v
/
infrastructure
1
0
Fork 0
Code Issues 13 Pull Requests 1 Actions Packages Projects Releases Activity

fixed linting

pull/208/head
Vivian 2023-09-25 11:56:02 +02:00
parent 290ce7f72d
commit ea83c79fb3
59 changed files with 2843 additions and 2638 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

31
flake.nix
View File

@ -46,8 +46,17 @@
attic.url = "github:zhaofengli/attic";
};
outputs = { self, nixpkgs, nixpkgs_stable, vault-secrets, colmena
, nixos-generators, nur, attic, ... }@inputs:
outputs =
{ self
, nixpkgs
, nixpkgs_stable
, vault-secrets
, colmena
, nixos-generators
, nur
, attic
, ...
}@inputs:
let
inherit (nixpkgs) lib;
@ -81,7 +90,8 @@
source /etc/set-environment
nix repl --file "${./.}/repl.nix" $@
'';
in {
in
{
# Make the nixosConfigurations for compat reasons (e.g. vault)
nixosConfigurations =
(import (inputs.colmena + "/src/nix/hive/eval.nix") {
@ -93,12 +103,14 @@
}).nodes;
# Make the colmena configuration
colmena = lib.foldr (el: acc: acc // util.mkColmenaHost el) {
meta = {
inherit specialArgs;
nixpkgs = pkgs;
};
} nixHosts;
colmena = lib.foldr (el: acc: acc // util.mkColmenaHost el)
{
meta = {
inherit specialArgs;
nixpkgs = pkgs;
};
}
nixHosts;
packages.${system} = {
inherit apply-local;
@ -137,6 +149,7 @@
statix
terraform
nixfmt
nixpkgs-fmt
nixUnstable
nil
vault

18
nixos/common/default.nix
View File

@ -2,14 +2,16 @@
imports =
[ ./users ./modules inputs.vault-secrets.nixosModules.vault-secrets ];
vault-secrets = let
inherit (config.networking) domain hostName;
server = if domain == "olympus" then "vault" else "vault-0";
in lib.mkIf (domain == "olympus" || domain == "hades") {
vaultPrefix = "${domain}_secrets/nixos";
vaultAddress = "http://${server}.${domain}:8200/";
approlePrefix = "${domain}-${hostName}";
};
vault-secrets =
let
inherit (config.networking) domain hostName;
server = if domain == "olympus" then "vault" else "vault-0";
in
lib.mkIf (domain == "olympus" || domain == "hades") {
vaultPrefix = "${domain}_secrets/nixos";
vaultAddress = "http://${server}.${domain}:8200/";
approlePrefix = "${domain}-${hostName}";
};
home-manager = {
useGlobalPkgs = true;

70
nixos/common/desktop/default.nix
View File

@ -21,9 +21,26 @@
users.victor = import ./home.nix;
extraSpecialArgs = { inherit inputs; };
};
services = {
# Enable my config for the gnome desktop environment
services.v.gnome.enable = true;
# Enable my config for the gnome desktop environment
v.gnome.enable = true;
# Enable CUPS to print documents.
printing.enable = true;
pipewire = {
enable = true;
alsa.enable = true;
alsa.support32Bit = true;
pulse.enable = true;
# If you want to use JACK applications, uncomment this
#jack.enable = true;
# use the example session manager (no others are packaged yet so this is enabled by default,
# no need to redefine it in your config for now)
#media-session.enable = true;
};
};
# Set your time zone.
time.timeZone = "Europe/Amsterdam";
@ -42,9 +59,6 @@
LC_TIME = "nl_NL.UTF-8";
};
# Enable CUPS to print documents.
services.printing.enable = true;
# Global Packages
environment = { systemPackages = with pkgs; [ wireguard-tools sbctl ]; };
@ -52,18 +66,6 @@
sound.enable = true;
hardware.pulseaudio.enable = false;
security.rtkit.enable = true;
services.pipewire = {
enable = true;
alsa.enable = true;
alsa.support32Bit = true;
pulse.enable = true;
# If you want to use JACK applications, uncomment this
#jack.enable = true;
# use the example session manager (no others are packaged yet so this is enabled by default,
# no need to redefine it in your config for now)
#media-session.enable = true;
};
virtualisation = {
podman.enable = true;
@ -84,21 +86,27 @@
[ "DejaVuSansMono" "Ubuntu" "DroidSansMono" "NerdFontsSymbolsOnly" ];
})
];
programs = {
steam = {
programs.steam = {
enable = true;
# Open ports in the firewall for Steam Remote Play
remotePlay.openFirewall = true;
package = pkgs.steam.override {
extraPkgs = pkgs: with pkgs; [ gamescope mangohud ];
enable = true;
# Open ports in the firewall for Steam Remote Play
remotePlay.openFirewall = true;
package = pkgs.steam.override {
extraPkgs = pkgs: with pkgs; [ gamescope mangohud ];
};
};
gamemode.enable = true;
adb.enable = true;
};
networking = {
# Networking
networkmanager.enable = true;
firewall.checkReversePath = false;
firewall.enable = false;
};
programs.gamemode.enable = true;
programs.adb.enable = true;
# Networking
networking.networkmanager.enable = true;
networking.firewall.checkReversePath = false;
networking.firewall.enable = false;
}

76
nixos/common/desktop/home.nix
View File

@ -5,7 +5,8 @@ let
dnd-5e-latex-template = { pkgs = [ pkgs.v.dnd-5e-latex-template ]; };
};
my-python-packages = ps: with ps; [ pandas requests numpy ];
in {
in
{
home.packages = with pkgs; [
(python3.withPackages my-python-packages)
btop
@ -37,50 +38,53 @@ in {
# Enable my own hm modules
themes.v.catppuccin.enable = true;
programs.v.vscode.enable = true;
programs = {
v.vscode.enable = true;
programs.riff = {
enable = true;
direnv = true;
};
riff = {
enable = true;
direnv = true;
};
programs.firefox.enable = true;
firefox.enable = true;
programs.chromium = {
enable = true;
package = pkgs.ungoogled-chromium;
};
chromium = {
enable = true;
package = pkgs.ungoogled-chromium;
};
programs.direnv = {
enable = true;
nix-direnv.enable = true;
};
direnv = {
enable = true;
nix-direnv.enable = true;
};
programs.zsh = {
enable = true;
sessionVariables = { DIRENV_LOG_FORMAT = ""; };
};
zsh = {
enable = true;
sessionVariables = { DIRENV_LOG_FORMAT = ""; };
};
programs.thunderbird = {
enable = true;
profiles.default = {
isDefault = true;
thunderbird = {
enable = true;
profiles.default = {
isDefault = true;
};
};
};
# Syncthing
services.syncthing.enable = true;
xdg.userDirs = let home = config.home.homeDirectory;
in {
enable = true;
createDirectories = true;
desktop = "${home}/.desktop";
documents = "${home}/cloud/Documents";
download = "${home}/dl";
music = "${home}/cloud/Music";
pictures = "${home}/cloud/Pictures";
publicShare = "${home}/.publicShare";
templates = "${home}/.templates";
videos = "${home}/cloud/Videos";
};
xdg.userDirs =
let home = config.home.homeDirectory;
in {
enable = true;
createDirectories = true;
desktop = "${home}/.desktop";
documents = "${home}/cloud/Documents";
download = "${home}/dl";
music = "${home}/cloud/Music";
pictures = "${home}/cloud/Pictures";
publicShare = "${home}/.publicShare";
templates = "${home}/.templates";
videos = "${home}/cloud/Videos";
};
}

56
nixos/common/hm-modules/catppuccin.nix
View File

@ -3,36 +3,38 @@ with lib;
let cfg = config.themes.v.catppuccin;
in {
options.themes.v.catppuccin = { enable = mkEnableOption "catppuccin"; };
config = let
theme = "Catppuccin-Pink-Dark";
cursorTheme = config.home.pointerCursor.name;
in mkIf cfg.enable {
home.pointerCursor = {
name = "Bibata_Ghost";
size = 24;
package = pkgs.bibata-cursors-translucent;
};
config =
let
theme = "Catppuccin-Pink-Dark";
cursorTheme = config.home.pointerCursor.name;
in
mkIf cfg.enable {
home.pointerCursor = {
name = "Bibata_Ghost";
size = 24;
package = pkgs.bibata-cursors-translucent;
};
gtk = {
enable = true;
theme = {
name = theme;
package = pkgs.catppuccin-gtk;
gtk = {
enable = true;
theme = {
name = theme;
package = pkgs.catppuccin-gtk;
};
iconTheme = {
name = "Papirus-Dark";
package = pkgs.papirus-icon-theme.override { color = "violet"; };
};
cursorTheme = {
name = cursorTheme;
inherit (config.home.pointerCursor) package size;
};
};
iconTheme = {
name = "Papirus-Dark";
package = pkgs.papirus-icon-theme.override { color = "violet"; };
};
cursorTheme = {
name = cursorTheme;
inherit (config.home.pointerCursor) package size;
};
};
programs.vscode = {
userSettings."workbench.colorTheme" = "Catppuccin Frappé";
extensions = [ pkgs.vscode-extensions.catppuccin.catppuccin-vsc ];
programs.vscode = {
userSettings."workbench.colorTheme" = "Catppuccin Frappé";
extensions = [ pkgs.vscode-extensions.catppuccin.catppuccin-vsc ];
};
};
};
}

14
nixos/common/hm-modules/nvim.nix
View File

@ -65,12 +65,14 @@ in {
comment-nvim = { enable = true; };
lsp = {
enable = true;
servers.nil_ls.enable = true;
servers.rust-analyzer.enable = true;
servers.pyright.enable = true;
servers.elixirls.enable = true;
servers.clangd.enable = true;
servers.yamlls.enable = true;
servers = {
nil_ls.enable = true;
rust-analyzer.enable = true;
pyright.enable = true;
elixirls.enable = true;
clangd.enable = true;
yamlls.enable = true;
};
};
trouble.enable = true;
lspkind.enable = true;

5
nixos/common/modules/dns.nix
View File

@ -15,7 +15,8 @@ let
ptr6Data = { hostname, realm, ip6, ... }: ''"${ip6} ${hostname}.${realm}"'';
cfg = config.services.v.dns;
in {
in
{
options.services.v.dns = {
enable = mkEnableOption "v.dns";
@ -47,7 +48,7 @@ in {
config = mkIf cfg.enable {
networking.firewall = mkIf cfg.openFirewall {
allowedTCPPorts = [ 53 ] ;
allowedTCPPorts = [ 53 ];
allowedUDPPorts = [ 53 ];
};
services.prometheus.exporters.unbound = mkIf cfg.enableMetrics {

34
nixos/common/modules/gnome/default.nix
View File

@ -14,22 +14,28 @@ in {
};
config = mkIf cfg.enable {
services.xserver.enable = true;
services.xserver.excludePackages = [ pkgs.xterm ];
services = {
xserver = {
enable = true;
excludePackages = [ pkgs.xterm ];
# Configure keymap in X11
layout = "us";
xkbVariant = "altgr-intl";
# Enable the GNOME Desktop Environment.
displayManager.gdm.enable = true;
desktopManager.gnome.enable = true;
};
udev.packages = with pkgs; [ gnome.gnome-settings-daemon ];
dbus.enable = true;
udisks2.enable = true;
};
# Add Home-manager dconf stuff
home-manager.sharedModules = mkIf cfg.hm [ ./hm.nix ];
# Configure keymap in X11
services.xserver = {
layout = "us";
xkbVariant = "altgr-intl";
};
# Enable the GNOME Desktop Environment.
services.xserver.displayManager.gdm.enable = true;
services.xserver.desktopManager.gnome.enable = true;
services.udev.packages = with pkgs; [ gnome.gnome-settings-daemon ];
environment.gnome.excludePackages =
(with pkgs; [ gnome-photos gnome-tour gnome-connections ])
++ (with pkgs.gnome; [
@ -54,8 +60,6 @@ in {
# Services required for gnome
programs.dconf.enable = true;
services.dbus.enable = true;
services.udisks2.enable = true;
# Extra gnome packages
environment.systemPackages = with pkgs; [

17
nixos/common/modules/gnome/hm.nix
View File

@ -7,15 +7,18 @@ let
generate_custom_keybindings = binds:
{
"org/gnome/settings-daemon/plugins/media-keys" = {
custom-keybindings = map (name:
"/org/gnome/settings-daemon/plugins/media-keys/custom-keybindings/${name}/")
custom-keybindings = map
(name:
"/org/gnome/settings-daemon/plugins/media-keys/custom-keybindings/${name}/")
(attrNames binds);
};
} // mapAttrs' (name:
nameValuePair
"org/gnome/settings-daemon/plugins/media-keys/custom-keybindings/${name}")
binds;
in {
} // mapAttrs'
(name:
nameValuePair
"org/gnome/settings-daemon/plugins/media-keys/custom-keybindings/${name}")
binds;
in
{
xdg.mimeApps.enable = true;
xdg.mimeApps.defaultApplications = {
"text/plain" = "org.gnome.TextEditor.desktop";

6
nixos/common/modules/meta.nix
View File

@ -20,7 +20,8 @@ let
};
};
};
in {
in
{
options.meta = {
exposes = mkOption {
@ -38,6 +39,5 @@ in {
};
};
config = {
};
config = { };
}

40
nixos/common/modules/nginx.nix
View File

@ -1,30 +1,32 @@
{ lib, hosts, config, ... }:
with lib;
let cfg = config.services.v.nginx;
in {
in {
options.services.v.nginx.autoExpose =
mkEnableOption "generate vhosts";
config = let
config =
let
proxy = url: {
enableACME = true;
forceSSL = true;
locations."/" = {
proxyPass = url;
proxyWebsockets = true;
proxy = url: {
enableACME = true;
forceSSL = true;
locations."/" = {
proxyPass = url;
proxyWebsockets = true;
};
};
};
hosts' =
filter (hasAttr "exposes") (attrValues hosts.${config.networking.domain});
exposes = { ip, exposes, ... }:
map ({ domain, port ? 80}: { inherit ip domain port; }) (attrValues exposes);
mkVhost = { ip, domain, port}: {
"${domain}" = proxy "http://${ip}:${toString port}";
hosts' =
filter (hasAttr "exposes") (attrValues hosts.${config.networking.domain});
exposes = { ip, exposes, ... }:
map ({ domain, port ? 80 }: { inherit ip domain port; }) (attrValues exposes);
mkVhost = { ip, domain, port }: {
"${domain}" = proxy "http://${ip}:${toString port}";
};
vhosts = foldr (el: acc: acc // mkVhost el) { } (concatMap exposes hosts');
in
mkIf cfg.autoExpose {
services.nginx.virtualHosts = vhosts;
};
vhosts = foldr (el: acc: acc // mkVhost el) { } (concatMap exposes hosts');
in mkIf cfg.autoExpose {
services.nginx.virtualHosts = vhosts;
};
}

104
nixos/common/modules/unpackerr.nix
View File

@ -57,7 +57,8 @@ let
'';
};
};
in {
in
{
options.services.unpackerr = {
enable = mkEnableOption "unpackerr";
@ -257,61 +258,62 @@ in {
after = [ "network.target" ];
description = "unpackerr system service";
# Filter out all unset variables else unpackerr complains
environment = filterAttrs (_n: v: stringLength v > 0) {
# General options
UN_DEBUG = "${toString cfg.debug}";
UN_INTERVAL = "${cfg.interval}";
UN_START_DELAY = "${cfg.startDelay}";
UN_RETRY_DELAY = "${cfg.retryDelay}";
UN_MAX_RETRIES = "${toString cfg.maxRetries}";
UN_PARALLEL = "${toString cfg.parallel}";
UN_FILE_MODE = "${cfg.fileMode}";
UN_DIR_MODE = "${cfg.dirMode}";
environment = filterAttrs (_n: v: stringLength v > 0)
{
# General options
UN_DEBUG = "${toString cfg.debug}";
UN_INTERVAL = "${cfg.interval}";
UN_START_DELAY = "${cfg.startDelay}";
UN_RETRY_DELAY = "${cfg.retryDelay}";
UN_MAX_RETRIES = "${toString cfg.maxRetries}";
UN_PARALLEL = "${toString cfg.parallel}";
UN_FILE_MODE = "${cfg.fileMode}";
UN_DIR_MODE = "${cfg.dirMode}";
# Sonarr
UN_SONARR_0_URL = "${cfg.sonarr.url}";
UN_SONARR_0_API_KEY = "${cfg.sonarr.apiKey}";
UN_SONARR_0_PATHS_0 = "${cfg.sonarr.paths}";
UN_SONARR_0_PROTOCOLS = "${cfg.sonarr.protocols}";
UN_SONARR_0_TIMEOUT = "${cfg.sonarr.timeout}";
UN_SONARR_0_DELETE_ORIG = "${toString cfg.sonarr.deleteOrginal}";
UN_SONARR_0_DELETE_DELAY = "${cfg.sonarr.deleteDelay}";
# Sonarr
UN_SONARR_0_URL = "${cfg.sonarr.url}";
UN_SONARR_0_API_KEY = "${cfg.sonarr.apiKey}";
UN_SONARR_0_PATHS_0 = "${cfg.sonarr.paths}";
UN_SONARR_0_PROTOCOLS = "${cfg.sonarr.protocols}";
UN_SONARR_0_TIMEOUT = "${cfg.sonarr.timeout}";
UN_SONARR_0_DELETE_ORIG = "${toString cfg.sonarr.deleteOrginal}";
UN_SONARR_0_DELETE_DELAY = "${cfg.sonarr.deleteDelay}";
# Radarr
UN_RADARR_0_URL = "${cfg.radarr.url}";
UN_RADARR_0_API_KEY = "${cfg.radarr.apiKey}";
UN_RADARR_0_PATHS_0 = "${cfg.radarr.paths}";
UN_RADARR_0_PROTOCOLS = "${cfg.radarr.protocols}";
UN_RADARR_0_TIMEOUT = "${cfg.radarr.timeout}";
UN_RADARR_0_DELETE_ORIG = "${toString cfg.radarr.deleteOrginal}";
UN_RADARR_0_DELETE_DELAY = "${cfg.radarr.deleteDelay}";
# Radarr
UN_RADARR_0_URL = "${cfg.radarr.url}";
UN_RADARR_0_API_KEY = "${cfg.radarr.apiKey}";
UN_RADARR_0_PATHS_0 = "${cfg.radarr.paths}";
UN_RADARR_0_PROTOCOLS = "${cfg.radarr.protocols}";
UN_RADARR_0_TIMEOUT = "${cfg.radarr.timeout}";
UN_RADARR_0_DELETE_ORIG = "${toString cfg.radarr.deleteOrginal}";
UN_RADARR_0_DELETE_DELAY = "${cfg.radarr.deleteDelay}";
# Lidarr
UN_LIDARR_0_URL = "${cfg.lidarr.url}";
UN_LIDARR_0_API_KEY = "${cfg.lidarr.apiKey}";
UN_LIDARR_0_PATHS_0 = "${cfg.lidarr.paths}";
UN_LIDARR_0_PROTOCOLS = "${cfg.lidarr.protocols}";
UN_LIDARR_0_TIMEOUT = "${cfg.lidarr.timeout}";
UN_LIDARR_0_DELETE_ORIG = "${toString cfg.lidarr.deleteOrginal}";
UN_LIDARR_0_DELETE_DELAY = "${cfg.lidarr.deleteDelay}";
# Lidarr
UN_LIDARR_0_URL = "${cfg.lidarr.url}";
UN_LIDARR_0_API_KEY = "${cfg.lidarr.apiKey}";
UN_LIDARR_0_PATHS_0 = "${cfg.lidarr.paths}";
UN_LIDARR_0_PROTOCOLS = "${cfg.lidarr.protocols}";
UN_LIDARR_0_TIMEOUT = "${cfg.lidarr.timeout}";
UN_LIDARR_0_DELETE_ORIG = "${toString cfg.lidarr.deleteOrginal}";
UN_LIDARR_0_DELETE_DELAY = "${cfg.lidarr.deleteDelay}";
# Readarr
UN_READARR_0_URL = "${cfg.readarr.url}";
UN_READARR_0_API_KEY = "${cfg.readarr.apiKey}";
UN_READARR_0_PATHS_0 = "${cfg.readarr.paths}";
UN_READARR_0_PROTOCOLS = "${cfg.readarr.protocols}";
UN_READARR_0_TIMEOUT = "${cfg.readarr.timeout}";
UN_READARR_0_DELETE_ORIG = "${toString cfg.readarr.deleteOrginal}";
UN_READARR_0_DELETE_DELAY = "${cfg.readarr.deleteDelay}";
# Readarr
UN_READARR_0_URL = "${cfg.readarr.url}";
UN_READARR_0_API_KEY = "${cfg.readarr.apiKey}";
UN_READARR_0_PATHS_0 = "${cfg.readarr.paths}";
UN_READARR_0_PROTOCOLS = "${cfg.readarr.protocols}";
UN_READARR_0_TIMEOUT = "${cfg.readarr.timeout}";
UN_READARR_0_DELETE_ORIG = "${toString cfg.readarr.deleteOrginal}";
UN_READARR_0_DELETE_DELAY = "${cfg.readarr.deleteDelay}";
# Folder
UN_FOLDER_0_PATH = "${cfg.folder.path}";
UN_FOLDER_0_EXTRACT_PATH = "${cfg.folder.extractPath}";
UN_FOLDER_0_DELETE_AFTER = "${cfg.folder.deleteAfter}";
UN_FOLDER_0_DELETE_ORIGINAL = "${toString cfg.folder.deleteOrginal}";
UN_FOLDER_0_DELETE_FILES = "${toString cfg.folder.deleteFiles}";
UN_FOLDER_0_MOVE_BACK = "${toString cfg.folder.moveBack}";
} // cfg.extraConfig;
# Folder
UN_FOLDER_0_PATH = "${cfg.folder.path}";
UN_FOLDER_0_EXTRACT_PATH = "${cfg.folder.extractPath}";
UN_FOLDER_0_DELETE_AFTER = "${cfg.folder.deleteAfter}";
UN_FOLDER_0_DELETE_ORIGINAL = "${toString cfg.folder.deleteOrginal}";
UN_FOLDER_0_DELETE_FILES = "${toString cfg.folder.deleteFiles}";
UN_FOLDER_0_MOVE_BACK = "${toString cfg.folder.moveBack}";
} // cfg.extraConfig;
serviceConfig = {
User = cfg.user;
Group = cfg.group;

17
nixos/common/modules/vault.nix
View File

@ -7,13 +7,16 @@ let
# Find all vault hosts that do not have the same IP as the current host
vault_hosts =
filter ({ tags ? [ ], ip ? "", ... }: (elem "vault" tags) && (ip != hostIP))
flat_hosts;
cluster_config = concatStrings (map ({ ip, ... }: ''
retry_join {
leader_api_addr = "http://${ip}:${toString cfg.port}"
}
'') vault_hosts);
in {
flat_hosts;
cluster_config = concatStrings (map
({ ip, ... }: ''
retry_join {
leader_api_addr = "http://${ip}:${toString cfg.port}"
}
'')
vault_hosts);
in
{
options.services.v.vault = {
enable = mkEnableOption "v's vault";

28
nixos/common/users/victor.nix
View File

@ -23,23 +23,27 @@
};
home-manager.users.victor = {
programs.home-manager.enable = true;
programs = {
home-manager.enable = true;
home.username = "victor";
home.homeDirectory = "/home/victor";
home.stateVersion = "23.05";
v.nvim.enable = true;
v.git.enable = true;
programs.v.nvim.enable = true;
programs.v.git.enable = true;
tmux = {
enable = true;
shortcut = "b";
terminal = "screen-256color";
clock24 = true;
};
programs.tmux = {
enable = true;
shortcut = "b";
terminal = "screen-256color";
clock24 = true;
bat.enable = true;
};
home = {
programs.bat.enable = true;
username = "victor";
homeDirectory = "/home/victor";
stateVersion = "23.05";
};
};
}

3
nixos/hosts/hades/immich/configuration.nix
View File

@ -7,7 +7,8 @@ let
# https://github.com/immich-app/immich/releases
# version = "1.55.1";
dataDir = "/var/lib/immich";
in {
in
{
imports = [ ];
# This value determines the NixOS release from which the default

11
nixos/hosts/hades/lucy/configuration.nix
View File

@ -24,7 +24,8 @@ let
doCheck = false;
};
in {
in
{
imports = [ ./hardware-configuration.nix ];
# This value determines the NixOS release from which the default
@ -46,10 +47,12 @@ in {
trivy
wapiti
];
boot.loader = {
boot.loader.systemd-boot.enable = true;
boot.loader.efi.canTouchEfiVariables = true;
boot.loader.efi.efiSysMountPoint = "/boot";
systemd-boot.enable = true;
efi.canTouchEfiVariables = true;
efi.efiSysMountPoint = "/boot";
};
virtualisation.docker.enable = true;

26
nixos/hosts/hades/lucy/hardware-configuration.nix
View File

@ -5,19 +5,21 @@
{
imports = [ (modulesPath + "/profiles/qemu-guest.nix") ];
boot = {
boot.initrd.availableKernelModules = [
"uhci_hcd"
"ehci_pci"
"ahci"
"virtio_pci"
"virtio_scsi"
"sd_mod"
"sr_mod"
];
boot.initrd.kernelModules = [ ];
boot.kernelModules = [ ];
boot.extraModulePackages = [ ];
initrd.availableKernelModules = [
"uhci_hcd"
"ehci_pci"
"ahci"
"virtio_pci"
"virtio_scsi"
"sd_mod"
"sr_mod"
];
initrd.kernelModules = [ ];
kernelModules = [ ];
extraModulePackages = [ ];
};
fileSystems."/" = {
device = "/dev/disk/by-uuid/749c02fd-209d-4974-917e-38b749d10ec2";

8
nixos/hosts/hades/mastodon/configuration.nix
View File

@ -2,7 +2,8 @@
let
vs = config.vault-secrets.secrets;
cfg = config.services.mastodon;
in {
in
{
system.stateVersion = "21.05";
# Use DHCP with static leases
networking.interfaces.eth0.useDHCP = true;
@ -100,6 +101,7 @@ in {
};
};
networking.firewall = let cfg = config.services.mastodon;
in { allowedTCPPorts = [ cfg.streamingPort cfg.webPort ]; };
networking.firewall =
let cfg = config.services.mastodon;
in { allowedTCPPorts = [ cfg.streamingPort cfg.webPort ]; };
}

223
nixos/hosts/hades/nginx/configuration.nix
View File

@ -12,7 +12,8 @@ let
proxyWebsockets = true;
};
};
in {
in
{
imports = [ ];
nixpkgs.config.permittedInsecurePackages = [ "openssl-1.1.1t" ];
@ -25,10 +26,12 @@ in {
# (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
system.stateVersion = "23.05"; # Did you read the comment?
networking.firewall.allowedTCPPorts = [ 80 443 ];
security.acme = {
security.acme.defaults.email = "victorheld12@gmail.com";
security.acme.acceptTerms = true;
security.acme.preliminarySelfsigned = true;
defaults.email = "victorheld12@gmail.com";
acceptTerms = true;
preliminarySelfsigned = true;
};
services.nginx = {
enable = true;
@ -39,38 +42,39 @@ in {
clientMaxBodySize = "1024m";
package = pkgs.nginxMainline;
virtualHosts = {
virtualHosts."cshub.nl" = proxy "http://192.168.0.113";
virtualHosts."api.cshub.nl" = proxy "http://192.168.0.113";
"cshub.nl" = proxy "http://192.168.0.113";
"api.cshub.nl" = proxy "http://192.168.0.113";
virtualHosts."ha.xirion.net" = proxy "http://192.168.0.129:8123";
virtualHosts."xirion.net" = {
enableACME = true;
forceSSL = true;
locations."/".extraConfig = ''
add_header Content-Type 'text/html; charset=UTF-8';
return 200 'Hello, World!';
'';
locations."= /.well-known/host-meta".extraConfig = ''
return 301 https://fedi.xirion.net$request_uri;
'';
};
# virtualHosts."blog.xirion.net" = proxy "http://10.10.10.12";
virtualHosts."git.xirion.net" = proxy "http://10.10.10.12";
# virtualHosts."mail.xirion.net" = proxy "http://192.168.0.118";
virtualHosts."o.xirion.net" = proxy "http://192.168.0.112:9000";
virtualHosts."g.xirion.net" = proxy "http://garage.hades:3900";
virtualHosts."requests.xirion.net" = proxy "http://overseerr.hades:5055";
virtualHosts."pass.xirion.net" = proxy "http://bitwarden_rs";
virtualHosts."repo.xirion.net" = proxy "http://archlinux";
virtualHosts."thelounge.xirion.net" = proxy "http://thelounge:9000";
virtualHosts."attic.xirion.net" = proxy "http://attic.hades:8080";
"ha.xirion.net" = proxy "http://192.168.0.129:8123";
"xirion.net" = {
enableACME = true;
forceSSL = true;
locations."/".extraConfig = ''
add_header Content-Type 'text/html; charset=UTF-8';
return 200 'Hello, World!';
'';
locations."= /.well-known/host-meta".extraConfig = ''
return 301 https://fedi.xirion.net$request_uri;
'';
};
# virtualHosts."blog.xirion.net" = proxy "http://10.10.10.12";
"git.xirion.net" = proxy "http://10.10.10.12";
# virtualHosts."mail.xirion.net" = proxy "http://192.168.0.118";
"o.xirion.net" = proxy "http://192.168.0.112:9000";
"g.xirion.net" = proxy "http://garage.hades:3900";
"requests.xirion.net" = proxy "http://overseerr.hades:5055";
"pass.xirion.net" = proxy "http://bitwarden_rs";
"repo.xirion.net" = proxy "http://archlinux";
"thelounge.xirion.net" = proxy "http://thelounge:9000";
"attic.xirion.net" = proxy "http://attic.hades:8080";
virtualHosts."tautulli.xirion.net" = proxy "http://tautulli.hades:8080";
virtualHosts."peepeepoopoo.xirion.net" = proxy "http://tautulli.hades:8080"; # Deprecated but Ricardo has it bookmarked already!
"tautulli.xirion.net" = proxy "http://tautulli.hades:8080";
"peepeepoopoo.xirion.net" = proxy "http://tautulli.hades:8080"; # Deprecated but Ricardo has it bookmarked already!
virtualHosts."registry.xirion.net" = proxy "http://docker-registry:5000"
// {
"registry.xirion.net" = proxy "http://docker-registry:5000"
// {
locations."/".extraConfig = ''
allow 127.0.0.1;
allow 10.42.42.0/23;
@ -83,91 +87,94 @@ in {
'';
};
virtualHosts."plex.xirion.net" = {
# Since we want a secure connection, we force SSL
forceSSL = true;
enableACME = true;
"plex.xirion.net" = {
# Since we want a secure connection, we force SSL
forceSSL = true;
enableACME = true;
extraConfig = ''
#Some players don't reopen a socket and playback stops totally instead of resuming after an extended pause
send_timeout 100m;
extraConfig = ''
#Some players don't reopen a socket and playback stops totally instead of resuming after an extended pause
send_timeout 100m;
# Why this is important: https://blog.cloudflare.com/ocsp-stapling-how-cloudflare-just-made-ssl-30/
ssl_stapling on;
ssl_stapling_verify on;
# Why this is important: https://blog.cloudflare.com/ocsp-stapling-how-cloudflare-just-made-ssl-30/
ssl_stapling on;
ssl_stapling_verify on;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_prefer_server_ciphers on;
#Intentionally not hardened for security for player support and encryption video streams has a lot of overhead with something like AES-256-GCM-SHA384.
ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:ECDHE-RSA-DES-CBC3-SHA:ECDHE-ECDSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA';
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_prefer_server_ciphers on;
#Intentionally not hardened for security for player support and encryption video streams has a lot of overhead with something like AES-256-GCM-SHA384.
ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:ECDHE-RSA-DES-CBC3-SHA:ECDHE-ECDSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA';
# Forward real ip and host to Plex
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header Host $server_addr;
proxy_set_header Referer $server_addr;
proxy_set_header Origin $server_addr;
# Forward real ip and host to Plex
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header Host $server_addr;
proxy_set_header Referer $server_addr;
proxy_set_header Origin $server_addr;
# Nginx default client_max_body_size is 1MB, which breaks Camera Upload feature from the phones.
# Increasing the limit fixes the issue. Anyhow, if 4K videos are expected to be uploaded, the size might need to be increased even more
client_max_body_size 100M;
# Nginx default client_max_body_size is 1MB, which breaks Camera Upload feature from the phones.
# Increasing the limit fixes the issue. Anyhow, if 4K videos are expected to be uploaded, the size might need to be increased even more
client_max_body_size 100M;
# Plex headers
proxy_set_header X-Plex-Client-Identifier $http_x_plex_client_identifier;
proxy_set_header X-Plex-Device $http_x_plex_device;
proxy_set_header X-Plex-Device-Name $http_x_plex_device_name;
proxy_set_header X-Plex-Platform $http_x_plex_platform;
proxy_set_header X-Plex-Platform-Version $http_x_plex_platform_version;
proxy_set_header X-Plex-Product $http_x_plex_product;
proxy_set_header X-Plex-Token $http_x_plex_token;
proxy_set_header X-Plex-Version $http_x_plex_version;
proxy_set_header X-Plex-Nocache $http_x_plex_nocache;
proxy_set_header X-Plex-Provides $http_x_plex_provides;
proxy_set_header X-Plex-Device-Vendor $http_x_plex_device_vendor;
proxy_set_header X-Plex-Model $http_x_plex_model;
# Plex headers
proxy_set_header X-Plex-Client-Identifier $http_x_plex_client_identifier;
proxy_set_header X-Plex-Device $http_x_plex_device;
proxy_set_header X-Plex-Device-Name $http_x_plex_device_name;
proxy_set_header X-Plex-Platform $http_x_plex_platform;
proxy_set_header X-Plex-Platform-Version $http_x_plex_platform_version;
proxy_set_header X-Plex-Product $http_x_plex_product;
proxy_set_header X-Plex-Token $http_x_plex_token;
proxy_set_header X-Plex-Version $http_x_plex_version;
proxy_set_header X-Plex-Nocache $http_x_plex_nocache;
proxy_set_header X-Plex-Provides $http_x_plex_provides;
proxy_set_header X-Plex-Device-Vendor $http_x_plex_device_vendor;
proxy_set_header X-Plex-Model $http_x_plex_model;
# Buffering off send to the client as soon as the data is received from Plex.
proxy_redirect off;
proxy_buffering off;
'';
locations."/" = {
# Buffering off send to the client as soon as the data is received from Plex.
proxy_redirect off;
proxy_buffering off;
'';
locations."/" = {
proxyWebsockets = true;
proxyPass = "http://plex2.hades:32400/";
proxyWebsockets = true;
proxyPass = "http://plex2.hades:32400/";
};
};
"fedi.xirion.net" = {
enableACME = true;
forceSSL = true;
root = "${pkgs.v.glitch-soc}/public/";
locations = {
"/".tryFiles = "$uri @proxy";
# location ~ ^/(emoji|packs|system/accounts/avatars|system/media_attachments/files) {
# add_header Cache-Control "public, max-age=31536000, immutable";
# add_header Strict-Transport-Security "max-age=31536000";
# try_files $uri @proxy;
# }
# location /sw.js {
# add_header Cache-Control "public, max-age=0";
# add_header Strict-Transport-Security "max-age=31536000";
# try_files $uri @proxy;
# }
"@proxy" = {
proxyPass = "http://192.168.0.138:55001";
proxyWebsockets = true;
};
"/api/v1/streaming" = {
proxyPass = "http://192.168.0.138:55000";
proxyWebsockets = true;
};
};
};
"fedi-media.xirion.net" = proxy "http://garage.hades:3902";
};
virtualHosts."fedi.xirion.net" = {
enableACME = true;
forceSSL = true;
root = "${pkgs.v.glitch-soc}/public/";
locations."/".tryFiles = "$uri @proxy";
# location ~ ^/(emoji|packs|system/accounts/avatars|system/media_attachments/files) {
# add_header Cache-Control "public, max-age=31536000, immutable";
# add_header Strict-Transport-Security "max-age=31536000";
# try_files $uri @proxy;
# }
# location /sw.js {
# add_header Cache-Control "public, max-age=0";
# add_header Strict-Transport-Security "max-age=31536000";
# try_files $uri @proxy;
# }
locations."@proxy" = {
proxyPass = "http://192.168.0.138:55001";
proxyWebsockets = true;
};
locations."/api/v1/streaming" = {
proxyPass = "http://192.168.0.138:55000";
proxyWebsockets = true;
};
};
virtualHosts."fedi-media.xirion.net" = proxy "http://garage.hades:3902";
};
}

3
nixos/hosts/hades/pmm/configuration.nix
View File

@ -14,7 +14,8 @@ let
-v "/etc/pmm/TVShows.yml:/config/TVShows.yml:ro" \
${container} --run
'';
in {
in
{
imports = [ ];
# This value determines the NixOS release from which the default

44
nixos/hosts/hades/rtorrent/configuration.nix
View File

@ -21,27 +21,29 @@ in {
vault-secrets.secrets.rtorrent = { services = [ "wg-quick-wg0" ]; };
# Mullvad VPN
networking.wg-quick.interfaces = let
postUpScript = pkgs.writeScriptBin "post_up" ''
#!${pkgs.stdenv.shell}
${pkgs.iproute2}/bin/ip route add 10.42.42.0/23 via 192.168.0.1
${pkgs.iproute2}/bin/ip route add 10.100.0.0/24 via 192.168.0.1
'';
in {
wg0 = {
address = [ "10.66.153.191/32" "fc00:bbbb:bbbb:bb01::3:99be/128" ];
dns = [ "10.64.0.1" ];
privateKeyFile = "${vs.rtorrent}/wireguardKey";
postUp = "${postUpScript}/bin/post_up || true";
networking.wg-quick.interfaces =
let
postUpScript = pkgs.writeScriptBin "post_up" ''
#!${pkgs.stdenv.shell}
${pkgs.iproute2}/bin/ip route add 10.42.42.0/23 via 192.168.0.1
${pkgs.iproute2}/bin/ip route add 10.100.0.0/24 via 192.168.0.1
'';
in
{
wg0 = {
address = [ "10.66.153.191/32" "fc00:bbbb:bbbb:bb01::3:99be/128" ];
dns = [ "10.64.0.1" ];
privateKeyFile = "${vs.rtorrent}/wireguardKey";
postUp = "${postUpScript}/bin/post_up || true";
peers = [
{
publicKey = "HQHCrq4J6bSpdW1fI5hR/bvcrYa6HgGgwaa5ZY749ik=";
allowedIPs = [ "0.0.0.0/0" "::/0"];
endpoint = "185.213.155.73:51820";
# persistentKeepalive = 25;
}
];
peers = [
{
publicKey = "HQHCrq4J6bSpdW1fI5hR/bvcrYa6HgGgwaa5ZY749ik=";
allowedIPs = [ "0.0.0.0/0" "::/0" ];
endpoint = "185.213.155.73:51820";
# persistentKeepalive = 25;
}
];
};
};
};
}

165
nixos/hosts/hades/rtorrent/rtorrent.nix
View File

@ -4,112 +4,113 @@
port = 54945; # Port Forwarded in mullvad
downloadDir = "/mnt/storage/torrents/r";
package = pkgs.jesec-rtorrent;
configText = let cfg = config.services.rtorrent;
in pkgs.lib.mkForce ''
# rTorrent runtime directory (cfg.basedir) [default: "$HOME/.local/share/rtorrent"]
method.insert = cfg.basedir, private|const|string, (cat,"${cfg.dataDir}/")
configText =
let cfg = config.services.rtorrent;
in pkgs.lib.mkForce ''
# rTorrent runtime directory (cfg.basedir) [default: "$HOME/.local/share/rtorrent"]
method.insert = cfg.basedir, private|const|string, (cat,"${cfg.dataDir}/")
# Default download directory (cfg.download) [default: "$(cfg.basedir)/download"]
method.insert = cfg.download, private|const|string, (cat,"${cfg.downloadDir}")
# Default download directory (cfg.download) [default: "$(cfg.basedir)/download"]
method.insert = cfg.download, private|const|string, (cat,"${cfg.downloadDir}")
# RPC Socket
method.insert = cfg.rpcsock, private|const|string, (cat,"${cfg.rpcSocket}")
# RPC Socket
method.insert = cfg.rpcsock, private|const|string, (cat,"${cfg.rpcSocket}")
# Log directory (cfg.logs) [default: "$(cfg.basedir)/log"]
method.insert = cfg.logs, private|const|string, (cat,(cfg.basedir),"log/")
method.insert = cfg.logfile, private|const|string, (cat,(cfg.logs),"rtorrent-",(system.time),".log")
# Log directory (cfg.logs) [default: "$(cfg.basedir)/log"]
method.insert = cfg.logs, private|const|string, (cat,(cfg.basedir),"log/")
method.insert = cfg.logfile, private|const|string, (cat,(cfg.logs),"rtorrent-",(system.time),".log")
# Torrent session directory (cfg.session) [default: "$(cfg.basedir)/.session"]
method.insert = cfg.session, private|const|string, (cat,(cfg.basedir),".session/")
# Torrent session directory (cfg.session) [default: "$(cfg.basedir)/.session"]
method.insert = cfg.session, private|const|string, (cat,(cfg.basedir),".session/")
# Watch (drop to add) directories (cfg.watch) [default: "$(cfg.basedir)/watch"]
method.insert = cfg.watch, private|const|string, (cat,(cfg.basedir),"watch/")
# Watch (drop to add) directories (cfg.watch) [default: "$(cfg.basedir)/watch"]
method.insert = cfg.watch, private|const|string, (cat,(cfg.basedir),"watch/")
# Create directories
fs.mkdir.recursive = (cat,(cfg.basedir))
# Create directories
fs.mkdir.recursive = (cat,(cfg.basedir))
fs.mkdir = (cat,(cfg.download))
fs.mkdir = (cat,(cfg.logs))
fs.mkdir = (cat,(cfg.session))
fs.mkdir = (cat,(cfg.download))
fs.mkdir = (cat,(cfg.logs))
fs.mkdir = (cat,(cfg.session))
fs.mkdir = (cat,(cfg.watch))
fs.mkdir = (cat,(cfg.watch),"/load")
fs.mkdir = (cat,(cfg.watch),"/start")
fs.mkdir = (cat,(cfg.watch))
fs.mkdir = (cat,(cfg.watch),"/load")
fs.mkdir = (cat,(cfg.watch),"/start")
# Drop to "$(cfg.watch)/load" to add torrent
schedule2 = watch_load, 11, 10, ((load.verbose, (cat, (cfg.watch), "load/*.torrent")))
# Drop to "$(cfg.watch)/load" to add torrent
schedule2 = watch_load, 11, 10, ((load.verbose, (cat, (cfg.watch), "load/*.torrent")))
# Drop to "$(cfg.watch)/start" to add torrent and start downloading
schedule2 = watch_start, 10, 10, ((load.start_verbose, (cat, (cfg.watch), "start/*.torrent")))
# Drop to "$(cfg.watch)/start" to add torrent and start downloading
schedule2 = watch_start, 10, 10, ((load.start_verbose, (cat, (cfg.watch), "start/*.torrent")))
# Listening port for incoming peer traffic
network.port_range.set = ${toString cfg.port}-${toString cfg.port}
network.port_random.set = no
# Listening port for incoming peer traffic
network.port_range.set = ${toString cfg.port}-${toString cfg.port}
network.port_random.set = no
# Distributed Hash Table and Peer EXchange
dht.mode.set = disable
dht.port.set = 6881
protocol.pex.set = yes
# Distributed Hash Table and Peer EXchange
dht.mode.set = disable
dht.port.set = 6881
protocol.pex.set = yes
# UDP tracker support
trackers.use_udp.set = yes
# UDP tracker support
trackers.use_udp.set = yes
# Peer settings
throttle.max_uploads.set = 100
throttle.max_uploads.global.set = 250
throttle.min_peers.normal.set = 20
throttle.max_peers.normal.set = 60
throttle.min_peers.seed.set = 30
throttle.max_peers.seed.set = 80
trackers.numwant.set = 80
# Peer settings
throttle.max_uploads.set = 100
throttle.max_uploads.global.set = 250
throttle.min_peers.normal.set = 20
throttle.max_peers.normal.set = 60
throttle.min_peers.seed.set = 30
throttle.max_peers.seed.set = 80
trackers.numwant.set = 80
protocol.encryption.set = allow_incoming,try_outgoing,enable_retry
protocol.encryption.set = allow_incoming,try_outgoing,enable_retry
# Limits for file handle resources, this is optimized for
# an `ulimit` of 1024 (a common default). You MUST leave
# a ceiling of handles reserved for rTorrent's internal needs!
network.max_open_files.set = 600
network.max_open_sockets.set = 300
# Limits for file handle resources, this is optimized for
# an `ulimit` of 1024 (a common default). You MUST leave
# a ceiling of handles reserved for rTorrent's internal needs!
network.max_open_files.set = 600
network.max_open_sockets.set = 300
# Memory resource usage (increase if you have a large number of items loaded,
# and/or the available resources to spend)
pieces.memory.max.set = 1800M
network.xmlrpc.size_limit.set = 32M
# Memory resource usage (increase if you have a large number of items loaded,
# and/or the available resources to spend)
pieces.memory.max.set = 1800M
network.xmlrpc.size_limit.set = 32M
# Basic operational settings
session.path.set = (cat, (cfg.session))
directory.default.set = (cat, (cfg.download))
log.execute = (cat, (cfg.logs), "execute.log")
# Basic operational settings
session.path.set = (cat, (cfg.session))
directory.default.set = (cat, (cfg.download))
log.execute = (cat, (cfg.logs), "execute.log")
# Other operational settings
encoding.add = utf8
system.umask.set = 0027
system.cwd.set = (directory.default)
#schedule2 = low_diskspace, 5, 60, ((close_low_diskspace, 500M))
#pieces.hash.on_completion.set = no
# Other operational settings
encoding.add = utf8
system.umask.set = 0027
system.cwd.set = (directory.default)
#schedule2 = low_diskspace, 5, 60, ((close_low_diskspace, 500M))
#pieces.hash.on_completion.set = no
# HTTP and SSL
network.http.max_open.set = 50
network.http.dns_cache_timeout.set = 25
# HTTP and SSL
network.http.max_open.set = 50
network.http.dns_cache_timeout.set = 25
#network.http.ssl_verify_peer.set = 1
#network.http.ssl_verify_host.set = 1
#network.http.ssl_verify_peer.set = 1
#network.http.ssl_verify_host.set = 1
# Run the rTorrent process as a daemon in the background
system.daemon.set = true
# Run the rTorrent process as a daemon in the background
system.daemon.set = true
# XML-RPC interface
network.scgi.open_local = (cat,(cfg.rpcsock))
schedule = scgi_group,0,0,"execute.nothrow=chown,\":rtorrent\",(cfg.rpcsock)"
schedule = scgi_permission,0,0,"execute.nothrow=chmod,\"g+w,o=\",(cfg.rpcsock)"
# XML-RPC interface
network.scgi.open_local = (cat,(cfg.rpcsock))
schedule = scgi_group,0,0,"execute.nothrow=chown,\":rtorrent\",(cfg.rpcsock)"
schedule = scgi_permission,0,0,"execute.nothrow=chmod,\"g+w,o=\",(cfg.rpcsock)"
# Logging:
# Levels = critical error warn notice info debug
# Groups = connection_* dht_* peer_* rpc_* storage_* thread_* tracker_* torrent_*
print = (cat, "Logging to ", (cfg.logfile))
log.open_file = "log", (cfg.logfile)
log.add_output = "debug", "log"
'';
# Logging:
# Levels = critical error warn notice info debug
# Groups = connection_* dht_* peer_* rpc_* storage_* thread_* tracker_* torrent_*
print = (cat, "Logging to ", (cfg.logfile))
log.open_file = "log", (cfg.logfile)
log.add_output = "debug", "log"
'';
};
}

2
nixos/hosts/hades/unifi/configuration.nix
View File

@ -1,4 +1,4 @@
{ pkgs, lib, pkgs_stable,... }: {
{ pkgs, lib, pkgs_stable, ... }: {
system.stateVersion = "21.05";
networking.interfaces.eth0.useDHCP = true;

3
nixos/hosts/olympus/bastion/configuration.nix
View File

@ -17,7 +17,8 @@ let
done
fi
'';
in {
in
{
imports = [
# Include the results of the hardware scan.
./hardware-configuration.nix

12
nixos/hosts/olympus/bastion/hardware-configuration.nix
View File

@ -5,12 +5,14 @@
{
imports = [ (modulesPath + "/profiles/qemu-guest.nix") ];
boot = {
boot.initrd.availableKernelModules =
[ "ata_piix" "uhci_hcd" "virtio_pci" "virtio_scsi" "sd_mod" "sr_mod" ];
boot.initrd.kernelModules = [ ];
boot.kernelModules = [ ];
boot.extraModulePackages = [ ];
initrd.availableKernelModules =
[ "ata_piix" "uhci_hcd" "virtio_pci" "virtio_scsi" "sd_mod" "sr_mod" ];
initrd.kernelModules = [ ];
kernelModules = [ ];
extraModulePackages = [ ];
};
fileSystems."/" = {
device = "/dev/disk/by-uuid/e8427097-8545-4924-b033-2659fcf9adca";

3
nixos/hosts/olympus/dex/configuration.nix
View File

@ -9,7 +9,8 @@ let
db_name = "dex";
inherit (config.meta.exposes.dex) port;
metricsPort = 5558;
in {
in
{
imports = [ ];
# This value determines the NixOS release from which the default

5
nixos/hosts/olympus/dhcp/configuration.nix
View File

@ -9,8 +9,9 @@ let
localDomain = config.networking.domain;
hosts =
filter (h: hasAttr "ip" h && hasAttr "mac" h && h.realm == localDomain)
flat_hosts;
in {
flat_hosts;
in
{
networking = {
defaultGateway = "10.42.42.1";
nameservers = [ "10.42.42.15" "10.42.42.16" ];

12
nixos/hosts/olympus/eevee/hardware-configuration.nix
View File

@ -5,12 +5,14 @@
{
imports = [ (modulesPath + "/installer/scan/not-detected.nix") ];
boot = {
boot.initrd.availableKernelModules =
[ "xhci_pci" "ahci" "nvme" "usbhid" "usb_storage" "sd_mod" ];
boot.initrd.kernelModules = [ ];
boot.kernelModules = [ "kvm-intel" ];
boot.extraModulePackages = [ ];
initrd.availableKernelModules =
[ "xhci_pci" "ahci" "nvme" "usbhid" "usb_storage" "sd_mod" ];
initrd.kernelModules = [ ];
kernelModules = [ "kvm-intel" ];
extraModulePackages = [ ];
};
fileSystems."/" = {
device = "/dev/disk/by-uuid/947a98af-9a4e-4811-a2ca-9aa00b319e9c";

62
nixos/hosts/olympus/eevee/hardware.nix
View File

@ -1,42 +1,46 @@
{ pkgs, config, ... }: {
hardware.enableAllFirmware = true;
hardware = {
enableAllFirmware = true;
nvidia = {
package = config.boot.kernelPackages.nvidiaPackages.stable;
services.hardware.bolt.enable = true;
# Open drivers cause gdm to crash
# open = true;
services.xserver.videoDrivers = [ "nvidia" ];
hardware.nvidia = {
package = config.boot.kernelPackages.nvidiaPackages.stable;
# nvidia-drm.modeset=1
modesetting.enable = true;
};
# Open drivers cause gdm to crash
# open = true;
# Hardware acceleration
opengl = {
enable = true;
# nvidia-drm.modeset=1
modesetting.enable = true;
# Vulkan
driSupport = true;
};
logitech.wireless = {
enable = true;
enableGraphical = true;
};
};
services = {
# Hardware acceleration
hardware.opengl = {
enable = true;
hardware.bolt.enable = true;
# Vulkan
driSupport = true;
xserver.videoDrivers = [ "nvidia" ];
# udev
udev.packages = with pkgs; [
android-udev-rules
logitech-udev-rules
wooting-udev-rules
];
# SSD Trim
fstrim.enable = true;
};
hardware.logitech.wireless = {
enable = true;
enableGraphical = true;
};
# udev
services.udev.packages = with pkgs; [
android-udev-rules
logitech-udev-rules
wooting-udev-rules
];
# FS
fileSystems."/".options = [ "compress=zstd" ];
# SSD Trim
services.fstrim.enable = true;
}

127
nixos/hosts/olympus/gitea/configuration.nix
View File

@ -6,7 +6,8 @@
let
vs = config.vault-secrets.secrets;
inherit (config.meta.exposes.git) port;
in {
in
{
imports = [ ];
# This value determines the NixOS release from which the default
@ -23,12 +24,71 @@ in {
environment.noXlibs = lib.mkForce false;
networking.firewall.allowedTCPPorts = [ port ];
services = {
services.openssh.startWhenNeeded = false;
openssh.startWhenNeeded = false;
services.fail2ban = {
enable = true;
maxretry = 3;
fail2ban = {
enable = true;
maxretry = 3;
};
gitea = {
enable = true;
package = pkgs.forgejo;
lfs.enable = true;
dump.type = "tar.gz";
database.type = "postgres";
mailerPasswordFile = "${vs.gitea}/mailPassword";
settings = {
default.WORK_PATH = "/var/lib/gitea";
actions = { "ENABLED" = true; };
repository = {
"ENABLE_PUSH_CREATE_USER" = true;
"DEFAULT_PUSH_CREATE_PRIVATE" = false;
};
service = {
"DEFAULT_KEEP_EMAIL_PRIVATE" = true;
"DISABLE_REGISTRATION" = true;
};
indexer = {
"REPO_INDEXER_ENABLED" = true;
"REPO_INDEXER_PATH" = "indexers/repos.bleve";
"MAX_FILE_SIZE" = 1048576;
"REPO_INDEXER_EXCLUDE" = "node_modules/**";
};
ui = {
"THEMES" = "forgejo-auto,forgejo-light,forgejo-dark,auto,gitea,arc-green,agatheme";
"DEFAULT_THEME" = "forgejo-auto";
"USE_SERVICE_WORKER" = true;
};
server = {
LANDING_PAGE = "explore";
SSH_PORT = 42;
DOMAIN = "git.0x76.dev";
ROOT_URL = "https://git.0x76.dev";
HTTP_PORT = port;
};
session = {
"PROVIDER" = "db";
"COOKIE_SECURE" = true;
};
mailer = {
"ENABLED" = true;
# "IS_TLS_ENABLED" = true;
# "HOST" = "mail.0x76.dev:465";
"FROM" = "gitea@0x76.dev";
# "MAILER_TYPE" = "smtp";
"USER" = "gitea@0x76.dev";
# Below is prep for 1.18
"PROTOCOL" = "smtps";
"SMTP_ADDR" = "mail.0x76.dev";
"SMTP_PORT" = 465;
};
};
};
};
vault-secrets.secrets.gitea = {
@ -42,61 +102,4 @@ in {
mkdir -p ${target_dir}
ln -sf ${pkgs.v.gitea-agatheme} "${target_dir}/theme-agatheme.css"
'';
services.gitea = {
enable = true;
package = pkgs.forgejo;
lfs.enable = true;
dump.type = "tar.gz";
database.type = "postgres";
mailerPasswordFile = "${vs.gitea}/mailPassword";
settings = {
default.WORK_PATH = "/var/lib/gitea";
actions = { "ENABLED" = true; };
repository = {
"ENABLE_PUSH_CREATE_USER" = true;
"DEFAULT_PUSH_CREATE_PRIVATE" = false;
};
service = {
"DEFAULT_KEEP_EMAIL_PRIVATE" = true;
"DISABLE_REGISTRATION" = true;
};
indexer = {
"REPO_INDEXER_ENABLED" = true;
"REPO_INDEXER_PATH" = "indexers/repos.bleve";
"MAX_FILE_SIZE" = 1048576;
"REPO_INDEXER_EXCLUDE" = "node_modules/**";
};
ui = {
"THEMES" = "forgejo-auto,forgejo-light,forgejo-dark,auto,gitea,arc-green,agatheme";
"DEFAULT_THEME" = "forgejo-auto";
"USE_SERVICE_WORKER" = true;
};
server = {
LANDING_PAGE = "explore";
SSH_PORT = 42;
DOMAIN = "git.0x76.dev";
ROOT_URL = "https://git.0x76.dev";
HTTP_PORT = port;
};
session = {
"PROVIDER" = "db";
"COOKIE_SECURE" = true;
};
mailer = {
"ENABLED" = true;
# "IS_TLS_ENABLED" = true;
# "HOST" = "mail.0x76.dev:465";
"FROM" = "gitea@0x76.dev";
# "MAILER_TYPE" = "smtp";
"USER" = "gitea@0x76.dev";
# Below is prep for 1.18
"PROTOCOL" = "smtps";
"SMTP_ADDR" = "mail.0x76.dev";
"SMTP_PORT" = 465;
};
};
};
}

30
nixos/hosts/olympus/hedgedoc/configuration.nix
View File

@ -8,7 +8,8 @@ let
db_user = "hedgedoc";
inherit (config.meta.exposes.md) port;
vs = config.vault-secrets.secrets;
in {
in
{
imports = [ ];
# This value determines the NixOS release from which the default
@ -67,19 +68,20 @@ in {
secretKey = "$MINIO_SECRET_KEY";
};
email = false;
oauth2 = let url = "https://dex.0x76.dev";
in {
providerName = "Dex";
clientID = "hedgedoc";
clientSecret = "$DEX_CLIENT_SECRET";
scope = "openid email profile";
authorizationURL = "${url}/auth";
tokenURL = "${url}/token";
userProfileURL = "${url}/userinfo";
userProfileUsernameAttr = "preferred_username";
userProfileDisplayNameAttr = "name";
userProfileEmailAttr = "email";
};
oauth2 =
let url = "https://dex.0x76.dev";
in {
providerName = "Dex";
clientID = "hedgedoc";
clientSecret = "$DEX_CLIENT_SECRET";
scope = "openid email profile";
authorizationURL = "${url}/auth";
tokenURL = "${url}/token";
userProfileURL = "${url}/userinfo";
userProfileUsernameAttr = "preferred_username";
userProfileDisplayNameAttr = "name";
userProfileEmailAttr = "email";
};
};
};
}

78
nixos/hosts/olympus/mailserver/configuration.nix
View File

@ -97,48 +97,50 @@ in {
autoIndexExclude = [ "\\Junk" ];
};
};
services = {
services.postfix.relayHost = "smtp.ziggozakelijk.nl";
services.postfix.relayPort = 587;
postfix.relayHost = "smtp.ziggozakelijk.nl";
postfix.relayPort = 587;
services.roundcube = {
enable = true;
package = pkgs.roundcube.withPlugins
(plugins: [ plugins.persistent_login pkgs.v.roundcube-swipe ]);
plugins = [
"archive"
"managesieve"
"swipe"
# "enigma"
# "markasjunk"
"persistent_login"
];
# this is the url of the vhost, not necessarily the same as the fqdn of
# the mailserver
hostName = "webmail.0x76.dev";
extraConfig = ''
# starttls needed for authentication, so the fqdn required to match
# the certificate
$config['smtp_host'] = "tls://${config.mailserver.fqdn}";
$config['smtp_user'] = "%u";
$config['smtp_pass'] = "%p";
$config['swipe_actions'] = [
'messagelist' => [
'left' => 'archive',
'right' => 'archive',
'down' => 'none'
],
'contactlist' => [
'left' => 'none',
'right' => 'none',
'down' => 'none'
]
roundcube = {
enable = true;
package = pkgs.roundcube.withPlugins
(plugins: [ plugins.persistent_login pkgs.v.roundcube-swipe ]);
plugins = [
"archive"
"managesieve"
"swipe"
# "enigma"
# "markasjunk"
"persistent_login"
];
'';
};
# this is the url of the vhost, not necessarily the same as the fqdn of
# the mailserver
hostName = "webmail.0x76.dev";
extraConfig = ''
# starttls needed for authentication, so the fqdn required to match
# the certificate
$config['smtp_host'] = "tls://${config.mailserver.fqdn}";
$config['smtp_user'] = "%u";
$config['smtp_pass'] = "%p";
services.nginx = { enable = true; };
$config['swipe_actions'] = [
'messagelist' => [
'left' => 'archive',
'right' => 'archive',
'down' => 'none'
],
'contactlist' => [
'left' => 'none',
'right' => 'none',
'down' => 'none'
]
];
'';
};
nginx = { enable = true; };
};
security.acme.acceptTerms = true;
security.acme.defaults.email = "v@0x76.dev";

3
nixos/hosts/olympus/minio/configuration.nix
View File

@ -7,7 +7,8 @@ let
vs = config.vault-secrets.secrets;
listenPort = config.meta.exposes.minio.port;
consolePort = listenPort + 1;
in {
in
{
imports = [ ];
# This value determines the NixOS release from which the default

201
nixos/hosts/olympus/nginx/configuration.nix
View File

@ -13,7 +13,8 @@ let
add_header Access-Control-Allow-Origin *;
return 200 '${builtins.toJSON data}';
'';
in {
in
{
# This value determines the NixOS release from which the default
# settings for stateful data, like file locations and database versions
# on your system were taken. It‘s perfectly fine and recommended to leave
@ -23,115 +24,127 @@ in {
system.stateVersion = "21.05"; # Did you read the comment?
networking.firewall.allowedTCPPorts = [ 80 443 ];
services = {
# Generates vhosts for all hosts that have an `exposes` section
services.v.nginx.autoExpose = true;
# Generates vhosts for all hosts that have an `exposes` section
v.nginx.autoExpose = true;
services.nginx = {
enable = true;
statusPage = true;
recommendedProxySettings = true;
recommendedTlsSettings = true;
recommendedOptimisation = true;
recommendedBrotliSettings = true;
clientMaxBodySize = "500m";
nginx = {
enable = true;
statusPage = true;
recommendedProxySettings = true;
recommendedTlsSettings = true;
recommendedOptimisation = true;
recommendedBrotliSettings = true;
clientMaxBodySize = "500m";
package = pkgs.nginxMainline;
package = pkgs.nginxMainline;
# Templated
virtualHosts = {
"pass.0x76.dev" = {
enableACME = true;
forceSSL = true;
locations."/" = {
proxyPass = "http://vaultwarden.olympus:8222";
proxyWebsockets = true;
};
locations."/notifications/hub/negotiate" = {
proxyPass = "http://vaultwarden.olympus:8222";
proxyWebsockets = true;
};
locations."/notifications/hub" = {
proxyPass = "http://vaultwarden.olympus:3012";
proxyWebsockets = true;
};
};
# Templated
virtualHosts = {
"pass.0x76.dev" = {
enableACME = true;
forceSSL = true;
locations = {
# Meow
"meowy.tech" = {
enableACME = true;
forceSSL = true;
locations."/".extraConfig = ''
add_header Content-Type 'text/html; charset=UTF-8';
return 200 '<h1>meow</h1>';
'';
locations."= /.well-known/matrix/client".extraConfig =
mkWellKnown clientConfig;
locations."= /.well-known/matrix/server".extraConfig =
mkWellKnown serverConfig;
};
"chat.meowy.tech" = {
enableACME = true;
forceSSL = true;
locations."/".extraConfig = ''
return 307 https://element.chat.meowy.tech;
'';
locations."/_matrix".proxyPass = "http://synapse.olympus:8008";
locations."/_synapse/client".proxyPass = "http://synapse.olympus:8008";
locations."/_synapse/admin" = {
# Allow only local and my own IPs
extraConfig = ''
allow 127.0.0.1;
allow 10.42.42.0/23;
allow 192.168.0.0/23;
allow 80.60.83.220;
allow 83.128.154.23;
allow 195.85.167.32/29;
deny all;
'';
proxyPass = "http://synapse.olympus:8008";
};
};
"element.chat.meowy.tech" = {
enableACME = true;
forceSSL = true;
"/".proxyPass = "http://vaultwarden.olympus:8222";
"/".proxyWebsockets = true;
root = pkgs.element-web.override {
conf = {
default_server_config = clientConfig;
show_labs_settings = true;
brand = "chat.meowy.tech";
"/notifications/hub/negotiate" = {
proxyPass = "http://vaultwarden.olympus:8222";
proxyWebsockets = true;
};
"/notifications/hub" = {
proxyPass = "http://vaultwarden.olympus:3012";
proxyWebsockets = true;
};
};
};
};
"cinny.chat.meowy.tech" = {
enableACME = true;
forceSSL = true;
root = pkgs.cinny.override {
conf = {
defaultHomeserver = 0;
allowCustomHomeservers = false;
homeserverList = [ "chat.meowy.tech" ];
# Meow
"meowy.tech" = {
enableACME = true;
forceSSL = true;
locations = {
"/".extraConfig = ''
add_header Content-Type 'text/html; charset=UTF-8';
return 200 '<h1>meow</h1>';
'';
"= /.well-known/matrix/client".extraConfig =
mkWellKnown clientConfig;
"= /.well-known/matrix/server".extraConfig =
mkWellKnown serverConfig;
};
};
"chat.meowy.tech" = {
enableACME = true;
forceSSL = true;
locations = {
"/".extraConfig = ''
return 307 https://element.chat.meowy.tech;
'';
"/_matrix".proxyPass = "http://synapse.olympus:8008";
"/_synapse/client".proxyPass = "http://synapse.olympus:8008";
"/_synapse/admin" = {
# Allow only local and my own IPs
extraConfig = ''
allow 127.0.0.1;
allow 10.42.42.0/23;
allow 192.168.0.0/23;
allow 80.60.83.220;
allow 83.128.154.23;
allow 195.85.167.32/29;
deny all;
'';
proxyPass = "http://synapse.olympus:8008";
};
};
};
"element.chat.meowy.tech" = {
enableACME = true;
forceSSL = true;
root = pkgs.element-web.override {
conf = {
default_server_config = clientConfig;
show_labs_settings = true;
brand = "chat.meowy.tech";
};
};
};
"cinny.chat.meowy.tech" = {
enableACME = true;
forceSSL = true;
root = pkgs.cinny.override {
conf = {
defaultHomeserver = 0;
allowCustomHomeservers = false;
homeserverList = [ "chat.meowy.tech" ];
};
};
};
"admin.chat.meowy.tech" = {
enableACME = true;
forceSSL = true;
root = pkgs.synapse-admin;
};
};
"admin.chat.meowy.tech" = {
enableACME = true;
forceSSL = true;
root = pkgs.synapse-admin;
};
prometheus.exporters = {
nginx = {
enable = true;
openFirewall = true;
};
};
};
security = {
acme = {
security.acme.defaults.email = "victorheld12@gmail.com";
security.acme.acceptTerms = true;
security.acme.preliminarySelfsigned = true;
services.prometheus.exporters = {
nginx = {
enable = true;
openFirewall = true;
defaults.email = "victorheld12@gmail.com";
acceptTerms = true;
preliminarySelfsigned = true;
};
};
}

27
nixos/hosts/olympus/ntfy/configuration.nix
View File

@ -20,18 +20,19 @@
networking.firewall.allowedTCPPorts = [ 80 9090 ];
services.ntfy-sh = let datadir = "/var/lib/ntfy-sh";
in {
enable = true;
settings = {
base-url = "https://ntfy.0x76.dev";
listen-http = ":80";
cache-file = "${datadir}/cache.db";
auth-file = "${datadir}/user.db";
auth-default-access = "deny-all";
behind-proxy = true;
attachment-cache-dir = "${datadir}/attachments";
metrics-listen-http = ":9090";
services.ntfy-sh =
let datadir = "/var/lib/ntfy-sh";
in {
enable = true;
settings = {
base-url = "https://ntfy.0x76.dev";
listen-http = ":80";
cache-file = "${datadir}/cache.db";
auth-file = "${datadir}/user.db";
auth-default-access = "deny-all";
behind-proxy = true;
attachment-cache-dir = "${datadir}/attachments";
metrics-listen-http = ":9090";
};
};
};
}

3
nixos/hosts/olympus/outline/configuration.nix
View File

@ -6,7 +6,8 @@
let
vs = config.vault-secrets.secrets;
inherit (config.meta.exposes.outline) port;
in {
in
{
imports = [ ];
# This value determines the NixOS release from which the default

109
nixos/hosts/olympus/synapse/configuration.nix
View File

@ -7,7 +7,8 @@ let
vs = config.vault-secrets.secrets;
port = 8008;
metricsPort = 9000;
in {
in
{
imports = [ ];
# This value determines the NixOS release from which the default
@ -49,60 +50,62 @@ in {
"${vs.synapse}/email_password" # Also contains the rest of the email config
];
settings = let
log_file = pkgs.writeText "log.yml" ''
version: 1
settings =
let
log_file = pkgs.writeText "log.yml" ''
version: 1
formatters:
structured:
class: synapse.logging.TerseJsonFormatter
formatters:
structured:
class: synapse.logging.TerseJsonFormatter
handlers:
file:
class: logging.handlers.TimedRotatingFileHandler
formatter: structured
filename: /var/lib/matrix-synapse/synapse.log
when: midnight
backupCount: 3 # Does not include the current log file.
encoding: utf8
handlers:
file:
class: logging.handlers.TimedRotatingFileHandler
formatter: structured
filename: /var/lib/matrix-synapse/synapse.log
when: midnight
backupCount: 3 # Does not include the current log file.
encoding: utf8
loggers:
synapse:
level: INFO
handlers: [file]
'';
in {
server_name = "meowy.tech";
enable_registration = true;
public_baseurl = "https://chat.meowy.tech";
enable_metrics = true;
max_upload_size = "100M";
registration_requires_token = true;
media_retention = { remote_media_lifetime = "90d"; };
log_config = "${log_file}";
listeners = [
{
inherit port;
bind_addresses = [ "0.0.0.0" ];
type = "http";
tls = false;
x_forwarded = true;
resources = [{
names = [ "client" "federation" ];
compress = true;
}];
}
{
port = metricsPort;
bind_addresses = [ "0.0.0.0" ];
type = "metrics";
tls = false;
resources = [{
names = [ "metrics" ];
compress = false;
}];
}
];
};
loggers:
synapse:
level: INFO
handlers: [file]
'';
in
{
server_name = "meowy.tech";
enable_registration = true;
public_baseurl = "https://chat.meowy.tech";
enable_metrics = true;
max_upload_size = "100M";
registration_requires_token = true;
media_retention = { remote_media_lifetime = "90d"; };
log_config = "${log_file}";
listeners = [
{
inherit port;
bind_addresses = [ "0.0.0.0" ];
type = "http";
tls = false;
x_forwarded = true;
resources = [{
names = [ "client" "federation" ];
compress = true;
}];
}
{
port = metricsPort;
bind_addresses = [ "0.0.0.0" ];
type = "metrics";
tls = false;
resources = [{
names = [ "metrics" ];
compress = false;
}];
}
];
};
};
}

3
nixos/hosts/olympus/vaultwarden/configuration.nix
View File

@ -6,7 +6,8 @@
let
vs = config.vault-secrets.secrets;
cfg = config.services.vaultwarden.config;
in {
in
{
imports = [ ];
# This value determines the NixOS release from which the default

191
nixos/hosts/olympus/victoriametrics/configuration.nix
View File

@ -8,7 +8,8 @@ let
grafanaDomain = config.meta.exposes.grafana.domain;
grafanaPort = config.meta.exposes.grafana.port;
vs = config.vault-secrets.secrets;
in {
in
{
imports = [ ];
# This value determines the NixOS release from which the default
@ -20,73 +21,104 @@ in {
system.stateVersion = "21.11"; # Did you read the comment?
networking.firewall.allowedTCPPorts = [ vmPort grafanaPort ];
networking.firewall.allowedUDPPorts = [ vmPort ];
services = {
services.victoriametrics = {
enable = true;
listenAddress = ":${toString vmPort}";
# Data Retention period in months
retentionPeriod = 36;
};
victoriametrics = {
enable = true;
listenAddress = ":${toString vmPort}";
# Data Retention period in months
retentionPeriod = 36;
};
vmagent = {
enable = true;
openFirewall = true;
prometheusConfig = {
global = {
scrape_interval = "1m";
scrape_timeout = "30s";
};
scrape_configs = [
{
job_name = "kea";
static_configs = [{
targets = [ "dhcp.olympus:9547" ];
labels.app = "dhcp";
}];
}
{
job_name = "nginx";
static_configs = [{
targets = [ "nginx.olympus:9113" ];
labels.app = "nginx";
}];
}
{
job_name = "synapse";
static_configs = [{
targets = [ "synapse.olympus:9000" ];
labels.app = "synapse";
}];
}
{
job_name = "wireguard";
static_configs = [{
targets = [ "wireguard.olympus:9586" ];
labels.app = "wireguard";
}];
}
{
job_name = "ntfy";
static_configs = [{
targets = [ "ntfy.olympus:9090" ];
labels.app = "ntfy";
}];
}
{
job_name = "dex";
static_configs = [{
targets = [ "dex.olympus:5558" ];
labels.app = "dex";
}];
}
{
job_name = "unbound";
static_configs = [{
targets = [ "dns-1.olympus:9167" "dns-2.olympus:9167" ];
labels.app = "dns";
}];
}
];
};
};
grafana = {
enable = true;
settings = {
server = {
domain = grafanaDomain;
root_url = "https://${grafanaDomain}";
http_addr = "0.0.0.0";
http_port = grafanaPort;
};
security.admin_password = "$__file{${vs.grafana}/password}";
"auth.generic_oauth" = {
name = "Dex";
icon = "signin";
enabled = true;
allow_sign_up = true;
client_id = "grafana";
client_secret = "$__file{${vs.grafana}/dex_client_secret}";
scopes = toString [ "openid" "profile" "email" "groups" ];
auth_url = "https://dex.0x76.dev/auth";
token_url = "https://dex.0x76.dev/token";
api_url = "https://dex.0x76.dev/userinfo";
skip_org_role_sync = true;
auto_login = true;
};
services.vmagent = {
enable = true;
openFirewall = true;
prometheusConfig = {
global = {
scrape_interval = "1m";
scrape_timeout = "30s";
};
scrape_configs = [
{
job_name = "kea";
static_configs = [{
targets = [ "dhcp.olympus:9547" ];
labels.app = "dhcp";
}];
}
{
job_name = "nginx";
static_configs = [{
targets = [ "nginx.olympus:9113" ];
labels.app = "nginx";
}];
}
{
job_name = "synapse";
static_configs = [{
targets = [ "synapse.olympus:9000" ];
labels.app = "synapse";
}];
}
{
job_name = "wireguard";
static_configs = [{
targets = [ "wireguard.olympus:9586" ];
labels.app = "wireguard";
}];
}
{
job_name = "ntfy";
static_configs = [{
targets = [ "ntfy.olympus:9090"];
labels.app = "ntfy";
}];
}
{
job_name = "dex";
static_configs = [{
targets = [ "dex.olympus:5558" ];
labels.app = "dex";
}];
}
{
job_name = "unbound";
static_configs = [{
targets = [ "dns-1.olympus:9167" "dns-2.olympus:9167" ];
labels.app = "dns";
}];
}
];
};
};
@ -94,33 +126,4 @@ in {
user = "grafana";
group = "grafana";
};
services.grafana = {
enable = true;
settings = {
server = {
domain = grafanaDomain;
root_url = "https://${grafanaDomain}";
http_addr = "0.0.0.0";
http_port = grafanaPort;
};
security.admin_password = "$__file{${vs.grafana}/password}";
"auth.generic_oauth" = {
name = "Dex";
icon = "signin";
enabled = true;
allow_sign_up = true;
client_id = "grafana";
client_secret = "$__file{${vs.grafana}/dex_client_secret}";
scopes = toString [ "openid" "profile" "email" "groups" ];
auth_url = "https://dex.0x76.dev/auth";
token_url = "https://dex.0x76.dev/token";
api_url = "https://dex.0x76.dev/userinfo";
skip_org_role_sync = true;
auto_login = true;
};
};
};
}

96
nixos/hosts/olympus/wireguard/configuration.nix
View File

@ -19,22 +19,62 @@ in {
environment.systemPackages = with pkgs; [ wireguard-tools ];
environment.noXlibs = lib.mkForce false;
networking = {
networking.firewall.allowedUDPPorts =
[ config.networking.wireguard.interfaces.wg0.listenPort ];
networking.firewall.checkReversePath = false;
firewall.allowedUDPPorts =
[ config.networking.wireguard.interfaces.wg0.listenPort ];
firewall.checkReversePath = false;
nat = {
enable = true;
internalInterfaces = [ "wg0" "eth0" ];
externalInterface = "eth0";
};
wireguard.interfaces.wg0 = {
ips = [ "10.100.0.1/24" ];
listenPort = 51821;
privateKeyFile = "${vs.wireguard}/privateKey";
peers = [
{
# Phone
publicKey = "K+99mvSYs4urcclreQDLA1pekD4xtu/mpS2uVWw8Bws=";
allowedIPs = [ "10.100.0.2/32" ];
}
{
# Laura's laptop
publicKey = "ZWIaDGrASlTkEK75j10VeGCvrIGfpk4GPobmqcYX2D0=";
allowedIPs = [ "10.100.0.3/32" ];
}
{
# Old Laptop
publicKey = "L8myt2bcdja7M+i+9eatdQRW8relPUoZZ9lEKSLe+m8=";
allowedIPs = [ "10.100.0.4/32" ];
}
{
# New Laptop
publicKey = "+Ms3xV6LxNZWTQk11zoz+AUIV2uds6A64Wz15JlR/Ak=";
allowedIPs = [ "10.100.0.6/32" ];
}
{
# Aerdenhout
# Useful setup video for opnsense: https://www.youtube.com/watch?v=RoXHe5dqCM0
# https://docs.opnsense.org/manual/how-tos/wireguard-s2s.html
publicKey = "KgqLhmUMX6kyTjRoa/GOCrZOvXNE5HWYuOr/T3v8/VI=";
allowedIPs = [ "10.100.0.5/32" "192.168.0.0/23" "10.10.10.0/24" ];
endpoint = "83.128.154.23:51820";
persistentKeepalive = 25;
}
];
};
};
vault-secrets.secrets.wireguard = {
services = [ "wireguard-wg0" ];
loginRetries = 25;
};
networking.nat = {
enable = true;
internalInterfaces = [ "wg0" "eth0" ];
externalInterface = "eth0";
};
boot.kernel.sysctl = {
"net.ipv4.ip_forward" = 1;
"net.ipv6.conf.all.forwarding" = 1;
@ -44,42 +84,4 @@ in {
enable = true;
openFirewall = true;
};
networking.wireguard.interfaces.wg0 = {
ips = [ "10.100.0.1/24" ];
listenPort = 51821;
privateKeyFile = "${vs.wireguard}/privateKey";
peers = [
{
# Phone
publicKey = "K+99mvSYs4urcclreQDLA1pekD4xtu/mpS2uVWw8Bws=";
allowedIPs = [ "10.100.0.2/32" ];
}
{
# Laura's laptop
publicKey = "ZWIaDGrASlTkEK75j10VeGCvrIGfpk4GPobmqcYX2D0=";
allowedIPs = [ "10.100.0.3/32" ];
}
{
# Old Laptop
publicKey = "L8myt2bcdja7M+i+9eatdQRW8relPUoZZ9lEKSLe+m8=";
allowedIPs = [ "10.100.0.4/32" ];
}
{
# New Laptop
publicKey = "+Ms3xV6LxNZWTQk11zoz+AUIV2uds6A64Wz15JlR/Ak=";
allowedIPs = [ "10.100.0.6/32" ];
}
{
# Aerdenhout
# Useful setup video for opnsense: https://www.youtube.com/watch?v=RoXHe5dqCM0
# https://docs.opnsense.org/manual/how-tos/wireguard-s2s.html
publicKey = "KgqLhmUMX6kyTjRoa/GOCrZOvXNE5HWYuOr/T3v8/VI=";
allowedIPs = [ "10.100.0.5/32" "192.168.0.0/23" "10.10.10.0/24" ];
endpoint = "83.128.154.23:51820";
persistentKeepalive = 25;
}
];
};
}

12
nixos/hosts/thalassa/aoife/hardware-configuration.nix
View File

@ -5,12 +5,14 @@
{
imports = [ (modulesPath + "/installer/scan/not-detected.nix") ];
boot = {
boot.initrd.availableKernelModules =
[ "nvme" "xhci_pci" "thunderbolt" "usb_storage" "sd_mod" "sdhci_pci" ];
boot.initrd.kernelModules = [ ];
boot.kernelModules = [ "kvm-amd" ];
boot.extraModulePackages = [ ];
initrd.availableKernelModules =
[ "nvme" "xhci_pci" "thunderbolt" "usb_storage" "sd_mod" "sdhci_pci" ];
initrd.kernelModules = [ ];
kernelModules = [ "kvm-amd" ];
extraModulePackages = [ ];
};
fileSystems."/" = {
device = "/dev/disk/by-uuid/c184866a-9a53-4a9f-9a1f-493792af7ea9";

70
nixos/hosts/thalassa/aoife/hardware.nix
View File

@ -1,50 +1,58 @@
{ pkgs, ... }: {
hardware.enableAllFirmware = true;
hardware = {
enableAllFirmware = true;
hardware.bluetooth.enable = true;
bluetooth.enable = true;
services.hardware.bolt.enable = true;
# Vulkan
opengl.driSupport = true;
opengl.extraPackages = with pkgs; [
amdvlk
rocm-opencl-icd
rocm-opencl-runtime
];
};
services = {
services.fprintd.enable = true;
hardware.bolt.enable = true;
fprintd.enable = true;
# Video Driver
xserver.videoDrivers = [ "amdgpu" ];
xserver = {
dpi = 280;
xkbOptions = "caps:swapescape";
};
# SSD Trim
fstrim.enable = true;
# Power Management
upower.enable = true;
thermald.enable = true;
};
# hardware.trackpoint.enable = true;
# FS
fileSystems."/".options = [ "compress=zstd" ];
# Video Driver
services.xserver.videoDrivers = [ "amdgpu" ];
services.xserver = {
dpi = 280;
xkbOptions = "caps:swapescape";
};
# Vulkan
hardware.opengl.driSupport = true;
hardware.opengl.extraPackages = with pkgs; [
amdvlk
rocm-opencl-icd
rocm-opencl-runtime
];
systemd.tmpfiles.rules =
[ "L+ /opt/rocm/hip - - - - ${pkgs.hip}" ];
# SSD Trim
services.fstrim.enable = true;
# Power Management
services.upower.enable = true;
services.thermald.enable = true;
powerManagement = {
enable = true;
powertop.enable = true;
};
security = {
tpm2 = {
# tpm
security.tpm2.enable = true;
security.tpm2.pkcs11.enable = true; # expose /run/current-system/sw/lib/libtpm2_pkcs11.so
security.tpm2.tctiEnvironment.enable = true; # TPM2TOOLS_TCTI and TPM2_PKCS11_TCTI env variables
users.users.victor.extraGroups = [ "tss" ]; # tss group has access to TPM devices
# tpm
enable = true;
pkcs11.enable = true; # expose /run/current-system/sw/lib/libtpm2_pkcs11.so
tctiEnvironment.enable = true;
};
}; # TPM2TOOLS_TCTI and TPM2_PKCS11_TCTI env variables
users.users.victor.extraGroups = [ "tss" ]; # tss group has access to TPM devices
}

2
nixos/hosts/thalassa/aoife/home/default.nix
View File

@ -1,4 +1,4 @@
{pkgs, ...}: {
{ pkgs, ... }: {
# Custom dconf settings
dconf.settings."org/gnome/desktop/input-sources" = {
xkb-options = [ "caps:swapescape" ];

259
nixos/hosts/thalassa/null/configuration.nix
View File

@ -30,23 +30,39 @@ let
exec Hyprland
'';
in {
in
{
imports = [
# Include the results of the hardware scan.
./hardware-configuration.nix
./rescue-boot.nix
./networking.nix
];
home-manager = {
# home-manager
home-manager.useGlobalPkgs = true;
home-manager.useUserPackages = true;
home-manager.users.victor = import ./home;
home-manager.extraSpecialArgs = { inherit inputs; };
# home-manager
useGlobalPkgs = true;
useUserPackages = true;
users.victor = import ./home;
extraSpecialArgs = { inherit inputs; };
};
security = {
security.pam.services.swaylock = { };
pam.services.swaylock = { };
security.sudo.wheelNeedsPassword = true;
sudo.wheelNeedsPassword = true;
rtkit.enable = true;
# Enables logging in with my Solokey
pam.u2f = {
enable = true;
debug = false;
cue = true;
control = "sufficient";
authFile =
"/etc/u2f-mappings"; # use `pamu2fcfg` from `pkgs.pam_u2f` to generate this config
};
};
fonts = {
fonts = with pkgs; [
@ -79,61 +95,116 @@ in {
# boot.initrd.systemd.enable = true; # Experimental
boot = {
kernelPackages = pkgs.linuxPackages_latest;
loader.systemd-boot.editor = false;
loader.systemd-boot.enable = true;
# loader.systemd-boot.configurationLimit = 6;
loader.efi.canTouchEfiVariables = true;
loader.efi.efiSysMountPoint = "/boot/efi";
loader = {
systemd-boot.editor = false;
systemd-boot.enable = true;
# loader.systemd-boot.configurationLimit = 6;
efi.canTouchEfiVariables = true;
efi.efiSysMountPoint = "/boot/efi";
};
kernel.sysctl = { "fs.inotify.max_user_watches" = 524288; };
};
services = {
services.gnome.gnome-keyring.enable = true;
gnome.gnome-keyring.enable = true;
fileSystems."/".options = [ "compress=zstd" ];
fileSystems."/home".options = [ "compress=zstd" ];
fileSystems."/nix".options = [ "compress=zstd" "noatime" ];
udisks2.enable = true;
dbus.enable = true;
# Filesystem dedup
# services.beesd.filesystems = {
# root = {
# spec = "LABEL=nixos";
# hashTableSizeMB = 256;
# verbosity = "crit";
# extraOptions = [ "--loadavg-target" "2.0" ];
# };
# };
xserver = {
enable = false;
layout = "us";
xkbVariant = "altgr-intl";
xkbOptions = "caps:swapescape";
videoDrivers = [ "nvidia" ];
};
blueman.enable = true;
# Select internationalisation properties.
i18n.defaultLocale = "en_GB.utf8";
# Enable CUPS to print documents.
printing.enable = true;
pipewire = {
enable = true;
alsa.enable = true;
alsa.support32Bit = true;
pulse.enable = true;
# If you want to use JACK applications, uncomment this
#jack.enable = true;
i18n.extraLocaleSettings = {
LC_ADDRESS = "nl_NL.UTF-8";
LC_IDENTIFICATION = "nl_NL.UTF-8";
LC_MEASUREMENT = "nl_NL.UTF-8";
LC_MONETARY = "nl_NL.UTF-8";
LC_NAME = "nl_NL.UTF-8";
LC_NUMERIC = "nl_NL.UTF-8";
LC_PAPER = "nl_NL.UTF-8";
LC_TELEPHONE = "nl_NL.UTF-8";
LC_TIME = "en_DK.UTF-8";
# use the example session manager (no others are packaged yet so this is enabled by default,
# no need to redefine it in your config for now)
#media-session.enable = true;
};
fstrim.enable = true;
# don't shutdown when power button is short-pressed
logind.extraConfig = ''
HandlePowerKey=suspend
'';
udev.packages = with pkgs; [
android-udev-rules
logitech-udev-rules
wooting-udev-rules
];
};
fileSystems = {
i18n.supportedLocales =
[ "en_GB.UTF-8/UTF-8" "nl_NL.UTF-8/UTF-8" "en_DK.UTF-8/UTF-8" ];
"/".options = [ "compress=zstd" ];
"/home".options = [ "compress=zstd" ];
"/nix".options = [ "compress=zstd" "noatime" ];
};
i18n = {
# Filesystem dedup
# services.beesd.filesystems = {
# root = {
# spec = "LABEL=nixos";
# hashTableSizeMB = 256;
# verbosity = "crit";
# extraOptions = [ "--loadavg-target" "2.0" ];
# };
# };
# Select internationalisation properties.
defaultLocale = "en_GB.utf8";
extraLocaleSettings = {
LC_ADDRESS = "nl_NL.UTF-8";
LC_IDENTIFICATION = "nl_NL.UTF-8";
LC_MEASUREMENT = "nl_NL.UTF-8";
LC_MONETARY = "nl_NL.UTF-8";
LC_NAME = "nl_NL.UTF-8";
LC_NUMERIC = "nl_NL.UTF-8";
LC_PAPER = "nl_NL.UTF-8";
LC_TELEPHONE = "nl_NL.UTF-8";
LC_TIME = "en_DK.UTF-8";
};
supportedLocales =
[ "en_GB.UTF-8/UTF-8" "nl_NL.UTF-8/UTF-8" "en_DK.UTF-8/UTF-8" ];
};
xdg.portal = {
enable = true;
wlr.enable = true;
};
programs = {
services.udisks2.enable = true;
services.dbus.enable = true;
# Hyprland
hyprland = {
enable = true;
package = null; # Managed by home manager
};
# Hyprland
programs.hyprland = {
enable = true;
package = null; # Managed by home manager
steam = {
enable = true;
remotePlay.openFirewall = true;
dedicatedServer.openFirewall = true;
};
ssh.startAgent = true;
};
environment.loginShellInit = ''
@ -141,57 +212,34 @@ in {
${run-hyprland}/bin/run-hyprland
fi
'';
hardware = {
services.xserver = {
enable = false;
layout = "us";
xkbVariant = "altgr-intl";
xkbOptions = "caps:swapescape";
videoDrivers = [ "nvidia" ];
nvidia.prime = {
offload.enable = true;
intelBusId = "PCI:0:2:0";
nvidiaBusId = "PCI:1:0:0";
};
opengl = {
enable = true;
extraPackages = with pkgs; [
vaapiVdpau
intel-media-driver # LIBVA_DRIVER_NAME=iHD
vaapiIntel # LIBVA_DRIVER_NAME=i965 (older but works better for Firefox/Chromium)
libvdpau-va-gl
];
};
bluetooth.enable = true;
saleae-logic.enable = true;
pulseaudio.enable = false;
};
hardware.nvidia.prime = {
offload.enable = true;
intelBusId = "PCI:0:2:0";
nvidiaBusId = "PCI:1:0:0";
};
hardware.opengl = {
enable = true;
extraPackages = with pkgs; [
vaapiVdpau
intel-media-driver # LIBVA_DRIVER_NAME=iHD
vaapiIntel # LIBVA_DRIVER_NAME=i965 (older but works better for Firefox/Chromium)
libvdpau-va-gl
];
};
hardware.bluetooth.enable = true;
services.blueman.enable = true;
virtualisation.podman.enable = true;
hardware.saleae-logic.enable = true;
# Enable CUPS to print documents.
services.printing.enable = true;
# Enable sound with pipewire.
sound.enable = true;
hardware.pulseaudio.enable = false;
security.rtkit.enable = true;
services.pipewire = {
enable = true;
alsa.enable = true;
alsa.support32Bit = true;
pulse.enable = true;
# If you want to use JACK applications, uncomment this
#jack.enable = true;
# use the example session manager (no others are packaged yet so this is enabled by default,
# no need to redefine it in your config for now)
#media-session.enable = true;
};
environment.systemPackages = with pkgs; [
pciutils
@ -204,42 +252,11 @@ in {
swaylock-effects # Has to be installed globally so that pam module works
];
programs.steam = {
enable = true;
remotePlay.openFirewall = true;
dedicatedServer.openFirewall = true;
};
services.fstrim.enable = true;
nix.extraOptions = ''
keep-outputs = true
keep-derivations = true
'';
# Enables logging in with my Solokey
security.pam.u2f = {
enable = true;
debug = false;
cue = true;
control = "sufficient";
authFile =
"/etc/u2f-mappings"; # use `pamu2fcfg` from `pkgs.pam_u2f` to generate this config
};
programs.ssh.startAgent = true;
# don't shutdown when power button is short-pressed
services.logind.extraConfig = ''
HandlePowerKey=suspend
'';
services.udev.packages = with pkgs; [
android-udev-rules
logitech-udev-rules
wooting-udev-rules
];
# This value determines the NixOS release from which the default
# settings for stateful data, like file locations and database versions
# on your system were taken. It‘s perfectly fine and recommended to leave

50
nixos/hosts/thalassa/null/hardware-configuration.nix
View File

@ -5,34 +5,38 @@
{
imports = [ (modulesPath + "/installer/scan/not-detected.nix") ];
boot = {
boot.initrd.availableKernelModules =
[ "xhci_pci" "ahci" "nvme" "rtsx_pci_sdmmc" ];
boot.initrd.kernelModules = [ ];
boot.kernelModules = [ "kvm-intel" ];
boot.extraModulePackages = [ ];
fileSystems."/" = {
device = "/dev/disk/by-uuid/d4f56e5b-2509-4e63-8324-65a35c71e90c";
fsType = "btrfs";
options = [ "subvol=@" ];
initrd.availableKernelModules =
[ "xhci_pci" "ahci" "nvme" "rtsx_pci_sdmmc" ];
initrd.kernelModules = [ ];
kernelModules = [ "kvm-intel" ];
extraModulePackages = [ ];
};
fileSystems = {
fileSystems."/nix" = {
device = "/dev/disk/by-uuid/d4f56e5b-2509-4e63-8324-65a35c71e90c";
fsType = "btrfs";
options = [ "subvol=@/nix" ];
};
"/" = {
device = "/dev/disk/by-uuid/d4f56e5b-2509-4e63-8324-65a35c71e90c";
fsType = "btrfs";
options = [ "subvol=@" ];
};
fileSystems."/home" = {
device = "/dev/disk/by-uuid/d4f56e5b-2509-4e63-8324-65a35c71e90c";
fsType = "btrfs";
options = [ "subvol=@home" ];
};
"/nix" = {
device = "/dev/disk/by-uuid/d4f56e5b-2509-4e63-8324-65a35c71e90c";
fsType = "btrfs";
options = [ "subvol=@/nix" ];
};
fileSystems."/boot/efi" = {
device = "/dev/disk/by-uuid/D478-6F66";
fsType = "vfat";
"/home" = {
device = "/dev/disk/by-uuid/d4f56e5b-2509-4e63-8324-65a35c71e90c";
fsType = "btrfs";
options = [ "subvol=@home" ];
};
"/boot/efi" = {
device = "/dev/disk/by-uuid/D478-6F66";
fsType = "vfat";
};
};
swapDevices = [ ];

373
nixos/hosts/thalassa/null/home/default.nix
View File

@ -4,198 +4,205 @@ let
inherit (pkgs.texlive) scheme-full;
dnd-5e-latex-template = { pkgs = [ pkgs.v.dnd-5e-latex-template ]; };
};
in {
programs.home-manager.enable = true;
home.username = "victor";
home.homeDirectory = "/home/victor";
home.stateVersion = "22.05";
in
{
programs = {
home-manager.enable = true;
foot = { enable = true; };
nix-index.enable = true;
exa = {
enable = true;
enableAliases = true;
};
bat.enable = true;
git = {
enable = true;
package = pkgs.gitAndTools.gitFull;
userName = "Victor";
userEmail = "victor@xirion.net";
lfs.enable = true;
# delta.enable = true;
extraConfig = {
push.autoSetupRemote = true;
init.defaultBranch = "main";
};
};
mako = {
enable = true;
extraConfig = ''
[mode=do-not-disturb]
invisible=1
'';
};
tmux = {
enable = true;
shortcut = "b";
terminal = "screen-256color";
clock24 = true;
};
firefox = {
enable = true;
package = pkgs.firefox-devedition-bin;
};
vscode = {
enable = true;
package = pkgs.vscode;
userSettings = {
"ltex.language" = "en-GB";
"latex-workshop" = {
"linting.chktex.enabled" = true;
"latex.clean.subfolder.enabled" = true;
"latex.outDir" = "%TMPDIR%/%RELATIVE_DOC%";
};
"workbench.colorTheme" = "Catppuccin Frappé";
"editor.fontFamily" =
"'DejaVuSansMono Nerd Font', 'monospace', monospace";
"keyboard.dispatch" = "keyCode";
"rust-analyzer.server.path" = "${pkgs.rust-analyzer}/bin/rust-analyzer";
"terminal.integrated.defaultProfile.linux" = "zsh";
"nix.enableLanguageServer" = true; # Enable LSP.
"nix.serverPath" =
"${pkgs.nil}/bin/nil"; # The path to the LSP server executable.
"[nix]" = { "editor.defaultFormatter" = "brettm12345.nixfmt-vscode"; };
};
extensions = with pkgs.vscode-extensions;
with pkgs.v.vscode-extensions; [
# astro-build.astro-vscode
brettm12345.nixfmt-vscode
catppuccin.catppuccin-vsc
codezombiech.gitignore
editorconfig.editorconfig
foxundermoon.shell-format
james-yu.latex-workshop
jnoortheen.nix-ide
matklad.rust-analyzer
mkhl.direnv
ms-vscode-remote.remote-ssh
ms-vscode.cpptools
platformio.platformio-ide
redhat.vscode-yaml
tamasfe.even-better-toml
valentjn.vscode-ltex
vscodevim.vim
xaver.clang-format
];
};
direnv = {
enable = true;
nix-direnv = { enable = true; };
};
zsh = {
enable = true;
sessionVariables = { DIRENV_LOG_FORMAT = ""; };
};
};
home = {
username = "victor";
homeDirectory = "/home/victor";
stateVersion = "22.05";
packages = with pkgs; [
appimage-run
brightnessctl
btop
calibre
cinny-desktop
discord-canary
element-desktop-wayland
fluxcd
fusee-launcher
gcc
gimp
gnome.eog
gnome.file-roller
gnome.gnome-font-viewer
gnome.nautilus
grim # Screenshot tool
inputs.comma.packages.${pkgs.system}.default
inputs.riff.packages.${pkgs.system}.riff
inputs.webcord.packages.${pkgs.system}.default
k9s
kubectl
libnotify
mullvad-vpn
neofetch
nixpkgs-review
nixfmt
ouch
plex-media-player
plexamp
python3
retroarchFull
ripgrep
rsync
rustup
saleae-logic-2
solo2-cli
steam-run
tex
thunderbird-wayland
v.deemix-gui
wf-recorder # Screenrecorder
wl-clipboard # Clipboard manager
wofi # Wayland rofi
wpa_supplicant_gui
];
};
imports = [ ./hyprland.nix ./neovim.nix ./eww ./theme.nix ];
home.packages = with pkgs; [
appimage-run
brightnessctl
btop
calibre
cinny-desktop
discord-canary
element-desktop-wayland
fluxcd
fusee-launcher
gcc
gimp
gnome.eog
gnome.file-roller
gnome.gnome-font-viewer
gnome.nautilus
grim # Screenshot tool
inputs.comma.packages.${pkgs.system}.default
inputs.riff.packages.${pkgs.system}.riff
inputs.webcord.packages.${pkgs.system}.default
k9s
kubectl
libnotify
mullvad-vpn
neofetch
nixpkgs-review
nixfmt
ouch
plex-media-player
plexamp
python3
retroarchFull
ripgrep
rsync
rustup
saleae-logic-2
solo2-cli
steam-run
tex
thunderbird-wayland
v.deemix-gui
wf-recorder # Screenrecorder
wl-clipboard # Clipboard manager
wofi # Wayland rofi
wpa_supplicant_gui
];
xdg.mimeApps = {
enable = true;
defaultApplications = let browser = [ "firefox.desktop" ];
in {
"image/*" = "org.gnome.eog.desktop";
"text/html" = browser;
"x-scheme-handler/http" = browser;
"x-scheme-handler/https" = browser;
"x-scheme-handler/ftp" = browser;
"x-scheme-handler/about" = browser;
"x-scheme-handler/unknown" = browser;
"application/x-extension-htm" = browser;
"application/x-extension-html" = browser;
"application/x-extension-shtml" = browser;
"application/xhtml+xml" = browser;
"application/x-extension-xhtml" = browser;
"application/x-extension-xht" = browser;
defaultApplications =
let browser = [ "firefox.desktop" ];
in {
"image/*" = "org.gnome.eog.desktop";
"text/html" = browser;
"x-scheme-handler/http" = browser;
"x-scheme-handler/https" = browser;
"x-scheme-handler/ftp" = browser;
"x-scheme-handler/about" = browser;
"x-scheme-handler/unknown" = browser;
"application/x-extension-htm" = browser;
"application/x-extension-html" = browser;
"application/x-extension-shtml" = browser;
"application/xhtml+xml" = browser;
"application/x-extension-xhtml" = browser;
"application/x-extension-xht" = browser;
"application/json" = browser;
"application/pdf" = browser;
"application/json" = browser;
"application/pdf" = browser;
"x-scheme-handler/vscode" = "code-url-handler.desktop";
"x-scheme-handler/discord" = "webcord.desktop";
};
};
programs.foot = { enable = true; };
programs.nix-index.enable = true;
programs.exa = {
enable = true;
enableAliases = true;
};
programs.bat.enable = true;
programs.git = {
enable = true;
package = pkgs.gitAndTools.gitFull;
userName = "Victor";
userEmail = "victor@xirion.net";
lfs.enable = true;
# delta.enable = true;
extraConfig = {
push.autoSetupRemote = true;
init.defaultBranch = "main";
};
};
programs.mako = {
enable = true;
extraConfig = ''
[mode=do-not-disturb]
invisible=1
'';
};
programs.tmux = {
enable = true;
shortcut = "b";
terminal = "screen-256color";
clock24 = true;
};
programs.firefox = {
enable = true;
package = pkgs.firefox-devedition-bin;
};
programs.vscode = {
enable = true;
package = pkgs.vscode;
userSettings = {
"ltex.language" = "en-GB";
"latex-workshop" = {
"linting.chktex.enabled" = true;
"latex.clean.subfolder.enabled" = true;
"latex.outDir" = "%TMPDIR%/%RELATIVE_DOC%";
"x-scheme-handler/vscode" = "code-url-handler.desktop";
"x-scheme-handler/discord" = "webcord.desktop";
};
"workbench.colorTheme" = "Catppuccin Frappé";
"editor.fontFamily" =
"'DejaVuSansMono Nerd Font', 'monospace', monospace";
"keyboard.dispatch" = "keyCode";
"rust-analyzer.server.path" = "${pkgs.rust-analyzer}/bin/rust-analyzer";
"terminal.integrated.defaultProfile.linux" = "zsh";
"nix.enableLanguageServer" = true; # Enable LSP.
"nix.serverPath" =
"${pkgs.nil}/bin/nil"; # The path to the LSP server executable.
"[nix]" = { "editor.defaultFormatter" = "brettm12345.nixfmt-vscode"; };
};
xdg.userDirs =
let home = config.home.homeDirectory;
in {
enable = true;
createDirectories = true;
desktop = "${home}/.desktop";
documents = "${home}/cloud/Documents";
download = "${home}/dl";
music = "${home}/cloud/Music";
pictures = "${home}/cloud/Pictures";
publicShare = "${home}/.publicShare";
templates = "${home}/.templates";
videos = "${home}/cloud/Videos";
};
extensions = with pkgs.vscode-extensions;
with pkgs.v.vscode-extensions; [
# astro-build.astro-vscode
brettm12345.nixfmt-vscode
catppuccin.catppuccin-vsc
codezombiech.gitignore
editorconfig.editorconfig
foxundermoon.shell-format
james-yu.latex-workshop
jnoortheen.nix-ide
matklad.rust-analyzer
mkhl.direnv
ms-vscode-remote.remote-ssh
ms-vscode.cpptools
platformio.platformio-ide
redhat.vscode-yaml
tamasfe.even-better-toml
valentjn.vscode-ltex
vscodevim.vim
xaver.clang-format
];
};
programs.direnv = {
enable = true;
nix-direnv = { enable = true; };
};
programs.zsh = {
enable = true;
sessionVariables = { DIRENV_LOG_FORMAT = ""; };
};
xdg.userDirs = let home = config.home.homeDirectory;
in {
enable = true;
createDirectories = true;
desktop = "${home}/.desktop";
documents = "${home}/cloud/Documents";
download = "${home}/dl";
music = "${home}/cloud/Music";
pictures = "${home}/cloud/Pictures";
publicShare = "${home}/.publicShare";
templates = "${home}/.templates";
videos = "${home}/cloud/Videos";
};
services.syncthing.enable = true;
}

62
nixos/hosts/thalassa/null/home/eww/default.nix
View File

@ -1,38 +1,42 @@
{ pkgs, ... }: {
home.packages = with pkgs; [
eww-wayland
pamixer
lua
(nerdfonts.override { fonts = [ "JetBrainsMono" ]; })
];
home = {
packages = with pkgs; [
eww-wayland
pamixer
lua
(nerdfonts.override { fonts = [ "JetBrainsMono" ]; })
];
file = {
home.file.".config/eww/eww.yuck".source = ./eww.yuck;
home.file.".config/eww/eww.scss".text = builtins.readFile ./eww.scss;
".config/eww/eww.yuck".source = ./eww.yuck;
".config/eww/eww.scss".text = builtins.readFile ./eww.scss;
# scripts
# TODO: just link all scripts in ./scripts to .config/eww/scripts
home.file.".config/eww/scripts/volume.sh" = {
source = ./scripts/volume.sh;
executable = true;
};
# scripts
# TODO: just link all scripts in ./scripts to .config/eww/scripts
".config/eww/scripts/volume.sh" = {
source = ./scripts/volume.sh;
executable = true;
};
home.file.".config/eww/scripts/wifi.sh" = {
source = ./scripts/wifi.sh;
executable = true;
};
".config/eww/scripts/wifi.sh" = {
source = ./scripts/wifi.sh;
executable = true;
};
home.file.".config/eww/scripts/workspaces.sh" = {
source = ./scripts/workspaces.sh;
executable = true;
};
".config/eww/scripts/workspaces.sh" = {
source = ./scripts/workspaces.sh;
executable = true;
};
home.file.".config/eww/scripts/workspaces.lua" = {
source = ./scripts/workspaces.lua;
executable = true;
};
".config/eww/scripts/workspaces.lua" = {
source = ./scripts/workspaces.lua;
executable = true;
};
home.file.".config/eww/scripts/do-not-disturb.sh" = {
source = ./scripts/do-not-disturb.sh;
executable = true;
".config/eww/scripts/do-not-disturb.sh" = {
source = ./scripts/do-not-disturb.sh;
executable = true;
};
};
};
}

226
nixos/hosts/thalassa/null/home/hyprland.nix
View File

@ -5,131 +5,133 @@
wallpaper = eDP-1,~/cloud/Pictures/Wallpapers-Laptop/wallpaper-nix-pink.png
'';
wayland.windowManager.hyprland = let
startup-script = pkgs.writeScriptBin "startup" ''
#!${pkgs.stdenv.shell}
hyprctl setcursor Catppuccin-Frappe-Pink-Cursors ${
builtins.toString config.home.pointerCursor.size
}
${pkgs.hyprpaper}/bin/hyprpaper &
foot --server &
eww daemon &
eww open bar &
firefox-devedition &
webcord &
element-desktop &
'';
in {
enable = true;
recommendedEnvironment = true;
extraConfig = ''
exec-once=dbus-update-activation-environment --systemd WAYLAND_DISPLAY XDG_CURRENT_DESKTOP
exec-once=systemctl --user import-environment WAYLAND_DISPLAY XDG_CURRENT_DESKTOP
monitor=eDP-1,1920x1080@60,0x0,1
monitor=eDP-1,addreserved,0,0,48,0
monitor=,preferred,auto,1
windowrulev2 = workspace 1 silent,class:^(Electron)$,title:^(.*)(WebCord)(.*)$
windowrulev2 = workspace 1 silent,title:^(Element)(.*)$
windowrulev2 = workspace 2 silent,class:^(firefox-aurora)$
windowrulev2 = float,class:^(firefox-aurora)$,title:^(Picture-in-Picture)$
general {
layout = dwindle
col.active_border = 0xfff4b8e4
}
input {
kb_options=caps:escape
touchpad {
natural_scroll= true
wayland.windowManager.hyprland =
let
startup-script = pkgs.writeScriptBin "startup" ''
#!${pkgs.stdenv.shell}
hyprctl setcursor Catppuccin-Frappe-Pink-Cursors ${
builtins.toString config.home.pointerCursor.size
}
}
${pkgs.hyprpaper}/bin/hyprpaper &
foot --server &
eww daemon &
eww open bar &
firefox-devedition &
webcord &
element-desktop &
'';
in
{
enable = true;
recommendedEnvironment = true;
extraConfig = ''
exec-once=dbus-update-activation-environment --systemd WAYLAND_DISPLAY XDG_CURRENT_DESKTOP
exec-once=systemctl --user import-environment WAYLAND_DISPLAY XDG_CURRENT_DESKTOP
gestures {
workspace_swipe = true
}
monitor=eDP-1,1920x1080@60,0x0,1
monitor=eDP-1,addreserved,0,0,48,0
monitor=,preferred,auto,1
misc {
no_vfr = false
disable_hyprland_logo = true
disable_splash_rendering = true
}
windowrulev2 = workspace 1 silent,class:^(Electron)$,title:^(.*)(WebCord)(.*)$
windowrulev2 = workspace 1 silent,title:^(Element)(.*)$
windowrulev2 = workspace 2 silent,class:^(firefox-aurora)$
windowrulev2 = float,class:^(firefox-aurora)$,title:^(Picture-in-Picture)$
dwindle {
pseudotile=true
}
general {
layout = dwindle
col.active_border = 0xfff4b8e4
}
bind=SUPER,RETURN,exec,footclient
bind=SUPER,f,exec,firefox-devedition
bind=SUPER,d,exec,wofi --show run,drun
input {
kb_options=caps:escape
touchpad {
natural_scroll= true
}
}
bind=,Print,exec,grim -g "$(slurp)" -t png - | wl-copy -t image/png
bind=SUPER,W,killactive,
bind=SUPERSHIFT,Q,exit,
bind=SUPER,S,togglefloating,
bind=SUPER,P,pin,
gestures {
workspace_swipe = true
}
bindm=SUPER,mouse:272,movewindow
bindm=SUPER,mouse:273,resizewindow
misc {
no_vfr = false
disable_hyprland_logo = true
disable_splash_rendering = true
}
bind=SUPER,left,movefocus,l
bind=SUPER,right,movefocus,r
bind=SUPER,up,movefocus,u
bind=SUPER,down,movefocus,d
dwindle {
pseudotile=true
}
bind=SUPER,1,workspace,1
bind=SUPER,2,workspace,2
bind=SUPER,3,workspace,3
bind=SUPER,4,workspace,4
bind=SUPER,5,workspace,5
bind=SUPER,6,workspace,6
bind=SUPER,7,workspace,7
bind=SUPER,8,workspace,8
bind=SUPER,9,workspace,9
bind=SUPER,0,workspace,10
bind=SUPER,grave,togglespecialworkspace
bind=SUPER,RETURN,exec,footclient
bind=SUPER,f,exec,firefox-devedition
bind=SUPER,d,exec,wofi --show run,drun
bind=ALT,1,movetoworkspace,1
bind=ALT,2,movetoworkspace,2
bind=ALT,3,movetoworkspace,3
bind=ALT,4,movetoworkspace,4
bind=ALT,5,movetoworkspace,5
bind=ALT,6,movetoworkspace,6
bind=ALT,7,movetoworkspace,7
bind=ALT,8,movetoworkspace,8
bind=ALT,9,movetoworkspace,9
bind=ALT,0,movetoworkspace,10
bind=ALT,grave,movetoworkspace,special
bind=,Print,exec,grim -g "$(slurp)" -t png - | wl-copy -t image/png
bind=SUPER,W,killactive,
bind=SUPERSHIFT,Q,exit,
bind=SUPER,S,togglefloating,
bind=SUPER,P,pin,
bind=SUPERSHIFT,1,movetoworkspacesilent,1
bind=SUPERSHIFT,2,movetoworkspacesilent,2
bind=SUPERSHIFT,3,movetoworkspacesilent,3
bind=SUPERSHIFT,4,movetoworkspacesilent,4
bind=SUPERSHIFT,5,movetoworkspacesilent,5
bind=SUPERSHIFT,6,movetoworkspacesilent,6
bind=SUPERSHIFT,7,movetoworkspacesilent,7
bind=SUPERSHIFT,8,movetoworkspacesilent,8
bind=SUPERSHIFT,9,movetoworkspacesilent,9
bind=SUPERSHIFT,0,movetoworkspacesilent,10
bind=SUPERSHIFT,grave,movetoworkspacesilent,special
bindm=SUPER,mouse:272,movewindow
bindm=SUPER,mouse:273,resizewindow
bind=SUPER,mouse_down,workspace,e+1
bind=SUPER,mouse_up,workspace,e-1
bind=SUPER,left,movefocus,l
bind=SUPER,right,movefocus,r
bind=SUPER,up,movefocus,u
bind=SUPER,down,movefocus,d
bind=SUPER,g,togglegroup
bind=SUPER,tab,changegroupactive
bind=SUPER,m,fullscreen,1
bind=SUPERSHIFT,m,fullscreen,0
bind=SUPER,1,workspace,1
bind=SUPER,2,workspace,2
bind=SUPER,3,workspace,3
bind=SUPER,4,workspace,4
bind=SUPER,5,workspace,5
bind=SUPER,6,workspace,6
bind=SUPER,7,workspace,7
bind=SUPER,8,workspace,8
bind=SUPER,9,workspace,9
bind=SUPER,0,workspace,10
bind=SUPER,grave,togglespecialworkspace
bind=,XF86MonBrightnessUp,exec,brightnessctl -q s +5%
bind=,XF86MonBrightnessDown,exec,brightnessctl -q s 5%-
bind=,XF86MonRaiseVolume,exec,pamixer -i 5
bind=,XF86MonLowerVolume,exec,pamixer -d 5
bind=,XF86AudioMute,exec,pamixer -t
bind=ALT,1,movetoworkspace,1
bind=ALT,2,movetoworkspace,2
bind=ALT,3,movetoworkspace,3
bind=ALT,4,movetoworkspace,4
bind=ALT,5,movetoworkspace,5
bind=ALT,6,movetoworkspace,6
bind=ALT,7,movetoworkspace,7
bind=ALT,8,movetoworkspace,8
bind=ALT,9,movetoworkspace,9
bind=ALT,0,movetoworkspace,10
bind=ALT,grave,movetoworkspace,special
exec-once=${startup-script}/bin/startup
'';
};
bind=SUPERSHIFT,1,movetoworkspacesilent,1
bind=SUPERSHIFT,2,movetoworkspacesilent,2
bind=SUPERSHIFT,3,movetoworkspacesilent,3
bind=SUPERSHIFT,4,movetoworkspacesilent,4
bind=SUPERSHIFT,5,movetoworkspacesilent,5
bind=SUPERSHIFT,6,movetoworkspacesilent,6
bind=SUPERSHIFT,7,movetoworkspacesilent,7
bind=SUPERSHIFT,8,movetoworkspacesilent,8
bind=SUPERSHIFT,9,movetoworkspacesilent,9
bind=SUPERSHIFT,0,movetoworkspacesilent,10
bind=SUPERSHIFT,grave,movetoworkspacesilent,special
bind=SUPER,mouse_down,workspace,e+1
bind=SUPER,mouse_up,workspace,e-1
bind=SUPER,g,togglegroup
bind=SUPER,tab,changegroupactive
bind=SUPER,m,fullscreen,1
bind=SUPERSHIFT,m,fullscreen,0
bind=,XF86MonBrightnessUp,exec,brightnessctl -q s +5%
bind=,XF86MonBrightnessDown,exec,brightnessctl -q s 5%-
bind=,XF86MonRaiseVolume,exec,pamixer -i 5
bind=,XF86MonLowerVolume,exec,pamixer -d 5
bind=,XF86AudioMute,exec,pamixer -t
exec-once=${startup-script}/bin/startup
'';
};
}

8
nixos/hosts/thalassa/null/home/neovim.nix
View File

@ -27,9 +27,11 @@
};
lsp = {
enable = true;
servers.rust-analyzer.enable = true;
servers.rnix-lsp.enable = true;
servers.pyright.enable = true;
servers = {
rust-analyzer.enable = true;
rnix-lsp.enable = true;
pyright.enable = true;
};
};
nvim-cmp = { enable = true; };
};

79
nixos/hosts/thalassa/null/home/theme.nix
View File

@ -34,16 +34,48 @@ let
hex = mapAttrs (_name: value: "#${value}") colour;
};
in {
home.file.".xsettingsd".text = ''
Net/ThemeName "${theme}"
Gtk/CursorThemeName "${cursorTheme}"
'';
in
{
home = {
file.".xsettingsd".text = ''
Net/ThemeName "${theme}"
Gtk/CursorThemeName "${cursorTheme}"
'';
home.pointerCursor = {
name = "Catppuccin-Frappe-Pink-Cursors";
size = 32;
package = pkgs.catppuccin-cursors.frappePink;
pointerCursor = {
name = "Catppuccin-Frappe-Pink-Cursors";
size = 32;
package = pkgs.catppuccin-cursors.frappePink;
};
file.".config/eww/eww.scss".text = lib.mkBefore ''
$rosewater: ${colour.hex.rosewater};
$flamingo: ${colour.hex.flamingo};
$pink: ${colour.hex.pink};
$mauve: ${colour.hex.mauve};
$red: ${colour.hex.red};
$maroon: ${colour.hex.maroon};
$peach: ${colour.hex.peach};
$yellow: ${colour.hex.yellow};
$green: ${colour.hex.green};
$teal: ${colour.hex.teal};
$sky: ${colour.hex.sky};
$sapphire: ${colour.hex.sapphire};
$blue: ${colour.hex.blue};
$lavender: ${colour.hex.lavender};
$text: ${colour.hex.text};
$subtext0: ${colour.hex.subtext0};
$subtext1: ${colour.hex.subtext1};
$overlay0: ${colour.hex.overlay0};
$overlay1: ${colour.hex.overlay1};
$overlay2: ${colour.hex.overlay2};
$surface0: ${colour.hex.surface0};
$surface1: ${colour.hex.surface1};
$surface2: ${colour.hex.surface2};
$base: ${colour.hex.base};
$mantle: ${colour.hex.mantle};
$crust: ${colour.hex.crust};
'';
};
gtk = {
@ -92,33 +124,4 @@ in {
textColor = colour.hex.text;
borderRadius = 5;
};
home.file.".config/eww/eww.scss".text = lib.mkBefore ''
$rosewater: ${colour.hex.rosewater};
$flamingo: ${colour.hex.flamingo};
$pink: ${colour.hex.pink};
$mauve: ${colour.hex.mauve};
$red: ${colour.hex.red};
$maroon: ${colour.hex.maroon};
$peach: ${colour.hex.peach};
$yellow: ${colour.hex.yellow};
$green: ${colour.hex.green};
$teal: ${colour.hex.teal};
$sky: ${colour.hex.sky};
$sapphire: ${colour.hex.sapphire};
$blue: ${colour.hex.blue};
$lavender: ${colour.hex.lavender};
$text: ${colour.hex.text};
$subtext0: ${colour.hex.subtext0};
$subtext1: ${colour.hex.subtext1};
$overlay0: ${colour.hex.overlay0};
$overlay1: ${colour.hex.overlay1};
$overlay2: ${colour.hex.overlay2};
$surface0: ${colour.hex.surface0};
$surface1: ${colour.hex.surface1};
$surface2: ${colour.hex.surface2};
$base: ${colour.hex.base};
$mantle: ${colour.hex.mantle};
$crust: ${colour.hex.crust};
'';
}

3
nixos/hosts/thalassa/null/rescue-boot.nix
View File

@ -13,7 +13,8 @@ let
boot.supportedFilesystems = [ "btrfs" "ext4" ];
environment.systemPackages = with pkgs; [ git ];
};
in {
in
{
boot.loader.systemd-boot = {
extraEntries = {
"rescue.conf" = ''

41
nixos/pkgs/glitch-soc/default.nix
View File

@ -1,9 +1,22 @@
{ lib, stdenv, nodejs-slim, bundlerEnv, nixosTests, yarn, callPackage
, imagemagick, ffmpeg, file, ruby_3_0, writeShellScript, fetchYarnDeps
{ lib
, stdenv
, nodejs-slim
, bundlerEnv
, nixosTests
, yarn
, callPackage
, imagemagick
, ffmpeg
, file
, ruby_3_0
, writeShellScript
, fetchYarnDeps
, fixup_yarn_lock
# Allow building a fork or custom version of Mastodon:
, pname ? "mastodon", version ? import ./version.nix, srcOverride ? null
# Allow building a fork or custom version of Mastodon:
, pname ? "mastodon"
, version ? import ./version.nix
, srcOverride ? null
, dependenciesDir ? ./. # Should contain gemset.nix, yarn.nix and package.json.
}:
@ -106,16 +119,18 @@ stdenv.mkDerivation rec {
ln -s /tmp tmp
'';
installPhase = let
run-streaming = writeShellScript "run-streaming.sh" ''
# NixOS helper script to consistently use the same NodeJS version the package was built with.
${nodejs-slim}/bin/node ./streaming
installPhase =
let
run-streaming = writeShellScript "run-streaming.sh" ''
# NixOS helper script to consistently use the same NodeJS version the package was built with.
${nodejs-slim}/bin/node ./streaming
'';
in
''
mkdir -p $out
cp -r * $out/
ln -s ${run-streaming} $out/run-streaming.sh
'';
in ''
mkdir -p $out
cp -r * $out/
ln -s ${run-streaming} $out/run-streaming.sh
'';
passthru = {
tests.mastodon = nixosTests.mastodon;

2246
nixos/pkgs/glitch-soc/gemset.nix
View File

File diff suppressed because it is too large Load Diff

8
nixos/pkgs/glitch-soc/source.nix
View File

@ -1,11 +1,13 @@
# This file was generated by pkgs.mastodon.updateScript.
{ fetchgit, applyPatches }: let
{ fetchgit, applyPatches }:
let
src = fetchgit {
url = "https://github.com/glitch-soc/mastodon.git";
rev = "a1df9fdb06854bd55f018918236132ccfa7d9d84";
sha256 = "0amqiigq3qgag6qm119aaysmd2k93vwgr1aynxjxmbpn35ykcay3";
};
in applyPatches {
in
applyPatches {
inherit src;
patches = [];
patches = [ ];
}

17
nixos/pkgs/glitch-soc/update.nix
View File

@ -1,5 +1,14 @@
{ runCommand, lib, makeWrapper, yarn2nix, bundix, coreutils, diffutils
, nix-prefetch-git, gnused, jq }:
{ runCommand
, lib
, makeWrapper
, yarn2nix
, bundix
, coreutils
, diffutils
, nix-prefetch-git
, gnused
, jq
}:
let
binPath = lib.makeBinPath [
yarn2nix
@ -10,7 +19,9 @@ let
gnused
jq
];
in runCommand "mastodon-update-script" {
in
runCommand "mastodon-update-script"
{
nativeBuildInputs = [ makeWrapper ];
meta = {

6
nixos/pkgs/plex-pass/raw.nix
View File

@ -2,8 +2,10 @@
let
sources = builtins.fromJSON (builtins.readFile ./sources.json);
source = lib.findFirst (x: x.platform == stdenv.hostPlatform.system)
(throw "unsupported platform: ${stdenv.hostPlatform.system}") sources;
in plexRaw.overrideAttrs (attrs: {
(throw "unsupported platform: ${stdenv.hostPlatform.system}")
sources;
in
plexRaw.overrideAttrs (attrs: {
pname = attrs.pname + "-plexpass";
inherit (source) version;
src = fetchurl {

3
nixos/pkgs/roundcube-swipe/default.nix
View File

@ -6,7 +6,8 @@ let
mkdir -p $out/plugins/
cp -r ${src} $out/plugins/swipe
'';
in roundcubePlugin rec {
in
roundcubePlugin rec {
pname = "roundcube-swipe";
version = "0.5";

47
nixos/util.nix
View File

@ -7,19 +7,21 @@ let
mailserver.nixosModules.mailserver
attic.nixosModules.atticd
];
type_import = let
import_cases = {
"lxc" = [
"${nixpkgs}/nixos/modules/virtualisation/lxc-container.nix"
./common/generic-lxc.nix
];
"vm" = [ ./common/generic-vm.nix ];
"local" = [
lanzaboote.nixosModules.lanzaboote
./common/desktop
];
};
in type: import_cases.${type} ++ base_imports;
type_import =
let
import_cases = {
"lxc" = [
"${nixpkgs}/nixos/modules/virtualisation/lxc-container.nix"
./common/generic-lxc.nix
];
"vm" = [ ./common/generic-vm.nix ];
"local" = [
lanzaboote.nixosModules.lanzaboote
./common/desktop
];
};
in
type: import_cases.${type} ++ base_imports;
# Helper function to resolve what should be imported depending on the type of config (lxc, vm, bare metal)
resolve_imports = { hostname, realm, profile ? hostname, type ? "lxc", ... }:
type_import type
@ -38,7 +40,7 @@ let
# Flatten all hosts to a single list
flatten_hosts = realms:
concatMap (mapAttrsToList (name: value: value // { hostname = name; }))
(attrValues realms);
(attrValues realms);
# Filter out all hosts which aren't nixos
filter_nix_hosts = filter ({ nix ? true, ... }: nix);
@ -46,12 +48,20 @@ let
# outputs
# Helper function to build a colmena host definition
mkColmenaHost = { ip ? null, exposes ? null, hostname, tags, realm
, type ? "lxc", ... }@host:
mkColmenaHost =
{ ip ? null
, exposes ? null
, hostname
, tags
, realm
, type ? "lxc"
, ...
}@host:
let
# this makes local apply work a bit nicer
name = if type == "local" then hostname else "${hostname}.${realm}";
in {
in
{
"${name}" = {
imports = resolve_imports host;
networking = {
@ -73,4 +83,5 @@ let
hosts = add_realm_to_tags (import ./hosts);
flat_hosts = flatten_hosts hosts;
nixHosts = filter_nix_hosts flat_hosts;
in { inherit base_imports mkColmenaHost hosts flat_hosts nixHosts; }
in
{ inherit base_imports mkColmenaHost hosts flat_hosts nixHosts; }

3
repl.nix
View File

@ -1,6 +1,7 @@
let
flake = builtins.getFlake (toString ./.);
nixpkgs = import <nixpkgs> { };
in {
in
{
inherit flake;
} // flake // builtins // nixpkgs // nixpkgs.lib // flake.nixosConfigurations