aynish/helm
1
0
Fork 0
Code Pull requests Packages Projects Releases Activity

i can't remember what caused this...

Browse source
This commit is contained in:
Anish Lakhwara 2024-03-15 23:25:49 -07:00
parent f8ec4cfa0f
commit b9fa71a9d3
44 changed files with 2448 additions and 98 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
.direnv/bin/nix-direnv-reload Normal file
View file

@ -0,0 +1,8 @@
#!/usr/bin/env bash
dir="$(realpath $(dirname ${BASH_SOURCE[0]})/../..)"
_nix_direnv_force_reload=1 direnv exec "$dir" true
direnv reload
# direnv reload updates the mtime of .envrc. Also update the timestamp of the
# profile_rc file to keep track that we actually are up to date.
touch $dir/.direnv/{nix,flake}-profile-*.rc

1863
.direnv/flake-profile-a5d5b61aa8a61b7d9d765e1daf971a9a578f1cfa.rc Normal file
View file

File diff suppressed because it is too large Load diff

2
.envrc Normal file
View file

@ -0,0 +1,2 @@
export HE_PASSWORD=SuperDuper
use flake

0
dns/test_nullhex.sh Executable file → Normal file
View file

6
flake.lock
View file

@ -451,11 +451,11 @@
},
"nixpkgs_2": {
"locked": {
"lastModified": 1704874635,
"narHash": "sha256-YWuCrtsty5vVZvu+7BchAxmcYzTMfolSPP5io8+WYCg=",
"lastModified": 1710420202,
"narHash": "sha256-MvFKESbq4rUWuaf2RKPNYENaSZEw/jaCLo2gU6oREcM=",
"owner": "nixos",
"repo": "nixpkgs",
"rev": "3dc440faeee9e889fe2d1b4d25ad0f430d449356",
"rev": "878ef7d9721bee9f81f8a80819f9211ad1f993da",
"type": "github"
},
"original": {

3
flake.nix
View file

@ -1,5 +1,5 @@
{
description = "Your new nix config";
description = "Sealight NixOS Config";
inputs = {
# Nixpkgs
@ -271,6 +271,7 @@
hostname = "mossnet.lan";
autoRollback = false;
magicRollback = false;
remoteBuild = true;
profiles.system = {
user = "root";
path = deploy-rs.lib.x86_64-linux.activate.nixos self.nixosConfigurations.box;

1
home/core/default.nix
View file

@ -1,7 +1,6 @@
{ self, pkgs, ... }:
{
imports = [
../profiles/nvim
../profiles/cli
../profiles/direnv
../profiles/git

1
home/gui/default.nix
View file

@ -2,6 +2,7 @@
{
imports = [
../core
../profiles/nvim
../profiles/firefox
../profiles/desktop
../profiles/email

17
home/profiles/cli/default.nix
View file

@ -26,10 +26,12 @@
iftop
wget
curl
exa
eza
bat
fd
ncdu
du-dust
# dia-cli
duf
trash-cli
nix-index
@ -216,9 +218,9 @@
gen-secret = "< /dev/urandom tr -dc _A-Z-a-z-0-9 | head -c\${1:-32};echo;";
# modern cli tools
ls = "exa --icons";
l = "exa -l --icons";
la = "exa -la --icons";
ls = "eza --icons";
l = "esa -l --icons";
la = "eza -la --icons";
tree = "ls --tree --icons";
cat = "bat";
unzip = "aunpack";
@ -229,14 +231,17 @@
make-secret = "< /dev/urandom \\tr -dc _A-Za-z0-9 | head -c \${1:-32};echo;";
# task warrior
# TODO: make blocked a context?
t = "task -BLOCKED -idea -backlog";
tw = "t rc.context:work";
# TODO find a reasonable way to manage this from a non-nix managed file in ~/.task/context or something
# we can do something like task rc.context:$(cat ~/.task/context) to read context
# and write a little script make-context = cat $@ > ~/.task/context or something
tt = "taskwarrior-tui -r list";
ti = "task +idea";
tb = "task +backlog list";
ttb = "taskwarrior-tui -r backlog";
tr = "task newest limit:page";
tw = "task +wait";
twait = "task +wait";
ta = "task add";
tai = "task add +idea";
tn = "task-note";

0
home/profiles/desktop/Xresources Normal file → Executable file
View file

0
home/profiles/desktop/polybar/run.sh Normal file → Executable file
View file

2
home/profiles/email/default.nix
View file

@ -175,7 +175,7 @@
bind editor ^T complete
# Press A to archive
macro index,pager A "<clear-flag>N<save-message>=/Archive" "mark message as Archived"
macro index,pager A "<clear-flag><save-message>=/Archive" "mark message as Archived"
# Press C to add contact to Khard address book
macro index,pager C \
"<pipe-message>khard add-email<return>" \

2
home/profiles/firefox/default.nix
View file

@ -21,7 +21,7 @@
extensions = with pkgs.nur.repos.rycee.firefox-addons; [
# Find extensions: https://github.com/nix-community/nur-combined/blob/master/repos/rycee/pkgs/firefox-addons/generated-firefox-addons.nix
ublock-origin
wallabagger
# wallabagger
# tree-style-tab
tridactyl
promnesia

6
home/profiles/nvim/default.nix
View file

@ -148,9 +148,9 @@ in
# kitaab zettel
kz = "cd ~/kitaab/vimwiki; vim -c :VimwikiIndex -c :ZettelNew; cd $OLDPWD";
# kitaab recents
kr = "cd /home/anish/kitaab/vimwiki; exa --sort=modified --reverse | fzf --preview 'bat --style=numbers --color=always --terminal-width -1 ./{}';cd $OLDPWD";
kr = "cd /home/anish/kitaab/vimwiki; eza --sort=modified --reverse | fzf --preview 'bat --style=numbers --color=always --terminal-width -1 ./{}';cd $OLDPWD";
# kitaab get by tagged
kt = "cd /home/anish/kitaab/vimwiki; exa *_index.wiki | fzf --preview 'bat --style=numbers --color=always --terminal-width -1 ./{}';cd $OLDPWD";
kt = "cd /home/anish/kitaab/vimwiki; eza *_index.wiki | fzf --preview 'bat --style=numbers --color=always --terminal-width -1 ./{}';cd $OLDPWD";
# List files that have no links in them
ku = "cd /home/anish/kitaab/;vim ./vimwiki/$(python3 poonam/main.py report --titles=false | tail -n +4 | fzf --preview 'bat --style=numbers --color=always --terminal-width -1 ./vimwiki/{}');cd $OLDPWD";
};
@ -804,7 +804,7 @@ in
}
}
-- You gotta run :SCNvimGenerateAssets for this first
require("luasnip").add_snippets("supercollider", require("scnvim/utils").get_snippets())
-- require("luasnip").add_snippets("supercollider", require("scnvim/utils").get_snippets())
-- zen mode
require('zen-mode').setup{

0
home/profiles/task/bin/set-backlog.sh Normal file → Executable file
View file

0
home/profiles/task/bin/set-focus.sh Normal file → Executable file
View file

2
home/profiles/task/default.nix
View file

@ -9,7 +9,7 @@
# this way, we get a copy of the file, and we make sure it's writable
".taskrc".source = ./taskrc;
".taskrc".executable = true;
".taskrc".onChange = "cp ~/.taskrc ~/.taskrc2;rm ~/.taskrc;mv ~/.taskrc2 ~/.taskrc;chmod +w ~/.taskrc";
# ".taskrc".onChange = "cp ~/.taskrc ~/.taskrc2;rm ~/.taskrc;mv ~/.taskrc2 ~/.taskrc;chmod +w ~/.taskrc";
".task/keys/ca.cert".source = ./ca.cert;
".task/keys/public.cert".source = ./public.cert;

5
home/profiles/task/taskrc
View file

@ -82,6 +82,11 @@ report.every.filter=(status:pending limit:0)
report.every.labels=ID,Active,Deps,P,Project,Tag,Recur,S,Due,Until,Description
report.every.columns=id,start.age,depends,priority,project,tags,recur,scheduled.countdown,due.relative,until.remaining,description
report.poms.filter=(status:pending -idea -backlog -BLOCKED)
report.poms.labels=UUID,ID,Project,Tag,Description
report.poms.columns=uuid,id,project,tags,description
report.poms.sort=start+,urgency+
# Urgency
urgency.user.project.wait.coefficient=-10.0
urgency.user.project.craft.coefficient=1.9

5
hosts/box/default.nix
View file

@ -7,7 +7,7 @@
../profiles/taskd
../profiles/shaarli
../profiles/dns
../profiles/monitoring
# ../profiles/monitoring
../profiles/nfs
../profiles/gonic
../profiles/headphones
@ -22,9 +22,10 @@
../profiles/grasp
# ../profiles/archivebox
# ../profiles/woodpecker-agent
../profiles/jellyfin
# ../profiles/jellyfin
../profiles/ulogger-server
../profiles/photoprism
#../profiles/postgres_upgrade_script
];
# Backups

8
hosts/curve/default.nix
View file

@ -20,6 +20,12 @@
# import profiling tools
programs.systemtap.enable = true;
virtualisation.docker.enable = true;
virtualisation.docker.storageDriver = "btrfs";
environment.systemPackages = with pkgs; [
docker-compose
];
# Speed up boot by removing dependency on network
systemd = {
targets.network-online.wantedBy = pkgs.lib.mkForce [ ]; # Normally ["multi-user.target"]
@ -87,7 +93,7 @@
#virtualisation.docker.enable = true;
boot.blacklistedKernelModules = [ "qcserial" ];
# Used for packer Capsul
users.users.anish.extraGroups = [ "adbusers" "wheel" "plugdev" "libvertd" ];
users.users.anish.extraGroups = [ "adbusers" "wheel" "plugdev" "libvertd" "docker" ];
virtualisation.libvirtd.enable = true;
hardware.keyboard.zsa.enable = true;
services.udev.extraRules = ''

28
hosts/curve/hardware-configuration.nix
View file

@ -5,37 +5,34 @@
{
imports =
[
(modulesPath + "/installer/scan/not-detected.nix")
[ (modulesPath + "/installer/scan/not-detected.nix")
];
boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "usb_storage" "usbhid" "sd_mod" "rtsx_pci_sdmmc" ];
boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "usbhid" "usb_storage" "sd_mod" "rtsx_pci_sdmmc" ];
boot.initrd.kernelModules = [ "dm-snapshot" ];
boot.kernelModules = [ "kvm-intel" ];
boot.extraModulePackages = [ ];
fileSystems."/boot" =
{
device = "/dev/disk/by-uuid/2C41-3DAA";
fsType = "vfat";
};
fileSystems."/" =
{
device = "/dev/disk/by-uuid/a4ae2855-10b9-49f3-adb0-acd82b74eeb9";
{ device = "/dev/disk/by-uuid/e1268753-4f18-4e6f-8edb-d4724ad8eb4a";
fsType = "btrfs";
options = [ "subvol=root" ];
};
fileSystems."/home" =
{
device = "/dev/disk/by-uuid/a4ae2855-10b9-49f3-adb0-acd82b74eeb9";
{ device = "/dev/disk/by-uuid/e1268753-4f18-4e6f-8edb-d4724ad8eb4a";
fsType = "btrfs";
options = [ "subvol=home" ];
};
fileSystems."/boot" =
{ device = "/dev/disk/by-uuid/8244-A184";
fsType = "vfat";
};
swapDevices =
[{ device = "/dev/disk/by-uuid/23658926-6ffa-42dc-8915-a6479c385e0b"; }];
[ { device = "/dev/disk/by-uuid/e220fea6-cf3b-4687-bfe1-9cf6d3ba57f7"; }
];
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
# (the default) this is the recommended approach. When using systemd-networkd it's
@ -46,6 +43,5 @@
# networking.interfaces.wlp3s0.useDHCP = lib.mkDefault true;
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
powerManagement.cpuFreqGovernor = lib.mkDefault "powersave";
# hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
}

337
hosts/development/mirlo/docker-compose.nix Normal file
View file

@ -0,0 +1,337 @@
# Auto-generated using compose2nix v0.1.6.
{ pkgs, lib, ... }:
{
# Runtime
virtualisation.podman = {
enable = true;
autoPrune.enable = true;
dockerCompat = true;
defaultNetwork.settings = {
# Required for container networking to be able to use names.
dns_enabled = true;
};
};
virtualisation.oci-containers.backend = "podman";
# Containers
virtualisation.oci-containers.containers."blackbird-api" = {
image = "";
environment = {
API_DOMAIN = "http://localhost:3000";
DATABASE_URL = "postgresql://nomads:nomads@pgsql:5432/nomads?schema=public";
JWT_SECRET = "test1234";
MEDIA_LOCATION = "./data/media/";
MEDIA_LOCATION_DOWNLOAD_CACHE = "/data/media/downloadCache";
MEDIA_LOCATION_INCOMING = "/data/media/incoming";
MINIO_HOST = "minio";
MINIO_PORT = "9000";
MINIO_ROOT_PASSWORD = "password";
MINIO_ROOT_USER = "blackbird";
NODE_ENV = "development";
PORT = "3000";
POSTGRES_LOCAL_MACHINE_PORT = "5434";
POSTGRES_PASSWORD = "nomads";
POSTGRES_USER = "nomads";
REACT_APP_API_DOMAIN = "http://localhost:3000";
REDIS_HOST = "redis";
REDIS_PASSWORD = "password";
REDIS_PORT = "6379";
REFRESH_TOKEN_SECRET = "test1234";
STATIC_MEDIA_HOST = "http://localhost:3000";
STRIPE_KEY = "";
};
volumes = [
"/home/anish/.ssh:/root/.ssh:rw"
"/home/anish/usr/mirlo:/var/www/api:rw"
"/home/anish/usr/mirlo/data/media/downloadCache:/data/media/downloadCache:rw"
"/home/anish/usr/mirlo/data/media/incoming:/data/media/incoming:rw"
];
ports = [
"3000:3000/tcp"
];
cmd = [ "/bin/sh" "-c" "yarn && yarn migrate:deploy && yarn dev:api" ];
dependsOn = [
"blackbird-minio"
"blackbird-pgsql"
"blackbird-redis"
];
log-driver = "journald";
extraOptions = [
"--network-alias=api"
"--network=mirlo-api-network"
"--network=mirlo-redis-network"
];
};
systemd.services."podman-blackbird-api" = {
serviceConfig = {
Restart = lib.mkOverride 500 "always";
};
after = [
"podman-network-mirlo-api-network.service"
"podman-network-mirlo-redis-network.service"
];
requires = [
"podman-network-mirlo-api-network.service"
"podman-network-mirlo-redis-network.service"
];
partOf = [
"podman-compose-mirlo-root.target"
];
unitConfig.UpheldBy = [
"podman-blackbird-minio.service"
"podman-blackbird-pgsql.service"
"podman-blackbird-redis.service"
];
wantedBy = [
"podman-compose-mirlo-root.target"
];
};
virtualisation.oci-containers.containers."blackbird-background" = {
image = "";
environment = {
API_DOMAIN = "http://localhost:3000";
DATABASE_URL = "postgresql://nomads:nomads@pgsql:5432/nomads?schema=public";
JWT_SECRET = "test1234";
MEDIA_LOCATION = "./data/media/";
MEDIA_LOCATION_DOWNLOAD_CACHE = "/data/media/downloadCache";
MEDIA_LOCATION_INCOMING = "/data/media/incoming";
MINIO_HOST = "minio";
MINIO_PORT = "9000";
MINIO_ROOT_PASSWORD = "password";
MINIO_ROOT_USER = "blackbird";
NODE_ENV = "development";
PORT = "3000";
POSTGRES_LOCAL_MACHINE_PORT = "5434";
POSTGRES_PASSWORD = "nomads";
POSTGRES_USER = "nomads";
REACT_APP_API_DOMAIN = "http://localhost:3000";
REDIS_HOST = "redis";
REDIS_PASSWORD = "password";
REDIS_PORT = "6379";
REFRESH_TOKEN_SECRET = "test1234";
STATIC_MEDIA_HOST = "http://localhost:3000";
STRIPE_KEY = "";
};
volumes = [
"/home/anish/.ssh:/root/.ssh:rw"
"/home/anish/usr/mirlo:/var/www/api:rw"
"/home/anish/usr/mirlo/data/media/processing:/data/media/processing:rw"
];
dependsOn = [
"blackbird-api"
"blackbird-minio"
"blackbird-pgsql"
"blackbird-redis"
];
log-driver = "journald";
extraOptions = [
"--network-alias=background"
"--network=mirlo-api-network"
"--network=mirlo-redis-network"
];
};
systemd.services."podman-blackbird-background" = {
serviceConfig = {
Restart = lib.mkOverride 500 "always";
};
after = [
"podman-network-mirlo-api-network.service"
"podman-network-mirlo-redis-network.service"
];
requires = [
"podman-network-mirlo-api-network.service"
"podman-network-mirlo-redis-network.service"
];
partOf = [
"podman-compose-mirlo-root.target"
];
unitConfig.UpheldBy = [
"podman-blackbird-api.service"
"podman-blackbird-minio.service"
"podman-blackbird-pgsql.service"
"podman-blackbird-redis.service"
];
wantedBy = [
"podman-compose-mirlo-root.target"
];
};
virtualisation.oci-containers.containers."blackbird-minio" = {
image = "minio/minio";
environment = {
API_DOMAIN = "http://localhost:3000";
DATABASE_URL = "postgresql://nomads:nomads@pgsql:5432/nomads?schema=public";
JWT_SECRET = "test1234";
MEDIA_LOCATION = "./data/media/";
MEDIA_LOCATION_DOWNLOAD_CACHE = "/data/media/downloadCache";
MEDIA_LOCATION_INCOMING = "/data/media/incoming";
MINIO_HOST = "minio";
MINIO_PORT = "9000";
MINIO_ROOT_PASSWORD = "password";
MINIO_ROOT_USER = "blackbird";
PORT = "3000";
POSTGRES_LOCAL_MACHINE_PORT = "5434";
POSTGRES_PASSWORD = "nomads";
POSTGRES_USER = "nomads";
REACT_APP_API_DOMAIN = "http://localhost:3000";
REDIS_HOST = "redis";
REDIS_PASSWORD = "password";
REDIS_PORT = "6379";
REFRESH_TOKEN_SECRET = "test1234";
STATIC_MEDIA_HOST = "http://localhost:3000";
STRIPE_KEY = "";
};
volumes = [
"/home/anish/usr/mirlo/data/minio_storage:/data:rw"
];
ports = [
"9000:9000/tcp"
"9001:9001/tcp"
];
cmd = [ "server" "--console-address" ":9001" "/data" ];
log-driver = "journald";
extraOptions = [
"--network-alias=minio"
"--network=mirlo-api-network:alias=minio"
];
};
systemd.services."podman-blackbird-minio" = {
serviceConfig = {
Restart = lib.mkOverride 500 "no";
};
after = [
"podman-network-mirlo-api-network.service"
];
requires = [
"podman-network-mirlo-api-network.service"
];
partOf = [
"podman-compose-mirlo-root.target"
];
wantedBy = [
"podman-compose-mirlo-root.target"
];
};
virtualisation.oci-containers.containers."blackbird-pgsql" = {
image = "postgres:14-alpine";
environment = {
API_DOMAIN = "http://localhost:3000";
DATABASE_URL = "postgresql://nomads:nomads@pgsql:5432/nomads?schema=public";
JWT_SECRET = "test1234";
MEDIA_LOCATION = "./data/media/";
MEDIA_LOCATION_DOWNLOAD_CACHE = "/data/media/downloadCache";
MEDIA_LOCATION_INCOMING = "/data/media/incoming";
MINIO_HOST = "minio";
MINIO_PORT = "9000";
MINIO_ROOT_PASSWORD = "password";
MINIO_ROOT_USER = "blackbird";
PORT = "3000";
POSTGRES_LOCAL_MACHINE_PORT = "5434";
POSTGRES_PASSWORD = "nomads";
POSTGRES_USER = "nomads";
REACT_APP_API_DOMAIN = "http://localhost:3000";
REDIS_HOST = "redis";
REDIS_PASSWORD = "password";
REDIS_PORT = "6379";
REFRESH_TOKEN_SECRET = "test1234";
STATIC_MEDIA_HOST = "http://localhost:3000";
STRIPE_KEY = "";
};
volumes = [
"/home/anish/usr/mirlo/data/pgsql:/var/lib/postgresql/data:rw"
"/home/anish/usr/mirlo/data/pgsql_backups:/backups:rw"
];
ports = [
"5432:5432/tcp"
];
log-driver = "journald";
extraOptions = [
"--network-alias=pgsql"
"--network=mirlo-api-network:alias=pgsql"
];
};
systemd.services."podman-blackbird-pgsql" = {
serviceConfig = {
Restart = lib.mkOverride 500 "no";
};
after = [
"podman-network-mirlo-api-network.service"
];
requires = [
"podman-network-mirlo-api-network.service"
];
partOf = [
"podman-compose-mirlo-root.target"
];
wantedBy = [
"podman-compose-mirlo-root.target"
];
};
virtualisation.oci-containers.containers."blackbird-redis" = {
image = "redis";
ports = [
"6379:6379/tcp"
];
cmd = [ "redis-server" "--appendonly" "yes" "--requirepass " ];
log-driver = "journald";
extraOptions = [
"--network-alias=redis"
"--network=mirlo-redis-network"
];
};
systemd.services."podman-blackbird-redis" = {
serviceConfig = {
Restart = lib.mkOverride 500 "always";
};
after = [
"podman-network-mirlo-redis-network.service"
];
requires = [
"podman-network-mirlo-redis-network.service"
];
partOf = [
"podman-compose-mirlo-root.target"
];
wantedBy = [
"podman-compose-mirlo-root.target"
];
};
# Networks
systemd.services."podman-network-mirlo-api-network" = {
path = [ pkgs.podman ];
serviceConfig = {
Type = "oneshot";
RemainAfterExit = true;
ExecStop = "${pkgs.podman}/bin/podman network rm -f mirlo-api-network";
};
script = ''
podman network inspect mirlo-api-network || podman network create mirlo-api-network --opt isolate=true
'';
partOf = [ "podman-compose-mirlo-root.target" ];
wantedBy = [ "podman-compose-mirlo-root.target" ];
};
systemd.services."podman-network-mirlo-redis-network" = {
path = [ pkgs.podman ];
serviceConfig = {
Type = "oneshot";
RemainAfterExit = true;
ExecStop = "${pkgs.podman}/bin/podman network rm -f mirlo-redis-network";
};
script = ''
podman network inspect mirlo-redis-network || podman network create mirlo-redis-network --opt isolate=true
'';
partOf = [ "podman-compose-mirlo-root.target" ];
wantedBy = [ "podman-compose-mirlo-root.target" ];
};
# Root service
# When started, this will automatically create all resources and start
# the containers. When stopped, this will teardown all resources.
systemd.targets."podman-compose-mirlo-root" = {
unitConfig = {
Description = "Root target generated by compose2nix.";
};
wantedBy = [ "multi-user.target" ];
};
}

7
hosts/helix/default.nix
View file

@ -11,6 +11,7 @@
# ../profiles/mount-mossnet
../profiles/freshrss
../profiles/microbin
# ../profiles/postgres_upgrade_script
];
# Capsul specific
@ -27,11 +28,11 @@
privateKeyFile = "/run/agenix/helix-wg";
};
services.postgresql.package = pkgs.postgresql_11;
services.postgresql.package = pkgs.postgresql_15;
services.postgresqlBackup = {
# TODO needs working wireguard to box
enable = false;
databases = [ "gitea" "freshrss" "woodpecker" ];
databases = [ "gitea" "freshrss" ]; # "woodpecker"
location = "/mnt/two/postgres";
};
@ -41,7 +42,7 @@
paths = [
"/var/lib/gitea"
"/var/lib/freshrss"
"/var/lib/woodpecker"
# "/var/lib/woodpecker"
"/var/lib/microbin"
];

2
hosts/profiles/core/default.nix
View file

@ -32,7 +32,7 @@ in
};
environment.systemPackages = with pkgs; [
pinentry_gnome
pinentry-gnome
cached-nix-shell
];

7
hosts/profiles/desktop/default.nix
View file

@ -99,7 +99,7 @@ in
papirus-icon-theme
calendar-cli
wyrd
tic-80
# tic-80
ytfzf
yt-dlp
];
@ -123,9 +123,12 @@ in
};
xserver = {
enable = true;
xkb.layout = "us,dvorak";
# TODO should be xkb.layout
layout = "us";
# xkb.variant = "dvorak";
desktopManager.wallpaper.mode = "fill";
displayManager = {
# startx.enable = true;
defaultSession = "none+bspwm";
sessionCommands = ''
${pkgs.xorg.xrdb}/bin/xrdb -merge <<EOF

15
hosts/profiles/freshrss/default.nix
View file

@ -17,13 +17,14 @@
services.postgresql = {
enable = true; # Ensure postgresql is enabled
authentication = ''
local freshrss all ident map=freshrss-users
'';
identMap = # Map the freshrss user to postgresql
''
freshrss-users freshrss freshrss
'';
# authentication = ''
# local freshrss all ident map=freshrss-users
# '';
# identMap = # Map the freshrss user to postgresql
# ''
# freshrss-users freshrss freshrss
# freshrss-users postgres freshrss
# '';
ensureDatabases = [ "freshrss" ];
ensureUsers = [{
name = "freshrss";

15
hosts/profiles/gitea/default.nix
View file

@ -46,13 +46,14 @@
environment.systemPackages = [ pkgs.pandoc ];
services.postgresql = {
enable = true; # Ensure postgresql is enabled
authentication = ''
local gitea all ident map=gitea-users
'';
identMap = # Map the gitea user to postgresql
''
gitea-users gitea gitea
'';
# authentication = ''
# local gitea all ident map=gitea-users
# '';
# identMap = # Map the gitea user to postgresql
# ''
# gitea-users gitea gitea
# gitea-users postgres gitea
# '';
ensureDatabases = [ "gitea" ];
ensureUsers = [{
name = "gitea";

4
hosts/profiles/microbin/default.nix
View file

@ -1,8 +1,8 @@
{ config, lib, pkgs, ... }:
{
services.microbin.enable = true;
services.microbin.hostname = "bin.sealight.xyz";
services.microbin.port = 4949;
services.microbin.settings.PUBLIC_PATH = "bin.sealight.xyz";
services.microbin.settings.MICROBIN_PORT = 4949;
networking.firewall.allowedTCPPorts = [ 4949 ];
services.nginx.virtualHosts."bin.sealight.xyz" = {
enableACME = true;

4
hosts/profiles/music/default.nix
View file

@ -16,7 +16,7 @@
orca-c
supercollider
dirt
sunvox
# sunvox
vcv-rack
lmms
bespokesynth
@ -38,7 +38,7 @@
alsa.enable = true;
alsa.support32Bit = false;
pulse.enable = true;
jack.enable = true;
jack.enable = true;
# Deprecated as of 23.05
# config = {
# pipewire."context.properties"."default.clock.rate" = "48000";

7
hosts/profiles/postgres_upgrade_script/default.nix
View file

@ -6,13 +6,12 @@
# TODO it's perhaps advisable to stop all services that depend on postgresql
systemctl stop postgresql
# TODO replace `<new version>` with the psqlSchema here
# The schema can be found by running:
# nix-instantiate '<nixpkgs>' --eval -A postgresql_14.psqlSchema
export NEWDATA="/var/lib/postgresql/<new version>"
# nix eval --raw nixpkgs#postgresql_15.psqlSchema
export NEWDATA="/var/lib/postgresql/15"
# TODO specify the postgresql package you'd like to upgrade to
export NEWBIN="${pkgs.postgresql_14}/bin"
export NEWBIN="${pkgs.postgresql_15}/bin"
export OLDDATA="${config.services.postgresql.dataDir}"
export OLDBIN="${config.services.postgresql.package}/bin"

0
hosts/profiles/sync/music/get-music.sh Executable file → Normal file
View file

2
hosts/profiles/ulogger-server/default.nix
View file

@ -6,7 +6,7 @@
ensureDatabases = [ "ulogger" ];
ensureUsers = [{
name = "ulogger";
nsureDBOwnership = true;
ensureDBOwnership = true;
}];
};

5
hosts/profiles/wallabag/default.nix
View file

@ -25,7 +25,8 @@
services.wallabag = {
enable = true;
hostName = "read.mossnet.lan";
package = pkgs.wallabag;
package = pkgs.my-wallabag;
dataDir = "/var/lib/wallabag";
conf = ''
# This file is a "template" of what your parameters.yml file should look like
parameters:
@ -42,7 +43,7 @@
# with PostgreSQL and SQLite, you must set "utf8"
database_charset: utf8
domain_name: http://read.mossnet.lan/
domain_name: http://read.mossnet.lan
server_name: "mossnet wallabag instance"
mailer_dsn: null://

0
install-encrypted.sh Executable file → Normal file
View file

2
install-yubikey.sh Executable file → Normal file
View file

@ -19,7 +19,7 @@ cc -O3 -I$(nix-build "<nixpkgs>" --no-build-output -A openssl.dev)/include -L$(n
# Yubikey Setup
SLOT=2
ykpersonalize -"$SLOT" -ochal-resp -ochal-hmac
# ykpersonalize -"$SLOT" -ochal-resp -ochal-hmac
SALT_LENGTH=16
salt="$(dd if=/dev/random bs=1 count=$SALT_LENGTH 2>/dev/null | rbtohex)"
k_user=PASSWORDCHANGEMEPLAEASES

2
modules/nixos/default.nix
View file

@ -9,5 +9,5 @@
wireguard = import ./wireguard.nix;
backup = import ./backup.nix;
ulogger-server = import ./ulogger.nix;
# microbin = import ./microbin.nix; includide in 23.11
# microbin = import ./microbin.nix; # includide in 23.11
}

36
modules/nixos/wallabag.nix
View file

@ -26,7 +26,7 @@ let
console = pkgs.writeShellScriptBin "wallabag-console" ''
export WALLABAG_DATA="${cfg.dataDir}"
cd "${cfg.dataDir}"
${pkgs.php}/bin/php ${pkgs.wallabag}/bin/console --env=prod $@
${pkgs.php}/bin/php ${cfg.package}/bin/console --env=prod $@
'';
in
@ -166,11 +166,11 @@ in
forceSSL = false;
root = "${cfg.package}/web";
extraConfig = ''
add_header X-Frame-Options SAMEORIGIN;
add_header X-Content-Type-Options nosniff;
add_header X-XSS-Protection "1; mode=block";
'';
# extraConfig = ''
# add_header X-Frame-Options SAMEORIGIN;
# add_header X-Content-Type-Options nosniff;
# add_header X-XSS-Protection "1; mode=block";
# '';
locations."/" = {
tryFiles = "$uri /app.php$is_args$args";
@ -179,25 +179,19 @@ in
locations."/assets".root = "${cfg.dataDir}/web";
locations."~ ^/app\\.php(/|$)" = {
fastcgiParams = {
SCRIPT_FILENAME = "$realpath_root$fastcgi_script_name";
DOCUMENT_ROOT = "$realpath_root";
};
# fastcgiParams = {
# SCRIPT_FILENAME = "$realpath_root$fastcgi_script_name";
# DOCUMENT_ROOT = "$realpath_root";
# };
extraConfig = ''
fastcgi_pass unix:${config.services.phpfpm.pools."${poolName}".socket};
include ${config.services.nginx.package}/conf/fastcgi_params;
include ${config.services.nginx.package}/conf/fastcgi.conf;
fastcgi_split_path_info ^(.+\.php)(/.*)$;
include ${pkgs.nginx}/conf/fastcgi_params;
fastcgi_param SCRIPT_FILENAME ${cfg.package}/web/$fastcgi_script_name;
fastcgi_param DOCUMENT_ROOT ${cfg.package}/web;
fastcgi_read_timeout 120;
internal;
'';
# extraConfig = ''
# fastcgi_pass unix:${config.services.phpfpm.pools."${poolName}".socket};
# fastcgi_split_path_info ^(.+\.php)(/.*)$;
# include ${pkgs.nginx}/conf/fastcgi_params;
# fastcgi_param SCRIPT_FILENAME ${cfg.package}/web/$fastcgi_script_name;
# fastcgi_param DOCUMENT_ROOT ${cfg.package}/web;
# fastcgi_read_timeout 120;
# internal;
# '';
};
locations."~ /(?!app)\\.php$" = {

18
mount-crypted.sh Normal file → Executable file
View file

@ -1,9 +1,21 @@
#!/usr/bin/env bash
# nix-shell https://github.com/sgillespie/nixos-yubikey-luks/archive/master.tar.gz
rbtohex() {
( od -An -vtx1 | tr -d ' \n' )
}
hextorb() {
( tr '[:lower:]' '[:upper:]' | sed -e 's/\([0-9A-F]\{2\}\)/\\\\\\x\1/gI'| xargs printf )
}
key_length=512
iterations="$(head -n 2 /boot/crypted-storage/default)"
salt="$(head -n 1 /boot/crypted-storage/default)"
iterations=1000000
salt="$(head -n 1 /mnt/crypt-storage/default)"
chal="$(echo -n $salt | openssl dgst -binary -sha512 | rbtohex)"
resp="$(ykchalresp -2 -x $chal 2>/dev/null)"
user_key="$(read -s)"
user_key=
read -r user_key
luks_key="$(echo -n $user_key | pbkdf2-sha512 $(($key_length / 8)) $iterations $resp | rbtohex)"
echo -n $luks_key | hextorb | sudo cryptsetup luksOpen /dev/sda2 crypted --key-file=-

2
pkgs/default.nix
View file

@ -8,4 +8,6 @@
kobopatch = pkgs.callPackage ./kobopatch.nix { };
my-mautrix-discord = pkgs.callPackage ./mautrix-discord.nix { }; # Handled by matrix-appservices input
ulogger-server = pkgs.callPackage ./ulogger.nix { };
my-wallabag = pkgs.callPackage ./wallabag.nix { };
mautrix-slack = pkgs.callPackage ./mautrix-slack.nix { };
}

2
pkgs/koboutils.nix
View file

@ -4,7 +4,7 @@ buildGoModule rec {
name = "koboutils";
version = "git_2020-04-08";
vendorSha256 = "1hqvizvbc29yib6awmvlklxkq7j8c0d32gxsipdiwhkh79xbd6wq";
vendorha256 = "1hqvizvbc29yib6awmvlklxkq7j8c0d32gxsipdiwhkh79xbd6wq";
deleteVendor = true;
src = fetchFromGitHub {

29
pkgs/mautrix-slack.nix Normal file
View file

@ -0,0 +1,29 @@
{ lib, buildGoModule, fetchFromGitHub, olm }:
buildGoModule rec {
pname = "mautrix-discord";
version = "unstable-2022-11-04";
src = fetchFromGitHub {
owner = "mautrix";
repo = "slack";
rev = "4530ff397d08d93b673cd71da4c2a75d969ca0df";
hash = "";
};
buildInputs = [ olm ];
vendorHash = "sha256-yday2mSnPwuhXWkCG4XY7qoBl3DXHcSvzBoZbjgYz/c=";
ldflags = [ "-s" "-w" ]; # https://github.com/NixOS/nixpkgs/issues/177698
doCheck = false; # No tests available
meta = with lib; {
homepage = "https://go.mau.fi/mautrix-slack";
description = "Matrix to Slack hybrid puppeting/relaybot bridge";
license = licenses.agpl3Plus;
maintainers = with maintainers; [ ];
};
}

4
pkgs/tic-80.nix
View file

@ -10,7 +10,7 @@ pkgs.stdenv.mkDerivation rec {
};
buildInputs = with pkgs; [
gcc
pkgconfig
pkg-config
autoconf
automake
libtool
@ -27,7 +27,7 @@ pkgs.stdenv.mkDerivation rec {
gtk3-x11
cmake
cmakeCurses
elementary-cmake-modules
# elementary-cmake-modules
extra-cmake-modules
libglvnd
mesa_glu

26
pkgs/wallabag-data.patch Normal file
View file

@ -0,0 +1,26 @@
diff --git a/app/AppKernel.php b/app/AppKernel.php
index 61b734e06..d25d1aaa3 100644
--- a/app/AppKernel.php
+++ b/app/AppKernel.php
@@ -62,14 +62,19 @@ class AppKernel extends Kernel
return $bundles;
}
+ public function getProjectDir()
+ {
+ return getenv('WALLABAG_DATA') ?: dirname(__DIR__);
+ }
+
public function getCacheDir()
{
- return dirname(__DIR__) . '/var/cache/' . $this->getEnvironment();
+ return $this->getProjectDir() . '/var/cache/' . $this->getEnvironment();
}
public function getLogDir()
{
- return dirname(__DIR__) . '/var/logs';
+ return $this->getProjectDir() . '/var/logs';
}
public function registerContainerConfiguration(LoaderInterface $loader)

57
pkgs/wallabag.nix Normal file
View file

@ -0,0 +1,57 @@
{ lib
, stdenv
, fetchurl
}:
# Point the environment variable $WALLABAG_DATA to a data directory
# that contains the folder `app` which must be a clone of
# wallabag's configuration files with your customized `parameters.yml`.
# In practice you need to copy `${pkgs.wallabag}/app` and the
# customizzed `parameters.yml` to $WALLABAG_DATA.
# These need to be updated every package upgrade.
#
# After a package upgrade, empty the `var/cache` folder or unexpected
# error will occur.
let
pname = "wallabag";
version = "2.6.8";
in
stdenv.mkDerivation {
inherit pname version;
# Release tarball includes vendored files
src = fetchurl {
url = "https://github.com/wallabag/wallabag/releases/download/${version}/wallabag-${version}.tar.gz";
hash = "sha256-pmQXafqpd5rTwBIYG9NnwIIPta6Ek7iYaPaHvz1s550=";
};
patches = [
./wallabag-data.patch # exposes $WALLABAG_DATA
];
dontBuild = true;
installPhase = ''
runHook preInstall
mkdir $out
cp -R * $out/
runHook postInstall
'';
meta = with lib; {
description = "wallabag is a self hostable application for saving web pages";
longDescription = ''
wallabag is a self-hostable PHP application allowing you to not
miss any content anymore. Click, save and read it when you can.
It extracts content so that you can read it when you have time.
'';
license = licenses.mit;
homepage = "http://wallabag.org";
changelog = "https://github.com/wallabag/wallabag/releases/tag/${version}";
maintainers = with maintainers; [ schneefux ];
platforms = platforms.all;
};
}