current
linted
This commit is contained in:
atagen
parent
4e99a0e323
commit
7485de646a
95 changed files with 2743 additions and 2282 deletions
|
|
@ -1,18 +1,15 @@
|
|||
{
|
||||
inputs,
|
||||
outputs,
|
||||
config,
|
||||
lib,
|
||||
pkgs,
|
||||
overlays,
|
||||
modulesPath,
|
||||
...
|
||||
}: {
|
||||
}:
|
||||
{
|
||||
imports = [
|
||||
./configuration.nix
|
||||
];
|
||||
|
||||
nix.settings.trusted-users = ["plank"];
|
||||
nix.settings.trusted-users = [ "plank" ];
|
||||
programs.nh.flake = "/home/plank/.nix";
|
||||
|
||||
boot.kernelParams = [
|
||||
|
|
@ -23,9 +20,18 @@
|
|||
"rd.udev.log_level=3"
|
||||
"vt.global_cursor_default=0"
|
||||
];
|
||||
boot.initrd.availableKernelModules = ["xhci_pci" "nvme" "usb_storage" "sd_mod" "rtsx_pci_sdmmc"];
|
||||
boot.initrd.kernelModules = ["dm-snapshot"];
|
||||
boot.kernelModules = ["iwlwifi" "kvm-intel"];
|
||||
boot.initrd.availableKernelModules = [
|
||||
"xhci_pci"
|
||||
"nvme"
|
||||
"usb_storage"
|
||||
"sd_mod"
|
||||
"rtsx_pci_sdmmc"
|
||||
];
|
||||
boot.initrd.kernelModules = [ "dm-snapshot" ];
|
||||
boot.kernelModules = [
|
||||
"iwlwifi"
|
||||
"kvm-intel"
|
||||
];
|
||||
boot.kernelPackages = pkgs.linuxPackages;
|
||||
|
||||
fileSystems."/boot" = {
|
||||
|
|
@ -39,7 +45,7 @@
|
|||
};
|
||||
|
||||
swapDevices = [
|
||||
{device = "/dev/disk/by-uuid/a732641d-1233-45a7-8614-53caed60f11b";}
|
||||
{ device = "/dev/disk/by-uuid/a732641d-1233-45a7-8614-53caed60f11b"; }
|
||||
];
|
||||
|
||||
boot.loader.systemd-boot.configurationLimit = 2;
|
||||
|
|
@ -66,7 +72,7 @@
|
|||
};
|
||||
};
|
||||
|
||||
services.xserver.videoDrivers = ["i915"];
|
||||
services.xserver.videoDrivers = [ "i915" ];
|
||||
programs.xwayland.enable = true;
|
||||
|
||||
xdg.portal = {
|
||||
|
|
@ -85,6 +91,6 @@
|
|||
networking.hostName = "adrift"; # Define your hostname.
|
||||
users.users.plank = {
|
||||
isNormalUser = true;
|
||||
extraGroups = ["wheel"]; # Enable ‘sudo’ for the user.
|
||||
extraGroups = [ "wheel" ]; # Enable ‘sudo’ for the user.
|
||||
};
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,15 +1,7 @@
|
|||
# WARN: this file will get overwritten by $ cachix use <name>
|
||||
{
|
||||
pkgs,
|
||||
lib,
|
||||
...
|
||||
}: let
|
||||
folder = ./cachix;
|
||||
toImport = name: value: folder + ("/" + name);
|
||||
filterCaches = key: value: value == "regular" && lib.hasSuffix ".nix" key;
|
||||
imports = lib.mapAttrsToList toImport (lib.filterAttrs filterCaches (builtins.readDir folder));
|
||||
in {
|
||||
inherit imports;
|
||||
}:
|
||||
{
|
||||
nix.settings = {
|
||||
substituters = [
|
||||
"https://cache.nixos.org"
|
||||
|
|
@ -20,6 +12,7 @@ in {
|
|||
"https://walker-git.cachix.org"
|
||||
"https://anmonteiro.nix-cache.workers.dev"
|
||||
"https://viperml.cachix.org"
|
||||
"https://drakon64-nixos-cachyos-kernel.cachix.org"
|
||||
];
|
||||
trusted-public-keys = [
|
||||
"cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY="
|
||||
|
|
@ -30,6 +23,7 @@ in {
|
|||
"walker-git.cachix.org-1:vmC0ocfPWh0S/vRAQGtChuiZBTAe4wiKDeyyXM0/7pM="
|
||||
"ocaml.nix-cache.com-1:/xI2h2+56rwFfKyyFVbkJSeGqSIYMC/Je+7XXqGKDIY="
|
||||
"viperml.cachix.org-1:qZhKBMTfmcLL+OG6fj/hzsMEedgKvZVFRRAhq7j8Vh8="
|
||||
"drakon64-nixos-cachyos-kernel.cachix.org-1:J3gjZ9N6S05pyLA/P0M5y7jXpSxO/i0rshrieQJi5D0="
|
||||
];
|
||||
};
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,13 +1,15 @@
|
|||
{
|
||||
inputs,
|
||||
outputs,
|
||||
self,
|
||||
lib,
|
||||
pkgs,
|
||||
mainUser,
|
||||
...
|
||||
}: let
|
||||
}:
|
||||
let
|
||||
getFlakePackage = package: inputs."${package}".packages.x86_64-linux.default;
|
||||
in {
|
||||
in
|
||||
{
|
||||
# these settings propagate to home-manager's nixpkgs
|
||||
nixpkgs = {
|
||||
overlays = [
|
||||
|
|
@ -16,14 +18,12 @@ in {
|
|||
inputs.nil.overlays.nil
|
||||
# inputs.nixd.overlays.default
|
||||
inputs.niri.overlays.niri
|
||||
# outputs.overlays.additions
|
||||
outputs.overlays.rice
|
||||
outputs.overlays.murex
|
||||
outputs.overlays.murex-starship
|
||||
outputs.overlays.murex-jump
|
||||
outputs.overlays.comfyui
|
||||
outputs.overlays.comfyui-plugins
|
||||
# outputs.overlays.sirula
|
||||
self.overlays.rice
|
||||
self.overlays.murex
|
||||
self.overlays.murex-starship
|
||||
self.overlays.murex-jump
|
||||
self.overlays.comfyui
|
||||
self.overlays.comfyui-plugins
|
||||
];
|
||||
config = {
|
||||
allowUnfree = true;
|
||||
|
|
@ -34,10 +34,14 @@ in {
|
|||
|
||||
nix = {
|
||||
# add flake inputs to our registry to allow global use
|
||||
registry = lib.mapAttrs (_: value: {flake = value;}) inputs;
|
||||
registry = lib.mapAttrs (_: value: { flake = value; }) inputs;
|
||||
settings = {
|
||||
# trusted-users = ["bolt" "plank"];
|
||||
experimental-features = ["nix-command" "flakes" "pipe-operator"];
|
||||
experimental-features = [
|
||||
"nix-command"
|
||||
"flakes"
|
||||
"pipe-operator"
|
||||
];
|
||||
substitute = true;
|
||||
};
|
||||
extraOptions = ''
|
||||
|
|
@ -106,12 +110,12 @@ in {
|
|||
|
||||
# services.tailscale.enable = true;
|
||||
|
||||
# TODO - move these to more appropriate places
|
||||
environment.systemPackages = with pkgs; [
|
||||
curl
|
||||
eza
|
||||
git
|
||||
jujutsu
|
||||
nil
|
||||
];
|
||||
|
||||
# services.atuin.enable = true;
|
||||
|
|
@ -136,5 +140,5 @@ in {
|
|||
|
||||
systemd.user.extraConfig = "LogLevel=debug";
|
||||
|
||||
security.pam.services.swaylock = {};
|
||||
system.nixos.tags = [ "fatcock" ];
|
||||
}
|
||||
|
|
|
|||
|
|
@ -2,7 +2,8 @@
|
|||
pkgs,
|
||||
lib,
|
||||
...
|
||||
}: {
|
||||
}:
|
||||
{
|
||||
# perlless activations
|
||||
boot.initrd.systemd.enable = true;
|
||||
# breaks everything
|
||||
|
|
@ -18,7 +19,7 @@
|
|||
programs.command-not-found.enable = false;
|
||||
boot.enableContainers = false;
|
||||
boot.loader.grub.enable = false;
|
||||
environment.defaultPackages = lib.mkDefault [];
|
||||
environment.defaultPackages = lib.mkDefault [ ];
|
||||
documentation.info.enable = false;
|
||||
|
||||
# no cppnix .. ?
|
||||
|
|
|
|||
|
|
@ -1,4 +1,5 @@
|
|||
{pkgs, ...}: {
|
||||
{ pkgs, ... }:
|
||||
{
|
||||
services.desktopManager.cosmic = {
|
||||
enable = true;
|
||||
};
|
||||
|
|
|
|||
|
|
@ -1,4 +1,5 @@
|
|||
{...}: {
|
||||
_:
|
||||
{
|
||||
programs.culr = {
|
||||
enable = true;
|
||||
pattern = "rainbow-split";
|
||||
|
|
|
|||
|
|
@ -1,4 +1,5 @@
|
|||
{pkgs, ...}: {
|
||||
{ pkgs, ... }:
|
||||
{
|
||||
environment.systemPackages = with pkgs; [
|
||||
man-pages
|
||||
man-pages-posix
|
||||
|
|
|
|||
|
|
@ -2,7 +2,8 @@
|
|||
lib,
|
||||
pkgs,
|
||||
...
|
||||
}: let
|
||||
}:
|
||||
let
|
||||
# gives some output like:
|
||||
# Address = [
|
||||
# "10.10.10.10/32"
|
||||
|
|
@ -24,8 +25,14 @@
|
|||
# PublicKey = [
|
||||
# "xxx"
|
||||
# ];
|
||||
inherit (lib) mapAttrs' mapAttrs mapAttrsToList listToAttrs splitString filter filterAttrs length head last;
|
||||
inherit (builtins) readFile readDir;
|
||||
inherit (lib)
|
||||
mapAttrsToList
|
||||
listToAttrs
|
||||
splitString
|
||||
filterAttrs
|
||||
head
|
||||
;
|
||||
inherit (builtins) readDir;
|
||||
# parseMullvad = file: {
|
||||
# name = head (splitString "." file);
|
||||
# value = listToAttrs (map (entry: {
|
||||
|
|
@ -38,24 +45,19 @@
|
|||
# };
|
||||
# definitions =
|
||||
# map parseMullvad (getFiles ../../mullvad);
|
||||
getFiles = path:
|
||||
mapAttrsToList (n: v: n)
|
||||
(filterAttrs (n: v: v == "regular")
|
||||
(readDir path));
|
||||
in {
|
||||
environment.systemPackages = [pkgs.wireguard-tools.out];
|
||||
networking.wg-quick.interfaces = listToAttrs (map (f: rec {
|
||||
getFiles = path: mapAttrsToList (n: _v: n) (filterAttrs (_n: v: v == "regular") (readDir path));
|
||||
in
|
||||
{
|
||||
environment.systemPackages = [ pkgs.wireguard-tools.out ];
|
||||
networking.wg-quick.interfaces = listToAttrs (
|
||||
map (f: rec {
|
||||
name = head (splitString "." f);
|
||||
value = {
|
||||
autostart =
|
||||
if (name == "au-syd-wg-101")
|
||||
then true
|
||||
else false;
|
||||
autostart = if (name == "au-syd-wg-101") then true else false;
|
||||
configFile = builtins.toString ../../mullvad/${f};
|
||||
};
|
||||
})
|
||||
(getFiles
|
||||
../../mullvad));
|
||||
}) (getFiles ../../mullvad)
|
||||
);
|
||||
# listToAttrs (map ({
|
||||
# name,
|
||||
# value,
|
||||
|
|
|
|||
|
|
@ -1,4 +1,5 @@
|
|||
{pkgs,...}: {
|
||||
{ ... }:
|
||||
{
|
||||
# imports = [
|
||||
# ./mullvad.nix
|
||||
# ];
|
||||
|
|
@ -6,7 +7,11 @@
|
|||
systemd.services.NetworkManager-wait-online.enable = true; # for some reason nm doesn't enable without this
|
||||
services.resolved = {
|
||||
enable = true;
|
||||
fallbackDns = ["103.1.206.179" "168.138.8.38" "168.138.12.137"];
|
||||
fallbackDns = [
|
||||
"103.1.206.179"
|
||||
"168.138.8.38"
|
||||
"168.138.12.137"
|
||||
];
|
||||
dnssec = "false";
|
||||
};
|
||||
services.mullvad-vpn.enable = true;
|
||||
|
|
|
|||
|
|
@ -1,19 +1,23 @@
|
|||
{
|
||||
pkgs,
|
||||
lib,
|
||||
mainUser,
|
||||
...
|
||||
}: {
|
||||
}:
|
||||
{
|
||||
services.greetd = {
|
||||
enable = true;
|
||||
restart = false;
|
||||
settings = let session = {
|
||||
command = "niri-session";
|
||||
user = "${mainUser}";
|
||||
}; in {
|
||||
default_session = session;
|
||||
initial_session = session;
|
||||
};
|
||||
settings =
|
||||
let
|
||||
session = {
|
||||
command = "niri-session";
|
||||
user = "${mainUser}";
|
||||
};
|
||||
in
|
||||
{
|
||||
default_session = session;
|
||||
initial_session = session;
|
||||
};
|
||||
};
|
||||
programs.niri = {
|
||||
enable = true;
|
||||
|
|
|
|||
|
|
@ -1,8 +1,11 @@
|
|||
{pkgs, ...}: {
|
||||
{ pkgs, ... }:
|
||||
{
|
||||
environment.systemPackages = with pkgs; [
|
||||
# nixd
|
||||
home-manager
|
||||
cachix
|
||||
alejandra
|
||||
nixfmt-rfc-style
|
||||
nil
|
||||
statix
|
||||
deadnix
|
||||
];
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,4 +1,5 @@
|
|||
{...}: {
|
||||
_:
|
||||
{
|
||||
security.rtkit.enable = true;
|
||||
services.pipewire = {
|
||||
enable = true;
|
||||
|
|
|
|||
|
|
@ -1,10 +1,8 @@
|
|||
{
|
||||
lib,
|
||||
pkgs,
|
||||
stable-diffusion,
|
||||
automatic-webui,
|
||||
...
|
||||
}: {
|
||||
}:
|
||||
{
|
||||
systemd.services.stable-diffusion = {
|
||||
description = "stable diffusion + AUTOMATIC1111 ui";
|
||||
serviceConfig = {
|
||||
|
|
|
|||
|
|
@ -1,6 +1,7 @@
|
|||
{...}: {
|
||||
_:
|
||||
{
|
||||
time.timeZone = "Australia/Sydney";
|
||||
time.hardwareClockInLocalTime = false;
|
||||
i18n.defaultLocale = "en_AU.UTF-8";
|
||||
i18n.supportedLocales = ["en_AU.UTF-8/UTF-8"];
|
||||
i18n.supportedLocales = [ "en_AU.UTF-8/UTF-8" ];
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,4 +1,5 @@
|
|||
{...}: {
|
||||
_:
|
||||
{
|
||||
boot.loader.systemd-boot.consoleMode = "max";
|
||||
boot.loader.timeout = 3;
|
||||
boot.loader.systemd-boot.enable = true;
|
||||
|
|
|
|||
|
|
@ -1,13 +1,15 @@
|
|||
{pkgs, ...}: let
|
||||
{ pkgs, ... }:
|
||||
let
|
||||
inherit (pkgs) murex zsh elvish;
|
||||
in {
|
||||
environment.pathsToLink = ["/share/zsh"];
|
||||
in
|
||||
{
|
||||
environment.pathsToLink = [ "/share/zsh" ];
|
||||
programs.zsh.enable = true;
|
||||
environment.systemPackages = [
|
||||
murex
|
||||
elvish
|
||||
];
|
||||
environment.shells = [murex];
|
||||
environment.shells = [ murex ];
|
||||
users.defaultUserShell = murex;
|
||||
# users.defaultUserShell = zsh;
|
||||
console = {
|
||||
|
|
|
|||
|
|
@ -2,15 +2,17 @@
|
|||
config,
|
||||
lib,
|
||||
pkgs,
|
||||
mainUser,
|
||||
inputs,
|
||||
...
|
||||
}: {
|
||||
}:
|
||||
{
|
||||
imports = [
|
||||
./configuration.nix
|
||||
];
|
||||
|
||||
services.ollama.enable = true;
|
||||
services.ollama = {
|
||||
enable = true;
|
||||
user = "ollama";
|
||||
};
|
||||
|
||||
system.stateVersion = "22.11"; # Did you read the comment?
|
||||
|
||||
|
|
@ -24,9 +26,17 @@
|
|||
];
|
||||
};
|
||||
|
||||
boot.initrd.availableKernelModules = ["xhci_pci" "ahci" "usbcore" "sd_mod"];
|
||||
boot.initrd.kernelModules = [];
|
||||
boot.kernelModules = ["kvm-amd" "i2c-dev"];
|
||||
boot.initrd.availableKernelModules = [
|
||||
"xhci_pci"
|
||||
"ahci"
|
||||
"usbcore"
|
||||
"sd_mod"
|
||||
];
|
||||
boot.initrd.kernelModules = [ ];
|
||||
boot.kernelModules = [
|
||||
"kvm-amd"
|
||||
"i2c-dev"
|
||||
];
|
||||
boot.kernelParams = [
|
||||
"mitigations=off"
|
||||
# "acpi_enforce_resources=lax"
|
||||
|
|
@ -38,7 +48,8 @@
|
|||
"vt.global_cursor_default=0"
|
||||
];
|
||||
|
||||
boot.kernelPackages = pkgs.linuxPackages_xanmod_latest;
|
||||
boot.kernelPackages = pkgs.linuxPackagesFor pkgs.linuxPackages_cachyos;
|
||||
# pkgs.linuxPackages_xanmod_latest;
|
||||
boot.supportedFilesystems = {
|
||||
ntfs = true;
|
||||
btrfs = true;
|
||||
|
|
@ -53,7 +64,10 @@
|
|||
|
||||
hardware.cpu.amd.updateMicrocode = true;
|
||||
|
||||
environment.pathsToLink = ["/share/xdg-desktop-portal" "/share/applications"];
|
||||
environment.pathsToLink = [
|
||||
"/share/xdg-desktop-portal"
|
||||
"/share/applications"
|
||||
];
|
||||
environment.sessionVariables = {
|
||||
NIXOS_OZONE_WL = "1";
|
||||
# ZSH_AUTOSUGGEST_HIGHLIGHT_STYLE = "fg=5";
|
||||
|
|
@ -66,7 +80,7 @@
|
|||
EDITOR = "hx";
|
||||
};
|
||||
|
||||
nix.settings.trusted-users = ["bolt"];
|
||||
nix.settings.trusted-users = [ "bolt" ];
|
||||
|
||||
virtualisation.lxc = {
|
||||
unprivilegedContainers = true;
|
||||
|
|
@ -82,7 +96,7 @@
|
|||
};
|
||||
};
|
||||
|
||||
services.xserver.videoDrivers = ["nvidia"];
|
||||
services.xserver.videoDrivers = [ "nvidia" ];
|
||||
hardware.nvidia = {
|
||||
package = config.boot.kernelPackages.nvidiaPackages.latest;
|
||||
modesetting.enable = true;
|
||||
|
|
@ -108,19 +122,15 @@
|
|||
# motherboard = "amd";
|
||||
# };
|
||||
|
||||
hardware.ckb-next = {
|
||||
enable = true;
|
||||
# package = inputs.nixpkgs-stable.legacyPackages.x86_64-linux.ckb-next;
|
||||
};
|
||||
|
||||
hardware.ckb-next.enable = true;
|
||||
environment.systemPackages = builtins.attrValues {
|
||||
inherit
|
||||
(pkgs)
|
||||
inherit (pkgs)
|
||||
wl-clipboard
|
||||
wl-clipboard-x11
|
||||
xclip
|
||||
;
|
||||
};
|
||||
programs.fuse.userAllowOther = true;
|
||||
|
||||
fileSystems = {
|
||||
"/" = {
|
||||
|
|
@ -136,18 +146,34 @@
|
|||
"/data" = {
|
||||
device = "/dev/disk/by-uuid/39D4F78C658E8B56";
|
||||
fsType = "ntfs";
|
||||
options = ["rw" "uid=1000" "gid=100"];
|
||||
options = [
|
||||
"rw"
|
||||
"uid=1000"
|
||||
"gid=100"
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
swapDevices = [
|
||||
{device = "/dev/disk/by-uuid/9c006925-e0e9-4165-bc0c-508ae2d1bfce";}
|
||||
{ device = "/dev/disk/by-uuid/9c006925-e0e9-4165-bc0c-508ae2d1bfce"; }
|
||||
];
|
||||
|
||||
# networking.nftables.enable = true;
|
||||
networking.firewall = {
|
||||
# allowedUDPPorts = [1900];
|
||||
# allowedTCPPorts = [8200 2234];
|
||||
allowedTCPPorts = [2234];
|
||||
allowedTCPPorts = [ 2234 ];
|
||||
};
|
||||
|
||||
services.open-webui = {
|
||||
enable = true;
|
||||
port = 8088;
|
||||
environment = {
|
||||
DO_NOT_TRACK = "True";
|
||||
SCARF_NO_ANALYTICS = "True";
|
||||
ANONYMIZED_TELEMETRY = "False";
|
||||
WEBUI_AUTH = "False";
|
||||
DATABASE_URL = "sqlite:///${config.services.open-webui.stateDir}/newdb.db";
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
|
|||
|
|
@ -2,11 +2,11 @@
|
|||
# your system. Help is available in the configuration.nix(5) man page
|
||||
# and in the NixOS manual (accessible by running ‘nixos-help’).
|
||||
{
|
||||
lib,
|
||||
config,
|
||||
pkgs,
|
||||
...
|
||||
}: let
|
||||
}:
|
||||
let
|
||||
wekan-compose = pkgs.fetchurl {
|
||||
url = "https://github.com/wekan/wekan/raw/v6.68/docker-compose.yml";
|
||||
sha256 = "sha256-gLZ8bZZ8ZMo1NGz3ooIgXRH6JuMoEMp+to7lfqAvc6E=";
|
||||
|
|
@ -18,18 +18,15 @@
|
|||
# sed -i 's/80:8080/7897:8080/g' $out
|
||||
# sed -i 's/ROOT_URL=.*/ROOT_URL=https:\/\/reflector\.beam\/kanban\//' $out
|
||||
# '';
|
||||
wekan-rhizome = pkgs.runCommand "wekan-rhizome" {} ''
|
||||
wekan-rhizome = pkgs.runCommand "wekan-rhizome" { } ''
|
||||
cp ${wekan-compose} $out
|
||||
sed -i '/localtime/d' $out
|
||||
sed -i '/timezone/d' $out
|
||||
sed -i 's/80:8080/7897:8080/g' $out
|
||||
sed -i 's/ROOT_URL=.*/ROOT_URL=https:\/\/board\.rhizome\.tf\//' $out
|
||||
'';
|
||||
foswiki-compose = pkgs.fetchurl {
|
||||
url = "https://raw.githubusercontent.com/timlegge/docker-foswiki/master/docker-compose.1-simple.yml";
|
||||
sha256 = "sha256-XqGWGTZ/URKsIdDEEpBQUK7xoIdZ164lRhHEiWdnKpM=";
|
||||
};
|
||||
in {
|
||||
in
|
||||
{
|
||||
imports = [
|
||||
# Include the results of the hardware scan.
|
||||
./hardware-configuration.nix
|
||||
|
|
@ -41,7 +38,10 @@ in {
|
|||
# "nix-community"
|
||||
# ];
|
||||
|
||||
nix.settings.experimental-features = ["flakes" "nix-command"];
|
||||
nix.settings.experimental-features = [
|
||||
"flakes"
|
||||
"nix-command"
|
||||
];
|
||||
# systemd.services.NetworkManager-wait-online.enable = false;
|
||||
|
||||
# Use the GRUB 2 boot loader.
|
||||
|
|
@ -58,8 +58,8 @@ in {
|
|||
# Define a user account. Don't forget to set a password with ‘passwd’.
|
||||
users.users.sunshine = {
|
||||
isNormalUser = true;
|
||||
extraGroups = ["wheel"]; # Enable ‘sudo’ for the user.
|
||||
packages = with pkgs; [];
|
||||
extraGroups = [ "wheel" ]; # Enable ‘sudo’ for the user.
|
||||
packages = with pkgs; [ ];
|
||||
openssh.authorizedKeys.keys = [
|
||||
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDSQC8VgKLzoU5BSynJJuC8BFqAEN8JlSIzsZ2Vg9rfXHM7T4vbWtnxSCSbNw3CEnZCfrdDQTeRum7Uq+gvrcHWd9Aj+rVmubTdud70ybW7T7SlGv3b5TYBhMNbrAz0JIJjLnFMy3/pWids1v6mKW3i7k6Kbq8fSt7jva5Yg5x1jtkUUwvjSZjPg/E/Zl0hAcnx8fWe4foFTcYYsUbfEpp6bxdN2QuVmb17UKnLrMz6JTj88Jd2uYZkeKxGOwk+uwrd0WArY8JIiRi1NcPA3I42aAQfZKxCUY/xmVyRlF+l6K8caD4CZlysms9aXQzBhmPPDIY87AwyRlVK5JsRbaMEBMsffX2xk8DdV+2+9RbztgeXOoYk7WjJX1/+WcxY3RGn8QsUfrGALmrQTRGXgYRbtM/ZJq1m9aP6IvVQeKE1NOpKguXpmokB7JsyKPcWk/PCMVYyXM/qYspc6hRPJgGWiJsayj7myO6X5Ssl9uQnHpNNyrQNY+cx3/boBu2J1sM= bolt@quiver"
|
||||
];
|
||||
|
|
@ -113,7 +113,11 @@ in {
|
|||
enable = true;
|
||||
serverUrl = "https://net.atagen.co";
|
||||
dns = {
|
||||
nameservers = ["103.1.206.179" "168.138.8.38" "168.138.12.137"];
|
||||
nameservers = [
|
||||
"103.1.206.179"
|
||||
"168.138.8.38"
|
||||
"168.138.12.137"
|
||||
];
|
||||
magicDns = true;
|
||||
};
|
||||
};
|
||||
|
|
@ -147,27 +151,33 @@ in {
|
|||
isSystemUser = true;
|
||||
createHome = true;
|
||||
group = "ci";
|
||||
extraGroups = ["docker" "wheel"];
|
||||
extraGroups = [
|
||||
"docker"
|
||||
"wheel"
|
||||
];
|
||||
};
|
||||
users.groups.ci = {};
|
||||
users.groups.ci = { };
|
||||
|
||||
users.users.ci-agent = {
|
||||
isSystemUser = true;
|
||||
createHome = true;
|
||||
group = "ci";
|
||||
extraGroups = ["docker" "wheel"];
|
||||
extraGroups = [
|
||||
"docker"
|
||||
"wheel"
|
||||
];
|
||||
};
|
||||
users.groups.ci = {};
|
||||
users.groups.ci = { };
|
||||
|
||||
users.users.dufs = {
|
||||
isSystemUser = true;
|
||||
createHome = true;
|
||||
group = "dufs";
|
||||
};
|
||||
users.groups.dufs = {};
|
||||
users.groups.dufs = { };
|
||||
|
||||
systemd.services.woodpecker-server = {
|
||||
wantedBy = ["multi-user.target"];
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
description = "woodpecker CI/CD server";
|
||||
serviceConfig = {
|
||||
Environment = [
|
||||
|
|
@ -191,7 +201,7 @@ in {
|
|||
};
|
||||
|
||||
systemd.services.woodpecker-agent = {
|
||||
wantedBy = ["multi-user.target"];
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
description = "woodpecker CI/CD agent";
|
||||
serviceConfig = {
|
||||
Environment = [
|
||||
|
|
@ -218,9 +228,12 @@ in {
|
|||
# };
|
||||
|
||||
systemd.services.wekan-rhizome = {
|
||||
wantedBy = ["multi-user.target"];
|
||||
after = ["network.target" "docker.service"];
|
||||
requires = ["docker.service"];
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
after = [
|
||||
"network.target"
|
||||
"docker.service"
|
||||
];
|
||||
requires = [ "docker.service" ];
|
||||
description = "wekan kanban board for rhizomers";
|
||||
serviceConfig = {
|
||||
Restart = "always";
|
||||
|
|
@ -231,8 +244,8 @@ in {
|
|||
};
|
||||
|
||||
systemd.services.dufs = {
|
||||
wantedBy = ["multi-user.target"];
|
||||
after = ["network.target"];
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
after = [ "network.target" ];
|
||||
description = "dufs webdav server";
|
||||
serviceConfig = {
|
||||
User = "dufs";
|
||||
|
|
@ -258,7 +271,7 @@ in {
|
|||
enable = true;
|
||||
virtualHosts = {
|
||||
"atagen.co" = {
|
||||
serverAliases = ["www.atagen.co"];
|
||||
serverAliases = [ "www.atagen.co" ];
|
||||
extraConfig = ''
|
||||
respond "i live.. again"
|
||||
'';
|
||||
|
|
@ -318,10 +331,19 @@ in {
|
|||
|
||||
networking.firewall = {
|
||||
enable = true;
|
||||
trustedInterfaces = ["tailscale0"];
|
||||
trustedInterfaces = [ "tailscale0" ];
|
||||
checkReversePath = "loose";
|
||||
allowedTCPPorts = [80 443 6660];
|
||||
allowedUDPPorts = [80 443 41641 6660];
|
||||
allowedTCPPorts = [
|
||||
80
|
||||
443
|
||||
6660
|
||||
];
|
||||
allowedUDPPorts = [
|
||||
80
|
||||
443
|
||||
41641
|
||||
6660
|
||||
];
|
||||
};
|
||||
|
||||
# Copy the NixOS configuration file and link it from the resulting system
|
||||
|
|
|
|||
|
|
@ -2,30 +2,33 @@
|
|||
# your system. Help is available in the configuration.nix(5) man page
|
||||
# and in the NixOS manual (accessible by running `nixos-help`).
|
||||
{
|
||||
config,
|
||||
pkgs,
|
||||
lib,
|
||||
...
|
||||
}: {
|
||||
}:
|
||||
{
|
||||
imports = [
|
||||
# Include the results of the hardware scan.
|
||||
./hardware-configuration.nix
|
||||
];
|
||||
|
||||
nix.settings.experimental-features = ["nix-command" "flakes"];
|
||||
nix.settings.experimental-features = [
|
||||
"nix-command"
|
||||
"flakes"
|
||||
];
|
||||
nix.extraOptions = ''
|
||||
keep-outputs = true
|
||||
keep-derivations = true
|
||||
'';
|
||||
|
||||
environment.pathsToLink = ["/share/zsh"];
|
||||
environment.pathsToLink = [ "/share/zsh" ];
|
||||
programs.zsh.enable = true;
|
||||
users.defaultUserShell = pkgs.zsh;
|
||||
|
||||
users.users.felix = {
|
||||
isSystemUser = true;
|
||||
group = "www";
|
||||
extraGroups = ["docker"];
|
||||
extraGroups = [ "docker" ];
|
||||
};
|
||||
|
||||
users.users.spore = {
|
||||
|
|
@ -34,14 +37,18 @@
|
|||
createHome = true;
|
||||
useDefaultShell = true;
|
||||
group = "www";
|
||||
extraGroups = ["docker"];
|
||||
extraGroups = [ "docker" ];
|
||||
openssh.authorizedKeys.keys = [
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIL9VRcCnmjCyV7DpCm8ir3+xPTbyMDBJhgSkhpmdFL5d spore@server.rhizome.tf"
|
||||
];
|
||||
};
|
||||
|
||||
users.groups.www = {
|
||||
members = ["acme" "felix" "spore"];
|
||||
members = [
|
||||
"acme"
|
||||
"felix"
|
||||
"spore"
|
||||
];
|
||||
};
|
||||
|
||||
boot.loader.grub.enable = true;
|
||||
|
|
@ -54,7 +61,7 @@
|
|||
|
||||
users.users.rhizome = {
|
||||
isNormalUser = true;
|
||||
extraGroups = ["wheel"]; # Enable ‘sudo’ for the user.
|
||||
extraGroups = [ "wheel" ]; # Enable ‘sudo’ for the user.
|
||||
openssh.authorizedKeys.keys = [
|
||||
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDSQC8VgKLzoU5BSynJJuC8BFqAEN8JlSIzsZ2Vg9rfXHM7T4vbWtnxSCSbNw3CEnZCfrdDQTeRum7Uq+gvrcHWd9Aj+rVmubTdud70ybW7T7SlGv3b5TYBhMNbrAz0JIJjLnFMy3/pWids1v6mKW3i7k6Kbq8fSt7jva5Yg5x1jtkUUwvjSZjPg/E/Zl0hAcnx8fWe4foFTcYYsUbfEpp6bxdN2QuVmb17UKnLrMz6JTj88Jd2uYZkeKxGOwk+uwrd0WArY8JIiRi1NcPA3I42aAQfZKxCUY/xmVyRlF+l6K8caD4CZlysms9aXQzBhmPPDIY87AwyRlVK5JsRbaMEBMsffX2xk8DdV+2+9RbztgeXOoYk7WjJX1/+WcxY3RGn8QsUfrGALmrQTRGXgYRbtM/ZJq1m9aP6IvVQeKE1NOpKguXpmokB7JsyKPcWk/PCMVYyXM/qYspc6hRPJgGWiJsayj7myO6X5Ssl9uQnHpNNyrQNY+cx3/boBu2J1sM= bolt@quiver"
|
||||
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDW/YjnlHiEf2bV0RapVl+jWEtsNYrbXsaJJhXUkAaf61rsTZ2jpda7FmOVGjyJiOkTNYANoT83YhGxvKt3Ukcx5xG0JhcrilEGKfOR43/QLlXetCh4aFed//CXYNQo8obDovx9A8YamzfZWJo0nhshEAt1aDvNGlyPgHZI3r5vYNB6OpMlaSnr873i5hp6S9dxURoF0FjpdZwTWk5DiYUoZCezs6TfG6PzHbSsB88o4AUNZ6O+h1KD0lITSXH/v/M1zG8fkUzfZHFQoZ6VaIMhIVwLmbybvyb630IIfhx6KUoCWzCRlKBjVOGsQ1xZWEnjPgHB6atX5eNc/L8/bdyZOJ4aE2wSdVNMyriYuiyc3t/RwSvcRpfmzaxWUImDpjH3mxCrDymrZIQQTrNuC6o5O3mz3NCZRcFUZmuZXeYphyrzuNgAfsvHKMd8Fu+PdddSPCHkgYEIRuGD4flaujM8eUHZYqKkpmmiMwKk6jupBscN+1uwBqGQbaR0InXR+4c= custard"
|
||||
|
|
@ -65,17 +72,17 @@
|
|||
isSystemUser = true;
|
||||
createHome = true;
|
||||
group = "ci";
|
||||
extraGroups = ["docker"];
|
||||
extraGroups = [ "docker" ];
|
||||
};
|
||||
|
||||
users.users.ci-agent = {
|
||||
isSystemUser = true;
|
||||
createHome = true;
|
||||
group = "ci";
|
||||
extraGroups = ["docker"];
|
||||
extraGroups = [ "docker" ];
|
||||
};
|
||||
|
||||
users.groups.ci = {};
|
||||
users.groups.ci = { };
|
||||
|
||||
virtualisation = {
|
||||
docker.enable = true;
|
||||
|
|
@ -137,7 +144,7 @@
|
|||
};
|
||||
|
||||
systemd.services.woodpecker-server = {
|
||||
wantedBy = ["multi-user.target"];
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
description = "woodpecker CI/CD server";
|
||||
serviceConfig = {
|
||||
Environment = [
|
||||
|
|
@ -161,7 +168,7 @@
|
|||
};
|
||||
|
||||
systemd.services.woodpecker-agent = {
|
||||
wantedBy = ["multi-user.target"];
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
description = "woodpecker CI/CD agent";
|
||||
serviceConfig = {
|
||||
Environment = [
|
||||
|
|
@ -175,7 +182,7 @@
|
|||
};
|
||||
|
||||
systemd.services.felix = {
|
||||
wantedBy = ["multi-user.target"];
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
description = "gilles on testing";
|
||||
serviceConfig = {
|
||||
ExecStart = ''${lib.getExe pkgs.docker} run --network host -v /var/lib/acme/rhizome.tf:/var/lib/acme/rhizome.tf --env-file /var/www/felix_env git.rhizome.tf/rhizome/gilles:latest'';
|
||||
|
|
@ -250,8 +257,18 @@
|
|||
permitRootLogin = "no";
|
||||
};
|
||||
|
||||
networking.firewall.allowedTCPPorts = [22 80 443 5539 5559 6660];
|
||||
networking.firewall.allowedUDPPorts = [443 6660];
|
||||
networking.firewall.allowedTCPPorts = [
|
||||
22
|
||||
80
|
||||
443
|
||||
5539
|
||||
5559
|
||||
6660
|
||||
];
|
||||
networking.firewall.allowedUDPPorts = [
|
||||
443
|
||||
6660
|
||||
];
|
||||
|
||||
security.acme = {
|
||||
acceptTerms = true;
|
||||
|
|
|
|||
|
|
@ -21,33 +21,33 @@
|
|||
};
|
||||
};
|
||||
|
||||
outputs = {
|
||||
self,
|
||||
nixpkgs,
|
||||
home-manager,
|
||||
nix-index-database,
|
||||
...
|
||||
} @ inputs: let
|
||||
inherit (self) outputs;
|
||||
forAllSystems = nixpkgs.lib.genAttrs [
|
||||
"x86_64-linux"
|
||||
];
|
||||
in rec {
|
||||
nixosConfigurations = {
|
||||
"filament" = nixpkgs.lib.nixosSystem {
|
||||
system = "x86_64-linux";
|
||||
specialArgs = {inherit inputs outputs;};
|
||||
modules = [
|
||||
./configuration.nix
|
||||
nix-index-database.nixosModules.nix-index
|
||||
home-manager.nixosModules.home-manager
|
||||
{
|
||||
home-manager.useGlobalPkgs = true;
|
||||
home-manager.extraSpecialArgs = {inherit inputs outputs;};
|
||||
home-manager.users.rhizome.imports = [./rhizome.nix];
|
||||
} # hm
|
||||
]; # modules
|
||||
}; # filament
|
||||
};
|
||||
}; # rec
|
||||
outputs =
|
||||
{
|
||||
self,
|
||||
nixpkgs,
|
||||
home-manager,
|
||||
nix-index-database,
|
||||
...
|
||||
}@inputs:
|
||||
let
|
||||
inherit (self) outputs;
|
||||
in
|
||||
rec {
|
||||
nixosConfigurations = {
|
||||
"filament" = nixpkgs.lib.nixosSystem {
|
||||
system = "x86_64-linux";
|
||||
specialArgs = { inherit inputs outputs; };
|
||||
modules = [
|
||||
./configuration.nix
|
||||
nix-index-database.nixosModules.nix-index
|
||||
home-manager.nixosModules.home-manager
|
||||
{
|
||||
home-manager.useGlobalPkgs = true;
|
||||
home-manager.extraSpecialArgs = { inherit inputs outputs; };
|
||||
home-manager.users.rhizome.imports = [ ./rhizome.nix ];
|
||||
} # hm
|
||||
]; # modules
|
||||
}; # filament
|
||||
};
|
||||
}; # rec
|
||||
}
|
||||
|
|
|
|||
|
|
@ -2,25 +2,29 @@
|
|||
# and may be overwritten by future invocations. Please make changes
|
||||
# to /etc/nixos/configuration.nix instead.
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
pkgs,
|
||||
modulesPath,
|
||||
...
|
||||
}: {
|
||||
imports = [];
|
||||
}:
|
||||
{
|
||||
imports = [ ];
|
||||
|
||||
boot.initrd.availableKernelModules = ["ata_piix" "uhci_hcd" "virtio_pci" "sr_mod" "virtio_blk"];
|
||||
boot.initrd.kernelModules = [];
|
||||
boot.kernelModules = [];
|
||||
boot.extraModulePackages = [];
|
||||
boot.initrd.availableKernelModules = [
|
||||
"ata_piix"
|
||||
"uhci_hcd"
|
||||
"virtio_pci"
|
||||
"sr_mod"
|
||||
"virtio_blk"
|
||||
];
|
||||
boot.initrd.kernelModules = [ ];
|
||||
boot.kernelModules = [ ];
|
||||
boot.extraModulePackages = [ ];
|
||||
|
||||
fileSystems."/" = {
|
||||
device = "/dev/disk/by-uuid/f4889546-f71c-4e3c-ab47-e183a72dc52e";
|
||||
fsType = "ext4";
|
||||
};
|
||||
|
||||
swapDevices = [];
|
||||
swapDevices = [ ];
|
||||
|
||||
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
|
||||
# (the default) this is the recommended approach. When using systemd-networkd it's
|
||||
|
|
|
|||
|
|
@ -1,11 +1,8 @@
|
|||
{
|
||||
inputs,
|
||||
outputs,
|
||||
lib,
|
||||
config,
|
||||
pkgs,
|
||||
...
|
||||
}: {
|
||||
}:
|
||||
{
|
||||
home.packages = with pkgs; [
|
||||
lazygit
|
||||
alejandra
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue