From 9ac75ad03cd70a78c48f93db96b06962aa04696b Mon Sep 17 00:00:00 2001 From: Anish Lakhwara Date: Mon, 3 Oct 2022 23:59:21 +1000 Subject: [PATCH] lituus up to date --- flake.lock | 6 ++-- flake.nix | 4 +-- hosts/lituus/hardware-configuration.nix | 4 +-- modules/heisenbridge.nix | 2 +- profiles/desktop/default.nix | 3 ++ profiles/matrix/default.nix | 5 ++-- profiles/postgres_upgrade_script/default.nix | 31 ++++++++++++++++++++ profiles/server/default.nix | 9 ++++++ profiles/wireguard-server/default.nix | 2 +- users/profiles/cli/default.nix | 15 +++++++++- users/profiles/task/taskrc | 5 +++- 11 files changed, 73 insertions(+), 13 deletions(-) create mode 100644 profiles/postgres_upgrade_script/default.nix diff --git a/flake.lock b/flake.lock index ce5413c9..53e4afec 100644 --- a/flake.lock +++ b/flake.lock @@ -557,11 +557,11 @@ }, "nixos": { "locked": { - "lastModified": 1663433994, - "narHash": "sha256-Bpthhv1PdZRrIFct8KbHACNvOu9bsYAMEaqoH83cvqM=", + "lastModified": 1664594436, + "narHash": "sha256-YHowMADGzdi7fKnGlg47qe0PIljq+11VqLarmXDuKxQ=", "owner": "nixos", "repo": "nixpkgs", - "rev": "17989edb05615c4f61803b9c427d80b84c289c6b", + "rev": "9cac45850280978a21a3eb67b15a18f34cbffa2d", "type": "github" }, "original": { diff --git a/flake.nix b/flake.nix index 6246cd7b..ec0da331 100644 --- a/flake.nix +++ b/flake.nix @@ -149,7 +149,7 @@ suites = with profiles; rec { base = [ core users.root users.anish ]; sealight = [ base server metrics gitea rss-bridge mount-mossnet ]; # matrix - lituus = [ base server metrics sealight-website matrix ]; + lituus = [ base server metrics sealight-website matrix wireguard-server ]; mossnet = [ base server taskd shaarli dns monitoring nfs gonic headphones radicale seafile syncthing dhyan calibre wallabag finance ]; # hpi sync.music cube = [ base site server ]; graphical = [ base bluetooth music sync.kitaab sync.website sync.cal wifi desktop mimetypes ]; @@ -173,7 +173,7 @@ }; users = { nixos = { suites, ... }: { imports = suites.hmBase; }; - anish = { suites, ... }: { imports = suites.gui; }; + # anish = { suites, ... }: { imports = suites.gui; }; anishlakhwara = { suites, ... }: { imports = suites.work; }; }; # digga.lib.importers.rakeLeaves ./users/hm; }; diff --git a/hosts/lituus/hardware-configuration.nix b/hosts/lituus/hardware-configuration.nix index 403ff39d..172bf7cc 100644 --- a/hosts/lituus/hardware-configuration.nix +++ b/hosts/lituus/hardware-configuration.nix @@ -1,12 +1,12 @@ # Do not modify this file! It was generated by ‘nixos-generate-config’ # and may be overwritten by future invocations. Please make changes # to /etc/nixos/configuration.nix instead. -{ config, lib, pkgs, ... }: +{ config, lib, pkgs, modulesPath, ... }: { imports = [ - + (modulesPath + "/profiles/qemu-guest.nix") ]; boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "sr_mod" "virtio_blk" ]; diff --git a/modules/heisenbridge.nix b/modules/heisenbridge.nix index 6f4e1d6b..005679db 100644 --- a/modules/heisenbridge.nix +++ b/modules/heisenbridge.nix @@ -74,7 +74,7 @@ in config = mkIf cfg.enable { meta.maintainers = [ maintainers.sumnerevans ]; - services.matrix-synapse.app_service_config_files = [ + services.matrix-synapse.settings.app_service_config_files = [ heisenbridgeConfigYaml ]; diff --git a/profiles/desktop/default.nix b/profiles/desktop/default.nix index bf3ab557..7e5e5408 100644 --- a/profiles/desktop/default.nix +++ b/profiles/desktop/default.nix @@ -28,6 +28,8 @@ in }; }; + security.pam.services.Default.enableGnomeKeyring = true; + security.pam.services.Login.enableGnomeKeyring = true; security.pam.services.sddm.enableGnomeKeyring = true; environment.sessionVariables = rec { @@ -58,6 +60,7 @@ in zathura calibre nheko + fractal mpv newsflash zeal diff --git a/profiles/matrix/default.nix b/profiles/matrix/default.nix index e4e7578f..72c21f4f 100644 --- a/profiles/matrix/default.nix +++ b/profiles/matrix/default.nix @@ -30,7 +30,7 @@ # The registration file is automatically generated after starting the appservice for the first time. # cp /var/lib/matrix-appservice-discord/discord-registration.yaml /var/lib/matrix-synapse/ # chown matrix-synapse:matrix-synapse /var/lib/matrix-synapse/discord-registration.yaml - # "/var/lib/matrix-synapse/telegram-registration.yaml" + "/var/lib/matrix-synapse/telegram-registration.yaml" # "/var/lib/matrix-synapse/slack-registration.yaml" # "/var/lib/matrix-synapse/discord-registration.yaml" # "/var/lib/matrix-synapse/whatsapp-registration.yaml" @@ -107,6 +107,7 @@ services.postgresql = { enable = true; + package = pkgs.postgresql_14; ## postgresql user and db name remains in the ## service.matrix-synapse.database_args setting which ## by default is matrix-synapse @@ -223,7 +224,7 @@ }; services.mautrix-telegram = { - enable = false; + enable = true; environmentFile = /etc/secrets/telegram.env; # file containing the appservice and telegram tokens # The appservice is pre-configured to use SQLite by default. It's also possible to use PostgreSQL. settings = { diff --git a/profiles/postgres_upgrade_script/default.nix b/profiles/postgres_upgrade_script/default.nix new file mode 100644 index 00000000..9442df0d --- /dev/null +++ b/profiles/postgres_upgrade_script/default.nix @@ -0,0 +1,31 @@ +{ config, pkgs, ... }: +{ + environment.systemPackages = [ + (pkgs.writeScriptBin "upgrade-pg-cluster" '' + set -eux + # TODO it's perhaps advisable to stop all services that depend on postgresql + systemctl stop postgresql + + # TODO replace `` with the psqlSchema here + # The schema can be found by running: + # nix-instantiate '' --eval -A postgresql_14.psqlSchema + export NEWDATA="/var/lib/postgresql/" + + # TODO specify the postgresql package you'd like to upgrade to + export NEWBIN="${pkgs.postgresql_14}/bin" + + export OLDDATA="${config.services.postgresql.dataDir}" + export OLDBIN="${config.services.postgresql.package}/bin" + + install -d -m 0700 -o postgres -g postgres "$NEWDATA" + cd "$NEWDATA" + sudo -u postgres $NEWBIN/initdb -D "$NEWDATA" + + sudo -u postgres $NEWBIN/pg_upgrade \ + --old-datadir "$OLDDATA" --new-datadir "$NEWDATA" \ + --old-bindir $OLDBIN --new-bindir $NEWBIN \ + "$@" + '') + ]; +} + diff --git a/profiles/server/default.nix b/profiles/server/default.nix index d3a55dda..30d09753 100644 --- a/profiles/server/default.nix +++ b/profiles/server/default.nix @@ -10,4 +10,13 @@ security.acme.defaults.email = "anish+acme@lakhwara.com"; security.acme.acceptTerms = true; + + services.fail2ban = { + enable = true; + maxretry = 5; + ignoreIP = [ + "127.0.0.0/8" + "10.0.0.0/8" + ]; + }; } diff --git a/profiles/wireguard-server/default.nix b/profiles/wireguard-server/default.nix index a4ef9723..c8809f5e 100644 --- a/profiles/wireguard-server/default.nix +++ b/profiles/wireguard-server/default.nix @@ -13,7 +13,7 @@ networking.wireguard.interfaces.wg0 = { ips = [ "10.0.69.1/24" ]; listenPort = 60990; - privateKeyFile = "/var/lib/wireguard/private"; + privateKeyFile = "/var/lib/wireguard/priv"; generatePrivateKeyFile = true; # TODO agenix secret peers = [ { diff --git a/users/profiles/cli/default.nix b/users/profiles/cli/default.nix index 9ff92a16..124bf39c 100644 --- a/users/profiles/cli/default.nix +++ b/users/profiles/cli/default.nix @@ -57,6 +57,18 @@ #ssb-patchwork fontconfig pandoc + (pkgs.writeScriptBin "jq-repl" '' + #!/usr/bin/env bash + if [[ -z $1 ]] || [[ $1 == "-" ]] then + input=$(mktemp) + trap "rm -f $input" EXIT + cat /dev/stdin > $input + else + input=$1 + fi + + echo "" \ | fzf --phony --preview-window="up:90%" --print-query --preview "jq --color-output -r {q} $input" + '') ]; programs.zsh = { @@ -183,11 +195,12 @@ # task warrior # TODO: make blocked a context? t = "task -BLOCKED"; + tin = "task +in"; tun = "task -BLOCKED -wait"; tr = "task newest limit:page"; tu = "task unblocked -wait"; tl = "task list"; - ta = "task add"; + ta = "task add +in"; tn = "task-note"; tm = "task limit:page"; te = "task edit"; diff --git a/users/profiles/task/taskrc b/users/profiles/task/taskrc index 9f7df55c..f9181132 100644 --- a/users/profiles/task/taskrc +++ b/users/profiles/task/taskrc @@ -47,7 +47,10 @@ report._reviewed.sort=reviewed+,modified+ report._reviewed.filter=( reviewed.none: or reviewed.before:now-6days ) and ( +PENDING or +WAITING ) report.list.columns=id,priority,project,tags,recur.indicator,scheduled.countdown,due,until.remaining,description.count report.list.labels=ID,P,Project,Tags,R,Sch,Due,Until,Description -report.in.columns = id,description report.in.description = Inbox report.in.filter = status:pending limit:page (+in) report.in.labels = ID,Description +report.in.columns=id,description +report.in.description=Inbox +report.in.filter=status:pending limit:page (+in) +report.in.labels=ID,Description urgency.user.project.wait.coefficient=-10.0 urgency.user.project.craft.coefficient=1.9 urgency.user.project.chores.coefficient=0.8