nodes['kunsi-p14s'] = { 'hostname': 'localhost', 'bundles': { 'arch-with-gui', 'backup-client', 'lldp', 'lm-sensors', 'nfs-client', 'systemd-boot', 'telegraf-battery-usage', 'zfs', }, 'groups': { 'arch', }, 'metadata': { 'arch-with-gui': { 'autologin': { 'username': 'kunsi', 'session': 'i3.desktop', }, 'i3pystatus': { 'deps': { 'colour', 'netifaces', 'basiciw', }, }, }, 'backup-client': { # only alert people if we're missing more than a week of backups 'one_backup_every_hours': 7 * 24, }, 'firewall': { 'port_rules': { # obs websocket thingie - just allow all RFC1918 ips here #'4444': { # '10.0.0.0/8', # '172.16.0.0/12', # '192.168.0.0/16', #}, # For the occasional file-share using `python -m http.server` '8000': {'*'}, }, }, 'icinga_options': { 'exclude_from_monitoring': True, }, 'interfaces': { 'enp2s0f0': { 'dhcp': True, }, 'enp5s0': { 'dhcp': True, }, # there is also wlp3s0, but that's managed by netctl }, 'nfs-client': { 'mounts': { 'nas-scansnap': { 'mountpoint': '/mnt/scansnap', 'serverpath': '172.19.138.20:/srv/scansnap', 'mount_options': { 'retry=0', 'rw', }, }, 'nas-storage': { 'mountpoint': '/mnt/nas', 'serverpath': '172.19.138.20:/storage/nas', 'mount_options': { 'retry=0', 'ro', }, }, }, }, 'openssh': { 'restrict-to': { 'rfc1918', 'ipv6', }, }, 'pacman': { 'linux-lts': True, 'packages': { # for hardware support 'amd-ucode': {}, 'mesa': {}, # various video drivers 'libva-mesa-driver': {}, 'mesa-vdpau': {}, 'xf86-video-amdgpu': {}, # for i3pystatus 'iw': {}, 'wireless_tools': {}, # all that other random stuff one needs 'apachedirectorystudio': {}, 'browserpass': {}, 'browserpass-firefox': {}, 'claws-mail': {}, 'claws-mail-themes': {}, 'dunst': {}, 'ferdi-bin': {}, 'ffmpeg': {}, 'gumbo-parser': {}, # for claws litehtml 'libnotify': {}, # provides notify-send 'mosh': {}, 'mosquitto': {}, 'mpv': {}, 'pass': {}, 'pass-otp': {}, 'pdftk': {}, 'pwgen': {}, 'qpdfview': {}, 'the_silver_searcher': {}, 'tlp': {}, # so we can stop charging the battery at 90% 'virt-manager': {}, 'xclip': {}, # for pass -c 'xf86-input-wacom': {}, }, }, 'systemd-boot': { 'default': 'arch-lts', 'entries': { 'arch-lts': { 'title': 'Arch Linux (LTS kernel)', 'linux': '/vmlinuz-linux-lts', 'initrd': [ '/amd-ucode.img', '/initramfs-linux-lts.img', ], 'options': { 'zfs=zroot/system/root', 'rw', }, }, 'arch-lts-fallback': { 'title': 'Arch Linux (LTS kernel, no ucode, fallback initramfs)', 'linux': '/vmlinuz-linux-lts', 'initrd': [ '/initramfs-linux-lts-fallback.img', ], 'options': { 'zfs=zroot/system/root', 'rw', }, }, }, }, 'systemd-networkd': { 'enable-resolved': True, }, 'timezone': 'Europe/Berlin', 'users': { 'kunsi': { 'password': vault.decrypt('encrypt$gAAAAABgLmmuQGRUStrQawoPee-758emIYn2u8-8ebrgzNAFSp7ifeFDdXXvs-zL3QogwNYlCtBHboH2xfy1rSj6OF5bbNO-tg=='), 'shell': '/usr/bin/fish', }, 'sophie': { 'delete': True, }, }, 'zfs': { 'datasets': { # this is not a complete list, but we can't create that # structure using bundlewrap anyway, so there's no point # in adding it here. 'zroot/system/journal': { 'mountpoint': '/var/log/journal', 'acltype': 'posix', }, 'zroot/system/root': { 'canmount': 'noauto', 'mountpoint': '/', }, 'zroot/user/kunsi': { 'mountpoint': '/home/kunsi', }, }, 'snapshots': { 'retain_per_dataset': { 'zroot/user/kunsi': { # juuuuuuuust to be sure 'hourly': 100, }, }, 'snapshot_never': { 'zroot/system/journal', }, }, }, }, 'os': 'arch', }