feat: introduce treefmt and fmt all
This commit is contained in:
parent
80250b0179
commit
5d5282a914
213 changed files with 4967 additions and 4423 deletions
3
.gitignore
vendored
3
.gitignore
vendored
|
|
@ -4,3 +4,6 @@
|
||||||
.env
|
.env
|
||||||
**/result
|
**/result
|
||||||
.direnv/
|
.direnv/
|
||||||
|
|
||||||
|
# nixago: ignore-linked-files
|
||||||
|
/treefmt.toml
|
||||||
18
.vscode/settings.json
vendored
18
.vscode/settings.json
vendored
|
|
@ -1,4 +1,9 @@
|
||||||
{
|
{
|
||||||
|
"editor.defaultFormatter": "ibecker.treefmt-vscode",
|
||||||
|
"treefmt.command": "treefmt",
|
||||||
|
"editor.formatOnSave": true,
|
||||||
|
"nix.enableLanguageServer": true,
|
||||||
|
"nix.serverPath": "nil",
|
||||||
"nix.serverSettings": {
|
"nix.serverSettings": {
|
||||||
// settings for 'nil' LSP
|
// settings for 'nil' LSP
|
||||||
"nil": {
|
"nil": {
|
||||||
|
|
@ -9,11 +14,14 @@
|
||||||
"unused_with"
|
"unused_with"
|
||||||
]
|
]
|
||||||
},
|
},
|
||||||
"formatting": {
|
// TODO: this doesn't work because treefmt-nix wants the output path as an argument
|
||||||
"command": [
|
// "formatting": {
|
||||||
"treefmt-nix",
|
// "command": [
|
||||||
]
|
// "treefmt-nix",
|
||||||
}
|
// "--stdin",
|
||||||
|
// "/dev/stdout"
|
||||||
|
// ]
|
||||||
|
// }
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -4,6 +4,9 @@
|
||||||
# Having pkgs default to <nixpkgs> is fine though, and it lets you use short
|
# Having pkgs default to <nixpkgs> is fine though, and it lets you use short
|
||||||
# commands such as:
|
# commands such as:
|
||||||
# nix-build -A mypackage
|
# nix-build -A mypackage
|
||||||
{pkgs ? import <nixpkgs> {}}: {
|
{
|
||||||
pkgs = import ./nix/pkgs {inherit pkgs;};
|
pkgs ? import <nixpkgs> { },
|
||||||
|
}:
|
||||||
|
{
|
||||||
|
pkgs = import ./nix/pkgs { inherit pkgs; };
|
||||||
}
|
}
|
||||||
|
|
|
||||||
202
flake.lock
generated
202
flake.lock
generated
|
|
@ -346,6 +346,81 @@
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
"flake-utils_3": {
|
"flake-utils_3": {
|
||||||
|
"locked": {
|
||||||
|
"lastModified": 1653893745,
|
||||||
|
"narHash": "sha256-0jntwV3Z8//YwuOjzhV2sgJJPt+HY6KhU7VZUL0fKZQ=",
|
||||||
|
"owner": "numtide",
|
||||||
|
"repo": "flake-utils",
|
||||||
|
"rev": "1ed9fb1935d260de5fe1c2f7ee0ebaae17ed2fa1",
|
||||||
|
"type": "github"
|
||||||
|
},
|
||||||
|
"original": {
|
||||||
|
"owner": "numtide",
|
||||||
|
"repo": "flake-utils",
|
||||||
|
"type": "github"
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"flake-utils_4": {
|
||||||
|
"locked": {
|
||||||
|
"lastModified": 1653893745,
|
||||||
|
"narHash": "sha256-0jntwV3Z8//YwuOjzhV2sgJJPt+HY6KhU7VZUL0fKZQ=",
|
||||||
|
"owner": "numtide",
|
||||||
|
"repo": "flake-utils",
|
||||||
|
"rev": "1ed9fb1935d260de5fe1c2f7ee0ebaae17ed2fa1",
|
||||||
|
"type": "github"
|
||||||
|
},
|
||||||
|
"original": {
|
||||||
|
"owner": "numtide",
|
||||||
|
"repo": "flake-utils",
|
||||||
|
"type": "github"
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"flake-utils_5": {
|
||||||
|
"locked": {
|
||||||
|
"lastModified": 1653893745,
|
||||||
|
"narHash": "sha256-0jntwV3Z8//YwuOjzhV2sgJJPt+HY6KhU7VZUL0fKZQ=",
|
||||||
|
"owner": "numtide",
|
||||||
|
"repo": "flake-utils",
|
||||||
|
"rev": "1ed9fb1935d260de5fe1c2f7ee0ebaae17ed2fa1",
|
||||||
|
"type": "github"
|
||||||
|
},
|
||||||
|
"original": {
|
||||||
|
"owner": "numtide",
|
||||||
|
"repo": "flake-utils",
|
||||||
|
"type": "github"
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"flake-utils_6": {
|
||||||
|
"locked": {
|
||||||
|
"lastModified": 1653893745,
|
||||||
|
"narHash": "sha256-0jntwV3Z8//YwuOjzhV2sgJJPt+HY6KhU7VZUL0fKZQ=",
|
||||||
|
"owner": "numtide",
|
||||||
|
"repo": "flake-utils",
|
||||||
|
"rev": "1ed9fb1935d260de5fe1c2f7ee0ebaae17ed2fa1",
|
||||||
|
"type": "github"
|
||||||
|
},
|
||||||
|
"original": {
|
||||||
|
"owner": "numtide",
|
||||||
|
"repo": "flake-utils",
|
||||||
|
"type": "github"
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"flake-utils_7": {
|
||||||
|
"locked": {
|
||||||
|
"lastModified": 1653893745,
|
||||||
|
"narHash": "sha256-0jntwV3Z8//YwuOjzhV2sgJJPt+HY6KhU7VZUL0fKZQ=",
|
||||||
|
"owner": "numtide",
|
||||||
|
"repo": "flake-utils",
|
||||||
|
"rev": "1ed9fb1935d260de5fe1c2f7ee0ebaae17ed2fa1",
|
||||||
|
"type": "github"
|
||||||
|
},
|
||||||
|
"original": {
|
||||||
|
"owner": "numtide",
|
||||||
|
"repo": "flake-utils",
|
||||||
|
"type": "github"
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"flake-utils_8": {
|
||||||
"inputs": {
|
"inputs": {
|
||||||
"systems": "systems_3"
|
"systems": "systems_3"
|
||||||
},
|
},
|
||||||
|
|
@ -363,7 +438,7 @@
|
||||||
"type": "github"
|
"type": "github"
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
"flake-utils_4": {
|
"flake-utils_9": {
|
||||||
"inputs": {
|
"inputs": {
|
||||||
"systems": "systems_4"
|
"systems": "systems_4"
|
||||||
},
|
},
|
||||||
|
|
@ -485,7 +560,7 @@
|
||||||
},
|
},
|
||||||
"lib-aggregate": {
|
"lib-aggregate": {
|
||||||
"inputs": {
|
"inputs": {
|
||||||
"flake-utils": "flake-utils_3",
|
"flake-utils": "flake-utils_8",
|
||||||
"nixpkgs-lib": "nixpkgs-lib_2"
|
"nixpkgs-lib": "nixpkgs-lib_2"
|
||||||
},
|
},
|
||||||
"locked": {
|
"locked": {
|
||||||
|
|
@ -639,6 +714,126 @@
|
||||||
"type": "github"
|
"type": "github"
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
|
"nixago": {
|
||||||
|
"inputs": {
|
||||||
|
"flake-utils": "flake-utils_3",
|
||||||
|
"nixago-exts": "nixago-exts",
|
||||||
|
"nixpkgs": [
|
||||||
|
"nixpkgs"
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"locked": {
|
||||||
|
"lastModified": 1714086354,
|
||||||
|
"narHash": "sha256-yKVQMxL9p7zCWUhnGhDzRVT8sDgHoI3V595lBK0C2YA=",
|
||||||
|
"owner": "jmgilman",
|
||||||
|
"repo": "nixago",
|
||||||
|
"rev": "5133633e9fe6b144c8e00e3b212cdbd5a173b63d",
|
||||||
|
"type": "github"
|
||||||
|
},
|
||||||
|
"original": {
|
||||||
|
"owner": "jmgilman",
|
||||||
|
"repo": "nixago",
|
||||||
|
"type": "github"
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"nixago-exts": {
|
||||||
|
"inputs": {
|
||||||
|
"flake-utils": "flake-utils_4",
|
||||||
|
"nixago": "nixago_2",
|
||||||
|
"nixpkgs": [
|
||||||
|
"nixago",
|
||||||
|
"nixpkgs"
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"locked": {
|
||||||
|
"lastModified": 1676070308,
|
||||||
|
"narHash": "sha256-QaJ65oc2l8iwQIGWUJ0EKjCeSuuCM/LqR8RauxZUUkc=",
|
||||||
|
"owner": "nix-community",
|
||||||
|
"repo": "nixago-extensions",
|
||||||
|
"rev": "e5380cb0456f4ea3c86cf94e3039eb856bf07d0b",
|
||||||
|
"type": "github"
|
||||||
|
},
|
||||||
|
"original": {
|
||||||
|
"owner": "nix-community",
|
||||||
|
"repo": "nixago-extensions",
|
||||||
|
"type": "github"
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"nixago-exts_2": {
|
||||||
|
"inputs": {
|
||||||
|
"flake-utils": "flake-utils_6",
|
||||||
|
"nixago": "nixago_3",
|
||||||
|
"nixpkgs": [
|
||||||
|
"nixago",
|
||||||
|
"nixago-exts",
|
||||||
|
"nixago",
|
||||||
|
"nixpkgs"
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"locked": {
|
||||||
|
"lastModified": 1655508669,
|
||||||
|
"narHash": "sha256-BDDdo5dZQMmwNH/GNacy33nPBnCpSIydWFPZs0kkj/g=",
|
||||||
|
"owner": "nix-community",
|
||||||
|
"repo": "nixago-extensions",
|
||||||
|
"rev": "3022a932ce109258482ecc6568c163e8d0b426aa",
|
||||||
|
"type": "github"
|
||||||
|
},
|
||||||
|
"original": {
|
||||||
|
"owner": "nix-community",
|
||||||
|
"repo": "nixago-extensions",
|
||||||
|
"type": "github"
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"nixago_2": {
|
||||||
|
"inputs": {
|
||||||
|
"flake-utils": "flake-utils_5",
|
||||||
|
"nixago-exts": "nixago-exts_2",
|
||||||
|
"nixpkgs": [
|
||||||
|
"nixago",
|
||||||
|
"nixago-exts",
|
||||||
|
"nixpkgs"
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"locked": {
|
||||||
|
"lastModified": 1676070010,
|
||||||
|
"narHash": "sha256-iYzJIWptE1EUD8VINAg66AAMUajizg8JUYN3oBmb8no=",
|
||||||
|
"owner": "nix-community",
|
||||||
|
"repo": "nixago",
|
||||||
|
"rev": "d480ba6c0c16e2c5c0bd2122852d6a0c9ad1ed0e",
|
||||||
|
"type": "github"
|
||||||
|
},
|
||||||
|
"original": {
|
||||||
|
"owner": "nix-community",
|
||||||
|
"ref": "rename-config-data",
|
||||||
|
"repo": "nixago",
|
||||||
|
"type": "github"
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"nixago_3": {
|
||||||
|
"inputs": {
|
||||||
|
"flake-utils": "flake-utils_7",
|
||||||
|
"nixpkgs": [
|
||||||
|
"nixago",
|
||||||
|
"nixago-exts",
|
||||||
|
"nixago",
|
||||||
|
"nixago-exts",
|
||||||
|
"nixpkgs"
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"locked": {
|
||||||
|
"lastModified": 1655405483,
|
||||||
|
"narHash": "sha256-Crd49aZWNrpczlRTOwWGfwBMsTUoG9vlHDKQC7cx264=",
|
||||||
|
"owner": "nix-community",
|
||||||
|
"repo": "nixago",
|
||||||
|
"rev": "e6a9566c18063db5b120e69e048d3627414e327d",
|
||||||
|
"type": "github"
|
||||||
|
},
|
||||||
|
"original": {
|
||||||
|
"owner": "nix-community",
|
||||||
|
"repo": "nixago",
|
||||||
|
"type": "github"
|
||||||
|
}
|
||||||
|
},
|
||||||
"nixos-anywhere": {
|
"nixos-anywhere": {
|
||||||
"inputs": {
|
"inputs": {
|
||||||
"disko": "disko",
|
"disko": "disko",
|
||||||
|
|
@ -1058,6 +1253,7 @@
|
||||||
"logseq_0_10_9_aarch64_appimage": "logseq_0_10_9_aarch64_appimage",
|
"logseq_0_10_9_aarch64_appimage": "logseq_0_10_9_aarch64_appimage",
|
||||||
"nix-vscode-extensions": "nix-vscode-extensions",
|
"nix-vscode-extensions": "nix-vscode-extensions",
|
||||||
"nix4vscode": "nix4vscode",
|
"nix4vscode": "nix4vscode",
|
||||||
|
"nixago": "nixago",
|
||||||
"nixos-anywhere": "nixos-anywhere",
|
"nixos-anywhere": "nixos-anywhere",
|
||||||
"nixpkgs": [
|
"nixpkgs": [
|
||||||
"nixpkgs-2405"
|
"nixpkgs-2405"
|
||||||
|
|
@ -1351,7 +1547,7 @@
|
||||||
},
|
},
|
||||||
"yofi": {
|
"yofi": {
|
||||||
"inputs": {
|
"inputs": {
|
||||||
"flake-utils": "flake-utils_4",
|
"flake-utils": "flake-utils_9",
|
||||||
"nixpkgs": [
|
"nixpkgs": [
|
||||||
"nixpkgs"
|
"nixpkgs"
|
||||||
]
|
]
|
||||||
|
|
|
||||||
118
flake.nix
118
flake.nix
|
|
@ -129,14 +129,18 @@
|
||||||
url = "github:numtide/treefmt-nix";
|
url = "github:numtide/treefmt-nix";
|
||||||
inputs.nixpkgs.follows = "nixpkgs";
|
inputs.nixpkgs.follows = "nixpkgs";
|
||||||
};
|
};
|
||||||
|
nixago.url = "github:jmgilman/nixago";
|
||||||
|
nixago.inputs.nixpkgs.follows = "nixpkgs";
|
||||||
};
|
};
|
||||||
|
|
||||||
outputs = inputs @ {
|
outputs =
|
||||||
|
inputs@{
|
||||||
self,
|
self,
|
||||||
flake-parts,
|
flake-parts,
|
||||||
nixpkgs,
|
nixpkgs,
|
||||||
...
|
...
|
||||||
}: let
|
}:
|
||||||
|
let
|
||||||
inherit (nixpkgs) lib;
|
inherit (nixpkgs) lib;
|
||||||
|
|
||||||
systems = [
|
systems = [
|
||||||
|
|
@ -144,25 +148,26 @@
|
||||||
"aarch64-linux"
|
"aarch64-linux"
|
||||||
];
|
];
|
||||||
in
|
in
|
||||||
flake-parts.lib.mkFlake {inherit inputs;}
|
flake-parts.lib.mkFlake { inherit inputs; } (
|
||||||
({withSystem, ...}: {
|
{ withSystem, ... }:
|
||||||
|
{
|
||||||
flake.colmena =
|
flake.colmena =
|
||||||
lib.lists.foldl (sum: cur: lib.attrsets.recursiveUpdate sum cur)
|
lib.lists.foldl (sum: cur: lib.attrsets.recursiveUpdate sum cur)
|
||||||
{
|
{ meta.nixpkgs = import inputs.nixpkgs.outPath { system = builtins.elemAt systems 0; }; }
|
||||||
meta.nixpkgs = import inputs.nixpkgs.outPath {
|
|
||||||
system = builtins.elemAt systems 0;
|
|
||||||
};
|
|
||||||
}
|
|
||||||
# FIXME: this doesn't seem to work to apply overlays into a node's nixpkgs import
|
# FIXME: this doesn't seem to work to apply overlays into a node's nixpkgs import
|
||||||
# try this instead: https://github.com/zhaofengli/colmena/issues/60#issuecomment-1510496861
|
# try this instead: https://github.com/zhaofengli/colmena/issues/60#issuecomment-1510496861
|
||||||
(builtins.map
|
(
|
||||||
(nodeName:
|
builtins.map
|
||||||
|
(
|
||||||
|
nodeName:
|
||||||
import ./nix/os/devices/${nodeName} {
|
import ./nix/os/devices/${nodeName} {
|
||||||
inherit nodeName;
|
inherit nodeName;
|
||||||
repoFlake = self;
|
repoFlake = self;
|
||||||
repoFlakeWithSystem = withSystem;
|
repoFlakeWithSystem = withSystem;
|
||||||
nodeFlake = self.inputs.get-flake ./nix/os/devices/${nodeName};
|
nodeFlake = self.inputs.get-flake ./nix/os/devices/${nodeName};
|
||||||
}) [
|
}
|
||||||
|
)
|
||||||
|
[
|
||||||
"steveej-t14"
|
"steveej-t14"
|
||||||
"steveej-x13s"
|
"steveej-x13s"
|
||||||
"steveej-x13s-rmvbl"
|
"steveej-x13s-rmvbl"
|
||||||
|
|
@ -177,17 +182,33 @@
|
||||||
"sj-srv1"
|
"sj-srv1"
|
||||||
|
|
||||||
"hstk0"
|
"hstk0"
|
||||||
]);
|
]
|
||||||
|
);
|
||||||
|
|
||||||
flake.lib = {
|
flake.lib = {
|
||||||
inherit withSystem;
|
inherit withSystem;
|
||||||
|
|
||||||
|
treefmtEval =
|
||||||
|
pkgs:
|
||||||
|
let
|
||||||
|
settingsNix = {
|
||||||
|
# Used to find the project root
|
||||||
|
projectRootFile = ".git/config";
|
||||||
|
programs.nixfmt.enable = true;
|
||||||
|
};
|
||||||
|
in
|
||||||
|
inputs.treefmt-nix.lib.evalModule pkgs settingsNix;
|
||||||
|
|
||||||
|
treefmtSettings = pkgs: (self.lib.treefmtEval pkgs).config.settings;
|
||||||
};
|
};
|
||||||
|
|
||||||
# this makes nixos-anywhere work
|
# this makes nixos-anywhere work
|
||||||
flake.nixosConfigurations = let
|
flake.nixosConfigurations =
|
||||||
|
let
|
||||||
colmenaHive = (inputs.colmena.lib.makeHive self.outputs.colmena).nodes;
|
colmenaHive = (inputs.colmena.lib.makeHive self.outputs.colmena).nodes;
|
||||||
router0-dmz0 = (inputs.get-flake ./nix/os/devices/router0-dmz0).nixosConfigurations;
|
router0-dmz0 = (inputs.get-flake ./nix/os/devices/router0-dmz0).nixosConfigurations;
|
||||||
in (
|
in
|
||||||
|
(
|
||||||
colmenaHive
|
colmenaHive
|
||||||
// {
|
// {
|
||||||
router0-dmz0 = router0-dmz0.native;
|
router0-dmz0 = router0-dmz0.native;
|
||||||
|
|
@ -197,13 +218,15 @@
|
||||||
router0-dmz0_cross = router0-dmz0.cross;
|
router0-dmz0_cross = router0-dmz0.cross;
|
||||||
|
|
||||||
steveej-x13s_cross = (inputs.get-flake ./nix/os/devices/steveej-x13s).nixosConfigurations.cross;
|
steveej-x13s_cross = (inputs.get-flake ./nix/os/devices/steveej-x13s).nixosConfigurations.cross;
|
||||||
steveej-x13s-rmvbl_cross = (inputs.get-flake ./nix/os/devices/steveej-x13s-rmvbl).nixosConfigurations.cross;
|
steveej-x13s-rmvbl_cross =
|
||||||
|
(inputs.get-flake ./nix/os/devices/steveej-x13s-rmvbl).nixosConfigurations.cross;
|
||||||
}
|
}
|
||||||
);
|
);
|
||||||
|
|
||||||
inherit systems;
|
inherit systems;
|
||||||
|
|
||||||
perSystem = {
|
perSystem =
|
||||||
|
{
|
||||||
self',
|
self',
|
||||||
inputs',
|
inputs',
|
||||||
system,
|
system,
|
||||||
|
|
@ -211,37 +234,33 @@
|
||||||
lib,
|
lib,
|
||||||
pkgs,
|
pkgs,
|
||||||
...
|
...
|
||||||
}: {
|
}:
|
||||||
imports = [
|
{
|
||||||
./nix/modules/flake-parts/perSystem/default.nix
|
imports = [ ./nix/modules/flake-parts/perSystem/default.nix ];
|
||||||
];
|
|
||||||
|
|
||||||
packages = let
|
packages =
|
||||||
dcpj4110dw = pkgs.callPackage (self + /nix/pkgs/dcpj4110dw) {};
|
let
|
||||||
|
dcpj4110dw = pkgs.callPackage (self + /nix/pkgs/dcpj4110dw) { };
|
||||||
|
|
||||||
craneLibFn = (inputs.crane.mkLib inputs.nixpkgs.legacyPackages.${system}).overrideToolchain;
|
craneLibFn = (inputs.crane.mkLib inputs.nixpkgs.legacyPackages.${system}).overrideToolchain;
|
||||||
|
|
||||||
craneLib =
|
craneLib = craneLibFn inputs'.fenix.packages.stable.toolchain;
|
||||||
craneLibFn
|
|
||||||
inputs'.fenix.packages.stable.toolchain;
|
|
||||||
|
|
||||||
craneLibOfiPass =
|
craneLibOfiPass = craneLibFn (
|
||||||
craneLibFn
|
|
||||||
(
|
|
||||||
inputs'.fenix.packages.stable.toolchain
|
inputs'.fenix.packages.stable.toolchain
|
||||||
# .override {
|
# .override {
|
||||||
# date = "1.60.0";
|
# date = "1.60.0";
|
||||||
# }
|
# }
|
||||||
);
|
);
|
||||||
in {
|
in
|
||||||
|
{
|
||||||
dcpj4110dwDriver = dcpj4110dw.driver;
|
dcpj4110dwDriver = dcpj4110dw.driver;
|
||||||
dcpj4110dwCupswrapper = dcpj4110dw.cupswrapper;
|
dcpj4110dwCupswrapper = dcpj4110dw.cupswrapper;
|
||||||
|
|
||||||
inherit (inputs'.colmena.packages) colmena;
|
inherit (inputs'.colmena.packages) colmena;
|
||||||
|
|
||||||
prs =
|
prs = pkgs.callPackage (
|
||||||
pkgs.callPackage
|
{
|
||||||
({
|
|
||||||
pkgs,
|
pkgs,
|
||||||
dbus,
|
dbus,
|
||||||
glib,
|
glib,
|
||||||
|
|
@ -257,7 +276,12 @@
|
||||||
pname = "prs";
|
pname = "prs";
|
||||||
version = inputs.prs.shortRev;
|
version = inputs.prs.shortRev;
|
||||||
src = inputs.prs;
|
src = inputs.prs;
|
||||||
nativeBuildInputs = [gpgme installShellFiles pkg-config python3];
|
nativeBuildInputs = [
|
||||||
|
gpgme
|
||||||
|
installShellFiles
|
||||||
|
pkg-config
|
||||||
|
python3
|
||||||
|
];
|
||||||
|
|
||||||
buildInputs = [
|
buildInputs = [
|
||||||
dbus
|
dbus
|
||||||
|
|
@ -275,8 +299,8 @@
|
||||||
installShellCompletion --cmd prs --$shell <($out/bin/prs internal completions $shell --stdout)
|
installShellCompletion --cmd prs --$shell <($out/bin/prs internal completions $shell --stdout)
|
||||||
done
|
done
|
||||||
'';
|
'';
|
||||||
})
|
}
|
||||||
{};
|
) { };
|
||||||
|
|
||||||
nomad = inputs'.nixpkgs-unstable.legacyPackages.nomad_1_6;
|
nomad = inputs'.nixpkgs-unstable.legacyPackages.nomad_1_6;
|
||||||
|
|
||||||
|
|
@ -309,29 +333,27 @@
|
||||||
|
|
||||||
rperf = craneLib.buildPackage {
|
rperf = craneLib.buildPackage {
|
||||||
src = inputs.rperf;
|
src = inputs.rperf;
|
||||||
nativeBuildInputs = [
|
nativeBuildInputs = [ pkgs.pkg-config ];
|
||||||
pkgs.pkg-config
|
buildInputs = [ ];
|
||||||
];
|
|
||||||
buildInputs = [
|
|
||||||
];
|
|
||||||
};
|
};
|
||||||
|
|
||||||
x13s-bt-firmware = pkgs.runCommand "x13s-bt-firmware" {} ''
|
x13s-bt-firmware = pkgs.runCommand "x13s-bt-firmware" { } ''
|
||||||
mkdir -p $out/lib/firmware/qca
|
mkdir -p $out/lib/firmware/qca
|
||||||
cp -v ${self}/misc/x13s_bt_firmware/hpnv21g.b8c.crypt.fw $out/lib/firmware/qca/hpnv21.bin
|
cp -v ${self}/misc/x13s_bt_firmware/hpnv21g.b8c.crypt.fw $out/lib/firmware/qca/hpnv21.bin
|
||||||
cp -v ${inputs.x13s-bt-firmware} $out/lib/firmware/qca//hpbtfw21.tlv
|
cp -v ${inputs.x13s-bt-firmware} $out/lib/firmware/qca//hpbtfw21.tlv
|
||||||
'';
|
'';
|
||||||
|
|
||||||
x13s-ath11k-firmware = pkgs.runCommand "x13s-ath11k-firmware-before" {} ''
|
x13s-ath11k-firmware = pkgs.runCommand "x13s-ath11k-firmware-before" { } ''
|
||||||
mkdir -p $out/lib/firmware/ath11k/WCN6855/hw2.1/
|
mkdir -p $out/lib/firmware/ath11k/WCN6855/hw2.1/
|
||||||
cp -v ${inputs.ath11k-firmware}/WCN6855/hw2.1/{board-2,regdb}.bin $out/lib/firmware/ath11k/WCN6855/hw2.1/
|
cp -v ${inputs.ath11k-firmware}/WCN6855/hw2.1/{board-2,regdb}.bin $out/lib/firmware/ath11k/WCN6855/hw2.1/
|
||||||
cp -v ${inputs.ath11k-firmware}/WCN6855/hw2.1/1.1/WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.41/{amss,m3}.bin $out/lib/firmware/ath11k/WCN6855/hw2.1/
|
cp -v ${inputs.ath11k-firmware}/WCN6855/hw2.1/1.1/WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.41/{amss,m3}.bin $out/lib/firmware/ath11k/WCN6855/hw2.1/
|
||||||
'';
|
'';
|
||||||
};
|
};
|
||||||
|
|
||||||
formatter = inputs.treefmt-nix.formatter.${system};
|
formatter = (self.lib.treefmtEval pkgs).config.build.wrapper;
|
||||||
|
|
||||||
devShells = let
|
devShells =
|
||||||
|
let
|
||||||
all = import ./nix/devShells.nix {
|
all = import ./nix/devShells.nix {
|
||||||
inherit
|
inherit
|
||||||
self
|
self
|
||||||
|
|
@ -340,7 +362,9 @@
|
||||||
pkgs
|
pkgs
|
||||||
;
|
;
|
||||||
};
|
};
|
||||||
in (all // {default = all.develop;});
|
in
|
||||||
|
(all // { default = all.develop; });
|
||||||
};
|
};
|
||||||
});
|
}
|
||||||
|
);
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -1,6 +1,10 @@
|
||||||
{pkgs ? import <nixpkgs> {}}: let
|
{
|
||||||
baseEnv = ["SSL_CERT_FILE=${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt"];
|
pkgs ? import <nixpkgs> { },
|
||||||
in rec {
|
}:
|
||||||
|
let
|
||||||
|
baseEnv = [ "SSL_CERT_FILE=${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt" ];
|
||||||
|
in
|
||||||
|
rec {
|
||||||
base = pkgs.dockerTools.buildImage rec {
|
base = pkgs.dockerTools.buildImage rec {
|
||||||
name = "base";
|
name = "base";
|
||||||
|
|
||||||
|
|
@ -21,12 +25,20 @@ in rec {
|
||||||
interactive_base = pkgs.dockerTools.buildImage {
|
interactive_base = pkgs.dockerTools.buildImage {
|
||||||
name = "interactive_base";
|
name = "interactive_base";
|
||||||
fromImage = base;
|
fromImage = base;
|
||||||
contents = with pkgs; [procps zsh coreutils neovim];
|
contents = with pkgs; [
|
||||||
|
procps
|
||||||
|
zsh
|
||||||
|
coreutils
|
||||||
|
neovim
|
||||||
|
];
|
||||||
|
|
||||||
config = {Cmd = ["/bin/zsh"];};
|
config = {
|
||||||
|
Cmd = [ "/bin/zsh" ];
|
||||||
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
s3ql = let
|
s3ql =
|
||||||
|
let
|
||||||
entrypoint = pkgs.writeScript "entrypoint" ''
|
entrypoint = pkgs.writeScript "entrypoint" ''
|
||||||
#!${pkgs.stdenv.shell}
|
#!${pkgs.stdenv.shell}
|
||||||
|
|
||||||
|
|
@ -73,7 +85,10 @@ in rec {
|
||||||
pkgs.dockerTools.buildImage {
|
pkgs.dockerTools.buildImage {
|
||||||
name = "s3ql";
|
name = "s3ql";
|
||||||
fromImage = interactive_base;
|
fromImage = interactive_base;
|
||||||
contents = [pkgs.s3ql pkgs.fuse];
|
contents = [
|
||||||
|
pkgs.s3ql
|
||||||
|
pkgs.fuse
|
||||||
|
];
|
||||||
|
|
||||||
runAsRoot = ''
|
runAsRoot = ''
|
||||||
#!${pkgs.stdenv.shell}
|
#!${pkgs.stdenv.shell}
|
||||||
|
|
@ -84,25 +99,24 @@ in rec {
|
||||||
'';
|
'';
|
||||||
|
|
||||||
config = {
|
config = {
|
||||||
Env =
|
Env = baseEnv ++ [
|
||||||
baseEnv
|
|
||||||
++ [
|
|
||||||
"HOME=/home/s3ql"
|
"HOME=/home/s3ql"
|
||||||
"S3QL_CACHE_DIR=/var/cache/s3ql"
|
"S3QL_CACHE_DIR=/var/cache/s3ql"
|
||||||
"S3QL_AUTHINFO2=/etc/s3ql/authinfo2"
|
"S3QL_AUTHINFO2=/etc/s3ql/authinfo2"
|
||||||
"CONTAINER_ENTRYPOINT=${entrypoint}"
|
"CONTAINER_ENTRYPOINT=${entrypoint}"
|
||||||
];
|
];
|
||||||
Cmd = [entrypoint];
|
Cmd = [ entrypoint ];
|
||||||
Volumes = {
|
Volumes = {
|
||||||
"/var/cache/s3ql" = {};
|
"/var/cache/s3ql" = { };
|
||||||
"/etc/s3ql/authinfo2" = {};
|
"/etc/s3ql/authinfo2" = { };
|
||||||
"/buckets" = {};
|
"/buckets" = { };
|
||||||
"/tmp" = {};
|
"/tmp" = { };
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
syncthing = let
|
syncthing =
|
||||||
|
let
|
||||||
entrypoint = pkgs.writeScript "entrypoint" ''
|
entrypoint = pkgs.writeScript "entrypoint" ''
|
||||||
#!${pkgs.stdenv.shell}
|
#!${pkgs.stdenv.shell}
|
||||||
set -x
|
set -x
|
||||||
|
|
@ -132,9 +146,11 @@ in rec {
|
||||||
contents = pkgs.syncthing;
|
contents = pkgs.syncthing;
|
||||||
|
|
||||||
config = {
|
config = {
|
||||||
Env = baseEnv ++ ["SYNCTHING_HOME=/home/syncthing"];
|
Env = baseEnv ++ [ "SYNCTHING_HOME=/home/syncthing" ];
|
||||||
Cmd = [entrypoint];
|
Cmd = [ entrypoint ];
|
||||||
Volumes = {"/data" = {};};
|
Volumes = {
|
||||||
|
"/data" = { };
|
||||||
|
};
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -1,6 +1,9 @@
|
||||||
{versionsPath}: let
|
{ versionsPath }:
|
||||||
|
let
|
||||||
channelVersions = import versionsPath;
|
channelVersions = import versionsPath;
|
||||||
mkChannelSource = name: let
|
mkChannelSource =
|
||||||
|
name:
|
||||||
|
let
|
||||||
channelVersion = builtins.getAttr name channelVersions;
|
channelVersion = builtins.getAttr name channelVersions;
|
||||||
in
|
in
|
||||||
builtins.fetchGit {
|
builtins.fetchGit {
|
||||||
|
|
@ -8,19 +11,24 @@
|
||||||
inherit name;
|
inherit name;
|
||||||
inherit (channelVersion) url ref rev;
|
inherit (channelVersion) url ref rev;
|
||||||
};
|
};
|
||||||
nixPath = builtins.concatStringsSep ":" (builtins.map
|
nixPath = builtins.concatStringsSep ":" (
|
||||||
(elemName: let
|
builtins.map (
|
||||||
|
elemName:
|
||||||
|
let
|
||||||
elem = builtins.getAttr elemName channelVersions;
|
elem = builtins.getAttr elemName channelVersions;
|
||||||
elemPath = mkChannelSource elemName;
|
elemPath = mkChannelSource elemName;
|
||||||
suffix =
|
suffix = if builtins.hasAttr "suffix" elem then elem.suffix else "";
|
||||||
if builtins.hasAttr "suffix" elem
|
|
||||||
then elem.suffix
|
|
||||||
else "";
|
|
||||||
in
|
in
|
||||||
builtins.concatStringsSep "=" [elemName elemPath] + suffix)
|
builtins.concatStringsSep "=" [
|
||||||
(builtins.attrNames channelVersions));
|
elemName
|
||||||
pkgs = import (mkChannelSource "nixpkgs") {};
|
elemPath
|
||||||
in {
|
]
|
||||||
|
+ suffix
|
||||||
|
) (builtins.attrNames channelVersions)
|
||||||
|
);
|
||||||
|
pkgs = import (mkChannelSource "nixpkgs") { };
|
||||||
|
in
|
||||||
|
{
|
||||||
inherit nixPath;
|
inherit nixPath;
|
||||||
channelSources = pkgs.writeText "channels.rc" ''
|
channelSources = pkgs.writeText "channels.rc" ''
|
||||||
export NIX_PATH=${nixPath}
|
export NIX_PATH=${nixPath}
|
||||||
|
|
|
||||||
|
|
@ -3,9 +3,11 @@
|
||||||
self',
|
self',
|
||||||
inputs',
|
inputs',
|
||||||
pkgs,
|
pkgs,
|
||||||
}: let
|
}:
|
||||||
|
let
|
||||||
pkgsUnstable = inputs'.nixpkgs-unstable.legacyPackages;
|
pkgsUnstable = inputs'.nixpkgs-unstable.legacyPackages;
|
||||||
in {
|
in
|
||||||
|
{
|
||||||
install = pkgs.mkShell {
|
install = pkgs.mkShell {
|
||||||
name = "infra-install";
|
name = "infra-install";
|
||||||
packages = with pkgs; [
|
packages = with pkgs; [
|
||||||
|
|
@ -20,11 +22,9 @@ in {
|
||||||
|
|
||||||
develop = pkgs.mkShell {
|
develop = pkgs.mkShell {
|
||||||
name = "infra-develop";
|
name = "infra-develop";
|
||||||
inputsFrom = [
|
inputsFrom = [ self'.devShells.install ];
|
||||||
self'.devShells.install
|
|
||||||
];
|
|
||||||
packages = with pkgs; [
|
packages = with pkgs; [
|
||||||
self'.formatter
|
pkgs.treefmt
|
||||||
inputs'.colmena.packages.colmena
|
inputs'.colmena.packages.colmena
|
||||||
dconf2nix
|
dconf2nix
|
||||||
inputs'.nixos-anywhere.packages.nixos-anywhere
|
inputs'.nixos-anywhere.packages.nixos-anywhere
|
||||||
|
|
@ -92,6 +92,15 @@ in {
|
||||||
# Set Environment Variables
|
# Set Environment Variables
|
||||||
RUST_BACKTRACE = 1;
|
RUST_BACKTRACE = 1;
|
||||||
|
|
||||||
KANIDM_URL = self.nixosConfigurations.sj-srv1.config.containers.webserver.config.services.kanidm.serverSettings.origin;
|
KANIDM_URL =
|
||||||
|
self.nixosConfigurations.sj-srv1.config.containers.webserver.config.services.kanidm.serverSettings.origin;
|
||||||
|
|
||||||
|
shellHook =
|
||||||
|
(self.inputs.nixago.lib.${pkgs.stdenv.system}.make {
|
||||||
|
data = self.lib.treefmtSettings pkgs;
|
||||||
|
output = "treefmt.toml";
|
||||||
|
format = "toml";
|
||||||
|
}).shellHook;
|
||||||
|
|
||||||
};
|
};
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -7,11 +7,13 @@
|
||||||
repoFlake,
|
repoFlake,
|
||||||
packages',
|
packages',
|
||||||
...
|
...
|
||||||
}: let
|
}:
|
||||||
|
let
|
||||||
pkgsUnstable =
|
pkgsUnstable =
|
||||||
pkgs.pkgsUnstable
|
pkgs.pkgsUnstable
|
||||||
or (import nodeFlake.inputs.nixpkgs-unstable {inherit (pkgs) system config overlays;});
|
or (import nodeFlake.inputs.nixpkgs-unstable { inherit (pkgs) system config overlays; });
|
||||||
in {
|
in
|
||||||
|
{
|
||||||
imports = [
|
imports = [
|
||||||
../profiles/common.nix
|
../profiles/common.nix
|
||||||
# ../profiles/dotfiles.nix
|
# ../profiles/dotfiles.nix
|
||||||
|
|
@ -34,18 +36,18 @@ in {
|
||||||
../programs/libreoffice.nix
|
../programs/libreoffice.nix
|
||||||
../programs/neovim.nix
|
../programs/neovim.nix
|
||||||
../programs/vscode
|
../programs/vscode
|
||||||
{
|
{ home.packages = [ pkgsUnstable.markdown-oxide ]; }
|
||||||
home.packages = [
|
|
||||||
pkgsUnstable.markdown-oxide
|
|
||||||
];
|
|
||||||
}
|
|
||||||
];
|
];
|
||||||
|
|
||||||
home.sessionVariables.HM_CONFIG = "graphical-fullblown";
|
home.sessionVariables.HM_CONFIG = "graphical-fullblown";
|
||||||
home.sessionVariables.GOPATH = "$HOME/src/go";
|
home.sessionVariables.GOPATH = "$HOME/src/go";
|
||||||
home.sessionVariables.PATH = pkgs.lib.concatStringsSep ":" ["$HOME/.local/bin" "$PATH"];
|
home.sessionVariables.PATH = pkgs.lib.concatStringsSep ":" [
|
||||||
|
"$HOME/.local/bin"
|
||||||
|
"$PATH"
|
||||||
|
];
|
||||||
|
|
||||||
nixpkgs.config.allowInsecurePredicate = pkg:
|
nixpkgs.config.allowInsecurePredicate =
|
||||||
|
pkg:
|
||||||
builtins.elem (lib.getName pkg) [
|
builtins.elem (lib.getName pkg) [
|
||||||
"electron-28.3.3"
|
"electron-28.3.3"
|
||||||
"electron-27.3.11"
|
"electron-27.3.11"
|
||||||
|
|
@ -68,7 +70,7 @@ in {
|
||||||
# ];
|
# ];
|
||||||
|
|
||||||
home.packages =
|
home.packages =
|
||||||
[]
|
[ ]
|
||||||
++ (with pkgs; [
|
++ (with pkgs; [
|
||||||
# Authentication
|
# Authentication
|
||||||
# cacert
|
# cacert
|
||||||
|
|
@ -246,19 +248,15 @@ in {
|
||||||
# libretro.snes9x2010
|
# libretro.snes9x2010
|
||||||
# retroarchFull
|
# retroarchFull
|
||||||
|
|
||||||
(
|
(pkgs.logseq.overrideAttrs (
|
||||||
pkgs.logseq.overrideAttrs (
|
|
||||||
attrs:
|
attrs:
|
||||||
lib.attrsets.recursiveUpdate
|
lib.attrsets.recursiveUpdate attrs (
|
||||||
attrs
|
|
||||||
(
|
|
||||||
lib.attrsets.optionalAttrs pkgs.stdenv.isAarch64 {
|
lib.attrsets.optionalAttrs pkgs.stdenv.isAarch64 {
|
||||||
src = repoFlake.inputs.logseq_0_10_9_aarch64_appimage;
|
src = repoFlake.inputs.logseq_0_10_9_aarch64_appimage;
|
||||||
meta.platforms = ["aarch64-linux"];
|
meta.platforms = [ "aarch64-linux" ];
|
||||||
}
|
}
|
||||||
)
|
)
|
||||||
)
|
))
|
||||||
)
|
|
||||||
|
|
||||||
# (
|
# (
|
||||||
# pkgsUnstable.callPackage (repoFlake + "/nix/pkgs/logseq")
|
# pkgsUnstable.callPackage (repoFlake + "/nix/pkgs/logseq")
|
||||||
|
|
@ -267,8 +265,7 @@ in {
|
||||||
# })
|
# })
|
||||||
# )
|
# )
|
||||||
])
|
])
|
||||||
++ (lib.lists.optionals (!pkgs.stdenv.targetPlatform.isAarch64) [
|
++ (lib.lists.optionals (!pkgs.stdenv.targetPlatform.isAarch64) [ ])
|
||||||
])
|
|
||||||
++ (lib.lists.optionals (!pkgs.stdenv.targetPlatform.isAarch64) [
|
++ (lib.lists.optionals (!pkgs.stdenv.targetPlatform.isAarch64) [
|
||||||
pkgsUnstable.ledger-live-desktop
|
pkgsUnstable.ledger-live-desktop
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -1,10 +1,7 @@
|
||||||
|
{ pkgs, config, ... }:
|
||||||
{
|
{
|
||||||
pkgs,
|
|
||||||
config,
|
|
||||||
...
|
|
||||||
}: {
|
|
||||||
home.packages =
|
home.packages =
|
||||||
[]
|
[ ]
|
||||||
++ (with pkgs; [
|
++ (with pkgs; [
|
||||||
gnome.gnome-tweaks
|
gnome.gnome-tweaks
|
||||||
gnome.gnome-keyring
|
gnome.gnome-keyring
|
||||||
|
|
|
||||||
|
|
@ -1,8 +1,5 @@
|
||||||
|
{ pkgs, config, ... }:
|
||||||
{
|
{
|
||||||
pkgs,
|
|
||||||
config,
|
|
||||||
...
|
|
||||||
}: {
|
|
||||||
imports = [
|
imports = [
|
||||||
../profiles/common.nix
|
../profiles/common.nix
|
||||||
../profiles/qtile-desktop.nix
|
../profiles/qtile-desktop.nix
|
||||||
|
|
@ -17,7 +14,7 @@
|
||||||
];
|
];
|
||||||
|
|
||||||
home.packages =
|
home.packages =
|
||||||
[]
|
[ ]
|
||||||
++ (with pkgs; [
|
++ (with pkgs; [
|
||||||
# Nix package related tools
|
# Nix package related tools
|
||||||
patchelf
|
patchelf
|
||||||
|
|
|
||||||
|
|
@ -1,14 +1,22 @@
|
||||||
{}: let
|
{ }:
|
||||||
in {
|
let
|
||||||
mkSimpleTrayService = {execStart}: {
|
in
|
||||||
|
{
|
||||||
|
mkSimpleTrayService =
|
||||||
|
{ execStart }:
|
||||||
|
{
|
||||||
Unit = {
|
Unit = {
|
||||||
Description = "";
|
Description = "";
|
||||||
After = ["graphical-session-pre.target"];
|
After = [ "graphical-session-pre.target" ];
|
||||||
PartOf = ["graphical-session.target"];
|
PartOf = [ "graphical-session.target" ];
|
||||||
};
|
};
|
||||||
|
|
||||||
Install = {WantedBy = ["graphical-session.target"];};
|
Install = {
|
||||||
|
WantedBy = [ "graphical-session.target" ];
|
||||||
|
};
|
||||||
|
|
||||||
Service = {ExecStart = execStart;};
|
Service = {
|
||||||
|
ExecStart = execStart;
|
||||||
|
};
|
||||||
};
|
};
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -1,8 +1,5 @@
|
||||||
|
{ pkgs, lib, ... }:
|
||||||
{
|
{
|
||||||
pkgs,
|
|
||||||
lib,
|
|
||||||
...
|
|
||||||
}: {
|
|
||||||
home.stateVersion = lib.mkDefault "23.11";
|
home.stateVersion = lib.mkDefault "23.11";
|
||||||
|
|
||||||
# TODO: re-enable this with the appropriate version?
|
# TODO: re-enable this with the appropriate version?
|
||||||
|
|
@ -15,7 +12,8 @@
|
||||||
allowUnfree = true;
|
allowUnfree = true;
|
||||||
allowUnsupportedSystem = true;
|
allowUnsupportedSystem = true;
|
||||||
|
|
||||||
allowInsecurePredicate = pkg:
|
allowInsecurePredicate =
|
||||||
|
pkg:
|
||||||
builtins.elem (lib.getName pkg) [
|
builtins.elem (lib.getName pkg) [
|
||||||
"electron-28.3.3"
|
"electron-28.3.3"
|
||||||
"electron-27.3.11"
|
"electron-27.3.11"
|
||||||
|
|
@ -28,7 +26,8 @@
|
||||||
"electron"
|
"electron"
|
||||||
];
|
];
|
||||||
|
|
||||||
allowUnfreePredicate = pkg:
|
allowUnfreePredicate =
|
||||||
|
pkg:
|
||||||
builtins.elem (lib.getName pkg) [
|
builtins.elem (lib.getName pkg) [
|
||||||
"obsidian"
|
"obsidian"
|
||||||
"vivaldi"
|
"vivaldi"
|
||||||
|
|
@ -57,7 +56,7 @@
|
||||||
programs.fzf.enable = true;
|
programs.fzf.enable = true;
|
||||||
|
|
||||||
home.packages =
|
home.packages =
|
||||||
[]
|
[ ]
|
||||||
++ (with pkgs; [
|
++ (with pkgs; [
|
||||||
coreutils
|
coreutils
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -5,14 +5,16 @@
|
||||||
repoHttps ? "https://gitlab.com/steveeJ/dotfiles.git",
|
repoHttps ? "https://gitlab.com/steveeJ/dotfiles.git",
|
||||||
repoSsh ? "git@gitlab.com:/steveeJ/dotfiles.git",
|
repoSsh ? "git@gitlab.com:/steveeJ/dotfiles.git",
|
||||||
...
|
...
|
||||||
}: let
|
}:
|
||||||
|
let
|
||||||
repoBareLocal =
|
repoBareLocal =
|
||||||
pkgs.runCommand "fetchbare"
|
pkgs.runCommand "fetchbare"
|
||||||
{
|
{
|
||||||
outputHashMode = "recursive";
|
outputHashMode = "recursive";
|
||||||
outputHashAlgo = "sha256";
|
outputHashAlgo = "sha256";
|
||||||
outputHash = "0000000000000000000000000000000000000000000000000000";
|
outputHash = "0000000000000000000000000000000000000000000000000000";
|
||||||
} ''
|
}
|
||||||
|
''
|
||||||
(
|
(
|
||||||
set -xe
|
set -xe
|
||||||
export GIT_SSL_CAINFO=${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt
|
export GIT_SSL_CAINFO=${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt
|
||||||
|
|
@ -39,7 +41,8 @@
|
||||||
set_remotes ${repoHttps} ${repoSsh}
|
set_remotes ${repoHttps} ${repoSsh}
|
||||||
fi
|
fi
|
||||||
'';
|
'';
|
||||||
in {
|
in
|
||||||
|
{
|
||||||
# TODO: fix the dotfiles
|
# TODO: fix the dotfiles
|
||||||
# home.activation.vcsh = config.lib.dag.entryAfter["linkGeneration"] ''
|
# home.activation.vcsh = config.lib.dag.entryAfter["linkGeneration"] ''
|
||||||
# $DRY_RUN_CMD ${vcshActivationScript}
|
# $DRY_RUN_CMD ${vcshActivationScript}
|
||||||
|
|
|
||||||
|
|
@ -3,14 +3,16 @@
|
||||||
repoHttps ? "https://gitlab.com/steveeJ/dotfiles.git",
|
repoHttps ? "https://gitlab.com/steveeJ/dotfiles.git",
|
||||||
repoSsh ? "git@gitlab.com:/steveeJ/dotfiles.git",
|
repoSsh ? "git@gitlab.com:/steveeJ/dotfiles.git",
|
||||||
...
|
...
|
||||||
}: let
|
}:
|
||||||
|
let
|
||||||
repoBareLocal =
|
repoBareLocal =
|
||||||
pkgs.runCommand "fetchbare"
|
pkgs.runCommand "fetchbare"
|
||||||
{
|
{
|
||||||
outputHashMode = "recursive";
|
outputHashMode = "recursive";
|
||||||
outputHashAlgo = "sha256";
|
outputHashAlgo = "sha256";
|
||||||
outputHash = "0000000000000000000000000000000000000000000000000000";
|
outputHash = "0000000000000000000000000000000000000000000000000000";
|
||||||
} ''
|
}
|
||||||
|
''
|
||||||
(
|
(
|
||||||
set -xe
|
set -xe
|
||||||
export GIT_SSL_CAINFO=${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt
|
export GIT_SSL_CAINFO=${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt
|
||||||
|
|
@ -19,7 +21,7 @@
|
||||||
)
|
)
|
||||||
'';
|
'';
|
||||||
in
|
in
|
||||||
pkgs.writeScript "activation-script" ''
|
pkgs.writeScript "activation-script" ''
|
||||||
export HOST=$(hostname -s)
|
export HOST=$(hostname -s)
|
||||||
|
|
||||||
function set_remotes {
|
function set_remotes {
|
||||||
|
|
@ -37,4 +39,4 @@ in
|
||||||
${pkgs.vcsh}/bin/vcsh pull $HOST || true
|
${pkgs.vcsh}/bin/vcsh pull $HOST || true
|
||||||
set_remotes ${repoHttps} ${repoSsh}
|
set_remotes ${repoHttps} ${repoSsh}
|
||||||
fi
|
fi
|
||||||
''
|
''
|
||||||
|
|
|
||||||
|
|
@ -5,12 +5,12 @@
|
||||||
nodeFlake,
|
nodeFlake,
|
||||||
packages',
|
packages',
|
||||||
...
|
...
|
||||||
}: let
|
}:
|
||||||
pkgsUnstable = pkgs.callPackage nodeFlake.inputs.nixpkgs-unstable.outPath {};
|
let
|
||||||
in {
|
pkgsUnstable = pkgs.callPackage nodeFlake.inputs.nixpkgs-unstable.outPath { };
|
||||||
imports = [
|
in
|
||||||
../profiles/wayland-desktop.nix
|
{
|
||||||
];
|
imports = [ ../profiles/wayland-desktop.nix ];
|
||||||
|
|
||||||
home.packages = [
|
home.packages = [
|
||||||
# experimental WMs
|
# experimental WMs
|
||||||
|
|
|
||||||
|
|
@ -3,11 +3,11 @@
|
||||||
config,
|
config,
|
||||||
lib,
|
lib,
|
||||||
...
|
...
|
||||||
}: let
|
}:
|
||||||
in {
|
let
|
||||||
imports = [
|
in
|
||||||
../profiles/wayland-desktop.nix
|
{
|
||||||
];
|
imports = [ ../profiles/wayland-desktop.nix ];
|
||||||
|
|
||||||
services = {
|
services = {
|
||||||
gnome-keyring.enable = false;
|
gnome-keyring.enable = false;
|
||||||
|
|
@ -25,7 +25,8 @@ in {
|
||||||
|
|
||||||
services.gpg-agent.pinentryPackage = pkgs.pinentry-gnome3;
|
services.gpg-agent.pinentryPackage = pkgs.pinentry-gnome3;
|
||||||
|
|
||||||
dconf.settings = let
|
dconf.settings =
|
||||||
|
let
|
||||||
manualKeybindings = [
|
manualKeybindings = [
|
||||||
{
|
{
|
||||||
binding = "Print";
|
binding = "Print";
|
||||||
|
|
@ -42,68 +43,65 @@ in {
|
||||||
|
|
||||||
numWorkspaces = 10;
|
numWorkspaces = 10;
|
||||||
customKeybindingBaseName = "org/gnome/settings-daemon/plugins/media-keys/custom-keybindings/custom";
|
customKeybindingBaseName = "org/gnome/settings-daemon/plugins/media-keys/custom-keybindings/custom";
|
||||||
customKeybindingsNames =
|
customKeybindingsNames = builtins.genList (i: "/${customKeybindingBaseName}${toString i}/") (
|
||||||
builtins.genList (i: "/${customKeybindingBaseName}${toString i}/")
|
(builtins.length manualKeybindings) + numWorkspaces # for sending to the workspace
|
||||||
(
|
|
||||||
(builtins.length manualKeybindings)
|
|
||||||
+ numWorkspaces # for sending to the workspace
|
|
||||||
);
|
);
|
||||||
|
|
||||||
workspacesKeyBindingsOffset = builtins.length manualKeybindings;
|
workspacesKeyBindingsOffset = builtins.length manualKeybindings;
|
||||||
|
|
||||||
# with this we can make use of all number keys [0-9]
|
# with this we can make use of all number keys [0-9]
|
||||||
mapToNumber = i:
|
mapToNumber =
|
||||||
if i < 10
|
i:
|
||||||
then i
|
if i < 10 then
|
||||||
else if i == 10
|
i
|
||||||
then 0
|
else if i == 10 then
|
||||||
else throw "i exceeds 10: ${i}";
|
0
|
||||||
|
else
|
||||||
|
throw "i exceeds 10: ${i}";
|
||||||
in
|
in
|
||||||
{
|
{
|
||||||
"org/gnome/settings-daemon/plugins/media-keys" = {
|
"org/gnome/settings-daemon/plugins/media-keys" = {
|
||||||
custom-keybindings = customKeybindingsNames;
|
custom-keybindings = customKeybindingsNames;
|
||||||
screenreader = "@as []";
|
screenreader = "@as []";
|
||||||
screensaver = ["<Alt><Super>l"];
|
screensaver = [ "<Alt><Super>l" ];
|
||||||
};
|
};
|
||||||
|
|
||||||
# disable the builtin <Super>[1-9] functionality
|
# disable the builtin <Super>[1-9] functionality
|
||||||
"org/gnome/shell/keybindings" = builtins.listToAttrs ((builtins.genList
|
"org/gnome/shell/keybindings" = builtins.listToAttrs (
|
||||||
(i: {
|
(builtins.genList (i: {
|
||||||
name = "switch-to-application-${toString (i + 1)}";
|
name = "switch-to-application-${toString (i + 1)}";
|
||||||
value = [];
|
value = [ ];
|
||||||
})
|
}) numWorkspaces)
|
||||||
numWorkspaces)
|
|
||||||
++ [
|
++ [
|
||||||
{
|
{
|
||||||
name = "toggle-overview";
|
name = "toggle-overview";
|
||||||
value = [];
|
value = [ ];
|
||||||
}
|
}
|
||||||
]);
|
]
|
||||||
|
);
|
||||||
|
|
||||||
# remap it to switching to the workspaces
|
# remap it to switching to the workspaces
|
||||||
"org/gnome/desktop/wm/keybindings" = builtins.listToAttrs (builtins.genList
|
"org/gnome/desktop/wm/keybindings" = builtins.listToAttrs (
|
||||||
(i: {
|
builtins.genList (i: {
|
||||||
name = "switch-to-workspace-${toString (i + 1)}";
|
name = "switch-to-workspace-${toString (i + 1)}";
|
||||||
value = [
|
value = [ "<Super>${toString (mapToNumber (i + 1))}" ];
|
||||||
"<Super>${toString (mapToNumber (i + 1))}"
|
}) numWorkspaces
|
||||||
];
|
);
|
||||||
})
|
|
||||||
numWorkspaces);
|
|
||||||
}
|
}
|
||||||
// builtins.listToAttrs (builtins.genList
|
// builtins.listToAttrs (
|
||||||
(i: {
|
builtins.genList (i: {
|
||||||
name = "${customKeybindingBaseName}${toString i}";
|
name = "${customKeybindingBaseName}${toString i}";
|
||||||
value = builtins.elemAt manualKeybindings i;
|
value = builtins.elemAt manualKeybindings i;
|
||||||
})
|
}) (builtins.length manualKeybindings)
|
||||||
(builtins.length manualKeybindings))
|
)
|
||||||
// builtins.listToAttrs (builtins.genList
|
// builtins.listToAttrs (
|
||||||
(i: {
|
builtins.genList (i: {
|
||||||
name = "${customKeybindingBaseName}${toString (workspacesKeyBindingsOffset + i)}";
|
name = "${customKeybindingBaseName}${toString (workspacesKeyBindingsOffset + i)}";
|
||||||
value = {
|
value = {
|
||||||
binding = "<Control><Super>${toString (mapToNumber (i + 1))}";
|
binding = "<Control><Super>${toString (mapToNumber (i + 1))}";
|
||||||
command = "wmctrl -r :ACTIVE: -t ${toString i}";
|
command = "wmctrl -r :ACTIVE: -t ${toString i}";
|
||||||
name = "Send to workspace ${toString (i + 1)}";
|
name = "Send to workspace ${toString (i + 1)}";
|
||||||
};
|
};
|
||||||
})
|
}) numWorkspaces
|
||||||
numWorkspaces);
|
);
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -1,14 +1,11 @@
|
||||||
|
{ pkgs, config, ... }:
|
||||||
|
let
|
||||||
|
in
|
||||||
{
|
{
|
||||||
pkgs,
|
|
||||||
config,
|
|
||||||
...
|
|
||||||
}: let
|
|
||||||
in {
|
|
||||||
home.file.".nix-channels".text = "";
|
home.file.".nix-channels".text = "";
|
||||||
|
|
||||||
home.activation.removeExistingNixChannels = config.lib.dag.entryBefore ["checkLinkTargets"] ''
|
home.activation.removeExistingNixChannels = config.lib.dag.entryBefore [ "checkLinkTargets" ] ''
|
||||||
$DRY_RUN_CMD ${
|
$DRY_RUN_CMD ${pkgs.writeScript "activation-script" ''
|
||||||
pkgs.writeScript "activation-script" ''
|
|
||||||
set -ex
|
set -ex
|
||||||
if test -f $HOME/.nix-channels; then
|
if test -f $HOME/.nix-channels; then
|
||||||
echo Uninstalling available channels...
|
echo Uninstalling available channels...
|
||||||
|
|
@ -22,7 +19,6 @@ in {
|
||||||
mv --backup=numbered $HOME/.nix-channels.dummy $HOME/.nix-channels
|
mv --backup=numbered $HOME/.nix-channels.dummy $HOME/.nix-channels
|
||||||
rm $HOME/.nix-channels
|
rm $HOME/.nix-channels
|
||||||
fi
|
fi
|
||||||
''
|
''};
|
||||||
};
|
|
||||||
'';
|
'';
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -1,14 +1,15 @@
|
||||||
{
|
{ pkgs, config, ... }:
|
||||||
pkgs,
|
let
|
||||||
config,
|
inherit (import ../lib.nix { }) mkSimpleTrayService;
|
||||||
...
|
|
||||||
}: let
|
|
||||||
inherit (import ../lib.nix {}) mkSimpleTrayService;
|
|
||||||
|
|
||||||
audio = pkgs.writeShellScript "audio" ''
|
audio = pkgs.writeShellScript "audio" ''
|
||||||
export PATH=${
|
export PATH=${
|
||||||
with pkgs;
|
with pkgs;
|
||||||
lib.makeBinPath [pulseaudio findutils gnugrep]
|
lib.makeBinPath [
|
||||||
|
pulseaudio
|
||||||
|
findutils
|
||||||
|
gnugrep
|
||||||
|
]
|
||||||
}:$PATH
|
}:$PATH
|
||||||
|
|
||||||
export MUTEFILE=''${TEMPDIR:-/tmp}/.qtilemute
|
export MUTEFILE=''${TEMPDIR:-/tmp}/.qtilemute
|
||||||
|
|
@ -33,7 +34,7 @@
|
||||||
terminalCommand = "${pkgs.alacritty}/bin/alacritty";
|
terminalCommand = "${pkgs.alacritty}/bin/alacritty";
|
||||||
|
|
||||||
dpmsScript = pkgs.writeShellScript "dpmsScript" ''
|
dpmsScript = pkgs.writeShellScript "dpmsScript" ''
|
||||||
export PATH=${with pkgs; lib.makeBinPath [xorg.xset]}:$PATH
|
export PATH=${with pkgs; lib.makeBinPath [ xorg.xset ]}:$PATH
|
||||||
|
|
||||||
set -xe
|
set -xe
|
||||||
|
|
||||||
|
|
@ -56,7 +57,7 @@
|
||||||
'';
|
'';
|
||||||
|
|
||||||
screenLockCommand = pkgs.writeShellScript "screenLock" ''
|
screenLockCommand = pkgs.writeShellScript "screenLock" ''
|
||||||
export PATH=${with pkgs; lib.makeBinPath [i3lock]}:$PATH
|
export PATH=${with pkgs; lib.makeBinPath [ i3lock ]}:$PATH
|
||||||
|
|
||||||
revert() {
|
revert() {
|
||||||
${dpmsScript} default
|
${dpmsScript} default
|
||||||
|
|
@ -251,7 +252,8 @@
|
||||||
def print_new_window(window):
|
def print_new_window(window):
|
||||||
print("new window: ", window)
|
print("new window: ", window)
|
||||||
'';
|
'';
|
||||||
in {
|
in
|
||||||
|
{
|
||||||
services = {
|
services = {
|
||||||
gnome-keyring.enable = true;
|
gnome-keyring.enable = true;
|
||||||
blueman-applet.enable = true;
|
blueman-applet.enable = true;
|
||||||
|
|
|
||||||
|
|
@ -1,19 +1,19 @@
|
||||||
/*
|
/*
|
||||||
TODO: create helper scripts for sharing of a screen portion
|
TODO: create helper scripts for sharing of a screen portion
|
||||||
```
|
```
|
||||||
|
|
||||||
# this will create a new output named HEADLESS-<n>. <n> increments by 1 with each invocation even if the output is `unplug`ged.
|
# this will create a new output named HEADLESS-<n>. <n> increments by 1 with each invocation even if the output is `unplug`ged.
|
||||||
swaymsg create_output
|
swaymsg create_output
|
||||||
|
|
||||||
# find the name and the workspace number
|
# find the name and the workspace number
|
||||||
swaymsg -t get_outputs | jq '.[] | select(.name | test("HEADLESS-.*")) | (.name, .current_workspace)'
|
swaymsg -t get_outputs | jq '.[] | select(.name | test("HEADLESS-.*")) | (.name, .current_workspace)'
|
||||||
|
|
||||||
swaymsg output HEADLESS-1 mode 1920@108060Hz
|
swaymsg output HEADLESS-1 mode 1920@108060Hz
|
||||||
|
|
||||||
# mirror the headless workspace on the current one
|
# mirror the headless workspace on the current one
|
||||||
nix run nixpkgs\#wl-mirror -- HEADLESS-1
|
nix run nixpkgs\#wl-mirror -- HEADLESS-1
|
||||||
|
|
||||||
# shift windows to the workspace and switch the focus to it
|
# shift windows to the workspace and switch the focus to it
|
||||||
*/
|
*/
|
||||||
{
|
{
|
||||||
pkgs,
|
pkgs,
|
||||||
|
|
@ -22,14 +22,16 @@ nix run nixpkgs\#wl-mirror -- HEADLESS-1
|
||||||
# packages',
|
# packages',
|
||||||
repoFlakeInputs',
|
repoFlakeInputs',
|
||||||
...
|
...
|
||||||
}: let
|
}:
|
||||||
inherit (import ../lib.nix {}) mkSimpleTrayService;
|
let
|
||||||
|
inherit (import ../lib.nix { }) mkSimpleTrayService;
|
||||||
|
|
||||||
lockCmd = "${pkgs.swaylock}/bin/swaylock -efF --color '#000000'";
|
lockCmd = "${pkgs.swaylock}/bin/swaylock -efF --color '#000000'";
|
||||||
displayOffCmd = "${pkgs.sway}/bin/swaymsg 'output * power off'";
|
displayOffCmd = "${pkgs.sway}/bin/swaymsg 'output * power off'";
|
||||||
displayOnCmd = "${pkgs.sway}/bin/swaymsg 'output * power on'";
|
displayOnCmd = "${pkgs.sway}/bin/swaymsg 'output * power on'";
|
||||||
swapOutputWorkspaces = ../../../scripts/sway-swapoutputworkspaces.sh;
|
swapOutputWorkspaces = ../../../scripts/sway-swapoutputworkspaces.sh;
|
||||||
in {
|
in
|
||||||
|
{
|
||||||
imports = [
|
imports = [
|
||||||
../profiles/wayland-desktop.nix
|
../profiles/wayland-desktop.nix
|
||||||
../programs/waybar.nix
|
../programs/waybar.nix
|
||||||
|
|
@ -98,12 +100,19 @@ in {
|
||||||
systemd.enable = true;
|
systemd.enable = true;
|
||||||
xwayland = false;
|
xwayland = false;
|
||||||
|
|
||||||
config = let
|
config =
|
||||||
|
let
|
||||||
modifier = "Mod4";
|
modifier = "Mod4";
|
||||||
inherit (config.wayland.windowManager.sway.config) left right up down;
|
inherit (config.wayland.windowManager.sway.config)
|
||||||
in {
|
left
|
||||||
|
right
|
||||||
|
up
|
||||||
|
down
|
||||||
|
;
|
||||||
|
in
|
||||||
|
{
|
||||||
inherit modifier;
|
inherit modifier;
|
||||||
bars = [];
|
bars = [ ];
|
||||||
|
|
||||||
input = {
|
input = {
|
||||||
"type:keyboard" =
|
"type:keyboard" =
|
||||||
|
|
@ -111,7 +120,7 @@ in {
|
||||||
xkb_layout = config.home.keyboard.layout;
|
xkb_layout = config.home.keyboard.layout;
|
||||||
xkb_variant = config.home.keyboard.variant;
|
xkb_variant = config.home.keyboard.variant;
|
||||||
}
|
}
|
||||||
// lib.attrsets.optionalAttrs (builtins.length (config.home.keyboard.options or []) > 0) {
|
// lib.attrsets.optionalAttrs (builtins.length (config.home.keyboard.options or [ ]) > 0) {
|
||||||
xkb_options = builtins.concatStringsSep "," config.home.keyboard.options;
|
xkb_options = builtins.concatStringsSep "," config.home.keyboard.options;
|
||||||
};
|
};
|
||||||
|
|
||||||
|
|
@ -175,28 +184,30 @@ in {
|
||||||
startup =
|
startup =
|
||||||
[
|
[
|
||||||
{
|
{
|
||||||
command = builtins.toString (pkgs.writeShellScript "ensure-graphical-session" ''
|
command = builtins.toString (
|
||||||
|
pkgs.writeShellScript "ensure-graphical-session" ''
|
||||||
(
|
(
|
||||||
${pkgs.coreutils}/bin/sleep 0.2
|
${pkgs.coreutils}/bin/sleep 0.2
|
||||||
${pkgs.systemd}/bin/systemctl --user restart graphical-session.target
|
${pkgs.systemd}/bin/systemctl --user restart graphical-session.target
|
||||||
) &
|
) &
|
||||||
'');
|
''
|
||||||
|
);
|
||||||
}
|
}
|
||||||
]
|
]
|
||||||
++ lib.optionals config.services.swayidle.enable [
|
++ lib.optionals config.services.swayidle.enable [
|
||||||
{
|
{
|
||||||
command = builtins.toString (pkgs.writeShellScript "ensure-graphical-session" ''
|
command = builtins.toString (
|
||||||
|
pkgs.writeShellScript "ensure-graphical-session" ''
|
||||||
(
|
(
|
||||||
${pkgs.coreutils}/bin/sleep 0.2
|
${pkgs.coreutils}/bin/sleep 0.2
|
||||||
${pkgs.systemd}/bin/systemctl --user restart swayidle
|
${pkgs.systemd}/bin/systemctl --user restart swayidle
|
||||||
) &
|
) &
|
||||||
'');
|
''
|
||||||
|
);
|
||||||
}
|
}
|
||||||
];
|
];
|
||||||
|
|
||||||
colors.focused = lib.mkOptionDefault {
|
colors.focused = lib.mkOptionDefault { childBorder = lib.mkForce "#ffa500"; };
|
||||||
childBorder = lib.mkForce "#ffa500";
|
|
||||||
};
|
|
||||||
|
|
||||||
window.titlebar = false;
|
window.titlebar = false;
|
||||||
window.border = 4;
|
window.border = 4;
|
||||||
|
|
|
||||||
|
|
@ -5,12 +5,14 @@
|
||||||
repoFlake,
|
repoFlake,
|
||||||
nodeFlake,
|
nodeFlake,
|
||||||
...
|
...
|
||||||
}: let
|
}:
|
||||||
inherit (import ../lib.nix {}) mkSimpleTrayService;
|
let
|
||||||
|
inherit (import ../lib.nix { }) mkSimpleTrayService;
|
||||||
|
|
||||||
nixpkgs-wayland' = repoFlake.inputs.nixpkgs-wayland.packages.${pkgs.system};
|
nixpkgs-wayland' = repoFlake.inputs.nixpkgs-wayland.packages.${pkgs.system};
|
||||||
wayprompt = nixpkgs-wayland'.wayprompt;
|
wayprompt = nixpkgs-wayland'.wayprompt;
|
||||||
in {
|
in
|
||||||
|
{
|
||||||
fonts.fontconfig.enable = true;
|
fonts.fontconfig.enable = true;
|
||||||
|
|
||||||
# services.gpg-agent.pinentryFlavor = lib.mkForce null;
|
# services.gpg-agent.pinentryFlavor = lib.mkForce null;
|
||||||
|
|
@ -26,11 +28,12 @@ in {
|
||||||
systemd.user.targets.tray = {
|
systemd.user.targets.tray = {
|
||||||
Unit = {
|
Unit = {
|
||||||
Description = "Home Manager System Tray";
|
Description = "Home Manager System Tray";
|
||||||
Requires = ["graphical-session-pre.target"];
|
Requires = [ "graphical-session-pre.target" ];
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
home.packages = with pkgs;
|
home.packages =
|
||||||
|
with pkgs;
|
||||||
[
|
[
|
||||||
# required by network-manager-applet
|
# required by network-manager-applet
|
||||||
networkmanagerapplet
|
networkmanagerapplet
|
||||||
|
|
@ -62,11 +65,9 @@ in {
|
||||||
|
|
||||||
waypipe
|
waypipe
|
||||||
]
|
]
|
||||||
++ (
|
++ (lib.lists.optionals (!pkgs.stdenv.isAarch64)
|
||||||
lib.lists.optionals (!pkgs.stdenv.isAarch64)
|
|
||||||
# TODO: broken on aarch64
|
# TODO: broken on aarch64
|
||||||
[
|
[ ]
|
||||||
]
|
|
||||||
);
|
);
|
||||||
|
|
||||||
home.sessionVariables = {
|
home.sessionVariables = {
|
||||||
|
|
|
||||||
|
|
@ -3,14 +3,15 @@
|
||||||
lib,
|
lib,
|
||||||
pkgs,
|
pkgs,
|
||||||
...
|
...
|
||||||
}: let
|
}:
|
||||||
|
let
|
||||||
extensions =
|
extensions =
|
||||||
[
|
[
|
||||||
#undetectable adblocker
|
#undetectable adblocker
|
||||||
{id = "gcfcpohokifjldeandkfjoboemihipmb";}
|
{ id = "gcfcpohokifjldeandkfjoboemihipmb"; }
|
||||||
|
|
||||||
# ublock origin
|
# ublock origin
|
||||||
{id = "cjpalhdlnbpafiamejdnhcphjbkeiagm";}
|
{ id = "cjpalhdlnbpafiamejdnhcphjbkeiagm"; }
|
||||||
|
|
||||||
# # YT ad block
|
# # YT ad block
|
||||||
# {id = "cmedhionkhpnakcndndgjdbohmhepckk";}
|
# {id = "cmedhionkhpnakcndndgjdbohmhepckk";}
|
||||||
|
|
@ -19,15 +20,15 @@
|
||||||
# {id = "cfhdojbkjhnklbpkdaibdccddilifddb";}
|
# {id = "cfhdojbkjhnklbpkdaibdccddilifddb";}
|
||||||
|
|
||||||
# Cookie Notice Blocker
|
# Cookie Notice Blocker
|
||||||
{id = "odhmfmnoejhihkmfebnolljiibpnednn";}
|
{ id = "odhmfmnoejhihkmfebnolljiibpnednn"; }
|
||||||
# i don't care about cookies
|
# i don't care about cookies
|
||||||
{id = "fihnjjcciajhdojfnbdddfaoknhalnja";}
|
{ id = "fihnjjcciajhdojfnbdddfaoknhalnja"; }
|
||||||
|
|
||||||
# NopeCHA
|
# NopeCHA
|
||||||
{id = "dknlfmjaanfblgfdfebhijalfmhmjjjo";}
|
{ id = "dknlfmjaanfblgfdfebhijalfmhmjjjo"; }
|
||||||
|
|
||||||
# h264ify
|
# h264ify
|
||||||
{id = "aleakchihdccplidncghkekgioiakgal";}
|
{ id = "aleakchihdccplidncghkekgioiakgal"; }
|
||||||
|
|
||||||
# clippy
|
# clippy
|
||||||
# {id = "honbeilkanbghjimjoniipnnehlmhggk"}
|
# {id = "honbeilkanbghjimjoniipnnehlmhggk"}
|
||||||
|
|
@ -38,31 +39,32 @@
|
||||||
}
|
}
|
||||||
|
|
||||||
# cookie autodelete
|
# cookie autodelete
|
||||||
{id = "fhcgjolkccmbidfldomjliifgaodjagh";}
|
{ id = "fhcgjolkccmbidfldomjliifgaodjagh"; }
|
||||||
|
|
||||||
# unhook
|
# unhook
|
||||||
{id = "khncfooichmfjbepaaaebmommgaepoid";}
|
{ id = "khncfooichmfjbepaaaebmommgaepoid"; }
|
||||||
]
|
]
|
||||||
++ (lib.lists.optionals ((builtins.match "^steveej.*" name) != null) [
|
++ (lib.lists.optionals ((builtins.match "^steveej.*" name) != null) [
|
||||||
# polkadotjs
|
# polkadotjs
|
||||||
{id = "mopnmbcafieddcagagdcbnhejhlodfdd";}
|
{ id = "mopnmbcafieddcagagdcbnhejhlodfdd"; }
|
||||||
|
|
||||||
# rabby wallet
|
# rabby wallet
|
||||||
{id = "acmacodkjbdgmoleebolmdjonilkdbch";}
|
{ id = "acmacodkjbdgmoleebolmdjonilkdbch"; }
|
||||||
|
|
||||||
# phantom wallet
|
# phantom wallet
|
||||||
{id = "bfnaelmomeimhlpmgjnjophhpkkoljpa";}
|
{ id = "bfnaelmomeimhlpmgjnjophhpkkoljpa"; }
|
||||||
|
|
||||||
# Vimium C
|
# Vimium C
|
||||||
{id = "hfjbmagddngcpeloejdejnfgbamkjaeg";}
|
{ id = "hfjbmagddngcpeloejdejnfgbamkjaeg"; }
|
||||||
|
|
||||||
# always right
|
# always right
|
||||||
{id = "npjpaghfnndnnmjiliibnkmdfgbojokj";}
|
{ id = "npjpaghfnndnnmjiliibnkmdfgbojokj"; }
|
||||||
|
|
||||||
# shazam music
|
# shazam music
|
||||||
{id = "mmioliijnhnoblpgimnlajmefafdfilb";}
|
{ id = "mmioliijnhnoblpgimnlajmefafdfilb"; }
|
||||||
]);
|
]);
|
||||||
in {
|
in
|
||||||
|
{
|
||||||
programs.chromium = {
|
programs.chromium = {
|
||||||
enable = true;
|
enable = true;
|
||||||
inherit extensions;
|
inherit extensions;
|
||||||
|
|
@ -72,9 +74,7 @@ in {
|
||||||
|
|
||||||
programs.brave = {
|
programs.brave = {
|
||||||
# TODO: enable this on aarch64-linux
|
# TODO: enable this on aarch64-linux
|
||||||
enable =
|
enable = true && !pkgs.stdenv.targetPlatform.isAarch64;
|
||||||
true
|
|
||||||
&& !pkgs.stdenv.targetPlatform.isAarch64;
|
|
||||||
inherit extensions;
|
inherit extensions;
|
||||||
};
|
};
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -1,8 +1,5 @@
|
||||||
|
{ pkgs, repoFlake, ... }:
|
||||||
{
|
{
|
||||||
pkgs,
|
|
||||||
repoFlake,
|
|
||||||
...
|
|
||||||
}: {
|
|
||||||
services.espanso = {
|
services.espanso = {
|
||||||
package = pkgs.espanso-wayland;
|
package = pkgs.espanso-wayland;
|
||||||
# package = pkgs.espanso-wayland.overrideAttrs (_: {
|
# package = pkgs.espanso-wayland.overrideAttrs (_: {
|
||||||
|
|
@ -24,10 +21,11 @@
|
||||||
# backend = "Clipboard";
|
# backend = "Clipboard";
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
matches = let
|
matches =
|
||||||
playerctl = ''
|
let
|
||||||
${pkgs.coreutils}/bin/env DBUS_SESSION_BUS_ADDRESS="unix:path=/run/user/$(${pkgs.coreutils}/bin/id -u)/bus" ${pkgs.playerctl}/bin/playerctl'';
|
playerctl = ''${pkgs.coreutils}/bin/env DBUS_SESSION_BUS_ADDRESS="unix:path=/run/user/$(${pkgs.coreutils}/bin/id -u)/bus" ${pkgs.playerctl}/bin/playerctl'';
|
||||||
in {
|
in
|
||||||
|
{
|
||||||
default = {
|
default = {
|
||||||
matches = [
|
matches = [
|
||||||
{
|
{
|
||||||
|
|
@ -64,10 +62,7 @@
|
||||||
name = "output";
|
name = "output";
|
||||||
type = "script";
|
type = "script";
|
||||||
params = {
|
params = {
|
||||||
args = [
|
args = [ (pkgs.writeShellScript "espanso" "${playerctl} metadata title") ];
|
||||||
(pkgs.writeShellScript "espanso"
|
|
||||||
"${playerctl} metadata title")
|
|
||||||
];
|
|
||||||
};
|
};
|
||||||
}
|
}
|
||||||
];
|
];
|
||||||
|
|
|
||||||
|
|
@ -1,5 +1,8 @@
|
||||||
{pkgs, ...}: {
|
{ pkgs, ... }:
|
||||||
programs.librewolf = {enable = false;};
|
{
|
||||||
|
programs.librewolf = {
|
||||||
|
enable = false;
|
||||||
|
};
|
||||||
programs.firefox = {
|
programs.firefox = {
|
||||||
enable = true;
|
enable = true;
|
||||||
package = pkgs.firefox-esr-128;
|
package = pkgs.firefox-esr-128;
|
||||||
|
|
|
||||||
|
|
@ -3,10 +3,9 @@
|
||||||
pkgs,
|
pkgs,
|
||||||
config,
|
config,
|
||||||
...
|
...
|
||||||
}: {
|
}:
|
||||||
home.packages = [
|
{
|
||||||
pkgs.gcr
|
home.packages = [ pkgs.gcr ];
|
||||||
];
|
|
||||||
|
|
||||||
programs.gpg.enable = true;
|
programs.gpg.enable = true;
|
||||||
services.gpg-agent = {
|
services.gpg-agent = {
|
||||||
|
|
|
||||||
|
|
@ -1,15 +1,12 @@
|
||||||
|
{ pkgs, config, ... }:
|
||||||
|
let
|
||||||
|
in
|
||||||
|
# TODO: clean up the impurity in here
|
||||||
{
|
{
|
||||||
pkgs,
|
|
||||||
config,
|
|
||||||
...
|
|
||||||
}: let
|
|
||||||
# TODO: clean up the impurity in here
|
|
||||||
in {
|
|
||||||
home.sessionVariables.HOMESHICK_DIR = "${pkgs.homeshick}";
|
home.sessionVariables.HOMESHICK_DIR = "${pkgs.homeshick}";
|
||||||
|
|
||||||
home.activation.bootstrapRepos = config.lib.dag.entryAfter ["writeBoundary"] ''
|
home.activation.bootstrapRepos = config.lib.dag.entryAfter [ "writeBoundary" ] ''
|
||||||
$DRY_RUN_CMD ${
|
$DRY_RUN_CMD ${pkgs.writeScript "activation-script" ''
|
||||||
pkgs.writeScript "activation-script" ''
|
|
||||||
set -e
|
set -e
|
||||||
echo home-manager path is ${config.home.path}
|
echo home-manager path is ${config.home.path}
|
||||||
echo home is $HOME
|
echo home is $HOME
|
||||||
|
|
@ -20,13 +17,12 @@ in {
|
||||||
# echo Updating homeshick
|
# echo Updating homeshick
|
||||||
# ln -sfT ${pkgs.homeshick} "$HOMESICK_REPOS"/.homeshick
|
# ln -sfT ${pkgs.homeshick} "$HOMESICK_REPOS"/.homeshick
|
||||||
# mv -Tf "$HOMESICK_REPOS"/{.,}homeshick
|
# mv -Tf "$HOMESICK_REPOS"/{.,}homeshick
|
||||||
''
|
''};
|
||||||
};
|
|
||||||
'';
|
'';
|
||||||
|
|
||||||
nixpkgs.config = {
|
nixpkgs.config = {
|
||||||
packageOverrides = pkgs:
|
packageOverrides =
|
||||||
with pkgs; {
|
pkgs: with pkgs; {
|
||||||
homeshick = builtins.fetchGit {
|
homeshick = builtins.fetchGit {
|
||||||
url = "https://github.com/andsens/homeshick.git";
|
url = "https://github.com/andsens/homeshick.git";
|
||||||
ref = "master";
|
ref = "master";
|
||||||
|
|
|
||||||
|
|
@ -1,3 +1,4 @@
|
||||||
{pkgs, ...}: {
|
{ pkgs, ... }:
|
||||||
home.packages = [pkgs.libreoffice];
|
{
|
||||||
|
home.packages = [ pkgs.libreoffice ];
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -3,10 +3,9 @@
|
||||||
pkgs,
|
pkgs,
|
||||||
lib,
|
lib,
|
||||||
...
|
...
|
||||||
}: {
|
}:
|
||||||
imports = [
|
{
|
||||||
repoFlake.inputs.nixvim.homeManagerModules.nixvim
|
imports = [ repoFlake.inputs.nixvim.homeManagerModules.nixvim ];
|
||||||
];
|
|
||||||
|
|
||||||
programs.nixvim = {
|
programs.nixvim = {
|
||||||
enable = true;
|
enable = true;
|
||||||
|
|
@ -14,7 +13,7 @@
|
||||||
vimdiffAlias = true;
|
vimdiffAlias = true;
|
||||||
vimAlias = true;
|
vimAlias = true;
|
||||||
|
|
||||||
extraPython3Packages = ps: with ps; [];
|
extraPython3Packages = ps: with ps; [ ];
|
||||||
|
|
||||||
# extraConfigVim = builtins.readFile ./neovim/vimrc;
|
# extraConfigVim = builtins.readFile ./neovim/vimrc;
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -1,21 +1,25 @@
|
||||||
|
{ pkgs, lib, ... }:
|
||||||
{
|
{
|
||||||
pkgs,
|
|
||||||
lib,
|
|
||||||
...
|
|
||||||
}: {
|
|
||||||
programs.obs-studio = {
|
programs.obs-studio = {
|
||||||
enable = true;
|
enable = true;
|
||||||
plugins =
|
plugins =
|
||||||
builtins.map (plugin: (plugin.overrideAttrs (attrs: {
|
builtins.map
|
||||||
|
(
|
||||||
|
plugin:
|
||||||
|
(plugin.overrideAttrs (attrs: {
|
||||||
meta = lib.mkMerge [
|
meta = lib.mkMerge [
|
||||||
{inherit (attrs) meta;}
|
{ inherit (attrs) meta; }
|
||||||
{meta.platforms = [pkgs.stdenv.system];}
|
{ meta.platforms = [ pkgs.stdenv.system ]; }
|
||||||
];
|
];
|
||||||
})))
|
}))
|
||||||
(with pkgs.obs-studio-plugins; [
|
)
|
||||||
|
(
|
||||||
|
with pkgs.obs-studio-plugins;
|
||||||
|
[
|
||||||
# wlrobs
|
# wlrobs
|
||||||
obs-backgroundremoval
|
obs-backgroundremoval
|
||||||
obs-pipewire-audio-capture
|
obs-pipewire-audio-capture
|
||||||
]);
|
]
|
||||||
|
);
|
||||||
};
|
};
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -3,10 +3,12 @@
|
||||||
nodeFlake,
|
nodeFlake,
|
||||||
repoFlake,
|
repoFlake,
|
||||||
...
|
...
|
||||||
}: let
|
}:
|
||||||
pkgsUnstable = import nodeFlake.inputs.nixpkgs-unstable {inherit (pkgs) system config;};
|
let
|
||||||
pkgsVscodium = import repoFlake.inputs.nixpkgs-vscodium {inherit (pkgs) system config;};
|
pkgsUnstable = import nodeFlake.inputs.nixpkgs-unstable { inherit (pkgs) system config; };
|
||||||
in {
|
pkgsVscodium = import repoFlake.inputs.nixpkgs-vscodium { inherit (pkgs) system config; };
|
||||||
|
in
|
||||||
|
{
|
||||||
home.packages = [
|
home.packages = [
|
||||||
pkgs.nil
|
pkgs.nil
|
||||||
pkgs.nixd
|
pkgs.nixd
|
||||||
|
|
@ -33,7 +35,9 @@ in {
|
||||||
(pkgsVscodium.openvscode-server.overrideAttrs (attrs: {
|
(pkgsVscodium.openvscode-server.overrideAttrs (attrs: {
|
||||||
src = repoFlake.inputs.openvscode-server;
|
src = repoFlake.inputs.openvscode-server;
|
||||||
version = "1.94.2";
|
version = "1.94.2";
|
||||||
yarnCache = attrs.yarnCache.overrideAttrs (_: {outputHash = "sha256-89c6GYLT2RzHqwxBKegYqB6g5rEJ6/nH53cnfV7b0Tt=";});
|
yarnCache = attrs.yarnCache.overrideAttrs (_: {
|
||||||
|
outputHash = "sha256-89c6GYLT2RzHqwxBKegYqB6g5rEJ6/nH53cnfV7b0Tt=";
|
||||||
|
});
|
||||||
}))
|
}))
|
||||||
|
|
||||||
pkgs.waypipe
|
pkgs.waypipe
|
||||||
|
|
|
||||||
|
|
@ -1,8 +1,5 @@
|
||||||
|
{ repoFlake, pkgs, ... }:
|
||||||
{
|
{
|
||||||
repoFlake,
|
|
||||||
pkgs,
|
|
||||||
...
|
|
||||||
}: {
|
|
||||||
# required by pass-otp
|
# required by pass-otp
|
||||||
# home.sessionVariables.PASSWORD_STORE_EXTENSIONS_DIR = "$HOME/.nix-profile/lib/password-store/extensions";
|
# home.sessionVariables.PASSWORD_STORE_EXTENSIONS_DIR = "$HOME/.nix-profile/lib/password-store/extensions";
|
||||||
# home.sessionVariables.PASSWORD_STORE_ENABLE_EXTENSIONS = "true";
|
# home.sessionVariables.PASSWORD_STORE_ENABLE_EXTENSIONS = "true";
|
||||||
|
|
|
||||||
|
|
@ -4,7 +4,8 @@
|
||||||
pkgs,
|
pkgs,
|
||||||
osConfig,
|
osConfig,
|
||||||
...
|
...
|
||||||
}: let
|
}:
|
||||||
|
let
|
||||||
libdecsync = pkgs.python3Packages.buildPythonPackage rec {
|
libdecsync = pkgs.python3Packages.buildPythonPackage rec {
|
||||||
pname = "libdecsync";
|
pname = "libdecsync";
|
||||||
version = "2.2.1";
|
version = "2.2.1";
|
||||||
|
|
@ -38,18 +39,18 @@
|
||||||
# pkgs.libxcrypt
|
# pkgs.libxcrypt
|
||||||
];
|
];
|
||||||
|
|
||||||
propagatedBuildInputs = [libdecsync pkgs.python3Packages.setuptools];
|
propagatedBuildInputs = [
|
||||||
|
libdecsync
|
||||||
|
pkgs.python3Packages.setuptools
|
||||||
|
];
|
||||||
};
|
};
|
||||||
radicale-decsync = pkgs.radicale.overrideAttrs (old: {
|
radicale-decsync = pkgs.radicale.overrideAttrs (old: {
|
||||||
propagatedBuildInputs =
|
propagatedBuildInputs = old.propagatedBuildInputs ++ [ radicale-storage-decsync ];
|
||||||
old.propagatedBuildInputs
|
|
||||||
++ [radicale-storage-decsync];
|
|
||||||
});
|
});
|
||||||
|
|
||||||
mkRadicaleService = {
|
mkRadicaleService =
|
||||||
suffix,
|
{ suffix, port }:
|
||||||
port,
|
let
|
||||||
}: let
|
|
||||||
radicale-config = pkgs.writeText "radicale-config-${suffix}" ''
|
radicale-config = pkgs.writeText "radicale-config-${suffix}" ''
|
||||||
[server]
|
[server]
|
||||||
hosts = localhost:${builtins.toString port}
|
hosts = localhost:${builtins.toString port}
|
||||||
|
|
@ -64,18 +65,19 @@
|
||||||
filesystem_folder = ${config.xdg.dataHome}/radicale/radicale-${suffix}
|
filesystem_folder = ${config.xdg.dataHome}/radicale/radicale-${suffix}
|
||||||
decsync_dir = ${config.xdg.dataHome}/decsync/decsync-${suffix}
|
decsync_dir = ${config.xdg.dataHome}/decsync/decsync-${suffix}
|
||||||
'';
|
'';
|
||||||
in {
|
in
|
||||||
|
{
|
||||||
systemd.user.services."radicale-${suffix}" = {
|
systemd.user.services."radicale-${suffix}" = {
|
||||||
Unit.Description = "Radicale with DecSync (${suffix})";
|
Unit.Description = "Radicale with DecSync (${suffix})";
|
||||||
Service = {
|
Service = {
|
||||||
ExecStart = "${radicale-decsync}/bin/radicale -C ${radicale-config}";
|
ExecStart = "${radicale-decsync}/bin/radicale -C ${radicale-config}";
|
||||||
Restart = "on-failure";
|
Restart = "on-failure";
|
||||||
};
|
};
|
||||||
Install.WantedBy = ["default.target"];
|
Install.WantedBy = [ "default.target" ];
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
in
|
in
|
||||||
builtins.foldl' (sum: cur: lib.recursiveUpdate sum (mkRadicaleService cur)) {} [
|
builtins.foldl' (sum: cur: lib.recursiveUpdate sum (mkRadicaleService cur)) { } [
|
||||||
{
|
{
|
||||||
suffix = "personal";
|
suffix = "personal";
|
||||||
port = 5232;
|
port = 5232;
|
||||||
|
|
@ -84,4 +86,4 @@ in
|
||||||
suffix = "family";
|
suffix = "family";
|
||||||
port = 5233;
|
port = 5233;
|
||||||
}
|
}
|
||||||
]
|
]
|
||||||
|
|
|
||||||
|
|
@ -1,10 +1,8 @@
|
||||||
{
|
{ pkgs, config, ... }:
|
||||||
pkgs,
|
let
|
||||||
config,
|
|
||||||
...
|
|
||||||
}: let
|
|
||||||
passwords = import ../../variables/passwords.crypt.nix;
|
passwords = import ../../variables/passwords.crypt.nix;
|
||||||
in {
|
in
|
||||||
|
{
|
||||||
services.gammastep = {
|
services.gammastep = {
|
||||||
enable = true;
|
enable = true;
|
||||||
provider = "manual";
|
provider = "manual";
|
||||||
|
|
|
||||||
|
|
@ -8,11 +8,10 @@
|
||||||
# useful testing command:
|
# useful testing command:
|
||||||
# for i in `seq 0 10`; do nix shell nixpkgs#libnotify --command notify-send notifiiiiiii "$i"; sleep 1; done
|
# for i in `seq 0 10`; do nix shell nixpkgs#libnotify --command notify-send notifiiiiiii "$i"; sleep 1; done
|
||||||
let
|
let
|
||||||
inherit (import ../lib.nix {}) mkSimpleTrayService;
|
inherit (import ../lib.nix { }) mkSimpleTrayService;
|
||||||
in {
|
in
|
||||||
home.packages = [
|
{
|
||||||
packages'.salut
|
home.packages = [ packages'.salut ];
|
||||||
];
|
|
||||||
|
|
||||||
xdg.configFile."salut/config.ini" = {
|
xdg.configFile."salut/config.ini" = {
|
||||||
enable = true;
|
enable = true;
|
||||||
|
|
@ -34,7 +33,5 @@ in {
|
||||||
onChange = "${pkgs.systemd}/bin/systemctl --user restart salut";
|
onChange = "${pkgs.systemd}/bin/systemctl --user restart salut";
|
||||||
};
|
};
|
||||||
|
|
||||||
systemd.user.services.salut = mkSimpleTrayService {
|
systemd.user.services.salut = mkSimpleTrayService { execStart = "${packages'.salut}/bin/salut"; };
|
||||||
execStart = "${packages'.salut}/bin/salut";
|
|
||||||
};
|
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -3,9 +3,11 @@
|
||||||
nodeFlake,
|
nodeFlake,
|
||||||
repoFlake,
|
repoFlake,
|
||||||
...
|
...
|
||||||
}: let
|
}:
|
||||||
pkgsVscodium = import repoFlake.inputs.nixpkgs-vscodium {inherit (pkgs) system config;};
|
let
|
||||||
in {
|
pkgsVscodium = import repoFlake.inputs.nixpkgs-vscodium { inherit (pkgs) system config; };
|
||||||
|
in
|
||||||
|
{
|
||||||
programs.vscode = {
|
programs.vscode = {
|
||||||
enable = true;
|
enable = true;
|
||||||
package = pkgsVscodium.vscodium;
|
package = pkgsVscodium.vscodium;
|
||||||
|
|
@ -18,7 +20,8 @@ in {
|
||||||
# sha256 = "1qc1qsahfx1nvznq4adplx63w5d94xhafngv76vnqjjbzhv991v2";
|
# sha256 = "1qc1qsahfx1nvznq4adplx63w5d94xhafngv76vnqjjbzhv991v2";
|
||||||
# })
|
# })
|
||||||
]
|
]
|
||||||
++ (with pkgsVscodium.vscode-extensions;
|
++ (
|
||||||
|
with pkgsVscodium.vscode-extensions;
|
||||||
[
|
[
|
||||||
eamodio.gitlens
|
eamodio.gitlens
|
||||||
mkhl.direnv
|
mkhl.direnv
|
||||||
|
|
@ -43,11 +46,14 @@ in {
|
||||||
# TODO: not compatible with vscodium
|
# TODO: not compatible with vscodium
|
||||||
# ms-vscode-remote.remote-ssh
|
# ms-vscode-remote.remote-ssh
|
||||||
]
|
]
|
||||||
++ (let
|
++ (
|
||||||
|
let
|
||||||
extensions = repoFlake.inputs.nix-vscode-extensions.extensions.${pkgs.system};
|
extensions = repoFlake.inputs.nix-vscode-extensions.extensions.${pkgs.system};
|
||||||
in (
|
in
|
||||||
|
(
|
||||||
with extensions.vscode-marketplace;
|
with extensions.vscode-marketplace;
|
||||||
with extensions.vscode-marketplace-release; [
|
with extensions.vscode-marketplace-release;
|
||||||
|
[
|
||||||
tamasfe.even-better-toml
|
tamasfe.even-better-toml
|
||||||
|
|
||||||
serayuzgur.crates
|
serayuzgur.crates
|
||||||
|
|
@ -59,10 +65,11 @@ in {
|
||||||
|
|
||||||
ibecker.treefmt-vscode
|
ibecker.treefmt-vscode
|
||||||
]
|
]
|
||||||
)))
|
)
|
||||||
|
)
|
||||||
|
)
|
||||||
++ [
|
++ [
|
||||||
(pkgsVscodium.vscode-utils.extensionFromVscodeMarketplace
|
(pkgsVscodium.vscode-utils.extensionFromVscodeMarketplace {
|
||||||
{
|
|
||||||
name = "markdown-oxide";
|
name = "markdown-oxide";
|
||||||
publisher = "felixzeller";
|
publisher = "felixzeller";
|
||||||
version = "1.1.0";
|
version = "1.1.0";
|
||||||
|
|
@ -151,4 +158,3 @@ in {
|
||||||
# xyz.plsql-language
|
# xyz.plsql-language
|
||||||
# yzane.markdown-pdf
|
# yzane.markdown-pdf
|
||||||
# zxh404.vscode-proto3
|
# zxh404.vscode-proto3
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -1,12 +1,17 @@
|
||||||
{
|
{ pkgs, lib }:
|
||||||
pkgs,
|
let
|
||||||
lib,
|
inherit (pkgs.stdenv)
|
||||||
}: let
|
isDarwin
|
||||||
inherit (pkgs.stdenv) isDarwin isLinux isi686 isx86_64 isAarch32 isAarch64;
|
isLinux
|
||||||
|
isi686
|
||||||
|
isx86_64
|
||||||
|
isAarch32
|
||||||
|
isAarch64
|
||||||
|
;
|
||||||
vscode-utils = pkgs.vscode-utils;
|
vscode-utils = pkgs.vscode-utils;
|
||||||
merge = lib.attrsets.recursiveUpdate;
|
merge = lib.attrsets.recursiveUpdate;
|
||||||
in
|
in
|
||||||
merge
|
merge
|
||||||
(merge
|
(merge
|
||||||
(merge
|
(merge
|
||||||
(merge
|
(merge
|
||||||
|
|
@ -18,7 +23,8 @@ in
|
||||||
sha256 = "07l37hkg106m3nl9530l7i39iw1kibckv1zi4n23gbp7srdrwbs3";
|
sha256 = "07l37hkg106m3nl9530l7i39iw1kibckv1zi4n23gbp7srdrwbs3";
|
||||||
};
|
};
|
||||||
}
|
}
|
||||||
(lib.attrsets.optionalAttrs (isLinux && (isi686 || isx86_64)) {
|
(
|
||||||
|
lib.attrsets.optionalAttrs (isLinux && (isi686 || isx86_64)) {
|
||||||
"ibecker"."treefmt-vscode" = vscode-utils.extensionFromVscodeMarketplace {
|
"ibecker"."treefmt-vscode" = vscode-utils.extensionFromVscodeMarketplace {
|
||||||
name = "treefmt-vscode";
|
name = "treefmt-vscode";
|
||||||
publisher = "ibecker";
|
publisher = "ibecker";
|
||||||
|
|
@ -26,8 +32,11 @@ in
|
||||||
sha256 = "1r17wjpw8xiha5r9h3146facxghpcp416zf8551sw93cmam9ky6j";
|
sha256 = "1r17wjpw8xiha5r9h3146facxghpcp416zf8551sw93cmam9ky6j";
|
||||||
arch = "linux-x64";
|
arch = "linux-x64";
|
||||||
};
|
};
|
||||||
}))
|
}
|
||||||
(lib.attrsets.optionalAttrs (isLinux && (isAarch32 || isAarch64)) {
|
)
|
||||||
|
)
|
||||||
|
(
|
||||||
|
lib.attrsets.optionalAttrs (isLinux && (isAarch32 || isAarch64)) {
|
||||||
"ibecker"."treefmt-vscode" = vscode-utils.extensionFromVscodeMarketplace {
|
"ibecker"."treefmt-vscode" = vscode-utils.extensionFromVscodeMarketplace {
|
||||||
name = "treefmt-vscode";
|
name = "treefmt-vscode";
|
||||||
publisher = "ibecker";
|
publisher = "ibecker";
|
||||||
|
|
@ -35,8 +44,11 @@ in
|
||||||
sha256 = "0swvl7fkjcwp43grnrhnmy60a5m3hfwawk204byi8hhbczy131li";
|
sha256 = "0swvl7fkjcwp43grnrhnmy60a5m3hfwawk204byi8hhbczy131li";
|
||||||
arch = "linux-arm64";
|
arch = "linux-arm64";
|
||||||
};
|
};
|
||||||
}))
|
}
|
||||||
(lib.attrsets.optionalAttrs (isDarwin && (isi686 || isx86_64)) {
|
)
|
||||||
|
)
|
||||||
|
(
|
||||||
|
lib.attrsets.optionalAttrs (isDarwin && (isi686 || isx86_64)) {
|
||||||
"ibecker"."treefmt-vscode" = vscode-utils.extensionFromVscodeMarketplace {
|
"ibecker"."treefmt-vscode" = vscode-utils.extensionFromVscodeMarketplace {
|
||||||
name = "treefmt-vscode";
|
name = "treefmt-vscode";
|
||||||
publisher = "ibecker";
|
publisher = "ibecker";
|
||||||
|
|
@ -44,8 +56,11 @@ in
|
||||||
sha256 = "1swq9hy6a9nzkrn07j21g59pyk2m7aqsfi1pphl9l9y8p4zwiaqm";
|
sha256 = "1swq9hy6a9nzkrn07j21g59pyk2m7aqsfi1pphl9l9y8p4zwiaqm";
|
||||||
arch = "darwin-x64";
|
arch = "darwin-x64";
|
||||||
};
|
};
|
||||||
}))
|
}
|
||||||
(lib.attrsets.optionalAttrs (isDarwin && (isAarch32 || isAarch64)) {
|
)
|
||||||
|
)
|
||||||
|
(
|
||||||
|
lib.attrsets.optionalAttrs (isDarwin && (isAarch32 || isAarch64)) {
|
||||||
"ibecker"."treefmt-vscode" = vscode-utils.extensionFromVscodeMarketplace {
|
"ibecker"."treefmt-vscode" = vscode-utils.extensionFromVscodeMarketplace {
|
||||||
name = "treefmt-vscode";
|
name = "treefmt-vscode";
|
||||||
publisher = "ibecker";
|
publisher = "ibecker";
|
||||||
|
|
@ -53,4 +68,5 @@ in
|
||||||
sha256 = "1xg3wnn3f1kvsz5a09l0cjpzfm3l9va73cahbvl14mx3n6734r2m";
|
sha256 = "1xg3wnn3f1kvsz5a09l0cjpzfm3l9va73cahbvl14mx3n6734r2m";
|
||||||
arch = "darwin-arm64";
|
arch = "darwin-arm64";
|
||||||
};
|
};
|
||||||
})
|
}
|
||||||
|
)
|
||||||
|
|
|
||||||
|
|
@ -3,7 +3,8 @@
|
||||||
config,
|
config,
|
||||||
repoFlake,
|
repoFlake,
|
||||||
...
|
...
|
||||||
}: {
|
}:
|
||||||
|
{
|
||||||
home.packages = [
|
home.packages = [
|
||||||
# required by any bar that has a tray plugin
|
# required by any bar that has a tray plugin
|
||||||
pkgs.libappindicator-gtk3
|
pkgs.libappindicator-gtk3
|
||||||
|
|
@ -12,10 +13,9 @@
|
||||||
|
|
||||||
programs.waybar = {
|
programs.waybar = {
|
||||||
enable = true;
|
enable = true;
|
||||||
package = repoFlake.inputs.nixpkgs-wayland.outputs.packages.${pkgs.stdenv.hostPlatform.system}.waybar;
|
package =
|
||||||
style =
|
repoFlake.inputs.nixpkgs-wayland.outputs.packages.${pkgs.stdenv.hostPlatform.system}.waybar;
|
||||||
pkgs.lib.readFile "${pkgs.waybar.src}/resources/style.css"
|
style = pkgs.lib.readFile "${pkgs.waybar.src}/resources/style.css" + pkgs.lib.readFile ./waybar.css;
|
||||||
+ pkgs.lib.readFile ./waybar.css;
|
|
||||||
systemd.enable = true;
|
systemd.enable = true;
|
||||||
settings = {
|
settings = {
|
||||||
mainBar = {
|
mainBar = {
|
||||||
|
|
@ -24,12 +24,7 @@
|
||||||
height = 30;
|
height = 30;
|
||||||
output =
|
output =
|
||||||
# hide the bar on HEADDLESS displays as i use them only for screensharing
|
# hide the bar on HEADDLESS displays as i use them only for screensharing
|
||||||
(
|
(builtins.genList (i: "!HEADLESS-${builtins.toString i}") 99) ++ [ "*" ];
|
||||||
builtins.genList (i: "!HEADLESS-${builtins.toString i}") 99
|
|
||||||
)
|
|
||||||
++ [
|
|
||||||
"*"
|
|
||||||
];
|
|
||||||
# output = [
|
# output = [
|
||||||
# "eDP-1"
|
# "eDP-1"
|
||||||
# "DP-*"
|
# "DP-*"
|
||||||
|
|
|
||||||
|
|
@ -3,8 +3,10 @@
|
||||||
lib,
|
lib,
|
||||||
pkgs,
|
pkgs,
|
||||||
...
|
...
|
||||||
}: let
|
}:
|
||||||
just-plugin = let
|
let
|
||||||
|
just-plugin =
|
||||||
|
let
|
||||||
plugin_file = pkgs.writeText "_just" ''
|
plugin_file = pkgs.writeText "_just" ''
|
||||||
#compdef just
|
#compdef just
|
||||||
#autload
|
#autload
|
||||||
|
|
@ -35,7 +37,8 @@
|
||||||
chmod --recursive a-w $out
|
chmod --recursive a-w $out
|
||||||
'';
|
'';
|
||||||
};
|
};
|
||||||
in {
|
in
|
||||||
|
{
|
||||||
programs.zsh = {
|
programs.zsh = {
|
||||||
enable = true;
|
enable = true;
|
||||||
|
|
||||||
|
|
@ -46,9 +49,11 @@ in {
|
||||||
# will be called again by oh-my-zsh
|
# will be called again by oh-my-zsh
|
||||||
enableCompletion = false;
|
enableCompletion = false;
|
||||||
enableAutosuggestions = true;
|
enableAutosuggestions = true;
|
||||||
initExtra = let
|
initExtra =
|
||||||
|
let
|
||||||
inNixShell = ''$([[ -n "$IN_NIX_SHELL" ]] && printf " 🐚")'';
|
inNixShell = ''$([[ -n "$IN_NIX_SHELL" ]] && printf " 🐚")'';
|
||||||
in ''
|
in
|
||||||
|
''
|
||||||
if test ! -n "$TMPDIR" -a -z "$TMPDIR"; then
|
if test ! -n "$TMPDIR" -a -z "$TMPDIR"; then
|
||||||
unset TMPDIR
|
unset TMPDIR
|
||||||
fi
|
fi
|
||||||
|
|
@ -69,12 +74,13 @@ in {
|
||||||
fi
|
fi
|
||||||
|
|
||||||
${
|
${
|
||||||
if builtins.hasAttr "homeshick" pkgs
|
if builtins.hasAttr "homeshick" pkgs then
|
||||||
then ''
|
''
|
||||||
source ${pkgs.homeshick}/homeshick.sh
|
source ${pkgs.homeshick}/homeshick.sh
|
||||||
fpath=(${pkgs.homeshick}/completions $fpath)
|
fpath=(${pkgs.homeshick}/completions $fpath)
|
||||||
''
|
''
|
||||||
else ""
|
else
|
||||||
|
""
|
||||||
}
|
}
|
||||||
|
|
||||||
# Disable intercepting of ctrl-s and ctrl-q as flow control.
|
# Disable intercepting of ctrl-s and ctrl-q as flow control.
|
||||||
|
|
@ -128,7 +134,10 @@ in {
|
||||||
oh-my-zsh = {
|
oh-my-zsh = {
|
||||||
enable = true;
|
enable = true;
|
||||||
theme = "tjkirch";
|
theme = "tjkirch";
|
||||||
plugins = ["git" "sudo"];
|
plugins = [
|
||||||
|
"git"
|
||||||
|
"sudo"
|
||||||
|
];
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -1,7 +1,8 @@
|
||||||
{lib, ...}: {
|
{ lib, ... }:
|
||||||
|
{
|
||||||
options.flake.colmena = lib.mkOption {
|
options.flake.colmena = lib.mkOption {
|
||||||
# type = lib.types.attrsOf lib.types.unspecified;
|
# type = lib.types.attrsOf lib.types.unspecified;
|
||||||
type = lib.types.raw;
|
type = lib.types.raw;
|
||||||
default = {};
|
default = { };
|
||||||
};
|
};
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -5,9 +5,11 @@
|
||||||
lib,
|
lib,
|
||||||
pkgs,
|
pkgs,
|
||||||
...
|
...
|
||||||
}: {
|
}:
|
||||||
|
{
|
||||||
packages = {
|
packages = {
|
||||||
myPython = pkgs.python310.withPackages (ps:
|
myPython = pkgs.python310.withPackages (
|
||||||
|
ps:
|
||||||
with ps;
|
with ps;
|
||||||
[
|
[
|
||||||
pep8
|
pep8
|
||||||
|
|
@ -33,6 +35,10 @@
|
||||||
pyaml
|
pyaml
|
||||||
requests
|
requests
|
||||||
]
|
]
|
||||||
++ [pkgs.pypi2nix pkgs.libffi]);
|
++ [
|
||||||
|
pkgs.pypi2nix
|
||||||
|
pkgs.libffi
|
||||||
|
]
|
||||||
|
);
|
||||||
};
|
};
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -1,14 +1,12 @@
|
||||||
# WARN: this file will get overwritten by $ cachix use <name>
|
# WARN: this file will get overwritten by $ cachix use <name>
|
||||||
{
|
{ pkgs, lib, ... }:
|
||||||
pkgs,
|
let
|
||||||
lib,
|
|
||||||
...
|
|
||||||
}: let
|
|
||||||
folder = ./cachix;
|
folder = ./cachix;
|
||||||
toImport = name: value: folder + ("/" + name);
|
toImport = name: value: folder + ("/" + name);
|
||||||
filterCaches = key: value: value == "regular" && lib.hasSuffix ".nix" key;
|
filterCaches = key: value: value == "regular" && lib.hasSuffix ".nix" key;
|
||||||
imports = lib.mapAttrsToList toImport (lib.filterAttrs filterCaches (builtins.readDir folder));
|
imports = lib.mapAttrsToList toImport (lib.filterAttrs filterCaches (builtins.readDir folder));
|
||||||
in {
|
in
|
||||||
|
{
|
||||||
inherit imports;
|
inherit imports;
|
||||||
nix.settings.substituters = ["https://cache.nixos.org/"];
|
nix.settings.substituters = [ "https://cache.nixos.org/" ];
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -1,8 +1,6 @@
|
||||||
{
|
{
|
||||||
nix = {
|
nix = {
|
||||||
settings.substituters = [
|
settings.substituters = [ "https://nixpkgs-wayland.cachix.org" ];
|
||||||
"https://nixpkgs-wayland.cachix.org"
|
|
||||||
];
|
|
||||||
settings.trusted-public-keys = [
|
settings.trusted-public-keys = [
|
||||||
"nixpkgs-wayland.cachix.org-1:3lwxaILxMRkVhehr5StQprHdEo4IrE8sRho9R9HOLYA="
|
"nixpkgs-wayland.cachix.org-1:3lwxaILxMRkVhehr5StQprHdEo4IrE8sRho9R9HOLYA="
|
||||||
];
|
];
|
||||||
|
|
|
||||||
|
|
@ -5,16 +5,23 @@
|
||||||
subvolumes,
|
subvolumes,
|
||||||
targetPathSuffix ? "",
|
targetPathSuffix ? "",
|
||||||
autoStart ? false,
|
autoStart ? false,
|
||||||
}: let
|
}:
|
||||||
|
let
|
||||||
passwords = import ../../variables/passwords.crypt.nix;
|
passwords = import ../../variables/passwords.crypt.nix;
|
||||||
subvolumeParentDir = "/var/lib/container-volumes";
|
subvolumeParentDir = "/var/lib/container-volumes";
|
||||||
in {
|
in
|
||||||
config = {pkgs, ...}: {
|
{
|
||||||
|
config =
|
||||||
|
{ pkgs, ... }:
|
||||||
|
{
|
||||||
system.stateVersion = "20.03"; # Did you read the comment?
|
system.stateVersion = "20.03"; # Did you read the comment?
|
||||||
|
|
||||||
imports = [../profiles/containers/configuration.nix];
|
imports = [ ../profiles/containers/configuration.nix ];
|
||||||
|
|
||||||
environment.systemPackages = with pkgs; [btrfs-progs btrbk];
|
environment.systemPackages = with pkgs; [
|
||||||
|
btrfs-progs
|
||||||
|
btrbk
|
||||||
|
];
|
||||||
|
|
||||||
networking.firewall.enable = true;
|
networking.firewall.enable = true;
|
||||||
|
|
||||||
|
|
@ -22,13 +29,15 @@ in {
|
||||||
enable = true;
|
enable = true;
|
||||||
description = "bkp-sync service";
|
description = "bkp-sync service";
|
||||||
|
|
||||||
serviceConfig = {Type = "oneshot";};
|
serviceConfig = {
|
||||||
|
Type = "oneshot";
|
||||||
|
};
|
||||||
|
|
||||||
after = ["bkp-run.service"];
|
after = [ "bkp-run.service" ];
|
||||||
|
|
||||||
requires = ["bkp-run.service"];
|
requires = [ "bkp-run.service" ];
|
||||||
|
|
||||||
path = with pkgs; [utillinux];
|
path = with pkgs; [ utillinux ];
|
||||||
script = ''
|
script = ''
|
||||||
set -x
|
set -x
|
||||||
true
|
true
|
||||||
|
|
@ -39,13 +48,20 @@ in {
|
||||||
enable = true;
|
enable = true;
|
||||||
description = "bkp-run";
|
description = "bkp-run";
|
||||||
|
|
||||||
serviceConfig = {Type = "oneshot";};
|
serviceConfig = {
|
||||||
|
Type = "oneshot";
|
||||||
|
};
|
||||||
|
|
||||||
partOf = ["bkp-sync.service"];
|
partOf = [ "bkp-sync.service" ];
|
||||||
|
|
||||||
path = with pkgs; [btrfs-progs btrbk coreutils];
|
path = with pkgs; [
|
||||||
|
btrfs-progs
|
||||||
|
btrbk
|
||||||
|
coreutils
|
||||||
|
];
|
||||||
|
|
||||||
script = let
|
script =
|
||||||
|
let
|
||||||
btrbkConf = pkgs.writeText "cfg" ''
|
btrbkConf = pkgs.writeText "cfg" ''
|
||||||
timestamp_format long
|
timestamp_format long
|
||||||
ssh_identity ${passwords.storage.backupTarget.keyPath}
|
ssh_identity ${passwords.storage.backupTarget.keyPath}
|
||||||
|
|
@ -62,10 +78,10 @@ in {
|
||||||
|
|
||||||
volume ${subvolumeParentDir}
|
volume ${subvolumeParentDir}
|
||||||
target ${passwords.storage.backupTarget.target}/container-volumes/${targetPathSuffix}
|
target ${passwords.storage.backupTarget.target}/container-volumes/${targetPathSuffix}
|
||||||
${builtins.foldl' (sum: elem: sum + " subvolume " + elem + "\n") ""
|
${builtins.foldl' (sum: elem: sum + " subvolume " + elem + "\n") "" subvolumes}
|
||||||
subvolumes}
|
|
||||||
'';
|
'';
|
||||||
in ''
|
in
|
||||||
|
''
|
||||||
#! ${pkgs.bash}/bin/bash
|
#! ${pkgs.bash}/bin/bash
|
||||||
set -Eeuxo pipefail
|
set -Eeuxo pipefail
|
||||||
|
|
||||||
|
|
@ -76,7 +92,10 @@ in {
|
||||||
systemd.timers."bkp" = {
|
systemd.timers."bkp" = {
|
||||||
description = "Timer to trigger bkp periodically";
|
description = "Timer to trigger bkp periodically";
|
||||||
enable = true;
|
enable = true;
|
||||||
wantedBy = ["timer.target" "multi-user.target"];
|
wantedBy = [
|
||||||
|
"timer.target"
|
||||||
|
"multi-user.target"
|
||||||
|
];
|
||||||
timerConfig = {
|
timerConfig = {
|
||||||
# Obtained using `systemd-analyze calendar "Wed 23:00"`
|
# Obtained using `systemd-analyze calendar "Wed 23:00"`
|
||||||
# OnCalendar = "Wed *-*-* 23:00:00";
|
# OnCalendar = "Wed *-*-* 23:00:00";
|
||||||
|
|
@ -114,10 +133,10 @@ in {
|
||||||
}
|
}
|
||||||
];
|
];
|
||||||
|
|
||||||
extraFlags = ["--resolv-conf=bind-host"];
|
extraFlags = [ "--resolv-conf=bind-host" ];
|
||||||
|
|
||||||
privateNetwork = true;
|
privateNetwork = true;
|
||||||
forwardPorts = [];
|
forwardPorts = [ ];
|
||||||
|
|
||||||
inherit hostAddress localAddress;
|
inherit hostAddress localAddress;
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -6,15 +6,18 @@
|
||||||
imapsPort ? 993,
|
imapsPort ? 993,
|
||||||
sievePort ? 4190,
|
sievePort ? 4190,
|
||||||
autoStart ? false,
|
autoStart ? false,
|
||||||
}: {
|
}:
|
||||||
|
{
|
||||||
inherit specialArgs;
|
inherit specialArgs;
|
||||||
config = {
|
config =
|
||||||
|
{
|
||||||
pkgs,
|
pkgs,
|
||||||
config,
|
config,
|
||||||
lib,
|
lib,
|
||||||
repoFlake,
|
repoFlake,
|
||||||
...
|
...
|
||||||
}: {
|
}:
|
||||||
|
{
|
||||||
system.stateVersion = "22.05"; # Did you read the comment?
|
system.stateVersion = "22.05"; # Did you read the comment?
|
||||||
|
|
||||||
imports = [
|
imports = [
|
||||||
|
|
@ -32,7 +35,7 @@
|
||||||
# FIXME: find out how to use the `defaultSopsFile` so i don't have to specify each secret separately
|
# FIXME: find out how to use the `defaultSopsFile` so i don't have to specify each secret separately
|
||||||
# sops.defaultSopsFile = ./mailserver_secrets.yaml;
|
# sops.defaultSopsFile = ./mailserver_secrets.yaml;
|
||||||
|
|
||||||
sops.age.sshKeyPaths = ["/etc/ssh/ssh_host_ed25519_key"];
|
sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
|
||||||
sops.secrets.email_mailStefanjunkerDe = {
|
sops.secrets.email_mailStefanjunkerDe = {
|
||||||
sopsFile = ./mailserver_secrets.yaml;
|
sopsFile = ./mailserver_secrets.yaml;
|
||||||
owner = config.users.users.steveej.name;
|
owner = config.users.users.steveej.name;
|
||||||
|
|
@ -64,8 +67,8 @@
|
||||||
services.dovecot2 = {
|
services.dovecot2 = {
|
||||||
enable = true;
|
enable = true;
|
||||||
|
|
||||||
modules = [pkgs.dovecot_pigeonhole];
|
modules = [ pkgs.dovecot_pigeonhole ];
|
||||||
protocols = ["sieve"];
|
protocols = [ "sieve" ];
|
||||||
|
|
||||||
enableImap = true;
|
enableImap = true;
|
||||||
enableLmtp = true;
|
enableLmtp = true;
|
||||||
|
|
@ -100,14 +103,15 @@
|
||||||
|
|
||||||
systemd.services.steveej-getmail-stefanjunker = {
|
systemd.services.steveej-getmail-stefanjunker = {
|
||||||
enable = true;
|
enable = true;
|
||||||
wantedBy = ["multi-user.target"];
|
wantedBy = [ "multi-user.target" ];
|
||||||
serviceConfig.User = "steveej";
|
serviceConfig.User = "steveej";
|
||||||
serviceConfig.Group = "dovecot2";
|
serviceConfig.Group = "dovecot2";
|
||||||
serviceConfig.RestartSec = 600;
|
serviceConfig.RestartSec = 600;
|
||||||
serviceConfig.Restart = "always";
|
serviceConfig.Restart = "always";
|
||||||
description = "Getmail service";
|
description = "Getmail service";
|
||||||
path = [pkgs.getmail6];
|
path = [ pkgs.getmail6 ];
|
||||||
script = let
|
script =
|
||||||
|
let
|
||||||
rc = pkgs.writeText "mailATstefanjunker.de.getmail.rc" ''
|
rc = pkgs.writeText "mailATstefanjunker.de.getmail.rc" ''
|
||||||
[options]
|
[options]
|
||||||
verbose = 1
|
verbose = 1
|
||||||
|
|
@ -126,21 +130,23 @@
|
||||||
type = MDA_external
|
type = MDA_external
|
||||||
path = ${pkgs.dovecot}/libexec/dovecot/dovecot-lda
|
path = ${pkgs.dovecot}/libexec/dovecot/dovecot-lda
|
||||||
'';
|
'';
|
||||||
in ''
|
in
|
||||||
|
''
|
||||||
getmail --idle=INBOX --rcfile=${rc}
|
getmail --idle=INBOX --rcfile=${rc}
|
||||||
'';
|
'';
|
||||||
};
|
};
|
||||||
|
|
||||||
systemd.services.steveej-getmail-stefanjunker-hetzner = {
|
systemd.services.steveej-getmail-stefanjunker-hetzner = {
|
||||||
enable = true;
|
enable = true;
|
||||||
wantedBy = ["multi-user.target"];
|
wantedBy = [ "multi-user.target" ];
|
||||||
serviceConfig.User = "steveej";
|
serviceConfig.User = "steveej";
|
||||||
serviceConfig.Group = "dovecot2";
|
serviceConfig.Group = "dovecot2";
|
||||||
serviceConfig.RestartSec = 60;
|
serviceConfig.RestartSec = 60;
|
||||||
serviceConfig.Restart = "always";
|
serviceConfig.Restart = "always";
|
||||||
description = "Getmail service";
|
description = "Getmail service";
|
||||||
path = [pkgs.getmail6];
|
path = [ pkgs.getmail6 ];
|
||||||
script = let
|
script =
|
||||||
|
let
|
||||||
rc = pkgs.writeText "mailATstefanjunker.de.getmail.rc" ''
|
rc = pkgs.writeText "mailATstefanjunker.de.getmail.rc" ''
|
||||||
[options]
|
[options]
|
||||||
verbose = 2
|
verbose = 2
|
||||||
|
|
@ -159,21 +165,23 @@
|
||||||
type = MDA_external
|
type = MDA_external
|
||||||
path = ${pkgs.dovecot}/libexec/dovecot/dovecot-lda
|
path = ${pkgs.dovecot}/libexec/dovecot/dovecot-lda
|
||||||
'';
|
'';
|
||||||
in ''
|
in
|
||||||
|
''
|
||||||
getmail --rcfile=${rc} --idle=INBOX
|
getmail --rcfile=${rc} --idle=INBOX
|
||||||
'';
|
'';
|
||||||
};
|
};
|
||||||
|
|
||||||
systemd.services.steveej-getmail-webde = {
|
systemd.services.steveej-getmail-webde = {
|
||||||
enable = true;
|
enable = true;
|
||||||
wantedBy = ["multi-user.target"];
|
wantedBy = [ "multi-user.target" ];
|
||||||
serviceConfig.User = "steveej";
|
serviceConfig.User = "steveej";
|
||||||
serviceConfig.Group = "dovecot2";
|
serviceConfig.Group = "dovecot2";
|
||||||
description = "Getmail service";
|
description = "Getmail service";
|
||||||
path = [pkgs.getmail6];
|
path = [ pkgs.getmail6 ];
|
||||||
serviceConfig.RestartSec = 1000;
|
serviceConfig.RestartSec = 1000;
|
||||||
serviceConfig.Restart = "always";
|
serviceConfig.Restart = "always";
|
||||||
script = let
|
script =
|
||||||
|
let
|
||||||
rc = pkgs.writeText "schtifATweb.de.getmail.rc" ''
|
rc = pkgs.writeText "schtifATweb.de.getmail.rc" ''
|
||||||
[options]
|
[options]
|
||||||
verbose = 1
|
verbose = 1
|
||||||
|
|
@ -192,7 +200,8 @@
|
||||||
type = Maildir
|
type = Maildir
|
||||||
path = ~/.maildir/
|
path = ~/.maildir/
|
||||||
'';
|
'';
|
||||||
in ''
|
in
|
||||||
|
''
|
||||||
getmail --rcfile=${rc} --idle=INBOX
|
getmail --rcfile=${rc} --idle=INBOX
|
||||||
'';
|
'';
|
||||||
};
|
};
|
||||||
|
|
|
||||||
|
|
@ -11,33 +11,36 @@
|
||||||
inputs.nixpkgs.follows = "nixpkgs";
|
inputs.nixpkgs.follows = "nixpkgs";
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
outputs = {
|
outputs =
|
||||||
|
{
|
||||||
self,
|
self,
|
||||||
nixpkgs,
|
nixpkgs,
|
||||||
nixos-generators,
|
nixos-generators,
|
||||||
...
|
...
|
||||||
}: let
|
}:
|
||||||
|
let
|
||||||
systems = [
|
systems = [
|
||||||
"aarch64-linux"
|
"aarch64-linux"
|
||||||
"x86_64-linux"
|
"x86_64-linux"
|
||||||
];
|
];
|
||||||
forAllSystems = nixpkgs.lib.genAttrs systems;
|
forAllSystems = nixpkgs.lib.genAttrs systems;
|
||||||
in {
|
in
|
||||||
nixosConfigurations.default =
|
|
||||||
nixpkgs.lib.nixosSystem
|
|
||||||
{
|
{
|
||||||
|
nixosConfigurations.default = nixpkgs.lib.nixosSystem {
|
||||||
system = "aarch64-linux";
|
system = "aarch64-linux";
|
||||||
|
|
||||||
specialArgs = {};
|
specialArgs = { };
|
||||||
|
|
||||||
modules = [
|
modules = [
|
||||||
({
|
(
|
||||||
|
{
|
||||||
config,
|
config,
|
||||||
modulesPath,
|
modulesPath,
|
||||||
pkgs,
|
pkgs,
|
||||||
lib,
|
lib,
|
||||||
...
|
...
|
||||||
}: {
|
}:
|
||||||
|
{
|
||||||
nixpkgs.overlays = [
|
nixpkgs.overlays = [
|
||||||
(final: previous: {
|
(final: previous: {
|
||||||
# inherit (self.inputs.nixpkgs-systemd256.legacyPackages.${pkgs.system}) systemd systemdMinimal;
|
# inherit (self.inputs.nixpkgs-systemd256.legacyPackages.${pkgs.system}) systemd systemdMinimal;
|
||||||
|
|
@ -99,9 +102,7 @@
|
||||||
})
|
})
|
||||||
];
|
];
|
||||||
|
|
||||||
imports = [
|
imports = [ (modulesPath + "/profiles/minimal.nix") ];
|
||||||
(modulesPath + "/profiles/minimal.nix")
|
|
||||||
];
|
|
||||||
system.stateVersion = "24.11";
|
system.stateVersion = "24.11";
|
||||||
|
|
||||||
# https://github.com/hercules-ci/arion/blob/c24c185e67f093298a081900b49ca18716077dec/src/nix/modules/nixos/container-systemd.nix
|
# https://github.com/hercules-ci/arion/blob/c24c185e67f093298a081900b49ca18716077dec/src/nix/modules/nixos/container-systemd.nix
|
||||||
|
|
@ -114,7 +115,7 @@
|
||||||
# boot.specialFileSystems = lib.mkForce {};
|
# boot.specialFileSystems = lib.mkForce {};
|
||||||
|
|
||||||
services.nscd.enable = false;
|
services.nscd.enable = false;
|
||||||
system.nssModules = lib.mkForce [];
|
system.nssModules = lib.mkForce [ ];
|
||||||
systemd.services.systemd-logind.enable = false;
|
systemd.services.systemd-logind.enable = false;
|
||||||
systemd.services.console-getty.enable = false;
|
systemd.services.console-getty.enable = false;
|
||||||
|
|
||||||
|
|
@ -135,32 +136,32 @@
|
||||||
mkdir -p /run/wrappers
|
mkdir -p /run/wrappers
|
||||||
'';
|
'';
|
||||||
|
|
||||||
boot.kernelParams = [
|
boot.kernelParams = [ "systemd.log_level=debug" ];
|
||||||
"systemd.log_level=debug"
|
|
||||||
];
|
|
||||||
|
|
||||||
# services.udev.enable = false;
|
# services.udev.enable = false;
|
||||||
|
|
||||||
# TODO: this is only needed because `/run/current-system` is missing
|
# TODO: this is only needed because `/run/current-system` is missing
|
||||||
# environment.variables.PATH = "${lib.makeBinPath config.environment.systemPackages}:$PATH";
|
# environment.variables.PATH = "${lib.makeBinPath config.environment.systemPackages}:$PATH";
|
||||||
|
|
||||||
systemd.mounts = lib.mkForce [];
|
systemd.mounts = lib.mkForce [ ];
|
||||||
fileSystems = lib.mkForce {};
|
fileSystems = lib.mkForce { };
|
||||||
|
|
||||||
services.mycelium.enable = false;
|
services.mycelium.enable = false;
|
||||||
services.mycelium.keyFile = "/var/lib/secrets/mycelium-keyfile";
|
services.mycelium.keyFile = "/var/lib/secrets/mycelium-keyfile";
|
||||||
systemd.services.mycelium.serviceConfig.DynamicUser = lib.mkForce false;
|
systemd.services.mycelium.serviceConfig.DynamicUser = lib.mkForce false;
|
||||||
systemd.services.mycelium.serviceConfig.User = lib.mkForce "root";
|
systemd.services.mycelium.serviceConfig.User = lib.mkForce "root";
|
||||||
systemd.services.mycelium.serviceConfig.ExecStart = lib.mkForce (pkgs.writeShellScript "mycelium" ''
|
systemd.services.mycelium.serviceConfig.ExecStart = lib.mkForce (
|
||||||
|
pkgs.writeShellScript "mycelium" ''
|
||||||
while true; do
|
while true; do
|
||||||
ls -lha $CREDENTIALS_DIRECTORY
|
ls -lha $CREDENTIALS_DIRECTORY
|
||||||
sleep 5
|
sleep 5
|
||||||
done
|
done
|
||||||
'');
|
''
|
||||||
|
);
|
||||||
|
|
||||||
systemd.services.testing-credentials = {
|
systemd.services.testing-credentials = {
|
||||||
wantedBy = ["multi-user.target"];
|
wantedBy = [ "multi-user.target" ];
|
||||||
path = [pkgs.coreutils];
|
path = [ pkgs.coreutils ];
|
||||||
|
|
||||||
serviceConfig = {
|
serviceConfig = {
|
||||||
# SyslogIdentifier = "testing-credentials";
|
# SyslogIdentifier = "testing-credentials";
|
||||||
|
|
@ -174,7 +175,8 @@
|
||||||
# "hosts:/etc/hosts"
|
# "hosts:/etc/hosts"
|
||||||
# ];
|
# ];
|
||||||
SetCredential = "mycelium-keyfile:not secret string";
|
SetCredential = "mycelium-keyfile:not secret string";
|
||||||
ExecStart = lib.mkForce (pkgs.writeShellScript "mycelium" ''
|
ExecStart = lib.mkForce (
|
||||||
|
pkgs.writeShellScript "mycelium" ''
|
||||||
cd $STATE_DIRECTORY
|
cd $STATE_DIRECTORY
|
||||||
pwd
|
pwd
|
||||||
env
|
env
|
||||||
|
|
@ -182,7 +184,8 @@
|
||||||
ls -lha $CREDENTIALS_DIRECTORY
|
ls -lha $CREDENTIALS_DIRECTORY
|
||||||
sleep 5
|
sleep 5
|
||||||
done
|
done
|
||||||
'');
|
''
|
||||||
|
);
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
|
|
@ -197,28 +200,32 @@
|
||||||
'';
|
'';
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
})
|
}
|
||||||
|
)
|
||||||
];
|
];
|
||||||
};
|
};
|
||||||
packages = forAllSystems (system: let
|
packages = forAllSystems (
|
||||||
|
system:
|
||||||
|
let
|
||||||
name = "mycelium";
|
name = "mycelium";
|
||||||
inherit (self.inputs) nix-snapshotter;
|
inherit (self.inputs) nix-snapshotter;
|
||||||
|
|
||||||
config = {
|
config = {
|
||||||
entrypoint = "${self.nixosConfigurations.default.config.system.build.toplevel}/init";
|
entrypoint = "${self.nixosConfigurations.default.config.system.build.toplevel}/init";
|
||||||
# port = 2379;
|
# port = 2379;
|
||||||
args = [
|
args = [ ];
|
||||||
];
|
|
||||||
# nodePort = 30001;
|
# nodePort = 30001;
|
||||||
};
|
};
|
||||||
|
|
||||||
myceliumPorts = {
|
myceliumPorts = {
|
||||||
tcp = [9651];
|
tcp = [ 9651 ];
|
||||||
udp = [9650 9651];
|
udp = [
|
||||||
|
9650
|
||||||
|
9651
|
||||||
|
];
|
||||||
};
|
};
|
||||||
|
|
||||||
inherit
|
inherit (config)
|
||||||
(config)
|
|
||||||
entrypoint
|
entrypoint
|
||||||
# port
|
# port
|
||||||
|
|
||||||
|
|
@ -227,15 +234,13 @@
|
||||||
|
|
||||||
;
|
;
|
||||||
|
|
||||||
pkgs = import nixpkgs {
|
pkgs = import nixpkgs { overlays = [ nix-snapshotter.overlays.default ]; };
|
||||||
overlays = [nix-snapshotter.overlays.default];
|
|
||||||
};
|
|
||||||
|
|
||||||
image = pkgs.nix-snapshotter.buildImage {
|
image = pkgs.nix-snapshotter.buildImage {
|
||||||
inherit name;
|
inherit name;
|
||||||
resolvedByNix = true;
|
resolvedByNix = true;
|
||||||
config = {
|
config = {
|
||||||
entrypoint = [entrypoint];
|
entrypoint = [ entrypoint ];
|
||||||
env = [
|
env = [
|
||||||
# this is read by the `/init` script and prevents various incompatible commands like mount, etc.
|
# this is read by the `/init` script and prevents various incompatible commands like mount, etc.
|
||||||
# the value of this doesn't seem to matter as long as it's not an empty string.
|
# the value of this doesn't seem to matter as long as it's not an empty string.
|
||||||
|
|
@ -253,14 +258,19 @@
|
||||||
];
|
];
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
in {
|
in
|
||||||
k8s = let
|
{
|
||||||
pod = pkgs.writeText "${name}-pod.json" (builtins.toJSON {
|
k8s =
|
||||||
|
let
|
||||||
|
pod = pkgs.writeText "${name}-pod.json" (
|
||||||
|
builtins.toJSON {
|
||||||
apiVersion = "v1";
|
apiVersion = "v1";
|
||||||
kind = "Pod";
|
kind = "Pod";
|
||||||
metadata = {
|
metadata = {
|
||||||
inherit name;
|
inherit name;
|
||||||
labels = {inherit name;};
|
labels = {
|
||||||
|
inherit name;
|
||||||
|
};
|
||||||
};
|
};
|
||||||
spec.containers = [
|
spec.containers = [
|
||||||
{
|
{
|
||||||
|
|
@ -284,15 +294,19 @@
|
||||||
];
|
];
|
||||||
}
|
}
|
||||||
];
|
];
|
||||||
});
|
}
|
||||||
|
);
|
||||||
|
|
||||||
service = pkgs.writeText "${name}-service.json" (builtins.toJSON {
|
service = pkgs.writeText "${name}-service.json" (
|
||||||
|
builtins.toJSON {
|
||||||
apiVersion = "v1";
|
apiVersion = "v1";
|
||||||
kind = "Service";
|
kind = "Service";
|
||||||
metadata.name = "${name}-service";
|
metadata.name = "${name}-service";
|
||||||
spec = {
|
spec = {
|
||||||
type = "NodePort";
|
type = "NodePort";
|
||||||
selector = {inherit name;};
|
selector = {
|
||||||
|
inherit name;
|
||||||
|
};
|
||||||
ports = [
|
ports = [
|
||||||
{
|
{
|
||||||
name = "mycelium-tcp-0";
|
name = "mycelium-tcp-0";
|
||||||
|
|
@ -313,9 +327,10 @@
|
||||||
}
|
}
|
||||||
];
|
];
|
||||||
};
|
};
|
||||||
});
|
}
|
||||||
|
);
|
||||||
in
|
in
|
||||||
pkgs.runCommand "declarative-k8s" {} ''
|
pkgs.runCommand "declarative-k8s" { } ''
|
||||||
mkdir -p $out/share/k8s
|
mkdir -p $out/share/k8s
|
||||||
cp ${pod} $out/share/k8s/
|
cp ${pod} $out/share/k8s/
|
||||||
cp ${service} $out/share/k8s/
|
cp ${service} $out/share/k8s/
|
||||||
|
|
@ -355,6 +370,7 @@
|
||||||
|
|
||||||
# mount -t tmpfs tmpfs /run/credentials/mycelium.service -o ro,nosuid,nodev,noexec,relatime,nosymfollow,size=1024k,nr_inodes=1024,mode=700,noswap
|
# mount -t tmpfs tmpfs /run/credentials/mycelium.service -o ro,nosuid,nodev,noexec,relatime,nosymfollow,size=1024k,nr_inodes=1024,mode=700,noswap
|
||||||
};
|
};
|
||||||
});
|
}
|
||||||
|
);
|
||||||
};
|
};
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -6,16 +6,15 @@
|
||||||
syncthingPort ? 22000,
|
syncthingPort ? 22000,
|
||||||
syncthingLocalAnnouncePort ? 21027,
|
syncthingLocalAnnouncePort ? 21027,
|
||||||
autoStart ? false,
|
autoStart ? false,
|
||||||
}: {
|
}:
|
||||||
|
{
|
||||||
inherit specialArgs;
|
inherit specialArgs;
|
||||||
config = {
|
config =
|
||||||
config,
|
{ config, pkgs, ... }:
|
||||||
pkgs,
|
{
|
||||||
...
|
|
||||||
}: {
|
|
||||||
system.stateVersion = "20.05"; # Did you read the comment?
|
system.stateVersion = "20.05"; # Did you read the comment?
|
||||||
|
|
||||||
imports = [../profiles/containers/configuration.nix];
|
imports = [ ../profiles/containers/configuration.nix ];
|
||||||
|
|
||||||
networking.firewall.allowedTCPPorts = [
|
networking.firewall.allowedTCPPorts = [
|
||||||
# syncthing gui
|
# syncthing gui
|
||||||
|
|
|
||||||
|
|
@ -7,11 +7,14 @@
|
||||||
httpsPort,
|
httpsPort,
|
||||||
forgejoSshPort,
|
forgejoSshPort,
|
||||||
autoStart ? false,
|
autoStart ? false,
|
||||||
}: let
|
}:
|
||||||
|
let
|
||||||
domain = "www.stefanjunker.de";
|
domain = "www.stefanjunker.de";
|
||||||
in {
|
in
|
||||||
|
{
|
||||||
inherit specialArgs;
|
inherit specialArgs;
|
||||||
config = {
|
config =
|
||||||
|
{
|
||||||
config,
|
config,
|
||||||
pkgs,
|
pkgs,
|
||||||
lib,
|
lib,
|
||||||
|
|
@ -19,7 +22,8 @@ in {
|
||||||
nodeFlake,
|
nodeFlake,
|
||||||
system,
|
system,
|
||||||
...
|
...
|
||||||
}: {
|
}:
|
||||||
|
{
|
||||||
system.stateVersion = "22.05"; # Did you read the comment?
|
system.stateVersion = "22.05"; # Did you read the comment?
|
||||||
|
|
||||||
disabledModules = [
|
disabledModules = [
|
||||||
|
|
@ -44,7 +48,7 @@ in {
|
||||||
forgejoSshPort
|
forgejoSshPort
|
||||||
];
|
];
|
||||||
|
|
||||||
sops.age.sshKeyPaths = ["/etc/ssh/ssh_host_ed25519_key"];
|
sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
|
||||||
sops.secrets.hedgedoc_environment_file = {
|
sops.secrets.hedgedoc_environment_file = {
|
||||||
sopsFile = ./webserver_secrets.yaml;
|
sopsFile = ./webserver_secrets.yaml;
|
||||||
owner = config.users.users.hedgedoc.name;
|
owner = config.users.users.hedgedoc.name;
|
||||||
|
|
@ -135,9 +139,11 @@ in {
|
||||||
useridField = "uid";
|
useridField = "uid";
|
||||||
};
|
};
|
||||||
|
|
||||||
oauth2 = let
|
oauth2 =
|
||||||
|
let
|
||||||
originURL = config.services.kanidm.serverSettings.origin;
|
originURL = config.services.kanidm.serverSettings.origin;
|
||||||
in {
|
in
|
||||||
|
{
|
||||||
providerName = "kanidm (${originURL})";
|
providerName = "kanidm (${originURL})";
|
||||||
|
|
||||||
authorizationURL = "${originURL}/ui/oauth2";
|
authorizationURL = "${originURL}/ui/oauth2";
|
||||||
|
|
@ -183,9 +189,11 @@ in {
|
||||||
owner = config.users.users.authelia-default.name;
|
owner = config.users.users.authelia-default.name;
|
||||||
};
|
};
|
||||||
|
|
||||||
services.authelia.instances.default = let
|
services.authelia.instances.default =
|
||||||
|
let
|
||||||
baseDir = "/var/lib/authelia-default";
|
baseDir = "/var/lib/authelia-default";
|
||||||
in {
|
in
|
||||||
|
{
|
||||||
enable = true;
|
enable = true;
|
||||||
secrets.storageEncryptionKeyFile = config.sops.secrets.authelia_storageEncryptionKey.path;
|
secrets.storageEncryptionKeyFile = config.sops.secrets.authelia_storageEncryptionKey.path;
|
||||||
secrets.jwtSecretFile = config.sops.secrets.authelia_jwtSecret.path;
|
secrets.jwtSecretFile = config.sops.secrets.authelia_jwtSecret.path;
|
||||||
|
|
@ -224,7 +232,7 @@ in {
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
users.groups.lldap = {};
|
users.groups.lldap = { };
|
||||||
users.users.lldap = {
|
users.users.lldap = {
|
||||||
isSystemUser = true;
|
isSystemUser = true;
|
||||||
group = "lldap";
|
group = "lldap";
|
||||||
|
|
@ -275,9 +283,9 @@ in {
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
sops.secrets.FORGEJO_JWT_SECRET = {};
|
sops.secrets.FORGEJO_JWT_SECRET = { };
|
||||||
sops.secrets.FORGEJO_INTERNAL_TOKEN = {};
|
sops.secrets.FORGEJO_INTERNAL_TOKEN = { };
|
||||||
sops.secrets.FORGEJO_SECRET_KEY = {};
|
sops.secrets.FORGEJO_SECRET_KEY = { };
|
||||||
|
|
||||||
services.forgejo = {
|
services.forgejo = {
|
||||||
enable = true;
|
enable = true;
|
||||||
|
|
@ -307,7 +315,7 @@ in {
|
||||||
# combine a path watcher with a service that transfers the certs by caddy to kanidm
|
# combine a path watcher with a service that transfers the certs by caddy to kanidm
|
||||||
systemd.paths.kanidm-tls-watch = {
|
systemd.paths.kanidm-tls-watch = {
|
||||||
enable = true;
|
enable = true;
|
||||||
requiredBy = ["kanidm.service"];
|
requiredBy = [ "kanidm.service" ];
|
||||||
pathConfig = {
|
pathConfig = {
|
||||||
PathChanged = [
|
PathChanged = [
|
||||||
"${config.services.caddy.dataDir}/.local/share/caddy/certificates/acme-v02.api.letsencrypt.org-directory/${config.services.kanidm.serverSettings.domain}/${config.services.kanidm.serverSettings.domain}.key"
|
"${config.services.caddy.dataDir}/.local/share/caddy/certificates/acme-v02.api.letsencrypt.org-directory/${config.services.kanidm.serverSettings.domain}/${config.services.kanidm.serverSettings.domain}.key"
|
||||||
|
|
@ -316,13 +324,13 @@ in {
|
||||||
Unit = "kanidm-tls-update.service";
|
Unit = "kanidm-tls-update.service";
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
systemd.services.kanidm-tls-update = let
|
systemd.services.kanidm-tls-update =
|
||||||
dbDir =
|
let
|
||||||
builtins.dirOf
|
dbDir = builtins.dirOf config.services.kanidm.serverSettings.db_path;
|
||||||
config.services.kanidm.serverSettings.db_path;
|
in
|
||||||
in {
|
{
|
||||||
enable = true;
|
enable = true;
|
||||||
requiredBy = ["kanidm.service"];
|
requiredBy = [ "kanidm.service" ];
|
||||||
unitConfig = {
|
unitConfig = {
|
||||||
# ConditionPathExists = [
|
# ConditionPathExists = [
|
||||||
# "${config.services.caddy.dataDir}/.local/share/caddy/certificates/acme-v02.api.letsencrypt.org-directory/${config.services.kanidm.serverSettings.domain}/${config.services.kanidm.serverSettings.domain}.key"
|
# "${config.services.caddy.dataDir}/.local/share/caddy/certificates/acme-v02.api.letsencrypt.org-directory/${config.services.kanidm.serverSettings.domain}/${config.services.kanidm.serverSettings.domain}.key"
|
||||||
|
|
@ -330,9 +338,11 @@ in {
|
||||||
# ];
|
# ];
|
||||||
};
|
};
|
||||||
serviceConfig.Type = "oneshot";
|
serviceConfig.Type = "oneshot";
|
||||||
script = let
|
script =
|
||||||
|
let
|
||||||
tlsDir = builtins.dirOf config.services.kanidm.serverSettings.tls_key;
|
tlsDir = builtins.dirOf config.services.kanidm.serverSettings.tls_key;
|
||||||
in ''
|
in
|
||||||
|
''
|
||||||
set -xe
|
set -xe
|
||||||
|
|
||||||
cat "${config.services.caddy.dataDir}/.local/share/caddy/certificates/acme-v02.api.letsencrypt.org-directory/${config.services.kanidm.serverSettings.domain}/${config.services.kanidm.serverSettings.domain}.key" > tls.key
|
cat "${config.services.caddy.dataDir}/.local/share/caddy/certificates/acme-v02.api.letsencrypt.org-directory/${config.services.kanidm.serverSettings.domain}/${config.services.kanidm.serverSettings.domain}.key" > tls.key
|
||||||
|
|
@ -359,12 +369,12 @@ in {
|
||||||
'';
|
'';
|
||||||
};
|
};
|
||||||
|
|
||||||
systemd.services.kanidm.serviceConfig = let
|
systemd.services.kanidm.serviceConfig =
|
||||||
dbDir =
|
let
|
||||||
builtins.dirOf
|
dbDir = builtins.dirOf config.services.kanidm.serverSettings.db_path;
|
||||||
config.services.kanidm.serverSettings.db_path;
|
in
|
||||||
# stateDir = "/var/lib/${config.systemd.services.kanidm.serviceConfig.StateDirectory}";
|
# stateDir = "/var/lib/${config.systemd.services.kanidm.serviceConfig.StateDirectory}";
|
||||||
in {
|
{
|
||||||
# ExecStartPre = ''
|
# ExecStartPre = ''
|
||||||
# mkdir -p ${dbDir}
|
# mkdir -p ${dbDir}
|
||||||
# '';
|
# '';
|
||||||
|
|
@ -374,9 +384,11 @@ in {
|
||||||
];
|
];
|
||||||
};
|
};
|
||||||
|
|
||||||
services.kanidm = let
|
services.kanidm =
|
||||||
|
let
|
||||||
dataDir = "/var/lib/kanidm";
|
dataDir = "/var/lib/kanidm";
|
||||||
in {
|
in
|
||||||
|
{
|
||||||
package = repoFlake.inputs.nixpkgs-kanidm.legacyPackages.${pkgs.system}.kanidm;
|
package = repoFlake.inputs.nixpkgs-kanidm.legacyPackages.${pkgs.system}.kanidm;
|
||||||
|
|
||||||
enablePam = false;
|
enablePam = false;
|
||||||
|
|
|
||||||
|
|
@ -1,15 +1,20 @@
|
||||||
{
|
{
|
||||||
dir,
|
dir,
|
||||||
pkgs ? import <channels-nixos-stable> {},
|
pkgs ? import <channels-nixos-stable> { },
|
||||||
ownLib ? import ../lib/default.nix {inherit (pkgs) lib;},
|
ownLib ? import ../lib/default.nix { inherit (pkgs) lib; },
|
||||||
gitRoot ? "$(git rev-parse --show-toplevel)",
|
gitRoot ? "$(git rev-parse --show-toplevel)",
|
||||||
# FIXME: why do these need explicit mentioning?
|
# FIXME: why do these need explicit mentioning?
|
||||||
moreargs ? "",
|
moreargs ? "",
|
||||||
rebuildarg ? "",
|
rebuildarg ? "",
|
||||||
...
|
...
|
||||||
} @ args: let
|
}@args:
|
||||||
rebuildargsSudo = ["switch" "boot"];
|
let
|
||||||
rebuild = {
|
rebuildargsSudo = [
|
||||||
|
"switch"
|
||||||
|
"boot"
|
||||||
|
];
|
||||||
|
rebuild =
|
||||||
|
{
|
||||||
gitRoot,
|
gitRoot,
|
||||||
rebuildarg ? "dry-activate",
|
rebuildarg ? "dry-activate",
|
||||||
moreargs ? "",
|
moreargs ? "",
|
||||||
|
|
@ -30,18 +35,18 @@
|
||||||
|
|
||||||
${
|
${
|
||||||
if
|
if
|
||||||
(builtins.elem rebuildarg rebuildargsSudo)
|
(builtins.elem rebuildarg rebuildargsSudo) && (builtins.match ".*--target-host.*" moreargs) == null
|
||||||
&& (builtins.match ".*--target-host.*" moreargs) == null
|
then
|
||||||
then "sudo -E \\"
|
"sudo -E \\"
|
||||||
else ""
|
else
|
||||||
|
""
|
||||||
}
|
}
|
||||||
nixos-rebuild --show-trace -I nixos-config=''${NIXOS_CONFIG} ${rebuildarg} ${moreargs}
|
nixos-rebuild --show-trace -I nixos-config=''${NIXOS_CONFIG} ${rebuildarg} ${moreargs}
|
||||||
'';
|
'';
|
||||||
in {
|
in
|
||||||
recipes =
|
{
|
||||||
{
|
recipes = {
|
||||||
rebuild =
|
rebuild = rebuild {
|
||||||
rebuild {
|
|
||||||
inherit gitRoot;
|
inherit gitRoot;
|
||||||
inherit moreargs;
|
inherit moreargs;
|
||||||
inherit rebuildarg;
|
inherit rebuildarg;
|
||||||
|
|
@ -49,6 +54,5 @@ in {
|
||||||
# // pkgs.lib.attrsets.optionalAttrs (moreargs != "") { inherit moreargs; }
|
# // pkgs.lib.attrsets.optionalAttrs (moreargs != "") { inherit moreargs; }
|
||||||
# // pkgs.lib.attrsets.optionalAttrs (rebuildarg != "") { inherit rebuildarg; }
|
# // pkgs.lib.attrsets.optionalAttrs (rebuildarg != "") { inherit rebuildarg; }
|
||||||
;
|
;
|
||||||
}
|
} // (import ./disk.nix (args // { inherit pkgs ownLib gitRoot; }));
|
||||||
// (import ./disk.nix (args // {inherit pkgs ownLib gitRoot;}));
|
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -3,40 +3,29 @@
|
||||||
ownLib,
|
ownLib,
|
||||||
dir,
|
dir,
|
||||||
gitRoot,
|
gitRoot,
|
||||||
diskId ?
|
diskId ? (import ((builtins.getEnv "PWD") + "/${dir}/hw.nix") { }).hardware.opinionatedDisk.diskId,
|
||||||
(import ((builtins.getEnv "PWD") + "/${dir}/hw.nix")
|
|
||||||
{})
|
|
||||||
.hardware
|
|
||||||
.opinionatedDisk
|
|
||||||
.diskId,
|
|
||||||
encrypted ?
|
encrypted ?
|
||||||
(import ((builtins.getEnv "PWD") + "/${dir}/hw.nix")
|
(import ((builtins.getEnv "PWD") + "/${dir}/hw.nix") { }).hardware.opinionatedDisk.encrypted,
|
||||||
{})
|
|
||||||
.hardware
|
|
||||||
.opinionatedDisk
|
|
||||||
.encrypted,
|
|
||||||
previousDiskId ? "",
|
previousDiskId ? "",
|
||||||
...
|
...
|
||||||
}: let
|
}:
|
||||||
|
let
|
||||||
mntRootVol = "/mnt/${diskId}-root";
|
mntRootVol = "/mnt/${diskId}-root";
|
||||||
in rec {
|
in
|
||||||
|
rec {
|
||||||
diskMount = pkgs.writeScript "script" ''
|
diskMount = pkgs.writeScript "script" ''
|
||||||
#!/usr/bin/env bash
|
#!/usr/bin/env bash
|
||||||
set -xe
|
set -xe
|
||||||
echo Mounting ${diskId}
|
echo Mounting ${diskId}
|
||||||
${pkgs.lib.strings.optionalString encrypted ''
|
${pkgs.lib.strings.optionalString encrypted ''
|
||||||
sudo cryptsetup luksOpen ${ownLib.disk.bootLuksDevice diskId} ${
|
sudo cryptsetup luksOpen ${ownLib.disk.bootLuksDevice diskId} ${ownLib.disk.luksName diskId}
|
||||||
ownLib.disk.luksName diskId
|
|
||||||
}
|
|
||||||
''}
|
''}
|
||||||
sleep 1
|
sleep 1
|
||||||
sudo vgchange -ay ${ownLib.disk.volumeGroup diskId}
|
sudo vgchange -ay ${ownLib.disk.volumeGroup diskId}
|
||||||
sudo mkdir -p /mnt
|
sudo mkdir -p /mnt
|
||||||
sudo mkdir ${mntRootVol}
|
sudo mkdir ${mntRootVol}
|
||||||
sudo mount ${ownLib.disk.rootFsDevice diskId} ${mntRootVol}
|
sudo mount ${ownLib.disk.rootFsDevice diskId} ${mntRootVol}
|
||||||
sudo mount ${
|
sudo mount ${ownLib.disk.rootFsDevice diskId} ${mntRootVol}/nixos/home -o subvol=home
|
||||||
ownLib.disk.rootFsDevice diskId
|
|
||||||
} ${mntRootVol}/nixos/home -o subvol=home
|
|
||||||
sudo mount ${ownLib.disk.bootFsDevice diskId} ${mntRootVol}/nixos/boot
|
sudo mount ${ownLib.disk.bootFsDevice diskId} ${mntRootVol}/nixos/boot
|
||||||
'';
|
'';
|
||||||
|
|
||||||
|
|
@ -73,9 +62,7 @@ in rec {
|
||||||
#!/usr/bin/env bash
|
#!/usr/bin/env bash
|
||||||
set -xe
|
set -xe
|
||||||
|
|
||||||
read -p "Continue to format ${
|
read -p "Continue to format ${ownLib.disk.bootGrubDevice diskId} (YES/n)? " choice
|
||||||
ownLib.disk.bootGrubDevice diskId
|
|
||||||
} (YES/n)? " choice
|
|
||||||
case "$choice" in
|
case "$choice" in
|
||||||
YES ) echo "Continuing in 3 seconds..."; sleep 3;;
|
YES ) echo "Continuing in 3 seconds..."; sleep 3;;
|
||||||
n|N ) echo "Exiting..."; exit 0;;
|
n|N ) echo "Exiting..."; exit 0;;
|
||||||
|
|
@ -122,15 +109,11 @@ in rec {
|
||||||
${pkgs.lib.strings.optionalString encrypted ''
|
${pkgs.lib.strings.optionalString encrypted ''
|
||||||
# Encrypt
|
# Encrypt
|
||||||
sudo cryptsetup luksFormat ${ownLib.disk.bootLuksDevice diskId} -
|
sudo cryptsetup luksFormat ${ownLib.disk.bootLuksDevice diskId} -
|
||||||
sudo cryptsetup luksOpen ${ownLib.disk.bootLuksDevice diskId} ${
|
sudo cryptsetup luksOpen ${ownLib.disk.bootLuksDevice diskId} ${ownLib.disk.luksName diskId}
|
||||||
ownLib.disk.luksName diskId
|
|
||||||
}
|
|
||||||
''}
|
''}
|
||||||
|
|
||||||
# LVM
|
# LVM
|
||||||
sudo vgcreate ${ownLib.disk.volumeGroup diskId} ${
|
sudo vgcreate ${ownLib.disk.volumeGroup diskId} ${ownLib.disk.lvmPv diskId encrypted}
|
||||||
ownLib.disk.lvmPv diskId encrypted
|
|
||||||
}
|
|
||||||
sudo lvcreate ${ownLib.disk.volumeGroup diskId} -L 2G -n swap
|
sudo lvcreate ${ownLib.disk.volumeGroup diskId} -L 2G -n swap
|
||||||
sudo lvcreate ${ownLib.disk.volumeGroup diskId} -l 100%FREE -n root
|
sudo lvcreate ${ownLib.disk.volumeGroup diskId} -l 100%FREE -n root
|
||||||
|
|
||||||
|
|
@ -154,9 +137,7 @@ in rec {
|
||||||
#!/usr/bin/env bash
|
#!/usr/bin/env bash
|
||||||
set -xe
|
set -xe
|
||||||
|
|
||||||
read -p "Continue to relabel ${
|
read -p "Continue to relabel ${ownLib.disk.bootGrubDevice diskId} (YES/n)?" choice
|
||||||
ownLib.disk.bootGrubDevice diskId
|
|
||||||
} (YES/n)?" choice
|
|
||||||
case "$choice" in
|
case "$choice" in
|
||||||
YES ) echo "Continuing in 3 seconds..."; sleep 3;;
|
YES ) echo "Continuing in 3 seconds..."; sleep 3;;
|
||||||
n|N ) echo "Exiting..."; exit 0;;
|
n|N ) echo "Exiting..."; exit 0;;
|
||||||
|
|
@ -187,13 +168,9 @@ in rec {
|
||||||
|
|
||||||
|
|
||||||
if test "${previousDiskId}"; then
|
if test "${previousDiskId}"; then
|
||||||
${
|
${pkgs.lib.strings.optionalString encrypted ''
|
||||||
pkgs.lib.strings.optionalString encrypted ''
|
sudo cryptsetup luksOpen ${ownLib.disk.bootLuksDevice diskId} ${ownLib.disk.luksName diskId}
|
||||||
sudo cryptsetup luksOpen ${ownLib.disk.bootLuksDevice diskId} ${
|
''}
|
||||||
ownLib.disk.luksName diskId
|
|
||||||
}
|
|
||||||
''
|
|
||||||
}
|
|
||||||
sync
|
sync
|
||||||
sleep 1
|
sleep 1
|
||||||
if sudo vgs ${previousDiskId}; then
|
if sudo vgs ${previousDiskId}; then
|
||||||
|
|
|
||||||
|
|
@ -1,4 +1,5 @@
|
||||||
{lib, ...}: {
|
{ lib, ... }:
|
||||||
|
{
|
||||||
boot.loader.grub.efiSupport = lib.mkForce false;
|
boot.loader.grub.efiSupport = lib.mkForce false;
|
||||||
boot.loader.efi.canTouchEfiVariables = lib.mkForce false;
|
boot.loader.efi.canTouchEfiVariables = lib.mkForce false;
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -1,4 +1,5 @@
|
||||||
{...}: {
|
{ ... }:
|
||||||
|
{
|
||||||
imports = [
|
imports = [
|
||||||
../../profiles/common/configuration.nix
|
../../profiles/common/configuration.nix
|
||||||
../../profiles/graphical/configuration.nix
|
../../profiles/graphical/configuration.nix
|
||||||
|
|
|
||||||
|
|
@ -3,17 +3,17 @@
|
||||||
repoFlake,
|
repoFlake,
|
||||||
nodeFlake,
|
nodeFlake,
|
||||||
...
|
...
|
||||||
}: let
|
}:
|
||||||
|
let
|
||||||
system = "x86_64-linux";
|
system = "x86_64-linux";
|
||||||
in {
|
in
|
||||||
|
{
|
||||||
meta.nodeSpecialArgs.${nodeName} = {
|
meta.nodeSpecialArgs.${nodeName} = {
|
||||||
inherit repoFlake nodeName nodeFlake;
|
inherit repoFlake nodeName nodeFlake;
|
||||||
packages' = repoFlake.packages.${system};
|
packages' = repoFlake.packages.${system};
|
||||||
};
|
};
|
||||||
|
|
||||||
meta.nodeNixpkgs.${nodeName} = import nodeFlake.inputs.nixpkgs.outPath {
|
meta.nodeNixpkgs.${nodeName} = import nodeFlake.inputs.nixpkgs.outPath { inherit system; };
|
||||||
inherit system;
|
|
||||||
};
|
|
||||||
|
|
||||||
${nodeName} = {
|
${nodeName} = {
|
||||||
deployment.targetHost = "elias-e525.lan";
|
deployment.targetHost = "elias-e525.lan";
|
||||||
|
|
|
||||||
|
|
@ -6,5 +6,5 @@
|
||||||
inputs.nixpkgs.follows = "nixpkgs";
|
inputs.nixpkgs.follows = "nixpkgs";
|
||||||
};
|
};
|
||||||
|
|
||||||
outputs = _: {};
|
outputs = _: { };
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -1,4 +1,5 @@
|
||||||
{...}: {
|
{ ... }:
|
||||||
|
{
|
||||||
# TASK: new device
|
# TASK: new device
|
||||||
hardware.opinionatedDisk = {
|
hardware.opinionatedDisk = {
|
||||||
enable = true;
|
enable = true;
|
||||||
|
|
|
||||||
|
|
@ -1,8 +1,5 @@
|
||||||
{
|
{ pkgs, lib, ... }:
|
||||||
pkgs,
|
let
|
||||||
lib,
|
|
||||||
...
|
|
||||||
}: let
|
|
||||||
homeEnv = keyboard: {
|
homeEnv = keyboard: {
|
||||||
imports = [
|
imports = [
|
||||||
../../../home-manager/profiles/common.nix
|
../../../home-manager/profiles/common.nix
|
||||||
|
|
@ -22,26 +19,27 @@
|
||||||
rustdesk
|
rustdesk
|
||||||
];
|
];
|
||||||
};
|
};
|
||||||
in {
|
in
|
||||||
|
{
|
||||||
services.gnome = builtins.mapAttrs (attr: value: lib.mkForce value) {
|
services.gnome = builtins.mapAttrs (attr: value: lib.mkForce value) {
|
||||||
gnome-remote-desktop.enable = true;
|
gnome-remote-desktop.enable = true;
|
||||||
};
|
};
|
||||||
|
|
||||||
home-manager.users.steveej = homeEnv {
|
home-manager.users.steveej = homeEnv {
|
||||||
layout = "en";
|
layout = "en";
|
||||||
options = ["nodeadkey"];
|
options = [ "nodeadkey" ];
|
||||||
variant = "altgr-intl";
|
variant = "altgr-intl";
|
||||||
};
|
};
|
||||||
|
|
||||||
home-manager.users.elias = homeEnv {
|
home-manager.users.elias = homeEnv {
|
||||||
layout = "de";
|
layout = "de";
|
||||||
options = [];
|
options = [ ];
|
||||||
variant = "";
|
variant = "";
|
||||||
};
|
};
|
||||||
|
|
||||||
home-manager.users.justyna = homeEnv {
|
home-manager.users.justyna = homeEnv {
|
||||||
layout = "de";
|
layout = "de";
|
||||||
options = [];
|
options = [ ];
|
||||||
variant = "";
|
variant = "";
|
||||||
};
|
};
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -3,8 +3,10 @@
|
||||||
lib,
|
lib,
|
||||||
config,
|
config,
|
||||||
...
|
...
|
||||||
}: let
|
}:
|
||||||
in {
|
let
|
||||||
|
in
|
||||||
|
{
|
||||||
# TASK: new device
|
# TASK: new device
|
||||||
networking.hostName = "elias-e525"; # Define your hostname.
|
networking.hostName = "elias-e525"; # Define your hostname.
|
||||||
|
|
||||||
|
|
@ -38,11 +40,13 @@ in {
|
||||||
# udev.packages = [ pkgs.gnome3.gnome-settings-daemon ];
|
# udev.packages = [ pkgs.gnome3.gnome-settings-daemon ];
|
||||||
};
|
};
|
||||||
|
|
||||||
security.pki.certificateFiles = ["${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt"];
|
security.pki.certificateFiles = [ "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt" ];
|
||||||
|
|
||||||
services.xserver.videoDrivers = ["modesetting"];
|
services.xserver.videoDrivers = [ "modesetting" ];
|
||||||
|
|
||||||
boot.kernelPackages = lib.mkForce pkgs.linuxPackages_latest;
|
boot.kernelPackages = lib.mkForce pkgs.linuxPackages_latest;
|
||||||
|
|
||||||
nix.gc = {automatic = true;};
|
nix.gc = {
|
||||||
|
automatic = true;
|
||||||
|
};
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -3,10 +3,12 @@
|
||||||
pkgs,
|
pkgs,
|
||||||
lib,
|
lib,
|
||||||
...
|
...
|
||||||
}: let
|
}:
|
||||||
|
let
|
||||||
keys = import ../../../variables/keys.nix;
|
keys = import ../../../variables/keys.nix;
|
||||||
inherit (pkgs.callPackage ../../lib/default.nix {}) mkUser;
|
inherit (pkgs.callPackage ../../lib/default.nix { }) mkUser;
|
||||||
in {
|
in
|
||||||
|
{
|
||||||
sops.secrets.sharedUsers-elias = {
|
sops.secrets.sharedUsers-elias = {
|
||||||
sopsFile = ../../../../secrets/shared-users.yaml;
|
sopsFile = ../../../../secrets/shared-users.yaml;
|
||||||
neededForUsers = true;
|
neededForUsers = true;
|
||||||
|
|
|
||||||
|
|
@ -1,4 +1,5 @@
|
||||||
{lib, ...}: {
|
{ lib, ... }:
|
||||||
|
{
|
||||||
boot.loader.grub.efiInstallAsRemovable = lib.mkForce true;
|
boot.loader.grub.efiInstallAsRemovable = lib.mkForce true;
|
||||||
boot.loader.efi.canTouchEfiVariables = lib.mkForce false;
|
boot.loader.efi.canTouchEfiVariables = lib.mkForce false;
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -1,4 +1,5 @@
|
||||||
{...}: {
|
{ ... }:
|
||||||
|
{
|
||||||
imports = [
|
imports = [
|
||||||
../../profiles/common/configuration.nix
|
../../profiles/common/configuration.nix
|
||||||
../../modules/opinionatedDisk.nix
|
../../modules/opinionatedDisk.nix
|
||||||
|
|
|
||||||
|
|
@ -1,5 +1,7 @@
|
||||||
{...}: let
|
{ ... }:
|
||||||
in {
|
let
|
||||||
|
in
|
||||||
|
{
|
||||||
# TASK: new device
|
# TASK: new device
|
||||||
hardware.opinionatedDisk = {
|
hardware.opinionatedDisk = {
|
||||||
enable = true;
|
enable = true;
|
||||||
|
|
|
||||||
|
|
@ -1,17 +1,17 @@
|
||||||
{pkgs, ...}: {
|
{ pkgs, ... }:
|
||||||
nixpkgs.config.packageOverrides = pkgs:
|
{
|
||||||
with pkgs; {
|
nixpkgs.config.packageOverrides =
|
||||||
nixPath =
|
pkgs: with pkgs; {
|
||||||
(import ../../../default.nix {
|
nixPath = (import ../../../default.nix { versionsPath = ./versions.nix; }).nixPath;
|
||||||
versionsPath = ./versions.nix;
|
|
||||||
})
|
|
||||||
.nixPath;
|
|
||||||
};
|
};
|
||||||
home-manager.users.steveej = import ../../../home-manager/configuration/text-minimal.nix {
|
home-manager.users.steveej = import ../../../home-manager/configuration/text-minimal.nix {
|
||||||
inherit pkgs;
|
inherit pkgs;
|
||||||
};
|
};
|
||||||
|
|
||||||
environment.systemPackages = with pkgs; [iw wirelesstools];
|
environment.systemPackages = with pkgs; [
|
||||||
|
iw
|
||||||
|
wirelesstools
|
||||||
|
];
|
||||||
|
|
||||||
system.stateVersion = "21.11";
|
system.stateVersion = "21.11";
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -3,10 +3,12 @@
|
||||||
lib,
|
lib,
|
||||||
config,
|
config,
|
||||||
...
|
...
|
||||||
}: let
|
}:
|
||||||
|
let
|
||||||
keys = import ../../../variables/keys.nix;
|
keys = import ../../../variables/keys.nix;
|
||||||
passwords = import ../../../variables/passwords.crypt.nix;
|
passwords = import ../../../variables/passwords.crypt.nix;
|
||||||
in {
|
in
|
||||||
|
{
|
||||||
# TASK: new device
|
# TASK: new device
|
||||||
networking.hostName = "fwhost1"; # Define your hostname.
|
networking.hostName = "fwhost1"; # Define your hostname.
|
||||||
|
|
||||||
|
|
@ -21,11 +23,14 @@ in {
|
||||||
networking.firewall.logRefusedConnections = false;
|
networking.firewall.logRefusedConnections = false;
|
||||||
networking.usePredictableInterfaceNames = false;
|
networking.usePredictableInterfaceNames = false;
|
||||||
|
|
||||||
networking.bridges.breth.interfaces = ["eth0" "eth1"];
|
networking.bridges.breth.interfaces = [
|
||||||
|
"eth0"
|
||||||
|
"eth1"
|
||||||
|
];
|
||||||
networking.bridges.breth.rstp = true;
|
networking.bridges.breth.rstp = true;
|
||||||
|
|
||||||
networking.defaultGateway.address = "172.172.171.10";
|
networking.defaultGateway.address = "172.172.171.10";
|
||||||
networking.nameservers = ["172.172.171.10"];
|
networking.nameservers = [ "172.172.171.10" ];
|
||||||
|
|
||||||
# WAN interfaces, currently unused because the OPNsense guest acts as a router.
|
# WAN interfaces, currently unused because the OPNsense guest acts as a router.
|
||||||
networking.vlans.wan1.id = 3;
|
networking.vlans.wan1.id = 3;
|
||||||
|
|
|
||||||
|
|
@ -1,9 +1,7 @@
|
||||||
{
|
{ config, pkgs, ... }:
|
||||||
config,
|
let
|
||||||
pkgs,
|
|
||||||
...
|
|
||||||
}: let
|
|
||||||
passwords = import ../../../variables/passwords.crypt.nix;
|
passwords = import ../../../variables/passwords.crypt.nix;
|
||||||
keys = import ../../../variables/keys.nix;
|
keys = import ../../../variables/keys.nix;
|
||||||
inherit (import ../../lib/default.nix {}) mkUser;
|
inherit (import ../../lib/default.nix { }) mkUser;
|
||||||
in {}
|
in
|
||||||
|
{ }
|
||||||
|
|
|
||||||
|
|
@ -4,9 +4,12 @@ let
|
||||||
ref = "nixos-21.11";
|
ref = "nixos-21.11";
|
||||||
rev = "386234e2a61e1e8acf94dfa3a3d3ca19a6776efb";
|
rev = "386234e2a61e1e8acf94dfa3a3d3ca19a6776efb";
|
||||||
};
|
};
|
||||||
in {
|
in
|
||||||
|
{
|
||||||
inherit nixpkgs;
|
inherit nixpkgs;
|
||||||
nixos = nixpkgs // {suffix = "/nixos";};
|
nixos = nixpkgs // {
|
||||||
|
suffix = "/nixos";
|
||||||
|
};
|
||||||
"channels-nixos-stable" = nixpkgs;
|
"channels-nixos-stable" = nixpkgs;
|
||||||
|
|
||||||
"channels-nixos-unstable" = {
|
"channels-nixos-unstable" = {
|
||||||
|
|
|
||||||
|
|
@ -6,9 +6,12 @@ let
|
||||||
<% git ls-remote https://github.com/nixos/nixpkgs nixos-21.11 | awk '{ print $1 }' | tr -d '
|
<% git ls-remote https://github.com/nixos/nixpkgs nixos-21.11 | awk '{ print $1 }' | tr -d '
|
||||||
' -%>'';
|
' -%>'';
|
||||||
};
|
};
|
||||||
in {
|
in
|
||||||
|
{
|
||||||
inherit nixpkgs;
|
inherit nixpkgs;
|
||||||
nixos = nixpkgs // {suffix = "/nixos";};
|
nixos = nixpkgs // {
|
||||||
|
suffix = "/nixos";
|
||||||
|
};
|
||||||
"channels-nixos-stable" = nixpkgs;
|
"channels-nixos-stable" = nixpkgs;
|
||||||
|
|
||||||
"channels-nixos-unstable" = {
|
"channels-nixos-unstable" = {
|
||||||
|
|
|
||||||
|
|
@ -1,4 +1,5 @@
|
||||||
{lib, ...}: {
|
{ lib, ... }:
|
||||||
|
{
|
||||||
boot.loader.grub.efiInstallAsRemovable = lib.mkForce true;
|
boot.loader.grub.efiInstallAsRemovable = lib.mkForce true;
|
||||||
boot.loader.efi.canTouchEfiVariables = lib.mkForce false;
|
boot.loader.efi.canTouchEfiVariables = lib.mkForce false;
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -1,4 +1,5 @@
|
||||||
{...}: {
|
{ ... }:
|
||||||
|
{
|
||||||
imports = [
|
imports = [
|
||||||
../../profiles/common/configuration.nix
|
../../profiles/common/configuration.nix
|
||||||
../../modules/opinionatedDisk.nix
|
../../modules/opinionatedDisk.nix
|
||||||
|
|
|
||||||
|
|
@ -1,5 +1,7 @@
|
||||||
{...}: let
|
{ ... }:
|
||||||
in {
|
let
|
||||||
|
in
|
||||||
|
{
|
||||||
# TASK: new device
|
# TASK: new device
|
||||||
hardware.opinionatedDisk = {
|
hardware.opinionatedDisk = {
|
||||||
enable = true;
|
enable = true;
|
||||||
|
|
|
||||||
|
|
@ -1,17 +1,17 @@
|
||||||
{pkgs, ...}: {
|
{ pkgs, ... }:
|
||||||
nixpkgs.config.packageOverrides = pkgs:
|
{
|
||||||
with pkgs; {
|
nixpkgs.config.packageOverrides =
|
||||||
nixPath =
|
pkgs: with pkgs; {
|
||||||
(import ../../../default.nix {
|
nixPath = (import ../../../default.nix { versionsPath = ./versions.nix; }).nixPath;
|
||||||
versionsPath = ./versions.nix;
|
|
||||||
})
|
|
||||||
.nixPath;
|
|
||||||
};
|
};
|
||||||
home-manager.users.steveej = import ../../../home-manager/configuration/text-minimal.nix {
|
home-manager.users.steveej = import ../../../home-manager/configuration/text-minimal.nix {
|
||||||
inherit pkgs;
|
inherit pkgs;
|
||||||
};
|
};
|
||||||
|
|
||||||
environment.systemPackages = with pkgs; [iw wirelesstools];
|
environment.systemPackages = with pkgs; [
|
||||||
|
iw
|
||||||
|
wirelesstools
|
||||||
|
];
|
||||||
|
|
||||||
system.stateVersion = "21.11";
|
system.stateVersion = "21.11";
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -4,10 +4,12 @@
|
||||||
config,
|
config,
|
||||||
utils,
|
utils,
|
||||||
...
|
...
|
||||||
}: let
|
}:
|
||||||
|
let
|
||||||
keys = import ../../../variables/keys.nix;
|
keys = import ../../../variables/keys.nix;
|
||||||
passwords = import ../../../variables/passwords.crypt.nix;
|
passwords = import ../../../variables/passwords.crypt.nix;
|
||||||
in {
|
in
|
||||||
|
{
|
||||||
# TASK: new device
|
# TASK: new device
|
||||||
networking.hostName = "fwhost2"; # Define your hostname.
|
networking.hostName = "fwhost2"; # Define your hostname.
|
||||||
|
|
||||||
|
|
@ -22,11 +24,14 @@ in {
|
||||||
networking.firewall.logRefusedConnections = false;
|
networking.firewall.logRefusedConnections = false;
|
||||||
networking.usePredictableInterfaceNames = false;
|
networking.usePredictableInterfaceNames = false;
|
||||||
|
|
||||||
networking.bridges.breth.interfaces = ["eth0" "eth1"];
|
networking.bridges.breth.interfaces = [
|
||||||
|
"eth0"
|
||||||
|
"eth1"
|
||||||
|
];
|
||||||
networking.bridges.breth.rstp = true;
|
networking.bridges.breth.rstp = true;
|
||||||
|
|
||||||
networking.defaultGateway.address = "172.172.171.10";
|
networking.defaultGateway.address = "172.172.171.10";
|
||||||
networking.nameservers = ["172.172.171.10"];
|
networking.nameservers = [ "172.172.171.10" ];
|
||||||
|
|
||||||
# WAN interfaces, currently unused because the OPNsense guest acts as a router.
|
# WAN interfaces, currently unused because the OPNsense guest acts as a router.
|
||||||
networking.vlans.wan1.id = 3;
|
networking.vlans.wan1.id = 3;
|
||||||
|
|
|
||||||
|
|
@ -1,12 +1,10 @@
|
||||||
{
|
{ config, pkgs, ... }:
|
||||||
config,
|
let
|
||||||
pkgs,
|
|
||||||
...
|
|
||||||
}: let
|
|
||||||
passwords = import ../../../variables/passwords.crypt.nix;
|
passwords = import ../../../variables/passwords.crypt.nix;
|
||||||
keys = import ../../../variables/keys.nix;
|
keys = import ../../../variables/keys.nix;
|
||||||
inherit (import ../../lib/default.nix {inherit (pkgs) lib;}) mkUser;
|
inherit (import ../../lib/default.nix { inherit (pkgs) lib; }) mkUser;
|
||||||
in {
|
in
|
||||||
|
{
|
||||||
# users.extraUsers.steveej2 = mkUser {
|
# users.extraUsers.steveej2 = mkUser {
|
||||||
# uid = 1001;
|
# uid = 1001;
|
||||||
# openssh.authorizedKeys.keys = keys.users.steveej.openssh;
|
# openssh.authorizedKeys.keys = keys.users.steveej.openssh;
|
||||||
|
|
|
||||||
|
|
@ -4,9 +4,12 @@ let
|
||||||
ref = "nixos-21.11";
|
ref = "nixos-21.11";
|
||||||
rev = "386234e2a61e1e8acf94dfa3a3d3ca19a6776efb";
|
rev = "386234e2a61e1e8acf94dfa3a3d3ca19a6776efb";
|
||||||
};
|
};
|
||||||
in {
|
in
|
||||||
|
{
|
||||||
inherit nixpkgs;
|
inherit nixpkgs;
|
||||||
nixos = nixpkgs // {suffix = "/nixos";};
|
nixos = nixpkgs // {
|
||||||
|
suffix = "/nixos";
|
||||||
|
};
|
||||||
"channels-nixos-stable" = nixpkgs;
|
"channels-nixos-stable" = nixpkgs;
|
||||||
|
|
||||||
"channels-nixos-unstable" = {
|
"channels-nixos-unstable" = {
|
||||||
|
|
|
||||||
|
|
@ -6,9 +6,12 @@ let
|
||||||
<% git ls-remote https://github.com/nixos/nixpkgs nixos-21.11 | awk '{ print $1 }' | tr -d '
|
<% git ls-remote https://github.com/nixos/nixpkgs nixos-21.11 | awk '{ print $1 }' | tr -d '
|
||||||
' -%>'';
|
' -%>'';
|
||||||
};
|
};
|
||||||
in {
|
in
|
||||||
|
{
|
||||||
inherit nixpkgs;
|
inherit nixpkgs;
|
||||||
nixos = nixpkgs // {suffix = "/nixos";};
|
nixos = nixpkgs // {
|
||||||
|
suffix = "/nixos";
|
||||||
|
};
|
||||||
"channels-nixos-stable" = nixpkgs;
|
"channels-nixos-stable" = nixpkgs;
|
||||||
|
|
||||||
"channels-nixos-unstable" = {
|
"channels-nixos-unstable" = {
|
||||||
|
|
|
||||||
|
|
@ -9,9 +9,9 @@
|
||||||
nodeName,
|
nodeName,
|
||||||
system,
|
system,
|
||||||
...
|
...
|
||||||
}: {
|
}:
|
||||||
disabledModules = [
|
{
|
||||||
];
|
disabledModules = [ ];
|
||||||
|
|
||||||
imports = [
|
imports = [
|
||||||
nodeFlake.inputs.disko.nixosModules.disko
|
nodeFlake.inputs.disko.nixosModules.disko
|
||||||
|
|
@ -28,9 +28,7 @@
|
||||||
}
|
}
|
||||||
|
|
||||||
../../snippets/nix-settings.nix
|
../../snippets/nix-settings.nix
|
||||||
{
|
{ nix.settings.sandbox = lib.mkForce "relaxed"; }
|
||||||
nix.settings.sandbox = lib.mkForce "relaxed";
|
|
||||||
}
|
|
||||||
|
|
||||||
../../snippets/mycelium.nix
|
../../snippets/mycelium.nix
|
||||||
|
|
||||||
|
|
@ -80,15 +78,12 @@
|
||||||
nat.enable = true;
|
nat.enable = true;
|
||||||
firewall.enable = true;
|
firewall.enable = true;
|
||||||
|
|
||||||
firewall.allowedTCPPorts = [
|
firewall.allowedTCPPorts = [ 5201 ];
|
||||||
5201
|
firewall.allowedUDPPorts = [ 5201 ];
|
||||||
];
|
|
||||||
firewall.allowedUDPPorts = [
|
|
||||||
5201
|
|
||||||
];
|
|
||||||
};
|
};
|
||||||
|
|
||||||
disko.devices = let
|
disko.devices =
|
||||||
|
let
|
||||||
disk = id: {
|
disk = id: {
|
||||||
type = "disk";
|
type = "disk";
|
||||||
device = "/dev/${id}";
|
device = "/dev/${id}";
|
||||||
|
|
@ -109,7 +104,8 @@
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
in {
|
in
|
||||||
|
{
|
||||||
disk = {
|
disk = {
|
||||||
sda = disk "sda";
|
sda = disk "sda";
|
||||||
sdb = disk "sdb";
|
sdb = disk "sdb";
|
||||||
|
|
@ -149,7 +145,5 @@
|
||||||
|
|
||||||
virtualisation.libvirtd.enable = true;
|
virtualisation.libvirtd.enable = true;
|
||||||
|
|
||||||
boot.binfmt.emulatedSystems = [
|
boot.binfmt.emulatedSystems = [ "aarch64-linux" ];
|
||||||
"aarch64-linux"
|
|
||||||
];
|
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -3,19 +3,22 @@
|
||||||
repoFlake,
|
repoFlake,
|
||||||
nodeFlake,
|
nodeFlake,
|
||||||
...
|
...
|
||||||
}: let
|
}:
|
||||||
|
let
|
||||||
system = "x86_64-linux";
|
system = "x86_64-linux";
|
||||||
in {
|
in
|
||||||
|
{
|
||||||
meta.nodeSpecialArgs.${nodeName} = {
|
meta.nodeSpecialArgs.${nodeName} = {
|
||||||
inherit repoFlake nodeName nodeFlake system;
|
inherit
|
||||||
|
repoFlake
|
||||||
|
nodeName
|
||||||
|
nodeFlake
|
||||||
|
system
|
||||||
|
;
|
||||||
packages' = repoFlake.packages.${system};
|
packages' = repoFlake.packages.${system};
|
||||||
};
|
};
|
||||||
|
|
||||||
meta.nodeNixpkgs.${nodeName} =
|
meta.nodeNixpkgs.${nodeName} = import nodeFlake.inputs.nixpkgs.outPath { inherit system; };
|
||||||
import nodeFlake.inputs.nixpkgs.outPath
|
|
||||||
{
|
|
||||||
inherit system;
|
|
||||||
};
|
|
||||||
|
|
||||||
${nodeName} = {
|
${nodeName} = {
|
||||||
deployment.targetHost = "185.130.224.33";
|
deployment.targetHost = "185.130.224.33";
|
||||||
|
|
|
||||||
|
|
@ -16,38 +16,37 @@
|
||||||
|
|
||||||
# outputs = _: {};
|
# outputs = _: {};
|
||||||
|
|
||||||
outputs = {
|
outputs =
|
||||||
|
{
|
||||||
self,
|
self,
|
||||||
get-flake,
|
get-flake,
|
||||||
nixpkgs,
|
nixpkgs,
|
||||||
...
|
...
|
||||||
} @ attrs: let
|
}@attrs:
|
||||||
|
let
|
||||||
system = "x86_64-linux";
|
system = "x86_64-linux";
|
||||||
nodeName = "hostkey-0";
|
nodeName = "hostkey-0";
|
||||||
|
|
||||||
mkNixosConfiguration = {extraModules ? [], ...} @ attrs:
|
mkNixosConfiguration =
|
||||||
nixpkgs.lib.nixosSystem (
|
|
||||||
nixpkgs.lib.attrsets.recursiveUpdate
|
|
||||||
attrs
|
|
||||||
{
|
{
|
||||||
|
extraModules ? [ ],
|
||||||
|
...
|
||||||
|
}@attrs:
|
||||||
|
nixpkgs.lib.nixosSystem (
|
||||||
|
nixpkgs.lib.attrsets.recursiveUpdate attrs {
|
||||||
specialArgs = {
|
specialArgs = {
|
||||||
nodeFlake = self;
|
nodeFlake = self;
|
||||||
repoFlake = get-flake ../../../..;
|
repoFlake = get-flake ../../../..;
|
||||||
inherit nodeName;
|
inherit nodeName;
|
||||||
};
|
};
|
||||||
|
|
||||||
modules =
|
modules = [ ./configuration.nix ] ++ extraModules;
|
||||||
[
|
|
||||||
./configuration.nix
|
|
||||||
]
|
|
||||||
++ extraModules;
|
|
||||||
}
|
}
|
||||||
);
|
);
|
||||||
in {
|
in
|
||||||
|
{
|
||||||
nixosConfigurations = {
|
nixosConfigurations = {
|
||||||
native = mkNixosConfiguration {
|
native = mkNixosConfiguration { inherit system; };
|
||||||
inherit system;
|
|
||||||
};
|
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -1,4 +1,5 @@
|
||||||
{lib, ...}: {
|
{ lib, ... }:
|
||||||
|
{
|
||||||
boot.loader.grub.efiInstallAsRemovable = lib.mkForce false;
|
boot.loader.grub.efiInstallAsRemovable = lib.mkForce false;
|
||||||
boot.loader.efi.canTouchEfiVariables = lib.mkForce false;
|
boot.loader.efi.canTouchEfiVariables = lib.mkForce false;
|
||||||
boot.loader.grub.efiSupport = lib.mkForce false;
|
boot.loader.grub.efiSupport = lib.mkForce false;
|
||||||
|
|
|
||||||
|
|
@ -1,4 +1,5 @@
|
||||||
{...}: {
|
{ ... }:
|
||||||
|
{
|
||||||
imports = [
|
imports = [
|
||||||
../../profiles/common/configuration.nix
|
../../profiles/common/configuration.nix
|
||||||
../../profiles/graphical/configuration.nix
|
../../profiles/graphical/configuration.nix
|
||||||
|
|
|
||||||
|
|
@ -3,17 +3,17 @@
|
||||||
repoFlake,
|
repoFlake,
|
||||||
nodeFlake,
|
nodeFlake,
|
||||||
...
|
...
|
||||||
}: let
|
}:
|
||||||
|
let
|
||||||
system = "x86_64-linux";
|
system = "x86_64-linux";
|
||||||
in {
|
in
|
||||||
|
{
|
||||||
meta.nodeSpecialArgs.${nodeName} = {
|
meta.nodeSpecialArgs.${nodeName} = {
|
||||||
inherit repoFlake nodeName nodeFlake;
|
inherit repoFlake nodeName nodeFlake;
|
||||||
packages' = repoFlake.packages.${system};
|
packages' = repoFlake.packages.${system};
|
||||||
};
|
};
|
||||||
|
|
||||||
meta.nodeNixpkgs.${nodeName} = import nodeFlake.inputs.nixpkgs.outPath {
|
meta.nodeNixpkgs.${nodeName} = import nodeFlake.inputs.nixpkgs.outPath { inherit system; };
|
||||||
inherit system;
|
|
||||||
};
|
|
||||||
|
|
||||||
${nodeName} = {
|
${nodeName} = {
|
||||||
deployment.targetHost = nodeName;
|
deployment.targetHost = nodeName;
|
||||||
|
|
|
||||||
|
|
@ -6,8 +6,8 @@
|
||||||
inputs.nixpkgs.follows = "nixpkgs";
|
inputs.nixpkgs.follows = "nixpkgs";
|
||||||
};
|
};
|
||||||
|
|
||||||
inputs.disko.url = github:nix-community/disko;
|
inputs.disko.url = "github:nix-community/disko";
|
||||||
inputs.disko.inputs.nixpkgs.follows = "nixpkgs";
|
inputs.disko.inputs.nixpkgs.follows = "nixpkgs";
|
||||||
|
|
||||||
outputs = _: {};
|
outputs = _: { };
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -3,10 +3,9 @@
|
||||||
nodeFlake,
|
nodeFlake,
|
||||||
lib,
|
lib,
|
||||||
...
|
...
|
||||||
}: {
|
}:
|
||||||
imports = [
|
{
|
||||||
nodeFlake.inputs.disko.nixosModules.disko
|
imports = [ nodeFlake.inputs.disko.nixosModules.disko ];
|
||||||
];
|
|
||||||
|
|
||||||
disko.devices.disk.sda = {
|
disko.devices.disk.sda = {
|
||||||
device = "/dev/sda";
|
device = "/dev/sda";
|
||||||
|
|
@ -20,7 +19,7 @@
|
||||||
start = "0";
|
start = "0";
|
||||||
end = "1M";
|
end = "1M";
|
||||||
part-type = "primary";
|
part-type = "primary";
|
||||||
flags = ["bios_grub"];
|
flags = [ "bios_grub" ];
|
||||||
}
|
}
|
||||||
{
|
{
|
||||||
name = "root";
|
name = "root";
|
||||||
|
|
@ -30,14 +29,14 @@
|
||||||
bootable = true;
|
bootable = true;
|
||||||
content = {
|
content = {
|
||||||
type = "btrfs";
|
type = "btrfs";
|
||||||
extraArgs = ["-f"]; # Override existing partition
|
extraArgs = [ "-f" ]; # Override existing partition
|
||||||
subvolumes = {
|
subvolumes = {
|
||||||
# Subvolume name is different from mountpoint
|
# Subvolume name is different from mountpoint
|
||||||
"/rootfs" = {
|
"/rootfs" = {
|
||||||
mountpoint = "/";
|
mountpoint = "/";
|
||||||
};
|
};
|
||||||
"/nix" = {
|
"/nix" = {
|
||||||
mountOptions = ["noatime"];
|
mountOptions = [ "noatime" ];
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
|
||||||
|
|
@ -3,7 +3,8 @@
|
||||||
lib,
|
lib,
|
||||||
packages',
|
packages',
|
||||||
...
|
...
|
||||||
}: let
|
}:
|
||||||
|
let
|
||||||
homeEnv = keyboard: {
|
homeEnv = keyboard: {
|
||||||
imports = [
|
imports = [
|
||||||
../../../home-manager/profiles/common.nix
|
../../../home-manager/profiles/common.nix
|
||||||
|
|
@ -23,15 +24,19 @@
|
||||||
rustdesk
|
rustdesk
|
||||||
];
|
];
|
||||||
};
|
};
|
||||||
in {
|
in
|
||||||
|
{
|
||||||
services.gnome = builtins.mapAttrs (attr: value: lib.mkForce value) {
|
services.gnome = builtins.mapAttrs (attr: value: lib.mkForce value) {
|
||||||
gnome-remote-desktop.enable = true;
|
gnome-remote-desktop.enable = true;
|
||||||
};
|
};
|
||||||
|
|
||||||
services.printing.drivers = lib.mkForce (with packages'; [
|
services.printing.drivers = lib.mkForce (
|
||||||
|
with packages';
|
||||||
|
[
|
||||||
dcpj4110dwDriver
|
dcpj4110dwDriver
|
||||||
dcpj4110dwCupswrapper
|
dcpj4110dwCupswrapper
|
||||||
]);
|
]
|
||||||
|
);
|
||||||
|
|
||||||
services.printing.extraConf = ''
|
services.printing.extraConf = ''
|
||||||
LogLevel debug
|
LogLevel debug
|
||||||
|
|
@ -39,13 +44,13 @@ in {
|
||||||
|
|
||||||
home-manager.users.steveej = homeEnv {
|
home-manager.users.steveej = homeEnv {
|
||||||
layout = "en";
|
layout = "en";
|
||||||
options = ["nodeadkey"];
|
options = [ "nodeadkey" ];
|
||||||
variant = "altgr-intl";
|
variant = "altgr-intl";
|
||||||
};
|
};
|
||||||
|
|
||||||
home-manager.users.elias = homeEnv {
|
home-manager.users.elias = homeEnv {
|
||||||
layout = "de";
|
layout = "de";
|
||||||
options = [];
|
options = [ ];
|
||||||
variant = "";
|
variant = "";
|
||||||
};
|
};
|
||||||
|
|
||||||
|
|
@ -53,16 +58,14 @@ in {
|
||||||
lib.attrsets.recursiveUpdate
|
lib.attrsets.recursiveUpdate
|
||||||
(homeEnv {
|
(homeEnv {
|
||||||
layout = "de";
|
layout = "de";
|
||||||
options = [];
|
options = [ ];
|
||||||
variant = "";
|
variant = "";
|
||||||
})
|
})
|
||||||
{
|
{
|
||||||
services.syncthing.enable = true;
|
services.syncthing.enable = true;
|
||||||
services.syncthing.tray = true;
|
services.syncthing.tray = true;
|
||||||
|
|
||||||
home.packages = with pkgs; [
|
home.packages = with pkgs; [ session-desktop ];
|
||||||
session-desktop
|
|
||||||
];
|
|
||||||
};
|
};
|
||||||
|
|
||||||
system.stateVersion = "21.11";
|
system.stateVersion = "21.11";
|
||||||
|
|
|
||||||
|
|
@ -3,9 +3,11 @@
|
||||||
lib,
|
lib,
|
||||||
config,
|
config,
|
||||||
...
|
...
|
||||||
}: let
|
}:
|
||||||
|
let
|
||||||
passwords = import ../../../variables/passwords.crypt.nix;
|
passwords = import ../../../variables/passwords.crypt.nix;
|
||||||
in {
|
in
|
||||||
|
{
|
||||||
networking.firewall.enable = true;
|
networking.firewall.enable = true;
|
||||||
networking.firewall.allowedTCPPorts = [
|
networking.firewall.allowedTCPPorts = [
|
||||||
# iperf3
|
# iperf3
|
||||||
|
|
@ -39,11 +41,13 @@ in {
|
||||||
# udev.packages = [ pkgs.gnome3.gnome-settings-daemon ];
|
# udev.packages = [ pkgs.gnome3.gnome-settings-daemon ];
|
||||||
};
|
};
|
||||||
|
|
||||||
security.pki.certificateFiles = ["${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt"];
|
security.pki.certificateFiles = [ "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt" ];
|
||||||
|
|
||||||
services.xserver.videoDrivers = ["modesetting"];
|
services.xserver.videoDrivers = [ "modesetting" ];
|
||||||
|
|
||||||
boot.kernelPackages = lib.mkForce pkgs.linuxPackages_latest;
|
boot.kernelPackages = lib.mkForce pkgs.linuxPackages_latest;
|
||||||
|
|
||||||
nix.gc = {automatic = true;};
|
nix.gc = {
|
||||||
|
automatic = true;
|
||||||
|
};
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -1,11 +1,9 @@
|
||||||
{
|
{ config, pkgs, ... }:
|
||||||
config,
|
let
|
||||||
pkgs,
|
|
||||||
...
|
|
||||||
}: let
|
|
||||||
keys = import ../../../variables/keys.nix;
|
keys = import ../../../variables/keys.nix;
|
||||||
inherit (pkgs.callPackage ../../lib/default.nix {}) mkUser;
|
inherit (pkgs.callPackage ../../lib/default.nix { }) mkUser;
|
||||||
in {
|
in
|
||||||
|
{
|
||||||
sops.secrets.sharedUsers-elias = {
|
sops.secrets.sharedUsers-elias = {
|
||||||
sopsFile = ../../../../secrets/shared-users.yaml;
|
sopsFile = ../../../../secrets/shared-users.yaml;
|
||||||
neededForUsers = true;
|
neededForUsers = true;
|
||||||
|
|
|
||||||
|
|
@ -9,33 +9,33 @@
|
||||||
localDomainName,
|
localDomainName,
|
||||||
system,
|
system,
|
||||||
...
|
...
|
||||||
}: let
|
}:
|
||||||
inherit
|
let
|
||||||
(nodeFlake.inputs)
|
inherit (nodeFlake.inputs) nixos-nftables-firewall nixos-sbc;
|
||||||
nixos-nftables-firewall
|
|
||||||
nixos-sbc
|
|
||||||
;
|
|
||||||
|
|
||||||
vlanRangeStart = builtins.head vlanRange;
|
vlanRangeStart = builtins.head vlanRange;
|
||||||
vlanRangeEnd = builtins.elemAt vlanRange ((builtins.length vlanRange) - 1);
|
vlanRangeEnd = builtins.elemAt vlanRange ((builtins.length vlanRange) - 1);
|
||||||
vlanRange = builtins.map (vlanid: (lib.strings.toInt vlanid)) (builtins.attrNames vlans);
|
vlanRange = builtins.map (vlanid: (lib.strings.toInt vlanid)) (builtins.attrNames vlans);
|
||||||
vlanRangeWith0 = [0] ++ vlanRange;
|
vlanRangeWith0 = [ 0 ] ++ vlanRange;
|
||||||
|
|
||||||
mkVlanIpv4HostAddr = {
|
mkVlanIpv4HostAddr =
|
||||||
|
{
|
||||||
vlanid,
|
vlanid,
|
||||||
host,
|
host,
|
||||||
thirdIpv4SegmentMin ? 20,
|
thirdIpv4SegmentMin ? 20,
|
||||||
cidr ? true,
|
cidr ? true,
|
||||||
}: let
|
}:
|
||||||
|
let
|
||||||
# reserve the first subnet for vlanid == 0
|
# reserve the first subnet for vlanid == 0
|
||||||
# number the other subnets continously from there
|
# number the other subnets continously from there
|
||||||
offset =
|
offset = if vlanid == 0 then thirdIpv4SegmentMin else thirdIpv4SegmentMin + 1 - vlanRangeStart;
|
||||||
if vlanid == 0
|
|
||||||
then thirdIpv4SegmentMin
|
|
||||||
else thirdIpv4SegmentMin + 1 - vlanRangeStart;
|
|
||||||
in
|
in
|
||||||
builtins.concatStringsSep "."
|
builtins.concatStringsSep "." [
|
||||||
["192" "168" (toString (vlanid + offset)) "${toString host}${lib.strings.optionalString cidr "/24"}"];
|
"192"
|
||||||
|
"168"
|
||||||
|
(toString (vlanid + offset))
|
||||||
|
"${toString host}${lib.strings.optionalString cidr "/24"}"
|
||||||
|
];
|
||||||
|
|
||||||
defaultVlan = {
|
defaultVlan = {
|
||||||
name = "${localDomainName}";
|
name = "${localDomainName}";
|
||||||
|
|
@ -62,30 +62,25 @@
|
||||||
"15".packet_priority = -10;
|
"15".packet_priority = -10;
|
||||||
};
|
};
|
||||||
|
|
||||||
vlansByName =
|
vlansByName = lib.attrsets.mapAttrs' (
|
||||||
lib.attrsets.mapAttrs'
|
|
||||||
(
|
|
||||||
vlanid': attrs:
|
vlanid': attrs:
|
||||||
lib.attrsets.nameValuePair
|
lib.attrsets.nameValuePair attrs.name (
|
||||||
attrs.name
|
attrs
|
||||||
(attrs
|
|
||||||
// {
|
// {
|
||||||
id = lib.strings.toInt vlanid';
|
id = lib.strings.toInt vlanid';
|
||||||
id' = vlanid';
|
id' = vlanid';
|
||||||
})
|
}
|
||||||
)
|
)
|
||||||
vlans;
|
) vlans;
|
||||||
|
|
||||||
getVlanDomain = {vlanid}:
|
getVlanDomain =
|
||||||
if vlanid == 0
|
{ vlanid }:
|
||||||
then defaultVlan.name
|
if vlanid == 0 then defaultVlan.name else vlans."${toString vlanid}".name + "." + defaultVlan.name;
|
||||||
else vlans."${toString vlanid}".name + "." + defaultVlan.name;
|
|
||||||
|
|
||||||
bridgeInterfaceName = "br-lan";
|
bridgeInterfaceName = "br-lan";
|
||||||
mkInterfaceName = {vlanid}:
|
mkInterfaceName =
|
||||||
if vlanid == 0
|
{ vlanid }:
|
||||||
then bridgeInterfaceName
|
if vlanid == 0 then bridgeInterfaceName else "${bridgeInterfaceName}.${toString vlanid}";
|
||||||
else "${bridgeInterfaceName}.${toString vlanid}";
|
|
||||||
|
|
||||||
dmzExposedHost = "sj-srv1";
|
dmzExposedHost = "sj-srv1";
|
||||||
dmzExposedHostDomain = "dmz.internal";
|
dmzExposedHostDomain = "dmz.internal";
|
||||||
|
|
@ -96,8 +91,10 @@
|
||||||
cidr = false;
|
cidr = false;
|
||||||
};
|
};
|
||||||
|
|
||||||
dmzExposedHostMACaddr = repoFlake.nixosConfigurations.${dmzExposedHost}.config.systemd.network.netdevs."10-dmz0".netdevConfig.MACAddress;
|
dmzExposedHostMACaddr =
|
||||||
in {
|
repoFlake.nixosConfigurations.${dmzExposedHost}.config.systemd.network.netdevs."10-dmz0".netdevConfig.MACAddress;
|
||||||
|
in
|
||||||
|
{
|
||||||
imports = [
|
imports = [
|
||||||
nixos-sbc.nixosModules.default
|
nixos-sbc.nixosModules.default
|
||||||
nixos-sbc.nixosModules.boards.bananapi.bpir3
|
nixos-sbc.nixosModules.boards.bananapi.bpir3
|
||||||
|
|
@ -130,7 +127,7 @@ in {
|
||||||
sops.secrets.passwords-root.neededForUsers = true;
|
sops.secrets.passwords-root.neededForUsers = true;
|
||||||
|
|
||||||
# sops.secrets.wlan0_saePasswordsFile = {};
|
# sops.secrets.wlan0_saePasswordsFile = {};
|
||||||
sops.secrets.wlan0_wpaPskFile = {};
|
sops.secrets.wlan0_wpaPskFile = { };
|
||||||
}
|
}
|
||||||
];
|
];
|
||||||
|
|
||||||
|
|
@ -193,10 +190,12 @@ in {
|
||||||
chains = {
|
chains = {
|
||||||
prerouting = {
|
prerouting = {
|
||||||
"exposeHost" = {
|
"exposeHost" = {
|
||||||
after = ["hook"];
|
after = [ "hook" ];
|
||||||
rules = let
|
rules =
|
||||||
|
let
|
||||||
wanInterfaces = builtins.concatStringsSep ", " config.networking.nftables.firewall.zones.wan.interfaces;
|
wanInterfaces = builtins.concatStringsSep ", " config.networking.nftables.firewall.zones.wan.interfaces;
|
||||||
in [
|
in
|
||||||
|
[
|
||||||
"iifname { ${wanInterfaces} } tcp dport 220 redirect to 22"
|
"iifname { ${wanInterfaces} } tcp dport 220 redirect to 22"
|
||||||
"iifname { ${wanInterfaces} } dnat ip to ${dmzExposedHostIpv4}"
|
"iifname { ${wanInterfaces} } dnat ip to ${dmzExposedHostIpv4}"
|
||||||
];
|
];
|
||||||
|
|
@ -211,20 +210,26 @@ in {
|
||||||
# snippets.nnf-conntrack.enable = true;
|
# snippets.nnf-conntrack.enable = true;
|
||||||
zones =
|
zones =
|
||||||
{
|
{
|
||||||
lan.interfaces = [(mkInterfaceName {vlanid = 0;})];
|
lan.interfaces = [ (mkInterfaceName { vlanid = 0; }) ];
|
||||||
vlan.interfaces = builtins.map (vlanid: (mkInterfaceName {inherit vlanid;})) vlanRange;
|
vlan.interfaces = builtins.map (vlanid: (mkInterfaceName { inherit vlanid; })) vlanRange;
|
||||||
# lan.ipv4Addresses = ["192.168.0.0/16"];
|
# lan.ipv4Addresses = ["192.168.0.0/16"];
|
||||||
wan.interfaces = ["wan" "lan0"];
|
wan.interfaces = [
|
||||||
vpn.interfaces = ["wg0" "wg1" "wg2"];
|
"wan"
|
||||||
|
"lan0"
|
||||||
|
];
|
||||||
|
vpn.interfaces = [
|
||||||
|
"wg0"
|
||||||
|
"wg1"
|
||||||
|
"wg2"
|
||||||
|
];
|
||||||
}
|
}
|
||||||
//
|
//
|
||||||
# generate a zone for each vlan
|
# generate a zone for each vlan
|
||||||
lib.attrsets.mapAttrs
|
lib.attrsets.mapAttrs (key: value: {
|
||||||
(key: value: {
|
interfaces = [ (mkInterfaceName { vlanid = value.id; }) ];
|
||||||
interfaces = [(mkInterfaceName {vlanid = value.id;})];
|
}) vlansByName;
|
||||||
})
|
rules =
|
||||||
vlansByName;
|
let
|
||||||
rules = let
|
|
||||||
ipv6IcmpTypes = [
|
ipv6IcmpTypes = [
|
||||||
"destination-unreachable"
|
"destination-unreachable"
|
||||||
"echo-reply"
|
"echo-reply"
|
||||||
|
|
@ -250,33 +255,37 @@ in {
|
||||||
"ip protocol icmp icmp type { ${builtins.concatStringsSep ", " ipv4IcmpTypes} } accept"
|
"ip protocol icmp icmp type { ${builtins.concatStringsSep ", " ipv4IcmpTypes} } accept"
|
||||||
"ip6 nexthdr icmpv6 icmpv6 type { ${builtins.concatStringsSep ", " ipv6IcmpTypes} } accept"
|
"ip6 nexthdr icmpv6 icmpv6 type { ${builtins.concatStringsSep ", " ipv6IcmpTypes} } accept"
|
||||||
];
|
];
|
||||||
in {
|
in
|
||||||
|
{
|
||||||
fw = {
|
fw = {
|
||||||
from = ["fw"];
|
from = [ "fw" ];
|
||||||
verdict = "accept";
|
verdict = "accept";
|
||||||
};
|
};
|
||||||
|
|
||||||
office-to-dmz = {
|
office-to-dmz = {
|
||||||
from = ["office"];
|
from = [ "office" ];
|
||||||
to = ["dmz"];
|
to = [ "dmz" ];
|
||||||
verdict = "accept";
|
verdict = "accept";
|
||||||
};
|
};
|
||||||
|
|
||||||
lan-to-fw = {
|
lan-to-fw = {
|
||||||
from = ["lan"];
|
from = [ "lan" ];
|
||||||
to = ["fw" "lan"];
|
to = [
|
||||||
|
"fw"
|
||||||
|
"lan"
|
||||||
|
];
|
||||||
verdict = "accept";
|
verdict = "accept";
|
||||||
};
|
};
|
||||||
|
|
||||||
lan-to-wan = {
|
lan-to-wan = {
|
||||||
from = ["lan"];
|
from = [ "lan" ];
|
||||||
to = ["wan"];
|
to = [ "wan" ];
|
||||||
verdict = "accept";
|
verdict = "accept";
|
||||||
};
|
};
|
||||||
|
|
||||||
vlan-to-wan = {
|
vlan-to-wan = {
|
||||||
from = ["vlan"];
|
from = [ "vlan" ];
|
||||||
to = ["wan"];
|
to = [ "wan" ];
|
||||||
verdict = "accept";
|
verdict = "accept";
|
||||||
};
|
};
|
||||||
|
|
||||||
|
|
@ -309,47 +318,45 @@ in {
|
||||||
to = 5201;
|
to = 5201;
|
||||||
}
|
}
|
||||||
];
|
];
|
||||||
from = ["vlan"];
|
from = [ "vlan" ];
|
||||||
to = ["fw"];
|
to = [ "fw" ];
|
||||||
extraLines =
|
extraLines = allowIcmpLines ++ [ "drop" ];
|
||||||
allowIcmpLines
|
|
||||||
++ [
|
|
||||||
"drop"
|
|
||||||
];
|
|
||||||
};
|
};
|
||||||
|
|
||||||
to-wan-nat = {
|
to-wan-nat = {
|
||||||
from = ["lan" "vlan"];
|
from = [
|
||||||
to = ["wan"];
|
"lan"
|
||||||
|
"vlan"
|
||||||
|
];
|
||||||
|
to = [ "wan" ];
|
||||||
masquerade = true;
|
masquerade = true;
|
||||||
verdict = "accept";
|
verdict = "accept";
|
||||||
};
|
};
|
||||||
|
|
||||||
wan-to-dmz = {
|
wan-to-dmz = {
|
||||||
from = ["wan"];
|
from = [ "wan" ];
|
||||||
to = ["dmz"];
|
to = [ "dmz" ];
|
||||||
verdict = "accept";
|
verdict = "accept";
|
||||||
};
|
};
|
||||||
|
|
||||||
wan-to-fw = {
|
wan-to-fw = {
|
||||||
from = ["wan"];
|
from = [ "wan" ];
|
||||||
to = ["fw"];
|
to = [ "fw" ];
|
||||||
allowedTCPPortRanges = [
|
allowedTCPPortRanges = [
|
||||||
{
|
{
|
||||||
from = 22;
|
from = 22;
|
||||||
to = 22;
|
to = 22;
|
||||||
}
|
}
|
||||||
];
|
];
|
||||||
extraLines =
|
extraLines = allowIcmpLines ++ [ "drop" ];
|
||||||
allowIcmpLines
|
|
||||||
++ [
|
|
||||||
"drop"
|
|
||||||
];
|
|
||||||
};
|
};
|
||||||
|
|
||||||
to-vpn-nat = {
|
to-vpn-nat = {
|
||||||
from = ["lan" "vlan"];
|
from = [
|
||||||
to = ["vpn"];
|
"lan"
|
||||||
|
"vlan"
|
||||||
|
];
|
||||||
|
to = [ "vpn" ];
|
||||||
masquerade = false;
|
masquerade = false;
|
||||||
verdict = "accept";
|
verdict = "accept";
|
||||||
};
|
};
|
||||||
|
|
@ -377,48 +384,13 @@ in {
|
||||||
|
|
||||||
systemd.network = {
|
systemd.network = {
|
||||||
wait-online.anyInterface = true;
|
wait-online.anyInterface = true;
|
||||||
netdevs = let
|
netdevs =
|
||||||
router0-ifog_wg0Endpoint = "${repoFlake.colmena.router0-ifog.deployment.targetHost}:${
|
let
|
||||||
builtins.toString
|
router0-ifog_wg0Endpoint = "${repoFlake.colmena.router0-ifog.deployment.targetHost}:${builtins.toString repoFlake.nixosConfigurations.router0-ifog.config.systemd.network.netdevs.wg0.wireguardConfig.ListenPort}";
|
||||||
repoFlake
|
|
||||||
.nixosConfigurations
|
|
||||||
.router0-ifog
|
|
||||||
.config
|
|
||||||
.systemd
|
|
||||||
.network
|
|
||||||
.netdevs
|
|
||||||
.wg0
|
|
||||||
.wireguardConfig
|
|
||||||
.ListenPort
|
|
||||||
}";
|
|
||||||
|
|
||||||
router0-ifog_wg1Endpoint = "${repoFlake.colmena.router0-ifog.deployment.targetHost}:${
|
router0-ifog_wg1Endpoint = "${repoFlake.colmena.router0-ifog.deployment.targetHost}:${builtins.toString repoFlake.nixosConfigurations.router0-ifog.config.systemd.network.netdevs.wg1.wireguardConfig.ListenPort}";
|
||||||
builtins.toString
|
|
||||||
repoFlake
|
|
||||||
.nixosConfigurations
|
|
||||||
.router0-ifog
|
|
||||||
.config
|
|
||||||
.systemd
|
|
||||||
.network
|
|
||||||
.netdevs
|
|
||||||
.wg1
|
|
||||||
.wireguardConfig
|
|
||||||
.ListenPort
|
|
||||||
}";
|
|
||||||
|
|
||||||
router0-hosthatch_wg0Endpoint = "${repoFlake.colmena.router0-hosthatch.deployment.targetHost}:${
|
router0-hosthatch_wg0Endpoint = "${repoFlake.colmena.router0-hosthatch.deployment.targetHost}:${builtins.toString repoFlake.nixosConfigurations.router0-hosthatch.config.systemd.network.netdevs.wg0.wireguardConfig.ListenPort}";
|
||||||
builtins.toString
|
|
||||||
repoFlake
|
|
||||||
.nixosConfigurations
|
|
||||||
.router0-hosthatch
|
|
||||||
.config
|
|
||||||
.systemd
|
|
||||||
.network
|
|
||||||
.netdevs
|
|
||||||
.wg0
|
|
||||||
.wireguardConfig
|
|
||||||
.ListenPort
|
|
||||||
}";
|
|
||||||
in
|
in
|
||||||
{
|
{
|
||||||
# Create the bridge interface
|
# Create the bridge interface
|
||||||
|
|
@ -536,33 +508,29 @@ in {
|
||||||
};
|
};
|
||||||
}
|
}
|
||||||
# generate the vlan devices. these will be tagged on the main bridge
|
# generate the vlan devices. these will be tagged on the main bridge
|
||||||
// builtins.foldl'
|
// builtins.foldl' (acc: cur: acc // cur) { } (
|
||||||
(acc: cur: acc // cur)
|
|
||||||
{}
|
|
||||||
(
|
|
||||||
builtins.map
|
builtins.map
|
||||||
({
|
(
|
||||||
vlanid,
|
{ vlanid, vlanid' }:
|
||||||
vlanid',
|
{
|
||||||
}: {
|
"20-${mkInterfaceName { inherit vlanid; }}" = {
|
||||||
"20-${mkInterfaceName {inherit vlanid;}}" = {
|
|
||||||
netdevConfig = {
|
netdevConfig = {
|
||||||
Kind = "vlan";
|
Kind = "vlan";
|
||||||
Name = "${mkInterfaceName {inherit vlanid;}}";
|
Name = "${mkInterfaceName { inherit vlanid; }}";
|
||||||
};
|
};
|
||||||
vlanConfig.Id = vlanid;
|
vlanConfig.Id = vlanid;
|
||||||
};
|
};
|
||||||
})
|
}
|
||||||
|
)
|
||||||
(
|
(
|
||||||
builtins.map
|
builtins.map (vlanid: {
|
||||||
(vlanid: {
|
|
||||||
inherit vlanid;
|
inherit vlanid;
|
||||||
vlanid' = builtins.toString vlanid;
|
vlanid' = builtins.toString vlanid;
|
||||||
})
|
}) vlanRange
|
||||||
vlanRange
|
|
||||||
)
|
)
|
||||||
);
|
);
|
||||||
networks = let
|
networks =
|
||||||
|
let
|
||||||
commonWanOptions = {
|
commonWanOptions = {
|
||||||
networkConfig = {
|
networkConfig = {
|
||||||
# start a DHCP Client for IPv4/6 Addressing/Routing
|
# start a DHCP Client for IPv4/6 Addressing/Routing
|
||||||
|
|
@ -771,7 +739,7 @@ in {
|
||||||
# Configure the bridge for its desired function
|
# Configure the bridge for its desired function
|
||||||
"40-${bridgeInterfaceName}" = {
|
"40-${bridgeInterfaceName}" = {
|
||||||
matchConfig.Name = bridgeInterfaceName;
|
matchConfig.Name = bridgeInterfaceName;
|
||||||
bridgeConfig = {};
|
bridgeConfig = { };
|
||||||
address = [
|
address = [
|
||||||
(mkVlanIpv4HostAddr {
|
(mkVlanIpv4HostAddr {
|
||||||
vlanid = 0;
|
vlanid = 0;
|
||||||
|
|
@ -793,19 +761,13 @@ in {
|
||||||
}
|
}
|
||||||
];
|
];
|
||||||
|
|
||||||
vlan = (
|
vlan = (builtins.map (vlanid: (mkInterfaceName { inherit vlanid; })) vlanRange);
|
||||||
builtins.map
|
|
||||||
(vlanid: (mkInterfaceName {inherit vlanid;}))
|
|
||||||
vlanRange
|
|
||||||
);
|
|
||||||
};
|
};
|
||||||
|
|
||||||
"50-wg0" = {
|
"50-wg0" = {
|
||||||
enable = true;
|
enable = true;
|
||||||
matchConfig.Name = "wg0";
|
matchConfig.Name = "wg0";
|
||||||
address = [
|
address = [ "10.0.0.1/31" ];
|
||||||
"10.0.0.1/31"
|
|
||||||
];
|
|
||||||
|
|
||||||
routes = [
|
routes = [
|
||||||
# {
|
# {
|
||||||
|
|
@ -820,9 +782,7 @@ in {
|
||||||
"50-wg1" = {
|
"50-wg1" = {
|
||||||
enable = true;
|
enable = true;
|
||||||
matchConfig.Name = "wg1";
|
matchConfig.Name = "wg1";
|
||||||
address = [
|
address = [ "10.0.0.3/31" ];
|
||||||
"10.0.0.3/31"
|
|
||||||
];
|
|
||||||
routes = [
|
routes = [
|
||||||
# {
|
# {
|
||||||
# routeConfig = {
|
# routeConfig = {
|
||||||
|
|
@ -836,9 +796,7 @@ in {
|
||||||
"50-wg2" = {
|
"50-wg2" = {
|
||||||
enable = true;
|
enable = true;
|
||||||
matchConfig.Name = "wg2";
|
matchConfig.Name = "wg2";
|
||||||
address = [
|
address = [ "10.0.1.1/31" ];
|
||||||
"10.0.1.1/31"
|
|
||||||
];
|
|
||||||
|
|
||||||
routes = [
|
routes = [
|
||||||
# TODO: add a testing route here
|
# TODO: add a testing route here
|
||||||
|
|
@ -849,19 +807,16 @@ in {
|
||||||
# * netdev type vlan
|
# * netdev type vlan
|
||||||
# * host address for vlan
|
# * host address for vlan
|
||||||
# * vlan config for wlan interface
|
# * vlan config for wlan interface
|
||||||
// builtins.foldl'
|
// builtins.foldl' (acc: cur: acc // cur) { } (
|
||||||
(acc: cur: acc // cur)
|
builtins.map
|
||||||
{}
|
(
|
||||||
(builtins.map
|
{ vlanid, vlanid' }:
|
||||||
({
|
{
|
||||||
vlanid,
|
|
||||||
vlanid',
|
|
||||||
}: {
|
|
||||||
# configure the tagged vlan device with an address and vlan filtering.
|
# configure the tagged vlan device with an address and vlan filtering.
|
||||||
# dnsmasq is configured to serve the respective /24 range on each tagged device.
|
# dnsmasq is configured to serve the respective /24 range on each tagged device.
|
||||||
# this device only receives traffic for the given vlanid and sends tagged traffic to the bridge.
|
# this device only receives traffic for the given vlanid and sends tagged traffic to the bridge.
|
||||||
"41-${mkInterfaceName {inherit vlanid;}}" = {
|
"41-${mkInterfaceName { inherit vlanid; }}" = {
|
||||||
matchConfig.Name = "${mkInterfaceName {inherit vlanid;}}";
|
matchConfig.Name = "${mkInterfaceName { inherit vlanid; }}";
|
||||||
address = [
|
address = [
|
||||||
(mkVlanIpv4HostAddr {
|
(mkVlanIpv4HostAddr {
|
||||||
inherit vlanid;
|
inherit vlanid;
|
||||||
|
|
@ -934,25 +889,27 @@ in {
|
||||||
# };
|
# };
|
||||||
# linkConfig.RequiredForOnline = "no";
|
# linkConfig.RequiredForOnline = "no";
|
||||||
# };
|
# };
|
||||||
})
|
}
|
||||||
|
)
|
||||||
(
|
(
|
||||||
builtins.map
|
builtins.map (vlanid: {
|
||||||
(vlanid: {
|
|
||||||
inherit vlanid;
|
inherit vlanid;
|
||||||
vlanid' = builtins.toString vlanid;
|
vlanid' = builtins.toString vlanid;
|
||||||
})
|
}) vlanRange
|
||||||
vlanRange
|
)
|
||||||
));
|
);
|
||||||
};
|
};
|
||||||
|
|
||||||
# wireless access point
|
# wireless access point
|
||||||
services.hostapd = {
|
services.hostapd = {
|
||||||
enable = true;
|
enable = true;
|
||||||
# package = nodeFlake.packages.${system}.hostapd_patched;
|
# package = nodeFlake.packages.${system}.hostapd_patched;
|
||||||
radios = let
|
radios =
|
||||||
|
let
|
||||||
# generated with https://miniwebtool.com/mac-address-generator/
|
# generated with https://miniwebtool.com/mac-address-generator/
|
||||||
mkBssid = i: "34:56:ce:0f:ed:4${toString i}";
|
mkBssid = i: "34:56:ce:0f:ed:4${toString i}";
|
||||||
in {
|
in
|
||||||
|
{
|
||||||
wlan0 = {
|
wlan0 = {
|
||||||
band = "2g";
|
band = "2g";
|
||||||
# FIXME: apparently setting this could cause bugs, testing disabling it for a while.
|
# FIXME: apparently setting this could cause bugs, testing disabling it for a while.
|
||||||
|
|
@ -1002,17 +959,18 @@ in {
|
||||||
};
|
};
|
||||||
|
|
||||||
networks = {
|
networks = {
|
||||||
wlan0 = let
|
wlan0 =
|
||||||
|
let
|
||||||
iface = "wlan0";
|
iface = "wlan0";
|
||||||
in {
|
in
|
||||||
|
{
|
||||||
ssid = "mlsia";
|
ssid = "mlsia";
|
||||||
bssid = mkBssid 0;
|
bssid = mkBssid 0;
|
||||||
|
|
||||||
# enables debug logging
|
# enables debug logging
|
||||||
logLevel = 0;
|
logLevel = 0;
|
||||||
|
|
||||||
authentication.mode =
|
authentication.mode = "wpa2-sha256"
|
||||||
"wpa2-sha256"
|
|
||||||
# "wpa3-sae-transition"
|
# "wpa3-sae-transition"
|
||||||
# "wpa3-sae"
|
# "wpa3-sae"
|
||||||
;
|
;
|
||||||
|
|
@ -1048,13 +1006,11 @@ in {
|
||||||
vlan_bridge = "br-${iface}.";
|
vlan_bridge = "br-${iface}.";
|
||||||
*/
|
*/
|
||||||
|
|
||||||
vlan_file = let
|
vlan_file =
|
||||||
generated =
|
let
|
||||||
builtins.map
|
generated = builtins.map (
|
||||||
(
|
|
||||||
vlanid: "${builtins.toString vlanid} ${iface}.${builtins.toString vlanid}"
|
vlanid: "${builtins.toString vlanid} ${iface}.${builtins.toString vlanid}"
|
||||||
)
|
) vlanRange;
|
||||||
vlanRange;
|
|
||||||
|
|
||||||
wildcard = [
|
wildcard = [
|
||||||
# Optional wildcard entry matching all VLAN IDs. The first # in the interface
|
# Optional wildcard entry matching all VLAN IDs. The first # in the interface
|
||||||
|
|
@ -1064,14 +1020,13 @@ in {
|
||||||
"* ${iface}.#"
|
"* ${iface}.#"
|
||||||
];
|
];
|
||||||
|
|
||||||
file =
|
file = pkgs.writeText "hostapd.vlan" (builtins.concatStringsSep "\n" (generated ++ wildcard));
|
||||||
pkgs.writeText "hostapd.vlan"
|
|
||||||
(builtins.concatStringsSep "\n" (generated ++ wildcard));
|
|
||||||
filePath = toString file;
|
filePath = toString file;
|
||||||
in
|
in
|
||||||
filePath;
|
filePath;
|
||||||
|
|
||||||
wpa_key_mgmt = lib.mkForce (builtins.concatStringsSep " " [
|
wpa_key_mgmt = lib.mkForce (
|
||||||
|
builtins.concatStringsSep " " [
|
||||||
"WPA-PSK"
|
"WPA-PSK"
|
||||||
|
|
||||||
# TODO: the printer can't connect when this is on
|
# TODO: the printer can't connect when this is on
|
||||||
|
|
@ -1079,7 +1034,8 @@ in {
|
||||||
|
|
||||||
# unfortunately SAE doesn't support VLAN passwords in the way i'd like to use them
|
# unfortunately SAE doesn't support VLAN passwords in the way i'd like to use them
|
||||||
# "SAE"
|
# "SAE"
|
||||||
]);
|
]
|
||||||
|
);
|
||||||
|
|
||||||
# wpa_psk_radius = 0;
|
# wpa_psk_radius = 0;
|
||||||
wpa_pairwise = "CCMP";
|
wpa_pairwise = "CCMP";
|
||||||
|
|
@ -1150,11 +1106,10 @@ in {
|
||||||
# v6 config
|
# v6 config
|
||||||
enable-ra = true;
|
enable-ra = true;
|
||||||
|
|
||||||
dhcp-range = let
|
dhcp-range =
|
||||||
mkDhcpRange = {
|
let
|
||||||
tag,
|
mkDhcpRange =
|
||||||
vlanid,
|
{ tag, vlanid }:
|
||||||
}:
|
|
||||||
builtins.concatStringsSep "," [
|
builtins.concatStringsSep "," [
|
||||||
tag
|
tag
|
||||||
(mkVlanIpv4HostAddr {
|
(mkVlanIpv4HostAddr {
|
||||||
|
|
@ -1173,15 +1128,13 @@ in {
|
||||||
# "ra-names"
|
# "ra-names"
|
||||||
];
|
];
|
||||||
in
|
in
|
||||||
builtins.map
|
builtins.map (
|
||||||
(
|
|
||||||
vlanid:
|
vlanid:
|
||||||
mkDhcpRange {
|
mkDhcpRange {
|
||||||
tag = mkInterfaceName {inherit vlanid;};
|
tag = mkInterfaceName { inherit vlanid; };
|
||||||
inherit vlanid;
|
inherit vlanid;
|
||||||
}
|
}
|
||||||
)
|
) vlanRangeWith0;
|
||||||
vlanRangeWith0;
|
|
||||||
|
|
||||||
dhcp-host = builtins.concatStringsSep "," [
|
dhcp-host = builtins.concatStringsSep "," [
|
||||||
dmzExposedHostMACaddr
|
dmzExposedHostMACaddr
|
||||||
|
|
@ -1211,39 +1164,35 @@ in {
|
||||||
];
|
];
|
||||||
|
|
||||||
domain =
|
domain =
|
||||||
[
|
[ "/${getVlanDomain { vlanid = 0; }}/,local" ]
|
||||||
"/${getVlanDomain {vlanid = 0;}}/,local"
|
++ builtins.map (
|
||||||
]
|
vlanid:
|
||||||
++ builtins.map
|
"${getVlanDomain { inherit vlanid; }},${
|
||||||
(
|
mkVlanIpv4HostAddr {
|
||||||
vlanid: "${getVlanDomain {inherit vlanid;}},${mkVlanIpv4HostAddr {
|
|
||||||
inherit vlanid;
|
inherit vlanid;
|
||||||
host = 0;
|
host = 0;
|
||||||
cidr = true;
|
cidr = true;
|
||||||
}},local"
|
}
|
||||||
)
|
},local"
|
||||||
vlanRangeWith0;
|
) vlanRangeWith0;
|
||||||
|
|
||||||
# TODO: compare this to using `interface-name`
|
# TODO: compare this to using `interface-name`
|
||||||
dynamic-host =
|
dynamic-host =
|
||||||
[
|
[ ]
|
||||||
]
|
++ builtins.map (
|
||||||
++ builtins.map
|
|
||||||
(
|
|
||||||
vlanid:
|
vlanid:
|
||||||
builtins.concatStringsSep "," [
|
builtins.concatStringsSep "," [
|
||||||
# "${getVlanDomain{inherit vlanid;}}" "0.0.0.1" (mkInterfaceName {inherit vlanid;})
|
# "${getVlanDomain{inherit vlanid;}}" "0.0.0.1" (mkInterfaceName {inherit vlanid;})
|
||||||
"${nodeName}.${getVlanDomain {inherit vlanid;}}"
|
"${nodeName}.${getVlanDomain { inherit vlanid; }}"
|
||||||
"0.0.0.1"
|
"0.0.0.1"
|
||||||
(mkInterfaceName {inherit vlanid;})
|
(mkInterfaceName { inherit vlanid; })
|
||||||
]
|
]
|
||||||
)
|
) vlanRangeWith0;
|
||||||
vlanRangeWith0;
|
|
||||||
|
|
||||||
dhcp-option-force =
|
dhcp-option-force = builtins.map (
|
||||||
builtins.map
|
vlanid:
|
||||||
(vlanid: "${mkInterfaceName {inherit vlanid;}},option:domain-search,${getVlanDomain {inherit vlanid;}}")
|
"${mkInterfaceName { inherit vlanid; }},option:domain-search,${getVlanDomain { inherit vlanid; }}"
|
||||||
vlanRangeWith0;
|
) vlanRangeWith0;
|
||||||
|
|
||||||
# auth-server = [
|
# auth-server = [
|
||||||
# (builtins.concatStringsSep "," [
|
# (builtins.concatStringsSep "," [
|
||||||
|
|
|
||||||
|
|
@ -5,25 +5,24 @@
|
||||||
nodeFlake,
|
nodeFlake,
|
||||||
localDomainName ? "internal",
|
localDomainName ? "internal",
|
||||||
...
|
...
|
||||||
}: {
|
}:
|
||||||
|
{
|
||||||
meta.nodeSpecialArgs.${nodeName} = {
|
meta.nodeSpecialArgs.${nodeName} = {
|
||||||
inherit repoFlake nodeName nodeFlake system;
|
inherit
|
||||||
|
repoFlake
|
||||||
|
nodeName
|
||||||
|
nodeFlake
|
||||||
|
system
|
||||||
|
;
|
||||||
packages' = repoFlake.packages.${system};
|
packages' = repoFlake.packages.${system};
|
||||||
nodePackages' = nodeFlake.packages.${system};
|
nodePackages' = nodeFlake.packages.${system};
|
||||||
|
|
||||||
inherit
|
inherit (nodeFlake.inputs.bpir3.packages.${system}) armTrustedFirmwareMT7986;
|
||||||
(nodeFlake.inputs.bpir3.packages.${system})
|
|
||||||
armTrustedFirmwareMT7986
|
|
||||||
;
|
|
||||||
|
|
||||||
inherit localDomainName;
|
inherit localDomainName;
|
||||||
};
|
};
|
||||||
|
|
||||||
meta.nodeNixpkgs.${nodeName} =
|
meta.nodeNixpkgs.${nodeName} = import nodeFlake.inputs.nixpkgs.outPath { inherit system; };
|
||||||
import nodeFlake.inputs.nixpkgs.outPath
|
|
||||||
{
|
|
||||||
inherit system;
|
|
||||||
};
|
|
||||||
|
|
||||||
${nodeName} = {
|
${nodeName} = {
|
||||||
deployment.targetHost = "${nodeName}.${localDomainName}";
|
deployment.targetHost = "${nodeName}.${localDomainName}";
|
||||||
|
|
|
||||||
|
|
@ -39,13 +39,15 @@
|
||||||
# };
|
# };
|
||||||
};
|
};
|
||||||
|
|
||||||
outputs = {
|
outputs =
|
||||||
|
{
|
||||||
self,
|
self,
|
||||||
get-flake,
|
get-flake,
|
||||||
nixpkgs,
|
nixpkgs,
|
||||||
nixos-sbc,
|
nixos-sbc,
|
||||||
...
|
...
|
||||||
}: let
|
}:
|
||||||
|
let
|
||||||
nativeSystem = "aarch64-linux";
|
nativeSystem = "aarch64-linux";
|
||||||
nodeName = "router0-dmz0";
|
nodeName = "router0-dmz0";
|
||||||
|
|
||||||
|
|
@ -57,11 +59,13 @@
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
mkNixosConfiguration = {extraModules ? [], ...} @ attrs:
|
mkNixosConfiguration =
|
||||||
nixpkgs.lib.nixosSystem (
|
|
||||||
nixpkgs.lib.attrsets.recursiveUpdate
|
|
||||||
attrs
|
|
||||||
{
|
{
|
||||||
|
extraModules ? [ ],
|
||||||
|
...
|
||||||
|
}@attrs:
|
||||||
|
nixpkgs.lib.nixosSystem (
|
||||||
|
nixpkgs.lib.attrsets.recursiveUpdate attrs {
|
||||||
specialArgs =
|
specialArgs =
|
||||||
(import ./default.nix {
|
(import ./default.nix {
|
||||||
system = nativeSystem;
|
system = nativeSystem;
|
||||||
|
|
@ -69,13 +73,9 @@
|
||||||
|
|
||||||
repoFlake = get-flake ../../../..;
|
repoFlake = get-flake ../../../..;
|
||||||
nodeFlake = self;
|
nodeFlake = self;
|
||||||
})
|
}).meta.nodeSpecialArgs.${nodeName};
|
||||||
.meta
|
|
||||||
.nodeSpecialArgs
|
|
||||||
.${nodeName};
|
|
||||||
|
|
||||||
modules =
|
modules = [
|
||||||
[
|
|
||||||
./configuration.nix
|
./configuration.nix
|
||||||
|
|
||||||
# flake registry
|
# flake registry
|
||||||
|
|
@ -83,15 +83,13 @@
|
||||||
nixpkgs.overlays = builtins.attrValues self.overlays;
|
nixpkgs.overlays = builtins.attrValues self.overlays;
|
||||||
nix.registry.nixpkgs.flake = nixpkgs;
|
nix.registry.nixpkgs.flake = nixpkgs;
|
||||||
}
|
}
|
||||||
]
|
] ++ extraModules;
|
||||||
++ extraModules;
|
|
||||||
}
|
}
|
||||||
);
|
);
|
||||||
in {
|
in
|
||||||
|
{
|
||||||
nixosConfigurations = {
|
nixosConfigurations = {
|
||||||
native = mkNixosConfiguration {
|
native = mkNixosConfiguration { system = nativeSystem; };
|
||||||
system = nativeSystem;
|
|
||||||
};
|
|
||||||
|
|
||||||
cross = mkNixosConfiguration {
|
cross = mkNixosConfiguration {
|
||||||
extraModules = [
|
extraModules = [
|
||||||
|
|
@ -105,9 +103,7 @@
|
||||||
|
|
||||||
overlays.default = final: previous: {
|
overlays.default = final: previous: {
|
||||||
hostapd = previous.hostapd.overrideDerivation (attrs: {
|
hostapd = previous.hostapd.overrideDerivation (attrs: {
|
||||||
patches =
|
patches = attrs.patches ++ [
|
||||||
attrs.patches
|
|
||||||
++ [
|
|
||||||
"${self.inputs.openwrt}/package/network/services/hostapd/patches/710-vlan_no_bridge.patch"
|
"${self.inputs.openwrt}/package/network/services/hostapd/patches/710-vlan_no_bridge.patch"
|
||||||
];
|
];
|
||||||
});
|
});
|
||||||
|
|
|
||||||
|
|
@ -9,7 +9,8 @@
|
||||||
system,
|
system,
|
||||||
variables,
|
variables,
|
||||||
...
|
...
|
||||||
}: {
|
}:
|
||||||
|
{
|
||||||
system.stateVersion = "24.05";
|
system.stateVersion = "24.05";
|
||||||
|
|
||||||
imports = [
|
imports = [
|
||||||
|
|
@ -48,7 +49,7 @@
|
||||||
boot.loader.grub.efiSupport = false;
|
boot.loader.grub.efiSupport = false;
|
||||||
|
|
||||||
# forcing seems required or else there's an error about duplicated devices
|
# forcing seems required or else there's an error about duplicated devices
|
||||||
boot.loader.grub.devices = lib.mkForce ["/dev/vda"];
|
boot.loader.grub.devices = lib.mkForce [ "/dev/vda" ];
|
||||||
|
|
||||||
disko.devices.disk.vda = {
|
disko.devices.disk.vda = {
|
||||||
device = "/dev/vda";
|
device = "/dev/vda";
|
||||||
|
|
@ -64,14 +65,14 @@
|
||||||
size = "100%";
|
size = "100%";
|
||||||
content = {
|
content = {
|
||||||
type = "btrfs";
|
type = "btrfs";
|
||||||
extraArgs = ["-f"]; # Override existing partition
|
extraArgs = [ "-f" ]; # Override existing partition
|
||||||
subvolumes = {
|
subvolumes = {
|
||||||
# Subvolume name is different from mountpoint
|
# Subvolume name is different from mountpoint
|
||||||
"/rootfs" = {
|
"/rootfs" = {
|
||||||
mountpoint = "/";
|
mountpoint = "/";
|
||||||
};
|
};
|
||||||
"/nix" = {
|
"/nix" = {
|
||||||
mountOptions = ["noatime"];
|
mountOptions = [ "noatime" ];
|
||||||
mountpoint = "/nix";
|
mountpoint = "/nix";
|
||||||
};
|
};
|
||||||
"/boot" = {
|
"/boot" = {
|
||||||
|
|
@ -156,9 +157,7 @@
|
||||||
interface = "eth0";
|
interface = "eth0";
|
||||||
address = variables.ipv4gateway;
|
address = variables.ipv4gateway;
|
||||||
};
|
};
|
||||||
nameservers = [
|
nameservers = [ variables.ipv4dns ];
|
||||||
variables.ipv4dns
|
|
||||||
];
|
|
||||||
|
|
||||||
# these will be configured via nftables
|
# these will be configured via nftables
|
||||||
nat.enable = lib.mkForce false;
|
nat.enable = lib.mkForce false;
|
||||||
|
|
@ -176,17 +175,20 @@
|
||||||
snippets.nnf-common.enable = true;
|
snippets.nnf-common.enable = true;
|
||||||
|
|
||||||
zones.wan = {
|
zones.wan = {
|
||||||
interfaces = ["eth0"];
|
interfaces = [ "eth0" ];
|
||||||
};
|
};
|
||||||
|
|
||||||
zones.vpn = {
|
zones.vpn = {
|
||||||
interfaces = ["wg0" "wg1"];
|
interfaces = [
|
||||||
|
"wg0"
|
||||||
|
"wg1"
|
||||||
|
];
|
||||||
};
|
};
|
||||||
|
|
||||||
rules = {
|
rules = {
|
||||||
to-fw = {
|
to-fw = {
|
||||||
from = "all";
|
from = "all";
|
||||||
to = ["fw"];
|
to = [ "fw" ];
|
||||||
verdict = "drop";
|
verdict = "drop";
|
||||||
|
|
||||||
allowedTCPPorts = [
|
allowedTCPPorts = [
|
||||||
|
|
@ -202,8 +204,8 @@
|
||||||
};
|
};
|
||||||
|
|
||||||
vpn-to-wan-nat = {
|
vpn-to-wan-nat = {
|
||||||
from = ["vpn"];
|
from = [ "vpn" ];
|
||||||
to = ["wan"];
|
to = [ "wan" ];
|
||||||
masquerade = true;
|
masquerade = true;
|
||||||
verdict = "accept";
|
verdict = "accept";
|
||||||
};
|
};
|
||||||
|
|
@ -283,9 +285,7 @@
|
||||||
systemd.network.networks.wg0 = {
|
systemd.network.networks.wg0 = {
|
||||||
enable = true;
|
enable = true;
|
||||||
matchConfig.Name = "wg0";
|
matchConfig.Name = "wg0";
|
||||||
address = [
|
address = [ "10.0.1.0/31" ];
|
||||||
"10.0.1.0/31"
|
|
||||||
];
|
|
||||||
|
|
||||||
routes = [
|
routes = [
|
||||||
{
|
{
|
||||||
|
|
@ -299,9 +299,7 @@
|
||||||
systemd.network.networks.wg1 = {
|
systemd.network.networks.wg1 = {
|
||||||
enable = true;
|
enable = true;
|
||||||
matchConfig.Name = "wg1";
|
matchConfig.Name = "wg1";
|
||||||
address = [
|
address = [ "10.0.1.2/31" ];
|
||||||
"10.0.1.2/31"
|
|
||||||
];
|
|
||||||
|
|
||||||
routes = [
|
routes = [
|
||||||
{
|
{
|
||||||
|
|
|
||||||
|
|
@ -4,20 +4,24 @@
|
||||||
repoFlake,
|
repoFlake,
|
||||||
nodeFlake,
|
nodeFlake,
|
||||||
...
|
...
|
||||||
}: let
|
}:
|
||||||
|
let
|
||||||
variables = import ./variables.crypt.nix;
|
variables = import ./variables.crypt.nix;
|
||||||
in {
|
in
|
||||||
|
{
|
||||||
meta.nodeSpecialArgs.${nodeName} = {
|
meta.nodeSpecialArgs.${nodeName} = {
|
||||||
inherit repoFlake nodeName nodeFlake system variables;
|
inherit
|
||||||
|
repoFlake
|
||||||
|
nodeName
|
||||||
|
nodeFlake
|
||||||
|
system
|
||||||
|
variables
|
||||||
|
;
|
||||||
packages' = repoFlake.packages.${system};
|
packages' = repoFlake.packages.${system};
|
||||||
nodePackages' = nodeFlake.packages.${system};
|
nodePackages' = nodeFlake.packages.${system};
|
||||||
};
|
};
|
||||||
|
|
||||||
meta.nodeNixpkgs.${nodeName} =
|
meta.nodeNixpkgs.${nodeName} = import nodeFlake.inputs.nixpkgs.outPath { inherit system; };
|
||||||
import nodeFlake.inputs.nixpkgs.outPath
|
|
||||||
{
|
|
||||||
inherit system;
|
|
||||||
};
|
|
||||||
|
|
||||||
${nodeName} = {
|
${nodeName} = {
|
||||||
deployment.targetHost = variables.ipv4;
|
deployment.targetHost = variables.ipv4;
|
||||||
|
|
|
||||||
|
|
@ -15,5 +15,5 @@
|
||||||
nixos-nftables-firewall.inputs.nixpkgs.follows = "nixpkgs";
|
nixos-nftables-firewall.inputs.nixpkgs.follows = "nixpkgs";
|
||||||
};
|
};
|
||||||
|
|
||||||
outputs = _: {};
|
outputs = _: { };
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -9,7 +9,8 @@
|
||||||
system,
|
system,
|
||||||
variables,
|
variables,
|
||||||
...
|
...
|
||||||
}: {
|
}:
|
||||||
|
{
|
||||||
system.stateVersion = "23.11";
|
system.stateVersion = "23.11";
|
||||||
|
|
||||||
imports = [
|
imports = [
|
||||||
|
|
@ -48,7 +49,7 @@
|
||||||
boot.loader.grub.efiSupport = false;
|
boot.loader.grub.efiSupport = false;
|
||||||
|
|
||||||
# forcing seems required or else there's an error about duplicated devices
|
# forcing seems required or else there's an error about duplicated devices
|
||||||
boot.loader.grub.devices = lib.mkForce ["/dev/vda"];
|
boot.loader.grub.devices = lib.mkForce [ "/dev/vda" ];
|
||||||
|
|
||||||
disko.devices.disk.vda = {
|
disko.devices.disk.vda = {
|
||||||
device = "/dev/vda";
|
device = "/dev/vda";
|
||||||
|
|
@ -64,14 +65,14 @@
|
||||||
size = "100%";
|
size = "100%";
|
||||||
content = {
|
content = {
|
||||||
type = "btrfs";
|
type = "btrfs";
|
||||||
extraArgs = ["-f"]; # Override existing partition
|
extraArgs = [ "-f" ]; # Override existing partition
|
||||||
subvolumes = {
|
subvolumes = {
|
||||||
# Subvolume name is different from mountpoint
|
# Subvolume name is different from mountpoint
|
||||||
"/rootfs" = {
|
"/rootfs" = {
|
||||||
mountpoint = "/";
|
mountpoint = "/";
|
||||||
};
|
};
|
||||||
"/nix" = {
|
"/nix" = {
|
||||||
mountOptions = ["noatime"];
|
mountOptions = [ "noatime" ];
|
||||||
mountpoint = "/nix";
|
mountpoint = "/nix";
|
||||||
};
|
};
|
||||||
"/boot" = {
|
"/boot" = {
|
||||||
|
|
@ -156,9 +157,7 @@
|
||||||
interface = "eth0";
|
interface = "eth0";
|
||||||
address = variables.ipv4gateway;
|
address = variables.ipv4gateway;
|
||||||
};
|
};
|
||||||
nameservers = [
|
nameservers = [ variables.ipv4dns ];
|
||||||
variables.ipv4dns
|
|
||||||
];
|
|
||||||
|
|
||||||
# these will be configured via nftables
|
# these will be configured via nftables
|
||||||
nat.enable = lib.mkForce false;
|
nat.enable = lib.mkForce false;
|
||||||
|
|
@ -176,17 +175,20 @@
|
||||||
snippets.nnf-common.enable = true;
|
snippets.nnf-common.enable = true;
|
||||||
|
|
||||||
zones.wan = {
|
zones.wan = {
|
||||||
interfaces = ["eth0"];
|
interfaces = [ "eth0" ];
|
||||||
};
|
};
|
||||||
|
|
||||||
zones.vpn = {
|
zones.vpn = {
|
||||||
interfaces = ["wg0" "wg1"];
|
interfaces = [
|
||||||
|
"wg0"
|
||||||
|
"wg1"
|
||||||
|
];
|
||||||
};
|
};
|
||||||
|
|
||||||
rules = {
|
rules = {
|
||||||
to-fw = {
|
to-fw = {
|
||||||
from = "all";
|
from = "all";
|
||||||
to = ["fw"];
|
to = [ "fw" ];
|
||||||
verdict = "drop";
|
verdict = "drop";
|
||||||
|
|
||||||
allowedTCPPorts = [
|
allowedTCPPorts = [
|
||||||
|
|
@ -202,8 +204,8 @@
|
||||||
};
|
};
|
||||||
|
|
||||||
vpn-to-wan-nat = {
|
vpn-to-wan-nat = {
|
||||||
from = ["vpn"];
|
from = [ "vpn" ];
|
||||||
to = ["wan"];
|
to = [ "wan" ];
|
||||||
masquerade = true;
|
masquerade = true;
|
||||||
verdict = "accept";
|
verdict = "accept";
|
||||||
};
|
};
|
||||||
|
|
@ -283,9 +285,7 @@
|
||||||
systemd.network.networks.wg0 = {
|
systemd.network.networks.wg0 = {
|
||||||
enable = true;
|
enable = true;
|
||||||
matchConfig.Name = "wg0";
|
matchConfig.Name = "wg0";
|
||||||
address = [
|
address = [ "10.0.0.0/31" ];
|
||||||
"10.0.0.0/31"
|
|
||||||
];
|
|
||||||
|
|
||||||
routes = [
|
routes = [
|
||||||
{
|
{
|
||||||
|
|
@ -299,9 +299,7 @@
|
||||||
systemd.network.networks.wg1 = {
|
systemd.network.networks.wg1 = {
|
||||||
enable = true;
|
enable = true;
|
||||||
matchConfig.Name = "wg1";
|
matchConfig.Name = "wg1";
|
||||||
address = [
|
address = [ "10.0.0.2/31" ];
|
||||||
"10.0.0.2/31"
|
|
||||||
];
|
|
||||||
|
|
||||||
routes = [
|
routes = [
|
||||||
{
|
{
|
||||||
|
|
|
||||||
|
|
@ -4,20 +4,24 @@
|
||||||
repoFlake,
|
repoFlake,
|
||||||
nodeFlake,
|
nodeFlake,
|
||||||
...
|
...
|
||||||
}: let
|
}:
|
||||||
|
let
|
||||||
variables = import ./variables.crypt.nix;
|
variables = import ./variables.crypt.nix;
|
||||||
in {
|
in
|
||||||
|
{
|
||||||
meta.nodeSpecialArgs.${nodeName} = {
|
meta.nodeSpecialArgs.${nodeName} = {
|
||||||
inherit repoFlake nodeName nodeFlake system variables;
|
inherit
|
||||||
|
repoFlake
|
||||||
|
nodeName
|
||||||
|
nodeFlake
|
||||||
|
system
|
||||||
|
variables
|
||||||
|
;
|
||||||
packages' = repoFlake.packages.${system};
|
packages' = repoFlake.packages.${system};
|
||||||
nodePackages' = nodeFlake.packages.${system};
|
nodePackages' = nodeFlake.packages.${system};
|
||||||
};
|
};
|
||||||
|
|
||||||
meta.nodeNixpkgs.${nodeName} =
|
meta.nodeNixpkgs.${nodeName} = import nodeFlake.inputs.nixpkgs.outPath { inherit system; };
|
||||||
import nodeFlake.inputs.nixpkgs.outPath
|
|
||||||
{
|
|
||||||
inherit system;
|
|
||||||
};
|
|
||||||
|
|
||||||
${nodeName} = {
|
${nodeName} = {
|
||||||
deployment.targetHost = variables.ipv4;
|
deployment.targetHost = variables.ipv4;
|
||||||
|
|
|
||||||
|
|
@ -15,5 +15,5 @@
|
||||||
nixos-nftables-firewall.inputs.nixpkgs.follows = "nixpkgs";
|
nixos-nftables-firewall.inputs.nixpkgs.follows = "nixpkgs";
|
||||||
};
|
};
|
||||||
|
|
||||||
outputs = _: {};
|
outputs = _: { };
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -1,3 +1,4 @@
|
||||||
{lib, ...}: {
|
{ lib, ... }:
|
||||||
boot.extraModulePackages = [];
|
{
|
||||||
|
boot.extraModulePackages = [ ];
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -3,8 +3,9 @@
|
||||||
config,
|
config,
|
||||||
pkgs,
|
pkgs,
|
||||||
...
|
...
|
||||||
}: {
|
}:
|
||||||
disabledModules = [];
|
{
|
||||||
|
disabledModules = [ ];
|
||||||
imports = [
|
imports = [
|
||||||
../../profiles/common/configuration.nix
|
../../profiles/common/configuration.nix
|
||||||
{
|
{
|
||||||
|
|
|
||||||
|
|
@ -3,17 +3,17 @@
|
||||||
repoFlake,
|
repoFlake,
|
||||||
nodeFlake,
|
nodeFlake,
|
||||||
...
|
...
|
||||||
}: let
|
}:
|
||||||
|
let
|
||||||
system = "x86_64-linux";
|
system = "x86_64-linux";
|
||||||
in {
|
in
|
||||||
|
{
|
||||||
meta.nodeSpecialArgs.${nodeName} = {
|
meta.nodeSpecialArgs.${nodeName} = {
|
||||||
inherit repoFlake nodeName nodeFlake;
|
inherit repoFlake nodeName nodeFlake;
|
||||||
packages' = repoFlake.packages.${system};
|
packages' = repoFlake.packages.${system};
|
||||||
};
|
};
|
||||||
|
|
||||||
meta.nodeNixpkgs.${nodeName} = import nodeFlake.inputs.nixpkgs.outPath {
|
meta.nodeNixpkgs.${nodeName} = import nodeFlake.inputs.nixpkgs.outPath { inherit system; };
|
||||||
inherit system;
|
|
||||||
};
|
|
||||||
|
|
||||||
${nodeName} = {
|
${nodeName} = {
|
||||||
deployment.targetHost = "${nodeName}.dmz.internal";
|
deployment.targetHost = "${nodeName}.dmz.internal";
|
||||||
|
|
|
||||||
|
|
@ -12,5 +12,5 @@
|
||||||
inputs.nixpkgs_forgejo.url = "github:NixOS/nixpkgs/af4ac075a3e97cb239078e187112afdf380cd47b";
|
inputs.nixpkgs_forgejo.url = "github:NixOS/nixpkgs/af4ac075a3e97cb239078e187112afdf380cd47b";
|
||||||
# nixpkgs_forgejo.url = "github:steveej-forks/nixpkgs/9c3519ab3beb11b8d997281f8922330f707df419";
|
# nixpkgs_forgejo.url = "github:steveej-forks/nixpkgs/9c3519ab3beb11b8d997281f8922330f707df419";
|
||||||
|
|
||||||
outputs = _: {};
|
outputs = _: { };
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -1,4 +1,5 @@
|
||||||
{...}: let
|
{ ... }:
|
||||||
|
let
|
||||||
stage1Modules = [
|
stage1Modules = [
|
||||||
"virtio_balloon"
|
"virtio_balloon"
|
||||||
"virtio_scsi"
|
"virtio_scsi"
|
||||||
|
|
@ -38,7 +39,8 @@
|
||||||
"cdc_ether"
|
"cdc_ether"
|
||||||
"uas"
|
"uas"
|
||||||
];
|
];
|
||||||
in {
|
in
|
||||||
|
{
|
||||||
hardware.opinionatedDisk = {
|
hardware.opinionatedDisk = {
|
||||||
enable = true;
|
enable = true;
|
||||||
encrypted = false;
|
encrypted = false;
|
||||||
|
|
|
||||||
|
|
@ -6,29 +6,29 @@
|
||||||
nodeFlake,
|
nodeFlake,
|
||||||
nodeName,
|
nodeName,
|
||||||
...
|
...
|
||||||
}: let
|
}:
|
||||||
|
let
|
||||||
hostBridgeAddress = "192.168.101.1";
|
hostBridgeAddress = "192.168.101.1";
|
||||||
in {
|
in
|
||||||
|
{
|
||||||
imports = [
|
imports = [
|
||||||
../../snippets/systemd-resolved.nix
|
../../snippets/systemd-resolved.nix
|
||||||
{
|
{
|
||||||
# make sure it uses the DNS that comes in via DHCP
|
# make sure it uses the DNS that comes in via DHCP
|
||||||
networking.nameservers = lib.mkForce [];
|
networking.nameservers = lib.mkForce [ ];
|
||||||
services.resolved.enable = true;
|
services.resolved.enable = true;
|
||||||
|
|
||||||
# provide DNS to the containers
|
# provide DNS to the containers
|
||||||
services.resolved.extraConfig = ''
|
services.resolved.extraConfig = ''
|
||||||
DNSStubListenerExtra=${hostBridgeAddress}
|
DNSStubListenerExtra=${hostBridgeAddress}
|
||||||
'';
|
'';
|
||||||
networking.firewall.interfaces.br0.allowedTCPPorts = [53];
|
networking.firewall.interfaces.br0.allowedTCPPorts = [ 53 ];
|
||||||
networking.firewall.interfaces.br0.allowedUDPPorts = [53];
|
networking.firewall.interfaces.br0.allowedUDPPorts = [ 53 ];
|
||||||
}
|
}
|
||||||
];
|
];
|
||||||
|
|
||||||
programs.wireshark.enable = true;
|
programs.wireshark.enable = true;
|
||||||
environment.systemPackages = [
|
environment.systemPackages = [ pkgs.dnsutils ];
|
||||||
pkgs.dnsutils
|
|
||||||
];
|
|
||||||
|
|
||||||
networking.firewall.enable = true;
|
networking.firewall.enable = true;
|
||||||
networking.nftables.enable = true;
|
networking.nftables.enable = true;
|
||||||
|
|
@ -48,13 +48,13 @@ in {
|
||||||
|
|
||||||
networking.nat = {
|
networking.nat = {
|
||||||
enable = true;
|
enable = true;
|
||||||
internalInterfaces = ["br0"];
|
internalInterfaces = [ "br0" ];
|
||||||
externalInterface = "dmz0";
|
externalInterface = "dmz0";
|
||||||
};
|
};
|
||||||
|
|
||||||
networking.bridges = {
|
networking.bridges = {
|
||||||
br0 = {
|
br0 = {
|
||||||
interfaces = [];
|
interfaces = [ ];
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
networking.interfaces = {
|
networking.interfaces = {
|
||||||
|
|
@ -89,9 +89,7 @@ in {
|
||||||
networkConfig.LinkLocalAddressing = "no";
|
networkConfig.LinkLocalAddressing = "no";
|
||||||
|
|
||||||
# TODO: i'm not sure if and if so why this is required
|
# TODO: i'm not sure if and if so why this is required
|
||||||
macvlan = [
|
macvlan = [ "dmz0" ];
|
||||||
"dmz0"
|
|
||||||
];
|
|
||||||
|
|
||||||
DHCP = "no";
|
DHCP = "no";
|
||||||
};
|
};
|
||||||
|
|
@ -111,22 +109,26 @@ in {
|
||||||
};
|
};
|
||||||
|
|
||||||
# virtualization
|
# virtualization
|
||||||
virtualisation = {docker.enable = false;};
|
virtualisation = {
|
||||||
|
docker.enable = false;
|
||||||
|
};
|
||||||
|
|
||||||
nix.gc = {automatic = true;};
|
nix.gc = {
|
||||||
|
automatic = true;
|
||||||
|
};
|
||||||
|
|
||||||
sops.secrets.restic-password.sopsFile = ../../../../secrets/${nodeName}/secrets.yaml;
|
sops.secrets.restic-password.sopsFile = ../../../../secrets/${nodeName}/secrets.yaml;
|
||||||
|
|
||||||
# adapted from https://github.com/lilyinstarlight/foosteros/blob/5c75ded111878970fd4f600c7adc013f971d5e71/config/restic.nix
|
# adapted from https://github.com/lilyinstarlight/foosteros/blob/5c75ded111878970fd4f600c7adc013f971d5e71/config/restic.nix
|
||||||
services.restic.backups.${nodeName} = let
|
services.restic.backups.${nodeName} =
|
||||||
|
let
|
||||||
btrfs = "${pkgs.btrfs-progs}/bin/btrfs";
|
btrfs = "${pkgs.btrfs-progs}/bin/btrfs";
|
||||||
in {
|
in
|
||||||
|
{
|
||||||
initialize = true;
|
initialize = true;
|
||||||
repository = "sftp://u217879-sub3@u217879-sub3.your-storagebox.de:23/restic/${nodeName}";
|
repository = "sftp://u217879-sub3@u217879-sub3.your-storagebox.de:23/restic/${nodeName}";
|
||||||
|
|
||||||
paths = [
|
paths = [ "/backup" ];
|
||||||
"/backup"
|
|
||||||
];
|
|
||||||
|
|
||||||
pruneOpts = [
|
pruneOpts = [
|
||||||
"--keep-daily 7"
|
"--keep-daily 7"
|
||||||
|
|
@ -167,9 +169,7 @@ in {
|
||||||
sievePort = 4190;
|
sievePort = 4190;
|
||||||
};
|
};
|
||||||
|
|
||||||
webserver =
|
webserver = import ../../containers/webserver.nix {
|
||||||
import ../../containers/webserver.nix
|
|
||||||
{
|
|
||||||
specialArgs = {
|
specialArgs = {
|
||||||
inherit repoFlake nodeFlake;
|
inherit repoFlake nodeFlake;
|
||||||
hostAddress = hostBridgeAddress;
|
hostAddress = hostBridgeAddress;
|
||||||
|
|
|
||||||
|
|
@ -1,4 +1,5 @@
|
||||||
{lib, ...}: {
|
{ lib, ... }:
|
||||||
|
{
|
||||||
boot.loader.grub.efiSupport = lib.mkForce false;
|
boot.loader.grub.efiSupport = lib.mkForce false;
|
||||||
boot.extraModulePackages = [];
|
boot.extraModulePackages = [ ];
|
||||||
}
|
}
|
||||||
|
|
|
||||||
Some files were not shown because too many files have changed in this diff Show more
Loading…
Add table
Add a link
Reference in a new issue