bowl
This commit is contained in:
		
						commit
						c70fa682f2
					
				
							
								
								
									
										29
									
								
								bowl/box.nix
									
									
									
									
									
										Normal file
									
								
							
							
						
						
									
										29
									
								
								bowl/box.nix
									
									
									
									
									
										Normal file
									
								
							|  | @ -0,0 +1,29 @@ | |||
| { config, pkgs, ... }: | ||||
| 
 | ||||
| {  | ||||
| 	imports = [ | ||||
| 		./common.nix | ||||
|     ./musician.nix | ||||
| 	]; | ||||
| 
 | ||||
| 
 | ||||
|   users.extraUsers."anish".extraGroups = [ "jackaudio" ]; | ||||
| 
 | ||||
| 	services.xserver = { | ||||
|     enable = true; | ||||
|     displayManager.gdm.enable = true; | ||||
| 		desktopManager.gnome3.enable = true; | ||||
|   }; | ||||
| 
 | ||||
| 	# task whisperer broken  | ||||
|   #nixpkgs.config.allowBroken = true; | ||||
| 
 | ||||
|   # virtual box | ||||
|   virtualisation.virtualbox.host.enable = true; | ||||
| 
 | ||||
| 	# ErgoDox Firmware (doesn't compile) | ||||
| 	# environment.systemPackages = with pkgs; [ | ||||
| 	#	qmk_firmware | ||||
| 	# ]; | ||||
| } | ||||
| 
 | ||||
							
								
								
									
										115
									
								
								bowl/common.nix
									
									
									
									
									
										Normal file
									
								
							
							
						
						
									
										115
									
								
								bowl/common.nix
									
									
									
									
									
										Normal file
									
								
							|  | @ -0,0 +1,115 @@ | |||
| { config, pkgs, ... }: | ||||
| 
 | ||||
| { | ||||
| 	imports = [ | ||||
| 		./nvim.nix | ||||
| #	  ./unstable.nix | ||||
| 	]; | ||||
| 
 | ||||
| 
 | ||||
| 	environment.systemPackages = with pkgs; [ | ||||
| 		htop | ||||
| 		iftop | ||||
| 		wget | ||||
| 		curl | ||||
|     exa | ||||
|     bat | ||||
|     fd | ||||
|     ag | ||||
| 		tcpdump | ||||
| 		whois | ||||
| 		mtr | ||||
| 		file | ||||
| 		lsof | ||||
| 	  atool | ||||
| 		inotify-tools | ||||
| 	  strace | ||||
| 		zip | ||||
| 		unzip | ||||
| 		rsync | ||||
| 		tmux | ||||
| 		pwgen | ||||
| 	  glow | ||||
|     jq | ||||
| 		gitAndTools.gitFull | ||||
| 	  #neovim defined in ./nvim.nix | ||||
| 	  wofi | ||||
| 		firefox | ||||
| 		fractal | ||||
| 	  pinentry_gnome | ||||
| 		pass | ||||
| 		gcc | ||||
| 		less | ||||
| 		mpv | ||||
| 		zathura | ||||
| 	  #qmk_firmware | ||||
| 		python3 | ||||
| 	  gdb | ||||
| 	  vcv-rack | ||||
| 	  #xdotool | ||||
| 	  #neofetch | ||||
| 	  #calibre | ||||
| 		#openvpn | ||||
| 	  gimp | ||||
| 	  xxd | ||||
| 		tilix | ||||
| 	  kitty | ||||
| 		taskwarrior | ||||
| 		gnupg | ||||
| 	  openjdk | ||||
| 		glslviewer | ||||
| 	  filezilla | ||||
| 		signal-desktop | ||||
| 	  wire-desktop | ||||
| 		tdesktop | ||||
| 		feedreader | ||||
|     newsflash | ||||
| 		syncthing | ||||
| 	  dijo | ||||
| 	  #kdeconnect | ||||
| 	  #ssb-patchwork | ||||
| 		gnome3.gnome-tweaks | ||||
| 	  gnome3.pomodoro | ||||
| 		gnomeExtensions.gsconnect | ||||
|     #gnomeExtensions.taskwhisperer | ||||
| 	  #gnome3.networkmanager-openvpn | ||||
| 		#python3Packages.youtube-dl | ||||
| 		appimage-run | ||||
| 	  home-manager | ||||
| 		libreoffice | ||||
| 		fontconfig | ||||
| 		hugo | ||||
| 	  #processing | ||||
| 	  #nextcloud-client | ||||
| 	  zsh-powerlevel10k | ||||
| 	  powerline-fonts | ||||
| 	  supercollider | ||||
| 	  haskellPackages.tidal | ||||
| 	  # vim-zettel | ||||
| 	  pandoc | ||||
| 	]; | ||||
| 
 | ||||
| 	programs.bash.enableCompletion = true; | ||||
| 
 | ||||
| 	# needed for vcv-rack | ||||
| 	nixpkgs.config.allowUnfree = true;  | ||||
| 
 | ||||
| 	system.copySystemConfiguration = true; | ||||
| 	services.syncthing = { | ||||
| 	  enable = true; | ||||
| 	  openDefaultPorts = true; | ||||
| 	  systemService = true; | ||||
| 	  user    = "anish"; | ||||
| 	  dataDir = "/home/anish/usr/syncthing"; | ||||
| 	}; | ||||
| 
 | ||||
| 	#zsh powerlevel10k | ||||
| 	programs.zsh.enable = true; | ||||
| 	programs.zsh.promptInit = "source ${pkgs.zsh-powerlevel10k}/share/zsh-powerlevel10k/powerlevel10k.zsh-theme"; | ||||
| 	users.users.anish.shell = pkgs.zsh; | ||||
| 
 | ||||
| 	#android  | ||||
| 	programs.adb.enable = true; | ||||
| 	users.users.anish.extraGroups = ["adbusers"]; | ||||
| 
 | ||||
| } | ||||
							
								
								
									
										24
									
								
								bowl/musician.nix
									
									
									
									
									
										Normal file
									
								
							
							
						
						
									
										24
									
								
								bowl/musician.nix
									
									
									
									
									
										Normal file
									
								
							|  | @ -0,0 +1,24 @@ | |||
| {pkgs, config, ... }: | ||||
| { | ||||
|   imports = [  | ||||
|     /home/anish/usr/musnix | ||||
|   ]; | ||||
| 
 | ||||
|   musnix.enable = true; | ||||
|   users.users.anish.extraGroups = [ "audio" ]; | ||||
| 
 | ||||
| 	environment.systemPackages = with pkgs; [ ardour patchage helm ]; | ||||
|   #services.jack = { | ||||
| 	#	jackd.enable = true; | ||||
|   #  # support ALSA only programs via ALSA JACK PCM plugin | ||||
| 	#	alsa.enable = false; | ||||
|   #  # support ALSA only programs via loopback device (supports programs like Steam) | ||||
| 	#	loopback = { | ||||
| 	#		enable = true; | ||||
|   #    # buffering parameters for dmix device to work with ALSA only semi-professional sound programs | ||||
|   #    #dmixConfig = '' | ||||
|   #    #  period_size 2048 | ||||
|   #    #''; | ||||
| 	#	}; | ||||
| 	#}; | ||||
| } | ||||
							
								
								
									
										6
									
								
								bowl/musnix.nix
									
									
									
									
									
										Normal file
									
								
							
							
						
						
									
										6
									
								
								bowl/musnix.nix
									
									
									
									
									
										Normal file
									
								
							|  | @ -0,0 +1,6 @@ | |||
| { | ||||
|   imports = [ <musnix> ]; | ||||
|   musnix.enable = true; | ||||
| 
 | ||||
|   users.users."anish".extraGroups = [ "audio" ]; | ||||
| } | ||||
							
								
								
									
										262
									
								
								bowl/nvim.nix
									
									
									
									
									
										Normal file
									
								
							
							
						
						
									
										262
									
								
								bowl/nvim.nix
									
									
									
									
									
										Normal file
									
								
							|  | @ -0,0 +1,262 @@ | |||
| { pkgs, ... }: | ||||
| 
 | ||||
| 
 | ||||
| 	#nvim | ||||
|   {  | ||||
|     environment.variables.EDITOR = "nvim"; | ||||
|     environment.shellAliases = { | ||||
|       k = "vim -c :VimwikiIndex"; | ||||
|       kz = "vim -c :VimwikiIndex -c :ZettelNew"; | ||||
|     }; | ||||
|     environment.systemPackages = with pkgs; [  | ||||
|       nodejs | ||||
|   ( neovim.override { | ||||
|   vimAlias = true; | ||||
|   configure = { | ||||
| 		packages.myPlugins = with pkgs.vimPlugins; { | ||||
| 			start = [  | ||||
| 				vim-nix | ||||
| 				fzf-vim | ||||
| 				vim-elixir | ||||
| 				emmet-vim | ||||
| 				nerdtree | ||||
| 				goyo-vim | ||||
| 				vim-sneak | ||||
| 				lightline-vim | ||||
| 				csv-vim | ||||
|         vimwiki | ||||
|         coc-nvim | ||||
| 				coc-json | ||||
|         coc-python | ||||
|         coc-pairs | ||||
|         coc-emmet | ||||
|         emmet-vim | ||||
|         LanguageClient-neovim | ||||
|         ayu-vim | ||||
|         rainbow_parentheses-vim | ||||
|         vim-surround | ||||
|         vim-fugitive | ||||
|         #iron-nvim | ||||
|         #nvim-colorizer | ||||
|         vim-devicons | ||||
| 
 | ||||
|         # testing | ||||
|         #vim-processing | ||||
|         #vim-tidal | ||||
|         taskwiki | ||||
|         vim-zettel | ||||
|         vimwiki-sync | ||||
| 			]; | ||||
| 		}; | ||||
|     customRC = '' | ||||
| 			set tabstop=2 | ||||
| 			set showmatch | ||||
| 			set shiftwidth=2 | ||||
|       set noexpandtab | ||||
|       set autoindent | ||||
| 
 | ||||
|       set foldmethod=indent   " fold based on indent | ||||
| 			set number | ||||
| 			set nocompatible | ||||
| 			set relativenumber | ||||
|       set showtabline=2 | ||||
|       set autowriteall | ||||
| 			syntax on | ||||
|       set list lcs=tab:\|\  | ||||
|       filetype plugin on | ||||
|        | ||||
|       set termguicolors | ||||
|       let ayucolor="dark" | ||||
|       colorscheme ayu | ||||
| 
 | ||||
|       " window | ||||
|       nmap <leader>wh  :topleft  vnew<CR> | ||||
|       nmap <leader>wl :botright vnew<CR> | ||||
|       nmap <leader>wk    :topleft  new<CR> | ||||
|       nmap <leader>wj  :botright new<CR> | ||||
| 
 | ||||
| 			let mapleader = "\<Space>" | ||||
| 
 | ||||
| 			" lightline colorscheme | ||||
| 			let g:lightline = { | ||||
| 						\ 'colorscheme': 'seoul256', | ||||
| 						\ } | ||||
| 
 | ||||
| 			" moving splits with vim movements. | ||||
| 			:tnoremap <A-h> <C-\><C-N><C-w>h | ||||
| 			:tnoremap <A-j> <C-\><C-N><C-w>j | ||||
| 			:tnoremap <A-k> <C-\><C-N><C-w>k | ||||
| 			:tnoremap <A-l> <C-\><C-N><C-w>l | ||||
| 			:inoremap <A-h> <C-\><C-N><C-w>h | ||||
| 			:inoremap <A-j> <C-\><C-N><C-w>j | ||||
| 			:inoremap <A-k> <C-\><C-N><C-w>k | ||||
| 			:inoremap <A-l> <C-\><C-N><C-w>l | ||||
| 			:nnoremap <A-h> <leader>h | ||||
| 			:nnoremap <A-j> <leader>j | ||||
| 			:nnoremap <A-k> <leader>k | ||||
| 			:nnoremap <A-l> <leader>l | ||||
| 			:nnoremap <F5> "=strftime("%Y-%m-%d %H:%M:") | ||||
| 			:inoremap <F5> <C-R>=strftime("%Y-%m-%d %H:%M:") | ||||
| 
 | ||||
|       " exit normal mode in terminal | ||||
|       :tnoremap <C-n> <C-\><C-n> | ||||
| 
 | ||||
| 			let g:syntastic_always_populate_loc_list = 1 | ||||
| 			let g:syntastic_auto_loc_list = 1 | ||||
| 			let g:syntastic_check_on_open = 1 | ||||
| 			let g:syntastic_check_on_wq = 0 | ||||
| 
 | ||||
|       let g:rainbow_active = 0 | ||||
|       autocmd BufReadPost,BufNewFile c,py,nix RainbowParenthesesToggleAll | ||||
| 
 | ||||
| 			" keyboard commands | ||||
| 			map <leader>t :NERDTreeToggle<CR> | ||||
| 			map <leader>s :w<CR> | ||||
| 			map <leader>q :wq<CR> | ||||
|       map <leader>r :RainbowParenthesesToggleAll<CR> | ||||
|       map <leader>zs :ZettelSearch<CR> | ||||
|       map <leader>zo :ZettelOpen<CR> | ||||
|       map <leader>zn :ZettelNew<CR> | ||||
| 
 | ||||
| 
 | ||||
| 			" NERDTree  | ||||
| 			" open on directory | ||||
| 			autocmd StdinReadPre * let s:std_in=1 | ||||
| 
 | ||||
| 			" coc | ||||
| 			" | ||||
| 			" if hidden is not set, TextEdit might fail. | ||||
| 			set hidden | ||||
| 
 | ||||
| 			" Some servers have issues with backup files, see #649 | ||||
| 			set nobackup | ||||
| 			set nowritebackup | ||||
| 
 | ||||
| 			" Better display for messages | ||||
| 			set cmdheight=2 | ||||
| 
 | ||||
| 			" You will have bad experience for diagnostic messages when it's default 4000. | ||||
| 			set updatetime=300 | ||||
| 
 | ||||
| 			" don't give |ins-completion-menu| messages. | ||||
| 			set shortmess+=c | ||||
| 
 | ||||
| 			" always show signcolumns | ||||
| 			set signcolumn=yes | ||||
| 
 | ||||
| 			" Use tab for trigger completion with characters ahead and navigate. | ||||
| 			" Use command ':verbose imap <tab>' to make sure tab is not mapped by other plugin. | ||||
| 			inoremap <silent><expr> <TAB> | ||||
| 						\ pumvisible() ? "\<C-n>" : | ||||
| 						\ <SID>check_back_space() ? "\<TAB>" : | ||||
| 						\ coc#refresh() | ||||
| 			inoremap <expr><S-TAB> pumvisible() ? "\<C-p>" : "\<C-h>" | ||||
| 
 | ||||
| 			function! s:check_back_space() abort | ||||
| 				let col = col('.') - 1 | ||||
| 				return !col || getline('.')[col - 1]  =~# '\s' | ||||
| 			endfunction | ||||
| 
 | ||||
| 			" Use <c-space> to trigger completion. | ||||
| 			inoremap <silent><expr> <c-space> coc#refresh() | ||||
| 
 | ||||
| 			" Use <cr> to confirm completion, `<C-g>u` means break undo chain at current position. | ||||
| 			" Coc only does snippet and additional edit on confirm. | ||||
| 			inoremap <expr> <cr> pumvisible() ? "\<C-y>" : "\<C-g>u\<CR>" | ||||
| 			" Or use `complete_info` if your vim support it, like: | ||||
| 			" inoremap <expr> <cr> complete_info()["selected"] != "-1" ? "\<C-y>" : "\<C-g>u\<CR>" | ||||
| 
 | ||||
| 			" Use `[g` and `]g` to navigate diagnostics | ||||
| 			nmap <silent> [g <Plug>(coc-diagnostic-prev) | ||||
| 			nmap <silent> ]g <Plug>(coc-diagnostic-next) | ||||
| 
 | ||||
| 			" Remap keys for gotos | ||||
| 			nmap <silent> gd <Plug>(coc-definition) | ||||
| 			nmap <silent> gy <Plug>(coc-type-definition) | ||||
| 			nmap <silent> gi <Plug>(coc-implementation) | ||||
| 			nmap <silent> gr <Plug>(coc-references) | ||||
| 
 | ||||
| 			" Use K to show documentation in preview window | ||||
| 			nnoremap <silent> K :call <SID>show_documentation()<CR> | ||||
| 
 | ||||
| 			function! s:show_documentation() | ||||
| 				if (index(['vim','help'], &filetype) >= 0) | ||||
| 					execute 'h '.expand('<cword>') | ||||
| 				else | ||||
| 					call CocAction('doHover') | ||||
| 				endif | ||||
| 			endfunction | ||||
| 
 | ||||
| 			" Highlight symbol under cursor on CursorHold | ||||
| 			autocmd CursorHold * silent call CocActionAsync('highlight') | ||||
| 
 | ||||
| 			" Remap for rename current word | ||||
| 			nmap <leader>rn <Plug>(coc-rename) | ||||
| 
 | ||||
| 			" Remap for format selected region | ||||
| 			xmap <leader>f  <Plug>(coc-format-selected) | ||||
| 			nmap <leader>f  <Plug>(coc-format-selected) | ||||
| 
 | ||||
| 			augroup mygroup | ||||
| 				autocmd! | ||||
| 				" Setup formatexpr specified filetype(s). | ||||
| 				autocmd FileType typescript,json setl formatexpr=CocAction('formatSelected') | ||||
| 				" Update signature help on jump placeholder | ||||
| 				autocmd User CocJumpPlaceholder call CocActionAsync('showSignatureHelp') | ||||
| 			augroup end | ||||
| 
 | ||||
| 			" Remap for do codeAction of selected region, ex: `<leader>aap` for current paragraph | ||||
| 			xmap <leader>a  <Plug>(coc-codeaction-selected) | ||||
| 			nmap <leader>a  <Plug>(coc-codeaction-selected) | ||||
| 
 | ||||
| 			" Remap for do codeAction of current line | ||||
| 			nmap <leader>ac  <Plug>(coc-codeaction) | ||||
| 			" Fix autofix problem of current line | ||||
| 			nmap <leader>qf  <Plug>(coc-fix-current) | ||||
| 
 | ||||
| 			" Create mappings for function text object, requires document symbols feature of languageserver. | ||||
| 			xmap if <Plug>(coc-funcobj-i) | ||||
| 			xmap af <Plug>(coc-funcobj-a) | ||||
| 			omap if <Plug>(coc-funcobj-i) | ||||
| 			omap af <Plug>(coc-funcobj-a) | ||||
| 
 | ||||
| 			" Use <C-d> for select selections ranges, needs server support, like: coc-tsserver, coc-python | ||||
| 			nmap <silent> <C-d> <Plug>(coc-range-select) | ||||
| 			xmap <silent> <C-d> <Plug>(coc-range-select) | ||||
| 
 | ||||
| 			" Use `:Format` to format current buffer | ||||
| 			command! -nargs=0 Format :call CocAction('format') | ||||
| 
 | ||||
| 			" Use `:Fold` to fold current buffer | ||||
| 			command! -nargs=? Fold :call     CocAction('fold', <f-args>) | ||||
| 
 | ||||
| 			" use `:OR` for organize import of current buffer | ||||
| 			command! -nargs=0 OR   :call     CocAction('runCommand', 'editor.action.organizeImport') | ||||
| 
 | ||||
| 			" Add status line support, for integration with other plugin, checkout `:h coc-status` | ||||
| 			" set statusline^=%{coc#status()}%{get(b:,'coc_current_function',"")} | ||||
| 
 | ||||
| 			" Using CocList | ||||
| 			" Show all diagnostics | ||||
| 			nnoremap <silent> <space>a  :<C-u>CocList diagnostics<cr> | ||||
| 			" Manage extensions | ||||
| 			nnoremap <silent> <space>e  :<C-u>CocList extensions<cr> | ||||
| 			" Show commands | ||||
| 			nnoremap <silent> <space>c  :<C-u>CocList commands<cr> | ||||
| 			" Find symbol of current document | ||||
| 			nnoremap <silent> <space>o  :<C-u>CocList outline<cr> | ||||
| 			" Search workspace symbols | ||||
| 			nnoremap <silent> <space>s  :<C-u>CocList -I symbols<cr> | ||||
| 			" Do default action for next item. | ||||
| 			nnoremap <silent> <space>j  :<C-u>CocNext<CR> | ||||
| 			" Do default action for previous item. | ||||
| 			nnoremap <silent> <space>k  :<C-u>CocPrev<CR> | ||||
| 			" Resume latest coc list | ||||
| 			nnoremap <silent> <space>p  :<C-u>CocListResume<CR> | ||||
| 
 | ||||
| 			au BufNewFile,BufRead *.frag,*.vert,*.fp,*.vp,*.glsl setf glsl | ||||
| 				''; | ||||
| 			}; | ||||
| 		} | ||||
| 	)]; | ||||
| } | ||||
							
								
								
									
										13
									
								
								bowl/unstable.nix
									
									
									
									
									
										Normal file
									
								
							
							
						
						
									
										13
									
								
								bowl/unstable.nix
									
									
									
									
									
										Normal file
									
								
							|  | @ -0,0 +1,13 @@ | |||
| { config, pkgs, ... }: | ||||
| 
 | ||||
| 
 | ||||
| let | ||||
|   unstable = import <nixos-unstable> {}; | ||||
| in { | ||||
|   nix.nixPath = [  | ||||
|     "nixos-unstable=https://nixos.org/channels/nixos-unstable/nixexprs.tar.xz" | ||||
|   ]; | ||||
| 
 | ||||
|   #currently installed this software through nix-env -f https://nixos.org/channels/nixos-unstable -iA [ packages ] | ||||
|   environment.systemPackages = [ unstable.ripcord ]; | ||||
| } | ||||
|  | @ -1,74 +0,0 @@ | |||
| { config, pkgs, ... }: | ||||
| { | ||||
| imports = | ||||
|         [ # Include the results of the hardware scan. | ||||
|           ./hardware-configuration.nix | ||||
|           ./taskd.nix | ||||
| 	  ./nextcloud.nix | ||||
| 	  ./networking.nix | ||||
| #	  ./wireguard.nix | ||||
| #	  ./shiori.nix | ||||
| 	  ./shaarli.nix | ||||
| #	  ./shaarli-tokudan.nix | ||||
| 	  ./mod-wallabag.nix | ||||
| #	  ./pkg-wallabag.nix | ||||
| 	  ./navidrome.nix | ||||
| 	  ./pkg-navidrome.nix | ||||
| 	  ./wallabag.nix | ||||
| 	  ./headphones.nix | ||||
| 	  #./dns.nix | ||||
| 	  ./backup.nix | ||||
| 	  ./monitoring.nix | ||||
|         ]; | ||||
| 
 | ||||
|                 boot.loader.grub.devices = [ "/dev/sda" ]; | ||||
|                 boot.loader.grub.enable = true; | ||||
|                 boot.loader.grub.version = 2; | ||||
|                 boot.loader.grub.enableCryptodisk = true; | ||||
|                 boot.loader.supportsInitrdSecrets = true; | ||||
|          | ||||
|                 boot.initrd.kernelModules = [ "dm-snapshot" ]; | ||||
|                 boot.initrd.availableKernelModules = ["virtio-pci"]; | ||||
|                 boot.initrd.network = { | ||||
|                   enable = true; | ||||
|                   ssh = { | ||||
|                     enable = true; | ||||
|                     port = 2222; | ||||
|                     authorizedKeys = ["ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDKN8/SH55DBiwVoSnTU8k2Pen+wmovL9QaMyehxGEsJJv/8fzwsswGalD4C/4O51LOvdu4UKkZW5hG02uVSK+58p3UV3pOPyoqsu/aDeIsWsqmTeTzUrBIWOlNzcDKnohLz2oGC5YO+wyTJ9Iteq6aGJDjErsW7sG3h5lXCs551EmJNNGhtBQaaoytMNnWqSdlVjDNCijurH7WUpp40U/RjEp532l4rX6eIIj3jBKEFbhZkFSSjqbj4xM4SyFt+Jmigb1RMjsQjmpfY1vDtM84RcYfpTUte/T5w2dkD5H6kccmWnwKSJpm9wXfx4E7lR9APdUGnau2U1+XxiD3ytGl anish@box | ||||
| "]; | ||||
|                     hostKeys = [ "/host_ecdsa_key" ]; | ||||
|                     }; | ||||
|                 }; | ||||
|          | ||||
|                 boot.initrd.luks.devices = { | ||||
|                   "enc-pv" = { | ||||
|                     name = "enc-pv"; | ||||
|                     preLVM = true; | ||||
|                     device = "/dev/disk/by-uuid/425cc402-9221-474f-aaf1-10ac7cd4c93c"; | ||||
|                     allowDiscards = true; | ||||
|                   }; | ||||
|                 }; | ||||
|          | ||||
|                 boot.initrd.secrets = { | ||||
|                   "/host_ecdsa_key" = "/host_ecdsa_key"; | ||||
|                   }; | ||||
|          | ||||
| 
 | ||||
|         boot.cleanTmpDir = true; | ||||
|         boot.kernelModules = [ "dm-snapshot" ]; | ||||
| 
 | ||||
| 	users.users.anish = { | ||||
| 		isNormalUser = true; | ||||
| 		extraGroups = [ "wheel" ]; | ||||
| 		hashedPassword = "MO0Pbd2O4eIlA"; | ||||
| 		openssh.authorizedKeys.keys = [ "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDKN8/SH55DBiwVoSnTU8k2Pen+wmovL9QaMyehxGEsJJv/8fzwsswGalD4C/4O51LOvdu4UKkZW5hG02uVSK+58p3UV3pOPyoqsu/aDeIsWsqmTeTzUrBIWOlNzcDKnohLz2oGC5YO+wyTJ9Iteq6aGJDjErsW7sG3h5lXCs551EmJNNGhtBQaaoytMNnWqSdlVjDNCijurH7WUpp40U/RjEp532l4rX6eIIj3jBKEFbhZkFSSjqbj4xM4SyFt+Jmigb1RMjsQjmpfY1vDtM84RcYfpTUte/T5w2dkD5H6kccmWnwKSJpm9wXfx4E7lR9APdUGnau2U1+XxiD3ytGl anish@box ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDM8kTdMGGmr6mv/zv+K9qVjhzqwivyyN5IV04R7/kcWKw1c6ZEzzqqmsnJ/hci6IIxZ/VEUzMhYz0iBCL0wJHHMxYoNCgISWePtDlVJdyrzm9OWjJNcRStZBW3XcY9dELJsCVcQ4LAVYE4vA+MdmbwM2FZgJhAH6qUzujpfNrj/YIVG7MTN6tbUd63uZF57F43c8WUjgRJx2o7Wl9bSe6v3PZ4fAgEO+wQPso+W+pEXLZ3hBNrHdybwdoGvG9tHlBDbLid11BxtpzmwR9CydDfpbyOXB2+tJkkNXhsHB22mN/2+vGWYhDKYPTFqbDW7McDfQChySyYDdZWmg5WHIGz anish@curve" ]; | ||||
| 	}; | ||||
| 
 | ||||
|         users.users.root.initialHashedPassword = ""; | ||||
|         services.openssh.permitRootLogin = "prohibit-password"; | ||||
|         networking.hostName = "bowl"; | ||||
|         services.openssh.enable = true; | ||||
|         services.logind.lidSwitch = "ignore"; | ||||
| 	system.stateVersion = "20.09"; | ||||
| 	time.timeZone = "Australia/Brisbane"; | ||||
| } | ||||
|  | @ -1,29 +0,0 @@ | |||
| # Do not modify this file!  It was generated by ‘nixos-generate-config’ | ||||
| # and may be overwritten by future invocations.  Please make changes | ||||
| # to /etc/nixos/configuration.nix instead. | ||||
| { config, lib, pkgs, modulesPath, ... }: | ||||
| 
 | ||||
| { | ||||
|   imports = | ||||
|     [ (modulesPath + "/installer/scan/not-detected.nix") | ||||
|     ]; | ||||
| 
 | ||||
|   boot.initrd.availableKernelModules = [ "ehci_pci" "ahci" "usb_storage" "sd_mod" "sr_mod" ]; | ||||
|   boot.initrd.kernelModules = [ "dm-snapshot" ]; | ||||
|   boot.kernelModules = [ "kvm-intel" ]; | ||||
|   boot.extraModulePackages = [ ]; | ||||
| 
 | ||||
|   fileSystems."/" = | ||||
|     { device = "/dev/disk/by-uuid/d64cc666-2569-403d-8629-32c65732f683"; | ||||
|       fsType = "ext4"; | ||||
|     }; | ||||
| 
 | ||||
|   fileSystems."/data" =  | ||||
|     { device = "/dev/disk/by-uuid/d85b6c90-501c-4f8d-adfd-84f8d66b203a"; | ||||
|       fsType = "ext4"; | ||||
|     }; | ||||
| 
 | ||||
|   swapDevices = | ||||
|     [ { device = "/dev/disk/by-uuid/e2479d1b-af81-44ed-ae47-0f7aee2817b8"; } | ||||
|     ]; | ||||
| } | ||||
							
								
								
									
										52
									
								
								machines/helix.nix
									
									
									
									
									
										Normal file
									
								
							
							
						
						
									
										52
									
								
								machines/helix.nix
									
									
									
									
									
										Normal file
									
								
							|  | @ -0,0 +1,52 @@ | |||
| { config, pkgs, ... }: | ||||
| { | ||||
|   imports = | ||||
|     [ # Include the results of the hardware scan. | ||||
|       ./hardware-configuration.nix | ||||
|       ./wireguard.nix | ||||
|       ./matrix.nix | ||||
|     ]; | ||||
| 
 | ||||
|   # Use the GRUB 2 boot loader. | ||||
|   boot.loader.grub.enable = true; | ||||
|   boot.loader.grub.version = 2; | ||||
|   boot.loader.grub.device = "/dev/vda"; # or "nodev" for efi only | ||||
| 
 | ||||
|   networking.hostName = "helix"; # Define your hostname. | ||||
| 
 | ||||
|   networking.useDHCP = false; | ||||
|   networking.interfaces.ens3.useDHCP = true; | ||||
| 
 | ||||
|   # Configure network proxy if necessary | ||||
|   # networking.proxy.default = "http://user:password@proxy:port/"; | ||||
|   # networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain"; | ||||
| 
 | ||||
|   # Enable the OpenSSH daemon. | ||||
|   services.openssh.enable = true; | ||||
|   #services.openssh.passwordAuthentication = false; | ||||
|   services.openssh.permitRootLogin = "no"; | ||||
| 
 | ||||
|   # Open ports in the firewall. | ||||
|   # networking.firewall.allowedTCPPorts = [ ... ]; | ||||
|   # networking.firewall.allowedUDPPorts = [ ... ]; | ||||
|   # Or disable the firewall altogether. | ||||
|   # networking.firewall.enable = false; | ||||
| 
 | ||||
|   # Define a user account. Don't forget to set a password with ‘passwd’. | ||||
|   users.users.anish = { | ||||
|     isNormalUser = true; | ||||
|     extraGroups = [ "wheel" ]; # Enable ‘sudo’ for the user | ||||
|     openssh.authorizedKeys.keys = [ | ||||
| 	"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDM8kTdMGGmr6mv/zv+K9qVjhzqwivyyN5IV04R7/kcWKw1c6ZEzzqqmsnJ/hci6IIxZ/VEUzMhYz0iBCL0wJHHMxYoNCgISWePtDlVJdyrzm9OWjJNcRStZBW3XcY9dELJsCVcQ4LAVYE4vA+MdmbwM2FZgJhAH6qUzujpfNrj/YIVG7MTN6tbUd63uZF57F43c8WUjgRJx2o7Wl9bSe6v3PZ4fAgEO+wQPso+W+pEXLZ3hBNrHdybwdoGvG9tHlBDbLid11BxtpzmwR9CydDfpbyOXB2+tJkkNXhsHB22mN/2+vGWYhDKYPTFqbDW7McDfQChySyYDdZWmg5WHIGz anish@curve"   | ||||
| 	"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCeWQsf9rbE+KBrWLkLkg1PMKx0jPfDP8xyv+XtddIQzAskRTN+JSSQp1GpoRgfQij7bx6f6DfjkwSQK5NWDQNQ+klGhcdEwEdptWUzpRAvKHMImjyIwFHmRKKEgcfH8+DSHVM93nRSQKrLezX4PzPkHF9f3TLxFdGeQDeY0J2oP2Oa97hRtuTJZW9BwUojyvDYUbg7F3fxf+pdFCvIAFaayiLkhOYdTXnjLt1Ks6NOhSzM78ZibHv4pFYI9r6dhflkFP/SzyLeSSm1aVAtxqE7vF5HnnORAg0byDsiOv/9RXxiDx7gkAAw3xENDSpp9TRj54M7iz1OSsRMhmD6orHjZFIRejlE4DIn+PBPm3PH+U5ILKTogE6n5MfPT28V0QdtHuqq3b5tSWiDcFpnjxbIUmEIo5hLzMR0tXZoNLQhBCSNfxjE8CYzpk7mHbvhSs2GPfG+NI1vvldbw2EF8beJFQHNYTqJw8y7p8RXpCwZqqpSitJX6v9DiYdLVG1hWvE= nix-on-droid@localhost" | ||||
| 	 "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDKN8/SH55DBiwVoSnTU8k2Pen+wmovL9QaMyehxGEsJJv/8fzwsswGalD4C/4O51LOvdu4UKkZW5hG02uVSK+58p3UV3pOPyoqsu/aDeIsWsqmTeTzUrBIWOlNzcDKnohLz2oGC5YO+wyTJ9Iteq6aGJDjErsW7sG3h5lXCs551EmJNNGhtBQaaoytMNnWqSdlVjDNCijurH7WUpp40U/RjEp532l4rX6eIIj3jBKEFbhZkFSSjqbj4xM4SyFt+Jmigb1RMjsQjmpfY1vDtM84RcYfpTUte/T5w2dkD5H6kccmWnwKSJpm9wXfx4E7lR9APdUGnau2U1+XxiD3ytGl anish@box" ]; | ||||
|   }; | ||||
| 
 | ||||
|   # This value determines the NixOS release with which your system is to be | ||||
|   # compatible, in order to avoid breaking some software such as database | ||||
|   # servers. You should change this only after NixOS release notes say you | ||||
|   # should. | ||||
|   system.stateVersion = "19.09"; # Did you read the comment? | ||||
| 
 | ||||
| } | ||||
| 
 | ||||
							
								
								
									
										153
									
								
								modules/matrix-slack.nix
									
									
									
									
									
										Normal file
									
								
							
							
						
						
									
										153
									
								
								modules/matrix-slack.nix
									
									
									
									
									
										Normal file
									
								
							|  | @ -0,0 +1,153 @@ | |||
| { config, pkgs, lib, ... }: | ||||
| 
 | ||||
| with lib; | ||||
| 
 | ||||
| let | ||||
|   dataDir = "/var/lib/matrix-appservice-slack"; | ||||
|   registrationFile = "${dataDir}/slack-registration.yaml"; | ||||
|   #appDir = "${pkgs.matrix-appservice-slack}/${pkgs.matrix-appservice-slack.passthru.nodeAppDir}"; | ||||
|   cfg = config.services.matrix-appservice-slack; | ||||
|   # TODO: switch to configGen.json once RFC42 is implemented | ||||
|   settingsFile = pkgs.writeText "matrix-appservice-slack-settings.json" (builtins.toJSON cfg.settings); | ||||
| 
 | ||||
| in { | ||||
|   options = { | ||||
|     services.matrix-appservice-slack = { | ||||
|       enable = mkEnableOption "a bridge between Matrix and Slack"; | ||||
| 
 | ||||
|       settings = mkOption rec { | ||||
|         # TODO: switch to types.config.json as prescribed by RFC42 once it's implemented | ||||
|         type = types.attrs; | ||||
|         apply = recursiveUpdate default; | ||||
|         default = { | ||||
|           # empty values necessary for registration file generation | ||||
|           # actual values defined in environmentFile | ||||
|           auth = { | ||||
|             clientID = ""; | ||||
|             botToken = ""; | ||||
|           }; | ||||
|         }; | ||||
|         example = literalExample '' | ||||
|           { | ||||
|             bridge = { | ||||
|               domain = "public-domain.tld"; | ||||
|               homeserverUrl = "http://public-domain.tld:8008"; | ||||
|             }; | ||||
|           } | ||||
|         ''; | ||||
|         description = '' | ||||
|           <filename>config.yaml</filename> configuration as a Nix attribute set. | ||||
|           </para> | ||||
| 
 | ||||
|           <para> | ||||
|           Configuration options should match those described in | ||||
|           <link xlink:href="https://github.com/Half-Shot/matrix-appservice-discord/blob/master/config/config.sample.yaml"> | ||||
|           config.sample.yaml</link>. | ||||
|           </para> | ||||
| 
 | ||||
|           <para> | ||||
|           <option>config.bridge.domain</option> and <option>config.bridge.homeserverUrl</option> | ||||
|           should be set to match the public host name of the Matrix homeserver for webhooks and avatars to work. | ||||
|           </para> | ||||
| 
 | ||||
|           <para> | ||||
|           Secret tokens should be specified using <option>environmentFile</option> | ||||
|           instead of this world-readable attribute set. | ||||
|         ''; | ||||
|       }; | ||||
| 
 | ||||
|       environmentFile = mkOption { | ||||
|         type = types.nullOr types.path; | ||||
|         default = null; | ||||
|         description = '' | ||||
|           File containing environment variables to be passed to the matrix-appservice-discord service, | ||||
|           in which secret tokens can be specified securely by defining values for | ||||
|           <literal>APPSERVICE_SLACK_AUTH_CLIENT_I_D</literal> and | ||||
|           <literal>APPSERVICE_SLACK_AUTH_BOT_TOKEN</literal>. | ||||
|         ''; | ||||
|       }; | ||||
| 
 | ||||
|       url = mkOption { | ||||
|         type = types.str; | ||||
|         default = "http://localhost:${toString cfg.port}"; | ||||
|         description = '' | ||||
|           The URL where the application service is listening for HS requests. | ||||
|         ''; | ||||
|       }; | ||||
| 
 | ||||
|       port = mkOption { | ||||
|         type = types.port; | ||||
|         default = 9898; # from https://github.com/matrix-org/matrix-appservice-slack/blob/develop/config/config.sample.yaml#L70 | ||||
|         description = '' | ||||
|           Port number on which the bridge should listen for internal communication with the Matrix homeserver. | ||||
|         ''; | ||||
|       }; | ||||
| 
 | ||||
|       localpart = mkOption { | ||||
|         type = with types; nullOr str; | ||||
|         default = null; | ||||
|         description = '' | ||||
|           The user_id localpart to assign to the AS. | ||||
|         ''; | ||||
|       }; | ||||
| 
 | ||||
|       serviceDependencies = mkOption { | ||||
|         type = with types; listOf str; | ||||
|         default = optional config.services.matrix-synapse.enable "matrix-synapse.service"; | ||||
|         description = '' | ||||
|           List of Systemd services to require and wait for when starting the application service, | ||||
|           such as the Matrix homeserver if it's running on the same host. | ||||
|         ''; | ||||
|       }; | ||||
|     }; | ||||
|   }; | ||||
| 
 | ||||
|   config = mkIf cfg.enable { | ||||
|     systemd.services.matrix-appservice-slack = { | ||||
|       description = "A bridge between Matrix and Slack."; | ||||
| 
 | ||||
|       wantedBy = [ "multi-user.target" ]; | ||||
|       wants = [ "network-online.target" ] ++ cfg.serviceDependencies; | ||||
|       after = [ "network-online.target" ] ++ cfg.serviceDependencies; | ||||
| 
 | ||||
|       preStart = '' | ||||
|         if [ ! -f '${registrationFile}' ]; then | ||||
|           ${pkgs.matrix-appservice-slack}/bin/matrix-appservice-slack \ | ||||
|             --generate-registration \ | ||||
|             --url=${escapeShellArg cfg.url} \ | ||||
|             ${optionalString (cfg.localpart != null) "--localpart=${escapeShellArg cfg.localpart}"} \ | ||||
|             --config='${settingsFile}' \ | ||||
|             --file='${registrationFile}' | ||||
|         fi | ||||
|       ''; | ||||
| 
 | ||||
|       serviceConfig = { | ||||
|         Type = "simple"; | ||||
|         Restart = "always"; | ||||
| 
 | ||||
|         ProtectSystem = "strict"; | ||||
|         ProtectHome = true; | ||||
|         ProtectKernelTunables = true; | ||||
|         ProtectKernelModules = true; | ||||
|         ProtectControlGroups = true; | ||||
| 
 | ||||
|         DynamicUser = true; | ||||
|         PrivateTmp = true; | ||||
|         #WorkingDirectory = appDir; | ||||
|         StateDirectory = baseNameOf dataDir; | ||||
|         UMask = 0027; | ||||
|         EnvironmentFile = cfg.environmentFile; | ||||
| 
 | ||||
|         ExecStart = '' | ||||
|           ${pkgs.matrix-appservice-slack}/bin/matrix-appservice-slack \ | ||||
|             --file='${registrationFile}' \ | ||||
|             --config='${settingsFile}' \ | ||||
|             --port='${toString cfg.port}' | ||||
|         ''; | ||||
|       }; | ||||
|     }; | ||||
|   }; | ||||
| 
 | ||||
|   meta.maintainers = with maintainers; [ chickensoupandrice ]; | ||||
| } | ||||
| 
 | ||||
							
								
								
									
										258
									
								
								modules/matrix.nix
									
									
									
									
									
										Normal file
									
								
							
							
						
						
									
										258
									
								
								modules/matrix.nix
									
									
									
									
									
										Normal file
									
								
							|  | @ -0,0 +1,258 @@ | |||
| { config, lib, pkgs, ... }: | ||||
| 
 | ||||
| { | ||||
|   imports = [ ./matrix-slack.nix ./mautrix-whatsapp.nix ]; | ||||
|   security.acme.email = "anish+acme@lakhwara.com"; | ||||
|   security.acme.acceptTerms = true; | ||||
|   services.matrix-synapse = { | ||||
|     enable = true; | ||||
|     app_service_config_files = [ | ||||
|     #  # The registration file is automatically generated after starting the appservice for the first time. | ||||
|     #  # cp /var/lib/matrix-appservice-discord/discord-registration.yaml /var/lib/matrix-synapse/ | ||||
|     #  # chown matrix-synapse:matrix-synapse /var/lib/matrix-synapse/discord-registration.yaml | ||||
|     #   "/var/lib/matrix-synapse/discord-registration.yaml" | ||||
|        "/var/lib/matrix-synapse/telegram-registration.yaml" | ||||
|        "/var/lib/matrix-synapse/slack-registration.yaml" | ||||
|        "/var/lib/matrix-synapse/whatsapp-registration.yaml" | ||||
|     ]; | ||||
|     server_name = "sealight.xyz"; | ||||
|     registration_shared_secret = "hD9HQGTTDxp0mQsQ5JDsfudWMDiubmZENOgPchIvfBvUlPxlvQSvjoO4wn2L1seU"; | ||||
|     enable_metrics = true; | ||||
|     enable_registration = true; | ||||
|     database_type = "psycopg2"; | ||||
|     database_args = { | ||||
|       database = "matrix-synapse"; | ||||
|     }; | ||||
|     listeners = [ | ||||
|       { | ||||
|         port = 8448; | ||||
|         tls = false; | ||||
|         resources = [ | ||||
|           { | ||||
|             compress = true; | ||||
|             names = ["client" "federation"]; | ||||
|           } | ||||
|         ]; | ||||
|       } | ||||
|     ]; | ||||
|     extraConfig = '' | ||||
|       max_upload_size: "50M" | ||||
|     ''; | ||||
|   }; | ||||
| 
 | ||||
|   services.mautrix-telegram = { | ||||
|     enable = true; | ||||
|     environmentFile = /etc/secrets/telegram.env; # file containing the appservice and telegram tokens | ||||
|     # The appservice is pre-configured to use SQLite by default. It's also possible to use PostgreSQL. | ||||
|     settings = { | ||||
|       homeserver = { | ||||
|         address = "https://chat.sealight.xyz"; | ||||
|         domain = "sealight.xyz"; | ||||
|       }; | ||||
|       appservice = { | ||||
|         provisioning.enabled = false; | ||||
|         id = "telegram"; | ||||
|         public = { | ||||
|           enabled = false; | ||||
|           prefix = "/public"; | ||||
|           external = "https://chat.sealight.xyz/public"; | ||||
|         }; | ||||
|         # The service uses SQLite by default, but it's also possible to use PostgreSQL instead: | ||||
|         #database = "postgresql:///mautrix-telegram?host=/run/postgresql"; | ||||
|       }; | ||||
|       bridge = { | ||||
|         relaybot.authless_portals = false; | ||||
|         permissions = { | ||||
|           "@aynish:sealight.xyz" = "admin"; | ||||
|         }; | ||||
|       }; | ||||
|     }; | ||||
|   }; | ||||
| 
 | ||||
|   services.mautrix-whatsapp = { | ||||
|     enable = true; | ||||
|     # The appservice is pre-configured to use SQLite by default. It's also possible to use PostgreSQL. | ||||
|     configOptions = { | ||||
|       homeserver = { | ||||
|         address = "https://chat.sealight.xyz"; | ||||
|         domain = "sealight.xyz"; | ||||
|       }; | ||||
|       appservice = { | ||||
|         id = "whatsapp"; | ||||
| 	address = http://localhost:9897; | ||||
| 	hostname = "0.0.0.0"; | ||||
| 	port = 9897; | ||||
| 	database = { | ||||
|   	  type = "sqlite3"; | ||||
|   	  uri = "/var/lib/mautrix-whatsapp/mautrix-whatsapp.db"; | ||||
| 	}; | ||||
| 	state_store_path = "/var/lib/mautrix-whatsapp/mx-state.json"; | ||||
| 	bot = { | ||||
| 	  username = "whatsappbot"; | ||||
| 	  displayname = "WhatsApp bridge bot"; | ||||
| 	  avatar = "mxc://maunium.net/NeXNQarUbrlYBiPCpprYsRqr"; | ||||
| 	}; | ||||
| 	as_token = ""; | ||||
| 	hs_token = ""; | ||||
|       }; | ||||
|       bridge = { | ||||
| 	username_template = "whatsapp_{{.}}"; | ||||
| 	displayname_template = "{{if .Notify}}{{.Notify}}{{else}}{{.Jid}}{{end}} (WA)"; | ||||
| 	command_prefix = "!wa"; | ||||
| 	permissions = { | ||||
| 		"@aynish:sealight.xyz" = 100; | ||||
| 	}; | ||||
|       }; | ||||
|       logging = { | ||||
|         directory = "/var/lib/mautrix-whatsapp/logs"; | ||||
| 	file_name_format = "{{.Date}}-{{.Index}}.log"; | ||||
| 	file_date_format = "\"2006-01-02\""; | ||||
| 	file_mode = 384; | ||||
| 	timestamp_format = "Jan _2, 2006 15:04:05"; | ||||
| 	print_level = "debug"; | ||||
|       }; | ||||
|       metrics = { | ||||
| 	enabled = true; | ||||
| 	listen  = "http://localhost:5070"; | ||||
|       }; | ||||
|     }; | ||||
|   }; | ||||
| 
 | ||||
|   services.matrix-appservice-slack = { | ||||
|     enable = true; | ||||
|     #environmentFile = /etc/secrets/matrix-appservice-slack.env; | ||||
|     settings = { | ||||
|       homeserver = { | ||||
|         server_name = "sealight.xyz"; | ||||
|         url = "https://chat.sealight.xyz"; | ||||
|       }; | ||||
|       db = { | ||||
|         engine = "postgres"; | ||||
|         connectionString = "postgres://slackbridge_user:somethingverysecret@localhost/slack_bridge?sslmode=require"; | ||||
|       }; | ||||
|       matrix_admin_room = "!ikEWOHCcmoZtVzSmPF:sealight.xyz"; | ||||
|       username_prefix = "slack_"; | ||||
|       rtm = { | ||||
|         enable = true; | ||||
|         logging = "silent"; | ||||
|       }; | ||||
|       slack_hook_port = 9899; | ||||
|       enable_metrics = true; | ||||
|       puppeting = { | ||||
|         enabled = true; | ||||
|         onboard_users = true; | ||||
|       }; | ||||
|       oauth2 = { | ||||
|         client_id = "2832868673.1609454840563"; | ||||
|         client_secret = "079a7ca42b192e66a9ff32740a69cb9d"; | ||||
|         redirect_prefix = "https://sealight.xyz/slackbridge/"; | ||||
|       }; | ||||
|       #team_sync = { | ||||
|       #  T02QGRJKT = { | ||||
|       #    users = { | ||||
|       #      enabled = false; | ||||
|       #    }; | ||||
|       #    channels = { | ||||
|       #       enabled = true; | ||||
|       #       alias_prefix = "qf_"; | ||||
|       #    }; | ||||
|       #  }; | ||||
|       #}; | ||||
|     }; | ||||
|   }; | ||||
| 
 | ||||
|   services.postgresql = { | ||||
|     enable = true; | ||||
|     ## postgresql user and db name remains in the | ||||
|     ## service.matrix-synapse.database_args setting which | ||||
|     ## by default is matrix-synapse | ||||
|     initialScript = pkgs.writeText "synapse-init.sql" '' | ||||
|         CREATE ROLE "matrix-synapse" WITH LOGIN PASSWORD "Da0?H*9i{x?,]|'kq@iBwlIzu"; | ||||
|         CREATE DATABASE "matrix-synapse" WITH OWNER "matrix-synapse" | ||||
|             TEMPLATE template0 | ||||
|             LC_COLLATE = "C" | ||||
|             LC_CTYPE = "C"; | ||||
|         ''; | ||||
|   }; | ||||
| 
 | ||||
|   networking.firewall = { | ||||
|     enable = true; | ||||
|     allowedTCPPorts = [ | ||||
|       22    # SSH | ||||
|       8448  # Matrix federation | ||||
|       8008 | ||||
|       80  | ||||
|       443 | ||||
|       9899 # Matrix <-> Slack Bridge Puppeting | ||||
|     ]; | ||||
|   }; | ||||
| 
 | ||||
|  nixpkgs.overlays = [ | ||||
|     (self: super: { | ||||
|         element-web = super.element-web.override { | ||||
|             conf = { | ||||
|                  default_server_config = { | ||||
|                     "m.homeserver" = { | ||||
|                         "base_url" = "https://chat.sealight.xyz"; | ||||
|                         "server_name" = "sealight.xyz"; | ||||
|                     }; | ||||
|                     "m.identity_server" = { | ||||
|                         "base_url" = "https://vector.im"; | ||||
|                     }; | ||||
|                  }; | ||||
| 
 | ||||
|                  ## jitsi will be setup later, | ||||
|                  ## but we need to add to Riot configuration | ||||
|                  #jitsi.preferredDomain = "jitsi.dangerousdemos.net"; | ||||
|             }; | ||||
|         }; | ||||
|     }) | ||||
|   ]; | ||||
| 
 | ||||
|   services.nginx = { | ||||
|    enable = true; | ||||
|    virtualHosts = { | ||||
| 
 | ||||
|      "sealight.xyz" = { | ||||
|        forceSSL = true; | ||||
|        enableACME = true; | ||||
|        locations."/" = { | ||||
|          root = "/var/www/sealight.xyz"; | ||||
|        }; | ||||
|        locations."/_matrix" = { | ||||
|          proxyPass = "http://localhost:8448"; | ||||
|        }; | ||||
|        locations."/slackbridge" = { | ||||
|          proxyPass = "http://localhost:9899"; | ||||
|        }; | ||||
|      }; | ||||
|      ## virtual host for Synapse | ||||
|      "chat.sealight.xyz" = { | ||||
|        forceSSL = true; | ||||
|        enableACME = true; | ||||
|        #useACMEHost = "sealight.xyz"; | ||||
|        locations."/" = { | ||||
|          proxyPass = "http://localhost:8448"; | ||||
|        }; | ||||
|      }; | ||||
| 
 | ||||
|      ## virtual host for Riot/Web | ||||
|      "element.sealight.xyz" = { | ||||
|        forceSSL = true; | ||||
|        enableACME = true; | ||||
|        #useACMEHost = "sealight.xyz"; | ||||
| 
 | ||||
|        ## root points to the riot-web package content, also configured via Nix | ||||
|        locations."/" = { | ||||
|            root = pkgs.element-web; | ||||
|        }; | ||||
|      }; | ||||
|    }; | ||||
|    ## other nginx specific best practices | ||||
|    recommendedGzipSettings = true; | ||||
|    recommendedOptimisation = true; | ||||
|    recommendedTlsSettings = true; | ||||
|   }; | ||||
| 
 | ||||
|   environment.systemPackages = with pkgs; [ matrix-appservice-slack ]; | ||||
| } | ||||
							
								
								
									
										96
									
								
								modules/mautrix-whatsapp.nix
									
									
									
									
									
										Normal file
									
								
							
							
						
						
									
										96
									
								
								modules/mautrix-whatsapp.nix
									
									
									
									
									
										Normal file
									
								
							|  | @ -0,0 +1,96 @@ | |||
| { lib, config, pkgs, ... }: | ||||
| 
 | ||||
| with lib; | ||||
| 
 | ||||
| let | ||||
|   cfg = config.services.mautrix-whatsapp; | ||||
| 
 | ||||
|   configFile = pkgs.runCommand "mautrix-whatsapp" { | ||||
|     buildInputs = [ pkgs.mautrix-whatsapp pkgs.remarshal ]; | ||||
|     preferLocalBuild = true; | ||||
|   } '' | ||||
|     mkdir -p $out | ||||
|     ${pkgs.remarshal}/bin/json2yaml -i ${pkgs.writeText "config.json" (builtins.toJSON cfg.configOptions)} \ | ||||
|       -o $out/config.yaml | ||||
| 
 | ||||
|     ${pkgs.mautrix-whatsapp}/bin/mautrix-whatsapp -c $out/config.yaml -g -r $out/registration.yaml | ||||
|   ''; | ||||
| 
 | ||||
| in | ||||
| { | ||||
|   options.services.mautrix-whatsapp = { | ||||
|     enable = mkEnableOption "Mautrix-whatsapp, a puppeting bridge between Matrix and WhatsApp."; | ||||
| 
 | ||||
|     configOptions = mkOption { | ||||
|       type = types.attrs; | ||||
|       description = '' | ||||
|         This options will be transform in YAML configuration file for the bridge | ||||
| 
 | ||||
|         Look <link xlink:href="https://github.com/tulir/mautrix-whatsapp/wiki/Bridge-setup">here</link> for documentation. | ||||
|       ''; | ||||
|       example = { | ||||
|         configOptions = { | ||||
|           homeserver = { | ||||
|             address = https://matrix.org; | ||||
|             domain = "matrix.org"; | ||||
|           }; | ||||
|           appservice = { | ||||
|             address = http://localhost:8080; | ||||
|             hostname = "0.0.0.0"; | ||||
|             port = 8080; | ||||
|             database = { | ||||
|               type = "sqlite3"; | ||||
|               uri = "/var/lib/mautrix-whatsapp/mautrix-whatsapp.db"; | ||||
|             }; | ||||
|             state_store_path = "/var/lib/mautrix-whatsapp/mx-state.json"; | ||||
|             id = "whatsapp"; | ||||
|             bot = { | ||||
|               username = "whatsappbot"; | ||||
|               displayname = "WhatsApp bridge bot"; | ||||
|               avatar = "mxc://maunium.net/NeXNQarUbrlYBiPCpprYsRqr"; | ||||
|             }; | ||||
|             as_token = ""; | ||||
|             hs_token = ""; | ||||
|           }; | ||||
|           bridge = { | ||||
|             username_template = "whatsapp_{{.}}"; | ||||
|             displayname_template = "{{if .Notify}}{{.Notify}}{{else}}{{.Jid}}{{end}} (WA)"; | ||||
|             command_prefix = "!wa"; | ||||
|             permissions = { | ||||
|               "@example:matrix.org" = 100; | ||||
|             }; | ||||
|           }; | ||||
|           logging = { | ||||
|             directory = "/var/lib/mautrix-whatsapp/logs"; | ||||
|             file_name_format = "{{.Date}}-{{.Index}}.log"; | ||||
|             file_date_format = "\"2006-01-02\""; | ||||
|             file_mode = 384; | ||||
|             timestamp_format = "Jan _2, 2006 15:04:05"; | ||||
|             print_level = "debug"; | ||||
|           }; | ||||
|         }; | ||||
|       }; | ||||
|     }; | ||||
|   }; | ||||
| 
 | ||||
|   config = mkIf cfg.enable { | ||||
|     systemd.services.mautrix-whatsapp = { | ||||
|       description = "Mautrix-WhatsApp Service - A WhatsApp bridge for Matrix"; | ||||
|       after = [ "network.target" "matrix-synapse.service" ]; | ||||
|       wantedBy = [ "multi-user.target" ]; | ||||
| 
 | ||||
|       serviceConfig = { | ||||
|         DynamicUser = true; | ||||
|         StateDirectory = "mautrix-whatsapp"; | ||||
| 	LoggingDir = "mautrix-whatsapp"; | ||||
|         ExecStart = '' | ||||
|           ${pkgs.mautrix-whatsapp}/bin/mautrix-whatsapp -c "${configFile}/config.yaml" | ||||
|         ''; | ||||
|         Restart = "on-failure"; | ||||
|       }; | ||||
|     }; | ||||
| 
 | ||||
|     #services.matrix-synapse.app_service_config_files = [ "${configFile}/registration.yaml" ]; | ||||
| 
 | ||||
|   }; | ||||
| } | ||||
							
								
								
									
										17
									
								
								modules/monitoring-helix.nix
									
									
									
									
									
										Normal file
									
								
							
							
						
						
									
										17
									
								
								modules/monitoring-helix.nix
									
									
									
									
									
										Normal file
									
								
							|  | @ -0,0 +1,17 @@ | |||
| { config, pkgs, ... }: { | ||||
|   # grafana configuration | ||||
|   services.grafana = { | ||||
|     enable = true; | ||||
|     domain = "grafana.sealight.xyz"; | ||||
|     port = 2342; | ||||
|     addr = "127.0.0.1"; | ||||
|   }; | ||||
|    | ||||
|   # nginx reverse proxy | ||||
|   services.nginx.virtualHosts.${config.services.grafana.domain} = { | ||||
|     locations."/" = { | ||||
|         proxyPass = "http://127.0.0.1:${toString config.services.grafana.port}"; | ||||
|         proxyWebsockets = true; | ||||
|     }; | ||||
|   }; | ||||
| } | ||||
							
								
								
									
										14
									
								
								modules/sealight.nix
									
									
									
									
									
										Normal file
									
								
							
							
						
						
									
										14
									
								
								modules/sealight.nix
									
									
									
									
									
										Normal file
									
								
							|  | @ -0,0 +1,14 @@ | |||
| { | ||||
|    services.nginx = { | ||||
|       enable = true; | ||||
|       vhost = {  | ||||
| 	  "sealight.xyz" = { | ||||
| 		  forceSSL = true; | ||||
| 		  enableACME = true; | ||||
| 		  locations."/" = { | ||||
| 		    root = "/var/www/sealight.xyz" | ||||
| 		  }; | ||||
|       }; | ||||
|     }; | ||||
|    }; | ||||
| } | ||||
							
								
								
									
										27
									
								
								modules/wireguard-helix.nix
									
									
									
									
									
										Normal file
									
								
							
							
						
						
									
										27
									
								
								modules/wireguard-helix.nix
									
									
									
									
									
										Normal file
									
								
							|  | @ -0,0 +1,27 @@ | |||
| { config, pkgs, lib, ... }: | ||||
| {  | ||||
|   environment.systemPackages = [ pkgs.wireguard pkgs.mosh ]; | ||||
|   networking.nat = { | ||||
|       enable = true; | ||||
|       externalInterface = "ens3"; | ||||
|       internalInterfaces = [ "wg0" ]; | ||||
|   }; | ||||
|   networking.firewall = { | ||||
|     allowedUDPPorts = [ 60990 ]; | ||||
|   }; | ||||
| 
 | ||||
|   networking.wireguard.interfaces.wg0 = { | ||||
|     ips = [ "10.0.69.1/24" ]; | ||||
|     listenPort = 60990; | ||||
|     privateKeyFile = "/var/lib/wireguard/priv"; | ||||
|     peers = [{ # bowl | ||||
|       publicKey = "EzvDUmHXo95S2jKRv/LkH5ItUNOBgM7aQQsaq1WfCRw="; | ||||
|       allowedIPs = [ "10.0.69.2/32" ]; | ||||
|     } | ||||
|     { # line | ||||
|       publicKey = "ViRabGV2Mv0SZUVWnoAUhIzaHEvqRXAZJLq3Bp1oN1k="; | ||||
|       allowedIPs = [ "10.0.69.3/32" ]; | ||||
|     } | ||||
| ]; | ||||
|   }; | ||||
| } | ||||
							
								
								
									
										104
									
								
								nixos-legacy-bios-encrypted.sh
									
									
									
									
									
										Normal file
									
								
							
							
						
						
									
										104
									
								
								nixos-legacy-bios-encrypted.sh
									
									
									
									
									
										Normal file
									
								
							|  | @ -0,0 +1,104 @@ | |||
| #!/usr/bin/env bash | ||||
| set -eux | ||||
| 
 | ||||
| hostname="bowl" | ||||
| password="xxx" | ||||
| 
 | ||||
| diskdev=/dev/sda | ||||
| rootpart=/dev/sda2 | ||||
| 
 | ||||
| # -o clear | ||||
| # -g convert to gpt disk | ||||
| # -n new partition num:start:end +size | ||||
| # ef00 EFI / 8300 linux fs | ||||
| sgdisk -o -g -n 1::+5M -t 1:ef02 -n 2:: -t 2:8300 $diskdev | ||||
| 
 | ||||
| # LVM part | ||||
| echo "$password" | cryptsetup luksFormat --type luks1 -h sha512 $rootpart | ||||
| echo "$password" | cryptsetup luksOpen $rootpart enc-pv | ||||
| 
 | ||||
| pvcreate /dev/mapper/enc-pv | ||||
| vgcreate vg0 /dev/mapper/enc-pv | ||||
| lvcreate -L 8G -n swap vg0 | ||||
| lvcreate -L 40G -n nixos vg0 | ||||
| lvcreate -l '100%FREE' -n home vg0 | ||||
| 
 | ||||
| # format disk | ||||
| mkfs.ext4 -L root /dev/vg0/nixos | ||||
| mkfs.ext4 -L home /dev/vg0/home | ||||
| mkswap -L swap /dev/vg0/swap | ||||
| 
 | ||||
| swapon /dev/vg0/swap | ||||
| mount /dev/vg0/nixos /mnt | ||||
| 
 | ||||
| nix-channel --add https://nixos.org/channels/nixos-unstable nixos | ||||
| nix-channel --update | ||||
| 
 | ||||
| nixos-generate-config --root /mnt | ||||
| 
 | ||||
| for uuid in /dev/disk/by-uuid/* | ||||
| do | ||||
| 	if test $(readlink -f $uuid) = $rootpart | ||||
| 	then | ||||
| 		luksuuid=$uuid | ||||
| 		break | ||||
| 	fi | ||||
| done | ||||
| 
 | ||||
| cat << EOF > /mnt/etc/nixos/configuration.nix | ||||
| { config, pkgs, ... }: | ||||
| { | ||||
| imports = | ||||
|         [ # Include the results of the hardware scan. | ||||
|           ./hardware-configuration.nix | ||||
|         ]; | ||||
|                 boot.loader.grub.devices = [ "/dev/sda" ]; | ||||
|                 boot.loader.grub.enable = true; | ||||
|                 boot.loader.grub.version = 2; | ||||
|                 boot.loader.grub.enableCryptodisk = true; | ||||
|                 boot.loader.supportsInitrdSecrets = true; | ||||
|          | ||||
|                 boot.initrd.kernelModules = [ "dm-snapshot" ]; | ||||
|                 boot.initrd.availableKernelModules = ["virtio-pci"]; | ||||
|                 boot.initrd.network = { | ||||
|                   enable = true; | ||||
|                   ssh = { | ||||
|                     enable = true; | ||||
|                     port = 2222; | ||||
|                     authorizedKeys = ["ssh-rsa xxx"]; | ||||
|                     hostKeys = [ "/host_ecdsa_key" ]; | ||||
|                     }; | ||||
|                 }; | ||||
|          | ||||
|                 boot.initrd.luks.devices = [ | ||||
|                   { | ||||
|                     name = "enc-pv"; | ||||
|                     preLVM = true; | ||||
|                     device = "$luksuuid"; | ||||
|                     allowDiscards = true; | ||||
|                   } | ||||
|                 ]; | ||||
|          | ||||
|                 boot.initrd.secrets = { | ||||
|                   "/host_ecdsa_key" = "/host_ecdsa_key"; | ||||
|                   }; | ||||
|          | ||||
|         boot.cleanTmpDir = true; | ||||
|         boot.kernelModules = [ "dm-snapshot" ]; | ||||
|         nixpkgs.config.allowUnfree = true; | ||||
|         users.users.root.initialHashedPassword = ""; | ||||
|         services.openssh.permitRootLogin = "prohibit-password"; | ||||
|         networking.hostName = "$hostname"; | ||||
|         time.timeZone = "Europe/Paris"; | ||||
|         services.openssh.enable = true; | ||||
|         users.users.root.openssh.authorizedKeys.keys = ["ssh-rsa xxx"]; | ||||
|         system.stateVersion = "20.03"; | ||||
| } | ||||
| EOF | ||||
| 
 | ||||
| ssh-keygen -t ecdsa -N "" -f host_ecdsa_key | ||||
| 
 | ||||
| cp host_ecdsa_key /mnt/ | ||||
| 
 | ||||
| nixos-install --no-root-passwd | ||||
| 
 | ||||
		Loading…
	
		Reference in a new issue