Compare commits
27 commits
487800eba8
...
1461881cf8
Author | SHA1 | Date | |
---|---|---|---|
1461881cf8 | |||
3f1af8ca77 | |||
2368a1b6a6 | |||
63a18c2bc3 | |||
df629af5ab | |||
f374e8bd1f | |||
2a1f956227 | |||
110ba17935 | |||
41a64a3248 | |||
27138bdc7d | |||
6a8a4985df | |||
b6b7601a68 | |||
73f53bfd50 | |||
adf222b873 | |||
f140ebbda3 | |||
eef4f59aa6 | |||
2f940bc682 | |||
4856c4e2ca | |||
cc547e7da3 | |||
b595688a65 | |||
5f3d27695e | |||
c04d45ee80 | |||
b363fd3c9e | |||
ad7d63eea7 | |||
ac312637e7 | |||
f8acfda6e5 | |||
70e8fa79bd |
|
@ -16,6 +16,7 @@ D('sealight.xyz', REG_NONE, DnsProvider(DNS_HEDNS),
|
|||
A('bridge', '69.61.38.225', TTL(300)),
|
||||
A('rss', '69.61.38.225', TTL(300)),
|
||||
A('git', '69.61.38.225', TTL(300)),
|
||||
A('bin', '69.61.38.225', TTL(300)),
|
||||
A('ci', '69.61.38.225', TTL(300)),
|
||||
// vultr -> nulled: lituus
|
||||
A('@', '45.77.48.108', TTL(300)),
|
||||
|
|
50
flake.lock
50
flake.lock
|
@ -210,6 +210,21 @@
|
|||
}
|
||||
},
|
||||
"flake-utils_2": {
|
||||
"locked": {
|
||||
"lastModified": 1667395993,
|
||||
"narHash": "sha256-nuEHfE/LcWyuSWnS8t12N1wc105Qtau+/OdUAjtQ0rA=",
|
||||
"owner": "numtide",
|
||||
"repo": "flake-utils",
|
||||
"rev": "5aed5285a952e0b949eb3ba02c12fa4fcfef535f",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "numtide",
|
||||
"repo": "flake-utils",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"flake-utils_3": {
|
||||
"locked": {
|
||||
"lastModified": 1676283394,
|
||||
"narHash": "sha256-XX2f9c3iySLCw54rJ/CZs+ZK6IQy7GXNY4nSOyu2QG4=",
|
||||
|
@ -224,7 +239,7 @@
|
|||
"type": "github"
|
||||
}
|
||||
},
|
||||
"flake-utils_3": {
|
||||
"flake-utils_4": {
|
||||
"locked": {
|
||||
"lastModified": 1659877975,
|
||||
"narHash": "sha256-zllb8aq3YO3h8B/U0/J1WBgAL8EX5yWf5pMj3G0NAmc=",
|
||||
|
@ -239,6 +254,28 @@
|
|||
"type": "github"
|
||||
}
|
||||
},
|
||||
"grasp": {
|
||||
"inputs": {
|
||||
"flake-utils": "flake-utils_2",
|
||||
"nixpkgs": [
|
||||
"nixpkgs"
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1682644301,
|
||||
"narHash": "sha256-gMBFZLf41s3+cnhxgZVRvj2JSAFYv4jn2xBKwEESthE=",
|
||||
"ref": "main",
|
||||
"rev": "a2d85675b930ffc26f6891b2e14491795907be4e",
|
||||
"revCount": 137,
|
||||
"type": "git",
|
||||
"url": "ssh://gitea@git.sealight.xyz/aynish/grasp.git"
|
||||
},
|
||||
"original": {
|
||||
"ref": "main",
|
||||
"type": "git",
|
||||
"url": "ssh://gitea@git.sealight.xyz/aynish/grasp.git"
|
||||
}
|
||||
},
|
||||
"hardware": {
|
||||
"locked": {
|
||||
"lastModified": 1677232326,
|
||||
|
@ -277,7 +314,7 @@
|
|||
},
|
||||
"llamacpp": {
|
||||
"inputs": {
|
||||
"flake-utils": "flake-utils_2",
|
||||
"flake-utils": "flake-utils_3",
|
||||
"nixpkgs": [
|
||||
"unstable"
|
||||
]
|
||||
|
@ -423,6 +460,7 @@
|
|||
"basant": "basant",
|
||||
"deploy-rs": "deploy-rs",
|
||||
"eww": "eww",
|
||||
"grasp": "grasp",
|
||||
"hardware": "hardware",
|
||||
"home-manager": "home-manager",
|
||||
"llamacpp": "llamacpp",
|
||||
|
@ -438,7 +476,7 @@
|
|||
},
|
||||
"rust-overlay": {
|
||||
"inputs": {
|
||||
"flake-utils": "flake-utils_3",
|
||||
"flake-utils": "flake-utils_4",
|
||||
"nixpkgs": [
|
||||
"nixpkgs"
|
||||
]
|
||||
|
@ -519,11 +557,11 @@
|
|||
},
|
||||
"unstable": {
|
||||
"locked": {
|
||||
"lastModified": 1677063315,
|
||||
"narHash": "sha256-qiB4ajTeAOVnVSAwCNEEkoybrAlA+cpeiBxLobHndE8=",
|
||||
"lastModified": 1682268651,
|
||||
"narHash": "sha256-2eZriMhnD24Pmb8ideZWZDiXaAVe6LzJrHQiNPck+Lk=",
|
||||
"owner": "nixos",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "988cc958c57ce4350ec248d2d53087777f9e1949",
|
||||
"rev": "e78d25df6f1036b3fa76750ed4603dd9d5fe90fc",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
|
|
18
flake.nix
18
flake.nix
|
@ -24,8 +24,8 @@
|
|||
basant.url = "git+ssh://gitea@git.sealight.xyz/aynish/basant?ref=main";
|
||||
basant.inputs.nixpkgs.follows = "nixpkgs";
|
||||
basant.inputs.poonam.follows = "poonam";
|
||||
# grasp.url = "git+ssh://gitea@git.sealight.xyz/aynish/grasp.git?ref=main";
|
||||
# grasp.inputs.nixpkgs.follows = "nixpkgs";
|
||||
grasp.url = "git+ssh://gitea@git.sealight.xyz/aynish/grasp.git?ref=main";
|
||||
grasp.inputs.nixpkgs.follows = "nixpkgs";
|
||||
# Matrix
|
||||
nix-matrix-appservices.url = "gitlab:coffeetables/nix-matrix-appservices";
|
||||
# Others
|
||||
|
@ -61,7 +61,7 @@
|
|||
, deploy-rs
|
||||
, agenix
|
||||
, basant
|
||||
# , grasp
|
||||
, grasp
|
||||
, nix-matrix-appservices
|
||||
, nur
|
||||
, tidalcycles
|
||||
|
@ -116,6 +116,7 @@
|
|||
inherit system;
|
||||
overlays = [
|
||||
agenix.overlays.default
|
||||
unstableOverlay # Remove once updated to 23.05 (used for microbin on helix)
|
||||
tidalcycles.overlays.default # needed for nvim which comes pre-installed lol
|
||||
];
|
||||
});
|
||||
|
@ -167,18 +168,13 @@
|
|||
helix = nixpkgs.lib.nixosSystem rec {
|
||||
specialArgs = { inherit inputs self; };
|
||||
system = "x86_64-linux";
|
||||
pkgs = nixpkgsFor.${system};
|
||||
pkgs = litePkgsFor.${system};
|
||||
modules = [
|
||||
./hosts/helix
|
||||
agenix.nixosModules.age
|
||||
self.nixosModules.backup
|
||||
self.nixosModules.wireguard
|
||||
home-manager.nixosModules.home-manager
|
||||
{
|
||||
home-manager.useGlobalPkgs = true;
|
||||
home-manager.useUserPackages = true;
|
||||
home-manager.users.anish = import ./home/core;
|
||||
}
|
||||
self.nixosModules.microbin
|
||||
];
|
||||
};
|
||||
|
||||
|
@ -226,7 +222,7 @@
|
|||
self.nixosModules.wallabag
|
||||
self.nixosModules.gonic
|
||||
self.nixosModules.ulogger-server
|
||||
# grasp.nixosModule
|
||||
grasp.nixosModule
|
||||
home-manager.nixosModules.home-manager
|
||||
{
|
||||
home-manager.useGlobalPkgs = true;
|
||||
|
|
|
@ -299,5 +299,6 @@
|
|||
sm = "ssh mossnet.lan"; # box regular
|
||||
sl = "ssh sealight.xyz"; # lituus
|
||||
sh = "ssh git.sealight.xyz"; # helix
|
||||
sb = "ssh cyberian@69.61.38.246"; # bonfire for allwell
|
||||
};
|
||||
}
|
||||
|
|
1
home/profiles/desktop/bin/paste
Executable file
1
home/profiles/desktop/bin/paste
Executable file
|
@ -0,0 +1 @@
|
|||
curl -F "content=$(xclip -o)" -X POST https://bin.sealight.xyz/upload
|
|
@ -113,6 +113,7 @@ in
|
|||
'';
|
||||
# TODO hardcoded
|
||||
".local/bin/passmenu".source = ./bin/passmenu;
|
||||
".local/bin/paste".source = ./bin/paste;
|
||||
".local/bin/bluetoothmenu".source = ./bin/bluetoothmenu;
|
||||
".local/bin/wifimenu".source = ./bin/wifimenu;
|
||||
".local/bin/powermenu".source = ./bin/powermenu;
|
||||
|
|
|
@ -27,6 +27,9 @@ super + Tab
|
|||
super + e
|
||||
rofimoji --selector-args "-theme theme/emojimenu.rasi" --skin-tone moderate --action copy
|
||||
|
||||
super + a
|
||||
paste
|
||||
|
||||
super + p
|
||||
passmenu
|
||||
|
||||
|
|
|
@ -49,6 +49,7 @@
|
|||
".tmp"
|
||||
".direnv"
|
||||
"result"
|
||||
"node_modules/"
|
||||
];
|
||||
|
||||
extraConfig = {
|
||||
|
|
|
@ -151,6 +151,8 @@ in
|
|||
home.file.".config/nvim/after/syntax/vimwiki.vim".text = ''
|
||||
" match with %update
|
||||
syntax match VimwikiPlaceholder /^\s*%update\ze\%(\s.*\)\?$/ nextgroup=VimwikiPlaceholderParam skipwhite
|
||||
" match with %link
|
||||
syntax match VimwikiPlaceholder /^\s*%link\ze\%(\s.*\)\?$/ nextgroup=VimwikiPlaceholderParam skipwhite
|
||||
'';
|
||||
|
||||
#environment.systemPackages = with customPlugins; [ tidal ];
|
||||
|
|
|
@ -41,9 +41,9 @@ def write_note(task_id: int):
|
|||
time = datetime.datetime.now().strftime("%y-%m-%d %H:%M")
|
||||
|
||||
with open(notes_file, "w") as f:
|
||||
f.write(f"%title: {task_description}")
|
||||
f.write(f"%title {task_description}")
|
||||
f.write(f":task:{task_project}:{task_tags if len(task_tags) else ''}\n")
|
||||
f.write(f"%date: {time}\n\n")
|
||||
f.write(f"%date {time}\n\n")
|
||||
f.flush()
|
||||
|
||||
os.execlp(EDITOR, EDITOR, notes_file)
|
||||
|
|
|
@ -19,17 +19,13 @@
|
|||
../profiles/wallabag
|
||||
../profiles/finance
|
||||
../profiles/sync/website
|
||||
../profiles/grasp
|
||||
# ../profiles/archivebox
|
||||
../profiles/woodpecker-agent
|
||||
../profiles/jellyfin
|
||||
../profiles/ulogger-server
|
||||
];
|
||||
|
||||
# Something broke when manually updating grasp...
|
||||
# services.grasp.enable = true;
|
||||
# services.grasp.path = "/home/anish/kitaab/grasp/grasp.wiki";
|
||||
# services.grasp.user = "anish";
|
||||
|
||||
# Backups
|
||||
age.secrets.borg-password.file = "${self}/secrets/borg-password.age";
|
||||
services.postgresqlBackup = {
|
||||
|
|
|
@ -13,6 +13,7 @@
|
|||
../profiles/mimetypes
|
||||
../profiles/syncthing
|
||||
../profiles/mossnet-hosts
|
||||
../profiles/kuberenetes
|
||||
];
|
||||
|
||||
# home-manager.users.anish = import ../../home/gui;
|
||||
|
|
|
@ -10,6 +10,7 @@
|
|||
../profiles/rss-bridge
|
||||
../profiles/mount-mossnet
|
||||
../profiles/freshrss
|
||||
../profiles/microbin
|
||||
];
|
||||
|
||||
# Capsul specific
|
||||
|
|
|
@ -61,12 +61,11 @@ in
|
|||
};
|
||||
|
||||
environment.systemPackages = with pkgs; [
|
||||
unstable.signal-desktop # bridge to sealight?
|
||||
unstable.sublime-music
|
||||
unstable.nheko
|
||||
unstable.tootle
|
||||
newsflash
|
||||
liferea
|
||||
unstable.newsflash
|
||||
unstable.liferea
|
||||
|
||||
scrot
|
||||
ripcord
|
||||
|
|
|
@ -1,37 +1,76 @@
|
|||
{ config, pkgs, lib, ... }:
|
||||
{
|
||||
services.dnsmasq.enable = true;
|
||||
services.dnsmasq.extraConfig = ''
|
||||
domain-needed
|
||||
no-resolv
|
||||
local=/lan/
|
||||
local=/moss/
|
||||
cache-size=5000
|
||||
addn-hosts=/etc/adblock.hosts
|
||||
''; # TODO find a way to make adblock hosts reproducible and updateable
|
||||
services.dnsmasq.servers = [ "45.90.30.49" "45.90.28.49" "1.1.1.1" "8.8.8.8" ];
|
||||
# TODO use this list in mossnet-hosts
|
||||
networking.hosts = {
|
||||
"192.168.1.240" = [
|
||||
"mossnet.lan"
|
||||
"links.mossnet.lan"
|
||||
"read.mossnet.lan"
|
||||
"stats.mossnet.lan"
|
||||
"music.mossnet.lan"
|
||||
"rss.mossnet.lan"
|
||||
"tasks.mossnet.lan"
|
||||
"file.mossnet.lan"
|
||||
"books.mossnet.lan"
|
||||
"fin.mossnet.lan"
|
||||
"paper.mossnet.lan"
|
||||
"cal.mossnet.lan"
|
||||
"archive.mossnet.lan"
|
||||
"tracks.mossnet.lan"
|
||||
];
|
||||
"192.168.1.226" = [
|
||||
"df-web.lan"
|
||||
];
|
||||
let
|
||||
adblockLocalZones = pkgs.stdenv.mkDerivation {
|
||||
name = "unbound-zones-adblock";
|
||||
|
||||
src = (pkgs.fetchFromGitHub
|
||||
{
|
||||
owner = "StevenBlack";
|
||||
repo = "hosts";
|
||||
rev = "3.12.21";
|
||||
sha256 = "Yzr6PY/zqQE+AHH0J6ioHTsgkikM+dz4aelbGpQJa1s=";
|
||||
} + "/hosts");
|
||||
|
||||
phases = [ "installPhase" ];
|
||||
|
||||
installPhase = ''
|
||||
${pkgs.gawk}/bin/awk '{sub(/\r$/,"")} {sub(/^127\.0\.0\.1/,"0.0.0.0")} BEGIN { OFS = "" } NF == 2 && $1 == "0.0.0.0" { print "local-zone: \"", $2, "\" static"}' $src | tr '[:upper:]' '[:lower:]' | sort -u > $out
|
||||
'';
|
||||
};
|
||||
|
||||
mossnet = "192.168.1.240"; # The local lan-ip for box
|
||||
wg-mossnet = "10.0.69.4"; # The wireguard ip for box
|
||||
mossnet-hosts = [
|
||||
"mossnet.lan"
|
||||
"links.mossnet.lan"
|
||||
"read.mossnet.lan"
|
||||
"stats.mossnet.lan"
|
||||
"music.mossnet.lan"
|
||||
"rss.mossnet.lan"
|
||||
"tasks.mossnet.lan"
|
||||
"file.mossnet.lan"
|
||||
"books.mossnet.lan"
|
||||
"fin.mossnet.lan"
|
||||
"paper.mossnet.lan"
|
||||
"cal.mossnet.lan"
|
||||
"archive.mossnet.lan"
|
||||
"tracks.mossnet.lan"
|
||||
"grasp.mossnet.lan"
|
||||
];
|
||||
in
|
||||
{
|
||||
services.unbound = {
|
||||
enable = true;
|
||||
settings = {
|
||||
server = {
|
||||
include = "${adblockLocalZones}";
|
||||
interface = [ "0.0.0.0" ];
|
||||
access-control = [ "127.0.0.0/24 allow" "192.168.0.0/24 allow" "10.0.69.0/24 allow" ];
|
||||
access-control-view = "10.0.69.0/24 wireguard";
|
||||
local-zone = ''"mossnet.lan." redirect'';
|
||||
local-data = ''"mossnet.lan. IN A ${mossnet}"'';
|
||||
};
|
||||
forward-zone = [{
|
||||
name = ".";
|
||||
forward-addr = [ "45.90.30.49" "45.90.28.49" "1.1.1.1" "8.8.8.8" ];
|
||||
}];
|
||||
view = {
|
||||
name = "wireguard";
|
||||
local-zone = ''"mossnet.lan." redirect'';
|
||||
local-data = ''"mossnet.lan. IN A ${wg-mossnet}"'';
|
||||
};
|
||||
do-not-query-localhost = "no";
|
||||
# Eventually we'll add DNSSEC / DoT
|
||||
# so-reuseport: yes
|
||||
# tls-cert-bundle: /etc/ssl/certs/ca-certificates.crt
|
||||
# tls-upstream: yes
|
||||
};
|
||||
};
|
||||
|
||||
# With unbound we're doing wildcard redirects, so we don't need that anymore
|
||||
# networking.hosts = {
|
||||
# mossnet = mossnet-hosts;
|
||||
# };
|
||||
networking.firewall.allowedTCPPorts = [ 53 ];
|
||||
networking.firewall.allowedUDPPorts = [ 53 ];
|
||||
}
|
||||
|
|
|
@ -6,6 +6,7 @@
|
|||
|
||||
services.gitea = {
|
||||
enable = true;
|
||||
package = pkgs.unstable.forgejo;
|
||||
appName = "Sealight Git Forge";
|
||||
domain = "git.sealight.xyz";
|
||||
rootUrl = "https://git.sealight.xyz";
|
||||
|
|
|
@ -1,6 +1,12 @@
|
|||
{ ... }:
|
||||
{
|
||||
services."grasp".enable = true;
|
||||
services."grasp".path = "/home/anish/kitaab/grasp";
|
||||
services."grasp".user = "anish";
|
||||
services.grasp = {
|
||||
enable = true;
|
||||
path = "/home/anish/kitaab/grasp/notes.wiki";
|
||||
user = "anish";
|
||||
};
|
||||
|
||||
services.nginx.virtualHosts."grasp.mossnet.lan" = {
|
||||
locations."/".proxyPass = "http://localhost:12212";
|
||||
};
|
||||
}
|
||||
|
|
20
hosts/profiles/kuberenetes/default.nix
Normal file
20
hosts/profiles/kuberenetes/default.nix
Normal file
|
@ -0,0 +1,20 @@
|
|||
{ pkgs, ... }:
|
||||
|
||||
{
|
||||
# k3s
|
||||
networking.firewall.allowedTCPPorts = [ 6443 ];
|
||||
services.k3s.enable = true;
|
||||
services.k3s.role = "server";
|
||||
services.k3s.clusterInit = true;
|
||||
# services.k3s.extraFlags = toString [
|
||||
# "--kubelet-arg=v=4" # Optionally add additional args to k3s
|
||||
# ];
|
||||
environment.systemPackages = [ pkgs.k3s pkgs.kubernetes-helm ];
|
||||
|
||||
# minikube on docker
|
||||
virtualisation.docker.enable = true;
|
||||
virtualisation.docker.storageDriver = "btrfs";
|
||||
# or use kvm
|
||||
#virtualisation.libvrt.enable = true;
|
||||
users.users.anish.extraGroups = [ "docker" ]; # "libvert"
|
||||
}
|
21
hosts/profiles/microbin/default.nix
Normal file
21
hosts/profiles/microbin/default.nix
Normal file
|
@ -0,0 +1,21 @@
|
|||
{ config, lib, pkgs, ... }:
|
||||
{
|
||||
services.microbin.enable = true;
|
||||
services.microbin.hostname = "bin.sealight.xyz";
|
||||
services.microbin.port = 4949;
|
||||
networking.firewall.allowedTCPPorts = [ 4949 ];
|
||||
services.nginx.virtualHosts."bin.sealight.xyz" = {
|
||||
enableACME = true;
|
||||
forceSSL = true;
|
||||
extraConfig = "client_max_body_size 20M;";
|
||||
|
||||
locations."/" = {
|
||||
extraConfig = ''
|
||||
proxy_pass http://localhost:4949/;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
'';
|
||||
};
|
||||
};
|
||||
}
|
|
@ -34,6 +34,7 @@
|
|||
};
|
||||
|
||||
systemd.services.woodpecker-server = {
|
||||
after = [ "postgresql.service" ];
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
serviceConfig = {
|
||||
WorkingDirectory = "/var/lib/woodpecker";
|
||||
|
|
|
@ -9,4 +9,5 @@
|
|||
wireguard = import ./wireguard.nix;
|
||||
backup = import ./backup.nix;
|
||||
ulogger-server = import ./ulogger.nix;
|
||||
microbin = import ./microbin.nix;
|
||||
}
|
||||
|
|
95
modules/nixos/microbin.nix
Normal file
95
modules/nixos/microbin.nix
Normal file
|
@ -0,0 +1,95 @@
|
|||
{ self, config, lib, pkgs, ... }:
|
||||
|
||||
with lib;
|
||||
|
||||
let
|
||||
cfg = config.services.microbin;
|
||||
configFile = "/etc/microbin/config";
|
||||
dataFolder = "/var/lib/microbin";
|
||||
in
|
||||
{
|
||||
options = {
|
||||
|
||||
services.microbin = {
|
||||
enable = mkEnableOption "A super tiny pasta";
|
||||
|
||||
user = mkOption {
|
||||
type = types.str;
|
||||
default = "microbin";
|
||||
description = "User account under which microbin runs.";
|
||||
};
|
||||
|
||||
group = mkOption {
|
||||
type = types.str;
|
||||
default = "microbin";
|
||||
description = "Group account under which microbin runs.";
|
||||
};
|
||||
|
||||
hostname = mkOption {
|
||||
type = types.str;
|
||||
description = "Hostname of your microbin service";
|
||||
};
|
||||
|
||||
port = mkOption {
|
||||
type = types.port;
|
||||
default = 8080;
|
||||
description = "Port on which to run the serice";
|
||||
};
|
||||
|
||||
};
|
||||
};
|
||||
|
||||
config = mkIf cfg.enable {
|
||||
systemd.services.microbin = {
|
||||
description = "Microbin A Super Tiny Pasta";
|
||||
after = [ "remote-fs.target" "network.target" ];
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
serviceConfig = {
|
||||
ExecStart = "${pkgs.unstable.microbin}/bin/microbin --public-path ${cfg.hostname} --qr --enable-burn-after --private";
|
||||
Environment = [
|
||||
"MICROBIN_EDITABLE=true"
|
||||
"MICROBIN_HIDE_FOOTER=true"
|
||||
"MICROBIN_HIGHLIGHTSYNTAX=true"
|
||||
"MICROBIN_PORT=${builtins.toString cfg.port}"
|
||||
"MICROBIN_TITLE=SealightBin"
|
||||
];
|
||||
WorkingDirectory = dataFolder;
|
||||
TimeoutStopSec = " 20 ";
|
||||
KillMode = " process ";
|
||||
RestartSec = " 10 ";
|
||||
User = cfg.user;
|
||||
Group = cfg.group;
|
||||
DevicePolicy = " closed ";
|
||||
NoNewPrivileges = " yes ";
|
||||
PrivateTmp = " yes ";
|
||||
PrivateUsers = " yes ";
|
||||
ProtectControlGroups = " yes ";
|
||||
ProtectKernelModules = " yes ";
|
||||
ProtectKernelTunables = " yes ";
|
||||
RestrictAddressFamilies = "
|
||||
AF_UNIX
|
||||
AF_INET
|
||||
AF_INET6 ";
|
||||
RestrictNamespaces = " yes ";
|
||||
RestrictRealtime = " yes ";
|
||||
SystemCallFilter = "~@clock @debug @module @mount @obsolete @privileged @reboot @setuid @swap";
|
||||
ReadWritePaths = dataFolder;
|
||||
StateDirectory = baseNameOf dataFolder;
|
||||
};
|
||||
};
|
||||
|
||||
users.users = optionalAttrs (cfg.user == "microbin") ({
|
||||
microbin = {
|
||||
description = "microbin service user";
|
||||
name = cfg.user;
|
||||
group = cfg.group;
|
||||
isSystemUser = true;
|
||||
};
|
||||
});
|
||||
|
||||
users.groups = optionalAttrs (cfg.group == "microbin") ({
|
||||
microbin = { };
|
||||
});
|
||||
};
|
||||
}
|
||||
|
|
@ -255,14 +255,13 @@ in
|
|||
};
|
||||
|
||||
script = ''
|
||||
echo "Setting up ulogger-server files in ${cfg.dataDir} ..."
|
||||
cd "${cfg.dataDir}"
|
||||
|
||||
cp -R ${cfg.package}/* ./
|
||||
cp ${configFile}/config.php ./
|
||||
|
||||
if [ ! -f installed ]; then
|
||||
echo "Install file not found, installing ..."
|
||||
cp -R ${cfg.package}/* ./
|
||||
cp ${configFile}/config.php ./
|
||||
|
||||
psql -U ulogger < ${cfg.package}/scripts/ulogger.pgsql
|
||||
psql -d ulogger -c "INSERT INTO users (login, password, admin) VALUES ('$ULOGGER_ADMIN_USER', '$ULOGGER_ADMIN_PASSWORD', TRUE)"
|
||||
touch installed
|
||||
|
@ -272,6 +271,6 @@ in
|
|||
};
|
||||
|
||||
meta = with stdenv.lib; {
|
||||
maintainers = with maintainers; [ nadrieril ];
|
||||
maintainers = with maintainers; [ chickensoupwithrice ];
|
||||
};
|
||||
}
|
||||
|
|
Loading…
Reference in a new issue