diff --git a/.gitignore b/.gitignore index 0d96e93..4173ca2 100644 --- a/.gitignore +++ b/.gitignore @@ -1,2 +1,3 @@ host result +.pre-commit-config.yaml diff --git a/ceph/home.nix b/ceph/home.nix index 124937b..3813c09 100644 --- a/ceph/home.nix +++ b/ceph/home.nix @@ -1,21 +1,23 @@ { - fsid = "749bf0ea-acf5-4a5e-b33e-9a057455c06b"; - clusterName = "home"; - initialMonitors = [ { - hostname = "myself.thehellings.lan"; - ipAddress = "10.42.1.6"; - } { - hostname = "jeremiah.thehellings.lan"; - ipAddress = "10.42.1.8"; - } { - hostname = "hosea.thehellings.lan"; - ipAddress = "10.42.1.7"; - } ]; - mdsNodes = [ { - hostname = "jeremiah.thehellings.lan"; - ipAddress = "10.42.1.8"; - } ]; - publicNetworks = [ "10.42.0.0/16" ]; - clusterNetworks = [ "10.201.0.0/16" ]; - adminKeyring = ../secrets/home.client.admin.keyring; + fsid = "749bf0ea-acf5-4a5e-b33e-9a057455c06b"; + clusterName = "home"; + initialMonitors = [{ + hostname = "myself.thehellings.lan"; + ipAddress = "10.42.1.6"; + } + { + hostname = "jeremiah.thehellings.lan"; + ipAddress = "10.42.1.8"; + } + { + hostname = "hosea.thehellings.lan"; + ipAddress = "10.42.1.7"; + }]; + mdsNodes = [{ + hostname = "jeremiah.thehellings.lan"; + ipAddress = "10.42.1.8"; + }]; + publicNetworks = [ "10.42.0.0/16" ]; + clusterNetworks = [ "10.201.0.0/16" ]; + adminKeyring = ../secrets/home.client.admin.keyring; } diff --git a/checks.nix b/checks.nix index 980d783..8f85128 100644 --- a/checks.nix +++ b/checks.nix @@ -1,9 +1,10 @@ { hooks, system, ... }: { - pre-commit-check = hooks.lib.${system}.run { - src = ./.; - hooks = { - }; - }; + pre-commit-check = hooks.lib.${system}.run { + src = ./.; + hooks = { + nixpkgs-fmt.enable = true; + }; + }; } diff --git a/configuration.nix b/configuration.nix index 1944e5c..87e011d 100644 --- a/configuration.nix +++ b/configuration.nix @@ -6,7 +6,8 @@ { imports = - [ # Include the results of the hardware scan. + [ + # Include the results of the hardware scan. ./hardware-configuration.nix ./modules/ ]; @@ -75,7 +76,7 @@ extraGroups = [ "networkmanager" "wheel" ]; packages = with pkgs; [ firefox - # thunderbird + # thunderbird ]; }; diff --git a/darwin-configuration.nix b/darwin-configuration.nix index 8f2bcdd..cbac3c7 100644 --- a/darwin-configuration.nix +++ b/darwin-configuration.nix @@ -1,8 +1,8 @@ { ... }: { - imports = [ - ./modules - ./hosts/work - ]; + imports = [ + ./modules + ./hosts/work + ]; } diff --git a/darwin/default.nix b/darwin/default.nix index 6f76ebf..67caf6c 100644 --- a/darwin/default.nix +++ b/darwin/default.nix @@ -1,33 +1,35 @@ { inputs, overlays, ... }: let - mac = { - system ? "aarch64-darwin", - name, - channel ? inputs.nixunstable, - hm ? inputs.hmunstable, - extraMods ? [] - }: - let - nixpkgs = import channel { - inherit system overlays; - }; - in inputs.darwin.lib.darwinSystem { - inherit system; - specialArgs = { inherit nixpkgs; }; - modules = [ - { - nixpkgs.overlays = overlays; - home-manager.extraSpecialArgs = { - inherit inputs; - host = name; - }; - } - hm.darwinModules.home-manager - inputs.self.modules.darwinModule - ./${name} - ] ++ extraMods; - }; -in rec { - la23002 = mac { name = "ivr"; }; - LA23002 = la23002; + mac = + { system ? "aarch64-darwin" + , name + , channel ? inputs.nixunstable + , hm ? inputs.hmunstable + , extraMods ? [ ] + }: + let + nixpkgs = import channel { + inherit system overlays; + }; + in + inputs.darwin.lib.darwinSystem { + inherit system; + specialArgs = { inherit nixpkgs; }; + modules = [ + { + nixpkgs.overlays = overlays; + home-manager.extraSpecialArgs = { + inherit inputs; + host = name; + }; + } + hm.darwinModules.home-manager + inputs.self.modules.darwinModule + ./${name} + ] ++ extraMods; + }; +in +rec { + la23002 = mac { name = "ivr"; }; + LA23002 = la23002; } diff --git a/flake.nix b/flake.nix index f6104c7..6f7f703 100644 --- a/flake.nix +++ b/flake.nix @@ -2,109 +2,112 @@ # your system. Help is available in the configuration.nix(5) man page # and in the NixOS manual (accessible by running ‘nixos-help’). { - description = "Greg's machines!"; + description = "Greg's machines!"; - inputs = { - agenix = { - url = "github:ryantm/agenix"; - inputs.nixpkgs.follows = "nixunstable"; - }; - btc = { - url = "github:fort-nix/nix-bitcoin/release"; - }; - darwin = { - url = "github:lnl7/nix-darwin/master"; - inputs.nixpkgs.follows = "nixunstable"; - }; - flake-parts.url = "github:hercules-ci/flake-parts"; - hooks.url = "github:cachix/git-hooks.nix"; - hm = { - url = "github:nix-community/home-manager/release-24.05"; - inputs.nixpkgs.follows = "nixstable"; - }; - hmunstable = { - url = "github:nix-community/home-manager/master"; - inputs.nixpkgs.follows = "nixstable"; - }; - nixvimstable.url = "github:nix-community/nixvim/nixos-24.05"; - nixvimunstable.url = "github:nix-community/nixvim/main"; - nix23_05.url = "github:NixOS/nixpkgs/nixos-23.05"; - nixstable.url = "github:nixos/nixpkgs/nixos-24.05"; - nixunstable.url = "github:nixos/nixpkgs/nixos-unstable"; - nurpkgs.url = "github:nix-community/NUR"; - vsext.url = "github:nix-community/nix-vscode-extensions"; - wsl = { - url = "github:nix-community/NixOS-WSL"; - inputs.nixpkgs.follows = "nixunstable"; - }; - zed.url = "github:zed-industries/zed/v0.154.x"; - }; + inputs = { + agenix = { + url = "github:ryantm/agenix"; + inputs.nixpkgs.follows = "nixunstable"; + }; + btc = { + url = "github:fort-nix/nix-bitcoin/release"; + }; + darwin = { + url = "github:lnl7/nix-darwin/master"; + inputs.nixpkgs.follows = "nixunstable"; + }; + flake-parts.url = "github:hercules-ci/flake-parts"; + hooks.url = "github:cachix/git-hooks.nix"; + hm = { + url = "github:nix-community/home-manager/release-24.05"; + inputs.nixpkgs.follows = "nixstable"; + }; + hmunstable = { + url = "github:nix-community/home-manager/master"; + inputs.nixpkgs.follows = "nixstable"; + }; + nixvimstable.url = "github:nix-community/nixvim/nixos-24.05"; + nixvimunstable.url = "github:nix-community/nixvim/main"; + nix23_05.url = "github:NixOS/nixpkgs/nixos-23.05"; + nixstable.url = "github:nixos/nixpkgs/nixos-24.05"; + nixunstable.url = "github:nixos/nixpkgs/nixos-unstable"; + nurpkgs.url = "github:nix-community/NUR"; + vsext.url = "github:nix-community/nix-vscode-extensions"; + wsl = { + url = "github:nix-community/NixOS-WSL"; + inputs.nixpkgs.follows = "nixunstable"; + }; + zed.url = "github:zed-industries/zed/v0.154.x"; + }; - outputs = { self, ...}@inputs: let - local_overlay = import ./overlays; - overlays = [ - inputs.agenix.overlays.default - local_overlay - inputs.nurpkgs.overlay - inputs.vsext.overlays.default - (_: _: { zed-editor = inputs.zed.packages.x86_64-linux.default; } ) - ]; + outputs = { self, ... }@inputs: + let + local_overlay = import ./overlays; + overlays = [ + inputs.agenix.overlays.default + local_overlay + inputs.nurpkgs.overlay + inputs.vsext.overlays.default + (_: _: { zed-editor = inputs.zed.packages.x86_64-linux.default; }) + ]; - in inputs.flake-parts.lib.mkFlake { inherit inputs; } { - systems = [ "x86_64-linux" "x86_64-darwin" "aarch64-linux" "aarch64-darwin" ]; - #checks = { - # x86_64-linux = { - # unstable = self.nixosConfigurations.jude.config.system.build.toplevel; - # stable = self.nixosConfigurations.linode.config.system.build.toplevel; - # }; - # aarch64-linux = { - # unstable = self.nixosConfigurations.nixos.config.system.build.toplevel; - # }; - #}; + in + inputs.flake-parts.lib.mkFlake { inherit inputs; } { + systems = [ "x86_64-linux" "x86_64-darwin" "aarch64-linux" "aarch64-darwin" ]; + #checks = { + # x86_64-linux = { + # unstable = self.nixosConfigurations.jude.config.system.build.toplevel; + # stable = self.nixosConfigurations.linode.config.system.build.toplevel; + # }; + # aarch64-linux = { + # unstable = self.nixosConfigurations.nixos.config.system.build.toplevel; + # }; + #}; - flake = { - nixosConfigurations = (import ./hosts { inherit inputs overlays; }); + flake = { + nixosConfigurations = (import ./hosts { inherit inputs overlays; }); - darwinConfigurations = (import ./darwin { inherit inputs overlays; }); + darwinConfigurations = (import ./darwin { inherit inputs overlays; }); - homeConfigurations = (import ./home { inherit inputs overlays; }); + homeConfigurations = (import ./home { inherit inputs overlays; }); - overlays = { - default = local_overlay; - }; + overlays = { + default = local_overlay; + }; - modules = import ./modules; - }; + modules = import ./modules; + }; - perSystem = { pkgs, system, ... }: { - _module.args.pkgs = import inputs.nixstable { - inherit system overlays; - }; + perSystem = { pkgs, self', system, ... }: { + _module.args.pkgs = import inputs.nixstable { + inherit system overlays; + }; - checks = import ./checks.nix { inherit system; inherit (inputs) hooks; }; + checks = import ./checks.nix { inherit system; inherit (inputs) hooks; }; - devShells = { - default = pkgs.mkShell { - buildInputs = with pkgs; [ - bashInteractive - curl - git - gnutar - gzip - inject - inject-darwin - tmux - vim - xonsh - ]; - }; - }; + devShells = { + default = pkgs.mkShell { + inherit (self'.checks.pre-commit-check) shellHook; + buildInputs = with pkgs; [ + bashInteractive + curl + git + gnutar + gzip + inject + inject-darwin + tmux + vim + xonsh + ]; + }; + }; - packages = rec { - defaullt = iso; - iso = self.nixosConfigurations.iso.config.system.build.isoImage; - iso-beta = self.nixosConfigurations.iso-beta.config.system.build.isoImage; - }; - }; - }; + packages = rec { + defaullt = iso; + iso = self.nixosConfigurations.iso.config.system.build.isoImage; + iso-beta = self.nixosConfigurations.iso-beta.config.system.build.isoImage; + }; + }; + }; } diff --git a/hardware-configuration.nix b/hardware-configuration.nix index dbb261b..64f11a1 100644 --- a/hardware-configuration.nix +++ b/hardware-configuration.nix @@ -5,7 +5,8 @@ { imports = - [ (modulesPath + "/installer/scan/not-detected.nix") + [ + (modulesPath + "/installer/scan/not-detected.nix") ]; boot.initrd.availableKernelModules = [ "xhci_pci" "thunderbolt" "nvme" "uas" "sd_mod" ]; @@ -14,13 +15,15 @@ boot.extraModulePackages = [ ]; fileSystems."/" = - { device = "/dev/disk/by-uuid/607b933f-2967-4652-b478-4d8e9aa38a0d"; + { + device = "/dev/disk/by-uuid/607b933f-2967-4652-b478-4d8e9aa38a0d"; fsType = "btrfs"; options = [ "subvol=@" ]; }; fileSystems."/boot" = - { device = "/dev/disk/by-uuid/B31C-C1F4"; + { + device = "/dev/disk/by-uuid/B31C-C1F4"; fsType = "vfat"; }; diff --git a/home/default.nix b/home/default.nix index 2fc77f2..15f5a34 100644 --- a/home/default.nix +++ b/home/default.nix @@ -1,26 +1,26 @@ -{ - inputs, - overlays, - ... +{ inputs +, overlays +, ... }: rec { - greghellings = - let - system = "x86_64-linux"; - pkgs = (import inputs.nixunstable { inherit system overlays; }); - in inputs.hmunstable.lib.homeManagerConfiguration { - inherit pkgs; - modules = [ ./home.nix ]; - extraSpecialArgs = { - inherit inputs; - nixvim = inputs.nixvimunstable; - gui = false; - gnome = false; - host = "ivr"; - username = "gregory.hellings"; - }; - }; + greghellings = + let + system = "x86_64-linux"; + pkgs = (import inputs.nixunstable { inherit system overlays; }); + in + inputs.hmunstable.lib.homeManagerConfiguration { + inherit pkgs; + modules = [ ./home.nix ]; + extraSpecialArgs = { + inherit inputs; + nixvim = inputs.nixvimunstable; + gui = false; + gnome = false; + host = "ivr"; + username = "gregory.hellings"; + }; + }; - "gregory.hellings" = greghellings; + "gregory.hellings" = greghellings; } diff --git a/home/home.nix b/home/home.nix index 4b002c4..a6bbaee 100644 --- a/home/home.nix +++ b/home/home.nix @@ -1,48 +1,50 @@ -{ pkgs, lib, - host ? "most", - nixvim, - ...}: +{ pkgs +, lib +, host ? "most" +, nixvim +, ... +}: { - nixpkgs.config.allowUnfreePredicate = (_: true); - imports = [ - nixvim.homeManagerModules.default - ./modules - ] ++ lib.optionals (builtins.pathExists ./hosts/${host}) [ ./hosts/${host} ]; + nixpkgs.config.allowUnfreePredicate = (_: true); + imports = [ + nixvim.homeManagerModules.default + ./modules + ] ++ lib.optionals (builtins.pathExists ./hosts/${host}) [ ./hosts/${host} ]; - programs.tmux = { - enable = true; - keyMode = "vi"; - terminal = "xterm-256color"; - customPaneNavigationAndResize = true; - extraConfig = (lib.strings.concatStringsSep "\n" [ - "bind P paste-buffer" - ]); - }; + programs.tmux = { + enable = true; + keyMode = "vi"; + terminal = "xterm-256color"; + customPaneNavigationAndResize = true; + extraConfig = (lib.strings.concatStringsSep "\n" [ + "bind P paste-buffer" + ]); + }; - home.stateVersion = "23.05"; - home.packages = with pkgs; [ - bitwarden-cli - copier - diffutils - findutils - gh - git - gnupatch - hms - htop - inetutils - jq - nano - nix-prefetch - nmap - openssl - setup-ssh - tmux - tree - unzip - wget - zip - ]; + home.stateVersion = "23.05"; + home.packages = with pkgs; [ + bitwarden-cli + copier + diffutils + findutils + gh + git + gnupatch + hms + htop + inetutils + jq + nano + nix-prefetch + nmap + openssl + setup-ssh + tmux + tree + unzip + wget + zip + ]; } diff --git a/home/hosts/exodus/default.nix b/home/hosts/exodus/default.nix index 499c450..2e2e34a 100644 --- a/home/hosts/exodus/default.nix +++ b/home/hosts/exodus/default.nix @@ -1,15 +1,15 @@ { pkgs, config, ... }: { - greg = { - vscodium = true; - development = true; - gnome = true; - gui = true; - }; - home.packages = with pkgs; [ - cargo - freeciv - #freeciv_qt - ]; + greg = { + vscodium = true; + development = true; + gnome = true; + gui = true; + }; + home.packages = with pkgs; [ + cargo + freeciv + #freeciv_qt + ]; } diff --git a/home/hosts/icdm-root/default.nix b/home/hosts/icdm-root/default.nix index d8147ea..5bd3e36 100644 --- a/home/hosts/icdm-root/default.nix +++ b/home/hosts/icdm-root/default.nix @@ -1,5 +1,3 @@ { ... }: -{ - -} +{ } diff --git a/home/hosts/ivr/default.nix b/home/hosts/ivr/default.nix index 352c975..ae59dfe 100644 --- a/home/hosts/ivr/default.nix +++ b/home/hosts/ivr/default.nix @@ -1,65 +1,66 @@ -{ pkgs, lib, inputs, ...}: +{ pkgs, lib, inputs, ... }: let - nix23 = import inputs.nix23_05 { - inherit (pkgs.stdenv) system; - overlays = [ inputs.self.overlays.default ]; - }; - py = nix23.python311.withPackages ( p: with p; [ - django - djangorestframework - django-rapyd-modernauth - environs - mysqlclient - pyyaml - ruamel-yaml - tox - ]); - x = pkgs.xonsh.override { - extraPackages = (ps: [ - pkgs.nur.repos.xonsh-xontribs.xonsh-direnv - pkgs.nur.repos.xonsh-xontribs.xontrib-vox - ps.xonsh-apipenv - pkgs.pipenv-ivr - ]); - }; -in { - greg = { - development = true; - gui = true; - pypackage = py; - vscodium = true; - }; + nix23 = import inputs.nix23_05 { + inherit (pkgs.stdenv) system; + overlays = [ inputs.self.overlays.default ]; + }; + py = nix23.python311.withPackages (p: with p; [ + django + djangorestframework + django-rapyd-modernauth + environs + mysqlclient + pyyaml + ruamel-yaml + tox + ]); + x = pkgs.xonsh.override { + extraPackages = (ps: [ + pkgs.nur.repos.xonsh-xontribs.xonsh-direnv + pkgs.nur.repos.xonsh-xontribs.xontrib-vox + ps.xonsh-apipenv + pkgs.pipenv-ivr + ]); + }; +in +{ + greg = { + development = true; + gui = true; + pypackage = py; + vscodium = true; + }; - nixpkgs.config = { - allowUnfree = true; - permittedInsecurePackages = [ - "jitsi-meet-1.0.8043" - ]; - }; + nixpkgs.config = { + allowUnfree = true; + permittedInsecurePackages = [ + "jitsi-meet-1.0.8043" + ]; + }; - home = { - packages = with pkgs; [ - aacs - ansible - bitwarden-cli - direnv - home-manager - mysql-workbench - pipenv-ivr - poetry - robo3t - x - ]; - file.".pip/pip.conf".text = (lib.strings.concatStringsSep "\n" [ - "[global]" - "retries = 1" - "index-url = https://pypi.python.org/simple" - "extra-index-url =" - " https://pypi.ivrtechnology.com/simple/" - " https://pypidev.ivrtechnology.com/simple/" - ]); - username = "gregory.hellings"; - homeDirectory = lib.mkForce "/home/gregory.hellings"; - }; - programs.tmux.shell = (lib.getExe x); + home = { + packages = with pkgs; [ + aacs + ansible + bitwarden-cli + direnv + home-manager + mysql-workbench + pipenv-ivr + poetry + robo3t + x + ]; + file.".pip/pip.conf".text = (lib.strings.concatStringsSep "\n" [ + "[global]" + "retries = 1" + "index-url = https://pypi.python.org/simple" + "extra-index-url =" + " https://pypi.ivrtechnology.com/simple/" + " https://pypidev.ivrtechnology.com/simple/" + ]); + username = "gregory.hellings"; + homeDirectory = lib.mkForce "/home/gregory.hellings"; + }; + programs.tmux.shell = (lib.getExe x); } diff --git a/home/hosts/jude/default.nix b/home/hosts/jude/default.nix index 21dd59f..98cdb6f 100644 --- a/home/hosts/jude/default.nix +++ b/home/hosts/jude/default.nix @@ -1,17 +1,17 @@ { pkgs, ... }: { - home.packages = with pkgs; [ - (mumble.override { pulseSupport = true; }) - #logseq - ]; - greg = { - development = true; - gui = true; - sway = false; - gnome = true; - vscodium = true; - }; + home.packages = with pkgs; [ + (mumble.override { pulseSupport = true; }) + #logseq + ]; + greg = { + development = true; + gui = true; + sway = false; + gnome = true; + vscodium = true; + }; - programs.xonsh.sessionVariables.EFI_DIR = "${pkgs.OVMF.fd}/FV/"; + programs.xonsh.sessionVariables.EFI_DIR = "${pkgs.OVMF.fd}/FV/"; } diff --git a/home/hosts/work/default.nix b/home/hosts/work/default.nix index f14792d..aec6038 100644 --- a/home/hosts/work/default.nix +++ b/home/hosts/work/default.nix @@ -1,9 +1,9 @@ { pkgs, ... }: { - greg.vscodium.enable = true; + greg.vscodium.enable = true; - home.packages = with pkgs; [ - brew - ]; + home.packages = with pkgs; [ + brew + ]; } diff --git a/home/modules/baseline/ansible.nix b/home/modules/baseline/ansible.nix index f4df8b6..ecc068c 100644 --- a/home/modules/baseline/ansible.nix +++ b/home/modules/baseline/ansible.nix @@ -1,28 +1,28 @@ { ... }: { - home.file.".ansible.cfg".text = '' -[defaults] -forks=10 -host_key_checking=False -# Also available: profile_roles -callback_enabled=timer,profile_tasks -stdout_callback=yaml -nocows=1 -cow_selection=tux -collections_path=~/src + home.file.".ansible.cfg".text = '' + [defaults] + forks=10 + host_key_checking=False + # Also available: profile_roles + callback_enabled=timer,profile_tasks + stdout_callback=yaml + nocows=1 + cow_selection=tux + collections_path=~/src -[ssh_connection] -pipelining=True -ssh_args = -o ControlMaster=auto -o ControlPersist=600s -o IdentitiesOnly=yes -o GSSAPIAuthentication=no -o StrictHostKeyChecking=no -control_path=%(directory)s/%%h-%%r -control_path_dir=/tmp + [ssh_connection] + pipelining=True + ssh_args = -o ControlMaster=auto -o ControlPersist=600s -o IdentitiesOnly=yes -o GSSAPIAuthentication=no -o StrictHostKeyChecking=no + control_path=%(directory)s/%%h-%%r + control_path_dir=/tmp -[callback_profile_tasks] -sort_order=descending + [callback_profile_tasks] + sort_order=descending -[galaxy] -role_skeleton_ignore = ^.git$,^.*/.git_keep$,\..*.swp -role_skeleton = ~/src/ansible_collections/meta_ansible_templates/role -''; + [galaxy] + role_skeleton_ignore = ^.git$,^.*/.git_keep$,\..*.swp + role_skeleton = ~/src/ansible_collections/meta_ansible_templates/role + ''; } diff --git a/home/modules/baseline/bash.nix b/home/modules/baseline/bash.nix index dc5087a..a8b6747 100644 --- a/home/modules/baseline/bash.nix +++ b/home/modules/baseline/bash.nix @@ -1,93 +1,93 @@ { pkgs, ... }: { - programs.bash = { - enable = true; - shellAliases = { - acp = "rsync --progress -ah"; - agbuild = "ansible-galaxy collection build"; - apub = "ansible-galaxy collection publish --api-key \${GALAXY_API_KEY}"; - calc = "bc"; - d = "deactivate"; - devroles = "cd ~/src/ansible_collections/devroles"; - gohome = "ssh greg@dns.greg-hellings.gmail.com.beta.tailscale.net -D localhost:10080"; - ll = "ls -l"; - molcol = "molecule -c ../../tests/molecule.yml"; - packaging = "cd ~/src/packaging"; - vdown = "vagrant destroy"; - vhalt = "vagrant halt"; - vos = "vagrant up --provision --provider openstack"; - vprov = "vagrant provision"; - vssh = "vagrant ssh"; - vup = "vagrant up --provision --provider libvirt"; - yaml2js = "python -c 'import sys, yaml, json; json.dump(yaml.load(sys.stdin), sys.stdout, indent=4)"; - }; - sessionVariables = { - ANSIBLE_COLLECTIONS_PATH="\${HOME}/src/"; - CLICOLOR = "1"; - EDITOR = "${pkgs.vim}/bin/vim"; - GIT_SSL_NO_VERIFY = "True"; - LSCOLORS = "ExGxBxDxCxEgEdxbxgxcxd"; - MAVEN_OPTS = " -Dmaven.wagon.http.ssl.insecure=true "; - OS_CLOUD = "default"; - SWORD_PATH = "\${HOME}/.sword"; - TIMEFORMAT = "%3Uu %3Ss %3lR %P%%"; - }; - profileExtra = '' -if [ -e /etc/profile ]; then - . /etc/profile -fi -''; - bashrcExtra = '' -function swordtag { - if [ x"$1" == "x" ]; then - echo "Please provide tag version" - return - fi - svn cp http://crosswire.org/svn/sword/branches/sword-1-8-x/ http://crosswire.org/svn/sword/tags/sword-$1/ -} + programs.bash = { + enable = true; + shellAliases = { + acp = "rsync --progress -ah"; + agbuild = "ansible-galaxy collection build"; + apub = "ansible-galaxy collection publish --api-key \${GALAXY_API_KEY}"; + calc = "bc"; + d = "deactivate"; + devroles = "cd ~/src/ansible_collections/devroles"; + gohome = "ssh greg@dns.greg-hellings.gmail.com.beta.tailscale.net -D localhost:10080"; + ll = "ls -l"; + molcol = "molecule -c ../../tests/molecule.yml"; + packaging = "cd ~/src/packaging"; + vdown = "vagrant destroy"; + vhalt = "vagrant halt"; + vos = "vagrant up --provision --provider openstack"; + vprov = "vagrant provision"; + vssh = "vagrant ssh"; + vup = "vagrant up --provision --provider libvirt"; + yaml2js = "python -c 'import sys, yaml, json; json.dump(yaml.load(sys.stdin), sys.stdout, indent=4)"; + }; + sessionVariables = { + ANSIBLE_COLLECTIONS_PATH = "\${HOME}/src/"; + CLICOLOR = "1"; + EDITOR = "${pkgs.vim}/bin/vim"; + GIT_SSL_NO_VERIFY = "True"; + LSCOLORS = "ExGxBxDxCxEgEdxbxgxcxd"; + MAVEN_OPTS = " -Dmaven.wagon.http.ssl.insecure=true "; + OS_CLOUD = "default"; + SWORD_PATH = "\${HOME}/.sword"; + TIMEFORMAT = "%3Uu %3Ss %3lR %P%%"; + }; + profileExtra = '' + if [ -e /etc/profile ]; then + . /etc/profile + fi + ''; + bashrcExtra = '' + function swordtag { + if [ x"$1" == "x" ]; then + echo "Please provide tag version" + return + fi + svn cp http://crosswire.org/svn/sword/branches/sword-1-8-x/ http://crosswire.org/svn/sword/tags/sword-$1/ + } -function newdock { - if [ x"$1" == "x" -o x"$2" == "x" ]; then - echo "expected arguments [name] [source]" - return - fi - podman run -P --privileged=true -e DISPLAY=$DISPLAY -v /tmp/.X11-unix:/tmp/.X11-unix -v "$(pwd):/dmnt" -t -i --name="$1" "$2" /bin/bash -} + function newdock { + if [ x"$1" == "x" -o x"$2" == "x" ]; then + echo "expected arguments [name] [source]" + return + fi + podman run -P --privileged=true -e DISPLAY=$DISPLAY -v /tmp/.X11-unix:/tmp/.X11-unix -v "$(pwd):/dmnt" -t -i --name="$1" "$2" /bin/bash + } -function rundock { - podman start -a -i "$1" -} + function rundock { + podman start -a -i "$1" + } -function ac { - source ~/venv/''${1}/bin/activate -} + function ac { + source ~/venv/''${1}/bin/activate + } -function py2env { - /usr/bin/virtualenv -p /usr/bin/python2 "''${HOME}/venv/''${1}" - "''${HOME}/venv/''${1}/bin/pip" install -U pip -} + function py2env { + /usr/bin/virtualenv -p /usr/bin/python2 "''${HOME}/venv/''${1}" + "''${HOME}/venv/''${1}/bin/pip" install -U pip + } -function py3env { - VENV_NAME="''${1}" - #PYVERSION="$(python3 -c "import sys;print(sys.version[:sys.version.find('.',2)])")" - #SITE_PACKAGES_PATH="/usr/lib64/python''${PYVERSION}/site-packages/" - #VENV_SITE_PACKAGES="''${HOME}/venv/''${VENV_NAME}/lib64/python''${PYVERSION}/site-packages/" - # Create the virtualenv and update pip to latest - /usr/bin/python3 -m venv --clear "''${HOME}/venv/''${VENV_NAME}" --system-site-packages - "''${HOME}/venv/''${1}/bin/python3" -m pip install -U pip - # Link SELinux into the environment if necessary - #if [ -d "''${SITE_PACKAGES_PATH}" ]; then - # ln -s "''${SITE_PACKAGES_PATH}/selinux" "''${VENV_SITE_PACKAGES}" - # ln -s ''${SITE_PACKAGES_PATH}/_selinux*.so "''${VENV_SITE_PACKAGES}" - #else - # echo "ERROR: LibSELinux not found for Python ''${PYVERSION}. Install system package to enable." - #fi -} + function py3env { + VENV_NAME="''${1}" + #PYVERSION="$(python3 -c "import sys;print(sys.version[:sys.version.find('.',2)])")" + #SITE_PACKAGES_PATH="/usr/lib64/python''${PYVERSION}/site-packages/" + #VENV_SITE_PACKAGES="''${HOME}/venv/''${VENV_NAME}/lib64/python''${PYVERSION}/site-packages/" + # Create the virtualenv and update pip to latest + /usr/bin/python3 -m venv --clear "''${HOME}/venv/''${VENV_NAME}" --system-site-packages + "''${HOME}/venv/''${1}/bin/python3" -m pip install -U pip + # Link SELinux into the environment if necessary + #if [ -d "''${SITE_PACKAGES_PATH}" ]; then + # ln -s "''${SITE_PACKAGES_PATH}/selinux" "''${VENV_SITE_PACKAGES}" + # ln -s ''${SITE_PACKAGES_PATH}/_selinux*.so "''${VENV_SITE_PACKAGES}" + #else + # echo "ERROR: LibSELinux not found for Python ''${PYVERSION}. Install system package to enable." + #fi + } -function unknown_host { - sed -i -e ''${1}d ~/.ssh/known_hosts -} -''; - }; + function unknown_host { + sed -i -e ''${1}d ~/.ssh/known_hosts + } + ''; + }; } diff --git a/home/modules/baseline/default.nix b/home/modules/baseline/default.nix index 8eb30b6..749fd47 100644 --- a/home/modules/baseline/default.nix +++ b/home/modules/baseline/default.nix @@ -1,13 +1,13 @@ { ... }: { - imports = [ - ./ansible.nix - ./bash.nix - ./direnv.nix - ./git.nix - ./ssh.nix - ./vim.nix - ./xonsh.nix - ]; + imports = [ + ./ansible.nix + ./bash.nix + ./direnv.nix + ./git.nix + ./ssh.nix + ./vim.nix + ./xonsh.nix + ]; } diff --git a/home/modules/baseline/direnv.nix b/home/modules/baseline/direnv.nix index c4bf504..cb77a73 100644 --- a/home/modules/baseline/direnv.nix +++ b/home/modules/baseline/direnv.nix @@ -1,8 +1,8 @@ { pkgs, ... }: { - programs.direnv = { - enable = true; - nix-direnv.enable = true; - }; + programs.direnv = { + enable = true; + nix-direnv.enable = true; + }; } diff --git a/home/modules/baseline/git.nix b/home/modules/baseline/git.nix index 4fcf317..4ba8685 100644 --- a/home/modules/baseline/git.nix +++ b/home/modules/baseline/git.nix @@ -1,31 +1,33 @@ { ... }: { - programs.git = { - enable = true; - userName = "Greg Hellings"; - userEmail = "greg.hellings@gmail.com"; - aliases = { - st = "status"; - ci = "commit"; - co = "checkout"; - ups = "push -u origin HEAD"; - amend = "commit --amend"; - }; - ignores = [ - ".*.swp" ".*.swo" ".*.swn" # vim - ".idea" # IntelliJ - ".DS_Store" # Macs - "Thumbs.db" # Windows - ".tox" # Tox temp directory - ".eclipse" # These next two are created by VSCodium plugins - ".bazelproject" - ]; - extraConfig = { - init.defaultBranch = "main"; - push.default = "upstream"; - pull.rebase = "false"; - tag.sort = "version:refname"; - }; - }; + programs.git = { + enable = true; + userName = "Greg Hellings"; + userEmail = "greg.hellings@gmail.com"; + aliases = { + st = "status"; + ci = "commit"; + co = "checkout"; + ups = "push -u origin HEAD"; + amend = "commit --amend"; + }; + ignores = [ + ".*.swp" + ".*.swo" + ".*.swn" # vim + ".idea" # IntelliJ + ".DS_Store" # Macs + "Thumbs.db" # Windows + ".tox" # Tox temp directory + ".eclipse" # These next two are created by VSCodium plugins + ".bazelproject" + ]; + extraConfig = { + init.defaultBranch = "main"; + push.default = "upstream"; + pull.rebase = "false"; + tag.sort = "version:refname"; + }; + }; } diff --git a/home/modules/baseline/ssh.nix b/home/modules/baseline/ssh.nix index 3baa14e..04e4bf3 100644 --- a/home/modules/baseline/ssh.nix +++ b/home/modules/baseline/ssh.nix @@ -1,64 +1,65 @@ { lib, ... }: { - # Workaround to set the config value to user read-only - # This allows things like SSH in distrobox to read the config file just fine - home.file.".ssh/config" = { - target = ".ssh/config_source"; - onChange = ''cat ~/.ssh/config_source > ~/.ssh/config && chmod 600 ~/.ssh/config''; - }; - programs.ssh = { - enable = true; - serverAliveInterval = 60; + # Workaround to set the config value to user read-only + # This allows things like SSH in distrobox to read the config file just fine + home.file.".ssh/config" = { + target = ".ssh/config_source"; + onChange = ''cat ~/.ssh/config_source > ~/.ssh/config && chmod 600 ~/.ssh/config''; + }; + programs.ssh = { + enable = true; + serverAliveInterval = 60; - includes = ["config.local"]; + includes = [ "config.local" ]; - matchBlocks = - let - nas = { user = "admin"; }; - owned = { user = "greg"; }; - in { - inherit nas; + matchBlocks = + let + nas = { user = "admin"; }; + owned = { user = "greg"; }; + in + { + inherit nas; - "*" = { - dynamicForwards = [ { - port = 10240; - } ]; - }; + "*" = { + dynamicForwards = [{ + port = 10240; + }]; + }; - "10.42.1.4" = lib.hm.dag.entryBefore ["10.42.*"] nas; - "nas.thehellings.lan" = nas; - "nas.greg-hellings.gmail.com.beta.tailscale.net" = nas; - chronicles = nas; - "chronicles.thehellings.lan" = lib.hm.dag.entryBefore [ "*.thehellings.lan"] nas; + "10.42.1.4" = lib.hm.dag.entryBefore [ "10.42.*" ] nas; + "nas.thehellings.lan" = nas; + "nas.greg-hellings.gmail.com.beta.tailscale.net" = nas; + chronicles = nas; + "chronicles.thehellings.lan" = lib.hm.dag.entryBefore [ "*.thehellings.lan" ] nas; - gh = { user = "git"; hostname = "github.com"; }; - "src" = { - user = "gitlab"; - hostname = "git.thehellings.lan"; - }; + gh = { user = "git"; hostname = "github.com"; }; + "src" = { + user = "gitlab"; + hostname = "git.thehellings.lan"; + }; - "*.thehellings.lan" = owned; - "10.42.*" = owned; + "*.thehellings.lan" = owned; + "10.42.*" = owned; - "host.crosswire.org crosswire" = { - hostname = "host.crosswire.org"; - user = "ghellings"; - }; + "host.crosswire.org crosswire" = { + hostname = "host.crosswire.org"; + user = "ghellings"; + }; - fedpeople = { - hostname = "fedorapeople.org"; - user = "greghellings"; - }; + fedpeople = { + hostname = "fedorapeople.org"; + user = "greghellings"; + }; - "src.fedoraproject.org pkgs.fedoraproject.org" = { - user = "greghellings"; - }; + "src.fedoraproject.org pkgs.fedoraproject.org" = { + user = "greghellings"; + }; - "127.*".extraOptions = { - PubkeyAcceptedAlgorithms = "+ssh-rsa"; - HostkeyAlgorithms = "+ssh-rsa"; - }; - }; - }; + "127.*".extraOptions = { + PubkeyAcceptedAlgorithms = "+ssh-rsa"; + HostkeyAlgorithms = "+ssh-rsa"; + }; + }; + }; } diff --git a/home/modules/baseline/vim.nix b/home/modules/baseline/vim.nix index 45d84f9..d0b969f 100644 --- a/home/modules/baseline/vim.nix +++ b/home/modules/baseline/vim.nix @@ -1,142 +1,145 @@ { lib, pkgs, config, ... }: let - vim-xonsh = pkgs.vimUtils.buildVimPlugin { - name = "vim-xonsh"; - src = pkgs.fetchFromGitHub { - owner = "meatballs"; - repo = "vim-xonsh"; - rev = "929f35e"; - hash = "sha256-ugHLu2Z9bTtQsIp4FQPKxgjVe9oZNjfQYrP+aHu+/uU="; - }; - }; + vim-xonsh = pkgs.vimUtils.buildVimPlugin { + name = "vim-xonsh"; + src = pkgs.fetchFromGitHub { + owner = "meatballs"; + repo = "vim-xonsh"; + rev = "929f35e"; + hash = "sha256-ugHLu2Z9bTtQsIp4FQPKxgjVe9oZNjfQYrP+aHu+/uU="; + }; + }; in { - fonts.fontconfig.enable = true; - home.packages = [ (pkgs.nerdfonts.override { fonts = [ "Hack" ]; }) ]; - programs.nixvim = { - enable = true; - colorschemes.gruvbox.enable = true; - globals = { - indent_guides_enable_on_vim_startup = 1; - nix_recommended_style = 0; - }; - opts = { - background = "dark"; - backup = false; - copyindent = true; - cursorline = true; - expandtab = false; - hidden = true; - hlsearch = true; - ignorecase = true; - lazyredraw = true; - list = true; - listchars = "tab:→ ,extends:→,precedes:←,trail:·,eol:¬"; - mouse = "a"; - number = true; - preserveindent = true; - relativenumber = true; - shiftwidth = 4; - showcmd = true; - showmatch = true; - signcolumn = "yes"; - smartcase = true; - softtabstop = 4; - tabstop = 4; - # Setting for CtrlP - wildignore = "*.swp,*.pyc,*.class,.tox"; - wrap = false; - writebackup = false; - }; - keymaps = let - winMove = key: { mode = "n"; key = ""; action = "${key}"; }; - in [ { - mode = "n"; - key = ""; - action = ":BufExplorer"; - } { - mode = "n"; - key = ""; - #action = ":NERDTreeToggle"; - action = ":Neotree toggle"; - } { - mode = "n"; - key = ""; - action = ":Neotree float git_status toggle"; - } - (winMove "h") - (winMove "j") - (winMove "k") - (winMove "l") - ]; - plugins = { - airline.enable = true; - cmp = { - enable = true; - autoEnableSources = true; - settings.sources = [ - { name = "nvim_lsp"; } - { name = "buffer"; group_index = 2; } - { name = "path"; gruop_index = 3; } - ]; - }; - direnv.enable = true; - gitgutter.enable = true; - fugitive.enable = true; - fzf-lua = { - enable = true; - keymaps = { - "" = { - action = "files"; - settings = { - previewers.cat.cmd = "${pkgs.coreutils}/bin/cat"; - winopts.height = 0.5; - }; - }; - "" = { - action = "git_files"; - settings = { - previewers.cat.cmd = "${pkgs.coreutils}/bin/cat"; - winopts.height = 0.5; - }; - }; - }; - profile = "fzf-vim"; - }; - lsp = { - enable = true; - servers = { - ansiblels.enable = true; - cmake.enable = true; - gopls.enable = true; - html.enable = true; - nixd.enable = true; - pylsp.enable = true; - pyright.enable = true; - rust-analyzer = { - # No need to have these installed on every one of my systems - installCargo = false; - installRustc = false; - enable = true; - }; - terraformls.enable = true; - }; - }; - neo-tree.enable = true; - notify.enable = true; - web-devicons.enable = true; - } // (lib.mkIf (lib.versionAtLeast config.system.nixos.release "24.11") {}); - extraConfigLua = builtins.replaceStrings [ "@git@" ] [ "${pkgs.git}/bin/git" ] (builtins.readFile ./vim/extra.lua); - extraConfigVim = builtins.readFile ./vim/extra.vimrc; - extraPlugins = with pkgs.vimPlugins; [ - bufexplorer + fonts.fontconfig.enable = true; + home.packages = [ (pkgs.nerdfonts.override { fonts = [ "Hack" ]; }) ]; + programs.nixvim = { + enable = true; + colorschemes.gruvbox.enable = true; + globals = { + indent_guides_enable_on_vim_startup = 1; + nix_recommended_style = 0; + }; + opts = { + background = "dark"; + backup = false; + copyindent = true; + cursorline = true; + expandtab = false; + hidden = true; + hlsearch = true; + ignorecase = true; + lazyredraw = true; + list = true; + listchars = "tab:→ ,extends:→,precedes:←,trail:·,eol:¬"; + mouse = "a"; + number = true; + preserveindent = true; + relativenumber = true; + shiftwidth = 4; + showcmd = true; + showmatch = true; + signcolumn = "yes"; + smartcase = true; + softtabstop = 4; + tabstop = 4; + # Setting for CtrlP + wildignore = "*.swp,*.pyc,*.class,.tox"; + wrap = false; + writebackup = false; + }; + keymaps = + let + winMove = key: { mode = "n"; key = ""; action = "${key}"; }; + in + [{ + mode = "n"; + key = ""; + action = ":BufExplorer"; + } + { + mode = "n"; + key = ""; + #action = ":NERDTreeToggle"; + action = ":Neotree toggle"; + } + { + mode = "n"; + key = ""; + action = ":Neotree float git_status toggle"; + } + (winMove "h") + (winMove "j") + (winMove "k") + (winMove "l")]; + plugins = { + airline.enable = true; + cmp = { + enable = true; + autoEnableSources = true; + settings.sources = [ + { name = "nvim_lsp"; } + { name = "buffer"; group_index = 2; } + { name = "path"; gruop_index = 3; } + ]; + }; + direnv.enable = true; + gitgutter.enable = true; + fugitive.enable = true; + fzf-lua = { + enable = true; + keymaps = { + "" = { + action = "files"; + settings = { + previewers.cat.cmd = "${pkgs.coreutils}/bin/cat"; + winopts.height = 0.5; + }; + }; + "" = { + action = "git_files"; + settings = { + previewers.cat.cmd = "${pkgs.coreutils}/bin/cat"; + winopts.height = 0.5; + }; + }; + }; + profile = "fzf-vim"; + }; + lsp = { + enable = true; + servers = { + ansiblels.enable = true; + cmake.enable = true; + gopls.enable = true; + html.enable = true; + nixd.enable = true; + pylsp.enable = true; + pyright.enable = true; + rust-analyzer = { + # No need to have these installed on every one of my systems + installCargo = false; + installRustc = false; + enable = true; + }; + terraformls.enable = true; + }; + }; + neo-tree.enable = true; + notify.enable = true; + web-devicons.enable = true; + } // (lib.mkIf (lib.versionAtLeast config.system.nixos.release "24.11") { }); + extraConfigLua = builtins.replaceStrings [ "@git@" ] [ "${pkgs.git}/bin/git" ] (builtins.readFile ./vim/extra.lua); + extraConfigVim = builtins.readFile ./vim/extra.vimrc; + extraPlugins = with pkgs.vimPlugins; [ + bufexplorer - context-vim - vim-indent-guides - vim-xonsh - ]; - viAlias = true; - vimAlias = true; - }; + context-vim + vim-indent-guides + vim-xonsh + ]; + viAlias = true; + vimAlias = true; + }; } diff --git a/home/modules/baseline/xonsh.nix b/home/modules/baseline/xonsh.nix index b2e0558..5c3b0e2 100644 --- a/home/modules/baseline/xonsh.nix +++ b/home/modules/baseline/xonsh.nix @@ -1,75 +1,75 @@ { pkgs, config, lib, ... }: { - programs.xonsh = { - enable = true; + programs.xonsh = { + enable = true; - sessionVariables = { - CLICOLOR = 1; - EDITOR = "nvim"; - # vte_new_tab_cwd causes new Terminal tabs to open in the - # same CWD as the current tab - LESS_TERMCAP_mb = "\\033[01;31m"; # begin blinking - LESS_TERMCAP_md = "\\033[01;31m"; # begin bold - LESS_TERMCAP_me = "\\033[0m"; # end mode - LESS_TERMCAP_so = "\\033[01;44;36m"; # begin standout-mode (bottom of screen) - LESS_TERMCAP_se = "\\033[0m"; # end standout-mode - LESS_TERMCAP_us = "\\033[00;36m"; # begin underline - LESS_TERMCAP_ue = "\\033[0m"; # end underline - LIBMYSQL_ENABLE_CLEARTEXT_PLUGIN = "1"; - LSCOLORS = "ExGxBxDxCxEgEdxbxgxcxd"; - MAVEN_OPTS = " -Dmaven.wagon.http.ssl.insecure=true"; - OS_CLOUD = "default"; - PROMPT = "{vte_new_tab_cwd}{env_name}{BOLD_GREEN}{user}@{hostname}{BOLD_BLUE} {short_cwd}{branch_color}{curr_branch: {}}{RESET} {BOLD_BLUE}{prompt_end}{RESET} "; - SWORD_PATH = "${config.home.homeDirectory}/.sword/"; - TIMEFORMAT = "%3Uu %3Ss %3lR %P%%"; - # Tells vox where to find virtualenvs - VIRTUALENV_HOME = "${config.home.homeDirectory}/venv/"; - XONSH_COLOR_STYLE = "default"; + sessionVariables = { + CLICOLOR = 1; + EDITOR = "nvim"; + # vte_new_tab_cwd causes new Terminal tabs to open in the + # same CWD as the current tab + LESS_TERMCAP_mb = "\\033[01;31m"; # begin blinking + LESS_TERMCAP_md = "\\033[01;31m"; # begin bold + LESS_TERMCAP_me = "\\033[0m"; # end mode + LESS_TERMCAP_so = "\\033[01;44;36m"; # begin standout-mode (bottom of screen) + LESS_TERMCAP_se = "\\033[0m"; # end standout-mode + LESS_TERMCAP_us = "\\033[00;36m"; # begin underline + LESS_TERMCAP_ue = "\\033[0m"; # end underline + LIBMYSQL_ENABLE_CLEARTEXT_PLUGIN = "1"; + LSCOLORS = "ExGxBxDxCxEgEdxbxgxcxd"; + MAVEN_OPTS = " -Dmaven.wagon.http.ssl.insecure=true"; + OS_CLOUD = "default"; + PROMPT = "{vte_new_tab_cwd}{env_name}{BOLD_GREEN}{user}@{hostname}{BOLD_BLUE} {short_cwd}{branch_color}{curr_branch: {}}{RESET} {BOLD_BLUE}{prompt_end}{RESET} "; + SWORD_PATH = "${config.home.homeDirectory}/.sword/"; + TIMEFORMAT = "%3Uu %3Ss %3lR %P%%"; + # Tells vox where to find virtualenvs + VIRTUALENV_HOME = "${config.home.homeDirectory}/venv/"; + XONSH_COLOR_STYLE = "default"; - GOPATH = "${config.home.homeDirectory}/src/go"; - GOBIN = "${config.home.homeDirectory}/src/bin"; - }; + GOPATH = "${config.home.homeDirectory}/src/go"; + GOBIN = "${config.home.homeDirectory}/src/bin"; + }; - aliases = { - # Python related ones - ac = "vox activate"; - d = "vox deactivate"; + aliases = { + # Python related ones + ac = "vox activate"; + d = "vox deactivate"; - # Nix related ones - gl-nging = "sudo nixos-container run gitlab -- systemctl restart nginx"; - nb = "nix build -L"; - nixdu = "sudo nix-store --gc --print-roots | egrep -v r\"^(/nix/var|/run/\\w+-system|\\{memory|/proc)\""; - nixtest = "nixpkgs-review rev HEAD"; - nixup = "nix flake update"; - stable = "nix flake update nixpkgs hm nixvimstable"; - unstable = "nix flake update nixunstable hmunstable nixvimunstable nurpkgs vsext wsl"; + # Nix related ones + gl-nging = "sudo nixos-container run gitlab -- systemctl restart nginx"; + nb = "nix build -L"; + nixdu = "sudo nix-store --gc --print-roots | egrep -v r\"^(/nix/var|/run/\\w+-system|\\{memory|/proc)\""; + nixtest = "nixpkgs-review rev HEAD"; + nixup = "nix flake update"; + stable = "nix flake update nixpkgs hm nixvimstable"; + unstable = "nix flake update nixunstable hmunstable nixvimunstable nurpkgs vsext wsl"; - # General - gh-personal = "$GH_CONFIG_DIR=\"${config.home.homeDirectory}/.config/gh/personal\" gh"; - ls = "ls --color"; - ll = "ls -l --color"; - tf = "terraform"; + # General + gh-personal = "$GH_CONFIG_DIR=\"${config.home.homeDirectory}/.config/gh/personal\" gh"; + ls = "ls --color"; + ll = "ls -l --color"; + tf = "terraform"; - # Tailscale related ones - tsup = "sudo tailscale up"; - tspub = "sudo tailscale up --exit-node=linode"; - tshome = "sudo tailscale up --exit-node=2maccabees"; - tsclear = "sudo tailscale up --exit-node=''"; + # Tailscale related ones + tsup = "sudo tailscale up"; + tspub = "sudo tailscale up --exit-node=linode"; + tshome = "sudo tailscale up --exit-node=2maccabees"; + tsclear = "sudo tailscale up --exit-node=''"; - # Vagrant related - vdown = "vagrant destroy"; - vhalt = "vagrant halt"; - vos = "vagrant up --provision --provider openstack"; - vprov = "vagrant provision"; - vup = "vagrant up --provision --provider libvirt"; - vssh = "vagrant ssh"; - }; + # Vagrant related + vdown = "vagrant destroy"; + vhalt = "vagrant halt"; + vos = "vagrant up --provision --provider openstack"; + vprov = "vagrant provision"; + vup = "vagrant up --provision --provider libvirt"; + vssh = "vagrant ssh"; + }; - configHeader = builtins.readFile ./xonsh_header.xsh; - configFooter = (builtins.readFile ./xonsh_footer.xsh) + (builtins.concatStringsSep "\n" [ - "with open('${pkgs.stdenv.cc}/nix-support/dynamic-linker', 'r') as fp:" - " $NIX_LD = fp.read().strip()" - ]); - }; + configHeader = builtins.readFile ./xonsh_header.xsh; + configFooter = (builtins.readFile ./xonsh_footer.xsh) + (builtins.concatStringsSep "\n" [ + "with open('${pkgs.stdenv.cc}/nix-support/dynamic-linker', 'r') as fp:" + " $NIX_LD = fp.read().strip()" + ]); + }; } diff --git a/home/modules/default.nix b/home/modules/default.nix index 534373b..e170b71 100644 --- a/home/modules/default.nix +++ b/home/modules/default.nix @@ -1,14 +1,14 @@ { ... }: { - imports = [ - ./baseline - ./development.nix - ./gnome.nix - ./gui.nix - ./python.nix - ./sway.nix - ./vscodium.nix - ./xonsh.nix - ]; + imports = [ + ./baseline + ./development.nix + ./gnome.nix + ./gui.nix + ./python.nix + ./sway.nix + ./vscodium.nix + ./xonsh.nix + ]; } diff --git a/home/modules/development.nix b/home/modules/development.nix index 90f5f2b..fb86eda 100644 --- a/home/modules/development.nix +++ b/home/modules/development.nix @@ -1,24 +1,25 @@ { config, pkgs, lib, ... }: let - packages = with pkgs; [ - bruno # but let's not talk about it - cargo - gh-copilot - mariadb - nix-eval-jobs - nix-fast-build - nix-output-monitor - nix-update - nixfmt-rfc-style - nixpkgs-review - nodejs - process-compose - zed-editor - ]; -in with lib; { - options.greg.development = mkEnableOption "Setup necessary development packages"; + packages = with pkgs; [ + bruno # but let's not talk about it + cargo + gh-copilot + mariadb + nix-eval-jobs + nix-fast-build + nix-output-monitor + nix-update + nixfmt-rfc-style + nixpkgs-review + nodejs + process-compose + zed-editor + ]; +in +with lib; { + options.greg.development = mkEnableOption "Setup necessary development packages"; - config = mkIf config.greg.development { - home.packages = packages; - }; + config = mkIf config.greg.development { + home.packages = packages; + }; } diff --git a/home/modules/gnome.nix b/home/modules/gnome.nix index dc815a6..c1683d7 100644 --- a/home/modules/gnome.nix +++ b/home/modules/gnome.nix @@ -1,121 +1,122 @@ { config, pkgs, lib, ... }: let - gv = lib.hm.gvariant; - cfg = config.greg.gnome; + gv = lib.hm.gvariant; + cfg = config.greg.gnome; -in { - options.greg.gnome = lib.mkEnableOption "Enable Gnome support and settings"; +in +{ + options.greg.gnome = lib.mkEnableOption "Enable Gnome support and settings"; - config = (lib.mkIf cfg { - programs.gnome-terminal = lib.mkIf ( pkgs.system != "x86_64-darwin") { - enable = true; - showMenubar = true; - themeVariant = "dark"; - profile."95f3c68e-82f3-4f44-ac85-6e075fed80b0" = { - default = true; - customCommand = "xonsh -st best"; - loginShell = true; - scrollbackLines = 65535; - transparencyPercent = 50; - visibleName = "greg"; - }; - }; + config = (lib.mkIf cfg { + programs.gnome-terminal = lib.mkIf (pkgs.system != "x86_64-darwin") { + enable = true; + showMenubar = true; + themeVariant = "dark"; + profile."95f3c68e-82f3-4f44-ac85-6e075fed80b0" = { + default = true; + customCommand = "xonsh -st best"; + loginShell = true; + scrollbackLines = 65535; + transparencyPercent = 50; + visibleName = "greg"; + }; + }; - dconf.settings = { - "org/gnome/Disks" = { - image-dir-uri = "file:///home/greg/Downloads"; - }; - "org/gnome/desktop/interface" = { - clock-show-weekday = true; - color-scheme = "default"; - cursor-size = 24; - toolbar-style = "text"; - }; - "org/gnome/desktop/screensaver" = { - lock-delay = "uint32 0"; - lock-enabled = false; - }; - "org/gnome/desktop/wm/keybindings" = { - switch-applications = []; - switch-applications-backward = []; - switch-windows = ["Tab"]; - switch-windows-backward = [ "Tab" ]; - }; - "org/gnome/desktop/wm/preferences" = { - button-layout="icon:minimize,maximize,close"; - }; - "org/gnome/file-roller/listing" = { - list-mode = "as-folder"; - name-coloumn-width = 302; - show-path = true; - sort-method = "name"; - sort-type = "ascending"; - }; - "org/gnome/nautilus/preferences" = { - default-folder-viewer = "icon-view"; - search-filter-time-type = "last_modified"; - search-view = "list-view"; - }; - "org/gnome/shell" = { - enabled-extensions = [ - "appindicatorsupport@rgcjonas.gmail.com" - "Vitals@CoreCoding.com" - "window-list@gnome-shell-extensions.gcampax.github.com" - "gsconnect@andyholmes.github.io" - ]; - favorite-apps = [ - "org.gnome.Calendar.desktop" - "org.gnome.Nautilus.desktop" - "org.gnome.Terminal.desktop" - "firefox.desktop" - "vlc.desktop" - ]; - remember-mount-password = true; - }; - "org/gnome/shell/extensions/vitals" = { - hot-sensors = [ - "_memory_usage_" - "_system_load_1m_" - "__network-rx_max__" - "_temperature_k10temp_tccd1_" - "_temperature_k10temp_tctl_" - ]; - }; - "org/gnome/shell/overrides" = { - attach-modal-dialogs = true; - dynamic-workspaces = true; - edge-tiling = true; - focus-change-on-pointer-rest = true; - workspaces-only-on-primary = true; - }; - "org/gnome/shell/weather" = { - automation-location = true; - locations = "[<(uint32 2, <('Midlothian / Waxahachie, Mid-Way Regional Airport', 'KJWY', false, [(0.5664611473274288, -1.691437359323684)], @a(dd) [])>)>]"; - }; - "org/gnome/shell/window-switcher" = { - app-icon-mode = "both"; - current-workspace-only = true; - }; - "org/gtk/settings/file-chooser" = { - location-mode = "path-bar"; - show-hidden = false; - show-size-column = true; - sort-column = "modified"; - sort-directories-first = false; - sort-order = "descending"; - }; - "org/virt-manager/virt-manager/confirm" = { - delete-storage = true; - forcepoweroff = false; - }; - "org/virt-manager/virt-manager/details" = { - show-toolbar = true; - }; - "org/virt-manager/virt-manager/connections" = { - autoconnect = [ "qemu:///session" "qemu:///system" ]; - uris = [ "qemu:///session" "qemu:///system" ]; - }; - }; - }); + dconf.settings = { + "org/gnome/Disks" = { + image-dir-uri = "file:///home/greg/Downloads"; + }; + "org/gnome/desktop/interface" = { + clock-show-weekday = true; + color-scheme = "default"; + cursor-size = 24; + toolbar-style = "text"; + }; + "org/gnome/desktop/screensaver" = { + lock-delay = "uint32 0"; + lock-enabled = false; + }; + "org/gnome/desktop/wm/keybindings" = { + switch-applications = [ ]; + switch-applications-backward = [ ]; + switch-windows = [ "Tab" ]; + switch-windows-backward = [ "Tab" ]; + }; + "org/gnome/desktop/wm/preferences" = { + button-layout = "icon:minimize,maximize,close"; + }; + "org/gnome/file-roller/listing" = { + list-mode = "as-folder"; + name-coloumn-width = 302; + show-path = true; + sort-method = "name"; + sort-type = "ascending"; + }; + "org/gnome/nautilus/preferences" = { + default-folder-viewer = "icon-view"; + search-filter-time-type = "last_modified"; + search-view = "list-view"; + }; + "org/gnome/shell" = { + enabled-extensions = [ + "appindicatorsupport@rgcjonas.gmail.com" + "Vitals@CoreCoding.com" + "window-list@gnome-shell-extensions.gcampax.github.com" + "gsconnect@andyholmes.github.io" + ]; + favorite-apps = [ + "org.gnome.Calendar.desktop" + "org.gnome.Nautilus.desktop" + "org.gnome.Terminal.desktop" + "firefox.desktop" + "vlc.desktop" + ]; + remember-mount-password = true; + }; + "org/gnome/shell/extensions/vitals" = { + hot-sensors = [ + "_memory_usage_" + "_system_load_1m_" + "__network-rx_max__" + "_temperature_k10temp_tccd1_" + "_temperature_k10temp_tctl_" + ]; + }; + "org/gnome/shell/overrides" = { + attach-modal-dialogs = true; + dynamic-workspaces = true; + edge-tiling = true; + focus-change-on-pointer-rest = true; + workspaces-only-on-primary = true; + }; + "org/gnome/shell/weather" = { + automation-location = true; + locations = "[<(uint32 2, <('Midlothian / Waxahachie, Mid-Way Regional Airport', 'KJWY', false, [(0.5664611473274288, -1.691437359323684)], @a(dd) [])>)>]"; + }; + "org/gnome/shell/window-switcher" = { + app-icon-mode = "both"; + current-workspace-only = true; + }; + "org/gtk/settings/file-chooser" = { + location-mode = "path-bar"; + show-hidden = false; + show-size-column = true; + sort-column = "modified"; + sort-directories-first = false; + sort-order = "descending"; + }; + "org/virt-manager/virt-manager/confirm" = { + delete-storage = true; + forcepoweroff = false; + }; + "org/virt-manager/virt-manager/details" = { + show-toolbar = true; + }; + "org/virt-manager/virt-manager/connections" = { + autoconnect = [ "qemu:///session" "qemu:///system" ]; + uris = [ "qemu:///session" "qemu:///system" ]; + }; + }; + }); } diff --git a/home/modules/gui.nix b/home/modules/gui.nix index f28cc7a..1710836 100644 --- a/home/modules/gui.nix +++ b/home/modules/gui.nix @@ -1,120 +1,121 @@ { config, pkgs, lib, ... }: let - cfg = config.greg.gui; + cfg = config.greg.gui; - excludes = systems: opts: ( - if ( builtins.all (x: pkgs.system != x) systems ) then opts else [] - ); + excludes = systems: opts: ( + if (builtins.all (x: pkgs.system != x) systems) then opts else [ ] + ); - # For now, we ignore this and don't install it - ffPkgs = pkgs.firefox.override { cfg.enableGnomeExtensions = true; }; + # For now, we ignore this and don't install it + ffPkgs = pkgs.firefox.override { cfg.enableGnomeExtensions = true; }; - vars = { - XDG_CURRENT_DESKTOP = "GNOME"; - }; -in { - options.greg.gui = lib.mkEnableOption "Enable GUI programs"; + vars = { + XDG_CURRENT_DESKTOP = "GNOME"; + }; +in +{ + options.greg.gui = lib.mkEnableOption "Enable GUI programs"; - config = (lib.mkIf cfg { - # These packages are Linux only - home.packages = with pkgs; ( excludes ["x86_64-darwin" "aarch64-darwin"] - [ - cdrtools - element-desktop - freetube - qpwgraph - vlc - x265 - ]) ++ + config = (lib.mkIf cfg { + # These packages are Linux only + home.packages = with pkgs; (excludes [ "x86_64-darwin" "aarch64-darwin" ] + [ + cdrtools + element-desktop + freetube + qpwgraph + vlc + x265 + ]) ++ - # x86_64-linux only - ( excludes ["x86_64-darwin" "aarch64-darwin" "aarch64-linux"] - [ - bitwarden - discord - endeavour - gnucash - jellyfin-media-player - #logseq - nextcloud-client - slack - ]) ++ + # x86_64-linux only + (excludes [ "x86_64-darwin" "aarch64-darwin" "aarch64-linux" ] + [ + bitwarden + discord + endeavour + gnucash + jellyfin-media-player + #logseq + nextcloud-client + slack + ]) ++ - # Items that are not supported on ARM/Linux - ( excludes ["aarch64-linux"] - [ - onlyoffice-bin - synology-drive-client - zoom-us - ]); + # Items that are not supported on ARM/Linux + (excludes [ "aarch64-linux" ] + [ + onlyoffice-bin + synology-drive-client + zoom-us + ]); - programs.firefox = { - enable = (! pkgs.stdenv.hostPlatform.isDarwin); - package = ffPkgs; - policies = { - DisableAppUpdate = true; - }; - profiles = { - default = { - bookmarks = import ./gui/bookmarks.nix; - id = 0; - isDefault = true; - search = { - default = "DuckDuckGo"; - force = true; - engines = { - Google.metaData.alias = "@g"; - "Nix Packages" = { - urls = [{ - template = "https://search.nixos.org/packages"; - params = [ - { name = "type"; value = "packages"; } - { name = "query"; value = "{searchTerms}"; } - ]; - }]; - icon = "${pkgs.nixos-icons}/share/icons/hicolor/scalable/apps/nix-snowflake.svg"; - definedAliases = [ "@np" ]; - }; - "Nix Options" = { - urls = [{ - template = "https://search.nixos.org/options"; - params = [ - { name = "type"; value = "packages"; } - { name = "query"; value = "{searchTerms}"; } - ]; - }]; - icon = "${pkgs.nixos-icons}/share/icons/hicolor/scalable/apps/nix-snowflake.svg"; - definedAliases = [ "@no" ]; - }; - }; - }; - settings = { - "app.update.auto" = false; - "browser.ctrlTab.sortByRecentlyUsed" = true; - "browser.startup.page" = 3; - "browser.startup.homepage" = "https://thehellings.com"; - "doh-rollout.doorhanger-decision" = "UIDisabled"; - "doh-rollout.doneFirstRun" = true; - "signon.rememberSignons" = false; - }; - extensions = with pkgs.nur.repos.rycee.firefox-addons; [ - bitwarden - gsconnect - foxyproxy-standard - multi-account-containers - octotree - okta-browser-plugin - refined-github - tree-style-tab - ublock-origin - ]; - }; - }; - }; + programs.firefox = { + enable = (! pkgs.stdenv.hostPlatform.isDarwin); + package = ffPkgs; + policies = { + DisableAppUpdate = true; + }; + profiles = { + default = { + bookmarks = import ./gui/bookmarks.nix; + id = 0; + isDefault = true; + search = { + default = "DuckDuckGo"; + force = true; + engines = { + Google.metaData.alias = "@g"; + "Nix Packages" = { + urls = [{ + template = "https://search.nixos.org/packages"; + params = [ + { name = "type"; value = "packages"; } + { name = "query"; value = "{searchTerms}"; } + ]; + }]; + icon = "${pkgs.nixos-icons}/share/icons/hicolor/scalable/apps/nix-snowflake.svg"; + definedAliases = [ "@np" ]; + }; + "Nix Options" = { + urls = [{ + template = "https://search.nixos.org/options"; + params = [ + { name = "type"; value = "packages"; } + { name = "query"; value = "{searchTerms}"; } + ]; + }]; + icon = "${pkgs.nixos-icons}/share/icons/hicolor/scalable/apps/nix-snowflake.svg"; + definedAliases = [ "@no" ]; + }; + }; + }; + settings = { + "app.update.auto" = false; + "browser.ctrlTab.sortByRecentlyUsed" = true; + "browser.startup.page" = 3; + "browser.startup.homepage" = "https://thehellings.com"; + "doh-rollout.doorhanger-decision" = "UIDisabled"; + "doh-rollout.doneFirstRun" = true; + "signon.rememberSignons" = false; + }; + extensions = with pkgs.nur.repos.rycee.firefox-addons; [ + bitwarden + gsconnect + foxyproxy-standard + multi-account-containers + octotree + okta-browser-plugin + refined-github + tree-style-tab + ublock-origin + ]; + }; + }; + }; - # This is supposed to be in support of Firefox, but I dunno... - programs.bash.sessionVariables = vars; - programs.xonsh.sessionVariables = vars; - }); + # This is supposed to be in support of Firefox, but I dunno... + programs.bash.sessionVariables = vars; + programs.xonsh.sessionVariables = vars; + }); } diff --git a/home/modules/gui/bookmarks.nix b/home/modules/gui/bookmarks.nix index 4d5affa..e7cc667 100644 --- a/home/modules/gui/bookmarks.nix +++ b/home/modules/gui/bookmarks.nix @@ -1,137 +1,167 @@ -[ { - name = "Toolbar"; - toolbar = true; - bookmarks = [ { - name = "Ansible"; - bookmarks = [ { - name = "Collection Index"; - url = "https://docs.ansible.com/ansible/latest/collections/index.html"; - } ]; - } { - name = "Church"; - bookmarks = [ { - name = "DC4K"; - url = "https://www.dc4k.org/leaderzone/articles"; - } ]; - } { - name = "IVR"; - bookmarks = [ { - name = "Dev"; - bookmarks = [ { - name = "Core Survey"; - url = "https://webdev5.ivrtechnology.com/coreservices/survey/admin/"; - } { - name = "Audio"; - url = "https://apidev1.ivrtechnology.com/coreservices/audio/admin/"; - } ]; - } { - name = "HC"; - bookmarks = [ { - name = "Audio"; - url = "https://hcweb3.ivrtechnology.com/coreservices/audio/admin/"; - } { - name = "Survey"; - url = "https://hcweb2.ivrtechnology.com/coreservices/survey/admin/"; - } ]; - } { - name = "PCI"; - bookmarks = [ { - name = "Audio"; - url = "https://pciweb3.ivrtechnology.com/coreservices/audio/admin/"; - } ]; - } { - name = "Processes"; - bookmarks = [ { - name = "Change Management"; - url = "https://ivrtg.atlassian.net/wiki/spaces/ITS/pages/13094842/Executing+Change+Management"; - } { - name = "Okta"; - url = "https://engagesmart.okta.com/"; - } { - name = "DB Request"; - url = "https://ivrtg.aha.io/develop/features/INFR-1073"; - } ]; - } ]; - } { - name = "Katie"; - bookmarks = [ { - name = "Sports Forms"; - url = "https://midlothianisd.rankone.com/New/NewStudentList.aspx"; - } { - name = "Skyward"; - url = "https://skyward.iscorp.com/MidlothianISDTXStuSTS/Session/Signin?area=Home&controller=Home&action=Index&logoutreason=TimedOut"; - } ]; - } { - name = "Nix"; - bookmarks = [ { - name = "Package Versions"; - url = "https://lazamar.co.uk/nix-versions/?channel=nixpkgs-unstable&package=python3"; - } { - name = "Channel status"; - url = "https://status.nixos.org/"; - } { - name = "Home Manager options"; - url = "https://nix-community.github.io/home-manager/options.xhtml"; - } { - name = "Flake Parts"; - url = "https://community.flake.parts/"; - } { - name = "Language ref"; - url = "https://nix.dev/manual/nix/latest/language/index.html"; - } { - name = "Builtin functions"; - url = "https://nix.dev/manual/nix/latest/language/builtins.html"; - } { - name = "Nixpkgs functions"; - url = "https://ryantm.github.io/nixpkgs/functions/library/strings/#sec-functions-library-strings"; - } { - name = "NUR search"; - url = "https://nur.nix-community.org/"; - } ]; - } { - name = "Rust"; - bookmarks = [ { - name = "Learn Rust"; - url = "https://www.rust-lang.org/learn"; - } { - name = "Rust by Example"; - url = "https://doc.rust-lang.org/rust-by-example/hello.html"; - } { - name = "Iced"; - url = "https://docs.rs/iced/latest/iced/"; - } ]; - } { - name = "Shopping"; - bookmarks = [ { - name = "Cables"; - url = "https://www.pchcables.com"; - } ]; - } { - name = "SubTo"; - bookmarks = [ { - name = "Kajabi"; - url = "https://www.subtocourse.com/login"; - } { - name = "SubTo Fund"; - url = "https://frontend.koreconx.com/auth/login"; - } { - name = "Creive Title"; - url = "https://getcreativetitle.com/"; - } { - name = "REI Scripts"; - url = "https://reiconveyorbelt.com/no-excuses/"; - } ]; - } { - name = "Tools"; - bookmarks = [ { - name = "Password Hash"; - url = "https://unix4lyfe.org/crypt/"; - } { - name = "Keymap editor"; - url = "https://nickcoutsos.github.io/keymap-editor/"; - } { - name = "Bitcoin dashboard"; - url = "http://hosea.home:60845"; - } ]; - } ]; -} ] +[{ + name = "Toolbar"; + toolbar = true; + bookmarks = [{ + name = "Ansible"; + bookmarks = [{ + name = "Collection Index"; + url = "https://docs.ansible.com/ansible/latest/collections/index.html"; + }]; + } + { + name = "Church"; + bookmarks = [{ + name = "DC4K"; + url = "https://www.dc4k.org/leaderzone/articles"; + }]; + } + { + name = "IVR"; + bookmarks = [{ + name = "Dev"; + bookmarks = [{ + name = "Core Survey"; + url = "https://webdev5.ivrtechnology.com/coreservices/survey/admin/"; + } + { + name = "Audio"; + url = "https://apidev1.ivrtechnology.com/coreservices/audio/admin/"; + }]; + } + { + name = "HC"; + bookmarks = [{ + name = "Audio"; + url = "https://hcweb3.ivrtechnology.com/coreservices/audio/admin/"; + } + { + name = "Survey"; + url = "https://hcweb2.ivrtechnology.com/coreservices/survey/admin/"; + }]; + } + { + name = "PCI"; + bookmarks = [{ + name = "Audio"; + url = "https://pciweb3.ivrtechnology.com/coreservices/audio/admin/"; + }]; + } + { + name = "Processes"; + bookmarks = [{ + name = "Change Management"; + url = "https://ivrtg.atlassian.net/wiki/spaces/ITS/pages/13094842/Executing+Change+Management"; + } + { + name = "Okta"; + url = "https://engagesmart.okta.com/"; + } + { + name = "DB Request"; + url = "https://ivrtg.aha.io/develop/features/INFR-1073"; + }]; + }]; + } + { + name = "Katie"; + bookmarks = [{ + name = "Sports Forms"; + url = "https://midlothianisd.rankone.com/New/NewStudentList.aspx"; + } + { + name = "Skyward"; + url = "https://skyward.iscorp.com/MidlothianISDTXStuSTS/Session/Signin?area=Home&controller=Home&action=Index&logoutreason=TimedOut"; + }]; + } + { + name = "Nix"; + bookmarks = [{ + name = "Package Versions"; + url = "https://lazamar.co.uk/nix-versions/?channel=nixpkgs-unstable&package=python3"; + } + { + name = "Channel status"; + url = "https://status.nixos.org/"; + } + { + name = "Home Manager options"; + url = "https://nix-community.github.io/home-manager/options.xhtml"; + } + { + name = "Flake Parts"; + url = "https://community.flake.parts/"; + } + { + name = "Language ref"; + url = "https://nix.dev/manual/nix/latest/language/index.html"; + } + { + name = "Builtin functions"; + url = "https://nix.dev/manual/nix/latest/language/builtins.html"; + } + { + name = "Nixpkgs functions"; + url = "https://ryantm.github.io/nixpkgs/functions/library/strings/#sec-functions-library-strings"; + } + { + name = "NUR search"; + url = "https://nur.nix-community.org/"; + }]; + } + { + name = "Rust"; + bookmarks = [{ + name = "Learn Rust"; + url = "https://www.rust-lang.org/learn"; + } + { + name = "Rust by Example"; + url = "https://doc.rust-lang.org/rust-by-example/hello.html"; + } + { + name = "Iced"; + url = "https://docs.rs/iced/latest/iced/"; + }]; + } + { + name = "Shopping"; + bookmarks = [{ + name = "Cables"; + url = "https://www.pchcables.com"; + }]; + } + { + name = "SubTo"; + bookmarks = [{ + name = "Kajabi"; + url = "https://www.subtocourse.com/login"; + } + { + name = "SubTo Fund"; + url = "https://frontend.koreconx.com/auth/login"; + } + { + name = "Creive Title"; + url = "https://getcreativetitle.com/"; + } + { + name = "REI Scripts"; + url = "https://reiconveyorbelt.com/no-excuses/"; + }]; + } + { + name = "Tools"; + bookmarks = [{ + name = "Password Hash"; + url = "https://unix4lyfe.org/crypt/"; + } + { + name = "Keymap editor"; + url = "https://nickcoutsos.github.io/keymap-editor/"; + } + { + name = "Bitcoin dashboard"; + url = "http://hosea.home:60845"; + }]; + }]; +}] diff --git a/home/modules/python.nix b/home/modules/python.nix index d7ed997..a9e3b23 100644 --- a/home/modules/python.nix +++ b/home/modules/python.nix @@ -1,10 +1,10 @@ { config, pkgs, lib, ... }: { - options.greg.pypackage = lib.mkOption { - description = "Enable Gnome support and settings"; - type = lib.types.package; - default = pkgs.gregpy; - }; + options.greg.pypackage = lib.mkOption { + description = "Enable Gnome support and settings"; + type = lib.types.package; + default = pkgs.gregpy; + }; - config.home.packages = [ config.greg.pypackage ]; + config.home.packages = [ config.greg.pypackage ]; } diff --git a/home/modules/sway.nix b/home/modules/sway.nix index dc3b6e7..4dcbc78 100644 --- a/home/modules/sway.nix +++ b/home/modules/sway.nix @@ -1,103 +1,106 @@ { config, pkgs, lib, ... }: let - cfg = config.greg.sway; - file_browser = { - pkg = pkgs.krusader; - path = "${pkgs.krusader}/bin/krusader"; - }; - term = "${pkgs.alacritty}/bin/alacritty"; - msg = "${pkgs.sway}/bin/swaymsg"; - sleep = "${pkgs.coreutils}/bin/sleep"; - workstation1 = pkgs.writeScriptBin "workstation1" (builtins.concatStringsSep "\n" [ - "${msg} \"workspace 1 ; exec ${pkgs.firefox}/bin/firefox ; split horizontal ; exec ${pkgs.element-desktop}/bin/element-desktop \"" - "${sleep} 1" - "${msg} '[app_id=\"firefox\"]' move left" - "${msg} '[instance=\"element\"]' \"layout tabbed ; exec ${term} \"" - "${msg} '[app_id=\"firefox\"]' move left" - "${sleep} 0.3" - "${msg} '[app_id=\"Alacritty\" workspace=\"1\"]' move right" - "${msg} '[app_id=\"firefox\"]' resize grow width 300 px" - ]); - workstation2 = pkgs.writeScriptBin "workstation2" (builtins.concatStringsSep "\n" [ - "${sleep} 5" - "${msg} \"workspace 2 ; exec ${term} ; layout tabbed\"" - ]); -in { - options.greg.sway = lib.mkEnableOption "Enable Sway support and settings"; + cfg = config.greg.sway; + file_browser = { + pkg = pkgs.krusader; + path = "${pkgs.krusader}/bin/krusader"; + }; + term = "${pkgs.alacritty}/bin/alacritty"; + msg = "${pkgs.sway}/bin/swaymsg"; + sleep = "${pkgs.coreutils}/bin/sleep"; + workstation1 = pkgs.writeScriptBin "workstation1" (builtins.concatStringsSep "\n" [ + "${msg} \"workspace 1 ; exec ${pkgs.firefox}/bin/firefox ; split horizontal ; exec ${pkgs.element-desktop}/bin/element-desktop \"" + "${sleep} 1" + "${msg} '[app_id=\"firefox\"]' move left" + "${msg} '[instance=\"element\"]' \"layout tabbed ; exec ${term} \"" + "${msg} '[app_id=\"firefox\"]' move left" + "${sleep} 0.3" + "${msg} '[app_id=\"Alacritty\" workspace=\"1\"]' move right" + "${msg} '[app_id=\"firefox\"]' resize grow width 300 px" + ]); + workstation2 = pkgs.writeScriptBin "workstation2" (builtins.concatStringsSep "\n" [ + "${sleep} 5" + "${msg} \"workspace 2 ; exec ${term} ; layout tabbed\"" + ]); +in +{ + options.greg.sway = lib.mkEnableOption "Enable Sway support and settings"; - config = (lib.mkIf cfg { - programs.swaylock.enable = true; + config = (lib.mkIf cfg { + programs.swaylock.enable = true; - wayland.windowManager.sway = let - mod = config.wayland.windowManager.sway.config.modifier; - in { - enable = true; - config = rec { - #fonts.size = 10.0; - keybindings = lib.mkOptionDefault { - "Mod4+l" = "exec ${pkgs.swaylock}/bin/swaylock -c 000000"; - "Mod4+h" = "exec ${pkgs.qpwgraph}/bin/qpwgraph -x /home/greg/sound/headphones.qpwgraph -m"; - "Mod4+m" = "exec ${pkgs.qpwgraph}/bin/qpwgraph -x /home/greg/sound/monitor.qpwgraph -m"; - "Mod4+b" = "exec ${pkgs.qpwgraph}/bin/qpwgraph -x /home/greg/sound/both.qpwgraph -m"; + wayland.windowManager.sway = + let + mod = config.wayland.windowManager.sway.config.modifier; + in + { + enable = true; + config = rec { + #fonts.size = 10.0; + keybindings = lib.mkOptionDefault { + "Mod4+l" = "exec ${pkgs.swaylock}/bin/swaylock -c 000000"; + "Mod4+h" = "exec ${pkgs.qpwgraph}/bin/qpwgraph -x /home/greg/sound/headphones.qpwgraph -m"; + "Mod4+m" = "exec ${pkgs.qpwgraph}/bin/qpwgraph -x /home/greg/sound/monitor.qpwgraph -m"; + "Mod4+b" = "exec ${pkgs.qpwgraph}/bin/qpwgraph -x /home/greg/sound/both.qpwgraph -m"; - "${mod}+Shift+Return" = file_browser.path; - }; - modifier = "Mod1"; - output = { - "Samsung Electric Company S24E650 H4ZN600985" = { - mode = "1920x1200"; - transform = "90"; - pos = "0 0"; - }; - "ViewSonic Corporation VA2252 Series VMT201800925" = { - mode = "1920x1080"; - pos = "200 1920"; - }; - }; - terminal = term; - startup = [ - { command = "${workstation1}/bin/workstation1"; } - { command = "${workstation2}/bin/workstation2"; } - ]; - }; - extraOptions = [ - "--unsupported-gpu" - ]; - extraSessionCommands = '' - export WLR_NO_HARDWARE_CURSORS=1 - ''; - systemd.enable = true; - wrapperFeatures = { - base = true; - gtk = true; - }; - }; - - home.pointerCursor = { - name = "Adwaita"; - package = pkgs.gnome.adwaita-icon-theme; - size = 12; - x11 = { - enable = true; - defaultCursor = "Adwaita"; - }; - }; + "${mod}+Shift+Return" = file_browser.path; + }; + modifier = "Mod1"; + output = { + "Samsung Electric Company S24E650 H4ZN600985" = { + mode = "1920x1200"; + transform = "90"; + pos = "0 0"; + }; + "ViewSonic Corporation VA2252 Series VMT201800925" = { + mode = "1920x1080"; + pos = "200 1920"; + }; + }; + terminal = term; + startup = [ + { command = "${workstation1}/bin/workstation1"; } + { command = "${workstation2}/bin/workstation2"; } + ]; + }; + extraOptions = [ + "--unsupported-gpu" + ]; + extraSessionCommands = '' + export WLR_NO_HARDWARE_CURSORS=1 + ''; + systemd.enable = true; + wrapperFeatures = { + base = true; + gtk = true; + }; + }; - home.packages = with pkgs; [ - arj - dpkg - kate - kget - krename - file_browser.pkg - p7zip - plocate - rpm - qpwgraph - xorg.xev - xorg.xmodmap - xxdiff - ]; - }); + home.pointerCursor = { + name = "Adwaita"; + package = pkgs.gnome.adwaita-icon-theme; + size = 12; + x11 = { + enable = true; + defaultCursor = "Adwaita"; + }; + }; + + home.packages = with pkgs; [ + arj + dpkg + kate + kget + krename + file_browser.pkg + p7zip + plocate + rpm + qpwgraph + xorg.xev + xorg.xmodmap + xxdiff + ]; + }); } diff --git a/home/modules/vscodium.nix b/home/modules/vscodium.nix index d7e4c2b..b0ea339 100644 --- a/home/modules/vscodium.nix +++ b/home/modules/vscodium.nix @@ -1,57 +1,58 @@ { pkgs, config, lib, inputs, ... }: let - cfg = config.greg.vscodium; -in { - options.greg.vscodium = lib.mkEnableOption "Enable installation of VSCodium on the host"; + cfg = config.greg.vscodium; +in +{ + options.greg.vscodium = lib.mkEnableOption "Enable installation of VSCodium on the host"; - config = lib.mkIf cfg { - home.packages = with pkgs; [ - buildifier - gopls - nixd # nix language server - ]; + config = lib.mkIf cfg { + home.packages = with pkgs; [ + buildifier + gopls + nixd # nix language server + ]; - # An alternative editor to vim, when I need it for some things - programs.vscode = { - enable = true; - package = pkgs.vscodium; - extensions = with inputs.vsext.extensions."${pkgs.stdenv.system}".vscode-marketplace; [ - arrterian.nix-env-selector - asvetliakov.vscode-neovim - batisteo.vscode-django - bungcip.better-toml - donjayamanne.python-environment-manager - golang.go - kevinrose.vsc-python-indent - jnoortheen.nix-ide - mkhl.direnv - ms-python.python - njpwerner.autodocstring - rust-lang.rust-analyzer - vscjava.vscode-java-test - vscjava.vscode-java-dependency - vscjava.vscode-java-debug - wholroyd.jinja - ]; - userSettings = { - "direnv.restart.automatic" = true; - "direnv.path.executable" = "/home/gregory.hellings/.nix-profile/bin/direnv"; - "extensions.autoUpdate" = false; - "extensions.experimental.affinity" = { - "asvetliakov.vscode-neovim" = 1; - }; - "git.openRepositoryInParentFolders" = "always"; - "search.exclude" = { - "**/.tox" = true; - }; - "terminal.integrated.defaultProfile.linux" = "tmux"; - "vscode-neovim.neovimInitVimPaths.darwin" = "~/.config/nvim/init.lua"; - "vscode-neovim.neovimInitVimPaths.linux" = "~/.config/nvim/init.lua"; - "workbench.settings.applyToAllProfiles" = [ - "direnv.path.executable" - ]; - }; - }; - }; + # An alternative editor to vim, when I need it for some things + programs.vscode = { + enable = true; + package = pkgs.vscodium; + extensions = with inputs.vsext.extensions."${pkgs.stdenv.system}".vscode-marketplace; [ + arrterian.nix-env-selector + asvetliakov.vscode-neovim + batisteo.vscode-django + bungcip.better-toml + donjayamanne.python-environment-manager + golang.go + kevinrose.vsc-python-indent + jnoortheen.nix-ide + mkhl.direnv + ms-python.python + njpwerner.autodocstring + rust-lang.rust-analyzer + vscjava.vscode-java-test + vscjava.vscode-java-dependency + vscjava.vscode-java-debug + wholroyd.jinja + ]; + userSettings = { + "direnv.restart.automatic" = true; + "direnv.path.executable" = "/home/gregory.hellings/.nix-profile/bin/direnv"; + "extensions.autoUpdate" = false; + "extensions.experimental.affinity" = { + "asvetliakov.vscode-neovim" = 1; + }; + "git.openRepositoryInParentFolders" = "always"; + "search.exclude" = { + "**/.tox" = true; + }; + "terminal.integrated.defaultProfile.linux" = "tmux"; + "vscode-neovim.neovimInitVimPaths.darwin" = "~/.config/nvim/init.lua"; + "vscode-neovim.neovimInitVimPaths.linux" = "~/.config/nvim/init.lua"; + "workbench.settings.applyToAllProfiles" = [ + "direnv.path.executable" + ]; + }; + }; + }; } diff --git a/home/modules/xonsh.nix b/home/modules/xonsh.nix index 95bd862..ea5162f 100644 --- a/home/modules/xonsh.nix +++ b/home/modules/xonsh.nix @@ -1,94 +1,100 @@ { config, pkgs, lib, ... }: let - cfg = config.programs.xonsh; + cfg = config.programs.xonsh; -in with lib; { - options = { - programs.xonsh = { - enable = mkEnableOption "Enable the xonsh program"; +in +with lib; { + options = { + programs.xonsh = { + enable = mkEnableOption "Enable the xonsh program"; - sessionVariables = mkOption { - type = types.attrs; - default = {}; - example = { XONSH_TRACE_SUBPROC = true; }; - description = '' - Environment variables that will be set for the Xonsh session. - ''; - }; + sessionVariables = mkOption { + type = types.attrs; + default = { }; + example = { XONSH_TRACE_SUBPROC = true; }; + description = '' + Environment variables that will be set for the Xonsh session. + ''; + }; - aliases = mkOption { - type = types.attrsOf types.str; - default = {}; - example = literalExpression '' - { - ll = "ls -l"; - la = "ls -a"; - } - ''; - description = '' - An attribute set that maps aliases (the top level attribute names in - this option) to command strings or directly to build outputs. - ''; - }; + aliases = mkOption { + type = types.attrsOf types.str; + default = { }; + example = literalExpression '' + { + ll = "ls -l"; + la = "ls -a"; + } + ''; + description = '' + An attribute set that maps aliases (the top level attribute names in + this option) to command strings or directly to build outputs. + ''; + }; - configHeader = mkOption { - type = types.lines; - default = ""; - example = literalExpression '' - import os - import sys - ''; - description = "An arbitrary string to put at the top of the config file"; - }; + configHeader = mkOption { + type = types.lines; + default = ""; + example = literalExpression '' + import os + import sys + ''; + description = "An arbitrary string to put at the top of the config file"; + }; - configFooter = mkOption { - type = types.lines; - default = ""; - example = literalExpression '' - def _some_method(args): - do_command() - some_other_thing() - aliases['some_method'] = _some_method - ''; - description = "An arbitrary string to put at the end of the config file"; - }; - }; - }; + configFooter = mkOption { + type = types.lines; + default = ""; + example = literalExpression '' + def _some_method(args): + do_command() + some_other_thing() + aliases['some_method'] = _some_method + ''; + description = "An arbitrary string to put at the end of the config file"; + }; + }; + }; - config = - let - shortAliases = concatStringsSep "\n" ( - mapAttrsToList (k: v: "aliases['${k}']=r'${v}'") cfg.aliases - ); + config = + let + shortAliases = concatStringsSep "\n" ( + mapAttrsToList (k: v: "aliases['${k}']=r'${v}'") cfg.aliases + ); - listToPythonList = let - listInternals = args: - concatStringsSep "\n" (map (v: "'${v}'") args); - in list: "[${listInternals list}]"; + listToPythonList = + let + listInternals = args: + concatStringsSep "\n" (map (v: "'${v}'") args); + in + list: "[${listInternals list}]"; - sessionVars = concatStringsSep "\n" ( - mapAttrsToList (k: v: - if builtins.typeOf v == "string" then - "\$${k} = '${v}'" - else if builtins.typeOf v == "list" then - "\$${k} = ${listToPythonList}" - else if builtins.typeOf v == "int" then - "\$${k} = ${toString v}" - else "" - ) cfg.sessionVariables - ); + sessionVars = concatStringsSep "\n" ( + mapAttrsToList + (k: v: + if builtins.typeOf v == "string" then + "\$${k} = '${v}'" + else if builtins.typeOf v == "list" then + "\$${k} = ${listToPythonList}" + else if builtins.typeOf v == "int" then + "\$${k} = ${toString v}" + else "" + ) + cfg.sessionVariables + ); - in mkIf cfg.enable { + in + mkIf cfg.enable { - home.file.".xonshrc".text = '' -${cfg.configHeader} + home.file.".xonshrc".text = '' + ${cfg.configHeader} -${sessionVars} + ${sessionVars} -${shortAliases} + ${shortAliases} -${cfg.configFooter} -''; - }; + ${cfg.configFooter} + ''; + }; } diff --git a/hosts/default.nix b/hosts/default.nix index 979c877..97d3c79 100644 --- a/hosts/default.nix +++ b/hosts/default.nix @@ -1,65 +1,68 @@ { inputs, overlays, ... }: let - wsl = args: (unstable (args // { extraMods = [ inputs.wsl.nixosModules.wsl ]; })); - unstable = args: (machine (args // { - channel = inputs.nixunstable; - hm = inputs.hmunstable; - nixvim = inputs.nixvimunstable; - })); - machine = { - channel ? inputs.nixstable, - extraMods ? [], - name, - system ? "x86_64-linux", - hm ? inputs.hm, - nixvim ? inputs.nixvimstable, - }: - let - nixpkgs = import channel { - inherit system; - }; - # Use this to include modules directly from a repo - nurNoPkg = import inputs.nurpkgs { - nurpkgs = nixpkgs; - }; - in channel.lib.nixosSystem { - inherit system; - specialArgs = { inherit nixpkgs inputs overlays; }; - modules = [ - { - nixpkgs.overlays = overlays; - home-manager = { - useGlobalPkgs = true; - useUserPackages = true; - users.greg = import ../home/home.nix; - extraSpecialArgs = { - inherit inputs overlays nixvim; - home = "/home/greg"; - host = name; - }; - backupFileExtension = "bkp"; - }; - } - inputs.agenix.nixosModules.default - hm.nixosModules.home-manager - inputs.self.modules.nixosModule - inputs.nurpkgs.nixosModules.nur - ./${name} - ] ++ extraMods; - }; -in { - genesis = machine { name = "genesis"; }; - exodus = unstable { name = "exodus"; }; - jude = unstable { name = "jude"; }; - icdm-root = unstable { name = "icdm-root"; }; - linode = machine { name = "linode"; }; - hosea = unstable { name = "hosea"; }; - jeremiah = unstable { name = "jeremiah"; }; - myself = unstable { name = "myself"; }; - iso = machine { name = "iso"; }; - iso-beta = unstable { name = "iso"; }; - # nix build '.#nixosConfigurations.wsl.config.system.build.installer' - nixos = wsl { name = "wsl"; system = "aarch64-linux"; }; - # nix build '.#nixosConfigurations.wsl-aarch.config.system.build.installer' - nixos-arm = wsl { name = "wsl"; system = "aarch64-linux"; }; + wsl = args: (unstable (args // { extraMods = [ inputs.wsl.nixosModules.wsl ]; })); + unstable = args: (machine (args // { + channel = inputs.nixunstable; + hm = inputs.hmunstable; + nixvim = inputs.nixvimunstable; + })); + machine = + { channel ? inputs.nixstable + , extraMods ? [ ] + , name + , system ? "x86_64-linux" + , hm ? inputs.hm + , nixvim ? inputs.nixvimstable + , + }: + let + nixpkgs = import channel { + inherit system; + }; + # Use this to include modules directly from a repo + nurNoPkg = import inputs.nurpkgs { + nurpkgs = nixpkgs; + }; + in + channel.lib.nixosSystem { + inherit system; + specialArgs = { inherit nixpkgs inputs overlays; }; + modules = [ + { + nixpkgs.overlays = overlays; + home-manager = { + useGlobalPkgs = true; + useUserPackages = true; + users.greg = import ../home/home.nix; + extraSpecialArgs = { + inherit inputs overlays nixvim; + home = "/home/greg"; + host = name; + }; + backupFileExtension = "bkp"; + }; + } + inputs.agenix.nixosModules.default + hm.nixosModules.home-manager + inputs.self.modules.nixosModule + inputs.nurpkgs.nixosModules.nur + ./${name} + ] ++ extraMods; + }; +in +{ + genesis = machine { name = "genesis"; }; + exodus = unstable { name = "exodus"; }; + jude = unstable { name = "jude"; }; + icdm-root = unstable { name = "icdm-root"; }; + linode = machine { name = "linode"; }; + hosea = unstable { name = "hosea"; }; + jeremiah = unstable { name = "jeremiah"; }; + myself = unstable { name = "myself"; }; + iso = machine { name = "iso"; }; + iso-beta = unstable { name = "iso"; }; + # nix build '.#nixosConfigurations.wsl.config.system.build.installer' + nixos = wsl { name = "wsl"; system = "aarch64-linux"; }; + # nix build '.#nixosConfigurations.wsl-aarch.config.system.build.installer' + nixos-arm = wsl { name = "wsl"; system = "aarch64-linux"; }; } diff --git a/hosts/exodus/default.nix b/hosts/exodus/default.nix index 5a433e3..5e28521 100644 --- a/hosts/exodus/default.nix +++ b/hosts/exodus/default.nix @@ -1,24 +1,24 @@ { pkgs, config, ... }: { - imports = [ - ./hardware-configuration.nix - ]; + imports = [ + ./hardware-configuration.nix + ]; - boot.loader = { - systemd-boot.enable = true; - efi.canTouchEfiVariables = true; - }; + boot.loader = { + systemd-boot.enable = true; + efi.canTouchEfiVariables = true; + }; - networking.hostName = "exodus"; - greg = { - home = true; - gnome.enable = true; - print.enable = true; - tailscale.enable = true; - vmdev = { - enable = true; - system = "intel"; - }; - }; + networking.hostName = "exodus"; + greg = { + home = true; + gnome.enable = true; + print.enable = true; + tailscale.enable = true; + vmdev = { + enable = true; + system = "intel"; + }; + }; } diff --git a/hosts/exodus/hardware-configuration.nix b/hosts/exodus/hardware-configuration.nix index dbb261b..64f11a1 100644 --- a/hosts/exodus/hardware-configuration.nix +++ b/hosts/exodus/hardware-configuration.nix @@ -5,7 +5,8 @@ { imports = - [ (modulesPath + "/installer/scan/not-detected.nix") + [ + (modulesPath + "/installer/scan/not-detected.nix") ]; boot.initrd.availableKernelModules = [ "xhci_pci" "thunderbolt" "nvme" "uas" "sd_mod" ]; @@ -14,13 +15,15 @@ boot.extraModulePackages = [ ]; fileSystems."/" = - { device = "/dev/disk/by-uuid/607b933f-2967-4652-b478-4d8e9aa38a0d"; + { + device = "/dev/disk/by-uuid/607b933f-2967-4652-b478-4d8e9aa38a0d"; fsType = "btrfs"; options = [ "subvol=@" ]; }; fileSystems."/boot" = - { device = "/dev/disk/by-uuid/B31C-C1F4"; + { + device = "/dev/disk/by-uuid/B31C-C1F4"; fsType = "vfat"; }; diff --git a/hosts/genesis/acme.nix b/hosts/genesis/acme.nix index 0d43069..314ddad 100644 --- a/hosts/genesis/acme.nix +++ b/hosts/genesis/acme.nix @@ -1,62 +1,63 @@ { pkgs, config, lib, ... }: let - address = (builtins.elemAt config.networking.interfaces.ens18.ipv4.addresses 0).address; - root_ca = pkgs.writeText "root_ca.crt" (builtins.readFile ../../ca/root_ca.crt); - intermediate_ca = pkgs.writeText "intermediate_ca.crt" (builtins.readFile ../../ca/intermediate_ca.crt); -in { - age.secrets.acme_password = { - file = ../../secrets/acme_password.age; - }; - age.secrets.intermediate_ca_key = { - file = ../../secrets/ca/intermediate_key.age; - }; - age.secrets.root_ca_key.file = ../../secrets/ca/root_key.age; - systemd.services.step-ca.serviceConfig.Environment = lib.mkForce ["STEPDEBUG=1" "HOME=%S/step-ca"]; - services.step-ca = { - inherit address; - enable = false; - intermediatePasswordFile = config.age.secrets.acme_password.path; - openFirewall = true; - port = 8443; - settings = { - root = root_ca; - federatedRoots = null; - cert = intermediate_ca; - key = config.age.secrets.intermediate_ca_key.path; - dnsNames = [ - "10.42.1.5" - "acme.thehellings.lan" - ]; - logger.format = "text"; - db = { - type = "badgerv2"; - dataSource = "/var/lib/step-ca/db"; - badgerFileLoadingMode = ""; - }; - authority.provisioners = [ { - type = "JWK"; - name = "greg@thehellings.com"; - key = { - use = "sig"; - kty = "EC"; - kid = "1GOpOttYLZtx7XiG79ZycbGcG4ptL0czfohK35SZOEI"; - crv = "P-256"; - alg = "ES256"; - x = "YEWVj5CCoqWQXWqmL0UuORlFY9IEOLcg1jpG1o-wGx4"; - y = "MEpqnJp60VV-SpFtb6m8U-VAYut7R_PKFm07xl7MjBk"; - }; - encryptedKey = "eyJhbGciOiJQQkVTMi1IUzI1NitBMTI4S1ciLCJjdHkiOiJqd2sranNvbiIsImVuYyI6IkEyNTZHQ00iLCJwMmMiOjYwMDAwMCwicDJzIjoieWdfb0lfbWgwbHhPRXdjUTBsd0FnUSJ9.ivdQUFEhs2U8PUBYr8AhQl3hHdb4spF4jvXgqY_hiVgpjB-z3Nn9Uw.u7vrNht_3WD1G97q.mbydlpAQxjtKLkOmmDOUczqscRDPqrUyoPJ1uqXcJDH3vs4KiYlrKRcFLjPy9sWzEL1iIrqjwf3U-3AAx1KNAg7frs2D__MGfOO-U5SdQDVJVAND7KpWOJGJVSb0xioCA6-8ldlP_REqu4ENmkkdw0_6Is2b0p7ZFKqke_fqOOs7osqFAfbMb_WzEWrACLn5A5-Teh2rpEgR-z9zipN6MSEqE6VIQ2BXuv70aHWhslNe1MK1OgTYm9CqA47EMYvQ7HQLPDZAbP56WK84yJLktoXMmnkaKeTtvER0dh4ufyjJHBhecnEranbR5rHc_jV8_qvyWhlqbCrOU_8bWrk.a9SH_q3GKIUsOUSRWkDxQg"; - } ]; - tls = { - cipherSuites = [ - "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256" - "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256" - ]; - minVersion = 1.2; - maxVersion = 1.3; - renegotiation = false; - }; - }; - }; + address = (builtins.elemAt config.networking.interfaces.ens18.ipv4.addresses 0).address; + root_ca = pkgs.writeText "root_ca.crt" (builtins.readFile ../../ca/root_ca.crt); + intermediate_ca = pkgs.writeText "intermediate_ca.crt" (builtins.readFile ../../ca/intermediate_ca.crt); +in +{ + age.secrets.acme_password = { + file = ../../secrets/acme_password.age; + }; + age.secrets.intermediate_ca_key = { + file = ../../secrets/ca/intermediate_key.age; + }; + age.secrets.root_ca_key.file = ../../secrets/ca/root_key.age; + systemd.services.step-ca.serviceConfig.Environment = lib.mkForce [ "STEPDEBUG=1" "HOME=%S/step-ca" ]; + services.step-ca = { + inherit address; + enable = false; + intermediatePasswordFile = config.age.secrets.acme_password.path; + openFirewall = true; + port = 8443; + settings = { + root = root_ca; + federatedRoots = null; + cert = intermediate_ca; + key = config.age.secrets.intermediate_ca_key.path; + dnsNames = [ + "10.42.1.5" + "acme.thehellings.lan" + ]; + logger.format = "text"; + db = { + type = "badgerv2"; + dataSource = "/var/lib/step-ca/db"; + badgerFileLoadingMode = ""; + }; + authority.provisioners = [{ + type = "JWK"; + name = "greg@thehellings.com"; + key = { + use = "sig"; + kty = "EC"; + kid = "1GOpOttYLZtx7XiG79ZycbGcG4ptL0czfohK35SZOEI"; + crv = "P-256"; + alg = "ES256"; + x = "YEWVj5CCoqWQXWqmL0UuORlFY9IEOLcg1jpG1o-wGx4"; + y = "MEpqnJp60VV-SpFtb6m8U-VAYut7R_PKFm07xl7MjBk"; + }; + encryptedKey = "eyJhbGciOiJQQkVTMi1IUzI1NitBMTI4S1ciLCJjdHkiOiJqd2sranNvbiIsImVuYyI6IkEyNTZHQ00iLCJwMmMiOjYwMDAwMCwicDJzIjoieWdfb0lfbWgwbHhPRXdjUTBsd0FnUSJ9.ivdQUFEhs2U8PUBYr8AhQl3hHdb4spF4jvXgqY_hiVgpjB-z3Nn9Uw.u7vrNht_3WD1G97q.mbydlpAQxjtKLkOmmDOUczqscRDPqrUyoPJ1uqXcJDH3vs4KiYlrKRcFLjPy9sWzEL1iIrqjwf3U-3AAx1KNAg7frs2D__MGfOO-U5SdQDVJVAND7KpWOJGJVSb0xioCA6-8ldlP_REqu4ENmkkdw0_6Is2b0p7ZFKqke_fqOOs7osqFAfbMb_WzEWrACLn5A5-Teh2rpEgR-z9zipN6MSEqE6VIQ2BXuv70aHWhslNe1MK1OgTYm9CqA47EMYvQ7HQLPDZAbP56WK84yJLktoXMmnkaKeTtvER0dh4ufyjJHBhecnEranbR5rHc_jV8_qvyWhlqbCrOU_8bWrk.a9SH_q3GKIUsOUSRWkDxQg"; + }]; + tls = { + cipherSuites = [ + "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256" + "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256" + ]; + minVersion = 1.2; + maxVersion = 1.3; + renegotiation = false; + }; + }; + }; } diff --git a/hosts/genesis/default.nix b/hosts/genesis/default.nix index 860a288..fa408c0 100644 --- a/hosts/genesis/default.nix +++ b/hosts/genesis/default.nix @@ -5,43 +5,43 @@ { config, pkgs, ... }: { - imports = [ - # Include the results of the hardware scan. - ./acme.nix - ./hardware-configuration.nix - ./home-assistant.nix - ./networking.nix - ]; - - greg.home = true; - greg.gnome.enable = false; - - # Bootloader. - boot.loader.grub = { - enable = true; - device = "/dev/vda"; - useOSProber = true; - }; + imports = [ + # Include the results of the hardware scan. + ./acme.nix + ./hardware-configuration.nix + ./home-assistant.nix + ./networking.nix + ]; - #boot.loader = { - # systemd-boot.enable = true; - # efi = { - # canTouchEfiVariables = true; - # efiSysMountPoint = "/boot/efi"; - # }; - #}; - - networking.hostName = "genesis"; # Define your hostname. - environment.systemPackages = with pkgs; [ - awscli2 - create_ssl - step-ca - ]; + greg.home = true; + greg.gnome.enable = false; - virtualisation.oci-containers.containers.speedtest = { - image = "ghcr.io/librespeed/speedtest"; - hostname = "speedtest"; - ports = [ "19472:80" ]; - }; - greg.proxies."speedtest.thehellings.lan".target = "http://localhost:19472"; + # Bootloader. + boot.loader.grub = { + enable = true; + device = "/dev/vda"; + useOSProber = true; + }; + + #boot.loader = { + # systemd-boot.enable = true; + # efi = { + # canTouchEfiVariables = true; + # efiSysMountPoint = "/boot/efi"; + # }; + #}; + + networking.hostName = "genesis"; # Define your hostname. + environment.systemPackages = with pkgs; [ + awscli2 + create_ssl + step-ca + ]; + + virtualisation.oci-containers.containers.speedtest = { + image = "ghcr.io/librespeed/speedtest"; + hostname = "speedtest"; + ports = [ "19472:80" ]; + }; + greg.proxies."speedtest.thehellings.lan".target = "http://localhost:19472"; } diff --git a/hosts/genesis/hardware-configuration.nix b/hosts/genesis/hardware-configuration.nix index 41686e2..8ae25d8 100644 --- a/hosts/genesis/hardware-configuration.nix +++ b/hosts/genesis/hardware-configuration.nix @@ -5,7 +5,8 @@ { imports = - [ (modulesPath + "/profiles/qemu-guest.nix") + [ + (modulesPath + "/profiles/qemu-guest.nix") ]; boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "sr_mod" "virtio_blk" ]; @@ -14,13 +15,13 @@ boot.extraModulePackages = [ ]; fileSystems."/" = - { device = "/dev/disk/by-uuid/a13f941e-4985-47ab-a8c6-374a627c5ce1"; + { + device = "/dev/disk/by-uuid/a13f941e-4985-47ab-a8c6-374a627c5ce1"; fsType = "ext4"; }; swapDevices = - [ { device = "/dev/disk/by-uuid/ac4557de-1ad5-4d3c-b9f4-5ec50dbf76f1"; } - ]; + [{ device = "/dev/disk/by-uuid/ac4557de-1ad5-4d3c-b9f4-5ec50dbf76f1"; }]; # Enables DHCP on each ethernet and wireless interface. In case of scripted networking # (the default) this is the recommended approach. When using systemd-networkd it's diff --git a/hosts/genesis/home-assistant.nix b/hosts/genesis/home-assistant.nix index f9d9b9f..15592d5 100755 --- a/hosts/genesis/home-assistant.nix +++ b/hosts/genesis/home-assistant.nix @@ -1,135 +1,136 @@ { config, pkgs, ... }: let - service_list = [ "podman-home-assistant.service" ]; + service_list = [ "podman-home-assistant.service" ]; in { - virtualisation.podman.enable = true; + virtualisation.podman.enable = true; - services.home-assistant = { - enable = true; - configDir = "/var/lib/hass"; - extraComponents = [ - "accuweather" - "calendar" - "cast" - "eufy" - "lovelace" - "nextcloud" - "ping" - "piper" - "radio_browser" - "rainbird" - "roborock" - "smart_meter_texas" - "speedtestdotnet" - "solaredge" - "whisper" - "wiz" - "wyoming" - "zwave_js" - ]; - customComponents = with pkgs.home-assistant-custom-components; [ - smartthinq-sensors - ]; + services.home-assistant = { + enable = true; + configDir = "/var/lib/hass"; + extraComponents = [ + "accuweather" + "calendar" + "cast" + "eufy" + "lovelace" + "nextcloud" + "ping" + "piper" + "radio_browser" + "rainbird" + "roborock" + "smart_meter_texas" + "speedtestdotnet" + "solaredge" + "whisper" + "wiz" + "wyoming" + "zwave_js" + ]; + customComponents = with pkgs.home-assistant-custom-components; [ + smartthinq-sensors + ]; - config = { - default_config = {}; - tts = [ { platform = "google_translate"; } ]; - http = { - use_x_forwarded_for = true; - trusted_proxies = [ "127.0.0.1" "::1" ]; - server_host = "127.0.0.1"; - }; - #"automation manual" = *nix config here* and so on - "automation ui" = "!include automations.yaml"; - "script ui" = "!include scripts.yaml"; - "scene ui" = "!include scenes.yaml"; - }; - }; + config = { + default_config = { }; + tts = [{ platform = "google_translate"; }]; + http = { + use_x_forwarded_for = true; + trusted_proxies = [ "127.0.0.1" "::1" ]; + server_host = "127.0.0.1"; + }; + #"automation manual" = *nix config here* and so on + "automation ui" = "!include automations.yaml"; + "script ui" = "!include scripts.yaml"; + "scene ui" = "!include scenes.yaml"; + }; + }; - # Helps with Voice stuff for Home Assistant - services.wyoming = { - faster-whisper.servers = { - greg = { - enable = true; - beamSize = 1; # wut? - device = "auto"; # Could be CPU or CUDA - language = "en"; - model = "base-int8"; - uri = "tcp://0.0.0.0:13415"; - }; - }; - piper.servers.greg = { - enable = true; - uri = "tcp://0.0.0.0:13416"; - voice = "en_US-amy-medium"; - }; - }; + # Helps with Voice stuff for Home Assistant + services.wyoming = { + faster-whisper.servers = { + greg = { + enable = true; + beamSize = 1; # wut? + device = "auto"; # Could be CPU or CUDA + language = "en"; + model = "base-int8"; + uri = "tcp://0.0.0.0:13415"; + }; + }; + piper.servers.greg = { + enable = true; + uri = "tcp://0.0.0.0:13416"; + voice = "en_US-amy-medium"; + }; + }; - # Although NixOS has a package for Home Assistant, it is not kept as up to date as the container and the upstream - # is very vocal about only supporting their own container or the HAOS deployments. So we deploy the container here - # and avoid any potential messes from that - virtualisation.oci-containers = { - backend = "podman"; + # Although NixOS has a package for Home Assistant, it is not kept as up to date as the container and the upstream + # is very vocal about only supporting their own container or the HAOS deployments. So we deploy the container here + # and avoid any potential messes from that + virtualisation.oci-containers = { + backend = "podman"; - # I have ZWave devices. The easiest way to connect to them is the zwavejs2mqtt service running, so we spin up - # its container and map the ZWave device into it - containers.zwave = { - autoStart = false; # We will try to start it with udev.extraRules listed below, as this option starts it too quickly - image = "zwavejs/zwave-js-ui:latest"; - ports = [ "8091:8091" "3000:3000" ]; - volumes = [ "/var/lib/zwave:/usr/src/app/store" ]; - extraOptions = [ - "--device" "/dev/serial/by-id/usb-0658_0200-if00:/dev/zwave" - "--pull=newer" - ]; - environment = { - TZ = "America/Chicago"; - CONSOLE_OUTPUT = "true"; - }; - }; - }; + # I have ZWave devices. The easiest way to connect to them is the zwavejs2mqtt service running, so we spin up + # its container and map the ZWave device into it + containers.zwave = { + autoStart = false; # We will try to start it with udev.extraRules listed below, as this option starts it too quickly + image = "zwavejs/zwave-js-ui:latest"; + ports = [ "8091:8091" "3000:3000" ]; + volumes = [ "/var/lib/zwave:/usr/src/app/store" ]; + extraOptions = [ + "--device" + "/dev/serial/by-id/usb-0658_0200-if00:/dev/zwave" + "--pull=newer" + ]; + environment = { + TZ = "America/Chicago"; + CONSOLE_OUTPUT = "true"; + }; + }; + }; - # Both of the above container need storage for their configuration and devices, but it is not created correctly by - # the container. So we add the creation of /var/lib/{zwave,hass} to the systemd Unit files - systemd.services = { - "podman-zwave" = { - after = [ "sys-devices-pci0000:00-0000:00:1e.0-0000:02:1b.0-usb2-2\\x2d1-2\\x2d1:1.0-tty-ttyACM0.device" ]; - wantedBy = [ "sys-devices-pci0000:00-0000:00:1e.0-0000:02:1b.0-usb2-2\\x2d1-2\\x2d1:1.0-tty-ttyACM0.device" ]; - serviceConfig = { - StateDirectory = "zwave"; - StateDirectoryMode = pkgs.lib.mkForce "0777"; - }; - }; - }; + # Both of the above container need storage for their configuration and devices, but it is not created correctly by + # the container. So we add the creation of /var/lib/{zwave,hass} to the systemd Unit files + systemd.services = { + "podman-zwave" = { + after = [ "sys-devices-pci0000:00-0000:00:1e.0-0000:02:1b.0-usb2-2\\x2d1-2\\x2d1:1.0-tty-ttyACM0.device" ]; + wantedBy = [ "sys-devices-pci0000:00-0000:00:1e.0-0000:02:1b.0-usb2-2\\x2d1-2\\x2d1:1.0-tty-ttyACM0.device" ]; + serviceConfig = { + StateDirectory = "zwave"; + StateDirectoryMode = pkgs.lib.mkForce "0777"; + }; + }; + }; - services.udev.extraRules = '' - SUBSYSTEM=="tty", KERNEL=="ttyACM0", TAG+="systemd" - ''; + services.udev.extraRules = '' + SUBSYSTEM=="tty", KERNEL=="ttyACM0", TAG+="systemd" + ''; - greg.proxies = { - "smart.home".target = "http://127.0.0.1:8123/"; - "smart.thehellings.lan".target = "http://127.0.0.1:8123/"; - "zwave.home".target = "http://127.0.0.1:8091/"; - }; + greg.proxies = { + "smart.home".target = "http://127.0.0.1:8123/"; + "smart.thehellings.lan".target = "http://127.0.0.1:8123/"; + "zwave.home".target = "http://127.0.0.1:8091/"; + }; - # Ensure that both ports are up and running. We keep 8123 directly open because we are on the LAN and sometimes want to connect - # directly for troubleshooting Nginx configuration - networking.firewall = { - allowedTCPPorts = [ 80 443 ]; - }; + # Ensure that both ports are up and running. We keep 8123 directly open because we are on the LAN and sometimes want to connect + # directly for troubleshooting Nginx configuration + networking.firewall = { + allowedTCPPorts = [ 80 443 ]; + }; - greg.backup.jobs.zwave = { - src = "/var/lib/zwave"; - dest = "zwave"; - id = "zwave-asdf"; - }; + greg.backup.jobs.zwave = { + src = "/var/lib/zwave"; + dest = "zwave"; + id = "zwave-asdf"; + }; - greg.backup.jobs.hass-backup = { - src = "/var/lib/hass"; - dest = "hass"; - id = "hass-asdf"; - }; + greg.backup.jobs.hass-backup = { + src = "/var/lib/hass"; + dest = "hass"; + id = "hass-asdf"; + }; } diff --git a/hosts/genesis/networking.nix b/hosts/genesis/networking.nix index 86fcf34..72e52de 100644 --- a/hosts/genesis/networking.nix +++ b/hosts/genesis/networking.nix @@ -1,191 +1,192 @@ { pkgs, config, ... }: let - lan = "ens18"; - lanIP = "10.42.1.5"; - iot = "ens19"; - iotIP = "192.168.66.250"; - routerIP = "10.42.1.2"; - extraHosts = builtins.readFile ./net/hosts; + lan = "ens18"; + lanIP = "10.42.1.5"; + iot = "ens19"; + iotIP = "192.168.66.250"; + routerIP = "10.42.1.2"; + extraHosts = builtins.readFile ./net/hosts; - adblockUpdate = pkgs.writeShellScriptBin "adblockUpdate" (builtins.readFile ./adblockUpdate.sh); - proxyPort = 3128; - dnsPort = 53; - dhcpPort = 67; - dnsServers = [ - "9.9.9.9" # Quad 9 - "1.1.1.1" # Cloudflare - "1.0.0.1" # Cloudflare - "149.112.112.112" # Quad 9 - ]; -in { - greg.tailscale.enable = true; + adblockUpdate = pkgs.writeShellScriptBin "adblockUpdate" (builtins.readFile ./adblockUpdate.sh); + proxyPort = 3128; + dnsPort = 53; + dhcpPort = 67; + dnsServers = [ + "9.9.9.9" # Quad 9 + "1.1.1.1" # Cloudflare + "1.0.0.1" # Cloudflare + "149.112.112.112" # Quad 9 + ]; +in +{ + greg.tailscale.enable = true; - # Really, why do I still have to force-disable this crap? - boot.kernel.sysctl = { - "net.ipv6.conf.${lan}.disable_ipv6" = true; - "net.ipv6.conf.${iot}.disable_ipv6" = true; - "net.ipv6.conf.lo.disable_ipv6" = true; - }; + # Really, why do I still have to force-disable this crap? + boot.kernel.sysctl = { + "net.ipv6.conf.${lan}.disable_ipv6" = true; + "net.ipv6.conf.${iot}.disable_ipv6" = true; + "net.ipv6.conf.lo.disable_ipv6" = true; + }; - networking = { - enableIPv6 = false; - networkmanager.enable = pkgs.lib.mkForce false; - defaultGateway = routerIP; - nameservers = dnsServers; - interfaces = { - # This is our LAN port - "${lan}" = { - useDHCP = false; - ipv4.addresses = [ { - address = "${lanIP}"; - prefixLength = 16; - } ]; - }; + networking = { + enableIPv6 = false; + networkmanager.enable = pkgs.lib.mkForce false; + defaultGateway = routerIP; + nameservers = dnsServers; + interfaces = { + # This is our LAN port + "${lan}" = { + useDHCP = false; + ipv4.addresses = [{ + address = "${lanIP}"; + prefixLength = 16; + }]; + }; - "${iot}" = { - useDHCP = false; - ipv4.addresses = [ { - address = "${iotIP}"; - prefixLength = 24; - } ]; - }; - }; - firewall = { - enable = false; - allowedUDPPorts = [ - dhcpPort - dnsPort - 1900 # Jellyfin auto-discovery - 7359 # Jellyfin auto-discovery - ]; - allowedTCPPorts = [ - dnsPort - proxyPort - 80 - ]; - }; - nftables.enable = false; - }; + "${iot}" = { + useDHCP = false; + ipv4.addresses = [{ + address = "${iotIP}"; + prefixLength = 24; + }]; + }; + }; + firewall = { + enable = false; + allowedUDPPorts = [ + dhcpPort + dnsPort + 1900 # Jellyfin auto-discovery + 7359 # Jellyfin auto-discovery + ]; + allowedTCPPorts = [ + dnsPort + proxyPort + 80 + ]; + }; + nftables.enable = false; + }; - environment.etc."hosts.d/local".text = extraHosts; + environment.etc."hosts.d/local".text = extraHosts; - fileSystems = { - "/media" = { - device = "10.42.1.4:/volume1/video/"; - fsType = "nfs"; - options = [ "ro" ]; - }; - }; + fileSystems = { + "/media" = { + device = "10.42.1.4:/volume1/video/"; + fsType = "nfs"; + options = [ "ro" ]; + }; + }; - services = { - # Video services - jellyfin = { - enable = true; - openFirewall = true; - }; + services = { + # Video services + jellyfin = { + enable = true; + openFirewall = true; + }; - ######### - # Blind service proxy behind the walls of the VPN - ######## - _3proxy = { - enable = true; - services = [ { - type = "socks"; - auth = [ "strong" ]; - bindPort = proxyPort; - acl = [ { - rule = "allow"; - users = [ "greg" ]; - } ]; - } ]; - #usersFile = "/run/agenix/3proxy"; - denyPrivate = false; - }; + ######### + # Blind service proxy behind the walls of the VPN + ######## + _3proxy = { + enable = true; + services = [{ + type = "socks"; + auth = [ "strong" ]; + bindPort = proxyPort; + acl = [{ + rule = "allow"; + users = [ "greg" ]; + }]; + }]; + #usersFile = "/run/agenix/3proxy"; + denyPrivate = false; + }; - ######### - # dnsmasq config - ######## - dnsmasq = { - enable = true; - settings = { - domain = "thehellings.lan"; - dhcp-range = [ - "${lan},10.42.2.1,10.42.2.255,255.255.0.0,12h" - "${iot},192.168.66.3,192.168.66.150,255.255.255.0,12h" - "vlan67@${lan},192.168.67.3,192.168.67.150,12h" - ]; - dhcp-option = [ - "${lan},option:router,${routerIP}" - "${lan},option:dns-server,${lanIP},1.1.1.1" - "${lan},option:domain-search,thehellings.lan" + ######### + # dnsmasq config + ######## + dnsmasq = { + enable = true; + settings = { + domain = "thehellings.lan"; + dhcp-range = [ + "${lan},10.42.2.1,10.42.2.255,255.255.0.0,12h" + "${iot},192.168.66.3,192.168.66.150,255.255.255.0,12h" + "vlan67@${lan},192.168.67.3,192.168.67.150,12h" + ]; + dhcp-option = [ + "${lan},option:router,${routerIP}" + "${lan},option:dns-server,${lanIP},1.1.1.1" + "${lan},option:domain-search,thehellings.lan" - "${iot},option:router,192.168.66.1" - "${iot},option:dns-server,${iotIP}" + "${iot},option:router,192.168.66.1" + "${iot},option:dns-server,${iotIP}" - "vlan67@${lan},option:router,192.168.67.1" - "vlan67@${lan},option:dns-server,192.168.67.1" - ]; - dhcp-host = [ - # Static IPs for personal work - "2a:5d:23:10:4e:22,10.42.0.5" # SAN Switch - "00:00:de:ad:be:ef,10.42.2.254" - "01:a8:a1:59:c7:8a:12,10.42.2.253" # BMC management interface for isaiah + "vlan67@${lan},option:router,192.168.67.1" + "vlan67@${lan},option:dns-server,192.168.67.1" + ]; + dhcp-host = [ + # Static IPs for personal work + "2a:5d:23:10:4e:22,10.42.0.5" # SAN Switch + "00:00:de:ad:be:ef,10.42.2.254" + "01:a8:a1:59:c7:8a:12,10.42.2.253" # BMC management interface for isaiah - # Static IPs for things in the IOT range - "b4:b0:24:9a:02:4a,192.168.66.5" # LD125 - "98:da:c4:20:f3:64,192.168.66.6" # Dining room light - "54:af:97:c1:dc:b9,192.168.66.25" # Master bedroom Kasa switch - "f0:03:8c:b3:b0:f6,192.168.66.55" # Roomba - "4c:a1:61:05:cd:52,192.168.66.61" # Rainbird - "48:d6:d5:5d:81:21,192.168.66.65" # Google Home - "6c:29:90:3e:e2:02,192.168.66.66" # wiz - "28:87:ba:0e:ca:da,192.168.66.74" # - "28:87:ba:0e:c9:fd,192.168.66.75" # Master closet - "54:af:97:c2:0f:a1,192.168.66.76" # Master toilet - "54:af:97:83:ed:33,192.168.66.80" - "98:da:c4:77:80:18,192.168.66.84" # Kitchen lights - "98:da:c4:21:1b:2e,192.168.66.85" # Living Room lights - "0c:80:63:41:6e:0f,192.168.66.90" # Front porch - "0c:80:63:41:6c:5d,192.168.66.98" # House number - "ac:84:c6:5e:4b:28,192.168.66.100" - "98:da:c4:77:7f:4d,192.168.66.102" # Office lights - "8c:85:80:1c:f9:d1,192.168.66.104" - "98:da:c4:77:82:7b,192.168.66.105" # Parlor lamp - "0c:80:63:41:74:73,192.168.66.106" # Front hall light switch - "98:da:c4:20:ea:db,192.168.66.107" # Parlor light switch - "8c:49:62:aa:58:60,192.168.66.108" # Roku, HiHandsome - "92:3e:11:c7:c5:be,192.168.66.109" - "d8:0d:17:19:60:62,192.168.66.112" - "b4:b0:24:9a:12:53,192.168.66.130" # KL125 - "b4:b0:24:9a:14:0e,192.168.66.131" - "e4:f0:42:61:fa:b5,192.168.66.149" # Google Home-mini - ]; - expand-hosts = true; - log-dhcp = true; - log-queries = true; - no-hosts = true; # Do not read /etc/hosts, which makes genesis resolve to 127.0.0.2 - addn-hosts = "/etc/adblock_hosts"; - hostsdir = "/etc/hosts.d/"; - server = dnsServers; - }; - }; + # Static IPs for things in the IOT range + "b4:b0:24:9a:02:4a,192.168.66.5" # LD125 + "98:da:c4:20:f3:64,192.168.66.6" # Dining room light + "54:af:97:c1:dc:b9,192.168.66.25" # Master bedroom Kasa switch + "f0:03:8c:b3:b0:f6,192.168.66.55" # Roomba + "4c:a1:61:05:cd:52,192.168.66.61" # Rainbird + "48:d6:d5:5d:81:21,192.168.66.65" # Google Home + "6c:29:90:3e:e2:02,192.168.66.66" # wiz + "28:87:ba:0e:ca:da,192.168.66.74" # + "28:87:ba:0e:c9:fd,192.168.66.75" # Master closet + "54:af:97:c2:0f:a1,192.168.66.76" # Master toilet + "54:af:97:83:ed:33,192.168.66.80" + "98:da:c4:77:80:18,192.168.66.84" # Kitchen lights + "98:da:c4:21:1b:2e,192.168.66.85" # Living Room lights + "0c:80:63:41:6e:0f,192.168.66.90" # Front porch + "0c:80:63:41:6c:5d,192.168.66.98" # House number + "ac:84:c6:5e:4b:28,192.168.66.100" + "98:da:c4:77:7f:4d,192.168.66.102" # Office lights + "8c:85:80:1c:f9:d1,192.168.66.104" + "98:da:c4:77:82:7b,192.168.66.105" # Parlor lamp + "0c:80:63:41:74:73,192.168.66.106" # Front hall light switch + "98:da:c4:20:ea:db,192.168.66.107" # Parlor light switch + "8c:49:62:aa:58:60,192.168.66.108" # Roku, HiHandsome + "92:3e:11:c7:c5:be,192.168.66.109" + "d8:0d:17:19:60:62,192.168.66.112" + "b4:b0:24:9a:12:53,192.168.66.130" # KL125 + "b4:b0:24:9a:14:0e,192.168.66.131" + "e4:f0:42:61:fa:b5,192.168.66.149" # Google Home-mini + ]; + expand-hosts = true; + log-dhcp = true; + log-queries = true; + no-hosts = true; # Do not read /etc/hosts, which makes genesis resolve to 127.0.0.2 + addn-hosts = "/etc/adblock_hosts"; + hostsdir = "/etc/hosts.d/"; + server = dnsServers; + }; + }; - # Update adblock list - cron = { - enable = true; - systemCronJobs = [ - "* * * * * root ${adblockUpdate} 2>&1 > /var/log/adblock.log" - ]; - }; - }; # End of services configuration + # Update adblock list + cron = { + enable = true; + systemCronJobs = [ + "* * * * * root ${adblockUpdate} 2>&1 > /var/log/adblock.log" + ]; + }; + }; # End of services configuration - greg.proxies = { - "jellyfin.home".target = "http://localhost:8096/"; - }; + greg.proxies = { + "jellyfin.home".target = "http://localhost:8096/"; + }; - environment.systemPackages = with pkgs; [ - bind - curl # Used by dnsmasq fetching - sqlite - ]; + environment.systemPackages = with pkgs; [ + bind + curl # Used by dnsmasq fetching + sqlite + ]; } diff --git a/hosts/hosea/bitcoin.nix b/hosts/hosea/bitcoin.nix index 31c947b..587a670 100644 --- a/hosts/hosea/bitcoin.nix +++ b/hosts/hosea/bitcoin.nix @@ -1,78 +1,79 @@ { config, pkgs, ... }: let - ip = "100.68.203.1"; -in { - nix-bitcoin = { - generateSecrets = true; - operator = { - enable = true; - name = "greg"; - }; - useVersionLockedPkgs = true; # Use the exact versions of packages from upstream - }; + ip = "100.68.203.1"; +in +{ + nix-bitcoin = { + generateSecrets = true; + operator = { + enable = true; + name = "greg"; + }; + useVersionLockedPkgs = true; # Use the exact versions of packages from upstream + }; - networking.firewall.allowedTCPPorts = with config.services; [ - bitcoind.port - bitcoind.rpc.port - lnd.restPort - lnd.port - mempool.frontend.port - ]; + networking.firewall.allowedTCPPorts = with config.services; [ + bitcoind.port + bitcoind.rpc.port + lnd.restPort + lnd.port + mempool.frontend.port + ]; - greg.backup.jobs = { - clightning = { - src = config.services.clightning.replication.local.directory; - dest = "hosea-clightning"; - id = "clightning"; - }; - }; + greg.backup.jobs = { + clightning = { + src = config.services.clightning.replication.local.directory; + dest = "hosea-clightning"; + id = "clightning"; + }; + }; - services = { - backups = { - enable = true; - frequency = "hourly"; - }; - bitcoind = { - enable = true; - address = "0.0.0.0"; - dataDir = "/chain/bitcoind"; - listen = true; - rpc = { - address = ip; - allowip = [ - "100.1.1.1/8" - ]; - }; - }; - clightning = { - enable = true; - address = ip; - port = 9736; - replication = { - enable = true; - local.directory = "/var/backup/clightning"; - encrypt = false; - }; - }; - electrs = { - enable = true; - address = ip; - }; - lnd = { - enable = true; - address = ip; - lndconnect.enable = true; - }; - mempool = { - enable = true; - frontend = { - enable = true; - address = ip; - }; - }; - }; + services = { + backups = { + enable = true; + frequency = "hourly"; + }; + bitcoind = { + enable = true; + address = "0.0.0.0"; + dataDir = "/chain/bitcoind"; + listen = true; + rpc = { + address = ip; + allowip = [ + "100.1.1.1/8" + ]; + }; + }; + clightning = { + enable = true; + address = ip; + port = 9736; + replication = { + enable = true; + local.directory = "/var/backup/clightning"; + encrypt = false; + }; + }; + electrs = { + enable = true; + address = ip; + }; + lnd = { + enable = true; + address = ip; + lndconnect.enable = true; + }; + mempool = { + enable = true; + frontend = { + enable = true; + address = ip; + }; + }; + }; - environment.systemPackages = with pkgs; [ - ]; + environment.systemPackages = with pkgs; [ + ]; } diff --git a/hosts/hosea/default.nix b/hosts/hosea/default.nix index 9c2ecd1..fdab3a9 100644 --- a/hosts/hosea/default.nix +++ b/hosts/hosea/default.nix @@ -4,58 +4,59 @@ { config, pkgs, lib, inputs, overlays, ... }: let - wanInterface = "enp2s0"; - lanInterface = "enp1s0"; - lanIpAddress = "10.42.1.7"; + wanInterface = "enp2s0"; + lanInterface = "enp1s0"; + lanIpAddress = "10.42.1.7"; in { - imports = - [ # Include the results of the hardware scan. - ./hardware-configuration.nix - inputs.btc.nixosModules.default - ./bitcoin.nix - ]; + imports = + [ + # Include the results of the hardware scan. + ./hardware-configuration.nix + inputs.btc.nixosModules.default + ./bitcoin.nix + ]; - # Bootloader - boot = { - loader = { - systemd-boot.enable = true; - efi = { - canTouchEfiVariables = true; - efiSysMountPoint = "/boot/"; - }; - }; - extraModprobeConfig = "vboxdrv"; - }; - users.users.greg.extraGroups = [ "vboxusers" ]; + # Bootloader + boot = { + loader = { + systemd-boot.enable = true; + efi = { + canTouchEfiVariables = true; + efiSysMountPoint = "/boot/"; + }; + }; + extraModprobeConfig = "vboxdrv"; + }; + users.users.greg.extraGroups = [ "vboxusers" ]; - networking = { - hostName = "hosea"; - nameservers = [ "10.42.1.5" ]; - defaultGateway = "10.42.1.1"; - interfaces = { - "${wanInterface}".useDHCP = true; - "${lanInterface}" = { - useDHCP = false; - ipv4.addresses = [{ - address = lanIpAddress; - prefixLength = 16; - }]; - }; - }; - }; + networking = { + hostName = "hosea"; + nameservers = [ "10.42.1.5" ]; + defaultGateway = "10.42.1.1"; + interfaces = { + "${wanInterface}".useDHCP = true; + "${lanInterface}" = { + useDHCP = false; + ipv4.addresses = [{ + address = lanIpAddress; + prefixLength = 16; + }]; + }; + }; + }; - # Serves as the router, DHCP, and DNS for the site - greg = { - tailscale.enable = true; - home = true; - }; - services = { - # Configure keymap - xserver.xkb = { - layout = "us"; - variant = ""; - }; - }; + # Serves as the router, DHCP, and DNS for the site + greg = { + tailscale.enable = true; + home = true; + }; + services = { + # Configure keymap + xserver.xkb = { + layout = "us"; + variant = ""; + }; + }; } diff --git a/hosts/hosea/hardware-configuration.nix b/hosts/hosea/hardware-configuration.nix index 6473eef..6a36c10 100644 --- a/hosts/hosea/hardware-configuration.nix +++ b/hosts/hosea/hardware-configuration.nix @@ -5,7 +5,8 @@ { imports = - [ (modulesPath + "/installer/scan/not-detected.nix") + [ + (modulesPath + "/installer/scan/not-detected.nix") ]; boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "nvme" "usbhid" "uas" "sd_mod" ]; @@ -14,13 +15,15 @@ boot.extraModulePackages = [ ]; fileSystems."/" = - { device = "/dev/disk/by-uuid/d4ac74f7-62bb-421a-aad8-566277c9d8ba"; + { + device = "/dev/disk/by-uuid/d4ac74f7-62bb-421a-aad8-566277c9d8ba"; fsType = "btrfs"; options = [ "subvol=@" ]; }; fileSystems."/boot" = - { device = "/dev/disk/by-uuid/1F51-B638"; + { + device = "/dev/disk/by-uuid/1F51-B638"; fsType = "vfat"; }; diff --git a/hosts/icdm-root/boot.nix b/hosts/icdm-root/boot.nix index 796db1b..f26b3c7 100644 --- a/hosts/icdm-root/boot.nix +++ b/hosts/icdm-root/boot.nix @@ -1,11 +1,11 @@ -{ pkgs, config, ...}: +{ pkgs, config, ... }: { - # Bootloader. - boot = { - loader.grub = { - enable = true; - device = "/dev/sda"; - }; - }; + # Bootloader. + boot = { + loader.grub = { + enable = true; + device = "/dev/sda"; + }; + }; } diff --git a/hosts/icdm-root/default.nix b/hosts/icdm-root/default.nix index 27aae2f..80b064a 100644 --- a/hosts/icdm-root/default.nix +++ b/hosts/icdm-root/default.nix @@ -5,20 +5,21 @@ { config, pkgs, agenix, ... }: { - imports = [ # Include the results of the hardware scan. - ./hardware-configuration.nix - ./boot.nix - ./filesystem.nix - ./location.nix - ./networking.nix - ./wiki.nix - ]; + imports = [ + # Include the results of the hardware scan. + ./hardware-configuration.nix + ./boot.nix + ./filesystem.nix + ./location.nix + ./networking.nix + ./wiki.nix + ]; - # Define a user account. Don't forget to set a password with ‘passwd’. - users.users.greg = { - isNormalUser = true; - description = "Gregory Hellings"; - extraGroups = [ "networkmanager" "wheel" ]; - packages = with pkgs; []; - }; + # Define a user account. Don't forget to set a password with ‘passwd’. + users.users.greg = { + isNormalUser = true; + description = "Gregory Hellings"; + extraGroups = [ "networkmanager" "wheel" ]; + packages = with pkgs; [ ]; + }; } diff --git a/hosts/icdm-root/filesystem.nix b/hosts/icdm-root/filesystem.nix index 25b6e9a..fd2169f 100644 --- a/hosts/icdm-root/filesystem.nix +++ b/hosts/icdm-root/filesystem.nix @@ -2,11 +2,11 @@ let in { - fileSystems."serve" = { - #device = "10.42.1.4:/volume1/icdm-mysql/"; - #fsType = "nfs"; - device = "/dev/sdb1"; - fsType = "auto"; - mountPoint = "/srv"; - }; + fileSystems."serve" = { + #device = "10.42.1.4:/volume1/icdm-mysql/"; + #fsType = "nfs"; + device = "/dev/sdb1"; + fsType = "auto"; + mountPoint = "/srv"; + }; } diff --git a/hosts/icdm-root/hardware-configuration.nix b/hosts/icdm-root/hardware-configuration.nix index 0919a73..14e988e 100644 --- a/hosts/icdm-root/hardware-configuration.nix +++ b/hosts/icdm-root/hardware-configuration.nix @@ -5,7 +5,8 @@ { imports = - [ (modulesPath + "/installer/scan/not-detected.nix") + [ + (modulesPath + "/installer/scan/not-detected.nix") ]; boot.initrd.availableKernelModules = [ "xhci_pci" "ehci_pci" "ahci" "usbhid" "usb_storage" "sd_mod" ]; @@ -14,24 +15,26 @@ boot.extraModulePackages = [ ]; fileSystems."/" = - { device = "/dev/disk/by-uuid/dab0d455-e25e-4445-8fa4-5320047d7e7b"; + { + device = "/dev/disk/by-uuid/dab0d455-e25e-4445-8fa4-5320047d7e7b"; fsType = "btrfs"; options = [ "subvol=@" ]; }; fileSystems."/boot" = - { device = "/dev/disk/by-uuid/5aedbb07-5761-423b-909d-2560405eae32"; + { + device = "/dev/disk/by-uuid/5aedbb07-5761-423b-909d-2560405eae32"; fsType = "ext4"; }; fileSystems."/var" = - { device = "/dev/disk/by-uuid/57968536-c29d-417d-997e-85223d1d1f65"; + { + device = "/dev/disk/by-uuid/57968536-c29d-417d-997e-85223d1d1f65"; fsType = "btrfs"; }; swapDevices = - [ { device = "/dev/disk/by-uuid/09691dce-375a-43c6-8d40-4498d20a6d9a"; } - ]; + [{ device = "/dev/disk/by-uuid/09691dce-375a-43c6-8d40-4498d20a6d9a"; }]; # Enables DHCP on each ethernet and wireless interface. In case of scripted networking # (the default) this is the recommended approach. When using systemd-networkd it's diff --git a/hosts/icdm-root/location.nix b/hosts/icdm-root/location.nix index 09339a4..079dfda 100644 --- a/hosts/icdm-root/location.nix +++ b/hosts/icdm-root/location.nix @@ -1,4 +1,4 @@ -{...}: +{ ... }: { # Set your time zone. diff --git a/hosts/icdm-root/networking.nix b/hosts/icdm-root/networking.nix index d3d8b16..c4c7037 100644 --- a/hosts/icdm-root/networking.nix +++ b/hosts/icdm-root/networking.nix @@ -1,58 +1,59 @@ -{...}: +{ ... }: let - dnsHosts = builtins.concatStringsSep "\n" [ - "wiki.icdm.lan 10.42.101.1" - ]; + dnsHosts = builtins.concatStringsSep "\n" [ + "wiki.icdm.lan 10.42.101.1" + ]; in { - # If we have to do proxying in Bayonnais, we can start to work on that here - # networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain"; - networking = { - hostName = "icdm-root"; - useDHCP = false; - defaultGateway = "10.42.1.1"; - nameservers = [ "100.100.100.100" "10.42.1.2" ]; - enableIPv6 = false; + # If we have to do proxying in Bayonnais, we can start to work on that here + # networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain"; + networking = { + hostName = "icdm-root"; + useDHCP = false; + defaultGateway = "10.42.1.1"; + nameservers = [ "100.100.100.100" "10.42.1.2" ]; + enableIPv6 = false; - interfaces = { - eno1.ipv4.addresses = [ { - address = "10.42.101.1"; - prefixLength = 16; - } { - address = "10.77.1.2"; - prefixLength = 16; - } ]; - }; - # Allow traffic through - firewall = { - enable = true; - allowedTCPPorts = [ 53 ]; - allowedUDPPorts = [ 53 67 ]; - }; + interfaces = { + eno1.ipv4.addresses = [{ + address = "10.42.101.1"; + prefixLength = 16; + } + { + address = "10.77.1.2"; + prefixLength = 16; + }]; + }; + # Allow traffic through + firewall = { + enable = true; + allowedTCPPorts = [ 53 ]; + allowedUDPPorts = [ 53 67 ]; + }; - extraHosts = "${dnsHosts}"; - }; + extraHosts = "${dnsHosts}"; + }; - services.dnsmasq = { - enable = true; - settings = { - domain = "icdm.lan"; - dhcp-range = [ - "eno1,10.77.1.10,10.77.1.255,255.255.0.0,12h" - ]; - dhcp-option = [ - "eno1,option:router,10.77.1.1" - "eno1,option:dns-server,10.77.1.2,1.1.1.1" - "eno1,option:domain-search,icdm.lan" - ]; - expand-hosts = true; - log-dhcp = true; - log-queries = true; - # Upstream servers - server = [ - "1.1.1.1" - "8.8.4.4" - ]; - }; - }; + services.dnsmasq = { + enable = true; + settings = { + domain = "icdm.lan"; + dhcp-range = [ + "eno1,10.77.1.10,10.77.1.255,255.255.0.0,12h" + ]; + dhcp-option = [ + "eno1,option:router,10.77.1.1" + "eno1,option:dns-server,10.77.1.2,1.1.1.1" + "eno1,option:domain-search,icdm.lan" + ]; + expand-hosts = true; + log-dhcp = true; + log-queries = true; + # Upstream servers + server = [ + "1.1.1.1" + "8.8.4.4" + ]; + }; + }; } diff --git a/hosts/icdm-root/wiki.nix b/hosts/icdm-root/wiki.nix index 46ab920..1a8601e 100644 --- a/hosts/icdm-root/wiki.nix +++ b/hosts/icdm-root/wiki.nix @@ -1,32 +1,32 @@ { pkgs, ... }: let - wikiPasswordFile = "/var/mediawiki/passwordFile"; - wikiHost = "wiki.icdm.lan"; - kiwixport = 8080; - dependents = with pkgs; [ - enwiki-dump - transmission - ]; + wikiPasswordFile = "/var/mediawiki/passwordFile"; + wikiHost = "wiki.icdm.lan"; + kiwixport = 8080; + dependents = with pkgs; [ + enwiki-dump + transmission + ]; in { - services.kiwix-serve = { - enable = true; - port = kiwixport; - path = "/srv/zims/*.zim"; - }; + services.kiwix-serve = { + enable = true; + port = kiwixport; + path = "/srv/zims/*.zim"; + }; - services.transmission = { - enable = true; - settings = { - download-dir = "/srv"; - incomplete-dir = "/srv/incomplete"; - rpc-bind-address = "0.0.0.0"; - rpc-whitelist = "10.42.*,127.*,localhost"; - }; - }; + services.transmission = { + enable = true; + settings = { + download-dir = "/srv"; + incomplete-dir = "/srv/incomplete"; + rpc-bind-address = "0.0.0.0"; + rpc-whitelist = "10.42.*,127.*,localhost"; + }; + }; - greg.proxies."${wikiHost}".target = "http://localhost:${toString kiwixport}"; - networking.firewall.allowedTCPPorts = [ 80 ]; + greg.proxies."${wikiHost}".target = "http://localhost:${toString kiwixport}"; + networking.firewall.allowedTCPPorts = [ 80 ]; - environment.systemPackages = dependents; + environment.systemPackages = dependents; } diff --git a/hosts/iso/default.nix b/hosts/iso/default.nix index 3ac6960..7108e93 100644 --- a/hosts/iso/default.nix +++ b/hosts/iso/default.nix @@ -1,15 +1,15 @@ { pkgs, lib, modulesPath, ... }: { - imports = [ - "${modulesPath}/installer/cd-dvd/installation-cd-graphical-calamares-gnome.nix" - "${modulesPath}/installer/cd-dvd/channel.nix" - ]; + imports = [ + "${modulesPath}/installer/cd-dvd/installation-cd-graphical-calamares-gnome.nix" + "${modulesPath}/installer/cd-dvd/channel.nix" + ]; - networking.networkmanager.enable = lib.mkForce false; - users.users.greg.initialPassword = ""; - #services.getty.autologinUser = lib.mkForce "greg"; - environment.systemPackages = with pkgs; [ - tree - ]; + networking.networkmanager.enable = lib.mkForce false; + users.users.greg.initialPassword = ""; + #services.getty.autologinUser = lib.mkForce "greg"; + environment.systemPackages = with pkgs; [ + tree + ]; } diff --git a/hosts/jeremiah/ceph.nix b/hosts/jeremiah/ceph.nix index 25a2276..185a03b 100644 --- a/hosts/jeremiah/ceph.nix +++ b/hosts/jeremiah/ceph.nix @@ -1,33 +1,34 @@ { config, ... }: let - publicIp = (builtins.elemAt config.networking.interfaces.enp68s0.ipv4.addresses 0).address; - sanIp = (builtins.elemAt config.networking.interfaces.enp67s0.ipv4.addresses 0).address; - vip = (builtins.elemAt config.networking.interfaces.enp68s0.ipv4.addresses 1).address; - hostname = config.networking.hostName; - baseConfig = import ../../ceph/home.nix; -in { - services.ceph-benaco = baseConfig // { - enable = false; - monitor = { - enable = false; - initialKeyring = ../../secrets/home.mon.keyring; - nodeName = hostname; - bindAddr = publicIp; - advertisedPublicAddr = vip; - }; - osdBindAddr = publicIp; - osdAdvertisedPublicAddr = publicIp; - osds = { - osd1 = { - enable = false; - bootstrapKeyring = ../../secrets/home.osd-bootstrap.keyring; - id = 1; - uuid = "c13bd2b1-cfc7-4966-8da5-d92356e87e06"; - blockDevice = "/dev/sda"; - blockDeviceUdevRuleMatcher = ''KERNEL=="sda"''; - clusterAddress = sanIp; - }; - }; - }; + publicIp = (builtins.elemAt config.networking.interfaces.enp68s0.ipv4.addresses 0).address; + sanIp = (builtins.elemAt config.networking.interfaces.enp67s0.ipv4.addresses 0).address; + vip = (builtins.elemAt config.networking.interfaces.enp68s0.ipv4.addresses 1).address; + hostname = config.networking.hostName; + baseConfig = import ../../ceph/home.nix; +in +{ + services.ceph-benaco = baseConfig // { + enable = false; + monitor = { + enable = false; + initialKeyring = ../../secrets/home.mon.keyring; + nodeName = hostname; + bindAddr = publicIp; + advertisedPublicAddr = vip; + }; + osdBindAddr = publicIp; + osdAdvertisedPublicAddr = publicIp; + osds = { + osd1 = { + enable = false; + bootstrapKeyring = ../../secrets/home.osd-bootstrap.keyring; + id = 1; + uuid = "c13bd2b1-cfc7-4966-8da5-d92356e87e06"; + blockDevice = "/dev/sda"; + blockDeviceUdevRuleMatcher = ''KERNEL=="sda"''; + clusterAddress = sanIp; + }; + }; + }; } diff --git a/hosts/jeremiah/default.nix b/hosts/jeremiah/default.nix index 7553178..4d6fd34 100644 --- a/hosts/jeremiah/default.nix +++ b/hosts/jeremiah/default.nix @@ -5,125 +5,127 @@ { config, pkgs, lib, ... }: { - imports = - [ # Include the results of the hardware scan. - ./ceph.nix - ./hardware-configuration.nix - ./minio.nix - ]; + imports = + [ + # Include the results of the hardware scan. + ./ceph.nix + ./hardware-configuration.nix + ./minio.nix + ]; - # Bootloader. - boot.loader.systemd-boot.enable = true; - boot.loader.efi.canTouchEfiVariables = true; + # Bootloader. + boot.loader.systemd-boot.enable = true; + boot.loader.efi.canTouchEfiVariables = true; - networking = { - hostName = "jeremiah"; # Define your hostname. - useDHCP = false; - defaultGateway = { - address = " 10.42.1.1"; - interface = "enp68s0"; - }; - vlans = { - san = { - id = 616; - interface = "enp67s0"; - }; - }; - interfaces = { - enp68s0 = { - ipv4.addresses = [ { - address = "10.42.1.8"; - prefixLength = 16; - } { - address = "10.42.100.1"; - prefixLength = 16; - } ]; - }; - san = { - ipv4.addresses = [ { - address = "10.201.1.2"; - prefixLength = 24; - } ]; - }; - }; - nameservers = [ - "10.42.1.5" - ]; - }; - greg = { - home = true; - tailscale.enable = true; - }; - environment.systemPackages = with pkgs; [ - curl - gawk - git - unzip - wget - ]; - - fileSystems = { - "/nix" = { - fsType = "btrfs"; - options = [ "subvol=nix" ]; - device = "/dev/nvme0n1p1"; - }; - "/var" = { - fsType = "btrfs"; - options = [ "subvol=var" ]; - device = "/dev/nvme0n1p1"; - }; - }; + networking = { + hostName = "jeremiah"; # Define your hostname. + useDHCP = false; + defaultGateway = { + address = " 10.42.1.1"; + interface = "enp68s0"; + }; + vlans = { + san = { + id = 616; + interface = "enp67s0"; + }; + }; + interfaces = { + enp68s0 = { + ipv4.addresses = [{ + address = "10.42.1.8"; + prefixLength = 16; + } + { + address = "10.42.100.1"; + prefixLength = 16; + }]; + }; + san = { + ipv4.addresses = [{ + address = "10.201.1.2"; + prefixLength = 24; + }]; + }; + }; + nameservers = [ + "10.42.1.5" + ]; + }; + greg = { + home = true; + tailscale.enable = true; + }; + environment.systemPackages = with pkgs; [ + curl + gawk + git + unzip + wget + ]; - ##################################################################################### - #################### Virtualbox Runner ############################################## - ##################################################################################### - services = { - gitlab-runner = { - enable = true; - settings.concurrent = 7; - services = { - shell = { - executor = "shell"; - limit = 5; - authenticationTokenConfigFile = config.age.secrets.runner-reg.path; - environmentVariables = { - EFI_DIR = "${pkgs.OVMF.fd}/FV/"; - STORAGE_URL = "http://s3.thehellings.lan:9000"; - }; - }; - }; - }; - }; - age.secrets.runner-reg.file = ../../secrets/gitlab/jeremiah-runner-reg.age; - virtualisation.virtualbox.host = { - enable = true; - enableExtensionPack = true; - enableHardening = false; - headless = true; - enableWebService = true; - }; + fileSystems = { + "/nix" = { + fsType = "btrfs"; + options = [ "subvol=nix" ]; + device = "/dev/nvme0n1p1"; + }; + "/var" = { + fsType = "btrfs"; + options = [ "subvol=var" ]; + device = "/dev/nvme0n1p1"; + }; + }; - systemd.services."gitlab-runner" = { - after = [ - "network.target" - "network-online.target" - "systemd-resolved.service" - ]; - wants = [ - "network-online.target" - "systemd-resolved.service" - ]; - preStart = builtins.concatStringsSep "\n" [ - "${pkgs.kmod}/bin/modprobe vboxdrv" - "${pkgs.kmod}/bin/modprobe vboxnetadp" - "${pkgs.kmod}/bin/modprobe vboxnetflt" - ]; - postStop = "${pkgs.kmod}/bin/rmmod vboxnetadp vboxnetflt vboxdrv"; - serviceConfig = { - DevicePolicy = lib.mkForce "auto"; - User = "root"; - DynamicUser = lib.mkForce false; - }; - }; + ##################################################################################### + #################### Virtualbox Runner ############################################## + ##################################################################################### + services = { + gitlab-runner = { + enable = true; + settings.concurrent = 7; + services = { + shell = { + executor = "shell"; + limit = 5; + authenticationTokenConfigFile = config.age.secrets.runner-reg.path; + environmentVariables = { + EFI_DIR = "${pkgs.OVMF.fd}/FV/"; + STORAGE_URL = "http://s3.thehellings.lan:9000"; + }; + }; + }; + }; + }; + age.secrets.runner-reg.file = ../../secrets/gitlab/jeremiah-runner-reg.age; + virtualisation.virtualbox.host = { + enable = true; + enableExtensionPack = true; + enableHardening = false; + headless = true; + enableWebService = true; + }; + + systemd.services."gitlab-runner" = { + after = [ + "network.target" + "network-online.target" + "systemd-resolved.service" + ]; + wants = [ + "network-online.target" + "systemd-resolved.service" + ]; + preStart = builtins.concatStringsSep "\n" [ + "${pkgs.kmod}/bin/modprobe vboxdrv" + "${pkgs.kmod}/bin/modprobe vboxnetadp" + "${pkgs.kmod}/bin/modprobe vboxnetflt" + ]; + postStop = "${pkgs.kmod}/bin/rmmod vboxnetadp vboxnetflt vboxdrv"; + serviceConfig = { + DevicePolicy = lib.mkForce "auto"; + User = "root"; + DynamicUser = lib.mkForce false; + }; + }; } diff --git a/hosts/jeremiah/hardware-configuration.nix b/hosts/jeremiah/hardware-configuration.nix index fcd7de1..d673caf 100644 --- a/hosts/jeremiah/hardware-configuration.nix +++ b/hosts/jeremiah/hardware-configuration.nix @@ -5,7 +5,8 @@ { imports = - [ (modulesPath + "/installer/scan/not-detected.nix") + [ + (modulesPath + "/installer/scan/not-detected.nix") ]; boot.initrd.availableKernelModules = [ "nvme" "xhci_pci" "ahci" "uas" "usbhid" "sd_mod" ]; @@ -14,12 +15,14 @@ boot.extraModulePackages = [ ]; fileSystems."/" = - { device = "/dev/disk/by-uuid/ffc167f5-d9e4-4b11-a5f1-f7da0550ad24"; + { + device = "/dev/disk/by-uuid/ffc167f5-d9e4-4b11-a5f1-f7da0550ad24"; fsType = "ext4"; }; fileSystems."/boot" = - { device = "/dev/disk/by-uuid/3047-870E"; + { + device = "/dev/disk/by-uuid/3047-870E"; fsType = "vfat"; }; diff --git a/hosts/jeremiah/minio.nix b/hosts/jeremiah/minio.nix index 522498f..4535021 100644 --- a/hosts/jeremiah/minio.nix +++ b/hosts/jeremiah/minio.nix @@ -1,32 +1,33 @@ { config, pkgs, ... }: let - minioPort = 9000; - minioConsolePort = 9001; -in { - environment.systemPackages = with pkgs; [ - minio-client - xfsprogs - ]; + minioPort = 9000; + minioConsolePort = 9001; +in +{ + environment.systemPackages = with pkgs; [ + minio-client + xfsprogs + ]; - greg.proxies."minio-02.thehellings.lan".target = "http://localhost:9000"; + greg.proxies."minio-02.thehellings.lan".target = "http://localhost:9000"; - fileSystems."/data/1" = { - device = "/dev/disk/by-id/ata-ST12000NM0558_ZHZ5YSXW-part1"; - fsType = "xfs"; - }; + fileSystems."/data/1" = { + device = "/dev/disk/by-id/ata-ST12000NM0558_ZHZ5YSXW-part1"; + fsType = "xfs"; + }; - networking.firewall.allowedTCPPorts = [ - minioPort - minioConsolePort - ]; + networking.firewall.allowedTCPPorts = [ + minioPort + minioConsolePort + ]; - age.secrets.minio.file = ../../secrets/minio.age; + age.secrets.minio.file = ../../secrets/minio.age; - services.minio = { - enable = true; - dataDir = [ "/data/1/minio" ]; - rootCredentialsFile = config.age.secrets.minio.path; - browser = true; - }; + services.minio = { + enable = true; + dataDir = [ "/data/1/minio" ]; + rootCredentialsFile = config.age.secrets.minio.path; + browser = true; + }; } diff --git a/hosts/jude/boot.nix b/hosts/jude/boot.nix index 1a1d0b9..a4136c7 100644 --- a/hosts/jude/boot.nix +++ b/hosts/jude/boot.nix @@ -1,50 +1,50 @@ { lib, pkgs, ... }: { - # Use the systemd-boot EFI boot loader. - boot = { - binfmt.emulatedSystems = [ "aarch64-linux" ]; - kernelPackages = pkgs.linuxPackages_latest; - supportedFilesystems = [ "ntfs" ]; - loader = { - timeout = 15; - systemd-boot = { - enable = true; - configurationLimit = 20; - extraEntries = { - "Windows.conf" = (lib.strings.concatStringsSep "\n" [ - "title Windows" - "efi /EFI/Microsoft/EFI/bootmgfw.efi" - ]); - "Win2.conf" = (lib.strings.concatStringsSep "\n" [ - "title Windows 11" - "efi /shellx64.efi" - "options -nointerrupt -noconsolein -noconsoleout windows11.nsh" - ]); - "Shell.conf" = (lib.strings.concatStringsSep "\n" [ - "title EFI Shell" - "efi /shell.efi" - ]); - }; - extraFiles = { - "windows11.nsh" = (pkgs.writeText "windows11.nsh" (lib.strings.concatStringsSep "\n" [ - ])); - "shell.efi" = "${pkgs.edk2-uefi-shell}/shell.efi"; - }; - }; - grub = { - enable = false; - device = "/dev/nvme0n1"; - useOSProber = true; - efiSupport = true; - extraEntries = '' - menuentry "Windows" --class windows --class os { - insmod ntfs - chainloader (hd0,0)/EFI/Windows/bootmgfw.efi - } - ''; - }; - #efi.canTouchEfiVariables = true; - }; - }; + # Use the systemd-boot EFI boot loader. + boot = { + binfmt.emulatedSystems = [ "aarch64-linux" ]; + kernelPackages = pkgs.linuxPackages_latest; + supportedFilesystems = [ "ntfs" ]; + loader = { + timeout = 15; + systemd-boot = { + enable = true; + configurationLimit = 20; + extraEntries = { + "Windows.conf" = (lib.strings.concatStringsSep "\n" [ + "title Windows" + "efi /EFI/Microsoft/EFI/bootmgfw.efi" + ]); + "Win2.conf" = (lib.strings.concatStringsSep "\n" [ + "title Windows 11" + "efi /shellx64.efi" + "options -nointerrupt -noconsolein -noconsoleout windows11.nsh" + ]); + "Shell.conf" = (lib.strings.concatStringsSep "\n" [ + "title EFI Shell" + "efi /shell.efi" + ]); + }; + extraFiles = { + "windows11.nsh" = (pkgs.writeText "windows11.nsh" (lib.strings.concatStringsSep "\n" [ + ])); + "shell.efi" = "${pkgs.edk2-uefi-shell}/shell.efi"; + }; + }; + grub = { + enable = false; + device = "/dev/nvme0n1"; + useOSProber = true; + efiSupport = true; + extraEntries = '' + menuentry "Windows" --class windows --class os { + insmod ntfs + chainloader (hd0,0)/EFI/Windows/bootmgfw.efi + } + ''; + }; + #efi.canTouchEfiVariables = true; + }; + }; } diff --git a/hosts/jude/default.nix b/hosts/jude/default.nix index ee05293..75d99a6 100644 --- a/hosts/jude/default.nix +++ b/hosts/jude/default.nix @@ -1,119 +1,120 @@ { pkgs, config, ... }: { - imports = [ - ./boot.nix - ./hardware-configuration.nix - ./podman.nix - ./virt.nix - ]; - programs = { - steam.enable = true; - nix-index = { - enable = true; - enableBashIntegration = false; - enableFishIntegration = false; - enableZshIntegration = false; - }; - nix-ld.enable = false; - }; + imports = [ + ./boot.nix + ./hardware-configuration.nix + ./podman.nix + ./virt.nix + ]; + programs = { + steam.enable = true; + nix-index = { + enable = true; + enableBashIntegration = false; + enableFishIntegration = false; + enableZshIntegration = false; + }; + nix-ld.enable = false; + }; - networking = { - hostName = "jude"; - enableIPv6 = false; - interfaces.enp12s0.useDHCP = true; - firewall = { - enable = false; - allowedTCPPorts = [ 21000 ]; - allowedUDPPorts = [ 21000 21010 ]; - }; - }; - greg = { - tailscale.enable = true; - sway.enable = false; - gnome.enable = true; - kde.enable = false; - print.enable = true; - }; + networking = { + hostName = "jude"; + enableIPv6 = false; + interfaces.enp12s0.useDHCP = true; + firewall = { + enable = false; + allowedTCPPorts = [ 21000 ]; + allowedUDPPorts = [ 21000 21010 ]; + }; + }; + greg = { + tailscale.enable = true; + sway.enable = false; + gnome.enable = true; + kde.enable = false; + print.enable = true; + }; - boot.extraModulePackages = [ config.boot.kernelPackages.v4l2loopback ]; + boot.extraModulePackages = [ config.boot.kernelPackages.v4l2loopback ]; - environment.systemPackages = with pkgs; lib.mkMerge [ - [ # for Immersed - cudatoolkit - immersed-vr - libva - ] - [ - bind # For things like nslookup - create_ssl - distrobox - expect - gimp - go - gparted - gnucash - graphviz - flock - ffmpeg - handbrake - imagemagick - libtheora - libxml2 - linode-cli - makemkv - oathToolkit - usbutils - vagrant - ventoy - ] + environment.systemPackages = with pkgs; lib.mkMerge [ + [ + # for Immersed + cudatoolkit + immersed-vr + libva + ] + [ + bind # For things like nslookup + create_ssl + distrobox + expect + gimp + go + gparted + gnucash + graphviz + flock + ffmpeg + handbrake + imagemagick + libtheora + libxml2 + linode-cli + makemkv + oathToolkit + usbutils + vagrant + ventoy + ] - [ - # Video/Audio data composition framework tools like "gst-inspect", "gst-launch" ... - gst_all_1.gstreamer - gst_all_1.gst-plugins-base - gst_all_1.gst-plugins-good - gst_all_1.gst-plugins-bad - gst_all_1.gst-plugins-ugly - gst_all_1.gst-libav - gst_all_1.gst-vaapi - ] - ]; - fileSystems = { - "/boot" = { - device = "/dev/nvme0n1p1"; - fsType = "auto"; - }; - "/windows" = { - device = "/dev/nvme0n1p5"; - fsType = "ntfs-3g"; - }; - "/windows11" = { - device = "/dev/nvme1n1p2"; - fsType = "ntfs-3g"; - }; - }; + [ + # Video/Audio data composition framework tools like "gst-inspect", "gst-launch" ... + gst_all_1.gstreamer + gst_all_1.gst-plugins-base + gst_all_1.gst-plugins-good + gst_all_1.gst-plugins-bad + gst_all_1.gst-plugins-ugly + gst_all_1.gst-libav + gst_all_1.gst-vaapi + ] + ]; + fileSystems = { + "/boot" = { + device = "/dev/nvme0n1p1"; + fsType = "auto"; + }; + "/windows" = { + device = "/dev/nvme0n1p5"; + fsType = "ntfs-3g"; + }; + "/windows11" = { + device = "/dev/nvme1n1p2"; + fsType = "ntfs-3g"; + }; + }; - # Let's do a sound thing - services = { - pipewire = { - enable = true; - alsa.enable = true; - audio.enable = true; - jack.enable = true; - pulse.enable = true; - wireplumber.enable = true; - }; - locate.enable = true; - xserver.videoDrivers = [ "nvidia" ]; - }; - hardware = { - nvidia = { - modesetting.enable = true; - nvidiaSettings = true; - open = true; - }; - pulseaudio.enable = false; # This conflicts with pipewire - system76.enableAll = true; - }; + # Let's do a sound thing + services = { + pipewire = { + enable = true; + alsa.enable = true; + audio.enable = true; + jack.enable = true; + pulse.enable = true; + wireplumber.enable = true; + }; + locate.enable = true; + xserver.videoDrivers = [ "nvidia" ]; + }; + hardware = { + nvidia = { + modesetting.enable = true; + nvidiaSettings = true; + open = true; + }; + pulseaudio.enable = false; # This conflicts with pipewire + system76.enableAll = true; + }; } diff --git a/hosts/jude/hardware-configuration.nix b/hosts/jude/hardware-configuration.nix index 5b54c4b..96b9a71 100644 --- a/hosts/jude/hardware-configuration.nix +++ b/hosts/jude/hardware-configuration.nix @@ -5,7 +5,8 @@ { imports = - [ (modulesPath + "/installer/scan/not-detected.nix") + [ + (modulesPath + "/installer/scan/not-detected.nix") ]; boot.initrd.availableKernelModules = [ "nvme" "xhci_pci" "ahci" "usbhid" "usb_storage" "sd_mod" ]; @@ -14,7 +15,8 @@ boot.extraModulePackages = [ ]; fileSystems."/" = - { #device = "/dev/disk/by-uuid/27ae91ed-32e9-411e-8227-0d99e360fbbf"; + { + #device = "/dev/disk/by-uuid/27ae91ed-32e9-411e-8227-0d99e360fbbf"; device = "/dev/nvme0n1p4"; fsType = "btrfs"; }; diff --git a/hosts/jude/podman.nix b/hosts/jude/podman.nix index 837ebf4..784b5fe 100644 --- a/hosts/jude/podman.nix +++ b/hosts/jude/podman.nix @@ -1,8 +1,8 @@ { ... }: { - virtualisation.podman = { - enable = true; - dockerCompat = true; - }; + virtualisation.podman = { + enable = true; + dockerCompat = true; + }; } diff --git a/hosts/jude/virt.nix b/hosts/jude/virt.nix index 4479188..57b4880 100644 --- a/hosts/jude/virt.nix +++ b/hosts/jude/virt.nix @@ -1,38 +1,38 @@ { pkgs, config, ... }: { - greg.vmdev.enable = true; + greg.vmdev.enable = true; - virtualisation = { - waydroid.enable = false; - lxd.enable = false; - }; + virtualisation = { + waydroid.enable = false; + lxd.enable = false; + }; - systemd.services = { - gitlab-runner = { - conflicts = [ "libvirtd.service" ]; - preStart = builtins.concatStringsSep "\n" [ - "${pkgs.kmod}/bin/modprobe vboxnetflt vboxdrv" - "${pkgs.kmod}/bin/modprobe vboxnetadp" - ]; - postStop = "${pkgs.kmod}/bin/rmmod vboxnetflt vboxnetadp vboxdrv"; - wantedBy = pkgs.lib.mkForce []; - serviceConfig.User = "root"; - }; - }; + systemd.services = { + gitlab-runner = { + conflicts = [ "libvirtd.service" ]; + preStart = builtins.concatStringsSep "\n" [ + "${pkgs.kmod}/bin/modprobe vboxnetflt vboxdrv" + "${pkgs.kmod}/bin/modprobe vboxnetadp" + ]; + postStop = "${pkgs.kmod}/bin/rmmod vboxnetflt vboxnetadp vboxdrv"; + wantedBy = pkgs.lib.mkForce [ ]; + serviceConfig.User = "root"; + }; + }; - age.secrets.runner-reg.file = ../../secrets/gitlab/myself-vbox-runner-reg.age; + age.secrets.runner-reg.file = ../../secrets/gitlab/myself-vbox-runner-reg.age; - services.gitlab-runner = { - enable = true; - settings.concurrent = 5; - services.vbox = { - executor = "shell"; - limit = 5; - authenticationTokenConfigFile = config.age.secrets.runner-reg.path; - environmentVariables = { - EFI_DIR = "${pkgs.OVMF.fd}/FV/"; - }; - }; - }; + services.gitlab-runner = { + enable = true; + settings.concurrent = 5; + services.vbox = { + executor = "shell"; + limit = 5; + authenticationTokenConfigFile = config.age.secrets.runner-reg.path; + environmentVariables = { + EFI_DIR = "${pkgs.OVMF.fd}/FV/"; + }; + }; + }; } diff --git a/hosts/linode/default.nix b/hosts/linode/default.nix index 9906df5..cd6205a 100644 --- a/hosts/linode/default.nix +++ b/hosts/linode/default.nix @@ -1,78 +1,79 @@ { pkgs, lib, config, ... }: { - imports = [ - ./git.nix - ./hardware-configuration.nix - ./podman.nix - ./matrix.nix - ./nextcloud.nix - ./nginx.nix - ./postgres.nix - ]; + imports = [ + ./git.nix + ./hardware-configuration.nix + ./podman.nix + ./matrix.nix + ./nextcloud.nix + ./nginx.nix + ./postgres.nix + ]; - greg = { - home = false; - linode.enable = true; - tailscale.enable = true; - }; + greg = { + home = false; + linode.enable = true; + tailscale.enable = true; + }; - programs.ssh.extraConfig = lib.strings.concatStringsSep "\n" [ - "Host chronicles.shire-zebra.ts.net" - " User backup" - " IdentityFile /etc/ssh/backup_ed25519" - " StrictHostKeyChecking no" - " UserKnownHostsFile /dev/null" - ]; + programs.ssh.extraConfig = lib.strings.concatStringsSep "\n" [ + "Host chronicles.shire-zebra.ts.net" + " User backup" + " IdentityFile /etc/ssh/backup_ed25519" + " StrictHostKeyChecking no" + " UserKnownHostsFile /dev/null" + ]; - networking = { - networkmanager.enable = lib.mkForce false; - hostName = "linode"; - domain = "thehellings.com"; - nameservers = [ - "100.88.91.27" - ]; - }; + networking = { + networkmanager.enable = lib.mkForce false; + hostName = "linode"; + domain = "thehellings.com"; + nameservers = [ + "100.88.91.27" + ]; + }; - age.secrets.runner-deployer = { - file = ../../secrets/gitlab/linode-deployer-runner-reg.age; - owner = "gitlab-runner"; - }; + age.secrets.runner-deployer = { + file = ../../secrets/gitlab/linode-deployer-runner-reg.age; + owner = "gitlab-runner"; + }; - services.gitlab-runner = { - enable = true; - services.deployer = { - executor = "shell"; - authenticationTokenConfigFile = config.age.secrets.runner-deployer.path; - }; - }; + services.gitlab-runner = { + enable = true; + services.deployer = { + executor = "shell"; + authenticationTokenConfigFile = config.age.secrets.runner-deployer.path; + }; + }; - users.users.gitlab-runner = { - isSystemUser = true; - group = "gitlab-runner"; - }; - users.groups.gitlab-runner = {}; + users.users.gitlab-runner = { + isSystemUser = true; + group = "gitlab-runner"; + }; + users.groups.gitlab-runner = { }; - systemd.services."gitlab-runner".serviceConfig = { - DynamicUser = lib.mkForce false; - User = "gitlab-runner"; - }; + systemd.services."gitlab-runner".serviceConfig = { + DynamicUser = lib.mkForce false; + User = "gitlab-runner"; + }; - security.sudo.extraRules = [{ - users = [ "gitlab-runner" ]; - commands = [{ - command = "/run/current-system/sw/bin/systemctl"; - options = [ "NOPASSWD" ]; - } { - command = "/run/current-system/sw/bin/podman"; - options = [ "NOPASSWD" ]; - }]; - }]; + security.sudo.extraRules = [{ + users = [ "gitlab-runner" ]; + commands = [{ + command = "/run/current-system/sw/bin/systemctl"; + options = [ "NOPASSWD" ]; + } + { + command = "/run/current-system/sw/bin/podman"; + options = [ "NOPASSWD" ]; + }]; + }]; - environment.systemPackages = with pkgs; [ - bind - graphviz - nix-du - pgloader - ]; + environment.systemPackages = with pkgs; [ + bind + graphviz + nix-du + pgloader + ]; } diff --git a/hosts/linode/git.nix b/hosts/linode/git.nix index d393ac3..ab7341e 100644 --- a/hosts/linode/git.nix +++ b/hosts/linode/git.nix @@ -1,44 +1,45 @@ { config, pkgs, ... }: let - srcDomain = "src.thehellings.com"; - sshPort = 2222; -in { - greg.proxies."${srcDomain}" = { - target = "http://git.thehellings.lan"; - ssl = true; - genAliases = false; - extraConfig = '' - proxy_set_header X-Forwarded-Proto https; - proxy_set_header X-Forwarded-Ssl on; - ''; - }; - greg.proxies."registry.thehellings.com" = { - target = "https://registry.thehellings.lan:5000"; - ssl = true; - genAliases = false; - extraConfig = "client_max_body_size 250m;"; - }; + srcDomain = "src.thehellings.com"; + sshPort = 2222; +in +{ + greg.proxies."${srcDomain}" = { + target = "http://git.thehellings.lan"; + ssl = true; + genAliases = false; + extraConfig = '' + proxy_set_header X-Forwarded-Proto https; + proxy_set_header X-Forwarded-Ssl on; + ''; + }; + greg.proxies."registry.thehellings.com" = { + target = "https://registry.thehellings.lan:5000"; + ssl = true; + genAliases = false; + extraConfig = "client_max_body_size 250m;"; + }; - networking.firewall.allowedTCPPorts = [ sshPort ]; + networking.firewall.allowedTCPPorts = [ sshPort ]; - services.haproxy = { - enable = true; - config = builtins.concatStringsSep "\n" [ - "global" - " daemon" - " maxconn 20" - - "defaults" - " timeout connect 500s" - " timeout client 500s" - " timeout server 1h" + services.haproxy = { + enable = true; + config = builtins.concatStringsSep "\n" [ + "global" + " daemon" + " maxconn 20" - "listen gitsshd" - " bind *:${toString sshPort}" - " timeout client 1h" - " mode tcp" - " server git-thehellings-lan git.thehellings.lan:22" - ]; - }; + "defaults" + " timeout connect 500s" + " timeout client 500s" + " timeout server 1h" + + "listen gitsshd" + " bind *:${toString sshPort}" + " timeout client 1h" + " mode tcp" + " server git-thehellings-lan git.thehellings.lan:22" + ]; + }; } diff --git a/hosts/linode/matrix.nix b/hosts/linode/matrix.nix index 81b26eb..2a991c7 100644 --- a/hosts/linode/matrix.nix +++ b/hosts/linode/matrix.nix @@ -4,59 +4,61 @@ # register_new_matrix_user -k "B9EoPr2WV9hzwc7uL2Sx1JmvCeKDEOGCpB0uginQcQtEH4wzRtkSIdo7lltrjSQa" http://localhost:8448 { config, pkgs, ... }: let - domain = "${config.networking.domain}"; - fqdn = "matrix.${domain}"; - conn = "postgresql:///dendrite?sslmode=disable&host=/run/postgresql"; + domain = "${config.networking.domain}"; + fqdn = "matrix.${domain}"; + conn = "postgresql:///dendrite?sslmode=disable&host=/run/postgresql"; in { - services.nginx = { - virtualHosts = { - # Server the '.well-known' files to find the Matrix API server - "${domain}" = { - enableACME = true; - forceSSL = true; + services.nginx = { + virtualHosts = { + # Server the '.well-known' files to find the Matrix API server + "${domain}" = { + enableACME = true; + forceSSL = true; - # This is needed so that servers contacting hellings.com can find - # the actual application server at matrix.thehellings.com - locations."= /.well-known/matrix/server".extraConfig = - let - server = { "m.server" = "${fqdn}:443"; }; - in '' -add_header Content-Type application/json; -return 200 '${builtins.toJSON server}'; -''; + # This is needed so that servers contacting hellings.com can find + # the actual application server at matrix.thehellings.com + locations."= /.well-known/matrix/server".extraConfig = + let + server = { "m.server" = "${fqdn}:443"; }; + in + '' + add_header Content-Type application/json; + return 200 '${builtins.toJSON server}'; + ''; - locations."= /.well-known/matrix/client".extraConfig = - let - client = { - "m.homeserver" = { "base_url" = "https://${fqdn}"; }; - "m.identity_server" = { "base_url" = "https://vector.im"; }; - }; - in '' -add_header Content-Type application/json; -add_header Access-Control-Allow-Origin *; -return 200 '${builtins.toJSON client}'; -''; - }; + locations."= /.well-known/matrix/client".extraConfig = + let + client = { + "m.homeserver" = { "base_url" = "https://${fqdn}"; }; + "m.identity_server" = { "base_url" = "https://vector.im"; }; + }; + in + '' + add_header Content-Type application/json; + add_header Access-Control-Allow-Origin *; + return 200 '${builtins.toJSON client}'; + ''; + }; - # Reverse proxy in front of the actual Matrix server - "${fqdn}" = { - enableACME = true; - forceSSL = true; + # Reverse proxy in front of the actual Matrix server + "${fqdn}" = { + enableACME = true; + forceSSL = true; - # Not the appropriate place for the chat client - locations."/".extraConfig = "return 404;"; + # Not the appropriate place for the chat client + locations."/".extraConfig = "return 404;"; - locations."/_matrix" = { - proxyPass = "http://matrix.shire-zebra.ts.net:8448"; # Lacking the trailing / is correct - }; - }; - }; - }; + locations."/_matrix" = { + proxyPass = "http://matrix.shire-zebra.ts.net:8448"; # Lacking the trailing / is correct + }; + }; + }; + }; - # Open networking ports for the server - networking.firewall = { - enable = true; - allowedTCPPorts = [ 80 443 ]; - }; + # Open networking ports for the server + networking.firewall = { + enable = true; + allowedTCPPorts = [ 80 443 ]; + }; } diff --git a/hosts/linode/nextcloud.nix b/hosts/linode/nextcloud.nix index f267d7b..9afc297 100644 --- a/hosts/linode/nextcloud.nix +++ b/hosts/linode/nextcloud.nix @@ -1,38 +1,38 @@ { config, pkgs, ... }: { - age.secrets.nextcloudadmin.file = ../../secrets/nextcloudadmin.age; - age.secrets.nextcloudadmin.owner = "nextcloud"; + age.secrets.nextcloudadmin.file = ../../secrets/nextcloudadmin.age; + age.secrets.nextcloudadmin.owner = "nextcloud"; - services.nextcloud = { - enable = true; - package = pkgs.nextcloud29; - appstoreEnable = true; - hostName = "next.${config.networking.domain}"; - https = true; - config = { - adminpassFile = config.age.secrets.nextcloudadmin.path; - adminuser = "greg"; - dbhost = "/run/postgresql"; - dbtype = "pgsql"; - }; - settings = { - default_phone_region = "US"; - overwriteprotocol = "https"; - }; - }; + services.nextcloud = { + enable = true; + package = pkgs.nextcloud29; + appstoreEnable = true; + hostName = "next.${config.networking.domain}"; + https = true; + config = { + adminpassFile = config.age.secrets.nextcloudadmin.path; + adminuser = "greg"; + dbhost = "/run/postgresql"; + dbtype = "pgsql"; + }; + settings = { + default_phone_region = "US"; + overwriteprotocol = "https"; + }; + }; - services.nginx.virtualHosts."next.thehellings.com" = { - forceSSL = true; - enableACME = true; - }; + services.nginx.virtualHosts."next.thehellings.com" = { + forceSSL = true; + enableACME = true; + }; - # Otherwise nginx errors looking for the nextcloud sock file - systemd.services.nginx.after = [ "nextcloud.service" ]; + # Otherwise nginx errors looking for the nextcloud sock file + systemd.services.nginx.after = [ "nextcloud.service" ]; - greg.backup.jobs.nextcloud-bkup = { - src = "/var/lib/nextcloud"; - dest = "nextcloud-backup"; - id = "rbfco-rvmis"; - }; + greg.backup.jobs.nextcloud-bkup = { + src = "/var/lib/nextcloud"; + dest = "nextcloud-backup"; + id = "rbfco-rvmis"; + }; } diff --git a/hosts/linode/nginx.nix b/hosts/linode/nginx.nix index 2f46ce3..561d9e9 100644 --- a/hosts/linode/nginx.nix +++ b/hosts/linode/nginx.nix @@ -1,36 +1,36 @@ { ... }: let - homepage = "127.0.0.1:30080"; + homepage = "127.0.0.1:30080"; in { - security.acme = { - acceptTerms = true; - defaults.email = "greg.hellings@gmail.com"; - }; + security.acme = { + acceptTerms = true; + defaults.email = "greg.hellings@gmail.com"; + }; - services.nginx = { - enable = true; + services.nginx = { + enable = true; - # If there are recommended settings, let's use them! - recommendedGzipSettings = true; - recommendedOptimisation = true; - recommendedProxySettings = true; - recommendedTlsSettings = true; - }; + # If there are recommended settings, let's use them! + recommendedGzipSettings = true; + recommendedOptimisation = true; + recommendedProxySettings = true; + recommendedTlsSettings = true; + }; - # Actually serve the content from here - virtualisation.podman.enable = true; - virtualisation.oci-containers = { - backend = "podman"; - containers."homepage" = { - # needs explicit port to match what gitlab-runner sees when pulling - image = "registry.thehellings.com:443/greg/homepage/gregs-homepage:latest"; - ports = [ "${homepage}:80" ]; - }; - }; - greg.proxies."thehellings.com" = { - target = "http://${homepage}/"; - ssl = true; - genAliases = false; - }; + # Actually serve the content from here + virtualisation.podman.enable = true; + virtualisation.oci-containers = { + backend = "podman"; + containers."homepage" = { + # needs explicit port to match what gitlab-runner sees when pulling + image = "registry.thehellings.com:443/greg/homepage/gregs-homepage:latest"; + ports = [ "${homepage}:80" ]; + }; + }; + greg.proxies."thehellings.com" = { + target = "http://${homepage}/"; + ssl = true; + genAliases = false; + }; } diff --git a/hosts/linode/podman.nix b/hosts/linode/podman.nix index 97ba29d..99b3b29 100644 --- a/hosts/linode/podman.nix +++ b/hosts/linode/podman.nix @@ -1,9 +1,9 @@ { ... }: { - virtualisation.podman = { - enable = true; - dockerCompat = true; - dockerSocket.enable = true; - }; + virtualisation.podman = { + enable = true; + dockerCompat = true; + dockerSocket.enable = true; + }; } diff --git a/hosts/linode/postgres.nix b/hosts/linode/postgres.nix index 8172ddd..5977235 100644 --- a/hosts/linode/postgres.nix +++ b/hosts/linode/postgres.nix @@ -1,63 +1,63 @@ { config, pkgs, lib, ... }: { - environment.systemPackages = [ - pkgs.upgrade-pg-cluster - ]; + environment.systemPackages = [ + pkgs.upgrade-pg-cluster + ]; - services.postgresql = { - enable = true; - package = pkgs.postgresql_15; - checkConfig = true; - ensureDatabases = [ - "nextcloud" - ]; - #initialScript = pkgs.writeText "create-matrix-db.sql" '' - # CREATE ROLE "matrix-synapse" WITH LOGIN; - # CREATE DATABASE "synapse" WITH OWNER "matrix-synapse" TEMPLATE template0 LC_COLLATE = "C" LC_CTYPE = "C"; - # GRANT ALL PRIVILEGES ON DATABASE "synapse" TO "matrix-synapse"; - #''; # These are done manually in order to set the LC_COLLATE values properly - ensureUsers = [ { - name = "nextcloud"; - ensureDBOwnership = true; - } ]; - settings = { - log_connections = true; - log_statement = "all"; - logging_collector = true; - log_filename = "postgresql.log"; - }; - identMap = '' -root root postgres -''; - }; + services.postgresql = { + enable = true; + package = pkgs.postgresql_15; + checkConfig = true; + ensureDatabases = [ + "nextcloud" + ]; + #initialScript = pkgs.writeText "create-matrix-db.sql" '' + # CREATE ROLE "matrix-synapse" WITH LOGIN; + # CREATE DATABASE "synapse" WITH OWNER "matrix-synapse" TEMPLATE template0 LC_COLLATE = "C" LC_CTYPE = "C"; + # GRANT ALL PRIVILEGES ON DATABASE "synapse" TO "matrix-synapse"; + #''; # These are done manually in order to set the LC_COLLATE values properly + ensureUsers = [{ + name = "nextcloud"; + ensureDBOwnership = true; + }]; + settings = { + log_connections = true; + log_statement = "all"; + logging_collector = true; + log_filename = "postgresql.log"; + }; + identMap = '' + root root postgres + ''; + }; - services.postgresqlBackup = { - enable = true; - databases = [ - "nextcloud" - ]; - }; + services.postgresqlBackup = { + enable = true; + databases = [ + "nextcloud" + ]; + }; - services.logrotate = { - enable = true; - settings = { - postgresBackup = { - enable = true; - files = "${config.services.postgresqlBackup.location}/*.gz"; - }; - postgresLog = { - enable = true; - files = "/var/lib/postgresql/*/log/*.log"; - compress = true; - compresscmd = "${pkgs.xz}/bin/xz"; - }; - }; - }; + services.logrotate = { + enable = true; + settings = { + postgresBackup = { + enable = true; + files = "${config.services.postgresqlBackup.location}/*.gz"; + }; + postgresLog = { + enable = true; + files = "/var/lib/postgresql/*/log/*.log"; + compress = true; + compresscmd = "${pkgs.xz}/bin/xz"; + }; + }; + }; - greg.backup.jobs.greg-postgresql-backup = { - src = config.services.postgresqlBackup.location; - dest = "linode-postgres"; - id = "9pwvg-s257a"; - }; + greg.backup.jobs.greg-postgresql-backup = { + src = config.services.postgresqlBackup.location; + dest = "linode-postgres"; + id = "9pwvg-s257a"; + }; } diff --git a/hosts/myself/ceph.nix b/hosts/myself/ceph.nix index f57aa3e..695b109 100644 --- a/hosts/myself/ceph.nix +++ b/hosts/myself/ceph.nix @@ -1,33 +1,34 @@ { config, ... }: let - publicIp = (builtins.elemAt config.networking.interfaces.enp38s0.ipv4.addresses 0).address; - sanIp = (builtins.elemAt config.networking.interfaces.enp39s0.ipv4.addresses 0).address; - vip = (builtins.elemAt config.networking.interfaces.enp38s0.ipv4.addresses 1).address; - hostname = config.networking.hostName; - baseConfig = import ../../ceph/home.nix; -in { - services.ceph-benaco = baseConfig // { - enable = false; - monitor = { - enable = false; - initialKeyring = ../../secrets/home.mon.keyring; - nodeName = hostname; - bindAddr = publicIp; - advertisedPublicAddr = vip; - }; - osdBindAddr = publicIp; - osdAdvertisedPublicAddr = publicIp; - osds = { - osd1 = { - enable = false; - bootstrapKeyring = ../../secrets/home.osd-bootstrap.keyring; - id = 2; - uuid = "73424b68-210b-415f-800f-8767babea625"; - blockDevice = "/dev/disk/by-id/ata-ST12000NM0558_ZHZ5WM4L"; - blockDeviceUdevRuleMatcher = ''KERNEL=="sdb"''; - clusterAddress = sanIp; - }; - }; - }; + publicIp = (builtins.elemAt config.networking.interfaces.enp38s0.ipv4.addresses 0).address; + sanIp = (builtins.elemAt config.networking.interfaces.enp39s0.ipv4.addresses 0).address; + vip = (builtins.elemAt config.networking.interfaces.enp38s0.ipv4.addresses 1).address; + hostname = config.networking.hostName; + baseConfig = import ../../ceph/home.nix; +in +{ + services.ceph-benaco = baseConfig // { + enable = false; + monitor = { + enable = false; + initialKeyring = ../../secrets/home.mon.keyring; + nodeName = hostname; + bindAddr = publicIp; + advertisedPublicAddr = vip; + }; + osdBindAddr = publicIp; + osdAdvertisedPublicAddr = publicIp; + osds = { + osd1 = { + enable = false; + bootstrapKeyring = ../../secrets/home.osd-bootstrap.keyring; + id = 2; + uuid = "73424b68-210b-415f-800f-8767babea625"; + blockDevice = "/dev/disk/by-id/ata-ST12000NM0558_ZHZ5WM4L"; + blockDeviceUdevRuleMatcher = ''KERNEL=="sdb"''; + clusterAddress = sanIp; + }; + }; + }; } diff --git a/hosts/myself/container-git.nix b/hosts/myself/container-git.nix index c6c0014..42f03ac 100644 --- a/hosts/myself/container-git.nix +++ b/hosts/myself/container-git.nix @@ -1,195 +1,201 @@ -{ config, pkgs, lib, ... }: let - registryPort = 5000; - vpnIp = "100.78.226.76"; - containerIp = "192.168.200.2"; -in { - age.secretsMountPoint = "/run/derp"; - age.secrets = let - cfg = n: { file = ../../secrets/gitlab/${n}.age; owner = "gitlab"; group = "gitlab"; mode = "0444"; }; - in { - gitlab-secret = cfg "secret"; - gitlab-otp = cfg "otp"; - gitlab-db = cfg "db"; - gitlab-jws = cfg "jws"; - gitlab-key = cfg "key"; - gitlab-cert = cfg "cert"; +{ config, pkgs, lib, ... }: +let + registryPort = 5000; + vpnIp = "100.78.226.76"; + containerIp = "192.168.200.2"; +in +{ + age.secretsMountPoint = "/run/derp"; + age.secrets = + let + cfg = n: { file = ../../secrets/gitlab/${n}.age; owner = "gitlab"; group = "gitlab"; mode = "0444"; }; + in + { + gitlab-secret = cfg "secret"; + gitlab-otp = cfg "otp"; + gitlab-db = cfg "db"; + gitlab-jws = cfg "jws"; + gitlab-key = cfg "key"; + gitlab-cert = cfg "cert"; - minio_access_key_id = { - file = ../../secrets/minio_access_key_id.age; - owner = "gitlab"; - group = "gitlab"; - mode = "0444"; - }; - minio_secret_access_key = { - file = ../../secrets/minio_secret_access_key.age; - owner = "gitlab"; - group = "gitlab"; - mode = "0444"; - }; - }; + minio_access_key_id = { + file = ../../secrets/minio_access_key_id.age; + owner = "gitlab"; + group = "gitlab"; + mode = "0444"; + }; + minio_secret_access_key = { + file = ../../secrets/minio_secret_access_key.age; + owner = "gitlab"; + group = "gitlab"; + mode = "0444"; + }; + }; - networking.firewall.allowedTCPPorts = [ 80 registryPort ]; + networking.firewall.allowedTCPPorts = [ 80 registryPort ]; - greg.proxies = let - t = { - target = "http://unix:/run/gitlab/gitlab-workhorse.socket"; - extraConfig = '' - proxy_set_header X-Forwarded-Proto https; - proxy_set_header X-Forwarded-Ssl on; - ''; - }; - in { - "${containerIp}" = t; - "${vpnIp}" = t; - "git.thehellings.lan" = t; - }; + greg.proxies = + let + t = { + target = "http://unix:/run/gitlab/gitlab-workhorse.socket"; + extraConfig = '' + proxy_set_header X-Forwarded-Proto https; + proxy_set_header X-Forwarded-Ssl on; + ''; + }; + in + { + "${containerIp}" = t; + "${vpnIp}" = t; + "git.thehellings.lan" = t; + }; - virtualisation.docker.enable = true; + virtualisation.docker.enable = true; - programs.ssh.extraConfig = lib.strings.concatStringsSep "\n" [ - "Host nas" - " User backup" - " IdentityFile /etc/ssh/duplicity_ed25519" - " StrictHostKeyChecking no" - " UserKnownHostsFile /dev/null" - ]; + programs.ssh.extraConfig = lib.strings.concatStringsSep "\n" [ + "Host nas" + " User backup" + " IdentityFile /etc/ssh/duplicity_ed25519" + " StrictHostKeyChecking no" + " UserKnownHostsFile /dev/null" + ]; - greg.backup.jobs.nas-backup = { - src = "/var/gitlab/state/backup/"; - dest = "gitlab"; - id = "yha^-s45h"; - }; + greg.backup.jobs.nas-backup = { + src = "/var/gitlab/state/backup/"; + dest = "gitlab"; + id = "yha^-s45h"; + }; - services = { - gitlab = { - enable = true; - backup = { - keepTime = 288; - startAt = [ "03:00" ]; - }; - host = "src.thehellings.com"; - https = true; - port = 443; - extraConfig = { - gitlab = { - trustedProxies = [ "100.109.86.8/32" ]; - }; - }; - initialRootEmail = "greg@thehellings.com"; - initialRootPasswordFile = pkgs.writeText "initialRootPassword" "root_password"; - pages = { - enable = true; - settings.pages-domain = "pages.thehellings.com"; - }; - puma = { - threadsMax = 6; - threadsMin = 2; - workers = 6; - }; - redisUrl = "unix:${config.services.redis.servers.gitlab.unixSocket}"; - registry = { - enable = true; - certFile = config.age.secrets.gitlab-cert.path; - keyFile = config.age.secrets.gitlab-key.path; - externalAddress = "registry.thehellings.com"; - externalPort = 443; - }; - secrets = { - secretFile = config.age.secrets.gitlab-secret.path; - otpFile = config.age.secrets.gitlab-otp.path; - dbFile = config.age.secrets.gitlab-db.path; - jwsFile = config.age.secrets.gitlab-jws.path; - }; + services = { + gitlab = { + enable = true; + backup = { + keepTime = 288; + startAt = [ "03:00" ]; + }; + host = "src.thehellings.com"; + https = true; + port = 443; + extraConfig = { + gitlab = { + trustedProxies = [ "100.109.86.8/32" ]; + }; + }; + initialRootEmail = "greg@thehellings.com"; + initialRootPasswordFile = pkgs.writeText "initialRootPassword" "root_password"; + pages = { + enable = true; + settings.pages-domain = "pages.thehellings.com"; + }; + puma = { + threadsMax = 6; + threadsMin = 2; + workers = 6; + }; + redisUrl = "unix:${config.services.redis.servers.gitlab.unixSocket}"; + registry = { + enable = true; + certFile = config.age.secrets.gitlab-cert.path; + keyFile = config.age.secrets.gitlab-key.path; + externalAddress = "registry.thehellings.com"; + externalPort = 443; + }; + secrets = { + secretFile = config.age.secrets.gitlab-secret.path; + otpFile = config.age.secrets.gitlab-otp.path; + dbFile = config.age.secrets.gitlab-db.path; + jwsFile = config.age.secrets.gitlab-jws.path; + }; - extraConfig = { - object_store = { - enabled = true; - proxy_download = false; # Tell them to reach out to object storage themselves! - connection = { - provider = "AWS"; - endpoint = "http://s3.thehellings.lan:9000"; - region = "us-east-1"; - aws_access_key_id = { _secret = config.age.secrets.minio_access_key_id.path; }; - aws_secret_access_key = { _secret = config.age.secrets.minio_secret_access_key.path; }; - path_style = true; # True for MinIO - aws_signature_version = 2; - }; - #storage_options = ...; - objects = builtins.listToAttrs ( builtins.map (x: lib.attrsets.nameValuePair x { bucket = "gitlab-${builtins.replaceStrings [ "_" ] [ "-" ] x}"; }) [ - "artifacts" - "ci_secure_files" - "dependency_proxy" - "external_diffs" - "lfs" - "packages" - "pages" - "terraform_state" - "uploads" - ]); - }; - }; - }; + extraConfig = { + object_store = { + enabled = true; + proxy_download = false; # Tell them to reach out to object storage themselves! + connection = { + provider = "AWS"; + endpoint = "http://s3.thehellings.lan:9000"; + region = "us-east-1"; + aws_access_key_id = { _secret = config.age.secrets.minio_access_key_id.path; }; + aws_secret_access_key = { _secret = config.age.secrets.minio_secret_access_key.path; }; + path_style = true; # True for MinIO + aws_signature_version = 2; + }; + #storage_options = ...; + objects = builtins.listToAttrs (builtins.map (x: lib.attrsets.nameValuePair x { bucket = "gitlab-${builtins.replaceStrings [ "_" ] [ "-" ] x}"; }) [ + "artifacts" + "ci_secure_files" + "dependency_proxy" + "external_diffs" + "lfs" + "packages" + "pages" + "terraform_state" + "uploads" + ]); + }; + }; + }; - nginx.virtualHosts."gitlab.shire-zebra.ts.net" = { - listen = [ { - addr = vpnIp; - port = registryPort; - ssl = true; - } ]; - locations."/" = { - proxyPass = "http://127.0.0.1:5000/"; - recommendedProxySettings = true; - }; - extraConfig = builtins.concatStringsSep "\n" [ - "ssl_certificate /etc/certs/gitlab.shire-zebra.ts.net.crt ;" - "ssl_certificate_key /etc/certs/gitlab.shire-zebra.ts.net.key ;" - "client_max_body_size 250m;" - ]; - }; + nginx.virtualHosts."gitlab.shire-zebra.ts.net" = { + listen = [{ + addr = vpnIp; + port = registryPort; + ssl = true; + }]; + locations."/" = { + proxyPass = "http://127.0.0.1:5000/"; + recommendedProxySettings = true; + }; + extraConfig = builtins.concatStringsSep "\n" [ + "ssl_certificate /etc/certs/gitlab.shire-zebra.ts.net.crt ;" + "ssl_certificate_key /etc/certs/gitlab.shire-zebra.ts.net.key ;" + "client_max_body_size 250m;" + ]; + }; - # Fetch the SSL certificates for nginx to use - cron = { - enable = true; - systemCronJobs = [ "0 0 1 */2 * cd /etc/certs && tailscale cert gitlab.shire-zebra.ts.net && chown nginx * && systemctl reload nginx" ]; - }; + # Fetch the SSL certificates for nginx to use + cron = { + enable = true; + systemCronJobs = [ "0 0 1 */2 * cd /etc/certs && tailscale cert gitlab.shire-zebra.ts.net && chown nginx * && systemctl reload nginx" ]; + }; - postgresql = { - enable = true; - checkConfig = true; - ensureDatabases = [ "gitlab" ]; - ensureUsers = [ { - name = "gitlab"; - ensureDBOwnership = true; - } ]; - settings = { - log_connections = true; - log_statement = "all"; - logging_collector = true; - log_filename = "postgresql.log"; - }; - }; + postgresql = { + enable = true; + checkConfig = true; + ensureDatabases = [ "gitlab" ]; + ensureUsers = [{ + name = "gitlab"; + ensureDBOwnership = true; + }]; + settings = { + log_connections = true; + log_statement = "all"; + logging_collector = true; + log_filename = "postgresql.log"; + }; + }; - redis.servers.gitlab = { - enable = true; - }; - resolved.enable = true; - openssh.enable = true; - }; + redis.servers.gitlab = { + enable = true; + }; + resolved.enable = true; + openssh.enable = true; + }; - # Do not start nginx until we have tailscaled up and running, so it can bind - # to the 100.* addresses - systemd.services = { - nginx = rec { - after = [ - "network-online.target" - ]; - wants = after; - serviceConfig = { - RestartMaxDelaySec = "30s"; - RestartSteps = "5"; - }; - }; - tailscaled.partOf = [ "network-online.target" ]; - }; - system.stateVersion = lib.mkForce "24.05"; + # Do not start nginx until we have tailscaled up and running, so it can bind + # to the 100.* addresses + systemd.services = { + nginx = rec { + after = [ + "network-online.target" + ]; + wants = after; + serviceConfig = { + RestartMaxDelaySec = "30s"; + RestartSteps = "5"; + }; + }; + tailscaled.partOf = [ "network-online.target" ]; + }; + system.stateVersion = lib.mkForce "24.05"; } diff --git a/hosts/myself/container-runner.nix b/hosts/myself/container-runner.nix index cad42cb..df12891 100644 --- a/hosts/myself/container-runner.nix +++ b/hosts/myself/container-runner.nix @@ -1,91 +1,92 @@ -{ inputs, name, extra ? {}, packages ? [], overlays }: +{ inputs, name, extra ? { }, packages ? [ ], overlays }: ({ config, pkgs, lib, ... }: ( -lib.attrsets.recursiveUpdate { + lib.attrsets.recursiveUpdate + { - imports = [ - inputs.agenix.nixosModules.default - inputs.self.modules.nixosModule - ]; + imports = [ + inputs.agenix.nixosModules.default + inputs.self.modules.nixosModule + ]; - nixpkgs.overlays = overlays; + nixpkgs.overlays = overlays; - greg.tailscale.enable = true; + greg.tailscale.enable = true; - age = { - identityPaths = [ "/etc/ssh/ssh_host_ed25519_key" ]; - secrets.runner-reg = { - file = ../../secrets/gitlab/myself-${name}-runner-reg.age; - owner = "gitlab-runner"; - }; - }; + age = { + identityPaths = [ "/etc/ssh/ssh_host_ed25519_key" ]; + secrets.runner-reg = { + file = ../../secrets/gitlab/myself-${name}-runner-reg.age; + owner = "gitlab-runner"; + }; + }; - environment.systemPackages = with pkgs; [ - curl - gawk - git - unzip - xorriso - wget - ] ++ packages; + environment.systemPackages = with pkgs; [ + curl + gawk + git + unzip + xorriso + wget + ] ++ packages; - networking = { - useHostResolvConf = pkgs.lib.mkForce false; - nameservers = [ "100.100.100.100" ]; - }; + networking = { + useHostResolvConf = pkgs.lib.mkForce false; + nameservers = [ "100.100.100.100" ]; + }; - nixpkgs.config.allowUnfree = true; + nixpkgs.config.allowUnfree = true; - users.users.gitlab-runner = { - isSystemUser = true; - group = "kvm"; - extraGroups = [ "kvm" ]; - }; + users.users.gitlab-runner = { + isSystemUser = true; + group = "kvm"; + extraGroups = [ "kvm" ]; + }; - services = { - gitlab-runner = { - enable = true; - settings.concurrent = 5; - services = { - shell = { - executor = "shell"; - limit = 5; - authenticationTokenConfigFile = config.age.secrets.runner-reg.path; - environmentVariables = { - EFI_DIR = "${pkgs.OVMF.fd}/FV/"; - STORAGE_URL = "http://s3.thehellings.lan:9000"; - }; - }; - }; - }; - resolved.enable = true; - }; + services = { + gitlab-runner = { + enable = true; + settings.concurrent = 5; + services = { + shell = { + executor = "shell"; + limit = 5; + authenticationTokenConfigFile = config.age.secrets.runner-reg.path; + environmentVariables = { + EFI_DIR = "${pkgs.OVMF.fd}/FV/"; + STORAGE_URL = "http://s3.thehellings.lan:9000"; + }; + }; + }; + }; + resolved.enable = true; + }; - systemd.services.gitlab-runner = { - wants = [ - "network-online.target" - "systemd-resolved.service" - ]; - after = [ - "network.target" - "network-online.target" - "systemd-resolved.service" - ]; - serviceConfig = { - DevicePolicy = lib.mkForce "auto"; - PrivateDevices = false; - ProtectKernelModules = false; - DevicesAllow = [ "/dev/kvm" "/dev/mem" ]; - DynamicUser = lib.mkForce false; - User = "root"; - Group = "kvm"; - }; - }; + systemd.services.gitlab-runner = { + wants = [ + "network-online.target" + "systemd-resolved.service" + ]; + after = [ + "network.target" + "network-online.target" + "systemd-resolved.service" + ]; + serviceConfig = { + DevicePolicy = lib.mkForce "auto"; + PrivateDevices = false; + ProtectKernelModules = false; + DevicesAllow = [ "/dev/kvm" "/dev/mem" ]; + DynamicUser = lib.mkForce false; + User = "root"; + Group = "kvm"; + }; + }; - system.stateVersion = lib.mkForce "24.05"; -} + system.stateVersion = lib.mkForce "24.05"; + } -extra + extra ) # End of attrsets.recursiveUpdate ) # End of outter function wrapper diff --git a/hosts/myself/default.nix b/hosts/myself/default.nix index 2c8abb3..8b576a3 100644 --- a/hosts/myself/default.nix +++ b/hosts/myself/default.nix @@ -1,86 +1,87 @@ { config, pkgs, lib, ... }: { - imports = [ - ./ceph.nix - ./hardware-configuration.nix - ./git.nix - ./matrix.nix - ./minio.nix - ]; + imports = [ + ./ceph.nix + ./hardware-configuration.nix + ./git.nix + ./matrix.nix + ./minio.nix + ]; - greg.tailscale.enable = true; + greg.tailscale.enable = true; - services = { - openssh.enable = true; - }; - networking = { - hostName = "myself"; - useDHCP = false; - defaultGateway = { - address = " 10.42.1.1"; - interface = "enp38s0"; - }; - vlans = { - san = { - id = 616; - interface = "enp39s0"; - }; - }; - interfaces = { - enp38s0 = { - ipv4.addresses = [ { - address = "10.42.1.6"; - prefixLength = 16; - } { - address = "10.42.100.1"; - prefixLength = 16; - } ]; - }; - san = { - ipv4.addresses = [ { - address = "10.201.1.1"; - prefixLength = 24; - } ]; - }; - }; - nameservers = [ - "10.42.1.5" - ]; - }; - users = { - users = { - greg = { - extraGroups = [ - "kvm" - "sudo" - "wheel" - ]; - isNormalUser = true; - }; - }; - }; - system.stateVersion = lib.mkForce "24.05"; - boot = { - extraModprobeConfig = "options kvm_amd nested=1"; - supportedFilesystems = [ "ntfs" ]; - loader = { - efi = { - canTouchEfiVariables = true; - efiSysMountPoint = "/boot"; - }; - systemd-boot = { - enable = true; - configurationLimit = 10; - }; - }; - binfmt.emulatedSystems = [ - "aarch64-linux" - ]; - }; - nixpkgs.config = { - allowUnfree = true; - permittedInsecurePackages = [ - "nodejs-16.20.2" - ]; - }; + services = { + openssh.enable = true; + }; + networking = { + hostName = "myself"; + useDHCP = false; + defaultGateway = { + address = " 10.42.1.1"; + interface = "enp38s0"; + }; + vlans = { + san = { + id = 616; + interface = "enp39s0"; + }; + }; + interfaces = { + enp38s0 = { + ipv4.addresses = [{ + address = "10.42.1.6"; + prefixLength = 16; + } + { + address = "10.42.100.1"; + prefixLength = 16; + }]; + }; + san = { + ipv4.addresses = [{ + address = "10.201.1.1"; + prefixLength = 24; + }]; + }; + }; + nameservers = [ + "10.42.1.5" + ]; + }; + users = { + users = { + greg = { + extraGroups = [ + "kvm" + "sudo" + "wheel" + ]; + isNormalUser = true; + }; + }; + }; + system.stateVersion = lib.mkForce "24.05"; + boot = { + extraModprobeConfig = "options kvm_amd nested=1"; + supportedFilesystems = [ "ntfs" ]; + loader = { + efi = { + canTouchEfiVariables = true; + efiSysMountPoint = "/boot"; + }; + systemd-boot = { + enable = true; + configurationLimit = 10; + }; + }; + binfmt.emulatedSystems = [ + "aarch64-linux" + ]; + }; + nixpkgs.config = { + allowUnfree = true; + permittedInsecurePackages = [ + "nodejs-16.20.2" + ]; + }; } diff --git a/hosts/myself/git.nix b/hosts/myself/git.nix index 410d032..dec5629 100644 --- a/hosts/myself/git.nix +++ b/hosts/myself/git.nix @@ -2,139 +2,142 @@ let - gitlabStateDir = "/var/lib/gitlab"; + gitlabStateDir = "/var/lib/gitlab"; - container = input: (lib.attrsets.recursiveUpdate { - bindMounts."/etc/ssh".hostPath = "/etc/ssh"; # For agenix secrets - enableTun = true; - privateNetwork = true; - } input); -in { - networking = { - firewall = { - enable = true; - allowedTCPPorts = [ 80 ]; - }; - nat = { - enable = true; - internalInterfaces = [ "ve-+" ]; - externalInterface = "enp38s0"; - }; - }; + container = input: (lib.attrsets.recursiveUpdate + { + bindMounts."/etc/ssh".hostPath = "/etc/ssh"; # For agenix secrets + enableTun = true; + privateNetwork = true; + } + input); +in +{ + networking = { + firewall = { + enable = true; + allowedTCPPorts = [ 80 ]; + }; + nat = { + enable = true; + internalInterfaces = [ "ve-+" ]; + externalInterface = "enp38s0"; + }; + }; - greg.proxies."git.thehellings.lan" = { - target = "http://192.168.200.2"; - extraConfig = '' - proxy_set_header X-Forwarded-Proto https; - proxy_set_header X-Forwarded-Ssl on; - ''; - }; - - system.activationScripts.makeGitlabDir = lib.stringAfter [ "var" ] "mkdir -p ${gitlabStateDir} && touch ${gitlabStateDir}/touch"; + greg.proxies."git.thehellings.lan" = { + target = "http://192.168.200.2"; + extraConfig = '' + proxy_set_header X-Forwarded-Proto https; + proxy_set_header X-Forwarded-Ssl on; + ''; + }; - greg.containers.gitlab = { - tailscale = true; - subnet = "200"; - builder = (import ./container-git.nix); - }; + system.activationScripts.makeGitlabDir = lib.stringAfter [ "var" ] "mkdir -p ${gitlabStateDir} && touch ${gitlabStateDir}/touch"; - systemd.services = { - "gitlab-runner" = { - after = [ "container@github.service" ]; - preStart = builtins.concatStringsSep "\n" [ - "${pkgs.kmod}/bin/modprobe kvm" - "${pkgs.kmod}/bin/modprobe kvm_amd" - ]; - postStop = builtins.concatStringsSep "\n" [ - "${pkgs.kmod}/bin/rmmod -f kvm_amd kvm" - ]; - serviceConfig = { - DevicePolicy = lib.mkForce "auto"; - DevicesAllow = [ "/dev/kvm" "/dev/mem" ]; - EnvironmentFile = config.age.secrets.docker-auth.path; - PermissionsStartOnly = "true"; - PrivateDevices = false; - ProtectKernelModules = false; - }; - }; - }; + greg.containers.gitlab = { + tailscale = true; + subnet = "200"; + builder = (import ./container-git.nix); + }; - ##################################################################################### - #################### Container Podman Runner ######################################## - ##################################################################################### - containers.gitlab-runner-shell = container { - autoStart = true; - hostAddress = "192.168.203.1"; - localAddress = "192.168.203.2"; - config = ((import ./container-runner.nix) { - inherit inputs overlays; - name = "shell"; - extra.virtualisation.podman.enable = true; - }); - }; + systemd.services = { + "gitlab-runner" = { + after = [ "container@github.service" ]; + preStart = builtins.concatStringsSep "\n" [ + "${pkgs.kmod}/bin/modprobe kvm" + "${pkgs.kmod}/bin/modprobe kvm_amd" + ]; + postStop = builtins.concatStringsSep "\n" [ + "${pkgs.kmod}/bin/rmmod -f kvm_amd kvm" + ]; + serviceConfig = { + DevicePolicy = lib.mkForce "auto"; + DevicesAllow = [ "/dev/kvm" "/dev/mem" ]; + EnvironmentFile = config.age.secrets.docker-auth.path; + PermissionsStartOnly = "true"; + PrivateDevices = false; + ProtectKernelModules = false; + }; + }; + }; - ##################################################################################### - #################### Local Podman/Docker Runner ##################################### - ##################################################################################### - age.secrets.runner-reg.file = ../../secrets/gitlab/myself-podman-runner-reg.age; - age.secrets.docker-auth.file = ../../secrets/gitlab/docker-auth.age; - age.secrets.runner-qemu.file = ../../secrets/gitlab/myself-qemu-runner-reg.age; - services.gitlab-runner = { - enable = true; - settings = { - concurrent = 5; - }; - services = { - default = { - executor = "docker"; - authenticationTokenConfigFile = config.age.secrets.runner-reg.path; - dockerImage = "gitlab.shire-zebra.ts.net:5000/greg/ci-images/fedora:latest"; - dockerAllowedImages = [ - "alpine:*" - "debian:*" - "docker:*" - "fedora:*" - "python:*" - "ubuntu:*" + ##################################################################################### + #################### Container Podman Runner ######################################## + ##################################################################################### + containers.gitlab-runner-shell = container { + autoStart = true; + hostAddress = "192.168.203.1"; + localAddress = "192.168.203.2"; + config = ((import ./container-runner.nix) { + inherit inputs overlays; + name = "shell"; + extra.virtualisation.podman.enable = true; + }); + }; - "hashicorp/*:*" - "koalaman/shellcheck:*" + ##################################################################################### + #################### Local Podman/Docker Runner ##################################### + ##################################################################################### + age.secrets.runner-reg.file = ../../secrets/gitlab/myself-podman-runner-reg.age; + age.secrets.docker-auth.file = ../../secrets/gitlab/docker-auth.age; + age.secrets.runner-qemu.file = ../../secrets/gitlab/myself-qemu-runner-reg.age; + services.gitlab-runner = { + enable = true; + settings = { + concurrent = 5; + }; + services = { + default = { + executor = "docker"; + authenticationTokenConfigFile = config.age.secrets.runner-reg.path; + dockerImage = "gitlab.shire-zebra.ts.net:5000/greg/ci-images/fedora:latest"; + dockerAllowedImages = [ + "alpine:*" + "debian:*" + "docker:*" + "fedora:*" + "python:*" + "ubuntu:*" - "registry.gitlab.com/gitlab-org/*" - "registry.thehellings.com/*/*/*:*" - "gitlab.shire-zebra.ts.net:5000/*/*/*:*" - ]; - dockerAllowedServices = [ - "docker:*" - "registry.thehellings.com/*/*/*:*" - "gitlab.shire-zebra.ts.net:5000/*/*/*:*" - ]; - dockerPrivileged = true; - dockerVolumes = [ - "/certs/client" - "/cache" - ]; - }; - qemu = { - executor = "shell"; - limit = 5; - authenticationTokenConfigFile = config.age.secrets.runner-qemu.path; - environmentVariables = { - EFI_DIR = "${pkgs.OVMF.fd}/FV/"; - STORAGE_URL = "http://s3.thehellings.lan:9000"; - }; - }; - }; - }; - virtualisation = { - docker.enable = true; - oci-containers.backend = "docker"; - }; - environment.systemPackages = with pkgs; [ - curl - gawk - git - unzip - wget - ]; + "hashicorp/*:*" + "koalaman/shellcheck:*" + + "registry.gitlab.com/gitlab-org/*" + "registry.thehellings.com/*/*/*:*" + "gitlab.shire-zebra.ts.net:5000/*/*/*:*" + ]; + dockerAllowedServices = [ + "docker:*" + "registry.thehellings.com/*/*/*:*" + "gitlab.shire-zebra.ts.net:5000/*/*/*:*" + ]; + dockerPrivileged = true; + dockerVolumes = [ + "/certs/client" + "/cache" + ]; + }; + qemu = { + executor = "shell"; + limit = 5; + authenticationTokenConfigFile = config.age.secrets.runner-qemu.path; + environmentVariables = { + EFI_DIR = "${pkgs.OVMF.fd}/FV/"; + STORAGE_URL = "http://s3.thehellings.lan:9000"; + }; + }; + }; + }; + virtualisation = { + docker.enable = true; + oci-containers.backend = "docker"; + }; + environment.systemPackages = with pkgs; [ + curl + gawk + git + unzip + wget + ]; } diff --git a/hosts/myself/hardware-configuration.nix b/hosts/myself/hardware-configuration.nix index 7d20b31..78331da 100644 --- a/hosts/myself/hardware-configuration.nix +++ b/hosts/myself/hardware-configuration.nix @@ -4,48 +4,53 @@ { config, lib, pkgs, modulesPath, ... }: { - imports = - [ (modulesPath + "/installer/scan/not-detected.nix") - ]; + imports = + [ + (modulesPath + "/installer/scan/not-detected.nix") + ]; - boot.initrd.availableKernelModules = [ "nvme" "xhci_pci" "ahci" "usb_storage" "usbhid" "sd_mod" "sr_mod" ]; - boot.initrd.kernelModules = [ ]; - boot.kernelModules = [ "kvm-amd" ]; - boot.extraModulePackages = [ ]; + boot.initrd.availableKernelModules = [ "nvme" "xhci_pci" "ahci" "usb_storage" "usbhid" "sd_mod" "sr_mod" ]; + boot.initrd.kernelModules = [ ]; + boot.kernelModules = [ "kvm-amd" ]; + boot.extraModulePackages = [ ]; - fileSystems."/" = - { device = "/dev/disk/by-uuid/714744ca-dd9d-4713-b571-c6ccfbf56d79"; - fsType = "btrfs"; - options = [ "subvol=nixos" ]; - }; + fileSystems."/" = + { + device = "/dev/disk/by-uuid/714744ca-dd9d-4713-b571-c6ccfbf56d79"; + fsType = "btrfs"; + options = [ "subvol=nixos" ]; + }; - fileSystems."/home" = - { device = "/dev/disk/by-uuid/714744ca-dd9d-4713-b571-c6ccfbf56d79"; - fsType = "btrfs"; - options = [ "subvol=home" ]; - }; + fileSystems."/home" = + { + device = "/dev/disk/by-uuid/714744ca-dd9d-4713-b571-c6ccfbf56d79"; + fsType = "btrfs"; + options = [ "subvol=home" ]; + }; - fileSystems."/boot" = - { device = "/dev/disk/by-uuid/29E7-E20C"; - fsType = "vfat"; - }; + fileSystems."/boot" = + { + device = "/dev/disk/by-uuid/29E7-E20C"; + fsType = "vfat"; + }; - fileSystems."/myvol" = - { device = "/dev/nvme0n1p1"; - fsType = "btrfs"; - }; + fileSystems."/myvol" = + { + device = "/dev/nvme0n1p1"; + fsType = "btrfs"; + }; - swapDevices = [ ]; + swapDevices = [ ]; - # Enables DHCP on each ethernet and wireless interface. In case of scripted networking - # (the default) this is the recommended approach. When using systemd-networkd it's - # still possible to use this option, but it's recommended to use it in conjunction - # with explicit per-interface declarations with `networking.interfaces..useDHCP`. - networking.useDHCP = lib.mkDefault true; - # networking.interfaces.enp38s0.useDHCP = lib.mkDefault true; - # networking.interfaces.enp39s0.useDHCP = lib.mkDefault true; - # networking.interfaces.enp42s0f3u5u3c2.useDHCP = lib.mkDefault true; + # Enables DHCP on each ethernet and wireless interface. In case of scripted networking + # (the default) this is the recommended approach. When using systemd-networkd it's + # still possible to use this option, but it's recommended to use it in conjunction + # with explicit per-interface declarations with `networking.interfaces..useDHCP`. + networking.useDHCP = lib.mkDefault true; + # networking.interfaces.enp38s0.useDHCP = lib.mkDefault true; + # networking.interfaces.enp39s0.useDHCP = lib.mkDefault true; + # networking.interfaces.enp42s0f3u5u3c2.useDHCP = lib.mkDefault true; - nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux"; - hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware; + nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux"; + hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware; } diff --git a/hosts/myself/matrix.nix b/hosts/myself/matrix.nix index 8dc250d..6574759 100644 --- a/hosts/myself/matrix.nix +++ b/hosts/myself/matrix.nix @@ -1,90 +1,91 @@ { config, pkgs, inputs, lib, ... }: let - domain = "thehellings.com"; - fqdn = "matrix.${domain}"; - conn = "postgresql:///dendrite?sslmode=disable&host=/run/postgresql"; + domain = "thehellings.com"; + fqdn = "matrix.${domain}"; + conn = "postgresql:///dendrite?sslmode=disable&host=/run/postgresql"; in { - environment.systemPackages = with pkgs; [ upgrade-pg-cluster ]; + environment.systemPackages = with pkgs; [ upgrade-pg-cluster ]; - greg.containers.matrix = { - tailscale = true; - subnet = "204"; - builder = { pkgs, config, ... }: { - networking.firewall.allowedTCPPorts = [ config.services.dendrite.httpPort ]; + greg.containers.matrix = { + tailscale = true; + subnet = "204"; + builder = { pkgs, config, ... }: { + networking.firewall.allowedTCPPorts = [ config.services.dendrite.httpPort ]; - # Environment secrets - age = { - secrets.dendrite = { - file = ../../secrets/dendrite.age; - owner = "dendrite"; - }; - secrets.dendrite_key = { - file = ../../secrets/dendrite_key.age; - owner = "dendrite"; - }; - }; + # Environment secrets + age = { + secrets.dendrite = { + file = ../../secrets/dendrite.age; + owner = "dendrite"; + }; + secrets.dendrite_key = { + file = ../../secrets/dendrite_key.age; + owner = "dendrite"; + }; + }; - users.users.dendrite = { - isSystemUser = true; - group = "dendrite"; - }; - users.groups.dendrite = {}; + users.users.dendrite = { + isSystemUser = true; + group = "dendrite"; + }; + users.groups.dendrite = { }; - systemd.services.dendrite.serviceConfig = { - User = "dendrite"; - }; + systemd.services.dendrite.serviceConfig = { + User = "dendrite"; + }; - greg.databases.dendrite = {}; + greg.databases.dendrite = { }; - services.dendrite = { - enable = true; - environmentFile = config.age.secrets.dendrite.path; - httpPort = 8448; - # Identify ourselves as the root of our own domain - settings = ( - (builtins.listToAttrs ( - (map (x: { name = x; value = { database.connection_string = conn; }; }) [ - "app_service_api" - "federation_api" - "key_server" - "media_api" - "mscs" - "relay_api" - "room_server" - "sync_api" - ]) - ) ) // - { - user_api.account_database.connection_string = conn; - user_api.device_database.connection_string = conn; - global = { - database = { - connection_string = conn; - max_open_conns = 25; - max_idle_conns = 5; - conn_max_lifetime = -1; - }; - server_name = "thehellings.com"; - trusted_third_party_id_servers = [ - "matrix.org" - "vector.im" - "jupiterbroadcasting.com" - ]; - # Generate this with {path-to-dendrite}/bin/generate-keys --private-key /etc/dendrite.pem - private_key = config.age.secrets.dendrite_key.path; - }; - client_api = { - registration_enabled = false; - registration_shared_secret = "\${REGISTRATION_SHARED_SECRET}"; - }; - }); - }; + services.dendrite = { + enable = true; + environmentFile = config.age.secrets.dendrite.path; + httpPort = 8448; + # Identify ourselves as the root of our own domain + settings = ( + (builtins.listToAttrs ( + (map (x: { name = x; value = { database.connection_string = conn; }; }) [ + "app_service_api" + "federation_api" + "key_server" + "media_api" + "mscs" + "relay_api" + "room_server" + "sync_api" + ]) + )) // + { + user_api.account_database.connection_string = conn; + user_api.device_database.connection_string = conn; + global = { + database = { + connection_string = conn; + max_open_conns = 25; + max_idle_conns = 5; + conn_max_lifetime = -1; + }; + server_name = "thehellings.com"; + trusted_third_party_id_servers = [ + "matrix.org" + "vector.im" + "jupiterbroadcasting.com" + ]; + # Generate this with {path-to-dendrite}/bin/generate-keys --private-key /etc/dendrite.pem + private_key = config.age.secrets.dendrite_key.path; + }; + client_api = { + registration_enabled = false; + registration_shared_secret = "\${REGISTRATION_SHARED_SECRET}"; + }; + } + ); + }; - systemd.services.dendrite = { - after = [ "postgresql.service" ]; - requires = [ "postgresql.service" ]; - }; - }; - }; + systemd.services.dendrite = { + after = [ "postgresql.service" ]; + requires = [ "postgresql.service" ]; + }; + }; + }; } diff --git a/hosts/myself/minio.nix b/hosts/myself/minio.nix index 67adcdd..4ddd9b0 100644 --- a/hosts/myself/minio.nix +++ b/hosts/myself/minio.nix @@ -1,32 +1,33 @@ { config, pkgs, ... }: let - minioPort = 9000; - minioConsolePort = 9001; -in { - environment.systemPackages = with pkgs; [ - minio-client - xfsprogs - ]; + minioPort = 9000; + minioConsolePort = 9001; +in +{ + environment.systemPackages = with pkgs; [ + minio-client + xfsprogs + ]; - greg.proxies."minio-01.thehellings.lan".target = "http://localhost:9000"; + greg.proxies."minio-01.thehellings.lan".target = "http://localhost:9000"; - fileSystems."/data/1" = { - device = "/dev/disk/by-id/wwn-0x5000c500c48728e9-part1"; - fsType = "xfs"; - }; + fileSystems."/data/1" = { + device = "/dev/disk/by-id/wwn-0x5000c500c48728e9-part1"; + fsType = "xfs"; + }; - networking.firewall.allowedTCPPorts = [ - minioPort - minioConsolePort - ]; + networking.firewall.allowedTCPPorts = [ + minioPort + minioConsolePort + ]; - age.secrets.minio.file = ../../secrets/minio.age; + age.secrets.minio.file = ../../secrets/minio.age; - services.minio = { - enable = true; - dataDir = [ "/data/1/minio" ]; - rootCredentialsFile = config.age.secrets.minio.path; - browser = true; - }; + services.minio = { + enable = true; + dataDir = [ "/data/1/minio" ]; + rootCredentialsFile = config.age.secrets.minio.path; + browser = true; + }; } diff --git a/hosts/wsl/default.nix b/hosts/wsl/default.nix index 5bbf08e..8fdaaa2 100644 --- a/hosts/wsl/default.nix +++ b/hosts/wsl/default.nix @@ -1,11 +1,11 @@ { pkgs, ... }: { - wsl = { - enable = true; - wslConf.automount.root = "/mnt"; - defaultUser = "greg"; - startMenuLaunchers = true; - nativeSystemd = true; - }; + wsl = { + enable = true; + wslConf.automount.root = "/mnt"; + defaultUser = "greg"; + startMenuLaunchers = true; + nativeSystemd = true; + }; } diff --git a/modules/baseline.nix b/modules/baseline.nix index 04531d2..b0c71f7 100644 --- a/modules/baseline.nix +++ b/modules/baseline.nix @@ -1,60 +1,60 @@ { pkgs, lib, ... }: let - notDarwin = (! pkgs.stdenv.isDarwin); + notDarwin = (! pkgs.stdenv.isDarwin); in { - # Enable flakes - nix = { - gc = { - automatic = true; - # Scheduling of them is different in nixos vs nix-darwin, so check for - # the extra details there - options = "--delete-older-than 30d"; - }; - - settings = { - experimental-features = "nix-command flakes"; - keep-outputs = true; - keep-derivations = true; - min-free = (toString (1024 * 1024 * 1024) ); - max-free = (toString (5 * 1024 * 1024 * 1024) ); - substituters = [ - "https://cache.garnix.io" - "https://ai.cachix.org" - ]; - trusted-public-keys = [ - "cache.garnix.io:CTFPyKSLcx5RMJKfLo5EEPUObbA78b0YQ2DTCJXqr9g=" - "ai.cachix.org-1:N9dzRK+alWwoKXQlnn0H6aUx0lU/mspIoz8hMvGvbbc=" - ]; - }; + # Enable flakes + nix = { + gc = { + automatic = true; + # Scheduling of them is different in nixos vs nix-darwin, so check for + # the extra details there + options = "--delete-older-than 30d"; }; - nixpkgs.config = { - allowUnfree = true; - permittedInsecurePackages = [ - "jitsi-meet-1.0.8043" - ]; + settings = { + experimental-features = "nix-command flakes"; + keep-outputs = true; + keep-derivations = true; + min-free = (toString (1024 * 1024 * 1024)); + max-free = (toString (5 * 1024 * 1024 * 1024)); + substituters = [ + "https://cache.garnix.io" + "https://ai.cachix.org" + ]; + trusted-public-keys = [ + "cache.garnix.io:CTFPyKSLcx5RMJKfLo5EEPUObbA78b0YQ2DTCJXqr9g=" + "ai.cachix.org-1:N9dzRK+alWwoKXQlnn0H6aUx0lU/mspIoz8hMvGvbbc=" + ]; }; + }; - # Base packages that need to be in all my hosts - environment.systemPackages = with pkgs; [ - agenix - bitwarden-cli - bmon - diffutils - git - gnupatch - gregpy - findutils - file - hms # My own home manager switcher - htop - iperf - killall - nano - pciutils - pwgen - unzip - wget - ]; + nixpkgs.config = { + allowUnfree = true; + permittedInsecurePackages = [ + "jitsi-meet-1.0.8043" + ]; + }; + + # Base packages that need to be in all my hosts + environment.systemPackages = with pkgs; [ + agenix + bitwarden-cli + bmon + diffutils + git + gnupatch + gregpy + findutils + file + hms # My own home manager switcher + htop + iperf + killall + nano + pciutils + pwgen + unzip + wget + ]; } diff --git a/modules/darwin/default.nix b/modules/darwin/default.nix index 576ae65..55edd6c 100644 --- a/modules/darwin/default.nix +++ b/modules/darwin/default.nix @@ -1,26 +1,26 @@ -{...}: +{ ... }: { - imports = [ - ../baseline.nix - ]; - system.stateVersion = 4; - home-manager = { - useGlobalPkgs = true; - users."gregory.hellings" = import ../../home/home.nix; - extraSpecialArgs = { - gnome = false; - gui = false; - home = "/Users/gregory.hellings"; - }; + imports = [ + ../baseline.nix + ]; + system.stateVersion = 4; + home-manager = { + useGlobalPkgs = true; + users."gregory.hellings" = import ../../home/home.nix; + extraSpecialArgs = { + gnome = false; + gui = false; + home = "/Users/gregory.hellings"; }; - users.users."gregory.hellings".home = "/Users/gregory.hellings"; - programs = { - zsh.enable = true; - bash.enable = true; - }; - services.nix-daemon.enable = true; - nix = { - gc.interval.Hour = 24; - settings.auto-optimise-store = false; # Darwin bugs? - }; -} \ No newline at end of file + }; + users.users."gregory.hellings".home = "/Users/gregory.hellings"; + programs = { + zsh.enable = true; + bash.enable = true; + }; + services.nix-daemon.enable = true; + nix = { + gc.interval.Hour = 24; + settings.auto-optimise-store = false; # Darwin bugs? + }; +} diff --git a/modules/default.nix b/modules/default.nix index 7f28a07..b3a136c 100644 --- a/modules/default.nix +++ b/modules/default.nix @@ -1,7 +1,8 @@ let - nixos = (import ./nixos); - darwin = (import ./darwin); -in { - nixosModule = nixos; - darwinModule = darwin; -} \ No newline at end of file + nixos = (import ./nixos); + darwin = (import ./darwin); +in +{ + nixosModule = nixos; + darwinModule = darwin; +} diff --git a/modules/nixos/backup.nix b/modules/nixos/backup.nix index bbfe8d8..96f1a8c 100644 --- a/modules/nixos/backup.nix +++ b/modules/nixos/backup.nix @@ -1,71 +1,74 @@ { lib, config, pkgs, ... }: let - cfg = config.greg.backup; + cfg = config.greg.backup; - where = j: "${config.services.syncthing.dataDir}/${j.dest}"; + where = j: "${config.services.syncthing.dataDir}/${j.dest}"; - makeSyncFolders = name: job: { - devices = [ "chronicles" ]; - enable = true; - id = job.id; - label = job.dest; - path = where job; - type = "sendonly"; - }; + makeSyncFolders = name: job: { + devices = [ "chronicles" ]; + enable = true; + id = job.id; + label = job.dest; + path = where job; + type = "sendonly"; + }; - makeRestic = name: job: let - who = "${config.services.syncthing.user}:${config.services.syncthing.group}"; - in rec { - initialize = true; - passwordFile = config.age.secrets.restic-pw.path; - paths = [ job.src ]; - repository = where job; - backupCleanupCommand = ''${pkgs.coreutils}/bin/chown -R ${who} "${repository}"''; - }; + makeRestic = name: job: + let + who = "${config.services.syncthing.user}:${config.services.syncthing.group}"; + in + rec { + initialize = true; + passwordFile = config.age.secrets.restic-pw.path; + paths = [ job.src ]; + repository = where job; + backupCleanupCommand = ''${pkgs.coreutils}/bin/chown -R ${who} "${repository}"''; + }; -in with lib; { - options = { - greg.backup = { - jobs = mkOption { - default = {}; +in +with lib; { + options = { + greg.backup = { + jobs = mkOption { + default = { }; - type = with types; attrsOf (submodule ( - { name, config, options, ... }: - { - options = { - src = mkOption { - type = types.str; - description = "Local path (string form) to backup from"; - }; + type = with types; attrsOf (submodule ( + { name, config, options, ... }: + { + options = { + src = mkOption { + type = types.str; + description = "Local path (string form) to backup from"; + }; - dest = mkOption { - type = types.str; - }; + dest = mkOption { + type = types.str; + }; - id = mkOption { - type = types.str; - description = "The unique folder ID for this"; - }; - }; - } - )); - }; - }; - }; + id = mkOption { + type = types.str; + description = "The unique folder ID for this"; + }; + }; + } + )); + }; + }; + }; - config = mkIf ( ( attrValues cfg.jobs ) != [] ) - { - age.secrets = { - restic-pw.file = ../../secrets/restic-pw.age; - restic-env.file = ../../secrets/restic-env.age; - }; - greg.syncthing = { - enable = true; - }; - services = { - syncthing.settings.folders = mapAttrs makeSyncFolders cfg.jobs; - restic.backups = mapAttrs makeRestic cfg.jobs; - }; - }; + config = mkIf ((attrValues cfg.jobs) != [ ]) + { + age.secrets = { + restic-pw.file = ../../secrets/restic-pw.age; + restic-env.file = ../../secrets/restic-env.age; + }; + greg.syncthing = { + enable = true; + }; + services = { + syncthing.settings.folders = mapAttrs makeSyncFolders cfg.jobs; + restic.backups = mapAttrs makeRestic cfg.jobs; + }; + }; } diff --git a/modules/nixos/ceph.nix b/modules/nixos/ceph.nix index fcd1d7d..62d82e1 100644 --- a/modules/nixos/ceph.nix +++ b/modules/nixos/ceph.nix @@ -8,11 +8,13 @@ let cfg = config.services.ceph-benaco; commaSep = builtins.concatStringsSep ","; - ensureUnitExists = c': name: let - unitName = (builtins.elemAt (builtins.split "\\." name) 0); - in if c'.systemd.services ? unitName - then name - else name;# "Unable to locate ${name} at ${commaSep (builtins.attrNames c')}"; + ensureUnitExists = c': name: + let + unitName = (builtins.elemAt (builtins.split "\\." name) 0); + in + if c'.systemd.services ? unitName + then name + else name; # "Unable to locate ${name} at ${commaSep (builtins.attrNames c')}"; in { @@ -143,7 +145,7 @@ in }; osds = mkOption { - default = {}; + default = { }; example = { osd1 = { enable = true; @@ -200,7 +202,7 @@ in systemdExtraRequiresAfter = mkOption { type = types.listOf types.str; - default = []; + default = [ ]; description = '' Add the specified systemd units to the "requires" and "after" lists of the systemd service of this OSD. @@ -325,135 +327,138 @@ in ###### implementation - config = let - monDir = "/var/lib/ceph/mon/${cfg.clusterName}-${cfg.monitor.nodeName}"; - mgrDir = "/var/lib/ceph/mgr/${cfg.clusterName}-${cfg.manager.nodeName}"; - mdsDir = "/var/lib/ceph/mds/${cfg.clusterName}-${cfg.mds.nodeName}"; - - # File permissions for things that are on locations wiped at start - # (e.g. /run or its /var/run symlink). - ensureTransientCephDirs = '' - install -m 770 -o ${config.users.users.ceph.name} -g ${config.users.groups.ceph.name} -d /var/run/ceph - ''; - - # File permissions from cluster deployed with ceph-deploy. - ensureCephDirs = '' - install -m 3770 -o ${config.users.users.ceph.name} -g ${config.users.groups.ceph.name} -d /var/log/ceph - install -m 770 -o ${config.users.users.ceph.name} -g ${config.users.groups.ceph.name} -d /var/run/ceph - install -m 750 -o ${config.users.users.ceph.name} -g ${config.users.groups.ceph.name} -d /var/lib/ceph - install -m 755 -o ${config.users.users.ceph.name} -g ${config.users.groups.ceph.name} -d /var/lib/ceph/mon - install -m 755 -o ${config.users.users.ceph.name} -g ${config.users.groups.ceph.name} -d /var/lib/ceph/mgr - install -m 755 -o ${config.users.users.ceph.name} -g ${config.users.groups.ceph.name} -d /var/lib/ceph/osd - ''; - - # Utilities called by Ceph device health scraping, see: - # https://docs.ceph.com/en/latest/rados/operations/devices/#enabling-monitoring - # As per https://github.com/ceph/ceph-container/pull/1490/commits/c49e821599965ae92a88b2c78077ee03c4405895, - # both the OSDs and the `mon` need this. - # Ceph calls these utilities with `sudo`. That requires sudoers entries. - # Sudoers entries require absolute path; that exact (nix store) path needs to - # be used by Ceph, so it needs to be given to the systemd unit via `path`. - # This is why we pair each `sudoersExtraRule` with the `package` to put onto - # that `path`. - # - # Entries are based on: - # https://github.com/ceph/ceph/blob/a2f5a3c1dbfa4dce41e25da4f029a8fdb8c8d864/sudoers.d/ceph-smartctl - cephMonitoringSudoersCommandsAndPackages = [ - { - package = pkgs.smartmontools; - sudoersExtraRule = { # entry for `security.sudo.extraRules` - users = [ config.users.users.ceph.name ]; - commands = [{ - command = "${lib.getBin pkgs.smartmontools}/bin/smartctl -x --json=o /dev/*"; - options = [ "NOPASSWD" ]; - }]; - }; - } - { - package = pkgs.nvme-cli; - sudoersExtraRule = { # entry for `security.sudo.extraRules` - users = [ config.users.users.ceph.name ]; - commands = [{ - command = "${lib.getBin pkgs.nvme-cli}/bin/nvme * smart-log-add --json /dev/*"; - options = [ "NOPASSWD" ]; - }]; - }; - } - ]; - - cephDeviceHealthMonitoringPathsOrPackages = with pkgs; [ - # Contains `sudo`. Ceph wraps this around the other health check programs. - # Cannot use `pkgs.sudo` because that one is not SUID, see: - # https://discourse.nixos.org/t/sudo-uid-issues/9133 - "/run/wrappers" # `systemd.services..path` adds the `bin/` subdir of this - ] ++ map ({ package, ... }: package) cephMonitoringSudoersCommandsAndPackages; - - makeCephOsdSetupSystemdService = localOsdServiceName: osdConfig: + config = let - osdExistenceFile = "/var/lib/ceph/osd/.${toString osdConfig.id}.${osdConfig.uuid}.nix-existence"; - in - mkIf osdConfig.enable { - description = "Initialize Ceph OSD"; + monDir = "/var/lib/ceph/mon/${cfg.clusterName}-${cfg.monitor.nodeName}"; + mgrDir = "/var/lib/ceph/mgr/${cfg.clusterName}-${cfg.manager.nodeName}"; + mdsDir = "/var/lib/ceph/mds/${cfg.clusterName}-${cfg.mds.nodeName}"; - requires = osdConfig.systemdExtraRequiresAfter; - after = osdConfig.systemdExtraRequiresAfter; + # File permissions for things that are on locations wiped at start + # (e.g. /run or its /var/run symlink). + ensureTransientCephDirs = '' + install -m 770 -o ${config.users.users.ceph.name} -g ${config.users.groups.ceph.name} -d /var/run/ceph + ''; - path = with pkgs; [ - # The following are currently missing in Ceph's wrapping, see https://github.com/NixOS/nixpkgs/issues/147801#issue-1065600852 - util-linux # for `lsblk` - lvm2 # for `lvs` + # File permissions from cluster deployed with ceph-deploy. + ensureCephDirs = '' + install -m 3770 -o ${config.users.users.ceph.name} -g ${config.users.groups.ceph.name} -d /var/log/ceph + install -m 770 -o ${config.users.users.ceph.name} -g ${config.users.groups.ceph.name} -d /var/run/ceph + install -m 750 -o ${config.users.users.ceph.name} -g ${config.users.groups.ceph.name} -d /var/lib/ceph + install -m 755 -o ${config.users.users.ceph.name} -g ${config.users.groups.ceph.name} -d /var/lib/ceph/mon + install -m 755 -o ${config.users.users.ceph.name} -g ${config.users.groups.ceph.name} -d /var/lib/ceph/mgr + install -m 755 -o ${config.users.users.ceph.name} -g ${config.users.groups.ceph.name} -d /var/lib/ceph/osd + ''; + + # Utilities called by Ceph device health scraping, see: + # https://docs.ceph.com/en/latest/rados/operations/devices/#enabling-monitoring + # As per https://github.com/ceph/ceph-container/pull/1490/commits/c49e821599965ae92a88b2c78077ee03c4405895, + # both the OSDs and the `mon` need this. + # Ceph calls these utilities with `sudo`. That requires sudoers entries. + # Sudoers entries require absolute path; that exact (nix store) path needs to + # be used by Ceph, so it needs to be given to the systemd unit via `path`. + # This is why we pair each `sudoersExtraRule` with the `package` to put onto + # that `path`. + # + # Entries are based on: + # https://github.com/ceph/ceph/blob/a2f5a3c1dbfa4dce41e25da4f029a8fdb8c8d864/sudoers.d/ceph-smartctl + cephMonitoringSudoersCommandsAndPackages = [ + { + package = pkgs.smartmontools; + sudoersExtraRule = { + # entry for `security.sudo.extraRules` + users = [ config.users.users.ceph.name ]; + commands = [{ + command = "${lib.getBin pkgs.smartmontools}/bin/smartctl -x --json=o /dev/*"; + options = [ "NOPASSWD" ]; + }]; + }; + } + { + package = pkgs.nvme-cli; + sudoersExtraRule = { + # entry for `security.sudo.extraRules` + users = [ config.users.users.ceph.name ]; + commands = [{ + command = "${lib.getBin pkgs.nvme-cli}/bin/nvme * smart-log-add --json /dev/*"; + options = [ "NOPASSWD" ]; + }]; + }; + } ]; - # TODO Use `udevadm trigger --settle` instead of the separate `udevadm settle` - # once that feature is available to us with systemd >= 238; - # see https://github.com/systemd/systemd/commit/792cc203a67edb201073351f5c766fce3d5eab45 - preStart = '' - set -x - ${ensureCephDirs} - install -m 755 -o ${config.users.users.ceph.name} -g ${config.users.groups.ceph.name} -d /var/lib/ceph/bootstrap-osd - # `install` is not atomic, see - # https://lists.gnu.org/archive/html/bug-coreutils/2010-02/msg00243.html - # so use `mktemp` + `mv` to make it atomic. - TMPFILE=$(mktemp --tmpdir=/var/lib/ceph/bootstrap-osd/) - install -o ${config.users.users.ceph.name} -g ${config.users.groups.ceph.name} ${osdConfig.bootstrapKeyring} "$TMPFILE" - mv "$TMPFILE" /var/lib/ceph/bootstrap-osd/ceph.keyring + cephDeviceHealthMonitoringPathsOrPackages = with pkgs; [ + # Contains `sudo`. Ceph wraps this around the other health check programs. + # Cannot use `pkgs.sudo` because that one is not SUID, see: + # https://discourse.nixos.org/t/sudo-uid-issues/9133 + "/run/wrappers" # `systemd.services..path` adds the `bin/` subdir of this + ] ++ map ({ package, ... }: package) cephMonitoringSudoersCommandsAndPackages; - # Trigger udev rules for permissions of block devices and wait for them to settle. - udevadm trigger --name-match=${osdConfig.blockDevice} - '' + lib.optionalString (osdConfig.dbBlockDevice != null) '' - udevadm trigger --name-match=${osdConfig.dbBlockDevice} - '' + - '' - udevadm settle - '' + (optionalString (!osdConfig.skipZap) ( - '' - # Zap OSD block devices, otherwise `ceph-osd` below will try to fsck if there's some old - # ceph data on the block device (see https://tracker.ceph.com/issues/24099). - ${cfg.package}/bin/ceph-volume lvm zap ${osdConfig.blockDevice} - '' + lib.optionalString (osdConfig.dbBlockDevice != null) '' - ${cfg.package}/bin/ceph-volume lvm zap ${osdConfig.dbBlockDevice} - '' - )); + makeCephOsdSetupSystemdService = localOsdServiceName: osdConfig: + let + osdExistenceFile = "/var/lib/ceph/osd/.${toString osdConfig.id}.${osdConfig.uuid}.nix-existence"; + in + mkIf osdConfig.enable { + description = "Initialize Ceph OSD"; - script = '' - set -euo pipefail - set -x - until [ -f /etc/ceph/${cfg.clusterName}.client.admin.keyring ] - do - sleep 1 - done + requires = osdConfig.systemdExtraRequiresAfter; + after = osdConfig.systemdExtraRequiresAfter; - OSD_SECRET=$(${cfg.package}/bin/ceph-authtool --gen-print-key) - echo "{\"cephx_secret\": \"$OSD_SECRET\"}" | \ - ${cfg.package}/bin/ceph --cluster ${cfg.clusterName} osd new ${osdConfig.uuid} ${toString osdConfig.id} -i - \ - -n client.bootstrap-osd -k ${osdConfig.bootstrapKeyring} - mkdir -p /var/lib/ceph/osd/${cfg.clusterName}-${toString osdConfig.id} + path = with pkgs; [ + # The following are currently missing in Ceph's wrapping, see https://github.com/NixOS/nixpkgs/issues/147801#issue-1065600852 + util-linux # for `lsblk` + lvm2 # for `lvs` + ]; - ln -s ${osdConfig.blockDevice} /var/lib/ceph/osd/${cfg.clusterName}-${toString osdConfig.id}/block - '' + lib.optionalString (osdConfig.dbBlockDevice != null) '' - ln -s ${osdConfig.dbBlockDevice} /var/lib/ceph/osd/${cfg.clusterName}-${toString osdConfig.id}/block.db - '' + - '' + # TODO Use `udevadm trigger --settle` instead of the separate `udevadm settle` + # once that feature is available to us with systemd >= 238; + # see https://github.com/systemd/systemd/commit/792cc203a67edb201073351f5c766fce3d5eab45 + preStart = '' + set -x + ${ensureCephDirs} + install -m 755 -o ${config.users.users.ceph.name} -g ${config.users.groups.ceph.name} -d /var/lib/ceph/bootstrap-osd + # `install` is not atomic, see + # https://lists.gnu.org/archive/html/bug-coreutils/2010-02/msg00243.html + # so use `mktemp` + `mv` to make it atomic. + TMPFILE=$(mktemp --tmpdir=/var/lib/ceph/bootstrap-osd/) + install -o ${config.users.users.ceph.name} -g ${config.users.groups.ceph.name} ${osdConfig.bootstrapKeyring} "$TMPFILE" + mv "$TMPFILE" /var/lib/ceph/bootstrap-osd/ceph.keyring + + # Trigger udev rules for permissions of block devices and wait for them to settle. + udevadm trigger --name-match=${osdConfig.blockDevice} + '' + lib.optionalString (osdConfig.dbBlockDevice != null) '' + udevadm trigger --name-match=${osdConfig.dbBlockDevice} + '' + + '' + udevadm settle + '' + (optionalString (!osdConfig.skipZap) ( + '' + # Zap OSD block devices, otherwise `ceph-osd` below will try to fsck if there's some old + # ceph data on the block device (see https://tracker.ceph.com/issues/24099). + ${cfg.package}/bin/ceph-volume lvm zap ${osdConfig.blockDevice} + '' + lib.optionalString (osdConfig.dbBlockDevice != null) '' + ${cfg.package}/bin/ceph-volume lvm zap ${osdConfig.dbBlockDevice} + '' + )); + + script = '' + set -euo pipefail + set -x + until [ -f /etc/ceph/${cfg.clusterName}.client.admin.keyring ] + do + sleep 1 + done + + OSD_SECRET=$(${cfg.package}/bin/ceph-authtool --gen-print-key) + echo "{\"cephx_secret\": \"$OSD_SECRET\"}" | \ + ${cfg.package}/bin/ceph --cluster ${cfg.clusterName} osd new ${osdConfig.uuid} ${toString osdConfig.id} -i - \ + -n client.bootstrap-osd -k ${osdConfig.bootstrapKeyring} + mkdir -p /var/lib/ceph/osd/${cfg.clusterName}-${toString osdConfig.id} + + ln -s ${osdConfig.blockDevice} /var/lib/ceph/osd/${cfg.clusterName}-${toString osdConfig.id}/block + '' + lib.optionalString (osdConfig.dbBlockDevice != null) '' + ln -s ${osdConfig.dbBlockDevice} /var/lib/ceph/osd/${cfg.clusterName}-${toString osdConfig.id}/block.db + '' + + '' ${cfg.package}/bin/ceph-authtool --create-keyring /var/lib/ceph/osd/ceph-${toString osdConfig.id}/keyring \ --name osd.${toString osdConfig.id} --add-key $OSD_SECRET @@ -462,388 +467,395 @@ in touch ${osdExistenceFile} ''; - serviceConfig = { - Type = "oneshot"; - RemainAfterExit = true; - PermissionsStartOnly = true; # only run the script as ceph, preStart as root - User = config.users.users.ceph.name; - Group = config.users.groups.ceph.name; - }; - unitConfig = { - ConditionPathExists = "!${osdExistenceFile}"; - }; - }; + serviceConfig = { + Type = "oneshot"; + RemainAfterExit = true; + PermissionsStartOnly = true; # only run the script as ceph, preStart as root + User = config.users.users.ceph.name; + Group = config.users.groups.ceph.name; + }; + unitConfig = { + ConditionPathExists = "!${osdExistenceFile}"; + }; + }; - makeCephOsdSystemdService = localOsdServiceName: osdConfig: mkIf osdConfig.enable { - description = "Ceph OSD"; + makeCephOsdSystemdService = localOsdServiceName: osdConfig: mkIf osdConfig.enable { + description = "Ceph OSD"; - # Note we do not have to add `osdConfig.systemdExtraRequiresAfter` here because - # that's already a dependency of our dependency `ceph-osd-setup-*`. - requires = [ - (ensureUnitExists config "ceph-osd-setup-${localOsdServiceName}.service") - ]; - requiredBy = [ "multi-user.target" ]; - after = [ - "network.target" - "local-fs.target" - "time-sync.target" - (ensureUnitExists config "ceph-osd-setup-${localOsdServiceName}.service") - ]; - wants = [ - "network.target" - "local-fs.target" - "time-sync.target" - ]; + # Note we do not have to add `osdConfig.systemdExtraRequiresAfter` here because + # that's already a dependency of our dependency `ceph-osd-setup-*`. + requires = [ + (ensureUnitExists config "ceph-osd-setup-${localOsdServiceName}.service") + ]; + requiredBy = [ "multi-user.target" ]; + after = [ + "network.target" + "local-fs.target" + "time-sync.target" + (ensureUnitExists config "ceph-osd-setup-${localOsdServiceName}.service") + ]; + wants = [ + "network.target" + "local-fs.target" + "time-sync.target" + ]; - path = [ - # TODO: use wrapProgram in the ceph package for this in the future - pkgs.getopt - ] + path = [ + # TODO: use wrapProgram in the ceph package for this in the future + pkgs.getopt + ] ++ cephDeviceHealthMonitoringPathsOrPackages - ; + ; - restartTriggers = [ config.environment.etc."ceph/${cfg.clusterName}.conf".source ]; + restartTriggers = [ config.environment.etc."ceph/${cfg.clusterName}.conf".source ]; - preStart = '' - ${ensureTransientCephDirs} - ${lib.getLib cfg.package}/libexec/ceph/ceph-osd-prestart.sh --cluster ${cfg.clusterName} --id ${toString osdConfig.id} - ''; - - serviceConfig = let - clusterIpArg = lib.optionalString (osdConfig.clusterAddress != null) "--cluster_addr=${osdConfig.clusterAddress}"; - in { - LimitNOFILE="1048576"; - LimitNPROC="1048576"; - - ExecStart='' - ${cfg.package}/bin/ceph-osd -f --cluster ${cfg.clusterName} --id ${toString osdConfig.id} --setuser ${config.users.users.ceph.name} --setgroup ${config.users.groups.ceph.name} "--public_bind_addr=${cfg.osdBindAddr}" "--public_addr=${cfg.osdAdvertisedPublicAddr}" "${clusterIpArg}" + preStart = '' + ${ensureTransientCephDirs} + ${lib.getLib cfg.package}/libexec/ceph/ceph-osd-prestart.sh --cluster ${cfg.clusterName} --id ${toString osdConfig.id} ''; - ExecReload='' - ${pkgs.coreutils}/bin/kill -HUP $MAINPID - ''; - Restart="on-failure"; - ProtectHome="true"; - ProtectSystem="full"; - PrivateTmp="true"; - TasksMax="infinity"; - # StartLimitBurst="3"; + + serviceConfig = + let + clusterIpArg = lib.optionalString (osdConfig.clusterAddress != null) "--cluster_addr=${osdConfig.clusterAddress}"; + in + { + LimitNOFILE = "1048576"; + LimitNPROC = "1048576"; + + ExecStart = '' + ${cfg.package}/bin/ceph-osd -f --cluster ${cfg.clusterName} --id ${toString osdConfig.id} --setuser ${config.users.users.ceph.name} --setgroup ${config.users.groups.ceph.name} "--public_bind_addr=${cfg.osdBindAddr}" "--public_addr=${cfg.osdAdvertisedPublicAddr}" "${clusterIpArg}" + ''; + ExecReload = '' + ${pkgs.coreutils}/bin/kill -HUP $MAINPID + ''; + Restart = "on-failure"; + ProtectHome = "true"; + ProtectSystem = "full"; + PrivateTmp = "true"; + TasksMax = "infinity"; + # StartLimitBurst="3"; + }; + # startLimitIntervalSec = 30 * 60; }; - # startLimitIntervalSec = 30 * 60; - }; - in mkIf cfg.enable { - environment.systemPackages = [ cfg.package ]; + in + mkIf cfg.enable { + environment.systemPackages = [ cfg.package ]; - networking.firewall = { - allowedTCPPorts = [ - # Ceph outside of VPN because it is very data heavy and causes packet loss. - # We enable msgr-v2 only because that allows its own on-wire encryption. - 3300 # ceph msgr-v2 - ]; - allowedTCPPortRanges = [ - { from = 6800; to = 7300; } # https://docs.ceph.com/en/pacific/rados/configuration/network-config-ref/ - ]; - }; + networking.firewall = { + allowedTCPPorts = [ + # Ceph outside of VPN because it is very data heavy and causes packet loss. + # We enable msgr-v2 only because that allows its own on-wire encryption. + 3300 # ceph msgr-v2 + ]; + allowedTCPPortRanges = [ + { from = 6800; to = 7300; } # https://docs.ceph.com/en/pacific/rados/configuration/network-config-ref/ + ]; + }; - # Reminder of how `ceph.conf` works: - # - # * Ceph upstream docs now recommend to use underscores instead of spaces. - # * Options in more specific sections like `[mon]` override those in less - # specific sections like `[global]`. But all options can be written into all sections, - # and an option has the same name, no matter in which section it is written. - # Thus, put options in `[global]`, and only use a diffent section - # if you want to override an option you've set in `global`. - # - # Sample: https://github.com/ceph/ceph/blob/master/src/sample.ceph.conf - environment.etc."ceph/${cfg.clusterName}.conf".text = - '' - [global] - fsid = ${cfg.fsid} - mon_initial_members = ${commaSep (map (mon: mon.hostname) cfg.initialMonitors)} - mon_host = ${commaSep (map (mon: mon.ipAddress) cfg.initialMonitors)} + # Reminder of how `ceph.conf` works: + # + # * Ceph upstream docs now recommend to use underscores instead of spaces. + # * Options in more specific sections like `[mon]` override those in less + # specific sections like `[global]`. But all options can be written into all sections, + # and an option has the same name, no matter in which section it is written. + # Thus, put options in `[global]`, and only use a diffent section + # if you want to override an option you've set in `global`. + # + # Sample: https://github.com/ceph/ceph/blob/master/src/sample.ceph.conf + environment.etc."ceph/${cfg.clusterName}.conf".text = + '' + [global] + fsid = ${cfg.fsid} + mon_initial_members = ${commaSep (map (mon: mon.hostname) cfg.initialMonitors)} + mon_host = ${commaSep (map (mon: mon.ipAddress) cfg.initialMonitors)} - # Ceph clusters go into WARN health mode, until - # the following setting is made strict by setting it to `false`: - # See: https://docs.ceph.com/en/latest/security/CVE-2021-20288/#recommendations - # As of writing, this setting is not documented outside of the CVE note :( - # - # While for new clusters the warning no longer seems to appear, it still - # appears in our existing clusters unless this option is set, see: - # https://tracker.ceph.com/issues/53751#note-7 - auth_allow_insecure_global_id_reclaim = false + # Ceph clusters go into WARN health mode, until + # the following setting is made strict by setting it to `false`: + # See: https://docs.ceph.com/en/latest/security/CVE-2021-20288/#recommendations + # As of writing, this setting is not documented outside of the CVE note :( + # + # While for new clusters the warning no longer seems to appear, it still + # appears in our existing clusters unless this option is set, see: + # https://tracker.ceph.com/issues/53751#note-7 + auth_allow_insecure_global_id_reclaim = false - # Disable dirfrag prefetch on MDS restart to prevent out-of-memory after - # many files were opened. - # Note this option has no effect on Ceph < 15, because it doesn't exist there. - # TODO: Remove this once we're on a Ceph version that includes this default, - # see https://github.com/ceph/ceph/pull/44667. - # This is assuming that the commit fixes existing clusters, see - # https://github.com/ceph/ceph/pull/44667#issuecomment-1036103397 - # If it doesn't this can only be removed once we have no existing - # cluster with the old default. - mds_oft_prefetch_dirfrags = false + # Disable dirfrag prefetch on MDS restart to prevent out-of-memory after + # many files were opened. + # Note this option has no effect on Ceph < 15, because it doesn't exist there. + # TODO: Remove this once we're on a Ceph version that includes this default, + # see https://github.com/ceph/ceph/pull/44667. + # This is assuming that the commit fixes existing clusters, see + # https://github.com/ceph/ceph/pull/44667#issuecomment-1036103397 + # If it doesn't this can only be removed once we have no existing + # cluster with the old default. + mds_oft_prefetch_dirfrags = false - # Disable sleep between HDD recovery operations, otherwise recovery - # will take forever when small objects (e.g. CephFS files) are on HDD. - # See https://tracker.ceph.com/issues/23595#note-12 - osd_recovery_sleep_hdd = 0.0 + # Disable sleep between HDD recovery operations, otherwise recovery + # will take forever when small objects (e.g. CephFS files) are on HDD. + # See https://tracker.ceph.com/issues/23595#note-12 + osd_recovery_sleep_hdd = 0.0 - # Increase scrub intervals by 4x. - # Since we store many small files on HDD, and scrubbing apparently - # iterates over all objects - # we have no chance to scrub at the default intervals. - # - # (This was written when we had 400M files across 30 HDDs.) - # Change this back once we have reduced our number of files per disk. - osd_scrub_min_interval = 345600 - osd_scrub_max_interval = 2419200 - osd_deep_scrub_interval = 2419200 + # Increase scrub intervals by 4x. + # Since we store many small files on HDD, and scrubbing apparently + # iterates over all objects + # we have no chance to scrub at the default intervals. + # + # (This was written when we had 400M files across 30 HDDs.) + # Change this back once we have reduced our number of files per disk. + osd_scrub_min_interval = 345600 + osd_scrub_max_interval = 2419200 + osd_deep_scrub_interval = 2419200 - public_network = ${commaSep cfg.publicNetworks} - cluster_network = ${commaSep cfg.clusterNetworks} - auth_cluster_required = cephx - auth_service_required = cephx - auth_client_required = cephx + public_network = ${commaSep cfg.publicNetworks} + cluster_network = ${commaSep cfg.clusterNetworks} + auth_cluster_required = cephx + auth_service_required = cephx + auth_client_required = cephx - # Enforce on-wire transport encryption. - ms_cluster_mode = secure - ms_service_mode = secure - ms_client_mode = secure + # Enforce on-wire transport encryption. + ms_cluster_mode = secure + ms_service_mode = secure + ms_client_mode = secure - ${cfg.extraConfig} - ''; + ${cfg.extraConfig} + ''; - environment.etc."ceph/${cfg.clusterName}.client.admin.keyring" = { - source = cfg.adminKeyring; - mode = "0600"; - # Make ceph own this keyring so that it can use it to get keys for its daemons. - user = "ceph"; - group = "ceph"; - }; + environment.etc."ceph/${cfg.clusterName}.client.admin.keyring" = { + source = cfg.adminKeyring; + mode = "0600"; + # Make ceph own this keyring so that it can use it to get keys for its daemons. + user = "ceph"; + group = "ceph"; + }; - users.users.ceph = { - isNormalUser = false; - isSystemUser = true; - # TODO: Legacy UID / GID chosen from before we configured the UID declaratively. - # In the future, we whould change this whole module to use - # `config.ids.uids.ceph`, like the upstream nixpkgs Ceph module does. - # Switching away from `nogroup` would also be good as described there. - # For both cases, we'll have to `chown` all relevant existing files on - # deployments, such as `/var/lib/ceph`, and log files. - uid = 1001; - group = config.users.groups.nogroup.name; - }; - users.groups.ceph = { - # TODO: Same TODO as above for the `uid`. - gid = 499; - }; + users.users.ceph = { + isNormalUser = false; + isSystemUser = true; + # TODO: Legacy UID / GID chosen from before we configured the UID declaratively. + # In the future, we whould change this whole module to use + # `config.ids.uids.ceph`, like the upstream nixpkgs Ceph module does. + # Switching away from `nogroup` would also be good as described there. + # For both cases, we'll have to `chown` all relevant existing files on + # deployments, such as `/var/lib/ceph`, and log files. + uid = 1001; + group = config.users.groups.nogroup.name; + }; + users.groups.ceph = { + # TODO: Same TODO as above for the `uid`. + gid = 499; + }; - # Allow ceph daemons (which run as user ceph) to collect device health metrics. - security.sudo.extraRules = - map ({ sudoersExtraRule, ... }: sudoersExtraRule) cephMonitoringSudoersCommandsAndPackages; + # Allow ceph daemons (which run as user ceph) to collect device health metrics. + security.sudo.extraRules = + map ({ sudoersExtraRule, ... }: sudoersExtraRule) cephMonitoringSudoersCommandsAndPackages; - # The udevadm trigger/settle in `makeCephOsdSetupSystemdService` waits for these rules rule to be applied. - services.udev.extraRules = - lib.concatStringsSep "\n" ( - lib.mapAttrsToList (_localOsdServiceName: osdConfig: - '' - SUBSYSTEM=="block", ${osdConfig.blockDeviceUdevRuleMatcher}, OWNER="${config.users.users.ceph.name}", GROUP="${config.users.groups.ceph.name}", MODE="0660" - '' - + lib.optionalString (osdConfig.dbBlockDeviceUdevRuleMatcher != null) ( + # The udevadm trigger/settle in `makeCephOsdSetupSystemdService` waits for these rules rule to be applied. + services.udev.extraRules = + lib.concatStringsSep "\n" ( + lib.mapAttrsToList + (_localOsdServiceName: osdConfig: '' - SUBSYSTEM=="block", ${osdConfig.dbBlockDeviceUdevRuleMatcher}, OWNER="${config.users.users.ceph.name}", GROUP="${config.users.groups.ceph.name}", MODE="0660" + SUBSYSTEM=="block", ${osdConfig.blockDeviceUdevRuleMatcher}, OWNER="${config.users.users.ceph.name}", GROUP="${config.users.groups.ceph.name}", MODE="0660" '' + + lib.optionalString (osdConfig.dbBlockDeviceUdevRuleMatcher != null) ( + '' + SUBSYSTEM=="block", ${osdConfig.dbBlockDeviceUdevRuleMatcher}, OWNER="${config.users.users.ceph.name}", GROUP="${config.users.groups.ceph.name}", MODE="0660" + '' + ) ) - ) cfg.osds - ); + cfg.osds + ); - systemd.services = { + systemd.services = { - ceph-mon-setup = mkIf cfg.monitor.enable { - description = "Initialize ceph monitor"; + ceph-mon-setup = mkIf cfg.monitor.enable { + description = "Initialize ceph monitor"; - preStart = ensureCephDirs; + preStart = ensureCephDirs; - script = let - # `--addv` seems currently required to get msgr-v2 working, see: - # https://tracker.ceph.com/issues/53751#note-11 - monmapNodes = builtins.concatStringsSep " " (lib.concatMap (mon: [ "--addv" mon.hostname "[v2:${mon.ipAddress}:3300,v1:${mon.ipAddress}:6789]" ]) cfg.initialMonitors); - # Monitors cannot simply be changed in config, one has to update the monmap, see note [replacing-ceph-monmap-ips-for-existing-cluster] - in '' - set -euo pipefail - rm -rf "${monDir}" # Start from scratch. - echo "Initializing monitor." - MONMAP_DIR=`mktemp -d` - ${cfg.package}/bin/monmaptool --create ${monmapNodes} --fsid ${cfg.fsid} "$MONMAP_DIR/monmap" - ${cfg.package}/bin/ceph-mon --cluster ${cfg.clusterName} --mkfs -i ${cfg.monitor.nodeName} --monmap "$MONMAP_DIR/monmap" --keyring ${cfg.monitor.initialKeyring} - rm -r "$MONMAP_DIR" - touch ${monDir}/done - ''; + script = + let + # `--addv` seems currently required to get msgr-v2 working, see: + # https://tracker.ceph.com/issues/53751#note-11 + monmapNodes = builtins.concatStringsSep " " (lib.concatMap (mon: [ "--addv" mon.hostname "[v2:${mon.ipAddress}:3300,v1:${mon.ipAddress}:6789]" ]) cfg.initialMonitors); + # Monitors cannot simply be changed in config, one has to update the monmap, see note [replacing-ceph-monmap-ips-for-existing-cluster] + in + '' + set -euo pipefail + rm -rf "${monDir}" # Start from scratch. + echo "Initializing monitor." + MONMAP_DIR=`mktemp -d` + ${cfg.package}/bin/monmaptool --create ${monmapNodes} --fsid ${cfg.fsid} "$MONMAP_DIR/monmap" + ${cfg.package}/bin/ceph-mon --cluster ${cfg.clusterName} --mkfs -i ${cfg.monitor.nodeName} --monmap "$MONMAP_DIR/monmap" --keyring ${cfg.monitor.initialKeyring} + rm -r "$MONMAP_DIR" + touch ${monDir}/done + ''; - serviceConfig = { - Type = "oneshot"; - RemainAfterExit = true; - PermissionsStartOnly = true; # only run the script as ceph - User = config.users.users.ceph.name; - Group = config.users.groups.ceph.name; + serviceConfig = { + Type = "oneshot"; + RemainAfterExit = true; + PermissionsStartOnly = true; # only run the script as ceph + User = config.users.users.ceph.name; + Group = config.users.groups.ceph.name; + }; + unitConfig = { + ConditionPathExists = "!${monDir}/done"; + }; }; - unitConfig = { - ConditionPathExists = "!${monDir}/done"; + + ceph-mon = mkIf cfg.monitor.enable { + description = "Ceph monitor"; + + requires = [ (ensureUnitExists config "ceph-mon-setup.service") ]; + requiredBy = [ "multi-user.target" ]; + after = [ "network.target" "local-fs.target" "time-sync.target" (ensureUnitExists config "ceph-mon-setup.service") ]; + wants = [ "network.target" "local-fs.target" "time-sync.target" ]; + + restartTriggers = [ config.environment.etc."ceph/${cfg.clusterName}.conf".source ]; + + path = cephDeviceHealthMonitoringPathsOrPackages; + + preStart = ensureTransientCephDirs; + + serviceConfig = { + LimitNOFILE = "1048576"; + LimitNPROC = "1048576"; + ExecStart = '' + ${cfg.package}/bin/ceph-mon -f --cluster ${cfg.clusterName} --id ${cfg.monitor.nodeName} --setuser ${config.users.users.ceph.name} --setgroup ${config.users.groups.ceph.name} "--public_bind_addr=${cfg.monitor.bindAddr}" "--public_addr=${cfg.monitor.advertisedPublicAddr}" + ''; + ExecReload = '' + ${pkgs.coreutils}/bin/kill -HUP $MAINPID + ''; + PrivateDevices = "yes"; + ProtectHome = "true"; + ProtectSystem = "full"; + PrivateTmp = "true"; + TasksMax = "infinity"; + Restart = "on-failure"; + # StartLimitBurst="5"; + RestartSec = "10"; + }; + # startLimitIntervalSec = 30 * 60; }; - }; - ceph-mon = mkIf cfg.monitor.enable { - description = "Ceph monitor"; + ceph-mgr-setup = mkIf cfg.manager.enable { + description = "Initialize Ceph manager"; - requires = [ (ensureUnitExists config "ceph-mon-setup.service") ]; - requiredBy = [ "multi-user.target" ]; - after = [ "network.target" "local-fs.target" "time-sync.target" (ensureUnitExists config "ceph-mon-setup.service") ]; - wants = [ "network.target" "local-fs.target" "time-sync.target" ]; + preStart = ensureCephDirs; - restartTriggers = [ config.environment.etc."ceph/${cfg.clusterName}.conf".source ]; - - path = cephDeviceHealthMonitoringPathsOrPackages; - - preStart = ensureTransientCephDirs; - - serviceConfig = { - LimitNOFILE="1048576"; - LimitNPROC="1048576"; - ExecStart='' - ${cfg.package}/bin/ceph-mon -f --cluster ${cfg.clusterName} --id ${cfg.monitor.nodeName} --setuser ${config.users.users.ceph.name} --setgroup ${config.users.groups.ceph.name} "--public_bind_addr=${cfg.monitor.bindAddr}" "--public_addr=${cfg.monitor.advertisedPublicAddr}" + script = '' + set -euo pipefail + mkdir -p ${mgrDir} + until [ -f /etc/ceph/${cfg.clusterName}.client.admin.keyring ] + do + sleep 1 + done + ${cfg.package}/bin/ceph auth get-or-create mgr.${cfg.manager.nodeName} mon 'allow profile mgr' mds 'allow *' osd 'allow *' -o ${mgrDir}/keyring + touch "${mgrDir}/.nix_done" ''; - ExecReload='' - ${pkgs.coreutils}/bin/kill -HUP $MAINPID + + serviceConfig = { + Type = "oneshot"; + RemainAfterExit = true; + PermissionsStartOnly = true; # only run the script as ceph + User = config.users.users.ceph.name; + Group = config.users.groups.ceph.name; + }; + unitConfig = { + ConditionPathExists = "!${mgrDir}/.nix_done"; + }; + }; + + ceph-mgr = mkIf cfg.manager.enable { + description = "Ceph manager"; + + requires = [ (ensureUnitExists config "ceph-mgr-setup.service") ]; + requiredBy = [ "multi-user.target" ]; + after = [ "network.target" "local-fs.target" "time-sync.target" (ensureUnitExists config "ceph-mgr-setup.service") ]; + wants = [ "network.target" "local-fs.target" "time-sync.target" ]; + + restartTriggers = [ config.environment.etc."ceph/${cfg.clusterName}.conf".source ]; + + preStart = ensureTransientCephDirs; + + serviceConfig = { + LimitNOFILE = "1048576"; + LimitNPROC = "1048576"; + + ExecStart = '' + ${cfg.package}/bin/ceph-mgr -f --cluster ${cfg.clusterName} --id ${cfg.manager.nodeName} --setuser ${config.users.users.ceph.name} --setgroup ${config.users.groups.ceph.name} + ''; + ExecReload = '' + ${pkgs.coreutils}/bin/kill -HUP $MAINPID + ''; + Restart = "on-failure"; + RestartSec = 10; + # StartLimitBurst="3"; + }; + # startLimitIntervalSec = 30 * 60; + }; + + ceph-mds-setup = mkIf cfg.mds.enable { + description = "Initialize Ceph MDS"; + + preStart = ensureCephDirs; + + script = '' + set -euo pipefail + mkdir -p ${mdsDir} + until [ -f /etc/ceph/${cfg.clusterName}.client.admin.keyring ] + do + sleep 1 + done + ${cfg.package}/bin/ceph auth get-or-create mds.${cfg.mds.nodeName} osd 'allow rwx' mds 'allow' mon 'allow profile mds' -o ${mdsDir}/keyring + touch "${mdsDir}/.nix_done" ''; - PrivateDevices="yes"; - ProtectHome="true"; - ProtectSystem="full"; - PrivateTmp="true"; - TasksMax="infinity"; - Restart="on-failure"; - # StartLimitBurst="5"; - RestartSec="10"; + + serviceConfig = { + Type = "oneshot"; + RemainAfterExit = true; + PermissionsStartOnly = true; # only run the script as ceph + User = config.users.users.ceph.name; + Group = config.users.groups.ceph.name; + }; + unitConfig = { + ConditionPathExists = "!${mdsDir}/.nix_done"; + }; }; - # startLimitIntervalSec = 30 * 60; - }; - ceph-mgr-setup = mkIf cfg.manager.enable { - description = "Initialize Ceph manager"; + ceph-mds = mkIf cfg.mds.enable { + description = "Ceph MDS"; - preStart = ensureCephDirs; + requires = [ (ensureUnitExists config "ceph-mds-setup.service") ]; + requiredBy = [ "multi-user.target" ]; + after = [ "network.target" "local-fs.target" "time-sync.target" (ensureUnitExists config "ceph-mds-setup.service") ]; + wants = [ "network.target" "local-fs.target" "time-sync.target" ]; - script = '' - set -euo pipefail - mkdir -p ${mgrDir} - until [ -f /etc/ceph/${cfg.clusterName}.client.admin.keyring ] - do - sleep 1 - done - ${cfg.package}/bin/ceph auth get-or-create mgr.${cfg.manager.nodeName} mon 'allow profile mgr' mds 'allow *' osd 'allow *' -o ${mgrDir}/keyring - touch "${mgrDir}/.nix_done" - ''; + restartTriggers = [ config.environment.etc."ceph/${cfg.clusterName}.conf".source ]; - serviceConfig = { - Type = "oneshot"; - RemainAfterExit = true; - PermissionsStartOnly = true; # only run the script as ceph - User = config.users.users.ceph.name; - Group = config.users.groups.ceph.name; + preStart = ensureTransientCephDirs; + + serviceConfig = { + LimitNOFILE = "1048576"; + LimitNPROC = "1048576"; + + ExecStart = '' + ${cfg.package}/bin/ceph-mds -f --cluster ${cfg.clusterName} --id ${cfg.mds.nodeName} --setuser ${config.users.users.ceph.name} --setgroup ${config.users.groups.ceph.name} "--public_addr=${cfg.mds.listenAddr}" + ''; + ExecReload = '' + ${pkgs.coreutils}/bin/kill -HUP $MAINPID + ''; + Restart = "on-failure"; + # StartLimitBurst="3"; + }; + # startLimitIntervalSec = 30 * 60; }; - unitConfig = { - ConditionPathExists = "!${mgrDir}/.nix_done"; - }; - }; - ceph-mgr = mkIf cfg.manager.enable { - description = "Ceph manager"; - - requires = [ (ensureUnitExists config "ceph-mgr-setup.service") ]; - requiredBy = [ "multi-user.target" ]; - after = [ "network.target" "local-fs.target" "time-sync.target" (ensureUnitExists config "ceph-mgr-setup.service") ]; - wants = [ "network.target" "local-fs.target" "time-sync.target" ]; - - restartTriggers = [ config.environment.etc."ceph/${cfg.clusterName}.conf".source ]; - - preStart = ensureTransientCephDirs; - - serviceConfig = { - LimitNOFILE="1048576"; - LimitNPROC="1048576"; - - ExecStart='' - ${cfg.package}/bin/ceph-mgr -f --cluster ${cfg.clusterName} --id ${cfg.manager.nodeName} --setuser ${config.users.users.ceph.name} --setgroup ${config.users.groups.ceph.name} - ''; - ExecReload='' - ${pkgs.coreutils}/bin/kill -HUP $MAINPID - ''; - Restart="on-failure"; - RestartSec=10; - # StartLimitBurst="3"; - }; - # startLimitIntervalSec = 30 * 60; - }; - - ceph-mds-setup = mkIf cfg.mds.enable { - description = "Initialize Ceph MDS"; - - preStart = ensureCephDirs; - - script = '' - set -euo pipefail - mkdir -p ${mdsDir} - until [ -f /etc/ceph/${cfg.clusterName}.client.admin.keyring ] - do - sleep 1 - done - ${cfg.package}/bin/ceph auth get-or-create mds.${cfg.mds.nodeName} osd 'allow rwx' mds 'allow' mon 'allow profile mds' -o ${mdsDir}/keyring - touch "${mdsDir}/.nix_done" - ''; - - serviceConfig = { - Type = "oneshot"; - RemainAfterExit = true; - PermissionsStartOnly = true; # only run the script as ceph - User = config.users.users.ceph.name; - Group = config.users.groups.ceph.name; - }; - unitConfig = { - ConditionPathExists = "!${mdsDir}/.nix_done"; - }; - }; - - ceph-mds = mkIf cfg.mds.enable { - description = "Ceph MDS"; - - requires = [ (ensureUnitExists config "ceph-mds-setup.service") ]; - requiredBy = [ "multi-user.target" ]; - after = [ "network.target" "local-fs.target" "time-sync.target" (ensureUnitExists config "ceph-mds-setup.service") ]; - wants = [ "network.target" "local-fs.target" "time-sync.target" ]; - - restartTriggers = [ config.environment.etc."ceph/${cfg.clusterName}.conf".source ]; - - preStart = ensureTransientCephDirs; - - serviceConfig = { - LimitNOFILE="1048576"; - LimitNPROC="1048576"; - - ExecStart='' - ${cfg.package}/bin/ceph-mds -f --cluster ${cfg.clusterName} --id ${cfg.mds.nodeName} --setuser ${config.users.users.ceph.name} --setgroup ${config.users.groups.ceph.name} "--public_addr=${cfg.mds.listenAddr}" - ''; - ExecReload='' - ${pkgs.coreutils}/bin/kill -HUP $MAINPID - ''; - Restart="on-failure"; - # StartLimitBurst="3"; - }; - # startLimitIntervalSec = 30 * 60; - }; - - } + } # Make one OSD service for each configured OSD. // lib.mapAttrs' (localOsdServiceName: osdConfig: nameValuePair "ceph-osd-setup-${localOsdServiceName}" (makeCephOsdSetupSystemdService localOsdServiceName osdConfig)) cfg.osds - // lib.mapAttrs' (localOsdServiceName: osdConfig: nameValuePair "ceph-osd-${localOsdServiceName}" (makeCephOsdSystemdService localOsdServiceName osdConfig)) cfg.osds; - }; + // lib.mapAttrs' (localOsdServiceName: osdConfig: nameValuePair "ceph-osd-${localOsdServiceName}" (makeCephOsdSystemdService localOsdServiceName osdConfig)) cfg.osds; + }; } diff --git a/modules/nixos/container.nix b/modules/nixos/container.nix index 8f17832..0ff5b8c 100644 --- a/modules/nixos/container.nix +++ b/modules/nixos/container.nix @@ -1,76 +1,79 @@ { config, lib, inputs, overlays, ... }: let - cfg = config.greg.containers; + cfg = config.greg.containers; - # Create a container with all our default settings + # Create a container with all our default settings - makeContainer = name: container: let - agekey = "/etc/ssh/agenix_key"; - in { - autoStart = true; - hostAddress = "192.168.${container.subnet}.1"; - localAddress = "192.168.${container.subnet}.2"; - privateNetwork = true; - bindMounts = { - "${agekey}".hostPath = "/etc/ssh/ssh_host_ed25519_key"; # This is needed for agenix to - }; - enableTun = container.tailscale; - config = { config, pkgs, ... }: { - imports = [ - inputs.agenix.nixosModules.default - inputs.self.modules.nixosModule - container.builder - ]; + makeContainer = name: container: + let + agekey = "/etc/ssh/agenix_key"; + in + { + autoStart = true; + hostAddress = "192.168.${container.subnet}.1"; + localAddress = "192.168.${container.subnet}.2"; + privateNetwork = true; + bindMounts = { + "${agekey}".hostPath = "/etc/ssh/ssh_host_ed25519_key"; # This is needed for agenix to + }; + enableTun = container.tailscale; + config = { config, pkgs, ... }: { + imports = [ + inputs.agenix.nixosModules.default + inputs.self.modules.nixosModule + container.builder + ]; - nixpkgs.overlays = overlays; + nixpkgs.overlays = overlays; - networking = { - firewall.enable = true; - useHostResolvConf = lib.mkForce false; - }; + networking = { + firewall.enable = true; + useHostResolvConf = lib.mkForce false; + }; - age.identityPaths = [ agekey ]; + age.identityPaths = [ agekey ]; - greg.tailscale.enable = container.tailscale; - }; - }; -in { - options.greg.containers = lib.mkOption { - default = {}; + greg.tailscale.enable = container.tailscale; + }; + }; +in +{ + options.greg.containers = lib.mkOption { + default = { }; - type = with lib.types; attrsOf ( submodule ( - { - options = { - tailscale = lib.mkOption { - type = bool; - default = false; - description = "Enable tailscale in the container"; - }; - subnet = lib.mkOption { - type = str; - default = "200"; - }; - builder = lib.mkOption { - default = { ... }: {}; - description = '' - This needs to be a function, like the one for - a container's config. It will setup the core system above the - defaults set in this module. - ''; - example = '' - { pkgs, config, lib, ... } : - { - services.openssh.enable = true; - } - ''; - }; - }; - } - )); - }; + type = with lib.types; attrsOf (submodule ( + { + options = { + tailscale = lib.mkOption { + type = bool; + default = false; + description = "Enable tailscale in the container"; + }; + subnet = lib.mkOption { + type = str; + default = "200"; + }; + builder = lib.mkOption { + default = { ... }: { }; + description = '' + This needs to be a function, like the one for + a container's config. It will setup the core system above the + defaults set in this module. + ''; + example = '' + { pkgs, config, lib, ... } : + { + services.openssh.enable = true; + } + ''; + }; + }; + } + )); + }; - config = { - containers = builtins.mapAttrs makeContainer cfg; - }; + config = { + containers = builtins.mapAttrs makeContainer cfg; + }; } diff --git a/modules/nixos/db.nix b/modules/nixos/db.nix index 8bf1097..b9cd8ef 100644 --- a/modules/nixos/db.nix +++ b/modules/nixos/db.nix @@ -1,63 +1,64 @@ { config, lib, pkgs, ... }: let - cfg = config.greg.databases; - dbs = (lib.attrNames cfg); -in { - options.greg.databases = lib.mkOption { - default = {}; - type = with lib.types; attrsOf ( submodule ( - { name, config, options, ... }: { - # Options reserved for future expansion - options = {}; - } - )); - }; + cfg = config.greg.databases; + dbs = (lib.attrNames cfg); +in +{ + options.greg.databases = lib.mkOption { + default = { }; + type = with lib.types; attrsOf (submodule ( + { name, config, options, ... }: { + # Options reserved for future expansion + options = { }; + } + )); + }; - config = lib.mkIf ( dbs != [] ) { - services = { - postgresql = { - enable = true; - package = pkgs.postgresql_15; - checkConfig = true; - ensureDatabases = dbs; - ensureUsers = map (db: { name = db; ensureDBOwnership = true; }) dbs; - settings = { - log_connections = true; - log_statement = "all"; - logging_collector = true; - log_filename = "postgresql.log"; - }; - identMap = "root root postgres"; - }; + config = lib.mkIf (dbs != [ ]) { + services = { + postgresql = { + enable = true; + package = pkgs.postgresql_15; + checkConfig = true; + ensureDatabases = dbs; + ensureUsers = map (db: { name = db; ensureDBOwnership = true; }) dbs; + settings = { + log_connections = true; + log_statement = "all"; + logging_collector = true; + log_filename = "postgresql.log"; + }; + identMap = "root root postgres"; + }; - postgresqlBackup = { - enable = true; - databases = dbs; - }; + postgresqlBackup = { + enable = true; + databases = dbs; + }; - logrotate = { - enable = true; - settings = { - postgresqlBackup = { - enable = true; - files = "${config.services.postgresqlBackup.location}/*.gz"; - }; - postgresLog = { - enable = true; - files = "/var/lib/postgresql/*/log/*.log"; - compress = true; - compresscmd = "${pkgs.xz}/bin/xz"; - }; - }; - }; + logrotate = { + enable = true; + settings = { + postgresqlBackup = { + enable = true; + files = "${config.services.postgresqlBackup.location}/*.gz"; + }; + postgresLog = { + enable = true; + files = "/var/lib/postgresql/*/log/*.log"; + compress = true; + compresscmd = "${pkgs.xz}/bin/xz"; + }; + }; + }; - }; + }; - greg.backup.jobs.greg-postgresql-backup = { - src = config.services.postgresqlBackup.location; - dest = "database-${config.networking.hostName}"; - id = "${config.networking.hostName}-postgres-backup"; - }; - }; + greg.backup.jobs.greg-postgresql-backup = { + src = config.services.postgresqlBackup.location; + dest = "database-${config.networking.hostName}"; + id = "${config.networking.hostName}-postgres-backup"; + }; + }; } diff --git a/modules/nixos/default.nix b/modules/nixos/default.nix index acf33e5..15c5d9b 100644 --- a/modules/nixos/default.nix +++ b/modules/nixos/default.nix @@ -1,94 +1,96 @@ { config, pkgs, inputs, lib, ... }: let - x = if builtins.hasAttr "xonsh-unwrapped" pkgs then - pkgs.xonsh else - pkgs.xonsh.passthru.wrapper; -in { - imports = [ - ../baseline.nix - ./backup.nix - ./ceph.nix - ./container.nix - ./db.nix - ./gnome.nix - ./home.nix - ./kde.nix - ./kiwix-serve.nix - ./linode.nix - ./print.nix - ./proxy.nix - ./router.nix - ./rpi4.nix - ./sway.nix - ./syncthing.nix - ./tailscale.nix - ./vmdev.nix - ]; + x = + if builtins.hasAttr "xonsh-unwrapped" pkgs then + pkgs.xonsh else + pkgs.xonsh.passthru.wrapper; +in +{ + imports = [ + ../baseline.nix + ./backup.nix + ./ceph.nix + ./container.nix + ./db.nix + ./gnome.nix + ./home.nix + ./kde.nix + ./kiwix-serve.nix + ./linode.nix + ./print.nix + ./proxy.nix + ./router.nix + ./rpi4.nix + ./sway.nix + ./syncthing.nix + ./tailscale.nix + ./vmdev.nix + ]; - environment.sessionVariables.MOZ_ENABLE_WAYLAND = "0"; - environment.systemPackages = with pkgs; [ - btrfs-progs - coreutils-full - efibootmgr - psmisc - lshw - usbutils - xfsprogs - ]; + environment.sessionVariables.MOZ_ENABLE_WAYLAND = "0"; + environment.systemPackages = with pkgs; [ + btrfs-progs + coreutils-full + efibootmgr + psmisc + lshw + usbutils + xfsprogs + ]; - system.stateVersion = "24.05"; + system.stateVersion = "24.05"; - nix = { - gc.dates = "weekly"; - settings.auto-optimise-store = true; - }; + nix = { + gc.dates = "weekly"; + settings.auto-optimise-store = true; + }; - # I am a fan of network manager, myself - networking = { - search = [ - "thehellings.lan" - "home" - ]; - networkmanager.enable = true; - }; + # I am a fan of network manager, myself + networking = { + search = [ + "thehellings.lan" + "home" + ]; + networkmanager.enable = true; + }; - programs.xonsh = { - enable = true; - package = (x.override { - extraPackages = (ps: with ps; [ - (ps.toPythonModule pkgs.pipenv) - pyyaml - requests - ruamel-yaml - xonsh-apipenv - pkgs.nur.repos.xonsh-xontribs.xonsh-direnv - pkgs.nur.repos.xonsh-xontribs.xontrib-vox - ]); - }); - }; + programs.xonsh = { + enable = true; + package = (x.override { + extraPackages = (ps: with ps; [ + (ps.toPythonModule pkgs.pipenv) + pyyaml + requests + ruamel-yaml + xonsh-apipenv + pkgs.nur.repos.xonsh-xontribs.xonsh-direnv + pkgs.nur.repos.xonsh-xontribs.xontrib-vox + ]); + }); + }; - # Enable the OpenSSH daemon for remote control - services = { - openssh = { - enable = true; - settings.X11Forwarding = true; - }; - }; + # Enable the OpenSSH daemon for remote control + services = { + openssh = { + enable = true; + settings.X11Forwarding = true; + }; + }; - # Define a user account. Don't forget to set a password with ‘passwd’. - users.users.greg = { - isNormalUser = true; - createHome = true; - extraGroups = [ "wheel" "networkmanager" ]; # Enable ‘sudo’ for the user. - shell = config.programs.xonsh.package; - openssh.authorizedKeys.keys = lib.strings.splitString "\n" (builtins.readFile ../../home/ssh/authorized_keys); - }; + # Define a user account. Don't forget to set a password with ‘passwd’. + users.users.greg = { + isNormalUser = true; + createHome = true; + extraGroups = [ "wheel" "networkmanager" ]; # Enable ‘sudo’ for the user. + shell = config.programs.xonsh.package; + openssh.authorizedKeys.keys = lib.strings.splitString "\n" (builtins.readFile ../../home/ssh/authorized_keys); + }; - i18n.defaultLocale = "en_US.UTF-8"; + i18n.defaultLocale = "en_US.UTF-8"; - console = { - font = "Lat2-Terminus16"; - keyMap = "us"; - }; + console = { + font = "Lat2-Terminus16"; + keyMap = "us"; + }; } diff --git a/modules/nixos/gnome.nix b/modules/nixos/gnome.nix index 9ad3c54..1b4a385 100644 --- a/modules/nixos/gnome.nix +++ b/modules/nixos/gnome.nix @@ -1,64 +1,65 @@ { config, pkgs, lib, ... }: let - cfg = config.greg.gnome; + cfg = config.greg.gnome; -in with lib; { - options = { - greg.gnome.enable = mkEnableOption "Enable my default Gnome3 setup"; - }; +in +with lib; { + options = { + greg.gnome.enable = mkEnableOption "Enable my default Gnome3 setup"; + }; - config = mkIf cfg.enable { - # Sets up a basic Gnome installation - services = { - accounts-daemon.enable = true; + config = mkIf cfg.enable { + # Sets up a basic Gnome installation + services = { + accounts-daemon.enable = true; - # Trackpad support - libinput.enable = true; + # Trackpad support + libinput.enable = true; - xserver = { - enable = true; - displayManager.gdm.enable = true; - desktopManager.gnome.enable = true; - xkb.layout = "us"; - }; + xserver = { + enable = true; + displayManager.gdm.enable = true; + desktopManager.gnome.enable = true; + xkb.layout = "us"; + }; - udev.packages = with pkgs; [ - gnome-settings-daemon - ]; + udev.packages = with pkgs; [ + gnome-settings-daemon + ]; - pipewire.enable = true; + pipewire.enable = true; - # Enablement for Firefox - gnome = { - gnome-browser-connector.enable = true; - #chrome-gnome-shell.enable = true; - sushi.enable = true; - gnome-online-accounts.enable = true; - }; - }; + # Enablement for Firefox + gnome = { + gnome-browser-connector.enable = true; + #chrome-gnome-shell.enable = true; + sushi.enable = true; + gnome-online-accounts.enable = true; + }; + }; - programs.dconf.enable = true; - xdg.portal = { - enable = true; - wlr.enable = true; # Enables screen sharing in Wayland - }; + programs.dconf.enable = true; + xdg.portal = { + enable = true; + wlr.enable = true; # Enables screen sharing in Wayland + }; - # Used by gsconnect - networking.firewall.allowedTCPPorts = [ 1716 ]; + # Used by gsconnect + networking.firewall.allowedTCPPorts = [ 1716 ]; - # Enable some Gnome plugins that I like - environment.systemPackages = with pkgs; [ - adwaita-icon-theme - gnome-tweaks - dconf-editor - gnomeExtensions.appindicator - gnomeExtensions.clipboard-indicator - gnomeExtensions.dash-to-dock - gnomeExtensions.gsconnect - gnomeExtensions.stocks-extension - gnomeExtensions.tailscale-qs - gnomeExtensions.vitals - ]; - }; + # Enable some Gnome plugins that I like + environment.systemPackages = with pkgs; [ + adwaita-icon-theme + gnome-tweaks + dconf-editor + gnomeExtensions.appindicator + gnomeExtensions.clipboard-indicator + gnomeExtensions.dash-to-dock + gnomeExtensions.gsconnect + gnomeExtensions.stocks-extension + gnomeExtensions.tailscale-qs + gnomeExtensions.vitals + ]; + }; } diff --git a/modules/nixos/home.nix b/modules/nixos/home.nix index 8040dce..4c9c8aa 100644 --- a/modules/nixos/home.nix +++ b/modules/nixos/home.nix @@ -1,18 +1,19 @@ { config, lib, ... }: let - cfg = config.greg.home; + cfg = config.greg.home; -in with lib; +in +with lib; { - options.greg.home = mkOption { - type = types.bool; - default = true; - description = "Sets the device up to be part of my home network"; - }; + options.greg.home = mkOption { + type = types.bool; + default = true; + description = "Sets the device up to be part of my home network"; + }; - config = mkIf cfg { - time.timeZone = "America/Chicago"; - networking.domain = "thehellings.lan"; - }; + config = mkIf cfg { + time.timeZone = "America/Chicago"; + networking.domain = "thehellings.lan"; + }; } diff --git a/modules/nixos/kde.nix b/modules/nixos/kde.nix index 685edb8..9b08a21 100644 --- a/modules/nixos/kde.nix +++ b/modules/nixos/kde.nix @@ -1,48 +1,49 @@ { config, pkgs, lib, options, ... }: let - cfg = config.greg.kde; + cfg = config.greg.kde; -in with lib; { - options = { - greg.kde.enable = mkEnableOption "Enable my default KDE setup"; - }; +in +with lib; { + options = { + greg.kde.enable = mkEnableOption "Enable my default KDE setup"; + }; - config = mkIf cfg.enable { - # Sets up a basic KDE installation - services = { - xserver = { - enable = true; - xkb.layout = "us"; - # Trackpad support - libinput.enable = true; - }; + config = mkIf cfg.enable { + # Sets up a basic KDE installation + services = { + xserver = { + enable = true; + xkb.layout = "us"; + # Trackpad support + libinput.enable = true; + }; - pipewire = { - enable = true; - alsa.enable = true; - alsa.support32Bit = true; - pulse.enable = true; - }; - } // (optionalAttrs (builtins.hasAttr "plasma6" options.services.xserver.desktopManager) { - desktopManager.plasma6.enable = true; - displayManager = { - defaultSession = "plasma"; - sddm.enable = true; - }; - }); + pipewire = { + enable = true; + alsa.enable = true; + alsa.support32Bit = true; + pulse.enable = true; + }; + } // (optionalAttrs (builtins.hasAttr "plasma6" options.services.xserver.desktopManager) { + desktopManager.plasma6.enable = true; + displayManager = { + defaultSession = "plasma"; + sddm.enable = true; + }; + }); - programs.dconf.enable = true; - programs.sway.enable = true; # Gives us Wayland - xdg.portal = { - enable = true; - wlr.enable = true; # Enables screen sharing in Wayland - }; + programs.dconf.enable = true; + programs.sway.enable = true; # Gives us Wayland + xdg.portal = { + enable = true; + wlr.enable = true; # Enables screen sharing in Wayland + }; - environment.systemPackages = with pkgs; [ - kalendar - korganizer - plasma-pa - ]; - }; + environment.systemPackages = with pkgs; [ + kalendar + korganizer + plasma-pa + ]; + }; } diff --git a/modules/nixos/kiwix-serve.nix b/modules/nixos/kiwix-serve.nix index ef714a2..3565dd5 100644 --- a/modules/nixos/kiwix-serve.nix +++ b/modules/nixos/kiwix-serve.nix @@ -1,48 +1,49 @@ -{ config, pkgs, lib, ... }: +{ config, pkgs, lib, ... }: let - cfg = config.services.kiwix-serve; -in with lib; { - options.services.kiwix-serve = { - enable = mkEnableOption "Enable the Kiwix web server"; + cfg = config.services.kiwix-serve; +in +with lib; { + options.services.kiwix-serve = { + enable = mkEnableOption "Enable the Kiwix web server"; - port = mkOption { - type = types.int; - default = 8888; - description = "Port to serve the Kiwix HTTP service on"; - }; + port = mkOption { + type = types.int; + default = 8888; + description = "Port to serve the Kiwix HTTP service on"; + }; - path = mkOption { - type = types.str; - default = "/var/lib/kiwix-serve/"; - description = "Path to Zim file(s) to serve"; - }; + path = mkOption { + type = types.str; + default = "/var/lib/kiwix-serve/"; + description = "Path to Zim file(s) to serve"; + }; - proxy = mkOption { - type = types.str; - default = ""; - description = ''Upstream proxy, if any, to configure with kiwix. Specify + proxy = mkOption { + type = types.str; + default = ""; + description = ''Upstream proxy, if any, to configure with kiwix. Specify host and port. E.g. "localhost:8080" ''; - }; - }; + }; + }; - config = mkIf cfg.enable { - environment.systemPackages = [ - pkgs.kiwix-tools - ]; + config = mkIf cfg.enable { + environment.systemPackages = [ + pkgs.kiwix-tools + ]; - systemd.services.kiwix-serve = { - enable = true; - after = [ "network.service" ]; - description = "Runs the kiwix-serve binary as a sysmted service"; - restartTriggers = [ pkgs.kiwix-tools ]; - wantedBy = [ "multi-user.target" ]; - script = "${pkgs.kiwix-tools}/bin/kiwix-serve --port ${toString cfg.port} ${cfg.path}"; - environment = { - UPSTREAM_HOST = mkIf (cfg.proxy != "") cfg.proxy; - UPSTREAM_WIKI = mkIf (cfg.proxy != "") cfg.proxy; - }; - }; - }; + systemd.services.kiwix-serve = { + enable = true; + after = [ "network.service" ]; + description = "Runs the kiwix-serve binary as a sysmted service"; + restartTriggers = [ pkgs.kiwix-tools ]; + wantedBy = [ "multi-user.target" ]; + script = "${pkgs.kiwix-tools}/bin/kiwix-serve --port ${toString cfg.port} ${cfg.path}"; + environment = { + UPSTREAM_HOST = mkIf (cfg.proxy != "") cfg.proxy; + UPSTREAM_WIKI = mkIf (cfg.proxy != "") cfg.proxy; + }; + }; + }; } diff --git a/modules/nixos/linode.nix b/modules/nixos/linode.nix index dd5bdb4..f474ab2 100644 --- a/modules/nixos/linode.nix +++ b/modules/nixos/linode.nix @@ -1,44 +1,45 @@ { config, lib, pkgs, ... }: let - cfg = config.greg.linode; + cfg = config.greg.linode; -in with lib; +in +with lib; { - options.greg.linode = { - enable = mkEnableOption "Set sensible defaults for a Linode host"; + options.greg.linode = { + enable = mkEnableOption "Set sensible defaults for a Linode host"; - bootTimeout = mkOption { - type = types.int; - default = 15; - description = "Set bootloader timeout in seconds."; - }; - }; + bootTimeout = mkOption { + type = types.int; + default = 15; + description = "Set bootloader timeout in seconds."; + }; + }; - config = mkIf cfg.enable { - # Enables connection over Linode consoles - boot.kernelParams = [ "console=ttyS0,19200n8" ]; - boot.loader.grub = { - device = "nodev"; - extraConfig = '' -serial --speed=19200 --unit=0 --word=8 --parity=no --stop=1; -terminal_input serial; -terminal_output serial; -''; - }; + config = mkIf cfg.enable { + # Enables connection over Linode consoles + boot.kernelParams = [ "console=ttyS0,19200n8" ]; + boot.loader.grub = { + device = "nodev"; + extraConfig = '' + serial --speed=19200 --unit=0 --word=8 --parity=no --stop=1; + terminal_input serial; + terminal_output serial; + ''; + }; - # Tells grub to ignore partion-free device warnings, since we are on Linode - boot.loader.timeout = 15; + # Tells grub to ignore partion-free device warnings, since we are on Linode + boot.loader.timeout = 15; - networking.usePredictableInterfaceNames = false; # Use old style eth0 names - networking.useDHCP = false; - networking.interfaces.eth0.useDHCP = true; + networking.usePredictableInterfaceNames = false; # Use old style eth0 names + networking.useDHCP = false; + networking.interfaces.eth0.useDHCP = true; - # Suggested diagnostic tools - environment.systemPackages = with pkgs; [ - inetutils - mtr - sysstat - ]; - }; + # Suggested diagnostic tools + environment.systemPackages = with pkgs; [ + inetutils + mtr + sysstat + ]; + }; } diff --git a/modules/nixos/print.nix b/modules/nixos/print.nix index aabd200..985e499 100644 --- a/modules/nixos/print.nix +++ b/modules/nixos/print.nix @@ -1,33 +1,34 @@ { config, lib, pkgs, ... }: let - cfg = config.greg.print; + cfg = config.greg.print; -in with lib; +in +with lib; { - options.greg.print.enable = mkOption { - type = types.bool; - default = true; - description = "Configures the system to print with my home printer"; - }; + options.greg.print.enable = mkOption { + type = types.bool; + default = true; + description = "Configures the system to print with my home printer"; + }; - config = mkIf cfg.enable { - # ipp://printer.thehellings.lan:631/ - generic postscript printer - services.printing = { - enable = true; - drivers = with pkgs; [ - gutenprint - ] ++ (lib.optional pkgs.stdenv.isx86_64 gutenprintBin); - }; + config = mkIf cfg.enable { + # ipp://printer.thehellings.lan:631/ - generic postscript printer + services.printing = { + enable = true; + drivers = with pkgs; [ + gutenprint + ] ++ (lib.optional pkgs.stdenv.isx86_64 gutenprintBin); + }; - hardware.printers.ensurePrinters = [ { - name = "HomeLexmarkColorPrinter"; - location = "Home office"; - deviceUri = "ipp://printer.thehellings.lan:631/"; - model = "drv:///sample.drv/generic.ppd"; - ppdOptions = { - PageSize = "Letter"; - }; - } ]; - }; + hardware.printers.ensurePrinters = [{ + name = "HomeLexmarkColorPrinter"; + location = "Home office"; + deviceUri = "ipp://printer.thehellings.lan:631/"; + model = "drv:///sample.drv/generic.ppd"; + ppdOptions = { + PageSize = "Letter"; + }; + }]; + }; } diff --git a/modules/nixos/proxy.nix b/modules/nixos/proxy.nix index e3d87ec..2f56fb0 100644 --- a/modules/nixos/proxy.nix +++ b/modules/nixos/proxy.nix @@ -1,87 +1,89 @@ { config, lib, pkgs, ... }: let - cfg = config.greg.proxies; + cfg = config.greg.proxies; - alias = name: with builtins; head (split "\\." name); + alias = name: with builtins; head (split "\\." name); - makeHost = name: dest: { - forceSSL = dest.ssl; - enableACME = dest.ssl; - locations."${dest.path}" = { - proxyPass = dest.target; - extraConfig = '' -proxy_http_version 1.1; -proxy_set_header Upgrade $http_upgrade; -proxy_set_header Connection $connection_upgrade; -'' + dest.extraConfig; - }; - serverAliases = lib.mkIf dest.genAliases [ "${alias name}" ]; - }; + makeHost = name: dest: { + forceSSL = dest.ssl; + enableACME = dest.ssl; + locations."${dest.path}" = { + proxyPass = dest.target; + extraConfig = '' + proxy_http_version 1.1; + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection $connection_upgrade; + '' + dest.extraConfig; + }; + serverAliases = lib.mkIf dest.genAliases [ "${alias name}" ]; + }; -in with lib; { - options = { - greg.proxies = mkOption { - default = {}; - example = literalExpression '' - { host-name = { - target = proxyLocation; - ssl = true; - }; - ''; - description = '' - Quick and simple Nginx proxy configurations. - Use this to configure a very simple proxy that does not - need any extra customization options other than SSL - enablement. - ''; +in +with lib; { + options = { + greg.proxies = mkOption { + default = { }; + example = literalExpression '' + { host-name = { + target = proxyLocation; + ssl = true; + }; + ''; + description = '' + Quick and simple Nginx proxy configurations. + Use this to configure a very simple proxy that does not + need any extra customization options other than SSL + enablement. + ''; - type = with types; attrsOf (submodule ( - { name, config, options, ... }: - { - options = { - genAliases = mkOption { - type = types.bool; - description = "Whether to auto-generate short alias name"; - default = true; - }; + type = with types; attrsOf (submodule ( + { name, config, options, ... }: + { + options = { + genAliases = mkOption { + type = types.bool; + description = "Whether to auto-generate short alias name"; + default = true; + }; - target = mkOption { - type = types.str; - description = ''The destination that is being proxied.''; - example = "http://localhost:8080"; - }; + target = mkOption { + type = types.str; + description = ''The destination that is being proxied.''; + example = "http://localhost:8080"; + }; - ssl = mkOption { - type = types.bool; - description = "Whether to enable SSL in front of the proxy"; - default = false; - }; + ssl = mkOption { + type = types.bool; + description = "Whether to enable SSL in front of the proxy"; + default = false; + }; - path = mkOption { - type = types.str; - description = "The path prefix for this proxy"; - default = "/"; - }; + path = mkOption { + type = types.str; + description = "The path prefix for this proxy"; + default = "/"; + }; - extraConfig = mkOption { - type = types.str; - description = "Extra nginx config options"; - default = ""; - }; - }; - })); - }; - }; + extraConfig = mkOption { + type = types.str; + description = "Extra nginx config options"; + default = ""; + }; + }; + } + )); + }; + }; - config.services.nginx = mkIf ( ( attrValues cfg ) != [] ) { - enable = true; + config.services.nginx = mkIf ((attrValues cfg) != [ ]) { + enable = true; - recommendedGzipSettings = true; - recommendedOptimisation = true; - recommendedProxySettings = true; - recommendedTlsSettings = true; + recommendedGzipSettings = true; + recommendedOptimisation = true; + recommendedProxySettings = true; + recommendedTlsSettings = true; - virtualHosts = mapAttrs makeHost cfg; - }; + virtualHosts = mapAttrs makeHost cfg; + }; } diff --git a/modules/nixos/router.nix b/modules/nixos/router.nix index b483587..15a2f36 100644 --- a/modules/nixos/router.nix +++ b/modules/nixos/router.nix @@ -1,93 +1,97 @@ { config, lib, pkgs, ... }: let - names = mylist: (lib.strings.concatMapStringsSep "," (x: ''"${x}"'') mylist); - # Pass the names of the wan/lan ports - nftConfig = { - wan, - lan, - limitedLan ? [], - openPorts ? [ "ssh" "67" "53" ], # ssh, dhcpd, dns - openUDPPorts ? [ "67" "53" ] # dhcpd, dns - }: let - lanList = names lan; - allLan = names (lan ++ limitedLan); - wanName = names wan; - portsString = lib.strings.concatMapStringsSep "\n" (x: "iifname { ${lanList}, \"tailscale0\" } tcp dport ${toString x} accept") openPorts; - udpPortsString = lib.strings.concatMapStringsSep "\n" (x: "iifname { ${lanList}, \"tailscale0\" } udp dport ${toString x} accept") openUDPPorts; - in lib.strings.concatStringsSep "\n" [ - "table ip filter {" - " chain output {" - " type filter hook output priority 100; policy accept;" - " }" + names = mylist: (lib.strings.concatMapStringsSep "," (x: ''"${x}"'') mylist); + # Pass the names of the wan/lan ports + nftConfig = + { wan + , lan + , limitedLan ? [ ] + , openPorts ? [ "ssh" "67" "53" ] + , # ssh, dhcpd, dns + openUDPPorts ? [ "67" "53" ] # dhcpd, dns + }: + let + lanList = names lan; + allLan = names (lan ++ limitedLan); + wanName = names wan; + portsString = lib.strings.concatMapStringsSep "\n" (x: "iifname { ${lanList}, \"tailscale0\" } tcp dport ${toString x} accept") openPorts; + udpPortsString = lib.strings.concatMapStringsSep "\n" (x: "iifname { ${lanList}, \"tailscale0\" } udp dport ${toString x} accept") openUDPPorts; + in + lib.strings.concatStringsSep "\n" [ + "table ip filter {" + " chain output {" + " type filter hook output priority 100; policy accept;" + " }" - " chain input {" - " type filter hook input priority 0; policy drop;" + " chain input {" + " type filter hook input priority 0; policy drop;" - " iifname lo accept" - portsString - udpPortsString - " iifname { ${lanList} } accept comment \"Allows LAN traffic and outgoing\"" - " iifname { ${wanName} } ct state { established, related } accept comment \"Allows existing connections\"" - " iifname { ${wanName} } icmp type { echo-request, destination-unreachable, time-exceeded } counter accept comment \"Allow some ICMP traffic\"" - " iifname { ${wanName} } counter drop comment \"Drop other incoming traffic, and count how much\"" - " }" - " chain forward {" - " type filter hook forward priority 0; policy drop;" - " iifname { ${allLan} } oifname { ${wanName} } accept comment \"Forward LAN to WAN\"" - " iifname { ${wanName} } oifname { ${allLan} } ct state established, related accept comment \"Allow incoming established traffic\"" - " }" - "}" + " iifname lo accept" + portsString + udpPortsString + " iifname { ${lanList} } accept comment \"Allows LAN traffic and outgoing\"" + " iifname { ${wanName} } ct state { established, related } accept comment \"Allows existing connections\"" + " iifname { ${wanName} } icmp type { echo-request, destination-unreachable, time-exceeded } counter accept comment \"Allow some ICMP traffic\"" + " iifname { ${wanName} } counter drop comment \"Drop other incoming traffic, and count how much\"" + " }" + " chain forward {" + " type filter hook forward priority 0; policy drop;" + " iifname { ${allLan} } oifname { ${wanName} } accept comment \"Forward LAN to WAN\"" + " iifname { ${wanName} } oifname { ${allLan} } ct state established, related accept comment \"Allow incoming established traffic\"" + " }" + "}" - "table ip nat {" - " chain postrouting {" - " type nat hook postrouting priority 100; policy accept;" - " oifname { ${wanName} } masquerade" - " }" - "}" + "table ip nat {" + " chain postrouting {" + " type nat hook postrouting priority 100; policy accept;" + " oifname { ${wanName} } masquerade" + " }" + "}" - "table ip6 filter {" - " chain input {" - " type filter hook input priority 0; policy drop;" - " }" - " chain forward {" - " type filter hook forward priority 0; policy drop;" - " }" - "}" - ]; - cfg = config.greg.router; + "table ip6 filter {" + " chain input {" + " type filter hook input priority 0; policy drop;" + " }" + " chain forward {" + " type filter hook forward priority 0; policy drop;" + " }" + "}" + ]; + cfg = config.greg.router; -in with lib; { - options.greg.router = { - enable = mkEnableOption "Enable NFTables and routing"; - wan = mkOption { - type = (types.listOf types.str); - description = "The name of the network interface that is the WAN connection"; - }; - lan = mkOption { - type = (types.listOf types.str); - description = "A list of all network interfaces that are considered LAN connections"; - }; - limited = mkOption { - type = (types.listOf types.str); - description = "A list of limited access LAN connections - such as IOT connections and similar."; - default = []; - }; - }; +in +with lib; { + options.greg.router = { + enable = mkEnableOption "Enable NFTables and routing"; + wan = mkOption { + type = (types.listOf types.str); + description = "The name of the network interface that is the WAN connection"; + }; + lan = mkOption { + type = (types.listOf types.str); + description = "A list of all network interfaces that are considered LAN connections"; + }; + limited = mkOption { + type = (types.listOf types.str); + description = "A list of limited access LAN connections - such as IOT connections and similar."; + default = [ ]; + }; + }; - config = mkIf cfg.enable { - networking.nftables = { - enable = true; - ruleset = (nftConfig { - inherit (cfg) lan wan; - openPorts = config.networking.firewall.allowedTCPPorts; - openUDPPorts = config.networking.firewall.allowedUDPPorts; - }); - }; + config = mkIf cfg.enable { + networking.nftables = { + enable = true; + ruleset = (nftConfig { + inherit (cfg) lan wan; + openPorts = config.networking.firewall.allowedTCPPorts; + openUDPPorts = config.networking.firewall.allowedUDPPorts; + }); + }; - environment.systemPackages = [ - pkgs.pciutils - pkgs.tcpdump - ]; - }; + environment.systemPackages = [ + pkgs.pciutils + pkgs.tcpdump + ]; + }; } diff --git a/modules/nixos/rpi4.nix b/modules/nixos/rpi4.nix index fd77bb8..0de4593 100644 --- a/modules/nixos/rpi4.nix +++ b/modules/nixos/rpi4.nix @@ -1,43 +1,44 @@ { config, lib, pkgs, ... }: let - cfg = config.greg.rpi4; + cfg = config.greg.rpi4; -in with lib; { - options = { - greg.rpi4 = { - enable = mkEnableOption "Enable support for Raspberry Pi 4s"; - }; - }; +in +with lib; { + options = { + greg.rpi4 = { + enable = mkEnableOption "Enable support for Raspberry Pi 4s"; + }; + }; - config = mkIf cfg.enable { - boot = { - # This prevents us from having to compile our own kernel - kernelPackages = pkgs.linuxPackages_rpi4; - kernelParams = [ - "8250.nr_uarts=1" - "console=ttyAMA0,115200" - "console=tty1" - "cma=128M" - ]; + config = mkIf cfg.enable { + boot = { + # This prevents us from having to compile our own kernel + kernelPackages = pkgs.linuxPackages_rpi4; + kernelParams = [ + "8250.nr_uarts=1" + "console=ttyAMA0,115200" + "console=tty1" + "cma=128M" + ]; - loader = { - raspberryPi = { - enable = true; - version = 4; - }; + loader = { + raspberryPi = { + enable = true; + version = 4; + }; - # Use the extlinux boot loader. (NixOS wants to enable GRUB by default) - grub.enable = false; + # Use the extlinux boot loader. (NixOS wants to enable GRUB by default) + grub.enable = false; - # Enables the generation of /boot/extlinux/extlinux.conf - #generic-extlinux-compatible.enable = true; - }; - }; + # Enables the generation of /boot/extlinux/extlinux.conf + #generic-extlinux-compatible.enable = true; + }; + }; - environment.systemPackages = with pkgs; [ - raspberrypifw - usbutils - ]; - }; + environment.systemPackages = with pkgs; [ + raspberrypifw + usbutils + ]; + }; } diff --git a/modules/nixos/sway.nix b/modules/nixos/sway.nix index 221d037..0776caf 100644 --- a/modules/nixos/sway.nix +++ b/modules/nixos/sway.nix @@ -1,42 +1,43 @@ { config, pkgs, lib, ... }: let - cfg = config.greg.sway; + cfg = config.greg.sway; -in with lib; { - options = { - greg.sway.enable = mkEnableOption "Enable my default Gnome3 setup"; - }; +in +with lib; { + options = { + greg.sway.enable = mkEnableOption "Enable my default Gnome3 setup"; + }; - config = mkIf cfg.enable { - services = { - accounts-daemon.enable = true; + config = mkIf cfg.enable { + services = { + accounts-daemon.enable = true; - pipewire = { - enable = true; - alsa.enable = true; - audio.enable = true; - jack.enable = true; - pulse.enable = true; - wireplumber.enable = true; - }; + pipewire = { + enable = true; + alsa.enable = true; + audio.enable = true; + jack.enable = true; + pulse.enable = true; + wireplumber.enable = true; + }; - xserver = { - enable = true; - displayManager.gdm = { - enable = true; - autoSuspend = false; - banner = "Welcome to Greg's JUDE machine. Do I know you?"; - wayland = true; - }; - xkb.layout = "us"; - }; - }; + xserver = { + enable = true; + displayManager.gdm = { + enable = true; + autoSuspend = false; + banner = "Welcome to Greg's JUDE machine. Do I know you?"; + wayland = true; + }; + xkb.layout = "us"; + }; + }; - programs.sway = { - enable = true; # Will be enabled through home-manager - wrapperFeatures.gtk = true; - }; - security.pam.services.swaylock = {}; - }; + programs.sway = { + enable = true; # Will be enabled through home-manager + wrapperFeatures.gtk = true; + }; + security.pam.services.swaylock = { }; + }; } diff --git a/modules/nixos/syncthing.nix b/modules/nixos/syncthing.nix index d259516..7b82aed 100644 --- a/modules/nixos/syncthing.nix +++ b/modules/nixos/syncthing.nix @@ -1,29 +1,30 @@ { config, lib, pkgs, ... }: let - cfg = config.greg.syncthing; -in with lib; { - options.greg.syncthing = { - enable = mkEnableOption "Setup my personal minimal configuration for Syncthing"; - }; + cfg = config.greg.syncthing; +in +with lib; { + options.greg.syncthing = { + enable = mkEnableOption "Setup my personal minimal configuration for Syncthing"; + }; - config = mkIf cfg.enable { - services.syncthing = { - enable = true; - overrideFolders = true; - overrideDevices = true; - settings = { - devices = { - chronicles.id = "7FI6Y3M-C7YQEDI-IB345L6-RKLXMB6-AEIV57Y-3J2RCXQ-MK6QRNK-EINPXAE"; - genesis.id = "YDTH4SD-GUAC5AA-SSYWYPZ-YMJW5LK-LE7PZKJ-GV2UJFZ-CU7LZAD-GTYWCQK"; - gitlab.id = "VAG5GHP-L7TNY7O-CHR3CKU-GXXVCIL-OT3WHHU-E4VAIZC-JI4BKOM-PYZQOQS"; - linode.id = "IJMMXPR-WNALZBD-FMJH5W5-WV7XGJY-HLJTKGT-5TKHJIH-75LT56D-UUZCYQE"; - matrix.id = "K5IHM3I-TJFFEW5-GAYJMPS-CYSHW5C-XHMC462-MFRMOHJ-EJLKIKC-CZHGJQ2"; - }; - options = { - urAccepted = -1; - }; - }; - }; - }; + config = mkIf cfg.enable { + services.syncthing = { + enable = true; + overrideFolders = true; + overrideDevices = true; + settings = { + devices = { + chronicles.id = "7FI6Y3M-C7YQEDI-IB345L6-RKLXMB6-AEIV57Y-3J2RCXQ-MK6QRNK-EINPXAE"; + genesis.id = "YDTH4SD-GUAC5AA-SSYWYPZ-YMJW5LK-LE7PZKJ-GV2UJFZ-CU7LZAD-GTYWCQK"; + gitlab.id = "VAG5GHP-L7TNY7O-CHR3CKU-GXXVCIL-OT3WHHU-E4VAIZC-JI4BKOM-PYZQOQS"; + linode.id = "IJMMXPR-WNALZBD-FMJH5W5-WV7XGJY-HLJTKGT-5TKHJIH-75LT56D-UUZCYQE"; + matrix.id = "K5IHM3I-TJFFEW5-GAYJMPS-CYSHW5C-XHMC462-MFRMOHJ-EJLKIKC-CZHGJQ2"; + }; + options = { + urAccepted = -1; + }; + }; + }; + }; } diff --git a/modules/nixos/tailscale.nix b/modules/nixos/tailscale.nix index b446c9f..aef7c52 100644 --- a/modules/nixos/tailscale.nix +++ b/modules/nixos/tailscale.nix @@ -1,18 +1,19 @@ { lib, config, ... }: let - cfg = config.greg.tailscale; -in { - options = { - greg.tailscale.enable = lib.mkEnableOption "Enable Tailscale"; - }; + cfg = config.greg.tailscale; +in +{ + options = { + greg.tailscale.enable = lib.mkEnableOption "Enable Tailscale"; + }; - config = lib.mkIf cfg.enable { - services.tailscale.enable = true; - networking.firewall.checkReversePath = "loose"; - boot.kernel.sysctl = { - "net.ipv4.ip_forward" = "1"; - "net.ipv6.conf.all.forwarding" = "1"; - }; - }; + config = lib.mkIf cfg.enable { + services.tailscale.enable = true; + networking.firewall.checkReversePath = "loose"; + boot.kernel.sysctl = { + "net.ipv4.ip_forward" = "1"; + "net.ipv6.conf.all.forwarding" = "1"; + }; + }; } diff --git a/modules/nixos/vmdev.nix b/modules/nixos/vmdev.nix index 0b28137..49af6c5 100644 --- a/modules/nixos/vmdev.nix +++ b/modules/nixos/vmdev.nix @@ -1,74 +1,75 @@ { pkgs, lib, config, ... }: let - cfg = config.greg.vmdev; -in with lib; + cfg = config.greg.vmdev; +in +with lib; { - options = { - greg.vmdev = { - enable = mkEnableOption "Enable this system for VM development work"; - user = mkOption { - default = "greg"; - type = types.str; - description = "The user who will be doing VM dev"; - }; - system = mkOption { - default = "amd"; - type = types.str; - description = "Kernel module type to install - amd, intel, etc"; - }; - }; - }; + options = { + greg.vmdev = { + enable = mkEnableOption "Enable this system for VM development work"; + user = mkOption { + default = "greg"; + type = types.str; + description = "The user who will be doing VM dev"; + }; + system = mkOption { + default = "amd"; + type = types.str; + description = "Kernel module type to install - amd, intel, etc"; + }; + }; + }; - config = mkIf cfg.enable { - environment.systemPackages = with pkgs; [ - dmidecode - guestfs-tools - libguestfs - OVMFFull - packer - virt-manager - xorriso - ]; + config = mkIf cfg.enable { + environment.systemPackages = with pkgs; [ + dmidecode + guestfs-tools + libguestfs + OVMFFull + packer + virt-manager + xorriso + ]; - users.users."${cfg.user}".extraGroups = [ "libvirtd" ]; + users.users."${cfg.user}".extraGroups = [ "libvirtd" ]; - # Enable the virtualisation services - virtualisation = { - libvirtd = { - enable = true; - onBoot = "ignore"; # Do not auto-restart VMs on boot, unless they are marked autostart - qemu.ovmf.enable = true; - }; + # Enable the virtualisation services + virtualisation = { + libvirtd = { + enable = true; + onBoot = "ignore"; # Do not auto-restart VMs on boot, unless they are marked autostart + qemu.ovmf.enable = true; + }; - virtualbox.host = { - enable = true; - enableExtensionPack = true; - }; - }; + virtualbox.host = { + enable = true; + enableExtensionPack = true; + }; + }; - # Configuration for vbox user performance - users.extraGroups.vboxusers.members = [ cfg.user ]; + # Configuration for vbox user performance + users.extraGroups.vboxusers.members = [ cfg.user ]; - boot.extraModprobeConfig = "options kvm_${cfg.system} nested=1"; + boot.extraModprobeConfig = "options kvm_${cfg.system} nested=1"; - # Configure the services more - systemd.services = { - libvirtd = { - preStart = "${pkgs.kmod}/bin/modprobe kvm_${cfg.system}"; - postStop = "${pkgs.kmod}/bin/rmmod kvm_${cfg.system} kvm"; - conflicts = [ "vbox.service" ]; - }; - vbox = { - preStart = "${pkgs.kmod}/bin/modprobe vboxdrv vboxnetadp vboxnetflt"; - postStop = "${pkgs.kmod}/bin/rmmod vboxnetadp vboxnetflt vboxdrv"; - script = "echo Started"; - conflicts = [ "libvirtd.service" ]; - unitConfig = { - Type = "oneshot"; - RemainAfterExit = "yes"; - }; - }; - }; - }; + # Configure the services more + systemd.services = { + libvirtd = { + preStart = "${pkgs.kmod}/bin/modprobe kvm_${cfg.system}"; + postStop = "${pkgs.kmod}/bin/rmmod kvm_${cfg.system} kvm"; + conflicts = [ "vbox.service" ]; + }; + vbox = { + preStart = "${pkgs.kmod}/bin/modprobe vboxdrv vboxnetadp vboxnetflt"; + postStop = "${pkgs.kmod}/bin/rmmod vboxnetadp vboxnetflt vboxdrv"; + script = "echo Started"; + conflicts = [ "libvirtd.service" ]; + unitConfig = { + Type = "oneshot"; + RemainAfterExit = "yes"; + }; + }; + }; + }; } diff --git a/overlays/aacs.nix b/overlays/aacs.nix index cf123a6..6a1bd86 100644 --- a/overlays/aacs.nix +++ b/overlays/aacs.nix @@ -1,10 +1,10 @@ { pkgs, ... }: pkgs.writeShellScriptBin "aacs" '' -set -ex -[ ! -d "''${HOME}/.config/aacs" ] && mkdir -p "''${HOME}/.config/aacs" -cd "''${HOME}/.config/aacs" -[ -f KEYDB.cfg.zip ] && rm -f KEYDB.cfg.zip -curl -L -o KEYDB.cfg.zip "http://fvonline-db.bplaced.net/fv_download.php?lang=eng" -${pkgs.unzip}/bin/unzip KEYDB.cfg.zip -mv keydb.cfg KEYDB.cfg'' + set -ex + [ ! -d "''${HOME}/.config/aacs" ] && mkdir -p "''${HOME}/.config/aacs" + cd "''${HOME}/.config/aacs" + [ -f KEYDB.cfg.zip ] && rm -f KEYDB.cfg.zip + curl -L -o KEYDB.cfg.zip "http://fvonline-db.bplaced.net/fv_download.php?lang=eng" + ${pkgs.unzip}/bin/unzip KEYDB.cfg.zip + mv keydb.cfg KEYDB.cfg'' diff --git a/overlays/create_ssl.nix b/overlays/create_ssl.nix index a593d17..25f7b12 100644 --- a/overlays/create_ssl.nix +++ b/overlays/create_ssl.nix @@ -1,28 +1,28 @@ -{ writeShellScriptBin, openssl, ...}: +{ writeShellScriptBin, openssl, ... }: writeShellScriptBin "create_ssl" '' -set -e -o pipefail -name="''${1}" -root_key="''${2}" + set -e -o pipefail + name="''${1}" + root_key="''${2}" -function usage { - echo "USAGE: create_ssl " -} + function usage { + echo "USAGE: create_ssl " + } -if [ -z "''${name}" ]; then - usage - exit 1 -fi + if [ -z "''${name}" ]; then + usage + exit 1 + fi -if [ -z "''${root_key}" ]; then - usage - exit 1 -fi + if [ -z "''${root_key}" ]; then + usage + exit 1 + fi -# Create the certificate key -${openssl}/bin/openssl ecparam -out "''${name}.key" -name prime256v1 -genkey -# Create the CSR -${openssl}/bin/openssl req -name -sha256 -key "''${name}.key" -out "''${name}.csr" -# Sign it -${openssl}/bin/openssl x509 -req -in "''${name}.csr" -CA "''${root_key}.crt" -CAkey "''${root_key}.key" -CAcreateserial -out "''${name}.crt" -days 3650 -sha256 + # Create the certificate key + ${openssl}/bin/openssl ecparam -out "''${name}.key" -name prime256v1 -genkey + # Create the CSR + ${openssl}/bin/openssl req -name -sha256 -key "''${name}.key" -out "''${name}.csr" + # Sign it + ${openssl}/bin/openssl x509 -req -in "''${name}.csr" -CA "''${root_key}.crt" -CAkey "''${root_key}.key" -CAcreateserial -out "''${name}.crt" -days 3650 -sha256 '' diff --git a/overlays/default.nix b/overlays/default.nix index c26c232..46f34ed 100644 --- a/overlays/default.nix +++ b/overlays/default.nix @@ -1,79 +1,83 @@ final: prev: let - myPackages = pypackages: with pypackages; [ - black - dateutil - ipython - mypy - pylint - pyyaml - responses - ruamel-yaml - tox - typing-extensions - virtualenv - ]; + myPackages = pypackages: with pypackages; [ + black + dateutil + ipython + mypy + pylint + pyyaml + responses + ruamel-yaml + tox + typing-extensions + virtualenv + ]; - myPython = prev.python312.withPackages myPackages; - macOver = file: og: - if prev.stdenv.isDarwin then - (prev.callPackage file {}) else - prev."${og}"; + myPython = prev.python312.withPackages myPackages; + macOver = file: og: + if prev.stdenv.isDarwin then + (prev.callPackage file { }) else + prev."${og}"; - buildFirefoxXpiAddon = final.nur.repos.rycee.lib.buildFirefoxXpiAddon; + buildFirefoxXpiAddon = final.nur.repos.rycee.lib.buildFirefoxXpiAddon; - is2405 = prev.lib.versionAtLeast prev.lib.version "24"; + is2405 = prev.lib.versionAtLeast prev.lib.version "24"; -in rec { - gregpy = myPython; +in +rec { + gregpy = myPython; - ## Testing adding python packages in the correct manner - pythonPackagesExtensions = (prev.pythonPackagesExtensions or []) ++ [ - (python-final: python-prev: let cp = python-final.callPackage; in { - django-rapyd-modernauth = cp ./django-rapyd-modernauth.nix {}; - graypy = cp ./graypy.nix {}; - itg-django-utils = cp ./itg-django-utils.nix {}; - xonsh-apipenv = cp ./xonsh-apipenv.nix {}; - }) - ]; + ## Testing adding python packages in the correct manner + pythonPackagesExtensions = (prev.pythonPackagesExtensions or [ ]) ++ [ + (python-final: python-prev: + let cp = python-final.callPackage; in { + django-rapyd-modernauth = cp ./django-rapyd-modernauth.nix { }; + graypy = cp ./graypy.nix { }; + itg-django-utils = cp ./itg-django-utils.nix { }; + xonsh-apipenv = cp ./xonsh-apipenv.nix { }; + }) + ]; - # My own packages - aacs = prev.callPackage ./aacs.nix {}; - create_ssl = prev.callPackage ./create_ssl.nix {}; - enwiki-dump = prev.callPackage ./enwiki-dump.nix {}; - hms = prev.callPackage ./hms { - pkgs = final.pkgs; - }; - inject = prev.callPackage ./inject.nix { inherit (final) pkgs; }; - inject-darwin = prev.callPackage ./inject-darwin.nix { inherit (final) pkgs; }; - setup-ssh = prev.callPackage ./setup-ssh { - pkgs = final.pkgs; - }; - upgrade-pg-cluster = prev.callPackage ./upgrade-pg-cluster.nix {}; + # My own packages + aacs = prev.callPackage ./aacs.nix { }; + create_ssl = prev.callPackage ./create_ssl.nix { }; + enwiki-dump = prev.callPackage ./enwiki-dump.nix { }; + hms = prev.callPackage ./hms { + pkgs = final.pkgs; + }; + inject = prev.callPackage ./inject.nix { inherit (final) pkgs; }; + inject-darwin = prev.callPackage ./inject-darwin.nix { inherit (final) pkgs; }; + setup-ssh = prev.callPackage ./setup-ssh { + pkgs = final.pkgs; + }; + upgrade-pg-cluster = prev.callPackage ./upgrade-pg-cluster.nix { }; - # Overrides of packages - brew = prev.callPackage ./homebrew.nix {}; - copier = (if is2405 then prev.copier.overridePythonAttrs (old: { - version = "9.1.0"; - src = final.fetchFromGitHub { - owner = "copier-org"; - repo = "copier"; - rev = "v9.1.0"; - hash = "sha256-x5r7Xv4lAOMkR+UIEeSY7LvbYMLpTWYuICYe9ygz1tA="; - postFetch = "rm $out/tests/demo/doc/ma*ana.txt"; - }; - }) else prev.copier); - libbluray-custom = prev.libbluray.override { - withAACS = true; - withBDplus = true; - }; - template = prev.callPackage ./template.nix { }; - handbrake = prev.handbrake.override { - libbluray = libbluray-custom; - }; - libvirt-greg = prev.libvirt.overrideAttrs { - postInstall = prev.libvirt.postInstall + "rm -r $out/lib/systemd/system/libvirtd.service"; - }; - pipenv-ivr = prev.callPackage ./pipenv.nix { }; + # Overrides of packages + brew = prev.callPackage ./homebrew.nix { }; + copier = (if is2405 then + prev.copier.overridePythonAttrs + (old: { + version = "9.1.0"; + src = final.fetchFromGitHub { + owner = "copier-org"; + repo = "copier"; + rev = "v9.1.0"; + hash = "sha256-x5r7Xv4lAOMkR+UIEeSY7LvbYMLpTWYuICYe9ygz1tA="; + postFetch = "rm $out/tests/demo/doc/ma*ana.txt"; + }; + }) else prev.copier); + libbluray-custom = prev.libbluray.override { + withAACS = true; + withBDplus = true; + }; + template = prev.callPackage ./template.nix { }; + handbrake = prev.handbrake.override { + libbluray = libbluray-custom; + }; + libvirt-greg = prev.libvirt.overrideAttrs { + postInstall = prev.libvirt.postInstall + "rm -r $out/lib/systemd/system/libvirtd.service"; + }; + pipenv-ivr = prev.callPackage ./pipenv.nix { }; } diff --git a/overlays/django-rapyd-modernauth.nix b/overlays/django-rapyd-modernauth.nix index 8f7eec2..6dbfeb6 100644 --- a/overlays/django-rapyd-modernauth.nix +++ b/overlays/django-rapyd-modernauth.nix @@ -1,55 +1,54 @@ -{ - lib, - buildPythonPackage, - fetchPypi, - - click, - django, - python-dotenv, - pytz, - setuptools, - sqlparse, - zipp +{ lib +, buildPythonPackage +, fetchPypi +, click +, django +, python-dotenv +, pytz +, setuptools +, sqlparse +, zipp }: let - pydeps = pypkgs: with pypkgs; [ - click - django - python-dotenv - pytz - setuptools - sqlparse - zipp - ]; -in buildPythonPackage rec { - pname = "django-rapyd-modernauth"; - version = "0.0.4"; + pydeps = pypkgs: with pypkgs; [ + click + django + python-dotenv + pytz + setuptools + sqlparse + zipp + ]; +in +buildPythonPackage rec { + pname = "django-rapyd-modernauth"; + version = "0.0.4"; - src = fetchPypi { - inherit pname version; - sha256 = "sha256-kDZjI32LcKsmLI38ruINKOUfi6lWTIqXF5qIQHi0LeQ="; - }; + src = fetchPypi { + inherit pname version; + sha256 = "sha256-kDZjI32LcKsmLI38ruINKOUfi6lWTIqXF5qIQHi0LeQ="; + }; - meta = with lib; { - description = "A Django application that provides a custom User model where the username is the email address."; - homepage = "https://github.com/karthicraghupathi/django_rapyd_modernauth"; - license = licenses.afl20; - maintainers = []; - }; + meta = with lib; { + description = "A Django application that provides a custom User model where the username is the email address."; + homepage = "https://github.com/karthicraghupathi/django_rapyd_modernauth"; + license = licenses.afl20; + maintainers = [ ]; + }; - doCheck = false; + doCheck = false; - buildInputs = [ - click - django - python-dotenv - pytz - setuptools - sqlparse - zipp - ]; + buildInputs = [ + click + django + python-dotenv + pytz + setuptools + sqlparse + zipp + ]; - nativeBuildInputs = [ - ]; + nativeBuildInputs = [ + ]; } diff --git a/overlays/enwiki-dump.nix b/overlays/enwiki-dump.nix index 80f9aaf..a17ef32 100644 --- a/overlays/enwiki-dump.nix +++ b/overlays/enwiki-dump.nix @@ -1,55 +1,56 @@ { pkgs, ... }: let - version = "2022.07.20"; - date = builtins.replaceStrings ["."] [""] version; + version = "2022.07.20"; + date = builtins.replaceStrings [ "." ] [ "" ] version; -in pkgs.writeShellScriptBin "wiki-data" '' -set -eo pipefail +in +pkgs.writeShellScriptBin "wiki-data" '' + set -eo pipefail -function process_file { - file="''${lang}''${1}" - destfile=/var/tmp/''${file} - curl -C - -o "''${destfile}" "https://dumps.wikimedia.your.org/''${lang}wiki/${date}/''${file}" - bzcat "''${destfile}" | ${pkgs.php}/bin/php ${pkgs.mediawiki}/share/mediawiki/maintenance/importDump.php --report 500 | tee "/var/log/mediawiki-''${lang}-import" - rm "''${destfile}" -} + function process_file { + file="''${lang}''${1}" + destfile=/var/tmp/''${file} + curl -C - -o "''${destfile}" "https://dumps.wikimedia.your.org/''${lang}wiki/${date}/''${file}" + bzcat "''${destfile}" | ${pkgs.php}/bin/php ${pkgs.mediawiki}/share/mediawiki/maintenance/importDump.php --report 500 | tee "/var/log/mediawiki-''${lang}-import" + rm "''${destfile}" + } -function zim_fetch { - dest="/srv/zims" - mkdir -p "''${dest}" - file="''${1}" - echo "Downloading ''${file}" - transmission-remote -w "''${dest}" -a https://download.kiwix.org/zim/''${file}.zim.torrent -} + function zim_fetch { + dest="/srv/zims" + mkdir -p "''${dest}" + file="''${1}" + echo "Downloading ''${file}" + transmission-remote -w "''${dest}" -a https://download.kiwix.org/zim/''${file}.zim.torrent + } -#process_file "wiki-${date}-pages-articles-multistream.xml.bz2" -#process_file "wiki-${date}-pages-meta-current.xml.bz2" -#process_file "wiki-${date}-pages-articles.xml.bz2" + #process_file "wiki-${date}-pages-articles-multistream.xml.bz2" + #process_file "wiki-${date}-pages-meta-current.xml.bz2" + #process_file "wiki-${date}-pages-articles.xml.bz2" -zim_fetch wikipedia_en_all_maxi -zim_fetch wikipedia_fr_all_maxi -zim_fetch wikipedia_ht_all_maxi + zim_fetch wikipedia_en_all_maxi + zim_fetch wikipedia_fr_all_maxi + zim_fetch wikipedia_ht_all_maxi -zim_fetch wiktionary_en_all_maxi -zim_fetch wiktionary_fr_all_maxi + zim_fetch wiktionary_en_all_maxi + zim_fetch wiktionary_fr_all_maxi -zim_fetch wikiversity_en_all_maxi -zim_fetch wikiversity_fr_all_maxi + zim_fetch wikiversity_en_all_maxi + zim_fetch wikiversity_fr_all_maxi -zim_fetch wikibooks_en_all_maxi -zim_fetch wikibooks_fr_all_maxi + zim_fetch wikibooks_en_all_maxi + zim_fetch wikibooks_fr_all_maxi -zim_fetch wikisource_en_all_maxi -zim_fetch wikisource_fr_all_maxi + zim_fetch wikisource_en_all_maxi + zim_fetch wikisource_fr_all_maxi -zim_fetch ted_en_science -zim_fetch ted_en_technology + zim_fetch ted_en_science + zim_fetch ted_en_technology -zim_fetch phet_en -zim_fetch phet_fr -zim_fetch phet_ht + zim_fetch phet_en + zim_fetch phet_fr + zim_fetch phet_ht -zim_fetch gutenberg_en_all -zim_fetch gutenberg_fr_all + zim_fetch gutenberg_en_all + zim_fetch gutenberg_fr_all '' diff --git a/overlays/graypy.nix b/overlays/graypy.nix index 2cce63e..44faaa9 100644 --- a/overlays/graypy.nix +++ b/overlays/graypy.nix @@ -1,35 +1,34 @@ -{ - lib, - buildPythonPackage, - fetchFromGitHub, - - amqplib, - mock, - pytestCheckHook, - requests, +{ lib +, buildPythonPackage +, fetchFromGitHub +, amqplib +, mock +, pytestCheckHook +, requests +, }: buildPythonPackage rec { - pname = "graypy"; - version = "2.1.0"; + pname = "graypy"; + version = "2.1.0"; - src = fetchFromGitHub { - owner = "severb"; - repo = "graypy"; - rev = "2.1.0"; - hash = "sha256-y1HbJEpqnAgOeB+zXKy3iUT6Lpv0bufjL7+jWUSAjFs="; - }; + src = fetchFromGitHub { + owner = "severb"; + repo = "graypy"; + rev = "2.1.0"; + hash = "sha256-y1HbJEpqnAgOeB+zXKy3iUT6Lpv0bufjL7+jWUSAjFs="; + }; - nativeCheckInputs = [ - amqplib - mock - pytestCheckHook - requests - ]; + nativeCheckInputs = [ + amqplib + mock + pytestCheckHook + requests + ]; - meta = with lib; { - description = "Python logging handlers that send messages in the Graylog Extended Log Format (GELF)."; - homepage = "https://github.com/severb/graypy"; - license = licenses.bsd3; - }; + meta = with lib; { + description = "Python logging handlers that send messages in the Graylog Extended Log Format (GELF)."; + homepage = "https://github.com/severb/graypy"; + license = licenses.bsd3; + }; } diff --git a/overlays/homebrew.nix b/overlays/homebrew.nix index 932a9d8..ffcd099 100644 --- a/overlays/homebrew.nix +++ b/overlays/homebrew.nix @@ -1,43 +1,42 @@ -{ -lib, -pkgs, -stdenv, - -bash, -curl, -git, -ruby, -...}: +{ lib +, pkgs +, stdenv +, bash +, curl +, git +, ruby +, ... +}: stdenv.mkDerivation rec { - pname = "homebrew-installer"; - version = "20230531"; + pname = "homebrew-installer"; + version = "20230531"; - src = pkgs.fetchFromGitHub { - owner = "Homebrew"; - repo = "install"; - rev = "716a1d024f32890ef75ea82c18a769abc24e9475"; - sha256 = "sha256-xhxWWeCJm49bDzmBT2GHSC0CK1SoQArBhfh5sltGY5o="; - }; + src = pkgs.fetchFromGitHub { + owner = "Homebrew"; + repo = "install"; + rev = "716a1d024f32890ef75ea82c18a769abc24e9475"; + sha256 = "sha256-xhxWWeCJm49bDzmBT2GHSC0CK1SoQArBhfh5sltGY5o="; + }; - buildInputs = [ - bash - curl - git - ruby - ]; + buildInputs = [ + bash + curl + git + ruby + ]; - installPhase = '' - mkdir -p $out/bin/ - cp ${src}/install.sh $out/bin/install-homebrew.sh - cp ${src}/uninstall.sh $out/bin/uninstall-homebrew.sh - ''; + installPhase = '' + mkdir -p $out/bin/ + cp ${src}/install.sh $out/bin/install-homebrew.sh + cp ${src}/uninstall.sh $out/bin/uninstall-homebrew.sh + ''; - meta = with lib; { - description = "Runs the homebrew installer"; - homepage = "https://github.com/Homebrew/"; - license = licenses.bsd2; - platforms = [ "aarch64-darwin" "x86_64-darwin" "x86_64-linux" "aarch64-linux" ]; - maintainers = [ maintainers.greg ]; - }; + meta = with lib; { + description = "Runs the homebrew installer"; + homepage = "https://github.com/Homebrew/"; + license = licenses.bsd2; + platforms = [ "aarch64-darwin" "x86_64-darwin" "x86_64-linux" "aarch64-linux" ]; + maintainers = [ maintainers.greg ]; + }; } diff --git a/overlays/inject-darwin.nix b/overlays/inject-darwin.nix index baf6a45..c74d113 100644 --- a/overlays/inject-darwin.nix +++ b/overlays/inject-darwin.nix @@ -1,32 +1,31 @@ -{ - pkgs, - coreutils, - curl, - gnutar, - nix, - ... +{ pkgs +, coreutils +, curl +, gnutar +, nix +, ... }: pkgs.writeShellScriptBin "inject-darwin" '' -set -ex -set -o pipefail + set -ex + set -o pipefail -dir="$(${coreutils}/bin/mktemp -d)" -cd "''${dir}" + dir="$(${coreutils}/bin/mktemp -d)" + cd "''${dir}" -# Install nix-darwin -${nix}/bin/nix-build https://github.com/LnL7/nix-darwin/archive/master.tar.gz -A installer -./result/bin/darwin-installer + # Install nix-darwin + ${nix}/bin/nix-build https://github.com/LnL7/nix-darwin/archive/master.tar.gz -A installer + ./result/bin/darwin-installer -# Get my configuration -mkdir -p ~/.config/darwin -cd ~/.config/darwin -${curl}/bin/curl -O -L https://github.com/greg-hellings/nixos-config/archive/refs/heads/main.tar.gz -${gnutar}/bin/tar xvzf main.tar.gz --strip-components 1 + # Get my configuration + mkdir -p ~/.config/darwin + cd ~/.config/darwin + ${curl}/bin/curl -O -L https://github.com/greg-hellings/nixos-config/archive/refs/heads/main.tar.gz + ${gnutar}/bin/tar xvzf main.tar.gz --strip-components 1 -# Build NixOS for this system -pushd "''${dir}" -${nix}/bin/nix build "~/.config/darwin#darwinConfigurations.$(hostname -s).system" -./result/sw/bin/darwin-rebuild switch --flake ~/.config/darwin -popd -rm -r "''${dir}" + # Build NixOS for this system + pushd "''${dir}" + ${nix}/bin/nix build "~/.config/darwin#darwinConfigurations.$(hostname -s).system" + ./result/sw/bin/darwin-rebuild switch --flake ~/.config/darwin + popd + rm -r "''${dir}" '' diff --git a/overlays/inject.nix b/overlays/inject.nix index 04f648e..04c382f 100644 --- a/overlays/inject.nix +++ b/overlays/inject.nix @@ -1,56 +1,55 @@ -{ - pkgs, - git, - ... +{ pkgs +, git +, ... }: pkgs.writeShellScriptBin "inject-nixos-config" '' -hostname="''${1}" -if [ -n "''${hostname}"]; then - echo "You must provide a hostname"; - exit 1; -fi + hostname="''${1}" + if [ -n "''${hostname}"]; then + echo "You must provide a hostname"; + exit 1; + fi -mv /etc/nixos /etc/nixos.bk -cd /etc -${git}/bin/git clone http://github.com/greg-hellings/nixos-config nixos -mkdir -p "/etc/nixos/hosts/''${hostname}" + mv /etc/nixos /etc/nixos.bk + cd /etc + ${git}/bin/git clone http://github.com/greg-hellings/nixos-config nixos + mkdir -p "/etc/nixos/hosts/''${hostname}" -# Prepares everything for the flake usage -#cp /etc/nixos.bk/configuration.nix "/etc/nixos/hosts/''${hostname}/default.nix" -cat << EOF > "/etc/nixos/hosts/''${hostname}/default.nix" -{ pkgs, config, ... }: + # Prepares everything for the flake usage + #cp /etc/nixos.bk/configuration.nix "/etc/nixos/hosts/''${hostname}/default.nix" + cat << EOF > "/etc/nixos/hosts/''${hostname}/default.nix" + { pkgs, config, ... }: -{ - imports = [ ./hardware-configuration.nix ]; + { + imports = [ ./hardware-configuration.nix ]; - boot.loader = { - systemd-boot.enable = true; - efi.canTouchEfiVariables = true; - }; + boot.loader = { + systemd-boot.enable = true; + efi.canTouchEfiVariables = true; + }; - networking.hostName = "''${hostname}"; - greg = { - home = true; - tailscale.enable = true; - }; -} -EOF -cp /etc/nixos.bk/hardware-configuration.nix "/etc/nixos/hosts/''${hostname}/hardware-configuration.nix" + networking.hostName = "''${hostname}"; + greg = { + home = true; + tailscale.enable = true; + }; + } + EOF + cp /etc/nixos.bk/hardware-configuration.nix "/etc/nixos/hosts/''${hostname}/hardware-configuration.nix" -# Prepare home-manager portion for setup -mkdir -p "/etc/nixos/home/hosts/''${hostname}" -cat << EOF > "/etc/nixos/home/hosts/''${hostname}/default.nix" -{ pkgs, config, ... }: + # Prepare home-manager portion for setup + mkdir -p "/etc/nixos/home/hosts/''${hostname}" + cat << EOF > "/etc/nixos/home/hosts/''${hostname}/default.nix" + { pkgs, config, ... }: -{ -} -EOF + { + } + EOF -# Prepares it for injecting the use case into the flake usage -cp /etc/nixos.bk/hardware-configuration.nix /etc/nixos -chown -R greg nixos + # Prepares it for injecting the use case into the flake usage + cp /etc/nixos.bk/hardware-configuration.nix /etc/nixos + chown -R greg nixos -echo "Now you should be able to just run `nixos-rebuild switch` to enable the flake functionality" -echo "After that and adding the entry to the flake, run `nixos-rebuild boot --flake '.#''${hostname}'` and reboot" + echo "Now you should be able to just run `nixos-rebuild switch` to enable the flake functionality" + echo "After that and adding the entry to the flake, run `nixos-rebuild boot --flake '.#''${hostname}'` and reboot" '' diff --git a/overlays/itg-django-utils.nix b/overlays/itg-django-utils.nix index 0a4f712..a54929b 100644 --- a/overlays/itg-django-utils.nix +++ b/overlays/itg-django-utils.nix @@ -1,35 +1,34 @@ -{ - lib, - buildPythonPackage, - fetchurl, - - django, - djangorestframework, - graypy, - setuptools, +{ lib +, buildPythonPackage +, fetchurl +, django +, djangorestframework +, graypy +, setuptools +, }: buildPythonPackage rec { - pname = "itg-django-utils"; - version = "0.1.11"; + pname = "itg-django-utils"; + version = "0.1.11"; - src = fetchurl { - url = "https://pypi.ivrtechnology.com/packages/itg-django-utils-0.1.12.tar.gz"; - hash = "sha256-LbOl4L4UZbRTlLuBL4L3ser6+WDuP3R5a03EIh1xSK8="; - }; + src = fetchurl { + url = "https://pypi.ivrtechnology.com/packages/itg-django-utils-0.1.12.tar.gz"; + hash = "sha256-LbOl4L4UZbRTlLuBL4L3ser6+WDuP3R5a03EIh1xSK8="; + }; - propagatedBuildInputs = [ - django - djangorestframework - graypy - setuptools - ]; + propagatedBuildInputs = [ + django + djangorestframework + graypy + setuptools + ]; - meta = with lib; { - description = "ITG specific stuff"; - homepage = "http://www.ivrtechnology.com"; - maintainers = []; - }; + meta = with lib; { + description = "ITG specific stuff"; + homepage = "http://www.ivrtechnology.com"; + maintainers = [ ]; + }; - doCheck = false; + doCheck = false; } diff --git a/overlays/packages.nix b/overlays/packages.nix index 09f4baf..522ae91 100644 --- a/overlays/packages.nix +++ b/overlays/packages.nix @@ -1,26 +1,27 @@ { nixunstable, flake-utils }: flake-utils.lib.eachDefaultSystemMap (system: - let - pkgs = (import nixunstable { inherit system; }); - lib = pkgs.lib; - callPackage = pkgs.lib.callPackageWith pkgs; - python = pkgs.packages.python3; - cp = pkgs.packages.python3.pkgs.callPackage; - in { - hms = pkgs.callPackage ./hms.nix { - inherit pkgs; - }; +let + pkgs = (import nixunstable { inherit system; }); + lib = pkgs.lib; + callPackage = pkgs.lib.callPackageWith pkgs; + python = pkgs.packages.python3; + cp = pkgs.packages.python3.pkgs.callPackage; +in +{ + hms = pkgs.callPackage ./hms.nix { + inherit pkgs; + }; - brew = pkgs.callPackage ./homebrew.nix {}; + brew = pkgs.callPackage ./homebrew.nix { }; - django-rapyd-modernauth = pkgs.python3.pkgs.callPackage ./django-rapyd-modernauth.nix { - buildPythonPackage = pkgs.python3.pkgs.buildPythonPackage; - }; + django-rapyd-modernauth = pkgs.python3.pkgs.callPackage ./django-rapyd-modernauth.nix { + buildPythonPackage = pkgs.python3.pkgs.buildPythonPackage; + }; - xonsh-direnv = pkgs.callPackage ./xonsh-direnv.nix { - buildPythonPackage = pkgs.python3.pkgs.buildPythonPackage; - fetchPypi = pkgs.python.pkgs.fetchPypi; - }; - } + xonsh-direnv = pkgs.callPackage ./xonsh-direnv.nix { + buildPythonPackage = pkgs.python3.pkgs.buildPythonPackage; + fetchPypi = pkgs.python.pkgs.fetchPypi; + }; +} ) diff --git a/overlays/pipenv.nix b/overlays/pipenv.nix index 6f129ab..a821848 100644 --- a/overlays/pipenv.nix +++ b/overlays/pipenv.nix @@ -22,7 +22,8 @@ let pythonEnv = python3.withPackages runtimeDeps; -in buildPythonApplication rec { +in +buildPythonApplication rec { pname = "pipenv"; version = "2023.11.15"; format = "pyproject"; diff --git a/overlays/setup-ssh/default.nix b/overlays/setup-ssh/default.nix index 511b615..2ea5e6f 100644 --- a/overlays/setup-ssh/default.nix +++ b/overlays/setup-ssh/default.nix @@ -1,3 +1,3 @@ { pkgs, gh, ... }: -pkgs.writeShellScriptBin "setup-ssh" (builtins.replaceStrings ["gh "] ["${gh}/bin/gh "] (builtins.readFile ./setup-ssh.sh)) +pkgs.writeShellScriptBin "setup-ssh" (builtins.replaceStrings [ "gh " ] [ "${gh}/bin/gh " ] (builtins.readFile ./setup-ssh.sh)) diff --git a/overlays/template.nix b/overlays/template.nix index e4bfcde..e71e2fe 100644 --- a/overlays/template.nix +++ b/overlays/template.nix @@ -2,14 +2,14 @@ name: vars: template: (stdenv.mkDerivation { - inherit name; + inherit name; - passAsFile = [ "varsData" ]; - varsData = builtins.toJSON vars; + passAsFile = [ "varsData" ]; + varsData = builtins.toJSON vars; - nativeBuildInputs = [ jinja2-cli ]; - phases = [ "buildPhase" "installPhase" ]; + nativeBuildInputs = [ jinja2-cli ]; + phases = [ "buildPhase" "installPhase" ]; - buildPhase = ''${jinja2-cli}/bin/jinja2 --format=json ${template} $varsDataPath > result''; - installPhase = "cp result $out"; + buildPhase = ''${jinja2-cli}/bin/jinja2 --format=json ${template} $varsDataPath > result''; + installPhase = "cp result $out"; }) diff --git a/overlays/upgrade-pg-cluster.nix b/overlays/upgrade-pg-cluster.nix index b8d5e22..90fd818 100644 --- a/overlays/upgrade-pg-cluster.nix +++ b/overlays/upgrade-pg-cluster.nix @@ -1,24 +1,25 @@ { postgresql_15, postgresql_16, writeScriptBin, ... }: let - newPostgres = postgresql_16; - oldPostgres = postgresql_15; -in writeScriptBin "upgrade-pg-cluster" '' - set -eux - systemctl stop postgresql + newPostgres = postgresql_16; + oldPostgres = postgresql_15; +in +writeScriptBin "upgrade-pg-cluster" '' + set -eux + systemctl stop postgresql - export NEWDATA="/var/lib/postgresql/${newPostgres.psqlSchema}" - export NEWBIN="${newPostgres}/bin" + export NEWDATA="/var/lib/postgresql/${newPostgres.psqlSchema}" + export NEWBIN="${newPostgres}/bin" - export OLDDATA="/var/lib/postgresql/${oldPostgres.psqlSchema}" - export OLDBIN="${oldPostgres}/bin" + export OLDDATA="/var/lib/postgresql/${oldPostgres.psqlSchema}" + export OLDBIN="${oldPostgres}/bin" - install -d -m 0700 -o postgres -g postgres "$NEWDATA" - cd "$NEWDATA" - sudo -u postgres "$NEWBIN/initdb" -D "$NEWDATA" + install -d -m 0700 -o postgres -g postgres "$NEWDATA" + cd "$NEWDATA" + sudo -u postgres "$NEWBIN/initdb" -D "$NEWDATA" - sudo -u postgres "$NEWBIN/pg_upgrade" \ - --old-datadir "$OLDDATA" --new-datadir "$NEWDATA" \ - --old-bindir "$OLDBIN" --new-bindir "$NEWBIN" \ - "$@" + sudo -u postgres "$NEWBIN/pg_upgrade" \ + --old-datadir "$OLDDATA" --new-datadir "$NEWDATA" \ + --old-bindir "$OLDBIN" --new-bindir "$NEWBIN" \ + "$@" '' diff --git a/overlays/xonsh-apipenv.nix b/overlays/xonsh-apipenv.nix index 063f92d..a05c48f 100644 --- a/overlays/xonsh-apipenv.nix +++ b/overlays/xonsh-apipenv.nix @@ -1,32 +1,32 @@ -{ - lib, - buildPythonPackage, - fetchFromGitHub, - toPythonModule, - pipenv, +{ lib +, buildPythonPackage +, fetchFromGitHub +, toPythonModule +, pipenv +, }: buildPythonPackage rec { - pname = "xonsh-apipenv"; - version = "0.5.0"; + pname = "xonsh-apipenv"; + version = "0.5.0"; - src = fetchFromGitHub { - owner = "greg-hellings"; - repo = "xontrib-apipenv"; - rev = "0.5.0"; - hash = "sha256-QJatIiIP1YVT8M5vLUPHmf/8CGZ34cXMBXQmfSgY5C4="; - }; + src = fetchFromGitHub { + owner = "greg-hellings"; + repo = "xontrib-apipenv"; + rev = "0.5.0"; + hash = "sha256-QJatIiIP1YVT8M5vLUPHmf/8CGZ34cXMBXQmfSgY5C4="; + }; - doCheck = false; + doCheck = false; - dependencies = [ - (toPythonModule pipenv) - ]; + dependencies = [ + (toPythonModule pipenv) + ]; - meta = with lib; { - description = "Auto pipenv support for Xonsh"; - homepage = "https://github.com/greg-hellings/xontrib-apipenv"; - license = licenses.mit; - maintainers = []; - }; + meta = with lib; { + description = "Auto pipenv support for Xonsh"; + homepage = "https://github.com/greg-hellings/xontrib-apipenv"; + license = licenses.mit; + maintainers = [ ]; + }; } diff --git a/secrets/secrets.nix b/secrets/secrets.nix index 78f87dd..eaa21f4 100644 --- a/secrets/secrets.nix +++ b/secrets/secrets.nix @@ -1,77 +1,77 @@ let - linode = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMv9Zud3kZOl86gtmkn+uj3D4kiXWDPtyUL02VVLNR4Q"; - jude = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOos0zQePsa+T6Z2dsKbPOvEdrBQ8a6mx3s7pN6ysCI0 root@jude"; - myself = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHleYKtfV4W1Z63Ysu9w5Rbglqlz4F92YcZoMkucoTNf"; - genesis = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEI9jbTPmEWQ0F2bLYmnIOLmBnag1fkKxHRjz3X8lB/k root@genesis"; - hosea = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKLIwkTTXA56sUlUjEulXXZRvZy5H4a5ZwgKWLlpkQDz"; - jeremiah = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOjQjXq9WYU2Ki27BR9WwJ4ZruS/lJXbjC1b0Q42Adi0"; - systems = [ genesis linode jude myself hosea jeremiah ]; + linode = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMv9Zud3kZOl86gtmkn+uj3D4kiXWDPtyUL02VVLNR4Q"; + jude = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOos0zQePsa+T6Z2dsKbPOvEdrBQ8a6mx3s7pN6ysCI0 root@jude"; + myself = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHleYKtfV4W1Z63Ysu9w5Rbglqlz4F92YcZoMkucoTNf"; + genesis = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEI9jbTPmEWQ0F2bLYmnIOLmBnag1fkKxHRjz3X8lB/k root@genesis"; + hosea = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKLIwkTTXA56sUlUjEulXXZRvZy5H4a5ZwgKWLlpkQDz"; + jeremiah = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOjQjXq9WYU2Ki27BR9WwJ4ZruS/lJXbjC1b0Q42Adi0"; + systems = [ genesis linode jude myself hosea jeremiah ]; - user1 = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAEAQDLQRq55JKqLifX+31kEXyuoB8gfM+5thAlgR7XLPvvdu6g2a5cCWyozQ1I2oGbPRfJtzcJ5ifM7Ii2PuqAj3MdYFLHBEDOhIpBBWme9Ts2YB9HJ4NorBvB4zEfJd0Q7k2MmylyeBOwdwGz3bVqPRDcJbxWFMDHqr33FEs6SXdfyAQ5SvhWGARI84qz8zUUdOp6M4e3aIGO3cx1gA+YzYQ4FbUtL8+m1NFO8VoNFMZBMf5q0iF/SgEu5bmGWUCePia6DvfeBFQ2/y4Y7WmOj980WE+JmFTkIvmGruMYeGI8FuDQ2JIIIcehddy9bQbPF4VlGnTFsHqJYVRUUWc+vH1cPNMn01oB8s27ogf9e1lyhIN+cZOgp/jDt4eXcO4Wr04uwj7CI6m+d8iMQOa5Jv0hmNgqqiwOMVBlKeo0FCxlovzwvn/Lia9WZ74JqM6JwLCD8SZ0oFgiSIHOTHrQhr7iaCmj7X/0ey7VR8FnCrpeAJpG+ELTfWGshF1d9QR2zW7u4EsXTDLiuOmdJ+/KxwMvjMcWdlg2+Qch6SwulTQRxWaED2IWJo+YiAql8eaiVXu/eZJGLoiskGFZnONoLrzIT4pSjakPlrSpn/M/GkP1pDpaMkr24OhJsGpJNEU3F1ZcOMqy2iJzIxlPmU8Xg0I/OrnbJplpaXeRCqnmouJUJhWkaPzawaVyW7dtvprLWcpQtUgTRet18WLyOrLKlq1jwvNRMTPKUJ2IFJMpk2pNEP6bdiUxyMa4vrRIEU2p1zsYSUJpCRLtccZ/i/+yAqwnTA2L5TdAORi9nD2uCdM/Ljz52V3A14QapS6oqcoWx2soWKgnsbVXoG8DxmUTpll77Ze9t7Y5216SMInWuOu0vstP8ZcgFmWsiBgIYIuLA58abWHMxgD251phYidua6R3Gtkf8J/kYqTR1P6eJF1bt5efEg7FD2aL1QQZsYJo3CRNz7yVe1XqMdPbfe2mFXQVF9TDX5x6r9Ir3d0KiEmTlBdByz8nSyPJ8IQxC58NT4LNVQs3p2XH2Zcf6B4JOBSmV4NNBnLseFobsxniWjkWwZigED/D2iu3OXuuhmskCbw0hKy2rBcKffaSNMioVqYIiYNfKlMlSvAacQKqc/1HCpqgX8PwAcSgNSLy4K7/gIrTHmjY+g+CH7onzatWzkLo+0vsZRa/D/qwhhK2CU2FeU07mhnWxWuzqpJuqVaAwDTaEforK7nQUtAOFAZZP6qGhIoqsynYt4THb+QORb3QYfaP0PVgQwXfVU5Q8eUQFZ8A+siPtOASFjDumsIbseB5VzkF+UhvdseJwkX2+4pVFu8eHFDyvArYsHeGK6fBcQGJFQc2jSs6doIP9HD9IO2R ghelling@unknown38BAF87CD102"; - user4 = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAEAQCoGGV3eD1oF0O62JZfCWNxmViRjRGQsfOhRkQfzQROkwDlFZ7S1+02fudD9t7mPtZE6dQ4yS2+6Q3NIfGW8NBbZAlWwsQ6PnrpuAhWpWc+ng/IDQd9CH/rBCt5bWSLL8AGHa4c+qde7iyoFGK0l9jXVD9wATBFQ274WTmPacVQVHmIAmJS6ISmR6vlq9eaDj1fX8wixao6WvzfwAUvXIs8nhPEfmtyu4T/1Eev9rVIxOw3ODQjk/E0VWV4Koeptsyc+V+j+XMyA91v8f20T4Uwe5LGnJHSQS0WavHnCMWHb1tzkmiKdaNCymoDUcUF2rywMYry7JN0kZo2mp2d7OzE/RP3bz/IsAI33+DwRlDYDNzgeLsLVmOJij61AtqBZque6WDcyCF8HN0ZaY0KJPOtNlN92+GUBRF/Faei0MXZ7wW2BZL5Bc7qnXc9USyhPNsm2vQ7LLhh/NtBGqB88+C+AidTTZ/xiIHKWZJXPkWLPRcK5cfaFqHFqcVMk4U+b0FYB95vYPKmjURlAZ6WrU6dNaNaMH9hJSE6/03is4hb4t8RCRiNaR41pEACDZbATjY0DInFn1LxxpUV66xfpOVg5hKm5ScIks3KxWJ8i3v4/cX7WvbDC/UzWb2UygpsqR7/1n5LV1SNPl+/qxFfdaOyZ8WVvx7DKGxkKfkPBgGwdpSthdv7BY+SC4sT9WXQAPGnvOIk6HwKhHjJYX7AIKK64ACfGZbjBC2gg7Ocl4HkgwpYYlUWLRJdJUhHOCi3VhPZDspYhw/UxPnUhYa8lxq5l7kgkks/tFe1qHOvPe3QRW6brg3EdJNkwtMrlrstW4/nph/KFqSshzNVDlEqTAnhE1cjbBZNmlHt1Un4ixcW1b8b86mE+472pSsIEfO8vxP26brQhxepJFZGOFv2vs3XDrrtn6IMJok4e+AQSCCY0kCcgfG5nMYXUoWpGyTpN/JLG0joJuhPWt58OaOzzKNPq2+rCVAbS7/UmDCqkwxjCywxOZRwluBsEWbZaLEdOwQOfIZQGwSDBM0hfHJJxMSaLN3rCe6VZb+c/5mFXUZ46L5mOGkRlO1TOEAe4jqawAQnuGaHN8mMWSw1gKM+UBXTKa0tBR6Aj/OSfPW0jU+mz/YzzJkzNnlRFiSrLxWvL4eXaBsMZvgKdpA41+E4JG8Vu+9D9KNGRnLASOCxRknV18MubZlEEyKby9A6TaKoPrz7GVQZP+36V9DtAJAza74nHSDNAQG/4w2BLOw9+VrDNdXwjMbgG+SN4f1K+e554OirtSMVB73VXjdwoH/FyX+7+dcUZRQ7V2n37jIVOE6CcuEPjzdnkvKSqBsdTO3Bt66+QtS9BwGHu5c01+Q7jvIl greg@nixos"; - user5 = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAEAQDR4vmc5TiymSjMB7E+oYsiTxOg+2xwnLAILYjQKPA7dIvz/A/HW31R1aVVxNEgkHm8qeqmgE1bUysMMl128zvdKmwkMmq2uagx9hboyfCwOYRaQOtpS0dlgSllhM654vL9553t94sTuMIfNUiXBD3EV2Z5JJ1RteCkBTJjzmXQnV9he0xozBYOdGv35UGneQzAr7Pps9iK81mR4yW+vLcW3pAaPmDBbN7C6WFxqcEBWsaJZK0rLCTrQo+6B130XgH6gPgh4GyDaRmtRJl63yANiP/RfkDFTPKOh87slLLZaHJUe94P2CTZw0e9xSzWuzx71nBp9JhkoZkI9XD+AnbHIZ9X3twIADUf+D0fivzOH+Yzne0gNRFa+O4x8xd/xj8QeM+Rr1ATikBf/FRfyx+RzHgHS1ZyOKfIpQbrm44E8Smv7FzS5RcCfAScSn0npOqP0cilYjtDCEoeMVsx4XQy4+iYLOA/EaMICSz2PwQFG/KXe7NK30Cc5flq5qUiz8TX1Mzlxuro4qTktYSXZBs5YyEg3Za/hcqMV52kVn0W8S1DatHOL4TlRKYeKsg1hWNvtm2MRqJvWkqK9vNNL86Ew5D5hgXdCk+AiRzOhQxfprPYMea2Vx1Mkaq3VYHWmJBWc/m4aOKUSajhFu8KG7l8bc4IkgC+qQCYzr6pCUDlCaCEF1iQ3lItSkbJJmRBHKEOb85lsIJ/SZ0bhsMl8bc9z33zY+bwv2NezG/aKVGrny4ZTAI1BKkZN/60L0yzJihyKamEa442jjnvG1jzC2wEtd/0gCGWScfZsQWqDu97spbeq8jrc67U9xqlGTrWyyNsCW2lpu26cQWWRC8ufl5zBNRDFDSYKceBaJ2+sx1GPj3YYdJSlTt5JvxNyBg0BGfGqCTd0w4IXF3KP9IZRWWAKPaOZcil2MRZwYhWEd7p+CtKVAL93uW0sE+0C13+iFMnBUkFBJ2dZH+tWpywCRYcrVNvrBlsHe2XniwBwvQHUFgKaQAB8upFTK1xBWTh2S+CVyNed/fckAUrPDj4sI2NERGcyPC5Oi6r0fUPtcWvKRfA/yXx5A0iNWc6acTqd5wwSO3s8rOCjIwdczZmkmnjAf3UKhmtDnwRd9rbO5Hanom80re9Dk0W+z9E2+70b9iYvZ60pbw+cG4WqEQnr02RS8hKvU0CsYFoDMTzV4snqTKNrl0IeD+Fmjl7oDkcC4YQbZd2902qVL3WHHvW+p0WQ1B/rk8BPVRYVmrUQbqwPFCQlmTe3Zy+LpqbWYemhQJGVSiEiioVNCc7pHO6RyWLCoEQKwKHAoNleKtkG94hT/d0z+1RYpB/nbJ51BPihK5EMlXbw/Hu1SVaaDLOSL6p greg@mm"; + user1 = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAEAQDLQRq55JKqLifX+31kEXyuoB8gfM+5thAlgR7XLPvvdu6g2a5cCWyozQ1I2oGbPRfJtzcJ5ifM7Ii2PuqAj3MdYFLHBEDOhIpBBWme9Ts2YB9HJ4NorBvB4zEfJd0Q7k2MmylyeBOwdwGz3bVqPRDcJbxWFMDHqr33FEs6SXdfyAQ5SvhWGARI84qz8zUUdOp6M4e3aIGO3cx1gA+YzYQ4FbUtL8+m1NFO8VoNFMZBMf5q0iF/SgEu5bmGWUCePia6DvfeBFQ2/y4Y7WmOj980WE+JmFTkIvmGruMYeGI8FuDQ2JIIIcehddy9bQbPF4VlGnTFsHqJYVRUUWc+vH1cPNMn01oB8s27ogf9e1lyhIN+cZOgp/jDt4eXcO4Wr04uwj7CI6m+d8iMQOa5Jv0hmNgqqiwOMVBlKeo0FCxlovzwvn/Lia9WZ74JqM6JwLCD8SZ0oFgiSIHOTHrQhr7iaCmj7X/0ey7VR8FnCrpeAJpG+ELTfWGshF1d9QR2zW7u4EsXTDLiuOmdJ+/KxwMvjMcWdlg2+Qch6SwulTQRxWaED2IWJo+YiAql8eaiVXu/eZJGLoiskGFZnONoLrzIT4pSjakPlrSpn/M/GkP1pDpaMkr24OhJsGpJNEU3F1ZcOMqy2iJzIxlPmU8Xg0I/OrnbJplpaXeRCqnmouJUJhWkaPzawaVyW7dtvprLWcpQtUgTRet18WLyOrLKlq1jwvNRMTPKUJ2IFJMpk2pNEP6bdiUxyMa4vrRIEU2p1zsYSUJpCRLtccZ/i/+yAqwnTA2L5TdAORi9nD2uCdM/Ljz52V3A14QapS6oqcoWx2soWKgnsbVXoG8DxmUTpll77Ze9t7Y5216SMInWuOu0vstP8ZcgFmWsiBgIYIuLA58abWHMxgD251phYidua6R3Gtkf8J/kYqTR1P6eJF1bt5efEg7FD2aL1QQZsYJo3CRNz7yVe1XqMdPbfe2mFXQVF9TDX5x6r9Ir3d0KiEmTlBdByz8nSyPJ8IQxC58NT4LNVQs3p2XH2Zcf6B4JOBSmV4NNBnLseFobsxniWjkWwZigED/D2iu3OXuuhmskCbw0hKy2rBcKffaSNMioVqYIiYNfKlMlSvAacQKqc/1HCpqgX8PwAcSgNSLy4K7/gIrTHmjY+g+CH7onzatWzkLo+0vsZRa/D/qwhhK2CU2FeU07mhnWxWuzqpJuqVaAwDTaEforK7nQUtAOFAZZP6qGhIoqsynYt4THb+QORb3QYfaP0PVgQwXfVU5Q8eUQFZ8A+siPtOASFjDumsIbseB5VzkF+UhvdseJwkX2+4pVFu8eHFDyvArYsHeGK6fBcQGJFQc2jSs6doIP9HD9IO2R ghelling@unknown38BAF87CD102"; + user4 = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAEAQCoGGV3eD1oF0O62JZfCWNxmViRjRGQsfOhRkQfzQROkwDlFZ7S1+02fudD9t7mPtZE6dQ4yS2+6Q3NIfGW8NBbZAlWwsQ6PnrpuAhWpWc+ng/IDQd9CH/rBCt5bWSLL8AGHa4c+qde7iyoFGK0l9jXVD9wATBFQ274WTmPacVQVHmIAmJS6ISmR6vlq9eaDj1fX8wixao6WvzfwAUvXIs8nhPEfmtyu4T/1Eev9rVIxOw3ODQjk/E0VWV4Koeptsyc+V+j+XMyA91v8f20T4Uwe5LGnJHSQS0WavHnCMWHb1tzkmiKdaNCymoDUcUF2rywMYry7JN0kZo2mp2d7OzE/RP3bz/IsAI33+DwRlDYDNzgeLsLVmOJij61AtqBZque6WDcyCF8HN0ZaY0KJPOtNlN92+GUBRF/Faei0MXZ7wW2BZL5Bc7qnXc9USyhPNsm2vQ7LLhh/NtBGqB88+C+AidTTZ/xiIHKWZJXPkWLPRcK5cfaFqHFqcVMk4U+b0FYB95vYPKmjURlAZ6WrU6dNaNaMH9hJSE6/03is4hb4t8RCRiNaR41pEACDZbATjY0DInFn1LxxpUV66xfpOVg5hKm5ScIks3KxWJ8i3v4/cX7WvbDC/UzWb2UygpsqR7/1n5LV1SNPl+/qxFfdaOyZ8WVvx7DKGxkKfkPBgGwdpSthdv7BY+SC4sT9WXQAPGnvOIk6HwKhHjJYX7AIKK64ACfGZbjBC2gg7Ocl4HkgwpYYlUWLRJdJUhHOCi3VhPZDspYhw/UxPnUhYa8lxq5l7kgkks/tFe1qHOvPe3QRW6brg3EdJNkwtMrlrstW4/nph/KFqSshzNVDlEqTAnhE1cjbBZNmlHt1Un4ixcW1b8b86mE+472pSsIEfO8vxP26brQhxepJFZGOFv2vs3XDrrtn6IMJok4e+AQSCCY0kCcgfG5nMYXUoWpGyTpN/JLG0joJuhPWt58OaOzzKNPq2+rCVAbS7/UmDCqkwxjCywxOZRwluBsEWbZaLEdOwQOfIZQGwSDBM0hfHJJxMSaLN3rCe6VZb+c/5mFXUZ46L5mOGkRlO1TOEAe4jqawAQnuGaHN8mMWSw1gKM+UBXTKa0tBR6Aj/OSfPW0jU+mz/YzzJkzNnlRFiSrLxWvL4eXaBsMZvgKdpA41+E4JG8Vu+9D9KNGRnLASOCxRknV18MubZlEEyKby9A6TaKoPrz7GVQZP+36V9DtAJAza74nHSDNAQG/4w2BLOw9+VrDNdXwjMbgG+SN4f1K+e554OirtSMVB73VXjdwoH/FyX+7+dcUZRQ7V2n37jIVOE6CcuEPjzdnkvKSqBsdTO3Bt66+QtS9BwGHu5c01+Q7jvIl greg@nixos"; + user5 = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAEAQDR4vmc5TiymSjMB7E+oYsiTxOg+2xwnLAILYjQKPA7dIvz/A/HW31R1aVVxNEgkHm8qeqmgE1bUysMMl128zvdKmwkMmq2uagx9hboyfCwOYRaQOtpS0dlgSllhM654vL9553t94sTuMIfNUiXBD3EV2Z5JJ1RteCkBTJjzmXQnV9he0xozBYOdGv35UGneQzAr7Pps9iK81mR4yW+vLcW3pAaPmDBbN7C6WFxqcEBWsaJZK0rLCTrQo+6B130XgH6gPgh4GyDaRmtRJl63yANiP/RfkDFTPKOh87slLLZaHJUe94P2CTZw0e9xSzWuzx71nBp9JhkoZkI9XD+AnbHIZ9X3twIADUf+D0fivzOH+Yzne0gNRFa+O4x8xd/xj8QeM+Rr1ATikBf/FRfyx+RzHgHS1ZyOKfIpQbrm44E8Smv7FzS5RcCfAScSn0npOqP0cilYjtDCEoeMVsx4XQy4+iYLOA/EaMICSz2PwQFG/KXe7NK30Cc5flq5qUiz8TX1Mzlxuro4qTktYSXZBs5YyEg3Za/hcqMV52kVn0W8S1DatHOL4TlRKYeKsg1hWNvtm2MRqJvWkqK9vNNL86Ew5D5hgXdCk+AiRzOhQxfprPYMea2Vx1Mkaq3VYHWmJBWc/m4aOKUSajhFu8KG7l8bc4IkgC+qQCYzr6pCUDlCaCEF1iQ3lItSkbJJmRBHKEOb85lsIJ/SZ0bhsMl8bc9z33zY+bwv2NezG/aKVGrny4ZTAI1BKkZN/60L0yzJihyKamEa442jjnvG1jzC2wEtd/0gCGWScfZsQWqDu97spbeq8jrc67U9xqlGTrWyyNsCW2lpu26cQWWRC8ufl5zBNRDFDSYKceBaJ2+sx1GPj3YYdJSlTt5JvxNyBg0BGfGqCTd0w4IXF3KP9IZRWWAKPaOZcil2MRZwYhWEd7p+CtKVAL93uW0sE+0C13+iFMnBUkFBJ2dZH+tWpywCRYcrVNvrBlsHe2XniwBwvQHUFgKaQAB8upFTK1xBWTh2S+CVyNed/fckAUrPDj4sI2NERGcyPC5Oi6r0fUPtcWvKRfA/yXx5A0iNWc6acTqd5wwSO3s8rOCjIwdczZmkmnjAf3UKhmtDnwRd9rbO5Hanom80re9Dk0W+z9E2+70b9iYvZ60pbw+cG4WqEQnr02RS8hKvU0CsYFoDMTzV4snqTKNrl0IeD+Fmjl7oDkcC4YQbZd2902qVL3WHHvW+p0WQ1B/rk8BPVRYVmrUQbqwPFCQlmTe3Zy+LpqbWYemhQJGVSiEiioVNCc7pHO6RyWLCoEQKwKHAoNleKtkG94hT/d0z+1RYpB/nbJ51BPihK5EMlXbw/Hu1SVaaDLOSL6p greg@mm"; - user_genesis_virt = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFWPSFQT0AH77wrwRhiskcBS0w4ZakBRdJywYYBsnm3S greg@genesis"; - user_ivr = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMYzms+KIe5/bYF3uCyFjA5e1AgMPLIA3c4k417coqBe gregory.hellings@ls23003"; - user_jude = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINnRc/kBhxcjpUtiRQY+BXnSObdp0jFL1395wAQxJip7 greg@jude"; - user_linode = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINAX6pNx5mbwIa8X+GzktyNijfYmJUpgROFpRxSW9js0 greg@linode"; - user_myself = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAl6DJVrPSujvJSAEA5Q8tRrzfJs/c6DMwqwQEUFffIR greg@myself"; - user_hosea = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGrqJQvDspLi1vXQRJ/Z5kN/F8jCBHvaXjo+5zLuIYjR greg@hosea"; - user_jeremiah = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIYIiecdyM9c7tXgR96983K3wqiJeQRMbrzGIF8Wy6uO greg@jeremiah"; + user_genesis_virt = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFWPSFQT0AH77wrwRhiskcBS0w4ZakBRdJywYYBsnm3S greg@genesis"; + user_ivr = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMYzms+KIe5/bYF3uCyFjA5e1AgMPLIA3c4k417coqBe gregory.hellings@ls23003"; + user_jude = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINnRc/kBhxcjpUtiRQY+BXnSObdp0jFL1395wAQxJip7 greg@jude"; + user_linode = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINAX6pNx5mbwIa8X+GzktyNijfYmJUpgROFpRxSW9js0 greg@linode"; + user_myself = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAl6DJVrPSujvJSAEA5Q8tRrzfJs/c6DMwqwQEUFffIR greg@myself"; + user_hosea = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGrqJQvDspLi1vXQRJ/Z5kN/F8jCBHvaXjo+5zLuIYjR greg@hosea"; + user_jeremiah = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIYIiecdyM9c7tXgR96983K3wqiJeQRMbrzGIF8Wy6uO greg@jeremiah"; - users = [ - user_genesis_virt - user_ivr - user_jude - user_linode - user_myself - user_hosea - user_jeremiah - ]; + users = [ + user_genesis_virt + user_ivr + user_jude + user_linode + user_myself + user_hosea + user_jeremiah + ]; - everyone = systems ++ users; + everyone = systems ++ users; in { - # Demo of how to create it - "matrix.age".publicKeys = everyone; - # At the point where you want to use it, put - # age.secrets.matrix.file = ../../secrets/matrix.age; - # Then you can reference the file at /run/agenix/matrix - "nextcloudadmin.age".publicKeys = everyone; + # Demo of how to create it + "matrix.age".publicKeys = everyone; + # At the point where you want to use it, put + # age.secrets.matrix.file = ../../secrets/matrix.age; + # Then you can reference the file at /run/agenix/matrix + "nextcloudadmin.age".publicKeys = everyone; - "3proxy.age".publicKeys = everyone; + "3proxy.age".publicKeys = everyone; - "linode-forgejo-runner.age".publicKeys = everyone; - "jude-forgejo-runner.age".publicKeys = everyone; - "minio.age".publicKeys = everyone; + "linode-forgejo-runner.age".publicKeys = everyone; + "jude-forgejo-runner.age".publicKeys = everyone; + "minio.age".publicKeys = everyone; - "restic-env.age".publicKeys = everyone; - "restic-pw.age".publicKeys = everyone; + "restic-env.age".publicKeys = everyone; + "restic-pw.age".publicKeys = everyone; - "dendrite.age".publicKeys = everyone; - "dendrite_key.age".publicKeys = everyone; - "gitlab/secret.age".publicKeys = everyone; - "gitlab/otp.age".publicKeys = everyone; - "gitlab/db.age".publicKeys = everyone; - "gitlab/jws.age".publicKeys = everyone; - # openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.crt -days 365 -nodes -subj '/CN=issuer' - # Then pipe the resulting files to agenix -e - "gitlab/key.age".publicKeys = everyone; - "gitlab/cert.age".publicKeys = everyone; - "gitlab/jeremiah-runner-reg.age".publicKeys = everyone; - "gitlab/myself-qemu-runner-reg.age".publicKeys = everyone; - "gitlab/myself-vbox-runner-reg.age".publicKeys = everyone; - "gitlab/myself-podman-runner-reg.age".publicKeys = everyone; - "gitlab/myself-shell-runner-reg.age".publicKeys = everyone; - "gitlab/linode-deployer-runner-reg.age".publicKeys = everyone; - "gitlab/docker-auth.age".publicKeys = everyone; + "dendrite.age".publicKeys = everyone; + "dendrite_key.age".publicKeys = everyone; + "gitlab/secret.age".publicKeys = everyone; + "gitlab/otp.age".publicKeys = everyone; + "gitlab/db.age".publicKeys = everyone; + "gitlab/jws.age".publicKeys = everyone; + # openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.crt -days 365 -nodes -subj '/CN=issuer' + # Then pipe the resulting files to agenix -e + "gitlab/key.age".publicKeys = everyone; + "gitlab/cert.age".publicKeys = everyone; + "gitlab/jeremiah-runner-reg.age".publicKeys = everyone; + "gitlab/myself-qemu-runner-reg.age".publicKeys = everyone; + "gitlab/myself-vbox-runner-reg.age".publicKeys = everyone; + "gitlab/myself-podman-runner-reg.age".publicKeys = everyone; + "gitlab/myself-shell-runner-reg.age".publicKeys = everyone; + "gitlab/linode-deployer-runner-reg.age".publicKeys = everyone; + "gitlab/docker-auth.age".publicKeys = everyone; - "acme_password.age".publicKeys = everyone; - "ca/intermediate_key.age".publicKeys = everyone; - "ca/root_key.age".publicKeys = everyone; + "acme_password.age".publicKeys = everyone; + "ca/intermediate_key.age".publicKeys = everyone; + "ca/root_key.age".publicKeys = everyone; - "minio_secret_access_key.age".publicKeys = everyone; - "minio_access_key_id.age".publicKeys = everyone; + "minio_secret_access_key.age".publicKeys = everyone; + "minio_access_key_id.age".publicKeys = everyone; }