Compare commits
8 commits
9a53ca1cea
...
7a795e5ed9
| Author | SHA1 | Date | |
|---|---|---|---|
7a795e5ed9
|
|||
|
e702d503b9
|
|||
|
1267f2b4e7
|
|||
|
30689a18b5
|
|||
|
44482b9e9e
|
|||
|
6120ca25fb
|
|||
|
a2422d1f4e
|
|||
|
553622ac66
|
57 changed files with 1492 additions and 907 deletions
|
|
@ -293,11 +293,11 @@
|
|||
"nixvim": "nixvim"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1724158316,
|
||||
"narHash": "sha256-cz2N0vPfe0jmjxqKWh7dgVecLqmPLHQrvxGJk0atDbg=",
|
||||
"lastModified": 1724306750,
|
||||
"narHash": "sha256-mT8DXzj0zHfGJ+zuxFAnqnk+0bDEFgEk7TvEk59WbWQ=",
|
||||
"ref": "refs/heads/master",
|
||||
"rev": "a5eb7fe89ee8ba654f339d8f75cecb39851743ec",
|
||||
"revCount": 4,
|
||||
"rev": "81990813485a580d69853d8429e3b8aece7f66a6",
|
||||
"revCount": 11,
|
||||
"type": "git",
|
||||
"url": "https://git.xinyang.life/xin/nixvim"
|
||||
},
|
||||
|
|
|
|||
254
flake.nix
254
flake.nix
|
|
@ -52,28 +52,28 @@
|
|||
catppuccin.url = "github:catppuccin/nix";
|
||||
};
|
||||
|
||||
|
||||
outputs =
|
||||
{ self
|
||||
, home-manager
|
||||
, nixpkgs
|
||||
, nixos-hardware
|
||||
, flake-utils
|
||||
, nur
|
||||
, catppuccin
|
||||
, my-nixvim
|
||||
, ...
|
||||
{
|
||||
self,
|
||||
home-manager,
|
||||
nixpkgs,
|
||||
nixos-hardware,
|
||||
flake-utils,
|
||||
nur,
|
||||
catppuccin,
|
||||
my-nixvim,
|
||||
...
|
||||
}@inputs:
|
||||
let
|
||||
nixvimOverlay = (final: prev: {
|
||||
nixvim = self.packages.${prev.stdenv.system}.nixvim;
|
||||
});
|
||||
overlayModule = { ... }: {
|
||||
nixpkgs.overlays = [
|
||||
nixvimOverlay
|
||||
(import ./overlays/add-pkgs.nix)
|
||||
];
|
||||
};
|
||||
nixvimOverlay = (final: prev: { nixvim = self.packages.${prev.stdenv.system}.nixvim; });
|
||||
overlayModule =
|
||||
{ ... }:
|
||||
{
|
||||
nixpkgs.overlays = [
|
||||
nixvimOverlay
|
||||
(import ./overlays/add-pkgs.nix)
|
||||
];
|
||||
};
|
||||
deploymentModule = {
|
||||
deployment.targetUser = "xin";
|
||||
};
|
||||
|
|
@ -87,20 +87,25 @@
|
|||
catppuccin.homeManagerModules.catppuccin
|
||||
self.homeManagerModules
|
||||
];
|
||||
mkHome = user: host: { ... }: {
|
||||
imports = [
|
||||
home-manager.nixosModules.home-manager
|
||||
{
|
||||
home-manager = {
|
||||
sharedModules = sharedHmModules;
|
||||
useGlobalPkgs = true;
|
||||
useUserPackages = true;
|
||||
extraSpecialArgs = { inherit inputs; };
|
||||
};
|
||||
home-manager.users.${user} = (import ./home).${user}.${host};
|
||||
}
|
||||
];
|
||||
};
|
||||
mkHome =
|
||||
user: host:
|
||||
{ ... }:
|
||||
{
|
||||
imports = [
|
||||
home-manager.nixosModules.home-manager
|
||||
{
|
||||
home-manager = {
|
||||
sharedModules = sharedHmModules;
|
||||
useGlobalPkgs = true;
|
||||
useUserPackages = true;
|
||||
extraSpecialArgs = {
|
||||
inherit inputs;
|
||||
};
|
||||
};
|
||||
home-manager.users.${user} = (import ./home).${user}.${host};
|
||||
}
|
||||
];
|
||||
};
|
||||
mkHomeConfiguration = user: host: {
|
||||
name = user;
|
||||
value = home-manager.lib.homeManagerConfiguration {
|
||||
|
|
@ -114,94 +119,109 @@
|
|||
};
|
||||
};
|
||||
};
|
||||
mkNixos = { system, modules, specialArgs ? { } }: nixpkgs.lib.nixosSystem {
|
||||
inherit system;
|
||||
specialArgs = specialArgs // { inherit inputs system; };
|
||||
modules = [
|
||||
self.nixosModules.default
|
||||
nur.nixosModules.nur
|
||||
] ++ modules;
|
||||
};
|
||||
mkNixos =
|
||||
{
|
||||
system,
|
||||
modules,
|
||||
specialArgs ? { },
|
||||
}:
|
||||
nixpkgs.lib.nixosSystem {
|
||||
inherit system;
|
||||
specialArgs = specialArgs // {
|
||||
inherit inputs system;
|
||||
};
|
||||
modules = [
|
||||
self.nixosModules.default
|
||||
nur.nixosModules.nur
|
||||
] ++ modules;
|
||||
};
|
||||
in
|
||||
{
|
||||
nixpkgs = nixpkgs;
|
||||
nixosModules.default = { imports = [ ./modules/nixos overlayModule ]; };
|
||||
nixosModules.default = {
|
||||
imports = [
|
||||
./modules/nixos
|
||||
overlayModule
|
||||
];
|
||||
};
|
||||
homeManagerModules = import ./modules/home-manager;
|
||||
|
||||
homeConfigurations = builtins.listToAttrs [ (mkHomeConfiguration "xin" "calcite") ];
|
||||
|
||||
colmenaHive = inputs.colmena.lib.makeHive {
|
||||
meta = {
|
||||
nixpkgs = import nixpkgs {
|
||||
system = "x86_64-linux";
|
||||
};
|
||||
nixpkgs = import nixpkgs { system = "x86_64-linux"; };
|
||||
specialArgs = {
|
||||
inherit inputs;
|
||||
};
|
||||
};
|
||||
|
||||
massicot = { ... }: {
|
||||
deployment.targetHost = "49.13.13.122";
|
||||
deployment.buildOnTarget = true;
|
||||
massicot =
|
||||
{ ... }:
|
||||
{
|
||||
deployment.targetHost = "49.13.13.122";
|
||||
deployment.buildOnTarget = true;
|
||||
|
||||
imports = [
|
||||
{ nixpkgs.system = "aarch64-linux"; }
|
||||
machines/massicot
|
||||
] ++ sharedColmenaModules;
|
||||
};
|
||||
|
||||
tok-00 = { ... }: {
|
||||
imports = [
|
||||
machines/dolomite
|
||||
] ++ sharedColmenaModules;
|
||||
nixpkgs.system = "x86_64-linux";
|
||||
networking.hostName = "tok-00";
|
||||
system.stateVersion = "23.11";
|
||||
deployment = {
|
||||
targetHost = "video01.namely.icu";
|
||||
buildOnTarget = false;
|
||||
tags = [ "proxy" ];
|
||||
imports = [
|
||||
{ nixpkgs.system = "aarch64-linux"; }
|
||||
machines/massicot
|
||||
] ++ sharedColmenaModules;
|
||||
};
|
||||
};
|
||||
|
||||
la-00 = { ... }: {
|
||||
imports = [
|
||||
machines/dolomite
|
||||
] ++ sharedColmenaModules;
|
||||
nixpkgs.system = "x86_64-linux";
|
||||
networking.hostName = "la-00";
|
||||
system.stateVersion = "21.05";
|
||||
deployment = {
|
||||
targetHost = "la-00.video.namely.icu";
|
||||
buildOnTarget = false;
|
||||
tags = [ "proxy" ];
|
||||
tok-00 =
|
||||
{ ... }:
|
||||
{
|
||||
imports = [ machines/dolomite ] ++ sharedColmenaModules;
|
||||
nixpkgs.system = "x86_64-linux";
|
||||
networking.hostName = "tok-00";
|
||||
system.stateVersion = "23.11";
|
||||
deployment = {
|
||||
targetHost = "video01.namely.icu";
|
||||
buildOnTarget = false;
|
||||
tags = [ "proxy" ];
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
raspite = { ... }: {
|
||||
deployment = {
|
||||
targetHost = "raspite.local";
|
||||
buildOnTarget = false;
|
||||
la-00 =
|
||||
{ ... }:
|
||||
{
|
||||
imports = [ machines/dolomite ] ++ sharedColmenaModules;
|
||||
nixpkgs.system = "x86_64-linux";
|
||||
networking.hostName = "la-00";
|
||||
system.stateVersion = "21.05";
|
||||
deployment = {
|
||||
targetHost = "la-00.video.namely.icu";
|
||||
buildOnTarget = false;
|
||||
tags = [ "proxy" ];
|
||||
};
|
||||
};
|
||||
nixpkgs.system = "aarch64-linux";
|
||||
imports = [
|
||||
"${nixpkgs}/nixos/modules/installer/sd-card/sd-image-aarch64.nix"
|
||||
nixos-hardware.nixosModules.raspberry-pi-4
|
||||
machines/raspite/configuration.nix
|
||||
] ++ sharedColmenaModules;
|
||||
};
|
||||
|
||||
weilite = { ... }: {
|
||||
imports = [
|
||||
machines/weilite
|
||||
] ++ sharedColmenaModules;
|
||||
deployment = {
|
||||
targetHost = "weilite.coho-tet.ts.net";
|
||||
targetPort = 22;
|
||||
buildOnTarget = false;
|
||||
raspite =
|
||||
{ ... }:
|
||||
{
|
||||
deployment = {
|
||||
targetHost = "raspite.local";
|
||||
buildOnTarget = false;
|
||||
};
|
||||
nixpkgs.system = "aarch64-linux";
|
||||
imports = [
|
||||
"${nixpkgs}/nixos/modules/installer/sd-card/sd-image-aarch64.nix"
|
||||
nixos-hardware.nixosModules.raspberry-pi-4
|
||||
machines/raspite/configuration.nix
|
||||
] ++ sharedColmenaModules;
|
||||
};
|
||||
|
||||
weilite =
|
||||
{ ... }:
|
||||
{
|
||||
imports = [ machines/weilite ] ++ sharedColmenaModules;
|
||||
deployment = {
|
||||
targetHost = "weilite.coho-tet.ts.net";
|
||||
targetPort = 22;
|
||||
buildOnTarget = false;
|
||||
};
|
||||
nixpkgs.system = "x86_64-linux";
|
||||
};
|
||||
nixpkgs.system = "x86_64-linux";
|
||||
};
|
||||
};
|
||||
|
||||
nixosConfigurations = {
|
||||
|
|
@ -215,18 +235,30 @@
|
|||
};
|
||||
} // self.colmenaHive.nodes;
|
||||
|
||||
} // flake-utils.lib.eachDefaultSystem (system:
|
||||
let pkgs = nixpkgs.legacyPackages.${system}; in
|
||||
{
|
||||
devShells = {
|
||||
default = pkgs.mkShell {
|
||||
packages = with pkgs; [ nix git colmena sops nix-output-monitor nil nvd ];
|
||||
};
|
||||
};
|
||||
|
||||
packages = {
|
||||
nixvim = my-nixvim.packages.${system}.default;
|
||||
};
|
||||
}
|
||||
// flake-utils.lib.eachDefaultSystem (
|
||||
system:
|
||||
let
|
||||
pkgs = nixpkgs.legacyPackages.${system};
|
||||
in
|
||||
{
|
||||
devShells = {
|
||||
default = pkgs.mkShell {
|
||||
packages = with pkgs; [
|
||||
nix
|
||||
git
|
||||
colmena
|
||||
sops
|
||||
nix-output-monitor
|
||||
nil
|
||||
nvd
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
packages = {
|
||||
nixvim = my-nixvim.packages.${system}.default;
|
||||
};
|
||||
}
|
||||
);
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,8 +1,6 @@
|
|||
{ config, pkgs, ... }@inputs:
|
||||
{
|
||||
imports = [
|
||||
./common
|
||||
];
|
||||
imports = [ ./common ];
|
||||
|
||||
programs.nix-index-database.comma.enable = true;
|
||||
|
||||
|
|
@ -46,15 +44,42 @@
|
|||
};
|
||||
|
||||
custom-hm = {
|
||||
alacritty = { enable = true; };
|
||||
direnv = { enable = true; };
|
||||
fish = { enable = true; };
|
||||
git = { enable = true; signing.enable = true; };
|
||||
neovim = { enable = true; };
|
||||
vscode = { enable = true; languages = { cxx = true; python = true; scala = true; latex = true; }; llm = true; };
|
||||
zellij = { enable = true; };
|
||||
alacritty = {
|
||||
enable = true;
|
||||
};
|
||||
cosmic-term = {
|
||||
enable = true;
|
||||
};
|
||||
direnv = {
|
||||
enable = true;
|
||||
};
|
||||
fish = {
|
||||
enable = true;
|
||||
};
|
||||
git = {
|
||||
enable = true;
|
||||
signing.enable = true;
|
||||
};
|
||||
neovim = {
|
||||
enable = true;
|
||||
};
|
||||
vscode = {
|
||||
enable = true;
|
||||
languages = {
|
||||
cxx = true;
|
||||
python = true;
|
||||
scala = true;
|
||||
latex = true;
|
||||
};
|
||||
llm = true;
|
||||
};
|
||||
zellij = {
|
||||
enable = true;
|
||||
};
|
||||
};
|
||||
|
||||
programs.gnome-shell.enable = true;
|
||||
|
||||
programs.atuin = {
|
||||
enable = true;
|
||||
flags = [ "--disable-up-arrow" ];
|
||||
|
|
@ -68,10 +93,82 @@
|
|||
|
||||
programs.firefox.profiles.default = {
|
||||
isDefault = true;
|
||||
userChrome = builtins.readFile "${pkgs.fetchgit {
|
||||
url = "https://gist.github.com/0ded98af9fe3da35f3688f81364d8c14.git";
|
||||
rev = "11bb4f428382052bcbbceb6cc3fef97f3c939481";
|
||||
hash = "sha256-J11indzEGdUA0HSW8eFe5AjesOxCL/G05KwkJk9GZSY=";
|
||||
}}/userChrome.css";
|
||||
userChrome = ''
|
||||
#titlebar {
|
||||
display: none;
|
||||
}
|
||||
|
||||
#sidebar-header {
|
||||
display: none;
|
||||
}
|
||||
|
||||
[titlepreface*="."] #sidebar-header {
|
||||
visibility: collapse !important;
|
||||
}
|
||||
[titlepreface*="."] #titlebar {
|
||||
visibility: collapse;
|
||||
}
|
||||
|
||||
#sidebar-box{
|
||||
--uc-sidebar-width: 33px;
|
||||
--uc-sidebar-hover-width: 300px;
|
||||
--uc-autohide-sidebar-delay: 90ms;
|
||||
position: relative;
|
||||
min-width: var(--uc-sidebar-width) !important;
|
||||
width: var(--uc-sidebar-width) !important;
|
||||
max-width: var(--uc-sidebar-width) !important;
|
||||
z-index:1;
|
||||
}
|
||||
|
||||
#sidebar-box[positionend]{ direction: rtl }
|
||||
#sidebar-box[positionend] > *{ direction: ltr }
|
||||
|
||||
#sidebar-box[positionend]:-moz-locale-dir(rtl){ direction: ltr }
|
||||
#sidebar-box[positionend]:-moz-locale-dir(rtl) > *{ direction: rtl }
|
||||
|
||||
#main-window[sizemode="fullscreen"] #sidebar-box{ --uc-sidebar-width: 1px; }
|
||||
|
||||
#sidebar-splitter{ display: none }
|
||||
|
||||
#sidebar-header{
|
||||
overflow: hidden;
|
||||
color: var(--chrome-color, inherit) !important;
|
||||
padding-inline: 0 !important;
|
||||
}
|
||||
|
||||
#sidebar-header::before,
|
||||
#sidebar-header::after{
|
||||
content: "";
|
||||
display: -moz-box;
|
||||
padding-left: 8px;
|
||||
}
|
||||
|
||||
#sidebar-switcher-target{
|
||||
-moz-box-pack: start !important;
|
||||
}
|
||||
|
||||
#sidebar-header,
|
||||
#sidebar{
|
||||
transition: min-width 115ms linear var(--uc-autohide-sidebar-delay) !important;
|
||||
min-width: var(--uc-sidebar-width) !important;
|
||||
will-change: min-width;
|
||||
}
|
||||
#sidebar-box:hover > #sidebar-header,
|
||||
#sidebar-box:hover > #sidebar{
|
||||
min-width: var(--uc-sidebar-hover-width) !important;
|
||||
transition-delay: 0ms !important;
|
||||
}
|
||||
|
||||
.sidebar-panel{
|
||||
background-color: transparent !important;
|
||||
color: var(--newtab-text-primary-color) !important;
|
||||
}
|
||||
|
||||
.sidebar-panel #search-box{
|
||||
-moz-appearance: none !important;
|
||||
background-color: rgba(249,249,250,0.1) !important;
|
||||
color: inherit !important;
|
||||
}
|
||||
'';
|
||||
};
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,4 +1,10 @@
|
|||
{ inputs, pkgs, lib, ... }: {
|
||||
{
|
||||
inputs,
|
||||
pkgs,
|
||||
lib,
|
||||
...
|
||||
}:
|
||||
{
|
||||
imports = [ ];
|
||||
|
||||
home.packages = with pkgs; [
|
||||
|
|
|
|||
|
|
@ -1,15 +1,15 @@
|
|||
{ pkgs, home-manager, ... }:
|
||||
home-manager.lib.homeManagerConfiguration {
|
||||
inherit pkgs;
|
||||
modules = [
|
||||
../common
|
||||
{
|
||||
home.username = "xin";
|
||||
home.homeDirectory = "/home/xin";
|
||||
home.stateVersion = "23.05";
|
||||
home-manager.lib.homeManagerConfiguration {
|
||||
inherit pkgs;
|
||||
modules = [
|
||||
../common
|
||||
{
|
||||
home.username = "xin";
|
||||
home.homeDirectory = "/home/xin";
|
||||
home.stateVersion = "23.05";
|
||||
|
||||
# Let Home Manager install and manage itself.
|
||||
programs.home-manager.enable = true;
|
||||
}
|
||||
];
|
||||
}
|
||||
# Let Home Manager install and manage itself.
|
||||
programs.home-manager.enable = true;
|
||||
}
|
||||
];
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,9 +1,6 @@
|
|||
|
||||
{ config, pkgs, ... }:
|
||||
{
|
||||
imports = [
|
||||
../common
|
||||
];
|
||||
imports = [ ../common ];
|
||||
|
||||
home.username = "xin";
|
||||
home.homeDirectory = "/home/xin";
|
||||
|
|
|
|||
|
|
@ -1,13 +1,17 @@
|
|||
{ config, pkgs, lib, ... }:
|
||||
{
|
||||
config,
|
||||
pkgs,
|
||||
lib,
|
||||
...
|
||||
}:
|
||||
|
||||
{
|
||||
imports =
|
||||
[
|
||||
# Include the results of the hardware scan.
|
||||
./hardware-configuration.nix
|
||||
./network.nix
|
||||
../sops.nix
|
||||
];
|
||||
imports = [
|
||||
# Include the results of the hardware scan.
|
||||
./hardware-configuration.nix
|
||||
./network.nix
|
||||
../sops.nix
|
||||
];
|
||||
|
||||
commonSettings = {
|
||||
auth.enable = true;
|
||||
|
|
@ -22,7 +26,11 @@
|
|||
boot.loader.efi.canTouchEfiVariables = true;
|
||||
boot.loader.efi.efiSysMountPoint = "/boot/efi";
|
||||
# boot.kernelPackages = pkgs.linuxPackages_latest;
|
||||
boot.kernelModules = [ "nvidia" "nvidia_modeset" "nvidia_uvm" ];
|
||||
boot.kernelModules = [
|
||||
"nvidia"
|
||||
"nvidia_modeset"
|
||||
"nvidia_uvm"
|
||||
];
|
||||
boot.supportedFilesystems = [ "ntfs" ];
|
||||
boot.binfmt.emulatedSystems = [ "aarch64-linux" ];
|
||||
|
||||
|
|
@ -45,7 +53,9 @@
|
|||
|
||||
programs.steam = {
|
||||
enable = true;
|
||||
gamescopeSession = { enable = true; };
|
||||
gamescopeSession = {
|
||||
enable = true;
|
||||
};
|
||||
};
|
||||
|
||||
programs.oidc-agent.enable = true;
|
||||
|
|
@ -93,7 +103,6 @@
|
|||
services.xserver.displayManager.gdm.enable = true;
|
||||
services.xserver.desktopManager.gnome.enable = true;
|
||||
|
||||
|
||||
# Configure keymap in X11
|
||||
services.xserver = {
|
||||
xkb.layout = "us";
|
||||
|
|
@ -135,7 +144,12 @@
|
|||
users.users.xin = {
|
||||
isNormalUser = true;
|
||||
description = "xin";
|
||||
extraGroups = [ "networkmanager" "wheel" "wireshark" "tss" ];
|
||||
extraGroups = [
|
||||
"networkmanager"
|
||||
"wheel"
|
||||
"wireshark"
|
||||
"tss"
|
||||
];
|
||||
};
|
||||
|
||||
services.kanidm = {
|
||||
|
|
@ -179,13 +193,14 @@
|
|||
# reference: https://nixos.wiki/wiki/Python
|
||||
(
|
||||
let
|
||||
my-python-packages = python-packages: with python-packages; [
|
||||
pandas
|
||||
requests
|
||||
numpy
|
||||
pyyaml
|
||||
setuptools
|
||||
];
|
||||
my-python-packages =
|
||||
python-packages: with python-packages; [
|
||||
pandas
|
||||
requests
|
||||
numpy
|
||||
pyyaml
|
||||
setuptools
|
||||
];
|
||||
python-with-my-packages = python3.withPackages my-python-packages;
|
||||
in
|
||||
python-with-my-packages
|
||||
|
|
@ -280,14 +295,19 @@
|
|||
acceleration = "cuda";
|
||||
};
|
||||
|
||||
|
||||
# MTP support
|
||||
services.gvfs.enable = true;
|
||||
|
||||
# Fonts
|
||||
fonts = {
|
||||
packages = with pkgs; [
|
||||
(nerdfonts.override { fonts = [ "FiraCode" ]; })
|
||||
(nerdfonts.override {
|
||||
fonts = [
|
||||
"FiraCode"
|
||||
"FiraMono"
|
||||
"JetBrainsMono"
|
||||
];
|
||||
})
|
||||
noto-fonts
|
||||
noto-fonts-emoji
|
||||
liberation_ttf
|
||||
|
|
@ -305,9 +325,19 @@
|
|||
];
|
||||
fontconfig = {
|
||||
defaultFonts = {
|
||||
serif = [ "Noto Serif CJK SC" "Ubuntu" ];
|
||||
sansSerif = [ "Noto Sans CJK SC" "Ubuntu" ];
|
||||
monospace = [ "FiraCode NerdFont Mono" "Noto Sans Mono CJK SC" "Ubuntu" ];
|
||||
serif = [
|
||||
"Noto Serif CJK SC"
|
||||
"Ubuntu"
|
||||
];
|
||||
sansSerif = [
|
||||
"Noto Sans CJK SC"
|
||||
"Ubuntu"
|
||||
];
|
||||
monospace = [
|
||||
"FiraCode NerdFont Mono"
|
||||
"Noto Sans Mono CJK SC"
|
||||
"Ubuntu"
|
||||
];
|
||||
};
|
||||
};
|
||||
enableDefaultPackages = true;
|
||||
|
|
|
|||
|
|
@ -1,14 +1,23 @@
|
|||
# Do not modify this file! It was generated by ‘nixos-generate-config’
|
||||
# and may be overwritten by future invocations. Please make changes
|
||||
# to /etc/nixos/configuration.nix instead.
|
||||
{ config, lib, pkgs, modulesPath, ... }:
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
pkgs,
|
||||
modulesPath,
|
||||
...
|
||||
}:
|
||||
|
||||
{
|
||||
imports =
|
||||
[ (modulesPath + "/installer/scan/not-detected.nix")
|
||||
];
|
||||
imports = [ (modulesPath + "/installer/scan/not-detected.nix") ];
|
||||
|
||||
boot.initrd.availableKernelModules = [ "xhci_pci" "nvme" "ahci" "usbhid" ];
|
||||
boot.initrd.availableKernelModules = [
|
||||
"xhci_pci"
|
||||
"nvme"
|
||||
"ahci"
|
||||
"usbhid"
|
||||
];
|
||||
boot.initrd.kernelModules = [ ];
|
||||
boot.initrd.luks.devices.cryptroot = {
|
||||
device = "/dev/disk/by-uuid/5a51f623-6fbd-4843-9f83-c895067e8e7d";
|
||||
|
|
@ -16,26 +25,29 @@
|
|||
boot.kernelModules = [ "kvm-amd" ];
|
||||
boot.extraModulePackages = [ ];
|
||||
|
||||
fileSystems."/" =
|
||||
{ # device = "/dev/disk/by-label/NIXROOT";
|
||||
device = "/dev/mapper/cryptroot";
|
||||
fsType = "btrfs";
|
||||
};
|
||||
fileSystems."/" = {
|
||||
# device = "/dev/disk/by-label/NIXROOT";
|
||||
device = "/dev/mapper/cryptroot";
|
||||
fsType = "btrfs";
|
||||
};
|
||||
|
||||
fileSystems."/boot/efi" =
|
||||
{ device = "/dev/disk/by-label/EFIBOOT";
|
||||
fsType = "vfat";
|
||||
};
|
||||
fileSystems."/boot/efi" = {
|
||||
device = "/dev/disk/by-label/EFIBOOT";
|
||||
fsType = "vfat";
|
||||
};
|
||||
|
||||
fileSystems."/media/data" =
|
||||
{ device = "/dev/nvme0n1p7";
|
||||
fsType = "ntfs-3g";
|
||||
options = [ "rw" "uid=1000" "nofail" "x-systemd.device-timeout=2" ];
|
||||
};
|
||||
|
||||
swapDevices =
|
||||
[ { device = "/dev/disk/by-label/NIXSWAP"; }
|
||||
fileSystems."/media/data" = {
|
||||
device = "/dev/nvme0n1p7";
|
||||
fsType = "ntfs-3g";
|
||||
options = [
|
||||
"rw"
|
||||
"uid=1000"
|
||||
"nofail"
|
||||
"x-systemd.device-timeout=2"
|
||||
];
|
||||
};
|
||||
|
||||
swapDevices = [ { device = "/dev/disk/by-label/NIXSWAP"; } ];
|
||||
|
||||
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
|
||||
# (the default) this is the recommended approach. When using systemd-networkd it's
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
{ config, pkgs, ...}:
|
||||
{ config, pkgs, ... }:
|
||||
|
||||
{
|
||||
imports = [ ];
|
||||
|
|
@ -10,6 +10,7 @@
|
|||
dns = "systemd-resolved";
|
||||
};
|
||||
};
|
||||
systemd.services.NetworkManager-wait-online.enable = false;
|
||||
|
||||
services.resolved = {
|
||||
enable = true;
|
||||
|
|
@ -37,10 +38,11 @@
|
|||
# Open ports in the firewall.
|
||||
networking.firewall.enable = true;
|
||||
networking.firewall.allowedTCPPorts = [ 3389 ];
|
||||
networking.firewall.allowedUDPPorts = [ 3389 41641 ];
|
||||
networking.firewall.trustedInterfaces = [
|
||||
"tailscale0"
|
||||
networking.firewall.allowedUDPPorts = [
|
||||
3389
|
||||
41641
|
||||
];
|
||||
networking.firewall.trustedInterfaces = [ "tailscale0" ];
|
||||
# Use nftables to manager firewall
|
||||
networking.nftables.enable = true;
|
||||
|
||||
|
|
|
|||
|
|
@ -1,30 +1,42 @@
|
|||
{ config, lib, pkgs, modulesPath, ... }:
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
pkgs,
|
||||
modulesPath,
|
||||
...
|
||||
}:
|
||||
let
|
||||
cfg = config.isBandwagon;
|
||||
in
|
||||
{
|
||||
imports = [ (modulesPath + "/profiles/qemu-guest.nix") ];
|
||||
|
||||
|
||||
options = {
|
||||
isBandwagon = lib.mkEnableOption "Bandwagon instance";
|
||||
};
|
||||
|
||||
config = lib.mkIf cfg {
|
||||
boot.initrd.availableKernelModules = [ "ata_piix" "xhci_pci" "virtio_pci" "virtio_scsi" "sd_mod" "sr_mod" ];
|
||||
boot.initrd.availableKernelModules = [
|
||||
"ata_piix"
|
||||
"xhci_pci"
|
||||
"virtio_pci"
|
||||
"virtio_scsi"
|
||||
"sd_mod"
|
||||
"sr_mod"
|
||||
];
|
||||
boot.initrd.kernelModules = [ ];
|
||||
boot.kernelModules = [ ];
|
||||
boot.extraModulePackages = [ ];
|
||||
|
||||
fileSystems."/" =
|
||||
{ device = "/dev/disk/by-label/NIXROOT";
|
||||
fsType = "xfs";
|
||||
};
|
||||
fileSystems."/" = {
|
||||
device = "/dev/disk/by-label/NIXROOT";
|
||||
fsType = "xfs";
|
||||
};
|
||||
|
||||
fileSystems."/boot" =
|
||||
{ device = "/dev/disk/by-label/NIXBOOT";
|
||||
fsType = "vfat";
|
||||
};
|
||||
fileSystems."/boot" = {
|
||||
device = "/dev/disk/by-label/NIXBOOT";
|
||||
fsType = "vfat";
|
||||
};
|
||||
|
||||
swapDevices = [ ];
|
||||
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
{ config, lib, ... }:
|
||||
let
|
||||
awsHosts = [ "tok-00"];
|
||||
awsHosts = [ "tok-00" ];
|
||||
bwgHosts = [ "la-00" ];
|
||||
in
|
||||
{
|
||||
|
|
@ -10,7 +10,6 @@ in
|
|||
./lightsail.nix
|
||||
];
|
||||
|
||||
|
||||
config = {
|
||||
isBandwagon = builtins.elem config.networking.hostName bwgHosts;
|
||||
isLightsail = builtins.elem config.networking.hostName awsHosts;
|
||||
|
|
@ -37,10 +36,18 @@ in
|
|||
acceptTerms = true;
|
||||
certs.${config.deployment.targetHost} = {
|
||||
email = "me@namely.icu";
|
||||
listenHTTP = ":80";
|
||||
# Avoid port conflict
|
||||
listenHTTP = if config.services.caddy.enable then ":30310" else ":80";
|
||||
};
|
||||
};
|
||||
networking.firewall.allowedTCPPorts = [ 80 8080 ];
|
||||
services.caddy.virtualHosts."http://${config.deployment.targetHost}:80".extraConfig = ''
|
||||
reverse_proxy 127.0.0.1:30310
|
||||
'';
|
||||
|
||||
networking.firewall.allowedTCPPorts = [
|
||||
80
|
||||
8080
|
||||
];
|
||||
networking.firewall.allowedUDPPorts = [ ] ++ (lib.range 6311 6314);
|
||||
|
||||
custom.prometheus = {
|
||||
|
|
@ -75,119 +82,129 @@ in
|
|||
wheelNeedsPassword = false;
|
||||
};
|
||||
|
||||
services.sing-box = let
|
||||
singTls = {
|
||||
enabled = true;
|
||||
server_name = config.deployment.targetHost;
|
||||
key_path = config.security.acme.certs.${config.deployment.targetHost}.directory + "/key.pem";
|
||||
certificate_path = config.security.acme.certs.${config.deployment.targetHost}.directory + "/cert.pem";
|
||||
};
|
||||
password = {
|
||||
_secret = config.sops.secrets.singbox_password.path;
|
||||
};
|
||||
uuid = {
|
||||
_secret = config.sops.secrets.singbox_uuid.path;
|
||||
};
|
||||
in
|
||||
{
|
||||
enable = true;
|
||||
settings = {
|
||||
dns = {
|
||||
servers = [
|
||||
{
|
||||
tag = "warp";
|
||||
address = "1.1.1.1";
|
||||
detour = "wg-out";
|
||||
}
|
||||
{
|
||||
tag = "directdns";
|
||||
address = "h3://8.8.8.8/dns-query";
|
||||
}
|
||||
];
|
||||
rules = [
|
||||
{
|
||||
outbound = "wg-out";
|
||||
server = "warp";
|
||||
}
|
||||
{
|
||||
outbound = "direct";
|
||||
server = "directdns";
|
||||
}
|
||||
];
|
||||
services.sing-box =
|
||||
let
|
||||
singTls = {
|
||||
enabled = true;
|
||||
server_name = config.deployment.targetHost;
|
||||
key_path = config.security.acme.certs.${config.deployment.targetHost}.directory + "/key.pem";
|
||||
certificate_path =
|
||||
config.security.acme.certs.${config.deployment.targetHost}.directory + "/cert.pem";
|
||||
};
|
||||
inbounds = [
|
||||
{
|
||||
tag = "sg0";
|
||||
type = "trojan";
|
||||
listen = "::";
|
||||
listen_port = 8080;
|
||||
users = [
|
||||
{ name = "proxy";
|
||||
password = password;
|
||||
password = {
|
||||
_secret = config.sops.secrets.singbox_password.path;
|
||||
};
|
||||
uuid = {
|
||||
_secret = config.sops.secrets.singbox_uuid.path;
|
||||
};
|
||||
in
|
||||
{
|
||||
enable = true;
|
||||
settings = {
|
||||
dns = {
|
||||
servers = [
|
||||
{
|
||||
tag = "warp";
|
||||
address = "1.1.1.1";
|
||||
detour = "wg-out";
|
||||
}
|
||||
{
|
||||
tag = "directdns";
|
||||
address = "h3://8.8.8.8/dns-query";
|
||||
}
|
||||
];
|
||||
tls = singTls;
|
||||
}
|
||||
] ++ lib.forEach (lib.range 6311 6314) (port: {
|
||||
tag = "sg" + toString (port - 6310);
|
||||
type = "tuic";
|
||||
listen = "::";
|
||||
listen_port = port;
|
||||
congestion_control = "bbr";
|
||||
users = [
|
||||
{ name = "proxy";
|
||||
uuid = uuid;
|
||||
password = password;
|
||||
rules = [
|
||||
{
|
||||
outbound = "wg-out";
|
||||
server = "warp";
|
||||
}
|
||||
{
|
||||
outbound = "direct";
|
||||
server = "directdns";
|
||||
}
|
||||
];
|
||||
tls = singTls;
|
||||
});
|
||||
outbounds = [
|
||||
{
|
||||
type = "wireguard";
|
||||
tag = "wg-out";
|
||||
private_key = {
|
||||
_secret = config.sops.secrets.wg_private_key.path;
|
||||
};
|
||||
local_address = [
|
||||
"172.16.0.2/32"
|
||||
{ _secret = config.sops.secrets.wg_ipv6_local_addr.path; }
|
||||
];
|
||||
peers = [
|
||||
{ public_key= "bmXOC+F1FxEMF9dyiK2H5/1SUtzH0JuVo51h2wPfgyo=";
|
||||
allowed_ips = [ "0.0.0.0/0" "::/0" ];
|
||||
server = "162.159.192.1";
|
||||
server_port = 500;
|
||||
};
|
||||
inbounds =
|
||||
[
|
||||
{
|
||||
tag = "sg0";
|
||||
type = "trojan";
|
||||
listen = "::";
|
||||
listen_port = 8080;
|
||||
users = [
|
||||
{
|
||||
name = "proxy";
|
||||
password = password;
|
||||
}
|
||||
];
|
||||
tls = singTls;
|
||||
}
|
||||
];
|
||||
}
|
||||
{
|
||||
type = "direct";
|
||||
tag = "direct";
|
||||
}
|
||||
{
|
||||
type = "dns";
|
||||
tag = "dns-out";
|
||||
}
|
||||
];
|
||||
route = {
|
||||
rules = [
|
||||
]
|
||||
++ lib.forEach (lib.range 6311 6314) (port: {
|
||||
tag = "sg" + toString (port - 6310);
|
||||
type = "tuic";
|
||||
listen = "::";
|
||||
listen_port = port;
|
||||
congestion_control = "bbr";
|
||||
users = [
|
||||
{
|
||||
name = "proxy";
|
||||
uuid = uuid;
|
||||
password = password;
|
||||
}
|
||||
];
|
||||
tls = singTls;
|
||||
});
|
||||
outbounds = [
|
||||
{
|
||||
outbound = "dns-out";
|
||||
protocol = "dns";
|
||||
type = "wireguard";
|
||||
tag = "wg-out";
|
||||
private_key = {
|
||||
_secret = config.sops.secrets.wg_private_key.path;
|
||||
};
|
||||
local_address = [
|
||||
"172.16.0.2/32"
|
||||
{ _secret = config.sops.secrets.wg_ipv6_local_addr.path; }
|
||||
];
|
||||
peers = [
|
||||
{
|
||||
public_key = "bmXOC+F1FxEMF9dyiK2H5/1SUtzH0JuVo51h2wPfgyo=";
|
||||
allowed_ips = [
|
||||
"0.0.0.0/0"
|
||||
"::/0"
|
||||
];
|
||||
server = "162.159.192.1";
|
||||
server_port = 500;
|
||||
}
|
||||
];
|
||||
}
|
||||
{
|
||||
inbound = "sg0";
|
||||
outbound = "direct";
|
||||
type = "direct";
|
||||
tag = "direct";
|
||||
}
|
||||
{
|
||||
inbound = "sg4";
|
||||
outbound = "direct";
|
||||
type = "dns";
|
||||
tag = "dns-out";
|
||||
}
|
||||
];
|
||||
route = {
|
||||
rules = [
|
||||
{
|
||||
outbound = "dns-out";
|
||||
protocol = "dns";
|
||||
}
|
||||
{
|
||||
inbound = "sg0";
|
||||
outbound = "direct";
|
||||
}
|
||||
{
|
||||
inbound = "sg4";
|
||||
outbound = "direct";
|
||||
}
|
||||
];
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,4 +1,10 @@
|
|||
{ config, lib, pkgs, modulesPath, ... }:
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
pkgs,
|
||||
modulesPath,
|
||||
...
|
||||
}:
|
||||
with lib;
|
||||
let
|
||||
cfg = config.ec2;
|
||||
|
|
@ -39,18 +45,22 @@ in
|
|||
fsType = "vfat";
|
||||
};
|
||||
|
||||
boot.extraModulePackages = [
|
||||
config.boot.kernelPackages.ena
|
||||
];
|
||||
boot.extraModulePackages = [ config.boot.kernelPackages.ena ];
|
||||
boot.initrd.kernelModules = [ "xen-blkfront" ];
|
||||
boot.initrd.availableKernelModules = [ "nvme" ];
|
||||
boot.kernelParams = [ "console=ttyS0,115200n8" "random.trust_cpu=on" ];
|
||||
boot.kernelParams = [
|
||||
"console=ttyS0,115200n8"
|
||||
"random.trust_cpu=on"
|
||||
];
|
||||
|
||||
# Prevent the nouveau kernel module from being loaded, as it
|
||||
# interferes with the nvidia/nvidia-uvm modules needed for CUDA.
|
||||
# Also blacklist xen_fbfront to prevent a 30 second delay during
|
||||
# boot.
|
||||
boot.blacklistedKernelModules = [ "nouveau" "xen_fbfront" ];
|
||||
boot.blacklistedKernelModules = [
|
||||
"nouveau"
|
||||
"xen_fbfront"
|
||||
];
|
||||
|
||||
boot.loader.grub.efiSupport = cfg.efi;
|
||||
boot.loader.grub.efiInstallAsRemovable = cfg.efi;
|
||||
|
|
@ -64,7 +74,7 @@ in
|
|||
systemd.services.fetch-ec2-metadata = {
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
wants = [ "network-online.target" ];
|
||||
after = ["network-online.target"];
|
||||
after = [ "network-online.target" ];
|
||||
path = [ pkgs.curl ];
|
||||
script = builtins.readFile ./ec2-metadata-fetcher.sh;
|
||||
serviceConfig.Type = "oneshot";
|
||||
|
|
|
|||
|
|
@ -1,4 +1,10 @@
|
|||
{ inputs, config, libs, pkgs, ... }:
|
||||
{
|
||||
inputs,
|
||||
config,
|
||||
libs,
|
||||
pkgs,
|
||||
...
|
||||
}:
|
||||
|
||||
{
|
||||
imports = [
|
||||
|
|
|
|||
|
|
@ -5,9 +5,19 @@
|
|||
efiSupport = true;
|
||||
device = "nodev";
|
||||
};
|
||||
fileSystems."/boot" = { device = "/dev/disk/by-uuid/AC27-D9D6"; fsType = "vfat"; };
|
||||
boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "xen_blkfront" ];
|
||||
fileSystems."/boot" = {
|
||||
device = "/dev/disk/by-uuid/AC27-D9D6";
|
||||
fsType = "vfat";
|
||||
};
|
||||
boot.initrd.availableKernelModules = [
|
||||
"ata_piix"
|
||||
"uhci_hcd"
|
||||
"xen_blkfront"
|
||||
];
|
||||
boot.initrd.kernelModules = [ "nvme" ];
|
||||
fileSystems."/" = { device = "/dev/sda1"; fsType = "ext4"; };
|
||||
fileSystems."/" = {
|
||||
device = "/dev/sda1";
|
||||
fsType = "ext4";
|
||||
};
|
||||
|
||||
}
|
||||
|
|
|
|||
|
|
@ -21,7 +21,11 @@
|
|||
members = [ "xin" ];
|
||||
};
|
||||
immich-users = {
|
||||
members = [ "xin" "zhuo" "ycm" ];
|
||||
members = [
|
||||
"xin"
|
||||
"zhuo"
|
||||
"ycm"
|
||||
];
|
||||
};
|
||||
grafana-superadmins = {
|
||||
members = [ "xin" ];
|
||||
|
|
@ -65,7 +69,12 @@
|
|||
originLanding = "https://git.xinyang.life/user/oauth2/kandim";
|
||||
allowInsecureClientDisablePkce = true;
|
||||
scopeMaps = {
|
||||
forgejo-access = [ "openid" "email" "profile" "groups" ];
|
||||
forgejo-access = [
|
||||
"openid"
|
||||
"email"
|
||||
"profile"
|
||||
"groups"
|
||||
];
|
||||
};
|
||||
claimMaps = {
|
||||
forgejo_role = {
|
||||
|
|
@ -83,7 +92,12 @@
|
|||
originLanding = "https://xinyang.life/";
|
||||
allowInsecureClientDisablePkce = true;
|
||||
scopeMaps = {
|
||||
gts-users = [ "openid" "email" "profile" "groups" ];
|
||||
gts-users = [
|
||||
"openid"
|
||||
"email"
|
||||
"profile"
|
||||
"groups"
|
||||
];
|
||||
};
|
||||
};
|
||||
owncloud = {
|
||||
|
|
@ -92,7 +106,11 @@
|
|||
originLanding = "https://home.xinyang.life:9201/";
|
||||
public = true;
|
||||
scopeMaps = {
|
||||
ocis-users = [ "openid" "email" "profile" ];
|
||||
ocis-users = [
|
||||
"openid"
|
||||
"email"
|
||||
"profile"
|
||||
];
|
||||
};
|
||||
};
|
||||
hedgedoc = {
|
||||
|
|
@ -101,7 +119,11 @@
|
|||
originLanding = "https://docs.xinyang.life/auth/oauth2";
|
||||
allowInsecureClientDisablePkce = true;
|
||||
scopeMaps = {
|
||||
hedgedoc-users = [ "openid" "email" "profile" ];
|
||||
hedgedoc-users = [
|
||||
"openid"
|
||||
"email"
|
||||
"profile"
|
||||
];
|
||||
};
|
||||
};
|
||||
immich-mobile = {
|
||||
|
|
@ -110,7 +132,11 @@
|
|||
originLanding = "https://immich.xinyang.life:8000/api/oauth/mobile-redirect/";
|
||||
allowInsecureClientDisablePkce = true;
|
||||
scopeMaps = {
|
||||
immich-users = [ "openid" "email" "profile" ];
|
||||
immich-users = [
|
||||
"openid"
|
||||
"email"
|
||||
"profile"
|
||||
];
|
||||
};
|
||||
};
|
||||
miniflux = {
|
||||
|
|
@ -118,7 +144,11 @@
|
|||
originUrl = "https://rss.xinyang.life/";
|
||||
originLanding = "https://rss.xinyang.life/";
|
||||
scopeMaps = {
|
||||
miniflux-users = [ "openid" "email" "profile" ];
|
||||
miniflux-users = [
|
||||
"openid"
|
||||
"email"
|
||||
"profile"
|
||||
];
|
||||
};
|
||||
};
|
||||
grafana = {
|
||||
|
|
@ -126,7 +156,12 @@
|
|||
originUrl = "https://grafana.xinyang.life/";
|
||||
originLanding = "https://grafana.xinyang.life/";
|
||||
scopeMaps = {
|
||||
grafana-users = [ "openid" "email" "profile" "groups" ];
|
||||
grafana-users = [
|
||||
"openid"
|
||||
"email"
|
||||
"profile"
|
||||
"groups"
|
||||
];
|
||||
};
|
||||
claimMaps = {
|
||||
grafana_role = {
|
||||
|
|
|
|||
|
|
@ -1,11 +1,14 @@
|
|||
{ pkgs, ... }: {
|
||||
{ pkgs, ... }:
|
||||
{
|
||||
networking = {
|
||||
interfaces = {
|
||||
eth0.useDHCP = true;
|
||||
eth0.ipv6.addresses = [{
|
||||
address = "2a01:4f8:c17:345f::1";
|
||||
prefixLength = 64;
|
||||
}];
|
||||
eth0.ipv6.addresses = [
|
||||
{
|
||||
address = "2a01:4f8:c17:345f::1";
|
||||
prefixLength = 64;
|
||||
}
|
||||
];
|
||||
};
|
||||
defaultGateway6 = {
|
||||
address = "fe80::1";
|
||||
|
|
|
|||
|
|
@ -1,10 +1,24 @@
|
|||
{ config, pkgs, lib, ... }:
|
||||
{
|
||||
config,
|
||||
pkgs,
|
||||
lib,
|
||||
...
|
||||
}:
|
||||
let
|
||||
kanidm_listen_port = 5324;
|
||||
in
|
||||
{
|
||||
networking.firewall.allowedTCPPorts = [ 80 443 2222 8448 ];
|
||||
networking.firewall.allowedUDPPorts = [ 80 443 8448 ];
|
||||
networking.firewall.allowedTCPPorts = [
|
||||
80
|
||||
443
|
||||
2222
|
||||
8448
|
||||
];
|
||||
networking.firewall.allowedUDPPorts = [
|
||||
80
|
||||
443
|
||||
8448
|
||||
];
|
||||
|
||||
custom.vaultwarden = {
|
||||
enable = true;
|
||||
|
|
@ -32,16 +46,23 @@ in
|
|||
exporters.miniflux.enable = true;
|
||||
};
|
||||
|
||||
systemd.mounts = map
|
||||
(share: {
|
||||
what = "//u380335-sub1.your-storagebox.de/u380335-sub1/${share}";
|
||||
where = "/mnt/storage/${share}";
|
||||
type = "cifs";
|
||||
options = "rw,uid=${share},gid=${share},credentials=${config.sops.secrets.storage_box_mount.path},_netdev,fsc";
|
||||
before = [ "${share}.service" ];
|
||||
after = [ "cachefilesd.service" ];
|
||||
wantedBy = [ "${share}.service" ];
|
||||
}) [ "forgejo" "gotosocial" "conduit" "hedgedoc" ];
|
||||
systemd.mounts =
|
||||
map
|
||||
(share: {
|
||||
what = "//u380335-sub1.your-storagebox.de/u380335-sub1/${share}";
|
||||
where = "/mnt/storage/${share}";
|
||||
type = "cifs";
|
||||
options = "rw,uid=${share},gid=${share},credentials=${config.sops.secrets.storage_box_mount.path},_netdev,fsc";
|
||||
before = [ "${share}.service" ];
|
||||
after = [ "cachefilesd.service" ];
|
||||
wantedBy = [ "${share}.service" ];
|
||||
})
|
||||
[
|
||||
"forgejo"
|
||||
"gotosocial"
|
||||
"conduit"
|
||||
"hedgedoc"
|
||||
];
|
||||
|
||||
services.cachefilesd.enable = true;
|
||||
|
||||
|
|
@ -82,6 +103,7 @@ in
|
|||
bindaddress = "[::]:${toString kanidm_listen_port}";
|
||||
tls_key = ''${config.security.acme.certs."auth.xinyang.life".directory}/key.pem'';
|
||||
tls_chain = ''${config.security.acme.certs."auth.xinyang.life".directory}/fullchain.pem'';
|
||||
online_backup.versions = 7;
|
||||
# db_path = "/var/lib/kanidm/kanidm.db";
|
||||
};
|
||||
provision = import ./kanidm-provision.nix;
|
||||
|
|
@ -224,11 +246,14 @@ in
|
|||
allow_assign_grafana_admin = true;
|
||||
auto_login = true;
|
||||
};
|
||||
"auth" = { disable_login_form = true; };
|
||||
"auth" = {
|
||||
disable_login_form = true;
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
systemd.services.grafana.serviceConfig.EnvironmentFile = config.sops.secrets.grafana_oauth_secret.path;
|
||||
systemd.services.grafana.serviceConfig.EnvironmentFile =
|
||||
config.sops.secrets.grafana_oauth_secret.path;
|
||||
|
||||
users.users.git = {
|
||||
isSystemUser = true;
|
||||
|
|
@ -239,9 +264,7 @@ in
|
|||
users.groups.git = { };
|
||||
|
||||
users.users = {
|
||||
${config.services.caddy.user}.extraGroups = [
|
||||
config.services.ntfy-sh.group
|
||||
];
|
||||
${config.services.caddy.user}.extraGroups = [ config.services.ntfy-sh.group ];
|
||||
};
|
||||
|
||||
services.caddy = {
|
||||
|
|
|
|||
|
|
@ -1,17 +1,19 @@
|
|||
{ config, lib, pkgs, ... }:
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
pkgs,
|
||||
...
|
||||
}:
|
||||
|
||||
{
|
||||
imports = [
|
||||
./hass.nix
|
||||
];
|
||||
imports = [ ./hass.nix ];
|
||||
|
||||
commonSettings.nix.enableMirrors = true;
|
||||
|
||||
nixpkgs.overlays = [
|
||||
# Workaround https://github.com/NixOS/nixpkgs/issues/126755#issuecomment-869149243
|
||||
(final: super: {
|
||||
makeModulesClosure = x:
|
||||
super.makeModulesClosure (x // { allowMissing = true; });
|
||||
makeModulesClosure = x: super.makeModulesClosure (x // { allowMissing = true; });
|
||||
})
|
||||
];
|
||||
|
||||
|
|
|
|||
|
|
@ -1,4 +1,5 @@
|
|||
{ config, pkgs, ... }: {
|
||||
{ config, pkgs, ... }:
|
||||
{
|
||||
services.home-assistant = {
|
||||
enable = true;
|
||||
extraComponents = [
|
||||
|
|
@ -9,14 +10,12 @@
|
|||
];
|
||||
openFirewall = false;
|
||||
config = {
|
||||
default_config = {};
|
||||
default_config = { };
|
||||
http = {
|
||||
server_host = "::1";
|
||||
base_url = "raspite.local:1000";
|
||||
use_x_forward_for = true;
|
||||
trusted_proxies = [
|
||||
"::1"
|
||||
];
|
||||
trusted_proxies = [ "::1" ];
|
||||
};
|
||||
};
|
||||
};
|
||||
|
|
@ -28,16 +27,17 @@
|
|||
|
||||
users.groups.dialout.members = config.users.groups.wheel.members;
|
||||
|
||||
environment.systemPackages = with pkgs; [
|
||||
zigbee2mqtt
|
||||
];
|
||||
environment.systemPackages = with pkgs; [ zigbee2mqtt ];
|
||||
|
||||
networking.firewall.allowedTCPPorts = [ 1000 1001 ];
|
||||
networking.firewall.allowedTCPPorts = [
|
||||
1000
|
||||
1001
|
||||
];
|
||||
|
||||
services.caddy = {
|
||||
enable = true;
|
||||
virtualHosts = {
|
||||
# reverse_proxy ${config.services.home-assistant.config.http.server_host}:${toString config.services.home-assistant.config.http.server_port}
|
||||
# reverse_proxy ${config.services.home-assistant.config.http.server_host}:${toString config.services.home-assistant.config.http.server_port}
|
||||
"raspite.local:1000".extraConfig = ''
|
||||
reverse_proxy http://[::1]:8123
|
||||
'';
|
||||
|
|
|
|||
|
|
@ -1,4 +1,9 @@
|
|||
{ inputs, config, lib, ... }:
|
||||
{
|
||||
inputs,
|
||||
config,
|
||||
lib,
|
||||
...
|
||||
}:
|
||||
{
|
||||
imports = [ inputs.sops-nix.nixosModules.sops ];
|
||||
config = {
|
||||
|
|
@ -11,24 +16,22 @@
|
|||
owner = "root";
|
||||
};
|
||||
singbox_sg_server = {
|
||||
owner = "root";
|
||||
owner = "root";
|
||||
};
|
||||
singbox_jp_server = {
|
||||
owner = "root";
|
||||
owner = "root";
|
||||
};
|
||||
singbox_password = {
|
||||
owner = "root";
|
||||
owner = "root";
|
||||
};
|
||||
singbox_uuid = {
|
||||
owner = "root";
|
||||
owner = "root";
|
||||
};
|
||||
private_dns_address = {
|
||||
owner = "root";
|
||||
owner = "root";
|
||||
};
|
||||
};
|
||||
secrets.grafana_cloud_api = lib.mkIf config.services.prometheus.enable {
|
||||
owner = "prometheus";
|
||||
};
|
||||
secrets.grafana_cloud_api = lib.mkIf config.services.prometheus.enable { owner = "prometheus"; };
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,4 +1,11 @@
|
|||
{ inputs, config, pkgs, lib, modulesPath, ... }:
|
||||
{
|
||||
inputs,
|
||||
config,
|
||||
pkgs,
|
||||
lib,
|
||||
modulesPath,
|
||||
...
|
||||
}:
|
||||
|
||||
with lib;
|
||||
|
||||
|
|
@ -19,17 +26,21 @@ with lib;
|
|||
};
|
||||
|
||||
boot = {
|
||||
loader = {
|
||||
loader = {
|
||||
systemd-boot.enable = true;
|
||||
efi.canTouchEfiVariables = true;
|
||||
};
|
||||
initrd.availableKernelModules = [ "uhci_hcd" "ehci_pci" "ahci" "usb_storage" "sd_mod" ];
|
||||
initrd.availableKernelModules = [
|
||||
"uhci_hcd"
|
||||
"ehci_pci"
|
||||
"ahci"
|
||||
"usb_storage"
|
||||
"sd_mod"
|
||||
];
|
||||
kernelModules = [ "kvm-intel" ];
|
||||
};
|
||||
|
||||
environment.systemPackages = [
|
||||
pkgs.virtiofsd
|
||||
];
|
||||
environment.systemPackages = [ pkgs.virtiofsd ];
|
||||
|
||||
sops = {
|
||||
defaultSopsFile = ./secrets.yaml;
|
||||
|
|
@ -47,13 +58,15 @@ with lib;
|
|||
};
|
||||
|
||||
systemd.mounts = [
|
||||
{ what = "immich";
|
||||
{
|
||||
what = "immich";
|
||||
where = "/mnt/XinPhotos/immich";
|
||||
type = "virtiofs";
|
||||
options = "rw";
|
||||
wantedBy = [ "immich-server.service" ];
|
||||
}
|
||||
{ what = "originals";
|
||||
{
|
||||
what = "originals";
|
||||
where = "/mnt/XinPhotos/originals";
|
||||
type = "virtiofs";
|
||||
options = "ro,nodev,nosuid";
|
||||
|
|
@ -61,7 +74,10 @@ with lib;
|
|||
}
|
||||
];
|
||||
|
||||
services.openssh.ports = [ 22 2222 ];
|
||||
services.openssh.ports = [
|
||||
22
|
||||
2222
|
||||
];
|
||||
|
||||
services.immich = {
|
||||
enable = true;
|
||||
|
|
@ -90,7 +106,10 @@ with lib;
|
|||
enable = true;
|
||||
package = pkgs.caddy.withPlugins {
|
||||
caddyModules = [
|
||||
{ repo = "github.com/caddy-dns/cloudflare"; version = "89f16b99c18ef49c8bb470a82f895bce01cbaece"; }
|
||||
{
|
||||
repo = "github.com/caddy-dns/cloudflare";
|
||||
version = "89f16b99c18ef49c8bb470a82f895bce01cbaece";
|
||||
}
|
||||
];
|
||||
vendorHash = "sha256-fTcMtg5GGEgclIwJCav0jjWpqT+nKw2OF1Ow0MEEitk=";
|
||||
};
|
||||
|
|
@ -124,7 +143,10 @@ with lib;
|
|||
fileSystems."/boot" = {
|
||||
device = "/dev/sda1";
|
||||
fsType = "vfat";
|
||||
options = [ "fmask=0022" "dmask=0022" ];
|
||||
options = [
|
||||
"fmask=0022"
|
||||
"dmask=0022"
|
||||
];
|
||||
};
|
||||
|
||||
system.stateVersion = "24.11";
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
{ config, pkgs, lib, ... }:
|
||||
{ config, lib, ... }:
|
||||
with lib;
|
||||
|
||||
let
|
||||
|
|
@ -25,6 +25,7 @@ in
|
|||
window = {
|
||||
resize_increments = true;
|
||||
dynamic_padding = true;
|
||||
decorations = "none";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
|
|
|||
19
modules/home-manager/cosmic-term.nix
Normal file
19
modules/home-manager/cosmic-term.nix
Normal file
|
|
@ -0,0 +1,19 @@
|
|||
{
|
||||
config,
|
||||
pkgs,
|
||||
lib,
|
||||
...
|
||||
}:
|
||||
|
||||
let
|
||||
inherit (lib) mkEnableOption mkIf;
|
||||
|
||||
cfg = config.custom-hm.cosmic-term;
|
||||
in
|
||||
{
|
||||
options.custom-hm.cosmic-term = {
|
||||
enable = mkEnableOption "cosmic-term";
|
||||
};
|
||||
|
||||
config = mkIf cfg.enable { home.packages = [ pkgs.cosmic-term ]; };
|
||||
}
|
||||
|
|
@ -1,6 +1,7 @@
|
|||
{
|
||||
imports = [
|
||||
./alacritty.nix
|
||||
./cosmic-term.nix
|
||||
./direnv.nix
|
||||
./fish.nix
|
||||
./git.nix
|
||||
|
|
|
|||
|
|
@ -24,6 +24,7 @@ in
|
|||
direnv = {
|
||||
enable = true;
|
||||
stdlib = changeCacheDir;
|
||||
nix-direnv.enable = true;
|
||||
};
|
||||
};
|
||||
};
|
||||
|
|
|
|||
|
|
@ -1,4 +1,9 @@
|
|||
{ config, pkgs, lib, ... }:
|
||||
{
|
||||
config,
|
||||
pkgs,
|
||||
lib,
|
||||
...
|
||||
}:
|
||||
|
||||
with lib;
|
||||
|
||||
|
|
@ -10,7 +15,12 @@ in
|
|||
enable = mkEnableOption "fish";
|
||||
plugins = mkOption {
|
||||
type = types.listOf types.str;
|
||||
default = [ "pisces" "done" "hydro" "grc" ];
|
||||
default = [
|
||||
"pisces"
|
||||
"done"
|
||||
"hydro"
|
||||
"grc"
|
||||
];
|
||||
};
|
||||
functions = {
|
||||
enable = mkOption {
|
||||
|
|
@ -30,40 +40,65 @@ in
|
|||
home.packages = [ pkgs.grc ];
|
||||
programs.fish = {
|
||||
enable = true;
|
||||
plugins = with pkgs; (filter (
|
||||
e: hasAttr e.name (builtins.listToAttrs # { "xxx" = true; }
|
||||
(map (p: { name = p; value = true; }) cfg.plugins) # { name = "xxx"; value = true; }
|
||||
)) [
|
||||
{ name = "pisces";
|
||||
src = fishPlugins.pisces.src;
|
||||
}
|
||||
{ name = "done";
|
||||
src = fishPlugins.done.src;
|
||||
}
|
||||
{ name = "hydro";
|
||||
src = fishPlugins.hydro.src;
|
||||
}
|
||||
{ name = "grc";
|
||||
src = fishPlugins.grc.src;
|
||||
}
|
||||
]);
|
||||
interactiveShellInit = let
|
||||
extraInit = if cfg.functions.enable then ''
|
||||
${pkgs.nix-your-shell}/bin/nix-your-shell fish | source
|
||||
function fish_right_prompt
|
||||
if test -n "$IN_NIX_SHELL"
|
||||
echo -n "<nix-shell>"
|
||||
else if test $SHLVL -ge 3
|
||||
echo -n "<🚀lv$SHLVL>"
|
||||
end
|
||||
end
|
||||
function fish_command_not_found
|
||||
${pkgs.comma}/bin/comma $argv
|
||||
end
|
||||
'' else "";
|
||||
in ''
|
||||
fish_config prompt choose arrow
|
||||
'' + extraInit;
|
||||
plugins =
|
||||
with pkgs;
|
||||
(filter
|
||||
(
|
||||
e:
|
||||
hasAttr e.name (
|
||||
builtins.listToAttrs # { "xxx" = true; }
|
||||
(
|
||||
map (p: {
|
||||
name = p;
|
||||
value = true;
|
||||
}) cfg.plugins
|
||||
) # { name = "xxx"; value = true; }
|
||||
)
|
||||
)
|
||||
[
|
||||
{
|
||||
name = "pisces";
|
||||
src = fishPlugins.pisces.src;
|
||||
}
|
||||
{
|
||||
name = "done";
|
||||
src = fishPlugins.done.src;
|
||||
}
|
||||
{
|
||||
name = "hydro";
|
||||
src = fishPlugins.hydro.src;
|
||||
}
|
||||
{
|
||||
name = "grc";
|
||||
src = fishPlugins.grc.src;
|
||||
}
|
||||
]
|
||||
);
|
||||
interactiveShellInit =
|
||||
let
|
||||
extraInit =
|
||||
if cfg.functions.enable then
|
||||
''
|
||||
${pkgs.nix-your-shell}/bin/nix-your-shell fish | source
|
||||
function fish_right_prompt
|
||||
if test -n "$IN_NIX_SHELL"
|
||||
echo -n "<nix-shell>"
|
||||
else if test $SHLVL -ge 3
|
||||
echo -n "<🚀lv$SHLVL>"
|
||||
end
|
||||
end
|
||||
function fish_command_not_found
|
||||
${pkgs.comma}/bin/comma $argv
|
||||
end
|
||||
set -gx LS_COLORS (${lib.getExe pkgs.vivid} generate catppuccin-mocha)
|
||||
''
|
||||
else
|
||||
"";
|
||||
in
|
||||
''
|
||||
fish_config prompt choose default
|
||||
''
|
||||
+ extraInit;
|
||||
functions = mkIf cfg.functions.enable {
|
||||
gitignore = "curl -sL https://www.gitignore.io/api/$argv";
|
||||
};
|
||||
|
|
|
|||
|
|
@ -1,4 +1,9 @@
|
|||
{ config, pkgs, lib, ... }:
|
||||
{
|
||||
config,
|
||||
pkgs,
|
||||
lib,
|
||||
...
|
||||
}:
|
||||
|
||||
with lib;
|
||||
|
||||
|
|
@ -36,12 +41,8 @@ in
|
|||
signByDefault = true;
|
||||
key = cfg.signing.keyFile;
|
||||
};
|
||||
extraConfig.user = mkIf cfg.signing.enable {
|
||||
signingkey = cfg.signing.keyFile;
|
||||
};
|
||||
extraConfig.gpg = mkIf cfg.signing.enable {
|
||||
format = "ssh";
|
||||
};
|
||||
extraConfig.user = mkIf cfg.signing.enable { signingkey = cfg.signing.keyFile; };
|
||||
extraConfig.gpg = mkIf cfg.signing.enable { format = "ssh"; };
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1 +1 @@
|
|||
{}
|
||||
{ }
|
||||
|
|
|
|||
|
|
@ -1,4 +1,9 @@
|
|||
{ config, pkgs, lib, ... }:
|
||||
{
|
||||
config,
|
||||
pkgs,
|
||||
lib,
|
||||
...
|
||||
}:
|
||||
let
|
||||
inherit (lib) mkIf mkEnableOption getExe;
|
||||
cfg = config.custom-hm.neovim;
|
||||
|
|
@ -13,7 +18,10 @@ in
|
|||
enable = mkEnableOption "neovim configurations";
|
||||
};
|
||||
config = mkIf cfg.enable {
|
||||
home.packages = with pkgs; [ nixvim neovide ];
|
||||
home.packages = with pkgs; [
|
||||
nixvim
|
||||
neovide
|
||||
];
|
||||
programs.neovim.enable = false;
|
||||
home.file.".config/neovide/config.toml" = {
|
||||
source = tomlFormat.generate "neovide-config" neovideConfig;
|
||||
|
|
|
|||
|
|
@ -1,4 +1,10 @@
|
|||
{ inputs, config, lib, pkgs, ... }:
|
||||
{
|
||||
inputs,
|
||||
config,
|
||||
lib,
|
||||
pkgs,
|
||||
...
|
||||
}:
|
||||
with lib;
|
||||
|
||||
let
|
||||
|
|
@ -6,7 +12,10 @@ let
|
|||
|
||||
packages = {
|
||||
nixPackages = {
|
||||
systemPackages = with pkgs; [ nixd nixpkgs-fmt ];
|
||||
systemPackages = with pkgs; [
|
||||
nixd
|
||||
nixpkgs-fmt
|
||||
];
|
||||
extension = with inputs.nix-vscode-extensions.extensions.${pkgs.system}.vscode-marketplace; [
|
||||
jnoortheen.nix-ide
|
||||
];
|
||||
|
|
@ -17,10 +26,15 @@ let
|
|||
};
|
||||
};
|
||||
cxxPackages = {
|
||||
systemPackages = with pkgs; [ clang-tools cmake-format ];
|
||||
systemPackages = with pkgs; [
|
||||
clang-tools
|
||||
cmake-format
|
||||
];
|
||||
extension = with inputs.nix-vscode-extensions.extensions.${pkgs.system}.vscode-marketplace; [
|
||||
llvm-vs-code-extensions.vscode-clangd
|
||||
(ms-vscode.cmake-tools.overrideAttrs (_: { sourceRoot = "extension"; }))
|
||||
(ms-vscode.cmake-tools.overrideAttrs (_: {
|
||||
sourceRoot = "extension";
|
||||
}))
|
||||
twxs.cmake
|
||||
ms-vscode.cpptools
|
||||
];
|
||||
|
|
@ -43,7 +57,10 @@ let
|
|||
settings = { };
|
||||
};
|
||||
scalaPackages = {
|
||||
systemPackages = with pkgs; [ coursier metals ];
|
||||
systemPackages = with pkgs; [
|
||||
coursier
|
||||
metals
|
||||
];
|
||||
extension = with inputs.nix-vscode-extensions.extensions.${pkgs.system}.vscode-marketplace; [
|
||||
scala-lang.scala
|
||||
scalameta.metals
|
||||
|
|
@ -61,20 +78,56 @@ let
|
|||
{
|
||||
"name" = "xelatex";
|
||||
"command" = "xelatex";
|
||||
"args" = [ "-synctex=1" "-interaction=nonstopmode" "-file-line-error" "%DOCFILE%" ];
|
||||
"args" = [
|
||||
"-synctex=1"
|
||||
"-interaction=nonstopmode"
|
||||
"-file-line-error"
|
||||
"%DOCFILE%"
|
||||
];
|
||||
}
|
||||
{
|
||||
"name" = "pdflatex";
|
||||
"command" = "pdflatex";
|
||||
"args" = [ "-synctex=1" "-interaction=nonstopmode" "-file-line-error" "%DOCFILE%" ];
|
||||
"args" = [
|
||||
"-synctex=1"
|
||||
"-interaction=nonstopmode"
|
||||
"-file-line-error"
|
||||
"%DOCFILE%"
|
||||
];
|
||||
}
|
||||
{
|
||||
"name" = "bibtex";
|
||||
"command" = "bibtex";
|
||||
"args" = [ "%DOCFILE%" ];
|
||||
}
|
||||
{ "name" = "bibtex"; "command" = "bibtex"; "args" = [ "%DOCFILE%" ]; }
|
||||
];
|
||||
"latex-workshop.latex.recipes" = [
|
||||
{ "name" = "xelatex"; "tools" = [ "xelatex" ]; }
|
||||
{ "name" = "pdflatex"; "tools" = [ "pdflatex" ]; }
|
||||
{ "name" = "xe->bib->xe->xe"; "tools" = [ "xelatex" "bibtex" "xelatex" "xelatex" ]; }
|
||||
{ "name" = "pdf->bib->pdf->pdf"; "tools" = [ "pdflatex" "bibtex" "pdflatex" "pdflatex" ]; }
|
||||
{
|
||||
"name" = "xelatex";
|
||||
"tools" = [ "xelatex" ];
|
||||
}
|
||||
{
|
||||
"name" = "pdflatex";
|
||||
"tools" = [ "pdflatex" ];
|
||||
}
|
||||
{
|
||||
"name" = "xe->bib->xe->xe";
|
||||
"tools" = [
|
||||
"xelatex"
|
||||
"bibtex"
|
||||
"xelatex"
|
||||
"xelatex"
|
||||
];
|
||||
}
|
||||
{
|
||||
"name" = "pdf->bib->pdf->pdf";
|
||||
"tools" = [
|
||||
"pdflatex"
|
||||
"bibtex"
|
||||
"pdflatex"
|
||||
"pdflatex"
|
||||
];
|
||||
}
|
||||
];
|
||||
"[latex]" = {
|
||||
"editor.formatOnPaste" = false;
|
||||
|
|
@ -88,9 +141,15 @@ let
|
|||
};
|
||||
llmExtensions = [ pkgs.vscode-extensions.continue.continue ];
|
||||
|
||||
languages = [ "nix" "cxx" "python" "scala" "latex" ];
|
||||
zipAttrsWithLanguageOption = (attr:
|
||||
(map (l: (lib.mkIf cfg.languages.${l} packages."${l}Packages".${attr})) languages)
|
||||
languages = [
|
||||
"nix"
|
||||
"cxx"
|
||||
"python"
|
||||
"scala"
|
||||
"latex"
|
||||
];
|
||||
zipAttrsWithLanguageOption = (
|
||||
attr: (map (l: (lib.mkIf cfg.languages.${l} packages."${l}Packages".${attr})) languages)
|
||||
);
|
||||
in
|
||||
{
|
||||
|
|
@ -111,64 +170,71 @@ in
|
|||
config = mkIf cfg.enable {
|
||||
nixpkgs.config.allowUnfree = true;
|
||||
|
||||
home.packages = lib.mkMerge ([
|
||||
[ pkgs.clang-tools ]
|
||||
(mkIf cfg.llm [ pkgs.ollama ])
|
||||
] ++ zipAttrsWithLanguageOption "systemPackages");
|
||||
home.packages = lib.mkMerge (
|
||||
[
|
||||
[ pkgs.clang-tools ]
|
||||
(mkIf cfg.llm [ pkgs.ollama ])
|
||||
]
|
||||
++ zipAttrsWithLanguageOption "systemPackages"
|
||||
);
|
||||
programs.vscode = {
|
||||
enable = true;
|
||||
package = pkgs.vscode.override { commandLineArgs = "--enable-wayland-ime"; };
|
||||
enableUpdateCheck = false;
|
||||
enableExtensionUpdateCheck = false;
|
||||
mutableExtensionsDir = false;
|
||||
extensions = lib.mkMerge ([
|
||||
(with inputs.nix-vscode-extensions.extensions.${pkgs.system}.vscode-marketplace; [
|
||||
mkhl.direnv
|
||||
extensions = lib.mkMerge (
|
||||
[
|
||||
(with inputs.nix-vscode-extensions.extensions.${pkgs.system}.vscode-marketplace; [
|
||||
mkhl.direnv
|
||||
|
||||
ms-azuretools.vscode-docker
|
||||
ms-vscode-remote.remote-ssh
|
||||
vscodevim.vim
|
||||
github.vscode-pull-request-github
|
||||
gruntfuggly.todo-tree # todo highlight
|
||||
ms-azuretools.vscode-docker
|
||||
ms-vscode-remote.remote-ssh
|
||||
vscodevim.vim
|
||||
github.vscode-pull-request-github
|
||||
gruntfuggly.todo-tree # todo highlight
|
||||
|
||||
# Markdown
|
||||
davidanson.vscode-markdownlint
|
||||
# Latex
|
||||
# Scale / chisel
|
||||
sterben.fpga-support
|
||||
# Markdown
|
||||
davidanson.vscode-markdownlint
|
||||
# Latex
|
||||
# Scale / chisel
|
||||
sterben.fpga-support
|
||||
|
||||
ms-vscode-remote.remote-ssh-edit
|
||||
mushan.vscode-paste-image
|
||||
])
|
||||
ms-vscode-remote.remote-ssh-edit
|
||||
mushan.vscode-paste-image
|
||||
])
|
||||
|
||||
(with pkgs.vscode-extensions; [
|
||||
waderyan.gitblame
|
||||
catppuccin.catppuccin-vsc
|
||||
# Rust
|
||||
rust-lang.rust-analyzer
|
||||
])
|
||||
(with pkgs.vscode-extensions; [
|
||||
waderyan.gitblame
|
||||
catppuccin.catppuccin-vsc
|
||||
# Rust
|
||||
rust-lang.rust-analyzer
|
||||
])
|
||||
|
||||
(mkIf cfg.llm llmExtensions)
|
||||
] ++ zipAttrsWithLanguageOption "extension");
|
||||
userSettings = lib.mkMerge ([
|
||||
{
|
||||
"workbench.colorTheme" = "Catppuccin Macchiato";
|
||||
"terminal.integrated.sendKeybindingsToShell" = true;
|
||||
"extensions.ignoreRecommendations" = true;
|
||||
"files.autoSave" = "afterDelay";
|
||||
"editor.inlineSuggest.enabled" = true;
|
||||
"editor.rulers" = [
|
||||
80
|
||||
];
|
||||
"editor.mouseWheelZoom" = true;
|
||||
"git.autofetch" = false;
|
||||
"window.zoomLevel" = -1;
|
||||
(mkIf cfg.llm llmExtensions)
|
||||
]
|
||||
++ zipAttrsWithLanguageOption "extension"
|
||||
);
|
||||
userSettings = lib.mkMerge (
|
||||
[
|
||||
{
|
||||
"workbench.colorTheme" = "Catppuccin Macchiato";
|
||||
"terminal.integrated.sendKeybindingsToShell" = true;
|
||||
"extensions.ignoreRecommendations" = true;
|
||||
"files.autoSave" = "afterDelay";
|
||||
"editor.inlineSuggest.enabled" = true;
|
||||
"editor.rulers" = [ 80 ];
|
||||
"editor.mouseWheelZoom" = true;
|
||||
"git.autofetch" = false;
|
||||
"window.zoomLevel" = -1;
|
||||
|
||||
"extensions.experimental.affinity" = {
|
||||
"vscodevim.vim" = 1;
|
||||
};
|
||||
}
|
||||
] ++ zipAttrsWithLanguageOption "settings");
|
||||
"extensions.experimental.affinity" = {
|
||||
"vscodevim.vim" = 1;
|
||||
};
|
||||
}
|
||||
]
|
||||
++ zipAttrsWithLanguageOption "settings"
|
||||
);
|
||||
};
|
||||
|
||||
home.file.".continue/config.json".text = lib.generators.toJSON { } {
|
||||
|
|
@ -180,7 +246,7 @@ in
|
|||
}
|
||||
];
|
||||
tabAutocompleteModel = {
|
||||
model ="deepseek-coder:6.7b-base";
|
||||
model = "deepseek-coder:6.7b-base";
|
||||
provider = "ollama";
|
||||
title = "codegemma";
|
||||
};
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
{ config, pkgs, lib, ... }:
|
||||
{ config, lib, ... }:
|
||||
|
||||
with lib;
|
||||
|
||||
|
|
@ -14,20 +14,22 @@ in
|
|||
enable = true;
|
||||
settings = {
|
||||
default_shell = "fish";
|
||||
keybinds = {
|
||||
unbind = [
|
||||
"Ctrl p"
|
||||
"Ctrl n"
|
||||
];
|
||||
shared_except = {
|
||||
_args = [ "pane" "locked" ];
|
||||
bind = {
|
||||
_args = [ "Ctrl b"];
|
||||
SwitchToMode = "Pane";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
xdg.configFile."zellij/config.kdl".text = ''
|
||||
keybinds {
|
||||
shared_except "pane" "locked" {
|
||||
bind "Ctrl b" { SwitchToMode "Pane"; }
|
||||
}
|
||||
shared_except "locked" {
|
||||
bind "Ctrl h" { MoveFocusOrTab "Left"; }
|
||||
bind "Ctrl l" { MoveFocusOrTab "Right"; }
|
||||
bind "Ctrl j" { MoveFocus "Down"; }
|
||||
bind "Ctrl k" { MoveFocus "Up"; }
|
||||
unbind "Alt h" "Alt l" "Alt j" "Alt k"
|
||||
}
|
||||
unbind "Ctrl p" "Ctrl n"
|
||||
}
|
||||
'';
|
||||
};
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,7 +1,17 @@
|
|||
{ config, lib, pkgs, ... }:
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
pkgs,
|
||||
...
|
||||
}:
|
||||
|
||||
let
|
||||
inherit (lib) mkIf mkEnableOption mkOption types;
|
||||
inherit (lib)
|
||||
mkIf
|
||||
mkEnableOption
|
||||
mkOption
|
||||
types
|
||||
;
|
||||
|
||||
cfg = config.commonSettings.auth;
|
||||
in
|
||||
|
|
@ -38,4 +48,3 @@ in
|
|||
};
|
||||
};
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -1,7 +1,17 @@
|
|||
{ config, lib, pkgs, ... }:
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
pkgs,
|
||||
...
|
||||
}:
|
||||
|
||||
let
|
||||
inherit (lib) mkIf mkEnableOption mkOption types;
|
||||
inherit (lib)
|
||||
mkIf
|
||||
mkEnableOption
|
||||
mkOption
|
||||
types
|
||||
;
|
||||
|
||||
cfg = config.commonSettings.nix;
|
||||
in
|
||||
|
|
@ -33,7 +43,10 @@ in
|
|||
nix.optimise.automatic = true;
|
||||
|
||||
nix.settings = {
|
||||
experimental-features = [ "nix-command" "flakes" ];
|
||||
experimental-features = [
|
||||
"nix-command"
|
||||
"flakes"
|
||||
];
|
||||
auto-optimise-store = true;
|
||||
trusted-users = [ "root" ];
|
||||
|
||||
|
|
@ -52,10 +65,7 @@ in
|
|||
"xin-1:8/ul1IhdWLswERF/8RfeAw8VZqjwHrJ1x55y1yjxQ+Y="
|
||||
];
|
||||
|
||||
secret-key-files = mkIf cfg.signing.enable [
|
||||
cfg.signing.keyFile
|
||||
];
|
||||
secret-key-files = mkIf cfg.signing.enable [ cfg.signing.keyFile ];
|
||||
};
|
||||
};
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -1,4 +1,9 @@
|
|||
{ config, pkgs, lib, ... }:
|
||||
{
|
||||
config,
|
||||
pkgs,
|
||||
lib,
|
||||
...
|
||||
}:
|
||||
let
|
||||
cfg = config.custom.forgejo-actions-runner;
|
||||
in
|
||||
|
|
@ -6,9 +11,7 @@ in
|
|||
options = {
|
||||
custom.forgejo-actions-runner = {
|
||||
enable = lib.mkEnableOption "TPM supported ssh agent in go";
|
||||
tokenFile = lib.mkOption {
|
||||
type = lib.types.path;
|
||||
};
|
||||
tokenFile = lib.mkOption { type = lib.types.path; };
|
||||
};
|
||||
};
|
||||
config = lib.mkIf cfg.enable {
|
||||
|
|
|
|||
|
|
@ -1,4 +1,9 @@
|
|||
{ config, pkgs, lib, ... }:
|
||||
{
|
||||
config,
|
||||
pkgs,
|
||||
lib,
|
||||
...
|
||||
}:
|
||||
|
||||
with lib;
|
||||
|
||||
|
|
@ -26,22 +31,12 @@ in
|
|||
};
|
||||
oidc = {
|
||||
enable = mkEnableOption "OIDC support for HedgeDoc";
|
||||
baseURL = mkOption {
|
||||
type = types.str;
|
||||
};
|
||||
authorizationURL = mkOption {
|
||||
type = types.str;
|
||||
};
|
||||
tokenURL = mkOption {
|
||||
type = types.str;
|
||||
};
|
||||
userProfileURL = mkOption {
|
||||
type = types.str;
|
||||
};
|
||||
};
|
||||
environmentFile = mkOption {
|
||||
type = types.path;
|
||||
baseURL = mkOption { type = types.str; };
|
||||
authorizationURL = mkOption { type = types.str; };
|
||||
tokenURL = mkOption { type = types.str; };
|
||||
userProfileURL = mkOption { type = types.str; };
|
||||
};
|
||||
environmentFile = mkOption { type = types.path; };
|
||||
};
|
||||
};
|
||||
config = mkIf cfg.enable {
|
||||
|
|
|
|||
|
|
@ -1,17 +1,14 @@
|
|||
{ config
|
||||
, lib
|
||||
, ... }:
|
||||
{ config, lib, ... }:
|
||||
let
|
||||
cfg = config.custom.sing-box-server;
|
||||
|
||||
secretFileType = lib.types.submodule {
|
||||
_secret = lib.types.path;
|
||||
};
|
||||
secretFileType = lib.types.submodule { _secret = lib.types.path; };
|
||||
singTls = {
|
||||
enabled = true;
|
||||
server_name = config.deployment.targetHost;
|
||||
key_path = config.security.acme.certs.${config.deployment.targetHost}.directory + "/key.pem";
|
||||
certificate_path = config.security.acme.certs.${config.deployment.targetHost}.directory + "/cert.pem";
|
||||
certificate_path =
|
||||
config.security.acme.certs.${config.deployment.targetHost}.directory + "/cert.pem";
|
||||
};
|
||||
in
|
||||
{
|
||||
|
|
@ -22,17 +19,11 @@ in
|
|||
type = lib.types.str;
|
||||
default = "proxy";
|
||||
};
|
||||
password = lib.mkOption {
|
||||
type = secretFileType;
|
||||
};
|
||||
uuid = lib.mkOption {
|
||||
type = secretFileType;
|
||||
};
|
||||
password = lib.mkOption { type = secretFileType; };
|
||||
uuid = lib.mkOption { type = secretFileType; };
|
||||
};
|
||||
wgOut = {
|
||||
privKeyFile = lib.mkOption {
|
||||
type = lib.types.path;
|
||||
};
|
||||
privKeyFile = lib.mkOption { type = lib.types.path; };
|
||||
pubkey = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "bmXOC+F1FxEMF9dyiK2H5/1SUtzH0JuVo51h2wPfgyo=";
|
||||
|
|
@ -73,17 +64,19 @@ in
|
|||
}
|
||||
];
|
||||
};
|
||||
inbounds = [
|
||||
# TODO: Trojan and tuic enable
|
||||
{
|
||||
tag = "trojan-in";
|
||||
type = "trojan";
|
||||
listen = "::";
|
||||
listen_port = 8080;
|
||||
users = map (u: removeAttrs u [ "uuid" ]) cfg.users;
|
||||
tls = singTls;
|
||||
}
|
||||
] ++ lib.forEach (cfg.tuic.ports ++ cfg.tuic.directPorts) (port: {
|
||||
inbounds =
|
||||
[
|
||||
# TODO: Trojan and tuic enable
|
||||
{
|
||||
tag = "trojan-in";
|
||||
type = "trojan";
|
||||
listen = "::";
|
||||
listen_port = 8080;
|
||||
users = map (u: removeAttrs u [ "uuid" ]) cfg.users;
|
||||
tls = singTls;
|
||||
}
|
||||
]
|
||||
++ lib.forEach (cfg.tuic.ports ++ cfg.tuic.directPorts) (port: {
|
||||
tag = "tuic-in" + toString port;
|
||||
type = "tuic";
|
||||
listen = "::";
|
||||
|
|
@ -102,23 +95,38 @@ in
|
|||
"2606:4700:110:82ed:a443:3c62:6cbc:b59b/128"
|
||||
];
|
||||
peers = [
|
||||
{ public_key= cfg.wgOut.pubkey;
|
||||
allowed_ips = [ "0.0.0.0/0" "::/0" ];
|
||||
{
|
||||
public_key = cfg.wgOut.pubkey;
|
||||
allowed_ips = [
|
||||
"0.0.0.0/0"
|
||||
"::/0"
|
||||
];
|
||||
server = "162.159.192.1";
|
||||
server_port = 500;
|
||||
}
|
||||
];
|
||||
}
|
||||
{ type = "direct"; tag = "direct-out"; }
|
||||
{ type = "dns"; tag = "dns-out"; }
|
||||
{
|
||||
type = "direct";
|
||||
tag = "direct-out";
|
||||
}
|
||||
{
|
||||
type = "dns";
|
||||
tag = "dns-out";
|
||||
}
|
||||
];
|
||||
route = {
|
||||
rules = [
|
||||
{ outbound = "dns-out"; protocol = "dns"; }
|
||||
] ++ lib.forEach cfg.tuic.directPorts (port: {
|
||||
inbound = "tuic-in" + toString port;
|
||||
outbound = "direct-out";
|
||||
});
|
||||
rules =
|
||||
[
|
||||
{
|
||||
outbound = "dns-out";
|
||||
protocol = "dns";
|
||||
}
|
||||
]
|
||||
++ lib.forEach cfg.tuic.directPorts (port: {
|
||||
inbound = "tuic-in" + toString port;
|
||||
outbound = "direct-out";
|
||||
});
|
||||
};
|
||||
};
|
||||
};
|
||||
|
|
|
|||
|
|
@ -1,4 +1,9 @@
|
|||
{ config, pkgs, lib, ... }:
|
||||
{
|
||||
config,
|
||||
pkgs,
|
||||
lib,
|
||||
...
|
||||
}:
|
||||
with lib;
|
||||
|
||||
let
|
||||
|
|
@ -27,27 +32,25 @@ in
|
|||
type = types.listOf types.str;
|
||||
default = [ ];
|
||||
};
|
||||
uri = mkOption {
|
||||
type = types.str;
|
||||
};
|
||||
uri = mkOption { type = types.str; };
|
||||
};
|
||||
};
|
||||
config = mkIf cfg.enable {
|
||||
services.kanidm = mkMerge
|
||||
[ (mkIf cfg.enable {
|
||||
enableClient = true;
|
||||
clientSettings = {
|
||||
uri = cfg.uri;
|
||||
};
|
||||
})
|
||||
(mkIf cfg.asSSHAuth.enable {
|
||||
enablePam = true;
|
||||
unixSettings = {
|
||||
pam_allowed_login_groups = cfg.asSSHAuth.allowedGroups;
|
||||
default_shell = "/bin/sh";
|
||||
};
|
||||
})
|
||||
];
|
||||
services.kanidm = mkMerge [
|
||||
(mkIf cfg.enable {
|
||||
enableClient = true;
|
||||
clientSettings = {
|
||||
uri = cfg.uri;
|
||||
};
|
||||
})
|
||||
(mkIf cfg.asSSHAuth.enable {
|
||||
enablePam = true;
|
||||
unixSettings = {
|
||||
pam_allowed_login_groups = cfg.asSSHAuth.allowedGroups;
|
||||
default_shell = "/bin/sh";
|
||||
};
|
||||
})
|
||||
];
|
||||
services.openssh = mkIf cfg.asSSHAuth.enable {
|
||||
enable = true;
|
||||
authorizedKeysCommand = "/etc/ssh/auth %u";
|
||||
|
|
@ -70,8 +73,10 @@ in
|
|||
};
|
||||
users.groups.wheel.members = cfg.sudoers;
|
||||
users.groups.kanidm-ssh-runner = { };
|
||||
users.users.kanidm-ssh-runner = { isSystemUser = true; group = "kanidm-ssh-runner"; };
|
||||
users.users.kanidm-ssh-runner = {
|
||||
isSystemUser = true;
|
||||
group = "kanidm-ssh-runner";
|
||||
};
|
||||
|
||||
};
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -1,6 +1,19 @@
|
|||
{ config, pkgs, lib, ... }:
|
||||
{
|
||||
config,
|
||||
pkgs,
|
||||
lib,
|
||||
...
|
||||
}:
|
||||
let
|
||||
inherit (lib) mkEnableOption mkPackageOption mkOption types literalExpression mkIf mkDefault;
|
||||
inherit (lib)
|
||||
mkEnableOption
|
||||
mkPackageOption
|
||||
mkOption
|
||||
types
|
||||
literalExpression
|
||||
mkIf
|
||||
mkDefault
|
||||
;
|
||||
cfg = config.custom.miniflux;
|
||||
|
||||
defaultAddress = "localhost:8080";
|
||||
|
|
@ -18,12 +31,15 @@ in
|
|||
|
||||
package = mkPackageOption pkgs "miniflux" { };
|
||||
|
||||
oauth2SecretFile = mkOption {
|
||||
type = types.path;
|
||||
};
|
||||
oauth2SecretFile = mkOption { type = types.path; };
|
||||
|
||||
environment = mkOption {
|
||||
type = with types; attrsOf (oneOf [ int str ]);
|
||||
type =
|
||||
with types;
|
||||
attrsOf (oneOf [
|
||||
int
|
||||
str
|
||||
]);
|
||||
};
|
||||
|
||||
createDatabaseLocally = mkOption {
|
||||
|
|
@ -50,17 +66,22 @@ in
|
|||
|
||||
services.postgresql = lib.mkIf cfg.createDatabaseLocally {
|
||||
enable = true;
|
||||
ensureUsers = [{
|
||||
name = "miniflux";
|
||||
ensureDBOwnership = true;
|
||||
}];
|
||||
ensureUsers = [
|
||||
{
|
||||
name = "miniflux";
|
||||
ensureDBOwnership = true;
|
||||
}
|
||||
];
|
||||
ensureDatabases = [ "miniflux" ];
|
||||
};
|
||||
|
||||
systemd.services.miniflux-dbsetup = lib.mkIf cfg.createDatabaseLocally {
|
||||
description = "Miniflux database setup";
|
||||
requires = [ "postgresql.service" ];
|
||||
after = [ "network.target" "postgresql.service" ];
|
||||
after = [
|
||||
"network.target"
|
||||
"postgresql.service"
|
||||
];
|
||||
serviceConfig = {
|
||||
Type = "oneshot";
|
||||
User = config.services.postgresql.superUser;
|
||||
|
|
@ -72,8 +93,12 @@ in
|
|||
description = "Miniflux service";
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
requires = lib.optional cfg.createDatabaseLocally "miniflux-dbsetup.service";
|
||||
after = [ "network.target" ]
|
||||
++ lib.optionals cfg.createDatabaseLocally [ "postgresql.service" "miniflux-dbsetup.service" ];
|
||||
after =
|
||||
[ "network.target" ]
|
||||
++ lib.optionals cfg.createDatabaseLocally [
|
||||
"postgresql.service"
|
||||
"miniflux-dbsetup.service"
|
||||
];
|
||||
|
||||
serviceConfig = {
|
||||
Type = "notify";
|
||||
|
|
@ -104,12 +129,19 @@ in
|
|||
ProtectKernelModules = true;
|
||||
ProtectKernelTunables = true;
|
||||
ProtectProc = "invisible";
|
||||
RestrictAddressFamilies = [ "AF_INET" "AF_INET6" "AF_UNIX" ];
|
||||
RestrictAddressFamilies = [
|
||||
"AF_INET"
|
||||
"AF_INET6"
|
||||
"AF_UNIX"
|
||||
];
|
||||
RestrictNamespaces = true;
|
||||
RestrictRealtime = true;
|
||||
RestrictSUIDSGID = true;
|
||||
SystemCallArchitectures = "native";
|
||||
SystemCallFilter = [ "@system-service" "~@privileged" ];
|
||||
SystemCallFilter = [
|
||||
"@system-service"
|
||||
"~@privileged"
|
||||
];
|
||||
UMask = "0077";
|
||||
};
|
||||
|
||||
|
|
|
|||
|
|
@ -1,10 +1,20 @@
|
|||
{ config, lib, pkgs, ... }:
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
pkgs,
|
||||
...
|
||||
}:
|
||||
|
||||
let
|
||||
inherit (lib) mkIf mkEnableOption mkOption types;
|
||||
inherit (lib)
|
||||
mkIf
|
||||
mkEnableOption
|
||||
mkOption
|
||||
types
|
||||
;
|
||||
|
||||
cfg = config.programs.oidc-agent;
|
||||
providerFormat = pkgs.formats.json {};
|
||||
providerFormat = pkgs.formats.json { };
|
||||
in
|
||||
{
|
||||
options.programs.oidc-agent = {
|
||||
|
|
@ -18,7 +28,7 @@ in
|
|||
};
|
||||
providers = mkOption {
|
||||
type = providerFormat.type;
|
||||
default = {};
|
||||
default = { };
|
||||
description = ''
|
||||
Configuration of providers which contains a json array of json objects
|
||||
each describing an issuer, see https://indigo-dc.gitbook.io/oidc-agent/configuration/issuers
|
||||
|
|
|
|||
|
|
@ -1,4 +1,9 @@
|
|||
{ config, lib, pkgs, ... }:
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
pkgs,
|
||||
...
|
||||
}:
|
||||
let
|
||||
cfg = config.custom.prometheus;
|
||||
in
|
||||
|
|
@ -8,7 +13,7 @@ in
|
|||
enable = true;
|
||||
listenAddress = "127.0.0.1";
|
||||
configFile = pkgs.writeText "blackbox.config.yaml" (
|
||||
lib.generators.toYAML {} {
|
||||
lib.generators.toYAML { } {
|
||||
modules = {
|
||||
tcp4_connect = {
|
||||
prober = "tcp";
|
||||
|
|
@ -25,7 +30,7 @@ in
|
|||
};
|
||||
|
||||
services.prometheus.scrapeConfigs = [
|
||||
{
|
||||
{
|
||||
job_name = "blackbox";
|
||||
scrape_interval = "1m";
|
||||
metrics_path = "/probe";
|
||||
|
|
@ -73,8 +78,13 @@ in
|
|||
alert = "HighProbeLatency";
|
||||
expr = "probe_duration_seconds > 0.5";
|
||||
for = "2m";
|
||||
labels = { severity = "warning"; };
|
||||
annotations = { summary = "High request latency on {{ $labels.instance }}"; description = "95th percentile of request latency is above 0.5 seconds for the last 2 minutes."; };
|
||||
labels = {
|
||||
severity = "warning";
|
||||
};
|
||||
annotations = {
|
||||
summary = "High request latency on {{ $labels.instance }}";
|
||||
description = "95th percentile of request latency is above 0.5 seconds for the last 2 minutes.";
|
||||
};
|
||||
}
|
||||
];
|
||||
}
|
||||
|
|
|
|||
|
|
@ -13,9 +13,7 @@ in
|
|||
services.prometheus.scrapeConfigs = [
|
||||
{
|
||||
job_name = "caddy";
|
||||
static_configs = [
|
||||
{ targets = [ "127.0.0.1:2019" ]; }
|
||||
];
|
||||
static_configs = [ { targets = [ "127.0.0.1:2019" ]; } ];
|
||||
}
|
||||
];
|
||||
|
||||
|
|
@ -27,8 +25,12 @@ in
|
|||
alert = "UpstreamHealthy";
|
||||
expr = "caddy_reverse_proxy_upstreams_healthy != 1";
|
||||
for = "5m";
|
||||
labels = { severity = "critical"; };
|
||||
annotations = { summary = "Upstream {{ $labels.unstream }} not healthy"; };
|
||||
labels = {
|
||||
severity = "critical";
|
||||
};
|
||||
annotations = {
|
||||
summary = "Upstream {{ $labels.unstream }} not healthy";
|
||||
};
|
||||
}
|
||||
];
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,26 +1,31 @@
|
|||
{ config, pkgs, lib, ... }:
|
||||
{
|
||||
config,
|
||||
pkgs,
|
||||
lib,
|
||||
...
|
||||
}:
|
||||
|
||||
with lib;
|
||||
|
||||
let
|
||||
cfg = config.custom.prometheus;
|
||||
mkExporterOption = enableOption: (mkOption {
|
||||
type = types.bool;
|
||||
default = enableOption;
|
||||
description = "Enable this exporter";
|
||||
});
|
||||
mkExporterOption =
|
||||
enableOption:
|
||||
(mkOption {
|
||||
type = types.bool;
|
||||
default = enableOption;
|
||||
description = "Enable this exporter";
|
||||
});
|
||||
|
||||
mkRulesOption = mkOption {
|
||||
type = types.listOf (types.submodule {
|
||||
options = {
|
||||
name = mkOption {
|
||||
type = lib.types.str;
|
||||
type = types.listOf (
|
||||
types.submodule {
|
||||
options = {
|
||||
name = mkOption { type = lib.types.str; };
|
||||
rules = mkOption { type = lib.types.listOf lib.types.attrs; };
|
||||
};
|
||||
rules = mkOption {
|
||||
type = lib.types.listOf lib.types.attrs;
|
||||
};
|
||||
};
|
||||
});
|
||||
}
|
||||
);
|
||||
};
|
||||
in
|
||||
{
|
||||
|
|
@ -54,153 +59,172 @@ in
|
|||
};
|
||||
grafana = {
|
||||
enable = mkEnableOption "Grafana Cloud";
|
||||
password_file = mkOption {
|
||||
type = types.path;
|
||||
};
|
||||
password_file = mkOption { type = types.path; };
|
||||
};
|
||||
ruleModules = mkRulesOption;
|
||||
};
|
||||
};
|
||||
|
||||
config = mkIf cfg.enable
|
||||
{
|
||||
services.tailscale = {
|
||||
enable = true;
|
||||
permitCertUid = config.services.caddy.user;
|
||||
openFirewall = true;
|
||||
};
|
||||
config = mkIf cfg.enable {
|
||||
services.tailscale = {
|
||||
enable = true;
|
||||
permitCertUid = config.services.caddy.user;
|
||||
openFirewall = true;
|
||||
};
|
||||
|
||||
services.caddy = {
|
||||
enable = true;
|
||||
virtualHosts."${config.networking.hostName}.coho-tet.ts.net".extraConfig = ''
|
||||
reverse_proxy 127.0.0.1:${toString config.services.prometheus.port}
|
||||
'';
|
||||
};
|
||||
services.caddy = {
|
||||
enable = true;
|
||||
virtualHosts."${config.networking.hostName}.coho-tet.ts.net".extraConfig = ''
|
||||
reverse_proxy 127.0.0.1:${toString config.services.prometheus.port}
|
||||
'';
|
||||
};
|
||||
|
||||
services.prometheus = mkIf cfg.enable
|
||||
services.prometheus = mkIf cfg.enable {
|
||||
enable = true;
|
||||
port = 9091;
|
||||
globalConfig.external_labels = {
|
||||
hostname = config.networking.hostName;
|
||||
};
|
||||
remoteWrite = mkIf cfg.grafana.enable [
|
||||
{
|
||||
name = "grafana";
|
||||
url = "https://prometheus-prod-24-prod-eu-west-2.grafana.net/api/prom/push";
|
||||
basic_auth = {
|
||||
username = "1340065";
|
||||
password_file = cfg.grafana.password_file;
|
||||
};
|
||||
}
|
||||
];
|
||||
exporters = {
|
||||
node = {
|
||||
enable = true;
|
||||
port = 9091;
|
||||
globalConfig.external_labels = { hostname = config.networking.hostName; };
|
||||
remoteWrite = mkIf cfg.grafana.enable [
|
||||
{
|
||||
name = "grafana";
|
||||
url = "https://prometheus-prod-24-prod-eu-west-2.grafana.net/api/prom/push";
|
||||
basic_auth = {
|
||||
username = "1340065";
|
||||
password_file = cfg.grafana.password_file;
|
||||
};
|
||||
}
|
||||
enabledCollectors = [
|
||||
"loadavg"
|
||||
"time"
|
||||
"systemd"
|
||||
];
|
||||
exporters = {
|
||||
node = {
|
||||
enable = true;
|
||||
enabledCollectors = [
|
||||
"loadavg"
|
||||
"time"
|
||||
"systemd"
|
||||
];
|
||||
listenAddress = "127.0.0.1";
|
||||
port = 9100;
|
||||
};
|
||||
};
|
||||
scrapeConfigs = [
|
||||
{
|
||||
job_name = "prometheus";
|
||||
static_configs = [
|
||||
{ targets = [ "localhost:${toString config.services.prometheus.port}" ]; }
|
||||
];
|
||||
}
|
||||
{
|
||||
job_name = "node";
|
||||
static_configs = [
|
||||
{ targets = [ "localhost:${toString config.services.prometheus.exporters.node.port}" ]; }
|
||||
];
|
||||
}
|
||||
];
|
||||
|
||||
alertmanager = {
|
||||
enable = true;
|
||||
listenAddress = "127.0.0.1";
|
||||
logLevel = "debug";
|
||||
configuration = {
|
||||
route = {
|
||||
receiver = "ntfy";
|
||||
};
|
||||
receivers = [
|
||||
{
|
||||
name = "ntfy";
|
||||
webhook_configs = [
|
||||
{
|
||||
url = "https://ntfy.xinyang.life/prometheus-alerts?tpl=yes&m=${lib.escapeURL ''
|
||||
Alert {{.status}}
|
||||
{{range .alerts}}-----{{range $k,$v := .labels}}
|
||||
{{$k}}={{$v}}{{end}}
|
||||
{{end}}
|
||||
''}";
|
||||
send_resolved = true;
|
||||
}
|
||||
];
|
||||
}
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
alertmanagers = [
|
||||
{
|
||||
scheme = "http";
|
||||
static_configs = [
|
||||
{
|
||||
targets = [
|
||||
"${config.services.prometheus.alertmanager.listenAddress}:${toString config.services.prometheus.alertmanager.port}"
|
||||
];
|
||||
}
|
||||
];
|
||||
}
|
||||
];
|
||||
rules = [ (lib.generators.toYAML { } { groups = cfg.ruleModules; }) ];
|
||||
listenAddress = "127.0.0.1";
|
||||
port = 9100;
|
||||
};
|
||||
custom.prometheus.ruleModules = [
|
||||
};
|
||||
scrapeConfigs = [
|
||||
{
|
||||
name = "system_alerts";
|
||||
rules = [
|
||||
job_name = "prometheus";
|
||||
static_configs = [ { targets = [ "localhost:${toString config.services.prometheus.port}" ]; } ];
|
||||
}
|
||||
{
|
||||
job_name = "node";
|
||||
static_configs = [
|
||||
{ targets = [ "localhost:${toString config.services.prometheus.exporters.node.port}" ]; }
|
||||
];
|
||||
}
|
||||
];
|
||||
|
||||
alertmanager = {
|
||||
enable = true;
|
||||
listenAddress = "127.0.0.1";
|
||||
logLevel = "debug";
|
||||
configuration = {
|
||||
route = {
|
||||
receiver = "ntfy";
|
||||
};
|
||||
receivers = [
|
||||
{
|
||||
alert = "SystemdFailedUnits";
|
||||
expr = "node_systemd_unit_state{state=\"failed\"} > 0";
|
||||
for = "5m";
|
||||
labels = { severity = "critical"; };
|
||||
annotations = { summary = "Systemd has failed units on {{ $labels.instance }}"; description = "There are {{ $value }} failed units on {{ $labels.instance }}. Immediate attention required!"; };
|
||||
name = "ntfy";
|
||||
webhook_configs = [
|
||||
{
|
||||
url = "https://ntfy.xinyang.life/prometheus-alerts?tpl=yes&m=${lib.escapeURL ''
|
||||
Alert {{.status}}
|
||||
{{range .alerts}}-----{{range $k,$v := .labels}}
|
||||
{{$k}}={{$v}}{{end}}
|
||||
{{end}}
|
||||
''}";
|
||||
send_resolved = true;
|
||||
}
|
||||
];
|
||||
}
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
alertmanagers = [
|
||||
{
|
||||
scheme = "http";
|
||||
static_configs = [
|
||||
{
|
||||
alert = "HighLoadAverage";
|
||||
expr = "node_load1 > 0.8 * count without (cpu) (node_cpu_seconds_total{mode=\"idle\"})";
|
||||
for = "1m";
|
||||
labels = { severity = "warning"; };
|
||||
annotations = { summary = "High load average detected on {{ $labels.instance }}"; description = "The 1-minute load average ({{ $value }}) exceeds 80% the number of CPUs."; };
|
||||
}
|
||||
{
|
||||
alert = "HighTransmitTraffic";
|
||||
expr = "rate(node_network_transmit_bytes_total{device!=\"lo\"}[5m]) > 100000000";
|
||||
for = "1m";
|
||||
labels = { severity = "warning"; };
|
||||
annotations = { summary = "High network transmit traffic on {{ $labels.instance }} ({{ $labels.device }})"; description = "The network interface {{ $labels.device }} on {{ $labels.instance }} is transmitting data at a rate exceeding 100 MB/s for the last 1 minute."; };
|
||||
}
|
||||
{
|
||||
alert = "NetworkTrafficExceedLimit";
|
||||
expr = ''increase(node_network_transmit_bytes_total{device!="lo",device!~"tailscale.*",device!~"wg.*",device!~"br.*"}[30d]) > 322122547200'';
|
||||
for = "0m";
|
||||
labels = { severity = "critical"; };
|
||||
annotations = { summary = "Outbound network traffic exceed 300GB for last 30 day"; };
|
||||
}
|
||||
{
|
||||
alert = "JobDown";
|
||||
expr = "up == 0";
|
||||
for = "1m";
|
||||
labels = { severity = "critical"; };
|
||||
annotations = { summary = "Job {{ $labels.job }} down for 1m."; };
|
||||
targets = [
|
||||
"${config.services.prometheus.alertmanager.listenAddress}:${toString config.services.prometheus.alertmanager.port}"
|
||||
];
|
||||
}
|
||||
];
|
||||
}
|
||||
];
|
||||
rules = [ (lib.generators.toYAML { } { groups = cfg.ruleModules; }) ];
|
||||
};
|
||||
custom.prometheus.ruleModules = [
|
||||
{
|
||||
name = "system_alerts";
|
||||
rules = [
|
||||
{
|
||||
alert = "SystemdFailedUnits";
|
||||
expr = "node_systemd_unit_state{state=\"failed\"} > 0";
|
||||
for = "5m";
|
||||
labels = {
|
||||
severity = "critical";
|
||||
};
|
||||
annotations = {
|
||||
summary = "Systemd has failed units on {{ $labels.instance }}";
|
||||
description = "There are {{ $value }} failed units on {{ $labels.instance }}. Immediate attention required!";
|
||||
};
|
||||
}
|
||||
{
|
||||
alert = "HighLoadAverage";
|
||||
expr = "node_load1 > 0.8 * count without (cpu) (node_cpu_seconds_total{mode=\"idle\"})";
|
||||
for = "1m";
|
||||
labels = {
|
||||
severity = "warning";
|
||||
};
|
||||
annotations = {
|
||||
summary = "High load average detected on {{ $labels.instance }}";
|
||||
description = "The 1-minute load average ({{ $value }}) exceeds 80% the number of CPUs.";
|
||||
};
|
||||
}
|
||||
{
|
||||
alert = "HighTransmitTraffic";
|
||||
expr = "rate(node_network_transmit_bytes_total{device!=\"lo\"}[5m]) > 100000000";
|
||||
for = "1m";
|
||||
labels = {
|
||||
severity = "warning";
|
||||
};
|
||||
annotations = {
|
||||
summary = "High network transmit traffic on {{ $labels.instance }} ({{ $labels.device }})";
|
||||
description = "The network interface {{ $labels.device }} on {{ $labels.instance }} is transmitting data at a rate exceeding 100 MB/s for the last 1 minute.";
|
||||
};
|
||||
}
|
||||
{
|
||||
alert = "NetworkTrafficExceedLimit";
|
||||
expr = ''increase(node_network_transmit_bytes_total{device!="lo",device!~"tailscale.*",device!~"wg.*",device!~"br.*"}[30d]) > 322122547200'';
|
||||
for = "0m";
|
||||
labels = {
|
||||
severity = "critical";
|
||||
};
|
||||
annotations = {
|
||||
summary = "Outbound network traffic exceed 300GB for last 30 day";
|
||||
};
|
||||
}
|
||||
{
|
||||
alert = "JobDown";
|
||||
expr = "up == 0";
|
||||
for = "1m";
|
||||
labels = {
|
||||
severity = "critical";
|
||||
};
|
||||
annotations = {
|
||||
summary = "Job {{ $labels.job }} down for 1m.";
|
||||
};
|
||||
}
|
||||
];
|
||||
}
|
||||
];
|
||||
};
|
||||
}
|
||||
|
|
|
|||
|
|
@ -10,9 +10,7 @@ in
|
|||
services.prometheus.scrapeConfigs = [
|
||||
{
|
||||
job_name = "gotosocial";
|
||||
static_configs = [
|
||||
{ targets = [ "localhost:8080" ]; }
|
||||
];
|
||||
static_configs = [ { targets = [ "localhost:8080" ]; } ];
|
||||
}
|
||||
];
|
||||
};
|
||||
|
|
|
|||
|
|
@ -3,9 +3,10 @@ let
|
|||
cfg = config.custom.prometheus;
|
||||
immichEnv = config.services.immich.environment;
|
||||
metricPort =
|
||||
if builtins.hasAttr "IMMICH_API_METRICS_PORT" immichEnv
|
||||
then immichEnv.IMMICH_API_METRICS_PORT
|
||||
else 8081;
|
||||
if builtins.hasAttr "IMMICH_API_METRICS_PORT" immichEnv then
|
||||
immichEnv.IMMICH_API_METRICS_PORT
|
||||
else
|
||||
8081;
|
||||
in
|
||||
{
|
||||
config = lib.mkIf (cfg.enable && cfg.exporters.immich.enable) {
|
||||
|
|
@ -16,9 +17,7 @@ in
|
|||
services.prometheus.scrapeConfigs = [
|
||||
{
|
||||
job_name = "immich";
|
||||
static_configs = [
|
||||
{ targets = [ "127.0.0.1:${toString metricPort}" ]; }
|
||||
];
|
||||
static_configs = [ { targets = [ "127.0.0.1:${toString metricPort}" ]; } ];
|
||||
}
|
||||
];
|
||||
};
|
||||
|
|
|
|||
|
|
@ -8,9 +8,7 @@ in
|
|||
services.prometheus.scrapeConfigs = [
|
||||
{
|
||||
job_name = "miniflux";
|
||||
static_configs = [
|
||||
{ targets = [ config.systemd.services.miniflux.environment.LISTEN_ADDR ]; }
|
||||
];
|
||||
static_configs = [ { targets = [ config.systemd.services.miniflux.environment.LISTEN_ADDR ]; } ];
|
||||
}
|
||||
];
|
||||
};
|
||||
|
|
|
|||
|
|
@ -8,9 +8,7 @@ in
|
|||
services.prometheus.scrapeConfigs = [
|
||||
{
|
||||
job_name = "ntfy-sh";
|
||||
static_configs = [
|
||||
{ targets = [ "ntfy.xinyang.life" ]; }
|
||||
];
|
||||
static_configs = [ { targets = [ "ntfy.xinyang.life" ]; } ];
|
||||
}
|
||||
];
|
||||
};
|
||||
|
|
|
|||
|
|
@ -9,9 +9,7 @@ in
|
|||
services.prometheus.scrapeConfigs = [
|
||||
(lib.mkIf cfg.exporters.restic.enable {
|
||||
job_name = "restic";
|
||||
static_configs = [
|
||||
{ targets = [ config.services.restic.server.listenAddress ]; }
|
||||
];
|
||||
static_configs = [ { targets = [ config.services.restic.server.listenAddress ]; } ];
|
||||
})
|
||||
];
|
||||
|
||||
|
|
@ -23,15 +21,25 @@ in
|
|||
alert = "ResticCheckFailed";
|
||||
expr = "restic_check_success == 0";
|
||||
for = "5m";
|
||||
labels = { severity = "critical"; };
|
||||
annotations = { summary = "Restic check failed (instance {{ $labels.instance }})"; description = "Restic check failed\\n VALUE = {{ $value }}\\n LABELS = {{ $labels }}"; };
|
||||
labels = {
|
||||
severity = "critical";
|
||||
};
|
||||
annotations = {
|
||||
summary = "Restic check failed (instance {{ $labels.instance }})";
|
||||
description = "Restic check failed\\n VALUE = {{ $value }}\\n LABELS = {{ $labels }}";
|
||||
};
|
||||
}
|
||||
{
|
||||
alert = "ResticOutdatedBackup";
|
||||
expr = "time() - restic_backup_timestamp > 518400";
|
||||
for = "0m";
|
||||
labels = { severity = "critical"; };
|
||||
annotations = { summary = "Restic {{ $labels.client_hostname }} / {{ $labels.client_username }} backup is outdated"; description = "Restic backup is outdated\\n VALUE = {{ $value }}\\n LABELS = {{ $labels }}"; };
|
||||
labels = {
|
||||
severity = "critical";
|
||||
};
|
||||
annotations = {
|
||||
summary = "Restic {{ $labels.client_hostname }} / {{ $labels.client_username }} backup is outdated";
|
||||
description = "Restic backup is outdated\\n VALUE = {{ $value }}\\n LABELS = {{ $labels }}";
|
||||
};
|
||||
}
|
||||
];
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,4 +1,9 @@
|
|||
{ config, pkgs, lib, ... }:
|
||||
{
|
||||
config,
|
||||
pkgs,
|
||||
lib,
|
||||
...
|
||||
}:
|
||||
let
|
||||
cfg = config.custom.restic;
|
||||
in
|
||||
|
|
@ -45,4 +50,3 @@ in
|
|||
};
|
||||
};
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -1,4 +1,10 @@
|
|||
{ config, pkgs, lib, utils, ... }:
|
||||
{
|
||||
config,
|
||||
pkgs,
|
||||
lib,
|
||||
utils,
|
||||
...
|
||||
}:
|
||||
let
|
||||
cfg = config.custom.sing-box;
|
||||
settingsFormat = pkgs.formats.json { };
|
||||
|
|
@ -16,9 +22,7 @@ in
|
|||
};
|
||||
|
||||
configFile = {
|
||||
urlFile = lib.mkOption {
|
||||
type = lib.types.path;
|
||||
};
|
||||
urlFile = lib.mkOption { type = lib.types.path; };
|
||||
name = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "config.json";
|
||||
|
|
@ -63,9 +67,9 @@ in
|
|||
systemd.packages = [ cfg.package ];
|
||||
|
||||
systemd.services.sing-box =
|
||||
let
|
||||
configFile = cfg.stateDir + "/${cfg.configFile.name}";
|
||||
in
|
||||
let
|
||||
configFile = cfg.stateDir + "/${cfg.configFile.name}";
|
||||
in
|
||||
{
|
||||
preStart = ''
|
||||
umask 0077
|
||||
|
|
@ -81,4 +85,3 @@ in
|
|||
};
|
||||
};
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -1,5 +1,10 @@
|
|||
# Temporary workaround
|
||||
{ config, pkgs, lib, ... }:
|
||||
{
|
||||
config,
|
||||
pkgs,
|
||||
lib,
|
||||
...
|
||||
}:
|
||||
let
|
||||
cfg = config.services.ssh-tpm-agent;
|
||||
in
|
||||
|
|
|
|||
|
|
@ -1,4 +1,9 @@
|
|||
{ config, pkgs, lib, ... }:
|
||||
{
|
||||
config,
|
||||
pkgs,
|
||||
lib,
|
||||
...
|
||||
}:
|
||||
|
||||
with lib;
|
||||
|
||||
|
|
@ -23,7 +28,7 @@ in
|
|||
};
|
||||
};
|
||||
config = mkIf cfg.enable {
|
||||
services.vaultwarden = {
|
||||
services.vaultwarden = {
|
||||
enable = true;
|
||||
dbBackend = "sqlite";
|
||||
config = {
|
||||
|
|
@ -44,4 +49,3 @@ in
|
|||
};
|
||||
};
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -6,72 +6,78 @@
|
|||
flake-utils.url = "github:numtide/flake-utils";
|
||||
};
|
||||
|
||||
outputs = {
|
||||
self,
|
||||
flake-utils,
|
||||
nix,
|
||||
nixpkgs,
|
||||
...
|
||||
}:
|
||||
flake-utils.lib.eachDefaultSystem (system: let
|
||||
pkgs = (import nixpkgs) {
|
||||
inherit system;
|
||||
};
|
||||
lib = pkgs.lib;
|
||||
in rec {
|
||||
packages = rec {
|
||||
# a modified version of the nixos/nix image
|
||||
# re-using the upstream nix docker image generation code
|
||||
base = import (nix + "/docker.nix") {
|
||||
inherit pkgs;
|
||||
name = "nix-ci-base";
|
||||
maxLayers = 10;
|
||||
extraPkgs = with pkgs; [
|
||||
nodejs_20 # nodejs is needed for running most 3rdparty actions
|
||||
# add any other pre-installed packages here
|
||||
curl
|
||||
xz
|
||||
openssl
|
||||
coreutils-full
|
||||
cmake
|
||||
gnumake
|
||||
gcc
|
||||
];
|
||||
# change this is you want
|
||||
channelURL = "https://nixos.org/channels/nixpkgs-23.11";
|
||||
nixConf = {
|
||||
substituters = [
|
||||
"https://mirrors.bfsu.edu.cn/nix-channels/store"
|
||||
"https://mirrors.ustc.edu.cn/nix-channels/store"
|
||||
"https://cache.nixos.org/"
|
||||
outputs =
|
||||
{
|
||||
self,
|
||||
flake-utils,
|
||||
nix,
|
||||
nixpkgs,
|
||||
...
|
||||
}:
|
||||
flake-utils.lib.eachDefaultSystem (
|
||||
system:
|
||||
let
|
||||
pkgs = (import nixpkgs) { inherit system; };
|
||||
lib = pkgs.lib;
|
||||
in
|
||||
rec {
|
||||
packages = rec {
|
||||
# a modified version of the nixos/nix image
|
||||
# re-using the upstream nix docker image generation code
|
||||
base = import (nix + "/docker.nix") {
|
||||
inherit pkgs;
|
||||
name = "nix-ci-base";
|
||||
maxLayers = 10;
|
||||
extraPkgs = with pkgs; [
|
||||
nodejs_20 # nodejs is needed for running most 3rdparty actions
|
||||
# add any other pre-installed packages here
|
||||
curl
|
||||
xz
|
||||
openssl
|
||||
coreutils-full
|
||||
cmake
|
||||
gnumake
|
||||
gcc
|
||||
];
|
||||
# change this is you want
|
||||
channelURL = "https://nixos.org/channels/nixpkgs-23.11";
|
||||
nixConf = {
|
||||
substituters = [
|
||||
"https://mirrors.bfsu.edu.cn/nix-channels/store"
|
||||
"https://mirrors.ustc.edu.cn/nix-channels/store"
|
||||
"https://cache.nixos.org/"
|
||||
|
||||
"https://nix-community.cachix.org"
|
||||
];
|
||||
accept-flake-config = "true";
|
||||
log-lines = "300";
|
||||
trusted-public-keys = [
|
||||
"cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY="
|
||||
"nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
|
||||
];
|
||||
# allow using the new flake commands in our workflows
|
||||
experimental-features = ["nix-command" "flakes"];
|
||||
"https://nix-community.cachix.org"
|
||||
];
|
||||
accept-flake-config = "true";
|
||||
log-lines = "300";
|
||||
trusted-public-keys = [
|
||||
"cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY="
|
||||
"nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
|
||||
];
|
||||
# allow using the new flake commands in our workflows
|
||||
experimental-features = [
|
||||
"nix-command"
|
||||
"flakes"
|
||||
];
|
||||
};
|
||||
};
|
||||
# make /bin/sleep available on the image
|
||||
runner = pkgs.dockerTools.buildImage {
|
||||
name = "nix-runner";
|
||||
tag = "2.21.0-pkgs-23.11";
|
||||
|
||||
fromImage = base;
|
||||
fromImageName = null;
|
||||
fromImageTag = "latest";
|
||||
|
||||
copyToRoot = pkgs.buildEnv {
|
||||
name = "image-root";
|
||||
paths = [ pkgs.coreutils-full ];
|
||||
pathsToLink = [ "/bin" ]; # add coreutuls (which includes sleep) to /bin
|
||||
};
|
||||
};
|
||||
};
|
||||
# make /bin/sleep available on the image
|
||||
runner = pkgs.dockerTools.buildImage {
|
||||
name = "nix-runner";
|
||||
tag = "2.21.0-pkgs-23.11";
|
||||
|
||||
fromImage = base;
|
||||
fromImageName = null;
|
||||
fromImageTag = "latest";
|
||||
|
||||
copyToRoot = pkgs.buildEnv {
|
||||
name = "image-root";
|
||||
paths = [pkgs.coreutils-full];
|
||||
pathsToLink = ["/bin"]; # add coreutuls (which includes sleep) to /bin
|
||||
};
|
||||
};
|
||||
};
|
||||
});
|
||||
}
|
||||
);
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,4 +1,9 @@
|
|||
{ config, pkgs, lib, ... }:
|
||||
{
|
||||
config,
|
||||
pkgs,
|
||||
lib,
|
||||
...
|
||||
}:
|
||||
|
||||
{
|
||||
nixpkgs.overlays = [
|
||||
|
|
|
|||
|
|
@ -1,3 +1 @@
|
|||
(final: prev: {
|
||||
oidc-agent = prev.callPackage ./pkgs/oidc-agent { };
|
||||
})
|
||||
(final: prev: { oidc-agent = prev.callPackage ./pkgs/oidc-agent { }; })
|
||||
|
|
|
|||
|
|
@ -1,14 +1,15 @@
|
|||
{ lib
|
||||
, stdenv
|
||||
, fetchFromGitHub
|
||||
, curl
|
||||
, webkitgtk
|
||||
, libmicrohttpd
|
||||
, libsecret
|
||||
, qrencode
|
||||
, libsodium
|
||||
, pkg-config
|
||||
, help2man
|
||||
{
|
||||
lib,
|
||||
stdenv,
|
||||
fetchFromGitHub,
|
||||
curl,
|
||||
webkitgtk,
|
||||
libmicrohttpd,
|
||||
libsecret,
|
||||
qrencode,
|
||||
libsodium,
|
||||
pkg-config,
|
||||
help2man,
|
||||
}:
|
||||
|
||||
stdenv.mkDerivation rec {
|
||||
|
|
@ -19,8 +20,7 @@ stdenv.mkDerivation rec {
|
|||
owner = "indigo-dc";
|
||||
repo = "oidc-agent";
|
||||
rev = "v${version}";
|
||||
sha256 = "sha256-cOK/rZ/jnyALLuhDM3+qvwwe4Fjkv8diQBkw7NfVo0c="
|
||||
;
|
||||
sha256 = "sha256-cOK/rZ/jnyALLuhDM3+qvwwe4Fjkv8diQBkw7NfVo0c=";
|
||||
};
|
||||
|
||||
buildInputs = [
|
||||
|
|
@ -47,7 +47,6 @@ stdenv.mkDerivation rec {
|
|||
make install_man PREFIX=$out
|
||||
'';
|
||||
|
||||
|
||||
meta = with lib; {
|
||||
description = "oidc-agent for managing OpenID Connect tokens on the command line";
|
||||
homepage = "https://github.com/indigo-dc/oidc-agent";
|
||||
|
|
@ -55,4 +54,3 @@ stdenv.mkDerivation rec {
|
|||
license = licenses.mit;
|
||||
};
|
||||
}
|
||||
|
||||
|
|
|
|||
Loading…
Reference in a new issue