1
0
Fork 0
This commit is contained in:
Lukas Wurzinger 2025-05-11 22:49:04 +02:00
parent be9fb9278e
commit b8af0e9761
No known key found for this signature in database
165 changed files with 1815 additions and 1431 deletions

10
.envrc
View file

@ -1,9 +1 @@
watch_file flake.nix
watch_file flake.lock
DEVENV_ROOT_FILE="$(mktemp)"
printf %s "$PWD" > "$DEVENV_ROOT_FILE"
if ! use flake . --override-input devenv-root "file+file://$DEVENV_ROOT_FILE"
then
echo "devenv could not be built. The devenv environment was not loaded. Make the necessary changes to devenv.nix and hit enter to try again." >&2
fi
use flake

View file

@ -1,3 +0,0 @@
{pkgs, ...}: {
environment.systemPackages = [pkgs.wl-clipboard];
}

View file

@ -1,6 +0,0 @@
{pkgs, ...}: {
# TODO: wrap
environment.systemPackages = [
pkgs.vscodium
];
}

View file

@ -1,17 +0,0 @@
{inputs, ...}: {
imports = [
inputs.nixos-cosmic.nixosModules.default
];
nix.settings = {
substituters = ["https://cosmic.cachix.org"];
trusted-public-keys = ["cosmic.cachix.org-1:Dya9IyXD4xdBehWjrkPv6rtxpmMdRel02smYzA85dPE="];
};
services = {
desktopManager.cosmic.enable = true;
displayManager.cosmic-greeter.enable = true;
};
environment.sessionVariables.COSMIC_DATA_CONTROL_ENABLED = 1;
}

View file

@ -1,3 +0,0 @@
{pkgs, ...}: {
environment.systemPackages = [pkgs.devenv];
}

View file

@ -1,7 +0,0 @@
{inputs, ...}: {
imports = [
inputs.flatpak.nixosModules.nix-flatpak
];
services.flatpak.enable = true;
}

View file

@ -1,27 +0,0 @@
{pkgs, ...}: {
fonts = {
enableDefaultPackages = true;
packages = [
pkgs.noto-fonts
pkgs.noto-fonts-extra
pkgs.noto-fonts-cjk-sans
pkgs.noto-fonts-cjk-serif
pkgs.noto-fonts-monochrome-emoji
pkgs.noto-fonts-color-emoji
pkgs.nerd-fonts.fira-code
];
fontconfig = {
enable = true;
defaultFonts = {
monospace = ["FiraCode Nerd Font"];
sansSerif = ["Noto Sans"];
serif = ["Noto Serif"];
emoji = ["Noto Color Emoji" "Noto Emoji"];
};
};
fontDir.enable = true;
};
}

View file

@ -1,10 +0,0 @@
{
hardware = {
bluetooth.enable = true;
steam-hardware.enable = true;
xone.enable = true;
xpadneo.enable = true;
opentabletdriver.enable = true;
graphics.enable = true;
};
}

View file

@ -1,3 +0,0 @@
{
location.provider = "geoclue2";
}

View file

@ -1,6 +0,0 @@
{pkgs, ...}: {
services.mullvad-vpn = {
enable = true;
package = pkgs.mullvad-vpn;
};
}

View file

@ -1,10 +0,0 @@
{config, ...}: {
services.resolved.enable = true;
networking.networkmanager = {
enable = true;
dns = "systemd-resolved";
};
users.groups.networkmanager.members = config.users.normalUsers;
}

View file

@ -1,11 +0,0 @@
{
security.rtkit.enable = true;
services.pipewire = {
enable = true;
wireplumber.enable = true;
alsa.enable = true;
pulse.enable = true;
jack.enable = true;
};
}

View file

@ -1,6 +0,0 @@
{
services.printing = {
enable = true;
webInterface = true;
};
}

View file

@ -1,6 +0,0 @@
{
environment.sessionVariables = {
NIXOS_OZONE_WL = "1";
SDL_VIDEODRIVER = "wayland";
};
}

View file

@ -1,3 +0,0 @@
{
xdg.portal.xdgOpenUsePortal = true;
}

View file

@ -1,3 +0,0 @@
{
networking.useNetworkd = true;
}

View file

@ -1,3 +0,0 @@
{
time.timeZone = "UTC";
}

View file

@ -1,4 +1,5 @@
{inputs, ...}: {
{ inputs, ... }:
{
imports = [
inputs.agenix.nixosModules.default
];

View file

@ -1,5 +1,6 @@
{ config, ... }:
{
fileSystems."/boot" = {
fileSystems.${config.boot.loader.efi.efiSysMountPoint} = {
label = "BOOT";
fsType = "vfat";
};
@ -16,6 +17,12 @@
efiSysMountPoint = "/boot";
};
};
tmp.cleanOnBoot = true;
# TODO
tmp = {
useTmpfs = true;
tmpfsSize = "50%";
cleanOnBoot = true;
};
};
}

View file

@ -1,3 +1,4 @@
{pkgs, ...}: {
environment.systemPackages = [pkgs.bottom];
{ pkgs, ... }:
{
environment.systemPackages = [ pkgs.bottom ];
}

View file

@ -1,4 +1,5 @@
{pkgs, ...}: {
{ pkgs, ... }:
{
programs.fish.enable = true;
users.defaultUserShell = pkgs.fish;

View file

@ -1,7 +0,0 @@
{
nix.gc = {
automatic = true;
dates = "daily";
options = "--delete-older-than 7d";
};
}

View file

@ -1,4 +1,5 @@
{pkgs, ...}: {
{ pkgs, ... }:
{
environment.systemPackages = [
pkgs.gitui
];

View file

@ -1,16 +1,21 @@
{
inputs,
lib,
pkgs,
...
}: let
package = pkgs.helix;
in {
environment.systemPackages = [package];
}:
let
package = inputs.hxwrap.packages.${pkgs.system}.default;
in
{
environment.systemPackages = [ package ];
environment.sessionVariables = let
exe = builtins.baseNameOf (lib.getExe package);
in {
EDITOR = exe;
VISUAL = exe;
};
environment.sessionVariables =
let
exe = builtins.baseNameOf (lib.getExe package);
in
{
EDITOR = exe;
VISUAL = exe;
};
}

View file

@ -1,5 +1,9 @@
{pkgs, ...}: {
networking.nftables.enable = true;
{ attrName, pkgs, ... }:
{
networking = {
hostName = attrName;
nftables.enable = true;
};
environment.systemPackages = [
pkgs.nixos-firewall-tool

17
common/nh.nix Normal file
View file

@ -0,0 +1,17 @@
{
pkgs,
self,
...
}:
{
programs.nh = {
enable = true;
clean = {
enable = true;
extraArgs = "--keep 5 --keep-since 1w";
dates = "weekly";
};
};
environment.sessionVariables.NH_FLAKE = "git+https://forgejo@forgejo.helveticanonstandard.net/helvetica/puter.git"; # TODO
}

View file

@ -1,4 +1,5 @@
{inputs, ...}: {
{ inputs, ... }:
{
imports = [
inputs.nix-index-database.nixosModules.nix-index
];

View file

@ -3,16 +3,17 @@
inputs,
lib,
...
}: {
}:
{
nix = {
registry = lib.mapAttrs (_: value: {flake = value;}) inputs;
registry = lib.mapAttrs (_: value: { flake = value; }) inputs;
nixPath = lib.mapAttrsToList (key: _: "${key}=flake:${key}") config.nix.registry;
optimise.automatic = true;
settings = {
trusted-users = ["root"] ++ config.users.normalUsers;
trusted-users = [ "root" ] ++ config.users.normalUsers;
experimental-features = [
"nix-command"
"flakes"
@ -24,5 +25,4 @@
};
nixpkgs.config.allowUnfree = true;
hardware.enableAllFirmware = true;
}

View file

@ -2,10 +2,12 @@
lib,
self,
...
}: {
options.pubkeys = let
inherit (lib) types;
in
}:
{
options.pubkeys =
let
inherit (lib) types;
in
lib.mkOption {
type = types.attrsOf (types.attrsOf types.str);
description = ''

View file

@ -1,12 +0,0 @@
{
pkgs,
self,
...
}: {
environment = {
systemPackages = [
self.packages.${pkgs.system}.puter
];
sessionVariables.PUTER_FLAKEREF = "git+https://forgejo@tea.wrz.one/lukas/puter.git";
};
}

View file

@ -1,4 +1,5 @@
{pkgs, ...}: {
{ pkgs, ... }:
{
environment.systemPackages = [
pkgs.ripgrep
];

25
common/rsync.nix Normal file
View file

@ -0,0 +1,25 @@
{
lib,
pkgs,
...
}:
{
#services.rsync = {
# enable = true;
# commonArgs = let
# rsh = "${lib.getExe pkgs.openssh} -i /etc/ssh/ssh_host_ed25519_key -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null";
# in [
# "--verbose"
# "--verbose"
# "--archive"
# "--update"
# "--delete"
# "--mkpath"
# "--exclude"
# "lost+found"
# "--rsh"
# rsh
# ];
#};
}

6
common/shpool.nix Normal file
View file

@ -0,0 +1,6 @@
{ pkgs, ... }:
{
environment.systemPackages = [
pkgs.shpool
];
}

View file

@ -1,5 +1,5 @@
{
age.identityPaths = ["/etc/ssh/ssh_host_ed25519_key"];
age.identityPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
services.openssh = {
enable = true;

View file

@ -1,6 +1,8 @@
{config, ...}: let
{ config, ... }:
let
inherit (config.networking) hostName;
in {
in
{
services.syncthing = {
enable = true;
systemService = true;

View file

@ -1,4 +1,5 @@
{config, ...}: {
{ config, ... }:
{
services.tailscale = {
enable = true;
openFirewall = true;

View file

@ -2,10 +2,12 @@
config,
lib,
...
}: let
}:
let
inherit (config.users) mainUser;
in {
age.secrets = lib.mkSecrets {"user-${mainUser}" = {};};
in
{
age.secrets = lib.mkSecrets { "user-${mainUser}" = { }; };
users = {
mutableUsers = false;
@ -20,7 +22,7 @@ in {
isNormalUser = true;
hashedPasswordFile = config.age.secrets."user-${mainUser}".path;
openssh.authorizedKeys.keys = builtins.attrValues config.pubkeys.users;
extraGroups = ["wheel"]; #TODO remove
extraGroups = [ "wheel" ]; # TODO remove
};
};
};

View file

@ -1,3 +1,4 @@
{config, ...}: {
{ config, ... }:
{
users.groups.wheel.members = config.users.normalUsers;
}

View file

@ -1,4 +1,5 @@
{pkgs, ...}: {
{ pkgs, ... }:
{
environment.systemPackages = [
pkgs.zellij
];

View file

@ -1,21 +0,0 @@
{
languages.python.enable = true;
pre-commit.hooks = {
# Nix
alejandra.enable = true;
deadnix.enable = true;
statix.enable = true;
# Flakes
flake-checker.enable = true;
# Shell
shellcheck.enable = true;
# Python
pyright.enable = true;
ruff.enable = true;
ruff-format.enable = true;
};
}

657
flake.lock generated
View file

@ -8,11 +8,11 @@
"systems": "systems"
},
"locked": {
"lastModified": 1736955230,
"narHash": "sha256-uenf8fv2eG5bKM8C/UvFaiJMZ4IpUFaQxk9OH5t/1gA=",
"lastModified": 1745630506,
"narHash": "sha256-bHCFgGeu8XjWlVuaWzi3QONjDW3coZDqSHvnd4l7xus=",
"owner": "ryantm",
"repo": "agenix",
"rev": "e600439ec4c273cf11e06fe4d9d906fb98fa097c",
"rev": "96e078c646b711aee04b82ba01aefbff87004ded",
"type": "github"
},
"original": {
@ -21,49 +21,6 @@
"type": "github"
}
},
"cachix": {
"inputs": {
"devenv": [
"devenv"
],
"flake-compat": [
"devenv"
],
"git-hooks": [
"devenv"
],
"nixpkgs": "nixpkgs_2"
},
"locked": {
"lastModified": 1742042642,
"narHash": "sha256-D0gP8srrX0qj+wNYNPdtVJsQuFzIng3q43thnHXQ/es=",
"owner": "cachix",
"repo": "cachix",
"rev": "a624d3eaf4b1d225f918de8543ed739f2f574203",
"type": "github"
},
"original": {
"owner": "cachix",
"ref": "latest",
"repo": "cachix",
"type": "github"
}
},
"crane": {
"locked": {
"lastModified": 1731098351,
"narHash": "sha256-HQkYvKvaLQqNa10KEFGgWHfMAbWBfFp+4cAgkut+NNE=",
"owner": "ipetkov",
"repo": "crane",
"rev": "ef80ead953c1b28316cc3f8613904edc2eb90c28",
"type": "github"
},
"original": {
"owner": "ipetkov",
"repo": "crane",
"type": "github"
}
},
"darwin": {
"inputs": {
"nixpkgs": [
@ -72,11 +29,11 @@
]
},
"locked": {
"lastModified": 1700795494,
"narHash": "sha256-gzGLZSiOhf155FW7262kdHo2YDeugp3VuIFb4/GGng0=",
"lastModified": 1744478979,
"narHash": "sha256-dyN+teG9G82G+m+PX/aSAagkC+vUv0SgUw3XkPhQodQ=",
"owner": "lnl7",
"repo": "nix-darwin",
"rev": "4b9b83d5a92e8c1fbfd8eb27eda375908c11ec4d",
"rev": "43975d782b418ebf4969e9ccba82466728c2851b",
"type": "github"
},
"original": {
@ -86,40 +43,6 @@
"type": "github"
}
},
"devenv": {
"inputs": {
"cachix": "cachix",
"flake-compat": "flake-compat",
"git-hooks": "git-hooks",
"nix": "nix",
"nixpkgs": "nixpkgs_4"
},
"locked": {
"lastModified": 1744298740,
"narHash": "sha256-m5RnbHQqYQhQA4ntohXlJsiIsOAKx+pz/vOC+E+FmHg=",
"owner": "cachix",
"repo": "devenv",
"rev": "028c6a38fb0284c96691176bd31626bf36981129",
"type": "github"
},
"original": {
"owner": "cachix",
"repo": "devenv",
"type": "github"
}
},
"devenv-root": {
"flake": false,
"locked": {
"narHash": "sha256-d6xi4mKdjkX2JFicDIv5niSzpyI0m/Hnm8GGAIU04kY=",
"type": "file",
"url": "file:///dev/null"
},
"original": {
"type": "file",
"url": "file:///dev/null"
}
},
"flake-compat": {
"flake": false,
"locked": {
@ -139,27 +62,11 @@
"flake-compat_2": {
"flake": false,
"locked": {
"lastModified": 1696426674,
"narHash": "sha256-kvjfFW7WAETZlt09AgDn1MrtKzP7t90Vf7vypd3OL1U=",
"owner": "edolstra",
"repo": "flake-compat",
"rev": "0f9255e01c2351cc7d116c072cb317785dd33b33",
"type": "github"
},
"original": {
"owner": "edolstra",
"repo": "flake-compat",
"type": "github"
}
},
"flake-compat_3": {
"flake": false,
"locked": {
"lastModified": 1717312683,
"narHash": "sha256-FrlieJH50AuvagamEvWMIE6D2OAnERuDboFDYAED/dE=",
"lastModified": 1746162366,
"narHash": "sha256-5SSSZ/oQkwfcAz/o/6TlejlVGqeK08wyREBQ5qFFPhM=",
"owner": "nix-community",
"repo": "flake-compat",
"rev": "38fd3954cf65ce6faf3d0d45cd26059e059f07ea",
"rev": "0f158086a2ecdbb138cd0429410e44994f1b7e4b",
"type": "github"
},
"original": {
@ -168,45 +75,7 @@
"type": "github"
}
},
"flake-compat_4": {
"flake": false,
"locked": {
"lastModified": 1733328505,
"narHash": "sha256-NeCCThCEP3eCl2l/+27kNNK7QrwZB1IJCrXfrbv5oqU=",
"owner": "edolstra",
"repo": "flake-compat",
"rev": "ff81ac966bb2cae68946d5ed5fc4994f96d0ffec",
"type": "github"
},
"original": {
"owner": "edolstra",
"repo": "flake-compat",
"type": "github"
}
},
"flake-parts": {
"inputs": {
"nixpkgs-lib": [
"devenv",
"nix",
"nixpkgs"
]
},
"locked": {
"lastModified": 1712014858,
"narHash": "sha256-sB4SWl2lX95bExY2gMFG5HIzvva5AVMJd4Igm+GpZNw=",
"owner": "hercules-ci",
"repo": "flake-parts",
"rev": "9126214d0a59633752a136528f5f3b9aa8565b7d",
"type": "github"
},
"original": {
"owner": "hercules-ci",
"repo": "flake-parts",
"type": "github"
}
},
"flake-parts_2": {
"inputs": {
"nixpkgs-lib": "nixpkgs-lib"
},
@ -224,28 +93,7 @@
"type": "github"
}
},
"flake-parts_3": {
"inputs": {
"nixpkgs-lib": [
"lanzaboote",
"nixpkgs"
]
},
"locked": {
"lastModified": 1730504689,
"narHash": "sha256-hgmguH29K2fvs9szpq2r3pz2/8cJd2LPS+b4tfNFCwE=",
"owner": "hercules-ci",
"repo": "flake-parts",
"rev": "506278e768c2a08bec68eb62932193e341f55c90",
"type": "github"
},
"original": {
"owner": "hercules-ci",
"repo": "flake-parts",
"type": "github"
}
},
"flake-parts_4": {
"flake-parts_2": {
"inputs": {
"nixpkgs-lib": "nixpkgs-lib_2"
},
@ -263,98 +111,89 @@
"type": "github"
}
},
"flatpak": {
"flake-parts_3": {
"inputs": {
"nixpkgs-lib": "nixpkgs-lib_3"
},
"locked": {
"lastModified": 1739444422,
"narHash": "sha256-iAVVHi7X3kWORftY+LVbRiStRnQEob2TULWyjMS6dWg=",
"owner": "gmodena",
"repo": "nix-flatpak",
"rev": "5e54c3ca05a7c7d968ae1ddeabe01d2a9bc1e177",
"lastModified": 1743550720,
"narHash": "sha256-hIshGgKZCgWh6AYJpJmRgFdR3WUbkY04o82X05xqQiY=",
"owner": "hercules-ci",
"repo": "flake-parts",
"rev": "c621e8422220273271f52058f618c94e405bb0f5",
"type": "github"
},
"original": {
"owner": "gmodena",
"ref": "latest",
"repo": "nix-flatpak",
"owner": "hercules-ci",
"repo": "flake-parts",
"type": "github"
}
},
"git-hooks": {
"flake-parts_4": {
"inputs": {
"flake-compat": [
"devenv"
],
"gitignore": "gitignore",
"nixpkgs": [
"devenv",
"nixpkgs"
]
"nixpkgs-lib": "nixpkgs-lib_4"
},
"locked": {
"lastModified": 1742649964,
"narHash": "sha256-DwOTp7nvfi8mRfuL1escHDXabVXFGT1VlPD1JHrtrco=",
"owner": "cachix",
"repo": "git-hooks.nix",
"rev": "dcf5072734cb576d2b0c59b2ac44f5050b5eac82",
"lastModified": 1743550720,
"narHash": "sha256-hIshGgKZCgWh6AYJpJmRgFdR3WUbkY04o82X05xqQiY=",
"owner": "hercules-ci",
"repo": "flake-parts",
"rev": "c621e8422220273271f52058f618c94e405bb0f5",
"type": "github"
},
"original": {
"owner": "cachix",
"repo": "git-hooks.nix",
"owner": "hercules-ci",
"repo": "flake-parts",
"type": "github"
}
},
"gitignore": {
"flake-parts_5": {
"inputs": {
"nixpkgs": [
"devenv",
"git-hooks",
"nixpkgs"
]
"nixpkgs-lib": "nixpkgs-lib_5"
},
"locked": {
"lastModified": 1709087332,
"narHash": "sha256-HG2cCnktfHsKV0s4XW83gU3F57gaTljL9KNSuG6bnQs=",
"lastModified": 1743550720,
"narHash": "sha256-hIshGgKZCgWh6AYJpJmRgFdR3WUbkY04o82X05xqQiY=",
"owner": "hercules-ci",
"repo": "gitignore.nix",
"rev": "637db329424fd7e46cf4185293b9cc8c88c95394",
"repo": "flake-parts",
"rev": "c621e8422220273271f52058f618c94e405bb0f5",
"type": "github"
},
"original": {
"owner": "hercules-ci",
"repo": "gitignore.nix",
"repo": "flake-parts",
"type": "github"
}
},
"gitignore_2": {
"forgesync": {
"inputs": {
"nixpkgs": [
"lanzaboote",
"pre-commit-hooks-nix",
"nixpkgs"
]
"flake-parts": "flake-parts_2",
"nixpkgs": "nixpkgs_2",
"pyproject-build-systems": "pyproject-build-systems",
"pyproject-nix": "pyproject-nix",
"uv2nix": "uv2nix"
},
"locked": {
"lastModified": 1709087332,
"narHash": "sha256-HG2cCnktfHsKV0s4XW83gU3F57gaTljL9KNSuG6bnQs=",
"owner": "hercules-ci",
"repo": "gitignore.nix",
"rev": "637db329424fd7e46cf4185293b9cc8c88c95394",
"type": "github"
"lastModified": 1746299148,
"narHash": "sha256-OL9j+S8m4zC2dCqjaWLt6Ooc7EzRjJC/olLVj7mqd/M=",
"ref": "refs/heads/main",
"rev": "e2e0f134da1444b298d4a4601390664124d0a5c4",
"revCount": 10,
"type": "git",
"url": "https://codeberg.org/helvetica/forgesync.git"
},
"original": {
"owner": "hercules-ci",
"repo": "gitignore.nix",
"type": "github"
"type": "git",
"url": "https://codeberg.org/helvetica/forgesync.git"
}
},
"hardware": {
"locked": {
"lastModified": 1744366945,
"narHash": "sha256-OuLhysErPHl53BBifhesrRumJNhrlSgQDfYOTXfgIMg=",
"lastModified": 1746341346,
"narHash": "sha256-WjupK5Xpc+viJlJWiyPHp/dF4aJItp1BPuFsEdv2/fI=",
"owner": "NixOS",
"repo": "nixos-hardware",
"rev": "1fe3cc2bc5d2dc9c81cb4e63d2f67c1543340df1",
"rev": "0833dc8bbc4ffa9cf9b0cbfccf1c5ec8632fc66e",
"type": "github"
},
"original": {
@ -371,11 +210,11 @@
]
},
"locked": {
"lastModified": 1703113217,
"narHash": "sha256-7ulcXOk63TIT2lVDSExj7XzFx09LpdSAPtvgtM7yQPE=",
"lastModified": 1745494811,
"narHash": "sha256-YZCh2o9Ua1n9uCvrvi5pRxtuVNml8X2a03qIFfRKpFs=",
"owner": "nix-community",
"repo": "home-manager",
"rev": "3bfaacf46133c037bb356193bd2f1765d9dc82c1",
"rev": "abfad3d2958c9e6300a883bd443512c55dfeb1be",
"type": "github"
},
"original": {
@ -384,96 +223,62 @@
"type": "github"
}
},
"lanzaboote": {
"hxwrap": {
"inputs": {
"crane": "crane",
"flake-compat": "flake-compat_2",
"flake-parts": "flake-parts_3",
"nixpkgs": "nixpkgs_5",
"pre-commit-hooks-nix": "pre-commit-hooks-nix",
"rust-overlay": "rust-overlay"
"nixpkgs": "nixpkgs_3"
},
"locked": {
"lastModified": 1737639419,
"narHash": "sha256-AEEDktApTEZ5PZXNDkry2YV2k6t0dTgLPEmAZbnigXU=",
"owner": "nix-community",
"repo": "lanzaboote",
"rev": "a65905a09e2c43ff63be8c0e86a93712361f871e",
"type": "github"
"lastModified": 1745088587,
"narHash": "sha256-85AYHWayJVq/dxgk/S4RH7u6w59Akyr1fVttR8KBh8g=",
"ref": "refs/heads/main",
"rev": "8fa5d5d550add7bf6cfd0a619dfac0e8a03b2bae",
"revCount": 21,
"type": "git",
"url": "https://codeberg.org/helvetica/hxwrap.git"
},
"original": {
"owner": "nix-community",
"ref": "v0.4.2",
"repo": "lanzaboote",
"type": "github"
}
},
"libgit2": {
"flake": false,
"locked": {
"lastModified": 1697646580,
"narHash": "sha256-oX4Z3S9WtJlwvj0uH9HlYcWv+x1hqp8mhXl7HsLu2f0=",
"owner": "libgit2",
"repo": "libgit2",
"rev": "45fd9ed7ae1a9b74b957ef4f337bc3c8b3df01b5",
"type": "github"
},
"original": {
"owner": "libgit2",
"repo": "libgit2",
"type": "github"
"type": "git",
"url": "https://codeberg.org/helvetica/hxwrap.git"
}
},
"musicomp": {
"inputs": {
"flake-parts": "flake-parts_4",
"nixpkgs": "nixpkgs_6"
"nixpkgs": "nixpkgs_4"
},
"locked": {
"lastModified": 1744068246,
"narHash": "sha256-ZrLuwXT0uRxa4hyMyCe/IG9lKZEqAM+lUgLKcCiZjbA=",
"lastModified": 1744916606,
"narHash": "sha256-6l7xP5DTAc7E+gO2xu9aX5BjyuDNLMdeS6oFFrpsulg=",
"ref": "refs/heads/main",
"rev": "66aa356585132605e8bd9cc630fab7416f3caf3d",
"revCount": 2,
"rev": "0c6b26ce38dbc39d360904ddd98eab1159b922e1",
"revCount": 3,
"type": "git",
"url": "https://codeberg.org/helveticanonstandard/musicomp.git"
"url": "https://codeberg.org/helvetica/musicomp.git"
},
"original": {
"type": "git",
"url": "https://codeberg.org/helveticanonstandard/musicomp.git"
"url": "https://codeberg.org/helvetica/musicomp.git"
}
},
"nix": {
"myphps": {
"inputs": {
"flake-compat": [
"devenv"
],
"flake-parts": "flake-parts",
"libgit2": "libgit2",
"nixpkgs": "nixpkgs_3",
"nixpkgs-23-11": [
"devenv"
],
"nixpkgs-regression": [
"devenv"
],
"pre-commit-hooks": [
"devenv"
]
"flake-parts": "flake-parts_5",
"nixpkgs": "nixpkgs_5",
"phps": "phps"
},
"locked": {
"lastModified": 1741798497,
"narHash": "sha256-E3j+3MoY8Y96mG1dUIiLFm2tZmNbRvSiyN7CrSKuAVg=",
"owner": "domenkozar",
"repo": "nix",
"rev": "f3f44b2baaf6c4c6e179de8cbb1cc6db031083cd",
"type": "github"
"lastModified": 1746369841,
"narHash": "sha256-/k3MQPXdsXJ0FDEsT1YvBG9ugRXk1nuE9MCb1wAMGQc=",
"ref": "refs/heads/main",
"rev": "dbe35541ef6923f411685434cc535d0854b55b6a",
"revCount": 5,
"type": "git",
"url": "https://codeberg.org/helvetica/myphps.git"
},
"original": {
"owner": "domenkozar",
"ref": "devenv-2.24",
"repo": "nix",
"type": "github"
"type": "git",
"url": "https://codeberg.org/helvetica/myphps.git"
}
},
"nix-index-database": {
@ -483,11 +288,11 @@
]
},
"locked": {
"lastModified": 1743911143,
"narHash": "sha256-4j4JPwr0TXHH4ZyorXN5yIcmqIQr0WYacsuPA4ktONo=",
"lastModified": 1746330942,
"narHash": "sha256-ShizFaJCAST23tSrHHtFFGF0fwd72AG+KhPZFFQX/0o=",
"owner": "nix-community",
"repo": "nix-index-database",
"rev": "a36f6a7148aec2c77d78e4466215cceb2f5f4bfb",
"rev": "137fd2bd726fff343874f85601b51769b48685cc",
"type": "github"
},
"original": {
@ -498,17 +303,17 @@
},
"nixos-cosmic": {
"inputs": {
"flake-compat": "flake-compat_3",
"flake-compat": "flake-compat_2",
"nixpkgs": "nixpkgs_7",
"nixpkgs-stable": "nixpkgs-stable_2",
"rust-overlay": "rust-overlay_2"
"nixpkgs-stable": "nixpkgs-stable",
"rust-overlay": "rust-overlay"
},
"locked": {
"lastModified": 1744369853,
"narHash": "sha256-rVW9J8gMUFj8PsFV2TgNiNuJd8+O+FUizEQgl1ooQFY=",
"lastModified": 1746356902,
"narHash": "sha256-aV2pm+XKEoGE/BuqJwI1zDhtHclzC5BsbSO+SAMFEKk=",
"owner": "lilyinstarlight",
"repo": "nixos-cosmic",
"rev": "c2b4dd2f85d558c7147bc06c6417f87aa1775ad5",
"rev": "22325997671e2a6f0a2e784db2746267868a33ed",
"type": "github"
},
"original": {
@ -519,11 +324,11 @@
},
"nixpkgs": {
"locked": {
"lastModified": 1703013332,
"narHash": "sha256-+tFNwMvlXLbJZXiMHqYq77z/RfmpfpiI3yjL6o/Zo9M=",
"lastModified": 1745391562,
"narHash": "sha256-sPwcCYuiEopaafePqlG826tBhctuJsLx/mhKKM5Fmjo=",
"owner": "NixOS",
"repo": "nixpkgs",
"rev": "54aac082a4d9bb5bbc5c4e899603abfb76a3f6d6",
"rev": "8a2f738d9d1f1d986b5a4cd2fd2061a7127237d7",
"type": "github"
},
"original": {
@ -563,29 +368,58 @@
"type": "github"
}
},
"nixpkgs-stable": {
"nixpkgs-lib_3": {
"locked": {
"lastModified": 1730741070,
"narHash": "sha256-edm8WG19kWozJ/GqyYx2VjW99EdhjKwbY3ZwdlPAAlo=",
"owner": "NixOS",
"repo": "nixpkgs",
"rev": "d063c1dd113c91ab27959ba540c0d9753409edf3",
"lastModified": 1743296961,
"narHash": "sha256-b1EdN3cULCqtorQ4QeWgLMrd5ZGOjLSLemfa00heasc=",
"owner": "nix-community",
"repo": "nixpkgs.lib",
"rev": "e4822aea2a6d1cdd36653c134cacfd64c97ff4fa",
"type": "github"
},
"original": {
"owner": "NixOS",
"ref": "nixos-24.05",
"repo": "nixpkgs",
"owner": "nix-community",
"repo": "nixpkgs.lib",
"type": "github"
}
},
"nixpkgs-stable_2": {
"nixpkgs-lib_4": {
"locked": {
"lastModified": 1744168086,
"narHash": "sha256-S9M4HddBCxbbX1CKSyDYgZ8NCVyHcbKnBfoUXeRu2jQ=",
"lastModified": 1743296961,
"narHash": "sha256-b1EdN3cULCqtorQ4QeWgLMrd5ZGOjLSLemfa00heasc=",
"owner": "nix-community",
"repo": "nixpkgs.lib",
"rev": "e4822aea2a6d1cdd36653c134cacfd64c97ff4fa",
"type": "github"
},
"original": {
"owner": "nix-community",
"repo": "nixpkgs.lib",
"type": "github"
}
},
"nixpkgs-lib_5": {
"locked": {
"lastModified": 1743296961,
"narHash": "sha256-b1EdN3cULCqtorQ4QeWgLMrd5ZGOjLSLemfa00heasc=",
"owner": "nix-community",
"repo": "nixpkgs.lib",
"rev": "e4822aea2a6d1cdd36653c134cacfd64c97ff4fa",
"type": "github"
},
"original": {
"owner": "nix-community",
"repo": "nixpkgs.lib",
"type": "github"
}
},
"nixpkgs-stable": {
"locked": {
"lastModified": 1746183838,
"narHash": "sha256-kwaaguGkAqTZ1oK0yXeQ3ayYjs8u/W7eEfrFpFfIDFA=",
"owner": "NixOS",
"repo": "nixpkgs",
"rev": "60e405b241edb6f0573f3d9f944617fe33ac4a73",
"rev": "bf3287dac860542719fe7554e21e686108716879",
"type": "github"
},
"original": {
@ -597,11 +431,11 @@
},
"nixpkgs_2": {
"locked": {
"lastModified": 1733212471,
"narHash": "sha256-M1+uCoV5igihRfcUKrr1riygbe73/dzNnzPsmaLCmpo=",
"lastModified": 1745526057,
"narHash": "sha256-ITSpPDwvLBZBnPRS2bUcHY3gZSwis/uTe255QgMtTLA=",
"owner": "NixOS",
"repo": "nixpkgs",
"rev": "55d15ad12a74eb7d4646254e13638ad0c4128776",
"rev": "f771eb401a46846c1aebd20552521b233dd7e18b",
"type": "github"
},
"original": {
@ -613,53 +447,21 @@
},
"nixpkgs_3": {
"locked": {
"lastModified": 1717432640,
"narHash": "sha256-+f9c4/ZX5MWDOuB1rKoWj+lBNm0z0rs4CK47HBLxy1o=",
"lastModified": 1744932701,
"narHash": "sha256-fusHbZCyv126cyArUwwKrLdCkgVAIaa/fQJYFlCEqiU=",
"owner": "NixOS",
"repo": "nixpkgs",
"rev": "88269ab3044128b7c2f4c7d68448b2fb50456870",
"rev": "b024ced1aac25639f8ca8fdfc2f8c4fbd66c48ef",
"type": "github"
},
"original": {
"owner": "NixOS",
"ref": "release-24.05",
"ref": "nixos-unstable",
"repo": "nixpkgs",
"type": "github"
}
},
"nixpkgs_4": {
"locked": {
"lastModified": 1733477122,
"narHash": "sha256-qamMCz5mNpQmgBwc8SB5tVMlD5sbwVIToVZtSxMph9s=",
"owner": "cachix",
"repo": "devenv-nixpkgs",
"rev": "7bd9e84d0452f6d2e63b6e6da29fe73fac951857",
"type": "github"
},
"original": {
"owner": "cachix",
"ref": "rolling",
"repo": "devenv-nixpkgs",
"type": "github"
}
},
"nixpkgs_5": {
"locked": {
"lastModified": 1731919951,
"narHash": "sha256-vOM6ETpl1yu9KLi/icTmLJIPbbdJCdAVYUXZceO/Ce4=",
"owner": "NixOS",
"repo": "nixpkgs",
"rev": "04386ac325a813047fc314d4b4d838a5b1e3c7fe",
"type": "github"
},
"original": {
"owner": "NixOS",
"ref": "nixos-unstable-small",
"repo": "nixpkgs",
"type": "github"
}
},
"nixpkgs_6": {
"locked": {
"lastModified": 1743964447,
"narHash": "sha256-nEo1t3Q0F+0jQ36HJfbJtiRU4OI+/0jX/iITURKe3EE=",
@ -675,13 +477,13 @@
"type": "github"
}
},
"nixpkgs_7": {
"nixpkgs_5": {
"locked": {
"lastModified": 1744098102,
"narHash": "sha256-tzCdyIJj9AjysC3OuKA+tMD/kDEDAF9mICPDU7ix0JA=",
"lastModified": 1744463964,
"narHash": "sha256-LWqduOgLHCFxiTNYi3Uj5Lgz0SR+Xhw3kr/3Xd0GPTM=",
"owner": "NixOS",
"repo": "nixpkgs",
"rev": "c8cd81426f45942bb2906d5ed2fe21d2f19d95b7",
"rev": "2631b0b7abcea6e640ce31cd78ea58910d31e650",
"type": "github"
},
"original": {
@ -691,13 +493,13 @@
"type": "github"
}
},
"nixpkgs_8": {
"nixpkgs_6": {
"locked": {
"lastModified": 1743689281,
"narHash": "sha256-y7Hg5lwWhEOgflEHRfzSH96BOt26LaYfrYWzZ+VoVdg=",
"lastModified": 1744502386,
"narHash": "sha256-QAd1L37eU7ktL2WeLLLTmI6P9moz9+a/ONO8qNBYJgM=",
"owner": "NixOS",
"repo": "nixpkgs",
"rev": "2bfc080955153be0be56724be6fa5477b4eefabb",
"rev": "f6db44a8daa59c40ae41ba6e5823ec77fe0d2124",
"type": "github"
},
"original": {
@ -707,18 +509,34 @@
"type": "github"
}
},
"nixpkgs_7": {
"locked": {
"lastModified": 1746232882,
"narHash": "sha256-MHmBH2rS8KkRRdoU/feC/dKbdlMkcNkB5mwkuipVHeQ=",
"owner": "NixOS",
"repo": "nixpkgs",
"rev": "7a2622e2c0dbad5c4493cb268aba12896e28b008",
"type": "github"
},
"original": {
"owner": "NixOS",
"ref": "nixos-unstable",
"repo": "nixpkgs",
"type": "github"
}
},
"phps": {
"inputs": {
"flake-compat": "flake-compat_4",
"nixpkgs": "nixpkgs_8",
"flake-compat": "flake-compat",
"nixpkgs": "nixpkgs_6",
"utils": "utils"
},
"locked": {
"lastModified": 1744001863,
"narHash": "sha256-0pYw0Idtion++srUKsmGX7mq1weozdVE8gR+inoedUo=",
"lastModified": 1744527323,
"narHash": "sha256-2EyP6SxJsmBFMHArrTGw1J+Ned3aRMUZzbzmJZHDbNo=",
"owner": "fossar",
"repo": "nix-phps",
"rev": "220ed74315dc7cd64a6181efd3d583a3607ef01f",
"rev": "f6b53caf2b1c2d592cbac5156f729ef79495992a",
"type": "github"
},
"original": {
@ -727,74 +545,74 @@
"type": "github"
}
},
"pre-commit-hooks-nix": {
"pyproject-build-systems": {
"inputs": {
"flake-compat": [
"lanzaboote",
"flake-compat"
],
"gitignore": "gitignore_2",
"nixpkgs": [
"lanzaboote",
"forgesync",
"nixpkgs"
],
"nixpkgs-stable": "nixpkgs-stable"
"pyproject-nix": [
"forgesync",
"pyproject-nix"
],
"uv2nix": [
"forgesync",
"uv2nix"
]
},
"locked": {
"lastModified": 1731363552,
"narHash": "sha256-vFta1uHnD29VUY4HJOO/D6p6rxyObnf+InnSMT4jlMU=",
"owner": "cachix",
"repo": "pre-commit-hooks.nix",
"rev": "cd1af27aa85026ac759d5d3fccf650abe7e1bbf0",
"lastModified": 1744599653,
"narHash": "sha256-nysSwVVjG4hKoOjhjvE6U5lIKA8sEr1d1QzEfZsannU=",
"owner": "pyproject-nix",
"repo": "build-system-pkgs",
"rev": "7dba6dbc73120e15b558754c26024f6c93015dd7",
"type": "github"
},
"original": {
"owner": "cachix",
"repo": "pre-commit-hooks.nix",
"owner": "pyproject-nix",
"repo": "build-system-pkgs",
"type": "github"
}
},
"pyproject-nix": {
"inputs": {
"nixpkgs": [
"forgesync",
"nixpkgs"
]
},
"locked": {
"lastModified": 1743438845,
"narHash": "sha256-1GSaoubGtvsLRwoYwHjeKYq40tLwvuFFVhGrG8J9Oek=",
"owner": "pyproject-nix",
"repo": "pyproject.nix",
"rev": "8063ec98edc459571d042a640b1c5e334ecfca1e",
"type": "github"
},
"original": {
"owner": "pyproject-nix",
"repo": "pyproject.nix",
"type": "github"
}
},
"root": {
"inputs": {
"agenix": "agenix",
"devenv": "devenv",
"devenv-root": "devenv-root",
"flake-parts": "flake-parts_2",
"flatpak": "flatpak",
"flake-parts": "flake-parts",
"forgesync": "forgesync",
"hardware": "hardware",
"lanzaboote": "lanzaboote",
"hxwrap": "hxwrap",
"musicomp": "musicomp",
"myphps": "myphps",
"nix-index-database": "nix-index-database",
"nixos-cosmic": "nixos-cosmic",
"nixpkgs": [
"nixos-cosmic",
"nixpkgs"
],
"phps": "phps"
]
}
},
"rust-overlay": {
"inputs": {
"nixpkgs": [
"lanzaboote",
"nixpkgs"
]
},
"locked": {
"lastModified": 1731897198,
"narHash": "sha256-Ou7vLETSKwmE/HRQz4cImXXJBr/k9gp4J4z/PF8LzTE=",
"owner": "oxalica",
"repo": "rust-overlay",
"rev": "0be641045af6d8666c11c2c40e45ffc9667839b5",
"type": "github"
},
"original": {
"owner": "oxalica",
"repo": "rust-overlay",
"type": "github"
}
},
"rust-overlay_2": {
"inputs": {
"nixpkgs": [
"nixos-cosmic",
@ -802,11 +620,11 @@
]
},
"locked": {
"lastModified": 1744338850,
"narHash": "sha256-pwMIVmsb8fjjT92n5XFDqCsplcX70qVMMT7NulumPXs=",
"lastModified": 1746326315,
"narHash": "sha256-IDqSls/r6yBfdOBRSMQ/noTUoigmsKnTQ7TqpsBtN4Y=",
"owner": "oxalica",
"repo": "rust-overlay",
"rev": "5e64aecc018e6f775572609e7d7485fdba6985a7",
"rev": "dd280c436961ec5adccf0135efe5b66a23d84497",
"type": "github"
},
"original": {
@ -862,6 +680,31 @@
"repo": "flake-utils",
"type": "github"
}
},
"uv2nix": {
"inputs": {
"nixpkgs": [
"forgesync",
"nixpkgs"
],
"pyproject-nix": [
"forgesync",
"pyproject-nix"
]
},
"locked": {
"lastModified": 1745697651,
"narHash": "sha256-r4A/fkiCenEapHkjJWPiNUZEfviuXMCr6mRozJ5dC4o=",
"owner": "pyproject-nix",
"repo": "uv2nix",
"rev": "cb6508484d534dafd097713b575f2aebc3417de0",
"type": "github"
},
"original": {
"owner": "pyproject-nix",
"repo": "uv2nix",
"type": "github"
}
}
},
"root": "root",

View file

@ -4,23 +4,18 @@
inputs = {
nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
flake-parts.url = "github:hercules-ci/flake-parts";
devenv-root = {
url = "file+file:///dev/null";
flake = false;
};
devenv.url = "github:cachix/devenv";
hardware.url = "github:NixOS/nixos-hardware";
agenix.url = "github:ryantm/agenix";
phps.url = "github:fossar/nix-phps";
lanzaboote.url = "github:nix-community/lanzaboote/v0.4.2";
flatpak.url = "github:gmodena/nix-flatpak?ref=latest";
nixpkgs.follows = "nixos-cosmic/nixpkgs";
nixos-cosmic.url = "github:lilyinstarlight/nixos-cosmic";
nix-index-database = {
url = "github:nix-community/nix-index-database";
inputs.nixpkgs.follows = "nixpkgs";
};
musicomp.url = "git+https://codeberg.org/helveticanonstandard/musicomp.git";
musicomp.url = "git+https://codeberg.org/helvetica/musicomp.git";
hxwrap.url = "git+https://codeberg.org/helvetica/hxwrap.git";
myphps.url = "git+https://codeberg.org/helvetica/myphps.git";
forgesync.url = "git+https://codeberg.org/helvetica/forgesync.git";
};
nixConfig = {
@ -28,58 +23,43 @@
extra-trusted-public-keys = "cosmic.cachix.org-1:Dya9IyXD4xdBehWjrkPv6rtxpmMdRel02smYzA85dPE=";
};
outputs = {
self,
nixpkgs,
flake-parts,
...
} @ inputs:
flake-parts.lib.mkFlake {inherit inputs;} {
imports = [
inputs.devenv.flakeModule
outputs =
{
self,
nixpkgs,
flake-parts,
...
}@inputs:
flake-parts.lib.mkFlake { inherit inputs; } {
systems = [
"x86_64-linux"
"aarch64-linux"
];
systems = ["x86_64-linux" "aarch64-linux"];
flake = {
lib = nixpkgs.lib.extend (import ./lib.nix);
nixosConfigurations = self.lib.genNixosConfigurations {inherit inputs;};
nixosConfigurations = self.lib.genNixosConfigurations inputs;
};
perSystem = {
pkgs,
inputs',
lib,
...
}: {
devenv.shells.default = {
devenv.root = let
devenvRootFileContent = builtins.readFile inputs.devenv-root.outPath;
in
lib.mkIf (devenvRootFileContent != "") devenvRootFileContent;
name = "puter";
imports = [
./devenv.nix
];
packages = [
inputs'.agenix.packages.agenix
];
};
packages =
lib.packagesFromDirectoryRecursive {
inherit (pkgs) callPackage;
directory = ./packages;
}
// {
symfony-cli = pkgs.callPackage ./symfony-cli/package.nix {
fossarPhps = inputs'.phps.packages;
};
perSystem =
{
pkgs,
inputs',
lib,
...
}:
{
devShells.default = pkgs.mkShellNoCC {
packages = [
inputs'.agenix.packages.default
];
};
};
packages = lib.packagesFromDirectoryRecursive {
inherit (pkgs) callPackage newScope;
directory = ./packages;
};
};
};
}

View file

@ -1,4 +1,5 @@
{config, ...}: {
{ config, ... }:
{
users.users.root.openssh.authorizedKeys.keys = [
config.pubkeys.hosts.vessel
];

View file

@ -1,14 +1,15 @@
{config, ...}: {
{ config, ... }:
{
fileSystems = {
"/" = {
fsType = "ext4";
label = "main";
options = ["noatime"];
options = [ "noatime" ];
};
${config.services.navidrome.settings.MusicFolder} = {
label = "music";
fsType = "ext4";
options = ["noatime"];
options = [ "noatime" ];
};
};
}

View file

@ -3,9 +3,11 @@
lib,
pkgs,
...
}: let
}:
let
virtualHostName = "forgejo.helveticanonstandard.net";
in {
in
{
age.secrets = lib.mkSecrets {
forgejo-mailer = {
mode = "400";
@ -19,6 +21,7 @@ in {
services.forgejo = {
enable = true;
package = pkgs.forgejo;
database.type = "postgres";
lfs.enable = true;
settings = {
@ -51,25 +54,28 @@ in {
secrets.mailer.PASSWD = config.age.secrets.forgejo-mailer.path;
};
# TODO what
systemd.services.forgejo.preStart = lib.getExe pkgs.writeShellApplication {
name = "forgejo-init-admin";
runtimeInputs = [
config.services.forgejo.package
];
text = let
passwordFile = config.age.secrets.forgejo-admin.path;
in ''
admins=$(admin user list --admin)
admins=$((admins - 1))
text =
let
passwordFile = config.age.secrets.forgejo-admin.path;
in
''
admins=$(admin user list --admin)
admins=$((admins - 1))
if ((admins < 1)); then
gitea admin user create \
--admin \
--email helvetica@helveticanonstandard.net \
--username helvetica \
--password "$(cat -- ${passwordFile})"
fi
'';
if ((admins < 1)); then
gitea admin user create \
--admin \
--email helvetica@helveticanonstandard.net \
--username helvetica \
--password "$(cat -- ${passwordFile})"
fi
'';
};
services.nginx.virtualHosts.${virtualHostName} = {
@ -80,9 +86,11 @@ in {
client_max_body_size 512M;
'';
locations."/".proxyPass = let
host = config.services.forgejo.settings.server.HTTP_ADDR;
port = builtins.toString config.services.forgejo.settings.server.HTTP_PORT;
in "http://${host}:${port}";
locations."/".proxyPass =
let
host = config.services.forgejo.settings.server.HTTP_ADDR;
port = builtins.toString config.services.forgejo.settings.server.HTTP_PORT;
in
"http://${host}:${port}";
};
}

View file

@ -1,11 +1,18 @@
{modulesPath, ...}: {
{ modulesPath, ... }:
{
imports = [
"${modulesPath}/profiles/qemu-guest.nix"
];
nixpkgs.hostPlatform = "aarch64-linux";
boot.initrd.availableKernelModules = ["xhci_pci" "virtio_pci" "virtio_scsi" "usbhid" "sr_mod"];
boot.initrd.availableKernelModules = [
"xhci_pci"
"virtio_pci"
"virtio_scsi"
"usbhid"
"sr_mod"
];
powerManagement.cpuFreqGovernor = "performance";
}

View file

@ -1,6 +1,8 @@
{config, ...}: let
{ config, ... }:
let
virtualHostName = "headscale.helveticanonstandard.net";
in {
in
{
services.headscale = {
enable = true;
address = "127.0.0.1";
@ -16,10 +18,12 @@ in {
forceSSL = true;
enableACME = true;
locations."/" = {
proxyPass = let
host = config.services.headscale.address;
port = builtins.toString config.services.headscale.port;
in "http://${host}:${port}";
proxyPass =
let
host = config.services.headscale.address;
port = builtins.toString config.services.headscale.port;
in
"http://${host}:${port}";
proxyWebsockets = true;
};
};

View file

@ -1,6 +1,8 @@
{config, ...}: let
{ config, ... }:
let
virtualHostName = "mealie.helveticanonstandard.net";
in {
in
{
services.mealie = {
enable = true;
settings = {
@ -15,9 +17,11 @@ in {
enableACME = true;
forceSSL = true;
locations."/".proxyPass = let
host = config.services.mealie.listenAddress;
port = builtins.toString config.services.mealie.port;
in "http://${host}:${port}";
locations."/".proxyPass =
let
host = config.services.mealie.listenAddress;
port = builtins.toString config.services.mealie.port;
in
"http://${host}:${port}";
};
}

View file

@ -1,6 +1,8 @@
{config, ...}: let
{ config, ... }:
let
virtualHostName = "navidrome.helveticanonstandard.net";
in {
in
{
services.navidrome = {
enable = true;
settings = {
@ -15,9 +17,11 @@ in {
enableACME = true;
forceSSL = true;
locations."/".proxyPass = let
host = config.services.navidrome.settings.Address;
port = builtins.toString config.services.navidrome.settings.Port;
in "http://${host}:${port}";
locations."/".proxyPass =
let
host = config.services.navidrome.settings.Address;
port = builtins.toString config.services.navidrome.settings.Port;
in
"http://${host}:${port}";
};
}

View file

@ -0,0 +1,23 @@
{
networking =
let
interface = "enp1s0";
in
{
domain = "wrz.one";
interfaces.${interface}.ipv6.addresses = [
{
address = "2a01:4f9:c012:92b5::2";
prefixLength = 64;
}
];
defaultGateway6 = {
address = "fe80::1";
inherit interface;
};
firewall.allowedTCPPorts = [
80
443
];
};
}

32
hosts/abacus/nginx.nix Normal file
View file

@ -0,0 +1,32 @@
{
services.nginx = {
enable = true;
recommendedGzipSettings = true;
recommendedOptimisation = true;
recommendedProxySettings = true;
recommendedTlsSettings = true;
commonHttpConfig = ''
error_log stderr;
access_log /var/log/nginx/access.log;
'';
virtualHosts =
let
matchAll = ''~.*'';
matchWww = ''~^www\.(?<domain>.+)$'';
in
{
# Redirect anything that doesn't match any server name to networking.domain
${matchAll} = {
default = true;
rejectSSL = true;
globalRedirect = "wrz.one";
};
# Redirect www to non-www
${matchWww}.globalRedirect = "$domain";
};
};
}

41
hosts/abacus/restic.nix Normal file
View file

@ -0,0 +1,41 @@
{
attrName,
config,
lib,
...
}:
let
secretName = "restic-${attrName}";
secret = config.age.secrets.${secretName};
in
{
age.secrets = lib.mkSecrets { ${secretName} = { }; };
services.restic.backups.remote = {
repository = "sftp:u459482@u459482.your-storagebox.de:/${attrName}";
initialize = true;
paths = [
config.services.vaultwarden.backupDir
config.services.syncthing.dataDir
config.services.forgejo.stateDir
config.services.postgresqlBackup.location
config.services.postgresqlBackup.location
# TODO: Add stateDir options for these
"/var/lib/headscale"
"/var/lib/navidrome"
];
passwordFile = secret.path;
pruneOpts = [
"--keep-daily 7"
"--keep-weekly 5"
"--keep-monthly 12"
];
timerConfig = {
OnCalendar = "*-*-* 03:00:00";
Persistent = true;
};
extraOptions = [
"sftp.args='-i /etc/ssh/ssh_host_ed25519_key -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null'"
];
};
}

View file

@ -0,0 +1,34 @@
{
config,
lib,
...
}:
let
parent = "/var/www";
sites = [
"wrz.one"
"helveticanonstandard.net"
];
in
lib.mkMerge (
map (
virtualHostName:
let
root = "${parent}/${virtualHostName}";
in
{
services.nginx.virtualHosts.${virtualHostName} = {
enableACME = true;
forceSSL = true;
inherit root;
};
systemd.tmpfiles.settings."10-static-sites".${root}.d = {
user = config.users.mainUser;
group = "users";
mode = "0755";
};
}
) sites
)

View file

@ -2,11 +2,13 @@
config,
lib,
...
}: let
}:
let
virtualHostName = "vault.wrz.one";
backupDir = "/srv/backup/vaultwarden";
in {
age.secrets = lib.mkSecrets {vaultwarden = {};};
in
{
age.secrets = lib.mkSecrets { vaultwarden = { }; };
services.vaultwarden = {
enable = true;
@ -37,10 +39,12 @@ in {
forceSSL = true;
locations."/" = {
proxyPass = let
host = config.services.vaultwarden.config.ROCKET_ADDRESS;
port = builtins.toString config.services.vaultwarden.config.ROCKET_PORT;
in "http://${host}:${port}";
proxyPass =
let
host = config.services.vaultwarden.config.ROCKET_ADDRESS;
port = builtins.toString config.services.vaultwarden.config.ROCKET_PORT;
in
"http://${host}:${port}";
proxyWebsockets = true;
};
};

View file

@ -4,6 +4,6 @@
fileSystems."/" = {
fsType = "ext4";
device = "/dev/mapper/main";
options = ["noatime"];
options = [ "noatime" ];
};
}

View file

@ -2,7 +2,8 @@
inputs,
modulesPath,
...
}: {
}:
{
imports = [
"${modulesPath}/installer/scan/not-detected.nix"
@ -12,8 +13,13 @@
nixpkgs.hostPlatform = "x86_64-linux";
boot = {
initrd.availableKernelModules = ["xhci_pci" "nvme" "usb_storage" "sd_mod"];
kernelModules = ["kvm-intel"];
initrd.availableKernelModules = [
"xhci_pci"
"nvme"
"usb_storage"
"sd_mod"
];
kernelModules = [ "kvm-intel" ];
};
powerManagement.cpuFreqGovernor = "powersave";

View file

@ -4,6 +4,6 @@
fileSystems."/" = {
fsType = "ext4";
device = "/dev/mapper/main";
options = ["noatime"];
options = [ "noatime" ];
};
}

View file

@ -2,7 +2,8 @@
inputs,
modulesPath,
...
}: {
}:
{
imports = [
"${modulesPath}/installer/scan/not-detected.nix"
@ -15,11 +16,18 @@
boot = {
initrd = {
availableKernelModules = ["nvme" "ahci" "xhci_pci" "usbhid" "usb_storage" "sd_mod"];
kernelModules = ["amdgpu"];
availableKernelModules = [
"nvme"
"ahci"
"xhci_pci"
"usbhid"
"usb_storage"
"sd_mod"
];
kernelModules = [ "amdgpu" ];
};
kernelModules = ["kvm-amd"];
binfmt.emulatedSystems = ["aarch64-linux"];
kernelModules = [ "kvm-amd" ];
binfmt.emulatedSystems = [ "aarch64-linux" ];
};
powerManagement.cpuFreqGovernor = "performance";

View file

@ -0,0 +1,9 @@
{
profiles = {
desktop = true;
emulation = true;
gaming = true;
piracy = true;
productivity = true;
};
}

View file

@ -1,5 +0,0 @@
{
services.flatpak.packages = [
"org.libreoffice.LibreOffice"
];
}

View file

@ -1,5 +0,0 @@
{
services.flatpak.packages = [
"io.gitlab.librewolf-community"
];
}

View file

@ -1,5 +0,0 @@
{
services.flatpak.packages = [
"io.mpv.Mpv"
];
}

View file

@ -1,5 +0,0 @@
{
services.flatpak.packages = [
"io.github.dweymouth.supersonic"
];
}

View file

@ -1,5 +0,0 @@
{
services.flatpak.packages = [
"org.gimp.GIMP"
];
}

View file

@ -1,5 +0,0 @@
{
services.flatpak.packages = [
"org.inkscape.Inkscape"
];
}

View file

@ -1,3 +0,0 @@
{
setups.secureBoot.enable = true;
}

View file

@ -1,5 +0,0 @@
{
services.flatpak.packages = [
"org.libreoffice.LibreOffice"
];
}

View file

@ -1,5 +0,0 @@
{
services.flatpak.packages = [
"io.gitlab.librewolf-community"
];
}

View file

@ -1,5 +0,0 @@
{
services.flatpak.packages = [
"io.mpv.Mpv"
];
}

View file

@ -1,6 +0,0 @@
{
services.flatpak.packages = [
"com.valvesoftware.Steam"
"com.github.Matoking.protontricks"
];
}

View file

@ -1,5 +0,0 @@
{
services.flatpak.packages = [
"io.github.dweymouth.supersonic"
];
}

View file

@ -1,17 +0,0 @@
{
config,
lib,
pkgs,
...
}: {
services.greetd.settings.initial_session = {
user = config.users.mainUser;
command = ''
${lib.getExe' pkgs.coreutils "env"} XCURSOR_THEME="''${XCURSOR_THEME:-Pop}" systemd-cat --identifier start-cosmic ${lib.getExe' pkgs.cosmic-session "start-cosmic"}
'';
};
environment.cosmic.excludePackages = [
pkgs.cosmic-store
];
}

View file

@ -1,5 +0,0 @@
{
services.flatpak.packages = [
"org.DolphinEmu.dolphin-emu"
];
}

View file

@ -1,6 +0,0 @@
{
services.flatpak.update.auto = {
enable = true;
onCalendar = "weekly";
};
}

View file

@ -1,5 +0,0 @@
{
services.flatpak.packages = [
"io.freetubeapp.FreeTube"
];
}

View file

@ -1,5 +0,0 @@
{
services.flatpak.packages = [
"com.github.Rosalie241.RMG"
];
}

View file

@ -1,5 +0,0 @@
{
services.flatpak.packages = [
"com.valvesoftware.Steam"
];
}

View file

@ -1,5 +0,0 @@
{
services.flatpak.packages = [
"io.github.dweymouth.supersonic"
];
}

View file

@ -1,6 +0,0 @@
{pkgs, ...}: {
environment.systemPackages = [
pkgs.kubectl
pkgs.awscli
];
}

View file

@ -1,95 +0,0 @@
{
lib,
inputs,
pkgs,
...
}: let
supportedPhps = [
"php72"
"php73"
"php74"
"php80"
"php81"
"php82"
"php83"
"php84"
];
selectedPhp = lib.last supportedPhps;
extraConfig = ''
memory_limit = -1
xdebug.mode = develop,coverage,gcstats,profile,debug,trace
xdebug.discover_client_host = 1
xdebug.client_host = localhost
'';
# Wrap all PHP versions with the extensions I need and bundle composer
phps = lib.genAttrs supportedPhps (
phpName: let
phpBase = inputs.phps.packages.${pkgs.system}.${phpName};
phpWithEnv = phpBase.buildEnv {
extensions = {
enabled,
all,
}:
enabled
++ [all.xdebug]
++ (
if (lib.versionAtLeast phpBase.version "8")
then [all.amqp]
else []
);
inherit extraConfig;
};
phpWithTools = pkgs.symlinkJoin {
inherit (phpWithEnv) name version meta passthru;
paths = [
phpWithEnv
phpWithEnv.packages.composer
];
};
in
phpWithTools
);
prefix = "/var/lib/phps";
# Tell Symfony's CLI where it can access the different PHP versions
symfony-cli = let
package = pkgs.symfony-cli;
in
pkgs.symlinkJoin {
inherit (package) pname version meta;
paths = [package];
buildInputs = [pkgs.makeWrapper];
postBuild = ''
wrapProgram $out/bin/${package.meta.mainProgram} \
--suffix PATH : ${pkgs.lib.makeBinPath (
builtins.attrValues phps
)}
'';
};
in {
nix.settings = {
substituters = ["https://fossar.cachix.org/"];
trusted-public-keys = ["fossar.cachix.org-1:Zv6FuqIboeHPWQS7ysLCJ7UT7xExb4OE8c4LyGb5AsE="];
};
# Link PHP installations so that PhpStorm knows about them
systemd.tmpfiles.settings =
builtins.mapAttrs (name: drv: {
"${prefix}/${name}"."L+".argument = drv.outPath;
})
phps;
environment.systemPackages = [
pkgs.jetbrains.phpstorm
phps.${selectedPhp}
symfony-cli
];
}

View file

@ -1,5 +0,0 @@
{
services.flatpak.packages = [
"io.github.dweymouth.supersonic"
];
}

View file

@ -1,3 +0,0 @@
{lib, ...}: {
services.syncthing.enable = lib.mkForce false;
}

View file

@ -1,30 +0,0 @@
{
attrName,
config,
lib,
...
}: {
age.secrets = lib.mkSecrets {"restic-${attrName}" = {};};
services.restic.backups.${attrName} = {
repository = "sftp:u385962@u385962.your-storagebox.de:/restic/${attrName}";
initialize = true;
paths = [
config.services.vaultwarden.backupDir
config.services.syncthing.dataDir
config.services.forgejo.stateDir
config.services.postgresqlBackup.location
config.services.postgresqlBackup.location
# TODO: Add stateDir options for these
"/var/lib/headscale"
"/var/lib/navidrome"
];
passwordFile = config.age.secrets."restic-${attrName}".path;
pruneOpts = ["--keep-daily 7" "--keep-weekly 5" "--keep-monthly 12"];
timerConfig = {
OnCalendar = "*-*-* 03:00:00";
Persistent = true;
};
extraOptions = ["sftp.args='-i /etc/ssh/ssh_host_ed25519_key -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null'"];
};
}

View file

@ -1,18 +0,0 @@
{
networking = let
interface = "enp1s0";
in {
domain = "wrz.one";
interfaces.${interface}.ipv6.addresses = [
{
address = "2a01:4f9:c012:92b5::2";
prefixLength = 64;
}
];
defaultGateway6 = {
address = "fe80::1";
inherit interface;
};
firewall.allowedTCPPorts = [80 443];
};
}

View file

@ -1,30 +0,0 @@
{
services.nginx = {
enable = true;
recommendedGzipSettings = true;
recommendedOptimisation = true;
recommendedProxySettings = true;
recommendedTlsSettings = true;
commonHttpConfig = ''
error_log stderr;
access_log /var/log/nginx/access.log;
'';
virtualHosts = let
matchAll = ''~.*'';
matchWww = ''~^www\.(?<domain>.+)$'';
in {
# Redirect anything that doesn't match any server name to networking.domain
${matchAll} = {
default = true;
rejectSSL = true;
globalRedirect = "wrz.one";
};
# Redirect www to non-www
${matchWww}.globalRedirect = "$domain";
};
};
}

View file

@ -1,32 +0,0 @@
{
config,
lib,
...
}: let
parent = "/var/www";
sites = [
"wrz.one"
"helveticanonstandard.net"
];
in
lib.mkMerge (
map (
virtualHostName: let
root = "${parent}/${virtualHostName}";
in {
services.nginx.virtualHosts.${virtualHostName} = {
enableACME = true;
forceSSL = true;
inherit root;
};
systemd.tmpfiles.settings."10-static-sites".${root}.d = {
user = config.users.mainUser;
group = "users";
mode = "0755";
};
}
)
sites
)

View file

@ -1,61 +0,0 @@
{
attrName,
config,
lib,
pkgs,
...
}: let
backups = {
music = "/srv/music";
safe = "/srv/safe";
storage = "/srv/storage";
sync = config.services.syncthing.dataDir;
};
in {
systemd = lib.mkMerge (map (
backupName: let
systemdName = "${backupName}-backup";
in {
timers.${systemdName} = {
description = "Local rsync Backup ${backupName}";
wantedBy = ["timers.target"];
timerConfig = {
OnCalendar = "*-*-* 03:00:00"; # TODO
Persistent = true;
Unit = "${systemdName}.service"; # TODO
};
};
services.${systemdName} = {
description = "Local rsync Backup ${backupName}";
serviceConfig = {
Type = "oneshot";
User = "root";
Group = "root";
};
# TODO
script = ''
${lib.getExe pkgs.rsync} --verbose --verbose --archive --update --delete --mkpath -- ${backups.${backupName}}/ /srv/backup/${backupName}/
'';
};
}
) (lib.attrNames backups));
age.secrets = lib.mkSecrets {"restic-${attrName}" = {};};
services.restic.backups.${attrName} = {
repository = "sftp:u385962@u385962.your-storagebox.de:/restic/${attrName}";
initialize = true;
paths = [
backups.safe
backups.sync
];
passwordFile = config.age.secrets."restic-${attrName}".path;
pruneOpts = ["--keep-daily 7" "--keep-weekly 5" "--keep-monthly 12"];
timerConfig = {
OnCalendar = "*-*-* 03:00:00"; # TODO
Persistent = true;
};
extraOptions = ["sftp.args='-i /etc/ssh/ssh_host_ed25519_key -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null'"];
};
}

View file

@ -1,27 +0,0 @@
let
upstream = "https://one.one.one.one/dns-query";
in {
services = {
resolved.extraConfig = "DNSStubListener=no";
blocky = {
enable = true;
settings = {
ports.dns = 53;
upstreams.groups.default = [upstream];
bootstrapDns = {
inherit upstream;
ips = ["1.1.1.1" "1.0.0.1"];
};
blocking = {
denylists.ads = ["https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts"];
clientGroupsBlock.default = ["ads"];
};
caching = {
minTime = "5m";
maxTime = "30m";
prefetching = true;
};
};
};
};
}

View file

@ -1,14 +0,0 @@
{
fileSystems = {
"/" = {
fsType = "ext4";
label = "main";
options = ["noatime"];
};
"/srv/backup" = {
label = "backup";
fsType = "ext4";
options = ["noatime"];
};
};
}

View file

@ -1,37 +0,0 @@
{
inputs,
self,
lib,
pkgs,
...
}: {
imports = [
inputs.musicomp.nixosModules.default
];
services.musicomp.jobs.main = {
music = "/srv/music";
comp = "/srv/compmusic";
timerConfig = {
OnCalendar = "daily";
Persistent = true;
};
inhibitsSleep = true;
post = let
remoteDir = self.nixosConfigurations.abacus.config.services.navidrome.settings.MusicFolder;
rsyncExe = lib.getExe pkgs.rsync;
rsh = "${lib.getExe pkgs.openssh} -i /etc/ssh/ssh_host_ed25519_key -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null";
in ''
${rsyncExe} \
--archive \
--recursive \
--delete \
--update \
--mkpath \
--verbose --verbose \
--exclude lost+found \
--rsh ${lib.escapeShellArg rsh} \
/srv/compmusic/ root@wrz.one:${remoteDir}
'';
};
}

View file

@ -1,27 +0,0 @@
{
systemd.tmpfiles.settings = {
"10-safe"."/srv/safe".d = {
user = "helvetica";
group = "users";
mode = "0755";
};
"10-storage"."/srv/storage".d = {
user = "helvetica";
group = "users";
mode = "0755";
};
"10-music"."/srv/music".d = {
user = "helvetica";
group = "users";
mode = "0755";
};
"10-compmusic"."/srv/compmusic".d = {
user = "helvetica";
group = "users";
mode = "0755";
};
};
}

View file

@ -2,6 +2,6 @@
fileSystems."/" = {
fsType = "ext4";
label = "main";
options = ["noatime"];
options = [ "noatime" ];
};
}

View file

@ -0,0 +1,6 @@
{ pkgs, ... }:
{
environment.systemPackages = [
pkgs.freetube
];
}

View file

@ -2,7 +2,8 @@
inputs,
modulesPath,
...
}: {
}:
{
imports = [
"${modulesPath}/installer/scan/not-detected.nix"
@ -15,10 +16,16 @@
boot = {
initrd = {
availableKernelModules = ["nvme" "xhci_pci" "ahci" "usb_storage" "sd_mod"];
kernelModules = ["amdgpu"];
availableKernelModules = [
"nvme"
"xhci_pci"
"ahci"
"usb_storage"
"sd_mod"
];
kernelModules = [ "amdgpu" ];
};
kernelModules = ["kvm-amd"];
kernelModules = [ "kvm-amd" ];
};
powerManagement.cpuFreqGovernor = "performance";

Some files were not shown because too many files have changed in this diff Show more