diff --git a/.gitignore b/.gitignore index c70dc2d..0d96e93 100644 --- a/.gitignore +++ b/.gitignore @@ -1 +1,2 @@ host +result diff --git a/flake.lock b/flake.lock index a11ff8a..73ba5fd 100644 --- a/flake.lock +++ b/flake.lock @@ -25,11 +25,11 @@ ] }, "locked": { - "lastModified": 1654113405, - "narHash": "sha256-VpK+0QaWG2JRgB00lw77N9TjkE3ec0iMYIX1TzGpxa4=", + "lastModified": 1656169755, + "narHash": "sha256-Nlnm4jeQWEGjYrE6hxi/7HYHjBSZ/E0RtjCYifnNsWk=", "owner": "nix-community", "repo": "home-manager", - "rev": "ac2287df5a2d6f0a44bbcbd11701dbbf6ec43675", + "rev": "4a3d01fb53f52ac83194081272795aa4612c2381", "type": "github" }, "original": { @@ -57,11 +57,11 @@ }, "nixpkgs_2": { "locked": { - "lastModified": 1654005557, - "narHash": "sha256-J6elwUzPoco+r5qWPHhvS2EHVWomUtNcxzkfdAQOwEU=", + "lastModified": 1659342832, + "narHash": "sha256-ePnxG4hacRd6oZMk+YeCSYMNUnHCe+qPLI0/+VaTu48=", "owner": "nixos", "repo": "nixpkgs", - "rev": "08950a6e29cf7bddee466592eb790a417550f7f9", + "rev": "e43cf1748462c81202a32b26294e9f8eefcc3462", "type": "github" }, "original": { @@ -73,11 +73,11 @@ }, "nixunstable": { "locked": { - "lastModified": 1653931853, - "narHash": "sha256-O3wncIouj9x7gBPntzHeK/Hkmm9M1SGlYq7JI7saTAE=", + "lastModified": 1659219666, + "narHash": "sha256-pzYr5fokQPHv7CmUXioOhhzDy/XyWOIXP4LZvv/T7Mk=", "owner": "nixos", "repo": "nixpkgs", - "rev": "f1c167688a6f81f4a51ab542e5f476c8c595e457", + "rev": "7b9be38c7250b22d829ab6effdee90d5e40c6e5c", "type": "github" }, "original": { @@ -87,13 +87,13 @@ "type": "github" } }, - "nur": { + "nurpkgs": { "locked": { - "lastModified": 1654123271, - "narHash": "sha256-xM85/VFYu8I8jZiZ7U0CmZO/98sHO7+f7PIMxQVZXCM=", + "lastModified": 1659423577, + "narHash": "sha256-i2wSHqFqu4xpBJU/o9SRpQblAHknnEtyeN6Kuq/c1JA=", "owner": "nix-community", "repo": "NUR", - "rev": "4c83235ccca7cfcf34fee9f49023f21c0e9db128", + "rev": "0bdb7691364dc93c8f04016c0ed395b675bdc50c", "type": "github" }, "original": { @@ -108,7 +108,7 @@ "home-manager": "home-manager", "nixpkgs": "nixpkgs_2", "nixunstable": "nixunstable", - "nur": "nur" + "nurpkgs": "nurpkgs" } } }, diff --git a/flake.nix b/flake.nix index 22178e3..b5a6d1c 100644 --- a/flake.nix +++ b/flake.nix @@ -12,15 +12,15 @@ url = "github:nix-community/home-manager/release-22.05"; inputs.nixpkgs.follows = "nixpkgs"; }; - nur.url = "github:nix-community/NUR"; + nurpkgs.url = "github:nix-community/NUR"; }; - outputs = {nixpkgs, nixunstable, agenix, home-manager, nur, self}@inputs: + outputs = {nixpkgs, nixunstable, agenix, home-manager, nurpkgs, self}@inputs: let local_overlay = import ./overlays; mods = hostname: [ - { nixpkgs.overlays = [ nur.overlay local_overlay ]; } + { nixpkgs.overlays = [ nurpkgs.overlay local_overlay ]; } agenix.nixosModule ./modules ./profiles/base @@ -28,8 +28,6 @@ home-manager.nixosModules.home-manager { home-manager.useGlobalPkgs = true; home-manager.useUserPackages = true; - home-manager.users.greg = import ./home/home.nix "greg"; - home-manager.users.root = import ./home/home.nix "root"; home-manager.extraSpecialArgs = { inherit nixunstable; }; @@ -66,5 +64,14 @@ }; defaultPackage."x86_64-linux" = inputs.self.nixosConfigurations.iso.config.system.build.isoImage; + + homeConfigurations = ( + import ./home { + inherit nixpkgs nixunstable agenix home-manager nurpkgs; + } + ); + + overlay = local_overlay; + modules = import ./modules; }; } diff --git a/home/default.nix b/home/default.nix new file mode 100644 index 0000000..ec0ed68 --- /dev/null +++ b/home/default.nix @@ -0,0 +1,35 @@ +{ nixpkgs, nurpkgs, home-manager, username ? builtins.getEnv "USER", ... }: + +let + homeDirectory = if username == "root" then "/root" else "/home/${username}"; + configDir = "${homeDirectory}/.config"; + + pkgs = import nixpkgs { + config.allowUnfree = true; + config.xdg.configHome = configDir; + overlays = [ + nurpkgs.overlay + (import ../overlays) + ]; + }; + + nur = import nurpkgs { + inherit pkgs; + nur = pkgs; + }; + + mkhome = system: gui: + home-manager.lib.homeManagerConfiguration rec { + inherit pkgs system username homeDirectory; + stateVersion = "22.05"; + configuration = import ./home.nix username { + inherit nur pkgs gui; + inherit (pkgs) config lib stdenv; + }; + }; +in { + "aarch64-gui" = mkhome "aarch64-linux" true; + "aarch64-nogui" = mkhome "aarch64-linux" false; + "x86_64-gui" = mkhome "x86_64-linux" true; + "x86_64-nogui" = mkhome "x86_64-linux" false; +} diff --git a/home/gui/default.nix b/home/gui/default.nix index 95f8ffc..4ee5a48 100644 --- a/home/gui/default.nix +++ b/home/gui/default.nix @@ -8,6 +8,7 @@ ]; home.packages = with pkgs; [ + bitwarden onlyoffice-bin ]; } diff --git a/home/gui/firefox.nix b/home/gui/firefox.nix index d5513a0..d1b97c7 100644 --- a/home/gui/firefox.nix +++ b/home/gui/firefox.nix @@ -19,7 +19,7 @@ in with lib; }; }; extensions = with pkgs.nur.repos.rycee.firefox-addons; [ - keepassxc-browser + bitwarden octotree refined-github tree-style-tab diff --git a/home/home.nix b/home/home.nix index 55fc169..50b7f6f 100644 --- a/home/home.nix +++ b/home/home.nix @@ -1,7 +1,7 @@ -name: { pkgs, lib, nixosConfig, ...}: +name: { pkgs, lib, gui, ...}: let - guiImports = if nixosConfig.greg.gnome.enable then + guiImports = if gui then [ ./gui ] else []; in { @@ -17,7 +17,8 @@ in { ] ++ guiImports; - home.username = name; - home.homeDirectory = if name == "root" then "/root" else "/home/${name}"; - home.stateVersion = "21.11"; + home.stateVersion = "22.05"; + home.packages = [ + pkgs.hms + ]; } diff --git a/home/xonsh.nix b/home/xonsh.nix index 7b7ccc2..aafa96a 100644 --- a/home/xonsh.nix +++ b/home/xonsh.nix @@ -1,8 +1,6 @@ -{ pkgs, config, nixosConfig, lib, ... }: +{ pkgs, config, lib, ... }: -let - enable = nixosConfig.greg.gnome.enable; -in { +{ programs.xonsh = { enable = true; @@ -42,6 +40,11 @@ in { molcol = "molecule -c ../../tests/molecule.yml"; pa = "cd ~/src/packaging"; dirflake = "nix flake new -t github:nix-community/nix-direnv"; + tsup = "sudo tailscale up"; + tspub = "sudo tailscale up --exit-node=linode"; + tshome = "sudo tailscale up --exit-node=2maccabees"; + tsclear = "sudo tailscale up --exit-node=''"; + rebuild = "sudo nixos-rebuild switch"; }; configHeader = '' diff --git a/hosts/2maccabees/dnsmasq.nix b/hosts/2maccabees/dnsmasq.nix index 1c18c66..ed96138 100644 --- a/hosts/2maccabees/dnsmasq.nix +++ b/hosts/2maccabees/dnsmasq.nix @@ -2,16 +2,21 @@ let extraHosts = builtins.concatStringsSep "\n" [ + # Local hosts "10.42.0.1 switch" "10.42.1.1 router" "10.42.1.2 2maccabees 2maccabees.thehellings.lan dns dns.thehellings.lan smart smart.thehellings.lan" - "100.99.244.92 dns.me.ts 2maccabees.me.ts smart.me.ts" "10.42.1.3 printer" "10.42.1.4 chronicles nas" - "100.119.228.115 nas.me.ts" "10.42.1.12 tv" - "100.90.74.19 jude.me.ts" + # Tailscale hosts + "100.90.74.19 jude.me.ts" + "100.99.244.92 dns.me.ts 2maccabees.me.ts smart.me.ts" + "100.119.228.115 chronicles.me.ts nas.me.ts" + "100.115.57.8 linode.me.ts" + + # Dev hosts "10.42.101.1 icdm.lan wiki.icdm.lan *.icdm.lan" ]; diff --git a/hosts/iso/default.nix b/hosts/iso/default.nix index 23333be..18535c8 100644 --- a/hosts/iso/default.nix +++ b/hosts/iso/default.nix @@ -2,7 +2,7 @@ { imports = [ - "${nixpkgs}/nixos/modules/installer/cd-dvd/installation-cd-base.nix" + "${nixpkgs}/nixos/modules/installer/cd-dvd/installation-cd-graphical-calamares-gnome.nix" ]; networking.networkmanager.enable = lib.mkForce false; diff --git a/hosts/jude/boot.nix b/hosts/jude/boot.nix index 65f8ae9..f01208d 100644 --- a/hosts/jude/boot.nix +++ b/hosts/jude/boot.nix @@ -4,6 +4,12 @@ # Use the systemd-boot EFI boot loader. #boot.loader.systemd-boot.enable = true; boot.loader.grub.device = "/dev/nvme0n1"; + boot.loader.grub.useOSProber = true; + boot.loader.grub.extraEntries = '' + menuentry "Windows" { + chainloader (hd0,2)+1 + } + ''; boot.loader.efi.canTouchEfiVariables = true; networking.interfaces.enp4s0.useDHCP = true; } diff --git a/hosts/jude/default.nix b/hosts/jude/default.nix index 342e027..d85e8a1 100644 --- a/hosts/jude/default.nix +++ b/hosts/jude/default.nix @@ -9,5 +9,6 @@ ./virt.nix ]; networking.hostName = "jude"; + greg.tailscale.enable = true; greg.gnome.enable= true; } diff --git a/hosts/linode/default.nix b/hosts/linode/default.nix index 2ab58f5..ae0a13c 100644 --- a/hosts/linode/default.nix +++ b/hosts/linode/default.nix @@ -10,6 +10,7 @@ ]; greg.home = false; greg.linode.enable = true; + greg.tailscale.enable = true; networking.hostName = "linode"; networking.domain = "thehellings.com"; } diff --git a/hosts/linode/nextcloud.nix b/hosts/linode/nextcloud.nix index b4c7265..068ec5a 100644 --- a/hosts/linode/nextcloud.nix +++ b/hosts/linode/nextcloud.nix @@ -30,8 +30,4 @@ enable = true; devices = [ "nas" ]; }; - - services.cron.systemCronJobs = [ - "59 2 * * * root chmod -R a+r ${config.services.syncthing.folders.nextcloud-backup.path} && find ${config.services.syncthing.folders.nextcloud-backup.path} -type d -exec chmod a+x '{}' \\;" - ]; } diff --git a/hosts/linode/nginx.nix b/hosts/linode/nginx.nix index 9f17309..dc7c4de 100644 --- a/hosts/linode/nginx.nix +++ b/hosts/linode/nginx.nix @@ -5,7 +5,7 @@ in { security.acme = { acceptTerms = true; - email = "greg.hellings@gmail.com"; + defaults.email = "greg.hellings@gmail.com"; }; services.nginx = { @@ -30,5 +30,6 @@ in greg.proxies."thehellings.com" = { target = "http://${homepage}/"; ssl = true; + genAliases = false; }; } diff --git a/hosts/linode/postgres.nix b/hosts/linode/postgres.nix index 9191feb..319c962 100644 --- a/hosts/linode/postgres.nix +++ b/hosts/linode/postgres.nix @@ -27,14 +27,20 @@ root root postgres ''; }; - services.postgresqlBackup.enable = true; + services.postgresqlBackup = { + enable = true; + databases = [ + "nextcloud" + "matrix-synapse" + ]; + }; services.logrotate = { enable = true; - paths = { + settings = { postgres = { enable = true; - path = "${config.services.postgresqlBackup.location}/*.gz"; + files = "${config.services.postgresqlBackup.location}/*.gz"; }; }; }; @@ -44,8 +50,4 @@ root root postgres enable = true; devices = [ "nas" ]; }; - - services.cron.systemCronJobs = [ - "59 2 * * * root chmod -R a+r ${config.services.postgresqlBackup.location} && find ${config.services.postgresqlBackup.location} -type d -exec chmod a+x '{}' \\;" - ]; } diff --git a/hosts/linode/synapse.nix b/hosts/linode/synapse.nix index 2d296e5..02bb222 100644 --- a/hosts/linode/synapse.nix +++ b/hosts/linode/synapse.nix @@ -74,26 +74,30 @@ return 200 '${builtins.toJSON client}'; services.matrix-synapse = { enable = true; - database_name = "synapse"; - database_user = "matrix-synapse"; # Identify ourselves as the root of our own domain - server_name = "thehellings.com"; - #registration_shared_secret = "B9EoPr2WV9hzwc7uL2Sx1JmvCeKDEOGCpB0uginQcQtEH4wzRtkSIdo7lltrjSQa"; - # Bind a single listener to localhost only, disable SSL/TLS, and put - # it behind an nginx proxy - listeners = [ { - port = 8448; - bind_address = "127.0.0.1"; - type = "http"; # Offload SSL/TLS to Nginx - tls = false; - resources = [ { - names = [ "client" "federation" ]; - compress = false; # Offload compressiong to Nginx + settings = { + database.args = { + user = "matrix-synapse"; + database = "synapse"; + }; + server_name = "thehellings.com"; + #registration_shared_secret = "B9EoPr2WV9hzwc7uL2Sx1JmvCeKDEOGCpB0uginQcQtEH4wzRtkSIdo7lltrjSQa"; + # Bind a single listener to localhost only, disable SSL/TLS, and put + # it behind an nginx proxy + listeners = [ { + port = 8448; + bind_addresses = ["127.0.0.1"]; + type = "http"; # Offload SSL/TLS to Nginx + tls = false; + resources = [ { + names = [ "client" "federation" ]; + compress = false; # Offload compressiong to Nginx + } ]; } ]; - } ]; - app_service_config_files = [ - "/etc/${fbRegistrationFile}" - ]; + app_service_config_files = [ + "/etc/${fbRegistrationFile}" + ]; + }; }; # Open networking ports for the server diff --git a/modules/default.nix b/modules/default.nix index 8124384..2a2d0c4 100644 --- a/modules/default.nix +++ b/modules/default.nix @@ -7,6 +7,7 @@ ./linode.nix ./proxy.nix ./rpi4.nix + ./tailscale.nix ./xprograms.nix ]; } diff --git a/modules/proxy.nix b/modules/proxy.nix index 7e0768f..e108242 100644 --- a/modules/proxy.nix +++ b/modules/proxy.nix @@ -16,7 +16,7 @@ proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection $connection_upgrade; ''; }; - serverAliases = [ "${alias name}" ]; + serverAliases = lib.mkIf dest.genAliases [ "${alias name}" ]; }; in with lib; { @@ -40,6 +40,12 @@ in with lib; { { name, config, options, ... }: { options = { + genAliases = mkOption { + type = types.bool; + description = "Whether to auto-generate short alias name"; + default = true; + }; + target = mkOption { type = types.str; description = ''The destination that is being proxied.''; diff --git a/modules/tailscale.nix b/modules/tailscale.nix new file mode 100644 index 0000000..54e34b1 --- /dev/null +++ b/modules/tailscale.nix @@ -0,0 +1,14 @@ +{ lib, config, ... }: + +let + cfg = config.greg.tailscale; +in { + options = { + greg.tailscale.enable = lib.mkEnableOption "Enable Tailscale"; + }; + + config = lib.mkIf cfg.enable { + services.tailscale.enable = true; + networking.firewall.checkReversePath = "loose"; + }; +} diff --git a/overlays/default.nix b/overlays/default.nix index 080869d..e228946 100644 --- a/overlays/default.nix +++ b/overlays/default.nix @@ -8,4 +8,8 @@ self: super: xonsh = super.xonsh.overridePythonAttrs (old: rec{ propagatedBuildInputs = old.propagatedBuildInputs ++ [ self.xonsh-direnv ]; }); + + hms = super.callPackage ./hms.nix { + pkgs = self.pkgs; + }; } diff --git a/overlays/hms.nix b/overlays/hms.nix new file mode 100644 index 0000000..b3cefb1 --- /dev/null +++ b/overlays/hms.nix @@ -0,0 +1,20 @@ +{ pkgs, ... }: + +pkgs.writeShellScriptBin "hms" '' +set -eo pipefail +# Build different targets with GUI or not +if [ -z "$DISPLAY" ]; then + target="nogui" +else + target="gui" +fi + +# Build and switch +echo "Building $(uname -m)-$target" +dest=$(mktemp -d) +pushd "$dest" > /dev/null +nix build --impure /etc/nixos#homeConfigurations.$(uname -m)-$target.activationPackage +./result/activate +popd > /dev/null +rm -r "$dest" +'' diff --git a/overlays/xonsh-direnv.nix b/overlays/xonsh-direnv.nix index 79afcad..07d57a5 100644 --- a/overlays/xonsh-direnv.nix +++ b/overlays/xonsh-direnv.nix @@ -2,11 +2,11 @@ buildPythonPackage rec { pname = "xonsh-direnv"; - version = "1.5.0"; + version = "1.6.1"; src = fetchPypi { inherit pname version; - sha256 = "OLjtGD2lX4Yf3aHrxCWmAbSPZnf8OuVrBu0VFbsna1Y="; + sha256 = "Nt8Da1EtMVWZ9mbBDjys7HDutLYifwoQ1HVmI5CN2Ww="; }; meta = with lib; { diff --git a/profiles/base/default.nix b/profiles/base/default.nix index 043fb38..5e6b5b9 100755 --- a/profiles/base/default.nix +++ b/profiles/base/default.nix @@ -27,6 +27,13 @@ ]; }; + users.users.test = { + isNormalUser = true; + createHome = true; + extraGroups = [ ]; + shell = pkgs.xonsh; + }; + i18n.defaultLocale = "en_US.UTF-8"; console = { diff --git a/profiles/base/programs.nix b/profiles/base/programs.nix index 3c188fb..f2f273a 100644 --- a/profiles/base/programs.nix +++ b/profiles/base/programs.nix @@ -10,10 +10,12 @@ in { # Base packages that need to be in all my hosts environment.systemPackages = with pkgs; [ agenix.defaultPackage."${system}" + bitwarden-cli diffutils git gnupatch findutils + hms # My own home manager switcher home-manager htop myPython diff --git a/profiles/base/syncthing.nix b/profiles/base/syncthing.nix index 5058476..dc46abc 100644 --- a/profiles/base/syncthing.nix +++ b/profiles/base/syncthing.nix @@ -10,9 +10,9 @@ in { services.syncthing = { enable = true; - user = "greg"; - group = "users"; - dataDir = "/home/greg/sync"; + user = "root"; + group = "root"; + dataDir = "/root/sync"; devices = { nas = { addresses = [ @@ -32,14 +32,7 @@ in addresses = [ "tcp://linode.thehellings.com:22000" ]; - id = "3PHWAI5-ILAWGGD-S5FC5QM-M2WQ2FX-PZ3IXQF-QVRKANG-WXAACJC-2MZN3Q5"; - }; - }; - folders = { - "mkrvy-tc6x9" = { - enable = true; - path = "/home/greg/drive"; - devices = syncs; + id = "ROZPUG5-G4IAXYA-JNRQXRD-5PFU2BQ-WVJTOGZ-DFMGJ5E-Q4IGXCJ-JHSNDQ6"; }; }; };