Compare commits
38 commits
38a4c41a1f
...
0e7cacc12b
Author | SHA1 | Date | |
---|---|---|---|
0e7cacc12b | |||
3b1aa44e63 | |||
99a14250f0 | |||
c751f0f6d1 | |||
5a2f0dc43b | |||
ba2d0c4917 | |||
8c3924d942 | |||
da8e4b25eb | |||
a6980a1b74 | |||
984d29ee2b | |||
aa97bc3618 | |||
2b211cc29d | |||
7ef8033b53 | |||
9ca6e47078 | |||
ad7bd1ebbb | |||
9012e55951 | |||
b3cdb97335 | |||
52c76af334 | |||
4dc773f2ce | |||
9723f79d24 | |||
03b1edc941 | |||
16c975db35 | |||
11e36c5082 | |||
fe806757d2 | |||
6fafa22851 | |||
8ce0eca9af | |||
71f417b250 | |||
d50510a8aa | |||
90c62bcd39 | |||
658ecc4c7b | |||
cf2f8b40eb | |||
793604b9de | |||
05038f2001 | |||
55c47ec2aa | |||
f8f8995c30 | |||
66b0a3db70 | |||
e45f12ddf6 | |||
a377eb2f69 |
|
@ -4,6 +4,27 @@ var REG_NONE = NewRegistrar('none'); // No registrar.
|
||||||
var DNS_BIND = NewDnsProvider('bind'); // ISC BIND.
|
var DNS_BIND = NewDnsProvider('bind'); // ISC BIND.
|
||||||
var DNS_HEDNS = NewDnsProvider('hedns');
|
var DNS_HEDNS = NewDnsProvider('hedns');
|
||||||
|
|
||||||
|
D("lakhwara.com", REG_NONE,
|
||||||
|
DnsProvider(DNS_HEDNS),
|
||||||
|
DefaultTTL(86400),
|
||||||
|
//SOA('@', 'ns1.he.net.', 'hostmaster.he.net.', 2022041702, 86400, 7200, 3600000, 86400, TTL(172800)),
|
||||||
|
A('anish', '103.16.130.98'),
|
||||||
|
A('coaching', '103.16.130.98'),
|
||||||
|
TXT('anish', 'datkey=dat://1a240a14fab2bae9c85ebad29bddc04505aaba24e5fb809c2ccb4cdf71e3a7d5'),
|
||||||
|
CNAME('fm1._domainkey', 'fm1.lakhwara.com.dkim.fmhosted.com.'),
|
||||||
|
CNAME('fm2._domainkey', 'fm2.lakhwara.com.dkim.fmhosted.com.'),
|
||||||
|
CNAME('fm3._domainkey', 'fm3.lakhwara.com.dkim.fmhosted.com.'),
|
||||||
|
A('@', '103.16.130.98'),
|
||||||
|
MX('@', 10, 'in1-smtp.messagingengine.com.'),
|
||||||
|
MX('@', 20, 'in2-smtp.messagingengine.com.'),
|
||||||
|
//NAMESERVER('ns1.he.net.'),
|
||||||
|
//NAMESERVER('ns2.he.net.'),
|
||||||
|
//NAMESERVER('ns3.he.net.'),
|
||||||
|
//NAMESERVER('ns4.he.net.'),
|
||||||
|
//NAMESERVER('ns5.he.net.'),
|
||||||
|
TXT('@', 'v=spf1 include:spf.messagingengine.com ?all')
|
||||||
|
)
|
||||||
|
|
||||||
D('sealight.xyz', REG_NONE, DnsProvider(DNS_HEDNS),
|
D('sealight.xyz', REG_NONE, DnsProvider(DNS_HEDNS),
|
||||||
DefaultTTL(86400),
|
DefaultTTL(86400),
|
||||||
//SOA('@', 'ns1.he.net.', 'hostmaster.he.net.', 2022121008, 86400, 7200, 3600000, 172800, TTL(172800)),
|
//SOA('@', 'ns1.he.net.', 'hostmaster.he.net.', 2022121008, 86400, 7200, 3600000, 172800, TTL(172800)),
|
||||||
|
@ -13,11 +34,11 @@ D('sealight.xyz', REG_NONE, DnsProvider(DNS_HEDNS),
|
||||||
//NAMESERVER('ns4.he.net.'),
|
//NAMESERVER('ns4.he.net.'),
|
||||||
//NAMESERVER('ns5.he.net.'),
|
//NAMESERVER('ns5.he.net.'),
|
||||||
// capsul: helix
|
// capsul: helix
|
||||||
A('bridge', '69.61.38.225', TTL(300)),
|
A('bridge', '69.61.2.203', TTL(300)),
|
||||||
A('rss', '69.61.38.225', TTL(300)),
|
A('rss', '69.61.2.203', TTL(300)),
|
||||||
A('git', '69.61.38.225', TTL(300)),
|
A('git', '69.61.2.203', TTL(300)),
|
||||||
A('bin', '69.61.38.225', TTL(300)),
|
A('bin', '69.61.2.203', TTL(300)),
|
||||||
A('ci', '69.61.38.225', TTL(300)),
|
A('ci', '69.61.2.203', TTL(300)),
|
||||||
// vultr -> nulled: lituus
|
// vultr -> nulled: lituus
|
||||||
A('@', '45.77.48.108', TTL(300)),
|
A('@', '45.77.48.108', TTL(300)),
|
||||||
A('jitsi', '45.77.48.108', TTL(300)),
|
A('jitsi', '45.77.48.108', TTL(300)),
|
||||||
|
|
22
dns/zones/lakhwara.com.zone
Normal file
22
dns/zones/lakhwara.com.zone
Normal file
|
@ -0,0 +1,22 @@
|
||||||
|
; lakhwara.com Dumped Sun May 28 22:30:02 2023
|
||||||
|
;
|
||||||
|
lakhwara.com. 172800 IN SOA ns1.he.net. hostmaster.he.net. (
|
||||||
|
2022041702 ;serial
|
||||||
|
86400 ;refresh
|
||||||
|
7200 ;retry
|
||||||
|
3600000 ;expire
|
||||||
|
86400 ) ;minimum
|
||||||
|
anish.lakhwara.com. 86400 IN A 103.16.130.98
|
||||||
|
anish.lakhwara.com. 86400 IN TXT datkey=dat://1a240a14fab2bae9c85ebad29bddc04505aaba24e5fb809c2ccb4cdf71e3a7d5
|
||||||
|
fm1._domainkey.lakhwara.com. 86400 IN CNAME fm1.lakhwara.com.dkim.fmhosted.com.
|
||||||
|
fm2._domainkey.lakhwara.com. 86400 IN CNAME fm2.lakhwara.com.dkim.fmhosted.com.
|
||||||
|
fm3._domainkey.lakhwara.com. 86400 IN CNAME fm3.lakhwara.com.dkim.fmhosted.com.
|
||||||
|
lakhwara.com. 86400 IN A 103.16.130.98
|
||||||
|
lakhwara.com. 86400 IN MX 10 in1-smtp.messagingengine.com.
|
||||||
|
lakhwara.com. 86400 IN MX 20 in2-smtp.messagingengine.com.
|
||||||
|
lakhwara.com. 86400 IN NS ns1.he.net.
|
||||||
|
lakhwara.com. 86400 IN NS ns2.he.net.
|
||||||
|
lakhwara.com. 86400 IN NS ns3.he.net.
|
||||||
|
lakhwara.com. 86400 IN NS ns4.he.net.
|
||||||
|
lakhwara.com. 86400 IN NS ns5.he.net.
|
||||||
|
lakhwara.com. 86400 IN TXT "v=spf1 include:spf.messagingengine.com ?all"
|
51
flake.lock
51
flake.lock
|
@ -77,11 +77,11 @@
|
||||||
"utils": "utils"
|
"utils": "utils"
|
||||||
},
|
},
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1674127017,
|
"lastModified": 1683779844,
|
||||||
"narHash": "sha256-QO1xF7stu5ZMDLbHN30LFolMAwY6TVlzYvQoUs1RD68=",
|
"narHash": "sha256-sIeOU0GsCeQEn5TpqE/jFRN4EGsPsjqVRsPdrzIDABM=",
|
||||||
"owner": "serokell",
|
"owner": "serokell",
|
||||||
"repo": "deploy-rs",
|
"repo": "deploy-rs",
|
||||||
"rev": "8c9ea9605eed20528bf60fae35a2b613b901fd77",
|
"rev": "c80189917086e43d49eece2bd86f56813500a0eb",
|
||||||
"type": "github"
|
"type": "github"
|
||||||
},
|
},
|
||||||
"original": {
|
"original": {
|
||||||
|
@ -122,6 +122,26 @@
|
||||||
"type": "github"
|
"type": "github"
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
|
"disko": {
|
||||||
|
"inputs": {
|
||||||
|
"nixpkgs": [
|
||||||
|
"nixpkgs"
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"locked": {
|
||||||
|
"lastModified": 1684783210,
|
||||||
|
"narHash": "sha256-hxRbwwBTu1G1u1EdI9nEo/n4HIsQIfNi+2BQ1nEoj/o=",
|
||||||
|
"owner": "nix-community",
|
||||||
|
"repo": "disko",
|
||||||
|
"rev": "f0b9f374bb42fdcd57baa7d4448ac5d4788226bd",
|
||||||
|
"type": "github"
|
||||||
|
},
|
||||||
|
"original": {
|
||||||
|
"owner": "nix-community",
|
||||||
|
"repo": "disko",
|
||||||
|
"type": "github"
|
||||||
|
}
|
||||||
|
},
|
||||||
"eww": {
|
"eww": {
|
||||||
"inputs": {
|
"inputs": {
|
||||||
"flake-compat": "flake-compat_2",
|
"flake-compat": "flake-compat_2",
|
||||||
|
@ -459,6 +479,7 @@
|
||||||
"agenix": "agenix",
|
"agenix": "agenix",
|
||||||
"basant": "basant",
|
"basant": "basant",
|
||||||
"deploy-rs": "deploy-rs",
|
"deploy-rs": "deploy-rs",
|
||||||
|
"disko": "disko",
|
||||||
"eww": "eww",
|
"eww": "eww",
|
||||||
"grasp": "grasp",
|
"grasp": "grasp",
|
||||||
"hardware": "hardware",
|
"hardware": "hardware",
|
||||||
|
@ -471,7 +492,8 @@
|
||||||
"poonam": "poonam",
|
"poonam": "poonam",
|
||||||
"rust-overlay": "rust-overlay",
|
"rust-overlay": "rust-overlay",
|
||||||
"tidalcycles": "tidalcycles",
|
"tidalcycles": "tidalcycles",
|
||||||
"unstable": "unstable"
|
"unstable": "unstable",
|
||||||
|
"vimwikicli": "vimwikicli"
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
"rust-overlay": {
|
"rust-overlay": {
|
||||||
|
@ -655,6 +677,27 @@
|
||||||
"url": "ssh://gitea@git.sealight.xyz/aynish/vimwiki-cli"
|
"url": "ssh://gitea@git.sealight.xyz/aynish/vimwiki-cli"
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
|
"vimwikicli": {
|
||||||
|
"inputs": {
|
||||||
|
"nixpkgs": [
|
||||||
|
"nixpkgs"
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"locked": {
|
||||||
|
"lastModified": 1662448409,
|
||||||
|
"narHash": "sha256-Xd8CuFcEpEQK/TjNBXcp1HqPJCc7LwkMqKa1WiAP1Zc=",
|
||||||
|
"ref": "main",
|
||||||
|
"rev": "a73c4695cf116c2e8194a5caa837c2f9e1a7e2fb",
|
||||||
|
"revCount": 7,
|
||||||
|
"type": "git",
|
||||||
|
"url": "ssh://gitea@git.sealight.xyz/aynish/vimwiki-cli"
|
||||||
|
},
|
||||||
|
"original": {
|
||||||
|
"ref": "main",
|
||||||
|
"type": "git",
|
||||||
|
"url": "ssh://gitea@git.sealight.xyz/aynish/vimwiki-cli"
|
||||||
|
}
|
||||||
|
},
|
||||||
"vowel-src": {
|
"vowel-src": {
|
||||||
"flake": false,
|
"flake": false,
|
||||||
"locked": {
|
"locked": {
|
||||||
|
|
22
flake.nix
22
flake.nix
|
@ -17,17 +17,23 @@
|
||||||
agenix.inputs.nixpkgs.follows = "nixpkgs";
|
agenix.inputs.nixpkgs.follows = "nixpkgs";
|
||||||
deploy-rs.url = "github:serokell/deploy-rs";
|
deploy-rs.url = "github:serokell/deploy-rs";
|
||||||
deploy-rs.inputs.nixpkgs.follows = "nixpkgs";
|
deploy-rs.inputs.nixpkgs.follows = "nixpkgs";
|
||||||
|
disko.url = "github:nix-community/disko";
|
||||||
|
disko.inputs.nixpkgs.follows = "nixpkgs";
|
||||||
|
|
||||||
# Packages
|
# My Packages
|
||||||
poonam.url = "git+ssh://gitea@git.sealight.xyz/aynish/kitaab?ref=main";
|
poonam.url = "git+ssh://gitea@git.sealight.xyz/aynish/kitaab?ref=main";
|
||||||
poonam.inputs.nixpkgs.follows = "nixpkgs";
|
poonam.inputs.nixpkgs.follows = "nixpkgs";
|
||||||
basant.url = "git+ssh://gitea@git.sealight.xyz/aynish/basant?ref=main";
|
basant.url = "git+ssh://gitea@git.sealight.xyz/aynish/basant?ref=main";
|
||||||
|
vimwikicli.url = "git+ssh://gitea@git.sealight.xyz/aynish/vimwiki-cli?ref=main";
|
||||||
basant.inputs.nixpkgs.follows = "nixpkgs";
|
basant.inputs.nixpkgs.follows = "nixpkgs";
|
||||||
basant.inputs.poonam.follows = "poonam";
|
basant.inputs.poonam.follows = "poonam";
|
||||||
|
vimwikicli.inputs.nixpkgs.follows = "nixpkgs";
|
||||||
grasp.url = "git+ssh://gitea@git.sealight.xyz/aynish/grasp.git?ref=main";
|
grasp.url = "git+ssh://gitea@git.sealight.xyz/aynish/grasp.git?ref=main";
|
||||||
grasp.inputs.nixpkgs.follows = "nixpkgs";
|
grasp.inputs.nixpkgs.follows = "nixpkgs";
|
||||||
|
|
||||||
# Matrix
|
# Matrix
|
||||||
nix-matrix-appservices.url = "gitlab:coffeetables/nix-matrix-appservices";
|
nix-matrix-appservices.url = "gitlab:coffeetables/nix-matrix-appservices";
|
||||||
|
|
||||||
# Others
|
# Others
|
||||||
nur.url = "github:nix-community/NUR";
|
nur.url = "github:nix-community/NUR";
|
||||||
rust-overlay = {
|
rust-overlay = {
|
||||||
|
@ -60,6 +66,7 @@
|
||||||
, home-manager
|
, home-manager
|
||||||
, deploy-rs
|
, deploy-rs
|
||||||
, agenix
|
, agenix
|
||||||
|
, disko
|
||||||
, basant
|
, basant
|
||||||
, grasp
|
, grasp
|
||||||
, nix-matrix-appservices
|
, nix-matrix-appservices
|
||||||
|
@ -68,6 +75,7 @@
|
||||||
, rust-overlay
|
, rust-overlay
|
||||||
, eww
|
, eww
|
||||||
, llamacpp
|
, llamacpp
|
||||||
|
, vimwikicli
|
||||||
, ...
|
, ...
|
||||||
}@inputs:
|
}@inputs:
|
||||||
let
|
let
|
||||||
|
@ -86,6 +94,9 @@
|
||||||
llamaOverlay = final: prev: {
|
llamaOverlay = final: prev: {
|
||||||
llama = llamacpp.packages.${prev.system}.default;
|
llama = llamacpp.packages.${prev.system}.default;
|
||||||
};
|
};
|
||||||
|
vimwikiOverlay = final: prev: {
|
||||||
|
vimwiki-cli = vimwikicli.packages.${prev.system}.vimwiki-cli;
|
||||||
|
};
|
||||||
|
|
||||||
nixpkgsFor = forAllSystems (system: import nixpkgs {
|
nixpkgsFor = forAllSystems (system: import nixpkgs {
|
||||||
inherit system;
|
inherit system;
|
||||||
|
@ -106,6 +117,8 @@
|
||||||
nur.overlay
|
nur.overlay
|
||||||
nix-matrix-appservices.overlay
|
nix-matrix-appservices.overlay
|
||||||
unstableOverlay
|
unstableOverlay
|
||||||
|
llamaOverlay
|
||||||
|
vimwikiOverlay
|
||||||
self.overlays.additions
|
self.overlays.additions
|
||||||
self.overlays.modifications
|
self.overlays.modifications
|
||||||
];
|
];
|
||||||
|
@ -175,6 +188,7 @@
|
||||||
self.nixosModules.backup
|
self.nixosModules.backup
|
||||||
self.nixosModules.wireguard
|
self.nixosModules.wireguard
|
||||||
self.nixosModules.microbin
|
self.nixosModules.microbin
|
||||||
|
disko.nixosModules.disko
|
||||||
];
|
];
|
||||||
};
|
};
|
||||||
|
|
||||||
|
@ -222,6 +236,7 @@
|
||||||
self.nixosModules.wallabag
|
self.nixosModules.wallabag
|
||||||
self.nixosModules.gonic
|
self.nixosModules.gonic
|
||||||
self.nixosModules.ulogger-server
|
self.nixosModules.ulogger-server
|
||||||
|
self.nixosModules.photoprism
|
||||||
grasp.nixosModule
|
grasp.nixosModule
|
||||||
home-manager.nixosModules.home-manager
|
home-manager.nixosModules.home-manager
|
||||||
{
|
{
|
||||||
|
@ -249,6 +264,7 @@
|
||||||
deploy.nodes = {
|
deploy.nodes = {
|
||||||
box = {
|
box = {
|
||||||
hostname = "mossnet.lan";
|
hostname = "mossnet.lan";
|
||||||
|
autoRollback = false;
|
||||||
profiles.system = {
|
profiles.system = {
|
||||||
user = "root";
|
user = "root";
|
||||||
path = deploy-rs.lib.x86_64-linux.activate.nixos self.nixosConfigurations.box;
|
path = deploy-rs.lib.x86_64-linux.activate.nixos self.nixosConfigurations.box;
|
||||||
|
@ -256,7 +272,7 @@
|
||||||
};
|
};
|
||||||
lituus = {
|
lituus = {
|
||||||
hostname = "sealight.xyz";
|
hostname = "sealight.xyz";
|
||||||
autoRollback = false;
|
# autoRollback = false;
|
||||||
profiles.system = {
|
profiles.system = {
|
||||||
user = "root";
|
user = "root";
|
||||||
path = deploy-rs.lib.x86_64-linux.activate.nixos self.nixosConfigurations.lituus;
|
path = deploy-rs.lib.x86_64-linux.activate.nixos self.nixosConfigurations.lituus;
|
||||||
|
@ -264,7 +280,7 @@
|
||||||
};
|
};
|
||||||
helix = {
|
helix = {
|
||||||
hostname = "git.sealight.xyz";
|
hostname = "git.sealight.xyz";
|
||||||
# autoRollback = false;
|
autoRollback = false;
|
||||||
profiles.system = {
|
profiles.system = {
|
||||||
user = "root";
|
user = "root";
|
||||||
path = deploy-rs.lib.x86_64-linux.activate.nixos self.nixosConfigurations.helix;
|
path = deploy-rs.lib.x86_64-linux.activate.nixos self.nixosConfigurations.helix;
|
||||||
|
|
|
@ -6,5 +6,6 @@
|
||||||
../profiles/desktop
|
../profiles/desktop
|
||||||
../profiles/email
|
../profiles/email
|
||||||
../profiles/cal
|
../profiles/cal
|
||||||
|
../profiles/sync/kitaab
|
||||||
];
|
];
|
||||||
}
|
}
|
||||||
|
|
5
home/profiles/cli/bin/clear-vim-trash.sh
Executable file
5
home/profiles/cli/bin/clear-vim-trash.sh
Executable file
|
@ -0,0 +1,5 @@
|
||||||
|
#!/usr/bin/env bash
|
||||||
|
|
||||||
|
working_directory=$(pwd)
|
||||||
|
vim_directory="${working_directory//\//%}.vim"
|
||||||
|
trash "$HOME/.local/share/nvim/sessions/${vim_directory}"
|
|
@ -58,6 +58,8 @@
|
||||||
fontconfig
|
fontconfig
|
||||||
pandoc
|
pandoc
|
||||||
taskwarrior-tui
|
taskwarrior-tui
|
||||||
|
python3Packages.howdoi
|
||||||
|
vimwiki-cli
|
||||||
|
|
||||||
(pkgs.writeScriptBin "jq-repl" ''
|
(pkgs.writeScriptBin "jq-repl" ''
|
||||||
#!/usr/bin/env bash
|
#!/usr/bin/env bash
|
||||||
|
@ -71,6 +73,7 @@
|
||||||
|
|
||||||
echo "" \ | fzf --phony --preview-window="up:90%" --print-query --preview "jq --color-output -r {q} $input"
|
echo "" \ | fzf --phony --preview-window="up:90%" --print-query --preview "jq --color-output -r {q} $input"
|
||||||
'')
|
'')
|
||||||
|
(pkgs.writeScriptBin "clear-vim-trash" (builtins.readFile ./bin/clear-vim-trash.sh))
|
||||||
(pkgs.writeScriptBin "flakify" ''
|
(pkgs.writeScriptBin "flakify" ''
|
||||||
#!/usr/bin/env zsh
|
#!/usr/bin/env zsh
|
||||||
if [ ! -e flake.nix ]; then
|
if [ ! -e flake.nix ]; then
|
||||||
|
@ -212,6 +215,7 @@
|
||||||
kr = "cd /home/anish/kitaab/vimwiki; exa --sort=modified --reverse | fzf --preview 'bat --style=numbers --color=always --terminal-width -1 ./{}'";
|
kr = "cd /home/anish/kitaab/vimwiki; exa --sort=modified --reverse | fzf --preview 'bat --style=numbers --color=always --terminal-width -1 ./{}'";
|
||||||
icat = "kitty +kitten icat";
|
icat = "kitty +kitten icat";
|
||||||
yt = "ytfzf -T kitty -t ";
|
yt = "ytfzf -T kitty -t ";
|
||||||
|
gen-secret = "< /dev/urandom tr -dc _A-Z-a-z-0-9 | head -c\${1:-32};echo;";
|
||||||
|
|
||||||
# modern cli tools
|
# modern cli tools
|
||||||
ls = "exa --icons";
|
ls = "exa --icons";
|
||||||
|
@ -294,7 +298,7 @@
|
||||||
jtl = "journalctl";
|
jtl = "journalctl";
|
||||||
|
|
||||||
# quick ssh
|
# quick ssh
|
||||||
kssh = "kitten +kitty ssh";
|
kssh = "kitty +kitten ssh";
|
||||||
smm = "ssh 10.0.69.4"; # box over wireguard
|
smm = "ssh 10.0.69.4"; # box over wireguard
|
||||||
sm = "ssh mossnet.lan"; # box regular
|
sm = "ssh mossnet.lan"; # box regular
|
||||||
sl = "ssh sealight.xyz"; # lituus
|
sl = "ssh sealight.xyz"; # lituus
|
||||||
|
|
|
@ -33,6 +33,21 @@ in
|
||||||
termpdfpy
|
termpdfpy
|
||||||
];
|
];
|
||||||
|
|
||||||
|
xdg.desktopEntries = {
|
||||||
|
ocr = {
|
||||||
|
name = "OCR image";
|
||||||
|
exec = "${pkgs.writeScript "ocr" ''
|
||||||
|
${pkgs.xfce.xfce4-screenshooter}/bin/xfce4-screenshooter -r --save /tmp/ocr-tmp.png
|
||||||
|
${pkgs.tesseract}/bin/tesseract /tmp/ocr-tmp.png | ${pkgs.xclip}/bin/xclip -sel clip
|
||||||
|
rm /tmp/ocr-tmp.png
|
||||||
|
''}";
|
||||||
|
};
|
||||||
|
screenshot = {
|
||||||
|
name = "Screenshot";
|
||||||
|
exec = "screenshot";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
# set up env
|
# set up env
|
||||||
xsession.enable = true;
|
xsession.enable = true;
|
||||||
|
|
||||||
|
|
|
@ -6,6 +6,7 @@ bold_italic_font auto
|
||||||
open_url_with default
|
open_url_with default
|
||||||
mouse_map left click ungrabbed mouse_click_url_or_select
|
mouse_map left click ungrabbed mouse_click_url_or_select
|
||||||
confirm_os_window_close 0
|
confirm_os_window_close 0
|
||||||
|
enable_bell_audio no
|
||||||
-- Allows zen-mode.nvim to increase font size
|
-- Allows zen-mode.nvim to increase font size
|
||||||
-- allow_remote_control socket-only
|
-- allow_remote_control socket-only
|
||||||
-- listen_on unix:/tmp/kitty
|
-- listen_on unix:/tmp/kitty
|
||||||
|
|
32
home/profiles/sync/kitaab/default.nix
Normal file
32
home/profiles/sync/kitaab/default.nix
Normal file
|
@ -0,0 +1,32 @@
|
||||||
|
{ pkgs, ... }:
|
||||||
|
|
||||||
|
let
|
||||||
|
name = "kitaab-sync";
|
||||||
|
# Note this will fail if index.wiki is open in vim while this runs
|
||||||
|
mkStartScript = name: pkgs.writeShellScript "${name}.sh" ''
|
||||||
|
set -euo pipefail
|
||||||
|
PATH=/run/current-system/sw/bin:/etc/profiles/per-user/anish/bin:
|
||||||
|
cd /home/anish/kitaab
|
||||||
|
vimwiki tags rebuild
|
||||||
|
git add -A
|
||||||
|
git diff-index --quiet HEAD || git commit -m 'syncing kitaab' # if nothing, don't exit 1
|
||||||
|
git push
|
||||||
|
exit 0
|
||||||
|
'';
|
||||||
|
in
|
||||||
|
{
|
||||||
|
systemd.user.services.kitaab-sync = {
|
||||||
|
Service = {
|
||||||
|
ExecStart = "${mkStartScript name}";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
systemd.user.timers.kitaab-sync = {
|
||||||
|
Install = {
|
||||||
|
WantedBy = [ "timers.target" ];
|
||||||
|
PartOf = [ "kitaab-sync.service" ];
|
||||||
|
};
|
||||||
|
Timer = {
|
||||||
|
OnCalendar = [ "hourly" ];
|
||||||
|
};
|
||||||
|
};
|
||||||
|
}
|
|
@ -24,13 +24,14 @@
|
||||||
../profiles/woodpecker-agent
|
../profiles/woodpecker-agent
|
||||||
../profiles/jellyfin
|
../profiles/jellyfin
|
||||||
../profiles/ulogger-server
|
../profiles/ulogger-server
|
||||||
|
../profiles/photoprism
|
||||||
];
|
];
|
||||||
|
|
||||||
# Backups
|
# Backups
|
||||||
age.secrets.borg-password.file = "${self}/secrets/borg-password.age";
|
age.secrets.borg-password.file = "${self}/secrets/borg-password.age";
|
||||||
services.postgresqlBackup = {
|
services.postgresqlBackup = {
|
||||||
enable = true;
|
enable = true;
|
||||||
databases = [ "wallabag" ];
|
databases = [ "wallabag" "photoprism" "ulogger" ];
|
||||||
location = "/var/backup/postgresql";
|
location = "/var/backup/postgresql";
|
||||||
};
|
};
|
||||||
mossnet.backup = {
|
mossnet.backup = {
|
||||||
|
@ -52,6 +53,7 @@
|
||||||
|
|
||||||
age.secrets.box-wg.file = "${self}/secrets/box-wg.age";
|
age.secrets.box-wg.file = "${self}/secrets/box-wg.age";
|
||||||
age.secrets.box-wg.owner = "anish";
|
age.secrets.box-wg.owner = "anish";
|
||||||
|
age.secrets.borg-key.file = "${self}/secrets/borg-key.age";
|
||||||
mossnet.wg = {
|
mossnet.wg = {
|
||||||
enable = true;
|
enable = true;
|
||||||
ips = [ "10.0.69.4/24" ];
|
ips = [ "10.0.69.4/24" ];
|
||||||
|
|
|
@ -6,4 +6,11 @@
|
||||||
../profiles/server
|
../profiles/server
|
||||||
../profiles/site
|
../profiles/site
|
||||||
];
|
];
|
||||||
|
|
||||||
|
services.nginx.enable = true;
|
||||||
|
services.nginx.virtualHosts."coaching.lakhwara.com" = {
|
||||||
|
forceSSL = true;
|
||||||
|
enableACME = true;
|
||||||
|
locations."/" = { root = "/var/lib/coaching"; index = "/index.html"; };
|
||||||
|
};
|
||||||
}
|
}
|
||||||
|
|
|
@ -6,7 +6,6 @@
|
||||||
../profiles/core
|
../profiles/core
|
||||||
../profiles/bluetooth
|
../profiles/bluetooth
|
||||||
../profiles/music
|
../profiles/music
|
||||||
../profiles/sync/kitaab
|
|
||||||
../profiles/sync/cal
|
../profiles/sync/cal
|
||||||
../profiles/wifi
|
../profiles/wifi
|
||||||
../profiles/desktop
|
../profiles/desktop
|
||||||
|
@ -14,6 +13,7 @@
|
||||||
../profiles/syncthing
|
../profiles/syncthing
|
||||||
../profiles/mossnet-hosts
|
../profiles/mossnet-hosts
|
||||||
../profiles/kuberenetes
|
../profiles/kuberenetes
|
||||||
|
# ../profiles/mount-mossnet
|
||||||
];
|
];
|
||||||
|
|
||||||
# home-manager.users.anish = import ../../home/gui;
|
# home-manager.users.anish = import ../../home/gui;
|
||||||
|
|
|
@ -1,10 +1,10 @@
|
||||||
{ self, profiles, suites, ... }:
|
{ self, profiles, suites, pkgs, ... }:
|
||||||
{
|
{
|
||||||
imports = [
|
imports = [
|
||||||
./configuration.nix
|
./configuration.nix
|
||||||
../profiles/core
|
../profiles/core
|
||||||
../profiles/server
|
../profiles/server
|
||||||
../profiles/metrics
|
# ../profiles/metrics
|
||||||
../profiles/gitea
|
../profiles/gitea
|
||||||
../profiles/woodpecker-server
|
../profiles/woodpecker-server
|
||||||
../profiles/rss-bridge
|
../profiles/rss-bridge
|
||||||
|
@ -19,10 +19,31 @@
|
||||||
extraGroups = [ "wheel" ];
|
extraGroups = [ "wheel" ];
|
||||||
};
|
};
|
||||||
|
|
||||||
|
age.secrets.helix-wg.file = "${self}/secrets/helix-wg.age";
|
||||||
|
age.secrets.helix-wg.owner = "anish";
|
||||||
mossnet.wg = {
|
mossnet.wg = {
|
||||||
enable = true;
|
enable = true;
|
||||||
ips = [ "10.0.69.5/24" ];
|
ips = [ "10.0.69.5/24" ];
|
||||||
privateKeyFile = "/home/anish/wg/wg-priv";
|
privateKeyFile = "/run/agenix/helix-wg";
|
||||||
};
|
};
|
||||||
|
|
||||||
|
services.postgresql.package = pkgs.postgresql_11;
|
||||||
|
services.postgresqlBackup = {
|
||||||
|
# TODO needs working wireguard to box
|
||||||
|
enable = false;
|
||||||
|
databases = [ "gitea" "freshrss" "woodpecker" ];
|
||||||
|
location = "/mnt/two/postgres";
|
||||||
|
};
|
||||||
|
|
||||||
|
mossnet.backup = {
|
||||||
|
enable = true;
|
||||||
|
name = "helix";
|
||||||
|
paths = [
|
||||||
|
"/var/lib/gitea"
|
||||||
|
"/var/lib/freshrss"
|
||||||
|
"/var/lib/woodpecker"
|
||||||
|
"/var/lib/microbin"
|
||||||
|
];
|
||||||
|
|
||||||
|
};
|
||||||
}
|
}
|
||||||
|
|
51
hosts/helix/disko.nix
Normal file
51
hosts/helix/disko.nix
Normal file
|
@ -0,0 +1,51 @@
|
||||||
|
{ disks ? [ "/dev/vdb" ], ... }: {
|
||||||
|
disko.devices = {
|
||||||
|
disk = {
|
||||||
|
vdb = {
|
||||||
|
type = "disk";
|
||||||
|
device = builtins.elemAt disks 0;
|
||||||
|
content = {
|
||||||
|
type = "table";
|
||||||
|
format = "gpt";
|
||||||
|
partitions = [
|
||||||
|
{
|
||||||
|
name = "ESP";
|
||||||
|
start = "1MiB";
|
||||||
|
end = "128MiB";
|
||||||
|
fs-type = "fat32";
|
||||||
|
bootable = true;
|
||||||
|
content = {
|
||||||
|
type = "filesystem";
|
||||||
|
format = "vfat";
|
||||||
|
mountpoint = "/boot";
|
||||||
|
};
|
||||||
|
}
|
||||||
|
{
|
||||||
|
name = "root";
|
||||||
|
start = "128MiB";
|
||||||
|
end = "100%";
|
||||||
|
content = {
|
||||||
|
type = "btrfs";
|
||||||
|
extraArgs = [ "-f" ]; # Override existing partition
|
||||||
|
subvolumes = {
|
||||||
|
# Subvolume name is different from mountpoint
|
||||||
|
"/rootfs" = {
|
||||||
|
mountpoint = "/";
|
||||||
|
};
|
||||||
|
# Mountpoints inferred from subvolume name
|
||||||
|
"/home" = {
|
||||||
|
mountOptions = [ "compress=zstd" ];
|
||||||
|
};
|
||||||
|
"/nix" = {
|
||||||
|
mountOptions = [ "compress=zstd" "noatime" ];
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
}
|
||||||
|
];
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
}
|
||||||
|
|
|
@ -5,23 +5,27 @@
|
||||||
|
|
||||||
{
|
{
|
||||||
imports =
|
imports =
|
||||||
[
|
[ (modulesPath + "/profiles/qemu-guest.nix")
|
||||||
(modulesPath + "/profiles/qemu-guest.nix")
|
|
||||||
];
|
];
|
||||||
|
|
||||||
boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "sr_mod" "virtio_blk" ];
|
boot.initrd.availableKernelModules = [ "ata_piix" "virtio_pci" "floppy" "sr_mod" "virtio_blk" ];
|
||||||
boot.initrd.kernelModules = [ ];
|
boot.initrd.kernelModules = [ ];
|
||||||
boot.kernelModules = [ ];
|
boot.kernelModules = [ ];
|
||||||
boot.extraModulePackages = [ ];
|
boot.extraModulePackages = [ ];
|
||||||
|
|
||||||
fileSystems."/" =
|
fileSystems."/" =
|
||||||
{
|
{ device = "/dev/disk/by-uuid/7c560634-d545-41cc-b375-42ce3037fd73";
|
||||||
device = "/dev/disk/by-uuid/3b8b2c4b-835e-4822-8ac8-0effdc8270d6";
|
fsType = "ext4";
|
||||||
fsType = "btrfs";
|
|
||||||
};
|
};
|
||||||
|
|
||||||
swapDevices = [ ];
|
swapDevices = [ ];
|
||||||
|
|
||||||
nix.settings.max-jobs = lib.mkDefault 1;
|
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
|
||||||
nixpkgs.hostPlatform = "x86_64-linux";
|
# (the default) this is the recommended approach. When using systemd-networkd it's
|
||||||
|
# still possible to use this option, but it's recommended to use it in conjunction
|
||||||
|
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
|
||||||
|
networking.useDHCP = lib.mkDefault true;
|
||||||
|
# networking.interfaces.ens3.useDHCP = lib.mkDefault true;
|
||||||
|
|
||||||
|
hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
|
||||||
}
|
}
|
||||||
|
|
|
@ -4,7 +4,6 @@ in
|
||||||
{
|
{
|
||||||
imports = [ ../../users/anish ];
|
imports = [ ../../users/anish ];
|
||||||
|
|
||||||
|
|
||||||
fonts = {
|
fonts = {
|
||||||
fonts = with pkgs; [ powerline-fonts dejavu_fonts ];
|
fonts = with pkgs; [ powerline-fonts dejavu_fonts ];
|
||||||
fontconfig.defaultFonts = {
|
fontconfig.defaultFonts = {
|
||||||
|
|
|
@ -26,7 +26,6 @@ let
|
||||||
"read.mossnet.lan"
|
"read.mossnet.lan"
|
||||||
"stats.mossnet.lan"
|
"stats.mossnet.lan"
|
||||||
"music.mossnet.lan"
|
"music.mossnet.lan"
|
||||||
"rss.mossnet.lan"
|
|
||||||
"tasks.mossnet.lan"
|
"tasks.mossnet.lan"
|
||||||
"file.mossnet.lan"
|
"file.mossnet.lan"
|
||||||
"books.mossnet.lan"
|
"books.mossnet.lan"
|
||||||
|
@ -36,6 +35,7 @@ let
|
||||||
"archive.mossnet.lan"
|
"archive.mossnet.lan"
|
||||||
"tracks.mossnet.lan"
|
"tracks.mossnet.lan"
|
||||||
"grasp.mossnet.lan"
|
"grasp.mossnet.lan"
|
||||||
|
"photos.mossnet.lan"
|
||||||
];
|
];
|
||||||
in
|
in
|
||||||
{
|
{
|
||||||
|
@ -44,26 +44,31 @@ in
|
||||||
settings = {
|
settings = {
|
||||||
server = {
|
server = {
|
||||||
include = "${adblockLocalZones}";
|
include = "${adblockLocalZones}";
|
||||||
|
prefetch = "yes";
|
||||||
|
# private-address = "10.0.69.0/8";
|
||||||
|
# private-address = "192.168.1.0/24";
|
||||||
|
cache-min-ttl = 0;
|
||||||
|
serve-expired = "yes";
|
||||||
interface = [ "0.0.0.0" ];
|
interface = [ "0.0.0.0" ];
|
||||||
access-control = [ "127.0.0.0/24 allow" "192.168.0.0/24 allow" "10.0.69.0/24 allow" ];
|
access-control = [ "127.0.0.0/8 allow" "192.168.1.0/24 allow" "10.0.69.0/24 allow" ];
|
||||||
access-control-view = "10.0.69.0/24 wireguard";
|
access-control-view = "10.0.69.0/24 wireguard";
|
||||||
|
# so-reuseport = "yes";
|
||||||
|
tls-upstream = "yes";
|
||||||
|
domain-insecure = "mossnet.lan";
|
||||||
local-zone = ''"mossnet.lan." redirect'';
|
local-zone = ''"mossnet.lan." redirect'';
|
||||||
local-data = ''"mossnet.lan. IN A ${mossnet}"'';
|
local-data = ''"mossnet.lan. IN A ${mossnet}"'';
|
||||||
};
|
};
|
||||||
forward-zone = [{
|
forward-zone = [{
|
||||||
name = ".";
|
name = ".";
|
||||||
forward-addr = [ "45.90.30.49" "45.90.28.49" "1.1.1.1" "8.8.8.8" ];
|
forward-addr = [ "45.90.28.0#6939b9.dns.nextdns.io" "1.1.1.1@853#cloudflare-dns.com" ];
|
||||||
|
# non-tls
|
||||||
|
# forward-addr = ["45.90.30.49" "45.90.28.49" "1.1.1.1" "8.8.8.8"]
|
||||||
}];
|
}];
|
||||||
view = {
|
view = {
|
||||||
name = "wireguard";
|
name = "wireguard";
|
||||||
local-zone = ''"mossnet.lan." redirect'';
|
local-zone = ''"mossnet.lan." redirect'';
|
||||||
local-data = ''"mossnet.lan. IN A ${wg-mossnet}"'';
|
local-data = ''"mossnet.lan. IN A ${wg-mossnet}"'';
|
||||||
};
|
};
|
||||||
do-not-query-localhost = "no";
|
|
||||||
# Eventually we'll add DNSSEC / DoT
|
|
||||||
# so-reuseport: yes
|
|
||||||
# tls-cert-bundle: /etc/ssl/certs/ca-certificates.crt
|
|
||||||
# tls-upstream: yes
|
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
|
|
|
@ -2,7 +2,7 @@
|
||||||
|
|
||||||
{
|
{
|
||||||
services.paperless = {
|
services.paperless = {
|
||||||
enable = true;
|
enable = false;
|
||||||
consumptionDirIsPublic = true;
|
consumptionDirIsPublic = true;
|
||||||
extraConfig.PAPERLESS_AUTO_LOGIN_USERNAME = "admin";
|
extraConfig.PAPERLESS_AUTO_LOGIN_USERNAME = "admin";
|
||||||
};
|
};
|
||||||
|
@ -18,6 +18,7 @@
|
||||||
path = [
|
path = [
|
||||||
pkgs.fava
|
pkgs.fava
|
||||||
];
|
];
|
||||||
|
wantedBy = [ "multi-user.target" ];
|
||||||
before = [ "nginx.service" ];
|
before = [ "nginx.service" ];
|
||||||
serviceConfig = {
|
serviceConfig = {
|
||||||
User = "anish";
|
User = "anish";
|
||||||
|
|
|
@ -17,7 +17,6 @@
|
||||||
|
|
||||||
services.postgresql = {
|
services.postgresql = {
|
||||||
enable = true; # Ensure postgresql is enabled
|
enable = true; # Ensure postgresql is enabled
|
||||||
package = pkgs.postgresql_11;
|
|
||||||
authentication = ''
|
authentication = ''
|
||||||
local freshrss all ident map=freshrss-users
|
local freshrss all ident map=freshrss-users
|
||||||
'';
|
'';
|
||||||
|
@ -26,8 +25,11 @@
|
||||||
freshrss-users freshrss freshrss
|
freshrss-users freshrss freshrss
|
||||||
'';
|
'';
|
||||||
ensureDatabases = [ "freshrss" ];
|
ensureDatabases = [ "freshrss" ];
|
||||||
|
ensureUsers = [
|
||||||
|
{ name = "freshrss"; ensurePermissions."DATABASE freshrss" = "ALL PRIVILEGES"; }
|
||||||
|
];
|
||||||
# TODO
|
# TODO
|
||||||
# initialScript # set password for gitea user
|
# initialScript # set password for freshrss user
|
||||||
};
|
};
|
||||||
|
|
||||||
services.nginx.virtualHosts."rss.sealight.xyz" = {
|
services.nginx.virtualHosts."rss.sealight.xyz" = {
|
||||||
|
|
|
@ -22,19 +22,21 @@
|
||||||
repository = {
|
repository = {
|
||||||
DEFAULT_BRANCH = "main";
|
DEFAULT_BRANCH = "main";
|
||||||
};
|
};
|
||||||
# TODO
|
|
||||||
"markup.restructuredtext" = {
|
"markup.restructuredtext" = {
|
||||||
ENABLED = true;
|
ENABLED = true;
|
||||||
FILE_EXTENSIONS = ".rst";
|
FILE_EXTENSIONS = ".rst";
|
||||||
RENDER_COMMAND = "pandoc +RTS -M512M -RTS -f rst";
|
RENDER_COMMAND = "timeout 30s pandoc +RTS -RTS -f rst";
|
||||||
IS_INPUT_FILE = false;
|
IS_INPUT_FILE = false;
|
||||||
};
|
};
|
||||||
# TODO
|
|
||||||
mailer = {
|
mailer = {
|
||||||
ENABLED = false;
|
ENABLED = true;
|
||||||
MAILER_TYPE = "smtp";
|
MAILER_TYPE = "smtp";
|
||||||
FROM = "ops@sealight.xyz";
|
FROM = "ops@sealight.xyz";
|
||||||
SENDMAIL_PATH = "${pkgs.system-sendmail}/bin/sendmail";
|
SMTP_ADDR = "smtp.nullhex.com";
|
||||||
|
SMTP_PORT = "465";
|
||||||
|
USER = "ops@sealight.xyz";
|
||||||
|
PASSWD = "breed deputy fossil glory"; # TODO how do we pass this from agenix?
|
||||||
|
IS_TLS_ENABLED = "true";
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
@ -49,7 +51,7 @@
|
||||||
''
|
''
|
||||||
gitea-users gitea gitea
|
gitea-users gitea gitea
|
||||||
'';
|
'';
|
||||||
# ensureDatabases = [ "gitea" ];
|
ensureDatabases = [ "gitea" ];
|
||||||
ensureUsers = [
|
ensureUsers = [
|
||||||
{ name = "gitea"; ensurePermissions."DATABASE gitea" = "ALL PRIVILEGES"; }
|
{ name = "gitea"; ensurePermissions."DATABASE gitea" = "ALL PRIVILEGES"; }
|
||||||
];
|
];
|
||||||
|
@ -71,6 +73,4 @@
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
networking.firewall.allowedTCPPorts = [ 80 443 22 ];
|
networking.firewall.allowedTCPPorts = [ 80 443 22 ];
|
||||||
security.acme.defaults.email = "anish+acme@lakhwara.com";
|
|
||||||
security.acme.acceptTerms = true;
|
|
||||||
}
|
}
|
||||||
|
|
|
@ -3,7 +3,7 @@
|
||||||
{
|
{
|
||||||
# k3s
|
# k3s
|
||||||
networking.firewall.allowedTCPPorts = [ 6443 ];
|
networking.firewall.allowedTCPPorts = [ 6443 ];
|
||||||
services.k3s.enable = true;
|
services.k3s.enable = false;
|
||||||
services.k3s.role = "server";
|
services.k3s.role = "server";
|
||||||
services.k3s.clusterInit = true;
|
services.k3s.clusterInit = true;
|
||||||
# services.k3s.extraFlags = toString [
|
# services.k3s.extraFlags = toString [
|
||||||
|
@ -15,6 +15,6 @@
|
||||||
virtualisation.docker.enable = true;
|
virtualisation.docker.enable = true;
|
||||||
virtualisation.docker.storageDriver = "btrfs";
|
virtualisation.docker.storageDriver = "btrfs";
|
||||||
# or use kvm
|
# or use kvm
|
||||||
#virtualisation.libvrt.enable = true;
|
virtualisation.libvirtd.enable = true;
|
||||||
users.users.anish.extraGroups = [ "docker" ]; # "libvert"
|
users.users.anish.extraGroups = [ "docker" "libvert" ]; #
|
||||||
}
|
}
|
||||||
|
|
|
@ -1,25 +1,49 @@
|
||||||
{ self, config, pkgs, ... }: {
|
{ self, config, pkgs, ... }: {
|
||||||
|
age.secrets.nullhex-smtp.file = "${self}/secrets/nullhex-smtp.age";
|
||||||
|
age.secrets.nullhex-smtp.owner = "grafana";
|
||||||
|
|
||||||
# grafana configuration
|
# grafana configuration
|
||||||
services.grafana = {
|
services.grafana = {
|
||||||
enable = true;
|
enable = true;
|
||||||
settings.server = {
|
settings = {
|
||||||
domain = "stats.mossnet.lan";
|
smtp = {
|
||||||
http_port = 2342;
|
enabled = true;
|
||||||
http_addr = "127.0.0.1";
|
password = "$__file{/run/agenix/nullhex-smtp}";
|
||||||
|
host = "smtp.nullhex.com";
|
||||||
|
user = "ops@sealight.xyz";
|
||||||
|
from_address = "ops@sealight.xyz";
|
||||||
|
};
|
||||||
|
server = {
|
||||||
|
domain = "stats.mossnet.lan";
|
||||||
|
http_addr = "127.0.0.1";
|
||||||
|
http_port = 2342;
|
||||||
|
root_url = "http://stats.mossnet.lan/";
|
||||||
|
};
|
||||||
};
|
};
|
||||||
# TODO enable
|
# TODO enable
|
||||||
# provision.alerting.rules.path = "${self}/hosts/profiles/monitoring/alert-rules.yaml";
|
# provision.alerting.rules.path = "${self}/hosts/profiles/monitoring/alert-rules.yaml";
|
||||||
};
|
};
|
||||||
|
|
||||||
# nginx reverse proxy
|
# nginx reverse proxy
|
||||||
services.nginx.recommendedProxySettings = true; # Needed for new grafana versions
|
# services.nginx.recommendedProxySettings = true; # Needed for new grafana versions
|
||||||
services.nginx.virtualHosts.${config.services.grafana.domain} = {
|
services.nginx.virtualHosts.${config.services.grafana.settings.server.domain} = {
|
||||||
locations."/" = {
|
locations."/" = {
|
||||||
proxyPass = "http://127.0.0.1:${toString config.services.grafana.port}";
|
proxyPass = "http://127.0.0.1:2342";
|
||||||
proxyWebsockets = true;
|
proxyWebsockets = true;
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
|
services.postgresql = {
|
||||||
|
ensureUsers = [{
|
||||||
|
name = "grafana";
|
||||||
|
ensurePermissions = {
|
||||||
|
"DATABASE wallabag" = "SELECT";
|
||||||
|
"DATABASE ulogger" = "SELECT";
|
||||||
|
"DATABASE photoprism" = "SELECT";
|
||||||
|
};
|
||||||
|
}];
|
||||||
|
};
|
||||||
|
|
||||||
services.prometheus = {
|
services.prometheus = {
|
||||||
enable = true;
|
enable = true;
|
||||||
port = 9001;
|
port = 9001;
|
||||||
|
|
|
@ -13,6 +13,9 @@
|
||||||
192.168.1.240 books.mossnet.lan
|
192.168.1.240 books.mossnet.lan
|
||||||
192.168.1.240 archive.mossnet.lan
|
192.168.1.240 archive.mossnet.lan
|
||||||
192.168.1.240 music.mossnet.lan
|
192.168.1.240 music.mossnet.lan
|
||||||
|
192.168.1.240 tracks.mossnet.lan
|
||||||
|
192.168.1.240 grasp.mossnet.lan
|
||||||
|
192.168.1.240 photos.mossnet.lan
|
||||||
'';
|
'';
|
||||||
# 10.0.69.4 mossnet.lan
|
# 10.0.69.4 mossnet.lan
|
||||||
# 10.0.69.4 links.mossnet.lan
|
# 10.0.69.4 links.mossnet.lan
|
||||||
|
|
48
hosts/profiles/photoprism/default.nix
Normal file
48
hosts/profiles/photoprism/default.nix
Normal file
|
@ -0,0 +1,48 @@
|
||||||
|
{ self, pkgs, config, lib, ... }:
|
||||||
|
|
||||||
|
{
|
||||||
|
services.postgresql = {
|
||||||
|
enable = true;
|
||||||
|
ensureDatabases = [ "photoprism" ];
|
||||||
|
ensureUsers = [{
|
||||||
|
name = "photoprism";
|
||||||
|
ensurePermissions = {
|
||||||
|
"DATABASE photoprism" = "ALL PRIVILEGES";
|
||||||
|
};
|
||||||
|
}];
|
||||||
|
};
|
||||||
|
|
||||||
|
services.photoprism = {
|
||||||
|
enable = true;
|
||||||
|
package = pkgs.unstable.photoprism;
|
||||||
|
port = 5152;
|
||||||
|
originalsPath = "/var/lib/private/photoprism/originals";
|
||||||
|
address = "0.0.0.0";
|
||||||
|
settings = {
|
||||||
|
PHOTOPRISM_ADMIN_USER = "admin";
|
||||||
|
PHOTOPRISM_ADMIN_PASSWORD = "photoprism"; # initial password, do change it!
|
||||||
|
PHOTOPRISM_DEFAULT_LOCALE = "en";
|
||||||
|
PHOTOPRISM_DATABASE_DRIVER = "postgres";
|
||||||
|
PHOTOPRISM_DATABASE_NAME = "photoprism";
|
||||||
|
PHOTOPRISM_DATABASE_SERVER = "/run/postgresql/";
|
||||||
|
PHOTOPRISM_DATABASE_USER = "photoprism";
|
||||||
|
PHOTOPRISM_SITE_URL = "http://photos.mossnet.lan/";
|
||||||
|
PHOTOPRISM_SITE_TITLE = "mossnet photos";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
services.nginx.clientMaxBodySize = "500m";
|
||||||
|
services.nginx.recommendedProxySettings = true;
|
||||||
|
services.nginx.virtualHosts."photos.mossnet.lan" = {
|
||||||
|
enableACME = false;
|
||||||
|
forceSSL = false;
|
||||||
|
locations."/" = {
|
||||||
|
extraConfig = ''
|
||||||
|
proxy_pass http://localhost:5152/;
|
||||||
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||||
|
proxy_buffering off;
|
||||||
|
proxy_http_version 1.1;
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
};
|
||||||
|
}
|
|
@ -1,27 +0,0 @@
|
||||||
{ pkgs, ... }:
|
|
||||||
|
|
||||||
{
|
|
||||||
systemd.services.kitaab-sync = {
|
|
||||||
serviceConfig.Type = "oneshot";
|
|
||||||
path = [
|
|
||||||
pkgs.git
|
|
||||||
pkgs.openssh
|
|
||||||
pkgs.coreutils
|
|
||||||
];
|
|
||||||
script = ''
|
|
||||||
cd /home/anish/kitaab
|
|
||||||
git add -A
|
|
||||||
git diff-index --quiet HEAD || git commit -m 'syncing kitaab' # if nothing, don't exit 1
|
|
||||||
git push
|
|
||||||
exit 0
|
|
||||||
'';
|
|
||||||
serviceConfig = {
|
|
||||||
User = "anish";
|
|
||||||
};
|
|
||||||
};
|
|
||||||
systemd.timers.kitaab-sync = {
|
|
||||||
wantedBy = [ "timers.target" ];
|
|
||||||
partOf = [ "kitaab-sync.service" ];
|
|
||||||
timerConfig.OnCalendar = [ "hourly" ];
|
|
||||||
};
|
|
||||||
}
|
|
|
@ -36,6 +36,11 @@
|
||||||
publicKey = "gcdq86hhEUlqF2chqYB/F8pALyAMNFvwLycxBoHuoDs=";
|
publicKey = "gcdq86hhEUlqF2chqYB/F8pALyAMNFvwLycxBoHuoDs=";
|
||||||
allowedIPs = [ "10.0.69.5/32" ];
|
allowedIPs = [ "10.0.69.5/32" ];
|
||||||
}
|
}
|
||||||
|
{
|
||||||
|
# hyperplane
|
||||||
|
publicKey = "";
|
||||||
|
allowedIPs = [ "10.0.69.6/32" ];
|
||||||
|
}
|
||||||
];
|
];
|
||||||
};
|
};
|
||||||
}
|
}
|
||||||
|
|
|
@ -52,7 +52,7 @@
|
||||||
|
|
||||||
"WOODPECKER_DATABASE_DATASOURCE=postgres:///woodpecker?host=/run/postgresql"
|
"WOODPECKER_DATABASE_DATASOURCE=postgres:///woodpecker?host=/run/postgresql"
|
||||||
"WOODPECKER_DATABASE_DRIVER=postgres"
|
"WOODPECKER_DATABASE_DRIVER=postgres"
|
||||||
"WOODPECKER_USER_CREATE=username:aynish,admin:true" # set your admin username
|
"WOODPECKER_ADMIN=aynish"
|
||||||
];
|
];
|
||||||
ExecStart = "${pkgs.woodpecker-server}/bin/woodpecker-server";
|
ExecStart = "${pkgs.woodpecker-server}/bin/woodpecker-server";
|
||||||
User = "woodpecker";
|
User = "woodpecker";
|
||||||
|
|
|
@ -10,4 +10,5 @@
|
||||||
backup = import ./backup.nix;
|
backup = import ./backup.nix;
|
||||||
ulogger-server = import ./ulogger.nix;
|
ulogger-server = import ./ulogger.nix;
|
||||||
microbin = import ./microbin.nix;
|
microbin = import ./microbin.nix;
|
||||||
|
photoprism = import ./photoprism.nix; #TODO remove once updated to 23.05, stolen from nixpkgs anyway
|
||||||
}
|
}
|
||||||
|
|
|
@ -45,7 +45,7 @@ in
|
||||||
after = [ "remote-fs.target" "network.target" ];
|
after = [ "remote-fs.target" "network.target" ];
|
||||||
wantedBy = [ "multi-user.target" ];
|
wantedBy = [ "multi-user.target" ];
|
||||||
serviceConfig = {
|
serviceConfig = {
|
||||||
ExecStart = "${pkgs.unstable.microbin}/bin/microbin --public-path ${cfg.hostname} --qr --enable-burn-after --private";
|
ExecStart = "${pkgs.unstable.microbin}/bin/microbin --public-path https://${cfg.hostname}/ --qr --enable-burn-after --private";
|
||||||
Environment = [
|
Environment = [
|
||||||
"MICROBIN_EDITABLE=true"
|
"MICROBIN_EDITABLE=true"
|
||||||
"MICROBIN_HIDE_FOOTER=true"
|
"MICROBIN_HIDE_FOOTER=true"
|
||||||
|
|
154
modules/nixos/photoprism.nix
Normal file
154
modules/nixos/photoprism.nix
Normal file
|
@ -0,0 +1,154 @@
|
||||||
|
{ config, pkgs, lib, ... }:
|
||||||
|
let
|
||||||
|
cfg = config.services.photoprism;
|
||||||
|
|
||||||
|
env = {
|
||||||
|
PHOTOPRISM_ORIGINALS_PATH = cfg.originalsPath;
|
||||||
|
PHOTOPRISM_STORAGE_PATH = cfg.storagePath;
|
||||||
|
PHOTOPRISM_IMPORT_PATH = cfg.importPath;
|
||||||
|
PHOTOPRISM_HTTP_HOST = cfg.address;
|
||||||
|
PHOTOPRISM_HTTP_PORT = toString cfg.port;
|
||||||
|
} // (
|
||||||
|
lib.mapAttrs (_: toString) cfg.settings
|
||||||
|
);
|
||||||
|
|
||||||
|
manage =
|
||||||
|
let
|
||||||
|
setupEnv = lib.concatStringsSep "\n" (lib.mapAttrsToList (name: val: "export ${name}=${lib.escapeShellArg val}") env);
|
||||||
|
in
|
||||||
|
pkgs.writeShellScript "manage" ''
|
||||||
|
${setupEnv}
|
||||||
|
exec ${cfg.package}/bin/photoprism "$@"
|
||||||
|
'';
|
||||||
|
in
|
||||||
|
{
|
||||||
|
meta.maintainers = with lib.maintainers; [ stunkymonkey ];
|
||||||
|
|
||||||
|
options.services.photoprism = {
|
||||||
|
|
||||||
|
enable = lib.mkEnableOption (lib.mdDoc "Photoprism web server");
|
||||||
|
|
||||||
|
passwordFile = lib.mkOption {
|
||||||
|
type = lib.types.nullOr lib.types.path;
|
||||||
|
default = null;
|
||||||
|
description = lib.mdDoc ''
|
||||||
|
Admin password file.
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
|
||||||
|
address = lib.mkOption {
|
||||||
|
type = lib.types.str;
|
||||||
|
default = "localhost";
|
||||||
|
description = lib.mdDoc ''
|
||||||
|
Web interface address.
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
|
||||||
|
port = lib.mkOption {
|
||||||
|
type = lib.types.port;
|
||||||
|
default = 2342;
|
||||||
|
description = lib.mdDoc ''
|
||||||
|
Web interface port.
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
|
||||||
|
originalsPath = lib.mkOption {
|
||||||
|
type = lib.types.path;
|
||||||
|
default = null;
|
||||||
|
example = "/data/photos";
|
||||||
|
description = lib.mdDoc ''
|
||||||
|
Storage path of your original media files (photos and videos).
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
|
||||||
|
importPath = lib.mkOption {
|
||||||
|
type = lib.types.str;
|
||||||
|
default = "import";
|
||||||
|
description = lib.mdDoc ''
|
||||||
|
Relative or absolute to the `originalsPath` from where the files should be imported.
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
|
||||||
|
storagePath = lib.mkOption {
|
||||||
|
type = lib.types.path;
|
||||||
|
default = "/var/lib/photoprism";
|
||||||
|
description = lib.mdDoc ''
|
||||||
|
Location for sidecar, cache, and database files.
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
|
||||||
|
package = lib.mkPackageOptionMD pkgs "photoprism" { };
|
||||||
|
|
||||||
|
settings = lib.mkOption {
|
||||||
|
type = lib.types.attrsOf lib.types.str;
|
||||||
|
default = { };
|
||||||
|
description = lib.mdDoc ''
|
||||||
|
See [the getting-started guide](https://docs.photoprism.app/getting-started/config-options/) for available options.
|
||||||
|
'';
|
||||||
|
example = {
|
||||||
|
PHOTOPRISM_DEFAULT_LOCALE = "de";
|
||||||
|
PHOTOPRISM_ADMIN_USER = "root";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
config = lib.mkIf cfg.enable {
|
||||||
|
systemd.services.photoprism = {
|
||||||
|
description = "Photoprism server";
|
||||||
|
|
||||||
|
serviceConfig = {
|
||||||
|
Restart = "on-failure";
|
||||||
|
User = "photoprism";
|
||||||
|
Group = "photoprism";
|
||||||
|
DynamicUser = true;
|
||||||
|
StateDirectory = "photoprism";
|
||||||
|
WorkingDirectory = "/var/lib/photoprism";
|
||||||
|
RuntimeDirectory = "photoprism";
|
||||||
|
|
||||||
|
LoadCredential = lib.optionalString (cfg.passwordFile != null)
|
||||||
|
"PHOTOPRISM_ADMIN_PASSWORD:${cfg.passwordFile}";
|
||||||
|
|
||||||
|
CapabilityBoundingSet = "";
|
||||||
|
LockPersonality = true;
|
||||||
|
PrivateDevices = true;
|
||||||
|
PrivateUsers = true;
|
||||||
|
ProtectClock = true;
|
||||||
|
ProtectControlGroups = true;
|
||||||
|
ProtectHome = true;
|
||||||
|
ProtectHostname = true;
|
||||||
|
ProtectKernelLogs = true;
|
||||||
|
ProtectKernelModules = true;
|
||||||
|
ProtectKernelTunables = true;
|
||||||
|
RestrictAddressFamilies = [ "AF_UNIX" "AF_INET" "AF_INET6" ];
|
||||||
|
RestrictNamespaces = true;
|
||||||
|
RestrictRealtime = true;
|
||||||
|
SystemCallArchitectures = "native";
|
||||||
|
SystemCallFilter = [ "@system-service" "~@privileged @setuid @keyring" ];
|
||||||
|
UMask = "0066";
|
||||||
|
} // lib.optionalAttrs (cfg.port < 1024) {
|
||||||
|
AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" ];
|
||||||
|
CapabilityBoundingSet = [ "CAP_NET_BIND_SERVICE" ];
|
||||||
|
};
|
||||||
|
|
||||||
|
wantedBy = [ "multi-user.target" ];
|
||||||
|
environment = env;
|
||||||
|
|
||||||
|
# reminder: easier password configuration will come in https://github.com/photoprism/photoprism/pull/2302
|
||||||
|
preStart = ''
|
||||||
|
ln -sf ${manage} photoprism-manage
|
||||||
|
|
||||||
|
${lib.optionalString (cfg.passwordFile != null) ''
|
||||||
|
export PHOTOPRISM_ADMIN_PASSWORD=$(cat "$CREDENTIALS_DIRECTORY/PHOTOPRISM_ADMIN_PASSWORD")
|
||||||
|
''}
|
||||||
|
exec ${cfg.package}/bin/photoprism migrations run -f
|
||||||
|
'';
|
||||||
|
|
||||||
|
script = ''
|
||||||
|
${lib.optionalString (cfg.passwordFile != null) ''
|
||||||
|
export PHOTOPRISM_ADMIN_PASSWORD=$(cat "$CREDENTIALS_DIRECTORY/PHOTOPRISM_ADMIN_PASSWORD")
|
||||||
|
''}
|
||||||
|
exec ${cfg.package}/bin/photoprism start
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
};
|
||||||
|
}
|
Binary file not shown.
Binary file not shown.
|
@ -1,8 +1,10 @@
|
||||||
age-encryption.org/v1
|
age-encryption.org/v1
|
||||||
-> ssh-ed25519 kgCrKA wILVHjLHNY2lAAWw6ENwYlRTRq6fWAO4ZHxd/BXDvg0
|
-> ssh-ed25519 6DaCrw 1dgmzBJiOecaCLSJz1nrw3iTF9G00gIQd5hY6HXZKUI
|
||||||
DCIIBq++JSKzcFOJ51i0USitDOhK9R6NEsCilGlxKtA
|
HVkZRyHiKJ2E/Wdgty/uMbPm6lNy9wgaGwe5EJcJ8jY
|
||||||
-> e-grease F
|
-> ssh-ed25519 kgCrKA aQiYpgMLe9uSw7NB89mt3Gpa29RqZGHfnZzsOV8DaiM
|
||||||
cN5lygYFvScErf/J4BAEJ5ZkimpxOUj9gj8jGZV6Cl/RMkUThxflOfxz/OOBOK3V
|
gcgFyaibNSL5/7ITddnryWFxOuCX22mtGY2e0uL8MEs
|
||||||
S/NBseDL2dg9XzIUY7k
|
-> zWZg=\-grease GP#:NZ \CW2nnR/ /k
|
||||||
--- IIXSaSol3agW8SNwdOqxoV8dTkwW1CWxgJ8R3Blr1Sw
|
bMvg21MLLhnwNVSyNMvMZNT9MzyiT6UqLn3SJcxGtt3Eu9jcMAphAeGy7i+8pQbt
|
||||||
Sャ゙ニモーyQェ>lュV,<2C>モR<EFBE93><52>5サS虍HP<48>`゚dニK6ルセ"u懌z)εL゚[゚ムWヒ<57>ハキKヌ
|
9MnCFZBN4JG+ZunMtSQWodmOqiHFV1vKGsjqQboMsjMo
|
||||||
|
--- glgRELYTsrSXv/SK/6RDso2FhnvfCT1TB3Ytz/AERPs
|
||||||
|
Œô97£lÓ•¹b,!.L_M´Ÿ×C[Q…rúôZ<C3B4>škò…› s"Q+ÚC$ÜØ«Ï«ÍŽ<C38D>“"ëè…sRõ[
|
|
@ -1,8 +1,9 @@
|
||||||
age-encryption.org/v1
|
age-encryption.org/v1
|
||||||
-> ssh-ed25519 kgCrKA /u5qYf6vYBVeJryLq2xvZHXk9LY2A8+ks/XV4C/fixw
|
-> ssh-ed25519 kgCrKA QpRQkobE13NxRH81V9tFP+HelBBp5KE2cTyOZIyKsVM
|
||||||
HNLXInIHa2d/CZR8/OwwhfLurpEbxiXca8Ip3kp/EWg
|
hw3pwAfiQeVRqNwITHCKx8u2/aBtwdB24FJdexUfMyc
|
||||||
-> s9b#/i%D-grease
|
-> ssh-ed25519 6DaCrw HjJO4lhmCmsRSD979Jva6UXIMCYqTzmkh7BX+GkbpiI
|
||||||
DtUrN1QNHQyj0mSiV9nAOBpjf1/3yxxV4E4Xxr0oR2kJa/VWvpIYzyReZdRpS5Xs
|
8SyOm3HR23KfA4pz/fL8dwbvpyXQJRE9ymLMs1lFCBs
|
||||||
Qf0Rw1HB9OAMAQ04DuR6FVfGYaGm
|
-> P32-grease %>7>/d}-
|
||||||
--- WszM9cCBr4HW0I+HltsdXj/BCxUDMld4yAVzXVo1HLg
|
mB3N3P/0E4+1zo1l/cqSmqNqGBaDw2RrH4RC11GfZEmadA
|
||||||
4µEíŕÝľöGT/ĹCÁ°¸<C2B0>ŞBń’šrň©ř˘ŁXYëµW<C2B5>ŔfröĹý|e5÷÷}PÄ)
|
--- 2P5bd82ou+ey3DbL5QHZKQM13N4hqvmzS5D9eWkYw5o
|
||||||
|
€Âµ®Üf»é2øGçèÅüqàà²Á›Ó<E280BA>;…f&aæYºG
õ•ˆ•ÎBòBüäÍû‹*Vz÷£lý
|
10
secrets/helix-wg.age
Normal file
10
secrets/helix-wg.age
Normal file
|
@ -0,0 +1,10 @@
|
||||||
|
age-encryption.org/v1
|
||||||
|
-> ssh-ed25519 6DaCrw igsyzrecx35FlTKXLg8msiM5mxT90UCBxty8lZwvelY
|
||||||
|
379UsHnxI+mL+Its00WVznKnDkpGi+SMLFSaHkcCcjE
|
||||||
|
-> ssh-ed25519 kgCrKA 7kGBgw8di49lYUYNLNq3PgVpoLpIvfDnGZbxipVUXXQ
|
||||||
|
ZzY77hAJn8GiPwYT88XmYw+Qi/OTmE3pXsVrot6psOE
|
||||||
|
-> Fgy[uTu-grease
|
||||||
|
9Oo+QfjC+h8Wlm1UcN1KcEa5G9t8mw9UF0aoafJYQnGBwdJAY1UgDbNVIWb3j5yD
|
||||||
|
EnIMAQ6RPEQtm9sXnDrY+f5A6vxNdYWMdSNUOcYi2In9Ux+Q9Us4d2A
|
||||||
|
--- c3Sqf+zgIZpEQ59/pCBoKFCuwAUjPCzAFImZsZ9pqZc
|
||||||
|
™°ÚÖ+ïƒGù[?<01>ÿ#<23>çk|}¡hn^Ô³lì!€_eÑ(ô™—ìFèôjÖ ²9•œ¿4OZžH¯Ý²˜žyÞ¬ËYl=®CwÊ4o_
|
14
secrets/nullhex-smtp.age
Normal file
14
secrets/nullhex-smtp.age
Normal file
|
@ -0,0 +1,14 @@
|
||||||
|
age-encryption.org/v1
|
||||||
|
-> ssh-ed25519 H6uv4Q k1/9tYh1a2JNaZCXB2RJgRA7hQ7vg0mE7B4a0lVCvW8
|
||||||
|
y4aGbd1scFAMA6mQZv6lshDFR/7TsCHKC3NuOWmE1Ss
|
||||||
|
-> ssh-ed25519 K2vF/Q Fqd9YCy61FlWmBiWXAJeJDAKeXtdDO9N5w0L2FBZGB0
|
||||||
|
lj9yucjMsmBshHtpz6VqRRb/MA4+DKUM9jo1ixY59Dc
|
||||||
|
-> ssh-ed25519 ntXL8g z+btuETbHoPe31h87MDOGM41vW3lq9xLIE1QU3EnME4
|
||||||
|
BtQLF81szEiwmGVcxbdF7Ls0mrV9UUJbvZ4N9Zy6dG0
|
||||||
|
-> ssh-ed25519 kgCrKA HFjfjTV8L6ftCuUh/fD+sGuJK0Ev++r2qyEqr+fTKmM
|
||||||
|
/m+7SzjOI5nmt/V+hMau9Rfi9RIbbPNPFSuWxUvhkM4
|
||||||
|
-> bN-grease }R]4T%[p
|
||||||
|
6yeWs4CF8vqsnJ/l3DX9JKODjBv0gkc66HFmCoGKtDZCtfNWeO82CW6UE50MES5E
|
||||||
|
lQL5woQJVXLL3HTIsNKbXeigjBZ1/SSksbMBGeeu/+DXkrUHdPo37pz/KcQ
|
||||||
|
--- La4OQuTEE9G8czWAz8t1EhHNIa6rE7hoq3tckn6GxOo
|
||||||
|
ý@ù<>.`ø¹¨Å´z8›ÔǬ};ÔŠK¯†<C2AF>G<[ÞdNpr¹ÄòùÞ ½ bßü.¯•¨³Ò
|
8
secrets/photoprism.age
Normal file
8
secrets/photoprism.age
Normal file
|
@ -0,0 +1,8 @@
|
||||||
|
age-encryption.org/v1
|
||||||
|
-> ssh-ed25519 K2vF/Q gbzVy3hrykVeOCwjPo6Ma8tTTemdtiRwAtX96cA2viE
|
||||||
|
NFSztfWodmZ4TQFBMgx9e1U2ZO37Nt/MKJEYBBrICrA
|
||||||
|
-> s.pLZ.|-grease %UVo!F YgUB rG`)8.@w
|
||||||
|
pYerZHERVJx3dldU27I9vIxh5mizU4cW4F1QTRxk646K0abW7H6rqp6Qyr096fLF
|
||||||
|
c9egbGKMJFNgWoXWaauMaGCAV2D8km5DHSWVoEMZVkskQSprSUWh
|
||||||
|
--- SANH4pgKXob6sZ/jhnqkgXFC9QzVbI81HqxvwiayK2Y
|
||||||
|
õÐ4¿ÆÝž•ë LªH²jæœ[§È˜p(löl@™GÊà¸ÍRƒr‰)P¤0Q?àG•®ÂaÜfú€ø»÷<>
|
|
@ -5,6 +5,7 @@ let
|
||||||
mossnet = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAA0bsVbdQR6iWNLKIiID57A1+dVXC58Dtf5cSXg6/JF root@box";
|
mossnet = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAA0bsVbdQR6iWNLKIiID57A1+dVXC58Dtf5cSXg6/JF root@box";
|
||||||
lituus = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIH2lAb33LH3JNuOfBXt971u0tHe+NURFecQdfjwEj+C+ root@lituus";
|
lituus = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIH2lAb33LH3JNuOfBXt971u0tHe+NURFecQdfjwEj+C+ root@lituus";
|
||||||
helix = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAKrL6IDHNnHmxi0q9nzu87NOyidPm3HpE7klU368lEf root@helix";
|
helix = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAKrL6IDHNnHmxi0q9nzu87NOyidPm3HpE7klU368lEf root@helix";
|
||||||
|
helix2 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIK2G81z1E51ioJQGLHnTJEjgSdBqLM6mb72Z+0atE6Bf root@helix";
|
||||||
curve = [ system user ];
|
curve = [ system user ];
|
||||||
allUserKeys = [ system user mossnet ];
|
allUserKeys = [ system user mossnet ];
|
||||||
systemOnly = [ system mossnet lituus helix ];
|
systemOnly = [ system mossnet lituus helix ];
|
||||||
|
@ -14,20 +15,23 @@ in
|
||||||
"fastmail.age".publicKeys = allUserKeys;
|
"fastmail.age".publicKeys = allUserKeys;
|
||||||
"mossnet.age".publicKeys = allUserKeys;
|
"mossnet.age".publicKeys = allUserKeys;
|
||||||
"curve-wg.age".publicKeys = curve;
|
"curve-wg.age".publicKeys = curve;
|
||||||
"box-wg.age".publicKeys = [ mossnet ];
|
"nullhex-smtp.age".publicKeys = systemOnly;
|
||||||
"wallabag-password.age".publicKeys = [ mossnet ];
|
|
||||||
"wallabag-secret.age".publicKeys = [ mossnet ];
|
|
||||||
|
|
||||||
"borg-password.age".publicKeys = systemOnly;
|
"borg-password.age".publicKeys = systemOnly;
|
||||||
"borg-key.age".publicKeys = systemOnly;
|
"borg-key.age".publicKeys = systemOnly;
|
||||||
"freshrss-dbpass.age".publicKeys = [ helix ];
|
|
||||||
|
"helix-wg.age".publicKeys = [ helix2 helix ];
|
||||||
|
"freshrss-dbpass.age".publicKeys = [ helix2 helix ];
|
||||||
|
"woodpecker-server-secrets.age".publicKeys = [ helix2 helix ];
|
||||||
|
"gitea-dbpass.age".publicKeys = [ helix helix2 ];
|
||||||
|
|
||||||
"synapse-config.age".publicKeys = [ lituus ];
|
"synapse-config.age".publicKeys = [ lituus ];
|
||||||
"synapse-database-password.age".publicKeys = [ lituus ];
|
"synapse-database-password.age".publicKeys = [ lituus ];
|
||||||
"sealight-mod-password.age".publicKeys = [ lituus ];
|
"sealight-mod-password.age".publicKeys = [ lituus ];
|
||||||
"telegram-matrix-env.age".publicKeys = [ lituus ];
|
"telegram-matrix-env.age".publicKeys = [ lituus ];
|
||||||
|
|
||||||
"wallabag.age".publicKeys = [ mossnet ];
|
"wallabag.age".publicKeys = [ mossnet ];
|
||||||
"woodpecker-agent-secret.age".publicKeys = [ mossnet helix ];
|
"woodpecker-agent-secret.age".publicKeys = [ mossnet helix helix2 ];
|
||||||
"woodpecker-server-secrets.age".publicKeys = [ helix ];
|
"box-wg.age".publicKeys = [ mossnet ];
|
||||||
"gitea-dbpass.age".publicKeys = [ helix ];
|
"wallabag-password.age".publicKeys = [ mossnet ];
|
||||||
|
"wallabag-secret.age".publicKeys = [ mossnet ];
|
||||||
}
|
}
|
||||||
|
|
Binary file not shown.
Binary file not shown.
Loading…
Reference in a new issue