greg/nixos
1
0
Fork 1
Code Issues Pull Requests 2 Actions Packages Projects Releases Wiki Activity

A complete reformatting to match nixpkgs-fmt

Browse Source
This commit is contained in:
Greg Hellings
2024-10-03 11:26:39 -05:00
parent e2f0856102
commit 78c802d32c
114 changed files with 5246 additions and 5089 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.gitignore
+1
View File
@@ -1,2 +1,3 @@
host
result
.pre-commit-config.yaml
ceph/home.nix
+21 -19
View File
@@ -1,21 +1,23 @@
{
fsid = "749bf0ea-acf5-4a5e-b33e-9a057455c06b";
clusterName = "home";
initialMonitors = [ {
hostname = "myself.thehellings.lan";
ipAddress = "10.42.1.6";
} {
hostname = "jeremiah.thehellings.lan";
ipAddress = "10.42.1.8";
} {
hostname = "hosea.thehellings.lan";
ipAddress = "10.42.1.7";
} ];
mdsNodes = [ {
hostname = "jeremiah.thehellings.lan";
ipAddress = "10.42.1.8";
} ];
publicNetworks = [ "10.42.0.0/16" ];
clusterNetworks = [ "10.201.0.0/16" ];
adminKeyring = ../secrets/home.client.admin.keyring;
fsid = "749bf0ea-acf5-4a5e-b33e-9a057455c06b";
clusterName = "home";
initialMonitors = [{
hostname = "myself.thehellings.lan";
ipAddress = "10.42.1.6";
}
{
hostname = "jeremiah.thehellings.lan";
ipAddress = "10.42.1.8";
}
{
hostname = "hosea.thehellings.lan";
ipAddress = "10.42.1.7";
}];
mdsNodes = [{
hostname = "jeremiah.thehellings.lan";
ipAddress = "10.42.1.8";
}];
publicNetworks = [ "10.42.0.0/16" ];
clusterNetworks = [ "10.201.0.0/16" ];
adminKeyring = ../secrets/home.client.admin.keyring;
}
checks.nix
+6 -5
View File
@@ -1,9 +1,10 @@
{ hooks, system, ... }:
{
pre-commit-check = hooks.lib.${system}.run {
src = ./.;
hooks = {
};
};
pre-commit-check = hooks.lib.${system}.run {
src = ./.;
hooks = {
nixpkgs-fmt.enable = true;
};
};
}
configuration.nix
+3 -2
View File
@@ -6,7 +6,8 @@
{
imports =
[ # Include the results of the hardware scan.
[
# Include the results of the hardware scan.
./hardware-configuration.nix
./modules/
];
@@ -75,7 +76,7 @@
extraGroups = [ "networkmanager" "wheel" ];
packages = with pkgs; [
firefox
# thunderbird
# thunderbird
];
};
darwin-configuration.nix
+4 -4
View File
@@ -1,8 +1,8 @@
{ ... }:
{
imports = [
./modules
./hosts/work
];
imports = [
./modules
./hosts/work
];
}
darwin/default.nix
+32 -30
View File
@@ -1,33 +1,35 @@
{ inputs, overlays, ... }:
let
mac = {
system ? "aarch64-darwin",
name,
channel ? inputs.nixunstable,
hm ? inputs.hmunstable,
extraMods ? []
}:
let
nixpkgs = import channel {
inherit system overlays;
};
in inputs.darwin.lib.darwinSystem {
inherit system;
specialArgs = { inherit nixpkgs; };
modules = [
{
nixpkgs.overlays = overlays;
home-manager.extraSpecialArgs = {
inherit inputs;
host = name;
};
}
hm.darwinModules.home-manager
inputs.self.modules.darwinModule
./${name}
] ++ extraMods;
};
in rec {
la23002 = mac { name = "ivr"; };
LA23002 = la23002;
mac =
{ system ? "aarch64-darwin"
, name
, channel ? inputs.nixunstable
, hm ? inputs.hmunstable
, extraMods ? [ ]
}:
let
nixpkgs = import channel {
inherit system overlays;
};
in
inputs.darwin.lib.darwinSystem {
inherit system;
specialArgs = { inherit nixpkgs; };
modules = [
{
nixpkgs.overlays = overlays;
home-manager.extraSpecialArgs = {
inherit inputs;
host = name;
};
}
hm.darwinModules.home-manager
inputs.self.modules.darwinModule
./${name}
] ++ extraMods;
};
in
rec {
la23002 = mac { name = "ivr"; };
LA23002 = la23002;
}
flake.nix
+96 -93
View File
@@ -2,109 +2,112 @@
# your system. Help is available in the configuration.nix(5) man page
# and in the NixOS manual (accessible by running ‘nixos-help’).
{
description = "Greg's machines!";
description = "Greg's machines!";
inputs = {
agenix = {
url = "github:ryantm/agenix";
inputs.nixpkgs.follows = "nixunstable";
};
btc = {
url = "github:fort-nix/nix-bitcoin/release";
};
darwin = {
url = "github:lnl7/nix-darwin/master";
inputs.nixpkgs.follows = "nixunstable";
};
flake-parts.url = "github:hercules-ci/flake-parts";
hooks.url = "github:cachix/git-hooks.nix";
hm = {
url = "github:nix-community/home-manager/release-24.05";
inputs.nixpkgs.follows = "nixstable";
};
hmunstable = {
url = "github:nix-community/home-manager/master";
inputs.nixpkgs.follows = "nixstable";
};
nixvimstable.url = "github:nix-community/nixvim/nixos-24.05";
nixvimunstable.url = "github:nix-community/nixvim/main";
nix23_05.url = "github:NixOS/nixpkgs/nixos-23.05";
nixstable.url = "github:nixos/nixpkgs/nixos-24.05";
nixunstable.url = "github:nixos/nixpkgs/nixos-unstable";
nurpkgs.url = "github:nix-community/NUR";
vsext.url = "github:nix-community/nix-vscode-extensions";
wsl = {
url = "github:nix-community/NixOS-WSL";
inputs.nixpkgs.follows = "nixunstable";
};
zed.url = "github:zed-industries/zed/v0.154.x";
};
inputs = {
agenix = {
url = "github:ryantm/agenix";
inputs.nixpkgs.follows = "nixunstable";
};
btc = {
url = "github:fort-nix/nix-bitcoin/release";
};
darwin = {
url = "github:lnl7/nix-darwin/master";
inputs.nixpkgs.follows = "nixunstable";
};
flake-parts.url = "github:hercules-ci/flake-parts";
hooks.url = "github:cachix/git-hooks.nix";
hm = {
url = "github:nix-community/home-manager/release-24.05";
inputs.nixpkgs.follows = "nixstable";
};
hmunstable = {
url = "github:nix-community/home-manager/master";
inputs.nixpkgs.follows = "nixstable";
};
nixvimstable.url = "github:nix-community/nixvim/nixos-24.05";
nixvimunstable.url = "github:nix-community/nixvim/main";
nix23_05.url = "github:NixOS/nixpkgs/nixos-23.05";
nixstable.url = "github:nixos/nixpkgs/nixos-24.05";
nixunstable.url = "github:nixos/nixpkgs/nixos-unstable";
nurpkgs.url = "github:nix-community/NUR";
vsext.url = "github:nix-community/nix-vscode-extensions";
wsl = {
url = "github:nix-community/NixOS-WSL";
inputs.nixpkgs.follows = "nixunstable";
};
zed.url = "github:zed-industries/zed/v0.154.x";
};
outputs = { self, ...}@inputs: let
local_overlay = import ./overlays;
overlays = [
inputs.agenix.overlays.default
local_overlay
inputs.nurpkgs.overlay
inputs.vsext.overlays.default
(_: _: { zed-editor = inputs.zed.packages.x86_64-linux.default; } )
];
outputs = { self, ... }@inputs:
let
local_overlay = import ./overlays;
overlays = [
inputs.agenix.overlays.default
local_overlay
inputs.nurpkgs.overlay
inputs.vsext.overlays.default
(_: _: { zed-editor = inputs.zed.packages.x86_64-linux.default; })
];
in inputs.flake-parts.lib.mkFlake { inherit inputs; } {
systems = [ "x86_64-linux" "x86_64-darwin" "aarch64-linux" "aarch64-darwin" ];
#checks = {
# x86_64-linux = {
# unstable = self.nixosConfigurations.jude.config.system.build.toplevel;
# stable = self.nixosConfigurations.linode.config.system.build.toplevel;
# };
# aarch64-linux = {
# unstable = self.nixosConfigurations.nixos.config.system.build.toplevel;
# };
#};
in
inputs.flake-parts.lib.mkFlake { inherit inputs; } {
systems = [ "x86_64-linux" "x86_64-darwin" "aarch64-linux" "aarch64-darwin" ];
#checks = {
# x86_64-linux = {
# unstable = self.nixosConfigurations.jude.config.system.build.toplevel;
# stable = self.nixosConfigurations.linode.config.system.build.toplevel;
# };
# aarch64-linux = {
# unstable = self.nixosConfigurations.nixos.config.system.build.toplevel;
# };
#};
flake = {
nixosConfigurations = (import ./hosts { inherit inputs overlays; });
flake = {
nixosConfigurations = (import ./hosts { inherit inputs overlays; });
darwinConfigurations = (import ./darwin { inherit inputs overlays; });
darwinConfigurations = (import ./darwin { inherit inputs overlays; });
homeConfigurations = (import ./home { inherit inputs overlays; });
homeConfigurations = (import ./home { inherit inputs overlays; });
overlays = {
default = local_overlay;
};
overlays = {
default = local_overlay;
};
modules = import ./modules;
};
modules = import ./modules;
};
perSystem = { pkgs, system, ... }: {
_module.args.pkgs = import inputs.nixstable {
inherit system overlays;
};
perSystem = { pkgs, self', system, ... }: {
_module.args.pkgs = import inputs.nixstable {
inherit system overlays;
};
checks = import ./checks.nix { inherit system; inherit (inputs) hooks; };
checks = import ./checks.nix { inherit system; inherit (inputs) hooks; };
devShells = {
default = pkgs.mkShell {
buildInputs = with pkgs; [
bashInteractive
curl
git
gnutar
gzip
inject
inject-darwin
tmux
vim
xonsh
];
};
};
devShells = {
default = pkgs.mkShell {
inherit (self'.checks.pre-commit-check) shellHook;
buildInputs = with pkgs; [
bashInteractive
curl
git
gnutar
gzip
inject
inject-darwin
tmux
vim
xonsh
];
};
};
packages = rec {
defaullt = iso;
iso = self.nixosConfigurations.iso.config.system.build.isoImage;
iso-beta = self.nixosConfigurations.iso-beta.config.system.build.isoImage;
};
};
};
packages = rec {
defaullt = iso;
iso = self.nixosConfigurations.iso.config.system.build.isoImage;
iso-beta = self.nixosConfigurations.iso-beta.config.system.build.isoImage;
};
};
};
}
hardware-configuration.nix
+6 -3
View File
@@ -5,7 +5,8 @@
{
imports =
[ (modulesPath + "/installer/scan/not-detected.nix")
[
(modulesPath + "/installer/scan/not-detected.nix")
];
boot.initrd.availableKernelModules = [ "xhci_pci" "thunderbolt" "nvme" "uas" "sd_mod" ];
@@ -14,13 +15,15 @@
boot.extraModulePackages = [ ];
fileSystems."/" =
{ device = "/dev/disk/by-uuid/607b933f-2967-4652-b478-4d8e9aa38a0d";
{
device = "/dev/disk/by-uuid/607b933f-2967-4652-b478-4d8e9aa38a0d";
fsType = "btrfs";
options = [ "subvol=@" ];
};
fileSystems."/boot" =
{ device = "/dev/disk/by-uuid/B31C-C1F4";
{
device = "/dev/disk/by-uuid/B31C-C1F4";
fsType = "vfat";
};
home/default.nix
+21 -21
View File
@@ -1,26 +1,26 @@
{
inputs,
overlays,
...
{ inputs
, overlays
, ...
}:
rec {
greghellings =
let
system = "x86_64-linux";
pkgs = (import inputs.nixunstable { inherit system overlays; });
in inputs.hmunstable.lib.homeManagerConfiguration {
inherit pkgs;
modules = [ ./home.nix ];
extraSpecialArgs = {
inherit inputs;
nixvim = inputs.nixvimunstable;
gui = false;
gnome = false;
host = "ivr";
username = "gregory.hellings";
};
};
greghellings =
let
system = "x86_64-linux";
pkgs = (import inputs.nixunstable { inherit system overlays; });
in
inputs.hmunstable.lib.homeManagerConfiguration {
inherit pkgs;
modules = [ ./home.nix ];
extraSpecialArgs = {
inherit inputs;
nixvim = inputs.nixvimunstable;
gui = false;
gnome = false;
host = "ivr";
username = "gregory.hellings";
};
};
"gregory.hellings" = greghellings;
"gregory.hellings" = greghellings;
}
home/home.nix
+44 -42
View File
@@ -1,48 +1,50 @@
{ pkgs, lib,
host ? "most",
nixvim,
...}:
{ pkgs
, lib
, host ? "most"
, nixvim
, ...
}:
{
nixpkgs.config.allowUnfreePredicate = (_: true);
imports = [
nixvim.homeManagerModules.default
./modules
] ++ lib.optionals (builtins.pathExists ./hosts/${host}) [ ./hosts/${host} ];
nixpkgs.config.allowUnfreePredicate = (_: true);
imports = [
nixvim.homeManagerModules.default
./modules
] ++ lib.optionals (builtins.pathExists ./hosts/${host}) [ ./hosts/${host} ];
programs.tmux = {
enable = true;
keyMode = "vi";
terminal = "xterm-256color";
customPaneNavigationAndResize = true;
extraConfig = (lib.strings.concatStringsSep "\n" [
"bind P paste-buffer"
]);
};
programs.tmux = {
enable = true;
keyMode = "vi";
terminal = "xterm-256color";
customPaneNavigationAndResize = true;
extraConfig = (lib.strings.concatStringsSep "\n" [
"bind P paste-buffer"
]);
};
home.stateVersion = "23.05";
home.packages = with pkgs; [
bitwarden-cli
copier
diffutils
findutils
gh
git
gnupatch
hms
htop
inetutils
jq
nano
nix-prefetch
nmap
openssl
setup-ssh
tmux
tree
unzip
wget
zip
];
home.stateVersion = "23.05";
home.packages = with pkgs; [
bitwarden-cli
copier
diffutils
findutils
gh
git
gnupatch
hms
htop
inetutils
jq
nano
nix-prefetch
nmap
openssl
setup-ssh
tmux
tree
unzip
wget
zip
];
}
home/hosts/exodus/default.nix
+11 -11
View File
@@ -1,15 +1,15 @@
{ pkgs, config, ... }:
{
greg = {
vscodium = true;
development = true;
gnome = true;
gui = true;
};
home.packages = with pkgs; [
cargo
freeciv
#freeciv_qt
];
greg = {
vscodium = true;
development = true;
gnome = true;
gui = true;
};
home.packages = with pkgs; [
cargo
freeciv
#freeciv_qt
];
}
home/hosts/icdm-root/default.nix
+1 -3
View File
@@ -1,5 +1,3 @@
{ ... }:
{
}
{ }
home/hosts/ivr/default.nix
+62 -61
View File
@@ -1,65 +1,66 @@
{ pkgs, lib, inputs, ...}:
{ pkgs, lib, inputs, ... }:
let
nix23 = import inputs.nix23_05 {
inherit (pkgs.stdenv) system;
overlays = [ inputs.self.overlays.default ];
};
py = nix23.python311.withPackages ( p: with p; [
django
djangorestframework
django-rapyd-modernauth
environs
mysqlclient
pyyaml
ruamel-yaml
tox
]);
x = pkgs.xonsh.override {
extraPackages = (ps: [
pkgs.nur.repos.xonsh-xontribs.xonsh-direnv
pkgs.nur.repos.xonsh-xontribs.xontrib-vox
ps.xonsh-apipenv
pkgs.pipenv-ivr
]);
};
in {
greg = {
development = true;
gui = true;
pypackage = py;
vscodium = true;
};
nix23 = import inputs.nix23_05 {
inherit (pkgs.stdenv) system;
overlays = [ inputs.self.overlays.default ];
};
py = nix23.python311.withPackages (p: with p; [
django
djangorestframework
django-rapyd-modernauth
environs
mysqlclient
pyyaml
ruamel-yaml
tox
]);
x = pkgs.xonsh.override {
extraPackages = (ps: [
pkgs.nur.repos.xonsh-xontribs.xonsh-direnv
pkgs.nur.repos.xonsh-xontribs.xontrib-vox
ps.xonsh-apipenv
pkgs.pipenv-ivr
]);
};
in
{
greg = {
development = true;
gui = true;
pypackage = py;
vscodium = true;
};
nixpkgs.config = {
allowUnfree = true;
permittedInsecurePackages = [
"jitsi-meet-1.0.8043"
];
};
nixpkgs.config = {
allowUnfree = true;
permittedInsecurePackages = [
"jitsi-meet-1.0.8043"
];
};
home = {
packages = with pkgs; [
aacs
ansible
bitwarden-cli
direnv
home-manager
mysql-workbench
pipenv-ivr
poetry
robo3t
x
];
file.".pip/pip.conf".text = (lib.strings.concatStringsSep "\n" [
"[global]"
"retries = 1"
"index-url = https://pypi.python.org/simple"
"extra-index-url ="
" https://pypi.ivrtechnology.com/simple/"
" https://pypidev.ivrtechnology.com/simple/"
]);
username = "gregory.hellings";
homeDirectory = lib.mkForce "/home/gregory.hellings";
};
programs.tmux.shell = (lib.getExe x);
home = {
packages = with pkgs; [
aacs
ansible
bitwarden-cli
direnv
home-manager
mysql-workbench
pipenv-ivr
poetry
robo3t
x
];
file.".pip/pip.conf".text = (lib.strings.concatStringsSep "\n" [
"[global]"
"retries = 1"
"index-url = https://pypi.python.org/simple"
"extra-index-url ="
" https://pypi.ivrtechnology.com/simple/"
" https://pypidev.ivrtechnology.com/simple/"
]);
username = "gregory.hellings";
homeDirectory = lib.mkForce "/home/gregory.hellings";
};
programs.tmux.shell = (lib.getExe x);
}
home/hosts/jude/default.nix
+12 -12
View File
@@ -1,17 +1,17 @@
{ pkgs, ... }:
{
home.packages = with pkgs; [
(mumble.override { pulseSupport = true; })
#logseq
];
greg = {
development = true;
gui = true;
sway = false;
gnome = true;
vscodium = true;
};
home.packages = with pkgs; [
(mumble.override { pulseSupport = true; })
#logseq
];
greg = {
development = true;
gui = true;
sway = false;
gnome = true;
vscodium = true;
};
programs.xonsh.sessionVariables.EFI_DIR = "${pkgs.OVMF.fd}/FV/";
programs.xonsh.sessionVariables.EFI_DIR = "${pkgs.OVMF.fd}/FV/";
}
home/hosts/work/default.nix
+4 -4
View File
@@ -1,9 +1,9 @@
{ pkgs, ... }:
{
greg.vscodium.enable = true;
greg.vscodium.enable = true;
home.packages = with pkgs; [
brew
];
home.packages = with pkgs; [
brew
];
}
home/modules/baseline/ansible.nix
+21 -21
View File
@@ -1,28 +1,28 @@
{ ... }:
{
home.file.".ansible.cfg".text = ''
[defaults]
forks=10
host_key_checking=False
# Also available: profile_roles
callback_enabled=timer,profile_tasks
stdout_callback=yaml
nocows=1
cow_selection=tux
collections_path=~/src
home.file.".ansible.cfg".text = ''
[defaults]
forks=10
host_key_checking=False
# Also available: profile_roles
callback_enabled=timer,profile_tasks
stdout_callback=yaml
nocows=1
cow_selection=tux
collections_path=~/src
[ssh_connection]
pipelining=True
ssh_args = -o ControlMaster=auto -o ControlPersist=600s -o IdentitiesOnly=yes -o GSSAPIAuthentication=no -o StrictHostKeyChecking=no
control_path=%(directory)s/%%h-%%r
control_path_dir=/tmp
[ssh_connection]
pipelining=True
ssh_args = -o ControlMaster=auto -o ControlPersist=600s -o IdentitiesOnly=yes -o GSSAPIAuthentication=no -o StrictHostKeyChecking=no
control_path=%(directory)s/%%h-%%r
control_path_dir=/tmp
[callback_profile_tasks]
sort_order=descending
[callback_profile_tasks]
sort_order=descending
[galaxy]
role_skeleton_ignore = ^.git$,^.*/.git_keep$,\..*.swp
role_skeleton = ~/src/ansible_collections/meta_ansible_templates/role
'';
[galaxy]
role_skeleton_ignore = ^.git$,^.*/.git_keep$,\..*.swp
role_skeleton = ~/src/ansible_collections/meta_ansible_templates/role
'';
}
home/modules/baseline/bash.nix
+83 -83
View File
@@ -1,93 +1,93 @@
{ pkgs, ... }:
{
programs.bash = {
enable = true;
shellAliases = {
acp = "rsync --progress -ah";
agbuild = "ansible-galaxy collection build";
apub = "ansible-galaxy collection publish --api-key \${GALAXY_API_KEY}";
calc = "bc";
d = "deactivate";
devroles = "cd ~/src/ansible_collections/devroles";
gohome = "ssh greg@dns.greg-hellings.gmail.com.beta.tailscale.net -D localhost:10080";
ll = "ls -l";
molcol = "molecule -c ../../tests/molecule.yml";
packaging = "cd ~/src/packaging";
vdown = "vagrant destroy";
vhalt = "vagrant halt";
vos = "vagrant up --provision --provider openstack";
vprov = "vagrant provision";
vssh = "vagrant ssh";
vup = "vagrant up --provision --provider libvirt";
yaml2js = "python -c 'import sys, yaml, json; json.dump(yaml.load(sys.stdin), sys.stdout, indent=4)";
};
sessionVariables = {
ANSIBLE_COLLECTIONS_PATH="\${HOME}/src/";
CLICOLOR = "1";
EDITOR = "${pkgs.vim}/bin/vim";
GIT_SSL_NO_VERIFY = "True";
LSCOLORS = "ExGxBxDxCxEgEdxbxgxcxd";
MAVEN_OPTS = " -Dmaven.wagon.http.ssl.insecure=true ";
OS_CLOUD = "default";
SWORD_PATH = "\${HOME}/.sword";
TIMEFORMAT = "%3Uu %3Ss %3lR %P%%";
};
profileExtra = ''
if [ -e /etc/profile ]; then
. /etc/profile
fi
'';
bashrcExtra = ''
function swordtag {
if [ x"$1" == "x" ]; then
echo "Please provide tag version"
return
fi
svn cp http://crosswire.org/svn/sword/branches/sword-1-8-x/ http://crosswire.org/svn/sword/tags/sword-$1/
}
programs.bash = {
enable = true;
shellAliases = {
acp = "rsync --progress -ah";
agbuild = "ansible-galaxy collection build";
apub = "ansible-galaxy collection publish --api-key \${GALAXY_API_KEY}";
calc = "bc";
d = "deactivate";
devroles = "cd ~/src/ansible_collections/devroles";
gohome = "ssh greg@dns.greg-hellings.gmail.com.beta.tailscale.net -D localhost:10080";
ll = "ls -l";
molcol = "molecule -c ../../tests/molecule.yml";
packaging = "cd ~/src/packaging";
vdown = "vagrant destroy";
vhalt = "vagrant halt";
vos = "vagrant up --provision --provider openstack";
vprov = "vagrant provision";
vssh = "vagrant ssh";
vup = "vagrant up --provision --provider libvirt";
yaml2js = "python -c 'import sys, yaml, json; json.dump(yaml.load(sys.stdin), sys.stdout, indent=4)";
};
sessionVariables = {
ANSIBLE_COLLECTIONS_PATH = "\${HOME}/src/";
CLICOLOR = "1";
EDITOR = "${pkgs.vim}/bin/vim";
GIT_SSL_NO_VERIFY = "True";
LSCOLORS = "ExGxBxDxCxEgEdxbxgxcxd";
MAVEN_OPTS = " -Dmaven.wagon.http.ssl.insecure=true ";
OS_CLOUD = "default";
SWORD_PATH = "\${HOME}/.sword";
TIMEFORMAT = "%3Uu %3Ss %3lR %P%%";
};
profileExtra = ''
if [ -e /etc/profile ]; then
. /etc/profile
fi
'';
bashrcExtra = ''
function swordtag {
if [ x"$1" == "x" ]; then
echo "Please provide tag version"
return
fi
svn cp http://crosswire.org/svn/sword/branches/sword-1-8-x/ http://crosswire.org/svn/sword/tags/sword-$1/
}
function newdock {
if [ x"$1" == "x" -o x"$2" == "x" ]; then
echo "expected arguments [name] [source]"
return
fi
podman run -P --privileged=true -e DISPLAY=$DISPLAY -v /tmp/.X11-unix:/tmp/.X11-unix -v "$(pwd):/dmnt" -t -i --name="$1" "$2" /bin/bash
}
function newdock {
if [ x"$1" == "x" -o x"$2" == "x" ]; then
echo "expected arguments [name] [source]"
return
fi
podman run -P --privileged=true -e DISPLAY=$DISPLAY -v /tmp/.X11-unix:/tmp/.X11-unix -v "$(pwd):/dmnt" -t -i --name="$1" "$2" /bin/bash
}
function rundock {
podman start -a -i "$1"
}
function rundock {
podman start -a -i "$1"
}
function ac {
source ~/venv/''${1}/bin/activate
}
function ac {
source ~/venv/''${1}/bin/activate
}
function py2env {
/usr/bin/virtualenv -p /usr/bin/python2 "''${HOME}/venv/''${1}"
"''${HOME}/venv/''${1}/bin/pip" install -U pip
}
function py2env {
/usr/bin/virtualenv -p /usr/bin/python2 "''${HOME}/venv/''${1}"
"''${HOME}/venv/''${1}/bin/pip" install -U pip
}
function py3env {
VENV_NAME="''${1}"
#PYVERSION="$(python3 -c "import sys;print(sys.version[:sys.version.find('.',2)])")"
#SITE_PACKAGES_PATH="/usr/lib64/python''${PYVERSION}/site-packages/"
#VENV_SITE_PACKAGES="''${HOME}/venv/''${VENV_NAME}/lib64/python''${PYVERSION}/site-packages/"
# Create the virtualenv and update pip to latest
/usr/bin/python3 -m venv --clear "''${HOME}/venv/''${VENV_NAME}" --system-site-packages
"''${HOME}/venv/''${1}/bin/python3" -m pip install -U pip
# Link SELinux into the environment if necessary
#if [ -d "''${SITE_PACKAGES_PATH}" ]; then
# ln -s "''${SITE_PACKAGES_PATH}/selinux" "''${VENV_SITE_PACKAGES}"
# ln -s ''${SITE_PACKAGES_PATH}/_selinux*.so "''${VENV_SITE_PACKAGES}"
#else
# echo "ERROR: LibSELinux not found for Python ''${PYVERSION}. Install system package to enable."
#fi
}
function py3env {
VENV_NAME="''${1}"
#PYVERSION="$(python3 -c "import sys;print(sys.version[:sys.version.find('.',2)])")"
#SITE_PACKAGES_PATH="/usr/lib64/python''${PYVERSION}/site-packages/"
#VENV_SITE_PACKAGES="''${HOME}/venv/''${VENV_NAME}/lib64/python''${PYVERSION}/site-packages/"
# Create the virtualenv and update pip to latest
/usr/bin/python3 -m venv --clear "''${HOME}/venv/''${VENV_NAME}" --system-site-packages
"''${HOME}/venv/''${1}/bin/python3" -m pip install -U pip
# Link SELinux into the environment if necessary
#if [ -d "''${SITE_PACKAGES_PATH}" ]; then
# ln -s "''${SITE_PACKAGES_PATH}/selinux" "''${VENV_SITE_PACKAGES}"
# ln -s ''${SITE_PACKAGES_PATH}/_selinux*.so "''${VENV_SITE_PACKAGES}"
#else
# echo "ERROR: LibSELinux not found for Python ''${PYVERSION}. Install system package to enable."
#fi
}
function unknown_host {
sed -i -e ''${1}d ~/.ssh/known_hosts
}
'';
};
function unknown_host {
sed -i -e ''${1}d ~/.ssh/known_hosts
}
'';
};
}
home/modules/baseline/default.nix
+9 -9
View File
@@ -1,13 +1,13 @@
{ ... }:
{
imports = [
./ansible.nix
./bash.nix
./direnv.nix
./git.nix
./ssh.nix
./vim.nix
./xonsh.nix
];
imports = [
./ansible.nix
./bash.nix
./direnv.nix
./git.nix
./ssh.nix
./vim.nix
./xonsh.nix
];
}
home/modules/baseline/direnv.nix
+4 -4
View File
@@ -1,8 +1,8 @@
{ pkgs, ... }:
{
programs.direnv = {
enable = true;
nix-direnv.enable = true;
};
programs.direnv = {
enable = true;
nix-direnv.enable = true;
};
}
home/modules/baseline/git.nix
+29 -27
View File
@@ -1,31 +1,33 @@
{ ... }:
{
programs.git = {
enable = true;
userName = "Greg Hellings";
userEmail = "greg.hellings@gmail.com";
aliases = {
st = "status";
ci = "commit";
co = "checkout";
ups = "push -u origin HEAD";
amend = "commit --amend";
};
ignores = [
".*.swp" ".*.swo" ".*.swn" # vim
".idea" # IntelliJ
".DS_Store" # Macs
"Thumbs.db" # Windows
".tox" # Tox temp directory
".eclipse" # These next two are created by VSCodium plugins
".bazelproject"
];
extraConfig = {
init.defaultBranch = "main";
push.default = "upstream";
pull.rebase = "false";
tag.sort = "version:refname";
};
};
programs.git = {
enable = true;
userName = "Greg Hellings";
userEmail = "greg.hellings@gmail.com";
aliases = {
st = "status";
ci = "commit";
co = "checkout";
ups = "push -u origin HEAD";
amend = "commit --amend";
};
ignores = [
".*.swp"
".*.swo"
".*.swn" # vim
".idea" # IntelliJ
".DS_Store" # Macs
"Thumbs.db" # Windows
".tox" # Tox temp directory
".eclipse" # These next two are created by VSCodium plugins
".bazelproject"
];
extraConfig = {
init.defaultBranch = "main";
push.default = "upstream";
pull.rebase = "false";
tag.sort = "version:refname";
};
};
}
home/modules/baseline/ssh.nix
+51 -50
View File
@@ -1,64 +1,65 @@
{ lib, ... }:
{
# Workaround to set the config value to user read-only
# This allows things like SSH in distrobox to read the config file just fine
home.file.".ssh/config" = {
target = ".ssh/config_source";
onChange = ''cat ~/.ssh/config_source > ~/.ssh/config && chmod 600 ~/.ssh/config'';
};
programs.ssh = {
enable = true;
serverAliveInterval = 60;
# Workaround to set the config value to user read-only
# This allows things like SSH in distrobox to read the config file just fine
home.file.".ssh/config" = {
target = ".ssh/config_source";
onChange = ''cat ~/.ssh/config_source > ~/.ssh/config && chmod 600 ~/.ssh/config'';
};
programs.ssh = {
enable = true;
serverAliveInterval = 60;
includes = ["config.local"];
includes = [ "config.local" ];
matchBlocks =
let
nas = { user = "admin"; };
owned = { user = "greg"; };
in {
inherit nas;
matchBlocks =
let
nas = { user = "admin"; };
owned = { user = "greg"; };
in
{
inherit nas;
"*" = {
dynamicForwards = [ {
port = 10240;
} ];
};
"*" = {
dynamicForwards = [{
port = 10240;
}];
};
"10.42.1.4" = lib.hm.dag.entryBefore ["10.42.*"] nas;
"nas.thehellings.lan" = nas;
"nas.greg-hellings.gmail.com.beta.tailscale.net" = nas;
chronicles = nas;
"chronicles.thehellings.lan" = lib.hm.dag.entryBefore [ "*.thehellings.lan"] nas;
"10.42.1.4" = lib.hm.dag.entryBefore [ "10.42.*" ] nas;
"nas.thehellings.lan" = nas;
"nas.greg-hellings.gmail.com.beta.tailscale.net" = nas;
chronicles = nas;
"chronicles.thehellings.lan" = lib.hm.dag.entryBefore [ "*.thehellings.lan" ] nas;
gh = { user = "git"; hostname = "github.com"; };
"src" = {
user = "gitlab";
hostname = "git.thehellings.lan";
};
gh = { user = "git"; hostname = "github.com"; };
"src" = {
user = "gitlab";
hostname = "git.thehellings.lan";
};
"*.thehellings.lan" = owned;
"10.42.*" = owned;
"*.thehellings.lan" = owned;
"10.42.*" = owned;
"host.crosswire.org crosswire" = {
hostname = "host.crosswire.org";
user = "ghellings";
};
"host.crosswire.org crosswire" = {
hostname = "host.crosswire.org";
user = "ghellings";
};
fedpeople = {
hostname = "fedorapeople.org";
user = "greghellings";
};
fedpeople = {
hostname = "fedorapeople.org";
user = "greghellings";
};
"src.fedoraproject.org pkgs.fedoraproject.org" = {
user = "greghellings";
};
"src.fedoraproject.org pkgs.fedoraproject.org" = {
user = "greghellings";
};
"127.*".extraOptions = {
PubkeyAcceptedAlgorithms = "+ssh-rsa";
HostkeyAlgorithms = "+ssh-rsa";
};
};
};
"127.*".extraOptions = {
PubkeyAcceptedAlgorithms = "+ssh-rsa";
HostkeyAlgorithms = "+ssh-rsa";
};
};
};
}
home/modules/baseline/vim.nix
+138 -135
View File
@@ -1,142 +1,145 @@
{ lib, pkgs, config, ... }:
let
vim-xonsh = pkgs.vimUtils.buildVimPlugin {
name = "vim-xonsh";
src = pkgs.fetchFromGitHub {
owner = "meatballs";
repo = "vim-xonsh";
rev = "929f35e";
hash = "sha256-ugHLu2Z9bTtQsIp4FQPKxgjVe9oZNjfQYrP+aHu+/uU=";
};
};
vim-xonsh = pkgs.vimUtils.buildVimPlugin {
name = "vim-xonsh";
src = pkgs.fetchFromGitHub {
owner = "meatballs";
repo = "vim-xonsh";
rev = "929f35e";
hash = "sha256-ugHLu2Z9bTtQsIp4FQPKxgjVe9oZNjfQYrP+aHu+/uU=";
};
};
in
{
fonts.fontconfig.enable = true;
home.packages = [ (pkgs.nerdfonts.override { fonts = [ "Hack" ]; }) ];
programs.nixvim = {
enable = true;
colorschemes.gruvbox.enable = true;
globals = {
indent_guides_enable_on_vim_startup = 1;
nix_recommended_style = 0;
};
opts = {
background = "dark";
backup = false;
copyindent = true;
cursorline = true;
expandtab = false;
hidden = true;
hlsearch = true;
ignorecase = true;
lazyredraw = true;
list = true;
listchars = "tab:→ ,extends:→,precedes:←,trail:·,eol:¬";
mouse = "a";
number = true;
preserveindent = true;
relativenumber = true;
shiftwidth = 4;
showcmd = true;
showmatch = true;
signcolumn = "yes";
smartcase = true;
softtabstop = 4;
tabstop = 4;
# Setting for CtrlP
wildignore = "*.swp,*.pyc,*.class,.tox";
wrap = false;
writebackup = false;
};
keymaps = let
winMove = key: { mode = "n"; key = "<C-${key}>"; action = "<C-w>${key}<C-w><CR>"; };
in [ {
mode = "n";
key = "<C-e>";
action = "<Esc>:BufExplorer<CR>";
} {
mode = "n";
key = "<C-t>";
#action = "<Esc>:NERDTreeToggle<CR>";
action = "<Esc>:Neotree toggle<CR>";
} {
mode = "n";
key = "<C-g>";
action = "<Esc>:Neotree float git_status toggle<CR>";
}
(winMove "h")
(winMove "j")
(winMove "k")
(winMove "l")
];
plugins = {
airline.enable = true;
cmp = {
enable = true;
autoEnableSources = true;
settings.sources = [
{ name = "nvim_lsp"; }
{ name = "buffer"; group_index = 2; }
{ name = "path"; gruop_index = 3; }
];
};
direnv.enable = true;
gitgutter.enable = true;
fugitive.enable = true;
fzf-lua = {
enable = true;
keymaps = {
"<C-o>" = {
action = "files";
settings = {
previewers.cat.cmd = "${pkgs.coreutils}/bin/cat";
winopts.height = 0.5;
};
};
"<C-p>" = {
action = "git_files";
settings = {
previewers.cat.cmd = "${pkgs.coreutils}/bin/cat";
winopts.height = 0.5;
};
};
};
profile = "fzf-vim";
};
lsp = {
enable = true;
servers = {
ansiblels.enable = true;
cmake.enable = true;
gopls.enable = true;
html.enable = true;
nixd.enable = true;
pylsp.enable = true;
pyright.enable = true;
rust-analyzer = {
# No need to have these installed on every one of my systems
installCargo = false;
installRustc = false;
enable = true;
};
terraformls.enable = true;
};
};
neo-tree.enable = true;
notify.enable = true;
web-devicons.enable = true;
} // (lib.mkIf (lib.versionAtLeast config.system.nixos.release "24.11") {});
extraConfigLua = builtins.replaceStrings [ "@git@" ] [ "${pkgs.git}/bin/git" ] (builtins.readFile ./vim/extra.lua);
extraConfigVim = builtins.readFile ./vim/extra.vimrc;
extraPlugins = with pkgs.vimPlugins; [
bufexplorer
fonts.fontconfig.enable = true;
home.packages = [ (pkgs.nerdfonts.override { fonts = [ "Hack" ]; }) ];
programs.nixvim = {
enable = true;
colorschemes.gruvbox.enable = true;
globals = {
indent_guides_enable_on_vim_startup = 1;
nix_recommended_style = 0;
};
opts = {
background = "dark";
backup = false;
copyindent = true;
cursorline = true;
expandtab = false;
hidden = true;
hlsearch = true;
ignorecase = true;
lazyredraw = true;
list = true;
listchars = "tab:→ ,extends:→,precedes:←,trail:·,eol:¬";
mouse = "a";
number = true;
preserveindent = true;
relativenumber = true;
shiftwidth = 4;
showcmd = true;
showmatch = true;
signcolumn = "yes";
smartcase = true;
softtabstop = 4;
tabstop = 4;
# Setting for CtrlP
wildignore = "*.swp,*.pyc,*.class,.tox";
wrap = false;
writebackup = false;
};
keymaps =
let
winMove = key: { mode = "n"; key = "<C-${key}>"; action = "<C-w>${key}<C-w><CR>"; };
in
[{
mode = "n";
key = "<C-e>";
action = "<Esc>:BufExplorer<CR>";
}
{
mode = "n";
key = "<C-t>";
#action = "<Esc>:NERDTreeToggle<CR>";
action = "<Esc>:Neotree toggle<CR>";
}
{
mode = "n";
key = "<C-g>";
action = "<Esc>:Neotree float git_status toggle<CR>";
}
(winMove "h")
(winMove "j")
(winMove "k")
(winMove "l")];
plugins = {
airline.enable = true;
cmp = {
enable = true;
autoEnableSources = true;
settings.sources = [
{ name = "nvim_lsp"; }
{ name = "buffer"; group_index = 2; }
{ name = "path"; gruop_index = 3; }
];
};
direnv.enable = true;
gitgutter.enable = true;
fugitive.enable = true;
fzf-lua = {
enable = true;
keymaps = {
"<C-o>" = {
action = "files";
settings = {
previewers.cat.cmd = "${pkgs.coreutils}/bin/cat";
winopts.height = 0.5;
};
};
"<C-p>" = {
action = "git_files";
settings = {
previewers.cat.cmd = "${pkgs.coreutils}/bin/cat";
winopts.height = 0.5;
};
};
};
profile = "fzf-vim";
};
lsp = {
enable = true;
servers = {
ansiblels.enable = true;
cmake.enable = true;
gopls.enable = true;
html.enable = true;
nixd.enable = true;
pylsp.enable = true;
pyright.enable = true;
rust-analyzer = {
# No need to have these installed on every one of my systems
installCargo = false;
installRustc = false;
enable = true;
};
terraformls.enable = true;
};
};
neo-tree.enable = true;
notify.enable = true;
web-devicons.enable = true;
} // (lib.mkIf (lib.versionAtLeast config.system.nixos.release "24.11") { });
extraConfigLua = builtins.replaceStrings [ "@git@" ] [ "${pkgs.git}/bin/git" ] (builtins.readFile ./vim/extra.lua);
extraConfigVim = builtins.readFile ./vim/extra.vimrc;
extraPlugins = with pkgs.vimPlugins; [
bufexplorer
context-vim
vim-indent-guides
vim-xonsh
];
viAlias = true;
vimAlias = true;
};
context-vim
vim-indent-guides
vim-xonsh
];
viAlias = true;
vimAlias = true;
};
}
home/modules/baseline/xonsh.nix
+63 -63
View File
@@ -1,75 +1,75 @@
{ pkgs, config, lib, ... }:
{
programs.xonsh = {
enable = true;
programs.xonsh = {
enable = true;
sessionVariables = {
CLICOLOR = 1;
EDITOR = "nvim";
# vte_new_tab_cwd causes new Terminal tabs to open in the
# same CWD as the current tab
LESS_TERMCAP_mb = "\\033[01;31m"; # begin blinking
LESS_TERMCAP_md = "\\033[01;31m"; # begin bold
LESS_TERMCAP_me = "\\033[0m"; # end mode
LESS_TERMCAP_so = "\\033[01;44;36m"; # begin standout-mode (bottom of screen)
LESS_TERMCAP_se = "\\033[0m"; # end standout-mode
LESS_TERMCAP_us = "\\033[00;36m"; # begin underline
LESS_TERMCAP_ue = "\\033[0m"; # end underline
LIBMYSQL_ENABLE_CLEARTEXT_PLUGIN = "1";
LSCOLORS = "ExGxBxDxCxEgEdxbxgxcxd";
MAVEN_OPTS = " -Dmaven.wagon.http.ssl.insecure=true";
OS_CLOUD = "default";
PROMPT = "{vte_new_tab_cwd}{env_name}{BOLD_GREEN}{user}@{hostname}{BOLD_BLUE} {short_cwd}{branch_color}{curr_branch: {}}{RESET} {BOLD_BLUE}{prompt_end}{RESET} ";
SWORD_PATH = "${config.home.homeDirectory}/.sword/";
TIMEFORMAT = "%3Uu %3Ss %3lR %P%%";
# Tells vox where to find virtualenvs
VIRTUALENV_HOME = "${config.home.homeDirectory}/venv/";
XONSH_COLOR_STYLE = "default";
sessionVariables = {
CLICOLOR = 1;
EDITOR = "nvim";
# vte_new_tab_cwd causes new Terminal tabs to open in the
# same CWD as the current tab
LESS_TERMCAP_mb = "\\033[01;31m"; # begin blinking
LESS_TERMCAP_md = "\\033[01;31m"; # begin bold
LESS_TERMCAP_me = "\\033[0m"; # end mode
LESS_TERMCAP_so = "\\033[01;44;36m"; # begin standout-mode (bottom of screen)
LESS_TERMCAP_se = "\\033[0m"; # end standout-mode
LESS_TERMCAP_us = "\\033[00;36m"; # begin underline
LESS_TERMCAP_ue = "\\033[0m"; # end underline
LIBMYSQL_ENABLE_CLEARTEXT_PLUGIN = "1";
LSCOLORS = "ExGxBxDxCxEgEdxbxgxcxd";
MAVEN_OPTS = " -Dmaven.wagon.http.ssl.insecure=true";
OS_CLOUD = "default";
PROMPT = "{vte_new_tab_cwd}{env_name}{BOLD_GREEN}{user}@{hostname}{BOLD_BLUE} {short_cwd}{branch_color}{curr_branch: {}}{RESET} {BOLD_BLUE}{prompt_end}{RESET} ";
SWORD_PATH = "${config.home.homeDirectory}/.sword/";
TIMEFORMAT = "%3Uu %3Ss %3lR %P%%";
# Tells vox where to find virtualenvs
VIRTUALENV_HOME = "${config.home.homeDirectory}/venv/";
XONSH_COLOR_STYLE = "default";
GOPATH = "${config.home.homeDirectory}/src/go";
GOBIN = "${config.home.homeDirectory}/src/bin";
};
GOPATH = "${config.home.homeDirectory}/src/go";
GOBIN = "${config.home.homeDirectory}/src/bin";
};
aliases = {
# Python related ones
ac = "vox activate";
d = "vox deactivate";
aliases = {
# Python related ones
ac = "vox activate";
d = "vox deactivate";
# Nix related ones
gl-nging = "sudo nixos-container run gitlab -- systemctl restart nginx";
nb = "nix build -L";
nixdu = "sudo nix-store --gc --print-roots | egrep -v r\"^(/nix/var|/run/\\w+-system|\\{memory|/proc)\"";
nixtest = "nixpkgs-review rev HEAD";
nixup = "nix flake update";
stable = "nix flake update nixpkgs hm nixvimstable";
unstable = "nix flake update nixunstable hmunstable nixvimunstable nurpkgs vsext wsl";
# Nix related ones
gl-nging = "sudo nixos-container run gitlab -- systemctl restart nginx";
nb = "nix build -L";
nixdu = "sudo nix-store --gc --print-roots | egrep -v r\"^(/nix/var|/run/\\w+-system|\\{memory|/proc)\"";
nixtest = "nixpkgs-review rev HEAD";
nixup = "nix flake update";
stable = "nix flake update nixpkgs hm nixvimstable";
unstable = "nix flake update nixunstable hmunstable nixvimunstable nurpkgs vsext wsl";
# General
gh-personal = "$GH_CONFIG_DIR=\"${config.home.homeDirectory}/.config/gh/personal\" gh";
ls = "ls --color";
ll = "ls -l --color";
tf = "terraform";
# General
gh-personal = "$GH_CONFIG_DIR=\"${config.home.homeDirectory}/.config/gh/personal\" gh";
ls = "ls --color";
ll = "ls -l --color";
tf = "terraform";
# Tailscale related ones
tsup = "sudo tailscale up";
tspub = "sudo tailscale up --exit-node=linode";
tshome = "sudo tailscale up --exit-node=2maccabees";
tsclear = "sudo tailscale up --exit-node=''";
# Tailscale related ones
tsup = "sudo tailscale up";
tspub = "sudo tailscale up --exit-node=linode";
tshome = "sudo tailscale up --exit-node=2maccabees";
tsclear = "sudo tailscale up --exit-node=''";
# Vagrant related
vdown = "vagrant destroy";
vhalt = "vagrant halt";
vos = "vagrant up --provision --provider openstack";
vprov = "vagrant provision";
vup = "vagrant up --provision --provider libvirt";
vssh = "vagrant ssh";
};
# Vagrant related
vdown = "vagrant destroy";
vhalt = "vagrant halt";
vos = "vagrant up --provision --provider openstack";
vprov = "vagrant provision";
vup = "vagrant up --provision --provider libvirt";
vssh = "vagrant ssh";
};
configHeader = builtins.readFile ./xonsh_header.xsh;
configFooter = (builtins.readFile ./xonsh_footer.xsh) + (builtins.concatStringsSep "\n" [
"with open('${pkgs.stdenv.cc}/nix-support/dynamic-linker', 'r') as fp:"
" $NIX_LD = fp.read().strip()"
]);
};
configHeader = builtins.readFile ./xonsh_header.xsh;
configFooter = (builtins.readFile ./xonsh_footer.xsh) + (builtins.concatStringsSep "\n" [
"with open('${pkgs.stdenv.cc}/nix-support/dynamic-linker', 'r') as fp:"
" $NIX_LD = fp.read().strip()"
]);
};
}
home/modules/default.nix
+10 -10
View File
@@ -1,14 +1,14 @@
{ ... }:
{
imports = [
./baseline
./development.nix
./gnome.nix
./gui.nix
./python.nix
./sway.nix
./vscodium.nix
./xonsh.nix
];
imports = [
./baseline
./development.nix
./gnome.nix
./gui.nix
./python.nix
./sway.nix
./vscodium.nix
./xonsh.nix
];
}
home/modules/development.nix
+21 -20
View File
@@ -1,24 +1,25 @@
{ config, pkgs, lib, ... }:
let
packages = with pkgs; [
bruno # but let's not talk about it
cargo
gh-copilot
mariadb
nix-eval-jobs
nix-fast-build
nix-output-monitor
nix-update
nixfmt-rfc-style
nixpkgs-review
nodejs
process-compose
zed-editor
];
in with lib; {
options.greg.development = mkEnableOption "Setup necessary development packages";
packages = with pkgs; [
bruno # but let's not talk about it
cargo
gh-copilot
mariadb
nix-eval-jobs
nix-fast-build
nix-output-monitor
nix-update
nixfmt-rfc-style
nixpkgs-review
nodejs
process-compose
zed-editor
];
in
with lib; {
options.greg.development = mkEnableOption "Setup necessary development packages";
config = mkIf config.greg.development {
home.packages = packages;
};
config = mkIf config.greg.development {
home.packages = packages;
};
}
home/modules/gnome.nix
+115 -114
View File
@@ -1,121 +1,122 @@
{ config, pkgs, lib, ... }:
let
gv = lib.hm.gvariant;
cfg = config.greg.gnome;
gv = lib.hm.gvariant;
cfg = config.greg.gnome;
in {
options.greg.gnome = lib.mkEnableOption "Enable Gnome support and settings";
in
{
options.greg.gnome = lib.mkEnableOption "Enable Gnome support and settings";
config = (lib.mkIf cfg {
programs.gnome-terminal = lib.mkIf ( pkgs.system != "x86_64-darwin") {
enable = true;
showMenubar = true;
themeVariant = "dark";
profile."95f3c68e-82f3-4f44-ac85-6e075fed80b0" = {
default = true;
customCommand = "xonsh -st best";
loginShell = true;
scrollbackLines = 65535;
transparencyPercent = 50;
visibleName = "greg";
};
};
config = (lib.mkIf cfg {
programs.gnome-terminal = lib.mkIf (pkgs.system != "x86_64-darwin") {
enable = true;
showMenubar = true;
themeVariant = "dark";
profile."95f3c68e-82f3-4f44-ac85-6e075fed80b0" = {
default = true;
customCommand = "xonsh -st best";
loginShell = true;
scrollbackLines = 65535;
transparencyPercent = 50;
visibleName = "greg";
};
};
dconf.settings = {
"org/gnome/Disks" = {
image-dir-uri = "file:///home/greg/Downloads";
};
"org/gnome/desktop/interface" = {
clock-show-weekday = true;
color-scheme = "default";
cursor-size = 24;
toolbar-style = "text";
};
"org/gnome/desktop/screensaver" = {
lock-delay = "uint32 0";
lock-enabled = false;
};
"org/gnome/desktop/wm/keybindings" = {
switch-applications = [];
switch-applications-backward = [];
switch-windows = ["<Alt>Tab"];
switch-windows-backward = [ "<Shift><Alt>Tab" ];
};
"org/gnome/desktop/wm/preferences" = {
button-layout="icon:minimize,maximize,close";
};
"org/gnome/file-roller/listing" = {
list-mode = "as-folder";
name-coloumn-width = 302;
show-path = true;
sort-method = "name";
sort-type = "ascending";
};
"org/gnome/nautilus/preferences" = {
default-folder-viewer = "icon-view";
search-filter-time-type = "last_modified";
search-view = "list-view";
};
"org/gnome/shell" = {
enabled-extensions = [
"appindicatorsupport@rgcjonas.gmail.com"
"Vitals@CoreCoding.com"
"window-list@gnome-shell-extensions.gcampax.github.com"
"gsconnect@andyholmes.github.io"
];
favorite-apps = [
"org.gnome.Calendar.desktop"
"org.gnome.Nautilus.desktop"
"org.gnome.Terminal.desktop"
"firefox.desktop"
"vlc.desktop"
];
remember-mount-password = true;
};
"org/gnome/shell/extensions/vitals" = {
hot-sensors = [
"_memory_usage_"
"_system_load_1m_"
"__network-rx_max__"
"_temperature_k10temp_tccd1_"
"_temperature_k10temp_tctl_"
];
};
"org/gnome/shell/overrides" = {
attach-modal-dialogs = true;
dynamic-workspaces = true;
edge-tiling = true;
focus-change-on-pointer-rest = true;
workspaces-only-on-primary = true;
};
"org/gnome/shell/weather" = {
automation-location = true;
locations = "[<(uint32 2, <('Midlothian / Waxahachie, Mid-Way Regional Airport', 'KJWY', false, [(0.5664611473274288, -1.691437359323684)], @a(dd) [])>)>]";
};
"org/gnome/shell/window-switcher" = {
app-icon-mode = "both";
current-workspace-only = true;
};
"org/gtk/settings/file-chooser" = {
location-mode = "path-bar";
show-hidden = false;
show-size-column = true;
sort-column = "modified";
sort-directories-first = false;
sort-order = "descending";
};
"org/virt-manager/virt-manager/confirm" = {
delete-storage = true;
forcepoweroff = false;
};
"org/virt-manager/virt-manager/details" = {
show-toolbar = true;
};
"org/virt-manager/virt-manager/connections" = {
autoconnect = [ "qemu:///session" "qemu:///system" ];
uris = [ "qemu:///session" "qemu:///system" ];
};
};
});
dconf.settings = {
"org/gnome/Disks" = {
image-dir-uri = "file:///home/greg/Downloads";
};
"org/gnome/desktop/interface" = {
clock-show-weekday = true;
color-scheme = "default";
cursor-size = 24;
toolbar-style = "text";
};
"org/gnome/desktop/screensaver" = {
lock-delay = "uint32 0";
lock-enabled = false;
};
"org/gnome/desktop/wm/keybindings" = {
switch-applications = [ ];
switch-applications-backward = [ ];
switch-windows = [ "<Alt>Tab" ];
switch-windows-backward = [ "<Shift><Alt>Tab" ];
};
"org/gnome/desktop/wm/preferences" = {
button-layout = "icon:minimize,maximize,close";
};
"org/gnome/file-roller/listing" = {
list-mode = "as-folder";
name-coloumn-width = 302;
show-path = true;
sort-method = "name";
sort-type = "ascending";
};
"org/gnome/nautilus/preferences" = {
default-folder-viewer = "icon-view";
search-filter-time-type = "last_modified";
search-view = "list-view";
};
"org/gnome/shell" = {
enabled-extensions = [
"appindicatorsupport@rgcjonas.gmail.com"
"Vitals@CoreCoding.com"
"window-list@gnome-shell-extensions.gcampax.github.com"
"gsconnect@andyholmes.github.io"
];
favorite-apps = [
"org.gnome.Calendar.desktop"
"org.gnome.Nautilus.desktop"
"org.gnome.Terminal.desktop"
"firefox.desktop"
"vlc.desktop"
];
remember-mount-password = true;
};
"org/gnome/shell/extensions/vitals" = {
hot-sensors = [
"_memory_usage_"
"_system_load_1m_"
"__network-rx_max__"
"_temperature_k10temp_tccd1_"
"_temperature_k10temp_tctl_"
];
};
"org/gnome/shell/overrides" = {
attach-modal-dialogs = true;
dynamic-workspaces = true;
edge-tiling = true;
focus-change-on-pointer-rest = true;
workspaces-only-on-primary = true;
};
"org/gnome/shell/weather" = {
automation-location = true;
locations = "[<(uint32 2, <('Midlothian / Waxahachie, Mid-Way Regional Airport', 'KJWY', false, [(0.5664611473274288, -1.691437359323684)], @a(dd) [])>)>]";
};
"org/gnome/shell/window-switcher" = {
app-icon-mode = "both";
current-workspace-only = true;
};
"org/gtk/settings/file-chooser" = {
location-mode = "path-bar";
show-hidden = false;
show-size-column = true;
sort-column = "modified";
sort-directories-first = false;
sort-order = "descending";
};
"org/virt-manager/virt-manager/confirm" = {
delete-storage = true;
forcepoweroff = false;
};
"org/virt-manager/virt-manager/details" = {
show-toolbar = true;
};
"org/virt-manager/virt-manager/connections" = {
autoconnect = [ "qemu:///session" "qemu:///system" ];
uris = [ "qemu:///session" "qemu:///system" ];
};
};
});
}
home/modules/gui.nix
+109 -108
View File
@@ -1,120 +1,121 @@
{ config, pkgs, lib, ... }:
let
cfg = config.greg.gui;
cfg = config.greg.gui;
excludes = systems: opts: (
if ( builtins.all (x: pkgs.system != x) systems ) then opts else []
);
excludes = systems: opts: (
if (builtins.all (x: pkgs.system != x) systems) then opts else [ ]
);
# For now, we ignore this and don't install it
ffPkgs = pkgs.firefox.override { cfg.enableGnomeExtensions = true; };
# For now, we ignore this and don't install it
ffPkgs = pkgs.firefox.override { cfg.enableGnomeExtensions = true; };
vars = {
XDG_CURRENT_DESKTOP = "GNOME";
};
in {
options.greg.gui = lib.mkEnableOption "Enable GUI programs";
vars = {
XDG_CURRENT_DESKTOP = "GNOME";
};
in
{
options.greg.gui = lib.mkEnableOption "Enable GUI programs";
config = (lib.mkIf cfg {
# These packages are Linux only
home.packages = with pkgs; ( excludes ["x86_64-darwin" "aarch64-darwin"]
[
cdrtools
element-desktop
freetube
qpwgraph
vlc
x265
]) ++
config = (lib.mkIf cfg {
# These packages are Linux only
home.packages = with pkgs; (excludes [ "x86_64-darwin" "aarch64-darwin" ]
[
cdrtools
element-desktop
freetube
qpwgraph
vlc
x265
]) ++
# x86_64-linux only
( excludes ["x86_64-darwin" "aarch64-darwin" "aarch64-linux"]
[
bitwarden
discord
endeavour
gnucash
jellyfin-media-player
#logseq
nextcloud-client
slack
]) ++
# x86_64-linux only
(excludes [ "x86_64-darwin" "aarch64-darwin" "aarch64-linux" ]
[
bitwarden
discord
endeavour
gnucash
jellyfin-media-player
#logseq
nextcloud-client
slack
]) ++
# Items that are not supported on ARM/Linux
( excludes ["aarch64-linux"]
[
onlyoffice-bin
synology-drive-client
zoom-us
]);
# Items that are not supported on ARM/Linux
(excludes [ "aarch64-linux" ]
[
onlyoffice-bin
synology-drive-client
zoom-us
]);
programs.firefox = {
enable = (! pkgs.stdenv.hostPlatform.isDarwin);
package = ffPkgs;
policies = {
DisableAppUpdate = true;
};
profiles = {
default = {
bookmarks = import ./gui/bookmarks.nix;
id = 0;
isDefault = true;
search = {
default = "DuckDuckGo";
force = true;
engines = {
Google.metaData.alias = "@g";
"Nix Packages" = {
urls = [{
template = "https://search.nixos.org/packages";
params = [
{ name = "type"; value = "packages"; }
{ name = "query"; value = "{searchTerms}"; }
];
}];
icon = "${pkgs.nixos-icons}/share/icons/hicolor/scalable/apps/nix-snowflake.svg";
definedAliases = [ "@np" ];
};
"Nix Options" = {
urls = [{
template = "https://search.nixos.org/options";
params = [
{ name = "type"; value = "packages"; }
{ name = "query"; value = "{searchTerms}"; }
];
}];
icon = "${pkgs.nixos-icons}/share/icons/hicolor/scalable/apps/nix-snowflake.svg";
definedAliases = [ "@no" ];
};
};
};
settings = {
"app.update.auto" = false;
"browser.ctrlTab.sortByRecentlyUsed" = true;
"browser.startup.page" = 3;
"browser.startup.homepage" = "https://thehellings.com";
"doh-rollout.doorhanger-decision" = "UIDisabled";
"doh-rollout.doneFirstRun" = true;
"signon.rememberSignons" = false;
};
extensions = with pkgs.nur.repos.rycee.firefox-addons; [
bitwarden
gsconnect
foxyproxy-standard
multi-account-containers
octotree
okta-browser-plugin
refined-github
tree-style-tab
ublock-origin
];
};
};
};
programs.firefox = {
enable = (! pkgs.stdenv.hostPlatform.isDarwin);
package = ffPkgs;
policies = {
DisableAppUpdate = true;
};
profiles = {
default = {
bookmarks = import ./gui/bookmarks.nix;
id = 0;
isDefault = true;
search = {
default = "DuckDuckGo";
force = true;
engines = {
Google.metaData.alias = "@g";
"Nix Packages" = {
urls = [{
template = "https://search.nixos.org/packages";
params = [
{ name = "type"; value = "packages"; }
{ name = "query"; value = "{searchTerms}"; }
];
}];
icon = "${pkgs.nixos-icons}/share/icons/hicolor/scalable/apps/nix-snowflake.svg";
definedAliases = [ "@np" ];
};
"Nix Options" = {
urls = [{
template = "https://search.nixos.org/options";
params = [
{ name = "type"; value = "packages"; }
{ name = "query"; value = "{searchTerms}"; }
];
}];
icon = "${pkgs.nixos-icons}/share/icons/hicolor/scalable/apps/nix-snowflake.svg";
definedAliases = [ "@no" ];
};
};
};
settings = {
"app.update.auto" = false;
"browser.ctrlTab.sortByRecentlyUsed" = true;
"browser.startup.page" = 3;
"browser.startup.homepage" = "https://thehellings.com";
"doh-rollout.doorhanger-decision" = "UIDisabled";
"doh-rollout.doneFirstRun" = true;
"signon.rememberSignons" = false;
};
extensions = with pkgs.nur.repos.rycee.firefox-addons; [
bitwarden
gsconnect
foxyproxy-standard
multi-account-containers
octotree
okta-browser-plugin
refined-github
tree-style-tab
ublock-origin
];
};
};
};
# This is supposed to be in support of Firefox, but I dunno...
programs.bash.sessionVariables = vars;
programs.xonsh.sessionVariables = vars;
});
# This is supposed to be in support of Firefox, but I dunno...
programs.bash.sessionVariables = vars;
programs.xonsh.sessionVariables = vars;
});
}
home/modules/gui/bookmarks.nix
+167 -137
View File
@@ -1,137 +1,167 @@
[ {
name = "Toolbar";
toolbar = true;
bookmarks = [ {
name = "Ansible";
bookmarks = [ {
name = "Collection Index";
url = "https://docs.ansible.com/ansible/latest/collections/index.html";
} ];
} {
name = "Church";
bookmarks = [ {
name = "DC4K";
url = "https://www.dc4k.org/leaderzone/articles";
} ];
} {
name = "IVR";
bookmarks = [ {
name = "Dev";
bookmarks = [ {
name = "Core Survey";
url = "https://webdev5.ivrtechnology.com/coreservices/survey/admin/";
} {
name = "Audio";
url = "https://apidev1.ivrtechnology.com/coreservices/audio/admin/";
} ];
} {
name = "HC";
bookmarks = [ {
name = "Audio";
url = "https://hcweb3.ivrtechnology.com/coreservices/audio/admin/";
} {
name = "Survey";
url = "https://hcweb2.ivrtechnology.com/coreservices/survey/admin/";
} ];
} {
name = "PCI";
bookmarks = [ {
name = "Audio";
url = "https://pciweb3.ivrtechnology.com/coreservices/audio/admin/";
} ];
} {
name = "Processes";
bookmarks = [ {
name = "Change Management";
url = "https://ivrtg.atlassian.net/wiki/spaces/ITS/pages/13094842/Executing+Change+Management";
} {
name = "Okta";
url = "https://engagesmart.okta.com/";
} {
name = "DB Request";
url = "https://ivrtg.aha.io/develop/features/INFR-1073";
} ];
} ];
} {
name = "Katie";
bookmarks = [ {
name = "Sports Forms";
url = "https://midlothianisd.rankone.com/New/NewStudentList.aspx";
} {
name = "Skyward";
url = "https://skyward.iscorp.com/MidlothianISDTXStuSTS/Session/Signin?area=Home&controller=Home&action=Index&logoutreason=TimedOut";
} ];
} {
name = "Nix";
bookmarks = [ {
name = "Package Versions";
url = "https://lazamar.co.uk/nix-versions/?channel=nixpkgs-unstable&package=python3";
} {
name = "Channel status";
url = "https://status.nixos.org/";
} {
name = "Home Manager options";
url = "https://nix-community.github.io/home-manager/options.xhtml";
} {
name = "Flake Parts";
url = "https://community.flake.parts/";
} {
name = "Language ref";
url = "https://nix.dev/manual/nix/latest/language/index.html";
} {
name = "Builtin functions";
url = "https://nix.dev/manual/nix/latest/language/builtins.html";
} {
name = "Nixpkgs functions";
url = "https://ryantm.github.io/nixpkgs/functions/library/strings/#sec-functions-library-strings";
} {
name = "NUR search";
url = "https://nur.nix-community.org/";
} ];
} {
name = "Rust";
bookmarks = [ {
name = "Learn Rust";
url = "https://www.rust-lang.org/learn";
} {
name = "Rust by Example";
url = "https://doc.rust-lang.org/rust-by-example/hello.html";
} {
name = "Iced";
url = "https://docs.rs/iced/latest/iced/";
} ];
} {
name = "Shopping";
bookmarks = [ {
name = "Cables";
url = "https://www.pchcables.com";
} ];
} {
name = "SubTo";
bookmarks = [ {
name = "Kajabi";
url = "https://www.subtocourse.com/login";
} {
name = "SubTo Fund";
url = "https://frontend.koreconx.com/auth/login";
} {
name = "Creive Title";
url = "https://getcreativetitle.com/";
} {
name = "REI Scripts";
url = "https://reiconveyorbelt.com/no-excuses/";
} ];
} {
name = "Tools";
bookmarks = [ {
name = "Password Hash";
url = "https://unix4lyfe.org/crypt/";
} {
name = "Keymap editor";
url = "https://nickcoutsos.github.io/keymap-editor/";
} {
name = "Bitcoin dashboard";
url = "http://hosea.home:60845";
} ];
} ];
} ]
[{
name = "Toolbar";
toolbar = true;
bookmarks = [{
name = "Ansible";
bookmarks = [{
name = "Collection Index";
url = "https://docs.ansible.com/ansible/latest/collections/index.html";
}];
}
{
name = "Church";
bookmarks = [{
name = "DC4K";
url = "https://www.dc4k.org/leaderzone/articles";
}];
}
{
name = "IVR";
bookmarks = [{
name = "Dev";
bookmarks = [{
name = "Core Survey";
url = "https://webdev5.ivrtechnology.com/coreservices/survey/admin/";
}
{
name = "Audio";
url = "https://apidev1.ivrtechnology.com/coreservices/audio/admin/";
}];
}
{
name = "HC";
bookmarks = [{
name = "Audio";
url = "https://hcweb3.ivrtechnology.com/coreservices/audio/admin/";
}
{
name = "Survey";
url = "https://hcweb2.ivrtechnology.com/coreservices/survey/admin/";
}];
}
{
name = "PCI";
bookmarks = [{
name = "Audio";
url = "https://pciweb3.ivrtechnology.com/coreservices/audio/admin/";
}];
}
{
name = "Processes";
bookmarks = [{
name = "Change Management";
url = "https://ivrtg.atlassian.net/wiki/spaces/ITS/pages/13094842/Executing+Change+Management";
}
{
name = "Okta";
url = "https://engagesmart.okta.com/";
}
{
name = "DB Request";
url = "https://ivrtg.aha.io/develop/features/INFR-1073";
}];
}];
}
{
name = "Katie";
bookmarks = [{
name = "Sports Forms";
url = "https://midlothianisd.rankone.com/New/NewStudentList.aspx";
}
{
name = "Skyward";
url = "https://skyward.iscorp.com/MidlothianISDTXStuSTS/Session/Signin?area=Home&controller=Home&action=Index&logoutreason=TimedOut";
}];
}
{
name = "Nix";
bookmarks = [{
name = "Package Versions";
url = "https://lazamar.co.uk/nix-versions/?channel=nixpkgs-unstable&package=python3";
}
{
name = "Channel status";
url = "https://status.nixos.org/";
}
{
name = "Home Manager options";
url = "https://nix-community.github.io/home-manager/options.xhtml";
}
{
name = "Flake Parts";
url = "https://community.flake.parts/";
}
{
name = "Language ref";
url = "https://nix.dev/manual/nix/latest/language/index.html";
}
{
name = "Builtin functions";
url = "https://nix.dev/manual/nix/latest/language/builtins.html";
}
{
name = "Nixpkgs functions";
url = "https://ryantm.github.io/nixpkgs/functions/library/strings/#sec-functions-library-strings";
}
{
name = "NUR search";
url = "https://nur.nix-community.org/";
}];
}
{
name = "Rust";
bookmarks = [{
name = "Learn Rust";
url = "https://www.rust-lang.org/learn";
}
{
name = "Rust by Example";
url = "https://doc.rust-lang.org/rust-by-example/hello.html";
}
{
name = "Iced";
url = "https://docs.rs/iced/latest/iced/";
}];
}
{
name = "Shopping";
bookmarks = [{
name = "Cables";
url = "https://www.pchcables.com";
}];
}
{
name = "SubTo";
bookmarks = [{
name = "Kajabi";
url = "https://www.subtocourse.com/login";
}
{
name = "SubTo Fund";
url = "https://frontend.koreconx.com/auth/login";
}
{
name = "Creive Title";
url = "https://getcreativetitle.com/";
}
{
name = "REI Scripts";
url = "https://reiconveyorbelt.com/no-excuses/";
}];
}
{
name = "Tools";
bookmarks = [{
name = "Password Hash";
url = "https://unix4lyfe.org/crypt/";
}
{
name = "Keymap editor";
url = "https://nickcoutsos.github.io/keymap-editor/";
}
{
name = "Bitcoin dashboard";
url = "http://hosea.home:60845";
}];
}];
}]
home/modules/python.nix
+6 -6
View File
@@ -1,10 +1,10 @@
{ config, pkgs, lib, ... }:
{
options.greg.pypackage = lib.mkOption {
description = "Enable Gnome support and settings";
type = lib.types.package;
default = pkgs.gregpy;
};
options.greg.pypackage = lib.mkOption {
description = "Enable Gnome support and settings";
type = lib.types.package;
default = pkgs.gregpy;
};
config.home.packages = [ config.greg.pypackage ];
config.home.packages = [ config.greg.pypackage ];
}
home/modules/sway.nix
+97 -94
View File
@@ -1,103 +1,106 @@
{ config, pkgs, lib, ... }:
let
cfg = config.greg.sway;
file_browser = {
pkg = pkgs.krusader;
path = "${pkgs.krusader}/bin/krusader";
};
term = "${pkgs.alacritty}/bin/alacritty";
msg = "${pkgs.sway}/bin/swaymsg";
sleep = "${pkgs.coreutils}/bin/sleep";
workstation1 = pkgs.writeScriptBin "workstation1" (builtins.concatStringsSep "\n" [
"${msg} \"workspace 1 ; exec ${pkgs.firefox}/bin/firefox ; split horizontal ; exec ${pkgs.element-desktop}/bin/element-desktop \""
"${sleep} 1"
"${msg} '[app_id=\"firefox\"]' move left"
"${msg} '[instance=\"element\"]' \"layout tabbed ; exec ${term} \""
"${msg} '[app_id=\"firefox\"]' move left"
"${sleep} 0.3"
"${msg} '[app_id=\"Alacritty\" workspace=\"1\"]' move right"
"${msg} '[app_id=\"firefox\"]' resize grow width 300 px"
]);
workstation2 = pkgs.writeScriptBin "workstation2" (builtins.concatStringsSep "\n" [
"${sleep} 5"
"${msg} \"workspace 2 ; exec ${term} ; layout tabbed\""
]);
in {
options.greg.sway = lib.mkEnableOption "Enable Sway support and settings";
cfg = config.greg.sway;
file_browser = {
pkg = pkgs.krusader;
path = "${pkgs.krusader}/bin/krusader";
};
term = "${pkgs.alacritty}/bin/alacritty";
msg = "${pkgs.sway}/bin/swaymsg";
sleep = "${pkgs.coreutils}/bin/sleep";
workstation1 = pkgs.writeScriptBin "workstation1" (builtins.concatStringsSep "\n" [
"${msg} \"workspace 1 ; exec ${pkgs.firefox}/bin/firefox ; split horizontal ; exec ${pkgs.element-desktop}/bin/element-desktop \""
"${sleep} 1"
"${msg} '[app_id=\"firefox\"]' move left"
"${msg} '[instance=\"element\"]' \"layout tabbed ; exec ${term} \""
"${msg} '[app_id=\"firefox\"]' move left"
"${sleep} 0.3"
"${msg} '[app_id=\"Alacritty\" workspace=\"1\"]' move right"
"${msg} '[app_id=\"firefox\"]' resize grow width 300 px"
]);
workstation2 = pkgs.writeScriptBin "workstation2" (builtins.concatStringsSep "\n" [
"${sleep} 5"
"${msg} \"workspace 2 ; exec ${term} ; layout tabbed\""
]);
in
{
options.greg.sway = lib.mkEnableOption "Enable Sway support and settings";
config = (lib.mkIf cfg {
programs.swaylock.enable = true;
config = (lib.mkIf cfg {
programs.swaylock.enable = true;
wayland.windowManager.sway = let
mod = config.wayland.windowManager.sway.config.modifier;
in {
enable = true;
config = rec {
#fonts.size = 10.0;
keybindings = lib.mkOptionDefault {
"Mod4+l" = "exec ${pkgs.swaylock}/bin/swaylock -c 000000";
"Mod4+h" = "exec ${pkgs.qpwgraph}/bin/qpwgraph -x /home/greg/sound/headphones.qpwgraph -m";
"Mod4+m" = "exec ${pkgs.qpwgraph}/bin/qpwgraph -x /home/greg/sound/monitor.qpwgraph -m";
"Mod4+b" = "exec ${pkgs.qpwgraph}/bin/qpwgraph -x /home/greg/sound/both.qpwgraph -m";
wayland.windowManager.sway =
let
mod = config.wayland.windowManager.sway.config.modifier;
in
{
enable = true;
config = rec {
#fonts.size = 10.0;
keybindings = lib.mkOptionDefault {
"Mod4+l" = "exec ${pkgs.swaylock}/bin/swaylock -c 000000";
"Mod4+h" = "exec ${pkgs.qpwgraph}/bin/qpwgraph -x /home/greg/sound/headphones.qpwgraph -m";
"Mod4+m" = "exec ${pkgs.qpwgraph}/bin/qpwgraph -x /home/greg/sound/monitor.qpwgraph -m";
"Mod4+b" = "exec ${pkgs.qpwgraph}/bin/qpwgraph -x /home/greg/sound/both.qpwgraph -m";
"${mod}+Shift+Return" = file_browser.path;
};
modifier = "Mod1";
output = {
"Samsung Electric Company S24E650 H4ZN600985" = {
mode = "1920x1200";
transform = "90";
pos = "0 0";
};
"ViewSonic Corporation VA2252 Series VMT201800925" = {
mode = "1920x1080";
pos = "200 1920";
};
};
terminal = term;
startup = [
{ command = "${workstation1}/bin/workstation1"; }
{ command = "${workstation2}/bin/workstation2"; }
];
};
extraOptions = [
"--unsupported-gpu"
];
extraSessionCommands = ''
export WLR_NO_HARDWARE_CURSORS=1
'';
systemd.enable = true;
wrapperFeatures = {
base = true;
gtk = true;
};
};
"${mod}+Shift+Return" = file_browser.path;
};
modifier = "Mod1";
output = {
"Samsung Electric Company S24E650 H4ZN600985" = {
mode = "1920x1200";
transform = "90";
pos = "0 0";
};
"ViewSonic Corporation VA2252 Series VMT201800925" = {
mode = "1920x1080";
pos = "200 1920";
};
};
terminal = term;
startup = [
{ command = "${workstation1}/bin/workstation1"; }
{ command = "${workstation2}/bin/workstation2"; }
];
};
extraOptions = [
"--unsupported-gpu"
];
extraSessionCommands = ''
export WLR_NO_HARDWARE_CURSORS=1
'';
systemd.enable = true;
wrapperFeatures = {
base = true;
gtk = true;
};
};
home.pointerCursor = {
name = "Adwaita";
package = pkgs.gnome.adwaita-icon-theme;
size = 12;
x11 = {
enable = true;
defaultCursor = "Adwaita";
};
};
home.pointerCursor = {
name = "Adwaita";
package = pkgs.gnome.adwaita-icon-theme;
size = 12;
x11 = {
enable = true;
defaultCursor = "Adwaita";
};
};
home.packages = with pkgs; [
arj
dpkg
kate
kget
krename
file_browser.pkg
p7zip
plocate
rpm
qpwgraph
xorg.xev
xorg.xmodmap
xxdiff
];
});
home.packages = with pkgs; [
arj
dpkg
kate
kget
krename
file_browser.pkg
p7zip
plocate
rpm
qpwgraph
xorg.xev
xorg.xmodmap
xxdiff
];
});
}
home/modules/vscodium.nix
+52 -51
View File
@@ -1,57 +1,58 @@
{ pkgs, config, lib, inputs, ... }:
let
cfg = config.greg.vscodium;
in {
options.greg.vscodium = lib.mkEnableOption "Enable installation of VSCodium on the host";
cfg = config.greg.vscodium;
in
{
options.greg.vscodium = lib.mkEnableOption "Enable installation of VSCodium on the host";
config = lib.mkIf cfg {
home.packages = with pkgs; [
buildifier
gopls
nixd # nix language server
];
config = lib.mkIf cfg {
home.packages = with pkgs; [
buildifier
gopls
nixd # nix language server
];
# An alternative editor to vim, when I need it for some things
programs.vscode = {
enable = true;
package = pkgs.vscodium;
extensions = with inputs.vsext.extensions."${pkgs.stdenv.system}".vscode-marketplace; [
arrterian.nix-env-selector
asvetliakov.vscode-neovim
batisteo.vscode-django
bungcip.better-toml
donjayamanne.python-environment-manager
golang.go
kevinrose.vsc-python-indent
jnoortheen.nix-ide
mkhl.direnv
ms-python.python
njpwerner.autodocstring
rust-lang.rust-analyzer
vscjava.vscode-java-test
vscjava.vscode-java-dependency
vscjava.vscode-java-debug
wholroyd.jinja
];
userSettings = {
"direnv.restart.automatic" = true;
"direnv.path.executable" = "/home/gregory.hellings/.nix-profile/bin/direnv";
"extensions.autoUpdate" = false;
"extensions.experimental.affinity" = {
"asvetliakov.vscode-neovim" = 1;
};
"git.openRepositoryInParentFolders" = "always";
"search.exclude" = {
"**/.tox" = true;
};
"terminal.integrated.defaultProfile.linux" = "tmux";
"vscode-neovim.neovimInitVimPaths.darwin" = "~/.config/nvim/init.lua";
"vscode-neovim.neovimInitVimPaths.linux" = "~/.config/nvim/init.lua";
"workbench.settings.applyToAllProfiles" = [
"direnv.path.executable"
];
};
};
};
# An alternative editor to vim, when I need it for some things
programs.vscode = {
enable = true;
package = pkgs.vscodium;
extensions = with inputs.vsext.extensions."${pkgs.stdenv.system}".vscode-marketplace; [
arrterian.nix-env-selector
asvetliakov.vscode-neovim
batisteo.vscode-django
bungcip.better-toml
donjayamanne.python-environment-manager
golang.go
kevinrose.vsc-python-indent
jnoortheen.nix-ide
mkhl.direnv
ms-python.python
njpwerner.autodocstring
rust-lang.rust-analyzer
vscjava.vscode-java-test
vscjava.vscode-java-dependency
vscjava.vscode-java-debug
wholroyd.jinja
];
userSettings = {
"direnv.restart.automatic" = true;
"direnv.path.executable" = "/home/gregory.hellings/.nix-profile/bin/direnv";
"extensions.autoUpdate" = false;
"extensions.experimental.affinity" = {
"asvetliakov.vscode-neovim" = 1;
};
"git.openRepositoryInParentFolders" = "always";
"search.exclude" = {
"**/.tox" = true;
};
"terminal.integrated.defaultProfile.linux" = "tmux";
"vscode-neovim.neovimInitVimPaths.darwin" = "~/.config/nvim/init.lua";
"vscode-neovim.neovimInitVimPaths.linux" = "~/.config/nvim/init.lua";
"workbench.settings.applyToAllProfiles" = [
"direnv.path.executable"
];
};
};
};
}
home/modules/xonsh.nix
+83 -77
View File
@@ -1,94 +1,100 @@
{ config, pkgs, lib, ... }:
let
cfg = config.programs.xonsh;
cfg = config.programs.xonsh;
in with lib; {
options = {
programs.xonsh = {
enable = mkEnableOption "Enable the xonsh program";
in
with lib; {
options = {
programs.xonsh = {
enable = mkEnableOption "Enable the xonsh program";
sessionVariables = mkOption {
type = types.attrs;
default = {};
example = { XONSH_TRACE_SUBPROC = true; };
description = ''
Environment variables that will be set for the Xonsh session.
'';
};
sessionVariables = mkOption {
type = types.attrs;
default = { };
example = { XONSH_TRACE_SUBPROC = true; };
description = ''
Environment variables that will be set for the Xonsh session.
'';
};
aliases = mkOption {
type = types.attrsOf types.str;
default = {};
example = literalExpression ''
{
ll = "ls -l";
la = "ls -a";
}
'';
description = ''
An attribute set that maps aliases (the top level attribute names in
this option) to command strings or directly to build outputs.
'';
};
aliases = mkOption {
type = types.attrsOf types.str;
default = { };
example = literalExpression ''
{
ll = "ls -l";
la = "ls -a";
}
'';
description = ''
An attribute set that maps aliases (the top level attribute names in
this option) to command strings or directly to build outputs.
'';
};
configHeader = mkOption {
type = types.lines;
default = "";
example = literalExpression ''
import os
import sys
'';
description = "An arbitrary string to put at the top of the config file";
};
configHeader = mkOption {
type = types.lines;
default = "";
example = literalExpression ''
import os
import sys
'';
description = "An arbitrary string to put at the top of the config file";
};
configFooter = mkOption {
type = types.lines;
default = "";
example = literalExpression ''
def _some_method(args):
do_command()
some_other_thing()
aliases['some_method'] = _some_method
'';
description = "An arbitrary string to put at the end of the config file";
};
};
};
configFooter = mkOption {
type = types.lines;
default = "";
example = literalExpression ''
def _some_method(args):
do_command()
some_other_thing()
aliases['some_method'] = _some_method
'';
description = "An arbitrary string to put at the end of the config file";
};
};
};
config =
let
shortAliases = concatStringsSep "\n" (
mapAttrsToList (k: v: "aliases['${k}']=r'${v}'") cfg.aliases
);
config =
let
shortAliases = concatStringsSep "\n" (
mapAttrsToList (k: v: "aliases['${k}']=r'${v}'") cfg.aliases
);
listToPythonList = let
listInternals = args:
concatStringsSep "\n" (map (v: "'${v}'") args);
in list: "[${listInternals list}]";
listToPythonList =
let
listInternals = args:
concatStringsSep "\n" (map (v: "'${v}'") args);
in
list: "[${listInternals list}]";
sessionVars = concatStringsSep "\n" (
mapAttrsToList (k: v:
if builtins.typeOf v == "string" then
"\$${k} = '${v}'"
else if builtins.typeOf v == "list" then
"\$${k} = ${listToPythonList}"
else if builtins.typeOf v == "int" then
"\$${k} = ${toString v}"
else ""
) cfg.sessionVariables
);
sessionVars = concatStringsSep "\n" (
mapAttrsToList
(k: v:
if builtins.typeOf v == "string" then
"\$${k} = '${v}'"
else if builtins.typeOf v == "list" then
"\$${k} = ${listToPythonList}"
else if builtins.typeOf v == "int" then
"\$${k} = ${toString v}"
else ""
)
cfg.sessionVariables
);
in mkIf cfg.enable {
in
mkIf cfg.enable {
home.file.".xonshrc".text = ''
${cfg.configHeader}
home.file.".xonshrc".text = ''
${cfg.configHeader}
${sessionVars}
${sessionVars}
${shortAliases}
${shortAliases}
${cfg.configFooter}
'';
};
${cfg.configFooter}
'';
};
}
hosts/default.nix
+65 -62
View File
@@ -1,65 +1,68 @@
{ inputs, overlays, ... }:
let
wsl = args: (unstable (args // { extraMods = [ inputs.wsl.nixosModules.wsl ]; }));
unstable = args: (machine (args // {
channel = inputs.nixunstable;
hm = inputs.hmunstable;
nixvim = inputs.nixvimunstable;
}));
machine = {
channel ? inputs.nixstable,
extraMods ? [],
name,
system ? "x86_64-linux",
hm ? inputs.hm,
nixvim ? inputs.nixvimstable,
}:
let
nixpkgs = import channel {
inherit system;
};
# Use this to include modules directly from a repo
nurNoPkg = import inputs.nurpkgs {
nurpkgs = nixpkgs;
};
in channel.lib.nixosSystem {
inherit system;
specialArgs = { inherit nixpkgs inputs overlays; };
modules = [
{
nixpkgs.overlays = overlays;
home-manager = {
useGlobalPkgs = true;
useUserPackages = true;
users.greg = import ../home/home.nix;
extraSpecialArgs = {
inherit inputs overlays nixvim;
home = "/home/greg";
host = name;
};
backupFileExtension = "bkp";
};
}
inputs.agenix.nixosModules.default
hm.nixosModules.home-manager
inputs.self.modules.nixosModule
inputs.nurpkgs.nixosModules.nur
./${name}
] ++ extraMods;
};
in {
genesis = machine { name = "genesis"; };
exodus = unstable { name = "exodus"; };
jude = unstable { name = "jude"; };
icdm-root = unstable { name = "icdm-root"; };
linode = machine { name = "linode"; };
hosea = unstable { name = "hosea"; };
jeremiah = unstable { name = "jeremiah"; };
myself = unstable { name = "myself"; };
iso = machine { name = "iso"; };
iso-beta = unstable { name = "iso"; };
# nix build '.#nixosConfigurations.wsl.config.system.build.installer'
nixos = wsl { name = "wsl"; system = "aarch64-linux"; };
# nix build '.#nixosConfigurations.wsl-aarch.config.system.build.installer'
nixos-arm = wsl { name = "wsl"; system = "aarch64-linux"; };
wsl = args: (unstable (args // { extraMods = [ inputs.wsl.nixosModules.wsl ]; }));
unstable = args: (machine (args // {
channel = inputs.nixunstable;
hm = inputs.hmunstable;
nixvim = inputs.nixvimunstable;
}));
machine =
{ channel ? inputs.nixstable
, extraMods ? [ ]
, name
, system ? "x86_64-linux"
, hm ? inputs.hm
, nixvim ? inputs.nixvimstable
,
}:
let
nixpkgs = import channel {
inherit system;
};
# Use this to include modules directly from a repo
nurNoPkg = import inputs.nurpkgs {
nurpkgs = nixpkgs;
};
in
channel.lib.nixosSystem {
inherit system;
specialArgs = { inherit nixpkgs inputs overlays; };
modules = [
{
nixpkgs.overlays = overlays;
home-manager = {
useGlobalPkgs = true;
useUserPackages = true;
users.greg = import ../home/home.nix;
extraSpecialArgs = {
inherit inputs overlays nixvim;
home = "/home/greg";
host = name;
};
backupFileExtension = "bkp";
};
}
inputs.agenix.nixosModules.default
hm.nixosModules.home-manager
inputs.self.modules.nixosModule
inputs.nurpkgs.nixosModules.nur
./${name}
] ++ extraMods;
};
in
{
genesis = machine { name = "genesis"; };
exodus = unstable { name = "exodus"; };
jude = unstable { name = "jude"; };
icdm-root = unstable { name = "icdm-root"; };
linode = machine { name = "linode"; };
hosea = unstable { name = "hosea"; };
jeremiah = unstable { name = "jeremiah"; };
myself = unstable { name = "myself"; };
iso = machine { name = "iso"; };
iso-beta = unstable { name = "iso"; };
# nix build '.#nixosConfigurations.wsl.config.system.build.installer'
nixos = wsl { name = "wsl"; system = "aarch64-linux"; };
# nix build '.#nixosConfigurations.wsl-aarch.config.system.build.installer'
nixos-arm = wsl { name = "wsl"; system = "aarch64-linux"; };
}
hosts/exodus/default.nix
+18 -18
View File
@@ -1,24 +1,24 @@
{ pkgs, config, ... }:
{
imports = [
./hardware-configuration.nix
];
imports = [
./hardware-configuration.nix
];
boot.loader = {
systemd-boot.enable = true;
efi.canTouchEfiVariables = true;
};
boot.loader = {
systemd-boot.enable = true;
efi.canTouchEfiVariables = true;
};
networking.hostName = "exodus";
greg = {
home = true;
gnome.enable = true;
print.enable = true;
tailscale.enable = true;
vmdev = {
enable = true;
system = "intel";
};
};
networking.hostName = "exodus";
greg = {
home = true;
gnome.enable = true;
print.enable = true;
tailscale.enable = true;
vmdev = {
enable = true;
system = "intel";
};
};
}
hosts/exodus/hardware-configuration.nix
+6 -3
View File
@@ -5,7 +5,8 @@
{
imports =
[ (modulesPath + "/installer/scan/not-detected.nix")
[
(modulesPath + "/installer/scan/not-detected.nix")
];
boot.initrd.availableKernelModules = [ "xhci_pci" "thunderbolt" "nvme" "uas" "sd_mod" ];
@@ -14,13 +15,15 @@
boot.extraModulePackages = [ ];
fileSystems."/" =
{ device = "/dev/disk/by-uuid/607b933f-2967-4652-b478-4d8e9aa38a0d";
{
device = "/dev/disk/by-uuid/607b933f-2967-4652-b478-4d8e9aa38a0d";
fsType = "btrfs";
options = [ "subvol=@" ];
};
fileSystems."/boot" =
{ device = "/dev/disk/by-uuid/B31C-C1F4";
{
device = "/dev/disk/by-uuid/B31C-C1F4";
fsType = "vfat";
};
hosts/genesis/acme.nix
+59 -58
View File
@@ -1,62 +1,63 @@
{ pkgs, config, lib, ... }:
let
address = (builtins.elemAt config.networking.interfaces.ens18.ipv4.addresses 0).address;
root_ca = pkgs.writeText "root_ca.crt" (builtins.readFile ../../ca/root_ca.crt);
intermediate_ca = pkgs.writeText "intermediate_ca.crt" (builtins.readFile ../../ca/intermediate_ca.crt);
in {
age.secrets.acme_password = {
file = ../../secrets/acme_password.age;
};
age.secrets.intermediate_ca_key = {
file = ../../secrets/ca/intermediate_key.age;
};
age.secrets.root_ca_key.file = ../../secrets/ca/root_key.age;
systemd.services.step-ca.serviceConfig.Environment = lib.mkForce ["STEPDEBUG=1" "HOME=%S/step-ca"];
services.step-ca = {
inherit address;
enable = false;
intermediatePasswordFile = config.age.secrets.acme_password.path;
openFirewall = true;
port = 8443;
settings = {
root = root_ca;
federatedRoots = null;
cert = intermediate_ca;
key = config.age.secrets.intermediate_ca_key.path;
dnsNames = [
"10.42.1.5"
"acme.thehellings.lan"
];
logger.format = "text";
db = {
type = "badgerv2";
dataSource = "/var/lib/step-ca/db";
badgerFileLoadingMode = "";
};
authority.provisioners = [ {
type = "JWK";
name = "greg@thehellings.com";
key = {
use = "sig";
kty = "EC";
kid = "1GOpOttYLZtx7XiG79ZycbGcG4ptL0czfohK35SZOEI";
crv = "P-256";
alg = "ES256";
x = "YEWVj5CCoqWQXWqmL0UuORlFY9IEOLcg1jpG1o-wGx4";
y = "MEpqnJp60VV-SpFtb6m8U-VAYut7R_PKFm07xl7MjBk";
};
encryptedKey = "eyJhbGciOiJQQkVTMi1IUzI1NitBMTI4S1ciLCJjdHkiOiJqd2sranNvbiIsImVuYyI6IkEyNTZHQ00iLCJwMmMiOjYwMDAwMCwicDJzIjoieWdfb0lfbWgwbHhPRXdjUTBsd0FnUSJ9.ivdQUFEhs2U8PUBYr8AhQl3hHdb4spF4jvXgqY_hiVgpjB-z3Nn9Uw.u7vrNht_3WD1G97q.mbydlpAQxjtKLkOmmDOUczqscRDPqrUyoPJ1uqXcJDH3vs4KiYlrKRcFLjPy9sWzEL1iIrqjwf3U-3AAx1KNAg7frs2D__MGfOO-U5SdQDVJVAND7KpWOJGJVSb0xioCA6-8ldlP_REqu4ENmkkdw0_6Is2b0p7ZFKqke_fqOOs7osqFAfbMb_WzEWrACLn5A5-Teh2rpEgR-z9zipN6MSEqE6VIQ2BXuv70aHWhslNe1MK1OgTYm9CqA47EMYvQ7HQLPDZAbP56WK84yJLktoXMmnkaKeTtvER0dh4ufyjJHBhecnEranbR5rHc_jV8_qvyWhlqbCrOU_8bWrk.a9SH_q3GKIUsOUSRWkDxQg";
} ];
tls = {
cipherSuites = [
"TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256"
"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256"
];
minVersion = 1.2;
maxVersion = 1.3;
renegotiation = false;
};
};
};
address = (builtins.elemAt config.networking.interfaces.ens18.ipv4.addresses 0).address;
root_ca = pkgs.writeText "root_ca.crt" (builtins.readFile ../../ca/root_ca.crt);
intermediate_ca = pkgs.writeText "intermediate_ca.crt" (builtins.readFile ../../ca/intermediate_ca.crt);
in
{
age.secrets.acme_password = {
file = ../../secrets/acme_password.age;
};
age.secrets.intermediate_ca_key = {
file = ../../secrets/ca/intermediate_key.age;
};
age.secrets.root_ca_key.file = ../../secrets/ca/root_key.age;
systemd.services.step-ca.serviceConfig.Environment = lib.mkForce [ "STEPDEBUG=1" "HOME=%S/step-ca" ];
services.step-ca = {
inherit address;
enable = false;
intermediatePasswordFile = config.age.secrets.acme_password.path;
openFirewall = true;
port = 8443;
settings = {
root = root_ca;
federatedRoots = null;
cert = intermediate_ca;
key = config.age.secrets.intermediate_ca_key.path;
dnsNames = [
"10.42.1.5"
"acme.thehellings.lan"
];
logger.format = "text";
db = {
type = "badgerv2";
dataSource = "/var/lib/step-ca/db";
badgerFileLoadingMode = "";
};
authority.provisioners = [{
type = "JWK";
name = "greg@thehellings.com";
key = {
use = "sig";
kty = "EC";
kid = "1GOpOttYLZtx7XiG79ZycbGcG4ptL0czfohK35SZOEI";
crv = "P-256";
alg = "ES256";
x = "YEWVj5CCoqWQXWqmL0UuORlFY9IEOLcg1jpG1o-wGx4";
y = "MEpqnJp60VV-SpFtb6m8U-VAYut7R_PKFm07xl7MjBk";
};
encryptedKey = "eyJhbGciOiJQQkVTMi1IUzI1NitBMTI4S1ciLCJjdHkiOiJqd2sranNvbiIsImVuYyI6IkEyNTZHQ00iLCJwMmMiOjYwMDAwMCwicDJzIjoieWdfb0lfbWgwbHhPRXdjUTBsd0FnUSJ9.ivdQUFEhs2U8PUBYr8AhQl3hHdb4spF4jvXgqY_hiVgpjB-z3Nn9Uw.u7vrNht_3WD1G97q.mbydlpAQxjtKLkOmmDOUczqscRDPqrUyoPJ1uqXcJDH3vs4KiYlrKRcFLjPy9sWzEL1iIrqjwf3U-3AAx1KNAg7frs2D__MGfOO-U5SdQDVJVAND7KpWOJGJVSb0xioCA6-8ldlP_REqu4ENmkkdw0_6Is2b0p7ZFKqke_fqOOs7osqFAfbMb_WzEWrACLn5A5-Teh2rpEgR-z9zipN6MSEqE6VIQ2BXuv70aHWhslNe1MK1OgTYm9CqA47EMYvQ7HQLPDZAbP56WK84yJLktoXMmnkaKeTtvER0dh4ufyjJHBhecnEranbR5rHc_jV8_qvyWhlqbCrOU_8bWrk.a9SH_q3GKIUsOUSRWkDxQg";
}];
tls = {
cipherSuites = [
"TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256"
"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256"
];
minVersion = 1.2;
maxVersion = 1.3;
renegotiation = false;
};
};
};
}
hosts/genesis/default.nix
+34 -34
View File
@@ -5,43 +5,43 @@
{ config, pkgs, ... }:
{
imports = [
# Include the results of the hardware scan.
./acme.nix
./hardware-configuration.nix
./home-assistant.nix
./networking.nix
];
imports = [
# Include the results of the hardware scan.
./acme.nix
./hardware-configuration.nix
./home-assistant.nix
./networking.nix
];
greg.home = true;
greg.gnome.enable = false;
greg.home = true;
greg.gnome.enable = false;
# Bootloader.
boot.loader.grub = {
enable = true;
device = "/dev/vda";
useOSProber = true;
};
# Bootloader.
boot.loader.grub = {
enable = true;
device = "/dev/vda";
useOSProber = true;
};
#boot.loader = {
# systemd-boot.enable = true;
# efi = {
# canTouchEfiVariables = true;
# efiSysMountPoint = "/boot/efi";
# };
#};
#boot.loader = {
# systemd-boot.enable = true;
# efi = {
# canTouchEfiVariables = true;
# efiSysMountPoint = "/boot/efi";
# };
#};
networking.hostName = "genesis"; # Define your hostname.
environment.systemPackages = with pkgs; [
awscli2
create_ssl
step-ca
];
networking.hostName = "genesis"; # Define your hostname.
environment.systemPackages = with pkgs; [
awscli2
create_ssl
step-ca
];
virtualisation.oci-containers.containers.speedtest = {
image = "ghcr.io/librespeed/speedtest";
hostname = "speedtest";
ports = [ "19472:80" ];
};
greg.proxies."speedtest.thehellings.lan".target = "http://localhost:19472";
virtualisation.oci-containers.containers.speedtest = {
image = "ghcr.io/librespeed/speedtest";
hostname = "speedtest";
ports = [ "19472:80" ];
};
greg.proxies."speedtest.thehellings.lan".target = "http://localhost:19472";
}
hosts/genesis/hardware-configuration.nix
+5 -4
View File
@@ -5,7 +5,8 @@
{
imports =
[ (modulesPath + "/profiles/qemu-guest.nix")
[
(modulesPath + "/profiles/qemu-guest.nix")
];
boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "sr_mod" "virtio_blk" ];
@@ -14,13 +15,13 @@
boot.extraModulePackages = [ ];
fileSystems."/" =
{ device = "/dev/disk/by-uuid/a13f941e-4985-47ab-a8c6-374a627c5ce1";
{
device = "/dev/disk/by-uuid/a13f941e-4985-47ab-a8c6-374a627c5ce1";
fsType = "ext4";
};
swapDevices =
[ { device = "/dev/disk/by-uuid/ac4557de-1ad5-4d3c-b9f4-5ec50dbf76f1"; }
];
[{ device = "/dev/disk/by-uuid/ac4557de-1ad5-4d3c-b9f4-5ec50dbf76f1"; }];
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
# (the default) this is the recommended approach. When using systemd-networkd it's
hosts/genesis/home-assistant.nix
+118 -117
View File
@@ -1,135 +1,136 @@
{ config, pkgs, ... }:
let
service_list = [ "podman-home-assistant.service" ];
service_list = [ "podman-home-assistant.service" ];
in
{
virtualisation.podman.enable = true;
virtualisation.podman.enable = true;
services.home-assistant = {
enable = true;
configDir = "/var/lib/hass";
extraComponents = [
"accuweather"
"calendar"
"cast"
"eufy"
"lovelace"
"nextcloud"
"ping"
"piper"
"radio_browser"
"rainbird"
"roborock"
"smart_meter_texas"
"speedtestdotnet"
"solaredge"
"whisper"
"wiz"
"wyoming"
"zwave_js"
];
customComponents = with pkgs.home-assistant-custom-components; [
smartthinq-sensors
];
services.home-assistant = {
enable = true;
configDir = "/var/lib/hass";
extraComponents = [
"accuweather"
"calendar"
"cast"
"eufy"
"lovelace"
"nextcloud"
"ping"
"piper"
"radio_browser"
"rainbird"
"roborock"
"smart_meter_texas"
"speedtestdotnet"
"solaredge"
"whisper"
"wiz"
"wyoming"
"zwave_js"
];
customComponents = with pkgs.home-assistant-custom-components; [
smartthinq-sensors
];
config = {
default_config = {};
tts = [ { platform = "google_translate"; } ];
http = {
use_x_forwarded_for = true;
trusted_proxies = [ "127.0.0.1" "::1" ];
server_host = "127.0.0.1";
};
#"automation manual" = *nix config here* and so on
"automation ui" = "!include automations.yaml";
"script ui" = "!include scripts.yaml";
"scene ui" = "!include scenes.yaml";
};
};
config = {
default_config = { };
tts = [{ platform = "google_translate"; }];
http = {
use_x_forwarded_for = true;
trusted_proxies = [ "127.0.0.1" "::1" ];
server_host = "127.0.0.1";
};
#"automation manual" = *nix config here* and so on
"automation ui" = "!include automations.yaml";
"script ui" = "!include scripts.yaml";
"scene ui" = "!include scenes.yaml";
};
};
# Helps with Voice stuff for Home Assistant
services.wyoming = {
faster-whisper.servers = {
greg = {
enable = true;
beamSize = 1; # wut?
device = "auto"; # Could be CPU or CUDA
language = "en";
model = "base-int8";
uri = "tcp://0.0.0.0:13415";
};
};
piper.servers.greg = {
enable = true;
uri = "tcp://0.0.0.0:13416";
voice = "en_US-amy-medium";
};
};
# Helps with Voice stuff for Home Assistant
services.wyoming = {
faster-whisper.servers = {
greg = {
enable = true;
beamSize = 1; # wut?
device = "auto"; # Could be CPU or CUDA
language = "en";
model = "base-int8";
uri = "tcp://0.0.0.0:13415";
};
};
piper.servers.greg = {
enable = true;
uri = "tcp://0.0.0.0:13416";
voice = "en_US-amy-medium";
};
};
# Although NixOS has a package for Home Assistant, it is not kept as up to date as the container and the upstream
# is very vocal about only supporting their own container or the HAOS deployments. So we deploy the container here
# and avoid any potential messes from that
virtualisation.oci-containers = {
backend = "podman";
# Although NixOS has a package for Home Assistant, it is not kept as up to date as the container and the upstream
# is very vocal about only supporting their own container or the HAOS deployments. So we deploy the container here
# and avoid any potential messes from that
virtualisation.oci-containers = {
backend = "podman";
# I have ZWave devices. The easiest way to connect to them is the zwavejs2mqtt service running, so we spin up
# its container and map the ZWave device into it
containers.zwave = {
autoStart = false; # We will try to start it with udev.extraRules listed below, as this option starts it too quickly
image = "zwavejs/zwave-js-ui:latest";
ports = [ "8091:8091" "3000:3000" ];
volumes = [ "/var/lib/zwave:/usr/src/app/store" ];
extraOptions = [
"--device" "/dev/serial/by-id/usb-0658_0200-if00:/dev/zwave"
"--pull=newer"
];
environment = {
TZ = "America/Chicago";
CONSOLE_OUTPUT = "true";
};
};
};
# I have ZWave devices. The easiest way to connect to them is the zwavejs2mqtt service running, so we spin up
# its container and map the ZWave device into it
containers.zwave = {
autoStart = false; # We will try to start it with udev.extraRules listed below, as this option starts it too quickly
image = "zwavejs/zwave-js-ui:latest";
ports = [ "8091:8091" "3000:3000" ];
volumes = [ "/var/lib/zwave:/usr/src/app/store" ];
extraOptions = [
"--device"
"/dev/serial/by-id/usb-0658_0200-if00:/dev/zwave"
"--pull=newer"
];
environment = {
TZ = "America/Chicago";
CONSOLE_OUTPUT = "true";
};
};
};
# Both of the above container need storage for their configuration and devices, but it is not created correctly by
# the container. So we add the creation of /var/lib/{zwave,hass} to the systemd Unit files
systemd.services = {
"podman-zwave" = {
after = [ "sys-devices-pci0000:00-0000:00:1e.0-0000:02:1b.0-usb2-2\\x2d1-2\\x2d1:1.0-tty-ttyACM0.device" ];
wantedBy = [ "sys-devices-pci0000:00-0000:00:1e.0-0000:02:1b.0-usb2-2\\x2d1-2\\x2d1:1.0-tty-ttyACM0.device" ];
serviceConfig = {
StateDirectory = "zwave";
StateDirectoryMode = pkgs.lib.mkForce "0777";
};
};
};
# Both of the above container need storage for their configuration and devices, but it is not created correctly by
# the container. So we add the creation of /var/lib/{zwave,hass} to the systemd Unit files
systemd.services = {
"podman-zwave" = {
after = [ "sys-devices-pci0000:00-0000:00:1e.0-0000:02:1b.0-usb2-2\\x2d1-2\\x2d1:1.0-tty-ttyACM0.device" ];
wantedBy = [ "sys-devices-pci0000:00-0000:00:1e.0-0000:02:1b.0-usb2-2\\x2d1-2\\x2d1:1.0-tty-ttyACM0.device" ];
serviceConfig = {
StateDirectory = "zwave";
StateDirectoryMode = pkgs.lib.mkForce "0777";
};
};
};
services.udev.extraRules = ''
SUBSYSTEM=="tty", KERNEL=="ttyACM0", TAG+="systemd"
'';
services.udev.extraRules = ''
SUBSYSTEM=="tty", KERNEL=="ttyACM0", TAG+="systemd"
'';
greg.proxies = {
"smart.home".target = "http://127.0.0.1:8123/";
"smart.thehellings.lan".target = "http://127.0.0.1:8123/";
"zwave.home".target = "http://127.0.0.1:8091/";
};
greg.proxies = {
"smart.home".target = "http://127.0.0.1:8123/";
"smart.thehellings.lan".target = "http://127.0.0.1:8123/";
"zwave.home".target = "http://127.0.0.1:8091/";
};
# Ensure that both ports are up and running. We keep 8123 directly open because we are on the LAN and sometimes want to connect
# directly for troubleshooting Nginx configuration
networking.firewall = {
allowedTCPPorts = [ 80 443 ];
};
# Ensure that both ports are up and running. We keep 8123 directly open because we are on the LAN and sometimes want to connect
# directly for troubleshooting Nginx configuration
networking.firewall = {
allowedTCPPorts = [ 80 443 ];
};
greg.backup.jobs.zwave = {
src = "/var/lib/zwave";
dest = "zwave";
id = "zwave-asdf";
};
greg.backup.jobs.zwave = {
src = "/var/lib/zwave";
dest = "zwave";
id = "zwave-asdf";
};
greg.backup.jobs.hass-backup = {
src = "/var/lib/hass";
dest = "hass";
id = "hass-asdf";
};
greg.backup.jobs.hass-backup = {
src = "/var/lib/hass";
dest = "hass";
id = "hass-asdf";
};
}
hosts/genesis/networking.nix
+174 -173
View File
@@ -1,191 +1,192 @@
{ pkgs, config, ... }:
let
lan = "ens18";
lanIP = "10.42.1.5";
iot = "ens19";
iotIP = "192.168.66.250";
routerIP = "10.42.1.2";
extraHosts = builtins.readFile ./net/hosts;
lan = "ens18";
lanIP = "10.42.1.5";
iot = "ens19";
iotIP = "192.168.66.250";
routerIP = "10.42.1.2";
extraHosts = builtins.readFile ./net/hosts;
adblockUpdate = pkgs.writeShellScriptBin "adblockUpdate" (builtins.readFile ./adblockUpdate.sh);
proxyPort = 3128;
dnsPort = 53;
dhcpPort = 67;
dnsServers = [
"9.9.9.9" # Quad 9
"1.1.1.1" # Cloudflare
"1.0.0.1" # Cloudflare
"149.112.112.112" # Quad 9
];
in {
greg.tailscale.enable = true;
adblockUpdate = pkgs.writeShellScriptBin "adblockUpdate" (builtins.readFile ./adblockUpdate.sh);
proxyPort = 3128;
dnsPort = 53;
dhcpPort = 67;
dnsServers = [
"9.9.9.9" # Quad 9
"1.1.1.1" # Cloudflare
"1.0.0.1" # Cloudflare
"149.112.112.112" # Quad 9
];
in
{
greg.tailscale.enable = true;
# Really, why do I still have to force-disable this crap?
boot.kernel.sysctl = {
"net.ipv6.conf.${lan}.disable_ipv6" = true;
"net.ipv6.conf.${iot}.disable_ipv6" = true;
"net.ipv6.conf.lo.disable_ipv6" = true;
};
# Really, why do I still have to force-disable this crap?
boot.kernel.sysctl = {
"net.ipv6.conf.${lan}.disable_ipv6" = true;
"net.ipv6.conf.${iot}.disable_ipv6" = true;
"net.ipv6.conf.lo.disable_ipv6" = true;
};
networking = {
enableIPv6 = false;
networkmanager.enable = pkgs.lib.mkForce false;
defaultGateway = routerIP;
nameservers = dnsServers;
interfaces = {
# This is our LAN port
"${lan}" = {
useDHCP = false;
ipv4.addresses = [ {
address = "${lanIP}";
prefixLength = 16;
} ];
};
networking = {
enableIPv6 = false;
networkmanager.enable = pkgs.lib.mkForce false;
defaultGateway = routerIP;
nameservers = dnsServers;
interfaces = {
# This is our LAN port
"${lan}" = {
useDHCP = false;
ipv4.addresses = [{
address = "${lanIP}";
prefixLength = 16;
}];
};
"${iot}" = {
useDHCP = false;
ipv4.addresses = [ {
address = "${iotIP}";
prefixLength = 24;
} ];
};
};
firewall = {
enable = false;
allowedUDPPorts = [
dhcpPort
dnsPort
1900 # Jellyfin auto-discovery
7359 # Jellyfin auto-discovery
];
allowedTCPPorts = [
dnsPort
proxyPort
80
];
};
nftables.enable = false;
};
"${iot}" = {
useDHCP = false;
ipv4.addresses = [{
address = "${iotIP}";
prefixLength = 24;
}];
};
};
firewall = {
enable = false;
allowedUDPPorts = [
dhcpPort
dnsPort
1900 # Jellyfin auto-discovery
7359 # Jellyfin auto-discovery
];
allowedTCPPorts = [
dnsPort
proxyPort
80
];
};
nftables.enable = false;
};
environment.etc."hosts.d/local".text = extraHosts;
environment.etc."hosts.d/local".text = extraHosts;
fileSystems = {
"/media" = {
device = "10.42.1.4:/volume1/video/";
fsType = "nfs";
options = [ "ro" ];
};
};
fileSystems = {
"/media" = {
device = "10.42.1.4:/volume1/video/";
fsType = "nfs";
options = [ "ro" ];
};
};
services = {
# Video services
jellyfin = {
enable = true;
openFirewall = true;
};
services = {
# Video services
jellyfin = {
enable = true;
openFirewall = true;
};
#########
# Blind service proxy behind the walls of the VPN
########
_3proxy = {
enable = true;
services = [ {
type = "socks";
auth = [ "strong" ];
bindPort = proxyPort;
acl = [ {
rule = "allow";
users = [ "greg" ];
} ];
} ];
#usersFile = "/run/agenix/3proxy";
denyPrivate = false;
};
#########
# Blind service proxy behind the walls of the VPN
########
_3proxy = {
enable = true;
services = [{
type = "socks";
auth = [ "strong" ];
bindPort = proxyPort;
acl = [{
rule = "allow";
users = [ "greg" ];
}];
}];
#usersFile = "/run/agenix/3proxy";
denyPrivate = false;
};
#########
# dnsmasq config
########
dnsmasq = {
enable = true;
settings = {
domain = "thehellings.lan";
dhcp-range = [
"${lan},10.42.2.1,10.42.2.255,255.255.0.0,12h"
"${iot},192.168.66.3,192.168.66.150,255.255.255.0,12h"
"vlan67@${lan},192.168.67.3,192.168.67.150,12h"
];
dhcp-option = [
"${lan},option:router,${routerIP}"
"${lan},option:dns-server,${lanIP},1.1.1.1"
"${lan},option:domain-search,thehellings.lan"
#########
# dnsmasq config
########
dnsmasq = {
enable = true;
settings = {
domain = "thehellings.lan";
dhcp-range = [
"${lan},10.42.2.1,10.42.2.255,255.255.0.0,12h"
"${iot},192.168.66.3,192.168.66.150,255.255.255.0,12h"
"vlan67@${lan},192.168.67.3,192.168.67.150,12h"
];
dhcp-option = [
"${lan},option:router,${routerIP}"
"${lan},option:dns-server,${lanIP},1.1.1.1"
"${lan},option:domain-search,thehellings.lan"
"${iot},option:router,192.168.66.1"
"${iot},option:dns-server,${iotIP}"
"${iot},option:router,192.168.66.1"
"${iot},option:dns-server,${iotIP}"
"vlan67@${lan},option:router,192.168.67.1"
"vlan67@${lan},option:dns-server,192.168.67.1"
];
dhcp-host = [
# Static IPs for personal work
"2a:5d:23:10:4e:22,10.42.0.5" # SAN Switch
"00:00:de:ad:be:ef,10.42.2.254"
"01:a8:a1:59:c7:8a:12,10.42.2.253" # BMC management interface for isaiah
"vlan67@${lan},option:router,192.168.67.1"
"vlan67@${lan},option:dns-server,192.168.67.1"
];
dhcp-host = [
# Static IPs for personal work
"2a:5d:23:10:4e:22,10.42.0.5" # SAN Switch
"00:00:de:ad:be:ef,10.42.2.254"
"01:a8:a1:59:c7:8a:12,10.42.2.253" # BMC management interface for isaiah
# Static IPs for things in the IOT range
"b4:b0:24:9a:02:4a,192.168.66.5" # LD125
"98:da:c4:20:f3:64,192.168.66.6" # Dining room light
"54:af:97:c1:dc:b9,192.168.66.25" # Master bedroom Kasa switch
"f0:03:8c:b3:b0:f6,192.168.66.55" # Roomba
"4c:a1:61:05:cd:52,192.168.66.61" # Rainbird
"48:d6:d5:5d:81:21,192.168.66.65" # Google Home
"6c:29:90:3e:e2:02,192.168.66.66" # wiz
"28:87:ba:0e:ca:da,192.168.66.74" #
"28:87:ba:0e:c9:fd,192.168.66.75" # Master closet
"54:af:97:c2:0f:a1,192.168.66.76" # Master toilet
"54:af:97:83:ed:33,192.168.66.80"
"98:da:c4:77:80:18,192.168.66.84" # Kitchen lights
"98:da:c4:21:1b:2e,192.168.66.85" # Living Room lights
"0c:80:63:41:6e:0f,192.168.66.90" # Front porch
"0c:80:63:41:6c:5d,192.168.66.98" # House number
"ac:84:c6:5e:4b:28,192.168.66.100"
"98:da:c4:77:7f:4d,192.168.66.102" # Office lights
"8c:85:80:1c:f9:d1,192.168.66.104"
"98:da:c4:77:82:7b,192.168.66.105" # Parlor lamp
"0c:80:63:41:74:73,192.168.66.106" # Front hall light switch
"98:da:c4:20:ea:db,192.168.66.107" # Parlor light switch
"8c:49:62:aa:58:60,192.168.66.108" # Roku, HiHandsome
"92:3e:11:c7:c5:be,192.168.66.109"
"d8:0d:17:19:60:62,192.168.66.112"
"b4:b0:24:9a:12:53,192.168.66.130" # KL125
"b4:b0:24:9a:14:0e,192.168.66.131"
"e4:f0:42:61:fa:b5,192.168.66.149" # Google Home-mini
];
expand-hosts = true;
log-dhcp = true;
log-queries = true;
no-hosts = true; # Do not read /etc/hosts, which makes genesis resolve to 127.0.0.2
addn-hosts = "/etc/adblock_hosts";
hostsdir = "/etc/hosts.d/";
server = dnsServers;
};
};
# Static IPs for things in the IOT range
"b4:b0:24:9a:02:4a,192.168.66.5" # LD125
"98:da:c4:20:f3:64,192.168.66.6" # Dining room light
"54:af:97:c1:dc:b9,192.168.66.25" # Master bedroom Kasa switch
"f0:03:8c:b3:b0:f6,192.168.66.55" # Roomba
"4c:a1:61:05:cd:52,192.168.66.61" # Rainbird
"48:d6:d5:5d:81:21,192.168.66.65" # Google Home
"6c:29:90:3e:e2:02,192.168.66.66" # wiz
"28:87:ba:0e:ca:da,192.168.66.74" #
"28:87:ba:0e:c9:fd,192.168.66.75" # Master closet
"54:af:97:c2:0f:a1,192.168.66.76" # Master toilet
"54:af:97:83:ed:33,192.168.66.80"
"98:da:c4:77:80:18,192.168.66.84" # Kitchen lights
"98:da:c4:21:1b:2e,192.168.66.85" # Living Room lights
"0c:80:63:41:6e:0f,192.168.66.90" # Front porch
"0c:80:63:41:6c:5d,192.168.66.98" # House number
"ac:84:c6:5e:4b:28,192.168.66.100"
"98:da:c4:77:7f:4d,192.168.66.102" # Office lights
"8c:85:80:1c:f9:d1,192.168.66.104"
"98:da:c4:77:82:7b,192.168.66.105" # Parlor lamp
"0c:80:63:41:74:73,192.168.66.106" # Front hall light switch
"98:da:c4:20:ea:db,192.168.66.107" # Parlor light switch
"8c:49:62:aa:58:60,192.168.66.108" # Roku, HiHandsome
"92:3e:11:c7:c5:be,192.168.66.109"
"d8:0d:17:19:60:62,192.168.66.112"
"b4:b0:24:9a:12:53,192.168.66.130" # KL125
"b4:b0:24:9a:14:0e,192.168.66.131"
"e4:f0:42:61:fa:b5,192.168.66.149" # Google Home-mini
];
expand-hosts = true;
log-dhcp = true;
log-queries = true;
no-hosts = true; # Do not read /etc/hosts, which makes genesis resolve to 127.0.0.2
addn-hosts = "/etc/adblock_hosts";
hostsdir = "/etc/hosts.d/";
server = dnsServers;
};
};
# Update adblock list
cron = {
enable = true;
systemCronJobs = [
"* * * * * root ${adblockUpdate} 2>&1 > /var/log/adblock.log"
];
};
}; # End of services configuration
# Update adblock list
cron = {
enable = true;
systemCronJobs = [
"* * * * * root ${adblockUpdate} 2>&1 > /var/log/adblock.log"
];
};
}; # End of services configuration
greg.proxies = {
"jellyfin.home".target = "http://localhost:8096/";
};
greg.proxies = {
"jellyfin.home".target = "http://localhost:8096/";
};
environment.systemPackages = with pkgs; [
bind
curl # Used by dnsmasq fetching
sqlite
];
environment.systemPackages = with pkgs; [
bind
curl # Used by dnsmasq fetching
sqlite
];
}
hosts/hosea/bitcoin.nix
+71 -70
View File
@@ -1,78 +1,79 @@
{ config, pkgs, ... }:
let
ip = "100.68.203.1";
in {
nix-bitcoin = {
generateSecrets = true;
operator = {
enable = true;
name = "greg";
};
useVersionLockedPkgs = true; # Use the exact versions of packages from upstream
};
ip = "100.68.203.1";
in
{
nix-bitcoin = {
generateSecrets = true;
operator = {
enable = true;
name = "greg";
};
useVersionLockedPkgs = true; # Use the exact versions of packages from upstream
};
networking.firewall.allowedTCPPorts = with config.services; [
bitcoind.port
bitcoind.rpc.port
lnd.restPort
lnd.port
mempool.frontend.port
];
networking.firewall.allowedTCPPorts = with config.services; [
bitcoind.port
bitcoind.rpc.port
lnd.restPort
lnd.port
mempool.frontend.port
];
greg.backup.jobs = {
clightning = {
src = config.services.clightning.replication.local.directory;
dest = "hosea-clightning";
id = "clightning";
};
};
greg.backup.jobs = {
clightning = {
src = config.services.clightning.replication.local.directory;
dest = "hosea-clightning";
id = "clightning";
};
};
services = {
backups = {
enable = true;
frequency = "hourly";
};
bitcoind = {
enable = true;
address = "0.0.0.0";
dataDir = "/chain/bitcoind";
listen = true;
rpc = {
address = ip;
allowip = [
"100.1.1.1/8"
];
};
};
clightning = {
enable = true;
address = ip;
port = 9736;
replication = {
enable = true;
local.directory = "/var/backup/clightning";
encrypt = false;
};
};
electrs = {
enable = true;
address = ip;
};
lnd = {
enable = true;
address = ip;
lndconnect.enable = true;
};
mempool = {
enable = true;
frontend = {
enable = true;
address = ip;
};
};
};
services = {
backups = {
enable = true;
frequency = "hourly";
};
bitcoind = {
enable = true;
address = "0.0.0.0";
dataDir = "/chain/bitcoind";
listen = true;
rpc = {
address = ip;
allowip = [
"100.1.1.1/8"
];
};
};
clightning = {
enable = true;
address = ip;
port = 9736;
replication = {
enable = true;
local.directory = "/var/backup/clightning";
encrypt = false;
};
};
electrs = {
enable = true;
address = ip;
};
lnd = {
enable = true;
address = ip;
lndconnect.enable = true;
};
mempool = {
enable = true;
frontend = {
enable = true;
address = ip;
};
};
};
environment.systemPackages = with pkgs; [
];
environment.systemPackages = with pkgs; [
];
}
hosts/hosea/default.nix
+49 -48
View File
@@ -4,58 +4,59 @@
{ config, pkgs, lib, inputs, overlays, ... }:
let
wanInterface = "enp2s0";
lanInterface = "enp1s0";
lanIpAddress = "10.42.1.7";
wanInterface = "enp2s0";
lanInterface = "enp1s0";
lanIpAddress = "10.42.1.7";
in
{
imports =
[ # Include the results of the hardware scan.
./hardware-configuration.nix
inputs.btc.nixosModules.default
./bitcoin.nix
];
imports =
[
# Include the results of the hardware scan.
./hardware-configuration.nix
inputs.btc.nixosModules.default
./bitcoin.nix
];
# Bootloader
boot = {
loader = {
systemd-boot.enable = true;
efi = {
canTouchEfiVariables = true;
efiSysMountPoint = "/boot/";
};
};
extraModprobeConfig = "vboxdrv";
};
users.users.greg.extraGroups = [ "vboxusers" ];
# Bootloader
boot = {
loader = {
systemd-boot.enable = true;
efi = {
canTouchEfiVariables = true;
efiSysMountPoint = "/boot/";
};
};
extraModprobeConfig = "vboxdrv";
};
users.users.greg.extraGroups = [ "vboxusers" ];
networking = {
hostName = "hosea";
nameservers = [ "10.42.1.5" ];
defaultGateway = "10.42.1.1";
interfaces = {
"${wanInterface}".useDHCP = true;
"${lanInterface}" = {
useDHCP = false;
ipv4.addresses = [{
address = lanIpAddress;
prefixLength = 16;
}];
};
};
};
networking = {
hostName = "hosea";
nameservers = [ "10.42.1.5" ];
defaultGateway = "10.42.1.1";
interfaces = {
"${wanInterface}".useDHCP = true;
"${lanInterface}" = {
useDHCP = false;
ipv4.addresses = [{
address = lanIpAddress;
prefixLength = 16;
}];
};
};
};
# Serves as the router, DHCP, and DNS for the site
greg = {
tailscale.enable = true;
home = true;
};
services = {
# Configure keymap
xserver.xkb = {
layout = "us";
variant = "";
};
};
# Serves as the router, DHCP, and DNS for the site
greg = {
tailscale.enable = true;
home = true;
};
services = {
# Configure keymap
xserver.xkb = {
layout = "us";
variant = "";
};
};
}
hosts/hosea/hardware-configuration.nix
+6 -3
View File
@@ -5,7 +5,8 @@
{
imports =
[ (modulesPath + "/installer/scan/not-detected.nix")
[
(modulesPath + "/installer/scan/not-detected.nix")
];
boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "nvme" "usbhid" "uas" "sd_mod" ];
@@ -14,13 +15,15 @@
boot.extraModulePackages = [ ];
fileSystems."/" =
{ device = "/dev/disk/by-uuid/d4ac74f7-62bb-421a-aad8-566277c9d8ba";
{
device = "/dev/disk/by-uuid/d4ac74f7-62bb-421a-aad8-566277c9d8ba";
fsType = "btrfs";
options = [ "subvol=@" ];
};
fileSystems."/boot" =
{ device = "/dev/disk/by-uuid/1F51-B638";
{
device = "/dev/disk/by-uuid/1F51-B638";
fsType = "vfat";
};
hosts/icdm-root/boot.nix
+8 -8
View File
@@ -1,11 +1,11 @@
{ pkgs, config, ...}:
{ pkgs, config, ... }:
{
# Bootloader.
boot = {
loader.grub = {
enable = true;
device = "/dev/sda";
};
};
# Bootloader.
boot = {
loader.grub = {
enable = true;
device = "/dev/sda";
};
};
}
hosts/icdm-root/default.nix
+16 -15
View File
@@ -5,20 +5,21 @@
{ config, pkgs, agenix, ... }:
{
imports = [ # Include the results of the hardware scan.
./hardware-configuration.nix
./boot.nix
./filesystem.nix
./location.nix
./networking.nix
./wiki.nix
];
imports = [
# Include the results of the hardware scan.
./hardware-configuration.nix
./boot.nix
./filesystem.nix
./location.nix
./networking.nix
./wiki.nix
];
# Define a user account. Don't forget to set a password with ‘passwd’.
users.users.greg = {
isNormalUser = true;
description = "Gregory Hellings";
extraGroups = [ "networkmanager" "wheel" ];
packages = with pkgs; [];
};
# Define a user account. Don't forget to set a password with ‘passwd’.
users.users.greg = {
isNormalUser = true;
description = "Gregory Hellings";
extraGroups = [ "networkmanager" "wheel" ];
packages = with pkgs; [ ];
};
}
hosts/icdm-root/filesystem.nix
+7 -7
View File
@@ -2,11 +2,11 @@
let
in {
fileSystems."serve" = {
#device = "10.42.1.4:/volume1/icdm-mysql/";
#fsType = "nfs";
device = "/dev/sdb1";
fsType = "auto";
mountPoint = "/srv";
};
fileSystems."serve" = {
#device = "10.42.1.4:/volume1/icdm-mysql/";
#fsType = "nfs";
device = "/dev/sdb1";
fsType = "auto";
mountPoint = "/srv";
};
}
hosts/icdm-root/hardware-configuration.nix
+9 -6
View File
@@ -5,7 +5,8 @@
{
imports =
[ (modulesPath + "/installer/scan/not-detected.nix")
[
(modulesPath + "/installer/scan/not-detected.nix")
];
boot.initrd.availableKernelModules = [ "xhci_pci" "ehci_pci" "ahci" "usbhid" "usb_storage" "sd_mod" ];
@@ -14,24 +15,26 @@
boot.extraModulePackages = [ ];
fileSystems."/" =
{ device = "/dev/disk/by-uuid/dab0d455-e25e-4445-8fa4-5320047d7e7b";
{
device = "/dev/disk/by-uuid/dab0d455-e25e-4445-8fa4-5320047d7e7b";
fsType = "btrfs";
options = [ "subvol=@" ];
};
fileSystems."/boot" =
{ device = "/dev/disk/by-uuid/5aedbb07-5761-423b-909d-2560405eae32";
{
device = "/dev/disk/by-uuid/5aedbb07-5761-423b-909d-2560405eae32";
fsType = "ext4";
};
fileSystems."/var" =
{ device = "/dev/disk/by-uuid/57968536-c29d-417d-997e-85223d1d1f65";
{
device = "/dev/disk/by-uuid/57968536-c29d-417d-997e-85223d1d1f65";
fsType = "btrfs";
};
swapDevices =
[ { device = "/dev/disk/by-uuid/09691dce-375a-43c6-8d40-4498d20a6d9a"; }
];
[{ device = "/dev/disk/by-uuid/09691dce-375a-43c6-8d40-4498d20a6d9a"; }];
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
# (the default) this is the recommended approach. When using systemd-networkd it's
hosts/icdm-root/location.nix
+1 -1
View File
@@ -1,4 +1,4 @@
{...}:
{ ... }:
{
# Set your time zone.
hosts/icdm-root/networking.nix
+52 -51
View File
@@ -1,58 +1,59 @@
{...}:
{ ... }:
let
dnsHosts = builtins.concatStringsSep "\n" [
"wiki.icdm.lan 10.42.101.1"
];
dnsHosts = builtins.concatStringsSep "\n" [
"wiki.icdm.lan 10.42.101.1"
];
in
{
# If we have to do proxying in Bayonnais, we can start to work on that here
# networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";
networking = {
hostName = "icdm-root";
useDHCP = false;
defaultGateway = "10.42.1.1";
nameservers = [ "100.100.100.100" "10.42.1.2" ];
enableIPv6 = false;
# If we have to do proxying in Bayonnais, we can start to work on that here
# networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";
networking = {
hostName = "icdm-root";
useDHCP = false;
defaultGateway = "10.42.1.1";
nameservers = [ "100.100.100.100" "10.42.1.2" ];
enableIPv6 = false;
interfaces = {
eno1.ipv4.addresses = [ {
address = "10.42.101.1";
prefixLength = 16;
} {
address = "10.77.1.2";
prefixLength = 16;
} ];
};
# Allow traffic through
firewall = {
enable = true;
allowedTCPPorts = [ 53 ];
allowedUDPPorts = [ 53 67 ];
};
interfaces = {
eno1.ipv4.addresses = [{
address = "10.42.101.1";
prefixLength = 16;
}
{
address = "10.77.1.2";
prefixLength = 16;
}];
};
# Allow traffic through
firewall = {
enable = true;
allowedTCPPorts = [ 53 ];
allowedUDPPorts = [ 53 67 ];
};
extraHosts = "${dnsHosts}";
};
extraHosts = "${dnsHosts}";
};
services.dnsmasq = {
enable = true;
settings = {
domain = "icdm.lan";
dhcp-range = [
"eno1,10.77.1.10,10.77.1.255,255.255.0.0,12h"
];
dhcp-option = [
"eno1,option:router,10.77.1.1"
"eno1,option:dns-server,10.77.1.2,1.1.1.1"
"eno1,option:domain-search,icdm.lan"
];
expand-hosts = true;
log-dhcp = true;
log-queries = true;
# Upstream servers
server = [
"1.1.1.1"
"8.8.4.4"
];
};
};
services.dnsmasq = {
enable = true;
settings = {
domain = "icdm.lan";
dhcp-range = [
"eno1,10.77.1.10,10.77.1.255,255.255.0.0,12h"
];
dhcp-option = [
"eno1,option:router,10.77.1.1"
"eno1,option:dns-server,10.77.1.2,1.1.1.1"
"eno1,option:domain-search,icdm.lan"
];
expand-hosts = true;
log-dhcp = true;
log-queries = true;
# Upstream servers
server = [
"1.1.1.1"
"8.8.4.4"
];
};
};
}
hosts/icdm-root/wiki.nix
+24 -24
View File
@@ -1,32 +1,32 @@
{ pkgs, ... }:
let
wikiPasswordFile = "/var/mediawiki/passwordFile";
wikiHost = "wiki.icdm.lan";
kiwixport = 8080;
dependents = with pkgs; [
enwiki-dump
transmission
];
wikiPasswordFile = "/var/mediawiki/passwordFile";
wikiHost = "wiki.icdm.lan";
kiwixport = 8080;
dependents = with pkgs; [
enwiki-dump
transmission
];
in
{
services.kiwix-serve = {
enable = true;
port = kiwixport;
path = "/srv/zims/*.zim";
};
services.kiwix-serve = {
enable = true;
port = kiwixport;
path = "/srv/zims/*.zim";
};
services.transmission = {
enable = true;
settings = {
download-dir = "/srv";
incomplete-dir = "/srv/incomplete";
rpc-bind-address = "0.0.0.0";
rpc-whitelist = "10.42.*,127.*,localhost";
};
};
services.transmission = {
enable = true;
settings = {
download-dir = "/srv";
incomplete-dir = "/srv/incomplete";
rpc-bind-address = "0.0.0.0";
rpc-whitelist = "10.42.*,127.*,localhost";
};
};
greg.proxies."${wikiHost}".target = "http://localhost:${toString kiwixport}";
networking.firewall.allowedTCPPorts = [ 80 ];
greg.proxies."${wikiHost}".target = "http://localhost:${toString kiwixport}";
networking.firewall.allowedTCPPorts = [ 80 ];
environment.systemPackages = dependents;
environment.systemPackages = dependents;
}
hosts/iso/default.nix
+10 -10
View File
@@ -1,15 +1,15 @@
{ pkgs, lib, modulesPath, ... }:
{
imports = [
"${modulesPath}/installer/cd-dvd/installation-cd-graphical-calamares-gnome.nix"
"${modulesPath}/installer/cd-dvd/channel.nix"
];
imports = [
"${modulesPath}/installer/cd-dvd/installation-cd-graphical-calamares-gnome.nix"
"${modulesPath}/installer/cd-dvd/channel.nix"
];
networking.networkmanager.enable = lib.mkForce false;
users.users.greg.initialPassword = "";
#services.getty.autologinUser = lib.mkForce "greg";
environment.systemPackages = with pkgs; [
tree
];
networking.networkmanager.enable = lib.mkForce false;
users.users.greg.initialPassword = "";
#services.getty.autologinUser = lib.mkForce "greg";
environment.systemPackages = with pkgs; [
tree
];
}
hosts/jeremiah/ceph.nix
+30 -29
View File
@@ -1,33 +1,34 @@
{ config, ... }:
let
publicIp = (builtins.elemAt config.networking.interfaces.enp68s0.ipv4.addresses 0).address;
sanIp = (builtins.elemAt config.networking.interfaces.enp67s0.ipv4.addresses 0).address;
vip = (builtins.elemAt config.networking.interfaces.enp68s0.ipv4.addresses 1).address;
hostname = config.networking.hostName;
baseConfig = import ../../ceph/home.nix;
in {
services.ceph-benaco = baseConfig // {
enable = false;
monitor = {
enable = false;
initialKeyring = ../../secrets/home.mon.keyring;
nodeName = hostname;
bindAddr = publicIp;
advertisedPublicAddr = vip;
};
osdBindAddr = publicIp;
osdAdvertisedPublicAddr = publicIp;
osds = {
osd1 = {
enable = false;
bootstrapKeyring = ../../secrets/home.osd-bootstrap.keyring;
id = 1;
uuid = "c13bd2b1-cfc7-4966-8da5-d92356e87e06";
blockDevice = "/dev/sda";
blockDeviceUdevRuleMatcher = ''KERNEL=="sda"'';
clusterAddress = sanIp;
};
};
};
publicIp = (builtins.elemAt config.networking.interfaces.enp68s0.ipv4.addresses 0).address;
sanIp = (builtins.elemAt config.networking.interfaces.enp67s0.ipv4.addresses 0).address;
vip = (builtins.elemAt config.networking.interfaces.enp68s0.ipv4.addresses 1).address;
hostname = config.networking.hostName;
baseConfig = import ../../ceph/home.nix;
in
{
services.ceph-benaco = baseConfig // {
enable = false;
monitor = {
enable = false;
initialKeyring = ../../secrets/home.mon.keyring;
nodeName = hostname;
bindAddr = publicIp;
advertisedPublicAddr = vip;
};
osdBindAddr = publicIp;
osdAdvertisedPublicAddr = publicIp;
osds = {
osd1 = {
enable = false;
bootstrapKeyring = ../../secrets/home.osd-bootstrap.keyring;
id = 1;
uuid = "c13bd2b1-cfc7-4966-8da5-d92356e87e06";
blockDevice = "/dev/sda";
blockDeviceUdevRuleMatcher = ''KERNEL=="sda"'';
clusterAddress = sanIp;
};
};
};
}
hosts/jeremiah/default.nix
+118 -116
View File
@@ -5,125 +5,127 @@
{ config, pkgs, lib, ... }:
{
imports =
[ # Include the results of the hardware scan.
./ceph.nix
./hardware-configuration.nix
./minio.nix
];
imports =
[
# Include the results of the hardware scan.
./ceph.nix
./hardware-configuration.nix
./minio.nix
];
# Bootloader.
boot.loader.systemd-boot.enable = true;
boot.loader.efi.canTouchEfiVariables = true;
# Bootloader.
boot.loader.systemd-boot.enable = true;
boot.loader.efi.canTouchEfiVariables = true;
networking = {
hostName = "jeremiah"; # Define your hostname.
useDHCP = false;
defaultGateway = {
address = " 10.42.1.1";
interface = "enp68s0";
};
vlans = {
san = {
id = 616;
interface = "enp67s0";
};
};
interfaces = {
enp68s0 = {
ipv4.addresses = [ {
address = "10.42.1.8";
prefixLength = 16;
} {
address = "10.42.100.1";
prefixLength = 16;
} ];
};
san = {
ipv4.addresses = [ {
address = "10.201.1.2";
prefixLength = 24;
} ];
};
};
nameservers = [
"10.42.1.5"
];
};
greg = {
home = true;
tailscale.enable = true;
};
environment.systemPackages = with pkgs; [
curl
gawk
git
unzip
wget
];
networking = {
hostName = "jeremiah"; # Define your hostname.
useDHCP = false;
defaultGateway = {
address = " 10.42.1.1";
interface = "enp68s0";
};
vlans = {
san = {
id = 616;
interface = "enp67s0";
};
};
interfaces = {
enp68s0 = {
ipv4.addresses = [{
address = "10.42.1.8";
prefixLength = 16;
}
{
address = "10.42.100.1";
prefixLength = 16;
}];
};
san = {
ipv4.addresses = [{
address = "10.201.1.2";
prefixLength = 24;
}];
};
};
nameservers = [
"10.42.1.5"
];
};
greg = {
home = true;
tailscale.enable = true;
};
environment.systemPackages = with pkgs; [
curl
gawk
git
unzip
wget
];
fileSystems = {
"/nix" = {
fsType = "btrfs";
options = [ "subvol=nix" ];
device = "/dev/nvme0n1p1";
};
"/var" = {
fsType = "btrfs";
options = [ "subvol=var" ];
device = "/dev/nvme0n1p1";
};
};
fileSystems = {
"/nix" = {
fsType = "btrfs";
options = [ "subvol=nix" ];
device = "/dev/nvme0n1p1";
};
"/var" = {
fsType = "btrfs";
options = [ "subvol=var" ];
device = "/dev/nvme0n1p1";
};
};
#####################################################################################
#################### Virtualbox Runner ##############################################
#####################################################################################
services = {
gitlab-runner = {
enable = true;
settings.concurrent = 7;
services = {
shell = {
executor = "shell";
limit = 5;
authenticationTokenConfigFile = config.age.secrets.runner-reg.path;
environmentVariables = {
EFI_DIR = "${pkgs.OVMF.fd}/FV/";
STORAGE_URL = "http://s3.thehellings.lan:9000";
};
};
};
};
};
age.secrets.runner-reg.file = ../../secrets/gitlab/jeremiah-runner-reg.age;
virtualisation.virtualbox.host = {
enable = true;
enableExtensionPack = true;
enableHardening = false;
headless = true;
enableWebService = true;
};
#####################################################################################
#################### Virtualbox Runner ##############################################
#####################################################################################
services = {
gitlab-runner = {
enable = true;
settings.concurrent = 7;
services = {
shell = {
executor = "shell";
limit = 5;
authenticationTokenConfigFile = config.age.secrets.runner-reg.path;
environmentVariables = {
EFI_DIR = "${pkgs.OVMF.fd}/FV/";
STORAGE_URL = "http://s3.thehellings.lan:9000";
};
};
};
};
};
age.secrets.runner-reg.file = ../../secrets/gitlab/jeremiah-runner-reg.age;
virtualisation.virtualbox.host = {
enable = true;
enableExtensionPack = true;
enableHardening = false;
headless = true;
enableWebService = true;
};
systemd.services."gitlab-runner" = {
after = [
"network.target"
"network-online.target"
"systemd-resolved.service"
];
wants = [
"network-online.target"
"systemd-resolved.service"
];
preStart = builtins.concatStringsSep "\n" [
"${pkgs.kmod}/bin/modprobe vboxdrv"
"${pkgs.kmod}/bin/modprobe vboxnetadp"
"${pkgs.kmod}/bin/modprobe vboxnetflt"
];
postStop = "${pkgs.kmod}/bin/rmmod vboxnetadp vboxnetflt vboxdrv";
serviceConfig = {
DevicePolicy = lib.mkForce "auto";
User = "root";
DynamicUser = lib.mkForce false;
};
};
systemd.services."gitlab-runner" = {
after = [
"network.target"
"network-online.target"
"systemd-resolved.service"
];
wants = [
"network-online.target"
"systemd-resolved.service"
];
preStart = builtins.concatStringsSep "\n" [
"${pkgs.kmod}/bin/modprobe vboxdrv"
"${pkgs.kmod}/bin/modprobe vboxnetadp"
"${pkgs.kmod}/bin/modprobe vboxnetflt"
];
postStop = "${pkgs.kmod}/bin/rmmod vboxnetadp vboxnetflt vboxdrv";
serviceConfig = {
DevicePolicy = lib.mkForce "auto";
User = "root";
DynamicUser = lib.mkForce false;
};
};
}
hosts/jeremiah/hardware-configuration.nix
+6 -3
View File
@@ -5,7 +5,8 @@
{
imports =
[ (modulesPath + "/installer/scan/not-detected.nix")
[
(modulesPath + "/installer/scan/not-detected.nix")
];
boot.initrd.availableKernelModules = [ "nvme" "xhci_pci" "ahci" "uas" "usbhid" "sd_mod" ];
@@ -14,12 +15,14 @@
boot.extraModulePackages = [ ];
fileSystems."/" =
{ device = "/dev/disk/by-uuid/ffc167f5-d9e4-4b11-a5f1-f7da0550ad24";
{
device = "/dev/disk/by-uuid/ffc167f5-d9e4-4b11-a5f1-f7da0550ad24";
fsType = "ext4";
};
fileSystems."/boot" =
{ device = "/dev/disk/by-uuid/3047-870E";
{
device = "/dev/disk/by-uuid/3047-870E";
fsType = "vfat";
};
hosts/jeremiah/minio.nix
+24 -23
View File
@@ -1,32 +1,33 @@
{ config, pkgs, ... }:
let
minioPort = 9000;
minioConsolePort = 9001;
in {
environment.systemPackages = with pkgs; [
minio-client
xfsprogs
];
minioPort = 9000;
minioConsolePort = 9001;
in
{
environment.systemPackages = with pkgs; [
minio-client
xfsprogs
];
greg.proxies."minio-02.thehellings.lan".target = "http://localhost:9000";
greg.proxies."minio-02.thehellings.lan".target = "http://localhost:9000";
fileSystems."/data/1" = {
device = "/dev/disk/by-id/ata-ST12000NM0558_ZHZ5YSXW-part1";
fsType = "xfs";
};
fileSystems."/data/1" = {
device = "/dev/disk/by-id/ata-ST12000NM0558_ZHZ5YSXW-part1";
fsType = "xfs";
};
networking.firewall.allowedTCPPorts = [
minioPort
minioConsolePort
];
networking.firewall.allowedTCPPorts = [
minioPort
minioConsolePort
];
age.secrets.minio.file = ../../secrets/minio.age;
age.secrets.minio.file = ../../secrets/minio.age;
services.minio = {
enable = true;
dataDir = [ "/data/1/minio" ];
rootCredentialsFile = config.age.secrets.minio.path;
browser = true;
};
services.minio = {
enable = true;
dataDir = [ "/data/1/minio" ];
rootCredentialsFile = config.age.secrets.minio.path;
browser = true;
};
}
hosts/jude/boot.nix
+46 -46
View File
@@ -1,50 +1,50 @@
{ lib, pkgs, ... }:
{
# Use the systemd-boot EFI boot loader.
boot = {
binfmt.emulatedSystems = [ "aarch64-linux" ];
kernelPackages = pkgs.linuxPackages_latest;
supportedFilesystems = [ "ntfs" ];
loader = {
timeout = 15;
systemd-boot = {
enable = true;
configurationLimit = 20;
extraEntries = {
"Windows.conf" = (lib.strings.concatStringsSep "\n" [
"title Windows"
"efi /EFI/Microsoft/EFI/bootmgfw.efi"
]);
"Win2.conf" = (lib.strings.concatStringsSep "\n" [
"title Windows 11"
"efi /shellx64.efi"
"options -nointerrupt -noconsolein -noconsoleout windows11.nsh"
]);
"Shell.conf" = (lib.strings.concatStringsSep "\n" [
"title EFI Shell"
"efi /shell.efi"
]);
};
extraFiles = {
"windows11.nsh" = (pkgs.writeText "windows11.nsh" (lib.strings.concatStringsSep "\n" [
]));
"shell.efi" = "${pkgs.edk2-uefi-shell}/shell.efi";
};
};
grub = {
enable = false;
device = "/dev/nvme0n1";
useOSProber = true;
efiSupport = true;
extraEntries = ''
menuentry "Windows" --class windows --class os {
insmod ntfs
chainloader (hd0,0)/EFI/Windows/bootmgfw.efi
}
'';
};
#efi.canTouchEfiVariables = true;
};
};
# Use the systemd-boot EFI boot loader.
boot = {
binfmt.emulatedSystems = [ "aarch64-linux" ];
kernelPackages = pkgs.linuxPackages_latest;
supportedFilesystems = [ "ntfs" ];
loader = {
timeout = 15;
systemd-boot = {
enable = true;
configurationLimit = 20;
extraEntries = {
"Windows.conf" = (lib.strings.concatStringsSep "\n" [
"title Windows"
"efi /EFI/Microsoft/EFI/bootmgfw.efi"
]);
"Win2.conf" = (lib.strings.concatStringsSep "\n" [
"title Windows 11"
"efi /shellx64.efi"
"options -nointerrupt -noconsolein -noconsoleout windows11.nsh"
]);
"Shell.conf" = (lib.strings.concatStringsSep "\n" [
"title EFI Shell"
"efi /shell.efi"
]);
};
extraFiles = {
"windows11.nsh" = (pkgs.writeText "windows11.nsh" (lib.strings.concatStringsSep "\n" [
]));
"shell.efi" = "${pkgs.edk2-uefi-shell}/shell.efi";
};
};
grub = {
enable = false;
device = "/dev/nvme0n1";
useOSProber = true;
efiSupport = true;
extraEntries = ''
menuentry "Windows" --class windows --class os {
insmod ntfs
chainloader (hd0,0)/EFI/Windows/bootmgfw.efi
}
'';
};
#efi.canTouchEfiVariables = true;
};
};
}
hosts/jude/default.nix
+111 -110
View File
@@ -1,119 +1,120 @@
{ pkgs, config, ... }:
{
imports = [
./boot.nix
./hardware-configuration.nix
./podman.nix
./virt.nix
];
programs = {
steam.enable = true;
nix-index = {
enable = true;
enableBashIntegration = false;
enableFishIntegration = false;
enableZshIntegration = false;
};
nix-ld.enable = false;
};
imports = [
./boot.nix
./hardware-configuration.nix
./podman.nix
./virt.nix
];
programs = {
steam.enable = true;
nix-index = {
enable = true;
enableBashIntegration = false;
enableFishIntegration = false;
enableZshIntegration = false;
};
nix-ld.enable = false;
};
networking = {
hostName = "jude";
enableIPv6 = false;
interfaces.enp12s0.useDHCP = true;
firewall = {
enable = false;
allowedTCPPorts = [ 21000 ];
allowedUDPPorts = [ 21000 21010 ];
};
};
greg = {
tailscale.enable = true;
sway.enable = false;
gnome.enable = true;
kde.enable = false;
print.enable = true;
};
networking = {
hostName = "jude";
enableIPv6 = false;
interfaces.enp12s0.useDHCP = true;
firewall = {
enable = false;
allowedTCPPorts = [ 21000 ];
allowedUDPPorts = [ 21000 21010 ];
};
};
greg = {
tailscale.enable = true;
sway.enable = false;
gnome.enable = true;
kde.enable = false;
print.enable = true;
};
boot.extraModulePackages = [ config.boot.kernelPackages.v4l2loopback ];
boot.extraModulePackages = [ config.boot.kernelPackages.v4l2loopback ];
environment.systemPackages = with pkgs; lib.mkMerge [
[ # for Immersed
cudatoolkit
immersed-vr
libva
]
[
bind # For things like nslookup
create_ssl
distrobox
expect
gimp
go
gparted
gnucash
graphviz
flock
ffmpeg
handbrake
imagemagick
libtheora
libxml2
linode-cli
makemkv
oathToolkit
usbutils
vagrant
ventoy
]
environment.systemPackages = with pkgs; lib.mkMerge [
[
# for Immersed
cudatoolkit
immersed-vr
libva
]
[
bind # For things like nslookup
create_ssl
distrobox
expect
gimp
go
gparted
gnucash
graphviz
flock
ffmpeg
handbrake
imagemagick
libtheora
libxml2
linode-cli
makemkv
oathToolkit
usbutils
vagrant
ventoy
]
[
# Video/Audio data composition framework tools like "gst-inspect", "gst-launch" ...
gst_all_1.gstreamer
gst_all_1.gst-plugins-base
gst_all_1.gst-plugins-good
gst_all_1.gst-plugins-bad
gst_all_1.gst-plugins-ugly
gst_all_1.gst-libav
gst_all_1.gst-vaapi
]
];
fileSystems = {
"/boot" = {
device = "/dev/nvme0n1p1";
fsType = "auto";
};
"/windows" = {
device = "/dev/nvme0n1p5";
fsType = "ntfs-3g";
};
"/windows11" = {
device = "/dev/nvme1n1p2";
fsType = "ntfs-3g";
};
};
[
# Video/Audio data composition framework tools like "gst-inspect", "gst-launch" ...
gst_all_1.gstreamer
gst_all_1.gst-plugins-base
gst_all_1.gst-plugins-good
gst_all_1.gst-plugins-bad
gst_all_1.gst-plugins-ugly
gst_all_1.gst-libav
gst_all_1.gst-vaapi
]
];
fileSystems = {
"/boot" = {
device = "/dev/nvme0n1p1";
fsType = "auto";
};
"/windows" = {
device = "/dev/nvme0n1p5";
fsType = "ntfs-3g";
};
"/windows11" = {
device = "/dev/nvme1n1p2";
fsType = "ntfs-3g";
};
};
# Let's do a sound thing
services = {
pipewire = {
enable = true;
alsa.enable = true;
audio.enable = true;
jack.enable = true;
pulse.enable = true;
wireplumber.enable = true;
};
locate.enable = true;
xserver.videoDrivers = [ "nvidia" ];
};
hardware = {
nvidia = {
modesetting.enable = true;
nvidiaSettings = true;
open = true;
};
pulseaudio.enable = false; # This conflicts with pipewire
system76.enableAll = true;
};
# Let's do a sound thing
services = {
pipewire = {
enable = true;
alsa.enable = true;
audio.enable = true;
jack.enable = true;
pulse.enable = true;
wireplumber.enable = true;
};
locate.enable = true;
xserver.videoDrivers = [ "nvidia" ];
};
hardware = {
nvidia = {
modesetting.enable = true;
nvidiaSettings = true;
open = true;
};
pulseaudio.enable = false; # This conflicts with pipewire
system76.enableAll = true;
};
}
hosts/jude/hardware-configuration.nix
+4 -2
View File
@@ -5,7 +5,8 @@
{
imports =
[ (modulesPath + "/installer/scan/not-detected.nix")
[
(modulesPath + "/installer/scan/not-detected.nix")
];
boot.initrd.availableKernelModules = [ "nvme" "xhci_pci" "ahci" "usbhid" "usb_storage" "sd_mod" ];
@@ -14,7 +15,8 @@
boot.extraModulePackages = [ ];
fileSystems."/" =
{ #device = "/dev/disk/by-uuid/27ae91ed-32e9-411e-8227-0d99e360fbbf";
{
#device = "/dev/disk/by-uuid/27ae91ed-32e9-411e-8227-0d99e360fbbf";
device = "/dev/nvme0n1p4";
fsType = "btrfs";
};
hosts/jude/podman.nix
+4 -4
View File
@@ -1,8 +1,8 @@
{ ... }:
{
virtualisation.podman = {
enable = true;
dockerCompat = true;
};
virtualisation.podman = {
enable = true;
dockerCompat = true;
};
}
hosts/jude/virt.nix
+30 -30
View File
@@ -1,38 +1,38 @@
{ pkgs, config, ... }:
{
greg.vmdev.enable = true;
greg.vmdev.enable = true;
virtualisation = {
waydroid.enable = false;
lxd.enable = false;
};
virtualisation = {
waydroid.enable = false;
lxd.enable = false;
};
systemd.services = {
gitlab-runner = {
conflicts = [ "libvirtd.service" ];
preStart = builtins.concatStringsSep "\n" [
"${pkgs.kmod}/bin/modprobe vboxnetflt vboxdrv"
"${pkgs.kmod}/bin/modprobe vboxnetadp"
];
postStop = "${pkgs.kmod}/bin/rmmod vboxnetflt vboxnetadp vboxdrv";
wantedBy = pkgs.lib.mkForce [];
serviceConfig.User = "root";
};
};
systemd.services = {
gitlab-runner = {
conflicts = [ "libvirtd.service" ];
preStart = builtins.concatStringsSep "\n" [
"${pkgs.kmod}/bin/modprobe vboxnetflt vboxdrv"
"${pkgs.kmod}/bin/modprobe vboxnetadp"
];
postStop = "${pkgs.kmod}/bin/rmmod vboxnetflt vboxnetadp vboxdrv";
wantedBy = pkgs.lib.mkForce [ ];
serviceConfig.User = "root";
};
};
age.secrets.runner-reg.file = ../../secrets/gitlab/myself-vbox-runner-reg.age;
age.secrets.runner-reg.file = ../../secrets/gitlab/myself-vbox-runner-reg.age;
services.gitlab-runner = {
enable = true;
settings.concurrent = 5;
services.vbox = {
executor = "shell";
limit = 5;
authenticationTokenConfigFile = config.age.secrets.runner-reg.path;
environmentVariables = {
EFI_DIR = "${pkgs.OVMF.fd}/FV/";
};
};
};
services.gitlab-runner = {
enable = true;
settings.concurrent = 5;
services.vbox = {
executor = "shell";
limit = 5;
authenticationTokenConfigFile = config.age.secrets.runner-reg.path;
environmentVariables = {
EFI_DIR = "${pkgs.OVMF.fd}/FV/";
};
};
};
}
hosts/linode/default.nix
+66 -65
View File
@@ -1,78 +1,79 @@
{ pkgs, lib, config, ... }:
{
imports = [
./git.nix
./hardware-configuration.nix
./podman.nix
./matrix.nix
./nextcloud.nix
./nginx.nix
./postgres.nix
];
imports = [
./git.nix
./hardware-configuration.nix
./podman.nix
./matrix.nix
./nextcloud.nix
./nginx.nix
./postgres.nix
];
greg = {
home = false;
linode.enable = true;
tailscale.enable = true;
};
greg = {
home = false;
linode.enable = true;
tailscale.enable = true;
};
programs.ssh.extraConfig = lib.strings.concatStringsSep "\n" [
"Host chronicles.shire-zebra.ts.net"
" User backup"
" IdentityFile /etc/ssh/backup_ed25519"
" StrictHostKeyChecking no"
" UserKnownHostsFile /dev/null"
];
programs.ssh.extraConfig = lib.strings.concatStringsSep "\n" [
"Host chronicles.shire-zebra.ts.net"
" User backup"
" IdentityFile /etc/ssh/backup_ed25519"
" StrictHostKeyChecking no"
" UserKnownHostsFile /dev/null"
];
networking = {
networkmanager.enable = lib.mkForce false;
hostName = "linode";
domain = "thehellings.com";
nameservers = [
"100.88.91.27"
];
};
networking = {
networkmanager.enable = lib.mkForce false;
hostName = "linode";
domain = "thehellings.com";
nameservers = [
"100.88.91.27"
];
};
age.secrets.runner-deployer = {
file = ../../secrets/gitlab/linode-deployer-runner-reg.age;
owner = "gitlab-runner";
};
age.secrets.runner-deployer = {
file = ../../secrets/gitlab/linode-deployer-runner-reg.age;
owner = "gitlab-runner";
};
services.gitlab-runner = {
enable = true;
services.deployer = {
executor = "shell";
authenticationTokenConfigFile = config.age.secrets.runner-deployer.path;
};
};
services.gitlab-runner = {
enable = true;
services.deployer = {
executor = "shell";
authenticationTokenConfigFile = config.age.secrets.runner-deployer.path;
};
};
users.users.gitlab-runner = {
isSystemUser = true;
group = "gitlab-runner";
};
users.groups.gitlab-runner = {};
users.users.gitlab-runner = {
isSystemUser = true;
group = "gitlab-runner";
};
users.groups.gitlab-runner = { };
systemd.services."gitlab-runner".serviceConfig = {
DynamicUser = lib.mkForce false;
User = "gitlab-runner";
};
systemd.services."gitlab-runner".serviceConfig = {
DynamicUser = lib.mkForce false;
User = "gitlab-runner";
};
security.sudo.extraRules = [{
users = [ "gitlab-runner" ];
commands = [{
command = "/run/current-system/sw/bin/systemctl";
options = [ "NOPASSWD" ];
} {
command = "/run/current-system/sw/bin/podman";
options = [ "NOPASSWD" ];
}];
}];
security.sudo.extraRules = [{
users = [ "gitlab-runner" ];
commands = [{
command = "/run/current-system/sw/bin/systemctl";
options = [ "NOPASSWD" ];
}
{
command = "/run/current-system/sw/bin/podman";
options = [ "NOPASSWD" ];
}];
}];
environment.systemPackages = with pkgs; [
bind
graphviz
nix-du
pgloader
];
environment.systemPackages = with pkgs; [
bind
graphviz
nix-du
pgloader
];
}
hosts/linode/git.nix
+37 -36
View File
@@ -1,44 +1,45 @@
{ config, pkgs, ... }:
let
srcDomain = "src.thehellings.com";
sshPort = 2222;
in {
greg.proxies."${srcDomain}" = {
target = "http://git.thehellings.lan";
ssl = true;
genAliases = false;
extraConfig = ''
proxy_set_header X-Forwarded-Proto https;
proxy_set_header X-Forwarded-Ssl on;
'';
};
greg.proxies."registry.thehellings.com" = {
target = "https://registry.thehellings.lan:5000";
ssl = true;
genAliases = false;
extraConfig = "client_max_body_size 250m;";
};
srcDomain = "src.thehellings.com";
sshPort = 2222;
in
{
greg.proxies."${srcDomain}" = {
target = "http://git.thehellings.lan";
ssl = true;
genAliases = false;
extraConfig = ''
proxy_set_header X-Forwarded-Proto https;
proxy_set_header X-Forwarded-Ssl on;
'';
};
greg.proxies."registry.thehellings.com" = {
target = "https://registry.thehellings.lan:5000";
ssl = true;
genAliases = false;
extraConfig = "client_max_body_size 250m;";
};
networking.firewall.allowedTCPPorts = [ sshPort ];
networking.firewall.allowedTCPPorts = [ sshPort ];
services.haproxy = {
enable = true;
config = builtins.concatStringsSep "\n" [
"global"
" daemon"
" maxconn 20"
services.haproxy = {
enable = true;
config = builtins.concatStringsSep "\n" [
"global"
" daemon"
" maxconn 20"
"defaults"
" timeout connect 500s"
" timeout client 500s"
" timeout server 1h"
"defaults"
" timeout connect 500s"
" timeout client 500s"
" timeout server 1h"
"listen gitsshd"
" bind *:${toString sshPort}"
" timeout client 1h"
" mode tcp"
" server git-thehellings-lan git.thehellings.lan:22"
];
};
"listen gitsshd"
" bind *:${toString sshPort}"
" timeout client 1h"
" mode tcp"
" server git-thehellings-lan git.thehellings.lan:22"
];
};
}
hosts/linode/matrix.nix
+49 -47
View File
@@ -4,59 +4,61 @@
# register_new_matrix_user -k "B9EoPr2WV9hzwc7uL2Sx1JmvCeKDEOGCpB0uginQcQtEH4wzRtkSIdo7lltrjSQa" http://localhost:8448
{ config, pkgs, ... }:
let
domain = "${config.networking.domain}";
fqdn = "matrix.${domain}";
conn = "postgresql:///dendrite?sslmode=disable&host=/run/postgresql";
domain = "${config.networking.domain}";
fqdn = "matrix.${domain}";
conn = "postgresql:///dendrite?sslmode=disable&host=/run/postgresql";
in
{
services.nginx = {
virtualHosts = {
# Server the '.well-known' files to find the Matrix API server
"${domain}" = {
enableACME = true;
forceSSL = true;
services.nginx = {
virtualHosts = {
# Server the '.well-known' files to find the Matrix API server
"${domain}" = {
enableACME = true;
forceSSL = true;
# This is needed so that servers contacting hellings.com can find
# the actual application server at matrix.thehellings.com
locations."= /.well-known/matrix/server".extraConfig =
let
server = { "m.server" = "${fqdn}:443"; };
in ''
add_header Content-Type application/json;
return 200 '${builtins.toJSON server}';
'';
# This is needed so that servers contacting hellings.com can find
# the actual application server at matrix.thehellings.com
locations."= /.well-known/matrix/server".extraConfig =
let
server = { "m.server" = "${fqdn}:443"; };
in
''
add_header Content-Type application/json;
return 200 '${builtins.toJSON server}';
'';
locations."= /.well-known/matrix/client".extraConfig =
let
client = {
"m.homeserver" = { "base_url" = "https://${fqdn}"; };
"m.identity_server" = { "base_url" = "https://vector.im"; };
};
in ''
add_header Content-Type application/json;
add_header Access-Control-Allow-Origin *;
return 200 '${builtins.toJSON client}';
'';
};
locations."= /.well-known/matrix/client".extraConfig =
let
client = {
"m.homeserver" = { "base_url" = "https://${fqdn}"; };
"m.identity_server" = { "base_url" = "https://vector.im"; };
};
in
''
add_header Content-Type application/json;
add_header Access-Control-Allow-Origin *;
return 200 '${builtins.toJSON client}';
'';
};
# Reverse proxy in front of the actual Matrix server
"${fqdn}" = {
enableACME = true;
forceSSL = true;
# Reverse proxy in front of the actual Matrix server
"${fqdn}" = {
enableACME = true;
forceSSL = true;
# Not the appropriate place for the chat client
locations."/".extraConfig = "return 404;";
# Not the appropriate place for the chat client
locations."/".extraConfig = "return 404;";
locations."/_matrix" = {
proxyPass = "http://matrix.shire-zebra.ts.net:8448"; # Lacking the trailing / is correct
};
};
};
};
locations."/_matrix" = {
proxyPass = "http://matrix.shire-zebra.ts.net:8448"; # Lacking the trailing / is correct
};
};
};
};
# Open networking ports for the server
networking.firewall = {
enable = true;
allowedTCPPorts = [ 80 443 ];
};
# Open networking ports for the server
networking.firewall = {
enable = true;
allowedTCPPorts = [ 80 443 ];
};
}
hosts/linode/nextcloud.nix
+30 -30
View File
@@ -1,38 +1,38 @@
{ config, pkgs, ... }:
{
age.secrets.nextcloudadmin.file = ../../secrets/nextcloudadmin.age;
age.secrets.nextcloudadmin.owner = "nextcloud";
age.secrets.nextcloudadmin.file = ../../secrets/nextcloudadmin.age;
age.secrets.nextcloudadmin.owner = "nextcloud";
services.nextcloud = {
enable = true;
package = pkgs.nextcloud29;
appstoreEnable = true;
hostName = "next.${config.networking.domain}";
https = true;
config = {
adminpassFile = config.age.secrets.nextcloudadmin.path;
adminuser = "greg";
dbhost = "/run/postgresql";
dbtype = "pgsql";
};
settings = {
default_phone_region = "US";
overwriteprotocol = "https";
};
};
services.nextcloud = {
enable = true;
package = pkgs.nextcloud29;
appstoreEnable = true;
hostName = "next.${config.networking.domain}";
https = true;
config = {
adminpassFile = config.age.secrets.nextcloudadmin.path;
adminuser = "greg";
dbhost = "/run/postgresql";
dbtype = "pgsql";
};
settings = {
default_phone_region = "US";
overwriteprotocol = "https";
};
};
services.nginx.virtualHosts."next.thehellings.com" = {
forceSSL = true;
enableACME = true;
};
services.nginx.virtualHosts."next.thehellings.com" = {
forceSSL = true;
enableACME = true;
};
# Otherwise nginx errors looking for the nextcloud sock file
systemd.services.nginx.after = [ "nextcloud.service" ];
# Otherwise nginx errors looking for the nextcloud sock file
systemd.services.nginx.after = [ "nextcloud.service" ];
greg.backup.jobs.nextcloud-bkup = {
src = "/var/lib/nextcloud";
dest = "nextcloud-backup";
id = "rbfco-rvmis";
};
greg.backup.jobs.nextcloud-bkup = {
src = "/var/lib/nextcloud";
dest = "nextcloud-backup";
id = "rbfco-rvmis";
};
}
hosts/linode/nginx.nix
+28 -28
View File
@@ -1,36 +1,36 @@
{ ... }:
let
homepage = "127.0.0.1:30080";
homepage = "127.0.0.1:30080";
in
{
security.acme = {
acceptTerms = true;
defaults.email = "greg.hellings@gmail.com";
};
security.acme = {
acceptTerms = true;
defaults.email = "greg.hellings@gmail.com";
};
services.nginx = {
enable = true;
services.nginx = {
enable = true;
# If there are recommended settings, let's use them!
recommendedGzipSettings = true;
recommendedOptimisation = true;
recommendedProxySettings = true;
recommendedTlsSettings = true;
};
# If there are recommended settings, let's use them!
recommendedGzipSettings = true;
recommendedOptimisation = true;
recommendedProxySettings = true;
recommendedTlsSettings = true;
};
# Actually serve the content from here
virtualisation.podman.enable = true;
virtualisation.oci-containers = {
backend = "podman";
containers."homepage" = {
# needs explicit port to match what gitlab-runner sees when pulling
image = "registry.thehellings.com:443/greg/homepage/gregs-homepage:latest";
ports = [ "${homepage}:80" ];
};
};
greg.proxies."thehellings.com" = {
target = "http://${homepage}/";
ssl = true;
genAliases = false;
};
# Actually serve the content from here
virtualisation.podman.enable = true;
virtualisation.oci-containers = {
backend = "podman";
containers."homepage" = {
# needs explicit port to match what gitlab-runner sees when pulling
image = "registry.thehellings.com:443/greg/homepage/gregs-homepage:latest";
ports = [ "${homepage}:80" ];
};
};
greg.proxies."thehellings.com" = {
target = "http://${homepage}/";
ssl = true;
genAliases = false;
};
}
hosts/linode/podman.nix
+5 -5
View File
@@ -1,9 +1,9 @@
{ ... }:
{
virtualisation.podman = {
enable = true;
dockerCompat = true;
dockerSocket.enable = true;
};
virtualisation.podman = {
enable = true;
dockerCompat = true;
dockerSocket.enable = true;
};
}
hosts/linode/postgres.nix
+55 -55
View File
@@ -1,63 +1,63 @@
{ config, pkgs, lib, ... }:
{
environment.systemPackages = [
pkgs.upgrade-pg-cluster
];
environment.systemPackages = [
pkgs.upgrade-pg-cluster
];
services.postgresql = {
enable = true;
package = pkgs.postgresql_15;
checkConfig = true;
ensureDatabases = [
"nextcloud"
];
#initialScript = pkgs.writeText "create-matrix-db.sql" ''
# CREATE ROLE "matrix-synapse" WITH LOGIN;
# CREATE DATABASE "synapse" WITH OWNER "matrix-synapse" TEMPLATE template0 LC_COLLATE = "C" LC_CTYPE = "C";
# GRANT ALL PRIVILEGES ON DATABASE "synapse" TO "matrix-synapse";
#''; # These are done manually in order to set the LC_COLLATE values properly
ensureUsers = [ {
name = "nextcloud";
ensureDBOwnership = true;
} ];
settings = {
log_connections = true;
log_statement = "all";
logging_collector = true;
log_filename = "postgresql.log";
};
identMap = ''
root root postgres
'';
};
services.postgresql = {
enable = true;
package = pkgs.postgresql_15;
checkConfig = true;
ensureDatabases = [
"nextcloud"
];
#initialScript = pkgs.writeText "create-matrix-db.sql" ''
# CREATE ROLE "matrix-synapse" WITH LOGIN;
# CREATE DATABASE "synapse" WITH OWNER "matrix-synapse" TEMPLATE template0 LC_COLLATE = "C" LC_CTYPE = "C";
# GRANT ALL PRIVILEGES ON DATABASE "synapse" TO "matrix-synapse";
#''; # These are done manually in order to set the LC_COLLATE values properly
ensureUsers = [{
name = "nextcloud";
ensureDBOwnership = true;
}];
settings = {
log_connections = true;
log_statement = "all";
logging_collector = true;
log_filename = "postgresql.log";
};
identMap = ''
root root postgres
'';
};
services.postgresqlBackup = {
enable = true;
databases = [
"nextcloud"
];
};
services.postgresqlBackup = {
enable = true;
databases = [
"nextcloud"
];
};
services.logrotate = {
enable = true;
settings = {
postgresBackup = {
enable = true;
files = "${config.services.postgresqlBackup.location}/*.gz";
};
postgresLog = {
enable = true;
files = "/var/lib/postgresql/*/log/*.log";
compress = true;
compresscmd = "${pkgs.xz}/bin/xz";
};
};
};
services.logrotate = {
enable = true;
settings = {
postgresBackup = {
enable = true;
files = "${config.services.postgresqlBackup.location}/*.gz";
};
postgresLog = {
enable = true;
files = "/var/lib/postgresql/*/log/*.log";
compress = true;
compresscmd = "${pkgs.xz}/bin/xz";
};
};
};
greg.backup.jobs.greg-postgresql-backup = {
src = config.services.postgresqlBackup.location;
dest = "linode-postgres";
id = "9pwvg-s257a";
};
greg.backup.jobs.greg-postgresql-backup = {
src = config.services.postgresqlBackup.location;
dest = "linode-postgres";
id = "9pwvg-s257a";
};
}
hosts/myself/ceph.nix
+30 -29
View File
@@ -1,33 +1,34 @@
{ config, ... }:
let
publicIp = (builtins.elemAt config.networking.interfaces.enp38s0.ipv4.addresses 0).address;
sanIp = (builtins.elemAt config.networking.interfaces.enp39s0.ipv4.addresses 0).address;
vip = (builtins.elemAt config.networking.interfaces.enp38s0.ipv4.addresses 1).address;
hostname = config.networking.hostName;
baseConfig = import ../../ceph/home.nix;
in {
services.ceph-benaco = baseConfig // {
enable = false;
monitor = {
enable = false;
initialKeyring = ../../secrets/home.mon.keyring;
nodeName = hostname;
bindAddr = publicIp;
advertisedPublicAddr = vip;
};
osdBindAddr = publicIp;
osdAdvertisedPublicAddr = publicIp;
osds = {
osd1 = {
enable = false;
bootstrapKeyring = ../../secrets/home.osd-bootstrap.keyring;
id = 2;
uuid = "73424b68-210b-415f-800f-8767babea625";
blockDevice = "/dev/disk/by-id/ata-ST12000NM0558_ZHZ5WM4L";
blockDeviceUdevRuleMatcher = ''KERNEL=="sdb"'';
clusterAddress = sanIp;
};
};
};
publicIp = (builtins.elemAt config.networking.interfaces.enp38s0.ipv4.addresses 0).address;
sanIp = (builtins.elemAt config.networking.interfaces.enp39s0.ipv4.addresses 0).address;
vip = (builtins.elemAt config.networking.interfaces.enp38s0.ipv4.addresses 1).address;
hostname = config.networking.hostName;
baseConfig = import ../../ceph/home.nix;
in
{
services.ceph-benaco = baseConfig // {
enable = false;
monitor = {
enable = false;
initialKeyring = ../../secrets/home.mon.keyring;
nodeName = hostname;
bindAddr = publicIp;
advertisedPublicAddr = vip;
};
osdBindAddr = publicIp;
osdAdvertisedPublicAddr = publicIp;
osds = {
osd1 = {
enable = false;
bootstrapKeyring = ../../secrets/home.osd-bootstrap.keyring;
id = 2;
uuid = "73424b68-210b-415f-800f-8767babea625";
blockDevice = "/dev/disk/by-id/ata-ST12000NM0558_ZHZ5WM4L";
blockDeviceUdevRuleMatcher = ''KERNEL=="sdb"'';
clusterAddress = sanIp;
};
};
};
}
hosts/myself/container-git.nix
+187 -181
View File
@@ -1,195 +1,201 @@
{ config, pkgs, lib, ... }: let
registryPort = 5000;
vpnIp = "100.78.226.76";
containerIp = "192.168.200.2";
in {
age.secretsMountPoint = "/run/derp";
age.secrets = let
cfg = n: { file = ../../secrets/gitlab/${n}.age; owner = "gitlab"; group = "gitlab"; mode = "0444"; };
in {
gitlab-secret = cfg "secret";
gitlab-otp = cfg "otp";
gitlab-db = cfg "db";
gitlab-jws = cfg "jws";
gitlab-key = cfg "key";
gitlab-cert = cfg "cert";
{ config, pkgs, lib, ... }:
let
registryPort = 5000;
vpnIp = "100.78.226.76";
containerIp = "192.168.200.2";
in
{
age.secretsMountPoint = "/run/derp";
age.secrets =
let
cfg = n: { file = ../../secrets/gitlab/${n}.age; owner = "gitlab"; group = "gitlab"; mode = "0444"; };
in
{
gitlab-secret = cfg "secret";
gitlab-otp = cfg "otp";
gitlab-db = cfg "db";
gitlab-jws = cfg "jws";
gitlab-key = cfg "key";
gitlab-cert = cfg "cert";
minio_access_key_id = {
file = ../../secrets/minio_access_key_id.age;
owner = "gitlab";
group = "gitlab";
mode = "0444";
};
minio_secret_access_key = {
file = ../../secrets/minio_secret_access_key.age;
owner = "gitlab";
group = "gitlab";
mode = "0444";
};
};
minio_access_key_id = {
file = ../../secrets/minio_access_key_id.age;
owner = "gitlab";
group = "gitlab";
mode = "0444";
};
minio_secret_access_key = {
file = ../../secrets/minio_secret_access_key.age;
owner = "gitlab";
group = "gitlab";
mode = "0444";
};
};
networking.firewall.allowedTCPPorts = [ 80 registryPort ];
networking.firewall.allowedTCPPorts = [ 80 registryPort ];
greg.proxies = let
t = {
target = "http://unix:/run/gitlab/gitlab-workhorse.socket";
extraConfig = ''
proxy_set_header X-Forwarded-Proto https;
proxy_set_header X-Forwarded-Ssl on;
'';
};
in {
"${containerIp}" = t;
"${vpnIp}" = t;
"git.thehellings.lan" = t;
};
greg.proxies =
let
t = {
target = "http://unix:/run/gitlab/gitlab-workhorse.socket";
extraConfig = ''
proxy_set_header X-Forwarded-Proto https;
proxy_set_header X-Forwarded-Ssl on;
'';
};
in
{
"${containerIp}" = t;
"${vpnIp}" = t;
"git.thehellings.lan" = t;
};
virtualisation.docker.enable = true;
virtualisation.docker.enable = true;
programs.ssh.extraConfig = lib.strings.concatStringsSep "\n" [
"Host nas"
" User backup"
" IdentityFile /etc/ssh/duplicity_ed25519"
" StrictHostKeyChecking no"
" UserKnownHostsFile /dev/null"
];
programs.ssh.extraConfig = lib.strings.concatStringsSep "\n" [
"Host nas"
" User backup"
" IdentityFile /etc/ssh/duplicity_ed25519"
" StrictHostKeyChecking no"
" UserKnownHostsFile /dev/null"
];
greg.backup.jobs.nas-backup = {
src = "/var/gitlab/state/backup/";
dest = "gitlab";
id = "yha^-s45h";
};
greg.backup.jobs.nas-backup = {
src = "/var/gitlab/state/backup/";
dest = "gitlab";
id = "yha^-s45h";
};
services = {
gitlab = {
enable = true;
backup = {
keepTime = 288;
startAt = [ "03:00" ];
};
host = "src.thehellings.com";
https = true;
port = 443;
extraConfig = {
gitlab = {
trustedProxies = [ "100.109.86.8/32" ];
};
};
initialRootEmail = "greg@thehellings.com";
initialRootPasswordFile = pkgs.writeText "initialRootPassword" "root_password";
pages = {
enable = true;
settings.pages-domain = "pages.thehellings.com";
};
puma = {
threadsMax = 6;
threadsMin = 2;
workers = 6;
};
redisUrl = "unix:${config.services.redis.servers.gitlab.unixSocket}";
registry = {
enable = true;
certFile = config.age.secrets.gitlab-cert.path;
keyFile = config.age.secrets.gitlab-key.path;
externalAddress = "registry.thehellings.com";
externalPort = 443;
};
secrets = {
secretFile = config.age.secrets.gitlab-secret.path;
otpFile = config.age.secrets.gitlab-otp.path;
dbFile = config.age.secrets.gitlab-db.path;
jwsFile = config.age.secrets.gitlab-jws.path;
};
services = {
gitlab = {
enable = true;
backup = {
keepTime = 288;
startAt = [ "03:00" ];
};
host = "src.thehellings.com";
https = true;
port = 443;
extraConfig = {
gitlab = {
trustedProxies = [ "100.109.86.8/32" ];
};
};
initialRootEmail = "greg@thehellings.com";
initialRootPasswordFile = pkgs.writeText "initialRootPassword" "root_password";
pages = {
enable = true;
settings.pages-domain = "pages.thehellings.com";
};
puma = {
threadsMax = 6;
threadsMin = 2;
workers = 6;
};
redisUrl = "unix:${config.services.redis.servers.gitlab.unixSocket}";
registry = {
enable = true;
certFile = config.age.secrets.gitlab-cert.path;
keyFile = config.age.secrets.gitlab-key.path;
externalAddress = "registry.thehellings.com";
externalPort = 443;
};
secrets = {
secretFile = config.age.secrets.gitlab-secret.path;
otpFile = config.age.secrets.gitlab-otp.path;
dbFile = config.age.secrets.gitlab-db.path;
jwsFile = config.age.secrets.gitlab-jws.path;
};
extraConfig = {
object_store = {
enabled = true;
proxy_download = false; # Tell them to reach out to object storage themselves!
connection = {
provider = "AWS";
endpoint = "http://s3.thehellings.lan:9000";
region = "us-east-1";
aws_access_key_id = { _secret = config.age.secrets.minio_access_key_id.path; };
aws_secret_access_key = { _secret = config.age.secrets.minio_secret_access_key.path; };
path_style = true; # True for MinIO
aws_signature_version = 2;
};
#storage_options = ...;
objects = builtins.listToAttrs ( builtins.map (x: lib.attrsets.nameValuePair x { bucket = "gitlab-${builtins.replaceStrings [ "_" ] [ "-" ] x}"; }) [
"artifacts"
"ci_secure_files"
"dependency_proxy"
"external_diffs"
"lfs"
"packages"
"pages"
"terraform_state"
"uploads"
]);
};
};
};
extraConfig = {
object_store = {
enabled = true;
proxy_download = false; # Tell them to reach out to object storage themselves!
connection = {
provider = "AWS";
endpoint = "http://s3.thehellings.lan:9000";
region = "us-east-1";
aws_access_key_id = { _secret = config.age.secrets.minio_access_key_id.path; };
aws_secret_access_key = { _secret = config.age.secrets.minio_secret_access_key.path; };
path_style = true; # True for MinIO
aws_signature_version = 2;
};
#storage_options = ...;
objects = builtins.listToAttrs (builtins.map (x: lib.attrsets.nameValuePair x { bucket = "gitlab-${builtins.replaceStrings [ "_" ] [ "-" ] x}"; }) [
"artifacts"
"ci_secure_files"
"dependency_proxy"
"external_diffs"
"lfs"
"packages"
"pages"
"terraform_state"
"uploads"
]);
};
};
};
nginx.virtualHosts."gitlab.shire-zebra.ts.net" = {
listen = [ {
addr = vpnIp;
port = registryPort;
ssl = true;
} ];
locations."/" = {
proxyPass = "http://127.0.0.1:5000/";
recommendedProxySettings = true;
};
extraConfig = builtins.concatStringsSep "\n" [
"ssl_certificate /etc/certs/gitlab.shire-zebra.ts.net.crt ;"
"ssl_certificate_key /etc/certs/gitlab.shire-zebra.ts.net.key ;"
"client_max_body_size 250m;"
];
};
nginx.virtualHosts."gitlab.shire-zebra.ts.net" = {
listen = [{
addr = vpnIp;
port = registryPort;
ssl = true;
}];
locations."/" = {
proxyPass = "http://127.0.0.1:5000/";
recommendedProxySettings = true;
};
extraConfig = builtins.concatStringsSep "\n" [
"ssl_certificate /etc/certs/gitlab.shire-zebra.ts.net.crt ;"
"ssl_certificate_key /etc/certs/gitlab.shire-zebra.ts.net.key ;"
"client_max_body_size 250m;"
];
};
# Fetch the SSL certificates for nginx to use
cron = {
enable = true;
systemCronJobs = [ "0 0 1 */2 * cd /etc/certs && tailscale cert gitlab.shire-zebra.ts.net && chown nginx * && systemctl reload nginx" ];
};
# Fetch the SSL certificates for nginx to use
cron = {
enable = true;
systemCronJobs = [ "0 0 1 */2 * cd /etc/certs && tailscale cert gitlab.shire-zebra.ts.net && chown nginx * && systemctl reload nginx" ];
};
postgresql = {
enable = true;
checkConfig = true;
ensureDatabases = [ "gitlab" ];
ensureUsers = [ {
name = "gitlab";
ensureDBOwnership = true;
} ];
settings = {
log_connections = true;
log_statement = "all";
logging_collector = true;
log_filename = "postgresql.log";
};
};
postgresql = {
enable = true;
checkConfig = true;
ensureDatabases = [ "gitlab" ];
ensureUsers = [{
name = "gitlab";
ensureDBOwnership = true;
}];
settings = {
log_connections = true;
log_statement = "all";
logging_collector = true;
log_filename = "postgresql.log";
};
};
redis.servers.gitlab = {
enable = true;
};
resolved.enable = true;
openssh.enable = true;
};
redis.servers.gitlab = {
enable = true;
};
resolved.enable = true;
openssh.enable = true;
};
# Do not start nginx until we have tailscaled up and running, so it can bind
# to the 100.* addresses
systemd.services = {
nginx = rec {
after = [
"network-online.target"
];
wants = after;
serviceConfig = {
RestartMaxDelaySec = "30s";
RestartSteps = "5";
};
};
tailscaled.partOf = [ "network-online.target" ];
};
system.stateVersion = lib.mkForce "24.05";
# Do not start nginx until we have tailscaled up and running, so it can bind
# to the 100.* addresses
systemd.services = {
nginx = rec {
after = [
"network-online.target"
];
wants = after;
serviceConfig = {
RestartMaxDelaySec = "30s";
RestartSteps = "5";
};
};
tailscaled.partOf = [ "network-online.target" ];
};
system.stateVersion = lib.mkForce "24.05";
}
hosts/myself/container-runner.nix
+75 -74
View File
@@ -1,91 +1,92 @@
{ inputs, name, extra ? {}, packages ? [], overlays }:
{ inputs, name, extra ? { }, packages ? [ ], overlays }:
({ config, pkgs, lib, ... }:
(
lib.attrsets.recursiveUpdate {
lib.attrsets.recursiveUpdate
{
imports = [
inputs.agenix.nixosModules.default
inputs.self.modules.nixosModule
];
imports = [
inputs.agenix.nixosModules.default
inputs.self.modules.nixosModule
];
nixpkgs.overlays = overlays;
nixpkgs.overlays = overlays;
greg.tailscale.enable = true;
greg.tailscale.enable = true;
age = {
identityPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
secrets.runner-reg = {
file = ../../secrets/gitlab/myself-${name}-runner-reg.age;
owner = "gitlab-runner";
};
};
age = {
identityPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
secrets.runner-reg = {
file = ../../secrets/gitlab/myself-${name}-runner-reg.age;
owner = "gitlab-runner";
};
};
environment.systemPackages = with pkgs; [
curl
gawk
git
unzip
xorriso
wget
] ++ packages;
environment.systemPackages = with pkgs; [
curl
gawk
git
unzip
xorriso
wget
] ++ packages;
networking = {
useHostResolvConf = pkgs.lib.mkForce false;
nameservers = [ "100.100.100.100" ];
};
networking = {
useHostResolvConf = pkgs.lib.mkForce false;
nameservers = [ "100.100.100.100" ];
};
nixpkgs.config.allowUnfree = true;
nixpkgs.config.allowUnfree = true;
users.users.gitlab-runner = {
isSystemUser = true;
group = "kvm";
extraGroups = [ "kvm" ];
};
users.users.gitlab-runner = {
isSystemUser = true;
group = "kvm";
extraGroups = [ "kvm" ];
};
services = {
gitlab-runner = {
enable = true;
settings.concurrent = 5;
services = {
shell = {
executor = "shell";
limit = 5;
authenticationTokenConfigFile = config.age.secrets.runner-reg.path;
environmentVariables = {
EFI_DIR = "${pkgs.OVMF.fd}/FV/";
STORAGE_URL = "http://s3.thehellings.lan:9000";
};
};
};
};
resolved.enable = true;
};
services = {
gitlab-runner = {
enable = true;
settings.concurrent = 5;
services = {
shell = {
executor = "shell";
limit = 5;
authenticationTokenConfigFile = config.age.secrets.runner-reg.path;
environmentVariables = {
EFI_DIR = "${pkgs.OVMF.fd}/FV/";
STORAGE_URL = "http://s3.thehellings.lan:9000";
};
};
};
};
resolved.enable = true;
};
systemd.services.gitlab-runner = {
wants = [
"network-online.target"
"systemd-resolved.service"
];
after = [
"network.target"
"network-online.target"
"systemd-resolved.service"
];
serviceConfig = {
DevicePolicy = lib.mkForce "auto";
PrivateDevices = false;
ProtectKernelModules = false;
DevicesAllow = [ "/dev/kvm" "/dev/mem" ];
DynamicUser = lib.mkForce false;
User = "root";
Group = "kvm";
};
};
systemd.services.gitlab-runner = {
wants = [
"network-online.target"
"systemd-resolved.service"
];
after = [
"network.target"
"network-online.target"
"systemd-resolved.service"
];
serviceConfig = {
DevicePolicy = lib.mkForce "auto";
PrivateDevices = false;
ProtectKernelModules = false;
DevicesAllow = [ "/dev/kvm" "/dev/mem" ];
DynamicUser = lib.mkForce false;
User = "root";
Group = "kvm";
};
};
system.stateVersion = lib.mkForce "24.05";
}
system.stateVersion = lib.mkForce "24.05";
}
extra
extra
) # End of attrsets.recursiveUpdate
) # End of outter function wrapper
hosts/myself/default.nix
+82 -81
View File
@@ -1,86 +1,87 @@
{ config, pkgs, lib, ... }:
{
imports = [
./ceph.nix
./hardware-configuration.nix
./git.nix
./matrix.nix
./minio.nix
];
imports = [
./ceph.nix
./hardware-configuration.nix
./git.nix
./matrix.nix
./minio.nix
];
greg.tailscale.enable = true;
greg.tailscale.enable = true;
services = {
openssh.enable = true;
};
networking = {
hostName = "myself";
useDHCP = false;
defaultGateway = {
address = " 10.42.1.1";
interface = "enp38s0";
};
vlans = {
san = {
id = 616;
interface = "enp39s0";
};
};
interfaces = {
enp38s0 = {
ipv4.addresses = [ {
address = "10.42.1.6";
prefixLength = 16;
} {
address = "10.42.100.1";
prefixLength = 16;
} ];
};
san = {
ipv4.addresses = [ {
address = "10.201.1.1";
prefixLength = 24;
} ];
};
};
nameservers = [
"10.42.1.5"
];
};
users = {
users = {
greg = {
extraGroups = [
"kvm"
"sudo"
"wheel"
];
isNormalUser = true;
};
};
};
system.stateVersion = lib.mkForce "24.05";
boot = {
extraModprobeConfig = "options kvm_amd nested=1";
supportedFilesystems = [ "ntfs" ];
loader = {
efi = {
canTouchEfiVariables = true;
efiSysMountPoint = "/boot";
};
systemd-boot = {
enable = true;
configurationLimit = 10;
};
};
binfmt.emulatedSystems = [
"aarch64-linux"
];
};
nixpkgs.config = {
allowUnfree = true;
permittedInsecurePackages = [
"nodejs-16.20.2"
];
};
services = {
openssh.enable = true;
};
networking = {
hostName = "myself";
useDHCP = false;
defaultGateway = {
address = " 10.42.1.1";
interface = "enp38s0";
};
vlans = {
san = {
id = 616;
interface = "enp39s0";
};
};
interfaces = {
enp38s0 = {
ipv4.addresses = [{
address = "10.42.1.6";
prefixLength = 16;
}
{
address = "10.42.100.1";
prefixLength = 16;
}];
};
san = {
ipv4.addresses = [{
address = "10.201.1.1";
prefixLength = 24;
}];
};
};
nameservers = [
"10.42.1.5"
];
};
users = {
users = {
greg = {
extraGroups = [
"kvm"
"sudo"
"wheel"
];
isNormalUser = true;
};
};
};
system.stateVersion = lib.mkForce "24.05";
boot = {
extraModprobeConfig = "options kvm_amd nested=1";
supportedFilesystems = [ "ntfs" ];
loader = {
efi = {
canTouchEfiVariables = true;
efiSysMountPoint = "/boot";
};
systemd-boot = {
enable = true;
configurationLimit = 10;
};
};
binfmt.emulatedSystems = [
"aarch64-linux"
];
};
nixpkgs.config = {
allowUnfree = true;
permittedInsecurePackages = [
"nodejs-16.20.2"
];
};
}
hosts/myself/git.nix
+129 -126
View File
@@ -2,139 +2,142 @@
let
gitlabStateDir = "/var/lib/gitlab";
gitlabStateDir = "/var/lib/gitlab";
container = input: (lib.attrsets.recursiveUpdate {
bindMounts."/etc/ssh".hostPath = "/etc/ssh"; # For agenix secrets
enableTun = true;
privateNetwork = true;
} input);
in {
networking = {
firewall = {
enable = true;
allowedTCPPorts = [ 80 ];
};
nat = {
enable = true;
internalInterfaces = [ "ve-+" ];
externalInterface = "enp38s0";
};
};
container = input: (lib.attrsets.recursiveUpdate
{
bindMounts."/etc/ssh".hostPath = "/etc/ssh"; # For agenix secrets
enableTun = true;
privateNetwork = true;
}
input);
in
{
networking = {
firewall = {
enable = true;
allowedTCPPorts = [ 80 ];
};
nat = {
enable = true;
internalInterfaces = [ "ve-+" ];
externalInterface = "enp38s0";
};
};
greg.proxies."git.thehellings.lan" = {
target = "http://192.168.200.2";
extraConfig = ''
proxy_set_header X-Forwarded-Proto https;
proxy_set_header X-Forwarded-Ssl on;
'';
};
greg.proxies."git.thehellings.lan" = {
target = "http://192.168.200.2";
extraConfig = ''
proxy_set_header X-Forwarded-Proto https;
proxy_set_header X-Forwarded-Ssl on;
'';
};
system.activationScripts.makeGitlabDir = lib.stringAfter [ "var" ] "mkdir -p ${gitlabStateDir} && touch ${gitlabStateDir}/touch";
system.activationScripts.makeGitlabDir = lib.stringAfter [ "var" ] "mkdir -p ${gitlabStateDir} && touch ${gitlabStateDir}/touch";
greg.containers.gitlab = {
tailscale = true;
subnet = "200";
builder = (import ./container-git.nix);
};
greg.containers.gitlab = {
tailscale = true;
subnet = "200";
builder = (import ./container-git.nix);
};
systemd.services = {
"gitlab-runner" = {
after = [ "container@github.service" ];
preStart = builtins.concatStringsSep "\n" [
"${pkgs.kmod}/bin/modprobe kvm"
"${pkgs.kmod}/bin/modprobe kvm_amd"
];
postStop = builtins.concatStringsSep "\n" [
"${pkgs.kmod}/bin/rmmod -f kvm_amd kvm"
];
serviceConfig = {
DevicePolicy = lib.mkForce "auto";
DevicesAllow = [ "/dev/kvm" "/dev/mem" ];
EnvironmentFile = config.age.secrets.docker-auth.path;
PermissionsStartOnly = "true";
PrivateDevices = false;
ProtectKernelModules = false;
};
};
};
systemd.services = {
"gitlab-runner" = {
after = [ "container@github.service" ];
preStart = builtins.concatStringsSep "\n" [
"${pkgs.kmod}/bin/modprobe kvm"
"${pkgs.kmod}/bin/modprobe kvm_amd"
];
postStop = builtins.concatStringsSep "\n" [
"${pkgs.kmod}/bin/rmmod -f kvm_amd kvm"
];
serviceConfig = {
DevicePolicy = lib.mkForce "auto";
DevicesAllow = [ "/dev/kvm" "/dev/mem" ];
EnvironmentFile = config.age.secrets.docker-auth.path;
PermissionsStartOnly = "true";
PrivateDevices = false;
ProtectKernelModules = false;
};
};
};
#####################################################################################
#################### Container Podman Runner ########################################
#####################################################################################
containers.gitlab-runner-shell = container {
autoStart = true;
hostAddress = "192.168.203.1";
localAddress = "192.168.203.2";
config = ((import ./container-runner.nix) {
inherit inputs overlays;
name = "shell";
extra.virtualisation.podman.enable = true;
});
};
#####################################################################################
#################### Container Podman Runner ########################################
#####################################################################################
containers.gitlab-runner-shell = container {
autoStart = true;
hostAddress = "192.168.203.1";
localAddress = "192.168.203.2";
config = ((import ./container-runner.nix) {
inherit inputs overlays;
name = "shell";
extra.virtualisation.podman.enable = true;
});
};
#####################################################################################
#################### Local Podman/Docker Runner #####################################
#####################################################################################
age.secrets.runner-reg.file = ../../secrets/gitlab/myself-podman-runner-reg.age;
age.secrets.docker-auth.file = ../../secrets/gitlab/docker-auth.age;
age.secrets.runner-qemu.file = ../../secrets/gitlab/myself-qemu-runner-reg.age;
services.gitlab-runner = {
enable = true;
settings = {
concurrent = 5;
};
services = {
default = {
executor = "docker";
authenticationTokenConfigFile = config.age.secrets.runner-reg.path;
dockerImage = "gitlab.shire-zebra.ts.net:5000/greg/ci-images/fedora:latest";
dockerAllowedImages = [
"alpine:*"
"debian:*"
"docker:*"
"fedora:*"
"python:*"
"ubuntu:*"
#####################################################################################
#################### Local Podman/Docker Runner #####################################
#####################################################################################
age.secrets.runner-reg.file = ../../secrets/gitlab/myself-podman-runner-reg.age;
age.secrets.docker-auth.file = ../../secrets/gitlab/docker-auth.age;
age.secrets.runner-qemu.file = ../../secrets/gitlab/myself-qemu-runner-reg.age;
services.gitlab-runner = {
enable = true;
settings = {
concurrent = 5;
};
services = {
default = {
executor = "docker";
authenticationTokenConfigFile = config.age.secrets.runner-reg.path;
dockerImage = "gitlab.shire-zebra.ts.net:5000/greg/ci-images/fedora:latest";
dockerAllowedImages = [
"alpine:*"
"debian:*"
"docker:*"
"fedora:*"
"python:*"
"ubuntu:*"
"hashicorp/*:*"
"koalaman/shellcheck:*"
"hashicorp/*:*"
"koalaman/shellcheck:*"
"registry.gitlab.com/gitlab-org/*"
"registry.thehellings.com/*/*/*:*"
"gitlab.shire-zebra.ts.net:5000/*/*/*:*"
];
dockerAllowedServices = [
"docker:*"
"registry.thehellings.com/*/*/*:*"
"gitlab.shire-zebra.ts.net:5000/*/*/*:*"
];
dockerPrivileged = true;
dockerVolumes = [
"/certs/client"
"/cache"
];
};
qemu = {
executor = "shell";
limit = 5;
authenticationTokenConfigFile = config.age.secrets.runner-qemu.path;
environmentVariables = {
EFI_DIR = "${pkgs.OVMF.fd}/FV/";
STORAGE_URL = "http://s3.thehellings.lan:9000";
};
};
};
};
virtualisation = {
docker.enable = true;
oci-containers.backend = "docker";
};
environment.systemPackages = with pkgs; [
curl
gawk
git
unzip
wget
];
"registry.gitlab.com/gitlab-org/*"
"registry.thehellings.com/*/*/*:*"
"gitlab.shire-zebra.ts.net:5000/*/*/*:*"
];
dockerAllowedServices = [
"docker:*"
"registry.thehellings.com/*/*/*:*"
"gitlab.shire-zebra.ts.net:5000/*/*/*:*"
];
dockerPrivileged = true;
dockerVolumes = [
"/certs/client"
"/cache"
];
};
qemu = {
executor = "shell";
limit = 5;
authenticationTokenConfigFile = config.age.secrets.runner-qemu.path;
environmentVariables = {
EFI_DIR = "${pkgs.OVMF.fd}/FV/";
STORAGE_URL = "http://s3.thehellings.lan:9000";
};
};
};
};
virtualisation = {
docker.enable = true;
oci-containers.backend = "docker";
};
environment.systemPackages = with pkgs; [
curl
gawk
git
unzip
wget
];
}
hosts/myself/hardware-configuration.nix
+41 -36
View File
@@ -4,48 +4,53 @@
{ config, lib, pkgs, modulesPath, ... }:
{
imports =
[ (modulesPath + "/installer/scan/not-detected.nix")
];
imports =
[
(modulesPath + "/installer/scan/not-detected.nix")
];
boot.initrd.availableKernelModules = [ "nvme" "xhci_pci" "ahci" "usb_storage" "usbhid" "sd_mod" "sr_mod" ];
boot.initrd.kernelModules = [ ];
boot.kernelModules = [ "kvm-amd" ];
boot.extraModulePackages = [ ];
boot.initrd.availableKernelModules = [ "nvme" "xhci_pci" "ahci" "usb_storage" "usbhid" "sd_mod" "sr_mod" ];
boot.initrd.kernelModules = [ ];
boot.kernelModules = [ "kvm-amd" ];
boot.extraModulePackages = [ ];
fileSystems."/" =
{ device = "/dev/disk/by-uuid/714744ca-dd9d-4713-b571-c6ccfbf56d79";
fsType = "btrfs";
options = [ "subvol=nixos" ];
};
fileSystems."/" =
{
device = "/dev/disk/by-uuid/714744ca-dd9d-4713-b571-c6ccfbf56d79";
fsType = "btrfs";
options = [ "subvol=nixos" ];
};
fileSystems."/home" =
{ device = "/dev/disk/by-uuid/714744ca-dd9d-4713-b571-c6ccfbf56d79";
fsType = "btrfs";
options = [ "subvol=home" ];
};
fileSystems."/home" =
{
device = "/dev/disk/by-uuid/714744ca-dd9d-4713-b571-c6ccfbf56d79";
fsType = "btrfs";
options = [ "subvol=home" ];
};
fileSystems."/boot" =
{ device = "/dev/disk/by-uuid/29E7-E20C";
fsType = "vfat";
};
fileSystems."/boot" =
{
device = "/dev/disk/by-uuid/29E7-E20C";
fsType = "vfat";
};
fileSystems."/myvol" =
{ device = "/dev/nvme0n1p1";
fsType = "btrfs";
};
fileSystems."/myvol" =
{
device = "/dev/nvme0n1p1";
fsType = "btrfs";
};
swapDevices = [ ];
swapDevices = [ ];
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
# (the default) this is the recommended approach. When using systemd-networkd it's
# still possible to use this option, but it's recommended to use it in conjunction
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
networking.useDHCP = lib.mkDefault true;
# networking.interfaces.enp38s0.useDHCP = lib.mkDefault true;
# networking.interfaces.enp39s0.useDHCP = lib.mkDefault true;
# networking.interfaces.enp42s0f3u5u3c2.useDHCP = lib.mkDefault true;
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
# (the default) this is the recommended approach. When using systemd-networkd it's
# still possible to use this option, but it's recommended to use it in conjunction
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
networking.useDHCP = lib.mkDefault true;
# networking.interfaces.enp38s0.useDHCP = lib.mkDefault true;
# networking.interfaces.enp39s0.useDHCP = lib.mkDefault true;
# networking.interfaces.enp42s0f3u5u3c2.useDHCP = lib.mkDefault true;
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
}
hosts/myself/matrix.nix
+79 -78
View File
@@ -1,90 +1,91 @@
{ config, pkgs, inputs, lib, ... }:
let
domain = "thehellings.com";
fqdn = "matrix.${domain}";
conn = "postgresql:///dendrite?sslmode=disable&host=/run/postgresql";
domain = "thehellings.com";
fqdn = "matrix.${domain}";
conn = "postgresql:///dendrite?sslmode=disable&host=/run/postgresql";
in
{
environment.systemPackages = with pkgs; [ upgrade-pg-cluster ];
environment.systemPackages = with pkgs; [ upgrade-pg-cluster ];
greg.containers.matrix = {
tailscale = true;
subnet = "204";
builder = { pkgs, config, ... }: {
networking.firewall.allowedTCPPorts = [ config.services.dendrite.httpPort ];
greg.containers.matrix = {
tailscale = true;
subnet = "204";
builder = { pkgs, config, ... }: {
networking.firewall.allowedTCPPorts = [ config.services.dendrite.httpPort ];
# Environment secrets
age = {
secrets.dendrite = {
file = ../../secrets/dendrite.age;
owner = "dendrite";
};
secrets.dendrite_key = {
file = ../../secrets/dendrite_key.age;
owner = "dendrite";
};
};
# Environment secrets
age = {
secrets.dendrite = {
file = ../../secrets/dendrite.age;
owner = "dendrite";
};
secrets.dendrite_key = {
file = ../../secrets/dendrite_key.age;
owner = "dendrite";
};
};
users.users.dendrite = {
isSystemUser = true;
group = "dendrite";
};
users.groups.dendrite = {};
users.users.dendrite = {
isSystemUser = true;
group = "dendrite";
};
users.groups.dendrite = { };
systemd.services.dendrite.serviceConfig = {
User = "dendrite";
};
systemd.services.dendrite.serviceConfig = {
User = "dendrite";
};
greg.databases.dendrite = {};
greg.databases.dendrite = { };
services.dendrite = {
enable = true;
environmentFile = config.age.secrets.dendrite.path;
httpPort = 8448;
# Identify ourselves as the root of our own domain
settings = (
(builtins.listToAttrs (
(map (x: { name = x; value = { database.connection_string = conn; }; }) [
"app_service_api"
"federation_api"
"key_server"
"media_api"
"mscs"
"relay_api"
"room_server"
"sync_api"
])
) ) //
{
user_api.account_database.connection_string = conn;
user_api.device_database.connection_string = conn;
global = {
database = {
connection_string = conn;
max_open_conns = 25;
max_idle_conns = 5;
conn_max_lifetime = -1;
};
server_name = "thehellings.com";
trusted_third_party_id_servers = [
"matrix.org"
"vector.im"
"jupiterbroadcasting.com"
];
# Generate this with {path-to-dendrite}/bin/generate-keys --private-key /etc/dendrite.pem
private_key = config.age.secrets.dendrite_key.path;
};
client_api = {
registration_enabled = false;
registration_shared_secret = "\${REGISTRATION_SHARED_SECRET}";
};
});
};
services.dendrite = {
enable = true;
environmentFile = config.age.secrets.dendrite.path;
httpPort = 8448;
# Identify ourselves as the root of our own domain
settings = (
(builtins.listToAttrs (
(map (x: { name = x; value = { database.connection_string = conn; }; }) [
"app_service_api"
"federation_api"
"key_server"
"media_api"
"mscs"
"relay_api"
"room_server"
"sync_api"
])
)) //
{
user_api.account_database.connection_string = conn;
user_api.device_database.connection_string = conn;
global = {
database = {
connection_string = conn;
max_open_conns = 25;
max_idle_conns = 5;
conn_max_lifetime = -1;
};
server_name = "thehellings.com";
trusted_third_party_id_servers = [
"matrix.org"
"vector.im"
"jupiterbroadcasting.com"
];
# Generate this with {path-to-dendrite}/bin/generate-keys --private-key /etc/dendrite.pem
private_key = config.age.secrets.dendrite_key.path;
};
client_api = {
registration_enabled = false;
registration_shared_secret = "\${REGISTRATION_SHARED_SECRET}";
};
}
);
};
systemd.services.dendrite = {
after = [ "postgresql.service" ];
requires = [ "postgresql.service" ];
};
};
};
systemd.services.dendrite = {
after = [ "postgresql.service" ];
requires = [ "postgresql.service" ];
};
};
};
}
hosts/myself/minio.nix
+24 -23
View File
@@ -1,32 +1,33 @@
{ config, pkgs, ... }:
let
minioPort = 9000;
minioConsolePort = 9001;
in {
environment.systemPackages = with pkgs; [
minio-client
xfsprogs
];
minioPort = 9000;
minioConsolePort = 9001;
in
{
environment.systemPackages = with pkgs; [
minio-client
xfsprogs
];
greg.proxies."minio-01.thehellings.lan".target = "http://localhost:9000";
greg.proxies."minio-01.thehellings.lan".target = "http://localhost:9000";
fileSystems."/data/1" = {
device = "/dev/disk/by-id/wwn-0x5000c500c48728e9-part1";
fsType = "xfs";
};
fileSystems."/data/1" = {
device = "/dev/disk/by-id/wwn-0x5000c500c48728e9-part1";
fsType = "xfs";
};
networking.firewall.allowedTCPPorts = [
minioPort
minioConsolePort
];
networking.firewall.allowedTCPPorts = [
minioPort
minioConsolePort
];
age.secrets.minio.file = ../../secrets/minio.age;
age.secrets.minio.file = ../../secrets/minio.age;
services.minio = {
enable = true;
dataDir = [ "/data/1/minio" ];
rootCredentialsFile = config.age.secrets.minio.path;
browser = true;
};
services.minio = {
enable = true;
dataDir = [ "/data/1/minio" ];
rootCredentialsFile = config.age.secrets.minio.path;
browser = true;
};
}
hosts/wsl/default.nix
+7 -7
View File
@@ -1,11 +1,11 @@
{ pkgs, ... }:
{
wsl = {
enable = true;
wslConf.automount.root = "/mnt";
defaultUser = "greg";
startMenuLaunchers = true;
nativeSystemd = true;
};
wsl = {
enable = true;
wslConf.automount.root = "/mnt";
defaultUser = "greg";
startMenuLaunchers = true;
nativeSystemd = true;
};
}
modules/baseline.nix
+51 -51
View File
@@ -1,60 +1,60 @@
{ pkgs, lib, ... }:
let
notDarwin = (! pkgs.stdenv.isDarwin);
notDarwin = (! pkgs.stdenv.isDarwin);
in
{
# Enable flakes
nix = {
gc = {
automatic = true;
# Scheduling of them is different in nixos vs nix-darwin, so check for
# the extra details there
options = "--delete-older-than 30d";
};
settings = {
experimental-features = "nix-command flakes";
keep-outputs = true;
keep-derivations = true;
min-free = (toString (1024 * 1024 * 1024) );
max-free = (toString (5 * 1024 * 1024 * 1024) );
substituters = [
"https://cache.garnix.io"
"https://ai.cachix.org"
];
trusted-public-keys = [
"cache.garnix.io:CTFPyKSLcx5RMJKfLo5EEPUObbA78b0YQ2DTCJXqr9g="
"ai.cachix.org-1:N9dzRK+alWwoKXQlnn0H6aUx0lU/mspIoz8hMvGvbbc="
];
};
# Enable flakes
nix = {
gc = {
automatic = true;
# Scheduling of them is different in nixos vs nix-darwin, so check for
# the extra details there
options = "--delete-older-than 30d";
};
nixpkgs.config = {
allowUnfree = true;
permittedInsecurePackages = [
"jitsi-meet-1.0.8043"
];
settings = {
experimental-features = "nix-command flakes";
keep-outputs = true;
keep-derivations = true;
min-free = (toString (1024 * 1024 * 1024));
max-free = (toString (5 * 1024 * 1024 * 1024));
substituters = [
"https://cache.garnix.io"
"https://ai.cachix.org"
];
trusted-public-keys = [
"cache.garnix.io:CTFPyKSLcx5RMJKfLo5EEPUObbA78b0YQ2DTCJXqr9g="
"ai.cachix.org-1:N9dzRK+alWwoKXQlnn0H6aUx0lU/mspIoz8hMvGvbbc="
];
};
};
# Base packages that need to be in all my hosts
environment.systemPackages = with pkgs; [
agenix
bitwarden-cli
bmon
diffutils
git
gnupatch
gregpy
findutils
file
hms # My own home manager switcher
htop
iperf
killall
nano
pciutils
pwgen
unzip
wget
];
nixpkgs.config = {
allowUnfree = true;
permittedInsecurePackages = [
"jitsi-meet-1.0.8043"
];
};
# Base packages that need to be in all my hosts
environment.systemPackages = with pkgs; [
agenix
bitwarden-cli
bmon
diffutils
git
gnupatch
gregpy
findutils
file
hms # My own home manager switcher
htop
iperf
killall
nano
pciutils
pwgen
unzip
wget
];
}
modules/darwin/default.nix
+23 -23
View File
@@ -1,26 +1,26 @@
{...}:
{ ... }:
{
imports = [
../baseline.nix
];
system.stateVersion = 4;
home-manager = {
useGlobalPkgs = true;
users."gregory.hellings" = import ../../home/home.nix;
extraSpecialArgs = {
gnome = false;
gui = false;
home = "/Users/gregory.hellings";
};
};
users.users."gregory.hellings".home = "/Users/gregory.hellings";
programs = {
zsh.enable = true;
bash.enable = true;
};
services.nix-daemon.enable = true;
nix = {
gc.interval.Hour = 24;
settings.auto-optimise-store = false; # Darwin bugs?
imports = [
../baseline.nix
];
system.stateVersion = 4;
home-manager = {
useGlobalPkgs = true;
users."gregory.hellings" = import ../../home/home.nix;
extraSpecialArgs = {
gnome = false;
gui = false;
home = "/Users/gregory.hellings";
};
};
users.users."gregory.hellings".home = "/Users/gregory.hellings";
programs = {
zsh.enable = true;
bash.enable = true;
};
services.nix-daemon.enable = true;
nix = {
gc.interval.Hour = 24;
settings.auto-optimise-store = false; # Darwin bugs?
};
}
modules/default.nix
+6 -5
View File
@@ -1,7 +1,8 @@
let
nixos = (import ./nixos);
darwin = (import ./darwin);
in {
nixosModule = nixos;
darwinModule = darwin;
nixos = (import ./nixos);
darwin = (import ./darwin);
in
{
nixosModule = nixos;
darwinModule = darwin;
}
modules/nixos/backup.nix
+62 -59
View File
@@ -1,71 +1,74 @@
{ lib, config, pkgs, ... }:
let
cfg = config.greg.backup;
cfg = config.greg.backup;
where = j: "${config.services.syncthing.dataDir}/${j.dest}";
where = j: "${config.services.syncthing.dataDir}/${j.dest}";
makeSyncFolders = name: job: {
devices = [ "chronicles" ];
enable = true;
id = job.id;
label = job.dest;
path = where job;
type = "sendonly";
};
makeSyncFolders = name: job: {
devices = [ "chronicles" ];
enable = true;
id = job.id;
label = job.dest;
path = where job;
type = "sendonly";
};
makeRestic = name: job: let
who = "${config.services.syncthing.user}:${config.services.syncthing.group}";
in rec {
initialize = true;
passwordFile = config.age.secrets.restic-pw.path;
paths = [ job.src ];
repository = where job;
backupCleanupCommand = ''${pkgs.coreutils}/bin/chown -R ${who} "${repository}"'';
};
makeRestic = name: job:
let
who = "${config.services.syncthing.user}:${config.services.syncthing.group}";
in
rec {
initialize = true;
passwordFile = config.age.secrets.restic-pw.path;
paths = [ job.src ];
repository = where job;
backupCleanupCommand = ''${pkgs.coreutils}/bin/chown -R ${who} "${repository}"'';
};
in with lib; {
options = {
greg.backup = {
jobs = mkOption {
default = {};
in
with lib; {
options = {
greg.backup = {
jobs = mkOption {
default = { };
type = with types; attrsOf (submodule (
{ name, config, options, ... }:
{
options = {
src = mkOption {
type = types.str;
description = "Local path (string form) to backup from";
};
type = with types; attrsOf (submodule (
{ name, config, options, ... }:
{
options = {
src = mkOption {
type = types.str;
description = "Local path (string form) to backup from";
};
dest = mkOption {
type = types.str;
};
dest = mkOption {
type = types.str;
};
id = mkOption {
type = types.str;
description = "The unique folder ID for this";
};
};
}
));
};
};
};
id = mkOption {
type = types.str;
description = "The unique folder ID for this";
};
};
}
));
};
};
};
config = mkIf ( ( attrValues cfg.jobs ) != [] )
{
age.secrets = {
restic-pw.file = ../../secrets/restic-pw.age;
restic-env.file = ../../secrets/restic-env.age;
};
greg.syncthing = {
enable = true;
};
services = {
syncthing.settings.folders = mapAttrs makeSyncFolders cfg.jobs;
restic.backups = mapAttrs makeRestic cfg.jobs;
};
};
config = mkIf ((attrValues cfg.jobs) != [ ])
{
age.secrets = {
restic-pw.file = ../../secrets/restic-pw.age;
restic-env.file = ../../secrets/restic-env.age;
};
greg.syncthing = {
enable = true;
};
services = {
syncthing.settings.folders = mapAttrs makeSyncFolders cfg.jobs;
restic.backups = mapAttrs makeRestic cfg.jobs;
};
};
}
modules/nixos/ceph.nix
+476 -464
View File
File diff suppressed because it is too large Load Diff
modules/nixos/container.nix
+67 -64
View File
@@ -1,76 +1,79 @@
{ config, lib, inputs, overlays, ... }:
let
cfg = config.greg.containers;
cfg = config.greg.containers;
# Create a container with all our default settings
# Create a container with all our default settings
makeContainer = name: container: let
agekey = "/etc/ssh/agenix_key";
in {
autoStart = true;
hostAddress = "192.168.${container.subnet}.1";
localAddress = "192.168.${container.subnet}.2";
privateNetwork = true;
bindMounts = {
"${agekey}".hostPath = "/etc/ssh/ssh_host_ed25519_key"; # This is needed for agenix to
};
enableTun = container.tailscale;
config = { config, pkgs, ... }: {
imports = [
inputs.agenix.nixosModules.default
inputs.self.modules.nixosModule
container.builder
];
makeContainer = name: container:
let
agekey = "/etc/ssh/agenix_key";
in
{
autoStart = true;
hostAddress = "192.168.${container.subnet}.1";
localAddress = "192.168.${container.subnet}.2";
privateNetwork = true;
bindMounts = {
"${agekey}".hostPath = "/etc/ssh/ssh_host_ed25519_key"; # This is needed for agenix to
};
enableTun = container.tailscale;
config = { config, pkgs, ... }: {
imports = [
inputs.agenix.nixosModules.default
inputs.self.modules.nixosModule
container.builder
];
nixpkgs.overlays = overlays;
nixpkgs.overlays = overlays;
networking = {
firewall.enable = true;
useHostResolvConf = lib.mkForce false;
};
networking = {
firewall.enable = true;
useHostResolvConf = lib.mkForce false;
};
age.identityPaths = [ agekey ];
age.identityPaths = [ agekey ];
greg.tailscale.enable = container.tailscale;
};
};
in {
options.greg.containers = lib.mkOption {
default = {};
greg.tailscale.enable = container.tailscale;
};
};
in
{
options.greg.containers = lib.mkOption {
default = { };
type = with lib.types; attrsOf ( submodule (
{
options = {
tailscale = lib.mkOption {
type = bool;
default = false;
description = "Enable tailscale in the container";
};
subnet = lib.mkOption {
type = str;
default = "200";
};
builder = lib.mkOption {
default = { ... }: {};
description = ''
This needs to be a function, like the one for
a container's config. It will setup the core system above the
defaults set in this module.
'';
example = ''
{ pkgs, config, lib, ... } :
{
services.openssh.enable = true;
}
'';
};
};
}
));
};
type = with lib.types; attrsOf (submodule (
{
options = {
tailscale = lib.mkOption {
type = bool;
default = false;
description = "Enable tailscale in the container";
};
subnet = lib.mkOption {
type = str;
default = "200";
};
builder = lib.mkOption {
default = { ... }: { };
description = ''
This needs to be a function, like the one for
a container's config. It will setup the core system above the
defaults set in this module.
'';
example = ''
{ pkgs, config, lib, ... } :
{
services.openssh.enable = true;
}
'';
};
};
}
));
};
config = {
containers = builtins.mapAttrs makeContainer cfg;
};
config = {
containers = builtins.mapAttrs makeContainer cfg;
};
}
modules/nixos/db.nix
+55 -54
View File
@@ -1,63 +1,64 @@
{ config, lib, pkgs, ... }:
let
cfg = config.greg.databases;
dbs = (lib.attrNames cfg);
in {
options.greg.databases = lib.mkOption {
default = {};
type = with lib.types; attrsOf ( submodule (
{ name, config, options, ... }: {
# Options reserved for future expansion
options = {};
}
));
};
cfg = config.greg.databases;
dbs = (lib.attrNames cfg);
in
{
options.greg.databases = lib.mkOption {
default = { };
type = with lib.types; attrsOf (submodule (
{ name, config, options, ... }: {
# Options reserved for future expansion
options = { };
}
));
};
config = lib.mkIf ( dbs != [] ) {
services = {
postgresql = {
enable = true;
package = pkgs.postgresql_15;
checkConfig = true;
ensureDatabases = dbs;
ensureUsers = map (db: { name = db; ensureDBOwnership = true; }) dbs;
settings = {
log_connections = true;
log_statement = "all";
logging_collector = true;
log_filename = "postgresql.log";
};
identMap = "root root postgres";
};
config = lib.mkIf (dbs != [ ]) {
services = {
postgresql = {
enable = true;
package = pkgs.postgresql_15;
checkConfig = true;
ensureDatabases = dbs;
ensureUsers = map (db: { name = db; ensureDBOwnership = true; }) dbs;
settings = {
log_connections = true;
log_statement = "all";
logging_collector = true;
log_filename = "postgresql.log";
};
identMap = "root root postgres";
};
postgresqlBackup = {
enable = true;
databases = dbs;
};
postgresqlBackup = {
enable = true;
databases = dbs;
};
logrotate = {
enable = true;
settings = {
postgresqlBackup = {
enable = true;
files = "${config.services.postgresqlBackup.location}/*.gz";
};
postgresLog = {
enable = true;
files = "/var/lib/postgresql/*/log/*.log";
compress = true;
compresscmd = "${pkgs.xz}/bin/xz";
};
};
};
logrotate = {
enable = true;
settings = {
postgresqlBackup = {
enable = true;
files = "${config.services.postgresqlBackup.location}/*.gz";
};
postgresLog = {
enable = true;
files = "/var/lib/postgresql/*/log/*.log";
compress = true;
compresscmd = "${pkgs.xz}/bin/xz";
};
};
};
};
};
greg.backup.jobs.greg-postgresql-backup = {
src = config.services.postgresqlBackup.location;
dest = "database-${config.networking.hostName}";
id = "${config.networking.hostName}-postgres-backup";
};
};
greg.backup.jobs.greg-postgresql-backup = {
src = config.services.postgresqlBackup.location;
dest = "database-${config.networking.hostName}";
id = "${config.networking.hostName}-postgres-backup";
};
};
}
modules/nixos/default.nix
+83 -81
View File
@@ -1,94 +1,96 @@
{ config, pkgs, inputs, lib, ... }:
let
x = if builtins.hasAttr "xonsh-unwrapped" pkgs then
pkgs.xonsh else
pkgs.xonsh.passthru.wrapper;
in {
imports = [
../baseline.nix
./backup.nix
./ceph.nix
./container.nix
./db.nix
./gnome.nix
./home.nix
./kde.nix
./kiwix-serve.nix
./linode.nix
./print.nix
./proxy.nix
./router.nix
./rpi4.nix
./sway.nix
./syncthing.nix
./tailscale.nix
./vmdev.nix
];
x =
if builtins.hasAttr "xonsh-unwrapped" pkgs then
pkgs.xonsh else
pkgs.xonsh.passthru.wrapper;
in
{
imports = [
../baseline.nix
./backup.nix
./ceph.nix
./container.nix
./db.nix
./gnome.nix
./home.nix
./kde.nix
./kiwix-serve.nix
./linode.nix
./print.nix
./proxy.nix
./router.nix
./rpi4.nix
./sway.nix
./syncthing.nix
./tailscale.nix
./vmdev.nix
];
environment.sessionVariables.MOZ_ENABLE_WAYLAND = "0";
environment.systemPackages = with pkgs; [
btrfs-progs
coreutils-full
efibootmgr
psmisc
lshw
usbutils
xfsprogs
];
environment.sessionVariables.MOZ_ENABLE_WAYLAND = "0";
environment.systemPackages = with pkgs; [
btrfs-progs
coreutils-full
efibootmgr
psmisc
lshw
usbutils
xfsprogs
];
system.stateVersion = "24.05";
system.stateVersion = "24.05";
nix = {
gc.dates = "weekly";
settings.auto-optimise-store = true;
};
nix = {
gc.dates = "weekly";
settings.auto-optimise-store = true;
};
# I am a fan of network manager, myself
networking = {
search = [
"thehellings.lan"
"home"
];
networkmanager.enable = true;
};
# I am a fan of network manager, myself
networking = {
search = [
"thehellings.lan"
"home"
];
networkmanager.enable = true;
};
programs.xonsh = {
enable = true;
package = (x.override {
extraPackages = (ps: with ps; [
(ps.toPythonModule pkgs.pipenv)
pyyaml
requests
ruamel-yaml
xonsh-apipenv
pkgs.nur.repos.xonsh-xontribs.xonsh-direnv
pkgs.nur.repos.xonsh-xontribs.xontrib-vox
]);
});
};
programs.xonsh = {
enable = true;
package = (x.override {
extraPackages = (ps: with ps; [
(ps.toPythonModule pkgs.pipenv)
pyyaml
requests
ruamel-yaml
xonsh-apipenv
pkgs.nur.repos.xonsh-xontribs.xonsh-direnv
pkgs.nur.repos.xonsh-xontribs.xontrib-vox
]);
});
};
# Enable the OpenSSH daemon for remote control
services = {
openssh = {
enable = true;
settings.X11Forwarding = true;
};
};
# Enable the OpenSSH daemon for remote control
services = {
openssh = {
enable = true;
settings.X11Forwarding = true;
};
};
# Define a user account. Don't forget to set a password with ‘passwd’.
users.users.greg = {
isNormalUser = true;
createHome = true;
extraGroups = [ "wheel" "networkmanager" ]; # Enable ‘sudo’ for the user.
shell = config.programs.xonsh.package;
openssh.authorizedKeys.keys = lib.strings.splitString "\n" (builtins.readFile ../../home/ssh/authorized_keys);
};
# Define a user account. Don't forget to set a password with ‘passwd’.
users.users.greg = {
isNormalUser = true;
createHome = true;
extraGroups = [ "wheel" "networkmanager" ]; # Enable ‘sudo’ for the user.
shell = config.programs.xonsh.package;
openssh.authorizedKeys.keys = lib.strings.splitString "\n" (builtins.readFile ../../home/ssh/authorized_keys);
};
i18n.defaultLocale = "en_US.UTF-8";
i18n.defaultLocale = "en_US.UTF-8";
console = {
font = "Lat2-Terminus16";
keyMap = "us";
};
console = {
font = "Lat2-Terminus16";
keyMap = "us";
};
}
modules/nixos/gnome.nix
+51 -50
View File
@@ -1,64 +1,65 @@
{ config, pkgs, lib, ... }:
let
cfg = config.greg.gnome;
cfg = config.greg.gnome;
in with lib; {
options = {
greg.gnome.enable = mkEnableOption "Enable my default Gnome3 setup";
};
in
with lib; {
options = {
greg.gnome.enable = mkEnableOption "Enable my default Gnome3 setup";
};
config = mkIf cfg.enable {
# Sets up a basic Gnome installation
services = {
accounts-daemon.enable = true;
config = mkIf cfg.enable {
# Sets up a basic Gnome installation
services = {
accounts-daemon.enable = true;
# Trackpad support
libinput.enable = true;
# Trackpad support
libinput.enable = true;
xserver = {
enable = true;
displayManager.gdm.enable = true;
desktopManager.gnome.enable = true;
xkb.layout = "us";
};
xserver = {
enable = true;
displayManager.gdm.enable = true;
desktopManager.gnome.enable = true;
xkb.layout = "us";
};
udev.packages = with pkgs; [
gnome-settings-daemon
];
udev.packages = with pkgs; [
gnome-settings-daemon
];
pipewire.enable = true;
pipewire.enable = true;
# Enablement for Firefox
gnome = {
gnome-browser-connector.enable = true;
#chrome-gnome-shell.enable = true;
sushi.enable = true;
gnome-online-accounts.enable = true;
};
};
# Enablement for Firefox
gnome = {
gnome-browser-connector.enable = true;
#chrome-gnome-shell.enable = true;
sushi.enable = true;
gnome-online-accounts.enable = true;
};
};
programs.dconf.enable = true;
xdg.portal = {
enable = true;
wlr.enable = true; # Enables screen sharing in Wayland
};
programs.dconf.enable = true;
xdg.portal = {
enable = true;
wlr.enable = true; # Enables screen sharing in Wayland
};
# Used by gsconnect
networking.firewall.allowedTCPPorts = [ 1716 ];
# Used by gsconnect
networking.firewall.allowedTCPPorts = [ 1716 ];
# Enable some Gnome plugins that I like
environment.systemPackages = with pkgs; [
adwaita-icon-theme
gnome-tweaks
dconf-editor
gnomeExtensions.appindicator
gnomeExtensions.clipboard-indicator
gnomeExtensions.dash-to-dock
gnomeExtensions.gsconnect
gnomeExtensions.stocks-extension
gnomeExtensions.tailscale-qs
gnomeExtensions.vitals
];
};
# Enable some Gnome plugins that I like
environment.systemPackages = with pkgs; [
adwaita-icon-theme
gnome-tweaks
dconf-editor
gnomeExtensions.appindicator
gnomeExtensions.clipboard-indicator
gnomeExtensions.dash-to-dock
gnomeExtensions.gsconnect
gnomeExtensions.stocks-extension
gnomeExtensions.tailscale-qs
gnomeExtensions.vitals
];
};
}
modules/nixos/home.nix
+12 -11
View File
@@ -1,18 +1,19 @@
{ config, lib, ... }:
let
cfg = config.greg.home;
cfg = config.greg.home;
in with lib;
in
with lib;
{
options.greg.home = mkOption {
type = types.bool;
default = true;
description = "Sets the device up to be part of my home network";
};
options.greg.home = mkOption {
type = types.bool;
default = true;
description = "Sets the device up to be part of my home network";
};
config = mkIf cfg {
time.timeZone = "America/Chicago";
networking.domain = "thehellings.lan";
};
config = mkIf cfg {
time.timeZone = "America/Chicago";
networking.domain = "thehellings.lan";
};
}
modules/nixos/kde.nix
+40 -39
View File
@@ -1,48 +1,49 @@
{ config, pkgs, lib, options, ... }:
let
cfg = config.greg.kde;
cfg = config.greg.kde;
in with lib; {
options = {
greg.kde.enable = mkEnableOption "Enable my default KDE setup";
};
in
with lib; {
options = {
greg.kde.enable = mkEnableOption "Enable my default KDE setup";
};
config = mkIf cfg.enable {
# Sets up a basic KDE installation
services = {
xserver = {
enable = true;
xkb.layout = "us";
# Trackpad support
libinput.enable = true;
};
config = mkIf cfg.enable {
# Sets up a basic KDE installation
services = {
xserver = {
enable = true;
xkb.layout = "us";
# Trackpad support
libinput.enable = true;
};
pipewire = {
enable = true;
alsa.enable = true;
alsa.support32Bit = true;
pulse.enable = true;
};
} // (optionalAttrs (builtins.hasAttr "plasma6" options.services.xserver.desktopManager) {
desktopManager.plasma6.enable = true;
displayManager = {
defaultSession = "plasma";
sddm.enable = true;
};
});
pipewire = {
enable = true;
alsa.enable = true;
alsa.support32Bit = true;
pulse.enable = true;
};
} // (optionalAttrs (builtins.hasAttr "plasma6" options.services.xserver.desktopManager) {
desktopManager.plasma6.enable = true;
displayManager = {
defaultSession = "plasma";
sddm.enable = true;
};
});
programs.dconf.enable = true;
programs.sway.enable = true; # Gives us Wayland
xdg.portal = {
enable = true;
wlr.enable = true; # Enables screen sharing in Wayland
};
programs.dconf.enable = true;
programs.sway.enable = true; # Gives us Wayland
xdg.portal = {
enable = true;
wlr.enable = true; # Enables screen sharing in Wayland
};
environment.systemPackages = with pkgs; [
kalendar
korganizer
plasma-pa
];
};
environment.systemPackages = with pkgs; [
kalendar
korganizer
plasma-pa
];
};
}
modules/nixos/kiwix-serve.nix
+39 -38
View File
@@ -1,48 +1,49 @@
{ config, pkgs, lib, ... }:
{ config, pkgs, lib, ... }:
let
cfg = config.services.kiwix-serve;
in with lib; {
options.services.kiwix-serve = {
enable = mkEnableOption "Enable the Kiwix web server";
cfg = config.services.kiwix-serve;
in
with lib; {
options.services.kiwix-serve = {
enable = mkEnableOption "Enable the Kiwix web server";
port = mkOption {
type = types.int;
default = 8888;
description = "Port to serve the Kiwix HTTP service on";
};
port = mkOption {
type = types.int;
default = 8888;
description = "Port to serve the Kiwix HTTP service on";
};
path = mkOption {
type = types.str;
default = "/var/lib/kiwix-serve/";
description = "Path to Zim file(s) to serve";
};
path = mkOption {
type = types.str;
default = "/var/lib/kiwix-serve/";
description = "Path to Zim file(s) to serve";
};
proxy = mkOption {
type = types.str;
default = "";
description = ''Upstream proxy, if any, to configure with kiwix. Specify
proxy = mkOption {
type = types.str;
default = "";
description = ''Upstream proxy, if any, to configure with kiwix. Specify
host and port. E.g. "localhost:8080"
'';
};
};
};
};
config = mkIf cfg.enable {
environment.systemPackages = [
pkgs.kiwix-tools
];
config = mkIf cfg.enable {
environment.systemPackages = [
pkgs.kiwix-tools
];
systemd.services.kiwix-serve = {
enable = true;
after = [ "network.service" ];
description = "Runs the kiwix-serve binary as a sysmted service";
restartTriggers = [ pkgs.kiwix-tools ];
wantedBy = [ "multi-user.target" ];
script = "${pkgs.kiwix-tools}/bin/kiwix-serve --port ${toString cfg.port} ${cfg.path}";
environment = {
UPSTREAM_HOST = mkIf (cfg.proxy != "") cfg.proxy;
UPSTREAM_WIKI = mkIf (cfg.proxy != "") cfg.proxy;
};
};
};
systemd.services.kiwix-serve = {
enable = true;
after = [ "network.service" ];
description = "Runs the kiwix-serve binary as a sysmted service";
restartTriggers = [ pkgs.kiwix-tools ];
wantedBy = [ "multi-user.target" ];
script = "${pkgs.kiwix-tools}/bin/kiwix-serve --port ${toString cfg.port} ${cfg.path}";
environment = {
UPSTREAM_HOST = mkIf (cfg.proxy != "") cfg.proxy;
UPSTREAM_WIKI = mkIf (cfg.proxy != "") cfg.proxy;
};
};
};
}
modules/nixos/linode.nix
+34 -33
View File
@@ -1,44 +1,45 @@
{ config, lib, pkgs, ... }:
let
cfg = config.greg.linode;
cfg = config.greg.linode;
in with lib;
in
with lib;
{
options.greg.linode = {
enable = mkEnableOption "Set sensible defaults for a Linode host";
options.greg.linode = {
enable = mkEnableOption "Set sensible defaults for a Linode host";
bootTimeout = mkOption {
type = types.int;
default = 15;
description = "Set bootloader timeout in seconds.";
};
};
bootTimeout = mkOption {
type = types.int;
default = 15;
description = "Set bootloader timeout in seconds.";
};
};
config = mkIf cfg.enable {
# Enables connection over Linode consoles
boot.kernelParams = [ "console=ttyS0,19200n8" ];
boot.loader.grub = {
device = "nodev";
extraConfig = ''
serial --speed=19200 --unit=0 --word=8 --parity=no --stop=1;
terminal_input serial;
terminal_output serial;
'';
};
config = mkIf cfg.enable {
# Enables connection over Linode consoles
boot.kernelParams = [ "console=ttyS0,19200n8" ];
boot.loader.grub = {
device = "nodev";
extraConfig = ''
serial --speed=19200 --unit=0 --word=8 --parity=no --stop=1;
terminal_input serial;
terminal_output serial;
'';
};
# Tells grub to ignore partion-free device warnings, since we are on Linode
boot.loader.timeout = 15;
# Tells grub to ignore partion-free device warnings, since we are on Linode
boot.loader.timeout = 15;
networking.usePredictableInterfaceNames = false; # Use old style eth0 names
networking.useDHCP = false;
networking.interfaces.eth0.useDHCP = true;
networking.usePredictableInterfaceNames = false; # Use old style eth0 names
networking.useDHCP = false;
networking.interfaces.eth0.useDHCP = true;
# Suggested diagnostic tools
environment.systemPackages = with pkgs; [
inetutils
mtr
sysstat
];
};
# Suggested diagnostic tools
environment.systemPackages = with pkgs; [
inetutils
mtr
sysstat
];
};
}
modules/nixos/print.nix
+26 -25
View File
@@ -1,33 +1,34 @@
{ config, lib, pkgs, ... }:
let
cfg = config.greg.print;
cfg = config.greg.print;
in with lib;
in
with lib;
{
options.greg.print.enable = mkOption {
type = types.bool;
default = true;
description = "Configures the system to print with my home printer";
};
options.greg.print.enable = mkOption {
type = types.bool;
default = true;
description = "Configures the system to print with my home printer";
};
config = mkIf cfg.enable {
# ipp://printer.thehellings.lan:631/ - generic postscript printer
services.printing = {
enable = true;
drivers = with pkgs; [
gutenprint
] ++ (lib.optional pkgs.stdenv.isx86_64 gutenprintBin);
};
config = mkIf cfg.enable {
# ipp://printer.thehellings.lan:631/ - generic postscript printer
services.printing = {
enable = true;
drivers = with pkgs; [
gutenprint
] ++ (lib.optional pkgs.stdenv.isx86_64 gutenprintBin);
};
hardware.printers.ensurePrinters = [ {
name = "HomeLexmarkColorPrinter";
location = "Home office";
deviceUri = "ipp://printer.thehellings.lan:631/";
model = "drv:///sample.drv/generic.ppd";
ppdOptions = {
PageSize = "Letter";
};
} ];
};
hardware.printers.ensurePrinters = [{
name = "HomeLexmarkColorPrinter";
location = "Home office";
deviceUri = "ipp://printer.thehellings.lan:631/";
model = "drv:///sample.drv/generic.ppd";
ppdOptions = {
PageSize = "Letter";
};
}];
};
}
modules/nixos/proxy.nix
+74 -72
View File
@@ -1,87 +1,89 @@
{ config, lib, pkgs, ... }:
let
cfg = config.greg.proxies;
cfg = config.greg.proxies;
alias = name: with builtins; head (split "\\." name);
alias = name: with builtins; head (split "\\." name);
makeHost = name: dest: {
forceSSL = dest.ssl;
enableACME = dest.ssl;
locations."${dest.path}" = {
proxyPass = dest.target;
extraConfig = ''
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $connection_upgrade;
'' + dest.extraConfig;
};
serverAliases = lib.mkIf dest.genAliases [ "${alias name}" ];
};
makeHost = name: dest: {
forceSSL = dest.ssl;
enableACME = dest.ssl;
locations."${dest.path}" = {
proxyPass = dest.target;
extraConfig = ''
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $connection_upgrade;
'' + dest.extraConfig;
};
serverAliases = lib.mkIf dest.genAliases [ "${alias name}" ];
};
in with lib; {
options = {
greg.proxies = mkOption {
default = {};
example = literalExpression ''
{ host-name = {
target = proxyLocation;
ssl = true;
};
'';
description = ''
Quick and simple Nginx proxy configurations.
Use this to configure a very simple proxy that does not
need any extra customization options other than SSL
enablement.
'';
in
with lib; {
options = {
greg.proxies = mkOption {
default = { };
example = literalExpression ''
{ host-name = {
target = proxyLocation;
ssl = true;
};
'';
description = ''
Quick and simple Nginx proxy configurations.
Use this to configure a very simple proxy that does not
need any extra customization options other than SSL
enablement.
'';
type = with types; attrsOf (submodule (
{ name, config, options, ... }:
{
options = {
genAliases = mkOption {
type = types.bool;
description = "Whether to auto-generate short alias name";
default = true;
};
type = with types; attrsOf (submodule (
{ name, config, options, ... }:
{
options = {
genAliases = mkOption {
type = types.bool;
description = "Whether to auto-generate short alias name";
default = true;
};
target = mkOption {
type = types.str;
description = ''The destination that is being proxied.'';
example = "http://localhost:8080";
};
target = mkOption {
type = types.str;
description = ''The destination that is being proxied.'';
example = "http://localhost:8080";
};
ssl = mkOption {
type = types.bool;
description = "Whether to enable SSL in front of the proxy";
default = false;
};
ssl = mkOption {
type = types.bool;
description = "Whether to enable SSL in front of the proxy";
default = false;
};
path = mkOption {
type = types.str;
description = "The path prefix for this proxy";
default = "/";
};
path = mkOption {
type = types.str;
description = "The path prefix for this proxy";
default = "/";
};
extraConfig = mkOption {
type = types.str;
description = "Extra nginx config options";
default = "";
};
};
}));
};
};
extraConfig = mkOption {
type = types.str;
description = "Extra nginx config options";
default = "";
};
};
}
));
};
};
config.services.nginx = mkIf ( ( attrValues cfg ) != [] ) {
enable = true;
config.services.nginx = mkIf ((attrValues cfg) != [ ]) {
enable = true;
recommendedGzipSettings = true;
recommendedOptimisation = true;
recommendedProxySettings = true;
recommendedTlsSettings = true;
recommendedGzipSettings = true;
recommendedOptimisation = true;
recommendedProxySettings = true;
recommendedTlsSettings = true;
virtualHosts = mapAttrs makeHost cfg;
};
virtualHosts = mapAttrs makeHost cfg;
};
}
modules/nixos/router.nix
+86 -82
View File
@@ -1,93 +1,97 @@
{ config, lib, pkgs, ... }:
let
names = mylist: (lib.strings.concatMapStringsSep "," (x: ''"${x}"'') mylist);
# Pass the names of the wan/lan ports
nftConfig = {
wan,
lan,
limitedLan ? [],
openPorts ? [ "ssh" "67" "53" ], # ssh, dhcpd, dns
openUDPPorts ? [ "67" "53" ] # dhcpd, dns
}: let
lanList = names lan;
allLan = names (lan ++ limitedLan);
wanName = names wan;
portsString = lib.strings.concatMapStringsSep "\n" (x: "iifname { ${lanList}, \"tailscale0\" } tcp dport ${toString x} accept") openPorts;
udpPortsString = lib.strings.concatMapStringsSep "\n" (x: "iifname { ${lanList}, \"tailscale0\" } udp dport ${toString x} accept") openUDPPorts;
in lib.strings.concatStringsSep "\n" [
"table ip filter {"
" chain output {"
" type filter hook output priority 100; policy accept;"
" }"
names = mylist: (lib.strings.concatMapStringsSep "," (x: ''"${x}"'') mylist);
# Pass the names of the wan/lan ports
nftConfig =
{ wan
, lan
, limitedLan ? [ ]
, openPorts ? [ "ssh" "67" "53" ]
, # ssh, dhcpd, dns
openUDPPorts ? [ "67" "53" ] # dhcpd, dns
}:
let
lanList = names lan;
allLan = names (lan ++ limitedLan);
wanName = names wan;
portsString = lib.strings.concatMapStringsSep "\n" (x: "iifname { ${lanList}, \"tailscale0\" } tcp dport ${toString x} accept") openPorts;
udpPortsString = lib.strings.concatMapStringsSep "\n" (x: "iifname { ${lanList}, \"tailscale0\" } udp dport ${toString x} accept") openUDPPorts;
in
lib.strings.concatStringsSep "\n" [
"table ip filter {"
" chain output {"
" type filter hook output priority 100; policy accept;"
" }"
" chain input {"
" type filter hook input priority 0; policy drop;"
" chain input {"
" type filter hook input priority 0; policy drop;"
" iifname lo accept"
portsString
udpPortsString
" iifname { ${lanList} } accept comment \"Allows LAN traffic and outgoing\""
" iifname { ${wanName} } ct state { established, related } accept comment \"Allows existing connections\""
" iifname { ${wanName} } icmp type { echo-request, destination-unreachable, time-exceeded } counter accept comment \"Allow some ICMP traffic\""
" iifname { ${wanName} } counter drop comment \"Drop other incoming traffic, and count how much\""
" }"
" chain forward {"
" type filter hook forward priority 0; policy drop;"
" iifname { ${allLan} } oifname { ${wanName} } accept comment \"Forward LAN to WAN\""
" iifname { ${wanName} } oifname { ${allLan} } ct state established, related accept comment \"Allow incoming established traffic\""
" }"
"}"
" iifname lo accept"
portsString
udpPortsString
" iifname { ${lanList} } accept comment \"Allows LAN traffic and outgoing\""
" iifname { ${wanName} } ct state { established, related } accept comment \"Allows existing connections\""
" iifname { ${wanName} } icmp type { echo-request, destination-unreachable, time-exceeded } counter accept comment \"Allow some ICMP traffic\""
" iifname { ${wanName} } counter drop comment \"Drop other incoming traffic, and count how much\""
" }"
" chain forward {"
" type filter hook forward priority 0; policy drop;"
" iifname { ${allLan} } oifname { ${wanName} } accept comment \"Forward LAN to WAN\""
" iifname { ${wanName} } oifname { ${allLan} } ct state established, related accept comment \"Allow incoming established traffic\""
" }"
"}"
"table ip nat {"
" chain postrouting {"
" type nat hook postrouting priority 100; policy accept;"
" oifname { ${wanName} } masquerade"
" }"
"}"
"table ip nat {"
" chain postrouting {"
" type nat hook postrouting priority 100; policy accept;"
" oifname { ${wanName} } masquerade"
" }"
"}"
"table ip6 filter {"
" chain input {"
" type filter hook input priority 0; policy drop;"
" }"
" chain forward {"
" type filter hook forward priority 0; policy drop;"
" }"
"}"
];
cfg = config.greg.router;
"table ip6 filter {"
" chain input {"
" type filter hook input priority 0; policy drop;"
" }"
" chain forward {"
" type filter hook forward priority 0; policy drop;"
" }"
"}"
];
cfg = config.greg.router;
in with lib; {
options.greg.router = {
enable = mkEnableOption "Enable NFTables and routing";
wan = mkOption {
type = (types.listOf types.str);
description = "The name of the network interface that is the WAN connection";
};
lan = mkOption {
type = (types.listOf types.str);
description = "A list of all network interfaces that are considered LAN connections";
};
limited = mkOption {
type = (types.listOf types.str);
description = "A list of limited access LAN connections - such as IOT connections and similar.";
default = [];
};
};
in
with lib; {
options.greg.router = {
enable = mkEnableOption "Enable NFTables and routing";
wan = mkOption {
type = (types.listOf types.str);
description = "The name of the network interface that is the WAN connection";
};
lan = mkOption {
type = (types.listOf types.str);
description = "A list of all network interfaces that are considered LAN connections";
};
limited = mkOption {
type = (types.listOf types.str);
description = "A list of limited access LAN connections - such as IOT connections and similar.";
default = [ ];
};
};
config = mkIf cfg.enable {
networking.nftables = {
enable = true;
ruleset = (nftConfig {
inherit (cfg) lan wan;
openPorts = config.networking.firewall.allowedTCPPorts;
openUDPPorts = config.networking.firewall.allowedUDPPorts;
});
};
config = mkIf cfg.enable {
networking.nftables = {
enable = true;
ruleset = (nftConfig {
inherit (cfg) lan wan;
openPorts = config.networking.firewall.allowedTCPPorts;
openUDPPorts = config.networking.firewall.allowedUDPPorts;
});
};
environment.systemPackages = [
pkgs.pciutils
pkgs.tcpdump
];
};
environment.systemPackages = [
pkgs.pciutils
pkgs.tcpdump
];
};
}
modules/nixos/rpi4.nix
+34 -33
View File
@@ -1,43 +1,44 @@
{ config, lib, pkgs, ... }:
let
cfg = config.greg.rpi4;
cfg = config.greg.rpi4;
in with lib; {
options = {
greg.rpi4 = {
enable = mkEnableOption "Enable support for Raspberry Pi 4s";
};
};
in
with lib; {
options = {
greg.rpi4 = {
enable = mkEnableOption "Enable support for Raspberry Pi 4s";
};
};
config = mkIf cfg.enable {
boot = {
# This prevents us from having to compile our own kernel
kernelPackages = pkgs.linuxPackages_rpi4;
kernelParams = [
"8250.nr_uarts=1"
"console=ttyAMA0,115200"
"console=tty1"
"cma=128M"
];
config = mkIf cfg.enable {
boot = {
# This prevents us from having to compile our own kernel
kernelPackages = pkgs.linuxPackages_rpi4;
kernelParams = [
"8250.nr_uarts=1"
"console=ttyAMA0,115200"
"console=tty1"
"cma=128M"
];
loader = {
raspberryPi = {
enable = true;
version = 4;
};
loader = {
raspberryPi = {
enable = true;
version = 4;
};
# Use the extlinux boot loader. (NixOS wants to enable GRUB by default)
grub.enable = false;
# Use the extlinux boot loader. (NixOS wants to enable GRUB by default)
grub.enable = false;
# Enables the generation of /boot/extlinux/extlinux.conf
#generic-extlinux-compatible.enable = true;
};
};
# Enables the generation of /boot/extlinux/extlinux.conf
#generic-extlinux-compatible.enable = true;
};
};
environment.systemPackages = with pkgs; [
raspberrypifw
usbutils
];
};
environment.systemPackages = with pkgs; [
raspberrypifw
usbutils
];
};
}
modules/nixos/sway.nix
+34 -33
View File
@@ -1,42 +1,43 @@
{ config, pkgs, lib, ... }:
let
cfg = config.greg.sway;
cfg = config.greg.sway;
in with lib; {
options = {
greg.sway.enable = mkEnableOption "Enable my default Gnome3 setup";
};
in
with lib; {
options = {
greg.sway.enable = mkEnableOption "Enable my default Gnome3 setup";
};
config = mkIf cfg.enable {
services = {
accounts-daemon.enable = true;
config = mkIf cfg.enable {
services = {
accounts-daemon.enable = true;
pipewire = {
enable = true;
alsa.enable = true;
audio.enable = true;
jack.enable = true;
pulse.enable = true;
wireplumber.enable = true;
};
pipewire = {
enable = true;
alsa.enable = true;
audio.enable = true;
jack.enable = true;
pulse.enable = true;
wireplumber.enable = true;
};
xserver = {
enable = true;
displayManager.gdm = {
enable = true;
autoSuspend = false;
banner = "Welcome to Greg's JUDE machine. Do I know you?";
wayland = true;
};
xkb.layout = "us";
};
};
xserver = {
enable = true;
displayManager.gdm = {
enable = true;
autoSuspend = false;
banner = "Welcome to Greg's JUDE machine. Do I know you?";
wayland = true;
};
xkb.layout = "us";
};
};
programs.sway = {
enable = true; # Will be enabled through home-manager
wrapperFeatures.gtk = true;
};
security.pam.services.swaylock = {};
};
programs.sway = {
enable = true; # Will be enabled through home-manager
wrapperFeatures.gtk = true;
};
security.pam.services.swaylock = { };
};
}
modules/nixos/syncthing.nix
+25 -24
View File
@@ -1,29 +1,30 @@
{ config, lib, pkgs, ... }:
let
cfg = config.greg.syncthing;
in with lib; {
options.greg.syncthing = {
enable = mkEnableOption "Setup my personal minimal configuration for Syncthing";
};
cfg = config.greg.syncthing;
in
with lib; {
options.greg.syncthing = {
enable = mkEnableOption "Setup my personal minimal configuration for Syncthing";
};
config = mkIf cfg.enable {
services.syncthing = {
enable = true;
overrideFolders = true;
overrideDevices = true;
settings = {
devices = {
chronicles.id = "7FI6Y3M-C7YQEDI-IB345L6-RKLXMB6-AEIV57Y-3J2RCXQ-MK6QRNK-EINPXAE";
genesis.id = "YDTH4SD-GUAC5AA-SSYWYPZ-YMJW5LK-LE7PZKJ-GV2UJFZ-CU7LZAD-GTYWCQK";
gitlab.id = "VAG5GHP-L7TNY7O-CHR3CKU-GXXVCIL-OT3WHHU-E4VAIZC-JI4BKOM-PYZQOQS";
linode.id = "IJMMXPR-WNALZBD-FMJH5W5-WV7XGJY-HLJTKGT-5TKHJIH-75LT56D-UUZCYQE";
matrix.id = "K5IHM3I-TJFFEW5-GAYJMPS-CYSHW5C-XHMC462-MFRMOHJ-EJLKIKC-CZHGJQ2";
};
options = {
urAccepted = -1;
};
};
};
};
config = mkIf cfg.enable {
services.syncthing = {
enable = true;
overrideFolders = true;
overrideDevices = true;
settings = {
devices = {
chronicles.id = "7FI6Y3M-C7YQEDI-IB345L6-RKLXMB6-AEIV57Y-3J2RCXQ-MK6QRNK-EINPXAE";
genesis.id = "YDTH4SD-GUAC5AA-SSYWYPZ-YMJW5LK-LE7PZKJ-GV2UJFZ-CU7LZAD-GTYWCQK";
gitlab.id = "VAG5GHP-L7TNY7O-CHR3CKU-GXXVCIL-OT3WHHU-E4VAIZC-JI4BKOM-PYZQOQS";
linode.id = "IJMMXPR-WNALZBD-FMJH5W5-WV7XGJY-HLJTKGT-5TKHJIH-75LT56D-UUZCYQE";
matrix.id = "K5IHM3I-TJFFEW5-GAYJMPS-CYSHW5C-XHMC462-MFRMOHJ-EJLKIKC-CZHGJQ2";
};
options = {
urAccepted = -1;
};
};
};
};
}
modules/nixos/tailscale.nix
+14 -13
View File
@@ -1,18 +1,19 @@
{ lib, config, ... }:
let
cfg = config.greg.tailscale;
in {
options = {
greg.tailscale.enable = lib.mkEnableOption "Enable Tailscale";
};
cfg = config.greg.tailscale;
in
{
options = {
greg.tailscale.enable = lib.mkEnableOption "Enable Tailscale";
};
config = lib.mkIf cfg.enable {
services.tailscale.enable = true;
networking.firewall.checkReversePath = "loose";
boot.kernel.sysctl = {
"net.ipv4.ip_forward" = "1";
"net.ipv6.conf.all.forwarding" = "1";
};
};
config = lib.mkIf cfg.enable {
services.tailscale.enable = true;
networking.firewall.checkReversePath = "loose";
boot.kernel.sysctl = {
"net.ipv4.ip_forward" = "1";
"net.ipv6.conf.all.forwarding" = "1";
};
};
}
modules/nixos/vmdev.nix
+63 -62
View File
@@ -1,74 +1,75 @@
{ pkgs, lib, config, ... }:
let
cfg = config.greg.vmdev;
in with lib;
cfg = config.greg.vmdev;
in
with lib;
{
options = {
greg.vmdev = {
enable = mkEnableOption "Enable this system for VM development work";
user = mkOption {
default = "greg";
type = types.str;
description = "The user who will be doing VM dev";
};
system = mkOption {
default = "amd";
type = types.str;
description = "Kernel module type to install - amd, intel, etc";
};
};
};
options = {
greg.vmdev = {
enable = mkEnableOption "Enable this system for VM development work";
user = mkOption {
default = "greg";
type = types.str;
description = "The user who will be doing VM dev";
};
system = mkOption {
default = "amd";
type = types.str;
description = "Kernel module type to install - amd, intel, etc";
};
};
};
config = mkIf cfg.enable {
environment.systemPackages = with pkgs; [
dmidecode
guestfs-tools
libguestfs
OVMFFull
packer
virt-manager
xorriso
];
config = mkIf cfg.enable {
environment.systemPackages = with pkgs; [
dmidecode
guestfs-tools
libguestfs
OVMFFull
packer
virt-manager
xorriso
];
users.users."${cfg.user}".extraGroups = [ "libvirtd" ];
users.users."${cfg.user}".extraGroups = [ "libvirtd" ];
# Enable the virtualisation services
virtualisation = {
libvirtd = {
enable = true;
onBoot = "ignore"; # Do not auto-restart VMs on boot, unless they are marked autostart
qemu.ovmf.enable = true;
};
# Enable the virtualisation services
virtualisation = {
libvirtd = {
enable = true;
onBoot = "ignore"; # Do not auto-restart VMs on boot, unless they are marked autostart
qemu.ovmf.enable = true;
};
virtualbox.host = {
enable = true;
enableExtensionPack = true;
};
};
virtualbox.host = {
enable = true;
enableExtensionPack = true;
};
};
# Configuration for vbox user performance
users.extraGroups.vboxusers.members = [ cfg.user ];
# Configuration for vbox user performance
users.extraGroups.vboxusers.members = [ cfg.user ];
boot.extraModprobeConfig = "options kvm_${cfg.system} nested=1";
boot.extraModprobeConfig = "options kvm_${cfg.system} nested=1";
# Configure the services more
systemd.services = {
libvirtd = {
preStart = "${pkgs.kmod}/bin/modprobe kvm_${cfg.system}";
postStop = "${pkgs.kmod}/bin/rmmod kvm_${cfg.system} kvm";
conflicts = [ "vbox.service" ];
};
vbox = {
preStart = "${pkgs.kmod}/bin/modprobe vboxdrv vboxnetadp vboxnetflt";
postStop = "${pkgs.kmod}/bin/rmmod vboxnetadp vboxnetflt vboxdrv";
script = "echo Started";
conflicts = [ "libvirtd.service" ];
unitConfig = {
Type = "oneshot";
RemainAfterExit = "yes";
};
};
};
};
# Configure the services more
systemd.services = {
libvirtd = {
preStart = "${pkgs.kmod}/bin/modprobe kvm_${cfg.system}";
postStop = "${pkgs.kmod}/bin/rmmod kvm_${cfg.system} kvm";
conflicts = [ "vbox.service" ];
};
vbox = {
preStart = "${pkgs.kmod}/bin/modprobe vboxdrv vboxnetadp vboxnetflt";
postStop = "${pkgs.kmod}/bin/rmmod vboxnetadp vboxnetflt vboxdrv";
script = "echo Started";
conflicts = [ "libvirtd.service" ];
unitConfig = {
Type = "oneshot";
RemainAfterExit = "yes";
};
};
};
};
}
overlays/aacs.nix
+7 -7
View File
@@ -1,10 +1,10 @@
{ pkgs, ... }:
pkgs.writeShellScriptBin "aacs" ''
set -ex
[ ! -d "''${HOME}/.config/aacs" ] && mkdir -p "''${HOME}/.config/aacs"
cd "''${HOME}/.config/aacs"
[ -f KEYDB.cfg.zip ] && rm -f KEYDB.cfg.zip
curl -L -o KEYDB.cfg.zip "http://fvonline-db.bplaced.net/fv_download.php?lang=eng"
${pkgs.unzip}/bin/unzip KEYDB.cfg.zip
mv keydb.cfg KEYDB.cfg''
set -ex
[ ! -d "''${HOME}/.config/aacs" ] && mkdir -p "''${HOME}/.config/aacs"
cd "''${HOME}/.config/aacs"
[ -f KEYDB.cfg.zip ] && rm -f KEYDB.cfg.zip
curl -L -o KEYDB.cfg.zip "http://fvonline-db.bplaced.net/fv_download.php?lang=eng"
${pkgs.unzip}/bin/unzip KEYDB.cfg.zip
mv keydb.cfg KEYDB.cfg''
overlays/create_ssl.nix
+21 -21
View File
@@ -1,28 +1,28 @@
{ writeShellScriptBin, openssl, ...}:
{ writeShellScriptBin, openssl, ... }:
writeShellScriptBin "create_ssl" ''
set -e -o pipefail
name="''${1}"
root_key="''${2}"
set -e -o pipefail
name="''${1}"
root_key="''${2}"
function usage {
echo "USAGE: create_ssl <cert name> <root path>"
}
function usage {
echo "USAGE: create_ssl <cert name> <root path>"
}
if [ -z "''${name}" ]; then
usage
exit 1
fi
if [ -z "''${name}" ]; then
usage
exit 1
fi
if [ -z "''${root_key}" ]; then
usage
exit 1
fi
if [ -z "''${root_key}" ]; then
usage
exit 1
fi
# Create the certificate key
${openssl}/bin/openssl ecparam -out "''${name}.key" -name prime256v1 -genkey
# Create the CSR
${openssl}/bin/openssl req -name -sha256 -key "''${name}.key" -out "''${name}.csr"
# Sign it
${openssl}/bin/openssl x509 -req -in "''${name}.csr" -CA "''${root_key}.crt" -CAkey "''${root_key}.key" -CAcreateserial -out "''${name}.crt" -days 3650 -sha256
# Create the certificate key
${openssl}/bin/openssl ecparam -out "''${name}.key" -name prime256v1 -genkey
# Create the CSR
${openssl}/bin/openssl req -name -sha256 -key "''${name}.key" -out "''${name}.csr"
# Sign it
${openssl}/bin/openssl x509 -req -in "''${name}.csr" -CA "''${root_key}.crt" -CAkey "''${root_key}.key" -CAcreateserial -out "''${name}.crt" -days 3650 -sha256
''
overlays/default.nix
+72 -68
View File
@@ -1,79 +1,83 @@
final: prev:
let
myPackages = pypackages: with pypackages; [
black
dateutil
ipython
mypy
pylint
pyyaml
responses
ruamel-yaml
tox
typing-extensions
virtualenv
];
myPackages = pypackages: with pypackages; [
black
dateutil
ipython
mypy
pylint
pyyaml
responses
ruamel-yaml
tox
typing-extensions
virtualenv
];
myPython = prev.python312.withPackages myPackages;
macOver = file: og:
if prev.stdenv.isDarwin then
(prev.callPackage file {}) else
prev."${og}";
myPython = prev.python312.withPackages myPackages;
macOver = file: og:
if prev.stdenv.isDarwin then
(prev.callPackage file { }) else
prev."${og}";
buildFirefoxXpiAddon = final.nur.repos.rycee.lib.buildFirefoxXpiAddon;
buildFirefoxXpiAddon = final.nur.repos.rycee.lib.buildFirefoxXpiAddon;
is2405 = prev.lib.versionAtLeast prev.lib.version "24";
is2405 = prev.lib.versionAtLeast prev.lib.version "24";
in rec {
gregpy = myPython;
in
rec {
gregpy = myPython;
## Testing adding python packages in the correct manner
pythonPackagesExtensions = (prev.pythonPackagesExtensions or []) ++ [
(python-final: python-prev: let cp = python-final.callPackage; in {
django-rapyd-modernauth = cp ./django-rapyd-modernauth.nix {};
graypy = cp ./graypy.nix {};
itg-django-utils = cp ./itg-django-utils.nix {};
xonsh-apipenv = cp ./xonsh-apipenv.nix {};
})
];
## Testing adding python packages in the correct manner
pythonPackagesExtensions = (prev.pythonPackagesExtensions or [ ]) ++ [
(python-final: python-prev:
let cp = python-final.callPackage; in {
django-rapyd-modernauth = cp ./django-rapyd-modernauth.nix { };
graypy = cp ./graypy.nix { };
itg-django-utils = cp ./itg-django-utils.nix { };
xonsh-apipenv = cp ./xonsh-apipenv.nix { };
})
];
# My own packages
aacs = prev.callPackage ./aacs.nix {};
create_ssl = prev.callPackage ./create_ssl.nix {};
enwiki-dump = prev.callPackage ./enwiki-dump.nix {};
hms = prev.callPackage ./hms {
pkgs = final.pkgs;
};
inject = prev.callPackage ./inject.nix { inherit (final) pkgs; };
inject-darwin = prev.callPackage ./inject-darwin.nix { inherit (final) pkgs; };
setup-ssh = prev.callPackage ./setup-ssh {
pkgs = final.pkgs;
};
upgrade-pg-cluster = prev.callPackage ./upgrade-pg-cluster.nix {};
# My own packages
aacs = prev.callPackage ./aacs.nix { };
create_ssl = prev.callPackage ./create_ssl.nix { };
enwiki-dump = prev.callPackage ./enwiki-dump.nix { };
hms = prev.callPackage ./hms {
pkgs = final.pkgs;
};
inject = prev.callPackage ./inject.nix { inherit (final) pkgs; };
inject-darwin = prev.callPackage ./inject-darwin.nix { inherit (final) pkgs; };
setup-ssh = prev.callPackage ./setup-ssh {
pkgs = final.pkgs;
};
upgrade-pg-cluster = prev.callPackage ./upgrade-pg-cluster.nix { };
# Overrides of packages
brew = prev.callPackage ./homebrew.nix {};
copier = (if is2405 then prev.copier.overridePythonAttrs (old: {
version = "9.1.0";
src = final.fetchFromGitHub {
owner = "copier-org";
repo = "copier";
rev = "v9.1.0";
hash = "sha256-x5r7Xv4lAOMkR+UIEeSY7LvbYMLpTWYuICYe9ygz1tA=";
postFetch = "rm $out/tests/demo/doc/ma*ana.txt";
};
}) else prev.copier);
libbluray-custom = prev.libbluray.override {
withAACS = true;
withBDplus = true;
};
template = prev.callPackage ./template.nix { };
handbrake = prev.handbrake.override {
libbluray = libbluray-custom;
};
libvirt-greg = prev.libvirt.overrideAttrs {
postInstall = prev.libvirt.postInstall + "rm -r $out/lib/systemd/system/libvirtd.service";
};
pipenv-ivr = prev.callPackage ./pipenv.nix { };
# Overrides of packages
brew = prev.callPackage ./homebrew.nix { };
copier = (if is2405 then
prev.copier.overridePythonAttrs
(old: {
version = "9.1.0";
src = final.fetchFromGitHub {
owner = "copier-org";
repo = "copier";
rev = "v9.1.0";
hash = "sha256-x5r7Xv4lAOMkR+UIEeSY7LvbYMLpTWYuICYe9ygz1tA=";
postFetch = "rm $out/tests/demo/doc/ma*ana.txt";
};
}) else prev.copier);
libbluray-custom = prev.libbluray.override {
withAACS = true;
withBDplus = true;
};
template = prev.callPackage ./template.nix { };
handbrake = prev.handbrake.override {
libbluray = libbluray-custom;
};
libvirt-greg = prev.libvirt.overrideAttrs {
postInstall = prev.libvirt.postInstall + "rm -r $out/lib/systemd/system/libvirtd.service";
};
pipenv-ivr = prev.callPackage ./pipenv.nix { };
}

Some files were not shown because too many files have changed in this diff Show More