2tf2y3vmyz0gntxzynqg2xgzk # hako
+      - age1wnxeqyzqsnylm4vdgzrlyu7k4yev82zuru6nzy72hwvu6htde4gq9wc5vu # hikari
+      - age1hlld327xfhm44hns9l9j6h4csrl5cl50h2qkhpl3969awgl665fsnxd3zc # kanade

hosts/server/hikari/default/configuration.nix

@@ -0,0 +1,55 @@
+{ pkgs, inputs, ... }:
+{
+  imports = [
+    ./hardware-configuration.nix
+    "${inputs.self}/modules/nixos/base"
+    "${inputs.self}/modules/nixos/features/cockpit.nix"
+    "${inputs.self}/modules/nixos/features/boot.nix"
+    "${inputs.self}/modules/nixos/features/ssh.nix"
+    "${inputs.self}/modules/nixos/features/podman.nix"
+
+    ./services/rustfs.nix
+    ./services/nextcloud.nix
+  ];
+
+  # 1. 크론 설정
+  services.cron = {
+    enable = true;
+    systemCronJobs = [
+      "0 1 * * * imnyang printf '\\n%s : ' \"$(date)\" >> /home/imnyang/codelounge.log && /home/imnyang/codelounge.sh >> /home/imnyang/codelounge.log"
+    ];
+  };
+
+  services.qemuGuest.enable = true;
+
+  # 2. 사용자 SSH 키 등록
+  users.users.imnyang.openssh.authorizedKeys.keys = [
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOHP3Z+AYrRh9f8TYyqChKfeyNm3lOe0F75AwRHTTaxD imnyang@kazusa"
+  ];
+
+  environment.systemPackages = with pkgs; [
+    eza
+    neovim
+    nil
+    nixd
+  ];
+
+  programs.git.config = {
+    safe.directory = "*";
+  };
+
+  nix.settings.require-sigs = false;
+
+  networking = {
+    hostName = "hikari";
+    networkmanager.enable = true;
+    firewall.enable = false;
+    bridges.br0 = {
+      interfaces = [
+        "eno1"
+      ];
+    };
+  };
+
+  system.stateVersion = "26.05";
+}

hosts/server/hikari/default/default.nix

@@ -0,0 +1,33 @@
+{
+  inputs,
+  overlays,
+}:
+let
+  inherit (inputs)
+    nixpkgs
+    home-manager
+    quadlet-nix
+    sops-nix
+    ;
+in
+nixpkgs.lib.nixosSystem {
+  system = "x86_64-linux";
+  modules = [
+    ./configuration.nix
+    ./hardware-configuration.nix
+    sops-nix.nixosModules.sops
+    home-manager.nixosModules.home-manager
+    inputs.rustfs.nixosModules.rustfs
+    quadlet-nix.nixosModules.quadlet
+    {
+      home-manager.useGlobalPkgs = true;
+      home-manager.useUserPackages = true;
+      home-manager.extraSpecialArgs = { inherit inputs; };
+      home-manager.users.imnyang = import ./home.nix;
+    }
+  ];
+  specialArgs = {
+    inherit inputs;
+    inherit overlays;
+  };
+}

hosts/server/hikari/default/hardware-configuration.nix

@@ -0,0 +1,65 @@
+# Do not modify this file! It was generated by nixos-generate-config
+# and may be overwritten by future invocations. Please make changes
+# to configuration.nix instead.
+{
+  config,
+  lib,
+  pkgs,
+  modulesPath,
+  ...
+}:
+
+{
+  imports = [
+    (modulesPath + "/installer/scan/not-detected.nix")
+  ];
+
+  boot.initrd.availableKernelModules = [
+    "nvme"
+    "xhci_pci"
+    "ahci"
+    "usb_storage"
+    "usbhid"
+    "uas"
+    "sd_mod"
+  ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-amd" ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" = {
+    device = "/dev/mapper/luks-32ac59f9-fa04-4ec7-a7a2-9b6821c19e35";
+    fsType = "ext4";
+  };
+  fileSystems."/".neededForBoot = true;
+
+  boot.initrd.luks.devices."luks-32ac59f9-fa04-4ec7-a7a2-9b6821c19e35" = {
+    device = "/dev/disk/by-uuid/32ac59f9-fa04-4ec7-a7a2-9b6821c19e35";
+  };
+
+  fileSystems."/boot" = {
+    device = "/dev/disk/by-uuid/ED22-EDE6";
+    fsType = "vfat";
+    options = [
+      "fmask=0077"
+      "dmask=0077"
+    ];
+  };
+
+  fileSystems."/mnt/snow" = {
+    device = "/dev/disk/by-uuid/68ecc71d-66d7-4900-9ac2-1ddde0d607a8";
+    fsType = "ext4";
+  };
+
+  fileSystems."/mnt/rain" = {
+    device = "/dev/disk/by-uuid/311b9c03-eb92-42f1-824b-d1a997916abb";
+    fsType = "ext4";
+  };
+
+  swapDevices = [ ];
+
+  hardware.ksm.enable = true;
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+}

hosts/server/hikari/default/home.nix

@@ -0,0 +1,66 @@
+{
+  pkgs,
+  inputs,
+  ...
+}:
+let
+  nr = import "${inputs.self}/modules/nixos/features/packages/nr.nix" { inherit pkgs; };
+  nrr = import "${inputs.self}/modules/nixos/features/packages/nrr.nix" { inherit pkgs; };
+in
+{
+  home.stateVersion = "26.05";
+  home.username = "imnyang";
+  home.homeDirectory = "/home/imnyang";
+
+  home.packages = [
+    nr
+    nrr
+  ];
+
+  home.sessionVariables = {
+    EDITOR = "nano";
+    VISUAL = "nano";
+  };
+
+  programs.fish = {
+    enable = true;
+
+    shellAliases = {
+      ".." = "cd ..";
+      "..." = "cd ../..";
+
+      ls = "eza";
+      ll = "eza -l";
+      la = "eza -a";
+      lla = "eza -la";
+
+      rebuild = "sudo nixos-rebuild switch --flake .#hako";
+      update = "nix flake update";
+      clean = "sudo nix-collect-garbage -d";
+    };
+
+    interactiveShellInit = ''
+      set -g fish_greeting ""
+      set -g fish_color_command blue
+      set -g fish_color_error red
+      set -g fish_color_param cyan
+    '';
+
+    functions = {
+      fish_prompt = ''
+        set_color purple
+        echo -n (whoami)
+        set_color normal
+        echo -n "@"
+        set_color green
+        echo -n (hostname)
+        set_color normal
+        echo -n ":"
+        set_color blue
+        echo -n (prompt_pwd)
+        set_color normal
+        echo -n " > "
+      '';
+    };
+  };
+}

hosts/server/hikari/default/secrets/rustfs.yaml

@@ -0,0 +1,45 @@
+rustfs:
+    access-key: ENC[AES256_GCM,data:Cn7OLVdATw==,iv:D4SufuFFUMcX+yvVSoEQewjRKuYn2lTs1q6AD4mxUv4=,tag:ZW39Ss9aH0Yex1jyf29dFA==,type:str]
+    secret-key: ENC[AES256_GCM,data:cGvzwMB8GImZ7gqNzQ==,iv:R8zKJ7S7pZLvDR0+4NKoq1HGK75XGJU+kR7OZr5By20=,tag:dos2R8yxuXBMkh/0NkPMag==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBuS1FVMkkvTm9iYzFjU0NB
+            UFRxRCsxK3FqYVVweTRNcktvOGl6MDdwRmljCllmaFVCZ2hmYmJtdjBqcDlLZTZk
+            SVl5SE05YnEvK3hkdEVYT3E2WGM5RzgKLS0tIHZlTEtwZmZZRTVWdVJxL1pGRlBt
+            ZEpCT3JuMXNtN1N2OGZpVFZPYm5HK1UKyGlt3NFaloUMJRNeRVFi8LCSAg6vXBMu
+            RJbfkCJBrzpHTPxNOKeFgsrgWt3FEmSSNN8180o4jymPyXhHqqOTEw==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1mgels4hjl7l07gcnt72g86kvhrvd82fha9kuvlp46mpks7unrpmqvy959u
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBFUHlOUExVb0Z2U3FZUXgr
+            UVc4b0VBZXpxQm11eVN5UTF6MXNnZVBmV2hVCkxXRnFTY1IxWmI2dlJDS0kxU1lx
+            Rmd3QXZwTWhMRG1ncVhPM1FCK1RkZnMKLS0tIHdZR2VwRzB6UFQzbEpLalhJdk5Z
+            ZElITjd3U2laaUVIZklRQVJubmcwNXcK7mSlmQF9tG5sPsCxjTXb3qhRvny2rVbS
+            txx0i7WXyzNbzL/FC6T7vPhsmZMEt0aAQpNOPAF4mayr4zfL7X1QsA==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1dcvh6q9953es9fvt8rq8rdgcktlt64asn2tf2y3vmyz0gntxzynqg2xgzk
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJQnFQR0ZUSEZRbzQ5V01j
+            emZldE9tc2MwM1VSZzRGbGhvaHVTZm43elZnCk14MitpU0hRVzlvK1VSQktmYlFS
+            bWswd29nTUMycWpoVXkxbGl5TDZjN2MKLS0tIGhOcUw4T1hEdlU3bzY1TjNLcFlq
+            YjhTK3A2UVlLODZwa3cra0o5bEJ5QTQKgS9sFXhgqWmdqXRpfsN7g9SgFByVUhVq
+            L0TTu/5PUkAt88KdUQlFUsm1PgaFnfJWPqfkIclmW+RJHaO0fQWBBQ==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1wnxeqyzqsnylm4vdgzrlyu7k4yev82zuru6nzy72hwvu6htde4gq9wc5vu
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBQb3E4K1d4NHJ2a1kwR3h5
+            RWt4T0ppcTVFWjU3NUdPU1krejBqZjZkV0M4Ci9iYUdxd3NDOUlwZ1p2ODJOY1dk
+            SzE2MWZ5R2xXRFV1bVFpRzhEOWZJV2sKLS0tIEFDRTNnRmZMOVIxeGFGcmQ2aWhP
+            dTJYbEhlcCt2ZURReVlZWWpSQndiVXcKw+3Y9kIRgCdQGcpl++4llH8cAeQyhT/E
+            I3Pxi5GXMRMEgGGKom46WT8UzwXWT3tlCYQpPEmFp6OiJeuxUtU2mg==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1hlld327xfhm44hns9l9j6h4csrl5cl50h2qkhpl3969awgl665fsnxd3zc
+    lastmodified: "2026-06-09T01:25:36Z"
+    mac: ENC[AES256_GCM,data:+I6s5nI7FKxolC3dVUToBFU4jULtTjCouKqR+VLT9XNUeZTin258mi0kD5fDhDWpKlC3pEzZ1lTvSOkPb3JX73fvHYjCKbchaW36HgEZi/QF7pQIaZZQUMQZ8ga5KpeUWOvRhJPdbZ/QwKB3+nCAJv7lDMpSLMEDHV2im9sT2e4=,iv:8gMmUef18qK/KIAFojyzVG/n/hOyjVy03aX05/dNukU=,tag:uqn3NSsSDsuyWfkrXvAW1Q==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.13.1

hosts/server/hikari/default/services/nextcloud.nix

@@ -0,0 +1,133 @@
+{ ... }:
+
+{
+  networking.firewall.allowedTCPPorts = [
+    60300
+    9980
+  ];
+
+  virtualisation.quadlet = {
+    networks.nextcloud = { };
+
+    containers = {
+      nextcloud-db = {
+        containerConfig = {
+          image = "postgres:17";
+          networks = [ "nextcloud" ];
+
+          volumes = [
+            "/data/nextcloud/db:/var/lib/postgresql/data:Z"
+          ];
+
+          environmentFiles = [
+            "/data/nextcloud/db.env"
+          ];
+
+          exec = "postgres -c listen_addresses='*' -c unix_socket_directories=''";
+        };
+
+        serviceConfig.Restart = "always";
+      };
+
+      nextcloud-redis = {
+        containerConfig = {
+          image = "redis:alpine";
+          networks = [ "nextcloud" ];
+        };
+
+        serviceConfig.Restart = "always";
+      };
+
+      nextcloud-app = {
+        containerConfig = {
+          image = "nextcloud:apache";
+
+          publishPorts = [ "60300:80" ];
+
+          networks = [ "nextcloud" ];
+
+          volumes = [
+            "/mnt/snow/Docker/nextcloud/data:/var/www/html:z"
+          ];
+
+          # environments로 변경 및 attrset 형식으로 정의
+          environments = {
+            POSTGRES_HOST = "nextcloud-db";
+            REDIS_HOST = "nextcloud-redis";
+            NEXTCLOUD_OVERWRITEPROTOCOL = "https";
+          };
+
+          environmentFiles = [
+            "/data/nextcloud/db.env"
+          ];
+        };
+
+        unitConfig = {
+          Requires = [
+            "nextcloud-db.service"
+            "nextcloud-redis.service"
+          ];
+
+          After = [
+            "nextcloud-db.service"
+            "nextcloud-redis.service"
+          ];
+        };
+
+        serviceConfig.Restart = "always";
+      };
+
+      nextcloud-cron = {
+        containerConfig = {
+          image = "nextcloud:apache";
+
+          networks = [ "nextcloud" ];
+
+          volumes = [
+            "/mnt/snow/Docker/nextcloud/data:/var/www/html:z"
+          ];
+
+          exec = "/cron.sh";
+        };
+
+        unitConfig = {
+          Requires = [
+            "nextcloud-db.service"
+            "nextcloud-redis.service"
+          ];
+
+          After = [
+            "nextcloud-db.service"
+            "nextcloud-redis.service"
+          ];
+        };
+
+        serviceConfig.Restart = "always";
+      };
+
+      collabora = {
+        containerConfig = {
+          image = "collabora/code:latest";
+
+          hostname = "collabora";
+
+          publishPorts = [ "9980:9980" ];
+
+          addCapabilities = [ "MKNOD" ];
+
+          podmanArgs = [
+            "--privileged"
+            "--tty"
+          ];
+
+          # environments로 변경 및 attrset 형식으로 정의
+          environments = {
+            extra_params = "--o:ssl.enable=false --o:ssl.termination=true";
+          };
+        };
+
+        serviceConfig.Restart = "always";
+      };
+    };
+  };
+}

hosts/server/hikari/default/services/rustfs.nix

@@ -0,0 +1,38 @@
+{
+  config,
+  pkgs,
+  inputs,
+  ...
+}:
+{
+  # sops.secrets = {
+  #   "rustfs/access-key" = {
+  #     sopsFile = ../secrets/rustfs.yaml;
+  #     owner = config.services.rustfs.user;
+  #     group = config.services.rustfs.group;
+  #     mode = "0400";
+  #     restartUnits = [ "rustfs.service" ];
+  #   };
+
+  #   "rustfs/secret-key" = {
+  #     sopsFile = ../secrets/rustfs.yaml;
+  #     owner = config.services.rustfs.user;
+  #     group = config.services.rustfs.group;
+  #     mode = "0400";
+  #     restartUnits = [ "rustfs.service" ];
+  #   };
+  # };
+
+  services.rustfs = {
+    enable = true;
+    package = inputs.rustfs.packages.${pkgs.stdenv.hostPlatform.system}.default;
+
+    accessKeyFile = "/etc/secrets/rustfs-access-key";
+    secretKeyFile = "/etc/secrets/rustfs-secret-key";
+
+    volumes = "/mnt/snow/rustfs";
+    address = ":9000";
+    consoleAddress = ":9001";
+    consoleEnable = true;
+  };
+}