teutat3s/os
1
0
Fork 0
forked from pub-solar/os
Code Pull requests Activity

feat: fae and paperless-ngx

Browse source
This commit is contained in:
teutat3s 2024-02-02 23:25:54 +01:00
parent 182138d33c
commit b307d4e8ff
Signed by: teutat3s
GPG key ID: 4FA1D3FA524F22C1
10 changed files with 217 additions and 124 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

11
flake.nix
View file

@ -92,7 +92,7 @@
};
flake = {
deploy.nodes = self.b12f-os.lib.deploy.mkDeployNodes self.nixosConfigurations {
deploy.nodes = self.lib.deploy.mkDeployNodes self.nixosConfigurations {
#example = {
# hostname = "example.com:22";
# sshUser = "bartender";
@ -103,15 +103,10 @@
# path = self.pkgs.x86_64-linux.nixos.deploy-rs.lib.x86_64-linux.activate.home-manager self.homeConfigurationsPortable.x86_64-linux.bartender;
# };
#};
fae = {
hostname = "fae.fritz.box:22";
hostname = "192.168.178.31";
sshUser = "pub-solar";
fastConnect = true;
profilesOrder = ["system" "direnv"];
profiles.direnv = {
user = "pub-solar";
path = self.pkgs.x86_64-linux.nixos.deploy-rs.lib.x86_64-linux.activate.home-manager self.homeConfigurationsPortable.x86_64-linux.pub-solar;
};
};
powder = {
hostname = "80.71.153.194";

18
hosts/default.nix
View file

@ -35,15 +35,15 @@
];
};
#fae = self.nixos-flake.lib.mkLinuxSystem {
# nixpkgs.hostPlatform = "x86_64-linux";
# imports = [
# self.nixosModules.base
# ./fae
# self.nixosModules.teutat3s
# self.nixosModules.wireguard-client
# ];
#};
fae = self.nixos-flake.lib.mkLinuxSystem {
nixpkgs.hostPlatform = "aarch64-linux";
imports = [
self.nixosModules.base
inputs.nixos-hardware.nixosModules.raspberry-pi-4
./fae
self.nixosModules.pub-solar
];
};
#powder = self.nixos-flake.lib.mkLinuxSystem {
# nixpkgs.hostPlatform = "aarch64-linux";

100
hosts/fae.nix
View file

@ -1,100 +0,0 @@
{
config,
lib,
pkgs,
profiles,
...
}: {
imports = [
# profiles.networking
#profiles.core
"${
fetchTarball {
url = "https://github.com/NixOS/nixos-hardware/archive/8f1bf828d8606fe38a02df312cf14546ae200a72.tar.gz";
sha256 = "11milap153g3f63fcrcv4777vd64f7wlfkk9p3kpxi6dqd2sxvh4";
}
}/raspberry-pi/4"
profiles.users.root # make sure to configure ssh keys
profiles.users.pub-solar
profiles.base-user
profiles.pub-solar-iso
];
config = {
pub-solar.core.iso-options.enable = true;
fileSystems = {
"/" = {
device = "/dev/disk/by-label/NIXOS_SD";
fsType = "ext4";
options = ["noatime"];
};
};
environment.systemPackages = with pkgs; [
(kodi-gbm.withPackages (p: with p; [jellyfin netflix youtube]))
];
services.openssh.enable = true;
networking.firewall = {
allowedTCPPorts = [8080];
allowedUDPPorts = [8080];
};
security.sudo.extraConfig = lib.mkAfter ''
%wheel ALL=(ALL) NOPASSWD:ALL
'';
nix = {
autoOptimiseStore = true;
gc.automatic = true;
optimise.automatic = true;
useSandbox = true;
allowedUsers = ["@wheel"];
trustedUsers = ["root" "@wheel"];
extraOptions = ''
min-free = 536870912
keep-outputs = true
keep-derivations = true
fallback = true
'';
};
# Enable GPU acceleration
hardware.raspberry-pi."4".fkms-3d.enable = true;
# Define a user account for kodi
users.extraUsers.kodi.isNormalUser = true;
services.xserver = {
enable = true;
desktopManager.kodi.enable = true;
desktopManager.kodi.package = pkgs.kodi-gbm;
displayManager = {
autoLogin.enable = true;
autoLogin.user = "kodi";
};
};
hardware.pulseaudio.enable = true;
# custom raspi boot loader is already present
boot.loader.systemd-boot.enable = lib.mkForce false;
boot.kernelPackages = lib.mkForce pkgs.linuxPackages_rpi4;
# This value determines the NixOS release from which the default
# settings for stateful data, like file locations and database versions
# on your system were taken. It‘s perfectly fine and recommended to leave
# this value at the release version of the first install of this system.
# Before changing this value read the documentation for this option
# (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
system.stateVersion = "21.05"; # Did you read the comment?
};
}

6
hosts/fae/default.nix Normal file
View file

@ -0,0 +1,6 @@
{...}: {
imports = [
./paperless.nix
./fae.nix
];
}

67
hosts/fae/fae.nix Normal file
View file

@ -0,0 +1,67 @@
{
config,
lib,
pkgs,
...
}: {
config = {
pub-solar.core.disk-encryption-active = false;
fileSystems = {
"/" = {
device = "/dev/disk/by-label/NIXOS_SD";
fsType = "ext4";
options = ["noatime"];
};
};
networking.hostName = "fae";
services.openssh = {
enable = true;
openFirewall = true;
};
boot.kernelParams = [
"boot.shell_on_fail=1"
];
environment.noXlibs = true;
nix = {
gc.automatic = true;
optimise.automatic = true;
settings = {
auto-optimise-store = true;
sandbox = true;
allowed-users = ["@wheel"];
trusted-users = ["root" "@wheel"];
};
extraOptions = ''
min-free = 536870912
keep-outputs = true
keep-derivations = true
fallback = true
'';
};
# custom raspi boot loader is already present
boot.loader.systemd-boot.enable = false;
boot.loader.grub.enable = false;
boot.loader.generic-extlinux-compatible.enable = true;
boot.kernelPackages = pkgs.linuxPackages_6_6;
nixpkgs.hostPlatform = lib.mkDefault "aarch64-linux";
# This value determines the NixOS release from which the default
# settings for stateful data, like file locations and database versions
# on your system were taken. It‘s perfectly fine and recommended to leave
# this value at the release version of the first install of this system.
# Before changing this value read the documentation for this option
# (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
system.stateVersion = "23.11"; # Did you read the comment?
};
}

121
hosts/fae/paperless.nix Normal file
View file

@ -0,0 +1,121 @@
{
flake,
lib,
config,
pkgs,
...
}:
with lib; let
psCfg = config.pub-solar;
xdg = config.home-manager.users."${psCfg.user.name}".xdg;
dataDir = "${xdg.dataHome}/Paperless";
backupDir = "${xdg.dataHome}/PaperlessBackup";
consumptionDir = "/home/${psCfg.user.name}/.local/share/scandir";
scan2paperless = with pkgs; writeShellScriptBin "scan2paperless" ''
DEVICE=$1
NUM_PAGES=$2
NAME=$3
if [ -z "''${DEVICE}" ] || [ -z "''${NUM_PAGES}" ] || [ -z "''${NAME}" ]; then
echo "Usage: scan2paperless <device> <num_pages> <name>"
exit 1
fi
tmpDir=$(${coreutils}/bin/mktemp -d)
files=()
for i in $(seq 1 $NUM_PAGES); do
fileName=$(${openssl}/bin/openssl rand -hex 12)
file="$tmpDir/$fileName.jpg"
echo "Start scanning page $i/$NUM_PAGES";
${sane-backends}/bin/scanimage -d $DEVICE --format=jpeg --resolution 300 --progress -o $file
echo "Finished scanning page $i";
files+=($file)
done
pdf="${consumptionDir}/$NAME.pdf"
${python3Packages.img2pdf}/bin/img2pdf --output $pdf ''${files[@]}
echo "PDF written to $pdf"
'';
in {
services.paperless = {
enable = true;
user = psCfg.user.name;
consumptionDir = consumptionDir;
dataDir = dataDir;
address = "127.0.0.1";
extraConfig = {
PAPERLESS_OCR_LANGUAGE = "nld+deu";
PAPERLESS_ADMIN_USER = psCfg.user.name;
PAPERLESS_AUTO_LOGIN_USERNAME = psCfg.user.name;
PAPERLESS_URL = "https://paperless.local";
};
};
#hardware.sane = {
# enable = true;
# extraBackends = [pkgs.hplipWithPlugin];
#};
users.users."${psCfg.user.name}".packages = with pkgs; [
scan2paperless
python3Packages.img2pdf
];
home-manager.users."${psCfg.user.name}" = {
home.sessionVariables = {
SCANNER_OUTPUT_DIR = consumptionDir;
};
systemd.user.sessionVariables = {
SCANNER_OUTPUT_DIR = consumptionDir;
};
};
#security.acme.certs = {
# "paperless.b12f.io" = {};
#};
services.caddy = {
enable = true;
virtualHosts = {
"paperless.local" = {
extraConfig = ''
reverse_proxy :${builtins.toString config.services.paperless.port}
'';
};
};
};
networking.firewall.allowedTCPPorts = [ 80 443 ];
systemd.tmpfiles.rules = [
"d /home/${psCfg.user.name}/.local 0700 ${psCfg.user.name} users - -"
"d /home/${psCfg.user.name}/.local/share 0700 ${psCfg.user.name} users - -"
"d '${backupDir}' 0700 ${psCfg.user.name} users - -"
];
#age.secrets."rclone-pie.conf" = {
# file = "${flake.self}/secrets/rclone-pie.conf.age";
# path = "/root/.config/rclone/rclone.conf";
# mode = "400";
#};
#age.secrets."restic-password" = {
# file = "${flake.self}/secrets/restic-password.age";
# mode = "400";
#};
#services.restic.backups = {
# paperless = {
# paths = [ backupDir ];
# initialize = true;
# passwordFile = config.age.secrets."restic-password".path;
# # See https://www.hosting.de/blog/verschluesselte-backups-mit-rclone-und-restic-in-nextcloud/
# repository = "rclone:cloud.pub.solar:/backups/Paperless";
# backupPrepareCommand = "${dataDir}/paperless-manage document_exporter ${backupDir} -c -p";
# rcloneConfigFile = config.age.secrets."rclone-pie.conf".path;
# };
#};
}

2
modules/crypto/default.nix
View file

@ -22,7 +22,7 @@ in {
services.gpg-agent = {
enable = true;
pinentryFlavor = "gnome3";
pinentryFlavor = lib.mkDefault "gnome3";
verbose = true;
};

1
users/default.nix
View file

@ -4,6 +4,7 @@
nixosModules = rec {
root = import ./root;
teutat3s = import ./teutat3s;
pub-solar = import ./pub-solar;
nixos = import ./nixos;
};
};

11
users/pub-solar/default.nix
View file

@ -6,11 +6,14 @@
# The rest is used for programs like git
user = {
name = "pub-solar";
# default password = pub-solar
password = "$6$Kv0BCLU2Jg7GN8Oa$hc2vERKCbZdczFqyHPfgCaleGP.JuOWyd.bfcIsLDNmExGXI6Rnkze.SWzVzVS311KBznN/P4uUYAUADXkVtr.";
password = "$6$guLp1v0G0TxGThXX$y7YeEcYjFpN6gutLCbvAkqppOVLYZjfo4DxofrMm6a9MIjVoKKaY20UzityJsHbQU4THIFfj8gLWVOjyjL.P2.";
passwordlessSudo = true;
fullName = "Pub Solar";
email = "iso@pub.solar";
publicKeys = [];
email = "teutat3s@pub.solar";
publicKeys = [
"ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBFro/k4Mgqyh8yV/7Zwjc0dv60ZM7bROBU9JNd99P/4co6fxPt1pJiU/pEz2Dax/HODxgcO+jFZfvPEuLMCeAl0= YubiKey #10593996 PIV Slot 9a"
];
};
};
home-manager.users.pub-solar.services.gpg-agent.pinentryFlavor = "curses";
}

4
users/teutat3s/home.nix
View file

@ -67,14 +67,14 @@ in {
gpu-switch
ifmetric
ipmitool
keybase-gui
#keybase-gui
nomad_1_4
thunderbird
vault
veracrypt
waypoint
age-plugin-yubikey
cockroach-bin
#cockroach-bin
obs-studio
wlvncc
];