v
/
infrastructure
1
0
Fork 0
Code Issues 13 Pull Requests 1 Actions Packages Projects Releases Activity

fixed linting

pull/208/head
Vivian 2023-09-25 11:56:02 +02:00
parent 290ce7f72d
commit ea83c79fb3
59 changed files with 2843 additions and 2638 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

31
flake.nix
View File

@ -46,8 +46,17 @@
attic.url = "github:zhaofengli/attic"; attic.url = "github:zhaofengli/attic";
}; };
outputs = { self, nixpkgs, nixpkgs_stable, vault-secrets, colmena outputs =
, nixos-generators, nur, attic, ... }@inputs: { self
, nixpkgs
, nixpkgs_stable
, vault-secrets
, colmena
, nixos-generators
, nur
, attic
, ...
}@inputs:
let let
inherit (nixpkgs) lib; inherit (nixpkgs) lib;
@ -81,7 +90,8 @@
source /etc/set-environment source /etc/set-environment
nix repl --file "${./.}/repl.nix" $@ nix repl --file "${./.}/repl.nix" $@
''; '';
in { in
{
# Make the nixosConfigurations for compat reasons (e.g. vault) # Make the nixosConfigurations for compat reasons (e.g. vault)
nixosConfigurations = nixosConfigurations =
(import (inputs.colmena + "/src/nix/hive/eval.nix") { (import (inputs.colmena + "/src/nix/hive/eval.nix") {
@ -93,12 +103,14 @@
}).nodes; }).nodes;
# Make the colmena configuration # Make the colmena configuration
colmena = lib.foldr (el: acc: acc // util.mkColmenaHost el) { colmena = lib.foldr (el: acc: acc // util.mkColmenaHost el)
meta = { {
inherit specialArgs; meta = {
nixpkgs = pkgs; inherit specialArgs;
}; nixpkgs = pkgs;
} nixHosts; };
}
nixHosts;
packages.${system} = { packages.${system} = {
inherit apply-local; inherit apply-local;
@ -137,6 +149,7 @@
statix statix
terraform terraform
nixfmt nixfmt
nixpkgs-fmt
nixUnstable nixUnstable
nil nil
vault vault

18
nixos/common/default.nix
View File

@ -2,14 +2,16 @@
imports = imports =
[ ./users ./modules inputs.vault-secrets.nixosModules.vault-secrets ]; [ ./users ./modules inputs.vault-secrets.nixosModules.vault-secrets ];
vault-secrets = let vault-secrets =
inherit (config.networking) domain hostName; let
server = if domain == "olympus" then "vault" else "vault-0"; inherit (config.networking) domain hostName;
in lib.mkIf (domain == "olympus" || domain == "hades") { server = if domain == "olympus" then "vault" else "vault-0";
vaultPrefix = "${domain}_secrets/nixos"; in
vaultAddress = "http://${server}.${domain}:8200/"; lib.mkIf (domain == "olympus" || domain == "hades") {
approlePrefix = "${domain}-${hostName}"; vaultPrefix = "${domain}_secrets/nixos";
}; vaultAddress = "http://${server}.${domain}:8200/";
approlePrefix = "${domain}-${hostName}";
};
home-manager = { home-manager = {
useGlobalPkgs = true; useGlobalPkgs = true;

70
nixos/common/desktop/default.nix
View File

@ -21,9 +21,26 @@
users.victor = import ./home.nix; users.victor = import ./home.nix;
extraSpecialArgs = { inherit inputs; }; extraSpecialArgs = { inherit inputs; };
}; };
services = {
# Enable my config for the gnome desktop environment # Enable my config for the gnome desktop environment
services.v.gnome.enable = true; v.gnome.enable = true;
# Enable CUPS to print documents.
printing.enable = true;
pipewire = {
enable = true;
alsa.enable = true;
alsa.support32Bit = true;
pulse.enable = true;
# If you want to use JACK applications, uncomment this
#jack.enable = true;
# use the example session manager (no others are packaged yet so this is enabled by default,
# no need to redefine it in your config for now)
#media-session.enable = true;
};
};
# Set your time zone. # Set your time zone.
time.timeZone = "Europe/Amsterdam"; time.timeZone = "Europe/Amsterdam";
@ -42,9 +59,6 @@
LC_TIME = "nl_NL.UTF-8"; LC_TIME = "nl_NL.UTF-8";
}; };
# Enable CUPS to print documents.
services.printing.enable = true;
# Global Packages # Global Packages
environment = { systemPackages = with pkgs; [ wireguard-tools sbctl ]; }; environment = { systemPackages = with pkgs; [ wireguard-tools sbctl ]; };
@ -52,18 +66,6 @@
sound.enable = true; sound.enable = true;
hardware.pulseaudio.enable = false; hardware.pulseaudio.enable = false;
security.rtkit.enable = true; security.rtkit.enable = true;
services.pipewire = {
enable = true;
alsa.enable = true;
alsa.support32Bit = true;
pulse.enable = true;
# If you want to use JACK applications, uncomment this
#jack.enable = true;
# use the example session manager (no others are packaged yet so this is enabled by default,
# no need to redefine it in your config for now)
#media-session.enable = true;
};
virtualisation = { virtualisation = {
podman.enable = true; podman.enable = true;
@ -84,21 +86,27 @@
[ "DejaVuSansMono" "Ubuntu" "DroidSansMono" "NerdFontsSymbolsOnly" ]; [ "DejaVuSansMono" "Ubuntu" "DroidSansMono" "NerdFontsSymbolsOnly" ];
}) })
]; ];
programs = {
steam = {
programs.steam = {
enable = true; enable = true;
# Open ports in the firewall for Steam Remote Play # Open ports in the firewall for Steam Remote Play
remotePlay.openFirewall = true; remotePlay.openFirewall = true;
package = pkgs.steam.override { package = pkgs.steam.override {
extraPkgs = pkgs: with pkgs; [ gamescope mangohud ]; extraPkgs = pkgs: with pkgs; [ gamescope mangohud ];
};
}; };
gamemode.enable = true;
adb.enable = true;
};
networking = {
# Networking
networkmanager.enable = true;
firewall.checkReversePath = false;
firewall.enable = false;
}; };
programs.gamemode.enable = true;
programs.adb.enable = true;
# Networking
networking.networkmanager.enable = true;
networking.firewall.checkReversePath = false;
networking.firewall.enable = false;
} }

76
nixos/common/desktop/home.nix
View File

@ -5,7 +5,8 @@ let
dnd-5e-latex-template = { pkgs = [ pkgs.v.dnd-5e-latex-template ]; }; dnd-5e-latex-template = { pkgs = [ pkgs.v.dnd-5e-latex-template ]; };
}; };
my-python-packages = ps: with ps; [ pandas requests numpy ]; my-python-packages = ps: with ps; [ pandas requests numpy ];
in { in
{
home.packages = with pkgs; [ home.packages = with pkgs; [
(python3.withPackages my-python-packages) (python3.withPackages my-python-packages)
btop btop
@ -37,50 +38,53 @@ in {
# Enable my own hm modules # Enable my own hm modules
themes.v.catppuccin.enable = true; themes.v.catppuccin.enable = true;
programs.v.vscode.enable = true; programs = {
v.vscode.enable = true;
programs.riff = { riff = {
enable = true; enable = true;
direnv = true; direnv = true;
}; };
programs.firefox.enable = true; firefox.enable = true;
programs.chromium = { chromium = {
enable = true; enable = true;
package = pkgs.ungoogled-chromium; package = pkgs.ungoogled-chromium;
}; };
programs.direnv = { direnv = {
enable = true; enable = true;
nix-direnv.enable = true; nix-direnv.enable = true;
}; };
programs.zsh = { zsh = {
enable = true; enable = true;
sessionVariables = { DIRENV_LOG_FORMAT = ""; }; sessionVariables = { DIRENV_LOG_FORMAT = ""; };
}; };
programs.thunderbird = { thunderbird = {
enable = true; enable = true;
profiles.default = { profiles.default = {
isDefault = true; isDefault = true;
};
}; };
}; };
# Syncthing # Syncthing
services.syncthing.enable = true; services.syncthing.enable = true;
xdg.userDirs = let home = config.home.homeDirectory; xdg.userDirs =
in { let home = config.home.homeDirectory;
enable = true; in {
createDirectories = true; enable = true;
desktop = "${home}/.desktop"; createDirectories = true;
documents = "${home}/cloud/Documents"; desktop = "${home}/.desktop";
download = "${home}/dl"; documents = "${home}/cloud/Documents";
music = "${home}/cloud/Music"; download = "${home}/dl";
pictures = "${home}/cloud/Pictures"; music = "${home}/cloud/Music";
publicShare = "${home}/.publicShare"; pictures = "${home}/cloud/Pictures";
templates = "${home}/.templates"; publicShare = "${home}/.publicShare";
videos = "${home}/cloud/Videos"; templates = "${home}/.templates";
}; videos = "${home}/cloud/Videos";
};
} }

56
nixos/common/hm-modules/catppuccin.nix
View File

@ -3,36 +3,38 @@ with lib;
let cfg = config.themes.v.catppuccin; let cfg = config.themes.v.catppuccin;
in { in {
options.themes.v.catppuccin = { enable = mkEnableOption "catppuccin"; }; options.themes.v.catppuccin = { enable = mkEnableOption "catppuccin"; };
config = let config =
theme = "Catppuccin-Pink-Dark"; let
cursorTheme = config.home.pointerCursor.name; theme = "Catppuccin-Pink-Dark";
in mkIf cfg.enable { cursorTheme = config.home.pointerCursor.name;
home.pointerCursor = { in
name = "Bibata_Ghost"; mkIf cfg.enable {
size = 24; home.pointerCursor = {
package = pkgs.bibata-cursors-translucent; name = "Bibata_Ghost";
}; size = 24;
package = pkgs.bibata-cursors-translucent;
};
gtk = { gtk = {
enable = true; enable = true;
theme = { theme = {
name = theme; name = theme;
package = pkgs.catppuccin-gtk; package = pkgs.catppuccin-gtk;
};
iconTheme = {
name = "Papirus-Dark";
package = pkgs.papirus-icon-theme.override { color = "violet"; };
};
cursorTheme = {
name = cursorTheme;
inherit (config.home.pointerCursor) package size;
};
}; };
iconTheme = {
name = "Papirus-Dark";
package = pkgs.papirus-icon-theme.override { color = "violet"; };
};
cursorTheme = {
name = cursorTheme;
inherit (config.home.pointerCursor) package size;
};
};
programs.vscode = { programs.vscode = {
userSettings."workbench.colorTheme" = "Catppuccin Frappé"; userSettings."workbench.colorTheme" = "Catppuccin Frappé";
extensions = [ pkgs.vscode-extensions.catppuccin.catppuccin-vsc ]; extensions = [ pkgs.vscode-extensions.catppuccin.catppuccin-vsc ];
};
}; };
};
} }

14
nixos/common/hm-modules/nvim.nix
View File

@ -65,12 +65,14 @@ in {
comment-nvim = { enable = true; }; comment-nvim = { enable = true; };
lsp = { lsp = {
enable = true; enable = true;
servers.nil_ls.enable = true; servers = {
servers.rust-analyzer.enable = true; nil_ls.enable = true;
servers.pyright.enable = true; rust-analyzer.enable = true;
servers.elixirls.enable = true; pyright.enable = true;
servers.clangd.enable = true; elixirls.enable = true;
servers.yamlls.enable = true; clangd.enable = true;
yamlls.enable = true;
};
}; };
trouble.enable = true; trouble.enable = true;
lspkind.enable = true; lspkind.enable = true;

5
nixos/common/modules/dns.nix
View File

@ -15,7 +15,8 @@ let
ptr6Data = { hostname, realm, ip6, ... }: ''"${ip6} ${hostname}.${realm}"''; ptr6Data = { hostname, realm, ip6, ... }: ''"${ip6} ${hostname}.${realm}"'';
cfg = config.services.v.dns; cfg = config.services.v.dns;
in { in
{
options.services.v.dns = { options.services.v.dns = {
enable = mkEnableOption "v.dns"; enable = mkEnableOption "v.dns";
@ -47,7 +48,7 @@ in {
config = mkIf cfg.enable { config = mkIf cfg.enable {
networking.firewall = mkIf cfg.openFirewall { networking.firewall = mkIf cfg.openFirewall {
allowedTCPPorts = [ 53 ] ; allowedTCPPorts = [ 53 ];
allowedUDPPorts = [ 53 ]; allowedUDPPorts = [ 53 ];
}; };
services.prometheus.exporters.unbound = mkIf cfg.enableMetrics { services.prometheus.exporters.unbound = mkIf cfg.enableMetrics {

34
nixos/common/modules/gnome/default.nix
View File

@ -14,22 +14,28 @@ in {
}; };
config = mkIf cfg.enable { config = mkIf cfg.enable {
services.xserver.enable = true; services = {
services.xserver.excludePackages = [ pkgs.xterm ]; xserver = {
enable = true;
excludePackages = [ pkgs.xterm ];
# Configure keymap in X11
layout = "us";
xkbVariant = "altgr-intl";
# Enable the GNOME Desktop Environment.
displayManager.gdm.enable = true;
desktopManager.gnome.enable = true;
};
udev.packages = with pkgs; [ gnome.gnome-settings-daemon ];
dbus.enable = true;
udisks2.enable = true;
};
# Add Home-manager dconf stuff # Add Home-manager dconf stuff
home-manager.sharedModules = mkIf cfg.hm [ ./hm.nix ]; home-manager.sharedModules = mkIf cfg.hm [ ./hm.nix ];
# Configure keymap in X11
services.xserver = {
layout = "us";
xkbVariant = "altgr-intl";
};
# Enable the GNOME Desktop Environment.
services.xserver.displayManager.gdm.enable = true;
services.xserver.desktopManager.gnome.enable = true;
services.udev.packages = with pkgs; [ gnome.gnome-settings-daemon ];
environment.gnome.excludePackages = environment.gnome.excludePackages =
(with pkgs; [ gnome-photos gnome-tour gnome-connections ]) (with pkgs; [ gnome-photos gnome-tour gnome-connections ])
++ (with pkgs.gnome; [ ++ (with pkgs.gnome; [
@ -54,8 +60,6 @@ in {
# Services required for gnome # Services required for gnome
programs.dconf.enable = true; programs.dconf.enable = true;
services.dbus.enable = true;
services.udisks2.enable = true;
# Extra gnome packages # Extra gnome packages
environment.systemPackages = with pkgs; [ environment.systemPackages = with pkgs; [

17
nixos/common/modules/gnome/hm.nix
View File

@ -7,15 +7,18 @@ let
generate_custom_keybindings = binds: generate_custom_keybindings = binds:
{ {
"org/gnome/settings-daemon/plugins/media-keys" = { "org/gnome/settings-daemon/plugins/media-keys" = {
custom-keybindings = map (name: custom-keybindings = map
"/org/gnome/settings-daemon/plugins/media-keys/custom-keybindings/${name}/") (name:
"/org/gnome/settings-daemon/plugins/media-keys/custom-keybindings/${name}/")
(attrNames binds); (attrNames binds);
}; };
} // mapAttrs' (name: } // mapAttrs'
nameValuePair (name:
"org/gnome/settings-daemon/plugins/media-keys/custom-keybindings/${name}") nameValuePair
binds; "org/gnome/settings-daemon/plugins/media-keys/custom-keybindings/${name}")
in { binds;
in
{
xdg.mimeApps.enable = true; xdg.mimeApps.enable = true;
xdg.mimeApps.defaultApplications = { xdg.mimeApps.defaultApplications = {
"text/plain" = "org.gnome.TextEditor.desktop"; "text/plain" = "org.gnome.TextEditor.desktop";

6
nixos/common/modules/meta.nix
View File

@ -20,7 +20,8 @@ let
}; };
}; };
}; };
in { in
{
options.meta = { options.meta = {
exposes = mkOption { exposes = mkOption {
@ -38,6 +39,5 @@ in {
}; };
}; };
config = { config = { };
};
} }

40
nixos/common/modules/nginx.nix
View File

@ -1,30 +1,32 @@
{ lib, hosts, config, ... }: { lib, hosts, config, ... }:
with lib; with lib;
let cfg = config.services.v.nginx; let cfg = config.services.v.nginx;
in { in {
options.services.v.nginx.autoExpose = options.services.v.nginx.autoExpose =
mkEnableOption "generate vhosts"; mkEnableOption "generate vhosts";
config = let config =
let
proxy = url: { proxy = url: {
enableACME = true; enableACME = true;
forceSSL = true; forceSSL = true;
locations."/" = { locations."/" = {
proxyPass = url; proxyPass = url;
proxyWebsockets = true; proxyWebsockets = true;
};
}; };
};
hosts' = hosts' =
filter (hasAttr "exposes") (attrValues hosts.${config.networking.domain}); filter (hasAttr "exposes") (attrValues hosts.${config.networking.domain});
exposes = { ip, exposes, ... }: exposes = { ip, exposes, ... }:
map ({ domain, port ? 80}: { inherit ip domain port; }) (attrValues exposes); map ({ domain, port ? 80 }: { inherit ip domain port; }) (attrValues exposes);
mkVhost = { ip, domain, port}: { mkVhost = { ip, domain, port }: {
"${domain}" = proxy "http://${ip}:${toString port}"; "${domain}" = proxy "http://${ip}:${toString port}";
};
vhosts = foldr (el: acc: acc // mkVhost el) { } (concatMap exposes hosts');
in
mkIf cfg.autoExpose {
services.nginx.virtualHosts = vhosts;
}; };
vhosts = foldr (el: acc: acc // mkVhost el) { } (concatMap exposes hosts');
in mkIf cfg.autoExpose {
services.nginx.virtualHosts = vhosts;
};
} }

104
nixos/common/modules/unpackerr.nix
View File

@ -57,7 +57,8 @@ let
''; '';
}; };
}; };
in { in
{
options.services.unpackerr = { options.services.unpackerr = {
enable = mkEnableOption "unpackerr"; enable = mkEnableOption "unpackerr";
@ -257,61 +258,62 @@ in {
after = [ "network.target" ]; after = [ "network.target" ];
description = "unpackerr system service"; description = "unpackerr system service";
# Filter out all unset variables else unpackerr complains # Filter out all unset variables else unpackerr complains
environment = filterAttrs (_n: v: stringLength v > 0) { environment = filterAttrs (_n: v: stringLength v > 0)
# General options {
UN_DEBUG = "${toString cfg.debug}"; # General options
UN_INTERVAL = "${cfg.interval}"; UN_DEBUG = "${toString cfg.debug}";
UN_START_DELAY = "${cfg.startDelay}"; UN_INTERVAL = "${cfg.interval}";
UN_RETRY_DELAY = "${cfg.retryDelay}"; UN_START_DELAY = "${cfg.startDelay}";
UN_MAX_RETRIES = "${toString cfg.maxRetries}"; UN_RETRY_DELAY = "${cfg.retryDelay}";
UN_PARALLEL = "${toString cfg.parallel}"; UN_MAX_RETRIES = "${toString cfg.maxRetries}";
UN_FILE_MODE = "${cfg.fileMode}"; UN_PARALLEL = "${toString cfg.parallel}";
UN_DIR_MODE = "${cfg.dirMode}"; UN_FILE_MODE = "${cfg.fileMode}";
UN_DIR_MODE = "${cfg.dirMode}";
# Sonarr # Sonarr
UN_SONARR_0_URL = "${cfg.sonarr.url}"; UN_SONARR_0_URL = "${cfg.sonarr.url}";
UN_SONARR_0_API_KEY = "${cfg.sonarr.apiKey}"; UN_SONARR_0_API_KEY = "${cfg.sonarr.apiKey}";
UN_SONARR_0_PATHS_0 = "${cfg.sonarr.paths}"; UN_SONARR_0_PATHS_0 = "${cfg.sonarr.paths}";
UN_SONARR_0_PROTOCOLS = "${cfg.sonarr.protocols}"; UN_SONARR_0_PROTOCOLS = "${cfg.sonarr.protocols}";
UN_SONARR_0_TIMEOUT = "${cfg.sonarr.timeout}"; UN_SONARR_0_TIMEOUT = "${cfg.sonarr.timeout}";
UN_SONARR_0_DELETE_ORIG = "${toString cfg.sonarr.deleteOrginal}"; UN_SONARR_0_DELETE_ORIG = "${toString cfg.sonarr.deleteOrginal}";
UN_SONARR_0_DELETE_DELAY = "${cfg.sonarr.deleteDelay}"; UN_SONARR_0_DELETE_DELAY = "${cfg.sonarr.deleteDelay}";
# Radarr # Radarr
UN_RADARR_0_URL = "${cfg.radarr.url}"; UN_RADARR_0_URL = "${cfg.radarr.url}";
UN_RADARR_0_API_KEY = "${cfg.radarr.apiKey}"; UN_RADARR_0_API_KEY = "${cfg.radarr.apiKey}";
UN_RADARR_0_PATHS_0 = "${cfg.radarr.paths}"; UN_RADARR_0_PATHS_0 = "${cfg.radarr.paths}";
UN_RADARR_0_PROTOCOLS = "${cfg.radarr.protocols}"; UN_RADARR_0_PROTOCOLS = "${cfg.radarr.protocols}";
UN_RADARR_0_TIMEOUT = "${cfg.radarr.timeout}"; UN_RADARR_0_TIMEOUT = "${cfg.radarr.timeout}";
UN_RADARR_0_DELETE_ORIG = "${toString cfg.radarr.deleteOrginal}"; UN_RADARR_0_DELETE_ORIG = "${toString cfg.radarr.deleteOrginal}";
UN_RADARR_0_DELETE_DELAY = "${cfg.radarr.deleteDelay}"; UN_RADARR_0_DELETE_DELAY = "${cfg.radarr.deleteDelay}";
# Lidarr # Lidarr
UN_LIDARR_0_URL = "${cfg.lidarr.url}"; UN_LIDARR_0_URL = "${cfg.lidarr.url}";
UN_LIDARR_0_API_KEY = "${cfg.lidarr.apiKey}"; UN_LIDARR_0_API_KEY = "${cfg.lidarr.apiKey}";
UN_LIDARR_0_PATHS_0 = "${cfg.lidarr.paths}"; UN_LIDARR_0_PATHS_0 = "${cfg.lidarr.paths}";
UN_LIDARR_0_PROTOCOLS = "${cfg.lidarr.protocols}"; UN_LIDARR_0_PROTOCOLS = "${cfg.lidarr.protocols}";
UN_LIDARR_0_TIMEOUT = "${cfg.lidarr.timeout}"; UN_LIDARR_0_TIMEOUT = "${cfg.lidarr.timeout}";
UN_LIDARR_0_DELETE_ORIG = "${toString cfg.lidarr.deleteOrginal}"; UN_LIDARR_0_DELETE_ORIG = "${toString cfg.lidarr.deleteOrginal}";
UN_LIDARR_0_DELETE_DELAY = "${cfg.lidarr.deleteDelay}"; UN_LIDARR_0_DELETE_DELAY = "${cfg.lidarr.deleteDelay}";
# Readarr # Readarr
UN_READARR_0_URL = "${cfg.readarr.url}"; UN_READARR_0_URL = "${cfg.readarr.url}";
UN_READARR_0_API_KEY = "${cfg.readarr.apiKey}"; UN_READARR_0_API_KEY = "${cfg.readarr.apiKey}";
UN_READARR_0_PATHS_0 = "${cfg.readarr.paths}"; UN_READARR_0_PATHS_0 = "${cfg.readarr.paths}";
UN_READARR_0_PROTOCOLS = "${cfg.readarr.protocols}"; UN_READARR_0_PROTOCOLS = "${cfg.readarr.protocols}";
UN_READARR_0_TIMEOUT = "${cfg.readarr.timeout}"; UN_READARR_0_TIMEOUT = "${cfg.readarr.timeout}";
UN_READARR_0_DELETE_ORIG = "${toString cfg.readarr.deleteOrginal}"; UN_READARR_0_DELETE_ORIG = "${toString cfg.readarr.deleteOrginal}";
UN_READARR_0_DELETE_DELAY = "${cfg.readarr.deleteDelay}"; UN_READARR_0_DELETE_DELAY = "${cfg.readarr.deleteDelay}";
# Folder # Folder
UN_FOLDER_0_PATH = "${cfg.folder.path}"; UN_FOLDER_0_PATH = "${cfg.folder.path}";
UN_FOLDER_0_EXTRACT_PATH = "${cfg.folder.extractPath}"; UN_FOLDER_0_EXTRACT_PATH = "${cfg.folder.extractPath}";
UN_FOLDER_0_DELETE_AFTER = "${cfg.folder.deleteAfter}"; UN_FOLDER_0_DELETE_AFTER = "${cfg.folder.deleteAfter}";
UN_FOLDER_0_DELETE_ORIGINAL = "${toString cfg.folder.deleteOrginal}"; UN_FOLDER_0_DELETE_ORIGINAL = "${toString cfg.folder.deleteOrginal}";
UN_FOLDER_0_DELETE_FILES = "${toString cfg.folder.deleteFiles}"; UN_FOLDER_0_DELETE_FILES = "${toString cfg.folder.deleteFiles}";
UN_FOLDER_0_MOVE_BACK = "${toString cfg.folder.moveBack}"; UN_FOLDER_0_MOVE_BACK = "${toString cfg.folder.moveBack}";
} // cfg.extraConfig; } // cfg.extraConfig;
serviceConfig = { serviceConfig = {
User = cfg.user; User = cfg.user;
Group = cfg.group; Group = cfg.group;

17
nixos/common/modules/vault.nix
View File

@ -7,13 +7,16 @@ let
# Find all vault hosts that do not have the same IP as the current host # Find all vault hosts that do not have the same IP as the current host
vault_hosts = vault_hosts =
filter ({ tags ? [ ], ip ? "", ... }: (elem "vault" tags) && (ip != hostIP)) filter ({ tags ? [ ], ip ? "", ... }: (elem "vault" tags) && (ip != hostIP))
flat_hosts; flat_hosts;
cluster_config = concatStrings (map ({ ip, ... }: '' cluster_config = concatStrings (map
retry_join { ({ ip, ... }: ''
leader_api_addr = "http://${ip}:${toString cfg.port}" retry_join {
} leader_api_addr = "http://${ip}:${toString cfg.port}"
'') vault_hosts); }
in { '')
vault_hosts);
in
{
options.services.v.vault = { options.services.v.vault = {
enable = mkEnableOption "v's vault"; enable = mkEnableOption "v's vault";

28
nixos/common/users/victor.nix
View File

@ -23,23 +23,27 @@
}; };
home-manager.users.victor = { home-manager.users.victor = {
programs.home-manager.enable = true; programs = {
home-manager.enable = true;
home.username = "victor"; v.nvim.enable = true;
home.homeDirectory = "/home/victor"; v.git.enable = true;
home.stateVersion = "23.05";
programs.v.nvim.enable = true; tmux = {
programs.v.git.enable = true; enable = true;
shortcut = "b";
terminal = "screen-256color";
clock24 = true;
};
programs.tmux = { bat.enable = true;
enable = true;
shortcut = "b";
terminal = "screen-256color";
clock24 = true;
}; };
home = {
programs.bat.enable = true; username = "victor";
homeDirectory = "/home/victor";
stateVersion = "23.05";
};
}; };
} }

3
nixos/hosts/hades/immich/configuration.nix
View File

@ -7,7 +7,8 @@ let
# https://github.com/immich-app/immich/releases # https://github.com/immich-app/immich/releases
# version = "1.55.1"; # version = "1.55.1";
dataDir = "/var/lib/immich"; dataDir = "/var/lib/immich";
in { in
{
imports = [ ]; imports = [ ];
# This value determines the NixOS release from which the default # This value determines the NixOS release from which the default

11
nixos/hosts/hades/lucy/configuration.nix
View File

@ -24,7 +24,8 @@ let
doCheck = false; doCheck = false;
}; };
in { in
{
imports = [ ./hardware-configuration.nix ]; imports = [ ./hardware-configuration.nix ];
# This value determines the NixOS release from which the default # This value determines the NixOS release from which the default
@ -46,10 +47,12 @@ in {
trivy trivy
wapiti wapiti
]; ];
boot.loader = {
boot.loader.systemd-boot.enable = true; systemd-boot.enable = true;
boot.loader.efi.canTouchEfiVariables = true; efi.canTouchEfiVariables = true;
boot.loader.efi.efiSysMountPoint = "/boot"; efi.efiSysMountPoint = "/boot";
};
virtualisation.docker.enable = true; virtualisation.docker.enable = true;

26
nixos/hosts/hades/lucy/hardware-configuration.nix
View File

@ -5,19 +5,21 @@
{ {
imports = [ (modulesPath + "/profiles/qemu-guest.nix") ]; imports = [ (modulesPath + "/profiles/qemu-guest.nix") ];
boot = {
boot.initrd.availableKernelModules = [ initrd.availableKernelModules = [
"uhci_hcd" "uhci_hcd"
"ehci_pci" "ehci_pci"
"ahci" "ahci"
"virtio_pci" "virtio_pci"
"virtio_scsi" "virtio_scsi"
"sd_mod" "sd_mod"
"sr_mod" "sr_mod"
]; ];
boot.initrd.kernelModules = [ ]; initrd.kernelModules = [ ];
boot.kernelModules = [ ]; kernelModules = [ ];
boot.extraModulePackages = [ ]; extraModulePackages = [ ];
};
fileSystems."/" = { fileSystems."/" = {
device = "/dev/disk/by-uuid/749c02fd-209d-4974-917e-38b749d10ec2"; device = "/dev/disk/by-uuid/749c02fd-209d-4974-917e-38b749d10ec2";

8
nixos/hosts/hades/mastodon/configuration.nix
View File

@ -2,7 +2,8 @@
let let
vs = config.vault-secrets.secrets; vs = config.vault-secrets.secrets;
cfg = config.services.mastodon; cfg = config.services.mastodon;
in { in
{
system.stateVersion = "21.05"; system.stateVersion = "21.05";
# Use DHCP with static leases # Use DHCP with static leases
networking.interfaces.eth0.useDHCP = true; networking.interfaces.eth0.useDHCP = true;
@ -100,6 +101,7 @@ in {
}; };
}; };
networking.firewall = let cfg = config.services.mastodon; networking.firewall =
in { allowedTCPPorts = [ cfg.streamingPort cfg.webPort ]; }; let cfg = config.services.mastodon;
in { allowedTCPPorts = [ cfg.streamingPort cfg.webPort ]; };
} }

223
nixos/hosts/hades/nginx/configuration.nix
View File

@ -12,7 +12,8 @@ let
proxyWebsockets = true; proxyWebsockets = true;
}; };
}; };
in { in
{
imports = [ ]; imports = [ ];
nixpkgs.config.permittedInsecurePackages = [ "openssl-1.1.1t" ]; nixpkgs.config.permittedInsecurePackages = [ "openssl-1.1.1t" ];
@ -25,10 +26,12 @@ in {
# (e.g. man configuration.nix or on https://nixos.org/nixos/options.html). # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
system.stateVersion = "23.05"; # Did you read the comment? system.stateVersion = "23.05"; # Did you read the comment?
networking.firewall.allowedTCPPorts = [ 80 443 ]; networking.firewall.allowedTCPPorts = [ 80 443 ];
security.acme = {
security.acme.defaults.email = "victorheld12@gmail.com"; defaults.email = "victorheld12@gmail.com";
security.acme.acceptTerms = true; acceptTerms = true;
security.acme.preliminarySelfsigned = true; preliminarySelfsigned = true;
};
services.nginx = { services.nginx = {
enable = true; enable = true;
@ -39,38 +42,39 @@ in {
clientMaxBodySize = "1024m"; clientMaxBodySize = "1024m";
package = pkgs.nginxMainline; package = pkgs.nginxMainline;
virtualHosts = {
virtualHosts."cshub.nl" = proxy "http://192.168.0.113"; "cshub.nl" = proxy "http://192.168.0.113";
virtualHosts."api.cshub.nl" = proxy "http://192.168.0.113"; "api.cshub.nl" = proxy "http://192.168.0.113";
virtualHosts."ha.xirion.net" = proxy "http://192.168.0.129:8123"; "ha.xirion.net" = proxy "http://192.168.0.129:8123";
virtualHosts."xirion.net" = { "xirion.net" = {
enableACME = true; enableACME = true;
forceSSL = true; forceSSL = true;
locations."/".extraConfig = '' locations."/".extraConfig = ''
add_header Content-Type 'text/html; charset=UTF-8'; add_header Content-Type 'text/html; charset=UTF-8';
return 200 'Hello, World!'; return 200 'Hello, World!';
''; '';
locations."= /.well-known/host-meta".extraConfig = '' locations."= /.well-known/host-meta".extraConfig = ''
return 301 https://fedi.xirion.net$request_uri; return 301 https://fedi.xirion.net$request_uri;
''; '';
}; };
# virtualHosts."blog.xirion.net" = proxy "http://10.10.10.12"; # virtualHosts."blog.xirion.net" = proxy "http://10.10.10.12";
virtualHosts."git.xirion.net" = proxy "http://10.10.10.12"; "git.xirion.net" = proxy "http://10.10.10.12";
# virtualHosts."mail.xirion.net" = proxy "http://192.168.0.118"; # virtualHosts."mail.xirion.net" = proxy "http://192.168.0.118";
virtualHosts."o.xirion.net" = proxy "http://192.168.0.112:9000"; "o.xirion.net" = proxy "http://192.168.0.112:9000";
virtualHosts."g.xirion.net" = proxy "http://garage.hades:3900"; "g.xirion.net" = proxy "http://garage.hades:3900";
virtualHosts."requests.xirion.net" = proxy "http://overseerr.hades:5055"; "requests.xirion.net" = proxy "http://overseerr.hades:5055";
virtualHosts."pass.xirion.net" = proxy "http://bitwarden_rs"; "pass.xirion.net" = proxy "http://bitwarden_rs";
virtualHosts."repo.xirion.net" = proxy "http://archlinux"; "repo.xirion.net" = proxy "http://archlinux";
virtualHosts."thelounge.xirion.net" = proxy "http://thelounge:9000"; "thelounge.xirion.net" = proxy "http://thelounge:9000";
virtualHosts."attic.xirion.net" = proxy "http://attic.hades:8080"; "attic.xirion.net" = proxy "http://attic.hades:8080";
virtualHosts."tautulli.xirion.net" = proxy "http://tautulli.hades:8080"; "tautulli.xirion.net" = proxy "http://tautulli.hades:8080";
virtualHosts."peepeepoopoo.xirion.net" = proxy "http://tautulli.hades:8080"; # Deprecated but Ricardo has it bookmarked already! "peepeepoopoo.xirion.net" = proxy "http://tautulli.hades:8080"; # Deprecated but Ricardo has it bookmarked already!
virtualHosts."registry.xirion.net" = proxy "http://docker-registry:5000" "registry.xirion.net" = proxy "http://docker-registry:5000"
// { // {
locations."/".extraConfig = '' locations."/".extraConfig = ''
allow 127.0.0.1; allow 127.0.0.1;
allow 10.42.42.0/23; allow 10.42.42.0/23;
@ -83,91 +87,94 @@ in {
''; '';
}; };
virtualHosts."plex.xirion.net" = { "plex.xirion.net" = {
# Since we want a secure connection, we force SSL # Since we want a secure connection, we force SSL
forceSSL = true; forceSSL = true;
enableACME = true; enableACME = true;
extraConfig = '' extraConfig = ''
#Some players don't reopen a socket and playback stops totally instead of resuming after an extended pause #Some players don't reopen a socket and playback stops totally instead of resuming after an extended pause
send_timeout 100m; send_timeout 100m;
# Why this is important: https://blog.cloudflare.com/ocsp-stapling-how-cloudflare-just-made-ssl-30/ # Why this is important: https://blog.cloudflare.com/ocsp-stapling-how-cloudflare-just-made-ssl-30/
ssl_stapling on; ssl_stapling on;
ssl_stapling_verify on; ssl_stapling_verify on;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2; ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_prefer_server_ciphers on; ssl_prefer_server_ciphers on;
#Intentionally not hardened for security for player support and encryption video streams has a lot of overhead with something like AES-256-GCM-SHA384. #Intentionally not hardened for security for player support and encryption video streams has a lot of overhead with something like AES-256-GCM-SHA384.
ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:ECDHE-RSA-DES-CBC3-SHA:ECDHE-ECDSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA'; ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:ECDHE-RSA-DES-CBC3-SHA:ECDHE-ECDSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA';
# Forward real ip and host to Plex # Forward real ip and host to Plex
proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme; proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header Host $server_addr; proxy_set_header Host $server_addr;
proxy_set_header Referer $server_addr; proxy_set_header Referer $server_addr;
proxy_set_header Origin $server_addr; proxy_set_header Origin $server_addr;
# Nginx default client_max_body_size is 1MB, which breaks Camera Upload feature from the phones. # Nginx default client_max_body_size is 1MB, which breaks Camera Upload feature from the phones.
# Increasing the limit fixes the issue. Anyhow, if 4K videos are expected to be uploaded, the size might need to be increased even more # Increasing the limit fixes the issue. Anyhow, if 4K videos are expected to be uploaded, the size might need to be increased even more
client_max_body_size 100M; client_max_body_size 100M;
# Plex headers # Plex headers
proxy_set_header X-Plex-Client-Identifier $http_x_plex_client_identifier; proxy_set_header X-Plex-Client-Identifier $http_x_plex_client_identifier;
proxy_set_header X-Plex-Device $http_x_plex_device; proxy_set_header X-Plex-Device $http_x_plex_device;
proxy_set_header X-Plex-Device-Name $http_x_plex_device_name; proxy_set_header X-Plex-Device-Name $http_x_plex_device_name;
proxy_set_header X-Plex-Platform $http_x_plex_platform; proxy_set_header X-Plex-Platform $http_x_plex_platform;
proxy_set_header X-Plex-Platform-Version $http_x_plex_platform_version; proxy_set_header X-Plex-Platform-Version $http_x_plex_platform_version;
proxy_set_header X-Plex-Product $http_x_plex_product; proxy_set_header X-Plex-Product $http_x_plex_product;
proxy_set_header X-Plex-Token $http_x_plex_token; proxy_set_header X-Plex-Token $http_x_plex_token;
proxy_set_header X-Plex-Version $http_x_plex_version; proxy_set_header X-Plex-Version $http_x_plex_version;
proxy_set_header X-Plex-Nocache $http_x_plex_nocache; proxy_set_header X-Plex-Nocache $http_x_plex_nocache;
proxy_set_header X-Plex-Provides $http_x_plex_provides; proxy_set_header X-Plex-Provides $http_x_plex_provides;
proxy_set_header X-Plex-Device-Vendor $http_x_plex_device_vendor; proxy_set_header X-Plex-Device-Vendor $http_x_plex_device_vendor;
proxy_set_header X-Plex-Model $http_x_plex_model; proxy_set_header X-Plex-Model $http_x_plex_model;
# Buffering off send to the client as soon as the data is received from Plex. # Buffering off send to the client as soon as the data is received from Plex.
proxy_redirect off; proxy_redirect off;
proxy_buffering off; proxy_buffering off;
''; '';
locations."/" = { locations."/" = {
proxyWebsockets = true; proxyWebsockets = true;
proxyPass = "http://plex2.hades:32400/"; proxyPass = "http://plex2.hades:32400/";
};
}; };
"fedi.xirion.net" = {
enableACME = true;
forceSSL = true;
root = "${pkgs.v.glitch-soc}/public/";
locations = {
"/".tryFiles = "$uri @proxy";
# location ~ ^/(emoji|packs|system/accounts/avatars|system/media_attachments/files) {
# add_header Cache-Control "public, max-age=31536000, immutable";
# add_header Strict-Transport-Security "max-age=31536000";
# try_files $uri @proxy;
# }
# location /sw.js {
# add_header Cache-Control "public, max-age=0";
# add_header Strict-Transport-Security "max-age=31536000";
# try_files $uri @proxy;
# }
"@proxy" = {
proxyPass = "http://192.168.0.138:55001";
proxyWebsockets = true;
};
"/api/v1/streaming" = {
proxyPass = "http://192.168.0.138:55000";
proxyWebsockets = true;
};
};
};
"fedi-media.xirion.net" = proxy "http://garage.hades:3902";
}; };
virtualHosts."fedi.xirion.net" = {
enableACME = true;
forceSSL = true;
root = "${pkgs.v.glitch-soc}/public/";
locations."/".tryFiles = "$uri @proxy";
# location ~ ^/(emoji|packs|system/accounts/avatars|system/media_attachments/files) {
# add_header Cache-Control "public, max-age=31536000, immutable";
# add_header Strict-Transport-Security "max-age=31536000";
# try_files $uri @proxy;
# }
# location /sw.js {
# add_header Cache-Control "public, max-age=0";
# add_header Strict-Transport-Security "max-age=31536000";
# try_files $uri @proxy;
# }
locations."@proxy" = {
proxyPass = "http://192.168.0.138:55001";
proxyWebsockets = true;
};
locations."/api/v1/streaming" = {
proxyPass = "http://192.168.0.138:55000";
proxyWebsockets = true;
};
};
virtualHosts."fedi-media.xirion.net" = proxy "http://garage.hades:3902";
}; };
} }

3
nixos/hosts/hades/pmm/configuration.nix
View File

@ -14,7 +14,8 @@ let
-v "/etc/pmm/TVShows.yml:/config/TVShows.yml:ro" \ -v "/etc/pmm/TVShows.yml:/config/TVShows.yml:ro" \
${container} --run ${container} --run
''; '';
in { in
{
imports = [ ]; imports = [ ];
# This value determines the NixOS release from which the default # This value determines the NixOS release from which the default

44
nixos/hosts/hades/rtorrent/configuration.nix
View File

@ -21,27 +21,29 @@ in {
vault-secrets.secrets.rtorrent = { services = [ "wg-quick-wg0" ]; }; vault-secrets.secrets.rtorrent = { services = [ "wg-quick-wg0" ]; };
# Mullvad VPN # Mullvad VPN
networking.wg-quick.interfaces = let networking.wg-quick.interfaces =
postUpScript = pkgs.writeScriptBin "post_up" '' let
#!${pkgs.stdenv.shell} postUpScript = pkgs.writeScriptBin "post_up" ''
${pkgs.iproute2}/bin/ip route add 10.42.42.0/23 via 192.168.0.1 #!${pkgs.stdenv.shell}
${pkgs.iproute2}/bin/ip route add 10.100.0.0/24 via 192.168.0.1 ${pkgs.iproute2}/bin/ip route add 10.42.42.0/23 via 192.168.0.1
''; ${pkgs.iproute2}/bin/ip route add 10.100.0.0/24 via 192.168.0.1
in { '';
wg0 = { in
address = [ "10.66.153.191/32" "fc00:bbbb:bbbb:bb01::3:99be/128" ]; {
dns = [ "10.64.0.1" ]; wg0 = {
privateKeyFile = "${vs.rtorrent}/wireguardKey"; address = [ "10.66.153.191/32" "fc00:bbbb:bbbb:bb01::3:99be/128" ];
postUp = "${postUpScript}/bin/post_up || true"; dns = [ "10.64.0.1" ];
privateKeyFile = "${vs.rtorrent}/wireguardKey";
postUp = "${postUpScript}/bin/post_up || true";
peers = [ peers = [
{ {
publicKey = "HQHCrq4J6bSpdW1fI5hR/bvcrYa6HgGgwaa5ZY749ik="; publicKey = "HQHCrq4J6bSpdW1fI5hR/bvcrYa6HgGgwaa5ZY749ik=";
allowedIPs = [ "0.0.0.0/0" "::/0"]; allowedIPs = [ "0.0.0.0/0" "::/0" ];
endpoint = "185.213.155.73:51820"; endpoint = "185.213.155.73:51820";
# persistentKeepalive = 25; # persistentKeepalive = 25;
} }
]; ];
};
}; };
};
} }

165
nixos/hosts/hades/rtorrent/rtorrent.nix
View File

@ -4,112 +4,113 @@
port = 54945; # Port Forwarded in mullvad port = 54945; # Port Forwarded in mullvad
downloadDir = "/mnt/storage/torrents/r"; downloadDir = "/mnt/storage/torrents/r";
package = pkgs.jesec-rtorrent; package = pkgs.jesec-rtorrent;
configText = let cfg = config.services.rtorrent; configText =
in pkgs.lib.mkForce '' let cfg = config.services.rtorrent;
# rTorrent runtime directory (cfg.basedir) [default: "$HOME/.local/share/rtorrent"] in pkgs.lib.mkForce ''
method.insert = cfg.basedir, private|const|string, (cat,"${cfg.dataDir}/") # rTorrent runtime directory (cfg.basedir) [default: "$HOME/.local/share/rtorrent"]
method.insert = cfg.basedir, private|const|string, (cat,"${cfg.dataDir}/")
# Default download directory (cfg.download) [default: "$(cfg.basedir)/download"] # Default download directory (cfg.download) [default: "$(cfg.basedir)/download"]
method.insert = cfg.download, private|const|string, (cat,"${cfg.downloadDir}") method.insert = cfg.download, private|const|string, (cat,"${cfg.downloadDir}")
# RPC Socket # RPC Socket
method.insert = cfg.rpcsock, private|const|string, (cat,"${cfg.rpcSocket}") method.insert = cfg.rpcsock, private|const|string, (cat,"${cfg.rpcSocket}")
# Log directory (cfg.logs) [default: "$(cfg.basedir)/log"] # Log directory (cfg.logs) [default: "$(cfg.basedir)/log"]
method.insert = cfg.logs, private|const|string, (cat,(cfg.basedir),"log/") method.insert = cfg.logs, private|const|string, (cat,(cfg.basedir),"log/")
method.insert = cfg.logfile, private|const|string, (cat,(cfg.logs),"rtorrent-",(system.time),".log") method.insert = cfg.logfile, private|const|string, (cat,(cfg.logs),"rtorrent-",(system.time),".log")
# Torrent session directory (cfg.session) [default: "$(cfg.basedir)/.session"] # Torrent session directory (cfg.session) [default: "$(cfg.basedir)/.session"]
method.insert = cfg.session, private|const|string, (cat,(cfg.basedir),".session/") method.insert = cfg.session, private|const|string, (cat,(cfg.basedir),".session/")
# Watch (drop to add) directories (cfg.watch) [default: "$(cfg.basedir)/watch"] # Watch (drop to add) directories (cfg.watch) [default: "$(cfg.basedir)/watch"]
method.insert = cfg.watch, private|const|string, (cat,(cfg.basedir),"watch/") method.insert = cfg.watch, private|const|string, (cat,(cfg.basedir),"watch/")
# Create directories # Create directories
fs.mkdir.recursive = (cat,(cfg.basedir)) fs.mkdir.recursive = (cat,(cfg.basedir))
fs.mkdir = (cat,(cfg.download)) fs.mkdir = (cat,(cfg.download))
fs.mkdir = (cat,(cfg.logs)) fs.mkdir = (cat,(cfg.logs))
fs.mkdir = (cat,(cfg.session)) fs.mkdir = (cat,(cfg.session))
fs.mkdir = (cat,(cfg.watch)) fs.mkdir = (cat,(cfg.watch))
fs.mkdir = (cat,(cfg.watch),"/load") fs.mkdir = (cat,(cfg.watch),"/load")
fs.mkdir = (cat,(cfg.watch),"/start") fs.mkdir = (cat,(cfg.watch),"/start")
# Drop to "$(cfg.watch)/load" to add torrent # Drop to "$(cfg.watch)/load" to add torrent
schedule2 = watch_load, 11, 10, ((load.verbose, (cat, (cfg.watch), "load/*.torrent"))) schedule2 = watch_load, 11, 10, ((load.verbose, (cat, (cfg.watch), "load/*.torrent")))
# Drop to "$(cfg.watch)/start" to add torrent and start downloading # Drop to "$(cfg.watch)/start" to add torrent and start downloading
schedule2 = watch_start, 10, 10, ((load.start_verbose, (cat, (cfg.watch), "start/*.torrent"))) schedule2 = watch_start, 10, 10, ((load.start_verbose, (cat, (cfg.watch), "start/*.torrent")))
# Listening port for incoming peer traffic # Listening port for incoming peer traffic
network.port_range.set = ${toString cfg.port}-${toString cfg.port} network.port_range.set = ${toString cfg.port}-${toString cfg.port}
network.port_random.set = no network.port_random.set = no
# Distributed Hash Table and Peer EXchange # Distributed Hash Table and Peer EXchange
dht.mode.set = disable dht.mode.set = disable
dht.port.set = 6881 dht.port.set = 6881
protocol.pex.set = yes protocol.pex.set = yes
# UDP tracker support # UDP tracker support
trackers.use_udp.set = yes trackers.use_udp.set = yes
# Peer settings # Peer settings
throttle.max_uploads.set = 100 throttle.max_uploads.set = 100
throttle.max_uploads.global.set = 250 throttle.max_uploads.global.set = 250
throttle.min_peers.normal.set = 20 throttle.min_peers.normal.set = 20
throttle.max_peers.normal.set = 60 throttle.max_peers.normal.set = 60
throttle.min_peers.seed.set = 30 throttle.min_peers.seed.set = 30
throttle.max_peers.seed.set = 80 throttle.max_peers.seed.set = 80
trackers.numwant.set = 80 trackers.numwant.set = 80
protocol.encryption.set = allow_incoming,try_outgoing,enable_retry protocol.encryption.set = allow_incoming,try_outgoing,enable_retry
# Limits for file handle resources, this is optimized for # Limits for file handle resources, this is optimized for
# an `ulimit` of 1024 (a common default). You MUST leave # an `ulimit` of 1024 (a common default). You MUST leave
# a ceiling of handles reserved for rTorrent's internal needs! # a ceiling of handles reserved for rTorrent's internal needs!
network.max_open_files.set = 600 network.max_open_files.set = 600
network.max_open_sockets.set = 300 network.max_open_sockets.set = 300
# Memory resource usage (increase if you have a large number of items loaded, # Memory resource usage (increase if you have a large number of items loaded,
# and/or the available resources to spend) # and/or the available resources to spend)
pieces.memory.max.set = 1800M pieces.memory.max.set = 1800M
network.xmlrpc.size_limit.set = 32M network.xmlrpc.size_limit.set = 32M
# Basic operational settings # Basic operational settings
session.path.set = (cat, (cfg.session)) session.path.set = (cat, (cfg.session))
directory.default.set = (cat, (cfg.download)) directory.default.set = (cat, (cfg.download))
log.execute = (cat, (cfg.logs), "execute.log") log.execute = (cat, (cfg.logs), "execute.log")
# Other operational settings # Other operational settings
encoding.add = utf8 encoding.add = utf8
system.umask.set = 0027 system.umask.set = 0027
system.cwd.set = (directory.default) system.cwd.set = (directory.default)
#schedule2 = low_diskspace, 5, 60, ((close_low_diskspace, 500M)) #schedule2 = low_diskspace, 5, 60, ((close_low_diskspace, 500M))
#pieces.hash.on_completion.set = no #pieces.hash.on_completion.set = no
# HTTP and SSL # HTTP and SSL
network.http.max_open.set = 50 network.http.max_open.set = 50
network.http.dns_cache_timeout.set = 25 network.http.dns_cache_timeout.set = 25
#network.http.ssl_verify_peer.set = 1 #network.http.ssl_verify_peer.set = 1
#network.http.ssl_verify_host.set = 1 #network.http.ssl_verify_host.set = 1
# Run the rTorrent process as a daemon in the background # Run the rTorrent process as a daemon in the background
system.daemon.set = true system.daemon.set = true
# XML-RPC interface # XML-RPC interface
network.scgi.open_local = (cat,(cfg.rpcsock)) network.scgi.open_local = (cat,(cfg.rpcsock))
schedule = scgi_group,0,0,"execute.nothrow=chown,\":rtorrent\",(cfg.rpcsock)" schedule = scgi_group,0,0,"execute.nothrow=chown,\":rtorrent\",(cfg.rpcsock)"
schedule = scgi_permission,0,0,"execute.nothrow=chmod,\"g+w,o=\",(cfg.rpcsock)" schedule = scgi_permission,0,0,"execute.nothrow=chmod,\"g+w,o=\",(cfg.rpcsock)"
# Logging: # Logging:
# Levels = critical error warn notice info debug # Levels = critical error warn notice info debug
# Groups = connection_* dht_* peer_* rpc_* storage_* thread_* tracker_* torrent_* # Groups = connection_* dht_* peer_* rpc_* storage_* thread_* tracker_* torrent_*
print = (cat, "Logging to ", (cfg.logfile)) print = (cat, "Logging to ", (cfg.logfile))
log.open_file = "log", (cfg.logfile) log.open_file = "log", (cfg.logfile)
log.add_output = "debug", "log" log.add_output = "debug", "log"
''; '';
}; };
} }

2
nixos/hosts/hades/unifi/configuration.nix
View File

@ -1,4 +1,4 @@
{ pkgs, lib, pkgs_stable,... }: { { pkgs, lib, pkgs_stable, ... }: {
system.stateVersion = "21.05"; system.stateVersion = "21.05";
networking.interfaces.eth0.useDHCP = true; networking.interfaces.eth0.useDHCP = true;

3
nixos/hosts/olympus/bastion/configuration.nix
View File

@ -17,7 +17,8 @@ let
done done
fi fi
''; '';
in { in
{
imports = [ imports = [
# Include the results of the hardware scan. # Include the results of the hardware scan.
./hardware-configuration.nix ./hardware-configuration.nix

12
nixos/hosts/olympus/bastion/hardware-configuration.nix
View File

@ -5,12 +5,14 @@
{ {
imports = [ (modulesPath + "/profiles/qemu-guest.nix") ]; imports = [ (modulesPath + "/profiles/qemu-guest.nix") ];
boot = {
boot.initrd.availableKernelModules = initrd.availableKernelModules =
[ "ata_piix" "uhci_hcd" "virtio_pci" "virtio_scsi" "sd_mod" "sr_mod" ]; [ "ata_piix" "uhci_hcd" "virtio_pci" "virtio_scsi" "sd_mod" "sr_mod" ];
boot.initrd.kernelModules = [ ]; initrd.kernelModules = [ ];
boot.kernelModules = [ ]; kernelModules = [ ];
boot.extraModulePackages = [ ]; extraModulePackages = [ ];
};
fileSystems."/" = { fileSystems."/" = {
device = "/dev/disk/by-uuid/e8427097-8545-4924-b033-2659fcf9adca"; device = "/dev/disk/by-uuid/e8427097-8545-4924-b033-2659fcf9adca";

3
nixos/hosts/olympus/dex/configuration.nix
View File

@ -9,7 +9,8 @@ let
db_name = "dex"; db_name = "dex";
inherit (config.meta.exposes.dex) port; inherit (config.meta.exposes.dex) port;
metricsPort = 5558; metricsPort = 5558;
in { in
{
imports = [ ]; imports = [ ];
# This value determines the NixOS release from which the default # This value determines the NixOS release from which the default

5
nixos/hosts/olympus/dhcp/configuration.nix
View File

@ -9,8 +9,9 @@ let
localDomain = config.networking.domain; localDomain = config.networking.domain;
hosts = hosts =
filter (h: hasAttr "ip" h && hasAttr "mac" h && h.realm == localDomain) filter (h: hasAttr "ip" h && hasAttr "mac" h && h.realm == localDomain)
flat_hosts; flat_hosts;
in { in
{
networking = { networking = {
defaultGateway = "10.42.42.1"; defaultGateway = "10.42.42.1";
nameservers = [ "10.42.42.15" "10.42.42.16" ]; nameservers = [ "10.42.42.15" "10.42.42.16" ];

12
nixos/hosts/olympus/eevee/hardware-configuration.nix
View File

@ -5,12 +5,14 @@
{ {
imports = [ (modulesPath + "/installer/scan/not-detected.nix") ]; imports = [ (modulesPath + "/installer/scan/not-detected.nix") ];
boot = {
boot.initrd.availableKernelModules = initrd.availableKernelModules =
[ "xhci_pci" "ahci" "nvme" "usbhid" "usb_storage" "sd_mod" ]; [ "xhci_pci" "ahci" "nvme" "usbhid" "usb_storage" "sd_mod" ];
boot.initrd.kernelModules = [ ]; initrd.kernelModules = [ ];
boot.kernelModules = [ "kvm-intel" ]; kernelModules = [ "kvm-intel" ];
boot.extraModulePackages = [ ]; extraModulePackages = [ ];
};
fileSystems."/" = { fileSystems."/" = {
device = "/dev/disk/by-uuid/947a98af-9a4e-4811-a2ca-9aa00b319e9c"; device = "/dev/disk/by-uuid/947a98af-9a4e-4811-a2ca-9aa00b319e9c";

62
nixos/hosts/olympus/eevee/hardware.nix
View File

@ -1,42 +1,46 @@
{ pkgs, config, ... }: { { pkgs, config, ... }: {
hardware.enableAllFirmware = true; hardware = {
enableAllFirmware = true;
nvidia = {
package = config.boot.kernelPackages.nvidiaPackages.stable;
services.hardware.bolt.enable = true; # Open drivers cause gdm to crash
# open = true;
services.xserver.videoDrivers = [ "nvidia" ]; # nvidia-drm.modeset=1
hardware.nvidia = { modesetting.enable = true;
package = config.boot.kernelPackages.nvidiaPackages.stable; };
# Open drivers cause gdm to crash # Hardware acceleration
# open = true; opengl = {
enable = true;
# nvidia-drm.modeset=1 # Vulkan
modesetting.enable = true; driSupport = true;
};
logitech.wireless = {
enable = true;
enableGraphical = true;
};
}; };
services = {
# Hardware acceleration hardware.bolt.enable = true;
hardware.opengl = {
enable = true;
# Vulkan xserver.videoDrivers = [ "nvidia" ];
driSupport = true;
# udev
udev.packages = with pkgs; [
android-udev-rules
logitech-udev-rules
wooting-udev-rules
];
# SSD Trim
fstrim.enable = true;
}; };
hardware.logitech.wireless = {
enable = true;
enableGraphical = true;
};
# udev
services.udev.packages = with pkgs; [
android-udev-rules
logitech-udev-rules
wooting-udev-rules
];
# FS # FS
fileSystems."/".options = [ "compress=zstd" ]; fileSystems."/".options = [ "compress=zstd" ];
# SSD Trim
services.fstrim.enable = true;
} }

127
nixos/hosts/olympus/gitea/configuration.nix
View File

@ -6,7 +6,8 @@
let let
vs = config.vault-secrets.secrets; vs = config.vault-secrets.secrets;
inherit (config.meta.exposes.git) port; inherit (config.meta.exposes.git) port;
in { in
{
imports = [ ]; imports = [ ];
# This value determines the NixOS release from which the default # This value determines the NixOS release from which the default
@ -23,12 +24,71 @@ in {
environment.noXlibs = lib.mkForce false; environment.noXlibs = lib.mkForce false;
networking.firewall.allowedTCPPorts = [ port ]; networking.firewall.allowedTCPPorts = [ port ];
services = {
services.openssh.startWhenNeeded = false; openssh.startWhenNeeded = false;
services.fail2ban = { fail2ban = {
enable = true; enable = true;
maxretry = 3; maxretry = 3;
};
gitea = {
enable = true;
package = pkgs.forgejo;
lfs.enable = true;
dump.type = "tar.gz";
database.type = "postgres";
mailerPasswordFile = "${vs.gitea}/mailPassword";
settings = {
default.WORK_PATH = "/var/lib/gitea";
actions = { "ENABLED" = true; };
repository = {
"ENABLE_PUSH_CREATE_USER" = true;
"DEFAULT_PUSH_CREATE_PRIVATE" = false;
};
service = {
"DEFAULT_KEEP_EMAIL_PRIVATE" = true;
"DISABLE_REGISTRATION" = true;
};
indexer = {
"REPO_INDEXER_ENABLED" = true;
"REPO_INDEXER_PATH" = "indexers/repos.bleve";
"MAX_FILE_SIZE" = 1048576;
"REPO_INDEXER_EXCLUDE" = "node_modules/**";
};
ui = {
"THEMES" = "forgejo-auto,forgejo-light,forgejo-dark,auto,gitea,arc-green,agatheme";
"DEFAULT_THEME" = "forgejo-auto";
"USE_SERVICE_WORKER" = true;
};
server = {
LANDING_PAGE = "explore";
SSH_PORT = 42;
DOMAIN = "git.0x76.dev";
ROOT_URL = "https://git.0x76.dev";
HTTP_PORT = port;
};
session = {
"PROVIDER" = "db";
"COOKIE_SECURE" = true;
};
mailer = {
"ENABLED" = true;
# "IS_TLS_ENABLED" = true;
# "HOST" = "mail.0x76.dev:465";
"FROM" = "gitea@0x76.dev";
# "MAILER_TYPE" = "smtp";
"USER" = "gitea@0x76.dev";
# Below is prep for 1.18
"PROTOCOL" = "smtps";
"SMTP_ADDR" = "mail.0x76.dev";
"SMTP_PORT" = 465;
};
};
};
}; };
vault-secrets.secrets.gitea = { vault-secrets.secrets.gitea = {
@ -42,61 +102,4 @@ in {
mkdir -p ${target_dir} mkdir -p ${target_dir}
ln -sf ${pkgs.v.gitea-agatheme} "${target_dir}/theme-agatheme.css" ln -sf ${pkgs.v.gitea-agatheme} "${target_dir}/theme-agatheme.css"
''; '';
services.gitea = {
enable = true;
package = pkgs.forgejo;
lfs.enable = true;
dump.type = "tar.gz";
database.type = "postgres";
mailerPasswordFile = "${vs.gitea}/mailPassword";
settings = {
default.WORK_PATH = "/var/lib/gitea";
actions = { "ENABLED" = true; };
repository = {
"ENABLE_PUSH_CREATE_USER" = true;
"DEFAULT_PUSH_CREATE_PRIVATE" = false;
};
service = {
"DEFAULT_KEEP_EMAIL_PRIVATE" = true;
"DISABLE_REGISTRATION" = true;
};
indexer = {
"REPO_INDEXER_ENABLED" = true;
"REPO_INDEXER_PATH" = "indexers/repos.bleve";
"MAX_FILE_SIZE" = 1048576;
"REPO_INDEXER_EXCLUDE" = "node_modules/**";
};
ui = {
"THEMES" = "forgejo-auto,forgejo-light,forgejo-dark,auto,gitea,arc-green,agatheme";
"DEFAULT_THEME" = "forgejo-auto";
"USE_SERVICE_WORKER" = true;
};
server = {
LANDING_PAGE = "explore";
SSH_PORT = 42;
DOMAIN = "git.0x76.dev";
ROOT_URL = "https://git.0x76.dev";
HTTP_PORT = port;
};
session = {
"PROVIDER" = "db";
"COOKIE_SECURE" = true;
};
mailer = {
"ENABLED" = true;
# "IS_TLS_ENABLED" = true;
# "HOST" = "mail.0x76.dev:465";
"FROM" = "gitea@0x76.dev";
# "MAILER_TYPE" = "smtp";
"USER" = "gitea@0x76.dev";
# Below is prep for 1.18
"PROTOCOL" = "smtps";
"SMTP_ADDR" = "mail.0x76.dev";
"SMTP_PORT" = 465;
};
};
};
} }

30
nixos/hosts/olympus/hedgedoc/configuration.nix
View File

@ -8,7 +8,8 @@ let
db_user = "hedgedoc"; db_user = "hedgedoc";
inherit (config.meta.exposes.md) port; inherit (config.meta.exposes.md) port;
vs = config.vault-secrets.secrets; vs = config.vault-secrets.secrets;
in { in
{
imports = [ ]; imports = [ ];
# This value determines the NixOS release from which the default # This value determines the NixOS release from which the default
@ -67,19 +68,20 @@ in {
secretKey = "$MINIO_SECRET_KEY"; secretKey = "$MINIO_SECRET_KEY";
}; };
email = false; email = false;
oauth2 = let url = "https://dex.0x76.dev"; oauth2 =
in { let url = "https://dex.0x76.dev";
providerName = "Dex"; in {
clientID = "hedgedoc"; providerName = "Dex";
clientSecret = "$DEX_CLIENT_SECRET"; clientID = "hedgedoc";
scope = "openid email profile"; clientSecret = "$DEX_CLIENT_SECRET";
authorizationURL = "${url}/auth"; scope = "openid email profile";
tokenURL = "${url}/token"; authorizationURL = "${url}/auth";
userProfileURL = "${url}/userinfo"; tokenURL = "${url}/token";
userProfileUsernameAttr = "preferred_username"; userProfileURL = "${url}/userinfo";
userProfileDisplayNameAttr = "name"; userProfileUsernameAttr = "preferred_username";
userProfileEmailAttr = "email"; userProfileDisplayNameAttr = "name";
}; userProfileEmailAttr = "email";
};
}; };
}; };
} }

78
nixos/hosts/olympus/mailserver/configuration.nix
View File

@ -97,48 +97,50 @@ in {
autoIndexExclude = [ "\\Junk" ]; autoIndexExclude = [ "\\Junk" ];
}; };
}; };
services = {
services.postfix.relayHost = "smtp.ziggozakelijk.nl"; postfix.relayHost = "smtp.ziggozakelijk.nl";
services.postfix.relayPort = 587; postfix.relayPort = 587;
services.roundcube = { roundcube = {
enable = true; enable = true;
package = pkgs.roundcube.withPlugins package = pkgs.roundcube.withPlugins
(plugins: [ plugins.persistent_login pkgs.v.roundcube-swipe ]); (plugins: [ plugins.persistent_login pkgs.v.roundcube-swipe ]);
plugins = [ plugins = [
"archive" "archive"
"managesieve" "managesieve"
"swipe" "swipe"
# "enigma" # "enigma"
# "markasjunk" # "markasjunk"
"persistent_login" "persistent_login"
];
# this is the url of the vhost, not necessarily the same as the fqdn of
# the mailserver
hostName = "webmail.0x76.dev";
extraConfig = ''
# starttls needed for authentication, so the fqdn required to match
# the certificate
$config['smtp_host'] = "tls://${config.mailserver.fqdn}";
$config['smtp_user'] = "%u";
$config['smtp_pass'] = "%p";
$config['swipe_actions'] = [
'messagelist' => [
'left' => 'archive',
'right' => 'archive',
'down' => 'none'
],
'contactlist' => [
'left' => 'none',
'right' => 'none',
'down' => 'none'
]
]; ];
''; # this is the url of the vhost, not necessarily the same as the fqdn of
}; # the mailserver
hostName = "webmail.0x76.dev";
extraConfig = ''
# starttls needed for authentication, so the fqdn required to match
# the certificate
$config['smtp_host'] = "tls://${config.mailserver.fqdn}";
$config['smtp_user'] = "%u";
$config['smtp_pass'] = "%p";
services.nginx = { enable = true; }; $config['swipe_actions'] = [
'messagelist' => [
'left' => 'archive',
'right' => 'archive',
'down' => 'none'
],
'contactlist' => [
'left' => 'none',
'right' => 'none',
'down' => 'none'
]
];
'';
};
nginx = { enable = true; };
};
security.acme.acceptTerms = true; security.acme.acceptTerms = true;
security.acme.defaults.email = "v@0x76.dev"; security.acme.defaults.email = "v@0x76.dev";

3
nixos/hosts/olympus/minio/configuration.nix
View File

@ -7,7 +7,8 @@ let
vs = config.vault-secrets.secrets; vs = config.vault-secrets.secrets;
listenPort = config.meta.exposes.minio.port; listenPort = config.meta.exposes.minio.port;
consolePort = listenPort + 1; consolePort = listenPort + 1;
in { in
{
imports = [ ]; imports = [ ];
# This value determines the NixOS release from which the default # This value determines the NixOS release from which the default

201
nixos/hosts/olympus/nginx/configuration.nix
View File

@ -13,7 +13,8 @@ let
add_header Access-Control-Allow-Origin *; add_header Access-Control-Allow-Origin *;
return 200 '${builtins.toJSON data}'; return 200 '${builtins.toJSON data}';
''; '';
in { in
{
# This value determines the NixOS release from which the default # This value determines the NixOS release from which the default
# settings for stateful data, like file locations and database versions # settings for stateful data, like file locations and database versions
# on your system were taken. It‘s perfectly fine and recommended to leave # on your system were taken. It‘s perfectly fine and recommended to leave
@ -23,115 +24,127 @@ in {
system.stateVersion = "21.05"; # Did you read the comment? system.stateVersion = "21.05"; # Did you read the comment?
networking.firewall.allowedTCPPorts = [ 80 443 ]; networking.firewall.allowedTCPPorts = [ 80 443 ];
services = {
# Generates vhosts for all hosts that have an `exposes` section # Generates vhosts for all hosts that have an `exposes` section
services.v.nginx.autoExpose = true; v.nginx.autoExpose = true;
services.nginx = { nginx = {
enable = true; enable = true;
statusPage = true; statusPage = true;
recommendedProxySettings = true; recommendedProxySettings = true;
recommendedTlsSettings = true; recommendedTlsSettings = true;
recommendedOptimisation = true; recommendedOptimisation = true;
recommendedBrotliSettings = true; recommendedBrotliSettings = true;
clientMaxBodySize = "500m"; clientMaxBodySize = "500m";
package = pkgs.nginxMainline; package = pkgs.nginxMainline;
# Templated # Templated
virtualHosts = { virtualHosts = {
"pass.0x76.dev" = { "pass.0x76.dev" = {
enableACME = true; enableACME = true;
forceSSL = true; forceSSL = true;
locations."/" = { locations = {
proxyPass = "http://vaultwarden.olympus:8222";
proxyWebsockets = true;
};
locations."/notifications/hub/negotiate" = {
proxyPass = "http://vaultwarden.olympus:8222";
proxyWebsockets = true;
};
locations."/notifications/hub" = {
proxyPass = "http://vaultwarden.olympus:3012";
proxyWebsockets = true;
};
};
# Meow "/".proxyPass = "http://vaultwarden.olympus:8222";
"meowy.tech" = { "/".proxyWebsockets = true;
enableACME = true;
forceSSL = true;
locations."/".extraConfig = ''
add_header Content-Type 'text/html; charset=UTF-8';
return 200 '<h1>meow</h1>';
'';
locations."= /.well-known/matrix/client".extraConfig =
mkWellKnown clientConfig;
locations."= /.well-known/matrix/server".extraConfig =
mkWellKnown serverConfig;
};
"chat.meowy.tech" = {
enableACME = true;
forceSSL = true;
locations."/".extraConfig = ''
return 307 https://element.chat.meowy.tech;
'';
locations."/_matrix".proxyPass = "http://synapse.olympus:8008";
locations."/_synapse/client".proxyPass = "http://synapse.olympus:8008";
locations."/_synapse/admin" = {
# Allow only local and my own IPs
extraConfig = ''
allow 127.0.0.1;
allow 10.42.42.0/23;
allow 192.168.0.0/23;
allow 80.60.83.220;
allow 83.128.154.23;
allow 195.85.167.32/29;
deny all;
'';
proxyPass = "http://synapse.olympus:8008";
};
};
"element.chat.meowy.tech" = {
enableACME = true;
forceSSL = true;
root = pkgs.element-web.override { "/notifications/hub/negotiate" = {
conf = { proxyPass = "http://vaultwarden.olympus:8222";
default_server_config = clientConfig; proxyWebsockets = true;
show_labs_settings = true; };
brand = "chat.meowy.tech"; "/notifications/hub" = {
proxyPass = "http://vaultwarden.olympus:3012";
proxyWebsockets = true;
};
}; };
}; };
};
"cinny.chat.meowy.tech" = {
enableACME = true;
forceSSL = true;
root = pkgs.cinny.override { # Meow
conf = { "meowy.tech" = {
defaultHomeserver = 0; enableACME = true;
allowCustomHomeservers = false; forceSSL = true;
homeserverList = [ "chat.meowy.tech" ]; locations = {
"/".extraConfig = ''
add_header Content-Type 'text/html; charset=UTF-8';
return 200 '<h1>meow</h1>';
'';
"= /.well-known/matrix/client".extraConfig =
mkWellKnown clientConfig;
"= /.well-known/matrix/server".extraConfig =
mkWellKnown serverConfig;
}; };
}; };
"chat.meowy.tech" = {
enableACME = true;
forceSSL = true;
locations = {
"/".extraConfig = ''
return 307 https://element.chat.meowy.tech;
'';
"/_matrix".proxyPass = "http://synapse.olympus:8008";
"/_synapse/client".proxyPass = "http://synapse.olympus:8008";
"/_synapse/admin" = {
# Allow only local and my own IPs
extraConfig = ''
allow 127.0.0.1;
allow 10.42.42.0/23;
allow 192.168.0.0/23;
allow 80.60.83.220;
allow 83.128.154.23;
allow 195.85.167.32/29;
deny all;
'';
proxyPass = "http://synapse.olympus:8008";
};
};
};
"element.chat.meowy.tech" = {
enableACME = true;
forceSSL = true;
root = pkgs.element-web.override {
conf = {
default_server_config = clientConfig;
show_labs_settings = true;
brand = "chat.meowy.tech";
};
};
};
"cinny.chat.meowy.tech" = {
enableACME = true;
forceSSL = true;
root = pkgs.cinny.override {
conf = {
defaultHomeserver = 0;
allowCustomHomeservers = false;
homeserverList = [ "chat.meowy.tech" ];
};
};
};
"admin.chat.meowy.tech" = {
enableACME = true;
forceSSL = true;
root = pkgs.synapse-admin;
};
}; };
"admin.chat.meowy.tech" = { };
enableACME = true;
forceSSL = true; prometheus.exporters = {
root = pkgs.synapse-admin; nginx = {
enable = true;
openFirewall = true;
}; };
}; };
}; };
security = {
acme = {
security.acme.defaults.email = "victorheld12@gmail.com"; defaults.email = "victorheld12@gmail.com";
security.acme.acceptTerms = true; acceptTerms = true;
security.acme.preliminarySelfsigned = true; preliminarySelfsigned = true;
services.prometheus.exporters = {
nginx = {
enable = true;
openFirewall = true;
}; };
}; };
} }

27
nixos/hosts/olympus/ntfy/configuration.nix
View File

@ -20,18 +20,19 @@
networking.firewall.allowedTCPPorts = [ 80 9090 ]; networking.firewall.allowedTCPPorts = [ 80 9090 ];
services.ntfy-sh = let datadir = "/var/lib/ntfy-sh"; services.ntfy-sh =
in { let datadir = "/var/lib/ntfy-sh";
enable = true; in {
settings = { enable = true;
base-url = "https://ntfy.0x76.dev"; settings = {
listen-http = ":80"; base-url = "https://ntfy.0x76.dev";
cache-file = "${datadir}/cache.db"; listen-http = ":80";
auth-file = "${datadir}/user.db"; cache-file = "${datadir}/cache.db";
auth-default-access = "deny-all"; auth-file = "${datadir}/user.db";
behind-proxy = true; auth-default-access = "deny-all";
attachment-cache-dir = "${datadir}/attachments"; behind-proxy = true;
metrics-listen-http = ":9090"; attachment-cache-dir = "${datadir}/attachments";
metrics-listen-http = ":9090";
};
}; };
};
} }

3
nixos/hosts/olympus/outline/configuration.nix
View File

@ -6,7 +6,8 @@
let let
vs = config.vault-secrets.secrets; vs = config.vault-secrets.secrets;
inherit (config.meta.exposes.outline) port; inherit (config.meta.exposes.outline) port;
in { in
{
imports = [ ]; imports = [ ];
# This value determines the NixOS release from which the default # This value determines the NixOS release from which the default

109
nixos/hosts/olympus/synapse/configuration.nix
View File

@ -7,7 +7,8 @@ let
vs = config.vault-secrets.secrets; vs = config.vault-secrets.secrets;
port = 8008; port = 8008;
metricsPort = 9000; metricsPort = 9000;
in { in
{
imports = [ ]; imports = [ ];
# This value determines the NixOS release from which the default # This value determines the NixOS release from which the default
@ -49,60 +50,62 @@ in {
"${vs.synapse}/email_password" # Also contains the rest of the email config "${vs.synapse}/email_password" # Also contains the rest of the email config
]; ];
settings = let settings =
log_file = pkgs.writeText "log.yml" '' let
version: 1 log_file = pkgs.writeText "log.yml" ''
version: 1
formatters: formatters:
structured: structured:
class: synapse.logging.TerseJsonFormatter class: synapse.logging.TerseJsonFormatter
handlers: handlers:
file: file:
class: logging.handlers.TimedRotatingFileHandler class: logging.handlers.TimedRotatingFileHandler
formatter: structured formatter: structured
filename: /var/lib/matrix-synapse/synapse.log filename: /var/lib/matrix-synapse/synapse.log
when: midnight when: midnight
backupCount: 3 # Does not include the current log file. backupCount: 3 # Does not include the current log file.
encoding: utf8 encoding: utf8
loggers: loggers:
synapse: synapse:
level: INFO level: INFO
handlers: [file] handlers: [file]
''; '';
in { in
server_name = "meowy.tech"; {
enable_registration = true; server_name = "meowy.tech";
public_baseurl = "https://chat.meowy.tech"; enable_registration = true;
enable_metrics = true; public_baseurl = "https://chat.meowy.tech";
max_upload_size = "100M"; enable_metrics = true;
registration_requires_token = true; max_upload_size = "100M";
media_retention = { remote_media_lifetime = "90d"; }; registration_requires_token = true;
log_config = "${log_file}"; media_retention = { remote_media_lifetime = "90d"; };
listeners = [ log_config = "${log_file}";
{ listeners = [
inherit port; {
bind_addresses = [ "0.0.0.0" ]; inherit port;
type = "http"; bind_addresses = [ "0.0.0.0" ];
tls = false; type = "http";
x_forwarded = true; tls = false;
resources = [{ x_forwarded = true;
names = [ "client" "federation" ]; resources = [{
compress = true; names = [ "client" "federation" ];
}]; compress = true;
} }];
{ }
port = metricsPort; {
bind_addresses = [ "0.0.0.0" ]; port = metricsPort;
type = "metrics"; bind_addresses = [ "0.0.0.0" ];
tls = false; type = "metrics";
resources = [{ tls = false;
names = [ "metrics" ]; resources = [{
compress = false; names = [ "metrics" ];
}]; compress = false;
} }];
]; }
}; ];
};
}; };
} }

3
nixos/hosts/olympus/vaultwarden/configuration.nix
View File

@ -6,7 +6,8 @@
let let
vs = config.vault-secrets.secrets; vs = config.vault-secrets.secrets;
cfg = config.services.vaultwarden.config; cfg = config.services.vaultwarden.config;
in { in
{
imports = [ ]; imports = [ ];
# This value determines the NixOS release from which the default # This value determines the NixOS release from which the default

191
nixos/hosts/olympus/victoriametrics/configuration.nix
View File

@ -8,7 +8,8 @@ let
grafanaDomain = config.meta.exposes.grafana.domain; grafanaDomain = config.meta.exposes.grafana.domain;
grafanaPort = config.meta.exposes.grafana.port; grafanaPort = config.meta.exposes.grafana.port;
vs = config.vault-secrets.secrets; vs = config.vault-secrets.secrets;
in { in
{
imports = [ ]; imports = [ ];
# This value determines the NixOS release from which the default # This value determines the NixOS release from which the default
@ -20,73 +21,104 @@ in {
system.stateVersion = "21.11"; # Did you read the comment? system.stateVersion = "21.11"; # Did you read the comment?
networking.firewall.allowedTCPPorts = [ vmPort grafanaPort ]; networking.firewall.allowedTCPPorts = [ vmPort grafanaPort ];
networking.firewall.allowedUDPPorts = [ vmPort ]; networking.firewall.allowedUDPPorts = [ vmPort ];
services = {
services.victoriametrics = { victoriametrics = {
enable = true; enable = true;
listenAddress = ":${toString vmPort}"; listenAddress = ":${toString vmPort}";
# Data Retention period in months # Data Retention period in months
retentionPeriod = 36; retentionPeriod = 36;
}; };
vmagent = {
enable = true;
openFirewall = true;
prometheusConfig = {
global = {
scrape_interval = "1m";
scrape_timeout = "30s";
};
scrape_configs = [
{
job_name = "kea";
static_configs = [{
targets = [ "dhcp.olympus:9547" ];
labels.app = "dhcp";
}];
}
{
job_name = "nginx";
static_configs = [{
targets = [ "nginx.olympus:9113" ];
labels.app = "nginx";
}];
}
{
job_name = "synapse";
static_configs = [{
targets = [ "synapse.olympus:9000" ];
labels.app = "synapse";
}];
}
{
job_name = "wireguard";
static_configs = [{
targets = [ "wireguard.olympus:9586" ];
labels.app = "wireguard";
}];
}
{
job_name = "ntfy";
static_configs = [{
targets = [ "ntfy.olympus:9090" ];
labels.app = "ntfy";
}];
}
{
job_name = "dex";
static_configs = [{
targets = [ "dex.olympus:5558" ];
labels.app = "dex";
}];
}
{
job_name = "unbound";
static_configs = [{
targets = [ "dns-1.olympus:9167" "dns-2.olympus:9167" ];
labels.app = "dns";
}];
}
];
};
};
grafana = {
enable = true;
settings = {
server = {
domain = grafanaDomain;
root_url = "https://${grafanaDomain}";
http_addr = "0.0.0.0";
http_port = grafanaPort;
};
security.admin_password = "$__file{${vs.grafana}/password}";
"auth.generic_oauth" = {
name = "Dex";
icon = "signin";
enabled = true;
allow_sign_up = true;
client_id = "grafana";
client_secret = "$__file{${vs.grafana}/dex_client_secret}";
scopes = toString [ "openid" "profile" "email" "groups" ];
auth_url = "https://dex.0x76.dev/auth";
token_url = "https://dex.0x76.dev/token";
api_url = "https://dex.0x76.dev/userinfo";
skip_org_role_sync = true;
auto_login = true;
};
services.vmagent = {
enable = true;
openFirewall = true;
prometheusConfig = {
global = {
scrape_interval = "1m";
scrape_timeout = "30s";
}; };
scrape_configs = [
{
job_name = "kea";
static_configs = [{
targets = [ "dhcp.olympus:9547" ];
labels.app = "dhcp";
}];
}
{
job_name = "nginx";
static_configs = [{
targets = [ "nginx.olympus:9113" ];
labels.app = "nginx";
}];
}
{
job_name = "synapse";
static_configs = [{
targets = [ "synapse.olympus:9000" ];
labels.app = "synapse";
}];
}
{
job_name = "wireguard";
static_configs = [{
targets = [ "wireguard.olympus:9586" ];
labels.app = "wireguard";
}];
}
{
job_name = "ntfy";
static_configs = [{
targets = [ "ntfy.olympus:9090"];
labels.app = "ntfy";
}];
}
{
job_name = "dex";
static_configs = [{
targets = [ "dex.olympus:5558" ];
labels.app = "dex";
}];
}
{
job_name = "unbound";
static_configs = [{
targets = [ "dns-1.olympus:9167" "dns-2.olympus:9167" ];
labels.app = "dns";
}];
}
];
}; };
}; };
@ -94,33 +126,4 @@ in {
user = "grafana"; user = "grafana";
group = "grafana"; group = "grafana";
}; };
services.grafana = {
enable = true;
settings = {
server = {
domain = grafanaDomain;
root_url = "https://${grafanaDomain}";
http_addr = "0.0.0.0";
http_port = grafanaPort;
};
security.admin_password = "$__file{${vs.grafana}/password}";
"auth.generic_oauth" = {
name = "Dex";
icon = "signin";
enabled = true;
allow_sign_up = true;
client_id = "grafana";
client_secret = "$__file{${vs.grafana}/dex_client_secret}";
scopes = toString [ "openid" "profile" "email" "groups" ];
auth_url = "https://dex.0x76.dev/auth";
token_url = "https://dex.0x76.dev/token";
api_url = "https://dex.0x76.dev/userinfo";
skip_org_role_sync = true;
auto_login = true;
};
};
};
} }

96
nixos/hosts/olympus/wireguard/configuration.nix
View File

@ -19,22 +19,62 @@ in {
environment.systemPackages = with pkgs; [ wireguard-tools ]; environment.systemPackages = with pkgs; [ wireguard-tools ];
environment.noXlibs = lib.mkForce false; environment.noXlibs = lib.mkForce false;
networking = {
networking.firewall.allowedUDPPorts = firewall.allowedUDPPorts =
[ config.networking.wireguard.interfaces.wg0.listenPort ]; [ config.networking.wireguard.interfaces.wg0.listenPort ];
networking.firewall.checkReversePath = false; firewall.checkReversePath = false;
nat = {
enable = true;
internalInterfaces = [ "wg0" "eth0" ];
externalInterface = "eth0";
};
wireguard.interfaces.wg0 = {
ips = [ "10.100.0.1/24" ];
listenPort = 51821;
privateKeyFile = "${vs.wireguard}/privateKey";
peers = [
{
# Phone
publicKey = "K+99mvSYs4urcclreQDLA1pekD4xtu/mpS2uVWw8Bws=";
allowedIPs = [ "10.100.0.2/32" ];
}
{
# Laura's laptop
publicKey = "ZWIaDGrASlTkEK75j10VeGCvrIGfpk4GPobmqcYX2D0=";
allowedIPs = [ "10.100.0.3/32" ];
}
{
# Old Laptop
publicKey = "L8myt2bcdja7M+i+9eatdQRW8relPUoZZ9lEKSLe+m8=";
allowedIPs = [ "10.100.0.4/32" ];
}
{
# New Laptop
publicKey = "+Ms3xV6LxNZWTQk11zoz+AUIV2uds6A64Wz15JlR/Ak=";
allowedIPs = [ "10.100.0.6/32" ];
}
{
# Aerdenhout
# Useful setup video for opnsense: https://www.youtube.com/watch?v=RoXHe5dqCM0
# https://docs.opnsense.org/manual/how-tos/wireguard-s2s.html
publicKey = "KgqLhmUMX6kyTjRoa/GOCrZOvXNE5HWYuOr/T3v8/VI=";
allowedIPs = [ "10.100.0.5/32" "192.168.0.0/23" "10.10.10.0/24" ];
endpoint = "83.128.154.23:51820";
persistentKeepalive = 25;
}
];
};
};
vault-secrets.secrets.wireguard = { vault-secrets.secrets.wireguard = {
services = [ "wireguard-wg0" ]; services = [ "wireguard-wg0" ];
loginRetries = 25; loginRetries = 25;
}; };
networking.nat = {
enable = true;
internalInterfaces = [ "wg0" "eth0" ];
externalInterface = "eth0";
};
boot.kernel.sysctl = { boot.kernel.sysctl = {
"net.ipv4.ip_forward" = 1; "net.ipv4.ip_forward" = 1;
"net.ipv6.conf.all.forwarding" = 1; "net.ipv6.conf.all.forwarding" = 1;
@ -44,42 +84,4 @@ in {
enable = true; enable = true;
openFirewall = true; openFirewall = true;
}; };
networking.wireguard.interfaces.wg0 = {
ips = [ "10.100.0.1/24" ];
listenPort = 51821;
privateKeyFile = "${vs.wireguard}/privateKey";
peers = [
{
# Phone
publicKey = "K+99mvSYs4urcclreQDLA1pekD4xtu/mpS2uVWw8Bws=";
allowedIPs = [ "10.100.0.2/32" ];
}
{
# Laura's laptop
publicKey = "ZWIaDGrASlTkEK75j10VeGCvrIGfpk4GPobmqcYX2D0=";
allowedIPs = [ "10.100.0.3/32" ];
}
{
# Old Laptop
publicKey = "L8myt2bcdja7M+i+9eatdQRW8relPUoZZ9lEKSLe+m8=";
allowedIPs = [ "10.100.0.4/32" ];
}
{
# New Laptop
publicKey = "+Ms3xV6LxNZWTQk11zoz+AUIV2uds6A64Wz15JlR/Ak=";
allowedIPs = [ "10.100.0.6/32" ];
}
{
# Aerdenhout
# Useful setup video for opnsense: https://www.youtube.com/watch?v=RoXHe5dqCM0
# https://docs.opnsense.org/manual/how-tos/wireguard-s2s.html
publicKey = "KgqLhmUMX6kyTjRoa/GOCrZOvXNE5HWYuOr/T3v8/VI=";
allowedIPs = [ "10.100.0.5/32" "192.168.0.0/23" "10.10.10.0/24" ];
endpoint = "83.128.154.23:51820";
persistentKeepalive = 25;
}
];
};
} }

12
nixos/hosts/thalassa/aoife/hardware-configuration.nix
View File

@ -5,12 +5,14 @@
{ {
imports = [ (modulesPath + "/installer/scan/not-detected.nix") ]; imports = [ (modulesPath + "/installer/scan/not-detected.nix") ];
boot = {
boot.initrd.availableKernelModules = initrd.availableKernelModules =
[ "nvme" "xhci_pci" "thunderbolt" "usb_storage" "sd_mod" "sdhci_pci" ]; [ "nvme" "xhci_pci" "thunderbolt" "usb_storage" "sd_mod" "sdhci_pci" ];
boot.initrd.kernelModules = [ ]; initrd.kernelModules = [ ];
boot.kernelModules = [ "kvm-amd" ]; kernelModules = [ "kvm-amd" ];
boot.extraModulePackages = [ ]; extraModulePackages = [ ];
};
fileSystems."/" = { fileSystems."/" = {
device = "/dev/disk/by-uuid/c184866a-9a53-4a9f-9a1f-493792af7ea9"; device = "/dev/disk/by-uuid/c184866a-9a53-4a9f-9a1f-493792af7ea9";

70
nixos/hosts/thalassa/aoife/hardware.nix
View File

@ -1,50 +1,58 @@
{ pkgs, ... }: { { pkgs, ... }: {
hardware.enableAllFirmware = true; hardware = {
enableAllFirmware = true;
hardware.bluetooth.enable = true; bluetooth.enable = true;
services.hardware.bolt.enable = true; # Vulkan
opengl.driSupport = true;
opengl.extraPackages = with pkgs; [
amdvlk
rocm-opencl-icd
rocm-opencl-runtime
];
};
services = {
services.fprintd.enable = true; hardware.bolt.enable = true;
fprintd.enable = true;
# Video Driver
xserver.videoDrivers = [ "amdgpu" ];
xserver = {
dpi = 280;
xkbOptions = "caps:swapescape";
};
# SSD Trim
fstrim.enable = true;
# Power Management
upower.enable = true;
thermald.enable = true;
};
# hardware.trackpoint.enable = true; # hardware.trackpoint.enable = true;
# FS # FS
fileSystems."/".options = [ "compress=zstd" ]; fileSystems."/".options = [ "compress=zstd" ];
# Video Driver
services.xserver.videoDrivers = [ "amdgpu" ];
services.xserver = {
dpi = 280;
xkbOptions = "caps:swapescape";
};
# Vulkan
hardware.opengl.driSupport = true;
hardware.opengl.extraPackages = with pkgs; [
amdvlk
rocm-opencl-icd
rocm-opencl-runtime
];
systemd.tmpfiles.rules = systemd.tmpfiles.rules =
[ "L+ /opt/rocm/hip - - - - ${pkgs.hip}" ]; [ "L+ /opt/rocm/hip - - - - ${pkgs.hip}" ];
# SSD Trim
services.fstrim.enable = true;
# Power Management
services.upower.enable = true;
services.thermald.enable = true;
powerManagement = { powerManagement = {
enable = true; enable = true;
powertop.enable = true; powertop.enable = true;
}; };
security = {
tpm2 = {
# tpm # tpm
security.tpm2.enable = true; enable = true;
security.tpm2.pkcs11.enable = true; # expose /run/current-system/sw/lib/libtpm2_pkcs11.so pkcs11.enable = true; # expose /run/current-system/sw/lib/libtpm2_pkcs11.so
security.tpm2.tctiEnvironment.enable = true; # TPM2TOOLS_TCTI and TPM2_PKCS11_TCTI env variables tctiEnvironment.enable = true;
users.users.victor.extraGroups = [ "tss" ]; # tss group has access to TPM devices };
}; # TPM2TOOLS_TCTI and TPM2_PKCS11_TCTI env variables
users.users.victor.extraGroups = [ "tss" ]; # tss group has access to TPM devices
} }

2
nixos/hosts/thalassa/aoife/home/default.nix
View File

@ -1,4 +1,4 @@
{pkgs, ...}: { { pkgs, ... }: {
# Custom dconf settings # Custom dconf settings
dconf.settings."org/gnome/desktop/input-sources" = { dconf.settings."org/gnome/desktop/input-sources" = {
xkb-options = [ "caps:swapescape" ]; xkb-options = [ "caps:swapescape" ];

259
nixos/hosts/thalassa/null/configuration.nix
View File

@ -30,23 +30,39 @@ let
exec Hyprland exec Hyprland
''; '';
in { in
{
imports = [ imports = [
# Include the results of the hardware scan. # Include the results of the hardware scan.
./hardware-configuration.nix ./hardware-configuration.nix
./rescue-boot.nix ./rescue-boot.nix
./networking.nix ./networking.nix
]; ];
home-manager = {
# home-manager # home-manager
home-manager.useGlobalPkgs = true; useGlobalPkgs = true;
home-manager.useUserPackages = true; useUserPackages = true;
home-manager.users.victor = import ./home; users.victor = import ./home;
home-manager.extraSpecialArgs = { inherit inputs; }; extraSpecialArgs = { inherit inputs; };
};
security = {
security.pam.services.swaylock = { }; pam.services.swaylock = { };
security.sudo.wheelNeedsPassword = true; sudo.wheelNeedsPassword = true;
rtkit.enable = true;
# Enables logging in with my Solokey
pam.u2f = {
enable = true;
debug = false;
cue = true;
control = "sufficient";
authFile =
"/etc/u2f-mappings"; # use `pamu2fcfg` from `pkgs.pam_u2f` to generate this config
};
};
fonts = { fonts = {
fonts = with pkgs; [ fonts = with pkgs; [
@ -79,61 +95,116 @@ in {
# boot.initrd.systemd.enable = true; # Experimental # boot.initrd.systemd.enable = true; # Experimental
boot = { boot = {
kernelPackages = pkgs.linuxPackages_latest; kernelPackages = pkgs.linuxPackages_latest;
loader.systemd-boot.editor = false; loader = {
loader.systemd-boot.enable = true; systemd-boot.editor = false;
# loader.systemd-boot.configurationLimit = 6; systemd-boot.enable = true;
loader.efi.canTouchEfiVariables = true; # loader.systemd-boot.configurationLimit = 6;
loader.efi.efiSysMountPoint = "/boot/efi"; efi.canTouchEfiVariables = true;
efi.efiSysMountPoint = "/boot/efi";
};
kernel.sysctl = { "fs.inotify.max_user_watches" = 524288; }; kernel.sysctl = { "fs.inotify.max_user_watches" = 524288; };
}; };
services = {
services.gnome.gnome-keyring.enable = true; gnome.gnome-keyring.enable = true;
fileSystems."/".options = [ "compress=zstd" ]; udisks2.enable = true;
fileSystems."/home".options = [ "compress=zstd" ]; dbus.enable = true;
fileSystems."/nix".options = [ "compress=zstd" "noatime" ];
# Filesystem dedup xserver = {
# services.beesd.filesystems = { enable = false;
# root = { layout = "us";
# spec = "LABEL=nixos"; xkbVariant = "altgr-intl";
# hashTableSizeMB = 256; xkbOptions = "caps:swapescape";
# verbosity = "crit"; videoDrivers = [ "nvidia" ];
# extraOptions = [ "--loadavg-target" "2.0" ]; };
# }; blueman.enable = true;
# };
# Select internationalisation properties. # Enable CUPS to print documents.
i18n.defaultLocale = "en_GB.utf8"; printing.enable = true;
pipewire = {
enable = true;
alsa.enable = true;
alsa.support32Bit = true;
pulse.enable = true;
# If you want to use JACK applications, uncomment this
#jack.enable = true;
i18n.extraLocaleSettings = { # use the example session manager (no others are packaged yet so this is enabled by default,
LC_ADDRESS = "nl_NL.UTF-8"; # no need to redefine it in your config for now)
LC_IDENTIFICATION = "nl_NL.UTF-8"; #media-session.enable = true;
LC_MEASUREMENT = "nl_NL.UTF-8"; };
LC_MONETARY = "nl_NL.UTF-8";
LC_NAME = "nl_NL.UTF-8"; fstrim.enable = true;
LC_NUMERIC = "nl_NL.UTF-8";
LC_PAPER = "nl_NL.UTF-8"; # don't shutdown when power button is short-pressed
LC_TELEPHONE = "nl_NL.UTF-8"; logind.extraConfig = ''
LC_TIME = "en_DK.UTF-8"; HandlePowerKey=suspend
'';
udev.packages = with pkgs; [
android-udev-rules
logitech-udev-rules
wooting-udev-rules
];
}; };
fileSystems = {
i18n.supportedLocales = "/".options = [ "compress=zstd" ];
[ "en_GB.UTF-8/UTF-8" "nl_NL.UTF-8/UTF-8" "en_DK.UTF-8/UTF-8" ]; "/home".options = [ "compress=zstd" ];
"/nix".options = [ "compress=zstd" "noatime" ];
};
i18n = {
# Filesystem dedup
# services.beesd.filesystems = {
# root = {
# spec = "LABEL=nixos";
# hashTableSizeMB = 256;
# verbosity = "crit";
# extraOptions = [ "--loadavg-target" "2.0" ];
# };
# };
# Select internationalisation properties.
defaultLocale = "en_GB.utf8";
extraLocaleSettings = {
LC_ADDRESS = "nl_NL.UTF-8";
LC_IDENTIFICATION = "nl_NL.UTF-8";
LC_MEASUREMENT = "nl_NL.UTF-8";
LC_MONETARY = "nl_NL.UTF-8";
LC_NAME = "nl_NL.UTF-8";
LC_NUMERIC = "nl_NL.UTF-8";
LC_PAPER = "nl_NL.UTF-8";
LC_TELEPHONE = "nl_NL.UTF-8";
LC_TIME = "en_DK.UTF-8";
};
supportedLocales =
[ "en_GB.UTF-8/UTF-8" "nl_NL.UTF-8/UTF-8" "en_DK.UTF-8/UTF-8" ];
};
xdg.portal = { xdg.portal = {
enable = true; enable = true;
wlr.enable = true; wlr.enable = true;
}; };
programs = {
services.udisks2.enable = true; # Hyprland
services.dbus.enable = true; hyprland = {
enable = true;
package = null; # Managed by home manager
};
# Hyprland steam = {
programs.hyprland = { enable = true;
enable = true; remotePlay.openFirewall = true;
package = null; # Managed by home manager dedicatedServer.openFirewall = true;
};
ssh.startAgent = true;
}; };
environment.loginShellInit = '' environment.loginShellInit = ''
@ -141,57 +212,34 @@ in {
${run-hyprland}/bin/run-hyprland ${run-hyprland}/bin/run-hyprland
fi fi
''; '';
hardware = {
services.xserver = { nvidia.prime = {
enable = false; offload.enable = true;
layout = "us"; intelBusId = "PCI:0:2:0";
xkbVariant = "altgr-intl"; nvidiaBusId = "PCI:1:0:0";
xkbOptions = "caps:swapescape"; };
videoDrivers = [ "nvidia" ];
opengl = {
enable = true;
extraPackages = with pkgs; [
vaapiVdpau
intel-media-driver # LIBVA_DRIVER_NAME=iHD
vaapiIntel # LIBVA_DRIVER_NAME=i965 (older but works better for Firefox/Chromium)
libvdpau-va-gl
];
};
bluetooth.enable = true;
saleae-logic.enable = true;
pulseaudio.enable = false;
}; };
hardware.nvidia.prime = {
offload.enable = true;
intelBusId = "PCI:0:2:0";
nvidiaBusId = "PCI:1:0:0";
};
hardware.opengl = {
enable = true;
extraPackages = with pkgs; [
vaapiVdpau
intel-media-driver # LIBVA_DRIVER_NAME=iHD
vaapiIntel # LIBVA_DRIVER_NAME=i965 (older but works better for Firefox/Chromium)
libvdpau-va-gl
];
};
hardware.bluetooth.enable = true;
services.blueman.enable = true;
virtualisation.podman.enable = true; virtualisation.podman.enable = true;
hardware.saleae-logic.enable = true;
# Enable CUPS to print documents.
services.printing.enable = true;
# Enable sound with pipewire. # Enable sound with pipewire.
sound.enable = true; sound.enable = true;
hardware.pulseaudio.enable = false;
security.rtkit.enable = true;
services.pipewire = {
enable = true;
alsa.enable = true;
alsa.support32Bit = true;
pulse.enable = true;
# If you want to use JACK applications, uncomment this
#jack.enable = true;
# use the example session manager (no others are packaged yet so this is enabled by default,
# no need to redefine it in your config for now)
#media-session.enable = true;
};
environment.systemPackages = with pkgs; [ environment.systemPackages = with pkgs; [
pciutils pciutils
@ -204,42 +252,11 @@ in {
swaylock-effects # Has to be installed globally so that pam module works swaylock-effects # Has to be installed globally so that pam module works
]; ];
programs.steam = {
enable = true;
remotePlay.openFirewall = true;
dedicatedServer.openFirewall = true;
};
services.fstrim.enable = true;
nix.extraOptions = '' nix.extraOptions = ''
keep-outputs = true keep-outputs = true
keep-derivations = true keep-derivations = true
''; '';
# Enables logging in with my Solokey
security.pam.u2f = {
enable = true;
debug = false;
cue = true;
control = "sufficient";
authFile =
"/etc/u2f-mappings"; # use `pamu2fcfg` from `pkgs.pam_u2f` to generate this config
};
programs.ssh.startAgent = true;
# don't shutdown when power button is short-pressed
services.logind.extraConfig = ''
HandlePowerKey=suspend
'';
services.udev.packages = with pkgs; [
android-udev-rules
logitech-udev-rules
wooting-udev-rules
];
# This value determines the NixOS release from which the default # This value determines the NixOS release from which the default
# settings for stateful data, like file locations and database versions # settings for stateful data, like file locations and database versions
# on your system were taken. It‘s perfectly fine and recommended to leave # on your system were taken. It‘s perfectly fine and recommended to leave

50
nixos/hosts/thalassa/null/hardware-configuration.nix
View File

@ -5,34 +5,38 @@
{ {
imports = [ (modulesPath + "/installer/scan/not-detected.nix") ]; imports = [ (modulesPath + "/installer/scan/not-detected.nix") ];
boot = {
boot.initrd.availableKernelModules = initrd.availableKernelModules =
[ "xhci_pci" "ahci" "nvme" "rtsx_pci_sdmmc" ]; [ "xhci_pci" "ahci" "nvme" "rtsx_pci_sdmmc" ];
boot.initrd.kernelModules = [ ]; initrd.kernelModules = [ ];
boot.kernelModules = [ "kvm-intel" ]; kernelModules = [ "kvm-intel" ];
boot.extraModulePackages = [ ]; extraModulePackages = [ ];
fileSystems."/" = {
device = "/dev/disk/by-uuid/d4f56e5b-2509-4e63-8324-65a35c71e90c";
fsType = "btrfs";
options = [ "subvol=@" ];
}; };
fileSystems = {
fileSystems."/nix" = { "/" = {
device = "/dev/disk/by-uuid/d4f56e5b-2509-4e63-8324-65a35c71e90c"; device = "/dev/disk/by-uuid/d4f56e5b-2509-4e63-8324-65a35c71e90c";
fsType = "btrfs"; fsType = "btrfs";
options = [ "subvol=@/nix" ]; options = [ "subvol=@" ];
}; };
fileSystems."/home" = { "/nix" = {
device = "/dev/disk/by-uuid/d4f56e5b-2509-4e63-8324-65a35c71e90c"; device = "/dev/disk/by-uuid/d4f56e5b-2509-4e63-8324-65a35c71e90c";
fsType = "btrfs"; fsType = "btrfs";
options = [ "subvol=@home" ]; options = [ "subvol=@/nix" ];
}; };
fileSystems."/boot/efi" = { "/home" = {
device = "/dev/disk/by-uuid/D478-6F66"; device = "/dev/disk/by-uuid/d4f56e5b-2509-4e63-8324-65a35c71e90c";
fsType = "vfat"; fsType = "btrfs";
options = [ "subvol=@home" ];
};
"/boot/efi" = {
device = "/dev/disk/by-uuid/D478-6F66";
fsType = "vfat";
};
}; };
swapDevices = [ ]; swapDevices = [ ];

373
nixos/hosts/thalassa/null/home/default.nix
View File

@ -4,198 +4,205 @@ let
inherit (pkgs.texlive) scheme-full; inherit (pkgs.texlive) scheme-full;
dnd-5e-latex-template = { pkgs = [ pkgs.v.dnd-5e-latex-template ]; }; dnd-5e-latex-template = { pkgs = [ pkgs.v.dnd-5e-latex-template ]; };
}; };
in { in
programs.home-manager.enable = true; {
home.username = "victor"; programs = {
home.homeDirectory = "/home/victor"; home-manager.enable = true;
home.stateVersion = "22.05";
foot = { enable = true; };
nix-index.enable = true;
exa = {
enable = true;
enableAliases = true;
};
bat.enable = true;
git = {
enable = true;
package = pkgs.gitAndTools.gitFull;
userName = "Victor";
userEmail = "victor@xirion.net";
lfs.enable = true;
# delta.enable = true;
extraConfig = {
push.autoSetupRemote = true;
init.defaultBranch = "main";
};
};
mako = {
enable = true;
extraConfig = ''
[mode=do-not-disturb]
invisible=1
'';
};
tmux = {
enable = true;
shortcut = "b";
terminal = "screen-256color";
clock24 = true;
};
firefox = {
enable = true;
package = pkgs.firefox-devedition-bin;
};
vscode = {
enable = true;
package = pkgs.vscode;
userSettings = {
"ltex.language" = "en-GB";
"latex-workshop" = {
"linting.chktex.enabled" = true;
"latex.clean.subfolder.enabled" = true;
"latex.outDir" = "%TMPDIR%/%RELATIVE_DOC%";
};
"workbench.colorTheme" = "Catppuccin Frappé";
"editor.fontFamily" =
"'DejaVuSansMono Nerd Font', 'monospace', monospace";
"keyboard.dispatch" = "keyCode";
"rust-analyzer.server.path" = "${pkgs.rust-analyzer}/bin/rust-analyzer";
"terminal.integrated.defaultProfile.linux" = "zsh";
"nix.enableLanguageServer" = true; # Enable LSP.
"nix.serverPath" =
"${pkgs.nil}/bin/nil"; # The path to the LSP server executable.
"[nix]" = { "editor.defaultFormatter" = "brettm12345.nixfmt-vscode"; };
};
extensions = with pkgs.vscode-extensions;
with pkgs.v.vscode-extensions; [
# astro-build.astro-vscode
brettm12345.nixfmt-vscode
catppuccin.catppuccin-vsc
codezombiech.gitignore
editorconfig.editorconfig
foxundermoon.shell-format
james-yu.latex-workshop
jnoortheen.nix-ide
matklad.rust-analyzer
mkhl.direnv
ms-vscode-remote.remote-ssh
ms-vscode.cpptools
platformio.platformio-ide
redhat.vscode-yaml
tamasfe.even-better-toml
valentjn.vscode-ltex
vscodevim.vim
xaver.clang-format
];
};
direnv = {
enable = true;
nix-direnv = { enable = true; };
};
zsh = {
enable = true;
sessionVariables = { DIRENV_LOG_FORMAT = ""; };
};
};
home = {
username = "victor";
homeDirectory = "/home/victor";
stateVersion = "22.05";
packages = with pkgs; [
appimage-run
brightnessctl
btop
calibre
cinny-desktop
discord-canary
element-desktop-wayland
fluxcd
fusee-launcher
gcc
gimp
gnome.eog
gnome.file-roller
gnome.gnome-font-viewer
gnome.nautilus
grim # Screenshot tool
inputs.comma.packages.${pkgs.system}.default
inputs.riff.packages.${pkgs.system}.riff
inputs.webcord.packages.${pkgs.system}.default
k9s
kubectl
libnotify
mullvad-vpn
neofetch
nixpkgs-review
nixfmt
ouch
plex-media-player
plexamp
python3
retroarchFull
ripgrep
rsync
rustup
saleae-logic-2
solo2-cli
steam-run
tex
thunderbird-wayland
v.deemix-gui
wf-recorder # Screenrecorder
wl-clipboard # Clipboard manager
wofi # Wayland rofi
wpa_supplicant_gui
];
};
imports = [ ./hyprland.nix ./neovim.nix ./eww ./theme.nix ]; imports = [ ./hyprland.nix ./neovim.nix ./eww ./theme.nix ];
home.packages = with pkgs; [
appimage-run
brightnessctl
btop
calibre
cinny-desktop
discord-canary
element-desktop-wayland
fluxcd
fusee-launcher
gcc
gimp
gnome.eog
gnome.file-roller
gnome.gnome-font-viewer
gnome.nautilus
grim # Screenshot tool
inputs.comma.packages.${pkgs.system}.default
inputs.riff.packages.${pkgs.system}.riff
inputs.webcord.packages.${pkgs.system}.default
k9s
kubectl
libnotify
mullvad-vpn
neofetch
nixpkgs-review
nixfmt
ouch
plex-media-player
plexamp
python3
retroarchFull
ripgrep
rsync
rustup
saleae-logic-2
solo2-cli
steam-run
tex
thunderbird-wayland
v.deemix-gui
wf-recorder # Screenrecorder
wl-clipboard # Clipboard manager
wofi # Wayland rofi
wpa_supplicant_gui
];
xdg.mimeApps = { xdg.mimeApps = {
enable = true; enable = true;
defaultApplications = let browser = [ "firefox.desktop" ]; defaultApplications =
in { let browser = [ "firefox.desktop" ];
"image/*" = "org.gnome.eog.desktop"; in {
"text/html" = browser; "image/*" = "org.gnome.eog.desktop";
"x-scheme-handler/http" = browser; "text/html" = browser;
"x-scheme-handler/https" = browser; "x-scheme-handler/http" = browser;
"x-scheme-handler/ftp" = browser; "x-scheme-handler/https" = browser;
"x-scheme-handler/about" = browser; "x-scheme-handler/ftp" = browser;
"x-scheme-handler/unknown" = browser; "x-scheme-handler/about" = browser;
"application/x-extension-htm" = browser; "x-scheme-handler/unknown" = browser;
"application/x-extension-html" = browser; "application/x-extension-htm" = browser;
"application/x-extension-shtml" = browser; "application/x-extension-html" = browser;
"application/xhtml+xml" = browser; "application/x-extension-shtml" = browser;
"application/x-extension-xhtml" = browser; "application/xhtml+xml" = browser;
"application/x-extension-xht" = browser; "application/x-extension-xhtml" = browser;
"application/x-extension-xht" = browser;
"application/json" = browser; "application/json" = browser;
"application/pdf" = browser; "application/pdf" = browser;
"x-scheme-handler/vscode" = "code-url-handler.desktop"; "x-scheme-handler/vscode" = "code-url-handler.desktop";
"x-scheme-handler/discord" = "webcord.desktop"; "x-scheme-handler/discord" = "webcord.desktop";
};
};
programs.foot = { enable = true; };
programs.nix-index.enable = true;
programs.exa = {
enable = true;
enableAliases = true;
};
programs.bat.enable = true;
programs.git = {
enable = true;
package = pkgs.gitAndTools.gitFull;
userName = "Victor";
userEmail = "victor@xirion.net";
lfs.enable = true;
# delta.enable = true;
extraConfig = {
push.autoSetupRemote = true;
init.defaultBranch = "main";
};
};
programs.mako = {
enable = true;
extraConfig = ''
[mode=do-not-disturb]
invisible=1
'';
};
programs.tmux = {
enable = true;
shortcut = "b";
terminal = "screen-256color";
clock24 = true;
};
programs.firefox = {
enable = true;
package = pkgs.firefox-devedition-bin;
};
programs.vscode = {
enable = true;
package = pkgs.vscode;
userSettings = {
"ltex.language" = "en-GB";
"latex-workshop" = {
"linting.chktex.enabled" = true;
"latex.clean.subfolder.enabled" = true;
"latex.outDir" = "%TMPDIR%/%RELATIVE_DOC%";
}; };
"workbench.colorTheme" = "Catppuccin Frappé"; };
"editor.fontFamily" =
"'DejaVuSansMono Nerd Font', 'monospace', monospace"; xdg.userDirs =
"keyboard.dispatch" = "keyCode"; let home = config.home.homeDirectory;
"rust-analyzer.server.path" = "${pkgs.rust-analyzer}/bin/rust-analyzer"; in {
"terminal.integrated.defaultProfile.linux" = "zsh"; enable = true;
"nix.enableLanguageServer" = true; # Enable LSP. createDirectories = true;
"nix.serverPath" = desktop = "${home}/.desktop";
"${pkgs.nil}/bin/nil"; # The path to the LSP server executable. documents = "${home}/cloud/Documents";
"[nix]" = { "editor.defaultFormatter" = "brettm12345.nixfmt-vscode"; }; download = "${home}/dl";
music = "${home}/cloud/Music";
pictures = "${home}/cloud/Pictures";
publicShare = "${home}/.publicShare";
templates = "${home}/.templates";
videos = "${home}/cloud/Videos";
}; };
extensions = with pkgs.vscode-extensions;
with pkgs.v.vscode-extensions; [
# astro-build.astro-vscode
brettm12345.nixfmt-vscode
catppuccin.catppuccin-vsc
codezombiech.gitignore
editorconfig.editorconfig
foxundermoon.shell-format
james-yu.latex-workshop
jnoortheen.nix-ide
matklad.rust-analyzer
mkhl.direnv
ms-vscode-remote.remote-ssh
ms-vscode.cpptools
platformio.platformio-ide
redhat.vscode-yaml
tamasfe.even-better-toml
valentjn.vscode-ltex
vscodevim.vim
xaver.clang-format
];
};
programs.direnv = {
enable = true;
nix-direnv = { enable = true; };
};
programs.zsh = {
enable = true;
sessionVariables = { DIRENV_LOG_FORMAT = ""; };
};
xdg.userDirs = let home = config.home.homeDirectory;
in {
enable = true;
createDirectories = true;
desktop = "${home}/.desktop";
documents = "${home}/cloud/Documents";
download = "${home}/dl";
music = "${home}/cloud/Music";
pictures = "${home}/cloud/Pictures";
publicShare = "${home}/.publicShare";
templates = "${home}/.templates";
videos = "${home}/cloud/Videos";
};
services.syncthing.enable = true; services.syncthing.enable = true;
} }

62
nixos/hosts/thalassa/null/home/eww/default.nix
View File

@ -1,38 +1,42 @@
{ pkgs, ... }: { { pkgs, ... }: {
home.packages = with pkgs; [ home = {
eww-wayland packages = with pkgs; [
pamixer eww-wayland
lua pamixer
(nerdfonts.override { fonts = [ "JetBrainsMono" ]; }) lua
]; (nerdfonts.override { fonts = [ "JetBrainsMono" ]; })
];
file = {
home.file.".config/eww/eww.yuck".source = ./eww.yuck; ".config/eww/eww.yuck".source = ./eww.yuck;
home.file.".config/eww/eww.scss".text = builtins.readFile ./eww.scss; ".config/eww/eww.scss".text = builtins.readFile ./eww.scss;
# scripts # scripts
# TODO: just link all scripts in ./scripts to .config/eww/scripts # TODO: just link all scripts in ./scripts to .config/eww/scripts
home.file.".config/eww/scripts/volume.sh" = { ".config/eww/scripts/volume.sh" = {
source = ./scripts/volume.sh; source = ./scripts/volume.sh;
executable = true; executable = true;
}; };
home.file.".config/eww/scripts/wifi.sh" = { ".config/eww/scripts/wifi.sh" = {
source = ./scripts/wifi.sh; source = ./scripts/wifi.sh;
executable = true; executable = true;
}; };
home.file.".config/eww/scripts/workspaces.sh" = { ".config/eww/scripts/workspaces.sh" = {
source = ./scripts/workspaces.sh; source = ./scripts/workspaces.sh;
executable = true; executable = true;
}; };
home.file.".config/eww/scripts/workspaces.lua" = { ".config/eww/scripts/workspaces.lua" = {
source = ./scripts/workspaces.lua; source = ./scripts/workspaces.lua;
executable = true; executable = true;
}; };
home.file.".config/eww/scripts/do-not-disturb.sh" = { ".config/eww/scripts/do-not-disturb.sh" = {
source = ./scripts/do-not-disturb.sh; source = ./scripts/do-not-disturb.sh;
executable = true; executable = true;
};
};
}; };
} }

226
nixos/hosts/thalassa/null/home/hyprland.nix
View File

@ -5,131 +5,133 @@
wallpaper = eDP-1,~/cloud/Pictures/Wallpapers-Laptop/wallpaper-nix-pink.png wallpaper = eDP-1,~/cloud/Pictures/Wallpapers-Laptop/wallpaper-nix-pink.png
''; '';
wayland.windowManager.hyprland = let wayland.windowManager.hyprland =
startup-script = pkgs.writeScriptBin "startup" '' let
#!${pkgs.stdenv.shell} startup-script = pkgs.writeScriptBin "startup" ''
hyprctl setcursor Catppuccin-Frappe-Pink-Cursors ${ #!${pkgs.stdenv.shell}
builtins.toString config.home.pointerCursor.size hyprctl setcursor Catppuccin-Frappe-Pink-Cursors ${
} builtins.toString config.home.pointerCursor.size
${pkgs.hyprpaper}/bin/hyprpaper &
foot --server &
eww daemon &
eww open bar &
firefox-devedition &
webcord &
element-desktop &
'';
in {
enable = true;
recommendedEnvironment = true;
extraConfig = ''
exec-once=dbus-update-activation-environment --systemd WAYLAND_DISPLAY XDG_CURRENT_DESKTOP
exec-once=systemctl --user import-environment WAYLAND_DISPLAY XDG_CURRENT_DESKTOP
monitor=eDP-1,1920x1080@60,0x0,1
monitor=eDP-1,addreserved,0,0,48,0
monitor=,preferred,auto,1
windowrulev2 = workspace 1 silent,class:^(Electron)$,title:^(.*)(WebCord)(.*)$
windowrulev2 = workspace 1 silent,title:^(Element)(.*)$
windowrulev2 = workspace 2 silent,class:^(firefox-aurora)$
windowrulev2 = float,class:^(firefox-aurora)$,title:^(Picture-in-Picture)$
general {
layout = dwindle
col.active_border = 0xfff4b8e4
}
input {
kb_options=caps:escape
touchpad {
natural_scroll= true
} }
} ${pkgs.hyprpaper}/bin/hyprpaper &
foot --server &
eww daemon &
eww open bar &
firefox-devedition &
webcord &
element-desktop &
'';
in
{
enable = true;
recommendedEnvironment = true;
extraConfig = ''
exec-once=dbus-update-activation-environment --systemd WAYLAND_DISPLAY XDG_CURRENT_DESKTOP
exec-once=systemctl --user import-environment WAYLAND_DISPLAY XDG_CURRENT_DESKTOP
gestures { monitor=eDP-1,1920x1080@60,0x0,1
workspace_swipe = true monitor=eDP-1,addreserved,0,0,48,0
} monitor=,preferred,auto,1
misc { windowrulev2 = workspace 1 silent,class:^(Electron)$,title:^(.*)(WebCord)(.*)$
no_vfr = false windowrulev2 = workspace 1 silent,title:^(Element)(.*)$
disable_hyprland_logo = true windowrulev2 = workspace 2 silent,class:^(firefox-aurora)$
disable_splash_rendering = true windowrulev2 = float,class:^(firefox-aurora)$,title:^(Picture-in-Picture)$
}
dwindle { general {
pseudotile=true layout = dwindle
} col.active_border = 0xfff4b8e4
}
bind=SUPER,RETURN,exec,footclient input {
bind=SUPER,f,exec,firefox-devedition kb_options=caps:escape
bind=SUPER,d,exec,wofi --show run,drun touchpad {
natural_scroll= true
}
}
bind=,Print,exec,grim -g "$(slurp)" -t png - | wl-copy -t image/png gestures {
bind=SUPER,W,killactive, workspace_swipe = true
bind=SUPERSHIFT,Q,exit, }
bind=SUPER,S,togglefloating,
bind=SUPER,P,pin,
bindm=SUPER,mouse:272,movewindow misc {
bindm=SUPER,mouse:273,resizewindow no_vfr = false
disable_hyprland_logo = true
disable_splash_rendering = true
}
bind=SUPER,left,movefocus,l dwindle {
bind=SUPER,right,movefocus,r pseudotile=true
bind=SUPER,up,movefocus,u }
bind=SUPER,down,movefocus,d
bind=SUPER,1,workspace,1 bind=SUPER,RETURN,exec,footclient
bind=SUPER,2,workspace,2 bind=SUPER,f,exec,firefox-devedition
bind=SUPER,3,workspace,3 bind=SUPER,d,exec,wofi --show run,drun
bind=SUPER,4,workspace,4
bind=SUPER,5,workspace,5
bind=SUPER,6,workspace,6
bind=SUPER,7,workspace,7
bind=SUPER,8,workspace,8
bind=SUPER,9,workspace,9
bind=SUPER,0,workspace,10
bind=SUPER,grave,togglespecialworkspace
bind=ALT,1,movetoworkspace,1 bind=,Print,exec,grim -g "$(slurp)" -t png - | wl-copy -t image/png
bind=ALT,2,movetoworkspace,2 bind=SUPER,W,killactive,
bind=ALT,3,movetoworkspace,3 bind=SUPERSHIFT,Q,exit,
bind=ALT,4,movetoworkspace,4 bind=SUPER,S,togglefloating,
bind=ALT,5,movetoworkspace,5 bind=SUPER,P,pin,
bind=ALT,6,movetoworkspace,6
bind=ALT,7,movetoworkspace,7
bind=ALT,8,movetoworkspace,8
bind=ALT,9,movetoworkspace,9
bind=ALT,0,movetoworkspace,10
bind=ALT,grave,movetoworkspace,special
bind=SUPERSHIFT,1,movetoworkspacesilent,1 bindm=SUPER,mouse:272,movewindow
bind=SUPERSHIFT,2,movetoworkspacesilent,2 bindm=SUPER,mouse:273,resizewindow
bind=SUPERSHIFT,3,movetoworkspacesilent,3
bind=SUPERSHIFT,4,movetoworkspacesilent,4
bind=SUPERSHIFT,5,movetoworkspacesilent,5
bind=SUPERSHIFT,6,movetoworkspacesilent,6
bind=SUPERSHIFT,7,movetoworkspacesilent,7
bind=SUPERSHIFT,8,movetoworkspacesilent,8
bind=SUPERSHIFT,9,movetoworkspacesilent,9
bind=SUPERSHIFT,0,movetoworkspacesilent,10
bind=SUPERSHIFT,grave,movetoworkspacesilent,special
bind=SUPER,mouse_down,workspace,e+1 bind=SUPER,left,movefocus,l
bind=SUPER,mouse_up,workspace,e-1 bind=SUPER,right,movefocus,r
bind=SUPER,up,movefocus,u
bind=SUPER,down,movefocus,d
bind=SUPER,g,togglegroup bind=SUPER,1,workspace,1
bind=SUPER,tab,changegroupactive bind=SUPER,2,workspace,2
bind=SUPER,m,fullscreen,1 bind=SUPER,3,workspace,3
bind=SUPERSHIFT,m,fullscreen,0 bind=SUPER,4,workspace,4
bind=SUPER,5,workspace,5
bind=SUPER,6,workspace,6
bind=SUPER,7,workspace,7
bind=SUPER,8,workspace,8
bind=SUPER,9,workspace,9
bind=SUPER,0,workspace,10
bind=SUPER,grave,togglespecialworkspace
bind=,XF86MonBrightnessUp,exec,brightnessctl -q s +5% bind=ALT,1,movetoworkspace,1
bind=,XF86MonBrightnessDown,exec,brightnessctl -q s 5%- bind=ALT,2,movetoworkspace,2
bind=,XF86MonRaiseVolume,exec,pamixer -i 5 bind=ALT,3,movetoworkspace,3
bind=,XF86MonLowerVolume,exec,pamixer -d 5 bind=ALT,4,movetoworkspace,4
bind=,XF86AudioMute,exec,pamixer -t bind=ALT,5,movetoworkspace,5
bind=ALT,6,movetoworkspace,6
bind=ALT,7,movetoworkspace,7
bind=ALT,8,movetoworkspace,8
bind=ALT,9,movetoworkspace,9
bind=ALT,0,movetoworkspace,10
bind=ALT,grave,movetoworkspace,special
exec-once=${startup-script}/bin/startup bind=SUPERSHIFT,1,movetoworkspacesilent,1
''; bind=SUPERSHIFT,2,movetoworkspacesilent,2
}; bind=SUPERSHIFT,3,movetoworkspacesilent,3
bind=SUPERSHIFT,4,movetoworkspacesilent,4
bind=SUPERSHIFT,5,movetoworkspacesilent,5
bind=SUPERSHIFT,6,movetoworkspacesilent,6
bind=SUPERSHIFT,7,movetoworkspacesilent,7
bind=SUPERSHIFT,8,movetoworkspacesilent,8
bind=SUPERSHIFT,9,movetoworkspacesilent,9
bind=SUPERSHIFT,0,movetoworkspacesilent,10
bind=SUPERSHIFT,grave,movetoworkspacesilent,special
bind=SUPER,mouse_down,workspace,e+1
bind=SUPER,mouse_up,workspace,e-1
bind=SUPER,g,togglegroup
bind=SUPER,tab,changegroupactive
bind=SUPER,m,fullscreen,1
bind=SUPERSHIFT,m,fullscreen,0
bind=,XF86MonBrightnessUp,exec,brightnessctl -q s +5%
bind=,XF86MonBrightnessDown,exec,brightnessctl -q s 5%-
bind=,XF86MonRaiseVolume,exec,pamixer -i 5
bind=,XF86MonLowerVolume,exec,pamixer -d 5
bind=,XF86AudioMute,exec,pamixer -t
exec-once=${startup-script}/bin/startup
'';
};
} }

8
nixos/hosts/thalassa/null/home/neovim.nix
View File

@ -27,9 +27,11 @@
}; };
lsp = { lsp = {
enable = true; enable = true;
servers.rust-analyzer.enable = true; servers = {
servers.rnix-lsp.enable = true; rust-analyzer.enable = true;
servers.pyright.enable = true; rnix-lsp.enable = true;
pyright.enable = true;
};
}; };
nvim-cmp = { enable = true; }; nvim-cmp = { enable = true; };
}; };

79
nixos/hosts/thalassa/null/home/theme.nix
View File

@ -34,16 +34,48 @@ let
hex = mapAttrs (_name: value: "#${value}") colour; hex = mapAttrs (_name: value: "#${value}") colour;
}; };
in { in
home.file.".xsettingsd".text = '' {
Net/ThemeName "${theme}" home = {
Gtk/CursorThemeName "${cursorTheme}" file.".xsettingsd".text = ''
''; Net/ThemeName "${theme}"
Gtk/CursorThemeName "${cursorTheme}"
'';
home.pointerCursor = { pointerCursor = {
name = "Catppuccin-Frappe-Pink-Cursors"; name = "Catppuccin-Frappe-Pink-Cursors";
size = 32; size = 32;
package = pkgs.catppuccin-cursors.frappePink; package = pkgs.catppuccin-cursors.frappePink;
};
file.".config/eww/eww.scss".text = lib.mkBefore ''
$rosewater: ${colour.hex.rosewater};
$flamingo: ${colour.hex.flamingo};
$pink: ${colour.hex.pink};
$mauve: ${colour.hex.mauve};
$red: ${colour.hex.red};
$maroon: ${colour.hex.maroon};
$peach: ${colour.hex.peach};
$yellow: ${colour.hex.yellow};
$green: ${colour.hex.green};
$teal: ${colour.hex.teal};
$sky: ${colour.hex.sky};
$sapphire: ${colour.hex.sapphire};
$blue: ${colour.hex.blue};
$lavender: ${colour.hex.lavender};
$text: ${colour.hex.text};
$subtext0: ${colour.hex.subtext0};
$subtext1: ${colour.hex.subtext1};
$overlay0: ${colour.hex.overlay0};
$overlay1: ${colour.hex.overlay1};
$overlay2: ${colour.hex.overlay2};
$surface0: ${colour.hex.surface0};
$surface1: ${colour.hex.surface1};
$surface2: ${colour.hex.surface2};
$base: ${colour.hex.base};
$mantle: ${colour.hex.mantle};
$crust: ${colour.hex.crust};
'';
}; };
gtk = { gtk = {
@ -92,33 +124,4 @@ in {
textColor = colour.hex.text; textColor = colour.hex.text;
borderRadius = 5; borderRadius = 5;
}; };
home.file.".config/eww/eww.scss".text = lib.mkBefore ''
$rosewater: ${colour.hex.rosewater};
$flamingo: ${colour.hex.flamingo};
$pink: ${colour.hex.pink};
$mauve: ${colour.hex.mauve};
$red: ${colour.hex.red};
$maroon: ${colour.hex.maroon};
$peach: ${colour.hex.peach};
$yellow: ${colour.hex.yellow};
$green: ${colour.hex.green};
$teal: ${colour.hex.teal};
$sky: ${colour.hex.sky};
$sapphire: ${colour.hex.sapphire};
$blue: ${colour.hex.blue};
$lavender: ${colour.hex.lavender};
$text: ${colour.hex.text};
$subtext0: ${colour.hex.subtext0};
$subtext1: ${colour.hex.subtext1};
$overlay0: ${colour.hex.overlay0};
$overlay1: ${colour.hex.overlay1};
$overlay2: ${colour.hex.overlay2};
$surface0: ${colour.hex.surface0};
$surface1: ${colour.hex.surface1};
$surface2: ${colour.hex.surface2};
$base: ${colour.hex.base};
$mantle: ${colour.hex.mantle};
$crust: ${colour.hex.crust};
'';
} }

3
nixos/hosts/thalassa/null/rescue-boot.nix
View File

@ -13,7 +13,8 @@ let
boot.supportedFilesystems = [ "btrfs" "ext4" ]; boot.supportedFilesystems = [ "btrfs" "ext4" ];
environment.systemPackages = with pkgs; [ git ]; environment.systemPackages = with pkgs; [ git ];
}; };
in { in
{
boot.loader.systemd-boot = { boot.loader.systemd-boot = {
extraEntries = { extraEntries = {
"rescue.conf" = '' "rescue.conf" = ''

41
nixos/pkgs/glitch-soc/default.nix
View File

@ -1,9 +1,22 @@
{ lib, stdenv, nodejs-slim, bundlerEnv, nixosTests, yarn, callPackage { lib
, imagemagick, ffmpeg, file, ruby_3_0, writeShellScript, fetchYarnDeps , stdenv
, nodejs-slim
, bundlerEnv
, nixosTests
, yarn
, callPackage
, imagemagick
, ffmpeg
, file
, ruby_3_0
, writeShellScript
, fetchYarnDeps
, fixup_yarn_lock , fixup_yarn_lock
# Allow building a fork or custom version of Mastodon: # Allow building a fork or custom version of Mastodon:
, pname ? "mastodon", version ? import ./version.nix, srcOverride ? null , pname ? "mastodon"
, version ? import ./version.nix
, srcOverride ? null
, dependenciesDir ? ./. # Should contain gemset.nix, yarn.nix and package.json. , dependenciesDir ? ./. # Should contain gemset.nix, yarn.nix and package.json.
}: }:
@ -106,16 +119,18 @@ stdenv.mkDerivation rec {
ln -s /tmp tmp ln -s /tmp tmp
''; '';
installPhase = let installPhase =
run-streaming = writeShellScript "run-streaming.sh" '' let
# NixOS helper script to consistently use the same NodeJS version the package was built with. run-streaming = writeShellScript "run-streaming.sh" ''
${nodejs-slim}/bin/node ./streaming # NixOS helper script to consistently use the same NodeJS version the package was built with.
${nodejs-slim}/bin/node ./streaming
'';
in
''
mkdir -p $out
cp -r * $out/
ln -s ${run-streaming} $out/run-streaming.sh
''; '';
in ''
mkdir -p $out
cp -r * $out/
ln -s ${run-streaming} $out/run-streaming.sh
'';
passthru = { passthru = {
tests.mastodon = nixosTests.mastodon; tests.mastodon = nixosTests.mastodon;

2246
nixos/pkgs/glitch-soc/gemset.nix
View File

File diff suppressed because it is too large Load Diff

8
nixos/pkgs/glitch-soc/source.nix
View File

@ -1,11 +1,13 @@
# This file was generated by pkgs.mastodon.updateScript. # This file was generated by pkgs.mastodon.updateScript.
{ fetchgit, applyPatches }: let { fetchgit, applyPatches }:
let
src = fetchgit { src = fetchgit {
url = "https://github.com/glitch-soc/mastodon.git"; url = "https://github.com/glitch-soc/mastodon.git";
rev = "a1df9fdb06854bd55f018918236132ccfa7d9d84"; rev = "a1df9fdb06854bd55f018918236132ccfa7d9d84";
sha256 = "0amqiigq3qgag6qm119aaysmd2k93vwgr1aynxjxmbpn35ykcay3"; sha256 = "0amqiigq3qgag6qm119aaysmd2k93vwgr1aynxjxmbpn35ykcay3";
}; };
in applyPatches { in
applyPatches {
inherit src; inherit src;
patches = []; patches = [ ];
} }

17
nixos/pkgs/glitch-soc/update.nix
View File

@ -1,5 +1,14 @@
{ runCommand, lib, makeWrapper, yarn2nix, bundix, coreutils, diffutils { runCommand
, nix-prefetch-git, gnused, jq }: , lib
, makeWrapper
, yarn2nix
, bundix
, coreutils
, diffutils
, nix-prefetch-git
, gnused
, jq
}:
let let
binPath = lib.makeBinPath [ binPath = lib.makeBinPath [
yarn2nix yarn2nix
@ -10,7 +19,9 @@ let
gnused gnused
jq jq
]; ];
in runCommand "mastodon-update-script" { in
runCommand "mastodon-update-script"
{
nativeBuildInputs = [ makeWrapper ]; nativeBuildInputs = [ makeWrapper ];
meta = { meta = {

6
nixos/pkgs/plex-pass/raw.nix
View File

@ -2,8 +2,10 @@
let let
sources = builtins.fromJSON (builtins.readFile ./sources.json); sources = builtins.fromJSON (builtins.readFile ./sources.json);
source = lib.findFirst (x: x.platform == stdenv.hostPlatform.system) source = lib.findFirst (x: x.platform == stdenv.hostPlatform.system)
(throw "unsupported platform: ${stdenv.hostPlatform.system}") sources; (throw "unsupported platform: ${stdenv.hostPlatform.system}")
in plexRaw.overrideAttrs (attrs: { sources;
in
plexRaw.overrideAttrs (attrs: {
pname = attrs.pname + "-plexpass"; pname = attrs.pname + "-plexpass";
inherit (source) version; inherit (source) version;
src = fetchurl { src = fetchurl {

3
nixos/pkgs/roundcube-swipe/default.nix
View File

@ -6,7 +6,8 @@ let
mkdir -p $out/plugins/ mkdir -p $out/plugins/
cp -r ${src} $out/plugins/swipe cp -r ${src} $out/plugins/swipe
''; '';
in roundcubePlugin rec { in
roundcubePlugin rec {
pname = "roundcube-swipe"; pname = "roundcube-swipe";
version = "0.5"; version = "0.5";

47
nixos/util.nix
View File

@ -7,19 +7,21 @@ let
mailserver.nixosModules.mailserver mailserver.nixosModules.mailserver
attic.nixosModules.atticd attic.nixosModules.atticd
]; ];
type_import = let type_import =
import_cases = { let
"lxc" = [ import_cases = {
"${nixpkgs}/nixos/modules/virtualisation/lxc-container.nix" "lxc" = [
./common/generic-lxc.nix "${nixpkgs}/nixos/modules/virtualisation/lxc-container.nix"
]; ./common/generic-lxc.nix
"vm" = [ ./common/generic-vm.nix ]; ];
"local" = [ "vm" = [ ./common/generic-vm.nix ];
lanzaboote.nixosModules.lanzaboote "local" = [
./common/desktop lanzaboote.nixosModules.lanzaboote
]; ./common/desktop
}; ];
in type: import_cases.${type} ++ base_imports; };
in
type: import_cases.${type} ++ base_imports;
# Helper function to resolve what should be imported depending on the type of config (lxc, vm, bare metal) # Helper function to resolve what should be imported depending on the type of config (lxc, vm, bare metal)
resolve_imports = { hostname, realm, profile ? hostname, type ? "lxc", ... }: resolve_imports = { hostname, realm, profile ? hostname, type ? "lxc", ... }:
type_import type type_import type
@ -38,7 +40,7 @@ let
# Flatten all hosts to a single list # Flatten all hosts to a single list
flatten_hosts = realms: flatten_hosts = realms:
concatMap (mapAttrsToList (name: value: value // { hostname = name; })) concatMap (mapAttrsToList (name: value: value // { hostname = name; }))
(attrValues realms); (attrValues realms);
# Filter out all hosts which aren't nixos # Filter out all hosts which aren't nixos
filter_nix_hosts = filter ({ nix ? true, ... }: nix); filter_nix_hosts = filter ({ nix ? true, ... }: nix);
@ -46,12 +48,20 @@ let
# outputs # outputs
# Helper function to build a colmena host definition # Helper function to build a colmena host definition
mkColmenaHost = { ip ? null, exposes ? null, hostname, tags, realm mkColmenaHost =
, type ? "lxc", ... }@host: { ip ? null
, exposes ? null
, hostname
, tags
, realm
, type ? "lxc"
, ...
}@host:
let let
# this makes local apply work a bit nicer # this makes local apply work a bit nicer
name = if type == "local" then hostname else "${hostname}.${realm}"; name = if type == "local" then hostname else "${hostname}.${realm}";
in { in
{
"${name}" = { "${name}" = {
imports = resolve_imports host; imports = resolve_imports host;
networking = { networking = {
@ -73,4 +83,5 @@ let
hosts = add_realm_to_tags (import ./hosts); hosts = add_realm_to_tags (import ./hosts);
flat_hosts = flatten_hosts hosts; flat_hosts = flatten_hosts hosts;
nixHosts = filter_nix_hosts flat_hosts; nixHosts = filter_nix_hosts flat_hosts;
in { inherit base_imports mkColmenaHost hosts flat_hosts nixHosts; } in
{ inherit base_imports mkColmenaHost hosts flat_hosts nixHosts; }

3
repl.nix
View File

@ -1,6 +1,7 @@
let let
flake = builtins.getFlake (toString ./.); flake = builtins.getFlake (toString ./.);
nixpkgs = import <nixpkgs> { }; nixpkgs = import <nixpkgs> { };
in { in
{
inherit flake; inherit flake;
} // flake // builtins // nixpkgs // nixpkgs.lib // flake.nixosConfigurations } // flake // builtins // nixpkgs // nixpkgs.lib // flake.nixosConfigurations