Works on Darwin
This commit is contained in:
greg-compass
@@ -0,0 +1,8 @@
|
||||
{ ... }:
|
||||
|
||||
{
|
||||
imports = [
|
||||
./syncthing.nix
|
||||
./users.nix
|
||||
];
|
||||
}
|
||||
@@ -0,0 +1,46 @@
|
||||
{ ... }:
|
||||
|
||||
let
|
||||
syncs = [
|
||||
"nas"
|
||||
"dns"
|
||||
"linode"
|
||||
];
|
||||
in
|
||||
{
|
||||
services.syncthing = {
|
||||
enable = true;
|
||||
user = "greg";
|
||||
group = "users";
|
||||
dataDir = "/home/greg/sync";
|
||||
devices = {
|
||||
nas = {
|
||||
addresses = [
|
||||
"tcp://nas.thehellings.lan:22000"
|
||||
"tcp://chronicles.greg-hellings.gmail.com.beta.tailscale.net:22000"
|
||||
];
|
||||
id = "74JUTZG-77EPGO3-FEYCL2P-CHDWP5G-6EXWZVB-XTAH6O5-TUXCVY2-QNRHSQ4";
|
||||
};
|
||||
dns = {
|
||||
addresses = [
|
||||
"tcp://dns.thehellings.lan:22000"
|
||||
"tcp://2maccabees.greg-hellings.gmail.com.beta.tailscale.net:22000"
|
||||
];
|
||||
id = "C4XJCH7-3ZNW6XZ-R5DB2EU-OEGVVT2-WPHQAG7-UDWER36-6NO5KZR-4MN5VAK";
|
||||
};
|
||||
linode = {
|
||||
addresses = [
|
||||
"tcp://linode.thehellings.com:22000"
|
||||
];
|
||||
id = "ROZPUG5-G4IAXYA-JNRQXRD-5PFU2BQ-WVJTOGZ-DFMGJ5E-Q4IGXCJ-JHSNDQ6";
|
||||
};
|
||||
};
|
||||
folders = {
|
||||
"mkrvy-tc6x9" = {
|
||||
path = "/home/greg/drive";
|
||||
enable = true;
|
||||
devices = syncs;
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,28 @@
|
||||
# Only imported from the Linux modules
|
||||
|
||||
{ pkgs, ... }:
|
||||
|
||||
{
|
||||
# Enable the OpenSSH daemon for remote control
|
||||
services.openssh.enable = true;
|
||||
#services.openssh.permitRootLogin = "yes";
|
||||
|
||||
# Define a user account. Don't forget to set a password with ‘passwd’.
|
||||
users.users.greg = {
|
||||
isNormalUser = true;
|
||||
createHome = true;
|
||||
extraGroups = [ "wheel" "networkmanager" ]; # Enable ‘sudo’ for the user.
|
||||
shell = pkgs.xonsh;
|
||||
openssh.authorizedKeys.keys = [
|
||||
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAEAQDLQRq55JKqLifX+31kEXyuoB8gfM+5thAlgR7XLPvvdu6g2a5cCWyozQ1I2oGbPRfJtzcJ5ifM7Ii2PuqAj3MdYFLHBEDOhIpBBWme9Ts2YB9HJ4NorBvB4zEfJd0Q7k2MmylyeBOwdwGz3bVqPRDcJbxWFMDHqr33FEs6SXdfyAQ5SvhWGARI84qz8zUUdOp6M4e3aIGO3cx1gA+YzYQ4FbUtL8+m1NFO8VoNFMZBMf5q0iF/SgEu5bmGWUCePia6DvfeBFQ2/y4Y7WmOj980WE+JmFTkIvmGruMYeGI8FuDQ2JIIIcehddy9bQbPF4VlGnTFsHqJYVRUUWc+vH1cPNMn01oB8s27ogf9e1lyhIN+cZOgp/jDt4eXcO4Wr04uwj7CI6m+d8iMQOa5Jv0hmNgqqiwOMVBlKeo0FCxlovzwvn/Lia9WZ74JqM6JwLCD8SZ0oFgiSIHOTHrQhr7iaCmj7X/0ey7VR8FnCrpeAJpG+ELTfWGshF1d9QR2zW7u4EsXTDLiuOmdJ+/KxwMvjMcWdlg2+Qch6SwulTQRxWaED2IWJo+YiAql8eaiVXu/eZJGLoiskGFZnONoLrzIT4pSjakPlrSpn/M/GkP1pDpaMkr24OhJsGpJNEU3F1ZcOMqy2iJzIxlPmU8Xg0I/OrnbJplpaXeRCqnmouJUJhWkaPzawaVyW7dtvprLWcpQtUgTRet18WLyOrLKlq1jwvNRMTPKUJ2IFJMpk2pNEP6bdiUxyMa4vrRIEU2p1zsYSUJpCRLtccZ/i/+yAqwnTA2L5TdAORi9nD2uCdM/Ljz52V3A14QapS6oqcoWx2soWKgnsbVXoG8DxmUTpll77Ze9t7Y5216SMInWuOu0vstP8ZcgFmWsiBgIYIuLA58abWHMxgD251phYidua6R3Gtkf8J/kYqTR1P6eJF1bt5efEg7FD2aL1QQZsYJo3CRNz7yVe1XqMdPbfe2mFXQVF9TDX5x6r9Ir3d0KiEmTlBdByz8nSyPJ8IQxC58NT4LNVQs3p2XH2Zcf6B4JOBSmV4NNBnLseFobsxniWjkWwZigED/D2iu3OXuuhmskCbw0hKy2rBcKffaSNMioVqYIiYNfKlMlSvAacQKqc/1HCpqgX8PwAcSgNSLy4K7/gIrTHmjY+g+CH7onzatWzkLo+0vsZRa/D/qwhhK2CU2FeU07mhnWxWuzqpJuqVaAwDTaEforK7nQUtAOFAZZP6qGhIoqsynYt4THb+QORb3QYfaP0PVgQwXfVU5Q8eUQFZ8A+siPtOASFjDumsIbseB5VzkF+UhvdseJwkX2+4pVFu8eHFDyvArYsHeGK6fBcQGJFQc2jSs6doIP9HD9IO2R ghelling@unknown38BAF87CD102"
|
||||
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDv26EhyBZS9E5bcuZDHHkh/oeyINHXlsD3OEL1UjZekIsiHoMv2QHYq99cYO/CsTVGcZj4ZTOKxrQQ069Cm1II76nXJP9mb3+jip5QAE/zYSWfxi3SgQum95qmkQsx9mxeKFi4NfUU9qN9vpmJkn0hrvYWg8vU98bcYmkx4RtGW6EgZJed3347EtHshTqq3UfAbj3ErSQdCbEqgNOjokzGWmcx16HyyO5HoQj2FP7PGQmArzMz0V76BRsnpg97CoPKkoWoGk+P13BCWWXR9GCa2PbJ9uprzPa6Ib4+i9RJPdeSkUiLlFi6rBTHaZUT9WUIEaqNSq3bbu1bIqMXkifPeDw7m+TMfOBT8MUBciJaPlPTgXuz3T4kCHBI041hIt+/VqryGtxnT45IavyUaN3JWYntDbpG3eEW4N9IB2oGWuC/XuTJrsUaNpLPpApUKuozxhsFELBRepU+j+Wn4kgJJl8hy0n+WL63ZUee+/F23C7UNXoOc/wU3KbpxO6ipsTSkTzhZpQF2LOuA3JUs5t9ZaiCJ2P9r8axHiphCRcIYSbcCo3pZupf1eTDSXm+x9/UB2sfzErNEH4SdakoSdAi8jG8WhPVOs3BrIXjVBjvyBLeOH86EzBGR/Ba8X6MWoEW9Oau1C3P/z65VH8RHpvPvp6axlMynyVI1ygt5uheuQ== gregory.hellings@C02G48H8MD6R"
|
||||
];
|
||||
};
|
||||
|
||||
i18n.defaultLocale = "en_US.UTF-8";
|
||||
|
||||
console = {
|
||||
font = "Lat2-Terminus16";
|
||||
keyMap = "us";
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,107 @@
|
||||
{ lib, config, pkgs, ... }:
|
||||
|
||||
let
|
||||
cfg = config.greg.backup;
|
||||
backup_key = "backup_keys/id_ed25519";
|
||||
|
||||
makeJob = name: job: {
|
||||
paths = job.src;
|
||||
encryption.mode = "none";
|
||||
environment.BORG_RSH = "ssh -i /etc/${backup_key} -o 'StrictHostKeyChecking=no' -o 'UserKnownHostsFile=/dev/null'";
|
||||
repo = "ssh://backup@nas.me.ts//volume1/NetBackup/${job.dest}";
|
||||
compression = "auto,zstd";
|
||||
startAt = "daily";
|
||||
|
||||
user = job.user;
|
||||
group = job.group;
|
||||
preHook = job.pre;
|
||||
postHook = job.post;
|
||||
};
|
||||
|
||||
cronJob = name: job:
|
||||
let
|
||||
binName = "backup-${name}";
|
||||
script = pkgs.writeShellScriptBin binName ''
|
||||
exec 1> >(systemd-cat -t $(basename $0)) 2>&1
|
||||
set -ex
|
||||
${job.pre}
|
||||
${pkgs.rsync}/bin/rsync -avz --delete -e "${pkgs.openssh}/bin/ssh -i /etc/${backup_key} -o 'StrictHostKeyChecking=no' -o 'UserKnownHostsFile=/dev/null'" ${job.src}/* backup@nas.me.ts:/volume1/NetBackup/${job.dest}/
|
||||
${job.post}
|
||||
'';
|
||||
in {
|
||||
inherit script;
|
||||
cron = "0 1 * * * ${job.user} ${script}/bin/${binName}";
|
||||
};
|
||||
|
||||
in with lib; {
|
||||
options = {
|
||||
greg.backup = {
|
||||
key = mkOption {
|
||||
type = types.path;
|
||||
description = "SSH key to use";
|
||||
default = ./ssh/id_ed25519;
|
||||
};
|
||||
|
||||
jobs = mkOption {
|
||||
default = {};
|
||||
|
||||
type = with types; attrsOf (submodule (
|
||||
{ name, config, options, ... }:
|
||||
{
|
||||
options = {
|
||||
src = mkOption {
|
||||
type = types.str;
|
||||
description = "Local path (string form) to backup from";
|
||||
};
|
||||
|
||||
dest = mkOption {
|
||||
type = types.str;
|
||||
};
|
||||
|
||||
user = mkOption {
|
||||
type = types.str;
|
||||
default = "root";
|
||||
description = "User to run backup as";
|
||||
};
|
||||
|
||||
pre = mkOption {
|
||||
type = types.str;
|
||||
default = "";
|
||||
description = "Commands to run before backup";
|
||||
};
|
||||
|
||||
post = mkOption {
|
||||
type = types.str;
|
||||
default = "";
|
||||
description = "Commands to run after backup";
|
||||
};
|
||||
};
|
||||
}
|
||||
));
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
config = let
|
||||
jobs = attrValues ( mapAttrs cronJob cfg.jobs );
|
||||
in mkIf ( ( attrValues cfg.jobs ) != [] )
|
||||
{
|
||||
#services.borgbackup = {
|
||||
# jobs = mapAttrs makeJob cfg.jobs;
|
||||
#};
|
||||
services.cron = {
|
||||
enable = true;
|
||||
systemCronJobs = map (e: e.cron) jobs;
|
||||
};
|
||||
|
||||
environment.etc = mkIf ( cfg.key != null ) {
|
||||
"${backup_key}" = {
|
||||
user = "nobody";
|
||||
mode = "0777";
|
||||
source = cfg.key;
|
||||
};
|
||||
};
|
||||
|
||||
environment.systemPackages = map (e: e.script) jobs;
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,22 @@
|
||||
{ ... }:
|
||||
|
||||
{
|
||||
imports = [
|
||||
./automatic
|
||||
./backup.nix
|
||||
./gnome.nix
|
||||
./home.nix
|
||||
./linode.nix
|
||||
./linux.nix
|
||||
./proxy.nix
|
||||
./rpi4.nix
|
||||
./tailscale.nix
|
||||
];
|
||||
|
||||
system.stateVersion = "22.05";
|
||||
|
||||
# I am a fan of network manager, myself
|
||||
networking.networkmanager.enable = true;
|
||||
|
||||
nix.settings.auto-optimise-store = true;
|
||||
}
|
||||
@@ -0,0 +1,57 @@
|
||||
{ config, pkgs, lib, ... }:
|
||||
|
||||
let
|
||||
cfg = config.greg.gnome;
|
||||
|
||||
in with lib; {
|
||||
options = {
|
||||
greg.gnome.enable = mkEnableOption "Enable my default Gnome3 setup";
|
||||
};
|
||||
|
||||
config = mkIf cfg.enable {
|
||||
greg.xprograms.enable = true;
|
||||
|
||||
# Sets up a basic Gnome installation
|
||||
services = {
|
||||
xserver = {
|
||||
enable = true;
|
||||
displayManager.gdm.enable = true;
|
||||
desktopManager.gnome.enable = true;
|
||||
layout = "us";
|
||||
# Trackpad support
|
||||
libinput.enable = true;
|
||||
};
|
||||
|
||||
udev.packages = with pkgs; [
|
||||
gnome3.gnome-settings-daemon
|
||||
];
|
||||
|
||||
pipewire.enable = true;
|
||||
|
||||
# Enablement for Firefox
|
||||
gnome = {
|
||||
chrome-gnome-shell.enable = true;
|
||||
sushi.enable = true;
|
||||
gnome-online-accounts.enable = true;
|
||||
};
|
||||
};
|
||||
|
||||
programs.dconf.enable = true;
|
||||
programs.sway.enable = true; # Gives us Wayland
|
||||
xdg.portal = {
|
||||
enable = true;
|
||||
gtkUsePortal = true;
|
||||
wlr.enable = true; # Enables screen sharing in Wayland
|
||||
};
|
||||
|
||||
# Enable some Gnome plugins that I like
|
||||
environment.systemPackages = with pkgs; [
|
||||
gnome3.adwaita-icon-theme
|
||||
gnome3.gnome-tweaks
|
||||
gnome3.dconf-editor
|
||||
gnomeExtensions.appindicator
|
||||
gnomeExtensions.clipboard-indicator
|
||||
gnomeExtensions.dash-to-dock
|
||||
];
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,18 @@
|
||||
{ config, lib, ... }:
|
||||
|
||||
let
|
||||
cfg = config.greg.home;
|
||||
|
||||
in with lib;
|
||||
{
|
||||
options.greg.home = mkOption {
|
||||
type = types.bool;
|
||||
default = true;
|
||||
description = "Sets the device up to be part of my home network";
|
||||
};
|
||||
|
||||
config = mkIf cfg {
|
||||
time.timeZone = "America/Chicago";
|
||||
networking.domain = "thehellings.lan";
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,44 @@
|
||||
{ config, lib, pkgs, ... }:
|
||||
|
||||
let
|
||||
cfg = config.greg.linode;
|
||||
|
||||
in with lib;
|
||||
{
|
||||
options.greg.linode = {
|
||||
enable = mkEnableOption "Set sensible defaults for a Linode host";
|
||||
|
||||
bootTimeout = mkOption {
|
||||
type = types.int;
|
||||
default = 15;
|
||||
description = "Set bootloader timeout in seconds.";
|
||||
};
|
||||
};
|
||||
|
||||
config = mkIf cfg.enable {
|
||||
# Enables connection over Linode consoles
|
||||
boot.kernelParams = [ "console=ttyS0,19200n8" ];
|
||||
boot.loader.grub = {
|
||||
device = "nodev";
|
||||
extraConfig = ''
|
||||
serial --speed=19200 --unit=0 --word=8 --parity=no --stop=1;
|
||||
terminal_input serial;
|
||||
terminal_output serial;
|
||||
'';
|
||||
};
|
||||
|
||||
# Tells grub to ignore partion-free device warnings, since we are on Linode
|
||||
boot.loader.timeout = 15;
|
||||
|
||||
networking.usePredictableInterfaceNames = false; # Use old style eth0 names
|
||||
networking.useDHCP = false;
|
||||
networking.interfaces.eth0.useDHCP = true;
|
||||
|
||||
# Suggested diagnostic tools
|
||||
environment.systemPackages = with pkgs; [
|
||||
inetutils
|
||||
mtr
|
||||
sysstat
|
||||
];
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,11 @@
|
||||
{ config, lib, ... }:
|
||||
|
||||
let
|
||||
cfg = config.greg.linux;
|
||||
|
||||
in with lib; {
|
||||
options.greg.linux = mkEnableOption "This system is Linux";
|
||||
|
||||
config = mkIf cfg {
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,81 @@
|
||||
{ config, lib, pkgs, ... }:
|
||||
|
||||
let
|
||||
cfg = config.greg.proxies;
|
||||
|
||||
alias = name: with builtins; head (split "\\." name);
|
||||
|
||||
makeHost = name: dest: {
|
||||
forceSSL = dest.ssl;
|
||||
enableACME = dest.ssl;
|
||||
locations."${dest.path}" = {
|
||||
proxyPass = dest.target;
|
||||
extraConfig = ''
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Upgrade $http_upgrade;
|
||||
proxy_set_header Connection $connection_upgrade;
|
||||
'';
|
||||
};
|
||||
serverAliases = lib.mkIf dest.genAliases [ "${alias name}" ];
|
||||
};
|
||||
|
||||
in with lib; {
|
||||
options = {
|
||||
greg.proxies = mkOption {
|
||||
default = {};
|
||||
example = literalExpression ''
|
||||
{ host-name = {
|
||||
target = proxyLocation;
|
||||
ssl = true;
|
||||
};
|
||||
'';
|
||||
description = ''
|
||||
Quick and simple Nginx proxy configurations.
|
||||
Use this to configure a very simple proxy that does not
|
||||
need any extra customization options other than SSL
|
||||
enablement.
|
||||
'';
|
||||
|
||||
type = with types; attrsOf (submodule (
|
||||
{ name, config, options, ... }:
|
||||
{
|
||||
options = {
|
||||
genAliases = mkOption {
|
||||
type = types.bool;
|
||||
description = "Whether to auto-generate short alias name";
|
||||
default = true;
|
||||
};
|
||||
|
||||
target = mkOption {
|
||||
type = types.str;
|
||||
description = ''The destination that is being proxied.'';
|
||||
example = "http://localhost:8080";
|
||||
};
|
||||
|
||||
ssl = mkOption {
|
||||
type = types.bool;
|
||||
description = "Whether to enable SSL in front of the proxy";
|
||||
default = false;
|
||||
};
|
||||
|
||||
path = mkOption {
|
||||
type = types.str;
|
||||
description = "The path prefix for this proxy";
|
||||
default = "/";
|
||||
};
|
||||
};
|
||||
}));
|
||||
};
|
||||
};
|
||||
|
||||
config.services.nginx = mkIf ( ( attrValues cfg ) != [] ) {
|
||||
enable = true;
|
||||
|
||||
recommendedGzipSettings = true;
|
||||
recommendedOptimisation = true;
|
||||
recommendedProxySettings = true;
|
||||
recommendedTlsSettings = true;
|
||||
|
||||
virtualHosts = mapAttrs makeHost cfg;
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,43 @@
|
||||
{ config, lib, pkgs, ... }:
|
||||
|
||||
let
|
||||
cfg = config.greg.rpi4;
|
||||
|
||||
in with lib; {
|
||||
options = {
|
||||
greg.rpi4 = {
|
||||
enable = mkEnableOption "Enable support for Raspberry Pi 4s";
|
||||
};
|
||||
};
|
||||
|
||||
config = mkIf cfg.enable {
|
||||
boot = {
|
||||
# This prevents us from having to compile our own kernel
|
||||
kernelPackages = pkgs.linuxPackages_rpi4;
|
||||
kernelParams = [
|
||||
"8250.nr_uarts=1"
|
||||
"console=ttyAMA0,115200"
|
||||
"console=tty1"
|
||||
"cma=128M"
|
||||
];
|
||||
|
||||
loader = {
|
||||
raspberryPi = {
|
||||
enable = true;
|
||||
version = 4;
|
||||
};
|
||||
|
||||
# Use the extlinux boot loader. (NixOS wants to enable GRUB by default)
|
||||
grub.enable = false;
|
||||
|
||||
# Enables the generation of /boot/extlinux/extlinux.conf
|
||||
#generic-extlinux-compatible.enable = true;
|
||||
};
|
||||
};
|
||||
|
||||
environment.systemPackages = with pkgs; [
|
||||
raspberrypifw
|
||||
usbutils
|
||||
];
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,14 @@
|
||||
{ lib, config, ... }:
|
||||
|
||||
let
|
||||
cfg = config.greg.tailscale;
|
||||
in {
|
||||
options = {
|
||||
greg.tailscale.enable = lib.mkEnableOption "Enable Tailscale";
|
||||
};
|
||||
|
||||
config = lib.mkIf cfg.enable {
|
||||
services.tailscale.enable = true;
|
||||
networking.firewall.checkReversePath = "loose";
|
||||
};
|
||||
}
|
||||
Reference in New Issue
Block a user