Compare commits

..

No commits in common. "0e7cacc12b2d19c8fac0a21271ebe83e60e49a48" and "38a4c41a1fae0bb6feede89147e01b9ad0afa1be" have entirely different histories.

41 changed files with 107 additions and 606 deletions

View file

@ -4,27 +4,6 @@ var REG_NONE = NewRegistrar('none'); // No registrar.
var DNS_BIND = NewDnsProvider('bind'); // ISC BIND. var DNS_BIND = NewDnsProvider('bind'); // ISC BIND.
var DNS_HEDNS = NewDnsProvider('hedns'); var DNS_HEDNS = NewDnsProvider('hedns');
D("lakhwara.com", REG_NONE,
DnsProvider(DNS_HEDNS),
DefaultTTL(86400),
//SOA('@', 'ns1.he.net.', 'hostmaster.he.net.', 2022041702, 86400, 7200, 3600000, 86400, TTL(172800)),
A('anish', '103.16.130.98'),
A('coaching', '103.16.130.98'),
TXT('anish', 'datkey=dat://1a240a14fab2bae9c85ebad29bddc04505aaba24e5fb809c2ccb4cdf71e3a7d5'),
CNAME('fm1._domainkey', 'fm1.lakhwara.com.dkim.fmhosted.com.'),
CNAME('fm2._domainkey', 'fm2.lakhwara.com.dkim.fmhosted.com.'),
CNAME('fm3._domainkey', 'fm3.lakhwara.com.dkim.fmhosted.com.'),
A('@', '103.16.130.98'),
MX('@', 10, 'in1-smtp.messagingengine.com.'),
MX('@', 20, 'in2-smtp.messagingengine.com.'),
//NAMESERVER('ns1.he.net.'),
//NAMESERVER('ns2.he.net.'),
//NAMESERVER('ns3.he.net.'),
//NAMESERVER('ns4.he.net.'),
//NAMESERVER('ns5.he.net.'),
TXT('@', 'v=spf1 include:spf.messagingengine.com ?all')
)
D('sealight.xyz', REG_NONE, DnsProvider(DNS_HEDNS), D('sealight.xyz', REG_NONE, DnsProvider(DNS_HEDNS),
DefaultTTL(86400), DefaultTTL(86400),
//SOA('@', 'ns1.he.net.', 'hostmaster.he.net.', 2022121008, 86400, 7200, 3600000, 172800, TTL(172800)), //SOA('@', 'ns1.he.net.', 'hostmaster.he.net.', 2022121008, 86400, 7200, 3600000, 172800, TTL(172800)),
@ -34,11 +13,11 @@ D('sealight.xyz', REG_NONE, DnsProvider(DNS_HEDNS),
//NAMESERVER('ns4.he.net.'), //NAMESERVER('ns4.he.net.'),
//NAMESERVER('ns5.he.net.'), //NAMESERVER('ns5.he.net.'),
// capsul: helix // capsul: helix
A('bridge', '69.61.2.203', TTL(300)), A('bridge', '69.61.38.225', TTL(300)),
A('rss', '69.61.2.203', TTL(300)), A('rss', '69.61.38.225', TTL(300)),
A('git', '69.61.2.203', TTL(300)), A('git', '69.61.38.225', TTL(300)),
A('bin', '69.61.2.203', TTL(300)), A('bin', '69.61.38.225', TTL(300)),
A('ci', '69.61.2.203', TTL(300)), A('ci', '69.61.38.225', TTL(300)),
// vultr -> nulled: lituus // vultr -> nulled: lituus
A('@', '45.77.48.108', TTL(300)), A('@', '45.77.48.108', TTL(300)),
A('jitsi', '45.77.48.108', TTL(300)), A('jitsi', '45.77.48.108', TTL(300)),

View file

@ -1,22 +0,0 @@
; lakhwara.com Dumped Sun May 28 22:30:02 2023
;
lakhwara.com. 172800 IN SOA ns1.he.net. hostmaster.he.net. (
2022041702 ;serial
86400 ;refresh
7200 ;retry
3600000 ;expire
86400 ) ;minimum
anish.lakhwara.com. 86400 IN A 103.16.130.98
anish.lakhwara.com. 86400 IN TXT datkey=dat://1a240a14fab2bae9c85ebad29bddc04505aaba24e5fb809c2ccb4cdf71e3a7d5
fm1._domainkey.lakhwara.com. 86400 IN CNAME fm1.lakhwara.com.dkim.fmhosted.com.
fm2._domainkey.lakhwara.com. 86400 IN CNAME fm2.lakhwara.com.dkim.fmhosted.com.
fm3._domainkey.lakhwara.com. 86400 IN CNAME fm3.lakhwara.com.dkim.fmhosted.com.
lakhwara.com. 86400 IN A 103.16.130.98
lakhwara.com. 86400 IN MX 10 in1-smtp.messagingengine.com.
lakhwara.com. 86400 IN MX 20 in2-smtp.messagingengine.com.
lakhwara.com. 86400 IN NS ns1.he.net.
lakhwara.com. 86400 IN NS ns2.he.net.
lakhwara.com. 86400 IN NS ns3.he.net.
lakhwara.com. 86400 IN NS ns4.he.net.
lakhwara.com. 86400 IN NS ns5.he.net.
lakhwara.com. 86400 IN TXT "v=spf1 include:spf.messagingengine.com ?all"

View file

@ -77,11 +77,11 @@
"utils": "utils" "utils": "utils"
}, },
"locked": { "locked": {
"lastModified": 1683779844, "lastModified": 1674127017,
"narHash": "sha256-sIeOU0GsCeQEn5TpqE/jFRN4EGsPsjqVRsPdrzIDABM=", "narHash": "sha256-QO1xF7stu5ZMDLbHN30LFolMAwY6TVlzYvQoUs1RD68=",
"owner": "serokell", "owner": "serokell",
"repo": "deploy-rs", "repo": "deploy-rs",
"rev": "c80189917086e43d49eece2bd86f56813500a0eb", "rev": "8c9ea9605eed20528bf60fae35a2b613b901fd77",
"type": "github" "type": "github"
}, },
"original": { "original": {
@ -122,26 +122,6 @@
"type": "github" "type": "github"
} }
}, },
"disko": {
"inputs": {
"nixpkgs": [
"nixpkgs"
]
},
"locked": {
"lastModified": 1684783210,
"narHash": "sha256-hxRbwwBTu1G1u1EdI9nEo/n4HIsQIfNi+2BQ1nEoj/o=",
"owner": "nix-community",
"repo": "disko",
"rev": "f0b9f374bb42fdcd57baa7d4448ac5d4788226bd",
"type": "github"
},
"original": {
"owner": "nix-community",
"repo": "disko",
"type": "github"
}
},
"eww": { "eww": {
"inputs": { "inputs": {
"flake-compat": "flake-compat_2", "flake-compat": "flake-compat_2",
@ -479,7 +459,6 @@
"agenix": "agenix", "agenix": "agenix",
"basant": "basant", "basant": "basant",
"deploy-rs": "deploy-rs", "deploy-rs": "deploy-rs",
"disko": "disko",
"eww": "eww", "eww": "eww",
"grasp": "grasp", "grasp": "grasp",
"hardware": "hardware", "hardware": "hardware",
@ -492,8 +471,7 @@
"poonam": "poonam", "poonam": "poonam",
"rust-overlay": "rust-overlay", "rust-overlay": "rust-overlay",
"tidalcycles": "tidalcycles", "tidalcycles": "tidalcycles",
"unstable": "unstable", "unstable": "unstable"
"vimwikicli": "vimwikicli"
} }
}, },
"rust-overlay": { "rust-overlay": {
@ -677,27 +655,6 @@
"url": "ssh://gitea@git.sealight.xyz/aynish/vimwiki-cli" "url": "ssh://gitea@git.sealight.xyz/aynish/vimwiki-cli"
} }
}, },
"vimwikicli": {
"inputs": {
"nixpkgs": [
"nixpkgs"
]
},
"locked": {
"lastModified": 1662448409,
"narHash": "sha256-Xd8CuFcEpEQK/TjNBXcp1HqPJCc7LwkMqKa1WiAP1Zc=",
"ref": "main",
"rev": "a73c4695cf116c2e8194a5caa837c2f9e1a7e2fb",
"revCount": 7,
"type": "git",
"url": "ssh://gitea@git.sealight.xyz/aynish/vimwiki-cli"
},
"original": {
"ref": "main",
"type": "git",
"url": "ssh://gitea@git.sealight.xyz/aynish/vimwiki-cli"
}
},
"vowel-src": { "vowel-src": {
"flake": false, "flake": false,
"locked": { "locked": {

View file

@ -17,23 +17,17 @@
agenix.inputs.nixpkgs.follows = "nixpkgs"; agenix.inputs.nixpkgs.follows = "nixpkgs";
deploy-rs.url = "github:serokell/deploy-rs"; deploy-rs.url = "github:serokell/deploy-rs";
deploy-rs.inputs.nixpkgs.follows = "nixpkgs"; deploy-rs.inputs.nixpkgs.follows = "nixpkgs";
disko.url = "github:nix-community/disko";
disko.inputs.nixpkgs.follows = "nixpkgs";
# My Packages # Packages
poonam.url = "git+ssh://gitea@git.sealight.xyz/aynish/kitaab?ref=main"; poonam.url = "git+ssh://gitea@git.sealight.xyz/aynish/kitaab?ref=main";
poonam.inputs.nixpkgs.follows = "nixpkgs"; poonam.inputs.nixpkgs.follows = "nixpkgs";
basant.url = "git+ssh://gitea@git.sealight.xyz/aynish/basant?ref=main"; basant.url = "git+ssh://gitea@git.sealight.xyz/aynish/basant?ref=main";
vimwikicli.url = "git+ssh://gitea@git.sealight.xyz/aynish/vimwiki-cli?ref=main";
basant.inputs.nixpkgs.follows = "nixpkgs"; basant.inputs.nixpkgs.follows = "nixpkgs";
basant.inputs.poonam.follows = "poonam"; basant.inputs.poonam.follows = "poonam";
vimwikicli.inputs.nixpkgs.follows = "nixpkgs";
grasp.url = "git+ssh://gitea@git.sealight.xyz/aynish/grasp.git?ref=main"; grasp.url = "git+ssh://gitea@git.sealight.xyz/aynish/grasp.git?ref=main";
grasp.inputs.nixpkgs.follows = "nixpkgs"; grasp.inputs.nixpkgs.follows = "nixpkgs";
# Matrix # Matrix
nix-matrix-appservices.url = "gitlab:coffeetables/nix-matrix-appservices"; nix-matrix-appservices.url = "gitlab:coffeetables/nix-matrix-appservices";
# Others # Others
nur.url = "github:nix-community/NUR"; nur.url = "github:nix-community/NUR";
rust-overlay = { rust-overlay = {
@ -66,7 +60,6 @@
, home-manager , home-manager
, deploy-rs , deploy-rs
, agenix , agenix
, disko
, basant , basant
, grasp , grasp
, nix-matrix-appservices , nix-matrix-appservices
@ -75,7 +68,6 @@
, rust-overlay , rust-overlay
, eww , eww
, llamacpp , llamacpp
, vimwikicli
, ... , ...
}@inputs: }@inputs:
let let
@ -94,9 +86,6 @@
llamaOverlay = final: prev: { llamaOverlay = final: prev: {
llama = llamacpp.packages.${prev.system}.default; llama = llamacpp.packages.${prev.system}.default;
}; };
vimwikiOverlay = final: prev: {
vimwiki-cli = vimwikicli.packages.${prev.system}.vimwiki-cli;
};
nixpkgsFor = forAllSystems (system: import nixpkgs { nixpkgsFor = forAllSystems (system: import nixpkgs {
inherit system; inherit system;
@ -117,8 +106,6 @@
nur.overlay nur.overlay
nix-matrix-appservices.overlay nix-matrix-appservices.overlay
unstableOverlay unstableOverlay
llamaOverlay
vimwikiOverlay
self.overlays.additions self.overlays.additions
self.overlays.modifications self.overlays.modifications
]; ];
@ -188,7 +175,6 @@
self.nixosModules.backup self.nixosModules.backup
self.nixosModules.wireguard self.nixosModules.wireguard
self.nixosModules.microbin self.nixosModules.microbin
disko.nixosModules.disko
]; ];
}; };
@ -236,7 +222,6 @@
self.nixosModules.wallabag self.nixosModules.wallabag
self.nixosModules.gonic self.nixosModules.gonic
self.nixosModules.ulogger-server self.nixosModules.ulogger-server
self.nixosModules.photoprism
grasp.nixosModule grasp.nixosModule
home-manager.nixosModules.home-manager home-manager.nixosModules.home-manager
{ {
@ -264,7 +249,6 @@
deploy.nodes = { deploy.nodes = {
box = { box = {
hostname = "mossnet.lan"; hostname = "mossnet.lan";
autoRollback = false;
profiles.system = { profiles.system = {
user = "root"; user = "root";
path = deploy-rs.lib.x86_64-linux.activate.nixos self.nixosConfigurations.box; path = deploy-rs.lib.x86_64-linux.activate.nixos self.nixosConfigurations.box;
@ -272,7 +256,7 @@
}; };
lituus = { lituus = {
hostname = "sealight.xyz"; hostname = "sealight.xyz";
# autoRollback = false; autoRollback = false;
profiles.system = { profiles.system = {
user = "root"; user = "root";
path = deploy-rs.lib.x86_64-linux.activate.nixos self.nixosConfigurations.lituus; path = deploy-rs.lib.x86_64-linux.activate.nixos self.nixosConfigurations.lituus;
@ -280,7 +264,7 @@
}; };
helix = { helix = {
hostname = "git.sealight.xyz"; hostname = "git.sealight.xyz";
autoRollback = false; # autoRollback = false;
profiles.system = { profiles.system = {
user = "root"; user = "root";
path = deploy-rs.lib.x86_64-linux.activate.nixos self.nixosConfigurations.helix; path = deploy-rs.lib.x86_64-linux.activate.nixos self.nixosConfigurations.helix;

View file

@ -6,6 +6,5 @@
../profiles/desktop ../profiles/desktop
../profiles/email ../profiles/email
../profiles/cal ../profiles/cal
../profiles/sync/kitaab
]; ];
} }

View file

@ -1,5 +0,0 @@
#!/usr/bin/env bash
working_directory=$(pwd)
vim_directory="${working_directory//\//%}.vim"
trash "$HOME/.local/share/nvim/sessions/${vim_directory}"

View file

@ -58,8 +58,6 @@
fontconfig fontconfig
pandoc pandoc
taskwarrior-tui taskwarrior-tui
python3Packages.howdoi
vimwiki-cli
(pkgs.writeScriptBin "jq-repl" '' (pkgs.writeScriptBin "jq-repl" ''
#!/usr/bin/env bash #!/usr/bin/env bash
@ -73,7 +71,6 @@
echo "" \ | fzf --phony --preview-window="up:90%" --print-query --preview "jq --color-output -r {q} $input" echo "" \ | fzf --phony --preview-window="up:90%" --print-query --preview "jq --color-output -r {q} $input"
'') '')
(pkgs.writeScriptBin "clear-vim-trash" (builtins.readFile ./bin/clear-vim-trash.sh))
(pkgs.writeScriptBin "flakify" '' (pkgs.writeScriptBin "flakify" ''
#!/usr/bin/env zsh #!/usr/bin/env zsh
if [ ! -e flake.nix ]; then if [ ! -e flake.nix ]; then
@ -215,7 +212,6 @@
kr = "cd /home/anish/kitaab/vimwiki; exa --sort=modified --reverse | fzf --preview 'bat --style=numbers --color=always --terminal-width -1 ./{}'"; kr = "cd /home/anish/kitaab/vimwiki; exa --sort=modified --reverse | fzf --preview 'bat --style=numbers --color=always --terminal-width -1 ./{}'";
icat = "kitty +kitten icat"; icat = "kitty +kitten icat";
yt = "ytfzf -T kitty -t "; yt = "ytfzf -T kitty -t ";
gen-secret = "< /dev/urandom tr -dc _A-Z-a-z-0-9 | head -c\${1:-32};echo;";
# modern cli tools # modern cli tools
ls = "exa --icons"; ls = "exa --icons";
@ -298,7 +294,7 @@
jtl = "journalctl"; jtl = "journalctl";
# quick ssh # quick ssh
kssh = "kitty +kitten ssh"; kssh = "kitten +kitty ssh";
smm = "ssh 10.0.69.4"; # box over wireguard smm = "ssh 10.0.69.4"; # box over wireguard
sm = "ssh mossnet.lan"; # box regular sm = "ssh mossnet.lan"; # box regular
sl = "ssh sealight.xyz"; # lituus sl = "ssh sealight.xyz"; # lituus

View file

@ -33,21 +33,6 @@ in
termpdfpy termpdfpy
]; ];
xdg.desktopEntries = {
ocr = {
name = "OCR image";
exec = "${pkgs.writeScript "ocr" ''
${pkgs.xfce.xfce4-screenshooter}/bin/xfce4-screenshooter -r --save /tmp/ocr-tmp.png
${pkgs.tesseract}/bin/tesseract /tmp/ocr-tmp.png | ${pkgs.xclip}/bin/xclip -sel clip
rm /tmp/ocr-tmp.png
''}";
};
screenshot = {
name = "Screenshot";
exec = "screenshot";
};
};
# set up env # set up env
xsession.enable = true; xsession.enable = true;

View file

@ -6,7 +6,6 @@ bold_italic_font auto
open_url_with default open_url_with default
mouse_map left click ungrabbed mouse_click_url_or_select mouse_map left click ungrabbed mouse_click_url_or_select
confirm_os_window_close 0 confirm_os_window_close 0
enable_bell_audio no
-- Allows zen-mode.nvim to increase font size -- Allows zen-mode.nvim to increase font size
-- allow_remote_control socket-only -- allow_remote_control socket-only
-- listen_on unix:/tmp/kitty -- listen_on unix:/tmp/kitty

View file

@ -1,32 +0,0 @@
{ pkgs, ... }:
let
name = "kitaab-sync";
# Note this will fail if index.wiki is open in vim while this runs
mkStartScript = name: pkgs.writeShellScript "${name}.sh" ''
set -euo pipefail
PATH=/run/current-system/sw/bin:/etc/profiles/per-user/anish/bin:
cd /home/anish/kitaab
vimwiki tags rebuild
git add -A
git diff-index --quiet HEAD || git commit -m 'syncing kitaab' # if nothing, don't exit 1
git push
exit 0
'';
in
{
systemd.user.services.kitaab-sync = {
Service = {
ExecStart = "${mkStartScript name}";
};
};
systemd.user.timers.kitaab-sync = {
Install = {
WantedBy = [ "timers.target" ];
PartOf = [ "kitaab-sync.service" ];
};
Timer = {
OnCalendar = [ "hourly" ];
};
};
}

View file

@ -24,14 +24,13 @@
../profiles/woodpecker-agent ../profiles/woodpecker-agent
../profiles/jellyfin ../profiles/jellyfin
../profiles/ulogger-server ../profiles/ulogger-server
../profiles/photoprism
]; ];
# Backups # Backups
age.secrets.borg-password.file = "${self}/secrets/borg-password.age"; age.secrets.borg-password.file = "${self}/secrets/borg-password.age";
services.postgresqlBackup = { services.postgresqlBackup = {
enable = true; enable = true;
databases = [ "wallabag" "photoprism" "ulogger" ]; databases = [ "wallabag" ];
location = "/var/backup/postgresql"; location = "/var/backup/postgresql";
}; };
mossnet.backup = { mossnet.backup = {
@ -53,7 +52,6 @@
age.secrets.box-wg.file = "${self}/secrets/box-wg.age"; age.secrets.box-wg.file = "${self}/secrets/box-wg.age";
age.secrets.box-wg.owner = "anish"; age.secrets.box-wg.owner = "anish";
age.secrets.borg-key.file = "${self}/secrets/borg-key.age";
mossnet.wg = { mossnet.wg = {
enable = true; enable = true;
ips = [ "10.0.69.4/24" ]; ips = [ "10.0.69.4/24" ];

View file

@ -6,11 +6,4 @@
../profiles/server ../profiles/server
../profiles/site ../profiles/site
]; ];
services.nginx.enable = true;
services.nginx.virtualHosts."coaching.lakhwara.com" = {
forceSSL = true;
enableACME = true;
locations."/" = { root = "/var/lib/coaching"; index = "/index.html"; };
};
} }

View file

@ -6,6 +6,7 @@
../profiles/core ../profiles/core
../profiles/bluetooth ../profiles/bluetooth
../profiles/music ../profiles/music
../profiles/sync/kitaab
../profiles/sync/cal ../profiles/sync/cal
../profiles/wifi ../profiles/wifi
../profiles/desktop ../profiles/desktop
@ -13,7 +14,6 @@
../profiles/syncthing ../profiles/syncthing
../profiles/mossnet-hosts ../profiles/mossnet-hosts
../profiles/kuberenetes ../profiles/kuberenetes
# ../profiles/mount-mossnet
]; ];
# home-manager.users.anish = import ../../home/gui; # home-manager.users.anish = import ../../home/gui;

View file

@ -1,10 +1,10 @@
{ self, profiles, suites, pkgs, ... }: { self, profiles, suites, ... }:
{ {
imports = [ imports = [
./configuration.nix ./configuration.nix
../profiles/core ../profiles/core
../profiles/server ../profiles/server
# ../profiles/metrics ../profiles/metrics
../profiles/gitea ../profiles/gitea
../profiles/woodpecker-server ../profiles/woodpecker-server
../profiles/rss-bridge ../profiles/rss-bridge
@ -19,31 +19,10 @@
extraGroups = [ "wheel" ]; extraGroups = [ "wheel" ];
}; };
age.secrets.helix-wg.file = "${self}/secrets/helix-wg.age";
age.secrets.helix-wg.owner = "anish";
mossnet.wg = { mossnet.wg = {
enable = true; enable = true;
ips = [ "10.0.69.5/24" ]; ips = [ "10.0.69.5/24" ];
privateKeyFile = "/run/agenix/helix-wg"; privateKeyFile = "/home/anish/wg/wg-priv";
}; };
services.postgresql.package = pkgs.postgresql_11;
services.postgresqlBackup = {
# TODO needs working wireguard to box
enable = false;
databases = [ "gitea" "freshrss" "woodpecker" ];
location = "/mnt/two/postgres";
};
mossnet.backup = {
enable = true;
name = "helix";
paths = [
"/var/lib/gitea"
"/var/lib/freshrss"
"/var/lib/woodpecker"
"/var/lib/microbin"
];
};
} }

View file

@ -1,51 +0,0 @@
{ disks ? [ "/dev/vdb" ], ... }: {
disko.devices = {
disk = {
vdb = {
type = "disk";
device = builtins.elemAt disks 0;
content = {
type = "table";
format = "gpt";
partitions = [
{
name = "ESP";
start = "1MiB";
end = "128MiB";
fs-type = "fat32";
bootable = true;
content = {
type = "filesystem";
format = "vfat";
mountpoint = "/boot";
};
}
{
name = "root";
start = "128MiB";
end = "100%";
content = {
type = "btrfs";
extraArgs = [ "-f" ]; # Override existing partition
subvolumes = {
# Subvolume name is different from mountpoint
"/rootfs" = {
mountpoint = "/";
};
# Mountpoints inferred from subvolume name
"/home" = {
mountOptions = [ "compress=zstd" ];
};
"/nix" = {
mountOptions = [ "compress=zstd" "noatime" ];
};
};
};
}
];
};
};
};
};
}

View file

@ -5,27 +5,23 @@
{ {
imports = imports =
[ (modulesPath + "/profiles/qemu-guest.nix") [
(modulesPath + "/profiles/qemu-guest.nix")
]; ];
boot.initrd.availableKernelModules = [ "ata_piix" "virtio_pci" "floppy" "sr_mod" "virtio_blk" ]; boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "sr_mod" "virtio_blk" ];
boot.initrd.kernelModules = [ ]; boot.initrd.kernelModules = [ ];
boot.kernelModules = [ ]; boot.kernelModules = [ ];
boot.extraModulePackages = [ ]; boot.extraModulePackages = [ ];
fileSystems."/" = fileSystems."/" =
{ device = "/dev/disk/by-uuid/7c560634-d545-41cc-b375-42ce3037fd73"; {
fsType = "ext4"; device = "/dev/disk/by-uuid/3b8b2c4b-835e-4822-8ac8-0effdc8270d6";
fsType = "btrfs";
}; };
swapDevices = [ ]; swapDevices = [ ];
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking nix.settings.max-jobs = lib.mkDefault 1;
# (the default) this is the recommended approach. When using systemd-networkd it's nixpkgs.hostPlatform = "x86_64-linux";
# still possible to use this option, but it's recommended to use it in conjunction
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
networking.useDHCP = lib.mkDefault true;
# networking.interfaces.ens3.useDHCP = lib.mkDefault true;
hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
} }

View file

@ -4,6 +4,7 @@ in
{ {
imports = [ ../../users/anish ]; imports = [ ../../users/anish ];
fonts = { fonts = {
fonts = with pkgs; [ powerline-fonts dejavu_fonts ]; fonts = with pkgs; [ powerline-fonts dejavu_fonts ];
fontconfig.defaultFonts = { fontconfig.defaultFonts = {

View file

@ -26,6 +26,7 @@ let
"read.mossnet.lan" "read.mossnet.lan"
"stats.mossnet.lan" "stats.mossnet.lan"
"music.mossnet.lan" "music.mossnet.lan"
"rss.mossnet.lan"
"tasks.mossnet.lan" "tasks.mossnet.lan"
"file.mossnet.lan" "file.mossnet.lan"
"books.mossnet.lan" "books.mossnet.lan"
@ -35,7 +36,6 @@ let
"archive.mossnet.lan" "archive.mossnet.lan"
"tracks.mossnet.lan" "tracks.mossnet.lan"
"grasp.mossnet.lan" "grasp.mossnet.lan"
"photos.mossnet.lan"
]; ];
in in
{ {
@ -44,31 +44,26 @@ in
settings = { settings = {
server = { server = {
include = "${adblockLocalZones}"; include = "${adblockLocalZones}";
prefetch = "yes";
# private-address = "10.0.69.0/8";
# private-address = "192.168.1.0/24";
cache-min-ttl = 0;
serve-expired = "yes";
interface = [ "0.0.0.0" ]; interface = [ "0.0.0.0" ];
access-control = [ "127.0.0.0/8 allow" "192.168.1.0/24 allow" "10.0.69.0/24 allow" ]; access-control = [ "127.0.0.0/24 allow" "192.168.0.0/24 allow" "10.0.69.0/24 allow" ];
access-control-view = "10.0.69.0/24 wireguard"; access-control-view = "10.0.69.0/24 wireguard";
# so-reuseport = "yes";
tls-upstream = "yes";
domain-insecure = "mossnet.lan";
local-zone = ''"mossnet.lan." redirect''; local-zone = ''"mossnet.lan." redirect'';
local-data = ''"mossnet.lan. IN A ${mossnet}"''; local-data = ''"mossnet.lan. IN A ${mossnet}"'';
}; };
forward-zone = [{ forward-zone = [{
name = "."; name = ".";
forward-addr = [ "45.90.28.0#6939b9.dns.nextdns.io" "1.1.1.1@853#cloudflare-dns.com" ]; forward-addr = [ "45.90.30.49" "45.90.28.49" "1.1.1.1" "8.8.8.8" ];
# non-tls
# forward-addr = ["45.90.30.49" "45.90.28.49" "1.1.1.1" "8.8.8.8"]
}]; }];
view = { view = {
name = "wireguard"; name = "wireguard";
local-zone = ''"mossnet.lan." redirect''; local-zone = ''"mossnet.lan." redirect'';
local-data = ''"mossnet.lan. IN A ${wg-mossnet}"''; local-data = ''"mossnet.lan. IN A ${wg-mossnet}"'';
}; };
do-not-query-localhost = "no";
# Eventually we'll add DNSSEC / DoT
# so-reuseport: yes
# tls-cert-bundle: /etc/ssl/certs/ca-certificates.crt
# tls-upstream: yes
}; };
}; };

View file

@ -2,7 +2,7 @@
{ {
services.paperless = { services.paperless = {
enable = false; enable = true;
consumptionDirIsPublic = true; consumptionDirIsPublic = true;
extraConfig.PAPERLESS_AUTO_LOGIN_USERNAME = "admin"; extraConfig.PAPERLESS_AUTO_LOGIN_USERNAME = "admin";
}; };
@ -18,7 +18,6 @@
path = [ path = [
pkgs.fava pkgs.fava
]; ];
wantedBy = [ "multi-user.target" ];
before = [ "nginx.service" ]; before = [ "nginx.service" ];
serviceConfig = { serviceConfig = {
User = "anish"; User = "anish";

View file

@ -17,6 +17,7 @@
services.postgresql = { services.postgresql = {
enable = true; # Ensure postgresql is enabled enable = true; # Ensure postgresql is enabled
package = pkgs.postgresql_11;
authentication = '' authentication = ''
local freshrss all ident map=freshrss-users local freshrss all ident map=freshrss-users
''; '';
@ -25,11 +26,8 @@
freshrss-users freshrss freshrss freshrss-users freshrss freshrss
''; '';
ensureDatabases = [ "freshrss" ]; ensureDatabases = [ "freshrss" ];
ensureUsers = [
{ name = "freshrss"; ensurePermissions."DATABASE freshrss" = "ALL PRIVILEGES"; }
];
# TODO # TODO
# initialScript # set password for freshrss user # initialScript # set password for gitea user
}; };
services.nginx.virtualHosts."rss.sealight.xyz" = { services.nginx.virtualHosts."rss.sealight.xyz" = {

View file

@ -22,21 +22,19 @@
repository = { repository = {
DEFAULT_BRANCH = "main"; DEFAULT_BRANCH = "main";
}; };
# TODO
"markup.restructuredtext" = { "markup.restructuredtext" = {
ENABLED = true; ENABLED = true;
FILE_EXTENSIONS = ".rst"; FILE_EXTENSIONS = ".rst";
RENDER_COMMAND = "timeout 30s pandoc +RTS -RTS -f rst"; RENDER_COMMAND = "pandoc +RTS -M512M -RTS -f rst";
IS_INPUT_FILE = false; IS_INPUT_FILE = false;
}; };
# TODO
mailer = { mailer = {
ENABLED = true; ENABLED = false;
MAILER_TYPE = "smtp"; MAILER_TYPE = "smtp";
FROM = "ops@sealight.xyz"; FROM = "ops@sealight.xyz";
SMTP_ADDR = "smtp.nullhex.com"; SENDMAIL_PATH = "${pkgs.system-sendmail}/bin/sendmail";
SMTP_PORT = "465";
USER = "ops@sealight.xyz";
PASSWD = "breed deputy fossil glory"; # TODO how do we pass this from agenix?
IS_TLS_ENABLED = "true";
}; };
}; };
}; };
@ -51,7 +49,7 @@
'' ''
gitea-users gitea gitea gitea-users gitea gitea
''; '';
ensureDatabases = [ "gitea" ]; # ensureDatabases = [ "gitea" ];
ensureUsers = [ ensureUsers = [
{ name = "gitea"; ensurePermissions."DATABASE gitea" = "ALL PRIVILEGES"; } { name = "gitea"; ensurePermissions."DATABASE gitea" = "ALL PRIVILEGES"; }
]; ];
@ -73,4 +71,6 @@
}; };
}; };
networking.firewall.allowedTCPPorts = [ 80 443 22 ]; networking.firewall.allowedTCPPorts = [ 80 443 22 ];
security.acme.defaults.email = "anish+acme@lakhwara.com";
security.acme.acceptTerms = true;
} }

View file

@ -3,7 +3,7 @@
{ {
# k3s # k3s
networking.firewall.allowedTCPPorts = [ 6443 ]; networking.firewall.allowedTCPPorts = [ 6443 ];
services.k3s.enable = false; services.k3s.enable = true;
services.k3s.role = "server"; services.k3s.role = "server";
services.k3s.clusterInit = true; services.k3s.clusterInit = true;
# services.k3s.extraFlags = toString [ # services.k3s.extraFlags = toString [
@ -15,6 +15,6 @@
virtualisation.docker.enable = true; virtualisation.docker.enable = true;
virtualisation.docker.storageDriver = "btrfs"; virtualisation.docker.storageDriver = "btrfs";
# or use kvm # or use kvm
virtualisation.libvirtd.enable = true; #virtualisation.libvrt.enable = true;
users.users.anish.extraGroups = [ "docker" "libvert" ]; # users.users.anish.extraGroups = [ "docker" ]; # "libvert"
} }

View file

@ -1,49 +1,25 @@
{ self, config, pkgs, ... }: { { self, config, pkgs, ... }: {
age.secrets.nullhex-smtp.file = "${self}/secrets/nullhex-smtp.age";
age.secrets.nullhex-smtp.owner = "grafana";
# grafana configuration # grafana configuration
services.grafana = { services.grafana = {
enable = true; enable = true;
settings = { settings.server = {
smtp = { domain = "stats.mossnet.lan";
enabled = true; http_port = 2342;
password = "$__file{/run/agenix/nullhex-smtp}"; http_addr = "127.0.0.1";
host = "smtp.nullhex.com";
user = "ops@sealight.xyz";
from_address = "ops@sealight.xyz";
};
server = {
domain = "stats.mossnet.lan";
http_addr = "127.0.0.1";
http_port = 2342;
root_url = "http://stats.mossnet.lan/";
};
}; };
# TODO enable # TODO enable
# provision.alerting.rules.path = "${self}/hosts/profiles/monitoring/alert-rules.yaml"; # provision.alerting.rules.path = "${self}/hosts/profiles/monitoring/alert-rules.yaml";
}; };
# nginx reverse proxy # nginx reverse proxy
# services.nginx.recommendedProxySettings = true; # Needed for new grafana versions services.nginx.recommendedProxySettings = true; # Needed for new grafana versions
services.nginx.virtualHosts.${config.services.grafana.settings.server.domain} = { services.nginx.virtualHosts.${config.services.grafana.domain} = {
locations."/" = { locations."/" = {
proxyPass = "http://127.0.0.1:2342"; proxyPass = "http://127.0.0.1:${toString config.services.grafana.port}";
proxyWebsockets = true; proxyWebsockets = true;
}; };
}; };
services.postgresql = {
ensureUsers = [{
name = "grafana";
ensurePermissions = {
"DATABASE wallabag" = "SELECT";
"DATABASE ulogger" = "SELECT";
"DATABASE photoprism" = "SELECT";
};
}];
};
services.prometheus = { services.prometheus = {
enable = true; enable = true;
port = 9001; port = 9001;

View file

@ -13,9 +13,6 @@
192.168.1.240 books.mossnet.lan 192.168.1.240 books.mossnet.lan
192.168.1.240 archive.mossnet.lan 192.168.1.240 archive.mossnet.lan
192.168.1.240 music.mossnet.lan 192.168.1.240 music.mossnet.lan
192.168.1.240 tracks.mossnet.lan
192.168.1.240 grasp.mossnet.lan
192.168.1.240 photos.mossnet.lan
''; '';
# 10.0.69.4 mossnet.lan # 10.0.69.4 mossnet.lan
# 10.0.69.4 links.mossnet.lan # 10.0.69.4 links.mossnet.lan

View file

@ -1,48 +0,0 @@
{ self, pkgs, config, lib, ... }:
{
services.postgresql = {
enable = true;
ensureDatabases = [ "photoprism" ];
ensureUsers = [{
name = "photoprism";
ensurePermissions = {
"DATABASE photoprism" = "ALL PRIVILEGES";
};
}];
};
services.photoprism = {
enable = true;
package = pkgs.unstable.photoprism;
port = 5152;
originalsPath = "/var/lib/private/photoprism/originals";
address = "0.0.0.0";
settings = {
PHOTOPRISM_ADMIN_USER = "admin";
PHOTOPRISM_ADMIN_PASSWORD = "photoprism"; # initial password, do change it!
PHOTOPRISM_DEFAULT_LOCALE = "en";
PHOTOPRISM_DATABASE_DRIVER = "postgres";
PHOTOPRISM_DATABASE_NAME = "photoprism";
PHOTOPRISM_DATABASE_SERVER = "/run/postgresql/";
PHOTOPRISM_DATABASE_USER = "photoprism";
PHOTOPRISM_SITE_URL = "http://photos.mossnet.lan/";
PHOTOPRISM_SITE_TITLE = "mossnet photos";
};
};
services.nginx.clientMaxBodySize = "500m";
services.nginx.recommendedProxySettings = true;
services.nginx.virtualHosts."photos.mossnet.lan" = {
enableACME = false;
forceSSL = false;
locations."/" = {
extraConfig = ''
proxy_pass http://localhost:5152/;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_buffering off;
proxy_http_version 1.1;
'';
};
};
}

View file

@ -0,0 +1,27 @@
{ pkgs, ... }:
{
systemd.services.kitaab-sync = {
serviceConfig.Type = "oneshot";
path = [
pkgs.git
pkgs.openssh
pkgs.coreutils
];
script = ''
cd /home/anish/kitaab
git add -A
git diff-index --quiet HEAD || git commit -m 'syncing kitaab' # if nothing, don't exit 1
git push
exit 0
'';
serviceConfig = {
User = "anish";
};
};
systemd.timers.kitaab-sync = {
wantedBy = [ "timers.target" ];
partOf = [ "kitaab-sync.service" ];
timerConfig.OnCalendar = [ "hourly" ];
};
}

View file

@ -36,11 +36,6 @@
publicKey = "gcdq86hhEUlqF2chqYB/F8pALyAMNFvwLycxBoHuoDs="; publicKey = "gcdq86hhEUlqF2chqYB/F8pALyAMNFvwLycxBoHuoDs=";
allowedIPs = [ "10.0.69.5/32" ]; allowedIPs = [ "10.0.69.5/32" ];
} }
{
# hyperplane
publicKey = "";
allowedIPs = [ "10.0.69.6/32" ];
}
]; ];
}; };
} }

View file

@ -52,7 +52,7 @@
"WOODPECKER_DATABASE_DATASOURCE=postgres:///woodpecker?host=/run/postgresql" "WOODPECKER_DATABASE_DATASOURCE=postgres:///woodpecker?host=/run/postgresql"
"WOODPECKER_DATABASE_DRIVER=postgres" "WOODPECKER_DATABASE_DRIVER=postgres"
"WOODPECKER_ADMIN=aynish" "WOODPECKER_USER_CREATE=username:aynish,admin:true" # set your admin username
]; ];
ExecStart = "${pkgs.woodpecker-server}/bin/woodpecker-server"; ExecStart = "${pkgs.woodpecker-server}/bin/woodpecker-server";
User = "woodpecker"; User = "woodpecker";

View file

@ -10,5 +10,4 @@
backup = import ./backup.nix; backup = import ./backup.nix;
ulogger-server = import ./ulogger.nix; ulogger-server = import ./ulogger.nix;
microbin = import ./microbin.nix; microbin = import ./microbin.nix;
photoprism = import ./photoprism.nix; #TODO remove once updated to 23.05, stolen from nixpkgs anyway
} }

View file

@ -45,7 +45,7 @@ in
after = [ "remote-fs.target" "network.target" ]; after = [ "remote-fs.target" "network.target" ];
wantedBy = [ "multi-user.target" ]; wantedBy = [ "multi-user.target" ];
serviceConfig = { serviceConfig = {
ExecStart = "${pkgs.unstable.microbin}/bin/microbin --public-path https://${cfg.hostname}/ --qr --enable-burn-after --private"; ExecStart = "${pkgs.unstable.microbin}/bin/microbin --public-path ${cfg.hostname} --qr --enable-burn-after --private";
Environment = [ Environment = [
"MICROBIN_EDITABLE=true" "MICROBIN_EDITABLE=true"
"MICROBIN_HIDE_FOOTER=true" "MICROBIN_HIDE_FOOTER=true"

View file

@ -1,154 +0,0 @@
{ config, pkgs, lib, ... }:
let
cfg = config.services.photoprism;
env = {
PHOTOPRISM_ORIGINALS_PATH = cfg.originalsPath;
PHOTOPRISM_STORAGE_PATH = cfg.storagePath;
PHOTOPRISM_IMPORT_PATH = cfg.importPath;
PHOTOPRISM_HTTP_HOST = cfg.address;
PHOTOPRISM_HTTP_PORT = toString cfg.port;
} // (
lib.mapAttrs (_: toString) cfg.settings
);
manage =
let
setupEnv = lib.concatStringsSep "\n" (lib.mapAttrsToList (name: val: "export ${name}=${lib.escapeShellArg val}") env);
in
pkgs.writeShellScript "manage" ''
${setupEnv}
exec ${cfg.package}/bin/photoprism "$@"
'';
in
{
meta.maintainers = with lib.maintainers; [ stunkymonkey ];
options.services.photoprism = {
enable = lib.mkEnableOption (lib.mdDoc "Photoprism web server");
passwordFile = lib.mkOption {
type = lib.types.nullOr lib.types.path;
default = null;
description = lib.mdDoc ''
Admin password file.
'';
};
address = lib.mkOption {
type = lib.types.str;
default = "localhost";
description = lib.mdDoc ''
Web interface address.
'';
};
port = lib.mkOption {
type = lib.types.port;
default = 2342;
description = lib.mdDoc ''
Web interface port.
'';
};
originalsPath = lib.mkOption {
type = lib.types.path;
default = null;
example = "/data/photos";
description = lib.mdDoc ''
Storage path of your original media files (photos and videos).
'';
};
importPath = lib.mkOption {
type = lib.types.str;
default = "import";
description = lib.mdDoc ''
Relative or absolute to the `originalsPath` from where the files should be imported.
'';
};
storagePath = lib.mkOption {
type = lib.types.path;
default = "/var/lib/photoprism";
description = lib.mdDoc ''
Location for sidecar, cache, and database files.
'';
};
package = lib.mkPackageOptionMD pkgs "photoprism" { };
settings = lib.mkOption {
type = lib.types.attrsOf lib.types.str;
default = { };
description = lib.mdDoc ''
See [the getting-started guide](https://docs.photoprism.app/getting-started/config-options/) for available options.
'';
example = {
PHOTOPRISM_DEFAULT_LOCALE = "de";
PHOTOPRISM_ADMIN_USER = "root";
};
};
};
config = lib.mkIf cfg.enable {
systemd.services.photoprism = {
description = "Photoprism server";
serviceConfig = {
Restart = "on-failure";
User = "photoprism";
Group = "photoprism";
DynamicUser = true;
StateDirectory = "photoprism";
WorkingDirectory = "/var/lib/photoprism";
RuntimeDirectory = "photoprism";
LoadCredential = lib.optionalString (cfg.passwordFile != null)
"PHOTOPRISM_ADMIN_PASSWORD:${cfg.passwordFile}";
CapabilityBoundingSet = "";
LockPersonality = true;
PrivateDevices = true;
PrivateUsers = true;
ProtectClock = true;
ProtectControlGroups = true;
ProtectHome = true;
ProtectHostname = true;
ProtectKernelLogs = true;
ProtectKernelModules = true;
ProtectKernelTunables = true;
RestrictAddressFamilies = [ "AF_UNIX" "AF_INET" "AF_INET6" ];
RestrictNamespaces = true;
RestrictRealtime = true;
SystemCallArchitectures = "native";
SystemCallFilter = [ "@system-service" "~@privileged @setuid @keyring" ];
UMask = "0066";
} // lib.optionalAttrs (cfg.port < 1024) {
AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" ];
CapabilityBoundingSet = [ "CAP_NET_BIND_SERVICE" ];
};
wantedBy = [ "multi-user.target" ];
environment = env;
# reminder: easier password configuration will come in https://github.com/photoprism/photoprism/pull/2302
preStart = ''
ln -sf ${manage} photoprism-manage
${lib.optionalString (cfg.passwordFile != null) ''
export PHOTOPRISM_ADMIN_PASSWORD=$(cat "$CREDENTIALS_DIRECTORY/PHOTOPRISM_ADMIN_PASSWORD")
''}
exec ${cfg.package}/bin/photoprism migrations run -f
'';
script = ''
${lib.optionalString (cfg.passwordFile != null) ''
export PHOTOPRISM_ADMIN_PASSWORD=$(cat "$CREDENTIALS_DIRECTORY/PHOTOPRISM_ADMIN_PASSWORD")
''}
exec ${cfg.package}/bin/photoprism start
'';
};
};
}

Binary file not shown.

Binary file not shown.

View file

@ -1,10 +1,8 @@
age-encryption.org/v1 age-encryption.org/v1
-> ssh-ed25519 6DaCrw 1dgmzBJiOecaCLSJz1nrw3iTF9G00gIQd5hY6HXZKUI -> ssh-ed25519 kgCrKA wILVHjLHNY2lAAWw6ENwYlRTRq6fWAO4ZHxd/BXDvg0
HVkZRyHiKJ2E/Wdgty/uMbPm6lNy9wgaGwe5EJcJ8jY DCIIBq++JSKzcFOJ51i0USitDOhK9R6NEsCilGlxKtA
-> ssh-ed25519 kgCrKA aQiYpgMLe9uSw7NB89mt3Gpa29RqZGHfnZzsOV8DaiM -> e-grease F
gcgFyaibNSL5/7ITddnryWFxOuCX22mtGY2e0uL8MEs cN5lygYFvScErf/J4BAEJ5ZkimpxOUj9gj8jGZV6Cl/RMkUThxflOfxz/OOBOK3V
-> zWZg=\-grease GP#:NZ \CW2nnR/ /k S/NBseDL2dg9XzIUY7k
bMvg21MLLhnwNVSyNMvMZNT9MzyiT6UqLn3SJcxGtt3Eu9jcMAphAeGy7i+8pQbt --- IIXSaSol3agW8SNwdOqxoV8dTkwW1CWxgJ8R3Blr1Sw
9MnCFZBN4JG+ZunMtSQWodmOqiHFV1vKGsjqQboMsjMo Sャ゙ニモーyQェ>lュV,<2C>モR<EFBE93><52>5サS虍HP<48>`゚dニK6ルセ"u懌z)εL゚[゚ムWヒ<57>ハキK
--- glgRELYTsrSXv/SK/6RDso2FhnvfCT1TB3Ytz/AERPs
Œô97£l Ó•¹b,!.L_M´Ÿ×C[Q…rúôZ<C3B4>škò…› s"Q+ÚC$ÜØ«Ï«ÍŽ<C38D>“"ëè…sRõ[

View file

@ -1,9 +1,8 @@
age-encryption.org/v1 age-encryption.org/v1
-> ssh-ed25519 kgCrKA QpRQkobE13NxRH81V9tFP+HelBBp5KE2cTyOZIyKsVM -> ssh-ed25519 kgCrKA /u5qYf6vYBVeJryLq2xvZHXk9LY2A8+ks/XV4C/fixw
hw3pwAfiQeVRqNwITHCKx8u2/aBtwdB24FJdexUfMyc HNLXInIHa2d/CZR8/OwwhfLurpEbxiXca8Ip3kp/EWg
-> ssh-ed25519 6DaCrw HjJO4lhmCmsRSD979Jva6UXIMCYqTzmkh7BX+GkbpiI -> s9b#/i%D-grease
8SyOm3HR23KfA4pz/fL8dwbvpyXQJRE9ymLMs1lFCBs DtUrN1QNHQyj0mSiV9nAOBpjf1/3yxxV4E4Xxr0oR2kJa/VWvpIYzyReZdRpS5Xs
-> P32-grease %>7>/d}- Qf0Rw1HB9OAMAQ04DuR6FVfGYaGm
mB3N3P/0E4+1zo1l/cqSmqNqGBaDw2RrH4RC11GfZEmadA --- WszM9cCBr4HW0I+HltsdXj/BCxUDMld4yAVzXVo1HLg
--- 2P5bd82ou+ey3DbL5QHZKQM13N4hqvmzS5D9eWkYw5o 4µEíŕÝľöGT/ĹCÁ°¸<C2B0>ŞBńšrň©ř˘ŁXYëµW<C2B5>ŔfröĹý|e5÷÷}PÄ)
€Â µ®Üf»é2øG­çèÅüqàà²ÁÓ<E280BA>;…f&aæYºG õ•ˆ•ÎBòBüäÍû*Vz÷£lý

View file

@ -1,10 +0,0 @@
age-encryption.org/v1
-> ssh-ed25519 6DaCrw igsyzrecx35FlTKXLg8msiM5mxT90UCBxty8lZwvelY
379UsHnxI+mL+Its00WVznKnDkpGi+SMLFSaHkcCcjE
-> ssh-ed25519 kgCrKA 7kGBgw8di49lYUYNLNq3PgVpoLpIvfDnGZbxipVUXXQ
ZzY77hAJn8GiPwYT88XmYw+Qi/OTmE3pXsVrot6psOE
-> Fgy[uTu-grease
9Oo+QfjC+h8Wlm1UcN1KcEa5G9t8mw9UF0aoafJYQnGBwdJAY1UgDbNVIWb3j5yD
EnIMAQ6RPEQtm9sXnDrY+f5A6vxNdYWMdSNUOcYi2In9Ux+Q9Us4d2A
--- c3Sqf+zgIZpEQ59/pCBoKFCuwAUjPCzAFImZsZ9pqZc
™°ÚÖ+ïƒGù[?<01>ÿ#<23>çk|}¡hn^Ô³lì!€_­eÑ(ô™—ìFèôjÖ ²9•œ¿4OZžH¯Ý²˜žyÞ¬ËYl=®CwÊ4o_

View file

@ -1,14 +0,0 @@
age-encryption.org/v1
-> ssh-ed25519 H6uv4Q k1/9tYh1a2JNaZCXB2RJgRA7hQ7vg0mE7B4a0lVCvW8
y4aGbd1scFAMA6mQZv6lshDFR/7TsCHKC3NuOWmE1Ss
-> ssh-ed25519 K2vF/Q Fqd9YCy61FlWmBiWXAJeJDAKeXtdDO9N5w0L2FBZGB0
lj9yucjMsmBshHtpz6VqRRb/MA4+DKUM9jo1ixY59Dc
-> ssh-ed25519 ntXL8g z+btuETbHoPe31h87MDOGM41vW3lq9xLIE1QU3EnME4
BtQLF81szEiwmGVcxbdF7Ls0mrV9UUJbvZ4N9Zy6dG0
-> ssh-ed25519 kgCrKA HFjfjTV8L6ftCuUh/fD+sGuJK0Ev++r2qyEqr+fTKmM
/m+7SzjOI5nmt/V+hMau9Rfi9RIbbPNPFSuWxUvhkM4
-> bN-grease }R]4T%[p
6yeWs4CF8vqsnJ/l3DX9JKODjBv0gkc66HFmCoGKtDZCtfNWeO82CW6UE50MES5E
lQL5woQJVXLL3HTIsNKbXeigjBZ1/SSksbMBGeeu/+DXkrUHdPo37pz/KcQ
--- La4OQuTEE9G8czWAz8t1EhHNIa6rE7hoq3tckn6GxOo
ý@ù<>.`ø¹¨Å´z8ÔǬ};ÔŠK ¯†<C2AF>G<[ÞdNpr¹ÄòùÞ ½ bßü.¯•¨³Ò

View file

@ -1,8 +0,0 @@
age-encryption.org/v1
-> ssh-ed25519 K2vF/Q gbzVy3hrykVeOCwjPo6Ma8tTTemdtiRwAtX96cA2viE
NFSztfWodmZ4TQFBMgx9e1U2ZO37Nt/MKJEYBBrICrA
-> s.pLZ.|-grease %UVo!F YgUB rG`)8.@w
pYerZHERVJx3dldU27I9vIxh5mizU4cW4F1QTRxk646K0abW7H6rqp6Qyr096fLF
c9egbGKMJFNgWoXWaauMaGCAV2D8km5DHSWVoEMZVkskQSprSUWh
--- SANH4pgKXob6sZ/jhnqkgXFC9QzVbI81HqxvwiayK2Y
õÐ4¿ÆÝž• ë LªH²jæœ[§ Șp(löl@™GÊà¸ÍRƒr‰)P¤0Q?àG•®ÂaÜfú€ø»÷<>

View file

@ -5,7 +5,6 @@ let
mossnet = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAA0bsVbdQR6iWNLKIiID57A1+dVXC58Dtf5cSXg6/JF root@box"; mossnet = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAA0bsVbdQR6iWNLKIiID57A1+dVXC58Dtf5cSXg6/JF root@box";
lituus = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIH2lAb33LH3JNuOfBXt971u0tHe+NURFecQdfjwEj+C+ root@lituus"; lituus = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIH2lAb33LH3JNuOfBXt971u0tHe+NURFecQdfjwEj+C+ root@lituus";
helix = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAKrL6IDHNnHmxi0q9nzu87NOyidPm3HpE7klU368lEf root@helix"; helix = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAKrL6IDHNnHmxi0q9nzu87NOyidPm3HpE7klU368lEf root@helix";
helix2 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIK2G81z1E51ioJQGLHnTJEjgSdBqLM6mb72Z+0atE6Bf root@helix";
curve = [ system user ]; curve = [ system user ];
allUserKeys = [ system user mossnet ]; allUserKeys = [ system user mossnet ];
systemOnly = [ system mossnet lituus helix ]; systemOnly = [ system mossnet lituus helix ];
@ -15,23 +14,20 @@ in
"fastmail.age".publicKeys = allUserKeys; "fastmail.age".publicKeys = allUserKeys;
"mossnet.age".publicKeys = allUserKeys; "mossnet.age".publicKeys = allUserKeys;
"curve-wg.age".publicKeys = curve; "curve-wg.age".publicKeys = curve;
"nullhex-smtp.age".publicKeys = systemOnly; "box-wg.age".publicKeys = [ mossnet ];
"wallabag-password.age".publicKeys = [ mossnet ];
"wallabag-secret.age".publicKeys = [ mossnet ];
"borg-password.age".publicKeys = systemOnly; "borg-password.age".publicKeys = systemOnly;
"borg-key.age".publicKeys = systemOnly; "borg-key.age".publicKeys = systemOnly;
"freshrss-dbpass.age".publicKeys = [ helix ];
"helix-wg.age".publicKeys = [ helix2 helix ];
"freshrss-dbpass.age".publicKeys = [ helix2 helix ];
"woodpecker-server-secrets.age".publicKeys = [ helix2 helix ];
"gitea-dbpass.age".publicKeys = [ helix helix2 ];
"synapse-config.age".publicKeys = [ lituus ]; "synapse-config.age".publicKeys = [ lituus ];
"synapse-database-password.age".publicKeys = [ lituus ]; "synapse-database-password.age".publicKeys = [ lituus ];
"sealight-mod-password.age".publicKeys = [ lituus ]; "sealight-mod-password.age".publicKeys = [ lituus ];
"telegram-matrix-env.age".publicKeys = [ lituus ]; "telegram-matrix-env.age".publicKeys = [ lituus ];
"wallabag.age".publicKeys = [ mossnet ]; "wallabag.age".publicKeys = [ mossnet ];
"woodpecker-agent-secret.age".publicKeys = [ mossnet helix helix2 ]; "woodpecker-agent-secret.age".publicKeys = [ mossnet helix ];
"box-wg.age".publicKeys = [ mossnet ]; "woodpecker-server-secrets.age".publicKeys = [ helix ];
"wallabag-password.age".publicKeys = [ mossnet ]; "gitea-dbpass.age".publicKeys = [ helix ];
"wallabag-secret.age".publicKeys = [ mossnet ];
} }

Binary file not shown.