steveej/infra
1
0
Fork 0
Code Issues 2 Pull requests Projects Releases Packages Wiki Activity Actions

workaround elctron issues, fix firewall for syncthing, set uphostkey0 as builder to steveej-t14

Browse source
This commit is contained in:
steveej 2023-12-17 23:25:24 +01:00
parent 70280c38f0
commit fd6077c476
8 changed files with 78 additions and 43 deletions
Download patch file Download diff file Expand all files Collapse all files

13
nix/home-manager/configuration/graphical-fullblown.nix
View file

@ -47,6 +47,7 @@ in {
nixpkgs.config.permittedInsecurePackages = [
"electron-24.8.6"
"electron-25.9.0"
];
home.packages =
@ -104,8 +105,8 @@ in {
# Messaging/Communication
# pidgin
hexchat
schildichat-desktop
# hexchat
# schildichat-desktop # insecure as of 2023-12-16
aspellDicts.en
aspellDicts.de
# skypeforlinux
@ -248,7 +249,13 @@ in {
pcmanfm
# mendeley
evince
pkgsUnstableSmall.logseq
(runCommand "logseq-wrapper" {
nativeBuildInputs = [ makeWrapper ];
} ''
makeWrapper ${logseq}/bin/logseq $out/bin/logseq \
--set NIXOS_OZONE_WL ""
'')
# (logseq.override({ electron_25 = electron_26; }))
# File Synchronzation
maestral

3
nix/home-manager/profiles/sway-desktop.nix
View file

@ -100,8 +100,7 @@ in {
wayland.windowManager.sway = {
enable = true;
systemdIntegration = true;
# systemd.enable = true;
systemd.enable = true;
xwayland = true;
config = let

3
nix/home-manager/programs/chromium.nix
View file

@ -38,6 +38,9 @@
# cookie autodelete
{id = "fhcgjolkccmbidfldomjliifgaodjagh";}
# unhook
{ id = "khncfooichmfjbepaaaebmommgaepoid";}
]
++ (lib.lists.optionals ((builtins.match "^steveej.*" name) != null) [
# Vimium C

4
nix/home-manager/programs/firefox.nix
View file

@ -1,6 +1,6 @@
{pkgs, ...}: {
# programs.librewolf = {enable = true;};
programs.librewolf = {enable = true;};
programs.firefox = {enable = true;};
home.file.".mozilla/native-messaging-hosts/passff.json".source = "${pkgs.passff-host}/share/passff-host/passff.json";
# home.file.".mozilla/native-messaging-hosts/passff.json".source = "${pkgs.passff-host}/share/passff-host/passff.json";
}

28
nix/os/devices/sj-bm-hostkey0/configuration.nix
View file

@ -11,11 +11,11 @@
...
}: {
disabledModules = [
# "services/networking/hostapd.nix"
];
imports = [
nodeFlake.inputs.disko.nixosModules.disko
nodeFlake.inputs.srvos.nixosModules.roles-nix-remote-builder
repoFlake.inputs.sops-nix.nixosModules.sops
../../profiles/common/user.nix
@ -35,8 +35,19 @@
inherit pkgs;
};
home-manager.users.steveej = import ../../../home-manager/configuration/text-minimal.nix {
inherit pkgs;
home-manager.users.steveej = { pkgs, ... }: {
imports = [
../../../home-manager/configuration/text-minimal.nix
];
home.packages = [
pkgs.nil
pkgs.rnix-lsp
pkgs.nixd
pkgs.nixpkgs-fmt
pkgs.alejandra
pkgs.nixfmt
];
};
programs.zsh.enable = true;
@ -45,6 +56,11 @@
}
];
roles.nix-remote-builder.schedulerPublicKeys = [
# TODO: make this a reference to the private key's secret
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIC8FHuK0k86iBWq41+NAhVwJqH1ZpGJe+q01m7iLviz6 root@steveej-t14"
];
services.openssh.enable = true;
services.openssh.settings.PermitRootLogin = "yes";
@ -141,4 +157,10 @@
# home.packages = with pkgs; [
# ];
# };
virtualisation.libvirtd.enable = true;
boot.binfmt.emulatedSystems = [
"aarch64-linux"
];
}

9
nix/os/devices/sj-bm-hostkey0/flake.nix
View file

@ -59,15 +59,6 @@
native = mkNixosConfiguration {
inherit system;
};
# cross = mkNixosConfiguration {
# extraModules = [
# {
# nixpkgs.buildPlatform.system = "x86_64-linux";
# nixpkgs.hostPlatform.system = system;
# }
# ];
# };
};
};
}

57
nix/os/devices/steveej-t14/system.nix
View file

@ -7,6 +7,23 @@
...
}: let
passwords = import ../../../variables/passwords.crypt.nix;
localTcpPorts = [
22
# syncthing
22000
# iperf3
5201
];
localUdpPorts = [
# syncthing
22000
21027
];
in {
imports = [
../../snippets/nix-settings-holo-chain.nix
@ -19,6 +36,20 @@ in {
];
};
nix.distributedBuilds = true;
nix.buildMachines = [
{
hostName = repoFlake.colmena.sj-bm-hostkey0.deployment.targetHost;
# TODO: make this a reference
sshUser = "nix-remote-builder";
protocol = "ssh-ng";
system = "x86_64-linux";
maxJobs = 24;
speedFactor = 100;
supportedFeatures = repoFlake.nixosConfigurations.router0-dmz0.config.nix.settings.system-features ++ [];
}
];
networking.extraHosts = ''
'';
@ -37,28 +68,10 @@ in {
services.openssh.openFirewall = false;
# TODO: upstream feature for inverse rule to work: `! --in-interface zt+`
networking.firewall.interfaces."eth+".allowedTCPPorts = [
22
# syncthing
22000
# iperf3
5201
# used on holochain hackathon for cache reverse proxy
80
];
networking.firewall.interfaces."eth+".allowedUDPPorts = [
# syncthing
22000
21027
];
networking.firewall.interfaces."wlan+".allowedTCPPorts = [
# used on holochain hackathon for cache reverse proxy
80
];
networking.firewall.interfaces."eth+".allowedTCPPorts = localTcpPorts;
networking.firewall.interfaces."eth+".allowedUDPPorts = localUdpPorts;
networking.firewall.interfaces."wlan+".allowedTCPPorts = localTcpPorts;
networking.firewall.interfaces."wlan+".allowedUDPPorts = localUdpPorts;
networking.firewall.logRefusedConnections = false;
networking.usePredictableInterfaceNames = false;

4
nix/os/snippets/nix-settings.nix
View file

@ -12,14 +12,14 @@
"nixpkgs=${pkgs.path}"
];
nix.experimental-features = [
nix.settings.experimental-features = [
"nix-command"
"flakes"
"ca-derivations"
"impure-derivations"
];
nix.system-features = [
nix.settings.system-features = [
"recursive-nix"
"big-parallel"
"kvm"