xin/nixos-config
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

treewide: apply the new rfc nixfmt

Browse source
This commit is contained in:
xinyangli 2024-08-25 17:45:58 +08:00
parent e702d503b9
commit 7a795e5ed9
Signed by: xin
SSH key fingerprint: SHA256:qZ/tzd8lYRtUFSrfBDBMcUqV4GHKxqeqRA3huItgvbk
53 changed files with 1371 additions and 888 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

256
flake.nix
View file

@ -52,28 +52,28 @@
catppuccin.url = "github:catppuccin/nix";
};
outputs =
{ self
, home-manager
, nixpkgs
, nixos-hardware
, flake-utils
, nur
, catppuccin
, my-nixvim
, ...
{
self,
home-manager,
nixpkgs,
nixos-hardware,
flake-utils,
nur,
catppuccin,
my-nixvim,
...
}@inputs:
let
nixvimOverlay = (final: prev: {
nixvim = self.packages.${prev.stdenv.system}.nixvim;
});
overlayModule = { ... }: {
nixpkgs.overlays = [
nixvimOverlay
(import ./overlays/add-pkgs.nix)
];
};
nixvimOverlay = (final: prev: { nixvim = self.packages.${prev.stdenv.system}.nixvim; });
overlayModule =
{ ... }:
{
nixpkgs.overlays = [
nixvimOverlay
(import ./overlays/add-pkgs.nix)
];
};
deploymentModule = {
deployment.targetUser = "xin";
};
@ -87,20 +87,25 @@
catppuccin.homeManagerModules.catppuccin
self.homeManagerModules
];
mkHome = user: host: { ... }: {
imports = [
home-manager.nixosModules.home-manager
{
home-manager = {
sharedModules = sharedHmModules;
useGlobalPkgs = true;
useUserPackages = true;
extraSpecialArgs = { inherit inputs; };
};
home-manager.users.${user} = (import ./home).${user}.${host};
}
];
};
mkHome =
user: host:
{ ... }:
{
imports = [
home-manager.nixosModules.home-manager
{
home-manager = {
sharedModules = sharedHmModules;
useGlobalPkgs = true;
useUserPackages = true;
extraSpecialArgs = {
inherit inputs;
};
};
home-manager.users.${user} = (import ./home).${user}.${host};
}
];
};
mkHomeConfiguration = user: host: {
name = user;
value = home-manager.lib.homeManagerConfiguration {
@ -114,94 +119,109 @@
};
};
};
mkNixos = { system, modules, specialArgs ? { } }: nixpkgs.lib.nixosSystem {
inherit system;
specialArgs = specialArgs // { inherit inputs system; };
modules = [
self.nixosModules.default
nur.nixosModules.nur
] ++ modules;
};
mkNixos =
{
system,
modules,
specialArgs ? { },
}:
nixpkgs.lib.nixosSystem {
inherit system;
specialArgs = specialArgs // {
inherit inputs system;
};
modules = [
self.nixosModules.default
nur.nixosModules.nur
] ++ modules;
};
in
{
nixpkgs = nixpkgs;
nixosModules.default = { imports = [ ./modules/nixos overlayModule ]; };
nixosModules.default = {
imports = [
./modules/nixos
overlayModule
];
};
homeManagerModules = import ./modules/home-manager;
homeConfigurations = builtins.listToAttrs [ (mkHomeConfiguration "xin" "calcite") ];
colmenaHive = inputs.colmena.lib.makeHive {
meta = {
nixpkgs = import nixpkgs {
system = "x86_64-linux";
};
nixpkgs = import nixpkgs { system = "x86_64-linux"; };
specialArgs = {
inherit inputs;
};
};
massicot = { ... }: {
deployment.targetHost = "49.13.13.122";
deployment.buildOnTarget = true;
massicot =
{ ... }:
{
deployment.targetHost = "49.13.13.122";
deployment.buildOnTarget = true;
imports = [
{ nixpkgs.system = "aarch64-linux"; }
machines/massicot
] ++ sharedColmenaModules;
};
tok-00 = { ... }: {
imports = [
machines/dolomite
] ++ sharedColmenaModules;
nixpkgs.system = "x86_64-linux";
networking.hostName = "tok-00";
system.stateVersion = "23.11";
deployment = {
targetHost = "video01.namely.icu";
buildOnTarget = false;
tags = [ "proxy" ];
imports = [
{ nixpkgs.system = "aarch64-linux"; }
machines/massicot
] ++ sharedColmenaModules;
};
};
la-00 = { ... }: {
imports = [
machines/dolomite
] ++ sharedColmenaModules;
nixpkgs.system = "x86_64-linux";
networking.hostName = "la-00";
system.stateVersion = "21.05";
deployment = {
targetHost = "la-00.video.namely.icu";
buildOnTarget = false;
tags = [ "proxy" ];
tok-00 =
{ ... }:
{
imports = [ machines/dolomite ] ++ sharedColmenaModules;
nixpkgs.system = "x86_64-linux";
networking.hostName = "tok-00";
system.stateVersion = "23.11";
deployment = {
targetHost = "video01.namely.icu";
buildOnTarget = false;
tags = [ "proxy" ];
};
};
};
raspite = { ... }: {
deployment = {
targetHost = "raspite.local";
buildOnTarget = false;
la-00 =
{ ... }:
{
imports = [ machines/dolomite ] ++ sharedColmenaModules;
nixpkgs.system = "x86_64-linux";
networking.hostName = "la-00";
system.stateVersion = "21.05";
deployment = {
targetHost = "la-00.video.namely.icu";
buildOnTarget = false;
tags = [ "proxy" ];
};
};
nixpkgs.system = "aarch64-linux";
imports = [
"${nixpkgs}/nixos/modules/installer/sd-card/sd-image-aarch64.nix"
nixos-hardware.nixosModules.raspberry-pi-4
machines/raspite/configuration.nix
] ++ sharedColmenaModules;
};
weilite = { ... }: {
imports = [
machines/weilite
] ++ sharedColmenaModules;
deployment = {
targetHost = "weilite.coho-tet.ts.net";
targetPort = 22;
buildOnTarget = false;
raspite =
{ ... }:
{
deployment = {
targetHost = "raspite.local";
buildOnTarget = false;
};
nixpkgs.system = "aarch64-linux";
imports = [
"${nixpkgs}/nixos/modules/installer/sd-card/sd-image-aarch64.nix"
nixos-hardware.nixosModules.raspberry-pi-4
machines/raspite/configuration.nix
] ++ sharedColmenaModules;
};
weilite =
{ ... }:
{
imports = [ machines/weilite ] ++ sharedColmenaModules;
deployment = {
targetHost = "weilite.coho-tet.ts.net";
targetPort = 22;
buildOnTarget = false;
};
nixpkgs.system = "x86_64-linux";
};
nixpkgs.system = "x86_64-linux";
};
};
nixosConfigurations = {
@ -215,18 +235,30 @@
};
} // self.colmenaHive.nodes;
} // flake-utils.lib.eachDefaultSystem (system:
let pkgs = nixpkgs.legacyPackages.${system}; in
{
devShells = {
default = pkgs.mkShell {
packages = with pkgs; [ nix git colmena sops nix-output-monitor nil nvd ];
};
};
packages = {
nixvim = my-nixvim.packages.${system}.default;
};
}
);
// flake-utils.lib.eachDefaultSystem (
system:
let
pkgs = nixpkgs.legacyPackages.${system};
in
{
devShells = {
default = pkgs.mkShell {
packages = with pkgs; [
nix
git
colmena
sops
nix-output-monitor
nil
nvd
];
};
};
packages = {
nixvim = my-nixvim.packages.${system}.default;
};
}
);
}

2
home/default.nix
View file

@ -2,4 +2,4 @@
xin = {
calcite = import ./xin/calcite.nix;
};
}
}

42
home/xin/calcite.nix
View file

@ -1,8 +1,6 @@
{ config, pkgs, ... }@inputs:
{
imports = [
./common
];
imports = [ ./common ];
programs.nix-index-database.comma.enable = true;
@ -46,12 +44,38 @@
};
custom-hm = {
alacritty = { enable = true; };
cosmic-term = { enable = true; };
direnv = { enable = true; }; fish = { enable = true; }; git = { enable = true; signing.enable = true; };
neovim = { enable = true; };
vscode = { enable = true; languages = { cxx = true; python = true; scala = true; latex = true; }; llm = true; };
zellij = { enable = true; };
alacritty = {
enable = true;
};
cosmic-term = {
enable = true;
};
direnv = {
enable = true;
};
fish = {
enable = true;
};
git = {
enable = true;
signing.enable = true;
};
neovim = {
enable = true;
};
vscode = {
enable = true;
languages = {
cxx = true;
python = true;
scala = true;
latex = true;
};
llm = true;
};
zellij = {
enable = true;
};
};
programs.gnome-shell.enable = true;

8
home/xin/common/default.nix
View file

@ -1,4 +1,10 @@
{ inputs, pkgs, lib, ... }: {
{
inputs,
pkgs,
lib,
...
}:
{
imports = [ ];
home.packages = with pkgs; [

26
home/xin/gold/default.nix
View file

@ -1,15 +1,15 @@
{ pkgs, home-manager, ... }:
home-manager.lib.homeManagerConfiguration {
inherit pkgs;
modules = [
../common
{
home.username = "xin";
home.homeDirectory = "/home/xin";
home.stateVersion = "23.05";
home-manager.lib.homeManagerConfiguration {
inherit pkgs;
modules = [
../common
{
home.username = "xin";
home.homeDirectory = "/home/xin";
home.stateVersion = "23.05";
# Let Home Manager install and manage itself.
programs.home-manager.enable = true;
}
];
}
# Let Home Manager install and manage itself.
programs.home-manager.enable = true;
}
];
}

5
home/xin/raspite/default.nix
View file

@ -1,9 +1,6 @@
{ config, pkgs, ... }:
{
imports = [
../common
];
imports = [ ../common ];
home.username = "xin";
home.homeDirectory = "/home/xin";

78
machines/calcite/configuration.nix
View file

@ -1,13 +1,17 @@
{ config, pkgs, lib, ... }:
{
config,
pkgs,
lib,
...
}:
{
imports =
[
# Include the results of the hardware scan.
./hardware-configuration.nix
./network.nix
../sops.nix
];
imports = [
# Include the results of the hardware scan.
./hardware-configuration.nix
./network.nix
../sops.nix
];
commonSettings = {
auth.enable = true;
@ -22,7 +26,11 @@
boot.loader.efi.canTouchEfiVariables = true;
boot.loader.efi.efiSysMountPoint = "/boot/efi";
# boot.kernelPackages = pkgs.linuxPackages_latest;
boot.kernelModules = [ "nvidia" "nvidia_modeset" "nvidia_uvm" ];
boot.kernelModules = [
"nvidia"
"nvidia_modeset"
"nvidia_uvm"
];
boot.supportedFilesystems = [ "ntfs" ];
boot.binfmt.emulatedSystems = [ "aarch64-linux" ];
@ -45,7 +53,9 @@
programs.steam = {
enable = true;
gamescopeSession = { enable = true; };
gamescopeSession = {
enable = true;
};
};
programs.oidc-agent.enable = true;
@ -93,7 +103,6 @@
services.xserver.displayManager.gdm.enable = true;
services.xserver.desktopManager.gnome.enable = true;
# Configure keymap in X11
services.xserver = {
xkb.layout = "us";
@ -135,7 +144,12 @@
users.users.xin = {
isNormalUser = true;
description = "xin";
extraGroups = [ "networkmanager" "wheel" "wireshark" "tss" ];
extraGroups = [
"networkmanager"
"wheel"
"wireshark"
"tss"
];
};
services.kanidm = {
@ -179,13 +193,14 @@
# reference: https://nixos.wiki/wiki/Python
(
let
my-python-packages = python-packages: with python-packages; [
pandas
requests
numpy
pyyaml
setuptools
];
my-python-packages =
python-packages: with python-packages; [
pandas
requests
numpy
pyyaml
setuptools
];
python-with-my-packages = python3.withPackages my-python-packages;
in
python-with-my-packages
@ -280,14 +295,19 @@
acceleration = "cuda";
};
# MTP support
services.gvfs.enable = true;
# Fonts
fonts = {
packages = with pkgs; [
(nerdfonts.override { fonts = [ "FiraCode" "FiraMono" "JetBrainsMono" ]; })
(nerdfonts.override {
fonts = [
"FiraCode"
"FiraMono"
"JetBrainsMono"
];
})
noto-fonts
noto-fonts-emoji
liberation_ttf
@ -305,9 +325,19 @@
];
fontconfig = {
defaultFonts = {
serif = [ "Noto Serif CJK SC" "Ubuntu" ];
sansSerif = [ "Noto Sans CJK SC" "Ubuntu" ];
monospace = [ "FiraCode NerdFont Mono" "Noto Sans Mono CJK SC" "Ubuntu" ];
serif = [
"Noto Serif CJK SC"
"Ubuntu"
];
sansSerif = [
"Noto Sans CJK SC"
"Ubuntu"
];
monospace = [
"FiraCode NerdFont Mono"
"Noto Sans Mono CJK SC"
"Ubuntu"
];
};
};
enableDefaultPackages = true;

56
machines/calcite/hardware-configuration.nix
View file

@ -1,14 +1,23 @@
# Do not modify this file! It was generated by ‘nixos-generate-config’
# and may be overwritten by future invocations. Please make changes
# to /etc/nixos/configuration.nix instead.
{ config, lib, pkgs, modulesPath, ... }:
{
config,
lib,
pkgs,
modulesPath,
...
}:
{
imports =
[ (modulesPath + "/installer/scan/not-detected.nix")
];
imports = [ (modulesPath + "/installer/scan/not-detected.nix") ];
boot.initrd.availableKernelModules = [ "xhci_pci" "nvme" "ahci" "usbhid" ];
boot.initrd.availableKernelModules = [
"xhci_pci"
"nvme"
"ahci"
"usbhid"
];
boot.initrd.kernelModules = [ ];
boot.initrd.luks.devices.cryptroot = {
device = "/dev/disk/by-uuid/5a51f623-6fbd-4843-9f83-c895067e8e7d";
@ -16,26 +25,29 @@
boot.kernelModules = [ "kvm-amd" ];
boot.extraModulePackages = [ ];
fileSystems."/" =
{ # device = "/dev/disk/by-label/NIXROOT";
device = "/dev/mapper/cryptroot";
fsType = "btrfs";
};
fileSystems."/" = {
# device = "/dev/disk/by-label/NIXROOT";
device = "/dev/mapper/cryptroot";
fsType = "btrfs";
};
fileSystems."/boot/efi" =
{ device = "/dev/disk/by-label/EFIBOOT";
fsType = "vfat";
};
fileSystems."/boot/efi" = {
device = "/dev/disk/by-label/EFIBOOT";
fsType = "vfat";
};
fileSystems."/media/data" =
{ device = "/dev/nvme0n1p7";
fsType = "ntfs-3g";
options = [ "rw" "uid=1000" "nofail" "x-systemd.device-timeout=2" ];
};
swapDevices =
[ { device = "/dev/disk/by-label/NIXSWAP"; }
fileSystems."/media/data" = {
device = "/dev/nvme0n1p7";
fsType = "ntfs-3g";
options = [
"rw"
"uid=1000"
"nofail"
"x-systemd.device-timeout=2"
];
};
swapDevices = [ { device = "/dev/disk/by-label/NIXSWAP"; } ];
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
# (the default) this is the recommended approach. When using systemd-networkd it's

9
machines/calcite/network.nix
View file

@ -1,4 +1,4 @@
{ config, pkgs, ...}:
{ config, pkgs, ... }:
{
imports = [ ];
@ -38,10 +38,11 @@
# Open ports in the firewall.
networking.firewall.enable = true;
networking.firewall.allowedTCPPorts = [ 3389 ];
networking.firewall.allowedUDPPorts = [ 3389 41641 ];
networking.firewall.trustedInterfaces = [
"tailscale0"
networking.firewall.allowedUDPPorts = [
3389
41641
];
networking.firewall.trustedInterfaces = [ "tailscale0" ];
# Use nftables to manager firewall
networking.nftables.enable = true;

34
machines/dolomite/bandwagon.nix
View file

@ -1,30 +1,42 @@
{ config, lib, pkgs, modulesPath, ... }:
{
config,
lib,
pkgs,
modulesPath,
...
}:
let
cfg = config.isBandwagon;
in
{
imports = [ (modulesPath + "/profiles/qemu-guest.nix") ];
options = {
isBandwagon = lib.mkEnableOption "Bandwagon instance";
};
config = lib.mkIf cfg {
boot.initrd.availableKernelModules = [ "ata_piix" "xhci_pci" "virtio_pci" "virtio_scsi" "sd_mod" "sr_mod" ];
boot.initrd.availableKernelModules = [
"ata_piix"
"xhci_pci"
"virtio_pci"
"virtio_scsi"
"sd_mod"
"sr_mod"
];
boot.initrd.kernelModules = [ ];
boot.kernelModules = [ ];
boot.extraModulePackages = [ ];
fileSystems."/" =
{ device = "/dev/disk/by-label/NIXROOT";
fsType = "xfs";
};
fileSystems."/" = {
device = "/dev/disk/by-label/NIXROOT";
fsType = "xfs";
};
fileSystems."/boot" =
{ device = "/dev/disk/by-label/NIXBOOT";
fsType = "vfat";
};
fileSystems."/boot" = {
device = "/dev/disk/by-label/NIXBOOT";
fsType = "vfat";
};
swapDevices = [ ];

214
machines/dolomite/default.nix
View file

@ -1,6 +1,6 @@
{ config, lib, ... }:
let
awsHosts = [ "tok-00"];
awsHosts = [ "tok-00" ];
bwgHosts = [ "la-00" ];
in
{
@ -10,7 +10,6 @@ in
./lightsail.nix
];
config = {
isBandwagon = builtins.elem config.networking.hostName bwgHosts;
isLightsail = builtins.elem config.networking.hostName awsHosts;
@ -45,7 +44,10 @@ in
reverse_proxy 127.0.0.1:30310
'';
networking.firewall.allowedTCPPorts = [ 80 8080 ];
networking.firewall.allowedTCPPorts = [
80
8080
];
networking.firewall.allowedUDPPorts = [ ] ++ (lib.range 6311 6314);
custom.prometheus = {
@ -80,119 +82,129 @@ in
wheelNeedsPassword = false;
};
services.sing-box = let
singTls = {
enabled = true;
server_name = config.deployment.targetHost;
key_path = config.security.acme.certs.${config.deployment.targetHost}.directory + "/key.pem";
certificate_path = config.security.acme.certs.${config.deployment.targetHost}.directory + "/cert.pem";
};
password = {
_secret = config.sops.secrets.singbox_password.path;
};
uuid = {
_secret = config.sops.secrets.singbox_uuid.path;
};
in
{
enable = true;
settings = {
dns = {
servers = [
{
tag = "warp";
address = "1.1.1.1";
detour = "wg-out";
}
{
tag = "directdns";
address = "h3://8.8.8.8/dns-query";
}
];
rules = [
{
outbound = "wg-out";
server = "warp";
}
{
outbound = "direct";
server = "directdns";
}
];
services.sing-box =
let
singTls = {
enabled = true;
server_name = config.deployment.targetHost;
key_path = config.security.acme.certs.${config.deployment.targetHost}.directory + "/key.pem";
certificate_path =
config.security.acme.certs.${config.deployment.targetHost}.directory + "/cert.pem";
};
inbounds = [
{
tag = "sg0";
type = "trojan";
listen = "::";
listen_port = 8080;
users = [
{ name = "proxy";
password = password;
password = {
_secret = config.sops.secrets.singbox_password.path;
};
uuid = {
_secret = config.sops.secrets.singbox_uuid.path;
};
in
{
enable = true;
settings = {
dns = {
servers = [
{
tag = "warp";
address = "1.1.1.1";
detour = "wg-out";
}
{
tag = "directdns";
address = "h3://8.8.8.8/dns-query";
}
];
tls = singTls;
}
] ++ lib.forEach (lib.range 6311 6314) (port: {
tag = "sg" + toString (port - 6310);
type = "tuic";
listen = "::";
listen_port = port;
congestion_control = "bbr";
users = [
{ name = "proxy";
uuid = uuid;
password = password;
rules = [
{
outbound = "wg-out";
server = "warp";
}
{
outbound = "direct";
server = "directdns";
}
];
tls = singTls;
});
outbounds = [
{
type = "wireguard";
tag = "wg-out";
private_key = {
_secret = config.sops.secrets.wg_private_key.path;
};
local_address = [
"172.16.0.2/32"
{ _secret = config.sops.secrets.wg_ipv6_local_addr.path; }
];
peers = [
{ public_key= "bmXOC+F1FxEMF9dyiK2H5/1SUtzH0JuVo51h2wPfgyo=";
allowed_ips = [ "0.0.0.0/0" "::/0" ];
server = "162.159.192.1";
server_port = 500;
};
inbounds =
[
{
tag = "sg0";
type = "trojan";
listen = "::";
listen_port = 8080;
users = [
{
name = "proxy";
password = password;
}
];
tls = singTls;
}
];
}
{
type = "direct";
tag = "direct";
}
{
type = "dns";
tag = "dns-out";
}
];
route = {
rules = [
]
++ lib.forEach (lib.range 6311 6314) (port: {
tag = "sg" + toString (port - 6310);
type = "tuic";
listen = "::";
listen_port = port;
congestion_control = "bbr";
users = [
{
name = "proxy";
uuid = uuid;
password = password;
}
];
tls = singTls;
});
outbounds = [
{
outbound = "dns-out";
protocol = "dns";
type = "wireguard";
tag = "wg-out";
private_key = {
_secret = config.sops.secrets.wg_private_key.path;
};
local_address = [
"172.16.0.2/32"
{ _secret = config.sops.secrets.wg_ipv6_local_addr.path; }
];
peers = [
{
public_key = "bmXOC+F1FxEMF9dyiK2H5/1SUtzH0JuVo51h2wPfgyo=";
allowed_ips = [
"0.0.0.0/0"
"::/0"
];
server = "162.159.192.1";
server_port = 500;
}
];
}
{
inbound = "sg0";
outbound = "direct";
type = "direct";
tag = "direct";
}
{
inbound = "sg4";
outbound = "direct";
type = "dns";
tag = "dns-out";
}
];
route = {
rules = [
{
outbound = "dns-out";
protocol = "dns";
}
{
inbound = "sg0";
outbound = "direct";
}
{
inbound = "sg4";
outbound = "direct";
}
];
};
};
};
};
};
}

26
machines/dolomite/lightsail.nix
View file

@ -1,10 +1,16 @@
{ config, lib, pkgs, modulesPath, ... }:
{
config,
lib,
pkgs,
modulesPath,
...
}:
with lib;
let
cfg = config.ec2;
in
{
imports = [
imports = [
"${modulesPath}/profiles/headless.nix"
# Note: While we do use the headless profile, we also explicitly
# turn on the serial console on ttyS0 below. This is because
@ -39,18 +45,22 @@ in
fsType = "vfat";
};
boot.extraModulePackages = [
config.boot.kernelPackages.ena
];
boot.extraModulePackages = [ config.boot.kernelPackages.ena ];
boot.initrd.kernelModules = [ "xen-blkfront" ];
boot.initrd.availableKernelModules = [ "nvme" ];
boot.kernelParams = [ "console=ttyS0,115200n8" "random.trust_cpu=on" ];
boot.kernelParams = [
"console=ttyS0,115200n8"
"random.trust_cpu=on"
];
# Prevent the nouveau kernel module from being loaded, as it
# interferes with the nvidia/nvidia-uvm modules needed for CUDA.
# Also blacklist xen_fbfront to prevent a 30 second delay during
# boot.
boot.blacklistedKernelModules = [ "nouveau" "xen_fbfront" ];
boot.blacklistedKernelModules = [
"nouveau"
"xen_fbfront"
];
boot.loader.grub.efiSupport = cfg.efi;
boot.loader.grub.efiInstallAsRemovable = cfg.efi;
@ -64,7 +74,7 @@ in
systemd.services.fetch-ec2-metadata = {
wantedBy = [ "multi-user.target" ];
wants = [ "network-online.target" ];
after = ["network-online.target"];
after = [ "network-online.target" ];
path = [ pkgs.curl ];
script = builtins.readFile ./ec2-metadata-fetcher.sh;
serviceConfig.Type = "oneshot";

8
machines/massicot/default.nix
View file

@ -1,4 +1,10 @@
{ inputs, config, libs, pkgs, ... }:
{
inputs,
config,
libs,
pkgs,
...
}:
{
imports = [

18
machines/massicot/hardware-configuration.nix
View file

@ -5,9 +5,19 @@
efiSupport = true;
device = "nodev";
};
fileSystems."/boot" = { device = "/dev/disk/by-uuid/AC27-D9D6"; fsType = "vfat"; };
boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "xen_blkfront" ];
fileSystems."/boot" = {
device = "/dev/disk/by-uuid/AC27-D9D6";
fsType = "vfat";
};
boot.initrd.availableKernelModules = [
"ata_piix"
"uhci_hcd"
"xen_blkfront"
];
boot.initrd.kernelModules = [ "nvme" ];
fileSystems."/" = { device = "/dev/sda1"; fsType = "ext4"; };
fileSystems."/" = {
device = "/dev/sda1";
fsType = "ext4";
};
}

51
machines/massicot/kanidm-provision.nix
View file

@ -21,7 +21,11 @@
members = [ "xin" ];
};
immich-users = {
members = [ "xin" "zhuo" "ycm" ];
members = [
"xin"
"zhuo"
"ycm"
];
};
grafana-superadmins = {
members = [ "xin" ];
@ -65,7 +69,12 @@
originLanding = "https://git.xinyang.life/user/oauth2/kandim";
allowInsecureClientDisablePkce = true;
scopeMaps = {
forgejo-access = [ "openid" "email" "profile" "groups" ];
forgejo-access = [
"openid"
"email"
"profile"
"groups"
];
};
claimMaps = {
forgejo_role = {
@ -83,7 +92,12 @@
originLanding = "https://xinyang.life/";
allowInsecureClientDisablePkce = true;
scopeMaps = {
gts-users = [ "openid" "email" "profile" "groups" ];
gts-users = [
"openid"
"email"
"profile"
"groups"
];
};
};
owncloud = {
@ -92,7 +106,11 @@
originLanding = "https://home.xinyang.life:9201/";
public = true;
scopeMaps = {
ocis-users = [ "openid" "email" "profile" ];
ocis-users = [
"openid"
"email"
"profile"
];
};
};
hedgedoc = {
@ -101,7 +119,11 @@
originLanding = "https://docs.xinyang.life/auth/oauth2";
allowInsecureClientDisablePkce = true;
scopeMaps = {
hedgedoc-users = [ "openid" "email" "profile" ];
hedgedoc-users = [
"openid"
"email"
"profile"
];
};
};
immich-mobile = {
@ -110,7 +132,11 @@
originLanding = "https://immich.xinyang.life:8000/api/oauth/mobile-redirect/";
allowInsecureClientDisablePkce = true;
scopeMaps = {
immich-users = [ "openid" "email" "profile" ];
immich-users = [
"openid"
"email"
"profile"
];
};
};
miniflux = {
@ -118,7 +144,11 @@
originUrl = "https://rss.xinyang.life/";
originLanding = "https://rss.xinyang.life/";
scopeMaps = {
miniflux-users = [ "openid" "email" "profile" ];
miniflux-users = [
"openid"
"email"
"profile"
];
};
};
grafana = {
@ -126,7 +156,12 @@
originUrl = "https://grafana.xinyang.life/";
originLanding = "https://grafana.xinyang.life/";
scopeMaps = {
grafana-users = [ "openid" "email" "profile" "groups" ];
grafana-users = [
"openid"
"email"
"profile"
"groups"
];
};
claimMaps = {
grafana_role = {

13
machines/massicot/networking.nix
View file

@ -1,11 +1,14 @@
{ pkgs, ... }: {
{ pkgs, ... }:
{
networking = {
interfaces = {
eth0.useDHCP = true;
eth0.ipv6.addresses = [{
address = "2a01:4f8:c17:345f::1";
prefixLength = 64;
}];
eth0.ipv6.addresses = [
{
address = "2a01:4f8:c17:345f::1";
prefixLength = 64;
}
];
};
defaultGateway6 = {
address = "fe80::1";

58
machines/massicot/services.nix
View file

@ -1,10 +1,24 @@
{ config, pkgs, lib, ... }:
{
config,
pkgs,
lib,
...
}:
let
kanidm_listen_port = 5324;
in
{
networking.firewall.allowedTCPPorts = [ 80 443 2222 8448 ];
networking.firewall.allowedUDPPorts = [ 80 443 8448 ];
networking.firewall.allowedTCPPorts = [
80
443
2222
8448
];
networking.firewall.allowedUDPPorts = [
80
443
8448
];
custom.vaultwarden = {
enable = true;
@ -32,16 +46,23 @@ in
exporters.miniflux.enable = true;
};
systemd.mounts = map
(share: {
what = "//u380335-sub1.your-storagebox.de/u380335-sub1/${share}";
where = "/mnt/storage/${share}";
type = "cifs";
options = "rw,uid=${share},gid=${share},credentials=${config.sops.secrets.storage_box_mount.path},_netdev,fsc";
before = [ "${share}.service" ];
after = [ "cachefilesd.service" ];
wantedBy = [ "${share}.service" ];
}) [ "forgejo" "gotosocial" "conduit" "hedgedoc" ];
systemd.mounts =
map
(share: {
what = "//u380335-sub1.your-storagebox.de/u380335-sub1/${share}";
where = "/mnt/storage/${share}";
type = "cifs";
options = "rw,uid=${share},gid=${share},credentials=${config.sops.secrets.storage_box_mount.path},_netdev,fsc";
before = [ "${share}.service" ];
after = [ "cachefilesd.service" ];
wantedBy = [ "${share}.service" ];
})
[
"forgejo"
"gotosocial"
"conduit"
"hedgedoc"
];
services.cachefilesd.enable = true;
@ -225,11 +246,14 @@ in
allow_assign_grafana_admin = true;
auto_login = true;
};
"auth" = { disable_login_form = true; };
"auth" = {
disable_login_form = true;
};
};
};
systemd.services.grafana.serviceConfig.EnvironmentFile = config.sops.secrets.grafana_oauth_secret.path;
systemd.services.grafana.serviceConfig.EnvironmentFile =
config.sops.secrets.grafana_oauth_secret.path;
users.users.git = {
isSystemUser = true;
@ -240,9 +264,7 @@ in
users.groups.git = { };
users.users = {
${config.services.caddy.user}.extraGroups = [
config.services.ntfy-sh.group
];
${config.services.caddy.user}.extraGroups = [ config.services.ntfy-sh.group ];
};
services.caddy = {

4
machines/netdrives.nix
View file

@ -1,7 +1,7 @@
{ pkgs, config, ... }:
{
sops.secrets = {
autofs-nas = {
autofs-nas = {
owner = "davfs2";
};
autofs-nas-secret = {
@ -19,4 +19,4 @@
];
};
}
}

16
machines/raspite/configuration.nix
View file

@ -1,17 +1,19 @@
{ config, lib, pkgs, ... }:
{
config,
lib,
pkgs,
...
}:
{
imports = [
./hass.nix
];
imports = [ ./hass.nix ];
commonSettings.nix.enableMirrors = true;
nixpkgs.overlays = [
# Workaround https://github.com/NixOS/nixpkgs/issues/126755#issuecomment-869149243
(final: super: {
makeModulesClosure = x:
super.makeModulesClosure (x // { allowMissing = true; });
makeModulesClosure = x: super.makeModulesClosure (x // { allowMissing = true; });
})
];
@ -22,7 +24,7 @@
];
system.stateVersion = "24.05";
networking = {
hostName = "raspite";
useDHCP = false;

22
machines/raspite/hass.nix
View file

@ -1,4 +1,5 @@
{ config, pkgs, ... }: {
{ config, pkgs, ... }:
{
services.home-assistant = {
enable = true;
extraComponents = [
@ -9,14 +10,12 @@
];
openFirewall = false;
config = {
default_config = {};
default_config = { };
http = {
server_host = "::1";
base_url = "raspite.local:1000";
use_x_forward_for = true;
trusted_proxies = [
"::1"
];
trusted_proxies = [ "::1" ];
};
};
};
@ -28,16 +27,17 @@
users.groups.dialout.members = config.users.groups.wheel.members;
environment.systemPackages = with pkgs; [
zigbee2mqtt
environment.systemPackages = with pkgs; [ zigbee2mqtt ];
networking.firewall.allowedTCPPorts = [
1000
1001
];
networking.firewall.allowedTCPPorts = [ 1000 1001 ];
services.caddy = {
enable = true;
enable = true;
virtualHosts = {
# reverse_proxy ${config.services.home-assistant.config.http.server_host}:${toString config.services.home-assistant.config.http.server_port}
# reverse_proxy ${config.services.home-assistant.config.http.server_host}:${toString config.services.home-assistant.config.http.server_port}
"raspite.local:1000".extraConfig = ''
reverse_proxy http://[::1]:8123
'';

21
machines/sops.nix
View file

@ -1,4 +1,9 @@
{ inputs, config, lib, ... }:
{
inputs,
config,
lib,
...
}:
{
imports = [ inputs.sops-nix.nixosModules.sops ];
config = {
@ -11,24 +16,22 @@
owner = "root";
};
singbox_sg_server = {
owner = "root";
owner = "root";
};
singbox_jp_server = {
owner = "root";
owner = "root";
};
singbox_password = {
owner = "root";
owner = "root";
};
singbox_uuid = {
owner = "root";
owner = "root";
};
private_dns_address = {
owner = "root";
owner = "root";
};
};
secrets.grafana_cloud_api = lib.mkIf config.services.prometheus.enable {
owner = "prometheus";
};
secrets.grafana_cloud_api = lib.mkIf config.services.prometheus.enable { owner = "prometheus"; };
};
};
}

46
machines/weilite/default.nix
View file

@ -1,4 +1,11 @@
{ inputs, config, pkgs, lib, modulesPath, ... }:
{
inputs,
config,
pkgs,
lib,
modulesPath,
...
}:
with lib;
@ -19,17 +26,21 @@ with lib;
};
boot = {
loader = {
loader = {
systemd-boot.enable = true;
efi.canTouchEfiVariables = true;
};
initrd.availableKernelModules = [ "uhci_hcd" "ehci_pci" "ahci" "usb_storage" "sd_mod" ];
initrd.availableKernelModules = [
"uhci_hcd"
"ehci_pci"
"ahci"
"usb_storage"
"sd_mod"
];
kernelModules = [ "kvm-intel" ];
};
environment.systemPackages = [
pkgs.virtiofsd
];
environment.systemPackages = [ pkgs.virtiofsd ];
sops = {
defaultSopsFile = ./secrets.yaml;
@ -47,13 +58,15 @@ with lib;
};
systemd.mounts = [
{ what = "immich";
{
what = "immich";
where = "/mnt/XinPhotos/immich";
type = "virtiofs";
options = "rw";
wantedBy = [ "immich-server.service" ];
}
{ what = "originals";
{
what = "originals";
where = "/mnt/XinPhotos/originals";
type = "virtiofs";
options = "ro,nodev,nosuid";
@ -61,7 +74,10 @@ with lib;
}
];
services.openssh.ports = [ 22 2222 ];
services.openssh.ports = [
22
2222
];
services.immich = {
enable = true;
@ -90,7 +106,10 @@ with lib;
enable = true;
package = pkgs.caddy.withPlugins {
caddyModules = [
{ repo = "github.com/caddy-dns/cloudflare"; version = "89f16b99c18ef49c8bb470a82f895bce01cbaece"; }
{
repo = "github.com/caddy-dns/cloudflare";
version = "89f16b99c18ef49c8bb470a82f895bce01cbaece";
}
];
vendorHash = "sha256-fTcMtg5GGEgclIwJCav0jjWpqT+nKw2OF1Ow0MEEitk=";
};
@ -115,7 +134,7 @@ with lib;
};
time.timeZone = "Asia/Shanghai";
fileSystems."/" = {
device = "/dev/disk/by-label/nixos";
fsType = "btrfs";
@ -124,7 +143,10 @@ with lib;
fileSystems."/boot" = {
device = "/dev/sda1";
fsType = "vfat";
options = [ "fmask=0022" "dmask=0022" ];
options = [
"fmask=0022"
"dmask=0022"
];
};
system.stateVersion = "24.11";

11
modules/home-manager/cosmic-term.nix
View file

@ -1,4 +1,9 @@
{ config, pkgs, lib, ... }:
{
config,
pkgs,
lib,
...
}:
let
inherit (lib) mkEnableOption mkIf;
@ -10,7 +15,5 @@ in
enable = mkEnableOption "cosmic-term";
};
config = mkIf cfg.enable {
home.packages = [ pkgs.cosmic-term ];
};
config = mkIf cfg.enable { home.packages = [ pkgs.cosmic-term ]; };
}

108
modules/home-manager/fish.nix
View file

@ -1,4 +1,9 @@
{ config, pkgs, lib, ... }:
{
config,
pkgs,
lib,
...
}:
with lib;
@ -10,7 +15,12 @@ in
enable = mkEnableOption "fish";
plugins = mkOption {
type = types.listOf types.str;
default = [ "pisces" "done" "hydro" "grc" ];
default = [
"pisces"
"done"
"hydro"
"grc"
];
};
functions = {
enable = mkOption {
@ -30,41 +40,65 @@ in
home.packages = [ pkgs.grc ];
programs.fish = {
enable = true;
plugins = with pkgs; (filter (
e: hasAttr e.name (builtins.listToAttrs # { "xxx" = true; }
(map (p: { name = p; value = true; }) cfg.plugins) # { name = "xxx"; value = true; }
)) [
{ name = "pisces";
src = fishPlugins.pisces.src;
}
{ name = "done";
src = fishPlugins.done.src;
}
{ name = "hydro";
src = fishPlugins.hydro.src;
}
{ name = "grc";
src = fishPlugins.grc.src;
}
]);
interactiveShellInit = let
extraInit = if cfg.functions.enable then ''
${pkgs.nix-your-shell}/bin/nix-your-shell fish | source
function fish_right_prompt
if test -n "$IN_NIX_SHELL"
echo -n "<nix-shell>"
else if test $SHLVL -ge 3
echo -n "<🚀lv$SHLVL>"
end
end
function fish_command_not_found
${pkgs.comma}/bin/comma $argv
end
set -gx LS_COLORS (${lib.getExe pkgs.vivid} generate catppuccin-mocha)
'' else "";
in ''
fish_config prompt choose default
'' + extraInit;
plugins =
with pkgs;
(filter
(
e:
hasAttr e.name (
builtins.listToAttrs # { "xxx" = true; }
(
map (p: {
name = p;
value = true;
}) cfg.plugins
) # { name = "xxx"; value = true; }
)
)
[
{
name = "pisces";
src = fishPlugins.pisces.src;
}
{
name = "done";
src = fishPlugins.done.src;
}
{
name = "hydro";
src = fishPlugins.hydro.src;
}
{
name = "grc";
src = fishPlugins.grc.src;
}
]
);
interactiveShellInit =
let
extraInit =
if cfg.functions.enable then
''
${pkgs.nix-your-shell}/bin/nix-your-shell fish | source
function fish_right_prompt
if test -n "$IN_NIX_SHELL"
echo -n "<nix-shell>"
else if test $SHLVL -ge 3
echo -n "<🚀lv$SHLVL>"
end
end
function fish_command_not_found
${pkgs.comma}/bin/comma $argv
end
set -gx LS_COLORS (${lib.getExe pkgs.vivid} generate catppuccin-mocha)
''
else
"";
in
''
fish_config prompt choose default
''
+ extraInit;
functions = mkIf cfg.functions.enable {
gitignore = "curl -sL https://www.gitignore.io/api/$argv";
};

17
modules/home-manager/git.nix
View file

@ -1,4 +1,9 @@
{ config, pkgs, lib, ... }:
{
config,
pkgs,
lib,
...
}:
with lib;
@ -32,16 +37,12 @@ in
d = "diff";
s = "status";
};
signing = mkIf cfg.signing.enable {
signing = mkIf cfg.signing.enable {
signByDefault = true;
key = cfg.signing.keyFile;
};
extraConfig.user = mkIf cfg.signing.enable {
signingkey = cfg.signing.keyFile;
};
extraConfig.gpg = mkIf cfg.signing.enable {
format = "ssh";
};
extraConfig.user = mkIf cfg.signing.enable { signingkey = cfg.signing.keyFile; };
extraConfig.gpg = mkIf cfg.signing.enable { format = "ssh"; };
};
};
}

2
modules/home-manager/tmux.nix
View file

@ -1 +1 @@
{}
{ }

12
modules/home-manager/vim.nix
View file

@ -1,4 +1,9 @@
{ config, pkgs, lib, ... }:
{
config,
pkgs,
lib,
...
}:
let
inherit (lib) mkIf mkEnableOption getExe;
cfg = config.custom-hm.neovim;
@ -13,7 +18,10 @@ in
enable = mkEnableOption "neovim configurations";
};
config = mkIf cfg.enable {
home.packages = with pkgs; [ nixvim neovide ];
home.packages = with pkgs; [
nixvim
neovide
];
programs.neovim.enable = false;
home.file.".config/neovide/config.toml" = {
source = tomlFormat.generate "neovide-config" neovideConfig;

190
modules/home-manager/vscode.nix
View file

@ -1,4 +1,10 @@
{ inputs, config, lib, pkgs, ... }:
{
inputs,
config,
lib,
pkgs,
...
}:
with lib;
let
@ -6,7 +12,10 @@ let
packages = {
nixPackages = {
systemPackages = with pkgs; [ nixd nixpkgs-fmt ];
systemPackages = with pkgs; [
nixd
nixpkgs-fmt
];
extension = with inputs.nix-vscode-extensions.extensions.${pkgs.system}.vscode-marketplace; [
jnoortheen.nix-ide
];
@ -17,10 +26,15 @@ let
};
};
cxxPackages = {
systemPackages = with pkgs; [ clang-tools cmake-format ];
systemPackages = with pkgs; [
clang-tools
cmake-format
];
extension = with inputs.nix-vscode-extensions.extensions.${pkgs.system}.vscode-marketplace; [
llvm-vs-code-extensions.vscode-clangd
(ms-vscode.cmake-tools.overrideAttrs (_: { sourceRoot = "extension"; }))
(ms-vscode.cmake-tools.overrideAttrs (_: {
sourceRoot = "extension";
}))
twxs.cmake
ms-vscode.cpptools
];
@ -43,7 +57,10 @@ let
settings = { };
};
scalaPackages = {
systemPackages = with pkgs; [ coursier metals ];
systemPackages = with pkgs; [
coursier
metals
];
extension = with inputs.nix-vscode-extensions.extensions.${pkgs.system}.vscode-marketplace; [
scala-lang.scala
scalameta.metals
@ -61,20 +78,56 @@ let
{
"name" = "xelatex";
"command" = "xelatex";
"args" = [ "-synctex=1" "-interaction=nonstopmode" "-file-line-error" "%DOCFILE%" ];
"args" = [
"-synctex=1"
"-interaction=nonstopmode"
"-file-line-error"
"%DOCFILE%"
];
}
{
"name" = "pdflatex";
"command" = "pdflatex";
"args" = [ "-synctex=1" "-interaction=nonstopmode" "-file-line-error" "%DOCFILE%" ];
"args" = [
"-synctex=1"
"-interaction=nonstopmode"
"-file-line-error"
"%DOCFILE%"
];
}
{
"name" = "bibtex";
"command" = "bibtex";
"args" = [ "%DOCFILE%" ];
}
{ "name" = "bibtex"; "command" = "bibtex"; "args" = [ "%DOCFILE%" ]; }
];
"latex-workshop.latex.recipes" = [
{ "name" = "xelatex"; "tools" = [ "xelatex" ]; }
{ "name" = "pdflatex"; "tools" = [ "pdflatex" ]; }
{ "name" = "xe->bib->xe->xe"; "tools" = [ "xelatex" "bibtex" "xelatex" "xelatex" ]; }
{ "name" = "pdf->bib->pdf->pdf"; "tools" = [ "pdflatex" "bibtex" "pdflatex" "pdflatex" ]; }
{
"name" = "xelatex";
"tools" = [ "xelatex" ];
}
{
"name" = "pdflatex";
"tools" = [ "pdflatex" ];
}
{
"name" = "xe->bib->xe->xe";
"tools" = [
"xelatex"
"bibtex"
"xelatex"
"xelatex"
];
}
{
"name" = "pdf->bib->pdf->pdf";
"tools" = [
"pdflatex"
"bibtex"
"pdflatex"
"pdflatex"
];
}
];
"[latex]" = {
"editor.formatOnPaste" = false;
@ -88,9 +141,15 @@ let
};
llmExtensions = [ pkgs.vscode-extensions.continue.continue ];
languages = [ "nix" "cxx" "python" "scala" "latex" ];
zipAttrsWithLanguageOption = (attr:
(map (l: (lib.mkIf cfg.languages.${l} packages."${l}Packages".${attr})) languages)
languages = [
"nix"
"cxx"
"python"
"scala"
"latex"
];
zipAttrsWithLanguageOption = (
attr: (map (l: (lib.mkIf cfg.languages.${l} packages."${l}Packages".${attr})) languages)
);
in
{
@ -111,64 +170,71 @@ in
config = mkIf cfg.enable {
nixpkgs.config.allowUnfree = true;
home.packages = lib.mkMerge ([
[ pkgs.clang-tools ]
(mkIf cfg.llm [ pkgs.ollama ])
] ++ zipAttrsWithLanguageOption "systemPackages");
home.packages = lib.mkMerge (
[
[ pkgs.clang-tools ]
(mkIf cfg.llm [ pkgs.ollama ])
]
++ zipAttrsWithLanguageOption "systemPackages"
);
programs.vscode = {
enable = true;
package = pkgs.vscode.override { commandLineArgs = "--enable-wayland-ime"; };
enableUpdateCheck = false;
enableExtensionUpdateCheck = false;
mutableExtensionsDir = false;
extensions = lib.mkMerge ([
(with inputs.nix-vscode-extensions.extensions.${pkgs.system}.vscode-marketplace; [
mkhl.direnv
extensions = lib.mkMerge (
[
(with inputs.nix-vscode-extensions.extensions.${pkgs.system}.vscode-marketplace; [
mkhl.direnv
ms-azuretools.vscode-docker
ms-vscode-remote.remote-ssh
vscodevim.vim
github.vscode-pull-request-github
gruntfuggly.todo-tree # todo highlight
ms-azuretools.vscode-docker
ms-vscode-remote.remote-ssh
vscodevim.vim
github.vscode-pull-request-github
gruntfuggly.todo-tree # todo highlight
# Markdown
davidanson.vscode-markdownlint
# Latex
# Scale / chisel
sterben.fpga-support
# Markdown
davidanson.vscode-markdownlint
# Latex
# Scale / chisel
sterben.fpga-support
ms-vscode-remote.remote-ssh-edit
mushan.vscode-paste-image
])
ms-vscode-remote.remote-ssh-edit
mushan.vscode-paste-image
])
(with pkgs.vscode-extensions; [
waderyan.gitblame
catppuccin.catppuccin-vsc
# Rust
rust-lang.rust-analyzer
])
(with pkgs.vscode-extensions; [
waderyan.gitblame
catppuccin.catppuccin-vsc
# Rust
rust-lang.rust-analyzer
])
(mkIf cfg.llm llmExtensions)
] ++ zipAttrsWithLanguageOption "extension");
userSettings = lib.mkMerge ([
{
"workbench.colorTheme" = "Catppuccin Macchiato";
"terminal.integrated.sendKeybindingsToShell" = true;
"extensions.ignoreRecommendations" = true;
"files.autoSave" = "afterDelay";
"editor.inlineSuggest.enabled" = true;
"editor.rulers" = [
80
];
"editor.mouseWheelZoom" = true;
"git.autofetch" = false;
"window.zoomLevel" = -1;
(mkIf cfg.llm llmExtensions)
]
++ zipAttrsWithLanguageOption "extension"
);
userSettings = lib.mkMerge (
[
{
"workbench.colorTheme" = "Catppuccin Macchiato";
"terminal.integrated.sendKeybindingsToShell" = true;
"extensions.ignoreRecommendations" = true;
"files.autoSave" = "afterDelay";
"editor.inlineSuggest.enabled" = true;
"editor.rulers" = [ 80 ];
"editor.mouseWheelZoom" = true;
"git.autofetch" = false;
"window.zoomLevel" = -1;
"extensions.experimental.affinity" = {
"vscodevim.vim" = 1;
};
}
] ++ zipAttrsWithLanguageOption "settings");
"extensions.experimental.affinity" = {
"vscodevim.vim" = 1;
};
}
]
++ zipAttrsWithLanguageOption "settings"
);
};
home.file.".continue/config.json".text = lib.generators.toJSON { } {
@ -180,7 +246,7 @@ in
}
];
tabAutocompleteModel = {
model ="deepseek-coder:6.7b-base";
model = "deepseek-coder:6.7b-base";
provider = "ollama";
title = "codegemma";
};

2
modules/home-manager/zellij.nix
View file

@ -1,4 +1,4 @@
{ config, lib, ... }:
{ config, lib, ... }:
with lib;

15
modules/nixos/common-settings/auth.nix
View file

@ -1,7 +1,17 @@
{ config, lib, pkgs, ... }:
{
config,
lib,
pkgs,
...
}:
let
inherit (lib) mkIf mkEnableOption mkOption types;
inherit (lib)
mkIf
mkEnableOption
mkOption
types
;
cfg = config.commonSettings.auth;
in
@ -38,4 +48,3 @@ in
};
};
}

24
modules/nixos/common-settings/nix-conf.nix
View file

@ -1,7 +1,17 @@
{ config, lib, pkgs, ... }:
{
config,
lib,
pkgs,
...
}:
let
inherit (lib) mkIf mkEnableOption mkOption types;
inherit (lib)
mkIf
mkEnableOption
mkOption
types
;
cfg = config.commonSettings.nix;
in
@ -33,7 +43,10 @@ in
nix.optimise.automatic = true;
nix.settings = {
experimental-features = [ "nix-command" "flakes" ];
experimental-features = [
"nix-command"
"flakes"
];
auto-optimise-store = true;
trusted-users = [ "root" ];
@ -52,10 +65,7 @@ in
"xin-1:8/ul1IhdWLswERF/8RfeAw8VZqjwHrJ1x55y1yjxQ+Y="
];
secret-key-files = mkIf cfg.signing.enable [
cfg.signing.keyFile
];
secret-key-files = mkIf cfg.signing.enable [ cfg.signing.keyFile ];
};
};
}

11
modules/nixos/forgejo-actions-runner.nix
View file

@ -1,4 +1,9 @@
{ config, pkgs, lib, ... }:
{
config,
pkgs,
lib,
...
}:
let
cfg = config.custom.forgejo-actions-runner;
in
@ -6,9 +11,7 @@ in
options = {
custom.forgejo-actions-runner = {
enable = lib.mkEnableOption "TPM supported ssh agent in go";
tokenFile = lib.mkOption {
type = lib.types.path;
};
tokenFile = lib.mkOption { type = lib.types.path; };
};
};
config = lib.mkIf cfg.enable {

27
modules/nixos/hedgedoc.nix
View file

@ -1,4 +1,9 @@
{ config, pkgs, lib, ... }:
{
config,
pkgs,
lib,
...
}:
with lib;
@ -26,22 +31,12 @@ in
};
oidc = {
enable = mkEnableOption "OIDC support for HedgeDoc";
baseURL = mkOption {
type = types.str;
};
authorizationURL = mkOption {
type = types.str;
};
tokenURL = mkOption {
type = types.str;
};
userProfileURL = mkOption {
type = types.str;
};
};
environmentFile = mkOption {
type = types.path;
baseURL = mkOption { type = types.str; };
authorizationURL = mkOption { type = types.str; };
tokenURL = mkOption { type = types.str; };
userProfileURL = mkOption { type = types.str; };
};
environmentFile = mkOption { type = types.path; };
};
};
config = mkIf cfg.enable {

86
modules/nixos/inbounds.nix
View file

@ -1,19 +1,16 @@
{ config
, lib
, ... }:
{ config, lib, ... }:
let
cfg = config.custom.sing-box-server;
secretFileType = lib.types.submodule {
_secret = lib.types.path;
};
secretFileType = lib.types.submodule { _secret = lib.types.path; };
singTls = {
enabled = true;
server_name = config.deployment.targetHost;
key_path = config.security.acme.certs.${config.deployment.targetHost}.directory + "/key.pem";
certificate_path = config.security.acme.certs.${config.deployment.targetHost}.directory + "/cert.pem";
certificate_path =
config.security.acme.certs.${config.deployment.targetHost}.directory + "/cert.pem";
};
in
in
{
options = {
enable = lib.mkEnableOption "sing-box proxy server";
@ -22,17 +19,11 @@ in
type = lib.types.str;
default = "proxy";
};
password = lib.mkOption {
type = secretFileType;
};
uuid = lib.mkOption {
type = secretFileType;
};
password = lib.mkOption { type = secretFileType; };
uuid = lib.mkOption { type = secretFileType; };
};
wgOut = {
privKeyFile = lib.mkOption {
type = lib.types.path;
};
privKeyFile = lib.mkOption { type = lib.types.path; };
pubkey = lib.mkOption {
type = lib.types.str;
default = "bmXOC+F1FxEMF9dyiK2H5/1SUtzH0JuVo51h2wPfgyo=";
@ -73,17 +64,19 @@ in
}
];
};
inbounds = [
# TODO: Trojan and tuic enable
{
tag = "trojan-in";
type = "trojan";
listen = "::";
listen_port = 8080;
users = map (u: removeAttrs u [ "uuid" ]) cfg.users;
tls = singTls;
}
] ++ lib.forEach (cfg.tuic.ports ++ cfg.tuic.directPorts) (port: {
inbounds =
[
# TODO: Trojan and tuic enable
{
tag = "trojan-in";
type = "trojan";
listen = "::";
listen_port = 8080;
users = map (u: removeAttrs u [ "uuid" ]) cfg.users;
tls = singTls;
}
]
++ lib.forEach (cfg.tuic.ports ++ cfg.tuic.directPorts) (port: {
tag = "tuic-in" + toString port;
type = "tuic";
listen = "::";
@ -102,25 +95,40 @@ in
"2606:4700:110:82ed:a443:3c62:6cbc:b59b/128"
];
peers = [
{ public_key= cfg.wgOut.pubkey;
allowed_ips = [ "0.0.0.0/0" "::/0" ];
{
public_key = cfg.wgOut.pubkey;
allowed_ips = [
"0.0.0.0/0"
"::/0"
];
server = "162.159.192.1";
server_port = 500;
}
];
}
{ type = "direct"; tag = "direct-out"; }
{ type = "dns"; tag = "dns-out"; }
{
type = "direct";
tag = "direct-out";
}
{
type = "dns";
tag = "dns-out";
}
];
route = {
rules = [
{ outbound = "dns-out"; protocol = "dns"; }
] ++ lib.forEach cfg.tuic.directPorts (port: {
inbound = "tuic-in" + toString port;
outbound = "direct-out";
});
rules =
[
{
outbound = "dns-out";
protocol = "dns";
}
]
++ lib.forEach cfg.tuic.directPorts (port: {
inbound = "tuic-in" + toString port;
outbound = "direct-out";
});
};
};
};
};
}
}

49
modules/nixos/kanidm-client.nix
View file

@ -1,4 +1,9 @@
{ config, pkgs, lib, ... }:
{
config,
pkgs,
lib,
...
}:
with lib;
let
@ -27,31 +32,29 @@ in
type = types.listOf types.str;
default = [ ];
};
uri = mkOption {
type = types.str;
};
uri = mkOption { type = types.str; };
};
};
config = mkIf cfg.enable {
services.kanidm = mkMerge
[ (mkIf cfg.enable {
enableClient = true;
clientSettings = {
uri = cfg.uri;
};
})
(mkIf cfg.asSSHAuth.enable {
enablePam = true;
unixSettings = {
pam_allowed_login_groups = cfg.asSSHAuth.allowedGroups;
default_shell = "/bin/sh";
};
})
];
services.kanidm = mkMerge [
(mkIf cfg.enable {
enableClient = true;
clientSettings = {
uri = cfg.uri;
};
})
(mkIf cfg.asSSHAuth.enable {
enablePam = true;
unixSettings = {
pam_allowed_login_groups = cfg.asSSHAuth.allowedGroups;
default_shell = "/bin/sh";
};
})
];
services.openssh = mkIf cfg.asSSHAuth.enable {
enable = true;
authorizedKeysCommand = "/etc/ssh/auth %u";
authorizedKeysCommandUser = "kanidm-ssh-runner";
authorizedKeysCommandUser = "kanidm-ssh-runner";
settings = mkIf cfg.asSSHAuth.enable {
PasswordAuthentication = false;
KbdInteractiveAuthentication = false;
@ -70,8 +73,10 @@ in
};
users.groups.wheel.members = cfg.sudoers;
users.groups.kanidm-ssh-runner = { };
users.users.kanidm-ssh-runner = { isSystemUser = true; group = "kanidm-ssh-runner"; };
users.users.kanidm-ssh-runner = {
isSystemUser = true;
group = "kanidm-ssh-runner";
};
};
}

62
modules/nixos/miniflux.nix
View file

@ -1,6 +1,19 @@
{ config, pkgs, lib, ... }:
{
config,
pkgs,
lib,
...
}:
let
inherit (lib) mkEnableOption mkPackageOption mkOption types literalExpression mkIf mkDefault;
inherit (lib)
mkEnableOption
mkPackageOption
mkOption
types
literalExpression
mkIf
mkDefault
;
cfg = config.custom.miniflux;
defaultAddress = "localhost:8080";
@ -18,12 +31,15 @@ in
package = mkPackageOption pkgs "miniflux" { };
oauth2SecretFile = mkOption {
type = types.path;
};
oauth2SecretFile = mkOption { type = types.path; };
environment = mkOption {
type = with types; attrsOf (oneOf [ int str ]);
type =
with types;
attrsOf (oneOf [
int
str
]);
};
createDatabaseLocally = mkOption {
@ -50,17 +66,22 @@ in
services.postgresql = lib.mkIf cfg.createDatabaseLocally {
enable = true;
ensureUsers = [{
name = "miniflux";
ensureDBOwnership = true;
}];
ensureUsers = [
{
name = "miniflux";
ensureDBOwnership = true;
}
];
ensureDatabases = [ "miniflux" ];
};
systemd.services.miniflux-dbsetup = lib.mkIf cfg.createDatabaseLocally {
description = "Miniflux database setup";
requires = [ "postgresql.service" ];
after = [ "network.target" "postgresql.service" ];
after = [
"network.target"
"postgresql.service"
];
serviceConfig = {
Type = "oneshot";
User = config.services.postgresql.superUser;
@ -72,8 +93,12 @@ in
description = "Miniflux service";
wantedBy = [ "multi-user.target" ];
requires = lib.optional cfg.createDatabaseLocally "miniflux-dbsetup.service";
after = [ "network.target" ]
++ lib.optionals cfg.createDatabaseLocally [ "postgresql.service" "miniflux-dbsetup.service" ];
after =
[ "network.target" ]
++ lib.optionals cfg.createDatabaseLocally [
"postgresql.service"
"miniflux-dbsetup.service"
];
serviceConfig = {
Type = "notify";
@ -104,12 +129,19 @@ in
ProtectKernelModules = true;
ProtectKernelTunables = true;
ProtectProc = "invisible";
RestrictAddressFamilies = [ "AF_INET" "AF_INET6" "AF_UNIX" ];
RestrictAddressFamilies = [
"AF_INET"
"AF_INET6"
"AF_UNIX"
];
RestrictNamespaces = true;
RestrictRealtime = true;
RestrictSUIDSGID = true;
SystemCallArchitectures = "native";
SystemCallFilter = [ "@system-service" "~@privileged" ];
SystemCallFilter = [
"@system-service"
"~@privileged"
];
UMask = "0077";
};

18
modules/nixos/oidc-agent.nix
View file

@ -1,10 +1,20 @@
{ config, lib, pkgs, ... }:
{
config,
lib,
pkgs,
...
}:
let
inherit (lib) mkIf mkEnableOption mkOption types;
inherit (lib)
mkIf
mkEnableOption
mkOption
types
;
cfg = config.programs.oidc-agent;
providerFormat = pkgs.formats.json {};
providerFormat = pkgs.formats.json { };
in
{
options.programs.oidc-agent = {
@ -18,7 +28,7 @@ in
};
providers = mkOption {
type = providerFormat.type;
default = {};
default = { };
description = ''
Configuration of providers which contains a json array of json objects
each describing an issuer, see https://indigo-dc.gitbook.io/oidc-agent/configuration/issuers

20
modules/nixos/prometheus/blackbox.nix
View file

@ -1,4 +1,9 @@
{ config, lib, pkgs, ... }:
{
config,
lib,
pkgs,
...
}:
let
cfg = config.custom.prometheus;
in
@ -8,7 +13,7 @@ in
enable = true;
listenAddress = "127.0.0.1";
configFile = pkgs.writeText "blackbox.config.yaml" (
lib.generators.toYAML {} {
lib.generators.toYAML { } {
modules = {
tcp4_connect = {
prober = "tcp";
@ -25,7 +30,7 @@ in
};
services.prometheus.scrapeConfigs = [
{
{
job_name = "blackbox";
scrape_interval = "1m";
metrics_path = "/probe";
@ -73,8 +78,13 @@ in
alert = "HighProbeLatency";
expr = "probe_duration_seconds > 0.5";
for = "2m";
labels = { severity = "warning"; };
annotations = { summary = "High request latency on {{ $labels.instance }}"; description = "95th percentile of request latency is above 0.5 seconds for the last 2 minutes."; };
labels = {
severity = "warning";
};
annotations = {
summary = "High request latency on {{ $labels.instance }}";
description = "95th percentile of request latency is above 0.5 seconds for the last 2 minutes.";
};
}
];
}

12
modules/nixos/prometheus/caddy.nix
View file

@ -13,9 +13,7 @@ in
services.prometheus.scrapeConfigs = [
{
job_name = "caddy";
static_configs = [
{ targets = [ "127.0.0.1:2019" ]; }
];
static_configs = [ { targets = [ "127.0.0.1:2019" ]; } ];
}
];
@ -27,8 +25,12 @@ in
alert = "UpstreamHealthy";
expr = "caddy_reverse_proxy_upstreams_healthy != 1";
for = "5m";
labels = { severity = "critical"; };
annotations = { summary = "Upstream {{ $labels.unstream }} not healthy"; };
labels = {
severity = "critical";
};
annotations = {
summary = "Upstream {{ $labels.unstream }} not healthy";
};
}
];
}

312
modules/nixos/prometheus/default.nix
View file

@ -1,26 +1,31 @@
{ config, pkgs, lib, ... }:
{
config,
pkgs,
lib,
...
}:
with lib;
let
cfg = config.custom.prometheus;
mkExporterOption = enableOption: (mkOption {
type = types.bool;
default = enableOption;
description = "Enable this exporter";
});
mkExporterOption =
enableOption:
(mkOption {
type = types.bool;
default = enableOption;
description = "Enable this exporter";
});
mkRulesOption = mkOption {
type = types.listOf (types.submodule {
options = {
name = mkOption {
type = lib.types.str;
type = types.listOf (
types.submodule {
options = {
name = mkOption { type = lib.types.str; };
rules = mkOption { type = lib.types.listOf lib.types.attrs; };
};
rules = mkOption {
type = lib.types.listOf lib.types.attrs;
};
};
});
}
);
};
in
{
@ -54,153 +59,172 @@ in
};
grafana = {
enable = mkEnableOption "Grafana Cloud";
password_file = mkOption {
type = types.path;
};
password_file = mkOption { type = types.path; };
};
ruleModules = mkRulesOption;
};
};
config = mkIf cfg.enable
{
services.tailscale = {
enable = true;
permitCertUid = config.services.caddy.user;
openFirewall = true;
};
config = mkIf cfg.enable {
services.tailscale = {
enable = true;
permitCertUid = config.services.caddy.user;
openFirewall = true;
};
services.caddy = {
enable = true;
virtualHosts."${config.networking.hostName}.coho-tet.ts.net".extraConfig = ''
reverse_proxy 127.0.0.1:${toString config.services.prometheus.port}
'';
};
services.caddy = {
enable = true;
virtualHosts."${config.networking.hostName}.coho-tet.ts.net".extraConfig = ''
reverse_proxy 127.0.0.1:${toString config.services.prometheus.port}
'';
};
services.prometheus = mkIf cfg.enable
services.prometheus = mkIf cfg.enable {
enable = true;
port = 9091;
globalConfig.external_labels = {
hostname = config.networking.hostName;
};
remoteWrite = mkIf cfg.grafana.enable [
{
name = "grafana";
url = "https://prometheus-prod-24-prod-eu-west-2.grafana.net/api/prom/push";
basic_auth = {
username = "1340065";
password_file = cfg.grafana.password_file;
};
}
];
exporters = {
node = {
enable = true;
port = 9091;
globalConfig.external_labels = { hostname = config.networking.hostName; };
remoteWrite = mkIf cfg.grafana.enable [
{
name = "grafana";
url = "https://prometheus-prod-24-prod-eu-west-2.grafana.net/api/prom/push";
basic_auth = {
username = "1340065";
password_file = cfg.grafana.password_file;
};
}
enabledCollectors = [
"loadavg"
"time"
"systemd"
];
exporters = {
node = {
enable = true;
enabledCollectors = [
"loadavg"
"time"
"systemd"
];
listenAddress = "127.0.0.1";
port = 9100;
};
};
scrapeConfigs = [
{
job_name = "prometheus";
static_configs = [
{ targets = [ "localhost:${toString config.services.prometheus.port}" ]; }
];
}
{
job_name = "node";
static_configs = [
{ targets = [ "localhost:${toString config.services.prometheus.exporters.node.port}" ]; }
];
}
];
alertmanager = {
enable = true;
listenAddress = "127.0.0.1";
logLevel = "debug";
configuration = {
route = {
receiver = "ntfy";
};
receivers = [
{
name = "ntfy";
webhook_configs = [
{
url = "https://ntfy.xinyang.life/prometheus-alerts?tpl=yes&m=${lib.escapeURL ''
Alert {{.status}}
{{range .alerts}}-----{{range $k,$v := .labels}}
{{$k}}={{$v}}{{end}}
{{end}}
''}";
send_resolved = true;
}
];
}
];
};
};
alertmanagers = [
{
scheme = "http";
static_configs = [
{
targets = [
"${config.services.prometheus.alertmanager.listenAddress}:${toString config.services.prometheus.alertmanager.port}"
];
}
];
}
];
rules = [ (lib.generators.toYAML { } { groups = cfg.ruleModules; }) ];
listenAddress = "127.0.0.1";
port = 9100;
};
custom.prometheus.ruleModules = [
};
scrapeConfigs = [
{
name = "system_alerts";
rules = [
job_name = "prometheus";
static_configs = [ { targets = [ "localhost:${toString config.services.prometheus.port}" ]; } ];
}
{
job_name = "node";
static_configs = [
{ targets = [ "localhost:${toString config.services.prometheus.exporters.node.port}" ]; }
];
}
];
alertmanager = {
enable = true;
listenAddress = "127.0.0.1";
logLevel = "debug";
configuration = {
route = {
receiver = "ntfy";
};
receivers = [
{
alert = "SystemdFailedUnits";
expr = "node_systemd_unit_state{state=\"failed\"} > 0";
for = "5m";
labels = { severity = "critical"; };
annotations = { summary = "Systemd has failed units on {{ $labels.instance }}"; description = "There are {{ $value }} failed units on {{ $labels.instance }}. Immediate attention required!"; };
name = "ntfy";
webhook_configs = [
{
url = "https://ntfy.xinyang.life/prometheus-alerts?tpl=yes&m=${lib.escapeURL ''
Alert {{.status}}
{{range .alerts}}-----{{range $k,$v := .labels}}
{{$k}}={{$v}}{{end}}
{{end}}
''}";
send_resolved = true;
}
];
}
];
};
};
alertmanagers = [
{
scheme = "http";
static_configs = [
{
alert = "HighLoadAverage";
expr = "node_load1 > 0.8 * count without (cpu) (node_cpu_seconds_total{mode=\"idle\"})";
for = "1m";
labels = { severity = "warning"; };
annotations = { summary = "High load average detected on {{ $labels.instance }}"; description = "The 1-minute load average ({{ $value }}) exceeds 80% the number of CPUs."; };
}
{
alert = "HighTransmitTraffic";
expr = "rate(node_network_transmit_bytes_total{device!=\"lo\"}[5m]) > 100000000";
for = "1m";
labels = { severity = "warning"; };
annotations = { summary = "High network transmit traffic on {{ $labels.instance }} ({{ $labels.device }})"; description = "The network interface {{ $labels.device }} on {{ $labels.instance }} is transmitting data at a rate exceeding 100 MB/s for the last 1 minute."; };
}
{
alert = "NetworkTrafficExceedLimit";
expr = ''increase(node_network_transmit_bytes_total{device!="lo",device!~"tailscale.*",device!~"wg.*",device!~"br.*"}[30d]) > 322122547200'';
for = "0m";
labels = { severity = "critical"; };
annotations = { summary = "Outbound network traffic exceed 300GB for last 30 day"; };
}
{
alert = "JobDown";
expr = "up == 0";
for = "1m";
labels = { severity = "critical"; };
annotations = { summary = "Job {{ $labels.job }} down for 1m."; };
targets = [
"${config.services.prometheus.alertmanager.listenAddress}:${toString config.services.prometheus.alertmanager.port}"
];
}
];
}
];
rules = [ (lib.generators.toYAML { } { groups = cfg.ruleModules; }) ];
};
custom.prometheus.ruleModules = [
{
name = "system_alerts";
rules = [
{
alert = "SystemdFailedUnits";
expr = "node_systemd_unit_state{state=\"failed\"} > 0";
for = "5m";
labels = {
severity = "critical";
};
annotations = {
summary = "Systemd has failed units on {{ $labels.instance }}";
description = "There are {{ $value }} failed units on {{ $labels.instance }}. Immediate attention required!";
};
}
{
alert = "HighLoadAverage";
expr = "node_load1 > 0.8 * count without (cpu) (node_cpu_seconds_total{mode=\"idle\"})";
for = "1m";
labels = {
severity = "warning";
};
annotations = {
summary = "High load average detected on {{ $labels.instance }}";
description = "The 1-minute load average ({{ $value }}) exceeds 80% the number of CPUs.";
};
}
{
alert = "HighTransmitTraffic";
expr = "rate(node_network_transmit_bytes_total{device!=\"lo\"}[5m]) > 100000000";
for = "1m";
labels = {
severity = "warning";
};
annotations = {
summary = "High network transmit traffic on {{ $labels.instance }} ({{ $labels.device }})";
description = "The network interface {{ $labels.device }} on {{ $labels.instance }} is transmitting data at a rate exceeding 100 MB/s for the last 1 minute.";
};
}
{
alert = "NetworkTrafficExceedLimit";
expr = ''increase(node_network_transmit_bytes_total{device!="lo",device!~"tailscale.*",device!~"wg.*",device!~"br.*"}[30d]) > 322122547200'';
for = "0m";
labels = {
severity = "critical";
};
annotations = {
summary = "Outbound network traffic exceed 300GB for last 30 day";
};
}
{
alert = "JobDown";
expr = "up == 0";
for = "1m";
labels = {
severity = "critical";
};
annotations = {
summary = "Job {{ $labels.job }} down for 1m.";
};
}
];
}
];
};
}

4
modules/nixos/prometheus/gotosocial.nix
View file

@ -10,9 +10,7 @@ in
services.prometheus.scrapeConfigs = [
{
job_name = "gotosocial";
static_configs = [
{ targets = [ "localhost:8080" ]; }
];
static_configs = [ { targets = [ "localhost:8080" ]; } ];
}
];
};

11
modules/nixos/prometheus/immich.nix
View file

@ -3,9 +3,10 @@ let
cfg = config.custom.prometheus;
immichEnv = config.services.immich.environment;
metricPort =
if builtins.hasAttr "IMMICH_API_METRICS_PORT" immichEnv
then immichEnv.IMMICH_API_METRICS_PORT
else 8081;
if builtins.hasAttr "IMMICH_API_METRICS_PORT" immichEnv then
immichEnv.IMMICH_API_METRICS_PORT
else
8081;
in
{
config = lib.mkIf (cfg.enable && cfg.exporters.immich.enable) {
@ -16,9 +17,7 @@ in
services.prometheus.scrapeConfigs = [
{
job_name = "immich";
static_configs = [
{ targets = [ "127.0.0.1:${toString metricPort}" ]; }
];
static_configs = [ { targets = [ "127.0.0.1:${toString metricPort}" ]; } ];
}
];
};

4
modules/nixos/prometheus/miniflux.nix
View file

@ -8,9 +8,7 @@ in
services.prometheus.scrapeConfigs = [
{
job_name = "miniflux";
static_configs = [
{ targets = [ config.systemd.services.miniflux.environment.LISTEN_ADDR ]; }
];
static_configs = [ { targets = [ config.systemd.services.miniflux.environment.LISTEN_ADDR ]; } ];
}
];
};

4
modules/nixos/prometheus/ntfy-sh.nix
View file

@ -8,9 +8,7 @@ in
services.prometheus.scrapeConfigs = [
{
job_name = "ntfy-sh";
static_configs = [
{ targets = [ "ntfy.xinyang.life" ]; }
];
static_configs = [ { targets = [ "ntfy.xinyang.life" ]; } ];
}
];
};

22
modules/nixos/prometheus/restic.nix
View file

@ -9,9 +9,7 @@ in
services.prometheus.scrapeConfigs = [
(lib.mkIf cfg.exporters.restic.enable {
job_name = "restic";
static_configs = [
{ targets = [ config.services.restic.server.listenAddress ]; }
];
static_configs = [ { targets = [ config.services.restic.server.listenAddress ]; } ];
})
];
@ -23,15 +21,25 @@ in
alert = "ResticCheckFailed";
expr = "restic_check_success == 0";
for = "5m";
labels = { severity = "critical"; };
annotations = { summary = "Restic check failed (instance {{ $labels.instance }})"; description = "Restic check failed\\n VALUE = {{ $value }}\\n LABELS = {{ $labels }}"; };
labels = {
severity = "critical";
};
annotations = {
summary = "Restic check failed (instance {{ $labels.instance }})";
description = "Restic check failed\\n VALUE = {{ $value }}\\n LABELS = {{ $labels }}";
};
}
{
alert = "ResticOutdatedBackup";
expr = "time() - restic_backup_timestamp > 518400";
for = "0m";
labels = { severity = "critical"; };
annotations = { summary = "Restic {{ $labels.client_hostname }} / {{ $labels.client_username }} backup is outdated"; description = "Restic backup is outdated\\n VALUE = {{ $value }}\\n LABELS = {{ $labels }}"; };
labels = {
severity = "critical";
};
annotations = {
summary = "Restic {{ $labels.client_hostname }} / {{ $labels.client_username }} backup is outdated";
description = "Restic backup is outdated\\n VALUE = {{ $value }}\\n LABELS = {{ $labels }}";
};
}
];
}

8
modules/nixos/restic.nix
View file

@ -1,4 +1,9 @@
{ config, pkgs, lib, ... }:
{
config,
pkgs,
lib,
...
}:
let
cfg = config.custom.restic;
in
@ -45,4 +50,3 @@ in
};
};
}

21
modules/nixos/sing-box.nix
View file

@ -1,4 +1,10 @@
{ config, pkgs, lib, utils, ... }:
{
config,
pkgs,
lib,
utils,
...
}:
let
cfg = config.custom.sing-box;
settingsFormat = pkgs.formats.json { };
@ -16,9 +22,7 @@ in
};
configFile = {
urlFile = lib.mkOption {
type = lib.types.path;
};
urlFile = lib.mkOption { type = lib.types.path; };
name = lib.mkOption {
type = lib.types.str;
default = "config.json";
@ -62,10 +66,10 @@ in
systemd.packages = [ cfg.package ];
systemd.services.sing-box =
let
configFile = cfg.stateDir + "/${cfg.configFile.name}";
in
systemd.services.sing-box =
let
configFile = cfg.stateDir + "/${cfg.configFile.name}";
in
{
preStart = ''
umask 0077
@ -81,4 +85,3 @@ in
};
};
}

7
modules/nixos/ssh-tpm-agent.nix
View file

@ -1,5 +1,10 @@
# Temporary workaround
{ config, pkgs, lib, ... }:
{
config,
pkgs,
lib,
...
}:
let
cfg = config.services.ssh-tpm-agent;
in

10
modules/nixos/vaultwarden.nix
View file

@ -1,4 +1,9 @@
{ config, pkgs, lib, ... }:
{
config,
pkgs,
lib,
...
}:
with lib;
@ -23,7 +28,7 @@ in
};
};
config = mkIf cfg.enable {
services.vaultwarden = {
services.vaultwarden = {
enable = true;
dbBackend = "sqlite";
config = {
@ -44,4 +49,3 @@ in
};
};
}

136
oci-images/nix-ci-base/flake.nix
View file

@ -6,72 +6,78 @@
flake-utils.url = "github:numtide/flake-utils";
};
outputs = {
self,
flake-utils,
nix,
nixpkgs,
...
}:
flake-utils.lib.eachDefaultSystem (system: let
pkgs = (import nixpkgs) {
inherit system;
};
lib = pkgs.lib;
in rec {
packages = rec {
# a modified version of the nixos/nix image
# re-using the upstream nix docker image generation code
base = import (nix + "/docker.nix") {
inherit pkgs;
name = "nix-ci-base";
maxLayers = 10;
extraPkgs = with pkgs; [
nodejs_20 # nodejs is needed for running most 3rdparty actions
# add any other pre-installed packages here
curl
xz
openssl
coreutils-full
cmake
gnumake
gcc
];
# change this is you want
channelURL = "https://nixos.org/channels/nixpkgs-23.11";
nixConf = {
substituters = [
"https://mirrors.bfsu.edu.cn/nix-channels/store"
"https://mirrors.ustc.edu.cn/nix-channels/store"
"https://cache.nixos.org/"
outputs =
{
self,
flake-utils,
nix,
nixpkgs,
...
}:
flake-utils.lib.eachDefaultSystem (
system:
let
pkgs = (import nixpkgs) { inherit system; };
lib = pkgs.lib;
in
rec {
packages = rec {
# a modified version of the nixos/nix image
# re-using the upstream nix docker image generation code
base = import (nix + "/docker.nix") {
inherit pkgs;
name = "nix-ci-base";
maxLayers = 10;
extraPkgs = with pkgs; [
nodejs_20 # nodejs is needed for running most 3rdparty actions
# add any other pre-installed packages here
curl
xz
openssl
coreutils-full
cmake
gnumake
gcc
];
# change this is you want
channelURL = "https://nixos.org/channels/nixpkgs-23.11";
nixConf = {
substituters = [
"https://mirrors.bfsu.edu.cn/nix-channels/store"
"https://mirrors.ustc.edu.cn/nix-channels/store"
"https://cache.nixos.org/"
"https://nix-community.cachix.org"
];
accept-flake-config = "true";
log-lines = "300";
trusted-public-keys = [
"cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY="
"nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
];
# allow using the new flake commands in our workflows
experimental-features = ["nix-command" "flakes"];
"https://nix-community.cachix.org"
];
accept-flake-config = "true";
log-lines = "300";
trusted-public-keys = [
"cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY="
"nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
];
# allow using the new flake commands in our workflows
experimental-features = [
"nix-command"
"flakes"
];
};
};
# make /bin/sleep available on the image
runner = pkgs.dockerTools.buildImage {
name = "nix-runner";
tag = "2.21.0-pkgs-23.11";
fromImage = base;
fromImageName = null;
fromImageTag = "latest";
copyToRoot = pkgs.buildEnv {
name = "image-root";
paths = [ pkgs.coreutils-full ];
pathsToLink = [ "/bin" ]; # add coreutuls (which includes sleep) to /bin
};
};
};
# make /bin/sleep available on the image
runner = pkgs.dockerTools.buildImage {
name = "nix-runner";
tag = "2.21.0-pkgs-23.11";
fromImage = base;
fromImageName = null;
fromImageTag = "latest";
copyToRoot = pkgs.buildEnv {
name = "image-root";
paths = [pkgs.coreutils-full];
pathsToLink = ["/bin"]; # add coreutuls (which includes sleep) to /bin
};
};
};
});
}
);
}

9
overlays/add-ime-electron.nix
View file

@ -1,8 +1,13 @@
{ config, pkgs, lib, ... }:
{
config,
pkgs,
lib,
...
}:
{
nixpkgs.overlays = [
(self: super: {
(self: super: {
element-desktop = super.element-desktop.override { commandLineArgs = "--enable-wayland-ime"; };
})
];

4
overlays/add-pkgs.nix
View file

@ -1,3 +1 @@
(final: prev: {
oidc-agent = prev.callPackage ./pkgs/oidc-agent { };
})
(final: prev: { oidc-agent = prev.callPackage ./pkgs/oidc-agent { }; })

28
overlays/pkgs/oidc-agent/default.nix
View file

@ -1,14 +1,15 @@
{ lib
, stdenv
, fetchFromGitHub
, curl
, webkitgtk
, libmicrohttpd
, libsecret
, qrencode
, libsodium
, pkg-config
, help2man
{
lib,
stdenv,
fetchFromGitHub,
curl,
webkitgtk,
libmicrohttpd,
libsecret,
qrencode,
libsodium,
pkg-config,
help2man,
}:
stdenv.mkDerivation rec {
@ -19,8 +20,7 @@ stdenv.mkDerivation rec {
owner = "indigo-dc";
repo = "oidc-agent";
rev = "v${version}";
sha256 = "sha256-cOK/rZ/jnyALLuhDM3+qvwwe4Fjkv8diQBkw7NfVo0c="
;
sha256 = "sha256-cOK/rZ/jnyALLuhDM3+qvwwe4Fjkv8diQBkw7NfVo0c=";
};
buildInputs = [
@ -47,7 +47,6 @@ stdenv.mkDerivation rec {
make install_man PREFIX=$out
'';
meta = with lib; {
description = "oidc-agent for managing OpenID Connect tokens on the command line";
homepage = "https://github.com/indigo-dc/oidc-agent";
@ -55,4 +54,3 @@ stdenv.mkDerivation rec {
license = licenses.mit;
};
}