lituus up to date

flake.lock

@@ -557,11 +557,11 @@
     },
     "nixos": {
       "locked": {
-        "lastModified": 1663433994,
-        "narHash": "sha256-Bpthhv1PdZRrIFct8KbHACNvOu9bsYAMEaqoH83cvqM=",
+        "lastModified": 1664594436,
+        "narHash": "sha256-YHowMADGzdi7fKnGlg47qe0PIljq+11VqLarmXDuKxQ=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "17989edb05615c4f61803b9c427d80b84c289c6b",
+        "rev": "9cac45850280978a21a3eb67b15a18f34cbffa2d",
         "type": "github"
       },
       "original": {

flake.nix

@@ -149,7 +149,7 @@
             suites = with profiles; rec {
               base = [ core users.root users.anish ];
               sealight = [ base server metrics gitea rss-bridge mount-mossnet ]; # matrix 
-              lituus = [ base server metrics sealight-website matrix ];
+              lituus = [ base server metrics sealight-website matrix wireguard-server ];
               mossnet = [ base server taskd shaarli dns monitoring nfs gonic headphones radicale seafile syncthing dhyan calibre wallabag finance ]; # hpi sync.music 
               cube = [ base site server ];
               graphical = [ base bluetooth music sync.kitaab sync.website sync.cal wifi desktop mimetypes ];
@@ -173,7 +173,7 @@
           };
           users = {
             nixos = { suites, ... }: { imports = suites.hmBase; };
-            anish = { suites, ... }: { imports = suites.gui; };
+            # anish = { suites, ... }: { imports = suites.gui; };
             anishlakhwara = { suites, ... }: { imports = suites.work; };
           }; # digga.lib.importers.rakeLeaves ./users/hm;
         };

hosts/lituus/hardware-configuration.nix

@@ -1,12 +1,12 @@
 # Do not modify this file!  It was generated by ‘nixos-generate-config’
 # and may be overwritten by future invocations.  Please make changes
 # to /etc/nixos/configuration.nix instead.
-{ config, lib, pkgs, ... }:
+{ config, lib, pkgs, modulesPath, ... }:
 
 {
   imports =
     [
-      <nixpkgs/nixos/modules/profiles/qemu-guest.nix>
+      (modulesPath + "/profiles/qemu-guest.nix")
     ];
 
   boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "sr_mod" "virtio_blk" ];

modules/heisenbridge.nix

@@ -74,7 +74,7 @@ in
   config = mkIf cfg.enable {
     meta.maintainers = [ maintainers.sumnerevans ];
 
-    services.matrix-synapse.app_service_config_files = [
+    services.matrix-synapse.settings.app_service_config_files = [
       heisenbridgeConfigYaml
     ];
 

profiles/desktop/default.nix

@@ -28,6 +28,8 @@ in
     };
   };
 
+  security.pam.services.Default.enableGnomeKeyring = true;
+  security.pam.services.Login.enableGnomeKeyring = true;
   security.pam.services.sddm.enableGnomeKeyring = true;
 
   environment.sessionVariables = rec {
@@ -58,6 +60,7 @@ in
     zathura
     calibre
     nheko
+    fractal
     mpv
     newsflash
     zeal

profiles/matrix/default.nix

@@ -30,7 +30,7 @@
         #   The registration file is automatically generated after starting the appservice for the first time.
         #   cp /var/lib/matrix-appservice-discord/discord-registration.yaml /var/lib/matrix-synapse/
         #   chown matrix-synapse:matrix-synapse /var/lib/matrix-synapse/discord-registration.yaml
-        # "/var/lib/matrix-synapse/telegram-registration.yaml"
+        "/var/lib/matrix-synapse/telegram-registration.yaml"
         # "/var/lib/matrix-synapse/slack-registration.yaml"
         # "/var/lib/matrix-synapse/discord-registration.yaml"
         # "/var/lib/matrix-synapse/whatsapp-registration.yaml"
@@ -107,6 +107,7 @@
 
   services.postgresql = {
     enable = true;
+    package = pkgs.postgresql_14;
     ## postgresql user and db name remains in the
     ## service.matrix-synapse.database_args setting which
     ## by default is matrix-synapse
@@ -223,7 +224,7 @@
   };
 
   services.mautrix-telegram = {
-    enable = false;
+    enable = true;
     environmentFile = /etc/secrets/telegram.env; # file containing the appservice and telegram tokens
     # The appservice is pre-configured to use SQLite by default. It's also possible to use PostgreSQL.
     settings = {

profiles/postgres_upgrade_script/default.nix

@@ -0,0 +1,31 @@
+{ config, pkgs, ... }:
+{
+  environment.systemPackages = [
+    (pkgs.writeScriptBin "upgrade-pg-cluster" ''
+      set -eux
+      # TODO it's perhaps advisable to stop all services that depend on postgresql
+      systemctl stop postgresql
+
+      # TODO replace `<new version>` with the psqlSchema here
+      # The schema can be found by running:
+      # nix-instantiate '<nixpkgs>' --eval -A postgresql_14.psqlSchema
+      export NEWDATA="/var/lib/postgresql/<new version>"
+
+      # TODO specify the postgresql package you'd like to upgrade to
+      export NEWBIN="${pkgs.postgresql_14}/bin"
+
+      export OLDDATA="${config.services.postgresql.dataDir}"
+      export OLDBIN="${config.services.postgresql.package}/bin"
+
+      install -d -m 0700 -o postgres -g postgres "$NEWDATA"
+      cd "$NEWDATA"
+      sudo -u postgres $NEWBIN/initdb -D "$NEWDATA"
+
+      sudo -u postgres $NEWBIN/pg_upgrade \
+        --old-datadir "$OLDDATA" --new-datadir "$NEWDATA" \
+        --old-bindir $OLDBIN --new-bindir $NEWBIN \
+        "$@"
+    '')
+  ];
+}
+

profiles/server/default.nix

@@ -10,4 +10,13 @@
 
   security.acme.defaults.email = "anish+acme@lakhwara.com";
   security.acme.acceptTerms = true;
+
+  services.fail2ban = {
+    enable = true;
+    maxretry = 5;
+    ignoreIP = [
+      "127.0.0.0/8"
+      "10.0.0.0/8"
+    ];
+  };
 }

profiles/wireguard-server/default.nix

@@ -13,7 +13,7 @@
   networking.wireguard.interfaces.wg0 = {
     ips = [ "10.0.69.1/24" ];
     listenPort = 60990;
-    privateKeyFile = "/var/lib/wireguard/private";
+    privateKeyFile = "/var/lib/wireguard/priv";
     generatePrivateKeyFile = true; # TODO agenix secret
     peers = [
       {

users/profiles/cli/default.nix

@@ -57,6 +57,18 @@
     #ssb-patchwork
     fontconfig
     pandoc
+    (pkgs.writeScriptBin "jq-repl" ''
+      #!/usr/bin/env bash
+      if [[ -z $1 ]] || [[ $1 == "-" ]] then 
+        input=$(mktemp)
+        trap "rm -f $input" EXIT
+        cat /dev/stdin > $input
+      else
+        input=$1
+      fi
+
+      echo "" \ | fzf --phony --preview-window="up:90%" --print-query --preview "jq --color-output -r {q} $input"
+    '')
   ];
 
   programs.zsh = {
@@ -183,11 +195,12 @@
     # task warrior
     # TODO: make blocked a context?
     t = "task -BLOCKED";
+    tin = "task +in";
     tun = "task -BLOCKED -wait";
     tr = "task newest limit:page";
     tu = "task unblocked -wait";
     tl = "task list";
-    ta = "task add";
+    ta = "task add +in";
     tn = "task-note";
     tm = "task limit:page";
     te = "task edit";

users/profiles/task/taskrc

@@ -47,7 +47,10 @@ report._reviewed.sort=reviewed+,modified+
 report._reviewed.filter=( reviewed.none: or reviewed.before:now-6days ) and ( +PENDING or +WAITING )
 report.list.columns=id,priority,project,tags,recur.indicator,scheduled.countdown,due,until.remaining,description.count
 report.list.labels=ID,P,Project,Tags,R,Sch,Due,Until,Description
-report.in.columns = id,description report.in.description = Inbox report.in.filter = status:pending limit:page (+in) report.in.labels = ID,Description 
+report.in.columns=id,description 
+report.in.description=Inbox
+report.in.filter=status:pending limit:page (+in)
+report.in.labels=ID,Description 
 urgency.user.project.wait.coefficient=-10.0
 urgency.user.project.craft.coefficient=1.9
 urgency.user.project.chores.coefficient=0.8