diff --git a/.editorconfig b/.editorconfig new file mode 100644 index 0000000..1d22591 --- /dev/null +++ b/.editorconfig @@ -0,0 +1,122 @@ +# EditorConfig configuration for nixpkgs +# https://EditorConfig.org + +# Top-most EditorConfig file +root = true + +# Unix-style newlines with a newline ending every file, utf-8 charset +[*] +end_of_line = lf +insert_final_newline = true +trim_trailing_whitespace = true +charset = utf-8 + +# Ignore diffs/patches +[*.{diff,patch}] +end_of_line = unset +insert_final_newline = unset +trim_trailing_whitespace = unset + +# We want readFile .version to return the version without a newline. +[.version] +insert_final_newline = false + +# see https://nixos.org/nixpkgs/manual/#chap-conventions + +# Match json/lockfiles/markdown/nix/perl/python/ruby/shell/docbook files, set indent to spaces +[*.{json,lock,md,nix,pl,pm,py,rb,sh,xml}] +indent_style = space + +# Match docbook files, set indent width of one +[*.xml] +indent_size = 1 + +# Match json/lockfiles/markdown/nix/ruby files, set indent width of two +[*.{json,lock,md,nix,rb}] +indent_size = 2 + +# Match perl/python/shell scripts, set indent width of four +[*.{pl,pm,py,sh}] +indent_size = 4 + +# Match gemfiles, set indent to spaces with width of two +[Gemfile] +indent_size = 2 +indent_style = space + +# Match package.json, which are generally pulled from upstream and accept them as they are +[package.json] +indent_style = unset + +# Disable file types or individual files +# some of these files may be auto-generated and/or require significant changes + +[*.{c,h}] +insert_final_newline = unset +trim_trailing_whitespace = unset + +[*.{asc,key,ovpn}] +insert_final_newline = unset +end_of_line = unset +trim_trailing_whitespace = unset + +[*.lock] +indent_size = unset + +# Although Markdown/CommonMark allows using two trailing spaces to denote +# a hard line break, we do not use that feature in nixpkgs since +# it forces the surrounding paragraph to become a which +# does not wrap reasonably. +# Instead of a hard line break, start a new paragraph by inserting a blank line. +[*.md] +trim_trailing_whitespace = true + +# binaries +[*.nib] +end_of_line = unset +insert_final_newline = unset +trim_trailing_whitespace = unset +charset = unset + +[eggs.nix] +trim_trailing_whitespace = unset + +[nixos/modules/services/networking/ircd-hybrid/*.{conf,in}] +trim_trailing_whitespace = unset + +[pkgs/build-support/dotnetenv/Wrapper/**] +end_of_line = unset +indent_style = unset +insert_final_newline = unset +trim_trailing_whitespace = unset + +[pkgs/development/compilers/elm/registry.dat] +end_of_line = unset +insert_final_newline = unset + +[pkgs/development/haskell-modules/hackage-packages.nix] +indent_style = unset +trim_trailing_whitespace = unset + +[pkgs/misc/documentation-highlighter/**] +insert_final_newline = unset + +[pkgs/servers/dict/wordnet_structures.py] +trim_trailing_whitespace = unset + +[pkgs/tools/misc/timidity/timidity.cfg] +trim_trailing_whitespace = unset + +[pkgs/tools/virtualization/ovftool/*.ova] +end_of_line = unset +insert_final_newline = unset +trim_trailing_whitespace = unset +charset = unset + +[lib/tests/*.plist] +indent_style = tab +insert_final_newline = unset + +[pkgs/kde/generated/**] +insert_final_newline = unset +end_of_line = unset diff --git a/.envrc b/.envrc new file mode 100644 index 0000000..3550a30 --- /dev/null +++ b/.envrc @@ -0,0 +1 @@ +use flake diff --git a/.gitignore b/.gitignore index 0d96e93..e39ed0f 100644 --- a/.gitignore +++ b/.gitignore @@ -1,2 +1,4 @@ host result +.pre-commit-config.yaml +.direnv diff --git a/ceph/home.nix b/ceph/home.nix index 124937b..4b36ff2 100644 --- a/ceph/home.nix +++ b/ceph/home.nix @@ -1,21 +1,27 @@ { - fsid = "749bf0ea-acf5-4a5e-b33e-9a057455c06b"; - clusterName = "home"; - initialMonitors = [ { - hostname = "myself.thehellings.lan"; - ipAddress = "10.42.1.6"; - } { - hostname = "jeremiah.thehellings.lan"; - ipAddress = "10.42.1.8"; - } { - hostname = "hosea.thehellings.lan"; - ipAddress = "10.42.1.7"; - } ]; - mdsNodes = [ { - hostname = "jeremiah.thehellings.lan"; - ipAddress = "10.42.1.8"; - } ]; - publicNetworks = [ "10.42.0.0/16" ]; - clusterNetworks = [ "10.201.0.0/16" ]; - adminKeyring = ../secrets/home.client.admin.keyring; + fsid = "749bf0ea-acf5-4a5e-b33e-9a057455c06b"; + clusterName = "home"; + initialMonitors = [ + { + hostname = "myself.thehellings.lan"; + ipAddress = "10.42.1.6"; + } + { + hostname = "jeremiah.thehellings.lan"; + ipAddress = "10.42.1.8"; + } + { + hostname = "hosea.thehellings.lan"; + ipAddress = "10.42.1.7"; + } + ]; + mdsNodes = [ + { + hostname = "jeremiah.thehellings.lan"; + ipAddress = "10.42.1.8"; + } + ]; + publicNetworks = [ "10.42.0.0/16" ]; + clusterNetworks = [ "10.201.0.0/16" ]; + adminKeyring = ../secrets/home.client.admin.keyring; } diff --git a/checks.nix b/checks.nix new file mode 100644 index 0000000..723e87e --- /dev/null +++ b/checks.nix @@ -0,0 +1,14 @@ +{ hooks, system, ... }: + +{ + pre-commit-check = hooks.lib.${system}.run { + src = ./.; + hooks = { + deadnix.enable = true; + # Needs https://github.com/DeterminateSystems/flake-checker/pull/130 + #flake-checker.enable = true; + nixfmt-rfc-style.enable = true; + check-merge-conflicts.enable = true; + }; + }; +} diff --git a/configuration.nix b/configuration.nix index 1944e5c..df0f4e0 100644 --- a/configuration.nix +++ b/configuration.nix @@ -5,11 +5,11 @@ { config, pkgs, ... }: { - imports = - [ # Include the results of the hardware scan. - ./hardware-configuration.nix - ./modules/ - ]; + imports = [ + # Include the results of the hardware scan. + ./hardware-configuration.nix + ./modules + ]; # Bootloader. boot.loader.systemd-boot.enable = true; @@ -72,10 +72,13 @@ users.users.greg = { isNormalUser = true; description = "Greg Hellings"; - extraGroups = [ "networkmanager" "wheel" ]; + extraGroups = [ + "networkmanager" + "wheel" + ]; packages = with pkgs; [ firefox - # thunderbird + # thunderbird ]; }; diff --git a/darwin-configuration.nix b/darwin-configuration.nix index 8f2bcdd..cbac3c7 100644 --- a/darwin-configuration.nix +++ b/darwin-configuration.nix @@ -1,8 +1,8 @@ { ... }: { - imports = [ - ./modules - ./hosts/work - ]; + imports = [ + ./modules + ./hosts/work + ]; } diff --git a/darwin/default.nix b/darwin/default.nix index 6f76ebf..abb607c 100644 --- a/darwin/default.nix +++ b/darwin/default.nix @@ -1,33 +1,36 @@ -{ inputs, overlays, ... }: +{ top, overlays, ... }: let - mac = { - system ? "aarch64-darwin", - name, - channel ? inputs.nixunstable, - hm ? inputs.hmunstable, - extraMods ? [] - }: - let - nixpkgs = import channel { - inherit system overlays; - }; - in inputs.darwin.lib.darwinSystem { - inherit system; - specialArgs = { inherit nixpkgs; }; - modules = [ - { - nixpkgs.overlays = overlays; - home-manager.extraSpecialArgs = { - inherit inputs; - host = name; - }; - } - hm.darwinModules.home-manager - inputs.self.modules.darwinModule - ./${name} - ] ++ extraMods; - }; -in rec { - la23002 = mac { name = "ivr"; }; - LA23002 = la23002; + mac = + { + system ? "aarch64-darwin", + name, + channel ? top.nixunstable, + hm ? top.hmunstable, + extraMods ? [ ], + }: + let + nixpkgs = import channel { inherit system overlays; }; + in + top.darwin.lib.darwinSystem { + inherit system; + specialArgs = { + inherit nixpkgs; + }; + modules = [ + { + nixpkgs.overlays = overlays; + home-manager.extraSpecialArgs = { + inherit top; + host = name; + }; + } + hm.darwinModules.home-manager + top.self.modules.darwinModule + ./${name} + ] ++ extraMods; + }; +in +rec { + la23002 = mac { name = "ivr"; }; + LA23002 = la23002; } diff --git a/darwin/ivr/default.nix b/darwin/ivr/default.nix deleted file mode 100644 index 60b43be..0000000 --- a/darwin/ivr/default.nix +++ /dev/null @@ -1,41 +0,0 @@ -{ pkgs, ... }: -let - qemu_conf = pkgs.stdenv.mkDerivation { - name = "qemu_conf"; - phases = [ "installPhase" ]; - - cfg = pkgs.writeText "qemu.conf" - '' - security_driver = "none" - dynamic_ownership = 0 - remember_owner = 0 - ''; - installPhase = '' - mkdir -p $out/opt/homebrew/etc/libvirt/ - cp $cfg $out/opt/homebrew/etc/libvirt/qemu.conf - ''; - }; -in { - environment.systemPackages = with pkgs; [ - qemu_conf - unixtools.watch - ]; - - homebrew = { - enable = true; - brews = [ - "qemu" - "gcc" - "libaacs" - { - name = "libvirt"; - restart_service = true; - } - "virt-manager" - ]; - casks = [ - "synology-drive" - "handbrake" - ]; - }; -} diff --git a/flake.lock b/flake.lock index c1406a7..f56c23d 100644 --- a/flake.lock +++ b/flake.lock @@ -23,6 +23,43 @@ "type": "github" } }, + "btc": { + "inputs": { + "extra-container": "extra-container", + "flake-utils": "flake-utils", + "nixpkgs": "nixpkgs", + "nixpkgs-unstable": "nixpkgs-unstable" + }, + "locked": { + "lastModified": 1723533469, + "narHash": "sha256-8gSsZpYmOzwFRaLIX0OMBvV/+SATmu/O9QXkDgsZlIg=", + "owner": "fort-nix", + "repo": "nix-bitcoin", + "rev": "6e208d6a7b554be592167f6ecad9b16c0abf96d7", + "type": "github" + }, + "original": { + "owner": "fort-nix", + "ref": "release", + "repo": "nix-bitcoin", + "type": "github" + } + }, + "crane": { + "locked": { + "lastModified": 1725409566, + "narHash": "sha256-PrtLmqhM6UtJP7v7IGyzjBFhbG4eOAHT6LPYOFmYfbk=", + "owner": "ipetkov", + "repo": "crane", + "rev": "7e4586bad4e3f8f97a9271def747cf58c4b68f3c", + "type": "github" + }, + "original": { + "owner": "ipetkov", + "repo": "crane", + "type": "github" + } + }, "darwin": { "inputs": { "nixpkgs": [ @@ -95,11 +132,11 @@ ] }, "locked": { - "lastModified": 1722113426, - "narHash": "sha256-Yo/3loq572A8Su6aY5GP56knpuKYRvM2a1meP9oJZCw=", + "lastModified": 1728330715, + "narHash": "sha256-xRJ2nPOXb//u1jaBnDP56M7v5ldavjbtR6lfGqSvcKg=", "owner": "numtide", "repo": "devshell", - "rev": "67cce7359e4cd3c45296fb4aaf6a19e2a9c757ae", + "rev": "dd6b80932022cea34a019e2bb32f6fa9e494dfef", "type": "github" }, "original": { @@ -108,37 +145,70 @@ "type": "github" } }, + "extra-container": { + "inputs": { + "flake-utils": [ + "btc", + "flake-utils" + ], + "nixpkgs": [ + "btc", + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1722175938, + "narHash": "sha256-HKyB4HD+NdX3T233bY31hm76v3/tdQBNeLLvopKbZeY=", + "owner": "erikarvstedt", + "repo": "extra-container", + "rev": "37e7207ac9f857eedb58b208b9dc91cd6b24e651", + "type": "github" + }, + "original": { + "owner": "erikarvstedt", + "repo": "extra-container", + "type": "github" + } + }, + "fenix": { + "inputs": { + "nixpkgs": [ + "zed", + "nixpkgs" + ], + "rust-analyzer-src": "rust-analyzer-src" + }, + "locked": { + "lastModified": 1726554553, + "narHash": "sha256-xakDhIS1c1VgJc/NMOLj05yBsTdlXKMEYz6wC8Hdshc=", + "owner": "nix-community", + "repo": "fenix", + "rev": "1f59d7585aa06d2c327960d397bea4067d8fee98", + "type": "github" + }, + "original": { + "owner": "nix-community", + "repo": "fenix", + "type": "github" + } + }, "flake-compat": { + "flake": false, "locked": { "lastModified": 1696426674, "narHash": "sha256-kvjfFW7WAETZlt09AgDn1MrtKzP7t90Vf7vypd3OL1U=", + "owner": "edolstra", + "repo": "flake-compat", "rev": "0f9255e01c2351cc7d116c072cb317785dd33b33", - "revCount": 57, - "type": "tarball", - "url": "https://api.flakehub.com/f/pinned/edolstra/flake-compat/1.0.1/018afb31-abd1-7bff-a5e4-cff7e18efb7a/source.tar.gz" + "type": "github" }, "original": { - "type": "tarball", - "url": "https://flakehub.com/f/edolstra/flake-compat/1.tar.gz" + "owner": "edolstra", + "repo": "flake-compat", + "type": "github" } }, "flake-compat_2": { - "flake": false, - "locked": { - "lastModified": 1696426674, - "narHash": "sha256-kvjfFW7WAETZlt09AgDn1MrtKzP7t90Vf7vypd3OL1U=", - "owner": "edolstra", - "repo": "flake-compat", - "rev": "0f9255e01c2351cc7d116c072cb317785dd33b33", - "type": "github" - }, - "original": { - "owner": "edolstra", - "repo": "flake-compat", - "type": "github" - } - }, - "flake-compat_3": { "locked": { "lastModified": 1696426674, "narHash": "sha256-kvjfFW7WAETZlt09AgDn1MrtKzP7t90Vf7vypd3OL1U=", @@ -152,7 +222,7 @@ "url": "https://flakehub.com/f/edolstra/flake-compat/1.tar.gz" } }, - "flake-compat_4": { + "flake-compat_3": { "flake": false, "locked": { "lastModified": 1696426674, @@ -168,19 +238,77 @@ "type": "github" } }, + "flake-compat_4": { + "locked": { + "lastModified": 1696426674, + "narHash": "sha256-kvjfFW7WAETZlt09AgDn1MrtKzP7t90Vf7vypd3OL1U=", + "rev": "0f9255e01c2351cc7d116c072cb317785dd33b33", + "revCount": 57, + "type": "tarball", + "url": "https://api.flakehub.com/f/pinned/edolstra/flake-compat/1.0.1/018afb31-abd1-7bff-a5e4-cff7e18efb7a/source.tar.gz" + }, + "original": { + "type": "tarball", + "url": "https://flakehub.com/f/edolstra/flake-compat/1.tar.gz" + } + }, + "flake-compat_5": { + "flake": false, + "locked": { + "lastModified": 1696426674, + "narHash": "sha256-kvjfFW7WAETZlt09AgDn1MrtKzP7t90Vf7vypd3OL1U=", + "owner": "edolstra", + "repo": "flake-compat", + "rev": "0f9255e01c2351cc7d116c072cb317785dd33b33", + "type": "github" + }, + "original": { + "owner": "edolstra", + "repo": "flake-compat", + "type": "github" + } + }, + "flake-compat_6": { + "flake": false, + "locked": { + "lastModified": 1696426674, + "narHash": "sha256-kvjfFW7WAETZlt09AgDn1MrtKzP7t90Vf7vypd3OL1U=", + "owner": "edolstra", + "repo": "flake-compat", + "rev": "0f9255e01c2351cc7d116c072cb317785dd33b33", + "type": "github" + }, + "original": { + "owner": "edolstra", + "repo": "flake-compat", + "type": "github" + } + }, + "flake-compat_7": { + "locked": { + "lastModified": 1696426674, + "narHash": "sha256-kvjfFW7WAETZlt09AgDn1MrtKzP7t90Vf7vypd3OL1U=", + "owner": "edolstra", + "repo": "flake-compat", + "rev": "0f9255e01c2351cc7d116c072cb317785dd33b33", + "type": "github" + }, + "original": { + "owner": "edolstra", + "repo": "flake-compat", + "type": "github" + } + }, "flake-parts": { "inputs": { - "nixpkgs-lib": [ - "nixvimstable", - "nixpkgs" - ] + "nixpkgs-lib": "nixpkgs-lib" }, "locked": { - "lastModified": 1722555600, - "narHash": "sha256-XOQkdLafnb/p9ij77byFQjDf5m5QYl9b2REiVClC+x4=", + "lastModified": 1727826117, + "narHash": "sha256-K5ZLCyfO/Zj9mPFldf3iwS6oZStJcU4tSpiXTMYaaL0=", "owner": "hercules-ci", "repo": "flake-parts", - "rev": "8471fe90ad337a8074e957b69ca4d0089218391d", + "rev": "3d04084d54bedc3d6b8b736c70ef449225c361b1", "type": "github" }, "original": { @@ -190,6 +318,27 @@ } }, "flake-parts_2": { + "inputs": { + "nixpkgs-lib": [ + "nixvimstable", + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1725234343, + "narHash": "sha256-+ebgonl3NbiKD2UD0x4BszCZQ6sTfL4xioaM49o5B3Y=", + "owner": "hercules-ci", + "repo": "flake-parts", + "rev": "567b938d64d4b4112ee253b9274472dc3a346eb6", + "type": "github" + }, + "original": { + "owner": "hercules-ci", + "repo": "flake-parts", + "type": "github" + } + }, + "flake-parts_3": { "inputs": { "nixpkgs-lib": [ "nixvimunstable", @@ -197,11 +346,11 @@ ] }, "locked": { - "lastModified": 1722555600, - "narHash": "sha256-XOQkdLafnb/p9ij77byFQjDf5m5QYl9b2REiVClC+x4=", + "lastModified": 1727826117, + "narHash": "sha256-K5ZLCyfO/Zj9mPFldf3iwS6oZStJcU4tSpiXTMYaaL0=", "owner": "hercules-ci", "repo": "flake-parts", - "rev": "8471fe90ad337a8074e957b69ca4d0089218391d", + "rev": "3d04084d54bedc3d6b8b736c70ef449225c361b1", "type": "github" }, "original": { @@ -233,11 +382,11 @@ "systems": "systems_3" }, "locked": { - "lastModified": 1710146030, - "narHash": "sha256-SZ5L6eA7HJ/nmkzGG7/ISclqe6oZdOZTNoesiInkXPQ=", + "lastModified": 1726560853, + "narHash": "sha256-X6rJYSESBVr3hBoH0WbKE5KvhPU5bloyZ2L4K60/fPQ=", "owner": "numtide", "repo": "flake-utils", - "rev": "b1d9ab70662946ef0850d488da1c9019f3a9752a", + "rev": "c1dfcf08411b08f6b8615f7d8971a2bfa81d5e8a", "type": "github" }, "original": { @@ -264,10 +413,28 @@ "type": "github" } }, + "flake-utils_4": { + "inputs": { + "systems": "systems_5" + }, + "locked": { + "lastModified": 1726560853, + "narHash": "sha256-X6rJYSESBVr3hBoH0WbKE5KvhPU5bloyZ2L4K60/fPQ=", + "owner": "numtide", + "repo": "flake-utils", + "rev": "c1dfcf08411b08f6b8615f7d8971a2bfa81d5e8a", + "type": "github" + }, + "original": { + "owner": "numtide", + "repo": "flake-utils", + "type": "github" + } + }, "git-hooks": { "inputs": { - "flake-compat": "flake-compat_2", - "gitignore": "gitignore", + "flake-compat": "flake-compat_3", + "gitignore": "gitignore_2", "nixpkgs": [ "nixvimstable", "nixpkgs" @@ -278,11 +445,11 @@ ] }, "locked": { - "lastModified": 1723202784, - "narHash": "sha256-qbhjc/NEGaDbyy0ucycubq4N3//gDFFH3DOmp1D3u1Q=", + "lastModified": 1724857454, + "narHash": "sha256-Qyl9Q4QMTLZnnBb/8OuQ9LSkzWjBU1T5l5zIzTxkkhk=", "owner": "cachix", "repo": "git-hooks.nix", - "rev": "c7012d0c18567c889b948781bc74a501e92275d1", + "rev": "4509ca64f1084e73bc7a721b20c669a8d4c5ebe6", "type": "github" }, "original": { @@ -297,7 +464,7 @@ "nixvimunstable", "flake-compat" ], - "gitignore": "gitignore_2", + "gitignore": "gitignore_3", "nixpkgs": [ "nixvimunstable", "nixpkgs" @@ -308,11 +475,11 @@ ] }, "locked": { - "lastModified": 1723202784, - "narHash": "sha256-qbhjc/NEGaDbyy0ucycubq4N3//gDFFH3DOmp1D3u1Q=", + "lastModified": 1729104314, + "narHash": "sha256-pZRZsq5oCdJt3upZIU4aslS9XwFJ+/nVtALHIciX/BI=", "owner": "cachix", "repo": "git-hooks.nix", - "rev": "c7012d0c18567c889b948781bc74a501e92275d1", + "rev": "3c3e88f0f544d6bb54329832616af7eb971b6be6", "type": "github" }, "original": { @@ -322,6 +489,27 @@ } }, "gitignore": { + "inputs": { + "nixpkgs": [ + "hooks", + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1709087332, + "narHash": "sha256-HG2cCnktfHsKV0s4XW83gU3F57gaTljL9KNSuG6bnQs=", + "owner": "hercules-ci", + "repo": "gitignore.nix", + "rev": "637db329424fd7e46cf4185293b9cc8c88c95394", + "type": "github" + }, + "original": { + "owner": "hercules-ci", + "repo": "gitignore.nix", + "type": "github" + } + }, + "gitignore_2": { "inputs": { "nixpkgs": [ "nixvimstable", @@ -343,7 +531,7 @@ "type": "github" } }, - "gitignore_2": { + "gitignore_3": { "inputs": { "nixpkgs": [ "nixvimunstable", @@ -372,11 +560,11 @@ ] }, "locked": { - "lastModified": 1720042825, - "narHash": "sha256-A0vrUB6x82/jvf17qPCpxaM+ulJnD8YZwH9Ci0BsAzE=", + "lastModified": 1726989464, + "narHash": "sha256-Vl+WVTJwutXkimwGprnEtXc/s/s8sMuXzqXaspIGlwM=", "owner": "nix-community", "repo": "home-manager", - "rev": "e1391fb22e18a36f57e6999c7a9f966dc80ac073", + "rev": "2f23fa308a7c067e52dfcc30a0758f47043ec176", "type": "github" }, "original": { @@ -393,11 +581,11 @@ ] }, "locked": { - "lastModified": 1723986931, - "narHash": "sha256-Fy+KEvDQ+Hc8lJAV3t6leXhZJ2ncU5/esxkgt3b8DEY=", + "lastModified": 1729551526, + "narHash": "sha256-7LAGY32Xl14OVQp3y6M43/0AtHYYvV6pdyBcp3eoz0s=", "owner": "nix-community", "repo": "home-manager", - "rev": "2598861031b78aadb4da7269df7ca9ddfc3e1671", + "rev": "5ec753a1fc4454df9285d8b3ec0809234defb975", "type": "github" }, "original": { @@ -458,11 +646,11 @@ ] }, "locked": { - "lastModified": 1723399884, - "narHash": "sha256-97wn0ihhGqfMb8WcUgzzkM/TuAxce2Gd20A8oiruju4=", + "lastModified": 1729260213, + "narHash": "sha256-jAvHoU/1y/yCuXzr2fNF+q6uKmr8Jj2xgAisK4QB9to=", "owner": "nix-community", "repo": "home-manager", - "rev": "086f619dd991a4d355c07837448244029fc2d9ab", + "rev": "09a0c0c02953318bf94425738c7061ffdc4cba75", "type": "github" }, "original": { @@ -471,6 +659,27 @@ "type": "github" } }, + "hooks": { + "inputs": { + "flake-compat": "flake-compat", + "gitignore": "gitignore", + "nixpkgs": "nixpkgs_2", + "nixpkgs-stable": "nixpkgs-stable" + }, + "locked": { + "lastModified": 1727854478, + "narHash": "sha256-/odH2nUMAwkMgOS2nG2z0exLQNJS4S2LfMW0teqU7co=", + "owner": "cachix", + "repo": "git-hooks.nix", + "rev": "5f58871c9657b5fc0a7f65670fe2ba99c26c1d79", + "type": "github" + }, + "original": { + "owner": "cachix", + "repo": "git-hooks.nix", + "type": "github" + } + }, "nix-darwin": { "inputs": { "nixpkgs": [ @@ -479,11 +688,11 @@ ] }, "locked": { - "lastModified": 1722924007, - "narHash": "sha256-+CQDamNwqO33REJLft8c26NbUi2Td083hq6SvAm2xkU=", + "lastModified": 1725189302, + "narHash": "sha256-IhXok/kwQqtusPsoguQLCHA+h6gKvgdCrkhIaN+kByA=", "owner": "lnl7", "repo": "nix-darwin", - "rev": "91010a5613ffd7ee23ee9263213157a1c422b705", + "rev": "7c4b53a7d9f3a3df902b3fddf2ae245ef20ebcda", "type": "github" }, "original": { @@ -500,11 +709,11 @@ ] }, "locked": { - "lastModified": 1722924007, - "narHash": "sha256-+CQDamNwqO33REJLft8c26NbUi2Td083hq6SvAm2xkU=", + "lastModified": 1728901530, + "narHash": "sha256-I9Qd0LnAsEGHtKE9+uVR0iDFmsijWSy7GT0g3jihG4Q=", "owner": "lnl7", "repo": "nix-darwin", - "rev": "91010a5613ffd7ee23ee9263213157a1c422b705", + "rev": "a60ac02f9466f85f092e576fd8364dfc4406b5a6", "type": "github" }, "original": { @@ -545,13 +754,121 @@ "type": "github" } }, - "nixpkgs_2": { + "nixpkgs-lib": { "locked": { - "lastModified": 1723175592, - "narHash": "sha256-M0xJ3FbDUc4fRZ84dPGx5VvgFsOzds77KiBMW/mMTnI=", + "lastModified": 1727825735, + "narHash": "sha256-0xHYkMkeLVQAMa7gvkddbPqpxph+hDzdu1XdGPJR+Os=", + "type": "tarball", + "url": "https://github.com/NixOS/nixpkgs/archive/fb192fec7cc7a4c26d51779e9bab07ce6fa5597a.tar.gz" + }, + "original": { + "type": "tarball", + "url": "https://github.com/NixOS/nixpkgs/archive/fb192fec7cc7a4c26d51779e9bab07ce6fa5597a.tar.gz" + } + }, + "nixpkgs-stable": { + "locked": { + "lastModified": 1720386169, + "narHash": "sha256-NGKVY4PjzwAa4upkGtAMz1npHGoRzWotlSnVlqI40mo=", "owner": "NixOS", "repo": "nixpkgs", - "rev": "5e0ca22929f3342b19569b21b2f3462f053e497b", + "rev": "194846768975b7ad2c4988bdb82572c00222c0d7", + "type": "github" + }, + "original": { + "owner": "NixOS", + "ref": "nixos-24.05", + "repo": "nixpkgs", + "type": "github" + } + }, + "nixpkgs-unstable": { + "locked": { + "lastModified": 1723221148, + "narHash": "sha256-7pjpeQlZUNQ4eeVntytU3jkw9dFK3k1Htgk2iuXjaD8=", + "owner": "NixOS", + "repo": "nixpkgs", + "rev": "154bcb95ad51bc257c2ce4043a725de6ca700ef6", + "type": "github" + }, + "original": { + "owner": "NixOS", + "ref": "nixpkgs-unstable", + "repo": "nixpkgs", + "type": "github" + } + }, + "nixpkgs_2": { + "locked": { + "lastModified": 1719082008, + "narHash": "sha256-jHJSUH619zBQ6WdC21fFAlDxHErKVDJ5fpN0Hgx4sjs=", + "owner": "NixOS", + "repo": "nixpkgs", + "rev": "9693852a2070b398ee123a329e68f0dab5526681", + "type": "github" + }, + "original": { + "owner": "NixOS", + "ref": "nixpkgs-unstable", + "repo": "nixpkgs", + "type": "github" + } + }, + "nixpkgs_3": { + "locked": { + "lastModified": 1725001927, + "narHash": "sha256-eV+63gK0Mp7ygCR0Oy4yIYSNcum2VQwnZamHxYTNi+M=", + "owner": "NixOS", + "repo": "nixpkgs", + "rev": "6e99f2a27d600612004fbd2c3282d614bfee6421", + "type": "github" + }, + "original": { + "owner": "NixOS", + "ref": "nixos-24.05", + "repo": "nixpkgs", + "type": "github" + } + }, + "nixpkgs_4": { + "locked": { + "lastModified": 1729070438, + "narHash": "sha256-KOTTUfPkugH52avUvXGxvWy8ibKKj4genodIYUED+Kc=", + "owner": "NixOS", + "repo": "nixpkgs", + "rev": "5785b6bb5eaae44e627d541023034e1601455827", + "type": "github" + }, + "original": { + "owner": "NixOS", + "ref": "nixos-unstable", + "repo": "nixpkgs", + "type": "github" + } + }, + "nixpkgs_5": { + "locked": { + "lastModified": 1713805509, + "narHash": "sha256-YgSEan4CcrjivCNO5ZNzhg7/8ViLkZ4CB/GrGBVSudo=", + "owner": "NixOS", + "repo": "nixpkgs", + "rev": "1e1dc66fe68972a76679644a5577828b6a7e8be4", + "type": "github" + }, + "original": { + "owner": "NixOS", + "ref": "nixpkgs-unstable", + "repo": "nixpkgs", + "type": "github" + } + }, + "nixpkgs_6": { + "locked": { + "lastModified": 1726463316, + "narHash": "sha256-gI9kkaH0ZjakJOKrdjaI/VbaMEo9qBbSUl93DnU7f4c=", + "owner": "NixOS", + "repo": "nixpkgs", + "rev": "99dc8785f6a0adac95f5e2ab05cc2e1bf666d172", "type": "github" }, "original": { @@ -563,11 +880,11 @@ }, "nixstable": { "locked": { - "lastModified": 1723556749, - "narHash": "sha256-+CHVZnTnIYRLYsARInHYoWkujzcRkLY/gXm3s5bE52o=", + "lastModified": 1727672256, + "narHash": "sha256-9/79hjQc9+xyH+QxeMcRsA6hDyw6Z9Eo1/oxjvwirLk=", "owner": "nixos", "repo": "nixpkgs", - "rev": "4a92571f9207810b559c9eac203d1f4d79830073", + "rev": "1719f27dd95fd4206afb9cec9f415b539978827e", "type": "github" }, "original": { @@ -579,11 +896,11 @@ }, "nixunstable": { "locked": { - "lastModified": 1723991338, - "narHash": "sha256-Grh5PF0+gootJfOJFenTTxDTYPidA3V28dqJ/WV7iis=", + "lastModified": 1729413321, + "narHash": "sha256-I4tuhRpZFa6Fu6dcH9Dlo5LlH17peT79vx1y1SpeKt0=", "owner": "nixos", "repo": "nixpkgs", - "rev": "8a3354191c0d7144db9756a74755672387b702ba", + "rev": "1997e4aa514312c1af7e2bda7fad1644e778ff26", "type": "github" }, "original": { @@ -596,20 +913,20 @@ "nixvimstable": { "inputs": { "devshell": "devshell", - "flake-compat": "flake-compat", - "flake-parts": "flake-parts", + "flake-compat": "flake-compat_2", + "flake-parts": "flake-parts_2", "git-hooks": "git-hooks", "home-manager": "home-manager_2", "nix-darwin": "nix-darwin", - "nixpkgs": "nixpkgs", + "nixpkgs": "nixpkgs_3", "treefmt-nix": "treefmt-nix" }, "locked": { - "lastModified": 1723536338, - "narHash": "sha256-1bSEOtZBsAeCkg5vdDbDgOT3z91K8L/KE2s7J9hLYHw=", + "lastModified": 1725350106, + "narHash": "sha256-TaMMlI2KPJ3wCyxJk6AShOLhNuTeabHCnvYRkLBlEFs=", "owner": "nix-community", "repo": "nixvim", - "rev": "0b6aa80acbcb8387f2a4affb3dd22960ac2899aa", + "rev": "0f2c31e6a57a83ed4e6fa3adc76749620231055d", "type": "github" }, "original": { @@ -622,21 +939,21 @@ "nixvimunstable": { "inputs": { "devshell": "devshell_2", - "flake-compat": "flake-compat_3", - "flake-parts": "flake-parts_2", + "flake-compat": "flake-compat_4", + "flake-parts": "flake-parts_3", "git-hooks": "git-hooks_2", "home-manager": "home-manager_3", "nix-darwin": "nix-darwin_2", - "nixpkgs": "nixpkgs_2", + "nixpkgs": "nixpkgs_4", "nuschtosSearch": "nuschtosSearch", "treefmt-nix": "treefmt-nix_2" }, "locked": { - "lastModified": 1723816538, - "narHash": "sha256-h37ltjdifkd7iLtMtBXSBBeYSTuBEKMW6ClFoC7nReQ=", + "lastModified": 1729602958, + "narHash": "sha256-eKGQKlj1oShfR6uqE1RjB4CgQ3DBrMS4VPrGPDKq1J4=", "owner": "nix-community", "repo": "nixvim", - "rev": "00f32f0430f82c74919c72af84bc95bf5ae434e4", + "rev": "b076f006c6b0cc6644a651bd21d4449cc3e7e56d", "type": "github" }, "original": { @@ -648,11 +965,11 @@ }, "nurpkgs": { "locked": { - "lastModified": 1724159175, - "narHash": "sha256-3z9wRL+h+gTVFtecCUGrRaW6nvPPAtBCIDE9KAmZj7c=", + "lastModified": 1729607740, + "narHash": "sha256-t5KMIn74sJOQQGfn7W7oO7MppMJe2S2X8fvUZmRDjpU=", "owner": "nix-community", "repo": "NUR", - "rev": "0b86d5643d99e3982471f0d79e553871c6f35396", + "rev": "5d773635b50f6d3ab2af57d0e41dd8533c37238f", "type": "github" }, "original": { @@ -670,11 +987,11 @@ ] }, "locked": { - "lastModified": 1723367906, - "narHash": "sha256-v1qA4WBGDI2uH/TVqRwuXSBP341W681psbzYJ8zrjog=", + "lastModified": 1728905062, + "narHash": "sha256-W/lClt0bRgFRO0WFtytX/LEILpPNq+FOjIfESpkeu5c=", "owner": "NuschtOS", "repo": "search", - "rev": "6ca2c3ae05a915c160512bd41f6810f456c9b30d", + "rev": "f82d3e1c1c9d1eaeb91878519e2d27b27c66ce84", "type": "github" }, "original": { @@ -686,17 +1003,38 @@ "root": { "inputs": { "agenix": "agenix", + "btc": "btc", "darwin": "darwin_2", - "flake-utils": "flake-utils", + "flake-parts": "flake-parts", "hm": "hm", "hmunstable": "hmunstable", + "hooks": "hooks", "nix23_05": "nix23_05", "nixstable": "nixstable", "nixunstable": "nixunstable", "nixvimstable": "nixvimstable", "nixvimunstable": "nixvimunstable", "nurpkgs": "nurpkgs", - "wsl": "wsl" + "vsext": "vsext", + "wsl": "wsl", + "zed": "zed" + } + }, + "rust-analyzer-src": { + "flake": false, + "locked": { + "lastModified": 1726443025, + "narHash": "sha256-nCmG4NJpwI0IoIlYlwtDwVA49yuspA2E6OhfCOmiArQ=", + "owner": "rust-lang", + "repo": "rust-analyzer", + "rev": "94b526fc86eaa0e90fb4d54a5ba6313aa1e9b269", + "type": "github" + }, + "original": { + "owner": "rust-lang", + "ref": "nightly", + "repo": "rust-analyzer", + "type": "github" } }, "systems": { @@ -759,6 +1097,21 @@ "type": "github" } }, + "systems_5": { + "locked": { + "lastModified": 1681028828, + "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=", + "owner": "nix-systems", + "repo": "default", + "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e", + "type": "github" + }, + "original": { + "owner": "nix-systems", + "repo": "default", + "type": "github" + } + }, "treefmt-nix": { "inputs": { "nixpkgs": [ @@ -767,11 +1120,11 @@ ] }, "locked": { - "lastModified": 1723454642, - "narHash": "sha256-S0Gvsenh0II7EAaoc9158ZB4vYyuycvMGKGxIbERNAM=", + "lastModified": 1724833132, + "narHash": "sha256-F4djBvyNRAXGusJiNYInqR6zIMI3rvlp6WiKwsRISos=", "owner": "numtide", "repo": "treefmt-nix", - "rev": "349de7bc435bdff37785c2466f054ed1766173be", + "rev": "3ffd842a5f50f435d3e603312eefa4790db46af5", "type": "github" }, "original": { @@ -788,11 +1141,11 @@ ] }, "locked": { - "lastModified": 1723454642, - "narHash": "sha256-S0Gvsenh0II7EAaoc9158ZB4vYyuycvMGKGxIbERNAM=", + "lastModified": 1729242555, + "narHash": "sha256-6jWSWxv2crIXmYSEb3LEVsFkCkyVHNllk61X4uhqfCs=", "owner": "numtide", "repo": "treefmt-nix", - "rev": "349de7bc435bdff37785c2466f054ed1766173be", + "rev": "d986489c1c757f6921a48c1439f19bfb9b8ecab5", "type": "github" }, "original": { @@ -801,20 +1154,40 @@ "type": "github" } }, + "vsext": { + "inputs": { + "flake-compat": "flake-compat_5", + "flake-utils": "flake-utils_3", + "nixpkgs": "nixpkgs_5" + }, + "locked": { + "lastModified": 1729561800, + "narHash": "sha256-LRRLzpS7Rh6AzWempfz6xRmv09m4WLyeRKXpILGUnGY=", + "owner": "nix-community", + "repo": "nix-vscode-extensions", + "rev": "ba02ecf164ec8da6f4d33d1f1e270b4a84252d60", + "type": "github" + }, + "original": { + "owner": "nix-community", + "repo": "nix-vscode-extensions", + "type": "github" + } + }, "wsl": { "inputs": { - "flake-compat": "flake-compat_4", - "flake-utils": "flake-utils_3", + "flake-compat": "flake-compat_6", + "flake-utils": "flake-utils_4", "nixpkgs": [ "nixunstable" ] }, "locked": { - "lastModified": 1713528946, - "narHash": "sha256-IBQta+xrEaI2S5UmYrXcgV7Tu7rGLQu2V3TeJseLPSg=", + "lastModified": 1729494942, + "narHash": "sha256-c/WV0R0WWuK2UAjTCGntaa+y1UVPsTUJZXqwwKxcmYs=", "owner": "nix-community", "repo": "NixOS-WSL", - "rev": "63c1247e12f269396ed2df8cdec3aed1f0f3928c", + "rev": "f26ca94fdcfc1a3adfee70e4ed5e2d8b1bab4317", "type": "github" }, "original": { @@ -822,6 +1195,28 @@ "repo": "NixOS-WSL", "type": "github" } + }, + "zed": { + "inputs": { + "crane": "crane", + "fenix": "fenix", + "flake-compat": "flake-compat_7", + "nixpkgs": "nixpkgs_6" + }, + "locked": { + "lastModified": 1728487939, + "narHash": "sha256-HdiEVRssMJmn+ifa0oWhHzRXB9L4oyji0DZ3PopHSoY=", + "owner": "zed-industries", + "repo": "zed", + "rev": "f6d974f3b148c2d4f28b4ed97b9b6352915faeed", + "type": "github" + }, + "original": { + "owner": "zed-industries", + "ref": "v0.156.x", + "repo": "zed", + "type": "github" + } } }, "root": "root", diff --git a/flake.nix b/flake.nix index b9aa43e..eefe966 100644 --- a/flake.nix +++ b/flake.nix @@ -2,108 +2,121 @@ # your system. Help is available in the configuration.nix(5) man page # and in the NixOS manual (accessible by running ‘nixos-help’). { - description = "Greg's machines!"; + description = "Greg's machines!"; - inputs = { - agenix = { - url = "github:ryantm/agenix"; - inputs.nixpkgs.follows = "nixunstable"; - }; - darwin = { - url = "github:lnl7/nix-darwin/master"; - inputs.nixpkgs.follows = "nixunstable"; - }; - flake-utils.url = "github:numtide/flake-utils"; - hm = { - url = "github:nix-community/home-manager/release-24.05"; - inputs.nixpkgs.follows = "nixstable"; - }; - hmunstable = { - url = "github:nix-community/home-manager/master"; - inputs.nixpkgs.follows = "nixstable"; - }; - nixvimstable.url = "github:nix-community/nixvim/nixos-24.05"; - nixvimunstable.url = "github:nix-community/nixvim/main"; - nix23_05.url = "github:NixOS/nixpkgs/nixos-23.05"; - nixstable.url = "github:nixos/nixpkgs/nixos-24.05"; - nixunstable.url = "github:nixos/nixpkgs/nixos-unstable"; - nurpkgs.url = "github:nix-community/NUR"; - wsl = { - url = "github:nix-community/NixOS-WSL"; - inputs.nixpkgs.follows = "nixunstable"; - }; - }; + nixConfig = { + extra-substituters = [ + "https://greg-hellings.cachix.org" + "https://cache.garnix.io" + ]; + extra-trusted-public-keys = [ + "greg-hellings.cachix.org-1:y01Jl/L5evlhxdnUW6n56AiI1k8g1wxWhTxJCe7XSco=" + "cache.garnix.io:CTFPyKSLcx5RMJKfLo5EEPUObbA78b0YQ2DTCJXqr9g" + ]; + }; - outputs = { - agenix, - darwin, - flake-utils, - hm, - hmunstable, - nix23_05, - nixstable, - nixunstable, - nurpkgs, - wsl, + inputs = { + agenix = { + url = "github:ryantm/agenix"; + inputs.nixpkgs.follows = "nixunstable"; + }; + btc = { + url = "github:fort-nix/nix-bitcoin/release"; + }; + darwin = { + url = "github:lnl7/nix-darwin/master"; + inputs.nixpkgs.follows = "nixunstable"; + }; + flake-parts.url = "github:hercules-ci/flake-parts"; + hooks.url = "github:cachix/git-hooks.nix"; + hm = { + url = "github:nix-community/home-manager/release-24.05"; + inputs.nixpkgs.follows = "nixstable"; + }; + hmunstable = { + url = "github:nix-community/home-manager/master"; + inputs.nixpkgs.follows = "nixstable"; + }; + nixvimstable.url = "github:nix-community/nixvim/nixos-24.05"; + nixvimunstable.url = "github:nix-community/nixvim/main"; + nix23_05.url = "github:NixOS/nixpkgs/nixos-23.05"; + nixstable.url = "github:nixos/nixpkgs/nixos-24.05"; + nixunstable.url = "github:nixos/nixpkgs/nixos-unstable"; + nurpkgs.url = "github:nix-community/NUR"; + vsext.url = "github:nix-community/nix-vscode-extensions"; + wsl = { + url = "github:nix-community/NixOS-WSL"; + inputs.nixpkgs.follows = "nixunstable"; + }; + zed.url = "github:zed-industries/zed/v0.156.x"; + }; - self, - ...}@inputs: - let - local_overlay = import ./overlays; - overlays = [ - agenix.overlays.default - local_overlay - nurpkgs.overlay - ]; + outputs = + { self, ... }@top: + let + local_overlay = import ./overlays; + packages_overlay = ( + _: prev: + (import ./pkgs { + inherit self; + pkgs = prev; + }).packages + ); + overlays = [ + top.agenix.overlays.default + local_overlay + packages_overlay + top.nurpkgs.overlay + top.vsext.overlays.default + (_: _: { zed-editor = top.zed.packages.x86_64-linux.default; }) + ]; - in { - #checks = { - # x86_64-linux = { - # unstable = self.nixosConfigurations.jude.config.system.build.toplevel; - # stable = self.nixosConfigurations.linode.config.system.build.toplevel; - # }; - # aarch64-linux = { - # unstable = self.nixosConfigurations.nixos.config.system.build.toplevel; - # }; - #}; + in + top.flake-parts.lib.mkFlake { inputs = top; } { + systems = [ + "aarch64-linux" + "x86_64-linux" + "aarch64-darwin" + ]; - nixosConfigurations = (import ./hosts { inherit inputs overlays; }); + flake = { + nixosConfigurations = (import ./hosts { inherit top overlays; }); - darwinConfigurations = (import ./darwin { inherit inputs overlays; }); + darwinConfigurations = (import ./darwin { inherit top overlays; }); - homeConfigurations = (import ./home { inherit inputs overlays; }); + homeConfigurations = (import ./home { inherit top overlays; }); - devShells = (flake-utils.lib.eachSystemMap flake-utils.lib.allSystems (system: let - pkgs = import nixunstable { inherit system overlays; }; - in { - default = pkgs.mkShell { - buildInputs = with pkgs; [ - bashInteractive - curl - git - gnutar - gzip - inject - inject-darwin - tmux - vim - xonsh - ]; - }; - })); + overlays = { + default = packages_overlay; + local = local_overlay; + }; - overlays = { - default = local_overlay; - }; + modules = import ./modules; + }; - modules = import ./modules; - - packages = { - x86_64-linux = rec { - default = iso-beta; - iso = self.nixosConfigurations.iso.config.system.build.isoImage; - iso-beta = self.nixosConfigurations.iso-beta.config.system.build.isoImage; - }; - }; - }; + perSystem = + { + pkgs, + self', + system, + ... + }: + { + _module.args = { + pkgs = import top.nixstable { inherit system overlays; }; + }; + + imports = [ ./pkgs ]; + + checks = import ./checks.nix { + inherit system; + inherit (top) hooks; + }; + + devShells = import ./shells.nix { + inherit self' pkgs; + inherit (top) nixvimunstable; + }; + }; + }; } diff --git a/hardware-configuration.nix b/hardware-configuration.nix index dbb261b..d57844c 100644 --- a/hardware-configuration.nix +++ b/hardware-configuration.nix @@ -1,28 +1,37 @@ # Do not modify this file! It was generated by ‘nixos-generate-config’ # and may be overwritten by future invocations. Please make changes # to /etc/nixos/configuration.nix instead. -{ config, lib, pkgs, modulesPath, ... }: +{ + config, + lib, + modulesPath, + ... +}: { - imports = - [ (modulesPath + "/installer/scan/not-detected.nix") - ]; + imports = [ (modulesPath + "/installer/scan/not-detected.nix") ]; - boot.initrd.availableKernelModules = [ "xhci_pci" "thunderbolt" "nvme" "uas" "sd_mod" ]; + boot.initrd.availableKernelModules = [ + "xhci_pci" + "thunderbolt" + "nvme" + "uas" + "sd_mod" + ]; boot.initrd.kernelModules = [ ]; boot.kernelModules = [ "kvm-intel" ]; boot.extraModulePackages = [ ]; - fileSystems."/" = - { device = "/dev/disk/by-uuid/607b933f-2967-4652-b478-4d8e9aa38a0d"; - fsType = "btrfs"; - options = [ "subvol=@" ]; - }; + fileSystems."/" = { + device = "/dev/disk/by-uuid/607b933f-2967-4652-b478-4d8e9aa38a0d"; + fsType = "btrfs"; + options = [ "subvol=@" ]; + }; - fileSystems."/boot" = - { device = "/dev/disk/by-uuid/B31C-C1F4"; - fsType = "vfat"; - }; + fileSystems."/boot" = { + device = "/dev/disk/by-uuid/B31C-C1F4"; + fsType = "vfat"; + }; swapDevices = [ ]; diff --git a/home/default.nix b/home/default.nix index 2fc77f2..b6eb72b 100644 --- a/home/default.nix +++ b/home/default.nix @@ -1,26 +1,28 @@ -{ - inputs, - overlays, - ... -}: +{ top, overlays, ... }: rec { - greghellings = - let - system = "x86_64-linux"; - pkgs = (import inputs.nixunstable { inherit system overlays; }); - in inputs.hmunstable.lib.homeManagerConfiguration { - inherit pkgs; - modules = [ ./home.nix ]; - extraSpecialArgs = { - inherit inputs; - nixvim = inputs.nixvimunstable; - gui = false; - gnome = false; - host = "ivr"; - username = "gregory.hellings"; - }; - }; + greghellings = + let + system = "x86_64-linux"; + pkgs = ( + import top.nixunstable { + inherit system overlays; + config.allowUnfree = true; + } + ); + in + top.hmunstable.lib.homeManagerConfiguration { + inherit pkgs; + modules = [ ./home.nix ]; + extraSpecialArgs = { + inherit top; + nixvim = top.nixvimunstable; + gui = false; + gnome = false; + host = "ivr"; + username = "gregory.hellings"; + }; + }; - "gregory.hellings" = greghellings; + "gregory.hellings" = greghellings; } diff --git a/home/home.nix b/home/home.nix index ab46346..e268953 100644 --- a/home/home.nix +++ b/home/home.nix @@ -1,52 +1,48 @@ -{ pkgs, lib, - inputs, +{ + pkgs, + lib, host ? "most", nixvim, - ...}: + ... +}: -let - system = pkgs.system; -in { - nixpkgs.config.allowUnfreePredicate = (_: true); - imports = [ - nixvim.homeManagerModules.default - ./modules - ] ++ lib.optionals (builtins.pathExists ./hosts/${host}) [ ./hosts/${host} ]; + nixpkgs.config.allowUnfreePredicate = (_: true); + imports = [ + nixvim.homeManagerModules.default + ./modules + ] ++ lib.optionals (builtins.pathExists ./hosts/${host}) [ ./hosts/${host} ]; + programs.tmux = { + enable = true; + keyMode = "vi"; + terminal = "xterm-256color"; + customPaneNavigationAndResize = true; + extraConfig = (lib.strings.concatStringsSep "\n" [ "bind P paste-buffer" ]); + }; - programs.tmux = { - enable = true; - keyMode = "vi"; - terminal = "xterm-256color"; - customPaneNavigationAndResize = true; - extraConfig = (lib.strings.concatStringsSep "\n" [ - "bind P paste-buffer" - ]); - }; - - home.stateVersion = "23.05"; - home.packages = with pkgs; [ - bitwarden-cli - copier - diffutils - findutils - gh - git - gnupatch - hms - htop - inetutils - jq - nano - nix-prefetch - nmap - openssl - setup-ssh - tmux - tree - unzip - wget - zip - ]; + home.stateVersion = "23.05"; + home.packages = with pkgs; [ + bitwarden-cli + copier + diffutils + findutils + gh + git + gnupatch + hms + htop + inetutils + jq + nano + nix-prefetch + nmap + openssl + setup-ssh + tmux + tree + unzip + wget + zip + ]; } diff --git a/home/hosts/exodus/default.nix b/home/hosts/exodus/default.nix index b168ca0..ff9ec07 100644 --- a/home/hosts/exodus/default.nix +++ b/home/hosts/exodus/default.nix @@ -1,13 +1,15 @@ -{ pkgs, config, ... }: +{ pkgs, ... }: { - greg = { - vscodium = true; - development = true; - gnome = true; - gui = true; - }; - home.packages = with pkgs; [ - cargo - ]; + greg = { + vscodium = true; + development = true; + gnome = true; + gui = true; + }; + home.packages = with pkgs; [ + cargo + freeciv + #freeciv_qt + ]; } diff --git a/home/hosts/icdm-root/default.nix b/home/hosts/icdm-root/default.nix index d8147ea..04618ac 100644 --- a/home/hosts/icdm-root/default.nix +++ b/home/hosts/icdm-root/default.nix @@ -1,5 +1,4 @@ { ... }: { - } diff --git a/home/hosts/ivr/default.nix b/home/hosts/ivr/default.nix index 1d6d7dd..44009bb 100644 --- a/home/hosts/ivr/default.nix +++ b/home/hosts/ivr/default.nix @@ -1,52 +1,70 @@ -{ pkgs, lib, inputs, ...}: +{ + pkgs, + lib, + top, + ... +}: let - nix23 = import inputs.nix23_05 { - inherit (pkgs.stdenv) system; - overlays = [ inputs.self.overlays.default ]; - }; - py = nix23.python311.withPackages ( p: with p; [ - django - djangorestframework - django-rapyd-modernauth - environs - mysqlclient - pyyaml - ruamel-yaml - tox - ]); - x = pkgs.xonsh.override { - extraPackages = (ps: [ - pkgs.nur.repos.xonsh-xontribs.xonsh-direnv - pkgs.nur.repos.xonsh-xontribs.xontrib-vox - ]); - }; -in { - greg = { - development = true; - pypackage = py; - vscodium = true; - }; - home = { - packages = with pkgs; [ - aacs - ansible - bitwarden-cli - direnv - home-manager - insomnia - pipenv-ivr - poetry - x - ]; - file.".pip/pip.conf".text = (lib.strings.concatStringsSep "\n" [ - "[global]" - "retries = 1" - "index-url = https://pypi.python.org/simple" - "extra-index-url =" - " https://pypi.ivrtechnology.com/simple/" - " https://pypidev.ivrtechnology.com/simple/" - ]); - username = "gregory.hellings"; - homeDirectory = lib.mkForce "/home/gregory.hellings"; - }; + nix23 = import top.nix23_05 { + inherit (pkgs.stdenv) system; + overlays = [ top.self.overlays.default ]; + }; + py = nix23.python311.withPackages ( + p: with p; [ + pyyaml + ruamel-yaml + tox + ] + ); + x = pkgs.xonsh.override { + extraPackages = ( + ps: [ + pkgs.nur.repos.xonsh-xontribs.xonsh-direnv + pkgs.nur.repos.xonsh-xontribs.xontrib-vox + ps.xonsh-apipenv + pkgs.pipenv-ivr + ] + ); + }; +in +{ + greg = { + development = true; + gui = true; + pypackage = py; + vscodium = true; + }; + + nixpkgs.config = { + allowUnfree = true; + permittedInsecurePackages = [ "jitsi-meet-1.0.8043" ]; + }; + + home = { + packages = with pkgs; [ + aacs + ansible + bitwarden-cli + direnv + home-manager + mysql-workbench + pipenv-ivr + poetry + robo3t + x + ]; + file.".pip/pip.conf".text = ( + lib.strings.concatStringsSep "\n" [ + "[global]" + "retries = 1" + "index-url = https://pypi.python.org/simple" + "extra-index-url =" + " https://pypi.ivrtechnology.com/simple/" + " https://pypidev.ivrtechnology.com/simple/" + ] + ); + username = "gregory.hellings"; + homeDirectory = lib.mkForce "/home/gregory.hellings"; + }; + programs.tmux.shell = (lib.getExe x); } diff --git a/home/hosts/jude/default.nix b/home/hosts/jude/default.nix index 21dd59f..cdde455 100644 --- a/home/hosts/jude/default.nix +++ b/home/hosts/jude/default.nix @@ -1,17 +1,17 @@ { pkgs, ... }: { - home.packages = with pkgs; [ - (mumble.override { pulseSupport = true; }) - #logseq - ]; - greg = { - development = true; - gui = true; - sway = false; - gnome = true; - vscodium = true; - }; + home.packages = with pkgs; [ + (mumble.override { pulseSupport = true; }) + #logseq + ]; + greg = { + development = true; + gui = true; + sway = false; + gnome = false; + vscodium = true; + }; - programs.xonsh.sessionVariables.EFI_DIR = "${pkgs.OVMF.fd}/FV/"; + programs.xonsh.sessionVariables.EFI_DIR = "${pkgs.OVMF.fd}/FV/"; } diff --git a/home/hosts/work/default.nix b/home/hosts/work/default.nix index f14792d..e9d6627 100644 --- a/home/hosts/work/default.nix +++ b/home/hosts/work/default.nix @@ -1,9 +1,7 @@ { pkgs, ... }: { - greg.vscodium.enable = true; + greg.vscodium.enable = true; - home.packages = with pkgs; [ - brew - ]; + home.packages = with pkgs; [ brew ]; } diff --git a/home/modules/baseline/ansible.nix b/home/modules/baseline/ansible.nix index f4df8b6..ecc068c 100644 --- a/home/modules/baseline/ansible.nix +++ b/home/modules/baseline/ansible.nix @@ -1,28 +1,28 @@ { ... }: { - home.file.".ansible.cfg".text = '' -[defaults] -forks=10 -host_key_checking=False -# Also available: profile_roles -callback_enabled=timer,profile_tasks -stdout_callback=yaml -nocows=1 -cow_selection=tux -collections_path=~/src + home.file.".ansible.cfg".text = '' + [defaults] + forks=10 + host_key_checking=False + # Also available: profile_roles + callback_enabled=timer,profile_tasks + stdout_callback=yaml + nocows=1 + cow_selection=tux + collections_path=~/src -[ssh_connection] -pipelining=True -ssh_args = -o ControlMaster=auto -o ControlPersist=600s -o IdentitiesOnly=yes -o GSSAPIAuthentication=no -o StrictHostKeyChecking=no -control_path=%(directory)s/%%h-%%r -control_path_dir=/tmp + [ssh_connection] + pipelining=True + ssh_args = -o ControlMaster=auto -o ControlPersist=600s -o IdentitiesOnly=yes -o GSSAPIAuthentication=no -o StrictHostKeyChecking=no + control_path=%(directory)s/%%h-%%r + control_path_dir=/tmp -[callback_profile_tasks] -sort_order=descending + [callback_profile_tasks] + sort_order=descending -[galaxy] -role_skeleton_ignore = ^.git$,^.*/.git_keep$,\..*.swp -role_skeleton = ~/src/ansible_collections/meta_ansible_templates/role -''; + [galaxy] + role_skeleton_ignore = ^.git$,^.*/.git_keep$,\..*.swp + role_skeleton = ~/src/ansible_collections/meta_ansible_templates/role + ''; } diff --git a/home/modules/baseline/bash.nix b/home/modules/baseline/bash.nix index dc5087a..a8b6747 100644 --- a/home/modules/baseline/bash.nix +++ b/home/modules/baseline/bash.nix @@ -1,93 +1,93 @@ { pkgs, ... }: { - programs.bash = { - enable = true; - shellAliases = { - acp = "rsync --progress -ah"; - agbuild = "ansible-galaxy collection build"; - apub = "ansible-galaxy collection publish --api-key \${GALAXY_API_KEY}"; - calc = "bc"; - d = "deactivate"; - devroles = "cd ~/src/ansible_collections/devroles"; - gohome = "ssh greg@dns.greg-hellings.gmail.com.beta.tailscale.net -D localhost:10080"; - ll = "ls -l"; - molcol = "molecule -c ../../tests/molecule.yml"; - packaging = "cd ~/src/packaging"; - vdown = "vagrant destroy"; - vhalt = "vagrant halt"; - vos = "vagrant up --provision --provider openstack"; - vprov = "vagrant provision"; - vssh = "vagrant ssh"; - vup = "vagrant up --provision --provider libvirt"; - yaml2js = "python -c 'import sys, yaml, json; json.dump(yaml.load(sys.stdin), sys.stdout, indent=4)"; - }; - sessionVariables = { - ANSIBLE_COLLECTIONS_PATH="\${HOME}/src/"; - CLICOLOR = "1"; - EDITOR = "${pkgs.vim}/bin/vim"; - GIT_SSL_NO_VERIFY = "True"; - LSCOLORS = "ExGxBxDxCxEgEdxbxgxcxd"; - MAVEN_OPTS = " -Dmaven.wagon.http.ssl.insecure=true "; - OS_CLOUD = "default"; - SWORD_PATH = "\${HOME}/.sword"; - TIMEFORMAT = "%3Uu %3Ss %3lR %P%%"; - }; - profileExtra = '' -if [ -e /etc/profile ]; then - . /etc/profile -fi -''; - bashrcExtra = '' -function swordtag { - if [ x"$1" == "x" ]; then - echo "Please provide tag version" - return - fi - svn cp http://crosswire.org/svn/sword/branches/sword-1-8-x/ http://crosswire.org/svn/sword/tags/sword-$1/ -} + programs.bash = { + enable = true; + shellAliases = { + acp = "rsync --progress -ah"; + agbuild = "ansible-galaxy collection build"; + apub = "ansible-galaxy collection publish --api-key \${GALAXY_API_KEY}"; + calc = "bc"; + d = "deactivate"; + devroles = "cd ~/src/ansible_collections/devroles"; + gohome = "ssh greg@dns.greg-hellings.gmail.com.beta.tailscale.net -D localhost:10080"; + ll = "ls -l"; + molcol = "molecule -c ../../tests/molecule.yml"; + packaging = "cd ~/src/packaging"; + vdown = "vagrant destroy"; + vhalt = "vagrant halt"; + vos = "vagrant up --provision --provider openstack"; + vprov = "vagrant provision"; + vssh = "vagrant ssh"; + vup = "vagrant up --provision --provider libvirt"; + yaml2js = "python -c 'import sys, yaml, json; json.dump(yaml.load(sys.stdin), sys.stdout, indent=4)"; + }; + sessionVariables = { + ANSIBLE_COLLECTIONS_PATH = "\${HOME}/src/"; + CLICOLOR = "1"; + EDITOR = "${pkgs.vim}/bin/vim"; + GIT_SSL_NO_VERIFY = "True"; + LSCOLORS = "ExGxBxDxCxEgEdxbxgxcxd"; + MAVEN_OPTS = " -Dmaven.wagon.http.ssl.insecure=true "; + OS_CLOUD = "default"; + SWORD_PATH = "\${HOME}/.sword"; + TIMEFORMAT = "%3Uu %3Ss %3lR %P%%"; + }; + profileExtra = '' + if [ -e /etc/profile ]; then + . /etc/profile + fi + ''; + bashrcExtra = '' + function swordtag { + if [ x"$1" == "x" ]; then + echo "Please provide tag version" + return + fi + svn cp http://crosswire.org/svn/sword/branches/sword-1-8-x/ http://crosswire.org/svn/sword/tags/sword-$1/ + } -function newdock { - if [ x"$1" == "x" -o x"$2" == "x" ]; then - echo "expected arguments [name] [source]" - return - fi - podman run -P --privileged=true -e DISPLAY=$DISPLAY -v /tmp/.X11-unix:/tmp/.X11-unix -v "$(pwd):/dmnt" -t -i --name="$1" "$2" /bin/bash -} + function newdock { + if [ x"$1" == "x" -o x"$2" == "x" ]; then + echo "expected arguments [name] [source]" + return + fi + podman run -P --privileged=true -e DISPLAY=$DISPLAY -v /tmp/.X11-unix:/tmp/.X11-unix -v "$(pwd):/dmnt" -t -i --name="$1" "$2" /bin/bash + } -function rundock { - podman start -a -i "$1" -} + function rundock { + podman start -a -i "$1" + } -function ac { - source ~/venv/''${1}/bin/activate -} + function ac { + source ~/venv/''${1}/bin/activate + } -function py2env { - /usr/bin/virtualenv -p /usr/bin/python2 "''${HOME}/venv/''${1}" - "''${HOME}/venv/''${1}/bin/pip" install -U pip -} + function py2env { + /usr/bin/virtualenv -p /usr/bin/python2 "''${HOME}/venv/''${1}" + "''${HOME}/venv/''${1}/bin/pip" install -U pip + } -function py3env { - VENV_NAME="''${1}" - #PYVERSION="$(python3 -c "import sys;print(sys.version[:sys.version.find('.',2)])")" - #SITE_PACKAGES_PATH="/usr/lib64/python''${PYVERSION}/site-packages/" - #VENV_SITE_PACKAGES="''${HOME}/venv/''${VENV_NAME}/lib64/python''${PYVERSION}/site-packages/" - # Create the virtualenv and update pip to latest - /usr/bin/python3 -m venv --clear "''${HOME}/venv/''${VENV_NAME}" --system-site-packages - "''${HOME}/venv/''${1}/bin/python3" -m pip install -U pip - # Link SELinux into the environment if necessary - #if [ -d "''${SITE_PACKAGES_PATH}" ]; then - # ln -s "''${SITE_PACKAGES_PATH}/selinux" "''${VENV_SITE_PACKAGES}" - # ln -s ''${SITE_PACKAGES_PATH}/_selinux*.so "''${VENV_SITE_PACKAGES}" - #else - # echo "ERROR: LibSELinux not found for Python ''${PYVERSION}. Install system package to enable." - #fi -} + function py3env { + VENV_NAME="''${1}" + #PYVERSION="$(python3 -c "import sys;print(sys.version[:sys.version.find('.',2)])")" + #SITE_PACKAGES_PATH="/usr/lib64/python''${PYVERSION}/site-packages/" + #VENV_SITE_PACKAGES="''${HOME}/venv/''${VENV_NAME}/lib64/python''${PYVERSION}/site-packages/" + # Create the virtualenv and update pip to latest + /usr/bin/python3 -m venv --clear "''${HOME}/venv/''${VENV_NAME}" --system-site-packages + "''${HOME}/venv/''${1}/bin/python3" -m pip install -U pip + # Link SELinux into the environment if necessary + #if [ -d "''${SITE_PACKAGES_PATH}" ]; then + # ln -s "''${SITE_PACKAGES_PATH}/selinux" "''${VENV_SITE_PACKAGES}" + # ln -s ''${SITE_PACKAGES_PATH}/_selinux*.so "''${VENV_SITE_PACKAGES}" + #else + # echo "ERROR: LibSELinux not found for Python ''${PYVERSION}. Install system package to enable." + #fi + } -function unknown_host { - sed -i -e ''${1}d ~/.ssh/known_hosts -} -''; - }; + function unknown_host { + sed -i -e ''${1}d ~/.ssh/known_hosts + } + ''; + }; } diff --git a/home/modules/baseline/default.nix b/home/modules/baseline/default.nix index 8eb30b6..749fd47 100644 --- a/home/modules/baseline/default.nix +++ b/home/modules/baseline/default.nix @@ -1,13 +1,13 @@ { ... }: { - imports = [ - ./ansible.nix - ./bash.nix - ./direnv.nix - ./git.nix - ./ssh.nix - ./vim.nix - ./xonsh.nix - ]; + imports = [ + ./ansible.nix + ./bash.nix + ./direnv.nix + ./git.nix + ./ssh.nix + ./vim.nix + ./xonsh.nix + ]; } diff --git a/home/modules/baseline/direnv.nix b/home/modules/baseline/direnv.nix index c4bf504..5172706 100644 --- a/home/modules/baseline/direnv.nix +++ b/home/modules/baseline/direnv.nix @@ -1,8 +1,21 @@ -{ pkgs, ... }: +{ ... }: { - programs.direnv = { - enable = true; - nix-direnv.enable = true; - }; + programs.direnv = { + enable = true; + nix-direnv.enable = true; + stdlib = '' + layout_poetry() { + if [[ ! -f pyproject.toml ]]; then + echo "No pyproject.toml found" + exit 1 + fi + + venv="$(dirname "$(poetry run which python)")" + export VIRTUAL_ENV="$(echo "$venv" | rev | cut -d'/' -f2- | rev)" + export POETRY_ACTIVE=1 + PATH_add "$venv" + } + ''; + }; } diff --git a/home/modules/baseline/git.nix b/home/modules/baseline/git.nix index 4fcf317..4ba8685 100644 --- a/home/modules/baseline/git.nix +++ b/home/modules/baseline/git.nix @@ -1,31 +1,33 @@ { ... }: { - programs.git = { - enable = true; - userName = "Greg Hellings"; - userEmail = "greg.hellings@gmail.com"; - aliases = { - st = "status"; - ci = "commit"; - co = "checkout"; - ups = "push -u origin HEAD"; - amend = "commit --amend"; - }; - ignores = [ - ".*.swp" ".*.swo" ".*.swn" # vim - ".idea" # IntelliJ - ".DS_Store" # Macs - "Thumbs.db" # Windows - ".tox" # Tox temp directory - ".eclipse" # These next two are created by VSCodium plugins - ".bazelproject" - ]; - extraConfig = { - init.defaultBranch = "main"; - push.default = "upstream"; - pull.rebase = "false"; - tag.sort = "version:refname"; - }; - }; + programs.git = { + enable = true; + userName = "Greg Hellings"; + userEmail = "greg.hellings@gmail.com"; + aliases = { + st = "status"; + ci = "commit"; + co = "checkout"; + ups = "push -u origin HEAD"; + amend = "commit --amend"; + }; + ignores = [ + ".*.swp" + ".*.swo" + ".*.swn" # vim + ".idea" # IntelliJ + ".DS_Store" # Macs + "Thumbs.db" # Windows + ".tox" # Tox temp directory + ".eclipse" # These next two are created by VSCodium plugins + ".bazelproject" + ]; + extraConfig = { + init.defaultBranch = "main"; + push.default = "upstream"; + pull.rebase = "false"; + tag.sort = "version:refname"; + }; + }; } diff --git a/home/modules/baseline/ssh.nix b/home/modules/baseline/ssh.nix index 3baa14e..be93252 100644 --- a/home/modules/baseline/ssh.nix +++ b/home/modules/baseline/ssh.nix @@ -1,64 +1,74 @@ { lib, ... }: { - # Workaround to set the config value to user read-only - # This allows things like SSH in distrobox to read the config file just fine - home.file.".ssh/config" = { - target = ".ssh/config_source"; - onChange = ''cat ~/.ssh/config_source > ~/.ssh/config && chmod 600 ~/.ssh/config''; - }; - programs.ssh = { - enable = true; - serverAliveInterval = 60; + # Workaround to set the config value to user read-only + # This allows things like SSH in distrobox to read the config file just fine + home.file.".ssh/config" = { + target = ".ssh/config_source"; + onChange = ''cat ~/.ssh/config_source > ~/.ssh/config && chmod 600 ~/.ssh/config''; + }; + programs.ssh = { + enable = true; + serverAliveInterval = 60; - includes = ["config.local"]; + includes = [ "config.local" ]; - matchBlocks = - let - nas = { user = "admin"; }; - owned = { user = "greg"; }; - in { - inherit nas; + matchBlocks = + let + nas = { + user = "admin"; + }; + owned = { + user = "greg"; + }; + in + { + inherit nas; - "*" = { - dynamicForwards = [ { - port = 10240; - } ]; - }; + "*" = { + dynamicForwards = [ { port = 10240; } ]; + }; - "10.42.1.4" = lib.hm.dag.entryBefore ["10.42.*"] nas; - "nas.thehellings.lan" = nas; - "nas.greg-hellings.gmail.com.beta.tailscale.net" = nas; - chronicles = nas; - "chronicles.thehellings.lan" = lib.hm.dag.entryBefore [ "*.thehellings.lan"] nas; + "10.42.1.4" = lib.hm.dag.entryBefore [ "10.42.*" ] nas; + "nas.thehellings.lan" = nas; + "nas.greg-hellings.gmail.com.beta.tailscale.net" = nas; + chronicles = nas; + "chronicles.thehellings.lan" = lib.hm.dag.entryBefore [ "*.thehellings.lan" ] nas; - gh = { user = "git"; hostname = "github.com"; }; - "src" = { - user = "gitlab"; - hostname = "git.thehellings.lan"; - }; + gh = { + user = "git"; + hostname = "github.com"; + }; + "src" = { + user = "gitlab"; + hostname = "git.thehellings.lan"; + }; + ivr = { + user = "git"; + hostname = "gitlab.com"; + }; - "*.thehellings.lan" = owned; - "10.42.*" = owned; + "*.thehellings.lan" = owned; + "10.42.*" = owned; - "host.crosswire.org crosswire" = { - hostname = "host.crosswire.org"; - user = "ghellings"; - }; + "host.crosswire.org crosswire" = { + hostname = "host.crosswire.org"; + user = "ghellings"; + }; - fedpeople = { - hostname = "fedorapeople.org"; - user = "greghellings"; - }; + fedpeople = { + hostname = "fedorapeople.org"; + user = "greghellings"; + }; - "src.fedoraproject.org pkgs.fedoraproject.org" = { - user = "greghellings"; - }; + "src.fedoraproject.org pkgs.fedoraproject.org" = { + user = "greghellings"; + }; - "127.*".extraOptions = { - PubkeyAcceptedAlgorithms = "+ssh-rsa"; - HostkeyAlgorithms = "+ssh-rsa"; - }; - }; - }; + "127.*".extraOptions = { + PubkeyAcceptedAlgorithms = "+ssh-rsa"; + HostkeyAlgorithms = "+ssh-rsa"; + }; + }; + }; } diff --git a/home/modules/baseline/vim.nix b/home/modules/baseline/vim.nix index 91e0dbd..c14dc5d 100644 --- a/home/modules/baseline/vim.nix +++ b/home/modules/baseline/vim.nix @@ -1,126 +1,16 @@ -{ pkgs, ... }: - -let - vim-stabs = pkgs.vimUtils.buildVimPlugin { - name = "vim-stabs"; - src = pkgs.fetchFromGitHub { - owner = "Thyrum"; - repo = "vim-stabs"; - rev = "4654d4e000680e1f608b40f155af08873446ed63"; - sha256 = "0hi1c5zv38hwxbyrf11fz97r728jgbppz4is7fwzwhfrzhwbw0ga"; - }; - }; - - vim-xonsh = pkgs.vimUtils.buildVimPlugin { - name = "vim-xonsh"; - src = pkgs.fetchFromGitHub { - owner = "meatballs"; - repo = "vim-xonsh"; - rev = "2028aac"; - sha256 = "sha256-0+dqtlz8LeyOoSiS12rv8aLdzOMj31PuYAyDYWnpNzw="; - }; - }; -in { - home.packages = with pkgs; [ - ansible-language-server - pyright - ]; + config, + pkgs, + lib, + ... +}: - programs.nixvim = { - enable = true; - colorschemes.gruvbox.enable = true; - globals = { - indent_guides_enable_on_vim_startup = 1; - nix_recommended_style = 0; - }; - opts = { - background = "dark"; - backup = false; - copyindent = true; - cursorline = true; - expandtab = false; - hidden = true; - hlsearch = true; - ignorecase = true; - lazyredraw = true; - list = true; - listchars = "tab:→ ,extends:→,precedes:←,trail:·,eol:¬"; - mouse = "a"; - number = true; - preserveindent = true; - relativenumber = true; - shiftwidth = 4; - showcmd = true; - showmatch = true; - signcolumn = "yes"; - smartcase = true; - softtabstop = 4; - tabstop = 4; - # Setting for CtrlP - wildignore = "*.swp,*.pyc,*.class,.tox"; - wrap = false; - writebackup = false; - }; - keymaps = let - winMove = key: { mode = "n"; key = ""; action = "${key}"; }; - in [ { - mode = "n"; - key = ""; - action = ":BufExplorer"; - } { - mode = "n"; - key = ""; - action = ":NERDTreeToggle"; - } - (winMove "h") - (winMove "j") - (winMove "k") - (winMove "l") - ]; - plugins = { - airline.enable = true; - cmp.enable = true; - direnv.enable = true; - gitgutter.enable = true; - fugitive.enable = true; - fzf-lua = { - enable = true; - iconsEnabled = true; - keymaps = { - "" = { - action = "files"; - settings = { - previewers.cat.cmd = "${pkgs.coreutils}/bin/cat"; - winopts.height = 0.5; - }; - }; - "" = { - action = "git_files"; - settings = { - previewers.cat.cmd = "${pkgs.coreutils}/bin/cat"; - winopts.height = 0.5; - }; - }; - }; - profile = "fzf-vim"; - }; - notify.enable = true; - }; - extraConfigLua = builtins.replaceStrings [ "@git@" ] [ "${pkgs.git}/bin/git" ] (builtins.readFile ./vim/extra.lua); - extraConfigVim = builtins.readFile ./vim/extra.vimrc; - extraPlugins = with pkgs.vimPlugins; [ - bufexplorer - nerdtree - nvim-web-devicons # Be sure to install Hack Nerd Font and set it to your term default: https://gist.github.com/matthewjberger/7dd7e079f282f8138a9dc3b045ebefa0 - packer-nvim +{ + # The Hack font is used in the Fugitive sidebars + fonts.fontconfig.enable = true; + home.packages = [ (pkgs.nerdfonts.override { fonts = [ "Hack" ]; }) ]; - context-vim - vim-flake8 - vim-indent-guides - vim-xonsh - ]; - viAlias = true; - vimAlias = true; - }; + programs.nixvim = (import ./vim/config.nix { inherit config pkgs lib; }) // { + enable = true; + }; } diff --git a/home/modules/baseline/vim/config.nix b/home/modules/baseline/vim/config.nix new file mode 100644 index 0000000..0c96ab6 --- /dev/null +++ b/home/modules/baseline/vim/config.nix @@ -0,0 +1,180 @@ +{ + config, + pkgs, + lib, + ... +}: +let + vim-xonsh = pkgs.vimUtils.buildVimPlugin { + name = "vim-xonsh"; + src = pkgs.fetchFromGitHub { + owner = "meatballs"; + repo = "vim-xonsh"; + rev = "929f35e"; + hash = "sha256-ugHLu2Z9bTtQsIp4FQPKxgjVe9oZNjfQYrP+aHu+/uU="; + }; + }; +in +{ + colorschemes.gruvbox.enable = true; + globals = { + indent_guides_enable_on_vim_startup = 1; + nix_recommended_style = 0; + }; + opts = { + background = "dark"; + backup = false; + copyindent = true; + cursorline = true; + expandtab = false; + hidden = true; + hlsearch = true; + ignorecase = true; + lazyredraw = true; + list = true; + listchars = "tab:→ ,extends:→,precedes:←,trail:·,eol:¬"; + mouse = "a"; + number = true; + preserveindent = true; + relativenumber = true; + shiftwidth = 4; + showcmd = true; + showmatch = true; + signcolumn = "yes"; + smartcase = true; + softtabstop = 4; + tabstop = 4; + # Setting for CtrlP + wildignore = "*.swp,*.pyc,*.class,.tox"; + wrap = false; + writebackup = false; + }; + keymaps = + let + winMove = key: { + mode = "n"; + key = ""; + action = "${key}"; + }; + in + [ + { + mode = "n"; + key = ""; + action = ":BufExplorer"; + } + { + mode = "n"; + key = ""; + #action = ":NERDTreeToggle"; + action = ":Neotree toggle"; + } + { + mode = "n"; + key = ""; + action = ":Git"; + } + (winMove "h") + (winMove "j") + (winMove "k") + (winMove "l") + ]; + plugins = { + airline.enable = true; + cmp = { + enable = true; + autoEnableSources = true; + settings = { + sources = [ + { name = "nvim_lsp"; } + { + name = "buffer"; + group_index = 2; + } + { + name = "copilot-vim"; + group_index = 2; + } + { + name = "path"; + gruop_index = 3; + } + ]; + mapping = { + "" = "cmp.mapping.complete()"; + "" = "cmp.mapping.confirm({ select = true })"; + "" = "cmp.mapping.select_next_item()"; + "" = "cmp.mapping.select_prev_item()"; + "" = "cmp.mapping.abort()"; + }; + }; + }; + copilot-vim = { + enable = (config.nixpkgs.config ? "allowUnfree" && config.nixpkgs.config.allowUnfree); + settings.workspace_folders = [ "~/src/ivr" ]; + }; + direnv.enable = true; + gitgutter.enable = true; + fugitive.enable = true; + fzf-lua = { + enable = true; + keymaps = { + "" = { + action = "files"; + settings = { + previewers.cat.cmd = "${pkgs.coreutils}/bin/cat"; + winopts.height = 0.5; + }; + }; + "" = { + action = "git_files"; + settings = { + previewers.cat.cmd = "${pkgs.coreutils}/bin/cat"; + winopts.height = 0.5; + }; + }; + }; + profile = "fzf-vim"; + }; + lsp = { + enable = true; + servers = { + ansiblels.enable = true; + cmake.enable = true; + gopls.enable = true; + html.enable = true; + nixd.enable = true; + pylsp.enable = true; + pyright.enable = true; + rust_analyzer = { + # No need to have these installed on every one of my systems + installCargo = false; + installRustc = false; + enable = true; + }; + terraformls.enable = true; + }; + }; + neo-tree.enable = true; + notify.enable = true; + } // (if (lib.versionAtLeast lib.version "24.11") then { web-devicons.enable = true; } else { }); + userCommands = { + Ggr = { + command = "Ggrep! | cw | redraw!"; + nargs = "+"; + }; + }; + extraConfigLua = builtins.replaceStrings [ "@git@" ] [ "${pkgs.git}/bin/git" ] ( + builtins.readFile ./extra.lua + ); + extraConfigVim = builtins.readFile ./extra.vimrc; + extraPlugins = with pkgs.vimPlugins; [ + bufexplorer + + context-vim + vim-indent-guides + vim-xonsh + ]; + viAlias = true; + vimAlias = true; +} diff --git a/home/modules/baseline/xonsh.nix b/home/modules/baseline/xonsh.nix index c3517d4..89e76b5 100644 --- a/home/modules/baseline/xonsh.nix +++ b/home/modules/baseline/xonsh.nix @@ -1,72 +1,88 @@ -{ pkgs, config, lib, ... }: +{ pkgs, config, ... }: { - programs.xonsh = { - enable = true; + # Programs that are used in the settings file + home.packages = with pkgs; [ + bitwarden-cli + copier + git + gnused + nix-output-monitor + nvd + ]; - sessionVariables = { - CLICOLOR = 1; - EDITOR = "nvim"; - # vte_new_tab_cwd causes new Terminal tabs to open in the - # same CWD as the current tab - LESS_TERMCAP_mb = "\\033[01;31m"; # begin blinking - LESS_TERMCAP_md = "\\033[01;31m"; # begin bold - LESS_TERMCAP_me = "\\033[0m"; # end mode - LESS_TERMCAP_so = "\\033[01;44;36m"; # begin standout-mode (bottom of screen) - LESS_TERMCAP_se = "\\033[0m"; # end standout-mode - LESS_TERMCAP_us = "\\033[00;36m"; # begin underline - LESS_TERMCAP_ue = "\\033[0m"; # end underline - LIBMYSQL_ENABLE_CLEARTEXT_PLUGIN = "1"; - LSCOLORS = "ExGxBxDxCxEgEdxbxgxcxd"; - MAVEN_OPTS = " -Dmaven.wagon.http.ssl.insecure=true"; - OS_CLOUD = "default"; - PROMPT = "{vte_new_tab_cwd}{env_name}{BOLD_GREEN}{user}@{hostname}{BOLD_BLUE} {short_cwd}{branch_color}{curr_branch: {}}{RESET} {BOLD_BLUE}{prompt_end}{RESET} "; - SWORD_PATH = "${config.home.homeDirectory}/.sword/"; - TIMEFORMAT = "%3Uu %3Ss %3lR %P%%"; - # Tells vox where to find virtualenvs - VIRTUALENV_HOME = "${config.home.homeDirectory}/venv/"; - XONSH_COLOR_STYLE = "default"; + programs.xonsh = { + enable = true; - GOPATH = "${config.home.homeDirectory}/src/go"; - GOBIN = "${config.home.homeDirectory}/src/bin"; - }; + sessionVariables = { + CLICOLOR = 1; + EDITOR = "nvim"; + # vte_new_tab_cwd causes new Terminal tabs to open in the + # same CWD as the current tab + LESS_TERMCAP_mb = "\\033[01;31m"; # begin blinking + LESS_TERMCAP_md = "\\033[01;31m"; # begin bold + LESS_TERMCAP_me = "\\033[0m"; # end mode + LESS_TERMCAP_so = "\\033[01;44;36m"; # begin standout-mode (bottom of screen) + LESS_TERMCAP_se = "\\033[0m"; # end standout-mode + LESS_TERMCAP_us = "\\033[00;36m"; # begin underline + LESS_TERMCAP_ue = "\\033[0m"; # end underline + LIBMYSQL_ENABLE_CLEARTEXT_PLUGIN = "1"; + LSCOLORS = "ExGxBxDxCxEgEdxbxgxcxd"; + MAVEN_OPTS = " -Dmaven.wagon.http.ssl.insecure=true"; + OS_CLOUD = "default"; + PROMPT = "{vte_new_tab_cwd}{env_name}{BOLD_GREEN}{user}@{hostname}{BOLD_BLUE} {short_cwd}{branch_color}{curr_branch: {}}{RESET} {BOLD_BLUE}{prompt_end}{RESET} "; + SWORD_PATH = "${config.home.homeDirectory}/.sword/"; + TIMEFORMAT = "%3Uu %3Ss %3lR %P%%"; + # Tells vox where to find virtualenvs + VIRTUALENV_HOME = "${config.home.homeDirectory}/venv/"; + XONSH_COLOR_STYLE = "default"; - aliases = { - # Python related ones - ac = "vox activate"; - d = "vox deactivate"; + GOPATH = "${config.home.homeDirectory}/src/go"; + GOBIN = "${config.home.homeDirectory}/src/bin"; + }; - # Nix related ones - gl-nging = "sudo nixos-container run gitlab -- systemctl restart nginx"; - nixup = "nix flake lock --update-input"; - nixtest = "nixpkgs-review rev HEAD"; - nixdu = "sudo nix-store --gc --print-roots | egrep -v r\"^(/nix/var|/run/\\w+-system|\\{memory|/proc)\""; + aliases = { + # Python related ones + ac = "vox activate"; + d = "vox deactivate"; + s = "nix run \".#runserver\""; - # General - gh-personal = "$GH_CONFIG_DIR=\"${config.home.homeDirectory}/.config/gh/personal\" gh"; - ls = "ls --color"; - ll = "ls -l --color"; - tf = "terraform"; + # Nix related ones + gl-nging = "sudo nixos-container run gitlab -- systemctl restart nginx"; + nb = "nix build -L"; + nixdu = "sudo nix-store --gc --print-roots | egrep -v r\"^(/nix/var|/run/\\w+-system|\\{memory|/proc)\""; + nixtest = "nixpkgs-review rev HEAD"; + nixup = "nix flake lock --update-input"; + stable = "nix flake lock --update-input nixpkgs --update-input hm --update-input nixvimstable"; + unstable = "nix flake lock --update-input nixunstable --update-input hmunstable --update-input nixvimunstable --update-input nurpkgs --update-input vsext --update-input wsl"; + updateScript = "nix-shell maintainers/scripts/update.nix --argstr package"; - # Tailscale related ones - tsup = "sudo tailscale up"; - tspub = "sudo tailscale up --exit-node=linode"; - tshome = "sudo tailscale up --exit-node=2maccabees"; - tsclear = "sudo tailscale up --exit-node=''"; + # General + gh-personal = "$GH_CONFIG_DIR=\"${config.home.homeDirectory}/.config/gh/personal\" gh"; + ls = "ls --color"; + ll = "ls -l --color"; - # Vagrant related - vdown = "vagrant destroy"; - vhalt = "vagrant halt"; - vos = "vagrant up --provision --provider openstack"; - vprov = "vagrant provision"; - vup = "vagrant up --provision --provider libvirt"; - vssh = "vagrant ssh"; - }; + # Tailscale related ones + tsup = "sudo tailscale up"; + tspub = "sudo tailscale up --exit-node=linode"; + tshome = "sudo tailscale up --exit-node=2maccabees"; + tsclear = "sudo tailscale up --exit-node=''"; - configHeader = builtins.readFile ./xonsh_header.xsh; - configFooter = (builtins.readFile ./xonsh_footer.xsh) + (builtins.concatStringsSep "\n" [ - "with open('${pkgs.stdenv.cc}/nix-support/dynamic-linker', 'r') as fp:" - " $NIX_LD = fp.read().strip()" - ]); - }; + # Vagrant related + vdown = "vagrant destroy"; + vhalt = "vagrant halt"; + vos = "vagrant up --provision --provider openstack"; + vprov = "vagrant provision"; + vup = "vagrant up --provision --provider libvirt"; + vssh = "vagrant ssh"; + }; + + configHeader = builtins.readFile ./xonsh_header.xsh; + configFooter = + (builtins.readFile ./xonsh_footer.xsh) + + (builtins.concatStringsSep "\n" [ + "with open('${pkgs.stdenv.cc}/nix-support/dynamic-linker', 'r') as fp:" + " $NIX_LD = fp.read().strip()" + ]); + }; } diff --git a/home/modules/baseline/xonsh_footer.xsh b/home/modules/baseline/xonsh_footer.xsh index 4d435df..1867181 100644 --- a/home/modules/baseline/xonsh_footer.xsh +++ b/home/modules/baseline/xonsh_footer.xsh @@ -1,6 +1,6 @@ -# vim: set ft=python : +# vim: set ft=xonsh : -from tempfile import NamedTemporaryFile +from tempfile import NamedTemporaryFile, TemporaryDirectory def bw_unlock(): """Unlocks the BitWarden CLI and adds the resulting session code to the @@ -37,17 +37,15 @@ def _ivr(args): vpn("350Main", "IVR Technology") aliases['ivr'] = _ivr +def _ivr2(args): + vpn("gregory_hellings@ra.ivrtechnology.com", "IVR Technology") +aliases['ivr2'] = _ivr2 + def _glrestart(args): sudo nixos-container run gitlab -- systemctl restart gitlab sudo nixos-container run gitlab -- systemctl restart nginx aliases['glrestart'] = _glrestart -def _cfetch(args): - bw_unlock() - $CIRCLECI_CLI_TOKEN=$(bw get password CircleCI) - compass workspace exec bazel run src/go/compass.com/tools/circleci_results_cache/fetch/cmd/fetch:fetch -aliases['cfetch'] = _cfetch - def _aws_creds(args): $AWS_ACCESS_KEY_ID=$(bw get username "AWS Access Key") $AWS_SECRET_ACCESS_KEY=$(bw get password "AWS Access Key") @@ -55,10 +53,17 @@ aliases['aws_creds'] = _aws_creds def _rebuild(args): system = uname() + hostname = system.nodename if system.sysname == 'Darwin': darwin-rebuild --flake ~/.config/darwin switch else: - sudo nixos-rebuild switch + with TemporaryDirectory() as td: + pushd @(td) + nom build f"/etc/nixos#nixosConfigurations.{hostname}.config.system.build.toplevel" + if g`result`: + nvd diff /run/current-system result + sudo result/bin/switch-to-configuration switch + popd aliases['rebuild'] = _rebuild def _yaml2json(args, stdin=None, stdout=None): diff --git a/home/modules/default.nix b/home/modules/default.nix index 534373b..e170b71 100644 --- a/home/modules/default.nix +++ b/home/modules/default.nix @@ -1,14 +1,14 @@ { ... }: { - imports = [ - ./baseline - ./development.nix - ./gnome.nix - ./gui.nix - ./python.nix - ./sway.nix - ./vscodium.nix - ./xonsh.nix - ]; + imports = [ + ./baseline + ./development.nix + ./gnome.nix + ./gui.nix + ./python.nix + ./sway.nix + ./vscodium.nix + ./xonsh.nix + ]; } diff --git a/home/modules/development.nix b/home/modules/development.nix index 91a472c..61a1c1c 100644 --- a/home/modules/development.nix +++ b/home/modules/development.nix @@ -1,17 +1,29 @@ -{ config, pkgs, lib, ... }: +{ + config, + pkgs, + lib, + ... +}: let - packages = with pkgs; [ - cargo - mariadb - nix-update - nixfmt-rfc-style - nixpkgs-review - process-compose - ]; -in with lib; { - options.greg.development = mkEnableOption "Setup necessary development packages"; + packages = with pkgs; [ + bruno # but let's not talk about it + cargo + gh-copilot + mariadb + nix-eval-jobs + nix-fast-build + nix-output-monitor + nix-update + nixfmt-rfc-style + nixpkgs-review + nodejs + process-compose + zed-editor + ]; +in +with lib; +{ + options.greg.development = mkEnableOption "Setup necessary development packages"; - config = mkIf config.greg.development { - home.packages = packages; - }; + config = mkIf config.greg.development { home.packages = packages; }; } diff --git a/home/modules/gnome.nix b/home/modules/gnome.nix index 982cf70..ebdc05b 100644 --- a/home/modules/gnome.nix +++ b/home/modules/gnome.nix @@ -1,121 +1,133 @@ -{ config, pkgs, lib, ... }: +{ + config, + pkgs, + lib, + ... +}: let - gv = lib.hm.gvariant; - cfg = config.greg.gnome; + cfg = config.greg.gnome; +in +{ + options.greg.gnome = lib.mkEnableOption "Enable Gnome support and settings"; -in { - options.greg.gnome = lib.mkEnableOption "Enable Gnome support and settings"; + config = ( + lib.mkIf cfg { + programs.gnome-terminal = lib.mkIf (pkgs.system != "x86_64-darwin") { + enable = true; + showMenubar = true; + themeVariant = "dark"; + profile."95f3c68e-82f3-4f44-ac85-6e075fed80b0" = { + default = true; + customCommand = "xonsh -st best"; + loginShell = true; + scrollbackLines = 65535; + transparencyPercent = 50; + visibleName = "greg"; + }; + }; - config = (lib.mkIf cfg { - programs.gnome-terminal = lib.mkIf ( pkgs.system != "x86_64-darwin") { - enable = true; - showMenubar = true; - themeVariant = "dark"; - profile."95f3c68e-82f3-4f44-ac85-6e075fed80b0" = { - default = true; - customCommand = "xonsh -st best"; - loginShell = true; - scrollbackLines = 65535; - transparencyPercent = 50; - visibleName = "greg"; - }; - }; - - dconf.settings = { - "org/gnome/Disks" = { - image-dir-uri = "file:///home/greg/Downloads"; - }; - "org/gnome/desktop/interface" = { - clock-show-weekday = true; - color-scheme = "default"; - cursor-size = 24; - toolbar-style = "text"; - }; - "org/gnome/desktop/screensaver" = { - lock-delay = "uint32 0"; - lock-enabled = false; - }; - "org/gnome/desktop/wm/keybindings" = { - switch-applications = []; - switch-applications-backward = []; - switch-windows = ["Tab"]; - switch-windows-backward = [ "Tab" ]; - }; - "org/gnome/desktop/wm/preferences" = { - button-layout="icon:minimize,maximize,close"; - }; - "org/gnome/file-roller/listing" = { - list-mode = "as-folder"; - name-coloumn-width = 302; - show-path = true; - sort-method = "name"; - sort-type = "ascending"; - }; - "org/gnome/nautilus/preferences" = { - default-folder-viewer = "icon-view"; - search-filter-time-type = "last_modified"; - search-view = "list-view"; - }; - "org/gnome/shell" = { - enabled-extensions = [ - "appindicatorsupport@rgcjonas.gmail.com" - "Vitals@CoreCoding.com" - "window-list@gnome-shell-extensions.gcampax.github.com" - "gsconnect@andyholmes.github.io" - ]; - favorite-apps = [ - "org.gnome.Calendar.desktop" - "org.gnome.Nautilus.desktop" - "org.gnome.Console.desktop" - "firefox.desktop" - "vlc.desktop" - ]; - remember-mount-password = true; - }; - "org/gnome/shell/extensions/vitals" = { - hot-sensors = [ - "_memory_usage_" - "_system_load_1m_" - "__network-rx_max__" - "_temperature_k10temp_tccd1_" - "_temperature_k10temp_tctl_" - ]; - }; - "org/gnome/shell/overrides" = { - attach-modal-dialogs = true; - dynamic-workspaces = true; - edge-tiling = true; - focus-change-on-pointer-rest = true; - workspaces-only-on-primary = true; - }; - "org/gnome/shell/weather" = { - automation-location = true; - locations = "[<(uint32 2, <('Midlothian / Waxahachie, Mid-Way Regional Airport', 'KJWY', false, [(0.5664611473274288, -1.691437359323684)], @a(dd) [])>)>]"; - }; - "org/gnome/shell/window-switcher" = { - app-icon-mode = "both"; - current-workspace-only = true; - }; - "org/gtk/settings/file-chooser" = { - location-mode = "path-bar"; - show-hidden = false; - show-size-column = true; - sort-column = "modified"; - sort-directories-first = false; - sort-order = "descending"; - }; - "org/virt-manager/virt-manager/confirm" = { - delete-storage = true; - forcepoweroff = false; - }; - "org/virt-manager/virt-manager/details" = { - show-toolbar = true; - }; - "org/virt-manager/virt-manager/connections" = { - autoconnect = [ "qemu:///session" "qemu:///system" ]; - uris = [ "qemu:///session" "qemu:///system" ]; - }; - }; - }); + dconf.settings = { + "org/gnome/Disks" = { + image-dir-uri = "file:///home/greg/Downloads"; + }; + "org/gnome/desktop/interface" = { + clock-show-weekday = true; + color-scheme = "default"; + cursor-size = 24; + toolbar-style = "text"; + }; + "org/gnome/desktop/screensaver" = { + lock-delay = "uint32 0"; + lock-enabled = false; + }; + "org/gnome/desktop/wm/keybindings" = { + switch-applications = [ ]; + switch-applications-backward = [ ]; + switch-windows = [ "Tab" ]; + switch-windows-backward = [ "Tab" ]; + }; + "org/gnome/desktop/wm/preferences" = { + button-layout = "icon:minimize,maximize,close"; + }; + "org/gnome/file-roller/listing" = { + list-mode = "as-folder"; + name-coloumn-width = 302; + show-path = true; + sort-method = "name"; + sort-type = "ascending"; + }; + "org/gnome/nautilus/preferences" = { + default-folder-viewer = "icon-view"; + search-filter-time-type = "last_modified"; + search-view = "list-view"; + }; + "org/gnome/shell" = { + enabled-extensions = [ + "appindicatorsupport@rgcjonas.gmail.com" + "Vitals@CoreCoding.com" + "window-list@gnome-shell-extensions.gcampax.github.com" + "gsconnect@andyholmes.github.io" + ]; + favorite-apps = [ + "org.gnome.Calendar.desktop" + "org.gnome.Nautilus.desktop" + "org.gnome.Terminal.desktop" + "firefox.desktop" + "vlc.desktop" + ]; + remember-mount-password = true; + }; + "org/gnome/shell/extensions/vitals" = { + hot-sensors = [ + "_memory_usage_" + "_system_load_1m_" + "__network-rx_max__" + "_temperature_k10temp_tccd1_" + "_temperature_k10temp_tctl_" + ]; + }; + "org/gnome/shell/overrides" = { + attach-modal-dialogs = true; + dynamic-workspaces = true; + edge-tiling = true; + focus-change-on-pointer-rest = true; + workspaces-only-on-primary = true; + }; + "org/gnome/shell/weather" = { + automation-location = true; + locations = "[<(uint32 2, <('Midlothian / Waxahachie, Mid-Way Regional Airport', 'KJWY', false, [(0.5664611473274288, -1.691437359323684)], @a(dd) [])>)>]"; + }; + "org/gnome/shell/window-switcher" = { + app-icon-mode = "both"; + current-workspace-only = true; + }; + "org/gtk/settings/file-chooser" = { + location-mode = "path-bar"; + show-hidden = false; + show-size-column = true; + sort-column = "modified"; + sort-directories-first = false; + sort-order = "descending"; + }; + "org/virt-manager/virt-manager/confirm" = { + delete-storage = true; + forcepoweroff = false; + }; + "org/virt-manager/virt-manager/details" = { + show-toolbar = true; + }; + "org/virt-manager/virt-manager/connections" = { + autoconnect = [ + "qemu:///session" + "qemu:///system" + ]; + uris = [ + "qemu:///session" + "qemu:///system" + ]; + }; + }; + } + ); } diff --git a/home/modules/gui.nix b/home/modules/gui.nix index 85bdba8..badfef9 100644 --- a/home/modules/gui.nix +++ b/home/modules/gui.nix @@ -1,87 +1,168 @@ -{ config, pkgs, lib, ... }: +{ + config, + pkgs, + lib, + ... +}: let - cfg = config.greg.gui; + cfg = config.greg.gui; - excludes = systems: opts: ( - if ( builtins.all (x: pkgs.system != x) systems ) then opts else [] - ); + excludes = systems: opts: (if (builtins.all (x: pkgs.system != x) systems) then opts else [ ]); - # For now, we ignore this and don't install it - ffPkgs = pkgs.firefox.override { cfg.enableGnomeExtensions = true; }; + vars = { + XDG_CURRENT_DESKTOP = "GNOME"; + }; +in +{ + options.greg.gui = lib.mkEnableOption "Enable GUI programs"; - vars = { - XDG_CURRENT_DESKTOP = "GNOME"; - }; -in { - options.greg.gui = lib.mkEnableOption "Enable GUI programs"; + config = ( + lib.mkIf cfg { + # These packages are Linux only + home.packages = + with pkgs; + (excludes + [ + "x86_64-darwin" + "aarch64-darwin" + ] + [ + cdrtools + element-desktop + freetube + qpwgraph + vlc + x265 + ] + ) + ++ - config = (lib.mkIf cfg { - # These packages are Linux only - home.packages = with pkgs; ( excludes ["x86_64-darwin" "aarch64-darwin"] - [ - cdrtools - element-desktop - freetube - qpwgraph - vlc - x265 - ]) ++ + # x86_64-linux only + (excludes + [ + "x86_64-darwin" + "aarch64-darwin" + "aarch64-linux" + ] + [ + bitwarden + discord + endeavour + gnucash + jellyfin-media-player + #logseq + nextcloud-client + slack + ] + ) + ++ - # x86_64-linux only - ( excludes ["x86_64-darwin" "aarch64-darwin" "aarch64-linux"] - [ - bitwarden - discord - endeavour - gnucash - jellyfin-media-player - #logseq - nextcloud-client - slack - ]) ++ + # Items that are not supported on ARM/Linux + (excludes [ "aarch64-linux" ] [ + onlyoffice-bin + synology-drive-client + zoom-us + ]); - # Items that are not supported on ARM/Linux - ( excludes ["aarch64-linux"] - [ - onlyoffice-bin - synology-drive-client - zoom-us - ]); + programs.firefox = { + enable = (!pkgs.stdenv.hostPlatform.isDarwin); + package = pkgs.firefox-bin; + policies = { + DisableAppUpdate = true; + }; + profiles = { + default = { + bookmarks = import ./gui/bookmarks.nix; + id = 0; + isDefault = true; + search = { + default = "DuckDuckGo"; + force = true; + engines = { + Google.metaData.alias = "@g"; + "Nix Packages" = { + urls = [ + { + template = "https://search.nixos.org/packages"; + params = [ + { + name = "type"; + value = "packages"; + } + { + name = "query"; + value = "{searchTerms}"; + } + ]; + } + ]; + icon = "${pkgs.nixos-icons}/share/icons/hicolor/scalable/apps/nix-snowflake.svg"; + definedAliases = [ "@np" ]; + }; + "Nix Options" = { + urls = [ + { + template = "https://search.nixos.org/options"; + params = [ + { + name = "type"; + value = "packages"; + } + { + name = "query"; + value = "{searchTerms}"; + } + ]; + } + ]; + icon = "${pkgs.nixos-icons}/share/icons/hicolor/scalable/apps/nix-snowflake.svg"; + definedAliases = [ "@no" ]; + }; + "Noogle" = { + urls = [ + { + template = "https://noogle.dev/q"; + params = [ + { + name = "term"; + value = "{searchTerms}"; + } + ]; + } + ]; + icon = "${pkgs.nixos-icons}/share/icons/hicolor/scalable/apps/nix-snowflake.svg"; + definedAliases = [ "@nl" ]; + }; + }; + }; + settings = { + "app.update.auto" = false; + "browser.ctrlTab.sortByRecentlyUsed" = true; + "browser.startup.page" = 3; + "browser.startup.homepage" = "https://thehellings.com"; + "doh-rollout.doorhanger-decision" = "UIDisabled"; + "doh-rollout.doneFirstRun" = true; + "signon.rememberSignons" = false; + }; + extensions = with pkgs.nur.repos.rycee.firefox-addons; [ + bitwarden + gsconnect + foxyproxy-standard + multi-account-containers + octotree + okta-browser-plugin + refined-github + tree-style-tab + ublock-origin + ]; + }; + }; + }; - programs.firefox = { - enable = (! pkgs.stdenv.hostPlatform.isDarwin); - package = ffPkgs; - profiles = { - default = { - isDefault = true; - id = 0; - search.default = "DuckDuckGo"; - settings = { - "app.update.auto" = false; - "browser.ctrlTab.sortByRecentlyUsed" = true; - "browser.startup.page" = 3; - "browser.startup.homepage" = "https://thehellings.com"; - "doh-rollout.doorhanger-decision" = "UIDisabled"; - "doh-rollout.doneFirstRun" = true; - "signon.rememberSignons" = false; - }; - extensions = with pkgs.nur.repos.rycee.firefox-addons; [ - bitwarden - gsconnect - foxyproxy-standard - multi-account-containers - octotree - refined-github - tree-style-tab - ublock-origin - ]; - }; - }; - }; - - # This is supposed to be in support of Firefox, but I dunno... - programs.bash.sessionVariables = vars; - programs.xonsh.sessionVariables = vars; - }); + # This is supposed to be in support of Firefox, but I dunno... + programs.bash.sessionVariables = vars; + programs.xonsh.sessionVariables = vars; + } + ); } diff --git a/home/modules/gui/bookmarks.nix b/home/modules/gui/bookmarks.nix new file mode 100644 index 0000000..b033e13 --- /dev/null +++ b/home/modules/gui/bookmarks.nix @@ -0,0 +1,209 @@ +[ + { + name = "Toolbar"; + toolbar = true; + bookmarks = [ + { + name = "Ansible"; + bookmarks = [ + { + name = "Collection Index"; + url = "https://docs.ansible.com/ansible/latest/collections/index.html"; + } + ]; + } + { + name = "Church"; + bookmarks = [ + { + name = "DC4K"; + url = "https://www.dc4k.org/leaderzone/articles"; + } + ]; + } + { + name = "IVR"; + bookmarks = [ + { + name = "Dev"; + bookmarks = [ + { + name = "Core Survey"; + url = "https://webdev5.ivrtechnology.com/coreservices/survey/admin/"; + } + { + name = "Audio"; + url = "https://apidev1.ivrtechnology.com/coreservices/audio/admin/"; + } + { + name = "Tower"; + url = "https://towerrd1.ivrtechnology.com"; + } + ]; + } + { + name = "HC"; + bookmarks = [ + { + name = "Audio"; + url = "https://hcweb3.ivrtechnology.com/coreservices/audio/admin/"; + } + { + name = "Survey"; + url = "https://hcweb2.ivrtechnology.com/coreservices/survey/admin/"; + } + ]; + } + { + name = "PCI"; + bookmarks = [ + { + name = "Audio"; + url = "https://pciweb3.ivrtechnology.com/coreservices/audio/admin/"; + } + ]; + } + { + name = "Processes"; + bookmarks = [ + { + name = "Change Management"; + url = "https://ivrtg.atlassian.net/wiki/spaces/ITS/pages/13094842/Executing+Change+Management"; + } + { + name = "Okta"; + url = "https://engagesmart.okta.com/"; + } + { + name = "DB Request"; + url = "https://ivrtg.aha.io/develop/features/INFR-1073"; + } + { + name = "Server list"; + url = "https://ivrtg.atlassian.net/wiki/spaces/ITS/pages/13009166/350+Main"; + } + ]; + } + ]; + } + { + name = "Katie"; + bookmarks = [ + { + name = "Sports Forms"; + url = "https://midlothianisd.rankone.com/New/NewStudentList.aspx"; + } + { + name = "Skyward"; + url = "https://skyward.iscorp.com/MidlothianISDTXStuSTS/Session/Signin?area=Home&controller=Home&action=Index&logoutreason=TimedOut"; + } + ]; + } + { + name = "Nix"; + bookmarks = [ + { + name = "Package Versions"; + url = "https://lazamar.co.uk/nix-versions/?channel=nixpkgs-unstable&package=python3"; + } + { + name = "Channel status"; + url = "https://status.nixos.org/"; + } + { + name = "Home Manager options"; + url = "https://nix-community.github.io/home-manager/options.xhtml"; + } + { + name = "Flake Parts"; + url = "https://community.flake.parts/"; + } + { + name = "Language ref"; + url = "https://nix.dev/manual/nix/latest/language/index.html"; + } + { + name = "Builtin functions"; + url = "https://nix.dev/manual/nix/latest/language/builtins.html"; + } + { + name = "Nixpkgs functions"; + url = "https://ryantm.github.io/nixpkgs/functions/library/strings/#sec-functions-library-strings"; + } + { + name = "Noogle"; + url = "https://noogle.dev/"; + } + { + name = "NUR search"; + url = "https://nur.nix-community.org/"; + } + ]; + } + { + name = "Rust"; + bookmarks = [ + { + name = "Learn Rust"; + url = "https://www.rust-lang.org/learn"; + } + { + name = "Rust by Example"; + url = "https://doc.rust-lang.org/rust-by-example/hello.html"; + } + { + name = "Iced"; + url = "https://docs.rs/iced/latest/iced/"; + } + ]; + } + { + name = "Shopping"; + bookmarks = [ + { + name = "Cables"; + url = "https://www.pchcables.com"; + } + ]; + } + { + name = "SubTo"; + bookmarks = [ + { + name = "Kajabi"; + url = "https://www.subtocourse.com/login"; + } + { + name = "SubTo Fund"; + url = "https://frontend.koreconx.com/auth/login"; + } + { + name = "Creive Title"; + url = "https://getcreativetitle.com/"; + } + { + name = "REI Scripts"; + url = "https://reiconveyorbelt.com/no-excuses/"; + } + ]; + } + { + name = "Tools"; + bookmarks = [ + { + name = "Password Hash"; + url = "https://unix4lyfe.org/crypt/"; + } + { + name = "Keymap editor"; + url = "https://nickcoutsos.github.io/keymap-editor/"; + } + { + name = "Bitcoin dashboard"; + url = "http://hosea.home:60845"; + } + ]; + } + ]; + } +] diff --git a/home/modules/python.nix b/home/modules/python.nix index d7ed997..fdbd210 100644 --- a/home/modules/python.nix +++ b/home/modules/python.nix @@ -1,10 +1,15 @@ -{ config, pkgs, lib, ... }: { - options.greg.pypackage = lib.mkOption { - description = "Enable Gnome support and settings"; - type = lib.types.package; - default = pkgs.gregpy; - }; + config, + pkgs, + lib, + ... +}: +{ + options.greg.pypackage = lib.mkOption { + description = "Enable Gnome support and settings"; + type = lib.types.package; + default = pkgs.gregpy; + }; - config.home.packages = [ config.greg.pypackage ]; + config.home.packages = [ config.greg.pypackage ]; } diff --git a/home/modules/sway.nix b/home/modules/sway.nix index dc3b6e7..9a8112a 100644 --- a/home/modules/sway.nix +++ b/home/modules/sway.nix @@ -1,103 +1,115 @@ -{ config, pkgs, lib, ... }: +{ + config, + pkgs, + lib, + ... +}: let - cfg = config.greg.sway; - file_browser = { - pkg = pkgs.krusader; - path = "${pkgs.krusader}/bin/krusader"; - }; - term = "${pkgs.alacritty}/bin/alacritty"; - msg = "${pkgs.sway}/bin/swaymsg"; - sleep = "${pkgs.coreutils}/bin/sleep"; - workstation1 = pkgs.writeScriptBin "workstation1" (builtins.concatStringsSep "\n" [ - "${msg} \"workspace 1 ; exec ${pkgs.firefox}/bin/firefox ; split horizontal ; exec ${pkgs.element-desktop}/bin/element-desktop \"" - "${sleep} 1" - "${msg} '[app_id=\"firefox\"]' move left" - "${msg} '[instance=\"element\"]' \"layout tabbed ; exec ${term} \"" - "${msg} '[app_id=\"firefox\"]' move left" - "${sleep} 0.3" - "${msg} '[app_id=\"Alacritty\" workspace=\"1\"]' move right" - "${msg} '[app_id=\"firefox\"]' resize grow width 300 px" - ]); - workstation2 = pkgs.writeScriptBin "workstation2" (builtins.concatStringsSep "\n" [ - "${sleep} 5" - "${msg} \"workspace 2 ; exec ${term} ; layout tabbed\"" - ]); -in { - options.greg.sway = lib.mkEnableOption "Enable Sway support and settings"; + cfg = config.greg.sway; + file_browser = { + pkg = pkgs.krusader; + path = "${pkgs.krusader}/bin/krusader"; + }; + term = "${pkgs.alacritty}/bin/alacritty"; + msg = "${pkgs.sway}/bin/swaymsg"; + sleep = "${pkgs.coreutils}/bin/sleep"; + workstation1 = pkgs.writeScriptBin "workstation1" ( + builtins.concatStringsSep "\n" [ + "${msg} \"workspace 1 ; exec ${pkgs.firefox}/bin/firefox ; split horizontal ; exec ${pkgs.element-desktop}/bin/element-desktop \"" + "${sleep} 1" + "${msg} '[app_id=\"firefox\"]' move left" + "${msg} '[instance=\"element\"]' \"layout tabbed ; exec ${term} \"" + "${msg} '[app_id=\"firefox\"]' move left" + "${sleep} 0.3" + "${msg} '[app_id=\"Alacritty\" workspace=\"1\"]' move right" + "${msg} '[app_id=\"firefox\"]' resize grow width 300 px" + ] + ); + workstation2 = pkgs.writeScriptBin "workstation2" ( + builtins.concatStringsSep "\n" [ + "${sleep} 5" + "${msg} \"workspace 2 ; exec ${term} ; layout tabbed\"" + ] + ); +in +{ + options.greg.sway = lib.mkEnableOption "Enable Sway support and settings"; - config = (lib.mkIf cfg { - programs.swaylock.enable = true; + config = ( + lib.mkIf cfg { + programs.swaylock.enable = true; - wayland.windowManager.sway = let - mod = config.wayland.windowManager.sway.config.modifier; - in { - enable = true; - config = rec { - #fonts.size = 10.0; - keybindings = lib.mkOptionDefault { - "Mod4+l" = "exec ${pkgs.swaylock}/bin/swaylock -c 000000"; - "Mod4+h" = "exec ${pkgs.qpwgraph}/bin/qpwgraph -x /home/greg/sound/headphones.qpwgraph -m"; - "Mod4+m" = "exec ${pkgs.qpwgraph}/bin/qpwgraph -x /home/greg/sound/monitor.qpwgraph -m"; - "Mod4+b" = "exec ${pkgs.qpwgraph}/bin/qpwgraph -x /home/greg/sound/both.qpwgraph -m"; + wayland.windowManager.sway = + let + mod = config.wayland.windowManager.sway.config.modifier; + in + { + enable = true; + config = rec { + #fonts.size = 10.0; + keybindings = lib.mkOptionDefault { + "Mod4+l" = "exec ${pkgs.swaylock}/bin/swaylock -c 000000"; + "Mod4+h" = "exec ${pkgs.qpwgraph}/bin/qpwgraph -x /home/greg/sound/headphones.qpwgraph -m"; + "Mod4+m" = "exec ${pkgs.qpwgraph}/bin/qpwgraph -x /home/greg/sound/monitor.qpwgraph -m"; + "Mod4+b" = "exec ${pkgs.qpwgraph}/bin/qpwgraph -x /home/greg/sound/both.qpwgraph -m"; - "${mod}+Shift+Return" = file_browser.path; - }; - modifier = "Mod1"; - output = { - "Samsung Electric Company S24E650 H4ZN600985" = { - mode = "1920x1200"; - transform = "90"; - pos = "0 0"; - }; - "ViewSonic Corporation VA2252 Series VMT201800925" = { - mode = "1920x1080"; - pos = "200 1920"; - }; - }; - terminal = term; - startup = [ - { command = "${workstation1}/bin/workstation1"; } - { command = "${workstation2}/bin/workstation2"; } - ]; - }; - extraOptions = [ - "--unsupported-gpu" - ]; - extraSessionCommands = '' - export WLR_NO_HARDWARE_CURSORS=1 - ''; - systemd.enable = true; - wrapperFeatures = { - base = true; - gtk = true; - }; - }; - - home.pointerCursor = { - name = "Adwaita"; - package = pkgs.gnome.adwaita-icon-theme; - size = 12; - x11 = { - enable = true; - defaultCursor = "Adwaita"; - }; - }; + "${mod}+Shift+Return" = file_browser.path; + }; + modifier = "Mod1"; + output = { + "Samsung Electric Company S24E650 H4ZN600985" = { + mode = "1920x1200"; + transform = "90"; + pos = "0 0"; + }; + "ViewSonic Corporation VA2252 Series VMT201800925" = { + mode = "1920x1080"; + pos = "200 1920"; + }; + }; + terminal = term; + startup = [ + { command = "${workstation1}/bin/workstation1"; } + { command = "${workstation2}/bin/workstation2"; } + ]; + }; + extraOptions = [ "--unsupported-gpu" ]; + extraSessionCommands = '' + export WLR_NO_HARDWARE_CURSORS=1 + ''; + systemd.enable = true; + wrapperFeatures = { + base = true; + gtk = true; + }; + }; - home.packages = with pkgs; [ - arj - dpkg - kate - kget - krename - file_browser.pkg - p7zip - plocate - rpm - qpwgraph - xorg.xev - xorg.xmodmap - xxdiff - ]; - }); + home.pointerCursor = { + name = "Adwaita"; + package = pkgs.gnome.adwaita-icon-theme; + size = 12; + x11 = { + enable = true; + defaultCursor = "Adwaita"; + }; + }; + + home.packages = with pkgs; [ + arj + dpkg + kate + kget + krename + file_browser.pkg + p7zip + plocate + rpm + qpwgraph + xorg.xev + xorg.xmodmap + xxdiff + ]; + } + ); } diff --git a/home/modules/vscodium.nix b/home/modules/vscodium.nix index 0309533..b15979a 100644 --- a/home/modules/vscodium.nix +++ b/home/modules/vscodium.nix @@ -1,33 +1,63 @@ -{ pkgs, config, lib, ... }: +{ + pkgs, + config, + lib, + top, + ... +}: let - cfg = config.greg.vscodium; -in { - options.greg.vscodium = lib.mkEnableOption "Enable installation of VSCodium on the host"; + cfg = config.greg.vscodium; +in +{ + options.greg.vscodium = lib.mkEnableOption "Enable installation of VSCodium on the host"; - config = lib.mkIf cfg { - home.packages = with pkgs; [ - buildifier - gopls - ]; + config = lib.mkIf cfg { + home.packages = with pkgs; [ + buildifier + gopls + nixd # nix language server + ]; - # An alternative editor to vim, when I need it for some things - programs.vscode = { - enable = true; - package = pkgs.vscodium; - extensions = with pkgs.vscode-extensions; [ - arrterian.nix-env-selector - asvetliakov.vscode-neovim - bungcip.better-toml - golang.go - jnoortheen.nix-ide - mkhl.direnv - ms-python.python - rust-lang.rust-analyzer - vscjava.vscode-java-test - vscjava.vscode-java-dependency - vscjava.vscode-java-debug - ]; - }; - }; + # An alternative editor to vim, when I need it for some things + programs.vscode = { + enable = true; + package = pkgs.vscodium; + extensions = with top.vsext.extensions."${pkgs.stdenv.system}".vscode-marketplace; [ + arrterian.nix-env-selector + asvetliakov.vscode-neovim + batisteo.vscode-django + donjayamanne.python-environment-manager + golang.go + kevinrose.vsc-python-indent + jnoortheen.nix-ide + mkhl.direnv + ms-python.python + njpwerner.autodocstring + rust-lang.rust-analyzer + tamasfe.even-better-toml + vadimcn.vscode-lldb + vscjava.vscode-java-test + vscjava.vscode-java-dependency + vscjava.vscode-java-debug + wholroyd.jinja + ]; + userSettings = { + "direnv.restart.automatic" = true; + "direnv.path.executable" = (lib.getExe pkgs.direnv); + "extensions.autoUpdate" = false; + "extensions.experimental.affinity" = { + "asvetliakov.vscode-neovim" = 1; + }; + "git.openRepositoryInParentFolders" = "always"; + "search.exclude" = { + "**/.tox" = true; + }; + "terminal.integrated.defaultProfile.linux" = "tmux"; + "vscode-neovim.neovimInitVimPaths.darwin" = "~/.config/nvim/init.lua"; + "vscode-neovim.neovimInitVimPaths.linux" = "~/.config/nvim/init.lua"; + "workbench.settings.applyToAllProfiles" = [ "direnv.path.executable" ]; + }; + }; + }; } diff --git a/home/modules/xonsh.nix b/home/modules/xonsh.nix index 95bd862..2437e6d 100644 --- a/home/modules/xonsh.nix +++ b/home/modules/xonsh.nix @@ -1,94 +1,100 @@ -{ config, pkgs, lib, ... }: +{ config, lib, ... }: let - cfg = config.programs.xonsh; + cfg = config.programs.xonsh; -in with lib; { - options = { - programs.xonsh = { - enable = mkEnableOption "Enable the xonsh program"; +in +with lib; +{ + options = { + programs.xonsh = { + enable = mkEnableOption "Enable the xonsh program"; - sessionVariables = mkOption { - type = types.attrs; - default = {}; - example = { XONSH_TRACE_SUBPROC = true; }; - description = '' - Environment variables that will be set for the Xonsh session. - ''; - }; + sessionVariables = mkOption { + type = types.attrs; + default = { }; + example = { + XONSH_TRACE_SUBPROC = true; + }; + description = '' + Environment variables that will be set for the Xonsh session. + ''; + }; - aliases = mkOption { - type = types.attrsOf types.str; - default = {}; - example = literalExpression '' - { - ll = "ls -l"; - la = "ls -a"; - } - ''; - description = '' - An attribute set that maps aliases (the top level attribute names in - this option) to command strings or directly to build outputs. - ''; - }; + aliases = mkOption { + type = types.attrsOf types.str; + default = { }; + example = literalExpression '' + { + ll = "ls -l"; + la = "ls -a"; + } + ''; + description = '' + An attribute set that maps aliases (the top level attribute names in + this option) to command strings or directly to build outputs. + ''; + }; - configHeader = mkOption { - type = types.lines; - default = ""; - example = literalExpression '' - import os - import sys - ''; - description = "An arbitrary string to put at the top of the config file"; - }; + configHeader = mkOption { + type = types.lines; + default = ""; + example = literalExpression '' + import os + import sys + ''; + description = "An arbitrary string to put at the top of the config file"; + }; - configFooter = mkOption { - type = types.lines; - default = ""; - example = literalExpression '' - def _some_method(args): - do_command() - some_other_thing() - aliases['some_method'] = _some_method - ''; - description = "An arbitrary string to put at the end of the config file"; - }; - }; - }; + configFooter = mkOption { + type = types.lines; + default = ""; + example = literalExpression '' + def _some_method(args): + do_command() + some_other_thing() + aliases['some_method'] = _some_method + ''; + description = "An arbitrary string to put at the end of the config file"; + }; + }; + }; - config = - let - shortAliases = concatStringsSep "\n" ( - mapAttrsToList (k: v: "aliases['${k}']=r'${v}'") cfg.aliases - ); + config = + let + shortAliases = concatStringsSep "\n" (mapAttrsToList (k: v: "aliases['${k}']=r'${v}'") cfg.aliases); - listToPythonList = let - listInternals = args: - concatStringsSep "\n" (map (v: "'${v}'") args); - in list: "[${listInternals list}]"; + listToPythonList = + let + listInternals = args: concatStringsSep "\n" (map (v: "'${v}'") args); + in + list: "[${listInternals list}]"; - sessionVars = concatStringsSep "\n" ( - mapAttrsToList (k: v: - if builtins.typeOf v == "string" then - "\$${k} = '${v}'" - else if builtins.typeOf v == "list" then - "\$${k} = ${listToPythonList}" - else if builtins.typeOf v == "int" then - "\$${k} = ${toString v}" - else "" - ) cfg.sessionVariables - ); + sessionVars = concatStringsSep "\n" ( + mapAttrsToList ( + k: v: + if builtins.typeOf v == "string" then + "\$${k} = '${v}'" + else if builtins.typeOf v == "list" then + "\$${k} = ${listToPythonList}" + else if builtins.typeOf v == "int" then + "\$${k} = ${toString v}" + else + "" + ) cfg.sessionVariables + ); - in mkIf cfg.enable { + in + mkIf cfg.enable { - home.file.".xonshrc".text = '' -${cfg.configHeader} + home.file.".xonshrc".text = '' + ${cfg.configHeader} -${sessionVars} + ${sessionVars} -${shortAliases} + ${shortAliases} -${cfg.configFooter} -''; - }; + ${cfg.configFooter} + ''; + }; } diff --git a/hosts/default.nix b/hosts/default.nix index 979c877..334be65 100644 --- a/hosts/default.nix +++ b/hosts/default.nix @@ -1,65 +1,76 @@ -{ inputs, overlays, ... }: +{ top, overlays, ... }: let - wsl = args: (unstable (args // { extraMods = [ inputs.wsl.nixosModules.wsl ]; })); - unstable = args: (machine (args // { - channel = inputs.nixunstable; - hm = inputs.hmunstable; - nixvim = inputs.nixvimunstable; - })); - machine = { - channel ? inputs.nixstable, - extraMods ? [], - name, - system ? "x86_64-linux", - hm ? inputs.hm, - nixvim ? inputs.nixvimstable, - }: - let - nixpkgs = import channel { - inherit system; - }; - # Use this to include modules directly from a repo - nurNoPkg = import inputs.nurpkgs { - nurpkgs = nixpkgs; - }; - in channel.lib.nixosSystem { - inherit system; - specialArgs = { inherit nixpkgs inputs overlays; }; - modules = [ - { - nixpkgs.overlays = overlays; - home-manager = { - useGlobalPkgs = true; - useUserPackages = true; - users.greg = import ../home/home.nix; - extraSpecialArgs = { - inherit inputs overlays nixvim; - home = "/home/greg"; - host = name; - }; - backupFileExtension = "bkp"; - }; - } - inputs.agenix.nixosModules.default - hm.nixosModules.home-manager - inputs.self.modules.nixosModule - inputs.nurpkgs.nixosModules.nur - ./${name} - ] ++ extraMods; - }; -in { - genesis = machine { name = "genesis"; }; - exodus = unstable { name = "exodus"; }; - jude = unstable { name = "jude"; }; - icdm-root = unstable { name = "icdm-root"; }; - linode = machine { name = "linode"; }; - hosea = unstable { name = "hosea"; }; - jeremiah = unstable { name = "jeremiah"; }; - myself = unstable { name = "myself"; }; - iso = machine { name = "iso"; }; - iso-beta = unstable { name = "iso"; }; - # nix build '.#nixosConfigurations.wsl.config.system.build.installer' - nixos = wsl { name = "wsl"; system = "aarch64-linux"; }; - # nix build '.#nixosConfigurations.wsl-aarch.config.system.build.installer' - nixos-arm = wsl { name = "wsl"; system = "aarch64-linux"; }; + wsl = args: (unstable (args // { extraMods = [ top.wsl.nixosModules.wsl ]; })); + unstable = + args: + (machine ( + args + // { + channel = top.nixunstable; + hm = top.hmunstable; + nixvim = top.nixvimunstable; + } + )); + machine = + { + channel ? top.nixstable, + extraMods ? [ ], + name, + system ? "x86_64-linux", + hm ? top.hm, + nixvim ? top.nixvimstable, + }: + let + nixpkgs = import channel { inherit system; }; + in + channel.lib.nixosSystem { + inherit system; + specialArgs = { + inherit nixpkgs top overlays; + inherit (top) self; + }; + modules = [ + { + nixpkgs.overlays = overlays; + home-manager = { + useGlobalPkgs = true; + useUserPackages = true; + users.greg = import ../home/home.nix; + extraSpecialArgs = { + inherit top overlays nixvim; + home = "/home/greg"; + host = name; + }; + backupFileExtension = "bkp"; + }; + } + top.agenix.nixosModules.default + hm.nixosModules.home-manager + top.self.modules.nixosModule + top.nurpkgs.nixosModules.nur + ./${name} + ] ++ extraMods; + }; +in +{ + genesis = machine { name = "genesis"; }; + exodus = unstable { name = "exodus"; }; + jude = unstable { name = "jude"; }; + icdm-root = unstable { name = "icdm-root"; }; + linode = machine { name = "linode"; }; + hosea = unstable { name = "hosea"; }; + jeremiah = unstable { name = "jeremiah"; }; + myself = unstable { name = "myself"; }; + iso = machine { name = "iso"; }; + iso-beta = unstable { name = "iso"; }; + # nix build '.#nixosConfigurations.wsl.config.system.build.installer' + nixos = wsl { + name = "wsl"; + system = "aarch64-linux"; + }; + # nix build '.#nixosConfigurations.wsl-aarch.config.system.build.installer' + nixos-arm = wsl { + name = "wsl"; + system = "aarch64-linux"; + }; } diff --git a/hosts/exodus/default.nix b/hosts/exodus/default.nix index 00e0556..3d5458d 100644 --- a/hosts/exodus/default.nix +++ b/hosts/exodus/default.nix @@ -1,24 +1,30 @@ -{ pkgs, config, ... }: +{ config, ... }: { - imports = [ - ./hardware-configuration.nix - ../jude/printing.nix - ]; + imports = [ ./hardware-configuration.nix ]; - boot.loader = { - systemd-boot.enable = true; - efi.canTouchEfiVariables = true; - }; + boot = { + loader = { + systemd-boot.enable = true; + efi.canTouchEfiVariables = true; + }; + binfmt.emulatedSystems = [ + "i686-linux" + "aarch64-linux" + ]; + }; - networking.hostName = "exodus"; - greg = { - home = true; - gnome.enable = true; - tailscale.enable = true; - vmdev = { - enable = true; - system = "intel"; - }; - }; + nix.settings.extra-platforms = config.boot.binfmt.emulatedSystems; + + networking.hostName = "exodus"; + greg = { + home = true; + gnome.enable = true; + print.enable = true; + tailscale.enable = true; + vmdev = { + enable = true; + system = "intel"; + }; + }; } diff --git a/hosts/exodus/hardware-configuration.nix b/hosts/exodus/hardware-configuration.nix index dbb261b..d57844c 100644 --- a/hosts/exodus/hardware-configuration.nix +++ b/hosts/exodus/hardware-configuration.nix @@ -1,28 +1,37 @@ # Do not modify this file! It was generated by ‘nixos-generate-config’ # and may be overwritten by future invocations. Please make changes # to /etc/nixos/configuration.nix instead. -{ config, lib, pkgs, modulesPath, ... }: +{ + config, + lib, + modulesPath, + ... +}: { - imports = - [ (modulesPath + "/installer/scan/not-detected.nix") - ]; + imports = [ (modulesPath + "/installer/scan/not-detected.nix") ]; - boot.initrd.availableKernelModules = [ "xhci_pci" "thunderbolt" "nvme" "uas" "sd_mod" ]; + boot.initrd.availableKernelModules = [ + "xhci_pci" + "thunderbolt" + "nvme" + "uas" + "sd_mod" + ]; boot.initrd.kernelModules = [ ]; boot.kernelModules = [ "kvm-intel" ]; boot.extraModulePackages = [ ]; - fileSystems."/" = - { device = "/dev/disk/by-uuid/607b933f-2967-4652-b478-4d8e9aa38a0d"; - fsType = "btrfs"; - options = [ "subvol=@" ]; - }; + fileSystems."/" = { + device = "/dev/disk/by-uuid/607b933f-2967-4652-b478-4d8e9aa38a0d"; + fsType = "btrfs"; + options = [ "subvol=@" ]; + }; - fileSystems."/boot" = - { device = "/dev/disk/by-uuid/B31C-C1F4"; - fsType = "vfat"; - }; + fileSystems."/boot" = { + device = "/dev/disk/by-uuid/B31C-C1F4"; + fsType = "vfat"; + }; swapDevices = [ ]; diff --git a/hosts/genesis/acme.nix b/hosts/genesis/acme.nix index 0d43069..6eb15fd 100644 --- a/hosts/genesis/acme.nix +++ b/hosts/genesis/acme.nix @@ -1,62 +1,75 @@ -{ pkgs, config, lib, ... }: +{ + pkgs, + config, + lib, + ... +}: let - address = (builtins.elemAt config.networking.interfaces.ens18.ipv4.addresses 0).address; - root_ca = pkgs.writeText "root_ca.crt" (builtins.readFile ../../ca/root_ca.crt); - intermediate_ca = pkgs.writeText "intermediate_ca.crt" (builtins.readFile ../../ca/intermediate_ca.crt); -in { - age.secrets.acme_password = { - file = ../../secrets/acme_password.age; - }; - age.secrets.intermediate_ca_key = { - file = ../../secrets/ca/intermediate_key.age; - }; - age.secrets.root_ca_key.file = ../../secrets/ca/root_key.age; - systemd.services.step-ca.serviceConfig.Environment = lib.mkForce ["STEPDEBUG=1" "HOME=%S/step-ca"]; - services.step-ca = { - inherit address; - enable = false; - intermediatePasswordFile = config.age.secrets.acme_password.path; - openFirewall = true; - port = 8443; - settings = { - root = root_ca; - federatedRoots = null; - cert = intermediate_ca; - key = config.age.secrets.intermediate_ca_key.path; - dnsNames = [ - "10.42.1.5" - "acme.thehellings.lan" - ]; - logger.format = "text"; - db = { - type = "badgerv2"; - dataSource = "/var/lib/step-ca/db"; - badgerFileLoadingMode = ""; - }; - authority.provisioners = [ { - type = "JWK"; - name = "greg@thehellings.com"; - key = { - use = "sig"; - kty = "EC"; - kid = "1GOpOttYLZtx7XiG79ZycbGcG4ptL0czfohK35SZOEI"; - crv = "P-256"; - alg = "ES256"; - x = "YEWVj5CCoqWQXWqmL0UuORlFY9IEOLcg1jpG1o-wGx4"; - y = "MEpqnJp60VV-SpFtb6m8U-VAYut7R_PKFm07xl7MjBk"; - }; - encryptedKey = "eyJhbGciOiJQQkVTMi1IUzI1NitBMTI4S1ciLCJjdHkiOiJqd2sranNvbiIsImVuYyI6IkEyNTZHQ00iLCJwMmMiOjYwMDAwMCwicDJzIjoieWdfb0lfbWgwbHhPRXdjUTBsd0FnUSJ9.ivdQUFEhs2U8PUBYr8AhQl3hHdb4spF4jvXgqY_hiVgpjB-z3Nn9Uw.u7vrNht_3WD1G97q.mbydlpAQxjtKLkOmmDOUczqscRDPqrUyoPJ1uqXcJDH3vs4KiYlrKRcFLjPy9sWzEL1iIrqjwf3U-3AAx1KNAg7frs2D__MGfOO-U5SdQDVJVAND7KpWOJGJVSb0xioCA6-8ldlP_REqu4ENmkkdw0_6Is2b0p7ZFKqke_fqOOs7osqFAfbMb_WzEWrACLn5A5-Teh2rpEgR-z9zipN6MSEqE6VIQ2BXuv70aHWhslNe1MK1OgTYm9CqA47EMYvQ7HQLPDZAbP56WK84yJLktoXMmnkaKeTtvER0dh4ufyjJHBhecnEranbR5rHc_jV8_qvyWhlqbCrOU_8bWrk.a9SH_q3GKIUsOUSRWkDxQg"; - } ]; - tls = { - cipherSuites = [ - "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256" - "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256" - ]; - minVersion = 1.2; - maxVersion = 1.3; - renegotiation = false; - }; - }; - }; + address = (builtins.elemAt config.networking.interfaces.ens18.ipv4.addresses 0).address; + root_ca = pkgs.writeText "root_ca.crt" (builtins.readFile ../../ca/root_ca.crt); + intermediate_ca = pkgs.writeText "intermediate_ca.crt" ( + builtins.readFile ../../ca/intermediate_ca.crt + ); +in +{ + age.secrets.acme_password = { + file = ../../secrets/acme_password.age; + }; + age.secrets.intermediate_ca_key = { + file = ../../secrets/ca/intermediate_key.age; + }; + age.secrets.root_ca_key.file = ../../secrets/ca/root_key.age; + systemd.services.step-ca.serviceConfig.Environment = lib.mkForce [ + "STEPDEBUG=1" + "HOME=%S/step-ca" + ]; + services.step-ca = { + inherit address; + enable = false; + intermediatePasswordFile = config.age.secrets.acme_password.path; + openFirewall = true; + port = 8443; + settings = { + root = root_ca; + federatedRoots = null; + cert = intermediate_ca; + key = config.age.secrets.intermediate_ca_key.path; + dnsNames = [ + "10.42.1.5" + "acme.thehellings.lan" + ]; + logger.format = "text"; + db = { + type = "badgerv2"; + dataSource = "/var/lib/step-ca/db"; + badgerFileLoadingMode = ""; + }; + authority.provisioners = [ + { + type = "JWK"; + name = "greg@thehellings.com"; + key = { + use = "sig"; + kty = "EC"; + kid = "1GOpOttYLZtx7XiG79ZycbGcG4ptL0czfohK35SZOEI"; + crv = "P-256"; + alg = "ES256"; + x = "YEWVj5CCoqWQXWqmL0UuORlFY9IEOLcg1jpG1o-wGx4"; + y = "MEpqnJp60VV-SpFtb6m8U-VAYut7R_PKFm07xl7MjBk"; + }; + encryptedKey = "eyJhbGciOiJQQkVTMi1IUzI1NitBMTI4S1ciLCJjdHkiOiJqd2sranNvbiIsImVuYyI6IkEyNTZHQ00iLCJwMmMiOjYwMDAwMCwicDJzIjoieWdfb0lfbWgwbHhPRXdjUTBsd0FnUSJ9.ivdQUFEhs2U8PUBYr8AhQl3hHdb4spF4jvXgqY_hiVgpjB-z3Nn9Uw.u7vrNht_3WD1G97q.mbydlpAQxjtKLkOmmDOUczqscRDPqrUyoPJ1uqXcJDH3vs4KiYlrKRcFLjPy9sWzEL1iIrqjwf3U-3AAx1KNAg7frs2D__MGfOO-U5SdQDVJVAND7KpWOJGJVSb0xioCA6-8ldlP_REqu4ENmkkdw0_6Is2b0p7ZFKqke_fqOOs7osqFAfbMb_WzEWrACLn5A5-Teh2rpEgR-z9zipN6MSEqE6VIQ2BXuv70aHWhslNe1MK1OgTYm9CqA47EMYvQ7HQLPDZAbP56WK84yJLktoXMmnkaKeTtvER0dh4ufyjJHBhecnEranbR5rHc_jV8_qvyWhlqbCrOU_8bWrk.a9SH_q3GKIUsOUSRWkDxQg"; + } + ]; + tls = { + cipherSuites = [ + "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256" + "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256" + ]; + minVersion = 1.2; + maxVersion = 1.3; + renegotiation = false; + }; + }; + }; } diff --git a/hosts/genesis/default.nix b/hosts/genesis/default.nix index 5f98195..2998ed1 100644 --- a/hosts/genesis/default.nix +++ b/hosts/genesis/default.nix @@ -2,47 +2,46 @@ # your system. Help is available in the configuration.nix(5) man page # and in the NixOS manual (accessible by running ‘nixos-help’). -{ config, pkgs, ... }: +{ pkgs, ... }: { - imports = [ - # Include the results of the hardware scan. - ./acme.nix - ./hardware-configuration.nix - ./home-assistant.nix - ./networking.nix - ]; - - greg.home = true; - greg.gnome.enable = false; - - # Bootloader. - boot.loader.grub = { - enable = true; - device = "/dev/vda"; - useOSProber = true; - }; + imports = [ + # Include the results of the hardware scan. + ./acme.nix + ./hardware-configuration.nix + ./home-assistant.nix + ./networking.nix + ]; - #boot.loader = { - # systemd-boot.enable = true; - # efi = { - # canTouchEfiVariables = true; - # efiSysMountPoint = "/boot/efi"; - # }; - #}; - - networking.hostName = "genesis"; # Define your hostname. - environment.systemPackages = with pkgs; [ - awscli2 - btrfs-progs - create_ssl - step-ca - ]; + greg.home = true; + greg.gnome.enable = false; - virtualisation.oci-containers.containers.speedtest = { - image = "ghcr.io/librespeed/speedtest"; - hostname = "speedtest"; - ports = [ "19472:80" ]; - }; - greg.proxies."speedtest.thehellings.lan".target = "http://localhost:19472"; + # Bootloader. + boot.loader.grub = { + enable = true; + device = "/dev/vda"; + useOSProber = true; + }; + + #boot.loader = { + # systemd-boot.enable = true; + # efi = { + # canTouchEfiVariables = true; + # efiSysMountPoint = "/boot/efi"; + # }; + #}; + + networking.hostName = "genesis"; # Define your hostname. + environment.systemPackages = with pkgs; [ + awscli2 + create_ssl + step-ca + ]; + + virtualisation.oci-containers.containers.speedtest = { + image = "ghcr.io/librespeed/speedtest"; + hostname = "speedtest"; + ports = [ "19472:80" ]; + }; + greg.proxies."speedtest.thehellings.lan".target = "http://localhost:19472"; } diff --git a/hosts/genesis/hardware-configuration.nix b/hosts/genesis/hardware-configuration.nix index 41686e2..43e7ae9 100644 --- a/hosts/genesis/hardware-configuration.nix +++ b/hosts/genesis/hardware-configuration.nix @@ -1,26 +1,28 @@ # Do not modify this file! It was generated by ‘nixos-generate-config’ # and may be overwritten by future invocations. Please make changes # to /etc/nixos/configuration.nix instead. -{ config, lib, pkgs, modulesPath, ... }: +{ lib, modulesPath, ... }: { - imports = - [ (modulesPath + "/profiles/qemu-guest.nix") - ]; + imports = [ (modulesPath + "/profiles/qemu-guest.nix") ]; - boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "sr_mod" "virtio_blk" ]; + boot.initrd.availableKernelModules = [ + "ata_piix" + "uhci_hcd" + "virtio_pci" + "sr_mod" + "virtio_blk" + ]; boot.initrd.kernelModules = [ ]; boot.kernelModules = [ ]; boot.extraModulePackages = [ ]; - fileSystems."/" = - { device = "/dev/disk/by-uuid/a13f941e-4985-47ab-a8c6-374a627c5ce1"; - fsType = "ext4"; - }; + fileSystems."/" = { + device = "/dev/disk/by-uuid/a13f941e-4985-47ab-a8c6-374a627c5ce1"; + fsType = "ext4"; + }; - swapDevices = - [ { device = "/dev/disk/by-uuid/ac4557de-1ad5-4d3c-b9f4-5ec50dbf76f1"; } - ]; + swapDevices = [ { device = "/dev/disk/by-uuid/ac4557de-1ad5-4d3c-b9f4-5ec50dbf76f1"; } ]; # Enables DHCP on each ethernet and wireless interface. In case of scripted networking # (the default) this is the recommended approach. When using systemd-networkd it's diff --git a/hosts/genesis/home-assistant.nix b/hosts/genesis/home-assistant.nix index 354244f..5df1e87 100755 --- a/hosts/genesis/home-assistant.nix +++ b/hosts/genesis/home-assistant.nix @@ -1,137 +1,143 @@ -{ config, pkgs, ... }: +{ pkgs, ... }: -let - service_list = [ "podman-home-assistant.service" ]; -in { - virtualisation.podman.enable = true; + virtualisation.podman.enable = true; - services.home-assistant = { - enable = true; - configDir = "/var/lib/hass"; - package = (pkgs.home-assistant.override { - extraComponents = [ - "accuweather" - "calendar" - "cast" - "eufy" - "lovelace" - "nextcloud" - "ping" - "piper" - "radio_browser" - "rainbird" - "roborock" - "smart_meter_texas" - "speedtestdotnet" - "solaredge" - "tplink" - "whisper" - "wiz" - "wyoming" - "zwave_js" - ]; - }).overrideAttrs (oldAttrs: { - doInstallCheck = false; - }); + services.home-assistant = { + enable = true; + configDir = "/var/lib/hass"; + extraComponents = [ + "accuweather" + "calendar" + "cast" + "eufy" + "lovelace" + "nextcloud" + "ping" + "piper" + "radio_browser" + "rainbird" + "roborock" + "smart_meter_texas" + "speedtestdotnet" + "solaredge" + "whisper" + "wiz" + "wyoming" + "zwave_js" + ]; + customComponents = with pkgs.home-assistant-custom-components; [ smartthinq-sensors ]; - config = { - default_config = {}; - tts = [ { platform = "google_translate"; } ]; - http = { - use_x_forwarded_for = true; - trusted_proxies = [ "127.0.0.1" "::1" ]; - server_host = "127.0.0.1"; - }; - #"automation manual" = *nix config here* and so on - "automation ui" = "!include automations.yaml"; - "script ui" = "!include scripts.yaml"; - "scene ui" = "!include scenes.yaml"; - }; - }; + config = { + default_config = { }; + tts = [ { platform = "google_translate"; } ]; + http = { + use_x_forwarded_for = true; + trusted_proxies = [ + "127.0.0.1" + "::1" + ]; + server_host = "127.0.0.1"; + }; + #"automation manual" = *nix config here* and so on + "automation ui" = "!include automations.yaml"; + "script ui" = "!include scripts.yaml"; + "scene ui" = "!include scenes.yaml"; + }; + }; - # Helps with Voice stuff for Home Assistant - services.wyoming = { - faster-whisper.servers = { - greg = { - enable = true; - beamSize = 1; # wut? - device = "auto"; # Could be CPU or CUDA - language = "en"; - model = "base-int8"; - uri = "tcp://0.0.0.0:13415"; - }; - }; - piper.servers.greg = { - enable = true; - uri = "tcp://0.0.0.0:13416"; - voice = "en_US-amy-medium"; - }; - }; + # Helps with Voice stuff for Home Assistant + services.wyoming = { + faster-whisper.servers = { + greg = { + enable = true; + beamSize = 1; # wut? + device = "auto"; # Could be CPU or CUDA + language = "en"; + model = "base-int8"; + uri = "tcp://0.0.0.0:13415"; + }; + }; + piper.servers.greg = { + enable = true; + uri = "tcp://0.0.0.0:13416"; + voice = "en_US-amy-medium"; + }; + }; - # Although NixOS has a package for Home Assistant, it is not kept as up to date as the container and the upstream - # is very vocal about only supporting their own container or the HAOS deployments. So we deploy the container here - # and avoid any potential messes from that - virtualisation.oci-containers = { - backend = "podman"; + # Although NixOS has a package for Home Assistant, it is not kept as up to date as the container and the upstream + # is very vocal about only supporting their own container or the HAOS deployments. So we deploy the container here + # and avoid any potential messes from that + virtualisation.oci-containers = { + backend = "podman"; - # I have ZWave devices. The easiest way to connect to them is the zwavejs2mqtt service running, so we spin up - # its container and map the ZWave device into it - containers.zwave = { - autoStart = false; # We will try to start it with udev.extraRules listed below, as this option starts it too quickly - image = "zwavejs/zwave-js-ui:latest"; - ports = [ "8091:8091" "3000:3000" ]; - volumes = [ "/var/lib/zwave:/usr/src/app/store" ]; - extraOptions = [ - "--device" "/dev/serial/by-id/usb-0658_0200-if00:/dev/zwave" - "--pull=newer" - ]; - environment = { - TZ = "America/Chicago"; - CONSOLE_OUTPUT = "true"; - }; - }; - }; + # I have ZWave devices. The easiest way to connect to them is the zwavejs2mqtt service running, so we spin up + # its container and map the ZWave device into it + containers.zwave = { + autoStart = false; # We will try to start it with udev.extraRules listed below, as this option starts it too quickly + image = "zwavejs/zwave-js-ui:latest"; + ports = [ + "8091:8091" + "3000:3000" + ]; + volumes = [ "/var/lib/zwave:/usr/src/app/store" ]; + extraOptions = [ + "--device" + "/dev/serial/by-id/usb-0658_0200-if00:/dev/zwave" + "--pull=newer" + ]; + environment = { + TZ = "America/Chicago"; + CONSOLE_OUTPUT = "true"; + }; + }; + }; - # Both of the above container need storage for their configuration and devices, but it is not created correctly by - # the container. So we add the creation of /var/lib/{zwave,hass} to the systemd Unit files - systemd.services = { - "podman-zwave" = { - after = [ "sys-devices-pci0000:00-0000:00:1e.0-0000:02:1b.0-usb2-2\\x2d1-2\\x2d1:1.0-tty-ttyACM0.device" ]; - wantedBy = [ "sys-devices-pci0000:00-0000:00:1e.0-0000:02:1b.0-usb2-2\\x2d1-2\\x2d1:1.0-tty-ttyACM0.device" ]; - serviceConfig = { - StateDirectory = "zwave"; - StateDirectoryMode = pkgs.lib.mkForce "0777"; - }; - }; - }; + # Both of the above container need storage for their configuration and devices, but it is not created correctly by + # the container. So we add the creation of /var/lib/{zwave,hass} to the systemd Unit files + systemd.services = { + "podman-zwave" = { + after = [ + "sys-devices-pci0000:00-0000:00:1e.0-0000:02:1b.0-usb2-2\\x2d1-2\\x2d1:1.0-tty-ttyACM0.device" + ]; + wantedBy = [ + "sys-devices-pci0000:00-0000:00:1e.0-0000:02:1b.0-usb2-2\\x2d1-2\\x2d1:1.0-tty-ttyACM0.device" + ]; + serviceConfig = { + StateDirectory = "zwave"; + StateDirectoryMode = pkgs.lib.mkForce "0777"; + }; + }; + }; - services.udev.extraRules = '' - SUBSYSTEM=="tty", KERNEL=="ttyACM0", TAG+="systemd" - ''; + services.udev.extraRules = '' + SUBSYSTEM=="tty", KERNEL=="ttyACM0", TAG+="systemd" + ''; + greg.proxies = { + "smart.home".target = "http://127.0.0.1:8123/"; + "smart.thehellings.lan".target = "http://127.0.0.1:8123/"; + "zwave.home".target = "http://127.0.0.1:8091/"; + }; - greg.proxies = { - "smart.home".target = "http://127.0.0.1:8123/"; - "smart.thehellings.lan".target = "http://127.0.0.1:8123/"; - "zwave.home".target = "http://127.0.0.1:8091/"; - }; + # Ensure that both ports are up and running. We keep 8123 directly open because we are on the LAN and sometimes want to connect + # directly for troubleshooting Nginx configuration + networking.firewall = { + allowedTCPPorts = [ + 80 + 443 + ]; + }; - # Ensure that both ports are up and running. We keep 8123 directly open because we are on the LAN and sometimes want to connect - # directly for troubleshooting Nginx configuration - networking.firewall = { - allowedTCPPorts = [ 80 443 ]; - }; + greg.backup.jobs.zwave = { + src = "/var/lib/zwave"; + dest = "zwave"; + id = "zwave-asdf"; + }; - greg.backup.jobs.zwave = { - src = "/var/lib/zwave"; - dest = "zwave"; - id = "zwave-asdf"; - }; - - greg.backup.jobs.hass-backup = { - src = "/var/lib/hass"; - dest = "hass"; - id = "hass-asdf"; - }; + greg.backup.jobs.hass-backup = { + src = "/var/lib/hass"; + dest = "hass"; + id = "hass-asdf"; + }; } diff --git a/hosts/genesis/networking.nix b/hosts/genesis/networking.nix index 86fcf34..1913ec1 100644 --- a/hosts/genesis/networking.nix +++ b/hosts/genesis/networking.nix @@ -1,191 +1,198 @@ -{ pkgs, config, ... }: +{ pkgs, ... }: let - lan = "ens18"; - lanIP = "10.42.1.5"; - iot = "ens19"; - iotIP = "192.168.66.250"; - routerIP = "10.42.1.2"; - extraHosts = builtins.readFile ./net/hosts; + lan = "ens18"; + lanIP = "10.42.1.5"; + iot = "ens19"; + iotIP = "192.168.66.250"; + routerIP = "10.42.1.2"; + extraHosts = builtins.readFile ./net/hosts; - adblockUpdate = pkgs.writeShellScriptBin "adblockUpdate" (builtins.readFile ./adblockUpdate.sh); - proxyPort = 3128; - dnsPort = 53; - dhcpPort = 67; - dnsServers = [ - "9.9.9.9" # Quad 9 - "1.1.1.1" # Cloudflare - "1.0.0.1" # Cloudflare - "149.112.112.112" # Quad 9 - ]; -in { - greg.tailscale.enable = true; + adblockUpdate = pkgs.writeShellScriptBin "adblockUpdate" (builtins.readFile ./adblockUpdate.sh); + proxyPort = 3128; + dnsPort = 53; + dhcpPort = 67; + dnsServers = [ + "9.9.9.9" # Quad 9 + "1.1.1.1" # Cloudflare + "1.0.0.1" # Cloudflare + "149.112.112.112" # Quad 9 + ]; +in +{ + greg.tailscale.enable = true; - # Really, why do I still have to force-disable this crap? - boot.kernel.sysctl = { - "net.ipv6.conf.${lan}.disable_ipv6" = true; - "net.ipv6.conf.${iot}.disable_ipv6" = true; - "net.ipv6.conf.lo.disable_ipv6" = true; - }; + # Really, why do I still have to force-disable this crap? + boot.kernel.sysctl = { + "net.ipv6.conf.${lan}.disable_ipv6" = true; + "net.ipv6.conf.${iot}.disable_ipv6" = true; + "net.ipv6.conf.lo.disable_ipv6" = true; + }; - networking = { - enableIPv6 = false; - networkmanager.enable = pkgs.lib.mkForce false; - defaultGateway = routerIP; - nameservers = dnsServers; - interfaces = { - # This is our LAN port - "${lan}" = { - useDHCP = false; - ipv4.addresses = [ { - address = "${lanIP}"; - prefixLength = 16; - } ]; - }; + networking = { + enableIPv6 = false; + networkmanager.enable = pkgs.lib.mkForce false; + defaultGateway = routerIP; + nameservers = dnsServers; + interfaces = { + # This is our LAN port + "${lan}" = { + useDHCP = false; + ipv4.addresses = [ + { + address = "${lanIP}"; + prefixLength = 16; + } + ]; + }; - "${iot}" = { - useDHCP = false; - ipv4.addresses = [ { - address = "${iotIP}"; - prefixLength = 24; - } ]; - }; - }; - firewall = { - enable = false; - allowedUDPPorts = [ - dhcpPort - dnsPort - 1900 # Jellyfin auto-discovery - 7359 # Jellyfin auto-discovery - ]; - allowedTCPPorts = [ - dnsPort - proxyPort - 80 - ]; - }; - nftables.enable = false; - }; + "${iot}" = { + useDHCP = false; + ipv4.addresses = [ + { + address = "${iotIP}"; + prefixLength = 24; + } + ]; + }; + }; + firewall = { + enable = false; + allowedUDPPorts = [ + dhcpPort + dnsPort + 1900 # Jellyfin auto-discovery + 7359 # Jellyfin auto-discovery + ]; + allowedTCPPorts = [ + dnsPort + proxyPort + 80 + ]; + }; + nftables.enable = false; + }; - environment.etc."hosts.d/local".text = extraHosts; + environment.etc."hosts.d/local".text = extraHosts; - fileSystems = { - "/media" = { - device = "10.42.1.4:/volume1/video/"; - fsType = "nfs"; - options = [ "ro" ]; - }; - }; + fileSystems = { + "/media" = { + device = "10.42.1.4:/volume1/video/"; + fsType = "nfs"; + options = [ "ro" ]; + }; + }; - services = { - # Video services - jellyfin = { - enable = true; - openFirewall = true; - }; + services = { + # Video services + jellyfin = { + enable = true; + openFirewall = true; + }; - ######### - # Blind service proxy behind the walls of the VPN - ######## - _3proxy = { - enable = true; - services = [ { - type = "socks"; - auth = [ "strong" ]; - bindPort = proxyPort; - acl = [ { - rule = "allow"; - users = [ "greg" ]; - } ]; - } ]; - #usersFile = "/run/agenix/3proxy"; - denyPrivate = false; - }; + ######### + # Blind service proxy behind the walls of the VPN + ######## + _3proxy = { + enable = true; + services = [ + { + type = "socks"; + auth = [ "strong" ]; + bindPort = proxyPort; + acl = [ + { + rule = "allow"; + users = [ "greg" ]; + } + ]; + } + ]; + #usersFile = "/run/agenix/3proxy"; + denyPrivate = false; + }; - ######### - # dnsmasq config - ######## - dnsmasq = { - enable = true; - settings = { - domain = "thehellings.lan"; - dhcp-range = [ - "${lan},10.42.2.1,10.42.2.255,255.255.0.0,12h" - "${iot},192.168.66.3,192.168.66.150,255.255.255.0,12h" - "vlan67@${lan},192.168.67.3,192.168.67.150,12h" - ]; - dhcp-option = [ - "${lan},option:router,${routerIP}" - "${lan},option:dns-server,${lanIP},1.1.1.1" - "${lan},option:domain-search,thehellings.lan" + ######### + # dnsmasq config + ######## + dnsmasq = { + enable = true; + settings = { + domain = "thehellings.lan"; + dhcp-range = [ + "${lan},10.42.2.1,10.42.2.255,255.255.0.0,12h" + "${iot},192.168.66.3,192.168.66.150,255.255.255.0,12h" + "vlan67@${lan},192.168.67.3,192.168.67.150,12h" + ]; + dhcp-option = [ + "${lan},option:router,${routerIP}" + "${lan},option:dns-server,${lanIP},1.1.1.1" + "${lan},option:domain-search,thehellings.lan" - "${iot},option:router,192.168.66.1" - "${iot},option:dns-server,${iotIP}" + "${iot},option:router,192.168.66.1" + "${iot},option:dns-server,${iotIP}" - "vlan67@${lan},option:router,192.168.67.1" - "vlan67@${lan},option:dns-server,192.168.67.1" - ]; - dhcp-host = [ - # Static IPs for personal work - "2a:5d:23:10:4e:22,10.42.0.5" # SAN Switch - "00:00:de:ad:be:ef,10.42.2.254" - "01:a8:a1:59:c7:8a:12,10.42.2.253" # BMC management interface for isaiah + "vlan67@${lan},option:router,192.168.67.1" + "vlan67@${lan},option:dns-server,192.168.67.1" + ]; + dhcp-host = [ + # Static IPs for personal work + "2a:5d:23:10:4e:22,10.42.0.5" # SAN Switch + "00:00:de:ad:be:ef,10.42.2.254" + "01:a8:a1:59:c7:8a:12,10.42.2.253" # BMC management interface for isaiah - # Static IPs for things in the IOT range - "b4:b0:24:9a:02:4a,192.168.66.5" # LD125 - "98:da:c4:20:f3:64,192.168.66.6" # Dining room light - "54:af:97:c1:dc:b9,192.168.66.25" # Master bedroom Kasa switch - "f0:03:8c:b3:b0:f6,192.168.66.55" # Roomba - "4c:a1:61:05:cd:52,192.168.66.61" # Rainbird - "48:d6:d5:5d:81:21,192.168.66.65" # Google Home - "6c:29:90:3e:e2:02,192.168.66.66" # wiz - "28:87:ba:0e:ca:da,192.168.66.74" # - "28:87:ba:0e:c9:fd,192.168.66.75" # Master closet - "54:af:97:c2:0f:a1,192.168.66.76" # Master toilet - "54:af:97:83:ed:33,192.168.66.80" - "98:da:c4:77:80:18,192.168.66.84" # Kitchen lights - "98:da:c4:21:1b:2e,192.168.66.85" # Living Room lights - "0c:80:63:41:6e:0f,192.168.66.90" # Front porch - "0c:80:63:41:6c:5d,192.168.66.98" # House number - "ac:84:c6:5e:4b:28,192.168.66.100" - "98:da:c4:77:7f:4d,192.168.66.102" # Office lights - "8c:85:80:1c:f9:d1,192.168.66.104" - "98:da:c4:77:82:7b,192.168.66.105" # Parlor lamp - "0c:80:63:41:74:73,192.168.66.106" # Front hall light switch - "98:da:c4:20:ea:db,192.168.66.107" # Parlor light switch - "8c:49:62:aa:58:60,192.168.66.108" # Roku, HiHandsome - "92:3e:11:c7:c5:be,192.168.66.109" - "d8:0d:17:19:60:62,192.168.66.112" - "b4:b0:24:9a:12:53,192.168.66.130" # KL125 - "b4:b0:24:9a:14:0e,192.168.66.131" - "e4:f0:42:61:fa:b5,192.168.66.149" # Google Home-mini - ]; - expand-hosts = true; - log-dhcp = true; - log-queries = true; - no-hosts = true; # Do not read /etc/hosts, which makes genesis resolve to 127.0.0.2 - addn-hosts = "/etc/adblock_hosts"; - hostsdir = "/etc/hosts.d/"; - server = dnsServers; - }; - }; + # Static IPs for things in the IOT range + "b4:b0:24:9a:02:4a,192.168.66.5" # LD125 + "98:da:c4:20:f3:64,192.168.66.6" # Dining room light + "54:af:97:c1:dc:b9,192.168.66.25" # Master bedroom Kasa switch + "f0:03:8c:b3:b0:f6,192.168.66.55" # Roomba + "4c:a1:61:05:cd:52,192.168.66.61" # Rainbird + "48:d6:d5:5d:81:21,192.168.66.65" # Google Home + "6c:29:90:3e:e2:02,192.168.66.66" # wiz + "28:87:ba:0e:ca:da,192.168.66.74" + "28:87:ba:0e:c9:fd,192.168.66.75" # Master closet + "54:af:97:c2:0f:a1,192.168.66.76" # Master toilet + "54:af:97:83:ed:33,192.168.66.80" + "98:da:c4:77:80:18,192.168.66.84" # Kitchen lights + "98:da:c4:21:1b:2e,192.168.66.85" # Living Room lights + "0c:80:63:41:6e:0f,192.168.66.90" # Front porch + "0c:80:63:41:6c:5d,192.168.66.98" # House number + "ac:84:c6:5e:4b:28,192.168.66.100" + "98:da:c4:77:7f:4d,192.168.66.102" # Office lights + "8c:85:80:1c:f9:d1,192.168.66.104" + "98:da:c4:77:82:7b,192.168.66.105" # Parlor lamp + "0c:80:63:41:74:73,192.168.66.106" # Front hall light switch + "98:da:c4:20:ea:db,192.168.66.107" # Parlor light switch + "8c:49:62:aa:58:60,192.168.66.108" # Roku, HiHandsome + "92:3e:11:c7:c5:be,192.168.66.109" + "d8:0d:17:19:60:62,192.168.66.112" + "b4:b0:24:9a:12:53,192.168.66.130" # KL125 + "b4:b0:24:9a:14:0e,192.168.66.131" + "e4:f0:42:61:fa:b5,192.168.66.149" # Google Home-mini + ]; + expand-hosts = true; + log-dhcp = true; + log-queries = true; + no-hosts = true; # Do not read /etc/hosts, which makes genesis resolve to 127.0.0.2 + addn-hosts = "/etc/adblock_hosts"; + hostsdir = "/etc/hosts.d/"; + server = dnsServers; + }; + }; - # Update adblock list - cron = { - enable = true; - systemCronJobs = [ - "* * * * * root ${adblockUpdate} 2>&1 > /var/log/adblock.log" - ]; - }; - }; # End of services configuration + # Update adblock list + cron = { + enable = true; + systemCronJobs = [ "* * * * * root ${adblockUpdate} 2>&1 > /var/log/adblock.log" ]; + }; + }; # End of services configuration - greg.proxies = { - "jellyfin.home".target = "http://localhost:8096/"; - }; + greg.proxies = { + "jellyfin.home".target = "http://localhost:8096/"; + }; - environment.systemPackages = with pkgs; [ - bind - curl # Used by dnsmasq fetching - sqlite - ]; + environment.systemPackages = with pkgs; [ + bind + curl # Used by dnsmasq fetching + sqlite + ]; } diff --git a/hosts/hosea/bitcoin.nix b/hosts/hosea/bitcoin.nix new file mode 100644 index 0000000..05915b9 --- /dev/null +++ b/hosts/hosea/bitcoin.nix @@ -0,0 +1,76 @@ +{ config, pkgs, ... }: + +let + ip = "100.68.203.1"; +in +{ + nix-bitcoin = { + generateSecrets = true; + operator = { + enable = true; + name = "greg"; + }; + useVersionLockedPkgs = true; # Use the exact versions of packages from upstream + }; + + networking.firewall.allowedTCPPorts = with config.services; [ + bitcoind.port + bitcoind.rpc.port + lnd.restPort + lnd.port + mempool.frontend.port + ]; + + greg.backup.jobs = { + clightning = { + src = config.services.clightning.replication.local.directory; + dest = "hosea-clightning"; + id = "clightning"; + }; + }; + + services = { + backups = { + enable = true; + frequency = "hourly"; + }; + bitcoind = { + enable = true; + address = "0.0.0.0"; + dataDir = "/chain/bitcoind"; + listen = true; + rpc = { + address = ip; + allowip = [ "100.1.1.1/8" ]; + }; + }; + clightning = { + enable = true; + address = ip; + port = 9736; + replication = { + enable = true; + local.directory = "/var/backup/clightning"; + encrypt = false; + }; + }; + electrs = { + enable = true; + address = ip; + }; + lnd = { + enable = true; + address = ip; + lndconnect.enable = true; + }; + mempool = { + enable = true; + frontend = { + enable = true; + address = ip; + }; + }; + }; + + environment.systemPackages = with pkgs; [ ]; +} diff --git a/hosts/hosea/default.nix b/hosts/hosea/default.nix index 9a37af7..5d95678 100644 --- a/hosts/hosea/default.nix +++ b/hosts/hosea/default.nix @@ -2,60 +2,62 @@ # your system. Help is available in the configuration.nix(5) man page # and in the NixOS manual (accessible by running ‘nixos-help’). -{ config, pkgs, lib, inputs, overlays, ... }: +{ top, ... }: let - wanInterface = "enp2s0"; - lanInterface = "enp1s0"; - lanIpAddress = "10.42.1.7"; + wanInterface = "enp2s0"; + lanInterface = "enp1s0"; + lanIpAddress = "10.42.1.7"; in { - imports = - [ # Include the results of the hardware scan. - ./hardware-configuration.nix - ./minio.nix - ]; + imports = [ + # Include the results of the hardware scan. + ./hardware-configuration.nix + top.btc.nixosModules.default + ./bitcoin.nix + ]; + # Bootloader + boot = { + loader = { + systemd-boot.enable = true; + efi = { + canTouchEfiVariables = true; + efiSysMountPoint = "/boot/"; + }; + }; + extraModprobeConfig = "vboxdrv"; + }; + users.users.greg.extraGroups = [ "vboxusers" ]; - # Bootloader - boot = { - loader = { - systemd-boot.enable = true; - efi = { - canTouchEfiVariables = true; - efiSysMountPoint = "/boot/"; - }; - }; - extraModprobeConfig = "vboxdrv"; - }; - users.users.greg.extraGroups = [ "vboxusers" ]; + networking = { + hostName = "hosea"; + nameservers = [ "10.42.1.5" ]; + defaultGateway = "10.42.1.1"; + interfaces = { + "${wanInterface}".useDHCP = true; + "${lanInterface}" = { + useDHCP = false; + ipv4.addresses = [ + { + address = lanIpAddress; + prefixLength = 16; + } + ]; + }; + }; + }; - networking = { - hostName = "hosea"; - nameservers = [ "10.42.1.5" ]; - defaultGateway = "10.42.1.1"; - interfaces = { - "${wanInterface}".useDHCP = true; - "${lanInterface}" = { - useDHCP = false; - ipv4.addresses = [{ - address = lanIpAddress; - prefixLength = 16; - }]; - }; - }; - }; - - # Serves as the router, DHCP, and DNS for the site - greg = { - tailscale.enable = true; - home = true; - }; - services = { - # Configure keymap - xserver.xkb = { - layout = "us"; - variant = ""; - }; - }; + # Serves as the router, DHCP, and DNS for the site + greg = { + tailscale.enable = true; + home = true; + }; + services = { + # Configure keymap + xserver.xkb = { + layout = "us"; + variant = ""; + }; + }; } diff --git a/hosts/hosea/hardware-configuration.nix b/hosts/hosea/hardware-configuration.nix index b2bc54d..645a26f 100644 --- a/hosts/hosea/hardware-configuration.nix +++ b/hosts/hosea/hardware-configuration.nix @@ -1,28 +1,43 @@ # Do not modify this file! It was generated by ‘nixos-generate-config’ # and may be overwritten by future invocations. Please make changes # to /etc/nixos/configuration.nix instead. -{ config, lib, pkgs, modulesPath, ... }: +{ + config, + lib, + modulesPath, + ... +}: { - imports = - [ (modulesPath + "/installer/scan/not-detected.nix") - ]; + imports = [ (modulesPath + "/installer/scan/not-detected.nix") ]; - boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "nvme" "usbhid" "uas" "sd_mod" ]; + boot.initrd.availableKernelModules = [ + "xhci_pci" + "ahci" + "nvme" + "usbhid" + "uas" + "sd_mod" + ]; boot.initrd.kernelModules = [ ]; boot.kernelModules = [ "kvm-intel" ]; boot.extraModulePackages = [ ]; - fileSystems."/" = - { device = "/dev/disk/by-uuid/d4ac74f7-62bb-421a-aad8-566277c9d8ba"; - fsType = "btrfs"; - options = [ "subvol=@" ]; - }; + fileSystems."/" = { + device = "/dev/disk/by-uuid/d4ac74f7-62bb-421a-aad8-566277c9d8ba"; + fsType = "btrfs"; + options = [ "subvol=@" ]; + }; - fileSystems."/boot" = - { device = "/dev/disk/by-uuid/1F51-B638"; - fsType = "vfat"; - }; + fileSystems."/boot" = { + device = "/dev/disk/by-uuid/1F51-B638"; + fsType = "vfat"; + }; + + fileSystems."/chain" = { + device = "/dev/sda1"; + fsType = "xfs"; + }; swapDevices = [ ]; diff --git a/hosts/hosea/minio.nix b/hosts/hosea/minio.nix deleted file mode 100644 index 12f3c99..0000000 --- a/hosts/hosea/minio.nix +++ /dev/null @@ -1,32 +0,0 @@ -{ config, pkgs, ... }: - -let - minioPort = 9000; - minioConsolePort = 9001; -in { - fileSystems."/proxy" = { - device = "/dev/sda1"; - fsType = "btrfs"; - }; - - networking.firewall.allowedTCPPorts = [ - 80 - minioPort - minioConsolePort - ]; - - age.secrets.minio.file = ../../secrets/minio.age; - - services.minio = { - enable = true; - dataDir = [ "/proxy/minio" ]; - rootCredentialsFile = config.age.secrets.minio.path; - browser = true; - }; - - greg.proxies."s3.thehellings.lan".target = "http://127.0.0.1:${toString minioPort}"; - - environment.systemPackages = with pkgs; [ - minio-client - ]; -} diff --git a/hosts/icdm-root/boot.nix b/hosts/icdm-root/boot.nix index 796db1b..47810f3 100644 --- a/hosts/icdm-root/boot.nix +++ b/hosts/icdm-root/boot.nix @@ -1,11 +1,11 @@ -{ pkgs, config, ...}: +{ ... }: { - # Bootloader. - boot = { - loader.grub = { - enable = true; - device = "/dev/sda"; - }; - }; + # Bootloader. + boot = { + loader.grub = { + enable = true; + device = "/dev/sda"; + }; + }; } diff --git a/hosts/icdm-root/default.nix b/hosts/icdm-root/default.nix index 27aae2f..c4ea82e 100644 --- a/hosts/icdm-root/default.nix +++ b/hosts/icdm-root/default.nix @@ -2,23 +2,27 @@ # your system. Help is available in the configuration.nix(5) man page # and in the NixOS manual (accessible by running ‘nixos-help’). -{ config, pkgs, agenix, ... }: +{ pkgs, ... }: { - imports = [ # Include the results of the hardware scan. - ./hardware-configuration.nix - ./boot.nix - ./filesystem.nix - ./location.nix - ./networking.nix - ./wiki.nix - ]; + imports = [ + # Include the results of the hardware scan. + ./hardware-configuration.nix + ./boot.nix + ./filesystem.nix + ./location.nix + ./networking.nix + ./wiki.nix + ]; - # Define a user account. Don't forget to set a password with ‘passwd’. - users.users.greg = { - isNormalUser = true; - description = "Gregory Hellings"; - extraGroups = [ "networkmanager" "wheel" ]; - packages = with pkgs; []; - }; + # Define a user account. Don't forget to set a password with ‘passwd’. + users.users.greg = { + isNormalUser = true; + description = "Gregory Hellings"; + extraGroups = [ + "networkmanager" + "wheel" + ]; + packages = with pkgs; [ ]; + }; } diff --git a/hosts/icdm-root/filesystem.nix b/hosts/icdm-root/filesystem.nix index 25b6e9a..f6b543f 100644 --- a/hosts/icdm-root/filesystem.nix +++ b/hosts/icdm-root/filesystem.nix @@ -1,12 +1,13 @@ { ... }: let -in { - fileSystems."serve" = { - #device = "10.42.1.4:/volume1/icdm-mysql/"; - #fsType = "nfs"; - device = "/dev/sdb1"; - fsType = "auto"; - mountPoint = "/srv"; - }; +in +{ + fileSystems."serve" = { + #device = "10.42.1.4:/volume1/icdm-mysql/"; + #fsType = "nfs"; + device = "/dev/sdb1"; + fsType = "auto"; + mountPoint = "/srv"; + }; } diff --git a/hosts/icdm-root/hardware-configuration.nix b/hosts/icdm-root/hardware-configuration.nix index 0919a73..3c850c2 100644 --- a/hosts/icdm-root/hardware-configuration.nix +++ b/hosts/icdm-root/hardware-configuration.nix @@ -1,37 +1,45 @@ # Do not modify this file! It was generated by ‘nixos-generate-config’ # and may be overwritten by future invocations. Please make changes # to /etc/nixos/configuration.nix instead. -{ config, lib, pkgs, modulesPath, ... }: +{ + config, + lib, + modulesPath, + ... +}: { - imports = - [ (modulesPath + "/installer/scan/not-detected.nix") - ]; + imports = [ (modulesPath + "/installer/scan/not-detected.nix") ]; - boot.initrd.availableKernelModules = [ "xhci_pci" "ehci_pci" "ahci" "usbhid" "usb_storage" "sd_mod" ]; + boot.initrd.availableKernelModules = [ + "xhci_pci" + "ehci_pci" + "ahci" + "usbhid" + "usb_storage" + "sd_mod" + ]; boot.initrd.kernelModules = [ ]; boot.kernelModules = [ "kvm-intel" ]; boot.extraModulePackages = [ ]; - fileSystems."/" = - { device = "/dev/disk/by-uuid/dab0d455-e25e-4445-8fa4-5320047d7e7b"; - fsType = "btrfs"; - options = [ "subvol=@" ]; - }; + fileSystems."/" = { + device = "/dev/disk/by-uuid/dab0d455-e25e-4445-8fa4-5320047d7e7b"; + fsType = "btrfs"; + options = [ "subvol=@" ]; + }; - fileSystems."/boot" = - { device = "/dev/disk/by-uuid/5aedbb07-5761-423b-909d-2560405eae32"; - fsType = "ext4"; - }; + fileSystems."/boot" = { + device = "/dev/disk/by-uuid/5aedbb07-5761-423b-909d-2560405eae32"; + fsType = "ext4"; + }; - fileSystems."/var" = - { device = "/dev/disk/by-uuid/57968536-c29d-417d-997e-85223d1d1f65"; - fsType = "btrfs"; - }; + fileSystems."/var" = { + device = "/dev/disk/by-uuid/57968536-c29d-417d-997e-85223d1d1f65"; + fsType = "btrfs"; + }; - swapDevices = - [ { device = "/dev/disk/by-uuid/09691dce-375a-43c6-8d40-4498d20a6d9a"; } - ]; + swapDevices = [ { device = "/dev/disk/by-uuid/09691dce-375a-43c6-8d40-4498d20a6d9a"; } ]; # Enables DHCP on each ethernet and wireless interface. In case of scripted networking # (the default) this is the recommended approach. When using systemd-networkd it's diff --git a/hosts/icdm-root/location.nix b/hosts/icdm-root/location.nix index 09339a4..079dfda 100644 --- a/hosts/icdm-root/location.nix +++ b/hosts/icdm-root/location.nix @@ -1,4 +1,4 @@ -{...}: +{ ... }: { # Set your time zone. diff --git a/hosts/icdm-root/networking.nix b/hosts/icdm-root/networking.nix index d3d8b16..66951e6 100644 --- a/hosts/icdm-root/networking.nix +++ b/hosts/icdm-root/networking.nix @@ -1,58 +1,63 @@ -{...}: +{ ... }: let - dnsHosts = builtins.concatStringsSep "\n" [ - "wiki.icdm.lan 10.42.101.1" - ]; + dnsHosts = builtins.concatStringsSep "\n" [ "wiki.icdm.lan 10.42.101.1" ]; in { - # If we have to do proxying in Bayonnais, we can start to work on that here - # networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain"; - networking = { - hostName = "icdm-root"; - useDHCP = false; - defaultGateway = "10.42.1.1"; - nameservers = [ "100.100.100.100" "10.42.1.2" ]; - enableIPv6 = false; + # If we have to do proxying in Bayonnais, we can start to work on that here + # networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain"; + networking = { + hostName = "icdm-root"; + useDHCP = false; + defaultGateway = "10.42.1.1"; + nameservers = [ + "100.100.100.100" + "10.42.1.2" + ]; + enableIPv6 = false; - interfaces = { - eno1.ipv4.addresses = [ { - address = "10.42.101.1"; - prefixLength = 16; - } { - address = "10.77.1.2"; - prefixLength = 16; - } ]; - }; - # Allow traffic through - firewall = { - enable = true; - allowedTCPPorts = [ 53 ]; - allowedUDPPorts = [ 53 67 ]; - }; + interfaces = { + eno1.ipv4.addresses = [ + { + address = "10.42.101.1"; + prefixLength = 16; + } + { + address = "10.77.1.2"; + prefixLength = 16; + } + ]; + }; + # Allow traffic through + firewall = { + enable = true; + allowedTCPPorts = [ 53 ]; + allowedUDPPorts = [ + 53 + 67 + ]; + }; - extraHosts = "${dnsHosts}"; - }; + extraHosts = "${dnsHosts}"; + }; - services.dnsmasq = { - enable = true; - settings = { - domain = "icdm.lan"; - dhcp-range = [ - "eno1,10.77.1.10,10.77.1.255,255.255.0.0,12h" - ]; - dhcp-option = [ - "eno1,option:router,10.77.1.1" - "eno1,option:dns-server,10.77.1.2,1.1.1.1" - "eno1,option:domain-search,icdm.lan" - ]; - expand-hosts = true; - log-dhcp = true; - log-queries = true; - # Upstream servers - server = [ - "1.1.1.1" - "8.8.4.4" - ]; - }; - }; + services.dnsmasq = { + enable = true; + settings = { + domain = "icdm.lan"; + dhcp-range = [ "eno1,10.77.1.10,10.77.1.255,255.255.0.0,12h" ]; + dhcp-option = [ + "eno1,option:router,10.77.1.1" + "eno1,option:dns-server,10.77.1.2,1.1.1.1" + "eno1,option:domain-search,icdm.lan" + ]; + expand-hosts = true; + log-dhcp = true; + log-queries = true; + # Upstream servers + server = [ + "1.1.1.1" + "8.8.4.4" + ]; + }; + }; } diff --git a/hosts/icdm-root/wiki.nix b/hosts/icdm-root/wiki.nix index 46ab920..e6a793a 100644 --- a/hosts/icdm-root/wiki.nix +++ b/hosts/icdm-root/wiki.nix @@ -1,32 +1,15 @@ -{ pkgs, ... }: +{ ... }: let - wikiPasswordFile = "/var/mediawiki/passwordFile"; - wikiHost = "wiki.icdm.lan"; - kiwixport = 8080; - dependents = with pkgs; [ - enwiki-dump - transmission - ]; + wikiHost = "wiki.icdm.lan"; + kiwixport = 8080; in { - services.kiwix-serve = { - enable = true; - port = kiwixport; - path = "/srv/zims/*.zim"; - }; + services.kiwix-serve = { + enable = true; + port = kiwixport; + path = "/srv/zims/*.zim"; + }; - services.transmission = { - enable = true; - settings = { - download-dir = "/srv"; - incomplete-dir = "/srv/incomplete"; - rpc-bind-address = "0.0.0.0"; - rpc-whitelist = "10.42.*,127.*,localhost"; - }; - }; - - greg.proxies."${wikiHost}".target = "http://localhost:${toString kiwixport}"; - networking.firewall.allowedTCPPorts = [ 80 ]; - - environment.systemPackages = dependents; + greg.proxies."${wikiHost}".target = "http://localhost:${toString kiwixport}"; + networking.firewall.allowedTCPPorts = [ 80 ]; } diff --git a/hosts/iso/default.nix b/hosts/iso/default.nix index 3ac6960..bbb5e8e 100644 --- a/hosts/iso/default.nix +++ b/hosts/iso/default.nix @@ -1,15 +1,18 @@ -{ pkgs, lib, modulesPath, ... }: +{ + pkgs, + lib, + modulesPath, + ... +}: { - imports = [ - "${modulesPath}/installer/cd-dvd/installation-cd-graphical-calamares-gnome.nix" - "${modulesPath}/installer/cd-dvd/channel.nix" - ]; + imports = [ + "${modulesPath}/installer/cd-dvd/installation-cd-graphical-calamares-gnome.nix" + "${modulesPath}/installer/cd-dvd/channel.nix" + ]; - networking.networkmanager.enable = lib.mkForce false; - users.users.greg.initialPassword = ""; - #services.getty.autologinUser = lib.mkForce "greg"; - environment.systemPackages = with pkgs; [ - tree - ]; + networking.networkmanager.enable = lib.mkForce false; + users.users.greg.initialPassword = ""; + #services.getty.autologinUser = lib.mkForce "greg"; + environment.systemPackages = with pkgs; [ tree ]; } diff --git a/hosts/jeremiah/ceph.nix b/hosts/jeremiah/ceph.nix index 25a2276..185a03b 100644 --- a/hosts/jeremiah/ceph.nix +++ b/hosts/jeremiah/ceph.nix @@ -1,33 +1,34 @@ { config, ... }: let - publicIp = (builtins.elemAt config.networking.interfaces.enp68s0.ipv4.addresses 0).address; - sanIp = (builtins.elemAt config.networking.interfaces.enp67s0.ipv4.addresses 0).address; - vip = (builtins.elemAt config.networking.interfaces.enp68s0.ipv4.addresses 1).address; - hostname = config.networking.hostName; - baseConfig = import ../../ceph/home.nix; -in { - services.ceph-benaco = baseConfig // { - enable = false; - monitor = { - enable = false; - initialKeyring = ../../secrets/home.mon.keyring; - nodeName = hostname; - bindAddr = publicIp; - advertisedPublicAddr = vip; - }; - osdBindAddr = publicIp; - osdAdvertisedPublicAddr = publicIp; - osds = { - osd1 = { - enable = false; - bootstrapKeyring = ../../secrets/home.osd-bootstrap.keyring; - id = 1; - uuid = "c13bd2b1-cfc7-4966-8da5-d92356e87e06"; - blockDevice = "/dev/sda"; - blockDeviceUdevRuleMatcher = ''KERNEL=="sda"''; - clusterAddress = sanIp; - }; - }; - }; + publicIp = (builtins.elemAt config.networking.interfaces.enp68s0.ipv4.addresses 0).address; + sanIp = (builtins.elemAt config.networking.interfaces.enp67s0.ipv4.addresses 0).address; + vip = (builtins.elemAt config.networking.interfaces.enp68s0.ipv4.addresses 1).address; + hostname = config.networking.hostName; + baseConfig = import ../../ceph/home.nix; +in +{ + services.ceph-benaco = baseConfig // { + enable = false; + monitor = { + enable = false; + initialKeyring = ../../secrets/home.mon.keyring; + nodeName = hostname; + bindAddr = publicIp; + advertisedPublicAddr = vip; + }; + osdBindAddr = publicIp; + osdAdvertisedPublicAddr = publicIp; + osds = { + osd1 = { + enable = false; + bootstrapKeyring = ../../secrets/home.osd-bootstrap.keyring; + id = 1; + uuid = "c13bd2b1-cfc7-4966-8da5-d92356e87e06"; + blockDevice = "/dev/sda"; + blockDeviceUdevRuleMatcher = ''KERNEL=="sda"''; + clusterAddress = sanIp; + }; + }; + }; } diff --git a/hosts/jeremiah/default.nix b/hosts/jeremiah/default.nix index e3754a6..42a0851 100644 --- a/hosts/jeremiah/default.nix +++ b/hosts/jeremiah/default.nix @@ -2,129 +2,136 @@ # your system. Help is available in the configuration.nix(5) man page # and in the NixOS manual (accessible by running ‘nixos-help’). -{ config, pkgs, lib, ... }: +{ + config, + pkgs, + lib, + ... +}: { - imports = - [ # Include the results of the hardware scan. - ./ceph.nix - ./hardware-configuration.nix - ./minio.nix - ]; + imports = [ + # Include the results of the hardware scan. + ./ceph.nix + ./hardware-configuration.nix + ./minio.nix + ]; - # Bootloader. - boot.loader.systemd-boot.enable = true; - boot.loader.efi.canTouchEfiVariables = true; + # Bootloader. + boot.loader.systemd-boot.enable = true; + boot.loader.efi.canTouchEfiVariables = true; - networking = { - hostName = "jeremiah"; # Define your hostname. - useDHCP = false; - defaultGateway = { - address = " 10.42.1.1"; - interface = "enp68s0"; - }; - vlans = { - san = { - id = 616; - interface = "enp67s0"; - }; - }; - interfaces = { - enp68s0 = { - ipv4.addresses = [ { - address = "10.42.1.8"; - prefixLength = 16; - } { - address = "10.42.100.1"; - prefixLength = 16; - } ]; - }; - san = { - ipv4.addresses = [ { - address = "10.201.1.2"; - prefixLength = 24; - } ]; - }; - }; - nameservers = [ - "10.42.1.5" - ]; - }; - greg = { - home = true; - tailscale.enable = true; - }; - environment.systemPackages = with pkgs; [ - btrfs-progs - curl - gawk - git - unzip - wget - ]; - - fileSystems = { - "/nix" = { - fsType = "btrfs"; - options = [ "subvol=nix" ]; - device = "/dev/nvme0n1p1"; - }; - "/var" = { - fsType = "btrfs"; - options = [ "subvol=var" ]; - device = "/dev/nvme0n1p1"; - }; - }; + networking = { + hostName = "jeremiah"; # Define your hostname. + useDHCP = false; + defaultGateway = { + address = " 10.42.1.1"; + interface = "enp68s0"; + }; + vlans = { + san = { + id = 616; + interface = "enp67s0"; + }; + }; + interfaces = { + enp68s0 = { + ipv4.addresses = [ + { + address = "10.42.1.8"; + prefixLength = 16; + } + { + address = "10.42.100.1"; + prefixLength = 16; + } + ]; + }; + san = { + ipv4.addresses = [ + { + address = "10.201.1.2"; + prefixLength = 24; + } + ]; + }; + }; + nameservers = [ "10.42.1.5" ]; + }; + greg = { + home = true; + tailscale.enable = true; + }; + environment.systemPackages = with pkgs; [ + curl + gawk + git + unzip + wget + ]; - ##################################################################################### - #################### Virtualbox Runner ############################################## - ##################################################################################### - services = { - gitlab-runner = { - enable = true; - settings.concurrent = 7; - services = { - shell = { - executor = "shell"; - limit = 5; - registrationConfigFile = config.age.secrets.runner-reg.path; - environmentVariables = { - EFI_DIR = "${pkgs.OVMF.fd}/FV/"; - STORAGE_URL = "http://s3.thehellings.lan:9000"; - }; - }; - }; - }; - }; - age.secrets.runner-reg.file = ../../secrets/gitlab/jeremiah-runner-reg.age; - virtualisation.virtualbox.host = { - enable = true; - enableExtensionPack = true; - enableHardening = false; - headless = true; - enableWebService = true; - }; + fileSystems = { + "/nix" = { + fsType = "btrfs"; + options = [ "subvol=nix" ]; + device = "/dev/nvme0n1p1"; + }; + "/var" = { + fsType = "btrfs"; + options = [ "subvol=var" ]; + device = "/dev/nvme0n1p1"; + }; + }; - systemd.services."gitlab-runner" = { - after = [ - "network.target" - "network-online.target" - "systemd-resolved.service" - ]; - wants = [ - "network-online.target" - "systemd-resolved.service" - ]; - preStart = builtins.concatStringsSep "\n" [ - "${pkgs.kmod}/bin/modprobe vboxdrv" - "${pkgs.kmod}/bin/modprobe vboxnetadp" - "${pkgs.kmod}/bin/modprobe vboxnetflt" - ]; - postStop = "${pkgs.kmod}/bin/rmmod vboxnetadp vboxnetflt vboxdrv"; - serviceConfig = { - DevicePolicy = lib.mkForce "auto"; - User = "root"; - DynamicUser = lib.mkForce false; - }; - }; + ##################################################################################### + #################### Virtualbox Runner ############################################## + ##################################################################################### + services = { + gitlab-runner = { + enable = true; + settings.concurrent = 7; + services = { + shell = { + executor = "shell"; + limit = 5; + authenticationTokenConfigFile = config.age.secrets.runner-reg.path; + environmentVariables = { + EFI_DIR = "${pkgs.OVMF.fd}/FV/"; + STORAGE_URL = "http://s3.thehellings.lan:9000"; + }; + }; + }; + }; + }; + age.secrets.runner-reg.file = ../../secrets/gitlab/jeremiah-runner-reg.age; + virtualisation.virtualbox.host = { + enable = true; + enableExtensionPack = true; + enableHardening = false; + headless = true; + enableWebService = true; + }; + + systemd.services."gitlab-runner" = { + after = [ + "network.target" + "network-online.target" + "systemd-resolved.service" + ]; + wants = [ + "network-online.target" + "systemd-resolved.service" + ]; + preStart = builtins.concatStringsSep "\n" [ + "${pkgs.kmod}/bin/modprobe vboxdrv" + "${pkgs.kmod}/bin/modprobe vboxnetadp" + "${pkgs.kmod}/bin/modprobe vboxnetflt" + ]; + postStop = "${pkgs.kmod}/bin/rmmod vboxnetadp vboxnetflt vboxdrv"; + serviceConfig = { + DevicePolicy = lib.mkForce "auto"; + User = "root"; + DynamicUser = lib.mkForce false; + }; + }; } diff --git a/hosts/jeremiah/hardware-configuration.nix b/hosts/jeremiah/hardware-configuration.nix index fcd7de1..c0c7635 100644 --- a/hosts/jeremiah/hardware-configuration.nix +++ b/hosts/jeremiah/hardware-configuration.nix @@ -1,27 +1,37 @@ # Do not modify this file! It was generated by ‘nixos-generate-config’ # and may be overwritten by future invocations. Please make changes # to /etc/nixos/configuration.nix instead. -{ config, lib, pkgs, modulesPath, ... }: +{ + config, + lib, + modulesPath, + ... +}: { - imports = - [ (modulesPath + "/installer/scan/not-detected.nix") - ]; + imports = [ (modulesPath + "/installer/scan/not-detected.nix") ]; - boot.initrd.availableKernelModules = [ "nvme" "xhci_pci" "ahci" "uas" "usbhid" "sd_mod" ]; + boot.initrd.availableKernelModules = [ + "nvme" + "xhci_pci" + "ahci" + "uas" + "usbhid" + "sd_mod" + ]; boot.initrd.kernelModules = [ ]; boot.kernelModules = [ "kvm-amd" ]; boot.extraModulePackages = [ ]; - fileSystems."/" = - { device = "/dev/disk/by-uuid/ffc167f5-d9e4-4b11-a5f1-f7da0550ad24"; - fsType = "ext4"; - }; + fileSystems."/" = { + device = "/dev/disk/by-uuid/ffc167f5-d9e4-4b11-a5f1-f7da0550ad24"; + fsType = "ext4"; + }; - fileSystems."/boot" = - { device = "/dev/disk/by-uuid/3047-870E"; - fsType = "vfat"; - }; + fileSystems."/boot" = { + device = "/dev/disk/by-uuid/3047-870E"; + fsType = "vfat"; + }; swapDevices = [ ]; diff --git a/hosts/jeremiah/minio.nix b/hosts/jeremiah/minio.nix index 522498f..4535021 100644 --- a/hosts/jeremiah/minio.nix +++ b/hosts/jeremiah/minio.nix @@ -1,32 +1,33 @@ { config, pkgs, ... }: let - minioPort = 9000; - minioConsolePort = 9001; -in { - environment.systemPackages = with pkgs; [ - minio-client - xfsprogs - ]; + minioPort = 9000; + minioConsolePort = 9001; +in +{ + environment.systemPackages = with pkgs; [ + minio-client + xfsprogs + ]; - greg.proxies."minio-02.thehellings.lan".target = "http://localhost:9000"; + greg.proxies."minio-02.thehellings.lan".target = "http://localhost:9000"; - fileSystems."/data/1" = { - device = "/dev/disk/by-id/ata-ST12000NM0558_ZHZ5YSXW-part1"; - fsType = "xfs"; - }; + fileSystems."/data/1" = { + device = "/dev/disk/by-id/ata-ST12000NM0558_ZHZ5YSXW-part1"; + fsType = "xfs"; + }; - networking.firewall.allowedTCPPorts = [ - minioPort - minioConsolePort - ]; + networking.firewall.allowedTCPPorts = [ + minioPort + minioConsolePort + ]; - age.secrets.minio.file = ../../secrets/minio.age; + age.secrets.minio.file = ../../secrets/minio.age; - services.minio = { - enable = true; - dataDir = [ "/data/1/minio" ]; - rootCredentialsFile = config.age.secrets.minio.path; - browser = true; - }; + services.minio = { + enable = true; + dataDir = [ "/data/1/minio" ]; + rootCredentialsFile = config.age.secrets.minio.path; + browser = true; + }; } diff --git a/hosts/jude/boot.nix b/hosts/jude/boot.nix index 1a1d0b9..67e0017 100644 --- a/hosts/jude/boot.nix +++ b/hosts/jude/boot.nix @@ -1,50 +1,55 @@ { lib, pkgs, ... }: { - # Use the systemd-boot EFI boot loader. - boot = { - binfmt.emulatedSystems = [ "aarch64-linux" ]; - kernelPackages = pkgs.linuxPackages_latest; - supportedFilesystems = [ "ntfs" ]; - loader = { - timeout = 15; - systemd-boot = { - enable = true; - configurationLimit = 20; - extraEntries = { - "Windows.conf" = (lib.strings.concatStringsSep "\n" [ - "title Windows" - "efi /EFI/Microsoft/EFI/bootmgfw.efi" - ]); - "Win2.conf" = (lib.strings.concatStringsSep "\n" [ - "title Windows 11" - "efi /shellx64.efi" - "options -nointerrupt -noconsolein -noconsoleout windows11.nsh" - ]); - "Shell.conf" = (lib.strings.concatStringsSep "\n" [ - "title EFI Shell" - "efi /shell.efi" - ]); - }; - extraFiles = { - "windows11.nsh" = (pkgs.writeText "windows11.nsh" (lib.strings.concatStringsSep "\n" [ - ])); - "shell.efi" = "${pkgs.edk2-uefi-shell}/shell.efi"; - }; - }; - grub = { - enable = false; - device = "/dev/nvme0n1"; - useOSProber = true; - efiSupport = true; - extraEntries = '' - menuentry "Windows" --class windows --class os { - insmod ntfs - chainloader (hd0,0)/EFI/Windows/bootmgfw.efi - } - ''; - }; - #efi.canTouchEfiVariables = true; - }; - }; + # Use the systemd-boot EFI boot loader. + boot = { + binfmt.emulatedSystems = [ "aarch64-linux" ]; + kernelPackages = pkgs.linuxPackages_latest; + supportedFilesystems = [ "ntfs" ]; + loader = { + timeout = 15; + systemd-boot = { + enable = true; + configurationLimit = 20; + extraEntries = { + "Windows.conf" = ( + lib.strings.concatStringsSep "\n" [ + "title Windows" + "efi /EFI/Microsoft/EFI/bootmgfw.efi" + ] + ); + "Win2.conf" = ( + lib.strings.concatStringsSep "\n" [ + "title Windows 11" + "efi /shellx64.efi" + "options -nointerrupt -noconsolein -noconsoleout windows11.nsh" + ] + ); + "Shell.conf" = ( + lib.strings.concatStringsSep "\n" [ + "title EFI Shell" + "efi /shell.efi" + ] + ); + }; + extraFiles = { + "windows11.nsh" = (pkgs.writeText "windows11.nsh" (lib.strings.concatStringsSep "\n" [ ])); + "shell.efi" = "${pkgs.edk2-uefi-shell}/shell.efi"; + }; + }; + grub = { + enable = false; + device = "/dev/nvme0n1"; + useOSProber = true; + efiSupport = true; + extraEntries = '' + menuentry "Windows" --class windows --class os { + insmod ntfs + chainloader (hd0,0)/EFI/Windows/bootmgfw.efi + } + ''; + }; + #efi.canTouchEfiVariables = true; + }; + }; } diff --git a/hosts/jude/default.nix b/hosts/jude/default.nix index bc6b0e8..0ba6924 100644 --- a/hosts/jude/default.nix +++ b/hosts/jude/default.nix @@ -1,119 +1,129 @@ { pkgs, config, ... }: { - imports = [ - ./boot.nix - ./hardware-configuration.nix - ./podman.nix - ./printing.nix - ./virt.nix - ]; - programs = { - steam.enable = true; - nix-index = { - enable = true; - enableBashIntegration = false; - enableFishIntegration = false; - enableZshIntegration = false; - }; - nix-ld.enable = false; - }; + imports = [ + ./boot.nix + ./hardware-configuration.nix + ./podman.nix + ./virt.nix + ./work.nix + ]; + programs = { + steam.enable = true; + nix-index = { + enable = true; + enableBashIntegration = false; + enableFishIntegration = false; + enableZshIntegration = false; + }; + nix-ld.enable = false; + }; - networking = { - hostName = "jude"; - enableIPv6 = false; - interfaces.enp12s0.useDHCP = true; - firewall = { - enable = false; - allowedTCPPorts = [ 21000 ]; - allowedUDPPorts = [ 21000 21010 ]; - }; - }; - greg = { - tailscale.enable = true; - sway.enable = false; - gnome.enable = true; - kde.enable = false; - }; + networking = { + hostName = "jude"; + enableIPv6 = false; + interfaces.enp12s0.useDHCP = true; + firewall = { + enable = false; + allowedTCPPorts = [ 21000 ]; + allowedUDPPorts = [ + 21000 + 21010 + ]; + }; + }; + greg = { + tailscale.enable = true; + sway.enable = false; + gnome.enable = false; + kde.enable = true; + print.enable = true; + remote-builder.enable = true; + }; - boot.extraModulePackages = [ config.boot.kernelPackages.v4l2loopback ]; + boot.extraModulePackages = [ config.boot.kernelPackages.v4l2loopback ]; - environment.systemPackages = with pkgs; lib.mkMerge [ - [ # for Immersed - cudatoolkit - immersed-vr - libva - ] - [ - bind # For things like nslookup - create_ssl - distrobox - expect - gimp - go - gparted - gnucash - graphviz - flock - ffmpeg - handbrake - imagemagick - libtheora - libxml2 - linode-cli - makemkv - oathToolkit - usbutils - vagrant - ventoy - ] + environment.systemPackages = + with pkgs; + lib.mkMerge [ + [ + # for Immersed + cudatoolkit + immersed + libva + ] + [ + bind # For things like nslookup + create_ssl + distrobox + expect + gimp + go + gparted + gnucash + graphviz + flock + ffmpeg + handbrake + imagemagick + libtheora + libxml2 + linode-cli + makemkv + oathToolkit + usbutils + ventoy + ] - [ - # Video/Audio data composition framework tools like "gst-inspect", "gst-launch" ... - gst_all_1.gstreamer - gst_all_1.gst-plugins-base - gst_all_1.gst-plugins-good - gst_all_1.gst-plugins-bad - gst_all_1.gst-plugins-ugly - gst_all_1.gst-libav - gst_all_1.gst-vaapi - ] - ]; - fileSystems = { - "/boot" = { - device = "/dev/nvme0n1p1"; - fsType = "auto"; - }; - "/windows" = { - device = "/dev/nvme0n1p5"; - fsType = "ntfs-3g"; - }; - "/windows11" = { - device = "/dev/nvme1n1p2"; - fsType = "ntfs-3g"; - }; - }; + [ + # Video/Audio data composition framework tools like "gst-inspect", "gst-launch" ... + gst_all_1.gstreamer + gst_all_1.gst-plugins-base + gst_all_1.gst-plugins-good + gst_all_1.gst-plugins-bad + gst_all_1.gst-plugins-ugly + gst_all_1.gst-libav + gst_all_1.gst-vaapi + ] + ]; + fileSystems = { + "/boot" = { + device = "/dev/nvme0n1p1"; + fsType = "auto"; + }; + "/windows" = { + device = "/dev/nvme0n1p5"; + fsType = "ntfs-3g"; + }; + "/windows11" = { + device = "/dev/nvme1n1p2"; + fsType = "ntfs-3g"; + }; + }; - # Let's do a sound thing - services = { - pipewire = { - enable = true; - alsa.enable = true; - audio.enable = true; - jack.enable = true; - pulse.enable = true; - wireplumber.enable = true; - }; - locate.enable = true; - xserver.videoDrivers = [ "nvidia" ]; - }; - hardware = { - nvidia = { - modesetting.enable = true; - nvidiaSettings = true; - #open = true; - }; - pulseaudio.enable = false; # This conflicts with pipewire - system76.enableAll = true; - }; + # Let's do a sound thing + services = { + pipewire = { + enable = true; + alsa.enable = true; + audio.enable = true; + jack.enable = true; + pulse.enable = true; + wireplumber.enable = true; + }; + locate.enable = true; + xserver.videoDrivers = [ "nvidia" ]; + }; + hardware = { + nvidia = { + modesetting.enable = true; + nvidiaSettings = true; + open = true; + }; + pulseaudio.enable = false; # This conflicts with pipewire + system76 = { + firmware-daemon.enable = true; + #kernel-modules.enable = true; + }; + }; } diff --git a/hosts/jude/hardware-configuration.nix b/hosts/jude/hardware-configuration.nix index 5b54c4b..10d765f 100644 --- a/hosts/jude/hardware-configuration.nix +++ b/hosts/jude/hardware-configuration.nix @@ -1,23 +1,33 @@ # Do not modify this file! It was generated by ‘nixos-generate-config’ # and may be overwritten by future invocations. Please make changes # to /etc/nixos/configuration.nix instead. -{ config, lib, pkgs, modulesPath, ... }: +{ + config, + lib, + modulesPath, + ... +}: { - imports = - [ (modulesPath + "/installer/scan/not-detected.nix") - ]; + imports = [ (modulesPath + "/installer/scan/not-detected.nix") ]; - boot.initrd.availableKernelModules = [ "nvme" "xhci_pci" "ahci" "usbhid" "usb_storage" "sd_mod" ]; + boot.initrd.availableKernelModules = [ + "nvme" + "xhci_pci" + "ahci" + "usbhid" + "usb_storage" + "sd_mod" + ]; boot.initrd.kernelModules = [ ]; boot.kernelModules = [ "kvm-amd" ]; boot.extraModulePackages = [ ]; - fileSystems."/" = - { #device = "/dev/disk/by-uuid/27ae91ed-32e9-411e-8227-0d99e360fbbf"; - device = "/dev/nvme0n1p4"; - fsType = "btrfs"; - }; + fileSystems."/" = { + #device = "/dev/disk/by-uuid/27ae91ed-32e9-411e-8227-0d99e360fbbf"; + device = "/dev/nvme0n1p4"; + fsType = "btrfs"; + }; swapDevices = [ ]; diff --git a/hosts/jude/podman.nix b/hosts/jude/podman.nix index 837ebf4..784b5fe 100644 --- a/hosts/jude/podman.nix +++ b/hosts/jude/podman.nix @@ -1,8 +1,8 @@ { ... }: { - virtualisation.podman = { - enable = true; - dockerCompat = true; - }; + virtualisation.podman = { + enable = true; + dockerCompat = true; + }; } diff --git a/hosts/jude/printing.nix b/hosts/jude/printing.nix deleted file mode 100644 index 07d237f..0000000 --- a/hosts/jude/printing.nix +++ /dev/null @@ -1,12 +0,0 @@ -{ pkgs, ... }: - -{ - # ipp://printer.thehellings.lan:631/ - generic postscript printer - services.printing = { - enable = true; - drivers = with pkgs; [ - gutenprint - gutenprintBin - ]; - }; -} diff --git a/hosts/jude/virt.nix b/hosts/jude/virt.nix index 26fcc46..57b4880 100644 --- a/hosts/jude/virt.nix +++ b/hosts/jude/virt.nix @@ -1,38 +1,38 @@ { pkgs, config, ... }: { - greg.vmdev.enable = true; + greg.vmdev.enable = true; - virtualisation = { - waydroid.enable = false; - lxd.enable = false; - }; + virtualisation = { + waydroid.enable = false; + lxd.enable = false; + }; - systemd.services = { - gitlab-runner = { - conflicts = [ "libvirtd.service" ]; - preStart = builtins.concatStringsSep "\n" [ - "${pkgs.kmod}/bin/modprobe vboxnetflt vboxdrv" - "${pkgs.kmod}/bin/modprobe vboxnetadp" - ]; - postStop = "${pkgs.kmod}/bin/rmmod vboxnetflt vboxnetadp vboxdrv"; - wantedBy = pkgs.lib.mkForce []; - serviceConfig.User = "root"; - }; - }; + systemd.services = { + gitlab-runner = { + conflicts = [ "libvirtd.service" ]; + preStart = builtins.concatStringsSep "\n" [ + "${pkgs.kmod}/bin/modprobe vboxnetflt vboxdrv" + "${pkgs.kmod}/bin/modprobe vboxnetadp" + ]; + postStop = "${pkgs.kmod}/bin/rmmod vboxnetflt vboxnetadp vboxdrv"; + wantedBy = pkgs.lib.mkForce [ ]; + serviceConfig.User = "root"; + }; + }; - age.secrets.runner-reg.file = ../../secrets/gitlab/myself-vbox-runner-reg.age; + age.secrets.runner-reg.file = ../../secrets/gitlab/myself-vbox-runner-reg.age; - services.gitlab-runner = { - enable = true; - settings.concurrent = 5; - services.vbox = { - executor = "shell"; - limit = 5; - registrationConfigFile = config.age.secrets.runner-reg.path; - environmentVariables = { - EFI_DIR = "${pkgs.OVMF.fd}/FV/"; - }; - }; - }; + services.gitlab-runner = { + enable = true; + settings.concurrent = 5; + services.vbox = { + executor = "shell"; + limit = 5; + authenticationTokenConfigFile = config.age.secrets.runner-reg.path; + environmentVariables = { + EFI_DIR = "${pkgs.OVMF.fd}/FV/"; + }; + }; + }; } diff --git a/hosts/jude/work.nix b/hosts/jude/work.nix new file mode 100644 index 0000000..249ba23 --- /dev/null +++ b/hosts/jude/work.nix @@ -0,0 +1,8 @@ +{ pkgs, ... }: + +{ + services.mongodb = { + enable = false; + }; + environment.systemPackages = with pkgs; [ mongodb-compass ]; +} diff --git a/hosts/linode/default.nix b/hosts/linode/default.nix index 8493590..5ede3a1 100644 --- a/hosts/linode/default.nix +++ b/hosts/linode/default.nix @@ -1,78 +1,86 @@ -{ pkgs, lib, config, ... }: +{ + pkgs, + lib, + config, + ... +}: { - imports = [ - ./git.nix - ./hardware-configuration.nix - ./podman.nix - ./matrix.nix - ./nextcloud.nix - ./nginx.nix - ./postgres.nix - ]; + imports = [ + ./git.nix + ./hardware-configuration.nix + ./podman.nix + ./matrix.nix + ./nextcloud.nix + ./nginx.nix + ./postgres.nix + ]; - greg = { - home = false; - linode.enable = true; - tailscale.enable = true; - }; + greg = { + home = false; + linode.enable = true; + tailscale.enable = true; + }; - programs.ssh.extraConfig = lib.strings.concatStringsSep "\n" [ - "Host chronicles.shire-zebra.ts.net" - " User backup" - " IdentityFile /etc/ssh/backup_ed25519" - " StrictHostKeyChecking no" - " UserKnownHostsFile /dev/null" - ]; + programs.ssh.extraConfig = lib.strings.concatStringsSep "\n" [ + "Host chronicles.shire-zebra.ts.net" + " User backup" + " IdentityFile /etc/ssh/backup_ed25519" + " StrictHostKeyChecking no" + " UserKnownHostsFile /dev/null" + ]; - networking = { - networkmanager.enable = lib.mkForce false; - hostName = "linode"; - domain = "thehellings.com"; - nameservers = [ - "100.88.91.27" - ]; - }; + networking = { + networkmanager.enable = lib.mkForce false; + hostName = "linode"; + domain = "thehellings.com"; + nameservers = [ "100.88.91.27" ]; + }; - age.secrets.runner-deployer = { - file = ../../secrets/gitlab/linode-deployer-runner-reg.age; - owner = "gitlab-runner"; - }; + age.secrets.runner-deployer = { + file = ../../secrets/gitlab/linode-deployer-runner-reg.age; + owner = "gitlab-runner"; + }; - services.gitlab-runner = { - enable = true; - services.deployer = { - executor = "shell"; - registrationConfigFile = config.age.secrets.runner-deployer.path; - }; - }; + services.gitlab-runner = { + enable = true; + services.deployer = { + executor = "shell"; + authenticationTokenConfigFile = config.age.secrets.runner-deployer.path; + }; + }; - users.users.gitlab-runner = { - isSystemUser = true; - group = "gitlab-runner"; - }; - users.groups.gitlab-runner = {}; + users.users.gitlab-runner = { + isSystemUser = true; + group = "gitlab-runner"; + }; + users.groups.gitlab-runner = { }; - systemd.services."gitlab-runner".serviceConfig = { - DynamicUser = lib.mkForce false; - User = "gitlab-runner"; - }; + systemd.services."gitlab-runner".serviceConfig = { + DynamicUser = lib.mkForce false; + User = "gitlab-runner"; + }; - security.sudo.extraRules = [{ - users = [ "gitlab-runner" ]; - commands = [{ - command = "/run/current-system/sw/bin/systemctl"; - options = [ "NOPASSWD" ]; - } { - command = "/run/current-system/sw/bin/podman"; - options = [ "NOPASSWD" ]; - }]; - }]; + security.sudo.extraRules = [ + { + users = [ "gitlab-runner" ]; + commands = [ + { + command = "/run/current-system/sw/bin/systemctl"; + options = [ "NOPASSWD" ]; + } + { + command = "/run/current-system/sw/bin/podman"; + options = [ "NOPASSWD" ]; + } + ]; + } + ]; - environment.systemPackages = with pkgs; [ - bind - graphviz - nix-du - pgloader - ]; + environment.systemPackages = with pkgs; [ + bind + graphviz + nix-du + pgloader + ]; } diff --git a/hosts/linode/git.nix b/hosts/linode/git.nix index d393ac3..64ab313 100644 --- a/hosts/linode/git.nix +++ b/hosts/linode/git.nix @@ -1,44 +1,45 @@ -{ config, pkgs, ... }: +{ ... }: let - srcDomain = "src.thehellings.com"; - sshPort = 2222; -in { - greg.proxies."${srcDomain}" = { - target = "http://git.thehellings.lan"; - ssl = true; - genAliases = false; - extraConfig = '' - proxy_set_header X-Forwarded-Proto https; - proxy_set_header X-Forwarded-Ssl on; - ''; - }; - greg.proxies."registry.thehellings.com" = { - target = "https://registry.thehellings.lan:5000"; - ssl = true; - genAliases = false; - extraConfig = "client_max_body_size 250m;"; - }; + srcDomain = "src.thehellings.com"; + sshPort = 2222; +in +{ + greg.proxies."${srcDomain}" = { + target = "http://git.thehellings.lan"; + ssl = true; + genAliases = false; + extraConfig = '' + proxy_set_header X-Forwarded-Proto https; + proxy_set_header X-Forwarded-Ssl on; + ''; + }; + greg.proxies."registry.thehellings.com" = { + target = "https://registry.thehellings.lan:5000"; + ssl = true; + genAliases = false; + extraConfig = "client_max_body_size 250m;"; + }; - networking.firewall.allowedTCPPorts = [ sshPort ]; + networking.firewall.allowedTCPPorts = [ sshPort ]; - services.haproxy = { - enable = true; - config = builtins.concatStringsSep "\n" [ - "global" - " daemon" - " maxconn 20" - - "defaults" - " timeout connect 500s" - " timeout client 500s" - " timeout server 1h" + services.haproxy = { + enable = true; + config = builtins.concatStringsSep "\n" [ + "global" + " daemon" + " maxconn 20" - "listen gitsshd" - " bind *:${toString sshPort}" - " timeout client 1h" - " mode tcp" - " server git-thehellings-lan git.thehellings.lan:22" - ]; - }; + "defaults" + " timeout connect 500s" + " timeout client 500s" + " timeout server 1h" + + "listen gitsshd" + " bind *:${toString sshPort}" + " timeout client 1h" + " mode tcp" + " server git-thehellings-lan git.thehellings.lan:22" + ]; + }; } diff --git a/hosts/linode/hardware-configuration.nix b/hosts/linode/hardware-configuration.nix index fc2b651..302e5f0 100644 --- a/hosts/linode/hardware-configuration.nix +++ b/hosts/linode/hardware-configuration.nix @@ -1,14 +1,22 @@ # Do not modify this file! It was generated by "nixos-generate-config" # and may be overwritten by future invocations. Please make changes # to /etc/nixos/configuration.nix instead. -{ config, lib, pkgs, modulesPath, ... }: +{ + config, + lib, + modulesPath, + ... +}: { - imports = [ - (modulesPath + "/profiles/qemu-guest.nix") - ]; + imports = [ (modulesPath + "/profiles/qemu-guest.nix") ]; - boot.initrd.availableKernelModules = [ "virtio_pci" "virtio_scsi" "ahci" "sd_mod" ]; + boot.initrd.availableKernelModules = [ + "virtio_pci" + "virtio_scsi" + "ahci" + "sd_mod" + ]; boot.initrd.kernelModules = [ ]; boot.kernelModules = [ ]; boot.extraModulePackages = [ ]; @@ -18,9 +26,7 @@ fsType = "ext4"; }; - swapDevices = [ - #{ device = "/dev/sdb"; } - ]; + swapDevices = [ { device = "/dev/sdb"; } ]; hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware; } diff --git a/hosts/linode/matrix.nix b/hosts/linode/matrix.nix index 81b26eb..45c146d 100644 --- a/hosts/linode/matrix.nix +++ b/hosts/linode/matrix.nix @@ -2,61 +2,71 @@ # them by the following commands: # nix run nixpkgs.matrix-synapse # register_new_matrix_user -k "B9EoPr2WV9hzwc7uL2Sx1JmvCeKDEOGCpB0uginQcQtEH4wzRtkSIdo7lltrjSQa" http://localhost:8448 -{ config, pkgs, ... }: +{ config, ... }: let - domain = "${config.networking.domain}"; - fqdn = "matrix.${domain}"; - conn = "postgresql:///dendrite?sslmode=disable&host=/run/postgresql"; + domain = "${config.networking.domain}"; + fqdn = "matrix.${domain}"; in { - services.nginx = { - virtualHosts = { - # Server the '.well-known' files to find the Matrix API server - "${domain}" = { - enableACME = true; - forceSSL = true; + services.nginx = { + virtualHosts = { + # Server the '.well-known' files to find the Matrix API server + "${domain}" = { + enableACME = true; + forceSSL = true; - # This is needed so that servers contacting hellings.com can find - # the actual application server at matrix.thehellings.com - locations."= /.well-known/matrix/server".extraConfig = - let - server = { "m.server" = "${fqdn}:443"; }; - in '' -add_header Content-Type application/json; -return 200 '${builtins.toJSON server}'; -''; + # This is needed so that servers contacting hellings.com can find + # the actual application server at matrix.thehellings.com + locations."= /.well-known/matrix/server".extraConfig = + let + server = { + "m.server" = "${fqdn}:443"; + }; + in + '' + add_header Content-Type application/json; + return 200 '${builtins.toJSON server}'; + ''; - locations."= /.well-known/matrix/client".extraConfig = - let - client = { - "m.homeserver" = { "base_url" = "https://${fqdn}"; }; - "m.identity_server" = { "base_url" = "https://vector.im"; }; - }; - in '' -add_header Content-Type application/json; -add_header Access-Control-Allow-Origin *; -return 200 '${builtins.toJSON client}'; -''; - }; + locations."= /.well-known/matrix/client".extraConfig = + let + client = { + "m.homeserver" = { + "base_url" = "https://${fqdn}"; + }; + "m.identity_server" = { + "base_url" = "https://vector.im"; + }; + }; + in + '' + add_header Content-Type application/json; + add_header Access-Control-Allow-Origin *; + return 200 '${builtins.toJSON client}'; + ''; + }; - # Reverse proxy in front of the actual Matrix server - "${fqdn}" = { - enableACME = true; - forceSSL = true; + # Reverse proxy in front of the actual Matrix server + "${fqdn}" = { + enableACME = true; + forceSSL = true; - # Not the appropriate place for the chat client - locations."/".extraConfig = "return 404;"; + # Not the appropriate place for the chat client + locations."/".extraConfig = "return 404;"; - locations."/_matrix" = { - proxyPass = "http://matrix.shire-zebra.ts.net:8448"; # Lacking the trailing / is correct - }; - }; - }; - }; + locations."/_matrix" = { + proxyPass = "http://matrix.shire-zebra.ts.net:8448"; # Lacking the trailing / is correct + }; + }; + }; + }; - # Open networking ports for the server - networking.firewall = { - enable = true; - allowedTCPPorts = [ 80 443 ]; - }; + # Open networking ports for the server + networking.firewall = { + enable = true; + allowedTCPPorts = [ + 80 + 443 + ]; + }; } diff --git a/hosts/linode/nextcloud.nix b/hosts/linode/nextcloud.nix index f267d7b..9afc297 100644 --- a/hosts/linode/nextcloud.nix +++ b/hosts/linode/nextcloud.nix @@ -1,38 +1,38 @@ { config, pkgs, ... }: { - age.secrets.nextcloudadmin.file = ../../secrets/nextcloudadmin.age; - age.secrets.nextcloudadmin.owner = "nextcloud"; + age.secrets.nextcloudadmin.file = ../../secrets/nextcloudadmin.age; + age.secrets.nextcloudadmin.owner = "nextcloud"; - services.nextcloud = { - enable = true; - package = pkgs.nextcloud29; - appstoreEnable = true; - hostName = "next.${config.networking.domain}"; - https = true; - config = { - adminpassFile = config.age.secrets.nextcloudadmin.path; - adminuser = "greg"; - dbhost = "/run/postgresql"; - dbtype = "pgsql"; - }; - settings = { - default_phone_region = "US"; - overwriteprotocol = "https"; - }; - }; + services.nextcloud = { + enable = true; + package = pkgs.nextcloud29; + appstoreEnable = true; + hostName = "next.${config.networking.domain}"; + https = true; + config = { + adminpassFile = config.age.secrets.nextcloudadmin.path; + adminuser = "greg"; + dbhost = "/run/postgresql"; + dbtype = "pgsql"; + }; + settings = { + default_phone_region = "US"; + overwriteprotocol = "https"; + }; + }; - services.nginx.virtualHosts."next.thehellings.com" = { - forceSSL = true; - enableACME = true; - }; + services.nginx.virtualHosts."next.thehellings.com" = { + forceSSL = true; + enableACME = true; + }; - # Otherwise nginx errors looking for the nextcloud sock file - systemd.services.nginx.after = [ "nextcloud.service" ]; + # Otherwise nginx errors looking for the nextcloud sock file + systemd.services.nginx.after = [ "nextcloud.service" ]; - greg.backup.jobs.nextcloud-bkup = { - src = "/var/lib/nextcloud"; - dest = "nextcloud-backup"; - id = "rbfco-rvmis"; - }; + greg.backup.jobs.nextcloud-bkup = { + src = "/var/lib/nextcloud"; + dest = "nextcloud-backup"; + id = "rbfco-rvmis"; + }; } diff --git a/hosts/linode/nginx.nix b/hosts/linode/nginx.nix index 2f46ce3..561d9e9 100644 --- a/hosts/linode/nginx.nix +++ b/hosts/linode/nginx.nix @@ -1,36 +1,36 @@ { ... }: let - homepage = "127.0.0.1:30080"; + homepage = "127.0.0.1:30080"; in { - security.acme = { - acceptTerms = true; - defaults.email = "greg.hellings@gmail.com"; - }; + security.acme = { + acceptTerms = true; + defaults.email = "greg.hellings@gmail.com"; + }; - services.nginx = { - enable = true; + services.nginx = { + enable = true; - # If there are recommended settings, let's use them! - recommendedGzipSettings = true; - recommendedOptimisation = true; - recommendedProxySettings = true; - recommendedTlsSettings = true; - }; + # If there are recommended settings, let's use them! + recommendedGzipSettings = true; + recommendedOptimisation = true; + recommendedProxySettings = true; + recommendedTlsSettings = true; + }; - # Actually serve the content from here - virtualisation.podman.enable = true; - virtualisation.oci-containers = { - backend = "podman"; - containers."homepage" = { - # needs explicit port to match what gitlab-runner sees when pulling - image = "registry.thehellings.com:443/greg/homepage/gregs-homepage:latest"; - ports = [ "${homepage}:80" ]; - }; - }; - greg.proxies."thehellings.com" = { - target = "http://${homepage}/"; - ssl = true; - genAliases = false; - }; + # Actually serve the content from here + virtualisation.podman.enable = true; + virtualisation.oci-containers = { + backend = "podman"; + containers."homepage" = { + # needs explicit port to match what gitlab-runner sees when pulling + image = "registry.thehellings.com:443/greg/homepage/gregs-homepage:latest"; + ports = [ "${homepage}:80" ]; + }; + }; + greg.proxies."thehellings.com" = { + target = "http://${homepage}/"; + ssl = true; + genAliases = false; + }; } diff --git a/hosts/linode/podman.nix b/hosts/linode/podman.nix index 97ba29d..99b3b29 100644 --- a/hosts/linode/podman.nix +++ b/hosts/linode/podman.nix @@ -1,9 +1,9 @@ { ... }: { - virtualisation.podman = { - enable = true; - dockerCompat = true; - dockerSocket.enable = true; - }; + virtualisation.podman = { + enable = true; + dockerCompat = true; + dockerSocket.enable = true; + }; } diff --git a/hosts/linode/postgres.nix b/hosts/linode/postgres.nix index 8172ddd..d43bdc3 100644 --- a/hosts/linode/postgres.nix +++ b/hosts/linode/postgres.nix @@ -1,63 +1,59 @@ -{ config, pkgs, lib, ... }: +{ config, pkgs, ... }: { - environment.systemPackages = [ - pkgs.upgrade-pg-cluster - ]; + environment.systemPackages = [ pkgs.upgrade-pg-cluster ]; - services.postgresql = { - enable = true; - package = pkgs.postgresql_15; - checkConfig = true; - ensureDatabases = [ - "nextcloud" - ]; - #initialScript = pkgs.writeText "create-matrix-db.sql" '' - # CREATE ROLE "matrix-synapse" WITH LOGIN; - # CREATE DATABASE "synapse" WITH OWNER "matrix-synapse" TEMPLATE template0 LC_COLLATE = "C" LC_CTYPE = "C"; - # GRANT ALL PRIVILEGES ON DATABASE "synapse" TO "matrix-synapse"; - #''; # These are done manually in order to set the LC_COLLATE values properly - ensureUsers = [ { - name = "nextcloud"; - ensureDBOwnership = true; - } ]; - settings = { - log_connections = true; - log_statement = "all"; - logging_collector = true; - log_filename = "postgresql.log"; - }; - identMap = '' -root root postgres -''; - }; + services.postgresql = { + enable = true; + package = pkgs.postgresql_15; + checkConfig = true; + ensureDatabases = [ "nextcloud" ]; + #initialScript = pkgs.writeText "create-matrix-db.sql" '' + # CREATE ROLE "matrix-synapse" WITH LOGIN; + # CREATE DATABASE "synapse" WITH OWNER "matrix-synapse" TEMPLATE template0 LC_COLLATE = "C" LC_CTYPE = "C"; + # GRANT ALL PRIVILEGES ON DATABASE "synapse" TO "matrix-synapse"; + #''; # These are done manually in order to set the LC_COLLATE values properly + ensureUsers = [ + { + name = "nextcloud"; + ensureDBOwnership = true; + } + ]; + settings = { + log_connections = true; + log_statement = "all"; + logging_collector = true; + log_filename = "postgresql.log"; + }; + identMap = '' + root root postgres + ''; + }; - services.postgresqlBackup = { - enable = true; - databases = [ - "nextcloud" - ]; - }; + services.postgresqlBackup = { + enable = true; + databases = [ "nextcloud" ]; + }; - services.logrotate = { - enable = true; - settings = { - postgresBackup = { - enable = true; - files = "${config.services.postgresqlBackup.location}/*.gz"; - }; - postgresLog = { - enable = true; - files = "/var/lib/postgresql/*/log/*.log"; - compress = true; - compresscmd = "${pkgs.xz}/bin/xz"; - }; - }; - }; + services.logrotate = { + enable = true; + settings = { + postgresBackup = { + enable = true; + files = "${config.services.postgresqlBackup.location}/*.gz"; + }; + postgresLog = { + enable = true; + files = "/var/lib/postgresql/*/log/*.log"; + compress = true; + compresscmd = "${pkgs.xz}/bin/xz"; + }; + }; + }; - greg.backup.jobs.greg-postgresql-backup = { - src = config.services.postgresqlBackup.location; - dest = "linode-postgres"; - id = "9pwvg-s257a"; - }; + greg.backup.jobs.greg-postgresql-backup = { + src = config.services.postgresqlBackup.location; + dest = "linode-postgres"; + id = "9pwvg-s257a"; + }; } diff --git a/hosts/myself/ceph.nix b/hosts/myself/ceph.nix index f57aa3e..695b109 100644 --- a/hosts/myself/ceph.nix +++ b/hosts/myself/ceph.nix @@ -1,33 +1,34 @@ { config, ... }: let - publicIp = (builtins.elemAt config.networking.interfaces.enp38s0.ipv4.addresses 0).address; - sanIp = (builtins.elemAt config.networking.interfaces.enp39s0.ipv4.addresses 0).address; - vip = (builtins.elemAt config.networking.interfaces.enp38s0.ipv4.addresses 1).address; - hostname = config.networking.hostName; - baseConfig = import ../../ceph/home.nix; -in { - services.ceph-benaco = baseConfig // { - enable = false; - monitor = { - enable = false; - initialKeyring = ../../secrets/home.mon.keyring; - nodeName = hostname; - bindAddr = publicIp; - advertisedPublicAddr = vip; - }; - osdBindAddr = publicIp; - osdAdvertisedPublicAddr = publicIp; - osds = { - osd1 = { - enable = false; - bootstrapKeyring = ../../secrets/home.osd-bootstrap.keyring; - id = 2; - uuid = "73424b68-210b-415f-800f-8767babea625"; - blockDevice = "/dev/disk/by-id/ata-ST12000NM0558_ZHZ5WM4L"; - blockDeviceUdevRuleMatcher = ''KERNEL=="sdb"''; - clusterAddress = sanIp; - }; - }; - }; + publicIp = (builtins.elemAt config.networking.interfaces.enp38s0.ipv4.addresses 0).address; + sanIp = (builtins.elemAt config.networking.interfaces.enp39s0.ipv4.addresses 0).address; + vip = (builtins.elemAt config.networking.interfaces.enp38s0.ipv4.addresses 1).address; + hostname = config.networking.hostName; + baseConfig = import ../../ceph/home.nix; +in +{ + services.ceph-benaco = baseConfig // { + enable = false; + monitor = { + enable = false; + initialKeyring = ../../secrets/home.mon.keyring; + nodeName = hostname; + bindAddr = publicIp; + advertisedPublicAddr = vip; + }; + osdBindAddr = publicIp; + osdAdvertisedPublicAddr = publicIp; + osds = { + osd1 = { + enable = false; + bootstrapKeyring = ../../secrets/home.osd-bootstrap.keyring; + id = 2; + uuid = "73424b68-210b-415f-800f-8767babea625"; + blockDevice = "/dev/disk/by-id/ata-ST12000NM0558_ZHZ5WM4L"; + blockDeviceUdevRuleMatcher = ''KERNEL=="sdb"''; + clusterAddress = sanIp; + }; + }; + }; } diff --git a/hosts/myself/container-git.nix b/hosts/myself/container-git.nix index c6c0014..928ffcf 100644 --- a/hosts/myself/container-git.nix +++ b/hosts/myself/container-git.nix @@ -1,195 +1,229 @@ -{ config, pkgs, lib, ... }: let - registryPort = 5000; - vpnIp = "100.78.226.76"; - containerIp = "192.168.200.2"; -in { - age.secretsMountPoint = "/run/derp"; - age.secrets = let - cfg = n: { file = ../../secrets/gitlab/${n}.age; owner = "gitlab"; group = "gitlab"; mode = "0444"; }; - in { - gitlab-secret = cfg "secret"; - gitlab-otp = cfg "otp"; - gitlab-db = cfg "db"; - gitlab-jws = cfg "jws"; - gitlab-key = cfg "key"; - gitlab-cert = cfg "cert"; +{ + config, + pkgs, + lib, + ... +}: +let + registryPort = 5000; + vpnIp = "100.78.226.76"; + containerIp = "192.168.200.2"; +in +{ + age.secretsMountPoint = "/run/derp"; + age.secrets = + let + cfg = n: { + file = ../../secrets/gitlab/${n}.age; + owner = "gitlab"; + group = "gitlab"; + mode = "0444"; + }; + in + { + gitlab-secret = cfg "secret"; + gitlab-otp = cfg "otp"; + gitlab-db = cfg "db"; + gitlab-jws = cfg "jws"; + gitlab-key = cfg "key"; + gitlab-cert = cfg "cert"; - minio_access_key_id = { - file = ../../secrets/minio_access_key_id.age; - owner = "gitlab"; - group = "gitlab"; - mode = "0444"; - }; - minio_secret_access_key = { - file = ../../secrets/minio_secret_access_key.age; - owner = "gitlab"; - group = "gitlab"; - mode = "0444"; - }; - }; + minio_access_key_id = { + file = ../../secrets/minio_access_key_id.age; + owner = "gitlab"; + group = "gitlab"; + mode = "0444"; + }; + minio_secret_access_key = { + file = ../../secrets/minio_secret_access_key.age; + owner = "gitlab"; + group = "gitlab"; + mode = "0444"; + }; + }; - networking.firewall.allowedTCPPorts = [ 80 registryPort ]; + networking.firewall.allowedTCPPorts = [ + 80 + registryPort + ]; - greg.proxies = let - t = { - target = "http://unix:/run/gitlab/gitlab-workhorse.socket"; - extraConfig = '' - proxy_set_header X-Forwarded-Proto https; - proxy_set_header X-Forwarded-Ssl on; - ''; - }; - in { - "${containerIp}" = t; - "${vpnIp}" = t; - "git.thehellings.lan" = t; - }; + greg.proxies = + let + t = { + target = "http://unix:/run/gitlab/gitlab-workhorse.socket"; + extraConfig = '' + proxy_set_header X-Forwarded-Proto https; + proxy_set_header X-Forwarded-Ssl on; + ''; + }; + in + { + "${containerIp}" = t; + "${vpnIp}" = t; + "git.thehellings.lan" = t; + }; - virtualisation.docker.enable = true; + virtualisation.docker.enable = true; - programs.ssh.extraConfig = lib.strings.concatStringsSep "\n" [ - "Host nas" - " User backup" - " IdentityFile /etc/ssh/duplicity_ed25519" - " StrictHostKeyChecking no" - " UserKnownHostsFile /dev/null" - ]; + programs.ssh.extraConfig = lib.strings.concatStringsSep "\n" [ + "Host nas" + " User backup" + " IdentityFile /etc/ssh/duplicity_ed25519" + " StrictHostKeyChecking no" + " UserKnownHostsFile /dev/null" + ]; - greg.backup.jobs.nas-backup = { - src = "/var/gitlab/state/backup/"; - dest = "gitlab"; - id = "yha^-s45h"; - }; + greg.backup.jobs.nas-backup = { + src = "/var/gitlab/state/backup/"; + dest = "gitlab"; + id = "yha^-s45h"; + }; - services = { - gitlab = { - enable = true; - backup = { - keepTime = 288; - startAt = [ "03:00" ]; - }; - host = "src.thehellings.com"; - https = true; - port = 443; - extraConfig = { - gitlab = { - trustedProxies = [ "100.109.86.8/32" ]; - }; - }; - initialRootEmail = "greg@thehellings.com"; - initialRootPasswordFile = pkgs.writeText "initialRootPassword" "root_password"; - pages = { - enable = true; - settings.pages-domain = "pages.thehellings.com"; - }; - puma = { - threadsMax = 6; - threadsMin = 2; - workers = 6; - }; - redisUrl = "unix:${config.services.redis.servers.gitlab.unixSocket}"; - registry = { - enable = true; - certFile = config.age.secrets.gitlab-cert.path; - keyFile = config.age.secrets.gitlab-key.path; - externalAddress = "registry.thehellings.com"; - externalPort = 443; - }; - secrets = { - secretFile = config.age.secrets.gitlab-secret.path; - otpFile = config.age.secrets.gitlab-otp.path; - dbFile = config.age.secrets.gitlab-db.path; - jwsFile = config.age.secrets.gitlab-jws.path; - }; + services = { + gitlab = { + enable = true; + backup = { + keepTime = 288; + startAt = [ "03:00" ]; + }; + host = "src.thehellings.com"; + https = true; + port = 443; + extraConfig = { + gitlab = { + trustedProxies = [ "100.109.86.8/32" ]; + }; + }; + initialRootEmail = "greg@thehellings.com"; + initialRootPasswordFile = pkgs.writeText "initialRootPassword" "root_password"; + pages = { + enable = true; + settings.pages-domain = "pages.thehellings.com"; + }; + puma = { + threadsMax = 6; + threadsMin = 2; + workers = 6; + }; + redisUrl = "unix:${config.services.redis.servers.gitlab.unixSocket}"; + registry = { + enable = true; + certFile = config.age.secrets.gitlab-cert.path; + keyFile = config.age.secrets.gitlab-key.path; + externalAddress = "registry.thehellings.com"; + externalPort = 443; + }; + secrets = { + secretFile = config.age.secrets.gitlab-secret.path; + otpFile = config.age.secrets.gitlab-otp.path; + dbFile = config.age.secrets.gitlab-db.path; + jwsFile = config.age.secrets.gitlab-jws.path; + }; - extraConfig = { - object_store = { - enabled = true; - proxy_download = false; # Tell them to reach out to object storage themselves! - connection = { - provider = "AWS"; - endpoint = "http://s3.thehellings.lan:9000"; - region = "us-east-1"; - aws_access_key_id = { _secret = config.age.secrets.minio_access_key_id.path; }; - aws_secret_access_key = { _secret = config.age.secrets.minio_secret_access_key.path; }; - path_style = true; # True for MinIO - aws_signature_version = 2; - }; - #storage_options = ...; - objects = builtins.listToAttrs ( builtins.map (x: lib.attrsets.nameValuePair x { bucket = "gitlab-${builtins.replaceStrings [ "_" ] [ "-" ] x}"; }) [ - "artifacts" - "ci_secure_files" - "dependency_proxy" - "external_diffs" - "lfs" - "packages" - "pages" - "terraform_state" - "uploads" - ]); - }; - }; - }; + extraConfig = { + object_store = { + enabled = true; + proxy_download = false; # Tell them to reach out to object storage themselves! + connection = { + provider = "AWS"; + endpoint = "http://s3.thehellings.lan:9000"; + region = "us-east-1"; + aws_access_key_id = { + _secret = config.age.secrets.minio_access_key_id.path; + }; + aws_secret_access_key = { + _secret = config.age.secrets.minio_secret_access_key.path; + }; + path_style = true; # True for MinIO + aws_signature_version = 2; + }; + #storage_options = ...; + objects = builtins.listToAttrs ( + builtins.map + ( + x: lib.attrsets.nameValuePair x { bucket = "gitlab-${builtins.replaceStrings [ "_" ] [ "-" ] x}"; } + ) + [ + "artifacts" + "ci_secure_files" + "dependency_proxy" + "external_diffs" + "lfs" + "packages" + "pages" + "terraform_state" + "uploads" + ] + ); + }; + }; + }; - nginx.virtualHosts."gitlab.shire-zebra.ts.net" = { - listen = [ { - addr = vpnIp; - port = registryPort; - ssl = true; - } ]; - locations."/" = { - proxyPass = "http://127.0.0.1:5000/"; - recommendedProxySettings = true; - }; - extraConfig = builtins.concatStringsSep "\n" [ - "ssl_certificate /etc/certs/gitlab.shire-zebra.ts.net.crt ;" - "ssl_certificate_key /etc/certs/gitlab.shire-zebra.ts.net.key ;" - "client_max_body_size 250m;" - ]; - }; + nginx.virtualHosts."gitlab.shire-zebra.ts.net" = { + listen = [ + { + addr = vpnIp; + port = registryPort; + ssl = true; + } + ]; + locations."/" = { + proxyPass = "http://127.0.0.1:5000/"; + recommendedProxySettings = true; + }; + extraConfig = builtins.concatStringsSep "\n" [ + "ssl_certificate /etc/certs/gitlab.shire-zebra.ts.net.crt ;" + "ssl_certificate_key /etc/certs/gitlab.shire-zebra.ts.net.key ;" + "client_max_body_size 250m;" + ]; + }; - # Fetch the SSL certificates for nginx to use - cron = { - enable = true; - systemCronJobs = [ "0 0 1 */2 * cd /etc/certs && tailscale cert gitlab.shire-zebra.ts.net && chown nginx * && systemctl reload nginx" ]; - }; + # Fetch the SSL certificates for nginx to use + cron = { + enable = true; + systemCronJobs = [ + "0 0 1 */2 * cd /etc/certs && tailscale cert gitlab.shire-zebra.ts.net && chown nginx * && systemctl reload nginx" + ]; + }; - postgresql = { - enable = true; - checkConfig = true; - ensureDatabases = [ "gitlab" ]; - ensureUsers = [ { - name = "gitlab"; - ensureDBOwnership = true; - } ]; - settings = { - log_connections = true; - log_statement = "all"; - logging_collector = true; - log_filename = "postgresql.log"; - }; - }; + postgresql = { + enable = true; + checkConfig = true; + ensureDatabases = [ "gitlab" ]; + ensureUsers = [ + { + name = "gitlab"; + ensureDBOwnership = true; + } + ]; + settings = { + log_connections = true; + log_statement = "all"; + logging_collector = true; + log_filename = "postgresql.log"; + }; + }; - redis.servers.gitlab = { - enable = true; - }; - resolved.enable = true; - openssh.enable = true; - }; + redis.servers.gitlab = { + enable = true; + }; + resolved.enable = true; + openssh.enable = true; + }; - # Do not start nginx until we have tailscaled up and running, so it can bind - # to the 100.* addresses - systemd.services = { - nginx = rec { - after = [ - "network-online.target" - ]; - wants = after; - serviceConfig = { - RestartMaxDelaySec = "30s"; - RestartSteps = "5"; - }; - }; - tailscaled.partOf = [ "network-online.target" ]; - }; - system.stateVersion = lib.mkForce "24.05"; + # Do not start nginx until we have tailscaled up and running, so it can bind + # to the 100.* addresses + systemd.services = { + nginx = rec { + after = [ "network-online.target" ]; + requires = [ "network-online.target" ]; + wants = after; + serviceConfig = { + RestartMaxDelaySec = "30s"; + RestartSteps = "5"; + }; + }; + tailscaled.partOf = [ "network-online.target" ]; + }; + system.stateVersion = lib.mkForce "24.05"; } diff --git a/hosts/myself/container-runner.nix b/hosts/myself/container-runner.nix index 090690f..fe7baae 100644 --- a/hosts/myself/container-runner.nix +++ b/hosts/myself/container-runner.nix @@ -1,91 +1,109 @@ -{ inputs, name, extra ? {}, packages ? [], overlays }: +{ + top, + name, + extra ? { }, + packages ? [ ], + overlays, +}: -({ config, pkgs, lib, ... }: ( -lib.attrsets.recursiveUpdate { + { + config, + pkgs, + lib, + ... + }: + (lib.attrsets.recursiveUpdate + { - imports = [ - inputs.agenix.nixosModules.default - inputs.self.modules.nixosModule - ]; + imports = [ + top.agenix.nixosModules.default + top.self.modules.nixosModule + ]; - nixpkgs.overlays = overlays; + nixpkgs.overlays = overlays; - greg.tailscale.enable = true; + greg.tailscale.enable = true; - age = { - identityPaths = [ "/etc/ssh/ssh_host_ed25519_key" ]; - secrets.runner-reg = { - file = ../../secrets/gitlab/myself-${name}-runner-reg.age; - owner = "gitlab-runner"; - }; - }; + age = { + identityPaths = [ "/etc/ssh/ssh_host_ed25519_key" ]; + secrets.runner-reg = { + file = ../../secrets/gitlab/myself-${name}-runner-reg.age; + owner = "gitlab-runner"; + }; + }; - environment.systemPackages = with pkgs; [ - curl - gawk - git - unzip - xorriso - wget - ] ++ packages; + environment.systemPackages = + with pkgs; + [ + curl + gawk + git + unzip + xorriso + wget + ] + ++ packages; - networking = { - useHostResolvConf = pkgs.lib.mkForce false; - nameservers = [ "100.100.100.100" ]; - }; + networking = { + useHostResolvConf = pkgs.lib.mkForce false; + nameservers = [ "100.100.100.100" ]; + }; - nixpkgs.config.allowUnfree = true; + nixpkgs.config.allowUnfree = true; - users.users.gitlab-runner = { - isSystemUser = true; - group = "kvm"; - extraGroups = [ "kvm" ]; - }; + users.users.gitlab-runner = { + isSystemUser = true; + group = "kvm"; + extraGroups = [ "kvm" ]; + }; - services = { - gitlab-runner = { - enable = true; - settings.concurrent = 5; - services = { - shell = { - executor = "shell"; - limit = 5; - registrationConfigFile = config.age.secrets.runner-reg.path; - environmentVariables = { - EFI_DIR = "${pkgs.OVMF.fd}/FV/"; - STORAGE_URL = "http://s3.thehellings.lan:9000"; - }; - }; - }; - }; - resolved.enable = true; - }; + services = { + gitlab-runner = { + enable = true; + settings.concurrent = 5; + services = { + shell = { + executor = "shell"; + limit = 5; + authenticationTokenConfigFile = config.age.secrets.runner-reg.path; + environmentVariables = { + EFI_DIR = "${pkgs.OVMF.fd}/FV/"; + STORAGE_URL = "http://s3.thehellings.lan:9000"; + }; + }; + }; + }; + resolved.enable = true; + }; - systemd.services.gitlab-runner = { - wants = [ - "network-online.target" - "systemd-resolved.service" - ]; - after = [ - "network.target" - "network-online.target" - "systemd-resolved.service" - ]; - serviceConfig = { - DevicePolicy = lib.mkForce "auto"; - PrivateDevices = false; - ProtectKernelModules = false; - DevicesAllow = [ "/dev/kvm" "/dev/mem" ]; - DynamicUser = lib.mkForce false; - User = "root"; - Group = "kvm"; - }; - }; + systemd.services.gitlab-runner = { + wants = [ + "network-online.target" + "systemd-resolved.service" + ]; + after = [ + "network.target" + "network-online.target" + "systemd-resolved.service" + ]; + serviceConfig = { + DevicePolicy = lib.mkForce "auto"; + PrivateDevices = false; + ProtectKernelModules = false; + DevicesAllow = [ + "/dev/kvm" + "/dev/mem" + ]; + DynamicUser = lib.mkForce false; + User = "root"; + Group = "kvm"; + }; + }; - system.stateVersion = lib.mkForce "24.05"; -} + system.stateVersion = lib.mkForce "24.05"; + } -extra -) # End of attrsets.recursiveUpdate -) # End of outter function wrapper + extra + ) # End of attrsets.recursiveUpdate +) # End of outter function wrapper diff --git a/hosts/myself/default.nix b/hosts/myself/default.nix index 2c8abb3..1564af3 100644 --- a/hosts/myself/default.nix +++ b/hosts/myself/default.nix @@ -1,86 +1,88 @@ -{ config, pkgs, lib, ... }: +{ lib, ... }: { - imports = [ - ./ceph.nix - ./hardware-configuration.nix - ./git.nix - ./matrix.nix - ./minio.nix - ]; + imports = [ + ./ceph.nix + ./hardware-configuration.nix + ./git.nix + ./matrix.nix + ./minio.nix + ]; - greg.tailscale.enable = true; + greg = { + tailscale.enable = true; + remote-builder.enable = true; + }; - services = { - openssh.enable = true; - }; - networking = { - hostName = "myself"; - useDHCP = false; - defaultGateway = { - address = " 10.42.1.1"; - interface = "enp38s0"; - }; - vlans = { - san = { - id = 616; - interface = "enp39s0"; - }; - }; - interfaces = { - enp38s0 = { - ipv4.addresses = [ { - address = "10.42.1.6"; - prefixLength = 16; - } { - address = "10.42.100.1"; - prefixLength = 16; - } ]; - }; - san = { - ipv4.addresses = [ { - address = "10.201.1.1"; - prefixLength = 24; - } ]; - }; - }; - nameservers = [ - "10.42.1.5" - ]; - }; - users = { - users = { - greg = { - extraGroups = [ - "kvm" - "sudo" - "wheel" - ]; - isNormalUser = true; - }; - }; - }; - system.stateVersion = lib.mkForce "24.05"; - boot = { - extraModprobeConfig = "options kvm_amd nested=1"; - supportedFilesystems = [ "ntfs" ]; - loader = { - efi = { - canTouchEfiVariables = true; - efiSysMountPoint = "/boot"; - }; - systemd-boot = { - enable = true; - configurationLimit = 10; - }; - }; - binfmt.emulatedSystems = [ - "aarch64-linux" - ]; - }; - nixpkgs.config = { - allowUnfree = true; - permittedInsecurePackages = [ - "nodejs-16.20.2" - ]; - }; + services = { + openssh.enable = true; + }; + networking = { + hostName = "myself"; + useDHCP = false; + defaultGateway = { + address = " 10.42.1.1"; + interface = "enp38s0"; + }; + vlans = { + san = { + id = 616; + interface = "enp39s0"; + }; + }; + interfaces = { + enp38s0 = { + ipv4.addresses = [ + { + address = "10.42.1.6"; + prefixLength = 16; + } + { + address = "10.42.100.1"; + prefixLength = 16; + } + ]; + }; + san = { + ipv4.addresses = [ + { + address = "10.201.1.1"; + prefixLength = 24; + } + ]; + }; + }; + nameservers = [ "10.42.1.5" ]; + }; + users = { + users = { + greg = { + extraGroups = [ + "kvm" + "sudo" + "wheel" + ]; + isNormalUser = true; + }; + }; + }; + system.stateVersion = lib.mkForce "24.05"; + boot = { + extraModprobeConfig = "options kvm_amd nested=1"; + supportedFilesystems = [ "ntfs" ]; + loader = { + efi = { + canTouchEfiVariables = true; + efiSysMountPoint = "/boot"; + }; + systemd-boot = { + enable = true; + configurationLimit = 10; + }; + }; + binfmt.emulatedSystems = [ "aarch64-linux" ]; + }; + nixpkgs.config = { + allowUnfree = true; + permittedInsecurePackages = [ "nodejs-16.20.2" ]; + }; } diff --git a/hosts/myself/git.nix b/hosts/myself/git.nix index ee58a74..c5b2c7e 100644 --- a/hosts/myself/git.nix +++ b/hosts/myself/git.nix @@ -1,140 +1,106 @@ -{ config, pkgs, lib, inputs, overlays, ... }: +{ + config, + pkgs, + lib, + ... +}: let + gitlabStateDir = "/var/lib/gitlab"; +in +{ + networking = { + firewall = { + enable = true; + allowedTCPPorts = [ 80 ]; + }; + nat = { + enable = true; + internalInterfaces = [ "ve-+" ]; + externalInterface = "enp38s0"; + }; + }; - gitlabStateDir = "/var/lib/gitlab"; + greg.proxies."git.thehellings.lan" = { + target = "http://192.168.200.2"; + extraConfig = '' + proxy_set_header X-Forwarded-Proto https; + proxy_set_header X-Forwarded-Ssl on; + ''; + }; - container = input: (lib.attrsets.recursiveUpdate { - bindMounts."/etc/ssh".hostPath = "/etc/ssh"; # For agenix secrets - enableTun = true; - privateNetwork = true; - } input); -in { - networking = { - firewall = { - enable = true; - allowedTCPPorts = [ 80 ]; - }; - nat = { - enable = true; - internalInterfaces = [ "ve-+" ]; - externalInterface = "enp38s0"; - }; - }; + system.activationScripts.makeGitlabDir = lib.stringAfter [ + "var" + ] "mkdir -p ${gitlabStateDir} && touch ${gitlabStateDir}/touch"; - greg.proxies."git.thehellings.lan" = { - target = "http://192.168.200.2"; - extraConfig = '' - proxy_set_header X-Forwarded-Proto https; - proxy_set_header X-Forwarded-Ssl on; - ''; - }; - - system.activationScripts.makeGitlabDir = lib.stringAfter [ "var" ] "mkdir -p ${gitlabStateDir} && touch ${gitlabStateDir}/touch"; + greg.containers.gitlab = { + tailscale = true; + subnet = "200"; + builder = (import ./container-git.nix); + }; - greg.containers.gitlab = { - tailscale = true; - subnet = "200"; - builder = (import ./container-git.nix); - }; - - systemd.services = { - "gitlab-runner" = { - after = [ "container@github.service" ]; - preStart = builtins.concatStringsSep "\n" [ - "${pkgs.kmod}/bin/modprobe kvm" - "${pkgs.kmod}/bin/modprobe kvm_amd" - ]; - postStop = builtins.concatStringsSep "\n" [ - "${pkgs.kmod}/bin/rmmod -f kvm_amd kvm" - ]; - serviceConfig = { - DevicePolicy = lib.mkForce "auto"; - DevicesAllow = [ "/dev/kvm" "/dev/mem" ]; - EnvironmentFile = config.age.secrets.docker-auth.path; - PermissionsStartOnly = "true"; - PrivateDevices = false; - ProtectKernelModules = false; - }; - }; - }; - - ##################################################################################### - #################### Container Podman Runner ######################################## - ##################################################################################### - containers.gitlab-runner-shell = container { - autoStart = true; - hostAddress = "192.168.203.1"; - localAddress = "192.168.203.2"; - config = ((import ./container-runner.nix) { - inherit inputs overlays; - name = "shell"; - extra.virtualisation.podman.enable = true; - }); - }; - - ##################################################################################### - #################### Local Podman/Docker Runner ##################################### - ##################################################################################### - age.secrets.runner-reg.file = ../../secrets/gitlab/myself-podman-runner-reg.age; - age.secrets.docker-auth.file = ../../secrets/gitlab/docker-auth.age; - age.secrets.runner-qemu.file = ../../secrets/gitlab/myself-qemu-runner-reg.age; - services.gitlab-runner = { - enable = true; - settings = { - concurrent = 5; - }; - services = { - default = { - executor = "docker"; - registrationConfigFile = config.age.secrets.runner-reg.path; - dockerImage = "gitlab.shire-zebra.ts.net:5000/greg/ci-images/fedora:latest"; - dockerAllowedImages = [ - "alpine:*" - "debian:*" - "docker:*" - "fedora:*" - "python:*" - "ubuntu:*" - - "hashicorp/*:*" - "koalaman/shellcheck:*" - - "registry.gitlab.com/gitlab-org/*" - "registry.thehellings.com/*/*/*:*" - "gitlab.shire-zebra.ts.net:5000/*/*/*:*" - ]; - dockerAllowedServices = [ - "docker:*" - "registry.thehellings.com/*/*/*:*" - "gitlab.shire-zebra.ts.net:5000/*/*/*:*" - ]; - dockerPrivileged = true; - dockerVolumes = [ - "/certs/client" - "/cache" - ]; - }; - qemu = { - executor = "shell"; - limit = 5; - registrationConfigFile = config.age.secrets.runner-qemu.path; - environmentVariables = { - EFI_DIR = "${pkgs.OVMF.fd}/FV/"; - STORAGE_URL = "http://s3.thehellings.lan:9000"; - }; - }; - }; - }; - virtualisation = { - docker.enable = true; - oci-containers.backend = "docker"; - }; - environment.systemPackages = with pkgs; [ - curl - gawk - git - unzip - wget - ]; + ##################################################################################### + #################### Local Podman/Docker Runner ##################################### + ##################################################################################### + age.secrets.runner-reg.file = ../../secrets/gitlab/myself-podman-runner-reg.age; + age.secrets.docker-auth.file = ../../secrets/gitlab/docker-auth.age; + age.secrets.runner-qemu.file = ../../secrets/gitlab/myself-qemu-runner-reg.age; + systemd.services.gitlab-runner = { + after = [ "network-online.target" ]; + requires = [ "network-online.target" ]; + }; + services.gitlab-runner = { + enable = true; + settings = { + concurrent = 5; + }; + services = { + default = { + executor = "docker"; + authenticationTokenConfigFile = config.age.secrets.runner-reg.path; + dockerImage = "gitlab.shire-zebra.ts.net:5000/greg/ci-images/fedora:latest"; + dockerAllowedImages = [ + "alpine:*" + "debian:*" + "docker:*" + "fedora:*" + "python:*" + "ubuntu:*" + "registry.gitlab.com/gitlab-org/*" + "registry.thehellings.com/*/*/*:*" + "gitlab.shire-zebra.ts.net:5000/*/*/*:*" + ]; + dockerAllowedServices = [ + "docker:*" + "registry.thehellings.com/*/*/*:*" + "gitlab.shire-zebra.ts.net:5000/*/*/*:*" + ]; + dockerPrivileged = true; + dockerVolumes = [ + "/certs/client" + "/cache" + ]; + }; + qemu = { + executor = "shell"; + limit = 5; + authenticationTokenConfigFile = config.age.secrets.runner-qemu.path; + environmentVariables = { + EFI_DIR = "${pkgs.OVMF.fd}/FV/"; + STORAGE_URL = "http://s3.thehellings.lan:9000"; + }; + }; + }; + }; + virtualisation = { + podman.enable = true; + oci-containers.backend = "podman"; + }; + environment.systemPackages = with pkgs; [ + curl + gawk + git + unzip + wget + ]; } diff --git a/hosts/myself/hardware-configuration.nix b/hosts/myself/hardware-configuration.nix index 7d20b31..58cdcef 100644 --- a/hosts/myself/hardware-configuration.nix +++ b/hosts/myself/hardware-configuration.nix @@ -1,51 +1,62 @@ # Do not modify this file! It was generated by ‘nixos-generate-config’ # and may be overwritten by future invocations. Please make changes # to /etc/nixos/configuration.nix instead. -{ config, lib, pkgs, modulesPath, ... }: +{ + config, + lib, + modulesPath, + ... +}: { - imports = - [ (modulesPath + "/installer/scan/not-detected.nix") - ]; + imports = [ (modulesPath + "/installer/scan/not-detected.nix") ]; - boot.initrd.availableKernelModules = [ "nvme" "xhci_pci" "ahci" "usb_storage" "usbhid" "sd_mod" "sr_mod" ]; - boot.initrd.kernelModules = [ ]; - boot.kernelModules = [ "kvm-amd" ]; - boot.extraModulePackages = [ ]; + boot.initrd.availableKernelModules = [ + "nvme" + "xhci_pci" + "ahci" + "usb_storage" + "usbhid" + "sd_mod" + "sr_mod" + ]; + boot.initrd.kernelModules = [ ]; + boot.kernelModules = [ "kvm-amd" ]; + boot.extraModulePackages = [ ]; - fileSystems."/" = - { device = "/dev/disk/by-uuid/714744ca-dd9d-4713-b571-c6ccfbf56d79"; - fsType = "btrfs"; - options = [ "subvol=nixos" ]; - }; + fileSystems."/" = { + device = "/dev/disk/by-uuid/714744ca-dd9d-4713-b571-c6ccfbf56d79"; + fsType = "btrfs"; + options = [ "subvol=nixos" ]; + }; - fileSystems."/home" = - { device = "/dev/disk/by-uuid/714744ca-dd9d-4713-b571-c6ccfbf56d79"; - fsType = "btrfs"; - options = [ "subvol=home" ]; - }; + fileSystems."/home" = { + device = "/dev/disk/by-uuid/714744ca-dd9d-4713-b571-c6ccfbf56d79"; + fsType = "btrfs"; + options = [ "subvol=home" ]; + }; - fileSystems."/boot" = - { device = "/dev/disk/by-uuid/29E7-E20C"; - fsType = "vfat"; - }; + fileSystems."/boot" = { + device = "/dev/disk/by-uuid/29E7-E20C"; + fsType = "vfat"; + }; - fileSystems."/myvol" = - { device = "/dev/nvme0n1p1"; - fsType = "btrfs"; - }; + fileSystems."/myvol" = { + device = "/dev/nvme0n1p1"; + fsType = "btrfs"; + }; - swapDevices = [ ]; + swapDevices = [ ]; - # Enables DHCP on each ethernet and wireless interface. In case of scripted networking - # (the default) this is the recommended approach. When using systemd-networkd it's - # still possible to use this option, but it's recommended to use it in conjunction - # with explicit per-interface declarations with `networking.interfaces..useDHCP`. - networking.useDHCP = lib.mkDefault true; - # networking.interfaces.enp38s0.useDHCP = lib.mkDefault true; - # networking.interfaces.enp39s0.useDHCP = lib.mkDefault true; - # networking.interfaces.enp42s0f3u5u3c2.useDHCP = lib.mkDefault true; + # Enables DHCP on each ethernet and wireless interface. In case of scripted networking + # (the default) this is the recommended approach. When using systemd-networkd it's + # still possible to use this option, but it's recommended to use it in conjunction + # with explicit per-interface declarations with `networking.interfaces..useDHCP`. + networking.useDHCP = lib.mkDefault true; + # networking.interfaces.enp38s0.useDHCP = lib.mkDefault true; + # networking.interfaces.enp39s0.useDHCP = lib.mkDefault true; + # networking.interfaces.enp42s0f3u5u3c2.useDHCP = lib.mkDefault true; - nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux"; - hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware; + nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux"; + hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware; } diff --git a/hosts/myself/matrix.nix b/hosts/myself/matrix.nix index 8dc250d..0c0f870 100644 --- a/hosts/myself/matrix.nix +++ b/hosts/myself/matrix.nix @@ -1,90 +1,99 @@ -{ config, pkgs, inputs, lib, ... }: +{ pkgs, ... }: let - domain = "thehellings.com"; - fqdn = "matrix.${domain}"; - conn = "postgresql:///dendrite?sslmode=disable&host=/run/postgresql"; + conn = "postgresql:///dendrite?sslmode=disable&host=/run/postgresql"; in { - environment.systemPackages = with pkgs; [ upgrade-pg-cluster ]; + environment.systemPackages = with pkgs; [ upgrade-pg-cluster ]; - greg.containers.matrix = { - tailscale = true; - subnet = "204"; - builder = { pkgs, config, ... }: { - networking.firewall.allowedTCPPorts = [ config.services.dendrite.httpPort ]; + greg.containers.matrix = { + tailscale = true; + subnet = "204"; + builder = + { config, ... }: + { + networking.firewall.allowedTCPPorts = [ config.services.dendrite.httpPort ]; - # Environment secrets - age = { - secrets.dendrite = { - file = ../../secrets/dendrite.age; - owner = "dendrite"; - }; - secrets.dendrite_key = { - file = ../../secrets/dendrite_key.age; - owner = "dendrite"; - }; - }; + # Environment secrets + age = { + secrets.dendrite = { + file = ../../secrets/dendrite.age; + owner = "dendrite"; + }; + secrets.dendrite_key = { + file = ../../secrets/dendrite_key.age; + owner = "dendrite"; + }; + }; - users.users.dendrite = { - isSystemUser = true; - group = "dendrite"; - }; - users.groups.dendrite = {}; + users.users.dendrite = { + isSystemUser = true; + group = "dendrite"; + }; + users.groups.dendrite = { }; - systemd.services.dendrite.serviceConfig = { - User = "dendrite"; - }; + systemd.services.dendrite.serviceConfig = { + User = "dendrite"; + }; - greg.databases.dendrite = {}; + greg.databases.dendrite = { }; - services.dendrite = { - enable = true; - environmentFile = config.age.secrets.dendrite.path; - httpPort = 8448; - # Identify ourselves as the root of our own domain - settings = ( - (builtins.listToAttrs ( - (map (x: { name = x; value = { database.connection_string = conn; }; }) [ - "app_service_api" - "federation_api" - "key_server" - "media_api" - "mscs" - "relay_api" - "room_server" - "sync_api" - ]) - ) ) // - { - user_api.account_database.connection_string = conn; - user_api.device_database.connection_string = conn; - global = { - database = { - connection_string = conn; - max_open_conns = 25; - max_idle_conns = 5; - conn_max_lifetime = -1; - }; - server_name = "thehellings.com"; - trusted_third_party_id_servers = [ - "matrix.org" - "vector.im" - "jupiterbroadcasting.com" - ]; - # Generate this with {path-to-dendrite}/bin/generate-keys --private-key /etc/dendrite.pem - private_key = config.age.secrets.dendrite_key.path; - }; - client_api = { - registration_enabled = false; - registration_shared_secret = "\${REGISTRATION_SHARED_SECRET}"; - }; - }); - }; + services.dendrite = { + enable = true; + environmentFile = config.age.secrets.dendrite.path; + httpPort = 8448; + # Identify ourselves as the root of our own domain + settings = ( + (builtins.listToAttrs ( + (map + (x: { + name = x; + value = { + database.connection_string = conn; + }; + }) + [ + "app_service_api" + "federation_api" + "key_server" + "media_api" + "mscs" + "relay_api" + "room_server" + "sync_api" + ] + ) + )) + // { + user_api.account_database.connection_string = conn; + user_api.device_database.connection_string = conn; + global = { + database = { + connection_string = conn; + max_open_conns = 25; + max_idle_conns = 5; + conn_max_lifetime = -1; + }; + server_name = "thehellings.com"; + trusted_third_party_id_servers = [ + "matrix.org" + "vector.im" + "jupiterbroadcasting.com" + ]; + # Generate this with {path-to-dendrite}/bin/generate-keys --private-key /etc/dendrite.pem + private_key = config.age.secrets.dendrite_key.path; + }; + client_api = { + registration_enabled = false; + registration_shared_secret = "\${REGISTRATION_SHARED_SECRET}"; + }; + } + ); + }; - systemd.services.dendrite = { - after = [ "postgresql.service" ]; - requires = [ "postgresql.service" ]; - }; - }; - }; + systemd.services.dendrite = { + after = [ "postgresql.service" ]; + requires = [ "postgresql.service" ]; + }; + }; + }; } diff --git a/hosts/myself/minio.nix b/hosts/myself/minio.nix index 67adcdd..4ddd9b0 100644 --- a/hosts/myself/minio.nix +++ b/hosts/myself/minio.nix @@ -1,32 +1,33 @@ { config, pkgs, ... }: let - minioPort = 9000; - minioConsolePort = 9001; -in { - environment.systemPackages = with pkgs; [ - minio-client - xfsprogs - ]; + minioPort = 9000; + minioConsolePort = 9001; +in +{ + environment.systemPackages = with pkgs; [ + minio-client + xfsprogs + ]; - greg.proxies."minio-01.thehellings.lan".target = "http://localhost:9000"; + greg.proxies."minio-01.thehellings.lan".target = "http://localhost:9000"; - fileSystems."/data/1" = { - device = "/dev/disk/by-id/wwn-0x5000c500c48728e9-part1"; - fsType = "xfs"; - }; + fileSystems."/data/1" = { + device = "/dev/disk/by-id/wwn-0x5000c500c48728e9-part1"; + fsType = "xfs"; + }; - networking.firewall.allowedTCPPorts = [ - minioPort - minioConsolePort - ]; + networking.firewall.allowedTCPPorts = [ + minioPort + minioConsolePort + ]; - age.secrets.minio.file = ../../secrets/minio.age; + age.secrets.minio.file = ../../secrets/minio.age; - services.minio = { - enable = true; - dataDir = [ "/data/1/minio" ]; - rootCredentialsFile = config.age.secrets.minio.path; - browser = true; - }; + services.minio = { + enable = true; + dataDir = [ "/data/1/minio" ]; + rootCredentialsFile = config.age.secrets.minio.path; + browser = true; + }; } diff --git a/hosts/wsl/default.nix b/hosts/wsl/default.nix index 5bbf08e..fb3a79e 100644 --- a/hosts/wsl/default.nix +++ b/hosts/wsl/default.nix @@ -1,11 +1,11 @@ -{ pkgs, ... }: +{ ... }: { - wsl = { - enable = true; - wslConf.automount.root = "/mnt"; - defaultUser = "greg"; - startMenuLaunchers = true; - nativeSystemd = true; - }; + wsl = { + enable = true; + wslConf.automount.root = "/mnt"; + defaultUser = "greg"; + startMenuLaunchers = true; + nativeSystemd = true; + }; } diff --git a/modules/baseline.nix b/modules/baseline.nix index 04531d2..12c0cd8 100644 --- a/modules/baseline.nix +++ b/modules/baseline.nix @@ -1,60 +1,107 @@ -{ pkgs, lib, ... }: +{ + pkgs, + config, + lib, + self, + ... +}: let - notDarwin = (! pkgs.stdenv.isDarwin); + builderHosts = ( + lib.attrNames (lib.filterAttrs (_: v: v.config.greg.remote-builder.enable) self.nixosConfigurations) + ); in { - # Enable flakes - nix = { - gc = { - automatic = true; - # Scheduling of them is different in nixos vs nix-darwin, so check for - # the extra details there - options = "--delete-older-than 30d"; - }; - - settings = { - experimental-features = "nix-command flakes"; - keep-outputs = true; - keep-derivations = true; - min-free = (toString (1024 * 1024 * 1024) ); - max-free = (toString (5 * 1024 * 1024 * 1024) ); - substituters = [ - "https://cache.garnix.io" - "https://ai.cachix.org" - ]; - trusted-public-keys = [ - "cache.garnix.io:CTFPyKSLcx5RMJKfLo5EEPUObbA78b0YQ2DTCJXqr9g=" - "ai.cachix.org-1:N9dzRK+alWwoKXQlnn0H6aUx0lU/mspIoz8hMvGvbbc=" - ]; - }; + # Enable flakes + nix = { + gc = { + automatic = true; + # Scheduling of them is different in nixos vs nix-darwin, so check for + # the extra details there + options = "--delete-older-than 30d"; }; - nixpkgs.config = { - allowUnfree = true; - permittedInsecurePackages = [ - "jitsi-meet-1.0.8043" - ]; + settings = { + experimental-features = "nix-command flakes"; + keep-outputs = true; + keep-derivations = true; + min-free = (toString (1024 * 1024 * 1024)); + max-free = (toString (5 * 1024 * 1024 * 1024)); + trusted-users = [ + "greg" + "gregory.hellings" + ]; # For home and for work machines + substituters = [ + "https://cache.garnix.io" + "https://ai.cachix.org" + "https://nixpkgs-python.cachix.org" + "https://greg-hellings.cachix.org" + "https://nix-community.cachix.org" + ]; + trusted-public-keys = [ + "cache.garnix.io:CTFPyKSLcx5RMJKfLo5EEPUObbA78b0YQ2DTCJXqr9g=" + "ai.cachix.org-1:N9dzRK+alWwoKXQlnn0H6aUx0lU/mspIoz8hMvGvbbc=" + "nixpkgs-python.cachix.org-1:hxjI7pFxTyuTHn2NkvWCrAUcNZLNS3ZAvfYNuYifcEU=" + "greg-hellings.cachix.org-1:y01Jl/L5evlhxdnUW6n56AiI1k8g1wxWhTxJCe7XSco=" + "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs=" + ]; }; - # Base packages that need to be in all my hosts - environment.systemPackages = with pkgs; [ - agenix - bitwarden-cli - bmon - diffutils - git - gnupatch - gregpy - findutils - file - hms # My own home manager switcher - htop - iperf - killall - nano - pciutils - pwgen - unzip - wget - ]; + buildMachines = ( + lib.map (host: { + hostName = "${host}-builder"; + system = "x86_64-linux"; + protocol = "ssh-ng"; + maxJobs = 12; + speedFactor = 2; + supportedFeatures = [ + "nixos-test" + "benchmark" + "big-parallel" + "kvm" + ]; + }) (lib.filter (x: x != config.networking.hostName) builderHosts) + ); + distributedBuilds = true; + extraOptions = '' + builders-use-substitutes = true + ''; + }; + + programs.ssh.extraConfig = ( + builtins.concatStringsSep "\n" ( + lib.map (x: '' + Host ${x}-builder + Hostname ${x}.home + User remote-builder-user + '') builderHosts + ) + ); + + nixpkgs.config = { + allowUnfree = true; + permittedInsecurePackages = [ "jitsi-meet-1.0.8043" ]; + }; + + # Base packages that need to be in all my hosts + environment.systemPackages = with pkgs; [ + agenix + bitwarden-cli + bmon + cachix + diffutils + git + gnupatch + gregpy + findutils + file + hms # My own home manager switcher + htop + iperf + killall + nano + pciutils + pwgen + unzip + wget + ]; } diff --git a/modules/darwin/default.nix b/modules/darwin/default.nix index 576ae65..4a212d7 100644 --- a/modules/darwin/default.nix +++ b/modules/darwin/default.nix @@ -1,26 +1,24 @@ -{...}: +{ ... }: { - imports = [ - ../baseline.nix - ]; - system.stateVersion = 4; - home-manager = { - useGlobalPkgs = true; - users."gregory.hellings" = import ../../home/home.nix; - extraSpecialArgs = { - gnome = false; - gui = false; - home = "/Users/gregory.hellings"; - }; + imports = [ ../baseline.nix ]; + system.stateVersion = 4; + home-manager = { + useGlobalPkgs = true; + users."gregory.hellings" = import ../../home/home.nix; + extraSpecialArgs = { + gnome = false; + gui = false; + home = "/Users/gregory.hellings"; }; - users.users."gregory.hellings".home = "/Users/gregory.hellings"; - programs = { - zsh.enable = true; - bash.enable = true; - }; - services.nix-daemon.enable = true; - nix = { - gc.interval.Hour = 24; - settings.auto-optimise-store = false; # Darwin bugs? - }; -} \ No newline at end of file + }; + users.users."gregory.hellings".home = "/Users/gregory.hellings"; + programs = { + zsh.enable = true; + bash.enable = true; + }; + services.nix-daemon.enable = true; + nix = { + gc.interval.Hour = 24; + settings.auto-optimise-store = false; # Darwin bugs? + }; +} diff --git a/modules/default.nix b/modules/default.nix index 7f28a07..b3a136c 100644 --- a/modules/default.nix +++ b/modules/default.nix @@ -1,7 +1,8 @@ let - nixos = (import ./nixos); - darwin = (import ./darwin); -in { - nixosModule = nixos; - darwinModule = darwin; -} \ No newline at end of file + nixos = (import ./nixos); + darwin = (import ./darwin); +in +{ + nixosModule = nixos; + darwinModule = darwin; +} diff --git a/modules/nixos/backup.nix b/modules/nixos/backup.nix index bbfe8d8..2604fae 100644 --- a/modules/nixos/backup.nix +++ b/modules/nixos/backup.nix @@ -1,71 +1,82 @@ -{ lib, config, pkgs, ... }: +{ + lib, + config, + pkgs, + ... +}: let - cfg = config.greg.backup; + cfg = config.greg.backup; - where = j: "${config.services.syncthing.dataDir}/${j.dest}"; + where = j: "${config.services.syncthing.dataDir}/${j.dest}"; - makeSyncFolders = name: job: { - devices = [ "chronicles" ]; - enable = true; - id = job.id; - label = job.dest; - path = where job; - type = "sendonly"; - }; + makeSyncFolders = _: job: { + devices = [ "chronicles" ]; + enable = true; + id = job.id; + label = job.dest; + path = where job; + type = "sendonly"; + }; - makeRestic = name: job: let - who = "${config.services.syncthing.user}:${config.services.syncthing.group}"; - in rec { - initialize = true; - passwordFile = config.age.secrets.restic-pw.path; - paths = [ job.src ]; - repository = where job; - backupCleanupCommand = ''${pkgs.coreutils}/bin/chown -R ${who} "${repository}"''; - }; + makeRestic = + _: job: + let + who = "${config.services.syncthing.user}:${config.services.syncthing.group}"; + in + rec { + initialize = true; + passwordFile = config.age.secrets.restic-pw.path; + paths = [ job.src ]; + repository = where job; + backupCleanupCommand = ''${pkgs.coreutils}/bin/chown -R ${who} "${repository}"''; + }; -in with lib; { - options = { - greg.backup = { - jobs = mkOption { - default = {}; +in +with lib; +{ + options = { + greg.backup = { + jobs = mkOption { + default = { }; - type = with types; attrsOf (submodule ( - { name, config, options, ... }: - { - options = { - src = mkOption { - type = types.str; - description = "Local path (string form) to backup from"; - }; + type = + with types; + attrsOf ( + submodule ( + { ... }: + { + options = { + src = mkOption { + type = types.str; + description = "Local path (string form) to backup from"; + }; - dest = mkOption { - type = types.str; - }; + dest = mkOption { type = types.str; }; - id = mkOption { - type = types.str; - description = "The unique folder ID for this"; - }; - }; - } - )); - }; - }; - }; + id = mkOption { + type = types.str; + description = "The unique folder ID for this"; + }; + }; + } + ) + ); + }; + }; + }; - config = mkIf ( ( attrValues cfg.jobs ) != [] ) - { - age.secrets = { - restic-pw.file = ../../secrets/restic-pw.age; - restic-env.file = ../../secrets/restic-env.age; - }; - greg.syncthing = { - enable = true; - }; - services = { - syncthing.settings.folders = mapAttrs makeSyncFolders cfg.jobs; - restic.backups = mapAttrs makeRestic cfg.jobs; - }; - }; + config = mkIf ((attrValues cfg.jobs) != [ ]) { + age.secrets = { + restic-pw.file = ../../secrets/restic-pw.age; + restic-env.file = ../../secrets/restic-env.age; + }; + greg.syncthing = { + enable = true; + }; + services = { + syncthing.settings.folders = mapAttrs makeSyncFolders cfg.jobs; + restic.backups = mapAttrs makeRestic cfg.jobs; + }; + }; } diff --git a/modules/nixos/ceph.nix b/modules/nixos/ceph.nix index fcd1d7d..2ddf2d0 100644 --- a/modules/nixos/ceph.nix +++ b/modules/nixos/ceph.nix @@ -1,6 +1,11 @@ # This is a good source for a Ceph dealio # https://gist.github.com0/nh2/13425a1f18b4c1ce82edb63c10b163c9 -{ config, lib, pkgs, ... }: +{ + config, + lib, + pkgs, + ... +}: with lib; @@ -8,11 +13,12 @@ let cfg = config.services.ceph-benaco; commaSep = builtins.concatStringsSep ","; - ensureUnitExists = c': name: let - unitName = (builtins.elemAt (builtins.split "\\." name) 0); - in if c'.systemd.services ? unitName - then name - else name;# "Unable to locate ${name} at ${commaSep (builtins.attrNames c')}"; + ensureUnitExists = + c': name: + let + in + #unitName = (builtins.elemAt (builtins.split "\\." name) 0); + if c'.systemd.services ? unitName then name else name; # "Unable to locate ${name} at ${commaSep (builtins.attrNames c')}"; in { @@ -44,36 +50,40 @@ in }; initialMonitors = mkOption { - type = types.listOf (types.submodule { - options = { - hostname = mkOption { - type = types.str; - description = "Initial monitor hostname."; - }; + type = types.listOf ( + types.submodule { + options = { + hostname = mkOption { + type = types.str; + description = "Initial monitor hostname."; + }; - ipAddress = mkOption { - type = types.str; - description = "Initial monitor IP address."; + ipAddress = mkOption { + type = types.str; + description = "Initial monitor IP address."; + }; }; - }; - }); + } + ); description = "Initial monitors."; }; mdsNodes = mkOption { - type = types.listOf (types.submodule { - options = { - hostname = mkOption { - type = types.str; - description = "MDS hostname."; - }; + type = types.listOf ( + types.submodule { + options = { + hostname = mkOption { + type = types.str; + description = "MDS hostname."; + }; - ipAddress = mkOption { - type = types.str; - description = "MDS IP address."; + ipAddress = mkOption { + type = types.str; + description = "MDS IP address."; + }; }; - }; - }); + } + ); description = "MDS nodes."; }; @@ -143,7 +153,7 @@ in }; osds = mkOption { - default = {}; + default = { }; example = { osd1 = { enable = true; @@ -175,123 +185,125 @@ in current machine only, used only to name the systemd service for that OSD. ''; - type = types.attrsOf (types.submodule { - options = { + type = types.attrsOf ( + types.submodule { + options = { - enable = mkEnableOption "Activate a Ceph OSD on this machine."; + enable = mkEnableOption "Activate a Ceph OSD on this machine."; + + bootstrapKeyring = mkOption { + type = types.path; + description = "Ceph OSD bootstrap keyring."; + example = "/path/to/ceph.client.bootstrap-osd.keyring"; + }; + + id = mkOption { + type = types.int; + description = "The ID of this OSD. Must be unique in the Ceph cluster."; + example = 1; + }; + + uuid = mkOption { + type = types.str; + description = "The UUID of this OSD. Must be unique in the Ceph cluster."; + example = "abcdef12-abcd-1234-abcd-1234567890ab"; + }; + + systemdExtraRequiresAfter = mkOption { + type = types.listOf types.str; + default = [ ]; + description = '' + Add the specified systemd units to the "requires" and "after" + lists of the systemd service of this OSD. + + Useful, for example, to decrypt the underlying block devices with LUKS first. + + NixOS modules allow override those lists from outside, but for that + the names of the systemd services for the OSDs need to be known; + this option is a convenience to not have to know them from outside. + ''; + example = "decrypt-my-disk.service"; + }; + + skipZap = mkOption { + type = types.bool; + default = false; + description = '' + Whether to skip the zapping of the the OSD device on initial OSD + installation. + + Skipping is needed because ceph-volume cannot + zap device-mapper devices: + + + In that case you need to wipe the device manually. + + In the common case of placing the OSD on a cryptsetup LUKS device + (which is a device-mapper device), re-creating the encryption + from scratch with a new key zaps anything anyway, in which case + zapping can be skipped here. + ''; + }; + + blockDevice = mkOption { + type = types.str; + description = "The block device used to store the OSD."; + example = "/dev/sdb"; + }; + + blockDeviceUdevRuleMatcher = mkOption { + type = types.str; + description = '' + An udev rule matcher matching the block device used to store the OSD. + Will be spliced into the udev rule that is + used to set access permissions to the ceph user via an udev rule. + + This is a matcher instead of just a device name to allow flexibility: + Normal disks can be easily matched with KERNEL=="sda1", but + device-mapper may not; for example, decrypted cryptsetup LUKS devices + have a less useful KERNEL=="dm-4" and may better be matched + using ENV{DM_NAME}=="mydisk-decrypted". + ''; + example = ''KERNEL=="sdb"''; + }; + + dbBlockDevice = mkOption { + type = types.nullOr types.str; + default = null; + description = '' + The block device used to store the OSD's BlueStore DB device. + + Put this on a faster device than to improve performance. + + See + for details. + ''; + example = "/dev/sdc"; + }; + + dbBlockDeviceUdevRuleMatcher = mkOption { + type = types.nullOr types.str; + default = null; + description = '' + Like but for the + . + ''; + example = ''KERNEL=="sdc"''; + }; + + clusterAddress = mkOption { + type = types.nullOr types.str; + default = null; + description = '' + The IP address on the dedicated cluster network that + is used by the backend communication for OSD communication. + ''; + example = "10.1.0.1f"; + }; - bootstrapKeyring = mkOption { - type = types.path; - description = "Ceph OSD bootstrap keyring."; - example = "/path/to/ceph.client.bootstrap-osd.keyring"; }; - - id = mkOption { - type = types.int; - description = "The ID of this OSD. Must be unique in the Ceph cluster."; - example = 1; - }; - - uuid = mkOption { - type = types.str; - description = "The UUID of this OSD. Must be unique in the Ceph cluster."; - example = "abcdef12-abcd-1234-abcd-1234567890ab"; - }; - - systemdExtraRequiresAfter = mkOption { - type = types.listOf types.str; - default = []; - description = '' - Add the specified systemd units to the "requires" and "after" - lists of the systemd service of this OSD. - - Useful, for example, to decrypt the underlying block devices with LUKS first. - - NixOS modules allow override those lists from outside, but for that - the names of the systemd services for the OSDs need to be known; - this option is a convenience to not have to know them from outside. - ''; - example = "decrypt-my-disk.service"; - }; - - skipZap = mkOption { - type = types.bool; - default = false; - description = '' - Whether to skip the zapping of the the OSD device on initial OSD - installation. - - Skipping is needed because ceph-volume cannot - zap device-mapper devices: - - - In that case you need to wipe the device manually. - - In the common case of placing the OSD on a cryptsetup LUKS device - (which is a device-mapper device), re-creating the encryption - from scratch with a new key zaps anything anyway, in which case - zapping can be skipped here. - ''; - }; - - blockDevice = mkOption { - type = types.str; - description = "The block device used to store the OSD."; - example = "/dev/sdb"; - }; - - blockDeviceUdevRuleMatcher = mkOption { - type = types.str; - description = '' - An udev rule matcher matching the block device used to store the OSD. - Will be spliced into the udev rule that is - used to set access permissions to the ceph user via an udev rule. - - This is a matcher instead of just a device name to allow flexibility: - Normal disks can be easily matched with KERNEL=="sda1", but - device-mapper may not; for example, decrypted cryptsetup LUKS devices - have a less useful KERNEL=="dm-4" and may better be matched - using ENV{DM_NAME}=="mydisk-decrypted". - ''; - example = ''KERNEL=="sdb"''; - }; - - dbBlockDevice = mkOption { - type = types.nullOr types.str; - default = null; - description = '' - The block device used to store the OSD's BlueStore DB device. - - Put this on a faster device than to improve performance. - - See - for details. - ''; - example = "/dev/sdc"; - }; - - dbBlockDeviceUdevRuleMatcher = mkOption { - type = types.nullOr types.str; - default = null; - description = '' - Like but for the - . - ''; - example = ''KERNEL=="sdc"''; - }; - - clusterAddress = mkOption { - type = types.nullOr types.str; - default = null; - description = '' - The IP address on the dedicated cluster network that - is used by the backend communication for OSD communication. - ''; - example = "10.1.0.1f"; - }; - - }; - }); + } + ); }; mds = { @@ -325,238 +337,262 @@ in ###### implementation - config = let - monDir = "/var/lib/ceph/mon/${cfg.clusterName}-${cfg.monitor.nodeName}"; - mgrDir = "/var/lib/ceph/mgr/${cfg.clusterName}-${cfg.manager.nodeName}"; - mdsDir = "/var/lib/ceph/mds/${cfg.clusterName}-${cfg.mds.nodeName}"; - - # File permissions for things that are on locations wiped at start - # (e.g. /run or its /var/run symlink). - ensureTransientCephDirs = '' - install -m 770 -o ${config.users.users.ceph.name} -g ${config.users.groups.ceph.name} -d /var/run/ceph - ''; - - # File permissions from cluster deployed with ceph-deploy. - ensureCephDirs = '' - install -m 3770 -o ${config.users.users.ceph.name} -g ${config.users.groups.ceph.name} -d /var/log/ceph - install -m 770 -o ${config.users.users.ceph.name} -g ${config.users.groups.ceph.name} -d /var/run/ceph - install -m 750 -o ${config.users.users.ceph.name} -g ${config.users.groups.ceph.name} -d /var/lib/ceph - install -m 755 -o ${config.users.users.ceph.name} -g ${config.users.groups.ceph.name} -d /var/lib/ceph/mon - install -m 755 -o ${config.users.users.ceph.name} -g ${config.users.groups.ceph.name} -d /var/lib/ceph/mgr - install -m 755 -o ${config.users.users.ceph.name} -g ${config.users.groups.ceph.name} -d /var/lib/ceph/osd - ''; - - # Utilities called by Ceph device health scraping, see: - # https://docs.ceph.com/en/latest/rados/operations/devices/#enabling-monitoring - # As per https://github.com/ceph/ceph-container/pull/1490/commits/c49e821599965ae92a88b2c78077ee03c4405895, - # both the OSDs and the `mon` need this. - # Ceph calls these utilities with `sudo`. That requires sudoers entries. - # Sudoers entries require absolute path; that exact (nix store) path needs to - # be used by Ceph, so it needs to be given to the systemd unit via `path`. - # This is why we pair each `sudoersExtraRule` with the `package` to put onto - # that `path`. - # - # Entries are based on: - # https://github.com/ceph/ceph/blob/a2f5a3c1dbfa4dce41e25da4f029a8fdb8c8d864/sudoers.d/ceph-smartctl - cephMonitoringSudoersCommandsAndPackages = [ - { - package = pkgs.smartmontools; - sudoersExtraRule = { # entry for `security.sudo.extraRules` - users = [ config.users.users.ceph.name ]; - commands = [{ - command = "${lib.getBin pkgs.smartmontools}/bin/smartctl -x --json=o /dev/*"; - options = [ "NOPASSWD" ]; - }]; - }; - } - { - package = pkgs.nvme-cli; - sudoersExtraRule = { # entry for `security.sudo.extraRules` - users = [ config.users.users.ceph.name ]; - commands = [{ - command = "${lib.getBin pkgs.nvme-cli}/bin/nvme * smart-log-add --json /dev/*"; - options = [ "NOPASSWD" ]; - }]; - }; - } - ]; - - cephDeviceHealthMonitoringPathsOrPackages = with pkgs; [ - # Contains `sudo`. Ceph wraps this around the other health check programs. - # Cannot use `pkgs.sudo` because that one is not SUID, see: - # https://discourse.nixos.org/t/sudo-uid-issues/9133 - "/run/wrappers" # `systemd.services..path` adds the `bin/` subdir of this - ] ++ map ({ package, ... }: package) cephMonitoringSudoersCommandsAndPackages; - - makeCephOsdSetupSystemdService = localOsdServiceName: osdConfig: + config = let - osdExistenceFile = "/var/lib/ceph/osd/.${toString osdConfig.id}.${osdConfig.uuid}.nix-existence"; + monDir = "/var/lib/ceph/mon/${cfg.clusterName}-${cfg.monitor.nodeName}"; + mgrDir = "/var/lib/ceph/mgr/${cfg.clusterName}-${cfg.manager.nodeName}"; + mdsDir = "/var/lib/ceph/mds/${cfg.clusterName}-${cfg.mds.nodeName}"; + + # File permissions for things that are on locations wiped at start + # (e.g. /run or its /var/run symlink). + ensureTransientCephDirs = '' + install -m 770 -o ${config.users.users.ceph.name} -g ${config.users.groups.ceph.name} -d /var/run/ceph + ''; + + # File permissions from cluster deployed with ceph-deploy. + ensureCephDirs = '' + install -m 3770 -o ${config.users.users.ceph.name} -g ${config.users.groups.ceph.name} -d /var/log/ceph + install -m 770 -o ${config.users.users.ceph.name} -g ${config.users.groups.ceph.name} -d /var/run/ceph + install -m 750 -o ${config.users.users.ceph.name} -g ${config.users.groups.ceph.name} -d /var/lib/ceph + install -m 755 -o ${config.users.users.ceph.name} -g ${config.users.groups.ceph.name} -d /var/lib/ceph/mon + install -m 755 -o ${config.users.users.ceph.name} -g ${config.users.groups.ceph.name} -d /var/lib/ceph/mgr + install -m 755 -o ${config.users.users.ceph.name} -g ${config.users.groups.ceph.name} -d /var/lib/ceph/osd + ''; + + # Utilities called by Ceph device health scraping, see: + # https://docs.ceph.com/en/latest/rados/operations/devices/#enabling-monitoring + # As per https://github.com/ceph/ceph-container/pull/1490/commits/c49e821599965ae92a88b2c78077ee03c4405895, + # both the OSDs and the `mon` need this. + # Ceph calls these utilities with `sudo`. That requires sudoers entries. + # Sudoers entries require absolute path; that exact (nix store) path needs to + # be used by Ceph, so it needs to be given to the systemd unit via `path`. + # This is why we pair each `sudoersExtraRule` with the `package` to put onto + # that `path`. + # + # Entries are based on: + # https://github.com/ceph/ceph/blob/a2f5a3c1dbfa4dce41e25da4f029a8fdb8c8d864/sudoers.d/ceph-smartctl + cephMonitoringSudoersCommandsAndPackages = [ + { + package = pkgs.smartmontools; + sudoersExtraRule = { + # entry for `security.sudo.extraRules` + users = [ config.users.users.ceph.name ]; + commands = [ + { + command = "${lib.getBin pkgs.smartmontools}/bin/smartctl -x --json=o /dev/*"; + options = [ "NOPASSWD" ]; + } + ]; + }; + } + { + package = pkgs.nvme-cli; + sudoersExtraRule = { + # entry for `security.sudo.extraRules` + users = [ config.users.users.ceph.name ]; + commands = [ + { + command = "${lib.getBin pkgs.nvme-cli}/bin/nvme * smart-log-add --json /dev/*"; + options = [ "NOPASSWD" ]; + } + ]; + }; + } + ]; + + cephDeviceHealthMonitoringPathsOrPackages = + with pkgs; + [ + # Contains `sudo`. Ceph wraps this around the other health check programs. + # Cannot use `pkgs.sudo` because that one is not SUID, see: + # https://discourse.nixos.org/t/sudo-uid-issues/9133 + "/run/wrappers" # `systemd.services..path` adds the `bin/` subdir of this + ] + ++ map ({ package, ... }: package) cephMonitoringSudoersCommandsAndPackages; + + # Unused localOsdServiceName in the following line + # deadnix: skip + makeCephOsdSetupSystemdService = + _localOsdServiceName: osdConfig: + let + osdExistenceFile = "/var/lib/ceph/osd/.${toString osdConfig.id}.${osdConfig.uuid}.nix-existence"; + in + mkIf osdConfig.enable { + description = "Initialize Ceph OSD"; + + requires = osdConfig.systemdExtraRequiresAfter; + after = osdConfig.systemdExtraRequiresAfter; + + path = with pkgs; [ + # The following are currently missing in Ceph's wrapping, see https://github.com/NixOS/nixpkgs/issues/147801#issue-1065600852 + util-linux # for `lsblk` + lvm2 # for `lvs` + ]; + + # TODO Use `udevadm trigger --settle` instead of the separate `udevadm settle` + # once that feature is available to us with systemd >= 238; + # see https://github.com/systemd/systemd/commit/792cc203a67edb201073351f5c766fce3d5eab45 + preStart = + '' + set -x + ${ensureCephDirs} + install -m 755 -o ${config.users.users.ceph.name} -g ${config.users.groups.ceph.name} -d /var/lib/ceph/bootstrap-osd + # `install` is not atomic, see + # https://lists.gnu.org/archive/html/bug-coreutils/2010-02/msg00243.html + # so use `mktemp` + `mv` to make it atomic. + TMPFILE=$(mktemp --tmpdir=/var/lib/ceph/bootstrap-osd/) + install -o ${config.users.users.ceph.name} -g ${config.users.groups.ceph.name} ${osdConfig.bootstrapKeyring} "$TMPFILE" + mv "$TMPFILE" /var/lib/ceph/bootstrap-osd/ceph.keyring + + # Trigger udev rules for permissions of block devices and wait for them to settle. + udevadm trigger --name-match=${osdConfig.blockDevice} + '' + + lib.optionalString (osdConfig.dbBlockDevice != null) '' + udevadm trigger --name-match=${osdConfig.dbBlockDevice} + '' + + '' + udevadm settle + '' + + (optionalString (!osdConfig.skipZap) ( + '' + # Zap OSD block devices, otherwise `ceph-osd` below will try to fsck if there's some old + # ceph data on the block device (see https://tracker.ceph.com/issues/24099). + ${cfg.package}/bin/ceph-volume lvm zap ${osdConfig.blockDevice} + '' + + lib.optionalString (osdConfig.dbBlockDevice != null) '' + ${cfg.package}/bin/ceph-volume lvm zap ${osdConfig.dbBlockDevice} + '' + )); + + script = + '' + set -euo pipefail + set -x + until [ -f /etc/ceph/${cfg.clusterName}.client.admin.keyring ] + do + sleep 1 + done + + OSD_SECRET=$(${cfg.package}/bin/ceph-authtool --gen-print-key) + echo "{\"cephx_secret\": \"$OSD_SECRET\"}" | \ + ${cfg.package}/bin/ceph --cluster ${cfg.clusterName} osd new ${osdConfig.uuid} ${toString osdConfig.id} -i - \ + -n client.bootstrap-osd -k ${osdConfig.bootstrapKeyring} + mkdir -p /var/lib/ceph/osd/${cfg.clusterName}-${toString osdConfig.id} + + ln -s ${osdConfig.blockDevice} /var/lib/ceph/osd/${cfg.clusterName}-${toString osdConfig.id}/block + '' + + lib.optionalString (osdConfig.dbBlockDevice != null) '' + ln -s ${osdConfig.dbBlockDevice} /var/lib/ceph/osd/${cfg.clusterName}-${toString osdConfig.id}/block.db + '' + + '' + + ${cfg.package}/bin/ceph-authtool --create-keyring /var/lib/ceph/osd/ceph-${toString osdConfig.id}/keyring \ + --name osd.${toString osdConfig.id} --add-key $OSD_SECRET + + ${cfg.package}/bin/ceph-osd -i ${toString osdConfig.id} --mkfs --osd-uuid ${osdConfig.uuid} --setuser ${config.users.users.ceph.name} --setgroup ${config.users.groups.ceph.name} --osd-objectstore bluestore + touch ${osdExistenceFile} + ''; + + serviceConfig = { + Type = "oneshot"; + RemainAfterExit = true; + PermissionsStartOnly = true; # only run the script as ceph, preStart as root + User = config.users.users.ceph.name; + Group = config.users.groups.ceph.name; + }; + unitConfig = { + ConditionPathExists = "!${osdExistenceFile}"; + }; + }; + + makeCephOsdSystemdService = + localOsdServiceName: osdConfig: + mkIf osdConfig.enable { + description = "Ceph OSD"; + + # Note we do not have to add `osdConfig.systemdExtraRequiresAfter` here because + # that's already a dependency of our dependency `ceph-osd-setup-*`. + requires = [ (ensureUnitExists config "ceph-osd-setup-${localOsdServiceName}.service") ]; + requiredBy = [ "multi-user.target" ]; + after = [ + "network.target" + "local-fs.target" + "time-sync.target" + (ensureUnitExists config "ceph-osd-setup-${localOsdServiceName}.service") + ]; + wants = [ + "network.target" + "local-fs.target" + "time-sync.target" + ]; + + path = [ + # TODO: use wrapProgram in the ceph package for this in the future + pkgs.getopt + ] ++ cephDeviceHealthMonitoringPathsOrPackages; + + restartTriggers = [ config.environment.etc."ceph/${cfg.clusterName}.conf".source ]; + + preStart = '' + ${ensureTransientCephDirs} + ${lib.getLib cfg.package}/libexec/ceph/ceph-osd-prestart.sh --cluster ${cfg.clusterName} --id ${toString osdConfig.id} + ''; + + serviceConfig = + let + clusterIpArg = lib.optionalString ( + osdConfig.clusterAddress != null + ) "--cluster_addr=${osdConfig.clusterAddress}"; + in + { + LimitNOFILE = "1048576"; + LimitNPROC = "1048576"; + + ExecStart = '' + ${cfg.package}/bin/ceph-osd -f --cluster ${cfg.clusterName} --id ${toString osdConfig.id} --setuser ${config.users.users.ceph.name} --setgroup ${config.users.groups.ceph.name} "--public_bind_addr=${cfg.osdBindAddr}" "--public_addr=${cfg.osdAdvertisedPublicAddr}" "${clusterIpArg}" + ''; + ExecReload = '' + ${pkgs.coreutils}/bin/kill -HUP $MAINPID + ''; + Restart = "on-failure"; + ProtectHome = "true"; + ProtectSystem = "full"; + PrivateTmp = "true"; + TasksMax = "infinity"; + # StartLimitBurst="3"; + }; + # startLimitIntervalSec = 30 * 60; + }; + in - mkIf osdConfig.enable { - description = "Initialize Ceph OSD"; + mkIf cfg.enable { + environment.systemPackages = [ cfg.package ]; - requires = osdConfig.systemdExtraRequiresAfter; - after = osdConfig.systemdExtraRequiresAfter; - - path = with pkgs; [ - # The following are currently missing in Ceph's wrapping, see https://github.com/NixOS/nixpkgs/issues/147801#issue-1065600852 - util-linux # for `lsblk` - lvm2 # for `lvs` - ]; - - # TODO Use `udevadm trigger --settle` instead of the separate `udevadm settle` - # once that feature is available to us with systemd >= 238; - # see https://github.com/systemd/systemd/commit/792cc203a67edb201073351f5c766fce3d5eab45 - preStart = '' - set -x - ${ensureCephDirs} - install -m 755 -o ${config.users.users.ceph.name} -g ${config.users.groups.ceph.name} -d /var/lib/ceph/bootstrap-osd - # `install` is not atomic, see - # https://lists.gnu.org/archive/html/bug-coreutils/2010-02/msg00243.html - # so use `mktemp` + `mv` to make it atomic. - TMPFILE=$(mktemp --tmpdir=/var/lib/ceph/bootstrap-osd/) - install -o ${config.users.users.ceph.name} -g ${config.users.groups.ceph.name} ${osdConfig.bootstrapKeyring} "$TMPFILE" - mv "$TMPFILE" /var/lib/ceph/bootstrap-osd/ceph.keyring - - # Trigger udev rules for permissions of block devices and wait for them to settle. - udevadm trigger --name-match=${osdConfig.blockDevice} - '' + lib.optionalString (osdConfig.dbBlockDevice != null) '' - udevadm trigger --name-match=${osdConfig.dbBlockDevice} - '' + - '' - udevadm settle - '' + (optionalString (!osdConfig.skipZap) ( - '' - # Zap OSD block devices, otherwise `ceph-osd` below will try to fsck if there's some old - # ceph data on the block device (see https://tracker.ceph.com/issues/24099). - ${cfg.package}/bin/ceph-volume lvm zap ${osdConfig.blockDevice} - '' + lib.optionalString (osdConfig.dbBlockDevice != null) '' - ${cfg.package}/bin/ceph-volume lvm zap ${osdConfig.dbBlockDevice} - '' - )); - - script = '' - set -euo pipefail - set -x - until [ -f /etc/ceph/${cfg.clusterName}.client.admin.keyring ] - do - sleep 1 - done - - OSD_SECRET=$(${cfg.package}/bin/ceph-authtool --gen-print-key) - echo "{\"cephx_secret\": \"$OSD_SECRET\"}" | \ - ${cfg.package}/bin/ceph --cluster ${cfg.clusterName} osd new ${osdConfig.uuid} ${toString osdConfig.id} -i - \ - -n client.bootstrap-osd -k ${osdConfig.bootstrapKeyring} - mkdir -p /var/lib/ceph/osd/${cfg.clusterName}-${toString osdConfig.id} - - ln -s ${osdConfig.blockDevice} /var/lib/ceph/osd/${cfg.clusterName}-${toString osdConfig.id}/block - '' + lib.optionalString (osdConfig.dbBlockDevice != null) '' - ln -s ${osdConfig.dbBlockDevice} /var/lib/ceph/osd/${cfg.clusterName}-${toString osdConfig.id}/block.db - '' + - '' - - ${cfg.package}/bin/ceph-authtool --create-keyring /var/lib/ceph/osd/ceph-${toString osdConfig.id}/keyring \ - --name osd.${toString osdConfig.id} --add-key $OSD_SECRET - - ${cfg.package}/bin/ceph-osd -i ${toString osdConfig.id} --mkfs --osd-uuid ${osdConfig.uuid} --setuser ${config.users.users.ceph.name} --setgroup ${config.users.groups.ceph.name} --osd-objectstore bluestore - touch ${osdExistenceFile} - ''; - - serviceConfig = { - Type = "oneshot"; - RemainAfterExit = true; - PermissionsStartOnly = true; # only run the script as ceph, preStart as root - User = config.users.users.ceph.name; - Group = config.users.groups.ceph.name; + networking.firewall = { + allowedTCPPorts = [ + # Ceph outside of VPN because it is very data heavy and causes packet loss. + # We enable msgr-v2 only because that allows its own on-wire encryption. + 3300 # ceph msgr-v2 + ]; + allowedTCPPortRanges = [ + { + from = 6800; + to = 7300; + } # https://docs.ceph.com/en/pacific/rados/configuration/network-config-ref/ + ]; }; - unitConfig = { - ConditionPathExists = "!${osdExistenceFile}"; - }; - }; - makeCephOsdSystemdService = localOsdServiceName: osdConfig: mkIf osdConfig.enable { - description = "Ceph OSD"; - - # Note we do not have to add `osdConfig.systemdExtraRequiresAfter` here because - # that's already a dependency of our dependency `ceph-osd-setup-*`. - requires = [ - (ensureUnitExists config "ceph-osd-setup-${localOsdServiceName}.service") - ]; - requiredBy = [ "multi-user.target" ]; - after = [ - "network.target" - "local-fs.target" - "time-sync.target" - (ensureUnitExists config "ceph-osd-setup-${localOsdServiceName}.service") - ]; - wants = [ - "network.target" - "local-fs.target" - "time-sync.target" - ]; - - path = [ - # TODO: use wrapProgram in the ceph package for this in the future - pkgs.getopt - ] - ++ cephDeviceHealthMonitoringPathsOrPackages - ; - - restartTriggers = [ config.environment.etc."ceph/${cfg.clusterName}.conf".source ]; - - preStart = '' - ${ensureTransientCephDirs} - ${lib.getLib cfg.package}/libexec/ceph/ceph-osd-prestart.sh --cluster ${cfg.clusterName} --id ${toString osdConfig.id} - ''; - - serviceConfig = let - clusterIpArg = lib.optionalString (osdConfig.clusterAddress != null) "--cluster_addr=${osdConfig.clusterAddress}"; - in { - LimitNOFILE="1048576"; - LimitNPROC="1048576"; - - ExecStart='' - ${cfg.package}/bin/ceph-osd -f --cluster ${cfg.clusterName} --id ${toString osdConfig.id} --setuser ${config.users.users.ceph.name} --setgroup ${config.users.groups.ceph.name} "--public_bind_addr=${cfg.osdBindAddr}" "--public_addr=${cfg.osdAdvertisedPublicAddr}" "${clusterIpArg}" - ''; - ExecReload='' - ${pkgs.coreutils}/bin/kill -HUP $MAINPID - ''; - Restart="on-failure"; - ProtectHome="true"; - ProtectSystem="full"; - PrivateTmp="true"; - TasksMax="infinity"; - # StartLimitBurst="3"; - }; - # startLimitIntervalSec = 30 * 60; - }; - - in mkIf cfg.enable { - environment.systemPackages = [ cfg.package ]; - - networking.firewall = { - allowedTCPPorts = [ - # Ceph outside of VPN because it is very data heavy and causes packet loss. - # We enable msgr-v2 only because that allows its own on-wire encryption. - 3300 # ceph msgr-v2 - ]; - allowedTCPPortRanges = [ - { from = 6800; to = 7300; } # https://docs.ceph.com/en/pacific/rados/configuration/network-config-ref/ - ]; - }; - - # Reminder of how `ceph.conf` works: - # - # * Ceph upstream docs now recommend to use underscores instead of spaces. - # * Options in more specific sections like `[mon]` override those in less - # specific sections like `[global]`. But all options can be written into all sections, - # and an option has the same name, no matter in which section it is written. - # Thus, put options in `[global]`, and only use a diffent section - # if you want to override an option you've set in `global`. - # - # Sample: https://github.com/ceph/ceph/blob/master/src/sample.ceph.conf - environment.etc."ceph/${cfg.clusterName}.conf".text = - '' + # Reminder of how `ceph.conf` works: + # + # * Ceph upstream docs now recommend to use underscores instead of spaces. + # * Options in more specific sections like `[mon]` override those in less + # specific sections like `[global]`. But all options can be written into all sections, + # and an option has the same name, no matter in which section it is written. + # Thus, put options in `[global]`, and only use a diffent section + # if you want to override an option you've set in `global`. + # + # Sample: https://github.com/ceph/ceph/blob/master/src/sample.ceph.conf + environment.etc."ceph/${cfg.clusterName}.conf".text = '' [global] fsid = ${cfg.fsid} mon_initial_members = ${commaSep (map (mon: mon.hostname) cfg.initialMonitors)} @@ -613,237 +649,281 @@ in ${cfg.extraConfig} ''; - environment.etc."ceph/${cfg.clusterName}.client.admin.keyring" = { - source = cfg.adminKeyring; - mode = "0600"; - # Make ceph own this keyring so that it can use it to get keys for its daemons. - user = "ceph"; - group = "ceph"; - }; + environment.etc."ceph/${cfg.clusterName}.client.admin.keyring" = { + source = cfg.adminKeyring; + mode = "0600"; + # Make ceph own this keyring so that it can use it to get keys for its daemons. + user = "ceph"; + group = "ceph"; + }; - users.users.ceph = { - isNormalUser = false; - isSystemUser = true; - # TODO: Legacy UID / GID chosen from before we configured the UID declaratively. - # In the future, we whould change this whole module to use - # `config.ids.uids.ceph`, like the upstream nixpkgs Ceph module does. - # Switching away from `nogroup` would also be good as described there. - # For both cases, we'll have to `chown` all relevant existing files on - # deployments, such as `/var/lib/ceph`, and log files. - uid = 1001; - group = config.users.groups.nogroup.name; - }; - users.groups.ceph = { - # TODO: Same TODO as above for the `uid`. - gid = 499; - }; + users.users.ceph = { + isNormalUser = false; + isSystemUser = true; + # TODO: Legacy UID / GID chosen from before we configured the UID declaratively. + # In the future, we whould change this whole module to use + # `config.ids.uids.ceph`, like the upstream nixpkgs Ceph module does. + # Switching away from `nogroup` would also be good as described there. + # For both cases, we'll have to `chown` all relevant existing files on + # deployments, such as `/var/lib/ceph`, and log files. + uid = 1001; + group = config.users.groups.nogroup.name; + }; + users.groups.ceph = { + # TODO: Same TODO as above for the `uid`. + gid = 499; + }; - # Allow ceph daemons (which run as user ceph) to collect device health metrics. - security.sudo.extraRules = - map ({ sudoersExtraRule, ... }: sudoersExtraRule) cephMonitoringSudoersCommandsAndPackages; + # Allow ceph daemons (which run as user ceph) to collect device health metrics. + security.sudo.extraRules = map ( + { sudoersExtraRule, ... }: sudoersExtraRule + ) cephMonitoringSudoersCommandsAndPackages; - # The udevadm trigger/settle in `makeCephOsdSetupSystemdService` waits for these rules rule to be applied. - services.udev.extraRules = - lib.concatStringsSep "\n" ( - lib.mapAttrsToList (_localOsdServiceName: osdConfig: + # The udevadm trigger/settle in `makeCephOsdSetupSystemdService` waits for these rules rule to be applied. + services.udev.extraRules = lib.concatStringsSep "\n" ( + lib.mapAttrsToList ( + _localOsdServiceName: osdConfig: '' SUBSYSTEM=="block", ${osdConfig.blockDeviceUdevRuleMatcher}, OWNER="${config.users.users.ceph.name}", GROUP="${config.users.groups.ceph.name}", MODE="0660" '' - + lib.optionalString (osdConfig.dbBlockDeviceUdevRuleMatcher != null) ( - '' - SUBSYSTEM=="block", ${osdConfig.dbBlockDeviceUdevRuleMatcher}, OWNER="${config.users.users.ceph.name}", GROUP="${config.users.groups.ceph.name}", MODE="0660" - '' - ) + + lib.optionalString (osdConfig.dbBlockDeviceUdevRuleMatcher != null) ('' + SUBSYSTEM=="block", ${osdConfig.dbBlockDeviceUdevRuleMatcher}, OWNER="${config.users.users.ceph.name}", GROUP="${config.users.groups.ceph.name}", MODE="0660" + '') ) cfg.osds ); - systemd.services = { + systemd.services = + { - ceph-mon-setup = mkIf cfg.monitor.enable { - description = "Initialize ceph monitor"; + ceph-mon-setup = mkIf cfg.monitor.enable { + description = "Initialize ceph monitor"; - preStart = ensureCephDirs; + preStart = ensureCephDirs; - script = let - # `--addv` seems currently required to get msgr-v2 working, see: - # https://tracker.ceph.com/issues/53751#note-11 - monmapNodes = builtins.concatStringsSep " " (lib.concatMap (mon: [ "--addv" mon.hostname "[v2:${mon.ipAddress}:3300,v1:${mon.ipAddress}:6789]" ]) cfg.initialMonitors); - # Monitors cannot simply be changed in config, one has to update the monmap, see note [replacing-ceph-monmap-ips-for-existing-cluster] - in '' - set -euo pipefail - rm -rf "${monDir}" # Start from scratch. - echo "Initializing monitor." - MONMAP_DIR=`mktemp -d` - ${cfg.package}/bin/monmaptool --create ${monmapNodes} --fsid ${cfg.fsid} "$MONMAP_DIR/monmap" - ${cfg.package}/bin/ceph-mon --cluster ${cfg.clusterName} --mkfs -i ${cfg.monitor.nodeName} --monmap "$MONMAP_DIR/monmap" --keyring ${cfg.monitor.initialKeyring} - rm -r "$MONMAP_DIR" - touch ${monDir}/done - ''; + script = + let + # `--addv` seems currently required to get msgr-v2 working, see: + # https://tracker.ceph.com/issues/53751#note-11 + monmapNodes = builtins.concatStringsSep " " ( + lib.concatMap (mon: [ + "--addv" + mon.hostname + "[v2:${mon.ipAddress}:3300,v1:${mon.ipAddress}:6789]" + ]) cfg.initialMonitors + ); + in + # Monitors cannot simply be changed in config, one has to update the monmap, see note [replacing-ceph-monmap-ips-for-existing-cluster] + '' + set -euo pipefail + rm -rf "${monDir}" # Start from scratch. + echo "Initializing monitor." + MONMAP_DIR=`mktemp -d` + ${cfg.package}/bin/monmaptool --create ${monmapNodes} --fsid ${cfg.fsid} "$MONMAP_DIR/monmap" + ${cfg.package}/bin/ceph-mon --cluster ${cfg.clusterName} --mkfs -i ${cfg.monitor.nodeName} --monmap "$MONMAP_DIR/monmap" --keyring ${cfg.monitor.initialKeyring} + rm -r "$MONMAP_DIR" + touch ${monDir}/done + ''; - serviceConfig = { - Type = "oneshot"; - RemainAfterExit = true; - PermissionsStartOnly = true; # only run the script as ceph - User = config.users.users.ceph.name; - Group = config.users.groups.ceph.name; - }; - unitConfig = { - ConditionPathExists = "!${monDir}/done"; - }; - }; + serviceConfig = { + Type = "oneshot"; + RemainAfterExit = true; + PermissionsStartOnly = true; # only run the script as ceph + User = config.users.users.ceph.name; + Group = config.users.groups.ceph.name; + }; + unitConfig = { + ConditionPathExists = "!${monDir}/done"; + }; + }; - ceph-mon = mkIf cfg.monitor.enable { - description = "Ceph monitor"; + ceph-mon = mkIf cfg.monitor.enable { + description = "Ceph monitor"; - requires = [ (ensureUnitExists config "ceph-mon-setup.service") ]; - requiredBy = [ "multi-user.target" ]; - after = [ "network.target" "local-fs.target" "time-sync.target" (ensureUnitExists config "ceph-mon-setup.service") ]; - wants = [ "network.target" "local-fs.target" "time-sync.target" ]; + requires = [ (ensureUnitExists config "ceph-mon-setup.service") ]; + requiredBy = [ "multi-user.target" ]; + after = [ + "network.target" + "local-fs.target" + "time-sync.target" + (ensureUnitExists config "ceph-mon-setup.service") + ]; + wants = [ + "network.target" + "local-fs.target" + "time-sync.target" + ]; - restartTriggers = [ config.environment.etc."ceph/${cfg.clusterName}.conf".source ]; + restartTriggers = [ config.environment.etc."ceph/${cfg.clusterName}.conf".source ]; - path = cephDeviceHealthMonitoringPathsOrPackages; + path = cephDeviceHealthMonitoringPathsOrPackages; - preStart = ensureTransientCephDirs; + preStart = ensureTransientCephDirs; - serviceConfig = { - LimitNOFILE="1048576"; - LimitNPROC="1048576"; - ExecStart='' - ${cfg.package}/bin/ceph-mon -f --cluster ${cfg.clusterName} --id ${cfg.monitor.nodeName} --setuser ${config.users.users.ceph.name} --setgroup ${config.users.groups.ceph.name} "--public_bind_addr=${cfg.monitor.bindAddr}" "--public_addr=${cfg.monitor.advertisedPublicAddr}" - ''; - ExecReload='' - ${pkgs.coreutils}/bin/kill -HUP $MAINPID - ''; - PrivateDevices="yes"; - ProtectHome="true"; - ProtectSystem="full"; - PrivateTmp="true"; - TasksMax="infinity"; - Restart="on-failure"; - # StartLimitBurst="5"; - RestartSec="10"; - }; - # startLimitIntervalSec = 30 * 60; - }; + serviceConfig = { + LimitNOFILE = "1048576"; + LimitNPROC = "1048576"; + ExecStart = '' + ${cfg.package}/bin/ceph-mon -f --cluster ${cfg.clusterName} --id ${cfg.monitor.nodeName} --setuser ${config.users.users.ceph.name} --setgroup ${config.users.groups.ceph.name} "--public_bind_addr=${cfg.monitor.bindAddr}" "--public_addr=${cfg.monitor.advertisedPublicAddr}" + ''; + ExecReload = '' + ${pkgs.coreutils}/bin/kill -HUP $MAINPID + ''; + PrivateDevices = "yes"; + ProtectHome = "true"; + ProtectSystem = "full"; + PrivateTmp = "true"; + TasksMax = "infinity"; + Restart = "on-failure"; + # StartLimitBurst="5"; + RestartSec = "10"; + }; + # startLimitIntervalSec = 30 * 60; + }; - ceph-mgr-setup = mkIf cfg.manager.enable { - description = "Initialize Ceph manager"; + ceph-mgr-setup = mkIf cfg.manager.enable { + description = "Initialize Ceph manager"; - preStart = ensureCephDirs; + preStart = ensureCephDirs; - script = '' - set -euo pipefail - mkdir -p ${mgrDir} - until [ -f /etc/ceph/${cfg.clusterName}.client.admin.keyring ] - do - sleep 1 - done - ${cfg.package}/bin/ceph auth get-or-create mgr.${cfg.manager.nodeName} mon 'allow profile mgr' mds 'allow *' osd 'allow *' -o ${mgrDir}/keyring - touch "${mgrDir}/.nix_done" - ''; + script = '' + set -euo pipefail + mkdir -p ${mgrDir} + until [ -f /etc/ceph/${cfg.clusterName}.client.admin.keyring ] + do + sleep 1 + done + ${cfg.package}/bin/ceph auth get-or-create mgr.${cfg.manager.nodeName} mon 'allow profile mgr' mds 'allow *' osd 'allow *' -o ${mgrDir}/keyring + touch "${mgrDir}/.nix_done" + ''; - serviceConfig = { - Type = "oneshot"; - RemainAfterExit = true; - PermissionsStartOnly = true; # only run the script as ceph - User = config.users.users.ceph.name; - Group = config.users.groups.ceph.name; - }; - unitConfig = { - ConditionPathExists = "!${mgrDir}/.nix_done"; - }; - }; + serviceConfig = { + Type = "oneshot"; + RemainAfterExit = true; + PermissionsStartOnly = true; # only run the script as ceph + User = config.users.users.ceph.name; + Group = config.users.groups.ceph.name; + }; + unitConfig = { + ConditionPathExists = "!${mgrDir}/.nix_done"; + }; + }; - ceph-mgr = mkIf cfg.manager.enable { - description = "Ceph manager"; + ceph-mgr = mkIf cfg.manager.enable { + description = "Ceph manager"; - requires = [ (ensureUnitExists config "ceph-mgr-setup.service") ]; - requiredBy = [ "multi-user.target" ]; - after = [ "network.target" "local-fs.target" "time-sync.target" (ensureUnitExists config "ceph-mgr-setup.service") ]; - wants = [ "network.target" "local-fs.target" "time-sync.target" ]; + requires = [ (ensureUnitExists config "ceph-mgr-setup.service") ]; + requiredBy = [ "multi-user.target" ]; + after = [ + "network.target" + "local-fs.target" + "time-sync.target" + (ensureUnitExists config "ceph-mgr-setup.service") + ]; + wants = [ + "network.target" + "local-fs.target" + "time-sync.target" + ]; - restartTriggers = [ config.environment.etc."ceph/${cfg.clusterName}.conf".source ]; + restartTriggers = [ config.environment.etc."ceph/${cfg.clusterName}.conf".source ]; - preStart = ensureTransientCephDirs; + preStart = ensureTransientCephDirs; - serviceConfig = { - LimitNOFILE="1048576"; - LimitNPROC="1048576"; + serviceConfig = { + LimitNOFILE = "1048576"; + LimitNPROC = "1048576"; - ExecStart='' - ${cfg.package}/bin/ceph-mgr -f --cluster ${cfg.clusterName} --id ${cfg.manager.nodeName} --setuser ${config.users.users.ceph.name} --setgroup ${config.users.groups.ceph.name} - ''; - ExecReload='' - ${pkgs.coreutils}/bin/kill -HUP $MAINPID - ''; - Restart="on-failure"; - RestartSec=10; - # StartLimitBurst="3"; - }; - # startLimitIntervalSec = 30 * 60; - }; + ExecStart = '' + ${cfg.package}/bin/ceph-mgr -f --cluster ${cfg.clusterName} --id ${cfg.manager.nodeName} --setuser ${config.users.users.ceph.name} --setgroup ${config.users.groups.ceph.name} + ''; + ExecReload = '' + ${pkgs.coreutils}/bin/kill -HUP $MAINPID + ''; + Restart = "on-failure"; + RestartSec = 10; + # StartLimitBurst="3"; + }; + # startLimitIntervalSec = 30 * 60; + }; - ceph-mds-setup = mkIf cfg.mds.enable { - description = "Initialize Ceph MDS"; + ceph-mds-setup = mkIf cfg.mds.enable { + description = "Initialize Ceph MDS"; - preStart = ensureCephDirs; + preStart = ensureCephDirs; - script = '' - set -euo pipefail - mkdir -p ${mdsDir} - until [ -f /etc/ceph/${cfg.clusterName}.client.admin.keyring ] - do - sleep 1 - done - ${cfg.package}/bin/ceph auth get-or-create mds.${cfg.mds.nodeName} osd 'allow rwx' mds 'allow' mon 'allow profile mds' -o ${mdsDir}/keyring - touch "${mdsDir}/.nix_done" - ''; + script = '' + set -euo pipefail + mkdir -p ${mdsDir} + until [ -f /etc/ceph/${cfg.clusterName}.client.admin.keyring ] + do + sleep 1 + done + ${cfg.package}/bin/ceph auth get-or-create mds.${cfg.mds.nodeName} osd 'allow rwx' mds 'allow' mon 'allow profile mds' -o ${mdsDir}/keyring + touch "${mdsDir}/.nix_done" + ''; - serviceConfig = { - Type = "oneshot"; - RemainAfterExit = true; - PermissionsStartOnly = true; # only run the script as ceph - User = config.users.users.ceph.name; - Group = config.users.groups.ceph.name; - }; - unitConfig = { - ConditionPathExists = "!${mdsDir}/.nix_done"; - }; - }; + serviceConfig = { + Type = "oneshot"; + RemainAfterExit = true; + PermissionsStartOnly = true; # only run the script as ceph + User = config.users.users.ceph.name; + Group = config.users.groups.ceph.name; + }; + unitConfig = { + ConditionPathExists = "!${mdsDir}/.nix_done"; + }; + }; - ceph-mds = mkIf cfg.mds.enable { - description = "Ceph MDS"; + ceph-mds = mkIf cfg.mds.enable { + description = "Ceph MDS"; - requires = [ (ensureUnitExists config "ceph-mds-setup.service") ]; - requiredBy = [ "multi-user.target" ]; - after = [ "network.target" "local-fs.target" "time-sync.target" (ensureUnitExists config "ceph-mds-setup.service") ]; - wants = [ "network.target" "local-fs.target" "time-sync.target" ]; + requires = [ (ensureUnitExists config "ceph-mds-setup.service") ]; + requiredBy = [ "multi-user.target" ]; + after = [ + "network.target" + "local-fs.target" + "time-sync.target" + (ensureUnitExists config "ceph-mds-setup.service") + ]; + wants = [ + "network.target" + "local-fs.target" + "time-sync.target" + ]; - restartTriggers = [ config.environment.etc."ceph/${cfg.clusterName}.conf".source ]; + restartTriggers = [ config.environment.etc."ceph/${cfg.clusterName}.conf".source ]; - preStart = ensureTransientCephDirs; + preStart = ensureTransientCephDirs; - serviceConfig = { - LimitNOFILE="1048576"; - LimitNPROC="1048576"; + serviceConfig = { + LimitNOFILE = "1048576"; + LimitNPROC = "1048576"; - ExecStart='' - ${cfg.package}/bin/ceph-mds -f --cluster ${cfg.clusterName} --id ${cfg.mds.nodeName} --setuser ${config.users.users.ceph.name} --setgroup ${config.users.groups.ceph.name} "--public_addr=${cfg.mds.listenAddr}" - ''; - ExecReload='' - ${pkgs.coreutils}/bin/kill -HUP $MAINPID - ''; - Restart="on-failure"; - # StartLimitBurst="3"; - }; - # startLimitIntervalSec = 30 * 60; - }; + ExecStart = '' + ${cfg.package}/bin/ceph-mds -f --cluster ${cfg.clusterName} --id ${cfg.mds.nodeName} --setuser ${config.users.users.ceph.name} --setgroup ${config.users.groups.ceph.name} "--public_addr=${cfg.mds.listenAddr}" + ''; + ExecReload = '' + ${pkgs.coreutils}/bin/kill -HUP $MAINPID + ''; + Restart = "on-failure"; + # StartLimitBurst="3"; + }; + # startLimitIntervalSec = 30 * 60; + }; - } - # Make one OSD service for each configured OSD. - // lib.mapAttrs' (localOsdServiceName: osdConfig: nameValuePair "ceph-osd-setup-${localOsdServiceName}" (makeCephOsdSetupSystemdService localOsdServiceName osdConfig)) cfg.osds - // lib.mapAttrs' (localOsdServiceName: osdConfig: nameValuePair "ceph-osd-${localOsdServiceName}" (makeCephOsdSystemdService localOsdServiceName osdConfig)) cfg.osds; - }; + } + # Make one OSD service for each configured OSD. + // lib.mapAttrs' ( + localOsdServiceName: osdConfig: + nameValuePair "ceph-osd-setup-${localOsdServiceName}" ( + makeCephOsdSetupSystemdService localOsdServiceName osdConfig + ) + ) cfg.osds + // lib.mapAttrs' ( + localOsdServiceName: osdConfig: + nameValuePair "ceph-osd-${localOsdServiceName}" ( + makeCephOsdSystemdService localOsdServiceName osdConfig + ) + ) cfg.osds; + }; } - diff --git a/modules/nixos/container.nix b/modules/nixos/container.nix index 8f17832..5b8de59 100644 --- a/modules/nixos/container.nix +++ b/modules/nixos/container.nix @@ -1,76 +1,88 @@ -{ config, lib, inputs, overlays, ... }: +{ + config, + lib, + top, + overlays, + ... +}: let - cfg = config.greg.containers; + cfg = config.greg.containers; - # Create a container with all our default settings + # Create a container with all our default settings - makeContainer = name: container: let - agekey = "/etc/ssh/agenix_key"; - in { - autoStart = true; - hostAddress = "192.168.${container.subnet}.1"; - localAddress = "192.168.${container.subnet}.2"; - privateNetwork = true; - bindMounts = { - "${agekey}".hostPath = "/etc/ssh/ssh_host_ed25519_key"; # This is needed for agenix to - }; - enableTun = container.tailscale; - config = { config, pkgs, ... }: { - imports = [ - inputs.agenix.nixosModules.default - inputs.self.modules.nixosModule - container.builder - ]; + makeContainer = + _: container: + let + agekey = "/etc/ssh/agenix_key"; + in + { + autoStart = true; + hostAddress = "192.168.${container.subnet}.1"; + localAddress = "192.168.${container.subnet}.2"; + privateNetwork = true; + bindMounts = { + "${agekey}".hostPath = "/etc/ssh/ssh_host_ed25519_key"; # This is needed for agenix to + }; + enableTun = container.tailscale; + config = + { ... }: + { + imports = [ + top.agenix.nixosModules.default + top.self.modules.nixosModule + container.builder + ]; - nixpkgs.overlays = overlays; + nixpkgs.overlays = overlays; - networking = { - firewall.enable = true; - useHostResolvConf = lib.mkForce false; - }; + networking = { + firewall.enable = true; + useHostResolvConf = lib.mkForce false; + }; - age.identityPaths = [ agekey ]; + age.identityPaths = [ agekey ]; - greg.tailscale.enable = container.tailscale; - }; - }; -in { - options.greg.containers = lib.mkOption { - default = {}; + greg.tailscale.enable = container.tailscale; + }; + }; +in +{ + options.greg.containers = lib.mkOption { + default = { }; - type = with lib.types; attrsOf ( submodule ( - { - options = { - tailscale = lib.mkOption { - type = bool; - default = false; - description = "Enable tailscale in the container"; - }; - subnet = lib.mkOption { - type = str; - default = "200"; - }; - builder = lib.mkOption { - default = { ... }: {}; - description = '' - This needs to be a function, like the one for - a container's config. It will setup the core system above the - defaults set in this module. - ''; - example = '' - { pkgs, config, lib, ... } : - { - services.openssh.enable = true; - } - ''; - }; - }; - } - )); - }; + type = + with lib.types; + attrsOf (submodule ({ + options = { + tailscale = lib.mkOption { + type = bool; + default = false; + description = "Enable tailscale in the container"; + }; + subnet = lib.mkOption { + type = str; + default = "200"; + }; + builder = lib.mkOption { + default = { ... }: { }; + description = '' + This needs to be a function, like the one for + a container's config. It will setup the core system above the + defaults set in this module. + ''; + example = '' + { pkgs, config, lib, ... } : + { + services.openssh.enable = true; + } + ''; + }; + }; + })); + }; - config = { - containers = builtins.mapAttrs makeContainer cfg; - }; + config = { + containers = builtins.mapAttrs makeContainer cfg; + }; } diff --git a/modules/nixos/db.nix b/modules/nixos/db.nix index 8bf1097..ed7c835 100644 --- a/modules/nixos/db.nix +++ b/modules/nixos/db.nix @@ -1,63 +1,77 @@ -{ config, lib, pkgs, ... }: +{ + config, + lib, + pkgs, + ... +}: let - cfg = config.greg.databases; - dbs = (lib.attrNames cfg); -in { - options.greg.databases = lib.mkOption { - default = {}; - type = with lib.types; attrsOf ( submodule ( - { name, config, options, ... }: { - # Options reserved for future expansion - options = {}; - } - )); - }; + cfg = config.greg.databases; + dbs = (lib.attrNames cfg); +in +{ + options.greg.databases = lib.mkOption { + default = { }; + type = + with lib.types; + attrsOf ( + submodule ( + { ... }: + { + # Options reserved for future expansion + options = { }; + } + ) + ); + }; - config = lib.mkIf ( dbs != [] ) { - services = { - postgresql = { - enable = true; - package = pkgs.postgresql_15; - checkConfig = true; - ensureDatabases = dbs; - ensureUsers = map (db: { name = db; ensureDBOwnership = true; }) dbs; - settings = { - log_connections = true; - log_statement = "all"; - logging_collector = true; - log_filename = "postgresql.log"; - }; - identMap = "root root postgres"; - }; + config = lib.mkIf (dbs != [ ]) { + services = { + postgresql = { + enable = true; + package = pkgs.postgresql_15; + checkConfig = true; + ensureDatabases = dbs; + ensureUsers = map (db: { + name = db; + ensureDBOwnership = true; + }) dbs; + settings = { + log_connections = true; + log_statement = "all"; + logging_collector = true; + log_filename = "postgresql.log"; + }; + identMap = "root root postgres"; + }; - postgresqlBackup = { - enable = true; - databases = dbs; - }; + postgresqlBackup = { + enable = true; + databases = dbs; + }; - logrotate = { - enable = true; - settings = { - postgresqlBackup = { - enable = true; - files = "${config.services.postgresqlBackup.location}/*.gz"; - }; - postgresLog = { - enable = true; - files = "/var/lib/postgresql/*/log/*.log"; - compress = true; - compresscmd = "${pkgs.xz}/bin/xz"; - }; - }; - }; + logrotate = { + enable = true; + settings = { + postgresqlBackup = { + enable = true; + files = "${config.services.postgresqlBackup.location}/*.gz"; + }; + postgresLog = { + enable = true; + files = "/var/lib/postgresql/*/log/*.log"; + compress = true; + compresscmd = "${pkgs.xz}/bin/xz"; + }; + }; + }; - }; + }; - greg.backup.jobs.greg-postgresql-backup = { - src = config.services.postgresqlBackup.location; - dest = "database-${config.networking.hostName}"; - id = "${config.networking.hostName}-postgres-backup"; - }; - }; + greg.backup.jobs.greg-postgresql-backup = { + src = config.services.postgresqlBackup.location; + dest = "database-${config.networking.hostName}"; + id = "${config.networking.hostName}-postgres-backup"; + }; + }; } diff --git a/modules/nixos/default.nix b/modules/nixos/default.nix index 5eee404..1447610 100644 --- a/modules/nixos/default.nix +++ b/modules/nixos/default.nix @@ -1,92 +1,107 @@ -{ config, pkgs, inputs, lib, ... }: +{ + config, + pkgs, + lib, + ... +}: let - x = if builtins.hasAttr "xonsh-unwrapped" pkgs then - pkgs.xonsh else - pkgs.xonsh.passthru.wrapper; -in { - imports = [ - ../baseline.nix - ./backup.nix - ./ceph.nix - ./container.nix - ./db.nix - ./gnome.nix - ./home.nix - ./kde.nix - ./kiwix-serve.nix - ./linode.nix - ./proxy.nix - ./router.nix - ./rpi4.nix - ./sway.nix - ./syncthing.nix - ./tailscale.nix - ./vmdev.nix - ]; + x = if builtins.hasAttr "xonsh-unwrapped" pkgs then pkgs.xonsh else pkgs.xonsh.passthru.wrapper; +in +{ + imports = [ + ../baseline.nix + ./backup.nix + ./ceph.nix + ./container.nix + ./db.nix + ./gnome.nix + ./home.nix + ./kde.nix + ./kiwix-serve.nix + ./linode.nix + ./print.nix + ./proxy.nix + ./remote-builder.nix + ./router.nix + ./rpi4.nix + ./sway.nix + ./syncthing.nix + ./tailscale.nix + ./vmdev.nix + ]; - environment.sessionVariables.MOZ_ENABLE_WAYLAND = "0"; - environment.systemPackages = with pkgs; [ - coreutils-full - direnv # needed for xonsh-direnv - efibootmgr - psmisc - lshw - usbutils - ]; + environment.systemPackages = with pkgs; [ + btrfs-progs + coreutils-full + efibootmgr + psmisc + lshw + usbutils + xfsprogs + ]; - system.stateVersion = "24.05"; + system.stateVersion = "24.05"; - nix = { - gc.dates = "weekly"; - settings.auto-optimise-store = true; - }; + nix = { + gc.dates = "weekly"; + settings.auto-optimise-store = true; + }; - # I am a fan of network manager, myself - networking = { - search = [ - "thehellings.lan" - "home" - ]; - networkmanager.enable = true; - }; + # I am a fan of network manager, myself + networking = { + search = [ + "thehellings.lan" + "home" + ]; + networkmanager.enable = true; + }; - programs.xonsh = { - enable = true; - package = (x.override { - extraPackages = (ps: with ps; [ - (ps.toPythonModule pkgs.pipenv) - pyyaml - requests - ruamel-yaml - xonsh-apipenv - pkgs.nur.repos.xonsh-xontribs.xonsh-direnv - pkgs.nur.repos.xonsh-xontribs.xontrib-vox - ]); - }); - }; + programs.xonsh = { + enable = true; + package = ( + x.override { + extraPackages = ( + ps: with ps; [ + (ps.toPythonModule pkgs.pipenv) + pyyaml + requests + ruamel-yaml + xonsh-apipenv + pkgs.nur.repos.xonsh-xontribs.xonsh-direnv + pkgs.nur.repos.xonsh-xontribs.xontrib-vox + ] + ); + } + ); + }; - # Enable the OpenSSH daemon for remote control - services = { - openssh = { - enable = true; - settings.X11Forwarding = true; - }; - }; + # Enable the OpenSSH daemon for remote control + services = { + openssh = { + enable = true; + settings.X11Forwarding = true; + }; + }; - # Define a user account. Don't forget to set a password with ‘passwd’. - users.users.greg = { - isNormalUser = true; - createHome = true; - extraGroups = [ "wheel" "networkmanager" ]; # Enable ‘sudo’ for the user. - shell = config.programs.xonsh.package; - openssh.authorizedKeys.keys = lib.strings.splitString "\n" (builtins.readFile ../../home/ssh/authorized_keys); - }; + # Define a user account. Don't forget to set a password with ‘passwd’. + users.users.greg = { + isNormalUser = true; + createHome = true; + extraGroups = [ + "wheel" + "networkmanager" + ]; # Enable ‘sudo’ for the user. + shell = config.programs.xonsh.package; + openssh.authorizedKeys.keys = lib.strings.splitString "\n" ( + builtins.readFile ../../home/ssh/authorized_keys + ); + }; - i18n.defaultLocale = "en_US.UTF-8"; + i18n.defaultLocale = "en_US.UTF-8"; - console = { - font = "Lat2-Terminus16"; - keyMap = "us"; - }; + console = { + font = "Lat2-Terminus16"; + keyMap = "us"; + }; } diff --git a/modules/nixos/gnome.nix b/modules/nixos/gnome.nix index 505d6b1..5026e84 100644 --- a/modules/nixos/gnome.nix +++ b/modules/nixos/gnome.nix @@ -1,64 +1,69 @@ -{ config, pkgs, lib, ... }: +{ + config, + pkgs, + lib, + ... +}: let - cfg = config.greg.gnome; + cfg = config.greg.gnome; -in with lib; { - options = { - greg.gnome.enable = mkEnableOption "Enable my default Gnome3 setup"; - }; +in +with lib; +{ + options = { + greg.gnome.enable = mkEnableOption "Enable my default Gnome3 setup"; + }; - config = mkIf cfg.enable { - # Sets up a basic Gnome installation - services = { - accounts-daemon.enable = true; + config = mkIf cfg.enable { + # Sets up a basic Gnome installation + services = { + accounts-daemon.enable = true; - # Trackpad support - libinput.enable = true; + # Trackpad support + libinput.enable = true; - xserver = { - enable = true; - displayManager.gdm.enable = true; - desktopManager.gnome.enable = true; - xkb.layout = "us"; - }; + xserver = { + enable = true; + displayManager.gdm.enable = true; + desktopManager.gnome.enable = true; + xkb.layout = "us"; + }; - udev.packages = with pkgs; [ - gnome3.gnome-settings-daemon - ]; + udev.packages = with pkgs; [ gnome-settings-daemon ]; - pipewire.enable = true; + pipewire.enable = true; - # Enablement for Firefox - gnome = { - gnome-browser-connector.enable = true; - #chrome-gnome-shell.enable = true; - sushi.enable = true; - gnome-online-accounts.enable = true; - }; - }; + # Enablement for Firefox + gnome = { + gnome-browser-connector.enable = true; + #chrome-gnome-shell.enable = true; + sushi.enable = true; + gnome-online-accounts.enable = true; + }; + }; - programs.dconf.enable = true; - xdg.portal = { - enable = true; - wlr.enable = true; # Enables screen sharing in Wayland - }; + programs.dconf.enable = true; + xdg.portal = { + enable = true; + wlr.enable = true; # Enables screen sharing in Wayland + }; - # Used by gsconnect - networking.firewall.allowedTCPPorts = [ 1716 ]; + # Used by gsconnect + networking.firewall.allowedTCPPorts = [ 1716 ]; - # Enable some Gnome plugins that I like - environment.systemPackages = with pkgs; [ - adwaita-icon-theme - gnome-tweaks - dconf-editor - gnomeExtensions.appindicator - gnomeExtensions.clipboard-indicator - gnomeExtensions.dash-to-dock - gnomeExtensions.gsconnect - gnomeExtensions.stocks-extension - gnomeExtensions.tailscale-qs - gnomeExtensions.vitals - ]; - }; + # Enable some Gnome plugins that I like + environment.systemPackages = with pkgs; [ + adwaita-icon-theme + gnome-tweaks + dconf-editor + gnomeExtensions.appindicator + gnomeExtensions.clipboard-indicator + gnomeExtensions.dash-to-dock + gnomeExtensions.gsconnect + gnomeExtensions.stocks-extension + gnomeExtensions.tailscale-qs + gnomeExtensions.vitals + ]; + }; } diff --git a/modules/nixos/home.nix b/modules/nixos/home.nix index 8040dce..4c9c8aa 100644 --- a/modules/nixos/home.nix +++ b/modules/nixos/home.nix @@ -1,18 +1,19 @@ { config, lib, ... }: let - cfg = config.greg.home; + cfg = config.greg.home; -in with lib; +in +with lib; { - options.greg.home = mkOption { - type = types.bool; - default = true; - description = "Sets the device up to be part of my home network"; - }; + options.greg.home = mkOption { + type = types.bool; + default = true; + description = "Sets the device up to be part of my home network"; + }; - config = mkIf cfg { - time.timeZone = "America/Chicago"; - networking.domain = "thehellings.lan"; - }; + config = mkIf cfg { + time.timeZone = "America/Chicago"; + networking.domain = "thehellings.lan"; + }; } diff --git a/modules/nixos/kde.nix b/modules/nixos/kde.nix index 685edb8..d6f37bd 100644 --- a/modules/nixos/kde.nix +++ b/modules/nixos/kde.nix @@ -1,48 +1,63 @@ -{ config, pkgs, lib, options, ... }: +{ + config, + pkgs, + lib, + options, + ... +}: let - cfg = config.greg.kde; + cfg = config.greg.kde; -in with lib; { - options = { - greg.kde.enable = mkEnableOption "Enable my default KDE setup"; - }; +in +with lib; +{ + options = { + greg.kde.enable = mkEnableOption "Enable my default KDE setup"; + }; - config = mkIf cfg.enable { - # Sets up a basic KDE installation - services = { - xserver = { - enable = true; - xkb.layout = "us"; - # Trackpad support - libinput.enable = true; - }; + config = mkIf cfg.enable { + hardware = { + bluetooth.enable = true; + }; + # Sets up a basic KDE installation + systemd.services.bluetooth.requiredBy = [ "multi-user.target" ]; + services = + { + xserver = { + enable = true; + xkb.layout = "us"; + # Trackpad support + }; - pipewire = { - enable = true; - alsa.enable = true; - alsa.support32Bit = true; - pulse.enable = true; - }; - } // (optionalAttrs (builtins.hasAttr "plasma6" options.services.xserver.desktopManager) { - desktopManager.plasma6.enable = true; - displayManager = { - defaultSession = "plasma"; - sddm.enable = true; - }; - }); + libinput.enable = true; + blueman.enable = true; - programs.dconf.enable = true; - programs.sway.enable = true; # Gives us Wayland - xdg.portal = { - enable = true; - wlr.enable = true; # Enables screen sharing in Wayland - }; + pipewire = { + enable = true; + alsa.enable = true; + alsa.support32Bit = true; + pulse.enable = true; + }; + } + // (optionalAttrs (builtins.hasAttr "plasma6" options.services.xserver.desktopManager) { + desktopManager.plasma6.enable = true; + displayManager = { + defaultSession = "plasma"; + sddm.enable = true; + }; + }); - environment.systemPackages = with pkgs; [ - kalendar - korganizer - plasma-pa - ]; - }; + programs.dconf.enable = true; + programs.sway.enable = true; # Gives us Wayland + xdg.portal = { + enable = true; + wlr.enable = true; # Enables screen sharing in Wayland + }; + + environment.systemPackages = with pkgs; [ + kalendar + korganizer + ]; + }; } diff --git a/modules/nixos/kiwix-serve.nix b/modules/nixos/kiwix-serve.nix index ef714a2..793b8b7 100644 --- a/modules/nixos/kiwix-serve.nix +++ b/modules/nixos/kiwix-serve.nix @@ -1,48 +1,54 @@ -{ config, pkgs, lib, ... }: +{ + config, + pkgs, + lib, + ... +}: let - cfg = config.services.kiwix-serve; -in with lib; { - options.services.kiwix-serve = { - enable = mkEnableOption "Enable the Kiwix web server"; + cfg = config.services.kiwix-serve; +in +with lib; +{ + options.services.kiwix-serve = { + enable = mkEnableOption "Enable the Kiwix web server"; - port = mkOption { - type = types.int; - default = 8888; - description = "Port to serve the Kiwix HTTP service on"; - }; + port = mkOption { + type = types.int; + default = 8888; + description = "Port to serve the Kiwix HTTP service on"; + }; - path = mkOption { - type = types.str; - default = "/var/lib/kiwix-serve/"; - description = "Path to Zim file(s) to serve"; - }; + path = mkOption { + type = types.str; + default = "/var/lib/kiwix-serve/"; + description = "Path to Zim file(s) to serve"; + }; - proxy = mkOption { - type = types.str; - default = ""; - description = ''Upstream proxy, if any, to configure with kiwix. Specify - host and port. E.g. "localhost:8080" - ''; - }; - }; + proxy = mkOption { + type = types.str; + default = ""; + description = '' + Upstream proxy, if any, to configure with kiwix. Specify + host and port. E.g. "localhost:8080" + ''; + }; + }; - config = mkIf cfg.enable { - environment.systemPackages = [ - pkgs.kiwix-tools - ]; + config = mkIf cfg.enable { + environment.systemPackages = [ pkgs.kiwix-tools ]; - systemd.services.kiwix-serve = { - enable = true; - after = [ "network.service" ]; - description = "Runs the kiwix-serve binary as a sysmted service"; - restartTriggers = [ pkgs.kiwix-tools ]; - wantedBy = [ "multi-user.target" ]; - script = "${pkgs.kiwix-tools}/bin/kiwix-serve --port ${toString cfg.port} ${cfg.path}"; - environment = { - UPSTREAM_HOST = mkIf (cfg.proxy != "") cfg.proxy; - UPSTREAM_WIKI = mkIf (cfg.proxy != "") cfg.proxy; - }; - }; - }; + systemd.services.kiwix-serve = { + enable = true; + after = [ "network.service" ]; + description = "Runs the kiwix-serve binary as a sysmted service"; + restartTriggers = [ pkgs.kiwix-tools ]; + wantedBy = [ "multi-user.target" ]; + script = "${pkgs.kiwix-tools}/bin/kiwix-serve --port ${toString cfg.port} ${cfg.path}"; + environment = { + UPSTREAM_HOST = mkIf (cfg.proxy != "") cfg.proxy; + UPSTREAM_WIKI = mkIf (cfg.proxy != "") cfg.proxy; + }; + }; + }; } diff --git a/modules/nixos/linode.nix b/modules/nixos/linode.nix index dd5bdb4..cfb0500 100644 --- a/modules/nixos/linode.nix +++ b/modules/nixos/linode.nix @@ -1,44 +1,50 @@ -{ config, lib, pkgs, ... }: +{ + config, + lib, + pkgs, + ... +}: let - cfg = config.greg.linode; + cfg = config.greg.linode; -in with lib; +in +with lib; { - options.greg.linode = { - enable = mkEnableOption "Set sensible defaults for a Linode host"; + options.greg.linode = { + enable = mkEnableOption "Set sensible defaults for a Linode host"; - bootTimeout = mkOption { - type = types.int; - default = 15; - description = "Set bootloader timeout in seconds."; - }; - }; + bootTimeout = mkOption { + type = types.int; + default = 15; + description = "Set bootloader timeout in seconds."; + }; + }; - config = mkIf cfg.enable { - # Enables connection over Linode consoles - boot.kernelParams = [ "console=ttyS0,19200n8" ]; - boot.loader.grub = { - device = "nodev"; - extraConfig = '' -serial --speed=19200 --unit=0 --word=8 --parity=no --stop=1; -terminal_input serial; -terminal_output serial; -''; - }; + config = mkIf cfg.enable { + # Enables connection over Linode consoles + boot.kernelParams = [ "console=ttyS0,19200n8" ]; + boot.loader.grub = { + device = "nodev"; + extraConfig = '' + serial --speed=19200 --unit=0 --word=8 --parity=no --stop=1; + terminal_input serial; + terminal_output serial; + ''; + }; - # Tells grub to ignore partion-free device warnings, since we are on Linode - boot.loader.timeout = 15; + # Tells grub to ignore partion-free device warnings, since we are on Linode + boot.loader.timeout = 15; - networking.usePredictableInterfaceNames = false; # Use old style eth0 names - networking.useDHCP = false; - networking.interfaces.eth0.useDHCP = true; + networking.usePredictableInterfaceNames = false; # Use old style eth0 names + networking.useDHCP = false; + networking.interfaces.eth0.useDHCP = true; - # Suggested diagnostic tools - environment.systemPackages = with pkgs; [ - inetutils - mtr - sysstat - ]; - }; + # Suggested diagnostic tools + environment.systemPackages = with pkgs; [ + inetutils + mtr + sysstat + ]; + }; } diff --git a/modules/nixos/print.nix b/modules/nixos/print.nix new file mode 100644 index 0000000..1eeb99b --- /dev/null +++ b/modules/nixos/print.nix @@ -0,0 +1,39 @@ +{ + config, + lib, + pkgs, + ... +}: + +let + cfg = config.greg.print; + +in +with lib; +{ + options.greg.print.enable = mkOption { + type = types.bool; + default = true; + description = "Configures the system to print with my home printer"; + }; + + config = mkIf cfg.enable { + # ipp://printer.thehellings.lan:631/ - generic postscript printer + services.printing = { + enable = true; + drivers = with pkgs; [ gutenprint ] ++ (lib.optional pkgs.stdenv.isx86_64 gutenprintBin); + }; + + hardware.printers.ensurePrinters = [ + { + name = "HomeLexmarkColorPrinter"; + location = "Home office"; + deviceUri = "ipp://printer.thehellings.lan:631/"; + model = "drv:///sample.drv/generic.ppd"; + ppdOptions = { + PageSize = "Letter"; + }; + } + ]; + }; +} diff --git a/modules/nixos/proxy.nix b/modules/nixos/proxy.nix index e3d87ec..fa2fc8f 100644 --- a/modules/nixos/proxy.nix +++ b/modules/nixos/proxy.nix @@ -1,87 +1,96 @@ -{ config, lib, pkgs, ... }: +{ config, lib, ... }: let - cfg = config.greg.proxies; + cfg = config.greg.proxies; - alias = name: with builtins; head (split "\\." name); + alias = name: with builtins; head (split "\\." name); - makeHost = name: dest: { - forceSSL = dest.ssl; - enableACME = dest.ssl; - locations."${dest.path}" = { - proxyPass = dest.target; - extraConfig = '' -proxy_http_version 1.1; -proxy_set_header Upgrade $http_upgrade; -proxy_set_header Connection $connection_upgrade; -'' + dest.extraConfig; - }; - serverAliases = lib.mkIf dest.genAliases [ "${alias name}" ]; - }; + makeHost = name: dest: { + forceSSL = dest.ssl; + enableACME = dest.ssl; + locations."${dest.path}" = { + proxyPass = dest.target; + extraConfig = + '' + proxy_http_version 1.1; + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection $connection_upgrade; + '' + + dest.extraConfig; + }; + serverAliases = lib.mkIf dest.genAliases [ "${alias name}" ]; + }; -in with lib; { - options = { - greg.proxies = mkOption { - default = {}; - example = literalExpression '' - { host-name = { - target = proxyLocation; - ssl = true; - }; - ''; - description = '' - Quick and simple Nginx proxy configurations. - Use this to configure a very simple proxy that does not - need any extra customization options other than SSL - enablement. - ''; +in +with lib; +{ + options = { + greg.proxies = mkOption { + default = { }; + example = literalExpression '' + { host-name = { + target = proxyLocation; + ssl = true; + }; + ''; + description = '' + Quick and simple Nginx proxy configurations. + Use this to configure a very simple proxy that does not + need any extra customization options other than SSL + enablement. + ''; - type = with types; attrsOf (submodule ( - { name, config, options, ... }: - { - options = { - genAliases = mkOption { - type = types.bool; - description = "Whether to auto-generate short alias name"; - default = true; - }; + type = + with types; + attrsOf ( + submodule ( + { ... }: + { + options = { + genAliases = mkOption { + type = types.bool; + description = "Whether to auto-generate short alias name"; + default = true; + }; - target = mkOption { - type = types.str; - description = ''The destination that is being proxied.''; - example = "http://localhost:8080"; - }; + target = mkOption { + type = types.str; + description = ''The destination that is being proxied.''; + example = "http://localhost:8080"; + }; - ssl = mkOption { - type = types.bool; - description = "Whether to enable SSL in front of the proxy"; - default = false; - }; + ssl = mkOption { + type = types.bool; + description = "Whether to enable SSL in front of the proxy"; + default = false; + }; - path = mkOption { - type = types.str; - description = "The path prefix for this proxy"; - default = "/"; - }; + path = mkOption { + type = types.str; + description = "The path prefix for this proxy"; + default = "/"; + }; - extraConfig = mkOption { - type = types.str; - description = "Extra nginx config options"; - default = ""; - }; - }; - })); - }; - }; + extraConfig = mkOption { + type = types.str; + description = "Extra nginx config options"; + default = ""; + }; + }; + } + ) + ); + }; + }; - config.services.nginx = mkIf ( ( attrValues cfg ) != [] ) { - enable = true; + config.services.nginx = mkIf ((attrValues cfg) != [ ]) { + enable = true; - recommendedGzipSettings = true; - recommendedOptimisation = true; - recommendedProxySettings = true; - recommendedTlsSettings = true; + recommendedGzipSettings = true; + recommendedOptimisation = true; + recommendedProxySettings = true; + recommendedTlsSettings = true; - virtualHosts = mapAttrs makeHost cfg; - }; + virtualHosts = mapAttrs makeHost cfg; + }; } diff --git a/modules/nixos/remote-builder.nix b/modules/nixos/remote-builder.nix new file mode 100644 index 0000000..6ba5180 --- /dev/null +++ b/modules/nixos/remote-builder.nix @@ -0,0 +1,33 @@ +{ lib, config, ... }: + +let + cfg = config.greg.remote-builder; +in +with lib; +{ + options.greg.remote-builder = { + enable = mkEnableOption "Enable this as a remote builder for myself"; + }; + + config = mkIf cfg.enable { + greg.tailscale.enable = true; + users.users.remote-builder-user = { + openssh.authorizedKeys.keys = [ + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIG4fNCnomQEsFKQZp16LXRqkfXHzzZbGAYJWPMvlGGQy root@exodus" + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMGJjyFVOsF74QKzRITc8z/5MJlIa47P1tMm9Z8HRJLm root@jude" + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMMOdWSq6NtcP6sfe2uke4wSfgE16hfa970t+8ADdLwk root@nixos" + ]; + homeMode = "500"; + isNormalUser = true; + useDefaultShell = true; + }; + # The builder user needs to be trusted to submit builds + nix.settings.trusted-users = [ config.users.users.remote-builder-user.name ]; + # If the system is powerful enough to be a remote builder, it should + # be powerful enough to do some basic qemu stuff + boot.binfmt.emulatedSystems = [ + "i686-linux" + "aarch64-linux" + ]; + }; +} diff --git a/modules/nixos/router.nix b/modules/nixos/router.nix index b483587..79d5c6b 100644 --- a/modules/nixos/router.nix +++ b/modules/nixos/router.nix @@ -1,93 +1,117 @@ -{ config, lib, pkgs, ... }: +{ + config, + lib, + pkgs, + ... +}: let - names = mylist: (lib.strings.concatMapStringsSep "," (x: ''"${x}"'') mylist); - # Pass the names of the wan/lan ports - nftConfig = { - wan, - lan, - limitedLan ? [], - openPorts ? [ "ssh" "67" "53" ], # ssh, dhcpd, dns - openUDPPorts ? [ "67" "53" ] # dhcpd, dns - }: let - lanList = names lan; - allLan = names (lan ++ limitedLan); - wanName = names wan; - portsString = lib.strings.concatMapStringsSep "\n" (x: "iifname { ${lanList}, \"tailscale0\" } tcp dport ${toString x} accept") openPorts; - udpPortsString = lib.strings.concatMapStringsSep "\n" (x: "iifname { ${lanList}, \"tailscale0\" } udp dport ${toString x} accept") openUDPPorts; - in lib.strings.concatStringsSep "\n" [ - "table ip filter {" - " chain output {" - " type filter hook output priority 100; policy accept;" - " }" + names = mylist: (lib.strings.concatMapStringsSep "," (x: ''"${x}"'') mylist); + # Pass the names of the wan/lan ports + nftConfig = + { + wan, + lan, + limitedLan ? [ ], + openPorts ? [ + "ssh" + "67" + "53" + ], + # ssh, dhcpd, dns + openUDPPorts ? [ + "67" + "53" + ], # dhcpd, dns + }: + let + lanList = names lan; + allLan = names (lan ++ limitedLan); + wanName = names wan; + portsString = lib.strings.concatMapStringsSep "\n" ( + x: "iifname { ${lanList}, \"tailscale0\" } tcp dport ${toString x} accept" + ) openPorts; + udpPortsString = lib.strings.concatMapStringsSep "\n" ( + x: "iifname { ${lanList}, \"tailscale0\" } udp dport ${toString x} accept" + ) openUDPPorts; + in + lib.strings.concatStringsSep "\n" [ + "table ip filter {" + " chain output {" + " type filter hook output priority 100; policy accept;" + " }" - " chain input {" - " type filter hook input priority 0; policy drop;" + " chain input {" + " type filter hook input priority 0; policy drop;" - " iifname lo accept" - portsString - udpPortsString - " iifname { ${lanList} } accept comment \"Allows LAN traffic and outgoing\"" - " iifname { ${wanName} } ct state { established, related } accept comment \"Allows existing connections\"" - " iifname { ${wanName} } icmp type { echo-request, destination-unreachable, time-exceeded } counter accept comment \"Allow some ICMP traffic\"" - " iifname { ${wanName} } counter drop comment \"Drop other incoming traffic, and count how much\"" - " }" - " chain forward {" - " type filter hook forward priority 0; policy drop;" - " iifname { ${allLan} } oifname { ${wanName} } accept comment \"Forward LAN to WAN\"" - " iifname { ${wanName} } oifname { ${allLan} } ct state established, related accept comment \"Allow incoming established traffic\"" - " }" - "}" + " iifname lo accept" + portsString + udpPortsString + " iifname { ${lanList} } accept comment \"Allows LAN traffic and outgoing\"" + " iifname { ${wanName} } ct state { established, related } accept comment \"Allows existing connections\"" + " iifname { ${wanName} } icmp type { echo-request, destination-unreachable, time-exceeded } counter accept comment \"Allow some ICMP traffic\"" + " iifname { ${wanName} } counter drop comment \"Drop other incoming traffic, and count how much\"" + " }" + " chain forward {" + " type filter hook forward priority 0; policy drop;" + " iifname { ${allLan} } oifname { ${wanName} } accept comment \"Forward LAN to WAN\"" + " iifname { ${wanName} } oifname { ${allLan} } ct state established, related accept comment \"Allow incoming established traffic\"" + " }" + "}" - "table ip nat {" - " chain postrouting {" - " type nat hook postrouting priority 100; policy accept;" - " oifname { ${wanName} } masquerade" - " }" - "}" + "table ip nat {" + " chain postrouting {" + " type nat hook postrouting priority 100; policy accept;" + " oifname { ${wanName} } masquerade" + " }" + "}" - "table ip6 filter {" - " chain input {" - " type filter hook input priority 0; policy drop;" - " }" - " chain forward {" - " type filter hook forward priority 0; policy drop;" - " }" - "}" - ]; - cfg = config.greg.router; + "table ip6 filter {" + " chain input {" + " type filter hook input priority 0; policy drop;" + " }" + " chain forward {" + " type filter hook forward priority 0; policy drop;" + " }" + "}" + ]; + cfg = config.greg.router; -in with lib; { - options.greg.router = { - enable = mkEnableOption "Enable NFTables and routing"; - wan = mkOption { - type = (types.listOf types.str); - description = "The name of the network interface that is the WAN connection"; - }; - lan = mkOption { - type = (types.listOf types.str); - description = "A list of all network interfaces that are considered LAN connections"; - }; - limited = mkOption { - type = (types.listOf types.str); - description = "A list of limited access LAN connections - such as IOT connections and similar."; - default = []; - }; - }; +in +with lib; +{ + options.greg.router = { + enable = mkEnableOption "Enable NFTables and routing"; + wan = mkOption { + type = (types.listOf types.str); + description = "The name of the network interface that is the WAN connection"; + }; + lan = mkOption { + type = (types.listOf types.str); + description = "A list of all network interfaces that are considered LAN connections"; + }; + limited = mkOption { + type = (types.listOf types.str); + description = "A list of limited access LAN connections - such as IOT connections and similar."; + default = [ ]; + }; + }; - config = mkIf cfg.enable { - networking.nftables = { - enable = true; - ruleset = (nftConfig { - inherit (cfg) lan wan; - openPorts = config.networking.firewall.allowedTCPPorts; - openUDPPorts = config.networking.firewall.allowedUDPPorts; - }); - }; + config = mkIf cfg.enable { + networking.nftables = { + enable = true; + ruleset = ( + nftConfig { + inherit (cfg) lan wan; + openPorts = config.networking.firewall.allowedTCPPorts; + openUDPPorts = config.networking.firewall.allowedUDPPorts; + } + ); + }; - environment.systemPackages = [ - pkgs.pciutils - pkgs.tcpdump - ]; - }; + environment.systemPackages = [ + pkgs.pciutils + pkgs.tcpdump + ]; + }; } diff --git a/modules/nixos/rpi4.nix b/modules/nixos/rpi4.nix index fd77bb8..832f0c2 100644 --- a/modules/nixos/rpi4.nix +++ b/modules/nixos/rpi4.nix @@ -1,43 +1,50 @@ -{ config, lib, pkgs, ... }: +{ + config, + lib, + pkgs, + ... +}: let - cfg = config.greg.rpi4; + cfg = config.greg.rpi4; -in with lib; { - options = { - greg.rpi4 = { - enable = mkEnableOption "Enable support for Raspberry Pi 4s"; - }; - }; +in +with lib; +{ + options = { + greg.rpi4 = { + enable = mkEnableOption "Enable support for Raspberry Pi 4s"; + }; + }; - config = mkIf cfg.enable { - boot = { - # This prevents us from having to compile our own kernel - kernelPackages = pkgs.linuxPackages_rpi4; - kernelParams = [ - "8250.nr_uarts=1" - "console=ttyAMA0,115200" - "console=tty1" - "cma=128M" - ]; + config = mkIf cfg.enable { + boot = { + # This prevents us from having to compile our own kernel + kernelPackages = pkgs.linuxPackages_rpi4; + kernelParams = [ + "8250.nr_uarts=1" + "console=ttyAMA0,115200" + "console=tty1" + "cma=128M" + ]; - loader = { - raspberryPi = { - enable = true; - version = 4; - }; + loader = { + raspberryPi = { + enable = true; + version = 4; + }; - # Use the extlinux boot loader. (NixOS wants to enable GRUB by default) - grub.enable = false; + # Use the extlinux boot loader. (NixOS wants to enable GRUB by default) + grub.enable = false; - # Enables the generation of /boot/extlinux/extlinux.conf - #generic-extlinux-compatible.enable = true; - }; - }; + # Enables the generation of /boot/extlinux/extlinux.conf + #generic-extlinux-compatible.enable = true; + }; + }; - environment.systemPackages = with pkgs; [ - raspberrypifw - usbutils - ]; - }; + environment.systemPackages = with pkgs; [ + raspberrypifw + usbutils + ]; + }; } diff --git a/modules/nixos/sway.nix b/modules/nixos/sway.nix index 221d037..6ab8e5d 100644 --- a/modules/nixos/sway.nix +++ b/modules/nixos/sway.nix @@ -1,42 +1,44 @@ -{ config, pkgs, lib, ... }: +{ config, lib, ... }: let - cfg = config.greg.sway; + cfg = config.greg.sway; -in with lib; { - options = { - greg.sway.enable = mkEnableOption "Enable my default Gnome3 setup"; - }; +in +with lib; +{ + options = { + greg.sway.enable = mkEnableOption "Enable my default Gnome3 setup"; + }; - config = mkIf cfg.enable { - services = { - accounts-daemon.enable = true; + config = mkIf cfg.enable { + services = { + accounts-daemon.enable = true; - pipewire = { - enable = true; - alsa.enable = true; - audio.enable = true; - jack.enable = true; - pulse.enable = true; - wireplumber.enable = true; - }; + pipewire = { + enable = true; + alsa.enable = true; + audio.enable = true; + jack.enable = true; + pulse.enable = true; + wireplumber.enable = true; + }; - xserver = { - enable = true; - displayManager.gdm = { - enable = true; - autoSuspend = false; - banner = "Welcome to Greg's JUDE machine. Do I know you?"; - wayland = true; - }; - xkb.layout = "us"; - }; - }; + xserver = { + enable = true; + displayManager.gdm = { + enable = true; + autoSuspend = false; + banner = "Welcome to Greg's JUDE machine. Do I know you?"; + wayland = true; + }; + xkb.layout = "us"; + }; + }; - programs.sway = { - enable = true; # Will be enabled through home-manager - wrapperFeatures.gtk = true; - }; - security.pam.services.swaylock = {}; - }; + programs.sway = { + enable = true; # Will be enabled through home-manager + wrapperFeatures.gtk = true; + }; + security.pam.services.swaylock = { }; + }; } diff --git a/modules/nixos/syncthing.nix b/modules/nixos/syncthing.nix index d259516..25f390d 100644 --- a/modules/nixos/syncthing.nix +++ b/modules/nixos/syncthing.nix @@ -1,29 +1,31 @@ -{ config, lib, pkgs, ... }: +{ config, lib, ... }: let - cfg = config.greg.syncthing; -in with lib; { - options.greg.syncthing = { - enable = mkEnableOption "Setup my personal minimal configuration for Syncthing"; - }; + cfg = config.greg.syncthing; +in +with lib; +{ + options.greg.syncthing = { + enable = mkEnableOption "Setup my personal minimal configuration for Syncthing"; + }; - config = mkIf cfg.enable { - services.syncthing = { - enable = true; - overrideFolders = true; - overrideDevices = true; - settings = { - devices = { - chronicles.id = "7FI6Y3M-C7YQEDI-IB345L6-RKLXMB6-AEIV57Y-3J2RCXQ-MK6QRNK-EINPXAE"; - genesis.id = "YDTH4SD-GUAC5AA-SSYWYPZ-YMJW5LK-LE7PZKJ-GV2UJFZ-CU7LZAD-GTYWCQK"; - gitlab.id = "VAG5GHP-L7TNY7O-CHR3CKU-GXXVCIL-OT3WHHU-E4VAIZC-JI4BKOM-PYZQOQS"; - linode.id = "IJMMXPR-WNALZBD-FMJH5W5-WV7XGJY-HLJTKGT-5TKHJIH-75LT56D-UUZCYQE"; - matrix.id = "K5IHM3I-TJFFEW5-GAYJMPS-CYSHW5C-XHMC462-MFRMOHJ-EJLKIKC-CZHGJQ2"; - }; - options = { - urAccepted = -1; - }; - }; - }; - }; + config = mkIf cfg.enable { + services.syncthing = { + enable = true; + overrideFolders = true; + overrideDevices = true; + settings = { + devices = { + chronicles.id = "7FI6Y3M-C7YQEDI-IB345L6-RKLXMB6-AEIV57Y-3J2RCXQ-MK6QRNK-EINPXAE"; + genesis.id = "YDTH4SD-GUAC5AA-SSYWYPZ-YMJW5LK-LE7PZKJ-GV2UJFZ-CU7LZAD-GTYWCQK"; + gitlab.id = "VAG5GHP-L7TNY7O-CHR3CKU-GXXVCIL-OT3WHHU-E4VAIZC-JI4BKOM-PYZQOQS"; + linode.id = "IJMMXPR-WNALZBD-FMJH5W5-WV7XGJY-HLJTKGT-5TKHJIH-75LT56D-UUZCYQE"; + matrix.id = "K5IHM3I-TJFFEW5-GAYJMPS-CYSHW5C-XHMC462-MFRMOHJ-EJLKIKC-CZHGJQ2"; + }; + options = { + urAccepted = -1; + }; + }; + }; + }; } diff --git a/modules/nixos/tailscale.nix b/modules/nixos/tailscale.nix index b446c9f..046bc48 100644 --- a/modules/nixos/tailscale.nix +++ b/modules/nixos/tailscale.nix @@ -1,18 +1,20 @@ { lib, config, ... }: let - cfg = config.greg.tailscale; -in { - options = { - greg.tailscale.enable = lib.mkEnableOption "Enable Tailscale"; - }; + cfg = config.greg.tailscale; +in +{ + options = { + greg.tailscale.enable = lib.mkEnableOption "Enable Tailscale"; + }; - config = lib.mkIf cfg.enable { - services.tailscale.enable = true; - networking.firewall.checkReversePath = "loose"; - boot.kernel.sysctl = { - "net.ipv4.ip_forward" = "1"; - "net.ipv6.conf.all.forwarding" = "1"; - }; - }; + config = lib.mkIf cfg.enable { + services.tailscale.enable = true; + networking.firewall.checkReversePath = "loose"; + boot.kernel.sysctl = { + "net.ipv4.ip_forward" = "1"; + "net.ipv6.conf.all.forwarding" = "1"; + }; + systemd.services.tailscaled.partOf = [ "network-online.target" ]; + }; } diff --git a/modules/nixos/vmdev.nix b/modules/nixos/vmdev.nix index 0b28137..1584bba 100644 --- a/modules/nixos/vmdev.nix +++ b/modules/nixos/vmdev.nix @@ -1,74 +1,81 @@ -{ pkgs, lib, config, ... }: +{ + pkgs, + lib, + config, + ... +}: let - cfg = config.greg.vmdev; -in with lib; + cfg = config.greg.vmdev; +in +with lib; { - options = { - greg.vmdev = { - enable = mkEnableOption "Enable this system for VM development work"; - user = mkOption { - default = "greg"; - type = types.str; - description = "The user who will be doing VM dev"; - }; - system = mkOption { - default = "amd"; - type = types.str; - description = "Kernel module type to install - amd, intel, etc"; - }; - }; - }; + options = { + greg.vmdev = { + enable = mkEnableOption "Enable this system for VM development work"; + user = mkOption { + default = "greg"; + type = types.str; + description = "The user who will be doing VM dev"; + }; + system = mkOption { + default = "amd"; + type = types.str; + description = "Kernel module type to install - amd, intel, etc"; + }; + }; + }; - config = mkIf cfg.enable { - environment.systemPackages = with pkgs; [ - dmidecode - guestfs-tools - libguestfs - OVMFFull - packer - virt-manager - xorriso - ]; + config = mkIf cfg.enable { + environment.systemPackages = with pkgs; [ + dmidecode + #guestfs-tools + libguestfs + OVMFFull + packer + virt-manager + xorriso + ]; - users.users."${cfg.user}".extraGroups = [ "libvirtd" ]; + users.users."${cfg.user}".extraGroups = [ "libvirtd" ]; - # Enable the virtualisation services - virtualisation = { - libvirtd = { - enable = true; - onBoot = "ignore"; # Do not auto-restart VMs on boot, unless they are marked autostart - qemu.ovmf.enable = true; - }; + # Enable the virtualisation services + virtualisation = { + libvirtd = { + enable = true; + onBoot = "ignore"; # Do not auto-restart VMs on boot, unless they are marked autostart + qemu.ovmf.enable = true; + }; - virtualbox.host = { - enable = true; - enableExtensionPack = true; - }; - }; + virtualbox.host = { + enable = true; + enableExtensionPack = true; + }; + }; - # Configuration for vbox user performance - users.extraGroups.vboxusers.members = [ cfg.user ]; + # Configuration for vbox user performance + users.extraGroups.vboxusers.members = [ cfg.user ]; - boot.extraModprobeConfig = "options kvm_${cfg.system} nested=1"; + boot.extraModprobeConfig = "options kvm_${cfg.system} nested=1"; - # Configure the services more - systemd.services = { - libvirtd = { - preStart = "${pkgs.kmod}/bin/modprobe kvm_${cfg.system}"; - postStop = "${pkgs.kmod}/bin/rmmod kvm_${cfg.system} kvm"; - conflicts = [ "vbox.service" ]; - }; - vbox = { - preStart = "${pkgs.kmod}/bin/modprobe vboxdrv vboxnetadp vboxnetflt"; - postStop = "${pkgs.kmod}/bin/rmmod vboxnetadp vboxnetflt vboxdrv"; - script = "echo Started"; - conflicts = [ "libvirtd.service" ]; - unitConfig = { - Type = "oneshot"; - RemainAfterExit = "yes"; - }; - }; - }; - }; + # Configure the services more + systemd.services = { + libvirtd = { + preStart = "${pkgs.kmod}/bin/modprobe kvm_${cfg.system}"; + postStop = "${pkgs.kmod}/bin/rmmod kvm_${cfg.system} kvm"; + conflicts = [ "vbox.service" ]; + #overrideStrategy = "asDropin"; + }; + vbox = { + preStart = "${pkgs.kmod}/bin/modprobe vboxdrv vboxnetadp vboxnetflt"; + postStop = "${pkgs.kmod}/bin/rmmod vboxnetadp vboxnetflt vboxdrv"; + script = "echo Started"; + conflicts = [ "libvirtd.service" ]; + unitConfig = { + Type = "oneshot"; + RemainAfterExit = "yes"; + }; + }; + }; + }; } diff --git a/overlays/aacs.nix b/overlays/aacs.nix deleted file mode 100644 index cf123a6..0000000 --- a/overlays/aacs.nix +++ /dev/null @@ -1,10 +0,0 @@ -{ pkgs, ... }: - -pkgs.writeShellScriptBin "aacs" '' -set -ex -[ ! -d "''${HOME}/.config/aacs" ] && mkdir -p "''${HOME}/.config/aacs" -cd "''${HOME}/.config/aacs" -[ -f KEYDB.cfg.zip ] && rm -f KEYDB.cfg.zip -curl -L -o KEYDB.cfg.zip "http://fvonline-db.bplaced.net/fv_download.php?lang=eng" -${pkgs.unzip}/bin/unzip KEYDB.cfg.zip -mv keydb.cfg KEYDB.cfg'' diff --git a/overlays/create_ssl.nix b/overlays/create_ssl.nix deleted file mode 100644 index a593d17..0000000 --- a/overlays/create_ssl.nix +++ /dev/null @@ -1,28 +0,0 @@ -{ writeShellScriptBin, openssl, ...}: - -writeShellScriptBin "create_ssl" '' -set -e -o pipefail -name="''${1}" -root_key="''${2}" - -function usage { - echo "USAGE: create_ssl " -} - -if [ -z "''${name}" ]; then - usage - exit 1 -fi - -if [ -z "''${root_key}" ]; then - usage - exit 1 -fi - -# Create the certificate key -${openssl}/bin/openssl ecparam -out "''${name}.key" -name prime256v1 -genkey -# Create the CSR -${openssl}/bin/openssl req -name -sha256 -key "''${name}.key" -out "''${name}.csr" -# Sign it -${openssl}/bin/openssl x509 -req -in "''${name}.csr" -CA "''${root_key}.crt" -CAkey "''${root_key}.key" -CAcreateserial -out "''${name}.crt" -days 3650 -sha256 -'' diff --git a/overlays/default.nix b/overlays/default.nix index 9a7297c..830ec23 100644 --- a/overlays/default.nix +++ b/overlays/default.nix @@ -1,82 +1,48 @@ -final: prev: +_final: prev: let - myPackages = pypackages: with pypackages; [ - black - dateutil - flake8 - ipython - jedi - jedi-language-server - mypy - pylint - pyyaml - responses - ruamel-yaml - tox - typing-extensions - virtualenv - ]; + myPackages = + pypackages: with pypackages; [ + black + dateutil + ipython + mypy + pylint + pyyaml + responses + ruamel-yaml + tox + typing-extensions + virtualenv + ]; - myPython = prev.python312.withPackages myPackages; - macOver = file: og: - if prev.stdenv.isDarwin then - (prev.callPackage file {}) else - prev."${og}"; + myPython = prev.python312.withPackages myPackages; - buildFirefoxXpiAddon = final.nur.repos.rycee.lib.buildFirefoxXpiAddon; +in +rec { + gregpy = myPython; - is2405 = prev.lib.versionAtLeast prev.lib.version "24"; + ## Testing adding python packages in the correct manner + pythonPackagesExtensions = (prev.pythonPackagesExtensions or [ ]) ++ [ + ( + python-final: _: + let + cp = python-final.callPackage; + in + { + xonsh-apipenv = cp ./xonsh-apipenv.nix { }; + } + ) + ]; -in rec { - gregpy = myPython; + # My own packages + enwiki-dump = prev.callPackage ./enwiki-dump.nix { }; - ## Testing adding python packages in the correct manner - pythonPackagesExtensions = (prev.pythonPackagesExtensions or []) ++ [ - (python-final: python-prev: let cp = python-final.callPackage; in { - django-rapyd-modernauth = cp ./django-rapyd-modernauth.nix {}; - graypy = cp ./graypy.nix {}; - itg-django-utils = cp ./itg-django-utils.nix {}; - xonsh-apipenv = cp ./xonsh-apipenv.nix {}; - }) - ]; - - # My own packages - aacs = prev.callPackage ./aacs.nix {}; - create_ssl = prev.callPackage ./create_ssl.nix {}; - enwiki-dump = prev.callPackage ./enwiki-dump.nix {}; - hms = prev.callPackage ./hms { - pkgs = final.pkgs; - }; - inject = prev.callPackage ./inject.nix { inherit (final) pkgs; }; - inject-darwin = prev.callPackage ./inject-darwin.nix { inherit (final) pkgs; }; - setup-ssh = prev.callPackage ./setup-ssh { - pkgs = final.pkgs; - }; - upgrade-pg-cluster = prev.callPackage ./upgrade-pg-cluster.nix {}; - - # Overrides of packages - brew = prev.callPackage ./homebrew.nix {}; - copier = (if is2405 then prev.copier.overridePythonAttrs (old: { - version = "9.1.0"; - src = final.fetchFromGitHub { - owner = "copier-org"; - repo = "copier"; - rev = "v9.1.0"; - hash = "sha256-x5r7Xv4lAOMkR+UIEeSY7LvbYMLpTWYuICYe9ygz1tA="; - postFetch = "rm $out/tests/demo/doc/ma*ana.txt"; - }; - }) else prev.copier); - libbluray-custom = prev.libbluray.override { - withAACS = true; - withBDplus = true; - }; - template = prev.callPackage ./template.nix { }; - handbrake = prev.handbrake.override { - libbluray = libbluray-custom; - }; - libvirt-greg = prev.libvirt.overrideAttrs { - postInstall = prev.libvirt.postInstall + "rm -r $out/lib/systemd/system/libvirtd.service"; - }; - pipenv-ivr = prev.callPackage ./pipenv.nix { }; + # Overrides of packages + libbluray-custom = prev.libbluray.override { + withAACS = true; + withBDplus = true; + }; + handbrake = prev.handbrake.override { libbluray = libbluray-custom; }; + pipenv-ivr = prev.callPackage ./pipenv.nix { }; } diff --git a/overlays/django-rapyd-modernauth.nix b/overlays/django-rapyd-modernauth.nix deleted file mode 100644 index 8f7eec2..0000000 --- a/overlays/django-rapyd-modernauth.nix +++ /dev/null @@ -1,55 +0,0 @@ -{ - lib, - buildPythonPackage, - fetchPypi, - - click, - django, - python-dotenv, - pytz, - setuptools, - sqlparse, - zipp -}: - -let - pydeps = pypkgs: with pypkgs; [ - click - django - python-dotenv - pytz - setuptools - sqlparse - zipp - ]; -in buildPythonPackage rec { - pname = "django-rapyd-modernauth"; - version = "0.0.4"; - - src = fetchPypi { - inherit pname version; - sha256 = "sha256-kDZjI32LcKsmLI38ruINKOUfi6lWTIqXF5qIQHi0LeQ="; - }; - - meta = with lib; { - description = "A Django application that provides a custom User model where the username is the email address."; - homepage = "https://github.com/karthicraghupathi/django_rapyd_modernauth"; - license = licenses.afl20; - maintainers = []; - }; - - doCheck = false; - - buildInputs = [ - click - django - python-dotenv - pytz - setuptools - sqlparse - zipp - ]; - - nativeBuildInputs = [ - ]; -} diff --git a/overlays/enwiki-dump.nix b/overlays/enwiki-dump.nix index 80f9aaf..a17ef32 100644 --- a/overlays/enwiki-dump.nix +++ b/overlays/enwiki-dump.nix @@ -1,55 +1,56 @@ { pkgs, ... }: let - version = "2022.07.20"; - date = builtins.replaceStrings ["."] [""] version; + version = "2022.07.20"; + date = builtins.replaceStrings [ "." ] [ "" ] version; -in pkgs.writeShellScriptBin "wiki-data" '' -set -eo pipefail +in +pkgs.writeShellScriptBin "wiki-data" '' + set -eo pipefail -function process_file { - file="''${lang}''${1}" - destfile=/var/tmp/''${file} - curl -C - -o "''${destfile}" "https://dumps.wikimedia.your.org/''${lang}wiki/${date}/''${file}" - bzcat "''${destfile}" | ${pkgs.php}/bin/php ${pkgs.mediawiki}/share/mediawiki/maintenance/importDump.php --report 500 | tee "/var/log/mediawiki-''${lang}-import" - rm "''${destfile}" -} + function process_file { + file="''${lang}''${1}" + destfile=/var/tmp/''${file} + curl -C - -o "''${destfile}" "https://dumps.wikimedia.your.org/''${lang}wiki/${date}/''${file}" + bzcat "''${destfile}" | ${pkgs.php}/bin/php ${pkgs.mediawiki}/share/mediawiki/maintenance/importDump.php --report 500 | tee "/var/log/mediawiki-''${lang}-import" + rm "''${destfile}" + } -function zim_fetch { - dest="/srv/zims" - mkdir -p "''${dest}" - file="''${1}" - echo "Downloading ''${file}" - transmission-remote -w "''${dest}" -a https://download.kiwix.org/zim/''${file}.zim.torrent -} + function zim_fetch { + dest="/srv/zims" + mkdir -p "''${dest}" + file="''${1}" + echo "Downloading ''${file}" + transmission-remote -w "''${dest}" -a https://download.kiwix.org/zim/''${file}.zim.torrent + } -#process_file "wiki-${date}-pages-articles-multistream.xml.bz2" -#process_file "wiki-${date}-pages-meta-current.xml.bz2" -#process_file "wiki-${date}-pages-articles.xml.bz2" + #process_file "wiki-${date}-pages-articles-multistream.xml.bz2" + #process_file "wiki-${date}-pages-meta-current.xml.bz2" + #process_file "wiki-${date}-pages-articles.xml.bz2" -zim_fetch wikipedia_en_all_maxi -zim_fetch wikipedia_fr_all_maxi -zim_fetch wikipedia_ht_all_maxi + zim_fetch wikipedia_en_all_maxi + zim_fetch wikipedia_fr_all_maxi + zim_fetch wikipedia_ht_all_maxi -zim_fetch wiktionary_en_all_maxi -zim_fetch wiktionary_fr_all_maxi + zim_fetch wiktionary_en_all_maxi + zim_fetch wiktionary_fr_all_maxi -zim_fetch wikiversity_en_all_maxi -zim_fetch wikiversity_fr_all_maxi + zim_fetch wikiversity_en_all_maxi + zim_fetch wikiversity_fr_all_maxi -zim_fetch wikibooks_en_all_maxi -zim_fetch wikibooks_fr_all_maxi + zim_fetch wikibooks_en_all_maxi + zim_fetch wikibooks_fr_all_maxi -zim_fetch wikisource_en_all_maxi -zim_fetch wikisource_fr_all_maxi + zim_fetch wikisource_en_all_maxi + zim_fetch wikisource_fr_all_maxi -zim_fetch ted_en_science -zim_fetch ted_en_technology + zim_fetch ted_en_science + zim_fetch ted_en_technology -zim_fetch phet_en -zim_fetch phet_fr -zim_fetch phet_ht + zim_fetch phet_en + zim_fetch phet_fr + zim_fetch phet_ht -zim_fetch gutenberg_en_all -zim_fetch gutenberg_fr_all + zim_fetch gutenberg_en_all + zim_fetch gutenberg_fr_all '' diff --git a/overlays/graypy.nix b/overlays/graypy.nix deleted file mode 100644 index 2cce63e..0000000 --- a/overlays/graypy.nix +++ /dev/null @@ -1,35 +0,0 @@ -{ - lib, - buildPythonPackage, - fetchFromGitHub, - - amqplib, - mock, - pytestCheckHook, - requests, -}: - -buildPythonPackage rec { - pname = "graypy"; - version = "2.1.0"; - - src = fetchFromGitHub { - owner = "severb"; - repo = "graypy"; - rev = "2.1.0"; - hash = "sha256-y1HbJEpqnAgOeB+zXKy3iUT6Lpv0bufjL7+jWUSAjFs="; - }; - - nativeCheckInputs = [ - amqplib - mock - pytestCheckHook - requests - ]; - - meta = with lib; { - description = "Python logging handlers that send messages in the Graylog Extended Log Format (GELF)."; - homepage = "https://github.com/severb/graypy"; - license = licenses.bsd3; - }; -} diff --git a/overlays/hms/default.nix b/overlays/hms/default.nix deleted file mode 100644 index 385661f..0000000 --- a/overlays/hms/default.nix +++ /dev/null @@ -1,3 +0,0 @@ -{ pkgs, ... }: - -pkgs.writeShellScriptBin "hms" (builtins.readFile ./hms.sh) diff --git a/overlays/homebrew.nix b/overlays/homebrew.nix deleted file mode 100644 index 932a9d8..0000000 --- a/overlays/homebrew.nix +++ /dev/null @@ -1,43 +0,0 @@ -{ -lib, -pkgs, -stdenv, - -bash, -curl, -git, -ruby, -...}: - -stdenv.mkDerivation rec { - pname = "homebrew-installer"; - version = "20230531"; - - src = pkgs.fetchFromGitHub { - owner = "Homebrew"; - repo = "install"; - rev = "716a1d024f32890ef75ea82c18a769abc24e9475"; - sha256 = "sha256-xhxWWeCJm49bDzmBT2GHSC0CK1SoQArBhfh5sltGY5o="; - }; - - buildInputs = [ - bash - curl - git - ruby - ]; - - installPhase = '' - mkdir -p $out/bin/ - cp ${src}/install.sh $out/bin/install-homebrew.sh - cp ${src}/uninstall.sh $out/bin/uninstall-homebrew.sh - ''; - - meta = with lib; { - description = "Runs the homebrew installer"; - homepage = "https://github.com/Homebrew/"; - license = licenses.bsd2; - platforms = [ "aarch64-darwin" "x86_64-darwin" "x86_64-linux" "aarch64-linux" ]; - maintainers = [ maintainers.greg ]; - }; -} diff --git a/overlays/inject-darwin.nix b/overlays/inject-darwin.nix deleted file mode 100644 index baf6a45..0000000 --- a/overlays/inject-darwin.nix +++ /dev/null @@ -1,32 +0,0 @@ -{ - pkgs, - coreutils, - curl, - gnutar, - nix, - ... -}: -pkgs.writeShellScriptBin "inject-darwin" '' -set -ex -set -o pipefail - -dir="$(${coreutils}/bin/mktemp -d)" -cd "''${dir}" - -# Install nix-darwin -${nix}/bin/nix-build https://github.com/LnL7/nix-darwin/archive/master.tar.gz -A installer -./result/bin/darwin-installer - -# Get my configuration -mkdir -p ~/.config/darwin -cd ~/.config/darwin -${curl}/bin/curl -O -L https://github.com/greg-hellings/nixos-config/archive/refs/heads/main.tar.gz -${gnutar}/bin/tar xvzf main.tar.gz --strip-components 1 - -# Build NixOS for this system -pushd "''${dir}" -${nix}/bin/nix build "~/.config/darwin#darwinConfigurations.$(hostname -s).system" -./result/sw/bin/darwin-rebuild switch --flake ~/.config/darwin -popd -rm -r "''${dir}" -'' diff --git a/overlays/inject.nix b/overlays/inject.nix deleted file mode 100644 index 04f648e..0000000 --- a/overlays/inject.nix +++ /dev/null @@ -1,56 +0,0 @@ -{ - pkgs, - git, - ... -}: - -pkgs.writeShellScriptBin "inject-nixos-config" '' -hostname="''${1}" -if [ -n "''${hostname}"]; then - echo "You must provide a hostname"; - exit 1; -fi - -mv /etc/nixos /etc/nixos.bk -cd /etc -${git}/bin/git clone http://github.com/greg-hellings/nixos-config nixos -mkdir -p "/etc/nixos/hosts/''${hostname}" - -# Prepares everything for the flake usage -#cp /etc/nixos.bk/configuration.nix "/etc/nixos/hosts/''${hostname}/default.nix" -cat << EOF > "/etc/nixos/hosts/''${hostname}/default.nix" -{ pkgs, config, ... }: - -{ - imports = [ ./hardware-configuration.nix ]; - - boot.loader = { - systemd-boot.enable = true; - efi.canTouchEfiVariables = true; - }; - - networking.hostName = "''${hostname}"; - greg = { - home = true; - tailscale.enable = true; - }; -} -EOF -cp /etc/nixos.bk/hardware-configuration.nix "/etc/nixos/hosts/''${hostname}/hardware-configuration.nix" - -# Prepare home-manager portion for setup -mkdir -p "/etc/nixos/home/hosts/''${hostname}" -cat << EOF > "/etc/nixos/home/hosts/''${hostname}/default.nix" -{ pkgs, config, ... }: - -{ -} -EOF - -# Prepares it for injecting the use case into the flake usage -cp /etc/nixos.bk/hardware-configuration.nix /etc/nixos -chown -R greg nixos - -echo "Now you should be able to just run `nixos-rebuild switch` to enable the flake functionality" -echo "After that and adding the entry to the flake, run `nixos-rebuild boot --flake '.#''${hostname}'` and reboot" -'' diff --git a/overlays/itg-django-utils.nix b/overlays/itg-django-utils.nix deleted file mode 100644 index 0a4f712..0000000 --- a/overlays/itg-django-utils.nix +++ /dev/null @@ -1,35 +0,0 @@ -{ - lib, - buildPythonPackage, - fetchurl, - - django, - djangorestframework, - graypy, - setuptools, -}: - -buildPythonPackage rec { - pname = "itg-django-utils"; - version = "0.1.11"; - - src = fetchurl { - url = "https://pypi.ivrtechnology.com/packages/itg-django-utils-0.1.12.tar.gz"; - hash = "sha256-LbOl4L4UZbRTlLuBL4L3ser6+WDuP3R5a03EIh1xSK8="; - }; - - propagatedBuildInputs = [ - django - djangorestframework - graypy - setuptools - ]; - - meta = with lib; { - description = "ITG specific stuff"; - homepage = "http://www.ivrtechnology.com"; - maintainers = []; - }; - - doCheck = false; -} diff --git a/overlays/packages.nix b/overlays/packages.nix deleted file mode 100644 index 09f4baf..0000000 --- a/overlays/packages.nix +++ /dev/null @@ -1,26 +0,0 @@ -{ nixunstable, flake-utils }: - -flake-utils.lib.eachDefaultSystemMap (system: - let - pkgs = (import nixunstable { inherit system; }); - lib = pkgs.lib; - callPackage = pkgs.lib.callPackageWith pkgs; - python = pkgs.packages.python3; - cp = pkgs.packages.python3.pkgs.callPackage; - in { - hms = pkgs.callPackage ./hms.nix { - inherit pkgs; - }; - - brew = pkgs.callPackage ./homebrew.nix {}; - - django-rapyd-modernauth = pkgs.python3.pkgs.callPackage ./django-rapyd-modernauth.nix { - buildPythonPackage = pkgs.python3.pkgs.buildPythonPackage; - }; - - xonsh-direnv = pkgs.callPackage ./xonsh-direnv.nix { - buildPythonPackage = pkgs.python3.pkgs.buildPythonPackage; - fetchPypi = pkgs.python.pkgs.fetchPypi; - }; - } -) diff --git a/overlays/pipenv.nix b/overlays/pipenv.nix index 6f129ab..ea06e4c 100644 --- a/overlays/pipenv.nix +++ b/overlays/pipenv.nix @@ -1,28 +1,31 @@ -{ lib -, stdenv -, python3 -, fetchFromGitHub -, installShellFiles +{ + lib, + stdenv, + python3, + fetchFromGitHub, + installShellFiles, }: with python3.pkgs; let - runtimeDeps = ps: with ps; [ - certifi - setuptools - pip - virtualenv - virtualenv-clone - ] - ++ lib.optionals stdenv.hostPlatform.isAndroid [ - pyjnius - ]; + runtimeDeps = + ps: + with ps; + [ + certifi + setuptools + pip + virtualenv + virtualenv-clone + ] + ++ lib.optionals stdenv.hostPlatform.isAndroid [ pyjnius ]; pythonEnv = python3.withPackages runtimeDeps; -in buildPythonApplication rec { +in +buildPythonApplication rec { pname = "pipenv"; version = "2023.11.15"; format = "pyproject"; @@ -70,9 +73,7 @@ in buildPythonApplication rec { "test_download_file" ]; - disabledTestPaths = [ - "tests/integration" - ]; + disabledTestPaths = [ "tests/integration" ]; postInstall = '' installShellCompletion --cmd pipenv \ diff --git a/overlays/setup-ssh/default.nix b/overlays/setup-ssh/default.nix deleted file mode 100644 index 511b615..0000000 --- a/overlays/setup-ssh/default.nix +++ /dev/null @@ -1,3 +0,0 @@ -{ pkgs, gh, ... }: - -pkgs.writeShellScriptBin "setup-ssh" (builtins.replaceStrings ["gh "] ["${gh}/bin/gh "] (builtins.readFile ./setup-ssh.sh)) diff --git a/overlays/template.nix b/overlays/template.nix deleted file mode 100644 index e4bfcde..0000000 --- a/overlays/template.nix +++ /dev/null @@ -1,15 +0,0 @@ -{ stdenv, jinja2-cli }: - -name: vars: template: -(stdenv.mkDerivation { - inherit name; - - passAsFile = [ "varsData" ]; - varsData = builtins.toJSON vars; - - nativeBuildInputs = [ jinja2-cli ]; - phases = [ "buildPhase" "installPhase" ]; - - buildPhase = ''${jinja2-cli}/bin/jinja2 --format=json ${template} $varsDataPath > result''; - installPhase = "cp result $out"; -}) diff --git a/overlays/upgrade-pg-cluster.nix b/overlays/upgrade-pg-cluster.nix deleted file mode 100644 index b8d5e22..0000000 --- a/overlays/upgrade-pg-cluster.nix +++ /dev/null @@ -1,24 +0,0 @@ -{ postgresql_15, postgresql_16, writeScriptBin, ... }: - -let - newPostgres = postgresql_16; - oldPostgres = postgresql_15; -in writeScriptBin "upgrade-pg-cluster" '' - set -eux - systemctl stop postgresql - - export NEWDATA="/var/lib/postgresql/${newPostgres.psqlSchema}" - export NEWBIN="${newPostgres}/bin" - - export OLDDATA="/var/lib/postgresql/${oldPostgres.psqlSchema}" - export OLDBIN="${oldPostgres}/bin" - - install -d -m 0700 -o postgres -g postgres "$NEWDATA" - cd "$NEWDATA" - sudo -u postgres "$NEWBIN/initdb" -D "$NEWDATA" - - sudo -u postgres "$NEWBIN/pg_upgrade" \ - --old-datadir "$OLDDATA" --new-datadir "$NEWDATA" \ - --old-bindir "$OLDBIN" --new-bindir "$NEWBIN" \ - "$@" -'' diff --git a/overlays/xonsh-apipenv.nix b/overlays/xonsh-apipenv.nix index 7d6a667..97ad9e9 100644 --- a/overlays/xonsh-apipenv.nix +++ b/overlays/xonsh-apipenv.nix @@ -1,34 +1,30 @@ { - lib, - buildPythonPackage, - fetchFromGitHub, - pipenv, + lib, + buildPythonPackage, + fetchFromGitHub, + toPythonModule, + pipenv, }: buildPythonPackage rec { - pname = "xonsh-apipenv"; - version = "0.4.0"; + pname = "xonsh-apipenv"; + version = "0.5.0"; - src = fetchFromGitHub { - owner = "deeuu"; - repo = "xontrib-apipenv"; - rev = "0.4.0"; - sha256 = "sha256-uFn3kF7P4wykd72XkQx6cPWLhBOh2SDQBcI3Idc2rFM="; - }; + src = fetchFromGitHub { + owner = "greg-hellings"; + repo = "xontrib-apipenv"; + rev = "0.5.0"; + hash = "sha256-QJatIiIP1YVT8M5vLUPHmf/8CGZ34cXMBXQmfSgY5C4="; + }; - meta = with lib; { - description = "Auto pipenv support for Xonsh"; - homepage = "https://github.com/deeuu/xontrib-apipenv"; - license = licenses.mit; - maintainers = []; - }; + doCheck = false; - doCheck = false; + dependencies = [ (toPythonModule pipenv) ]; - dependencies = [ - pipenv - ]; - - nativeBuildInputs = [ - ]; + meta = with lib; { + description = "Auto pipenv support for Xonsh"; + homepage = "https://github.com/greg-hellings/xontrib-apipenv"; + license = licenses.mit; + maintainers = [ ]; + }; } diff --git a/pkgs/aacs.nix b/pkgs/aacs.nix new file mode 100644 index 0000000..2d9a7f9 --- /dev/null +++ b/pkgs/aacs.nix @@ -0,0 +1,14 @@ +{ writeShellApplication, unzip, ... }: + +writeShellApplication { + name = "aacs"; + runtimeInputs = [ unzip ]; + text = '' + [ ! -d "''${HOME}/.config/aacs" ] && mkdir -p "''${HOME}/.config/aacs" + cd "''${HOME}/.config/aacs" + [ -f KEYDB.cfg.zip ] && rm -f KEYDB.cfg.zip + curl -L -o KEYDB.cfg.zip "http://fvonline-db.bplaced.net/fv_download.php?lang=eng" + unzip KEYDB.cfg.zip + mv keydb.cfg KEYDB.config + ''; +} diff --git a/pkgs/create_ssl.nix b/pkgs/create_ssl.nix new file mode 100644 index 0000000..3fba59d --- /dev/null +++ b/pkgs/create_ssl.nix @@ -0,0 +1,32 @@ +{ writeShellApplication, openssl, ... }: + +writeShellApplication { + name = "create_ssl"; + runtimeInputs = [ openssl ]; + text = '' + set -e -o pipefail + name="''${1}" + root_key="''${2}" + + function usage { + echo "USAGE: create_ssl " + } + + if [ -z "''${name}" ]; then + usage + exit 1 + fi + + if [ -z "''${root_key}" ]; then + usage + exit 1 + fi + + # Create the certificate key + openssl ecparam -out "''${name}.key" -name prime256v1 -genkey + # Create the CSR + openssl req -name -sha256 -key "''${name}.key" -out "''${name}.csr" + # Sign it + openssl x509 -req -in "''${name}.csr" -CA "''${root_key}.crt" -CAkey "''${root_key}.key" -CAcreateserial -out "''${name}.crt" -days 3650 -sha256 + ''; +} diff --git a/pkgs/default.nix b/pkgs/default.nix new file mode 100644 index 0000000..33a175a --- /dev/null +++ b/pkgs/default.nix @@ -0,0 +1,21 @@ +{ pkgs, ... }: + +let + c = pkgs.callPackage; +in +{ + packages = { + #default = iso; + #iso = top.self.nixosConfigurations.iso.config.system.build.isoImage; + #iso-beta = self.nixosConfigurations.iso-beta.config.system.build.isoImage; + aacs = c ./aacs.nix { }; + brew = c ./homebrew.nix { }; + create_ssl = c ./create_ssl.nix { }; + inject-darwin = c ./inject-darwin.nix { }; + inject = c ./inject.nix { }; + hms = c ./hms { }; + setup-ssh = c ./setup-ssh { }; + upgrade-pg-cluster = c ./upgrade-pg-cluster.nix { }; + zim = c ./zim.nix { }; + }; +} diff --git a/pkgs/hms/default.nix b/pkgs/hms/default.nix new file mode 100644 index 0000000..7662e58 --- /dev/null +++ b/pkgs/hms/default.nix @@ -0,0 +1,3 @@ +{ writeShellScriptBin, ... }: + +writeShellScriptBin "hms" (builtins.readFile ./hms.sh) diff --git a/overlays/hms/hms.sh b/pkgs/hms/hms.sh similarity index 75% rename from overlays/hms/hms.sh rename to pkgs/hms/hms.sh index 2d45713..f1787de 100644 --- a/overlays/hms/hms.sh +++ b/pkgs/hms/hms.sh @@ -1,5 +1,4 @@ # vim: set ft=bash: -set -eo pipefail # Build different targets with GUI or not # Build and switch @@ -8,7 +7,7 @@ src="${HOME}/.config/nix" echo "Building ${user}" dest=$(mktemp -d) pushd "${dest}" > /dev/null -nix build "${src}#homeConfigurations.\"${user}\".activationPackage" +nom build "${src}#homeConfigurations.\"${user}\".activationPackage" ./result/activate popd > /dev/null rm -r "${dest}" diff --git a/pkgs/homebrew.nix b/pkgs/homebrew.nix new file mode 100644 index 0000000..2cb63b6 --- /dev/null +++ b/pkgs/homebrew.nix @@ -0,0 +1,48 @@ +{ + lib, + fetchFromGitHub, + stdenv, + bash, + curl, + git, + ruby, + ... +}: + +stdenv.mkDerivation rec { + pname = "homebrew-installer"; + version = "20230531"; + + src = fetchFromGitHub { + owner = "Homebrew"; + repo = "install"; + rev = "716a1d024f32890ef75ea82c18a769abc24e9475"; + sha256 = "sha256-xhxWWeCJm49bDzmBT2GHSC0CK1SoQArBhfh5sltGY5o="; + }; + + buildInputs = [ + bash + curl + git + ruby + ]; + + installPhase = '' + mkdir -p $out/bin/ + cp ${src}/install.sh $out/bin/install-homebrew.sh + cp ${src}/uninstall.sh $out/bin/uninstall-homebrew.sh + ''; + + meta = with lib; { + description = "Runs the homebrew installer"; + homepage = "https://github.com/Homebrew/"; + license = licenses.bsd2; + platforms = [ + "aarch64-darwin" + "x86_64-darwin" + "x86_64-linux" + "aarch64-linux" + ]; + maintainers = [ maintainers.greg ]; + }; +} diff --git a/pkgs/inject-darwin.nix b/pkgs/inject-darwin.nix new file mode 100644 index 0000000..5e8f21b --- /dev/null +++ b/pkgs/inject-darwin.nix @@ -0,0 +1,38 @@ +{ + writeShellApplication, + coreutils, + curl, + gnutar, + nix, + ... +}: +writeShellApplication { + name = "inject-darwin"; + runtimeInputs = [ + coreutils + curl + gnutar + nix + ]; + text = '' + dir="$(mktemp -d)" + cd "''${dir}" + + # Install nix-darwin + nix-build https://github.com/LnL7/nix-darwin/archive/master.tar.gz -A installer + ./result/bin/darwin-installer + + # Get my configuration + mkdir -p ~/.config/darwin + cd ~/.config/darwin + curl -O -L https://github.com/greg-hellings/nixos-config/archive/refs/heads/main.tar.gz + tar xvzf main.tar.gz --strip-components 1 + + # Build NixOS for this system + pushd "''${dir}" + nix build "''${HOME}/.config/darwin#darwinConfigurations.$(hostname -s).system" + ./result/sw/bin/darwin-rebuild switch --flake ~/.config/darwin + popd + rm -r "''${dir}" + ''; +} diff --git a/pkgs/inject.nix b/pkgs/inject.nix new file mode 100644 index 0000000..2ec149f --- /dev/null +++ b/pkgs/inject.nix @@ -0,0 +1,56 @@ +{ writeShellApplication, git, ... }: + +writeShellApplication { + name = "inject-nixos-config"; + runtimeInputs = [ git ]; + text = '' + hostname="''${1}" + if [ -n "''${hostname}" ]; then + echo "You must provide a hostname"; + exit 1; + fi + + mv /etc/nixos /etc/nixos.bk + cd /etc + git clone http://github.com/greg-hellings/nixos-config nixos + mkdir -p "/etc/nixos/hosts/''${hostname}" + + # Prepares everything for the flake usage + #cp /etc/nixos.bk/configuration.nix "/etc/nixos/hosts/''${hostname}/default.nix" + cat << EOF > "/etc/nixos/hosts/''${hostname}/default.nix" + { pkgs, config, ... }: + + { + imports = [ ./hardware-configuration.nix ]; + + boot.loader = { + systemd-boot.enable = true; + efi.canTouchEfiVariables = true; + }; + + networking.hostName = "''${hostname}"; + greg = { + home = true; + tailscale.enable = true; + }; + } + EOF + cp /etc/nixos.bk/hardware-configuration.nix "/etc/nixos/hosts/''${hostname}/hardware-configuration.nix" + + # Prepare home-manager portion for setup + mkdir -p "/etc/nixos/home/hosts/''${hostname}" + cat << EOF > "/etc/nixos/home/hosts/''${hostname}/default.nix" + { pkgs, config, ... }: + + { + } + EOF + + # Prepares it for injecting the use case into the flake usage + cp /etc/nixos.bk/hardware-configuration.nix /etc/nixos + chown -R greg nixos + + echo "Now you should be able to just run 'nixos-rebuild switch' to enable the flake functionality" + echo "After that and adding the entry to the flake, run 'nixos-rebuild boot --flake '.#''${hostname}' and reboot" + ''; +} diff --git a/pkgs/setup-ssh/default.nix b/pkgs/setup-ssh/default.nix new file mode 100644 index 0000000..dcfe7fc --- /dev/null +++ b/pkgs/setup-ssh/default.nix @@ -0,0 +1,7 @@ +{ writeShellApplication, gh, ... }: + +writeShellApplication { + name = "setup-ssh"; + runtimeInputs = [ gh ]; + text = builtins.readFile ./setup-ssh.sh; +} diff --git a/overlays/setup-ssh/setup-ssh.sh b/pkgs/setup-ssh/setup-ssh.sh similarity index 84% rename from overlays/setup-ssh/setup-ssh.sh rename to pkgs/setup-ssh/setup-ssh.sh index 90e465b..9c3002a 100644 --- a/overlays/setup-ssh/setup-ssh.sh +++ b/pkgs/setup-ssh/setup-ssh.sh @@ -7,5 +7,5 @@ if [ ! -f "${file}" ]; then echo "Authing key to GitHub - may fail" gh auth refresh -h github.com -s admin:public_key - gh ssh-key add -t ${HOSTNAME}-auto "${file}" || true + gh ssh-key add -t "${HOSTNAME}-auto" "${file}" || true fi diff --git a/pkgs/upgrade-pg-cluster.nix b/pkgs/upgrade-pg-cluster.nix new file mode 100644 index 0000000..ffc2a50 --- /dev/null +++ b/pkgs/upgrade-pg-cluster.nix @@ -0,0 +1,36 @@ +{ + writeShellApplication, + postgresql_15, + postgresql_16, + ... +}: + +let + newPostgres = postgresql_16; + oldPostgres = postgresql_15; +in +writeShellApplication { + name = "upgrade-pg-cluster"; + # Only the new one should be in scope, because that is the + # one that we will be referencing directly with the sudo command + # down farther. + runtimeInputs = [ newPostgres ]; + text = '' + systemctl stop postgresql + + export NEWDATA="/var/lib/postgresql/${newPostgres.psqlSchema}" + export NEWBIN="${newPostgres}/bin" + + export OLDDATA="/var/lib/postgresql/${oldPostgres.psqlSchema}" + export OLDBIN="${oldPostgres}/bin" + + install -d -m 0700 -o postgres -g postgres "$NEWDATA" + cd "$NEWDATA" + sudo -u postgres "$NEWBIN/initdb" -D "$NEWDATA" + + sudo -u postgres "$NEWBIN/pg_upgrade" \ + --old-datadir "$OLDDATA" --new-datadir "$NEWDATA" \ + --old-bindir "$OLDBIN" --new-bindir "$NEWBIN" \ + "$@" + ''; +} diff --git a/pkgs/zim.nix b/pkgs/zim.nix new file mode 100644 index 0000000..fa5ca1b --- /dev/null +++ b/pkgs/zim.nix @@ -0,0 +1,45 @@ +{ + callPackage, + fetchtorrent, + lib, + stdenv, + ... +}: +let + inherit (lib.attrsets) mapAttrs mapAttrsRecursiveCond; + # Converts the inputs from the file into a fetchtorrent command + zim = + type: val: + (fetchtorrent { + inherit (val) hash name; + url = "https://download.kiwix.org/zim/${type}/${val.name}.torrent"; + }); + rawZims = builtins.fromJSON (builtins.readFile ./zim/blobs.json); + # Uses the function above to convert the JSON into a structure of fetchtorrent derivations + zims = mapAttrs (_: types: (mapAttrs (type: info: zim type info) types)) (rawZims); + # Turns the fetchtorrent derivations into a list of strings, copying the results into a final output + copies = builtins.concatStringsSep "\n" ( + lib.attrsets.collect builtins.isString ( + mapAttrsRecursiveCond (as: !(lib.attrsets.isDerivation as)) # don't recurse derivations + (_: v: "ln -s ${v} $out/") # copy derivation to destination + zims + ) + ); +in +stdenv.mkDerivation { + name = "zims"; + version = "2024-10"; + + passthru = { + inherit zims rawZims; + updater = (callPackage ./zim/updater.nix { }); + }; + + phases = [ "installPhase" ]; + + # Collect all the zim files into a single folder derivation + installPhase = '' + mkdir -p $out + ${copies} + ''; +} diff --git a/pkgs/zim/blobs.json b/pkgs/zim/blobs.json new file mode 100644 index 0000000..10072fd --- /dev/null +++ b/pkgs/zim/blobs.json @@ -0,0 +1 @@ +{"en":{"gutenberg":{"name":"gutenberg_en_all_2023-08.zim","hash":"sha256-pQpattmS9VmO3ZIQUFn66az8GSmB4IvYhTTCFn6SUmo="},"phet":{"name":"phet_en_all_2023-04.zim","hash":"sha256-pQpattmS9VmO3ZIQUFn66az8GSmB4IvYhTTCFn6SUmo="},"wikibooks":{"name":"wikibooks_en_all_maxi_2021-03.zim","hash":"sha256-pQpattmS9VmO3ZIQUFn66az8GSmB4IvYhTTCFn6SUmo="},"wikipedia":{"name":"wikipedia_en_all_maxi_2024-01.zim","hash":"sha256-pQpattmS9VmO3ZIQUFn66az8GSmB4IvYhTTCFn6SUmo="},"wikisource":{"name":"wikisource_en_all_maxi_2022-09.zim","hash":"sha256-pQpattmS9VmO3ZIQUFn66az8GSmB4IvYhTTCFn6SUmo="},"wikiversity":{"name":"wikiversity_en_all_maxi_2021-03.zim","hash":"sha256-pQpattmS9VmO3ZIQUFn66az8GSmB4IvYhTTCFn6SUmo="},"wiktionary":{"name":"wiktionary_en_all_nopic_2024-05.zim","hash":"sha256-pQpattmS9VmO3ZIQUFn66az8GSmB4IvYhTTCFn6SUmo="}},"fr":{"gutenberg":{"name":"gutenberg_fr_all_2023-08.zim","hash":"sha256-pQpattmS9VmO3ZIQUFn66az8GSmB4IvYhTTCFn6SUmo="},"phet":{"name":"phet_fr_all_2023-04.zim","hash":"sha256-pQpattmS9VmO3ZIQUFn66az8GSmB4IvYhTTCFn6SUmo="},"wikibooks":{"name":"wikibooks_fr_all_maxi_2024-06.zim","hash":"sha256-pQpattmS9VmO3ZIQUFn66az8GSmB4IvYhTTCFn6SUmo="},"wikipedia":{"name":"wikipedia_fr_all_maxi_2024-05.zim","hash":"sha256-pQpattmS9VmO3ZIQUFn66az8GSmB4IvYhTTCFn6SUmo="},"wikisource":{"name":"wikisource_fr_all_maxi_2022-04.zim","hash":"sha256-pQpattmS9VmO3ZIQUFn66az8GSmB4IvYhTTCFn6SUmo="},"wikiversity":{"name":"wikiversity_fr_all_maxi_2021-02.zim","hash":"sha256-pQpattmS9VmO3ZIQUFn66az8GSmB4IvYhTTCFn6SUmo="},"wiktionary":{"name":"wiktionary_fr_all_nopic_2024-06.zim","hash":"sha256-pQpattmS9VmO3ZIQUFn66az8GSmB4IvYhTTCFn6SUmo="}},"ht":{"phet":{"name":"phet_ht_all_2023-04.zim","hash":"sha256-pQpattmS9VmO3ZIQUFn66az8GSmB4IvYhTTCFn6SUmo="},"wikipedia":{"name":"wikipedia_ht_all_maxi_2024-06.zim","hash":"sha256-pQpattmS9VmO3ZIQUFn66az8GSmB4IvYhTTCFn6SUmo="},"wikisource":{"name":"wikisource_ht_all_maxi_2019-03.zim","hash":"sha256-pQpattmS9VmO3ZIQUFn66az8GSmB4IvYhTTCFn6SUmo="}}} diff --git a/pkgs/zim/updater.go b/pkgs/zim/updater.go new file mode 100644 index 0000000..3a71293 --- /dev/null +++ b/pkgs/zim/updater.go @@ -0,0 +1,149 @@ +package main + +import ( + "encoding/json" + "errors" + "fmt" + "io" + "net/http" + "os/exec" + "regexp" + "sort" + "strings" +) + +const BASE = "https://download.kiwix.org/zim" + +func getTypes() []string { + return []string{ + "wikipedia", + "wiktionary", + "wikiversity", + "wikisource", + "wikibooks", + "gutenberg", + "phet", + "ted", + } +} + +func getLanguages() []string { + return []string{ + "en", + "fr", + "ht", + } +} + +func getPage(t string) string { + page, err := http.Get(fmt.Sprintf("%s/%s/", BASE, t)) + if err != nil { + panic(err) + } + defer page.Body.Close() + pageBytes, _ := io.ReadAll(page.Body) + return string(pageBytes) +} + +func getLinks(page string) []string { + ret := []string{} + + link_href := regexp.MustCompile(`href="(.*?)"`) + // Is a list of lists + links := link_href.FindAllStringSubmatch(page, -1) + for _, link := range links { + ret = append(ret, link[len(link)-1]) + } + return ret +} + +func getName(links []string, t, lang string) (string, error) { + candidates := []string{} + prefix := fmt.Sprintf("%s_%s_all", t, lang) + for _, link := range links { + if strings.HasPrefix(link, prefix) { + if !strings.HasPrefix(link, "wiki") || strings.Contains(link, "maxi") { + candidates = append(candidates, link) + } + } + } + sort.Strings(candidates) + if len(candidates) > 0 { + ret := candidates[len(candidates)-1] + return ret, nil + } else { + return "", errors.New("Language item not found") + } +} + +func getHash(ch chan result, file, category, language string) { + // TODO: Only call this if the file doesn't already have a hash + // in the existing file + fmt.Printf("Fetching hash for %s\n", file) + cmd := exec.Command("nix-prefetch", + "--option", + "extra-experimental-features", + "flakes", + fmt.Sprintf(`fetchtorrent { + url="%s/%s/%s.torrent"; + hash="sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA="; + }`, BASE, category, file), + ) + out, err := cmd.Output() + if err != nil { + panic(err) + } + ch <- result{ category, language, strings.TrimSpace(string(out)) } +} + +func outputIsValid(o map[string]map[string]Zim) bool { + for a := range o { + for b := range o[a] { + if o[a][b].Hash == "" { + return false + } + } + } + return true +} + +type result struct { + category, language, hash string +} + +type Zim struct { + Name string `json:"name"` + Hash string `json:"hash"` +} + +func main() { + output := make(map[string]map[string]Zim) + comms := make(chan result) + + for _, t := range getTypes() { + page := getPage(t) + links := getLinks(page) + for _, lang := range getLanguages() { + if file, err := getName(links, t, lang); err == nil { + if _, ok := output[lang]; !ok { + output[lang] = make(map[string]Zim) + } + output[lang][t] = Zim{ file, "" } + go getHash(comms, file, t, lang) + } + } + } + + for r := range comms { + if entry, ok := output[r.language][r.category]; ok { + entry.Hash = r.hash + output[r.language][r.category] = entry + } + if outputIsValid(output) { + close(comms) + break + } + } + ret, _ := json.Marshal(output) + fmt.Println(string(ret)) +} diff --git a/pkgs/zim/updater.nix b/pkgs/zim/updater.nix new file mode 100644 index 0000000..67be92d --- /dev/null +++ b/pkgs/zim/updater.nix @@ -0,0 +1,19 @@ +{ + writeShellApplication, + nix-prefetch, + go, + ... +}: +let + goscript = ./updater.go; +in +writeShellApplication { + name = "update-zims"; + runtimeInputs = [ + go + nix-prefetch + ]; + text = '' + go run ${goscript} + ''; +} diff --git a/secrets/secrets.nix b/secrets/secrets.nix index 78f87dd..017ad48 100644 --- a/secrets/secrets.nix +++ b/secrets/secrets.nix @@ -1,77 +1,78 @@ let - linode = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMv9Zud3kZOl86gtmkn+uj3D4kiXWDPtyUL02VVLNR4Q"; - jude = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOos0zQePsa+T6Z2dsKbPOvEdrBQ8a6mx3s7pN6ysCI0 root@jude"; - myself = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHleYKtfV4W1Z63Ysu9w5Rbglqlz4F92YcZoMkucoTNf"; - genesis = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEI9jbTPmEWQ0F2bLYmnIOLmBnag1fkKxHRjz3X8lB/k root@genesis"; - hosea = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKLIwkTTXA56sUlUjEulXXZRvZy5H4a5ZwgKWLlpkQDz"; - jeremiah = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOjQjXq9WYU2Ki27BR9WwJ4ZruS/lJXbjC1b0Q42Adi0"; - systems = [ genesis linode jude myself hosea jeremiah ]; + linode = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMv9Zud3kZOl86gtmkn+uj3D4kiXWDPtyUL02VVLNR4Q"; + jude = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOos0zQePsa+T6Z2dsKbPOvEdrBQ8a6mx3s7pN6ysCI0 root@jude"; + myself = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHleYKtfV4W1Z63Ysu9w5Rbglqlz4F92YcZoMkucoTNf"; + genesis = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEI9jbTPmEWQ0F2bLYmnIOLmBnag1fkKxHRjz3X8lB/k root@genesis"; + hosea = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKLIwkTTXA56sUlUjEulXXZRvZy5H4a5ZwgKWLlpkQDz"; + jeremiah = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOjQjXq9WYU2Ki27BR9WwJ4ZruS/lJXbjC1b0Q42Adi0"; + systems = [ + genesis + linode + jude + myself + hosea + jeremiah + ]; + user_genesis_virt = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFWPSFQT0AH77wrwRhiskcBS0w4ZakBRdJywYYBsnm3S greg@genesis"; + user_ivr = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMYzms+KIe5/bYF3uCyFjA5e1AgMPLIA3c4k417coqBe gregory.hellings@ls23003"; + user_jude = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINnRc/kBhxcjpUtiRQY+BXnSObdp0jFL1395wAQxJip7 greg@jude"; + user_linode = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINAX6pNx5mbwIa8X+GzktyNijfYmJUpgROFpRxSW9js0 greg@linode"; + user_myself = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAl6DJVrPSujvJSAEA5Q8tRrzfJs/c6DMwqwQEUFffIR greg@myself"; + user_hosea = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGrqJQvDspLi1vXQRJ/Z5kN/F8jCBHvaXjo+5zLuIYjR greg@hosea"; + user_jeremiah = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIYIiecdyM9c7tXgR96983K3wqiJeQRMbrzGIF8Wy6uO greg@jeremiah"; - user1 = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAEAQDLQRq55JKqLifX+31kEXyuoB8gfM+5thAlgR7XLPvvdu6g2a5cCWyozQ1I2oGbPRfJtzcJ5ifM7Ii2PuqAj3MdYFLHBEDOhIpBBWme9Ts2YB9HJ4NorBvB4zEfJd0Q7k2MmylyeBOwdwGz3bVqPRDcJbxWFMDHqr33FEs6SXdfyAQ5SvhWGARI84qz8zUUdOp6M4e3aIGO3cx1gA+YzYQ4FbUtL8+m1NFO8VoNFMZBMf5q0iF/SgEu5bmGWUCePia6DvfeBFQ2/y4Y7WmOj980WE+JmFTkIvmGruMYeGI8FuDQ2JIIIcehddy9bQbPF4VlGnTFsHqJYVRUUWc+vH1cPNMn01oB8s27ogf9e1lyhIN+cZOgp/jDt4eXcO4Wr04uwj7CI6m+d8iMQOa5Jv0hmNgqqiwOMVBlKeo0FCxlovzwvn/Lia9WZ74JqM6JwLCD8SZ0oFgiSIHOTHrQhr7iaCmj7X/0ey7VR8FnCrpeAJpG+ELTfWGshF1d9QR2zW7u4EsXTDLiuOmdJ+/KxwMvjMcWdlg2+Qch6SwulTQRxWaED2IWJo+YiAql8eaiVXu/eZJGLoiskGFZnONoLrzIT4pSjakPlrSpn/M/GkP1pDpaMkr24OhJsGpJNEU3F1ZcOMqy2iJzIxlPmU8Xg0I/OrnbJplpaXeRCqnmouJUJhWkaPzawaVyW7dtvprLWcpQtUgTRet18WLyOrLKlq1jwvNRMTPKUJ2IFJMpk2pNEP6bdiUxyMa4vrRIEU2p1zsYSUJpCRLtccZ/i/+yAqwnTA2L5TdAORi9nD2uCdM/Ljz52V3A14QapS6oqcoWx2soWKgnsbVXoG8DxmUTpll77Ze9t7Y5216SMInWuOu0vstP8ZcgFmWsiBgIYIuLA58abWHMxgD251phYidua6R3Gtkf8J/kYqTR1P6eJF1bt5efEg7FD2aL1QQZsYJo3CRNz7yVe1XqMdPbfe2mFXQVF9TDX5x6r9Ir3d0KiEmTlBdByz8nSyPJ8IQxC58NT4LNVQs3p2XH2Zcf6B4JOBSmV4NNBnLseFobsxniWjkWwZigED/D2iu3OXuuhmskCbw0hKy2rBcKffaSNMioVqYIiYNfKlMlSvAacQKqc/1HCpqgX8PwAcSgNSLy4K7/gIrTHmjY+g+CH7onzatWzkLo+0vsZRa/D/qwhhK2CU2FeU07mhnWxWuzqpJuqVaAwDTaEforK7nQUtAOFAZZP6qGhIoqsynYt4THb+QORb3QYfaP0PVgQwXfVU5Q8eUQFZ8A+siPtOASFjDumsIbseB5VzkF+UhvdseJwkX2+4pVFu8eHFDyvArYsHeGK6fBcQGJFQc2jSs6doIP9HD9IO2R ghelling@unknown38BAF87CD102"; - user4 = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAEAQCoGGV3eD1oF0O62JZfCWNxmViRjRGQsfOhRkQfzQROkwDlFZ7S1+02fudD9t7mPtZE6dQ4yS2+6Q3NIfGW8NBbZAlWwsQ6PnrpuAhWpWc+ng/IDQd9CH/rBCt5bWSLL8AGHa4c+qde7iyoFGK0l9jXVD9wATBFQ274WTmPacVQVHmIAmJS6ISmR6vlq9eaDj1fX8wixao6WvzfwAUvXIs8nhPEfmtyu4T/1Eev9rVIxOw3ODQjk/E0VWV4Koeptsyc+V+j+XMyA91v8f20T4Uwe5LGnJHSQS0WavHnCMWHb1tzkmiKdaNCymoDUcUF2rywMYry7JN0kZo2mp2d7OzE/RP3bz/IsAI33+DwRlDYDNzgeLsLVmOJij61AtqBZque6WDcyCF8HN0ZaY0KJPOtNlN92+GUBRF/Faei0MXZ7wW2BZL5Bc7qnXc9USyhPNsm2vQ7LLhh/NtBGqB88+C+AidTTZ/xiIHKWZJXPkWLPRcK5cfaFqHFqcVMk4U+b0FYB95vYPKmjURlAZ6WrU6dNaNaMH9hJSE6/03is4hb4t8RCRiNaR41pEACDZbATjY0DInFn1LxxpUV66xfpOVg5hKm5ScIks3KxWJ8i3v4/cX7WvbDC/UzWb2UygpsqR7/1n5LV1SNPl+/qxFfdaOyZ8WVvx7DKGxkKfkPBgGwdpSthdv7BY+SC4sT9WXQAPGnvOIk6HwKhHjJYX7AIKK64ACfGZbjBC2gg7Ocl4HkgwpYYlUWLRJdJUhHOCi3VhPZDspYhw/UxPnUhYa8lxq5l7kgkks/tFe1qHOvPe3QRW6brg3EdJNkwtMrlrstW4/nph/KFqSshzNVDlEqTAnhE1cjbBZNmlHt1Un4ixcW1b8b86mE+472pSsIEfO8vxP26brQhxepJFZGOFv2vs3XDrrtn6IMJok4e+AQSCCY0kCcgfG5nMYXUoWpGyTpN/JLG0joJuhPWt58OaOzzKNPq2+rCVAbS7/UmDCqkwxjCywxOZRwluBsEWbZaLEdOwQOfIZQGwSDBM0hfHJJxMSaLN3rCe6VZb+c/5mFXUZ46L5mOGkRlO1TOEAe4jqawAQnuGaHN8mMWSw1gKM+UBXTKa0tBR6Aj/OSfPW0jU+mz/YzzJkzNnlRFiSrLxWvL4eXaBsMZvgKdpA41+E4JG8Vu+9D9KNGRnLASOCxRknV18MubZlEEyKby9A6TaKoPrz7GVQZP+36V9DtAJAza74nHSDNAQG/4w2BLOw9+VrDNdXwjMbgG+SN4f1K+e554OirtSMVB73VXjdwoH/FyX+7+dcUZRQ7V2n37jIVOE6CcuEPjzdnkvKSqBsdTO3Bt66+QtS9BwGHu5c01+Q7jvIl greg@nixos"; - user5 = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAEAQDR4vmc5TiymSjMB7E+oYsiTxOg+2xwnLAILYjQKPA7dIvz/A/HW31R1aVVxNEgkHm8qeqmgE1bUysMMl128zvdKmwkMmq2uagx9hboyfCwOYRaQOtpS0dlgSllhM654vL9553t94sTuMIfNUiXBD3EV2Z5JJ1RteCkBTJjzmXQnV9he0xozBYOdGv35UGneQzAr7Pps9iK81mR4yW+vLcW3pAaPmDBbN7C6WFxqcEBWsaJZK0rLCTrQo+6B130XgH6gPgh4GyDaRmtRJl63yANiP/RfkDFTPKOh87slLLZaHJUe94P2CTZw0e9xSzWuzx71nBp9JhkoZkI9XD+AnbHIZ9X3twIADUf+D0fivzOH+Yzne0gNRFa+O4x8xd/xj8QeM+Rr1ATikBf/FRfyx+RzHgHS1ZyOKfIpQbrm44E8Smv7FzS5RcCfAScSn0npOqP0cilYjtDCEoeMVsx4XQy4+iYLOA/EaMICSz2PwQFG/KXe7NK30Cc5flq5qUiz8TX1Mzlxuro4qTktYSXZBs5YyEg3Za/hcqMV52kVn0W8S1DatHOL4TlRKYeKsg1hWNvtm2MRqJvWkqK9vNNL86Ew5D5hgXdCk+AiRzOhQxfprPYMea2Vx1Mkaq3VYHWmJBWc/m4aOKUSajhFu8KG7l8bc4IkgC+qQCYzr6pCUDlCaCEF1iQ3lItSkbJJmRBHKEOb85lsIJ/SZ0bhsMl8bc9z33zY+bwv2NezG/aKVGrny4ZTAI1BKkZN/60L0yzJihyKamEa442jjnvG1jzC2wEtd/0gCGWScfZsQWqDu97spbeq8jrc67U9xqlGTrWyyNsCW2lpu26cQWWRC8ufl5zBNRDFDSYKceBaJ2+sx1GPj3YYdJSlTt5JvxNyBg0BGfGqCTd0w4IXF3KP9IZRWWAKPaOZcil2MRZwYhWEd7p+CtKVAL93uW0sE+0C13+iFMnBUkFBJ2dZH+tWpywCRYcrVNvrBlsHe2XniwBwvQHUFgKaQAB8upFTK1xBWTh2S+CVyNed/fckAUrPDj4sI2NERGcyPC5Oi6r0fUPtcWvKRfA/yXx5A0iNWc6acTqd5wwSO3s8rOCjIwdczZmkmnjAf3UKhmtDnwRd9rbO5Hanom80re9Dk0W+z9E2+70b9iYvZ60pbw+cG4WqEQnr02RS8hKvU0CsYFoDMTzV4snqTKNrl0IeD+Fmjl7oDkcC4YQbZd2902qVL3WHHvW+p0WQ1B/rk8BPVRYVmrUQbqwPFCQlmTe3Zy+LpqbWYemhQJGVSiEiioVNCc7pHO6RyWLCoEQKwKHAoNleKtkG94hT/d0z+1RYpB/nbJ51BPihK5EMlXbw/Hu1SVaaDLOSL6p greg@mm"; + users = [ + user_genesis_virt + user_ivr + user_jude + user_linode + user_myself + user_hosea + user_jeremiah + ]; - user_genesis_virt = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFWPSFQT0AH77wrwRhiskcBS0w4ZakBRdJywYYBsnm3S greg@genesis"; - user_ivr = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMYzms+KIe5/bYF3uCyFjA5e1AgMPLIA3c4k417coqBe gregory.hellings@ls23003"; - user_jude = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINnRc/kBhxcjpUtiRQY+BXnSObdp0jFL1395wAQxJip7 greg@jude"; - user_linode = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINAX6pNx5mbwIa8X+GzktyNijfYmJUpgROFpRxSW9js0 greg@linode"; - user_myself = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAl6DJVrPSujvJSAEA5Q8tRrzfJs/c6DMwqwQEUFffIR greg@myself"; - user_hosea = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGrqJQvDspLi1vXQRJ/Z5kN/F8jCBHvaXjo+5zLuIYjR greg@hosea"; - user_jeremiah = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIYIiecdyM9c7tXgR96983K3wqiJeQRMbrzGIF8Wy6uO greg@jeremiah"; - - users = [ - user_genesis_virt - user_ivr - user_jude - user_linode - user_myself - user_hosea - user_jeremiah - ]; - - everyone = systems ++ users; + everyone = systems ++ users; in { - # Demo of how to create it - "matrix.age".publicKeys = everyone; - # At the point where you want to use it, put - # age.secrets.matrix.file = ../../secrets/matrix.age; - # Then you can reference the file at /run/agenix/matrix - "nextcloudadmin.age".publicKeys = everyone; + # Demo of how to create it + "matrix.age".publicKeys = everyone; + # At the point where you want to use it, put + # age.secrets.matrix.file = ../../secrets/matrix.age; + # Then you can reference the file at /run/agenix/matrix + "nextcloudadmin.age".publicKeys = everyone; - "3proxy.age".publicKeys = everyone; + "3proxy.age".publicKeys = everyone; - "linode-forgejo-runner.age".publicKeys = everyone; - "jude-forgejo-runner.age".publicKeys = everyone; - "minio.age".publicKeys = everyone; + "linode-forgejo-runner.age".publicKeys = everyone; + "jude-forgejo-runner.age".publicKeys = everyone; + "minio.age".publicKeys = everyone; - "restic-env.age".publicKeys = everyone; - "restic-pw.age".publicKeys = everyone; + "restic-env.age".publicKeys = everyone; + "restic-pw.age".publicKeys = everyone; + "dendrite.age".publicKeys = everyone; + "dendrite_key.age".publicKeys = everyone; + "gitlab/secret.age".publicKeys = everyone; + "gitlab/otp.age".publicKeys = everyone; + "gitlab/db.age".publicKeys = everyone; + "gitlab/jws.age".publicKeys = everyone; + # openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.crt -days 365 -nodes -subj '/CN=issuer' + # Then pipe the resulting files to agenix -e + "gitlab/key.age".publicKeys = everyone; + "gitlab/cert.age".publicKeys = everyone; + "gitlab/jeremiah-runner-reg.age".publicKeys = everyone; + "gitlab/myself-qemu-runner-reg.age".publicKeys = everyone; + "gitlab/myself-vbox-runner-reg.age".publicKeys = everyone; + "gitlab/myself-podman-runner-reg.age".publicKeys = everyone; + "gitlab/myself-shell-runner-reg.age".publicKeys = everyone; + "gitlab/linode-deployer-runner-reg.age".publicKeys = everyone; + "gitlab/docker-auth.age".publicKeys = everyone; - "dendrite.age".publicKeys = everyone; - "dendrite_key.age".publicKeys = everyone; - "gitlab/secret.age".publicKeys = everyone; - "gitlab/otp.age".publicKeys = everyone; - "gitlab/db.age".publicKeys = everyone; - "gitlab/jws.age".publicKeys = everyone; - # openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.crt -days 365 -nodes -subj '/CN=issuer' - # Then pipe the resulting files to agenix -e - "gitlab/key.age".publicKeys = everyone; - "gitlab/cert.age".publicKeys = everyone; - "gitlab/jeremiah-runner-reg.age".publicKeys = everyone; - "gitlab/myself-qemu-runner-reg.age".publicKeys = everyone; - "gitlab/myself-vbox-runner-reg.age".publicKeys = everyone; - "gitlab/myself-podman-runner-reg.age".publicKeys = everyone; - "gitlab/myself-shell-runner-reg.age".publicKeys = everyone; - "gitlab/linode-deployer-runner-reg.age".publicKeys = everyone; - "gitlab/docker-auth.age".publicKeys = everyone; + "acme_password.age".publicKeys = everyone; + "ca/intermediate_key.age".publicKeys = everyone; + "ca/root_key.age".publicKeys = everyone; - "acme_password.age".publicKeys = everyone; - "ca/intermediate_key.age".publicKeys = everyone; - "ca/root_key.age".publicKeys = everyone; - - "minio_secret_access_key.age".publicKeys = everyone; - "minio_access_key_id.age".publicKeys = everyone; + "minio_secret_access_key.age".publicKeys = everyone; + "minio_access_key_id.age".publicKeys = everyone; } diff --git a/shells.nix b/shells.nix new file mode 100644 index 0000000..19e103f --- /dev/null +++ b/shells.nix @@ -0,0 +1,36 @@ +{ + self', + pkgs, + nixvimunstable, + ... +}: +let + system = pkgs.system; + vim = ( + nixvimunstable.legacyPackages.${system}.makeNixvim ( + import ./home/modules/baseline/vim/config.nix { + inherit pkgs; + inherit (pkgs) lib; + config.nixpkgs.config.allowUnfree = false; # I have tried to allow it, but I don't seem able to do so + } + ) + ); +in +{ + default = pkgs.mkShell { + inherit (self'.checks.pre-commit-check) shellHook; + buildInputs = with pkgs; [ + bashInteractive + curl + git + gnutar + gzip + inject + inject-darwin + vim + self'.checks.pre-commit-check.enabledPackages + tmux + xonsh + ]; + }; +}