Compare commits
38 commits
38a4c41a1f
...
0e7cacc12b
Author | SHA1 | Date | |
---|---|---|---|
0e7cacc12b | |||
3b1aa44e63 | |||
99a14250f0 | |||
c751f0f6d1 | |||
5a2f0dc43b | |||
ba2d0c4917 | |||
8c3924d942 | |||
da8e4b25eb | |||
a6980a1b74 | |||
984d29ee2b | |||
aa97bc3618 | |||
2b211cc29d | |||
7ef8033b53 | |||
9ca6e47078 | |||
ad7bd1ebbb | |||
9012e55951 | |||
b3cdb97335 | |||
52c76af334 | |||
4dc773f2ce | |||
9723f79d24 | |||
03b1edc941 | |||
16c975db35 | |||
11e36c5082 | |||
fe806757d2 | |||
6fafa22851 | |||
8ce0eca9af | |||
71f417b250 | |||
d50510a8aa | |||
90c62bcd39 | |||
658ecc4c7b | |||
cf2f8b40eb | |||
793604b9de | |||
05038f2001 | |||
55c47ec2aa | |||
f8f8995c30 | |||
66b0a3db70 | |||
e45f12ddf6 | |||
a377eb2f69 |
|
@ -4,6 +4,27 @@ var REG_NONE = NewRegistrar('none'); // No registrar.
|
|||
var DNS_BIND = NewDnsProvider('bind'); // ISC BIND.
|
||||
var DNS_HEDNS = NewDnsProvider('hedns');
|
||||
|
||||
D("lakhwara.com", REG_NONE,
|
||||
DnsProvider(DNS_HEDNS),
|
||||
DefaultTTL(86400),
|
||||
//SOA('@', 'ns1.he.net.', 'hostmaster.he.net.', 2022041702, 86400, 7200, 3600000, 86400, TTL(172800)),
|
||||
A('anish', '103.16.130.98'),
|
||||
A('coaching', '103.16.130.98'),
|
||||
TXT('anish', 'datkey=dat://1a240a14fab2bae9c85ebad29bddc04505aaba24e5fb809c2ccb4cdf71e3a7d5'),
|
||||
CNAME('fm1._domainkey', 'fm1.lakhwara.com.dkim.fmhosted.com.'),
|
||||
CNAME('fm2._domainkey', 'fm2.lakhwara.com.dkim.fmhosted.com.'),
|
||||
CNAME('fm3._domainkey', 'fm3.lakhwara.com.dkim.fmhosted.com.'),
|
||||
A('@', '103.16.130.98'),
|
||||
MX('@', 10, 'in1-smtp.messagingengine.com.'),
|
||||
MX('@', 20, 'in2-smtp.messagingengine.com.'),
|
||||
//NAMESERVER('ns1.he.net.'),
|
||||
//NAMESERVER('ns2.he.net.'),
|
||||
//NAMESERVER('ns3.he.net.'),
|
||||
//NAMESERVER('ns4.he.net.'),
|
||||
//NAMESERVER('ns5.he.net.'),
|
||||
TXT('@', 'v=spf1 include:spf.messagingengine.com ?all')
|
||||
)
|
||||
|
||||
D('sealight.xyz', REG_NONE, DnsProvider(DNS_HEDNS),
|
||||
DefaultTTL(86400),
|
||||
//SOA('@', 'ns1.he.net.', 'hostmaster.he.net.', 2022121008, 86400, 7200, 3600000, 172800, TTL(172800)),
|
||||
|
@ -13,11 +34,11 @@ D('sealight.xyz', REG_NONE, DnsProvider(DNS_HEDNS),
|
|||
//NAMESERVER('ns4.he.net.'),
|
||||
//NAMESERVER('ns5.he.net.'),
|
||||
// capsul: helix
|
||||
A('bridge', '69.61.38.225', TTL(300)),
|
||||
A('rss', '69.61.38.225', TTL(300)),
|
||||
A('git', '69.61.38.225', TTL(300)),
|
||||
A('bin', '69.61.38.225', TTL(300)),
|
||||
A('ci', '69.61.38.225', TTL(300)),
|
||||
A('bridge', '69.61.2.203', TTL(300)),
|
||||
A('rss', '69.61.2.203', TTL(300)),
|
||||
A('git', '69.61.2.203', TTL(300)),
|
||||
A('bin', '69.61.2.203', TTL(300)),
|
||||
A('ci', '69.61.2.203', TTL(300)),
|
||||
// vultr -> nulled: lituus
|
||||
A('@', '45.77.48.108', TTL(300)),
|
||||
A('jitsi', '45.77.48.108', TTL(300)),
|
||||
|
|
22
dns/zones/lakhwara.com.zone
Normal file
22
dns/zones/lakhwara.com.zone
Normal file
|
@ -0,0 +1,22 @@
|
|||
; lakhwara.com Dumped Sun May 28 22:30:02 2023
|
||||
;
|
||||
lakhwara.com. 172800 IN SOA ns1.he.net. hostmaster.he.net. (
|
||||
2022041702 ;serial
|
||||
86400 ;refresh
|
||||
7200 ;retry
|
||||
3600000 ;expire
|
||||
86400 ) ;minimum
|
||||
anish.lakhwara.com. 86400 IN A 103.16.130.98
|
||||
anish.lakhwara.com. 86400 IN TXT datkey=dat://1a240a14fab2bae9c85ebad29bddc04505aaba24e5fb809c2ccb4cdf71e3a7d5
|
||||
fm1._domainkey.lakhwara.com. 86400 IN CNAME fm1.lakhwara.com.dkim.fmhosted.com.
|
||||
fm2._domainkey.lakhwara.com. 86400 IN CNAME fm2.lakhwara.com.dkim.fmhosted.com.
|
||||
fm3._domainkey.lakhwara.com. 86400 IN CNAME fm3.lakhwara.com.dkim.fmhosted.com.
|
||||
lakhwara.com. 86400 IN A 103.16.130.98
|
||||
lakhwara.com. 86400 IN MX 10 in1-smtp.messagingengine.com.
|
||||
lakhwara.com. 86400 IN MX 20 in2-smtp.messagingengine.com.
|
||||
lakhwara.com. 86400 IN NS ns1.he.net.
|
||||
lakhwara.com. 86400 IN NS ns2.he.net.
|
||||
lakhwara.com. 86400 IN NS ns3.he.net.
|
||||
lakhwara.com. 86400 IN NS ns4.he.net.
|
||||
lakhwara.com. 86400 IN NS ns5.he.net.
|
||||
lakhwara.com. 86400 IN TXT "v=spf1 include:spf.messagingengine.com ?all"
|
51
flake.lock
51
flake.lock
|
@ -77,11 +77,11 @@
|
|||
"utils": "utils"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1674127017,
|
||||
"narHash": "sha256-QO1xF7stu5ZMDLbHN30LFolMAwY6TVlzYvQoUs1RD68=",
|
||||
"lastModified": 1683779844,
|
||||
"narHash": "sha256-sIeOU0GsCeQEn5TpqE/jFRN4EGsPsjqVRsPdrzIDABM=",
|
||||
"owner": "serokell",
|
||||
"repo": "deploy-rs",
|
||||
"rev": "8c9ea9605eed20528bf60fae35a2b613b901fd77",
|
||||
"rev": "c80189917086e43d49eece2bd86f56813500a0eb",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
|
@ -122,6 +122,26 @@
|
|||
"type": "github"
|
||||
}
|
||||
},
|
||||
"disko": {
|
||||
"inputs": {
|
||||
"nixpkgs": [
|
||||
"nixpkgs"
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1684783210,
|
||||
"narHash": "sha256-hxRbwwBTu1G1u1EdI9nEo/n4HIsQIfNi+2BQ1nEoj/o=",
|
||||
"owner": "nix-community",
|
||||
"repo": "disko",
|
||||
"rev": "f0b9f374bb42fdcd57baa7d4448ac5d4788226bd",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "nix-community",
|
||||
"repo": "disko",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"eww": {
|
||||
"inputs": {
|
||||
"flake-compat": "flake-compat_2",
|
||||
|
@ -459,6 +479,7 @@
|
|||
"agenix": "agenix",
|
||||
"basant": "basant",
|
||||
"deploy-rs": "deploy-rs",
|
||||
"disko": "disko",
|
||||
"eww": "eww",
|
||||
"grasp": "grasp",
|
||||
"hardware": "hardware",
|
||||
|
@ -471,7 +492,8 @@
|
|||
"poonam": "poonam",
|
||||
"rust-overlay": "rust-overlay",
|
||||
"tidalcycles": "tidalcycles",
|
||||
"unstable": "unstable"
|
||||
"unstable": "unstable",
|
||||
"vimwikicli": "vimwikicli"
|
||||
}
|
||||
},
|
||||
"rust-overlay": {
|
||||
|
@ -655,6 +677,27 @@
|
|||
"url": "ssh://gitea@git.sealight.xyz/aynish/vimwiki-cli"
|
||||
}
|
||||
},
|
||||
"vimwikicli": {
|
||||
"inputs": {
|
||||
"nixpkgs": [
|
||||
"nixpkgs"
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1662448409,
|
||||
"narHash": "sha256-Xd8CuFcEpEQK/TjNBXcp1HqPJCc7LwkMqKa1WiAP1Zc=",
|
||||
"ref": "main",
|
||||
"rev": "a73c4695cf116c2e8194a5caa837c2f9e1a7e2fb",
|
||||
"revCount": 7,
|
||||
"type": "git",
|
||||
"url": "ssh://gitea@git.sealight.xyz/aynish/vimwiki-cli"
|
||||
},
|
||||
"original": {
|
||||
"ref": "main",
|
||||
"type": "git",
|
||||
"url": "ssh://gitea@git.sealight.xyz/aynish/vimwiki-cli"
|
||||
}
|
||||
},
|
||||
"vowel-src": {
|
||||
"flake": false,
|
||||
"locked": {
|
||||
|
|
22
flake.nix
22
flake.nix
|
@ -17,17 +17,23 @@
|
|||
agenix.inputs.nixpkgs.follows = "nixpkgs";
|
||||
deploy-rs.url = "github:serokell/deploy-rs";
|
||||
deploy-rs.inputs.nixpkgs.follows = "nixpkgs";
|
||||
disko.url = "github:nix-community/disko";
|
||||
disko.inputs.nixpkgs.follows = "nixpkgs";
|
||||
|
||||
# Packages
|
||||
# My Packages
|
||||
poonam.url = "git+ssh://gitea@git.sealight.xyz/aynish/kitaab?ref=main";
|
||||
poonam.inputs.nixpkgs.follows = "nixpkgs";
|
||||
basant.url = "git+ssh://gitea@git.sealight.xyz/aynish/basant?ref=main";
|
||||
vimwikicli.url = "git+ssh://gitea@git.sealight.xyz/aynish/vimwiki-cli?ref=main";
|
||||
basant.inputs.nixpkgs.follows = "nixpkgs";
|
||||
basant.inputs.poonam.follows = "poonam";
|
||||
vimwikicli.inputs.nixpkgs.follows = "nixpkgs";
|
||||
grasp.url = "git+ssh://gitea@git.sealight.xyz/aynish/grasp.git?ref=main";
|
||||
grasp.inputs.nixpkgs.follows = "nixpkgs";
|
||||
|
||||
# Matrix
|
||||
nix-matrix-appservices.url = "gitlab:coffeetables/nix-matrix-appservices";
|
||||
|
||||
# Others
|
||||
nur.url = "github:nix-community/NUR";
|
||||
rust-overlay = {
|
||||
|
@ -60,6 +66,7 @@
|
|||
, home-manager
|
||||
, deploy-rs
|
||||
, agenix
|
||||
, disko
|
||||
, basant
|
||||
, grasp
|
||||
, nix-matrix-appservices
|
||||
|
@ -68,6 +75,7 @@
|
|||
, rust-overlay
|
||||
, eww
|
||||
, llamacpp
|
||||
, vimwikicli
|
||||
, ...
|
||||
}@inputs:
|
||||
let
|
||||
|
@ -86,6 +94,9 @@
|
|||
llamaOverlay = final: prev: {
|
||||
llama = llamacpp.packages.${prev.system}.default;
|
||||
};
|
||||
vimwikiOverlay = final: prev: {
|
||||
vimwiki-cli = vimwikicli.packages.${prev.system}.vimwiki-cli;
|
||||
};
|
||||
|
||||
nixpkgsFor = forAllSystems (system: import nixpkgs {
|
||||
inherit system;
|
||||
|
@ -106,6 +117,8 @@
|
|||
nur.overlay
|
||||
nix-matrix-appservices.overlay
|
||||
unstableOverlay
|
||||
llamaOverlay
|
||||
vimwikiOverlay
|
||||
self.overlays.additions
|
||||
self.overlays.modifications
|
||||
];
|
||||
|
@ -175,6 +188,7 @@
|
|||
self.nixosModules.backup
|
||||
self.nixosModules.wireguard
|
||||
self.nixosModules.microbin
|
||||
disko.nixosModules.disko
|
||||
];
|
||||
};
|
||||
|
||||
|
@ -222,6 +236,7 @@
|
|||
self.nixosModules.wallabag
|
||||
self.nixosModules.gonic
|
||||
self.nixosModules.ulogger-server
|
||||
self.nixosModules.photoprism
|
||||
grasp.nixosModule
|
||||
home-manager.nixosModules.home-manager
|
||||
{
|
||||
|
@ -249,6 +264,7 @@
|
|||
deploy.nodes = {
|
||||
box = {
|
||||
hostname = "mossnet.lan";
|
||||
autoRollback = false;
|
||||
profiles.system = {
|
||||
user = "root";
|
||||
path = deploy-rs.lib.x86_64-linux.activate.nixos self.nixosConfigurations.box;
|
||||
|
@ -256,7 +272,7 @@
|
|||
};
|
||||
lituus = {
|
||||
hostname = "sealight.xyz";
|
||||
autoRollback = false;
|
||||
# autoRollback = false;
|
||||
profiles.system = {
|
||||
user = "root";
|
||||
path = deploy-rs.lib.x86_64-linux.activate.nixos self.nixosConfigurations.lituus;
|
||||
|
@ -264,7 +280,7 @@
|
|||
};
|
||||
helix = {
|
||||
hostname = "git.sealight.xyz";
|
||||
# autoRollback = false;
|
||||
autoRollback = false;
|
||||
profiles.system = {
|
||||
user = "root";
|
||||
path = deploy-rs.lib.x86_64-linux.activate.nixos self.nixosConfigurations.helix;
|
||||
|
|
|
@ -6,5 +6,6 @@
|
|||
../profiles/desktop
|
||||
../profiles/email
|
||||
../profiles/cal
|
||||
../profiles/sync/kitaab
|
||||
];
|
||||
}
|
||||
|
|
5
home/profiles/cli/bin/clear-vim-trash.sh
Executable file
5
home/profiles/cli/bin/clear-vim-trash.sh
Executable file
|
@ -0,0 +1,5 @@
|
|||
#!/usr/bin/env bash
|
||||
|
||||
working_directory=$(pwd)
|
||||
vim_directory="${working_directory//\//%}.vim"
|
||||
trash "$HOME/.local/share/nvim/sessions/${vim_directory}"
|
|
@ -58,6 +58,8 @@
|
|||
fontconfig
|
||||
pandoc
|
||||
taskwarrior-tui
|
||||
python3Packages.howdoi
|
||||
vimwiki-cli
|
||||
|
||||
(pkgs.writeScriptBin "jq-repl" ''
|
||||
#!/usr/bin/env bash
|
||||
|
@ -71,6 +73,7 @@
|
|||
|
||||
echo "" \ | fzf --phony --preview-window="up:90%" --print-query --preview "jq --color-output -r {q} $input"
|
||||
'')
|
||||
(pkgs.writeScriptBin "clear-vim-trash" (builtins.readFile ./bin/clear-vim-trash.sh))
|
||||
(pkgs.writeScriptBin "flakify" ''
|
||||
#!/usr/bin/env zsh
|
||||
if [ ! -e flake.nix ]; then
|
||||
|
@ -212,6 +215,7 @@
|
|||
kr = "cd /home/anish/kitaab/vimwiki; exa --sort=modified --reverse | fzf --preview 'bat --style=numbers --color=always --terminal-width -1 ./{}'";
|
||||
icat = "kitty +kitten icat";
|
||||
yt = "ytfzf -T kitty -t ";
|
||||
gen-secret = "< /dev/urandom tr -dc _A-Z-a-z-0-9 | head -c\${1:-32};echo;";
|
||||
|
||||
# modern cli tools
|
||||
ls = "exa --icons";
|
||||
|
@ -294,7 +298,7 @@
|
|||
jtl = "journalctl";
|
||||
|
||||
# quick ssh
|
||||
kssh = "kitten +kitty ssh";
|
||||
kssh = "kitty +kitten ssh";
|
||||
smm = "ssh 10.0.69.4"; # box over wireguard
|
||||
sm = "ssh mossnet.lan"; # box regular
|
||||
sl = "ssh sealight.xyz"; # lituus
|
||||
|
|
|
@ -33,6 +33,21 @@ in
|
|||
termpdfpy
|
||||
];
|
||||
|
||||
xdg.desktopEntries = {
|
||||
ocr = {
|
||||
name = "OCR image";
|
||||
exec = "${pkgs.writeScript "ocr" ''
|
||||
${pkgs.xfce.xfce4-screenshooter}/bin/xfce4-screenshooter -r --save /tmp/ocr-tmp.png
|
||||
${pkgs.tesseract}/bin/tesseract /tmp/ocr-tmp.png | ${pkgs.xclip}/bin/xclip -sel clip
|
||||
rm /tmp/ocr-tmp.png
|
||||
''}";
|
||||
};
|
||||
screenshot = {
|
||||
name = "Screenshot";
|
||||
exec = "screenshot";
|
||||
};
|
||||
};
|
||||
|
||||
# set up env
|
||||
xsession.enable = true;
|
||||
|
||||
|
|
|
@ -6,6 +6,7 @@ bold_italic_font auto
|
|||
open_url_with default
|
||||
mouse_map left click ungrabbed mouse_click_url_or_select
|
||||
confirm_os_window_close 0
|
||||
enable_bell_audio no
|
||||
-- Allows zen-mode.nvim to increase font size
|
||||
-- allow_remote_control socket-only
|
||||
-- listen_on unix:/tmp/kitty
|
||||
|
|
32
home/profiles/sync/kitaab/default.nix
Normal file
32
home/profiles/sync/kitaab/default.nix
Normal file
|
@ -0,0 +1,32 @@
|
|||
{ pkgs, ... }:
|
||||
|
||||
let
|
||||
name = "kitaab-sync";
|
||||
# Note this will fail if index.wiki is open in vim while this runs
|
||||
mkStartScript = name: pkgs.writeShellScript "${name}.sh" ''
|
||||
set -euo pipefail
|
||||
PATH=/run/current-system/sw/bin:/etc/profiles/per-user/anish/bin:
|
||||
cd /home/anish/kitaab
|
||||
vimwiki tags rebuild
|
||||
git add -A
|
||||
git diff-index --quiet HEAD || git commit -m 'syncing kitaab' # if nothing, don't exit 1
|
||||
git push
|
||||
exit 0
|
||||
'';
|
||||
in
|
||||
{
|
||||
systemd.user.services.kitaab-sync = {
|
||||
Service = {
|
||||
ExecStart = "${mkStartScript name}";
|
||||
};
|
||||
};
|
||||
systemd.user.timers.kitaab-sync = {
|
||||
Install = {
|
||||
WantedBy = [ "timers.target" ];
|
||||
PartOf = [ "kitaab-sync.service" ];
|
||||
};
|
||||
Timer = {
|
||||
OnCalendar = [ "hourly" ];
|
||||
};
|
||||
};
|
||||
}
|
|
@ -24,13 +24,14 @@
|
|||
../profiles/woodpecker-agent
|
||||
../profiles/jellyfin
|
||||
../profiles/ulogger-server
|
||||
../profiles/photoprism
|
||||
];
|
||||
|
||||
# Backups
|
||||
age.secrets.borg-password.file = "${self}/secrets/borg-password.age";
|
||||
services.postgresqlBackup = {
|
||||
enable = true;
|
||||
databases = [ "wallabag" ];
|
||||
databases = [ "wallabag" "photoprism" "ulogger" ];
|
||||
location = "/var/backup/postgresql";
|
||||
};
|
||||
mossnet.backup = {
|
||||
|
@ -52,6 +53,7 @@
|
|||
|
||||
age.secrets.box-wg.file = "${self}/secrets/box-wg.age";
|
||||
age.secrets.box-wg.owner = "anish";
|
||||
age.secrets.borg-key.file = "${self}/secrets/borg-key.age";
|
||||
mossnet.wg = {
|
||||
enable = true;
|
||||
ips = [ "10.0.69.4/24" ];
|
||||
|
|
|
@ -6,4 +6,11 @@
|
|||
../profiles/server
|
||||
../profiles/site
|
||||
];
|
||||
|
||||
services.nginx.enable = true;
|
||||
services.nginx.virtualHosts."coaching.lakhwara.com" = {
|
||||
forceSSL = true;
|
||||
enableACME = true;
|
||||
locations."/" = { root = "/var/lib/coaching"; index = "/index.html"; };
|
||||
};
|
||||
}
|
||||
|
|
|
@ -6,7 +6,6 @@
|
|||
../profiles/core
|
||||
../profiles/bluetooth
|
||||
../profiles/music
|
||||
../profiles/sync/kitaab
|
||||
../profiles/sync/cal
|
||||
../profiles/wifi
|
||||
../profiles/desktop
|
||||
|
@ -14,6 +13,7 @@
|
|||
../profiles/syncthing
|
||||
../profiles/mossnet-hosts
|
||||
../profiles/kuberenetes
|
||||
# ../profiles/mount-mossnet
|
||||
];
|
||||
|
||||
# home-manager.users.anish = import ../../home/gui;
|
||||
|
|
|
@ -1,10 +1,10 @@
|
|||
{ self, profiles, suites, ... }:
|
||||
{ self, profiles, suites, pkgs, ... }:
|
||||
{
|
||||
imports = [
|
||||
./configuration.nix
|
||||
../profiles/core
|
||||
../profiles/server
|
||||
../profiles/metrics
|
||||
# ../profiles/metrics
|
||||
../profiles/gitea
|
||||
../profiles/woodpecker-server
|
||||
../profiles/rss-bridge
|
||||
|
@ -19,10 +19,31 @@
|
|||
extraGroups = [ "wheel" ];
|
||||
};
|
||||
|
||||
age.secrets.helix-wg.file = "${self}/secrets/helix-wg.age";
|
||||
age.secrets.helix-wg.owner = "anish";
|
||||
mossnet.wg = {
|
||||
enable = true;
|
||||
ips = [ "10.0.69.5/24" ];
|
||||
privateKeyFile = "/home/anish/wg/wg-priv";
|
||||
privateKeyFile = "/run/agenix/helix-wg";
|
||||
};
|
||||
|
||||
services.postgresql.package = pkgs.postgresql_11;
|
||||
services.postgresqlBackup = {
|
||||
# TODO needs working wireguard to box
|
||||
enable = false;
|
||||
databases = [ "gitea" "freshrss" "woodpecker" ];
|
||||
location = "/mnt/two/postgres";
|
||||
};
|
||||
|
||||
mossnet.backup = {
|
||||
enable = true;
|
||||
name = "helix";
|
||||
paths = [
|
||||
"/var/lib/gitea"
|
||||
"/var/lib/freshrss"
|
||||
"/var/lib/woodpecker"
|
||||
"/var/lib/microbin"
|
||||
];
|
||||
|
||||
};
|
||||
}
|
||||
|
|
51
hosts/helix/disko.nix
Normal file
51
hosts/helix/disko.nix
Normal file
|
@ -0,0 +1,51 @@
|
|||
{ disks ? [ "/dev/vdb" ], ... }: {
|
||||
disko.devices = {
|
||||
disk = {
|
||||
vdb = {
|
||||
type = "disk";
|
||||
device = builtins.elemAt disks 0;
|
||||
content = {
|
||||
type = "table";
|
||||
format = "gpt";
|
||||
partitions = [
|
||||
{
|
||||
name = "ESP";
|
||||
start = "1MiB";
|
||||
end = "128MiB";
|
||||
fs-type = "fat32";
|
||||
bootable = true;
|
||||
content = {
|
||||
type = "filesystem";
|
||||
format = "vfat";
|
||||
mountpoint = "/boot";
|
||||
};
|
||||
}
|
||||
{
|
||||
name = "root";
|
||||
start = "128MiB";
|
||||
end = "100%";
|
||||
content = {
|
||||
type = "btrfs";
|
||||
extraArgs = [ "-f" ]; # Override existing partition
|
||||
subvolumes = {
|
||||
# Subvolume name is different from mountpoint
|
||||
"/rootfs" = {
|
||||
mountpoint = "/";
|
||||
};
|
||||
# Mountpoints inferred from subvolume name
|
||||
"/home" = {
|
||||
mountOptions = [ "compress=zstd" ];
|
||||
};
|
||||
"/nix" = {
|
||||
mountOptions = [ "compress=zstd" "noatime" ];
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
];
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
@ -5,23 +5,27 @@
|
|||
|
||||
{
|
||||
imports =
|
||||
[
|
||||
(modulesPath + "/profiles/qemu-guest.nix")
|
||||
[ (modulesPath + "/profiles/qemu-guest.nix")
|
||||
];
|
||||
|
||||
boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "sr_mod" "virtio_blk" ];
|
||||
boot.initrd.availableKernelModules = [ "ata_piix" "virtio_pci" "floppy" "sr_mod" "virtio_blk" ];
|
||||
boot.initrd.kernelModules = [ ];
|
||||
boot.kernelModules = [ ];
|
||||
boot.extraModulePackages = [ ];
|
||||
|
||||
fileSystems."/" =
|
||||
{
|
||||
device = "/dev/disk/by-uuid/3b8b2c4b-835e-4822-8ac8-0effdc8270d6";
|
||||
fsType = "btrfs";
|
||||
{ device = "/dev/disk/by-uuid/7c560634-d545-41cc-b375-42ce3037fd73";
|
||||
fsType = "ext4";
|
||||
};
|
||||
|
||||
swapDevices = [ ];
|
||||
|
||||
nix.settings.max-jobs = lib.mkDefault 1;
|
||||
nixpkgs.hostPlatform = "x86_64-linux";
|
||||
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
|
||||
# (the default) this is the recommended approach. When using systemd-networkd it's
|
||||
# still possible to use this option, but it's recommended to use it in conjunction
|
||||
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
|
||||
networking.useDHCP = lib.mkDefault true;
|
||||
# networking.interfaces.ens3.useDHCP = lib.mkDefault true;
|
||||
|
||||
hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
|
||||
}
|
||||
|
|
|
@ -4,7 +4,6 @@ in
|
|||
{
|
||||
imports = [ ../../users/anish ];
|
||||
|
||||
|
||||
fonts = {
|
||||
fonts = with pkgs; [ powerline-fonts dejavu_fonts ];
|
||||
fontconfig.defaultFonts = {
|
||||
|
|
|
@ -26,7 +26,6 @@ let
|
|||
"read.mossnet.lan"
|
||||
"stats.mossnet.lan"
|
||||
"music.mossnet.lan"
|
||||
"rss.mossnet.lan"
|
||||
"tasks.mossnet.lan"
|
||||
"file.mossnet.lan"
|
||||
"books.mossnet.lan"
|
||||
|
@ -36,6 +35,7 @@ let
|
|||
"archive.mossnet.lan"
|
||||
"tracks.mossnet.lan"
|
||||
"grasp.mossnet.lan"
|
||||
"photos.mossnet.lan"
|
||||
];
|
||||
in
|
||||
{
|
||||
|
@ -44,26 +44,31 @@ in
|
|||
settings = {
|
||||
server = {
|
||||
include = "${adblockLocalZones}";
|
||||
prefetch = "yes";
|
||||
# private-address = "10.0.69.0/8";
|
||||
# private-address = "192.168.1.0/24";
|
||||
cache-min-ttl = 0;
|
||||
serve-expired = "yes";
|
||||
interface = [ "0.0.0.0" ];
|
||||
access-control = [ "127.0.0.0/24 allow" "192.168.0.0/24 allow" "10.0.69.0/24 allow" ];
|
||||
access-control = [ "127.0.0.0/8 allow" "192.168.1.0/24 allow" "10.0.69.0/24 allow" ];
|
||||
access-control-view = "10.0.69.0/24 wireguard";
|
||||
# so-reuseport = "yes";
|
||||
tls-upstream = "yes";
|
||||
domain-insecure = "mossnet.lan";
|
||||
local-zone = ''"mossnet.lan." redirect'';
|
||||
local-data = ''"mossnet.lan. IN A ${mossnet}"'';
|
||||
};
|
||||
forward-zone = [{
|
||||
name = ".";
|
||||
forward-addr = [ "45.90.30.49" "45.90.28.49" "1.1.1.1" "8.8.8.8" ];
|
||||
forward-addr = [ "45.90.28.0#6939b9.dns.nextdns.io" "1.1.1.1@853#cloudflare-dns.com" ];
|
||||
# non-tls
|
||||
# forward-addr = ["45.90.30.49" "45.90.28.49" "1.1.1.1" "8.8.8.8"]
|
||||
}];
|
||||
view = {
|
||||
name = "wireguard";
|
||||
local-zone = ''"mossnet.lan." redirect'';
|
||||
local-data = ''"mossnet.lan. IN A ${wg-mossnet}"'';
|
||||
};
|
||||
do-not-query-localhost = "no";
|
||||
# Eventually we'll add DNSSEC / DoT
|
||||
# so-reuseport: yes
|
||||
# tls-cert-bundle: /etc/ssl/certs/ca-certificates.crt
|
||||
# tls-upstream: yes
|
||||
};
|
||||
};
|
||||
|
||||
|
|
|
@ -2,7 +2,7 @@
|
|||
|
||||
{
|
||||
services.paperless = {
|
||||
enable = true;
|
||||
enable = false;
|
||||
consumptionDirIsPublic = true;
|
||||
extraConfig.PAPERLESS_AUTO_LOGIN_USERNAME = "admin";
|
||||
};
|
||||
|
@ -18,6 +18,7 @@
|
|||
path = [
|
||||
pkgs.fava
|
||||
];
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
before = [ "nginx.service" ];
|
||||
serviceConfig = {
|
||||
User = "anish";
|
||||
|
|
|
@ -17,7 +17,6 @@
|
|||
|
||||
services.postgresql = {
|
||||
enable = true; # Ensure postgresql is enabled
|
||||
package = pkgs.postgresql_11;
|
||||
authentication = ''
|
||||
local freshrss all ident map=freshrss-users
|
||||
'';
|
||||
|
@ -26,8 +25,11 @@
|
|||
freshrss-users freshrss freshrss
|
||||
'';
|
||||
ensureDatabases = [ "freshrss" ];
|
||||
ensureUsers = [
|
||||
{ name = "freshrss"; ensurePermissions."DATABASE freshrss" = "ALL PRIVILEGES"; }
|
||||
];
|
||||
# TODO
|
||||
# initialScript # set password for gitea user
|
||||
# initialScript # set password for freshrss user
|
||||
};
|
||||
|
||||
services.nginx.virtualHosts."rss.sealight.xyz" = {
|
||||
|
|
|
@ -22,19 +22,21 @@
|
|||
repository = {
|
||||
DEFAULT_BRANCH = "main";
|
||||
};
|
||||
# TODO
|
||||
"markup.restructuredtext" = {
|
||||
ENABLED = true;
|
||||
FILE_EXTENSIONS = ".rst";
|
||||
RENDER_COMMAND = "pandoc +RTS -M512M -RTS -f rst";
|
||||
RENDER_COMMAND = "timeout 30s pandoc +RTS -RTS -f rst";
|
||||
IS_INPUT_FILE = false;
|
||||
};
|
||||
# TODO
|
||||
mailer = {
|
||||
ENABLED = false;
|
||||
ENABLED = true;
|
||||
MAILER_TYPE = "smtp";
|
||||
FROM = "ops@sealight.xyz";
|
||||
SENDMAIL_PATH = "${pkgs.system-sendmail}/bin/sendmail";
|
||||
SMTP_ADDR = "smtp.nullhex.com";
|
||||
SMTP_PORT = "465";
|
||||
USER = "ops@sealight.xyz";
|
||||
PASSWD = "breed deputy fossil glory"; # TODO how do we pass this from agenix?
|
||||
IS_TLS_ENABLED = "true";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
@ -49,7 +51,7 @@
|
|||
''
|
||||
gitea-users gitea gitea
|
||||
'';
|
||||
# ensureDatabases = [ "gitea" ];
|
||||
ensureDatabases = [ "gitea" ];
|
||||
ensureUsers = [
|
||||
{ name = "gitea"; ensurePermissions."DATABASE gitea" = "ALL PRIVILEGES"; }
|
||||
];
|
||||
|
@ -71,6 +73,4 @@
|
|||
};
|
||||
};
|
||||
networking.firewall.allowedTCPPorts = [ 80 443 22 ];
|
||||
security.acme.defaults.email = "anish+acme@lakhwara.com";
|
||||
security.acme.acceptTerms = true;
|
||||
}
|
||||
|
|
|
@ -3,7 +3,7 @@
|
|||
{
|
||||
# k3s
|
||||
networking.firewall.allowedTCPPorts = [ 6443 ];
|
||||
services.k3s.enable = true;
|
||||
services.k3s.enable = false;
|
||||
services.k3s.role = "server";
|
||||
services.k3s.clusterInit = true;
|
||||
# services.k3s.extraFlags = toString [
|
||||
|
@ -15,6 +15,6 @@
|
|||
virtualisation.docker.enable = true;
|
||||
virtualisation.docker.storageDriver = "btrfs";
|
||||
# or use kvm
|
||||
#virtualisation.libvrt.enable = true;
|
||||
users.users.anish.extraGroups = [ "docker" ]; # "libvert"
|
||||
virtualisation.libvirtd.enable = true;
|
||||
users.users.anish.extraGroups = [ "docker" "libvert" ]; #
|
||||
}
|
||||
|
|
|
@ -1,25 +1,49 @@
|
|||
{ self, config, pkgs, ... }: {
|
||||
age.secrets.nullhex-smtp.file = "${self}/secrets/nullhex-smtp.age";
|
||||
age.secrets.nullhex-smtp.owner = "grafana";
|
||||
|
||||
# grafana configuration
|
||||
services.grafana = {
|
||||
enable = true;
|
||||
settings.server = {
|
||||
settings = {
|
||||
smtp = {
|
||||
enabled = true;
|
||||
password = "$__file{/run/agenix/nullhex-smtp}";
|
||||
host = "smtp.nullhex.com";
|
||||
user = "ops@sealight.xyz";
|
||||
from_address = "ops@sealight.xyz";
|
||||
};
|
||||
server = {
|
||||
domain = "stats.mossnet.lan";
|
||||
http_port = 2342;
|
||||
http_addr = "127.0.0.1";
|
||||
http_port = 2342;
|
||||
root_url = "http://stats.mossnet.lan/";
|
||||
};
|
||||
};
|
||||
# TODO enable
|
||||
# provision.alerting.rules.path = "${self}/hosts/profiles/monitoring/alert-rules.yaml";
|
||||
};
|
||||
|
||||
# nginx reverse proxy
|
||||
services.nginx.recommendedProxySettings = true; # Needed for new grafana versions
|
||||
services.nginx.virtualHosts.${config.services.grafana.domain} = {
|
||||
# services.nginx.recommendedProxySettings = true; # Needed for new grafana versions
|
||||
services.nginx.virtualHosts.${config.services.grafana.settings.server.domain} = {
|
||||
locations."/" = {
|
||||
proxyPass = "http://127.0.0.1:${toString config.services.grafana.port}";
|
||||
proxyPass = "http://127.0.0.1:2342";
|
||||
proxyWebsockets = true;
|
||||
};
|
||||
};
|
||||
|
||||
services.postgresql = {
|
||||
ensureUsers = [{
|
||||
name = "grafana";
|
||||
ensurePermissions = {
|
||||
"DATABASE wallabag" = "SELECT";
|
||||
"DATABASE ulogger" = "SELECT";
|
||||
"DATABASE photoprism" = "SELECT";
|
||||
};
|
||||
}];
|
||||
};
|
||||
|
||||
services.prometheus = {
|
||||
enable = true;
|
||||
port = 9001;
|
||||
|
|
|
@ -13,6 +13,9 @@
|
|||
192.168.1.240 books.mossnet.lan
|
||||
192.168.1.240 archive.mossnet.lan
|
||||
192.168.1.240 music.mossnet.lan
|
||||
192.168.1.240 tracks.mossnet.lan
|
||||
192.168.1.240 grasp.mossnet.lan
|
||||
192.168.1.240 photos.mossnet.lan
|
||||
'';
|
||||
# 10.0.69.4 mossnet.lan
|
||||
# 10.0.69.4 links.mossnet.lan
|
||||
|
|
48
hosts/profiles/photoprism/default.nix
Normal file
48
hosts/profiles/photoprism/default.nix
Normal file
|
@ -0,0 +1,48 @@
|
|||
{ self, pkgs, config, lib, ... }:
|
||||
|
||||
{
|
||||
services.postgresql = {
|
||||
enable = true;
|
||||
ensureDatabases = [ "photoprism" ];
|
||||
ensureUsers = [{
|
||||
name = "photoprism";
|
||||
ensurePermissions = {
|
||||
"DATABASE photoprism" = "ALL PRIVILEGES";
|
||||
};
|
||||
}];
|
||||
};
|
||||
|
||||
services.photoprism = {
|
||||
enable = true;
|
||||
package = pkgs.unstable.photoprism;
|
||||
port = 5152;
|
||||
originalsPath = "/var/lib/private/photoprism/originals";
|
||||
address = "0.0.0.0";
|
||||
settings = {
|
||||
PHOTOPRISM_ADMIN_USER = "admin";
|
||||
PHOTOPRISM_ADMIN_PASSWORD = "photoprism"; # initial password, do change it!
|
||||
PHOTOPRISM_DEFAULT_LOCALE = "en";
|
||||
PHOTOPRISM_DATABASE_DRIVER = "postgres";
|
||||
PHOTOPRISM_DATABASE_NAME = "photoprism";
|
||||
PHOTOPRISM_DATABASE_SERVER = "/run/postgresql/";
|
||||
PHOTOPRISM_DATABASE_USER = "photoprism";
|
||||
PHOTOPRISM_SITE_URL = "http://photos.mossnet.lan/";
|
||||
PHOTOPRISM_SITE_TITLE = "mossnet photos";
|
||||
};
|
||||
};
|
||||
|
||||
services.nginx.clientMaxBodySize = "500m";
|
||||
services.nginx.recommendedProxySettings = true;
|
||||
services.nginx.virtualHosts."photos.mossnet.lan" = {
|
||||
enableACME = false;
|
||||
forceSSL = false;
|
||||
locations."/" = {
|
||||
extraConfig = ''
|
||||
proxy_pass http://localhost:5152/;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_buffering off;
|
||||
proxy_http_version 1.1;
|
||||
'';
|
||||
};
|
||||
};
|
||||
}
|
|
@ -1,27 +0,0 @@
|
|||
{ pkgs, ... }:
|
||||
|
||||
{
|
||||
systemd.services.kitaab-sync = {
|
||||
serviceConfig.Type = "oneshot";
|
||||
path = [
|
||||
pkgs.git
|
||||
pkgs.openssh
|
||||
pkgs.coreutils
|
||||
];
|
||||
script = ''
|
||||
cd /home/anish/kitaab
|
||||
git add -A
|
||||
git diff-index --quiet HEAD || git commit -m 'syncing kitaab' # if nothing, don't exit 1
|
||||
git push
|
||||
exit 0
|
||||
'';
|
||||
serviceConfig = {
|
||||
User = "anish";
|
||||
};
|
||||
};
|
||||
systemd.timers.kitaab-sync = {
|
||||
wantedBy = [ "timers.target" ];
|
||||
partOf = [ "kitaab-sync.service" ];
|
||||
timerConfig.OnCalendar = [ "hourly" ];
|
||||
};
|
||||
}
|
|
@ -36,6 +36,11 @@
|
|||
publicKey = "gcdq86hhEUlqF2chqYB/F8pALyAMNFvwLycxBoHuoDs=";
|
||||
allowedIPs = [ "10.0.69.5/32" ];
|
||||
}
|
||||
{
|
||||
# hyperplane
|
||||
publicKey = "";
|
||||
allowedIPs = [ "10.0.69.6/32" ];
|
||||
}
|
||||
];
|
||||
};
|
||||
}
|
||||
|
|
|
@ -52,7 +52,7 @@
|
|||
|
||||
"WOODPECKER_DATABASE_DATASOURCE=postgres:///woodpecker?host=/run/postgresql"
|
||||
"WOODPECKER_DATABASE_DRIVER=postgres"
|
||||
"WOODPECKER_USER_CREATE=username:aynish,admin:true" # set your admin username
|
||||
"WOODPECKER_ADMIN=aynish"
|
||||
];
|
||||
ExecStart = "${pkgs.woodpecker-server}/bin/woodpecker-server";
|
||||
User = "woodpecker";
|
||||
|
|
|
@ -10,4 +10,5 @@
|
|||
backup = import ./backup.nix;
|
||||
ulogger-server = import ./ulogger.nix;
|
||||
microbin = import ./microbin.nix;
|
||||
photoprism = import ./photoprism.nix; #TODO remove once updated to 23.05, stolen from nixpkgs anyway
|
||||
}
|
||||
|
|
|
@ -45,7 +45,7 @@ in
|
|||
after = [ "remote-fs.target" "network.target" ];
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
serviceConfig = {
|
||||
ExecStart = "${pkgs.unstable.microbin}/bin/microbin --public-path ${cfg.hostname} --qr --enable-burn-after --private";
|
||||
ExecStart = "${pkgs.unstable.microbin}/bin/microbin --public-path https://${cfg.hostname}/ --qr --enable-burn-after --private";
|
||||
Environment = [
|
||||
"MICROBIN_EDITABLE=true"
|
||||
"MICROBIN_HIDE_FOOTER=true"
|
||||
|
|
154
modules/nixos/photoprism.nix
Normal file
154
modules/nixos/photoprism.nix
Normal file
|
@ -0,0 +1,154 @@
|
|||
{ config, pkgs, lib, ... }:
|
||||
let
|
||||
cfg = config.services.photoprism;
|
||||
|
||||
env = {
|
||||
PHOTOPRISM_ORIGINALS_PATH = cfg.originalsPath;
|
||||
PHOTOPRISM_STORAGE_PATH = cfg.storagePath;
|
||||
PHOTOPRISM_IMPORT_PATH = cfg.importPath;
|
||||
PHOTOPRISM_HTTP_HOST = cfg.address;
|
||||
PHOTOPRISM_HTTP_PORT = toString cfg.port;
|
||||
} // (
|
||||
lib.mapAttrs (_: toString) cfg.settings
|
||||
);
|
||||
|
||||
manage =
|
||||
let
|
||||
setupEnv = lib.concatStringsSep "\n" (lib.mapAttrsToList (name: val: "export ${name}=${lib.escapeShellArg val}") env);
|
||||
in
|
||||
pkgs.writeShellScript "manage" ''
|
||||
${setupEnv}
|
||||
exec ${cfg.package}/bin/photoprism "$@"
|
||||
'';
|
||||
in
|
||||
{
|
||||
meta.maintainers = with lib.maintainers; [ stunkymonkey ];
|
||||
|
||||
options.services.photoprism = {
|
||||
|
||||
enable = lib.mkEnableOption (lib.mdDoc "Photoprism web server");
|
||||
|
||||
passwordFile = lib.mkOption {
|
||||
type = lib.types.nullOr lib.types.path;
|
||||
default = null;
|
||||
description = lib.mdDoc ''
|
||||
Admin password file.
|
||||
'';
|
||||
};
|
||||
|
||||
address = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "localhost";
|
||||
description = lib.mdDoc ''
|
||||
Web interface address.
|
||||
'';
|
||||
};
|
||||
|
||||
port = lib.mkOption {
|
||||
type = lib.types.port;
|
||||
default = 2342;
|
||||
description = lib.mdDoc ''
|
||||
Web interface port.
|
||||
'';
|
||||
};
|
||||
|
||||
originalsPath = lib.mkOption {
|
||||
type = lib.types.path;
|
||||
default = null;
|
||||
example = "/data/photos";
|
||||
description = lib.mdDoc ''
|
||||
Storage path of your original media files (photos and videos).
|
||||
'';
|
||||
};
|
||||
|
||||
importPath = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "import";
|
||||
description = lib.mdDoc ''
|
||||
Relative or absolute to the `originalsPath` from where the files should be imported.
|
||||
'';
|
||||
};
|
||||
|
||||
storagePath = lib.mkOption {
|
||||
type = lib.types.path;
|
||||
default = "/var/lib/photoprism";
|
||||
description = lib.mdDoc ''
|
||||
Location for sidecar, cache, and database files.
|
||||
'';
|
||||
};
|
||||
|
||||
package = lib.mkPackageOptionMD pkgs "photoprism" { };
|
||||
|
||||
settings = lib.mkOption {
|
||||
type = lib.types.attrsOf lib.types.str;
|
||||
default = { };
|
||||
description = lib.mdDoc ''
|
||||
See [the getting-started guide](https://docs.photoprism.app/getting-started/config-options/) for available options.
|
||||
'';
|
||||
example = {
|
||||
PHOTOPRISM_DEFAULT_LOCALE = "de";
|
||||
PHOTOPRISM_ADMIN_USER = "root";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
config = lib.mkIf cfg.enable {
|
||||
systemd.services.photoprism = {
|
||||
description = "Photoprism server";
|
||||
|
||||
serviceConfig = {
|
||||
Restart = "on-failure";
|
||||
User = "photoprism";
|
||||
Group = "photoprism";
|
||||
DynamicUser = true;
|
||||
StateDirectory = "photoprism";
|
||||
WorkingDirectory = "/var/lib/photoprism";
|
||||
RuntimeDirectory = "photoprism";
|
||||
|
||||
LoadCredential = lib.optionalString (cfg.passwordFile != null)
|
||||
"PHOTOPRISM_ADMIN_PASSWORD:${cfg.passwordFile}";
|
||||
|
||||
CapabilityBoundingSet = "";
|
||||
LockPersonality = true;
|
||||
PrivateDevices = true;
|
||||
PrivateUsers = true;
|
||||
ProtectClock = true;
|
||||
ProtectControlGroups = true;
|
||||
ProtectHome = true;
|
||||
ProtectHostname = true;
|
||||
ProtectKernelLogs = true;
|
||||
ProtectKernelModules = true;
|
||||
ProtectKernelTunables = true;
|
||||
RestrictAddressFamilies = [ "AF_UNIX" "AF_INET" "AF_INET6" ];
|
||||
RestrictNamespaces = true;
|
||||
RestrictRealtime = true;
|
||||
SystemCallArchitectures = "native";
|
||||
SystemCallFilter = [ "@system-service" "~@privileged @setuid @keyring" ];
|
||||
UMask = "0066";
|
||||
} // lib.optionalAttrs (cfg.port < 1024) {
|
||||
AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" ];
|
||||
CapabilityBoundingSet = [ "CAP_NET_BIND_SERVICE" ];
|
||||
};
|
||||
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
environment = env;
|
||||
|
||||
# reminder: easier password configuration will come in https://github.com/photoprism/photoprism/pull/2302
|
||||
preStart = ''
|
||||
ln -sf ${manage} photoprism-manage
|
||||
|
||||
${lib.optionalString (cfg.passwordFile != null) ''
|
||||
export PHOTOPRISM_ADMIN_PASSWORD=$(cat "$CREDENTIALS_DIRECTORY/PHOTOPRISM_ADMIN_PASSWORD")
|
||||
''}
|
||||
exec ${cfg.package}/bin/photoprism migrations run -f
|
||||
'';
|
||||
|
||||
script = ''
|
||||
${lib.optionalString (cfg.passwordFile != null) ''
|
||||
export PHOTOPRISM_ADMIN_PASSWORD=$(cat "$CREDENTIALS_DIRECTORY/PHOTOPRISM_ADMIN_PASSWORD")
|
||||
''}
|
||||
exec ${cfg.package}/bin/photoprism start
|
||||
'';
|
||||
};
|
||||
};
|
||||
}
|
Binary file not shown.
Binary file not shown.
|
@ -1,8 +1,10 @@
|
|||
age-encryption.org/v1
|
||||
-> ssh-ed25519 kgCrKA wILVHjLHNY2lAAWw6ENwYlRTRq6fWAO4ZHxd/BXDvg0
|
||||
DCIIBq++JSKzcFOJ51i0USitDOhK9R6NEsCilGlxKtA
|
||||
-> e-grease F
|
||||
cN5lygYFvScErf/J4BAEJ5ZkimpxOUj9gj8jGZV6Cl/RMkUThxflOfxz/OOBOK3V
|
||||
S/NBseDL2dg9XzIUY7k
|
||||
--- IIXSaSol3agW8SNwdOqxoV8dTkwW1CWxgJ8R3Blr1Sw
|
||||
Sャ゙ニモーyQェ>lュV,<2C>モR<EFBE93><52>5サS虍HP<48>`゚dニK6ルセ"u懌z)εL゚[゚ムWヒ<57>ハキKヌ
|
||||
-> ssh-ed25519 6DaCrw 1dgmzBJiOecaCLSJz1nrw3iTF9G00gIQd5hY6HXZKUI
|
||||
HVkZRyHiKJ2E/Wdgty/uMbPm6lNy9wgaGwe5EJcJ8jY
|
||||
-> ssh-ed25519 kgCrKA aQiYpgMLe9uSw7NB89mt3Gpa29RqZGHfnZzsOV8DaiM
|
||||
gcgFyaibNSL5/7ITddnryWFxOuCX22mtGY2e0uL8MEs
|
||||
-> zWZg=\-grease GP#:NZ \CW2nnR/ /k
|
||||
bMvg21MLLhnwNVSyNMvMZNT9MzyiT6UqLn3SJcxGtt3Eu9jcMAphAeGy7i+8pQbt
|
||||
9MnCFZBN4JG+ZunMtSQWodmOqiHFV1vKGsjqQboMsjMo
|
||||
--- glgRELYTsrSXv/SK/6RDso2FhnvfCT1TB3Ytz/AERPs
|
||||
Œô97£lÓ•¹b,!.L_M´Ÿ×C[Q…rúôZ<C3B4>škò…› s"Q+ÚC$ÜØ«Ï«ÍŽ<C38D>“"ëè…sRõ[
|
|
@ -1,8 +1,9 @@
|
|||
age-encryption.org/v1
|
||||
-> ssh-ed25519 kgCrKA /u5qYf6vYBVeJryLq2xvZHXk9LY2A8+ks/XV4C/fixw
|
||||
HNLXInIHa2d/CZR8/OwwhfLurpEbxiXca8Ip3kp/EWg
|
||||
-> s9b#/i%D-grease
|
||||
DtUrN1QNHQyj0mSiV9nAOBpjf1/3yxxV4E4Xxr0oR2kJa/VWvpIYzyReZdRpS5Xs
|
||||
Qf0Rw1HB9OAMAQ04DuR6FVfGYaGm
|
||||
--- WszM9cCBr4HW0I+HltsdXj/BCxUDMld4yAVzXVo1HLg
|
||||
4µEíŕÝľöGT/ĹCÁ°¸<C2B0>ŞBń’šrň©ř˘ŁXYëµW<C2B5>ŔfröĹý|e5÷÷}PÄ)
|
||||
-> ssh-ed25519 kgCrKA QpRQkobE13NxRH81V9tFP+HelBBp5KE2cTyOZIyKsVM
|
||||
hw3pwAfiQeVRqNwITHCKx8u2/aBtwdB24FJdexUfMyc
|
||||
-> ssh-ed25519 6DaCrw HjJO4lhmCmsRSD979Jva6UXIMCYqTzmkh7BX+GkbpiI
|
||||
8SyOm3HR23KfA4pz/fL8dwbvpyXQJRE9ymLMs1lFCBs
|
||||
-> P32-grease %>7>/d}-
|
||||
mB3N3P/0E4+1zo1l/cqSmqNqGBaDw2RrH4RC11GfZEmadA
|
||||
--- 2P5bd82ou+ey3DbL5QHZKQM13N4hqvmzS5D9eWkYw5o
|
||||
€Âµ®Üf»é2øGçèÅüqàà²Á›Ó<E280BA>;…f&aæYºG
õ•ˆ•ÎBòBüäÍû‹*Vz÷£lý
|
10
secrets/helix-wg.age
Normal file
10
secrets/helix-wg.age
Normal file
|
@ -0,0 +1,10 @@
|
|||
age-encryption.org/v1
|
||||
-> ssh-ed25519 6DaCrw igsyzrecx35FlTKXLg8msiM5mxT90UCBxty8lZwvelY
|
||||
379UsHnxI+mL+Its00WVznKnDkpGi+SMLFSaHkcCcjE
|
||||
-> ssh-ed25519 kgCrKA 7kGBgw8di49lYUYNLNq3PgVpoLpIvfDnGZbxipVUXXQ
|
||||
ZzY77hAJn8GiPwYT88XmYw+Qi/OTmE3pXsVrot6psOE
|
||||
-> Fgy[uTu-grease
|
||||
9Oo+QfjC+h8Wlm1UcN1KcEa5G9t8mw9UF0aoafJYQnGBwdJAY1UgDbNVIWb3j5yD
|
||||
EnIMAQ6RPEQtm9sXnDrY+f5A6vxNdYWMdSNUOcYi2In9Ux+Q9Us4d2A
|
||||
--- c3Sqf+zgIZpEQ59/pCBoKFCuwAUjPCzAFImZsZ9pqZc
|
||||
™°ÚÖ+ïƒGù[?<01>ÿ#<23>çk|}¡hn^Ô³lì!€_eÑ(ô™—ìFèôjÖ ²9•œ¿4OZžH¯Ý²˜žyÞ¬ËYl=®CwÊ4o_
|
14
secrets/nullhex-smtp.age
Normal file
14
secrets/nullhex-smtp.age
Normal file
|
@ -0,0 +1,14 @@
|
|||
age-encryption.org/v1
|
||||
-> ssh-ed25519 H6uv4Q k1/9tYh1a2JNaZCXB2RJgRA7hQ7vg0mE7B4a0lVCvW8
|
||||
y4aGbd1scFAMA6mQZv6lshDFR/7TsCHKC3NuOWmE1Ss
|
||||
-> ssh-ed25519 K2vF/Q Fqd9YCy61FlWmBiWXAJeJDAKeXtdDO9N5w0L2FBZGB0
|
||||
lj9yucjMsmBshHtpz6VqRRb/MA4+DKUM9jo1ixY59Dc
|
||||
-> ssh-ed25519 ntXL8g z+btuETbHoPe31h87MDOGM41vW3lq9xLIE1QU3EnME4
|
||||
BtQLF81szEiwmGVcxbdF7Ls0mrV9UUJbvZ4N9Zy6dG0
|
||||
-> ssh-ed25519 kgCrKA HFjfjTV8L6ftCuUh/fD+sGuJK0Ev++r2qyEqr+fTKmM
|
||||
/m+7SzjOI5nmt/V+hMau9Rfi9RIbbPNPFSuWxUvhkM4
|
||||
-> bN-grease }R]4T%[p
|
||||
6yeWs4CF8vqsnJ/l3DX9JKODjBv0gkc66HFmCoGKtDZCtfNWeO82CW6UE50MES5E
|
||||
lQL5woQJVXLL3HTIsNKbXeigjBZ1/SSksbMBGeeu/+DXkrUHdPo37pz/KcQ
|
||||
--- La4OQuTEE9G8czWAz8t1EhHNIa6rE7hoq3tckn6GxOo
|
||||
ý@ù<>.`ø¹¨Å´z8›ÔǬ};ÔŠK¯†<C2AF>G<[ÞdNpr¹ÄòùÞ ½ bßü.¯•¨³Ò
|
8
secrets/photoprism.age
Normal file
8
secrets/photoprism.age
Normal file
|
@ -0,0 +1,8 @@
|
|||
age-encryption.org/v1
|
||||
-> ssh-ed25519 K2vF/Q gbzVy3hrykVeOCwjPo6Ma8tTTemdtiRwAtX96cA2viE
|
||||
NFSztfWodmZ4TQFBMgx9e1U2ZO37Nt/MKJEYBBrICrA
|
||||
-> s.pLZ.|-grease %UVo!F YgUB rG`)8.@w
|
||||
pYerZHERVJx3dldU27I9vIxh5mizU4cW4F1QTRxk646K0abW7H6rqp6Qyr096fLF
|
||||
c9egbGKMJFNgWoXWaauMaGCAV2D8km5DHSWVoEMZVkskQSprSUWh
|
||||
--- SANH4pgKXob6sZ/jhnqkgXFC9QzVbI81HqxvwiayK2Y
|
||||
õÐ4¿ÆÝž•ë LªH²jæœ[§È˜p(löl@™GÊà¸ÍRƒr‰)P¤0Q?àG•®ÂaÜfú€ø»÷<>
|
|
@ -5,6 +5,7 @@ let
|
|||
mossnet = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAA0bsVbdQR6iWNLKIiID57A1+dVXC58Dtf5cSXg6/JF root@box";
|
||||
lituus = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIH2lAb33LH3JNuOfBXt971u0tHe+NURFecQdfjwEj+C+ root@lituus";
|
||||
helix = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAKrL6IDHNnHmxi0q9nzu87NOyidPm3HpE7klU368lEf root@helix";
|
||||
helix2 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIK2G81z1E51ioJQGLHnTJEjgSdBqLM6mb72Z+0atE6Bf root@helix";
|
||||
curve = [ system user ];
|
||||
allUserKeys = [ system user mossnet ];
|
||||
systemOnly = [ system mossnet lituus helix ];
|
||||
|
@ -14,20 +15,23 @@ in
|
|||
"fastmail.age".publicKeys = allUserKeys;
|
||||
"mossnet.age".publicKeys = allUserKeys;
|
||||
"curve-wg.age".publicKeys = curve;
|
||||
"box-wg.age".publicKeys = [ mossnet ];
|
||||
"wallabag-password.age".publicKeys = [ mossnet ];
|
||||
"wallabag-secret.age".publicKeys = [ mossnet ];
|
||||
|
||||
"nullhex-smtp.age".publicKeys = systemOnly;
|
||||
"borg-password.age".publicKeys = systemOnly;
|
||||
"borg-key.age".publicKeys = systemOnly;
|
||||
"freshrss-dbpass.age".publicKeys = [ helix ];
|
||||
|
||||
"helix-wg.age".publicKeys = [ helix2 helix ];
|
||||
"freshrss-dbpass.age".publicKeys = [ helix2 helix ];
|
||||
"woodpecker-server-secrets.age".publicKeys = [ helix2 helix ];
|
||||
"gitea-dbpass.age".publicKeys = [ helix helix2 ];
|
||||
|
||||
"synapse-config.age".publicKeys = [ lituus ];
|
||||
"synapse-database-password.age".publicKeys = [ lituus ];
|
||||
"sealight-mod-password.age".publicKeys = [ lituus ];
|
||||
"telegram-matrix-env.age".publicKeys = [ lituus ];
|
||||
|
||||
"wallabag.age".publicKeys = [ mossnet ];
|
||||
"woodpecker-agent-secret.age".publicKeys = [ mossnet helix ];
|
||||
"woodpecker-server-secrets.age".publicKeys = [ helix ];
|
||||
"gitea-dbpass.age".publicKeys = [ helix ];
|
||||
"woodpecker-agent-secret.age".publicKeys = [ mossnet helix helix2 ];
|
||||
"box-wg.age".publicKeys = [ mossnet ];
|
||||
"wallabag-password.age".publicKeys = [ mossnet ];
|
||||
"wallabag-secret.age".publicKeys = [ mossnet ];
|
||||
}
|
||||
|
|
Binary file not shown.
Binary file not shown.
Loading…
Reference in a new issue