Merge remote-tracking branch 'origin/main'

.gitignore

@@ -1 +1,2 @@
 host
+result

flake.lock

@@ -25,11 +25,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1654113405,
+        "lastModified": 1656169755,
-        "narHash": "sha256-VpK+0QaWG2JRgB00lw77N9TjkE3ec0iMYIX1TzGpxa4=",
+        "narHash": "sha256-Nlnm4jeQWEGjYrE6hxi/7HYHjBSZ/E0RtjCYifnNsWk=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "ac2287df5a2d6f0a44bbcbd11701dbbf6ec43675",
+        "rev": "4a3d01fb53f52ac83194081272795aa4612c2381",
         "type": "github"
       },
       "original": {
@@ -57,11 +57,11 @@
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1654005557,
+        "lastModified": 1659342832,
-        "narHash": "sha256-J6elwUzPoco+r5qWPHhvS2EHVWomUtNcxzkfdAQOwEU=",
+        "narHash": "sha256-ePnxG4hacRd6oZMk+YeCSYMNUnHCe+qPLI0/+VaTu48=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "08950a6e29cf7bddee466592eb790a417550f7f9",
+        "rev": "e43cf1748462c81202a32b26294e9f8eefcc3462",
         "type": "github"
       },
       "original": {
@@ -73,11 +73,11 @@
     },
     "nixunstable": {
       "locked": {
-        "lastModified": 1653931853,
+        "lastModified": 1659219666,
-        "narHash": "sha256-O3wncIouj9x7gBPntzHeK/Hkmm9M1SGlYq7JI7saTAE=",
+        "narHash": "sha256-pzYr5fokQPHv7CmUXioOhhzDy/XyWOIXP4LZvv/T7Mk=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "f1c167688a6f81f4a51ab542e5f476c8c595e457",
+        "rev": "7b9be38c7250b22d829ab6effdee90d5e40c6e5c",
         "type": "github"
       },
       "original": {
@@ -87,13 +87,13 @@
         "type": "github"
       }
     },
-    "nur": {
+    "nurpkgs": {
       "locked": {
-        "lastModified": 1654123271,
+        "lastModified": 1659423577,
-        "narHash": "sha256-xM85/VFYu8I8jZiZ7U0CmZO/98sHO7+f7PIMxQVZXCM=",
+        "narHash": "sha256-i2wSHqFqu4xpBJU/o9SRpQblAHknnEtyeN6Kuq/c1JA=",
         "owner": "nix-community",
         "repo": "NUR",
-        "rev": "4c83235ccca7cfcf34fee9f49023f21c0e9db128",
+        "rev": "0bdb7691364dc93c8f04016c0ed395b675bdc50c",
         "type": "github"
       },
       "original": {
@@ -108,7 +108,7 @@
         "home-manager": "home-manager",
         "nixpkgs": "nixpkgs_2",
         "nixunstable": "nixunstable",
-        "nur": "nur"
+        "nurpkgs": "nurpkgs"
       }
     }
   },

flake.nix

@@ -12,15 +12,15 @@
 			url = "github:nix-community/home-manager/release-22.05";
 			inputs.nixpkgs.follows = "nixpkgs";
 		};
-		nur.url = "github:nix-community/NUR";
+		nurpkgs.url = "github:nix-community/NUR";
 	};
 
-	outputs = {nixpkgs, nixunstable, agenix, home-manager, nur, self}@inputs:
+	outputs = {nixpkgs, nixunstable, agenix, home-manager, nurpkgs, self}@inputs:
 	let
 		local_overlay = import ./overlays;
 
 		mods = hostname: [
-			{ nixpkgs.overlays = [ nur.overlay local_overlay ]; }
+			{ nixpkgs.overlays = [ nurpkgs.overlay local_overlay ]; }
 			agenix.nixosModule
 			./modules
 			./profiles/base
@@ -28,8 +28,6 @@
 			home-manager.nixosModules.home-manager {
 				home-manager.useGlobalPkgs = true;
 				home-manager.useUserPackages = true;
-				home-manager.users.greg = import ./home/home.nix  "greg";
-				home-manager.users.root = import ./home/home.nix  "root";
 				home-manager.extraSpecialArgs = {
 					inherit nixunstable;
 				};
@@ -66,5 +64,14 @@
 		};
 
 		defaultPackage."x86_64-linux" = inputs.self.nixosConfigurations.iso.config.system.build.isoImage;
+
+		homeConfigurations = (
+			import ./home {
+				inherit nixpkgs nixunstable agenix home-manager nurpkgs;
+			}
+		);
+
+		overlay = local_overlay;
+		modules = import ./modules;
 	};
 }

home/default.nix

@@ -0,0 +1,35 @@
+{ nixpkgs, nurpkgs, home-manager, username ? builtins.getEnv "USER", ... }:
+
+let
+	homeDirectory = if username == "root" then "/root" else "/home/${username}";
+	configDir = "${homeDirectory}/.config";
+
+	pkgs = import nixpkgs {
+		config.allowUnfree = true;
+		config.xdg.configHome = configDir;
+		overlays = [
+			nurpkgs.overlay
+			(import ../overlays)
+		];
+	};
+
+	nur = import nurpkgs {
+		inherit pkgs;
+		nur = pkgs;
+	};
+
+	mkhome = system: gui:
+		home-manager.lib.homeManagerConfiguration rec {
+			inherit pkgs system username homeDirectory;
+			stateVersion = "22.05";
+			configuration = import ./home.nix username {
+				inherit nur pkgs gui;
+				inherit (pkgs) config lib stdenv;
+			};
+		};
+in {
+	"aarch64-gui" = mkhome "aarch64-linux" true;
+	"aarch64-nogui" = mkhome "aarch64-linux" false;
+	"x86_64-gui" = mkhome "x86_64-linux" true;
+	"x86_64-nogui" = mkhome "x86_64-linux" false;
+}

home/gui/default.nix

@@ -8,6 +8,7 @@
 	];
 
 	home.packages = with pkgs; [
+		bitwarden
 		onlyoffice-bin
 	];
 }

home/gui/firefox.nix

@@ -19,7 +19,7 @@ in with lib;
 			};
 		};
 		extensions = with pkgs.nur.repos.rycee.firefox-addons; [
-			keepassxc-browser
+			bitwarden
 			octotree
 			refined-github
 			tree-style-tab

home/home.nix

@@ -1,7 +1,7 @@
-name: { pkgs, lib, nixosConfig, ...}:
+name: { pkgs, lib, gui, ...}:
 
 let
-	guiImports = if nixosConfig.greg.gnome.enable then
+	guiImports = if gui then
 		[ ./gui ] else [];
 
 in {
@@ -17,7 +17,8 @@ in {
 	] ++ guiImports;
 
 
-	home.username = name;
+	home.stateVersion = "22.05";
-	home.homeDirectory = if name == "root" then "/root" else "/home/${name}";
+	home.packages = [
-	home.stateVersion = "21.11";
+		pkgs.hms
+	];
 }

home/xonsh.nix

@@ -1,8 +1,6 @@
-{ pkgs, config, nixosConfig, lib, ... }:
+{ pkgs, config, lib, ... }:
 
-let
+{
-	enable = nixosConfig.greg.gnome.enable;
-in {
 	programs.xonsh = {
 		enable = true;
 
@@ -42,6 +40,11 @@ in {
 			molcol = "molecule -c ../../tests/molecule.yml";
 			pa = "cd ~/src/packaging";
 			dirflake = "nix flake new -t github:nix-community/nix-direnv";
+			tsup = "sudo tailscale up";
+			tspub = "sudo tailscale up --exit-node=linode";
+			tshome = "sudo tailscale up --exit-node=2maccabees";
+			tsclear = "sudo tailscale up --exit-node=''";
+			rebuild = "sudo nixos-rebuild switch";
 		};
 
 		configHeader = ''

hosts/2maccabees/dnsmasq.nix

@@ -2,16 +2,21 @@
 
 let
 	extraHosts = builtins.concatStringsSep "\n" [
+		# Local hosts
 		"10.42.0.1 switch"
 		"10.42.1.1 router"
 		"10.42.1.2 2maccabees 2maccabees.thehellings.lan dns dns.thehellings.lan smart smart.thehellings.lan"
-		"100.99.244.92 dns.me.ts 2maccabees.me.ts smart.me.ts"
 		"10.42.1.3 printer"
 		"10.42.1.4 chronicles nas"
-		"100.119.228.115 nas.me.ts"
 		"10.42.1.12 tv"
-		"100.90.74.19 jude.me.ts"
 
+		# Tailscale hosts
+		"100.90.74.19 jude.me.ts"
+		"100.99.244.92 dns.me.ts 2maccabees.me.ts smart.me.ts"
+		"100.119.228.115 chronicles.me.ts nas.me.ts"
+		"100.115.57.8 linode.me.ts"
+
+		# Dev hosts
 		"10.42.101.1 icdm.lan wiki.icdm.lan *.icdm.lan"
 	];
 

hosts/iso/default.nix

@@ -2,7 +2,7 @@
 {
 
 	imports = [
-		"${nixpkgs}/nixos/modules/installer/cd-dvd/installation-cd-base.nix"
+		"${nixpkgs}/nixos/modules/installer/cd-dvd/installation-cd-graphical-calamares-gnome.nix"
 	];
 
 	networking.networkmanager.enable = lib.mkForce false;

hosts/jude/boot.nix

@@ -4,6 +4,12 @@
 	# Use the systemd-boot EFI boot loader.
 	#boot.loader.systemd-boot.enable = true;
 	boot.loader.grub.device = "/dev/nvme0n1";
+	boot.loader.grub.useOSProber = true;
+	boot.loader.grub.extraEntries = ''
+		menuentry "Windows" {
+		  chainloader (hd0,2)+1
+		}
+	'';
 	boot.loader.efi.canTouchEfiVariables = true;
 	networking.interfaces.enp4s0.useDHCP = true;
 }

hosts/jude/default.nix

@@ -9,5 +9,6 @@
 		./virt.nix
 	];
 	networking.hostName = "jude";
+	greg.tailscale.enable = true;
 	greg.gnome.enable= true;
 }

hosts/linode/default.nix

@@ -10,6 +10,7 @@
 	];
 	greg.home = false;
 	greg.linode.enable = true;
+	greg.tailscale.enable = true;
 	networking.hostName = "linode";
 	networking.domain = "thehellings.com";
 }

hosts/linode/nextcloud.nix

@@ -30,8 +30,4 @@
 		enable = true;
 		devices = [ "nas" ];
 	};
-
-	services.cron.systemCronJobs = [
-		"59 2 * * * root chmod -R a+r ${config.services.syncthing.folders.nextcloud-backup.path} && find ${config.services.syncthing.folders.nextcloud-backup.path} -type d -exec chmod a+x '{}' \\;"
-	];
 }

hosts/linode/nginx.nix

@@ -5,7 +5,7 @@ in
 {
 	security.acme = {
 		acceptTerms = true;
-		email = "greg.hellings@gmail.com";
+		defaults.email = "greg.hellings@gmail.com";
 	};
 
 	services.nginx = {
@@ -30,5 +30,6 @@ in
 	greg.proxies."thehellings.com" = {
 		target = "http://${homepage}/";
 		ssl = true;
+		genAliases = false;
 	};
 }

hosts/linode/postgres.nix

@@ -27,14 +27,20 @@ root root postgres
 '';
 	};
 
-	services.postgresqlBackup.enable = true;
+	services.postgresqlBackup = {
+		enable = true;
+		databases = [
+			"nextcloud"
+			"matrix-synapse"
+		];
+	};
 
 	services.logrotate = {
 		enable = true;
-		paths = {
+		settings = {
 			postgres = {
 				enable = true;
-				path = "${config.services.postgresqlBackup.location}/*.gz";
+				files = "${config.services.postgresqlBackup.location}/*.gz";
 			};
 		};
 	};
@@ -44,8 +50,4 @@ root root postgres
 		enable = true;
 		devices = [ "nas" ];
 	};
-
-	services.cron.systemCronJobs = [
-		"59 2 * * * root chmod -R a+r ${config.services.postgresqlBackup.location} && find ${config.services.postgresqlBackup.location} -type d -exec chmod a+x '{}' \\;"
-	];
 }

hosts/linode/synapse.nix

@@ -74,16 +74,19 @@ return 200 '${builtins.toJSON client}';
 
 	services.matrix-synapse = {
 		enable = true;
-		database_name = "synapse";
-		database_user = "matrix-synapse";
 		# Identify ourselves as the root of our own domain
+		settings = {
+			database.args = {
+				user = "matrix-synapse";
+				database = "synapse";
+			};
 			server_name = "thehellings.com";
 			#registration_shared_secret = "B9EoPr2WV9hzwc7uL2Sx1JmvCeKDEOGCpB0uginQcQtEH4wzRtkSIdo7lltrjSQa";
 			# Bind a single listener to localhost only, disable SSL/TLS, and put
 			# it behind an nginx proxy
 			listeners = [ {
 				port = 8448;
-			bind_address = "127.0.0.1";
+				bind_addresses = ["127.0.0.1"];
 				type = "http";  # Offload SSL/TLS to Nginx
 				tls = false;
 				resources = [ {
@@ -95,6 +98,7 @@ return 200 '${builtins.toJSON client}';
 				"/etc/${fbRegistrationFile}"
 			];
 		};
+	};
 
 	# Open networking ports for the server
 	networking.firewall = {

modules/default.nix

@@ -7,6 +7,7 @@
 		./linode.nix
 		./proxy.nix
 		./rpi4.nix
+		./tailscale.nix
 		./xprograms.nix
 	];
 }

modules/proxy.nix

@@ -16,7 +16,7 @@ proxy_set_header Upgrade $http_upgrade;
 proxy_set_header Connection $connection_upgrade;
 '';
 		};
-		serverAliases = [ "${alias name}" ];
+		serverAliases = lib.mkIf dest.genAliases [ "${alias name}" ];
 	};
 
 in with lib; {
@@ -40,6 +40,12 @@ in with lib; {
 				{ name, config, options, ... }:
 				{
 					options = {
+						genAliases = mkOption {
+							type = types.bool;
+							description = "Whether to auto-generate short alias name";
+							default = true;
+						};
+
 						target = mkOption {
 							type = types.str;
 							description = ''The destination that is being proxied.'';

modules/tailscale.nix

@@ -0,0 +1,14 @@
+{ lib, config, ... }:
+
+let
+	cfg = config.greg.tailscale;
+in {
+	options = {
+		greg.tailscale.enable = lib.mkEnableOption "Enable Tailscale";
+	};
+
+	config = lib.mkIf cfg.enable {
+		services.tailscale.enable = true;
+		networking.firewall.checkReversePath = "loose";
+	};
+}

overlays/default.nix

@@ -8,4 +8,8 @@ self: super:
 	xonsh = super.xonsh.overridePythonAttrs (old: rec{
 		propagatedBuildInputs = old.propagatedBuildInputs ++ [ self.xonsh-direnv ];
 	});
+
+	hms = super.callPackage ./hms.nix {
+		pkgs = self.pkgs;
+	};
 }

overlays/hms.nix

@@ -0,0 +1,20 @@
+{ pkgs, ... }:
+
+pkgs.writeShellScriptBin "hms" ''
+set -eo pipefail
+# Build different targets with GUI or not
+if [ -z "$DISPLAY" ]; then
+	target="nogui"
+else
+	target="gui"
+fi
+
+# Build and switch
+echo "Building $(uname -m)-$target"
+dest=$(mktemp -d)
+pushd "$dest" > /dev/null
+nix build --impure /etc/nixos#homeConfigurations.$(uname -m)-$target.activationPackage
+./result/activate
+popd > /dev/null
+rm -r "$dest"
+''

overlays/xonsh-direnv.nix

@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
 	pname = "xonsh-direnv";
-	version = "1.5.0";
+	version = "1.6.1";
 
 	src = fetchPypi {
 		inherit pname version;
-		sha256 = "OLjtGD2lX4Yf3aHrxCWmAbSPZnf8OuVrBu0VFbsna1Y=";
+		sha256 = "Nt8Da1EtMVWZ9mbBDjys7HDutLYifwoQ1HVmI5CN2Ww=";
 	};
 
 	meta = with lib; {

profiles/base/default.nix

@@ -27,6 +27,13 @@
 		];
 	};
 
+	users.users.test = {
+		isNormalUser = true;
+		createHome = true;
+		extraGroups = [ ];
+		shell = pkgs.xonsh;
+	};
+
 	i18n.defaultLocale = "en_US.UTF-8";
 
 	console = {

profiles/base/programs.nix

@@ -10,10 +10,12 @@ in {
 	# Base packages that need to be in all my hosts
 	environment.systemPackages = with pkgs; [
 		agenix.defaultPackage."${system}"
+		bitwarden-cli
 		diffutils
 		git
 		gnupatch
 		findutils
+		hms # My own home manager switcher
 		home-manager
 		htop
 		myPython

profiles/base/syncthing.nix

@@ -10,9 +10,9 @@ in
 {
 	services.syncthing = {
 		enable = true;
-		user = "greg";
+		user = "root";
-		group = "users";
+		group = "root";
-		dataDir = "/home/greg/sync";
+		dataDir = "/root/sync";
 		devices = {
 			nas = {
 				addresses = [
@@ -32,14 +32,7 @@ in
 				addresses = [
 					"tcp://linode.thehellings.com:22000"
 				];
-				id = "3PHWAI5-ILAWGGD-S5FC5QM-M2WQ2FX-PZ3IXQF-QVRKANG-WXAACJC-2MZN3Q5";
+				id = "ROZPUG5-G4IAXYA-JNRQXRD-5PFU2BQ-WVJTOGZ-DFMGJ5E-Q4IGXCJ-JHSNDQ6";
-			};
-		};
-		folders = {
-			"mkrvy-tc6x9" = {
-				enable = true;
-				path = "/home/greg/drive";
-				devices = syncs;
 			};
 		};
 	};