bowl
This commit is contained in:
Anish Lakhwara
commit
c70fa682f2
29
bowl/box.nix
Normal file
29
bowl/box.nix
Normal file
|
|
@ -0,0 +1,29 @@
|
||||||
|
{ config, pkgs, ... }:
|
||||||
|
|
||||||
|
{
|
||||||
|
imports = [
|
||||||
|
./common.nix
|
||||||
|
./musician.nix
|
||||||
|
];
|
||||||
|
|
||||||
|
|
||||||
|
users.extraUsers."anish".extraGroups = [ "jackaudio" ];
|
||||||
|
|
||||||
|
services.xserver = {
|
||||||
|
enable = true;
|
||||||
|
displayManager.gdm.enable = true;
|
||||||
|
desktopManager.gnome3.enable = true;
|
||||||
|
};
|
||||||
|
|
||||||
|
# task whisperer broken
|
||||||
|
#nixpkgs.config.allowBroken = true;
|
||||||
|
|
||||||
|
# virtual box
|
||||||
|
virtualisation.virtualbox.host.enable = true;
|
||||||
|
|
||||||
|
# ErgoDox Firmware (doesn't compile)
|
||||||
|
# environment.systemPackages = with pkgs; [
|
||||||
|
# qmk_firmware
|
||||||
|
# ];
|
||||||
|
}
|
||||||
|
|
||||||
115
bowl/common.nix
Normal file
115
bowl/common.nix
Normal file
|
|
@ -0,0 +1,115 @@
|
||||||
|
{ config, pkgs, ... }:
|
||||||
|
|
||||||
|
{
|
||||||
|
imports = [
|
||||||
|
./nvim.nix
|
||||||
|
# ./unstable.nix
|
||||||
|
];
|
||||||
|
|
||||||
|
|
||||||
|
environment.systemPackages = with pkgs; [
|
||||||
|
htop
|
||||||
|
iftop
|
||||||
|
wget
|
||||||
|
curl
|
||||||
|
exa
|
||||||
|
bat
|
||||||
|
fd
|
||||||
|
ag
|
||||||
|
tcpdump
|
||||||
|
whois
|
||||||
|
mtr
|
||||||
|
file
|
||||||
|
lsof
|
||||||
|
atool
|
||||||
|
inotify-tools
|
||||||
|
strace
|
||||||
|
zip
|
||||||
|
unzip
|
||||||
|
rsync
|
||||||
|
tmux
|
||||||
|
pwgen
|
||||||
|
glow
|
||||||
|
jq
|
||||||
|
gitAndTools.gitFull
|
||||||
|
#neovim defined in ./nvim.nix
|
||||||
|
wofi
|
||||||
|
firefox
|
||||||
|
fractal
|
||||||
|
pinentry_gnome
|
||||||
|
pass
|
||||||
|
gcc
|
||||||
|
less
|
||||||
|
mpv
|
||||||
|
zathura
|
||||||
|
#qmk_firmware
|
||||||
|
python3
|
||||||
|
gdb
|
||||||
|
vcv-rack
|
||||||
|
#xdotool
|
||||||
|
#neofetch
|
||||||
|
#calibre
|
||||||
|
#openvpn
|
||||||
|
gimp
|
||||||
|
xxd
|
||||||
|
tilix
|
||||||
|
kitty
|
||||||
|
taskwarrior
|
||||||
|
gnupg
|
||||||
|
openjdk
|
||||||
|
glslviewer
|
||||||
|
filezilla
|
||||||
|
signal-desktop
|
||||||
|
wire-desktop
|
||||||
|
tdesktop
|
||||||
|
feedreader
|
||||||
|
newsflash
|
||||||
|
syncthing
|
||||||
|
dijo
|
||||||
|
#kdeconnect
|
||||||
|
#ssb-patchwork
|
||||||
|
gnome3.gnome-tweaks
|
||||||
|
gnome3.pomodoro
|
||||||
|
gnomeExtensions.gsconnect
|
||||||
|
#gnomeExtensions.taskwhisperer
|
||||||
|
#gnome3.networkmanager-openvpn
|
||||||
|
#python3Packages.youtube-dl
|
||||||
|
appimage-run
|
||||||
|
home-manager
|
||||||
|
libreoffice
|
||||||
|
fontconfig
|
||||||
|
hugo
|
||||||
|
#processing
|
||||||
|
#nextcloud-client
|
||||||
|
zsh-powerlevel10k
|
||||||
|
powerline-fonts
|
||||||
|
supercollider
|
||||||
|
haskellPackages.tidal
|
||||||
|
# vim-zettel
|
||||||
|
pandoc
|
||||||
|
];
|
||||||
|
|
||||||
|
programs.bash.enableCompletion = true;
|
||||||
|
|
||||||
|
# needed for vcv-rack
|
||||||
|
nixpkgs.config.allowUnfree = true;
|
||||||
|
|
||||||
|
system.copySystemConfiguration = true;
|
||||||
|
services.syncthing = {
|
||||||
|
enable = true;
|
||||||
|
openDefaultPorts = true;
|
||||||
|
systemService = true;
|
||||||
|
user = "anish";
|
||||||
|
dataDir = "/home/anish/usr/syncthing";
|
||||||
|
};
|
||||||
|
|
||||||
|
#zsh powerlevel10k
|
||||||
|
programs.zsh.enable = true;
|
||||||
|
programs.zsh.promptInit = "source ${pkgs.zsh-powerlevel10k}/share/zsh-powerlevel10k/powerlevel10k.zsh-theme";
|
||||||
|
users.users.anish.shell = pkgs.zsh;
|
||||||
|
|
||||||
|
#android
|
||||||
|
programs.adb.enable = true;
|
||||||
|
users.users.anish.extraGroups = ["adbusers"];
|
||||||
|
|
||||||
|
}
|
||||||
24
bowl/musician.nix
Normal file
24
bowl/musician.nix
Normal file
|
|
@ -0,0 +1,24 @@
|
||||||
|
{pkgs, config, ... }:
|
||||||
|
{
|
||||||
|
imports = [
|
||||||
|
/home/anish/usr/musnix
|
||||||
|
];
|
||||||
|
|
||||||
|
musnix.enable = true;
|
||||||
|
users.users.anish.extraGroups = [ "audio" ];
|
||||||
|
|
||||||
|
environment.systemPackages = with pkgs; [ ardour patchage helm ];
|
||||||
|
#services.jack = {
|
||||||
|
# jackd.enable = true;
|
||||||
|
# # support ALSA only programs via ALSA JACK PCM plugin
|
||||||
|
# alsa.enable = false;
|
||||||
|
# # support ALSA only programs via loopback device (supports programs like Steam)
|
||||||
|
# loopback = {
|
||||||
|
# enable = true;
|
||||||
|
# # buffering parameters for dmix device to work with ALSA only semi-professional sound programs
|
||||||
|
# #dmixConfig = ''
|
||||||
|
# # period_size 2048
|
||||||
|
# #'';
|
||||||
|
# };
|
||||||
|
#};
|
||||||
|
}
|
||||||
6
bowl/musnix.nix
Normal file
6
bowl/musnix.nix
Normal file
|
|
@ -0,0 +1,6 @@
|
||||||
|
{
|
||||||
|
imports = [ <musnix> ];
|
||||||
|
musnix.enable = true;
|
||||||
|
|
||||||
|
users.users."anish".extraGroups = [ "audio" ];
|
||||||
|
}
|
||||||
262
bowl/nvim.nix
Normal file
262
bowl/nvim.nix
Normal file
|
|
@ -0,0 +1,262 @@
|
||||||
|
{ pkgs, ... }:
|
||||||
|
|
||||||
|
|
||||||
|
#nvim
|
||||||
|
{
|
||||||
|
environment.variables.EDITOR = "nvim";
|
||||||
|
environment.shellAliases = {
|
||||||
|
k = "vim -c :VimwikiIndex";
|
||||||
|
kz = "vim -c :VimwikiIndex -c :ZettelNew";
|
||||||
|
};
|
||||||
|
environment.systemPackages = with pkgs; [
|
||||||
|
nodejs
|
||||||
|
( neovim.override {
|
||||||
|
vimAlias = true;
|
||||||
|
configure = {
|
||||||
|
packages.myPlugins = with pkgs.vimPlugins; {
|
||||||
|
start = [
|
||||||
|
vim-nix
|
||||||
|
fzf-vim
|
||||||
|
vim-elixir
|
||||||
|
emmet-vim
|
||||||
|
nerdtree
|
||||||
|
goyo-vim
|
||||||
|
vim-sneak
|
||||||
|
lightline-vim
|
||||||
|
csv-vim
|
||||||
|
vimwiki
|
||||||
|
coc-nvim
|
||||||
|
coc-json
|
||||||
|
coc-python
|
||||||
|
coc-pairs
|
||||||
|
coc-emmet
|
||||||
|
emmet-vim
|
||||||
|
LanguageClient-neovim
|
||||||
|
ayu-vim
|
||||||
|
rainbow_parentheses-vim
|
||||||
|
vim-surround
|
||||||
|
vim-fugitive
|
||||||
|
#iron-nvim
|
||||||
|
#nvim-colorizer
|
||||||
|
vim-devicons
|
||||||
|
|
||||||
|
# testing
|
||||||
|
#vim-processing
|
||||||
|
#vim-tidal
|
||||||
|
taskwiki
|
||||||
|
vim-zettel
|
||||||
|
vimwiki-sync
|
||||||
|
];
|
||||||
|
};
|
||||||
|
customRC = ''
|
||||||
|
set tabstop=2
|
||||||
|
set showmatch
|
||||||
|
set shiftwidth=2
|
||||||
|
set noexpandtab
|
||||||
|
set autoindent
|
||||||
|
|
||||||
|
set foldmethod=indent " fold based on indent
|
||||||
|
set number
|
||||||
|
set nocompatible
|
||||||
|
set relativenumber
|
||||||
|
set showtabline=2
|
||||||
|
set autowriteall
|
||||||
|
syntax on
|
||||||
|
set list lcs=tab:\|\
|
||||||
|
filetype plugin on
|
||||||
|
|
||||||
|
set termguicolors
|
||||||
|
let ayucolor="dark"
|
||||||
|
colorscheme ayu
|
||||||
|
|
||||||
|
" window
|
||||||
|
nmap <leader>wh :topleft vnew<CR>
|
||||||
|
nmap <leader>wl :botright vnew<CR>
|
||||||
|
nmap <leader>wk :topleft new<CR>
|
||||||
|
nmap <leader>wj :botright new<CR>
|
||||||
|
|
||||||
|
let mapleader = "\<Space>"
|
||||||
|
|
||||||
|
" lightline colorscheme
|
||||||
|
let g:lightline = {
|
||||||
|
\ 'colorscheme': 'seoul256',
|
||||||
|
\ }
|
||||||
|
|
||||||
|
" moving splits with vim movements.
|
||||||
|
:tnoremap <A-h> <C-\><C-N><C-w>h
|
||||||
|
:tnoremap <A-j> <C-\><C-N><C-w>j
|
||||||
|
:tnoremap <A-k> <C-\><C-N><C-w>k
|
||||||
|
:tnoremap <A-l> <C-\><C-N><C-w>l
|
||||||
|
:inoremap <A-h> <C-\><C-N><C-w>h
|
||||||
|
:inoremap <A-j> <C-\><C-N><C-w>j
|
||||||
|
:inoremap <A-k> <C-\><C-N><C-w>k
|
||||||
|
:inoremap <A-l> <C-\><C-N><C-w>l
|
||||||
|
:nnoremap <A-h> <leader>h
|
||||||
|
:nnoremap <A-j> <leader>j
|
||||||
|
:nnoremap <A-k> <leader>k
|
||||||
|
:nnoremap <A-l> <leader>l
|
||||||
|
:nnoremap <F5> "=strftime("%Y-%m-%d %H:%M:")
|
||||||
|
:inoremap <F5> <C-R>=strftime("%Y-%m-%d %H:%M:")
|
||||||
|
|
||||||
|
" exit normal mode in terminal
|
||||||
|
:tnoremap <C-n> <C-\><C-n>
|
||||||
|
|
||||||
|
let g:syntastic_always_populate_loc_list = 1
|
||||||
|
let g:syntastic_auto_loc_list = 1
|
||||||
|
let g:syntastic_check_on_open = 1
|
||||||
|
let g:syntastic_check_on_wq = 0
|
||||||
|
|
||||||
|
let g:rainbow_active = 0
|
||||||
|
autocmd BufReadPost,BufNewFile c,py,nix RainbowParenthesesToggleAll
|
||||||
|
|
||||||
|
" keyboard commands
|
||||||
|
map <leader>t :NERDTreeToggle<CR>
|
||||||
|
map <leader>s :w<CR>
|
||||||
|
map <leader>q :wq<CR>
|
||||||
|
map <leader>r :RainbowParenthesesToggleAll<CR>
|
||||||
|
map <leader>zs :ZettelSearch<CR>
|
||||||
|
map <leader>zo :ZettelOpen<CR>
|
||||||
|
map <leader>zn :ZettelNew<CR>
|
||||||
|
|
||||||
|
|
||||||
|
" NERDTree
|
||||||
|
" open on directory
|
||||||
|
autocmd StdinReadPre * let s:std_in=1
|
||||||
|
|
||||||
|
" coc
|
||||||
|
"
|
||||||
|
" if hidden is not set, TextEdit might fail.
|
||||||
|
set hidden
|
||||||
|
|
||||||
|
" Some servers have issues with backup files, see #649
|
||||||
|
set nobackup
|
||||||
|
set nowritebackup
|
||||||
|
|
||||||
|
" Better display for messages
|
||||||
|
set cmdheight=2
|
||||||
|
|
||||||
|
" You will have bad experience for diagnostic messages when it's default 4000.
|
||||||
|
set updatetime=300
|
||||||
|
|
||||||
|
" don't give |ins-completion-menu| messages.
|
||||||
|
set shortmess+=c
|
||||||
|
|
||||||
|
" always show signcolumns
|
||||||
|
set signcolumn=yes
|
||||||
|
|
||||||
|
" Use tab for trigger completion with characters ahead and navigate.
|
||||||
|
" Use command ':verbose imap <tab>' to make sure tab is not mapped by other plugin.
|
||||||
|
inoremap <silent><expr> <TAB>
|
||||||
|
\ pumvisible() ? "\<C-n>" :
|
||||||
|
\ <SID>check_back_space() ? "\<TAB>" :
|
||||||
|
\ coc#refresh()
|
||||||
|
inoremap <expr><S-TAB> pumvisible() ? "\<C-p>" : "\<C-h>"
|
||||||
|
|
||||||
|
function! s:check_back_space() abort
|
||||||
|
let col = col('.') - 1
|
||||||
|
return !col || getline('.')[col - 1] =~# '\s'
|
||||||
|
endfunction
|
||||||
|
|
||||||
|
" Use <c-space> to trigger completion.
|
||||||
|
inoremap <silent><expr> <c-space> coc#refresh()
|
||||||
|
|
||||||
|
" Use <cr> to confirm completion, `<C-g>u` means break undo chain at current position.
|
||||||
|
" Coc only does snippet and additional edit on confirm.
|
||||||
|
inoremap <expr> <cr> pumvisible() ? "\<C-y>" : "\<C-g>u\<CR>"
|
||||||
|
" Or use `complete_info` if your vim support it, like:
|
||||||
|
" inoremap <expr> <cr> complete_info()["selected"] != "-1" ? "\<C-y>" : "\<C-g>u\<CR>"
|
||||||
|
|
||||||
|
" Use `[g` and `]g` to navigate diagnostics
|
||||||
|
nmap <silent> [g <Plug>(coc-diagnostic-prev)
|
||||||
|
nmap <silent> ]g <Plug>(coc-diagnostic-next)
|
||||||
|
|
||||||
|
" Remap keys for gotos
|
||||||
|
nmap <silent> gd <Plug>(coc-definition)
|
||||||
|
nmap <silent> gy <Plug>(coc-type-definition)
|
||||||
|
nmap <silent> gi <Plug>(coc-implementation)
|
||||||
|
nmap <silent> gr <Plug>(coc-references)
|
||||||
|
|
||||||
|
" Use K to show documentation in preview window
|
||||||
|
nnoremap <silent> K :call <SID>show_documentation()<CR>
|
||||||
|
|
||||||
|
function! s:show_documentation()
|
||||||
|
if (index(['vim','help'], &filetype) >= 0)
|
||||||
|
execute 'h '.expand('<cword>')
|
||||||
|
else
|
||||||
|
call CocAction('doHover')
|
||||||
|
endif
|
||||||
|
endfunction
|
||||||
|
|
||||||
|
" Highlight symbol under cursor on CursorHold
|
||||||
|
autocmd CursorHold * silent call CocActionAsync('highlight')
|
||||||
|
|
||||||
|
" Remap for rename current word
|
||||||
|
nmap <leader>rn <Plug>(coc-rename)
|
||||||
|
|
||||||
|
" Remap for format selected region
|
||||||
|
xmap <leader>f <Plug>(coc-format-selected)
|
||||||
|
nmap <leader>f <Plug>(coc-format-selected)
|
||||||
|
|
||||||
|
augroup mygroup
|
||||||
|
autocmd!
|
||||||
|
" Setup formatexpr specified filetype(s).
|
||||||
|
autocmd FileType typescript,json setl formatexpr=CocAction('formatSelected')
|
||||||
|
" Update signature help on jump placeholder
|
||||||
|
autocmd User CocJumpPlaceholder call CocActionAsync('showSignatureHelp')
|
||||||
|
augroup end
|
||||||
|
|
||||||
|
" Remap for do codeAction of selected region, ex: `<leader>aap` for current paragraph
|
||||||
|
xmap <leader>a <Plug>(coc-codeaction-selected)
|
||||||
|
nmap <leader>a <Plug>(coc-codeaction-selected)
|
||||||
|
|
||||||
|
" Remap for do codeAction of current line
|
||||||
|
nmap <leader>ac <Plug>(coc-codeaction)
|
||||||
|
" Fix autofix problem of current line
|
||||||
|
nmap <leader>qf <Plug>(coc-fix-current)
|
||||||
|
|
||||||
|
" Create mappings for function text object, requires document symbols feature of languageserver.
|
||||||
|
xmap if <Plug>(coc-funcobj-i)
|
||||||
|
xmap af <Plug>(coc-funcobj-a)
|
||||||
|
omap if <Plug>(coc-funcobj-i)
|
||||||
|
omap af <Plug>(coc-funcobj-a)
|
||||||
|
|
||||||
|
" Use <C-d> for select selections ranges, needs server support, like: coc-tsserver, coc-python
|
||||||
|
nmap <silent> <C-d> <Plug>(coc-range-select)
|
||||||
|
xmap <silent> <C-d> <Plug>(coc-range-select)
|
||||||
|
|
||||||
|
" Use `:Format` to format current buffer
|
||||||
|
command! -nargs=0 Format :call CocAction('format')
|
||||||
|
|
||||||
|
" Use `:Fold` to fold current buffer
|
||||||
|
command! -nargs=? Fold :call CocAction('fold', <f-args>)
|
||||||
|
|
||||||
|
" use `:OR` for organize import of current buffer
|
||||||
|
command! -nargs=0 OR :call CocAction('runCommand', 'editor.action.organizeImport')
|
||||||
|
|
||||||
|
" Add status line support, for integration with other plugin, checkout `:h coc-status`
|
||||||
|
" set statusline^=%{coc#status()}%{get(b:,'coc_current_function',"")}
|
||||||
|
|
||||||
|
" Using CocList
|
||||||
|
" Show all diagnostics
|
||||||
|
nnoremap <silent> <space>a :<C-u>CocList diagnostics<cr>
|
||||||
|
" Manage extensions
|
||||||
|
nnoremap <silent> <space>e :<C-u>CocList extensions<cr>
|
||||||
|
" Show commands
|
||||||
|
nnoremap <silent> <space>c :<C-u>CocList commands<cr>
|
||||||
|
" Find symbol of current document
|
||||||
|
nnoremap <silent> <space>o :<C-u>CocList outline<cr>
|
||||||
|
" Search workspace symbols
|
||||||
|
nnoremap <silent> <space>s :<C-u>CocList -I symbols<cr>
|
||||||
|
" Do default action for next item.
|
||||||
|
nnoremap <silent> <space>j :<C-u>CocNext<CR>
|
||||||
|
" Do default action for previous item.
|
||||||
|
nnoremap <silent> <space>k :<C-u>CocPrev<CR>
|
||||||
|
" Resume latest coc list
|
||||||
|
nnoremap <silent> <space>p :<C-u>CocListResume<CR>
|
||||||
|
|
||||||
|
au BufNewFile,BufRead *.frag,*.vert,*.fp,*.vp,*.glsl setf glsl
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
}
|
||||||
|
)];
|
||||||
|
}
|
||||||
13
bowl/unstable.nix
Normal file
13
bowl/unstable.nix
Normal file
|
|
@ -0,0 +1,13 @@
|
||||||
|
{ config, pkgs, ... }:
|
||||||
|
|
||||||
|
|
||||||
|
let
|
||||||
|
unstable = import <nixos-unstable> {};
|
||||||
|
in {
|
||||||
|
nix.nixPath = [
|
||||||
|
"nixos-unstable=https://nixos.org/channels/nixos-unstable/nixexprs.tar.xz"
|
||||||
|
];
|
||||||
|
|
||||||
|
#currently installed this software through nix-env -f https://nixos.org/channels/nixos-unstable -iA [ packages ]
|
||||||
|
environment.systemPackages = [ unstable.ripcord ];
|
||||||
|
}
|
||||||
|
|
@ -1,74 +0,0 @@
|
||||||
{ config, pkgs, ... }:
|
|
||||||
{
|
|
||||||
imports =
|
|
||||||
[ # Include the results of the hardware scan.
|
|
||||||
./hardware-configuration.nix
|
|
||||||
./taskd.nix
|
|
||||||
./nextcloud.nix
|
|
||||||
./networking.nix
|
|
||||||
# ./wireguard.nix
|
|
||||||
# ./shiori.nix
|
|
||||||
./shaarli.nix
|
|
||||||
# ./shaarli-tokudan.nix
|
|
||||||
./mod-wallabag.nix
|
|
||||||
# ./pkg-wallabag.nix
|
|
||||||
./navidrome.nix
|
|
||||||
./pkg-navidrome.nix
|
|
||||||
./wallabag.nix
|
|
||||||
./headphones.nix
|
|
||||||
#./dns.nix
|
|
||||||
./backup.nix
|
|
||||||
./monitoring.nix
|
|
||||||
];
|
|
||||||
|
|
||||||
boot.loader.grub.devices = [ "/dev/sda" ];
|
|
||||||
boot.loader.grub.enable = true;
|
|
||||||
boot.loader.grub.version = 2;
|
|
||||||
boot.loader.grub.enableCryptodisk = true;
|
|
||||||
boot.loader.supportsInitrdSecrets = true;
|
|
||||||
|
|
||||||
boot.initrd.kernelModules = [ "dm-snapshot" ];
|
|
||||||
boot.initrd.availableKernelModules = ["virtio-pci"];
|
|
||||||
boot.initrd.network = {
|
|
||||||
enable = true;
|
|
||||||
ssh = {
|
|
||||||
enable = true;
|
|
||||||
port = 2222;
|
|
||||||
authorizedKeys = ["ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDKN8/SH55DBiwVoSnTU8k2Pen+wmovL9QaMyehxGEsJJv/8fzwsswGalD4C/4O51LOvdu4UKkZW5hG02uVSK+58p3UV3pOPyoqsu/aDeIsWsqmTeTzUrBIWOlNzcDKnohLz2oGC5YO+wyTJ9Iteq6aGJDjErsW7sG3h5lXCs551EmJNNGhtBQaaoytMNnWqSdlVjDNCijurH7WUpp40U/RjEp532l4rX6eIIj3jBKEFbhZkFSSjqbj4xM4SyFt+Jmigb1RMjsQjmpfY1vDtM84RcYfpTUte/T5w2dkD5H6kccmWnwKSJpm9wXfx4E7lR9APdUGnau2U1+XxiD3ytGl anish@box
|
|
||||||
"];
|
|
||||||
hostKeys = [ "/host_ecdsa_key" ];
|
|
||||||
};
|
|
||||||
};
|
|
||||||
|
|
||||||
boot.initrd.luks.devices = {
|
|
||||||
"enc-pv" = {
|
|
||||||
name = "enc-pv";
|
|
||||||
preLVM = true;
|
|
||||||
device = "/dev/disk/by-uuid/425cc402-9221-474f-aaf1-10ac7cd4c93c";
|
|
||||||
allowDiscards = true;
|
|
||||||
};
|
|
||||||
};
|
|
||||||
|
|
||||||
boot.initrd.secrets = {
|
|
||||||
"/host_ecdsa_key" = "/host_ecdsa_key";
|
|
||||||
};
|
|
||||||
|
|
||||||
|
|
||||||
boot.cleanTmpDir = true;
|
|
||||||
boot.kernelModules = [ "dm-snapshot" ];
|
|
||||||
|
|
||||||
users.users.anish = {
|
|
||||||
isNormalUser = true;
|
|
||||||
extraGroups = [ "wheel" ];
|
|
||||||
hashedPassword = "MO0Pbd2O4eIlA";
|
|
||||||
openssh.authorizedKeys.keys = [ "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDKN8/SH55DBiwVoSnTU8k2Pen+wmovL9QaMyehxGEsJJv/8fzwsswGalD4C/4O51LOvdu4UKkZW5hG02uVSK+58p3UV3pOPyoqsu/aDeIsWsqmTeTzUrBIWOlNzcDKnohLz2oGC5YO+wyTJ9Iteq6aGJDjErsW7sG3h5lXCs551EmJNNGhtBQaaoytMNnWqSdlVjDNCijurH7WUpp40U/RjEp532l4rX6eIIj3jBKEFbhZkFSSjqbj4xM4SyFt+Jmigb1RMjsQjmpfY1vDtM84RcYfpTUte/T5w2dkD5H6kccmWnwKSJpm9wXfx4E7lR9APdUGnau2U1+XxiD3ytGl anish@box ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDM8kTdMGGmr6mv/zv+K9qVjhzqwivyyN5IV04R7/kcWKw1c6ZEzzqqmsnJ/hci6IIxZ/VEUzMhYz0iBCL0wJHHMxYoNCgISWePtDlVJdyrzm9OWjJNcRStZBW3XcY9dELJsCVcQ4LAVYE4vA+MdmbwM2FZgJhAH6qUzujpfNrj/YIVG7MTN6tbUd63uZF57F43c8WUjgRJx2o7Wl9bSe6v3PZ4fAgEO+wQPso+W+pEXLZ3hBNrHdybwdoGvG9tHlBDbLid11BxtpzmwR9CydDfpbyOXB2+tJkkNXhsHB22mN/2+vGWYhDKYPTFqbDW7McDfQChySyYDdZWmg5WHIGz anish@curve" ];
|
|
||||||
};
|
|
||||||
|
|
||||||
users.users.root.initialHashedPassword = "";
|
|
||||||
services.openssh.permitRootLogin = "prohibit-password";
|
|
||||||
networking.hostName = "bowl";
|
|
||||||
services.openssh.enable = true;
|
|
||||||
services.logind.lidSwitch = "ignore";
|
|
||||||
system.stateVersion = "20.09";
|
|
||||||
time.timeZone = "Australia/Brisbane";
|
|
||||||
}
|
|
||||||
|
|
@ -1,29 +0,0 @@
|
||||||
# Do not modify this file! It was generated by ‘nixos-generate-config’
|
|
||||||
# and may be overwritten by future invocations. Please make changes
|
|
||||||
# to /etc/nixos/configuration.nix instead.
|
|
||||||
{ config, lib, pkgs, modulesPath, ... }:
|
|
||||||
|
|
||||||
{
|
|
||||||
imports =
|
|
||||||
[ (modulesPath + "/installer/scan/not-detected.nix")
|
|
||||||
];
|
|
||||||
|
|
||||||
boot.initrd.availableKernelModules = [ "ehci_pci" "ahci" "usb_storage" "sd_mod" "sr_mod" ];
|
|
||||||
boot.initrd.kernelModules = [ "dm-snapshot" ];
|
|
||||||
boot.kernelModules = [ "kvm-intel" ];
|
|
||||||
boot.extraModulePackages = [ ];
|
|
||||||
|
|
||||||
fileSystems."/" =
|
|
||||||
{ device = "/dev/disk/by-uuid/d64cc666-2569-403d-8629-32c65732f683";
|
|
||||||
fsType = "ext4";
|
|
||||||
};
|
|
||||||
|
|
||||||
fileSystems."/data" =
|
|
||||||
{ device = "/dev/disk/by-uuid/d85b6c90-501c-4f8d-adfd-84f8d66b203a";
|
|
||||||
fsType = "ext4";
|
|
||||||
};
|
|
||||||
|
|
||||||
swapDevices =
|
|
||||||
[ { device = "/dev/disk/by-uuid/e2479d1b-af81-44ed-ae47-0f7aee2817b8"; }
|
|
||||||
];
|
|
||||||
}
|
|
||||||
52
machines/helix.nix
Normal file
52
machines/helix.nix
Normal file
|
|
@ -0,0 +1,52 @@
|
||||||
|
{ config, pkgs, ... }:
|
||||||
|
{
|
||||||
|
imports =
|
||||||
|
[ # Include the results of the hardware scan.
|
||||||
|
./hardware-configuration.nix
|
||||||
|
./wireguard.nix
|
||||||
|
./matrix.nix
|
||||||
|
];
|
||||||
|
|
||||||
|
# Use the GRUB 2 boot loader.
|
||||||
|
boot.loader.grub.enable = true;
|
||||||
|
boot.loader.grub.version = 2;
|
||||||
|
boot.loader.grub.device = "/dev/vda"; # or "nodev" for efi only
|
||||||
|
|
||||||
|
networking.hostName = "helix"; # Define your hostname.
|
||||||
|
|
||||||
|
networking.useDHCP = false;
|
||||||
|
networking.interfaces.ens3.useDHCP = true;
|
||||||
|
|
||||||
|
# Configure network proxy if necessary
|
||||||
|
# networking.proxy.default = "http://user:password@proxy:port/";
|
||||||
|
# networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";
|
||||||
|
|
||||||
|
# Enable the OpenSSH daemon.
|
||||||
|
services.openssh.enable = true;
|
||||||
|
#services.openssh.passwordAuthentication = false;
|
||||||
|
services.openssh.permitRootLogin = "no";
|
||||||
|
|
||||||
|
# Open ports in the firewall.
|
||||||
|
# networking.firewall.allowedTCPPorts = [ ... ];
|
||||||
|
# networking.firewall.allowedUDPPorts = [ ... ];
|
||||||
|
# Or disable the firewall altogether.
|
||||||
|
# networking.firewall.enable = false;
|
||||||
|
|
||||||
|
# Define a user account. Don't forget to set a password with ‘passwd’.
|
||||||
|
users.users.anish = {
|
||||||
|
isNormalUser = true;
|
||||||
|
extraGroups = [ "wheel" ]; # Enable ‘sudo’ for the user
|
||||||
|
openssh.authorizedKeys.keys = [
|
||||||
|
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDM8kTdMGGmr6mv/zv+K9qVjhzqwivyyN5IV04R7/kcWKw1c6ZEzzqqmsnJ/hci6IIxZ/VEUzMhYz0iBCL0wJHHMxYoNCgISWePtDlVJdyrzm9OWjJNcRStZBW3XcY9dELJsCVcQ4LAVYE4vA+MdmbwM2FZgJhAH6qUzujpfNrj/YIVG7MTN6tbUd63uZF57F43c8WUjgRJx2o7Wl9bSe6v3PZ4fAgEO+wQPso+W+pEXLZ3hBNrHdybwdoGvG9tHlBDbLid11BxtpzmwR9CydDfpbyOXB2+tJkkNXhsHB22mN/2+vGWYhDKYPTFqbDW7McDfQChySyYDdZWmg5WHIGz anish@curve"
|
||||||
|
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCeWQsf9rbE+KBrWLkLkg1PMKx0jPfDP8xyv+XtddIQzAskRTN+JSSQp1GpoRgfQij7bx6f6DfjkwSQK5NWDQNQ+klGhcdEwEdptWUzpRAvKHMImjyIwFHmRKKEgcfH8+DSHVM93nRSQKrLezX4PzPkHF9f3TLxFdGeQDeY0J2oP2Oa97hRtuTJZW9BwUojyvDYUbg7F3fxf+pdFCvIAFaayiLkhOYdTXnjLt1Ks6NOhSzM78ZibHv4pFYI9r6dhflkFP/SzyLeSSm1aVAtxqE7vF5HnnORAg0byDsiOv/9RXxiDx7gkAAw3xENDSpp9TRj54M7iz1OSsRMhmD6orHjZFIRejlE4DIn+PBPm3PH+U5ILKTogE6n5MfPT28V0QdtHuqq3b5tSWiDcFpnjxbIUmEIo5hLzMR0tXZoNLQhBCSNfxjE8CYzpk7mHbvhSs2GPfG+NI1vvldbw2EF8beJFQHNYTqJw8y7p8RXpCwZqqpSitJX6v9DiYdLVG1hWvE= nix-on-droid@localhost"
|
||||||
|
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDKN8/SH55DBiwVoSnTU8k2Pen+wmovL9QaMyehxGEsJJv/8fzwsswGalD4C/4O51LOvdu4UKkZW5hG02uVSK+58p3UV3pOPyoqsu/aDeIsWsqmTeTzUrBIWOlNzcDKnohLz2oGC5YO+wyTJ9Iteq6aGJDjErsW7sG3h5lXCs551EmJNNGhtBQaaoytMNnWqSdlVjDNCijurH7WUpp40U/RjEp532l4rX6eIIj3jBKEFbhZkFSSjqbj4xM4SyFt+Jmigb1RMjsQjmpfY1vDtM84RcYfpTUte/T5w2dkD5H6kccmWnwKSJpm9wXfx4E7lR9APdUGnau2U1+XxiD3ytGl anish@box" ];
|
||||||
|
};
|
||||||
|
|
||||||
|
# This value determines the NixOS release with which your system is to be
|
||||||
|
# compatible, in order to avoid breaking some software such as database
|
||||||
|
# servers. You should change this only after NixOS release notes say you
|
||||||
|
# should.
|
||||||
|
system.stateVersion = "19.09"; # Did you read the comment?
|
||||||
|
|
||||||
|
}
|
||||||
|
|
||||||
153
modules/matrix-slack.nix
Normal file
153
modules/matrix-slack.nix
Normal file
|
|
@ -0,0 +1,153 @@
|
||||||
|
{ config, pkgs, lib, ... }:
|
||||||
|
|
||||||
|
with lib;
|
||||||
|
|
||||||
|
let
|
||||||
|
dataDir = "/var/lib/matrix-appservice-slack";
|
||||||
|
registrationFile = "${dataDir}/slack-registration.yaml";
|
||||||
|
#appDir = "${pkgs.matrix-appservice-slack}/${pkgs.matrix-appservice-slack.passthru.nodeAppDir}";
|
||||||
|
cfg = config.services.matrix-appservice-slack;
|
||||||
|
# TODO: switch to configGen.json once RFC42 is implemented
|
||||||
|
settingsFile = pkgs.writeText "matrix-appservice-slack-settings.json" (builtins.toJSON cfg.settings);
|
||||||
|
|
||||||
|
in {
|
||||||
|
options = {
|
||||||
|
services.matrix-appservice-slack = {
|
||||||
|
enable = mkEnableOption "a bridge between Matrix and Slack";
|
||||||
|
|
||||||
|
settings = mkOption rec {
|
||||||
|
# TODO: switch to types.config.json as prescribed by RFC42 once it's implemented
|
||||||
|
type = types.attrs;
|
||||||
|
apply = recursiveUpdate default;
|
||||||
|
default = {
|
||||||
|
# empty values necessary for registration file generation
|
||||||
|
# actual values defined in environmentFile
|
||||||
|
auth = {
|
||||||
|
clientID = "";
|
||||||
|
botToken = "";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
example = literalExample ''
|
||||||
|
{
|
||||||
|
bridge = {
|
||||||
|
domain = "public-domain.tld";
|
||||||
|
homeserverUrl = "http://public-domain.tld:8008";
|
||||||
|
};
|
||||||
|
}
|
||||||
|
'';
|
||||||
|
description = ''
|
||||||
|
<filename>config.yaml</filename> configuration as a Nix attribute set.
|
||||||
|
</para>
|
||||||
|
|
||||||
|
<para>
|
||||||
|
Configuration options should match those described in
|
||||||
|
<link xlink:href="https://github.com/Half-Shot/matrix-appservice-discord/blob/master/config/config.sample.yaml">
|
||||||
|
config.sample.yaml</link>.
|
||||||
|
</para>
|
||||||
|
|
||||||
|
<para>
|
||||||
|
<option>config.bridge.domain</option> and <option>config.bridge.homeserverUrl</option>
|
||||||
|
should be set to match the public host name of the Matrix homeserver for webhooks and avatars to work.
|
||||||
|
</para>
|
||||||
|
|
||||||
|
<para>
|
||||||
|
Secret tokens should be specified using <option>environmentFile</option>
|
||||||
|
instead of this world-readable attribute set.
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
|
||||||
|
environmentFile = mkOption {
|
||||||
|
type = types.nullOr types.path;
|
||||||
|
default = null;
|
||||||
|
description = ''
|
||||||
|
File containing environment variables to be passed to the matrix-appservice-discord service,
|
||||||
|
in which secret tokens can be specified securely by defining values for
|
||||||
|
<literal>APPSERVICE_SLACK_AUTH_CLIENT_I_D</literal> and
|
||||||
|
<literal>APPSERVICE_SLACK_AUTH_BOT_TOKEN</literal>.
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
|
||||||
|
url = mkOption {
|
||||||
|
type = types.str;
|
||||||
|
default = "http://localhost:${toString cfg.port}";
|
||||||
|
description = ''
|
||||||
|
The URL where the application service is listening for HS requests.
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
|
||||||
|
port = mkOption {
|
||||||
|
type = types.port;
|
||||||
|
default = 9898; # from https://github.com/matrix-org/matrix-appservice-slack/blob/develop/config/config.sample.yaml#L70
|
||||||
|
description = ''
|
||||||
|
Port number on which the bridge should listen for internal communication with the Matrix homeserver.
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
|
||||||
|
localpart = mkOption {
|
||||||
|
type = with types; nullOr str;
|
||||||
|
default = null;
|
||||||
|
description = ''
|
||||||
|
The user_id localpart to assign to the AS.
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
|
||||||
|
serviceDependencies = mkOption {
|
||||||
|
type = with types; listOf str;
|
||||||
|
default = optional config.services.matrix-synapse.enable "matrix-synapse.service";
|
||||||
|
description = ''
|
||||||
|
List of Systemd services to require and wait for when starting the application service,
|
||||||
|
such as the Matrix homeserver if it's running on the same host.
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
config = mkIf cfg.enable {
|
||||||
|
systemd.services.matrix-appservice-slack = {
|
||||||
|
description = "A bridge between Matrix and Slack.";
|
||||||
|
|
||||||
|
wantedBy = [ "multi-user.target" ];
|
||||||
|
wants = [ "network-online.target" ] ++ cfg.serviceDependencies;
|
||||||
|
after = [ "network-online.target" ] ++ cfg.serviceDependencies;
|
||||||
|
|
||||||
|
preStart = ''
|
||||||
|
if [ ! -f '${registrationFile}' ]; then
|
||||||
|
${pkgs.matrix-appservice-slack}/bin/matrix-appservice-slack \
|
||||||
|
--generate-registration \
|
||||||
|
--url=${escapeShellArg cfg.url} \
|
||||||
|
${optionalString (cfg.localpart != null) "--localpart=${escapeShellArg cfg.localpart}"} \
|
||||||
|
--config='${settingsFile}' \
|
||||||
|
--file='${registrationFile}'
|
||||||
|
fi
|
||||||
|
'';
|
||||||
|
|
||||||
|
serviceConfig = {
|
||||||
|
Type = "simple";
|
||||||
|
Restart = "always";
|
||||||
|
|
||||||
|
ProtectSystem = "strict";
|
||||||
|
ProtectHome = true;
|
||||||
|
ProtectKernelTunables = true;
|
||||||
|
ProtectKernelModules = true;
|
||||||
|
ProtectControlGroups = true;
|
||||||
|
|
||||||
|
DynamicUser = true;
|
||||||
|
PrivateTmp = true;
|
||||||
|
#WorkingDirectory = appDir;
|
||||||
|
StateDirectory = baseNameOf dataDir;
|
||||||
|
UMask = 0027;
|
||||||
|
EnvironmentFile = cfg.environmentFile;
|
||||||
|
|
||||||
|
ExecStart = ''
|
||||||
|
${pkgs.matrix-appservice-slack}/bin/matrix-appservice-slack \
|
||||||
|
--file='${registrationFile}' \
|
||||||
|
--config='${settingsFile}' \
|
||||||
|
--port='${toString cfg.port}'
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
meta.maintainers = with maintainers; [ chickensoupandrice ];
|
||||||
|
}
|
||||||
|
|
||||||
258
modules/matrix.nix
Normal file
258
modules/matrix.nix
Normal file
|
|
@ -0,0 +1,258 @@
|
||||||
|
{ config, lib, pkgs, ... }:
|
||||||
|
|
||||||
|
{
|
||||||
|
imports = [ ./matrix-slack.nix ./mautrix-whatsapp.nix ];
|
||||||
|
security.acme.email = "anish+acme@lakhwara.com";
|
||||||
|
security.acme.acceptTerms = true;
|
||||||
|
services.matrix-synapse = {
|
||||||
|
enable = true;
|
||||||
|
app_service_config_files = [
|
||||||
|
# # The registration file is automatically generated after starting the appservice for the first time.
|
||||||
|
# # cp /var/lib/matrix-appservice-discord/discord-registration.yaml /var/lib/matrix-synapse/
|
||||||
|
# # chown matrix-synapse:matrix-synapse /var/lib/matrix-synapse/discord-registration.yaml
|
||||||
|
# "/var/lib/matrix-synapse/discord-registration.yaml"
|
||||||
|
"/var/lib/matrix-synapse/telegram-registration.yaml"
|
||||||
|
"/var/lib/matrix-synapse/slack-registration.yaml"
|
||||||
|
"/var/lib/matrix-synapse/whatsapp-registration.yaml"
|
||||||
|
];
|
||||||
|
server_name = "sealight.xyz";
|
||||||
|
registration_shared_secret = "hD9HQGTTDxp0mQsQ5JDsfudWMDiubmZENOgPchIvfBvUlPxlvQSvjoO4wn2L1seU";
|
||||||
|
enable_metrics = true;
|
||||||
|
enable_registration = true;
|
||||||
|
database_type = "psycopg2";
|
||||||
|
database_args = {
|
||||||
|
database = "matrix-synapse";
|
||||||
|
};
|
||||||
|
listeners = [
|
||||||
|
{
|
||||||
|
port = 8448;
|
||||||
|
tls = false;
|
||||||
|
resources = [
|
||||||
|
{
|
||||||
|
compress = true;
|
||||||
|
names = ["client" "federation"];
|
||||||
|
}
|
||||||
|
];
|
||||||
|
}
|
||||||
|
];
|
||||||
|
extraConfig = ''
|
||||||
|
max_upload_size: "50M"
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
|
||||||
|
services.mautrix-telegram = {
|
||||||
|
enable = true;
|
||||||
|
environmentFile = /etc/secrets/telegram.env; # file containing the appservice and telegram tokens
|
||||||
|
# The appservice is pre-configured to use SQLite by default. It's also possible to use PostgreSQL.
|
||||||
|
settings = {
|
||||||
|
homeserver = {
|
||||||
|
address = "https://chat.sealight.xyz";
|
||||||
|
domain = "sealight.xyz";
|
||||||
|
};
|
||||||
|
appservice = {
|
||||||
|
provisioning.enabled = false;
|
||||||
|
id = "telegram";
|
||||||
|
public = {
|
||||||
|
enabled = false;
|
||||||
|
prefix = "/public";
|
||||||
|
external = "https://chat.sealight.xyz/public";
|
||||||
|
};
|
||||||
|
# The service uses SQLite by default, but it's also possible to use PostgreSQL instead:
|
||||||
|
#database = "postgresql:///mautrix-telegram?host=/run/postgresql";
|
||||||
|
};
|
||||||
|
bridge = {
|
||||||
|
relaybot.authless_portals = false;
|
||||||
|
permissions = {
|
||||||
|
"@aynish:sealight.xyz" = "admin";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
services.mautrix-whatsapp = {
|
||||||
|
enable = true;
|
||||||
|
# The appservice is pre-configured to use SQLite by default. It's also possible to use PostgreSQL.
|
||||||
|
configOptions = {
|
||||||
|
homeserver = {
|
||||||
|
address = "https://chat.sealight.xyz";
|
||||||
|
domain = "sealight.xyz";
|
||||||
|
};
|
||||||
|
appservice = {
|
||||||
|
id = "whatsapp";
|
||||||
|
address = http://localhost:9897;
|
||||||
|
hostname = "0.0.0.0";
|
||||||
|
port = 9897;
|
||||||
|
database = {
|
||||||
|
type = "sqlite3";
|
||||||
|
uri = "/var/lib/mautrix-whatsapp/mautrix-whatsapp.db";
|
||||||
|
};
|
||||||
|
state_store_path = "/var/lib/mautrix-whatsapp/mx-state.json";
|
||||||
|
bot = {
|
||||||
|
username = "whatsappbot";
|
||||||
|
displayname = "WhatsApp bridge bot";
|
||||||
|
avatar = "mxc://maunium.net/NeXNQarUbrlYBiPCpprYsRqr";
|
||||||
|
};
|
||||||
|
as_token = "";
|
||||||
|
hs_token = "";
|
||||||
|
};
|
||||||
|
bridge = {
|
||||||
|
username_template = "whatsapp_{{.}}";
|
||||||
|
displayname_template = "{{if .Notify}}{{.Notify}}{{else}}{{.Jid}}{{end}} (WA)";
|
||||||
|
command_prefix = "!wa";
|
||||||
|
permissions = {
|
||||||
|
"@aynish:sealight.xyz" = 100;
|
||||||
|
};
|
||||||
|
};
|
||||||
|
logging = {
|
||||||
|
directory = "/var/lib/mautrix-whatsapp/logs";
|
||||||
|
file_name_format = "{{.Date}}-{{.Index}}.log";
|
||||||
|
file_date_format = "\"2006-01-02\"";
|
||||||
|
file_mode = 384;
|
||||||
|
timestamp_format = "Jan _2, 2006 15:04:05";
|
||||||
|
print_level = "debug";
|
||||||
|
};
|
||||||
|
metrics = {
|
||||||
|
enabled = true;
|
||||||
|
listen = "http://localhost:5070";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
services.matrix-appservice-slack = {
|
||||||
|
enable = true;
|
||||||
|
#environmentFile = /etc/secrets/matrix-appservice-slack.env;
|
||||||
|
settings = {
|
||||||
|
homeserver = {
|
||||||
|
server_name = "sealight.xyz";
|
||||||
|
url = "https://chat.sealight.xyz";
|
||||||
|
};
|
||||||
|
db = {
|
||||||
|
engine = "postgres";
|
||||||
|
connectionString = "postgres://slackbridge_user:somethingverysecret@localhost/slack_bridge?sslmode=require";
|
||||||
|
};
|
||||||
|
matrix_admin_room = "!ikEWOHCcmoZtVzSmPF:sealight.xyz";
|
||||||
|
username_prefix = "slack_";
|
||||||
|
rtm = {
|
||||||
|
enable = true;
|
||||||
|
logging = "silent";
|
||||||
|
};
|
||||||
|
slack_hook_port = 9899;
|
||||||
|
enable_metrics = true;
|
||||||
|
puppeting = {
|
||||||
|
enabled = true;
|
||||||
|
onboard_users = true;
|
||||||
|
};
|
||||||
|
oauth2 = {
|
||||||
|
client_id = "2832868673.1609454840563";
|
||||||
|
client_secret = "079a7ca42b192e66a9ff32740a69cb9d";
|
||||||
|
redirect_prefix = "https://sealight.xyz/slackbridge/";
|
||||||
|
};
|
||||||
|
#team_sync = {
|
||||||
|
# T02QGRJKT = {
|
||||||
|
# users = {
|
||||||
|
# enabled = false;
|
||||||
|
# };
|
||||||
|
# channels = {
|
||||||
|
# enabled = true;
|
||||||
|
# alias_prefix = "qf_";
|
||||||
|
# };
|
||||||
|
# };
|
||||||
|
#};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
services.postgresql = {
|
||||||
|
enable = true;
|
||||||
|
## postgresql user and db name remains in the
|
||||||
|
## service.matrix-synapse.database_args setting which
|
||||||
|
## by default is matrix-synapse
|
||||||
|
initialScript = pkgs.writeText "synapse-init.sql" ''
|
||||||
|
CREATE ROLE "matrix-synapse" WITH LOGIN PASSWORD "Da0?H*9i{x?,]|'kq@iBwlIzu";
|
||||||
|
CREATE DATABASE "matrix-synapse" WITH OWNER "matrix-synapse"
|
||||||
|
TEMPLATE template0
|
||||||
|
LC_COLLATE = "C"
|
||||||
|
LC_CTYPE = "C";
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
|
||||||
|
networking.firewall = {
|
||||||
|
enable = true;
|
||||||
|
allowedTCPPorts = [
|
||||||
|
22 # SSH
|
||||||
|
8448 # Matrix federation
|
||||||
|
8008
|
||||||
|
80
|
||||||
|
443
|
||||||
|
9899 # Matrix <-> Slack Bridge Puppeting
|
||||||
|
];
|
||||||
|
};
|
||||||
|
|
||||||
|
nixpkgs.overlays = [
|
||||||
|
(self: super: {
|
||||||
|
element-web = super.element-web.override {
|
||||||
|
conf = {
|
||||||
|
default_server_config = {
|
||||||
|
"m.homeserver" = {
|
||||||
|
"base_url" = "https://chat.sealight.xyz";
|
||||||
|
"server_name" = "sealight.xyz";
|
||||||
|
};
|
||||||
|
"m.identity_server" = {
|
||||||
|
"base_url" = "https://vector.im";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
## jitsi will be setup later,
|
||||||
|
## but we need to add to Riot configuration
|
||||||
|
#jitsi.preferredDomain = "jitsi.dangerousdemos.net";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
})
|
||||||
|
];
|
||||||
|
|
||||||
|
services.nginx = {
|
||||||
|
enable = true;
|
||||||
|
virtualHosts = {
|
||||||
|
|
||||||
|
"sealight.xyz" = {
|
||||||
|
forceSSL = true;
|
||||||
|
enableACME = true;
|
||||||
|
locations."/" = {
|
||||||
|
root = "/var/www/sealight.xyz";
|
||||||
|
};
|
||||||
|
locations."/_matrix" = {
|
||||||
|
proxyPass = "http://localhost:8448";
|
||||||
|
};
|
||||||
|
locations."/slackbridge" = {
|
||||||
|
proxyPass = "http://localhost:9899";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
## virtual host for Synapse
|
||||||
|
"chat.sealight.xyz" = {
|
||||||
|
forceSSL = true;
|
||||||
|
enableACME = true;
|
||||||
|
#useACMEHost = "sealight.xyz";
|
||||||
|
locations."/" = {
|
||||||
|
proxyPass = "http://localhost:8448";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
## virtual host for Riot/Web
|
||||||
|
"element.sealight.xyz" = {
|
||||||
|
forceSSL = true;
|
||||||
|
enableACME = true;
|
||||||
|
#useACMEHost = "sealight.xyz";
|
||||||
|
|
||||||
|
## root points to the riot-web package content, also configured via Nix
|
||||||
|
locations."/" = {
|
||||||
|
root = pkgs.element-web;
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
## other nginx specific best practices
|
||||||
|
recommendedGzipSettings = true;
|
||||||
|
recommendedOptimisation = true;
|
||||||
|
recommendedTlsSettings = true;
|
||||||
|
};
|
||||||
|
|
||||||
|
environment.systemPackages = with pkgs; [ matrix-appservice-slack ];
|
||||||
|
}
|
||||||
96
modules/mautrix-whatsapp.nix
Normal file
96
modules/mautrix-whatsapp.nix
Normal file
|
|
@ -0,0 +1,96 @@
|
||||||
|
{ lib, config, pkgs, ... }:
|
||||||
|
|
||||||
|
with lib;
|
||||||
|
|
||||||
|
let
|
||||||
|
cfg = config.services.mautrix-whatsapp;
|
||||||
|
|
||||||
|
configFile = pkgs.runCommand "mautrix-whatsapp" {
|
||||||
|
buildInputs = [ pkgs.mautrix-whatsapp pkgs.remarshal ];
|
||||||
|
preferLocalBuild = true;
|
||||||
|
} ''
|
||||||
|
mkdir -p $out
|
||||||
|
${pkgs.remarshal}/bin/json2yaml -i ${pkgs.writeText "config.json" (builtins.toJSON cfg.configOptions)} \
|
||||||
|
-o $out/config.yaml
|
||||||
|
|
||||||
|
${pkgs.mautrix-whatsapp}/bin/mautrix-whatsapp -c $out/config.yaml -g -r $out/registration.yaml
|
||||||
|
'';
|
||||||
|
|
||||||
|
in
|
||||||
|
{
|
||||||
|
options.services.mautrix-whatsapp = {
|
||||||
|
enable = mkEnableOption "Mautrix-whatsapp, a puppeting bridge between Matrix and WhatsApp.";
|
||||||
|
|
||||||
|
configOptions = mkOption {
|
||||||
|
type = types.attrs;
|
||||||
|
description = ''
|
||||||
|
This options will be transform in YAML configuration file for the bridge
|
||||||
|
|
||||||
|
Look <link xlink:href="https://github.com/tulir/mautrix-whatsapp/wiki/Bridge-setup">here</link> for documentation.
|
||||||
|
'';
|
||||||
|
example = {
|
||||||
|
configOptions = {
|
||||||
|
homeserver = {
|
||||||
|
address = https://matrix.org;
|
||||||
|
domain = "matrix.org";
|
||||||
|
};
|
||||||
|
appservice = {
|
||||||
|
address = http://localhost:8080;
|
||||||
|
hostname = "0.0.0.0";
|
||||||
|
port = 8080;
|
||||||
|
database = {
|
||||||
|
type = "sqlite3";
|
||||||
|
uri = "/var/lib/mautrix-whatsapp/mautrix-whatsapp.db";
|
||||||
|
};
|
||||||
|
state_store_path = "/var/lib/mautrix-whatsapp/mx-state.json";
|
||||||
|
id = "whatsapp";
|
||||||
|
bot = {
|
||||||
|
username = "whatsappbot";
|
||||||
|
displayname = "WhatsApp bridge bot";
|
||||||
|
avatar = "mxc://maunium.net/NeXNQarUbrlYBiPCpprYsRqr";
|
||||||
|
};
|
||||||
|
as_token = "";
|
||||||
|
hs_token = "";
|
||||||
|
};
|
||||||
|
bridge = {
|
||||||
|
username_template = "whatsapp_{{.}}";
|
||||||
|
displayname_template = "{{if .Notify}}{{.Notify}}{{else}}{{.Jid}}{{end}} (WA)";
|
||||||
|
command_prefix = "!wa";
|
||||||
|
permissions = {
|
||||||
|
"@example:matrix.org" = 100;
|
||||||
|
};
|
||||||
|
};
|
||||||
|
logging = {
|
||||||
|
directory = "/var/lib/mautrix-whatsapp/logs";
|
||||||
|
file_name_format = "{{.Date}}-{{.Index}}.log";
|
||||||
|
file_date_format = "\"2006-01-02\"";
|
||||||
|
file_mode = 384;
|
||||||
|
timestamp_format = "Jan _2, 2006 15:04:05";
|
||||||
|
print_level = "debug";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
config = mkIf cfg.enable {
|
||||||
|
systemd.services.mautrix-whatsapp = {
|
||||||
|
description = "Mautrix-WhatsApp Service - A WhatsApp bridge for Matrix";
|
||||||
|
after = [ "network.target" "matrix-synapse.service" ];
|
||||||
|
wantedBy = [ "multi-user.target" ];
|
||||||
|
|
||||||
|
serviceConfig = {
|
||||||
|
DynamicUser = true;
|
||||||
|
StateDirectory = "mautrix-whatsapp";
|
||||||
|
LoggingDir = "mautrix-whatsapp";
|
||||||
|
ExecStart = ''
|
||||||
|
${pkgs.mautrix-whatsapp}/bin/mautrix-whatsapp -c "${configFile}/config.yaml"
|
||||||
|
'';
|
||||||
|
Restart = "on-failure";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
#services.matrix-synapse.app_service_config_files = [ "${configFile}/registration.yaml" ];
|
||||||
|
|
||||||
|
};
|
||||||
|
}
|
||||||
17
modules/monitoring-helix.nix
Normal file
17
modules/monitoring-helix.nix
Normal file
|
|
@ -0,0 +1,17 @@
|
||||||
|
{ config, pkgs, ... }: {
|
||||||
|
# grafana configuration
|
||||||
|
services.grafana = {
|
||||||
|
enable = true;
|
||||||
|
domain = "grafana.sealight.xyz";
|
||||||
|
port = 2342;
|
||||||
|
addr = "127.0.0.1";
|
||||||
|
};
|
||||||
|
|
||||||
|
# nginx reverse proxy
|
||||||
|
services.nginx.virtualHosts.${config.services.grafana.domain} = {
|
||||||
|
locations."/" = {
|
||||||
|
proxyPass = "http://127.0.0.1:${toString config.services.grafana.port}";
|
||||||
|
proxyWebsockets = true;
|
||||||
|
};
|
||||||
|
};
|
||||||
|
}
|
||||||
14
modules/sealight.nix
Normal file
14
modules/sealight.nix
Normal file
|
|
@ -0,0 +1,14 @@
|
||||||
|
{
|
||||||
|
services.nginx = {
|
||||||
|
enable = true;
|
||||||
|
vhost = {
|
||||||
|
"sealight.xyz" = {
|
||||||
|
forceSSL = true;
|
||||||
|
enableACME = true;
|
||||||
|
locations."/" = {
|
||||||
|
root = "/var/www/sealight.xyz"
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
}
|
||||||
27
modules/wireguard-helix.nix
Normal file
27
modules/wireguard-helix.nix
Normal file
|
|
@ -0,0 +1,27 @@
|
||||||
|
{ config, pkgs, lib, ... }:
|
||||||
|
{
|
||||||
|
environment.systemPackages = [ pkgs.wireguard pkgs.mosh ];
|
||||||
|
networking.nat = {
|
||||||
|
enable = true;
|
||||||
|
externalInterface = "ens3";
|
||||||
|
internalInterfaces = [ "wg0" ];
|
||||||
|
};
|
||||||
|
networking.firewall = {
|
||||||
|
allowedUDPPorts = [ 60990 ];
|
||||||
|
};
|
||||||
|
|
||||||
|
networking.wireguard.interfaces.wg0 = {
|
||||||
|
ips = [ "10.0.69.1/24" ];
|
||||||
|
listenPort = 60990;
|
||||||
|
privateKeyFile = "/var/lib/wireguard/priv";
|
||||||
|
peers = [{ # bowl
|
||||||
|
publicKey = "EzvDUmHXo95S2jKRv/LkH5ItUNOBgM7aQQsaq1WfCRw=";
|
||||||
|
allowedIPs = [ "10.0.69.2/32" ];
|
||||||
|
}
|
||||||
|
{ # line
|
||||||
|
publicKey = "ViRabGV2Mv0SZUVWnoAUhIzaHEvqRXAZJLq3Bp1oN1k=";
|
||||||
|
allowedIPs = [ "10.0.69.3/32" ];
|
||||||
|
}
|
||||||
|
];
|
||||||
|
};
|
||||||
|
}
|
||||||
104
nixos-legacy-bios-encrypted.sh
Normal file
104
nixos-legacy-bios-encrypted.sh
Normal file
|
|
@ -0,0 +1,104 @@
|
||||||
|
#!/usr/bin/env bash
|
||||||
|
set -eux
|
||||||
|
|
||||||
|
hostname="bowl"
|
||||||
|
password="xxx"
|
||||||
|
|
||||||
|
diskdev=/dev/sda
|
||||||
|
rootpart=/dev/sda2
|
||||||
|
|
||||||
|
# -o clear
|
||||||
|
# -g convert to gpt disk
|
||||||
|
# -n new partition num:start:end +size
|
||||||
|
# ef00 EFI / 8300 linux fs
|
||||||
|
sgdisk -o -g -n 1::+5M -t 1:ef02 -n 2:: -t 2:8300 $diskdev
|
||||||
|
|
||||||
|
# LVM part
|
||||||
|
echo "$password" | cryptsetup luksFormat --type luks1 -h sha512 $rootpart
|
||||||
|
echo "$password" | cryptsetup luksOpen $rootpart enc-pv
|
||||||
|
|
||||||
|
pvcreate /dev/mapper/enc-pv
|
||||||
|
vgcreate vg0 /dev/mapper/enc-pv
|
||||||
|
lvcreate -L 8G -n swap vg0
|
||||||
|
lvcreate -L 40G -n nixos vg0
|
||||||
|
lvcreate -l '100%FREE' -n home vg0
|
||||||
|
|
||||||
|
# format disk
|
||||||
|
mkfs.ext4 -L root /dev/vg0/nixos
|
||||||
|
mkfs.ext4 -L home /dev/vg0/home
|
||||||
|
mkswap -L swap /dev/vg0/swap
|
||||||
|
|
||||||
|
swapon /dev/vg0/swap
|
||||||
|
mount /dev/vg0/nixos /mnt
|
||||||
|
|
||||||
|
nix-channel --add https://nixos.org/channels/nixos-unstable nixos
|
||||||
|
nix-channel --update
|
||||||
|
|
||||||
|
nixos-generate-config --root /mnt
|
||||||
|
|
||||||
|
for uuid in /dev/disk/by-uuid/*
|
||||||
|
do
|
||||||
|
if test $(readlink -f $uuid) = $rootpart
|
||||||
|
then
|
||||||
|
luksuuid=$uuid
|
||||||
|
break
|
||||||
|
fi
|
||||||
|
done
|
||||||
|
|
||||||
|
cat << EOF > /mnt/etc/nixos/configuration.nix
|
||||||
|
{ config, pkgs, ... }:
|
||||||
|
{
|
||||||
|
imports =
|
||||||
|
[ # Include the results of the hardware scan.
|
||||||
|
./hardware-configuration.nix
|
||||||
|
];
|
||||||
|
boot.loader.grub.devices = [ "/dev/sda" ];
|
||||||
|
boot.loader.grub.enable = true;
|
||||||
|
boot.loader.grub.version = 2;
|
||||||
|
boot.loader.grub.enableCryptodisk = true;
|
||||||
|
boot.loader.supportsInitrdSecrets = true;
|
||||||
|
|
||||||
|
boot.initrd.kernelModules = [ "dm-snapshot" ];
|
||||||
|
boot.initrd.availableKernelModules = ["virtio-pci"];
|
||||||
|
boot.initrd.network = {
|
||||||
|
enable = true;
|
||||||
|
ssh = {
|
||||||
|
enable = true;
|
||||||
|
port = 2222;
|
||||||
|
authorizedKeys = ["ssh-rsa xxx"];
|
||||||
|
hostKeys = [ "/host_ecdsa_key" ];
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
boot.initrd.luks.devices = [
|
||||||
|
{
|
||||||
|
name = "enc-pv";
|
||||||
|
preLVM = true;
|
||||||
|
device = "$luksuuid";
|
||||||
|
allowDiscards = true;
|
||||||
|
}
|
||||||
|
];
|
||||||
|
|
||||||
|
boot.initrd.secrets = {
|
||||||
|
"/host_ecdsa_key" = "/host_ecdsa_key";
|
||||||
|
};
|
||||||
|
|
||||||
|
boot.cleanTmpDir = true;
|
||||||
|
boot.kernelModules = [ "dm-snapshot" ];
|
||||||
|
nixpkgs.config.allowUnfree = true;
|
||||||
|
users.users.root.initialHashedPassword = "";
|
||||||
|
services.openssh.permitRootLogin = "prohibit-password";
|
||||||
|
networking.hostName = "$hostname";
|
||||||
|
time.timeZone = "Europe/Paris";
|
||||||
|
services.openssh.enable = true;
|
||||||
|
users.users.root.openssh.authorizedKeys.keys = ["ssh-rsa xxx"];
|
||||||
|
system.stateVersion = "20.03";
|
||||||
|
}
|
||||||
|
EOF
|
||||||
|
|
||||||
|
ssh-keygen -t ecdsa -N "" -f host_ecdsa_key
|
||||||
|
|
||||||
|
cp host_ecdsa_key /mnt/
|
||||||
|
|
||||||
|
nixos-install --no-root-passwd
|
||||||
|
|
||||||
Loading…
Reference in a new issue