aynish/helm
1
0
Fork 0
Code Pull requests Packages Projects Releases Activity

add mast route to box

Browse source
This commit is contained in:
Anish Lakhwara 2024-10-25 16:15:05 -07:00
parent 3c3236cd2d
commit 8d2f747337
4 changed files with 94 additions and 87 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

132
flake.nix
View file

@ -27,7 +27,8 @@
poonam.url = "git+ssh://gitea@git.sealight.xyz/aynish/kitaab?ref=main"; poonam.url = "git+ssh://gitea@git.sealight.xyz/aynish/kitaab?ref=main";
poonam.inputs.nixpkgs.follows = "nixpkgs"; poonam.inputs.nixpkgs.follows = "nixpkgs";
basant.url = "git+ssh://gitea@git.sealight.xyz/aynish/basant?ref=main"; basant.url = "git+ssh://gitea@git.sealight.xyz/aynish/basant?ref=main";
vimwikicli.url = "git+ssh://gitea@git.sealight.xyz/aynish/vimwiki-cli?ref=main"; vimwikicli.url =
"git+ssh://gitea@git.sealight.xyz/aynish/vimwiki-cli?ref=main";
basant.inputs.nixpkgs.follows = "nixpkgs"; basant.inputs.nixpkgs.follows = "nixpkgs";
basant.inputs.poonam.follows = "poonam"; basant.inputs.poonam.follows = "poonam";
vimwikicli.inputs.nixpkgs.follows = "nixpkgs"; vimwikicli.inputs.nixpkgs.follows = "nixpkgs";
@ -54,24 +55,9 @@
# muneem.inputs.nixpkgs.follows = "nixpkgs"; # muneem.inputs.nixpkgs.follows = "nixpkgs";
}; };
outputs = outputs = { self, nixpkgs, unstable, nixos-hardware, home-manager, deploy-rs
{ self , agenix, disko, basant, grasp, nix-matrix-appservices, nur, tidalcycles
, nixpkgs , rust-overlay, vimwikicli, ... }@inputs:
, unstable
, nixos-hardware
, home-manager
, deploy-rs
, agenix
, disko
, basant
, grasp
, nix-matrix-appservices
, nur
, tidalcycles
, rust-overlay
, vimwikicli
, ...
}@inputs:
let let
forAllSystems = nixpkgs.lib.genAttrs [ forAllSystems = nixpkgs.lib.genAttrs [
"aarch64-linux" "aarch64-linux"
@ -89,59 +75,59 @@
vimwiki-cli = vimwikicli.packages.${prev.system}.vimwiki-cli; vimwiki-cli = vimwikicli.packages.${prev.system}.vimwiki-cli;
}; };
nixpkgsFor = forAllSystems (system: import nixpkgs { nixpkgsFor = forAllSystems (system:
inherit system; import nixpkgs {
config.allowUnfreePredicate = pkg: builtins.elem (nixpkgs.lib.getName pkg) [ inherit system;
"ripcord" config.allowUnfreePredicate = pkg:
"vcv-rack" builtins.elem (nixpkgs.lib.getName pkg) [
"SunVox" "ripcord"
"renoise" "vcv-rack"
]; "SunVox"
# config.permittedInsecurePackages = [ "renoise"
# "python3.10-django-3.1.14" # Needed for archivebox deployments on curve ];
# # Check when archive box updates it's dependeny # config.permittedInsecurePackages = [
# ]; # "python3.10-django-3.1.14" # Needed for archivebox deployments on curve
overlays = [ # # Check when archive box updates it's dependeny
rust-overlay.overlays.default # ];
tidalcycles.overlays.default overlays = [
agenix.overlays.default rust-overlay.overlays.default
nur.overlay tidalcycles.overlays.default
nix-matrix-appservices.overlay agenix.overlays.default
unstableOverlay nur.overlay
vimwikiOverlay nix-matrix-appservices.overlay
self.overlays.additions unstableOverlay
self.overlays.modifications vimwikiOverlay
]; self.overlays.additions
}); self.overlays.modifications
];
});
# for when space matters # for when space matters
litePkgsFor = forAllSystems (system: import nixpkgs { litePkgsFor = forAllSystems (system:
inherit system; import nixpkgs {
# config.permittedInsecurePackages = [ inherit system;
# "forgejo-1.19.4-0" # Needed for archivebox deployments on curve # config.permittedInsecurePackages = [
# # Check when archive box updates it's dependeny # "forgejo-1.19.4-0" # Needed for archivebox deployments on curve
# ]; # # Check when archive box updates it's dependeny
overlays = [ # ];
agenix.overlays.default overlays = [
self.overlays.additions agenix.overlays.default
self.overlays.modifications self.overlays.additions
tidalcycles.overlays.default # needed for nvim which comes pre-installed lol self.overlays.modifications
]; tidalcycles.overlays.default # needed for nvim which comes pre-installed lol
}); ];
in });
{ in {
# Your custom packages # Your custom packages
# Acessible through 'nix build', 'nix shell', etc # Acessible through 'nix build', 'nix shell', etc
packages = forAllSystems (system: packages = forAllSystems (system:
let pkgs = nixpkgsFor.${system}; let pkgs = nixpkgsFor.${system};
in import ./pkgs { pkgs = pkgs; } in import ./pkgs { pkgs = pkgs; });
);
# Devshell for bootstrapping # Devshell for bootstrapping
# Acessible through 'nix develop' or 'nix-shell' (legacy) # Acessible through 'nix develop' or 'nix-shell' (legacy)
devShells = forAllSystems (system: devShells = forAllSystems (system:
let pkgs = nixpkgsFor.${system}; let pkgs = nixpkgsFor.${system};
in import ./shell.nix { pkgs = pkgs; } in import ./shell.nix { pkgs = pkgs; });
);
# Your custom packages and modifications, exported as overlays # Your custom packages and modifications, exported as overlays
overlays = import ./overlays; overlays = import ./overlays;
@ -233,7 +219,7 @@
nix.registry.nixpkgs.flake = nixpkgs; nix.registry.nixpkgs.flake = nixpkgs;
home-manager.useGlobalPkgs = true; home-manager.useGlobalPkgs = true;
home-manager.useUserPackages = true; home-manager.useUserPackages = true;
home-manager.users.anish = import ./home/core; home-manager.users.anish = import ./home/dev;
} }
]; ];
}; };
@ -243,12 +229,10 @@
# Available through 'home-manager --flake .#your-username@your-hostname' # Available through 'home-manager --flake .#your-username@your-hostname'
homeConfigurations = { homeConfigurations = {
"anish@work" = home-manager.lib.homeManagerConfiguration { "anish@work" = home-manager.lib.homeManagerConfiguration {
pkgs = nixpkgsFor."x86_64-linux"; # Home-manager requires 'pkgs' instance pkgs =
nixpkgsFor."x86_64-linux"; # Home-manager requires 'pkgs' instance
extraSpecialArgs = { inherit inputs; }; extraSpecialArgs = { inherit inputs; };
modules = [ modules = [ ./home/core.nix ./home/profiles/firefox ];
./home/core.nix
./home/profiles/firefox
];
}; };
}; };
@ -260,7 +244,8 @@
remoteBuild = true; remoteBuild = true;
profiles.system = { profiles.system = {
user = "root"; user = "root";
path = deploy-rs.lib.x86_64-linux.activate.nixos self.nixosConfigurations.box; path = deploy-rs.lib.x86_64-linux.activate.nixos
self.nixosConfigurations.box;
}; };
}; };
lituus = { lituus = {
@ -268,7 +253,8 @@
# autoRollback = false; # autoRollback = false;
profiles.system = { profiles.system = {
user = "root"; user = "root";
path = deploy-rs.lib.x86_64-linux.activate.nixos self.nixosConfigurations.lituus; path = deploy-rs.lib.x86_64-linux.activate.nixos
self.nixosConfigurations.lituus;
}; };
}; };
helix = { helix = {
@ -277,11 +263,13 @@
magicRollback = false; magicRollback = false;
profiles.system = { profiles.system = {
user = "root"; user = "root";
path = deploy-rs.lib.x86_64-linux.activate.nixos self.nixosConfigurations.helix; path = deploy-rs.lib.x86_64-linux.activate.nixos
self.nixosConfigurations.helix;
}; };
}; };
}; };
checks = builtins.mapAttrs (system: deployLib: deployLib.deployChecks self.deploy) deploy-rs.lib; checks = builtins.mapAttrs
(system: deployLib: deployLib.deployChecks self.deploy) deploy-rs.lib;
}; };
} }

5
home/dev/default.nix Normal file
View file

@ -0,0 +1,5 @@
{ self, pkgs, ... }: {
imports =
[ ../profiles/cli ../profiles/nvim ../profiles/direnv ../profiles/git ];
home.stateVersion = "22.05";
}

15
hosts/box/default.nix
View file

@ -1,5 +1,4 @@
{ self, pkgs, ... }: { self, pkgs, ... }: {
{
imports = [ imports = [
./configuration.nix ./configuration.nix
../profiles/core ../profiles/core
@ -72,6 +71,18 @@
}; };
}; };
services.nginx.virtualHosts."mast.mossnet.lan" = {
enableACME = false;
forceSSL = false;
locations."/" = {
extraConfig = ''
proxy_pass http://localhost:5731/;
proxy_set_header X-Forwarded-Host $host;
'';
};
};
age.secrets.box-wg.file = "${self}/secrets/box-wg.age"; age.secrets.box-wg.file = "${self}/secrets/box-wg.age";
age.secrets.box-wg.owner = "anish"; age.secrets.box-wg.owner = "anish";
age.secrets.borg-key.file = "${self}/secrets/borg-key.age"; age.secrets.borg-key.file = "${self}/secrets/borg-key.age";

27
hosts/profiles/dns/default.nix
View file

@ -3,13 +3,12 @@ let
adblockLocalZones = pkgs.stdenv.mkDerivation { adblockLocalZones = pkgs.stdenv.mkDerivation {
name = "unbound-zones-adblock"; name = "unbound-zones-adblock";
src = (pkgs.fetchFromGitHub src = (pkgs.fetchFromGitHub {
{ owner = "StevenBlack";
owner = "StevenBlack"; repo = "hosts";
repo = "hosts"; rev = "3.12.21";
rev = "3.12.21"; sha256 = "Yzr6PY/zqQE+AHH0J6ioHTsgkikM+dz4aelbGpQJa1s=";
sha256 = "Yzr6PY/zqQE+AHH0J6ioHTsgkikM+dz4aelbGpQJa1s="; } + "/hosts");
} + "/hosts");
phases = [ "installPhase" ]; phases = [ "installPhase" ];
@ -19,7 +18,7 @@ let
}; };
mossnet = "192.168.1.240"; # The local lan-ip for box mossnet = "192.168.1.240"; # The local lan-ip for box
wg-mossnet = "10.0.69.4"; # The wireguard ip for box wg-mossnet = "10.0.69.4"; # The wireguard ip for box
mossnet-hosts = [ mossnet-hosts = [
"mossnet.lan" "mossnet.lan"
"headphones.mossnet.lan" "headphones.mossnet.lan"
@ -40,10 +39,10 @@ let
"grasp.mossnet.lan" "grasp.mossnet.lan"
"photos.mossnet.lan" "photos.mossnet.lan"
"pod.mossnet.lan" "pod.mossnet.lan"
"mast.mossnet.lan"
]; ];
in in {
{
services.unbound = { services.unbound = {
enable = true; enable = true;
settings = { settings = {
@ -55,7 +54,8 @@ in
cache-min-ttl = 0; cache-min-ttl = 0;
serve-expired = "yes"; serve-expired = "yes";
interface = [ "0.0.0.0" ]; interface = [ "0.0.0.0" ];
access-control = [ "127.0.0.0/8 allow" "192.168.1.0/24 allow" "10.0.69.0/24 allow" ]; access-control =
[ "127.0.0.0/8 allow" "192.168.1.0/24 allow" "10.0.69.0/24 allow" ];
access-control-view = "10.0.69.0/24 wireguard"; access-control-view = "10.0.69.0/24 wireguard";
# so-reuseport = "yes"; # so-reuseport = "yes";
tls-upstream = "yes"; tls-upstream = "yes";
@ -65,7 +65,10 @@ in
}; };
forward-zone = [{ forward-zone = [{
name = "."; name = ".";
forward-addr = [ "45.90.28.0#6939b9.dns.nextdns.io" "1.1.1.1@853#cloudflare-dns.com" ]; forward-addr = [
"45.90.28.0#6939b9.dns.nextdns.io"
"1.1.1.1@853#cloudflare-dns.com"
];
# non-tls # non-tls
# forward-addr = ["45.90.30.49" "45.90.28.49" "1.1.1.1" "8.8.8.8"] # forward-addr = ["45.90.30.49" "45.90.28.49" "1.1.1.1" "8.8.8.8"]
}]; }];