A complete reformatting to match nixpkgs-fmt

.gitignore

@@ -1,2 +1,3 @@
 host
 result
+.pre-commit-config.yaml

ceph/home.nix

@@ -1,21 +1,23 @@
 {
-	fsid = "749bf0ea-acf5-4a5e-b33e-9a057455c06b";
+  fsid = "749bf0ea-acf5-4a5e-b33e-9a057455c06b";
-	clusterName = "home";
+  clusterName = "home";
-	initialMonitors = [ {
+  initialMonitors = [{
-		hostname = "myself.thehellings.lan";
+    hostname = "myself.thehellings.lan";
-		ipAddress = "10.42.1.6";
+    ipAddress = "10.42.1.6";
-	} {
+  }
-		hostname = "jeremiah.thehellings.lan";
+    {
-		ipAddress = "10.42.1.8";
+      hostname = "jeremiah.thehellings.lan";
-	} {
+      ipAddress = "10.42.1.8";
-		hostname = "hosea.thehellings.lan";
+    }
-		ipAddress = "10.42.1.7";
+    {
-	} ];
+      hostname = "hosea.thehellings.lan";
-	mdsNodes = [ {
+      ipAddress = "10.42.1.7";
-		hostname = "jeremiah.thehellings.lan";
+    }];
-		ipAddress = "10.42.1.8";
+  mdsNodes = [{
-	} ];
+    hostname = "jeremiah.thehellings.lan";
-	publicNetworks = [ "10.42.0.0/16" ];
+    ipAddress = "10.42.1.8";
-	clusterNetworks = [ "10.201.0.0/16" ];
+  }];
-	adminKeyring = ../secrets/home.client.admin.keyring;
+  publicNetworks = [ "10.42.0.0/16" ];
+  clusterNetworks = [ "10.201.0.0/16" ];
+  adminKeyring = ../secrets/home.client.admin.keyring;
 }

checks.nix

@@ -1,9 +1,10 @@
 { hooks, system, ... }:
 
 {
-	pre-commit-check = hooks.lib.${system}.run {
+  pre-commit-check = hooks.lib.${system}.run {
-		src = ./.;
+    src = ./.;
-		hooks = {
+    hooks = {
-		};
+      nixpkgs-fmt.enable = true;
-	};
+    };
+  };
 }

configuration.nix

@@ -6,7 +6,8 @@
 
 {
   imports =
-    [ # Include the results of the hardware scan.
+    [
+      # Include the results of the hardware scan.
       ./hardware-configuration.nix
       ./modules/
     ];
@@ -75,7 +76,7 @@
     extraGroups = [ "networkmanager" "wheel" ];
     packages = with pkgs; [
       firefox
-    #  thunderbird
+      #  thunderbird
     ];
   };
 

darwin-configuration.nix

@@ -1,8 +1,8 @@
 { ... }:
 
 {
-	imports = [
+  imports = [
-		./modules
+    ./modules
-		./hosts/work
+    ./hosts/work
-	];
+  ];
 }

darwin/default.nix

@@ -1,33 +1,35 @@
 { inputs, overlays, ... }:
 let
-	mac = {
+  mac =
-		system ? "aarch64-darwin",
+    { system ? "aarch64-darwin"
-		name,
+    , name
-		channel ? inputs.nixunstable,
+    , channel ? inputs.nixunstable
-		hm ? inputs.hmunstable,
+    , hm ? inputs.hmunstable
-		extraMods ? []
+    , extraMods ? [ ]
-	}:
+    }:
-	let
+    let
-		nixpkgs = import channel {
+      nixpkgs = import channel {
-			inherit system overlays;
+        inherit system overlays;
-		};
+      };
-	in inputs.darwin.lib.darwinSystem {
+    in
-		inherit system;
+    inputs.darwin.lib.darwinSystem {
-		specialArgs = { inherit nixpkgs; };
+      inherit system;
-		modules = [
+      specialArgs = { inherit nixpkgs; };
-			{
+      modules = [
-				nixpkgs.overlays = overlays;
+        {
-				home-manager.extraSpecialArgs = {
+          nixpkgs.overlays = overlays;
-					inherit inputs;
+          home-manager.extraSpecialArgs = {
-					host = name;
+            inherit inputs;
-				};
+            host = name;
-			}
+          };
-			hm.darwinModules.home-manager
+        }
-			inputs.self.modules.darwinModule
+        hm.darwinModules.home-manager
-			./${name}
+        inputs.self.modules.darwinModule
-		] ++ extraMods;
+        ./${name}
-	};
+      ] ++ extraMods;
-in rec {
+    };
-	la23002 = mac { name = "ivr"; };
+in
-	LA23002 = la23002;
+rec {
+  la23002 = mac { name = "ivr"; };
+  LA23002 = la23002;
 }

flake.nix

@@ -2,109 +2,112 @@
 # your system.  Help is available in the configuration.nix(5) man page
 # and in the NixOS manual (accessible by running ‘nixos-help’).
 {
-	description = "Greg's machines!";
+  description = "Greg's machines!";
 
-	inputs = {
+  inputs = {
-		agenix = {
+    agenix = {
-			url = "github:ryantm/agenix";
+      url = "github:ryantm/agenix";
-			inputs.nixpkgs.follows = "nixunstable";
+      inputs.nixpkgs.follows = "nixunstable";
-		};
+    };
-		btc = {
+    btc = {
-			url = "github:fort-nix/nix-bitcoin/release";
+      url = "github:fort-nix/nix-bitcoin/release";
-		};
+    };
-		darwin = {
+    darwin = {
-			url = "github:lnl7/nix-darwin/master";
+      url = "github:lnl7/nix-darwin/master";
-			inputs.nixpkgs.follows = "nixunstable";
+      inputs.nixpkgs.follows = "nixunstable";
-		};
+    };
-		flake-parts.url = "github:hercules-ci/flake-parts";
+    flake-parts.url = "github:hercules-ci/flake-parts";
-		hooks.url = "github:cachix/git-hooks.nix";
+    hooks.url = "github:cachix/git-hooks.nix";
-		hm = {
+    hm = {
-			url = "github:nix-community/home-manager/release-24.05";
+      url = "github:nix-community/home-manager/release-24.05";
-			inputs.nixpkgs.follows = "nixstable";
+      inputs.nixpkgs.follows = "nixstable";
-		};
+    };
-		hmunstable = {
+    hmunstable = {
-			url = "github:nix-community/home-manager/master";
+      url = "github:nix-community/home-manager/master";
-			inputs.nixpkgs.follows = "nixstable";
+      inputs.nixpkgs.follows = "nixstable";
-		};
+    };
-		nixvimstable.url = "github:nix-community/nixvim/nixos-24.05";
+    nixvimstable.url = "github:nix-community/nixvim/nixos-24.05";
-		nixvimunstable.url = "github:nix-community/nixvim/main";
+    nixvimunstable.url = "github:nix-community/nixvim/main";
-		nix23_05.url = "github:NixOS/nixpkgs/nixos-23.05";
+    nix23_05.url = "github:NixOS/nixpkgs/nixos-23.05";
-		nixstable.url = "github:nixos/nixpkgs/nixos-24.05";
+    nixstable.url = "github:nixos/nixpkgs/nixos-24.05";
-		nixunstable.url = "github:nixos/nixpkgs/nixos-unstable";
+    nixunstable.url = "github:nixos/nixpkgs/nixos-unstable";
-		nurpkgs.url = "github:nix-community/NUR";
+    nurpkgs.url = "github:nix-community/NUR";
-		vsext.url = "github:nix-community/nix-vscode-extensions";
+    vsext.url = "github:nix-community/nix-vscode-extensions";
-		wsl = {
+    wsl = {
-			url = "github:nix-community/NixOS-WSL";
+      url = "github:nix-community/NixOS-WSL";
-			inputs.nixpkgs.follows = "nixunstable";
+      inputs.nixpkgs.follows = "nixunstable";
-		};
+    };
-		zed.url = "github:zed-industries/zed/v0.154.x";
+    zed.url = "github:zed-industries/zed/v0.154.x";
-	};
+  };
 
-	outputs = { self, ...}@inputs: let
+  outputs = { self, ... }@inputs:
-		local_overlay = import ./overlays;
+    let
-		overlays = [
+      local_overlay = import ./overlays;
-			inputs.agenix.overlays.default
+      overlays = [
-			local_overlay
+        inputs.agenix.overlays.default
-			inputs.nurpkgs.overlay
+        local_overlay
-			inputs.vsext.overlays.default
+        inputs.nurpkgs.overlay
-			(_: _: { zed-editor = inputs.zed.packages.x86_64-linux.default; } )
+        inputs.vsext.overlays.default
-		];
+        (_: _: { zed-editor = inputs.zed.packages.x86_64-linux.default; })
+      ];
 
-	in inputs.flake-parts.lib.mkFlake { inherit inputs; } {
+    in
-		systems = [ "x86_64-linux" "x86_64-darwin" "aarch64-linux" "aarch64-darwin" ];
+    inputs.flake-parts.lib.mkFlake { inherit inputs; } {
-		#checks = {
+      systems = [ "x86_64-linux" "x86_64-darwin" "aarch64-linux" "aarch64-darwin" ];
-		#	x86_64-linux = {
+      #checks = {
-		#		unstable = self.nixosConfigurations.jude.config.system.build.toplevel;
+      #	x86_64-linux = {
-		#		stable   = self.nixosConfigurations.linode.config.system.build.toplevel;
+      #		unstable = self.nixosConfigurations.jude.config.system.build.toplevel;
-		#	};
+      #		stable   = self.nixosConfigurations.linode.config.system.build.toplevel;
-		#	aarch64-linux = {
+      #	};
-		#		unstable = self.nixosConfigurations.nixos.config.system.build.toplevel;
+      #	aarch64-linux = {
-		#	};
+      #		unstable = self.nixosConfigurations.nixos.config.system.build.toplevel;
-		#};
+      #	};
+      #};
 
-		flake = {
+      flake = {
-			nixosConfigurations = (import ./hosts { inherit inputs overlays; });
+        nixosConfigurations = (import ./hosts { inherit inputs overlays; });
 
-			darwinConfigurations = (import ./darwin { inherit inputs overlays; });
+        darwinConfigurations = (import ./darwin { inherit inputs overlays; });
 
-			homeConfigurations = (import ./home { inherit inputs overlays; });
+        homeConfigurations = (import ./home { inherit inputs overlays; });
 
-			overlays = {
+        overlays = {
-				default = local_overlay;
+          default = local_overlay;
-			};
+        };
 
-			modules = import ./modules;
+        modules = import ./modules;
-		};
+      };
 
-		perSystem = { pkgs, system, ... }: {
+      perSystem = { pkgs, self', system, ... }: {
-			_module.args.pkgs = import inputs.nixstable {
+        _module.args.pkgs = import inputs.nixstable {
-				inherit system overlays;
+          inherit system overlays;
-			};
+        };
 
-			checks = import ./checks.nix { inherit  system; inherit (inputs) hooks; };
+        checks = import ./checks.nix { inherit system; inherit (inputs) hooks; };
 
-			devShells = {
+        devShells = {
-				default = pkgs.mkShell {
+          default = pkgs.mkShell {
-					buildInputs = with pkgs; [
+            inherit (self'.checks.pre-commit-check) shellHook;
-						bashInteractive
+            buildInputs = with pkgs; [
-						curl
+              bashInteractive
-						git
+              curl
-						gnutar
+              git
-						gzip
+              gnutar
-						inject
+              gzip
-						inject-darwin
+              inject
-						tmux
+              inject-darwin
-						vim
+              tmux
-						xonsh
+              vim
-					];
+              xonsh
-				};
+            ];
-			};
+          };
+        };
 
-			packages = rec {
+        packages = rec {
-				defaullt = iso;
+          defaullt = iso;
-				iso = self.nixosConfigurations.iso.config.system.build.isoImage;
+          iso = self.nixosConfigurations.iso.config.system.build.isoImage;
-				iso-beta = self.nixosConfigurations.iso-beta.config.system.build.isoImage;
+          iso-beta = self.nixosConfigurations.iso-beta.config.system.build.isoImage;
-			};
+        };
-		};
+      };
-	};
+    };
 }

hardware-configuration.nix

@@ -5,7 +5,8 @@
 
 {
   imports =
-    [ (modulesPath + "/installer/scan/not-detected.nix")
+    [
+      (modulesPath + "/installer/scan/not-detected.nix")
     ];
 
   boot.initrd.availableKernelModules = [ "xhci_pci" "thunderbolt" "nvme" "uas" "sd_mod" ];
@@ -14,13 +15,15 @@
   boot.extraModulePackages = [ ];
 
   fileSystems."/" =
-    { device = "/dev/disk/by-uuid/607b933f-2967-4652-b478-4d8e9aa38a0d";
+    {
+      device = "/dev/disk/by-uuid/607b933f-2967-4652-b478-4d8e9aa38a0d";
       fsType = "btrfs";
       options = [ "subvol=@" ];
     };
 
   fileSystems."/boot" =
-    { device = "/dev/disk/by-uuid/B31C-C1F4";
+    {
+      device = "/dev/disk/by-uuid/B31C-C1F4";
       fsType = "vfat";
     };
 

home/default.nix

@@ -1,26 +1,26 @@
-{
+{ inputs
-	inputs,
+, overlays
-	overlays,
+, ...
-	...
 }:
 
 rec {
-	greghellings = 
+  greghellings =
-	let
+    let
-		system = "x86_64-linux";
+      system = "x86_64-linux";
-		pkgs = (import inputs.nixunstable { inherit system overlays; });
+      pkgs = (import inputs.nixunstable { inherit system overlays; });
-	in inputs.hmunstable.lib.homeManagerConfiguration {
+    in
-		inherit pkgs;
+    inputs.hmunstable.lib.homeManagerConfiguration {
-		modules = [ ./home.nix ];
+      inherit pkgs;
-		extraSpecialArgs = {
+      modules = [ ./home.nix ];
-			inherit inputs;
+      extraSpecialArgs = {
-			nixvim = inputs.nixvimunstable;
+        inherit inputs;
-			gui = false;
+        nixvim = inputs.nixvimunstable;
-			gnome = false;
+        gui = false;
-			host = "ivr";
+        gnome = false;
-			username = "gregory.hellings";
+        host = "ivr";
-		};
+        username = "gregory.hellings";
-	};
+      };
+    };
 
-	"gregory.hellings" = greghellings;
+  "gregory.hellings" = greghellings;
 }

home/home.nix

@@ -1,48 +1,50 @@
-{ pkgs, lib,
+{ pkgs
-  host ? "most",
+, lib
-  nixvim,
+, host ? "most"
-  ...}:
+, nixvim
+, ...
+}:
 
 {
-	nixpkgs.config.allowUnfreePredicate = (_: true);
+  nixpkgs.config.allowUnfreePredicate = (_: true);
-	imports = [
+  imports = [
-		nixvim.homeManagerModules.default
+    nixvim.homeManagerModules.default
-		./modules
+    ./modules
-	] ++ lib.optionals (builtins.pathExists ./hosts/${host}) [ ./hosts/${host} ];
+  ] ++ lib.optionals (builtins.pathExists ./hosts/${host}) [ ./hosts/${host} ];
 
 
-	programs.tmux = {
+  programs.tmux = {
-		enable = true;
+    enable = true;
-		keyMode = "vi";
+    keyMode = "vi";
-		terminal = "xterm-256color";
+    terminal = "xterm-256color";
-		customPaneNavigationAndResize = true;
+    customPaneNavigationAndResize = true;
-		extraConfig = (lib.strings.concatStringsSep "\n" [
+    extraConfig = (lib.strings.concatStringsSep "\n" [
-			"bind P paste-buffer"
+      "bind P paste-buffer"
-		]);
+    ]);
-	};
+  };
 
-	home.stateVersion = "23.05";
+  home.stateVersion = "23.05";
-	home.packages = with pkgs; [
+  home.packages = with pkgs; [
-		bitwarden-cli
+    bitwarden-cli
-		copier
+    copier
-		diffutils
+    diffutils
-		findutils
+    findutils
-		gh
+    gh
-		git
+    git
-		gnupatch
+    gnupatch
-		hms
+    hms
-		htop
+    htop
-		inetutils
+    inetutils
-		jq
+    jq
-		nano
+    nano
-		nix-prefetch
+    nix-prefetch
-		nmap
+    nmap
-		openssl
+    openssl
-		setup-ssh
+    setup-ssh
-		tmux
+    tmux
-		tree
+    tree
-		unzip
+    unzip
-		wget
+    wget
-		zip
+    zip
-	];
+  ];
 }

home/hosts/exodus/default.nix

@@ -1,15 +1,15 @@
 { pkgs, config, ... }:
 
 {
-	greg = {
+  greg = {
-		vscodium = true;
+    vscodium = true;
-		development = true;
+    development = true;
-		gnome = true;
+    gnome = true;
-		gui = true;
+    gui = true;
-	};
+  };
-	home.packages = with pkgs; [
+  home.packages = with pkgs; [
-		cargo
+    cargo
-		freeciv
+    freeciv
-		#freeciv_qt
+    #freeciv_qt
-	];
+  ];
 }

home/hosts/icdm-root/default.nix

@@ -1,5 +1,3 @@
 { ... }:
 
-{
+{ }
-
-}

home/hosts/ivr/default.nix

@@ -1,65 +1,66 @@
-{ pkgs, lib, inputs, ...}:
+{ pkgs, lib, inputs, ... }:
 let
-	nix23 = import inputs.nix23_05 {
+  nix23 = import inputs.nix23_05 {
-		inherit (pkgs.stdenv) system;
+    inherit (pkgs.stdenv) system;
-		overlays = [ inputs.self.overlays.default ];
+    overlays = [ inputs.self.overlays.default ];
-	};
+  };
-	py = nix23.python311.withPackages ( p: with p; [
+  py = nix23.python311.withPackages (p: with p; [
-		django
+    django
-		djangorestframework
+    djangorestframework
-		django-rapyd-modernauth
+    django-rapyd-modernauth
-		environs
+    environs
-		mysqlclient
+    mysqlclient
-		pyyaml
+    pyyaml
-		ruamel-yaml
+    ruamel-yaml
-		tox
+    tox
-	]);
+  ]);
-	x = pkgs.xonsh.override {
+  x = pkgs.xonsh.override {
-		extraPackages = (ps: [
+    extraPackages = (ps: [
-			pkgs.nur.repos.xonsh-xontribs.xonsh-direnv
+      pkgs.nur.repos.xonsh-xontribs.xonsh-direnv
-			pkgs.nur.repos.xonsh-xontribs.xontrib-vox
+      pkgs.nur.repos.xonsh-xontribs.xontrib-vox
-			ps.xonsh-apipenv
+      ps.xonsh-apipenv
-			pkgs.pipenv-ivr
+      pkgs.pipenv-ivr
-		]);
+    ]);
-	};
+  };
-in {
+in
-	greg = {
+{
-		development = true;
+  greg = {
-		gui = true;
+    development = true;
-		pypackage = py;
+    gui = true;
-		vscodium = true;
+    pypackage = py;
-	};
+    vscodium = true;
+  };
 
-    nixpkgs.config = {
+  nixpkgs.config = {
-        allowUnfree = true;
+    allowUnfree = true;
-        permittedInsecurePackages = [
+    permittedInsecurePackages = [
-			"jitsi-meet-1.0.8043"
+      "jitsi-meet-1.0.8043"
-		];
+    ];
-    };
+  };
 
-	home = {
+  home = {
-		packages = with pkgs; [
+    packages = with pkgs; [
-			aacs
+      aacs
-			ansible
+      ansible
-			bitwarden-cli
+      bitwarden-cli
-			direnv
+      direnv
-			home-manager
+      home-manager
-			mysql-workbench
+      mysql-workbench
-			pipenv-ivr
+      pipenv-ivr
-			poetry
+      poetry
-			robo3t
+      robo3t
-			x
+      x
-		];
+    ];
-		file.".pip/pip.conf".text = (lib.strings.concatStringsSep "\n" [
+    file.".pip/pip.conf".text = (lib.strings.concatStringsSep "\n" [
-			"[global]"
+      "[global]"
-			"retries = 1"
+      "retries = 1"
-			"index-url = https://pypi.python.org/simple"
+      "index-url = https://pypi.python.org/simple"
-			"extra-index-url ="
+      "extra-index-url ="
-			"    https://pypi.ivrtechnology.com/simple/"
+      "    https://pypi.ivrtechnology.com/simple/"
-			"    https://pypidev.ivrtechnology.com/simple/"
+      "    https://pypidev.ivrtechnology.com/simple/"
-		]);
+    ]);
-		username = "gregory.hellings";
+    username = "gregory.hellings";
-		homeDirectory = lib.mkForce "/home/gregory.hellings";
+    homeDirectory = lib.mkForce "/home/gregory.hellings";
-	};
+  };
-	programs.tmux.shell = (lib.getExe x);
+  programs.tmux.shell = (lib.getExe x);
 }

home/hosts/jude/default.nix

@@ -1,17 +1,17 @@
 { pkgs, ... }:
 
 {
-	home.packages = with pkgs; [
+  home.packages = with pkgs; [
-		(mumble.override { pulseSupport = true; })
+    (mumble.override { pulseSupport = true; })
-		#logseq
+    #logseq
-	];
+  ];
-	greg = {
+  greg = {
-		development = true;
+    development = true;
-		gui = true;
+    gui = true;
-		sway = false;
+    sway = false;
-		gnome = true;
+    gnome = true;
-		vscodium = true;
+    vscodium = true;
-	};
+  };
 
-	programs.xonsh.sessionVariables.EFI_DIR = "${pkgs.OVMF.fd}/FV/";
+  programs.xonsh.sessionVariables.EFI_DIR = "${pkgs.OVMF.fd}/FV/";
 }

home/hosts/work/default.nix

@@ -1,9 +1,9 @@
 { pkgs, ... }:
 
 {
-	greg.vscodium.enable = true;
+  greg.vscodium.enable = true;
 
-	home.packages = with pkgs; [
+  home.packages = with pkgs; [
-		brew
+    brew
-	];
+  ];
 }

home/modules/baseline/ansible.nix

@@ -1,28 +1,28 @@
 { ... }:
 
 {
-	home.file.".ansible.cfg".text = ''
+  home.file.".ansible.cfg".text = ''
-[defaults]
+    [defaults]
-forks=10
+    forks=10
-host_key_checking=False
+    host_key_checking=False
-# Also available: profile_roles
+    # Also available: profile_roles
-callback_enabled=timer,profile_tasks
+    callback_enabled=timer,profile_tasks
-stdout_callback=yaml
+    stdout_callback=yaml
-nocows=1
+    nocows=1
-cow_selection=tux
+    cow_selection=tux
-collections_path=~/src
+    collections_path=~/src
 
-[ssh_connection]
+    [ssh_connection]
-pipelining=True
+    pipelining=True
-ssh_args = -o ControlMaster=auto -o ControlPersist=600s -o IdentitiesOnly=yes -o GSSAPIAuthentication=no -o StrictHostKeyChecking=no
+    ssh_args = -o ControlMaster=auto -o ControlPersist=600s -o IdentitiesOnly=yes -o GSSAPIAuthentication=no -o StrictHostKeyChecking=no
-control_path=%(directory)s/%%h-%%r
+    control_path=%(directory)s/%%h-%%r
-control_path_dir=/tmp
+    control_path_dir=/tmp
 
-[callback_profile_tasks]
+    [callback_profile_tasks]
-sort_order=descending
+    sort_order=descending
 
-[galaxy]
+    [galaxy]
-role_skeleton_ignore = ^.git$,^.*/.git_keep$,\..*.swp
+    role_skeleton_ignore = ^.git$,^.*/.git_keep$,\..*.swp
-role_skeleton = ~/src/ansible_collections/meta_ansible_templates/role
+    role_skeleton = ~/src/ansible_collections/meta_ansible_templates/role
-'';
+  '';
 }

home/modules/baseline/bash.nix

@@ -1,93 +1,93 @@
 { pkgs, ... }:
 
 {
-	programs.bash = {
+  programs.bash = {
-		enable = true;
+    enable = true;
-		shellAliases = {
+    shellAliases = {
-			acp = "rsync --progress -ah";
+      acp = "rsync --progress -ah";
-			agbuild = "ansible-galaxy collection build";
+      agbuild = "ansible-galaxy collection build";
-			apub = "ansible-galaxy collection publish --api-key \${GALAXY_API_KEY}";
+      apub = "ansible-galaxy collection publish --api-key \${GALAXY_API_KEY}";
-			calc = "bc";
+      calc = "bc";
-			d = "deactivate";
+      d = "deactivate";
-			devroles = "cd ~/src/ansible_collections/devroles";
+      devroles = "cd ~/src/ansible_collections/devroles";
-			gohome = "ssh greg@dns.greg-hellings.gmail.com.beta.tailscale.net -D localhost:10080";
+      gohome = "ssh greg@dns.greg-hellings.gmail.com.beta.tailscale.net -D localhost:10080";
-			ll = "ls -l";
+      ll = "ls -l";
-			molcol = "molecule -c ../../tests/molecule.yml";
+      molcol = "molecule -c ../../tests/molecule.yml";
-			packaging = "cd ~/src/packaging";
+      packaging = "cd ~/src/packaging";
-			vdown = "vagrant destroy";
+      vdown = "vagrant destroy";
-			vhalt = "vagrant halt";
+      vhalt = "vagrant halt";
-			vos = "vagrant up --provision --provider openstack";
+      vos = "vagrant up --provision --provider openstack";
-			vprov = "vagrant provision";
+      vprov = "vagrant provision";
-			vssh = "vagrant ssh";
+      vssh = "vagrant ssh";
-			vup = "vagrant up --provision --provider libvirt";
+      vup = "vagrant up --provision --provider libvirt";
-			yaml2js = "python -c 'import sys, yaml, json; json.dump(yaml.load(sys.stdin), sys.stdout, indent=4)";
+      yaml2js = "python -c 'import sys, yaml, json; json.dump(yaml.load(sys.stdin), sys.stdout, indent=4)";
-		};
+    };
-		sessionVariables = {
+    sessionVariables = {
-			ANSIBLE_COLLECTIONS_PATH="\${HOME}/src/";
+      ANSIBLE_COLLECTIONS_PATH = "\${HOME}/src/";
-			CLICOLOR = "1";
+      CLICOLOR = "1";
-			EDITOR = "${pkgs.vim}/bin/vim";
+      EDITOR = "${pkgs.vim}/bin/vim";
-			GIT_SSL_NO_VERIFY = "True";
+      GIT_SSL_NO_VERIFY = "True";
-			LSCOLORS = "ExGxBxDxCxEgEdxbxgxcxd";
+      LSCOLORS = "ExGxBxDxCxEgEdxbxgxcxd";
-			MAVEN_OPTS = " -Dmaven.wagon.http.ssl.insecure=true ";
+      MAVEN_OPTS = " -Dmaven.wagon.http.ssl.insecure=true ";
-			OS_CLOUD = "default";
+      OS_CLOUD = "default";
-			SWORD_PATH = "\${HOME}/.sword";
+      SWORD_PATH = "\${HOME}/.sword";
-			TIMEFORMAT = "%3Uu %3Ss %3lR %P%%";
+      TIMEFORMAT = "%3Uu %3Ss %3lR %P%%";
-		};
+    };
-		profileExtra = ''
+    profileExtra = ''
-if [ -e /etc/profile ]; then
+      if [ -e /etc/profile ]; then
-	. /etc/profile
+      	. /etc/profile
-fi
+      fi
-'';
+    '';
-		bashrcExtra = ''
+    bashrcExtra = ''
-function swordtag {
+      function swordtag {
-	if [ x"$1" == "x" ]; then
+      	if [ x"$1" == "x" ]; then
-		echo "Please provide tag version"
+      		echo "Please provide tag version"
-		return
+      		return
-	fi
+      	fi
-	svn cp http://crosswire.org/svn/sword/branches/sword-1-8-x/ http://crosswire.org/svn/sword/tags/sword-$1/
+      	svn cp http://crosswire.org/svn/sword/branches/sword-1-8-x/ http://crosswire.org/svn/sword/tags/sword-$1/
-}
+      }
 
-function newdock {
+      function newdock {
-	if [ x"$1" == "x" -o x"$2" == "x" ]; then
+      	if [ x"$1" == "x" -o x"$2" == "x" ]; then
-		echo "expected arguments [name] [source]"
+      		echo "expected arguments [name] [source]"
-		return
+      		return
-	fi
+      	fi
-	podman run -P --privileged=true -e DISPLAY=$DISPLAY -v /tmp/.X11-unix:/tmp/.X11-unix -v "$(pwd):/dmnt" -t -i --name="$1" "$2" /bin/bash
+      	podman run -P --privileged=true -e DISPLAY=$DISPLAY -v /tmp/.X11-unix:/tmp/.X11-unix -v "$(pwd):/dmnt" -t -i --name="$1" "$2" /bin/bash
-}
+      }
 
-function rundock {
+      function rundock {
-	podman start -a -i "$1"
+      	podman start -a -i "$1"
-}
+      }
 
-function ac {
+      function ac {
-	source ~/venv/''${1}/bin/activate
+      	source ~/venv/''${1}/bin/activate
-}
+      }
 
-function py2env {
+      function py2env {
-	/usr/bin/virtualenv -p /usr/bin/python2 "''${HOME}/venv/''${1}"
+      	/usr/bin/virtualenv -p /usr/bin/python2 "''${HOME}/venv/''${1}"
-	"''${HOME}/venv/''${1}/bin/pip" install -U pip
+      	"''${HOME}/venv/''${1}/bin/pip" install -U pip
-}
+      }
 
-function py3env {
+      function py3env {
-	VENV_NAME="''${1}"
+      	VENV_NAME="''${1}"
-	#PYVERSION="$(python3 -c "import sys;print(sys.version[:sys.version.find('.',2)])")"
+      	#PYVERSION="$(python3 -c "import sys;print(sys.version[:sys.version.find('.',2)])")"
-	#SITE_PACKAGES_PATH="/usr/lib64/python''${PYVERSION}/site-packages/"
+      	#SITE_PACKAGES_PATH="/usr/lib64/python''${PYVERSION}/site-packages/"
-	#VENV_SITE_PACKAGES="''${HOME}/venv/''${VENV_NAME}/lib64/python''${PYVERSION}/site-packages/"
+      	#VENV_SITE_PACKAGES="''${HOME}/venv/''${VENV_NAME}/lib64/python''${PYVERSION}/site-packages/"
-	# Create the virtualenv and update pip to latest
+      	# Create the virtualenv and update pip to latest
-	/usr/bin/python3 -m venv --clear "''${HOME}/venv/''${VENV_NAME}" --system-site-packages
+      	/usr/bin/python3 -m venv --clear "''${HOME}/venv/''${VENV_NAME}" --system-site-packages
-	"''${HOME}/venv/''${1}/bin/python3" -m pip install -U pip
+      	"''${HOME}/venv/''${1}/bin/python3" -m pip install -U pip
-	# Link SELinux into the environment if necessary
+      	# Link SELinux into the environment if necessary
-	#if [ -d "''${SITE_PACKAGES_PATH}" ]; then
+      	#if [ -d "''${SITE_PACKAGES_PATH}" ]; then
-	#	ln -s "''${SITE_PACKAGES_PATH}/selinux" "''${VENV_SITE_PACKAGES}"
+      	#	ln -s "''${SITE_PACKAGES_PATH}/selinux" "''${VENV_SITE_PACKAGES}"
-	#	ln -s ''${SITE_PACKAGES_PATH}/_selinux*.so "''${VENV_SITE_PACKAGES}"
+      	#	ln -s ''${SITE_PACKAGES_PATH}/_selinux*.so "''${VENV_SITE_PACKAGES}"
-	#else
+      	#else
-	#	echo "ERROR: LibSELinux not found for Python ''${PYVERSION}. Install system package to enable."
+      	#	echo "ERROR: LibSELinux not found for Python ''${PYVERSION}. Install system package to enable."
-	#fi
+      	#fi
-}
+      }
 
-function unknown_host {
+      function unknown_host {
-	sed -i -e ''${1}d ~/.ssh/known_hosts
+      	sed -i -e ''${1}d ~/.ssh/known_hosts
-}
+      }
-'';
+    '';
-	};
+  };
 }

home/modules/baseline/default.nix

@@ -1,13 +1,13 @@
 { ... }:
 
 {
-	imports = [
+  imports = [
-		./ansible.nix
+    ./ansible.nix
-		./bash.nix
+    ./bash.nix
-		./direnv.nix
+    ./direnv.nix
-		./git.nix
+    ./git.nix
-		./ssh.nix
+    ./ssh.nix
-		./vim.nix
+    ./vim.nix
-		./xonsh.nix
+    ./xonsh.nix
-	];
+  ];
 }

home/modules/baseline/direnv.nix

@@ -1,8 +1,8 @@
 { pkgs, ... }:
 
 {
-	programs.direnv = {
+  programs.direnv = {
-		enable = true;
+    enable = true;
-		nix-direnv.enable = true;
+    nix-direnv.enable = true;
-	};
+  };
 }

home/modules/baseline/git.nix

@@ -1,31 +1,33 @@
 { ... }:
 
 {
-	programs.git = {
+  programs.git = {
-		enable = true;
+    enable = true;
-		userName = "Greg Hellings";
+    userName = "Greg Hellings";
-		userEmail = "greg.hellings@gmail.com";
+    userEmail = "greg.hellings@gmail.com";
-		aliases = {
+    aliases = {
-			st = "status";
+      st = "status";
-			ci = "commit";
+      ci = "commit";
-			co = "checkout";
+      co = "checkout";
-			ups = "push -u origin HEAD";
+      ups = "push -u origin HEAD";
-			amend = "commit --amend";
+      amend = "commit --amend";
-		};
+    };
-		ignores = [
+    ignores = [
-			".*.swp" ".*.swo" ".*.swn" # vim
+      ".*.swp"
-			".idea" # IntelliJ
+      ".*.swo"
-			".DS_Store" # Macs
+      ".*.swn" # vim
-			"Thumbs.db" # Windows
+      ".idea" # IntelliJ
-			".tox" # Tox temp directory
+      ".DS_Store" # Macs
-			".eclipse"  # These next two are created by VSCodium plugins
+      "Thumbs.db" # Windows
-			".bazelproject"
+      ".tox" # Tox temp directory
-		];
+      ".eclipse" # These next two are created by VSCodium plugins
-		extraConfig = {
+      ".bazelproject"
-			init.defaultBranch = "main";
+    ];
-			push.default = "upstream";
+    extraConfig = {
-			pull.rebase = "false";
+      init.defaultBranch = "main";
-			tag.sort = "version:refname";
+      push.default = "upstream";
-		};
+      pull.rebase = "false";
-	};
+      tag.sort = "version:refname";
+    };
+  };
 }

home/modules/baseline/ssh.nix

@@ -1,64 +1,65 @@
 { lib, ... }:
 
 {
-	# Workaround to set the config value to user read-only
+  # Workaround to set the config value to user read-only
-	# This allows things like SSH in distrobox to read the config file just fine
+  # This allows things like SSH in distrobox to read the config file just fine
-	home.file.".ssh/config" = {
+  home.file.".ssh/config" = {
-  	  target = ".ssh/config_source";
+    target = ".ssh/config_source";
-  	  onChange = ''cat ~/.ssh/config_source > ~/.ssh/config && chmod 600 ~/.ssh/config'';
+    onChange = ''cat ~/.ssh/config_source > ~/.ssh/config && chmod 600 ~/.ssh/config'';
-	};
+  };
-	programs.ssh = {
+  programs.ssh = {
-		enable = true;
+    enable = true;
-		serverAliveInterval = 60;
+    serverAliveInterval = 60;
 
-		includes = ["config.local"];
+    includes = [ "config.local" ];
 
-		matchBlocks =
+    matchBlocks =
-		let
+      let
-			nas = { user = "admin"; };
+        nas = { user = "admin"; };
-			owned = { user = "greg"; };
+        owned = { user = "greg"; };
-		in {
+      in
-			inherit nas;
+      {
+        inherit nas;
 
-			"*" = {
+        "*" = {
-				dynamicForwards = [ {
+          dynamicForwards = [{
-					port = 10240;
+            port = 10240;
-				} ];
+          }];
-			};
+        };
 
-			"10.42.1.4" = lib.hm.dag.entryBefore ["10.42.*"] nas;
+        "10.42.1.4" = lib.hm.dag.entryBefore [ "10.42.*" ] nas;
-			"nas.thehellings.lan" = nas;
+        "nas.thehellings.lan" = nas;
-			"nas.greg-hellings.gmail.com.beta.tailscale.net" = nas;
+        "nas.greg-hellings.gmail.com.beta.tailscale.net" = nas;
-			chronicles = nas;
+        chronicles = nas;
-			"chronicles.thehellings.lan" = lib.hm.dag.entryBefore [ "*.thehellings.lan"] nas;
+        "chronicles.thehellings.lan" = lib.hm.dag.entryBefore [ "*.thehellings.lan" ] nas;
 
-			gh = { user = "git"; hostname = "github.com"; };
+        gh = { user = "git"; hostname = "github.com"; };
-			"src" = {
+        "src" = {
-				user = "gitlab";
+          user = "gitlab";
-				hostname = "git.thehellings.lan";
+          hostname = "git.thehellings.lan";
-			};
+        };
 
-			"*.thehellings.lan" = owned;
+        "*.thehellings.lan" = owned;
-			"10.42.*" = owned;
+        "10.42.*" = owned;
 
-			"host.crosswire.org crosswire" = {
+        "host.crosswire.org crosswire" = {
-				hostname = "host.crosswire.org";
+          hostname = "host.crosswire.org";
-				user = "ghellings";
+          user = "ghellings";
-			};
+        };
 
-			fedpeople = {
+        fedpeople = {
-				hostname = "fedorapeople.org";
+          hostname = "fedorapeople.org";
-				user = "greghellings";
+          user = "greghellings";
-			};
+        };
 
-			"src.fedoraproject.org pkgs.fedoraproject.org" = {
+        "src.fedoraproject.org pkgs.fedoraproject.org" = {
-				user = "greghellings";
+          user = "greghellings";
-			};
+        };
 
-			"127.*".extraOptions = {
+        "127.*".extraOptions = {
-				PubkeyAcceptedAlgorithms = "+ssh-rsa";
+          PubkeyAcceptedAlgorithms = "+ssh-rsa";
-				HostkeyAlgorithms = "+ssh-rsa";
+          HostkeyAlgorithms = "+ssh-rsa";
-			};
+        };
-		};
+      };
-	};
+  };
 }

home/modules/baseline/vim.nix

@@ -1,142 +1,145 @@
 { lib, pkgs, config, ... }:
 
 let
-	vim-xonsh = pkgs.vimUtils.buildVimPlugin {
+  vim-xonsh = pkgs.vimUtils.buildVimPlugin {
-		name = "vim-xonsh";
+    name = "vim-xonsh";
-		src = pkgs.fetchFromGitHub {
+    src = pkgs.fetchFromGitHub {
-			owner = "meatballs";
+      owner = "meatballs";
-			repo = "vim-xonsh";
+      repo = "vim-xonsh";
-			rev = "929f35e";
+      rev = "929f35e";
-			hash = "sha256-ugHLu2Z9bTtQsIp4FQPKxgjVe9oZNjfQYrP+aHu+/uU=";
+      hash = "sha256-ugHLu2Z9bTtQsIp4FQPKxgjVe9oZNjfQYrP+aHu+/uU=";
-		};
+    };
-	};
+  };
 in
 {
-	fonts.fontconfig.enable = true;
+  fonts.fontconfig.enable = true;
-	home.packages = [ (pkgs.nerdfonts.override { fonts = [ "Hack" ]; }) ];
+  home.packages = [ (pkgs.nerdfonts.override { fonts = [ "Hack" ]; }) ];
-	programs.nixvim = {
+  programs.nixvim = {
-		enable = true;
+    enable = true;
-		colorschemes.gruvbox.enable = true;
+    colorschemes.gruvbox.enable = true;
-		globals = {
+    globals = {
-			indent_guides_enable_on_vim_startup = 1;
+      indent_guides_enable_on_vim_startup = 1;
-			nix_recommended_style = 0;
+      nix_recommended_style = 0;
-		};
+    };
-		opts = {
+    opts = {
-			background = "dark";
+      background = "dark";
-			backup = false;
+      backup = false;
-			copyindent = true;
+      copyindent = true;
-			cursorline = true;
+      cursorline = true;
-			expandtab = false;
+      expandtab = false;
-			hidden = true;
+      hidden = true;
-			hlsearch = true;
+      hlsearch = true;
-			ignorecase = true;
+      ignorecase = true;
-			lazyredraw = true;
+      lazyredraw = true;
-			list = true;
+      list = true;
-			listchars = "tab:→ ,extends:→,precedes:←,trail:·,eol:¬";
+      listchars = "tab:→ ,extends:→,precedes:←,trail:·,eol:¬";
-			mouse = "a";
+      mouse = "a";
-			number = true;
+      number = true;
-			preserveindent = true;
+      preserveindent = true;
-			relativenumber = true;
+      relativenumber = true;
-			shiftwidth = 4;
+      shiftwidth = 4;
-			showcmd = true;
+      showcmd = true;
-			showmatch = true;
+      showmatch = true;
-			signcolumn = "yes";
+      signcolumn = "yes";
-			smartcase = true;
+      smartcase = true;
-			softtabstop = 4;
+      softtabstop = 4;
-			tabstop = 4;
+      tabstop = 4;
-			# Setting for CtrlP
+      # Setting for CtrlP
-			wildignore = "*.swp,*.pyc,*.class,.tox";
+      wildignore = "*.swp,*.pyc,*.class,.tox";
-			wrap = false;
+      wrap = false;
-			writebackup = false;
+      writebackup = false;
-		};
+    };
-		keymaps = let
+    keymaps =
-			winMove = key: { mode = "n"; key = "<C-${key}>"; action = "<C-w>${key}<C-w><CR>"; };
+      let
-		in [ {
+        winMove = key: { mode = "n"; key = "<C-${key}>"; action = "<C-w>${key}<C-w><CR>"; };
-			mode = "n";
+      in
-			key = "<C-e>";
+      [{
-			action = "<Esc>:BufExplorer<CR>";
+        mode = "n";
-		} {
+        key = "<C-e>";
-			mode = "n";
+        action = "<Esc>:BufExplorer<CR>";
-			key = "<C-t>";
+      }
-			#action = "<Esc>:NERDTreeToggle<CR>";
+        {
-			action = "<Esc>:Neotree toggle<CR>";
+          mode = "n";
-		} {
+          key = "<C-t>";
-			mode = "n";
+          #action = "<Esc>:NERDTreeToggle<CR>";
-			key = "<C-g>";
+          action = "<Esc>:Neotree toggle<CR>";
-			action = "<Esc>:Neotree float git_status toggle<CR>";
+        }
-		}
+        {
-			(winMove "h")
+          mode = "n";
-			(winMove "j")
+          key = "<C-g>";
-			(winMove "k")
+          action = "<Esc>:Neotree float git_status toggle<CR>";
-			(winMove "l")
+        }
-		];
+        (winMove "h")
-		plugins = {
+        (winMove "j")
-			airline.enable = true;
+        (winMove "k")
-			cmp = {
+        (winMove "l")];
-				enable = true;
+    plugins = {
-				autoEnableSources = true;
+      airline.enable = true;
-				settings.sources = [
+      cmp = {
-					{ name = "nvim_lsp"; }
+        enable = true;
-					{ name = "buffer"; group_index = 2; }
+        autoEnableSources = true;
-					{ name = "path"; gruop_index = 3; }
+        settings.sources = [
-				];
+          { name = "nvim_lsp"; }
-			};
+          { name = "buffer"; group_index = 2; }
-			direnv.enable = true;
+          { name = "path"; gruop_index = 3; }
-			gitgutter.enable = true;
+        ];
-			fugitive.enable = true;
+      };
-			fzf-lua = {
+      direnv.enable = true;
-				enable = true;
+      gitgutter.enable = true;
-				keymaps = {
+      fugitive.enable = true;
-					"<C-o>" = {
+      fzf-lua = {
-						action = "files";
+        enable = true;
-						settings = {
+        keymaps = {
-							previewers.cat.cmd = "${pkgs.coreutils}/bin/cat";
+          "<C-o>" = {
-							winopts.height = 0.5;
+            action = "files";
-						};
+            settings = {
-					};
+              previewers.cat.cmd = "${pkgs.coreutils}/bin/cat";
-					"<C-p>" = {
+              winopts.height = 0.5;
-						action = "git_files";
+            };
-						settings = {
+          };
-							previewers.cat.cmd = "${pkgs.coreutils}/bin/cat";
+          "<C-p>" = {
-							winopts.height = 0.5;
+            action = "git_files";
-						};
+            settings = {
-					};
+              previewers.cat.cmd = "${pkgs.coreutils}/bin/cat";
-				};
+              winopts.height = 0.5;
-				profile = "fzf-vim";
+            };
-			};
+          };
-			lsp = {
+        };
-				enable = true;
+        profile = "fzf-vim";
-				servers = {
+      };
-					ansiblels.enable = true;
+      lsp = {
-					cmake.enable = true;
+        enable = true;
-					gopls.enable = true;
+        servers = {
-					html.enable = true;
+          ansiblels.enable = true;
-					nixd.enable = true;
+          cmake.enable = true;
-					pylsp.enable = true;
+          gopls.enable = true;
-					pyright.enable = true;
+          html.enable = true;
-					rust-analyzer = {
+          nixd.enable = true;
-						# No need to have these installed on every one of my systems
+          pylsp.enable = true;
-						installCargo = false;
+          pyright.enable = true;
-						installRustc = false;
+          rust-analyzer = {
-						enable = true;
+            # No need to have these installed on every one of my systems
-					};
+            installCargo = false;
-					terraformls.enable = true;
+            installRustc = false;
-				};
+            enable = true;
-			};
+          };
-			neo-tree.enable = true;
+          terraformls.enable = true;
-			notify.enable = true;
+        };
-			web-devicons.enable = true;
+      };
-		} // (lib.mkIf (lib.versionAtLeast config.system.nixos.release "24.11") {});
+      neo-tree.enable = true;
-		extraConfigLua = builtins.replaceStrings [ "@git@" ] [ "${pkgs.git}/bin/git" ] (builtins.readFile ./vim/extra.lua);
+      notify.enable = true;
-		extraConfigVim = builtins.readFile ./vim/extra.vimrc;
+      web-devicons.enable = true;
-		extraPlugins = with pkgs.vimPlugins; [
+    } // (lib.mkIf (lib.versionAtLeast config.system.nixos.release "24.11") { });
-			bufexplorer
+    extraConfigLua = builtins.replaceStrings [ "@git@" ] [ "${pkgs.git}/bin/git" ] (builtins.readFile ./vim/extra.lua);
+    extraConfigVim = builtins.readFile ./vim/extra.vimrc;
+    extraPlugins = with pkgs.vimPlugins; [
+      bufexplorer
 
-			context-vim
+      context-vim
-			vim-indent-guides
+      vim-indent-guides
-			vim-xonsh
+      vim-xonsh
-		];
+    ];
-		viAlias = true;
+    viAlias = true;
-		vimAlias = true;
+    vimAlias = true;
-	};
+  };
 }

home/modules/baseline/xonsh.nix

@@ -1,75 +1,75 @@
 { pkgs, config, lib, ... }:
 
 {
-	programs.xonsh = {
+  programs.xonsh = {
-		enable = true;
+    enable = true;
 
-		sessionVariables = {
+    sessionVariables = {
-			CLICOLOR = 1;
+      CLICOLOR = 1;
-			EDITOR = "nvim";
+      EDITOR = "nvim";
-			# vte_new_tab_cwd causes new Terminal tabs to open in the
+      # vte_new_tab_cwd causes new Terminal tabs to open in the
-			# same CWD as the current tab
+      # same CWD as the current tab
-			LESS_TERMCAP_mb = "\\033[01;31m";     # begin blinking
+      LESS_TERMCAP_mb = "\\033[01;31m"; # begin blinking
-			LESS_TERMCAP_md = "\\033[01;31m";     # begin bold
+      LESS_TERMCAP_md = "\\033[01;31m"; # begin bold
-			LESS_TERMCAP_me = "\\033[0m";         # end mode
+      LESS_TERMCAP_me = "\\033[0m"; # end mode
-			LESS_TERMCAP_so = "\\033[01;44;36m";  # begin standout-mode (bottom of screen)
+      LESS_TERMCAP_so = "\\033[01;44;36m"; # begin standout-mode (bottom of screen)
-			LESS_TERMCAP_se = "\\033[0m";         # end standout-mode
+      LESS_TERMCAP_se = "\\033[0m"; # end standout-mode
-			LESS_TERMCAP_us = "\\033[00;36m";     # begin underline
+      LESS_TERMCAP_us = "\\033[00;36m"; # begin underline
-			LESS_TERMCAP_ue = "\\033[0m";         # end underline
+      LESS_TERMCAP_ue = "\\033[0m"; # end underline
-			LIBMYSQL_ENABLE_CLEARTEXT_PLUGIN = "1";
+      LIBMYSQL_ENABLE_CLEARTEXT_PLUGIN = "1";
-			LSCOLORS = "ExGxBxDxCxEgEdxbxgxcxd";
+      LSCOLORS = "ExGxBxDxCxEgEdxbxgxcxd";
-			MAVEN_OPTS = " -Dmaven.wagon.http.ssl.insecure=true";
+      MAVEN_OPTS = " -Dmaven.wagon.http.ssl.insecure=true";
-			OS_CLOUD = "default";
+      OS_CLOUD = "default";
-			PROMPT = "{vte_new_tab_cwd}{env_name}{BOLD_GREEN}{user}@{hostname}{BOLD_BLUE} {short_cwd}{branch_color}{curr_branch: {}}{RESET} {BOLD_BLUE}{prompt_end}{RESET} ";
+      PROMPT = "{vte_new_tab_cwd}{env_name}{BOLD_GREEN}{user}@{hostname}{BOLD_BLUE} {short_cwd}{branch_color}{curr_branch: {}}{RESET} {BOLD_BLUE}{prompt_end}{RESET} ";
-			SWORD_PATH = "${config.home.homeDirectory}/.sword/";
+      SWORD_PATH = "${config.home.homeDirectory}/.sword/";
-			TIMEFORMAT = "%3Uu %3Ss %3lR %P%%";
+      TIMEFORMAT = "%3Uu %3Ss %3lR %P%%";
-			# Tells vox where to find virtualenvs
+      # Tells vox where to find virtualenvs
-			VIRTUALENV_HOME = "${config.home.homeDirectory}/venv/";
+      VIRTUALENV_HOME = "${config.home.homeDirectory}/venv/";
-			XONSH_COLOR_STYLE = "default";
+      XONSH_COLOR_STYLE = "default";
 
-			GOPATH = "${config.home.homeDirectory}/src/go";
+      GOPATH = "${config.home.homeDirectory}/src/go";
-			GOBIN  = "${config.home.homeDirectory}/src/bin";
+      GOBIN = "${config.home.homeDirectory}/src/bin";
-		};
+    };
 
-		aliases = {
+    aliases = {
-			# Python related ones
+      # Python related ones
-			ac = "vox activate";
+      ac = "vox activate";
-			d = "vox deactivate";
+      d = "vox deactivate";
 
-			# Nix related ones
+      # Nix related ones
-			gl-nging = "sudo nixos-container run gitlab -- systemctl restart nginx";
+      gl-nging = "sudo nixos-container run gitlab -- systemctl restart nginx";
-			nb = "nix build -L";
+      nb = "nix build -L";
-			nixdu = "sudo nix-store --gc --print-roots | egrep -v r\"^(/nix/var|/run/\\w+-system|\\{memory|/proc)\"";
+      nixdu = "sudo nix-store --gc --print-roots | egrep -v r\"^(/nix/var|/run/\\w+-system|\\{memory|/proc)\"";
-			nixtest = "nixpkgs-review rev HEAD";
+      nixtest = "nixpkgs-review rev HEAD";
-			nixup = "nix flake update";
+      nixup = "nix flake update";
-			stable = "nix flake update nixpkgs hm nixvimstable";
+      stable = "nix flake update nixpkgs hm nixvimstable";
-			unstable = "nix flake update nixunstable hmunstable nixvimunstable nurpkgs vsext wsl";
+      unstable = "nix flake update nixunstable hmunstable nixvimunstable nurpkgs vsext wsl";
 
-			# General
+      # General
-			gh-personal = "$GH_CONFIG_DIR=\"${config.home.homeDirectory}/.config/gh/personal\" gh";
+      gh-personal = "$GH_CONFIG_DIR=\"${config.home.homeDirectory}/.config/gh/personal\" gh";
-			ls = "ls --color";
+      ls = "ls --color";
-			ll = "ls -l --color";
+      ll = "ls -l --color";
-			tf = "terraform";
+      tf = "terraform";
 
-			# Tailscale related ones
+      # Tailscale related ones
-			tsup = "sudo tailscale up";
+      tsup = "sudo tailscale up";
-			tspub = "sudo tailscale up --exit-node=linode";
+      tspub = "sudo tailscale up --exit-node=linode";
-			tshome = "sudo tailscale up --exit-node=2maccabees";
+      tshome = "sudo tailscale up --exit-node=2maccabees";
-			tsclear = "sudo tailscale up --exit-node=''";
+      tsclear = "sudo tailscale up --exit-node=''";
 
-			# Vagrant related
+      # Vagrant related
-			vdown = "vagrant destroy";
+      vdown = "vagrant destroy";
-			vhalt = "vagrant halt";
+      vhalt = "vagrant halt";
-			vos = "vagrant up --provision --provider openstack";
+      vos = "vagrant up --provision --provider openstack";
-			vprov = "vagrant provision";
+      vprov = "vagrant provision";
-			vup = "vagrant up --provision --provider libvirt";
+      vup = "vagrant up --provision --provider libvirt";
-			vssh = "vagrant ssh";
+      vssh = "vagrant ssh";
-		};
+    };
 
-		configHeader = builtins.readFile ./xonsh_header.xsh;
+    configHeader = builtins.readFile ./xonsh_header.xsh;
-		configFooter = (builtins.readFile ./xonsh_footer.xsh) + (builtins.concatStringsSep "\n" [
+    configFooter = (builtins.readFile ./xonsh_footer.xsh) + (builtins.concatStringsSep "\n" [
-			"with open('${pkgs.stdenv.cc}/nix-support/dynamic-linker', 'r') as fp:"
+      "with open('${pkgs.stdenv.cc}/nix-support/dynamic-linker', 'r') as fp:"
-			"    $NIX_LD = fp.read().strip()"
+      "    $NIX_LD = fp.read().strip()"
-		]);
+    ]);
-	};
+  };
 }

home/modules/default.nix

@@ -1,14 +1,14 @@
 { ... }:
 
 {
-	imports = [
+  imports = [
-		./baseline
+    ./baseline
-		./development.nix
+    ./development.nix
-		./gnome.nix
+    ./gnome.nix
-		./gui.nix
+    ./gui.nix
-		./python.nix
+    ./python.nix
-		./sway.nix
+    ./sway.nix
-		./vscodium.nix
+    ./vscodium.nix
-		./xonsh.nix
+    ./xonsh.nix
-	];
+  ];
 }

home/modules/development.nix

@@ -1,24 +1,25 @@
 { config, pkgs, lib, ... }:
 let
-	packages = with pkgs; [
+  packages = with pkgs; [
-		bruno  # but let's not talk about it
+    bruno # but let's not talk about it
-		cargo
+    cargo
-		gh-copilot
+    gh-copilot
-		mariadb
+    mariadb
-		nix-eval-jobs
+    nix-eval-jobs
-		nix-fast-build
+    nix-fast-build
-		nix-output-monitor
+    nix-output-monitor
-		nix-update
+    nix-update
-		nixfmt-rfc-style
+    nixfmt-rfc-style
-		nixpkgs-review
+    nixpkgs-review
-		nodejs
+    nodejs
-		process-compose
+    process-compose
-		zed-editor
+    zed-editor
-	];
+  ];
-in with lib; {
+in
-	options.greg.development = mkEnableOption "Setup necessary development packages";
+with lib; {
+  options.greg.development = mkEnableOption "Setup necessary development packages";
 
-	config = mkIf config.greg.development {
+  config = mkIf config.greg.development {
-		home.packages = packages;
+    home.packages = packages;
-	};
+  };
 }

home/modules/gnome.nix

@@ -1,121 +1,122 @@
 { config, pkgs, lib, ... }:
 
 let
-	gv = lib.hm.gvariant;
+  gv = lib.hm.gvariant;
-	cfg = config.greg.gnome;
+  cfg = config.greg.gnome;
 
-in {
+in
-	options.greg.gnome = lib.mkEnableOption "Enable Gnome support and settings";
+{
+  options.greg.gnome = lib.mkEnableOption "Enable Gnome support and settings";
 
-	config = (lib.mkIf cfg {
+  config = (lib.mkIf cfg {
-		programs.gnome-terminal = lib.mkIf ( pkgs.system != "x86_64-darwin") {
+    programs.gnome-terminal = lib.mkIf (pkgs.system != "x86_64-darwin") {
-			enable = true;
+      enable = true;
-			showMenubar = true;
+      showMenubar = true;
-			themeVariant = "dark";
+      themeVariant = "dark";
-			profile."95f3c68e-82f3-4f44-ac85-6e075fed80b0" = {
+      profile."95f3c68e-82f3-4f44-ac85-6e075fed80b0" = {
-				default = true;
+        default = true;
-				customCommand = "xonsh -st best";
+        customCommand = "xonsh -st best";
-				loginShell = true;
+        loginShell = true;
-				scrollbackLines = 65535;
+        scrollbackLines = 65535;
-				transparencyPercent = 50;
+        transparencyPercent = 50;
-				visibleName = "greg";
+        visibleName = "greg";
-			};
+      };
-		};
+    };
 
-		dconf.settings = {
+    dconf.settings = {
-			"org/gnome/Disks" = {
+      "org/gnome/Disks" = {
-				image-dir-uri = "file:///home/greg/Downloads";
+        image-dir-uri = "file:///home/greg/Downloads";
-			};
+      };
-			"org/gnome/desktop/interface" = {
+      "org/gnome/desktop/interface" = {
-				clock-show-weekday = true;
+        clock-show-weekday = true;
-				color-scheme = "default";
+        color-scheme = "default";
-				cursor-size = 24;
+        cursor-size = 24;
-				toolbar-style = "text";
+        toolbar-style = "text";
-			};
+      };
-			"org/gnome/desktop/screensaver" = {
+      "org/gnome/desktop/screensaver" = {
-				lock-delay = "uint32 0";
+        lock-delay = "uint32 0";
-				lock-enabled = false;
+        lock-enabled = false;
-			};
+      };
-			"org/gnome/desktop/wm/keybindings" = {
+      "org/gnome/desktop/wm/keybindings" = {
-				switch-applications = [];
+        switch-applications = [ ];
-				switch-applications-backward = [];
+        switch-applications-backward = [ ];
-				switch-windows = ["<Alt>Tab"];
+        switch-windows = [ "<Alt>Tab" ];
-				switch-windows-backward = [ "<Shift><Alt>Tab" ];
+        switch-windows-backward = [ "<Shift><Alt>Tab" ];
-			};
+      };
-			"org/gnome/desktop/wm/preferences" = {
+      "org/gnome/desktop/wm/preferences" = {
-				button-layout="icon:minimize,maximize,close";
+        button-layout = "icon:minimize,maximize,close";
-			};
+      };
-			"org/gnome/file-roller/listing" = {
+      "org/gnome/file-roller/listing" = {
-				list-mode = "as-folder";
+        list-mode = "as-folder";
-				name-coloumn-width = 302;
+        name-coloumn-width = 302;
-				show-path = true;
+        show-path = true;
-				sort-method = "name";
+        sort-method = "name";
-				sort-type = "ascending";
+        sort-type = "ascending";
-			};
+      };
-			"org/gnome/nautilus/preferences" = {
+      "org/gnome/nautilus/preferences" = {
-				default-folder-viewer = "icon-view";
+        default-folder-viewer = "icon-view";
-				search-filter-time-type = "last_modified";
+        search-filter-time-type = "last_modified";
-				search-view = "list-view";
+        search-view = "list-view";
-			};
+      };
-			"org/gnome/shell" = {
+      "org/gnome/shell" = {
-				enabled-extensions =  [
+        enabled-extensions = [
-					"appindicatorsupport@rgcjonas.gmail.com"
+          "appindicatorsupport@rgcjonas.gmail.com"
-					"Vitals@CoreCoding.com"
+          "Vitals@CoreCoding.com"
-					"window-list@gnome-shell-extensions.gcampax.github.com"
+          "window-list@gnome-shell-extensions.gcampax.github.com"
-					"gsconnect@andyholmes.github.io"
+          "gsconnect@andyholmes.github.io"
-				];
+        ];
-				favorite-apps = [
+        favorite-apps = [
-					"org.gnome.Calendar.desktop"
+          "org.gnome.Calendar.desktop"
-					"org.gnome.Nautilus.desktop"
+          "org.gnome.Nautilus.desktop"
-					"org.gnome.Terminal.desktop"
+          "org.gnome.Terminal.desktop"
-					"firefox.desktop"
+          "firefox.desktop"
-					"vlc.desktop"
+          "vlc.desktop"
-				];
+        ];
-				remember-mount-password = true;
+        remember-mount-password = true;
-			};
+      };
-			"org/gnome/shell/extensions/vitals" = {
+      "org/gnome/shell/extensions/vitals" = {
-				hot-sensors = [
+        hot-sensors = [
-					"_memory_usage_"
+          "_memory_usage_"
-					"_system_load_1m_"
+          "_system_load_1m_"
-					"__network-rx_max__"
+          "__network-rx_max__"
-					"_temperature_k10temp_tccd1_"
+          "_temperature_k10temp_tccd1_"
-					"_temperature_k10temp_tctl_"
+          "_temperature_k10temp_tctl_"
-				];
+        ];
-			};
+      };
-			"org/gnome/shell/overrides" = {
+      "org/gnome/shell/overrides" = {
-				attach-modal-dialogs = true;
+        attach-modal-dialogs = true;
-				dynamic-workspaces = true;
+        dynamic-workspaces = true;
-				edge-tiling = true;
+        edge-tiling = true;
-				focus-change-on-pointer-rest = true;
+        focus-change-on-pointer-rest = true;
-				workspaces-only-on-primary = true;
+        workspaces-only-on-primary = true;
-			};
+      };
-			"org/gnome/shell/weather" = {
+      "org/gnome/shell/weather" = {
-				automation-location = true;
+        automation-location = true;
-				locations = "[<(uint32 2, <('Midlothian / Waxahachie, Mid-Way Regional Airport', 'KJWY', false, [(0.5664611473274288, -1.691437359323684)], @a(dd) [])>)>]";
+        locations = "[<(uint32 2, <('Midlothian / Waxahachie, Mid-Way Regional Airport', 'KJWY', false, [(0.5664611473274288, -1.691437359323684)], @a(dd) [])>)>]";
-			};
+      };
-			"org/gnome/shell/window-switcher" = {
+      "org/gnome/shell/window-switcher" = {
-				app-icon-mode = "both";
+        app-icon-mode = "both";
-				current-workspace-only = true;
+        current-workspace-only = true;
-			};
+      };
-			"org/gtk/settings/file-chooser" = {
+      "org/gtk/settings/file-chooser" = {
-				location-mode = "path-bar";
+        location-mode = "path-bar";
-				show-hidden = false;
+        show-hidden = false;
-				show-size-column = true;
+        show-size-column = true;
-				sort-column = "modified";
+        sort-column = "modified";
-				sort-directories-first = false;
+        sort-directories-first = false;
-				sort-order = "descending";
+        sort-order = "descending";
-			};
+      };
-			"org/virt-manager/virt-manager/confirm" = {
+      "org/virt-manager/virt-manager/confirm" = {
-				delete-storage = true;
+        delete-storage = true;
-				forcepoweroff = false;
+        forcepoweroff = false;
-			};
+      };
-			"org/virt-manager/virt-manager/details" = {
+      "org/virt-manager/virt-manager/details" = {
-				show-toolbar = true;
+        show-toolbar = true;
-			};
+      };
-			"org/virt-manager/virt-manager/connections" = {
+      "org/virt-manager/virt-manager/connections" = {
-				autoconnect = [ "qemu:///session" "qemu:///system" ];
+        autoconnect = [ "qemu:///session" "qemu:///system" ];
-				uris = [ "qemu:///session" "qemu:///system" ];
+        uris = [ "qemu:///session" "qemu:///system" ];
-			};
+      };
-		};
+    };
-	});
+  });
 }

home/modules/gui.nix

@@ -1,120 +1,121 @@
 { config, pkgs, lib, ... }:
 
 let
-	cfg = config.greg.gui;
+  cfg = config.greg.gui;
 
-	excludes = systems: opts: (
+  excludes = systems: opts: (
-		if ( builtins.all (x: pkgs.system != x) systems ) then opts else []
+    if (builtins.all (x: pkgs.system != x) systems) then opts else [ ]
-	);
+  );
 
-	# For now, we ignore this and don't install it
+  # For now, we ignore this and don't install it
-	ffPkgs = pkgs.firefox.override { cfg.enableGnomeExtensions = true; };
+  ffPkgs = pkgs.firefox.override { cfg.enableGnomeExtensions = true; };
 
-	vars = {
+  vars = {
-		XDG_CURRENT_DESKTOP = "GNOME";
+    XDG_CURRENT_DESKTOP = "GNOME";
-	};
+  };
-in {
+in
-	options.greg.gui = lib.mkEnableOption "Enable GUI programs";
+{
+  options.greg.gui = lib.mkEnableOption "Enable GUI programs";
 
-	config = (lib.mkIf cfg {
+  config = (lib.mkIf cfg {
-		# These packages are Linux only
+    # These packages are Linux only
-		home.packages = with pkgs; ( excludes ["x86_64-darwin" "aarch64-darwin"]
+    home.packages = with pkgs; (excludes [ "x86_64-darwin" "aarch64-darwin" ]
-		[
+      [
-			cdrtools
+        cdrtools
-			element-desktop
+        element-desktop
-			freetube
+        freetube
-			qpwgraph
+        qpwgraph
-			vlc
+        vlc
-			x265
+        x265
-		]) ++
+      ]) ++
 
-		# x86_64-linux only
+    # x86_64-linux only
-		( excludes ["x86_64-darwin" "aarch64-darwin" "aarch64-linux"]
+    (excludes [ "x86_64-darwin" "aarch64-darwin" "aarch64-linux" ]
-		[
+      [
-			bitwarden
+        bitwarden
-			discord
+        discord
-			endeavour
+        endeavour
-			gnucash
+        gnucash
-			jellyfin-media-player
+        jellyfin-media-player
-			#logseq
+        #logseq
-			nextcloud-client
+        nextcloud-client
-			slack
+        slack
-		]) ++
+      ]) ++
 
-		# Items that are not supported on ARM/Linux
+    # Items that are not supported on ARM/Linux
-		( excludes ["aarch64-linux"]
+    (excludes [ "aarch64-linux" ]
-		[
+      [
-			onlyoffice-bin
+        onlyoffice-bin
-			synology-drive-client
+        synology-drive-client
-			zoom-us
+        zoom-us
-		]);
+      ]);
 
-		programs.firefox = {
+    programs.firefox = {
-			enable = (! pkgs.stdenv.hostPlatform.isDarwin);
+      enable = (! pkgs.stdenv.hostPlatform.isDarwin);
-			package = ffPkgs;
+      package = ffPkgs;
-			policies = {
+      policies = {
-				DisableAppUpdate = true;
+        DisableAppUpdate = true;
-			};
+      };
-			profiles = {
+      profiles = {
-				default = {
+        default = {
-					bookmarks = import ./gui/bookmarks.nix;
+          bookmarks = import ./gui/bookmarks.nix;
-					id = 0;
+          id = 0;
-					isDefault = true;
+          isDefault = true;
-					search = {
+          search = {
-						default = "DuckDuckGo";
+            default = "DuckDuckGo";
-						force = true;
+            force = true;
-						engines = {
+            engines = {
-							Google.metaData.alias = "@g";
+              Google.metaData.alias = "@g";
-							"Nix Packages" = {
+              "Nix Packages" = {
-								urls = [{
+                urls = [{
-									template = "https://search.nixos.org/packages";
+                  template = "https://search.nixos.org/packages";
-									params = [
+                  params = [
-										{ name = "type"; value = "packages"; }
+                    { name = "type"; value = "packages"; }
-										{ name = "query"; value = "{searchTerms}"; }
+                    { name = "query"; value = "{searchTerms}"; }
-									];
+                  ];
-								}];
+                }];
-								icon = "${pkgs.nixos-icons}/share/icons/hicolor/scalable/apps/nix-snowflake.svg";
+                icon = "${pkgs.nixos-icons}/share/icons/hicolor/scalable/apps/nix-snowflake.svg";
-								definedAliases = [ "@np" ];
+                definedAliases = [ "@np" ];
-							};
+              };
-							"Nix Options" = {
+              "Nix Options" = {
-								urls = [{
+                urls = [{
-									template = "https://search.nixos.org/options";
+                  template = "https://search.nixos.org/options";
-									params = [
+                  params = [
-										{ name = "type"; value = "packages"; }
+                    { name = "type"; value = "packages"; }
-										{ name = "query"; value = "{searchTerms}"; }
+                    { name = "query"; value = "{searchTerms}"; }
-									];
+                  ];
-								}];
+                }];
-								icon = "${pkgs.nixos-icons}/share/icons/hicolor/scalable/apps/nix-snowflake.svg";
+                icon = "${pkgs.nixos-icons}/share/icons/hicolor/scalable/apps/nix-snowflake.svg";
-								definedAliases = [ "@no" ];
+                definedAliases = [ "@no" ];
-							};
+              };
-						};
+            };
-					};
+          };
-					settings = {
+          settings = {
-						"app.update.auto" = false;
+            "app.update.auto" = false;
-						"browser.ctrlTab.sortByRecentlyUsed" = true;
+            "browser.ctrlTab.sortByRecentlyUsed" = true;
-						"browser.startup.page" = 3;
+            "browser.startup.page" = 3;
-						"browser.startup.homepage" = "https://thehellings.com";
+            "browser.startup.homepage" = "https://thehellings.com";
-						"doh-rollout.doorhanger-decision" = "UIDisabled";
+            "doh-rollout.doorhanger-decision" = "UIDisabled";
-						"doh-rollout.doneFirstRun" = true;
+            "doh-rollout.doneFirstRun" = true;
-						"signon.rememberSignons" = false;
+            "signon.rememberSignons" = false;
-					};
+          };
-					extensions = with pkgs.nur.repos.rycee.firefox-addons; [
+          extensions = with pkgs.nur.repos.rycee.firefox-addons; [
-						bitwarden
+            bitwarden
-						gsconnect
+            gsconnect
-						foxyproxy-standard
+            foxyproxy-standard
-						multi-account-containers
+            multi-account-containers
-						octotree
+            octotree
-						okta-browser-plugin
+            okta-browser-plugin
-						refined-github
+            refined-github
-						tree-style-tab
+            tree-style-tab
-						ublock-origin
+            ublock-origin
-					];
+          ];
-				};
+        };
-			};
+      };
-		};
+    };
 
-		# This is supposed to be in support of Firefox, but I dunno...
+    # This is supposed to be in support of Firefox, but I dunno...
-		programs.bash.sessionVariables = vars;
+    programs.bash.sessionVariables = vars;
-		programs.xonsh.sessionVariables = vars;
+    programs.xonsh.sessionVariables = vars;
-	});
+  });
 }

home/modules/gui/bookmarks.nix

@@ -1,137 +1,167 @@
-[ {
+[{
-	name = "Toolbar";
+  name = "Toolbar";
-	toolbar = true;
+  toolbar = true;
-	bookmarks = [ {
+  bookmarks = [{
-		name = "Ansible";
+    name = "Ansible";
-		bookmarks = [ {
+    bookmarks = [{
-			name = "Collection Index";
+      name = "Collection Index";
-			url = "https://docs.ansible.com/ansible/latest/collections/index.html";
+      url = "https://docs.ansible.com/ansible/latest/collections/index.html";
-		} ];
+    }];
-	} {
+  }
-		name = "Church";
+    {
-		bookmarks = [ {
+      name = "Church";
-			name = "DC4K";
+      bookmarks = [{
-			url = "https://www.dc4k.org/leaderzone/articles";
+        name = "DC4K";
-		} ];
+        url = "https://www.dc4k.org/leaderzone/articles";
-	} {
+      }];
-		name = "IVR";
+    }
-		bookmarks = [ {
+    {
-			name = "Dev";
+      name = "IVR";
-			bookmarks = [ {
+      bookmarks = [{
-				name = "Core Survey";
+        name = "Dev";
-				url = "https://webdev5.ivrtechnology.com/coreservices/survey/admin/";
+        bookmarks = [{
-			} {
+          name = "Core Survey";
-				name = "Audio";
+          url = "https://webdev5.ivrtechnology.com/coreservices/survey/admin/";
-				url = "https://apidev1.ivrtechnology.com/coreservices/audio/admin/";
+        }
-			} ];
+          {
-		} {
+            name = "Audio";
-			name = "HC";
+            url = "https://apidev1.ivrtechnology.com/coreservices/audio/admin/";
-			bookmarks = [ {
+          }];
-				name = "Audio";
+      }
-				url = "https://hcweb3.ivrtechnology.com/coreservices/audio/admin/";
+        {
-			} {
+          name = "HC";
-				name = "Survey";
+          bookmarks = [{
-				url = "https://hcweb2.ivrtechnology.com/coreservices/survey/admin/";
+            name = "Audio";
-			} ];
+            url = "https://hcweb3.ivrtechnology.com/coreservices/audio/admin/";
-		} {
+          }
-			name = "PCI";
+            {
-			bookmarks = [ {
+              name = "Survey";
-				name = "Audio";
+              url = "https://hcweb2.ivrtechnology.com/coreservices/survey/admin/";
-				url = "https://pciweb3.ivrtechnology.com/coreservices/audio/admin/";
+            }];
-			} ];
+        }
-		} {
+        {
-			name = "Processes";
+          name = "PCI";
-			bookmarks = [ {
+          bookmarks = [{
-				name = "Change Management";
+            name = "Audio";
-				url = "https://ivrtg.atlassian.net/wiki/spaces/ITS/pages/13094842/Executing+Change+Management";
+            url = "https://pciweb3.ivrtechnology.com/coreservices/audio/admin/";
-			} {
+          }];
-				name = "Okta";
+        }
-				url = "https://engagesmart.okta.com/";
+        {
-			} {
+          name = "Processes";
-				name = "DB Request";
+          bookmarks = [{
-				url = "https://ivrtg.aha.io/develop/features/INFR-1073";
+            name = "Change Management";
-			} ];
+            url = "https://ivrtg.atlassian.net/wiki/spaces/ITS/pages/13094842/Executing+Change+Management";
-		} ];
+          }
-	} {
+            {
-		name = "Katie";
+              name = "Okta";
-		bookmarks = [ {
+              url = "https://engagesmart.okta.com/";
-			name = "Sports Forms";
+            }
-			url = "https://midlothianisd.rankone.com/New/NewStudentList.aspx";
+            {
-		} {
+              name = "DB Request";
-			name = "Skyward";
+              url = "https://ivrtg.aha.io/develop/features/INFR-1073";
-			url = "https://skyward.iscorp.com/MidlothianISDTXStuSTS/Session/Signin?area=Home&controller=Home&action=Index&logoutreason=TimedOut";
+            }];
-		} ];
+        }];
-	} {
+    }
-		name = "Nix";
+    {
-		bookmarks = [ {
+      name = "Katie";
-			name = "Package Versions";
+      bookmarks = [{
-			url = "https://lazamar.co.uk/nix-versions/?channel=nixpkgs-unstable&package=python3";
+        name = "Sports Forms";
-		} {
+        url = "https://midlothianisd.rankone.com/New/NewStudentList.aspx";
-			name = "Channel status";
+      }
-			url = "https://status.nixos.org/";
+        {
-		} {
+          name = "Skyward";
-			name = "Home Manager options";
+          url = "https://skyward.iscorp.com/MidlothianISDTXStuSTS/Session/Signin?area=Home&controller=Home&action=Index&logoutreason=TimedOut";
-			url = "https://nix-community.github.io/home-manager/options.xhtml";
+        }];
-		} {
+    }
-			name = "Flake Parts";
+    {
-			url = "https://community.flake.parts/";
+      name = "Nix";
-		} {
+      bookmarks = [{
-			name = "Language ref";
+        name = "Package Versions";
-			url = "https://nix.dev/manual/nix/latest/language/index.html";
+        url = "https://lazamar.co.uk/nix-versions/?channel=nixpkgs-unstable&package=python3";
-		} {
+      }
-			name = "Builtin functions";
+        {
-			url = "https://nix.dev/manual/nix/latest/language/builtins.html";
+          name = "Channel status";
-		} {
+          url = "https://status.nixos.org/";
-			name = "Nixpkgs functions";
+        }
-			url = "https://ryantm.github.io/nixpkgs/functions/library/strings/#sec-functions-library-strings";
+        {
-		} {
+          name = "Home Manager options";
-			name = "NUR search";
+          url = "https://nix-community.github.io/home-manager/options.xhtml";
-			url = "https://nur.nix-community.org/";
+        }
-		} ];
+        {
-	} {
+          name = "Flake Parts";
-		name = "Rust";
+          url = "https://community.flake.parts/";
-		bookmarks = [ {
+        }
-			name = "Learn Rust";
+        {
-			url = "https://www.rust-lang.org/learn";
+          name = "Language ref";
-		} {
+          url = "https://nix.dev/manual/nix/latest/language/index.html";
-			name = "Rust by Example";
+        }
-			url = "https://doc.rust-lang.org/rust-by-example/hello.html";
+        {
-		} {
+          name = "Builtin functions";
-			name = "Iced";
+          url = "https://nix.dev/manual/nix/latest/language/builtins.html";
-			url = "https://docs.rs/iced/latest/iced/";
+        }
-		} ];
+        {
-	} {
+          name = "Nixpkgs functions";
-		name = "Shopping";
+          url = "https://ryantm.github.io/nixpkgs/functions/library/strings/#sec-functions-library-strings";
-		bookmarks = [ {
+        }
-			name = "Cables";
+        {
-			url = "https://www.pchcables.com";
+          name = "NUR search";
-		} ];
+          url = "https://nur.nix-community.org/";
-	} {
+        }];
-		name = "SubTo";
+    }
-		bookmarks = [ {
+    {
-			name = "Kajabi";
+      name = "Rust";
-			url = "https://www.subtocourse.com/login";
+      bookmarks = [{
-		} {
+        name = "Learn Rust";
-			name = "SubTo Fund";
+        url = "https://www.rust-lang.org/learn";
-			url = "https://frontend.koreconx.com/auth/login";
+      }
-		} {
+        {
-			name = "Creive Title";
+          name = "Rust by Example";
-			url = "https://getcreativetitle.com/";
+          url = "https://doc.rust-lang.org/rust-by-example/hello.html";
-		} {
+        }
-			name = "REI Scripts";
+        {
-			url = "https://reiconveyorbelt.com/no-excuses/";
+          name = "Iced";
-		} ];
+          url = "https://docs.rs/iced/latest/iced/";
-	} {
+        }];
-		name = "Tools";
+    }
-		bookmarks = [ {
+    {
-			name = "Password Hash";
+      name = "Shopping";
-			url = "https://unix4lyfe.org/crypt/";
+      bookmarks = [{
-		} {
+        name = "Cables";
-			name = "Keymap editor";
+        url = "https://www.pchcables.com";
-			url = "https://nickcoutsos.github.io/keymap-editor/";
+      }];
-		} {
+    }
-			name = "Bitcoin dashboard";
+    {
-			url = "http://hosea.home:60845";
+      name = "SubTo";
-		} ];
+      bookmarks = [{
-	} ];
+        name = "Kajabi";
-} ]
+        url = "https://www.subtocourse.com/login";
+      }
+        {
+          name = "SubTo Fund";
+          url = "https://frontend.koreconx.com/auth/login";
+        }
+        {
+          name = "Creive Title";
+          url = "https://getcreativetitle.com/";
+        }
+        {
+          name = "REI Scripts";
+          url = "https://reiconveyorbelt.com/no-excuses/";
+        }];
+    }
+    {
+      name = "Tools";
+      bookmarks = [{
+        name = "Password Hash";
+        url = "https://unix4lyfe.org/crypt/";
+      }
+        {
+          name = "Keymap editor";
+          url = "https://nickcoutsos.github.io/keymap-editor/";
+        }
+        {
+          name = "Bitcoin dashboard";
+          url = "http://hosea.home:60845";
+        }];
+    }];
+}]

home/modules/python.nix

@@ -1,10 +1,10 @@
 { config, pkgs, lib, ... }:
 {
-	options.greg.pypackage = lib.mkOption {
+  options.greg.pypackage = lib.mkOption {
-		description = "Enable Gnome support and settings";
+    description = "Enable Gnome support and settings";
-		type = lib.types.package;
+    type = lib.types.package;
-		default = pkgs.gregpy;
+    default = pkgs.gregpy;
-	};
+  };
 
-	config.home.packages = [ config.greg.pypackage ];
+  config.home.packages = [ config.greg.pypackage ];
 }

home/modules/sway.nix

@@ -1,103 +1,106 @@
 { config, pkgs, lib, ... }:
 
 let
-	cfg = config.greg.sway;
+  cfg = config.greg.sway;
-	file_browser = {
+  file_browser = {
-		pkg = pkgs.krusader;
+    pkg = pkgs.krusader;
-		path = "${pkgs.krusader}/bin/krusader";
+    path = "${pkgs.krusader}/bin/krusader";
-	};
+  };
-	term = "${pkgs.alacritty}/bin/alacritty";
+  term = "${pkgs.alacritty}/bin/alacritty";
-	msg = "${pkgs.sway}/bin/swaymsg";
+  msg = "${pkgs.sway}/bin/swaymsg";
-	sleep = "${pkgs.coreutils}/bin/sleep";
+  sleep = "${pkgs.coreutils}/bin/sleep";
-	workstation1 = pkgs.writeScriptBin "workstation1" (builtins.concatStringsSep "\n" [
+  workstation1 = pkgs.writeScriptBin "workstation1" (builtins.concatStringsSep "\n" [
-		"${msg} \"workspace 1 ; exec ${pkgs.firefox}/bin/firefox ; split horizontal ; exec ${pkgs.element-desktop}/bin/element-desktop \""
+    "${msg} \"workspace 1 ; exec ${pkgs.firefox}/bin/firefox ; split horizontal ; exec ${pkgs.element-desktop}/bin/element-desktop \""
-		"${sleep} 1"
+    "${sleep} 1"
-		"${msg} '[app_id=\"firefox\"]' move left"
+    "${msg} '[app_id=\"firefox\"]' move left"
-		"${msg} '[instance=\"element\"]' \"layout tabbed ; exec ${term} \""
+    "${msg} '[instance=\"element\"]' \"layout tabbed ; exec ${term} \""
-		"${msg} '[app_id=\"firefox\"]' move left"
+    "${msg} '[app_id=\"firefox\"]' move left"
-		"${sleep} 0.3"
+    "${sleep} 0.3"
-		"${msg} '[app_id=\"Alacritty\" workspace=\"1\"]' move right"
+    "${msg} '[app_id=\"Alacritty\" workspace=\"1\"]' move right"
-		"${msg} '[app_id=\"firefox\"]' resize grow width 300 px"
+    "${msg} '[app_id=\"firefox\"]' resize grow width 300 px"
-	]);
+  ]);
-	workstation2 = pkgs.writeScriptBin "workstation2" (builtins.concatStringsSep "\n" [
+  workstation2 = pkgs.writeScriptBin "workstation2" (builtins.concatStringsSep "\n" [
-		"${sleep} 5"
+    "${sleep} 5"
-		"${msg} \"workspace 2 ; exec ${term} ; layout tabbed\""
+    "${msg} \"workspace 2 ; exec ${term} ; layout tabbed\""
-	]);
+  ]);
-in {
+in
-	options.greg.sway = lib.mkEnableOption "Enable Sway support and settings";
+{
+  options.greg.sway = lib.mkEnableOption "Enable Sway support and settings";
 
-	config = (lib.mkIf cfg {
+  config = (lib.mkIf cfg {
-		programs.swaylock.enable = true;
+    programs.swaylock.enable = true;
 
-		wayland.windowManager.sway = let
+    wayland.windowManager.sway =
-			mod = config.wayland.windowManager.sway.config.modifier;
+      let
-		in {
+        mod = config.wayland.windowManager.sway.config.modifier;
-			enable = true;
+      in
-			config = rec {
+      {
-				#fonts.size = 10.0;
+        enable = true;
-				keybindings = lib.mkOptionDefault {
+        config = rec {
-					"Mod4+l" = "exec ${pkgs.swaylock}/bin/swaylock -c 000000";
+          #fonts.size = 10.0;
-					"Mod4+h" = "exec ${pkgs.qpwgraph}/bin/qpwgraph -x /home/greg/sound/headphones.qpwgraph -m";
+          keybindings = lib.mkOptionDefault {
-					"Mod4+m" = "exec ${pkgs.qpwgraph}/bin/qpwgraph -x /home/greg/sound/monitor.qpwgraph -m";
+            "Mod4+l" = "exec ${pkgs.swaylock}/bin/swaylock -c 000000";
-					"Mod4+b" = "exec ${pkgs.qpwgraph}/bin/qpwgraph -x /home/greg/sound/both.qpwgraph -m";
+            "Mod4+h" = "exec ${pkgs.qpwgraph}/bin/qpwgraph -x /home/greg/sound/headphones.qpwgraph -m";
+            "Mod4+m" = "exec ${pkgs.qpwgraph}/bin/qpwgraph -x /home/greg/sound/monitor.qpwgraph -m";
+            "Mod4+b" = "exec ${pkgs.qpwgraph}/bin/qpwgraph -x /home/greg/sound/both.qpwgraph -m";
 
-					"${mod}+Shift+Return" = file_browser.path;
+            "${mod}+Shift+Return" = file_browser.path;
-				};
+          };
-				modifier = "Mod1";
+          modifier = "Mod1";
-				output = {
+          output = {
-					"Samsung Electric Company S24E650 H4ZN600985" = {
+            "Samsung Electric Company S24E650 H4ZN600985" = {
-						mode = "1920x1200";
+              mode = "1920x1200";
-						transform = "90";
+              transform = "90";
-						pos = "0 0";
+              pos = "0 0";
-					};
+            };
-					"ViewSonic Corporation VA2252 Series VMT201800925" = {
+            "ViewSonic Corporation VA2252 Series VMT201800925" = {
-						mode = "1920x1080";
+              mode = "1920x1080";
-						pos = "200 1920";
+              pos = "200 1920";
-					};
+            };
-				};
+          };
-				terminal = term;
+          terminal = term;
-				startup = [
+          startup = [
-					{ command = "${workstation1}/bin/workstation1"; }
+            { command = "${workstation1}/bin/workstation1"; }
-					{ command = "${workstation2}/bin/workstation2"; }
+            { command = "${workstation2}/bin/workstation2"; }
-				];
+          ];
-			};
+        };
-			extraOptions = [
+        extraOptions = [
-				"--unsupported-gpu"
+          "--unsupported-gpu"
-			];
+        ];
-			extraSessionCommands = ''
+        extraSessionCommands = ''
-				export WLR_NO_HARDWARE_CURSORS=1
+          				export WLR_NO_HARDWARE_CURSORS=1
-			'';
+          			'';
-			systemd.enable = true;
+        systemd.enable = true;
-			wrapperFeatures = {
+        wrapperFeatures = {
-				base = true;
+          base = true;
-				gtk = true;
+          gtk = true;
-			};
+        };
-		};
+      };
 
-		home.pointerCursor = {
+    home.pointerCursor = {
-			name = "Adwaita";
+      name = "Adwaita";
-			package = pkgs.gnome.adwaita-icon-theme;
+      package = pkgs.gnome.adwaita-icon-theme;
-			size = 12;
+      size = 12;
-			x11 = {
+      x11 = {
-				enable = true;
+        enable = true;
-				defaultCursor = "Adwaita";
+        defaultCursor = "Adwaita";
-			};
+      };
-		};
+    };
 
-		home.packages = with pkgs; [
+    home.packages = with pkgs; [
-			arj
+      arj
-			dpkg
+      dpkg
-			kate
+      kate
-			kget
+      kget
-			krename
+      krename
-			file_browser.pkg
+      file_browser.pkg
-			p7zip
+      p7zip
-			plocate
+      plocate
-			rpm
+      rpm
-			qpwgraph
+      qpwgraph
-			xorg.xev
+      xorg.xev
-			xorg.xmodmap
+      xorg.xmodmap
-			xxdiff
+      xxdiff
-		];
+    ];
-	});
+  });
 }

home/modules/vscodium.nix

@@ -1,57 +1,58 @@
 { pkgs, config, lib, inputs, ... }:
 
 let
-	cfg = config.greg.vscodium;
+  cfg = config.greg.vscodium;
-in {
+in
-	options.greg.vscodium = lib.mkEnableOption "Enable installation of VSCodium on the host";
+{
+  options.greg.vscodium = lib.mkEnableOption "Enable installation of VSCodium on the host";
 
-	config = lib.mkIf cfg {
+  config = lib.mkIf cfg {
-		home.packages = with pkgs; [
+    home.packages = with pkgs; [
-			buildifier
+      buildifier
-			gopls
+      gopls
-			nixd  # nix language server
+      nixd # nix language server
-		];
+    ];
 
-		# An alternative editor to vim, when I need it for some things
+    # An alternative editor to vim, when I need it for some things
-		programs.vscode = {
+    programs.vscode = {
-			enable = true;
+      enable = true;
-			package = pkgs.vscodium;
+      package = pkgs.vscodium;
-			extensions = with inputs.vsext.extensions."${pkgs.stdenv.system}".vscode-marketplace; [
+      extensions = with inputs.vsext.extensions."${pkgs.stdenv.system}".vscode-marketplace; [
-				arrterian.nix-env-selector
+        arrterian.nix-env-selector
-				asvetliakov.vscode-neovim
+        asvetliakov.vscode-neovim
-				batisteo.vscode-django
+        batisteo.vscode-django
-				bungcip.better-toml
+        bungcip.better-toml
-				donjayamanne.python-environment-manager
+        donjayamanne.python-environment-manager
-				golang.go
+        golang.go
-				kevinrose.vsc-python-indent
+        kevinrose.vsc-python-indent
-				jnoortheen.nix-ide
+        jnoortheen.nix-ide
-				mkhl.direnv
+        mkhl.direnv
-				ms-python.python
+        ms-python.python
-				njpwerner.autodocstring
+        njpwerner.autodocstring
-				rust-lang.rust-analyzer
+        rust-lang.rust-analyzer
-				vscjava.vscode-java-test
+        vscjava.vscode-java-test
-				vscjava.vscode-java-dependency
+        vscjava.vscode-java-dependency
-				vscjava.vscode-java-debug
+        vscjava.vscode-java-debug
-				wholroyd.jinja
+        wholroyd.jinja
-			];
+      ];
-			userSettings = {
+      userSettings = {
-				"direnv.restart.automatic" = true;
+        "direnv.restart.automatic" = true;
-				"direnv.path.executable" = "/home/gregory.hellings/.nix-profile/bin/direnv";
+        "direnv.path.executable" = "/home/gregory.hellings/.nix-profile/bin/direnv";
-				"extensions.autoUpdate" = false;
+        "extensions.autoUpdate" = false;
-				"extensions.experimental.affinity" = {
+        "extensions.experimental.affinity" = {
-					"asvetliakov.vscode-neovim" = 1;
+          "asvetliakov.vscode-neovim" = 1;
-				};
+        };
-				"git.openRepositoryInParentFolders" = "always";
+        "git.openRepositoryInParentFolders" = "always";
-				"search.exclude" = {
+        "search.exclude" = {
-					"**/.tox" = true;
+          "**/.tox" = true;
-				};
+        };
-				"terminal.integrated.defaultProfile.linux" = "tmux";
+        "terminal.integrated.defaultProfile.linux" = "tmux";
-				"vscode-neovim.neovimInitVimPaths.darwin" = "~/.config/nvim/init.lua";
+        "vscode-neovim.neovimInitVimPaths.darwin" = "~/.config/nvim/init.lua";
-				"vscode-neovim.neovimInitVimPaths.linux" = "~/.config/nvim/init.lua";
+        "vscode-neovim.neovimInitVimPaths.linux" = "~/.config/nvim/init.lua";
-				"workbench.settings.applyToAllProfiles" = [
+        "workbench.settings.applyToAllProfiles" = [
-					"direnv.path.executable"
+          "direnv.path.executable"
-				];
+        ];
-			};
+      };
-		};
+    };
-	};
+  };
 }

home/modules/xonsh.nix

@@ -1,94 +1,100 @@
 { config, pkgs, lib, ... }:
 
 let
-	cfg = config.programs.xonsh;
+  cfg = config.programs.xonsh;
 
-in with lib; {
+in
-	options = {
+with lib; {
-		programs.xonsh = {
+  options = {
-			enable = mkEnableOption "Enable the xonsh program";
+    programs.xonsh = {
+      enable = mkEnableOption "Enable the xonsh program";
 
-			sessionVariables = mkOption {
+      sessionVariables = mkOption {
-				type = types.attrs;
+        type = types.attrs;
-				default = {};
+        default = { };
-				example = { XONSH_TRACE_SUBPROC = true; };
+        example = { XONSH_TRACE_SUBPROC = true; };
-				description = ''
+        description = ''
-					Environment variables that will be set for the Xonsh session.
+          					Environment variables that will be set for the Xonsh session.
-				'';
+          				'';
-			};
+      };
 
-			aliases = mkOption {
+      aliases = mkOption {
-				type = types.attrsOf types.str;
+        type = types.attrsOf types.str;
-				default = {};
+        default = { };
-				example = literalExpression ''
+        example = literalExpression ''
-					{
+          					{
-						ll = "ls -l";
+          						ll = "ls -l";
-						la = "ls -a";
+          						la = "ls -a";
-					}
+          					}
-				'';
+          				'';
-				description = ''
+        description = ''
-					An attribute set that maps aliases (the top level attribute names in
+          					An attribute set that maps aliases (the top level attribute names in
-					this option) to command strings or directly to build outputs.
+          					this option) to command strings or directly to build outputs.
-				'';
+          				'';
-			};
+      };
 
-			configHeader = mkOption {
+      configHeader = mkOption {
-				type = types.lines;
+        type = types.lines;
-				default = "";
+        default = "";
-				example = literalExpression ''
+        example = literalExpression ''
-					import os
+          					import os
-					import sys
+          					import sys
-				'';
+          				'';
-				description = "An arbitrary string to put at the top of the config file";
+        description = "An arbitrary string to put at the top of the config file";
-			};
+      };
 
-			configFooter = mkOption {
+      configFooter = mkOption {
-				type = types.lines;
+        type = types.lines;
-				default = "";
+        default = "";
-				example = literalExpression ''
+        example = literalExpression ''
-					def _some_method(args):
+          					def _some_method(args):
-						do_command()
+          						do_command()
-						some_other_thing()
+          						some_other_thing()
-					aliases['some_method'] = _some_method
+          					aliases['some_method'] = _some_method
-				'';
+          				'';
-				description = "An arbitrary string to put at the end of the config file";
+        description = "An arbitrary string to put at the end of the config file";
-			};
+      };
-		};
+    };
-	};
+  };
 
-	config =
+  config =
-	let
+    let
-		shortAliases = concatStringsSep "\n" (
+      shortAliases = concatStringsSep "\n" (
-			mapAttrsToList (k: v: "aliases['${k}']=r'${v}'") cfg.aliases
+        mapAttrsToList (k: v: "aliases['${k}']=r'${v}'") cfg.aliases
-		);
+      );
 
-		listToPythonList = let
+      listToPythonList =
-			listInternals = args:
+        let
-			concatStringsSep "\n" (map (v: "'${v}'") args);
+          listInternals = args:
-		in list: "[${listInternals list}]";
+            concatStringsSep "\n" (map (v: "'${v}'") args);
+        in
+        list: "[${listInternals list}]";
 
-		sessionVars = concatStringsSep "\n" (
+      sessionVars = concatStringsSep "\n" (
-			mapAttrsToList (k: v:
+        mapAttrsToList
-				if builtins.typeOf v == "string" then
+          (k: v:
-					"\$${k} = '${v}'"
+            if builtins.typeOf v == "string" then
-				else if builtins.typeOf v == "list" then
+              "\$${k} = '${v}'"
-					"\$${k} = ${listToPythonList}"
+            else if builtins.typeOf v == "list" then
-				else if builtins.typeOf v == "int" then
+              "\$${k} = ${listToPythonList}"
-					"\$${k} = ${toString v}"
+            else if builtins.typeOf v == "int" then
-				else ""
+              "\$${k} = ${toString v}"
-			) cfg.sessionVariables
+            else ""
-		);
+          )
+          cfg.sessionVariables
+      );
 
-	in mkIf cfg.enable {
+    in
+    mkIf cfg.enable {
 
-		home.file.".xonshrc".text = ''
+      home.file.".xonshrc".text = ''
-${cfg.configHeader}
+        ${cfg.configHeader}
 
-${sessionVars}
+        ${sessionVars}
 
-${shortAliases}
+        ${shortAliases}
 
-${cfg.configFooter}
+        ${cfg.configFooter}
-'';
+      '';
-	};
+    };
 }

hosts/default.nix

@@ -1,65 +1,68 @@
 { inputs, overlays, ... }:
 let
-	wsl = args: (unstable (args // { extraMods = [ inputs.wsl.nixosModules.wsl ]; }));
+  wsl = args: (unstable (args // { extraMods = [ inputs.wsl.nixosModules.wsl ]; }));
-	unstable = args: (machine (args // {
+  unstable = args: (machine (args // {
-		channel = inputs.nixunstable;
+    channel = inputs.nixunstable;
-		hm = inputs.hmunstable;
+    hm = inputs.hmunstable;
-		nixvim = inputs.nixvimunstable;
+    nixvim = inputs.nixvimunstable;
-	}));
+  }));
-	machine = {
+  machine =
-		channel ? inputs.nixstable,
+    { channel ? inputs.nixstable
-		extraMods ? [],
+    , extraMods ? [ ]
-		name,
+    , name
-		system ? "x86_64-linux",
+    , system ? "x86_64-linux"
-		hm ? inputs.hm,
+    , hm ? inputs.hm
-		nixvim ? inputs.nixvimstable,
+    , nixvim ? inputs.nixvimstable
-	}:
+    ,
-	let
+    }:
-		nixpkgs = import channel {
+    let
-			inherit system;
+      nixpkgs = import channel {
-		};
+        inherit system;
-		# Use this to include modules directly from a repo
+      };
-		nurNoPkg = import inputs.nurpkgs {
+      # Use this to include modules directly from a repo
-			nurpkgs = nixpkgs;
+      nurNoPkg = import inputs.nurpkgs {
-		};
+        nurpkgs = nixpkgs;
-	in channel.lib.nixosSystem {
+      };
-		inherit system;
+    in
-		specialArgs = { inherit nixpkgs inputs overlays; };
+    channel.lib.nixosSystem {
-		modules = [
+      inherit system;
-			{
+      specialArgs = { inherit nixpkgs inputs overlays; };
-				nixpkgs.overlays = overlays;
+      modules = [
-				home-manager = {
+        {
-					useGlobalPkgs = true;
+          nixpkgs.overlays = overlays;
-					useUserPackages = true;
+          home-manager = {
-					users.greg = import ../home/home.nix;
+            useGlobalPkgs = true;
-					extraSpecialArgs = {
+            useUserPackages = true;
-						inherit inputs overlays nixvim;
+            users.greg = import ../home/home.nix;
-						home = "/home/greg";
+            extraSpecialArgs = {
-						host = name;
+              inherit inputs overlays nixvim;
-					};
+              home = "/home/greg";
-					backupFileExtension = "bkp";
+              host = name;
-				};
+            };
-			}
+            backupFileExtension = "bkp";
-			inputs.agenix.nixosModules.default
+          };
-			hm.nixosModules.home-manager
+        }
-			inputs.self.modules.nixosModule
+        inputs.agenix.nixosModules.default
-			inputs.nurpkgs.nixosModules.nur
+        hm.nixosModules.home-manager
-			./${name}
+        inputs.self.modules.nixosModule
-		] ++ extraMods;
+        inputs.nurpkgs.nixosModules.nur
-	};
+        ./${name}
-in {
+      ] ++ extraMods;
-	genesis = machine { name = "genesis"; };
+    };
-	exodus = unstable { name = "exodus"; };
+in
-	jude = unstable { name = "jude"; };
+{
-	icdm-root = unstable { name = "icdm-root"; };
+  genesis = machine { name = "genesis"; };
-	linode = machine { name = "linode"; };
+  exodus = unstable { name = "exodus"; };
-	hosea = unstable { name = "hosea"; };
+  jude = unstable { name = "jude"; };
-	jeremiah = unstable { name = "jeremiah"; };
+  icdm-root = unstable { name = "icdm-root"; };
-	myself = unstable { name = "myself"; };
+  linode = machine { name = "linode"; };
-	iso = machine { name = "iso"; };
+  hosea = unstable { name = "hosea"; };
-	iso-beta = unstable { name = "iso"; };
+  jeremiah = unstable { name = "jeremiah"; };
-	# nix build '.#nixosConfigurations.wsl.config.system.build.installer'
+  myself = unstable { name = "myself"; };
-	nixos = wsl { name = "wsl"; system = "aarch64-linux"; };
+  iso = machine { name = "iso"; };
-	# nix build '.#nixosConfigurations.wsl-aarch.config.system.build.installer'
+  iso-beta = unstable { name = "iso"; };
-	nixos-arm = wsl { name = "wsl"; system = "aarch64-linux"; };
+  # nix build '.#nixosConfigurations.wsl.config.system.build.installer'
+  nixos = wsl { name = "wsl"; system = "aarch64-linux"; };
+  # nix build '.#nixosConfigurations.wsl-aarch.config.system.build.installer'
+  nixos-arm = wsl { name = "wsl"; system = "aarch64-linux"; };
 }

hosts/exodus/default.nix

@@ -1,24 +1,24 @@
 { pkgs, config, ... }:
 
 {
-	imports = [
+  imports = [
-		./hardware-configuration.nix
+    ./hardware-configuration.nix
-	];
+  ];
 
-	boot.loader = {
+  boot.loader = {
-		systemd-boot.enable = true;
+    systemd-boot.enable = true;
-		efi.canTouchEfiVariables = true;
+    efi.canTouchEfiVariables = true;
-	};
+  };
 
-	networking.hostName = "exodus";
+  networking.hostName = "exodus";
-	greg = {
+  greg = {
-		home = true;
+    home = true;
-		gnome.enable = true;
+    gnome.enable = true;
-		print.enable = true;
+    print.enable = true;
-		tailscale.enable = true;
+    tailscale.enable = true;
-		vmdev = {
+    vmdev = {
-			enable = true;
+      enable = true;
-			system = "intel";
+      system = "intel";
-		};
+    };
-	};
+  };
 }

hosts/exodus/hardware-configuration.nix

@@ -5,7 +5,8 @@
 
 {
   imports =
-    [ (modulesPath + "/installer/scan/not-detected.nix")
+    [
+      (modulesPath + "/installer/scan/not-detected.nix")
     ];
 
   boot.initrd.availableKernelModules = [ "xhci_pci" "thunderbolt" "nvme" "uas" "sd_mod" ];
@@ -14,13 +15,15 @@
   boot.extraModulePackages = [ ];
 
   fileSystems."/" =
-    { device = "/dev/disk/by-uuid/607b933f-2967-4652-b478-4d8e9aa38a0d";
+    {
+      device = "/dev/disk/by-uuid/607b933f-2967-4652-b478-4d8e9aa38a0d";
       fsType = "btrfs";
       options = [ "subvol=@" ];
     };
 
   fileSystems."/boot" =
-    { device = "/dev/disk/by-uuid/B31C-C1F4";
+    {
+      device = "/dev/disk/by-uuid/B31C-C1F4";
       fsType = "vfat";
     };
 

hosts/genesis/acme.nix

@@ -1,62 +1,63 @@
 { pkgs, config, lib, ... }:
 
 let
-	address = (builtins.elemAt config.networking.interfaces.ens18.ipv4.addresses 0).address;
+  address = (builtins.elemAt config.networking.interfaces.ens18.ipv4.addresses 0).address;
-	root_ca = pkgs.writeText "root_ca.crt" (builtins.readFile ../../ca/root_ca.crt);
+  root_ca = pkgs.writeText "root_ca.crt" (builtins.readFile ../../ca/root_ca.crt);
-	intermediate_ca = pkgs.writeText "intermediate_ca.crt" (builtins.readFile ../../ca/intermediate_ca.crt);
+  intermediate_ca = pkgs.writeText "intermediate_ca.crt" (builtins.readFile ../../ca/intermediate_ca.crt);
-in {
+in
-	age.secrets.acme_password = {
+{
-		file = ../../secrets/acme_password.age;
+  age.secrets.acme_password = {
-	};
+    file = ../../secrets/acme_password.age;
-	age.secrets.intermediate_ca_key = {
+  };
-		file = ../../secrets/ca/intermediate_key.age;
+  age.secrets.intermediate_ca_key = {
-	};
+    file = ../../secrets/ca/intermediate_key.age;
-	age.secrets.root_ca_key.file = ../../secrets/ca/root_key.age;
+  };
-	systemd.services.step-ca.serviceConfig.Environment = lib.mkForce ["STEPDEBUG=1" "HOME=%S/step-ca"];
+  age.secrets.root_ca_key.file = ../../secrets/ca/root_key.age;
-	services.step-ca = {
+  systemd.services.step-ca.serviceConfig.Environment = lib.mkForce [ "STEPDEBUG=1" "HOME=%S/step-ca" ];
-		inherit address;
+  services.step-ca = {
-		enable = false;
+    inherit address;
-		intermediatePasswordFile = config.age.secrets.acme_password.path;
+    enable = false;
-		openFirewall = true;
+    intermediatePasswordFile = config.age.secrets.acme_password.path;
-		port = 8443;
+    openFirewall = true;
-		settings = {
+    port = 8443;
-			root = root_ca;
+    settings = {
-			federatedRoots = null;
+      root = root_ca;
-			cert = intermediate_ca;
+      federatedRoots = null;
-			key = config.age.secrets.intermediate_ca_key.path;
+      cert = intermediate_ca;
-			dnsNames = [
+      key = config.age.secrets.intermediate_ca_key.path;
-				"10.42.1.5"
+      dnsNames = [
-				"acme.thehellings.lan"
+        "10.42.1.5"
-			];
+        "acme.thehellings.lan"
-			logger.format = "text";
+      ];
-			db = {
+      logger.format = "text";
-				type = "badgerv2";
+      db = {
-				dataSource = "/var/lib/step-ca/db";
+        type = "badgerv2";
-				badgerFileLoadingMode = "";
+        dataSource = "/var/lib/step-ca/db";
-			};
+        badgerFileLoadingMode = "";
-			authority.provisioners = [ {
+      };
-				type = "JWK";
+      authority.provisioners = [{
-				name = "greg@thehellings.com";
+        type = "JWK";
-				key = {
+        name = "greg@thehellings.com";
-					use = "sig";
+        key = {
-					kty = "EC";
+          use = "sig";
-					kid = "1GOpOttYLZtx7XiG79ZycbGcG4ptL0czfohK35SZOEI";
+          kty = "EC";
-					crv = "P-256";
+          kid = "1GOpOttYLZtx7XiG79ZycbGcG4ptL0czfohK35SZOEI";
-					alg = "ES256";
+          crv = "P-256";
-					x = "YEWVj5CCoqWQXWqmL0UuORlFY9IEOLcg1jpG1o-wGx4";
+          alg = "ES256";
-					y = "MEpqnJp60VV-SpFtb6m8U-VAYut7R_PKFm07xl7MjBk";
+          x = "YEWVj5CCoqWQXWqmL0UuORlFY9IEOLcg1jpG1o-wGx4";
-				};
+          y = "MEpqnJp60VV-SpFtb6m8U-VAYut7R_PKFm07xl7MjBk";
-				encryptedKey = "eyJhbGciOiJQQkVTMi1IUzI1NitBMTI4S1ciLCJjdHkiOiJqd2sranNvbiIsImVuYyI6IkEyNTZHQ00iLCJwMmMiOjYwMDAwMCwicDJzIjoieWdfb0lfbWgwbHhPRXdjUTBsd0FnUSJ9.ivdQUFEhs2U8PUBYr8AhQl3hHdb4spF4jvXgqY_hiVgpjB-z3Nn9Uw.u7vrNht_3WD1G97q.mbydlpAQxjtKLkOmmDOUczqscRDPqrUyoPJ1uqXcJDH3vs4KiYlrKRcFLjPy9sWzEL1iIrqjwf3U-3AAx1KNAg7frs2D__MGfOO-U5SdQDVJVAND7KpWOJGJVSb0xioCA6-8ldlP_REqu4ENmkkdw0_6Is2b0p7ZFKqke_fqOOs7osqFAfbMb_WzEWrACLn5A5-Teh2rpEgR-z9zipN6MSEqE6VIQ2BXuv70aHWhslNe1MK1OgTYm9CqA47EMYvQ7HQLPDZAbP56WK84yJLktoXMmnkaKeTtvER0dh4ufyjJHBhecnEranbR5rHc_jV8_qvyWhlqbCrOU_8bWrk.a9SH_q3GKIUsOUSRWkDxQg";
+        };
-			} ];
+        encryptedKey = "eyJhbGciOiJQQkVTMi1IUzI1NitBMTI4S1ciLCJjdHkiOiJqd2sranNvbiIsImVuYyI6IkEyNTZHQ00iLCJwMmMiOjYwMDAwMCwicDJzIjoieWdfb0lfbWgwbHhPRXdjUTBsd0FnUSJ9.ivdQUFEhs2U8PUBYr8AhQl3hHdb4spF4jvXgqY_hiVgpjB-z3Nn9Uw.u7vrNht_3WD1G97q.mbydlpAQxjtKLkOmmDOUczqscRDPqrUyoPJ1uqXcJDH3vs4KiYlrKRcFLjPy9sWzEL1iIrqjwf3U-3AAx1KNAg7frs2D__MGfOO-U5SdQDVJVAND7KpWOJGJVSb0xioCA6-8ldlP_REqu4ENmkkdw0_6Is2b0p7ZFKqke_fqOOs7osqFAfbMb_WzEWrACLn5A5-Teh2rpEgR-z9zipN6MSEqE6VIQ2BXuv70aHWhslNe1MK1OgTYm9CqA47EMYvQ7HQLPDZAbP56WK84yJLktoXMmnkaKeTtvER0dh4ufyjJHBhecnEranbR5rHc_jV8_qvyWhlqbCrOU_8bWrk.a9SH_q3GKIUsOUSRWkDxQg";
-			tls = {
+      }];
-				cipherSuites = [
+      tls = {
-					"TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256"
+        cipherSuites = [
-					"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256"
+          "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256"
-				];
+          "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256"
-				minVersion = 1.2;
+        ];
-				maxVersion = 1.3;
+        minVersion = 1.2;
-				renegotiation = false;
+        maxVersion = 1.3;
-			};
+        renegotiation = false;
-		};
+      };
-	};
+    };
+  };
 }

hosts/genesis/default.nix

@@ -5,43 +5,43 @@
 { config, pkgs, ... }:
 
 {
-	imports = [
+  imports = [
-		# Include the results of the hardware scan.
+    # Include the results of the hardware scan.
-		./acme.nix
+    ./acme.nix
-		./hardware-configuration.nix
+    ./hardware-configuration.nix
-		./home-assistant.nix
+    ./home-assistant.nix
-		./networking.nix
+    ./networking.nix
-	];
+  ];
 
-	greg.home = true;
+  greg.home = true;
-	greg.gnome.enable = false;
+  greg.gnome.enable = false;
 
-	# Bootloader.
+  # Bootloader.
-	boot.loader.grub = {
+  boot.loader.grub = {
-		enable = true;
+    enable = true;
-		device = "/dev/vda";
+    device = "/dev/vda";
-		useOSProber = true;
+    useOSProber = true;
-	};
+  };
 
-	#boot.loader = {
+  #boot.loader = {
-	#	systemd-boot.enable = true;
+  #	systemd-boot.enable = true;
-	#	efi = {
+  #	efi = {
-	#		canTouchEfiVariables = true;
+  #		canTouchEfiVariables = true;
-	#		efiSysMountPoint = "/boot/efi";
+  #		efiSysMountPoint = "/boot/efi";
-	#	};
+  #	};
-	#};
+  #};
 
-	networking.hostName = "genesis"; # Define your hostname.
+  networking.hostName = "genesis"; # Define your hostname.
-	environment.systemPackages = with pkgs; [
+  environment.systemPackages = with pkgs; [
-		awscli2
+    awscli2
-		create_ssl
+    create_ssl
-		step-ca
+    step-ca
-	];
+  ];
 
-	virtualisation.oci-containers.containers.speedtest = {
+  virtualisation.oci-containers.containers.speedtest = {
-		image = "ghcr.io/librespeed/speedtest";
+    image = "ghcr.io/librespeed/speedtest";
-		hostname = "speedtest";
+    hostname = "speedtest";
-		ports = [ "19472:80" ];
+    ports = [ "19472:80" ];
-	};
+  };
-	greg.proxies."speedtest.thehellings.lan".target = "http://localhost:19472";
+  greg.proxies."speedtest.thehellings.lan".target = "http://localhost:19472";
 }

hosts/genesis/hardware-configuration.nix

@@ -5,7 +5,8 @@
 
 {
   imports =
-    [ (modulesPath + "/profiles/qemu-guest.nix")
+    [
+      (modulesPath + "/profiles/qemu-guest.nix")
     ];
 
   boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "sr_mod" "virtio_blk" ];
@@ -14,13 +15,13 @@
   boot.extraModulePackages = [ ];
 
   fileSystems."/" =
-    { device = "/dev/disk/by-uuid/a13f941e-4985-47ab-a8c6-374a627c5ce1";
+    {
+      device = "/dev/disk/by-uuid/a13f941e-4985-47ab-a8c6-374a627c5ce1";
       fsType = "ext4";
     };
 
   swapDevices =
-    [ { device = "/dev/disk/by-uuid/ac4557de-1ad5-4d3c-b9f4-5ec50dbf76f1"; }
+    [{ device = "/dev/disk/by-uuid/ac4557de-1ad5-4d3c-b9f4-5ec50dbf76f1"; }];
-    ];
 
   # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
   # (the default) this is the recommended approach. When using systemd-networkd it's

hosts/genesis/home-assistant.nix

@@ -1,135 +1,136 @@
 { config, pkgs, ... }:
 
 let
-	service_list = [ "podman-home-assistant.service" ];
+  service_list = [ "podman-home-assistant.service" ];
 in
 {
-	virtualisation.podman.enable = true;
+  virtualisation.podman.enable = true;
 
-	services.home-assistant = {
+  services.home-assistant = {
-		enable = true;
+    enable = true;
-		configDir = "/var/lib/hass";
+    configDir = "/var/lib/hass";
-		extraComponents = [
+    extraComponents = [
-			"accuweather"
+      "accuweather"
-			"calendar"
+      "calendar"
-			"cast"
+      "cast"
-			"eufy"
+      "eufy"
-			"lovelace"
+      "lovelace"
-			"nextcloud"
+      "nextcloud"
-			"ping"
+      "ping"
-			"piper"
+      "piper"
-			"radio_browser"
+      "radio_browser"
-			"rainbird"
+      "rainbird"
-			"roborock"
+      "roborock"
-			"smart_meter_texas"
+      "smart_meter_texas"
-			"speedtestdotnet"
+      "speedtestdotnet"
-			"solaredge"
+      "solaredge"
-			"whisper"
+      "whisper"
-			"wiz"
+      "wiz"
-			"wyoming"
+      "wyoming"
-			"zwave_js"
+      "zwave_js"
-		];
+    ];
-		customComponents = with pkgs.home-assistant-custom-components; [
+    customComponents = with pkgs.home-assistant-custom-components; [
-			smartthinq-sensors
+      smartthinq-sensors
-		];
+    ];
 
-		config = {
+    config = {
-			default_config = {};
+      default_config = { };
-			tts = [ { platform = "google_translate"; } ];
+      tts = [{ platform = "google_translate"; }];
-			http = {
+      http = {
-				use_x_forwarded_for = true;
+        use_x_forwarded_for = true;
-				trusted_proxies = [ "127.0.0.1" "::1" ];
+        trusted_proxies = [ "127.0.0.1" "::1" ];
-				server_host = "127.0.0.1";
+        server_host = "127.0.0.1";
-			};
+      };
-			#"automation manual" = *nix config here* and so on
+      #"automation manual" = *nix config here* and so on
-			"automation ui" = "!include automations.yaml";
+      "automation ui" = "!include automations.yaml";
-			"script ui" = "!include scripts.yaml";
+      "script ui" = "!include scripts.yaml";
-			"scene ui" = "!include scenes.yaml";
+      "scene ui" = "!include scenes.yaml";
-		};
+    };
-	};
+  };
 
-	# Helps with Voice stuff for Home Assistant
+  # Helps with Voice stuff for Home Assistant
-	services.wyoming = {
+  services.wyoming = {
-		faster-whisper.servers = {
+    faster-whisper.servers = {
-			greg = {
+      greg = {
-				enable = true;
+        enable = true;
-				beamSize = 1; # wut?
+        beamSize = 1; # wut?
-				device = "auto"; # Could be CPU or CUDA
+        device = "auto"; # Could be CPU or CUDA
-				language = "en";
+        language = "en";
-				model = "base-int8";
+        model = "base-int8";
-				uri = "tcp://0.0.0.0:13415";
+        uri = "tcp://0.0.0.0:13415";
-			};
+      };
-		};
+    };
-		piper.servers.greg = {
+    piper.servers.greg = {
-			enable = true;
+      enable = true;
-			uri = "tcp://0.0.0.0:13416";
+      uri = "tcp://0.0.0.0:13416";
-			voice = "en_US-amy-medium";
+      voice = "en_US-amy-medium";
-		};
+    };
-	};
+  };
 
-	# Although NixOS has a package for Home Assistant, it is not kept as up to date as the container and the upstream
+  # Although NixOS has a package for Home Assistant, it is not kept as up to date as the container and the upstream
-	# is very vocal about only supporting their own container or the HAOS deployments. So we deploy the container here
+  # is very vocal about only supporting their own container or the HAOS deployments. So we deploy the container here
-	# and avoid any potential messes from that
+  # and avoid any potential messes from that
-	virtualisation.oci-containers = {
+  virtualisation.oci-containers = {
-		backend = "podman";
+    backend = "podman";
 
-		# I have ZWave devices. The easiest way to connect to them is the zwavejs2mqtt service running, so we spin up
+    # I have ZWave devices. The easiest way to connect to them is the zwavejs2mqtt service running, so we spin up
-		# its container and map the ZWave device into it
+    # its container and map the ZWave device into it
-		containers.zwave = {
+    containers.zwave = {
-			autoStart = false;  # We will try to start it with udev.extraRules listed below, as this option starts it too quickly
+      autoStart = false; # We will try to start it with udev.extraRules listed below, as this option starts it too quickly
-			image = "zwavejs/zwave-js-ui:latest";
+      image = "zwavejs/zwave-js-ui:latest";
-			ports = [ "8091:8091" "3000:3000" ];
+      ports = [ "8091:8091" "3000:3000" ];
-			volumes = [ "/var/lib/zwave:/usr/src/app/store" ];
+      volumes = [ "/var/lib/zwave:/usr/src/app/store" ];
-			extraOptions = [
+      extraOptions = [
-				"--device" "/dev/serial/by-id/usb-0658_0200-if00:/dev/zwave"
+        "--device"
-				"--pull=newer"
+        "/dev/serial/by-id/usb-0658_0200-if00:/dev/zwave"
-			];
+        "--pull=newer"
-			environment = {
+      ];
-				TZ = "America/Chicago";
+      environment = {
-				CONSOLE_OUTPUT = "true";
+        TZ = "America/Chicago";
-			};
+        CONSOLE_OUTPUT = "true";
-		};
+      };
-	};
+    };
+  };
 
-	# Both of the above container need storage for their configuration and devices, but it is not created correctly by
+  # Both of the above container need storage for their configuration and devices, but it is not created correctly by
-	# the container. So we add the creation of /var/lib/{zwave,hass} to the systemd Unit files
+  # the container. So we add the creation of /var/lib/{zwave,hass} to the systemd Unit files
-	systemd.services = {
+  systemd.services = {
-		"podman-zwave" = {
+    "podman-zwave" = {
-			after = [ "sys-devices-pci0000:00-0000:00:1e.0-0000:02:1b.0-usb2-2\\x2d1-2\\x2d1:1.0-tty-ttyACM0.device" ];
+      after = [ "sys-devices-pci0000:00-0000:00:1e.0-0000:02:1b.0-usb2-2\\x2d1-2\\x2d1:1.0-tty-ttyACM0.device" ];
-			wantedBy = [ "sys-devices-pci0000:00-0000:00:1e.0-0000:02:1b.0-usb2-2\\x2d1-2\\x2d1:1.0-tty-ttyACM0.device" ];
+      wantedBy = [ "sys-devices-pci0000:00-0000:00:1e.0-0000:02:1b.0-usb2-2\\x2d1-2\\x2d1:1.0-tty-ttyACM0.device" ];
-			serviceConfig = {
+      serviceConfig = {
-				StateDirectory = "zwave";
+        StateDirectory = "zwave";
-				StateDirectoryMode = pkgs.lib.mkForce "0777";
+        StateDirectoryMode = pkgs.lib.mkForce "0777";
-			};
+      };
-		};
+    };
-	};
+  };
 
-	services.udev.extraRules = ''
+  services.udev.extraRules = ''
-	SUBSYSTEM=="tty", KERNEL=="ttyACM0", TAG+="systemd"
+    	SUBSYSTEM=="tty", KERNEL=="ttyACM0", TAG+="systemd"
-	'';
+    	'';
 
 
-	greg.proxies = {
+  greg.proxies = {
-		"smart.home".target = "http://127.0.0.1:8123/";
+    "smart.home".target = "http://127.0.0.1:8123/";
-		"smart.thehellings.lan".target = "http://127.0.0.1:8123/";
+    "smart.thehellings.lan".target = "http://127.0.0.1:8123/";
-		"zwave.home".target = "http://127.0.0.1:8091/";
+    "zwave.home".target = "http://127.0.0.1:8091/";
-	};
+  };
 
-	# Ensure that both ports are up and running. We keep 8123 directly open because we are on the LAN and sometimes want to connect
+  # Ensure that both ports are up and running. We keep 8123 directly open because we are on the LAN and sometimes want to connect
-	# directly for troubleshooting Nginx configuration
+  # directly for troubleshooting Nginx configuration
-	networking.firewall = {
+  networking.firewall = {
-		allowedTCPPorts = [ 80 443 ];
+    allowedTCPPorts = [ 80 443 ];
-	};
+  };
 
-	greg.backup.jobs.zwave = {
+  greg.backup.jobs.zwave = {
-		src = "/var/lib/zwave";
+    src = "/var/lib/zwave";
-		dest = "zwave";
+    dest = "zwave";
-		id = "zwave-asdf";
+    id = "zwave-asdf";
-	};
+  };
 
-	greg.backup.jobs.hass-backup = {
+  greg.backup.jobs.hass-backup = {
-		src = "/var/lib/hass";
+    src = "/var/lib/hass";
-		dest = "hass";
+    dest = "hass";
-		id = "hass-asdf";
+    id = "hass-asdf";
-	};
+  };
 }

hosts/genesis/networking.nix

@@ -1,191 +1,192 @@
 { pkgs, config, ... }:
 let
-	lan = "ens18";
+  lan = "ens18";
-	lanIP = "10.42.1.5";
+  lanIP = "10.42.1.5";
-	iot = "ens19";
+  iot = "ens19";
-	iotIP = "192.168.66.250";
+  iotIP = "192.168.66.250";
-	routerIP = "10.42.1.2";
+  routerIP = "10.42.1.2";
-	extraHosts = builtins.readFile ./net/hosts;
+  extraHosts = builtins.readFile ./net/hosts;
 
-	adblockUpdate = pkgs.writeShellScriptBin "adblockUpdate" (builtins.readFile ./adblockUpdate.sh);
+  adblockUpdate = pkgs.writeShellScriptBin "adblockUpdate" (builtins.readFile ./adblockUpdate.sh);
-	proxyPort = 3128;
+  proxyPort = 3128;
-	dnsPort = 53;
+  dnsPort = 53;
-	dhcpPort = 67;
+  dhcpPort = 67;
-	dnsServers = [
+  dnsServers = [
-		"9.9.9.9"  # Quad 9
+    "9.9.9.9" # Quad 9
-		"1.1.1.1"  # Cloudflare
+    "1.1.1.1" # Cloudflare
-		"1.0.0.1"  # Cloudflare
+    "1.0.0.1" # Cloudflare
-		"149.112.112.112"  # Quad 9
+    "149.112.112.112" # Quad 9
-	];
+  ];
-in {
+in
-	greg.tailscale.enable = true;
+{
+  greg.tailscale.enable = true;
 
-	# Really, why do I still have to force-disable this crap?
+  # Really, why do I still have to force-disable this crap?
-	boot.kernel.sysctl = {
+  boot.kernel.sysctl = {
-		"net.ipv6.conf.${lan}.disable_ipv6" = true;
+    "net.ipv6.conf.${lan}.disable_ipv6" = true;
-		"net.ipv6.conf.${iot}.disable_ipv6" = true;
+    "net.ipv6.conf.${iot}.disable_ipv6" = true;
-		"net.ipv6.conf.lo.disable_ipv6" = true;
+    "net.ipv6.conf.lo.disable_ipv6" = true;
-	};
+  };
 
-	networking = {
+  networking = {
-		enableIPv6 = false;
+    enableIPv6 = false;
-		networkmanager.enable = pkgs.lib.mkForce false;
+    networkmanager.enable = pkgs.lib.mkForce false;
-		defaultGateway = routerIP;
+    defaultGateway = routerIP;
-		nameservers = dnsServers;
+    nameservers = dnsServers;
-		interfaces = {
+    interfaces = {
-			# This is our LAN port
+      # This is our LAN port
-			"${lan}" = {
+      "${lan}" = {
-				useDHCP = false;
+        useDHCP = false;
-				ipv4.addresses = [ {
+        ipv4.addresses = [{
-					address = "${lanIP}";
+          address = "${lanIP}";
-					prefixLength = 16;
+          prefixLength = 16;
-				} ];
+        }];
-			};
+      };
 
-			"${iot}" = {
+      "${iot}" = {
-				useDHCP = false;
+        useDHCP = false;
-				ipv4.addresses = [ {
+        ipv4.addresses = [{
-					address = "${iotIP}";
+          address = "${iotIP}";
-					prefixLength = 24;
+          prefixLength = 24;
-				} ];
+        }];
-			};
+      };
-		};
+    };
-		firewall = {
+    firewall = {
-			enable = false;
+      enable = false;
-			allowedUDPPorts = [
+      allowedUDPPorts = [
-				dhcpPort
+        dhcpPort
-				dnsPort
+        dnsPort
-				1900  # Jellyfin auto-discovery
+        1900 # Jellyfin auto-discovery
-				7359  # Jellyfin auto-discovery
+        7359 # Jellyfin auto-discovery
-			];
+      ];
-			allowedTCPPorts = [
+      allowedTCPPorts = [
-				dnsPort
+        dnsPort
-				proxyPort
+        proxyPort
-				80
+        80
-			];
+      ];
-		};
+    };
-		nftables.enable = false;
+    nftables.enable = false;
-	};
+  };
 
-	environment.etc."hosts.d/local".text = extraHosts;
+  environment.etc."hosts.d/local".text = extraHosts;
 
-	fileSystems = {
+  fileSystems = {
-		"/media" = {
+    "/media" = {
-			device = "10.42.1.4:/volume1/video/";
+      device = "10.42.1.4:/volume1/video/";
-			fsType = "nfs";
+      fsType = "nfs";
-			options = [ "ro" ];
+      options = [ "ro" ];
-		};
+    };
-	};
+  };
 
-	services = {
+  services = {
-		# Video services
+    # Video services
-		jellyfin = {
+    jellyfin = {
-			enable = true;
+      enable = true;
-			openFirewall = true;
+      openFirewall = true;
-		};
+    };
 
-		#########
+    #########
-		# Blind service proxy behind the walls of the VPN
+    # Blind service proxy behind the walls of the VPN
-		########
+    ########
-		_3proxy = {
+    _3proxy = {
-			enable = true;
+      enable = true;
-			services = [ {
+      services = [{
-				type = "socks";
+        type = "socks";
-				auth = [ "strong" ];
+        auth = [ "strong" ];
-				bindPort = proxyPort;
+        bindPort = proxyPort;
-				acl = [ {
+        acl = [{
-					rule = "allow";
+          rule = "allow";
-					users = [ "greg" ];
+          users = [ "greg" ];
-				} ];
+        }];
-			} ];
+      }];
-			#usersFile = "/run/agenix/3proxy";
+      #usersFile = "/run/agenix/3proxy";
-			denyPrivate = false;
+      denyPrivate = false;
-		};
+    };
 
-		#########
+    #########
-		# dnsmasq config
+    # dnsmasq config
-		########
+    ########
-		dnsmasq = {
+    dnsmasq = {
-			enable = true;
+      enable = true;
-			settings = {
+      settings = {
-				domain = "thehellings.lan";
+        domain = "thehellings.lan";
-				dhcp-range = [
+        dhcp-range = [
-					"${lan},10.42.2.1,10.42.2.255,255.255.0.0,12h"
+          "${lan},10.42.2.1,10.42.2.255,255.255.0.0,12h"
-					"${iot},192.168.66.3,192.168.66.150,255.255.255.0,12h"
+          "${iot},192.168.66.3,192.168.66.150,255.255.255.0,12h"
-					"vlan67@${lan},192.168.67.3,192.168.67.150,12h"
+          "vlan67@${lan},192.168.67.3,192.168.67.150,12h"
-				];
+        ];
-				dhcp-option = [
+        dhcp-option = [
-					"${lan},option:router,${routerIP}"
+          "${lan},option:router,${routerIP}"
-					"${lan},option:dns-server,${lanIP},1.1.1.1"
+          "${lan},option:dns-server,${lanIP},1.1.1.1"
-					"${lan},option:domain-search,thehellings.lan"
+          "${lan},option:domain-search,thehellings.lan"
 
-					"${iot},option:router,192.168.66.1"
+          "${iot},option:router,192.168.66.1"
-					"${iot},option:dns-server,${iotIP}"
+          "${iot},option:dns-server,${iotIP}"
 
-					"vlan67@${lan},option:router,192.168.67.1"
+          "vlan67@${lan},option:router,192.168.67.1"
-					"vlan67@${lan},option:dns-server,192.168.67.1"
+          "vlan67@${lan},option:dns-server,192.168.67.1"
-				];
+        ];
-				dhcp-host = [
+        dhcp-host = [
-					# Static IPs for personal work
+          # Static IPs for personal work
-					"2a:5d:23:10:4e:22,10.42.0.5"  # SAN Switch
+          "2a:5d:23:10:4e:22,10.42.0.5" # SAN Switch
-					"00:00:de:ad:be:ef,10.42.2.254"
+          "00:00:de:ad:be:ef,10.42.2.254"
-					"01:a8:a1:59:c7:8a:12,10.42.2.253"  # BMC management interface for isaiah
+          "01:a8:a1:59:c7:8a:12,10.42.2.253" # BMC management interface for isaiah
 
-					# Static IPs for things in the IOT range
+          # Static IPs for things in the IOT range
-					"b4:b0:24:9a:02:4a,192.168.66.5"  # LD125
+          "b4:b0:24:9a:02:4a,192.168.66.5" # LD125
-					"98:da:c4:20:f3:64,192.168.66.6"  # Dining room light
+          "98:da:c4:20:f3:64,192.168.66.6" # Dining room light
-					"54:af:97:c1:dc:b9,192.168.66.25"  # Master bedroom Kasa switch
+          "54:af:97:c1:dc:b9,192.168.66.25" # Master bedroom Kasa switch
-					"f0:03:8c:b3:b0:f6,192.168.66.55"  # Roomba
+          "f0:03:8c:b3:b0:f6,192.168.66.55" # Roomba
-					"4c:a1:61:05:cd:52,192.168.66.61"  # Rainbird
+          "4c:a1:61:05:cd:52,192.168.66.61" # Rainbird
-					"48:d6:d5:5d:81:21,192.168.66.65"  # Google Home
+          "48:d6:d5:5d:81:21,192.168.66.65" # Google Home
-					"6c:29:90:3e:e2:02,192.168.66.66"  # wiz
+          "6c:29:90:3e:e2:02,192.168.66.66" # wiz
-					"28:87:ba:0e:ca:da,192.168.66.74"  #
+          "28:87:ba:0e:ca:da,192.168.66.74" #
-					"28:87:ba:0e:c9:fd,192.168.66.75"  # Master closet
+          "28:87:ba:0e:c9:fd,192.168.66.75" # Master closet
-					"54:af:97:c2:0f:a1,192.168.66.76"  # Master toilet
+          "54:af:97:c2:0f:a1,192.168.66.76" # Master toilet
-					"54:af:97:83:ed:33,192.168.66.80"
+          "54:af:97:83:ed:33,192.168.66.80"
-					"98:da:c4:77:80:18,192.168.66.84"  # Kitchen lights
+          "98:da:c4:77:80:18,192.168.66.84" # Kitchen lights
-					"98:da:c4:21:1b:2e,192.168.66.85"  # Living Room lights
+          "98:da:c4:21:1b:2e,192.168.66.85" # Living Room lights
-					"0c:80:63:41:6e:0f,192.168.66.90" # Front porch
+          "0c:80:63:41:6e:0f,192.168.66.90" # Front porch
-					"0c:80:63:41:6c:5d,192.168.66.98"  # House number
+          "0c:80:63:41:6c:5d,192.168.66.98" # House number
-					"ac:84:c6:5e:4b:28,192.168.66.100"
+          "ac:84:c6:5e:4b:28,192.168.66.100"
-					"98:da:c4:77:7f:4d,192.168.66.102"  # Office lights
+          "98:da:c4:77:7f:4d,192.168.66.102" # Office lights
-					"8c:85:80:1c:f9:d1,192.168.66.104"
+          "8c:85:80:1c:f9:d1,192.168.66.104"
-					"98:da:c4:77:82:7b,192.168.66.105"  # Parlor lamp
+          "98:da:c4:77:82:7b,192.168.66.105" # Parlor lamp
-					"0c:80:63:41:74:73,192.168.66.106"  # Front hall light switch
+          "0c:80:63:41:74:73,192.168.66.106" # Front hall light switch
-					"98:da:c4:20:ea:db,192.168.66.107"  # Parlor light switch
+          "98:da:c4:20:ea:db,192.168.66.107" # Parlor light switch
-					"8c:49:62:aa:58:60,192.168.66.108"  # Roku, HiHandsome
+          "8c:49:62:aa:58:60,192.168.66.108" # Roku, HiHandsome
-					"92:3e:11:c7:c5:be,192.168.66.109"
+          "92:3e:11:c7:c5:be,192.168.66.109"
-					"d8:0d:17:19:60:62,192.168.66.112"
+          "d8:0d:17:19:60:62,192.168.66.112"
-					"b4:b0:24:9a:12:53,192.168.66.130"  # KL125
+          "b4:b0:24:9a:12:53,192.168.66.130" # KL125
-					"b4:b0:24:9a:14:0e,192.168.66.131"
+          "b4:b0:24:9a:14:0e,192.168.66.131"
-					"e4:f0:42:61:fa:b5,192.168.66.149"  # Google Home-mini
+          "e4:f0:42:61:fa:b5,192.168.66.149" # Google Home-mini
-				];
+        ];
-				expand-hosts = true;
+        expand-hosts = true;
-				log-dhcp = true;
+        log-dhcp = true;
-				log-queries = true;
+        log-queries = true;
-				no-hosts = true;  # Do not read /etc/hosts, which makes genesis resolve to 127.0.0.2
+        no-hosts = true; # Do not read /etc/hosts, which makes genesis resolve to 127.0.0.2
-				addn-hosts = "/etc/adblock_hosts";
+        addn-hosts = "/etc/adblock_hosts";
-				hostsdir = "/etc/hosts.d/";
+        hostsdir = "/etc/hosts.d/";
-				server = dnsServers;
+        server = dnsServers;
-			};
+      };
-		};
+    };
 
-		# Update adblock list
+    # Update adblock list
-		cron = {
+    cron = {
-			enable = true;
+      enable = true;
-			systemCronJobs = [
+      systemCronJobs = [
-				"* * * * * root ${adblockUpdate} 2>&1 > /var/log/adblock.log"
+        "* * * * * root ${adblockUpdate} 2>&1 > /var/log/adblock.log"
-			];
+      ];
-		};
+    };
-	};  # End of services configuration
+  }; # End of services configuration
 
-	greg.proxies = {
+  greg.proxies = {
-		"jellyfin.home".target = "http://localhost:8096/";
+    "jellyfin.home".target = "http://localhost:8096/";
-	};
+  };
 
-	environment.systemPackages = with pkgs; [
+  environment.systemPackages = with pkgs; [
-		bind
+    bind
-		curl  # Used by dnsmasq fetching
+    curl # Used by dnsmasq fetching
-		sqlite
+    sqlite
-	];
+  ];
 }

hosts/hosea/bitcoin.nix

@@ -1,78 +1,79 @@
 { config, pkgs, ... }:
 
 let
-	ip = "100.68.203.1";
+  ip = "100.68.203.1";
-in {
+in
-	nix-bitcoin = {
+{
-		generateSecrets = true;
+  nix-bitcoin = {
-		operator = {
+    generateSecrets = true;
-			enable = true;
+    operator = {
-			name = "greg";
+      enable = true;
-		};
+      name = "greg";
-		useVersionLockedPkgs = true;  # Use the exact versions of packages from upstream
+    };
-	};
+    useVersionLockedPkgs = true; # Use the exact versions of packages from upstream
+  };
 
-	networking.firewall.allowedTCPPorts = with config.services; [
+  networking.firewall.allowedTCPPorts = with config.services; [
-		bitcoind.port
+    bitcoind.port
-		bitcoind.rpc.port
+    bitcoind.rpc.port
-		lnd.restPort
+    lnd.restPort
-		lnd.port
+    lnd.port
-		mempool.frontend.port
+    mempool.frontend.port
-	];
+  ];
 
-	greg.backup.jobs = {
+  greg.backup.jobs = {
-		clightning = {
+    clightning = {
-			src = config.services.clightning.replication.local.directory;
+      src = config.services.clightning.replication.local.directory;
-			dest = "hosea-clightning";
+      dest = "hosea-clightning";
-			id = "clightning";
+      id = "clightning";
-		};
+    };
-	};
+  };
 
-	services = {
+  services = {
-		backups = {
+    backups = {
-			enable = true;
+      enable = true;
-			frequency = "hourly";
+      frequency = "hourly";
-		};
+    };
-		bitcoind = {
+    bitcoind = {
-			enable = true;
+      enable = true;
-			address = "0.0.0.0";
+      address = "0.0.0.0";
-			dataDir = "/chain/bitcoind";
+      dataDir = "/chain/bitcoind";
-			listen = true;
+      listen = true;
-			rpc = {
+      rpc = {
-				address = ip;
+        address = ip;
-				allowip = [
+        allowip = [
-					"100.1.1.1/8"
+          "100.1.1.1/8"
-				];
+        ];
-			};
+      };
-		};
+    };
-		clightning = {
+    clightning = {
-			enable = true;
+      enable = true;
-			address = ip;
+      address = ip;
-			port = 9736;
+      port = 9736;
-			replication = {
+      replication = {
-				enable = true;
+        enable = true;
-				local.directory = "/var/backup/clightning";
+        local.directory = "/var/backup/clightning";
-				encrypt = false;
+        encrypt = false;
-			};
+      };
-		};
+    };
-		electrs = {
+    electrs = {
-			enable = true;
+      enable = true;
-			address = ip;
+      address = ip;
-		};
+    };
-		lnd = {
+    lnd = {
-			enable = true;
+      enable = true;
-			address = ip;
+      address = ip;
-			lndconnect.enable = true;
+      lndconnect.enable = true;
-		};
+    };
-		mempool = {
+    mempool = {
-			enable = true;
+      enable = true;
-			frontend = {
+      frontend = {
-				enable = true;
+        enable = true;
-				address = ip;
+        address = ip;
-			};
+      };
-		};
+    };
-	};
+  };
 
-	environment.systemPackages = with pkgs; [
+  environment.systemPackages = with pkgs; [
-	];
+  ];
 }

hosts/hosea/default.nix

@@ -4,58 +4,59 @@
 
 { config, pkgs, lib, inputs, overlays, ... }:
 let
-	wanInterface = "enp2s0";
+  wanInterface = "enp2s0";
-	lanInterface = "enp1s0";
+  lanInterface = "enp1s0";
-	lanIpAddress = "10.42.1.7";
+  lanIpAddress = "10.42.1.7";
 in
 
 {
-	imports =
+  imports =
-		[ # Include the results of the hardware scan.
+    [
-			./hardware-configuration.nix
+      # Include the results of the hardware scan.
-			inputs.btc.nixosModules.default
+      ./hardware-configuration.nix
-			./bitcoin.nix
+      inputs.btc.nixosModules.default
-		];
+      ./bitcoin.nix
+    ];
 
-	# Bootloader
+  # Bootloader
-	boot = {
+  boot = {
-		loader = {
+    loader = {
-			systemd-boot.enable = true;
+      systemd-boot.enable = true;
-			efi = {
+      efi = {
-				canTouchEfiVariables = true;
+        canTouchEfiVariables = true;
-				efiSysMountPoint = "/boot/";
+        efiSysMountPoint = "/boot/";
-			};
+      };
-		};
+    };
-		extraModprobeConfig = "vboxdrv";
+    extraModprobeConfig = "vboxdrv";
-	};
+  };
-	users.users.greg.extraGroups = [ "vboxusers" ];
+  users.users.greg.extraGroups = [ "vboxusers" ];
 
-	networking = {
+  networking = {
-		hostName = "hosea";
+    hostName = "hosea";
-		nameservers = [ "10.42.1.5" ];
+    nameservers = [ "10.42.1.5" ];
-		defaultGateway = "10.42.1.1";
+    defaultGateway = "10.42.1.1";
-		interfaces = {
+    interfaces = {
-			"${wanInterface}".useDHCP = true;
+      "${wanInterface}".useDHCP = true;
-			"${lanInterface}" = {
+      "${lanInterface}" = {
-				useDHCP = false;
+        useDHCP = false;
-				ipv4.addresses = [{
+        ipv4.addresses = [{
-					address = lanIpAddress;
+          address = lanIpAddress;
-					prefixLength = 16;
+          prefixLength = 16;
-				}];
+        }];
-			};
+      };
-		};
+    };
-	};
+  };
 
-	# Serves as the router, DHCP, and DNS for the site
+  # Serves as the router, DHCP, and DNS for the site
-	greg = {
+  greg = {
-		tailscale.enable = true;
+    tailscale.enable = true;
-		home = true;
+    home = true;
-	};
+  };
-	services = {
+  services = {
-		# Configure keymap
+    # Configure keymap
-		xserver.xkb = {
+    xserver.xkb = {
-			layout = "us";
+      layout = "us";
-			variant = "";
+      variant = "";
-		};
+    };
-	};
+  };
 }

hosts/hosea/hardware-configuration.nix

@@ -5,7 +5,8 @@
 
 {
   imports =
-    [ (modulesPath + "/installer/scan/not-detected.nix")
+    [
+      (modulesPath + "/installer/scan/not-detected.nix")
     ];
 
   boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "nvme" "usbhid" "uas" "sd_mod" ];
@@ -14,13 +15,15 @@
   boot.extraModulePackages = [ ];
 
   fileSystems."/" =
-    { device = "/dev/disk/by-uuid/d4ac74f7-62bb-421a-aad8-566277c9d8ba";
+    {
+      device = "/dev/disk/by-uuid/d4ac74f7-62bb-421a-aad8-566277c9d8ba";
       fsType = "btrfs";
       options = [ "subvol=@" ];
     };
 
   fileSystems."/boot" =
-    { device = "/dev/disk/by-uuid/1F51-B638";
+    {
+      device = "/dev/disk/by-uuid/1F51-B638";
       fsType = "vfat";
     };
 

hosts/icdm-root/boot.nix

@@ -1,11 +1,11 @@
-{ pkgs, config, ...}:
+{ pkgs, config, ... }:
 
 {
-	# Bootloader.
+  # Bootloader.
-	boot = {
+  boot = {
-		loader.grub = {
+    loader.grub = {
-			enable = true;
+      enable = true;
-			device = "/dev/sda";
+      device = "/dev/sda";
-		};
+    };
-	};
+  };
 }

hosts/icdm-root/default.nix

@@ -5,20 +5,21 @@
 { config, pkgs, agenix, ... }:
 
 {
-	imports = [ # Include the results of the hardware scan.
+  imports = [
-		./hardware-configuration.nix
+    # Include the results of the hardware scan.
-		./boot.nix
+    ./hardware-configuration.nix
-		./filesystem.nix
+    ./boot.nix
-		./location.nix
+    ./filesystem.nix
-		./networking.nix
+    ./location.nix
-		./wiki.nix
+    ./networking.nix
-	];
+    ./wiki.nix
+  ];
 
-	# Define a user account. Don't forget to set a password with ‘passwd’.
+  # Define a user account. Don't forget to set a password with ‘passwd’.
-	users.users.greg = {
+  users.users.greg = {
-		isNormalUser = true;
+    isNormalUser = true;
-		description = "Gregory Hellings";
+    description = "Gregory Hellings";
-		extraGroups = [ "networkmanager" "wheel" ];
+    extraGroups = [ "networkmanager" "wheel" ];
-		packages = with pkgs; [];
+    packages = with pkgs; [ ];
-	};
+  };
 }

hosts/icdm-root/filesystem.nix

@@ -2,11 +2,11 @@
 
 let
 in {
-	fileSystems."serve" = {
+  fileSystems."serve" = {
-		#device = "10.42.1.4:/volume1/icdm-mysql/";
+    #device = "10.42.1.4:/volume1/icdm-mysql/";
-		#fsType = "nfs";
+    #fsType = "nfs";
-		device = "/dev/sdb1";
+    device = "/dev/sdb1";
-		fsType = "auto";
+    fsType = "auto";
-		mountPoint = "/srv";
+    mountPoint = "/srv";
-	};
+  };
 }

hosts/icdm-root/hardware-configuration.nix

@@ -5,7 +5,8 @@
 
 {
   imports =
-    [ (modulesPath + "/installer/scan/not-detected.nix")
+    [
+      (modulesPath + "/installer/scan/not-detected.nix")
     ];
 
   boot.initrd.availableKernelModules = [ "xhci_pci" "ehci_pci" "ahci" "usbhid" "usb_storage" "sd_mod" ];
@@ -14,24 +15,26 @@
   boot.extraModulePackages = [ ];
 
   fileSystems."/" =
-    { device = "/dev/disk/by-uuid/dab0d455-e25e-4445-8fa4-5320047d7e7b";
+    {
+      device = "/dev/disk/by-uuid/dab0d455-e25e-4445-8fa4-5320047d7e7b";
       fsType = "btrfs";
       options = [ "subvol=@" ];
     };
 
   fileSystems."/boot" =
-    { device = "/dev/disk/by-uuid/5aedbb07-5761-423b-909d-2560405eae32";
+    {
+      device = "/dev/disk/by-uuid/5aedbb07-5761-423b-909d-2560405eae32";
       fsType = "ext4";
     };
 
   fileSystems."/var" =
-    { device = "/dev/disk/by-uuid/57968536-c29d-417d-997e-85223d1d1f65";
+    {
+      device = "/dev/disk/by-uuid/57968536-c29d-417d-997e-85223d1d1f65";
       fsType = "btrfs";
     };
 
   swapDevices =
-    [ { device = "/dev/disk/by-uuid/09691dce-375a-43c6-8d40-4498d20a6d9a"; }
+    [{ device = "/dev/disk/by-uuid/09691dce-375a-43c6-8d40-4498d20a6d9a"; }];
-    ];
 
   # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
   # (the default) this is the recommended approach. When using systemd-networkd it's

hosts/icdm-root/location.nix

@@ -1,4 +1,4 @@
-{...}:
+{ ... }:
 
 {
   # Set your time zone.

hosts/icdm-root/networking.nix

@@ -1,58 +1,59 @@
-{...}:
+{ ... }:
 let
-	dnsHosts = builtins.concatStringsSep "\n" [
+  dnsHosts = builtins.concatStringsSep "\n" [
-		"wiki.icdm.lan 10.42.101.1"
+    "wiki.icdm.lan 10.42.101.1"
-	];
+  ];
 in
 {
-	# If we have to do proxying in Bayonnais, we can start to work on that here
+  # If we have to do proxying in Bayonnais, we can start to work on that here
-	# networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";
+  # networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";
-	networking = {
+  networking = {
-		hostName = "icdm-root";
+    hostName = "icdm-root";
-		useDHCP = false;
+    useDHCP = false;
-		defaultGateway = "10.42.1.1";
+    defaultGateway = "10.42.1.1";
-		nameservers = [ "100.100.100.100" "10.42.1.2" ];
+    nameservers = [ "100.100.100.100" "10.42.1.2" ];
-		enableIPv6 = false;
+    enableIPv6 = false;
 
-		interfaces = {
+    interfaces = {
-			eno1.ipv4.addresses = [ {
+      eno1.ipv4.addresses = [{
-				address = "10.42.101.1";
+        address = "10.42.101.1";
-				prefixLength = 16;
+        prefixLength = 16;
-			} {
+      }
-				address = "10.77.1.2";
+        {
-				prefixLength = 16;
+          address = "10.77.1.2";
-			} ];
+          prefixLength = 16;
-		};
+        }];
-		# Allow traffic through
+    };
-		firewall = {
+    # Allow traffic through
-			enable = true;
+    firewall = {
-			allowedTCPPorts = [ 53 ];
+      enable = true;
-			allowedUDPPorts = [ 53 67 ];
+      allowedTCPPorts = [ 53 ];
-		};
+      allowedUDPPorts = [ 53 67 ];
+    };
 
-		extraHosts = "${dnsHosts}";
+    extraHosts = "${dnsHosts}";
-	};
+  };
 
-	services.dnsmasq = {
+  services.dnsmasq = {
-		enable = true;
+    enable = true;
-		settings = {
+    settings = {
-			domain = "icdm.lan";
+      domain = "icdm.lan";
-			dhcp-range = [
+      dhcp-range = [
-				"eno1,10.77.1.10,10.77.1.255,255.255.0.0,12h"
+        "eno1,10.77.1.10,10.77.1.255,255.255.0.0,12h"
-			];
+      ];
-			dhcp-option = [
+      dhcp-option = [
-				"eno1,option:router,10.77.1.1"
+        "eno1,option:router,10.77.1.1"
-				"eno1,option:dns-server,10.77.1.2,1.1.1.1"
+        "eno1,option:dns-server,10.77.1.2,1.1.1.1"
-				"eno1,option:domain-search,icdm.lan"
+        "eno1,option:domain-search,icdm.lan"
-			];
+      ];
-			expand-hosts = true;
+      expand-hosts = true;
-			log-dhcp = true;
+      log-dhcp = true;
-			log-queries = true;
+      log-queries = true;
-			# Upstream servers
+      # Upstream servers
-			server = [
+      server = [
-				"1.1.1.1"
+        "1.1.1.1"
-				"8.8.4.4"
+        "8.8.4.4"
-			];
+      ];
-		};
+    };
-	};
+  };
 }

hosts/icdm-root/wiki.nix

@@ -1,32 +1,32 @@
 { pkgs, ... }:
 let
-	wikiPasswordFile = "/var/mediawiki/passwordFile";
+  wikiPasswordFile = "/var/mediawiki/passwordFile";
-	wikiHost = "wiki.icdm.lan";
+  wikiHost = "wiki.icdm.lan";
-	kiwixport = 8080;
+  kiwixport = 8080;
-	dependents = with pkgs; [
+  dependents = with pkgs; [
-		enwiki-dump
+    enwiki-dump
-		transmission
+    transmission
-	];
+  ];
 in
 {
-	services.kiwix-serve = {
+  services.kiwix-serve = {
-		enable = true;
+    enable = true;
-		port = kiwixport;
+    port = kiwixport;
-		path = "/srv/zims/*.zim";
+    path = "/srv/zims/*.zim";
-	};
+  };
 
-	services.transmission = {
+  services.transmission = {
-		enable = true;
+    enable = true;
-		settings = {
+    settings = {
-			download-dir = "/srv";
+      download-dir = "/srv";
-			incomplete-dir = "/srv/incomplete";
+      incomplete-dir = "/srv/incomplete";
-			rpc-bind-address = "0.0.0.0";
+      rpc-bind-address = "0.0.0.0";
-			rpc-whitelist = "10.42.*,127.*,localhost";
+      rpc-whitelist = "10.42.*,127.*,localhost";
-		};
+    };
-	};
+  };
 
-	greg.proxies."${wikiHost}".target = "http://localhost:${toString kiwixport}";
+  greg.proxies."${wikiHost}".target = "http://localhost:${toString kiwixport}";
-	networking.firewall.allowedTCPPorts = [ 80 ];
+  networking.firewall.allowedTCPPorts = [ 80 ];
 
-	environment.systemPackages = dependents;
+  environment.systemPackages = dependents;
 }

hosts/iso/default.nix

@@ -1,15 +1,15 @@
 { pkgs, lib, modulesPath, ... }:
 {
 
-	imports = [
+  imports = [
-		"${modulesPath}/installer/cd-dvd/installation-cd-graphical-calamares-gnome.nix"
+    "${modulesPath}/installer/cd-dvd/installation-cd-graphical-calamares-gnome.nix"
-		"${modulesPath}/installer/cd-dvd/channel.nix"
+    "${modulesPath}/installer/cd-dvd/channel.nix"
-	];
+  ];
 
-	networking.networkmanager.enable = lib.mkForce false;
+  networking.networkmanager.enable = lib.mkForce false;
-	users.users.greg.initialPassword = "";
+  users.users.greg.initialPassword = "";
-	#services.getty.autologinUser = lib.mkForce "greg";
+  #services.getty.autologinUser = lib.mkForce "greg";
-	environment.systemPackages = with pkgs; [
+  environment.systemPackages = with pkgs; [
-		tree
+    tree
-	];
+  ];
 }

hosts/jeremiah/ceph.nix

@@ -1,33 +1,34 @@
 { config, ... }:
 
 let
-	publicIp = (builtins.elemAt config.networking.interfaces.enp68s0.ipv4.addresses 0).address;
+  publicIp = (builtins.elemAt config.networking.interfaces.enp68s0.ipv4.addresses 0).address;
-	sanIp = (builtins.elemAt config.networking.interfaces.enp67s0.ipv4.addresses 0).address;
+  sanIp = (builtins.elemAt config.networking.interfaces.enp67s0.ipv4.addresses 0).address;
-	vip = (builtins.elemAt config.networking.interfaces.enp68s0.ipv4.addresses 1).address;
+  vip = (builtins.elemAt config.networking.interfaces.enp68s0.ipv4.addresses 1).address;
-	hostname = config.networking.hostName;
+  hostname = config.networking.hostName;
-	baseConfig = import ../../ceph/home.nix;
+  baseConfig = import ../../ceph/home.nix;
-in {
+in
-	services.ceph-benaco = baseConfig // {
+{
-		enable = false;
+  services.ceph-benaco = baseConfig // {
-		monitor = {
+    enable = false;
-			enable = false;
+    monitor = {
-			initialKeyring = ../../secrets/home.mon.keyring;
+      enable = false;
-			nodeName = hostname;
+      initialKeyring = ../../secrets/home.mon.keyring;
-			bindAddr = publicIp;
+      nodeName = hostname;
-			advertisedPublicAddr = vip;
+      bindAddr = publicIp;
-		};
+      advertisedPublicAddr = vip;
-		osdBindAddr = publicIp;
+    };
-		osdAdvertisedPublicAddr = publicIp;
+    osdBindAddr = publicIp;
-		osds = {
+    osdAdvertisedPublicAddr = publicIp;
-			osd1 = {
+    osds = {
-				enable = false;
+      osd1 = {
-				bootstrapKeyring = ../../secrets/home.osd-bootstrap.keyring;
+        enable = false;
-				id = 1;
+        bootstrapKeyring = ../../secrets/home.osd-bootstrap.keyring;
-				uuid = "c13bd2b1-cfc7-4966-8da5-d92356e87e06";
+        id = 1;
-				blockDevice = "/dev/sda";
+        uuid = "c13bd2b1-cfc7-4966-8da5-d92356e87e06";
-				blockDeviceUdevRuleMatcher = ''KERNEL=="sda"'';
+        blockDevice = "/dev/sda";
-				clusterAddress = sanIp;
+        blockDeviceUdevRuleMatcher = ''KERNEL=="sda"'';
-			};
+        clusterAddress = sanIp;
-		};
+      };
-	};
+    };
+  };
 }

hosts/jeremiah/default.nix

@@ -5,125 +5,127 @@
 { config, pkgs, lib, ... }:
 
 {
-	imports =
+  imports =
-		[ # Include the results of the hardware scan.
+    [
-			./ceph.nix
+      # Include the results of the hardware scan.
-			./hardware-configuration.nix
+      ./ceph.nix
-			./minio.nix
+      ./hardware-configuration.nix
-		];
+      ./minio.nix
+    ];
 
-	# Bootloader.
+  # Bootloader.
-	boot.loader.systemd-boot.enable = true;
+  boot.loader.systemd-boot.enable = true;
-	boot.loader.efi.canTouchEfiVariables = true;
+  boot.loader.efi.canTouchEfiVariables = true;
 
-	networking = {
+  networking = {
-		hostName = "jeremiah"; # Define your hostname.
+    hostName = "jeremiah"; # Define your hostname.
-		useDHCP = false;
+    useDHCP = false;
-		defaultGateway = {
+    defaultGateway = {
-			address = " 10.42.1.1";
+      address = " 10.42.1.1";
-			interface = "enp68s0";
+      interface = "enp68s0";
-		};
+    };
-		vlans = {
+    vlans = {
-			san = {
+      san = {
-				id = 616;
+        id = 616;
-				interface = "enp67s0";
+        interface = "enp67s0";
-			};
+      };
-		};
+    };
-		interfaces = {
+    interfaces = {
-			enp68s0 = {
+      enp68s0 = {
-				ipv4.addresses = [ {
+        ipv4.addresses = [{
-					address = "10.42.1.8";
+          address = "10.42.1.8";
-					prefixLength = 16;
+          prefixLength = 16;
-				} {
+        }
-					address = "10.42.100.1";
+          {
-					prefixLength = 16;
+            address = "10.42.100.1";
-				} ];
+            prefixLength = 16;
-			};
+          }];
-			san = {
+      };
-				ipv4.addresses = [ {
+      san = {
-					address = "10.201.1.2";
+        ipv4.addresses = [{
-					prefixLength = 24;
+          address = "10.201.1.2";
-				} ];
+          prefixLength = 24;
-			};
+        }];
-		};
+      };
-		nameservers = [
+    };
-			"10.42.1.5"
+    nameservers = [
-		];
+      "10.42.1.5"
-	};
+    ];
-	greg = {
+  };
-		home = true;
+  greg = {
-		tailscale.enable = true;
+    home = true;
-	};
+    tailscale.enable = true;
-	environment.systemPackages = with pkgs; [
+  };
-		curl
+  environment.systemPackages = with pkgs; [
-		gawk
+    curl
-		git
+    gawk
-		unzip
+    git
-		wget
+    unzip
-	];
+    wget
+  ];
 
-	fileSystems = {
+  fileSystems = {
-		"/nix" = {
+    "/nix" = {
-			fsType = "btrfs";
+      fsType = "btrfs";
-			options = [ "subvol=nix" ];
+      options = [ "subvol=nix" ];
-			device = "/dev/nvme0n1p1";
+      device = "/dev/nvme0n1p1";
-		};
+    };
-		"/var" = {
+    "/var" = {
-			fsType = "btrfs";
+      fsType = "btrfs";
-			options = [ "subvol=var" ];
+      options = [ "subvol=var" ];
-			device = "/dev/nvme0n1p1";
+      device = "/dev/nvme0n1p1";
-		};
+    };
-	};
+  };
 
-	#####################################################################################
+  #####################################################################################
-	#################### Virtualbox Runner ##############################################
+  #################### Virtualbox Runner ##############################################
-	#####################################################################################
+  #####################################################################################
-	services = {
+  services = {
-		gitlab-runner = {
+    gitlab-runner = {
-			enable = true;
+      enable = true;
-			settings.concurrent = 7;
+      settings.concurrent = 7;
-			services = {
+      services = {
-				shell = {
+        shell = {
-					executor = "shell";
+          executor = "shell";
-					limit = 5;
+          limit = 5;
-					authenticationTokenConfigFile = config.age.secrets.runner-reg.path;
+          authenticationTokenConfigFile = config.age.secrets.runner-reg.path;
-					environmentVariables = {
+          environmentVariables = {
-						EFI_DIR = "${pkgs.OVMF.fd}/FV/";
+            EFI_DIR = "${pkgs.OVMF.fd}/FV/";
-						STORAGE_URL = "http://s3.thehellings.lan:9000";
+            STORAGE_URL = "http://s3.thehellings.lan:9000";
-					};
+          };
-				};
+        };
-			};
+      };
-		};
+    };
-	};
+  };
-	age.secrets.runner-reg.file = ../../secrets/gitlab/jeremiah-runner-reg.age;
+  age.secrets.runner-reg.file = ../../secrets/gitlab/jeremiah-runner-reg.age;
-	virtualisation.virtualbox.host = {
+  virtualisation.virtualbox.host = {
-		enable = true;
+    enable = true;
-		enableExtensionPack = true;
+    enableExtensionPack = true;
-		enableHardening = false;
+    enableHardening = false;
-		headless = true;
+    headless = true;
-		enableWebService = true;
+    enableWebService = true;
-	};
+  };
 
-	systemd.services."gitlab-runner" = {
+  systemd.services."gitlab-runner" = {
-		after = [
+    after = [
-			"network.target"
+      "network.target"
-			"network-online.target"
+      "network-online.target"
-			"systemd-resolved.service"
+      "systemd-resolved.service"
-		];
+    ];
-		wants = [
+    wants = [
-			"network-online.target"
+      "network-online.target"
-			"systemd-resolved.service"
+      "systemd-resolved.service"
-		];
+    ];
-		preStart = builtins.concatStringsSep "\n" [
+    preStart = builtins.concatStringsSep "\n" [
-			"${pkgs.kmod}/bin/modprobe vboxdrv"
+      "${pkgs.kmod}/bin/modprobe vboxdrv"
-			"${pkgs.kmod}/bin/modprobe vboxnetadp"
+      "${pkgs.kmod}/bin/modprobe vboxnetadp"
-			"${pkgs.kmod}/bin/modprobe vboxnetflt"
+      "${pkgs.kmod}/bin/modprobe vboxnetflt"
-		];
+    ];
-		postStop = "${pkgs.kmod}/bin/rmmod vboxnetadp vboxnetflt vboxdrv";
+    postStop = "${pkgs.kmod}/bin/rmmod vboxnetadp vboxnetflt vboxdrv";
-		serviceConfig = {
+    serviceConfig = {
-			DevicePolicy = lib.mkForce "auto";
+      DevicePolicy = lib.mkForce "auto";
-			User = "root";
+      User = "root";
-			DynamicUser = lib.mkForce false;
+      DynamicUser = lib.mkForce false;
-		};
+    };
-	};
+  };
 }

hosts/jeremiah/hardware-configuration.nix

@@ -5,7 +5,8 @@
 
 {
   imports =
-    [ (modulesPath + "/installer/scan/not-detected.nix")
+    [
+      (modulesPath + "/installer/scan/not-detected.nix")
     ];
 
   boot.initrd.availableKernelModules = [ "nvme" "xhci_pci" "ahci" "uas" "usbhid" "sd_mod" ];
@@ -14,12 +15,14 @@
   boot.extraModulePackages = [ ];
 
   fileSystems."/" =
-    { device = "/dev/disk/by-uuid/ffc167f5-d9e4-4b11-a5f1-f7da0550ad24";
+    {
+      device = "/dev/disk/by-uuid/ffc167f5-d9e4-4b11-a5f1-f7da0550ad24";
       fsType = "ext4";
     };
 
   fileSystems."/boot" =
-    { device = "/dev/disk/by-uuid/3047-870E";
+    {
+      device = "/dev/disk/by-uuid/3047-870E";
       fsType = "vfat";
     };
 

hosts/jeremiah/minio.nix

@@ -1,32 +1,33 @@
 { config, pkgs, ... }:
 
 let
-	minioPort = 9000;
+  minioPort = 9000;
-	minioConsolePort = 9001;
+  minioConsolePort = 9001;
-in {
+in
-	environment.systemPackages = with pkgs; [
+{
-		minio-client
+  environment.systemPackages = with pkgs; [
-		xfsprogs
+    minio-client
-	];
+    xfsprogs
+  ];
 
-	greg.proxies."minio-02.thehellings.lan".target = "http://localhost:9000";
+  greg.proxies."minio-02.thehellings.lan".target = "http://localhost:9000";
 
-	fileSystems."/data/1" = {
+  fileSystems."/data/1" = {
-		device = "/dev/disk/by-id/ata-ST12000NM0558_ZHZ5YSXW-part1";
+    device = "/dev/disk/by-id/ata-ST12000NM0558_ZHZ5YSXW-part1";
-		fsType = "xfs";
+    fsType = "xfs";
-	};
+  };
 
-	networking.firewall.allowedTCPPorts = [
+  networking.firewall.allowedTCPPorts = [
-		minioPort
+    minioPort
-		minioConsolePort
+    minioConsolePort
-	];
+  ];
 
-	age.secrets.minio.file = ../../secrets/minio.age;
+  age.secrets.minio.file = ../../secrets/minio.age;
 
-	services.minio = {
+  services.minio = {
-		enable = true;
+    enable = true;
-		dataDir = [ "/data/1/minio" ];
+    dataDir = [ "/data/1/minio" ];
-		rootCredentialsFile = config.age.secrets.minio.path;
+    rootCredentialsFile = config.age.secrets.minio.path;
-		browser = true;
+    browser = true;
-	};
+  };
 }

hosts/jude/boot.nix

@@ -1,50 +1,50 @@
 { lib, pkgs, ... }:
 
 {
-	# Use the systemd-boot EFI boot loader.
+  # Use the systemd-boot EFI boot loader.
-	boot = {
+  boot = {
-		binfmt.emulatedSystems = [ "aarch64-linux" ];
+    binfmt.emulatedSystems = [ "aarch64-linux" ];
-		kernelPackages = pkgs.linuxPackages_latest;
+    kernelPackages = pkgs.linuxPackages_latest;
-		supportedFilesystems = [ "ntfs" ];
+    supportedFilesystems = [ "ntfs" ];
-		loader = {
+    loader = {
-			timeout = 15;
+      timeout = 15;
-			systemd-boot = {
+      systemd-boot = {
-				enable = true;
+        enable = true;
-				configurationLimit = 20;
+        configurationLimit = 20;
-				extraEntries = {
+        extraEntries = {
-					"Windows.conf" = (lib.strings.concatStringsSep "\n" [
+          "Windows.conf" = (lib.strings.concatStringsSep "\n" [
-						"title Windows"
+            "title Windows"
-						"efi /EFI/Microsoft/EFI/bootmgfw.efi"
+            "efi /EFI/Microsoft/EFI/bootmgfw.efi"
-					]);
+          ]);
-					"Win2.conf" = (lib.strings.concatStringsSep "\n" [
+          "Win2.conf" = (lib.strings.concatStringsSep "\n" [
-						"title Windows 11"
+            "title Windows 11"
-						"efi /shellx64.efi"
+            "efi /shellx64.efi"
-						"options -nointerrupt -noconsolein -noconsoleout windows11.nsh"
+            "options -nointerrupt -noconsolein -noconsoleout windows11.nsh"
-					]);
+          ]);
-					"Shell.conf" = (lib.strings.concatStringsSep "\n" [
+          "Shell.conf" = (lib.strings.concatStringsSep "\n" [
-						"title EFI Shell"
+            "title EFI Shell"
-						"efi /shell.efi"
+            "efi /shell.efi"
-					]);
+          ]);
-				};
+        };
-				extraFiles = {
+        extraFiles = {
-					"windows11.nsh" = (pkgs.writeText "windows11.nsh" (lib.strings.concatStringsSep "\n" [
+          "windows11.nsh" = (pkgs.writeText "windows11.nsh" (lib.strings.concatStringsSep "\n" [
-					]));
+          ]));
-					"shell.efi" = "${pkgs.edk2-uefi-shell}/shell.efi";
+          "shell.efi" = "${pkgs.edk2-uefi-shell}/shell.efi";
-				};
+        };
-			};
+      };
-			grub = {
+      grub = {
-				enable = false;
+        enable = false;
-				device = "/dev/nvme0n1";
+        device = "/dev/nvme0n1";
-				useOSProber = true;
+        useOSProber = true;
-				efiSupport = true;
+        efiSupport = true;
-				extraEntries = ''
+        extraEntries = ''
-				menuentry "Windows" --class windows --class os {
+          				menuentry "Windows" --class windows --class os {
-				  insmod ntfs
+          				  insmod ntfs
-				  chainloader (hd0,0)/EFI/Windows/bootmgfw.efi
+          				  chainloader (hd0,0)/EFI/Windows/bootmgfw.efi
-				}
+          				}
-				'';
+          				'';
-			};
+      };
-			#efi.canTouchEfiVariables = true;
+      #efi.canTouchEfiVariables = true;
-		};
+    };
-	};
+  };
 }

hosts/jude/default.nix

@@ -1,119 +1,120 @@
 { pkgs, config, ... }:
 
 {
-	imports = [
+  imports = [
-		./boot.nix
+    ./boot.nix
-		./hardware-configuration.nix
+    ./hardware-configuration.nix
-		./podman.nix
+    ./podman.nix
-		./virt.nix
+    ./virt.nix
-	];
+  ];
-	programs = {
+  programs = {
-		steam.enable = true;
+    steam.enable = true;
-		nix-index = {
+    nix-index = {
-			enable = true;
+      enable = true;
-			enableBashIntegration = false;
+      enableBashIntegration = false;
-			enableFishIntegration = false;
+      enableFishIntegration = false;
-			enableZshIntegration = false;
+      enableZshIntegration = false;
-		};
+    };
-		nix-ld.enable = false;
+    nix-ld.enable = false;
-	};
+  };
 
-	networking = {
+  networking = {
-		hostName = "jude";
+    hostName = "jude";
-		enableIPv6 = false;
+    enableIPv6 = false;
-		interfaces.enp12s0.useDHCP = true;
+    interfaces.enp12s0.useDHCP = true;
-		firewall = {
+    firewall = {
-			enable = false;
+      enable = false;
-			allowedTCPPorts = [ 21000 ];
+      allowedTCPPorts = [ 21000 ];
-			allowedUDPPorts = [ 21000 21010 ];
+      allowedUDPPorts = [ 21000 21010 ];
-		};
+    };
-	};
+  };
-	greg = {
+  greg = {
-		tailscale.enable = true;
+    tailscale.enable = true;
-		sway.enable = false;
+    sway.enable = false;
-		gnome.enable = true;
+    gnome.enable = true;
-		kde.enable = false;
+    kde.enable = false;
-		print.enable = true;
+    print.enable = true;
-	};
+  };
 
-	boot.extraModulePackages = [ config.boot.kernelPackages.v4l2loopback ];
+  boot.extraModulePackages = [ config.boot.kernelPackages.v4l2loopback ];
 
-	environment.systemPackages = with pkgs; lib.mkMerge [
+  environment.systemPackages = with pkgs; lib.mkMerge [
-		[  # for Immersed
+    [
-			cudatoolkit
+      # for Immersed
-			immersed-vr
+      cudatoolkit
-			libva
+      immersed-vr
-		]
+      libva
-		[
+    ]
-			bind  # For things like nslookup
+    [
-			create_ssl
+      bind # For things like nslookup
-			distrobox
+      create_ssl
-			expect
+      distrobox
-			gimp
+      expect
-			go
+      gimp
-			gparted
+      go
-			gnucash
+      gparted
-			graphviz
+      gnucash
-			flock
+      graphviz
-			ffmpeg
+      flock
-			handbrake
+      ffmpeg
-			imagemagick
+      handbrake
-			libtheora
+      imagemagick
-			libxml2
+      libtheora
-			linode-cli
+      libxml2
-			makemkv
+      linode-cli
-			oathToolkit
+      makemkv
-			usbutils
+      oathToolkit
-			vagrant
+      usbutils
-			ventoy
+      vagrant
-		]
+      ventoy
+    ]
 
-		[
+    [
-			# Video/Audio data composition framework tools like "gst-inspect", "gst-launch" ...
+      # Video/Audio data composition framework tools like "gst-inspect", "gst-launch" ...
-			gst_all_1.gstreamer
+      gst_all_1.gstreamer
-			gst_all_1.gst-plugins-base
+      gst_all_1.gst-plugins-base
-			gst_all_1.gst-plugins-good
+      gst_all_1.gst-plugins-good
-			gst_all_1.gst-plugins-bad
+      gst_all_1.gst-plugins-bad
-			gst_all_1.gst-plugins-ugly
+      gst_all_1.gst-plugins-ugly
-			gst_all_1.gst-libav
+      gst_all_1.gst-libav
-			gst_all_1.gst-vaapi
+      gst_all_1.gst-vaapi
-		]
+    ]
-	];
+  ];
-	fileSystems =  {
+  fileSystems = {
-		"/boot" = {
+    "/boot" = {
-			device = "/dev/nvme0n1p1";
+      device = "/dev/nvme0n1p1";
-			fsType = "auto";
+      fsType = "auto";
-		};
+    };
-		"/windows" = {
+    "/windows" = {
-			device = "/dev/nvme0n1p5";
+      device = "/dev/nvme0n1p5";
-			fsType = "ntfs-3g";
+      fsType = "ntfs-3g";
-		};
+    };
-		"/windows11" = {
+    "/windows11" = {
-			device = "/dev/nvme1n1p2";
+      device = "/dev/nvme1n1p2";
-			fsType = "ntfs-3g";
+      fsType = "ntfs-3g";
-		};
+    };
-	};
+  };
 
-	# Let's do a sound thing
+  # Let's do a sound thing
-	services = {
+  services = {
-		pipewire = {
+    pipewire = {
-			enable = true;
+      enable = true;
-			alsa.enable = true;
+      alsa.enable = true;
-			audio.enable = true;
+      audio.enable = true;
-			jack.enable = true;
+      jack.enable = true;
-			pulse.enable = true;
+      pulse.enable = true;
-			wireplumber.enable = true;
+      wireplumber.enable = true;
-		};
+    };
-		locate.enable = true;
+    locate.enable = true;
-		xserver.videoDrivers = [ "nvidia" ];
+    xserver.videoDrivers = [ "nvidia" ];
-	};
+  };
-	hardware = {
+  hardware = {
-		nvidia = {
+    nvidia = {
-			modesetting.enable = true;
+      modesetting.enable = true;
-			nvidiaSettings = true;
+      nvidiaSettings = true;
-			open = true;
+      open = true;
-		};
+    };
-		pulseaudio.enable = false;  # This conflicts with pipewire
+    pulseaudio.enable = false; # This conflicts with pipewire
-		system76.enableAll = true;
+    system76.enableAll = true;
-	};
+  };
 }

hosts/jude/hardware-configuration.nix

@@ -5,7 +5,8 @@
 
 {
   imports =
-    [ (modulesPath + "/installer/scan/not-detected.nix")
+    [
+      (modulesPath + "/installer/scan/not-detected.nix")
     ];
 
   boot.initrd.availableKernelModules = [ "nvme" "xhci_pci" "ahci" "usbhid" "usb_storage" "sd_mod" ];
@@ -14,7 +15,8 @@
   boot.extraModulePackages = [ ];
 
   fileSystems."/" =
-    { #device = "/dev/disk/by-uuid/27ae91ed-32e9-411e-8227-0d99e360fbbf";
+    {
+      #device = "/dev/disk/by-uuid/27ae91ed-32e9-411e-8227-0d99e360fbbf";
       device = "/dev/nvme0n1p4";
       fsType = "btrfs";
     };

hosts/jude/podman.nix

@@ -1,8 +1,8 @@
 { ... }:
 
 {
-	virtualisation.podman = {
+  virtualisation.podman = {
-		enable = true;
+    enable = true;
-		dockerCompat = true;
+    dockerCompat = true;
-	};
+  };
 }

hosts/jude/virt.nix

@@ -1,38 +1,38 @@
 { pkgs, config, ... }:
 
 {
-	greg.vmdev.enable = true;
+  greg.vmdev.enable = true;
 
-	virtualisation = {
+  virtualisation = {
-		waydroid.enable = false;
+    waydroid.enable = false;
-		lxd.enable = false;
+    lxd.enable = false;
-	};
+  };
 
-	systemd.services = {
+  systemd.services = {
-		gitlab-runner = {
+    gitlab-runner = {
-			conflicts = [ "libvirtd.service" ];
+      conflicts = [ "libvirtd.service" ];
-			preStart = builtins.concatStringsSep "\n" [
+      preStart = builtins.concatStringsSep "\n" [
-				"${pkgs.kmod}/bin/modprobe vboxnetflt vboxdrv"
+        "${pkgs.kmod}/bin/modprobe vboxnetflt vboxdrv"
-				"${pkgs.kmod}/bin/modprobe vboxnetadp"
+        "${pkgs.kmod}/bin/modprobe vboxnetadp"
-			];
+      ];
-			postStop = "${pkgs.kmod}/bin/rmmod vboxnetflt vboxnetadp vboxdrv";
+      postStop = "${pkgs.kmod}/bin/rmmod vboxnetflt vboxnetadp vboxdrv";
-			wantedBy = pkgs.lib.mkForce [];
+      wantedBy = pkgs.lib.mkForce [ ];
-			serviceConfig.User = "root";
+      serviceConfig.User = "root";
-		};
+    };
-	};
+  };
 
-	age.secrets.runner-reg.file = ../../secrets/gitlab/myself-vbox-runner-reg.age;
+  age.secrets.runner-reg.file = ../../secrets/gitlab/myself-vbox-runner-reg.age;
 
-	services.gitlab-runner = {
+  services.gitlab-runner = {
-		enable = true;
+    enable = true;
-		settings.concurrent = 5;
+    settings.concurrent = 5;
-		services.vbox = {
+    services.vbox = {
-			executor = "shell";
+      executor = "shell";
-			limit = 5;
+      limit = 5;
-			authenticationTokenConfigFile = config.age.secrets.runner-reg.path;
+      authenticationTokenConfigFile = config.age.secrets.runner-reg.path;
-			environmentVariables = {
+      environmentVariables = {
-				EFI_DIR = "${pkgs.OVMF.fd}/FV/";
+        EFI_DIR = "${pkgs.OVMF.fd}/FV/";
-			};
+      };
-		};
+    };
-	};
+  };
 }

hosts/linode/default.nix

@@ -1,78 +1,79 @@
 { pkgs, lib, config, ... }:
 
 {
-	imports = [
+  imports = [
-		./git.nix
+    ./git.nix
-		./hardware-configuration.nix
+    ./hardware-configuration.nix
-		./podman.nix
+    ./podman.nix
-		./matrix.nix
+    ./matrix.nix
-		./nextcloud.nix
+    ./nextcloud.nix
-		./nginx.nix
+    ./nginx.nix
-		./postgres.nix
+    ./postgres.nix
-	];
+  ];
 
-	greg = {
+  greg = {
-		home = false;
+    home = false;
-		linode.enable = true;
+    linode.enable = true;
-		tailscale.enable = true;
+    tailscale.enable = true;
-	};
+  };
 
-	programs.ssh.extraConfig = lib.strings.concatStringsSep "\n" [
+  programs.ssh.extraConfig = lib.strings.concatStringsSep "\n" [
-		"Host chronicles.shire-zebra.ts.net"
+    "Host chronicles.shire-zebra.ts.net"
-		"    User backup"
+    "    User backup"
-		"    IdentityFile /etc/ssh/backup_ed25519"
+    "    IdentityFile /etc/ssh/backup_ed25519"
-		"    StrictHostKeyChecking no"
+    "    StrictHostKeyChecking no"
-		"    UserKnownHostsFile /dev/null"
+    "    UserKnownHostsFile /dev/null"
-	];
+  ];
 
-	networking = {
+  networking = {
-		networkmanager.enable = lib.mkForce false;
+    networkmanager.enable = lib.mkForce false;
-		hostName = "linode";
+    hostName = "linode";
-		domain = "thehellings.com";
+    domain = "thehellings.com";
-		nameservers = [
+    nameservers = [
-			"100.88.91.27"
+      "100.88.91.27"
-		];
+    ];
-	};
+  };
 
-	age.secrets.runner-deployer = {
+  age.secrets.runner-deployer = {
-		file = ../../secrets/gitlab/linode-deployer-runner-reg.age;
+    file = ../../secrets/gitlab/linode-deployer-runner-reg.age;
-		owner = "gitlab-runner";
+    owner = "gitlab-runner";
-	};
+  };
 
-	services.gitlab-runner = {
+  services.gitlab-runner = {
-		enable = true;
+    enable = true;
-		services.deployer = {
+    services.deployer = {
-			executor = "shell";
+      executor = "shell";
-			authenticationTokenConfigFile = config.age.secrets.runner-deployer.path;
+      authenticationTokenConfigFile = config.age.secrets.runner-deployer.path;
-		};
+    };
-	};
+  };
 
-	users.users.gitlab-runner = {
+  users.users.gitlab-runner = {
-		isSystemUser = true;
+    isSystemUser = true;
-		group = "gitlab-runner";
+    group = "gitlab-runner";
-	};
+  };
-	users.groups.gitlab-runner = {};
+  users.groups.gitlab-runner = { };
 
-	systemd.services."gitlab-runner".serviceConfig = {
+  systemd.services."gitlab-runner".serviceConfig = {
-		DynamicUser = lib.mkForce false;
+    DynamicUser = lib.mkForce false;
-		User = "gitlab-runner";
+    User = "gitlab-runner";
-	};
+  };
 
-	security.sudo.extraRules = [{
+  security.sudo.extraRules = [{
-		users = [ "gitlab-runner" ];
+    users = [ "gitlab-runner" ];
-		commands = [{
+    commands = [{
-			command = "/run/current-system/sw/bin/systemctl";
+      command = "/run/current-system/sw/bin/systemctl";
-			options = [ "NOPASSWD" ];
+      options = [ "NOPASSWD" ];
-		} {
+    }
-			command = "/run/current-system/sw/bin/podman";
+      {
-			options = [ "NOPASSWD" ];
+        command = "/run/current-system/sw/bin/podman";
-		}];
+        options = [ "NOPASSWD" ];
-	}];
+      }];
+  }];
 
-	environment.systemPackages = with pkgs; [
+  environment.systemPackages = with pkgs; [
-		bind
+    bind
-		graphviz
+    graphviz
-		nix-du
+    nix-du
-		pgloader
+    pgloader
-	];
+  ];
 }

hosts/linode/git.nix

@@ -1,44 +1,45 @@
 { config, pkgs, ... }:
 
 let
-	srcDomain = "src.thehellings.com";
+  srcDomain = "src.thehellings.com";
-	sshPort = 2222;
+  sshPort = 2222;
-in {
+in
-	greg.proxies."${srcDomain}" = {
+{
-		target = "http://git.thehellings.lan";
+  greg.proxies."${srcDomain}" = {
-		ssl = true;
+    target = "http://git.thehellings.lan";
-		genAliases = false;
+    ssl = true;
-		extraConfig = ''
+    genAliases = false;
-		proxy_set_header X-Forwarded-Proto https;
+    extraConfig = ''
-		proxy_set_header X-Forwarded-Ssl on;
+      		proxy_set_header X-Forwarded-Proto https;
-		'';
+      		proxy_set_header X-Forwarded-Ssl on;
-	};
+      		'';
-	greg.proxies."registry.thehellings.com" = {
+  };
-		target = "https://registry.thehellings.lan:5000";
+  greg.proxies."registry.thehellings.com" = {
-		ssl = true;
+    target = "https://registry.thehellings.lan:5000";
-		genAliases = false;
+    ssl = true;
-		extraConfig = "client_max_body_size 250m;";
+    genAliases = false;
-	};
+    extraConfig = "client_max_body_size 250m;";
+  };
 
-	networking.firewall.allowedTCPPorts = [ sshPort ];
+  networking.firewall.allowedTCPPorts = [ sshPort ];
 
-	services.haproxy = {
+  services.haproxy = {
-		enable = true;
+    enable = true;
-		config = builtins.concatStringsSep "\n" [
+    config = builtins.concatStringsSep "\n" [
-			"global"
+      "global"
-			"	daemon"
+      "	daemon"
-			"	maxconn 20"
+      "	maxconn 20"
 
-			"defaults"
+      "defaults"
-			"	timeout connect 500s"
+      "	timeout connect 500s"
-			"	timeout client 500s"
+      "	timeout client 500s"
-			"	timeout server 1h"
+      "	timeout server 1h"
 
-			"listen gitsshd"
+      "listen gitsshd"
-			"	bind *:${toString sshPort}"
+      "	bind *:${toString sshPort}"
-			"	timeout client 1h"
+      "	timeout client 1h"
-			"	mode tcp"
+      "	mode tcp"
-			"	server git-thehellings-lan git.thehellings.lan:22"
+      "	server git-thehellings-lan git.thehellings.lan:22"
-		];
+    ];
-	};
+  };
 }

hosts/linode/matrix.nix

@@ -4,59 +4,61 @@
 # register_new_matrix_user -k "B9EoPr2WV9hzwc7uL2Sx1JmvCeKDEOGCpB0uginQcQtEH4wzRtkSIdo7lltrjSQa" http://localhost:8448
 { config, pkgs, ... }:
 let
-	domain = "${config.networking.domain}";
+  domain = "${config.networking.domain}";
-	fqdn = "matrix.${domain}";
+  fqdn = "matrix.${domain}";
-	conn = "postgresql:///dendrite?sslmode=disable&host=/run/postgresql";
+  conn = "postgresql:///dendrite?sslmode=disable&host=/run/postgresql";
 in
 {
-	services.nginx = {
+  services.nginx = {
-		virtualHosts = {
+    virtualHosts = {
-			# Server the '.well-known' files to find the Matrix API server
+      # Server the '.well-known' files to find the Matrix API server
-			"${domain}" = {
+      "${domain}" = {
-				enableACME = true;
+        enableACME = true;
-				forceSSL = true;
+        forceSSL = true;
 
-				# This is needed so that servers contacting hellings.com can find
+        # This is needed so that servers contacting hellings.com can find
-				# the actual application server at matrix.thehellings.com
+        # the actual application server at matrix.thehellings.com
-				locations."= /.well-known/matrix/server".extraConfig =
+        locations."= /.well-known/matrix/server".extraConfig =
-					let
+          let
-						server = { "m.server" = "${fqdn}:443"; };
+            server = { "m.server" = "${fqdn}:443"; };
-					in ''
+          in
-add_header Content-Type application/json;
+          ''
-return 200 '${builtins.toJSON server}';
+            add_header Content-Type application/json;
-'';
+            return 200 '${builtins.toJSON server}';
+          '';
 
-				locations."= /.well-known/matrix/client".extraConfig =
+        locations."= /.well-known/matrix/client".extraConfig =
-					let
+          let
-						client = {
+            client = {
-							"m.homeserver" = { "base_url" = "https://${fqdn}"; };
+              "m.homeserver" = { "base_url" = "https://${fqdn}"; };
-							"m.identity_server" = { "base_url" = "https://vector.im"; };
+              "m.identity_server" = { "base_url" = "https://vector.im"; };
-						};
+            };
-					in ''
+          in
-add_header Content-Type application/json;
+          ''
-add_header Access-Control-Allow-Origin *;
+            add_header Content-Type application/json;
-return 200 '${builtins.toJSON client}';
+            add_header Access-Control-Allow-Origin *;
-'';
+            return 200 '${builtins.toJSON client}';
-			};
+          '';
+      };
 
-			# Reverse proxy in front of the actual Matrix server
+      # Reverse proxy in front of the actual Matrix server
-			"${fqdn}" = {
+      "${fqdn}" = {
-				enableACME = true;
+        enableACME = true;
-				forceSSL = true;
+        forceSSL = true;
 
-				# Not the appropriate place for the chat client
+        # Not the appropriate place for the chat client
-				locations."/".extraConfig = "return 404;";
+        locations."/".extraConfig = "return 404;";
 
-				locations."/_matrix" = {
+        locations."/_matrix" = {
-					proxyPass = "http://matrix.shire-zebra.ts.net:8448"; # Lacking the trailing / is correct
+          proxyPass = "http://matrix.shire-zebra.ts.net:8448"; # Lacking the trailing / is correct
-				};
+        };
-			};
+      };
-		};
+    };
-	};
+  };
 
-	# Open networking ports for the server
+  # Open networking ports for the server
-	networking.firewall = {
+  networking.firewall = {
-		enable = true;
+    enable = true;
-		allowedTCPPorts = [ 80 443 ];
+    allowedTCPPorts = [ 80 443 ];
-	};
+  };
 }

hosts/linode/nextcloud.nix

@@ -1,38 +1,38 @@
 { config, pkgs, ... }:
 
 {
-	age.secrets.nextcloudadmin.file = ../../secrets/nextcloudadmin.age;
+  age.secrets.nextcloudadmin.file = ../../secrets/nextcloudadmin.age;
-	age.secrets.nextcloudadmin.owner = "nextcloud";
+  age.secrets.nextcloudadmin.owner = "nextcloud";
 
-	services.nextcloud = {
+  services.nextcloud = {
-		enable = true;
+    enable = true;
-		package = pkgs.nextcloud29;
+    package = pkgs.nextcloud29;
-		appstoreEnable = true;
+    appstoreEnable = true;
-		hostName = "next.${config.networking.domain}";
+    hostName = "next.${config.networking.domain}";
-		https = true;
+    https = true;
-		config = {
+    config = {
-			adminpassFile = config.age.secrets.nextcloudadmin.path;
+      adminpassFile = config.age.secrets.nextcloudadmin.path;
-			adminuser = "greg";
+      adminuser = "greg";
-			dbhost = "/run/postgresql";
+      dbhost = "/run/postgresql";
-			dbtype = "pgsql";
+      dbtype = "pgsql";
-		};
+    };
-		settings = {
+    settings = {
-			default_phone_region = "US";
+      default_phone_region = "US";
-			overwriteprotocol = "https";
+      overwriteprotocol = "https";
-		};
+    };
-	};
+  };
 
-	services.nginx.virtualHosts."next.thehellings.com" = {
+  services.nginx.virtualHosts."next.thehellings.com" = {
-		forceSSL = true;
+    forceSSL = true;
-		enableACME = true;
+    enableACME = true;
-	};
+  };
 
-	# Otherwise nginx errors looking for the nextcloud sock file
+  # Otherwise nginx errors looking for the nextcloud sock file
-	systemd.services.nginx.after = [ "nextcloud.service" ];
+  systemd.services.nginx.after = [ "nextcloud.service" ];
 
-	greg.backup.jobs.nextcloud-bkup = {
+  greg.backup.jobs.nextcloud-bkup = {
-		src = "/var/lib/nextcloud";
+    src = "/var/lib/nextcloud";
-		dest = "nextcloud-backup";
+    dest = "nextcloud-backup";
-		id = "rbfco-rvmis";
+    id = "rbfco-rvmis";
-	};
+  };
 }

hosts/linode/nginx.nix

@@ -1,36 +1,36 @@
 { ... }:
 let
-	homepage = "127.0.0.1:30080";
+  homepage = "127.0.0.1:30080";
 in
 {
-	security.acme = {
+  security.acme = {
-		acceptTerms = true;
+    acceptTerms = true;
-		defaults.email = "greg.hellings@gmail.com";
+    defaults.email = "greg.hellings@gmail.com";
-	};
+  };
 
-	services.nginx = {
+  services.nginx = {
-		enable = true;
+    enable = true;
 
-		# If there are recommended settings, let's use them!
+    # If there are recommended settings, let's use them!
-		recommendedGzipSettings = true;
+    recommendedGzipSettings = true;
-		recommendedOptimisation = true;
+    recommendedOptimisation = true;
-		recommendedProxySettings = true;
+    recommendedProxySettings = true;
-		recommendedTlsSettings = true;
+    recommendedTlsSettings = true;
-	};
+  };
 
-	# Actually serve the content from here
+  # Actually serve the content from here
-	virtualisation.podman.enable = true;
+  virtualisation.podman.enable = true;
-	virtualisation.oci-containers = {
+  virtualisation.oci-containers = {
-		backend = "podman";
+    backend = "podman";
-		containers."homepage" = {
+    containers."homepage" = {
-			# needs explicit port to match what gitlab-runner sees when pulling
+      # needs explicit port to match what gitlab-runner sees when pulling
-			image = "registry.thehellings.com:443/greg/homepage/gregs-homepage:latest";
+      image = "registry.thehellings.com:443/greg/homepage/gregs-homepage:latest";
-			ports = [ "${homepage}:80" ];
+      ports = [ "${homepage}:80" ];
-		};
+    };
-	};
+  };
-	greg.proxies."thehellings.com" = {
+  greg.proxies."thehellings.com" = {
-		target = "http://${homepage}/";
+    target = "http://${homepage}/";
-		ssl = true;
+    ssl = true;
-		genAliases = false;
+    genAliases = false;
-	};
+  };
 }

hosts/linode/podman.nix

@@ -1,9 +1,9 @@
 { ... }:
 
 {
-	virtualisation.podman = {
+  virtualisation.podman = {
-		enable = true;
+    enable = true;
-		dockerCompat = true;
+    dockerCompat = true;
-		dockerSocket.enable = true;
+    dockerSocket.enable = true;
-	};
+  };
 }

hosts/linode/postgres.nix

@@ -1,63 +1,63 @@
 { config, pkgs, lib, ... }:
 
 {
-	environment.systemPackages = [
+  environment.systemPackages = [
-		pkgs.upgrade-pg-cluster
+    pkgs.upgrade-pg-cluster
-	];
+  ];
 
-	services.postgresql = {
+  services.postgresql = {
-		enable = true;
+    enable = true;
-		package = pkgs.postgresql_15;
+    package = pkgs.postgresql_15;
-		checkConfig = true;
+    checkConfig = true;
-		ensureDatabases = [
+    ensureDatabases = [
-			"nextcloud"
+      "nextcloud"
-		];
+    ];
-		#initialScript = pkgs.writeText "create-matrix-db.sql" ''
+    #initialScript = pkgs.writeText "create-matrix-db.sql" ''
-		#	CREATE ROLE "matrix-synapse" WITH LOGIN;
+    #	CREATE ROLE "matrix-synapse" WITH LOGIN;
-		#	CREATE DATABASE "synapse" WITH OWNER "matrix-synapse" TEMPLATE template0 LC_COLLATE = "C" LC_CTYPE = "C";
+    #	CREATE DATABASE "synapse" WITH OWNER "matrix-synapse" TEMPLATE template0 LC_COLLATE = "C" LC_CTYPE = "C";
-		#	GRANT ALL PRIVILEGES ON DATABASE "synapse" TO "matrix-synapse";
+    #	GRANT ALL PRIVILEGES ON DATABASE "synapse" TO "matrix-synapse";
-		#'';  # These are done manually in order to set the LC_COLLATE values properly
+    #'';  # These are done manually in order to set the LC_COLLATE values properly
-		ensureUsers = [ {
+    ensureUsers = [{
-			name = "nextcloud";
+      name = "nextcloud";
-			ensureDBOwnership = true;
+      ensureDBOwnership = true;
-		}  ];
+    }];
-		settings = {
+    settings = {
-			log_connections = true;
+      log_connections = true;
-			log_statement = "all";
+      log_statement = "all";
-			logging_collector = true;
+      logging_collector = true;
-			log_filename = "postgresql.log";
+      log_filename = "postgresql.log";
-		};
+    };
-		identMap = ''
+    identMap = ''
-root root postgres
+      root root postgres
-'';
+    '';
-	};
+  };
 
-	services.postgresqlBackup = {
+  services.postgresqlBackup = {
-		enable = true;
+    enable = true;
-		databases = [
+    databases = [
-			"nextcloud"
+      "nextcloud"
-		];
+    ];
-	};
+  };
 
-	services.logrotate = {
+  services.logrotate = {
-		enable = true;
+    enable = true;
-		settings = {
+    settings = {
-			postgresBackup = {
+      postgresBackup = {
-				enable = true;
+        enable = true;
-				files = "${config.services.postgresqlBackup.location}/*.gz";
+        files = "${config.services.postgresqlBackup.location}/*.gz";
-			};
+      };
-			postgresLog = {
+      postgresLog = {
-				enable = true;
+        enable = true;
-				files = "/var/lib/postgresql/*/log/*.log";
+        files = "/var/lib/postgresql/*/log/*.log";
-				compress = true;
+        compress = true;
-				compresscmd = "${pkgs.xz}/bin/xz";
+        compresscmd = "${pkgs.xz}/bin/xz";
-			};
+      };
-		};
+    };
-	};
+  };
 
-	greg.backup.jobs.greg-postgresql-backup = {
+  greg.backup.jobs.greg-postgresql-backup = {
-		src = config.services.postgresqlBackup.location;
+    src = config.services.postgresqlBackup.location;
-		dest = "linode-postgres";
+    dest = "linode-postgres";
-		id = "9pwvg-s257a";
+    id = "9pwvg-s257a";
-	};
+  };
 }

hosts/myself/ceph.nix

@@ -1,33 +1,34 @@
 { config, ... }:
 
 let
-	publicIp = (builtins.elemAt config.networking.interfaces.enp38s0.ipv4.addresses 0).address;
+  publicIp = (builtins.elemAt config.networking.interfaces.enp38s0.ipv4.addresses 0).address;
-	sanIp = (builtins.elemAt config.networking.interfaces.enp39s0.ipv4.addresses 0).address;
+  sanIp = (builtins.elemAt config.networking.interfaces.enp39s0.ipv4.addresses 0).address;
-	vip = (builtins.elemAt config.networking.interfaces.enp38s0.ipv4.addresses 1).address;
+  vip = (builtins.elemAt config.networking.interfaces.enp38s0.ipv4.addresses 1).address;
-	hostname = config.networking.hostName;
+  hostname = config.networking.hostName;
-	baseConfig = import ../../ceph/home.nix;
+  baseConfig = import ../../ceph/home.nix;
-in {
+in
-	services.ceph-benaco = baseConfig // {
+{
-		enable = false;
+  services.ceph-benaco = baseConfig // {
-		monitor = {
+    enable = false;
-			enable = false;
+    monitor = {
-			initialKeyring = ../../secrets/home.mon.keyring;
+      enable = false;
-			nodeName = hostname;
+      initialKeyring = ../../secrets/home.mon.keyring;
-			bindAddr = publicIp;
+      nodeName = hostname;
-			advertisedPublicAddr = vip;
+      bindAddr = publicIp;
-		};
+      advertisedPublicAddr = vip;
-		osdBindAddr = publicIp;
+    };
-		osdAdvertisedPublicAddr = publicIp;
+    osdBindAddr = publicIp;
-		osds = {
+    osdAdvertisedPublicAddr = publicIp;
-			osd1 = {
+    osds = {
-				enable = false;
+      osd1 = {
-				bootstrapKeyring = ../../secrets/home.osd-bootstrap.keyring;
+        enable = false;
-				id = 2;
+        bootstrapKeyring = ../../secrets/home.osd-bootstrap.keyring;
-				uuid = "73424b68-210b-415f-800f-8767babea625";
+        id = 2;
-				blockDevice = "/dev/disk/by-id/ata-ST12000NM0558_ZHZ5WM4L";
+        uuid = "73424b68-210b-415f-800f-8767babea625";
-				blockDeviceUdevRuleMatcher = ''KERNEL=="sdb"'';
+        blockDevice = "/dev/disk/by-id/ata-ST12000NM0558_ZHZ5WM4L";
-				clusterAddress = sanIp;
+        blockDeviceUdevRuleMatcher = ''KERNEL=="sdb"'';
-			};
+        clusterAddress = sanIp;
-		};
+      };
-	};
+    };
+  };
 }

hosts/myself/container-git.nix

@@ -1,195 +1,201 @@
-{ config, pkgs, lib, ... }: let
+{ config, pkgs, lib, ... }:
-	registryPort = 5000;
+let
-	vpnIp = "100.78.226.76";
+  registryPort = 5000;
-	containerIp = "192.168.200.2";
+  vpnIp = "100.78.226.76";
-in {
+  containerIp = "192.168.200.2";
-	age.secretsMountPoint = "/run/derp";
+in
-	age.secrets = let
+{
-		cfg = n: { file = ../../secrets/gitlab/${n}.age; owner = "gitlab"; group = "gitlab"; mode = "0444"; };
+  age.secretsMountPoint = "/run/derp";
-	in {
+  age.secrets =
-		gitlab-secret = cfg "secret";
+    let
-		gitlab-otp = cfg "otp";
+      cfg = n: { file = ../../secrets/gitlab/${n}.age; owner = "gitlab"; group = "gitlab"; mode = "0444"; };
-		gitlab-db = cfg "db";
+    in
-		gitlab-jws = cfg "jws";
+    {
-		gitlab-key = cfg "key";
+      gitlab-secret = cfg "secret";
-		gitlab-cert = cfg "cert";
+      gitlab-otp = cfg "otp";
+      gitlab-db = cfg "db";
+      gitlab-jws = cfg "jws";
+      gitlab-key = cfg "key";
+      gitlab-cert = cfg "cert";
 
-		minio_access_key_id = {
+      minio_access_key_id = {
-			file = ../../secrets/minio_access_key_id.age;
+        file = ../../secrets/minio_access_key_id.age;
-			owner = "gitlab";
+        owner = "gitlab";
-			group = "gitlab";
+        group = "gitlab";
-			mode = "0444";
+        mode = "0444";
-		};
+      };
-		minio_secret_access_key = {
+      minio_secret_access_key = {
-			file = ../../secrets/minio_secret_access_key.age;
+        file = ../../secrets/minio_secret_access_key.age;
-			owner = "gitlab";
+        owner = "gitlab";
-			group = "gitlab";
+        group = "gitlab";
-			mode = "0444";
+        mode = "0444";
-		};
+      };
-	};
+    };
 
-	networking.firewall.allowedTCPPorts = [ 80 registryPort ];
+  networking.firewall.allowedTCPPorts = [ 80 registryPort ];
 
-	greg.proxies = let
+  greg.proxies =
-		t = {
+    let
-			target = "http://unix:/run/gitlab/gitlab-workhorse.socket";
+      t = {
-			extraConfig = ''
+        target = "http://unix:/run/gitlab/gitlab-workhorse.socket";
-			proxy_set_header X-Forwarded-Proto https;
+        extraConfig = ''
-			proxy_set_header X-Forwarded-Ssl on;
+          			proxy_set_header X-Forwarded-Proto https;
-			'';
+          			proxy_set_header X-Forwarded-Ssl on;
-		};
+          			'';
-	in {
+      };
-		"${containerIp}" = t;
+    in
-		"${vpnIp}" = t;
+    {
-		"git.thehellings.lan" = t;
+      "${containerIp}" = t;
-	};
+      "${vpnIp}" = t;
+      "git.thehellings.lan" = t;
+    };
 
-	virtualisation.docker.enable = true;
+  virtualisation.docker.enable = true;
 
-	programs.ssh.extraConfig = lib.strings.concatStringsSep "\n" [
+  programs.ssh.extraConfig = lib.strings.concatStringsSep "\n" [
-		"Host nas"
+    "Host nas"
-		"    User backup"
+    "    User backup"
-		"    IdentityFile /etc/ssh/duplicity_ed25519"
+    "    IdentityFile /etc/ssh/duplicity_ed25519"
-		"    StrictHostKeyChecking no"
+    "    StrictHostKeyChecking no"
-		"    UserKnownHostsFile /dev/null"
+    "    UserKnownHostsFile /dev/null"
-	];
+  ];
 
-	greg.backup.jobs.nas-backup = {
+  greg.backup.jobs.nas-backup = {
-		src = "/var/gitlab/state/backup/";
+    src = "/var/gitlab/state/backup/";
-		dest = "gitlab";
+    dest = "gitlab";
-		id = "yha^-s45h";
+    id = "yha^-s45h";
-	};
+  };
 
-	services = {
+  services = {
-		gitlab = {
+    gitlab = {
-			enable = true;
+      enable = true;
-			backup = {
+      backup = {
-				keepTime = 288;
+        keepTime = 288;
-				startAt = [ "03:00" ];
+        startAt = [ "03:00" ];
-			};
+      };
-			host = "src.thehellings.com";
+      host = "src.thehellings.com";
-			https = true;
+      https = true;
-			port = 443;
+      port = 443;
-			extraConfig = {
+      extraConfig = {
-				gitlab = {
+        gitlab = {
-					trustedProxies = [ "100.109.86.8/32" ];
+          trustedProxies = [ "100.109.86.8/32" ];
-				};
+        };
-			};
+      };
-			initialRootEmail = "greg@thehellings.com";
+      initialRootEmail = "greg@thehellings.com";
-			initialRootPasswordFile = pkgs.writeText "initialRootPassword" "root_password";
+      initialRootPasswordFile = pkgs.writeText "initialRootPassword" "root_password";
-			pages = {
+      pages = {
-				enable = true;
+        enable = true;
-				settings.pages-domain = "pages.thehellings.com";
+        settings.pages-domain = "pages.thehellings.com";
-			};
+      };
-			puma = {
+      puma = {
-				threadsMax = 6;
+        threadsMax = 6;
-				threadsMin = 2;
+        threadsMin = 2;
-				workers = 6;
+        workers = 6;
-			};
+      };
-			redisUrl = "unix:${config.services.redis.servers.gitlab.unixSocket}";
+      redisUrl = "unix:${config.services.redis.servers.gitlab.unixSocket}";
-			registry = {
+      registry = {
-				enable = true;
+        enable = true;
-				certFile = config.age.secrets.gitlab-cert.path;
+        certFile = config.age.secrets.gitlab-cert.path;
-				keyFile = config.age.secrets.gitlab-key.path;
+        keyFile = config.age.secrets.gitlab-key.path;
-				externalAddress = "registry.thehellings.com";
+        externalAddress = "registry.thehellings.com";
-				externalPort = 443;
+        externalPort = 443;
-			};
+      };
-			secrets = {
+      secrets = {
-				secretFile = config.age.secrets.gitlab-secret.path;
+        secretFile = config.age.secrets.gitlab-secret.path;
-				otpFile    = config.age.secrets.gitlab-otp.path;
+        otpFile = config.age.secrets.gitlab-otp.path;
-				dbFile     = config.age.secrets.gitlab-db.path;
+        dbFile = config.age.secrets.gitlab-db.path;
-				jwsFile    = config.age.secrets.gitlab-jws.path;
+        jwsFile = config.age.secrets.gitlab-jws.path;
-			};
+      };
 
-			extraConfig = {
+      extraConfig = {
-				object_store = {
+        object_store = {
-					enabled = true;
+          enabled = true;
-					proxy_download = false;  # Tell them to reach out to object storage themselves!
+          proxy_download = false; # Tell them to reach out to object storage themselves!
-					connection = {
+          connection = {
-						provider = "AWS";
+            provider = "AWS";
-						endpoint = "http://s3.thehellings.lan:9000";
+            endpoint = "http://s3.thehellings.lan:9000";
-						region = "us-east-1";
+            region = "us-east-1";
-						aws_access_key_id = { _secret = config.age.secrets.minio_access_key_id.path; };
+            aws_access_key_id = { _secret = config.age.secrets.minio_access_key_id.path; };
-						aws_secret_access_key = { _secret = config.age.secrets.minio_secret_access_key.path; };
+            aws_secret_access_key = { _secret = config.age.secrets.minio_secret_access_key.path; };
-						path_style = true;  # True for MinIO
+            path_style = true; # True for MinIO
-						aws_signature_version = 2;
+            aws_signature_version = 2;
-					};
+          };
-					#storage_options = ...;
+          #storage_options = ...;
-					objects = builtins.listToAttrs ( builtins.map (x: lib.attrsets.nameValuePair x { bucket = "gitlab-${builtins.replaceStrings [ "_" ] [ "-" ] x}"; }) [
+          objects = builtins.listToAttrs (builtins.map (x: lib.attrsets.nameValuePair x { bucket = "gitlab-${builtins.replaceStrings [ "_" ] [ "-" ] x}"; }) [
-						"artifacts"
+            "artifacts"
-						"ci_secure_files"
+            "ci_secure_files"
-						"dependency_proxy"
+            "dependency_proxy"
-						"external_diffs"
+            "external_diffs"
-						"lfs"
+            "lfs"
-						"packages"
+            "packages"
-						"pages"
+            "pages"
-						"terraform_state"
+            "terraform_state"
-						"uploads"
+            "uploads"
-					]);
+          ]);
-				};
+        };
-			};
+      };
-		};
+    };
 
-		nginx.virtualHosts."gitlab.shire-zebra.ts.net" = {
+    nginx.virtualHosts."gitlab.shire-zebra.ts.net" = {
-			listen = [ {
+      listen = [{
-				addr = vpnIp;
+        addr = vpnIp;
-				port = registryPort;
+        port = registryPort;
-				ssl = true;
+        ssl = true;
-			} ];
+      }];
-			locations."/" = {
+      locations."/" = {
-				proxyPass = "http://127.0.0.1:5000/";
+        proxyPass = "http://127.0.0.1:5000/";
-				recommendedProxySettings = true;
+        recommendedProxySettings = true;
-			};
+      };
-			extraConfig = builtins.concatStringsSep "\n" [
+      extraConfig = builtins.concatStringsSep "\n" [
-				"ssl_certificate /etc/certs/gitlab.shire-zebra.ts.net.crt ;"
+        "ssl_certificate /etc/certs/gitlab.shire-zebra.ts.net.crt ;"
-				"ssl_certificate_key /etc/certs/gitlab.shire-zebra.ts.net.key ;"
+        "ssl_certificate_key /etc/certs/gitlab.shire-zebra.ts.net.key ;"
-				"client_max_body_size 250m;"
+        "client_max_body_size 250m;"
-			];
+      ];
-		};
+    };
 
-		# Fetch the SSL certificates for nginx to use
+    # Fetch the SSL certificates for nginx to use
-		cron = {
+    cron = {
-			enable = true;
+      enable = true;
-			systemCronJobs = [ "0 0 1 */2 * cd /etc/certs && tailscale cert gitlab.shire-zebra.ts.net && chown nginx * && systemctl reload nginx" ];
+      systemCronJobs = [ "0 0 1 */2 * cd /etc/certs && tailscale cert gitlab.shire-zebra.ts.net && chown nginx * && systemctl reload nginx" ];
-		};
+    };
 
-		postgresql = {
+    postgresql = {
-			enable = true;
+      enable = true;
-			checkConfig = true;
+      checkConfig = true;
-			ensureDatabases = [ "gitlab" ];
+      ensureDatabases = [ "gitlab" ];
-			ensureUsers = [ {
+      ensureUsers = [{
-				name = "gitlab";
+        name = "gitlab";
-				ensureDBOwnership = true;
+        ensureDBOwnership = true;
-			} ];
+      }];
-			settings = {
+      settings = {
-				log_connections = true;
+        log_connections = true;
-				log_statement = "all";
+        log_statement = "all";
-				logging_collector = true;
+        logging_collector = true;
-				log_filename = "postgresql.log";
+        log_filename = "postgresql.log";
-			};
+      };
-		};
+    };
 
-		redis.servers.gitlab = {
+    redis.servers.gitlab = {
-			enable = true;
+      enable = true;
-		};
+    };
-		resolved.enable = true;
+    resolved.enable = true;
-		openssh.enable = true;
+    openssh.enable = true;
-	};
+  };
 
-	# Do not start nginx until we have tailscaled up and running, so it can bind
+  # Do not start nginx until we have tailscaled up and running, so it can bind
-	# to the 100.* addresses
+  # to the 100.* addresses
-	systemd.services = {
+  systemd.services = {
-		nginx = rec {
+    nginx = rec {
-			after = [
+      after = [
-				"network-online.target"
+        "network-online.target"
-			];
+      ];
-			wants = after;
+      wants = after;
-			serviceConfig = {
+      serviceConfig = {
-				RestartMaxDelaySec = "30s";
+        RestartMaxDelaySec = "30s";
-				RestartSteps = "5";
+        RestartSteps = "5";
-			};
+      };
-		};
+    };
-		tailscaled.partOf = [ "network-online.target" ];
+    tailscaled.partOf = [ "network-online.target" ];
-	};
+  };
-	system.stateVersion = lib.mkForce "24.05";
+  system.stateVersion = lib.mkForce "24.05";
 }

hosts/myself/container-runner.nix

@@ -1,91 +1,92 @@
-{ inputs, name, extra ? {}, packages ? [], overlays }:
+{ inputs, name, extra ? { }, packages ? [ ], overlays }:
 
 ({ config, pkgs, lib, ... }:
 (
-lib.attrsets.recursiveUpdate {
+  lib.attrsets.recursiveUpdate
+  {
 
-	imports = [
+    imports = [
-		inputs.agenix.nixosModules.default
+      inputs.agenix.nixosModules.default
-		inputs.self.modules.nixosModule
+      inputs.self.modules.nixosModule
-	];
+    ];
 
-	nixpkgs.overlays = overlays;
+    nixpkgs.overlays = overlays;
 
-	greg.tailscale.enable = true;
+    greg.tailscale.enable = true;
 
-	age = {
+    age = {
-		identityPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
+      identityPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
-		secrets.runner-reg = {
+      secrets.runner-reg = {
-			file = ../../secrets/gitlab/myself-${name}-runner-reg.age;
+        file = ../../secrets/gitlab/myself-${name}-runner-reg.age;
-			owner = "gitlab-runner";
+        owner = "gitlab-runner";
-		};
+      };
-	};
+    };
 
-	environment.systemPackages = with pkgs; [
+    environment.systemPackages = with pkgs; [
-		curl
+      curl
-		gawk
+      gawk
-		git
+      git
-		unzip
+      unzip
-		xorriso
+      xorriso
-		wget
+      wget
-	] ++ packages;
+    ] ++ packages;
 
-	networking = {
+    networking = {
-		useHostResolvConf = pkgs.lib.mkForce false;
+      useHostResolvConf = pkgs.lib.mkForce false;
-		nameservers = [ "100.100.100.100" ];
+      nameservers = [ "100.100.100.100" ];
-	};
+    };
 
-	nixpkgs.config.allowUnfree = true;
+    nixpkgs.config.allowUnfree = true;
 
-	users.users.gitlab-runner = {
+    users.users.gitlab-runner = {
-		isSystemUser = true;
+      isSystemUser = true;
-		group = "kvm";
+      group = "kvm";
-		extraGroups = [ "kvm" ];
+      extraGroups = [ "kvm" ];
-	};
+    };
 
-	services = {
+    services = {
-		gitlab-runner = {
+      gitlab-runner = {
-			enable = true;
+        enable = true;
-			settings.concurrent = 5;
+        settings.concurrent = 5;
-			services = {
+        services = {
-				shell = {
+          shell = {
-					executor = "shell";
+            executor = "shell";
-					limit = 5;
+            limit = 5;
-					authenticationTokenConfigFile = config.age.secrets.runner-reg.path;
+            authenticationTokenConfigFile = config.age.secrets.runner-reg.path;
-					environmentVariables = {
+            environmentVariables = {
-						EFI_DIR = "${pkgs.OVMF.fd}/FV/";
+              EFI_DIR = "${pkgs.OVMF.fd}/FV/";
-						STORAGE_URL = "http://s3.thehellings.lan:9000";
+              STORAGE_URL = "http://s3.thehellings.lan:9000";
-					};
+            };
-				};
+          };
-			};
+        };
-		};
+      };
-		resolved.enable = true;
+      resolved.enable = true;
-	};
+    };
 
-	systemd.services.gitlab-runner = {
+    systemd.services.gitlab-runner = {
-		wants = [
+      wants = [
-			"network-online.target"
+        "network-online.target"
-			"systemd-resolved.service"
+        "systemd-resolved.service"
-		];
+      ];
-		after = [
+      after = [
-			"network.target"
+        "network.target"
-			"network-online.target"
+        "network-online.target"
-			"systemd-resolved.service"
+        "systemd-resolved.service"
-		];
+      ];
-		serviceConfig = {
+      serviceConfig = {
-			DevicePolicy = lib.mkForce "auto";
+        DevicePolicy = lib.mkForce "auto";
-			PrivateDevices = false;
+        PrivateDevices = false;
-			ProtectKernelModules = false;
+        ProtectKernelModules = false;
-			DevicesAllow = [ "/dev/kvm" "/dev/mem" ];
+        DevicesAllow = [ "/dev/kvm" "/dev/mem" ];
-			DynamicUser = lib.mkForce false;
+        DynamicUser = lib.mkForce false;
-			User = "root";
+        User = "root";
-			Group = "kvm";
+        Group = "kvm";
-		};
+      };
-	};
+    };
 
-	system.stateVersion = lib.mkForce "24.05";
+    system.stateVersion = lib.mkForce "24.05";
-}
+  }
 
-extra
+    extra
 )  # End of attrsets.recursiveUpdate
 )  # End of outter function wrapper

hosts/myself/default.nix

@@ -1,86 +1,87 @@
 { config, pkgs, lib, ... }:
 {
-	imports = [
+  imports = [
-		./ceph.nix
+    ./ceph.nix
-		./hardware-configuration.nix
+    ./hardware-configuration.nix
-		./git.nix
+    ./git.nix
-		./matrix.nix
+    ./matrix.nix
-		./minio.nix
+    ./minio.nix
-	];
+  ];
 
-	greg.tailscale.enable = true;
+  greg.tailscale.enable = true;
 
-	services = {
+  services = {
-		openssh.enable = true;
+    openssh.enable = true;
-	};
+  };
-	networking = {
+  networking = {
-		hostName = "myself";
+    hostName = "myself";
-		useDHCP = false;
+    useDHCP = false;
-		defaultGateway = {
+    defaultGateway = {
-			address = " 10.42.1.1";
+      address = " 10.42.1.1";
-			interface = "enp38s0";
+      interface = "enp38s0";
-		};
+    };
-		vlans = {
+    vlans = {
-			san = {
+      san = {
-				id = 616;
+        id = 616;
-				interface = "enp39s0";
+        interface = "enp39s0";
-			};
+      };
-		};
+    };
-		interfaces = {
+    interfaces = {
-			enp38s0 = {
+      enp38s0 = {
-				ipv4.addresses = [ {
+        ipv4.addresses = [{
-					address = "10.42.1.6";
+          address = "10.42.1.6";
-					prefixLength = 16;
+          prefixLength = 16;
-				} {
+        }
-					address = "10.42.100.1";
+          {
-					prefixLength = 16;
+            address = "10.42.100.1";
-				} ];
+            prefixLength = 16;
-			};
+          }];
-			san = {
+      };
-				ipv4.addresses = [ {
+      san = {
-					address = "10.201.1.1";
+        ipv4.addresses = [{
-					prefixLength = 24;
+          address = "10.201.1.1";
-				} ];
+          prefixLength = 24;
-			};
+        }];
-		};
+      };
-		nameservers = [
+    };
-			"10.42.1.5"
+    nameservers = [
-		];
+      "10.42.1.5"
-	};
+    ];
-	users = {
+  };
-		users = {
+  users = {
-			greg = {
+    users = {
-				extraGroups = [
+      greg = {
-					"kvm"
+        extraGroups = [
-					"sudo"
+          "kvm"
-					"wheel"
+          "sudo"
-				];
+          "wheel"
-				isNormalUser = true;
+        ];
-			};
+        isNormalUser = true;
-		};
+      };
-	};
+    };
-	system.stateVersion = lib.mkForce "24.05";
+  };
-	boot = {
+  system.stateVersion = lib.mkForce "24.05";
-		extraModprobeConfig = "options kvm_amd nested=1";
+  boot = {
-		supportedFilesystems = [ "ntfs" ];
+    extraModprobeConfig = "options kvm_amd nested=1";
-		loader = {
+    supportedFilesystems = [ "ntfs" ];
-			efi = {
+    loader = {
-				canTouchEfiVariables = true;
+      efi = {
-				efiSysMountPoint = "/boot";
+        canTouchEfiVariables = true;
-			};
+        efiSysMountPoint = "/boot";
-			systemd-boot = {
+      };
-				enable = true;
+      systemd-boot = {
-				configurationLimit = 10;
+        enable = true;
-			};
+        configurationLimit = 10;
-		};
+      };
-		binfmt.emulatedSystems = [
+    };
-			"aarch64-linux"
+    binfmt.emulatedSystems = [
-		];
+      "aarch64-linux"
-	};
+    ];
-	nixpkgs.config = {
+  };
-		allowUnfree = true;
+  nixpkgs.config = {
-		permittedInsecurePackages = [
+    allowUnfree = true;
-			"nodejs-16.20.2"
+    permittedInsecurePackages = [
-		];
+      "nodejs-16.20.2"
-	};
+    ];
+  };
 }

hosts/myself/git.nix

@@ -2,139 +2,142 @@
 
 let
 
-	gitlabStateDir = "/var/lib/gitlab";
+  gitlabStateDir = "/var/lib/gitlab";
 
-	container = input: (lib.attrsets.recursiveUpdate {
+  container = input: (lib.attrsets.recursiveUpdate
-		bindMounts."/etc/ssh".hostPath = "/etc/ssh";  # For agenix secrets
+    {
-		enableTun = true;
+      bindMounts."/etc/ssh".hostPath = "/etc/ssh"; # For agenix secrets
-		privateNetwork = true;
+      enableTun = true;
-	} input);
+      privateNetwork = true;
-in  {
+    }
-	networking = {
+    input);
-		firewall = {
+in
-			enable = true;
+{
-			allowedTCPPorts = [ 80 ];
+  networking = {
-		};
+    firewall = {
-		nat = {
+      enable = true;
-			enable = true;
+      allowedTCPPorts = [ 80 ];
-			internalInterfaces = [ "ve-+" ];
+    };
-			externalInterface  = "enp38s0";
+    nat = {
-		};
+      enable = true;
-	};
+      internalInterfaces = [ "ve-+" ];
+      externalInterface = "enp38s0";
+    };
+  };
 
-	greg.proxies."git.thehellings.lan" = {
+  greg.proxies."git.thehellings.lan" = {
-		target = "http://192.168.200.2";
+    target = "http://192.168.200.2";
-		extraConfig = ''
+    extraConfig = ''
-		proxy_set_header X-Forwarded-Proto https;
+      		proxy_set_header X-Forwarded-Proto https;
-		proxy_set_header X-Forwarded-Ssl on;
+      		proxy_set_header X-Forwarded-Ssl on;
-		'';
+      		'';
-	};
+  };
 
-	system.activationScripts.makeGitlabDir = lib.stringAfter [ "var" ] "mkdir -p ${gitlabStateDir} && touch ${gitlabStateDir}/touch";
+  system.activationScripts.makeGitlabDir = lib.stringAfter [ "var" ] "mkdir -p ${gitlabStateDir} && touch ${gitlabStateDir}/touch";
 
-	greg.containers.gitlab = {
+  greg.containers.gitlab = {
-		tailscale = true;
+    tailscale = true;
-		subnet = "200";
+    subnet = "200";
-		builder = (import ./container-git.nix);
+    builder = (import ./container-git.nix);
-	};
+  };
 
-	systemd.services = {
+  systemd.services = {
-		"gitlab-runner" = {
+    "gitlab-runner" = {
-			after = [ "container@github.service" ];
+      after = [ "container@github.service" ];
-			preStart = builtins.concatStringsSep "\n" [
+      preStart = builtins.concatStringsSep "\n" [
-				"${pkgs.kmod}/bin/modprobe kvm"
+        "${pkgs.kmod}/bin/modprobe kvm"
-				"${pkgs.kmod}/bin/modprobe kvm_amd"
+        "${pkgs.kmod}/bin/modprobe kvm_amd"
-			];
+      ];
-			postStop = builtins.concatStringsSep "\n" [
+      postStop = builtins.concatStringsSep "\n" [
-				"${pkgs.kmod}/bin/rmmod -f kvm_amd kvm"
+        "${pkgs.kmod}/bin/rmmod -f kvm_amd kvm"
-			];
+      ];
-			serviceConfig = {
+      serviceConfig = {
-				DevicePolicy = lib.mkForce "auto";
+        DevicePolicy = lib.mkForce "auto";
-				DevicesAllow = [ "/dev/kvm" "/dev/mem" ];
+        DevicesAllow = [ "/dev/kvm" "/dev/mem" ];
-				EnvironmentFile = config.age.secrets.docker-auth.path;
+        EnvironmentFile = config.age.secrets.docker-auth.path;
-				PermissionsStartOnly = "true";
+        PermissionsStartOnly = "true";
-				PrivateDevices = false;
+        PrivateDevices = false;
-				ProtectKernelModules = false;
+        ProtectKernelModules = false;
-			};
+      };
-		};
+    };
-	};
+  };
 
-	#####################################################################################
+  #####################################################################################
-	#################### Container Podman Runner ########################################
+  #################### Container Podman Runner ########################################
-	#####################################################################################
+  #####################################################################################
-	containers.gitlab-runner-shell = container {
+  containers.gitlab-runner-shell = container {
-		autoStart = true;
+    autoStart = true;
-		hostAddress = "192.168.203.1";
+    hostAddress = "192.168.203.1";
-		localAddress = "192.168.203.2";
+    localAddress = "192.168.203.2";
-		config = ((import ./container-runner.nix) {
+    config = ((import ./container-runner.nix) {
-			inherit inputs overlays;
+      inherit inputs overlays;
-			name = "shell";
+      name = "shell";
-			extra.virtualisation.podman.enable = true;
+      extra.virtualisation.podman.enable = true;
-		});
+    });
-	};
+  };
 
-	#####################################################################################
+  #####################################################################################
-	#################### Local Podman/Docker Runner #####################################
+  #################### Local Podman/Docker Runner #####################################
-	#####################################################################################
+  #####################################################################################
-	age.secrets.runner-reg.file = ../../secrets/gitlab/myself-podman-runner-reg.age;
+  age.secrets.runner-reg.file = ../../secrets/gitlab/myself-podman-runner-reg.age;
-	age.secrets.docker-auth.file = ../../secrets/gitlab/docker-auth.age;
+  age.secrets.docker-auth.file = ../../secrets/gitlab/docker-auth.age;
-	age.secrets.runner-qemu.file = ../../secrets/gitlab/myself-qemu-runner-reg.age;
+  age.secrets.runner-qemu.file = ../../secrets/gitlab/myself-qemu-runner-reg.age;
-	services.gitlab-runner = {
+  services.gitlab-runner = {
-		enable = true;
+    enable = true;
-		settings = {
+    settings = {
-			concurrent = 5;
+      concurrent = 5;
-		};
+    };
-		services = {
+    services = {
-			default = {
+      default = {
-				executor = "docker";
+        executor = "docker";
-				authenticationTokenConfigFile = config.age.secrets.runner-reg.path;
+        authenticationTokenConfigFile = config.age.secrets.runner-reg.path;
-				dockerImage = "gitlab.shire-zebra.ts.net:5000/greg/ci-images/fedora:latest";
+        dockerImage = "gitlab.shire-zebra.ts.net:5000/greg/ci-images/fedora:latest";
-				dockerAllowedImages = [
+        dockerAllowedImages = [
-					"alpine:*"
+          "alpine:*"
-					"debian:*"
+          "debian:*"
-					"docker:*"
+          "docker:*"
-					"fedora:*"
+          "fedora:*"
-					"python:*"
+          "python:*"
-					"ubuntu:*"
+          "ubuntu:*"
 
-					"hashicorp/*:*"
+          "hashicorp/*:*"
-					"koalaman/shellcheck:*"
+          "koalaman/shellcheck:*"
 
-					"registry.gitlab.com/gitlab-org/*"
+          "registry.gitlab.com/gitlab-org/*"
-					"registry.thehellings.com/*/*/*:*"
+          "registry.thehellings.com/*/*/*:*"
-					"gitlab.shire-zebra.ts.net:5000/*/*/*:*"
+          "gitlab.shire-zebra.ts.net:5000/*/*/*:*"
-				];
+        ];
-				dockerAllowedServices = [
+        dockerAllowedServices = [
-					"docker:*"
+          "docker:*"
-					"registry.thehellings.com/*/*/*:*"
+          "registry.thehellings.com/*/*/*:*"
-					"gitlab.shire-zebra.ts.net:5000/*/*/*:*"
+          "gitlab.shire-zebra.ts.net:5000/*/*/*:*"
-				];
+        ];
-				dockerPrivileged = true;
+        dockerPrivileged = true;
-				dockerVolumes = [
+        dockerVolumes = [
-					"/certs/client"
+          "/certs/client"
-					"/cache"
+          "/cache"
-				];
+        ];
-			};
+      };
-			qemu = {
+      qemu = {
-				executor = "shell";
+        executor = "shell";
-				limit = 5;
+        limit = 5;
-				authenticationTokenConfigFile = config.age.secrets.runner-qemu.path;
+        authenticationTokenConfigFile = config.age.secrets.runner-qemu.path;
-				environmentVariables = {
+        environmentVariables = {
-					EFI_DIR = "${pkgs.OVMF.fd}/FV/";
+          EFI_DIR = "${pkgs.OVMF.fd}/FV/";
-					STORAGE_URL = "http://s3.thehellings.lan:9000";
+          STORAGE_URL = "http://s3.thehellings.lan:9000";
-				};
+        };
-			};
+      };
-		};
+    };
-	};
+  };
-	virtualisation = {
+  virtualisation = {
-		docker.enable = true;
+    docker.enable = true;
-		oci-containers.backend = "docker";
+    oci-containers.backend = "docker";
-	};
+  };
-	environment.systemPackages = with pkgs; [
+  environment.systemPackages = with pkgs; [
-		curl
+    curl
-		gawk
+    gawk
-		git
+    git
-		unzip
+    unzip
-		wget
+    wget
-	];
+  ];
 }

hosts/myself/hardware-configuration.nix

@@ -4,48 +4,53 @@
 { config, lib, pkgs, modulesPath, ... }:
 
 {
-	imports =
+  imports =
-		[ (modulesPath + "/installer/scan/not-detected.nix")
+    [
-		];
+      (modulesPath + "/installer/scan/not-detected.nix")
+    ];
 
-	boot.initrd.availableKernelModules = [ "nvme" "xhci_pci" "ahci" "usb_storage" "usbhid" "sd_mod" "sr_mod" ];
+  boot.initrd.availableKernelModules = [ "nvme" "xhci_pci" "ahci" "usb_storage" "usbhid" "sd_mod" "sr_mod" ];
-	boot.initrd.kernelModules = [ ];
+  boot.initrd.kernelModules = [ ];
-	boot.kernelModules = [ "kvm-amd" ];
+  boot.kernelModules = [ "kvm-amd" ];
-	boot.extraModulePackages = [ ];
+  boot.extraModulePackages = [ ];
 
-	fileSystems."/" =
+  fileSystems."/" =
-		{ device = "/dev/disk/by-uuid/714744ca-dd9d-4713-b571-c6ccfbf56d79";
+    {
-			fsType = "btrfs";
+      device = "/dev/disk/by-uuid/714744ca-dd9d-4713-b571-c6ccfbf56d79";
-			options = [ "subvol=nixos" ];
+      fsType = "btrfs";
-		};
+      options = [ "subvol=nixos" ];
+    };
 
-	fileSystems."/home" =
+  fileSystems."/home" =
-		{ device = "/dev/disk/by-uuid/714744ca-dd9d-4713-b571-c6ccfbf56d79";
+    {
-			fsType = "btrfs";
+      device = "/dev/disk/by-uuid/714744ca-dd9d-4713-b571-c6ccfbf56d79";
-			options = [ "subvol=home" ];
+      fsType = "btrfs";
-		};
+      options = [ "subvol=home" ];
+    };
 
-	fileSystems."/boot" =
+  fileSystems."/boot" =
-		{ device = "/dev/disk/by-uuid/29E7-E20C";
+    {
-			fsType = "vfat";
+      device = "/dev/disk/by-uuid/29E7-E20C";
-		};
+      fsType = "vfat";
+    };
 
-	fileSystems."/myvol" = 
+  fileSystems."/myvol" =
-		{ device = "/dev/nvme0n1p1";
+    {
-			fsType = "btrfs";
+      device = "/dev/nvme0n1p1";
-		};
+      fsType = "btrfs";
+    };
 
-	swapDevices = [ ];
+  swapDevices = [ ];
 
-	# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
-	# (the default) this is the recommended approach. When using systemd-networkd it's
+  # (the default) this is the recommended approach. When using systemd-networkd it's
-	# still possible to use this option, but it's recommended to use it in conjunction
+  # still possible to use this option, but it's recommended to use it in conjunction
-	# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
-	networking.useDHCP = lib.mkDefault true;
+  networking.useDHCP = lib.mkDefault true;
-	# networking.interfaces.enp38s0.useDHCP = lib.mkDefault true;
+  # networking.interfaces.enp38s0.useDHCP = lib.mkDefault true;
-	# networking.interfaces.enp39s0.useDHCP = lib.mkDefault true;
+  # networking.interfaces.enp39s0.useDHCP = lib.mkDefault true;
-	# networking.interfaces.enp42s0f3u5u3c2.useDHCP = lib.mkDefault true;
+  # networking.interfaces.enp42s0f3u5u3c2.useDHCP = lib.mkDefault true;
 
-	nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
-	hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+  hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
 }

hosts/myself/matrix.nix

@@ -1,90 +1,91 @@
 { config, pkgs, inputs, lib, ... }:
 let
-	domain = "thehellings.com";
+  domain = "thehellings.com";
-	fqdn = "matrix.${domain}";
+  fqdn = "matrix.${domain}";
-	conn = "postgresql:///dendrite?sslmode=disable&host=/run/postgresql";
+  conn = "postgresql:///dendrite?sslmode=disable&host=/run/postgresql";
 in
 {
-	environment.systemPackages = with pkgs; [ upgrade-pg-cluster ];
+  environment.systemPackages = with pkgs; [ upgrade-pg-cluster ];
 
-	greg.containers.matrix = {
+  greg.containers.matrix = {
-		tailscale = true;
+    tailscale = true;
-		subnet = "204";
+    subnet = "204";
-		builder = { pkgs, config, ... }: {
+    builder = { pkgs, config, ... }: {
-			networking.firewall.allowedTCPPorts = [ config.services.dendrite.httpPort ];
+      networking.firewall.allowedTCPPorts = [ config.services.dendrite.httpPort ];
 
-			# Environment secrets
+      # Environment secrets
-			age = {
+      age = {
-				secrets.dendrite = {
+        secrets.dendrite = {
-					file = ../../secrets/dendrite.age;
+          file = ../../secrets/dendrite.age;
-					owner = "dendrite";
+          owner = "dendrite";
-				};
+        };
-				secrets.dendrite_key = {
+        secrets.dendrite_key = {
-					file = ../../secrets/dendrite_key.age;
+          file = ../../secrets/dendrite_key.age;
-					owner = "dendrite";
+          owner = "dendrite";
-				};
+        };
-			};
+      };
 
-			users.users.dendrite = {
+      users.users.dendrite = {
-				isSystemUser = true;
+        isSystemUser = true;
-				group = "dendrite";
+        group = "dendrite";
-			};
+      };
-			users.groups.dendrite = {};
+      users.groups.dendrite = { };
 
-			systemd.services.dendrite.serviceConfig = {
+      systemd.services.dendrite.serviceConfig = {
-				User = "dendrite";
+        User = "dendrite";
-			};
+      };
 
-			greg.databases.dendrite = {};
+      greg.databases.dendrite = { };
 
-			services.dendrite = {
+      services.dendrite = {
-				enable = true;
+        enable = true;
-				environmentFile = config.age.secrets.dendrite.path;
+        environmentFile = config.age.secrets.dendrite.path;
-				httpPort = 8448;
+        httpPort = 8448;
-				# Identify ourselves as the root of our own domain
+        # Identify ourselves as the root of our own domain
-				settings = (
+        settings = (
-				(builtins.listToAttrs (
+          (builtins.listToAttrs (
-					(map (x: { name = x; value = { database.connection_string = conn; }; }) [
+            (map (x: { name = x; value = { database.connection_string = conn; }; }) [
-						"app_service_api"
+              "app_service_api"
-						"federation_api"
+              "federation_api"
-						"key_server"
+              "key_server"
-						"media_api"
+              "media_api"
-						"mscs"
+              "mscs"
-						"relay_api"
+              "relay_api"
-						"room_server"
+              "room_server"
-						"sync_api"
+              "sync_api"
-					])
+            ])
-				) ) //
+          )) //
-				{
+          {
-					user_api.account_database.connection_string = conn;
+            user_api.account_database.connection_string = conn;
-					user_api.device_database.connection_string = conn;
+            user_api.device_database.connection_string = conn;
-					global = {
+            global = {
-						database = {
+              database = {
-							connection_string = conn;
+                connection_string = conn;
-							max_open_conns = 25;
+                max_open_conns = 25;
-							max_idle_conns = 5;
+                max_idle_conns = 5;
-							conn_max_lifetime = -1;
+                conn_max_lifetime = -1;
-						};
+              };
-						server_name = "thehellings.com";
+              server_name = "thehellings.com";
-						trusted_third_party_id_servers = [
+              trusted_third_party_id_servers = [
-							"matrix.org"
+                "matrix.org"
-							"vector.im"
+                "vector.im"
-							"jupiterbroadcasting.com"
+                "jupiterbroadcasting.com"
-						];
+              ];
-						# Generate this with {path-to-dendrite}/bin/generate-keys --private-key /etc/dendrite.pem
+              # Generate this with {path-to-dendrite}/bin/generate-keys --private-key /etc/dendrite.pem
-						private_key = config.age.secrets.dendrite_key.path;
+              private_key = config.age.secrets.dendrite_key.path;
-					};
+            };
-					client_api = {
+            client_api = {
-						registration_enabled = false;
+              registration_enabled = false;
-						registration_shared_secret = "\${REGISTRATION_SHARED_SECRET}";
+              registration_shared_secret = "\${REGISTRATION_SHARED_SECRET}";
-					};
+            };
-				});
+          }
-			};
+        );
+      };
 
-			systemd.services.dendrite = {
+      systemd.services.dendrite = {
-				after = [ "postgresql.service" ];
+        after = [ "postgresql.service" ];
-				requires = [ "postgresql.service" ];
+        requires = [ "postgresql.service" ];
-			};
+      };
-		};
+    };
-	};
+  };
 }

hosts/myself/minio.nix

@@ -1,32 +1,33 @@
 { config, pkgs, ... }:
 
 let
-	minioPort = 9000;
+  minioPort = 9000;
-	minioConsolePort = 9001;
+  minioConsolePort = 9001;
-in {
+in
-	environment.systemPackages = with pkgs; [
+{
-		minio-client
+  environment.systemPackages = with pkgs; [
-		xfsprogs
+    minio-client
-	];
+    xfsprogs
+  ];
 
-	greg.proxies."minio-01.thehellings.lan".target = "http://localhost:9000";
+  greg.proxies."minio-01.thehellings.lan".target = "http://localhost:9000";
 
-	fileSystems."/data/1" = {
+  fileSystems."/data/1" = {
-		device = "/dev/disk/by-id/wwn-0x5000c500c48728e9-part1";
+    device = "/dev/disk/by-id/wwn-0x5000c500c48728e9-part1";
-		fsType = "xfs";
+    fsType = "xfs";
-	};
+  };
 
-	networking.firewall.allowedTCPPorts = [
+  networking.firewall.allowedTCPPorts = [
-		minioPort
+    minioPort
-		minioConsolePort
+    minioConsolePort
-	];
+  ];
 
-	age.secrets.minio.file = ../../secrets/minio.age;
+  age.secrets.minio.file = ../../secrets/minio.age;
 
-	services.minio = {
+  services.minio = {
-		enable = true;
+    enable = true;
-		dataDir = [ "/data/1/minio" ];
+    dataDir = [ "/data/1/minio" ];
-		rootCredentialsFile = config.age.secrets.minio.path;
+    rootCredentialsFile = config.age.secrets.minio.path;
-		browser = true;
+    browser = true;
-	};
+  };
 }

hosts/wsl/default.nix

@@ -1,11 +1,11 @@
 { pkgs, ... }:
 
 {
-	wsl = {
+  wsl = {
-		enable = true;
+    enable = true;
-		wslConf.automount.root = "/mnt";
+    wslConf.automount.root = "/mnt";
-		defaultUser = "greg";
+    defaultUser = "greg";
-		startMenuLaunchers = true;
+    startMenuLaunchers = true;
-		nativeSystemd = true;
+    nativeSystemd = true;
-	};
+  };
 }

modules/baseline.nix

@@ -1,60 +1,60 @@
 { pkgs, lib, ... }:
 let
-	notDarwin = (! pkgs.stdenv.isDarwin);
+  notDarwin = (! pkgs.stdenv.isDarwin);
 in
 {
-    # Enable flakes
+  # Enable flakes
-    nix = {
+  nix = {
-        gc = {
+    gc = {
-            automatic = true;
+      automatic = true;
-            # Scheduling of them is different in nixos vs nix-darwin, so check for
+      # Scheduling of them is different in nixos vs nix-darwin, so check for
-            # the extra details there
+      # the extra details there
-            options = "--delete-older-than 30d";
+      options = "--delete-older-than 30d";
-        };
-
-        settings = {
-            experimental-features = "nix-command flakes";
-            keep-outputs = true;
-            keep-derivations = true;
-            min-free = (toString (1024 * 1024 * 1024) );
-            max-free = (toString (5 * 1024 * 1024 * 1024) );
-            substituters = [
-                "https://cache.garnix.io"
-                "https://ai.cachix.org"
-            ];
-            trusted-public-keys = [
-                "cache.garnix.io:CTFPyKSLcx5RMJKfLo5EEPUObbA78b0YQ2DTCJXqr9g="
-                "ai.cachix.org-1:N9dzRK+alWwoKXQlnn0H6aUx0lU/mspIoz8hMvGvbbc="
-            ];
-        };
     };
 
-    nixpkgs.config = {
+    settings = {
-        allowUnfree = true;
+      experimental-features = "nix-command flakes";
-        permittedInsecurePackages = [
+      keep-outputs = true;
-			"jitsi-meet-1.0.8043"
+      keep-derivations = true;
-		];
+      min-free = (toString (1024 * 1024 * 1024));
+      max-free = (toString (5 * 1024 * 1024 * 1024));
+      substituters = [
+        "https://cache.garnix.io"
+        "https://ai.cachix.org"
+      ];
+      trusted-public-keys = [
+        "cache.garnix.io:CTFPyKSLcx5RMJKfLo5EEPUObbA78b0YQ2DTCJXqr9g="
+        "ai.cachix.org-1:N9dzRK+alWwoKXQlnn0H6aUx0lU/mspIoz8hMvGvbbc="
+      ];
     };
+  };
 
-    # Base packages that need to be in all my hosts
+  nixpkgs.config = {
-    environment.systemPackages = with pkgs; [
+    allowUnfree = true;
-		agenix
+    permittedInsecurePackages = [
-		bitwarden-cli
+      "jitsi-meet-1.0.8043"
-		bmon
+    ];
-		diffutils
+  };
-		git
+
-		gnupatch
+  # Base packages that need to be in all my hosts
-		gregpy
+  environment.systemPackages = with pkgs; [
-		findutils
+    agenix
-		file
+    bitwarden-cli
-		hms # My own home manager switcher
+    bmon
-		htop
+    diffutils
-		iperf
+    git
-		killall
+    gnupatch
-		nano
+    gregpy
-		pciutils
+    findutils
-		pwgen
+    file
-		unzip
+    hms # My own home manager switcher
-		wget
+    htop
-	];
+    iperf
+    killall
+    nano
+    pciutils
+    pwgen
+    unzip
+    wget
+  ];
 }

modules/darwin/default.nix

@@ -1,26 +1,26 @@
-{...}:
+{ ... }:
 {
-    imports = [
+  imports = [
-        ../baseline.nix
+    ../baseline.nix
-    ];
+  ];
-    system.stateVersion = 4;
+  system.stateVersion = 4;
-    home-manager = {
+  home-manager = {
-        useGlobalPkgs = true;
+    useGlobalPkgs = true;
-        users."gregory.hellings" = import ../../home/home.nix;
+    users."gregory.hellings" = import ../../home/home.nix;
-        extraSpecialArgs = {
+    extraSpecialArgs = {
-            gnome = false;
+      gnome = false;
-            gui = false;
+      gui = false;
-            home = "/Users/gregory.hellings";
+      home = "/Users/gregory.hellings";
-        };
-    };
-    users.users."gregory.hellings".home = "/Users/gregory.hellings";
-    programs = {
-        zsh.enable = true;
-        bash.enable = true;
-    };
-    services.nix-daemon.enable = true;
-    nix = {
-        gc.interval.Hour = 24;
-        settings.auto-optimise-store = false;  # Darwin bugs?
     };
+  };
+  users.users."gregory.hellings".home = "/Users/gregory.hellings";
+  programs = {
+    zsh.enable = true;
+    bash.enable = true;
+  };
+  services.nix-daemon.enable = true;
+  nix = {
+    gc.interval.Hour = 24;
+    settings.auto-optimise-store = false; # Darwin bugs?
+  };
 }

modules/default.nix

@@ -1,7 +1,8 @@
 let
-	nixos = (import ./nixos);
+  nixos = (import ./nixos);
-	darwin = (import ./darwin);
+  darwin = (import ./darwin);
-in {
+in
-	nixosModule = nixos;
+{
-	darwinModule = darwin;
+  nixosModule = nixos;
+  darwinModule = darwin;
 }

modules/nixos/backup.nix

@@ -1,71 +1,74 @@
 { lib, config, pkgs, ... }:
 
 let
-	cfg = config.greg.backup;
+  cfg = config.greg.backup;
 
-	where = j: "${config.services.syncthing.dataDir}/${j.dest}";
+  where = j: "${config.services.syncthing.dataDir}/${j.dest}";
 
-	makeSyncFolders = name: job: {
+  makeSyncFolders = name: job: {
-		devices = [ "chronicles" ];
+    devices = [ "chronicles" ];
-		enable = true;
+    enable = true;
-		id = job.id;
+    id = job.id;
-		label = job.dest;
+    label = job.dest;
-		path = where job;
+    path = where job;
-		type = "sendonly";
+    type = "sendonly";
-	};
+  };
 
-	makeRestic = name: job: let
+  makeRestic = name: job:
-		who = "${config.services.syncthing.user}:${config.services.syncthing.group}";
+    let
-	in rec {
+      who = "${config.services.syncthing.user}:${config.services.syncthing.group}";
-		initialize = true;
+    in
-		passwordFile = config.age.secrets.restic-pw.path;
+    rec {
-		paths = [ job.src ];
+      initialize = true;
-		repository = where job;
+      passwordFile = config.age.secrets.restic-pw.path;
-		backupCleanupCommand = ''${pkgs.coreutils}/bin/chown -R ${who} "${repository}"'';
+      paths = [ job.src ];
-	};
+      repository = where job;
+      backupCleanupCommand = ''${pkgs.coreutils}/bin/chown -R ${who} "${repository}"'';
+    };
 
-in with lib; {
+in
-	options = {
+with lib; {
-		greg.backup = {
+  options = {
-			jobs = mkOption {
+    greg.backup = {
-				default = {};
+      jobs = mkOption {
+        default = { };
 
-				type = with types; attrsOf (submodule (
+        type = with types; attrsOf (submodule (
-					{ name, config, options, ... }:
+          { name, config, options, ... }:
-					{
+          {
-						options = {
+            options = {
-							src = mkOption {
+              src = mkOption {
-								type = types.str;
+                type = types.str;
-								description = "Local path (string form) to backup from";
+                description = "Local path (string form) to backup from";
-							};
+              };
 
-							dest = mkOption {
+              dest = mkOption {
-								type = types.str;
+                type = types.str;
-							};
+              };
 
-							id = mkOption {
+              id = mkOption {
-								type = types.str;
+                type = types.str;
-								description = "The unique folder ID for this";
+                description = "The unique folder ID for this";
-							};
+              };
-						};
+            };
-					}
+          }
-				));
+        ));
-			};
+      };
-		};
+    };
-	};
+  };
 
-	config = mkIf ( ( attrValues cfg.jobs ) != [] )
+  config = mkIf ((attrValues cfg.jobs) != [ ])
-	{
+    {
-		age.secrets = {
+      age.secrets = {
-			restic-pw.file = ../../secrets/restic-pw.age;
+        restic-pw.file = ../../secrets/restic-pw.age;
-			restic-env.file = ../../secrets/restic-env.age;
+        restic-env.file = ../../secrets/restic-env.age;
-		};
+      };
-		greg.syncthing = {
+      greg.syncthing = {
-			enable = true;
+        enable = true;
-		};
+      };
-		services = {
+      services = {
-			syncthing.settings.folders = mapAttrs makeSyncFolders cfg.jobs;
+        syncthing.settings.folders = mapAttrs makeSyncFolders cfg.jobs;
-			restic.backups = mapAttrs makeRestic cfg.jobs;
+        restic.backups = mapAttrs makeRestic cfg.jobs;
-		};
+      };
-	};
+    };
 }

modules/nixos/container.nix

@@ -1,76 +1,79 @@
 { config, lib, inputs, overlays, ... }:
 
 let
-	cfg = config.greg.containers;
+  cfg = config.greg.containers;
 
-	# Create a container with all our default settings
+  # Create a container with all our default settings
 
-	makeContainer = name: container: let
+  makeContainer = name: container:
-		agekey = "/etc/ssh/agenix_key";
+    let
-	in {
+      agekey = "/etc/ssh/agenix_key";
-		autoStart = true;
+    in
-		hostAddress = "192.168.${container.subnet}.1";
+    {
-		localAddress = "192.168.${container.subnet}.2";
+      autoStart = true;
-		privateNetwork = true;
+      hostAddress = "192.168.${container.subnet}.1";
-		bindMounts = {
+      localAddress = "192.168.${container.subnet}.2";
-			"${agekey}".hostPath = "/etc/ssh/ssh_host_ed25519_key";  # This is needed for agenix to 
+      privateNetwork = true;
-		};
+      bindMounts = {
-		enableTun = container.tailscale;
+        "${agekey}".hostPath = "/etc/ssh/ssh_host_ed25519_key"; # This is needed for agenix to 
-		config = { config, pkgs, ... }: {
+      };
-			imports = [
+      enableTun = container.tailscale;
-				inputs.agenix.nixosModules.default
+      config = { config, pkgs, ... }: {
-				inputs.self.modules.nixosModule
+        imports = [
-				container.builder
+          inputs.agenix.nixosModules.default
-			];
+          inputs.self.modules.nixosModule
+          container.builder
+        ];
 
-			nixpkgs.overlays = overlays;
+        nixpkgs.overlays = overlays;
 
-			networking = {
+        networking = {
-				firewall.enable = true;
+          firewall.enable = true;
-				useHostResolvConf = lib.mkForce false;
+          useHostResolvConf = lib.mkForce false;
-			};
+        };
 
-			age.identityPaths = [ agekey ];
+        age.identityPaths = [ agekey ];
 
-			greg.tailscale.enable = container.tailscale;
+        greg.tailscale.enable = container.tailscale;
-		};
+      };
-	};
+    };
-in {
+in
-	options.greg.containers = lib.mkOption {
+{
-		default = {};
+  options.greg.containers = lib.mkOption {
+    default = { };
 
-		type = with lib.types; attrsOf ( submodule (
+    type = with lib.types; attrsOf (submodule (
-			{
+      {
-				options = {
+        options = {
-					tailscale = lib.mkOption {
+          tailscale = lib.mkOption {
-						type = bool;
+            type = bool;
-						default = false;
+            default = false;
-						description = "Enable tailscale in the container";
+            description = "Enable tailscale in the container";
-					};
+          };
-					subnet = lib.mkOption {
+          subnet = lib.mkOption {
-						type = str;
+            type = str;
-						default = "200";
+            default = "200";
-					};
+          };
-					builder = lib.mkOption {
+          builder = lib.mkOption {
-						default = { ... }: {};
+            default = { ... }: { };
-						description = ''
+            description = ''
-							This needs to be a function, like the one for
+              							This needs to be a function, like the one for
-							a container's config. It will setup the core system above the
+              							a container's config. It will setup the core system above the
-							defaults set in this module.
+              							defaults set in this module.
-						'';
+              						'';
-						example = ''
+            example = ''
-							{ pkgs, config, lib, ... } :
+              							{ pkgs, config, lib, ... } :
-							{
+              							{
-								services.openssh.enable = true;
+              								services.openssh.enable = true;
-							}
+              							}
-						'';
+              						'';
-					};
+          };
-				};
+        };
-			}
+      }
-		));
+    ));
-	};
+  };
 
-	config = {
+  config = {
-		containers = builtins.mapAttrs makeContainer cfg;
+    containers = builtins.mapAttrs makeContainer cfg;
-	};
+  };
 }

modules/nixos/db.nix

@@ -1,63 +1,64 @@
 { config, lib, pkgs, ... }:
 
 let
-	cfg = config.greg.databases;
+  cfg = config.greg.databases;
-	dbs = (lib.attrNames cfg);
+  dbs = (lib.attrNames cfg);
-in {
+in
-	options.greg.databases = lib.mkOption {
+{
-		default = {};
+  options.greg.databases = lib.mkOption {
-		type = with lib.types; attrsOf ( submodule (
+    default = { };
-			{ name, config, options, ... }: {
+    type = with lib.types; attrsOf (submodule (
-				# Options reserved for future expansion
+      { name, config, options, ... }: {
-				options = {};
+        # Options reserved for future expansion
-			}
+        options = { };
-		));
+      }
-	};
+    ));
+  };
 
-	config = lib.mkIf ( dbs != [] ) {
+  config = lib.mkIf (dbs != [ ]) {
-		services = {
+    services = {
-			postgresql = {
+      postgresql = {
-				enable = true;
+        enable = true;
-				package = pkgs.postgresql_15;
+        package = pkgs.postgresql_15;
-				checkConfig = true;
+        checkConfig = true;
-				ensureDatabases = dbs;
+        ensureDatabases = dbs;
-				ensureUsers = map (db: { name = db; ensureDBOwnership = true; }) dbs;
+        ensureUsers = map (db: { name = db; ensureDBOwnership = true; }) dbs;
-				settings = {
+        settings = {
-					log_connections = true;
+          log_connections = true;
-					log_statement = "all";
+          log_statement = "all";
-					logging_collector = true;
+          logging_collector = true;
-					log_filename = "postgresql.log";
+          log_filename = "postgresql.log";
-				};
+        };
-				identMap = "root root postgres";
+        identMap = "root root postgres";
-			};
+      };
 
-			postgresqlBackup =  {
+      postgresqlBackup = {
-				enable = true;
+        enable = true;
-				databases = dbs;
+        databases = dbs;
-			};
+      };
 
-			logrotate = {
+      logrotate = {
-				enable = true;
+        enable = true;
-				settings = {
+        settings = {
-					postgresqlBackup = {
+          postgresqlBackup = {
-						enable = true;
+            enable = true;
-						files = "${config.services.postgresqlBackup.location}/*.gz";
+            files = "${config.services.postgresqlBackup.location}/*.gz";
-					};
+          };
-					postgresLog = {
+          postgresLog = {
-						enable = true;
+            enable = true;
-						files = "/var/lib/postgresql/*/log/*.log";
+            files = "/var/lib/postgresql/*/log/*.log";
-						compress = true;
+            compress = true;
-						compresscmd = "${pkgs.xz}/bin/xz";
+            compresscmd = "${pkgs.xz}/bin/xz";
-					};
+          };
-				};
+        };
-			};
+      };
 
-		};
+    };
 
-		greg.backup.jobs.greg-postgresql-backup = {
+    greg.backup.jobs.greg-postgresql-backup = {
-			src = config.services.postgresqlBackup.location;
+      src = config.services.postgresqlBackup.location;
-			dest = "database-${config.networking.hostName}";
+      dest = "database-${config.networking.hostName}";
-			id = "${config.networking.hostName}-postgres-backup";
+      id = "${config.networking.hostName}-postgres-backup";
-		};
+    };
-	};
+  };
 }

modules/nixos/default.nix

@@ -1,94 +1,96 @@
 { config, pkgs, inputs, lib, ... }:
 
 let
-	x = if builtins.hasAttr "xonsh-unwrapped" pkgs then
+  x =
-		pkgs.xonsh else
+    if builtins.hasAttr "xonsh-unwrapped" pkgs then
-		pkgs.xonsh.passthru.wrapper;
+      pkgs.xonsh else
-in {
+      pkgs.xonsh.passthru.wrapper;
-	imports = [
+in
-		../baseline.nix
+{
-		./backup.nix
+  imports = [
-		./ceph.nix
+    ../baseline.nix
-		./container.nix
+    ./backup.nix
-		./db.nix
+    ./ceph.nix
-		./gnome.nix
+    ./container.nix
-		./home.nix
+    ./db.nix
-		./kde.nix
+    ./gnome.nix
-		./kiwix-serve.nix
+    ./home.nix
-		./linode.nix
+    ./kde.nix
-		./print.nix
+    ./kiwix-serve.nix
-		./proxy.nix
+    ./linode.nix
-		./router.nix
+    ./print.nix
-		./rpi4.nix
+    ./proxy.nix
-		./sway.nix
+    ./router.nix
-		./syncthing.nix
+    ./rpi4.nix
-		./tailscale.nix
+    ./sway.nix
-		./vmdev.nix
+    ./syncthing.nix
-	];
+    ./tailscale.nix
+    ./vmdev.nix
+  ];
 
-	environment.sessionVariables.MOZ_ENABLE_WAYLAND = "0";
+  environment.sessionVariables.MOZ_ENABLE_WAYLAND = "0";
-	environment.systemPackages = with pkgs; [
+  environment.systemPackages = with pkgs; [
-		btrfs-progs
+    btrfs-progs
-		coreutils-full
+    coreutils-full
-		efibootmgr
+    efibootmgr
-		psmisc
+    psmisc
-		lshw
+    lshw
-		usbutils
+    usbutils
-		xfsprogs
+    xfsprogs
-	];
+  ];
 
-	system.stateVersion = "24.05";
+  system.stateVersion = "24.05";
 
-	nix = {
+  nix = {
-		gc.dates = "weekly";
+    gc.dates = "weekly";
-		settings.auto-optimise-store = true;
+    settings.auto-optimise-store = true;
-	};
+  };
 
-	# I am a fan of network manager, myself
+  # I am a fan of network manager, myself
-	networking = {
+  networking = {
-		search = [
+    search = [
-			"thehellings.lan"
+      "thehellings.lan"
-			"home"
+      "home"
-		];
+    ];
-		networkmanager.enable = true;
+    networkmanager.enable = true;
-	};
+  };
 
-	programs.xonsh = {
+  programs.xonsh = {
-		enable = true;
+    enable = true;
-		package = (x.override {
+    package = (x.override {
-			extraPackages = (ps: with ps; [
+      extraPackages = (ps: with ps; [
-				(ps.toPythonModule pkgs.pipenv)
+        (ps.toPythonModule pkgs.pipenv)
-				pyyaml
+        pyyaml
-				requests
+        requests
-				ruamel-yaml
+        ruamel-yaml
-				xonsh-apipenv
+        xonsh-apipenv
-				pkgs.nur.repos.xonsh-xontribs.xonsh-direnv
+        pkgs.nur.repos.xonsh-xontribs.xonsh-direnv
-				pkgs.nur.repos.xonsh-xontribs.xontrib-vox
+        pkgs.nur.repos.xonsh-xontribs.xontrib-vox
-			]);
+      ]);
-		});
+    });
-	};
+  };
 
-	# Enable the OpenSSH daemon for remote control
+  # Enable the OpenSSH daemon for remote control
-	services = {
+  services = {
-		openssh = {
+    openssh = {
-			enable = true;
+      enable = true;
-			settings.X11Forwarding = true;
+      settings.X11Forwarding = true;
-		};
+    };
-	};
+  };
 
-	# Define a user account. Don't forget to set a password with ‘passwd’.
+  # Define a user account. Don't forget to set a password with ‘passwd’.
-	users.users.greg = {
+  users.users.greg = {
-		isNormalUser = true;
+    isNormalUser = true;
-		createHome = true;
+    createHome = true;
-		extraGroups = [ "wheel" "networkmanager" ]; # Enable ‘sudo’ for the user.
+    extraGroups = [ "wheel" "networkmanager" ]; # Enable ‘sudo’ for the user.
-		shell = config.programs.xonsh.package;
+    shell = config.programs.xonsh.package;
-		openssh.authorizedKeys.keys = lib.strings.splitString "\n" (builtins.readFile ../../home/ssh/authorized_keys);
+    openssh.authorizedKeys.keys = lib.strings.splitString "\n" (builtins.readFile ../../home/ssh/authorized_keys);
-	};
+  };
 
-	i18n.defaultLocale = "en_US.UTF-8";
+  i18n.defaultLocale = "en_US.UTF-8";
 
-	console = {
+  console = {
-		font = "Lat2-Terminus16";
+    font = "Lat2-Terminus16";
-		keyMap = "us";
+    keyMap = "us";
-	};
+  };
 }

modules/nixos/gnome.nix

@@ -1,64 +1,65 @@
 { config, pkgs, lib, ... }:
 
 let
-	cfg = config.greg.gnome;
+  cfg = config.greg.gnome;
 
-in with lib; {
+in
-	options = {
+with lib; {
-		greg.gnome.enable = mkEnableOption "Enable my default Gnome3 setup";
+  options = {
-	};
+    greg.gnome.enable = mkEnableOption "Enable my default Gnome3 setup";
+  };
 
-	config = mkIf cfg.enable {
+  config = mkIf cfg.enable {
-		# Sets up a basic Gnome installation
+    # Sets up a basic Gnome installation
-		services = {
+    services = {
-			accounts-daemon.enable = true;
+      accounts-daemon.enable = true;
 
-			# Trackpad support
+      # Trackpad support
-			libinput.enable = true;
+      libinput.enable = true;
 
-			xserver = {
+      xserver = {
-				enable = true;
+        enable = true;
-				displayManager.gdm.enable = true;
+        displayManager.gdm.enable = true;
-				desktopManager.gnome.enable = true;
+        desktopManager.gnome.enable = true;
-				xkb.layout = "us";
+        xkb.layout = "us";
-			};
+      };
 
-			udev.packages = with pkgs; [
+      udev.packages = with pkgs; [
-				gnome-settings-daemon
+        gnome-settings-daemon
-			];
+      ];
 
-			pipewire.enable = true;
+      pipewire.enable = true;
 
-			# Enablement for Firefox
+      # Enablement for Firefox
-			gnome = {
+      gnome = {
-				gnome-browser-connector.enable = true;
+        gnome-browser-connector.enable = true;
-				#chrome-gnome-shell.enable = true;
+        #chrome-gnome-shell.enable = true;
-				sushi.enable = true;
+        sushi.enable = true;
-				gnome-online-accounts.enable = true;
+        gnome-online-accounts.enable = true;
-			};
+      };
-		};
+    };
 
-		programs.dconf.enable = true;
+    programs.dconf.enable = true;
-		xdg.portal = {
+    xdg.portal = {
-			enable = true;
+      enable = true;
-			wlr.enable = true;  # Enables screen sharing in Wayland
+      wlr.enable = true; # Enables screen sharing in Wayland
-		};
+    };
 
-		# Used by gsconnect
+    # Used by gsconnect
-		networking.firewall.allowedTCPPorts = [ 1716 ];
+    networking.firewall.allowedTCPPorts = [ 1716 ];
 
-		# Enable some Gnome plugins that I like
+    # Enable some Gnome plugins that I like
-		environment.systemPackages = with pkgs; [
+    environment.systemPackages = with pkgs; [
-			adwaita-icon-theme
+      adwaita-icon-theme
-			gnome-tweaks
+      gnome-tweaks
-			dconf-editor
+      dconf-editor
-			gnomeExtensions.appindicator
+      gnomeExtensions.appindicator
-			gnomeExtensions.clipboard-indicator
+      gnomeExtensions.clipboard-indicator
-			gnomeExtensions.dash-to-dock
+      gnomeExtensions.dash-to-dock
-			gnomeExtensions.gsconnect
+      gnomeExtensions.gsconnect
-			gnomeExtensions.stocks-extension
+      gnomeExtensions.stocks-extension
-			gnomeExtensions.tailscale-qs
+      gnomeExtensions.tailscale-qs
-			gnomeExtensions.vitals
+      gnomeExtensions.vitals
-		];
+    ];
-	};
+  };
 }

modules/nixos/home.nix

@@ -1,18 +1,19 @@
 { config, lib, ... }:
 
 let
-	cfg = config.greg.home;
+  cfg = config.greg.home;
 
-in with lib;
+in
+with lib;
 {
-	options.greg.home = mkOption {
+  options.greg.home = mkOption {
-		type = types.bool;
+    type = types.bool;
-		default = true;
+    default = true;
-		description = "Sets the device up to be part of my home network";
+    description = "Sets the device up to be part of my home network";
-	};
+  };
 
-	config = mkIf cfg {
+  config = mkIf cfg {
-		time.timeZone = "America/Chicago";
+    time.timeZone = "America/Chicago";
-		networking.domain = "thehellings.lan";
+    networking.domain = "thehellings.lan";
-	};
+  };
 }

modules/nixos/kde.nix

@@ -1,48 +1,49 @@
 { config, pkgs, lib, options, ... }:
 
 let
-	cfg = config.greg.kde;
+  cfg = config.greg.kde;
 
-in with lib; {
+in
-	options = {
+with lib; {
-		greg.kde.enable = mkEnableOption "Enable my default KDE setup";
+  options = {
-	};
+    greg.kde.enable = mkEnableOption "Enable my default KDE setup";
+  };
 
-	config = mkIf cfg.enable {
+  config = mkIf cfg.enable {
-		# Sets up a basic KDE installation
+    # Sets up a basic KDE installation
-		services = {
+    services = {
-			xserver = {
+      xserver = {
-				enable = true;
+        enable = true;
-				xkb.layout = "us";
+        xkb.layout = "us";
-				# Trackpad support
+        # Trackpad support
-				libinput.enable = true;
+        libinput.enable = true;
-			};
+      };
 
-			pipewire = {
+      pipewire = {
-				enable = true;
+        enable = true;
-				alsa.enable = true;
+        alsa.enable = true;
-				alsa.support32Bit = true;
+        alsa.support32Bit = true;
-				pulse.enable = true;
+        pulse.enable = true;
-			};
+      };
-		} // (optionalAttrs (builtins.hasAttr "plasma6" options.services.xserver.desktopManager) {
+    } // (optionalAttrs (builtins.hasAttr "plasma6" options.services.xserver.desktopManager) {
-			desktopManager.plasma6.enable = true;
+      desktopManager.plasma6.enable = true;
-			displayManager = {
+      displayManager = {
-				defaultSession = "plasma";
+        defaultSession = "plasma";
-				sddm.enable = true;
+        sddm.enable = true;
-			};
+      };
-		});
+    });
 
-		programs.dconf.enable = true;
+    programs.dconf.enable = true;
-		programs.sway.enable = true;  # Gives us Wayland
+    programs.sway.enable = true; # Gives us Wayland
-		xdg.portal = {
+    xdg.portal = {
-			enable = true;
+      enable = true;
-			wlr.enable = true;  # Enables screen sharing in Wayland
+      wlr.enable = true; # Enables screen sharing in Wayland
-		};
+    };
 
-		environment.systemPackages = with pkgs; [
+    environment.systemPackages = with pkgs; [
-			kalendar
+      kalendar
-			korganizer
+      korganizer
-			plasma-pa
+      plasma-pa
-		];
+    ];
-	};
+  };
 }

modules/nixos/kiwix-serve.nix

@@ -1,48 +1,49 @@
-{  config, pkgs, lib, ... }:
+{ config, pkgs, lib, ... }:
 
 let
-	cfg = config.services.kiwix-serve;
+  cfg = config.services.kiwix-serve;
-in with lib; {
+in
-	options.services.kiwix-serve = {
+with lib; {
-		enable = mkEnableOption "Enable the Kiwix web server";
+  options.services.kiwix-serve = {
+    enable = mkEnableOption "Enable the Kiwix web server";
 
-		port = mkOption {
+    port = mkOption {
-			type = types.int;
+      type = types.int;
-			default = 8888;
+      default = 8888;
-			description = "Port to serve the Kiwix HTTP service on";
+      description = "Port to serve the Kiwix HTTP service on";
-		};
+    };
 
-		path = mkOption {
+    path = mkOption {
-			type = types.str;
+      type = types.str;
-			default = "/var/lib/kiwix-serve/";
+      default = "/var/lib/kiwix-serve/";
-			description = "Path to Zim file(s) to serve";
+      description = "Path to Zim file(s) to serve";
-		};
+    };
 
-		proxy = mkOption {
+    proxy = mkOption {
-			type = types.str;
+      type = types.str;
-			default = "";
+      default = "";
-			description = ''Upstream proxy, if any, to configure with kiwix. Specify
+      description = ''Upstream proxy, if any, to configure with kiwix. Specify
 				host and port. E.g. "localhost:8080"
 			'';
-		};
+    };
-	};
+  };
 
-	config = mkIf cfg.enable {
+  config = mkIf cfg.enable {
-		environment.systemPackages = [
+    environment.systemPackages = [
-			pkgs.kiwix-tools
+      pkgs.kiwix-tools
-		];
+    ];
 
-		systemd.services.kiwix-serve = {
+    systemd.services.kiwix-serve = {
-			enable = true;
+      enable = true;
-			after = [ "network.service" ];
+      after = [ "network.service" ];
-			description = "Runs the kiwix-serve binary as a sysmted service";
+      description = "Runs the kiwix-serve binary as a sysmted service";
-			restartTriggers = [ pkgs.kiwix-tools ];
+      restartTriggers = [ pkgs.kiwix-tools ];
-			wantedBy = [ "multi-user.target" ];
+      wantedBy = [ "multi-user.target" ];
-			script = "${pkgs.kiwix-tools}/bin/kiwix-serve --port ${toString cfg.port} ${cfg.path}";
+      script = "${pkgs.kiwix-tools}/bin/kiwix-serve --port ${toString cfg.port} ${cfg.path}";
-			environment = {
+      environment = {
-				UPSTREAM_HOST = mkIf (cfg.proxy != "") cfg.proxy;
+        UPSTREAM_HOST = mkIf (cfg.proxy != "") cfg.proxy;
-				UPSTREAM_WIKI = mkIf (cfg.proxy != "") cfg.proxy;
+        UPSTREAM_WIKI = mkIf (cfg.proxy != "") cfg.proxy;
-			};
+      };
-		};
+    };
-	};
+  };
 }

modules/nixos/linode.nix

@@ -1,44 +1,45 @@
 { config, lib, pkgs, ... }:
 
 let
-	cfg = config.greg.linode;
+  cfg = config.greg.linode;
 
-in with lib;
+in
+with lib;
 {
-	options.greg.linode = {
+  options.greg.linode = {
-		enable = mkEnableOption "Set sensible defaults for a Linode host";
+    enable = mkEnableOption "Set sensible defaults for a Linode host";
 
-		bootTimeout = mkOption {
+    bootTimeout = mkOption {
-			type = types.int;
+      type = types.int;
-			default = 15;
+      default = 15;
-			description = "Set bootloader timeout in seconds.";
+      description = "Set bootloader timeout in seconds.";
-		};
+    };
-	};
+  };
 
-	config = mkIf cfg.enable {
+  config = mkIf cfg.enable {
-		# Enables connection over Linode consoles
+    # Enables connection over Linode consoles
-		boot.kernelParams = [ "console=ttyS0,19200n8" ];
+    boot.kernelParams = [ "console=ttyS0,19200n8" ];
-		boot.loader.grub = {
+    boot.loader.grub = {
-			device = "nodev";
+      device = "nodev";
-			extraConfig = ''
+      extraConfig = ''
-serial --speed=19200 --unit=0 --word=8 --parity=no --stop=1;
+        serial --speed=19200 --unit=0 --word=8 --parity=no --stop=1;
-terminal_input serial;
+        terminal_input serial;
-terminal_output serial;
+        terminal_output serial;
-'';
+      '';
-		};
+    };
 
-		# Tells grub to ignore partion-free device warnings, since we are on Linode
+    # Tells grub to ignore partion-free device warnings, since we are on Linode
-		boot.loader.timeout = 15;
+    boot.loader.timeout = 15;
 
-		networking.usePredictableInterfaceNames = false;  # Use old style eth0 names
+    networking.usePredictableInterfaceNames = false; # Use old style eth0 names
-		networking.useDHCP = false;
+    networking.useDHCP = false;
-		networking.interfaces.eth0.useDHCP = true;
+    networking.interfaces.eth0.useDHCP = true;
 
-		# Suggested diagnostic tools
+    # Suggested diagnostic tools
-		environment.systemPackages = with pkgs; [
+    environment.systemPackages = with pkgs; [
-			inetutils
+      inetutils
-			mtr
+      mtr
-			sysstat
+      sysstat
-		];
+    ];
-	};
+  };
 }

modules/nixos/print.nix

@@ -1,33 +1,34 @@
 { config, lib, pkgs, ... }:
 
 let
-	cfg = config.greg.print;
+  cfg = config.greg.print;
 
-in with lib;
+in
+with lib;
 {
-	options.greg.print.enable = mkOption {
+  options.greg.print.enable = mkOption {
-		type = types.bool;
+    type = types.bool;
-		default = true;
+    default = true;
-		description = "Configures the system to print with my home printer";
+    description = "Configures the system to print with my home printer";
-	};
+  };
 
-	config = mkIf cfg.enable {
+  config = mkIf cfg.enable {
-		# ipp://printer.thehellings.lan:631/ - generic postscript printer
+    # ipp://printer.thehellings.lan:631/ - generic postscript printer
-		services.printing = {
+    services.printing = {
-			enable = true;
+      enable = true;
-			drivers = with pkgs; [
+      drivers = with pkgs; [
-				gutenprint
+        gutenprint
-			] ++ (lib.optional pkgs.stdenv.isx86_64 gutenprintBin);
+      ] ++ (lib.optional pkgs.stdenv.isx86_64 gutenprintBin);
-		};
+    };
 
-		hardware.printers.ensurePrinters = [ {
+    hardware.printers.ensurePrinters = [{
-			name = "HomeLexmarkColorPrinter";
+      name = "HomeLexmarkColorPrinter";
-			location = "Home office";
+      location = "Home office";
-			deviceUri = "ipp://printer.thehellings.lan:631/";
+      deviceUri = "ipp://printer.thehellings.lan:631/";
-			model = "drv:///sample.drv/generic.ppd";
+      model = "drv:///sample.drv/generic.ppd";
-			ppdOptions = {
+      ppdOptions = {
-				PageSize = "Letter";
+        PageSize = "Letter";
-			};
+      };
-		} ];
+    }];
-	};
+  };
 }

modules/nixos/proxy.nix

@@ -1,87 +1,89 @@
 { config, lib, pkgs, ... }:
 
 let
-	cfg = config.greg.proxies;
+  cfg = config.greg.proxies;
 
-	alias = name: with builtins; head (split "\\." name);
+  alias = name: with builtins; head (split "\\." name);
 
-	makeHost = name: dest: {
+  makeHost = name: dest: {
-		forceSSL = dest.ssl;
+    forceSSL = dest.ssl;
-		enableACME = dest.ssl;
+    enableACME = dest.ssl;
-		locations."${dest.path}" = {
+    locations."${dest.path}" = {
-			proxyPass = dest.target;
+      proxyPass = dest.target;
-			extraConfig = ''
+      extraConfig = ''
-proxy_http_version 1.1;
+        proxy_http_version 1.1;
-proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Upgrade $http_upgrade;
-proxy_set_header Connection $connection_upgrade;
+        proxy_set_header Connection $connection_upgrade;
-'' + dest.extraConfig;
+      '' + dest.extraConfig;
-		};
+    };
-		serverAliases = lib.mkIf dest.genAliases [ "${alias name}" ];
+    serverAliases = lib.mkIf dest.genAliases [ "${alias name}" ];
-	};
+  };
 
-in with lib; {
+in
-	options = {
+with lib; {
-		greg.proxies = mkOption {
+  options = {
-			default = {};
+    greg.proxies = mkOption {
-			example = literalExpression ''
+      default = { };
-				{ host-name = {
+      example = literalExpression ''
-					target = proxyLocation;
+        				{ host-name = {
-					ssl = true;
+        					target = proxyLocation;
-				};
+        					ssl = true;
-			'';
+        				};
-			description = ''
+        			'';
-				Quick and simple Nginx proxy configurations.
+      description = ''
-				Use this to configure a very simple proxy that does not
+        				Quick and simple Nginx proxy configurations.
-				need any extra customization options other than SSL
+        				Use this to configure a very simple proxy that does not
-				enablement.
+        				need any extra customization options other than SSL
-			'';
+        				enablement.
+        			'';
 
-			type = with types; attrsOf (submodule (
+      type = with types; attrsOf (submodule (
-				{ name, config, options, ... }:
+        { name, config, options, ... }:
-				{
+        {
-					options = {
+          options = {
-						genAliases = mkOption {
+            genAliases = mkOption {
-							type = types.bool;
+              type = types.bool;
-							description = "Whether to auto-generate short alias name";
+              description = "Whether to auto-generate short alias name";
-							default = true;
+              default = true;
-						};
+            };
 
-						target = mkOption {
+            target = mkOption {
-							type = types.str;
+              type = types.str;
-							description = ''The destination that is being proxied.'';
+              description = ''The destination that is being proxied.'';
-							example = "http://localhost:8080";
+              example = "http://localhost:8080";
-						};
+            };
 
-						ssl = mkOption {
+            ssl = mkOption {
-							type = types.bool;
+              type = types.bool;
-							description = "Whether to enable SSL in front of the proxy";
+              description = "Whether to enable SSL in front of the proxy";
-							default = false;
+              default = false;
-						};
+            };
 
-						path = mkOption {
+            path = mkOption {
-							type = types.str;
+              type = types.str;
-							description = "The path prefix for this proxy";
+              description = "The path prefix for this proxy";
-							default = "/";
+              default = "/";
-						};
+            };
 
-						extraConfig = mkOption {
+            extraConfig = mkOption {
-							type = types.str;
+              type = types.str;
-							description = "Extra nginx config options";
+              description = "Extra nginx config options";
-							default = "";
+              default = "";
-						};
+            };
-					};
+          };
-				}));
+        }
-		};
+      ));
-	};
+    };
+  };
 
-	config.services.nginx = mkIf ( ( attrValues cfg ) != [] ) {
+  config.services.nginx = mkIf ((attrValues cfg) != [ ]) {
-		enable = true;
+    enable = true;
 
-		recommendedGzipSettings = true;
+    recommendedGzipSettings = true;
-		recommendedOptimisation = true;
+    recommendedOptimisation = true;
-		recommendedProxySettings = true;
+    recommendedProxySettings = true;
-		recommendedTlsSettings = true;
+    recommendedTlsSettings = true;
 
-		virtualHosts = mapAttrs makeHost cfg;
+    virtualHosts = mapAttrs makeHost cfg;
-	};
+  };
 }

modules/nixos/router.nix

@@ -1,93 +1,97 @@
 { config, lib, pkgs, ... }:
 
 let
-	names = mylist: (lib.strings.concatMapStringsSep "," (x: ''"${x}"'') mylist);
+  names = mylist: (lib.strings.concatMapStringsSep "," (x: ''"${x}"'') mylist);
-	# Pass the names of the wan/lan ports
+  # Pass the names of the wan/lan ports
-	nftConfig = {
+  nftConfig =
-		wan,
+    { wan
-		lan,
+    , lan
-		limitedLan ? [],
+    , limitedLan ? [ ]
-		openPorts ? [ "ssh" "67" "53" ],  # ssh, dhcpd, dns
+    , openPorts ? [ "ssh" "67" "53" ]
-		openUDPPorts ? [ "67" "53" ] # dhcpd, dns
+    , # ssh, dhcpd, dns
-	}: let
+      openUDPPorts ? [ "67" "53" ] # dhcpd, dns
-			lanList = names lan;
+    }:
-			allLan = names (lan ++ limitedLan);
+    let
-			wanName = names wan;
+      lanList = names lan;
-			portsString = lib.strings.concatMapStringsSep "\n" (x: "iifname { ${lanList}, \"tailscale0\" } tcp dport ${toString x} accept") openPorts;
+      allLan = names (lan ++ limitedLan);
-			udpPortsString = lib.strings.concatMapStringsSep "\n" (x: "iifname { ${lanList}, \"tailscale0\" } udp dport ${toString x} accept") openUDPPorts;
+      wanName = names wan;
-	in lib.strings.concatStringsSep "\n" [
+      portsString = lib.strings.concatMapStringsSep "\n" (x: "iifname { ${lanList}, \"tailscale0\" } tcp dport ${toString x} accept") openPorts;
-		"table ip filter {"
+      udpPortsString = lib.strings.concatMapStringsSep "\n" (x: "iifname { ${lanList}, \"tailscale0\" } udp dport ${toString x} accept") openUDPPorts;
-		"	chain output {"
+    in
-		"		type filter hook output priority 100; policy accept;"
+    lib.strings.concatStringsSep "\n" [
-		"	}"
+      "table ip filter {"
+      "	chain output {"
+      "		type filter hook output priority 100; policy accept;"
+      "	}"
 
-		"	chain input {"
+      "	chain input {"
-		"		type filter hook input priority 0; policy drop;"
+      "		type filter hook input priority 0; policy drop;"
 
-		"		iifname lo accept"
+      "		iifname lo accept"
-		portsString
+      portsString
-		udpPortsString
+      udpPortsString
-		"		iifname { ${lanList} } accept comment \"Allows LAN traffic and outgoing\""
+      "		iifname { ${lanList} } accept comment \"Allows LAN traffic and outgoing\""
-		"		iifname { ${wanName} } ct state { established, related } accept comment \"Allows existing connections\""
+      "		iifname { ${wanName} } ct state { established, related } accept comment \"Allows existing connections\""
-		"		iifname { ${wanName} } icmp type { echo-request, destination-unreachable, time-exceeded } counter accept comment \"Allow some ICMP traffic\""
+      "		iifname { ${wanName} } icmp type { echo-request, destination-unreachable, time-exceeded } counter accept comment \"Allow some ICMP traffic\""
-		"		iifname { ${wanName} } counter drop comment \"Drop other incoming traffic, and count how much\""
+      "		iifname { ${wanName} } counter drop comment \"Drop other incoming traffic, and count how much\""
-		"	}"
+      "	}"
-		"	chain forward {"
+      "	chain forward {"
-		"		type filter hook forward priority 0; policy drop;"
+      "		type filter hook forward priority 0; policy drop;"
-		"		iifname { ${allLan} } oifname { ${wanName} } accept comment \"Forward LAN to WAN\""
+      "		iifname { ${allLan} } oifname { ${wanName} } accept comment \"Forward LAN to WAN\""
-		"		iifname { ${wanName} } oifname { ${allLan} } ct state established, related accept comment \"Allow incoming established traffic\""
+      "		iifname { ${wanName} } oifname { ${allLan} } ct state established, related accept comment \"Allow incoming established traffic\""
-		"	}"
+      "	}"
-		"}"
+      "}"
 
-		"table ip nat {"
+      "table ip nat {"
-		"	chain postrouting {"
+      "	chain postrouting {"
-		"		type nat hook postrouting priority 100; policy accept;"
+      "		type nat hook postrouting priority 100; policy accept;"
-		"		oifname { ${wanName} } masquerade"
+      "		oifname { ${wanName} } masquerade"
-		"	}"
+      "	}"
-		"}"
+      "}"
 
-		"table ip6 filter {"
+      "table ip6 filter {"
-		"	chain input {"
+      "	chain input {"
-		"		type filter hook input priority 0; policy drop;"
+      "		type filter hook input priority 0; policy drop;"
-		"	}"
+      "	}"
-		"	chain forward {"
+      "	chain forward {"
-		"		type filter hook forward priority 0; policy drop;"
+      "		type filter hook forward priority 0; policy drop;"
-		"	}"
+      "	}"
-		"}"
+      "}"
-	];
+    ];
-	cfg = config.greg.router;
+  cfg = config.greg.router;
 
-in with lib; {
+in
-	options.greg.router = {
+with lib; {
-		enable = mkEnableOption "Enable NFTables and routing";
+  options.greg.router = {
-		wan = mkOption {
+    enable = mkEnableOption "Enable NFTables and routing";
-			type = (types.listOf types.str);
+    wan = mkOption {
-			description = "The name of the network interface that is the WAN connection";
+      type = (types.listOf types.str);
-		};
+      description = "The name of the network interface that is the WAN connection";
-		lan = mkOption {
+    };
-			type = (types.listOf types.str);
+    lan = mkOption {
-			description = "A list of all network interfaces that are considered LAN connections";
+      type = (types.listOf types.str);
-		};
+      description = "A list of all network interfaces that are considered LAN connections";
-		limited = mkOption {
+    };
-			type = (types.listOf types.str);
+    limited = mkOption {
-			description = "A list of limited access LAN connections - such as IOT connections and similar.";
+      type = (types.listOf types.str);
-			default = [];
+      description = "A list of limited access LAN connections - such as IOT connections and similar.";
-		};
+      default = [ ];
-	};
+    };
+  };
 
-	config = mkIf cfg.enable {
+  config = mkIf cfg.enable {
-		networking.nftables = {
+    networking.nftables = {
-			enable = true;
+      enable = true;
-			ruleset = (nftConfig {
+      ruleset = (nftConfig {
-				inherit (cfg) lan wan;
+        inherit (cfg) lan wan;
-				openPorts = config.networking.firewall.allowedTCPPorts;
+        openPorts = config.networking.firewall.allowedTCPPorts;
-				openUDPPorts = config.networking.firewall.allowedUDPPorts;
+        openUDPPorts = config.networking.firewall.allowedUDPPorts;
-			});
+      });
-		};
+    };
 
-		environment.systemPackages = [
+    environment.systemPackages = [
-			pkgs.pciutils
+      pkgs.pciutils
-			pkgs.tcpdump
+      pkgs.tcpdump
-		];
+    ];
-	};
+  };
 }

modules/nixos/rpi4.nix

@@ -1,43 +1,44 @@
 { config, lib, pkgs, ... }:
 
 let
-	cfg = config.greg.rpi4;
+  cfg = config.greg.rpi4;
 
-in with lib; {
+in
-	options = {
+with lib; {
-		greg.rpi4 = {
+  options = {
-			enable = mkEnableOption "Enable support for Raspberry Pi 4s";
+    greg.rpi4 = {
-		};
+      enable = mkEnableOption "Enable support for Raspberry Pi 4s";
-	};
+    };
+  };
 
-	config = mkIf cfg.enable {
+  config = mkIf cfg.enable {
-		boot = {
+    boot = {
-			# This prevents us from having to compile our own kernel
+      # This prevents us from having to compile our own kernel
-			kernelPackages = pkgs.linuxPackages_rpi4;
+      kernelPackages = pkgs.linuxPackages_rpi4;
-			kernelParams = [
+      kernelParams = [
-				"8250.nr_uarts=1"
+        "8250.nr_uarts=1"
-				"console=ttyAMA0,115200"
+        "console=ttyAMA0,115200"
-				"console=tty1"
+        "console=tty1"
-				"cma=128M"
+        "cma=128M"
-			];
+      ];
 
-			loader = {
+      loader = {
-				raspberryPi = {
+        raspberryPi = {
-					enable = true;
+          enable = true;
-					version = 4;
+          version = 4;
-				};
+        };
 
-				# Use the extlinux boot loader. (NixOS wants to enable GRUB by default)
+        # Use the extlinux boot loader. (NixOS wants to enable GRUB by default)
-				grub.enable = false;
+        grub.enable = false;
 
-				# Enables the generation of /boot/extlinux/extlinux.conf
+        # Enables the generation of /boot/extlinux/extlinux.conf
-				#generic-extlinux-compatible.enable = true;
+        #generic-extlinux-compatible.enable = true;
-			};
+      };
-		};
+    };
 
-		environment.systemPackages = with pkgs; [
+    environment.systemPackages = with pkgs; [
-			raspberrypifw
+      raspberrypifw
-			usbutils
+      usbutils
-		];
+    ];
-	};
+  };
 }

modules/nixos/sway.nix

@@ -1,42 +1,43 @@
 { config, pkgs, lib, ... }:
 
 let
-	cfg = config.greg.sway;
+  cfg = config.greg.sway;
 
-in with lib; {
+in
-	options = {
+with lib; {
-		greg.sway.enable = mkEnableOption "Enable my default Gnome3 setup";
+  options = {
-	};
+    greg.sway.enable = mkEnableOption "Enable my default Gnome3 setup";
+  };
 
-	config = mkIf cfg.enable {
+  config = mkIf cfg.enable {
-		services = {
+    services = {
-			accounts-daemon.enable = true;
+      accounts-daemon.enable = true;
 
-			pipewire = {
+      pipewire = {
-				enable = true;
+        enable = true;
-				alsa.enable = true;
+        alsa.enable = true;
-				audio.enable = true;
+        audio.enable = true;
-				jack.enable = true;
+        jack.enable = true;
-				pulse.enable = true;
+        pulse.enable = true;
-				wireplumber.enable = true;
+        wireplumber.enable = true;
-			};
+      };
 
-			xserver = {
+      xserver = {
-				enable = true;
+        enable = true;
-				displayManager.gdm = {
+        displayManager.gdm = {
-					enable = true;
+          enable = true;
-					autoSuspend = false;
+          autoSuspend = false;
-					banner = "Welcome to Greg's JUDE machine. Do I know you?";
+          banner = "Welcome to Greg's JUDE machine. Do I know you?";
-					wayland = true;
+          wayland = true;
-				};
+        };
-				xkb.layout = "us";
+        xkb.layout = "us";
-			};
+      };
-		};
+    };
 
-		programs.sway = {
+    programs.sway = {
-			enable = true;  # Will be enabled through home-manager
+      enable = true; # Will be enabled through home-manager
-			wrapperFeatures.gtk = true;
+      wrapperFeatures.gtk = true;
-		};
+    };
-		security.pam.services.swaylock = {};
+    security.pam.services.swaylock = { };
-	};
+  };
 }

modules/nixos/syncthing.nix

@@ -1,29 +1,30 @@
 { config, lib, pkgs, ... }:
 
 let
-	cfg = config.greg.syncthing;
+  cfg = config.greg.syncthing;
-in with lib; {
+in
-	options.greg.syncthing = {
+with lib; {
-		enable = mkEnableOption "Setup my personal minimal configuration for Syncthing";
+  options.greg.syncthing = {
-	};
+    enable = mkEnableOption "Setup my personal minimal configuration for Syncthing";
+  };
 
-	config = mkIf cfg.enable {
+  config = mkIf cfg.enable {
-		services.syncthing = {
+    services.syncthing = {
-			enable = true;
+      enable = true;
-			overrideFolders = true;
+      overrideFolders = true;
-			overrideDevices = true;
+      overrideDevices = true;
-			settings = {
+      settings = {
-				devices = {
+        devices = {
-					chronicles.id = "7FI6Y3M-C7YQEDI-IB345L6-RKLXMB6-AEIV57Y-3J2RCXQ-MK6QRNK-EINPXAE";
+          chronicles.id = "7FI6Y3M-C7YQEDI-IB345L6-RKLXMB6-AEIV57Y-3J2RCXQ-MK6QRNK-EINPXAE";
-					genesis.id = "YDTH4SD-GUAC5AA-SSYWYPZ-YMJW5LK-LE7PZKJ-GV2UJFZ-CU7LZAD-GTYWCQK";
+          genesis.id = "YDTH4SD-GUAC5AA-SSYWYPZ-YMJW5LK-LE7PZKJ-GV2UJFZ-CU7LZAD-GTYWCQK";
-					gitlab.id = "VAG5GHP-L7TNY7O-CHR3CKU-GXXVCIL-OT3WHHU-E4VAIZC-JI4BKOM-PYZQOQS";
+          gitlab.id = "VAG5GHP-L7TNY7O-CHR3CKU-GXXVCIL-OT3WHHU-E4VAIZC-JI4BKOM-PYZQOQS";
-					linode.id = "IJMMXPR-WNALZBD-FMJH5W5-WV7XGJY-HLJTKGT-5TKHJIH-75LT56D-UUZCYQE";
+          linode.id = "IJMMXPR-WNALZBD-FMJH5W5-WV7XGJY-HLJTKGT-5TKHJIH-75LT56D-UUZCYQE";
-					matrix.id = "K5IHM3I-TJFFEW5-GAYJMPS-CYSHW5C-XHMC462-MFRMOHJ-EJLKIKC-CZHGJQ2";
+          matrix.id = "K5IHM3I-TJFFEW5-GAYJMPS-CYSHW5C-XHMC462-MFRMOHJ-EJLKIKC-CZHGJQ2";
-				};
+        };
-				options = {
+        options = {
-					urAccepted = -1;
+          urAccepted = -1;
-				};
+        };
-			};
+      };
-		};
+    };
-	};
+  };
 }

modules/nixos/tailscale.nix

@@ -1,18 +1,19 @@
 { lib, config, ... }:
 
 let
-	cfg = config.greg.tailscale;
+  cfg = config.greg.tailscale;
-in {
+in
-	options = {
+{
-		greg.tailscale.enable = lib.mkEnableOption "Enable Tailscale";
+  options = {
-	};
+    greg.tailscale.enable = lib.mkEnableOption "Enable Tailscale";
+  };
 
-	config = lib.mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
-		services.tailscale.enable = true;
+    services.tailscale.enable = true;
-		networking.firewall.checkReversePath = "loose";
+    networking.firewall.checkReversePath = "loose";
-		boot.kernel.sysctl = {
+    boot.kernel.sysctl = {
-			"net.ipv4.ip_forward" = "1";
+      "net.ipv4.ip_forward" = "1";
-			"net.ipv6.conf.all.forwarding" = "1";
+      "net.ipv6.conf.all.forwarding" = "1";
-		};
+    };
-	};
+  };
 }

modules/nixos/vmdev.nix

@@ -1,74 +1,75 @@
 { pkgs, lib, config, ... }:
 
 let
-	cfg = config.greg.vmdev;
+  cfg = config.greg.vmdev;
-in with lib;
+in
+with lib;
 {
-	options = {
+  options = {
-		greg.vmdev = {
+    greg.vmdev = {
-			enable = mkEnableOption "Enable this system for VM development work";
+      enable = mkEnableOption "Enable this system for VM development work";
-			user = mkOption {
+      user = mkOption {
-				default = "greg";
+        default = "greg";
-				type = types.str;
+        type = types.str;
-				description = "The user who will be doing VM dev";
+        description = "The user who will be doing VM dev";
-			};
+      };
-			system = mkOption {
+      system = mkOption {
-				default = "amd";
+        default = "amd";
-				type = types.str;
+        type = types.str;
-				description = "Kernel module type to install - amd, intel, etc";
+        description = "Kernel module type to install - amd, intel, etc";
-			};
+      };
-		};
+    };
-	};
+  };
 
-	config = mkIf cfg.enable {
+  config = mkIf cfg.enable {
-		environment.systemPackages = with pkgs; [
+    environment.systemPackages = with pkgs; [
-			dmidecode
+      dmidecode
-			guestfs-tools
+      guestfs-tools
-			libguestfs
+      libguestfs
-			OVMFFull
+      OVMFFull
-			packer
+      packer
-			virt-manager
+      virt-manager
-			xorriso
+      xorriso
-		];
+    ];
 
-		users.users."${cfg.user}".extraGroups = [ "libvirtd" ];
+    users.users."${cfg.user}".extraGroups = [ "libvirtd" ];
 
-		# Enable the virtualisation services
+    # Enable the virtualisation services
-		virtualisation = {
+    virtualisation = {
-			libvirtd = {
+      libvirtd = {
-				enable = true;
+        enable = true;
-				onBoot = "ignore";  # Do not auto-restart VMs on boot, unless they are marked autostart
+        onBoot = "ignore"; # Do not auto-restart VMs on boot, unless they are marked autostart
-				qemu.ovmf.enable = true;
+        qemu.ovmf.enable = true;
-			};
+      };
 
-			virtualbox.host = {
+      virtualbox.host = {
-				enable = true;
+        enable = true;
-				enableExtensionPack = true;
+        enableExtensionPack = true;
-			};
+      };
-		};
+    };
 
-		# Configuration for vbox user performance
+    # Configuration for vbox user performance
-		users.extraGroups.vboxusers.members = [ cfg.user ];
+    users.extraGroups.vboxusers.members = [ cfg.user ];
 
-		boot.extraModprobeConfig = "options kvm_${cfg.system} nested=1";
+    boot.extraModprobeConfig = "options kvm_${cfg.system} nested=1";
 
-		# Configure the services more
+    # Configure the services more
-		systemd.services = {
+    systemd.services = {
-			libvirtd = {
+      libvirtd = {
-				preStart = "${pkgs.kmod}/bin/modprobe kvm_${cfg.system}";
+        preStart = "${pkgs.kmod}/bin/modprobe kvm_${cfg.system}";
-				postStop = "${pkgs.kmod}/bin/rmmod kvm_${cfg.system} kvm";
+        postStop = "${pkgs.kmod}/bin/rmmod kvm_${cfg.system} kvm";
-				conflicts = [ "vbox.service" ];
+        conflicts = [ "vbox.service" ];
-			};
+      };
-			vbox = {
+      vbox = {
-				preStart = "${pkgs.kmod}/bin/modprobe vboxdrv vboxnetadp vboxnetflt";
+        preStart = "${pkgs.kmod}/bin/modprobe vboxdrv vboxnetadp vboxnetflt";
-				postStop = "${pkgs.kmod}/bin/rmmod vboxnetadp vboxnetflt vboxdrv";
+        postStop = "${pkgs.kmod}/bin/rmmod vboxnetadp vboxnetflt vboxdrv";
-				script = "echo Started";
+        script = "echo Started";
-				conflicts = [ "libvirtd.service" ];
+        conflicts = [ "libvirtd.service" ];
-				unitConfig = {
+        unitConfig = {
-					Type = "oneshot";
+          Type = "oneshot";
-					RemainAfterExit = "yes";
+          RemainAfterExit = "yes";
-				};
+        };
-			};
+      };
-		};
+    };
-	};
+  };
 }

overlays/aacs.nix

@@ -1,10 +1,10 @@
 { pkgs, ... }:
 
 pkgs.writeShellScriptBin "aacs" ''
-set -ex
+  set -ex
-[ ! -d "''${HOME}/.config/aacs" ] && mkdir -p "''${HOME}/.config/aacs"
+  [ ! -d "''${HOME}/.config/aacs" ] && mkdir -p "''${HOME}/.config/aacs"
-cd "''${HOME}/.config/aacs"
+  cd "''${HOME}/.config/aacs"
-[ -f KEYDB.cfg.zip ] && rm -f KEYDB.cfg.zip
+  [ -f KEYDB.cfg.zip ] && rm -f KEYDB.cfg.zip
-curl -L -o KEYDB.cfg.zip "http://fvonline-db.bplaced.net/fv_download.php?lang=eng"
+  curl -L -o KEYDB.cfg.zip "http://fvonline-db.bplaced.net/fv_download.php?lang=eng"
-${pkgs.unzip}/bin/unzip KEYDB.cfg.zip
+  ${pkgs.unzip}/bin/unzip KEYDB.cfg.zip
-mv keydb.cfg KEYDB.cfg''
+  mv keydb.cfg KEYDB.cfg''

overlays/create_ssl.nix

@@ -1,28 +1,28 @@
-{ writeShellScriptBin, openssl, ...}:
+{ writeShellScriptBin, openssl, ... }:
 
 writeShellScriptBin "create_ssl" ''
-set -e -o pipefail
+  set -e -o pipefail
-name="''${1}"
+  name="''${1}"
-root_key="''${2}"
+  root_key="''${2}"
 
-function usage {
+  function usage {
-	echo "USAGE: create_ssl <cert name> <root path>"
+  	echo "USAGE: create_ssl <cert name> <root path>"
-}
+  }
 
-if [ -z "''${name}" ]; then
+  if [ -z "''${name}" ]; then
-	usage
+  	usage
-	exit 1
+  	exit 1
-fi
+  fi
 
-if [ -z "''${root_key}" ]; then
+  if [ -z "''${root_key}" ]; then
-	usage
+  	usage
-	exit 1
+  	exit 1
-fi
+  fi
 
-# Create the certificate key
+  # Create the certificate key
-${openssl}/bin/openssl ecparam -out "''${name}.key" -name prime256v1 -genkey
+  ${openssl}/bin/openssl ecparam -out "''${name}.key" -name prime256v1 -genkey
-# Create the CSR
+  # Create the CSR
-${openssl}/bin/openssl req -name -sha256 -key "''${name}.key" -out "''${name}.csr"
+  ${openssl}/bin/openssl req -name -sha256 -key "''${name}.key" -out "''${name}.csr"
-# Sign it
+  # Sign it
-${openssl}/bin/openssl x509 -req -in "''${name}.csr" -CA "''${root_key}.crt" -CAkey "''${root_key}.key" -CAcreateserial -out "''${name}.crt" -days 3650 -sha256
+  ${openssl}/bin/openssl x509 -req -in "''${name}.csr" -CA "''${root_key}.crt" -CAkey "''${root_key}.key" -CAcreateserial -out "''${name}.crt" -days 3650 -sha256
 ''

overlays/default.nix

@@ -1,79 +1,83 @@
 final: prev:
 
 let
-	myPackages = pypackages: with pypackages; [
+  myPackages = pypackages: with pypackages; [
-		black
+    black
-		dateutil
+    dateutil
-		ipython
+    ipython
-		mypy
+    mypy
-		pylint
+    pylint
-		pyyaml
+    pyyaml
-		responses
+    responses
-		ruamel-yaml
+    ruamel-yaml
-		tox
+    tox
-		typing-extensions
+    typing-extensions
-		virtualenv
+    virtualenv
-	];
+  ];
 
-	myPython = prev.python312.withPackages myPackages;
+  myPython = prev.python312.withPackages myPackages;
-	macOver = file: og:
+  macOver = file: og:
-		if prev.stdenv.isDarwin then
+    if prev.stdenv.isDarwin then
-		(prev.callPackage file {}) else
+      (prev.callPackage file { }) else
-		prev."${og}";
+      prev."${og}";
 
-	buildFirefoxXpiAddon = final.nur.repos.rycee.lib.buildFirefoxXpiAddon;
+  buildFirefoxXpiAddon = final.nur.repos.rycee.lib.buildFirefoxXpiAddon;
 
-	is2405 = prev.lib.versionAtLeast prev.lib.version "24";
+  is2405 = prev.lib.versionAtLeast prev.lib.version "24";
 
-in rec {
+in
-	gregpy = myPython;
+rec {
+  gregpy = myPython;
 
-	## Testing adding python packages in the correct manner
+  ## Testing adding python packages in the correct manner
-	pythonPackagesExtensions = (prev.pythonPackagesExtensions or []) ++ [
+  pythonPackagesExtensions = (prev.pythonPackagesExtensions or [ ]) ++ [
-		(python-final: python-prev: let cp = python-final.callPackage; in {
+    (python-final: python-prev:
-			django-rapyd-modernauth = cp ./django-rapyd-modernauth.nix {};
+      let cp = python-final.callPackage; in {
-			graypy = cp ./graypy.nix {};
+        django-rapyd-modernauth = cp ./django-rapyd-modernauth.nix { };
-			itg-django-utils = cp ./itg-django-utils.nix {};
+        graypy = cp ./graypy.nix { };
-			xonsh-apipenv = cp ./xonsh-apipenv.nix {};
+        itg-django-utils = cp ./itg-django-utils.nix { };
-		})
+        xonsh-apipenv = cp ./xonsh-apipenv.nix { };
-	];
+      })
+  ];
 
-	# My own packages
+  # My own packages
-	aacs = prev.callPackage ./aacs.nix {};
+  aacs = prev.callPackage ./aacs.nix { };
-	create_ssl = prev.callPackage ./create_ssl.nix {};
+  create_ssl = prev.callPackage ./create_ssl.nix { };
-	enwiki-dump = prev.callPackage ./enwiki-dump.nix {};
+  enwiki-dump = prev.callPackage ./enwiki-dump.nix { };
-	hms = prev.callPackage ./hms {
+  hms = prev.callPackage ./hms {
-		pkgs = final.pkgs;
+    pkgs = final.pkgs;
-	};
+  };
-	inject = prev.callPackage ./inject.nix { inherit (final) pkgs; };
+  inject = prev.callPackage ./inject.nix { inherit (final) pkgs; };
-	inject-darwin = prev.callPackage ./inject-darwin.nix { inherit (final) pkgs; };
+  inject-darwin = prev.callPackage ./inject-darwin.nix { inherit (final) pkgs; };
-	setup-ssh = prev.callPackage ./setup-ssh {
+  setup-ssh = prev.callPackage ./setup-ssh {
-		pkgs = final.pkgs;
+    pkgs = final.pkgs;
-	};
+  };
-	upgrade-pg-cluster = prev.callPackage ./upgrade-pg-cluster.nix {};
+  upgrade-pg-cluster = prev.callPackage ./upgrade-pg-cluster.nix { };
 
-	# Overrides of packages
+  # Overrides of packages
-	brew = prev.callPackage ./homebrew.nix {};
+  brew = prev.callPackage ./homebrew.nix { };
-	copier = (if is2405 then prev.copier.overridePythonAttrs (old: {
+  copier = (if is2405 then
-		version = "9.1.0";
+    prev.copier.overridePythonAttrs
-		src = final.fetchFromGitHub {
+      (old: {
-			owner = "copier-org";
+        version = "9.1.0";
-			repo = "copier";
+        src = final.fetchFromGitHub {
-			rev = "v9.1.0";
+          owner = "copier-org";
-			hash = "sha256-x5r7Xv4lAOMkR+UIEeSY7LvbYMLpTWYuICYe9ygz1tA=";
+          repo = "copier";
-			postFetch = "rm $out/tests/demo/doc/ma*ana.txt";
+          rev = "v9.1.0";
-		};
+          hash = "sha256-x5r7Xv4lAOMkR+UIEeSY7LvbYMLpTWYuICYe9ygz1tA=";
-	}) else prev.copier);
+          postFetch = "rm $out/tests/demo/doc/ma*ana.txt";
-	libbluray-custom = prev.libbluray.override {
+        };
-		withAACS = true;
+      }) else prev.copier);
-		withBDplus = true;
+  libbluray-custom = prev.libbluray.override {
-	};
+    withAACS = true;
-	template = prev.callPackage ./template.nix { };
+    withBDplus = true;
-	handbrake = prev.handbrake.override {
+  };
-		libbluray = libbluray-custom;
+  template = prev.callPackage ./template.nix { };
-	};
+  handbrake = prev.handbrake.override {
-	libvirt-greg = prev.libvirt.overrideAttrs {
+    libbluray = libbluray-custom;
-		postInstall = prev.libvirt.postInstall + "rm -r $out/lib/systemd/system/libvirtd.service";
+  };
-	};
+  libvirt-greg = prev.libvirt.overrideAttrs {
-	pipenv-ivr = prev.callPackage ./pipenv.nix { };
+    postInstall = prev.libvirt.postInstall + "rm -r $out/lib/systemd/system/libvirtd.service";
+  };
+  pipenv-ivr = prev.callPackage ./pipenv.nix { };
 }