Compare commits

..

No commits in common. "1461881cf81ee3f73d549dc7fdaf50c4abe1f5d0" and "487800eba89137ced1092c96f7c2aa4c47e54032" have entirely different histories.

23 changed files with 66 additions and 290 deletions

View file

@ -16,7 +16,6 @@ D('sealight.xyz', REG_NONE, DnsProvider(DNS_HEDNS),
A('bridge', '69.61.38.225', TTL(300)),
A('rss', '69.61.38.225', TTL(300)),
A('git', '69.61.38.225', TTL(300)),
A('bin', '69.61.38.225', TTL(300)),
A('ci', '69.61.38.225', TTL(300)),
// vultr -> nulled: lituus
A('@', '45.77.48.108', TTL(300)),

View file

@ -210,21 +210,6 @@
}
},
"flake-utils_2": {
"locked": {
"lastModified": 1667395993,
"narHash": "sha256-nuEHfE/LcWyuSWnS8t12N1wc105Qtau+/OdUAjtQ0rA=",
"owner": "numtide",
"repo": "flake-utils",
"rev": "5aed5285a952e0b949eb3ba02c12fa4fcfef535f",
"type": "github"
},
"original": {
"owner": "numtide",
"repo": "flake-utils",
"type": "github"
}
},
"flake-utils_3": {
"locked": {
"lastModified": 1676283394,
"narHash": "sha256-XX2f9c3iySLCw54rJ/CZs+ZK6IQy7GXNY4nSOyu2QG4=",
@ -239,7 +224,7 @@
"type": "github"
}
},
"flake-utils_4": {
"flake-utils_3": {
"locked": {
"lastModified": 1659877975,
"narHash": "sha256-zllb8aq3YO3h8B/U0/J1WBgAL8EX5yWf5pMj3G0NAmc=",
@ -254,28 +239,6 @@
"type": "github"
}
},
"grasp": {
"inputs": {
"flake-utils": "flake-utils_2",
"nixpkgs": [
"nixpkgs"
]
},
"locked": {
"lastModified": 1682644301,
"narHash": "sha256-gMBFZLf41s3+cnhxgZVRvj2JSAFYv4jn2xBKwEESthE=",
"ref": "main",
"rev": "a2d85675b930ffc26f6891b2e14491795907be4e",
"revCount": 137,
"type": "git",
"url": "ssh://gitea@git.sealight.xyz/aynish/grasp.git"
},
"original": {
"ref": "main",
"type": "git",
"url": "ssh://gitea@git.sealight.xyz/aynish/grasp.git"
}
},
"hardware": {
"locked": {
"lastModified": 1677232326,
@ -314,7 +277,7 @@
},
"llamacpp": {
"inputs": {
"flake-utils": "flake-utils_3",
"flake-utils": "flake-utils_2",
"nixpkgs": [
"unstable"
]
@ -460,7 +423,6 @@
"basant": "basant",
"deploy-rs": "deploy-rs",
"eww": "eww",
"grasp": "grasp",
"hardware": "hardware",
"home-manager": "home-manager",
"llamacpp": "llamacpp",
@ -476,7 +438,7 @@
},
"rust-overlay": {
"inputs": {
"flake-utils": "flake-utils_4",
"flake-utils": "flake-utils_3",
"nixpkgs": [
"nixpkgs"
]
@ -557,11 +519,11 @@
},
"unstable": {
"locked": {
"lastModified": 1682268651,
"narHash": "sha256-2eZriMhnD24Pmb8ideZWZDiXaAVe6LzJrHQiNPck+Lk=",
"lastModified": 1677063315,
"narHash": "sha256-qiB4ajTeAOVnVSAwCNEEkoybrAlA+cpeiBxLobHndE8=",
"owner": "nixos",
"repo": "nixpkgs",
"rev": "e78d25df6f1036b3fa76750ed4603dd9d5fe90fc",
"rev": "988cc958c57ce4350ec248d2d53087777f9e1949",
"type": "github"
},
"original": {

View file

@ -24,8 +24,8 @@
basant.url = "git+ssh://gitea@git.sealight.xyz/aynish/basant?ref=main";
basant.inputs.nixpkgs.follows = "nixpkgs";
basant.inputs.poonam.follows = "poonam";
grasp.url = "git+ssh://gitea@git.sealight.xyz/aynish/grasp.git?ref=main";
grasp.inputs.nixpkgs.follows = "nixpkgs";
# grasp.url = "git+ssh://gitea@git.sealight.xyz/aynish/grasp.git?ref=main";
# grasp.inputs.nixpkgs.follows = "nixpkgs";
# Matrix
nix-matrix-appservices.url = "gitlab:coffeetables/nix-matrix-appservices";
# Others
@ -61,7 +61,7 @@
, deploy-rs
, agenix
, basant
, grasp
# , grasp
, nix-matrix-appservices
, nur
, tidalcycles
@ -116,7 +116,6 @@
inherit system;
overlays = [
agenix.overlays.default
unstableOverlay # Remove once updated to 23.05 (used for microbin on helix)
tidalcycles.overlays.default # needed for nvim which comes pre-installed lol
];
});
@ -168,13 +167,18 @@
helix = nixpkgs.lib.nixosSystem rec {
specialArgs = { inherit inputs self; };
system = "x86_64-linux";
pkgs = litePkgsFor.${system};
pkgs = nixpkgsFor.${system};
modules = [
./hosts/helix
agenix.nixosModules.age
self.nixosModules.backup
self.nixosModules.wireguard
self.nixosModules.microbin
home-manager.nixosModules.home-manager
{
home-manager.useGlobalPkgs = true;
home-manager.useUserPackages = true;
home-manager.users.anish = import ./home/core;
}
];
};
@ -222,7 +226,7 @@
self.nixosModules.wallabag
self.nixosModules.gonic
self.nixosModules.ulogger-server
grasp.nixosModule
# grasp.nixosModule
home-manager.nixosModules.home-manager
{
home-manager.useGlobalPkgs = true;

View file

@ -299,6 +299,5 @@
sm = "ssh mossnet.lan"; # box regular
sl = "ssh sealight.xyz"; # lituus
sh = "ssh git.sealight.xyz"; # helix
sb = "ssh cyberian@69.61.38.246"; # bonfire for allwell
};
}

View file

@ -1 +0,0 @@
curl -F "content=$(xclip -o)" -X POST https://bin.sealight.xyz/upload

View file

@ -113,7 +113,6 @@ in
'';
# TODO hardcoded
".local/bin/passmenu".source = ./bin/passmenu;
".local/bin/paste".source = ./bin/paste;
".local/bin/bluetoothmenu".source = ./bin/bluetoothmenu;
".local/bin/wifimenu".source = ./bin/wifimenu;
".local/bin/powermenu".source = ./bin/powermenu;

View file

@ -27,9 +27,6 @@ super + Tab
super + e
rofimoji --selector-args "-theme theme/emojimenu.rasi" --skin-tone moderate --action copy
super + a
paste
super + p
passmenu

View file

@ -49,7 +49,6 @@
".tmp"
".direnv"
"result"
"node_modules/"
];
extraConfig = {

View file

@ -151,8 +151,6 @@ in
home.file.".config/nvim/after/syntax/vimwiki.vim".text = ''
" match with %update
syntax match VimwikiPlaceholder /^\s*%update\ze\%(\s.*\)\?$/ nextgroup=VimwikiPlaceholderParam skipwhite
" match with %link
syntax match VimwikiPlaceholder /^\s*%link\ze\%(\s.*\)\?$/ nextgroup=VimwikiPlaceholderParam skipwhite
'';
#environment.systemPackages = with customPlugins; [ tidal ];

View file

@ -41,9 +41,9 @@ def write_note(task_id: int):
time = datetime.datetime.now().strftime("%y-%m-%d %H:%M")
with open(notes_file, "w") as f:
f.write(f"%title {task_description}")
f.write(f"%title: {task_description}")
f.write(f":task:{task_project}:{task_tags if len(task_tags) else ''}\n")
f.write(f"%date {time}\n\n")
f.write(f"%date: {time}\n\n")
f.flush()
os.execlp(EDITOR, EDITOR, notes_file)

View file

@ -19,13 +19,17 @@
../profiles/wallabag
../profiles/finance
../profiles/sync/website
../profiles/grasp
# ../profiles/archivebox
../profiles/woodpecker-agent
../profiles/jellyfin
../profiles/ulogger-server
];
# Something broke when manually updating grasp...
# services.grasp.enable = true;
# services.grasp.path = "/home/anish/kitaab/grasp/grasp.wiki";
# services.grasp.user = "anish";
# Backups
age.secrets.borg-password.file = "${self}/secrets/borg-password.age";
services.postgresqlBackup = {

View file

@ -13,7 +13,6 @@
../profiles/mimetypes
../profiles/syncthing
../profiles/mossnet-hosts
../profiles/kuberenetes
];
# home-manager.users.anish = import ../../home/gui;

View file

@ -10,7 +10,6 @@
../profiles/rss-bridge
../profiles/mount-mossnet
../profiles/freshrss
../profiles/microbin
];
# Capsul specific

View file

@ -61,11 +61,12 @@ in
};
environment.systemPackages = with pkgs; [
unstable.signal-desktop # bridge to sealight?
unstable.sublime-music
unstable.nheko
unstable.tootle
unstable.newsflash
unstable.liferea
newsflash
liferea
scrot
ripcord

View file

@ -1,76 +1,37 @@
{ config, pkgs, lib, ... }:
let
adblockLocalZones = pkgs.stdenv.mkDerivation {
name = "unbound-zones-adblock";
src = (pkgs.fetchFromGitHub
{
owner = "StevenBlack";
repo = "hosts";
rev = "3.12.21";
sha256 = "Yzr6PY/zqQE+AHH0J6ioHTsgkikM+dz4aelbGpQJa1s=";
} + "/hosts");
phases = [ "installPhase" ];
installPhase = ''
${pkgs.gawk}/bin/awk '{sub(/\r$/,"")} {sub(/^127\.0\.0\.1/,"0.0.0.0")} BEGIN { OFS = "" } NF == 2 && $1 == "0.0.0.0" { print "local-zone: \"", $2, "\" static"}' $src | tr '[:upper:]' '[:lower:]' | sort -u > $out
'';
};
mossnet = "192.168.1.240"; # The local lan-ip for box
wg-mossnet = "10.0.69.4"; # The wireguard ip for box
mossnet-hosts = [
"mossnet.lan"
"links.mossnet.lan"
"read.mossnet.lan"
"stats.mossnet.lan"
"music.mossnet.lan"
"rss.mossnet.lan"
"tasks.mossnet.lan"
"file.mossnet.lan"
"books.mossnet.lan"
"fin.mossnet.lan"
"paper.mossnet.lan"
"cal.mossnet.lan"
"archive.mossnet.lan"
"tracks.mossnet.lan"
"grasp.mossnet.lan"
];
in
{
services.unbound = {
enable = true;
settings = {
server = {
include = "${adblockLocalZones}";
interface = [ "0.0.0.0" ];
access-control = [ "127.0.0.0/24 allow" "192.168.0.0/24 allow" "10.0.69.0/24 allow" ];
access-control-view = "10.0.69.0/24 wireguard";
local-zone = ''"mossnet.lan." redirect'';
local-data = ''"mossnet.lan. IN A ${mossnet}"'';
};
forward-zone = [{
name = ".";
forward-addr = [ "45.90.30.49" "45.90.28.49" "1.1.1.1" "8.8.8.8" ];
}];
view = {
name = "wireguard";
local-zone = ''"mossnet.lan." redirect'';
local-data = ''"mossnet.lan. IN A ${wg-mossnet}"'';
};
do-not-query-localhost = "no";
# Eventually we'll add DNSSEC / DoT
# so-reuseport: yes
# tls-cert-bundle: /etc/ssl/certs/ca-certificates.crt
# tls-upstream: yes
};
services.dnsmasq.enable = true;
services.dnsmasq.extraConfig = ''
domain-needed
no-resolv
local=/lan/
local=/moss/
cache-size=5000
addn-hosts=/etc/adblock.hosts
''; # TODO find a way to make adblock hosts reproducible and updateable
services.dnsmasq.servers = [ "45.90.30.49" "45.90.28.49" "1.1.1.1" "8.8.8.8" ];
# TODO use this list in mossnet-hosts
networking.hosts = {
"192.168.1.240" = [
"mossnet.lan"
"links.mossnet.lan"
"read.mossnet.lan"
"stats.mossnet.lan"
"music.mossnet.lan"
"rss.mossnet.lan"
"tasks.mossnet.lan"
"file.mossnet.lan"
"books.mossnet.lan"
"fin.mossnet.lan"
"paper.mossnet.lan"
"cal.mossnet.lan"
"archive.mossnet.lan"
"tracks.mossnet.lan"
];
"192.168.1.226" = [
"df-web.lan"
];
};
# With unbound we're doing wildcard redirects, so we don't need that anymore
# networking.hosts = {
# mossnet = mossnet-hosts;
# };
networking.firewall.allowedTCPPorts = [ 53 ];
networking.firewall.allowedUDPPorts = [ 53 ];
}

View file

@ -6,7 +6,6 @@
services.gitea = {
enable = true;
package = pkgs.unstable.forgejo;
appName = "Sealight Git Forge";
domain = "git.sealight.xyz";
rootUrl = "https://git.sealight.xyz";

View file

@ -1,12 +1,6 @@
{ ... }:
{
services.grasp = {
enable = true;
path = "/home/anish/kitaab/grasp/notes.wiki";
user = "anish";
};
services.nginx.virtualHosts."grasp.mossnet.lan" = {
locations."/".proxyPass = "http://localhost:12212";
};
services."grasp".enable = true;
services."grasp".path = "/home/anish/kitaab/grasp";
services."grasp".user = "anish";
}

View file

@ -1,20 +0,0 @@
{ pkgs, ... }:
{
# k3s
networking.firewall.allowedTCPPorts = [ 6443 ];
services.k3s.enable = true;
services.k3s.role = "server";
services.k3s.clusterInit = true;
# services.k3s.extraFlags = toString [
# "--kubelet-arg=v=4" # Optionally add additional args to k3s
# ];
environment.systemPackages = [ pkgs.k3s pkgs.kubernetes-helm ];
# minikube on docker
virtualisation.docker.enable = true;
virtualisation.docker.storageDriver = "btrfs";
# or use kvm
#virtualisation.libvrt.enable = true;
users.users.anish.extraGroups = [ "docker" ]; # "libvert"
}

View file

@ -1,21 +0,0 @@
{ config, lib, pkgs, ... }:
{
services.microbin.enable = true;
services.microbin.hostname = "bin.sealight.xyz";
services.microbin.port = 4949;
networking.firewall.allowedTCPPorts = [ 4949 ];
services.nginx.virtualHosts."bin.sealight.xyz" = {
enableACME = true;
forceSSL = true;
extraConfig = "client_max_body_size 20M;";
locations."/" = {
extraConfig = ''
proxy_pass http://localhost:4949/;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
'';
};
};
}

View file

@ -34,7 +34,6 @@
};
systemd.services.woodpecker-server = {
after = [ "postgresql.service" ];
wantedBy = [ "multi-user.target" ];
serviceConfig = {
WorkingDirectory = "/var/lib/woodpecker";

View file

@ -9,5 +9,4 @@
wireguard = import ./wireguard.nix;
backup = import ./backup.nix;
ulogger-server = import ./ulogger.nix;
microbin = import ./microbin.nix;
}

View file

@ -1,95 +0,0 @@
{ self, config, lib, pkgs, ... }:
with lib;
let
cfg = config.services.microbin;
configFile = "/etc/microbin/config";
dataFolder = "/var/lib/microbin";
in
{
options = {
services.microbin = {
enable = mkEnableOption "A super tiny pasta";
user = mkOption {
type = types.str;
default = "microbin";
description = "User account under which microbin runs.";
};
group = mkOption {
type = types.str;
default = "microbin";
description = "Group account under which microbin runs.";
};
hostname = mkOption {
type = types.str;
description = "Hostname of your microbin service";
};
port = mkOption {
type = types.port;
default = 8080;
description = "Port on which to run the serice";
};
};
};
config = mkIf cfg.enable {
systemd.services.microbin = {
description = "Microbin A Super Tiny Pasta";
after = [ "remote-fs.target" "network.target" ];
wantedBy = [ "multi-user.target" ];
serviceConfig = {
ExecStart = "${pkgs.unstable.microbin}/bin/microbin --public-path ${cfg.hostname} --qr --enable-burn-after --private";
Environment = [
"MICROBIN_EDITABLE=true"
"MICROBIN_HIDE_FOOTER=true"
"MICROBIN_HIGHLIGHTSYNTAX=true"
"MICROBIN_PORT=${builtins.toString cfg.port}"
"MICROBIN_TITLE=SealightBin"
];
WorkingDirectory = dataFolder;
TimeoutStopSec = " 20 ";
KillMode = " process ";
RestartSec = " 10 ";
User = cfg.user;
Group = cfg.group;
DevicePolicy = " closed ";
NoNewPrivileges = " yes ";
PrivateTmp = " yes ";
PrivateUsers = " yes ";
ProtectControlGroups = " yes ";
ProtectKernelModules = " yes ";
ProtectKernelTunables = " yes ";
RestrictAddressFamilies = "
AF_UNIX
AF_INET
AF_INET6 ";
RestrictNamespaces = " yes ";
RestrictRealtime = " yes ";
SystemCallFilter = "~@clock @debug @module @mount @obsolete @privileged @reboot @setuid @swap";
ReadWritePaths = dataFolder;
StateDirectory = baseNameOf dataFolder;
};
};
users.users = optionalAttrs (cfg.user == "microbin") ({
microbin = {
description = "microbin service user";
name = cfg.user;
group = cfg.group;
isSystemUser = true;
};
});
users.groups = optionalAttrs (cfg.group == "microbin") ({
microbin = { };
});
};
}

View file

@ -255,13 +255,14 @@ in
};
script = ''
echo "Setting up ulogger-server files in ${cfg.dataDir} ..."
cd "${cfg.dataDir}"
cp -R ${cfg.package}/* ./
cp ${configFile}/config.php ./
if [ ! -f installed ]; then
echo "Install file not found, installing ..."
cp -R ${cfg.package}/* ./
cp ${configFile}/config.php ./
psql -U ulogger < ${cfg.package}/scripts/ulogger.pgsql
psql -d ulogger -c "INSERT INTO users (login, password, admin) VALUES ('$ULOGGER_ADMIN_USER', '$ULOGGER_ADMIN_PASSWORD', TRUE)"
touch installed
@ -271,6 +272,6 @@ in
};
meta = with stdenv.lib; {
maintainers = with maintainers; [ chickensoupwithrice ];
maintainers = with maintainers; [ nadrieril ];
};
}