teutat3s/os
2
0
Fork 0
forked from pub-solar/os
Code Pull requests Activity

feat: convert to flake-parts

Browse source 
Thanks @b12f
This commit is contained in:
teutat3s 2023-11-10 19:48:06 +01:00
parent 802750c5ba
commit a6e5630927
Signed by: teutat3s
GPG key ID: 4FA1D3FA524F22C1
131 changed files with 3659 additions and 6228 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
.gitignore vendored
View file

@ -4,7 +4,7 @@ doc/index.html
# Result of bud commands # Result of bud commands
vm vm
iso /iso
doi doi
pkgs/_sources/.shake* pkgs/_sources/.shake*

309
flake.lock
View file

@ -3,10 +3,10 @@
"agenix": { "agenix": {
"inputs": { "inputs": {
"darwin": [ "darwin": [
"darwin" "nix-darwin"
], ],
"nixpkgs": [ "nixpkgs": [
"nixos" "nixpkgs"
] ]
}, },
"locked": { "locked": {
@ -23,42 +23,22 @@
"type": "github" "type": "github"
} }
}, },
"darwin": { "deploy-rs": {
"inputs": {
"nixpkgs": [
"nixos"
]
},
"locked": {
"lastModified": 1692248770,
"narHash": "sha256-tZeFpETKQGbgnaSIO1AGWD27IyTcBm4D+A9d7ulQ4NM=",
"owner": "LnL7",
"repo": "nix-darwin",
"rev": "511177ffe8226c78c9cf6a92a7b5f2df3684956b",
"type": "github"
},
"original": {
"owner": "LnL7",
"repo": "nix-darwin",
"type": "github"
}
},
"deploy": {
"inputs": { "inputs": {
"flake-compat": [ "flake-compat": [
"flake-compat" "flake-compat"
], ],
"nixpkgs": [ "nixpkgs": [
"nixos" "nixpkgs"
], ],
"utils": "utils" "utils": "utils"
}, },
"locked": { "locked": {
"lastModified": 1686747123, "lastModified": 1695052866,
"narHash": "sha256-XUQK9kwHpTeilHoad7L4LjMCCyY13Oq383CoFADecRE=", "narHash": "sha256-agn7F9Oww4oU6nPiw+YiYI9Xb4vOOE73w8PAoBRP4AA=",
"owner": "serokell", "owner": "serokell",
"repo": "deploy-rs", "repo": "deploy-rs",
"rev": "724463b5a94daa810abfc64a4f87faef4e00f984", "rev": "e3f41832680801d0ee9e2ed33eb63af398b090e9",
"type": "github" "type": "github"
}, },
"original": { "original": {
@ -69,29 +49,7 @@
}, },
"devshell": { "devshell": {
"inputs": { "inputs": {
"flake-utils": "flake-utils", "nixpkgs": "nixpkgs_2",
"nixpkgs": [
"digga",
"nixpkgs"
]
},
"locked": {
"lastModified": 1671489820,
"narHash": "sha256-qoei5HDJ8psd1YUPD7DhbHdhLIT9L2nadscp4Qk37uk=",
"owner": "numtide",
"repo": "devshell",
"rev": "5aa3a8039c68b4bf869327446590f4cdf90bb634",
"type": "github"
},
"original": {
"owner": "numtide",
"repo": "devshell",
"type": "github"
}
},
"devshell_2": {
"inputs": {
"nixpkgs": "nixpkgs",
"systems": "systems" "systems": "systems"
}, },
"locked": { "locked": {
@ -108,46 +66,6 @@
"type": "github" "type": "github"
} }
}, },
"digga": {
"inputs": {
"darwin": [
"darwin"
],
"deploy": [
"deploy"
],
"devshell": "devshell",
"flake-compat": [
"flake-compat"
],
"flake-utils": "flake-utils_2",
"flake-utils-plus": "flake-utils-plus",
"home-manager": [
"home"
],
"nixlib": [
"nixos"
],
"nixpkgs": [
"nixos"
],
"nixpkgs-unstable": "nixpkgs-unstable"
},
"locked": {
"lastModified": 1674947971,
"narHash": "sha256-6gKqegJHs72jnfFP9g2sihl4fIZgtKgKuqU2rCkIdGY=",
"owner": "pub-solar",
"repo": "digga",
"rev": "2da608bd8afb48afef82c6b1b6d852a36094a497",
"type": "github"
},
"original": {
"owner": "pub-solar",
"ref": "fix/bootstrap-iso",
"repo": "digga",
"type": "github"
}
},
"flake-compat": { "flake-compat": {
"flake": false, "flake": false,
"locked": { "locked": {
@ -164,59 +82,25 @@
"type": "github" "type": "github"
} }
}, },
"flake-utils": { "flake-parts": {
"locked": {
"lastModified": 1642700792,
"narHash": "sha256-XqHrk7hFb+zBvRg6Ghl+AZDq03ov6OshJLiSWOoX5es=",
"owner": "numtide",
"repo": "flake-utils",
"rev": "846b2ae0fc4cc943637d3d1def4454213e203cba",
"type": "github"
},
"original": {
"owner": "numtide",
"repo": "flake-utils",
"type": "github"
}
},
"flake-utils-plus": {
"inputs": { "inputs": {
"flake-utils": [ "nixpkgs-lib": "nixpkgs-lib"
"digga",
"flake-utils"
]
}, },
"locked": { "locked": {
"lastModified": 1654029967, "lastModified": 1698579227,
"narHash": "sha256-my3GQ3mQIw/1f6GPV1IhUZrcYQSWh0YJAMPNBjhXJDw=", "narHash": "sha256-KVWjFZky+gRuWennKsbo6cWyo7c/z/VgCte5pR9pEKg=",
"owner": "gytis-ivaskevicius", "owner": "hercules-ci",
"repo": "flake-utils-plus", "repo": "flake-parts",
"rev": "6271cf3842ff9c8a9af9e3508c547f86bc77d199", "rev": "f76e870d64779109e41370848074ac4eaa1606ec",
"type": "github" "type": "github"
}, },
"original": { "original": {
"owner": "gytis-ivaskevicius", "owner": "hercules-ci",
"ref": "refs/pull/120/head", "repo": "flake-parts",
"repo": "flake-utils-plus",
"type": "github" "type": "github"
} }
}, },
"flake-utils_2": { "flake-utils": {
"locked": {
"lastModified": 1667395993,
"narHash": "sha256-nuEHfE/LcWyuSWnS8t12N1wc105Qtau+/OdUAjtQ0rA=",
"owner": "numtide",
"repo": "flake-utils",
"rev": "5aed5285a952e0b949eb3ba02c12fa4fcfef535f",
"type": "github"
},
"original": {
"owner": "numtide",
"repo": "flake-utils",
"type": "github"
}
},
"flake-utils_3": {
"locked": { "locked": {
"lastModified": 1653893745, "lastModified": 1653893745,
"narHash": "sha256-0jntwV3Z8//YwuOjzhV2sgJJPt+HY6KhU7VZUL0fKZQ=", "narHash": "sha256-0jntwV3Z8//YwuOjzhV2sgJJPt+HY6KhU7VZUL0fKZQ=",
@ -231,7 +115,7 @@
"type": "github" "type": "github"
} }
}, },
"flake-utils_4": { "flake-utils_2": {
"inputs": { "inputs": {
"systems": "systems_2" "systems": "systems_2"
}, },
@ -265,18 +149,18 @@
"type": "github" "type": "github"
} }
}, },
"home": { "home-manager": {
"inputs": { "inputs": {
"nixpkgs": [ "nixpkgs": [
"nixos" "nixpkgs"
] ]
}, },
"locked": { "locked": {
"lastModified": 1693208669, "lastModified": 1695108154,
"narHash": "sha256-hHFaaUsZ860wvppPeiu7nJn/nXZjJfnqAQEu9SPFE9I=", "narHash": "sha256-gSg7UTVtls2yO9lKtP0yb66XBHT1Fx5qZSZbGMpSn2c=",
"owner": "nix-community", "owner": "nix-community",
"repo": "home-manager", "repo": "home-manager",
"rev": "5bac4a1c06cd77cf8fc35a658ccb035a6c50cd2c", "rev": "07682fff75d41f18327a871088d20af2710d4744",
"type": "github" "type": "github"
}, },
"original": { "original": {
@ -286,22 +170,6 @@
"type": "github" "type": "github"
} }
}, },
"latest": {
"locked": {
"lastModified": 1698134075,
"narHash": "sha256-foCD+nuKzfh49bIoiCBur4+Fx1nozo+4C/6k8BYk4sg=",
"owner": "nixos",
"repo": "nixpkgs",
"rev": "8efd5d1e283604f75a808a20e6cde0ef313d07d4",
"type": "github"
},
"original": {
"owner": "nixos",
"ref": "nixos-unstable",
"repo": "nixpkgs",
"type": "github"
}
},
"master": { "master": {
"locked": { "locked": {
"lastModified": 1686841982, "lastModified": 1686841982,
@ -318,19 +186,24 @@
"type": "github" "type": "github"
} }
}, },
"nixos": { "nix-darwin": {
"inputs": {
"nixpkgs": [
"nixpkgs"
]
},
"locked": { "locked": {
"lastModified": 1698288402, "lastModified": 1698429334,
"narHash": "sha256-jIIjApPdm+4yt8PglX8pUOexAdEiAax/DXW3S/Mb21E=", "narHash": "sha256-Gq3+QabboczSu7RMpcy79RSLMSqnySO3wsnHQk4DfbE=",
"owner": "nixos", "owner": "lnl7",
"repo": "nixpkgs", "repo": "nix-darwin",
"rev": "60b9db998f71ea49e1a9c41824d09aa274be1344", "rev": "afe83cbc2e673b1f08d32dd0f70df599678ff1e7",
"type": "github" "type": "github"
}, },
"original": { "original": {
"owner": "nixos", "owner": "lnl7",
"ref": "nixos-23.05", "ref": "master",
"repo": "nixpkgs", "repo": "nix-darwin",
"type": "github" "type": "github"
} }
}, },
@ -350,6 +223,21 @@
"type": "github" "type": "github"
} }
}, },
"nixos-flake": {
"locked": {
"lastModified": 1698598244,
"narHash": "sha256-YbvPFt+9CbCiqnuS0dTx+P+W1YRCqzhLXen94sef3Kk=",
"owner": "srid",
"repo": "nixos-flake",
"rev": "f6b7757ad88483afca306c9f3bf387887fba7284",
"type": "github"
},
"original": {
"owner": "srid",
"repo": "nixos-flake",
"type": "github"
}
},
"nixos-hardware": { "nixos-hardware": {
"locked": { "locked": {
"lastModified": 1693718952, "lastModified": 1693718952,
@ -366,6 +254,40 @@
} }
}, },
"nixpkgs": { "nixpkgs": {
"locked": {
"lastModified": 1699291058,
"narHash": "sha256-5ggduoaAMPHUy4riL+OrlAZE14Kh7JWX4oLEs22ZqfU=",
"owner": "nixos",
"repo": "nixpkgs",
"rev": "41de143fda10e33be0f47eab2bfe08a50f234267",
"type": "github"
},
"original": {
"owner": "nixos",
"ref": "nixos-23.05",
"repo": "nixpkgs",
"type": "github"
}
},
"nixpkgs-lib": {
"locked": {
"dir": "lib",
"lastModified": 1696019113,
"narHash": "sha256-X3+DKYWJm93DRSdC5M6K5hLqzSya9BjibtBsuARoPco=",
"owner": "NixOS",
"repo": "nixpkgs",
"rev": "f5892ddac112a1e9b3612c39af1b72987ee5783a",
"type": "github"
},
"original": {
"dir": "lib",
"owner": "NixOS",
"ref": "nixos-unstable",
"repo": "nixpkgs",
"type": "github"
}
},
"nixpkgs_2": {
"locked": { "locked": {
"lastModified": 1677383253, "lastModified": 1677383253,
"narHash": "sha256-UfpzWfSxkfXHnb4boXZNaKsAcUrZT9Hw+tao1oZxd08=", "narHash": "sha256-UfpzWfSxkfXHnb4boXZNaKsAcUrZT9Hw+tao1oZxd08=",
@ -381,38 +303,23 @@
"type": "github" "type": "github"
} }
}, },
"nixpkgs-unstable": {
"locked": {
"lastModified": 1672791794,
"narHash": "sha256-mqGPpGmwap0Wfsf3o2b6qHJW1w2kk/I6cGCGIU+3t6o=",
"owner": "nixos",
"repo": "nixpkgs",
"rev": "9813adc7f7c0edd738c6bdd8431439688bb0cb3d",
"type": "github"
},
"original": {
"owner": "nixos",
"ref": "nixos-unstable",
"repo": "nixpkgs",
"type": "github"
}
},
"root": { "root": {
"inputs": { "inputs": {
"agenix": "agenix", "agenix": "agenix",
"darwin": "darwin", "deploy-rs": "deploy-rs",
"deploy": "deploy",
"digga": "digga",
"flake-compat": "flake-compat", "flake-compat": "flake-compat",
"flake-parts": "flake-parts",
"fork": "fork", "fork": "fork",
"home": "home", "home-manager": "home-manager",
"latest": "latest",
"master": "master", "master": "master",
"nixos": "nixos", "nix-darwin": "nix-darwin",
"nixos-22-05": "nixos-22-05", "nixos-22-05": "nixos-22-05",
"nixos-flake": "nixos-flake",
"nixos-hardware": "nixos-hardware", "nixos-hardware": "nixos-hardware",
"nixpkgs": "nixpkgs",
"triton-vmtools": "triton-vmtools", "triton-vmtools": "triton-vmtools",
"tritonshell": "tritonshell" "tritonshell": "tritonshell",
"unstable": "unstable"
} }
}, },
"systems": { "systems": {
@ -447,9 +354,9 @@
}, },
"triton-vmtools": { "triton-vmtools": {
"inputs": { "inputs": {
"flake-utils": "flake-utils_3", "flake-utils": "flake-utils",
"nixpkgs": [ "nixpkgs": [
"latest" "unstable"
] ]
}, },
"locked": { "locked": {
@ -471,10 +378,10 @@
}, },
"tritonshell": { "tritonshell": {
"inputs": { "inputs": {
"devshell": "devshell_2", "devshell": "devshell",
"flake-utils": "flake-utils_4", "flake-utils": "flake-utils_2",
"nixpkgs": [ "nixpkgs": [
"latest" "unstable"
] ]
}, },
"locked": { "locked": {
@ -492,6 +399,22 @@
"url": "https://git.greenbaum.cloud/dev/tritonshell" "url": "https://git.greenbaum.cloud/dev/tritonshell"
} }
}, },
"unstable": {
"locked": {
"lastModified": 1699099776,
"narHash": "sha256-X09iKJ27mGsGambGfkKzqvw5esP1L/Rf8H3u3fCqIiU=",
"owner": "nixos",
"repo": "nixpkgs",
"rev": "85f1ba3e51676fa8cc604a3d863d729026a6b8eb",
"type": "github"
},
"original": {
"owner": "nixos",
"ref": "nixos-unstable",
"repo": "nixpkgs",
"type": "github"
}
},
"utils": { "utils": {
"locked": { "locked": {
"lastModified": 1667395993, "lastModified": 1667395993,

216
flake.nix
View file

@ -1,13 +1,13 @@
{ {
description = "A highly structured configuration database."; description = "teutat3s hosts in nix";
nixConfig.extra-experimental-features = "nix-command flakes"; nixConfig.extra-experimental-features = "nix-command flakes";
inputs = { inputs = {
# Track channels with commits tested and built by hydra # Track channels with commits tested and built by hydra
nixos-22-05.url = "github:nixos/nixpkgs/nixos-22.05"; nixos-22-05.url = "github:nixos/nixpkgs/nixos-22.05";
nixos.url = "github:nixos/nixpkgs/nixos-23.05"; nixpkgs.url = "github:nixos/nixpkgs/nixos-23.05";
latest.url = "github:nixos/nixpkgs/nixos-unstable"; unstable.url = "github:nixos/nixpkgs/nixos-unstable";
master.url = "github:nixos/nixpkgs/master"; master.url = "github:nixos/nixpkgs/master";
fork.url = "github:teutat3s/nixpkgs/nvfetcher-fix"; fork.url = "github:teutat3s/nixpkgs/nvfetcher-fix";
@ -15,177 +15,84 @@
flake-compat.url = "github:edolstra/flake-compat"; flake-compat.url = "github:edolstra/flake-compat";
flake-compat.flake = false; flake-compat.flake = false;
digga.url = "github:pub-solar/digga/fix/bootstrap-iso"; nix-darwin.url = "github:lnl7/nix-darwin/master";
digga.inputs.nixpkgs.follows = "nixos"; nix-darwin.inputs.nixpkgs.follows = "nixpkgs";
digga.inputs.nixlib.follows = "nixos";
digga.inputs.home-manager.follows = "home";
digga.inputs.deploy.follows = "deploy";
digga.inputs.darwin.follows = "darwin";
digga.inputs.flake-compat.follows = "flake-compat";
home.url = "github:nix-community/home-manager/release-23.05"; home-manager.url = "github:nix-community/home-manager/release-23.05";
home.inputs.nixpkgs.follows = "nixos"; home-manager.inputs.nixpkgs.follows = "nixpkgs";
darwin.url = "github:LnL7/nix-darwin"; flake-parts.url = "github:hercules-ci/flake-parts";
darwin.inputs.nixpkgs.follows = "nixos"; nixos-flake.url = "github:srid/nixos-flake";
deploy.url = "github:serokell/deploy-rs"; deploy-rs.url = "github:serokell/deploy-rs";
deploy.inputs.nixpkgs.follows = "nixos"; deploy-rs.inputs.nixpkgs.follows = "nixpkgs";
deploy.inputs.flake-compat.follows = "flake-compat"; deploy-rs.inputs.flake-compat.follows = "flake-compat";
agenix.url = "github:ryantm/agenix"; agenix.url = "github:ryantm/agenix";
agenix.inputs.nixpkgs.follows = "nixos"; agenix.inputs.nixpkgs.follows = "nixpkgs";
agenix.inputs.darwin.follows = "darwin"; agenix.inputs.darwin.follows = "nix-darwin";
nixos-hardware.url = "github:nixos/nixos-hardware"; nixos-hardware.url = "github:nixos/nixos-hardware";
# PubSolarOS additions # PubSolarOS additions
triton-vmtools.url = "git+https://git.pub.solar/pub-solar/infra-vintage?ref=main&dir=vmtools"; triton-vmtools.url = "git+https://git.pub.solar/pub-solar/infra-vintage?ref=main&dir=vmtools";
triton-vmtools.inputs.nixpkgs.follows = "latest"; triton-vmtools.inputs.nixpkgs.follows = "unstable";
tritonshell.url = "git+https://git.greenbaum.cloud/dev/tritonshell?ref=main"; tritonshell.url = "git+https://git.greenbaum.cloud/dev/tritonshell?ref=main";
tritonshell.inputs.nixpkgs.follows = "latest"; tritonshell.inputs.nixpkgs.follows = "unstable";
}; };
outputs = { outputs = inputs@{ self, ...}:
self, inputs.flake-parts.lib.mkFlake { inherit inputs; } {
digga, systems = [
nixos, "x86_64-linux"
home, "aarch64-linux"
nixos-hardware, "x86_64-darwin"
agenix, "aarch64-darwin"
deploy,
tritonshell,
...
} @ inputs:
digga.lib.mkFlake
{
inherit self inputs;
channelsConfig = {
allowUnfree = true;
};
supportedSystems = ["x86_64-linux" "aarch64-linux" "aarch64-darwin"];
channels = {
nixos = {
imports = [(digga.lib.importOverlays ./overlays)];
overlays = [
(self: super: {
deploy-rs = {
inherit (inputs.nixos.legacyPackages.x86_64-linux) deploy-rs;
lib = inputs.deploy.lib.x86_64-linux;
};
})
];
};
nixos-22-05 = {};
latest = {};
master = {};
fork = {};
};
lib = import ./lib {lib = digga.lib // nixos.lib;};
sharedOverlays = [
(final: prev: {
__dontExport = true;
lib = prev.lib.extend (lfinal: lprev: {
our = self.lib;
});
})
agenix.overlays.default
(import ./pkgs)
]; ];
nixos = { imports = [
hostDefaults = { inputs.nixos-flake.flakeModule
system = "x86_64-linux"; ./lib
channelName = "nixos"; ./modules
imports = [(digga.lib.importExportableModules ./modules)]; ./hosts
modules = [ ./users
{lib.our = self.lib;} ./overlays
# FIXME: upstream module causes a huge number of unnecessary ];
# dependencies to be pulled in for all systems -- many of them are
# graphical. should only be imported as needed. perSystem = args@{ system, pkgs, config, ... }: {
# digga.nixosModules.bootstrapIso _module.args = {
digga.nixosModules.nixConfig inherit inputs;
home.nixosModules.home-manager pkgs = import inputs.nixpkgs {
agenix.nixosModules.age inherit system;
overlays = [
inputs.agenix.overlays.default
];
};
unstable = import inputs.unstable { inherit system; };
master = import inputs.master { inherit system; };
};
devShells.default = pkgs.mkShell {
buildInputs = with pkgs; [
deploy-rs
nixpkgs-fmt
agenix
cachix
editorconfig-checker
nix
nodePackages.prettier
nvfetcher
shellcheck
shfmt
treefmt
nixos-generators
]; ];
}; };
imports = [(digga.lib.importHosts ./hosts)];
hosts = {
# Set host-specific properties here
bootstrap = {
modules = [
digga.nixosModules.bootstrapIso
];
};
PubSolarOS = {
tests = [
#(import ./tests/first-test.nix {
# pkgs = nixos.legacyPackages.x86_64-linux;
# lib = nixos.lib;
#})
];
};
fae = {
system = "aarch64-linux";
};
powder = {
system = "x86_64-linux";
};
};
importables = rec {
profiles =
digga.lib.rakeLeaves ./profiles
// {
users = digga.lib.rakeLeaves ./users;
};
suites = with profiles; rec {
base = [users.pub-solar users.root];
iso = base ++ [base-user graphical pub-solar-iso];
pubsolaros = [full-install base-user users.root];
anonymous = [pubsolaros users.pub-solar];
teutat3s = pubsolaros ++ [users.teutat3s];
dumpyourvms = teutat3s ++ [graphical];
ryzensun = teutat3s ++ [graphical];
};
};
}; };
home = { flake = {
imports = [(digga.lib.importExportableModules ./users/modules)]; deploy.nodes = self.b12f-os.lib.deploy.mkDeployNodes self.nixosConfigurations {
modules = [];
importables = rec {
profiles = digga.lib.rakeLeaves ./users/profiles;
suites = with profiles; rec {
base = [direnv];
};
};
users = {
pub-solar = {suites, ...}: {
imports = suites.base;
home.stateVersion = "21.03";
};
teutat3s = {suites, ...}: {
imports = suites.base;
home.stateVersion = "21.03";
};
}; # digga.lib.importers.rakeLeaves ./users/hm;
};
devshell = ./shell;
homeConfigurations = digga.lib.mkHomeConfigurations self.nixosConfigurations;
deploy.nodes = digga.lib.mkDeployNodes self.nixosConfigurations {
#example = { #example = {
# hostname = "example.com:22"; # hostname = "example.com:22";
# sshUser = "bartender"; # sshUser = "bartender";
@ -217,4 +124,5 @@
}; };
}; };
}; };
};
} }

103
hosts/default.nix Normal file
View file

@ -0,0 +1,103 @@
{ withSystem, self, inputs, ...}:
{
flake = {
nixosConfigurations = {
dumpyourvms = self.nixos-flake.lib.mkLinuxSystem {
nixpkgs.hostPlatform = "x86_64-linux";
imports = [
self.nixosModules.base
./dumpyourvms
self.nixosModules.teutat3s
self.nixosModules.audio
self.nixosModules.bluetooth
self.nixosModules.desktop-extended
self.nixosModules.docker
#self.nixosModules.email
self.nixosModules.graphical
self.nixosModules.nextcloud
self.nixosModules.office
self.nixosModules.printing
#self.nixosModules.wireguard-client
];
};
ryzensun = self.nixos-flake.lib.mkLinuxSystem {
nixpkgs.hostPlatform = "x86_64-linux";
imports = [
self.nixosModules.base
./ryzensun
self.nixosModules.teutat3s
self.nixosModules.audio
self.nixosModules.desktop-extended
self.nixosModules.docker
#self.nixosModules.email
#self.nixosModules.gaming
self.nixosModules.graphical
self.nixosModules.nextcloud
self.nixosModules.office
self.nixosModules.printing
self.nixosModules.virtualisation
#self.nixosModules.wireguard-client
];
};
#fae = self.nixos-flake.lib.mkLinuxSystem {
# nixpkgs.hostPlatform = "x86_64-linux";
# imports = [
# self.nixosModules.base
# ./fae
# self.nixosModules.teutat3s
# self.nixosModules.wireguard-client
# ];
#};
#powder = self.nixos-flake.lib.mkLinuxSystem {
# nixpkgs.hostPlatform = "aarch64-linux";
# imports = [
# self.nixosModules.base
# inputs.nixos-hardware.nixosModules.raspberry-pi-4
# ./powder
# self.nixosModules.teutat3s
# self.nixosModules.docker
# self.nixosModules.wireguard-client
# self.nixosModules.invoiceplane
# ];
#};
iso = self.nixos-flake.lib.mkLinuxSystem {
nixpkgs.hostPlatform = "x86_64-linux";
imports = [
"${inputs.nixpkgs}/nixos/modules/installer/cd-dvd/installation-cd-minimal.nix"
self.nixosModules.base
./iso
self.nixosModules.nixos
];
};
iso-arm = self.nixos-flake.lib.mkLinuxSystem {
nixpkgs.hostPlatform = "aarch64-linux";
nixpkgs.buildPlatform = "x86_64-linux";
imports = [
"${inputs.nixpkgs}/nixos/modules/installer/cd-dvd/installation-cd-minimal.nix"
self.nixosModules.base
./iso
self.nixosModules.nixos
];
};
iso-graphical = self.nixos-flake.lib.mkLinuxSystem {
nixpkgs.hostPlatform = "x86_64-linux";
imports = [
"${inputs.nixpkgs}/nixos/modules/installer/cd-dvd/installation-cd-minimal.nix"
self.nixosModules.base
./iso
self.nixosModules.nixos
self.nixosModules.graphical
self.nixosModules.audio
self.nixosModules.bluetooth
({ ... }: { pub-solar.graphical.wayland.software-renderer.enable = true; })
];
};
};
};
}

13
hosts/dumpyourvms/default.nix
View file

@ -1,7 +1,8 @@
{suites, ...}: { { ... }: {
imports = imports = [
[ ./dumpyourvms.nix
./dumpyourvms.nix ./hardware-configuration.nix
]
++ suites.dumpyourvms; ./networking.nix
];
} }

349
hosts/dumpyourvms/dumpyourvms.nix
View file

@ -1,197 +1,178 @@
{ {
config, config,
pkgs,
lib, lib,
self, pkgs,
... ...
}: }:
with lib; let with lib; let
psCfg = config.pub-solar; psCfg = config.pub-solar;
xdg = config.home-manager.users."${psCfg.user.name}".xdg; xdg = config.home-manager.users."${psCfg.user.name}".xdg;
in { in {
imports = [ pub-solar = {
./hardware-configuration.nix terminal-life.full = true;
]; core.hibernation = {
config = {
age.secrets.environment-secrets = {
file = "${self}/secrets/environment-secrets.age";
mode = "700";
owner = "teutat3s";
};
age.secrets.github-api-token = {
file = "${self}/secrets/github-api-token.age";
mode = "600";
owner = "teutat3s";
path = "/home/${psCfg.user.name}/.local/share/github/api-token";
};
pub-solar = {
audio.mopidy.enable = lib.mkForce false;
core.hibernation = {
enable = true;
resumeDevice = "/dev/mapper/cryptroot";
resumeOffset = 47366144;
};
virtualisation.enable = true;
};
# Fix backlight for keyboard and brightness, adjust function key binding,
# intel_pstate for cpu schedutil
# For now, the radeon driver seems to work better than amdgpu with Radeon R9 M370X
# Explicitly set amdgpu support in place of radeon
# Source: https://github.com/NixOS/nixos-hardware/blob/master/common/gpu/amd/southern-islands/default.nix
# Try again after https://lists.freedesktop.org/archives/amd-gfx/2023-March/090096.html lands
boot.kernelParams = ["acpi_backlight=video" "hid_apple.fnmode=2" "intel_pstate=passive" "radeon.si_support=0" "amdgpu.si_support=1"];
boot.loader.efi.canTouchEfiVariables = true;
# Fix for Error switching console mode to 1: unsupported on startup
boot.loader.systemd-boot.consoleMode = mkForce "0";
boot.binfmt.emulatedSystems = ["aarch64-linux"];
systemd.sleep.extraConfig = ''
HibernateMode=shutdown
'';
hardware = {
cpu.intel.updateMicrocode = true;
facetimehd.enable = true;
opengl = {
extraPackages = with pkgs; [intel-media-driver];
};
};
services.resolved = {
enable = true; enable = true;
# DNSSEC=false because of random SERVFAIL responses with Greenbaum DNS resumeDevice = "/dev/mapper/cryptroot";
# when using allow-downgrade, see https://github.com/systemd/systemd/issues/10579 resumeOffset = 47366144;
extraConfig = ''
DNS=5.1.66.255#dot.ffmuc.net 185.150.99.255#dot.ffmuc.net 5.9.164.112#dns3.digitalcourage.de 89.233.43.71#unicast.censurfridns.dk 185.49.141.37#getdnsapi.net 2001:678:e68:f000::#dot.ffmuc.net 2001:678:ed0:f000::#dot.ffmuc.net 2a01:4f8:251:554::2#dns3.digitalcourage.de 2a01:3a0:53:53::0#unicast.censurfridns.dk 2a04:b900:0:100::38#getdnsapi.net
FallbackDNS=9.9.9.9#dns.quad9.net 149.112.112.112#dns.quad9.net 2620:fe::fe#dns.quad9.net 2620:fe::9#dns.quad9.net
Domains=~.
DNSOverTLS=yes
DNSSEC=false
'';
}; };
networking = import ./networking.nix;
services.tailscale.enable = true;
security.pki.certificateFiles = [./consul-agent-ca.pem];
# Power off dedicated GPU, use only integrated Intel GPU to save battery
# https://github.com/NixOS/nixpkgs/pull/33915
# https://ubuntuforums.org/showthread.php?t=2409856
systemd.services."amd-hybrid-graphics-power-save" = {
path = [pkgs.bash];
description = "Power Off dedicated AMD Card to reduce power usage";
requires = ["sys-kernel-debug.mount"];
enable = true;
serviceConfig = {
Type = "oneshot";
RemainAfterExit = true;
ExecStart = "${pkgs.bash}/bin/sh -c 'sleep 7 && if grep --quiet 'IGD:+' /sys/kernel/debug/vgaswitcheroo/switch; then echo -e \"IGD\\nOFF\" > /sys/kernel/debug/vgaswitcheroo/switch; fi'";
ExecStop = "${pkgs.bash}/bin/sh -c 'echo ON >/sys/kernel/debug/vgaswitcheroo/switch'";
};
wantedBy = ["multi-user.target"];
};
# Increase console font size for HiDPI display
console = {
earlySetup = true;
font = lib.mkForce "ter-i32b";
packages = [pkgs.terminus_font];
};
# Thunderbolt tools
services.hardware.bolt.enable = true;
# Enable udev rules for gnupg smart cards
hardware.gpgSmartcards.enable = true;
powerManagement = {
# Use new schedutil govenor
# https://github.com/NixOS/nixpkgs/pull/42330
# https://www.kernel.org/doc/html/v5.10/admin-guide/pm/cpufreq.html#schedutil
cpuFreqGovernor = lib.mkDefault "schedutil";
# brcmfmac being loaded during hibernation would inhibit a successful resume
# https://bugzilla.kernel.org/show_bug.cgi?id=101681#c116.
# Also brcmfmac could randomly crash on resume from sleep.
# To hibernate successfully using the amdgpu driver, the dedicated GPU needs
# to be powered on.
powerUpCommands = lib.mkBefore (
"${pkgs.kmod}/bin/modprobe brcmfmac"
+ lib.optionalString
(lib.versionAtLeast config.boot.kernelPackages.kernel.version "6.2") " brcmfmac_wcc"
);
powerDownCommands = lib.mkBefore (
lib.optionalString
(lib.versionAtLeast config.boot.kernelPackages.kernel.version "6.2")
"${pkgs.kmod}/bin/rmmod brcmfmac_wcc\n"
+ ''
${pkgs.kmod}/bin/rmmod brcmfmac
${pkgs.systemd}/bin/systemctl stop amd-hybrid-graphics-power-save.service
''
);
resumeCommands =
if config.systemd.services."amd-hybrid-graphics-power-save".enable == true
then ''
${pkgs.systemd}/bin/systemctl start amd-hybrid-graphics-power-save.service
''
else "";
};
# Change lid switch behaviour
services.logind.lidSwitch = "hibernate";
# TLP for power management
services.tlp = {
enable = true;
settings = {
CPU_SCALING_GOVERNOR_ON_AC = "performance";
CPU_SCALING_GOVERNOR_ON_BAT = "schedutil";
CPU_BOOST_ON_AC = 1;
CPU_BOOST_ON_BAT = 0;
};
};
services.udev.extraRules =
# Disable XHC1 wakeup signal to avoid resume getting triggered some time
# after suspend. Reboot required for this to take effect.
lib.optionalString
(lib.versionAtLeast config.boot.kernelPackages.kernel.version "3.13")
''SUBSYSTEM=="pci", KERNEL=="0000:00:14.0", ATTR{power/wakeup}="disabled"'';
services.printing.enable = true;
home-manager = pkgs.lib.setAttrByPath ["users" psCfg.user.name] {
# Custom device sway configs
xdg.configFile = mkIf psCfg.sway.enable {
"sway/config.d/10-applications.conf".source = ./.config/sway/config.d/applications.conf;
"sway/config.d/autostart.conf".source = ./.config/sway/config.d/autostart.conf;
"sway/config.d/10-custom-keybindings.conf".source = ./.config/sway/config.d/custom-keybindings.conf;
"sway/config.d/input-defaults.conf".source = ./.config/sway/config.d/input-defaults.conf;
"sway/config.d/screens.conf".source = ./.config/sway/config.d/screens.conf;
};
};
# WLAN frequency compliance (e.g. check for radar with DFS)
hardware.firmware = with pkgs; [wireless-regdb];
boot.extraModprobeConfig = ''
options cfg80211 ieee80211_regdom="DE"
# Enable the integrated GPU (iGPU) Intel i915 by default if present
options apple-gmux force_igd=y
'';
# This value determines the NixOS release from which the default
# settings for stateful data, like file locations and database versions
# on your system were taken. It‘s perfectly fine and recommended to leave
# this value at the release version of the first install of this system.
# Before changing this value read the documentation for this option
# (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
system.stateVersion = "21.05"; # Did you read the comment?
}; };
boot.kernelPackages = pkgs.linuxPackages_6_6;
# Fix backlight for keyboard and brightness, adjust function key binding,
# intel_pstate for cpu schedutil
# For now, the radeon driver seems to work better than amdgpu with Radeon R9 M370X
# Explicitly set amdgpu support in place of radeon
# Source: https://github.com/NixOS/nixos-hardware/blob/master/common/gpu/amd/southern-islands/default.nix
# Try again after https://lists.freedesktop.org/archives/amd-gfx/2023-March/090096.html lands
boot.kernelParams = ["acpi_backlight=video" "hid_apple.fnmode=2" "intel_pstate=passive" "radeon.si_support=0" "amdgpu.si_support=1"];
boot.loader.efi.canTouchEfiVariables = true;
# Fix for Error switching console mode to 1: unsupported on startup
boot.loader.systemd-boot.consoleMode = mkForce "0";
boot.binfmt.emulatedSystems = ["aarch64-linux"];
systemd.sleep.extraConfig = ''
HibernateMode=shutdown
'';
hardware = {
cpu.intel.updateMicrocode = true;
facetimehd.enable = true;
opengl = {
extraPackages = with pkgs; [intel-media-driver];
};
};
networking.hostName = "dumpyourvms";
services.resolved = {
enable = true;
# DNSSEC=false because of random SERVFAIL responses with Greenbaum DNS
# when using allow-downgrade, see https://github.com/systemd/systemd/issues/10579
extraConfig = ''
DNS=5.1.66.255#dot.ffmuc.net 185.150.99.255#dot.ffmuc.net 5.9.164.112#dns3.digitalcourage.de 89.233.43.71#unicast.censurfridns.dk 185.49.141.37#getdnsapi.net 2001:678:e68:f000::#dot.ffmuc.net 2001:678:ed0:f000::#dot.ffmuc.net 2a01:4f8:251:554::2#dns3.digitalcourage.de 2a01:3a0:53:53::0#unicast.censurfridns.dk 2a04:b900:0:100::38#getdnsapi.net
FallbackDNS=9.9.9.9#dns.quad9.net 149.112.112.112#dns.quad9.net 2620:fe::fe#dns.quad9.net 2620:fe::9#dns.quad9.net
Domains=~.
DNSOverTLS=yes
DNSSEC=false
'';
};
services.tailscale.enable = true;
security.pki.certificateFiles = [./consul-agent-ca.pem];
# Power off dedicated GPU, use only integrated Intel GPU to save battery
# https://github.com/NixOS/nixpkgs/pull/33915
# https://ubuntuforums.org/showthread.php?t=2409856
systemd.services."amd-hybrid-graphics-power-save" = {
path = [pkgs.bash];
description = "Power Off dedicated AMD Card to reduce power usage";
requires = ["sys-kernel-debug.mount"];
enable = true;
serviceConfig = {
Type = "oneshot";
RemainAfterExit = true;
ExecStart = "${pkgs.bash}/bin/sh -c 'sleep 7 && if grep --quiet 'IGD:+' /sys/kernel/debug/vgaswitcheroo/switch; then echo -e \"IGD\\nOFF\" > /sys/kernel/debug/vgaswitcheroo/switch; fi'";
ExecStop = "${pkgs.bash}/bin/sh -c 'echo ON >/sys/kernel/debug/vgaswitcheroo/switch'";
};
wantedBy = ["multi-user.target"];
};
# Increase console font size for HiDPI display
console = {
earlySetup = true;
font = lib.mkForce "ter-i32b";
packages = [pkgs.terminus_font];
};
# Thunderbolt tools
services.hardware.bolt.enable = true;
# Enable udev rules for gnupg smart cards
hardware.gpgSmartcards.enable = true;
powerManagement = {
# Use new schedutil govenor
# https://github.com/NixOS/nixpkgs/pull/42330
# https://www.kernel.org/doc/html/v5.10/admin-guide/pm/cpufreq.html#schedutil
cpuFreqGovernor = lib.mkDefault "schedutil";
# brcmfmac being loaded during hibernation would inhibit a successful resume
# https://bugzilla.kernel.org/show_bug.cgi?id=101681#c116.
# Also brcmfmac could randomly crash on resume from sleep.
# To hibernate successfully using the amdgpu driver, the dedicated GPU needs
# to be powered on.
powerUpCommands = lib.mkBefore (
"${pkgs.kmod}/bin/modprobe brcmfmac"
+ lib.optionalString
(lib.versionAtLeast config.boot.kernelPackages.kernel.version "6.2") " brcmfmac_wcc"
);
powerDownCommands = lib.mkBefore (
lib.optionalString
(lib.versionAtLeast config.boot.kernelPackages.kernel.version "6.2")
"${pkgs.kmod}/bin/rmmod brcmfmac_wcc\n"
+ ''
${pkgs.kmod}/bin/rmmod brcmfmac
${pkgs.systemd}/bin/systemctl stop amd-hybrid-graphics-power-save.service
''
);
resumeCommands =
if config.systemd.services."amd-hybrid-graphics-power-save".enable == true
then ''
${pkgs.systemd}/bin/systemctl start amd-hybrid-graphics-power-save.service
''
else "";
};
# Change lid switch behaviour
services.logind.lidSwitch = "hibernate";
# TLP for power management
services.tlp = {
enable = true;
settings = {
CPU_SCALING_GOVERNOR_ON_AC = "performance";
CPU_SCALING_GOVERNOR_ON_BAT = "schedutil";
CPU_BOOST_ON_AC = 1;
CPU_BOOST_ON_BAT = 0;
};
};
services.udev.extraRules =
# Disable XHC1 wakeup signal to avoid resume getting triggered some time
# after suspend. Reboot required for this to take effect.
lib.optionalString
(lib.versionAtLeast config.boot.kernelPackages.kernel.version "3.13")
''SUBSYSTEM=="pci", KERNEL=="0000:00:14.0", ATTR{power/wakeup}="disabled"'';
services.printing.enable = true;
home-manager = pkgs.lib.setAttrByPath ["users" psCfg.user.name] {
# Custom device sway configs
xdg.configFile = {
"sway/config.d/10-applications.conf".source = ./.config/sway/config.d/applications.conf;
"sway/config.d/autostart.conf".source = ./.config/sway/config.d/autostart.conf;
"sway/config.d/10-custom-keybindings.conf".source = ./.config/sway/config.d/custom-keybindings.conf;
"sway/config.d/input-defaults.conf".source = ./.config/sway/config.d/input-defaults.conf;
"sway/config.d/screens.conf".source = ./.config/sway/config.d/screens.conf;
};
};
# WLAN frequency compliance (e.g. check for radar with DFS)
hardware.firmware = with pkgs; [wireless-regdb];
boot.extraModprobeConfig = ''
options cfg80211 ieee80211_regdom="DE"
# Enable the integrated GPU (iGPU) Intel i915 by default if present
options apple-gmux force_igd=y
'';
# This value determines the NixOS release from which the default
# settings for stateful data, like file locations and database versions
# on your system were taken. It‘s perfectly fine and recommended to leave
# this value at the release version of the first install of this system.
# Before changing this value read the documentation for this option
# (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
system.stateVersion = "21.05"; # Did you read the comment?
} }

204
hosts/dumpyourvms/networking.nix
View file

@ -1,112 +1,114 @@
{ {
networkmanager.dns = "systemd-resolved"; networking = {
networkmanager.dns = "systemd-resolved";
# https://github.com/tailscale/tailscale/issues/4432#issuecomment-1112819111 # https://github.com/tailscale/tailscale/issues/4432#issuecomment-1112819111
# https://github.com/NixOS/nixpkgs/commit/68e514ed1cf55451901e8d0edd3e8ee5102d3565 # https://github.com/NixOS/nixpkgs/commit/68e514ed1cf55451901e8d0edd3e8ee5102d3565
#firewall.checkReversePath = "loose"; #firewall.checkReversePath = "loose";
hosts = { hosts = {
"10.0.0.42" = ["nomad.service.consul" "nomad.service.cgn-1.consul"]; "10.0.0.42" = ["nomad.service.consul" "nomad.service.cgn-1.consul"];
"10.0.0.66" = ["consul.service.cgn-1.consul"]; "10.0.0.66" = ["consul.service.cgn-1.consul"];
"10.0.1.9" = ["consul.service.lev-1.consul"]; "10.0.1.9" = ["consul.service.lev-1.consul"];
"10.0.0.70" = ["vault.service.consul" "vault.service.cgn-1.consul"]; "10.0.0.70" = ["vault.service.consul" "vault.service.cgn-1.consul"];
"10.0.0.200" = ["headnode.cgn-1"]; "10.0.0.200" = ["headnode.cgn-1"];
"10.0.0.201" = ["cn01.cgn-1"]; "10.0.0.201" = ["cn01.cgn-1"];
"10.0.0.202" = ["cn02.cgn-1"]; "10.0.0.202" = ["cn02.cgn-1"];
"10.0.0.205" = ["cn05.cgn-1"]; "10.0.0.205" = ["cn05.cgn-1"];
"10.0.0.206" = ["cn06.cgn-1"]; "10.0.0.206" = ["cn06.cgn-1"];
"10.0.0.207" = ["cn07.cgn-1"]; "10.0.0.207" = ["cn07.cgn-1"];
"10.0.0.208" = ["cn08.cgn-1"]; "10.0.0.208" = ["cn08.cgn-1"];
"10.0.1.200" = ["headnode.lev-1"]; "10.0.1.200" = ["headnode.lev-1"];
"10.0.1.201" = ["cn01.lev-1"]; "10.0.1.201" = ["cn01.lev-1"];
"10.0.1.202" = ["cn02.lev-1"]; "10.0.1.202" = ["cn02.lev-1"];
"10.0.1.203" = ["cn03.lev-1"]; "10.0.1.203" = ["cn03.lev-1"];
"10.0.1.204" = ["cn04.lev-1"]; "10.0.1.204" = ["cn04.lev-1"];
"10.0.1.205" = ["cn05.lev-1"]; "10.0.1.205" = ["cn05.lev-1"];
"10.0.1.206" = ["cn00.lev-1"]; "10.0.1.206" = ["cn00.lev-1"];
"10.0.1.207" = ["cn06.lev-1"]; "10.0.1.207" = ["cn06.lev-1"];
"10.0.1.208" = ["cn07.lev-1"]; "10.0.1.208" = ["cn07.lev-1"];
"10.101.64.10" = ["wifi.bahn.de"]; "10.101.64.10" = ["wifi.bahn.de"];
};
wireguard.enable = true;
wg-quick.interfaces = {
wg0 = {
address = ["10.8.8.6/32"];
privateKeyFile = "/etc/wireguard/wg0.privatekey";
peers = [
{
publicKey = "l0DJLicCrcrixNP6zAWTXNSEaNM2jML253BXEZ1KpiU=";
allowedIPs = ["10.8.8.16/32" "10.0.0.0/24" "10.88.88.0/24"];
endpoint = "85.88.23.16:51820";
persistentKeepalive = 25;
}
];
}; };
wg1 = {
address = ["192.168.188.203/24"];
privateKeyFile = "/etc/wireguard/wg1.privatekey";
peers = [ wireguard.enable = true;
{ wg-quick.interfaces = {
publicKey = "iZkgeA/mFxBRclCa5SJYdqffClly/uho5krebcUloCY="; wg0 = {
allowedIPs = ["192.168.188.0/24"]; address = ["10.8.8.6/32"];
presharedKeyFile = "/etc/wireguard/wg1.presharedkey"; privateKeyFile = "/etc/wireguard/wg0.privatekey";
#endpoint = "85.214.70.91:50163";
#endpoint = "7gwzft61sc8txc4r.myfritz.net:50163";
endpoint = "[2a00:6020:1000:47::2ded]:50163";
persistentKeepalive = 25;
}
];
};
wg2 = {
address = ["10.6.6.4/32"];
privateKeyFile = "/etc/wireguard/wg2.privatekey";
peers = [ peers = [
{ {
publicKey = "nYMmaCIW8lZ7SokivN8HXxYDch+SS1G7ab1SC9meDAw="; publicKey = "l0DJLicCrcrixNP6zAWTXNSEaNM2jML253BXEZ1KpiU=";
presharedKeyFile = "/etc/wireguard/wg2.presharedkey"; allowedIPs = ["10.8.8.16/32" "10.0.0.0/24" "10.88.88.0/24"];
allowedIPs = ["10.6.6.1/32" "10.1.1.0/24"]; endpoint = "85.88.23.16:51820";
endpoint = "85.88.23.127:51820"; persistentKeepalive = 25;
persistentKeepalive = 16; }
} ];
]; };
}; wg1 = {
wg3 = { address = ["192.168.188.203/24"];
address = ["10.11.11.2/32"]; privateKeyFile = "/etc/wireguard/wg1.privatekey";
privateKeyFile = "/etc/wireguard/wg3.privatekey";
mtu = 1300;
peers = [ peers = [
{ {
publicKey = "7RRgfZSneqAtAHBeI6+aaYLqz9e1jikg/lIK8mhW928="; publicKey = "iZkgeA/mFxBRclCa5SJYdqffClly/uho5krebcUloCY=";
presharedKeyFile = "/etc/wireguard/wg3.presharedkey"; allowedIPs = ["192.168.188.0/24"];
allowedIPs = ["10.11.11.0/24" "192.168.1.0/24" "10.0.1.0/24"]; presharedKeyFile = "/etc/wireguard/wg1.presharedkey";
endpoint = "80.71.153.1:51820"; #endpoint = "85.214.70.91:50163";
persistentKeepalive = 16; #endpoint = "7gwzft61sc8txc4r.myfritz.net:50163";
} endpoint = "[2a00:6020:1000:47::2ded]:50163";
]; persistentKeepalive = 25;
}; }
wg4 = { ];
address = ["fdaa:1:3234:a7b:16a9:0:a:202/120"]; };
privateKeyFile = "/etc/wireguard/wg4.privatekey"; wg2 = {
postUp = "resolvectl dns wg4 fdaa:1:3234::3; resolvectl domain wg4 ~internal"; address = ["10.6.6.4/32"];
preDown = "resolvectl revert wg4"; privateKeyFile = "/etc/wireguard/wg2.privatekey";
#dns = [
# "fdaa:1:3234::3, internal"
#];
peers = [ peers = [
{ {
publicKey = "yUyg63j5+17YeJ7gRhxoQuF6rvdX0JF59M6skytJFTQ="; publicKey = "nYMmaCIW8lZ7SokivN8HXxYDch+SS1G7ab1SC9meDAw=";
allowedIPs = ["fdaa:1:3234::/48"]; presharedKeyFile = "/etc/wireguard/wg2.presharedkey";
#endpoint = "ams1.gateway.6pn.dev:51820"; allowedIPs = ["10.6.6.1/32" "10.1.1.0/24"];
endpoint = "176.58.93.206:51820"; endpoint = "85.88.23.127:51820";
persistentKeepalive = 15; persistentKeepalive = 16;
} }
]; ];
};
wg3 = {
address = ["10.11.11.2/32"];
privateKeyFile = "/etc/wireguard/wg3.privatekey";
mtu = 1300;
peers = [
{
publicKey = "7RRgfZSneqAtAHBeI6+aaYLqz9e1jikg/lIK8mhW928=";
presharedKeyFile = "/etc/wireguard/wg3.presharedkey";
allowedIPs = ["10.11.11.0/24" "192.168.1.0/24" "10.0.1.0/24"];
endpoint = "80.71.153.1:51820";
persistentKeepalive = 16;
}
];
};
wg4 = {
address = ["fdaa:1:3234:a7b:16a9:0:a:202/120"];
privateKeyFile = "/etc/wireguard/wg4.privatekey";
postUp = "resolvectl dns wg4 fdaa:1:3234::3; resolvectl domain wg4 ~internal";
preDown = "resolvectl revert wg4";
#dns = [
# "fdaa:1:3234::3, internal"
#];
peers = [
{
publicKey = "yUyg63j5+17YeJ7gRhxoQuF6rvdX0JF59M6skytJFTQ=";
allowedIPs = ["fdaa:1:3234::/48"];
#endpoint = "ams1.gateway.6pn.dev:51820";
endpoint = "176.58.93.206:51820";
persistentKeepalive = 15;
}
];
};
}; };
}; };
} }

10
hosts/iso/default.nix Normal file
View file

@ -0,0 +1,10 @@
{
pkgs,
lib,
...
}: {
pub-solar.core.disk-encryption-active = false;
isoImage.squashfsCompression = "gzip -Xcompression-level 1";
systemd.services.sshd.wantedBy = lib.mkForce [ "multi-user.target" ];
networking.networkmanager.enable = false;
}

13
hosts/ryzensun/default.nix
View file

@ -1,7 +1,8 @@
{suites, ...}: { { ... }: {
imports = imports = [
[ ./ryzensun.nix
./ryzensun.nix ./hardware-configuration.nix
]
++ suites.ryzensun; ./networking.nix
];
} }

158
hosts/ryzensun/networking.nix
View file

@ -1,84 +1,86 @@
{ {
hosts = { networking = {
"10.0.0.42" = ["nomad.service.consul" "nomad.service.cgn-1.consul"]; hosts = {
"10.0.0.66" = ["consul.service.cgn-1.consul"]; "10.0.0.42" = ["nomad.service.consul" "nomad.service.cgn-1.consul"];
"10.0.1.9" = ["consul.service.lev-1.consul"]; "10.0.0.66" = ["consul.service.cgn-1.consul"];
"10.0.0.70" = ["vault.service.consul" "vault.service.cgn-1.consul"]; "10.0.1.9" = ["consul.service.lev-1.consul"];
"10.0.0.200" = ["headnode.cgn-1"]; "10.0.0.70" = ["vault.service.consul" "vault.service.cgn-1.consul"];
"10.0.0.201" = ["cn01.cgn-1"]; "10.0.0.200" = ["headnode.cgn-1"];
"10.0.0.202" = ["cn02.cgn-1"]; "10.0.0.201" = ["cn01.cgn-1"];
"10.0.0.205" = ["cn05.cgn-1"]; "10.0.0.202" = ["cn02.cgn-1"];
"10.0.0.206" = ["cn06.cgn-1"]; "10.0.0.205" = ["cn05.cgn-1"];
"10.0.0.207" = ["cn07.cgn-1"]; "10.0.0.206" = ["cn06.cgn-1"];
"10.0.0.208" = ["cn08.cgn-1"]; "10.0.0.207" = ["cn07.cgn-1"];
"10.0.1.200" = ["headnode.lev-1"]; "10.0.0.208" = ["cn08.cgn-1"];
"10.0.1.201" = ["cn01.lev-1"]; "10.0.1.200" = ["headnode.lev-1"];
"10.0.1.202" = ["cn02.lev-1"]; "10.0.1.201" = ["cn01.lev-1"];
"10.0.1.203" = ["cn03.lev-1"]; "10.0.1.202" = ["cn02.lev-1"];
"10.0.1.204" = ["cn04.lev-1"]; "10.0.1.203" = ["cn03.lev-1"];
"10.0.1.205" = ["cn05.lev-1"]; "10.0.1.204" = ["cn04.lev-1"];
"10.0.1.206" = ["cn00.lev-1"]; "10.0.1.205" = ["cn05.lev-1"];
"10.0.1.207" = ["cn06.lev-1"]; "10.0.1.206" = ["cn00.lev-1"];
"10.0.1.208" = ["cn07.lev-1"]; "10.0.1.207" = ["cn06.lev-1"];
}; "10.0.1.208" = ["cn07.lev-1"];
wireguard.enable = true;
wg-quick.interfaces = {
wg0 = {
address = ["10.8.8.7/32"];
privateKeyFile = "/etc/wireguard/wg0.privatekey";
peers = [
{
publicKey = "l0DJLicCrcrixNP6zAWTXNSEaNM2jML253BXEZ1KpiU=";
allowedIPs = ["10.8.8.16/32" "10.0.0.0/24" "10.88.88.0/24"];
endpoint = "85.88.23.16:51820";
persistentKeepalive = 25;
}
];
}; };
wg1 = {
address = ["10.11.11.6/32"];
privateKeyFile = "/etc/wireguard/wg1.privatekey";
mtu = 1300;
peers = [ wireguard.enable = true;
{ wg-quick.interfaces = {
publicKey = "7RRgfZSneqAtAHBeI6+aaYLqz9e1jikg/lIK8mhW928="; wg0 = {
presharedKeyFile = "/etc/wireguard/wg1.presharedkey"; address = ["10.8.8.7/32"];
allowedIPs = ["10.11.11.0/24" "192.168.1.0/24" "10.0.1.0/24"]; privateKeyFile = "/etc/wireguard/wg0.privatekey";
endpoint = "80.71.153.1:51820";
#persistentKeepalive = 16; peers = [
} {
]; publicKey = "l0DJLicCrcrixNP6zAWTXNSEaNM2jML253BXEZ1KpiU=";
allowedIPs = ["10.8.8.16/32" "10.0.0.0/24" "10.88.88.0/24"];
endpoint = "85.88.23.16:51820";
persistentKeepalive = 25;
}
];
};
wg1 = {
address = ["10.11.11.6/32"];
privateKeyFile = "/etc/wireguard/wg1.privatekey";
mtu = 1300;
peers = [
{
publicKey = "7RRgfZSneqAtAHBeI6+aaYLqz9e1jikg/lIK8mhW928=";
presharedKeyFile = "/etc/wireguard/wg1.presharedkey";
allowedIPs = ["10.11.11.0/24" "192.168.1.0/24" "10.0.1.0/24"];
endpoint = "80.71.153.1:51820";
#persistentKeepalive = 16;
}
];
};
#wg1 = {
# address = [ "10.13.0.1/32" ];
# privateKeyFile = "/etc/wireguard/wg1.privatekey";
# mtu = 1412;
# peers = [
# {
# publicKey = "XS3TTIMU7Jp3JJANBpE14RsVDJk6/VUvZgjQgQP8kAs=";
# allowedIPs = [ "10.13.0.100/32" "192.168.188.0/24" ];
# endpoint = "[2a00:6020:48ad:dd00:dea6:32ff:fe85:3306]:51820";
# persistentKeepalive = 25;
# }
# ];
#};
#wg2 = {
# address = [ "10.6.6.4/32" ];
# privateKeyFile = "/etc/wireguard/wg2.privatekey";
# peers = [
# {
# publicKey = "nYMmaCIW8lZ7SokivN8HXxYDch+SS1G7ab1SC9meDAw=";
# presharedKeyFile = "/etc/wireguard/wg2.presharedkey";
# allowedIPs = [ "10.6.6.1/32" "10.1.1.0/24" ];
# endpoint = "85.88.23.127:51820";
# persistentKeepalive = 16;
# }
# ];
#};
}; };
#wg1 = {
# address = [ "10.13.0.1/32" ];
# privateKeyFile = "/etc/wireguard/wg1.privatekey";
# mtu = 1412;
# peers = [
# {
# publicKey = "XS3TTIMU7Jp3JJANBpE14RsVDJk6/VUvZgjQgQP8kAs=";
# allowedIPs = [ "10.13.0.100/32" "192.168.188.0/24" ];
# endpoint = "[2a00:6020:48ad:dd00:dea6:32ff:fe85:3306]:51820";
# persistentKeepalive = 25;
# }
# ];
#};
#wg2 = {
# address = [ "10.6.6.4/32" ];
# privateKeyFile = "/etc/wireguard/wg2.privatekey";
# peers = [
# {
# publicKey = "nYMmaCIW8lZ7SokivN8HXxYDch+SS1G7ab1SC9meDAw=";
# presharedKeyFile = "/etc/wireguard/wg2.presharedkey";
# allowedIPs = [ "10.6.6.1/32" "10.1.1.0/24" ];
# endpoint = "85.88.23.127:51820";
# persistentKeepalive = 16;
# }
# ];
#};
}; };
} }

42
hosts/ryzensun/ryzensun.nix
View file

@ -2,44 +2,34 @@
config, config,
pkgs, pkgs,
lib, lib,
self, flake,
... ...
}: }:
with lib; let with lib; let
psCfg = config.pub-solar; psCfg = config.pub-solar;
xdg = config.home-manager.users."${psCfg.user.name}".xdg; xdg = config.home-manager.users."${psCfg.user.name}".xdg;
in { in {
imports = [
./hardware-configuration.nix
];
config = { config = {
age.secrets.environment-secrets = { age.secrets.environment-secrets = {
file = "${self}/secrets/environment-secrets.age"; file = "${flake.self}/secrets/environment-secrets.age";
mode = "700"; mode = "600";
owner = "teutat3s"; owner = "teutat3s";
}; };
age.secrets.docker-ci-runner-secrets = { age.secrets.docker-ci-runner-secrets = {
file = "${self}/secrets/docker-ci-runner-secrets.age"; file = "${flake.self}/secrets/docker-ci-runner-secrets.age";
mode = "700"; mode = "600";
owner = "999"; owner = "999";
}; };
pub-solar.nextcloud.enable = mkForce false; pub-solar.terminal-life.full = true;
pub-solar.docker.enable = true; #pub-solar.docker-ci-runner = {
pub-solar.virtualisation.enable = true; # enable = false;
pub-solar.docker-ci-runner = { # runnerEnvironment = {
enable = false; # DRONE_RUNNER_CAPACITY = "1";
runnerEnvironment = { # DRONE_RUNNER_LABELS = "hosttype:baremetal";
DRONE_RUNNER_CAPACITY = "1"; # };
DRONE_RUNNER_LABELS = "hosttype:baremetal"; # runnerVarsFile = config.age.secrets.docker-ci-runner-secrets.path;
}; #};
runnerVarsFile = config.age.secrets.docker-ci-runner-secrets.path;
};
pub-solar.audio.mopidy.enable = mkForce false;
networking = import ./networking.nix;
# Increase console font size for HiDPI display # Increase console font size for HiDPI display
console = { console = {
@ -48,7 +38,9 @@ in {
packages = [pkgs.terminus_font]; packages = [pkgs.terminus_font];
}; };
home-manager.users."${psCfg.user.name}".xdg.configFile = mkIf psCfg.sway.enable { networking.hostName = "ryzensun";
home-manager.users."${psCfg.user.name}".xdg.configFile = {
"sway/config.d/10-custom-keybindings.conf".source = ./.config/sway/config.d/custom-keybindings.conf; "sway/config.d/10-custom-keybindings.conf".source = ./.config/sway/config.d/custom-keybindings.conf;
"sway/config.d/autostart.conf".source = ./.config/sway/config.d/autostart.conf; "sway/config.d/autostart.conf".source = ./.config/sway/config.d/autostart.conf;
"sway/config.d/input-defaults.conf".source = ./.config/sway/config.d/input-defaults.conf; "sway/config.d/input-defaults.conf".source = ./.config/sway/config.d/input-defaults.conf;

5
lib/add-local-hostname.nix Normal file
View file

@ -0,0 +1,5 @@
{ lib }:
hostnames: {
"127.0.0.1" = hostnames;
"::1" = hostnames;
}

28
lib/default.nix
View file

@ -1,10 +1,18 @@
{lib}: { lib, inputs, ... }: {
lib.makeExtensible (self: let # Configuration common to all Linux systems
callLibs = file: import file {lib = self;}; flake = {
in rec { lib = let
## Define your own library functions here! callLibs = file: import file {inherit lib;};
#id = x: x; in rec {
## Or in files, containing functions that take {lib} ## Define your own library functions here!
#foo = callLibs ./foo.nix; #id = x: x;
## In configs, they can be used under "lib.our" ## Or in files, containing functions that take {lib}
}) #foo = callLibs ./foo.nix;
## In configs, they can be used under "lib.our"
deploy = import ./deploy.nix { inherit inputs lib; };
addLocalHostname = callLibs ./add-local-hostname.nix;
recursiveMerge = callLibs ./recursive-merge.nix;
};
};
}

62
lib/deploy.nix Normal file
View file

@ -0,0 +1,62 @@
/*
* The contents of this file are adapted from digga
* https://github.com/divnix/digga
*
* Licensed under the MIT license
*/
{ lib, inputs }: let
getFqdn = c: let
net = c.config.networking;
fqdn =
if (net ? domain) && (net.domain != null)
then "${net.hostName}.${net.domain}"
else net.hostName;
in
fqdn;
in {
mkDeployNodes = systemConfigurations: extraConfig:
/*
*
Synopsis: mkNodes _systemConfigurations_ _extraConfig_
Generate the `nodes` attribute expected by deploy-rs
where _systemConfigurations_ are `nodes`.
_systemConfigurations_ should take the form of a flake's
_nixosConfigurations_. Note that deploy-rs does not currently support
deploying to darwin hosts.
_extraConfig_, if specified, will be merged into each of the
nodes' configurations.
Example _systemConfigurations_ input:
```
{
hostname-1 = {
fastConnection = true;
sshOpts = [ "-p" "25" ];
};
hostname-2 = {
sshOpts = [ "-p" "19999" ];
sshUser = "root";
};
}
```
*
*/
lib.recursiveUpdate
(lib.mapAttrs
(
_: c: {
hostname = getFqdn c;
profiles.system = {
user = "root";
path = inputs.deploy-rs.lib.${c.pkgs.stdenv.hostPlatform.system}.activate.nixos c;
};
}
)
systemConfigurations)
extraConfig;
}

16
lib/recursive-merge.nix Normal file
View file

@ -0,0 +1,16 @@
{ lib }:
attrList:
let
f = attrPath:
zipAttrsWith (
n: values:
if tail values == []
then head values
else if all isList values
then unique (concatLists values)
else if all isAttrs values
then f (attrPath ++ [n]) values
else last values
);
in
f [] attrList;

15
modules/adb/default.nix Normal file
View file

@ -0,0 +1,15 @@
{
lib,
config,
pkgs,
...
}:
with lib; let
psCfg = config.pub-solar;
in {
programs.adb.enable = true;
users.users."${psCfg.user.name}" = {
extraGroups = ["adbusers"];
};
}

22
modules/arduino/default.nix
View file

@ -6,22 +6,12 @@
}: }:
with lib; let with lib; let
psCfg = config.pub-solar; psCfg = config.pub-solar;
cfg = config.pub-solar.devops;
in { in {
options.pub-solar.arduino = { users.users."${psCfg.user.name}" = {
enable = mkEnableOption "Life with home automation"; extraGroups = ["dialout"];
}; packages = with pkgs; [
config = mkIf cfg.enable { arduino
users.users = pkgs.lib.setAttrByPath [psCfg.user.name] { arduino-cli
extraGroups = ["dialout"]; ];
};
home-manager = with pkgs;
pkgs.lib.setAttrByPath ["users" psCfg.user.name] {
home.packages = [
arduino
arduino-cli
];
};
}; };
} }

129
modules/audio/default.nix
View file

@ -6,115 +6,34 @@
}: }:
with lib; let with lib; let
psCfg = config.pub-solar; psCfg = config.pub-solar;
cfg = config.pub-solar.audio;
xdg = config.home-manager.users."${psCfg.user.name}".xdg; xdg = config.home-manager.users."${psCfg.user.name}".xdg;
in { in {
options.pub-solar.audio = { users.users."${psCfg.user.name}" = {
enable = mkEnableOption "Life in highs and lows"; extraGroups = ["audio"];
mopidy.enable = mkEnableOption "Life with mopidy"; packages = with pkgs; [
spotify.enable = mkEnableOption "Life in DRM"; # easyeffects, e.g. for microphone noise filtering
spotify.username = mkOption { easyeffects
description = "Spotify login username or email"; mu
type = types.str; pavucontrol
example = "yourname@example.com"; pa_applet
default = ""; playerctl
}; # Needed for pactl cmd, until pw-cli is more mature (vol up/down hotkeys?)
bluetooth.enable = mkEnableOption "Life with bluetooth"; pulseaudio
vimpc
];
}; };
config = mkIf cfg.enable { home-manager.users."${psCfg.user.name}" = {
users.users = pkgs.lib.setAttrByPath [psCfg.user.name] { xdg.configFile."vimpc/vimpcrc".source = ./.config/vimpc/vimpcrc;
extraGroups = ["audio"]; systemd.user.services.easyeffects = import ./easyeffects.service.nix pkgs;
}; };
home-manager = with pkgs; # rtkit is optional but recommended
pkgs.lib.setAttrByPath ["users" psCfg.user.name] { security.rtkit.enable = true;
home.packages = services.pipewire = {
[ enable = true;
# easyeffects, e.g. for microphone noise filtering alsa.enable = true;
easyeffects alsa.support32Bit = true;
mu pulse.enable = true;
pavucontrol
pa_applet
playerctl
# Needed for pactl cmd, until pw-cli is more mature (vol up/down hotkeys?)
pulseaudio
vimpc
]
++ (
if cfg.spotify.enable
then [pkgs.spotify-tui]
else []
);
xdg.configFile."vimpc/vimpcrc".source = ./.config/vimpc/vimpcrc;
systemd.user.services.easyeffects = import ./easyeffects.service.nix pkgs;
services.spotifyd = mkIf cfg.spotify.enable {
enable = true;
settings = {
global = {
username = cfg.spotify.username;
password_cmd = "DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/1001/bus ${pkgs.libsecret}/bin/secret-tool lookup spotify password";
bitrate = 320;
volume_normalisation = true;
no_audio_cache = false;
max_cache_size = 1000000000;
};
};
};
};
# rtkit is optional but recommended
security.rtkit.enable = true;
# Enable sound using pipewire-pulse, default config:
# https://gitlab.freedesktop.org/pipewire/pipewire/-/blob/master/src/daemon/pipewire.conf.in
services.pipewire = {
enable = true;
alsa.enable = true;
alsa.support32Bit = true;
pulse.enable = true;
};
# Make pulseaudio listen on port 4713 for mopidy, extending the default
# config: https://gitlab.freedesktop.org/pipewire/pipewire/-/blob/master/src/daemon/pipewire-pulse.conf.in
environment.etc = mkIf cfg.mopidy.enable {
"pipewire/pipewire-pulse.conf.d/99-custom.conf".text = ''
{
"context.modules": [
{
"name": "libpipewire-module-protocol-pulse",
"args": {
"server.address": ["unix:native", "tcp:4713"],
"vm.overrides": {
"pulse.min.quantum": "1024/48000"
}
}
}
]
}
'';
};
# Enable bluetooth
hardware.bluetooth = mkIf cfg.bluetooth.enable {
enable = true;
# Disable bluetooth on startup to save battery
powerOnBoot = false;
# Disable useless SIM Access Profile plugin
disabledPlugins = [
"sap"
];
settings = {
General = {
# Enables experimental features and interfaces.
# Makes BlueZ Battery Provider available
Experimental = true;
};
};
};
services.blueman.enable = mkIf cfg.bluetooth.enable true;
# Enable audio server & client
services.mopidy = mkIf cfg.mopidy.enable ((import ./mopidy.nix) pkgs);
}; };
} }

18
modules/audio/mopidy.nix
View file

@ -1,18 +0,0 @@
pkgs: {
enable = true;
extensionPackages = with pkgs; [
mopidy-mpd
mopidy-soundcloud
mopidy-youtube
mopidy-local
mopidy-jellyfin
];
configuration = ''
[mpd]
hostname = ::
[audio]
output = pulsesink server=127.0.0.1:4713
'';
}

35
modules/bluetooth/default.nix Normal file
View file

@ -0,0 +1,35 @@
{
lib,
config,
pkgs,
...
}: {
hardware.bluetooth = {
enable = true;
# Disable bluetooth on startup to save battery
powerOnBoot = false;
# Disable useless SIM Access Profile plugin
disabledPlugins = [
"sap"
];
settings = {
General = {
# Enables experimental features and interfaces.
# Makes BlueZ Battery Provider available
Experimental = true;
};
};
};
services.blueman.enable = true;
environment.etc."wireplumber/bluetooth.lua.d/51-bluez-config.lua" = {
text = ''
bluez_monitor.properties = {
["bluez5.enable-sbc-xq"] = true,
["bluez5.enable-msbc"] = true,
["bluez5.enable-hw-volume"] = true,
["bluez5.headset-roles"] = "[ hsp_hs hsp_ag hfp_hf hfp_ag ]"
}
'';
};
}

45
modules/ci-runner/default.nix
View file

@ -1,45 +0,0 @@
{
lib,
config,
pkgs,
self,
...
}:
with lib; let
psCfg = config.pub-solar;
cfg = config.pub-solar.ci-runner;
in {
options.pub-solar.ci-runner = {
enable = mkEnableOption "Enables a systemd service that runs drone-ci-runner";
};
config = mkIf cfg.enable {
systemd.user.services.ci-runner = {
enable = true;
description = "CI runner for the PubSolarOS repository that can run test VM instances with KVM.";
serviceConfig = {
Type = "simple";
Restart = "always";
};
path = [
pkgs.git
pkgs.nix
pkgs.libvirt
];
wantedBy = ["multi-user.target"];
after = ["network.target" "libvirtd.service"];
script = ''${pkgs.drone-runner-exec}/bin/drone-runner-exec daemon /run/agenix/drone-runner-exec-config'';
};
age.secrets."drone-runner-exec-config" = {
file = "${self}/secrets/drone-runner-exec-config";
mode = "700";
owner = psCfg.user.name;
};
};
}

15
modules/core/boot.nix
View file

@ -7,12 +7,6 @@
with lib; let with lib; let
cfg = config.pub-solar.core; cfg = config.pub-solar.core;
in { in {
options.pub-solar.core.iso-options.enable = mkOption {
type = types.bool;
default = false;
description = "Feature flag for iso builds";
};
options.pub-solar.core.disk-encryption-active = mkOption { options.pub-solar.core.disk-encryption-active = mkOption {
type = types.bool; type = types.bool;
default = true; default = true;
@ -21,13 +15,10 @@ in {
config = { config = {
boot = { boot = {
# Enable plymouth for better experience of booting
plymouth.enable = mkIf (!cfg.lite) (lib.mkDefault true);
# Mount / luks device in initrd # Mount / luks device in initrd
# Allow fstrim to work on it. # Allow fstrim to work on it.
# The ! makes this enabled by default # The ! makes this enabled by default
initrd = mkIf (!cfg.iso-options.enable && cfg.disk-encryption-active) { initrd = mkIf cfg.disk-encryption-active {
luks.devices."cryptroot" = { luks.devices."cryptroot" = {
allowDiscards = true; allowDiscards = true;
}; };
@ -35,8 +26,8 @@ in {
loader.systemd-boot.enable = lib.mkDefault true; loader.systemd-boot.enable = lib.mkDefault true;
# Use latest linux kernel by default # Use latest LTS linux kernel by default
kernelPackages = lib.mkDefault pkgs.linuxPackages_6_5; kernelPackages = lib.mkDefault pkgs.linuxPackages_6_1;
# Support ntfs drives # Support ntfs drives
supportedFilesystems = ["ntfs"]; supportedFilesystems = ["ntfs"];

40
modules/core/default.nix
View file

@ -5,38 +5,34 @@
}: }:
with lib; let with lib; let
cfg = config.pub-solar.core; cfg = config.pub-solar.core;
psCfg = config.pub-solar;
in { in {
imports = [ imports = [
./boot.nix ./boot.nix
./hibernation.nix ./hibernation.nix
./fonts.nix
./i18n.nix ./i18n.nix
./networking.nix ./networking.nix
./nix.nix
./packages.nix ./packages.nix
./services.nix
]; ];
options.pub-solar.core = { # Service that makes Out of Memory Killer more effective
lite = mkOption { services.earlyoom.enable = true;
description = ''
Enable a lite edition of core with less default modules and a reduced package set. services.logind.lidSwitch = "hibernate";
'';
default = false; services.tor.settings = {
type = types.bool; UseBridges = true;
};
}; };
config = { # The options below are directly taken from or inspired by
pub-solar = { # https://xeiaso.net/blog/paranoid-nixos-2021-07-18
audio.enable = mkIf (!cfg.lite) (mkDefault true);
crypto.enable = mkIf (!cfg.lite) (mkDefault true);
devops.enable = mkIf (!cfg.lite) (mkDefault true);
terminal-life = { # Limit the use of sudo to the group wheel
enable = mkDefault true; security.sudo.execWheelOnly = true;
lite = cfg.lite;
}; # Remove the complete default environment of packages like
}; # nano, perl and rsync
}; environment.defaultPackages = lib.mkForce [];
# fileSystems."/".options = [ "noexec" ];
} }

14
modules/core/fonts.nix
View file

@ -1,14 +0,0 @@
{
config,
pkgs,
lib,
...
}: {
fonts = {
fonts = with pkgs; [powerline-fonts dejavu_fonts];
fontconfig.defaultFonts = {
monospace = ["DejaVu Sans Mono for Powerline"];
sansSerif = ["DejaVu Sans"];
};
};
}

100
modules/core/networking.nix
View file

@ -1,89 +1,39 @@
{ {
flake,
config, config,
pkgs, pkgs,
lib, lib,
... ...
}: }: {
with lib; let # disable NetworkManager and systemd-networkd -wait-online by default
cfg = config.pub-solar.core; systemd.services.NetworkManager-wait-online.enable = lib.mkDefault false;
in { systemd.services.systemd-networkd-wait-online.enable = lib.mkDefault false;
options.pub-solar.core = {
enableCaddy = mkOption {
type = types.bool;
default = !cfg.lite;
};
enableHelp = mkOption {
type = types.bool;
default = !cfg.lite;
};
binaryCaches = mkOption { networking.networkmanager = {
type = types.listOf types.str; # Enable networkmanager. REMEMBER to add yourself to group in order to use nm related stuff.
default = []; enable = lib.mkDefault true;
description = "Binary caches to use."; # not as stable as wpa_supplicant yet, also more trouble with 5 GHz networks
}; #wifi.backend = "iwd";
publicKeys = mkOption {
type = types.listOf types.str;
default = [];
description = "Public keys of binary caches.";
};
}; };
config = {
# disable NetworkManager and systemd-networkd -wait-online by default
systemd.services.NetworkManager-wait-online.enable = lib.mkDefault false;
systemd.services.systemd-networkd-wait-online.enable = lib.mkDefault false;
networking.networkmanager = { networking.firewall.enable = true;
# Enable networkmanager. REMEMBER to add yourself to group in order to use nm related stuff.
enable = true;
# not as stable as wpa_supplicant yet, also more trouble with 5 GHz networks
#wifi.backend = "iwd";
};
networking.firewall.enable = true; # For rage encryption, all hosts need a ssh key pair
services.openssh = {
enable = true;
allowSFTP = lib.mkDefault false;
# Customized binary caches list (with fallback to official binary cache) openFirewall = lib.mkDefault false;
nix.settings.substituters = cfg.binaryCaches;
nix.settings.trusted-public-keys = cfg.publicKeys;
# These entries get added to /etc/hosts settings.PasswordAuthentication = lib.mkDefault false;
networking.hosts = { settings.KbdInteractiveAuthentication = false;
"127.0.0.1" =
[]
++ lib.optionals cfg.enableCaddy ["caddy.local"]
++ lib.optionals config.pub-solar.printing.enable ["cups.local"]
++ lib.optionals cfg.enableHelp ["help.local"];
};
# Caddy reverse proxy for local services like cups extraConfig = ''
services.caddy = { AllowTcpForwarding yes
enable = lib.mkForce cfg.enableCaddy; X11Forwarding no
globalConfig = lib.mkForce '' AllowAgentForwarding no
default_bind 127.0.0.1 AllowStreamLocalForwarding no
auto_https off AuthenticationMethods publickey
''; '';
extraConfig = lib.mkForce (concatStringsSep "\n" [
(lib.optionalString
config.pub-solar.printing.enable
''
cups.local:80 {
request_header Host localhost:631
reverse_proxy unix//run/cups/cups.sock
}
'')
(lib.optionalString
cfg.enableHelp
''
help.local:80 {
root * ${pkgs.psos-docs}/lib/html
# Caddy builds the etag with only the file size & latest modified
# date, which is always 1970-01-01 in the Nix store
header -ETag
file_server
}
'')
]);
};
}; };
} }

81
modules/core/packages.nix
View file

@ -8,72 +8,21 @@ with lib; let
psCfg = config.pub-solar; psCfg = config.pub-solar;
cfg = config.pub-solar.core; cfg = config.pub-solar.core;
in { in {
environment = { environment.systemPackages = with pkgs; [
systemPackages = with pkgs; # Core unix utility packages
[ coreutils-full
# Core unix utility packages dnsutils
coreutils-full inetutils
dnsutils progress
inetutils pciutils
progress usbutils
pciutils diffutils
usbutils findutils
exfat
wget gitMinimal
openssl
openssh
curl
htop
btop
lsof
psmisc
file
# zippit btop
zip mtr
unzip ];
# Modern modern utilities
p7zip
croc
jq
]
++ lib.optionals (!cfg.lite) [
mtr
gitFull
git-lfs
git-bug
xdg-utils
sysfsutils
renameutils
nfs-utils
moreutils
mailutils
keyutils
input-utils
elfutils
binutils
dateutils
diffutils
findutils
exfat
# Nix specific utilities
alejandra
niv
manix
nix-index
nix-tree
nixpkgs-review
# Build broken, python2.7-PyJWT-2.0.1.drv' failed
#nixops
psos
nvd
# Fun
neofetch
];
};
} }

18
modules/core/services.nix
View file

@ -1,18 +0,0 @@
{
config,
pkgs,
lib,
...
}: {
# For rage encryption, all hosts need a ssh key pair
services.openssh = {
enable = true;
# If you don't want the host to have SSH actually opened up to the net,
# set `services.openssh.openFirewall` to false in your config.
openFirewall = lib.mkDefault true;
settings.PasswordAuthentication = lib.mkDefault false;
};
# Service that makes Out of Memory Killer more effective
services.earlyoom.enable = true;
}

46
modules/crypto/default.nix
View file

@ -6,40 +6,28 @@
}: }:
with lib; let with lib; let
psCfg = config.pub-solar; psCfg = config.pub-solar;
cfg = config.pub-solar.crypto;
in { in {
options.pub-solar.crypto = { services.udev.packages = [pkgs.yubikey-personalization];
enable = mkEnableOption "Life in private"; services.dbus.packages = [pkgs.gcr];
}; services.pcscd.enable = true;
config = mkIf cfg.enable { services.gnome.gnome-keyring.enable = true;
services.udev.packages = [pkgs.yubikey-personalization];
services.dbus.packages = [pkgs.gcr];
services.pcscd.enable = true;
services.gnome.gnome-keyring.enable = true; users.users."${psCfg.user.name}".packages = with pkgs; [
libsecret
];
home-manager = with pkgs; home-manager.users."${psCfg.user.name}" = {
pkgs.lib.setAttrByPath ["users" psCfg.user.name] { systemd.user.services.polkit-gnome-authentication-agent = import ./polkit-gnome-authentication-agent.service.nix pkgs;
systemd.user.services.polkit-gnome-authentication-agent = import ./polkit-gnome-authentication-agent.service.nix pkgs;
services.gpg-agent = { services.gpg-agent = {
enable = true; enable = true;
pinentryFlavor = "gnome3"; pinentryFlavor = "gnome3";
verbose = true; verbose = true;
}; };
programs.gpg = { programs.gpg = {
enable = true; enable = true;
}; };
home.packages = [
gnome.seahorse
keepassxc
libsecret
qMasterPassword
restic
];
};
}; };
} }

245
modules/ddclient/default.nix Normal file
View file

@ -0,0 +1,245 @@
{
config,
pkgs,
lib,
...
}:
let
cfg = config.services.ddclient;
boolToStr = bool: if bool then "yes" else "no";
dataDir = "/var/lib/ddclient";
StateDirectory = builtins.baseNameOf dataDir;
RuntimeDirectory = StateDirectory;
usev4 = if cfg.usev4 != "" then "usev4=${cfg.usev4}" else "";
usev6 = if cfg.usev6 != "" then "usev6=${cfg.usev6}" else "";
configFile' = pkgs.writeText "ddclient.conf" ''
# This file can be used as a template for configFile or is automatically generated by Nix options.
use=no
${usev4}
${usev6}
cache=${dataDir}/ddclient.cache
foreground=yes
login=${cfg.username}
password=${if cfg.protocol == "nsupdate" then "/run/${RuntimeDirectory}/ddclient.key" else "@password_placeholder@"}
protocol=${cfg.protocol}
${lib.optionalString (cfg.script != "") "script=${cfg.script}"}
${lib.optionalString (cfg.server != "") "server=${cfg.server}"}
${lib.optionalString (cfg.zone != "") "zone=${cfg.zone}"}
ssl=${boolToStr cfg.ssl}
wildcard=yes
quiet=${boolToStr cfg.quiet}
verbose=${boolToStr cfg.verbose}
${cfg.extraConfig}
${lib.concatStringsSep "," cfg.domains}
'';
configFile = if (cfg.configFile != null) then cfg.configFile else configFile';
preStart = ''
install --mode=600 --owner=$USER ${configFile} /run/${RuntimeDirectory}/ddclient.conf
${lib.optionalString (cfg.configFile == null) (if (cfg.protocol == "nsupdate") then ''
install --mode=600 --owner=$USER ${cfg.passwordFile} /run/${RuntimeDirectory}/ddclient.key
'' else if (cfg.passwordFile != null) then ''
"${pkgs.replace-secret}/bin/replace-secret" "@password_placeholder@" "${cfg.passwordFile}" "/run/${RuntimeDirectory}/ddclient.conf"
'' else ''
sed -i '/^password=@password_placeholder@$/d' /run/${RuntimeDirectory}/ddclient.conf
'')}
'';
in with lib; {
disabledModules = [
"services/networking/ddclient.nix"
];
imports = [
(mkChangedOptionModule [ "services" "ddclient" "domain" ] [ "services" "ddclient" "domains" ]
(config:
let value = getAttrFromPath [ "services" "ddclient" "domain" ] config;
in if value != "" then [ value ] else []))
(mkRemovedOptionModule [ "services" "ddclient" "homeDir" ] "")
(mkRemovedOptionModule [ "services" "ddclient" "password" ] "Use services.ddclient.passwordFile instead.")
];
###### interface
options = {
services.ddclient = with lib.types; {
enable = mkOption {
default = false;
type = bool;
description = lib.mdDoc ''
Whether to synchronise your machine's IP address with a dynamic DNS provider (e.g. dyndns.org).
'';
};
package = mkOption {
type = package;
default = pkgs.ddclient;
defaultText = lib.literalExpression "pkgs.ddclient";
description = lib.mdDoc ''
The ddclient executable package run by the service.
'';
};
domains = mkOption {
default = [ "" ];
type = listOf str;
description = lib.mdDoc ''
Domain name(s) to synchronize.
'';
};
username = mkOption {
# For `nsupdate` username contains the path to the nsupdate executable
default = lib.optionalString (config.services.ddclient.protocol == "nsupdate") "${pkgs.bind.dnsutils}/bin/nsupdate";
defaultText = "";
type = str;
description = lib.mdDoc ''
User name.
'';
};
passwordFile = mkOption {
default = null;
type = nullOr str;
description = lib.mdDoc ''
A file containing the password or a TSIG key in named format when using the nsupdate protocol.
'';
};
interval = mkOption {
default = "10min";
type = str;
description = lib.mdDoc ''
The interval at which to run the check and update.
See {command}`man 7 systemd.time` for the format.
'';
};
configFile = mkOption {
default = null;
type = nullOr path;
description = lib.mdDoc ''
Path to configuration file.
When set this overrides the generated configuration from module options.
'';
example = "/root/nixos/secrets/ddclient.conf";
};
protocol = mkOption {
default = "dyndns2";
type = str;
description = lib.mdDoc ''
Protocol to use with dynamic DNS provider (see https://sourceforge.net/p/ddclient/wiki/protocols).
'';
};
server = mkOption {
default = "";
type = str;
description = lib.mdDoc ''
Server address.
'';
};
ssl = mkOption {
default = true;
type = bool;
description = lib.mdDoc ''
Whether to use SSL/TLS to connect to dynamic DNS provider.
'';
};
quiet = mkOption {
default = false;
type = bool;
description = lib.mdDoc ''
Print no messages for unnecessary updates.
'';
};
script = mkOption {
default = "";
type = str;
description = lib.mdDoc ''
script as required by some providers.
'';
};
usev4 = mkOption {
default = "webv4, webv4=checkip.dyndns.com/, webv4-skip='Current IP Address: '";
type = str;
description = lib.mdDoc ''
Method to determine the IP address to send to the dynamic DNS provider.
'';
};
usev6 = mkOption {
default = "";
type = str;
description = lib.mdDoc ''
Method to determine the IP address to send to the dynamic DNS provider.
'';
};
verbose = mkOption {
default = false;
type = bool;
description = lib.mdDoc ''
Print verbose information.
'';
};
zone = mkOption {
default = "";
type = str;
description = lib.mdDoc ''
zone as required by some providers.
'';
};
extraConfig = mkOption {
default = "";
type = lines;
description = lib.mdDoc ''
Extra configuration. Contents will be added verbatim to the configuration file.
::: {.note}
`daemon` should not be added here because it does not work great with the systemd-timer approach the service uses.
:::
'';
};
};
};
###### implementation
config = mkIf config.services.ddclient.enable {
systemd.services.ddclient = {
description = "Dynamic DNS Client";
wantedBy = [ "multi-user.target" ];
after = [ "network.target" ];
restartTriggers = optional (cfg.configFile != null) cfg.configFile;
serviceConfig = {
DynamicUser = true;
RuntimeDirectoryMode = "0700";
inherit RuntimeDirectory;
inherit StateDirectory;
Type = "oneshot";
ExecStartPre = "!${pkgs.writeShellScript "ddclient-prestart" preStart}";
ExecStart = "${lib.getBin cfg.package}/bin/ddclient -file /run/${RuntimeDirectory}/ddclient.conf";
};
};
systemd.timers.ddclient = {
description = "Run ddclient";
wantedBy = [ "timers.target" ];
timerConfig = {
OnBootSec = cfg.interval;
OnUnitInactiveSec = cfg.interval;
};
};
};
}

42
modules/default.nix Normal file
View file

@ -0,0 +1,42 @@
{
self,
inputs,
...
}: {
flake = {
nixosModules = rec {
audio = import ./audio;
bluetooth = import ./bluetooth;
core = import ./core;
crypto = import ./crypto;
desktop-extended = import ./desktop-extended;
docker = import ./docker;
#email = import ./email;
#gaming = import ./gaming;
graphical = import ./graphical;
#invoiceplane = import ./invoiceplane;
nix = import ./nix;
nextcloud = import ./nextcloud;
office = import ./office;
printing = import ./printing;
terminal-life = import ./terminal-life;
user = import ./user;
virtualisation = import ./virtualisation;
#wireguard-client = import ./wireguard-client;
base.imports = [
self.nixosModules.home-manager
inputs.agenix.nixosModules.default
self.nixosModules.overlays
self.nixosModules.core
self.nixosModules.crypto
self.nixosModules.nix
self.nixosModules.terminal-life
self.nixosModules.root
self.nixosModules.user
];
};
};
}

48
modules/desktop-extended/default.nix Normal file
View file

@ -0,0 +1,48 @@
{
lib,
config,
pkgs,
...
}:
with lib; let
psCfg = config.pub-solar;
in {
users.users."${psCfg.user.name}".packages = with pkgs; [
ungoogled-chromium
wine
gimp
inkscape
tigervnc
nodejs
signal-desktop
tdesktop
element-desktop
# Nix specific utilities
alejandra
manix
nix-index
nix-output-monitor
nix-tree
nvd
];
fonts = {
fonts = with pkgs; [
dejavu_fonts
fira-code
fira-code-symbols
google-fonts
lato
montserrat
nerdfonts
noto-fonts
noto-fonts-cjk
open-sans
powerline-fonts
source-sans-pro
];
};
}

34
modules/devops/default.nix
View file

@ -1,34 +0,0 @@
{
lib,
config,
pkgs,
...
}:
with lib; let
psCfg = config.pub-solar;
cfg = config.pub-solar.devops;
in {
options.pub-solar.devops = {
enable = mkEnableOption "Life automated";
};
config = mkIf cfg.enable {
home-manager = with pkgs;
pkgs.lib.setAttrByPath ["users" psCfg.user.name] {
home.packages = [
fwknop
croc
drone-cli
nmap
pgcli
ansible
ansible-lint
restic
shellcheck
terraform
flyctl
tea
];
};
};
}

114
modules/docker-ci-runner/default.nix
View file

@ -1,114 +0,0 @@
{
lib,
config,
pkgs,
self,
...
}:
with lib; let
bootstrap = pkgs.writeScript "bootstrap.sh" ''
#!/usr/bin/env bash
set -e
apt update
apt install --yes curl git sudo xz-utils
adduser --system --uid 999 build
chown build /nix
sudo -u build curl -L https://nixos.org/nix/install > install
sudo -u build sh install
echo "export PATH=/nix/var/nix/profiles/per-user/build/profile/bin:''$PATH" >> /etc/profile
mkdir /etc/nix
echo 'experimental-features = nix-command flakes' >> /etc/nix/nix.conf
export nix_user_config_file="/home/build/.local/share/nix/trusted-settings.json"
mkdir -p $(dirname \\$nix_user_config_file)
echo '{"extra-experimental-features":{"nix-command flakes":true}}' > \\$nix_user_config_file
chown -R build /home/build/
curl -L https://github.com/drone-runners/drone-runner-exec/releases/latest/download/drone_runner_exec_linux_amd64.tar.gz | tar xz
sudo install -t /usr/local/bin drone-runner-exec
if [ ! -f /run/vars ]; then
exit 1
fi
cp -a /run/vars /run/runtime-vars
env | grep "DRONE" >> /run/runtime-vars
su - -s /bin/bash build sh -c "/usr/local/bin/drone-runner-exec daemon /run/runtime-vars"
'';
psCfg = config.pub-solar;
cfg = config.pub-solar.docker-ci-runner;
in {
options.pub-solar.docker-ci-runner = {
enable = lib.mkEnableOption "Enables a docker container running a drone exec runner as unprivileged user.";
enableKvm = lib.mkOption {
description = ''
Enable kvm support.
'';
default = true;
type = types.bool;
};
nixCacheLocation = lib.mkOption {
description = ''
Location of nix cache that is shared between builds
'';
default = "/var/lib/docker-ci-runner";
type = types.path;
};
runnerEnvironment = lib.mkOption {
description = ''
Additional environment vars added to the vars file on container runtime
'';
default = {};
};
runnerVarsFile = lib.mkOption {
description = ''
Location of vars file passed to drone runner
'';
type = types.path;
};
};
config = lib.mkIf cfg.enable {
virtualisation = {
docker = {
enable = true; # sadly podman is not supported rightnow
};
oci-containers = {
backend = "docker";
containers."drone-exec-runner" = {
image = "debian";
autoStart = true;
entrypoint = "bash";
cmd = ["/bootstrap.sh"];
volumes = [
"${cfg.runnerVarsFile}:/run/vars"
"${cfg.nixCacheLocation}:/nix"
"${bootstrap}:/bootstrap.sh"
];
environment = cfg.runnerEnvironment;
extraOptions = lib.mkIf cfg.enableKvm ["--device=/dev/kvm"];
};
};
};
# Fix container not stopping correctly and holding the system 120s upon
# shutdown / reboot
systemd.services.docker-drone-exec-runner.preStop = ''
docker stop drone-exec-runner
'';
};
}

23
modules/docker/default.nix
View file

@ -6,22 +6,15 @@
}: }:
with lib; let with lib; let
psCfg = config.pub-solar; psCfg = config.pub-solar;
cfg = config.pub-solar.docker;
in { in {
options.pub-solar.docker = { virtualisation.docker.enable = true;
enable = mkEnableOption "Life in metal boxes"; virtualisation.docker.package = pkgs.docker_24;
users.users."${psCfg.user.name}" = {
extraGroups = ["docker"];
}; };
config = mkIf cfg.enable { environment.systemPackages = with pkgs; [
virtualisation.docker.enable = true; docker-compose
virtualisation.docker.package = pkgs.docker_24; ];
users.users = with pkgs;
pkgs.lib.setAttrByPath [psCfg.user.name] {
extraGroups = ["docker"];
};
environment.systemPackages = with pkgs; [
docker-compose
];
};
} }

61
modules/email/default.nix
View file

@ -6,28 +6,49 @@
}: }:
with lib; let with lib; let
psCfg = config.pub-solar; psCfg = config.pub-solar;
cfg = config.pub-solar.email;
in { in {
options.pub-solar.email = { users.users."${psCfg.user.name}".packages = with pkgs; [
enable = mkEnableOption "Life in headers"; w3m
}; urlscan
neomutt
offlineimap
msmtp
mailto-mutt
];
config = mkIf cfg.enable { home-manager.users."${psCfg.user.name}" = {
home-manager = with pkgs; programs.offlineimap = {
pkgs.lib.setAttrByPath ["users" psCfg.user.name] { enable = true;
home.packages = [ pythonFile = builtins.readFile ./offlineimap.py;
w3m };
urlscan
neomutt
offlineimap
msmtp
mailto-mutt
];
programs.offlineimap = { xdg.configFile."mutt/muttrc".source = ./.config/mutt/muttrc;
enable = true; xdg.configFile."mutt/base16.muttrc".source = ./.config/mutt/base16.muttrc;
pythonFile = builtins.readFile ./offlineimap.py; xdg.configFile."mutt/mailcap".source = ./.config/mutt/mailcap;
}; xdg.configFile."offlineimap/functions.py".source = ./.config/offlineimap/functions.py;
};
xdg.configFile."mutt/accounts.muttrc".text = ''
source ./hello@benjaminbaedorf.eu.muttrc
macro index <f1> '<sync-mailbox><enter-command>source $XDG_CONFIG_HOME/mutt/hello@benjaminbaedorf.eu.muttrc<enter><change-folder>!<enter>'
macro index <f2> '<sync-mailbox><enter-command>source $XDG_CONFIG_HOME/mutt/benjamin.baedorf@rwth-aachen.de.muttrc<enter><change-folder>!<enter>'
macro index <f3> '<sync-mailbox><enter-command>source $XDG_CONFIG_HOME/mutt/byb@miom.space.muttrc<enter><change-folder>!<enter>'
macro index <f4> '<sync-mailbox><enter-command>source $XDG_CONFIG_HOME/mutt/mail@b12f.io.muttrc<enter><change-folder>!<enter>'
macro index <f5> '<sync-mailbox><enter-command>source $XDG_CONFIG_HOME/mutt/admins@pub.solar.muttrc<enter><change-folder>!<enter>'
macro index <f6> '<sync-mailbox><enter-command>source $XDG_CONFIG_HOME/mutt/crew@pub.solar.muttrc<enter><change-folder>!<enter>'
'';
xdg.configFile."mutt/hello@benjaminbaedorf.eu.muttrc".source = ./.config/mutt + "/hello@benjaminbaedorf.eu.muttrc";
xdg.configFile."mutt/benjamin.baedorf@rwth-aachen.de.muttrc".source = ./.config/mutt + "/benjamin.baedorf@rwth-aachen.de.muttrc";
xdg.configFile."mutt/hello@benjaminbaedorf.eu.signature".source = ./.config/mutt + "/hello@benjaminbaedorf.eu.signature";
xdg.configFile."mutt/byb@miom.space.muttrc".source = ./.config/mutt + "/byb@miom.space.muttrc";
xdg.configFile."mutt/byb@miom.space.signature".source = ./.config/mutt + "/byb@miom.space.signature";
xdg.configFile."mutt/mail@b12f.io.muttrc".source = ./.config/mutt + "/mail@b12f.io.muttrc";
xdg.configFile."mutt/mail@b12f.io.signature".source = ./.config/mutt + "/mail@b12f.io.signature";
xdg.configFile."mutt/admins@pub.solar.muttrc".source = ./.config/mutt + "/admins@pub.solar.muttrc";
xdg.configFile."mutt/admins@pub.solar.signature".source = ./.config/mutt + "/admins@pub.solar.signature";
xdg.configFile."mutt/crew@pub.solar.muttrc".source = ./.config/mutt + "/crew@pub.solar.muttrc";
xdg.configFile."mutt/crew@pub.solar.signature".source = ./.config/mutt + "/crew@pub.solar.signature";
xdg.configFile."offlineimap/config".source = ./.config/offlineimap/config;
xdg.configFile."msmtp/config".source = ./.config/msmtp/config;
}; };
} }

28
modules/gaming/default.nix
View file

@ -6,26 +6,16 @@
}: }:
with lib; let with lib; let
psCfg = config.pub-solar; psCfg = config.pub-solar;
cfg = config.pub-solar.gaming;
in { in {
options.pub-solar.gaming = { programs.steam.enable = true;
enable = mkEnableOption "Life in shooters"; nixpkgs.config.packageOverrides = pkgs: {
steam = pkgs.steam.override {};
}; };
config = mkIf cfg.enable { users.users."${psCfg.user.name}".packages = with pkgs; [
programs.steam.enable = true; playonlinux
nixpkgs.config.packageOverrides = pkgs: { godot
steam = pkgs.steam.override {}; obs-studio
}; obs-studio-plugins.wlrobs
];
home-manager = with pkgs;
pkgs.lib.setAttrByPath ["users" psCfg.user.name] {
home.packages = [
playonlinux
godot
obs-studio
obs-studio-plugins.wlrobs
];
};
};
} }

0
profiles/base-user/.config/libinput-gestures.conf → modules/graphical/.config/libinput-gestures.conf
View file

0
profiles/base-user/.config/mako/config → modules/graphical/.config/mako/config
View file

0
profiles/base-user/.config/swaync/config.json → modules/graphical/.config/swaync/config.json
View file

0
profiles/base-user/.config/swaync/style.css → modules/graphical/.config/swaync/style.css
View file

0
profiles/base-user/.config/user-dirs.dirs → modules/graphical/.config/user-dirs.dirs
View file

0
profiles/base-user/.config/user-dirs.locale → modules/graphical/.config/user-dirs.locale
View file

0
profiles/base-user/.config/waybar/colorscheme.css → modules/graphical/.config/waybar/colorscheme.css
View file

0
profiles/base-user/.config/waybar/config → modules/graphical/.config/waybar/config
View file

0
profiles/base-user/.config/waybar/style.css → modules/graphical/.config/waybar/style.css
View file

0
profiles/base-user/.config/xmodmap → modules/graphical/.config/xmodmap
View file

0
profiles/base-user/.config/xsettingsd/xsettingsd.conf → modules/graphical/.config/xsettingsd/xsettingsd.conf
View file

0
profiles/base-user/.xinitrc → modules/graphical/.xinitrc
View file

12
modules/graphical/alacritty.nix
View file

@ -55,7 +55,7 @@
style = "Italic"; style = "Italic";
}; };
size = 16.0; size = 12.0;
offset = { offset = {
x = 0; x = 0;
@ -69,6 +69,16 @@
}; };
key_bindings = [ key_bindings = [
{
key = "V";
mods = "Control|Super";
action = "Paste";
}
{
key = "C";
mods = "Control|Super";
action = "Copy";
}
{ {
key = "V"; key = "V";
mods = "Control|Alt"; mods = "Control|Alt";

0
profiles/base-user/assets/pub-solar.jpg → modules/graphical/assets/pub-solar.jpg
View file

Side by side Swipe Overlay

Before

Width:  |  Height:  |  Size: 513 KiB

After

Width:  |  Height:  |  Size: 513 KiB

0
profiles/base-user/assets/wallpaper.jpg → modules/graphical/assets/wallpaper.jpg
View file

Side by side Swipe Overlay

Before

Width:  |  Height:  |  Size: 168 KiB

After

Width:  |  Height:  |  Size: 168 KiB

186
modules/graphical/default.nix
View file

@ -6,36 +6,22 @@
}: }:
with lib; let with lib; let
psCfg = config.pub-solar; psCfg = config.pub-solar;
cfg = config.pub-solar.graphical;
yamlFormat = pkgs.formats.yaml {}; yamlFormat = pkgs.formats.yaml {};
recursiveMerge = attrList: let sessionVariables = {
f = attrPath: WLR_RENDERER =
zipAttrsWith ( if psCfg.graphical.wayland.software-renderer.enable
n: values: then "pixman"
if tail values == [] else "gles2";
then head values # Fix KeepassXC rendering issue
else if all isList values # https://github.com/void-linux/void-packages/issues/23517
then unique (concatLists values) QT_AUTO_SCREEN_SCALE_FACTOR = "0";
else if all isAttrs values };
then f (attrPath ++ [n]) values
else last values
);
in
f [] attrList;
in { in {
imports = [
./sway
];
options.pub-solar.graphical = { options.pub-solar.graphical = {
enable = mkEnableOption "Life in color";
alacritty = {
settings = mkOption {
type = yamlFormat.type;
default = {};
};
};
autologin.enable = mkOption {
type = types.bool;
default = true;
description = "Feature flag enabling autologin after boot.";
};
wayland.software-renderer.enable = mkOption { wayland.software-renderer.enable = mkOption {
type = types.bool; type = types.bool;
default = false; default = false;
@ -43,8 +29,9 @@ in {
}; };
}; };
config = mkIf cfg.enable { config = {
hardware.opengl.enable = true; hardware.opengl.enable = true;
environment = { environment = {
systemPackages = with pkgs; [ systemPackages = with pkgs; [
gtk-engine-murrine gtk-engine-murrine
@ -55,16 +42,20 @@ in {
papirus-maia-icon-theme papirus-maia-icon-theme
glib glib
xdg-utils
]; ];
etc = { etc = {
"xdg/PubSolar.conf".text = '' "xdg/PubSolar.conf".text = ''
[Qt] [Qt]
style=GTK+ style=GTK+
''; '';
}; };
variables = sessionVariables;
}; };
services.getty.autologinUser = mkIf cfg.autologin.enable (mkForce "${psCfg.user.name}"); services.getty.autologinUser = psCfg.user.name;
qt = { qt = {
enable = true; enable = true;
@ -72,8 +63,6 @@ in {
style = "gtk2"; style = "gtk2";
}; };
gtk.iconCache.enable = true;
# Required for running Gnome apps outside the Gnome DE, see https://nixos.wiki/wiki/GNOME#Running_GNOME_programs_outside_of_GNOME # Required for running Gnome apps outside the Gnome DE, see https://nixos.wiki/wiki/GNOME#Running_GNOME_programs_outside_of_GNOME
programs.dconf.enable = true; programs.dconf.enable = true;
services.udev.packages = with pkgs; [gnome3.gnome-settings-daemon]; services.udev.packages = with pkgs; [gnome3.gnome-settings-daemon];
@ -81,81 +70,80 @@ in {
services.gnome.sushi.enable = true; services.gnome.sushi.enable = true;
# Enable GVfs, a userspace virtual filesystem # Enable GVfs, a userspace virtual filesystem
services.gvfs.enable = true; services.gvfs.enable = true;
services.yubikey-agent.enable = true;
fonts.enableDefaultFonts = true; fonts = {
fonts.fonts = with pkgs; [ fonts = with pkgs; [
fira-code dejavu_fonts
fira-code-symbols powerline-fonts
google-fonts ];
lato enableDefaultFonts = true;
montserrat fontconfig.enable = true;
nerdfonts fontconfig.defaultFonts = {
noto-fonts monospace = ["DejaVu Sans Mono for Powerline"];
noto-fonts-cjk sansSerif = ["DejaVu Sans"];
open-sans };
powerline-fonts };
source-sans-pro
users.users."${psCfg.user.name}".packages = with pkgs; [
alacritty
firefox-wayland
flameshot
gnome.adwaita-icon-theme
gnome.eog
gnome.nautilus
gnome.seahorse
gnome.yelp
hicolor-icon-theme
keepassxc
qMasterPassword
libnotify
vlc
]; ];
home-manager = with pkgs; home-manager.users."${psCfg.user.name}" = {
setAttrByPath ["users" psCfg.user.name] { home.file."xinitrc".source = ./.xinitrc;
home.packages = [ xdg.configFile."alacritty/alacritty.yml".source = yamlFormat.generate "alacritty.yml" (import ./alacritty.nix);
alacritty xdg.configFile."xmodmap".source = ./.config/xmodmap;
foot xdg.configFile."user-dirs.dirs".source = ./.config/user-dirs.dirs;
ungoogled-chromium xdg.configFile."user-dirs.locale".source = ./.config/user-dirs.locale;
firefox-wayland xdg.configFile."xsettingsd/xsettingsd.conf".source = ./.config/xsettingsd/xsettingsd.conf;
xdg.configFile."mako/config".source = ./.config/mako/config;
xdg.configFile."libinput-gestures.conf".source = ./.config/libinput-gestures.conf;
xdg.configFile."swaync/config.json".source = ./.config/swaync/config.json;
xdg.configFile."swaync/style.css".source = ./.config/swaync/style.css;
xdg.configFile."waybar/config".source = ./.config/waybar/config;
xdg.configFile."waybar/style.css".source = ./.config/waybar/style.css;
xdg.configFile."waybar/colorscheme.css".source = ./.config/waybar/colorscheme.css;
xdg.configFile."wallpaper.jpg".source = ./assets/wallpaper.jpg;
flameshot gtk = {
libnotify enable = true;
gnome.adwaita-icon-theme font.name = "Lato";
gnome.eog iconTheme = {
gnome.nautilus package = pkgs.papirus-icon-theme;
gnome.yelp name = "Papirus-Adapta-Nokto-Maia";
hicolor-icon-theme };
theme = {
wine package = pkgs.matcha-gtk-theme;
name = "Matcha-dark-aliz";
toggle-kbd-layout
wcwd
vlc
gimp
];
xdg.configFile."alacritty/alacritty.yml" = {
source = yamlFormat.generate "alacritty.yml" (recursiveMerge [(import ./alacritty.nix) cfg.alacritty.settings]);
}; };
gtk = { gtk3.extraConfig = {
enable = true; gtk-xft-antialias = "1";
font.name = "Lato"; gtk-xft-hinting = "1";
iconTheme = { gtk-xft-hintstyle = "hintfull";
package = pkgs.papirus-icon-theme; gtk-xft-rgba = "rgb";
name = "Papirus-Adapta-Nokto-Maia"; gtk-application-prefer-dark-theme = "true";
};
theme = {
package = pkgs.matcha-gtk-theme;
name = "Matcha-dark-aliz";
};
gtk3.extraConfig = {
gtk-xft-antialias = "1";
gtk-xft-hinting = "1";
gtk-xft-hintstyle = "hintfull";
gtk-xft-rgba = "rgb";
gtk-application-prefer-dark-theme = "true";
};
}; };
# Fix KeepassXC rendering issue
# https://github.com/void-linux/void-packages/issues/23517
systemd.user.sessionVariables.QT_AUTO_SCREEN_SCALE_FACTOR = "0";
xresources.extraConfig = builtins.readFile ./.Xdefaults;
systemd.user.services.network-manager-applet = import ./network-manager-applet.service.nix pkgs;
}; };
xresources.extraConfig = builtins.readFile ./.Xdefaults;
systemd.user.services.network-manager-applet = import ./network-manager-applet.service.nix pkgs;
home.sessionVariables = sessionVariables;
systemd.user.sessionVariables = sessionVariables;
};
}; };
} }

1
modules/sway/config/config.d/applications.conf → modules/graphical/sway/config/config.d/applications.conf
View file

@ -49,6 +49,7 @@ for_window [class="(?i)virtualbox"] floating enable border normal
for_window [class="Xfburn"] floating enable for_window [class="Xfburn"] floating enable
for_window [class="^VirtualBox Machine$" title="Running"] floating disable for_window [class="^VirtualBox Machine$" title="Running"] floating disable
for_window [class="^rdesktop" title="rdesktop"] floating disable for_window [class="^rdesktop" title="rdesktop"] floating disable
for_window [app_id="signal"] floating enabled
# firefox floating menus # firefox floating menus
for_window [window_role="pop-up"] floating enable for_window [window_role="pop-up"] floating enable

0
modules/sway/config/config.d/colorscheme.conf → modules/graphical/sway/config/config.d/colorscheme.conf
View file

10
modules/sway/config/config.d/custom-keybindings.conf → modules/graphical/sway/config/config.d/custom-keybindings.conf
View file

@ -19,7 +19,7 @@ bindsym $mod+Shift+h exec psos help
bindsym $mod+F2 exec firefox bindsym $mod+F2 exec firefox
bindsym $mod+F4 exec nautilus -w bindsym $mod+F4 exec nautilus -w
bindsym $mod+Shift+F4 exec signal-desktop --use-tray-icon bindsym $mod+Shift+F4 exec signal-desktop --use-tray-icon --enable-features=WebRTCPipeWireCapturer
# Notifications with swaynotificationcenter # Notifications with swaynotificationcenter
# Toggle control center # Toggle control center
@ -37,3 +37,11 @@ bindsym $mod+Ctrl+r exec record-screen
# Launcher # Launcher
set $menu exec alacritty --class launcher -e env TERMINAL_COMMAND="alacritty -e" sway-launcher set $menu exec alacritty --class launcher -e env TERMINAL_COMMAND="alacritty -e" sway-launcher
bindsym $mod+Space exec $menu bindsym $mod+Space exec $menu
set $mode_vncclient In VNCClient mode. Press $mod+Num_Lock or $mod+Shift+Escape to return.
bindsym $mod+Num_Lock mode "$mode_vncclient"
bindsym $mod+Shift+Escape mode "$mode_vncclient"
mode "$mode_vncclient" {
bindsym $mod+Num_Lock mode "default"
bindsym $mod+Shift+Escape mode "default"
}

0
modules/sway/config/config.d/gaps.conf → modules/graphical/sway/config/config.d/gaps.conf
View file

29
modules/sway/config/config.d/mode_system.conf.nix → modules/graphical/sway/config/config.d/mode_system.conf.nix
View file

@ -7,22 +7,19 @@
# Set shut down, restart and locking features # Set shut down, restart and locking features
'' ''
+ ( + (
if psCfg.core.hibernation.enable && !psCfg.paranoia.enable if psCfg.core.hibernation.enable
then '' then ''
set $mode_system (e)xit, (h)ibernate, (l)ock, (s)uspend, (r)eboot, (Shift+s)hutdown set $mode_system (e)xit, (h)ibernate, (l)ock, (s)uspend, (r)eboot, (Shift+s)hutdown
'' ''
else if psCfg.paranoia.enable
then ''
set $mode_system (e)xit, (h)ibernate, (r)eboot, (Shift+s)hutdown
''
else '' else ''
set $mode_system (e)xit, (l)ock, (s)uspend, (r)eboot, (Shift+s)hutdown set $mode_system (e)xit, (l)ock, (s)uspend, (r)eboot, (Shift+s)hutdown
'' ''
) )
+ '' + ''
bindsym $mod+0 mode "$mode_system" bindsym $mod+0 mode "$mode_system"
mode "$mode_system" { mode "$mode_system" {
bindsym e exec swaymsg exit, mode "default" bindsym e exec swaymsg exit, mode "default"
'' ''
+ ( + (
if psCfg.core.hibernation.enable if psCfg.core.hibernation.enable
@ -31,20 +28,14 @@
'' ''
else "" else ""
) )
+ ( + ''
if !psCfg.paranoia.enable
then ''
bindsym l exec ${pkgs.swaylock-bg}/bin/swaylock-bg, mode "default" bindsym l exec ${pkgs.swaylock-bg}/bin/swaylock-bg, mode "default"
bindsym s exec systemctl suspend, mode "default" bindsym s exec systemctl suspend, mode "default"
'' bindsym r exec systemctl reboot, mode "default"
else "" bindsym Shift+s exec systemctl poweroff, mode "default"
)
+ ''
bindsym r exec systemctl reboot, mode "default"
bindsym Shift+s exec systemctl poweroff, mode "default"
# exit system mode: "Enter" or "Escape" # exit system mode: "Enter" or "Escape"
bindsym Return mode "default" bindsym Return mode "default"
bindsym Escape mode "default" bindsym Escape mode "default"
} }
'' ''

0
modules/sway/config/config.d/systemd.conf → modules/graphical/sway/config/config.d/systemd.conf
View file

0
modules/sway/config/config.d/theme.conf → modules/graphical/sway/config/config.d/theme.conf
View file

2
modules/sway/config/config.nix → modules/graphical/sway/config/config.nix
View file

@ -19,7 +19,7 @@
set $up i set $up i
set $right l set $right l
# Your preferred terminal emulator # Your preferred terminal emulator
set $term ${config.pub-solar.sway.terminal} set $term ${pkgs.alacritty}/bin/alacritty
# Your preferred application launcher # Your preferred application launcher
# Note: pass the final command to swaymsg so that the resulting window can be opened # Note: pass the final command to swaymsg so that the resulting window can be opened
# on the original workspace that the command was run on. # on the original workspace that the command was run on.

11
modules/graphical/sway/config/wayvnc/config.nix Normal file
View file

@ -0,0 +1,11 @@
{
psCfg,
pkgs,
}: "
address=0.0.0.0
enable_auth=true
username=${psCfg.user.name}
password=testtest
private_key_file=/run/agenix/vnc-key.pem
certificate_file=/run/agenix/vnc-cert.pem
"

100
modules/graphical/sway/default.nix Normal file
View file

@ -0,0 +1,100 @@
{
lib,
config,
pkgs,
...
}:
with lib; let
psCfg = config.pub-solar;
in {
options.pub-solar.graphical = {
v4l2loopback.enable = mkOption {
type = types.bool;
default = false;
description = "WebCam streaming tool";
};
};
config = {
boot = mkIf psCfg.graphical.v4l2loopback.enable {
extraModulePackages = with config.boot.kernelPackages; [v4l2loopback];
kernelModules = ["v4l2loopback"];
extraModprobeConfig = ''
options v4l2loopback exclusive_caps=1 devices=3
'';
};
environment.systemPackages = with pkgs; mkIf psCfg.graphical.v4l2loopback.enable [
linuxPackages.v4l2loopback
];
programs.sway.enable = true;
xdg.portal = {
enable = true;
wlr = {
enable = true;
settings = {
screencast = {
max_fps = 30;
chooser_type = "simple";
chooser_cmd = "${pkgs.slurp}/bin/slurp -f %o -or";
};
};
};
extraPortals = with pkgs; [xdg-desktop-portal-gtk];
};
services.pipewire.enable = true;
users.users."${psCfg.user.name}".packages = with pkgs; [
sway
grim
kanshi
slurp
swaybg
swayidle
swaynotificationcenter
xwayland
libappindicator-gtk3
wl-clipboard
wf-recorder
brightnessctl
gammastep
geoclue2
xsettingsd
ydotool
sway-launcher
record-screen
import-gtk-settings
# Unused on teutat3s hosts, see custom-keybindings.conf
#toggle-kbd-layout
s
wcwd
];
home-manager.users."${psCfg.user.name}" = {
programs.waybar.enable = true;
#programs.waybar.systemd.enable = true;
systemd.user.services.swaynotificationcenter = import ./swaynotificationcenter.service.nix pkgs;
systemd.user.services.sway = import ./sway.service.nix {inherit pkgs psCfg;};
systemd.user.services.swayidle = import ./swayidle.service.nix {inherit pkgs psCfg;};
systemd.user.services.xsettingsd = import ./xsettingsd.service.nix {inherit pkgs psCfg;};
systemd.user.services.waybar = import ./waybar.service.nix {inherit pkgs psCfg;};
systemd.user.targets.sway-session = import ./sway-session.target.nix {inherit pkgs psCfg;};
xdg.configFile."sway/config".text = import ./config/config.nix {inherit config pkgs;};
xdg.configFile."sway/config.d/colorscheme.conf".source = ./config/config.d/colorscheme.conf;
xdg.configFile."sway/config.d/theme.conf".source = ./config/config.d/theme.conf;
xdg.configFile."sway/config.d/gaps.conf".source = ./config/config.d/gaps.conf;
xdg.configFile."sway/config.d/custom-keybindings.conf".source = ./config/config.d/custom-keybindings.conf;
xdg.configFile."sway/config.d/mode_system.conf".text = import ./config/config.d/mode_system.conf.nix {inherit pkgs psCfg;};
xdg.configFile."sway/config.d/applications.conf".source = ./config/config.d/applications.conf;
xdg.configFile."sway/config.d/systemd.conf".source = ./config/config.d/systemd.conf;
};
};
}

0
modules/sway/gammastep.service.nix → modules/graphical/sway/gammastep.service.nix
View file

0
modules/sway/libinput-gestures.service.nix → modules/graphical/sway/libinput-gestures.service.nix
View file

18
modules/graphical/sway/mako.service.nix Normal file
View file

@ -0,0 +1,18 @@
{pkgs, ...}: {
Unit = {
Description = "Lightweight Wayland notification daemon";
Documentation = ["man:mako(1)"];
BindsTo = ["sway-session.target"];
After = ["sway-session.target"];
ConditionEnvironment = ["WAYLAND_DISPLAY"];
};
Service = {
Type = "dbus";
BusName = "org.freedesktop.Notifications";
ExecStart = "${pkgs.mako}/bin/mako";
ExecReload = "${pkgs.mako}/bin/makoctl reload";
};
Install = {
WantedBy = ["sway-session.target"];
};
}

0
modules/sway/sway-session.target.nix → modules/graphical/sway/sway-session.target.nix
View file

0
modules/sway/sway.service.nix → modules/graphical/sway/sway.service.nix
View file

27
modules/graphical/sway/swayidle.service.nix Normal file
View file

@ -0,0 +1,27 @@
{
pkgs,
psCfg,
...
}: {
Unit = {
Description = "Idle manager for Wayland";
Documentation = ["man:swayidle(1)"];
BindsTo = ["graphical-session.target"];
Wants = ["graphical-session-pre.target"];
After = ["graphical-session-pre.target"];
};
Service = {
Type = "simple";
Environment = "PATH=/run/current-system/sw/bin:${pkgs.sway}/bin:${pkgs.swaylock-bg}/bin:${pkgs.swayidle}/bin";
ExecStart = ''
swayidle -w \
after-resume 'swaymsg "output * dpms on"' \
before-sleep 'swaylock-bg' \
timeout 300 'swaylock-bg' \
timeout 600 'swaymsg "output * dpms off"' resume 'swaymsg "output * dpms on"'
'';
};
Install = {
WantedBy = ["sway-session.target"];
};
}

0
modules/sway/swaynotificationcenter.service.nix → modules/graphical/sway/swaynotificationcenter.service.nix
View file

2
modules/sway/waybar.service.nix → modules/graphical/sway/waybar.service.nix
View file

@ -10,7 +10,7 @@
Service = { Service = {
Type = "dbus"; Type = "dbus";
Environment = "PATH=${pkgs.bash}/bin:${pkgs.pavucontrol}/bin:${pkgs.swaynotificationcenter}/bin"; Environment = "PATH=${pkgs.bash}/bin:${pkgs.pavucontrol}/bin";
BusName = "fr.arouillard.waybar"; BusName = "fr.arouillard.waybar";
ExecStart = "${pkgs.waybar}/bin/waybar"; ExecStart = "${pkgs.waybar}/bin/waybar";
}; };

0
modules/sway/xsettingsd.service.nix → modules/graphical/sway/xsettingsd.service.nix
View file

0
modules/sway/ydotool.service.nix → modules/graphical/sway/ydotool.service.nix
View file

362
modules/invoiceplane/default.nix Normal file
View file

@ -0,0 +1,362 @@
{ config, pkgs, lib, ... }:
with lib;
let
cfg = config.services.invoiceplane;
eachSite = cfg.sites;
user = "invoiceplane";
webserver = config.services.${cfg.webserver};
invoiceplane-config = hostName: cfg: pkgs.writeText "ipconfig.php" ''
IP_URL=http://${hostName}
ENABLE_DEBUG=false
DISABLE_SETUP=false
REMOVE_INDEXPHP=false
DB_HOSTNAME=${cfg.database.host}
DB_USERNAME=${cfg.database.user}
# NOTE: file_get_contents adds newline at the end of returned string
DB_PASSWORD=${if cfg.database.passwordFile == null then "" else "trim(file_get_contents('${cfg.database.passwordFile}'),\"\\r\\n\")"}
DB_DATABASE=${cfg.database.name}
DB_PORT=${toString cfg.database.port}
SESS_EXPIRATION=864000
ENABLE_INVOICE_DELETION=false
DISABLE_READ_ONLY=false
ENCRYPTION_KEY=
ENCRYPTION_CIPHER=AES-256
SETUP_COMPLETED=false
REMOVE_INDEXPHP=true
'';
extraConfig = hostName: cfg: pkgs.writeText "extraConfig.php" ''
${toString cfg.extraConfig}
'';
pkg = hostName: cfg: pkgs.stdenv.mkDerivation rec {
pname = "invoiceplane-${hostName}";
version = src.version;
src = pkgs.invoiceplane;
postPhase = ''
# Patch index.php file to load additional config file
substituteInPlace index.php \
--replace "require('vendor/autoload.php');" "require('vendor/autoload.php'); \$dotenv = Dotenv\Dotenv::createImmutable(__DIR__, 'extraConfig.php'); \$dotenv->load();";
'';
installPhase = ''
mkdir -p $out
cp -r * $out/
# symlink uploads and log directories
rm -r $out/uploads $out/application/logs $out/vendor/mpdf/mpdf/tmp
ln -sf ${cfg.stateDir}/uploads $out/
ln -sf ${cfg.stateDir}/logs $out/application/
ln -sf ${cfg.stateDir}/tmp $out/vendor/mpdf/mpdf/
# symlink the InvoicePlane config
ln -s ${cfg.stateDir}/ipconfig.php $out/ipconfig.php
# symlink the extraConfig file
ln -s ${extraConfig hostName cfg} $out/extraConfig.php
# symlink additional templates
${concatMapStringsSep "\n" (template: "cp -r ${template}/. $out/application/views/invoice_templates/pdf/") cfg.invoiceTemplates}
'';
};
siteOpts = { lib, name, ... }:
{
options = {
enable = mkEnableOption (lib.mdDoc "InvoicePlane web application");
stateDir = mkOption {
type = types.path;
default = "/var/lib/invoiceplane/${name}";
description = lib.mdDoc ''
This directory is used for uploads of attachments and cache.
The directory passed here is automatically created and permissions
adjusted as required.
'';
};
database = {
host = mkOption {
type = types.str;
default = "localhost";
description = lib.mdDoc "Database host address.";
};
port = mkOption {
type = types.port;
default = 3306;
description = lib.mdDoc "Database host port.";
};
name = mkOption {
type = types.str;
default = "invoiceplane";
description = lib.mdDoc "Database name.";
};
user = mkOption {
type = types.str;
default = "invoiceplane";
description = lib.mdDoc "Database user.";
};
passwordFile = mkOption {
type = types.nullOr types.path;
default = null;
example = "/run/keys/invoiceplane-dbpassword";
description = lib.mdDoc ''
A file containing the password corresponding to
{option}`database.user`.
'';
};
createLocally = mkOption {
type = types.bool;
default = true;
description = lib.mdDoc "Create the database and database user locally.";
};
};
invoiceTemplates = mkOption {
type = types.listOf types.path;
default = [];
description = lib.mdDoc ''
List of path(s) to respective template(s) which are copied from the 'invoice_templates/pdf' directory.
::: {.note}
These templates need to be packaged before use, see example.
:::
'';
example = literalExpression ''
let
# Let's package an example template
template-vtdirektmarketing = pkgs.stdenv.mkDerivation {
name = "vtdirektmarketing";
# Download the template from a public repository
src = pkgs.fetchgit {
url = "https://git.project-insanity.org/onny/invoiceplane-vtdirektmarketing.git";
sha256 = "1hh0q7wzsh8v8x03i82p6qrgbxr4v5fb05xylyrpp975l8axyg2z";
};
sourceRoot = ".";
# Installing simply means copying template php file to the output directory
installPhase = ""
mkdir -p $out
cp invoiceplane-vtdirektmarketing/vtdirektmarketing.php $out/
"";
};
# And then pass this package to the template list like this:
in [ template-vtdirektmarketing ]
'';
};
poolConfig = mkOption {
type = with types; attrsOf (oneOf [ str int bool ]);
default = {
"pm" = "dynamic";
"pm.max_children" = 32;
"pm.start_servers" = 2;
"pm.min_spare_servers" = 2;
"pm.max_spare_servers" = 4;
"pm.max_requests" = 500;
};
description = lib.mdDoc ''
Options for the InvoicePlane PHP pool. See the documentation on `php-fpm.conf`
for details on configuration directives.
'';
};
extraConfig = mkOption {
type = types.nullOr types.lines;
default = null;
example = ''
SETUP_COMPLETED=true
DISABLE_SETUP=true
IP_URL=https://invoice.example.com
'';
description = lib.mdDoc ''
InvoicePlane configuration. Refer to
<https://github.com/InvoicePlane/InvoicePlane/blob/master/ipconfig.php.example>
for details on supported values.
'';
};
cron = {
enable = mkOption {
type = types.bool;
default = false;
description = lib.mdDoc ''
Enable cron service which periodically runs Invoiceplane tasks.
Requires key taken from the administration page. Refer to
<https://wiki.invoiceplane.com/en/1.0/modules/recurring-invoices>
on how to configure it.
'';
};
key = mkOption {
type = types.str;
description = lib.mdDoc "Cron key taken from the administration page.";
};
};
};
};
in
{
disabledModules = [
"services/web-apps/invoiceplane.nix"
];
# interface
options = {
services.invoiceplane = mkOption {
type = types.submodule {
options.sites = mkOption {
type = types.attrsOf (types.submodule siteOpts);
default = {};
description = lib.mdDoc "Specification of one or more WordPress sites to serve";
};
options.webserver = mkOption {
type = types.enum [ "caddy" ];
default = "caddy";
description = lib.mdDoc ''
Which webserver to use for virtual host management. Currently only
caddy is supported.
'';
};
};
default = {};
description = lib.mdDoc "InvoicePlane configuration.";
};
};
# implementation
config = mkIf (eachSite != {}) (mkMerge [{
assertions = flatten (mapAttrsToList (hostName: cfg:
[{ assertion = cfg.database.createLocally -> cfg.database.user == user;
message = ''services.invoiceplane.sites."${hostName}".database.user must be ${user} if the database is to be automatically provisioned'';
}
{ assertion = cfg.database.createLocally -> cfg.database.passwordFile == null;
message = ''services.invoiceplane.sites."${hostName}".database.passwordFile cannot be specified if services.invoiceplane.sites."${hostName}".database.createLocally is set to true.'';
}
{ assertion = cfg.cron.enable -> cfg.cron.key != null;
message = ''services.invoiceplane.sites."${hostName}".cron.key must be set in order to use cron service.'';
}
]) eachSite);
services.mysql = mkIf (any (v: v.database.createLocally) (attrValues eachSite)) {
enable = true;
package = mkDefault pkgs.mariadb;
ensureDatabases = mapAttrsToList (hostName: cfg: cfg.database.name) eachSite;
ensureUsers = mapAttrsToList (hostName: cfg:
{ name = cfg.database.user;
ensurePermissions = { "${cfg.database.name}.*" = "ALL PRIVILEGES"; };
}
) eachSite;
};
services.phpfpm = {
phpPackage = pkgs.php81;
pools = mapAttrs' (hostName: cfg: (
nameValuePair "invoiceplane-${hostName}" {
inherit user;
group = webserver.group;
settings = {
"listen.owner" = webserver.user;
"listen.group" = webserver.group;
} // cfg.poolConfig;
}
)) eachSite;
};
}
{
systemd.tmpfiles.rules = flatten (mapAttrsToList (hostName: cfg: [
"d ${cfg.stateDir} 0750 ${user} ${webserver.group} - -"
"f ${cfg.stateDir}/ipconfig.php 0750 ${user} ${webserver.group} - -"
"d ${cfg.stateDir}/logs 0750 ${user} ${webserver.group} - -"
"d ${cfg.stateDir}/uploads 0750 ${user} ${webserver.group} - -"
"d ${cfg.stateDir}/uploads/archive 0750 ${user} ${webserver.group} - -"
"d ${cfg.stateDir}/uploads/customer_files 0750 ${user} ${webserver.group} - -"
"d ${cfg.stateDir}/uploads/temp 0750 ${user} ${webserver.group} - -"
"d ${cfg.stateDir}/uploads/temp/mpdf 0750 ${user} ${webserver.group} - -"
"d ${cfg.stateDir}/tmp 0750 ${user} ${webserver.group} - -"
]) eachSite);
systemd.services.invoiceplane-config = {
serviceConfig.Type = "oneshot";
script = concatStrings (mapAttrsToList (hostName: cfg:
''
mkdir -p ${cfg.stateDir}/logs \
${cfg.stateDir}/uploads
if ! grep -q IP_URL "${cfg.stateDir}/ipconfig.php"; then
cp "${invoiceplane-config hostName cfg}" "${cfg.stateDir}/ipconfig.php"
fi
'') eachSite);
wantedBy = [ "multi-user.target" ];
};
users.users.${user} = {
group = webserver.group;
isSystemUser = true;
};
}
{
# Cron service implementation
systemd.timers = mapAttrs' (hostName: cfg: (
nameValuePair "invoiceplane-cron-${hostName}" (mkIf cfg.cron.enable {
wantedBy = [ "timers.target" ];
timerConfig = {
OnBootSec = "5m";
OnUnitActiveSec = "5m";
Unit = "invoiceplane-cron-${hostName}.service";
};
})
)) eachSite;
systemd.services =
mapAttrs' (hostName: cfg: (
nameValuePair "invoiceplane-cron-${hostName}" (mkIf cfg.cron.enable {
serviceConfig = {
Type = "oneshot";
User = user;
ExecStart = "${pkgs.curl}/bin/curl --header 'Host: ${hostName}' http://localhost/invoices/cron/recur/${cfg.cron.key}";
};
})
)) eachSite;
}
(mkIf (cfg.webserver == "caddy") {
services.caddy = {
enable = true;
virtualHosts = mapAttrs' (hostName: cfg: (
nameValuePair "http://${hostName}" {
extraConfig = ''
root * ${pkg hostName cfg}
file_server
php_fastcgi unix/${config.services.phpfpm.pools."invoiceplane-${hostName}".socket}
'';
}
)) eachSite;
};
})
]);
}

12
modules/nextcloud/default.nix
View file

@ -6,16 +6,8 @@
}: }:
with lib; let with lib; let
psCfg = config.pub-solar; psCfg = config.pub-solar;
cfg = config.pub-solar.nextcloud;
in { in {
options.pub-solar.nextcloud = { home-manager.users."${psCfg.user.name}" = {
enable = mkEnableOption "Life in sync"; systemd.user.services.nextcloud-client = import ./nextcloud.service.nix pkgs;
};
config = mkIf cfg.enable {
home-manager = with pkgs;
pkgs.lib.setAttrByPath ["users" psCfg.user.name] {
systemd.user.services.nextcloud-client = import ./nextcloud.service.nix pkgs;
};
}; };
} }

11
modules/nix-path.nix
View file

@ -1,11 +0,0 @@
{
channel,
inputs,
...
}: {
nix.nixPath = [
"nixpkgs=${channel.input}"
"nixos-config=${../lib/compat/nixos}"
"home-manager=${inputs.home}"
];
}

32
modules/core/nix.nix → modules/nix/default.nix
View file

@ -2,14 +2,29 @@
config, config,
pkgs, pkgs,
lib, lib,
inputs, flake,
... ...
}: { }: {
nixpkgs.config.allowUnfreePredicate = pkg: builtins.elem (lib.getName pkg) [
"cups-brother-hl3140cw"
"facetimehd-firmware"
"veracrypt"
"zoom"
];
nix = { nix = {
# Use default version alias for nix package # Use default version alias for nix package
package = pkgs.nix; package = pkgs.nix;
gc.automatic = true; gc.automatic = true;
optimise.automatic = true; optimise.automatic = true;
registry = {
nixpkgs.flake = flake.inputs.nixpkgs;
unstable.flake = flake.inputs.unstable;
master.flake = flake.inputs.master;
system.flake = flake.self;
};
settings = { settings = {
# Improve nix store disk usage # Improve nix store disk usage
auto-optimise-store = true; auto-optimise-store = true;
@ -19,7 +34,16 @@
trusted-users = ["root" "@wheel"]; trusted-users = ["root" "@wheel"];
# Allow only group wheel to connect to the nix daemon # Allow only group wheel to connect to the nix daemon
allowed-users = ["@wheel"]; allowed-users = ["@wheel"];
substituters = [
"https://pub-solar.cachix.org/"
];
trusted-public-keys = [
"pub-solar.cachix.org-1:ZicXIxKgdxMtgSJECWR8iihZxHRvu8ObL4n2cuBmtos="
];
}; };
# Generally useful nix option defaults # Generally useful nix option defaults
extraOptions = lib.mkForce '' extraOptions = lib.mkForce ''
experimental-features = flakes nix-command experimental-features = flakes nix-command
@ -28,5 +52,11 @@
keep-derivations = true keep-derivations = true
fallback = true fallback = true
''; '';
nixPath = [
"nixpkgs=${flake.inputs.nixpkgs}"
"nixos-config=${../../lib/compat/nixos}"
"home-manager=${flake.inputs.home-manager}"
];
}; };
} }

30
modules/office/default.nix
View file

@ -6,27 +6,15 @@
}: }:
with lib; let with lib; let
psCfg = config.pub-solar; psCfg = config.pub-solar;
cfg = config.pub-solar.office;
in { in {
options.pub-solar.office = { programs.evince.enable = true;
enable = mkEnableOption "Install office programs, also enables printing server";
};
config = mkIf cfg.enable { users.users."${psCfg.user.name}".packages = with pkgs; [
pub-solar.printing.enable = true; libreoffice-fresh
gnome.simple-scan
# Gnome PDF viewer # Tools like pdfunite
programs.evince.enable = true; poppler_utils
home-manager = with pkgs; # tool for annotating PDFs
pkgs.lib.setAttrByPath ["users" psCfg.user.name] { xournalpp
home.packages = [ ];
libreoffice-fresh
gnome.simple-scan
# Tools like pdfunite
poppler_utils
# tool for annotating PDFs
xournalpp
];
};
};
} }

53
modules/paranoia/default.nix
View file

@ -1,53 +0,0 @@
{
config,
lib,
...
}:
with lib; let
psCfg = config.pub-solar;
cfg = config.pub-solar.paranoia;
in {
options.pub-solar.paranoia = {
enable = mkOption {
description = ''
Only offer hibernation instead of screen locking and sleeping. This only makes sense
if your hard drive is encrypted, and ensures that the contents of your drive are
encrypted if you are not actively using the device.
'';
default = false;
type = types.bool;
};
};
config = mkIf cfg.enable {
pub-solar.core.hibernation.enable = true;
services.logind.lidSwitch = "hibernate";
# The options below are directly taken from or inspired by
# https://xeiaso.net/blog/paranoid-nixos-2021-07-18
# Don't set this if you need sftp
services.openssh.allowSFTP = false;
services.openssh.openFirewall = false; # Lock yourself out
# Limit the use of sudo to the group wheel
security.sudo.execWheelOnly = true;
# Remove the complete default environment of packages like
# nano, perl and rsync
environment.defaultPackages = lib.mkForce [];
# fileSystems."/".options = [ "noexec" ];
services.openssh = {
kbdInteractiveAuthentication = false;
extraConfig = ''
AllowTcpForwarding yes
X11Forwarding no
AllowAgentForwarding no
AllowStreamLocalForwarding no
AuthenticationMethods publickey
'';
};
};
}

60
modules/printing/default.nix
View file

@ -1,38 +1,36 @@
{ {
lib, flake,
config, config,
pkgs, pkgs,
lib,
... ...
}: }: {
with lib; let services.avahi.enable = true;
psCfg = config.pub-solar; services.avahi.ipv6 = true;
cfg = config.pub-solar.printing; services.avahi.nssmdns = true;
in { services.avahi.publish.enable = true;
options.pub-solar.printing = { services.avahi.publish.userServices = true;
enable = mkEnableOption "CUPSSSss";
};
config = mkIf cfg.enable { services.printing.enable = true;
services.avahi.enable = true; services.printing.browsing = true;
services.avahi.nssmdns = true; services.printing.listenAddresses = ["localhost:631"];
services.avahi.publish.enable = true; services.printing.defaultShared = lib.mkDefault false;
services.avahi.publish.userServices = true;
services.printing.enable = true; services.printing.drivers = [
services.printing.browsing = true; pkgs.gutenprint
services.printing.listenAddresses = ["localhost:631"]; ] ++ (if (pkgs.system == "x86_64-linux")
services.printing.allowFrom = ["all"]; then [ pkgs.cups-brother-hl3140cw ]
services.printing.defaultShared = false; else []);
services.printing.drivers = with pkgs; [
gutenprint networking.hosts = flake.self.lib.addLocalHostname ["cups.local"];
brgenml1lpr
brgenml1cupswrapper services.caddy = {
brlaser enable = true;
cnijfilter2 extraConfig = ''
cups-brother-hl3140cw cups.local {
]; request_header Host localhost:631
hardware.sane = { reverse_proxy unix//run/cups/cups.sock
enable = true; }
brscan4.enable = true; '';
};
}; };
} }

27
modules/social/default.nix
View file

@ -1,27 +0,0 @@
{
lib,
config,
pkgs,
...
}:
with lib; let
psCfg = config.pub-solar;
cfg = config.pub-solar.social;
in {
options.pub-solar.social = {
enable = mkEnableOption "Life with others";
};
config = mkIf cfg.enable {
home-manager = with pkgs;
pkgs.lib.setAttrByPath ["users" psCfg.user.name] {
home.packages = [
gurk-rs
signal-desktop
tdesktop
element-desktop
irssi
];
};
};
}

111
modules/sway/default.nix
View file

@ -1,111 +0,0 @@
{
lib,
config,
pkgs,
...
}:
with lib; let
psCfg = config.pub-solar;
in {
options.pub-solar.sway = {
enable = mkEnableOption "Life in boxes";
terminal = mkOption {
type = types.nullOr types.str;
default = "alacritty";
description = "Choose sway's default terminal";
};
v4l2loopback.enable = mkOption {
type = types.bool;
default = true;
description = "WebCam streaming tool";
};
};
config = mkIf psCfg.sway.enable (mkMerge [
(mkIf (psCfg.sway.v4l2loopback.enable) {
boot.extraModulePackages = with config.boot.kernelPackages; [v4l2loopback];
boot.kernelModules = ["v4l2loopback"];
boot.extraModprobeConfig = ''
options v4l2loopback exclusive_caps=1 devices=3
'';
})
{
environment.systemPackages = with pkgs; [
linuxPackages.v4l2loopback
];
programs.sway.enable = true;
xdg.portal = {
enable = true;
wlr = {
enable = true;
settings = {
screencast = {
max_fps = 30;
chooser_type = "simple";
chooser_cmd = "${pkgs.slurp}/bin/slurp -f %o -or";
};
};
};
extraPortals = with pkgs; [xdg-desktop-portal-gtk];
};
services.pipewire.enable = true;
home-manager = with pkgs;
pkgs.lib.setAttrByPath ["users" psCfg.user.name] {
home.packages = with pkgs; [
sway
grim
kanshi
mako
slurp
swaynotificationcenter
swayidle
swaylock
swaybg
xwayland
libappindicator-gtk3
wl-clipboard
wf-recorder
brightnessctl
gammastep
geoclue2
xsettingsd
ydotool
sway-launcher
record-screen
import-gtk-settings
s
wcwd
];
programs.waybar.enable = true;
#programs.waybar.systemd.enable = true;
systemd.user.services.swaynotificationcenter = import ./swaynotificationcenter.service.nix pkgs;
systemd.user.services.sway = import ./sway.service.nix {inherit pkgs psCfg;};
systemd.user.services.swayidle = import ./swayidle.service.nix {inherit pkgs psCfg;};
systemd.user.services.xsettingsd = import ./xsettingsd.service.nix {inherit pkgs psCfg;};
systemd.user.services.waybar = import ./waybar.service.nix {inherit pkgs psCfg;};
systemd.user.targets.sway-session = import ./sway-session.target.nix {inherit pkgs psCfg;};
xdg.configFile."sway/config".text = import ./config/config.nix {inherit config pkgs;};
xdg.configFile."sway/config.d/colorscheme.conf".source = ./config/config.d/colorscheme.conf;
xdg.configFile."sway/config.d/theme.conf".source = ./config/config.d/theme.conf;
xdg.configFile."sway/config.d/gaps.conf".source = ./config/config.d/gaps.conf;
xdg.configFile."sway/config.d/custom-keybindings.conf".source = ./config/config.d/custom-keybindings.conf;
xdg.configFile."sway/config.d/mode_system.conf".text = import ./config/config.d/mode_system.conf.nix {inherit pkgs psCfg;};
xdg.configFile."sway/config.d/applications.conf".source = ./config/config.d/applications.conf;
xdg.configFile."sway/config.d/systemd.conf".source = ./config/config.d/systemd.conf;
};
}
]);
}

35
modules/sway/swayidle.service.nix
View file

@ -1,35 +0,0 @@
{
pkgs,
psCfg,
...
}: {
Unit = {
Description = "Idle manager for Wayland";
Documentation = ["man:swayidle(1)"];
BindsTo = ["graphical-session.target"];
Wants = ["graphical-session-pre.target"];
After = ["graphical-session-pre.target"];
};
Service = {
Type = "simple";
Environment = "PATH=/run/current-system/sw/bin:${pkgs.sway}/bin:${pkgs.swaylock-bg}/bin:${pkgs.swayidle}/bin";
ExecStart =
'' ${pkgs.swayidle}/bin/swayidle -w \
after-resume 'swaymsg "output * dpms on"' \
before-sleep 'swaylock-bg' ''
+ (
if psCfg.paranoia.enable
then '' \
timeout 120 'swaymsg "output * dpms off"' resume 'swaymsg "output * dpms on"' \
timeout 150 'systemctl hibernate'
''
else '' \
timeout 600 'swaylock-bg' \
timeout 900 'swaymsg "output * dpms off"' resume 'swaymsg "output * dpms on"'
''
);
};
Install = {
WantedBy = ["sway-session.target"];
};
}

0
profiles/base-user/.config/git/config.nix → modules/terminal-life/.config/git/config.nix
View file

0
profiles/base-user/.config/git/gitmessage.nix → modules/terminal-life/.config/git/gitmessage.nix
View file

0
profiles/base-user/.config/git/global_gitignore.nix → modules/terminal-life/.config/git/global_gitignore.nix
View file

4554
profiles/base-user/.local/share/nvim/json-schemas/caddy_schema.json → modules/terminal-life/.local/share/nvim/json-schemas/caddy_schema.json
View file

File diff suppressed because one or more lines are too long

0
profiles/base-user/.local/share/scripts/base16.sh → modules/terminal-life/.local/share/scripts/base16.sh
View file

7
modules/terminal-life/bash/default.nix
View file

@ -1,7 +1,7 @@
{ {
config, config,
flake,
pkgs, pkgs,
self,
... ...
}: let }: let
psCfg = config.pub-solar; psCfg = config.pub-solar;
@ -18,6 +18,8 @@ in {
# Run when initializing an interactive shell # Run when initializing an interactive shell
initExtra = '' initExtra = ''
# Use fzf's CTRL-R history widget
source ${pkgs.fzf}/share/fzf/key-bindings.bash
# Show current directory at the top in Alacritty # Show current directory at the top in Alacritty
PROMPT_COMMAND='echo -e -n "\e]2;$(basename "$PWD" | sed "s/${psCfg.user.name}/~/")\e\\"' PROMPT_COMMAND='echo -e -n "\e]2;$(basename "$PWD" | sed "s/${psCfg.user.name}/~/")\e\\"'
@ -85,7 +87,6 @@ in {
fi fi
# end of .bashrc # end of .bashrc
# Somehow we need to ensure starship starts later than ble.sh # Somehow we need to ensure starship starts later than ble.sh
# (possible packaging issue?) # (possible packaging issue?)
# https://github.com/akinomyoga/ble.sh/issues/333 # https://github.com/akinomyoga/ble.sh/issues/333
@ -106,7 +107,7 @@ in {
drone = "DRONE_TOKEN=$(secret-tool lookup drone token) drone"; drone = "DRONE_TOKEN=$(secret-tool lookup drone token) drone";
no = "manix \"\" | grep '^# ' | sed 's/^# \(.*\) (.*/\1/;s/ (.*//;s/^# //' | fzf --preview=\"manix '{}'\" | xargs manix"; no = "manix \"\" | grep '^# ' | sed 's/^# \(.*\) (.*/\1/;s/ (.*//;s/^# //' | fzf --preview=\"manix '{}'\" | xargs manix";
# fix nixos-option # fix nixos-option
nixos-option = "nixos-option -I nixpkgs=${self}/lib/compat"; nixos-option = "nixos-option -I nixpkgs=${flake.self}/lib/compat";
myip = "dig +short myip.opendns.com @208.67.222.222 2>&1"; myip = "dig +short myip.opendns.com @208.67.222.222 2>&1";
nnn = "nnn -d -e -H -r"; nnn = "nnn -d -e -H -r";
}; };

137
modules/terminal-life/default.nix
View file

@ -2,7 +2,7 @@
lib, lib,
config, config,
pkgs, pkgs,
self, flake,
... ...
}: }:
with lib; let with lib; let
@ -10,73 +10,100 @@ with lib; let
cfg = config.pub-solar.terminal-life; cfg = config.pub-solar.terminal-life;
in { in {
options.pub-solar.terminal-life = { options.pub-solar.terminal-life = {
enable = mkEnableOption "Life in black and white"; full = mkOption {
lite = mkOption {
description = '' description = ''
Enable a lite edition of terminal-life with less modules and a reduced package set. Enable a full version, which includes more nvim plugins and lsps.
''; '';
default = false; default = false;
type = types.bool; type = types.bool;
}; };
}; };
config = mkIf cfg.enable { config = {
programs.command-not-found.enable = false; programs.command-not-found.enable = false;
environment.systemPackages = with pkgs; [ users.users."${psCfg.user.name}".packages = with pkgs; [
ack
asciinema
bat
blesh
exa
fd
jump
(nnn.overrideAttrs (o: {
patches =
(o.patches or [])
++ [
./nnn/0001-feat-use-wasd-keybindings-for-jkli.patch
];
}))
powerline
screen screen
silver-searcher
watson
]; ];
# Starship is a fast and featureful shell prompt home-manager.users."${psCfg.user.name}" = {
# starship.toml has sane defaults that can be changed there xdg.dataFile."scripts/base16.sh".source = .local/share/scripts/base16.sh;
programs.starship = {
enable = true;
settings = import ./starship.toml.nix;
};
home-manager = with pkgs; programs.less = {
pkgs.lib.setAttrByPath ["users" psCfg.user.name] { enable = true;
home.packages = [ keys = ''
ack k forw-line
asciinema i back-line
bat K forw-scroll
blesh I back-scroll
exa '';
fd
gh
glow
jump
mdbook-multilang
(nnn.overrideAttrs (o: {
patches =
(o.patches or [])
++ [
./nnn/0001-feat-use-wasd-keybindings-for-jkli.patch
];
}))
notes
powerline
python-wiki-fetch
silver-searcher
watson
tree
];
programs.bash = import ./bash {
inherit config;
inherit pkgs;
inherit self;
};
programs.fzf = import ./fzf {
inherit config;
inherit pkgs;
};
programs.neovim = import ./nvim {
inherit config;
inherit pkgs;
inherit lib;
};
}; };
# Starship is a fast and featureful shell prompt
# starship.toml has sane defaults that can be changed there
programs.starship = {
enable = true;
settings = import ./starship.toml.nix;
};
programs.bash = import ./bash {
inherit config;
inherit pkgs;
inherit lib;
inherit flake;
};
programs.fzf = import ./fzf {
inherit config;
inherit pkgs;
};
programs.neovim = import ./nvim {
inherit config;
inherit pkgs;
inherit lib;
};
# Ensure nvim backup directory gets created
# Workaround for E510: Can't make backup file (add ! to override)
xdg.dataFile."nvim/backup/.keep".text = "";
xdg.dataFile."nvim/json-schemas/.keep".text = "";
# Generated with:
# docker run -it --name caddy-json-schema registry.greenbaum.cloud/gc/caddy-l4:2.5.2 caddy json-schema -output /srv/caddy_schema.json
xdg.dataFile."nvim/json-schemas/caddy_schema.json".source = .local/share/nvim/json-schemas/caddy_schema.json;
xdg.dataFile."nvim/templates/.keep".text = "";
programs.git = import ./git {};
xdg.configFile."git/config".text = import ./.config/git/config.nix {
inherit config;
inherit pkgs;
};
xdg.configFile."git/gitmessage".text = import ./.config/git/gitmessage.nix {
inherit config;
inherit pkgs;
};
xdg.configFile."git/global_gitignore".text = import ./.config/git/global_gitignore.nix {
inherit config;
inherit pkgs;
};
programs.direnv = import ./direnv {};
};
}; };
} }

7
modules/terminal-life/direnv/default.nix Normal file
View file

@ -0,0 +1,7 @@
{ ... }:
{
enable = true;
nix-direnv = {
enable = true;
};
}

5
modules/terminal-life/fzf/default.nix
View file

@ -10,5 +10,8 @@
"--color=fg:#d3d1d4,header:#7accd7,info:#e5c463,pointer:#ef9062" "--color=fg:#d3d1d4,header:#7accd7,info:#e5c463,pointer:#ef9062"
"--color=marker:#ef9062,fg+:#303030,prompt:#e5c463,hl+:#7accd7" "--color=marker:#ef9062,fg+:#303030,prompt:#e5c463,hl+:#7accd7"
]; ];
enableBashIntegration = true; # Use ble.sh for completions, see
# modules/terminal-life/bash/default.nix -> bleopt complete_menu_style=desc
# and https://github.com/akinomyoga/ble.sh/wiki/Manual-%C2%A77-Completion
enableBashIntegration = false;
} }

41
modules/terminal-life/git/default.nix Normal file
View file

@ -0,0 +1,41 @@
{ ... }:
{
enable = true;
extraConfig = {
pull.rebase = false;
};
aliases = {
a = "add -p";
co = "checkout";
cob = "checkout -b";
f = "fetch -p";
c = "commit";
p = "push";
ba = "branch -a";
bd = "branch -d";
bD = "branch -D";
d = "diff";
dc = "diff --cached";
ds = "diff --staged";
r = "restore";
rs = "restore --staged";
st = "status -sb";
# reset
soft = "reset --soft";
hard = "reset --hard";
s1ft = "soft HEAD~1";
h1rd = "hard HEAD~1";
# logging
lg = "log --color --graph --pretty=format:'%Cred%h%Creset -%C(yellow)%d%Creset %s %Cgreen(%cr) %C(bold blue)<%an>%Creset' --abbrev-commit";
plog = "log --graph --pretty='format:%C(red)%d%C(reset) %C(yellow)%h%C(reset) %ar %C(green)%aN%C(reset) %s'";
tlog = "log --stat --since='1 Day Ago' --graph --pretty=oneline --abbrev-commit --date=relative";
rank = "shortlog -sn --no-merges";
# delete merged branches
bdm = "!git branch --merged | grep -v '*' | xargs -n 1 git branch -d";
};
}

212
modules/terminal-life/nvim/default.nix
View file

@ -21,7 +21,7 @@ in {
withPython3 = true; withPython3 = true;
extraPackages = with pkgs; extraPackages = with pkgs;
lib.mkIf (!cfg.lite) [ lib.mkIf (cfg.full) [
ansible-language-server ansible-language-server
ccls ccls
gopls gopls
@ -44,137 +44,135 @@ in {
universal-ctags universal-ctags
]; ];
plugins = with pkgs.vimPlugins; plugins = with pkgs.vimPlugins; lib.mkIf cfg.full [
[] (pkgs.vimPlugins.nvim-treesitter.withPlugins (p: [
++ lib.optionals (!cfg.lite) [ p.ini
(pkgs.vimPlugins.nvim-treesitter.withPlugins (p: [ p.json
p.ini p.json5
p.json p.markdown
p.json5 p.nix
p.markdown p.toml
p.nix p.yaml
p.toml
p.yaml
p.css p.css
p.graphql p.graphql
p.html p.html
p.javascript p.javascript
p.scss p.scss
p.tsx p.tsx
p.typescript p.typescript
p.vue p.vue
p.c p.c
p.cpp p.cpp
p.go p.go
p.gomod p.gomod
p.gosum p.gosum
p.haskell p.haskell
p.lua p.lua
p.php p.php
p.python p.python
p.ruby p.ruby
p.rust p.rust
p.vim p.vim
p.vimdoc p.vimdoc
p.passwd p.passwd
p.sql p.sql
p.diff p.diff
p.gitcommit p.gitcommit
p.gitignore p.gitignore
p.git_config p.git_config
p.gitattributes p.gitattributes
p.git_rebase p.git_rebase
p.bash p.bash
p.dockerfile p.dockerfile
p.make p.make
p.ninja p.ninja
p.terraform p.terraform
])) ]))
# Dependencies for nvim-lspconfig # Dependencies for nvim-lspconfig
nvim-cmp nvim-cmp
cmp-nvim-lsp cmp-nvim-lsp
cmp_luasnip cmp_luasnip
luasnip luasnip
# Quickstart configs for neovim LSP # Quickstart configs for neovim LSP
lsp_extensions-nvim lsp_extensions-nvim
nvim-lspconfig nvim-lspconfig
# Collaborative editing in Neovim using built-in capabilities # Collaborative editing in Neovim using built-in capabilities
instant-nvim-nvfetcher instant-nvim-nvfetcher
# Search functionality behind :Ack # Search functionality behind :Ack
ack-vim ack-vim
# The status bar in the bottom of the screen with the mode indication and file location # The status bar in the bottom of the screen with the mode indication and file location
vim-airline vim-airline
# Automatically load editorconfig files in repos to configure nvim settings # Automatically load editorconfig files in repos to configure nvim settings
editorconfig-vim editorconfig-vim
# File browser. Use <leader>n to access # File browser. Use <leader>n to access
nnn-vim nnn-vim
# Highlight characters when using f, F, t, and T # Highlight characters when using f, F, t, and T
quick-scope quick-scope
# Get sudo in vim; :SudaWrite <optional filename> # Get sudo in vim; :SudaWrite <optional filename>
suda-vim suda-vim
# Undo history etc. per project # Undo history etc. per project
vim-workspace-nvfetcher vim-workspace-nvfetcher
# JSON schemas # JSON schemas
SchemaStore-nvim SchemaStore-nvim
# Work with tags files # Work with tags files
vim-gutentags vim-gutentags
# Neovim colorschemes / themes # Neovim colorschemes / themes
sonokai sonokai
vim-hybrid-material vim-hybrid-material
vim-airline-themes vim-airline-themes
vim-apprentice-nvfetcher vim-apprentice-nvfetcher
# Git integrations # Git integrations
# A Git wrapper so awesome, it should be illegal # A Git wrapper so awesome, it should be illegal
fugitive fugitive
# Shows git diff markers in the sign column # Shows git diff markers in the sign column
vim-gitgutter vim-gitgutter
# GitHub extension for fugitive # GitHub extension for fugitive
vim-rhubarb vim-rhubarb
# Ease your git workflow within Vim # Ease your git workflow within Vim
vimagit-nvfetcher vimagit-nvfetcher
# FZF fuzzy finder # FZF fuzzy finder
fzf-vim fzf-vim
fzfWrapper fzfWrapper
# Make the yanked region apparent # Make the yanked region apparent
vim-highlightedyank vim-highlightedyank
# :Beautify Code beautifier # :Beautify Code beautifier
vim-beautify-nvfetcher vim-beautify-nvfetcher
# Unload, delete or wipe a buffer without closing the window # Unload, delete or wipe a buffer without closing the window
vim-bufkill vim-bufkill
# Defaults everyone can agree on # Defaults everyone can agree on
vim-sensible vim-sensible
# emmet for vim: http://emmet.io/ # emmet for vim: http://emmet.io/
emmet-vim emmet-vim
# Caddyfile syntax support for Vim # Caddyfile syntax support for Vim
vim-caddyfile-nvfetcher vim-caddyfile-nvfetcher
# Fix TOFU hashes when writing nix derivations without leaving neovim # Fix TOFU hashes when writing nix derivations without leaving neovim
vim-nixhash vim-nixhash
]; ];
extraConfig = builtins.concatStringsSep "\n" [ extraConfig = builtins.concatStringsSep "\n" [
'' ''

10
modules/terminal-life/nvim/lsp.vim
View file

@ -74,6 +74,8 @@ lua <<EOF
-- Add additional capabilities supported by nvim-cmp -- Add additional capabilities supported by nvim-cmp
local capabilities = require('cmp_nvim_lsp').default_capabilities() local capabilities = require('cmp_nvim_lsp').default_capabilities()
-- vscode HTML lsp needs this https://github.com/neovim/nvim-lspconfig/blob/master/doc/server_configurations.md#html
capabilities.textDocument.completion.completionItem.snippetSupport = true
-- vscode HTML lsp needs this https://github.com/neovim/nvim-lspconfig/blob/master/doc/server_configurations.md#html -- vscode HTML lsp needs this https://github.com/neovim/nvim-lspconfig/blob/master/doc/server_configurations.md#html
capabilities.textDocument.completion.completionItem.snippetSupport = true capabilities.textDocument.completion.completionItem.snippetSupport = true
@ -146,7 +148,6 @@ lua <<EOF
['settings'] = { ['settings'] = {
['yaml'] = { ['yaml'] = {
['schemas'] = { ['schemas'] = {
["https://raw.githubusercontent.com/instrumenta/kubernetes-json-schema/master/v1.18.1-standalone-strict/all.json"] = ".sensu/*.{yml,yaml}",
['https://json.schemastore.org/github-workflow'] = '.github/workflows/*.{yml,yaml}', ['https://json.schemastore.org/github-workflow'] = '.github/workflows/*.{yml,yaml}',
['https://json.schemastore.org/github-action'] = '.github/action.{yml,yaml}', ['https://json.schemastore.org/github-action'] = '.github/action.{yml,yaml}',
['https://json.schemastore.org/drone'] = '*.drone.{yml,yaml}', ['https://json.schemastore.org/drone'] = '*.drone.{yml,yaml}',
@ -173,6 +174,13 @@ lua <<EOF
end end
end -- ‡ end -- ‡
-- configure floating diagnostics appearance, symbols
local signs = { Error = " ", Warn = " ", Hint = " ", Info = " " }
for type, icon in pairs(signs) do
local hl = "DiagnosticSign" .. type
vim.fn.sign_define(hl, { text = icon, texthl = hl, numhl = hl })
end
-- Set completeopt to have a better completion experience -- Set completeopt to have a better completion experience
vim.o.completeopt = 'menuone,noselect' vim.o.completeopt = 'menuone,noselect'

31
modules/uhk/default.nix
View file

@ -1,31 +0,0 @@
{
lib,
config,
pkgs,
...
}:
with lib; let
psCfg = config.pub-solar;
cfg = config.pub-solar.uhk;
in {
options.pub-solar.uhk = {
enable = mkEnableOption "Ultimate Hacking Keyboard";
};
config = mkIf cfg.enable {
environment.systemPackages = with pkgs; [
uhk-agent
];
# Ultimate Hacking Keyboard rules
# These are the udev rules for accessing the USB interfaces of the UHK as non-root users.
services.udev.packages = with pkgs; [
uhk-agent
];
services.udev.extraRules = ''
SUBSYSTEM=="input", ATTRS{idVendor}=="1d50", ATTRS{idProduct}=="612[0-7]", GROUP="input", MODE="0660"
SUBSYSTEMS=="usb", ATTRS{idVendor}=="1d50", ATTRS{idProduct}=="612[0-7]", TAG+="uaccess"
KERNEL=="hidraw*", ATTRS{idVendor}=="1d50", ATTRS{idProduct}=="612[0-7]", TAG+="uaccess"
'';
};
}

0
profiles/base-user/.config/dircolors → modules/user/.config/dircolors
View file

0
profiles/base-user/.config/mimeapps.list → modules/user/.config/mimeapps.list
View file

62
modules/user/default.nix
View file

@ -1,12 +1,16 @@
{ {
lib,
config, config,
pkgs, pkgs,
lib,
... ...
}: }: let
with lib; let psCfg = config.pub-solar;
cfg = config.pub-solar; in
in { with lib; {
imports = [
./home.nix
];
options.pub-solar = { options.pub-solar = {
user = { user = {
name = mkOption { name = mkOption {
@ -24,6 +28,11 @@ in {
type = types.nullOr types.str; type = types.nullOr types.str;
default = null; default = null;
}; };
passwordlessSudo = mkOption {
description = "Whether this user can use sudo without entering a password";
type = types.bool;
default = false;
};
publicKeys = mkOption { publicKeys = mkOption {
description = "User SSH public keys"; description = "User SSH public keys";
type = types.listOf types.str; type = types.listOf types.str;
@ -46,4 +55,47 @@ in {
}; };
}; };
}; };
config = {
users = {
mutableUsers = false;
users."${psCfg.user.name}" = {
# Indicates whether this is an account for a “real” user.
# This automatically sets group to users, createHome to true,
# home to /home/username, useDefaultShell to true, and isSystemUser to false.
isNormalUser = true;
description = psCfg.user.description;
extraGroups = [
"input"
"lp"
"networkmanager"
"scanner"
"video"
"wheel"
];
shell = pkgs.bash;
initialHashedPassword =
if psCfg.user.password != null
then psCfg.user.password
else "";
openssh.authorizedKeys.keys =
if psCfg.user.publicKeys != null
then psCfg.user.publicKeys
else [];
};
};
security.sudo.extraRules = mkIf psCfg.user.passwordlessSudo [
{
users = ["${psCfg.user.name}"];
commands = [
{
command = "ALL";
options = ["NOPASSWD"];
}
];
}
];
};
} }

50
modules/user/home.nix Normal file
View file

@ -0,0 +1,50 @@
{
config,
pkgs,
lib,
...
}:
with lib; let
psCfg = config.pub-solar;
xdg = config.home-manager.users."${psCfg.user.name}".xdg;
in {
imports = [
./session-variables.nix
];
home-manager.users."${psCfg.user.name}" = {
# Let Home Manager install and manage itself.
programs.home-manager.enable = true;
# Home Manager needs a bit of information about you and the
# paths it should manage.
home.username = psCfg.user.name;
home.homeDirectory = "/home/${psCfg.user.name}";
home.stateVersion = "22.11";
programs.dircolors.enable = true;
xdg.enable = true;
xdg.mime.enable = true;
xdg.mimeApps = import ./mimeapps.nix;
xdg.configFile."dircolors".source = ./.config/dircolors;
xdg.dataFile."shell.nix.tmpl" = {
text = ''
let
unstable = import (fetchTarball https://github.com/nixos/nixpkgs/archive/nixos-unstable.tar.gz) { };
in
{ nixpkgs ? import <nixpkgs> {} }:
with nixpkgs; mkShell {
buildInputs = [
];
}
'';
target = "nvim/templates/shell.nix.tmpl";
};
# Allow unfree packages only on a user basis, not on a system-wide basis
xdg.configFile."nixpkgs/config.nix".text = " { allowUnfree = true; } ";
};
}

2
profiles/base-user/mimeapps.nix → modules/user/mimeapps.nix
View file

@ -22,6 +22,6 @@
"x-scheme-handler/https" = ["firefox.desktop"]; "x-scheme-handler/https" = ["firefox.desktop"];
"x-scheme-handler/mailto" = ["userapp-Thunderbird.desktop"]; "x-scheme-handler/mailto" = ["userapp-Thunderbird.desktop"];
"x-scheme-handler/msteams" = ["teams.desktop"]; "x-scheme-handler/msteams" = ["teams.desktop"];
"x-scheme-handler/tg" = ["userapp-Telegram Desktop-1RE3J1.desktop"]; "x-scheme-handler/tg" = ["userapp-Telegram Desktop-JBKFU0.desktop"];
}; };
} }

Some files were not shown because too many files have changed in this diff Show more