Compare commits
6 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 DerGrumpf
|
3049a605a2 | ||
|
DerGrumpf
|
7dc85f8f9a | ||
|
DerGrumpf
|
1ecec8e0d6 | ||
|
DerGrumpf
|
544f7cf833 | ||
|
DerGrumpf
|
06a7a048cf | ||
|
DerGrumpf
|
da06bed086 |
+1
-1
@@ -2,7 +2,7 @@
|
||||
result
|
||||
result-*
|
||||
*.qcow2
|
||||
extra-files/*
|
||||
extra_files/*
|
||||
|
||||
# Ignore everything in the secrets directory
|
||||
secrets/*
|
||||
|
||||
Binary file not shown.
|
After Width: | Height: | Size: 1.3 MiB |
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
BIN
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
+1
-18
@@ -1,7 +1,6 @@
|
||||
{
|
||||
pkgs,
|
||||
primaryUser,
|
||||
lib,
|
||||
...
|
||||
}:
|
||||
{
|
||||
@@ -9,7 +8,6 @@
|
||||
./settings.nix
|
||||
./homebrew.nix
|
||||
./yabai.nix
|
||||
./wireguard.nix
|
||||
];
|
||||
|
||||
# nix config
|
||||
@@ -52,12 +50,6 @@
|
||||
info.enable = false; # Skip info pages
|
||||
};
|
||||
|
||||
# Mirrored Network conf
|
||||
networking.knownNetworkServices = [
|
||||
"Wi-Fi"
|
||||
"Ethernet"
|
||||
];
|
||||
|
||||
# homebrew installation manager
|
||||
nix-homebrew = {
|
||||
user = primaryUser;
|
||||
@@ -67,24 +59,15 @@
|
||||
|
||||
# macOS-specific settings
|
||||
programs.fish.enable = true;
|
||||
environment.shells = [ pkgs.fish ];
|
||||
system.primaryUser = primaryUser;
|
||||
users.users.${primaryUser} = {
|
||||
home = "/Users/${primaryUser}";
|
||||
shell = pkgs.fish;
|
||||
openssh.authorizedKeys.keyFiles = [ ../secrets/ssh-key ];
|
||||
};
|
||||
|
||||
environment = {
|
||||
shells = [ pkgs.fish ];
|
||||
systemPath = [ "/opt/homebrew/bin" ];
|
||||
pathsToLink = [ "/Applications" ];
|
||||
etc."hosts".text = lib.mkAfter ''
|
||||
10.10.0.1 proxy.cyperpunk.de
|
||||
10.10.0.2 controller.cyperpunk.de
|
||||
10.10.0.3 mac.cyperpunk.de
|
||||
10.10.0.30 node1.cyperpunk.de
|
||||
10.10.0.31 node2.cyperpunk.de
|
||||
10.10.0.40 desktop.cyperpunk.de
|
||||
'';
|
||||
};
|
||||
}
|
||||
|
||||
@@ -1,40 +0,0 @@
|
||||
{
|
||||
config,
|
||||
pkgs,
|
||||
hostName,
|
||||
...
|
||||
}:
|
||||
{
|
||||
sops.secrets."network/wireguard/${hostName}" = {
|
||||
mode = "0400";
|
||||
};
|
||||
|
||||
launchd.daemons.wireguard = {
|
||||
script = ''
|
||||
set -e
|
||||
mkdir -p /etc/wireguard
|
||||
PRIVATE_KEY=$(cat ${config.sops.secrets."network/wireguard/${hostName}".path})
|
||||
cat > /etc/wireguard/wg0.conf << EOF
|
||||
[Interface]
|
||||
Address = $WG_IP
|
||||
PrivateKey = $PRIVATE_KEY
|
||||
|
||||
[Peer]
|
||||
PublicKey = NjMYaUZO/iPRM/J46qyPPuWYg5oSeAUxjocMs/hYTXs=
|
||||
Endpoint = 178.254.8.35:51820
|
||||
AllowedIPs = 10.10.0.0/24
|
||||
PersistentKeepalive = 25
|
||||
EOF
|
||||
chmod 600 /etc/wireguard/wg0.conf
|
||||
${pkgs.wireguard-tools}/bin/wg-quick up wg0
|
||||
'';
|
||||
environment.WG_IP = "";
|
||||
serviceConfig = {
|
||||
Label = "org.wireguard.wg0";
|
||||
RunAtLoad = true;
|
||||
KeepAlive = false;
|
||||
StandardOutPath = "/var/log/wireguard.log";
|
||||
StandardErrorPath = "/var/log/wireguard.log";
|
||||
};
|
||||
};
|
||||
}
|
||||
Generated
+30
-239
@@ -57,11 +57,11 @@
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1782648384,
|
||||
"narHash": "sha256-OlHdAqdXasZk1U+Zf9n+ivqHL9kj/UD0DFO4yYTNBYc=",
|
||||
"lastModified": 1782117778,
|
||||
"narHash": "sha256-x6vIJpJziw3Hs0JKKDP+AeRPWwqyMDOmK6I26tqbYj4=",
|
||||
"owner": "catppuccin",
|
||||
"repo": "nix",
|
||||
"rev": "f2c7dd14ecce785c206a39466cbe227ff62e3803",
|
||||
"rev": "e98afe2dfd950bda4e6a8ef32bb563ec2f04505a",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -90,48 +90,6 @@
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"disko": {
|
||||
"inputs": {
|
||||
"nixpkgs": [
|
||||
"nixpkgs"
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1781152676,
|
||||
"narHash": "sha256-RxWs5ND31KzTG7wvMM+PMfUjyNpmIEr999lqNARaM5o=",
|
||||
"owner": "nix-community",
|
||||
"repo": "disko",
|
||||
"rev": "ff8702b4de27f72b4c78573dfb89ec74e36abdf1",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "nix-community",
|
||||
"repo": "disko",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"disko_2": {
|
||||
"inputs": {
|
||||
"nixpkgs": [
|
||||
"nixos-anywhere",
|
||||
"nixpkgs"
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1781152676,
|
||||
"narHash": "sha256-RxWs5ND31KzTG7wvMM+PMfUjyNpmIEr999lqNARaM5o=",
|
||||
"owner": "nix-community",
|
||||
"repo": "disko",
|
||||
"rev": "ff8702b4de27f72b4c78573dfb89ec74e36abdf1",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "nix-community",
|
||||
"ref": "master",
|
||||
"repo": "disko",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"flake-compat": {
|
||||
"flake": false,
|
||||
"locked": {
|
||||
@@ -251,11 +209,11 @@
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1781788787,
|
||||
"narHash": "sha256-YqlTCRRhGvNjcJejPeMuHrYQ/TVhOO2MV/nEGMWb8nk=",
|
||||
"lastModified": 1782358560,
|
||||
"narHash": "sha256-vCcLh9pw3XO/+Lxk8r6xv6QnoCrTfGqiACcI7O637Wg=",
|
||||
"owner": "nix-community",
|
||||
"repo": "home-manager",
|
||||
"rev": "d456f483f157d4b706416005da226234b9c116ff",
|
||||
"rev": "3a70e333f2950c302e875c44cfcfaff3f80f36bc",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -265,27 +223,6 @@
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"home-manager_2": {
|
||||
"inputs": {
|
||||
"nixpkgs": [
|
||||
"impermanence",
|
||||
"nixpkgs"
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1768598210,
|
||||
"narHash": "sha256-kkgA32s/f4jaa4UG+2f8C225Qvclxnqs76mf8zvTVPg=",
|
||||
"owner": "nix-community",
|
||||
"repo": "home-manager",
|
||||
"rev": "c47b2cc64a629f8e075de52e4742de688f930dc6",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "nix-community",
|
||||
"repo": "home-manager",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"hyprcursor": {
|
||||
"inputs": {
|
||||
"hyprlang": "hyprlang",
|
||||
@@ -383,11 +320,11 @@
|
||||
"xdph": "xdph"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1781796010,
|
||||
"narHash": "sha256-bIqjZgUfp3vba/C1UJLVqTo8zdpfqMDvuwWrHmqDWm4=",
|
||||
"lastModified": 1782366482,
|
||||
"narHash": "sha256-J+yvgoF+zbYZHJkGxfMCPWa8L3i5Nm7Xlgfw2Eky/Xs=",
|
||||
"owner": "hyprwm",
|
||||
"repo": "Hyprland",
|
||||
"rev": "ae1690c2138313d988c81f5c25a9d0b6fadfd3b1",
|
||||
"rev": "c9e1a6c3a05c0310424f99c6b90af1164340af99",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -710,25 +647,6 @@
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"impermanence": {
|
||||
"inputs": {
|
||||
"home-manager": "home-manager_2",
|
||||
"nixpkgs": "nixpkgs_2"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1769548169,
|
||||
"narHash": "sha256-03+JxvzmfwRu+5JafM0DLbxgHttOQZkUtDWBmeUkN8Y=",
|
||||
"owner": "nix-community",
|
||||
"repo": "impermanence",
|
||||
"rev": "7b1d382faf603b6d264f58627330f9faa5cba149",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "nix-community",
|
||||
"repo": "impermanence",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"nix-homebrew": {
|
||||
"inputs": {
|
||||
"brew-src": "brew-src"
|
||||
@@ -747,27 +665,6 @@
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"nix-vm-test": {
|
||||
"inputs": {
|
||||
"nixpkgs": [
|
||||
"nixos-anywhere",
|
||||
"nixpkgs"
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1781506385,
|
||||
"narHash": "sha256-kvTBHLiqB911yf2D9VThIRfB6Ai/E2H9+mVF0wR+9AY=",
|
||||
"owner": "numtide",
|
||||
"repo": "nix-vm-test",
|
||||
"rev": "2071ebc1f5b2a2e0211a2ca38c4e678092df76a5",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "numtide",
|
||||
"repo": "nix-vm-test",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"nixcord": {
|
||||
"inputs": {
|
||||
"flake-compat": "flake-compat_2",
|
||||
@@ -778,11 +675,11 @@
|
||||
"nixpkgs-nixcord": "nixpkgs-nixcord"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1781775854,
|
||||
"narHash": "sha256-0eb1+zKSTwgD3qsBm7UiuRabahHQNkTP94Z/s3nMK60=",
|
||||
"lastModified": 1782349937,
|
||||
"narHash": "sha256-2haY6BBTL+yCblUup/P9t3D8sUTMSqIok68n+qGjjYI=",
|
||||
"owner": "kaylorben",
|
||||
"repo": "nixcord",
|
||||
"rev": "b92ceb7923c87dfcfcf84415407b0ca63e17548b",
|
||||
"rev": "afdacaafb10aa459dfabbb8af99e4b0deb74f1d2",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -791,72 +688,6 @@
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"nixos-anywhere": {
|
||||
"inputs": {
|
||||
"disko": "disko_2",
|
||||
"nix-vm-test": "nix-vm-test",
|
||||
"nixos-images": "nixos-images",
|
||||
"nixos-stable": "nixos-stable",
|
||||
"nixpkgs": [
|
||||
"nixpkgs"
|
||||
],
|
||||
"treefmt-nix": "treefmt-nix"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1782285665,
|
||||
"narHash": "sha256-ISUNn+z9+BIDGRrNAmEfghvzFmDgKtGHGEYqIDvGeWk=",
|
||||
"owner": "nix-community",
|
||||
"repo": "nixos-anywhere",
|
||||
"rev": "4b74194d2927a7741d023b3fd2a0d252059f75ee",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "nix-community",
|
||||
"repo": "nixos-anywhere",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"nixos-images": {
|
||||
"inputs": {
|
||||
"nixos-stable": [
|
||||
"nixos-anywhere",
|
||||
"nixos-stable"
|
||||
],
|
||||
"nixos-unstable": [
|
||||
"nixos-anywhere",
|
||||
"nixpkgs"
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1781778781,
|
||||
"narHash": "sha256-CYnhWtKIr0xbxQT6N0X1j0FsmCG+cDV498jyO0xevwQ=",
|
||||
"owner": "nix-community",
|
||||
"repo": "nixos-images",
|
||||
"rev": "94cbd4c8da5f130f188af04293514926a947b380",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "nix-community",
|
||||
"repo": "nixos-images",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"nixos-stable": {
|
||||
"locked": {
|
||||
"lastModified": 1782116945,
|
||||
"narHash": "sha256-G3tw/IXmaH6IQ2upZvhuN9sG8CkuX+BLuJDpE8hz0Ds=",
|
||||
"owner": "NixOS",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "34268251cf5547d39063f2c5ea9a196246f7f3a6",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "NixOS",
|
||||
"ref": "nixos-26.05",
|
||||
"repo": "nixpkgs",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"nixpkgs": {
|
||||
"locked": {
|
||||
"lastModified": 1780749050,
|
||||
@@ -905,22 +736,6 @@
|
||||
}
|
||||
},
|
||||
"nixpkgs_2": {
|
||||
"locked": {
|
||||
"lastModified": 1768564909,
|
||||
"narHash": "sha256-Kell/SpJYVkHWMvnhqJz/8DqQg2b6PguxVWOuadbHCc=",
|
||||
"owner": "nixos",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "e4bae1bd10c9c57b2cf517953ab70060a828ee6f",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "nixos",
|
||||
"ref": "nixos-unstable",
|
||||
"repo": "nixpkgs",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"nixpkgs_3": {
|
||||
"locked": {
|
||||
"lastModified": 1781577229,
|
||||
"narHash": "sha256-lrp67w8AulE9Ks53n27I45ADSzbOCn4H+CNW1Ck8B+8=",
|
||||
@@ -936,13 +751,13 @@
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"nixpkgs_4": {
|
||||
"nixpkgs_3": {
|
||||
"locked": {
|
||||
"lastModified": 1782175435,
|
||||
"narHash": "sha256-EMzXKmnOtBQ2MnvpiNOm7E+kOMvdPrIKaeg52Tip2Uk=",
|
||||
"lastModified": 1781607440,
|
||||
"narHash": "sha256-rxO+uc/KFbSJp+pgyXRuAX6QlG9hJdnt0BXpEQRXY+U=",
|
||||
"owner": "NixOS",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "89570f24e97e614aa34aa9ab1c927b6578a43775",
|
||||
"rev": "3e41b24abd260e8f71dbe2f5737d24122f972158",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -955,15 +770,15 @@
|
||||
"nixvim": {
|
||||
"inputs": {
|
||||
"flake-parts": "flake-parts_2",
|
||||
"nixpkgs": "nixpkgs_4",
|
||||
"nixpkgs": "nixpkgs_3",
|
||||
"systems": "systems_3"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1781713417,
|
||||
"narHash": "sha256-Kaj44jTNmnaFhKrcADx8nXmUYPa7l2HYfb7m6lEPy7Q=",
|
||||
"lastModified": 1782254890,
|
||||
"narHash": "sha256-kjsEECqhpPnJWqhooXp6tWh2qGQftCPAo2G1GvZtKdw=",
|
||||
"owner": "nix-community",
|
||||
"repo": "nixvim",
|
||||
"rev": "caee4e5d4161778815f522d9ea1c9e3dc42462b7",
|
||||
"rev": "dbf9550dba8448b03e11d58e5695d6c44a464554",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -980,11 +795,11 @@
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1781800183,
|
||||
"narHash": "sha256-NcRZr/JQiAvqC2qCyMxcfx/98Hf1epwdtjcbwKHeMf8=",
|
||||
"lastModified": 1782389847,
|
||||
"narHash": "sha256-eP8eqJcG07GXr/mNOm6xS4ws+7sKw8pPk9xbAf11tb8=",
|
||||
"owner": "nix-community",
|
||||
"repo": "NUR",
|
||||
"rev": "0559d992b12ee209570bb325d79e90007b13da52",
|
||||
"rev": "a573a709b3b6778499500cdea3ea134faef25218",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -1020,16 +835,13 @@
|
||||
"inputs": {
|
||||
"catppuccin": "catppuccin",
|
||||
"darwin": "darwin",
|
||||
"disko": "disko",
|
||||
"home-manager": "home-manager",
|
||||
"hyprcursor": "hyprcursor",
|
||||
"hyprland": "hyprland",
|
||||
"hyprland-plugins": "hyprland-plugins",
|
||||
"impermanence": "impermanence",
|
||||
"nix-homebrew": "nix-homebrew",
|
||||
"nixcord": "nixcord",
|
||||
"nixos-anywhere": "nixos-anywhere",
|
||||
"nixpkgs": "nixpkgs_3",
|
||||
"nixpkgs": "nixpkgs_2",
|
||||
"nixvim": "nixvim",
|
||||
"nur": "nur",
|
||||
"sops-nix": "sops-nix",
|
||||
@@ -1043,11 +855,11 @@
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1780547341,
|
||||
"narHash": "sha256-Gq8KNx5A7hBB3uGJaj6eQfLDIz5YdLu92gqBcvHvoUo=",
|
||||
"lastModified": 1782165805,
|
||||
"narHash": "sha256-478kKQBvK6SYTOdN2h9jhKJv94nbXRbFMfuL1WshErg=",
|
||||
"owner": "Mic92",
|
||||
"repo": "sops-nix",
|
||||
"rev": "9ed65852b6257fbeae4355bc24ecfea307ca759a",
|
||||
"rev": "56b24064fdcaedca53553b1a6d607fd23b613a24",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -1064,11 +876,11 @@
|
||||
"systems": "systems_4"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1781425310,
|
||||
"narHash": "sha256-GTBka4Df/ZOacmisI/DI2LICyNChEqn/giah83LucdM=",
|
||||
"lastModified": 1782031037,
|
||||
"narHash": "sha256-a7oWSyS7SN81UOqVt481yIEMDsMpaJ7GNdV6Eaz5Yqg=",
|
||||
"owner": "Gerg-L",
|
||||
"repo": "spicetify-nix",
|
||||
"rev": "aeaf7c81a45d3761da61cb05bfc370ac6d1b0441",
|
||||
"rev": "9cb27462cfd20edac174353f1e95bc03aa888863",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -1138,27 +950,6 @@
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"treefmt-nix": {
|
||||
"inputs": {
|
||||
"nixpkgs": [
|
||||
"nixos-anywhere",
|
||||
"nixpkgs"
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1780220602,
|
||||
"narHash": "sha256-eynAfOmbmxJnkp7YewvCEbShNnnYJ9gLLqkzsYtBPeM=",
|
||||
"owner": "numtide",
|
||||
"repo": "treefmt-nix",
|
||||
"rev": "db947814a175b7ca6ded66e21383d938df01c227",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "numtide",
|
||||
"repo": "treefmt-nix",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"xdph": {
|
||||
"inputs": {
|
||||
"hyprland-protocols": [
|
||||
|
||||
@@ -5,23 +5,6 @@
|
||||
# monorepo w/ recipes ("derivations")
|
||||
nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";
|
||||
|
||||
# declarative disk layout
|
||||
disko = {
|
||||
url = "github:nix-community/disko";
|
||||
inputs.nixpkgs.follows = "nixpkgs";
|
||||
};
|
||||
|
||||
# declarative impermanence
|
||||
impermanence = {
|
||||
url = "github:nix-community/impermanence";
|
||||
};
|
||||
|
||||
# declarative installer
|
||||
nixos-anywhere = {
|
||||
url = "github:nix-community/nixos-anywhere";
|
||||
inputs.nixpkgs.follows = "nixpkgs";
|
||||
};
|
||||
|
||||
# declarative Configs
|
||||
home-manager = {
|
||||
url = "github:nix-community/home-manager/master";
|
||||
@@ -101,54 +84,86 @@
|
||||
hyprland,
|
||||
sops-nix,
|
||||
nur,
|
||||
impermanence,
|
||||
disko,
|
||||
nixos-anywhere,
|
||||
...
|
||||
}@inputs:
|
||||
let
|
||||
primaryUser = "phil";
|
||||
|
||||
installer = nixpkgs.lib.nixosSystem {
|
||||
system = "x86_64-linux";
|
||||
specialArgs = { inherit inputs; };
|
||||
modules = [
|
||||
{
|
||||
nixpkgs = {
|
||||
config.allowUnfree = true;
|
||||
hostPlatform = "x86_64-linux";
|
||||
};
|
||||
}
|
||||
./hosts/installer/configuration.nix
|
||||
];
|
||||
};
|
||||
/*
|
||||
mkIso - Build a NixOS image for a given target.
|
||||
|
||||
mkInstall =
|
||||
Available targets (imageModule → imageBuildAttr):
|
||||
ISO (minimal) : "${nixpkgs}/nixos/modules/installer/cd-dvd/installation-cd-minimal.nix" → "isoImage"
|
||||
ISO (graphical): "${nixpkgs}/nixos/modules/installer/cd-dvd/installation-cd-graphical-gnome.nix" → "isoImage"
|
||||
Amazon EC2 : "${nixpkgs}/nixos/modules/virtualisation/amazon-image.nix" → "amazonImage"
|
||||
Linode : "${nixpkgs}/nixos/modules/virtualisation/linode-image.nix" → "linodeImage"
|
||||
Proxmox LXC : "${nixpkgs}/nixos/modules/virtualisation/proxmox-lxc.nix" → "tarball"
|
||||
Google Cloud : "${nixpkgs}/nixos/modules/virtualisation/google-compute-image.nix" → "googleComputeImage"
|
||||
Azure : "${nixpkgs}/nixos/modules/virtualisation/azure-image.nix" → "azureImage"
|
||||
QEMU (runnable): "${nixpkgs}/nixos/modules/virtualisation/qemu-vm.nix" → "vm"
|
||||
QEMU (headless): "${nixpkgs}/nixos/modules/virtualisation/qemu-vm.nix" → "vmWithBootLoader"
|
||||
- Claude Sonnet 4.6
|
||||
*/
|
||||
mkIso =
|
||||
{
|
||||
hostName,
|
||||
target ? "192.168.2.99",
|
||||
isDarwin ? false,
|
||||
isServer ? false,
|
||||
imageModule ? "${nixpkgs}/nixos/modules/installer/cd-dvd/installation-cd-minimal.nix",
|
||||
imageBuildAttr ? "isoImage",
|
||||
}:
|
||||
let
|
||||
pkgs = nixpkgs.legacyPackages.x86_64-linux;
|
||||
in
|
||||
{
|
||||
type = "app";
|
||||
program = "${
|
||||
pkgs.writeShellApplication {
|
||||
name = "install-${hostName}";
|
||||
runtimeInputs = [ nixos-anywhere.packages.x86_64-linux.nixos-anywhere ];
|
||||
text = ''
|
||||
EXTRA_FILES="''${1:-./extra-files}"
|
||||
TARGET="''${2:-${target}}"
|
||||
nixos-anywhere \
|
||||
--flake .#${hostName} \
|
||||
--extra-files "$EXTRA_FILES" \
|
||||
--chown /persist/secrets/age-key.txt "$(id -u ${primaryUser})":100 \
|
||||
root@"$TARGET"
|
||||
'';
|
||||
(nixpkgs.lib.nixosSystem {
|
||||
system = "x86_64-linux";
|
||||
specialArgs = {
|
||||
inherit
|
||||
inputs
|
||||
primaryUser
|
||||
self
|
||||
hostName
|
||||
isDarwin
|
||||
isServer
|
||||
;
|
||||
};
|
||||
modules = [
|
||||
imageModule
|
||||
{
|
||||
nixpkgs.overlays = [
|
||||
inputs.nur.overlays.default
|
||||
(import ./overlays { inherit (inputs) nur; })
|
||||
];
|
||||
}
|
||||
}/bin/install-${hostName}";
|
||||
};
|
||||
{ nixpkgs.config.allowUnfree = true; }
|
||||
{ nixpkgs.hostPlatform = "x86_64-linux"; }
|
||||
{ networking.hostName = hostName; }
|
||||
./hosts/${hostName}/configuration.nix
|
||||
./nixos
|
||||
inputs.sops-nix.nixosModules.sops
|
||||
inputs.home-manager.nixosModules.home-manager
|
||||
{
|
||||
home-manager = {
|
||||
extraSpecialArgs = {
|
||||
inherit
|
||||
inputs
|
||||
primaryUser
|
||||
self
|
||||
hostName
|
||||
isDarwin
|
||||
isServer
|
||||
;
|
||||
};
|
||||
users.${primaryUser} = import ./home;
|
||||
backupFileExtension = "backup";
|
||||
useGlobalPkgs = true;
|
||||
useUserPackages = true;
|
||||
sharedModules = [
|
||||
{
|
||||
programs.nixvim.nixpkgs.source = inputs.nixpkgs;
|
||||
}
|
||||
];
|
||||
};
|
||||
}
|
||||
];
|
||||
}).config.system.build.${imageBuildAttr};
|
||||
|
||||
mkSystem =
|
||||
{
|
||||
@@ -190,6 +205,11 @@
|
||||
backupFileExtension = "hm-backup";
|
||||
useGlobalPkgs = true;
|
||||
useUserPackages = true;
|
||||
sharedModules = [
|
||||
{
|
||||
programs.nixvim.nixpkgs.source = inputs.nixpkgs;
|
||||
}
|
||||
];
|
||||
};
|
||||
}
|
||||
];
|
||||
@@ -204,8 +224,6 @@
|
||||
[
|
||||
{ nixpkgs.hostPlatform = system; }
|
||||
./nixos
|
||||
inputs.impermanence.nixosModules.impermanence
|
||||
inputs.disko.nixosModules.disko
|
||||
];
|
||||
|
||||
in
|
||||
@@ -217,8 +235,6 @@
|
||||
in
|
||||
{
|
||||
nixosConfigurations = {
|
||||
"installer" = installer;
|
||||
|
||||
"cyper-desktop" = mkSystem {
|
||||
hostName = "cyper-desktop";
|
||||
system = "x86_64-linux";
|
||||
@@ -256,28 +272,25 @@
|
||||
};
|
||||
|
||||
packages.x86_64-linux = {
|
||||
installer = self.nixosConfigurations.installer.config.system.build.isoImage;
|
||||
cyper-desktop-iso = mkIso { hostName = "cyper-desktop"; };
|
||||
cyper-controller-iso = mkIso {
|
||||
hostName = "cyper-controller";
|
||||
isServer = true;
|
||||
};
|
||||
cyper-proxy-iso = mkIso {
|
||||
hostName = "cyper-proxy";
|
||||
isServer = true;
|
||||
};
|
||||
cyper-node-1-iso = mkIso {
|
||||
hostName = "cyper-node-1";
|
||||
isServer = true;
|
||||
};
|
||||
cyper-node-2-iso = mkIso {
|
||||
hostName = "cyper-node-2";
|
||||
isServer = true;
|
||||
};
|
||||
};
|
||||
|
||||
formatter.x86_64-linux = nixpkgs.legacyPackages.x86_64-linux.nixfmt-tree;
|
||||
|
||||
apps.x86_64-linux = {
|
||||
install-cyper-node-1 = mkInstall {
|
||||
hostName = "cyper-node-1";
|
||||
};
|
||||
install-cyper-node-2 = mkInstall {
|
||||
hostName = "cyper-node-2";
|
||||
};
|
||||
install-cyper-controller = mkInstall {
|
||||
hostName = "cyper-controller";
|
||||
};
|
||||
install-cyper-proxy = mkInstall {
|
||||
hostName = "cyper-proxy";
|
||||
target = ""; # KVM console IP
|
||||
};
|
||||
install-cyper-desktop = mkInstall {
|
||||
hostName = "cyper-desktop";
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
|
||||
+7
-7
@@ -43,8 +43,8 @@
|
||||
enableNixpkgsReleaseCheck = false;
|
||||
stateVersion = "26.05";
|
||||
sessionVariables = lib.mkIf (!isDarwin && !isServer) {
|
||||
GROQ_API_KEY = config.sops.secrets."api_keys/groq".path;
|
||||
OPENWEATHER_API_KEY = config.sops.secrets."api_keys/openweather".path;
|
||||
GROQ_API_KEY = config.sops.secrets.GROQ_API_KEY.path;
|
||||
OPENWEATHER_API_KEY = config.sops.secrets.OPENWEATHER_API_KEY.path;
|
||||
};
|
||||
file = lib.mkIf (!isServer) {
|
||||
"Pictures/Avatar" = {
|
||||
@@ -65,15 +65,15 @@
|
||||
if isDarwin then
|
||||
"/Users/${primaryUser}/.config/nix/secrets/keys.txt"
|
||||
else
|
||||
"/persist/secrets/age-key.txt";
|
||||
"/home/${primaryUser}/.config/nix/secrets/keys.txt";
|
||||
secrets = {
|
||||
"api_keys/groq" = { };
|
||||
"api_keys/openweather" = { };
|
||||
"ssh/private_key" = {
|
||||
GROQ_API_KEY = { };
|
||||
OPENWEATHER_API_KEY = { };
|
||||
ssh_private_key = {
|
||||
path = if isDarwin then "/Users/${primaryUser}/.ssh/ssh" else "/home/${primaryUser}/.ssh/ssh";
|
||||
mode = "0600";
|
||||
};
|
||||
"ssh/github_key" = {
|
||||
ssh_github_key = {
|
||||
path = if isDarwin then "/Users/${primaryUser}/.ssh/github" else "/home/${primaryUser}/.ssh/github";
|
||||
mode = "0600";
|
||||
};
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
{
|
||||
_: {
|
||||
imports = [
|
||||
./hyprland
|
||||
./rofi
|
||||
|
||||
@@ -8,6 +8,12 @@ in
|
||||
packages = with pkgs; [
|
||||
adwaita-icon-theme
|
||||
];
|
||||
#pointerCursor = {
|
||||
# gtk.enable = true;
|
||||
# name = "catppuccin-mocha-sapphire-cursors";
|
||||
# package = pkgs.catppuccin-cursors.mochaSapphire;
|
||||
# size = 24;
|
||||
#};
|
||||
file = {
|
||||
".config/gtk-4.0/gtk.css".source = "${theme}/share/themes/${theme_name}/gtk-4.0/gtk.css";
|
||||
".config/gtk-4.0/gtk-dark.css".source = "${theme}/share/themes/${theme_name}/gtk-4.0/gtk-dark.css";
|
||||
|
||||
@@ -15,7 +15,6 @@
|
||||
pamixer
|
||||
brightnessctl
|
||||
playerctl
|
||||
waypaper
|
||||
];
|
||||
|
||||
systemd.user.targets.hyprland-session.Unit.Wants = [ "xdg-desktop-autostart.target" ];
|
||||
|
||||
@@ -1,4 +1,6 @@
|
||||
{ ... }:
|
||||
{
|
||||
# Hypridle configuration
|
||||
services.hypridle = {
|
||||
enable = true;
|
||||
settings = {
|
||||
@@ -6,7 +8,7 @@
|
||||
after_sleep_cmd = "hyprctl dispatch dpms on";
|
||||
ignore_dbus_inhibit = false;
|
||||
lock_cmd = "hyprlock";
|
||||
before_sleep_cmd = "notify-send -u critical \"I'm getting sleepy… I'll see you in my code dreams 💖\" --app-name=Hyprlock";
|
||||
before_sleep_cmd = "notify-send -u critical \"I'm getting sleepy… I'll see you in my code dreams 💖\" --icon=$HOME/.config/hypr/avatar.png --app-name=Hyprlock";
|
||||
};
|
||||
|
||||
listener = [
|
||||
|
||||
@@ -1,4 +1,8 @@
|
||||
{ ... }:
|
||||
|
||||
{
|
||||
|
||||
# Hyprlock configuration
|
||||
programs.hyprlock = {
|
||||
enable = true;
|
||||
settings = {
|
||||
@@ -14,7 +18,7 @@
|
||||
|
||||
background = [
|
||||
{
|
||||
path = "$HOME/Pictures/Wallpapers/lucy_with_cat.png";
|
||||
path = "~/Pictures/Wallpapers/lucy_with_cat.png";
|
||||
blur_passes = 1;
|
||||
blur_size = 5;
|
||||
}
|
||||
@@ -77,7 +81,7 @@
|
||||
outline_thickness = 4;
|
||||
dots_size = 0.2;
|
||||
dots_spacing = 0.2;
|
||||
dots_center = true;
|
||||
dots_center = "true";
|
||||
outer_color = "$red";
|
||||
inner_color = "$surface0";
|
||||
font_color = "$text";
|
||||
@@ -93,17 +97,16 @@
|
||||
valign = "center";
|
||||
};
|
||||
|
||||
image = [
|
||||
{
|
||||
monitor = "";
|
||||
path = "$HOME/Pictures/Avatar/miku_happy_sparkels.png";
|
||||
size = 300;
|
||||
border_color = "$teal";
|
||||
position = "0, 75";
|
||||
halign = "center";
|
||||
valign = "center";
|
||||
}
|
||||
];
|
||||
image = {
|
||||
monitor = "";
|
||||
path = "~/.config/hypr/avatar/avatar.png";
|
||||
size = 300;
|
||||
border_color = "$teal";
|
||||
position = "0, 75";
|
||||
halign = "center";
|
||||
valign = "center";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
}
|
||||
|
||||
@@ -1,3 +1,4 @@
|
||||
{ ... }:
|
||||
{
|
||||
services.mako = {
|
||||
enable = true;
|
||||
|
||||
+3
-3
@@ -6,10 +6,10 @@
|
||||
platformTheme.name = "kvantum";
|
||||
};
|
||||
home.packages = lib.mkIf (!pkgs.stdenv.isDarwin) (
|
||||
with pkgs.kdePackages;
|
||||
with pkgs;
|
||||
[
|
||||
qt6ct
|
||||
qtstyleplugin-kvantum
|
||||
kdePackages.qt6ct
|
||||
kdePackages.qtstyleplugin-kvantum
|
||||
]
|
||||
);
|
||||
}
|
||||
|
||||
@@ -150,11 +150,11 @@
|
||||
format = "{}";
|
||||
return-type = "json";
|
||||
exec = ''
|
||||
curl -sf --max-time 10 "https://api.openweathermap.org/data/2.5/weather?lat=52.281311&lon=10.527029&appid=$(cat ~/.config/sops-nix/secrets/api_keys/openweather)&units=metric&lang=en" | jq -c '{text: "\(.name) \(.main.temp)C°"}'
|
||||
curl -sf --max-time 10 "https://api.openweathermap.org/data/2.5/weather?lat=52.281311&lon=10.527029&appid=$(cat ~/.config/sops-nix/secrets/OPENWEATHER_API_KEY)&units=metric&lang=en" | jq -c '{text: "\(.name) \(.main.temp)C°"}'
|
||||
'';
|
||||
interval = 120;
|
||||
on-click = ''
|
||||
data=$(curl -sf --max-time 10 "https://api.openweathermap.org/data/2.5/weather?lat=52.281311&lon=10.527029&appid=$(cat ~/.config/sops-nix/secrets/api_keys/openweather)&units=metric&lang=en")
|
||||
data=$(curl -sf --max-time 10 "https://api.openweathermap.org/data/2.5/weather?lat=52.281311&lon=10.527029&appid=$(cat ~/.config/sops-nix/secrets/OPENWEATHER_API_KEY)&units=metric&lang=en")
|
||||
city=$(echo "$data" | jq -r '.name')
|
||||
temp=$(echo "$data" | jq -r '.main.temp')
|
||||
feels=$(echo "$data" | jq -r '.main.feels_like')
|
||||
@@ -163,7 +163,7 @@
|
||||
clouds=$(echo "$data" | jq -r '.clouds.all')
|
||||
sunrise=$(echo "$data" | jq -r '.sys.sunrise | strftime("%H:%M")')
|
||||
sunset=$(echo "$data" | jq -r '.sys.sunset | strftime("%H:%M")')
|
||||
notify-send "$city" "Temperature: $temp °C\nFeels Like: $feels °C\nHumidity: $humidity%\nWind: $wind m/s\nClouds: $clouds%\nSunrise at: $sunrise\nSunset at: $sunset" -u normal --icon="$HOME/Pictures/Avatar/miku_window_no_bg.png"
|
||||
notify-send "$city" "Temperature: $temp °C\nFeels Like: $feels °C\nHumidity: $humidity%\nWind: $wind m/s\nClouds: $clouds%\nSunrise at: $sunrise\nSunset at: $sunset" -u normal --icon="$HOME/Pictures/Avatar/avatar_weather_no_bg.png"
|
||||
'';
|
||||
};
|
||||
|
||||
|
||||
@@ -13,14 +13,12 @@
|
||||
// (import ./dual.nix { inherit compositor; })
|
||||
);
|
||||
|
||||
home = {
|
||||
packages = lib.mkIf (!pkgs.stdenv.isDarwin) (with pkgs; [ cava ]);
|
||||
home.packages = lib.mkIf (!pkgs.stdenv.isDarwin) (with pkgs; [ cava ]);
|
||||
|
||||
file = lib.mkIf (!pkgs.stdenv.isDarwin) {
|
||||
".config/waybar" = {
|
||||
source = ./configs;
|
||||
recursive = true;
|
||||
};
|
||||
home.file = lib.mkIf (!pkgs.stdenv.isDarwin) {
|
||||
".config/waybar" = {
|
||||
source = ./configs;
|
||||
recursive = true;
|
||||
};
|
||||
};
|
||||
}
|
||||
|
||||
@@ -0,0 +1,31 @@
|
||||
{
|
||||
widgets = {
|
||||
"niri/workspaces" = {
|
||||
format = "{icon}";
|
||||
format-icons = {
|
||||
default = "";
|
||||
active = "";
|
||||
};
|
||||
};
|
||||
"custom/swaync" = {
|
||||
tooltip = false;
|
||||
format = "{icon}";
|
||||
format-icons = {
|
||||
notification = "<span foreground='red'><sup></sup></span>";
|
||||
none = " ";
|
||||
dnd-notification = "<span foreground='red'><sup></sup></span>";
|
||||
dnd-none = " ";
|
||||
inhibited-notification = "<span foreground='red'><sup></sup></span>";
|
||||
inhibited-none = " ";
|
||||
dnd-inhibited-notification = "<span foreground='red'><sup></sup></span>";
|
||||
dnd-inhibited-none = " ";
|
||||
};
|
||||
return-type = "json";
|
||||
exec-if = "which swaync-client";
|
||||
exec = "swaync-client -swb";
|
||||
on-click = "swaync-client -t -sw";
|
||||
on-click-right = "swaync-client -d -sw";
|
||||
escape = true;
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -1,4 +1,4 @@
|
||||
{ pkgs, primaryUser, ... }:
|
||||
{ pkgs, ... }:
|
||||
let
|
||||
addons = pkgs.nur.repos.rycee.firefox-addons;
|
||||
readJson = path: builtins.readFile path;
|
||||
@@ -22,10 +22,6 @@ let
|
||||
};
|
||||
in
|
||||
{
|
||||
home.persistence."/persist/home".directories = [
|
||||
".mozilla/firefox/${primaryUser}"
|
||||
];
|
||||
|
||||
programs.floorp = {
|
||||
enable = true;
|
||||
|
||||
|
||||
@@ -1,11 +0,0 @@
|
||||
{
|
||||
home.persistence."/persist/home" = {
|
||||
hideMounts = true;
|
||||
directories = [
|
||||
".config/nix"
|
||||
"Documents"
|
||||
"Downloads"
|
||||
"Pictures"
|
||||
];
|
||||
};
|
||||
}
|
||||
@@ -1,4 +1,6 @@
|
||||
{ pkgs, ... }:
|
||||
{
|
||||
# Avante: AI-powered coding assistant (Cursor-like experience in Neovim)
|
||||
programs.nixvim = {
|
||||
plugins = {
|
||||
markdown-preview.enable = true;
|
||||
@@ -12,7 +14,7 @@
|
||||
providers = {
|
||||
groq = {
|
||||
__inherited_from = "openai";
|
||||
api_key_name = "cmd:cat /home/phil/.config/sops-nix/secrets/api_keys/groq";
|
||||
api_key_name = "cmd:cat /home/phil/.config/sops-nix/secrets/GROQ_API_KEY";
|
||||
endpoint = "https://api.groq.com/openai/v1/";
|
||||
model = "qwen/qwen3-32b";
|
||||
system_promt = "You are a helpful coding assistant. Always respond in plain markdown format without using tool calls or JSON structures.";
|
||||
@@ -27,10 +29,10 @@
|
||||
};
|
||||
|
||||
ollama = {
|
||||
endpoint = "http://10.10.0.2:11434";
|
||||
model = "qwen2.5:3b";
|
||||
timeout = 60000;
|
||||
disable_tools = true;
|
||||
endpoint = "http://100.86.56.71:11434"; # tailscale IP, no /v1 suffix
|
||||
model = "qwen2.5:3b"; # swap for "llama3.2:3b" or "deepseek-r1:1.5b"
|
||||
timeout = 60000; # local + small model can be slow on first load
|
||||
disable_tools = true; # these small models aren't reliable at tool calling
|
||||
is_env_set.__raw = ''require("avante.providers.ollama").check_endpoint_alive'';
|
||||
extra_request_body = {
|
||||
options = {
|
||||
|
||||
+2
-35
@@ -5,6 +5,7 @@
|
||||
programs.nixvim = {
|
||||
plugins.conform-nvim = {
|
||||
enable = true;
|
||||
|
||||
settings = {
|
||||
formatters_by_ft = {
|
||||
lua = [ "stylua" ];
|
||||
@@ -12,40 +13,6 @@
|
||||
python = [ "black" ];
|
||||
rust = [ "rustfmt" ];
|
||||
rasi = [ "prettierd" ];
|
||||
c = [ "clang_format" ];
|
||||
cpp = [ "clang_format" ];
|
||||
};
|
||||
|
||||
formatters.clang_format = {
|
||||
# If the file has a project .clang-format (walking up from the
|
||||
# file itself, not nvim's cwd), use it - this is how a real
|
||||
# kernel checkout, or any other C/C++ project's own style,
|
||||
# gets respected automatically. Otherwise fall back to an
|
||||
# inline approximation of kernel style instead of plain LLVM,
|
||||
# since that's the sane default for one-off C files.
|
||||
prepend_args = {
|
||||
__raw = ''
|
||||
function(self, ctx)
|
||||
local found = vim.fs.find(
|
||||
{ ".clang-format", "_clang-format" },
|
||||
{ path = ctx.filename, upward = true }
|
||||
)[1]
|
||||
if found then
|
||||
return { "-style=file" }
|
||||
end
|
||||
return {
|
||||
"-style={BasedOnStyle: LLVM, IndentWidth: 8, UseTab: Always, "
|
||||
.. "TabWidth: 8, BreakBeforeBraces: Linux, ColumnLimit: 80, "
|
||||
.. "IndentCaseLabels: false, PointerAlignment: Right, "
|
||||
.. "DerivePointerAlignment: false, SpaceBeforeParens: ControlStatements, "
|
||||
.. "SpacesInParentheses: false, SpaceAfterCStyleCast: false, "
|
||||
.. "AllowShortIfStatementsOnASingleLine: false, AllowShortBlocksOnASingleLine: false, "
|
||||
.. "AllowShortFunctionsOnASingleLine: None, AllowShortLoopsOnASingleLine: false, "
|
||||
.. "ReflowComments: false}"
|
||||
}
|
||||
end
|
||||
'';
|
||||
};
|
||||
};
|
||||
|
||||
format_on_save = {
|
||||
@@ -54,6 +21,7 @@
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
# Install formatters
|
||||
extraPackages = with pkgs; [
|
||||
stylua
|
||||
@@ -61,7 +29,6 @@
|
||||
black
|
||||
rustfmt
|
||||
prettierd
|
||||
clang-tools # provides clang-format
|
||||
];
|
||||
};
|
||||
}
|
||||
|
||||
@@ -32,8 +32,6 @@
|
||||
|
||||
programs.nixvim = {
|
||||
enable = true;
|
||||
nixpkgs.source = inputs.nixpkgs;
|
||||
|
||||
defaultEditor = true;
|
||||
enableMan = false;
|
||||
|
||||
|
||||
@@ -29,7 +29,6 @@
|
||||
installRustc = true;
|
||||
};
|
||||
pylsp.enable = true; # Python language server
|
||||
clangd.enable = true;
|
||||
};
|
||||
|
||||
# Keymaps for LSP actions
|
||||
@@ -86,7 +85,6 @@
|
||||
lua-language-server
|
||||
nil
|
||||
rust-analyzer
|
||||
clang-tools
|
||||
];
|
||||
};
|
||||
}
|
||||
|
||||
+1
-9
@@ -1,17 +1,9 @@
|
||||
{
|
||||
lib,
|
||||
inputs,
|
||||
...
|
||||
}:
|
||||
{ lib, inputs, ... }:
|
||||
{
|
||||
imports = [
|
||||
inputs.nixcord.homeModules.nixcord
|
||||
];
|
||||
|
||||
home.persistence."/persist/home".directories = [
|
||||
".config/vesktop"
|
||||
];
|
||||
|
||||
programs.nixcord = {
|
||||
enable = true;
|
||||
discord = lib.mkForce { enable = false; };
|
||||
|
||||
+20
-27
@@ -2,7 +2,6 @@
|
||||
config,
|
||||
pkgs,
|
||||
lib,
|
||||
primaryUser,
|
||||
...
|
||||
}:
|
||||
let
|
||||
@@ -21,32 +20,26 @@ in
|
||||
};
|
||||
};
|
||||
|
||||
home = {
|
||||
packages = with pkgs; [
|
||||
git
|
||||
git-lfs
|
||||
openssh
|
||||
];
|
||||
home.packages = with pkgs; [
|
||||
git
|
||||
git-lfs
|
||||
openssh
|
||||
];
|
||||
|
||||
persistence."/persist/home".directories = [
|
||||
"Notes"
|
||||
];
|
||||
home.activation.obsidianVault = lib.hm.dag.entryAfter [ "writeBoundary" ] ''
|
||||
export PATH="${gitBin}:${gitLfsBin}:$PATH"
|
||||
export GIT_SSH_COMMAND="${sshBinary} -o StrictHostKeyChecking=accept-new"
|
||||
export GIT_LFS_SKIP_SMUDGE=1
|
||||
|
||||
activation.obsidianVault = lib.hm.dag.entryAfter [ "writeBoundary" ] ''
|
||||
export PATH="${gitBin}:${gitLfsBin}:$PATH"
|
||||
export GIT_SSH_COMMAND="${sshBinary} -o StrictHostKeyChecking=accept-new"
|
||||
export GIT_LFS_SKIP_SMUDGE=1
|
||||
|
||||
if [ ! -d "${vaultPath}/.git" ]; then
|
||||
echo "Cloning Obsidian vault (LFS objects will be pulled separately)..."
|
||||
${gitBin}/git clone "${vaultRepo}" "${vaultPath}"
|
||||
${gitLfsBin}/git-lfs install --local "${vaultPath}"
|
||||
${gitBin}/git -C "${vaultPath}" lfs pull
|
||||
else
|
||||
echo "Pulling latest changes for Obsidian vault..."
|
||||
${gitBin}/git -C "${vaultPath}" pull
|
||||
${gitBin}/git -C "${vaultPath}" lfs pull
|
||||
fi
|
||||
'';
|
||||
};
|
||||
if [ ! -d "${vaultPath}/.git" ]; then
|
||||
echo "Cloning Obsidian vault (LFS objects will be pulled separately)..."
|
||||
${gitBin}/git clone "${vaultRepo}" "${vaultPath}"
|
||||
${gitLfsBin}/git-lfs install --local "${vaultPath}"
|
||||
${gitBin}/git -C "${vaultPath}" lfs pull
|
||||
else
|
||||
echo "Pulling latest changes for Obsidian vault..."
|
||||
${gitBin}/git -C "${vaultPath}" pull
|
||||
${gitBin}/git -C "${vaultPath}" lfs pull
|
||||
fi
|
||||
'';
|
||||
}
|
||||
|
||||
+1
-1
@@ -12,7 +12,7 @@ _: {
|
||||
npm = "@ai-sdk/openai-compatible";
|
||||
name = "Ollama (tailscale)";
|
||||
options = {
|
||||
baseURL = "http://10.10.0.2:11434/v1";
|
||||
baseURL = "http://100.86.56.71:11434/v1";
|
||||
};
|
||||
models = {
|
||||
"llama3.2:3b" = {
|
||||
|
||||
+42
-33
@@ -2,43 +2,26 @@
|
||||
pkgs,
|
||||
isDarwin,
|
||||
lib,
|
||||
primaryUser,
|
||||
...
|
||||
}:
|
||||
{
|
||||
home = {
|
||||
packages = with pkgs; [
|
||||
eza # ls replacement
|
||||
tdf # terminal pdf viewer
|
||||
jq # json parser
|
||||
fastfetch # system stats
|
||||
tabiew # Table viewer
|
||||
glow # MD Viewer
|
||||
fd # find alternative
|
||||
bat # cat alternative
|
||||
ripgrep # grep alternative
|
||||
dnsutils
|
||||
home.packages = with pkgs; [
|
||||
eza # ls replacement
|
||||
tdf # terminal pdf viewer
|
||||
jq # json parser
|
||||
fastfetch # system stats
|
||||
tabiew # Table viewer
|
||||
glow # MD Viewer
|
||||
fd # find alternative
|
||||
bat # cat alternative
|
||||
ripgrep # grep alternative
|
||||
dnsutils
|
||||
|
||||
# Fun stuff
|
||||
zoxide
|
||||
lolcat
|
||||
cmatrix
|
||||
];
|
||||
|
||||
persistence = lib.mkIf (!isDarwin) {
|
||||
"/persist/home" = {
|
||||
directories = [ ".local/share/zoxide" ];
|
||||
files = [ ".local/share/fish/fish_history" ];
|
||||
};
|
||||
};
|
||||
|
||||
file = {
|
||||
".config/fastfetch/config.jsonc".source = ./fastfetch.jsonc;
|
||||
".config/tabiew/theme.toml".source = ./tabiew.toml;
|
||||
".config/kitty/tab_bar.py".source = ./tab_bar.py;
|
||||
".hushlogin" = lib.mkIf isDarwin { text = ""; }; # Suppress Login
|
||||
};
|
||||
};
|
||||
# Fun stuff
|
||||
zoxide
|
||||
lolcat
|
||||
cmatrix
|
||||
];
|
||||
|
||||
programs = {
|
||||
kitty = {
|
||||
@@ -260,4 +243,30 @@
|
||||
};
|
||||
};
|
||||
|
||||
home = {
|
||||
file = {
|
||||
".config/fastfetch/config.jsonc".source = ./fastfetch.jsonc;
|
||||
".config/tabiew/theme.toml".source = ./tabiew.toml;
|
||||
".config/kitty/tab_bar.py".source = ./tab_bar.py;
|
||||
".hushlogin" = lib.mkIf isDarwin { text = ""; }; # Suppress Login
|
||||
|
||||
# Link LLM std template
|
||||
".config/io.datasette.llm/templates/std.yaml".text = ''
|
||||
system: |
|
||||
You are a concise technical assistant running on an Intel Mac (x86_64-darwin)
|
||||
with nix-darwin and home-manager.
|
||||
|
||||
Rules:
|
||||
- Always respond in valid markdown
|
||||
- Be concise and direct, no unnecessary explanation
|
||||
- Prefer code blocks for commands and code
|
||||
- You have access to these tools in the shell: nvim, fish, git,
|
||||
eza, bat, ripgrep, fzf, yazi, glow, llm, zoxide, fastfetch,
|
||||
nix, darwin-rebuild, brew
|
||||
- When suggesting nix config changes, use the nix language
|
||||
- nix-switch rebuilds the system config
|
||||
- nix-check validates the flake without building
|
||||
'';
|
||||
};
|
||||
};
|
||||
}
|
||||
|
||||
+1
-9
@@ -1,17 +1,9 @@
|
||||
{
|
||||
pkgs,
|
||||
inputs,
|
||||
...
|
||||
}:
|
||||
{ pkgs, inputs, ... }:
|
||||
{
|
||||
imports = [
|
||||
inputs.spicetify-nix.homeManagerModules.default
|
||||
];
|
||||
|
||||
home.persistence."/persist/home".directories = [
|
||||
".config/spotify"
|
||||
];
|
||||
|
||||
programs.spicetify =
|
||||
let
|
||||
spicePkgs = inputs.spicetify-nix.legacyPackages.${pkgs.system};
|
||||
|
||||
@@ -1,6 +1,5 @@
|
||||
{
|
||||
imports = [
|
||||
./disko.nix
|
||||
./hardware-configuration.nix
|
||||
./smb.nix
|
||||
../../nixos/roles/monitoring.nix
|
||||
@@ -12,6 +11,7 @@
|
||||
../../nixos/roles/gitea.nix
|
||||
../../nixos/roles/vaultwarden.nix
|
||||
../../nixos/roles/frontpage
|
||||
#../../nixos/roles/paperless-ngx.nix
|
||||
../../nixos/roles/octoprint.nix
|
||||
../../nixos/roles/matrix/postgres-backup.nix
|
||||
../../nixos/roles/kanidm.nix
|
||||
@@ -22,17 +22,6 @@
|
||||
useNetworkd = true;
|
||||
useDHCP = false;
|
||||
firewall.enable = true;
|
||||
wireguard.interfaces.wg0 = {
|
||||
ips = [ "10.10.0.2/24" ];
|
||||
peers = [
|
||||
{
|
||||
publicKey = "NjMYaUZO/iPRM/J46qyPPuWYg5oSeAUxjocMs/hYTXs=";
|
||||
endpoint = "178.254.8.35:51820";
|
||||
allowedIPs = [ "10.10.0.0/24" ];
|
||||
persistentKeepalive = 25;
|
||||
}
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
systemd.network = {
|
||||
@@ -56,6 +45,5 @@
|
||||
};
|
||||
efi.canTouchEfiVariables = true;
|
||||
};
|
||||
|
||||
system.stateVersion = "26.05";
|
||||
}
|
||||
|
||||
@@ -1,62 +0,0 @@
|
||||
{
|
||||
disko.devices.disk.main = {
|
||||
type = "disk";
|
||||
device = "/dev/sda";
|
||||
content = {
|
||||
type = "gpt";
|
||||
partitions = {
|
||||
ESP = {
|
||||
size = "512M";
|
||||
type = "EF00";
|
||||
content = {
|
||||
type = "filesystem";
|
||||
format = "vfat";
|
||||
mountpoint = "/boot";
|
||||
mountOptions = [
|
||||
"fmask=0022"
|
||||
"dmask=0022"
|
||||
];
|
||||
extraArgs = [
|
||||
"-n"
|
||||
"NIXBOOT"
|
||||
];
|
||||
};
|
||||
};
|
||||
swap = {
|
||||
size = "8G";
|
||||
content = {
|
||||
type = "swap";
|
||||
extraArgs = [
|
||||
"-L"
|
||||
"NIXSWAP"
|
||||
];
|
||||
};
|
||||
};
|
||||
nix = {
|
||||
size = "80G";
|
||||
content = {
|
||||
type = "filesystem";
|
||||
format = "ext4";
|
||||
mountpoint = "/nix";
|
||||
extraArgs = [
|
||||
"-L"
|
||||
"NIXSTORE"
|
||||
];
|
||||
};
|
||||
};
|
||||
persist = {
|
||||
size = "100%";
|
||||
content = {
|
||||
type = "filesystem";
|
||||
format = "ext4";
|
||||
mountpoint = "/persist";
|
||||
extraArgs = [
|
||||
"-L"
|
||||
"NIXPERSIST"
|
||||
];
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -5,6 +5,7 @@
|
||||
primaryUser,
|
||||
...
|
||||
}:
|
||||
|
||||
{
|
||||
imports = [
|
||||
(modulesPath + "/installer/scan/not-detected.nix")
|
||||
@@ -16,21 +17,25 @@
|
||||
"ahci"
|
||||
"usb_storage"
|
||||
"sd_mod"
|
||||
"nvme"
|
||||
];
|
||||
initrd.kernelModules = [ ];
|
||||
kernelModules = [ "kvm-intel" ];
|
||||
extraModulePackages = [ ];
|
||||
zfs.forceImportRoot = false;
|
||||
};
|
||||
|
||||
fileSystems = {
|
||||
"/" = {
|
||||
device = "none";
|
||||
fsType = "tmpfs";
|
||||
"/" = lib.mkForce {
|
||||
device = "/dev/disk/by-label/NIXROOT";
|
||||
fsType = "ext4";
|
||||
};
|
||||
|
||||
"/boot" = lib.mkForce {
|
||||
device = "/dev/disk/by-label/NIXBOOT";
|
||||
fsType = "vfat";
|
||||
options = [
|
||||
"defaults"
|
||||
"size=6G"
|
||||
"mode=755"
|
||||
"fmask=0022"
|
||||
"dmask=0022"
|
||||
];
|
||||
};
|
||||
|
||||
@@ -66,8 +71,6 @@
|
||||
];
|
||||
};
|
||||
|
||||
"/nix".neededForBoot = true;
|
||||
"/persist".neededForBoot = true;
|
||||
};
|
||||
|
||||
systemd.tmpfiles.rules = [
|
||||
@@ -77,7 +80,12 @@
|
||||
"d /storage/backup 0755 ${primaryUser} users -"
|
||||
];
|
||||
|
||||
networking.useDHCP = lib.mkDefault true;
|
||||
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
|
||||
swapDevices = [
|
||||
{
|
||||
device = "/swapfile";
|
||||
size = 4096;
|
||||
}
|
||||
];
|
||||
|
||||
hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
|
||||
}
|
||||
|
||||
@@ -1,12 +1,11 @@
|
||||
{
|
||||
pkgs,
|
||||
primaryUser,
|
||||
config,
|
||||
...
|
||||
}:
|
||||
|
||||
{
|
||||
sops.secrets."network/smb_passwd" = { };
|
||||
sops.secrets.smb_passwd = { };
|
||||
|
||||
users.users.${primaryUser}.extraGroups = [ "sambashare" ];
|
||||
|
||||
@@ -94,7 +93,7 @@
|
||||
sleep 1
|
||||
done
|
||||
|
||||
PASSWORD=$(cat ${config.sops.secrets."network/smb_passwd".path})
|
||||
PASSWORD=$(cat /run/secrets/smb_passwd)
|
||||
(echo "$PASSWORD"; echo "$PASSWORD") | ${pkgs.samba}/bin/smbpasswd -a -s ${primaryUser} || \
|
||||
(echo "$PASSWORD"; echo "$PASSWORD") | ${pkgs.samba}/bin/smbpasswd -s ${primaryUser}
|
||||
'';
|
||||
|
||||
@@ -1,24 +1,11 @@
|
||||
{ ... }:
|
||||
{
|
||||
imports = [
|
||||
./disko.nix
|
||||
./hardware-configuration.nix
|
||||
];
|
||||
imports = [ ./hardware-configuration.nix ];
|
||||
|
||||
networking = {
|
||||
useNetworkd = true;
|
||||
useDHCP = false;
|
||||
firewall.enable = true;
|
||||
wireguard.interfaces.wg0 = {
|
||||
ips = [ "10.10.0.40/24" ];
|
||||
peers = [
|
||||
{
|
||||
publicKey = "NjMYaUZO/iPRM/J46qyPPuWYg5oSeAUxjocMs/hYTXs=";
|
||||
endpoint = "178.254.8.35:51820";
|
||||
allowedIPs = [ "10.10.0.0/24" ];
|
||||
persistentKeepalive = 25;
|
||||
}
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
systemd.network = {
|
||||
@@ -63,6 +50,4 @@
|
||||
|
||||
virtualisation.docker.enable = true;
|
||||
users.users.phil.extraGroups = [ "docker" ];
|
||||
|
||||
programs.fuse.userAllowOther = true;
|
||||
}
|
||||
|
||||
@@ -1,68 +0,0 @@
|
||||
{
|
||||
disko.devices.disk.main = {
|
||||
type = "disk";
|
||||
device = "/dev/sda";
|
||||
content = {
|
||||
type = "gpt";
|
||||
partitions = {
|
||||
|
||||
ESP = {
|
||||
size = "512M";
|
||||
type = "EF00";
|
||||
content = {
|
||||
type = "filesystem";
|
||||
format = "vfat";
|
||||
mountpoint = "/boot";
|
||||
mountOptions = [
|
||||
"fmask=0022"
|
||||
"dmask=0022"
|
||||
];
|
||||
extraArgs = [
|
||||
"-n"
|
||||
"NIXBOOT"
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
swap = {
|
||||
size = "4G";
|
||||
content = {
|
||||
type = "swap";
|
||||
extraArgs = [
|
||||
"-L"
|
||||
"NIXSWAP"
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
nix = {
|
||||
size = "110G";
|
||||
content = {
|
||||
type = "filesystem";
|
||||
format = "ext4";
|
||||
mountpoint = "/nix";
|
||||
mountOptions = [ "defaults" ];
|
||||
extraArgs = [
|
||||
"-L"
|
||||
"NIXSTORE"
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
persist = {
|
||||
size = "100%";
|
||||
content = {
|
||||
type = "filesystem";
|
||||
format = "ext4";
|
||||
mountpoint = "/persist";
|
||||
extraArgs = [
|
||||
"-L"
|
||||
"NIXPERSIST"
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -31,31 +31,34 @@
|
||||
extraModprobeConfig = ''
|
||||
options v4l2loopback exclusive_caps=1 card_label="Virtual Camera"
|
||||
'';
|
||||
zfs.forceImportRoot = false;
|
||||
};
|
||||
|
||||
sops = {
|
||||
secrets."network/smb_passwd" = { };
|
||||
secrets.smb_passwd = { };
|
||||
|
||||
templates.smb_credentials = {
|
||||
content = ''
|
||||
username=${primaryUser}
|
||||
password=${config.sops.placeholder."network/smb_passwd"}
|
||||
password=${config.sops.placeholder.smb_passwd}
|
||||
'';
|
||||
};
|
||||
};
|
||||
|
||||
fileSystems = {
|
||||
"/" = {
|
||||
device = "none";
|
||||
fsType = "tmpfs";
|
||||
options = [
|
||||
"defaults"
|
||||
"size=4G"
|
||||
"mode=755"
|
||||
];
|
||||
device = "/dev/disk/by-label/NIXROOT";
|
||||
fsType = "ext4";
|
||||
};
|
||||
|
||||
"/nix".neededForBoot = true;
|
||||
"/persist".neededForBoot = true;
|
||||
"/boot" = {
|
||||
device = "/dev/disk/by-label/NIXBOOT";
|
||||
fsType = "vfat";
|
||||
options = [
|
||||
"fmask=0022"
|
||||
"dmask=0022"
|
||||
];
|
||||
};
|
||||
|
||||
"/storage" = {
|
||||
device = "/dev/disk/by-label/STORAGE";
|
||||
@@ -96,6 +99,8 @@
|
||||
"d /shares/storage-backup 0775 ${primaryUser} users -"
|
||||
];
|
||||
|
||||
swapDevices = [ ];
|
||||
|
||||
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
|
||||
|
||||
hardware = {
|
||||
|
||||
@@ -1,3 +1 @@
|
||||
{
|
||||
launchd.daemons.wireguard.environment.WG_IP = "10.10.0.3/24";
|
||||
}
|
||||
{ ... }: { }
|
||||
|
||||
@@ -1,6 +1,5 @@
|
||||
{
|
||||
imports = [
|
||||
./disko.nix
|
||||
./hardware-configuration.nix
|
||||
];
|
||||
|
||||
@@ -8,17 +7,6 @@
|
||||
useNetworkd = true;
|
||||
useDHCP = false;
|
||||
firewall.enable = true;
|
||||
wireguard.interfaces.wg0 = {
|
||||
ips = [ "10.10.0.30/24" ];
|
||||
peers = [
|
||||
{
|
||||
publicKey = "NjMYaUZO/iPRM/J46qyPPuWYg5oSeAUxjocMs/hYTXs=";
|
||||
endpoint = "178.254.8.35:51820";
|
||||
allowedIPs = [ "10.10.0.0/24" ];
|
||||
persistentKeepalive = 25;
|
||||
}
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
systemd.network = {
|
||||
|
||||
@@ -1,68 +0,0 @@
|
||||
{
|
||||
disko.devices.disk.main = {
|
||||
type = "disk";
|
||||
device = "/dev/sda";
|
||||
content = {
|
||||
type = "gpt";
|
||||
partitions = {
|
||||
|
||||
ESP = {
|
||||
size = "512M";
|
||||
type = "EF00";
|
||||
content = {
|
||||
type = "filesystem";
|
||||
format = "vfat";
|
||||
mountpoint = "/boot";
|
||||
mountOptions = [
|
||||
"fmask=0022"
|
||||
"dmask=0022"
|
||||
];
|
||||
extraArgs = [
|
||||
"-n"
|
||||
"NIXBOOT"
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
swap = {
|
||||
size = "4G";
|
||||
content = {
|
||||
type = "swap";
|
||||
extraArgs = [
|
||||
"-L"
|
||||
"NIXSWAP"
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
nix = {
|
||||
size = "50G";
|
||||
content = {
|
||||
type = "filesystem";
|
||||
format = "ext4";
|
||||
mountpoint = "/nix";
|
||||
mountOptions = [ "defaults" ];
|
||||
extraArgs = [
|
||||
"-L"
|
||||
"NIXSTORE"
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
persist = {
|
||||
size = "100%";
|
||||
content = {
|
||||
type = "filesystem";
|
||||
format = "ext4";
|
||||
mountpoint = "/persist";
|
||||
extraArgs = [
|
||||
"-L"
|
||||
"NIXPERSIST"
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -4,6 +4,7 @@
|
||||
modulesPath,
|
||||
...
|
||||
}:
|
||||
|
||||
{
|
||||
imports = [
|
||||
(modulesPath + "/installer/scan/not-detected.nix")
|
||||
@@ -19,22 +20,34 @@
|
||||
initrd.kernelModules = [ ];
|
||||
kernelModules = [ "kvm-intel" ];
|
||||
extraModulePackages = [ ];
|
||||
zfs.forceImportRoot = false;
|
||||
};
|
||||
|
||||
fileSystems = {
|
||||
"/" = {
|
||||
device = "none";
|
||||
fsType = "tmpfs";
|
||||
options = [
|
||||
"defaults"
|
||||
"size=2G"
|
||||
"mode=755"
|
||||
];
|
||||
device = "/dev/disk/by-label/NIXROOT";
|
||||
fsType = "ext4";
|
||||
};
|
||||
|
||||
"/nix".neededForBoot = true;
|
||||
"/persist".neededForBoot = true;
|
||||
"/boot" = {
|
||||
device = "/dev/disk/by-label/NIXBOOT";
|
||||
fsType = "vfat";
|
||||
options = [
|
||||
"fmask=0022"
|
||||
"dmask=0022"
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
swapDevices = [
|
||||
{
|
||||
device = "/swapfile";
|
||||
size = 4096;
|
||||
}
|
||||
];
|
||||
|
||||
networking.useDHCP = lib.mkDefault true;
|
||||
|
||||
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
|
||||
hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
|
||||
}
|
||||
|
||||
@@ -1,6 +1,5 @@
|
||||
{
|
||||
imports = [
|
||||
./disko.nix
|
||||
./hardware-configuration.nix
|
||||
];
|
||||
|
||||
@@ -8,17 +7,6 @@
|
||||
useNetworkd = true;
|
||||
useDHCP = false;
|
||||
firewall.enable = true;
|
||||
wireguard.interfaces.wg0 = {
|
||||
ips = [ "10.10.0.31/24" ];
|
||||
peers = [
|
||||
{
|
||||
publicKey = "NjMYaUZO/iPRM/J46qyPPuWYg5oSeAUxjocMs/hYTXs=";
|
||||
endpoint = "178.254.8.35:51820";
|
||||
allowedIPs = [ "10.10.0.0/24" ];
|
||||
persistentKeepalive = 25;
|
||||
}
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
systemd.network = {
|
||||
|
||||
@@ -1,68 +0,0 @@
|
||||
{
|
||||
disko.devices.disk.main = {
|
||||
type = "disk";
|
||||
device = "/dev/sda";
|
||||
content = {
|
||||
type = "gpt";
|
||||
partitions = {
|
||||
|
||||
ESP = {
|
||||
size = "512M";
|
||||
type = "EF00";
|
||||
content = {
|
||||
type = "filesystem";
|
||||
format = "vfat";
|
||||
mountpoint = "/boot";
|
||||
mountOptions = [
|
||||
"fmask=0022"
|
||||
"dmask=0022"
|
||||
];
|
||||
extraArgs = [
|
||||
"-n"
|
||||
"NIXBOOT"
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
swap = {
|
||||
size = "4G";
|
||||
content = {
|
||||
type = "swap";
|
||||
extraArgs = [
|
||||
"-L"
|
||||
"NIXSWAP"
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
nix = {
|
||||
size = "50G";
|
||||
content = {
|
||||
type = "filesystem";
|
||||
format = "ext4";
|
||||
mountpoint = "/nix";
|
||||
mountOptions = [ "defaults" ];
|
||||
extraArgs = [
|
||||
"-L"
|
||||
"NIXSTORE"
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
persist = {
|
||||
size = "100%";
|
||||
content = {
|
||||
type = "filesystem";
|
||||
format = "ext4";
|
||||
mountpoint = "/persist";
|
||||
extraArgs = [
|
||||
"-L"
|
||||
"NIXPERSIST"
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -4,6 +4,7 @@
|
||||
modulesPath,
|
||||
...
|
||||
}:
|
||||
|
||||
{
|
||||
imports = [
|
||||
(modulesPath + "/installer/scan/not-detected.nix")
|
||||
@@ -19,22 +20,34 @@
|
||||
initrd.kernelModules = [ ];
|
||||
kernelModules = [ "kvm-intel" ];
|
||||
extraModulePackages = [ ];
|
||||
zfs.forceImportRoot = false;
|
||||
};
|
||||
|
||||
fileSystems = {
|
||||
"/" = {
|
||||
device = "none";
|
||||
fsType = "tmpfs";
|
||||
options = [
|
||||
"defaults"
|
||||
"size=2G"
|
||||
"mode=755"
|
||||
];
|
||||
device = "/dev/disk/by-label/NIXROOT";
|
||||
fsType = "ext4";
|
||||
};
|
||||
|
||||
"/nix".neededForBoot = true;
|
||||
"/persist".neededForBoot = true;
|
||||
"/boot" = {
|
||||
device = "/dev/disk/by-label/NIXBOOT";
|
||||
fsType = "vfat";
|
||||
options = [
|
||||
"fmask=0022"
|
||||
"dmask=0022"
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
swapDevices = [
|
||||
{
|
||||
device = "/swapfile";
|
||||
size = 4096;
|
||||
}
|
||||
];
|
||||
|
||||
networking.useDHCP = lib.mkDefault true;
|
||||
|
||||
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
|
||||
hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
|
||||
}
|
||||
|
||||
@@ -1,7 +1,6 @@
|
||||
{ ... }:
|
||||
{
|
||||
imports = [
|
||||
./disko.nix
|
||||
./hardware-configuration.nix
|
||||
../../nixos/roles/nginx.nix
|
||||
# ../../nixos/roles/jitsi.nix
|
||||
@@ -14,18 +13,18 @@
|
||||
interfaces.ens3 = {
|
||||
ipv4.addresses = [
|
||||
{
|
||||
address = "195.90.219.9";
|
||||
prefixLength = 22;
|
||||
address = "178.254.8.35";
|
||||
prefixLength = 23;
|
||||
}
|
||||
];
|
||||
ipv6.addresses = [
|
||||
{
|
||||
address = "2a00:6800:3:113e::1";
|
||||
address = "2a00:6800:3:1094::1";
|
||||
prefixLength = 64;
|
||||
}
|
||||
];
|
||||
};
|
||||
defaultGateway = "195.90.216.1";
|
||||
defaultGateway = "178.254.8.1";
|
||||
|
||||
defaultGateway6 = {
|
||||
address = "2a00:6800:3::1";
|
||||
@@ -37,46 +36,18 @@
|
||||
"178.254.16.141"
|
||||
];
|
||||
|
||||
wireguard.interfaces.wg0 = {
|
||||
ips = [ "10.10.0.1/24" ];
|
||||
listenPort = 51820;
|
||||
peers = [
|
||||
{
|
||||
publicKey = "EvML4de3CReNW8aF+lJAsPZ+p6FICOyjCsAZJBwIwX8=";
|
||||
allowedIPs = [ "10.10.0.2/32" ];
|
||||
}
|
||||
{
|
||||
publicKey = "WkY45tGnNZQuJTf1MPN6I92spxHts/kpzXRSZE9se2c=";
|
||||
allowedIPs = [ "10.10.0.3/32" ];
|
||||
}
|
||||
{
|
||||
publicKey = "oAstNd7Wxpj2PqSyS87q+8y8WtaLK7hZ5Ytfncml9EM=";
|
||||
allowedIPs = [ "10.10.0.40/32" ];
|
||||
}
|
||||
{
|
||||
publicKey = "GrFH3I5QqjRij7Jl+eOL6Ou6zK6MtH5/kAsA5AmGckM=";
|
||||
allowedIPs = [ "10.10.0.30/32" ];
|
||||
}
|
||||
{
|
||||
publicKey = "IddGAijZVCVxGj/aMasjfroIy9r8Owar4MO9xfvNNBY=";
|
||||
allowedIPs = [ "10.10.0.31/32" ];
|
||||
}
|
||||
];
|
||||
};
|
||||
|
||||
firewall.allowedTCPPorts = [
|
||||
80
|
||||
443
|
||||
51820
|
||||
];
|
||||
|
||||
hosts = {
|
||||
"195.90.219.9" = [
|
||||
"178.254.8.35" = [
|
||||
"cyperpunk.de"
|
||||
"matrix.cyperpunk.de"
|
||||
];
|
||||
|
||||
"2a00:6800:3:113e::1" = [
|
||||
"2a00:6800:3:1094::1" = [
|
||||
"cyperpunk.de"
|
||||
"matrix.cyperpunk.de"
|
||||
];
|
||||
|
||||
@@ -1,65 +0,0 @@
|
||||
{
|
||||
disko.devices.disk.main = {
|
||||
type = "disk";
|
||||
device = "/dev/vda";
|
||||
content = {
|
||||
type = "gpt";
|
||||
partitions = {
|
||||
boot = {
|
||||
size = "1M";
|
||||
type = "EF02";
|
||||
};
|
||||
ESP = {
|
||||
size = "512M";
|
||||
content = {
|
||||
type = "filesystem";
|
||||
format = "vfat";
|
||||
mountpoint = "/boot";
|
||||
mountOptions = [
|
||||
"fmask=0022"
|
||||
"dmask=0022"
|
||||
];
|
||||
extraArgs = [
|
||||
"-n"
|
||||
"NIXBOOT"
|
||||
];
|
||||
};
|
||||
};
|
||||
swap = {
|
||||
size = "4G";
|
||||
content = {
|
||||
type = "swap";
|
||||
extraArgs = [
|
||||
"-L"
|
||||
"NIXSWAP"
|
||||
];
|
||||
};
|
||||
};
|
||||
nix = {
|
||||
size = "40G";
|
||||
content = {
|
||||
type = "filesystem";
|
||||
format = "ext4";
|
||||
mountpoint = "/nix";
|
||||
extraArgs = [
|
||||
"-L"
|
||||
"NIXSTORE"
|
||||
];
|
||||
};
|
||||
};
|
||||
persist = {
|
||||
size = "100%";
|
||||
content = {
|
||||
type = "filesystem";
|
||||
format = "ext4";
|
||||
mountpoint = "/persist";
|
||||
extraArgs = [
|
||||
"-L"
|
||||
"NIXPERSIST"
|
||||
];
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -5,6 +5,11 @@
|
||||
];
|
||||
|
||||
boot = {
|
||||
loader.grub = {
|
||||
enable = true;
|
||||
device = "/dev/vda";
|
||||
};
|
||||
|
||||
initrd = {
|
||||
availableKernelModules = [
|
||||
"ata_piix"
|
||||
@@ -16,24 +21,26 @@
|
||||
];
|
||||
kernelModules = [ ];
|
||||
};
|
||||
kernel.sysctl."net.ipv4.ip_forward" = 1;
|
||||
kernelModules = [ ];
|
||||
extraModulePackages = [ ];
|
||||
zfs.forceImportRoot = false;
|
||||
};
|
||||
|
||||
fileSystems = {
|
||||
"/" = {
|
||||
device = "none";
|
||||
fsType = "tmpfs";
|
||||
options = [
|
||||
"defaults"
|
||||
"size=2G"
|
||||
"mode=755"
|
||||
];
|
||||
device = "/dev/disk/by-label/NIXROOT";
|
||||
fsType = "ext4";
|
||||
};
|
||||
|
||||
"/nix".neededForBoot = true;
|
||||
"/persist".neededForBoot = true;
|
||||
"/boot" = {
|
||||
device = "/dev/disk/by-label/NIXBOOT";
|
||||
fsType = "vfat";
|
||||
options = [
|
||||
"fmask=0022"
|
||||
"dmask=0022"
|
||||
];
|
||||
};
|
||||
};
|
||||
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
|
||||
|
||||
swapDevices = [ ];
|
||||
}
|
||||
|
||||
@@ -1,86 +0,0 @@
|
||||
{ modulesPath, pkgs, ... }:
|
||||
{
|
||||
imports = [ (modulesPath + "/installer/cd-dvd/installation-cd-minimal.nix") ];
|
||||
|
||||
boot.zfs.forceImportRoot = false;
|
||||
|
||||
time.timeZone = "Europe/Berlin";
|
||||
i18n = {
|
||||
defaultLocale = "en_US.UTF-8";
|
||||
extraLocaleSettings = {
|
||||
LC_ADDRESS = "de_DE.UTF-8";
|
||||
LC_IDENTIFICATION = "de_DE.UTF-8";
|
||||
LC_MEASUREMENT = "de_DE.UTF-8";
|
||||
LC_MONETARY = "de_DE.UTF-8";
|
||||
LC_NAME = "de_DE.UTF-8";
|
||||
LC_NUMERIC = "de_DE.UTF-8";
|
||||
LC_PAPER = "de_DE.UTF-8";
|
||||
LC_TELEPHONE = "de_DE.UTF-8";
|
||||
LC_TIME = "de_DE.UTF-8";
|
||||
};
|
||||
};
|
||||
|
||||
services.openssh = {
|
||||
enable = true;
|
||||
openFirewall = true;
|
||||
settings = {
|
||||
PermitRootLogin = "yes";
|
||||
PasswordAuthentication = false;
|
||||
};
|
||||
};
|
||||
|
||||
users.users = {
|
||||
root.openssh.authorizedKeys.keyFiles = [
|
||||
../../secrets/ssh-key
|
||||
];
|
||||
|
||||
phil = {
|
||||
isNormalUser = true;
|
||||
password = "nixos";
|
||||
extraGroups = [ "wheel" ];
|
||||
openssh.authorizedKeys.keyFiles = [
|
||||
../../secrets/ssh-key
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
security.sudo = {
|
||||
enable = true;
|
||||
wheelNeedsPassword = false;
|
||||
};
|
||||
|
||||
networking = {
|
||||
useNetworkd = true;
|
||||
useDHCP = false;
|
||||
firewall.enable = false;
|
||||
};
|
||||
|
||||
systemd.network = {
|
||||
enable = true;
|
||||
networks."10-ethernet" = {
|
||||
matchConfig.Name = "en*";
|
||||
networkConfig = {
|
||||
#Address = "192.168.2.99/24";
|
||||
#Gateway = "192.168.2.1";
|
||||
#DNS = "192.168.2.2";
|
||||
Address = "195.90.219.9/22";
|
||||
Gateway = "195.90.216.1";
|
||||
DNS = [
|
||||
"178.254.16.151"
|
||||
"178.254.16.141"
|
||||
];
|
||||
DHCP = "no";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
environment.systemPackages = with pkgs; [
|
||||
htop
|
||||
lsscsi
|
||||
pciutils
|
||||
usbutils
|
||||
nvme-cli
|
||||
];
|
||||
|
||||
system.stateVersion = "26.05";
|
||||
}
|
||||
+12
-27
@@ -11,9 +11,8 @@
|
||||
imports = [
|
||||
./sops.nix
|
||||
./locale.nix
|
||||
./wireguard.nix
|
||||
./tailscale.nix
|
||||
./ssh.nix
|
||||
./impermanence.nix
|
||||
]
|
||||
++ lib.optionals (!isServer) [
|
||||
./regreet.nix
|
||||
@@ -23,11 +22,9 @@
|
||||
./catppuccin.nix
|
||||
];
|
||||
|
||||
sops.secrets = {
|
||||
"nix/cache_priv_key" = {
|
||||
mode = "0400";
|
||||
};
|
||||
"nix/cachix_auth_token" = { };
|
||||
sops.secrets."nix_cache_priv_key" = {
|
||||
|
||||
mode = "0400";
|
||||
};
|
||||
|
||||
nix = {
|
||||
@@ -50,7 +47,7 @@
|
||||
"https://nix-community.cachix.org"
|
||||
"https://cyper-cache.cachix.org"
|
||||
];
|
||||
secret-key-files = [ config.sops.secrets."nix/cache_priv_key".path ];
|
||||
secret-key-files = [ config.sops.secrets."nix_cache_priv_key".path ];
|
||||
trusted-public-keys = [
|
||||
"cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY="
|
||||
"hyprland.cachix.org-1:a7pgxzMz7+chwVL3/pzj6jIBMioiJM7ypFP8PwtkuGc="
|
||||
@@ -115,6 +112,8 @@
|
||||
};
|
||||
};
|
||||
|
||||
sops.secrets.cachix_auth_token = { };
|
||||
|
||||
systemd.services.cachix-push = {
|
||||
description = "Push new store paths to Cachix";
|
||||
after = [ "multi-user.target" ];
|
||||
@@ -122,28 +121,14 @@
|
||||
serviceConfig = {
|
||||
Type = "oneshot";
|
||||
RemainAfterExit = true;
|
||||
ExecStart = "${pkgs.bash}/bin/bash -c 'CACHIX_AUTH_TOKEN=$(cat ${
|
||||
config.sops.secrets."nix/cachix_auth_token".path
|
||||
}) ${pkgs.nix}/bin/nix path-info --recursive /run/current-system | CACHIX_AUTH_TOKEN=$(cat ${
|
||||
config.sops.secrets."nix/cachix_auth_token".path
|
||||
}) ${pkgs.cachix}/bin/cachix push cyper-cache'";
|
||||
ExecStart = "${pkgs.bash}/bin/bash -c 'CACHIX_AUTH_TOKEN=$(cat ${config.sops.secrets.cachix_auth_token.path}) ${pkgs.nix}/bin/nix path-info --recursive /run/current-system | CACHIX_AUTH_TOKEN=$(cat ${config.sops.secrets.cachix_auth_token.path}) ${pkgs.cachix}/bin/cachix push cyper-cache'";
|
||||
};
|
||||
};
|
||||
|
||||
networking = {
|
||||
hosts = {
|
||||
"10.10.0.1" = [ "proxy.cyperpunk.de" ];
|
||||
"10.10.0.2" = [ "controller.cyperpunk.de" ];
|
||||
"10.10.0.3" = [ "mac.cyperpunk.de" ];
|
||||
"10.10.0.30" = [ "node1.cyperpunk.de" ];
|
||||
"10.10.0.31" = [ "node2.cyperpunk.de" ];
|
||||
"10.10.0.40" = [ "desktop.cyperpunk.de" ];
|
||||
};
|
||||
firewall.allowedTCPPorts = [
|
||||
9002
|
||||
3100
|
||||
];
|
||||
};
|
||||
networking.firewall.allowedTCPPorts = [
|
||||
9002
|
||||
3100
|
||||
];
|
||||
|
||||
users.users.${primaryUser} = {
|
||||
home = "/home/${primaryUser}";
|
||||
|
||||
@@ -1,18 +0,0 @@
|
||||
_: {
|
||||
environment.persistence."/persist" = {
|
||||
hideMounts = true;
|
||||
files = [
|
||||
"/etc/machine-id"
|
||||
"/etc/ssh/ssh_host_ed25519_key"
|
||||
"/etc/ssh/ssh_host_ed25519_key.pub"
|
||||
"/etc/ssh/ssh_host_rsa_key"
|
||||
"/etc/ssh/ssh_host_rsa_key.pub"
|
||||
];
|
||||
directories = [
|
||||
"/var/lib/nixos"
|
||||
"/var/lib/systemd"
|
||||
"/var/log"
|
||||
"/var/lib/tailscale"
|
||||
];
|
||||
};
|
||||
}
|
||||
+18
-24
@@ -1,7 +1,6 @@
|
||||
{
|
||||
lib,
|
||||
pkgs,
|
||||
primaryUser,
|
||||
...
|
||||
}:
|
||||
{
|
||||
@@ -9,46 +8,35 @@
|
||||
"greetd/background.png".source = ../assets/wallpapers/lucy_with_cat.png;
|
||||
"greetd/environments".text = ''
|
||||
Hyprland
|
||||
niri-session
|
||||
fish
|
||||
'';
|
||||
};
|
||||
|
||||
programs.regreet = {
|
||||
enable = true;
|
||||
enable = false;
|
||||
|
||||
cageArgs = [
|
||||
"-s"
|
||||
"-m"
|
||||
"last"
|
||||
];
|
||||
theme = {
|
||||
name = "catppuccin-mocha-standard-sky-dark";
|
||||
package = pkgs.catppuccin-gtk;
|
||||
};
|
||||
cursorTheme = {
|
||||
name = "catppuccin-mocha-sapphire-cursors";
|
||||
package = pkgs.catppuccin-cursors.mochaSapphire;
|
||||
};
|
||||
iconTheme = {
|
||||
name = "Papirus-Dark";
|
||||
package = pkgs.papirus-icon-theme;
|
||||
};
|
||||
font = {
|
||||
name = "FiraCode Nerd Font Propo";
|
||||
size = 12;
|
||||
package = pkgs.nerd-fonts.fira-code;
|
||||
};
|
||||
|
||||
settings = {
|
||||
|
||||
background = {
|
||||
path = "/etc/greetd/background.png";
|
||||
fit = "Fill";
|
||||
};
|
||||
|
||||
GTK = {
|
||||
application_prefer_dark_theme = true;
|
||||
cursor_theme_name = lib.mkForce "catppuccin-mocha-sapphire-cursors";
|
||||
cursor_theme_name = lib.mkForce "catppuccin-mocha-dark-cursors";
|
||||
font_name = lib.mkForce "FiraCode Nerd Font Propo 12";
|
||||
icon_theme_name = lib.mkForce "Papirus-Dark";
|
||||
theme_name = lib.mkForce "catppuccin-mocha-standard-sky-dark";
|
||||
theme_name = lib.mkForce "catppuccin-mocha-standard-mauve-dark";
|
||||
};
|
||||
|
||||
commands = {
|
||||
reboot = [
|
||||
"systemctl"
|
||||
@@ -58,10 +46,16 @@
|
||||
"systemctl"
|
||||
"poweroff"
|
||||
];
|
||||
x11_prefix = [
|
||||
"startx"
|
||||
"/usr/bin/env"
|
||||
];
|
||||
};
|
||||
|
||||
appearance = {
|
||||
greeting_msg = "Hey there!";
|
||||
};
|
||||
|
||||
widget.clock = {
|
||||
format = "%A %d.%m.%Y %T";
|
||||
resolution = "500ms";
|
||||
@@ -75,12 +69,12 @@
|
||||
enable = true;
|
||||
settings = {
|
||||
default_session = {
|
||||
command = "${pkgs.greetd.regreet}/bin/regreet";
|
||||
command = "${pkgs.tuigreet}/bin/tuigreet --cmd start-hyprland";
|
||||
user = "greeter";
|
||||
};
|
||||
initial_session = {
|
||||
command = "start-hyprland";
|
||||
user = primaryUser;
|
||||
command = "Hyprland";
|
||||
user = "phil";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
@@ -1,13 +1,5 @@
|
||||
{ ... }:
|
||||
{
|
||||
environment.persistence."/persist".directories = [
|
||||
{
|
||||
directory = "/var/lib/filebrowser";
|
||||
user = "filebrowser";
|
||||
group = "filebrowser";
|
||||
mode = "0750";
|
||||
}
|
||||
];
|
||||
|
||||
services.filebrowser = {
|
||||
enable = true;
|
||||
|
||||
|
||||
@@ -13,7 +13,7 @@ let
|
||||
"/var/lib/flame-${name}:/app/data"
|
||||
]
|
||||
++ extraVolumes;
|
||||
environmentFiles = [ config.sops.secrets."services/flame/${name}_password".path ];
|
||||
environmentFiles = [ config.sops.secrets."flame_${name}_password".path ];
|
||||
};
|
||||
|
||||
instances = [
|
||||
@@ -29,35 +29,8 @@ let
|
||||
];
|
||||
in
|
||||
{
|
||||
environment.persistence."/persist".directories = [
|
||||
{
|
||||
directory = "/var/lib/flame-phil";
|
||||
user = "root";
|
||||
group = "root";
|
||||
mode = "0755";
|
||||
}
|
||||
{
|
||||
directory = "/var/lib/flame-calvin";
|
||||
user = "root";
|
||||
group = "root";
|
||||
mode = "0755";
|
||||
}
|
||||
{
|
||||
directory = "/var/lib/docker";
|
||||
user = "root";
|
||||
group = "root";
|
||||
mode = "0710";
|
||||
}
|
||||
{
|
||||
directory = "/var/lib/private";
|
||||
user = "root";
|
||||
group = "root";
|
||||
mode = "0700";
|
||||
}
|
||||
];
|
||||
|
||||
sops.secrets = lib.listToAttrs (
|
||||
map ({ name, ... }: lib.nameValuePair "services/flame/${name}_password" { }) instances
|
||||
map ({ name, ... }: lib.nameValuePair "flame_${name}_password" { }) instances
|
||||
);
|
||||
|
||||
virtualisation = {
|
||||
|
||||
+10
-24
@@ -2,6 +2,7 @@
|
||||
pkgs,
|
||||
lib,
|
||||
config,
|
||||
primaryUser,
|
||||
...
|
||||
}:
|
||||
|
||||
@@ -19,48 +20,33 @@ let
|
||||
in
|
||||
{
|
||||
sops.secrets = {
|
||||
"services/gitea/db_password" = {
|
||||
"gitea/dbPassword" = {
|
||||
owner = "gitea";
|
||||
group = "gitea";
|
||||
mode = "0444";
|
||||
};
|
||||
"services/gitea/internal_token" = {
|
||||
"gitea/internalToken" = {
|
||||
owner = "gitea";
|
||||
group = "gitea";
|
||||
};
|
||||
"services/gitea/lfs_jwt_secret" = {
|
||||
"gitea/lfsJwtSecret" = {
|
||||
owner = "gitea";
|
||||
group = "gitea";
|
||||
};
|
||||
"services/gitea/mailer_password" = {
|
||||
"gitea/mailerPassword" = {
|
||||
owner = "gitea";
|
||||
group = "gitea";
|
||||
};
|
||||
"services/gitea/runner_token" = {
|
||||
"gitea/runnerToken" = {
|
||||
mode = "0444";
|
||||
};
|
||||
"kanidm/gitea_secret" = {
|
||||
"kanidm_gitea_secret" = {
|
||||
owner = "gitea";
|
||||
group = "gitea";
|
||||
mode = "0444";
|
||||
};
|
||||
};
|
||||
|
||||
environment.persistence."/persist".directories = [
|
||||
{
|
||||
directory = "/var/lib/gitea";
|
||||
user = "gitea";
|
||||
group = "gitea";
|
||||
mode = "0750";
|
||||
}
|
||||
{
|
||||
directory = "/var/lib/postgresql";
|
||||
user = "postgres";
|
||||
group = "postgres";
|
||||
mode = "0750";
|
||||
}
|
||||
];
|
||||
|
||||
systemd.services = {
|
||||
gitea-db-password = {
|
||||
description = "Set gitea postgres user password";
|
||||
@@ -74,7 +60,7 @@ in
|
||||
RemainAfterExit = true;
|
||||
};
|
||||
script = ''
|
||||
pass=$(cat ${config.sops.secrets."services/gitea/db_password".path})
|
||||
pass=$(cat ${config.sops.secrets."gitea/dbPassword".path})
|
||||
${pkgs.postgresql_14}/bin/psql -c \
|
||||
"ALTER USER gitea WITH PASSWORD '$pass';"
|
||||
'';
|
||||
@@ -125,7 +111,7 @@ in
|
||||
port = 5432;
|
||||
name = "gitea";
|
||||
user = "gitea";
|
||||
passwordFile = config.sops.secrets."services/gitea/db_password".path;
|
||||
passwordFile = config.sops.secrets."gitea/dbPassword".path;
|
||||
};
|
||||
|
||||
settings = {
|
||||
@@ -221,7 +207,7 @@ in
|
||||
gitea-actions-runner.instances."cyper_nix" = {
|
||||
enable = true;
|
||||
url = "https://git.cyperpunk.de";
|
||||
tokenFile = config.sops.secrets."services/gitea/runner_token".path;
|
||||
tokenFile = config.sops.secrets."gitea/runnerToken".path;
|
||||
name = "cyper-controller";
|
||||
labels = [ "nix:host" ];
|
||||
|
||||
|
||||
@@ -5,15 +5,6 @@ let
|
||||
certDir = "/var/lib/kanidm/tls";
|
||||
in
|
||||
{
|
||||
environment.persistence."/persist".directories = [
|
||||
{
|
||||
directory = "/var/lib/kanidm";
|
||||
user = "kanidm";
|
||||
group = "kanidm";
|
||||
mode = "0750";
|
||||
}
|
||||
];
|
||||
|
||||
systemd.services.kanidm-selfsigned-cert = {
|
||||
description = "Generate self-signed TLS certificate for Kanidm";
|
||||
wantedBy = [ "kanidm.service" ];
|
||||
|
||||
@@ -149,15 +149,6 @@ let
|
||||
|
||||
in
|
||||
{
|
||||
environment.persistence."/persist".directories = [
|
||||
{
|
||||
directory = "/var/lib/containers";
|
||||
user = "root";
|
||||
group = "root";
|
||||
mode = "0700";
|
||||
}
|
||||
];
|
||||
|
||||
services.nginx.virtualHosts = {
|
||||
"cinny.cyperpunk.de" = {
|
||||
forceSSL = true;
|
||||
|
||||
@@ -1,14 +1,15 @@
|
||||
{ config, lib, ... }:
|
||||
{
|
||||
sops.secrets = {
|
||||
"matrix/coturn_static_auth_secret" = {
|
||||
coturn_static_auth_secret = {
|
||||
owner = "turnserver";
|
||||
group = "turnserver";
|
||||
};
|
||||
|
||||
coturn_static_auth_secret_synapse = {
|
||||
owner = "matrix-synapse";
|
||||
group = "matrix-synapse";
|
||||
key = "matrix/coturn_static_auth_secret";
|
||||
key = "coturn_static_auth_secret";
|
||||
};
|
||||
};
|
||||
|
||||
@@ -20,7 +21,7 @@
|
||||
min-port = 49000;
|
||||
max-port = 50000;
|
||||
use-auth-secret = true;
|
||||
static-auth-secret-file = config.sops.secrets."matrix/coturn_static_auth_secret".path;
|
||||
static-auth-secret-file = config.sops.secrets.coturn_static_auth_secret.path;
|
||||
realm = "turn.cyperpunk.de";
|
||||
cert = "${config.security.acme.certs.${realm}.directory}/full.pem";
|
||||
pkey = "${config.security.acme.certs.${realm}.directory}/key.pem";
|
||||
|
||||
@@ -6,7 +6,7 @@
|
||||
./synapse.nix
|
||||
./livekit.nix
|
||||
./clients.nix
|
||||
./draupnir.nix
|
||||
./mjolnir.nix
|
||||
./coturn.nix
|
||||
./maubot.nix
|
||||
./discord-bridge.nix
|
||||
|
||||
@@ -1,29 +1,20 @@
|
||||
{ config, lib, ... }:
|
||||
{
|
||||
sops.secrets = {
|
||||
"matrix/bridges/discord/bot_token" = {
|
||||
discord_bot_token = {
|
||||
owner = "mautrix-discord";
|
||||
group = "mautrix-discord";
|
||||
};
|
||||
"matrix/bridges/discord/client_id" = {
|
||||
discord_client_id = {
|
||||
owner = "mautrix-discord";
|
||||
group = "mautrix-discord";
|
||||
};
|
||||
"matrix/bridges/discord/pickle_key" = {
|
||||
discord_pickle_key = {
|
||||
owner = "mautrix-discord";
|
||||
group = "mautrix-discord";
|
||||
};
|
||||
};
|
||||
|
||||
environment.persistence."/persist".directories = [
|
||||
{
|
||||
directory = "/var/lib/mautrix-discord";
|
||||
user = "mautrix-discord";
|
||||
group = "mautrix-discord";
|
||||
mode = "0750";
|
||||
}
|
||||
];
|
||||
|
||||
systemd = {
|
||||
services = {
|
||||
mautrix-discord-env = {
|
||||
@@ -35,15 +26,9 @@
|
||||
};
|
||||
script = ''
|
||||
mkdir -p /run/mautrix-discord
|
||||
echo "DISCORD_BOT_TOKEN=$(cat ${
|
||||
config.sops.secrets."matrix/bridges/discord/bot_token".path
|
||||
})" > /run/mautrix-discord/env
|
||||
echo "DISCORD_CLIENT_ID=$(cat ${
|
||||
config.sops.secrets."matrix/bridges/discord/client_id".path
|
||||
})" >> /run/mautrix-discord/env
|
||||
echo "DISCORD_PICKLE_KEY=$(cat ${
|
||||
config.sops.secrets."matrix/bridges/discord/pickle_key".path
|
||||
})" >> /run/mautrix-discord/env
|
||||
echo "DISCORD_BOT_TOKEN=$(cat ${config.sops.secrets.discord_bot_token.path})" > /run/mautrix-discord/env
|
||||
echo "DISCORD_CLIENT_ID=$(cat ${config.sops.secrets.discord_client_id.path})" >> /run/mautrix-discord/env
|
||||
echo "DISCORD_PICKLE_KEY=$(cat ${config.sops.secrets.discord_pickle_key.path})" >> /run/mautrix-discord/env
|
||||
chmod 600 /run/mautrix-discord/env
|
||||
chown mautrix-discord:mautrix-discord /run/mautrix-discord/env
|
||||
'';
|
||||
|
||||
@@ -1,22 +0,0 @@
|
||||
{ config, ... }:
|
||||
{
|
||||
sops.secrets."matrix/draupnir_access_token" = { };
|
||||
|
||||
environment.persistence."/persist".directories = [
|
||||
{
|
||||
directory = "/var/lib/private";
|
||||
user = "root";
|
||||
group = "root";
|
||||
mode = "0700";
|
||||
}
|
||||
];
|
||||
|
||||
services.draupnir = {
|
||||
enable = true;
|
||||
secrets.accessToken = config.sops.secrets."matrix/draupnir_access_token".path;
|
||||
settings = {
|
||||
homeserverUrl = "https://matrix.cyperpunk.de";
|
||||
managementRoom = "!eErCimyDjLSebHjpJA:cyperpunk.de";
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -1,20 +1,18 @@
|
||||
{ config, ... }:
|
||||
{
|
||||
sops.secrets."matrix/livekit_key_file" = { };
|
||||
sops.secrets.livekit_key_file = { };
|
||||
|
||||
services = {
|
||||
livekit = {
|
||||
enable = true;
|
||||
openFirewall = true;
|
||||
settings.room.auto_create = false;
|
||||
keyFile = config.sops.secrets."matrix/livekit_key_file".path;
|
||||
};
|
||||
services.livekit = {
|
||||
enable = true;
|
||||
openFirewall = true;
|
||||
settings.room.auto_create = false;
|
||||
keyFile = config.sops.secrets.livekit_key_file.path;
|
||||
};
|
||||
|
||||
lk-jwt-service = {
|
||||
enable = true;
|
||||
livekitUrl = "wss://cyperpunk.de/livekit/sfu";
|
||||
keyFile = config.sops.secrets."matrix/livekit_key_file".path;
|
||||
};
|
||||
services.lk-jwt-service = {
|
||||
enable = true;
|
||||
livekitUrl = "wss://cyperpunk.de/livekit/sfu";
|
||||
keyFile = config.sops.secrets.livekit_key_file.path;
|
||||
};
|
||||
|
||||
systemd.services.lk-jwt-service.environment.LIVEKIT_FULL_ACCESS_HOMESERVERS = "cyperpunk.de";
|
||||
|
||||
@@ -1,19 +1,8 @@
|
||||
{ config, pkgs, ... }:
|
||||
{
|
||||
environment = {
|
||||
systemPackages = with pkgs; [
|
||||
maubot
|
||||
];
|
||||
|
||||
persistence."/persist".directories = [
|
||||
{
|
||||
directory = "/var/lib/maubot";
|
||||
user = "maubot";
|
||||
group = "maubot";
|
||||
mode = "0750";
|
||||
}
|
||||
];
|
||||
};
|
||||
environment.systemPackages = with pkgs; [
|
||||
maubot
|
||||
];
|
||||
|
||||
services = {
|
||||
maubot = {
|
||||
|
||||
@@ -1,39 +1,24 @@
|
||||
{ config, lib, ... }:
|
||||
{
|
||||
sops.secrets = {
|
||||
"matrix/bridges/meta/as_token" = {
|
||||
meta_as_token = {
|
||||
owner = "mautrix-meta-facebook";
|
||||
group = "mautrix-meta";
|
||||
};
|
||||
"matrix/bridges/meta/hs_token" = {
|
||||
meta_hs_token = {
|
||||
owner = "mautrix-meta-facebook";
|
||||
group = "mautrix-meta";
|
||||
};
|
||||
"matrix/bridges/instagram/as_token" = {
|
||||
instagram_as_token = {
|
||||
owner = "mautrix-meta-instagram";
|
||||
group = "mautrix-meta";
|
||||
};
|
||||
"matrix/bridges/instagram/hs_token" = {
|
||||
instagram_hs_token = {
|
||||
owner = "mautrix-meta-instagram";
|
||||
group = "mautrix-meta";
|
||||
};
|
||||
};
|
||||
|
||||
environment.persistence."/persist".directories = [
|
||||
{
|
||||
directory = "/var/lib/mautrix-meta-facebook";
|
||||
user = "mautrix-meta-facebook";
|
||||
group = "mautrix-meta";
|
||||
mode = "0750";
|
||||
}
|
||||
{
|
||||
directory = "/var/lib/mautrix-meta-instagram";
|
||||
user = "mautrix-meta-instagram";
|
||||
group = "mautrix-meta";
|
||||
mode = "0750";
|
||||
}
|
||||
];
|
||||
|
||||
systemd.services = {
|
||||
mautrix-meta-facebook-env = {
|
||||
before = [ "mautrix-meta-facebook-registration.service" ];
|
||||
@@ -44,12 +29,8 @@
|
||||
};
|
||||
script = ''
|
||||
mkdir -p /run/mautrix-meta-facebook
|
||||
echo "META_AS_TOKEN=$(cat ${
|
||||
config.sops.secrets."matrix/bridges/meta/as_token".path
|
||||
})" > /run/mautrix-meta-facebook/env
|
||||
echo "META_HS_TOKEN=$(cat ${
|
||||
config.sops.secrets."matrix/bridges/meta/hs_token".path
|
||||
})" >> /run/mautrix-meta-facebook/env
|
||||
echo "META_AS_TOKEN=$(cat ${config.sops.secrets.meta_as_token.path})" > /run/mautrix-meta-facebook/env
|
||||
echo "META_HS_TOKEN=$(cat ${config.sops.secrets.meta_hs_token.path})" >> /run/mautrix-meta-facebook/env
|
||||
chmod 600 /run/mautrix-meta-facebook/env
|
||||
chown mautrix-meta-facebook:mautrix-meta /run/mautrix-meta-facebook/env
|
||||
'';
|
||||
@@ -64,12 +45,8 @@
|
||||
};
|
||||
script = ''
|
||||
mkdir -p /run/mautrix-meta-instagram
|
||||
echo "INSTAGRAM_AS_TOKEN=$(cat ${
|
||||
config.sops.secrets."matrix/bridges/instagram/as_token".path
|
||||
})" > /run/mautrix-meta-instagram/env
|
||||
echo "INSTAGRAM_HS_TOKEN=$(cat ${
|
||||
config.sops.secrets."matrix/bridges/instagram/hs_token".path
|
||||
})" >> /run/mautrix-meta-instagram/env
|
||||
echo "INSTAGRAM_AS_TOKEN=$(cat ${config.sops.secrets.instagram_as_token.path})" > /run/mautrix-meta-instagram/env
|
||||
echo "INSTAGRAM_HS_TOKEN=$(cat ${config.sops.secrets.instagram_hs_token.path})" >> /run/mautrix-meta-instagram/env
|
||||
chmod 600 /run/mautrix-meta-instagram/env
|
||||
chown mautrix-meta-instagram:mautrix-meta /run/mautrix-meta-instagram/env
|
||||
'';
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
{ config, ... }:
|
||||
{
|
||||
sops.secrets.mjolnir_access_token = { };
|
||||
|
||||
services.draupnir = {
|
||||
enable = true;
|
||||
secrets.accessToken = config.sops.secrets.mjolnir_access_token.path;
|
||||
settings = {
|
||||
homeserverUrl = "https://matrix.cyperpunk.de";
|
||||
managementRoom = "!eErCimyDjLSebHjpJA:cyperpunk.de";
|
||||
};
|
||||
};
|
||||
}
|
||||
|
||||
#curl -X POST https://matrix.cyperpunk.de/_matrix/client/v3/login \
|
||||
# -H "Content-Type: application/json" \
|
||||
# -d '{"type":"m.login.password ","user":"mjolnir","password":"i318HXBRkt)Lh$nOPwq#6n9z&<W[XJ&2c4$Zf>7jV}-uQCE{<plwk;LZ)10*N<~1"}'
|
||||
@@ -1,11 +1,12 @@
|
||||
{
|
||||
config,
|
||||
pkgs,
|
||||
lib,
|
||||
...
|
||||
}:
|
||||
{
|
||||
sops.secrets = {
|
||||
"postgres/replication_password" = {
|
||||
pg_replication_password = {
|
||||
owner = "root";
|
||||
group = "root";
|
||||
};
|
||||
@@ -17,10 +18,12 @@
|
||||
description = "PostgreSQL WAL streaming replica (Docker)";
|
||||
requires = [
|
||||
"docker.service"
|
||||
"tailscaled.service"
|
||||
"network-online.target"
|
||||
];
|
||||
after = [
|
||||
"docker.service"
|
||||
"tailscaled.service"
|
||||
"network-online.target"
|
||||
];
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
@@ -29,53 +32,64 @@
|
||||
Type = "simple";
|
||||
Restart = "on-failure";
|
||||
RestartSec = "10s";
|
||||
TimeoutStartSec = "0";
|
||||
};
|
||||
|
||||
preStart = ''
|
||||
DATADIR="/storage/backup/postgresql-replica"
|
||||
PG_PASS=$(cat ${config.sops.secrets."postgres/replication_password".path})
|
||||
${pkgs.docker}/bin/docker pull postgres:17
|
||||
if [ ! -f "$DATADIR/PG_VERSION" ]; then
|
||||
echo "No data dir found — running pg_basebackup..."
|
||||
rm -rf "$DATADIR"
|
||||
${pkgs.docker}/bin/docker run --rm \
|
||||
-e PGPASSWORD="$PG_PASS" \
|
||||
-v "/storage/backup:/out" \
|
||||
--network host \
|
||||
postgres:17 \
|
||||
pg_basebackup \
|
||||
--host=10.10.0.1 \
|
||||
--port=5432 \
|
||||
--username=replicator \
|
||||
--pgdata=/out/postgresql-replica \
|
||||
--wal-method=stream \
|
||||
--checkpoint=fast \
|
||||
--progress \
|
||||
--verbose
|
||||
touch "$DATADIR/standby.signal"
|
||||
cat > "$DATADIR/postgresql.auto.conf" <<EOF
|
||||
primary_conninfo = 'host=10.10.0.1 port=5432 user=replicator password=$PG_PASS application_name=cyper-controller sslmode=disable'
|
||||
DATADIR="/storage/backup/postgresql-replica"
|
||||
PG_PASS=$(cat ${config.sops.secrets.pg_replication_password.path})
|
||||
|
||||
${pkgs.docker}/bin/docker pull postgres:17
|
||||
|
||||
if [ ! -f "$DATADIR/PG_VERSION" ]; then
|
||||
echo "No data dir found — running pg_basebackup..."
|
||||
rm -rf "$DATADIR"
|
||||
|
||||
${pkgs.docker}/bin/docker run --rm \
|
||||
-e PGPASSWORD="$PG_PASS" \
|
||||
-v "/storage/backup:/out" \
|
||||
--network host \
|
||||
postgres:17 \
|
||||
pg_basebackup \
|
||||
--host=100.109.10.91 \
|
||||
--port=5432 \
|
||||
--username=replicator \
|
||||
--pgdata=/out/postgresql-replica \
|
||||
--wal-method=stream \
|
||||
--checkpoint=fast \
|
||||
--progress \
|
||||
--verbose
|
||||
|
||||
# standby signal
|
||||
touch "$DATADIR/standby.signal"
|
||||
|
||||
# primary conninfo
|
||||
cat > "$DATADIR/postgresql.auto.conf" <<EOF
|
||||
primary_conninfo = 'host=100.109.10.91 port=5432 user=replicator password=$PG_PASS application_name=cyper-controller sslmode=require'
|
||||
EOF
|
||||
cat > "$DATADIR/postgresql.conf" <<EOF
|
||||
|
||||
# minimal postgresql.conf
|
||||
cat > "$DATADIR/postgresql.conf" <<EOF
|
||||
hot_standby = on
|
||||
hot_standby_feedback = on
|
||||
wal_receiver_timeout = '60s'
|
||||
port = 5434
|
||||
listen_addresses = '*'
|
||||
EOF
|
||||
chown -R 999:999 "$DATADIR"
|
||||
fi
|
||||
if [ ! -f "$DATADIR/postgresql.conf" ]; then
|
||||
cat > "$DATADIR/postgresql.conf" <<EOF
|
||||
|
||||
chown -R 999:999 "$DATADIR"
|
||||
fi
|
||||
|
||||
# ensure postgresql.conf exists on subsequent starts
|
||||
if [ ! -f "$DATADIR/postgresql.conf" ]; then
|
||||
cat > "$DATADIR/postgresql.conf" <<EOF
|
||||
hot_standby = on
|
||||
hot_standby_feedback = on
|
||||
wal_receiver_timeout = '60s'
|
||||
port = 5434
|
||||
listen_addresses = '*'
|
||||
EOF
|
||||
chown 999:999 "$DATADIR/postgresql.conf"
|
||||
fi
|
||||
chown 999:999 "$DATADIR/postgresql.conf"
|
||||
fi
|
||||
'';
|
||||
|
||||
script = ''
|
||||
|
||||
@@ -34,59 +34,45 @@ let
|
||||
in
|
||||
{
|
||||
sops.secrets = {
|
||||
"matrix/macaroon_secret" = { };
|
||||
"matrix/registration_secret" = {
|
||||
matrix_macaroon_secret = { };
|
||||
matrix_registration_secret = {
|
||||
owner = "matrix-synapse";
|
||||
group = "matrix-synapse";
|
||||
};
|
||||
"postgres/replication_password" = {
|
||||
pg_replication_password = {
|
||||
owner = "postgres";
|
||||
group = "postgres";
|
||||
};
|
||||
"kanidm/synapse_secret" = {
|
||||
kanidm_synapse_secret = {
|
||||
owner = "matrix-synapse";
|
||||
group = "matrix-synapse";
|
||||
};
|
||||
};
|
||||
|
||||
environment.persistence."/persist".directories = [
|
||||
{
|
||||
directory = "/var/lib/matrix-synapse";
|
||||
user = "matrix-synapse";
|
||||
group = "matrix-synapse";
|
||||
mode = "0700";
|
||||
}
|
||||
{
|
||||
directory = "/var/lib/postgresql";
|
||||
user = "postgres";
|
||||
group = "postgres";
|
||||
mode = "0750";
|
||||
}
|
||||
{
|
||||
directory = "/var/lib/acme";
|
||||
user = "acme";
|
||||
group = "acme";
|
||||
mode = "0755";
|
||||
}
|
||||
systemd.tmpfiles.rules = [
|
||||
"d /var/www/matrix 0755 nginx nginx -"
|
||||
"L+ /var/www/matrix/index.html 0644 nginx nginx - ${matrixIndexHtml}"
|
||||
"L+ /var/www/matrix/register.php 0644 nginx nginx - ${matrixRegisterPhp}"
|
||||
"L+ /var/www/matrix/style.css 0644 nginx nginx - ${matrixStyleCss}"
|
||||
"L+ /var/www/matrix/app.js 0644 nginx nginx - ${matrixAppJs}"
|
||||
];
|
||||
|
||||
services = {
|
||||
|
||||
phpfpm.pools.matrix = {
|
||||
user = "nginx";
|
||||
group = "nginx";
|
||||
settings = {
|
||||
"listen.owner" = "nginx";
|
||||
"listen.group" = "nginx";
|
||||
"pm" = "dynamic";
|
||||
"pm.max_children" = 10;
|
||||
"pm.start_servers" = 2;
|
||||
"pm.min_spare_servers" = 1;
|
||||
"pm.max_spare_servers" = 3;
|
||||
};
|
||||
phpPackage = pkgs.php.withExtensions ({ enabled, all }: enabled ++ [ all.curl ]);
|
||||
services.phpfpm.pools.matrix = {
|
||||
user = "nginx";
|
||||
group = "nginx";
|
||||
settings = {
|
||||
"listen.owner" = "nginx";
|
||||
"listen.group" = "nginx";
|
||||
"pm" = "dynamic";
|
||||
"pm.max_children" = 10;
|
||||
"pm.start_servers" = 2;
|
||||
"pm.min_spare_servers" = 1;
|
||||
"pm.max_spare_servers" = 3;
|
||||
};
|
||||
phpPackage = pkgs.php.withExtensions ({ enabled, all }: enabled ++ [ all.curl ]);
|
||||
};
|
||||
|
||||
services = {
|
||||
matrix-synapse = {
|
||||
enable = true;
|
||||
settings = {
|
||||
@@ -95,8 +81,8 @@ in
|
||||
enable_registration = false;
|
||||
trusted_key_servers = [ { server_name = "matrix.org"; } ];
|
||||
suppress_key_server_warning = true;
|
||||
registration_shared_secret_path = config.sops.secrets."matrix/registration_secret".path;
|
||||
macaroon_secret_key = "$__file{${config.sops.secrets."matrix/macaroon_secret".path}}";
|
||||
registration_shared_secret_path = config.sops.secrets.matrix_registration_secret.path;
|
||||
macaroon_secret_key = "$__file{${config.sops.secrets.matrix_macaroon_secret.path}}";
|
||||
matrix_rtc = {
|
||||
enabled = true;
|
||||
transports = [
|
||||
@@ -149,7 +135,7 @@ in
|
||||
type = "metrics";
|
||||
bind_addresses = [
|
||||
"127.0.0.1"
|
||||
"10.10.0.1"
|
||||
"100.109.10.91"
|
||||
];
|
||||
resources = [ ];
|
||||
}
|
||||
@@ -162,7 +148,7 @@ in
|
||||
idp_name = "Kanidm";
|
||||
issuer = "https://auth.cyperpunk.de/oauth2/openid/synapse";
|
||||
client_id = "synapse";
|
||||
client_secret_path = config.sops.secrets."kanidm/synapse_secret".path;
|
||||
client_secret_path = config.sops.secrets.kanidm_synapse_secret.path;
|
||||
scopes = [
|
||||
"openid"
|
||||
"profile"
|
||||
@@ -250,11 +236,10 @@ in
|
||||
wal_level = "replica";
|
||||
max_wal_senders = 5;
|
||||
wal_keep_size = "512MB";
|
||||
listen_addresses = lib.mkForce "127.0.0.1,10.10.0.1";
|
||||
ssl = true;
|
||||
listen_addresses = lib.mkForce "127.0.0.1,100.109.10.91";
|
||||
};
|
||||
authentication = lib.mkAfter ''
|
||||
hostssl replication replicator 10.10.0.2/32 scram-sha-256
|
||||
host replication replicator 100.0.0.0/8 scram-sha-256
|
||||
'';
|
||||
};
|
||||
|
||||
@@ -266,26 +251,15 @@ in
|
||||
};
|
||||
};
|
||||
|
||||
systemd = {
|
||||
services = {
|
||||
matrix-synapse.serviceConfig.ReadOnlyPaths = [
|
||||
"/var/lib/mautrix-discord"
|
||||
"/var/lib/mautrix-whatsapp"
|
||||
];
|
||||
postgresql.postStart = lib.mkAfter ''
|
||||
PG_PASS=$(cat ${config.sops.secrets."postgres/replication_password".path})
|
||||
${config.services.postgresql.package}/bin/psql -U postgres -c \
|
||||
"ALTER ROLE replicator WITH PASSWORD '$PG_PASS';"
|
||||
'';
|
||||
};
|
||||
|
||||
tmpfiles.rules = [
|
||||
"d /var/www/matrix 0755 nginx nginx -"
|
||||
"L+ /var/www/matrix/index.html 0644 nginx nginx - ${matrixIndexHtml}"
|
||||
"L+ /var/www/matrix/register.php 0644 nginx nginx - ${matrixRegisterPhp}"
|
||||
"L+ /var/www/matrix/style.css 0644 nginx nginx - ${matrixStyleCss}"
|
||||
"L+ /var/www/matrix/app.js 0644 nginx nginx - ${matrixAppJs}"
|
||||
systemd.services = {
|
||||
matrix-synapse.serviceConfig.ReadOnlyPaths = [
|
||||
"/var/lib/mautrix-discord"
|
||||
"/var/lib/mautrix-whatsapp"
|
||||
];
|
||||
postgresql.postStart = lib.mkAfter ''
|
||||
PG_PASS=$(cat ${config.sops.secrets.pg_replication_password.path})
|
||||
${config.services.postgresql.package}/bin/psql -U postgres -c \
|
||||
"ALTER ROLE replicator WITH PASSWORD '$PG_PASS';"
|
||||
'';
|
||||
};
|
||||
|
||||
}
|
||||
|
||||
@@ -1,40 +1,29 @@
|
||||
{ ... }:
|
||||
{
|
||||
services.postgresql = {
|
||||
ensureUsers = [
|
||||
{
|
||||
name = "mautrix-whatsapp";
|
||||
ensureDBOwnership = true;
|
||||
}
|
||||
];
|
||||
ensureDatabases = [ "mautrix-whatsapp" ];
|
||||
};
|
||||
|
||||
environment.persistence."/persist".directories = [
|
||||
{
|
||||
directory = "/var/lib/mautrix-whatsapp";
|
||||
user = "mautrix-whatsapp";
|
||||
group = "mautrix-whatsapp";
|
||||
mode = "0750";
|
||||
}
|
||||
];
|
||||
|
||||
services = {
|
||||
postgresql = {
|
||||
ensureUsers = [
|
||||
{
|
||||
name = "mautrix-whatsapp";
|
||||
ensureDBOwnership = true;
|
||||
}
|
||||
];
|
||||
ensureDatabases = [ "mautrix-whatsapp" ];
|
||||
};
|
||||
|
||||
mautrix-whatsapp = {
|
||||
enable = true;
|
||||
settings = {
|
||||
homeserver = {
|
||||
address = "http://127.0.0.1:8008";
|
||||
domain = "cyperpunk.de";
|
||||
};
|
||||
database = {
|
||||
type = "postgres";
|
||||
uri = "postgres:///mautrix-whatsapp?host=/run/postgresql&sslmode=disable";
|
||||
};
|
||||
bridge.permissions = {
|
||||
"cyperpunk.de" = "user";
|
||||
"@dergrumpf:cyperpunk.de" = "admin";
|
||||
};
|
||||
services.mautrix-whatsapp = {
|
||||
enable = true;
|
||||
settings = {
|
||||
homeserver = {
|
||||
address = "http://127.0.0.1:8008";
|
||||
domain = "cyperpunk.de";
|
||||
};
|
||||
database = {
|
||||
type = "postgres";
|
||||
uri = "postgres:///mautrix-whatsapp?host=/run/postgresql&sslmode=disable";
|
||||
};
|
||||
bridge.permissions = {
|
||||
"cyperpunk.de" = "user";
|
||||
"@dergrumpf:cyperpunk.de" = "admin";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
@@ -27,29 +27,20 @@ in
|
||||
imports = [ ./gs-exporter.nix ];
|
||||
|
||||
sops.secrets = {
|
||||
"services/grafana/secret_key" = {
|
||||
grafana_secret_key = {
|
||||
owner = "grafana";
|
||||
group = "grafana";
|
||||
};
|
||||
"kanidm/grafana_secret" = {
|
||||
kanidm_grafana_secret = {
|
||||
owner = "grafana";
|
||||
group = "grafana";
|
||||
};
|
||||
"network/zyxel_pass" = {
|
||||
zyxel_pass = {
|
||||
group = "gs1200-exporter";
|
||||
mode = "0440";
|
||||
};
|
||||
};
|
||||
|
||||
environment.persistence."/persist".directories = [
|
||||
{
|
||||
directory = "/var/lib/grafana";
|
||||
user = "grafana";
|
||||
group = "grafana";
|
||||
mode = "0750";
|
||||
}
|
||||
];
|
||||
|
||||
users.groups.gs1200-exporter = { };
|
||||
|
||||
services = {
|
||||
@@ -78,7 +69,7 @@ in
|
||||
serve_from_sub_path = true;
|
||||
};
|
||||
security = {
|
||||
secret_key = "$__file{${config.sops.secrets."services/grafana/secret_key".path}}";
|
||||
secret_key = "$__file{${config.sops.secrets.grafana_secret_key.path}}";
|
||||
allow_embedding = true;
|
||||
cookie_samesite = "none";
|
||||
cookie_secure = true;
|
||||
@@ -91,7 +82,7 @@ in
|
||||
enabled = true;
|
||||
name = "Kanidm";
|
||||
client_id = "grafana";
|
||||
client_secret = "$__file{${config.sops.secrets."kanidm/grafana_secret".path}}";
|
||||
client_secret = "$__file{${config.sops.secrets.kanidm_grafana_secret.path}}";
|
||||
scopes = "openid profile email";
|
||||
auth_url = "https://auth.cyperpunk.de/ui/oauth2";
|
||||
token_url = "https://auth.cyperpunk.de/oauth2/token";
|
||||
@@ -134,7 +125,7 @@ in
|
||||
metrics_path = "/_synapse/metrics";
|
||||
static_configs = [
|
||||
{
|
||||
targets = [ "10.10.0.1:9009" ];
|
||||
targets = [ "100.109.10.91:9009" ];
|
||||
labels = {
|
||||
instance = "cyper-proxy";
|
||||
job = "master";
|
||||
@@ -158,7 +149,7 @@ in
|
||||
job_name = "postgresql-proxy";
|
||||
static_configs = [
|
||||
{
|
||||
targets = [ "10.10.0.1:9188" ];
|
||||
targets = [ "100.109.10.91:9188" ];
|
||||
labels = {
|
||||
instance = "cyper-proxy";
|
||||
};
|
||||
@@ -181,13 +172,13 @@ in
|
||||
zyxel1 = {
|
||||
address = "192.168.2.3";
|
||||
port = 9934;
|
||||
passwordFile = config.sops.secrets."network/zyxel_pass".path;
|
||||
passwordFile = config.sops.secrets.zyxel_pass.path;
|
||||
group = "gs1200-exporter";
|
||||
};
|
||||
zyxel2 = {
|
||||
address = "192.168.2.4";
|
||||
port = 9935;
|
||||
passwordFile = config.sops.secrets."network/zyxel_pass".path;
|
||||
passwordFile = config.sops.secrets.zyxel_pass.path;
|
||||
group = "gs1200-exporter";
|
||||
};
|
||||
};
|
||||
|
||||
@@ -1,6 +1,7 @@
|
||||
_:
|
||||
let
|
||||
upstream = "10.10.0.2";
|
||||
|
||||
upstream = "100.86.56.71";
|
||||
|
||||
mkProxy = port: {
|
||||
forceSSL = true;
|
||||
|
||||
@@ -48,16 +48,6 @@ let
|
||||
in
|
||||
{
|
||||
nixpkgs.overlays = [ octoprint-overlay ];
|
||||
|
||||
environment.persistence."/persist".directories = [
|
||||
{
|
||||
directory = "/var/lib/octoprint";
|
||||
user = "octoprint";
|
||||
group = "octoprint";
|
||||
mode = "0750";
|
||||
}
|
||||
];
|
||||
|
||||
services.octoprint = {
|
||||
enable = true;
|
||||
host = "0.0.0.0";
|
||||
|
||||
@@ -1,10 +1,11 @@
|
||||
{ config, ... }:
|
||||
{
|
||||
|
||||
sops.secrets = {
|
||||
"services/paperless/admin" = {
|
||||
paperless_admin = {
|
||||
owner = "paperless";
|
||||
};
|
||||
"services/paperless/oidc_secret" = {
|
||||
paperless_oidc_secret = {
|
||||
owner = "paperless";
|
||||
};
|
||||
};
|
||||
@@ -17,14 +18,14 @@
|
||||
consumptionDir = "/storage/fast/paperless/consume";
|
||||
dataDir = "/storage/fast/paperless";
|
||||
configureTika = true;
|
||||
passwordFile = config.sops.secrets."services/paperless/admin".path;
|
||||
passwordFile = config.sops.secrets.paperless_admin.path;
|
||||
settings = {
|
||||
PAPERLESS_USE_X_FORWARDED_HOST = true;
|
||||
PAPERLESS_USE_X_FORWARDED_PORT = true;
|
||||
PAPERLESS_ALLOWED_HOSTS = "ngx.cyperpunk.de,10.10.0.2,localhost";
|
||||
PAPERLESS_ALLOWED_HOSTS = "ngx.cyperpunk.de,100.109.179.25,localhost";
|
||||
PAPERLESS_CSRF_TRUSTED_ORIGINS = [
|
||||
"https://ngx.cyperpunk.de"
|
||||
"http://10.10.0.2:28101"
|
||||
"http://100.109.179.25:28101"
|
||||
];
|
||||
PAPERLESS_OCR_LANGUAGE = "deu+eng";
|
||||
PAPERLESS_CONSUMER_POLLING = 60;
|
||||
@@ -53,7 +54,7 @@
|
||||
requires = [ "systemd-tmpfiles-setup.service" ];
|
||||
};
|
||||
paperless-web = {
|
||||
serviceConfig.EnvironmentFiles = [ config.sops.secrets."services/paperless/oidc_secret".path ];
|
||||
serviceConfig.EnvironmentFiles = [ config.sops.secrets.paperless_oidc_secret.path ];
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
@@ -11,6 +11,8 @@ let
|
||||
port = 11080;
|
||||
in
|
||||
{
|
||||
boot.kernel.sysctl."vm.overcommit_memory" = lib.mkForce "1";
|
||||
|
||||
services.searx = {
|
||||
enable = true;
|
||||
package = pkgs.searxng;
|
||||
|
||||
@@ -1,15 +1,6 @@
|
||||
{ pkgs, ... }:
|
||||
|
||||
{
|
||||
environment.persistence."/persist".directories = [
|
||||
{
|
||||
directory = "/var/lib/unifi";
|
||||
user = "unifi";
|
||||
group = "unifi";
|
||||
mode = "0750";
|
||||
}
|
||||
];
|
||||
|
||||
services.unifi = {
|
||||
enable = true;
|
||||
unifiPackage = pkgs.unifi;
|
||||
|
||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user