A complete reformatting to match nixpkgs-fmt
This commit is contained in:
Greg Hellings
+51
-51
@@ -1,60 +1,60 @@
|
||||
{ pkgs, lib, ... }:
|
||||
let
|
||||
notDarwin = (! pkgs.stdenv.isDarwin);
|
||||
notDarwin = (! pkgs.stdenv.isDarwin);
|
||||
in
|
||||
{
|
||||
# Enable flakes
|
||||
nix = {
|
||||
gc = {
|
||||
automatic = true;
|
||||
# Scheduling of them is different in nixos vs nix-darwin, so check for
|
||||
# the extra details there
|
||||
options = "--delete-older-than 30d";
|
||||
};
|
||||
|
||||
settings = {
|
||||
experimental-features = "nix-command flakes";
|
||||
keep-outputs = true;
|
||||
keep-derivations = true;
|
||||
min-free = (toString (1024 * 1024 * 1024) );
|
||||
max-free = (toString (5 * 1024 * 1024 * 1024) );
|
||||
substituters = [
|
||||
"https://cache.garnix.io"
|
||||
"https://ai.cachix.org"
|
||||
];
|
||||
trusted-public-keys = [
|
||||
"cache.garnix.io:CTFPyKSLcx5RMJKfLo5EEPUObbA78b0YQ2DTCJXqr9g="
|
||||
"ai.cachix.org-1:N9dzRK+alWwoKXQlnn0H6aUx0lU/mspIoz8hMvGvbbc="
|
||||
];
|
||||
};
|
||||
# Enable flakes
|
||||
nix = {
|
||||
gc = {
|
||||
automatic = true;
|
||||
# Scheduling of them is different in nixos vs nix-darwin, so check for
|
||||
# the extra details there
|
||||
options = "--delete-older-than 30d";
|
||||
};
|
||||
|
||||
nixpkgs.config = {
|
||||
allowUnfree = true;
|
||||
permittedInsecurePackages = [
|
||||
"jitsi-meet-1.0.8043"
|
||||
];
|
||||
settings = {
|
||||
experimental-features = "nix-command flakes";
|
||||
keep-outputs = true;
|
||||
keep-derivations = true;
|
||||
min-free = (toString (1024 * 1024 * 1024));
|
||||
max-free = (toString (5 * 1024 * 1024 * 1024));
|
||||
substituters = [
|
||||
"https://cache.garnix.io"
|
||||
"https://ai.cachix.org"
|
||||
];
|
||||
trusted-public-keys = [
|
||||
"cache.garnix.io:CTFPyKSLcx5RMJKfLo5EEPUObbA78b0YQ2DTCJXqr9g="
|
||||
"ai.cachix.org-1:N9dzRK+alWwoKXQlnn0H6aUx0lU/mspIoz8hMvGvbbc="
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
# Base packages that need to be in all my hosts
|
||||
environment.systemPackages = with pkgs; [
|
||||
agenix
|
||||
bitwarden-cli
|
||||
bmon
|
||||
diffutils
|
||||
git
|
||||
gnupatch
|
||||
gregpy
|
||||
findutils
|
||||
file
|
||||
hms # My own home manager switcher
|
||||
htop
|
||||
iperf
|
||||
killall
|
||||
nano
|
||||
pciutils
|
||||
pwgen
|
||||
unzip
|
||||
wget
|
||||
];
|
||||
nixpkgs.config = {
|
||||
allowUnfree = true;
|
||||
permittedInsecurePackages = [
|
||||
"jitsi-meet-1.0.8043"
|
||||
];
|
||||
};
|
||||
|
||||
# Base packages that need to be in all my hosts
|
||||
environment.systemPackages = with pkgs; [
|
||||
agenix
|
||||
bitwarden-cli
|
||||
bmon
|
||||
diffutils
|
||||
git
|
||||
gnupatch
|
||||
gregpy
|
||||
findutils
|
||||
file
|
||||
hms # My own home manager switcher
|
||||
htop
|
||||
iperf
|
||||
killall
|
||||
nano
|
||||
pciutils
|
||||
pwgen
|
||||
unzip
|
||||
wget
|
||||
];
|
||||
}
|
||||
|
||||
+24
-24
@@ -1,26 +1,26 @@
|
||||
{...}:
|
||||
{ ... }:
|
||||
{
|
||||
imports = [
|
||||
../baseline.nix
|
||||
];
|
||||
system.stateVersion = 4;
|
||||
home-manager = {
|
||||
useGlobalPkgs = true;
|
||||
users."gregory.hellings" = import ../../home/home.nix;
|
||||
extraSpecialArgs = {
|
||||
gnome = false;
|
||||
gui = false;
|
||||
home = "/Users/gregory.hellings";
|
||||
};
|
||||
imports = [
|
||||
../baseline.nix
|
||||
];
|
||||
system.stateVersion = 4;
|
||||
home-manager = {
|
||||
useGlobalPkgs = true;
|
||||
users."gregory.hellings" = import ../../home/home.nix;
|
||||
extraSpecialArgs = {
|
||||
gnome = false;
|
||||
gui = false;
|
||||
home = "/Users/gregory.hellings";
|
||||
};
|
||||
users.users."gregory.hellings".home = "/Users/gregory.hellings";
|
||||
programs = {
|
||||
zsh.enable = true;
|
||||
bash.enable = true;
|
||||
};
|
||||
services.nix-daemon.enable = true;
|
||||
nix = {
|
||||
gc.interval.Hour = 24;
|
||||
settings.auto-optimise-store = false; # Darwin bugs?
|
||||
};
|
||||
}
|
||||
};
|
||||
users.users."gregory.hellings".home = "/Users/gregory.hellings";
|
||||
programs = {
|
||||
zsh.enable = true;
|
||||
bash.enable = true;
|
||||
};
|
||||
services.nix-daemon.enable = true;
|
||||
nix = {
|
||||
gc.interval.Hour = 24;
|
||||
settings.auto-optimise-store = false; # Darwin bugs?
|
||||
};
|
||||
}
|
||||
|
||||
+7
-6
@@ -1,7 +1,8 @@
|
||||
let
|
||||
nixos = (import ./nixos);
|
||||
darwin = (import ./darwin);
|
||||
in {
|
||||
nixosModule = nixos;
|
||||
darwinModule = darwin;
|
||||
}
|
||||
nixos = (import ./nixos);
|
||||
darwin = (import ./darwin);
|
||||
in
|
||||
{
|
||||
nixosModule = nixos;
|
||||
darwinModule = darwin;
|
||||
}
|
||||
|
||||
+62
-59
@@ -1,71 +1,74 @@
|
||||
{ lib, config, pkgs, ... }:
|
||||
|
||||
let
|
||||
cfg = config.greg.backup;
|
||||
cfg = config.greg.backup;
|
||||
|
||||
where = j: "${config.services.syncthing.dataDir}/${j.dest}";
|
||||
where = j: "${config.services.syncthing.dataDir}/${j.dest}";
|
||||
|
||||
makeSyncFolders = name: job: {
|
||||
devices = [ "chronicles" ];
|
||||
enable = true;
|
||||
id = job.id;
|
||||
label = job.dest;
|
||||
path = where job;
|
||||
type = "sendonly";
|
||||
};
|
||||
makeSyncFolders = name: job: {
|
||||
devices = [ "chronicles" ];
|
||||
enable = true;
|
||||
id = job.id;
|
||||
label = job.dest;
|
||||
path = where job;
|
||||
type = "sendonly";
|
||||
};
|
||||
|
||||
makeRestic = name: job: let
|
||||
who = "${config.services.syncthing.user}:${config.services.syncthing.group}";
|
||||
in rec {
|
||||
initialize = true;
|
||||
passwordFile = config.age.secrets.restic-pw.path;
|
||||
paths = [ job.src ];
|
||||
repository = where job;
|
||||
backupCleanupCommand = ''${pkgs.coreutils}/bin/chown -R ${who} "${repository}"'';
|
||||
};
|
||||
makeRestic = name: job:
|
||||
let
|
||||
who = "${config.services.syncthing.user}:${config.services.syncthing.group}";
|
||||
in
|
||||
rec {
|
||||
initialize = true;
|
||||
passwordFile = config.age.secrets.restic-pw.path;
|
||||
paths = [ job.src ];
|
||||
repository = where job;
|
||||
backupCleanupCommand = ''${pkgs.coreutils}/bin/chown -R ${who} "${repository}"'';
|
||||
};
|
||||
|
||||
in with lib; {
|
||||
options = {
|
||||
greg.backup = {
|
||||
jobs = mkOption {
|
||||
default = {};
|
||||
in
|
||||
with lib; {
|
||||
options = {
|
||||
greg.backup = {
|
||||
jobs = mkOption {
|
||||
default = { };
|
||||
|
||||
type = with types; attrsOf (submodule (
|
||||
{ name, config, options, ... }:
|
||||
{
|
||||
options = {
|
||||
src = mkOption {
|
||||
type = types.str;
|
||||
description = "Local path (string form) to backup from";
|
||||
};
|
||||
type = with types; attrsOf (submodule (
|
||||
{ name, config, options, ... }:
|
||||
{
|
||||
options = {
|
||||
src = mkOption {
|
||||
type = types.str;
|
||||
description = "Local path (string form) to backup from";
|
||||
};
|
||||
|
||||
dest = mkOption {
|
||||
type = types.str;
|
||||
};
|
||||
dest = mkOption {
|
||||
type = types.str;
|
||||
};
|
||||
|
||||
id = mkOption {
|
||||
type = types.str;
|
||||
description = "The unique folder ID for this";
|
||||
};
|
||||
};
|
||||
}
|
||||
));
|
||||
};
|
||||
};
|
||||
};
|
||||
id = mkOption {
|
||||
type = types.str;
|
||||
description = "The unique folder ID for this";
|
||||
};
|
||||
};
|
||||
}
|
||||
));
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
config = mkIf ( ( attrValues cfg.jobs ) != [] )
|
||||
{
|
||||
age.secrets = {
|
||||
restic-pw.file = ../../secrets/restic-pw.age;
|
||||
restic-env.file = ../../secrets/restic-env.age;
|
||||
};
|
||||
greg.syncthing = {
|
||||
enable = true;
|
||||
};
|
||||
services = {
|
||||
syncthing.settings.folders = mapAttrs makeSyncFolders cfg.jobs;
|
||||
restic.backups = mapAttrs makeRestic cfg.jobs;
|
||||
};
|
||||
};
|
||||
config = mkIf ((attrValues cfg.jobs) != [ ])
|
||||
{
|
||||
age.secrets = {
|
||||
restic-pw.file = ../../secrets/restic-pw.age;
|
||||
restic-env.file = ../../secrets/restic-env.age;
|
||||
};
|
||||
greg.syncthing = {
|
||||
enable = true;
|
||||
};
|
||||
services = {
|
||||
syncthing.settings.folders = mapAttrs makeSyncFolders cfg.jobs;
|
||||
restic.backups = mapAttrs makeRestic cfg.jobs;
|
||||
};
|
||||
};
|
||||
}
|
||||
|
||||
+476
-464
File diff suppressed because it is too large
Load Diff
+67
-64
@@ -1,76 +1,79 @@
|
||||
{ config, lib, inputs, overlays, ... }:
|
||||
|
||||
let
|
||||
cfg = config.greg.containers;
|
||||
cfg = config.greg.containers;
|
||||
|
||||
# Create a container with all our default settings
|
||||
# Create a container with all our default settings
|
||||
|
||||
makeContainer = name: container: let
|
||||
agekey = "/etc/ssh/agenix_key";
|
||||
in {
|
||||
autoStart = true;
|
||||
hostAddress = "192.168.${container.subnet}.1";
|
||||
localAddress = "192.168.${container.subnet}.2";
|
||||
privateNetwork = true;
|
||||
bindMounts = {
|
||||
"${agekey}".hostPath = "/etc/ssh/ssh_host_ed25519_key"; # This is needed for agenix to
|
||||
};
|
||||
enableTun = container.tailscale;
|
||||
config = { config, pkgs, ... }: {
|
||||
imports = [
|
||||
inputs.agenix.nixosModules.default
|
||||
inputs.self.modules.nixosModule
|
||||
container.builder
|
||||
];
|
||||
makeContainer = name: container:
|
||||
let
|
||||
agekey = "/etc/ssh/agenix_key";
|
||||
in
|
||||
{
|
||||
autoStart = true;
|
||||
hostAddress = "192.168.${container.subnet}.1";
|
||||
localAddress = "192.168.${container.subnet}.2";
|
||||
privateNetwork = true;
|
||||
bindMounts = {
|
||||
"${agekey}".hostPath = "/etc/ssh/ssh_host_ed25519_key"; # This is needed for agenix to
|
||||
};
|
||||
enableTun = container.tailscale;
|
||||
config = { config, pkgs, ... }: {
|
||||
imports = [
|
||||
inputs.agenix.nixosModules.default
|
||||
inputs.self.modules.nixosModule
|
||||
container.builder
|
||||
];
|
||||
|
||||
nixpkgs.overlays = overlays;
|
||||
nixpkgs.overlays = overlays;
|
||||
|
||||
networking = {
|
||||
firewall.enable = true;
|
||||
useHostResolvConf = lib.mkForce false;
|
||||
};
|
||||
networking = {
|
||||
firewall.enable = true;
|
||||
useHostResolvConf = lib.mkForce false;
|
||||
};
|
||||
|
||||
age.identityPaths = [ agekey ];
|
||||
age.identityPaths = [ agekey ];
|
||||
|
||||
greg.tailscale.enable = container.tailscale;
|
||||
};
|
||||
};
|
||||
in {
|
||||
options.greg.containers = lib.mkOption {
|
||||
default = {};
|
||||
greg.tailscale.enable = container.tailscale;
|
||||
};
|
||||
};
|
||||
in
|
||||
{
|
||||
options.greg.containers = lib.mkOption {
|
||||
default = { };
|
||||
|
||||
type = with lib.types; attrsOf ( submodule (
|
||||
{
|
||||
options = {
|
||||
tailscale = lib.mkOption {
|
||||
type = bool;
|
||||
default = false;
|
||||
description = "Enable tailscale in the container";
|
||||
};
|
||||
subnet = lib.mkOption {
|
||||
type = str;
|
||||
default = "200";
|
||||
};
|
||||
builder = lib.mkOption {
|
||||
default = { ... }: {};
|
||||
description = ''
|
||||
This needs to be a function, like the one for
|
||||
a container's config. It will setup the core system above the
|
||||
defaults set in this module.
|
||||
'';
|
||||
example = ''
|
||||
{ pkgs, config, lib, ... } :
|
||||
{
|
||||
services.openssh.enable = true;
|
||||
}
|
||||
'';
|
||||
};
|
||||
};
|
||||
}
|
||||
));
|
||||
};
|
||||
type = with lib.types; attrsOf (submodule (
|
||||
{
|
||||
options = {
|
||||
tailscale = lib.mkOption {
|
||||
type = bool;
|
||||
default = false;
|
||||
description = "Enable tailscale in the container";
|
||||
};
|
||||
subnet = lib.mkOption {
|
||||
type = str;
|
||||
default = "200";
|
||||
};
|
||||
builder = lib.mkOption {
|
||||
default = { ... }: { };
|
||||
description = ''
|
||||
This needs to be a function, like the one for
|
||||
a container's config. It will setup the core system above the
|
||||
defaults set in this module.
|
||||
'';
|
||||
example = ''
|
||||
{ pkgs, config, lib, ... } :
|
||||
{
|
||||
services.openssh.enable = true;
|
||||
}
|
||||
'';
|
||||
};
|
||||
};
|
||||
}
|
||||
));
|
||||
};
|
||||
|
||||
config = {
|
||||
containers = builtins.mapAttrs makeContainer cfg;
|
||||
};
|
||||
config = {
|
||||
containers = builtins.mapAttrs makeContainer cfg;
|
||||
};
|
||||
}
|
||||
|
||||
+55
-54
@@ -1,63 +1,64 @@
|
||||
{ config, lib, pkgs, ... }:
|
||||
|
||||
let
|
||||
cfg = config.greg.databases;
|
||||
dbs = (lib.attrNames cfg);
|
||||
in {
|
||||
options.greg.databases = lib.mkOption {
|
||||
default = {};
|
||||
type = with lib.types; attrsOf ( submodule (
|
||||
{ name, config, options, ... }: {
|
||||
# Options reserved for future expansion
|
||||
options = {};
|
||||
}
|
||||
));
|
||||
};
|
||||
cfg = config.greg.databases;
|
||||
dbs = (lib.attrNames cfg);
|
||||
in
|
||||
{
|
||||
options.greg.databases = lib.mkOption {
|
||||
default = { };
|
||||
type = with lib.types; attrsOf (submodule (
|
||||
{ name, config, options, ... }: {
|
||||
# Options reserved for future expansion
|
||||
options = { };
|
||||
}
|
||||
));
|
||||
};
|
||||
|
||||
config = lib.mkIf ( dbs != [] ) {
|
||||
services = {
|
||||
postgresql = {
|
||||
enable = true;
|
||||
package = pkgs.postgresql_15;
|
||||
checkConfig = true;
|
||||
ensureDatabases = dbs;
|
||||
ensureUsers = map (db: { name = db; ensureDBOwnership = true; }) dbs;
|
||||
settings = {
|
||||
log_connections = true;
|
||||
log_statement = "all";
|
||||
logging_collector = true;
|
||||
log_filename = "postgresql.log";
|
||||
};
|
||||
identMap = "root root postgres";
|
||||
};
|
||||
config = lib.mkIf (dbs != [ ]) {
|
||||
services = {
|
||||
postgresql = {
|
||||
enable = true;
|
||||
package = pkgs.postgresql_15;
|
||||
checkConfig = true;
|
||||
ensureDatabases = dbs;
|
||||
ensureUsers = map (db: { name = db; ensureDBOwnership = true; }) dbs;
|
||||
settings = {
|
||||
log_connections = true;
|
||||
log_statement = "all";
|
||||
logging_collector = true;
|
||||
log_filename = "postgresql.log";
|
||||
};
|
||||
identMap = "root root postgres";
|
||||
};
|
||||
|
||||
postgresqlBackup = {
|
||||
enable = true;
|
||||
databases = dbs;
|
||||
};
|
||||
postgresqlBackup = {
|
||||
enable = true;
|
||||
databases = dbs;
|
||||
};
|
||||
|
||||
logrotate = {
|
||||
enable = true;
|
||||
settings = {
|
||||
postgresqlBackup = {
|
||||
enable = true;
|
||||
files = "${config.services.postgresqlBackup.location}/*.gz";
|
||||
};
|
||||
postgresLog = {
|
||||
enable = true;
|
||||
files = "/var/lib/postgresql/*/log/*.log";
|
||||
compress = true;
|
||||
compresscmd = "${pkgs.xz}/bin/xz";
|
||||
};
|
||||
};
|
||||
};
|
||||
logrotate = {
|
||||
enable = true;
|
||||
settings = {
|
||||
postgresqlBackup = {
|
||||
enable = true;
|
||||
files = "${config.services.postgresqlBackup.location}/*.gz";
|
||||
};
|
||||
postgresLog = {
|
||||
enable = true;
|
||||
files = "/var/lib/postgresql/*/log/*.log";
|
||||
compress = true;
|
||||
compresscmd = "${pkgs.xz}/bin/xz";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
};
|
||||
};
|
||||
|
||||
greg.backup.jobs.greg-postgresql-backup = {
|
||||
src = config.services.postgresqlBackup.location;
|
||||
dest = "database-${config.networking.hostName}";
|
||||
id = "${config.networking.hostName}-postgres-backup";
|
||||
};
|
||||
};
|
||||
greg.backup.jobs.greg-postgresql-backup = {
|
||||
src = config.services.postgresqlBackup.location;
|
||||
dest = "database-${config.networking.hostName}";
|
||||
id = "${config.networking.hostName}-postgres-backup";
|
||||
};
|
||||
};
|
||||
}
|
||||
|
||||
+83
-81
@@ -1,94 +1,96 @@
|
||||
{ config, pkgs, inputs, lib, ... }:
|
||||
|
||||
let
|
||||
x = if builtins.hasAttr "xonsh-unwrapped" pkgs then
|
||||
pkgs.xonsh else
|
||||
pkgs.xonsh.passthru.wrapper;
|
||||
in {
|
||||
imports = [
|
||||
../baseline.nix
|
||||
./backup.nix
|
||||
./ceph.nix
|
||||
./container.nix
|
||||
./db.nix
|
||||
./gnome.nix
|
||||
./home.nix
|
||||
./kde.nix
|
||||
./kiwix-serve.nix
|
||||
./linode.nix
|
||||
./print.nix
|
||||
./proxy.nix
|
||||
./router.nix
|
||||
./rpi4.nix
|
||||
./sway.nix
|
||||
./syncthing.nix
|
||||
./tailscale.nix
|
||||
./vmdev.nix
|
||||
];
|
||||
x =
|
||||
if builtins.hasAttr "xonsh-unwrapped" pkgs then
|
||||
pkgs.xonsh else
|
||||
pkgs.xonsh.passthru.wrapper;
|
||||
in
|
||||
{
|
||||
imports = [
|
||||
../baseline.nix
|
||||
./backup.nix
|
||||
./ceph.nix
|
||||
./container.nix
|
||||
./db.nix
|
||||
./gnome.nix
|
||||
./home.nix
|
||||
./kde.nix
|
||||
./kiwix-serve.nix
|
||||
./linode.nix
|
||||
./print.nix
|
||||
./proxy.nix
|
||||
./router.nix
|
||||
./rpi4.nix
|
||||
./sway.nix
|
||||
./syncthing.nix
|
||||
./tailscale.nix
|
||||
./vmdev.nix
|
||||
];
|
||||
|
||||
environment.sessionVariables.MOZ_ENABLE_WAYLAND = "0";
|
||||
environment.systemPackages = with pkgs; [
|
||||
btrfs-progs
|
||||
coreutils-full
|
||||
efibootmgr
|
||||
psmisc
|
||||
lshw
|
||||
usbutils
|
||||
xfsprogs
|
||||
];
|
||||
environment.sessionVariables.MOZ_ENABLE_WAYLAND = "0";
|
||||
environment.systemPackages = with pkgs; [
|
||||
btrfs-progs
|
||||
coreutils-full
|
||||
efibootmgr
|
||||
psmisc
|
||||
lshw
|
||||
usbutils
|
||||
xfsprogs
|
||||
];
|
||||
|
||||
system.stateVersion = "24.05";
|
||||
system.stateVersion = "24.05";
|
||||
|
||||
nix = {
|
||||
gc.dates = "weekly";
|
||||
settings.auto-optimise-store = true;
|
||||
};
|
||||
nix = {
|
||||
gc.dates = "weekly";
|
||||
settings.auto-optimise-store = true;
|
||||
};
|
||||
|
||||
# I am a fan of network manager, myself
|
||||
networking = {
|
||||
search = [
|
||||
"thehellings.lan"
|
||||
"home"
|
||||
];
|
||||
networkmanager.enable = true;
|
||||
};
|
||||
# I am a fan of network manager, myself
|
||||
networking = {
|
||||
search = [
|
||||
"thehellings.lan"
|
||||
"home"
|
||||
];
|
||||
networkmanager.enable = true;
|
||||
};
|
||||
|
||||
programs.xonsh = {
|
||||
enable = true;
|
||||
package = (x.override {
|
||||
extraPackages = (ps: with ps; [
|
||||
(ps.toPythonModule pkgs.pipenv)
|
||||
pyyaml
|
||||
requests
|
||||
ruamel-yaml
|
||||
xonsh-apipenv
|
||||
pkgs.nur.repos.xonsh-xontribs.xonsh-direnv
|
||||
pkgs.nur.repos.xonsh-xontribs.xontrib-vox
|
||||
]);
|
||||
});
|
||||
};
|
||||
programs.xonsh = {
|
||||
enable = true;
|
||||
package = (x.override {
|
||||
extraPackages = (ps: with ps; [
|
||||
(ps.toPythonModule pkgs.pipenv)
|
||||
pyyaml
|
||||
requests
|
||||
ruamel-yaml
|
||||
xonsh-apipenv
|
||||
pkgs.nur.repos.xonsh-xontribs.xonsh-direnv
|
||||
pkgs.nur.repos.xonsh-xontribs.xontrib-vox
|
||||
]);
|
||||
});
|
||||
};
|
||||
|
||||
# Enable the OpenSSH daemon for remote control
|
||||
services = {
|
||||
openssh = {
|
||||
enable = true;
|
||||
settings.X11Forwarding = true;
|
||||
};
|
||||
};
|
||||
# Enable the OpenSSH daemon for remote control
|
||||
services = {
|
||||
openssh = {
|
||||
enable = true;
|
||||
settings.X11Forwarding = true;
|
||||
};
|
||||
};
|
||||
|
||||
# Define a user account. Don't forget to set a password with ‘passwd’.
|
||||
users.users.greg = {
|
||||
isNormalUser = true;
|
||||
createHome = true;
|
||||
extraGroups = [ "wheel" "networkmanager" ]; # Enable ‘sudo’ for the user.
|
||||
shell = config.programs.xonsh.package;
|
||||
openssh.authorizedKeys.keys = lib.strings.splitString "\n" (builtins.readFile ../../home/ssh/authorized_keys);
|
||||
};
|
||||
# Define a user account. Don't forget to set a password with ‘passwd’.
|
||||
users.users.greg = {
|
||||
isNormalUser = true;
|
||||
createHome = true;
|
||||
extraGroups = [ "wheel" "networkmanager" ]; # Enable ‘sudo’ for the user.
|
||||
shell = config.programs.xonsh.package;
|
||||
openssh.authorizedKeys.keys = lib.strings.splitString "\n" (builtins.readFile ../../home/ssh/authorized_keys);
|
||||
};
|
||||
|
||||
i18n.defaultLocale = "en_US.UTF-8";
|
||||
i18n.defaultLocale = "en_US.UTF-8";
|
||||
|
||||
console = {
|
||||
font = "Lat2-Terminus16";
|
||||
keyMap = "us";
|
||||
};
|
||||
console = {
|
||||
font = "Lat2-Terminus16";
|
||||
keyMap = "us";
|
||||
};
|
||||
}
|
||||
|
||||
+51
-50
@@ -1,64 +1,65 @@
|
||||
{ config, pkgs, lib, ... }:
|
||||
|
||||
let
|
||||
cfg = config.greg.gnome;
|
||||
cfg = config.greg.gnome;
|
||||
|
||||
in with lib; {
|
||||
options = {
|
||||
greg.gnome.enable = mkEnableOption "Enable my default Gnome3 setup";
|
||||
};
|
||||
in
|
||||
with lib; {
|
||||
options = {
|
||||
greg.gnome.enable = mkEnableOption "Enable my default Gnome3 setup";
|
||||
};
|
||||
|
||||
config = mkIf cfg.enable {
|
||||
# Sets up a basic Gnome installation
|
||||
services = {
|
||||
accounts-daemon.enable = true;
|
||||
config = mkIf cfg.enable {
|
||||
# Sets up a basic Gnome installation
|
||||
services = {
|
||||
accounts-daemon.enable = true;
|
||||
|
||||
# Trackpad support
|
||||
libinput.enable = true;
|
||||
# Trackpad support
|
||||
libinput.enable = true;
|
||||
|
||||
xserver = {
|
||||
enable = true;
|
||||
displayManager.gdm.enable = true;
|
||||
desktopManager.gnome.enable = true;
|
||||
xkb.layout = "us";
|
||||
};
|
||||
xserver = {
|
||||
enable = true;
|
||||
displayManager.gdm.enable = true;
|
||||
desktopManager.gnome.enable = true;
|
||||
xkb.layout = "us";
|
||||
};
|
||||
|
||||
udev.packages = with pkgs; [
|
||||
gnome-settings-daemon
|
||||
];
|
||||
udev.packages = with pkgs; [
|
||||
gnome-settings-daemon
|
||||
];
|
||||
|
||||
pipewire.enable = true;
|
||||
pipewire.enable = true;
|
||||
|
||||
# Enablement for Firefox
|
||||
gnome = {
|
||||
gnome-browser-connector.enable = true;
|
||||
#chrome-gnome-shell.enable = true;
|
||||
sushi.enable = true;
|
||||
gnome-online-accounts.enable = true;
|
||||
};
|
||||
};
|
||||
# Enablement for Firefox
|
||||
gnome = {
|
||||
gnome-browser-connector.enable = true;
|
||||
#chrome-gnome-shell.enable = true;
|
||||
sushi.enable = true;
|
||||
gnome-online-accounts.enable = true;
|
||||
};
|
||||
};
|
||||
|
||||
programs.dconf.enable = true;
|
||||
xdg.portal = {
|
||||
enable = true;
|
||||
wlr.enable = true; # Enables screen sharing in Wayland
|
||||
};
|
||||
programs.dconf.enable = true;
|
||||
xdg.portal = {
|
||||
enable = true;
|
||||
wlr.enable = true; # Enables screen sharing in Wayland
|
||||
};
|
||||
|
||||
# Used by gsconnect
|
||||
networking.firewall.allowedTCPPorts = [ 1716 ];
|
||||
# Used by gsconnect
|
||||
networking.firewall.allowedTCPPorts = [ 1716 ];
|
||||
|
||||
# Enable some Gnome plugins that I like
|
||||
environment.systemPackages = with pkgs; [
|
||||
adwaita-icon-theme
|
||||
gnome-tweaks
|
||||
dconf-editor
|
||||
gnomeExtensions.appindicator
|
||||
gnomeExtensions.clipboard-indicator
|
||||
gnomeExtensions.dash-to-dock
|
||||
gnomeExtensions.gsconnect
|
||||
gnomeExtensions.stocks-extension
|
||||
gnomeExtensions.tailscale-qs
|
||||
gnomeExtensions.vitals
|
||||
];
|
||||
};
|
||||
# Enable some Gnome plugins that I like
|
||||
environment.systemPackages = with pkgs; [
|
||||
adwaita-icon-theme
|
||||
gnome-tweaks
|
||||
dconf-editor
|
||||
gnomeExtensions.appindicator
|
||||
gnomeExtensions.clipboard-indicator
|
||||
gnomeExtensions.dash-to-dock
|
||||
gnomeExtensions.gsconnect
|
||||
gnomeExtensions.stocks-extension
|
||||
gnomeExtensions.tailscale-qs
|
||||
gnomeExtensions.vitals
|
||||
];
|
||||
};
|
||||
}
|
||||
|
||||
+12
-11
@@ -1,18 +1,19 @@
|
||||
{ config, lib, ... }:
|
||||
|
||||
let
|
||||
cfg = config.greg.home;
|
||||
cfg = config.greg.home;
|
||||
|
||||
in with lib;
|
||||
in
|
||||
with lib;
|
||||
{
|
||||
options.greg.home = mkOption {
|
||||
type = types.bool;
|
||||
default = true;
|
||||
description = "Sets the device up to be part of my home network";
|
||||
};
|
||||
options.greg.home = mkOption {
|
||||
type = types.bool;
|
||||
default = true;
|
||||
description = "Sets the device up to be part of my home network";
|
||||
};
|
||||
|
||||
config = mkIf cfg {
|
||||
time.timeZone = "America/Chicago";
|
||||
networking.domain = "thehellings.lan";
|
||||
};
|
||||
config = mkIf cfg {
|
||||
time.timeZone = "America/Chicago";
|
||||
networking.domain = "thehellings.lan";
|
||||
};
|
||||
}
|
||||
|
||||
+40
-39
@@ -1,48 +1,49 @@
|
||||
{ config, pkgs, lib, options, ... }:
|
||||
|
||||
let
|
||||
cfg = config.greg.kde;
|
||||
cfg = config.greg.kde;
|
||||
|
||||
in with lib; {
|
||||
options = {
|
||||
greg.kde.enable = mkEnableOption "Enable my default KDE setup";
|
||||
};
|
||||
in
|
||||
with lib; {
|
||||
options = {
|
||||
greg.kde.enable = mkEnableOption "Enable my default KDE setup";
|
||||
};
|
||||
|
||||
config = mkIf cfg.enable {
|
||||
# Sets up a basic KDE installation
|
||||
services = {
|
||||
xserver = {
|
||||
enable = true;
|
||||
xkb.layout = "us";
|
||||
# Trackpad support
|
||||
libinput.enable = true;
|
||||
};
|
||||
config = mkIf cfg.enable {
|
||||
# Sets up a basic KDE installation
|
||||
services = {
|
||||
xserver = {
|
||||
enable = true;
|
||||
xkb.layout = "us";
|
||||
# Trackpad support
|
||||
libinput.enable = true;
|
||||
};
|
||||
|
||||
pipewire = {
|
||||
enable = true;
|
||||
alsa.enable = true;
|
||||
alsa.support32Bit = true;
|
||||
pulse.enable = true;
|
||||
};
|
||||
} // (optionalAttrs (builtins.hasAttr "plasma6" options.services.xserver.desktopManager) {
|
||||
desktopManager.plasma6.enable = true;
|
||||
displayManager = {
|
||||
defaultSession = "plasma";
|
||||
sddm.enable = true;
|
||||
};
|
||||
});
|
||||
pipewire = {
|
||||
enable = true;
|
||||
alsa.enable = true;
|
||||
alsa.support32Bit = true;
|
||||
pulse.enable = true;
|
||||
};
|
||||
} // (optionalAttrs (builtins.hasAttr "plasma6" options.services.xserver.desktopManager) {
|
||||
desktopManager.plasma6.enable = true;
|
||||
displayManager = {
|
||||
defaultSession = "plasma";
|
||||
sddm.enable = true;
|
||||
};
|
||||
});
|
||||
|
||||
programs.dconf.enable = true;
|
||||
programs.sway.enable = true; # Gives us Wayland
|
||||
xdg.portal = {
|
||||
enable = true;
|
||||
wlr.enable = true; # Enables screen sharing in Wayland
|
||||
};
|
||||
programs.dconf.enable = true;
|
||||
programs.sway.enable = true; # Gives us Wayland
|
||||
xdg.portal = {
|
||||
enable = true;
|
||||
wlr.enable = true; # Enables screen sharing in Wayland
|
||||
};
|
||||
|
||||
environment.systemPackages = with pkgs; [
|
||||
kalendar
|
||||
korganizer
|
||||
plasma-pa
|
||||
];
|
||||
};
|
||||
environment.systemPackages = with pkgs; [
|
||||
kalendar
|
||||
korganizer
|
||||
plasma-pa
|
||||
];
|
||||
};
|
||||
}
|
||||
|
||||
@@ -1,48 +1,49 @@
|
||||
{ config, pkgs, lib, ... }:
|
||||
{ config, pkgs, lib, ... }:
|
||||
|
||||
let
|
||||
cfg = config.services.kiwix-serve;
|
||||
in with lib; {
|
||||
options.services.kiwix-serve = {
|
||||
enable = mkEnableOption "Enable the Kiwix web server";
|
||||
cfg = config.services.kiwix-serve;
|
||||
in
|
||||
with lib; {
|
||||
options.services.kiwix-serve = {
|
||||
enable = mkEnableOption "Enable the Kiwix web server";
|
||||
|
||||
port = mkOption {
|
||||
type = types.int;
|
||||
default = 8888;
|
||||
description = "Port to serve the Kiwix HTTP service on";
|
||||
};
|
||||
port = mkOption {
|
||||
type = types.int;
|
||||
default = 8888;
|
||||
description = "Port to serve the Kiwix HTTP service on";
|
||||
};
|
||||
|
||||
path = mkOption {
|
||||
type = types.str;
|
||||
default = "/var/lib/kiwix-serve/";
|
||||
description = "Path to Zim file(s) to serve";
|
||||
};
|
||||
path = mkOption {
|
||||
type = types.str;
|
||||
default = "/var/lib/kiwix-serve/";
|
||||
description = "Path to Zim file(s) to serve";
|
||||
};
|
||||
|
||||
proxy = mkOption {
|
||||
type = types.str;
|
||||
default = "";
|
||||
description = ''Upstream proxy, if any, to configure with kiwix. Specify
|
||||
proxy = mkOption {
|
||||
type = types.str;
|
||||
default = "";
|
||||
description = ''Upstream proxy, if any, to configure with kiwix. Specify
|
||||
host and port. E.g. "localhost:8080"
|
||||
'';
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
config = mkIf cfg.enable {
|
||||
environment.systemPackages = [
|
||||
pkgs.kiwix-tools
|
||||
];
|
||||
config = mkIf cfg.enable {
|
||||
environment.systemPackages = [
|
||||
pkgs.kiwix-tools
|
||||
];
|
||||
|
||||
systemd.services.kiwix-serve = {
|
||||
enable = true;
|
||||
after = [ "network.service" ];
|
||||
description = "Runs the kiwix-serve binary as a sysmted service";
|
||||
restartTriggers = [ pkgs.kiwix-tools ];
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
script = "${pkgs.kiwix-tools}/bin/kiwix-serve --port ${toString cfg.port} ${cfg.path}";
|
||||
environment = {
|
||||
UPSTREAM_HOST = mkIf (cfg.proxy != "") cfg.proxy;
|
||||
UPSTREAM_WIKI = mkIf (cfg.proxy != "") cfg.proxy;
|
||||
};
|
||||
};
|
||||
};
|
||||
systemd.services.kiwix-serve = {
|
||||
enable = true;
|
||||
after = [ "network.service" ];
|
||||
description = "Runs the kiwix-serve binary as a sysmted service";
|
||||
restartTriggers = [ pkgs.kiwix-tools ];
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
script = "${pkgs.kiwix-tools}/bin/kiwix-serve --port ${toString cfg.port} ${cfg.path}";
|
||||
environment = {
|
||||
UPSTREAM_HOST = mkIf (cfg.proxy != "") cfg.proxy;
|
||||
UPSTREAM_WIKI = mkIf (cfg.proxy != "") cfg.proxy;
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
|
||||
+34
-33
@@ -1,44 +1,45 @@
|
||||
{ config, lib, pkgs, ... }:
|
||||
|
||||
let
|
||||
cfg = config.greg.linode;
|
||||
cfg = config.greg.linode;
|
||||
|
||||
in with lib;
|
||||
in
|
||||
with lib;
|
||||
{
|
||||
options.greg.linode = {
|
||||
enable = mkEnableOption "Set sensible defaults for a Linode host";
|
||||
options.greg.linode = {
|
||||
enable = mkEnableOption "Set sensible defaults for a Linode host";
|
||||
|
||||
bootTimeout = mkOption {
|
||||
type = types.int;
|
||||
default = 15;
|
||||
description = "Set bootloader timeout in seconds.";
|
||||
};
|
||||
};
|
||||
bootTimeout = mkOption {
|
||||
type = types.int;
|
||||
default = 15;
|
||||
description = "Set bootloader timeout in seconds.";
|
||||
};
|
||||
};
|
||||
|
||||
config = mkIf cfg.enable {
|
||||
# Enables connection over Linode consoles
|
||||
boot.kernelParams = [ "console=ttyS0,19200n8" ];
|
||||
boot.loader.grub = {
|
||||
device = "nodev";
|
||||
extraConfig = ''
|
||||
serial --speed=19200 --unit=0 --word=8 --parity=no --stop=1;
|
||||
terminal_input serial;
|
||||
terminal_output serial;
|
||||
'';
|
||||
};
|
||||
config = mkIf cfg.enable {
|
||||
# Enables connection over Linode consoles
|
||||
boot.kernelParams = [ "console=ttyS0,19200n8" ];
|
||||
boot.loader.grub = {
|
||||
device = "nodev";
|
||||
extraConfig = ''
|
||||
serial --speed=19200 --unit=0 --word=8 --parity=no --stop=1;
|
||||
terminal_input serial;
|
||||
terminal_output serial;
|
||||
'';
|
||||
};
|
||||
|
||||
# Tells grub to ignore partion-free device warnings, since we are on Linode
|
||||
boot.loader.timeout = 15;
|
||||
# Tells grub to ignore partion-free device warnings, since we are on Linode
|
||||
boot.loader.timeout = 15;
|
||||
|
||||
networking.usePredictableInterfaceNames = false; # Use old style eth0 names
|
||||
networking.useDHCP = false;
|
||||
networking.interfaces.eth0.useDHCP = true;
|
||||
networking.usePredictableInterfaceNames = false; # Use old style eth0 names
|
||||
networking.useDHCP = false;
|
||||
networking.interfaces.eth0.useDHCP = true;
|
||||
|
||||
# Suggested diagnostic tools
|
||||
environment.systemPackages = with pkgs; [
|
||||
inetutils
|
||||
mtr
|
||||
sysstat
|
||||
];
|
||||
};
|
||||
# Suggested diagnostic tools
|
||||
environment.systemPackages = with pkgs; [
|
||||
inetutils
|
||||
mtr
|
||||
sysstat
|
||||
];
|
||||
};
|
||||
}
|
||||
|
||||
+26
-25
@@ -1,33 +1,34 @@
|
||||
{ config, lib, pkgs, ... }:
|
||||
|
||||
let
|
||||
cfg = config.greg.print;
|
||||
cfg = config.greg.print;
|
||||
|
||||
in with lib;
|
||||
in
|
||||
with lib;
|
||||
{
|
||||
options.greg.print.enable = mkOption {
|
||||
type = types.bool;
|
||||
default = true;
|
||||
description = "Configures the system to print with my home printer";
|
||||
};
|
||||
options.greg.print.enable = mkOption {
|
||||
type = types.bool;
|
||||
default = true;
|
||||
description = "Configures the system to print with my home printer";
|
||||
};
|
||||
|
||||
config = mkIf cfg.enable {
|
||||
# ipp://printer.thehellings.lan:631/ - generic postscript printer
|
||||
services.printing = {
|
||||
enable = true;
|
||||
drivers = with pkgs; [
|
||||
gutenprint
|
||||
] ++ (lib.optional pkgs.stdenv.isx86_64 gutenprintBin);
|
||||
};
|
||||
config = mkIf cfg.enable {
|
||||
# ipp://printer.thehellings.lan:631/ - generic postscript printer
|
||||
services.printing = {
|
||||
enable = true;
|
||||
drivers = with pkgs; [
|
||||
gutenprint
|
||||
] ++ (lib.optional pkgs.stdenv.isx86_64 gutenprintBin);
|
||||
};
|
||||
|
||||
hardware.printers.ensurePrinters = [ {
|
||||
name = "HomeLexmarkColorPrinter";
|
||||
location = "Home office";
|
||||
deviceUri = "ipp://printer.thehellings.lan:631/";
|
||||
model = "drv:///sample.drv/generic.ppd";
|
||||
ppdOptions = {
|
||||
PageSize = "Letter";
|
||||
};
|
||||
} ];
|
||||
};
|
||||
hardware.printers.ensurePrinters = [{
|
||||
name = "HomeLexmarkColorPrinter";
|
||||
location = "Home office";
|
||||
deviceUri = "ipp://printer.thehellings.lan:631/";
|
||||
model = "drv:///sample.drv/generic.ppd";
|
||||
ppdOptions = {
|
||||
PageSize = "Letter";
|
||||
};
|
||||
}];
|
||||
};
|
||||
}
|
||||
|
||||
+74
-72
@@ -1,87 +1,89 @@
|
||||
{ config, lib, pkgs, ... }:
|
||||
|
||||
let
|
||||
cfg = config.greg.proxies;
|
||||
cfg = config.greg.proxies;
|
||||
|
||||
alias = name: with builtins; head (split "\\." name);
|
||||
alias = name: with builtins; head (split "\\." name);
|
||||
|
||||
makeHost = name: dest: {
|
||||
forceSSL = dest.ssl;
|
||||
enableACME = dest.ssl;
|
||||
locations."${dest.path}" = {
|
||||
proxyPass = dest.target;
|
||||
extraConfig = ''
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Upgrade $http_upgrade;
|
||||
proxy_set_header Connection $connection_upgrade;
|
||||
'' + dest.extraConfig;
|
||||
};
|
||||
serverAliases = lib.mkIf dest.genAliases [ "${alias name}" ];
|
||||
};
|
||||
makeHost = name: dest: {
|
||||
forceSSL = dest.ssl;
|
||||
enableACME = dest.ssl;
|
||||
locations."${dest.path}" = {
|
||||
proxyPass = dest.target;
|
||||
extraConfig = ''
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Upgrade $http_upgrade;
|
||||
proxy_set_header Connection $connection_upgrade;
|
||||
'' + dest.extraConfig;
|
||||
};
|
||||
serverAliases = lib.mkIf dest.genAliases [ "${alias name}" ];
|
||||
};
|
||||
|
||||
in with lib; {
|
||||
options = {
|
||||
greg.proxies = mkOption {
|
||||
default = {};
|
||||
example = literalExpression ''
|
||||
{ host-name = {
|
||||
target = proxyLocation;
|
||||
ssl = true;
|
||||
};
|
||||
'';
|
||||
description = ''
|
||||
Quick and simple Nginx proxy configurations.
|
||||
Use this to configure a very simple proxy that does not
|
||||
need any extra customization options other than SSL
|
||||
enablement.
|
||||
'';
|
||||
in
|
||||
with lib; {
|
||||
options = {
|
||||
greg.proxies = mkOption {
|
||||
default = { };
|
||||
example = literalExpression ''
|
||||
{ host-name = {
|
||||
target = proxyLocation;
|
||||
ssl = true;
|
||||
};
|
||||
'';
|
||||
description = ''
|
||||
Quick and simple Nginx proxy configurations.
|
||||
Use this to configure a very simple proxy that does not
|
||||
need any extra customization options other than SSL
|
||||
enablement.
|
||||
'';
|
||||
|
||||
type = with types; attrsOf (submodule (
|
||||
{ name, config, options, ... }:
|
||||
{
|
||||
options = {
|
||||
genAliases = mkOption {
|
||||
type = types.bool;
|
||||
description = "Whether to auto-generate short alias name";
|
||||
default = true;
|
||||
};
|
||||
type = with types; attrsOf (submodule (
|
||||
{ name, config, options, ... }:
|
||||
{
|
||||
options = {
|
||||
genAliases = mkOption {
|
||||
type = types.bool;
|
||||
description = "Whether to auto-generate short alias name";
|
||||
default = true;
|
||||
};
|
||||
|
||||
target = mkOption {
|
||||
type = types.str;
|
||||
description = ''The destination that is being proxied.'';
|
||||
example = "http://localhost:8080";
|
||||
};
|
||||
target = mkOption {
|
||||
type = types.str;
|
||||
description = ''The destination that is being proxied.'';
|
||||
example = "http://localhost:8080";
|
||||
};
|
||||
|
||||
ssl = mkOption {
|
||||
type = types.bool;
|
||||
description = "Whether to enable SSL in front of the proxy";
|
||||
default = false;
|
||||
};
|
||||
ssl = mkOption {
|
||||
type = types.bool;
|
||||
description = "Whether to enable SSL in front of the proxy";
|
||||
default = false;
|
||||
};
|
||||
|
||||
path = mkOption {
|
||||
type = types.str;
|
||||
description = "The path prefix for this proxy";
|
||||
default = "/";
|
||||
};
|
||||
path = mkOption {
|
||||
type = types.str;
|
||||
description = "The path prefix for this proxy";
|
||||
default = "/";
|
||||
};
|
||||
|
||||
extraConfig = mkOption {
|
||||
type = types.str;
|
||||
description = "Extra nginx config options";
|
||||
default = "";
|
||||
};
|
||||
};
|
||||
}));
|
||||
};
|
||||
};
|
||||
extraConfig = mkOption {
|
||||
type = types.str;
|
||||
description = "Extra nginx config options";
|
||||
default = "";
|
||||
};
|
||||
};
|
||||
}
|
||||
));
|
||||
};
|
||||
};
|
||||
|
||||
config.services.nginx = mkIf ( ( attrValues cfg ) != [] ) {
|
||||
enable = true;
|
||||
config.services.nginx = mkIf ((attrValues cfg) != [ ]) {
|
||||
enable = true;
|
||||
|
||||
recommendedGzipSettings = true;
|
||||
recommendedOptimisation = true;
|
||||
recommendedProxySettings = true;
|
||||
recommendedTlsSettings = true;
|
||||
recommendedGzipSettings = true;
|
||||
recommendedOptimisation = true;
|
||||
recommendedProxySettings = true;
|
||||
recommendedTlsSettings = true;
|
||||
|
||||
virtualHosts = mapAttrs makeHost cfg;
|
||||
};
|
||||
virtualHosts = mapAttrs makeHost cfg;
|
||||
};
|
||||
}
|
||||
|
||||
+86
-82
@@ -1,93 +1,97 @@
|
||||
{ config, lib, pkgs, ... }:
|
||||
|
||||
let
|
||||
names = mylist: (lib.strings.concatMapStringsSep "," (x: ''"${x}"'') mylist);
|
||||
# Pass the names of the wan/lan ports
|
||||
nftConfig = {
|
||||
wan,
|
||||
lan,
|
||||
limitedLan ? [],
|
||||
openPorts ? [ "ssh" "67" "53" ], # ssh, dhcpd, dns
|
||||
openUDPPorts ? [ "67" "53" ] # dhcpd, dns
|
||||
}: let
|
||||
lanList = names lan;
|
||||
allLan = names (lan ++ limitedLan);
|
||||
wanName = names wan;
|
||||
portsString = lib.strings.concatMapStringsSep "\n" (x: "iifname { ${lanList}, \"tailscale0\" } tcp dport ${toString x} accept") openPorts;
|
||||
udpPortsString = lib.strings.concatMapStringsSep "\n" (x: "iifname { ${lanList}, \"tailscale0\" } udp dport ${toString x} accept") openUDPPorts;
|
||||
in lib.strings.concatStringsSep "\n" [
|
||||
"table ip filter {"
|
||||
" chain output {"
|
||||
" type filter hook output priority 100; policy accept;"
|
||||
" }"
|
||||
names = mylist: (lib.strings.concatMapStringsSep "," (x: ''"${x}"'') mylist);
|
||||
# Pass the names of the wan/lan ports
|
||||
nftConfig =
|
||||
{ wan
|
||||
, lan
|
||||
, limitedLan ? [ ]
|
||||
, openPorts ? [ "ssh" "67" "53" ]
|
||||
, # ssh, dhcpd, dns
|
||||
openUDPPorts ? [ "67" "53" ] # dhcpd, dns
|
||||
}:
|
||||
let
|
||||
lanList = names lan;
|
||||
allLan = names (lan ++ limitedLan);
|
||||
wanName = names wan;
|
||||
portsString = lib.strings.concatMapStringsSep "\n" (x: "iifname { ${lanList}, \"tailscale0\" } tcp dport ${toString x} accept") openPorts;
|
||||
udpPortsString = lib.strings.concatMapStringsSep "\n" (x: "iifname { ${lanList}, \"tailscale0\" } udp dport ${toString x} accept") openUDPPorts;
|
||||
in
|
||||
lib.strings.concatStringsSep "\n" [
|
||||
"table ip filter {"
|
||||
" chain output {"
|
||||
" type filter hook output priority 100; policy accept;"
|
||||
" }"
|
||||
|
||||
" chain input {"
|
||||
" type filter hook input priority 0; policy drop;"
|
||||
" chain input {"
|
||||
" type filter hook input priority 0; policy drop;"
|
||||
|
||||
" iifname lo accept"
|
||||
portsString
|
||||
udpPortsString
|
||||
" iifname { ${lanList} } accept comment \"Allows LAN traffic and outgoing\""
|
||||
" iifname { ${wanName} } ct state { established, related } accept comment \"Allows existing connections\""
|
||||
" iifname { ${wanName} } icmp type { echo-request, destination-unreachable, time-exceeded } counter accept comment \"Allow some ICMP traffic\""
|
||||
" iifname { ${wanName} } counter drop comment \"Drop other incoming traffic, and count how much\""
|
||||
" }"
|
||||
" chain forward {"
|
||||
" type filter hook forward priority 0; policy drop;"
|
||||
" iifname { ${allLan} } oifname { ${wanName} } accept comment \"Forward LAN to WAN\""
|
||||
" iifname { ${wanName} } oifname { ${allLan} } ct state established, related accept comment \"Allow incoming established traffic\""
|
||||
" }"
|
||||
"}"
|
||||
" iifname lo accept"
|
||||
portsString
|
||||
udpPortsString
|
||||
" iifname { ${lanList} } accept comment \"Allows LAN traffic and outgoing\""
|
||||
" iifname { ${wanName} } ct state { established, related } accept comment \"Allows existing connections\""
|
||||
" iifname { ${wanName} } icmp type { echo-request, destination-unreachable, time-exceeded } counter accept comment \"Allow some ICMP traffic\""
|
||||
" iifname { ${wanName} } counter drop comment \"Drop other incoming traffic, and count how much\""
|
||||
" }"
|
||||
" chain forward {"
|
||||
" type filter hook forward priority 0; policy drop;"
|
||||
" iifname { ${allLan} } oifname { ${wanName} } accept comment \"Forward LAN to WAN\""
|
||||
" iifname { ${wanName} } oifname { ${allLan} } ct state established, related accept comment \"Allow incoming established traffic\""
|
||||
" }"
|
||||
"}"
|
||||
|
||||
"table ip nat {"
|
||||
" chain postrouting {"
|
||||
" type nat hook postrouting priority 100; policy accept;"
|
||||
" oifname { ${wanName} } masquerade"
|
||||
" }"
|
||||
"}"
|
||||
"table ip nat {"
|
||||
" chain postrouting {"
|
||||
" type nat hook postrouting priority 100; policy accept;"
|
||||
" oifname { ${wanName} } masquerade"
|
||||
" }"
|
||||
"}"
|
||||
|
||||
"table ip6 filter {"
|
||||
" chain input {"
|
||||
" type filter hook input priority 0; policy drop;"
|
||||
" }"
|
||||
" chain forward {"
|
||||
" type filter hook forward priority 0; policy drop;"
|
||||
" }"
|
||||
"}"
|
||||
];
|
||||
cfg = config.greg.router;
|
||||
"table ip6 filter {"
|
||||
" chain input {"
|
||||
" type filter hook input priority 0; policy drop;"
|
||||
" }"
|
||||
" chain forward {"
|
||||
" type filter hook forward priority 0; policy drop;"
|
||||
" }"
|
||||
"}"
|
||||
];
|
||||
cfg = config.greg.router;
|
||||
|
||||
in with lib; {
|
||||
options.greg.router = {
|
||||
enable = mkEnableOption "Enable NFTables and routing";
|
||||
wan = mkOption {
|
||||
type = (types.listOf types.str);
|
||||
description = "The name of the network interface that is the WAN connection";
|
||||
};
|
||||
lan = mkOption {
|
||||
type = (types.listOf types.str);
|
||||
description = "A list of all network interfaces that are considered LAN connections";
|
||||
};
|
||||
limited = mkOption {
|
||||
type = (types.listOf types.str);
|
||||
description = "A list of limited access LAN connections - such as IOT connections and similar.";
|
||||
default = [];
|
||||
};
|
||||
};
|
||||
in
|
||||
with lib; {
|
||||
options.greg.router = {
|
||||
enable = mkEnableOption "Enable NFTables and routing";
|
||||
wan = mkOption {
|
||||
type = (types.listOf types.str);
|
||||
description = "The name of the network interface that is the WAN connection";
|
||||
};
|
||||
lan = mkOption {
|
||||
type = (types.listOf types.str);
|
||||
description = "A list of all network interfaces that are considered LAN connections";
|
||||
};
|
||||
limited = mkOption {
|
||||
type = (types.listOf types.str);
|
||||
description = "A list of limited access LAN connections - such as IOT connections and similar.";
|
||||
default = [ ];
|
||||
};
|
||||
};
|
||||
|
||||
config = mkIf cfg.enable {
|
||||
networking.nftables = {
|
||||
enable = true;
|
||||
ruleset = (nftConfig {
|
||||
inherit (cfg) lan wan;
|
||||
openPorts = config.networking.firewall.allowedTCPPorts;
|
||||
openUDPPorts = config.networking.firewall.allowedUDPPorts;
|
||||
});
|
||||
};
|
||||
config = mkIf cfg.enable {
|
||||
networking.nftables = {
|
||||
enable = true;
|
||||
ruleset = (nftConfig {
|
||||
inherit (cfg) lan wan;
|
||||
openPorts = config.networking.firewall.allowedTCPPorts;
|
||||
openUDPPorts = config.networking.firewall.allowedUDPPorts;
|
||||
});
|
||||
};
|
||||
|
||||
environment.systemPackages = [
|
||||
pkgs.pciutils
|
||||
pkgs.tcpdump
|
||||
];
|
||||
};
|
||||
environment.systemPackages = [
|
||||
pkgs.pciutils
|
||||
pkgs.tcpdump
|
||||
];
|
||||
};
|
||||
}
|
||||
|
||||
+34
-33
@@ -1,43 +1,44 @@
|
||||
{ config, lib, pkgs, ... }:
|
||||
|
||||
let
|
||||
cfg = config.greg.rpi4;
|
||||
cfg = config.greg.rpi4;
|
||||
|
||||
in with lib; {
|
||||
options = {
|
||||
greg.rpi4 = {
|
||||
enable = mkEnableOption "Enable support for Raspberry Pi 4s";
|
||||
};
|
||||
};
|
||||
in
|
||||
with lib; {
|
||||
options = {
|
||||
greg.rpi4 = {
|
||||
enable = mkEnableOption "Enable support for Raspberry Pi 4s";
|
||||
};
|
||||
};
|
||||
|
||||
config = mkIf cfg.enable {
|
||||
boot = {
|
||||
# This prevents us from having to compile our own kernel
|
||||
kernelPackages = pkgs.linuxPackages_rpi4;
|
||||
kernelParams = [
|
||||
"8250.nr_uarts=1"
|
||||
"console=ttyAMA0,115200"
|
||||
"console=tty1"
|
||||
"cma=128M"
|
||||
];
|
||||
config = mkIf cfg.enable {
|
||||
boot = {
|
||||
# This prevents us from having to compile our own kernel
|
||||
kernelPackages = pkgs.linuxPackages_rpi4;
|
||||
kernelParams = [
|
||||
"8250.nr_uarts=1"
|
||||
"console=ttyAMA0,115200"
|
||||
"console=tty1"
|
||||
"cma=128M"
|
||||
];
|
||||
|
||||
loader = {
|
||||
raspberryPi = {
|
||||
enable = true;
|
||||
version = 4;
|
||||
};
|
||||
loader = {
|
||||
raspberryPi = {
|
||||
enable = true;
|
||||
version = 4;
|
||||
};
|
||||
|
||||
# Use the extlinux boot loader. (NixOS wants to enable GRUB by default)
|
||||
grub.enable = false;
|
||||
# Use the extlinux boot loader. (NixOS wants to enable GRUB by default)
|
||||
grub.enable = false;
|
||||
|
||||
# Enables the generation of /boot/extlinux/extlinux.conf
|
||||
#generic-extlinux-compatible.enable = true;
|
||||
};
|
||||
};
|
||||
# Enables the generation of /boot/extlinux/extlinux.conf
|
||||
#generic-extlinux-compatible.enable = true;
|
||||
};
|
||||
};
|
||||
|
||||
environment.systemPackages = with pkgs; [
|
||||
raspberrypifw
|
||||
usbutils
|
||||
];
|
||||
};
|
||||
environment.systemPackages = with pkgs; [
|
||||
raspberrypifw
|
||||
usbutils
|
||||
];
|
||||
};
|
||||
}
|
||||
|
||||
+34
-33
@@ -1,42 +1,43 @@
|
||||
{ config, pkgs, lib, ... }:
|
||||
|
||||
let
|
||||
cfg = config.greg.sway;
|
||||
cfg = config.greg.sway;
|
||||
|
||||
in with lib; {
|
||||
options = {
|
||||
greg.sway.enable = mkEnableOption "Enable my default Gnome3 setup";
|
||||
};
|
||||
in
|
||||
with lib; {
|
||||
options = {
|
||||
greg.sway.enable = mkEnableOption "Enable my default Gnome3 setup";
|
||||
};
|
||||
|
||||
config = mkIf cfg.enable {
|
||||
services = {
|
||||
accounts-daemon.enable = true;
|
||||
config = mkIf cfg.enable {
|
||||
services = {
|
||||
accounts-daemon.enable = true;
|
||||
|
||||
pipewire = {
|
||||
enable = true;
|
||||
alsa.enable = true;
|
||||
audio.enable = true;
|
||||
jack.enable = true;
|
||||
pulse.enable = true;
|
||||
wireplumber.enable = true;
|
||||
};
|
||||
pipewire = {
|
||||
enable = true;
|
||||
alsa.enable = true;
|
||||
audio.enable = true;
|
||||
jack.enable = true;
|
||||
pulse.enable = true;
|
||||
wireplumber.enable = true;
|
||||
};
|
||||
|
||||
xserver = {
|
||||
enable = true;
|
||||
displayManager.gdm = {
|
||||
enable = true;
|
||||
autoSuspend = false;
|
||||
banner = "Welcome to Greg's JUDE machine. Do I know you?";
|
||||
wayland = true;
|
||||
};
|
||||
xkb.layout = "us";
|
||||
};
|
||||
};
|
||||
xserver = {
|
||||
enable = true;
|
||||
displayManager.gdm = {
|
||||
enable = true;
|
||||
autoSuspend = false;
|
||||
banner = "Welcome to Greg's JUDE machine. Do I know you?";
|
||||
wayland = true;
|
||||
};
|
||||
xkb.layout = "us";
|
||||
};
|
||||
};
|
||||
|
||||
programs.sway = {
|
||||
enable = true; # Will be enabled through home-manager
|
||||
wrapperFeatures.gtk = true;
|
||||
};
|
||||
security.pam.services.swaylock = {};
|
||||
};
|
||||
programs.sway = {
|
||||
enable = true; # Will be enabled through home-manager
|
||||
wrapperFeatures.gtk = true;
|
||||
};
|
||||
security.pam.services.swaylock = { };
|
||||
};
|
||||
}
|
||||
|
||||
+25
-24
@@ -1,29 +1,30 @@
|
||||
{ config, lib, pkgs, ... }:
|
||||
|
||||
let
|
||||
cfg = config.greg.syncthing;
|
||||
in with lib; {
|
||||
options.greg.syncthing = {
|
||||
enable = mkEnableOption "Setup my personal minimal configuration for Syncthing";
|
||||
};
|
||||
cfg = config.greg.syncthing;
|
||||
in
|
||||
with lib; {
|
||||
options.greg.syncthing = {
|
||||
enable = mkEnableOption "Setup my personal minimal configuration for Syncthing";
|
||||
};
|
||||
|
||||
config = mkIf cfg.enable {
|
||||
services.syncthing = {
|
||||
enable = true;
|
||||
overrideFolders = true;
|
||||
overrideDevices = true;
|
||||
settings = {
|
||||
devices = {
|
||||
chronicles.id = "7FI6Y3M-C7YQEDI-IB345L6-RKLXMB6-AEIV57Y-3J2RCXQ-MK6QRNK-EINPXAE";
|
||||
genesis.id = "YDTH4SD-GUAC5AA-SSYWYPZ-YMJW5LK-LE7PZKJ-GV2UJFZ-CU7LZAD-GTYWCQK";
|
||||
gitlab.id = "VAG5GHP-L7TNY7O-CHR3CKU-GXXVCIL-OT3WHHU-E4VAIZC-JI4BKOM-PYZQOQS";
|
||||
linode.id = "IJMMXPR-WNALZBD-FMJH5W5-WV7XGJY-HLJTKGT-5TKHJIH-75LT56D-UUZCYQE";
|
||||
matrix.id = "K5IHM3I-TJFFEW5-GAYJMPS-CYSHW5C-XHMC462-MFRMOHJ-EJLKIKC-CZHGJQ2";
|
||||
};
|
||||
options = {
|
||||
urAccepted = -1;
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
config = mkIf cfg.enable {
|
||||
services.syncthing = {
|
||||
enable = true;
|
||||
overrideFolders = true;
|
||||
overrideDevices = true;
|
||||
settings = {
|
||||
devices = {
|
||||
chronicles.id = "7FI6Y3M-C7YQEDI-IB345L6-RKLXMB6-AEIV57Y-3J2RCXQ-MK6QRNK-EINPXAE";
|
||||
genesis.id = "YDTH4SD-GUAC5AA-SSYWYPZ-YMJW5LK-LE7PZKJ-GV2UJFZ-CU7LZAD-GTYWCQK";
|
||||
gitlab.id = "VAG5GHP-L7TNY7O-CHR3CKU-GXXVCIL-OT3WHHU-E4VAIZC-JI4BKOM-PYZQOQS";
|
||||
linode.id = "IJMMXPR-WNALZBD-FMJH5W5-WV7XGJY-HLJTKGT-5TKHJIH-75LT56D-UUZCYQE";
|
||||
matrix.id = "K5IHM3I-TJFFEW5-GAYJMPS-CYSHW5C-XHMC462-MFRMOHJ-EJLKIKC-CZHGJQ2";
|
||||
};
|
||||
options = {
|
||||
urAccepted = -1;
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
|
||||
+14
-13
@@ -1,18 +1,19 @@
|
||||
{ lib, config, ... }:
|
||||
|
||||
let
|
||||
cfg = config.greg.tailscale;
|
||||
in {
|
||||
options = {
|
||||
greg.tailscale.enable = lib.mkEnableOption "Enable Tailscale";
|
||||
};
|
||||
cfg = config.greg.tailscale;
|
||||
in
|
||||
{
|
||||
options = {
|
||||
greg.tailscale.enable = lib.mkEnableOption "Enable Tailscale";
|
||||
};
|
||||
|
||||
config = lib.mkIf cfg.enable {
|
||||
services.tailscale.enable = true;
|
||||
networking.firewall.checkReversePath = "loose";
|
||||
boot.kernel.sysctl = {
|
||||
"net.ipv4.ip_forward" = "1";
|
||||
"net.ipv6.conf.all.forwarding" = "1";
|
||||
};
|
||||
};
|
||||
config = lib.mkIf cfg.enable {
|
||||
services.tailscale.enable = true;
|
||||
networking.firewall.checkReversePath = "loose";
|
||||
boot.kernel.sysctl = {
|
||||
"net.ipv4.ip_forward" = "1";
|
||||
"net.ipv6.conf.all.forwarding" = "1";
|
||||
};
|
||||
};
|
||||
}
|
||||
|
||||
+63
-62
@@ -1,74 +1,75 @@
|
||||
{ pkgs, lib, config, ... }:
|
||||
|
||||
let
|
||||
cfg = config.greg.vmdev;
|
||||
in with lib;
|
||||
cfg = config.greg.vmdev;
|
||||
in
|
||||
with lib;
|
||||
{
|
||||
options = {
|
||||
greg.vmdev = {
|
||||
enable = mkEnableOption "Enable this system for VM development work";
|
||||
user = mkOption {
|
||||
default = "greg";
|
||||
type = types.str;
|
||||
description = "The user who will be doing VM dev";
|
||||
};
|
||||
system = mkOption {
|
||||
default = "amd";
|
||||
type = types.str;
|
||||
description = "Kernel module type to install - amd, intel, etc";
|
||||
};
|
||||
};
|
||||
};
|
||||
options = {
|
||||
greg.vmdev = {
|
||||
enable = mkEnableOption "Enable this system for VM development work";
|
||||
user = mkOption {
|
||||
default = "greg";
|
||||
type = types.str;
|
||||
description = "The user who will be doing VM dev";
|
||||
};
|
||||
system = mkOption {
|
||||
default = "amd";
|
||||
type = types.str;
|
||||
description = "Kernel module type to install - amd, intel, etc";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
config = mkIf cfg.enable {
|
||||
environment.systemPackages = with pkgs; [
|
||||
dmidecode
|
||||
guestfs-tools
|
||||
libguestfs
|
||||
OVMFFull
|
||||
packer
|
||||
virt-manager
|
||||
xorriso
|
||||
];
|
||||
config = mkIf cfg.enable {
|
||||
environment.systemPackages = with pkgs; [
|
||||
dmidecode
|
||||
guestfs-tools
|
||||
libguestfs
|
||||
OVMFFull
|
||||
packer
|
||||
virt-manager
|
||||
xorriso
|
||||
];
|
||||
|
||||
users.users."${cfg.user}".extraGroups = [ "libvirtd" ];
|
||||
users.users."${cfg.user}".extraGroups = [ "libvirtd" ];
|
||||
|
||||
# Enable the virtualisation services
|
||||
virtualisation = {
|
||||
libvirtd = {
|
||||
enable = true;
|
||||
onBoot = "ignore"; # Do not auto-restart VMs on boot, unless they are marked autostart
|
||||
qemu.ovmf.enable = true;
|
||||
};
|
||||
# Enable the virtualisation services
|
||||
virtualisation = {
|
||||
libvirtd = {
|
||||
enable = true;
|
||||
onBoot = "ignore"; # Do not auto-restart VMs on boot, unless they are marked autostart
|
||||
qemu.ovmf.enable = true;
|
||||
};
|
||||
|
||||
virtualbox.host = {
|
||||
enable = true;
|
||||
enableExtensionPack = true;
|
||||
};
|
||||
};
|
||||
virtualbox.host = {
|
||||
enable = true;
|
||||
enableExtensionPack = true;
|
||||
};
|
||||
};
|
||||
|
||||
# Configuration for vbox user performance
|
||||
users.extraGroups.vboxusers.members = [ cfg.user ];
|
||||
# Configuration for vbox user performance
|
||||
users.extraGroups.vboxusers.members = [ cfg.user ];
|
||||
|
||||
boot.extraModprobeConfig = "options kvm_${cfg.system} nested=1";
|
||||
boot.extraModprobeConfig = "options kvm_${cfg.system} nested=1";
|
||||
|
||||
# Configure the services more
|
||||
systemd.services = {
|
||||
libvirtd = {
|
||||
preStart = "${pkgs.kmod}/bin/modprobe kvm_${cfg.system}";
|
||||
postStop = "${pkgs.kmod}/bin/rmmod kvm_${cfg.system} kvm";
|
||||
conflicts = [ "vbox.service" ];
|
||||
};
|
||||
vbox = {
|
||||
preStart = "${pkgs.kmod}/bin/modprobe vboxdrv vboxnetadp vboxnetflt";
|
||||
postStop = "${pkgs.kmod}/bin/rmmod vboxnetadp vboxnetflt vboxdrv";
|
||||
script = "echo Started";
|
||||
conflicts = [ "libvirtd.service" ];
|
||||
unitConfig = {
|
||||
Type = "oneshot";
|
||||
RemainAfterExit = "yes";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
# Configure the services more
|
||||
systemd.services = {
|
||||
libvirtd = {
|
||||
preStart = "${pkgs.kmod}/bin/modprobe kvm_${cfg.system}";
|
||||
postStop = "${pkgs.kmod}/bin/rmmod kvm_${cfg.system} kvm";
|
||||
conflicts = [ "vbox.service" ];
|
||||
};
|
||||
vbox = {
|
||||
preStart = "${pkgs.kmod}/bin/modprobe vboxdrv vboxnetadp vboxnetflt";
|
||||
postStop = "${pkgs.kmod}/bin/rmmod vboxnetadp vboxnetflt vboxdrv";
|
||||
script = "echo Started";
|
||||
conflicts = [ "libvirtd.service" ];
|
||||
unitConfig = {
|
||||
Type = "oneshot";
|
||||
RemainAfterExit = "yes";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user