teutat3s
/
os
forked from pub-solar/os
1
0
Fork 0
Code Pull Requests Activity

feat: convert to flake-parts 

Thanks @b12f
main
teutat3s 2023-11-10 19:48:06 +01:00
parent 802750c5ba
commit a6e5630927
Signed by: teutat3s
GPG Key ID: 4FA1D3FA524F22C1
131 changed files with 3659 additions and 6228 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
.gitignore vendored
View File

@ -4,7 +4,7 @@ doc/index.html
# Result of bud commands
vm
iso
/iso
doi
pkgs/_sources/.shake*

309
flake.lock
View File

@ -3,10 +3,10 @@
"agenix": {
"inputs": {
"darwin": [
"darwin"
"nix-darwin"
],
"nixpkgs": [
"nixos"
"nixpkgs"
]
},
"locked": {
@ -23,42 +23,22 @@
"type": "github"
}
},
"darwin": {
"inputs": {
"nixpkgs": [
"nixos"
]
},
"locked": {
"lastModified": 1692248770,
"narHash": "sha256-tZeFpETKQGbgnaSIO1AGWD27IyTcBm4D+A9d7ulQ4NM=",
"owner": "LnL7",
"repo": "nix-darwin",
"rev": "511177ffe8226c78c9cf6a92a7b5f2df3684956b",
"type": "github"
},
"original": {
"owner": "LnL7",
"repo": "nix-darwin",
"type": "github"
}
},
"deploy": {
"deploy-rs": {
"inputs": {
"flake-compat": [
"flake-compat"
],
"nixpkgs": [
"nixos"
"nixpkgs"
],
"utils": "utils"
},
"locked": {
"lastModified": 1686747123,
"narHash": "sha256-XUQK9kwHpTeilHoad7L4LjMCCyY13Oq383CoFADecRE=",
"lastModified": 1695052866,
"narHash": "sha256-agn7F9Oww4oU6nPiw+YiYI9Xb4vOOE73w8PAoBRP4AA=",
"owner": "serokell",
"repo": "deploy-rs",
"rev": "724463b5a94daa810abfc64a4f87faef4e00f984",
"rev": "e3f41832680801d0ee9e2ed33eb63af398b090e9",
"type": "github"
},
"original": {
@ -69,29 +49,7 @@
},
"devshell": {
"inputs": {
"flake-utils": "flake-utils",
"nixpkgs": [
"digga",
"nixpkgs"
]
},
"locked": {
"lastModified": 1671489820,
"narHash": "sha256-qoei5HDJ8psd1YUPD7DhbHdhLIT9L2nadscp4Qk37uk=",
"owner": "numtide",
"repo": "devshell",
"rev": "5aa3a8039c68b4bf869327446590f4cdf90bb634",
"type": "github"
},
"original": {
"owner": "numtide",
"repo": "devshell",
"type": "github"
}
},
"devshell_2": {
"inputs": {
"nixpkgs": "nixpkgs",
"nixpkgs": "nixpkgs_2",
"systems": "systems"
},
"locked": {
@ -108,46 +66,6 @@
"type": "github"
}
},
"digga": {
"inputs": {
"darwin": [
"darwin"
],
"deploy": [
"deploy"
],
"devshell": "devshell",
"flake-compat": [
"flake-compat"
],
"flake-utils": "flake-utils_2",
"flake-utils-plus": "flake-utils-plus",
"home-manager": [
"home"
],
"nixlib": [
"nixos"
],
"nixpkgs": [
"nixos"
],
"nixpkgs-unstable": "nixpkgs-unstable"
},
"locked": {
"lastModified": 1674947971,
"narHash": "sha256-6gKqegJHs72jnfFP9g2sihl4fIZgtKgKuqU2rCkIdGY=",
"owner": "pub-solar",
"repo": "digga",
"rev": "2da608bd8afb48afef82c6b1b6d852a36094a497",
"type": "github"
},
"original": {
"owner": "pub-solar",
"ref": "fix/bootstrap-iso",
"repo": "digga",
"type": "github"
}
},
"flake-compat": {
"flake": false,
"locked": {
@ -164,59 +82,25 @@
"type": "github"
}
},
"flake-utils": {
"locked": {
"lastModified": 1642700792,
"narHash": "sha256-XqHrk7hFb+zBvRg6Ghl+AZDq03ov6OshJLiSWOoX5es=",
"owner": "numtide",
"repo": "flake-utils",
"rev": "846b2ae0fc4cc943637d3d1def4454213e203cba",
"type": "github"
},
"original": {
"owner": "numtide",
"repo": "flake-utils",
"type": "github"
}
},
"flake-utils-plus": {
"flake-parts": {
"inputs": {
"flake-utils": [
"digga",
"flake-utils"
]
"nixpkgs-lib": "nixpkgs-lib"
},
"locked": {
"lastModified": 1654029967,
"narHash": "sha256-my3GQ3mQIw/1f6GPV1IhUZrcYQSWh0YJAMPNBjhXJDw=",
"owner": "gytis-ivaskevicius",
"repo": "flake-utils-plus",
"rev": "6271cf3842ff9c8a9af9e3508c547f86bc77d199",
"lastModified": 1698579227,
"narHash": "sha256-KVWjFZky+gRuWennKsbo6cWyo7c/z/VgCte5pR9pEKg=",
"owner": "hercules-ci",
"repo": "flake-parts",
"rev": "f76e870d64779109e41370848074ac4eaa1606ec",
"type": "github"
},
"original": {
"owner": "gytis-ivaskevicius",
"ref": "refs/pull/120/head",
"repo": "flake-utils-plus",
"owner": "hercules-ci",
"repo": "flake-parts",
"type": "github"
}
},
"flake-utils_2": {
"locked": {
"lastModified": 1667395993,
"narHash": "sha256-nuEHfE/LcWyuSWnS8t12N1wc105Qtau+/OdUAjtQ0rA=",
"owner": "numtide",
"repo": "flake-utils",
"rev": "5aed5285a952e0b949eb3ba02c12fa4fcfef535f",
"type": "github"
},
"original": {
"owner": "numtide",
"repo": "flake-utils",
"type": "github"
}
},
"flake-utils_3": {
"flake-utils": {
"locked": {
"lastModified": 1653893745,
"narHash": "sha256-0jntwV3Z8//YwuOjzhV2sgJJPt+HY6KhU7VZUL0fKZQ=",
@ -231,7 +115,7 @@
"type": "github"
}
},
"flake-utils_4": {
"flake-utils_2": {
"inputs": {
"systems": "systems_2"
},
@ -265,18 +149,18 @@
"type": "github"
}
},
"home": {
"home-manager": {
"inputs": {
"nixpkgs": [
"nixos"
"nixpkgs"
]
},
"locked": {
"lastModified": 1693208669,
"narHash": "sha256-hHFaaUsZ860wvppPeiu7nJn/nXZjJfnqAQEu9SPFE9I=",
"lastModified": 1695108154,
"narHash": "sha256-gSg7UTVtls2yO9lKtP0yb66XBHT1Fx5qZSZbGMpSn2c=",
"owner": "nix-community",
"repo": "home-manager",
"rev": "5bac4a1c06cd77cf8fc35a658ccb035a6c50cd2c",
"rev": "07682fff75d41f18327a871088d20af2710d4744",
"type": "github"
},
"original": {
@ -286,22 +170,6 @@
"type": "github"
}
},
"latest": {
"locked": {
"lastModified": 1698134075,
"narHash": "sha256-foCD+nuKzfh49bIoiCBur4+Fx1nozo+4C/6k8BYk4sg=",
"owner": "nixos",
"repo": "nixpkgs",
"rev": "8efd5d1e283604f75a808a20e6cde0ef313d07d4",
"type": "github"
},
"original": {
"owner": "nixos",
"ref": "nixos-unstable",
"repo": "nixpkgs",
"type": "github"
}
},
"master": {
"locked": {
"lastModified": 1686841982,
@ -318,19 +186,24 @@
"type": "github"
}
},
"nixos": {
"nix-darwin": {
"inputs": {
"nixpkgs": [
"nixpkgs"
]
},
"locked": {
"lastModified": 1698288402,
"narHash": "sha256-jIIjApPdm+4yt8PglX8pUOexAdEiAax/DXW3S/Mb21E=",
"owner": "nixos",
"repo": "nixpkgs",
"rev": "60b9db998f71ea49e1a9c41824d09aa274be1344",
"lastModified": 1698429334,
"narHash": "sha256-Gq3+QabboczSu7RMpcy79RSLMSqnySO3wsnHQk4DfbE=",
"owner": "lnl7",
"repo": "nix-darwin",
"rev": "afe83cbc2e673b1f08d32dd0f70df599678ff1e7",
"type": "github"
},
"original": {
"owner": "nixos",
"ref": "nixos-23.05",
"repo": "nixpkgs",
"owner": "lnl7",
"ref": "master",
"repo": "nix-darwin",
"type": "github"
}
},
@ -350,6 +223,21 @@
"type": "github"
}
},
"nixos-flake": {
"locked": {
"lastModified": 1698598244,
"narHash": "sha256-YbvPFt+9CbCiqnuS0dTx+P+W1YRCqzhLXen94sef3Kk=",
"owner": "srid",
"repo": "nixos-flake",
"rev": "f6b7757ad88483afca306c9f3bf387887fba7284",
"type": "github"
},
"original": {
"owner": "srid",
"repo": "nixos-flake",
"type": "github"
}
},
"nixos-hardware": {
"locked": {
"lastModified": 1693718952,
@ -366,6 +254,40 @@
}
},
"nixpkgs": {
"locked": {
"lastModified": 1699291058,
"narHash": "sha256-5ggduoaAMPHUy4riL+OrlAZE14Kh7JWX4oLEs22ZqfU=",
"owner": "nixos",
"repo": "nixpkgs",
"rev": "41de143fda10e33be0f47eab2bfe08a50f234267",
"type": "github"
},
"original": {
"owner": "nixos",
"ref": "nixos-23.05",
"repo": "nixpkgs",
"type": "github"
}
},
"nixpkgs-lib": {
"locked": {
"dir": "lib",
"lastModified": 1696019113,
"narHash": "sha256-X3+DKYWJm93DRSdC5M6K5hLqzSya9BjibtBsuARoPco=",
"owner": "NixOS",
"repo": "nixpkgs",
"rev": "f5892ddac112a1e9b3612c39af1b72987ee5783a",
"type": "github"
},
"original": {
"dir": "lib",
"owner": "NixOS",
"ref": "nixos-unstable",
"repo": "nixpkgs",
"type": "github"
}
},
"nixpkgs_2": {
"locked": {
"lastModified": 1677383253,
"narHash": "sha256-UfpzWfSxkfXHnb4boXZNaKsAcUrZT9Hw+tao1oZxd08=",
@ -381,38 +303,23 @@
"type": "github"
}
},
"nixpkgs-unstable": {
"locked": {
"lastModified": 1672791794,
"narHash": "sha256-mqGPpGmwap0Wfsf3o2b6qHJW1w2kk/I6cGCGIU+3t6o=",
"owner": "nixos",
"repo": "nixpkgs",
"rev": "9813adc7f7c0edd738c6bdd8431439688bb0cb3d",
"type": "github"
},
"original": {
"owner": "nixos",
"ref": "nixos-unstable",
"repo": "nixpkgs",
"type": "github"
}
},
"root": {
"inputs": {
"agenix": "agenix",
"darwin": "darwin",
"deploy": "deploy",
"digga": "digga",
"deploy-rs": "deploy-rs",
"flake-compat": "flake-compat",
"flake-parts": "flake-parts",
"fork": "fork",
"home": "home",
"latest": "latest",
"home-manager": "home-manager",
"master": "master",
"nixos": "nixos",
"nix-darwin": "nix-darwin",
"nixos-22-05": "nixos-22-05",
"nixos-flake": "nixos-flake",
"nixos-hardware": "nixos-hardware",
"nixpkgs": "nixpkgs",
"triton-vmtools": "triton-vmtools",
"tritonshell": "tritonshell"
"tritonshell": "tritonshell",
"unstable": "unstable"
}
},
"systems": {
@ -447,9 +354,9 @@
},
"triton-vmtools": {
"inputs": {
"flake-utils": "flake-utils_3",
"flake-utils": "flake-utils",
"nixpkgs": [
"latest"
"unstable"
]
},
"locked": {
@ -471,10 +378,10 @@
},
"tritonshell": {
"inputs": {
"devshell": "devshell_2",
"flake-utils": "flake-utils_4",
"devshell": "devshell",
"flake-utils": "flake-utils_2",
"nixpkgs": [
"latest"
"unstable"
]
},
"locked": {
@ -492,6 +399,22 @@
"url": "https://git.greenbaum.cloud/dev/tritonshell"
}
},
"unstable": {
"locked": {
"lastModified": 1699099776,
"narHash": "sha256-X09iKJ27mGsGambGfkKzqvw5esP1L/Rf8H3u3fCqIiU=",
"owner": "nixos",
"repo": "nixpkgs",
"rev": "85f1ba3e51676fa8cc604a3d863d729026a6b8eb",
"type": "github"
},
"original": {
"owner": "nixos",
"ref": "nixos-unstable",
"repo": "nixpkgs",
"type": "github"
}
},
"utils": {
"locked": {
"lastModified": 1667395993,

216
flake.nix
View File

@ -1,13 +1,13 @@
{
description = "A highly structured configuration database.";
description = "teutat3s hosts in nix";
nixConfig.extra-experimental-features = "nix-command flakes";
inputs = {
# Track channels with commits tested and built by hydra
nixos-22-05.url = "github:nixos/nixpkgs/nixos-22.05";
nixos.url = "github:nixos/nixpkgs/nixos-23.05";
latest.url = "github:nixos/nixpkgs/nixos-unstable";
nixpkgs.url = "github:nixos/nixpkgs/nixos-23.05";
unstable.url = "github:nixos/nixpkgs/nixos-unstable";
master.url = "github:nixos/nixpkgs/master";
fork.url = "github:teutat3s/nixpkgs/nvfetcher-fix";
@ -15,177 +15,84 @@
flake-compat.url = "github:edolstra/flake-compat";
flake-compat.flake = false;
digga.url = "github:pub-solar/digga/fix/bootstrap-iso";
digga.inputs.nixpkgs.follows = "nixos";
digga.inputs.nixlib.follows = "nixos";
digga.inputs.home-manager.follows = "home";
digga.inputs.deploy.follows = "deploy";
digga.inputs.darwin.follows = "darwin";
digga.inputs.flake-compat.follows = "flake-compat";
nix-darwin.url = "github:lnl7/nix-darwin/master";
nix-darwin.inputs.nixpkgs.follows = "nixpkgs";
home.url = "github:nix-community/home-manager/release-23.05";
home.inputs.nixpkgs.follows = "nixos";
home-manager.url = "github:nix-community/home-manager/release-23.05";
home-manager.inputs.nixpkgs.follows = "nixpkgs";
darwin.url = "github:LnL7/nix-darwin";
darwin.inputs.nixpkgs.follows = "nixos";
flake-parts.url = "github:hercules-ci/flake-parts";
nixos-flake.url = "github:srid/nixos-flake";
deploy.url = "github:serokell/deploy-rs";
deploy.inputs.nixpkgs.follows = "nixos";
deploy.inputs.flake-compat.follows = "flake-compat";
deploy-rs.url = "github:serokell/deploy-rs";
deploy-rs.inputs.nixpkgs.follows = "nixpkgs";
deploy-rs.inputs.flake-compat.follows = "flake-compat";
agenix.url = "github:ryantm/agenix";
agenix.inputs.nixpkgs.follows = "nixos";
agenix.inputs.darwin.follows = "darwin";
agenix.inputs.nixpkgs.follows = "nixpkgs";
agenix.inputs.darwin.follows = "nix-darwin";
nixos-hardware.url = "github:nixos/nixos-hardware";
# PubSolarOS additions
triton-vmtools.url = "git+https://git.pub.solar/pub-solar/infra-vintage?ref=main&dir=vmtools";
triton-vmtools.inputs.nixpkgs.follows = "latest";
triton-vmtools.inputs.nixpkgs.follows = "unstable";
tritonshell.url = "git+https://git.greenbaum.cloud/dev/tritonshell?ref=main";
tritonshell.inputs.nixpkgs.follows = "latest";
tritonshell.inputs.nixpkgs.follows = "unstable";
};
outputs = {
self,
digga,
nixos,
home,
nixos-hardware,
agenix,
deploy,
tritonshell,
...
} @ inputs:
digga.lib.mkFlake
{
inherit self inputs;
channelsConfig = {
allowUnfree = true;
};
supportedSystems = ["x86_64-linux" "aarch64-linux" "aarch64-darwin"];
channels = {
nixos = {
imports = [(digga.lib.importOverlays ./overlays)];
overlays = [
(self: super: {
deploy-rs = {
inherit (inputs.nixos.legacyPackages.x86_64-linux) deploy-rs;
lib = inputs.deploy.lib.x86_64-linux;
};
})
];
};
nixos-22-05 = {};
latest = {};
master = {};
fork = {};
};
lib = import ./lib {lib = digga.lib // nixos.lib;};
sharedOverlays = [
(final: prev: {
__dontExport = true;
lib = prev.lib.extend (lfinal: lprev: {
our = self.lib;
});
})
agenix.overlays.default
(import ./pkgs)
outputs = inputs@{ self, ...}:
inputs.flake-parts.lib.mkFlake { inherit inputs; } {
systems = [
"x86_64-linux"
"aarch64-linux"
"x86_64-darwin"
"aarch64-darwin"
];
nixos = {
hostDefaults = {
system = "x86_64-linux";
channelName = "nixos";
imports = [(digga.lib.importExportableModules ./modules)];
modules = [
{lib.our = self.lib;}
# FIXME: upstream module causes a huge number of unnecessary
# dependencies to be pulled in for all systems -- many of them are
# graphical. should only be imported as needed.
# digga.nixosModules.bootstrapIso
digga.nixosModules.nixConfig
home.nixosModules.home-manager
agenix.nixosModules.age
imports = [
inputs.nixos-flake.flakeModule
./lib
./modules
./hosts
./users
./overlays
];
perSystem = args@{ system, pkgs, config, ... }: {
_module.args = {
inherit inputs;
pkgs = import inputs.nixpkgs {
inherit system;
overlays = [
inputs.agenix.overlays.default
];
};
unstable = import inputs.unstable { inherit system; };
master = import inputs.master { inherit system; };
};
devShells.default = pkgs.mkShell {
buildInputs = with pkgs; [
deploy-rs
nixpkgs-fmt
agenix
cachix
editorconfig-checker
nix
nodePackages.prettier
nvfetcher
shellcheck
shfmt
treefmt
nixos-generators
];
};
imports = [(digga.lib.importHosts ./hosts)];
hosts = {
# Set host-specific properties here
bootstrap = {
modules = [
digga.nixosModules.bootstrapIso
];
};
PubSolarOS = {
tests = [
#(import ./tests/first-test.nix {
# pkgs = nixos.legacyPackages.x86_64-linux;
# lib = nixos.lib;
#})
];
};
fae = {
system = "aarch64-linux";
};
powder = {
system = "x86_64-linux";
};
};
importables = rec {
profiles =
digga.lib.rakeLeaves ./profiles
// {
users = digga.lib.rakeLeaves ./users;
};
suites = with profiles; rec {
base = [users.pub-solar users.root];
iso = base ++ [base-user graphical pub-solar-iso];
pubsolaros = [full-install base-user users.root];
anonymous = [pubsolaros users.pub-solar];
teutat3s = pubsolaros ++ [users.teutat3s];
dumpyourvms = teutat3s ++ [graphical];
ryzensun = teutat3s ++ [graphical];
};
};
};
home = {
imports = [(digga.lib.importExportableModules ./users/modules)];
modules = [];
importables = rec {
profiles = digga.lib.rakeLeaves ./users/profiles;
suites = with profiles; rec {
base = [direnv];
};
};
users = {
pub-solar = {suites, ...}: {
imports = suites.base;
home.stateVersion = "21.03";
};
teutat3s = {suites, ...}: {
imports = suites.base;
home.stateVersion = "21.03";
};
}; # digga.lib.importers.rakeLeaves ./users/hm;
};
devshell = ./shell;
homeConfigurations = digga.lib.mkHomeConfigurations self.nixosConfigurations;
deploy.nodes = digga.lib.mkDeployNodes self.nixosConfigurations {
flake = {
deploy.nodes = self.b12f-os.lib.deploy.mkDeployNodes self.nixosConfigurations {
#example = {
# hostname = "example.com:22";
# sshUser = "bartender";
@ -217,4 +124,5 @@
};
};
};
};
}

103
hosts/default.nix Normal file
View File

@ -0,0 +1,103 @@
{ withSystem, self, inputs, ...}:
{
flake = {
nixosConfigurations = {
dumpyourvms = self.nixos-flake.lib.mkLinuxSystem {
nixpkgs.hostPlatform = "x86_64-linux";
imports = [
self.nixosModules.base
./dumpyourvms
self.nixosModules.teutat3s
self.nixosModules.audio
self.nixosModules.bluetooth
self.nixosModules.desktop-extended
self.nixosModules.docker
#self.nixosModules.email
self.nixosModules.graphical
self.nixosModules.nextcloud
self.nixosModules.office
self.nixosModules.printing
#self.nixosModules.wireguard-client
];
};
ryzensun = self.nixos-flake.lib.mkLinuxSystem {
nixpkgs.hostPlatform = "x86_64-linux";
imports = [
self.nixosModules.base
./ryzensun
self.nixosModules.teutat3s
self.nixosModules.audio
self.nixosModules.desktop-extended
self.nixosModules.docker
#self.nixosModules.email
#self.nixosModules.gaming
self.nixosModules.graphical
self.nixosModules.nextcloud
self.nixosModules.office
self.nixosModules.printing
self.nixosModules.virtualisation
#self.nixosModules.wireguard-client
];
};
#fae = self.nixos-flake.lib.mkLinuxSystem {
# nixpkgs.hostPlatform = "x86_64-linux";
# imports = [
# self.nixosModules.base
# ./fae
# self.nixosModules.teutat3s
# self.nixosModules.wireguard-client
# ];
#};
#powder = self.nixos-flake.lib.mkLinuxSystem {
# nixpkgs.hostPlatform = "aarch64-linux";
# imports = [
# self.nixosModules.base
# inputs.nixos-hardware.nixosModules.raspberry-pi-4
# ./powder
# self.nixosModules.teutat3s
# self.nixosModules.docker
# self.nixosModules.wireguard-client
# self.nixosModules.invoiceplane
# ];
#};
iso = self.nixos-flake.lib.mkLinuxSystem {
nixpkgs.hostPlatform = "x86_64-linux";
imports = [
"${inputs.nixpkgs}/nixos/modules/installer/cd-dvd/installation-cd-minimal.nix"
self.nixosModules.base
./iso
self.nixosModules.nixos
];
};
iso-arm = self.nixos-flake.lib.mkLinuxSystem {
nixpkgs.hostPlatform = "aarch64-linux";
nixpkgs.buildPlatform = "x86_64-linux";
imports = [
"${inputs.nixpkgs}/nixos/modules/installer/cd-dvd/installation-cd-minimal.nix"
self.nixosModules.base
./iso
self.nixosModules.nixos
];
};
iso-graphical = self.nixos-flake.lib.mkLinuxSystem {
nixpkgs.hostPlatform = "x86_64-linux";
imports = [
"${inputs.nixpkgs}/nixos/modules/installer/cd-dvd/installation-cd-minimal.nix"
self.nixosModules.base
./iso
self.nixosModules.nixos
self.nixosModules.graphical
self.nixosModules.audio
self.nixosModules.bluetooth
({ ... }: { pub-solar.graphical.wayland.software-renderer.enable = true; })
];
};
};
};
}

13
hosts/dumpyourvms/default.nix
View File

@ -1,7 +1,8 @@
{suites, ...}: {
imports =
[
./dumpyourvms.nix
]
++ suites.dumpyourvms;
{ ... }: {
imports = [
./dumpyourvms.nix
./hardware-configuration.nix
./networking.nix
];
}

349
hosts/dumpyourvms/dumpyourvms.nix
View File

@ -1,197 +1,178 @@
{
config,
pkgs,
lib,
self,
pkgs,
...
}:
with lib; let
psCfg = config.pub-solar;
xdg = config.home-manager.users."${psCfg.user.name}".xdg;
in {
imports = [
./hardware-configuration.nix
];
config = {
age.secrets.environment-secrets = {
file = "${self}/secrets/environment-secrets.age";
mode = "700";
owner = "teutat3s";
};
age.secrets.github-api-token = {
file = "${self}/secrets/github-api-token.age";
mode = "600";
owner = "teutat3s";
path = "/home/${psCfg.user.name}/.local/share/github/api-token";
};
pub-solar = {
audio.mopidy.enable = lib.mkForce false;
core.hibernation = {
enable = true;
resumeDevice = "/dev/mapper/cryptroot";
resumeOffset = 47366144;
};
virtualisation.enable = true;
};
# Fix backlight for keyboard and brightness, adjust function key binding,
# intel_pstate for cpu schedutil
# For now, the radeon driver seems to work better than amdgpu with Radeon R9 M370X
# Explicitly set amdgpu support in place of radeon
# Source: https://github.com/NixOS/nixos-hardware/blob/master/common/gpu/amd/southern-islands/default.nix
# Try again after https://lists.freedesktop.org/archives/amd-gfx/2023-March/090096.html lands
boot.kernelParams = ["acpi_backlight=video" "hid_apple.fnmode=2" "intel_pstate=passive" "radeon.si_support=0" "amdgpu.si_support=1"];
boot.loader.efi.canTouchEfiVariables = true;
# Fix for Error switching console mode to 1: unsupported on startup
boot.loader.systemd-boot.consoleMode = mkForce "0";
boot.binfmt.emulatedSystems = ["aarch64-linux"];
systemd.sleep.extraConfig = ''
HibernateMode=shutdown
'';
hardware = {
cpu.intel.updateMicrocode = true;
facetimehd.enable = true;
opengl = {
extraPackages = with pkgs; [intel-media-driver];
};
};
services.resolved = {
pub-solar = {
terminal-life.full = true;
core.hibernation = {
enable = true;
# DNSSEC=false because of random SERVFAIL responses with Greenbaum DNS
# when using allow-downgrade, see https://github.com/systemd/systemd/issues/10579
extraConfig = ''
DNS=5.1.66.255#dot.ffmuc.net 185.150.99.255#dot.ffmuc.net 5.9.164.112#dns3.digitalcourage.de 89.233.43.71#unicast.censurfridns.dk 185.49.141.37#getdnsapi.net 2001:678:e68:f000::#dot.ffmuc.net 2001:678:ed0:f000::#dot.ffmuc.net 2a01:4f8:251:554::2#dns3.digitalcourage.de 2a01:3a0:53:53::0#unicast.censurfridns.dk 2a04:b900:0:100::38#getdnsapi.net
FallbackDNS=9.9.9.9#dns.quad9.net 149.112.112.112#dns.quad9.net 2620:fe::fe#dns.quad9.net 2620:fe::9#dns.quad9.net
Domains=~.
DNSOverTLS=yes
DNSSEC=false
'';
resumeDevice = "/dev/mapper/cryptroot";
resumeOffset = 47366144;
};
networking = import ./networking.nix;
services.tailscale.enable = true;
security.pki.certificateFiles = [./consul-agent-ca.pem];
# Power off dedicated GPU, use only integrated Intel GPU to save battery
# https://github.com/NixOS/nixpkgs/pull/33915
# https://ubuntuforums.org/showthread.php?t=2409856
systemd.services."amd-hybrid-graphics-power-save" = {
path = [pkgs.bash];
description = "Power Off dedicated AMD Card to reduce power usage";
requires = ["sys-kernel-debug.mount"];
enable = true;
serviceConfig = {
Type = "oneshot";
RemainAfterExit = true;
ExecStart = "${pkgs.bash}/bin/sh -c 'sleep 7 && if grep --quiet 'IGD:+' /sys/kernel/debug/vgaswitcheroo/switch; then echo -e \"IGD\\nOFF\" > /sys/kernel/debug/vgaswitcheroo/switch; fi'";
ExecStop = "${pkgs.bash}/bin/sh -c 'echo ON >/sys/kernel/debug/vgaswitcheroo/switch'";
};
wantedBy = ["multi-user.target"];
};
# Increase console font size for HiDPI display
console = {
earlySetup = true;
font = lib.mkForce "ter-i32b";
packages = [pkgs.terminus_font];
};
# Thunderbolt tools
services.hardware.bolt.enable = true;
# Enable udev rules for gnupg smart cards
hardware.gpgSmartcards.enable = true;
powerManagement = {
# Use new schedutil govenor
# https://github.com/NixOS/nixpkgs/pull/42330
# https://www.kernel.org/doc/html/v5.10/admin-guide/pm/cpufreq.html#schedutil
cpuFreqGovernor = lib.mkDefault "schedutil";
# brcmfmac being loaded during hibernation would inhibit a successful resume
# https://bugzilla.kernel.org/show_bug.cgi?id=101681#c116.
# Also brcmfmac could randomly crash on resume from sleep.
# To hibernate successfully using the amdgpu driver, the dedicated GPU needs
# to be powered on.
powerUpCommands = lib.mkBefore (
"${pkgs.kmod}/bin/modprobe brcmfmac"
+ lib.optionalString
(lib.versionAtLeast config.boot.kernelPackages.kernel.version "6.2") " brcmfmac_wcc"
);
powerDownCommands = lib.mkBefore (
lib.optionalString
(lib.versionAtLeast config.boot.kernelPackages.kernel.version "6.2")
"${pkgs.kmod}/bin/rmmod brcmfmac_wcc\n"
+ ''
${pkgs.kmod}/bin/rmmod brcmfmac
${pkgs.systemd}/bin/systemctl stop amd-hybrid-graphics-power-save.service
''
);
resumeCommands =
if config.systemd.services."amd-hybrid-graphics-power-save".enable == true
then ''
${pkgs.systemd}/bin/systemctl start amd-hybrid-graphics-power-save.service
''
else "";
};
# Change lid switch behaviour
services.logind.lidSwitch = "hibernate";
# TLP for power management
services.tlp = {
enable = true;
settings = {
CPU_SCALING_GOVERNOR_ON_AC = "performance";
CPU_SCALING_GOVERNOR_ON_BAT = "schedutil";
CPU_BOOST_ON_AC = 1;
CPU_BOOST_ON_BAT = 0;
};
};
services.udev.extraRules =
# Disable XHC1 wakeup signal to avoid resume getting triggered some time
# after suspend. Reboot required for this to take effect.
lib.optionalString
(lib.versionAtLeast config.boot.kernelPackages.kernel.version "3.13")
''SUBSYSTEM=="pci", KERNEL=="0000:00:14.0", ATTR{power/wakeup}="disabled"'';
services.printing.enable = true;
home-manager = pkgs.lib.setAttrByPath ["users" psCfg.user.name] {
# Custom device sway configs
xdg.configFile = mkIf psCfg.sway.enable {
"sway/config.d/10-applications.conf".source = ./.config/sway/config.d/applications.conf;
"sway/config.d/autostart.conf".source = ./.config/sway/config.d/autostart.conf;
"sway/config.d/10-custom-keybindings.conf".source = ./.config/sway/config.d/custom-keybindings.conf;
"sway/config.d/input-defaults.conf".source = ./.config/sway/config.d/input-defaults.conf;
"sway/config.d/screens.conf".source = ./.config/sway/config.d/screens.conf;
};
};
# WLAN frequency compliance (e.g. check for radar with DFS)
hardware.firmware = with pkgs; [wireless-regdb];
boot.extraModprobeConfig = ''
options cfg80211 ieee80211_regdom="DE"
# Enable the integrated GPU (iGPU) Intel i915 by default if present
options apple-gmux force_igd=y
'';
# This value determines the NixOS release from which the default
# settings for stateful data, like file locations and database versions
# on your system were taken. It‘s perfectly fine and recommended to leave
# this value at the release version of the first install of this system.
# Before changing this value read the documentation for this option
# (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
system.stateVersion = "21.05"; # Did you read the comment?
};
boot.kernelPackages = pkgs.linuxPackages_6_6;
# Fix backlight for keyboard and brightness, adjust function key binding,
# intel_pstate for cpu schedutil
# For now, the radeon driver seems to work better than amdgpu with Radeon R9 M370X
# Explicitly set amdgpu support in place of radeon
# Source: https://github.com/NixOS/nixos-hardware/blob/master/common/gpu/amd/southern-islands/default.nix
# Try again after https://lists.freedesktop.org/archives/amd-gfx/2023-March/090096.html lands
boot.kernelParams = ["acpi_backlight=video" "hid_apple.fnmode=2" "intel_pstate=passive" "radeon.si_support=0" "amdgpu.si_support=1"];
boot.loader.efi.canTouchEfiVariables = true;
# Fix for Error switching console mode to 1: unsupported on startup
boot.loader.systemd-boot.consoleMode = mkForce "0";
boot.binfmt.emulatedSystems = ["aarch64-linux"];
systemd.sleep.extraConfig = ''
HibernateMode=shutdown
'';
hardware = {
cpu.intel.updateMicrocode = true;
facetimehd.enable = true;
opengl = {
extraPackages = with pkgs; [intel-media-driver];
};
};
networking.hostName = "dumpyourvms";
services.resolved = {
enable = true;
# DNSSEC=false because of random SERVFAIL responses with Greenbaum DNS
# when using allow-downgrade, see https://github.com/systemd/systemd/issues/10579
extraConfig = ''
DNS=5.1.66.255#dot.ffmuc.net 185.150.99.255#dot.ffmuc.net 5.9.164.112#dns3.digitalcourage.de 89.233.43.71#unicast.censurfridns.dk 185.49.141.37#getdnsapi.net 2001:678:e68:f000::#dot.ffmuc.net 2001:678:ed0:f000::#dot.ffmuc.net 2a01:4f8:251:554::2#dns3.digitalcourage.de 2a01:3a0:53:53::0#unicast.censurfridns.dk 2a04:b900:0:100::38#getdnsapi.net
FallbackDNS=9.9.9.9#dns.quad9.net 149.112.112.112#dns.quad9.net 2620:fe::fe#dns.quad9.net 2620:fe::9#dns.quad9.net
Domains=~.
DNSOverTLS=yes
DNSSEC=false
'';
};
services.tailscale.enable = true;
security.pki.certificateFiles = [./consul-agent-ca.pem];
# Power off dedicated GPU, use only integrated Intel GPU to save battery
# https://github.com/NixOS/nixpkgs/pull/33915
# https://ubuntuforums.org/showthread.php?t=2409856
systemd.services."amd-hybrid-graphics-power-save" = {
path = [pkgs.bash];
description = "Power Off dedicated AMD Card to reduce power usage";
requires = ["sys-kernel-debug.mount"];
enable = true;
serviceConfig = {
Type = "oneshot";
RemainAfterExit = true;
ExecStart = "${pkgs.bash}/bin/sh -c 'sleep 7 && if grep --quiet 'IGD:+' /sys/kernel/debug/vgaswitcheroo/switch; then echo -e \"IGD\\nOFF\" > /sys/kernel/debug/vgaswitcheroo/switch; fi'";
ExecStop = "${pkgs.bash}/bin/sh -c 'echo ON >/sys/kernel/debug/vgaswitcheroo/switch'";
};
wantedBy = ["multi-user.target"];
};
# Increase console font size for HiDPI display
console = {
earlySetup = true;
font = lib.mkForce "ter-i32b";
packages = [pkgs.terminus_font];
};
# Thunderbolt tools
services.hardware.bolt.enable = true;
# Enable udev rules for gnupg smart cards
hardware.gpgSmartcards.enable = true;
powerManagement = {
# Use new schedutil govenor
# https://github.com/NixOS/nixpkgs/pull/42330
# https://www.kernel.org/doc/html/v5.10/admin-guide/pm/cpufreq.html#schedutil
cpuFreqGovernor = lib.mkDefault "schedutil";
# brcmfmac being loaded during hibernation would inhibit a successful resume
# https://bugzilla.kernel.org/show_bug.cgi?id=101681#c116.
# Also brcmfmac could randomly crash on resume from sleep.
# To hibernate successfully using the amdgpu driver, the dedicated GPU needs
# to be powered on.
powerUpCommands = lib.mkBefore (
"${pkgs.kmod}/bin/modprobe brcmfmac"
+ lib.optionalString
(lib.versionAtLeast config.boot.kernelPackages.kernel.version "6.2") " brcmfmac_wcc"
);
powerDownCommands = lib.mkBefore (
lib.optionalString
(lib.versionAtLeast config.boot.kernelPackages.kernel.version "6.2")
"${pkgs.kmod}/bin/rmmod brcmfmac_wcc\n"
+ ''
${pkgs.kmod}/bin/rmmod brcmfmac
${pkgs.systemd}/bin/systemctl stop amd-hybrid-graphics-power-save.service
''
);
resumeCommands =
if config.systemd.services."amd-hybrid-graphics-power-save".enable == true
then ''
${pkgs.systemd}/bin/systemctl start amd-hybrid-graphics-power-save.service
''
else "";
};
# Change lid switch behaviour
services.logind.lidSwitch = "hibernate";
# TLP for power management
services.tlp = {
enable = true;
settings = {
CPU_SCALING_GOVERNOR_ON_AC = "performance";
CPU_SCALING_GOVERNOR_ON_BAT = "schedutil";
CPU_BOOST_ON_AC = 1;
CPU_BOOST_ON_BAT = 0;
};
};
services.udev.extraRules =
# Disable XHC1 wakeup signal to avoid resume getting triggered some time
# after suspend. Reboot required for this to take effect.
lib.optionalString
(lib.versionAtLeast config.boot.kernelPackages.kernel.version "3.13")
''SUBSYSTEM=="pci", KERNEL=="0000:00:14.0", ATTR{power/wakeup}="disabled"'';
services.printing.enable = true;
home-manager = pkgs.lib.setAttrByPath ["users" psCfg.user.name] {
# Custom device sway configs
xdg.configFile = {
"sway/config.d/10-applications.conf".source = ./.config/sway/config.d/applications.conf;
"sway/config.d/autostart.conf".source = ./.config/sway/config.d/autostart.conf;
"sway/config.d/10-custom-keybindings.conf".source = ./.config/sway/config.d/custom-keybindings.conf;
"sway/config.d/input-defaults.conf".source = ./.config/sway/config.d/input-defaults.conf;
"sway/config.d/screens.conf".source = ./.config/sway/config.d/screens.conf;
};
};
# WLAN frequency compliance (e.g. check for radar with DFS)
hardware.firmware = with pkgs; [wireless-regdb];
boot.extraModprobeConfig = ''
options cfg80211 ieee80211_regdom="DE"
# Enable the integrated GPU (iGPU) Intel i915 by default if present
options apple-gmux force_igd=y
'';
# This value determines the NixOS release from which the default
# settings for stateful data, like file locations and database versions
# on your system were taken. It‘s perfectly fine and recommended to leave
# this value at the release version of the first install of this system.
# Before changing this value read the documentation for this option
# (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
system.stateVersion = "21.05"; # Did you read the comment?
}

204
hosts/dumpyourvms/networking.nix
View File

@ -1,112 +1,114 @@
{
networkmanager.dns = "systemd-resolved";
networking = {
networkmanager.dns = "systemd-resolved";
# https://github.com/tailscale/tailscale/issues/4432#issuecomment-1112819111
# https://github.com/NixOS/nixpkgs/commit/68e514ed1cf55451901e8d0edd3e8ee5102d3565
#firewall.checkReversePath = "loose";
# https://github.com/tailscale/tailscale/issues/4432#issuecomment-1112819111
# https://github.com/NixOS/nixpkgs/commit/68e514ed1cf55451901e8d0edd3e8ee5102d3565
#firewall.checkReversePath = "loose";
hosts = {
"10.0.0.42" = ["nomad.service.consul" "nomad.service.cgn-1.consul"];
"10.0.0.66" = ["consul.service.cgn-1.consul"];
"10.0.1.9" = ["consul.service.lev-1.consul"];
"10.0.0.70" = ["vault.service.consul" "vault.service.cgn-1.consul"];
"10.0.0.200" = ["headnode.cgn-1"];
"10.0.0.201" = ["cn01.cgn-1"];
"10.0.0.202" = ["cn02.cgn-1"];
"10.0.0.205" = ["cn05.cgn-1"];
"10.0.0.206" = ["cn06.cgn-1"];
"10.0.0.207" = ["cn07.cgn-1"];
"10.0.0.208" = ["cn08.cgn-1"];
"10.0.1.200" = ["headnode.lev-1"];
"10.0.1.201" = ["cn01.lev-1"];
"10.0.1.202" = ["cn02.lev-1"];
"10.0.1.203" = ["cn03.lev-1"];
"10.0.1.204" = ["cn04.lev-1"];
"10.0.1.205" = ["cn05.lev-1"];
"10.0.1.206" = ["cn00.lev-1"];
"10.0.1.207" = ["cn06.lev-1"];
"10.0.1.208" = ["cn07.lev-1"];
"10.101.64.10" = ["wifi.bahn.de"];
};
wireguard.enable = true;
wg-quick.interfaces = {
wg0 = {
address = ["10.8.8.6/32"];
privateKeyFile = "/etc/wireguard/wg0.privatekey";
peers = [
{
publicKey = "l0DJLicCrcrixNP6zAWTXNSEaNM2jML253BXEZ1KpiU=";
allowedIPs = ["10.8.8.16/32" "10.0.0.0/24" "10.88.88.0/24"];
endpoint = "85.88.23.16:51820";
persistentKeepalive = 25;
}
];
hosts = {
"10.0.0.42" = ["nomad.service.consul" "nomad.service.cgn-1.consul"];
"10.0.0.66" = ["consul.service.cgn-1.consul"];
"10.0.1.9" = ["consul.service.lev-1.consul"];
"10.0.0.70" = ["vault.service.consul" "vault.service.cgn-1.consul"];
"10.0.0.200" = ["headnode.cgn-1"];
"10.0.0.201" = ["cn01.cgn-1"];
"10.0.0.202" = ["cn02.cgn-1"];
"10.0.0.205" = ["cn05.cgn-1"];
"10.0.0.206" = ["cn06.cgn-1"];
"10.0.0.207" = ["cn07.cgn-1"];
"10.0.0.208" = ["cn08.cgn-1"];
"10.0.1.200" = ["headnode.lev-1"];
"10.0.1.201" = ["cn01.lev-1"];
"10.0.1.202" = ["cn02.lev-1"];
"10.0.1.203" = ["cn03.lev-1"];
"10.0.1.204" = ["cn04.lev-1"];
"10.0.1.205" = ["cn05.lev-1"];
"10.0.1.206" = ["cn00.lev-1"];
"10.0.1.207" = ["cn06.lev-1"];
"10.0.1.208" = ["cn07.lev-1"];
"10.101.64.10" = ["wifi.bahn.de"];
};
wg1 = {
address = ["192.168.188.203/24"];
privateKeyFile = "/etc/wireguard/wg1.privatekey";
peers = [
{
publicKey = "iZkgeA/mFxBRclCa5SJYdqffClly/uho5krebcUloCY=";
allowedIPs = ["192.168.188.0/24"];
presharedKeyFile = "/etc/wireguard/wg1.presharedkey";
#endpoint = "85.214.70.91:50163";
#endpoint = "7gwzft61sc8txc4r.myfritz.net:50163";
endpoint = "[2a00:6020:1000:47::2ded]:50163";
persistentKeepalive = 25;
}
];
};
wg2 = {
address = ["10.6.6.4/32"];
privateKeyFile = "/etc/wireguard/wg2.privatekey";
wireguard.enable = true;
wg-quick.interfaces = {
wg0 = {
address = ["10.8.8.6/32"];
privateKeyFile = "/etc/wireguard/wg0.privatekey";
peers = [
{
publicKey = "nYMmaCIW8lZ7SokivN8HXxYDch+SS1G7ab1SC9meDAw=";
presharedKeyFile = "/etc/wireguard/wg2.presharedkey";
allowedIPs = ["10.6.6.1/32" "10.1.1.0/24"];
endpoint = "85.88.23.127:51820";
persistentKeepalive = 16;
}
];
};
wg3 = {
address = ["10.11.11.2/32"];
privateKeyFile = "/etc/wireguard/wg3.privatekey";
mtu = 1300;
peers = [
{
publicKey = "l0DJLicCrcrixNP6zAWTXNSEaNM2jML253BXEZ1KpiU=";
allowedIPs = ["10.8.8.16/32" "10.0.0.0/24" "10.88.88.0/24"];
endpoint = "85.88.23.16:51820";
persistentKeepalive = 25;
}
];
};
wg1 = {
address = ["192.168.188.203/24"];
privateKeyFile = "/etc/wireguard/wg1.privatekey";
peers = [
{
publicKey = "7RRgfZSneqAtAHBeI6+aaYLqz9e1jikg/lIK8mhW928=";
presharedKeyFile = "/etc/wireguard/wg3.presharedkey";
allowedIPs = ["10.11.11.0/24" "192.168.1.0/24" "10.0.1.0/24"];
endpoint = "80.71.153.1:51820";
persistentKeepalive = 16;
}
];
};
wg4 = {
address = ["fdaa:1:3234:a7b:16a9:0:a:202/120"];
privateKeyFile = "/etc/wireguard/wg4.privatekey";
postUp = "resolvectl dns wg4 fdaa:1:3234::3; resolvectl domain wg4 ~internal";
preDown = "resolvectl revert wg4";
#dns = [
# "fdaa:1:3234::3, internal"
#];
peers = [
{
publicKey = "iZkgeA/mFxBRclCa5SJYdqffClly/uho5krebcUloCY=";
allowedIPs = ["192.168.188.0/24"];
presharedKeyFile = "/etc/wireguard/wg1.presharedkey";
#endpoint = "85.214.70.91:50163";
#endpoint = "7gwzft61sc8txc4r.myfritz.net:50163";
endpoint = "[2a00:6020:1000:47::2ded]:50163";
persistentKeepalive = 25;
}
];
};
wg2 = {
address = ["10.6.6.4/32"];
privateKeyFile = "/etc/wireguard/wg2.privatekey";
peers = [
{
publicKey = "yUyg63j5+17YeJ7gRhxoQuF6rvdX0JF59M6skytJFTQ=";
allowedIPs = ["fdaa:1:3234::/48"];
#endpoint = "ams1.gateway.6pn.dev:51820";
endpoint = "176.58.93.206:51820";
persistentKeepalive = 15;
}
];
peers = [
{
publicKey = "nYMmaCIW8lZ7SokivN8HXxYDch+SS1G7ab1SC9meDAw=";
presharedKeyFile = "/etc/wireguard/wg2.presharedkey";
allowedIPs = ["10.6.6.1/32" "10.1.1.0/24"];
endpoint = "85.88.23.127:51820";
persistentKeepalive = 16;
}
];
};
wg3 = {
address = ["10.11.11.2/32"];
privateKeyFile = "/etc/wireguard/wg3.privatekey";
mtu = 1300;
peers = [
{
publicKey = "7RRgfZSneqAtAHBeI6+aaYLqz9e1jikg/lIK8mhW928=";
presharedKeyFile = "/etc/wireguard/wg3.presharedkey";
allowedIPs = ["10.11.11.0/24" "192.168.1.0/24" "10.0.1.0/24"];
endpoint = "80.71.153.1:51820";
persistentKeepalive = 16;
}
];
};
wg4 = {
address = ["fdaa:1:3234:a7b:16a9:0:a:202/120"];
privateKeyFile = "/etc/wireguard/wg4.privatekey";
postUp = "resolvectl dns wg4 fdaa:1:3234::3; resolvectl domain wg4 ~internal";
preDown = "resolvectl revert wg4";
#dns = [
# "fdaa:1:3234::3, internal"
#];
peers = [
{
publicKey = "yUyg63j5+17YeJ7gRhxoQuF6rvdX0JF59M6skytJFTQ=";
allowedIPs = ["fdaa:1:3234::/48"];
#endpoint = "ams1.gateway.6pn.dev:51820";
endpoint = "176.58.93.206:51820";
persistentKeepalive = 15;
}
];
};
};
};
}

10
hosts/iso/default.nix Normal file
View File

@ -0,0 +1,10 @@
{
pkgs,
lib,
...
}: {
pub-solar.core.disk-encryption-active = false;
isoImage.squashfsCompression = "gzip -Xcompression-level 1";
systemd.services.sshd.wantedBy = lib.mkForce [ "multi-user.target" ];
networking.networkmanager.enable = false;
}

13
hosts/ryzensun/default.nix
View File

@ -1,7 +1,8 @@
{suites, ...}: {
imports =
[
./ryzensun.nix
]
++ suites.ryzensun;
{ ... }: {
imports = [
./ryzensun.nix
./hardware-configuration.nix
./networking.nix
];
}

158
hosts/ryzensun/networking.nix
View File

@ -1,84 +1,86 @@
{
hosts = {
"10.0.0.42" = ["nomad.service.consul" "nomad.service.cgn-1.consul"];
"10.0.0.66" = ["consul.service.cgn-1.consul"];
"10.0.1.9" = ["consul.service.lev-1.consul"];
"10.0.0.70" = ["vault.service.consul" "vault.service.cgn-1.consul"];
"10.0.0.200" = ["headnode.cgn-1"];
"10.0.0.201" = ["cn01.cgn-1"];
"10.0.0.202" = ["cn02.cgn-1"];
"10.0.0.205" = ["cn05.cgn-1"];
"10.0.0.206" = ["cn06.cgn-1"];
"10.0.0.207" = ["cn07.cgn-1"];
"10.0.0.208" = ["cn08.cgn-1"];
"10.0.1.200" = ["headnode.lev-1"];
"10.0.1.201" = ["cn01.lev-1"];
"10.0.1.202" = ["cn02.lev-1"];
"10.0.1.203" = ["cn03.lev-1"];
"10.0.1.204" = ["cn04.lev-1"];
"10.0.1.205" = ["cn05.lev-1"];
"10.0.1.206" = ["cn00.lev-1"];
"10.0.1.207" = ["cn06.lev-1"];
"10.0.1.208" = ["cn07.lev-1"];
};
wireguard.enable = true;
wg-quick.interfaces = {
wg0 = {
address = ["10.8.8.7/32"];
privateKeyFile = "/etc/wireguard/wg0.privatekey";
peers = [
{
publicKey = "l0DJLicCrcrixNP6zAWTXNSEaNM2jML253BXEZ1KpiU=";
allowedIPs = ["10.8.8.16/32" "10.0.0.0/24" "10.88.88.0/24"];
endpoint = "85.88.23.16:51820";
persistentKeepalive = 25;
}
];
networking = {
hosts = {
"10.0.0.42" = ["nomad.service.consul" "nomad.service.cgn-1.consul"];
"10.0.0.66" = ["consul.service.cgn-1.consul"];
"10.0.1.9" = ["consul.service.lev-1.consul"];
"10.0.0.70" = ["vault.service.consul" "vault.service.cgn-1.consul"];
"10.0.0.200" = ["headnode.cgn-1"];
"10.0.0.201" = ["cn01.cgn-1"];
"10.0.0.202" = ["cn02.cgn-1"];
"10.0.0.205" = ["cn05.cgn-1"];
"10.0.0.206" = ["cn06.cgn-1"];
"10.0.0.207" = ["cn07.cgn-1"];
"10.0.0.208" = ["cn08.cgn-1"];
"10.0.1.200" = ["headnode.lev-1"];
"10.0.1.201" = ["cn01.lev-1"];
"10.0.1.202" = ["cn02.lev-1"];
"10.0.1.203" = ["cn03.lev-1"];
"10.0.1.204" = ["cn04.lev-1"];
"10.0.1.205" = ["cn05.lev-1"];
"10.0.1.206" = ["cn00.lev-1"];
"10.0.1.207" = ["cn06.lev-1"];
"10.0.1.208" = ["cn07.lev-1"];
};
wg1 = {
address = ["10.11.11.6/32"];
privateKeyFile = "/etc/wireguard/wg1.privatekey";
mtu = 1300;
peers = [
{
publicKey = "7RRgfZSneqAtAHBeI6+aaYLqz9e1jikg/lIK8mhW928=";
presharedKeyFile = "/etc/wireguard/wg1.presharedkey";
allowedIPs = ["10.11.11.0/24" "192.168.1.0/24" "10.0.1.0/24"];
endpoint = "80.71.153.1:51820";
#persistentKeepalive = 16;
}
];
wireguard.enable = true;
wg-quick.interfaces = {
wg0 = {
address = ["10.8.8.7/32"];
privateKeyFile = "/etc/wireguard/wg0.privatekey";
peers = [
{
publicKey = "l0DJLicCrcrixNP6zAWTXNSEaNM2jML253BXEZ1KpiU=";
allowedIPs = ["10.8.8.16/32" "10.0.0.0/24" "10.88.88.0/24"];
endpoint = "85.88.23.16:51820";
persistentKeepalive = 25;
}
];
};
wg1 = {
address = ["10.11.11.6/32"];
privateKeyFile = "/etc/wireguard/wg1.privatekey";
mtu = 1300;
peers = [
{
publicKey = "7RRgfZSneqAtAHBeI6+aaYLqz9e1jikg/lIK8mhW928=";
presharedKeyFile = "/etc/wireguard/wg1.presharedkey";
allowedIPs = ["10.11.11.0/24" "192.168.1.0/24" "10.0.1.0/24"];
endpoint = "80.71.153.1:51820";
#persistentKeepalive = 16;
}
];
};
#wg1 = {
# address = [ "10.13.0.1/32" ];
# privateKeyFile = "/etc/wireguard/wg1.privatekey";
# mtu = 1412;
# peers = [
# {
# publicKey = "XS3TTIMU7Jp3JJANBpE14RsVDJk6/VUvZgjQgQP8kAs=";
# allowedIPs = [ "10.13.0.100/32" "192.168.188.0/24" ];
# endpoint = "[2a00:6020:48ad:dd00:dea6:32ff:fe85:3306]:51820";
# persistentKeepalive = 25;
# }
# ];
#};
#wg2 = {
# address = [ "10.6.6.4/32" ];
# privateKeyFile = "/etc/wireguard/wg2.privatekey";
# peers = [
# {
# publicKey = "nYMmaCIW8lZ7SokivN8HXxYDch+SS1G7ab1SC9meDAw=";
# presharedKeyFile = "/etc/wireguard/wg2.presharedkey";
# allowedIPs = [ "10.6.6.1/32" "10.1.1.0/24" ];
# endpoint = "85.88.23.127:51820";
# persistentKeepalive = 16;
# }
# ];
#};
};
#wg1 = {
# address = [ "10.13.0.1/32" ];
# privateKeyFile = "/etc/wireguard/wg1.privatekey";
# mtu = 1412;
# peers = [
# {
# publicKey = "XS3TTIMU7Jp3JJANBpE14RsVDJk6/VUvZgjQgQP8kAs=";
# allowedIPs = [ "10.13.0.100/32" "192.168.188.0/24" ];
# endpoint = "[2a00:6020:48ad:dd00:dea6:32ff:fe85:3306]:51820";
# persistentKeepalive = 25;
# }
# ];
#};
#wg2 = {
# address = [ "10.6.6.4/32" ];
# privateKeyFile = "/etc/wireguard/wg2.privatekey";
# peers = [
# {
# publicKey = "nYMmaCIW8lZ7SokivN8HXxYDch+SS1G7ab1SC9meDAw=";
# presharedKeyFile = "/etc/wireguard/wg2.presharedkey";
# allowedIPs = [ "10.6.6.1/32" "10.1.1.0/24" ];
# endpoint = "85.88.23.127:51820";
# persistentKeepalive = 16;
# }
# ];
#};
};
}

42
hosts/ryzensun/ryzensun.nix
View File

@ -2,44 +2,34 @@
config,
pkgs,
lib,
self,
flake,
...
}:
with lib; let
psCfg = config.pub-solar;
xdg = config.home-manager.users."${psCfg.user.name}".xdg;
in {
imports = [
./hardware-configuration.nix
];
config = {
age.secrets.environment-secrets = {
file = "${self}/secrets/environment-secrets.age";
mode = "700";
file = "${flake.self}/secrets/environment-secrets.age";
mode = "600";
owner = "teutat3s";
};
age.secrets.docker-ci-runner-secrets = {
file = "${self}/secrets/docker-ci-runner-secrets.age";
mode = "700";
file = "${flake.self}/secrets/docker-ci-runner-secrets.age";
mode = "600";
owner = "999";
};
pub-solar.nextcloud.enable = mkForce false;
pub-solar.docker.enable = true;
pub-solar.virtualisation.enable = true;
pub-solar.docker-ci-runner = {
enable = false;
runnerEnvironment = {
DRONE_RUNNER_CAPACITY = "1";
DRONE_RUNNER_LABELS = "hosttype:baremetal";
};
runnerVarsFile = config.age.secrets.docker-ci-runner-secrets.path;
};
pub-solar.audio.mopidy.enable = mkForce false;
networking = import ./networking.nix;
pub-solar.terminal-life.full = true;
#pub-solar.docker-ci-runner = {
# enable = false;
# runnerEnvironment = {
# DRONE_RUNNER_CAPACITY = "1";
# DRONE_RUNNER_LABELS = "hosttype:baremetal";
# };
# runnerVarsFile = config.age.secrets.docker-ci-runner-secrets.path;
#};
# Increase console font size for HiDPI display
console = {
@ -48,7 +38,9 @@ in {
packages = [pkgs.terminus_font];
};
home-manager.users."${psCfg.user.name}".xdg.configFile = mkIf psCfg.sway.enable {
networking.hostName = "ryzensun";
home-manager.users."${psCfg.user.name}".xdg.configFile = {
"sway/config.d/10-custom-keybindings.conf".source = ./.config/sway/config.d/custom-keybindings.conf;
"sway/config.d/autostart.conf".source = ./.config/sway/config.d/autostart.conf;
"sway/config.d/input-defaults.conf".source = ./.config/sway/config.d/input-defaults.conf;

5
lib/add-local-hostname.nix Normal file
View File

@ -0,0 +1,5 @@
{ lib }:
hostnames: {
"127.0.0.1" = hostnames;
"::1" = hostnames;
}

28
lib/default.nix
View File

@ -1,10 +1,18 @@
{lib}:
lib.makeExtensible (self: let
callLibs = file: import file {lib = self;};
in rec {
## Define your own library functions here!
#id = x: x;
## Or in files, containing functions that take {lib}
#foo = callLibs ./foo.nix;
## In configs, they can be used under "lib.our"
})
{ lib, inputs, ... }: {
# Configuration common to all Linux systems
flake = {
lib = let
callLibs = file: import file {inherit lib;};
in rec {
## Define your own library functions here!
#id = x: x;
## Or in files, containing functions that take {lib}
#foo = callLibs ./foo.nix;
## In configs, they can be used under "lib.our"
deploy = import ./deploy.nix { inherit inputs lib; };
addLocalHostname = callLibs ./add-local-hostname.nix;
recursiveMerge = callLibs ./recursive-merge.nix;
};
};
}

62
lib/deploy.nix Normal file
View File

@ -0,0 +1,62 @@
/*
* The contents of this file are adapted from digga
* https://github.com/divnix/digga
*
* Licensed under the MIT license
*/
{ lib, inputs }: let
getFqdn = c: let
net = c.config.networking;
fqdn =
if (net ? domain) && (net.domain != null)
then "${net.hostName}.${net.domain}"
else net.hostName;
in
fqdn;
in {
mkDeployNodes = systemConfigurations: extraConfig:
/*
*
Synopsis: mkNodes _systemConfigurations_ _extraConfig_
Generate the `nodes` attribute expected by deploy-rs
where _systemConfigurations_ are `nodes`.
_systemConfigurations_ should take the form of a flake's
_nixosConfigurations_. Note that deploy-rs does not currently support
deploying to darwin hosts.
_extraConfig_, if specified, will be merged into each of the
nodes' configurations.
Example _systemConfigurations_ input:
```
{
hostname-1 = {
fastConnection = true;
sshOpts = [ "-p" "25" ];
};
hostname-2 = {
sshOpts = [ "-p" "19999" ];
sshUser = "root";
};
}
```
*
*/
lib.recursiveUpdate
(lib.mapAttrs
(
_: c: {
hostname = getFqdn c;
profiles.system = {
user = "root";
path = inputs.deploy-rs.lib.${c.pkgs.stdenv.hostPlatform.system}.activate.nixos c;
};
}
)
systemConfigurations)
extraConfig;
}

16
lib/recursive-merge.nix Normal file
View File

@ -0,0 +1,16 @@
{ lib }:
attrList:
let
f = attrPath:
zipAttrsWith (
n: values:
if tail values == []
then head values
else if all isList values
then unique (concatLists values)
else if all isAttrs values
then f (attrPath ++ [n]) values
else last values
);
in
f [] attrList;

15
modules/adb/default.nix Normal file
View File

@ -0,0 +1,15 @@
{
lib,
config,
pkgs,
...
}:
with lib; let
psCfg = config.pub-solar;
in {
programs.adb.enable = true;
users.users."${psCfg.user.name}" = {
extraGroups = ["adbusers"];
};
}

22
modules/arduino/default.nix
View File

@ -6,22 +6,12 @@
}:
with lib; let
psCfg = config.pub-solar;
cfg = config.pub-solar.devops;
in {
options.pub-solar.arduino = {
enable = mkEnableOption "Life with home automation";
};
config = mkIf cfg.enable {
users.users = pkgs.lib.setAttrByPath [psCfg.user.name] {
extraGroups = ["dialout"];
};
home-manager = with pkgs;
pkgs.lib.setAttrByPath ["users" psCfg.user.name] {
home.packages = [
arduino
arduino-cli
];
};
users.users."${psCfg.user.name}" = {
extraGroups = ["dialout"];
packages = with pkgs; [
arduino
arduino-cli
];
};
}

129
modules/audio/default.nix
View File

@ -6,115 +6,34 @@
}:
with lib; let
psCfg = config.pub-solar;
cfg = config.pub-solar.audio;
xdg = config.home-manager.users."${psCfg.user.name}".xdg;
in {
options.pub-solar.audio = {
enable = mkEnableOption "Life in highs and lows";
mopidy.enable = mkEnableOption "Life with mopidy";
spotify.enable = mkEnableOption "Life in DRM";
spotify.username = mkOption {
description = "Spotify login username or email";
type = types.str;
example = "yourname@example.com";
default = "";
};
bluetooth.enable = mkEnableOption "Life with bluetooth";
users.users."${psCfg.user.name}" = {
extraGroups = ["audio"];
packages = with pkgs; [
# easyeffects, e.g. for microphone noise filtering
easyeffects
mu
pavucontrol
pa_applet
playerctl
# Needed for pactl cmd, until pw-cli is more mature (vol up/down hotkeys?)
pulseaudio
vimpc
];
};
config = mkIf cfg.enable {
users.users = pkgs.lib.setAttrByPath [psCfg.user.name] {
extraGroups = ["audio"];
};
home-manager.users."${psCfg.user.name}" = {
xdg.configFile."vimpc/vimpcrc".source = ./.config/vimpc/vimpcrc;
systemd.user.services.easyeffects = import ./easyeffects.service.nix pkgs;
};
home-manager = with pkgs;
pkgs.lib.setAttrByPath ["users" psCfg.user.name] {
home.packages =
[
# easyeffects, e.g. for microphone noise filtering
easyeffects
mu
pavucontrol
pa_applet
playerctl
# Needed for pactl cmd, until pw-cli is more mature (vol up/down hotkeys?)
pulseaudio
vimpc
]
++ (
if cfg.spotify.enable
then [pkgs.spotify-tui]
else []
);
xdg.configFile."vimpc/vimpcrc".source = ./.config/vimpc/vimpcrc;
systemd.user.services.easyeffects = import ./easyeffects.service.nix pkgs;
services.spotifyd = mkIf cfg.spotify.enable {
enable = true;
settings = {
global = {
username = cfg.spotify.username;
password_cmd = "DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/1001/bus ${pkgs.libsecret}/bin/secret-tool lookup spotify password";
bitrate = 320;
volume_normalisation = true;
no_audio_cache = false;
max_cache_size = 1000000000;
};
};
};
};
# rtkit is optional but recommended
security.rtkit.enable = true;
# Enable sound using pipewire-pulse, default config:
# https://gitlab.freedesktop.org/pipewire/pipewire/-/blob/master/src/daemon/pipewire.conf.in
services.pipewire = {
enable = true;
alsa.enable = true;
alsa.support32Bit = true;
pulse.enable = true;
};
# Make pulseaudio listen on port 4713 for mopidy, extending the default
# config: https://gitlab.freedesktop.org/pipewire/pipewire/-/blob/master/src/daemon/pipewire-pulse.conf.in
environment.etc = mkIf cfg.mopidy.enable {
"pipewire/pipewire-pulse.conf.d/99-custom.conf".text = ''
{
"context.modules": [
{
"name": "libpipewire-module-protocol-pulse",
"args": {
"server.address": ["unix:native", "tcp:4713"],
"vm.overrides": {
"pulse.min.quantum": "1024/48000"
}
}
}
]
}
'';
};
# Enable bluetooth
hardware.bluetooth = mkIf cfg.bluetooth.enable {
enable = true;
# Disable bluetooth on startup to save battery
powerOnBoot = false;
# Disable useless SIM Access Profile plugin
disabledPlugins = [
"sap"
];
settings = {
General = {
# Enables experimental features and interfaces.
# Makes BlueZ Battery Provider available
Experimental = true;
};
};
};
services.blueman.enable = mkIf cfg.bluetooth.enable true;
# Enable audio server & client
services.mopidy = mkIf cfg.mopidy.enable ((import ./mopidy.nix) pkgs);
# rtkit is optional but recommended
security.rtkit.enable = true;
services.pipewire = {
enable = true;
alsa.enable = true;
alsa.support32Bit = true;
pulse.enable = true;
};
}

18
modules/audio/mopidy.nix
View File

@ -1,18 +0,0 @@
pkgs: {
enable = true;
extensionPackages = with pkgs; [
mopidy-mpd
mopidy-soundcloud
mopidy-youtube
mopidy-local
mopidy-jellyfin
];
configuration = ''
[mpd]
hostname = ::
[audio]
output = pulsesink server=127.0.0.1:4713
'';
}

35
modules/bluetooth/default.nix Normal file
View File

@ -0,0 +1,35 @@
{
lib,
config,
pkgs,
...
}: {
hardware.bluetooth = {
enable = true;
# Disable bluetooth on startup to save battery
powerOnBoot = false;
# Disable useless SIM Access Profile plugin
disabledPlugins = [
"sap"
];
settings = {
General = {
# Enables experimental features and interfaces.
# Makes BlueZ Battery Provider available
Experimental = true;
};
};
};
services.blueman.enable = true;
environment.etc."wireplumber/bluetooth.lua.d/51-bluez-config.lua" = {
text = ''
bluez_monitor.properties = {
["bluez5.enable-sbc-xq"] = true,
["bluez5.enable-msbc"] = true,
["bluez5.enable-hw-volume"] = true,
["bluez5.headset-roles"] = "[ hsp_hs hsp_ag hfp_hf hfp_ag ]"
}
'';
};
}

45
modules/ci-runner/default.nix
View File

@ -1,45 +0,0 @@
{
lib,
config,
pkgs,
self,
...
}:
with lib; let
psCfg = config.pub-solar;
cfg = config.pub-solar.ci-runner;
in {
options.pub-solar.ci-runner = {
enable = mkEnableOption "Enables a systemd service that runs drone-ci-runner";
};
config = mkIf cfg.enable {
systemd.user.services.ci-runner = {
enable = true;
description = "CI runner for the PubSolarOS repository that can run test VM instances with KVM.";
serviceConfig = {
Type = "simple";
Restart = "always";
};
path = [
pkgs.git
pkgs.nix
pkgs.libvirt
];
wantedBy = ["multi-user.target"];
after = ["network.target" "libvirtd.service"];
script = ''${pkgs.drone-runner-exec}/bin/drone-runner-exec daemon /run/agenix/drone-runner-exec-config'';
};
age.secrets."drone-runner-exec-config" = {
file = "${self}/secrets/drone-runner-exec-config";
mode = "700";
owner = psCfg.user.name;
};
};
}

15
modules/core/boot.nix
View File

@ -7,12 +7,6 @@
with lib; let
cfg = config.pub-solar.core;
in {
options.pub-solar.core.iso-options.enable = mkOption {
type = types.bool;
default = false;
description = "Feature flag for iso builds";
};
options.pub-solar.core.disk-encryption-active = mkOption {
type = types.bool;
default = true;
@ -21,13 +15,10 @@ in {
config = {
boot = {
# Enable plymouth for better experience of booting
plymouth.enable = mkIf (!cfg.lite) (lib.mkDefault true);
# Mount / luks device in initrd
# Allow fstrim to work on it.
# The ! makes this enabled by default
initrd = mkIf (!cfg.iso-options.enable && cfg.disk-encryption-active) {
initrd = mkIf cfg.disk-encryption-active {
luks.devices."cryptroot" = {
allowDiscards = true;
};
@ -35,8 +26,8 @@ in {
loader.systemd-boot.enable = lib.mkDefault true;
# Use latest linux kernel by default
kernelPackages = lib.mkDefault pkgs.linuxPackages_6_5;
# Use latest LTS linux kernel by default
kernelPackages = lib.mkDefault pkgs.linuxPackages_6_1;
# Support ntfs drives
supportedFilesystems = ["ntfs"];

40
modules/core/default.nix
View File

@ -5,38 +5,34 @@
}:
with lib; let
cfg = config.pub-solar.core;
psCfg = config.pub-solar;
in {
imports = [
./boot.nix
./hibernation.nix
./fonts.nix
./i18n.nix
./networking.nix
./nix.nix
./packages.nix
./services.nix
];
options.pub-solar.core = {
lite = mkOption {
description = ''
Enable a lite edition of core with less default modules and a reduced package set.
'';
default = false;
type = types.bool;
};
# Service that makes Out of Memory Killer more effective
services.earlyoom.enable = true;
services.logind.lidSwitch = "hibernate";
services.tor.settings = {
UseBridges = true;
};
config = {
pub-solar = {
audio.enable = mkIf (!cfg.lite) (mkDefault true);
crypto.enable = mkIf (!cfg.lite) (mkDefault true);
devops.enable = mkIf (!cfg.lite) (mkDefault true);
# The options below are directly taken from or inspired by
# https://xeiaso.net/blog/paranoid-nixos-2021-07-18
terminal-life = {
enable = mkDefault true;
lite = cfg.lite;
};
};
};
# Limit the use of sudo to the group wheel
security.sudo.execWheelOnly = true;
# Remove the complete default environment of packages like
# nano, perl and rsync
environment.defaultPackages = lib.mkForce [];
# fileSystems."/".options = [ "noexec" ];
}

14
modules/core/fonts.nix
View File

@ -1,14 +0,0 @@
{
config,
pkgs,
lib,
...
}: {
fonts = {
fonts = with pkgs; [powerline-fonts dejavu_fonts];
fontconfig.defaultFonts = {
monospace = ["DejaVu Sans Mono for Powerline"];
sansSerif = ["DejaVu Sans"];
};
};
}

100
modules/core/networking.nix
View File

@ -1,89 +1,39 @@
{
flake,
config,
pkgs,
lib,
...
}:
with lib; let
cfg = config.pub-solar.core;
in {
options.pub-solar.core = {
enableCaddy = mkOption {
type = types.bool;
default = !cfg.lite;
};
enableHelp = mkOption {
type = types.bool;
default = !cfg.lite;
};
}: {
# disable NetworkManager and systemd-networkd -wait-online by default
systemd.services.NetworkManager-wait-online.enable = lib.mkDefault false;
systemd.services.systemd-networkd-wait-online.enable = lib.mkDefault false;
binaryCaches = mkOption {
type = types.listOf types.str;
default = [];
description = "Binary caches to use.";
};
publicKeys = mkOption {
type = types.listOf types.str;
default = [];
description = "Public keys of binary caches.";
};
networking.networkmanager = {
# Enable networkmanager. REMEMBER to add yourself to group in order to use nm related stuff.
enable = lib.mkDefault true;
# not as stable as wpa_supplicant yet, also more trouble with 5 GHz networks
#wifi.backend = "iwd";
};
config = {
# disable NetworkManager and systemd-networkd -wait-online by default
systemd.services.NetworkManager-wait-online.enable = lib.mkDefault false;
systemd.services.systemd-networkd-wait-online.enable = lib.mkDefault false;
networking.networkmanager = {
# Enable networkmanager. REMEMBER to add yourself to group in order to use nm related stuff.
enable = true;
# not as stable as wpa_supplicant yet, also more trouble with 5 GHz networks
#wifi.backend = "iwd";
};
networking.firewall.enable = true;
networking.firewall.enable = true;
# For rage encryption, all hosts need a ssh key pair
services.openssh = {
enable = true;
allowSFTP = lib.mkDefault false;
# Customized binary caches list (with fallback to official binary cache)
nix.settings.substituters = cfg.binaryCaches;
nix.settings.trusted-public-keys = cfg.publicKeys;
openFirewall = lib.mkDefault false;
# These entries get added to /etc/hosts
networking.hosts = {
"127.0.0.1" =
[]
++ lib.optionals cfg.enableCaddy ["caddy.local"]
++ lib.optionals config.pub-solar.printing.enable ["cups.local"]
++ lib.optionals cfg.enableHelp ["help.local"];
};
settings.PasswordAuthentication = lib.mkDefault false;
settings.KbdInteractiveAuthentication = false;
# Caddy reverse proxy for local services like cups
services.caddy = {
enable = lib.mkForce cfg.enableCaddy;
globalConfig = lib.mkForce ''
default_bind 127.0.0.1
auto_https off
'';
extraConfig = lib.mkForce (concatStringsSep "\n" [
(lib.optionalString
config.pub-solar.printing.enable
''
cups.local:80 {
request_header Host localhost:631
reverse_proxy unix//run/cups/cups.sock
}
'')
(lib.optionalString
cfg.enableHelp
''
help.local:80 {
root * ${pkgs.psos-docs}/lib/html
# Caddy builds the etag with only the file size & latest modified
# date, which is always 1970-01-01 in the Nix store
header -ETag
file_server
}
'')
]);
};
extraConfig = ''
AllowTcpForwarding yes
X11Forwarding no
AllowAgentForwarding no
AllowStreamLocalForwarding no
AuthenticationMethods publickey
'';
};
}

81
modules/core/packages.nix
View File

@ -8,72 +8,21 @@ with lib; let
psCfg = config.pub-solar;
cfg = config.pub-solar.core;
in {
environment = {
systemPackages = with pkgs;
[
# Core unix utility packages
coreutils-full
dnsutils
inetutils
progress
pciutils
usbutils
environment.systemPackages = with pkgs; [
# Core unix utility packages
coreutils-full
dnsutils
inetutils
progress
pciutils
usbutils
diffutils
findutils
exfat
wget
openssl
openssh
curl
htop
btop
lsof
psmisc
file
gitMinimal
# zippit
zip
unzip
# Modern modern utilities
p7zip
croc
jq
]
++ lib.optionals (!cfg.lite) [
mtr
gitFull
git-lfs
git-bug
xdg-utils
sysfsutils
renameutils
nfs-utils
moreutils
mailutils
keyutils
input-utils
elfutils
binutils
dateutils
diffutils
findutils
exfat
# Nix specific utilities
alejandra
niv
manix
nix-index
nix-tree
nixpkgs-review
# Build broken, python2.7-PyJWT-2.0.1.drv' failed
#nixops
psos
nvd
# Fun
neofetch
];
};
btop
mtr
];
}

18
modules/core/services.nix
View File

@ -1,18 +0,0 @@
{
config,
pkgs,
lib,
...
}: {
# For rage encryption, all hosts need a ssh key pair
services.openssh = {
enable = true;
# If you don't want the host to have SSH actually opened up to the net,
# set `services.openssh.openFirewall` to false in your config.
openFirewall = lib.mkDefault true;
settings.PasswordAuthentication = lib.mkDefault false;
};
# Service that makes Out of Memory Killer more effective
services.earlyoom.enable = true;
}

46
modules/crypto/default.nix
View File

@ -6,40 +6,28 @@
}:
with lib; let
psCfg = config.pub-solar;
cfg = config.pub-solar.crypto;
in {
options.pub-solar.crypto = {
enable = mkEnableOption "Life in private";
};
services.udev.packages = [pkgs.yubikey-personalization];
services.dbus.packages = [pkgs.gcr];
services.pcscd.enable = true;
config = mkIf cfg.enable {
services.udev.packages = [pkgs.yubikey-personalization];
services.dbus.packages = [pkgs.gcr];
services.pcscd.enable = true;
services.gnome.gnome-keyring.enable = true;
services.gnome.gnome-keyring.enable = true;
users.users."${psCfg.user.name}".packages = with pkgs; [
libsecret
];
home-manager = with pkgs;
pkgs.lib.setAttrByPath ["users" psCfg.user.name] {
systemd.user.services.polkit-gnome-authentication-agent = import ./polkit-gnome-authentication-agent.service.nix pkgs;
home-manager.users."${psCfg.user.name}" = {
systemd.user.services.polkit-gnome-authentication-agent = import ./polkit-gnome-authentication-agent.service.nix pkgs;
services.gpg-agent = {
enable = true;
pinentryFlavor = "gnome3";
verbose = true;
};
services.gpg-agent = {
enable = true;
pinentryFlavor = "gnome3";
verbose = true;
};
programs.gpg = {
enable = true;
};
home.packages = [
gnome.seahorse
keepassxc
libsecret
qMasterPassword
restic
];
};
programs.gpg = {
enable = true;
};
};
}

245
modules/ddclient/default.nix Normal file
View File

@ -0,0 +1,245 @@
{
config,
pkgs,
lib,
...
}:
let
cfg = config.services.ddclient;
boolToStr = bool: if bool then "yes" else "no";
dataDir = "/var/lib/ddclient";
StateDirectory = builtins.baseNameOf dataDir;
RuntimeDirectory = StateDirectory;
usev4 = if cfg.usev4 != "" then "usev4=${cfg.usev4}" else "";
usev6 = if cfg.usev6 != "" then "usev6=${cfg.usev6}" else "";
configFile' = pkgs.writeText "ddclient.conf" ''
# This file can be used as a template for configFile or is automatically generated by Nix options.
use=no
${usev4}
${usev6}
cache=${dataDir}/ddclient.cache
foreground=yes
login=${cfg.username}
password=${if cfg.protocol == "nsupdate" then "/run/${RuntimeDirectory}/ddclient.key" else "@password_placeholder@"}
protocol=${cfg.protocol}
${lib.optionalString (cfg.script != "") "script=${cfg.script}"}
${lib.optionalString (cfg.server != "") "server=${cfg.server}"}
${lib.optionalString (cfg.zone != "") "zone=${cfg.zone}"}
ssl=${boolToStr cfg.ssl}
wildcard=yes
quiet=${boolToStr cfg.quiet}
verbose=${boolToStr cfg.verbose}
${cfg.extraConfig}
${lib.concatStringsSep "," cfg.domains}
'';
configFile = if (cfg.configFile != null) then cfg.configFile else configFile';
preStart = ''
install --mode=600 --owner=$USER ${configFile} /run/${RuntimeDirectory}/ddclient.conf
${lib.optionalString (cfg.configFile == null) (if (cfg.protocol == "nsupdate") then ''
install --mode=600 --owner=$USER ${cfg.passwordFile} /run/${RuntimeDirectory}/ddclient.key
'' else if (cfg.passwordFile != null) then ''
"${pkgs.replace-secret}/bin/replace-secret" "@password_placeholder@" "${cfg.passwordFile}" "/run/${RuntimeDirectory}/ddclient.conf"
'' else ''
sed -i '/^password=@password_placeholder@$/d' /run/${RuntimeDirectory}/ddclient.conf
'')}
'';
in with lib; {
disabledModules = [
"services/networking/ddclient.nix"
];
imports = [
(mkChangedOptionModule [ "services" "ddclient" "domain" ] [ "services" "ddclient" "domains" ]
(config:
let value = getAttrFromPath [ "services" "ddclient" "domain" ] config;
in if value != "" then [ value ] else []))
(mkRemovedOptionModule [ "services" "ddclient" "homeDir" ] "")
(mkRemovedOptionModule [ "services" "ddclient" "password" ] "Use services.ddclient.passwordFile instead.")
];
###### interface
options = {
services.ddclient = with lib.types; {
enable = mkOption {
default = false;
type = bool;
description = lib.mdDoc ''
Whether to synchronise your machine's IP address with a dynamic DNS provider (e.g. dyndns.org).
'';
};
package = mkOption {
type = package;
default = pkgs.ddclient;
defaultText = lib.literalExpression "pkgs.ddclient";
description = lib.mdDoc ''
The ddclient executable package run by the service.
'';
};
domains = mkOption {
default = [ "" ];
type = listOf str;
description = lib.mdDoc ''
Domain name(s) to synchronize.
'';
};
username = mkOption {
# For `nsupdate` username contains the path to the nsupdate executable
default = lib.optionalString (config.services.ddclient.protocol == "nsupdate") "${pkgs.bind.dnsutils}/bin/nsupdate";
defaultText = "";
type = str;
description = lib.mdDoc ''
User name.
'';
};
passwordFile = mkOption {
default = null;
type = nullOr str;
description = lib.mdDoc ''
A file containing the password or a TSIG key in named format when using the nsupdate protocol.
'';
};
interval = mkOption {
default = "10min";
type = str;
description = lib.mdDoc ''
The interval at which to run the check and update.
See {command}`man 7 systemd.time` for the format.
'';
};
configFile = mkOption {
default = null;
type = nullOr path;
description = lib.mdDoc ''
Path to configuration file.
When set this overrides the generated configuration from module options.
'';
example = "/root/nixos/secrets/ddclient.conf";
};
protocol = mkOption {
default = "dyndns2";
type = str;
description = lib.mdDoc ''
Protocol to use with dynamic DNS provider (see https://sourceforge.net/p/ddclient/wiki/protocols).
'';
};
server = mkOption {
default = "";
type = str;
description = lib.mdDoc ''
Server address.
'';
};
ssl = mkOption {
default = true;
type = bool;
description = lib.mdDoc ''
Whether to use SSL/TLS to connect to dynamic DNS provider.
'';
};
quiet = mkOption {
default = false;
type = bool;
description = lib.mdDoc ''
Print no messages for unnecessary updates.
'';
};
script = mkOption {
default = "";
type = str;
description = lib.mdDoc ''
script as required by some providers.
'';
};
usev4 = mkOption {
default = "webv4, webv4=checkip.dyndns.com/, webv4-skip='Current IP Address: '";
type = str;
description = lib.mdDoc ''
Method to determine the IP address to send to the dynamic DNS provider.
'';
};
usev6 = mkOption {
default = "";
type = str;
description = lib.mdDoc ''
Method to determine the IP address to send to the dynamic DNS provider.
'';
};
verbose = mkOption {
default = false;
type = bool;
description = lib.mdDoc ''
Print verbose information.
'';
};
zone = mkOption {
default = "";
type = str;
description = lib.mdDoc ''
zone as required by some providers.
'';
};
extraConfig = mkOption {
default = "";
type = lines;
description = lib.mdDoc ''
Extra configuration. Contents will be added verbatim to the configuration file.
::: {.note}
`daemon` should not be added here because it does not work great with the systemd-timer approach the service uses.
:::
'';
};
};
};
###### implementation
config = mkIf config.services.ddclient.enable {
systemd.services.ddclient = {
description = "Dynamic DNS Client";
wantedBy = [ "multi-user.target" ];
after = [ "network.target" ];
restartTriggers = optional (cfg.configFile != null) cfg.configFile;
serviceConfig = {
DynamicUser = true;
RuntimeDirectoryMode = "0700";
inherit RuntimeDirectory;
inherit StateDirectory;
Type = "oneshot";
ExecStartPre = "!${pkgs.writeShellScript "ddclient-prestart" preStart}";
ExecStart = "${lib.getBin cfg.package}/bin/ddclient -file /run/${RuntimeDirectory}/ddclient.conf";
};
};
systemd.timers.ddclient = {
description = "Run ddclient";
wantedBy = [ "timers.target" ];
timerConfig = {
OnBootSec = cfg.interval;
OnUnitInactiveSec = cfg.interval;
};
};
};
}

42
modules/default.nix Normal file
View File

@ -0,0 +1,42 @@
{
self,
inputs,
...
}: {
flake = {
nixosModules = rec {
audio = import ./audio;
bluetooth = import ./bluetooth;
core = import ./core;
crypto = import ./crypto;
desktop-extended = import ./desktop-extended;
docker = import ./docker;
#email = import ./email;
#gaming = import ./gaming;
graphical = import ./graphical;
#invoiceplane = import ./invoiceplane;
nix = import ./nix;
nextcloud = import ./nextcloud;
office = import ./office;
printing = import ./printing;
terminal-life = import ./terminal-life;
user = import ./user;
virtualisation = import ./virtualisation;
#wireguard-client = import ./wireguard-client;
base.imports = [
self.nixosModules.home-manager
inputs.agenix.nixosModules.default
self.nixosModules.overlays
self.nixosModules.core
self.nixosModules.crypto
self.nixosModules.nix
self.nixosModules.terminal-life
self.nixosModules.root
self.nixosModules.user
];
};
};
}

48
modules/desktop-extended/default.nix Normal file
View File

@ -0,0 +1,48 @@
{
lib,
config,
pkgs,
...
}:
with lib; let
psCfg = config.pub-solar;
in {
users.users."${psCfg.user.name}".packages = with pkgs; [
ungoogled-chromium
wine
gimp
inkscape
tigervnc
nodejs
signal-desktop
tdesktop
element-desktop
# Nix specific utilities
alejandra
manix
nix-index
nix-output-monitor
nix-tree
nvd
];
fonts = {
fonts = with pkgs; [
dejavu_fonts
fira-code
fira-code-symbols
google-fonts
lato
montserrat
nerdfonts
noto-fonts
noto-fonts-cjk
open-sans
powerline-fonts
source-sans-pro
];
};
}

34
modules/devops/default.nix
View File

@ -1,34 +0,0 @@
{
lib,
config,
pkgs,
...
}:
with lib; let
psCfg = config.pub-solar;
cfg = config.pub-solar.devops;
in {
options.pub-solar.devops = {
enable = mkEnableOption "Life automated";
};
config = mkIf cfg.enable {
home-manager = with pkgs;
pkgs.lib.setAttrByPath ["users" psCfg.user.name] {
home.packages = [
fwknop
croc
drone-cli
nmap
pgcli
ansible
ansible-lint
restic
shellcheck
terraform
flyctl
tea
];
};
};
}

114
modules/docker-ci-runner/default.nix
View File

@ -1,114 +0,0 @@
{
lib,
config,
pkgs,
self,
...
}:
with lib; let
bootstrap = pkgs.writeScript "bootstrap.sh" ''
#!/usr/bin/env bash
set -e
apt update
apt install --yes curl git sudo xz-utils
adduser --system --uid 999 build
chown build /nix
sudo -u build curl -L https://nixos.org/nix/install > install
sudo -u build sh install
echo "export PATH=/nix/var/nix/profiles/per-user/build/profile/bin:''$PATH" >> /etc/profile
mkdir /etc/nix
echo 'experimental-features = nix-command flakes' >> /etc/nix/nix.conf
export nix_user_config_file="/home/build/.local/share/nix/trusted-settings.json"
mkdir -p $(dirname \\$nix_user_config_file)
echo '{"extra-experimental-features":{"nix-command flakes":true}}' > \\$nix_user_config_file
chown -R build /home/build/
curl -L https://github.com/drone-runners/drone-runner-exec/releases/latest/download/drone_runner_exec_linux_amd64.tar.gz | tar xz
sudo install -t /usr/local/bin drone-runner-exec
if [ ! -f /run/vars ]; then
exit 1
fi
cp -a /run/vars /run/runtime-vars
env | grep "DRONE" >> /run/runtime-vars
su - -s /bin/bash build sh -c "/usr/local/bin/drone-runner-exec daemon /run/runtime-vars"
'';
psCfg = config.pub-solar;
cfg = config.pub-solar.docker-ci-runner;
in {
options.pub-solar.docker-ci-runner = {
enable = lib.mkEnableOption "Enables a docker container running a drone exec runner as unprivileged user.";
enableKvm = lib.mkOption {
description = ''
Enable kvm support.
'';
default = true;
type = types.bool;
};
nixCacheLocation = lib.mkOption {
description = ''
Location of nix cache that is shared between builds
'';
default = "/var/lib/docker-ci-runner";
type = types.path;
};
runnerEnvironment = lib.mkOption {
description = ''
Additional environment vars added to the vars file on container runtime
'';
default = {};
};
runnerVarsFile = lib.mkOption {
description = ''
Location of vars file passed to drone runner
'';
type = types.path;
};
};
config = lib.mkIf cfg.enable {
virtualisation = {
docker = {
enable = true; # sadly podman is not supported rightnow
};
oci-containers = {
backend = "docker";
containers."drone-exec-runner" = {
image = "debian";
autoStart = true;
entrypoint = "bash";
cmd = ["/bootstrap.sh"];
volumes = [
"${cfg.runnerVarsFile}:/run/vars"
"${cfg.nixCacheLocation}:/nix"
"${bootstrap}:/bootstrap.sh"
];
environment = cfg.runnerEnvironment;
extraOptions = lib.mkIf cfg.enableKvm ["--device=/dev/kvm"];
};
};
};
# Fix container not stopping correctly and holding the system 120s upon
# shutdown / reboot
systemd.services.docker-drone-exec-runner.preStop = ''
docker stop drone-exec-runner
'';
};
}

23
modules/docker/default.nix
View File

@ -6,22 +6,15 @@
}:
with lib; let
psCfg = config.pub-solar;
cfg = config.pub-solar.docker;
in {
options.pub-solar.docker = {
enable = mkEnableOption "Life in metal boxes";
virtualisation.docker.enable = true;
virtualisation.docker.package = pkgs.docker_24;
users.users."${psCfg.user.name}" = {
extraGroups = ["docker"];
};
config = mkIf cfg.enable {
virtualisation.docker.enable = true;
virtualisation.docker.package = pkgs.docker_24;
users.users = with pkgs;
pkgs.lib.setAttrByPath [psCfg.user.name] {
extraGroups = ["docker"];
};
environment.systemPackages = with pkgs; [
docker-compose
];
};
environment.systemPackages = with pkgs; [
docker-compose
];
}

61
modules/email/default.nix
View File

@ -6,28 +6,49 @@
}:
with lib; let
psCfg = config.pub-solar;
cfg = config.pub-solar.email;
in {
options.pub-solar.email = {
enable = mkEnableOption "Life in headers";
};
users.users."${psCfg.user.name}".packages = with pkgs; [
w3m
urlscan
neomutt
offlineimap
msmtp
mailto-mutt
];
config = mkIf cfg.enable {
home-manager = with pkgs;
pkgs.lib.setAttrByPath ["users" psCfg.user.name] {
home.packages = [
w3m
urlscan
neomutt
offlineimap
msmtp
mailto-mutt
];
home-manager.users."${psCfg.user.name}" = {
programs.offlineimap = {
enable = true;
pythonFile = builtins.readFile ./offlineimap.py;
};
programs.offlineimap = {
enable = true;
pythonFile = builtins.readFile ./offlineimap.py;
};
};
xdg.configFile."mutt/muttrc".source = ./.config/mutt/muttrc;
xdg.configFile."mutt/base16.muttrc".source = ./.config/mutt/base16.muttrc;
xdg.configFile."mutt/mailcap".source = ./.config/mutt/mailcap;
xdg.configFile."offlineimap/functions.py".source = ./.config/offlineimap/functions.py;
xdg.configFile."mutt/accounts.muttrc".text = ''
source ./hello@benjaminbaedorf.eu.muttrc
macro index <f1> '<sync-mailbox><enter-command>source $XDG_CONFIG_HOME/mutt/hello@benjaminbaedorf.eu.muttrc<enter><change-folder>!<enter>'
macro index <f2> '<sync-mailbox><enter-command>source $XDG_CONFIG_HOME/mutt/benjamin.baedorf@rwth-aachen.de.muttrc<enter><change-folder>!<enter>'
macro index <f3> '<sync-mailbox><enter-command>source $XDG_CONFIG_HOME/mutt/byb@miom.space.muttrc<enter><change-folder>!<enter>'
macro index <f4> '<sync-mailbox><enter-command>source $XDG_CONFIG_HOME/mutt/mail@b12f.io.muttrc<enter><change-folder>!<enter>'
macro index <f5> '<sync-mailbox><enter-command>source $XDG_CONFIG_HOME/mutt/admins@pub.solar.muttrc<enter><change-folder>!<enter>'
macro index <f6> '<sync-mailbox><enter-command>source $XDG_CONFIG_HOME/mutt/crew@pub.solar.muttrc<enter><change-folder>!<enter>'
'';
xdg.configFile."mutt/hello@benjaminbaedorf.eu.muttrc".source = ./.config/mutt + "/hello@benjaminbaedorf.eu.muttrc";
xdg.configFile."mutt/benjamin.baedorf@rwth-aachen.de.muttrc".source = ./.config/mutt + "/benjamin.baedorf@rwth-aachen.de.muttrc";
xdg.configFile."mutt/hello@benjaminbaedorf.eu.signature".source = ./.config/mutt + "/hello@benjaminbaedorf.eu.signature";
xdg.configFile."mutt/byb@miom.space.muttrc".source = ./.config/mutt + "/byb@miom.space.muttrc";
xdg.configFile."mutt/byb@miom.space.signature".source = ./.config/mutt + "/byb@miom.space.signature";
xdg.configFile."mutt/mail@b12f.io.muttrc".source = ./.config/mutt + "/mail@b12f.io.muttrc";
xdg.configFile."mutt/mail@b12f.io.signature".source = ./.config/mutt + "/mail@b12f.io.signature";
xdg.configFile."mutt/admins@pub.solar.muttrc".source = ./.config/mutt + "/admins@pub.solar.muttrc";
xdg.configFile."mutt/admins@pub.solar.signature".source = ./.config/mutt + "/admins@pub.solar.signature";
xdg.configFile."mutt/crew@pub.solar.muttrc".source = ./.config/mutt + "/crew@pub.solar.muttrc";
xdg.configFile."mutt/crew@pub.solar.signature".source = ./.config/mutt + "/crew@pub.solar.signature";
xdg.configFile."offlineimap/config".source = ./.config/offlineimap/config;
xdg.configFile."msmtp/config".source = ./.config/msmtp/config;
};
}

28
modules/gaming/default.nix
View File

@ -6,26 +6,16 @@
}:
with lib; let
psCfg = config.pub-solar;
cfg = config.pub-solar.gaming;
in {
options.pub-solar.gaming = {
enable = mkEnableOption "Life in shooters";
programs.steam.enable = true;
nixpkgs.config.packageOverrides = pkgs: {
steam = pkgs.steam.override {};
};
config = mkIf cfg.enable {
programs.steam.enable = true;
nixpkgs.config.packageOverrides = pkgs: {
steam = pkgs.steam.override {};
};
home-manager = with pkgs;
pkgs.lib.setAttrByPath ["users" psCfg.user.name] {
home.packages = [
playonlinux
godot
obs-studio
obs-studio-plugins.wlrobs
];
};
};
users.users."${psCfg.user.name}".packages = with pkgs; [
playonlinux
godot
obs-studio
obs-studio-plugins.wlrobs
];
}

0
profiles/base-user/.config/libinput-gestures.conf → modules/graphical/.config/libinput-gestures.conf
View File

0
profiles/base-user/.config/mako/config → modules/graphical/.config/mako/config
View File

0
profiles/base-user/.config/swaync/config.json → modules/graphical/.config/swaync/config.json
View File

0
profiles/base-user/.config/swaync/style.css → modules/graphical/.config/swaync/style.css
View File

0
profiles/base-user/.config/user-dirs.dirs → modules/graphical/.config/user-dirs.dirs
View File

0
profiles/base-user/.config/user-dirs.locale → modules/graphical/.config/user-dirs.locale
View File

0
profiles/base-user/.config/waybar/colorscheme.css → modules/graphical/.config/waybar/colorscheme.css
View File

0
profiles/base-user/.config/waybar/config → modules/graphical/.config/waybar/config
View File

0
profiles/base-user/.config/waybar/style.css → modules/graphical/.config/waybar/style.css
View File

0
profiles/base-user/.config/xmodmap → modules/graphical/.config/xmodmap
View File

0
profiles/base-user/.config/xsettingsd/xsettingsd.conf → modules/graphical/.config/xsettingsd/xsettingsd.conf
View File

0
profiles/base-user/.xinitrc → modules/graphical/.xinitrc
View File

12
modules/graphical/alacritty.nix
View File

@ -55,7 +55,7 @@
style = "Italic";
};
size = 16.0;
size = 12.0;
offset = {
x = 0;
@ -69,6 +69,16 @@
};
key_bindings = [
{
key = "V";
mods = "Control|Super";
action = "Paste";
}
{
key = "C";
mods = "Control|Super";
action = "Copy";
}
{
key = "V";
mods = "Control|Alt";

0
profiles/base-user/assets/pub-solar.jpg → modules/graphical/assets/pub-solar.jpg
View File

Side by Side Swipe Overlay

Before

Width:  |  Height:  |  Size: 513 KiB

After

Width:  |  Height:  |  Size: 513 KiB

0
profiles/base-user/assets/wallpaper.jpg → modules/graphical/assets/wallpaper.jpg
View File

Side by Side Swipe Overlay

Before

Width:  |  Height:  |  Size: 168 KiB

After

Width:  |  Height:  |  Size: 168 KiB

186
modules/graphical/default.nix
View File

@ -6,36 +6,22 @@
}:
with lib; let
psCfg = config.pub-solar;
cfg = config.pub-solar.graphical;
yamlFormat = pkgs.formats.yaml {};
recursiveMerge = attrList: let
f = attrPath:
zipAttrsWith (
n: values:
if tail values == []
then head values
else if all isList values
then unique (concatLists values)
else if all isAttrs values
then f (attrPath ++ [n]) values
else last values
);
in
f [] attrList;
sessionVariables = {
WLR_RENDERER =
if psCfg.graphical.wayland.software-renderer.enable
then "pixman"
else "gles2";
# Fix KeepassXC rendering issue
# https://github.com/void-linux/void-packages/issues/23517
QT_AUTO_SCREEN_SCALE_FACTOR = "0";
};
in {
imports = [
./sway
];
options.pub-solar.graphical = {
enable = mkEnableOption "Life in color";
alacritty = {
settings = mkOption {
type = yamlFormat.type;
default = {};
};
};
autologin.enable = mkOption {
type = types.bool;
default = true;
description = "Feature flag enabling autologin after boot.";
};
wayland.software-renderer.enable = mkOption {
type = types.bool;
default = false;
@ -43,8 +29,9 @@ in {
};
};
config = mkIf cfg.enable {
config = {
hardware.opengl.enable = true;
environment = {
systemPackages = with pkgs; [
gtk-engine-murrine
@ -55,16 +42,20 @@ in {
papirus-maia-icon-theme
glib
xdg-utils
];
etc = {
"xdg/PubSolar.conf".text = ''
[Qt]
style=GTK+
'';
};
variables = sessionVariables;
};
services.getty.autologinUser = mkIf cfg.autologin.enable (mkForce "${psCfg.user.name}");
services.getty.autologinUser = psCfg.user.name;
qt = {
enable = true;
@ -72,8 +63,6 @@ in {
style = "gtk2";
};
gtk.iconCache.enable = true;
# Required for running Gnome apps outside the Gnome DE, see https://nixos.wiki/wiki/GNOME#Running_GNOME_programs_outside_of_GNOME
programs.dconf.enable = true;
services.udev.packages = with pkgs; [gnome3.gnome-settings-daemon];
@ -81,81 +70,80 @@ in {
services.gnome.sushi.enable = true;
# Enable GVfs, a userspace virtual filesystem
services.gvfs.enable = true;
services.yubikey-agent.enable = true;
fonts.enableDefaultFonts = true;
fonts.fonts = with pkgs; [
fira-code
fira-code-symbols
google-fonts
lato
montserrat
nerdfonts
noto-fonts
noto-fonts-cjk
open-sans
powerline-fonts
source-sans-pro
fonts = {
fonts = with pkgs; [
dejavu_fonts
powerline-fonts
];
enableDefaultFonts = true;
fontconfig.enable = true;
fontconfig.defaultFonts = {
monospace = ["DejaVu Sans Mono for Powerline"];
sansSerif = ["DejaVu Sans"];
};
};
users.users."${psCfg.user.name}".packages = with pkgs; [
alacritty
firefox-wayland
flameshot
gnome.adwaita-icon-theme
gnome.eog
gnome.nautilus
gnome.seahorse
gnome.yelp
hicolor-icon-theme
keepassxc
qMasterPassword
libnotify
vlc
];
home-manager = with pkgs;
setAttrByPath ["users" psCfg.user.name] {
home.packages = [
alacritty
foot
ungoogled-chromium
firefox-wayland
home-manager.users."${psCfg.user.name}" = {
home.file."xinitrc".source = ./.xinitrc;
xdg.configFile."alacritty/alacritty.yml".source = yamlFormat.generate "alacritty.yml" (import ./alacritty.nix);
xdg.configFile."xmodmap".source = ./.config/xmodmap;
xdg.configFile."user-dirs.dirs".source = ./.config/user-dirs.dirs;
xdg.configFile."user-dirs.locale".source = ./.config/user-dirs.locale;
xdg.configFile."xsettingsd/xsettingsd.conf".source = ./.config/xsettingsd/xsettingsd.conf;
xdg.configFile."mako/config".source = ./.config/mako/config;
xdg.configFile."libinput-gestures.conf".source = ./.config/libinput-gestures.conf;
xdg.configFile."swaync/config.json".source = ./.config/swaync/config.json;
xdg.configFile."swaync/style.css".source = ./.config/swaync/style.css;
xdg.configFile."waybar/config".source = ./.config/waybar/config;
xdg.configFile."waybar/style.css".source = ./.config/waybar/style.css;
xdg.configFile."waybar/colorscheme.css".source = ./.config/waybar/colorscheme.css;
xdg.configFile."wallpaper.jpg".source = ./assets/wallpaper.jpg;
flameshot
libnotify
gnome.adwaita-icon-theme
gnome.eog
gnome.nautilus
gnome.yelp
hicolor-icon-theme
wine
toggle-kbd-layout
wcwd
vlc
gimp
];
xdg.configFile."alacritty/alacritty.yml" = {
source = yamlFormat.generate "alacritty.yml" (recursiveMerge [(import ./alacritty.nix) cfg.alacritty.settings]);
gtk = {
enable = true;
font.name = "Lato";
iconTheme = {
package = pkgs.papirus-icon-theme;
name = "Papirus-Adapta-Nokto-Maia";
};
theme = {
package = pkgs.matcha-gtk-theme;
name = "Matcha-dark-aliz";
};
gtk = {
enable = true;
font.name = "Lato";
iconTheme = {
package = pkgs.papirus-icon-theme;
name = "Papirus-Adapta-Nokto-Maia";
};
theme = {
package = pkgs.matcha-gtk-theme;
name = "Matcha-dark-aliz";
};
gtk3.extraConfig = {
gtk-xft-antialias = "1";
gtk-xft-hinting = "1";
gtk-xft-hintstyle = "hintfull";
gtk-xft-rgba = "rgb";
gtk-application-prefer-dark-theme = "true";
};
gtk3.extraConfig = {
gtk-xft-antialias = "1";
gtk-xft-hinting = "1";
gtk-xft-hintstyle = "hintfull";
gtk-xft-rgba = "rgb";
gtk-application-prefer-dark-theme = "true";
};
# Fix KeepassXC rendering issue
# https://github.com/void-linux/void-packages/issues/23517
systemd.user.sessionVariables.QT_AUTO_SCREEN_SCALE_FACTOR = "0";
xresources.extraConfig = builtins.readFile ./.Xdefaults;
systemd.user.services.network-manager-applet = import ./network-manager-applet.service.nix pkgs;
};
xresources.extraConfig = builtins.readFile ./.Xdefaults;
systemd.user.services.network-manager-applet = import ./network-manager-applet.service.nix pkgs;
home.sessionVariables = sessionVariables;
systemd.user.sessionVariables = sessionVariables;
};
};
}

1
modules/sway/config/config.d/applications.conf → modules/graphical/sway/config/config.d/applications.conf
View File

@ -49,6 +49,7 @@ for_window [class="(?i)virtualbox"] floating enable border normal
for_window [class="Xfburn"] floating enable
for_window [class="^VirtualBox Machine$" title="Running"] floating disable
for_window [class="^rdesktop" title="rdesktop"] floating disable
for_window [app_id="signal"] floating enabled
# firefox floating menus
for_window [window_role="pop-up"] floating enable

0
modules/sway/config/config.d/colorscheme.conf → modules/graphical/sway/config/config.d/colorscheme.conf
View File

10
modules/sway/config/config.d/custom-keybindings.conf → modules/graphical/sway/config/config.d/custom-keybindings.conf
View File

@ -19,7 +19,7 @@ bindsym $mod+Shift+h exec psos help
bindsym $mod+F2 exec firefox
bindsym $mod+F4 exec nautilus -w
bindsym $mod+Shift+F4 exec signal-desktop --use-tray-icon
bindsym $mod+Shift+F4 exec signal-desktop --use-tray-icon --enable-features=WebRTCPipeWireCapturer
# Notifications with swaynotificationcenter
# Toggle control center
@ -37,3 +37,11 @@ bindsym $mod+Ctrl+r exec record-screen
# Launcher
set $menu exec alacritty --class launcher -e env TERMINAL_COMMAND="alacritty -e" sway-launcher
bindsym $mod+Space exec $menu
set $mode_vncclient In VNCClient mode. Press $mod+Num_Lock or $mod+Shift+Escape to return.
bindsym $mod+Num_Lock mode "$mode_vncclient"
bindsym $mod+Shift+Escape mode "$mode_vncclient"
mode "$mode_vncclient" {
bindsym $mod+Num_Lock mode "default"
bindsym $mod+Shift+Escape mode "default"
}

0
modules/sway/config/config.d/gaps.conf → modules/graphical/sway/config/config.d/gaps.conf
View File

29
modules/sway/config/config.d/mode_system.conf.nix → modules/graphical/sway/config/config.d/mode_system.conf.nix
View File

@ -7,22 +7,19 @@
# Set shut down, restart and locking features
''
+ (
if psCfg.core.hibernation.enable && !psCfg.paranoia.enable
if psCfg.core.hibernation.enable
then ''
set $mode_system (e)xit, (h)ibernate, (l)ock, (s)uspend, (r)eboot, (Shift+s)hutdown
''
else if psCfg.paranoia.enable
then ''
set $mode_system (e)xit, (h)ibernate, (r)eboot, (Shift+s)hutdown
''
else ''
set $mode_system (e)xit, (l)ock, (s)uspend, (r)eboot, (Shift+s)hutdown
''
)
+ ''
bindsym $mod+0 mode "$mode_system"
mode "$mode_system" {
bindsym e exec swaymsg exit, mode "default"
bindsym e exec swaymsg exit, mode "default"
''
+ (
if psCfg.core.hibernation.enable
@ -31,20 +28,14 @@
''
else ""
)
+ (
if !psCfg.paranoia.enable
then ''
+ ''
bindsym l exec ${pkgs.swaylock-bg}/bin/swaylock-bg, mode "default"
bindsym s exec systemctl suspend, mode "default"
''
else ""
)
+ ''
bindsym r exec systemctl reboot, mode "default"
bindsym Shift+s exec systemctl poweroff, mode "default"
bindsym r exec systemctl reboot, mode "default"
bindsym Shift+s exec systemctl poweroff, mode "default"
# exit system mode: "Enter" or "Escape"
bindsym Return mode "default"
bindsym Escape mode "default"
}
# exit system mode: "Enter" or "Escape"
bindsym Return mode "default"
bindsym Escape mode "default"
}
''

0
modules/sway/config/config.d/systemd.conf → modules/graphical/sway/config/config.d/systemd.conf
View File

0
modules/sway/config/config.d/theme.conf → modules/graphical/sway/config/config.d/theme.conf
View File

2
modules/sway/config/config.nix → modules/graphical/sway/config/config.nix
View File

@ -19,7 +19,7 @@
set $up i
set $right l
# Your preferred terminal emulator
set $term ${config.pub-solar.sway.terminal}
set $term ${pkgs.alacritty}/bin/alacritty
# Your preferred application launcher
# Note: pass the final command to swaymsg so that the resulting window can be opened
# on the original workspace that the command was run on.

11
modules/graphical/sway/config/wayvnc/config.nix Normal file
View File

@ -0,0 +1,11 @@
{
psCfg,
pkgs,
}: "
address=0.0.0.0
enable_auth=true
username=${psCfg.user.name}
password=testtest
private_key_file=/run/agenix/vnc-key.pem
certificate_file=/run/agenix/vnc-cert.pem
"

100
modules/graphical/sway/default.nix Normal file
View File

@ -0,0 +1,100 @@
{
lib,
config,
pkgs,
...
}:
with lib; let
psCfg = config.pub-solar;
in {
options.pub-solar.graphical = {
v4l2loopback.enable = mkOption {
type = types.bool;
default = false;
description = "WebCam streaming tool";
};
};
config = {
boot = mkIf psCfg.graphical.v4l2loopback.enable {
extraModulePackages = with config.boot.kernelPackages; [v4l2loopback];
kernelModules = ["v4l2loopback"];
extraModprobeConfig = ''
options v4l2loopback exclusive_caps=1 devices=3
'';
};
environment.systemPackages = with pkgs; mkIf psCfg.graphical.v4l2loopback.enable [
linuxPackages.v4l2loopback
];
programs.sway.enable = true;
xdg.portal = {
enable = true;
wlr = {
enable = true;
settings = {
screencast = {
max_fps = 30;
chooser_type = "simple";
chooser_cmd = "${pkgs.slurp}/bin/slurp -f %o -or";
};
};
};
extraPortals = with pkgs; [xdg-desktop-portal-gtk];
};
services.pipewire.enable = true;
users.users."${psCfg.user.name}".packages = with pkgs; [
sway
grim
kanshi
slurp
swaybg
swayidle
swaynotificationcenter
xwayland
libappindicator-gtk3
wl-clipboard
wf-recorder
brightnessctl
gammastep
geoclue2
xsettingsd
ydotool
sway-launcher
record-screen
import-gtk-settings
# Unused on teutat3s hosts, see custom-keybindings.conf
#toggle-kbd-layout
s
wcwd
];
home-manager.users."${psCfg.user.name}" = {
programs.waybar.enable = true;
#programs.waybar.systemd.enable = true;
systemd.user.services.swaynotificationcenter = import ./swaynotificationcenter.service.nix pkgs;
systemd.user.services.sway = import ./sway.service.nix {inherit pkgs psCfg;};
systemd.user.services.swayidle = import ./swayidle.service.nix {inherit pkgs psCfg;};
systemd.user.services.xsettingsd = import ./xsettingsd.service.nix {inherit pkgs psCfg;};
systemd.user.services.waybar = import ./waybar.service.nix {inherit pkgs psCfg;};
systemd.user.targets.sway-session = import ./sway-session.target.nix {inherit pkgs psCfg;};
xdg.configFile."sway/config".text = import ./config/config.nix {inherit config pkgs;};
xdg.configFile."sway/config.d/colorscheme.conf".source = ./config/config.d/colorscheme.conf;
xdg.configFile."sway/config.d/theme.conf".source = ./config/config.d/theme.conf;
xdg.configFile."sway/config.d/gaps.conf".source = ./config/config.d/gaps.conf;
xdg.configFile."sway/config.d/custom-keybindings.conf".source = ./config/config.d/custom-keybindings.conf;
xdg.configFile."sway/config.d/mode_system.conf".text = import ./config/config.d/mode_system.conf.nix {inherit pkgs psCfg;};
xdg.configFile."sway/config.d/applications.conf".source = ./config/config.d/applications.conf;
xdg.configFile."sway/config.d/systemd.conf".source = ./config/config.d/systemd.conf;
};
};
}

0
modules/sway/gammastep.service.nix → modules/graphical/sway/gammastep.service.nix
View File

0
modules/sway/libinput-gestures.service.nix → modules/graphical/sway/libinput-gestures.service.nix
View File

18
modules/graphical/sway/mako.service.nix Normal file
View File

@ -0,0 +1,18 @@
{pkgs, ...}: {
Unit = {
Description = "Lightweight Wayland notification daemon";
Documentation = ["man:mako(1)"];
BindsTo = ["sway-session.target"];
After = ["sway-session.target"];
ConditionEnvironment = ["WAYLAND_DISPLAY"];
};
Service = {
Type = "dbus";
BusName = "org.freedesktop.Notifications";
ExecStart = "${pkgs.mako}/bin/mako";
ExecReload = "${pkgs.mako}/bin/makoctl reload";
};
Install = {
WantedBy = ["sway-session.target"];
};
}

0
modules/sway/sway-session.target.nix → modules/graphical/sway/sway-session.target.nix
View File

0
modules/sway/sway.service.nix → modules/graphical/sway/sway.service.nix
View File

27
modules/graphical/sway/swayidle.service.nix Normal file
View File

@ -0,0 +1,27 @@
{
pkgs,
psCfg,
...
}: {
Unit = {
Description = "Idle manager for Wayland";
Documentation = ["man:swayidle(1)"];
BindsTo = ["graphical-session.target"];
Wants = ["graphical-session-pre.target"];
After = ["graphical-session-pre.target"];
};
Service = {
Type = "simple";
Environment = "PATH=/run/current-system/sw/bin:${pkgs.sway}/bin:${pkgs.swaylock-bg}/bin:${pkgs.swayidle}/bin";
ExecStart = ''
swayidle -w \
after-resume 'swaymsg "output * dpms on"' \
before-sleep 'swaylock-bg' \
timeout 300 'swaylock-bg' \
timeout 600 'swaymsg "output * dpms off"' resume 'swaymsg "output * dpms on"'
'';
};
Install = {
WantedBy = ["sway-session.target"];
};
}

0
modules/sway/swaynotificationcenter.service.nix → modules/graphical/sway/swaynotificationcenter.service.nix
View File

2
modules/sway/waybar.service.nix → modules/graphical/sway/waybar.service.nix
View File

@ -10,7 +10,7 @@
Service = {
Type = "dbus";
Environment = "PATH=${pkgs.bash}/bin:${pkgs.pavucontrol}/bin:${pkgs.swaynotificationcenter}/bin";
Environment = "PATH=${pkgs.bash}/bin:${pkgs.pavucontrol}/bin";
BusName = "fr.arouillard.waybar";
ExecStart = "${pkgs.waybar}/bin/waybar";
};

0
modules/sway/xsettingsd.service.nix → modules/graphical/sway/xsettingsd.service.nix
View File

0
modules/sway/ydotool.service.nix → modules/graphical/sway/ydotool.service.nix
View File

362
modules/invoiceplane/default.nix Normal file
View File

@ -0,0 +1,362 @@
{ config, pkgs, lib, ... }:
with lib;
let
cfg = config.services.invoiceplane;
eachSite = cfg.sites;
user = "invoiceplane";
webserver = config.services.${cfg.webserver};
invoiceplane-config = hostName: cfg: pkgs.writeText "ipconfig.php" ''
IP_URL=http://${hostName}
ENABLE_DEBUG=false
DISABLE_SETUP=false
REMOVE_INDEXPHP=false
DB_HOSTNAME=${cfg.database.host}
DB_USERNAME=${cfg.database.user}
# NOTE: file_get_contents adds newline at the end of returned string
DB_PASSWORD=${if cfg.database.passwordFile == null then "" else "trim(file_get_contents('${cfg.database.passwordFile}'),\"\\r\\n\")"}
DB_DATABASE=${cfg.database.name}
DB_PORT=${toString cfg.database.port}
SESS_EXPIRATION=864000
ENABLE_INVOICE_DELETION=false
DISABLE_READ_ONLY=false
ENCRYPTION_KEY=
ENCRYPTION_CIPHER=AES-256
SETUP_COMPLETED=false
REMOVE_INDEXPHP=true
'';
extraConfig = hostName: cfg: pkgs.writeText "extraConfig.php" ''
${toString cfg.extraConfig}
'';
pkg = hostName: cfg: pkgs.stdenv.mkDerivation rec {
pname = "invoiceplane-${hostName}";
version = src.version;
src = pkgs.invoiceplane;
postPhase = ''
# Patch index.php file to load additional config file
substituteInPlace index.php \
--replace "require('vendor/autoload.php');" "require('vendor/autoload.php'); \$dotenv = Dotenv\Dotenv::createImmutable(__DIR__, 'extraConfig.php'); \$dotenv->load();";
'';
installPhase = ''
mkdir -p $out
cp -r * $out/
# symlink uploads and log directories
rm -r $out/uploads $out/application/logs $out/vendor/mpdf/mpdf/tmp
ln -sf ${cfg.stateDir}/uploads $out/
ln -sf ${cfg.stateDir}/logs $out/application/
ln -sf ${cfg.stateDir}/tmp $out/vendor/mpdf/mpdf/
# symlink the InvoicePlane config
ln -s ${cfg.stateDir}/ipconfig.php $out/ipconfig.php
# symlink the extraConfig file
ln -s ${extraConfig hostName cfg} $out/extraConfig.php
# symlink additional templates
${concatMapStringsSep "\n" (template: "cp -r ${template}/. $out/application/views/invoice_templates/pdf/") cfg.invoiceTemplates}
'';
};
siteOpts = { lib, name, ... }:
{
options = {
enable = mkEnableOption (lib.mdDoc "InvoicePlane web application");
stateDir = mkOption {
type = types.path;
default = "/var/lib/invoiceplane/${name}";
description = lib.mdDoc ''
This directory is used for uploads of attachments and cache.
The directory passed here is automatically created and permissions
adjusted as required.
'';
};
database = {
host = mkOption {
type = types.str;
default = "localhost";
description = lib.mdDoc "Database host address.";
};
port = mkOption {
type = types.port;
default = 3306;
description = lib.mdDoc "Database host port.";
};
name = mkOption {
type = types.str;
default = "invoiceplane";
description = lib.mdDoc "Database name.";
};
user = mkOption {
type = types.str;
default = "invoiceplane";
description = lib.mdDoc "Database user.";
};
passwordFile = mkOption {
type = types.nullOr types.path;
default = null;
example = "/run/keys/invoiceplane-dbpassword";
description = lib.mdDoc ''
A file containing the password corresponding to
{option}`database.user`.
'';
};
createLocally = mkOption {
type = types.bool;
default = true;
description = lib.mdDoc "Create the database and database user locally.";
};
};
invoiceTemplates = mkOption {
type = types.listOf types.path;
default = [];
description = lib.mdDoc ''
List of path(s) to respective template(s) which are copied from the 'invoice_templates/pdf' directory.
::: {.note}
These templates need to be packaged before use, see example.
:::
'';
example = literalExpression ''
let
# Let's package an example template
template-vtdirektmarketing = pkgs.stdenv.mkDerivation {
name = "vtdirektmarketing";
# Download the template from a public repository
src = pkgs.fetchgit {
url = "https://git.project-insanity.org/onny/invoiceplane-vtdirektmarketing.git";
sha256 = "1hh0q7wzsh8v8x03i82p6qrgbxr4v5fb05xylyrpp975l8axyg2z";
};
sourceRoot = ".";
# Installing simply means copying template php file to the output directory
installPhase = ""
mkdir -p $out
cp invoiceplane-vtdirektmarketing/vtdirektmarketing.php $out/
"";
};
# And then pass this package to the template list like this:
in [ template-vtdirektmarketing ]
'';
};
poolConfig = mkOption {
type = with types; attrsOf (oneOf [ str int bool ]);
default = {
"pm" = "dynamic";
"pm.max_children" = 32;
"pm.start_servers" = 2;
"pm.min_spare_servers" = 2;
"pm.max_spare_servers" = 4;
"pm.max_requests" = 500;
};
description = lib.mdDoc ''
Options for the InvoicePlane PHP pool. See the documentation on `php-fpm.conf`
for details on configuration directives.
'';
};
extraConfig = mkOption {
type = types.nullOr types.lines;
default = null;
example = ''
SETUP_COMPLETED=true
DISABLE_SETUP=true
IP_URL=https://invoice.example.com
'';
description = lib.mdDoc ''
InvoicePlane configuration. Refer to
<https://github.com/InvoicePlane/InvoicePlane/blob/master/ipconfig.php.example>
for details on supported values.
'';
};
cron = {
enable = mkOption {
type = types.bool;
default = false;
description = lib.mdDoc ''
Enable cron service which periodically runs Invoiceplane tasks.
Requires key taken from the administration page. Refer to
<https://wiki.invoiceplane.com/en/1.0/modules/recurring-invoices>
on how to configure it.
'';
};
key = mkOption {
type = types.str;
description = lib.mdDoc "Cron key taken from the administration page.";
};
};
};
};
in
{
disabledModules = [
"services/web-apps/invoiceplane.nix"
];
# interface
options = {
services.invoiceplane = mkOption {
type = types.submodule {
options.sites = mkOption {
type = types.attrsOf (types.submodule siteOpts);
default = {};
description = lib.mdDoc "Specification of one or more WordPress sites to serve";
};
options.webserver = mkOption {
type = types.enum [ "caddy" ];
default = "caddy";
description = lib.mdDoc ''
Which webserver to use for virtual host management. Currently only
caddy is supported.
'';
};
};
default = {};
description = lib.mdDoc "InvoicePlane configuration.";
};
};
# implementation
config = mkIf (eachSite != {}) (mkMerge [{
assertions = flatten (mapAttrsToList (hostName: cfg:
[{ assertion = cfg.database.createLocally -> cfg.database.user == user;
message = ''services.invoiceplane.sites."${hostName}".database.user must be ${user} if the database is to be automatically provisioned'';
}
{ assertion = cfg.database.createLocally -> cfg.database.passwordFile == null;
message = ''services.invoiceplane.sites."${hostName}".database.passwordFile cannot be specified if services.invoiceplane.sites."${hostName}".database.createLocally is set to true.'';
}
{ assertion = cfg.cron.enable -> cfg.cron.key != null;
message = ''services.invoiceplane.sites."${hostName}".cron.key must be set in order to use cron service.'';
}
]) eachSite);
services.mysql = mkIf (any (v: v.database.createLocally) (attrValues eachSite)) {
enable = true;
package = mkDefault pkgs.mariadb;
ensureDatabases = mapAttrsToList (hostName: cfg: cfg.database.name) eachSite;
ensureUsers = mapAttrsToList (hostName: cfg:
{ name = cfg.database.user;
ensurePermissions = { "${cfg.database.name}.*" = "ALL PRIVILEGES"; };
}
) eachSite;
};
services.phpfpm = {
phpPackage = pkgs.php81;
pools = mapAttrs' (hostName: cfg: (
nameValuePair "invoiceplane-${hostName}" {
inherit user;
group = webserver.group;
settings = {
"listen.owner" = webserver.user;
"listen.group" = webserver.group;
} // cfg.poolConfig;
}
)) eachSite;
};
}
{
systemd.tmpfiles.rules = flatten (mapAttrsToList (hostName: cfg: [
"d ${cfg.stateDir} 0750 ${user} ${webserver.group} - -"
"f ${cfg.stateDir}/ipconfig.php 0750 ${user} ${webserver.group} - -"
"d ${cfg.stateDir}/logs 0750 ${user} ${webserver.group} - -"
"d ${cfg.stateDir}/uploads 0750 ${user} ${webserver.group} - -"
"d ${cfg.stateDir}/uploads/archive 0750 ${user} ${webserver.group} - -"
"d ${cfg.stateDir}/uploads/customer_files 0750 ${user} ${webserver.group} - -"
"d ${cfg.stateDir}/uploads/temp 0750 ${user} ${webserver.group} - -"
"d ${cfg.stateDir}/uploads/temp/mpdf 0750 ${user} ${webserver.group} - -"
"d ${cfg.stateDir}/tmp 0750 ${user} ${webserver.group} - -"
]) eachSite);
systemd.services.invoiceplane-config = {
serviceConfig.Type = "oneshot";
script = concatStrings (mapAttrsToList (hostName: cfg:
''
mkdir -p ${cfg.stateDir}/logs \
${cfg.stateDir}/uploads
if ! grep -q IP_URL "${cfg.stateDir}/ipconfig.php"; then
cp "${invoiceplane-config hostName cfg}" "${cfg.stateDir}/ipconfig.php"
fi
'') eachSite);
wantedBy = [ "multi-user.target" ];
};
users.users.${user} = {
group = webserver.group;
isSystemUser = true;
};
}
{
# Cron service implementation
systemd.timers = mapAttrs' (hostName: cfg: (
nameValuePair "invoiceplane-cron-${hostName}" (mkIf cfg.cron.enable {
wantedBy = [ "timers.target" ];
timerConfig = {
OnBootSec = "5m";
OnUnitActiveSec = "5m";
Unit = "invoiceplane-cron-${hostName}.service";
};
})
)) eachSite;
systemd.services =
mapAttrs' (hostName: cfg: (
nameValuePair "invoiceplane-cron-${hostName}" (mkIf cfg.cron.enable {
serviceConfig = {
Type = "oneshot";
User = user;
ExecStart = "${pkgs.curl}/bin/curl --header 'Host: ${hostName}' http://localhost/invoices/cron/recur/${cfg.cron.key}";
};
})
)) eachSite;
}
(mkIf (cfg.webserver == "caddy") {
services.caddy = {
enable = true;
virtualHosts = mapAttrs' (hostName: cfg: (
nameValuePair "http://${hostName}" {
extraConfig = ''
root * ${pkg hostName cfg}
file_server
php_fastcgi unix/${config.services.phpfpm.pools."invoiceplane-${hostName}".socket}
'';
}
)) eachSite;
};
})
]);
}

12
modules/nextcloud/default.nix
View File

@ -6,16 +6,8 @@
}:
with lib; let
psCfg = config.pub-solar;
cfg = config.pub-solar.nextcloud;
in {
options.pub-solar.nextcloud = {
enable = mkEnableOption "Life in sync";
};
config = mkIf cfg.enable {
home-manager = with pkgs;
pkgs.lib.setAttrByPath ["users" psCfg.user.name] {
systemd.user.services.nextcloud-client = import ./nextcloud.service.nix pkgs;
};
home-manager.users."${psCfg.user.name}" = {
systemd.user.services.nextcloud-client = import ./nextcloud.service.nix pkgs;
};
}

11
modules/nix-path.nix
View File

@ -1,11 +0,0 @@
{
channel,
inputs,
...
}: {
nix.nixPath = [
"nixpkgs=${channel.input}"
"nixos-config=${../lib/compat/nixos}"
"home-manager=${inputs.home}"
];
}

32
modules/core/nix.nix → modules/nix/default.nix
View File

@ -2,14 +2,29 @@
config,
pkgs,
lib,
inputs,
flake,
...
}: {
nixpkgs.config.allowUnfreePredicate = pkg: builtins.elem (lib.getName pkg) [
"cups-brother-hl3140cw"
"facetimehd-firmware"
"veracrypt"
"zoom"
];
nix = {
# Use default version alias for nix package
package = pkgs.nix;
gc.automatic = true;
optimise.automatic = true;
registry = {
nixpkgs.flake = flake.inputs.nixpkgs;
unstable.flake = flake.inputs.unstable;
master.flake = flake.inputs.master;
system.flake = flake.self;
};
settings = {
# Improve nix store disk usage
auto-optimise-store = true;
@ -19,7 +34,16 @@
trusted-users = ["root" "@wheel"];
# Allow only group wheel to connect to the nix daemon
allowed-users = ["@wheel"];
substituters = [
"https://pub-solar.cachix.org/"
];
trusted-public-keys = [
"pub-solar.cachix.org-1:ZicXIxKgdxMtgSJECWR8iihZxHRvu8ObL4n2cuBmtos="
];
};
# Generally useful nix option defaults
extraOptions = lib.mkForce ''
experimental-features = flakes nix-command
@ -28,5 +52,11 @@
keep-derivations = true
fallback = true
'';
nixPath = [
"nixpkgs=${flake.inputs.nixpkgs}"
"nixos-config=${../../lib/compat/nixos}"
"home-manager=${flake.inputs.home-manager}"
];
};
}

30
modules/office/default.nix
View File

@ -6,27 +6,15 @@
}:
with lib; let
psCfg = config.pub-solar;
cfg = config.pub-solar.office;
in {
options.pub-solar.office = {
enable = mkEnableOption "Install office programs, also enables printing server";
};
programs.evince.enable = true;
config = mkIf cfg.enable {
pub-solar.printing.enable = true;
# Gnome PDF viewer
programs.evince.enable = true;
home-manager = with pkgs;
pkgs.lib.setAttrByPath ["users" psCfg.user.name] {
home.packages = [
libreoffice-fresh
gnome.simple-scan
# Tools like pdfunite
poppler_utils
# tool for annotating PDFs
xournalpp
];
};
};
users.users."${psCfg.user.name}".packages = with pkgs; [
libreoffice-fresh
gnome.simple-scan
# Tools like pdfunite
poppler_utils
# tool for annotating PDFs
xournalpp
];
}

53
modules/paranoia/default.nix
View File

@ -1,53 +0,0 @@
{
config,
lib,
...
}:
with lib; let
psCfg = config.pub-solar;
cfg = config.pub-solar.paranoia;
in {
options.pub-solar.paranoia = {
enable = mkOption {
description = ''
Only offer hibernation instead of screen locking and sleeping. This only makes sense
if your hard drive is encrypted, and ensures that the contents of your drive are
encrypted if you are not actively using the device.
'';
default = false;
type = types.bool;
};
};
config = mkIf cfg.enable {
pub-solar.core.hibernation.enable = true;
services.logind.lidSwitch = "hibernate";
# The options below are directly taken from or inspired by
# https://xeiaso.net/blog/paranoid-nixos-2021-07-18
# Don't set this if you need sftp
services.openssh.allowSFTP = false;
services.openssh.openFirewall = false; # Lock yourself out
# Limit the use of sudo to the group wheel
security.sudo.execWheelOnly = true;
# Remove the complete default environment of packages like
# nano, perl and rsync
environment.defaultPackages = lib.mkForce [];
# fileSystems."/".options = [ "noexec" ];
services.openssh = {
kbdInteractiveAuthentication = false;
extraConfig = ''
AllowTcpForwarding yes
X11Forwarding no
AllowAgentForwarding no
AllowStreamLocalForwarding no
AuthenticationMethods publickey
'';
};
};
}

60
modules/printing/default.nix
View File

@ -1,38 +1,36 @@
{
lib,
flake,
config,
pkgs,
lib,
...
}:
with lib; let
psCfg = config.pub-solar;
cfg = config.pub-solar.printing;
in {
options.pub-solar.printing = {
enable = mkEnableOption "CUPSSSss";
};
}: {
services.avahi.enable = true;
services.avahi.ipv6 = true;
services.avahi.nssmdns = true;
services.avahi.publish.enable = true;
services.avahi.publish.userServices = true;
config = mkIf cfg.enable {
services.avahi.enable = true;
services.avahi.nssmdns = true;
services.avahi.publish.enable = true;
services.avahi.publish.userServices = true;
services.printing.enable = true;
services.printing.browsing = true;
services.printing.listenAddresses = ["localhost:631"];
services.printing.allowFrom = ["all"];
services.printing.defaultShared = false;
services.printing.drivers = with pkgs; [
gutenprint
brgenml1lpr
brgenml1cupswrapper
brlaser
cnijfilter2
cups-brother-hl3140cw
];
hardware.sane = {
enable = true;
brscan4.enable = true;
};
services.printing.enable = true;
services.printing.browsing = true;
services.printing.listenAddresses = ["localhost:631"];
services.printing.defaultShared = lib.mkDefault false;
services.printing.drivers = [
pkgs.gutenprint
] ++ (if (pkgs.system == "x86_64-linux")
then [ pkgs.cups-brother-hl3140cw ]
else []);
networking.hosts = flake.self.lib.addLocalHostname ["cups.local"];
services.caddy = {
enable = true;
extraConfig = ''
cups.local {
request_header Host localhost:631
reverse_proxy unix//run/cups/cups.sock
}
'';
};
}

27
modules/social/default.nix
View File

@ -1,27 +0,0 @@
{
lib,
config,
pkgs,
...
}:
with lib; let
psCfg = config.pub-solar;
cfg = config.pub-solar.social;
in {
options.pub-solar.social = {
enable = mkEnableOption "Life with others";
};
config = mkIf cfg.enable {
home-manager = with pkgs;
pkgs.lib.setAttrByPath ["users" psCfg.user.name] {
home.packages = [
gurk-rs
signal-desktop
tdesktop
element-desktop
irssi
];
};
};
}

111
modules/sway/default.nix
View File

@ -1,111 +0,0 @@
{
lib,
config,
pkgs,
...
}:
with lib; let
psCfg = config.pub-solar;
in {
options.pub-solar.sway = {
enable = mkEnableOption "Life in boxes";
terminal = mkOption {
type = types.nullOr types.str;
default = "alacritty";
description = "Choose sway's default terminal";
};
v4l2loopback.enable = mkOption {
type = types.bool;
default = true;
description = "WebCam streaming tool";
};
};
config = mkIf psCfg.sway.enable (mkMerge [
(mkIf (psCfg.sway.v4l2loopback.enable) {
boot.extraModulePackages = with config.boot.kernelPackages; [v4l2loopback];
boot.kernelModules = ["v4l2loopback"];
boot.extraModprobeConfig = ''
options v4l2loopback exclusive_caps=1 devices=3
'';
})
{
environment.systemPackages = with pkgs; [
linuxPackages.v4l2loopback
];
programs.sway.enable = true;
xdg.portal = {
enable = true;
wlr = {
enable = true;
settings = {
screencast = {
max_fps = 30;
chooser_type = "simple";
chooser_cmd = "${pkgs.slurp}/bin/slurp -f %o -or";
};
};
};
extraPortals = with pkgs; [xdg-desktop-portal-gtk];
};
services.pipewire.enable = true;
home-manager = with pkgs;
pkgs.lib.setAttrByPath ["users" psCfg.user.name] {
home.packages = with pkgs; [
sway
grim
kanshi
mako
slurp
swaynotificationcenter
swayidle
swaylock
swaybg
xwayland
libappindicator-gtk3
wl-clipboard
wf-recorder
brightnessctl
gammastep
geoclue2
xsettingsd
ydotool
sway-launcher
record-screen
import-gtk-settings
s
wcwd
];
programs.waybar.enable = true;
#programs.waybar.systemd.enable = true;
systemd.user.services.swaynotificationcenter = import ./swaynotificationcenter.service.nix pkgs;
systemd.user.services.sway = import ./sway.service.nix {inherit pkgs psCfg;};
systemd.user.services.swayidle = import ./swayidle.service.nix {inherit pkgs psCfg;};
systemd.user.services.xsettingsd = import ./xsettingsd.service.nix {inherit pkgs psCfg;};
systemd.user.services.waybar = import ./waybar.service.nix {inherit pkgs psCfg;};
systemd.user.targets.sway-session = import ./sway-session.target.nix {inherit pkgs psCfg;};
xdg.configFile."sway/config".text = import ./config/config.nix {inherit config pkgs;};
xdg.configFile."sway/config.d/colorscheme.conf".source = ./config/config.d/colorscheme.conf;
xdg.configFile."sway/config.d/theme.conf".source = ./config/config.d/theme.conf;
xdg.configFile."sway/config.d/gaps.conf".source = ./config/config.d/gaps.conf;
xdg.configFile."sway/config.d/custom-keybindings.conf".source = ./config/config.d/custom-keybindings.conf;
xdg.configFile."sway/config.d/mode_system.conf".text = import ./config/config.d/mode_system.conf.nix {inherit pkgs psCfg;};
xdg.configFile."sway/config.d/applications.conf".source = ./config/config.d/applications.conf;
xdg.configFile."sway/config.d/systemd.conf".source = ./config/config.d/systemd.conf;
};
}
]);
}

35
modules/sway/swayidle.service.nix
View File

@ -1,35 +0,0 @@
{
pkgs,
psCfg,
...
}: {
Unit = {
Description = "Idle manager for Wayland";
Documentation = ["man:swayidle(1)"];
BindsTo = ["graphical-session.target"];
Wants = ["graphical-session-pre.target"];
After = ["graphical-session-pre.target"];
};
Service = {
Type = "simple";
Environment = "PATH=/run/current-system/sw/bin:${pkgs.sway}/bin:${pkgs.swaylock-bg}/bin:${pkgs.swayidle}/bin";
ExecStart =
'' ${pkgs.swayidle}/bin/swayidle -w \
after-resume 'swaymsg "output * dpms on"' \
before-sleep 'swaylock-bg' ''
+ (
if psCfg.paranoia.enable
then '' \
timeout 120 'swaymsg "output * dpms off"' resume 'swaymsg "output * dpms on"' \
timeout 150 'systemctl hibernate'
''
else '' \
timeout 600 'swaylock-bg' \
timeout 900 'swaymsg "output * dpms off"' resume 'swaymsg "output * dpms on"'
''
);
};
Install = {
WantedBy = ["sway-session.target"];
};
}

0
profiles/base-user/.config/git/config.nix → modules/terminal-life/.config/git/config.nix
View File

0
profiles/base-user/.config/git/gitmessage.nix → modules/terminal-life/.config/git/gitmessage.nix
View File

0
profiles/base-user/.config/git/global_gitignore.nix → modules/terminal-life/.config/git/global_gitignore.nix
View File

4554
profiles/base-user/.local/share/nvim/json-schemas/caddy_schema.json → modules/terminal-life/.local/share/nvim/json-schemas/caddy_schema.json
View File

File diff suppressed because one or more lines are too long

0
profiles/base-user/.local/share/scripts/base16.sh → modules/terminal-life/.local/share/scripts/base16.sh
View File

7
modules/terminal-life/bash/default.nix
View File

@ -1,7 +1,7 @@
{
config,
flake,
pkgs,
self,
...
}: let
psCfg = config.pub-solar;
@ -18,6 +18,8 @@ in {
# Run when initializing an interactive shell
initExtra = ''
# Use fzf's CTRL-R history widget
source ${pkgs.fzf}/share/fzf/key-bindings.bash
# Show current directory at the top in Alacritty
PROMPT_COMMAND='echo -e -n "\e]2;$(basename "$PWD" | sed "s/${psCfg.user.name}/~/")\e\\"'
@ -85,7 +87,6 @@ in {
fi
# end of .bashrc
# Somehow we need to ensure starship starts later than ble.sh
# (possible packaging issue?)
# https://github.com/akinomyoga/ble.sh/issues/333
@ -106,7 +107,7 @@ in {
drone = "DRONE_TOKEN=$(secret-tool lookup drone token) drone";
no = "manix \"\" | grep '^# ' | sed 's/^# \(.*\) (.*/\1/;s/ (.*//;s/^# //' | fzf --preview=\"manix '{}'\" | xargs manix";
# fix nixos-option
nixos-option = "nixos-option -I nixpkgs=${self}/lib/compat";
nixos-option = "nixos-option -I nixpkgs=${flake.self}/lib/compat";
myip = "dig +short myip.opendns.com @208.67.222.222 2>&1";
nnn = "nnn -d -e -H -r";
};

137
modules/terminal-life/default.nix
View File

@ -2,7 +2,7 @@
lib,
config,
pkgs,
self,
flake,
...
}:
with lib; let
@ -10,73 +10,100 @@ with lib; let
cfg = config.pub-solar.terminal-life;
in {
options.pub-solar.terminal-life = {
enable = mkEnableOption "Life in black and white";
lite = mkOption {
full = mkOption {
description = ''
Enable a lite edition of terminal-life with less modules and a reduced package set.
Enable a full version, which includes more nvim plugins and lsps.
'';
default = false;
type = types.bool;
};
};
config = mkIf cfg.enable {
config = {
programs.command-not-found.enable = false;
environment.systemPackages = with pkgs; [
users.users."${psCfg.user.name}".packages = with pkgs; [
ack
asciinema
bat
blesh
exa
fd
jump
(nnn.overrideAttrs (o: {
patches =
(o.patches or [])
++ [
./nnn/0001-feat-use-wasd-keybindings-for-jkli.patch
];
}))
powerline
screen
silver-searcher
watson
];
# Starship is a fast and featureful shell prompt
# starship.toml has sane defaults that can be changed there
programs.starship = {
enable = true;
settings = import ./starship.toml.nix;
};
home-manager.users."${psCfg.user.name}" = {
xdg.dataFile."scripts/base16.sh".source = .local/share/scripts/base16.sh;
home-manager = with pkgs;
pkgs.lib.setAttrByPath ["users" psCfg.user.name] {
home.packages = [
ack
asciinema
bat
blesh
exa
fd
gh
glow
jump
mdbook-multilang
(nnn.overrideAttrs (o: {
patches =
(o.patches or [])
++ [
./nnn/0001-feat-use-wasd-keybindings-for-jkli.patch
];
}))
notes
powerline
python-wiki-fetch
silver-searcher
watson
tree
];
programs.bash = import ./bash {
inherit config;
inherit pkgs;
inherit self;
};
programs.fzf = import ./fzf {
inherit config;
inherit pkgs;
};
programs.neovim = import ./nvim {
inherit config;
inherit pkgs;
inherit lib;
};
programs.less = {
enable = true;
keys = ''
k forw-line
i back-line
K forw-scroll
I back-scroll
'';
};
# Starship is a fast and featureful shell prompt
# starship.toml has sane defaults that can be changed there
programs.starship = {
enable = true;
settings = import ./starship.toml.nix;
};
programs.bash = import ./bash {
inherit config;
inherit pkgs;
inherit lib;
inherit flake;
};
programs.fzf = import ./fzf {
inherit config;
inherit pkgs;
};
programs.neovim = import ./nvim {
inherit config;
inherit pkgs;
inherit lib;
};
# Ensure nvim backup directory gets created
# Workaround for E510: Can't make backup file (add ! to override)
xdg.dataFile."nvim/backup/.keep".text = "";
xdg.dataFile."nvim/json-schemas/.keep".text = "";
# Generated with:
# docker run -it --name caddy-json-schema registry.greenbaum.cloud/gc/caddy-l4:2.5.2 caddy json-schema -output /srv/caddy_schema.json
xdg.dataFile."nvim/json-schemas/caddy_schema.json".source = .local/share/nvim/json-schemas/caddy_schema.json;
xdg.dataFile."nvim/templates/.keep".text = "";
programs.git = import ./git {};
xdg.configFile."git/config".text = import ./.config/git/config.nix {
inherit config;
inherit pkgs;
};
xdg.configFile."git/gitmessage".text = import ./.config/git/gitmessage.nix {
inherit config;
inherit pkgs;
};
xdg.configFile."git/global_gitignore".text = import ./.config/git/global_gitignore.nix {
inherit config;
inherit pkgs;
};
programs.direnv = import ./direnv {};
};
};
}

7
modules/terminal-life/direnv/default.nix Normal file
View File

@ -0,0 +1,7 @@
{ ... }:
{
enable = true;
nix-direnv = {
enable = true;
};
}

5
modules/terminal-life/fzf/default.nix
View File

@ -10,5 +10,8 @@
"--color=fg:#d3d1d4,header:#7accd7,info:#e5c463,pointer:#ef9062"
"--color=marker:#ef9062,fg+:#303030,prompt:#e5c463,hl+:#7accd7"
];
enableBashIntegration = true;
# Use ble.sh for completions, see
# modules/terminal-life/bash/default.nix -> bleopt complete_menu_style=desc
# and https://github.com/akinomyoga/ble.sh/wiki/Manual-%C2%A77-Completion
enableBashIntegration = false;
}

41
modules/terminal-life/git/default.nix Normal file
View File

@ -0,0 +1,41 @@
{ ... }:
{
enable = true;
extraConfig = {
pull.rebase = false;
};
aliases = {
a = "add -p";
co = "checkout";
cob = "checkout -b";
f = "fetch -p";
c = "commit";
p = "push";
ba = "branch -a";
bd = "branch -d";
bD = "branch -D";
d = "diff";
dc = "diff --cached";
ds = "diff --staged";
r = "restore";
rs = "restore --staged";
st = "status -sb";
# reset
soft = "reset --soft";
hard = "reset --hard";
s1ft = "soft HEAD~1";
h1rd = "hard HEAD~1";
# logging
lg = "log --color --graph --pretty=format:'%Cred%h%Creset -%C(yellow)%d%Creset %s %Cgreen(%cr) %C(bold blue)<%an>%Creset' --abbrev-commit";
plog = "log --graph --pretty='format:%C(red)%d%C(reset) %C(yellow)%h%C(reset) %ar %C(green)%aN%C(reset) %s'";
tlog = "log --stat --since='1 Day Ago' --graph --pretty=oneline --abbrev-commit --date=relative";
rank = "shortlog -sn --no-merges";
# delete merged branches
bdm = "!git branch --merged | grep -v '*' | xargs -n 1 git branch -d";
};
}

212
modules/terminal-life/nvim/default.nix
View File

@ -21,7 +21,7 @@ in {
withPython3 = true;
extraPackages = with pkgs;
lib.mkIf (!cfg.lite) [
lib.mkIf (cfg.full) [
ansible-language-server
ccls
gopls
@ -44,137 +44,135 @@ in {
universal-ctags
];
plugins = with pkgs.vimPlugins;
[]
++ lib.optionals (!cfg.lite) [
(pkgs.vimPlugins.nvim-treesitter.withPlugins (p: [
p.ini
p.json
p.json5
p.markdown
p.nix
p.toml
p.yaml
plugins = with pkgs.vimPlugins; lib.mkIf cfg.full [
(pkgs.vimPlugins.nvim-treesitter.withPlugins (p: [
p.ini
p.json
p.json5
p.markdown
p.nix
p.toml
p.yaml
p.css
p.graphql
p.html
p.javascript
p.scss
p.tsx
p.typescript
p.vue
p.css
p.graphql
p.html
p.javascript
p.scss
p.tsx
p.typescript
p.vue
p.c
p.cpp
p.go
p.gomod
p.gosum
p.haskell
p.lua
p.php
p.python
p.ruby
p.rust
p.c
p.cpp
p.go
p.gomod
p.gosum
p.haskell
p.lua
p.php
p.python
p.ruby
p.rust
p.vim
p.vimdoc
p.vim
p.vimdoc
p.passwd
p.sql
p.passwd
p.sql
p.diff
p.gitcommit
p.gitignore
p.git_config
p.gitattributes
p.git_rebase
p.diff
p.gitcommit
p.gitignore
p.git_config
p.gitattributes
p.git_rebase
p.bash
p.dockerfile
p.make
p.ninja
p.terraform
]))
p.bash
p.dockerfile
p.make
p.ninja
p.terraform
]))
# Dependencies for nvim-lspconfig
nvim-cmp
cmp-nvim-lsp
cmp_luasnip
luasnip
# Dependencies for nvim-lspconfig
nvim-cmp
cmp-nvim-lsp
cmp_luasnip
luasnip
# Quickstart configs for neovim LSP
lsp_extensions-nvim
nvim-lspconfig
# Quickstart configs for neovim LSP
lsp_extensions-nvim
nvim-lspconfig
# Collaborative editing in Neovim using built-in capabilities
instant-nvim-nvfetcher
# Collaborative editing in Neovim using built-in capabilities
instant-nvim-nvfetcher
# Search functionality behind :Ack
ack-vim
# Search functionality behind :Ack
ack-vim
# The status bar in the bottom of the screen with the mode indication and file location
vim-airline
# The status bar in the bottom of the screen with the mode indication and file location
vim-airline
# Automatically load editorconfig files in repos to configure nvim settings
editorconfig-vim
# Automatically load editorconfig files in repos to configure nvim settings
editorconfig-vim
# File browser. Use <leader>n to access
nnn-vim
# File browser. Use <leader>n to access
nnn-vim
# Highlight characters when using f, F, t, and T
quick-scope
# Highlight characters when using f, F, t, and T
quick-scope
# Get sudo in vim; :SudaWrite <optional filename>
suda-vim
# Get sudo in vim; :SudaWrite <optional filename>
suda-vim
# Undo history etc. per project
vim-workspace-nvfetcher
# Undo history etc. per project
vim-workspace-nvfetcher
# JSON schemas
SchemaStore-nvim
# JSON schemas
SchemaStore-nvim
# Work with tags files
vim-gutentags
# Work with tags files
vim-gutentags
# Neovim colorschemes / themes
sonokai
vim-hybrid-material
vim-airline-themes
vim-apprentice-nvfetcher
# Neovim colorschemes / themes
sonokai
vim-hybrid-material
vim-airline-themes
vim-apprentice-nvfetcher
# Git integrations
# A Git wrapper so awesome, it should be illegal
fugitive
# Shows git diff markers in the sign column
vim-gitgutter
# GitHub extension for fugitive
vim-rhubarb
# Ease your git workflow within Vim
vimagit-nvfetcher
# Git integrations
# A Git wrapper so awesome, it should be illegal
fugitive
# Shows git diff markers in the sign column
vim-gitgutter
# GitHub extension for fugitive
vim-rhubarb
# Ease your git workflow within Vim
vimagit-nvfetcher
# FZF fuzzy finder
fzf-vim
fzfWrapper
# Make the yanked region apparent
vim-highlightedyank
# FZF fuzzy finder
fzf-vim
fzfWrapper
# Make the yanked region apparent
vim-highlightedyank
# :Beautify Code beautifier
vim-beautify-nvfetcher
# :Beautify Code beautifier
vim-beautify-nvfetcher
# Unload, delete or wipe a buffer without closing the window
vim-bufkill
# Defaults everyone can agree on
vim-sensible
# Unload, delete or wipe a buffer without closing the window
vim-bufkill
# Defaults everyone can agree on
vim-sensible
# emmet for vim: http://emmet.io/
emmet-vim
# Caddyfile syntax support for Vim
vim-caddyfile-nvfetcher
# emmet for vim: http://emmet.io/
emmet-vim
# Caddyfile syntax support for Vim
vim-caddyfile-nvfetcher
# Fix TOFU hashes when writing nix derivations without leaving neovim
vim-nixhash
];
# Fix TOFU hashes when writing nix derivations without leaving neovim
vim-nixhash
];
extraConfig = builtins.concatStringsSep "\n" [
''

10
modules/terminal-life/nvim/lsp.vim
View File

@ -74,6 +74,8 @@ lua <<EOF
-- Add additional capabilities supported by nvim-cmp
local capabilities = require('cmp_nvim_lsp').default_capabilities()
-- vscode HTML lsp needs this https://github.com/neovim/nvim-lspconfig/blob/master/doc/server_configurations.md#html
capabilities.textDocument.completion.completionItem.snippetSupport = true
-- vscode HTML lsp needs this https://github.com/neovim/nvim-lspconfig/blob/master/doc/server_configurations.md#html
capabilities.textDocument.completion.completionItem.snippetSupport = true
@ -146,7 +148,6 @@ lua <<EOF
['settings'] = {
['yaml'] = {
['schemas'] = {
["https://raw.githubusercontent.com/instrumenta/kubernetes-json-schema/master/v1.18.1-standalone-strict/all.json"] = ".sensu/*.{yml,yaml}",
['https://json.schemastore.org/github-workflow'] = '.github/workflows/*.{yml,yaml}',
['https://json.schemastore.org/github-action'] = '.github/action.{yml,yaml}',
['https://json.schemastore.org/drone'] = '*.drone.{yml,yaml}',
@ -173,6 +174,13 @@ lua <<EOF
end
end -- ‡
-- configure floating diagnostics appearance, symbols
local signs = { Error = " ", Warn = " ", Hint = " ", Info = " " }
for type, icon in pairs(signs) do
local hl = "DiagnosticSign" .. type
vim.fn.sign_define(hl, { text = icon, texthl = hl, numhl = hl })
end
-- Set completeopt to have a better completion experience
vim.o.completeopt = 'menuone,noselect'

31
modules/uhk/default.nix
View File

@ -1,31 +0,0 @@
{
lib,
config,
pkgs,
...
}:
with lib; let
psCfg = config.pub-solar;
cfg = config.pub-solar.uhk;
in {
options.pub-solar.uhk = {
enable = mkEnableOption "Ultimate Hacking Keyboard";
};
config = mkIf cfg.enable {
environment.systemPackages = with pkgs; [
uhk-agent
];
# Ultimate Hacking Keyboard rules
# These are the udev rules for accessing the USB interfaces of the UHK as non-root users.
services.udev.packages = with pkgs; [
uhk-agent
];
services.udev.extraRules = ''
SUBSYSTEM=="input", ATTRS{idVendor}=="1d50", ATTRS{idProduct}=="612[0-7]", GROUP="input", MODE="0660"
SUBSYSTEMS=="usb", ATTRS{idVendor}=="1d50", ATTRS{idProduct}=="612[0-7]", TAG+="uaccess"
KERNEL=="hidraw*", ATTRS{idVendor}=="1d50", ATTRS{idProduct}=="612[0-7]", TAG+="uaccess"
'';
};
}

0
profiles/base-user/.config/dircolors → modules/user/.config/dircolors
View File

0
profiles/base-user/.config/mimeapps.list → modules/user/.config/mimeapps.list
View File

62
modules/user/default.nix
View File

@ -1,12 +1,16 @@
{
lib,
config,
pkgs,
lib,
...
}:
with lib; let
cfg = config.pub-solar;
in {
}: let
psCfg = config.pub-solar;
in
with lib; {
imports = [
./home.nix
];
options.pub-solar = {
user = {
name = mkOption {
@ -24,6 +28,11 @@ in {
type = types.nullOr types.str;
default = null;
};
passwordlessSudo = mkOption {
description = "Whether this user can use sudo without entering a password";
type = types.bool;
default = false;
};
publicKeys = mkOption {
description = "User SSH public keys";
type = types.listOf types.str;
@ -46,4 +55,47 @@ in {
};
};
};
config = {
users = {
mutableUsers = false;
users."${psCfg.user.name}" = {
# Indicates whether this is an account for a “real” user.
# This automatically sets group to users, createHome to true,
# home to /home/username, useDefaultShell to true, and isSystemUser to false.
isNormalUser = true;
description = psCfg.user.description;
extraGroups = [
"input"
"lp"
"networkmanager"
"scanner"
"video"
"wheel"
];
shell = pkgs.bash;
initialHashedPassword =
if psCfg.user.password != null
then psCfg.user.password
else "";
openssh.authorizedKeys.keys =
if psCfg.user.publicKeys != null
then psCfg.user.publicKeys
else [];
};
};
security.sudo.extraRules = mkIf psCfg.user.passwordlessSudo [
{
users = ["${psCfg.user.name}"];
commands = [
{
command = "ALL";
options = ["NOPASSWD"];
}
];
}
];
};
}

50
modules/user/home.nix Normal file
View File

@ -0,0 +1,50 @@
{
config,
pkgs,
lib,
...
}:
with lib; let
psCfg = config.pub-solar;
xdg = config.home-manager.users."${psCfg.user.name}".xdg;
in {
imports = [
./session-variables.nix
];
home-manager.users."${psCfg.user.name}" = {
# Let Home Manager install and manage itself.
programs.home-manager.enable = true;
# Home Manager needs a bit of information about you and the
# paths it should manage.
home.username = psCfg.user.name;
home.homeDirectory = "/home/${psCfg.user.name}";
home.stateVersion = "22.11";
programs.dircolors.enable = true;
xdg.enable = true;
xdg.mime.enable = true;
xdg.mimeApps = import ./mimeapps.nix;
xdg.configFile."dircolors".source = ./.config/dircolors;
xdg.dataFile."shell.nix.tmpl" = {
text = ''
let
unstable = import (fetchTarball https://github.com/nixos/nixpkgs/archive/nixos-unstable.tar.gz) { };
in
{ nixpkgs ? import <nixpkgs> {} }:
with nixpkgs; mkShell {
buildInputs = [
];
}
'';
target = "nvim/templates/shell.nix.tmpl";
};
# Allow unfree packages only on a user basis, not on a system-wide basis
xdg.configFile."nixpkgs/config.nix".text = " { allowUnfree = true; } ";
};
}

2
profiles/base-user/mimeapps.nix → modules/user/mimeapps.nix
View File

@ -22,6 +22,6 @@
"x-scheme-handler/https" = ["firefox.desktop"];
"x-scheme-handler/mailto" = ["userapp-Thunderbird.desktop"];
"x-scheme-handler/msteams" = ["teams.desktop"];
"x-scheme-handler/tg" = ["userapp-Telegram Desktop-1RE3J1.desktop"];
"x-scheme-handler/tg" = ["userapp-Telegram Desktop-JBKFU0.desktop"];
};
}

Some files were not shown because too many files have changed in this diff Show More