Merge branch 'main' of gh:greg-hellings/nixos-config

flake.lock

@@ -413,11 +413,11 @@
     },
     "nixunstable": {
       "locked": {
-        "lastModified": 1717786204,
+        "lastModified": 1720957393,
-        "narHash": "sha256-4q0s6m0GUcN7q+Y2DqD27iLvbcd1G50T2lv08kKxkSI=",
+        "narHash": "sha256-oedh2RwpjEa+TNxhg5Je9Ch6d3W1NKi7DbRO1ziHemA=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "051f920625ab5aabe37c920346e3e69d7d34400e",
+        "rev": "693bc46d169f5af9c992095736e82c3488bf7dbb",
         "type": "github"
       },
       "original": {

home/home.nix

@@ -24,10 +24,10 @@ in
 	programs.tmux = {
 		enable = true;
 		keyMode = "vi";
-		shell = "${pkgs.xonsh}/bin/xonsh";
+		shell = "${pkgs.myxonsh}/bin/xonsh";
 		terminal = "xterm-256color";
 		customPaneNavigationAndResize = true;
-			#"set-option -g default-command ${pkgs.xonsh}/bin/xonsh"
+			#"set-option -g default-command ${pkgs.myxonsh}/bin/xonsh"
 		extraConfig = (lib.strings.concatStringsSep "\n" [
 			"bind P paste-buffer"
 		]);

home/hosts/ivr/default.nix

@@ -25,6 +25,7 @@ in {
 			home-manager
 			insomnia
 			pipenv-ivr
+			poetry
 		];
 		file.".pip/pip.conf".text = (lib.strings.concatStringsSep "\n" [
 			"[global]"

home/modules/gui.nix

@@ -25,6 +25,7 @@ in {
 		[
 			cdrtools
 			fluffychat
+			freetube
 			cinny-desktop
 			qpwgraph
 			vlc

home/modules/xonsh.nix

@@ -81,7 +81,7 @@ in with lib; {
 
 	in mkIf cfg.enable {
 
-		home.packages = [ pkgs.xonsh ];
+		home.packages = [ pkgs.myxonsh ];
 
 		home.file.".xonshrc".text = ''
 ${cfg.configHeader}

home/vim.nix

@@ -33,10 +33,6 @@ in
 		globals = {
 			indent_guides_enable_on_vim_startup = 1;
 			nix_recommended_style = 0;
-			netrw_liststyle = 3;
-			netrw_browse_split = 4;
-			netrw_altv = 1;
-			netrw_winsize = 25;
 		};
 		opts = {
 			background = "dark";
@@ -75,11 +71,7 @@ in
 		} {
 			mode = "n";
 			key = "<C-t>";
-			action = "<Esc>:Lex<CR>";
+			action = "<Esc>:NERDTreeToggle<CR>";
-		} {
-			mode = "n";
-			key = "<C-o>";
-			action = "<Esc>:GFiles?<CR>";
 		}
 			(winMove "h")
 			(winMove "j")
@@ -87,25 +79,43 @@ in
 			(winMove "l")
 		];
 		plugins = {
-			airline = {
+			airline.enable = true;
-				enable = true;
+			cmp.enable = true;
-				settings.theme = "gruvbox";
+			direnv.enable = true;
-			};
 			gitgutter.enable = true;
 			fugitive.enable = true;
+			fzf-lua = {
+				enable = true;
+				iconsEnabled = true;
+				keymaps = {
+					"<C-o>" = {
+						action = "files";
+						settings = {
+							previewers.cat.cmd = "${pkgs.coreutils}/bin/cat";
+							winopts.height = 0.5;
+						};
+					};
+					"<C-p>" = {
+						action = "git_files";
+						settings = {
+							previewers.cat.cmd = "${pkgs.coreutils}/bin/cat";
+							winopts.height = 0.5;
+						};
+					};
+				};
+				profile = "fzf-vim";
+			};
 			notify.enable = true;
 		};
 		extraConfigLua = builtins.replaceStrings [ "@git@" ] [ "${pkgs.git}/bin/git" ] (builtins.readFile ./vim/extra.lua);
 		extraConfigVim = builtins.readFile ./vim/extra.vimrc;
 		extraPlugins = with pkgs.vimPlugins; [
 			bufexplorer
-			gruvbox
+			nerdtree
-			nvim-cmp
+			nvim-web-devicons  # Be sure to install Hack Nerd Font and set it to your term default: https://gist.github.com/matthewjberger/7dd7e079f282f8138a9dc3b045ebefa0
 			packer-nvim
 
 			context-vim
-			direnv-vim
-			fzf-vim
 			vim-flake8
 			vim-indent-guides
 			vim-xonsh

home/xonsh_footer.xsh

@@ -1,5 +1,7 @@
 # vim: set ft=python :
 
+from tempfile import NamedTemporaryFile
+
 def bw_unlock():
     """Unlocks the BitWarden CLI and adds the resulting session code to the
     current environment variables. Also returns the code for them."""
@@ -15,6 +17,28 @@ def bw_unlock():
     $BW_SESSION = token
     return token
 
+def vpn(con, bwname):
+    bw_unlock()
+    base=$(bw get password @(bwname))
+    secret=$(bw get totp @(bwname))
+    #echo vpn.secrets.password:${base}$(oathtool -b -d "${digits}" -s "${period}" --totp "${secret}") > "${f}"
+
+    with NamedTemporaryFile(delete_on_close=False) as fp:
+        secret = f"vpn.secrets.password:{base}{secret}"
+        fp.write(secret.encode("utf-8"))
+        fp.close()
+        nmcli c up @(con) passwd-file @(fp.name)
+
+def _unlock(args):
+    bw_unlock()
+
+def _ivr(args):
+    vpn("350Main", "IVR Technology")
+
+def _glrestart(args):
+    sudo nixos-container run gitlab -- systemctl restart gitlab
+    sudo nixos-container run gitlab -- systemctl restart nginx
+
 def _cfetch(args):
     bw_unlock()
     $CIRCLECI_CLI_TOKEN=$(bw get password CircleCI) 
@@ -68,16 +92,19 @@ def _bake(args):
         git clone src:greg/copier-templates.git ~/.copier-templates
     copier copy @(str(templates / args[0])) .
 
-aliases['cfetch'] = _cfetch
+aliases['glrestart'] = _glrestart
 aliases['bake'] = _bake
-aliases['rebuild'] = _rebuild
+aliases['unlock'] = _unlock
-aliases['yaml2json'] = _yaml2json
+aliases['cfetch'] = _cfetch
+aliases['ivr'] = _ivr
+aliases['newdock'] = _newdock
+aliases['pip_extras'] = _pip_extras
 aliases['py2env'] = _py2env
 aliases['py3env'] = _py3env
+aliases['rebuild'] = _rebuild
 aliases['rundock'] = _rundock
-aliases['newdock'] = _newdock
 aliases['unknown_host'] = _unknown_host
-aliases['pip_extras'] = _pip_extras
+aliases['yaml2json'] = _yaml2json
 ###
 #
 # Other random nice-to-have things

hosts/exodus/default.nix

@@ -16,5 +16,9 @@
 		home = true;
 		gnome.enable = true;
 		tailscale.enable = true;
+		vmdev = {
+			enable = true;
+			system = "intel";
+		};
 	};
 }

hosts/hosea/default.nix

@@ -67,6 +67,7 @@ in
 					registrationConfigFile = config.age.secrets.runner-reg.path;
 					environmentVariables = {
 						EFI_DIR = "${pkgs.OVMF.fd}/FV/";
+						STORAGE_URL = "http://minio-01.thehellings.lan:9000";
 					};
 				};
 			};
@@ -120,7 +121,6 @@ in
 		gregpy
 		shellcheck
 		unzip
-		xonsh
 		xorriso
 		vagrant
 		wget

hosts/jeremiah/default.nix

@@ -2,13 +2,14 @@
 # your system.	Help is available in the configuration.nix(5) man page
 # and in the NixOS manual (accessible by running ‘nixos-help’).
 
-{ config, pkgs, ... }:
+{ config, pkgs, lib, ... }:
 
 {
 	imports =
 		[ # Include the results of the hardware scan.
 			./ceph.nix
 			./hardware-configuration.nix
+			./minio.nix
 		];
 
 	# Bootloader.
@@ -22,6 +23,12 @@
 			address = " 10.42.1.1";
 			interface = "enp68s0";
 		};
+		vlans = {
+			san = {
+				id = 616;
+				interface = "enp67s0";
+			};
+		};
 		interfaces = {
 			enp68s0 = {
 				ipv4.addresses = [ {
@@ -32,10 +39,10 @@
 					prefixLength = 16;
 				} ];
 			};
-			enp67s0 = {
+			san = {
 				ipv4.addresses = [ {
 					address = "10.201.1.2";
-					prefixLength = 16;
+					prefixLength = 24;
 				} ];
 			};
 		};
@@ -49,6 +56,18 @@
 	};
 	environment.systemPackages = with pkgs; [
 		btrfs-progs
+		curl
+		gawk
+		git
+		p7zip
+		packer
+		pup
+		gregpy
+		shellcheck
+		unzip
+		xorriso
+		vagrant
+		wget
 	];
 	
 	fileSystems = {
@@ -63,4 +82,55 @@
 			device = "/dev/nvme0n1p1";
 		};
 	};
+
+	#####################################################################################
+	#################### Virtualbox Runner ##############################################
+	#####################################################################################
+	services = {
+		gitlab-runner = {
+			enable = true;
+			settings.concurrent = 7;
+			services = {
+				shell = {
+					executor = "shell";
+					limit = 5;
+					registrationConfigFile = config.age.secrets.runner-reg.path;
+					environmentVariables = {
+						EFI_DIR = "${pkgs.OVMF.fd}/FV/";
+						STORAGE_URL = "http://localhost:9000";
+					};
+				};
+			};
+		};
+	};
+	age.secrets.runner-reg.file = ../../secrets/gitlab/jeremiah-runner-reg.age;
+	virtualisation.virtualbox.host = {
+		enable = true;
+		enableExtensionPack = true;
+		enableHardening = false;
+		headless = true;
+	};
+
+	systemd.services."gitlab-runner" = {
+		after = [
+			"network.target"
+			"network-online.target"
+			"systemd-resolved.service"
+		];
+		wants = [
+			"network-online.target"
+			"systemd-resolved.service"
+		];
+		preStart = builtins.concatStringsSep "\n" [
+			"${pkgs.kmod}/bin/modprobe vboxdrv"
+			"${pkgs.kmod}/bin/modprobe vboxnetadp"
+			"${pkgs.kmod}/bin/modprobe vboxnetflt"
+		];
+		postStop = "${pkgs.kmod}/bin/rmmod vboxnetadp vboxnetflt vboxdrv";
+		serviceConfig = {
+			DevicePolicy = lib.mkForce "auto";
+			User = "root";
+			DynamicUser = lib.mkForce false;
+		};
+	};
 }

hosts/jeremiah/minio.nix

@@ -0,0 +1,32 @@
+{ config, pkgs, ... }:
+
+let
+	minioPort = 9000;
+	minioConsolePort = 9001;
+in {
+	environment.systemPackages = with pkgs; [
+		minio-client
+		xfsprogs
+	];
+
+	greg.proxies."minio-02.thehellings.lan".target = "http://localhost:9000";
+
+	fileSystems."/data/1" = {
+		device = "/dev/disk/by-id/ata-ST12000NM0558_ZHZ5YSXW-part1";
+		fsType = "xfs";
+	};
+
+	networking.firewall.allowedTCPPorts = [
+		minioPort
+		minioConsolePort
+	];
+
+	age.secrets.minio.file = ../../secrets/minio.age;
+
+	services.minio = {
+		enable = true;
+		dataDir = [ "/data/1/minio" ];
+		rootCredentialsFile = config.age.secrets.minio.path;
+		browser = true;
+	};
+}

hosts/jude/virt.nix

@@ -1,41 +1,13 @@
 { pkgs, config, ... }:
 
 {
-	environment.systemPackages = with pkgs; [
+	greg.vmdev.enable = true;
-		dmidecode
-		guestfs-tools
-		libguestfs
-		OVMFFull
-		packer
-		virt-manager
-		vmware-workstation
-		vmfs-tools
-		xorriso
-	];
-
-	# Give my user access to the libvirtd process
-	users.users.greg.extraGroups = [ "libvirtd" ];
 
 	virtualisation = {
-		libvirtd = {
-			enable = true;
-			onBoot = "ignore";  # Do not auto-restart VMs on boot, unless they are marked autostart
-			qemu.ovmf.enable = true;
-		};
-
-		virtualbox.host = {
-			enable = true;
-			enableExtensionPack = true;
-		};
-
 		waydroid.enable = false;
 		lxd.enable = false;
 	};
 
-	users.extraGroups.vboxusers.members = [ "greg" ];
-
-	boot.extraModprobeConfig = "options kvm_amd nested=1";
-
 	systemd.services = {
 		gitlab-runner = {
 			conflicts = [ "libvirtd.service" ];
@@ -47,10 +19,6 @@
 			wantedBy = pkgs.lib.mkForce [];
 			serviceConfig.User = "root";
 		};
-		libvirtd = {
-			preStart = "${pkgs.kmod}/bin/modprobe kvm_amd";
-			postStop = "${pkgs.kmod}/bin/rmmod kvm_amd kvm";
-		};
 	};
 
 	age.secrets.runner-reg.file = ../../secrets/gitlab/myself-vbox-runner-reg.age;

hosts/myself/container-git.nix

@@ -106,7 +106,7 @@ in {
 					proxy_download = false;  # Tell them to reach out to object storage themselves!
 					connection = {
 						provider = "AWS";
-						endpoint = "http://s3.thehellings.lan:9000";
+						endpoint = "http://minio-01.thehellings.lan:9000";
 						region = "us-east-1";
 						aws_access_key_id = { _secret = config.age.secrets.minio_access_key_id.path; };
 						aws_secret_access_key = { _secret = config.age.secrets.minio_secret_access_key.path; };

hosts/myself/container-runner.nix

@@ -31,13 +31,13 @@ lib.attrsets.recursiveUpdate {
 		curl
 		gawk
 		git
+		minio-client
 		p7zip
 		packer
 		pup
 		py
 		shellcheck
 		unzip
-		xonsh
 		xorriso
 		vagrant
 		wget
@@ -67,6 +67,7 @@ lib.attrsets.recursiveUpdate {
 					registrationConfigFile = config.age.secrets.runner-reg.path;
 					environmentVariables = {
 						EFI_DIR = "${pkgs.OVMF.fd}/FV/";
+						STORAGE_URL = "http://localhost:9000";
 					};
 				};
 			};

hosts/myself/default.nix

@@ -15,7 +15,6 @@
 		tmux
 		tree
 		vim
-		xonsh
 		xorriso
 	];
 
@@ -31,20 +30,28 @@
 			address = " 10.42.1.1";
 			interface = "enp38s0";
 		};
-		interfaces.enp38s0 = {
+		vlans = {
-			ipv4.addresses = [ {
+			san = {
-				address = "10.42.1.6";
+				id = 616;
-				prefixLength = 16;
+				interface = "enp39s0";
-			} {
+			};
-				address = "10.42.100.1";
-				prefixLength = 16;
-			} ];
 		};
-		interfaces.enp39s0 = {
+		interfaces = {
-			ipv4.addresses = [ {
+			enp38s0 = {
-				address = "10.201.1.1";
+				ipv4.addresses = [ {
-				prefixLength = 24;
+					address = "10.42.1.6";
-			} ];
+					prefixLength = 16;
+				} {
+					address = "10.42.100.1";
+					prefixLength = 16;
+				} ];
+			};
+			san = {
+				ipv4.addresses = [ {
+					address = "10.201.1.1";
+					prefixLength = 24;
+				} ];
+			};
 		};
 		nameservers = [
 			"10.42.1.5"

hosts/myself/git.nix

@@ -120,6 +120,7 @@ in  {
 				registrationConfigFile = config.age.secrets.runner-qemu.path;
 				environmentVariables = {
 					EFI_DIR = "${pkgs.OVMF.fd}/FV/";
+					STORAGE_URL = "http://localhost:9000";
 				};
 			};
 		};
@@ -132,6 +133,7 @@ in  {
 		curl
 		gawk
 		git
+		minio-client
 		p7zip
 		packer
 		pup
@@ -140,7 +142,6 @@ in  {
 		qemu_kvm
 		shellcheck
 		unzip
-		xonsh
 		xorriso
 		vagrant
 		wget

modules/nixos/default.nix

@@ -17,6 +17,7 @@
 		./rpi4.nix
 		./sway.nix
 		./tailscale.nix
+		./vmdev.nix
 	];
 
 	environment.systemPackages = with pkgs; [
@@ -44,7 +45,10 @@
 	};
 
 	programs = {
-		xonsh.enable = true;
+		xonsh = {
+			enable = true;
+			package = pkgs.myxonsh;
+		};
 	};
 
 	# Enable the OpenSSH daemon for remote control

modules/nixos/vmdev.nix

@@ -0,0 +1,73 @@
+{ pkgs, lib, config, ... }:
+
+let
+	cfg = config.greg.vmdev;
+in with lib;
+{
+	options = {
+		greg.vmdev = {
+			enable = mkEnableOption "Enable this system for VM development work";
+			user = mkOption {
+				default = "greg";
+				type = types.str;
+				description = "The user who will be doing VM dev";
+			};
+			system = mkOption {
+				default = "amd";
+				type = types.str;
+				description = "Kernel module type to install - amd, intel, etc";
+			};
+		};
+	};
+
+	config = mkIf cfg.enable {
+		environment.systemPackages = with pkgs; [
+			dmidecode
+			guestfs-tools
+			libguestfs
+			OVMFFull
+			packer
+			virt-manager
+			xorriso
+		];
+
+		users.users."${cfg.user}".extraGroups = [ "libvirtd" ];
+
+		# Enable the virtualisation services
+		virtualisation = {
+			libvirtd = {
+				enable = true;
+				onBoot = "ignore";  # Do not auto-restart VMs on boot, unless they are marked autostart
+				qemu.ovmf.enable = true;
+			};
+
+			virtualbox.host = {
+				enable = true;
+				enableExtensionPack = true;
+			};
+		};
+
+		# Configuration for vbox user performance
+		users.extraGroups.vboxusers.members = [ cfg.user ];
+
+		boot.extraModprobeConfig = "options kvm_${cfg.system} nested=1";
+
+		# Configure the services more
+		systemd.services = {
+			libvirtd = {
+				preStart = "${pkgs.kmod}/bin/modprobe kvm_${cfg.system}";
+				postStop = "${pkgs.kmod}/bin/rmmod kvm_${cfg.system} kvm";
+				conflicts = [ "vbox.service" ];
+			};
+			vbox = {
+				preStart = "${pkgs.kmod}/bin/modprobe vboxdrv vboxnetadp vboxnetflt";
+				postStop = "${pkgs.kmod}/bin/rmmod vboxnetadp vboxnetflt vboxdrv";
+				conflicts = [ "libvirtd.service" ];
+				unitConfig = {
+					Type = "oneshot";
+					RemainAfterExit = "yes";
+				};
+			};
+		};
+	};
+}

overlays/default.nix

@@ -18,7 +18,7 @@ let
 		virtualenv
 	];
 
-	myPython = prev.python3.withPackages myPackages;
+	myPython = prev.python312.withPackages myPackages;
 	macOver = file: og:
 		if prev.stdenv.isDarwin then
 		(prev.callPackage file {}) else
@@ -83,7 +83,7 @@ in rec {
 	};
 	pipenv-ivr = prev.callPackage ./pipenv.nix { };
 
-	xonsh = (prev.xonsh.override {
+	myxonsh = (prev.xonsh-unwrapped.passthru.wrapper.override {
 		extraPackages = (ps: with ps; [
 			xonsh-apipenv
 			xonsh-direnv

secrets/secrets.nix

@@ -57,6 +57,7 @@ in
 	# Then pipe the resulting files to agenix -e <foo>
 	"gitlab/key.age".publicKeys = everyone;
 	"gitlab/cert.age".publicKeys = everyone;
+	"gitlab/jeremiah-runner-reg.age".publicKeys = everyone;
 	"gitlab/myself-qemu-runner-reg.age".publicKeys = everyone;
 	"gitlab/myself-vbox-runner-reg.age".publicKeys = everyone;
 	"gitlab/myself-podman-runner-reg.age".publicKeys = everyone;