bowl
This commit is contained in:
Anish Lakhwara
commit
c70fa682f2
29
bowl/box.nix
Normal file
29
bowl/box.nix
Normal file
|
|
@ -0,0 +1,29 @@
|
|||
{ config, pkgs, ... }:
|
||||
|
||||
{
|
||||
imports = [
|
||||
./common.nix
|
||||
./musician.nix
|
||||
];
|
||||
|
||||
|
||||
users.extraUsers."anish".extraGroups = [ "jackaudio" ];
|
||||
|
||||
services.xserver = {
|
||||
enable = true;
|
||||
displayManager.gdm.enable = true;
|
||||
desktopManager.gnome3.enable = true;
|
||||
};
|
||||
|
||||
# task whisperer broken
|
||||
#nixpkgs.config.allowBroken = true;
|
||||
|
||||
# virtual box
|
||||
virtualisation.virtualbox.host.enable = true;
|
||||
|
||||
# ErgoDox Firmware (doesn't compile)
|
||||
# environment.systemPackages = with pkgs; [
|
||||
# qmk_firmware
|
||||
# ];
|
||||
}
|
||||
|
||||
115
bowl/common.nix
Normal file
115
bowl/common.nix
Normal file
|
|
@ -0,0 +1,115 @@
|
|||
{ config, pkgs, ... }:
|
||||
|
||||
{
|
||||
imports = [
|
||||
./nvim.nix
|
||||
# ./unstable.nix
|
||||
];
|
||||
|
||||
|
||||
environment.systemPackages = with pkgs; [
|
||||
htop
|
||||
iftop
|
||||
wget
|
||||
curl
|
||||
exa
|
||||
bat
|
||||
fd
|
||||
ag
|
||||
tcpdump
|
||||
whois
|
||||
mtr
|
||||
file
|
||||
lsof
|
||||
atool
|
||||
inotify-tools
|
||||
strace
|
||||
zip
|
||||
unzip
|
||||
rsync
|
||||
tmux
|
||||
pwgen
|
||||
glow
|
||||
jq
|
||||
gitAndTools.gitFull
|
||||
#neovim defined in ./nvim.nix
|
||||
wofi
|
||||
firefox
|
||||
fractal
|
||||
pinentry_gnome
|
||||
pass
|
||||
gcc
|
||||
less
|
||||
mpv
|
||||
zathura
|
||||
#qmk_firmware
|
||||
python3
|
||||
gdb
|
||||
vcv-rack
|
||||
#xdotool
|
||||
#neofetch
|
||||
#calibre
|
||||
#openvpn
|
||||
gimp
|
||||
xxd
|
||||
tilix
|
||||
kitty
|
||||
taskwarrior
|
||||
gnupg
|
||||
openjdk
|
||||
glslviewer
|
||||
filezilla
|
||||
signal-desktop
|
||||
wire-desktop
|
||||
tdesktop
|
||||
feedreader
|
||||
newsflash
|
||||
syncthing
|
||||
dijo
|
||||
#kdeconnect
|
||||
#ssb-patchwork
|
||||
gnome3.gnome-tweaks
|
||||
gnome3.pomodoro
|
||||
gnomeExtensions.gsconnect
|
||||
#gnomeExtensions.taskwhisperer
|
||||
#gnome3.networkmanager-openvpn
|
||||
#python3Packages.youtube-dl
|
||||
appimage-run
|
||||
home-manager
|
||||
libreoffice
|
||||
fontconfig
|
||||
hugo
|
||||
#processing
|
||||
#nextcloud-client
|
||||
zsh-powerlevel10k
|
||||
powerline-fonts
|
||||
supercollider
|
||||
haskellPackages.tidal
|
||||
# vim-zettel
|
||||
pandoc
|
||||
];
|
||||
|
||||
programs.bash.enableCompletion = true;
|
||||
|
||||
# needed for vcv-rack
|
||||
nixpkgs.config.allowUnfree = true;
|
||||
|
||||
system.copySystemConfiguration = true;
|
||||
services.syncthing = {
|
||||
enable = true;
|
||||
openDefaultPorts = true;
|
||||
systemService = true;
|
||||
user = "anish";
|
||||
dataDir = "/home/anish/usr/syncthing";
|
||||
};
|
||||
|
||||
#zsh powerlevel10k
|
||||
programs.zsh.enable = true;
|
||||
programs.zsh.promptInit = "source ${pkgs.zsh-powerlevel10k}/share/zsh-powerlevel10k/powerlevel10k.zsh-theme";
|
||||
users.users.anish.shell = pkgs.zsh;
|
||||
|
||||
#android
|
||||
programs.adb.enable = true;
|
||||
users.users.anish.extraGroups = ["adbusers"];
|
||||
|
||||
}
|
||||
24
bowl/musician.nix
Normal file
24
bowl/musician.nix
Normal file
|
|
@ -0,0 +1,24 @@
|
|||
{pkgs, config, ... }:
|
||||
{
|
||||
imports = [
|
||||
/home/anish/usr/musnix
|
||||
];
|
||||
|
||||
musnix.enable = true;
|
||||
users.users.anish.extraGroups = [ "audio" ];
|
||||
|
||||
environment.systemPackages = with pkgs; [ ardour patchage helm ];
|
||||
#services.jack = {
|
||||
# jackd.enable = true;
|
||||
# # support ALSA only programs via ALSA JACK PCM plugin
|
||||
# alsa.enable = false;
|
||||
# # support ALSA only programs via loopback device (supports programs like Steam)
|
||||
# loopback = {
|
||||
# enable = true;
|
||||
# # buffering parameters for dmix device to work with ALSA only semi-professional sound programs
|
||||
# #dmixConfig = ''
|
||||
# # period_size 2048
|
||||
# #'';
|
||||
# };
|
||||
#};
|
||||
}
|
||||
6
bowl/musnix.nix
Normal file
6
bowl/musnix.nix
Normal file
|
|
@ -0,0 +1,6 @@
|
|||
{
|
||||
imports = [ <musnix> ];
|
||||
musnix.enable = true;
|
||||
|
||||
users.users."anish".extraGroups = [ "audio" ];
|
||||
}
|
||||
262
bowl/nvim.nix
Normal file
262
bowl/nvim.nix
Normal file
|
|
@ -0,0 +1,262 @@
|
|||
{ pkgs, ... }:
|
||||
|
||||
|
||||
#nvim
|
||||
{
|
||||
environment.variables.EDITOR = "nvim";
|
||||
environment.shellAliases = {
|
||||
k = "vim -c :VimwikiIndex";
|
||||
kz = "vim -c :VimwikiIndex -c :ZettelNew";
|
||||
};
|
||||
environment.systemPackages = with pkgs; [
|
||||
nodejs
|
||||
( neovim.override {
|
||||
vimAlias = true;
|
||||
configure = {
|
||||
packages.myPlugins = with pkgs.vimPlugins; {
|
||||
start = [
|
||||
vim-nix
|
||||
fzf-vim
|
||||
vim-elixir
|
||||
emmet-vim
|
||||
nerdtree
|
||||
goyo-vim
|
||||
vim-sneak
|
||||
lightline-vim
|
||||
csv-vim
|
||||
vimwiki
|
||||
coc-nvim
|
||||
coc-json
|
||||
coc-python
|
||||
coc-pairs
|
||||
coc-emmet
|
||||
emmet-vim
|
||||
LanguageClient-neovim
|
||||
ayu-vim
|
||||
rainbow_parentheses-vim
|
||||
vim-surround
|
||||
vim-fugitive
|
||||
#iron-nvim
|
||||
#nvim-colorizer
|
||||
vim-devicons
|
||||
|
||||
# testing
|
||||
#vim-processing
|
||||
#vim-tidal
|
||||
taskwiki
|
||||
vim-zettel
|
||||
vimwiki-sync
|
||||
];
|
||||
};
|
||||
customRC = ''
|
||||
set tabstop=2
|
||||
set showmatch
|
||||
set shiftwidth=2
|
||||
set noexpandtab
|
||||
set autoindent
|
||||
|
||||
set foldmethod=indent " fold based on indent
|
||||
set number
|
||||
set nocompatible
|
||||
set relativenumber
|
||||
set showtabline=2
|
||||
set autowriteall
|
||||
syntax on
|
||||
set list lcs=tab:\|\
|
||||
filetype plugin on
|
||||
|
||||
set termguicolors
|
||||
let ayucolor="dark"
|
||||
colorscheme ayu
|
||||
|
||||
" window
|
||||
nmap <leader>wh :topleft vnew<CR>
|
||||
nmap <leader>wl :botright vnew<CR>
|
||||
nmap <leader>wk :topleft new<CR>
|
||||
nmap <leader>wj :botright new<CR>
|
||||
|
||||
let mapleader = "\<Space>"
|
||||
|
||||
" lightline colorscheme
|
||||
let g:lightline = {
|
||||
\ 'colorscheme': 'seoul256',
|
||||
\ }
|
||||
|
||||
" moving splits with vim movements.
|
||||
:tnoremap <A-h> <C-\><C-N><C-w>h
|
||||
:tnoremap <A-j> <C-\><C-N><C-w>j
|
||||
:tnoremap <A-k> <C-\><C-N><C-w>k
|
||||
:tnoremap <A-l> <C-\><C-N><C-w>l
|
||||
:inoremap <A-h> <C-\><C-N><C-w>h
|
||||
:inoremap <A-j> <C-\><C-N><C-w>j
|
||||
:inoremap <A-k> <C-\><C-N><C-w>k
|
||||
:inoremap <A-l> <C-\><C-N><C-w>l
|
||||
:nnoremap <A-h> <leader>h
|
||||
:nnoremap <A-j> <leader>j
|
||||
:nnoremap <A-k> <leader>k
|
||||
:nnoremap <A-l> <leader>l
|
||||
:nnoremap <F5> "=strftime("%Y-%m-%d %H:%M:")
|
||||
:inoremap <F5> <C-R>=strftime("%Y-%m-%d %H:%M:")
|
||||
|
||||
" exit normal mode in terminal
|
||||
:tnoremap <C-n> <C-\><C-n>
|
||||
|
||||
let g:syntastic_always_populate_loc_list = 1
|
||||
let g:syntastic_auto_loc_list = 1
|
||||
let g:syntastic_check_on_open = 1
|
||||
let g:syntastic_check_on_wq = 0
|
||||
|
||||
let g:rainbow_active = 0
|
||||
autocmd BufReadPost,BufNewFile c,py,nix RainbowParenthesesToggleAll
|
||||
|
||||
" keyboard commands
|
||||
map <leader>t :NERDTreeToggle<CR>
|
||||
map <leader>s :w<CR>
|
||||
map <leader>q :wq<CR>
|
||||
map <leader>r :RainbowParenthesesToggleAll<CR>
|
||||
map <leader>zs :ZettelSearch<CR>
|
||||
map <leader>zo :ZettelOpen<CR>
|
||||
map <leader>zn :ZettelNew<CR>
|
||||
|
||||
|
||||
" NERDTree
|
||||
" open on directory
|
||||
autocmd StdinReadPre * let s:std_in=1
|
||||
|
||||
" coc
|
||||
"
|
||||
" if hidden is not set, TextEdit might fail.
|
||||
set hidden
|
||||
|
||||
" Some servers have issues with backup files, see #649
|
||||
set nobackup
|
||||
set nowritebackup
|
||||
|
||||
" Better display for messages
|
||||
set cmdheight=2
|
||||
|
||||
" You will have bad experience for diagnostic messages when it's default 4000.
|
||||
set updatetime=300
|
||||
|
||||
" don't give |ins-completion-menu| messages.
|
||||
set shortmess+=c
|
||||
|
||||
" always show signcolumns
|
||||
set signcolumn=yes
|
||||
|
||||
" Use tab for trigger completion with characters ahead and navigate.
|
||||
" Use command ':verbose imap <tab>' to make sure tab is not mapped by other plugin.
|
||||
inoremap <silent><expr> <TAB>
|
||||
\ pumvisible() ? "\<C-n>" :
|
||||
\ <SID>check_back_space() ? "\<TAB>" :
|
||||
\ coc#refresh()
|
||||
inoremap <expr><S-TAB> pumvisible() ? "\<C-p>" : "\<C-h>"
|
||||
|
||||
function! s:check_back_space() abort
|
||||
let col = col('.') - 1
|
||||
return !col || getline('.')[col - 1] =~# '\s'
|
||||
endfunction
|
||||
|
||||
" Use <c-space> to trigger completion.
|
||||
inoremap <silent><expr> <c-space> coc#refresh()
|
||||
|
||||
" Use <cr> to confirm completion, `<C-g>u` means break undo chain at current position.
|
||||
" Coc only does snippet and additional edit on confirm.
|
||||
inoremap <expr> <cr> pumvisible() ? "\<C-y>" : "\<C-g>u\<CR>"
|
||||
" Or use `complete_info` if your vim support it, like:
|
||||
" inoremap <expr> <cr> complete_info()["selected"] != "-1" ? "\<C-y>" : "\<C-g>u\<CR>"
|
||||
|
||||
" Use `[g` and `]g` to navigate diagnostics
|
||||
nmap <silent> [g <Plug>(coc-diagnostic-prev)
|
||||
nmap <silent> ]g <Plug>(coc-diagnostic-next)
|
||||
|
||||
" Remap keys for gotos
|
||||
nmap <silent> gd <Plug>(coc-definition)
|
||||
nmap <silent> gy <Plug>(coc-type-definition)
|
||||
nmap <silent> gi <Plug>(coc-implementation)
|
||||
nmap <silent> gr <Plug>(coc-references)
|
||||
|
||||
" Use K to show documentation in preview window
|
||||
nnoremap <silent> K :call <SID>show_documentation()<CR>
|
||||
|
||||
function! s:show_documentation()
|
||||
if (index(['vim','help'], &filetype) >= 0)
|
||||
execute 'h '.expand('<cword>')
|
||||
else
|
||||
call CocAction('doHover')
|
||||
endif
|
||||
endfunction
|
||||
|
||||
" Highlight symbol under cursor on CursorHold
|
||||
autocmd CursorHold * silent call CocActionAsync('highlight')
|
||||
|
||||
" Remap for rename current word
|
||||
nmap <leader>rn <Plug>(coc-rename)
|
||||
|
||||
" Remap for format selected region
|
||||
xmap <leader>f <Plug>(coc-format-selected)
|
||||
nmap <leader>f <Plug>(coc-format-selected)
|
||||
|
||||
augroup mygroup
|
||||
autocmd!
|
||||
" Setup formatexpr specified filetype(s).
|
||||
autocmd FileType typescript,json setl formatexpr=CocAction('formatSelected')
|
||||
" Update signature help on jump placeholder
|
||||
autocmd User CocJumpPlaceholder call CocActionAsync('showSignatureHelp')
|
||||
augroup end
|
||||
|
||||
" Remap for do codeAction of selected region, ex: `<leader>aap` for current paragraph
|
||||
xmap <leader>a <Plug>(coc-codeaction-selected)
|
||||
nmap <leader>a <Plug>(coc-codeaction-selected)
|
||||
|
||||
" Remap for do codeAction of current line
|
||||
nmap <leader>ac <Plug>(coc-codeaction)
|
||||
" Fix autofix problem of current line
|
||||
nmap <leader>qf <Plug>(coc-fix-current)
|
||||
|
||||
" Create mappings for function text object, requires document symbols feature of languageserver.
|
||||
xmap if <Plug>(coc-funcobj-i)
|
||||
xmap af <Plug>(coc-funcobj-a)
|
||||
omap if <Plug>(coc-funcobj-i)
|
||||
omap af <Plug>(coc-funcobj-a)
|
||||
|
||||
" Use <C-d> for select selections ranges, needs server support, like: coc-tsserver, coc-python
|
||||
nmap <silent> <C-d> <Plug>(coc-range-select)
|
||||
xmap <silent> <C-d> <Plug>(coc-range-select)
|
||||
|
||||
" Use `:Format` to format current buffer
|
||||
command! -nargs=0 Format :call CocAction('format')
|
||||
|
||||
" Use `:Fold` to fold current buffer
|
||||
command! -nargs=? Fold :call CocAction('fold', <f-args>)
|
||||
|
||||
" use `:OR` for organize import of current buffer
|
||||
command! -nargs=0 OR :call CocAction('runCommand', 'editor.action.organizeImport')
|
||||
|
||||
" Add status line support, for integration with other plugin, checkout `:h coc-status`
|
||||
" set statusline^=%{coc#status()}%{get(b:,'coc_current_function',"")}
|
||||
|
||||
" Using CocList
|
||||
" Show all diagnostics
|
||||
nnoremap <silent> <space>a :<C-u>CocList diagnostics<cr>
|
||||
" Manage extensions
|
||||
nnoremap <silent> <space>e :<C-u>CocList extensions<cr>
|
||||
" Show commands
|
||||
nnoremap <silent> <space>c :<C-u>CocList commands<cr>
|
||||
" Find symbol of current document
|
||||
nnoremap <silent> <space>o :<C-u>CocList outline<cr>
|
||||
" Search workspace symbols
|
||||
nnoremap <silent> <space>s :<C-u>CocList -I symbols<cr>
|
||||
" Do default action for next item.
|
||||
nnoremap <silent> <space>j :<C-u>CocNext<CR>
|
||||
" Do default action for previous item.
|
||||
nnoremap <silent> <space>k :<C-u>CocPrev<CR>
|
||||
" Resume latest coc list
|
||||
nnoremap <silent> <space>p :<C-u>CocListResume<CR>
|
||||
|
||||
au BufNewFile,BufRead *.frag,*.vert,*.fp,*.vp,*.glsl setf glsl
|
||||
'';
|
||||
};
|
||||
}
|
||||
)];
|
||||
}
|
||||
13
bowl/unstable.nix
Normal file
13
bowl/unstable.nix
Normal file
|
|
@ -0,0 +1,13 @@
|
|||
{ config, pkgs, ... }:
|
||||
|
||||
|
||||
let
|
||||
unstable = import <nixos-unstable> {};
|
||||
in {
|
||||
nix.nixPath = [
|
||||
"nixos-unstable=https://nixos.org/channels/nixos-unstable/nixexprs.tar.xz"
|
||||
];
|
||||
|
||||
#currently installed this software through nix-env -f https://nixos.org/channels/nixos-unstable -iA [ packages ]
|
||||
environment.systemPackages = [ unstable.ripcord ];
|
||||
}
|
||||
|
|
@ -1,74 +0,0 @@
|
|||
{ config, pkgs, ... }:
|
||||
{
|
||||
imports =
|
||||
[ # Include the results of the hardware scan.
|
||||
./hardware-configuration.nix
|
||||
./taskd.nix
|
||||
./nextcloud.nix
|
||||
./networking.nix
|
||||
# ./wireguard.nix
|
||||
# ./shiori.nix
|
||||
./shaarli.nix
|
||||
# ./shaarli-tokudan.nix
|
||||
./mod-wallabag.nix
|
||||
# ./pkg-wallabag.nix
|
||||
./navidrome.nix
|
||||
./pkg-navidrome.nix
|
||||
./wallabag.nix
|
||||
./headphones.nix
|
||||
#./dns.nix
|
||||
./backup.nix
|
||||
./monitoring.nix
|
||||
];
|
||||
|
||||
boot.loader.grub.devices = [ "/dev/sda" ];
|
||||
boot.loader.grub.enable = true;
|
||||
boot.loader.grub.version = 2;
|
||||
boot.loader.grub.enableCryptodisk = true;
|
||||
boot.loader.supportsInitrdSecrets = true;
|
||||
|
||||
boot.initrd.kernelModules = [ "dm-snapshot" ];
|
||||
boot.initrd.availableKernelModules = ["virtio-pci"];
|
||||
boot.initrd.network = {
|
||||
enable = true;
|
||||
ssh = {
|
||||
enable = true;
|
||||
port = 2222;
|
||||
authorizedKeys = ["ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDKN8/SH55DBiwVoSnTU8k2Pen+wmovL9QaMyehxGEsJJv/8fzwsswGalD4C/4O51LOvdu4UKkZW5hG02uVSK+58p3UV3pOPyoqsu/aDeIsWsqmTeTzUrBIWOlNzcDKnohLz2oGC5YO+wyTJ9Iteq6aGJDjErsW7sG3h5lXCs551EmJNNGhtBQaaoytMNnWqSdlVjDNCijurH7WUpp40U/RjEp532l4rX6eIIj3jBKEFbhZkFSSjqbj4xM4SyFt+Jmigb1RMjsQjmpfY1vDtM84RcYfpTUte/T5w2dkD5H6kccmWnwKSJpm9wXfx4E7lR9APdUGnau2U1+XxiD3ytGl anish@box
|
||||
"];
|
||||
hostKeys = [ "/host_ecdsa_key" ];
|
||||
};
|
||||
};
|
||||
|
||||
boot.initrd.luks.devices = {
|
||||
"enc-pv" = {
|
||||
name = "enc-pv";
|
||||
preLVM = true;
|
||||
device = "/dev/disk/by-uuid/425cc402-9221-474f-aaf1-10ac7cd4c93c";
|
||||
allowDiscards = true;
|
||||
};
|
||||
};
|
||||
|
||||
boot.initrd.secrets = {
|
||||
"/host_ecdsa_key" = "/host_ecdsa_key";
|
||||
};
|
||||
|
||||
|
||||
boot.cleanTmpDir = true;
|
||||
boot.kernelModules = [ "dm-snapshot" ];
|
||||
|
||||
users.users.anish = {
|
||||
isNormalUser = true;
|
||||
extraGroups = [ "wheel" ];
|
||||
hashedPassword = "MO0Pbd2O4eIlA";
|
||||
openssh.authorizedKeys.keys = [ "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDKN8/SH55DBiwVoSnTU8k2Pen+wmovL9QaMyehxGEsJJv/8fzwsswGalD4C/4O51LOvdu4UKkZW5hG02uVSK+58p3UV3pOPyoqsu/aDeIsWsqmTeTzUrBIWOlNzcDKnohLz2oGC5YO+wyTJ9Iteq6aGJDjErsW7sG3h5lXCs551EmJNNGhtBQaaoytMNnWqSdlVjDNCijurH7WUpp40U/RjEp532l4rX6eIIj3jBKEFbhZkFSSjqbj4xM4SyFt+Jmigb1RMjsQjmpfY1vDtM84RcYfpTUte/T5w2dkD5H6kccmWnwKSJpm9wXfx4E7lR9APdUGnau2U1+XxiD3ytGl anish@box ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDM8kTdMGGmr6mv/zv+K9qVjhzqwivyyN5IV04R7/kcWKw1c6ZEzzqqmsnJ/hci6IIxZ/VEUzMhYz0iBCL0wJHHMxYoNCgISWePtDlVJdyrzm9OWjJNcRStZBW3XcY9dELJsCVcQ4LAVYE4vA+MdmbwM2FZgJhAH6qUzujpfNrj/YIVG7MTN6tbUd63uZF57F43c8WUjgRJx2o7Wl9bSe6v3PZ4fAgEO+wQPso+W+pEXLZ3hBNrHdybwdoGvG9tHlBDbLid11BxtpzmwR9CydDfpbyOXB2+tJkkNXhsHB22mN/2+vGWYhDKYPTFqbDW7McDfQChySyYDdZWmg5WHIGz anish@curve" ];
|
||||
};
|
||||
|
||||
users.users.root.initialHashedPassword = "";
|
||||
services.openssh.permitRootLogin = "prohibit-password";
|
||||
networking.hostName = "bowl";
|
||||
services.openssh.enable = true;
|
||||
services.logind.lidSwitch = "ignore";
|
||||
system.stateVersion = "20.09";
|
||||
time.timeZone = "Australia/Brisbane";
|
||||
}
|
||||
|
|
@ -1,29 +0,0 @@
|
|||
# Do not modify this file! It was generated by ‘nixos-generate-config’
|
||||
# and may be overwritten by future invocations. Please make changes
|
||||
# to /etc/nixos/configuration.nix instead.
|
||||
{ config, lib, pkgs, modulesPath, ... }:
|
||||
|
||||
{
|
||||
imports =
|
||||
[ (modulesPath + "/installer/scan/not-detected.nix")
|
||||
];
|
||||
|
||||
boot.initrd.availableKernelModules = [ "ehci_pci" "ahci" "usb_storage" "sd_mod" "sr_mod" ];
|
||||
boot.initrd.kernelModules = [ "dm-snapshot" ];
|
||||
boot.kernelModules = [ "kvm-intel" ];
|
||||
boot.extraModulePackages = [ ];
|
||||
|
||||
fileSystems."/" =
|
||||
{ device = "/dev/disk/by-uuid/d64cc666-2569-403d-8629-32c65732f683";
|
||||
fsType = "ext4";
|
||||
};
|
||||
|
||||
fileSystems."/data" =
|
||||
{ device = "/dev/disk/by-uuid/d85b6c90-501c-4f8d-adfd-84f8d66b203a";
|
||||
fsType = "ext4";
|
||||
};
|
||||
|
||||
swapDevices =
|
||||
[ { device = "/dev/disk/by-uuid/e2479d1b-af81-44ed-ae47-0f7aee2817b8"; }
|
||||
];
|
||||
}
|
||||
52
machines/helix.nix
Normal file
52
machines/helix.nix
Normal file
|
|
@ -0,0 +1,52 @@
|
|||
{ config, pkgs, ... }:
|
||||
{
|
||||
imports =
|
||||
[ # Include the results of the hardware scan.
|
||||
./hardware-configuration.nix
|
||||
./wireguard.nix
|
||||
./matrix.nix
|
||||
];
|
||||
|
||||
# Use the GRUB 2 boot loader.
|
||||
boot.loader.grub.enable = true;
|
||||
boot.loader.grub.version = 2;
|
||||
boot.loader.grub.device = "/dev/vda"; # or "nodev" for efi only
|
||||
|
||||
networking.hostName = "helix"; # Define your hostname.
|
||||
|
||||
networking.useDHCP = false;
|
||||
networking.interfaces.ens3.useDHCP = true;
|
||||
|
||||
# Configure network proxy if necessary
|
||||
# networking.proxy.default = "http://user:password@proxy:port/";
|
||||
# networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";
|
||||
|
||||
# Enable the OpenSSH daemon.
|
||||
services.openssh.enable = true;
|
||||
#services.openssh.passwordAuthentication = false;
|
||||
services.openssh.permitRootLogin = "no";
|
||||
|
||||
# Open ports in the firewall.
|
||||
# networking.firewall.allowedTCPPorts = [ ... ];
|
||||
# networking.firewall.allowedUDPPorts = [ ... ];
|
||||
# Or disable the firewall altogether.
|
||||
# networking.firewall.enable = false;
|
||||
|
||||
# Define a user account. Don't forget to set a password with ‘passwd’.
|
||||
users.users.anish = {
|
||||
isNormalUser = true;
|
||||
extraGroups = [ "wheel" ]; # Enable ‘sudo’ for the user
|
||||
openssh.authorizedKeys.keys = [
|
||||
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDM8kTdMGGmr6mv/zv+K9qVjhzqwivyyN5IV04R7/kcWKw1c6ZEzzqqmsnJ/hci6IIxZ/VEUzMhYz0iBCL0wJHHMxYoNCgISWePtDlVJdyrzm9OWjJNcRStZBW3XcY9dELJsCVcQ4LAVYE4vA+MdmbwM2FZgJhAH6qUzujpfNrj/YIVG7MTN6tbUd63uZF57F43c8WUjgRJx2o7Wl9bSe6v3PZ4fAgEO+wQPso+W+pEXLZ3hBNrHdybwdoGvG9tHlBDbLid11BxtpzmwR9CydDfpbyOXB2+tJkkNXhsHB22mN/2+vGWYhDKYPTFqbDW7McDfQChySyYDdZWmg5WHIGz anish@curve"
|
||||
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCeWQsf9rbE+KBrWLkLkg1PMKx0jPfDP8xyv+XtddIQzAskRTN+JSSQp1GpoRgfQij7bx6f6DfjkwSQK5NWDQNQ+klGhcdEwEdptWUzpRAvKHMImjyIwFHmRKKEgcfH8+DSHVM93nRSQKrLezX4PzPkHF9f3TLxFdGeQDeY0J2oP2Oa97hRtuTJZW9BwUojyvDYUbg7F3fxf+pdFCvIAFaayiLkhOYdTXnjLt1Ks6NOhSzM78ZibHv4pFYI9r6dhflkFP/SzyLeSSm1aVAtxqE7vF5HnnORAg0byDsiOv/9RXxiDx7gkAAw3xENDSpp9TRj54M7iz1OSsRMhmD6orHjZFIRejlE4DIn+PBPm3PH+U5ILKTogE6n5MfPT28V0QdtHuqq3b5tSWiDcFpnjxbIUmEIo5hLzMR0tXZoNLQhBCSNfxjE8CYzpk7mHbvhSs2GPfG+NI1vvldbw2EF8beJFQHNYTqJw8y7p8RXpCwZqqpSitJX6v9DiYdLVG1hWvE= nix-on-droid@localhost"
|
||||
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDKN8/SH55DBiwVoSnTU8k2Pen+wmovL9QaMyehxGEsJJv/8fzwsswGalD4C/4O51LOvdu4UKkZW5hG02uVSK+58p3UV3pOPyoqsu/aDeIsWsqmTeTzUrBIWOlNzcDKnohLz2oGC5YO+wyTJ9Iteq6aGJDjErsW7sG3h5lXCs551EmJNNGhtBQaaoytMNnWqSdlVjDNCijurH7WUpp40U/RjEp532l4rX6eIIj3jBKEFbhZkFSSjqbj4xM4SyFt+Jmigb1RMjsQjmpfY1vDtM84RcYfpTUte/T5w2dkD5H6kccmWnwKSJpm9wXfx4E7lR9APdUGnau2U1+XxiD3ytGl anish@box" ];
|
||||
};
|
||||
|
||||
# This value determines the NixOS release with which your system is to be
|
||||
# compatible, in order to avoid breaking some software such as database
|
||||
# servers. You should change this only after NixOS release notes say you
|
||||
# should.
|
||||
system.stateVersion = "19.09"; # Did you read the comment?
|
||||
|
||||
}
|
||||
|
||||
153
modules/matrix-slack.nix
Normal file
153
modules/matrix-slack.nix
Normal file
|
|
@ -0,0 +1,153 @@
|
|||
{ config, pkgs, lib, ... }:
|
||||
|
||||
with lib;
|
||||
|
||||
let
|
||||
dataDir = "/var/lib/matrix-appservice-slack";
|
||||
registrationFile = "${dataDir}/slack-registration.yaml";
|
||||
#appDir = "${pkgs.matrix-appservice-slack}/${pkgs.matrix-appservice-slack.passthru.nodeAppDir}";
|
||||
cfg = config.services.matrix-appservice-slack;
|
||||
# TODO: switch to configGen.json once RFC42 is implemented
|
||||
settingsFile = pkgs.writeText "matrix-appservice-slack-settings.json" (builtins.toJSON cfg.settings);
|
||||
|
||||
in {
|
||||
options = {
|
||||
services.matrix-appservice-slack = {
|
||||
enable = mkEnableOption "a bridge between Matrix and Slack";
|
||||
|
||||
settings = mkOption rec {
|
||||
# TODO: switch to types.config.json as prescribed by RFC42 once it's implemented
|
||||
type = types.attrs;
|
||||
apply = recursiveUpdate default;
|
||||
default = {
|
||||
# empty values necessary for registration file generation
|
||||
# actual values defined in environmentFile
|
||||
auth = {
|
||||
clientID = "";
|
||||
botToken = "";
|
||||
};
|
||||
};
|
||||
example = literalExample ''
|
||||
{
|
||||
bridge = {
|
||||
domain = "public-domain.tld";
|
||||
homeserverUrl = "http://public-domain.tld:8008";
|
||||
};
|
||||
}
|
||||
'';
|
||||
description = ''
|
||||
<filename>config.yaml</filename> configuration as a Nix attribute set.
|
||||
</para>
|
||||
|
||||
<para>
|
||||
Configuration options should match those described in
|
||||
<link xlink:href="https://github.com/Half-Shot/matrix-appservice-discord/blob/master/config/config.sample.yaml">
|
||||
config.sample.yaml</link>.
|
||||
</para>
|
||||
|
||||
<para>
|
||||
<option>config.bridge.domain</option> and <option>config.bridge.homeserverUrl</option>
|
||||
should be set to match the public host name of the Matrix homeserver for webhooks and avatars to work.
|
||||
</para>
|
||||
|
||||
<para>
|
||||
Secret tokens should be specified using <option>environmentFile</option>
|
||||
instead of this world-readable attribute set.
|
||||
'';
|
||||
};
|
||||
|
||||
environmentFile = mkOption {
|
||||
type = types.nullOr types.path;
|
||||
default = null;
|
||||
description = ''
|
||||
File containing environment variables to be passed to the matrix-appservice-discord service,
|
||||
in which secret tokens can be specified securely by defining values for
|
||||
<literal>APPSERVICE_SLACK_AUTH_CLIENT_I_D</literal> and
|
||||
<literal>APPSERVICE_SLACK_AUTH_BOT_TOKEN</literal>.
|
||||
'';
|
||||
};
|
||||
|
||||
url = mkOption {
|
||||
type = types.str;
|
||||
default = "http://localhost:${toString cfg.port}";
|
||||
description = ''
|
||||
The URL where the application service is listening for HS requests.
|
||||
'';
|
||||
};
|
||||
|
||||
port = mkOption {
|
||||
type = types.port;
|
||||
default = 9898; # from https://github.com/matrix-org/matrix-appservice-slack/blob/develop/config/config.sample.yaml#L70
|
||||
description = ''
|
||||
Port number on which the bridge should listen for internal communication with the Matrix homeserver.
|
||||
'';
|
||||
};
|
||||
|
||||
localpart = mkOption {
|
||||
type = with types; nullOr str;
|
||||
default = null;
|
||||
description = ''
|
||||
The user_id localpart to assign to the AS.
|
||||
'';
|
||||
};
|
||||
|
||||
serviceDependencies = mkOption {
|
||||
type = with types; listOf str;
|
||||
default = optional config.services.matrix-synapse.enable "matrix-synapse.service";
|
||||
description = ''
|
||||
List of Systemd services to require and wait for when starting the application service,
|
||||
such as the Matrix homeserver if it's running on the same host.
|
||||
'';
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
config = mkIf cfg.enable {
|
||||
systemd.services.matrix-appservice-slack = {
|
||||
description = "A bridge between Matrix and Slack.";
|
||||
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
wants = [ "network-online.target" ] ++ cfg.serviceDependencies;
|
||||
after = [ "network-online.target" ] ++ cfg.serviceDependencies;
|
||||
|
||||
preStart = ''
|
||||
if [ ! -f '${registrationFile}' ]; then
|
||||
${pkgs.matrix-appservice-slack}/bin/matrix-appservice-slack \
|
||||
--generate-registration \
|
||||
--url=${escapeShellArg cfg.url} \
|
||||
${optionalString (cfg.localpart != null) "--localpart=${escapeShellArg cfg.localpart}"} \
|
||||
--config='${settingsFile}' \
|
||||
--file='${registrationFile}'
|
||||
fi
|
||||
'';
|
||||
|
||||
serviceConfig = {
|
||||
Type = "simple";
|
||||
Restart = "always";
|
||||
|
||||
ProtectSystem = "strict";
|
||||
ProtectHome = true;
|
||||
ProtectKernelTunables = true;
|
||||
ProtectKernelModules = true;
|
||||
ProtectControlGroups = true;
|
||||
|
||||
DynamicUser = true;
|
||||
PrivateTmp = true;
|
||||
#WorkingDirectory = appDir;
|
||||
StateDirectory = baseNameOf dataDir;
|
||||
UMask = 0027;
|
||||
EnvironmentFile = cfg.environmentFile;
|
||||
|
||||
ExecStart = ''
|
||||
${pkgs.matrix-appservice-slack}/bin/matrix-appservice-slack \
|
||||
--file='${registrationFile}' \
|
||||
--config='${settingsFile}' \
|
||||
--port='${toString cfg.port}'
|
||||
'';
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
meta.maintainers = with maintainers; [ chickensoupandrice ];
|
||||
}
|
||||
|
||||
258
modules/matrix.nix
Normal file
258
modules/matrix.nix
Normal file
|
|
@ -0,0 +1,258 @@
|
|||
{ config, lib, pkgs, ... }:
|
||||
|
||||
{
|
||||
imports = [ ./matrix-slack.nix ./mautrix-whatsapp.nix ];
|
||||
security.acme.email = "anish+acme@lakhwara.com";
|
||||
security.acme.acceptTerms = true;
|
||||
services.matrix-synapse = {
|
||||
enable = true;
|
||||
app_service_config_files = [
|
||||
# # The registration file is automatically generated after starting the appservice for the first time.
|
||||
# # cp /var/lib/matrix-appservice-discord/discord-registration.yaml /var/lib/matrix-synapse/
|
||||
# # chown matrix-synapse:matrix-synapse /var/lib/matrix-synapse/discord-registration.yaml
|
||||
# "/var/lib/matrix-synapse/discord-registration.yaml"
|
||||
"/var/lib/matrix-synapse/telegram-registration.yaml"
|
||||
"/var/lib/matrix-synapse/slack-registration.yaml"
|
||||
"/var/lib/matrix-synapse/whatsapp-registration.yaml"
|
||||
];
|
||||
server_name = "sealight.xyz";
|
||||
registration_shared_secret = "hD9HQGTTDxp0mQsQ5JDsfudWMDiubmZENOgPchIvfBvUlPxlvQSvjoO4wn2L1seU";
|
||||
enable_metrics = true;
|
||||
enable_registration = true;
|
||||
database_type = "psycopg2";
|
||||
database_args = {
|
||||
database = "matrix-synapse";
|
||||
};
|
||||
listeners = [
|
||||
{
|
||||
port = 8448;
|
||||
tls = false;
|
||||
resources = [
|
||||
{
|
||||
compress = true;
|
||||
names = ["client" "federation"];
|
||||
}
|
||||
];
|
||||
}
|
||||
];
|
||||
extraConfig = ''
|
||||
max_upload_size: "50M"
|
||||
'';
|
||||
};
|
||||
|
||||
services.mautrix-telegram = {
|
||||
enable = true;
|
||||
environmentFile = /etc/secrets/telegram.env; # file containing the appservice and telegram tokens
|
||||
# The appservice is pre-configured to use SQLite by default. It's also possible to use PostgreSQL.
|
||||
settings = {
|
||||
homeserver = {
|
||||
address = "https://chat.sealight.xyz";
|
||||
domain = "sealight.xyz";
|
||||
};
|
||||
appservice = {
|
||||
provisioning.enabled = false;
|
||||
id = "telegram";
|
||||
public = {
|
||||
enabled = false;
|
||||
prefix = "/public";
|
||||
external = "https://chat.sealight.xyz/public";
|
||||
};
|
||||
# The service uses SQLite by default, but it's also possible to use PostgreSQL instead:
|
||||
#database = "postgresql:///mautrix-telegram?host=/run/postgresql";
|
||||
};
|
||||
bridge = {
|
||||
relaybot.authless_portals = false;
|
||||
permissions = {
|
||||
"@aynish:sealight.xyz" = "admin";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
services.mautrix-whatsapp = {
|
||||
enable = true;
|
||||
# The appservice is pre-configured to use SQLite by default. It's also possible to use PostgreSQL.
|
||||
configOptions = {
|
||||
homeserver = {
|
||||
address = "https://chat.sealight.xyz";
|
||||
domain = "sealight.xyz";
|
||||
};
|
||||
appservice = {
|
||||
id = "whatsapp";
|
||||
address = http://localhost:9897;
|
||||
hostname = "0.0.0.0";
|
||||
port = 9897;
|
||||
database = {
|
||||
type = "sqlite3";
|
||||
uri = "/var/lib/mautrix-whatsapp/mautrix-whatsapp.db";
|
||||
};
|
||||
state_store_path = "/var/lib/mautrix-whatsapp/mx-state.json";
|
||||
bot = {
|
||||
username = "whatsappbot";
|
||||
displayname = "WhatsApp bridge bot";
|
||||
avatar = "mxc://maunium.net/NeXNQarUbrlYBiPCpprYsRqr";
|
||||
};
|
||||
as_token = "";
|
||||
hs_token = "";
|
||||
};
|
||||
bridge = {
|
||||
username_template = "whatsapp_{{.}}";
|
||||
displayname_template = "{{if .Notify}}{{.Notify}}{{else}}{{.Jid}}{{end}} (WA)";
|
||||
command_prefix = "!wa";
|
||||
permissions = {
|
||||
"@aynish:sealight.xyz" = 100;
|
||||
};
|
||||
};
|
||||
logging = {
|
||||
directory = "/var/lib/mautrix-whatsapp/logs";
|
||||
file_name_format = "{{.Date}}-{{.Index}}.log";
|
||||
file_date_format = "\"2006-01-02\"";
|
||||
file_mode = 384;
|
||||
timestamp_format = "Jan _2, 2006 15:04:05";
|
||||
print_level = "debug";
|
||||
};
|
||||
metrics = {
|
||||
enabled = true;
|
||||
listen = "http://localhost:5070";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
services.matrix-appservice-slack = {
|
||||
enable = true;
|
||||
#environmentFile = /etc/secrets/matrix-appservice-slack.env;
|
||||
settings = {
|
||||
homeserver = {
|
||||
server_name = "sealight.xyz";
|
||||
url = "https://chat.sealight.xyz";
|
||||
};
|
||||
db = {
|
||||
engine = "postgres";
|
||||
connectionString = "postgres://slackbridge_user:somethingverysecret@localhost/slack_bridge?sslmode=require";
|
||||
};
|
||||
matrix_admin_room = "!ikEWOHCcmoZtVzSmPF:sealight.xyz";
|
||||
username_prefix = "slack_";
|
||||
rtm = {
|
||||
enable = true;
|
||||
logging = "silent";
|
||||
};
|
||||
slack_hook_port = 9899;
|
||||
enable_metrics = true;
|
||||
puppeting = {
|
||||
enabled = true;
|
||||
onboard_users = true;
|
||||
};
|
||||
oauth2 = {
|
||||
client_id = "2832868673.1609454840563";
|
||||
client_secret = "079a7ca42b192e66a9ff32740a69cb9d";
|
||||
redirect_prefix = "https://sealight.xyz/slackbridge/";
|
||||
};
|
||||
#team_sync = {
|
||||
# T02QGRJKT = {
|
||||
# users = {
|
||||
# enabled = false;
|
||||
# };
|
||||
# channels = {
|
||||
# enabled = true;
|
||||
# alias_prefix = "qf_";
|
||||
# };
|
||||
# };
|
||||
#};
|
||||
};
|
||||
};
|
||||
|
||||
services.postgresql = {
|
||||
enable = true;
|
||||
## postgresql user and db name remains in the
|
||||
## service.matrix-synapse.database_args setting which
|
||||
## by default is matrix-synapse
|
||||
initialScript = pkgs.writeText "synapse-init.sql" ''
|
||||
CREATE ROLE "matrix-synapse" WITH LOGIN PASSWORD "Da0?H*9i{x?,]|'kq@iBwlIzu";
|
||||
CREATE DATABASE "matrix-synapse" WITH OWNER "matrix-synapse"
|
||||
TEMPLATE template0
|
||||
LC_COLLATE = "C"
|
||||
LC_CTYPE = "C";
|
||||
'';
|
||||
};
|
||||
|
||||
networking.firewall = {
|
||||
enable = true;
|
||||
allowedTCPPorts = [
|
||||
22 # SSH
|
||||
8448 # Matrix federation
|
||||
8008
|
||||
80
|
||||
443
|
||||
9899 # Matrix <-> Slack Bridge Puppeting
|
||||
];
|
||||
};
|
||||
|
||||
nixpkgs.overlays = [
|
||||
(self: super: {
|
||||
element-web = super.element-web.override {
|
||||
conf = {
|
||||
default_server_config = {
|
||||
"m.homeserver" = {
|
||||
"base_url" = "https://chat.sealight.xyz";
|
||||
"server_name" = "sealight.xyz";
|
||||
};
|
||||
"m.identity_server" = {
|
||||
"base_url" = "https://vector.im";
|
||||
};
|
||||
};
|
||||
|
||||
## jitsi will be setup later,
|
||||
## but we need to add to Riot configuration
|
||||
#jitsi.preferredDomain = "jitsi.dangerousdemos.net";
|
||||
};
|
||||
};
|
||||
})
|
||||
];
|
||||
|
||||
services.nginx = {
|
||||
enable = true;
|
||||
virtualHosts = {
|
||||
|
||||
"sealight.xyz" = {
|
||||
forceSSL = true;
|
||||
enableACME = true;
|
||||
locations."/" = {
|
||||
root = "/var/www/sealight.xyz";
|
||||
};
|
||||
locations."/_matrix" = {
|
||||
proxyPass = "http://localhost:8448";
|
||||
};
|
||||
locations."/slackbridge" = {
|
||||
proxyPass = "http://localhost:9899";
|
||||
};
|
||||
};
|
||||
## virtual host for Synapse
|
||||
"chat.sealight.xyz" = {
|
||||
forceSSL = true;
|
||||
enableACME = true;
|
||||
#useACMEHost = "sealight.xyz";
|
||||
locations."/" = {
|
||||
proxyPass = "http://localhost:8448";
|
||||
};
|
||||
};
|
||||
|
||||
## virtual host for Riot/Web
|
||||
"element.sealight.xyz" = {
|
||||
forceSSL = true;
|
||||
enableACME = true;
|
||||
#useACMEHost = "sealight.xyz";
|
||||
|
||||
## root points to the riot-web package content, also configured via Nix
|
||||
locations."/" = {
|
||||
root = pkgs.element-web;
|
||||
};
|
||||
};
|
||||
};
|
||||
## other nginx specific best practices
|
||||
recommendedGzipSettings = true;
|
||||
recommendedOptimisation = true;
|
||||
recommendedTlsSettings = true;
|
||||
};
|
||||
|
||||
environment.systemPackages = with pkgs; [ matrix-appservice-slack ];
|
||||
}
|
||||
96
modules/mautrix-whatsapp.nix
Normal file
96
modules/mautrix-whatsapp.nix
Normal file
|
|
@ -0,0 +1,96 @@
|
|||
{ lib, config, pkgs, ... }:
|
||||
|
||||
with lib;
|
||||
|
||||
let
|
||||
cfg = config.services.mautrix-whatsapp;
|
||||
|
||||
configFile = pkgs.runCommand "mautrix-whatsapp" {
|
||||
buildInputs = [ pkgs.mautrix-whatsapp pkgs.remarshal ];
|
||||
preferLocalBuild = true;
|
||||
} ''
|
||||
mkdir -p $out
|
||||
${pkgs.remarshal}/bin/json2yaml -i ${pkgs.writeText "config.json" (builtins.toJSON cfg.configOptions)} \
|
||||
-o $out/config.yaml
|
||||
|
||||
${pkgs.mautrix-whatsapp}/bin/mautrix-whatsapp -c $out/config.yaml -g -r $out/registration.yaml
|
||||
'';
|
||||
|
||||
in
|
||||
{
|
||||
options.services.mautrix-whatsapp = {
|
||||
enable = mkEnableOption "Mautrix-whatsapp, a puppeting bridge between Matrix and WhatsApp.";
|
||||
|
||||
configOptions = mkOption {
|
||||
type = types.attrs;
|
||||
description = ''
|
||||
This options will be transform in YAML configuration file for the bridge
|
||||
|
||||
Look <link xlink:href="https://github.com/tulir/mautrix-whatsapp/wiki/Bridge-setup">here</link> for documentation.
|
||||
'';
|
||||
example = {
|
||||
configOptions = {
|
||||
homeserver = {
|
||||
address = https://matrix.org;
|
||||
domain = "matrix.org";
|
||||
};
|
||||
appservice = {
|
||||
address = http://localhost:8080;
|
||||
hostname = "0.0.0.0";
|
||||
port = 8080;
|
||||
database = {
|
||||
type = "sqlite3";
|
||||
uri = "/var/lib/mautrix-whatsapp/mautrix-whatsapp.db";
|
||||
};
|
||||
state_store_path = "/var/lib/mautrix-whatsapp/mx-state.json";
|
||||
id = "whatsapp";
|
||||
bot = {
|
||||
username = "whatsappbot";
|
||||
displayname = "WhatsApp bridge bot";
|
||||
avatar = "mxc://maunium.net/NeXNQarUbrlYBiPCpprYsRqr";
|
||||
};
|
||||
as_token = "";
|
||||
hs_token = "";
|
||||
};
|
||||
bridge = {
|
||||
username_template = "whatsapp_{{.}}";
|
||||
displayname_template = "{{if .Notify}}{{.Notify}}{{else}}{{.Jid}}{{end}} (WA)";
|
||||
command_prefix = "!wa";
|
||||
permissions = {
|
||||
"@example:matrix.org" = 100;
|
||||
};
|
||||
};
|
||||
logging = {
|
||||
directory = "/var/lib/mautrix-whatsapp/logs";
|
||||
file_name_format = "{{.Date}}-{{.Index}}.log";
|
||||
file_date_format = "\"2006-01-02\"";
|
||||
file_mode = 384;
|
||||
timestamp_format = "Jan _2, 2006 15:04:05";
|
||||
print_level = "debug";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
config = mkIf cfg.enable {
|
||||
systemd.services.mautrix-whatsapp = {
|
||||
description = "Mautrix-WhatsApp Service - A WhatsApp bridge for Matrix";
|
||||
after = [ "network.target" "matrix-synapse.service" ];
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
|
||||
serviceConfig = {
|
||||
DynamicUser = true;
|
||||
StateDirectory = "mautrix-whatsapp";
|
||||
LoggingDir = "mautrix-whatsapp";
|
||||
ExecStart = ''
|
||||
${pkgs.mautrix-whatsapp}/bin/mautrix-whatsapp -c "${configFile}/config.yaml"
|
||||
'';
|
||||
Restart = "on-failure";
|
||||
};
|
||||
};
|
||||
|
||||
#services.matrix-synapse.app_service_config_files = [ "${configFile}/registration.yaml" ];
|
||||
|
||||
};
|
||||
}
|
||||
17
modules/monitoring-helix.nix
Normal file
17
modules/monitoring-helix.nix
Normal file
|
|
@ -0,0 +1,17 @@
|
|||
{ config, pkgs, ... }: {
|
||||
# grafana configuration
|
||||
services.grafana = {
|
||||
enable = true;
|
||||
domain = "grafana.sealight.xyz";
|
||||
port = 2342;
|
||||
addr = "127.0.0.1";
|
||||
};
|
||||
|
||||
# nginx reverse proxy
|
||||
services.nginx.virtualHosts.${config.services.grafana.domain} = {
|
||||
locations."/" = {
|
||||
proxyPass = "http://127.0.0.1:${toString config.services.grafana.port}";
|
||||
proxyWebsockets = true;
|
||||
};
|
||||
};
|
||||
}
|
||||
14
modules/sealight.nix
Normal file
14
modules/sealight.nix
Normal file
|
|
@ -0,0 +1,14 @@
|
|||
{
|
||||
services.nginx = {
|
||||
enable = true;
|
||||
vhost = {
|
||||
"sealight.xyz" = {
|
||||
forceSSL = true;
|
||||
enableACME = true;
|
||||
locations."/" = {
|
||||
root = "/var/www/sealight.xyz"
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
27
modules/wireguard-helix.nix
Normal file
27
modules/wireguard-helix.nix
Normal file
|
|
@ -0,0 +1,27 @@
|
|||
{ config, pkgs, lib, ... }:
|
||||
{
|
||||
environment.systemPackages = [ pkgs.wireguard pkgs.mosh ];
|
||||
networking.nat = {
|
||||
enable = true;
|
||||
externalInterface = "ens3";
|
||||
internalInterfaces = [ "wg0" ];
|
||||
};
|
||||
networking.firewall = {
|
||||
allowedUDPPorts = [ 60990 ];
|
||||
};
|
||||
|
||||
networking.wireguard.interfaces.wg0 = {
|
||||
ips = [ "10.0.69.1/24" ];
|
||||
listenPort = 60990;
|
||||
privateKeyFile = "/var/lib/wireguard/priv";
|
||||
peers = [{ # bowl
|
||||
publicKey = "EzvDUmHXo95S2jKRv/LkH5ItUNOBgM7aQQsaq1WfCRw=";
|
||||
allowedIPs = [ "10.0.69.2/32" ];
|
||||
}
|
||||
{ # line
|
||||
publicKey = "ViRabGV2Mv0SZUVWnoAUhIzaHEvqRXAZJLq3Bp1oN1k=";
|
||||
allowedIPs = [ "10.0.69.3/32" ];
|
||||
}
|
||||
];
|
||||
};
|
||||
}
|
||||
104
nixos-legacy-bios-encrypted.sh
Normal file
104
nixos-legacy-bios-encrypted.sh
Normal file
|
|
@ -0,0 +1,104 @@
|
|||
#!/usr/bin/env bash
|
||||
set -eux
|
||||
|
||||
hostname="bowl"
|
||||
password="xxx"
|
||||
|
||||
diskdev=/dev/sda
|
||||
rootpart=/dev/sda2
|
||||
|
||||
# -o clear
|
||||
# -g convert to gpt disk
|
||||
# -n new partition num:start:end +size
|
||||
# ef00 EFI / 8300 linux fs
|
||||
sgdisk -o -g -n 1::+5M -t 1:ef02 -n 2:: -t 2:8300 $diskdev
|
||||
|
||||
# LVM part
|
||||
echo "$password" | cryptsetup luksFormat --type luks1 -h sha512 $rootpart
|
||||
echo "$password" | cryptsetup luksOpen $rootpart enc-pv
|
||||
|
||||
pvcreate /dev/mapper/enc-pv
|
||||
vgcreate vg0 /dev/mapper/enc-pv
|
||||
lvcreate -L 8G -n swap vg0
|
||||
lvcreate -L 40G -n nixos vg0
|
||||
lvcreate -l '100%FREE' -n home vg0
|
||||
|
||||
# format disk
|
||||
mkfs.ext4 -L root /dev/vg0/nixos
|
||||
mkfs.ext4 -L home /dev/vg0/home
|
||||
mkswap -L swap /dev/vg0/swap
|
||||
|
||||
swapon /dev/vg0/swap
|
||||
mount /dev/vg0/nixos /mnt
|
||||
|
||||
nix-channel --add https://nixos.org/channels/nixos-unstable nixos
|
||||
nix-channel --update
|
||||
|
||||
nixos-generate-config --root /mnt
|
||||
|
||||
for uuid in /dev/disk/by-uuid/*
|
||||
do
|
||||
if test $(readlink -f $uuid) = $rootpart
|
||||
then
|
||||
luksuuid=$uuid
|
||||
break
|
||||
fi
|
||||
done
|
||||
|
||||
cat << EOF > /mnt/etc/nixos/configuration.nix
|
||||
{ config, pkgs, ... }:
|
||||
{
|
||||
imports =
|
||||
[ # Include the results of the hardware scan.
|
||||
./hardware-configuration.nix
|
||||
];
|
||||
boot.loader.grub.devices = [ "/dev/sda" ];
|
||||
boot.loader.grub.enable = true;
|
||||
boot.loader.grub.version = 2;
|
||||
boot.loader.grub.enableCryptodisk = true;
|
||||
boot.loader.supportsInitrdSecrets = true;
|
||||
|
||||
boot.initrd.kernelModules = [ "dm-snapshot" ];
|
||||
boot.initrd.availableKernelModules = ["virtio-pci"];
|
||||
boot.initrd.network = {
|
||||
enable = true;
|
||||
ssh = {
|
||||
enable = true;
|
||||
port = 2222;
|
||||
authorizedKeys = ["ssh-rsa xxx"];
|
||||
hostKeys = [ "/host_ecdsa_key" ];
|
||||
};
|
||||
};
|
||||
|
||||
boot.initrd.luks.devices = [
|
||||
{
|
||||
name = "enc-pv";
|
||||
preLVM = true;
|
||||
device = "$luksuuid";
|
||||
allowDiscards = true;
|
||||
}
|
||||
];
|
||||
|
||||
boot.initrd.secrets = {
|
||||
"/host_ecdsa_key" = "/host_ecdsa_key";
|
||||
};
|
||||
|
||||
boot.cleanTmpDir = true;
|
||||
boot.kernelModules = [ "dm-snapshot" ];
|
||||
nixpkgs.config.allowUnfree = true;
|
||||
users.users.root.initialHashedPassword = "";
|
||||
services.openssh.permitRootLogin = "prohibit-password";
|
||||
networking.hostName = "$hostname";
|
||||
time.timeZone = "Europe/Paris";
|
||||
services.openssh.enable = true;
|
||||
users.users.root.openssh.authorizedKeys.keys = ["ssh-rsa xxx"];
|
||||
system.stateVersion = "20.03";
|
||||
}
|
||||
EOF
|
||||
|
||||
ssh-keygen -t ecdsa -N "" -f host_ecdsa_key
|
||||
|
||||
cp host_ecdsa_key /mnt/
|
||||
|
||||
nixos-install --no-root-passwd
|
||||
|
||||
Loading…
Reference in a new issue