diff --git a/flake.lock b/flake.lock index e68dfe83..e2d0ff2d 100644 --- a/flake.lock +++ b/flake.lock @@ -443,19 +443,20 @@ "inputs": { "nixpkgs": [ "nixos" - ] + ], + "utils": "utils_2" }, "locked": { - "lastModified": 1656169755, - "narHash": "sha256-Nlnm4jeQWEGjYrE6hxi/7HYHjBSZ/E0RtjCYifnNsWk=", + "lastModified": 1670156115, + "narHash": "sha256-L2FKLedprp3AkQ+GS+2Br7CYWeCmLCjt3zUd87p0lNQ=", "owner": "nix-community", "repo": "home-manager", - "rev": "4a3d01fb53f52ac83194081272795aa4612c2381", + "rev": "e704ef9ec7a8ccf8711bb11ff68da06f1917a26d", "type": "github" }, "original": { "owner": "nix-community", - "ref": "release-22.05", + "ref": "release-22.11", "repo": "home-manager", "type": "github" } @@ -557,16 +558,16 @@ }, "nixos": { "locked": { - "lastModified": 1667327283, - "narHash": "sha256-XEMEmRwv0lrhV8OFn1+dsEJovTDmn94zEjfxMfAoLIc=", + "lastModified": 1670157845, + "narHash": "sha256-epO16PPDkhYicQWQkSYZxU3tJAML/rF0FESR6BMTpYw=", "owner": "nixos", "repo": "nixpkgs", - "rev": "c9a1090e19f93cb30c205682aab2d0989f8de91f", + "rev": "267a3d939c3aa4cea15d3b1ccac59f5e29c05bb3", "type": "github" }, "original": { "owner": "nixos", - "ref": "release-22.05", + "ref": "release-22.11", "repo": "nixpkgs", "type": "github" } @@ -804,7 +805,7 @@ ], "superdirt-src": "superdirt-src", "tidal-src": "tidal-src", - "utils": "utils_2", + "utils": "utils_3", "vim-tidal-src": "vim-tidal-src", "vowel-src": "vowel-src" }, @@ -838,6 +839,21 @@ } }, "utils_2": { + "locked": { + "lastModified": 1667395993, + "narHash": "sha256-nuEHfE/LcWyuSWnS8t12N1wc105Qtau+/OdUAjtQ0rA=", + "owner": "numtide", + "repo": "flake-utils", + "rev": "5aed5285a952e0b949eb3ba02c12fa4fcfef535f", + "type": "github" + }, + "original": { + "owner": "numtide", + "repo": "flake-utils", + "type": "github" + } + }, + "utils_3": { "locked": { "lastModified": 1653893745, "narHash": "sha256-0jntwV3Z8//YwuOjzhV2sgJJPt+HY6KhU7VZUL0fKZQ=", diff --git a/flake.nix b/flake.nix index f6172c71..24d740d1 100644 --- a/flake.nix +++ b/flake.nix @@ -4,10 +4,10 @@ inputs = { # Nix - nixos.url = "github:nixos/nixpkgs/release-22.05"; + nixos.url = "github:nixos/nixpkgs/release-22.11"; latest.url = "github:nixos/nixpkgs/nixos-unstable"; # Community - home.url = "github:nix-community/home-manager/release-22.05"; + home.url = "github:nix-community/home-manager/release-22.11"; home.inputs.nixpkgs.follows = "nixos"; nixos-hardware.url = "github:nixos/nixos-hardware"; # Lib @@ -52,6 +52,9 @@ # TODO not quite useful yet, since it needs secrets # dhyan.url = "git+ssh://gitea@git.sealight.xyz/aynish/dhyan?ref=main"; # dhyan.inputs.nixpkgs.follows = "nixos"; + # TODO needs secrets + # muneem.url = "git+ssh://gitea@git.sealight.xyz/aynish/muneem?ref=main"; + # muneem.inputs.nixpkgs.follows = "nixos"; }; outputs = @@ -91,7 +94,7 @@ deploy.overlay ./pkgs/default.nix tidalcycles.overlays.default - neovim-nightly.overlay + # neovim-nightly.overlay rust-overlay.overlays.default eww.overlays.default ]; @@ -148,7 +151,7 @@ }; suites = with profiles; rec { base = [ core users.root users.anish ]; - sealight = [ base server metrics gitea rss-bridge mount-mossnet ]; + sealight = [ base server metrics gitea rss-bridge mount-mossnet freshrss ]; lituus = [ base server metrics sealight-website matrix wireguard-server ]; mossnet = [ base server taskd shaarli dns monitoring nfs gonic headphones radicale seafile syncthing dhyan calibre wallabag finance ]; # hpi sync.music muneem cube = [ base site server ]; diff --git a/install-encrypted.sh b/install-encrypted.sh index e044cd56..c395c8b6 100755 --- a/install-encrypted.sh +++ b/install-encrypted.sh @@ -112,7 +112,7 @@ cat >> /mnt/etc/nixos/configuration.nix <<'endmsg' # this value at the release version of the first install of this system. # Before changing this value read the documentation for this option # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html). - system.stateVersion = "21.05"; # Did you read the comment? + system.stateVersion = "22.11"; # Did you read the comment? } endmsg diff --git a/install-yubikey.sh b/install-yubikey.sh index 2ddac5b9..b9b713ff 100755 --- a/install-yubikey.sh +++ b/install-yubikey.sh @@ -162,7 +162,7 @@ cat > /mnt/etc/nixos/configuration.nix <<'endmsg' # this value at the release version of the first install of this system. # Before changing this value read the documentation for this option # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html). - system.stateVersion = "21.05"; # Did you read the comment? + system.stateVersion = "22.11"; # Did you read the comment? } endmsg diff --git a/profiles/cachix/default.nix b/profiles/cachix/default.nix index d88a3f75..26ca2ca4 100644 --- a/profiles/cachix/default.nix +++ b/profiles/cachix/default.nix @@ -7,5 +7,5 @@ let in { inherit imports; - nix.binaryCaches = [ "https://cache.nixos.org/" ]; + nix.settings.substituters = [ "https://cache.nixos.org/" ]; } diff --git a/profiles/cachix/nix-community.nix b/profiles/cachix/nix-community.nix index 7e4be286..28de7e40 100644 --- a/profiles/cachix/nix-community.nix +++ b/profiles/cachix/nix-community.nix @@ -1,10 +1,12 @@ { nix = { - binaryCaches = [ - "https://nix-community.cachix.org" - ]; - binaryCachePublicKeys = [ - "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs=" - ]; + settings = { + substituters = [ + "https://nix-community.cachix.org" + ]; + trusted-public-keys = [ + "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs=" + ]; + }; }; } diff --git a/profiles/cachix/nrdxp.nix b/profiles/cachix/nrdxp.nix index bb3b4a59..53b8c49a 100644 --- a/profiles/cachix/nrdxp.nix +++ b/profiles/cachix/nrdxp.nix @@ -1,10 +1,12 @@ { nix = { - binaryCaches = [ - "https://nrdxp.cachix.org" - ]; - binaryCachePublicKeys = [ - "nrdxp.cachix.org-1:Fc5PSqY2Jm1TrWfm88l6cvGWwz3s93c6IOifQWnhNW4=" - ]; + settings = { + substituters = [ + "https://nrdxp.cachix.org" + ]; + trusted-public-keys = [ + "nrdxp.cachix.org-1:Fc5PSqY2Jm1TrWfm88l6cvGWwz3s93c6IOifQWnhNW4=" + ]; + }; }; } diff --git a/profiles/core/default.nix b/profiles/core/default.nix index 88d626a4..7af791b8 100644 --- a/profiles/core/default.nix +++ b/profiles/core/default.nix @@ -4,7 +4,7 @@ in { imports = [ ../cachix ]; - nix.systemFeatures = [ "nixos-test" "benchmark" "big-parallel" "kvm" ]; + nix.settings.system-features = [ "nixos-test" "benchmark" "big-parallel" "kvm" ]; fonts = { fonts = with pkgs; [ powerline-fonts dejavu_fonts ]; @@ -15,12 +15,14 @@ in }; nix = { - autoOptimiseStore = true; + settings = { + sandbox = true; + trusted-users = [ "root" "@wheel" ]; + allowed-users = [ "@wheel" ]; + auto-optimise-store = true; + }; gc.automatic = true; optimise.automatic = true; - useSandbox = true; - allowedUsers = [ "@wheel" ]; - trustedUsers = [ "root" "@wheel" ]; extraOptions = '' min-free = 536870912 keep-outputs = true diff --git a/profiles/freshrss/default.nix b/profiles/freshrss/default.nix index 224c08f0..579e8935 100644 --- a/profiles/freshrss/default.nix +++ b/profiles/freshrss/default.nix @@ -1,14 +1,15 @@ { config, lib, pkgs, ... }: { + age.secrets.freshrss-dbpass.file = "${self}/secrets/freshrss-dbpass.age"; + age.secrets.freshrss-dbpass.owner = "freshrss"; services.freshrss = { enable = true; virtualHost = "rss.sealight.xyz"; baseUrl = "https://rss.sealight.xyz/"; database = { type = "pgsql"; - # passwordFile = "/run/secrets/gitea-dbpass"; # TODO supplied by agenix - passFile = "/run/secrets/freshrss-dbpass"; + passFile = "/run/agenix/freshrss-dbpass"; }; }; diff --git a/users/anish/default.nix b/users/anish/default.nix index 234df394..633ae251 100644 --- a/users/anish/default.nix +++ b/users/anish/default.nix @@ -5,7 +5,7 @@ users.users.anish = { description = "Personal user for Anish"; - hashedPassword = "MVHHpy9gbe3ow"; + hashedPassword = "$y$j9T$y3DPt/dWaPE.gRazQqw1w0$1RMH5sl/Nu8kW3ZMywYCPRniHD/jF5qRh0VKrdJ.bV2"; shell = pkgs.zsh; isNormalUser = true; extraGroups = [ "wheel" "audio" ]; @@ -17,6 +17,8 @@ ]; }; + home-manager.users.anish.home.stateVersion = "22.05"; + # home-manager.users.anish.programs.git = { # userName = "Anish Lakhwara"; # userEmail = "anish+git@lakhwara.com"; diff --git a/users/profiles/cli/default.nix b/users/profiles/cli/default.nix index f9399f5f..ec9bafad 100644 --- a/users/profiles/cli/default.nix +++ b/users/profiles/cli/default.nix @@ -206,7 +206,6 @@ tai = "task add +in"; tn = "task-note"; tp = "task limit:page"; - te = "task edit"; ts = "task sync"; # keeping for posterity but now sxhkbd handles screenshot with