aynish/helm
1
0
Fork 0
Code Pull requests Packages Projects Releases Activity

holy moly we're almost there

Browse source
This commit is contained in:
Anish Lakhwara 2022-09-19 08:13:50 +10:00
commit 3693732aac
203 changed files with 17247 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

114
CHANGELOG.md Normal file
View file

@ -0,0 +1,114 @@
# Changelog
## [v0.10.0](https://github.com/divnix/devos/tree/v0.10.0) (2021-05-24)
**Implemented enhancements:**
- Providing an interface to nixpkgs.config [\#237](https://github.com/divnix/devos/issues/237)
- Making the user available in profiles [\#230](https://github.com/divnix/devos/issues/230)
- copy evaluation store paths to iso [\#195](https://github.com/divnix/devos/issues/195)
- Extract custom system builds from devosSystem out of lib [\#170](https://github.com/divnix/devos/issues/170)
- Allow setting of channel host-wide [\#117](https://github.com/divnix/devos/issues/117)
- alacritty: CSIu support [\#51](https://github.com/divnix/devos/issues/51)
**Fixed bugs:**
- Cachix timeouts + how to disable nrdxp cachix \(if needed\) [\#294](https://github.com/divnix/devos/issues/294)
- default.nix flake-compat is broken [\#285](https://github.com/divnix/devos/issues/285)
- All suites return "attribute missing" [\#282](https://github.com/divnix/devos/issues/282)
- nix is built two times [\#203](https://github.com/divnix/devos/issues/203)
- fix lib docs [\#166](https://github.com/divnix/devos/issues/166)
**Closed issues:**
- eliminate userFlakeNixOS [\#257](https://github.com/divnix/devos/issues/257)
- devos-as-library [\#214](https://github.com/divnix/devos/issues/214)
**Merged pull requests:**
- Update evalArgs to match the new planned API [\#239](https://github.com/divnix/devos/pull/239)
## [v0.9.0](https://github.com/divnix/devos/tree/v0.9.0) (2021-04-19)
**Implemented enhancements:**
- pin inputs into iso live registry [\#190](https://github.com/divnix/devos/issues/190)
- Pass 'self' to lib [\#169](https://github.com/divnix/devos/issues/169)
- doc: quickstart "ISO. What next?" [\#167](https://github.com/divnix/devos/issues/167)
- Integrate Android AOSP putting mobile under control [\#149](https://github.com/divnix/devos/issues/149)
- Inoculate host identity on first use [\#132](https://github.com/divnix/devos/issues/132)
- kubenix support [\#130](https://github.com/divnix/devos/issues/130)
- Improve Home Manager support: profiles/suites, modules, extern, flake outputs [\#119](https://github.com/divnix/devos/issues/119)
- Local CA \(between hosts\) [\#104](https://github.com/divnix/devos/issues/104)
- Q5: git annex for machine state [\#68](https://github.com/divnix/devos/issues/68)
- name space ./pkgs overlays [\#60](https://github.com/divnix/devos/issues/60)
- remap global keys easily [\#57](https://github.com/divnix/devos/issues/57)
- make pass state part of this repo's structure [\#56](https://github.com/divnix/devos/issues/56)
- Incorporate ./shells [\#38](https://github.com/divnix/devos/issues/38)
- Encrypt with \(r\)age [\#37](https://github.com/divnix/devos/issues/37)
**Fixed bugs:**
- `pathsToImportedAttrs` does not accept directories [\#221](https://github.com/divnix/devos/issues/221)
- Cachix caches aren't added to the configuration [\#208](https://github.com/divnix/devos/issues/208)
- Issues with current changelog workflow [\#205](https://github.com/divnix/devos/issues/205)
- iso: systemd service startup [\#194](https://github.com/divnix/devos/issues/194)
- Help adding easy-hls-nix to devos [\#174](https://github.com/divnix/devos/issues/174)
- `flk update` fails because of obsolete flag [\#159](https://github.com/divnix/devos/issues/159)
- Expected that not all packages are exported? [\#151](https://github.com/divnix/devos/issues/151)
- Segmentation fault when generating iso [\#150](https://github.com/divnix/devos/issues/150)
**Documentation:**
- doc: split iso [\#193](https://github.com/divnix/devos/issues/193)
- lib: can depend on pkgs \(a la nixpkgs\#pkgs/pkgs-lib\) [\#147](https://github.com/divnix/devos/pull/147)
**Closed issues:**
- FRRouting router implementation [\#154](https://github.com/divnix/devos/issues/154)
- ARM aarch64 Support [\#72](https://github.com/divnix/devos/issues/72)
## [v0.8.0](https://github.com/divnix/devos/tree/v0.8.0) (2021-03-02)
**Implemented enhancements:**
- semi automatic update for /pkgs [\#118](https://github.com/divnix/devos/issues/118)
- Home-manager external modules from flakes [\#106](https://github.com/divnix/devos/issues/106)
**Fixed bugs:**
- My emacsGcc overlay is not working [\#146](https://github.com/divnix/devos/issues/146)
- local flake registry freezes branches [\#142](https://github.com/divnix/devos/issues/142)
- nixos-option no longer works after collect garbage [\#138](https://github.com/divnix/devos/issues/138)
- Profiles imports are brittle, causing failure if imported twice [\#136](https://github.com/divnix/devos/issues/136)
## [0.7.0](https://github.com/divnix/devos/tree/0.7.0) (2021-02-20)
**Implemented enhancements:**
- add zoxide [\#53](https://github.com/divnix/devos/issues/53)
- Multiarch support? [\#17](https://github.com/divnix/devos/issues/17)
- initial multiArch support [\#18](https://github.com/divnix/devos/pull/18)
**Fixed bugs:**
- Missing shebang from flk.sh [\#131](https://github.com/divnix/devos/issues/131)
- Rename Meta Issue [\#128](https://github.com/divnix/devos/issues/128)
- specialisations break the `system` argument [\#46](https://github.com/divnix/devos/issues/46)
- Revert "Add extraArgs to lib.nixosSystem call to add system args." [\#47](https://github.com/divnix/devos/pull/47)
**Documentation:**
- update home-manager urls [\#62](https://github.com/divnix/devos/pull/62)
**Closed issues:**
- add github action for cachix build ci [\#59](https://github.com/divnix/devos/issues/59)
## [12052020](https://github.com/divnix/devos/tree/12052020) (2020-12-06)
## [07092020](https://github.com/divnix/devos/tree/07092020) (2020-07-09)
\* *This Changelog was automatically generated by [github_changelog_generator](https://github.com/github-changelog-generator/github-changelog-generator)*

18
COPYING Normal file
View file

@ -0,0 +1,18 @@
Permission is hereby granted, free of charge, to any person obtaining
a copy of this software and associated documentation files (the
"Software"), to deal in the Software without restriction, including
without limitation the rights to use, copy, modify, merge, publish,
distribute, sublicense, and/or sell copies of the Software, and to
permit persons to whom the Software is furnished to do so, subject to
the following conditions:
The above copyright notice and this permission notice shall be
included in all copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

93
README.md Normal file
View file

@ -0,0 +1,93 @@
[![NixOS](https://img.shields.io/badge/NixOS-unstable-blue.svg?style=flat&logo=NixOS&logoColor=white)](https://nixos.org)
[![MIT License](https://img.shields.io/github/license/divnix/devos)][mit]
> #### ⚠ Advisory ⚠
> Do you remember how you got here? Where were you going? What were you leaving behind?
> Are you sure you want to go down this rabbit hole, Alice?
## Getting Started
This is my personal deployment hub. I configure all my personal servers from this repo. Good luck if you're looking to graft this.
You'll probably want to run some `install.sh` that will configure the base NixOS system. Some of them aren't in a good state.
From there you can either install the host you want with `sudo nixos-rebuild switch --flake .#<host>` or enter the cockpit with `nix develop` and deploy servers remotely through `deploy`
## Personal dotfiles
<img src="./screenshots/fakebusy.png" width="100%" />
<p align="center">
<span><img src="./screenshots/desktop.png" height="178" /></span>
<span><img src="./screenshots/rofi.png" height="178" /></span>
<span><img src="./screenshots/firefox.png" height="178" /></span>
</p>
------
| | |
|----------------|----------------------------------------------------------|
| **Shell:** | bash / elvish |
| **DM:** | lightdm + lightdm-mini-greeter |
| **WM:** | bspwm + polybar |
| **Editor:** | nvim |
| **Terminal:** | kitty |
| **Launcher:** | rofi |
| **Browser:** | firefox |
| **GTK Theme:** | [Ant Dracula](https://github.com/EliverLara/Ant-Dracula) |
-----
### Status: Beta
The volcanic rock still shifts below this structure. It has not solidified and cannot yet be considered `home`
You should not expect landmarks here.
Learn to adopt Chaos.
## Shoulders
Summoning is powerful magic, and cannot be created in isolation. It stands on the [shoulders of the
following giants][giants]:
### :onion: &mdash; like the layers of an onion
- [`divnix/digga`][digga]
- [`gytis-ivaskevicius/flake-utils-plus`][fup]
- [`numtide/flake-utils`][fu]
- [`numtide/devshell`][devshell]
- [`serokell/deploy-rs`][deploy]
- [`berberman/nvfetcher`][nvfetcher]
- [`NixOS/nixpkgs`][nixpkgs]
- Agenix
- direnv
:heart:
### But Why?
The future is more uncertain than ever. Make dependable what you can, in whatever way you know how.
Stop doing it by yourself, unless we learn to work with one another will we be able to grow long term solutions.
Managing servers by hand sucks, k8s doesn't allow me to transitively deploy all my configuration to multiple personal machines, and ansible wasn't good enough.
You probably don't want to use nixOS, I'm a masocist
### Grafts
https://github.com/hlissner/dotfiles
# License
DevOS is licensed under the [MIT License][mit].
[community]: https://github.com/divnix/devos/tree/community
[core]: https://github.com/divnix/devos
[deploy]: https://github.com/serokell/deploy-rs
[devshell]: https://github.com/numtide/devshell
[digga]: https://github.com/divnix/digga
[dotfiles]: https://github.com/hlissner/dotfiles
[flake-doc]: https://github.com/NixOS/nix/blob/master/src/nix/flake.md
[flakes]: https://nixos.wiki/wiki/Flakes
[fu]: https://github.com/numtide/flake-utils
[fup]: https://github.com/gytis-ivaskevicius/flake-utils-plus
[giants]: https://en.wikipedia.org/wiki/Standing_on_the_shoulders_of_giants
[home-manager]: https://nix-community.github.io/home-manager
[mit]: https://mit-license.org
[mk-flake]: https://github.com/divnix/digga/tree/master/src/mkFlake
[nix]: https://nixos.org/manual/nix/stable
[nixos]: https://nixos.org/manual/nixos/stable
[nixpkgs]: https://github.com/NixOS/nixpkgs
[nvfetcher]: https://github.com/berberman/nvfetcher

5
bors.toml Normal file
View file

@ -0,0 +1,5 @@
status = [ "check" ]
required_approvals = 1
up_to_date_approvals = true

31
default.nix Normal file
View file

@ -0,0 +1,31 @@
let
inherit (default.inputs.nixos) lib;
default = (import ./lib/compat).defaultNix;
ciSystems = [
"aarch64-linux"
"i686-linux"
"x86_64-linux"
];
filterSystems = lib.filterAttrs
(system: _: lib.elem system ciSystems);
recurseIntoAttrsRecursive = lib.mapAttrs (_: v:
if lib.isAttrs v
then recurseIntoAttrsRecursive (lib.recurseIntoAttrs v)
else v
);
systemOutputs = lib.filterAttrs
(name: set: lib.isAttrs set
&& lib.any
(system: set ? ${system} && name != "legacyPackages")
ciSystems
)
default.outputs;
ciDrvs = lib.mapAttrs (_: system: filterSystems system) systemOutputs;
in
(recurseIntoAttrsRecursive ciDrvs) // { shell = import ./shell.nix; }

1
doc/.gitignore vendored Normal file
View file

@ -0,0 +1 @@
book

18
doc/CONTRIBUTING.md Normal file
View file

@ -0,0 +1,18 @@
# Pull Requests
## TL;DR;
- **Target Branch**: `main`
- **Merge Policy**: [`bors`][bors] is alwyas right (&rarr; `bors try`)
- **Docs**: every changeset is expected to contain doc updates
- **Commit Msg**: be a poet! Comprehensive and explanatory commit messages
should cover the motivation and use case in an easily understandable manner
even when read after a few months.
- **Test Driven Development**: please default to test driven development where possible.
### Within the Devshell (`nix develop`)
- **Hooks**: please `git commit` within the devshell
- **Fail Early**: please run from within the devshell on your local machine:
- `nix flake check`
[bors]: https://bors.tech

28
doc/SUMMARY.md Normal file
View file

@ -0,0 +1,28 @@
# Summary
- [Introduction](../README.md)
- [Quick Start](./start/index.md)
- [ISO](./start/iso.md)
- [Bootstrapping](./start/bootstrapping.md)
- [From NixOS](./start/from-nixos.md)
- [Key Concepts](./concepts/index.md)
- [Hosts](./concepts/hosts.md)
- [Overrides](./concepts/overrides.md)
- [Profiles](./concepts/profiles.md)
- [Suites](./concepts/suites.md)
- [Users](./concepts/users.md)
- [Outputs](./outputs/index.md)
- [Modules](./outputs/modules.md)
- [Overlays](./outputs/overlays.md)
- [Packages](./outputs/pkgs.md)
- [Concerns]()
- [Secrets](./secrets.md)
- [Tests](./tests.md)
- [Helper Script – `bud`](./bud/index.md)
- [get](./bud/get.md)
- [Integrations](./integrations/index.md)
- [Cachix](./integrations/cachix.md)
- [Deploy RS](./integrations/deploy.md)
- [NvFetcher](./integrations/nvfetcher.md)
- [Hercules CI](./integrations/hercules.md)
- [Contributing](./CONTRIBUTING.md)

6
doc/book.toml Normal file
View file

@ -0,0 +1,6 @@
[book]
authors = ["Timothy DeHerrera"]
language = "en"
multilingual = false
src = "."
title = "devos docs"

10
doc/bud/get.md Normal file
View file

@ -0,0 +1,10 @@
# get
The `get` subcommand is useful for getting a bare copy of devos without the
git history.
## Usage
```sh
bud get DEST-DIR
```
If DEST-DIR is ommitted, it defaults to _./devos_.

24
doc/bud/index.md Normal file
View file

@ -0,0 +1,24 @@
# [`bud`][bud] command
The template incudes a convenient script for managing your system called [`bud`][bud].
It is a portable and highly composable system control tool that work anywhere on your host
or in the flake's devshell.
Although it comes with some predefined standard helpers,
it is very extensible and you are encouraged to write your own script snippets
to ease your workflows. An example is the bud module for a `get` command that
comes included with `devos`.
While writing scripts you can convenientely access smart environment variables
that can tell the current architecture, user or host name, among others, regardless
wether you invoke `bud` within the devshell or as the system-wide installed `bud`.
For details, please review the [bud repo][bud].
## Usage
```sh
bud help
```
[bud]: https://github.com/divnix/bud

62
doc/concepts/hosts.md Normal file
View file

@ -0,0 +1,62 @@
# Hosts
Nix flakes contain an output called `nixosConfigurations` declaring an
attribute set of valid NixOS systems. To simplify the management and creation
of these hosts, devos automatically imports every _.nix_ file inside this
directory to the mentioned attribute set, applying the projects defaults to
each. The only hard requirement is that the file contain a valid NixOS module.
As an example, a file `hosts/system.nix` or `hosts/system/default.nix` will
be available via the flake output `nixosConfigurations.system`. You can have
as many hosts as you want and all of them will be automatically imported based
on their name.
For each host, the configuration automatically sets the `networking.hostName`
attribute to the folder name or name of the file minus the _.nix_ extension. This
is for convenience, since `nixos-rebuild` automatically searches for a configuration
matching the current systems hostname if one is not specified explicitly.
You can set channels, systems, and add extra modules to each host by editing the
`nixos.hosts` argument in flake.nix. This is the perfect place to import
host specific modules from external sources, such as the
[nixos-hardware][nixos-hardware] repository.
It is recommended that the host modules only contain configuration information
specific to a particular piece of hardware. Anything reusable across machines
is best saved for [profile modules](./profiles.md).
This is a good place to import sets of profiles, called [suites](./suites.md),
that you intend to use on your machine.
## Example
flake.nix:
```nix
{
nixos = {
imports = [ (devos.lib.importHosts ./hosts) ];
hosts = {
librem = {
channelName = "latest";
modules = [ nixos-hardware.nixosModules.purism-librem-13v3 ];
};
};
};
}
```
hosts/librem.nix:
```nix
{ suites, ... }:
{
imports = suites.laptop;
boot.loader.systemd-boot.enable = true;
boot.loader.efi.canTouchEfiVariables = true;
fileSystems."/" = { device = "/dev/disk/by-label/nixos"; };
}
```
[nixos-hardware]: https://github.com/NixOS/nixos-hardware

10
doc/concepts/index.md Normal file
View file

@ -0,0 +1,10 @@
# Key Concepts
Key concepts are derived from [digga][digga]. Please refer to its
[docs][digga-docs] for more details.
This section is dedicated to helping you develop a more hands on
understanding of them them.
[digga-docs]: https://digga.divnix.com
[digga]: https://github.com/divnix/digga

42
doc/concepts/overrides.md Normal file
View file

@ -0,0 +1,42 @@
# Overrides
Each NixOS host follows one channel. But many times it is useful to get packages
or modules from different channels.
## Packages
You can make use of `overlays/overrides.nix` to override specific packages in the
default channel to be pulled from other channels. That file is simply an example
of how any overlay can get `channels` as their first argument.
You can add overlays to any channel to override packages from other channels.
Pulling the manix package from the `latest` channel:
```nix
channels: final: prev: {
__dontExport = true;
inherit (pkgs.latest) manix;
}
```
It is recommended to set the `__dontExport` property for override specific
overlays. `overlays/overrides.nix` is the best place to consolidate all package
overrides and the property is already set for you.
## Modules
You can also pull modules from other channels. All modules have access to the
`modulesPath` for each channel as `<channelName>ModulesPath`. And you can use
`disabledModules` to remove modules from the current channel.
To pull zsh module from the `latest` channel this code can be placed in any module, whether its your host file, a profile, or a module in ./modules etc:
```nix
{ latestModulesPath }:
{
imports = [ "${latestModulesPath}/programs/zsh/zsh.nix" ];
disabledModules = [ "programs/zsh/zsh.nix" ];
}
```
> ##### _Note:_
> Sometimes a modules name will change from one branch to another.
[nixpkgs-modules]: https://github.com/NixOS/nixpkgs/tree/master/nixos/modules

67
doc/concepts/profiles.md Normal file
View file

@ -0,0 +1,67 @@
# Profiles
Profiles are a convenient shorthand for the [_definition_][definition] of
[options][options] in contrast to their [_declaration_][declaration]. They're
built into the NixOS module system for a reason: to elegantly provide a clear
separation of concerns.
## Creation
Profiles are created with the `rakeLeaves` function which recursively collects
`.nix` files from within a folder. The recursion stops at folders with a `default.nix`
in them. You end up with an attribute set with leaves(paths to profiles) or
nodes(attrsets leading to more nodes or leaves).
A profile is used for quick modularization of [interelated bits](./profiles.md#subprofiles).
> ##### _Notes:_
> * For _declaring_ module options, there's the [modules](../outputs/modules.md) directory.
> * This directory takes inspiration from
> [upstream](https://github.com/NixOS/nixpkgs/tree/master/nixos/modules/profiles)
> .
### Nested profiles
Profiles can be nested in attribute sets due to the recursive nature of `rakeLeaves`.
This can be useful to have a set of profiles created for a specific purpose. It is
sometimes useful to have a `common` profile that has high level concerns related
to all its sister profiles.
### Example
profiles/develop/common.nix:
```nix
{
imports = [ ./zsh ];
# some generic development concerns ...
}
```
profiles/develop/zsh.nix:
```nix
{ ... }:
{
programs.zsh.enable = true;
# zsh specific options ...
}
```
The examples above will end up with a profiles set like this:
```nix
{
develop = {
common = ./profiles/develop/common.nix;
zsh = ./profiles/develop/zsh.nix;
};
}
```
## Conclusion
Profiles are the most important concept in DevOS. They allow us to keep our
Nix expressions self contained and modular. This way we can maximize reuse
across hosts while minimizing boilerplate. Remember, anything machine
specific belongs in your [host](hosts.md) files instead.
[definition]: https://nixos.org/manual/nixos/stable/index.html#sec-option-definitions
[declaration]: https://nixos.org/manual/nixos/stable/index.html#sec-option-declarations
[options]: https://nixos.org/manual/nixos/stable/index.html#sec-writing-modules
[spec]: https://github.com/divnix/devos/tree/core/lib/devos/mkProfileAttrs.nix
[config]: https://nixos.wiki/wiki/Module#structure

25
doc/concepts/suites.md Normal file
View file

@ -0,0 +1,25 @@
# Suites
Suites provide a mechanism for users to easily combine and name collecitons of
profiles.
`suites` are defined in the `importables` argument in either the `home` or `nixos`
namespace. They are a special case of an `importable` which get passed as a special
argument (one that can be use in an `imports` line) to your hosts. All lists defined
in `suites` are flattened and type-checked as paths.
## Definition
```nix
rec {
workstation = [ profiles.develop profiles.graphical users.nixos ];
mobileWS = workstation ++ [ profiles.laptop ];
}
```
## Usage
`hosts/my-laptop.nix`:
```nix
{ suites, ... }:
{
imports = suites.mobileWS;
}
```

77
doc/concepts/users.md Normal file
View file

@ -0,0 +1,77 @@
> ##### _Note:_
> This section and its semantics need a conceptiual rework.
> Since recently [portable home configurations][portableuser]
> that are not bound to any specific host are a thing.
# Users
Users are a special case of [profiles](profiles.md) that define system
users and [home-manager][home-manager] configurations. For your convenience,
home manager is wired in by default so all you have to worry about is declaring
your users. For a fully fleshed out example, check out the developers personal
[branch](https://github.com/divnix/devos/tree/nrd/users/nrd/default.nix).
## Basic Usage
`users/myuser/default.nix`:
```nix
{ ... }:
{
users.users.myuser = {
isNormalUser = true;
};
home-manager.users.myuser = {
programs.mpv.enable = true;
};
}
```
## Home Manager
Home Manager support follows the same principles as regular nixos configurations,
it even gets its own namespace in your `flake.nix` as `home`.
All modules defined in [user modules][modules-list] will be imported to
Home Manager.
User profiles can be collected in a similar fashion as system ones into a `suites`
argument that gets passed to your home-manager users.
### Example
```nix
{
home-manager.users.nixos = { suites, ... }: {
imports = suites.base;
};
}
```
## External Usage
You can easily use the defined home-manager configurations outside of NixOS
using the `homeConfigurations` flake output. The [flk](../flk/index.md) helper
script makes this even easier.
This is great for keeping your environment consistent across Unix systems,
including OSX.
### From within the projects devshell:
```sh
# builds the nixos user defined in the NixOS host
flk home NixOS nixos
# build and activate
flk home NixOS nixos switch
```
### Manually from outside the project:
```sh
# build
nix build "github:divnix/devos#homeConfigurations.nixos@NixOS.home.activationPackage"
# activate
./result/activate && unlink result
```
[home-manager]: https://nix-community.github.io/home-manager
[modules-list]: https://github.com/divnix/devos/tree/core/users/modules/module-list.nix
[portableuser]: https://digga.divnix.com/api-reference-home.html#homeusers

17
doc/integrations/cachix.md Normal file
View file

@ -0,0 +1,17 @@
# Cachix
The system will automatically pull a cachix.nix at the root if one exists.
This is usually created automatically by a `sudo cachix use`. If you're more
inclined to keep the root clean, you can drop any generated files in the
`cachix` directory into the `profiles/cachix` directory without further
modification.
For example, to add your own cache, assuming the template lives in /etc/nixos,
by simply running `sudo cachix use yourcache`. Then, optionally, move
`cachix/yourcache.nix` to `profiles/cachix/yourcache.nix`
These caches are only added to the system after a `nixos-rebuild switch`, so it
is recommended to call `cachix use nrdxp` before the initial deployment, as it
will save a lot of build time.
In the future, users will be able to skip this step once the ability to define
the nix.conf within the flake is fully fleshed out upstream.

49
doc/integrations/deploy.md Normal file
View file

@ -0,0 +1,49 @@
# deploy-rs
[Deploy-rs][d-rs] is a tool for managing NixOS remote machines. It was
chosen for devos after the author experienced some frustrations with the
stateful nature of nixops' db. It was also designed from scratch to support
flake based deployments, and so is an excellent tool for the job.
By default, all the [hosts](../concepts/hosts.md) are also available as deploy-rs nodes,
configured with the hostname set to `networking.hostName`; overridable via
the command line.
## Usage
Just add your ssh key to the host:
```nix
{ ... }:
{
users.users.${sshUser}.openssh.authorizedKeys.keyFiles = [
../secrets/path/to/key.pub
];
}
```
And the private key to your user:
```nix
{ ... }:
{
home-manager.users.${sshUser}.programs.ssh = {
enable = true;
matchBlocks = {
${host} = {
host = hostName;
identityFile = ../secrets/path/to/key;
extraOptions = { AddKeysToAgent = "yes"; };
};
};
}
}
```
And run the deployment:
```sh
deploy "flk#hostName" --hostname host.example.com
```
> ##### _Note:_
> Your user will need **passwordless** sudo access
[d-rs]: https://github.com/serokell/deploy-rs

36
doc/integrations/hercules.md Normal file
View file

@ -0,0 +1,36 @@
# Hercules CI
If you start adding your own packages and configurations, you'll probably have
at least a few binary artifacts. With hercules we can build every package in
our configuration automatically, on every commit. Additionally, we can have it
upload all our build artifacts to a binary cache like [cachix][cachix].
This will work whether your copy is a fork, or a bare template, as long as your
repo is hosted on GitHub.
## Setup
Just head over to [hercules-ci.com](https://hercules-ci.com) to make an account.
Then follow the docs to set up an [agent][agent], if you want to deploy to a
binary cache (and of course you do), be sure _not_ to skip the
[binary-caches.json][cache].
## Ready to Use
The repo is already set up with the proper _default.nix_ file, building all
declared packages, checks, profiles and shells. So you can see if something
breaks, and never build the same package twice!
If you want to get fancy, you could even have hercules
[deploy your configuration](https://docs.hercules-ci.com/hercules-ci-effects/guide/deploy-a-nixos-machine/)!
> ##### _Note:_
> Hercules doesn't have access to anything encrypted in the
> [secrets folder](../../secrets), so none of your secrets will accidentally get
> pushed to a cache by mistake.
>
> You could pull all your secrets via your user, and then exclude it from
> [allUsers](https://github.com/nrdxp/devos/blob/nrd/suites/default.nix#L17)
> to keep checks passing.
[agent]: https://docs.hercules-ci.com/hercules-ci/getting-started/#github
[cache]: https://docs.hercules-ci.com/hercules-ci/getting-started/deploy/nixos/#_3_configure_a_binary_cache
[cachix]: https://cachix.org

5
doc/integrations/index.md Normal file
View file

@ -0,0 +1,5 @@
# Integrations
This section explores some of the optional tools included with devos to provide
a solution to common concerns such as ci and remote deployment. An effort is
made to choose tools that treat nix, and where possible flakes, as first class
citizens.

43
doc/integrations/nvfetcher.md Normal file
View file

@ -0,0 +1,43 @@
# nvfetcher
[NvFetcher][nvf] is a workflow companion for updating nix sources.
You can specify an origin source and an update configuration, and
nvfetcher can for example track updates to a specific branch and
automatically update your nix sources configuration on each run
to the tip of that branch.
All package source declaration is done in [sources.toml][sources.toml].
From within the devshell of this repo, run `nvfetcher`, a wrapped
version of `nvfetcher` that knows where to find and place its files
and commit the results.
## Usage
Statically fetching (not tracking) a particular tag from a github repo:
```toml
[manix]
src.manual = "v0.6.3"
fetch.github = "mlvzk/manix"
```
Tracking the latest github _release_ from a github repo:
```toml
[manix]
src.github = "mlvzk/manix" # responsible for tracking
fetch.github = "mlvzk/manix" # responsible for fetching
```
Tracking the latest commit of a git repository and fetch from a git repo:
```toml
[manix]
src.git = "https://github.com/mlvzk/manix.git" # responsible for tracking
fetch.git = "https://github.com/mlvzk/manix.git" # responsible for fetching
```
> ##### _Note:_
> Please refer to the [NvFetcher Readme][nvf-readme] for more options.
[nvf]: https://github.com/berberman/nvfetcher
[nvf-readme]: https://github.com/berberman/nvfetcher#readme
[sources.toml]: https://github.com/divnix/devos/tree/core/pkgs/sources.toml

3
doc/outputs/index.md Normal file
View file

@ -0,0 +1,3 @@
# Layout
Each of the following sections is a directory whose contents are output to the
outside world via the flake's outputs. Check each chapter for details.

79
doc/outputs/modules.md Normal file
View file

@ -0,0 +1,79 @@
# Modules
The modules directory is a replica of nixpkg's NixOS [modules][nixpkgs-modules]
, and follows the same semantics. This allows for trivial upstreaming into
nixpkgs proper once your module is sufficiently stable.
All modules linked in _module-list.nix_ are automatically exported via
`nixosModules.<file-basename>`, and imported into all [hosts](../concepts/hosts.md).
> ##### _Note:_
> This is reserved for declaring brand new module options. If you just want to
> declare a coherent configuration of already existing and related NixOS options
> , use [profiles](../concepts/profiles.md) instead.
## Semantics
In case you've never written a module for nixpkgs before, here is a brief
outline of the process.
### Declaration
modules/services/service-category/my-service.nix:
```nix
{ config, lib, ... }:
let
cfg = config.services.myService;
in
{
options.services.myService = {
enable = lib.mkEnableOption "Description of my new service.";
# additional options ...
};
config = lib.mkIf cfg.enable {
# implementation ...
};
}
```
### Import
modules/module-list.nix:
```nix
[
./services/service-category/my-service.nix
]
```
## Usage
### Internal
profiles/profile-category/my-profile.nix:
```nix
{ ... }:
{
services.MyService.enable = true;
}
```
### External
flake.nix:
```nix
{
# inputs omitted
outputs = { self, devos, nixpkgs, ... }: {
nixosConfigurations.myConfig = nixpkgs.lib.nixosSystem {
system = "...";
modules = [
devos.nixosModules.my-service
({ ... }: {
services.MyService.enable = true;
})
];
};
};
}
```
[nixpkgs-modules]: https://github.com/NixOS/nixpkgs/tree/master/nixos/modules

25
doc/outputs/overlays.md Normal file
View file

@ -0,0 +1,25 @@
# Overlays
Writing overlays is a common occurence when using a NixOS system. Therefore,
we want to keep the process as simple and straightforward as possible.
Any _.nix_ files declared in this directory will be assumed to be a valid
overlay, and will be automatically imported into all [hosts](../concepts/hosts.md), and
exported via `overlays.<channel>/<pkgName>` _as well as_
`packages.<system>.<pkgName>` (for valid systems), so all you have to do is
write it.
## Example
overlays/kakoune.nix:
```nix
final: prev: {
kakoune = prev.kakoune.override {
configure.plugins = with final.kakounePlugins; [
(kak-fzf.override { fzf = final.skim; })
kak-auto-pairs
kak-buffers
kak-powerline
kak-vertical-selection
];
};
}
```

109
doc/outputs/pkgs.md Normal file
View file

@ -0,0 +1,109 @@
# Packages
Similar to [modules](./modules.md), the pkgs directory mirrors the upstream
[nixpkgs/pkgs][pkgs], and for the same reason; if you ever want to upstream
your package, it's as simple as dropping it into the nixpkgs/pkgs directory.
The only minor difference is that, instead of adding the `callPackage` call to
`all-packages.nix`, you just add it the the _default.nix_ in this directory,
which is defined as a simple overlay.
All the packages are exported via `packages.<system>.<pkg-name>`, for all
the supported systems listed in the package's `meta.platforms` attribute.
And, as usual, every package in the overlay is also available to any NixOS
[host](../concepts/hosts.md).
Another convenient difference is that it is possible to use
[nvfetcher](https://github.com/berberman/nvfetcher) to keep packages up to
date.
This is best understood by the simple example below.
## Example
It is possible to specify sources separately to keep them up to date semi
automatically.
The basic rules are specified in pkgs/sources.toml:
```toml
# nvfetcher.toml
[libinih]
src.github = "benhoyt/inih"
fetch.github = "benhoyt/inih"
```
After changes to this file as well as to update the packages specified in there run
nvfetcher (for more details see [nvfetcher](https://github.com/berberman/nvfetcher)).
The pkgs overlay is managed in
pkgs/default.nix:
```nix
final: prev: {
# keep sources first, this makes sources available to the pkgs
sources = prev.callPackage (import ./_sources/generated.nix) { };
# then, call packages with `final.callPackage`
libinih = prev.callPackage ./development/libraries/libinih { };
}
```
Lastly the example package is in
pkgs/development/libraries/libinih/default.nix:
```nix
{ stdenv, meson, ninja, lib, sources, ... }:
stdenv.mkDerivation {
pname = "libinih";
# version will resolve to the latest available on gitub
inherit (sources.libinih) version src;
buildInputs = [ meson ninja ];
# ...
}
```
## Migration from flake based approach
Previous to nvfetcher it was possible to manage sources via a pkgs/flake.nix, the main changes from there are that sources where in the attribute "srcs" (now "sources") and the contents of the sources where slightly different.
In order to switch to the new system, rewrite pkgs/flake.nix to a pkgs/sources.toml file using the documentation of nvfetcher,
add the line that calls the sources at the beginning of pkgs/default.nix, and
accomodate the small changes in the packages as can be seen from the example.
The example package looked like:
pkgs/flake.nix:
```nix
{
description = "Package sources";
inputs = {
libinih.url = "github:benhoyt/inih/r53";
libinih.flake = false;
};
}
```
pkgs/default.nix:
```nix
final: prev: {
# then, call packages with `final.callPackage`
libinih = prev.callPackage ./development/libraries/libinih { };
}
```
pkgs/development/libraries/libinih/default.nix:
```nix
{ stdenv, meson, ninja, lib, srcs, ... }:
let inherit (srcs) libinih; in
stdenv.mkDerivation {
pname = "libinih";
# version will resolve to 53, as specified in the flake.nix file
inherit (libinih) version;
src = libinih;
buildInputs = [ meson ninja ];
# ...
}
```
[pkgs]: https://github.com/NixOS/nixpkgs/tree/master/pkgs

110
doc/secrets.md Normal file
View file

@ -0,0 +1,110 @@
# Secrets
Secrets are managed using [git-crypt][git-crypt] and [agenix][agenix]
so you can keep your flake in a public repository like GitHub without
exposing your password or other sensitive data.
By default, everything in the secrets folder is automatically encrypted. Just
be sure to run `git-crypt init` before putting anything in here.
## Agenix
Currently, there is [no mechanism][secrets-issue] in nix itself to deploy secrets
within the nix store because it is world-readable.
Most NixOS modules have the ability to set options to files in the system, outside
the nix store, that contain sensitive information. You can use [agenix][agenix]
to easily setup those secret files declaratively.
[agenix][agenix] encrypts secrets and stores them as .age files in your repository.
Age files are encrypted with multiple ssh public keys, so any host or user with a
matching ssh private key can read the data. The [age module][age module] will add those
encrypted files to the nix store and decrypt them on activation to `/run/secrets`.
### Setup
All hosts must have openssh enabled, this is done by default in the core profile.
You need to populate your `secrets/secrets.nix` with the proper ssh public keys.
Be extra careful to make sure you only add public keys, you should never share a
private key!!
secrets/secrets.nix:
```nix
let
system = "<system ssh key>";
user = "<user ssh key>";
allKeys = [ system user ];
in
```
On most systems, you can get your systems ssh public key from `/etc/ssh/ssh_host_ed25519_key.pub`. If
this file doesn't exist you likely need to enable openssh and rebuild your system.
Your users ssh public key is probably stored in `~/.ssh/id_ed25519.pub` or
`~/.ssh/id_rsa.pub`. If you haven't generated a ssh key yet, be sure do so:
```sh
ssh-keygen -t ed25519
```
> ##### _Note:_
> The underlying tool used by agenix, rage, doesn't work well with password protected
> ssh keys. So if you have lots of secrets you might have to type in your password many
> times.
### Secrets
You will need the `agenix` command to create secrets. DevOS conveniently provides that
in the devShell, so just run `nix develop` whenever you want to edit secrets. Make sure
to always run `agenix` while in the `secrets/` folder, so it can pick up your `secrets.nix`.
To create secrets, simply add lines to your `secrets/secrets.nix`:
```
let
...
allKeys = [ system user ];
in
{
"secret.age".publicKeys = allKeys;
}
```
That would tell agenix to create a `secret.age` file that is encrypted with the `system`
and `user` ssh public key.
Then go into the `secrets` folder and run:
```sh
agenix -e secret.age
```
This will create the `secret.age`, if it doesn't already exist, and allow you to edit it.
If you ever change the `publicKeys` entry of any secret make sure to rekey the secrets:
```sh
agenix --rekey
```
### Usage
Once you have your secret file encrypted and ready to use, you can utilize the [age module][age module]
to ensure that your secrets end up in `/run/secrets`.
In any profile that uses a NixOS module that requires a secret you can enable a particular secret like so:
```nix
{ self, ... }:
{
age.secrets.mysecret.file = "${self}/secrets/mysecret.age";
}
```
Then you can just pass the path `/run/secrets/mysecret` to the module.
You can make use of the many options provided by the age module to customize where and how
secrets get decrypted. You can learn about them by looking at the
[age module][age module].
> ##### _Note:_
> You can take a look at the [agenix repository][agenix] for more information
> about the tool.
[git-crypt]: https://github.com/AGWA/git-crypt
[agenix]: https://github.com/ryantm/agenix
[age module]: https://github.com/ryantm/agenix/blob/master/modules/age.nix
[secrets-issue]: https://github.com/NixOS/nix/issues/8

102
doc/start/bootstrapping.md Normal file
View file

@ -0,0 +1,102 @@
# Bootstrapping
This will help you boostrap a bare host with the help of the
[bespoke iso](./iso.md) live installer.
_Note: nothing prevents you from remotely executing the boostrapping
process. See below._
Once your target host has booted into the live iso, you need to partion
and format your disk according to the [official manual][manual].
## Mount partitions
Then properly mount the formatted partitions at `/mnt`, so that you can
install your system to those new partitions.
Mount `nixos` partition to `/mnt` and &mdash; for UEFI &mdash; `boot`
partition to `/mnt/boot`:
```console
$ mount /dev/disk/by-label/nixos /mnt
$ mkdir -p /mnt/boot && mount /dev/disk/by-label/boot /mnt/boot # UEFI only
$ swapon /dev/disk/by-label/swap
```
Add some extra space to the store. In the iso, it's running on a tmpfs
off your RAM:
```console
$ mkdir -p /mnt/tmpstore/{work,store}
$ mount -t overlay overlay -olowerdir=/nix/store,upperdir=/mnt/tmpstore/store,workdir=/mnt/tmpstore/work /nix/store
```
## Install
Install off of a copy of devos from the time the iso was built:
```console
$ cd /iso/devos
$ nixos-install --flake .#NixOS
```
## Notes of interest
### Remote access to the live installer
The iso live installer comes preconfigured with a network configuration
which announces it's hostname via [MulticastDNS][mDNS] as `hostname.local`,
that is `bootstrap.local` in the [iso example](./iso).
In the rare case that [MulticastDNS][mDNS] is not availabe or turned off
in your network, there is a static link-local IPv6 address configured to
`fe80::47`(mnemonic from the letter's position in the english alphabet:
`n=14 i=9 x=24; 47 = n+i+x`).
Provided that you have added your public key to the authorized keys of the
`root` user _(hint: [`deploy-rs`](../integrations/deploy.md) needs passwordless
sudo access)_:
```nix
{ ... }:
{
users.users.root.openssh.authorizedKeys.keyFiles = [
../secrets/path/to/key.pub
];
}
```
You can then ssh into the live installer through one of the
following options:
```console
ssh root@bootstrap.local
ssh root@fe80::47%eno1 # where eno1 is your network interface on which you are linked to the target
```
_Note: the [static link-local IPv6 address][staticLLA] and [MulticastDNS][mDNS] is only
configured on the live installer. If you wish to enable [MulticastDNS][mDNS]
for your environment, you ought to configure that in a regular [profile](../concepts/profiles.md)._
### EUI-64 LLA & Host Identity
The iso's IPv6 Link Local Address (LLA) is configured with a static 64-bit Extended
Unique Identifiers (EUI-64) that is derived from the host interface's Message
Authentication Code (MAC) address.
After a little while (a few seconds), you can remotely discover this unique and host
specific address over [NDP][NDP] for example with:
```console
ip -6 neigh show # also shows fe80::47
```
***This LLA is stable for the host, unless you need to swap that particular network card.***
Under this reservation, though, you may use this EUI-64 to wire up a specific
(cryptographic) host identity.
[manual]: https://nixos.org/manual/nixos/stable/index.html#sec-installation-partitioning
[mDNS]: https://en.wikipedia.org/wiki/Multicast_DNS
[NDP]: https://en.wikipedia.org/wiki/Neighbor_Discovery_Protocol
[staticLLA]: https://tools.ietf.org/html/rfc7404

54
doc/start/from-nixos.md Normal file
View file

@ -0,0 +1,54 @@
# From NixOS
## Generate Configuration
Assuming you're happy with your existing partition layout, you can generate a
basic NixOS configuration for your system using:
```sh
flk up
```
This will make a new file `hosts/up-$(hostname).nix`, which you can edit to
your liking.
You must then add a host to `nixos.hosts` in flake.nix:
```nix
{
nixos.hosts = {
modules = hosts/NixOS.nix;
};
}
```
Make sure your `i18n.defaultLocale` and `time.timeZone` are set properly for
your region. Keep in mind that `networking.hostName` will be automatically
set to the name of your host;
Now might be a good time to read the docs on [suites](../concepts/suites.md) and
[profiles](../concepts/profiles.md) and add or create any that you need.
> ##### _Note:_
> While the `up` sub-command is provided as a convenience to quickly set up and
> install a "fresh" NixOS system on current hardware, committing these files is
> discouraged.
>
> They are placed in the git staging area automatically because they would be
> invisible to the flake otherwise, but it is best to move what you need from
> them directly into a host module of your own making, and commit that instead.
# Installation
Once you're ready to deploy `hosts/my-host.nix`:
```sh
flk my-host switch
```
This calls `nixos-rebuild` with sudo to build and install your configuration.
> ##### _Notes:_
> - Instead of `switch`, you can pass `build`, `test`, `boot`, etc just as with
> `nixos-rebuild`.
>
> - It is convenient to have the template living at `/etc/nixos` so you can
> simply `sudo nixos-rebuild switch` from anywhere on the system, but it is
> not required.

41
doc/start/index.md Normal file
View file

@ -0,0 +1,41 @@
# Quick Start
The only dependency is nix, so make sure you have it [installed][install-nix].
## Get the Template
Here is a snippet that will get you the template without the git history:
```sh
nix-shell -p cachix --run "cachix use nrdxp"
nix-shell https://github.com/divnix/devos/archive/core.tar.gz -A shell \
--run "flk get core"
cd flk
nix-shell
git init
git add .
git commit -m init
```
This will place you in a new folder named `flk` with git initialized, and a
nix-shell that provides all the dependencies, including the unstable nix
version required.
In addition, the [binary cache](../integrations/cachix.md) is added for faster deployment.
> ##### _Notes:_
> - Flakes ignore files that have not been added to git, so be sure to stage new
> files before building the system.
> - You can choose to simply clone the repo with git if you want to follow
> upstream changes.
> - If the `nix-shell -p cachix --run "cachix use nrdxp"` line doesn't work
> you can try with sudo: `sudo nix-shell -p cachix --run "cachix use nrdxp"`
## Next Steps:
- [Make installable ISO](./iso.md)
- [Bootstrap Host](./bootstrapping.md)
- [Already on NixOS](./from-nixos.md)
[install-nix]: https://nixos.org/manual/nix/stable/#sect-multi-user-installation

22
doc/start/iso.md Normal file
View file

@ -0,0 +1,22 @@
# ISO
Making and writing an installable iso for `hosts/bootstrap.nix` is as simple as:
```sh
bud build bootstrap bootstrapIso
sudo -E $(which bud) burn
```
This works for any host.
## ISO image nix store & cache
The iso image holds the store to the live environment and _also_ acts as a binary cache
to the installer. To considerably speed up things, the image already includes all flake
`inputs` as well as the `devshell` closures.
While you _could_ provision any machine with a single stick, a custom-made iso for
the host you want to install DevOS to, maximises those local cache hits.
For hosts that don't differ too much, a single usb stick might be ok, whereas when
there are bigger differences, a custom-made usb stick will be considerably faster.

33
doc/tests.md Normal file
View file

@ -0,0 +1,33 @@
# Testing
Testing is always an important aspect of any software development project, and
NixOS offers some incredibly powerful tools to write tests for your
configuration, and, optionally, run them in
[CI](./integrations/hercules.md).
## Unit Tests
Unit tests can be created from regular derivations, and they can do
almost anything you can imagine. By convention, it is best to test your
packages during their [check phase][check]. All packages and their tests will
be built during CI.
## Integration Tests
All your profiles defined in suites will be tested in a NixOS VM.
You can write integration tests for one or more NixOS VMs that can,
optionally, be networked together, and yes, it's as awesome as it sounds!
Be sure to use the `mkTest` function from digga, `digga.lib.pkgs-lib.mkTest`
which wraps the official [testing-python][testing-python] function to ensure
that the system is setup exactly as it is for a bare DevOS system. There are
already great resources for learning how to use these tests effectively,
including the official [docs][test-doc], a fantastic [blog post][test-blog],
and the examples in [nixpkgs][nixos-tests].
[test-doc]: https://nixos.org/manual/nixos/stable/index.html#sec-nixos-tests
[test-blog]: https://www.haskellforall.com/2020/11/how-to-use-nixos-for-lightweight.html
[default]: https://github.com/divnix/devos/tree/core/tests/default.nix
[run-test]: https://github.com/NixOS/nixpkgs/blob/6571462647d7316aff8b8597ecdf5922547bf365/lib/debug.nix#L154-L166
[nixos-tests]: https://github.com/NixOS/nixpkgs/tree/master/nixos/tests
[testing-python]: https://github.com/NixOS/nixpkgs/tree/master/nixos/lib/testing-python.nix
[check]: https://nixos.org/manual/nixpkgs/stable/#ssec-check-phase

6
doc/theme/highlight.js vendored Normal file
View file

File diff suppressed because one or more lines are too long

925
flake.lock Normal file
View file

@ -0,0 +1,925 @@
{
"nodes": {
"agenix": {
"inputs": {
"nixpkgs": [
"nixos"
]
},
"locked": {
"lastModified": 1662241716,
"narHash": "sha256-urqPvSvvGUhkwzTDxUI8N1nsdMysbAfjmBNZaTYBZRU=",
"owner": "ryantm",
"repo": "agenix",
"rev": "c96da5835b76d3d8e8d99a0fec6fe32f8539ee2e",
"type": "github"
},
"original": {
"owner": "ryantm",
"repo": "agenix",
"type": "github"
}
},
"basant": {
"inputs": {
"flake-utils": "flake-utils",
"nixpkgs": [
"nixos"
],
"poonam": [
"poonam"
]
},
"locked": {
"lastModified": 1657514455,
"narHash": "sha256-rYrofeCRgZyiZMuuwbwbM7ZLNTj04S0l4G/1ZeH0gqI=",
"ref": "main",
"rev": "50f7ee786d9704ecfd67a9fe2eb8f338fc983dc1",
"revCount": 64,
"type": "git",
"url": "ssh://gitea@git.sealight.xyz/aynish/basant"
},
"original": {
"ref": "main",
"type": "git",
"url": "ssh://gitea@git.sealight.xyz/aynish/basant"
}
},
"blank": {
"locked": {
"lastModified": 1625557891,
"narHash": "sha256-O8/MWsPBGhhyPoPLHZAuoZiiHo9q6FLlEeIDEXuj6T4=",
"owner": "divnix",
"repo": "blank",
"rev": "5a5d2684073d9f563072ed07c871d577a6c614a8",
"type": "github"
},
"original": {
"owner": "divnix",
"repo": "blank",
"type": "github"
}
},
"darwin": {
"inputs": {
"nixpkgs": "nixpkgs"
},
"locked": {
"lastModified": 1651916036,
"narHash": "sha256-UuD9keUGm4IuVEV6wdSYbuRm7CwfXE63hVkzKDjVsh4=",
"owner": "LnL7",
"repo": "nix-darwin",
"rev": "2f2bdf658d2b79bada78dc914af99c53cad37cba",
"type": "github"
},
"original": {
"owner": "LnL7",
"repo": "nix-darwin",
"type": "github"
}
},
"deploy": {
"inputs": {
"flake-compat": "flake-compat",
"nixpkgs": [
"nixos"
],
"utils": "utils"
},
"locked": {
"lastModified": 1659725433,
"narHash": "sha256-1ZxuK67TL29YLw88vQ18Y2Y6iYg8Jb7I6/HVzmNB6nM=",
"owner": "serokell",
"repo": "deploy-rs",
"rev": "41f15759dd8b638e7b4f299730d94d5aa46ab7eb",
"type": "github"
},
"original": {
"owner": "serokell",
"repo": "deploy-rs",
"type": "github"
}
},
"devshell": {
"inputs": {
"flake-utils": "flake-utils_2",
"nixpkgs": "nixpkgs_2"
},
"locked": {
"lastModified": 1655976588,
"narHash": "sha256-VreHyH6ITkf/1EX/8h15UqhddJnUleb0HgbC3gMkAEQ=",
"owner": "numtide",
"repo": "devshell",
"rev": "899ca4629020592a13a46783587f6e674179d1db",
"type": "github"
},
"original": {
"owner": "numtide",
"repo": "devshell",
"type": "github"
}
},
"digga": {
"inputs": {
"blank": "blank",
"darwin": "darwin",
"deploy": [
"deploy"
],
"devshell": "devshell",
"flake-compat": "flake-compat_2",
"flake-utils-plus": "flake-utils-plus",
"home-manager": [
"home"
],
"latest": "latest",
"nixlib": [
"nixos"
],
"nixpkgs": [
"nixos"
],
"nixpkgs-unstable": "nixpkgs-unstable"
},
"locked": {
"lastModified": 1659622306,
"narHash": "sha256-Kpfm2PNs+kZU0W7qcugoPATLG8I2P7FJFGTgsf1LJiU=",
"owner": "divnix",
"repo": "digga",
"rev": "d1193743a535d7fbbc7f3eda4e51295b10bd4d2c",
"type": "github"
},
"original": {
"owner": "divnix",
"repo": "digga",
"type": "github"
}
},
"dirt-samples-src": {
"flake": false,
"locked": {
"lastModified": 1588278411,
"narHash": "sha256-h8vQxRym6QzNLOTZU7A43VCHuG0H77l+BFwXnC0L1CE=",
"owner": "tidalcycles",
"repo": "dirt-samples",
"rev": "66d432418c9a7d82cf049d9246adfa62f46df2a6",
"type": "github"
},
"original": {
"owner": "tidalcycles",
"ref": "master",
"repo": "dirt-samples",
"type": "github"
}
},
"eww": {
"inputs": {
"flake-compat": "flake-compat_3",
"nixpkgs": [
"nixos"
],
"rust-overlay": [
"rust-overlay"
]
},
"locked": {
"lastModified": 1663061357,
"narHash": "sha256-zMJslerxTcSQ+A8fI4gFcJioRGs+T55343zOtsnEJ3k=",
"owner": "elkowar",
"repo": "eww",
"rev": "52e9603dd8c79cbc267a4733389c1f7e7625b352",
"type": "github"
},
"original": {
"owner": "elkowar",
"repo": "eww",
"type": "github"
}
},
"flake-compat": {
"flake": false,
"locked": {
"lastModified": 1648199409,
"narHash": "sha256-JwPKdC2PoVBkG6E+eWw3j6BMR6sL3COpYWfif7RVb8Y=",
"owner": "edolstra",
"repo": "flake-compat",
"rev": "64a525ee38886ab9028e6f61790de0832aa3ef03",
"type": "github"
},
"original": {
"owner": "edolstra",
"repo": "flake-compat",
"type": "github"
}
},
"flake-compat_2": {
"flake": false,
"locked": {
"lastModified": 1650374568,
"narHash": "sha256-Z+s0J8/r907g149rllvwhb4pKi8Wam5ij0st8PwAh+E=",
"owner": "edolstra",
"repo": "flake-compat",
"rev": "b4a34015c698c7793d592d66adbab377907a2be8",
"type": "github"
},
"original": {
"owner": "edolstra",
"repo": "flake-compat",
"type": "github"
}
},
"flake-compat_3": {
"flake": false,
"locked": {
"lastModified": 1650374568,
"narHash": "sha256-Z+s0J8/r907g149rllvwhb4pKi8Wam5ij0st8PwAh+E=",
"owner": "edolstra",
"repo": "flake-compat",
"rev": "b4a34015c698c7793d592d66adbab377907a2be8",
"type": "github"
},
"original": {
"owner": "edolstra",
"repo": "flake-compat",
"type": "github"
}
},
"flake-compat_4": {
"flake": false,
"locked": {
"lastModified": 1650374568,
"narHash": "sha256-Z+s0J8/r907g149rllvwhb4pKi8Wam5ij0st8PwAh+E=",
"owner": "edolstra",
"repo": "flake-compat",
"rev": "b4a34015c698c7793d592d66adbab377907a2be8",
"type": "github"
},
"original": {
"owner": "edolstra",
"repo": "flake-compat",
"type": "github"
}
},
"flake-compat_5": {
"flake": false,
"locked": {
"lastModified": 1648199409,
"narHash": "sha256-JwPKdC2PoVBkG6E+eWw3j6BMR6sL3COpYWfif7RVb8Y=",
"owner": "edolstra",
"repo": "flake-compat",
"rev": "64a525ee38886ab9028e6f61790de0832aa3ef03",
"type": "github"
},
"original": {
"owner": "edolstra",
"repo": "flake-compat",
"type": "github"
}
},
"flake-utils": {
"locked": {
"lastModified": 1638122382,
"narHash": "sha256-sQzZzAbvKEqN9s0bzWuYmRaA03v40gaJ4+iL1LXjaeI=",
"owner": "numtide",
"repo": "flake-utils",
"rev": "74f7e4319258e287b0f9cb95426c9853b282730b",
"type": "github"
},
"original": {
"owner": "numtide",
"repo": "flake-utils",
"type": "github"
}
},
"flake-utils-plus": {
"inputs": {
"flake-utils": "flake-utils_3"
},
"locked": {
"lastModified": 1654029967,
"narHash": "sha256-my3GQ3mQIw/1f6GPV1IhUZrcYQSWh0YJAMPNBjhXJDw=",
"owner": "gytis-ivaskevicius",
"repo": "flake-utils-plus",
"rev": "6271cf3842ff9c8a9af9e3508c547f86bc77d199",
"type": "github"
},
"original": {
"owner": "gytis-ivaskevicius",
"ref": "refs/pull/120/head",
"repo": "flake-utils-plus",
"type": "github"
}
},
"flake-utils_2": {
"locked": {
"lastModified": 1642700792,
"narHash": "sha256-XqHrk7hFb+zBvRg6Ghl+AZDq03ov6OshJLiSWOoX5es=",
"owner": "numtide",
"repo": "flake-utils",
"rev": "846b2ae0fc4cc943637d3d1def4454213e203cba",
"type": "github"
},
"original": {
"owner": "numtide",
"repo": "flake-utils",
"type": "github"
}
},
"flake-utils_3": {
"locked": {
"lastModified": 1644229661,
"narHash": "sha256-1YdnJAsNy69bpcjuoKdOYQX0YxZBiCYZo4Twxerqv7k=",
"owner": "numtide",
"repo": "flake-utils",
"rev": "3cecb5b042f7f209c56ffd8371b2711a290ec797",
"type": "github"
},
"original": {
"owner": "numtide",
"repo": "flake-utils",
"type": "github"
}
},
"flake-utils_4": {
"locked": {
"lastModified": 1652372896,
"narHash": "sha256-lURGussfF3mGrFPQT3zgW7+RC0pBhbHzco0C7I+ilow=",
"owner": "numtide",
"repo": "flake-utils",
"rev": "0d347c56f6f41de822a4f4c7ff5072f3382db121",
"type": "github"
},
"original": {
"owner": "numtide",
"repo": "flake-utils",
"type": "github"
}
},
"flake-utils_5": {
"locked": {
"lastModified": 1659877975,
"narHash": "sha256-zllb8aq3YO3h8B/U0/J1WBgAL8EX5yWf5pMj3G0NAmc=",
"owner": "numtide",
"repo": "flake-utils",
"rev": "c0e246b9b83f637f4681389ecabcb2681b4f3af0",
"type": "github"
},
"original": {
"owner": "numtide",
"repo": "flake-utils",
"type": "github"
}
},
"flake-utils_6": {
"locked": {
"lastModified": 1649676176,
"narHash": "sha256-OWKJratjt2RW151VUlJPRALb7OU2S5s+f0vLj4o1bHM=",
"owner": "numtide",
"repo": "flake-utils",
"rev": "a4b154ebbdc88c8498a5c7b01589addc9e9cb678",
"type": "github"
},
"original": {
"owner": "numtide",
"repo": "flake-utils",
"type": "github"
}
},
"flake-utils_7": {
"locked": {
"lastModified": 1656928814,
"narHash": "sha256-RIFfgBuKz6Hp89yRr7+NR5tzIAbn52h8vT6vXkYjZoM=",
"owner": "numtide",
"repo": "flake-utils",
"rev": "7e2a3b3dfd9af950a856d66b0a7d01e3c18aa249",
"type": "github"
},
"original": {
"owner": "numtide",
"repo": "flake-utils",
"type": "github"
}
},
"grasp": {
"inputs": {
"flake-utils": "flake-utils_4",
"grasp": "grasp_2",
"nixpkgs": [
"nixos"
]
},
"locked": {
"lastModified": 1652615971,
"narHash": "sha256-e8fvTQCR/At2jgenuY71WXN13XawYRiMpKiHSGgGSkY=",
"ref": "main",
"rev": "ef605857248ec1b60cece250f98d2964164d48db",
"revCount": 19,
"type": "git",
"url": "ssh://gitea@git.sealight.xyz/aynish/grasp.git"
},
"original": {
"ref": "main",
"type": "git",
"url": "ssh://gitea@git.sealight.xyz/aynish/grasp.git"
}
},
"grasp_2": {
"flake": false,
"locked": {
"lastModified": 1586706168,
"narHash": "sha256-xLkxE24xtTghQpAfAqAsOvsGpz0coACXjNT8bHZhcxM=",
"owner": "karlicoss",
"repo": "grasp",
"rev": "4bc8f011227d1baa18b4e98543561534065490d8",
"type": "github"
},
"original": {
"owner": "karlicoss",
"repo": "grasp",
"type": "github"
}
},
"home": {
"inputs": {
"nixpkgs": [
"nixos"
]
},
"locked": {
"lastModified": 1656169755,
"narHash": "sha256-Nlnm4jeQWEGjYrE6hxi/7HYHjBSZ/E0RtjCYifnNsWk=",
"owner": "nix-community",
"repo": "home-manager",
"rev": "4a3d01fb53f52ac83194081272795aa4612c2381",
"type": "github"
},
"original": {
"owner": "nix-community",
"ref": "release-22.05",
"repo": "home-manager",
"type": "github"
}
},
"latest": {
"locked": {
"lastModified": 1657265485,
"narHash": "sha256-PUQ9C7mfi0/BnaAUX2R/PIkoNCb/Jtx9EpnhMBNrO/o=",
"owner": "nixos",
"repo": "nixpkgs",
"rev": "b39924fc7764c08ae3b51beef9a3518c414cdb7d",
"type": "github"
},
"original": {
"owner": "nixos",
"ref": "nixos-unstable",
"repo": "nixpkgs",
"type": "github"
}
},
"latest_2": {
"locked": {
"lastModified": 1663178737,
"narHash": "sha256-ayOtdyoNx6BqJtTYVzdQCDz/YWb67TY/CMGacFCgNQo=",
"owner": "nixos",
"repo": "nixpkgs",
"rev": "1158501e7c7cba26d922723cf9f70099995eb755",
"type": "github"
},
"original": {
"owner": "nixos",
"ref": "nixos-unstable",
"repo": "nixpkgs",
"type": "github"
}
},
"naersk": {
"inputs": {
"nixpkgs": [
"nixos"
]
},
"locked": {
"lastModified": 1662220400,
"narHash": "sha256-9o2OGQqu4xyLZP9K6kNe1pTHnyPz0Wr3raGYnr9AIgY=",
"owner": "nmattia",
"repo": "naersk",
"rev": "6944160c19cb591eb85bbf9b2f2768a935623ed3",
"type": "github"
},
"original": {
"owner": "nmattia",
"repo": "naersk",
"type": "github"
}
},
"neovim-flake": {
"inputs": {
"flake-utils": "flake-utils_5",
"nixpkgs": "nixpkgs_3"
},
"locked": {
"dir": "contrib",
"lastModified": 1663315670,
"narHash": "sha256-RGoY9o0dN6BhOcjhJxw6XYSxUIDu+tAJl4vp7d9EBSM=",
"owner": "neovim",
"repo": "neovim",
"rev": "0b7a3c173c929085f54a178c9fa852481d5f021e",
"type": "github"
},
"original": {
"dir": "contrib",
"owner": "neovim",
"repo": "neovim",
"type": "github"
}
},
"neovim-nightly": {
"inputs": {
"flake-compat": "flake-compat_4",
"neovim-flake": "neovim-flake",
"nixpkgs": [
"nixos"
]
},
"locked": {
"lastModified": 1663316300,
"narHash": "sha256-QvFH3kiYJP+KTenixYDIp9bx3xyD36UQse3L4qfC6e4=",
"owner": "nix-community",
"repo": "neovim-nightly-overlay",
"rev": "dd84dca0ba386b7e49bae4255279d3c4cde9625c",
"type": "github"
},
"original": {
"owner": "nix-community",
"repo": "neovim-nightly-overlay",
"type": "github"
}
},
"nixos": {
"locked": {
"lastModified": 1663433994,
"narHash": "sha256-Bpthhv1PdZRrIFct8KbHACNvOu9bsYAMEaqoH83cvqM=",
"owner": "nixos",
"repo": "nixpkgs",
"rev": "17989edb05615c4f61803b9c427d80b84c289c6b",
"type": "github"
},
"original": {
"owner": "nixos",
"ref": "release-22.05",
"repo": "nixpkgs",
"type": "github"
}
},
"nixos-hardware": {
"locked": {
"lastModified": 1663229557,
"narHash": "sha256-1uU4nsDLXKG0AHc/VCsNBAEPkTA/07juYhcEWRb1O1E=",
"owner": "nixos",
"repo": "nixos-hardware",
"rev": "a0df6cd6e199df4a78c833c273781ea92fa62cfb",
"type": "github"
},
"original": {
"owner": "nixos",
"repo": "nixos-hardware",
"type": "github"
}
},
"nixpkgs": {
"locked": {
"lastModified": 1663419078,
"narHash": "sha256-cxEeMnaTGMTeDAvXnZmqcF50qoyJOsQENhYxSnW9ZMs=",
"owner": "NixOS",
"repo": "nixpkgs",
"rev": "0cfb3c002b61807ca0bab3efe514476bdf2e5478",
"type": "github"
},
"original": {
"id": "nixpkgs",
"type": "indirect"
}
},
"nixpkgs-unstable": {
"locked": {
"lastModified": 1657292830,
"narHash": "sha256-ldfVSTveWceDCmW6gf3B4kR6vwmz/XS80y5wsLLHFJU=",
"owner": "nixos",
"repo": "nixpkgs",
"rev": "334ec8b503c3981e37a04b817a70e8d026ea9e84",
"type": "github"
},
"original": {
"owner": "nixos",
"ref": "nixpkgs-unstable",
"repo": "nixpkgs",
"type": "github"
}
},
"nixpkgs_2": {
"locked": {
"lastModified": 1663419078,
"narHash": "sha256-cxEeMnaTGMTeDAvXnZmqcF50qoyJOsQENhYxSnW9ZMs=",
"owner": "NixOS",
"repo": "nixpkgs",
"rev": "0cfb3c002b61807ca0bab3efe514476bdf2e5478",
"type": "github"
},
"original": {
"owner": "NixOS",
"ref": "nixpkgs-unstable",
"repo": "nixpkgs",
"type": "github"
}
},
"nixpkgs_3": {
"locked": {
"lastModified": 1663357389,
"narHash": "sha256-oYA2nVRSi6yhCBqS5Vz465Hw+3BQOVFEhfbfy//3vTs=",
"owner": "nixos",
"repo": "nixpkgs",
"rev": "da6a05816e7fa5226c3f61e285ef8d9dfc868f3c",
"type": "github"
},
"original": {
"owner": "nixos",
"ref": "nixos-unstable",
"repo": "nixpkgs",
"type": "github"
}
},
"nixpkgs_4": {
"locked": {
"lastModified": 1662446902,
"narHash": "sha256-Dmsd3jSG2ldZUlhFaIwunqgMf14EEK7ylXpw+OPDLxE=",
"owner": "nixos",
"repo": "nixpkgs",
"rev": "3bfaf06b12253ddaafe64a67f4ed39b547d41667",
"type": "github"
},
"original": {
"owner": "nixos",
"repo": "nixpkgs",
"type": "github"
}
},
"nixpkgs_5": {
"locked": {
"lastModified": 1663489134,
"narHash": "sha256-YqM45LLzvgBNbvIK0QQa8cY8omKS0+bRUg4JWzEj14w=",
"owner": "nixos",
"repo": "nixpkgs",
"rev": "830e228898ac7a66eeafb169dd3df0dc427674d4",
"type": "github"
},
"original": {
"owner": "nixos",
"repo": "nixpkgs",
"type": "github"
}
},
"nur": {
"locked": {
"lastModified": 1663393873,
"narHash": "sha256-DtumXhmyA9gpu0+qa5fwvU93qKqtx0AtUFvfazPzz1Y=",
"owner": "nix-community",
"repo": "NUR",
"rev": "ecf7442437f53f0f689df6897c10a7f9a4f6b9ae",
"type": "github"
},
"original": {
"id": "nur",
"type": "indirect"
}
},
"nvfetcher": {
"inputs": {
"flake-compat": "flake-compat_5",
"flake-utils": "flake-utils_6",
"nixpkgs": [
"nixos"
]
},
"locked": {
"lastModified": 1654975372,
"narHash": "sha256-wkNZ16akgKViuZzE/IM+bux4uaJ04KIwUeexH8gBjgw=",
"owner": "berberman",
"repo": "nvfetcher",
"rev": "d4b237c10f14f72f8266b0f658faad822e491e55",
"type": "github"
},
"original": {
"owner": "berberman",
"repo": "nvfetcher",
"type": "github"
}
},
"poonam": {
"inputs": {
"nixpkgs": "nixpkgs_4",
"vimwiki-cli": "vimwiki-cli"
},
"locked": {
"lastModified": 1663038000,
"narHash": "sha256-Uf1aohzvF8nxrKW0Dli7+JfOouu4oGEP/lqRYycSapI=",
"ref": "main",
"rev": "bc78a43646dd833be3c17513d09661610ec2dfb0",
"revCount": 385,
"type": "git",
"url": "ssh://gitea@git.sealight.xyz/aynish/kitaab"
},
"original": {
"ref": "main",
"type": "git",
"url": "ssh://gitea@git.sealight.xyz/aynish/kitaab"
}
},
"root": {
"inputs": {
"agenix": "agenix",
"basant": "basant",
"deploy": "deploy",
"digga": "digga",
"eww": "eww",
"grasp": "grasp",
"home": "home",
"latest": "latest_2",
"naersk": "naersk",
"neovim-nightly": "neovim-nightly",
"nixos": "nixos",
"nixos-hardware": "nixos-hardware",
"nur": "nur",
"nvfetcher": "nvfetcher",
"poonam": "poonam",
"rust-overlay": "rust-overlay",
"tidalcycles": "tidalcycles"
}
},
"rust-overlay": {
"inputs": {
"flake-utils": "flake-utils_7",
"nixpkgs": [
"nixos"
]
},
"locked": {
"lastModified": 1663383457,
"narHash": "sha256-WoHXGHVmOv883HyH2Rvqh3XJE0Dk2YSZfLJyedSMr4U=",
"owner": "oxalica",
"repo": "rust-overlay",
"rev": "e4c6adaa5f9293911de5ad50eaf32dbe36819de3",
"type": "github"
},
"original": {
"owner": "oxalica",
"repo": "rust-overlay",
"type": "github"
}
},
"superdirt-src": {
"flake": false,
"locked": {
"lastModified": 1611740180,
"narHash": "sha256-GtnqZeMFqFkVhgx2Exu0wY687cHa7mNnVCgjQd6fiIA=",
"owner": "musikinformatik",
"repo": "superdirt",
"rev": "7abb62e89649daa1232b9cbd6427241868abd30e",
"type": "github"
},
"original": {
"owner": "musikinformatik",
"ref": "master",
"repo": "superdirt",
"type": "github"
}
},
"tidal-src": {
"flake": false,
"locked": {
"lastModified": 1654350756,
"narHash": "sha256-tONM5SYYBca0orTLH1EUOilSC1FCluWrFt8AetUx+YQ=",
"owner": "tidalcycles",
"repo": "tidal",
"rev": "fda9c1ecb3722698935245e5409ef8ccdfca16c8",
"type": "github"
},
"original": {
"owner": "tidalcycles",
"ref": "main",
"repo": "tidal",
"type": "github"
}
},
"tidalcycles": {
"inputs": {
"dirt-samples-src": "dirt-samples-src",
"nixpkgs": [
"latest"
],
"superdirt-src": "superdirt-src",
"tidal-src": "tidal-src",
"utils": "utils_2",
"vim-tidal-src": "vim-tidal-src",
"vowel-src": "vowel-src"
},
"locked": {
"lastModified": 1661670241,
"narHash": "sha256-+5C83z+Sd8ugvMshrXqpca4vv3tQ2D4tYEJ3QY6JVsg=",
"owner": "mitchmindtree",
"repo": "tidalcycles.nix",
"rev": "fefe3d586511e1cfaac79bb83ec0b278bb1b6bad",
"type": "github"
},
"original": {
"owner": "mitchmindtree",
"repo": "tidalcycles.nix",
"type": "github"
}
},
"utils": {
"locked": {
"lastModified": 1648297722,
"narHash": "sha256-W+qlPsiZd8F3XkzXOzAoR+mpFqzm3ekQkJNa+PIh1BQ=",
"owner": "numtide",
"repo": "flake-utils",
"rev": "0f8662f1319ad6abf89b3380dd2722369fc51ade",
"type": "github"
},
"original": {
"owner": "numtide",
"repo": "flake-utils",
"type": "github"
}
},
"utils_2": {
"locked": {
"lastModified": 1653893745,
"narHash": "sha256-0jntwV3Z8//YwuOjzhV2sgJJPt+HY6KhU7VZUL0fKZQ=",
"owner": "numtide",
"repo": "flake-utils",
"rev": "1ed9fb1935d260de5fe1c2f7ee0ebaae17ed2fa1",
"type": "github"
},
"original": {
"owner": "numtide",
"repo": "flake-utils",
"type": "github"
}
},
"vim-tidal-src": {
"flake": false,
"locked": {
"lastModified": 1661670183,
"narHash": "sha256-HU075U97COak/Xqw+4ifVkEEIgWzGvwRoR3q9LGKl8s=",
"owner": "mitchmindtree",
"repo": "vim-tidal",
"rev": "5c1e70ee3d2b4655b8ccba11422866c496610ca8",
"type": "github"
},
"original": {
"owner": "mitchmindtree",
"ref": "mitchmindtree",
"repo": "vim-tidal",
"type": "github"
}
},
"vimwiki-cli": {
"inputs": {
"nixpkgs": "nixpkgs_5"
},
"locked": {
"lastModified": 1662448409,
"narHash": "sha256-Xd8CuFcEpEQK/TjNBXcp1HqPJCc7LwkMqKa1WiAP1Zc=",
"ref": "main",
"rev": "a73c4695cf116c2e8194a5caa837c2f9e1a7e2fb",
"revCount": 7,
"type": "git",
"url": "ssh://gitea@git.sealight.xyz/aynish/vimwiki-cli"
},
"original": {
"ref": "main",
"type": "git",
"url": "ssh://gitea@git.sealight.xyz/aynish/vimwiki-cli"
}
},
"vowel-src": {
"flake": false,
"locked": {
"lastModified": 1641306144,
"narHash": "sha256-zfF6cvAGDNYWYsE8dOIo38b+dIymd17Pexg0HiPFbxM=",
"owner": "supercollider-quarks",
"repo": "vowel",
"rev": "ab59caa870201ecf2604b3efdd2196e21a8b5446",
"type": "github"
},
"original": {
"owner": "supercollider-quarks",
"ref": "master",
"repo": "vowel",
"type": "github"
}
}
},
"root": "root",
"version": 7
}

185
flake.nix Normal file
View file

@ -0,0 +1,185 @@
{
description = "A highly structured configuration database.";
inputs =
{
# Nix
nixos.url = "github:nixos/nixpkgs/release-22.05";
latest.url = "github:nixos/nixpkgs/nixos-unstable";
# Community
home.url = "github:nix-community/home-manager/release-22.05";
home.inputs.nixpkgs.follows = "nixos";
nixos-hardware.url = "github:nixos/nixos-hardware";
# Lib
digga.url = "github:divnix/digga";
digga.inputs.nixpkgs.follows = "nixos";
digga.inputs.nixlib.follows = "nixos";
digga.inputs.home-manager.follows = "home";
digga.inputs.deploy.follows = "deploy";
nvfetcher.url = "github:berberman/nvfetcher";
nvfetcher.inputs.nixpkgs.follows = "nixos";
naersk.url = "github:nmattia/naersk";
naersk.inputs.nixpkgs.follows = "nixos";
# Tools
agenix.url = "github:ryantm/agenix";
agenix.inputs.nixpkgs.follows = "nixos";
deploy.url = "github:serokell/deploy-rs";
deploy.inputs.nixpkgs.follows = "nixos";
# Packages
poonam.url = "git+ssh://gitea@git.sealight.xyz/aynish/kitaab?ref=main";
basant.url = "git+ssh://gitea@git.sealight.xyz/aynish/basant?ref=main";
basant.inputs.nixpkgs.follows = "nixos";
basant.inputs.poonam.follows = "poonam";
rust-overlay = {
url = "github:oxalica/rust-overlay";
inputs.nixpkgs.follows = "nixos";
};
eww = {
url = "github:elkowar/eww";
inputs.nixpkgs.follows = "nixos";
inputs.rust-overlay.follows = "rust-overlay";
};
# eww follows rust nightly
# eww.inputs.nixpkgs.follows = "latest";
grasp.url = "git+ssh://gitea@git.sealight.xyz/aynish/grasp.git?ref=main";
grasp.inputs.nixpkgs.follows = "nixos";
tidalcycles.url = "github:mitchmindtree/tidalcycles.nix";
tidalcycles.inputs.nixpkgs.follows = "latest";
neovim-nightly.url = "github:nix-community/neovim-nightly-overlay";
neovim-nightly.inputs.nixpkgs.follows = "nixos";
# TODO hundred rabbits software
# TODO not quite useful yet, since it needs secrets
# dhyan.url = "git+ssh://gitea@git.sealight.xyz/aynish/dhyan?ref=main";
# dhyan.inputs.nixpkgs.follows = "nixos";
};
outputs =
{ self
, digga
, nixos
, home
, nixos-hardware
, nur
, agenix
, nvfetcher
, deploy
, basant
, grasp
, tidalcycles
, neovim-nightly
, rust-overlay
, eww
, ...
} @ inputs:
digga.lib.mkFlake
{
inherit self inputs;
supportedSystems = [
"x86_64-linux"
];
channelsConfig = { allowUnfree = true; };
channels = {
nixos = {
imports = [ (digga.lib.importOverlays ./overlays) ];
overlays = [
nur.overlay
agenix.overlay
nvfetcher.overlay
deploy.overlay
./pkgs/default.nix
tidalcycles.overlays.default
neovim-nightly.overlay
rust-overlay.overlays.default
eww.overlays.default
];
};
latest = { };
};
lib = import ./lib { lib = digga.lib // nixos.lib; };
sharedOverlays = [
(final: prev: {
__dontExport = true;
lib = prev.lib.extend (lfinal: lprev: {
our = self.lib;
});
})
];
nixos = {
hostDefaults = {
system = "x86_64-linux";
channelName = "nixos";
imports = [ (digga.lib.importExportableModules ./modules) ];
modules = [
{ lib.our = self.lib; }
digga.nixosModules.nixConfig
home.nixosModules.home-manager
agenix.nixosModules.age
];
};
imports = [ (digga.lib.importHosts ./hosts) ];
hosts = {
/* set host specific properties here */
curve = {
modules = [
]; # nixos-hardware.nixosModules.lenovo-thinkpad
# Yubikey
};
cube = {
modules = [ basant.nixosModule ];
};
box = {
modules = [
grasp.nixosModule
];
};
# helix = { };
# work = { };
};
importables = rec {
profiles = digga.lib.rakeLeaves ./profiles // {
users = digga.lib.rakeLeaves ./users;
};
suites = with profiles; rec {
base = [ core users.root users.anish ];
sealight = [ base server metrics gitea sealight-website backup rss-bridge mount-mossnet matrix ]; #
mossnet = [ base server taskd shaarli dns monitoring nfs rss-bridge gonic headphones radicale seafile syncthing dhyan calibre wallabag ]; # hpi sync.music
cube = [ base site server ];
graphical = [ base bluetooth music sync.kitaab sync.website sync.cal wifi desktop mimetypes ];
curve = [ graphical secrets syncthing ];
work = [ base ];
};
};
};
home = {
imports = [ (digga.lib.importExportableModules ./users/modules) ];
# exportedModules = [ ];
# modules = [ ];
importables = rec {
profiles = digga.lib.rakeLeaves ./users/profiles;
suites = with profiles; rec {
hmBase = [ direnv git nvim cli task ];
gui = [ hmBase firefox desktop email cal ];
work = [ hmBase firefox ];
};
};
users = {
nixos = { suites, ... }: { imports = suites.hmBase; };
anish = { suites, ... }: { imports = suites.gui; };
anishlakhwara = { suites, ... }: { imports = suites.work; };
}; # digga.lib.importers.rakeLeaves ./users/hm;
};
devshell = ./shell;
homeConfigurations = digga.lib.mkHomeConfigurations self.nixosConfigurations;
deploy.nodes = digga.lib.mkDeployNodes self.nixosConfigurations { };
};
}

18
hosts/bootstrap.nix Normal file
View file

@ -0,0 +1,18 @@
{ profiles, ... }:
{
# build with: `bud build bootstrap bootstrapIso`
# reachable on the local link via ssh root@fe80::47%eno1
# where 'eno1' is replaced by your own machine's network
# interface that has the local link to the target machine
imports = [
# profiles.networking
profiles.core
profiles.users.root # make sure to configure ssh keys
profiles.users.nixos
];
boot.loader.systemd-boot.enable = true;
# will be overridden by the bootstrapIso instrumentation
fileSystems."/" = { device = "/dev/disk/by-label/nixos"; };
}

95
hosts/box/configuration.nix Normal file
View file

@ -0,0 +1,95 @@
# Edit this configuration file to define what should be installed on
# your system. Help is available in the configuration.nix(5) man page
# and in the NixOS manual (accessible by running ‘nixos-help’).
{ config, pkgs, ... }:
{
imports =
[
# Include the results of the hardware scan.
./hardware-configuration.nix
];
# Use the GRUB 2 boot loader.
boot.loader.efi.canTouchEfiVariables = false;
boot.loader.efi.efiSysMountPoint = "/boot/efi";
boot.loader.grub = {
enable = true;
device = "nodev";
version = 2;
efiSupport = true;
enableCryptodisk = true;
efiInstallAsRemovable = true;
};
boot.initrd.secrets = {
"/keyfile0.bin" = /etc/secrets/initrd/keyfile0.bin;
"/keyfile1.bin" = /etc/secrets/initrd/keyfile1.bin;
};
boot.initrd.luks.devices = {
"root" = {
#name = "root";
device = "/dev/disk/by-uuid/f37f3222-47d7-42d8-b400-363320a31853"; # UUID for /dev/nvme01np2
preLVM = true;
allowDiscards = true;
keyFile = "/keyfile0.bin";
};
};
# Data mount
# fileSystems."/data" = {
# device = "/dev/disk/by-uuid/3276a297-9ee4-4998-b262-1ed100366c06"; # UUID for /dev/mapper/crypted-data
# encrypted = {
# enable = true;
# label = "crypted-data";
# blkDev = "/dev/disk/by-uuid/8a317bf4-fe13-4334-a6df-5fe5a5048b5e"; # UUID for /dev/sda1
# keyFile = "/keyfile1.bin";
# };
# };
networking.interfaces.enp2s0 = {
ipv4.addresses = [{
address = "192.168.1.240";
prefixLength = 24;
}];
ipv4.routes = [{ address = "192.168.1.0"; prefixLength = 24; via = "192.168.1.1"; }];
useDHCP = false;
};
#networking.nameservers = [ "172.16.11.240" ];
networking.nameservers = [ "192.168.1.1" ];
networking.defaultGateway = {
address = "192.168.1.1";
interface = "enp2s0";
};
networking.hostName = "box"; # Define your hostname.
# networking.wireless.enable = true; # Enables wireless support via wpa_supplicant.
# The global useDHCP flag is deprecated, therefore explicitly set to false here.
# Per-interface useDHCP will be mandatory in the future, so this generated config
# replicates the default behaviour.
networking.useDHCP = false;
networking.interfaces.wlp3s0.useDHCP = true;
# Set your time zone.
time.timeZone = "Australia/Brisbane";
# Enable the OpenSSH daemon.
services.openssh.enable = true;
networking.firewall.allowedTCPPorts = [ 22 ];
sound.enable = false;
programs.gnupg.agent.enable = true;
programs.gnupg.agent.pinentryFlavor = "curses";
programs.gnupg.agent.enableSSHSupport = true;
# This value determines the NixOS release with which your system is to be
# compatible, in order to avoid breaking some software such as database
# servers. You should change this only after NixOS release notes say you
# should.
system.stateVersion = "19.09"; # Did you read the comment?
}

49
hosts/box/default.nix Normal file
View file

@ -0,0 +1,49 @@
{ self, pkgs, profiles, suites, ... }:
{
imports = [
./configuration.nix
] ++ suites.mossnet;
home-manager.users.anish = { self, suites, ... }: {
imports = [ ] ++ suites.hmBase;
};
# For some reason this doesn't work in the profile, but does over here??
# Something weird in the way I'm importing nixpkgs in the profile or something
services."grasp".enable = true;
services."grasp".path = "/home/anish/kitaab/grasp/grasp.wiki";
services."grasp".user = "anish";
# Backups
age.secrets.borg-password.file = "${self}/secrets/borg-password.age";
services.postgresqlBackup = {
enable = true;
databases = [ "wallabag" ];
location = "/var/backup/postgresql";
};
mossnet.backup = {
enable = true;
name = "mossnet";
paths = [
"/var/lib/taskserver" # taskwarrior
"/var/www/shaarli-config" # sharli
"/var/backup/postgresql" # wallabag
"/var/lib/radicale" # radicale
"/home/anish/usr/drawing" # syncthing
"/home/anish/usr/nonfiction" # syncthing
"/mnt/two/postgres" # sealight postgres backups TODO remove once moved to capsul
];
# seafile
};
age.secrets.box-wg.file = "${self}/secrets/box-wg.age";
age.secrets.box-wg.owner = "anish";
mossnet.wg = {
enable = true;
ips = [ "10.0.69.4/24" ];
privateKeyFile = "/run/agenix/box-wg";
};
services.syncthing.guiAddress = "0.0.0.0:8384"; # public syncthing
system.stateVersion = "19.09";
}

52
hosts/box/hardware-configuration.nix Normal file
View file

@ -0,0 +1,52 @@
# Do not modify this file! It was generated by ‘nixos-generate-config’
# and may be overwritten by future invocations. Please make changes
# to /etc/nixos/configuration.nix instead.
{ config, lib, pkgs, modulesPath, ... }:
{
imports =
[
(modulesPath + "/installer/scan/not-detected.nix")
];
boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "thunderbolt" "uas" "usb_storage" "sd_mod" ];
boot.initrd.kernelModules = [ "dm-snapshot" ];
boot.kernelModules = [ "kvm-intel" ];
boot.extraModulePackages = [ ];
fileSystems."/" =
{
device = "/dev/disk/by-uuid/ade0752d-84d3-4e39-865b-9027ba2d5c67";
fsType = "ext4";
};
fileSystems."/boot/efi" =
{
device = "/dev/disk/by-uuid/1715-278E";
fsType = "vfat";
};
fileSystems."/mnt/one" =
{
device = "/dev/disk/by-uuid/0f857c6e-509d-436f-9e78-bc25f1b0d23b";
fsType = "ext4";
};
fileSystems."/mnt/two" =
{
device = "/dev/disk/by-uuid/5bc894bf-ed87-4c30-aab4-87e154e0cd08";
fsType = "ext4";
};
fileSystems."/mnt/three" =
{
device = "/dev/disk/by-uuid/0be3ded1-9c8b-40aa-94ca-dc2297d5988e";
fsType = "ext4";
};
swapDevices =
[{ device = "/dev/disk/by-uuid/b790abb4-ba5f-4476-8f09-b0fc575414aa"; }];
powerManagement.cpuFreqGovernor = lib.mkDefault "powersave";
hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
}

34
hosts/cube/configuration.nix Normal file
View file

@ -0,0 +1,34 @@
{ config, pkgs, ... }:
{
imports =
[
# Include the results of the hardware scan.
./hardware-configuration.nix
];
boot.loader.grub.enable = true;
boot.loader.grub.version = 2;
boot.loader.grub.device = "/dev/vda"; # or "nodev" for efi only
networking.hostName = "cube"; # Define your hostname.
time.timeZone = "Australia/Brisbane";
networking.useDHCP = false;
networking.interfaces.ens3.useDHCP = true;
i18n.defaultLocale = "en_US.UTF-8";
environment.systemPackages = with pkgs; [
vim
gitAndTools.gitFull
];
# This value determines the NixOS release from which the default
# settings for stateful data, like file locations and database versions
# on your system were taken. It‘s perfectly fine and recommended to leave
# this value at the release version of the first install of this system.
# Before changing this value read the documentation for this option
# (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
system.stateVersion = "21.11"; # Did you read the comment?
}

10
hosts/cube/default.nix Normal file
View file

@ -0,0 +1,10 @@
{ profiles, suites, ... }:
{
imports = [
./configuration.nix
] ++ suites.cube;
home-manager.users.anish = { self, suites, ... }: {
imports = [ ] ++ suites.hmBase;
};
}

29
hosts/cube/hardware-configuration.nix Normal file
View file

@ -0,0 +1,29 @@
# Do not modify this file! It was generated by ‘nixos-generate-config’
# and may be overwritten by future invocations. Please make changes
# to /etc/nixos/configuration.nix instead.
{ config, lib, pkgs, modulesPath, ... }:
{
imports =
[ (modulesPath + "/profiles/qemu-guest.nix")
];
boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "sr_mod" "virtio_blk" ];
boot.initrd.kernelModules = [ ];
boot.kernelModules = [ ];
boot.extraModulePackages = [ ];
fileSystems."/" =
{ device = "/dev/disk/by-uuid/9233d8be-539f-43c8-9b83-84b5b4d72a93";
fsType = "ext4";
};
fileSystems."/boot" =
{ device = "/dev/disk/by-uuid/E00D-9070";
fsType = "vfat";
};
swapDevices = [ ];
hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
}

50
hosts/curve/configuration.nix Normal file
View file

@ -0,0 +1,50 @@
{
imports = [ ./hardware-configuration.nix ];
boot.loader.grub.enable = true;
boot.loader.grub.version = 2;
# Define on which hard drive you want to install Grub.
boot.loader.grub.device = "/dev/sda"; # or "nodev" for efi only
# Minimal list of modules to use the EFI system partition and the YubiKey
boot.initrd.kernelModules = [ "vfat" "nls_cp437" "nls_iso8859-1" "usbhid" ];
# Enable support for the YubiKey PBA
boot.initrd.luks.yubikeySupport = true;
# Configuration to use your Luks device
boot.initrd.luks.devices = {
"crypthome" = {
device = "/dev/sda2";
preLVM = true; # You may want to set this to false if you need to start a network service first
yubikey = {
slot = 2;
twoFactor = true; # Set to false if you did not set up a user password.
storage = {
device = "/dev/sda1";
};
};
};
};
networking.hostName = "curve";
#networking.wireless.enable = true; # Enables wireless support via wpa_supplicant.
time.timeZone = "Australia/Brisbane";
networking.useDHCP = false;
networking.interfaces.enp0s31f6.useDHCP = true;
networking.interfaces.wlp3s0.useDHCP = true;
networking.wireless.enable = true;
networking.wireless.interfaces = [ "wlp3s0" ];
networking.wireless.userControlled.enable = true;
# Select internationalisation properties.
i18n.defaultLocale = "en_US.UTF-8";
# console = {
# font = "Lat2-Terminus16";
# keyMap = "us";
# };
sound.enable = true;
services.xserver.libinput.enable = true;
}

16
hosts/curve/curve.nix Normal file
View file

@ -0,0 +1,16 @@
{ profiles, suites, ... }:
{
imports = [
profiles.core
profiles.users.anish
profiles.hardware.curve # how else to deal with hardware?
];
bud.enable = true;
# Speed up boot by removing dependency on network
systemd = {
targets.network-online.wantedBy = pkgs.lib.mkForce [ ]; # Normally ["multi-user.target"]
services.NetworkManager-wait-online.wantedBy = pkgs.lib.mkForce [ ]; # Normally ["network-online.target"]
};
}

152
hosts/curve/default.nix Normal file
View file

@ -0,0 +1,152 @@
{ self, profiles, suites, ... }:
{
imports = [
./configuration.nix
profiles.mossnet-hosts
] ++ suites.curve;
home-manager.users.anish = { suites, ... }: {
imports = suites.gui;
};
programs.gnupg.agent.pinentryFlavor = "gnome3";
fileSystems."/mnt/ftp" = {
device = "192.168.1.240:/home/ftp";
fsType = "nfs";
options = [ "x-systemd.automount" "noauto" "x-systemd.idle-timeout=600" ];
};
fileSystems."/mnt/tv" = {
device = "192.168.1.240:/mnt/three/tv";
fsType = "nfs";
options = [ "x-systemd.automount" "noauto" "x-systemd.idle-timeout=600" ];
};
fileSystems."/mnt/movies" = {
device = "192.168.1.240:/mnt/three/movies";
fsType = "nfs";
options = [ "x-systemd.automount" "noauto" "x-systemd.idle-timeout=600" ];
};
boot.supportedFilesystems = [ "ntfs" ];
# lazy enable of ports necessary for KDE connect which is installed via cli home profile (for some reason?)
networking.firewall = {
allowedTCPPortRanges = [{ from = 1714; to = 1764; }];
allowedUDPPortRanges = [{ from = 1714; to = 1764; }];
};
age.secrets.curve-wg.file = "${self}/secrets/curve-wg.age";
age.secrets.curve-wg.owner = "anish";
mossnet.wg = {
enable = true;
ips = [ "10.0.69.2/24" ];
privateKeyFile = "/run/agenix/curve-wg";
};
age.secrets.borg-password.file = "${self}/secrets/borg-password.age";
mossnet.backup = {
enable = true;
name = "curve";
paths = [ "/home/anish" ];
};
# enable adb
# TODO move this (it's for KaiOS WebIDE devShell?)
programs.adb.enable = true;
#virtualisation.docker.enable = true;
boot.blacklistedKernelModules = [ "qcserial" ];
# Used for packer Capsul
users.users.anish.extraGroups = [ "adbusers" "wheel" "plugdev" "libvertd" ];
virtualisation.libvirtd.enable = true;
hardware.keyboard.zsa.enable = true;
services.udev.extraRules = ''
# Qualcomm EDL
SUBSYSTEMS=="usb", ATTRS{idVendor}=="05c6", ATTRS{idProduct}=="9008", MODE="0666", GROUP="plugdev"
# Qualcomm Memory Debug
SUBSYSTEMS=="usb", ATTRS{idVendor}=="05c6", ATTRS{idProduct}=="9006", MODE="0666", GROUP="plugdev"
# Atmel DFU
### ATmega16U2
SUBSYSTEMS=="usb", ATTRS{idVendor}=="03eb", ATTRS{idProduct}=="2fef", TAG+="uaccess"
### ATmega32U2
SUBSYSTEMS=="usb", ATTRS{idVendor}=="03eb", ATTRS{idProduct}=="2ff0", TAG+="uaccess"
### ATmega16U4
SUBSYSTEMS=="usb", ATTRS{idVendor}=="03eb", ATTRS{idProduct}=="2ff3", TAG+="uaccess"
### ATmega32U4
SUBSYSTEMS=="usb", ATTRS{idVendor}=="03eb", ATTRS{idProduct}=="2ff4", TAG+="uaccess"
### AT90USB64
SUBSYSTEMS=="usb", ATTRS{idVendor}=="03eb", ATTRS{idProduct}=="2ff9", TAG+="uaccess"
### AT90USB162
SUBSYSTEMS=="usb", ATTRS{idVendor}=="03eb", ATTRS{idProduct}=="2ffa", TAG+="uaccess"
### AT90USB128
SUBSYSTEMS=="usb", ATTRS{idVendor}=="03eb", ATTRS{idProduct}=="2ffb", TAG+="uaccess"
# Input Club
SUBSYSTEMS=="usb", ATTRS{idVendor}=="1c11", ATTRS{idProduct}=="b007", TAG+="uaccess"
# STM32duino
SUBSYSTEMS=="usb", ATTRS{idVendor}=="1eaf", ATTRS{idProduct}=="0003", TAG+="uaccess"
# STM32 DFU
SUBSYSTEMS=="usb", ATTRS{idVendor}=="0483", ATTRS{idProduct}=="df11", TAG+="uaccess"
# BootloadHID
SUBSYSTEMS=="usb", ATTRS{idVendor}=="16c0", ATTRS{idProduct}=="05df", TAG+="uaccess"
# USBAspLoader
SUBSYSTEMS=="usb", ATTRS{idVendor}=="16c0", ATTRS{idProduct}=="05dc", TAG+="uaccess"
# ModemManager should ignore the following devices
# Atmel SAM-BA (Massdrop)
SUBSYSTEMS=="usb", ATTRS{idVendor}=="03eb", ATTRS{idProduct}=="6124", TAG+="uaccess", ENV{ID_MM_DEVICE_IGNORE}="1"
# Caterina (Pro Micro)
## pid.codes shared PID
### Keyboardio Atreus 2 Bootloader
SUBSYSTEMS=="usb", ATTRS{idVendor}=="1209", ATTRS{idProduct}=="2302", TAG+="uaccess", ENV{ID_MM_DEVICE_IGNORE}="1"
## Spark Fun Electronics
### Pro Micro 3V3/8MHz
SUBSYSTEMS=="usb", ATTRS{idVendor}=="1b4f", ATTRS{idProduct}=="9203", TAG+="uaccess", ENV{ID_MM_DEVICE_IGNORE}="1"
### Pro Micro 5V/16MHz
SUBSYSTEMS=="usb", ATTRS{idVendor}=="1b4f", ATTRS{idProduct}=="9205", TAG+="uaccess", ENV{ID_MM_DEVICE_IGNORE}="1"
### LilyPad 3V3/8MHz (and some Pro Micro clones)
SUBSYSTEMS=="usb", ATTRS{idVendor}=="1b4f", ATTRS{idProduct}=="9207", TAG+="uaccess", ENV{ID_MM_DEVICE_IGNORE}="1"
## Pololu Electronics
### A-Star 32U4
SUBSYSTEMS=="usb", ATTRS{idVendor}=="1ffb", ATTRS{idProduct}=="0101", TAG+="uaccess", ENV{ID_MM_DEVICE_IGNORE}="1"
## Arduino SA
### Leonardo
SUBSYSTEMS=="usb", ATTRS{idVendor}=="2341", ATTRS{idProduct}=="0036", TAG+="uaccess", ENV{ID_MM_DEVICE_IGNORE}="1"
### Micro
SUBSYSTEMS=="usb", ATTRS{idVendor}=="2341", ATTRS{idProduct}=="0037", TAG+="uaccess", ENV{ID_MM_DEVICE_IGNORE}="1"
## Adafruit Industries LLC
### Feather 32U4
SUBSYSTEMS=="usb", ATTRS{idVendor}=="239a", ATTRS{idProduct}=="000c", TAG+="uaccess", ENV{ID_MM_DEVICE_IGNORE}="1"
### ItsyBitsy 32U4 3V3/8MHz
SUBSYSTEMS=="usb", ATTRS{idVendor}=="239a", ATTRS{idProduct}=="000d", TAG+="uaccess", ENV{ID_MM_DEVICE_IGNORE}="1"
### ItsyBitsy 32U4 5V/16MHz
SUBSYSTEMS=="usb", ATTRS{idVendor}=="239a", ATTRS{idProduct}=="000e", TAG+="uaccess", ENV{ID_MM_DEVICE_IGNORE}="1"
## dog hunter AG
### Leonardo
SUBSYSTEMS=="usb", ATTRS{idVendor}=="2a03", ATTRS{idProduct}=="0036", TAG+="uaccess", ENV{ID_MM_DEVICE_IGNORE}="1"
### Micro
SUBSYSTEMS=="usb", ATTRS{idVendor}=="2a03", ATTRS{idProduct}=="0037", TAG+="uaccess", ENV{ID_MM_DEVICE_IGNORE}="1"
# hid_listen
KERNEL=="hidraw*", MODE="0660", GROUP="plugdev", TAG+="uaccess", TAG+="udev-acl"
# hid bootloaders
## QMK HID
SUBSYSTEMS=="usb", ATTRS{idVendor}=="03eb", ATTRS{idProduct}=="2067", TAG+="uaccess"
## PJRC's HalfKay
SUBSYSTEMS=="usb", ATTRS{idVendor}=="16c0", ATTRS{idProduct}=="0478", TAG+="uaccess"
'';
# enable wireguard tunnel
# privKey = "/run/secrets/curve-wg"; -> local config
# publicKey = "..."; -> shipped to server config
# IP = "10.0.69.2"; -> shipped to both configs
system.stateVersion = "22.05";
}

47
hosts/curve/hardware-configuration.nix Normal file
View file

@ -0,0 +1,47 @@
# Do not modify this file! It was generated by ‘nixos-generate-config’
# and may be overwritten by future invocations. Please make changes
# to /etc/nixos/configuration.nix instead.
{ config, lib, pkgs, modulesPath, ... }:
{
imports =
[ (modulesPath + "/installer/scan/not-detected.nix")
];
boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "usb_storage" "usbhid" "sd_mod" "rtsx_pci_sdmmc" ];
boot.initrd.kernelModules = [ "dm-snapshot" ];
boot.kernelModules = [ "kvm-intel" ];
boot.extraModulePackages = [ ];
fileSystems."/" =
{ device = "/dev/disk/by-uuid/74ba39ee-35cd-4b87-9ee9-651384fa55bd";
fsType = "btrfs";
options = [ "subvol=root" ];
};
fileSystems."/home" =
{ device = "/dev/disk/by-uuid/74ba39ee-35cd-4b87-9ee9-651384fa55bd";
fsType = "btrfs";
options = [ "subvol=home" ];
};
fileSystems."/boot" =
{ device = "/dev/disk/by-uuid/87DA-98E7";
fsType = "vfat";
};
swapDevices =
[ { device = "/dev/disk/by-uuid/c36e3ba9-8eee-4fbf-837c-7e1cfda33f09"; }
];
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
# (the default) this is the recommended approach. When using systemd-networkd it's
# still possible to use this option, but it's recommended to use it in conjunction
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
networking.useDHCP = lib.mkDefault true;
# networking.interfaces.enp0s31f6.useDHCP = lib.mkDefault true;
# networking.interfaces.wlp3s0.useDHCP = lib.mkDefault true;
powerManagement.cpuFreqGovernor = lib.mkDefault "powersave";
hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
}

38
hosts/curve/hardware.bak Normal file
View file

@ -0,0 +1,38 @@
# Do not modify this file! It was generated by ‘nixos-generate-config’
# and may be overwritten by future invocations. Please make changes
# to /etc/nixos/configuration.nix instead.
{ config, lib, pkgs, modulesPath, ... }:
{
imports =
[ (modulesPath + "/installer/scan/not-detected.nix")
];
boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "usbhid" "usb_storage" "sd_mod" "rtsx_pci_sdmmc" ];
boot.initrd.kernelModules = [ "dm-snapshot" ];
boot.kernelModules = [ ];
boot.extraModulePackages = [ ];
fileSystems."/" =
{ device = "/dev/disk/by-uuid/6ee9d430-1b1b-4e39-bced-606145570a78";
fsType = "btrfs";
options = [ "subvol=root" ];
};
fileSystems."/home" =
{ device = "/dev/disk/by-uuid/6ee9d430-1b1b-4e39-bced-606145570a78";
fsType = "btrfs";
options = [ "subvol=home" ];
};
fileSystems."/boot" =
{ device = "/dev/disk/by-uuid/AD0C-92EF";
fsType = "vfat";
};
swapDevices =
[ { device = "/dev/disk/by-uuid/5486bd9f-6826-4ac7-b09b-8768a35c331f"; }
];
powerManagement.cpuFreqGovernor = lib.mkDefault "powersave";
}

36
hosts/helix/configuration.nix Normal file
View file

@ -0,0 +1,36 @@
{ config, pkgs, ... }:
{
imports =
[
# Include the results of the hardware scan.
./hardware-configuration.nix
];
# Use the GRUB 2 boot loader.
boot.loader.grub.enable = true;
boot.loader.grub.version = 2;
boot.loader.grub.device = "/dev/vda"; # or "nodev" for efi only
networking.hostName = "helix"; # Define your hostname.
networking.useDHCP = false;
networking.interfaces.ens3.useDHCP = true;
# Configure network proxy if necessary
# networking.proxy.default = "http://user:password@proxy:port/";
# networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";
# Enable the OpenSSH daemon.
services.openssh.enable = true;
services.openssh.passwordAuthentication = false;
services.openssh.permitRootLogin = "no";
sound.enable = false;
# Define a user account. Don't forget to set a password with ‘passwd’.
# This value determines the NixOS release with which your system is to be
# compatible, in order to avoid breaking some software such as database
# servers. You should change this only after NixOS release notes say you
# should.
system.stateVersion = "22.05"; # Did you read the comment?
}

35
hosts/helix/default.nix Normal file
View file

@ -0,0 +1,35 @@
{ self, profiles, suites, ... }:
{
imports = [
./configuration.nix
] ++ suites.sealight;
home-manager.users.anish = { self, suites, ... }: {
imports = [ ] ++ suites.hmBase;
};
# Capsul specific
users.users.cyberian = {
isNormalUser = true;
extraGroups = [ "wheel" ];
};
mossnet.wg = {
enable = true;
ips = [ "10.0.69.5/24" ];
privateKeyFile = "/home/anish/wg/wg-priv";
};
# mossnet.backup = {
# enable = false;
# name = "sealight";
# paths = [ "/var/backup/postgresql" ];
# };
# age.secrets.borg-password.file = "${self}/secrets/borg-password.age";
# services.postgresqlBackup = {
# enable = false;
# databases = [ "matrix-synapse" "gitea" ];
# location = "/var/backup/postgresql";
# };
}

26
hosts/helix/hardware-configuration.nix Normal file
View file

@ -0,0 +1,26 @@
# Do not modify this file! It was generated by ‘nixos-generate-config’
# and may be overwritten by future invocations. Please make changes
# to /etc/nixos/configuration.nix instead.
{ config, lib, pkgs, modulesPath, ... }:
{
imports =
[
(modulesPath + "/profiles/qemu-guest.nix")
];
boot.initrd.availableKernelModules = [ "ata_piix" "floppy" "virtio_pci" "sr_mod" "virtio_blk" ];
boot.initrd.kernelModules = [ ];
boot.kernelModules = [ ];
boot.extraModulePackages = [ ];
fileSystems."/" =
{
device = "/dev/disk/by-uuid/7c560634-d545-41cc-b375-42ce3037fd73";
fsType = "ext4";
};
swapDevices = [ ];
hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
}

121
install-encrypted.sh Executable file
View file

@ -0,0 +1,121 @@
# Setup
# Presumes pre-formatted harddrives
BOOT=/dev/sda1
DISK=/dev/sda2
dd if=/dev/urandom of=./keyfile0.bin bs=1024 count=4
dd if=/dev/urandom of=./keyfile1.bin bs=1024 count=4
echo "Creating LUKS partitions..."
# Enter the passphrase which is used to unlock disk. You will enter this in grub on every boot
cryptsetup luksFormat --type luks1 -c aes-xts-plain64 -s 256 -h sha512 $DISK
# Add a second key which will be used by nixos. You will need to enter the pasphrase from previous step
cryptsetup luksAddKey $DISK keyfile0.bin
cryptsetup luksOpen $DISK crypted-nixos -d keyfile0.bin
# Create the LVM
echo "Creating LVM partitions..."
pvcreate /dev/mapper/crypted-nixos
vgcreate vg /dev/mapper/crypted-nixos
lvcreate -L 4G -n swap vg
lvcreate -l '100%FREE' -n root vg
# Format the disks
echo "Formatting disks..."
mkfs.fat -F 32 $BOOT
mkswap -L swap /dev/vg/swap
mkfs.ext4 -L root /dev/vg/root
# mkfs.ext4 -L data /dev/mapper/crypted-data
echo "Mounting drives..."
mount /dev/vg/root /mnt
mkdir -p /mnt/boot/efi
mount $BOOT /mnt/boot/efi
swapon /dev/vg/swap
# Copy the keys
mkdir -p /mnt/etc/secrets/initrd/
cp keyfile0.bin keyfile1.bin /mnt/etc/secrets/initrd
chmod 000 /mnt/etc/secrets/initrd/keyfile*.bin
# Generate and edit configuration
echo "Generating NixOS config..."
nixos-generate-config --root /mnt
# TODO: neds to get the uuid of each of the disks
# UUID=$(blkid)
echo "Extending NixOS config..."
cat >> /mnt/etc/nixos/configuration.nix <<'endmsg'
boot.loader.efi.canTouchEfiVariables = true;
boot.loader.efi.efiSysMountPoint = "/boot/efi";
boot.loader.grub = {
enable = true;
device = "nodev";
version = 2;
efiSupport = true;
enableCryptodisk = true;
};
boot.initrd = {
luks.devices."root" = {
# UPDATE ME
device = "/dev/disk/by-uuid/a8b302cf-5296-4a2e-a7ba-707e6fa75123"; # UUID for /dev/nvme01np2
preLVM = true;
keyFile = "/keyfile0.bin";
allowDiscards = true;
};
secrets = {
# Create /mnt/etc/secrets/initrd directory and copy keys to it
"keyfile0.bin" = "/etc/secrets/initrd/keyfile0.bin";
"keyfile1.bin" = "/etc/secrets/initrd/keyfile1.bin";
};
};
# Data mount
# This is all wrong for box for now
# fileSystems."/data" = {
# device = "/dev/disk/by-uuid/79630267-5766-4c7d-85a5-1d5f1dcd58ad"; # UUID for /dev/mapper/crypted-data
# encrypted = {
# enable = true;
# label = "crypted-data";
# blkDev = "/dev/disk/by-uuid/3476cb09-b3c4-4301-9ec9-84f60f32828a"; # UUID for /dev/sda1
# keyFile = "/keyfile1.bin";
# };
# };
time.timeZone = "Australia/Brisbane";
networking.useDHCP = false;
nix = {
package = pkgs.nixUnstable;
extraOptions = ''
experimental-features = nix-command flakes
'';
};
users.users.anish = {
isNormalUser = true;
hashedPassword = "MVHHpy9gbe3ow";
extraGroups = [ "wheel" ]; # Enable ‘sudo’ for the user.
openssh.authorizedKeys.keys = [ "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDM0Zvei46x/yZl/IeBCq6+IYQQ0avulzVyBysF9cPigZMCybWRV7IEU+E3k9t6JrbdbdGfJkcZIWmsWDdKS8W8mBnZpVoT0ffLynu8JQ/TKdGm4Qv6bgUeKNrGsNv0ZPs2CDaGSLj0oJfRF7Ko10tcLP0vW+yujrh+y6TH/vVzJioaV4TGvtCUpn+wEQah9ROwPQLUUofsSWdnRsDJ/gp37zXWs4l5wyjSKtP3O9RZUP7kBekbSqEgSXiTk0oUQSVqIWl9NDiP6onk/gSOjXsR/JPqsSN/XI/c/yj6gyY0f51Ru2D7iBxuMJIJcWV+rU6coIj+ULcQWLzt/7TI8jq5AOOzI/ll4zbL24Eo84Rz+TP9tvMMhDZ0VaMN22AJ8qQEjc5P09tWKsX7Jg39XelyV1jHXncE4yvIE9F4RSCHzWCeKeXakizQNuzSaxTxIExRFYHjNW5bR6+3MTGwVrEIXU+qML+0yFTR86MT+tdY5AreAJQLwbog79O1NupeXJE= anish@curve" ];
};
security.sudo.wheelNeedsPassword = false; # needed for deploy-rs
services.openssh.enable = true;
# This value determines the NixOS release from which the default
# settings for stateful data, like file locations and database versions
# on your system were taken. It‘s perfectly fine and recommended to leave
# this value at the release version of the first install of this system.
# Before changing this value read the documentation for this option
# (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
system.stateVersion = "21.05"; # Did you read the comment?
}
endmsg
# sudo nixos-install

62
install-simple.sh Normal file
View file

@ -0,0 +1,62 @@
#!/usr/bin/env bash
# partition the files yourself sorry
sudo fatlabel /dev/vda1 NIXBOOT
sudo mkfs.ext4 /dev/vda2 -L NIXROOT
sudo mount /dev/disk/by-label/NIXROOT /mnt
sudo mkdir -p /mnt/boot
sudo mount /dev/disk/by-label/NIXBOOT /mnt/boot
sudo nixos-generate-config --root /mnt
cat > /mnt/etc/nixos/configuration.nix <<'endmsg'
{ config, pkgs, ... }:
{
imports =
[ # Include the results of the hardware scan.
./hardware-configuration.nix
];
boot.loader.grub.enable = true;
boot.loader.grub.version = 2;
# Define on which hard drive you want to install Grub.
boot.loader.grub.device = "/dev/vda"; # or "nodev" for efi only
# Enable Flakes
nix = {
package = pkgs.nixUnstable;
extraOptions = ''
experimental-features = nix-command flakes
'';
};
time.timeZone = "Australia/Brisbane";
networking.useDHCP = false;
networking.interfaces.ens3.useDHCP = true; # TODO you probably want to change this
i18n.defaultLocale = "en_US.UTF-8";
users.users.anish = {
isNormalUser = true;
hashedPassword = "MVHHpy9gbe3ow";
extraGroups = [ "wheel" ]; # Enable ‘sudo’ for the user.
openssh.authorizedKeys.keys = [ "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDM0Zvei46x/yZl/IeBCq6+IYQQ0avulzVyBysF9cPigZMCybWRV7IEU+E3k9t6JrbdbdGfJkcZIWmsWDdKS8W8mBnZpVoT0ffLynu8JQ/TKdGm4Qv6bgUeKNrGsNv0ZPs2CDaGSLj0oJfRF7Ko10tcLP0vW+yujrh+y6TH/vVzJioaV4TGvtCUpn+wEQah9ROwPQLUUofsSWdnRsDJ/gp37zXWs4l5wyjSKtP3O9RZUP7kBekbSqEgSXiTk0oUQSVqIWl9NDiP6onk/gSOjXsR/JPqsSN/XI/c/yj6gyY0f51Ru2D7iBxuMJIJcWV+rU6coIj+ULcQWLzt/7TI8jq5AOOzI/ll4zbL24Eo84Rz+TP9tvMMhDZ0VaMN22AJ8qQEjc5P09tWKsX7Jg39XelyV1jHXncE4yvIE9F4RSCHzWCeKeXakizQNuzSaxTxIExRFYHjNW5bR6+3MTGwVrEIXU+qML+0yFTR86MT+tdY5AreAJQLwbog79O1NupeXJE= anish@curve" ];
};
security.sudo.wheelNeedsPassword = false; # needed for deploy-rs
services.openssh.enable = true;
# This value determines the NixOS release from which the default
# settings for stateful data, like file locations and database versions
# on your system were taken. It‘s perfectly fine and recommended to leave
# this value at the release version of the first install of this system.
# Before changing this value read the documentation for this option
# (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
system.stateVersion = "21.11"; # Did you read the comment?
}
endmsg
sudo nixos-install

172
install-yubikey.sh Executable file
View file

@ -0,0 +1,172 @@
rbtohex() {
( od -An -vtx1 | tr -d ' \n' )
}
hextorb() {
( tr '[:lower:]' '[:upper:]' | sed -e 's/\([0-9A-F]\{2\}\)/\\\\\\x\1/gI'| xargs printf )
}
# Setup
# nix-env -i gcc-wrapper
# nix-env -i yubikey-personalization
# nix-env -i openssl
# Use nix-shell https://github.com/sgillespie/nixos-yubikey-luks/archive/master.tar.gz
# Compile correct version of OpenSSL key derivation
cc -O3 -I$(nix-build "<nixpkgs>" --no-build-output -A openssl.dev)/include -L$(nix-build "<nixpkgs>" --no-build-output -A openssl.out)/lib $(nix eval "(with import <nixpkgs> {}; pkgs.path)")/nixos/modules/system/boot/pbkdf2-sha512.c -o ./pbkdf2-sha512 -lcrypto
# Yubikey Setup
SLOT=2
ykpersonalize -"$SLOT" -ochal-resp -ochal-hmac
SALT_LENGTH=16
salt="$(dd if=/dev/random bs=1 count=$SALT_LENGTH 2>/dev/null | rbtohex)"
k_user=PASSWORDCHANGEMEPLAEASES
challenge="$(echo -n $salt | openssl dgst -binary -sha512 | rbtohex)"
response="$(ykchalresp -2 -x $challenge 2>/dev/null)"
# Setup LUKS device
KEY_LENGTH=512
ITERATIONS=1000000
k_luks="$(echo -n $k_user | ./pbkdf2-sha512 $(($KEY_LENGTH / 8)) $ITERATIONS $response | rbtohex)"
EFI_PART=/dev/sda1
LUKS_PART=/dev/sda2
EFI_MNT=/boot/
mkdir -p "$EFI_MNT"
mkfs.fat -F 32 -n boot "$EFI_PART"
mount "$EFI_PART" "$EFI_MNT"
STORAGE=/crypt-storage/default
mkdir -p "$(dirname $EFI_MNT$STORAGE)"
echo -ne "$salt\n$ITERATIONS" > $EFI_MNT$STORAGE
CIPHER=aes-xts-plain64
HASH=sha512
echo -n "$k_luks" | hextorb | cryptsetup luksFormat --cipher="$CIPHER" --key-size="$KEY_LENGTH" --hash="$HASH" --key-file=- "$LUKS_PART"
umount "$EFI_MNT"
# LVM Setup
LUKSROOT=crypthome
echo -n "$k_luks" | hextorb | cryptsetup luksOpen $LUKS_PART $LUKSROOT --key-file=-
pvcreate "/dev/mapper/$LUKSROOT"
VGNAME=partitions
vgcreate "$VGNAME" "/dev/mapper/$LUKSROOT"
lvcreate -L 2G -n swap "$VGNAME"
FSROOT=fsroot
lvcreate -l 100%FREE -n "$FSROOT" "$VGNAME"
vgchange -ay
mkswap -L swap /dev/partitions/swap
# BTRFS Setup
mkfs.btrfs -L "$FSROOT" "/dev/partitions/$FSROOT"
# incase the above breaks
#mkdir /mnt-root
#touch /mnt-root/nix-store.squashfs
mount "/dev/partitions/$FSROOT" /mnt
cd /mnt
btrfs subvolume create root
btrfs subvolume create home
cd
umount /mnt
mount -o subvol=root "/dev/partitions/$FSROOT" /mnt
mkdir /mnt/home
mount -o subvol=home "/dev/partitions/$FSROOT" /mnt/home
mkdir /mnt/boot
mount "$EFI_PART" /mnt/boot
swapon /dev/partitions/swap
# Install NixOS
nixos-generate-config --root /mnt
# Change the config
cat > /mnt/etc/nixos/configuration.nix <<'endmsg'
{ config, pkgs, ... }:
{
imports =
[ # Include the results of the hardware scan.
./hardware-configuration.nix
];
boot.loader.grub.enable = true;
boot.loader.grub.version = 2;
# Define on which hard drive you want to install Grub.
boot.loader.grub.device = "/dev/sda"; # or "nodev" for efi only
# Minimal list of modules to use the EFI system partition and the YubiKey
boot.initrd.kernelModules = [ "vfat" "nls_cp437" "nls_iso8859-1" "usbhid" ];
# Enable support for the YubiKey PBA
boot.initrd.luks.yubikeySupport = true;
# Configuration to use your Luks device
boot.initrd.luks.devices = {
"crypthome" = {
device = "/dev/sda2";
preLVM = true; # You may want to set this to false if you need to start a network service first
yubikey = {
slot = 2;
twoFactor = true; # Set to false if you did not set up a user password.
storage = {
device = "/dev/sda1";
};
};
};
};
# Enable Flakes
nix = {
package = pkgs.nixUnstable;
extraOptions = ''
experimental-features = nix-command flakes
'';
};
networking.hostName = "curve"; # Define your hostname.
networking.wireless.enable = true; # Enables wireless support via wpa_supplicant.
time.timeZone = "Australia/Brisbane";
networking.useDHCP = false;
networking.interfaces.enp0s31f6.useDHCP = true;
networking.interfaces.wlp3s0.useDHCP = true;
# Select internationalisation properties.
i18n.defaultLocale = "en_US.UTF-8";
# console = {
# font = "Lat2-Terminus16";
# keyMap = "us";
# };
services.xserver.layout = "us,dvorak";
sound.enable = true;
hardware.pulseaudio.enable = true;
services.xserver.libinput.enable = true;
# Hmmm maybe somewhere else?
users.users.anish = {
isNormalUser = true;
extraGroups = [ "wheel" ];
};
# Enable the OpenSSH daemon.
# services.openssh.enable = true;
# This value determines the NixOS release from which the default
# settings for stateful data, like file locations and database versions
# on your system were taken. It‘s perfectly fine and recommended to leave
# this value at the release version of the first install of this system.
# Before changing this value read the documentation for this option
# (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
system.stateVersion = "21.05"; # Did you read the comment?
}
endmsg
cd /mnt
nixos-install --root /mnt
passwd

14
lib/compat/default.nix Normal file
View file

@ -0,0 +1,14 @@
let
rev = "e7e5d481a0e15dcd459396e55327749989e04ce0";
flake = (import
(
fetchTarball {
url = "https://github.com/edolstra/flake-compat/archive/${rev}.tar.gz";
sha256 = "0zd3x46fswh5n6faq4x2kkpy6p3c6j593xbdlbsl40ppkclwc80x";
}
)
{
src = ../../.;
});
in
flake

10
lib/compat/nixos/default.nix Normal file
View file

@ -0,0 +1,10 @@
{ ... }:
let
inherit (default.inputs.nixos) lib;
host = configs.${hostname} or configs.NixOS;
configs = default.nixosConfigurations;
default = (import ../.).defaultNix;
hostname = lib.fileContents /etc/hostname;
in
host

2
lib/default.nix Normal file
View file

@ -0,0 +1,2 @@
{ lib }:
lib.makeExtensible (self: { })

53
modules/backup.nix Normal file
View file

@ -0,0 +1,53 @@
# TODO:
# This currently works on a per host basis, and the host file has to define all the locations it wants to back up.
# Ideally, this would create a job for each profile instead, so the backup strategy is included in the profile regardless of host
{ config, lib, pkgs, ... }:
with lib;
let
cfg = config.mossnet.backup;
in
{
options = {
mossnet.backup = {
enable = mkEnableOption "Backup module using borg for Anish's computer nursery";
name = lib.mkOption {
type = types.str;
default = { };
example = literalExample ''
mossnet
'';
description = ''
name for the backup operator
'';
};
paths = lib.mkOption {
type = with types; listOf str;
default = { };
example = literalExample ''
[ "/home/anish/usr" ];
'';
description = ''
A list of folders to backup
'';
};
};
};
config = mkIf cfg.enable {
services.borgbackup.jobs = {
"${cfg.name}" = {
paths = cfg.paths;
doInit = true;
repo = "20779@hk-s020.rsync.net:${cfg.name}";
encryption = {
mode = "repokey-blake2";
passCommand = "cat /run/agenix/borg-password";
};
environment = { BORG_RSH = "ssh -i /root/borg/borg-key"; }; # YOU NEED TO PUT THIS HERE MANUALLY
compression = "auto,lzma";
startAt = "daily";
extraArgs = "--remote-path=borg1";
};
};
};
}

109
modules/gonic.nix Normal file
View file

@ -0,0 +1,109 @@
{ config, lib, pkgs, ... }:
with lib;
let
cfg = config.services.gonic;
configFile = "/etc/gonic/config";
dataFolder = "/var/lib/gonic";
in {
options = {
services.gonic = {
enable = mkEnableOption "Gonic music server and streamer";
settings = lib.mkOption {
type = types.str;
default = {};
example = literalExample ''
music-path <path to your music dir>
podcast-path <path to your podcasts dir>
cache-path <path to cache dir>
'';
description = ''
Configuration for Gonic, see <link xlink:href="https://github.com/sentriz/gonic"/> for supported values.
'';
};
user = mkOption {
type = types.str;
default = "gonic";
description = "User account under which gonic runs.";
};
group = mkOption {
type = types.str;
default = "gonic";
description = "Group account under which gonic runs.";
};
};
};
config = mkIf cfg.enable {
environment.etc."gonic/config".text = cfg.settings;
systemd.services.gonic = {
description = "gonic Music Server and Streamer compatible with Subsonic/Airsonic";
after = [ "remote-fs.target" "network.target" ];
wantedBy = [ "multi-user.target" ];
environment = {
#GONIC_MUSIC_PATH
#GONIC_PODCAST_PATH
#GONIC_CACHE_PATH
#GONIC_DB_PATH
GONIC_SCAN_INTERVAL="800";
#...
};
serviceConfig = {
ExecStart = "${pkgs.gonic}/bin/gonic -config-path /etc/gonic/config";
WorkingDirectory = dataFolder;
TimeoutStopSec = "20";
KillMode = "process";
Restart = "on-failure";
RestartSec = "10";
User = cfg.user;
Group = cfg.group;
DevicePolicy = "closed";
NoNewPrivileges= " yes";
PrivateTmp = "yes";
PrivateUsers = "yes";
ProtectControlGroups = "yes";
ProtectKernelModules = "yes";
ProtectKernelTunables = "yes";
RestrictAddressFamilies = "AF_UNIX AF_INET AF_INET6";
RestrictNamespaces = "yes";
RestrictRealtime = "yes";
SystemCallFilter = "~@clock @debug @module @mount @obsolete @privileged @reboot @setuid @swap";
ReadWritePaths = dataFolder;
StateDirectory = baseNameOf dataFolder;
};
};
users.users = optionalAttrs (cfg.user == "gonic") ({
gonic = {
description = "gonic service user";
name = cfg.user;
group = cfg.group;
isSystemUser = true;
};
});
users.groups = optionalAttrs (cfg.group == "gonic") ({
gonic = {};
});
services.nginx.virtualHosts."music.mossnet.lan" = {
enableACME = false;
forceSSL = false;
locations."/" = {
extraConfig = ''
proxy_pass http://localhost:4747/;
proxy_set_header X-Forwarded-Host $host;
'';
};
};
};
}

112
modules/heisenbridge.nix.bak Normal file
View file

@ -0,0 +1,112 @@
{ config, lib, pkgs, ... }: with lib; let
cfg = config.services.heisenbridge;
heisenbridgeAppserviceConfig = {
id = "heisenbridge";
url = "http://${cfg.listenAddress}:${toString cfg.listenPort}";
as_token = cfg.appServiceToken;
hs_token = cfg.homeserverToken;
rate_limited = false;
sender_localpart = cfg.senderLocalpart;
namespaces = {
users = [{ regex = "@irc_.*"; exclusive = true; }];
aliases = [ ];
rooms = [ ];
};
};
heisenbridgeConfigYaml = pkgs.writeText "heisenbridge.yaml" (
generators.toYAML { } heisenbridgeAppserviceConfig);
in
{
options = {
services.heisenbridge = {
enable = mkEnableOption "heisenbridge, a bouncer-style Matrix IRC bridge.";
identd.enable = mkEnableOption "identd for heisenbridge" // {
default = true;
};
homeserver = mkOption {
type = types.str;
default = "http://localhost:8008";
description = "The URL of the Matrix homeserver.";
};
listenAddress = mkOption {
type = types.str;
default = "127.0.0.1";
description = "The address for heisenbridge to listen on.";
};
listenPort = mkOption {
type = types.int;
default = 9898;
description = "The port for heisenbridge to listen on.";
};
senderLocalpart = mkOption {
type = types.str;
default = "heisenbridge";
description = "The localpart of the heisenbridge admin bot's username.";
};
ownerId = mkOption {
type = types.nullOr types.str;
default = null;
description = ''
The owner MXID (for example, @user:homeserver) of the bridge. If
unspecified, the first talking local user will claim the bridge.
'';
};
appServiceToken = mkOption {
type = types.str;
description = ''
This is the token that the app service should use as its access_token
when using the Client-Server API. This can be anything you want.
'';
};
homeserverToken = mkOption {
type = types.str;
description = ''
This is the token that the homeserver will use when sending requests
to the app service. This can be anything you want.
'';
};
};
};
config = mkIf cfg.enable {
meta.maintainers = [ maintainers.sumnerevans ];
services.matrix-synapse.app_service_config_files = [
heisenbridgeConfigYaml
];
# Create a user for heisenbridge.
users.users.heisenbridge = {
group = "heisenbridge";
isSystemUser = true;
};
users.groups.heisenbridge = { };
# Open ports for identd.
networking.firewall.allowedTCPPorts = mkIf cfg.identd.enable [ 113 ];
systemd.services.heisenbridge = {
description = "Heisenbridge Matrix IRC bridge";
after = [ "matrix-synapse.service" ];
wantedBy = [ "multi-user.target" ];
serviceConfig = {
ExecStart = ''
${pkgs.heisenbridge}/bin/heisenbridge \
--config ${heisenbridgeConfigYaml} \
--verbose --verbose \
--listen-address ${cfg.listenAddress} \
--listen-port ${toString cfg.listenPort} \
--uid heisenbridge \
--gid heisenbridge \
${optionalString cfg.identd.enable "--identd"} \
${optionalString (cfg.ownerId != null) "--owner ${cfg.ownerId}"} \
${cfg.homeserver}
'';
Restart = "on-failure";
};
};
};
}

11
modules/hm-system-defaults.nix Normal file
View file

@ -0,0 +1,11 @@
{ config, ... }: {
home-manager.sharedModules = [
{
home.sessionVariables = {
inherit (config.environment.sessionVariables) NIX_PATH;
};
xdg.configFile."nix/registry.json".text =
config.environment.etc."nix/registry.json".text;
}
];
}

7
modules/nix-path.nix Normal file
View file

@ -0,0 +1,7 @@
{ channel, inputs, ... }: {
nix.nixPath = [
"nixpkgs=${channel.input}"
"nixos-config=${../lib/compat/nixos}"
"home-manager=${inputs.home}"
];
}

200
modules/wallabag.nix Normal file
View file

@ -0,0 +1,200 @@
{ config, options, lib, pkgs, ... }:
with lib;
let
cfg = config.services.wallabag;
poolName = "wallabag";
configFile = pkgs.writeTextFile {
name = "wallabag-config";
text = cfg.conf;
destination = "/config/parameters.yml";
};
appDir = pkgs.buildEnv {
name = "wallabag-app-dir";
ignoreCollisions = true;
checkCollisionContents = false;
paths = [ configFile "${cfg.package}/app" ];
};
in
{
options = {
services.wallabag = {
enable = mkEnableOption "wallabag";
user = mkOption {
type = types.str;
default = "nginx";
description = ''
User account under which both the update daemon and the web-application run.
'';
};
dataDir = mkOption {
type = types.path;
default = "/var/lib/wallabag";
description = ''
Data directory.
'';
};
package = mkOption {
type = types.package;
default = pkgs.wallabag;
description = ''
Wallabag package to use.
'';
};
hostName = mkOption {
type = types.str;
description = ''
Name of the nginx virtualhost to use and setup.
'';
};
poolConfig = mkOption {
type = types.lines;
default = ''
pm = dynamic
pm.max_children = 75
pm.start_servers = 1
pm.min_spare_servers = 1
pm.max_spare_servers = 20
pm.max_requests = 500
catch_workers_output = 1
'';
description = ''
Options for wallabag's PHP pool. See the documentation on <literal>php-fpm.conf</literal> for details on configuration directives.
'';
};
conf = mkOption {
type = types.str;
description = ''
Contents of the wallabag configuration file (parameters.yml)
'';
};
};
};
config = mkIf cfg.enable {
services.phpfpm.pools."${poolName}" = {
user = "${cfg.user}";
group = "nginx";
phpPackage = pkgs.php74;
settings = {
"listen.owner" = "nginx";
"listen.group" = "nginx";
"listen.mode" = "0600";
"user" = "${cfg.user}";
"group" = "nginx";
"env[WALLABAG_DATA]" = "${cfg.dataDir}";
"pm" = "dynamic";
"pm.max_children" = "75";
"pm.min_spare_servers" = "5";
"pm.max_spare_servers" = "20";
"pm.max_requests" = "10";
"catch_workers_output" = "1";
"php_admin_value[error_log]" = "/var/log/nginx/${poolName}-phpfpm-error.log";
};
};
services.phpfpm.phpOptions = ''
max_execution_time = 120
'';
services.nginx.enable = mkDefault true;
services.nginx.virtualHosts."${cfg.hostName}" = {
enableACME = false;
forceSSL = false;
root = "${cfg.package}/web";
extraConfig = ''
add_header X-Frame-Options SAMEORIGIN;
add_header X-Content-Type-Options nosniff;
add_header X-XSS-Protection "1; mode=block";
'';
locations."/" = {
extraConfig = ''
try_files $uri /app.php$is_args$args;
'';
};
locations."/assets".root = "${cfg.dataDir}/web";
locations."~ ^/app\\.php(/|$)" = {
extraConfig = ''
fastcgi_pass unix:${config.services.phpfpm.pools."${poolName}".socket};
fastcgi_split_path_info ^(.+\.php)(/.*)$;
include ${pkgs.nginx}/conf/fastcgi_params;
fastcgi_param SCRIPT_FILENAME ${cfg.package}/web/$fastcgi_script_name;
fastcgi_param DOCUMENT_ROOT ${cfg.package}/web;
fastcgi_read_timeout 120;
internal;
'';
};
locations."~ /(?!app)\\.php$" = {
extraConfig = ''
return 404;
'';
};
};
systemd.services.wallabag-install = {
description = "Wallabag install service";
wantedBy = [ "multi-user.target" ];
before = [ "phpfpm-wallabag.service" ];
after = [ "mysql.service" "postgresql.service" ];
path = with pkgs; [ coreutils php74 php74Packages.composer ];
serviceConfig = {
User = cfg.user;
Type = "oneshot";
RemainAfterExit = "yes";
PermissionsStartOnly = true;
};
preStart = ''
mkdir -p "${cfg.dataDir}"
chown ${cfg.user}:nginx "${cfg.dataDir}"
'';
script = ''
echo "Setting up wallabag files in ${cfg.dataDir} ..."
cd "${cfg.dataDir}"
rm -rf var/cache/*
rm -f app
ln -sf ${appDir} app
ln -sf ${cfg.package}/composer.{json,lock} .
export WALLABAG_DATA="${cfg.dataDir}"
if [ ! -f installed ]; then
echo "Install file not found, installing ..."
php ${cfg.package}/bin/console --env=prod doctrine:database:create --if-not-exists --no-interaction
php ${cfg.package}/bin/console --env=prod doctrine:migrations:migrate --no-interaction
# Until https://github.com/wallabag/wallabag/issues/3662 is fixed
# yes no | php ${cfg.package}/bin/console --env=prod wallabag:install
touch installed
else
php ${cfg.package}/bin/console --env=prod doctrine:migrations:migrate --no-interaction
fi
php ${cfg.package}/bin/console --env=prod cache:clear
'';
};
};
meta = with stdenv.lib; {
maintainers = with maintainers; [ nadrieril ];
};
}

54
modules/wireguard.nix Normal file
View file

@ -0,0 +1,54 @@
{ config, lib, pkgs, ... }:
with lib;
let
cfg = config.mossnet.wg;
in
{
options = {
mossnet.wg = {
enable = mkEnableOption "Gain access to all mossnet systems through wireguard";
ips = lib.mkOption {
type = with types; listOf str;
default = { };
example = literalExample ''
[ "10.0.69.2/24" ];
'';
description = ''
The IP this machine is allowed to connect to
'';
};
privateKeyFile = lib.mkOption {
type = types.path;
default = { };
example = literalExample ''
/run/agenix/wg-curve
'';
description = ''
The private ssh key file to use to connect!
Remember set age.secrets.*.file and age.secrets.*.user
'';
};
};
};
config = mkIf cfg.enable {
networking.firewall.allowedUDPPorts = [ 60990 ];
networking.wireguard.interfaces = {
wg0 = {
ips = cfg.ips;
listenPort = 60990; # to match firewall allowedUDPPorts (without this wg uses random port numbers)
privateKeyFile = cfg.privateKeyFile;
peers = [
# For a client configuration, one peer entry for the server will suffice.
{
publicKey = "c1J4p63rD3IlszugMZiki7UBV3YmDdqa3DU4UejXzAI=";
allowedIPs = [ "10.0.69.0/24" ];
# Set this to the server IP and port.
endpoint = "149.28.163.78:60990"; # ToDo: route to endpoint not automatically configured https://wiki.archlinux.org/index.php/WireGuard#Loop_routing https://discourse.nixos.org/t/solved-minimal-firewall-setup-for-wireguard-client/7577
persistentKeepalive = 25;
}
];
};
};
};
}

8
mount-crypted.sh Normal file
View file

@ -0,0 +1,8 @@
key_length=512
iterations="$(head -n 2 /boot/crypted-storage/default)"
salt="$(head -n 1 /boot/crypted-storage/default)"
chal="$(echo -n $salt | openssl dgst -binary -sha512 | rbtohex)"
resp="$(ykchalresp -2 -x $chal 2>/dev/null)"
user_key="$(read -s)"
luks_key="$(echo -n $user_key | pbkdf2-sha512 $(($key_length / 8)) $iterations $resp | rbtohex)"
echo -n $luks_key | hextorb | sudo cryptsetup luksOpen /dev/sda2 crypted --key-file=-

31
overlays/overrides.nix Normal file
View file

@ -0,0 +1,31 @@
channels: final: prev: {
__dontExport = true; # overrides clutter up actual creations
inherit (channels.latest)
cachix
dhall
discord
element-desktop
rage
nixpkgs-fmt
qutebrowser
nheko
signal-desktop
tootle
sublime-music
starship;
haskellPackages = prev.haskellPackages.override
(old: {
overrides = prev.lib.composeExtensions (old.overrides or (_: _: { })) (hfinal: hprev:
let version = prev.lib.replaceChars [ "." ] [ "" ] prev.ghc.version;
in
{
# same for haskell packages, matching ghc versions
inherit (channels.latest.haskell.packages."ghc${version}")
haskell-language-server;
});
});
}

11
overlays/various-flake-fixes.nix Normal file
View file

@ -0,0 +1,11 @@
final: prev: {
# Since: https://github.com/NixOS/nixpkgs/pull/126137
nix-direnv =
if builtins.hasAttr "enableFlakes" prev.nix-direnv.override.__functionArgs
then
prev.nix-direnv.override
{
enableFlakes = true;
}
else prev.nix-direnv;
}

16
pkgs/_sources/generated.nix Normal file
View file

@ -0,0 +1,16 @@
# This file was generated by nvfetcher, please do not modify it manually.
{ fetchgit, fetchurl }:
{
manix = {
pname = "manix";
version = "d08e7ca185445b929f097f8bfb1243a8ef3e10e4";
src = fetchgit {
url = "https://github.com/mlvzk/manix";
rev = "d08e7ca185445b929f097f8bfb1243a8ef3e10e4";
fetchSubmodules = false;
deepClone = false;
leaveDotGit = false;
sha256 = "1b7xi8c2drbwzfz70czddc4j33s7g1alirv12dwl91hbqxifx8qs";
};
};
}

5
pkgs/default.nix Normal file
View file

@ -0,0 +1,5 @@
final: prev: {
# keep sources this first
sources = prev.callPackage (import ./_sources/generated.nix) { };
# then, call packages with `final.callPackage`
}

4
pkgs/sources.toml Normal file
View file

@ -0,0 +1,4 @@
# nvfetcher.toml
[manix]
src.git = "https://github.com/mlvzk/manix"
fetch.github = "mlvzk/manix"

98
pkgs/wallabag.nix Normal file
View file

@ -0,0 +1,98 @@
{ pkgs, config, lib, ... }:
{
services.postgresql = {
enable = true;
# Ensure the database, user, and permissions always exist
ensureDatabases = [ "wallabag" ];
ensureUsers = [
{ name = "wallabag";
ensurePermissions."DATABASE wallabag" = "ALL PRIVILEGES";
}
];
};
services.wallabag = {
enable = true;
hostName = "read.mossnet.lan";
package = pkgs.callPackage ./pkg-wallabag.nix {};
conf = ''
# This file is a "template" of what your parameters.yml file should look like
parameters:
# Uncomment these settings or manually update your parameters.yml
# to use docker-compose
#
# database_driver: %env.database_driver%
# database_host: %env.database_host%
# database_port: %env.database_port%
# database_name: %env.database_name%
# database_user: %env.database_user%
# database_password: %env.database_password%
database_driver: pdo_pgsql
database_host: localhost
database_port: ~
database_name: wallabag
database_user: wallabag
database_password: wallabag
# For SQLite, database_path should be "%kernel.project_dir%/data/db/wallabag.sqlite"
database_path: ~
database_table_prefix: wallabag_
database_socket: null
# with PostgreSQL and SQLite, you must set "utf8"
database_charset: utf8
domain_name: http://read.mossnet.lan
server_name: "mossnet wallabag instance"
mailer_transport: smtp
mailer_user: ~
mailer_password: ~
mailer_host: 127.0.0.1
mailer_port: false
mailer_encryption: ~
mailer_auth_mode: ~
locale: en
# A secret key that's used to generate certain security-related tokens
secret: SAFGOECRIlfal89oe6u0(*^dsaaih961
# two factor stuff
twofactor_auth: true
twofactor_sender: no-reply@wallabag.org
# fosuser stuff
fosuser_registration: true
fosuser_confirmation: true
# how long the access token should live in seconds for the API
fos_oauth_server_access_token_lifetime: 3600
# how long the refresh token should life in seconds for the API
fos_oauth_server_refresh_token_lifetime: 1209600
from_email: no-reply@wallabag.org
rss_limit: 50
# RabbitMQ processing
rabbitmq_host: localhost
rabbitmq_port: 5672
rabbitmq_user: guest
rabbitmq_password: guest
rabbitmq_prefetch_count: 10
# Redis processing
redis_scheme: tcp
redis_host: localhost
redis_port: 6379
redis_path: null
redis_password: null
# sentry logging
sentry_dsn: ~
'';
};
# networking.firewall.allowedTCPPorts = [ 8080 ];
}

31
pkgs/wallabag.patch Normal file
View file

@ -0,0 +1,31 @@
diff --git a/app/AppKernel.php b/app/AppKernel.php
index 347197e..902b558 100644
--- a/app/AppKernel.php
+++ b/app/AppKernel.php
@@ -69,19 +69,24 @@ class AppKernel extends Kernel
return __DIR__;
}
+ public function getProjectDir()
+ {
+ return getenv('WALLABAG_DATA') ?: dirname(__DIR__);
+ }
+
public function getCacheDir()
{
- return dirname(__DIR__) . '/var/cache/' . $this->getEnvironment();
+ return $this->getProjectDir() . '/var/cache/' . $this->getEnvironment();
}
public function getLogDir()
{
- return dirname(__DIR__) . '/var/logs';
+ return $this->getProjectDir() . '/var/logs';
}
public function registerContainerConfiguration(LoaderInterface $loader)
{
- $loader->load($this->getRootDir() . '/config/config_' . $this->getEnvironment() . '.yml');
+ $loader->load($this->getProjectDir() . '/app/config/config_' . $this->getEnvironment() . '.yml');
$loader->load(function ($container) {

1
profiles/backup/default.nix Normal file
View file

@ -0,0 +1 @@
{ }

12
profiles/bluetooth/default.nix Normal file
View file

@ -0,0 +1,12 @@
{ pkgs, ... }:
{
hardware.bluetooth.enable = true;
services.blueman.enable = true;
# A2DP protocol
hardware.bluetooth.settings = {
General = {
Enable = "Source,Sink,Media,Socket";
};
};
}

34
profiles/borg/default.nix Normal file
View file

@ -0,0 +1,34 @@
{
# Assumes the remote borg backup server has already been initialized
# borg init --encryption-key=repokey-blake2 -rsh 'ssh -i /run/keys/id_ed25519_borgbase' 20779@hk-s020.rsync.net:<borg-archive>
services.borgbackup.jobs = {
backupTaskwarriorRsync = {
paths = [ "/var/lib/taskserver" ];
doInit = true;
repo = "20779@hk-s020.rsync.net:taskwarrior";
encryption = {
mode = "repokey-blake2";
passCommand = "cat /run/keys/rsync";
};
environment = { BORG_RSH = "ssh -i /run/keys/id_ed25519_borgbase"; };
compression = "auto,lzma";
startAt = "weekly";
extraArgs = "--remote-path=borg1";
};
};
services.borgbackup.jobs = {
backupShaarliRsync = {
paths = [ "/var/www/shaarli-config/data/datastore.php" "/var/www/shaarli-config/config" "/var/www/shaarli-config/.json.config" ];
doInit = true;
repo = "20779@hk-s020.rsync.net:shaarli";
encryption = {
mode = "repokey-blake2";
passCommand = "cat /run/keys/rsync";
};
environment = { BORG_RSH = "ssh -i /run/keys/id_ed25519_borgbase"; };
compression = "auto,lzma";
startAt = "weekly";
extraArgs = "--remote-path=borg1";
};
};
}

11
profiles/cachix/default.nix Normal file
View file

@ -0,0 +1,11 @@
{ pkgs, lib, ... }:
let
folder = ./.;
toImport = name: value: folder + ("/" + name);
filterCaches = key: value: value == "regular" && lib.hasSuffix ".nix" key && key != "default.nix";
imports = lib.mapAttrsToList toImport (lib.filterAttrs filterCaches (builtins.readDir folder));
in
{
inherit imports;
nix.binaryCaches = [ "https://cache.nixos.org/" ];
}

10
profiles/cachix/nix-community.nix Normal file
View file

@ -0,0 +1,10 @@
{
nix = {
binaryCaches = [
"https://nix-community.cachix.org"
];
binaryCachePublicKeys = [
"nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
];
};
}

10
profiles/cachix/nrdxp.nix Normal file
View file

@ -0,0 +1,10 @@
{
nix = {
binaryCaches = [
"https://nrdxp.cachix.org"
];
binaryCachePublicKeys = [
"nrdxp.cachix.org-1:Fc5PSqY2Jm1TrWfm88l6cvGWwz3s93c6IOifQWnhNW4="
];
};
}

37
profiles/calibre/default.nix Normal file
View file

@ -0,0 +1,37 @@
{
# Unnecessary at this stage
#services.calibre-web = {
# enable = true;
# listen.port = 8083;
# openFirewall = true;
# # Bug in the module puts this in quotes in the systemd file
# # user = calibre;
# # group = calibre;
# options = {
# calibreLibrary = "/data/books";
# enableBookUploading = true;
# };
#};
services.calibre-server = {
enable = true;
libraries = [ "/data/books" ];
# Bug in the module puts this in quotes in the systemd file
# user = calibre;
# group = calibre;
};
services.nginx.virtualHosts."books.mossnet.lan" = {
enableACME = false;
forceSSL = false;
locations."/" = {
extraConfig = ''
proxy_pass http://localhost:8083/;
proxy_set_header X-Forwarded-Host $host;
'';
};
};
networking.firewall.allowedTCPPorts = [ 8080 ];
}

132
profiles/core/common.nix Normal file
View file

@ -0,0 +1,132 @@
{ config, pkgs, ... }:
{
# imports = [
# ./nvim.nix
# ./unstable.nix
# ];
environment.systemPackages = with pkgs; [
htop
iftop
wget
curl
exa
bat
fd
ag
viu
w3m
ranger
ripgrep
tcpdump
whois
mtr
file
lsof
atool
inotify-tools
strace
zip
unzip
rsync
tmux
pwgen
glow
gitAndTools.gitFull
dig
wpa_supplicant
#neovim defined in ./nvim.nix
#wofi
#firefox
#fractal
#pinentry_gnome
pass
gcc
less
mpv
zathura
#qmk_firmware
python3
gdb
#vcv-rack
#xdotool
#neofetch
#calibre
#openvpn
#gimp
xxd
#tilix
kitty
taskwarrior
gnupg
#openjdk
#glslviewer
#filezilla
#signal-desktop
#wire-desktop
#tdesktop
#feedreader
#newsflash
#syncthing
dijo
#kdeconnect
#ssb-patchwork
#gnome3.gnome-tweaks
#gnome3.pomodoro
#gnomeExtensions.gsconnect
#gnomeExtensions.taskwhisperer
#gnome3.networkmanager-openvpn
#python3Packages.youtube-dl
#appimage-run
#home-manager
libreoffice
fontconfig
#hugo
#processing
#nextcloud-client
#zsh-powerlevel10k
powerline-fonts
#supercollider
haskellPackages.tidal
pandoc
];
#programs.bash.enableCompletion = true;
environment.shellAliases = {
"cat": "bat";
"ls":"exa";
"grep": "rg";
};
# needed for vcv-rack
#nixpkgs.config.allowUnfree = true;
programs.gnupg.agent.enable = true;
programs.gnupg.agent.pinentryFlavor = "curses";
programs.gnupg.agent.enableSSHSupport = false;
#system.copySystemConfiguration = true;
#services.syncthing = {
# enable = true;
# openDefaultPorts = true;
# systemService = true;
# user = "anish";
# dataDir = "/home/anish/usr/syncthing";
#};
#zsh powerlevel10k
#programs.zsh.enable = true;
#programs.zsh.promptInit = "source ${pkgs.zsh-powerlevel10k}/share/zsh-powerlevel10k/powerlevel10k.zsh-theme";
#users.users.anish.shell = pkgs.zsh;
#android
programs.adb.enable = true;
users.users.anish.extraGroups = ["adbusers"];
nix.extraOptions = ''
keep-outputs = true
keep-derivations = true
'';
}

49
profiles/core/default.nix Normal file
View file

@ -0,0 +1,49 @@
{ self, config, lib, pkgs, ... }:
let inherit (lib) fileContents;
in
{
imports = [ ../cachix ];
nix.systemFeatures = [ "nixos-test" "benchmark" "big-parallel" "kvm" ];
fonts = {
fonts = with pkgs; [ powerline-fonts dejavu_fonts ];
fontconfig.defaultFonts = {
monospace = [ "DejaVu Sans Mono for Powerline" ];
sansSerif = [ "DejaVu Sans" ];
};
};
nix = {
autoOptimiseStore = true;
gc.automatic = true;
optimise.automatic = true;
useSandbox = true;
allowedUsers = [ "@wheel" ];
trustedUsers = [ "root" "@wheel" ];
extraOptions = ''
min-free = 536870912
keep-outputs = true
keep-derivations = true
fallback = true
'';
};
environment.systemPackages = with pkgs; [
pinentry_gnome
cached-nix-shell
];
services.devmon.enable = true;
# For rage encryption, all hosts need a ssh key pair
services.openssh = {
enable = true;
openFirewall = lib.mkDefault false;
};
programs.gnupg.agent.enable = true;
#programs.gnupg.agent.pinentryFlavor = "curses";
services.earlyoom.enable = true;
}

92
profiles/core/starship.toml Normal file
View file

@ -0,0 +1,92 @@
[aws]
symbol = " "
[character]
success_symbol = "[❯](bold purple)"
vicmd_symbol = "[❮](bold purple)"
[battery]
full_symbol = " "
charging_symbol = " "
discharging_symbol = " "
[conda]
symbol = " "
[directory]
style = "cyan"
read_only = " 🔒"
[docker_context]
symbol = " "
[elixir]
symbol = " "
[elm]
symbol = " "
[git_branch]
format = "[$symbol$branch]($style) "
symbol = " "
style = "bold dimmed white"
[git_status]
format = '([「$all_status$ahead_behind」]($style) )'
conflicted = "⚠️"
ahead = "⟫${count} "
behind = "⟪${count}"
diverged = "🔀 "
untracked = "📁 "
stashed = "↪ "
modified = "𝚫 "
staged = "✔ "
renamed = "⇆ "
deleted = "✘ "
style = "bold bright-white"
[golang]
symbol = " "
[hg_branch]
symbol = " "
[java]
symbol = " "
[julia]
symbol = " "
[memory_usage]
symbol = " "
disabled = false
[nim]
symbol = " "
[nix_shell]
format = '[$symbol$state]($style) '
symbol = " "
pure_msg = "λ"
impure_msg = "⎔"
[nodejs]
symbol = " "
[package]
symbol = " "
[php]
symbol = " "
[python]
symbol = " "
[ruby]
symbol = " "
[rust]
symbol = " "
[status]
disabled = false

42
profiles/desktop/battery-low-timer.nix Normal file
View file

@ -0,0 +1,42 @@
{ pkgs, ... }:
{
systemd.services.battery-low = {
serviceConfig.Type = "simple";
path = [
pkgs.acpi
pkgs.gawk # I was too lazy to find out where awk lives, it's not coreutils, hopefully it works the same
pkgs.libnotify
];
startAt = "*08:00:00";
script = ''
#!/usr/bin/env bash
if [ `acpi -b | grep "Battery 0" | gawk ' { print ($3)}'` == "Discharging," ] ; then
# Discharging
# Monitor for low battery
rm /tmp/battery-full
if [ `acpi -b | grep "Battery 0" | gawk ' { print ($4)-0}'` -le "15" ] ; then
notify-send -u critical "Battery Low";
fi
else
# Charging
if [ `acpi -b | grep "Battery 0" | gawk ' { print ($4)-0}'` -ge "94" ] ; then
# Fully charged
if [[ -f /tmp/battery-full ]]; then
touch /tmp/battery-full;
notify-send "Battery Full"
fi
fi
fi
'';
serviceConfig = {
User = "anish";
Environment = "DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/1000/bus";
};
};
systemd.timers.battery-low = {
wantedBy = [ "timers.target" ];
partOf = [ "battery-low.service" ];
timerConfig.OnCalendar = [ "*:0/5" ];
};
}

201
profiles/desktop/default.nix Normal file
View file

@ -0,0 +1,201 @@
{ config, pkgs, lib, ... }:
let
dracula-gtk = pkgs.fetchFromGitHub {
owner = "dracula";
repo = "gtk";
rev = "502f212d83bc67e8f0499574546b99ec6c8e16f9";
sha256 = "1wx9nzq7cqyvpaq4j60bs8g7gh4jk8qg4016yi4c331l4iw1ymsa";
};
in
{
# TODO modularize
imports = [ ./battery-low-timer.nix ];
services = {
gnome.gnome-keyring.enable = true;
upower.enable = true;
dbus = {
enable = true;
packages = [ pkgs.dconf ];
};
};
security.pam.services.sddm.enableGnomeKeyring = true;
environment.sessionVariables = rec {
XDG_CACHE_HOME = "\${HOME}/.cache";
XDG_CONFIG_HOME = "\${HOME}/.config";
XDG_BIN_HOME = "\${HOME}/.local/bin";
XDG_DATA_HOME = "\${HOME}/.local/share";
PATH = [
"\${XDG_BIN_HOME}"
];
};
nixpkgs.config.allowUnfreePredicate = pkg: builtins.elem (lib.getName pkg) [
"ripcord"
"vcv-rack"
];
environment.systemPackages = with pkgs; [
signal-desktop # bridge to sealight?
scrot
ripcord
feh
sxiv
xkblayout-state
sublime-music
vcv-rack
zathura
calibre
nheko
mpv
newsflash
zeal
xclip
xdotool
rofi
rofimoji
rofi-calc
eww
obs-studio
lightdm
dunst
libnotify
(polybar.override {
pulseSupport = true;
nlSupport = true;
})
papirus-icon-theme
calendar-cli
wyrd
tootle
];
location.provider = "geoclue2";
services = {
redshift = {
enable = true;
temperature = {
day = 5500;
night = 3700;
};
};
xserver = {
enable = true;
layout = "us,dvorak";
desktopManager.wallpaper.mode = "fill";
displayManager = {
defaultSession = "none+bspwm";
sessionCommands = ''
${pkgs.xorg.xrdb}/bin/xrdb -merge <<EOF
#define blk #1F2430
#define bblk #F28779
#define red #A6CC70
#define bred #FFCC66
#define grn #5CCFE6
#define bgrn #F29E74
#define ylw #77A8D9
#define bylw #5C6773
#define blu #707A8C
#define bblu #F27983
#define mag #BAE67E
#define bmag #FFD580
#define cyn #73D0FF
#define bcyn #FFA759
#define wht #95E6CB
#define bwht #CBCCC6
#define bg blk
#define fg wht
*.foreground: fg
*.background: bg
*.cursorColor: mag
*.color0: blk
*.color8: bblk
*.color1: red
*.color9: bred
*.color2: grn
*.color10: bgrn
*.color3: ylw
*.color11: bylw
*.color4: blu
*.color12: bblu
*.color5: mag
*.color13: bmag
*.color6: cyn
*.color14: bcyn
*.color7: wht
*.color15: bwht
! greys
*.color234: #1E2029
*.color235: #282a36
*.color236: #373844
*.color237: #44475a
*.color239: #565761
*.color240: #6272a4
*.color241: #b6b6b2
EOF
# hotplug
connect() {
xrandr --output HDMI-2 --same-as eDP-1
}
disconnect() {
xrandr --output HDMI-2 --off
}
xrandr | grep "HDMI-2 connected" &>>/dev/null && connect || disconnect
# keyboard on curve is busted
get_keyboard_id() {
xinput list | grep 'AT Translated Set' | cut -f2 | cut -d'=' -f2 | xinput float
}
disconnect_keyboard() {
id=$(get_keyboard_id)
xinput float $id
unset id
}
attach_keyboard() {
id=$(get_keyboard_id)
xinput reattach $id 3
}
disconnect_keyboard
'';
# lightdm.enable = true;
# lightdm.greeters.mini.enable = true;
# lightdm.greeters.mini.user = "anish"; # TODO hardcoded
# lightdm.background = "/etc/nixos/users/profiles/desktop/background.jpg";
# lightdm.greeters.mini.extraConfig = ''
# text-color = "#ff79c6"
# password-background-color = "#1E2029"
# window-color = "#181a23"
# border-color = "#181a23"
# '';
};
windowManager.bspwm.enable = true;
#windowManager.bspwm.configFile = "/home/anish/.bspwm/bspwmrc";
windowManager.bspwm.sxhkd.configFile = "/home/anish/.config/sxhkdrc";
};
};
fonts.fonts = with pkgs; [
fira-code
fira-code-symbols
hermit
#hack
siji
font-awesome
proggyfonts
(nerdfonts.override { fonts = [ "FiraCode" "DroidSansMono" "Iosevka" ]; })
];
}

32
profiles/dhyan/default.nix Normal file
View file

@ -0,0 +1,32 @@
{ pkgs, ... }:
{
# TODO
# scrappy script that requires dhyan be cloned to /home/anish/usr/dhyan
# dhyan needs secrets, and internet access to install dependencies, havent figured that out with nix yet
# dhyan also depends on jdk11, but that's only to install dependencies, run `bb -m dhyan.main` once before installing this script
# If you've updated dhyan, you'll want to cd to /home/anish/usr/dhyan and run git pull
systemd.services.dhyan = {
serviceConfig.Type = "oneshot";
path = [
pkgs.babashka
pkgs.git
pkgs.jdk11
pkgs.curl
];
startAt = "*08:00:00";
script = ''
cd /home/anish/usr/dhyan
source .envrc
bb -m dhyan.main
'';
serviceConfig = {
User = "anish";
};
};
systemd.timers.dhyan = {
wantedBy = [ "timers.target" ];
partOf = [ "kitaab-sync.service" ];
timerConfig.OnCalendar = [ "08:00:00" ];
};
}

16
profiles/dns/default.nix Normal file
View file

@ -0,0 +1,16 @@
{ config, pkgs, lib, ... }:
{
services.dnsmasq.enable = true;
services.dnsmasq.extraConfig = ''
domain-needed
no-resolv
local=/lan/
local=/moss/
cache-size=5000
addn-hosts=/etc/adblock.hosts
''; # find a way to make adblock hosts reproducible and updateable
services.dnsmasq.servers = [ "45.90.30.49" "45.90.28.49" "1.1.1.1" "8.8.8.8" ];
networking.hosts = { "192.168.1.240" = [ "mossnet.lan" "links.mossnet.lan" "read.mossnet.lan" "stats.mossnet.lan" "music.mossnet.lan" "rss.mossnet.lan" "tasks.mossnet.lan" "file.mossnet.lan" "books.mossnet.lan" ]; };
networking.firewall.allowedTCPPorts = [ 53 ];
networking.firewall.allowedUDPPorts = [ 53 ];
}

20
profiles/ftp/default.nix Normal file
View file

@ -0,0 +1,20 @@
{ pkgs, lib, ... }:
{
networking.firewall.allowedTCPPorts = [ 20 21 ];
networking.firewall.allowedTCPPortRanges = [{ from = 51000; to = 51999; }];
services.vsftpd = {
enable = true;
writeEnable = true;
anonymousUser = true;
anonymousUserNoPassword = true;
anonymousUploadEnable = true;
anonymousMkdirEnable = true;
anonymousUserHome = "/home/ftp";
extraConfig = ''
pasv_enable=Yes
pasv_min_port=51000
pasv_max_port=51999
'';
};
}

59
profiles/gitea/default.nix Normal file
View file

@ -0,0 +1,59 @@
{ config, lib, pkgs, ... }:
{
services.gitea = {
enable = true;
appName = "Sealight Git Forge";
domain = "git.sealight.xyz";
rootUrl = "https://git.sealight.xyz";
httpPort = 3001;
database = {
type = "postgres";
# passwordFile = "/run/secrets/gitea-dbpass"; # TODO supplied by agenix
password = "somethingunknowablesorry";
};
settings = {
metrics = {
ENABLED = true;
};
repository = {
DEFAULT_BRANCH = "main";
};
};
};
services.postgresql = {
enable = true; # Ensure postgresql is enabled
authentication = ''
local gitea all ident map=gitea-users
'';
identMap = # Map the gitea user to postgresql
''
gitea-users gitea gitea
'';
# ensureDatabases = [ "gitea" ];
ensureUsers = [
{ name = "gitea"; ensurePermissions."DATABASE gitea" = "ALL PRIVILEGES"; }
];
# TODO
# initialScript # set password for gitea user
};
services.nginx = {
enable = true; # Enable Nginx
recommendedGzipSettings = true;
recommendedOptimisation = true;
recommendedProxySettings = true;
recommendedTlsSettings = true;
virtualHosts."git.sealight.xyz" = {
# Gitea hostname
enableACME = true; # Use ACME certs
forceSSL = true; # Force SSL
locations."/".proxyPass = "http://localhost:3001/"; # Proxy Gitea
};
};
networking.firewall.allowedTCPPorts = [ 80 443 ];
security.acme.defaults.email = "anish+acme@lakhwara.com";
security.acme.acceptTerms = true;
}

12
profiles/gonic/default.nix Normal file
View file

@ -0,0 +1,12 @@
{ config, lib, pkgs, ... }:
{
services.gonic.enable = true;
services.gonic.settings = ''
music-path /mnt/two/music/
podcast-path /data/podcasts
cache-path /data/cache
'';
services.gonic.group = "audio";
services.gonic.user = "headphones";
networking.firewall.allowedTCPPorts = [ 4747 ];
}

110
profiles/gonic/module-gonic.nix Normal file
View file

@ -0,0 +1,110 @@
{ config, lib, pkgs, ... }:
with lib;
let
cfg = config.services.gonic;
configFile = "/etc/gonic/config";
dataFolder = "/var/lib/gonic";
in
{
options = {
services.gonic = {
enable = mkEnableOption "Gonic music server and streamer";
settings = lib.mkOption {
type = types.str;
default = { };
example = literalExample ''
music-path <path to your music dir>
podcast-path <path to your podcasts dir>
cache-path <path to cache dir>
'';
description = ''
Configuration for Gonic, see <link xlink:href="https://github.com/sentriz/gonic"/> for supported values.
'';
};
user = mkOption {
type = types.str;
default = "gonic";
description = "User account under which gonic runs.";
};
group = mkOption {
type = types.str;
default = "gonic";
description = "Group account under which gonic runs.";
};
};
};
config = mkIf cfg.enable {
environment.etc."gonic/config".text = cfg.settings;
systemd.services.gonic = {
description = "gonic Music Server and Streamer compatible with Subsonic/Airsonic";
after = [ "remote-fs.target" "network.target" ];
wantedBy = [ "multi-user.target" ];
environment = {
#GONIC_MUSIC_PATH
#GONIC_PODCAST_PATH
#GONIC_CACHE_PATH
#GONIC_DB_PATH
GONIC_SCAN_INTERVAL = "800";
#...
};
serviceConfig = {
ExecStart = "${pkgs.gonic}/bin/gonic -config-path /etc/gonic/config";
WorkingDirectory = dataFolder;
TimeoutStopSec = "20";
KillMode = "process";
Restart = "on-failure";
RestartSec = "10";
User = cfg.user;
Group = cfg.group;
DevicePolicy = "closed";
NoNewPrivileges = " yes";
PrivateTmp = "yes";
PrivateUsers = "yes";
ProtectControlGroups = "yes";
ProtectKernelModules = "yes";
ProtectKernelTunables = "yes";
RestrictAddressFamilies = "AF_UNIX AF_INET AF_INET6";
RestrictNamespaces = "yes";
RestrictRealtime = "yes";
SystemCallFilter = "~@clock @debug @module @mount @obsolete @privileged @reboot @setuid @swap";
ReadWritePaths = dataFolder;
StateDirectory = baseNameOf dataFolder;
};
};
users.users = optionalAttrs (cfg.user == "gonic") ({
gonic = {
description = "gonic service user";
name = cfg.user;
group = cfg.group;
isSystemUser = true;
};
});
users.groups = optionalAttrs (cfg.group == "gonic") ({
gonic = { };
});
services.nginx.virtualHosts."music.mossnet.lan" = {
enableACME = false;
forceSSL = false;
locations."/" = {
extraConfig = ''
proxy_pass http://localhost:4747/;
proxy_set_header X-Forwarded-Host $host;
'';
};
};
};
}

6
profiles/grasp/default.nix Normal file
View file

@ -0,0 +1,6 @@
{ ... }:
{
services."grasp".enable = true;
services."grasp".path = "/home/anish/kitaab/grasp";
services."grasp".user = "anish";
}

12
profiles/headphones/default.nix Normal file
View file

@ -0,0 +1,12 @@
{ config, lib, pkgs, ... }:
{
services.headphones = {
enable = true;
host = "192.168.1.240";
port = 8181;
user = "headphones";
group = "audio";
dataDir = "/data/music";
};
networking.firewall.allowedTCPPorts = [ 8181 ];
}

54
profiles/helix-zone/dns.nix Normal file
View file

@ -0,0 +1,54 @@
{ pkgs, ... }:
let
adblockLocalZones = pkgs.stdenv.mkDerivation {
name = "unbound-zones-adblock";
src = (pkgs.fetchFromGitHub {
owner = "StevenBlack";
repo = "hosts";
rev = "3.0.0";
sha256 = "01g6pc9s1ah2w1cbf6bvi424762hkbpbgja9585a0w99cq0n6bxv";
} + "/hosts");
phases = [ "installPhase" ];
installPhase = ''
${pkgs.gawk}/bin/awk '{sub(/\r$/,"")} {sub(/^127\.0\.0\.1/,"0.0.0.0")} BEGIN { OFS = "" } NF == 2 && $1 == "0.0.0.0" { print "local-zone: \"", $2, "\" static"}' $src | tr '[:upper:]' '[:lower:]' | sort -u > $out
'';
};
in {
networking.firewall.allowedTCPPorts = [ 53 853 5353 ];
networking.firewall.allowedUDPPorts = [ 53 853 5353 ];
networking.extraHosts = '' 127.0.0.1 helix.domain '';
# These are causing errors, goes in the server file
# local-data = "mossnet.lan. 10800 IN A 10.0.69.4";
services.unbound = {
enable = true;
settings = {
server = {
interface = [ "0.0.0.0" ];
tls-upstream = true;
tls-cert-bundle = "/etc/ssl/certs/ca-certificates.crt";
include = "${adblockLocalZones}";
access-control = "0.0.0.0/0 allow";
verbosity = 2;
do-tcp = true;
do-ip4 = true;
prefetch = true;
prefetch-key = true;
rrset-roundrobin = true;
qname-minimisation-strict = true;
hide-identity = true;
hide-version = true;
local-zone = "mossnet.lan. static";
};
forward-zone = [{
name = ".";
forward-addr = [ "45.90.28.77#c46fd3.dns1.nextdns.io" "2a07:a8c0::#c46fd3.dns1.nextdns.io" "45.90.30.77#c46fd3.dns2.nextdns.io" "2a07:a8c1::#c46fd3.dns2.nextdns.io" ];
}];
remote-control.control-enable = true;
};
};
}

82
profiles/helix-zone/knot.nix Normal file
View file

@ -0,0 +1,82 @@
# SPDX-License-Identifier: Apache-2.0
{ config, pkgs, ... }:
let
# https://github.com/StevenBlack/hosts/issues/451
# https://github.com/ScriptTiger/Hosts-Conversions
# https://github.com/ScriptTiger/scripttiger.github.io
# https://scripttiger.github.io/alts/
adblockLocalZones = pkgs.stdenv.mkDerivation {
name = "adblock-rpz";
src = (pkgs.fetchFromGitHub {
owner = "ScriptTiger";
repo = "scripttiger.github.io";
# nix-prefetch-github ScriptTiger scripttiger.github.io
rev = "04402a6726f97c5f0d30436a70ac1344dccb7cf1";
sha256 = "iSTR7j7QEr5xYtImyntDlVLbnN2ipcLcTRr4sfdx078=";
} + "/alts/rpz/blacklist.txt");
phases = [ "installPhase" ];
installPhase = "install -m 444 -D $src $out";
};
domain = "sealight.xyz";
certdir = config.security.acme.certs.${domain}.directory;
in {
networking.firewall.allowedTCPPorts = [ 853 ];
networking.firewall.allowedUDPPorts = [ 853 ];
# for acme certs, TODO: make a proper group
users.users.knot-resolver.extraGroups = [ "nginx" ];
# https://github.com/NixOS/nixpkgs/issues/81109
nixpkgs.config.packageOverrides = pkgs: rec {
knot-resolver = pkgs.knot-resolver.override { extraFeatures = true; };
};
services.kresd = {
enable = true;
# Plain DNS only from localhost.
# You might want to add a LAN or VPN subnet, depending on deployment.
#listenPlain = [ "127.0.0.1:53" "[::1]:53" ];
listenTLS = [ "853" ];
#listenDoH = [ "" "[::]:443" ];
instances = 1;
# TODO: chain.pem for stapling: https://gitlab.nic.cz/knot/knot-resolver/-/issues/517
#policy.add(
# policy.rpz(
# policy.DENY_MSG('domain blocked by your resolver operator'),
# '${adblockLocalZones}',
# false))
extraConfig = ''
modules.load('predict')
modules = { 'hints > iterate' }
policy.add(
policy.all(
policy.TLS_FORWARD({
{'45.90.30.0', hostname='87b4e9.dns2.nextdns.io'},
{'45.90.28.0', hostname='87b4e9.dns1.nextdns.io'}
})))
policy.add(policy.suffix(policy.FORWARD({'10.0.69.4', '172.16.11.240'}), {todname('mossnet.lan')}))
net.tls("${certdir}/fullchain.pem", "${certdir}/key.pem")
-- refresh certs when ACME updates them
-- TODO: could probably do with systemd and a control socket?
-- TODO: may fail on first boot if ACME isn't fast, add a systemd dep
local notify = require('cqueues.notify')
local watcher = notify.opendir('${certdir}')
watcher:add('fullchain.pem')
worker.coroutine(function ()
for flags, name in watcher:changes() do
for flag in notify.flags(flags) do
print('file watcher:', name, notify[flag])
end
if name == 'fullchain.pem' then
net.tls("${certdir}/fullchain.pem", "${certdir}/key.pem")
end
end
end)
-- Below we create a tmpfs FS for the cache -- use almost all of it:
cache.size = cache.fssize() - 1*MB
'';
};
}

17
profiles/helix-zone/node-composition.nix Normal file
View file

@ -0,0 +1,17 @@
# This file has been generated by node2nix 1.9.0. Do not edit!
{pkgs ? import <nixpkgs> {
inherit system;
}, system ? builtins.currentSystem, nodejs ? pkgs."nodejs-12_x"}:
let
nodeEnv = import ./node-env.nix {
inherit (pkgs) stdenv lib python2 runCommand writeTextFile writeShellScript;
inherit pkgs nodejs;
libtool = if pkgs.stdenv.isDarwin then pkgs.darwin.cctools else null;
};
in
import ./node-packages.nix {
inherit (pkgs) fetchurl nix-gitignore stdenv lib fetchgit;
inherit nodeEnv;
}

588
profiles/helix-zone/node-env.nix Normal file
View file

@ -0,0 +1,588 @@
# This file originates from node2nix
{lib, stdenv, nodejs, python2, pkgs, libtool, runCommand, writeTextFile, writeShellScript}:
let
# Workaround to cope with utillinux in Nixpkgs 20.09 and util-linux in Nixpkgs master
utillinux = if pkgs ? utillinux then pkgs.utillinux else pkgs.util-linux;
python = if nodejs ? python then nodejs.python else python2;
# Create a tar wrapper that filters all the 'Ignoring unknown extended header keyword' noise
tarWrapper = runCommand "tarWrapper" {} ''
mkdir -p $out/bin
cat > $out/bin/tar <<EOF
#! ${stdenv.shell} -e
$(type -p tar) "\$@" --warning=no-unknown-keyword --delay-directory-restore
EOF
chmod +x $out/bin/tar
'';
# Function that generates a TGZ file from a NPM project
buildNodeSourceDist =
{ name, version, src, ... }:
stdenv.mkDerivation {
name = "node-tarball-${name}-${version}";
inherit src;
buildInputs = [ nodejs ];
buildPhase = ''
export HOME=$TMPDIR
tgzFile=$(npm pack | tail -n 1) # Hooks to the pack command will add output (https://docs.npmjs.com/misc/scripts)
'';
installPhase = ''
mkdir -p $out/tarballs
mv $tgzFile $out/tarballs
mkdir -p $out/nix-support
echo "file source-dist $out/tarballs/$tgzFile" >> $out/nix-support/hydra-build-products
'';
};
# Common shell logic
installPackage = writeShellScript "install-package" ''
installPackage() {
local packageName=$1 src=$2
local strippedName
local DIR=$PWD
cd $TMPDIR
unpackFile $src
# Make the base dir in which the target dependency resides first
mkdir -p "$(dirname "$DIR/$packageName")"
if [ -f "$src" ]
then
# Figure out what directory has been unpacked
packageDir="$(find . -maxdepth 1 -type d | tail -1)"
# Restore write permissions to make building work
find "$packageDir" -type d -exec chmod u+x {} \;
chmod -R u+w "$packageDir"
# Move the extracted tarball into the output folder
mv "$packageDir" "$DIR/$packageName"
elif [ -d "$src" ]
then
# Get a stripped name (without hash) of the source directory.
# On old nixpkgs it's already set internally.
if [ -z "$strippedName" ]
then
strippedName="$(stripHash $src)"
fi
# Restore write permissions to make building work
chmod -R u+w "$strippedName"
# Move the extracted directory into the output folder
mv "$strippedName" "$DIR/$packageName"
fi
# Change to the package directory to install dependencies
cd "$DIR/$packageName"
}
'';
# Bundle the dependencies of the package
#
# Only include dependencies if they don't exist. They may also be bundled in the package.
includeDependencies = {dependencies}:
lib.optionalString (dependencies != []) (
''
mkdir -p node_modules
cd node_modules
''
+ (lib.concatMapStrings (dependency:
''
if [ ! -e "${dependency.name}" ]; then
${composePackage dependency}
fi
''
) dependencies)
+ ''
cd ..
''
);
# Recursively composes the dependencies of a package
composePackage = { name, packageName, src, dependencies ? [], ... }@args:
builtins.addErrorContext "while evaluating node package '${packageName}'" ''
installPackage "${packageName}" "${src}"
${includeDependencies { inherit dependencies; }}
cd ..
${lib.optionalString (builtins.substring 0 1 packageName == "@") "cd .."}
'';
pinpointDependencies = {dependencies, production}:
let
pinpointDependenciesFromPackageJSON = writeTextFile {
name = "pinpointDependencies.js";
text = ''
var fs = require('fs');
var path = require('path');
function resolveDependencyVersion(location, name) {
if(location == process.env['NIX_STORE']) {
return null;
} else {
var dependencyPackageJSON = path.join(location, "node_modules", name, "package.json");
if(fs.existsSync(dependencyPackageJSON)) {
var dependencyPackageObj = JSON.parse(fs.readFileSync(dependencyPackageJSON));
if(dependencyPackageObj.name == name) {
return dependencyPackageObj.version;
}
} else {
return resolveDependencyVersion(path.resolve(location, ".."), name);
}
}
}
function replaceDependencies(dependencies) {
if(typeof dependencies == "object" && dependencies !== null) {
for(var dependency in dependencies) {
var resolvedVersion = resolveDependencyVersion(process.cwd(), dependency);
if(resolvedVersion === null) {
process.stderr.write("WARNING: cannot pinpoint dependency: "+dependency+", context: "+process.cwd()+"\n");
} else {
dependencies[dependency] = resolvedVersion;
}
}
}
}
/* Read the package.json configuration */
var packageObj = JSON.parse(fs.readFileSync('./package.json'));
/* Pinpoint all dependencies */
replaceDependencies(packageObj.dependencies);
if(process.argv[2] == "development") {
replaceDependencies(packageObj.devDependencies);
}
replaceDependencies(packageObj.optionalDependencies);
/* Write the fixed package.json file */
fs.writeFileSync("package.json", JSON.stringify(packageObj, null, 2));
'';
};
in
''
node ${pinpointDependenciesFromPackageJSON} ${if production then "production" else "development"}
${lib.optionalString (dependencies != [])
''
if [ -d node_modules ]
then
cd node_modules
${lib.concatMapStrings (dependency: pinpointDependenciesOfPackage dependency) dependencies}
cd ..
fi
''}
'';
# Recursively traverses all dependencies of a package and pinpoints all
# dependencies in the package.json file to the versions that are actually
# being used.
pinpointDependenciesOfPackage = { packageName, dependencies ? [], production ? true, ... }@args:
''
if [ -d "${packageName}" ]
then
cd "${packageName}"
${pinpointDependencies { inherit dependencies production; }}
cd ..
${lib.optionalString (builtins.substring 0 1 packageName == "@") "cd .."}
fi
'';
# Extract the Node.js source code which is used to compile packages with
# native bindings
nodeSources = runCommand "node-sources" {} ''
tar --no-same-owner --no-same-permissions -xf ${nodejs.src}
mv node-* $out
'';
# Script that adds _integrity fields to all package.json files to prevent NPM from consulting the cache (that is empty)
addIntegrityFieldsScript = writeTextFile {
name = "addintegrityfields.js";
text = ''
var fs = require('fs');
var path = require('path');
function augmentDependencies(baseDir, dependencies) {
for(var dependencyName in dependencies) {
var dependency = dependencies[dependencyName];
// Open package.json and augment metadata fields
var packageJSONDir = path.join(baseDir, "node_modules", dependencyName);
var packageJSONPath = path.join(packageJSONDir, "package.json");
if(fs.existsSync(packageJSONPath)) { // Only augment packages that exist. Sometimes we may have production installs in which development dependencies can be ignored
console.log("Adding metadata fields to: "+packageJSONPath);
var packageObj = JSON.parse(fs.readFileSync(packageJSONPath));
if(dependency.integrity) {
packageObj["_integrity"] = dependency.integrity;
} else {
packageObj["_integrity"] = "sha1-000000000000000000000000000="; // When no _integrity string has been provided (e.g. by Git dependencies), add a dummy one. It does not seem to harm and it bypasses downloads.
}
if(dependency.resolved) {
packageObj["_resolved"] = dependency.resolved; // Adopt the resolved property if one has been provided
} else {
packageObj["_resolved"] = dependency.version; // Set the resolved version to the version identifier. This prevents NPM from cloning Git repositories.
}
if(dependency.from !== undefined) { // Adopt from property if one has been provided
packageObj["_from"] = dependency.from;
}
fs.writeFileSync(packageJSONPath, JSON.stringify(packageObj, null, 2));
}
// Augment transitive dependencies
if(dependency.dependencies !== undefined) {
augmentDependencies(packageJSONDir, dependency.dependencies);
}
}
}
if(fs.existsSync("./package-lock.json")) {
var packageLock = JSON.parse(fs.readFileSync("./package-lock.json"));
if(![1, 2].includes(packageLock.lockfileVersion)) {
process.stderr.write("Sorry, I only understand lock file versions 1 and 2!\n");
process.exit(1);
}
if(packageLock.dependencies !== undefined) {
augmentDependencies(".", packageLock.dependencies);
}
}
'';
};
# Reconstructs a package-lock file from the node_modules/ folder structure and package.json files with dummy sha1 hashes
reconstructPackageLock = writeTextFile {
name = "addintegrityfields.js";
text = ''
var fs = require('fs');
var path = require('path');
var packageObj = JSON.parse(fs.readFileSync("package.json"));
var lockObj = {
name: packageObj.name,
version: packageObj.version,
lockfileVersion: 1,
requires: true,
dependencies: {}
};
function augmentPackageJSON(filePath, dependencies) {
var packageJSON = path.join(filePath, "package.json");
if(fs.existsSync(packageJSON)) {
var packageObj = JSON.parse(fs.readFileSync(packageJSON));
dependencies[packageObj.name] = {
version: packageObj.version,
integrity: "sha1-000000000000000000000000000=",
dependencies: {}
};
processDependencies(path.join(filePath, "node_modules"), dependencies[packageObj.name].dependencies);
}
}
function processDependencies(dir, dependencies) {
if(fs.existsSync(dir)) {
var files = fs.readdirSync(dir);
files.forEach(function(entry) {
var filePath = path.join(dir, entry);
var stats = fs.statSync(filePath);
if(stats.isDirectory()) {
if(entry.substr(0, 1) == "@") {
// When we encounter a namespace folder, augment all packages belonging to the scope
var pkgFiles = fs.readdirSync(filePath);
pkgFiles.forEach(function(entry) {
if(stats.isDirectory()) {
var pkgFilePath = path.join(filePath, entry);
augmentPackageJSON(pkgFilePath, dependencies);
}
});
} else {
augmentPackageJSON(filePath, dependencies);
}
}
});
}
}
processDependencies("node_modules", lockObj.dependencies);
fs.writeFileSync("package-lock.json", JSON.stringify(lockObj, null, 2));
'';
};
prepareAndInvokeNPM = {packageName, bypassCache, reconstructLock, npmFlags, production}:
let
forceOfflineFlag = if bypassCache then "--offline" else "--registry http://www.example.com";
in
''
# Pinpoint the versions of all dependencies to the ones that are actually being used
echo "pinpointing versions of dependencies..."
source $pinpointDependenciesScriptPath
# Patch the shebangs of the bundled modules to prevent them from
# calling executables outside the Nix store as much as possible
patchShebangs .
# Deploy the Node.js package by running npm install. Since the
# dependencies have been provided already by ourselves, it should not
# attempt to install them again, which is good, because we want to make
# it Nix's responsibility. If it needs to install any dependencies
# anyway (e.g. because the dependency parameters are
# incomplete/incorrect), it fails.
#
# The other responsibilities of NPM are kept -- version checks, build
# steps, postprocessing etc.
export HOME=$TMPDIR
cd "${packageName}"
runHook preRebuild
${lib.optionalString bypassCache ''
${lib.optionalString reconstructLock ''
if [ -f package-lock.json ]
then
echo "WARNING: Reconstruct lock option enabled, but a lock file already exists!"
echo "This will most likely result in version mismatches! We will remove the lock file and regenerate it!"
rm package-lock.json
else
echo "No package-lock.json file found, reconstructing..."
fi
node ${reconstructPackageLock}
''}
node ${addIntegrityFieldsScript}
''}
npm ${forceOfflineFlag} --nodedir=${nodeSources} ${npmFlags} ${lib.optionalString production "--production"} rebuild
if [ "''${dontNpmInstall-}" != "1" ]
then
# NPM tries to download packages even when they already exist if npm-shrinkwrap is used.
rm -f npm-shrinkwrap.json
npm ${forceOfflineFlag} --nodedir=${nodeSources} ${npmFlags} ${lib.optionalString production "--production"} install
fi
'';
# Builds and composes an NPM package including all its dependencies
buildNodePackage =
{ name
, packageName
, version
, dependencies ? []
, buildInputs ? []
, production ? true
, npmFlags ? ""
, dontNpmInstall ? false
, bypassCache ? false
, reconstructLock ? false
, preRebuild ? ""
, dontStrip ? true
, unpackPhase ? "true"
, buildPhase ? "true"
, meta ? {}
, ... }@args:
let
extraArgs = removeAttrs args [ "name" "dependencies" "buildInputs" "dontStrip" "dontNpmInstall" "preRebuild" "unpackPhase" "buildPhase" "meta" ];
in
stdenv.mkDerivation ({
name = "${name}-${version}";
buildInputs = [ tarWrapper python nodejs ]
++ lib.optional (stdenv.isLinux) utillinux
++ lib.optional (stdenv.isDarwin) libtool
++ buildInputs;
inherit nodejs;
inherit dontStrip; # Stripping may fail a build for some package deployments
inherit dontNpmInstall preRebuild unpackPhase buildPhase;
compositionScript = composePackage args;
pinpointDependenciesScript = pinpointDependenciesOfPackage args;
passAsFile = [ "compositionScript" "pinpointDependenciesScript" ];
installPhase = ''
source ${installPackage}
# Create and enter a root node_modules/ folder
mkdir -p $out/lib/node_modules
cd $out/lib/node_modules
# Compose the package and all its dependencies
source $compositionScriptPath
${prepareAndInvokeNPM { inherit packageName bypassCache reconstructLock npmFlags production; }}
# Create symlink to the deployed executable folder, if applicable
if [ -d "$out/lib/node_modules/.bin" ]
then
ln -s $out/lib/node_modules/.bin $out/bin
fi
# Create symlinks to the deployed manual page folders, if applicable
if [ -d "$out/lib/node_modules/${packageName}/man" ]
then
mkdir -p $out/share
for dir in "$out/lib/node_modules/${packageName}/man/"*
do
mkdir -p $out/share/man/$(basename "$dir")
for page in "$dir"/*
do
ln -s $page $out/share/man/$(basename "$dir")
done
done
fi
# Run post install hook, if provided
runHook postInstall
'';
meta = {
# default to Node.js' platforms
platforms = nodejs.meta.platforms;
} // meta;
} // extraArgs);
# Builds a node environment (a node_modules folder and a set of binaries)
buildNodeDependencies =
{ name
, packageName
, version
, src
, dependencies ? []
, buildInputs ? []
, production ? true
, npmFlags ? ""
, dontNpmInstall ? false
, bypassCache ? false
, reconstructLock ? false
, dontStrip ? true
, unpackPhase ? "true"
, buildPhase ? "true"
, ... }@args:
let
extraArgs = removeAttrs args [ "name" "dependencies" "buildInputs" ];
in
stdenv.mkDerivation ({
name = "node-dependencies-${name}-${version}";
buildInputs = [ tarWrapper python nodejs ]
++ lib.optional (stdenv.isLinux) utillinux
++ lib.optional (stdenv.isDarwin) libtool
++ buildInputs;
inherit dontStrip; # Stripping may fail a build for some package deployments
inherit dontNpmInstall unpackPhase buildPhase;
includeScript = includeDependencies { inherit dependencies; };
pinpointDependenciesScript = pinpointDependenciesOfPackage args;
passAsFile = [ "includeScript" "pinpointDependenciesScript" ];
installPhase = ''
source ${installPackage}
mkdir -p $out/${packageName}
cd $out/${packageName}
source $includeScriptPath
# Create fake package.json to make the npm commands work properly
cp ${src}/package.json .
chmod 644 package.json
${lib.optionalString bypassCache ''
if [ -f ${src}/package-lock.json ]
then
cp ${src}/package-lock.json .
fi
''}
# Go to the parent folder to make sure that all packages are pinpointed
cd ..
${lib.optionalString (builtins.substring 0 1 packageName == "@") "cd .."}
${prepareAndInvokeNPM { inherit packageName bypassCache reconstructLock npmFlags production; }}
# Expose the executables that were installed
cd ..
${lib.optionalString (builtins.substring 0 1 packageName == "@") "cd .."}
mv ${packageName} lib
ln -s $out/lib/node_modules/.bin $out/bin
'';
} // extraArgs);
# Builds a development shell
buildNodeShell =
{ name
, packageName
, version
, src
, dependencies ? []
, buildInputs ? []
, production ? true
, npmFlags ? ""
, dontNpmInstall ? false
, bypassCache ? false
, reconstructLock ? false
, dontStrip ? true
, unpackPhase ? "true"
, buildPhase ? "true"
, ... }@args:
let
nodeDependencies = buildNodeDependencies args;
in
stdenv.mkDerivation {
name = "node-shell-${name}-${version}";
buildInputs = [ python nodejs ] ++ lib.optional (stdenv.isLinux) utillinux ++ buildInputs;
buildCommand = ''
mkdir -p $out/bin
cat > $out/bin/shell <<EOF
#! ${stdenv.shell} -e
$shellHook
exec ${stdenv.shell}
EOF
chmod +x $out/bin/shell
'';
# Provide the dependencies in a development shell through the NODE_PATH environment variable
inherit nodeDependencies;
shellHook = lib.optionalString (dependencies != []) ''
export NODE_PATH=${nodeDependencies}/lib/node_modules
export PATH="${nodeDependencies}/bin:$PATH"
'';
};
in
{
buildNodeSourceDist = lib.makeOverridable buildNodeSourceDist;
buildNodePackage = lib.makeOverridable buildNodePackage;
buildNodeDependencies = lib.makeOverridable buildNodeDependencies;
buildNodeShell = lib.makeOverridable buildNodeShell;
}

4216
profiles/helix-zone/node-packages.nix Normal file
View file

File diff suppressed because it is too large Load diff

48
profiles/helix-zone/pkg-mx-puppet-slack.nix Normal file
View file

@ -0,0 +1,48 @@
{ stdenv, fetchFromGitHub, pkgs, lib, nodejs, nodePackages, pkg-config, libjpeg, pixman, cairo, pango }:
let
# No official version ever released
src = fetchFromGitHub {
owner = "Sorunome";
repo = "mx-puppet-slack";
rev = "691e53d2d703bd169e1f23a8d8dff3f008d8c4ef";
sha256 = "1yczhfpa4qzvijcpgc2pr10s009qb6jwlfwpcbb17g2wsx6zj0c2";
};
myNodePackages = import ./node-composition.nix {
inherit pkgs nodejs;
inherit (stdenv.hostPlatform) system;
};
in myNodePackages.package.override {
pname = "mx-puppet-slack";
inherit src;
nativeBuildInputs = [ nodePackages.node-pre-gyp pkg-config ];
buildInputs = [ libjpeg pixman cairo pango ];
postInstall = ''
# Patch shebangs in node_modules, otherwise the webpack build fails with interpreter problems
patchShebangs --build "$out/lib/node_modules/mx-puppet-slack/node_modules/"
# compile Typescript sources
npm run build
# Make an executable to run the server
mkdir -p $out/bin
cat <<EOF > $out/bin/mx-puppet-slack
#!/bin/sh
exec ${nodejs}/bin/node $out/lib/node_modules/mx-puppet-slack/build/index.js "\$@"
EOF
chmod +x $out/bin/mx-puppet-slack
'';
meta = with lib; {
description = "A slack puppeting bridge for matrix";
license = licenses.asl20;
homepage = "https://github.com/Sorunome/mx-puppet-slack";
maintainers = with maintainers; [ chickensoupwithrice ];
platforms = platforms.unix;
};
}

378
profiles/matrix/default.nix Normal file
View file

@ -0,0 +1,378 @@
{ config, lib, pkgs, ... }:
{
services.matrix-synapse = {
enable = true;
settings = {
server_name = "sealight.xyz";
listeners = [
{
port = 8448;
tls = false;
resources = [{
compress = true;
names = [ "client" "federation" ];
}];
}
{
port = 9090;
type = "metrics";
bind_addresses = [ "0.0.0.0" ];
resources = [{
compress = false;
names = [ ];
}];
tls = false;
}
];
app_service_config_files = [
# The registration file is automatically generated after starting the appservice for the first time.
# cp /var/lib/matrix-appservice-discord/discord-registration.yaml /var/lib/matrix-synapse/
# chown matrix-synapse:matrix-synapse /var/lib/matrix-synapse/discord-registration.yaml
# "/var/lib/matrix-synapse/telegram-registration.yaml"
# "/var/lib/matrix-synapse/slack-registration.yaml"
# "/var/lib/matrix-synapse/discord-registration.yaml"
# "/var/lib/matrix-synapse/whatsapp-registration.yaml"
];
turn_uris = [
"turn:turn.sealight.xyz:3478?transport=udp"
"turn:turn.sealight.xyz:3478?transport=tcp"
];
turn_shared_secret = config.services.coturn.static-auth-secret;
extraConfig = ''
max_upload_size: "50M"
use_presence: false
registration_shared_secret: "hD9HQGTTDxp0mQsQ5JDsfudWMDiubmZENOgPchIvfBvUlPxlvQSvjoO4wn2L1seU";
'';
enable_metrics = true;
enable_registration = false;
database = {
name = "psycopg2";
args.password = "Da0?H*9i{x?,]|kq@iBwlIzu"; # TODO agenix
};
};
## coturn based TURN server integration (TURN server setup mentioned later),
## shared secret generated while configuring coturn
## and reused here (power of Nix being a real programming language)
};
services.coturn = {
enable = true;
use-auth-secret = true;
static-auth-secret = "jXW1ohIq6wM3NB00xeME3uBihY85xjpkhGoyzBIdwhOpj7gjyxXZu1fwp1lUiYwJ";
realm = "turn.sealight.xyz";
min-port = 49111;
max-port = 51111;
no-cli = true;
no-tcp-relay = true;
no-tls = true;
cert = "${config.security.acme.certs."turn.sealight.xyz".directory}/full.pem";
pkey = "${config.security.acme.certs."turn.sealight.xyz".directory}/key.pem";
extraConfig = ''
verbose
user-quota=12
total-quota=1200
denied-peer-ip=10.0.0.0-10.255.255.255
denied-peer-ip=192.168.0.0-192.168.255.255
denied-peer-ip=172.16.0.0-172.31.255.255
denied-peer-ip=0.0.0.0-0.255.255.255
denied-peer-ip=100.64.0.0-100.127.255.255
denied-peer-ip=127.0.0.0-127.255.255.255
denied-peer-ip=169.254.0.0-169.254.255.255
denied-peer-ip=192.0.0.0-192.0.0.255
denied-peer-ip=192.0.2.0-192.0.2.255
denied-peer-ip=192.88.99.0-192.88.99.255
denied-peer-ip=198.18.0.0-198.19.255.255
denied-peer-ip=198.51.100.0-198.51.100.255
denied-peer-ip=203.0.113.0-203.0.113.255
denied-peer-ip=240.0.0.0-255.255.255.255
'';
};
security.acme.certs.${config.services.coturn.realm} = {
/* insert here the right configuration to obtain a certificate */
webroot = "/var/lib/acme/acme-challenge/";
email = "anish+acme@lakhwara.com";
postRun = "systemctl restart coturn.service";
group = "turnserver";
};
# TODO fix up jitsi bridge stuff
## services.jitsi-meet = {
## enable = true;
## hostName = "jitsi.sealight.xyz";
## };
## services.jitsi-videobridge.enable = true;
services.postgresql = {
enable = true;
## postgresql user and db name remains in the
## service.matrix-synapse.database_args setting which
## by default is matrix-synapse
# TODO agenix
initialScript = pkgs.writeText "synapse-init.sql" ''
CREATE ROLE "matrix-synapse" WITH LOGIN PASSWORD "Da0?H*9i{x?,]|kq@iBwlIzu";
CREATE DATABASE "matrix-synapse" WITH OWNER "matrix-synapse"
TEMPLATE template0
LC_COLLATE = "C"
LC_CTYPE = "C";
'';
authentication = ''
local matrix-synapse all ident map=matrix-synapse-users
'';
identMap = # Map the matrix-synapse user to postgresql
''
matrix-synapse-users matrix-synapse matrix-synapse
'';
};
networking.firewall =
let
range = with config.services.coturn; [{
from = min-port;
to = max-port;
}];
in
{
enable = true;
allowedUDPPortRanges = range; # coturn
allowedTCPPortRanges = range;
allowedTCPPorts = [
22 # SSH
8448 # Matrix federation
8008
80
443
3478 # Coturn service
5349 # Coturn service
9090 # Synapse Metrics
];
allowedUDPPorts = [
3478
5349 # Coturn service
];
};
nixpkgs.overlays = [
(self: super: {
element-web = super.element-web.override {
conf = {
default_server_config = {
"m.homeserver" = {
"base_url" = "https://chat.sealight.xyz";
"server_name" = "sealight.xyz";
};
"m.identity_server" = {
"base_url" = "https://vector.im";
};
};
## jitsi will be setup later,
## but we need to add to Riot configuration
jitsi.preferredDomain = "jitsi.sealight.xyz";
};
};
})
];
services.nginx = {
enable = true;
virtualHosts = {
"sealight.xyz" = {
forceSSL = true;
enableACME = true;
locations."/" = {
root = "/var/www/sealight.xyz";
};
locations."/_matrix" = {
proxyPass = "http://localhost:8448";
};
# locations."/slackbridge" = {
# proxyPass = "http://localhost:9899";
# };
};
## virtual host for Synapse
"chat.sealight.xyz" = {
forceSSL = true;
enableACME = true; # TODO
#useACMEHost = "sealight.xyz";
locations."/" = {
proxyPass = "http://localhost:8448";
};
};
## virtual host for Riot/Web
"element.sealight.xyz" = {
forceSSL = true;
enableACME = true; # TODO
#useACMEHost = "sealight.xyz";
## root points to the riot-web package content, also configured via Nix
locations."/" = {
root = pkgs.element-web;
};
};
# ${config.services.jitsi-meet.hostName} = {
# enableACME = true; # TODO
# forceSSL = true; # TODO
# };
};
## other nginx specific best practices
recommendedGzipSettings = true;
recommendedOptimisation = true;
recommendedTlsSettings = true;
};
services.mautrix-telegram = {
enable = false;
environmentFile = /etc/secrets/telegram.env; # file containing the appservice and telegram tokens
# The appservice is pre-configured to use SQLite by default. It's also possible to use PostgreSQL.
settings = {
homeserver = {
address = "https://sealight.xyz";
domain = "sealight.xyz";
};
appservice = {
provisioning.enabled = false;
id = "telegram";
bot_username = "telegrambridge";
public = {
enabled = false;
prefix = "/public";
external = "https://chat.sealight.xyz/public";
};
address = "http://localhost:18787";
port = 18787;
# The service uses SQLite by default, but it's also possible to use PostgreSQL instead:
#database = "postgresql:///mautrix-telegram?host=/run/postgresql";
};
bridge = {
relaybot.authless_portals = false;
permissions = {
"@aynish:sealight.xyz" = "admin";
};
};
};
};
# services.heisenbridge = {
# enable = true;
# homeserver = "https://sealight.xyz";
# listenPort = 14456;
# appServiceToken = "wyujLh8kjpmk2bfKeEE3sZ2gWOEUBKK5";
# homeserverToken = "yEHs7lthD2ZHUibJOAv1APaFhEjxN5PT";
# };
# environment.systemPackages = with pkgs; [ matrix-appservice-slack ];
#services.mx-puppet-slack= {
#enable = false;
#settings = {
# bridge = {
# bindAddress = "localhost";
# port = 16786;
# domain = "sealight.xyz";
# homeserverUrl = "https://sealight.xyz";
# };
# provisioning = {
# whitelist = [ "@aynish:sealight.xyz" ];
# };
# relay = {
# whitelist = [ "@aynish:sealight.xyz" ];
# };
# namePatterns = {
# group = ":name";
# room = ":name[:team? - :team,]";
# user = ":name (Slack)";
# userOverride = ":displayname";
# };
# presence = {
# enabled = false;
# };
# oauth = {
# enabled = false;
# };
#};
#serviceDependencies = ["matrix-synapse.service"];
#};
# services.mautrix-whatsapp = {
# enable = false;
# The appservice is pre-configured to use SQLite by default. It's also possible to use PostgreSQL.
#configOptions = {
# homeserver = {
# address = "https://chat.sealight.xyz";
# domain = "sealight.xyz";
# };
# appservice = {
# id = "whatsapp";
# address = http://localhost:9897;
# hostname = "0.0.0.0";
# port = 9897;
# database = {
# type = "sqlite3";
# uri = "/var/lib/mautrix-whatsapp/mautrix-whatsapp.db";
# };
# state_store_path = "/var/lib/mautrix-whatsapp/mx-state.json";
# bot = {
# username = "whatsappbot";
# displayname = "WhatsApp bridge bot";
# avatar = "mxc://maunium.net/NeXNQarUbrlYBiPCpprYsRqr";
# };
# as_token = "";
# hs_token = "";
# };
# bridge = {
# username_template = "whatsapp_{{.}}";
# displayname_template = "{{if .Notify}}{{.Notify}}{{else}}{{.Jid}}{{end}} (WA)";
# command_prefix = "!wa";
# permissions = {
# "@aynish:sealight.xyz" = 100;
# };
# };
# logging = {
# directory = "/var/lib/mautrix-whatsapp/logs";
# file_name_format = "{{.Date}}-{{.Index}}.log";
# file_date_format = "\"2006-01-02\"";
# file_mode = 384;
# timestamp_format = "Jan _2, 2006 15:04:05";
# print_level = "debug";
# };
# metrics = {
# enabled = true;
# listen = "http://localhost:5070";
# };
#};
# };
#services.mx-puppet-discord = {
# enable = true;
# settings = {
# bridge = {
# bindAddress = "localhost";
# port = 16785;
# domain = "sealight.xyz";
# homeserverUrl = "https://sealight.xyz";
# avatarUrl = "https://discord.com/assets/2d20a45d79110dc5bf947137e9d99b66.svg";
# };
# provisioning = {
# whitelist = [ "@aynish:sealight.xyz" ];
# };
# relay = {
# whitelist = [ "@aynish:sealight.xyz" ];
# };
# namePatterns = {
# group = ":name";
# room = ":name";
# user = ":name (Discord)";
# userOverride = ":displayname";
# };
# presence = {
# enabled = false;
# };
# };
# serviceDependencies = [ "matrix-synapse.service" ];
#};
}

154
profiles/matrix/matrix-slack.nix Normal file
View file

@ -0,0 +1,154 @@
{ config, pkgs, lib, ... }:
with lib;
let
dataDir = "/var/lib/matrix-appservice-slack";
registrationFile = "${dataDir}/slack-registration.yaml";
#appDir = "${pkgs.matrix-appservice-slack}/${pkgs.matrix-appservice-slack.passthru.nodeAppDir}";
cfg = config.services.matrix-appservice-slack;
# TODO: switch to configGen.json once RFC42 is implemented
settingsFile = pkgs.writeText "matrix-appservice-slack-settings.json" (builtins.toJSON cfg.settings);
in
{
options = {
services.matrix-appservice-slack = {
enable = mkEnableOption "a bridge between Matrix and Slack";
settings = mkOption rec {
# TODO: switch to types.config.json as prescribed by RFC42 once it's implemented
type = types.attrs;
apply = recursiveUpdate default;
default = {
# empty values necessary for registration file generation
# actual values defined in environmentFile
auth = {
clientID = "";
botToken = "";
};
};
example = literalExample ''
{
bridge = {
domain = "public-domain.tld";
homeserverUrl = "http://public-domain.tld:8008";
};
}
'';
description = ''
<filename>config.yaml</filename> configuration as a Nix attribute set.
</para>
<para>
Configuration options should match those described in
<link xlink:href="https://github.com/Half-Shot/matrix-appservice-discord/blob/master/config/config.sample.yaml">
config.sample.yaml</link>.
</para>
<para>
<option>config.bridge.domain</option> and <option>config.bridge.homeserverUrl</option>
should be set to match the public host name of the Matrix homeserver for webhooks and avatars to work.
</para>
<para>
Secret tokens should be specified using <option>environmentFile</option>
instead of this world-readable attribute set.
'';
};
environmentFile = mkOption {
type = types.nullOr types.path;
default = null;
description = ''
File containing environment variables to be passed to the matrix-appservice-discord service,
in which secret tokens can be specified securely by defining values for
<literal>APPSERVICE_SLACK_AUTH_CLIENT_I_D</literal> and
<literal>APPSERVICE_SLACK_AUTH_BOT_TOKEN</literal>.
'';
};
url = mkOption {
type = types.str;
default = "http://localhost:${toString cfg.port}";
description = ''
The URL where the application service is listening for HS requests.
'';
};
port = mkOption {
type = types.port;
default = 9898; # from https://github.com/matrix-org/matrix-appservice-slack/blob/develop/config/config.sample.yaml#L70
description = ''
Port number on which the bridge should listen for internal communication with the Matrix homeserver.
'';
};
localpart = mkOption {
type = with types; nullOr str;
default = null;
description = ''
The user_id localpart to assign to the AS.
'';
};
serviceDependencies = mkOption {
type = with types; listOf str;
default = optional config.services.matrix-synapse.enable "matrix-synapse.service";
description = ''
List of Systemd services to require and wait for when starting the application service,
such as the Matrix homeserver if it's running on the same host.
'';
};
};
};
config = mkIf cfg.enable {
systemd.services.matrix-appservice-slack = {
description = "A bridge between Matrix and Slack.";
wantedBy = [ "multi-user.target" ];
wants = [ "network-online.target" ] ++ cfg.serviceDependencies;
after = [ "network-online.target" ] ++ cfg.serviceDependencies;
preStart = ''
if [ ! -f '${registrationFile}' ]; then
${pkgs.matrix-appservice-slack}/bin/matrix-appservice-slack \
--generate-registration \
--url=${escapeShellArg cfg.url} \
${optionalString (cfg.localpart != null) "--localpart=${escapeShellArg cfg.localpart}"} \
--config='${settingsFile}' \
--file='${registrationFile}'
fi
'';
serviceConfig = {
Type = "simple";
Restart = "always";
ProtectSystem = "strict";
ProtectHome = true;
ProtectKernelTunables = true;
ProtectKernelModules = true;
ProtectControlGroups = true;
DynamicUser = true;
PrivateTmp = true;
#WorkingDirectory = appDir;
StateDirectory = baseNameOf dataDir;
UMask = 0027;
EnvironmentFile = cfg.environmentFile;
ExecStart = ''
${pkgs.matrix-appservice-slack}/bin/matrix-appservice-slack \
--file='${registrationFile}' \
--config='${settingsFile}' \
--port='${toString cfg.port}'
'';
};
};
};
meta.maintainers = with maintainers; [ chickensoupandrice ];
}

97
profiles/matrix/mautrix-whatsapp.nix Normal file
View file

@ -0,0 +1,97 @@
{ lib, config, pkgs, ... }:
with lib;
let
cfg = config.services.mautrix-whatsapp;
configFile = pkgs.runCommand "mautrix-whatsapp"
{
buildInputs = [ pkgs.mautrix-whatsapp pkgs.remarshal ];
preferLocalBuild = true;
} ''
mkdir -p $out
${pkgs.remarshal}/bin/json2yaml -i ${pkgs.writeText "config.json" (builtins.toJSON cfg.configOptions)} \
-o $out/config.yaml
${pkgs.mautrix-whatsapp}/bin/mautrix-whatsapp -c $out/config.yaml -g -r $out/registration.yaml
'';
in
{
options.services.mautrix-whatsapp = {
enable = mkEnableOption "Mautrix-whatsapp, a puppeting bridge between Matrix and WhatsApp.";
configOptions = mkOption {
type = types.attrs;
description = ''
This options will be transform in YAML configuration file for the bridge
Look <link xlink:href="https://github.com/tulir/mautrix-whatsapp/wiki/Bridge-setup">here</link> for documentation.
'';
example = {
configOptions = {
homeserver = {
address = https://matrix.org;
domain = "matrix.org";
};
appservice = {
address = http://localhost:8080;
hostname = "0.0.0.0";
port = 8080;
database = {
type = "sqlite3";
uri = "/var/lib/mautrix-whatsapp/mautrix-whatsapp.db";
};
state_store_path = "/var/lib/mautrix-whatsapp/mx-state.json";
id = "whatsapp";
bot = {
username = "whatsappbot";
displayname = "WhatsApp bridge bot";
avatar = "mxc://maunium.net/NeXNQarUbrlYBiPCpprYsRqr";
};
as_token = "";
hs_token = "";
};
bridge = {
username_template = "whatsapp_{{.}}";
displayname_template = "{{if .Notify}}{{.Notify}}{{else}}{{.Jid}}{{end}} (WA)";
command_prefix = "!wa";
permissions = {
"@example:matrix.org" = 100;
};
};
logging = {
directory = "/var/lib/mautrix-whatsapp/logs";
file_name_format = "{{.Date}}-{{.Index}}.log";
file_date_format = "\"2006-01-02\"";
file_mode = 384;
timestamp_format = "Jan _2, 2006 15:04:05";
print_level = "debug";
};
};
};
};
};
config = mkIf cfg.enable {
systemd.services.mautrix-whatsapp = {
description = "Mautrix-WhatsApp Service - A WhatsApp bridge for Matrix";
after = [ "network.target" "matrix-synapse.service" ];
wantedBy = [ "multi-user.target" ];
serviceConfig = {
DynamicUser = true;
StateDirectory = "mautrix-whatsapp";
LoggingDir = "mautrix-whatsapp";
ExecStart = ''
${pkgs.mautrix-whatsapp}/bin/mautrix-whatsapp -c "${configFile}/config.yaml"
'';
Restart = "on-failure";
};
};
#services.matrix-synapse.app_service_config_files = [ "${configFile}/registration.yaml" ];
};
}

Some files were not shown because too many files have changed in this diff Show more