greg/nixos
1
0
Fork 1
Code Issues Pull Requests 2 Actions Packages Projects Releases Wiki Activity

Completely reformat to satisfy nixfmt

Browse Source
This commit is contained in:
Greg Hellings
2024-10-19 01:20:46 -05:00
parent 7abb613f20
commit a71eb7485a
56 changed files with 1749 additions and 1393 deletions
Download Patch File Download Diff File Expand all files Collapse all files
hosts/exodus/hardware-configuration.nix
+23 -17
View File
@@ -1,31 +1,37 @@
# Do not modify this file! It was generated by ‘nixos-generate-config’
# and may be overwritten by future invocations. Please make changes
# to /etc/nixos/configuration.nix instead.
{ config, lib, modulesPath, ... }:
{
config,
lib,
modulesPath,
...
}:
{
imports =
[
(modulesPath + "/installer/scan/not-detected.nix")
];
imports = [ (modulesPath + "/installer/scan/not-detected.nix") ];
boot.initrd.availableKernelModules = [ "xhci_pci" "thunderbolt" "nvme" "uas" "sd_mod" ];
boot.initrd.availableKernelModules = [
"xhci_pci"
"thunderbolt"
"nvme"
"uas"
"sd_mod"
];
boot.initrd.kernelModules = [ ];
boot.kernelModules = [ "kvm-intel" ];
boot.extraModulePackages = [ ];
fileSystems."/" =
{
device = "/dev/disk/by-uuid/607b933f-2967-4652-b478-4d8e9aa38a0d";
fsType = "btrfs";
options = [ "subvol=@" ];
};
fileSystems."/" = {
device = "/dev/disk/by-uuid/607b933f-2967-4652-b478-4d8e9aa38a0d";
fsType = "btrfs";
options = [ "subvol=@" ];
};
fileSystems."/boot" =
{
device = "/dev/disk/by-uuid/B31C-C1F4";
fsType = "vfat";
};
fileSystems."/boot" = {
device = "/dev/disk/by-uuid/B31C-C1F4";
fsType = "vfat";
};
swapDevices = [ ];
hosts/genesis/acme.nix
+29 -17
View File
@@ -1,9 +1,16 @@
{ pkgs, config, lib, ... }:
{
pkgs,
config,
lib,
...
}:
let
address = (builtins.elemAt config.networking.interfaces.ens18.ipv4.addresses 0).address;
root_ca = pkgs.writeText "root_ca.crt" (builtins.readFile ../../ca/root_ca.crt);
intermediate_ca = pkgs.writeText "intermediate_ca.crt" (builtins.readFile ../../ca/intermediate_ca.crt);
intermediate_ca = pkgs.writeText "intermediate_ca.crt" (
builtins.readFile ../../ca/intermediate_ca.crt
);
in
{
age.secrets.acme_password = {
@@ -13,7 +20,10 @@ in
file = ../../secrets/ca/intermediate_key.age;
};
age.secrets.root_ca_key.file = ../../secrets/ca/root_key.age;
systemd.services.step-ca.serviceConfig.Environment = lib.mkForce [ "STEPDEBUG=1" "HOME=%S/step-ca" ];
systemd.services.step-ca.serviceConfig.Environment = lib.mkForce [
"STEPDEBUG=1"
"HOME=%S/step-ca"
];
services.step-ca = {
inherit address;
enable = false;
@@ -35,20 +45,22 @@ in
dataSource = "/var/lib/step-ca/db";
badgerFileLoadingMode = "";
};
authority.provisioners = [{
type = "JWK";
name = "greg@thehellings.com";
key = {
use = "sig";
kty = "EC";
kid = "1GOpOttYLZtx7XiG79ZycbGcG4ptL0czfohK35SZOEI";
crv = "P-256";
alg = "ES256";
x = "YEWVj5CCoqWQXWqmL0UuORlFY9IEOLcg1jpG1o-wGx4";
y = "MEpqnJp60VV-SpFtb6m8U-VAYut7R_PKFm07xl7MjBk";
};
encryptedKey = "eyJhbGciOiJQQkVTMi1IUzI1NitBMTI4S1ciLCJjdHkiOiJqd2sranNvbiIsImVuYyI6IkEyNTZHQ00iLCJwMmMiOjYwMDAwMCwicDJzIjoieWdfb0lfbWgwbHhPRXdjUTBsd0FnUSJ9.ivdQUFEhs2U8PUBYr8AhQl3hHdb4spF4jvXgqY_hiVgpjB-z3Nn9Uw.u7vrNht_3WD1G97q.mbydlpAQxjtKLkOmmDOUczqscRDPqrUyoPJ1uqXcJDH3vs4KiYlrKRcFLjPy9sWzEL1iIrqjwf3U-3AAx1KNAg7frs2D__MGfOO-U5SdQDVJVAND7KpWOJGJVSb0xioCA6-8ldlP_REqu4ENmkkdw0_6Is2b0p7ZFKqke_fqOOs7osqFAfbMb_WzEWrACLn5A5-Teh2rpEgR-z9zipN6MSEqE6VIQ2BXuv70aHWhslNe1MK1OgTYm9CqA47EMYvQ7HQLPDZAbP56WK84yJLktoXMmnkaKeTtvER0dh4ufyjJHBhecnEranbR5rHc_jV8_qvyWhlqbCrOU_8bWrk.a9SH_q3GKIUsOUSRWkDxQg";
}];
authority.provisioners = [
{
type = "JWK";
name = "greg@thehellings.com";
key = {
use = "sig";
kty = "EC";
kid = "1GOpOttYLZtx7XiG79ZycbGcG4ptL0czfohK35SZOEI";
crv = "P-256";
alg = "ES256";
x = "YEWVj5CCoqWQXWqmL0UuORlFY9IEOLcg1jpG1o-wGx4";
y = "MEpqnJp60VV-SpFtb6m8U-VAYut7R_PKFm07xl7MjBk";
};
encryptedKey = "eyJhbGciOiJQQkVTMi1IUzI1NitBMTI4S1ciLCJjdHkiOiJqd2sranNvbiIsImVuYyI6IkEyNTZHQ00iLCJwMmMiOjYwMDAwMCwicDJzIjoieWdfb0lfbWgwbHhPRXdjUTBsd0FnUSJ9.ivdQUFEhs2U8PUBYr8AhQl3hHdb4spF4jvXgqY_hiVgpjB-z3Nn9Uw.u7vrNht_3WD1G97q.mbydlpAQxjtKLkOmmDOUczqscRDPqrUyoPJ1uqXcJDH3vs4KiYlrKRcFLjPy9sWzEL1iIrqjwf3U-3AAx1KNAg7frs2D__MGfOO-U5SdQDVJVAND7KpWOJGJVSb0xioCA6-8ldlP_REqu4ENmkkdw0_6Is2b0p7ZFKqke_fqOOs7osqFAfbMb_WzEWrACLn5A5-Teh2rpEgR-z9zipN6MSEqE6VIQ2BXuv70aHWhslNe1MK1OgTYm9CqA47EMYvQ7HQLPDZAbP56WK84yJLktoXMmnkaKeTtvER0dh4ufyjJHBhecnEranbR5rHc_jV8_qvyWhlqbCrOU_8bWrk.a9SH_q3GKIUsOUSRWkDxQg";
}
];
tls = {
cipherSuites = [
"TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256"
hosts/genesis/hardware-configuration.nix
+13 -12
View File
@@ -4,24 +4,25 @@
{ lib, modulesPath, ... }:
{
imports =
[
(modulesPath + "/profiles/qemu-guest.nix")
];
imports = [ (modulesPath + "/profiles/qemu-guest.nix") ];
boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "sr_mod" "virtio_blk" ];
boot.initrd.availableKernelModules = [
"ata_piix"
"uhci_hcd"
"virtio_pci"
"sr_mod"
"virtio_blk"
];
boot.initrd.kernelModules = [ ];
boot.kernelModules = [ ];
boot.extraModulePackages = [ ];
fileSystems."/" =
{
device = "/dev/disk/by-uuid/a13f941e-4985-47ab-a8c6-374a627c5ce1";
fsType = "ext4";
};
fileSystems."/" = {
device = "/dev/disk/by-uuid/a13f941e-4985-47ab-a8c6-374a627c5ce1";
fsType = "ext4";
};
swapDevices =
[{ device = "/dev/disk/by-uuid/ac4557de-1ad5-4d3c-b9f4-5ec50dbf76f1"; }];
swapDevices = [ { device = "/dev/disk/by-uuid/ac4557de-1ad5-4d3c-b9f4-5ec50dbf76f1"; } ];
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
# (the default) this is the recommended approach. When using systemd-networkd it's
hosts/genesis/home-assistant.nix
+22 -12
View File
@@ -26,16 +26,17 @@
"wyoming"
"zwave_js"
];
customComponents = with pkgs.home-assistant-custom-components; [
smartthinq-sensors
];
customComponents = with pkgs.home-assistant-custom-components; [ smartthinq-sensors ];
config = {
default_config = { };
tts = [{ platform = "google_translate"; }];
tts = [ { platform = "google_translate"; } ];
http = {
use_x_forwarded_for = true;
trusted_proxies = [ "127.0.0.1" "::1" ];
trusted_proxies = [
"127.0.0.1"
"::1"
];
server_host = "127.0.0.1";
};
#"automation manual" = *nix config here* and so on
@@ -75,7 +76,10 @@
containers.zwave = {
autoStart = false; # We will try to start it with udev.extraRules listed below, as this option starts it too quickly
image = "zwavejs/zwave-js-ui:latest";
ports = [ "8091:8091" "3000:3000" ];
ports = [
"8091:8091"
"3000:3000"
];
volumes = [ "/var/lib/zwave:/usr/src/app/store" ];
extraOptions = [
"--device"
@@ -93,8 +97,12 @@
# the container. So we add the creation of /var/lib/{zwave,hass} to the systemd Unit files
systemd.services = {
"podman-zwave" = {
after = [ "sys-devices-pci0000:00-0000:00:1e.0-0000:02:1b.0-usb2-2\\x2d1-2\\x2d1:1.0-tty-ttyACM0.device" ];
wantedBy = [ "sys-devices-pci0000:00-0000:00:1e.0-0000:02:1b.0-usb2-2\\x2d1-2\\x2d1:1.0-tty-ttyACM0.device" ];
after = [
"sys-devices-pci0000:00-0000:00:1e.0-0000:02:1b.0-usb2-2\\x2d1-2\\x2d1:1.0-tty-ttyACM0.device"
];
wantedBy = [
"sys-devices-pci0000:00-0000:00:1e.0-0000:02:1b.0-usb2-2\\x2d1-2\\x2d1:1.0-tty-ttyACM0.device"
];
serviceConfig = {
StateDirectory = "zwave";
StateDirectoryMode = pkgs.lib.mkForce "0777";
@@ -103,9 +111,8 @@
};
services.udev.extraRules = ''
SUBSYSTEM=="tty", KERNEL=="ttyACM0", TAG+="systemd"
'';
SUBSYSTEM=="tty", KERNEL=="ttyACM0", TAG+="systemd"
'';
greg.proxies = {
"smart.home".target = "http://127.0.0.1:8123/";
@@ -116,7 +123,10 @@
# Ensure that both ports are up and running. We keep 8123 directly open because we are on the LAN and sometimes want to connect
# directly for troubleshooting Nginx configuration
networking.firewall = {
allowedTCPPorts = [ 80 443 ];
allowedTCPPorts = [
80
443
];
};
greg.backup.jobs.zwave = {
hosts/genesis/networking.nix
+27 -21
View File
@@ -37,18 +37,22 @@ in
# This is our LAN port
"${lan}" = {
useDHCP = false;
ipv4.addresses = [{
address = "${lanIP}";
prefixLength = 16;
}];
ipv4.addresses = [
{
address = "${lanIP}";
prefixLength = 16;
}
];
};
"${iot}" = {
useDHCP = false;
ipv4.addresses = [{
address = "${iotIP}";
prefixLength = 24;
}];
ipv4.addresses = [
{
address = "${iotIP}";
prefixLength = 24;
}
];
};
};
firewall = {
@@ -90,15 +94,19 @@ in
########
_3proxy = {
enable = true;
services = [{
type = "socks";
auth = [ "strong" ];
bindPort = proxyPort;
acl = [{
rule = "allow";
users = [ "greg" ];
}];
}];
services = [
{
type = "socks";
auth = [ "strong" ];
bindPort = proxyPort;
acl = [
{
rule = "allow";
users = [ "greg" ];
}
];
}
];
#usersFile = "/run/agenix/3proxy";
denyPrivate = false;
};
@@ -140,7 +148,7 @@ in
"4c:a1:61:05:cd:52,192.168.66.61" # Rainbird
"48:d6:d5:5d:81:21,192.168.66.65" # Google Home
"6c:29:90:3e:e2:02,192.168.66.66" # wiz
"28:87:ba:0e:ca:da,192.168.66.74" #
"28:87:ba:0e:ca:da,192.168.66.74"
"28:87:ba:0e:c9:fd,192.168.66.75" # Master closet
"54:af:97:c2:0f:a1,192.168.66.76" # Master toilet
"54:af:97:83:ed:33,192.168.66.80"
@@ -174,9 +182,7 @@ in
# Update adblock list
cron = {
enable = true;
systemCronJobs = [
"* * * * * root ${adblockUpdate} 2>&1 > /var/log/adblock.log"
];
systemCronJobs = [ "* * * * * root ${adblockUpdate} 2>&1 > /var/log/adblock.log" ];
};
}; # End of services configuration
hosts/hosea/bitcoin.nix
+2 -5
View File
@@ -41,9 +41,7 @@ in
listen = true;
rpc = {
address = ip;
allowip = [
"100.1.1.1/8"
];
allowip = [ "100.1.1.1/8" ];
};
};
clightning = {
@@ -74,6 +72,5 @@ in
};
};
environment.systemPackages = with pkgs; [
];
environment.systemPackages = with pkgs; [ ];
}
hosts/hosea/hardware-configuration.nix
+24 -17
View File
@@ -1,31 +1,38 @@
# Do not modify this file! It was generated by ‘nixos-generate-config’
# and may be overwritten by future invocations. Please make changes
# to /etc/nixos/configuration.nix instead.
{ config, lib, modulesPath, ... }:
{
config,
lib,
modulesPath,
...
}:
{
imports =
[
(modulesPath + "/installer/scan/not-detected.nix")
];
imports = [ (modulesPath + "/installer/scan/not-detected.nix") ];
boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "nvme" "usbhid" "uas" "sd_mod" ];
boot.initrd.availableKernelModules = [
"xhci_pci"
"ahci"
"nvme"
"usbhid"
"uas"
"sd_mod"
];
boot.initrd.kernelModules = [ ];
boot.kernelModules = [ "kvm-intel" ];
boot.extraModulePackages = [ ];
fileSystems."/" =
{
device = "/dev/disk/by-uuid/d4ac74f7-62bb-421a-aad8-566277c9d8ba";
fsType = "btrfs";
options = [ "subvol=@" ];
};
fileSystems."/" = {
device = "/dev/disk/by-uuid/d4ac74f7-62bb-421a-aad8-566277c9d8ba";
fsType = "btrfs";
options = [ "subvol=@" ];
};
fileSystems."/boot" =
{
device = "/dev/disk/by-uuid/1F51-B638";
fsType = "vfat";
};
fileSystems."/boot" = {
device = "/dev/disk/by-uuid/1F51-B638";
fsType = "vfat";
};
fileSystems."/chain" = {
device = "/dev/sda1";
hosts/icdm-root/default.nix
+4 -1
View File
@@ -19,7 +19,10 @@
users.users.greg = {
isNormalUser = true;
description = "Gregory Hellings";
extraGroups = [ "networkmanager" "wheel" ];
extraGroups = [
"networkmanager"
"wheel"
];
packages = with pkgs; [ ];
};
}
hosts/icdm-root/filesystem.nix
+2 -1
View File
@@ -1,7 +1,8 @@
{ ... }:
let
in {
in
{
fileSystems."serve" = {
#device = "10.42.1.4:/volume1/icdm-mysql/";
#fsType = "nfs";
hosts/icdm-root/hardware-configuration.nix
+29 -24
View File
@@ -1,40 +1,45 @@
# Do not modify this file! It was generated by ‘nixos-generate-config’
# and may be overwritten by future invocations. Please make changes
# to /etc/nixos/configuration.nix instead.
{ config, lib, modulesPath, ... }:
{
config,
lib,
modulesPath,
...
}:
{
imports =
[
(modulesPath + "/installer/scan/not-detected.nix")
];
imports = [ (modulesPath + "/installer/scan/not-detected.nix") ];
boot.initrd.availableKernelModules = [ "xhci_pci" "ehci_pci" "ahci" "usbhid" "usb_storage" "sd_mod" ];
boot.initrd.availableKernelModules = [
"xhci_pci"
"ehci_pci"
"ahci"
"usbhid"
"usb_storage"
"sd_mod"
];
boot.initrd.kernelModules = [ ];
boot.kernelModules = [ "kvm-intel" ];
boot.extraModulePackages = [ ];
fileSystems."/" =
{
device = "/dev/disk/by-uuid/dab0d455-e25e-4445-8fa4-5320047d7e7b";
fsType = "btrfs";
options = [ "subvol=@" ];
};
fileSystems."/" = {
device = "/dev/disk/by-uuid/dab0d455-e25e-4445-8fa4-5320047d7e7b";
fsType = "btrfs";
options = [ "subvol=@" ];
};
fileSystems."/boot" =
{
device = "/dev/disk/by-uuid/5aedbb07-5761-423b-909d-2560405eae32";
fsType = "ext4";
};
fileSystems."/boot" = {
device = "/dev/disk/by-uuid/5aedbb07-5761-423b-909d-2560405eae32";
fsType = "ext4";
};
fileSystems."/var" =
{
device = "/dev/disk/by-uuid/57968536-c29d-417d-997e-85223d1d1f65";
fsType = "btrfs";
};
fileSystems."/var" = {
device = "/dev/disk/by-uuid/57968536-c29d-417d-997e-85223d1d1f65";
fsType = "btrfs";
};
swapDevices =
[{ device = "/dev/disk/by-uuid/09691dce-375a-43c6-8d40-4498d20a6d9a"; }];
swapDevices = [ { device = "/dev/disk/by-uuid/09691dce-375a-43c6-8d40-4498d20a6d9a"; } ];
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
# (the default) this is the recommended approach. When using systemd-networkd it's
hosts/icdm-root/networking.nix
+17 -13
View File
@@ -1,8 +1,6 @@
{ ... }:
let
dnsHosts = builtins.concatStringsSep "\n" [
"wiki.icdm.lan 10.42.101.1"
];
dnsHosts = builtins.concatStringsSep "\n" [ "wiki.icdm.lan 10.42.101.1" ];
in
{
# If we have to do proxying in Bayonnais, we can start to work on that here
@@ -11,24 +9,32 @@ in
hostName = "icdm-root";
useDHCP = false;
defaultGateway = "10.42.1.1";
nameservers = [ "100.100.100.100" "10.42.1.2" ];
nameservers = [
"100.100.100.100"
"10.42.1.2"
];
enableIPv6 = false;
interfaces = {
eno1.ipv4.addresses = [{
address = "10.42.101.1";
prefixLength = 16;
}
eno1.ipv4.addresses = [
{
address = "10.42.101.1";
prefixLength = 16;
}
{
address = "10.77.1.2";
prefixLength = 16;
}];
}
];
};
# Allow traffic through
firewall = {
enable = true;
allowedTCPPorts = [ 53 ];
allowedUDPPorts = [ 53 67 ];
allowedUDPPorts = [
53
67
];
};
extraHosts = "${dnsHosts}";
@@ -38,9 +44,7 @@ in
enable = true;
settings = {
domain = "icdm.lan";
dhcp-range = [
"eno1,10.77.1.10,10.77.1.255,255.255.0.0,12h"
];
dhcp-range = [ "eno1,10.77.1.10,10.77.1.255,255.255.0.0,12h" ];
dhcp-option = [
"eno1,option:router,10.77.1.1"
"eno1,option:dns-server,10.77.1.2,1.1.1.1"
hosts/iso/default.nix
+7 -4
View File
@@ -1,4 +1,9 @@
{ pkgs, lib, modulesPath, ... }:
{
pkgs,
lib,
modulesPath,
...
}:
{
imports = [
@@ -9,7 +14,5 @@
networking.networkmanager.enable = lib.mkForce false;
users.users.greg.initialPassword = "";
#services.getty.autologinUser = lib.mkForce "greg";
environment.systemPackages = with pkgs; [
tree
];
environment.systemPackages = with pkgs; [ tree ];
}
hosts/jeremiah/default.nix
+26 -20
View File
@@ -2,16 +2,20 @@
# your system. Help is available in the configuration.nix(5) man page
# and in the NixOS manual (accessible by running ‘nixos-help’).
{ config, pkgs, lib, ... }:
{
config,
pkgs,
lib,
...
}:
{
imports =
[
# Include the results of the hardware scan.
./ceph.nix
./hardware-configuration.nix
./minio.nix
];
imports = [
# Include the results of the hardware scan.
./ceph.nix
./hardware-configuration.nix
./minio.nix
];
# Bootloader.
boot.loader.systemd-boot.enable = true;
@@ -32,25 +36,27 @@
};
interfaces = {
enp68s0 = {
ipv4.addresses = [{
address = "10.42.1.8";
prefixLength = 16;
}
ipv4.addresses = [
{
address = "10.42.1.8";
prefixLength = 16;
}
{
address = "10.42.100.1";
prefixLength = 16;
}];
}
];
};
san = {
ipv4.addresses = [{
address = "10.201.1.2";
prefixLength = 24;
}];
ipv4.addresses = [
{
address = "10.201.1.2";
prefixLength = 24;
}
];
};
};
nameservers = [
"10.42.1.5"
];
nameservers = [ "10.42.1.5" ];
};
greg = {
home = true;
hosts/jeremiah/hardware-configuration.nix
+23 -16
View File
@@ -1,30 +1,37 @@
# Do not modify this file! It was generated by ‘nixos-generate-config’
# and may be overwritten by future invocations. Please make changes
# to /etc/nixos/configuration.nix instead.
{ config, lib, modulesPath, ... }:
{
config,
lib,
modulesPath,
...
}:
{
imports =
[
(modulesPath + "/installer/scan/not-detected.nix")
];
imports = [ (modulesPath + "/installer/scan/not-detected.nix") ];
boot.initrd.availableKernelModules = [ "nvme" "xhci_pci" "ahci" "uas" "usbhid" "sd_mod" ];
boot.initrd.availableKernelModules = [
"nvme"
"xhci_pci"
"ahci"
"uas"
"usbhid"
"sd_mod"
];
boot.initrd.kernelModules = [ ];
boot.kernelModules = [ "kvm-amd" ];
boot.extraModulePackages = [ ];
fileSystems."/" =
{
device = "/dev/disk/by-uuid/ffc167f5-d9e4-4b11-a5f1-f7da0550ad24";
fsType = "ext4";
};
fileSystems."/" = {
device = "/dev/disk/by-uuid/ffc167f5-d9e4-4b11-a5f1-f7da0550ad24";
fsType = "ext4";
};
fileSystems."/boot" =
{
device = "/dev/disk/by-uuid/3047-870E";
fsType = "vfat";
};
fileSystems."/boot" = {
device = "/dev/disk/by-uuid/3047-870E";
fsType = "vfat";
};
swapDevices = [ ];
hosts/jude/boot.nix
+25 -20
View File
@@ -12,23 +12,28 @@
enable = true;
configurationLimit = 20;
extraEntries = {
"Windows.conf" = (lib.strings.concatStringsSep "\n" [
"title Windows"
"efi /EFI/Microsoft/EFI/bootmgfw.efi"
]);
"Win2.conf" = (lib.strings.concatStringsSep "\n" [
"title Windows 11"
"efi /shellx64.efi"
"options -nointerrupt -noconsolein -noconsoleout windows11.nsh"
]);
"Shell.conf" = (lib.strings.concatStringsSep "\n" [
"title EFI Shell"
"efi /shell.efi"
]);
"Windows.conf" = (
lib.strings.concatStringsSep "\n" [
"title Windows"
"efi /EFI/Microsoft/EFI/bootmgfw.efi"
]
);
"Win2.conf" = (
lib.strings.concatStringsSep "\n" [
"title Windows 11"
"efi /shellx64.efi"
"options -nointerrupt -noconsolein -noconsoleout windows11.nsh"
]
);
"Shell.conf" = (
lib.strings.concatStringsSep "\n" [
"title EFI Shell"
"efi /shell.efi"
]
);
};
extraFiles = {
"windows11.nsh" = (pkgs.writeText "windows11.nsh" (lib.strings.concatStringsSep "\n" [
]));
"windows11.nsh" = (pkgs.writeText "windows11.nsh" (lib.strings.concatStringsSep "\n" [ ]));
"shell.efi" = "${pkgs.edk2-uefi-shell}/shell.efi";
};
};
@@ -38,11 +43,11 @@
useOSProber = true;
efiSupport = true;
extraEntries = ''
menuentry "Windows" --class windows --class os {
insmod ntfs
chainloader (hd0,0)/EFI/Windows/bootmgfw.efi
}
'';
menuentry "Windows" --class windows --class os {
insmod ntfs
chainloader (hd0,0)/EFI/Windows/bootmgfw.efi
}
'';
};
#efi.canTouchEfiVariables = true;
};
hosts/jude/default.nix
+47 -42
View File
@@ -25,7 +25,10 @@
firewall = {
enable = false;
allowedTCPPorts = [ 21000 ];
allowedUDPPorts = [ 21000 21010 ];
allowedUDPPorts = [
21000
21010
];
};
};
greg = {
@@ -38,48 +41,50 @@
boot.extraModulePackages = [ config.boot.kernelPackages.v4l2loopback ];
environment.systemPackages = with pkgs; lib.mkMerge [
[
# for Immersed
cudatoolkit
immersed-vr
libva
]
[
bind # For things like nslookup
create_ssl
distrobox
expect
gimp
go
gparted
gnucash
graphviz
flock
ffmpeg
handbrake
imagemagick
libtheora
libxml2
linode-cli
makemkv
oathToolkit
usbutils
vagrant
ventoy
]
environment.systemPackages =
with pkgs;
lib.mkMerge [
[
# for Immersed
cudatoolkit
immersed-vr
libva
]
[
bind # For things like nslookup
create_ssl
distrobox
expect
gimp
go
gparted
gnucash
graphviz
flock
ffmpeg
handbrake
imagemagick
libtheora
libxml2
linode-cli
makemkv
oathToolkit
usbutils
vagrant
ventoy
]
[
# Video/Audio data composition framework tools like "gst-inspect", "gst-launch" ...
gst_all_1.gstreamer
gst_all_1.gst-plugins-base
gst_all_1.gst-plugins-good
gst_all_1.gst-plugins-bad
gst_all_1.gst-plugins-ugly
gst_all_1.gst-libav
gst_all_1.gst-vaapi
]
];
[
# Video/Audio data composition framework tools like "gst-inspect", "gst-launch" ...
gst_all_1.gstreamer
gst_all_1.gst-plugins-base
gst_all_1.gst-plugins-good
gst_all_1.gst-plugins-bad
gst_all_1.gst-plugins-ugly
gst_all_1.gst-libav
gst_all_1.gst-vaapi
]
];
fileSystems = {
"/boot" = {
device = "/dev/nvme0n1p1";
hosts/jude/hardware-configuration.nix
+20 -12
View File
@@ -1,25 +1,33 @@
# Do not modify this file! It was generated by ‘nixos-generate-config’
# and may be overwritten by future invocations. Please make changes
# to /etc/nixos/configuration.nix instead.
{ config, lib, modulesPath, ... }:
{
config,
lib,
modulesPath,
...
}:
{
imports =
[
(modulesPath + "/installer/scan/not-detected.nix")
];
imports = [ (modulesPath + "/installer/scan/not-detected.nix") ];
boot.initrd.availableKernelModules = [ "nvme" "xhci_pci" "ahci" "usbhid" "usb_storage" "sd_mod" ];
boot.initrd.availableKernelModules = [
"nvme"
"xhci_pci"
"ahci"
"usbhid"
"usb_storage"
"sd_mod"
];
boot.initrd.kernelModules = [ ];
boot.kernelModules = [ "kvm-amd" ];
boot.extraModulePackages = [ ];
fileSystems."/" =
{
#device = "/dev/disk/by-uuid/27ae91ed-32e9-411e-8227-0d99e360fbbf";
device = "/dev/nvme0n1p4";
fsType = "btrfs";
};
fileSystems."/" = {
#device = "/dev/disk/by-uuid/27ae91ed-32e9-411e-8227-0d99e360fbbf";
device = "/dev/nvme0n1p4";
fsType = "btrfs";
};
swapDevices = [ ];
hosts/linode/default.nix
+21 -14
View File
@@ -1,4 +1,9 @@
{ pkgs, lib, config, ... }:
{
pkgs,
lib,
config,
...
}:
{
imports = [
@@ -29,9 +34,7 @@
networkmanager.enable = lib.mkForce false;
hostName = "linode";
domain = "thehellings.com";
nameservers = [
"100.88.91.27"
];
nameservers = [ "100.88.91.27" ];
};
age.secrets.runner-deployer = {
@@ -58,17 +61,21 @@
User = "gitlab-runner";
};
security.sudo.extraRules = [{
users = [ "gitlab-runner" ];
commands = [{
command = "/run/current-system/sw/bin/systemctl";
options = [ "NOPASSWD" ];
security.sudo.extraRules = [
{
users = [ "gitlab-runner" ];
commands = [
{
command = "/run/current-system/sw/bin/systemctl";
options = [ "NOPASSWD" ];
}
{
command = "/run/current-system/sw/bin/podman";
options = [ "NOPASSWD" ];
}
];
}
{
command = "/run/current-system/sw/bin/podman";
options = [ "NOPASSWD" ];
}];
}];
];
environment.systemPackages = with pkgs; [
bind
hosts/linode/git.nix
+3 -3
View File
@@ -10,9 +10,9 @@ in
ssl = true;
genAliases = false;
extraConfig = ''
proxy_set_header X-Forwarded-Proto https;
proxy_set_header X-Forwarded-Ssl on;
'';
proxy_set_header X-Forwarded-Proto https;
proxy_set_header X-Forwarded-Ssl on;
'';
};
greg.proxies."registry.thehellings.com" = {
target = "https://registry.thehellings.lan:5000";
hosts/linode/hardware-configuration.nix
+14 -8
View File
@@ -1,14 +1,22 @@
# Do not modify this file! It was generated by "nixos-generate-config"
# and may be overwritten by future invocations. Please make changes
# to /etc/nixos/configuration.nix instead.
{ config, lib, modulesPath, ... }:
{
config,
lib,
modulesPath,
...
}:
{
imports = [
(modulesPath + "/profiles/qemu-guest.nix")
];
imports = [ (modulesPath + "/profiles/qemu-guest.nix") ];
boot.initrd.availableKernelModules = [ "virtio_pci" "virtio_scsi" "ahci" "sd_mod" ];
boot.initrd.availableKernelModules = [
"virtio_pci"
"virtio_scsi"
"ahci"
"sd_mod"
];
boot.initrd.kernelModules = [ ];
boot.kernelModules = [ ];
boot.extraModulePackages = [ ];
@@ -18,9 +26,7 @@
fsType = "ext4";
};
swapDevices = [
{ device = "/dev/sdb"; }
];
swapDevices = [ { device = "/dev/sdb"; } ];
hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
}
hosts/linode/matrix.nix
+13 -4
View File
@@ -19,7 +19,9 @@ in
# the actual application server at matrix.thehellings.com
locations."= /.well-known/matrix/server".extraConfig =
let
server = { "m.server" = "${fqdn}:443"; };
server = {
"m.server" = "${fqdn}:443";
};
in
''
add_header Content-Type application/json;
@@ -29,8 +31,12 @@ in
locations."= /.well-known/matrix/client".extraConfig =
let
client = {
"m.homeserver" = { "base_url" = "https://${fqdn}"; };
"m.identity_server" = { "base_url" = "https://vector.im"; };
"m.homeserver" = {
"base_url" = "https://${fqdn}";
};
"m.identity_server" = {
"base_url" = "https://vector.im";
};
};
in
''
@@ -58,6 +64,9 @@ in
# Open networking ports for the server
networking.firewall = {
enable = true;
allowedTCPPorts = [ 80 443 ];
allowedTCPPorts = [
80
443
];
};
}
hosts/linode/postgres.nix
+9 -13
View File
@@ -1,26 +1,24 @@
{ config, pkgs, ... }:
{
environment.systemPackages = [
pkgs.upgrade-pg-cluster
];
environment.systemPackages = [ pkgs.upgrade-pg-cluster ];
services.postgresql = {
enable = true;
package = pkgs.postgresql_15;
checkConfig = true;
ensureDatabases = [
"nextcloud"
];
ensureDatabases = [ "nextcloud" ];
#initialScript = pkgs.writeText "create-matrix-db.sql" ''
# CREATE ROLE "matrix-synapse" WITH LOGIN;
# CREATE DATABASE "synapse" WITH OWNER "matrix-synapse" TEMPLATE template0 LC_COLLATE = "C" LC_CTYPE = "C";
# GRANT ALL PRIVILEGES ON DATABASE "synapse" TO "matrix-synapse";
#''; # These are done manually in order to set the LC_COLLATE values properly
ensureUsers = [{
name = "nextcloud";
ensureDBOwnership = true;
}];
ensureUsers = [
{
name = "nextcloud";
ensureDBOwnership = true;
}
];
settings = {
log_connections = true;
log_statement = "all";
@@ -34,9 +32,7 @@
services.postgresqlBackup = {
enable = true;
databases = [
"nextcloud"
];
databases = [ "nextcloud" ];
};
services.logrotate = {
hosts/myself/container-git.nix
+59 -32
View File
@@ -1,4 +1,9 @@
{ config, pkgs, lib, ... }:
{
config,
pkgs,
lib,
...
}:
let
registryPort = 5000;
vpnIp = "100.78.226.76";
@@ -8,7 +13,12 @@ in
age.secretsMountPoint = "/run/derp";
age.secrets =
let
cfg = n: { file = ../../secrets/gitlab/${n}.age; owner = "gitlab"; group = "gitlab"; mode = "0444"; };
cfg = n: {
file = ../../secrets/gitlab/${n}.age;
owner = "gitlab";
group = "gitlab";
mode = "0444";
};
in
{
gitlab-secret = cfg "secret";
@@ -32,16 +42,19 @@ in
};
};
networking.firewall.allowedTCPPorts = [ 80 registryPort ];
networking.firewall.allowedTCPPorts = [
80
registryPort
];
greg.proxies =
let
t = {
target = "http://unix:/run/gitlab/gitlab-workhorse.socket";
extraConfig = ''
proxy_set_header X-Forwarded-Proto https;
proxy_set_header X-Forwarded-Ssl on;
'';
proxy_set_header X-Forwarded-Proto https;
proxy_set_header X-Forwarded-Ssl on;
'';
};
in
{
@@ -115,33 +128,45 @@ in
provider = "AWS";
endpoint = "http://s3.thehellings.lan:9000";
region = "us-east-1";
aws_access_key_id = { _secret = config.age.secrets.minio_access_key_id.path; };
aws_secret_access_key = { _secret = config.age.secrets.minio_secret_access_key.path; };
aws_access_key_id = {
_secret = config.age.secrets.minio_access_key_id.path;
};
aws_secret_access_key = {
_secret = config.age.secrets.minio_secret_access_key.path;
};
path_style = true; # True for MinIO
aws_signature_version = 2;
};
#storage_options = ...;
objects = builtins.listToAttrs (builtins.map (x: lib.attrsets.nameValuePair x { bucket = "gitlab-${builtins.replaceStrings [ "_" ] [ "-" ] x}"; }) [
"artifacts"
"ci_secure_files"
"dependency_proxy"
"external_diffs"
"lfs"
"packages"
"pages"
"terraform_state"
"uploads"
]);
objects = builtins.listToAttrs (
builtins.map
(
x: lib.attrsets.nameValuePair x { bucket = "gitlab-${builtins.replaceStrings [ "_" ] [ "-" ] x}"; }
)
[
"artifacts"
"ci_secure_files"
"dependency_proxy"
"external_diffs"
"lfs"
"packages"
"pages"
"terraform_state"
"uploads"
]
);
};
};
};
nginx.virtualHosts."gitlab.shire-zebra.ts.net" = {
listen = [{
addr = vpnIp;
port = registryPort;
ssl = true;
}];
listen = [
{
addr = vpnIp;
port = registryPort;
ssl = true;
}
];
locations."/" = {
proxyPass = "http://127.0.0.1:5000/";
recommendedProxySettings = true;
@@ -156,17 +181,21 @@ in
# Fetch the SSL certificates for nginx to use
cron = {
enable = true;
systemCronJobs = [ "0 0 1 */2 * cd /etc/certs && tailscale cert gitlab.shire-zebra.ts.net && chown nginx * && systemctl reload nginx" ];
systemCronJobs = [
"0 0 1 */2 * cd /etc/certs && tailscale cert gitlab.shire-zebra.ts.net && chown nginx * && systemctl reload nginx"
];
};
postgresql = {
enable = true;
checkConfig = true;
ensureDatabases = [ "gitlab" ];
ensureUsers = [{
name = "gitlab";
ensureDBOwnership = true;
}];
ensureUsers = [
{
name = "gitlab";
ensureDBOwnership = true;
}
];
settings = {
log_connections = true;
log_statement = "all";
@@ -186,9 +215,7 @@ in
# to the 100.* addresses
systemd.services = {
nginx = rec {
after = [
"network-online.target"
];
after = [ "network-online.target" ];
wants = after;
serviceConfig = {
RestartMaxDelaySec = "30s";
hosts/myself/hardware-configuration.nix
+34 -28
View File
@@ -1,44 +1,50 @@
# Do not modify this file! It was generated by ‘nixos-generate-config’
# and may be overwritten by future invocations. Please make changes
# to /etc/nixos/configuration.nix instead.
{ config, lib, modulesPath, ... }:
{
config,
lib,
modulesPath,
...
}:
{
imports =
[
(modulesPath + "/installer/scan/not-detected.nix")
];
imports = [ (modulesPath + "/installer/scan/not-detected.nix") ];
boot.initrd.availableKernelModules = [ "nvme" "xhci_pci" "ahci" "usb_storage" "usbhid" "sd_mod" "sr_mod" ];
boot.initrd.availableKernelModules = [
"nvme"
"xhci_pci"
"ahci"
"usb_storage"
"usbhid"
"sd_mod"
"sr_mod"
];
boot.initrd.kernelModules = [ ];
boot.kernelModules = [ "kvm-amd" ];
boot.extraModulePackages = [ ];
fileSystems."/" =
{
device = "/dev/disk/by-uuid/714744ca-dd9d-4713-b571-c6ccfbf56d79";
fsType = "btrfs";
options = [ "subvol=nixos" ];
};
fileSystems."/" = {
device = "/dev/disk/by-uuid/714744ca-dd9d-4713-b571-c6ccfbf56d79";
fsType = "btrfs";
options = [ "subvol=nixos" ];
};
fileSystems."/home" =
{
device = "/dev/disk/by-uuid/714744ca-dd9d-4713-b571-c6ccfbf56d79";
fsType = "btrfs";
options = [ "subvol=home" ];
};
fileSystems."/home" = {
device = "/dev/disk/by-uuid/714744ca-dd9d-4713-b571-c6ccfbf56d79";
fsType = "btrfs";
options = [ "subvol=home" ];
};
fileSystems."/boot" =
{
device = "/dev/disk/by-uuid/29E7-E20C";
fsType = "vfat";
};
fileSystems."/boot" = {
device = "/dev/disk/by-uuid/29E7-E20C";
fsType = "vfat";
};
fileSystems."/myvol" =
{
device = "/dev/nvme0n1p1";
fsType = "btrfs";
};
fileSystems."/myvol" = {
device = "/dev/nvme0n1p1";
fsType = "btrfs";
};
swapDevices = [ ];
hosts/myself/matrix.nix
+78 -68
View File
@@ -8,82 +8,92 @@ in
greg.containers.matrix = {
tailscale = true;
subnet = "204";
builder = { config, ... }: {
networking.firewall.allowedTCPPorts = [ config.services.dendrite.httpPort ];
builder =
{ config, ... }:
{
networking.firewall.allowedTCPPorts = [ config.services.dendrite.httpPort ];
# Environment secrets
age = {
secrets.dendrite = {
file = ../../secrets/dendrite.age;
owner = "dendrite";
# Environment secrets
age = {
secrets.dendrite = {
file = ../../secrets/dendrite.age;
owner = "dendrite";
};
secrets.dendrite_key = {
file = ../../secrets/dendrite_key.age;
owner = "dendrite";
};
};
secrets.dendrite_key = {
file = ../../secrets/dendrite_key.age;
owner = "dendrite";
users.users.dendrite = {
isSystemUser = true;
group = "dendrite";
};
};
users.groups.dendrite = { };
users.users.dendrite = {
isSystemUser = true;
group = "dendrite";
};
users.groups.dendrite = { };
systemd.services.dendrite.serviceConfig = {
User = "dendrite";
};
systemd.services.dendrite.serviceConfig = {
User = "dendrite";
};
greg.databases.dendrite = { };
greg.databases.dendrite = { };
services.dendrite = {
enable = true;
environmentFile = config.age.secrets.dendrite.path;
httpPort = 8448;
# Identify ourselves as the root of our own domain
settings = (
(builtins.listToAttrs (
(map (x: { name = x; value = { database.connection_string = conn; }; }) [
"app_service_api"
"federation_api"
"key_server"
"media_api"
"mscs"
"relay_api"
"room_server"
"sync_api"
])
)) //
{
user_api.account_database.connection_string = conn;
user_api.device_database.connection_string = conn;
global = {
database = {
connection_string = conn;
max_open_conns = 25;
max_idle_conns = 5;
conn_max_lifetime = -1;
services.dendrite = {
enable = true;
environmentFile = config.age.secrets.dendrite.path;
httpPort = 8448;
# Identify ourselves as the root of our own domain
settings = (
(builtins.listToAttrs (
(map
(x: {
name = x;
value = {
database.connection_string = conn;
};
})
[
"app_service_api"
"federation_api"
"key_server"
"media_api"
"mscs"
"relay_api"
"room_server"
"sync_api"
]
)
))
// {
user_api.account_database.connection_string = conn;
user_api.device_database.connection_string = conn;
global = {
database = {
connection_string = conn;
max_open_conns = 25;
max_idle_conns = 5;
conn_max_lifetime = -1;
};
server_name = "thehellings.com";
trusted_third_party_id_servers = [
"matrix.org"
"vector.im"
"jupiterbroadcasting.com"
];
# Generate this with {path-to-dendrite}/bin/generate-keys --private-key /etc/dendrite.pem
private_key = config.age.secrets.dendrite_key.path;
};
server_name = "thehellings.com";
trusted_third_party_id_servers = [
"matrix.org"
"vector.im"
"jupiterbroadcasting.com"
];
# Generate this with {path-to-dendrite}/bin/generate-keys --private-key /etc/dendrite.pem
private_key = config.age.secrets.dendrite_key.path;
};
client_api = {
registration_enabled = false;
registration_shared_secret = "\${REGISTRATION_SHARED_SECRET}";
};
}
);
};
client_api = {
registration_enabled = false;
registration_shared_secret = "\${REGISTRATION_SHARED_SECRET}";
};
}
);
};
systemd.services.dendrite = {
after = [ "postgresql.service" ];
requires = [ "postgresql.service" ];
systemd.services.dendrite = {
after = [ "postgresql.service" ];
requires = [ "postgresql.service" ];
};
};
};
};
}