aynish/helm
1
0
Fork 0
Code Pull requests Packages Projects Releases Activity
2102 commits 16 branches 0 tags 41 MiB
Commit graph

249 commits

Author SHA1 Message Date
Henrik Lissner 8a6bf347e9 agenix: use secrets in store 
Rather than the local secrets, which won't be found if the remote has no
~/.config/dotfiles.
 2021-03-03 22:23:50 -05:00
Henrik Lissner 9d90e3a822 Replace lib.paths with config.dotfiles.* 2021-03-01 20:43:12 -05:00
Henrik Lissner 2286d85a68 Rewrite backup services+timers 2021-02-28 20:13:42 -05:00
Henrik Lissner de7714e8d6 Add blender to graphics module 2021-02-28 14:26:48 -05:00
Henrik Lissner 0325968f12 Polish mock syncthing config 2021-02-28 14:26:48 -05:00
Henrik Lissner 8ca2cc66ba mkdir /run/backups/bitwarden_rs 
Since the service fails to do it itself.
 2021-02-27 15:30:02 -05:00
Henrik Lissner 60e3b114db Resolve paths to yarn/npm 2021-02-27 11:20:16 -05:00
Henrik Lissner 3c8481307b Add DOTFILES_BIN envvar 2021-02-26 13:20:46 -05:00
Henrik Lissner c883524efc Replace backup module with built-in solutions 
May not be as universal, but is more certain to work correctly than my
hacked up version that I'm not so invested in.
 2021-02-22 10:40:22 -05:00
Henrik Lissner 5c29620dee Harden & optimize networking settings 2021-02-21 10:27:17 -05:00
Henrik Lissner 0f0f314643 Add noexec & size=25% to tmpfs on /tmp 
Also auto-enable boot.cleanTmpDir if boot.tmpOnTmpfs is off. /tmp
shouldn't be treated as persistent storage!
 2021-02-20 20:50:25 -05:00
Henrik Lissner 1ea4dea1d1 Add modules/desktop/apps/signal 2021-02-20 17:53:37 -05:00
Henrik Lissner 404e0c2881 Tweak rofi styles 2021-02-20 11:39:27 -05:00
Henrik Lissner c603422085 Replace bin/bookmarkmenu with bin/browsermenu 
Handles both history and bookmarks. Also, rewritten in ruby.
 2021-02-17 00:47:30 -05:00
Henrik Lissner db6589fef8 xst: switch to JetBrainsMono & add borderpx 2021-02-15 13:16:18 -05:00
Henrik Lissner 93cada691e Remove celluloid 
Unused and unneeded GUI for mpv.
 2021-02-15 13:16:18 -05:00
Henrik Lissner 5c0a7339a5 Polish qutebrowser theme, integration, & config 2021-02-09 22:07:07 -05:00
Henrik Lissner 0b1ed32aaf Add/revise comments 2021-02-09 22:06:01 -05:00
Henrik Lissner 80a78fe7a7 modules/desktop: add xorg.xwininfo package 2021-02-09 22:00:49 -05:00
Henrik Lissner af7e92b98d Add XDG_BIN_HOME to $PATH 2021-02-09 22:00:39 -05:00
Henrik Lissner ddf772a4d8 Add adl module and packages 2021-02-09 22:00:17 -05:00
Henrik Lissner f4a0da4d87 Use wally-cli & new hardware.keyboard.zsa module for ergodx 2021-02-06 23:33:09 -05:00
Henrik Lissner 8d39061f48 qutebrowser: add bitwarden integration & polish 
+ Add bitwarden integration
+ Polish xkcd userstyle (to better match the alucard theme)
+ Rethink qutebrowser keybinds. Some were redundant, others misplaced.
 2021-02-06 01:26:06 -05:00
Henrik Lissner fd4932ea88 Use unstable neovim 2021-02-05 18:31:36 -05:00
Henrik Lissner deb071d556 qutebrowser: mitigate flash of white between page loads 2021-02-05 18:31:13 -05:00
Henrik Lissner 299257cfd4 Upgrade to qutebrowser 2.0.1 
+ Refactor config (again).
+ Accommodate new Brave adblocker.
+ Polish UI settings (overlay scrollbar)
+ Remove outdated userstyles (some of these sites offer dark modes now)
 2021-02-02 04:08:01 -05:00
Henrik Lissner 9f856bbe47 Simplify qutebrowser config 2021-02-02 04:08:01 -05:00
Henrik Lissner 526dc19eeb Fix & redesign qutebrowser config 2021-02-02 00:53:30 -05:00
Henrik Lissner b7d49362a8 gitea.lfs.enable = true 2021-02-01 19:55:05 -05:00
Henrik Lissner ffb097ce0c fail2ban: move maxretry default to jails 
Throws a "option 'maxretry' in section 'DEFAULT' already exists" error
on startup otherwise.
 2021-01-31 18:43:29 -05:00
Henrik Lissner 25a87f24d9 Reduce gitea logging & disable basic auth for api 
- Disabled SQL logs because they quickly fill up the logs and aren't
  useful, currently. Also, smaller logs = easier job for fail2ban.
- Disabled basic auth because it's the least secure method of
  interacting with the gitea API. Tokens/oauth are better.
 2021-01-31 18:39:01 -05:00
Henrik Lissner c32a1846e0 Tweak fail2ban defaults 2021-01-31 18:39:01 -05:00
Henrik Lissner 68fa845a73 Add comments & remove redundant config 
IS_TLS_ENABLED = true is implied if HOST's port is 465
 2021-01-31 18:20:17 -05:00
Henrik Lissner 78d85018b0 Fix redundant nginx directive 
And typo. Should be 128k, not 1k!
 2021-01-30 17:10:25 -05:00
Henrik Lissner fe4a34a9e3 Harden nginx defaults 2021-01-30 17:07:52 -05:00
Henrik Lissner 2da00f3ad5 fail2ban: speed up gitea/bitwarden jails 
These services log to syslog, so a log file doesn't exist, meaning
fail2ban must scan the whole journal to seek authentication failure
logs, which is slow! By specifying a journalmatch, it significantly
narrows the scope of their searches.
 2021-01-30 06:04:38 -05:00
Henrik Lissner d380e06cba Make fail2ban defaults less forgiving 2021-01-30 04:52:13 -05:00
Henrik Lissner 24d5a426f5 Clean up modules/desktop/media/daw.nix 2021-01-30 02:39:00 -05:00
Henrik Lissner f88552ad64 Add modules/services/syncthing.nix 
Generalizes the module so it's not so Henrik-centric. I know,
blasphemous, but the world only sometimes revolves around me.

Also, adds a new, much simpler config for syncthing.
 2021-01-26 23:00:01 -05:00
Henrik Lissner 41ac027216 Add modules/backup.nix 
A rudimentary backup and restoration system.
 2021-01-26 23:00:01 -05:00
Henrik Lissner dd62442c09 Install ripgrep in zsh module 2021-01-26 22:58:47 -05:00
Henrik Lissner be343218e9 Add modules/desktop/browsers/brave.nix 2021-01-26 22:58:47 -05:00
Henrik Lissner 5ceb72ddee Remove services.gitea.disableRegistration default 
This can be done in the host file, once its ready to disable
registration.
 2021-01-26 22:58:47 -05:00
Henrik Lissner e703bd374d New ssh pubkey & redesign 'hey push' 
Remote rebuilding requires root access, but I don't want root ssh
access (even by ssh key) to be a permanent fixture of my servers.  So
I've changed 'hey push' to copy my remote user's `authorized_keys` to
/root/.ssh/ temporarily, until the rebuild is complete. It is removed
afterwards.

This should be done non-destructively in the future, but it suits my
needs for now.
 2021-01-26 22:56:50 -05:00
Henrik Lissner 69d730f89d Add agenix 
Indexes all *.age files in $HOST/secrets/
 2021-01-22 20:01:55 -05:00
Henrik Lissner a1ab0811bb Refactor 2021-01-20 01:28:30 -05:00
Henrik Lissner 096a60d61f
services/nginx: add main user to nginx group 2021-01-02 00:26:07 -05:00
Henrik Lissner bca8c84ab3
Minor refactors & readme revision 2021-01-02 00:26:00 -05:00
Henrik Lissner 608b3472b9
security.acme.acceptTerms = true 
So we don't have to later.
 2021-01-02 00:24:20 -05:00
Henrik Lissner 177a7eec6f
Add services/fail2ban module 
With bitwarden_rs & gitea filters
 2021-01-01 21:19:06 -05:00