Compare commits

...

27 commits

Author SHA1 Message Date
Anish Lakhwara 1461881cf8 Merge branch 'main' of git.sealight.xyz:aynish/helm 2023-05-13 22:50:33 +10:00
Anish Lakhwara 3f1af8ca77 upgrade to forgejo (needs unstable) 2023-05-13 22:49:56 +10:00
Anish Lakhwara 2368a1b6a6 use latest microbin for all the features 2023-05-13 22:49:47 +10:00
Anish Lakhwara 63a18c2bc3 add unstable overlay to litePackages 2023-05-13 22:49:37 +10:00
Anish Lakhwara df629af5ab working split dns config :3 2023-05-13 21:12:05 +10:00
Anish Lakhwara f374e8bd1f paste should be super+a not super+e 2023-05-12 21:33:48 +10:00
Anish Lakhwara 2a1f956227 update microbin, add sxhkdrc command to paste clipboard to my bin 2023-05-12 21:23:45 +10:00
Anish Lakhwara 110ba17935 bin.sealight.xyz 2023-05-12 20:51:34 +10:00
Anish Lakhwara 41a64a3248 microbin works 2023-05-12 20:51:28 +10:00
Anish Lakhwara 27138bdc7d helix runs lite config, out of space 2023-05-12 20:51:07 +10:00
Anish Lakhwara 6a8a4985df ensure woodpecker runs after postgres 2023-05-12 20:50:51 +10:00
Anish Lakhwara b6b7601a68 only use docker for minikube 2023-05-11 23:04:13 +10:00
Anish Lakhwara 73f53bfd50 fix box grasp 2023-05-11 23:04:05 +10:00
Anish Lakhwara adf222b873 add microbin module to config 2023-05-11 23:03:51 +10:00
Anish Lakhwara f140ebbda3 add microbin to helix (create module) 2023-05-11 23:03:33 +10:00
Anish Lakhwara eef4f59aa6 setup docker / kvm2 for minikube usage 2023-05-05 14:04:30 +10:00
Anish Lakhwara 2f940bc682 update flake.lock file 2023-05-04 23:10:17 +10:00
Anish Lakhwara 4856c4e2ca correct location of print command for ulogger-install script 2023-05-04 23:10:01 +10:00
Anish Lakhwara cc547e7da3 add k8s config for k3s and minikube to curve 2023-05-04 23:09:47 +10:00
Anish Lakhwara b595688a65 task-note matches correct template, %link is highlighted on vimwiki
filetypes
2023-05-04 23:09:27 +10:00
Anish Lakhwara 5f3d27695e gitignore node_modules 2023-05-04 23:09:18 +10:00
Anish Lakhwara c04d45ee80 add ssh shortcut sb for allwell bonfire instance 2023-05-04 23:08:57 +10:00
Anish Lakhwara b363fd3c9e make ulogger-install idempotent 2023-04-28 09:10:29 +10:00
Anish Lakhwara ad7d63eea7 update ulogger so it dosen't recreate everytime 2023-04-27 16:14:58 +10:00
Anish Lakhwara ac312637e7 unstable newsflash and lifera 2023-04-27 16:14:11 +10:00
Anish Lakhwara f8acfda6e5 make grasp work 2023-04-27 16:14:01 +10:00
Anish Lakhwara 70e8fa79bd update unstable 2023-04-25 11:43:21 +10:00
23 changed files with 291 additions and 67 deletions

View file

@ -16,6 +16,7 @@ D('sealight.xyz', REG_NONE, DnsProvider(DNS_HEDNS),
A('bridge', '69.61.38.225', TTL(300)),
A('rss', '69.61.38.225', TTL(300)),
A('git', '69.61.38.225', TTL(300)),
A('bin', '69.61.38.225', TTL(300)),
A('ci', '69.61.38.225', TTL(300)),
// vultr -> nulled: lituus
A('@', '45.77.48.108', TTL(300)),

View file

@ -210,6 +210,21 @@
}
},
"flake-utils_2": {
"locked": {
"lastModified": 1667395993,
"narHash": "sha256-nuEHfE/LcWyuSWnS8t12N1wc105Qtau+/OdUAjtQ0rA=",
"owner": "numtide",
"repo": "flake-utils",
"rev": "5aed5285a952e0b949eb3ba02c12fa4fcfef535f",
"type": "github"
},
"original": {
"owner": "numtide",
"repo": "flake-utils",
"type": "github"
}
},
"flake-utils_3": {
"locked": {
"lastModified": 1676283394,
"narHash": "sha256-XX2f9c3iySLCw54rJ/CZs+ZK6IQy7GXNY4nSOyu2QG4=",
@ -224,7 +239,7 @@
"type": "github"
}
},
"flake-utils_3": {
"flake-utils_4": {
"locked": {
"lastModified": 1659877975,
"narHash": "sha256-zllb8aq3YO3h8B/U0/J1WBgAL8EX5yWf5pMj3G0NAmc=",
@ -239,6 +254,28 @@
"type": "github"
}
},
"grasp": {
"inputs": {
"flake-utils": "flake-utils_2",
"nixpkgs": [
"nixpkgs"
]
},
"locked": {
"lastModified": 1682644301,
"narHash": "sha256-gMBFZLf41s3+cnhxgZVRvj2JSAFYv4jn2xBKwEESthE=",
"ref": "main",
"rev": "a2d85675b930ffc26f6891b2e14491795907be4e",
"revCount": 137,
"type": "git",
"url": "ssh://gitea@git.sealight.xyz/aynish/grasp.git"
},
"original": {
"ref": "main",
"type": "git",
"url": "ssh://gitea@git.sealight.xyz/aynish/grasp.git"
}
},
"hardware": {
"locked": {
"lastModified": 1677232326,
@ -277,7 +314,7 @@
},
"llamacpp": {
"inputs": {
"flake-utils": "flake-utils_2",
"flake-utils": "flake-utils_3",
"nixpkgs": [
"unstable"
]
@ -423,6 +460,7 @@
"basant": "basant",
"deploy-rs": "deploy-rs",
"eww": "eww",
"grasp": "grasp",
"hardware": "hardware",
"home-manager": "home-manager",
"llamacpp": "llamacpp",
@ -438,7 +476,7 @@
},
"rust-overlay": {
"inputs": {
"flake-utils": "flake-utils_3",
"flake-utils": "flake-utils_4",
"nixpkgs": [
"nixpkgs"
]
@ -519,11 +557,11 @@
},
"unstable": {
"locked": {
"lastModified": 1677063315,
"narHash": "sha256-qiB4ajTeAOVnVSAwCNEEkoybrAlA+cpeiBxLobHndE8=",
"lastModified": 1682268651,
"narHash": "sha256-2eZriMhnD24Pmb8ideZWZDiXaAVe6LzJrHQiNPck+Lk=",
"owner": "nixos",
"repo": "nixpkgs",
"rev": "988cc958c57ce4350ec248d2d53087777f9e1949",
"rev": "e78d25df6f1036b3fa76750ed4603dd9d5fe90fc",
"type": "github"
},
"original": {

View file

@ -24,8 +24,8 @@
basant.url = "git+ssh://gitea@git.sealight.xyz/aynish/basant?ref=main";
basant.inputs.nixpkgs.follows = "nixpkgs";
basant.inputs.poonam.follows = "poonam";
# grasp.url = "git+ssh://gitea@git.sealight.xyz/aynish/grasp.git?ref=main";
# grasp.inputs.nixpkgs.follows = "nixpkgs";
grasp.url = "git+ssh://gitea@git.sealight.xyz/aynish/grasp.git?ref=main";
grasp.inputs.nixpkgs.follows = "nixpkgs";
# Matrix
nix-matrix-appservices.url = "gitlab:coffeetables/nix-matrix-appservices";
# Others
@ -61,7 +61,7 @@
, deploy-rs
, agenix
, basant
# , grasp
, grasp
, nix-matrix-appservices
, nur
, tidalcycles
@ -116,6 +116,7 @@
inherit system;
overlays = [
agenix.overlays.default
unstableOverlay # Remove once updated to 23.05 (used for microbin on helix)
tidalcycles.overlays.default # needed for nvim which comes pre-installed lol
];
});
@ -167,18 +168,13 @@
helix = nixpkgs.lib.nixosSystem rec {
specialArgs = { inherit inputs self; };
system = "x86_64-linux";
pkgs = nixpkgsFor.${system};
pkgs = litePkgsFor.${system};
modules = [
./hosts/helix
agenix.nixosModules.age
self.nixosModules.backup
self.nixosModules.wireguard
home-manager.nixosModules.home-manager
{
home-manager.useGlobalPkgs = true;
home-manager.useUserPackages = true;
home-manager.users.anish = import ./home/core;
}
self.nixosModules.microbin
];
};
@ -226,7 +222,7 @@
self.nixosModules.wallabag
self.nixosModules.gonic
self.nixosModules.ulogger-server
# grasp.nixosModule
grasp.nixosModule
home-manager.nixosModules.home-manager
{
home-manager.useGlobalPkgs = true;

View file

@ -299,5 +299,6 @@
sm = "ssh mossnet.lan"; # box regular
sl = "ssh sealight.xyz"; # lituus
sh = "ssh git.sealight.xyz"; # helix
sb = "ssh cyberian@69.61.38.246"; # bonfire for allwell
};
}

View file

@ -0,0 +1 @@
curl -F "content=$(xclip -o)" -X POST https://bin.sealight.xyz/upload

View file

@ -113,6 +113,7 @@ in
'';
# TODO hardcoded
".local/bin/passmenu".source = ./bin/passmenu;
".local/bin/paste".source = ./bin/paste;
".local/bin/bluetoothmenu".source = ./bin/bluetoothmenu;
".local/bin/wifimenu".source = ./bin/wifimenu;
".local/bin/powermenu".source = ./bin/powermenu;

View file

@ -27,6 +27,9 @@ super + Tab
super + e
rofimoji --selector-args "-theme theme/emojimenu.rasi" --skin-tone moderate --action copy
super + a
paste
super + p
passmenu

View file

@ -49,6 +49,7 @@
".tmp"
".direnv"
"result"
"node_modules/"
];
extraConfig = {

View file

@ -151,6 +151,8 @@ in
home.file.".config/nvim/after/syntax/vimwiki.vim".text = ''
" match with %update
syntax match VimwikiPlaceholder /^\s*%update\ze\%(\s.*\)\?$/ nextgroup=VimwikiPlaceholderParam skipwhite
" match with %link
syntax match VimwikiPlaceholder /^\s*%link\ze\%(\s.*\)\?$/ nextgroup=VimwikiPlaceholderParam skipwhite
'';
#environment.systemPackages = with customPlugins; [ tidal ];

View file

@ -41,9 +41,9 @@ def write_note(task_id: int):
time = datetime.datetime.now().strftime("%y-%m-%d %H:%M")
with open(notes_file, "w") as f:
f.write(f"%title: {task_description}")
f.write(f"%title {task_description}")
f.write(f":task:{task_project}:{task_tags if len(task_tags) else ''}\n")
f.write(f"%date: {time}\n\n")
f.write(f"%date {time}\n\n")
f.flush()
os.execlp(EDITOR, EDITOR, notes_file)

View file

@ -19,17 +19,13 @@
../profiles/wallabag
../profiles/finance
../profiles/sync/website
../profiles/grasp
# ../profiles/archivebox
../profiles/woodpecker-agent
../profiles/jellyfin
../profiles/ulogger-server
];
# Something broke when manually updating grasp...
# services.grasp.enable = true;
# services.grasp.path = "/home/anish/kitaab/grasp/grasp.wiki";
# services.grasp.user = "anish";
# Backups
age.secrets.borg-password.file = "${self}/secrets/borg-password.age";
services.postgresqlBackup = {

View file

@ -13,6 +13,7 @@
../profiles/mimetypes
../profiles/syncthing
../profiles/mossnet-hosts
../profiles/kuberenetes
];
# home-manager.users.anish = import ../../home/gui;

View file

@ -10,6 +10,7 @@
../profiles/rss-bridge
../profiles/mount-mossnet
../profiles/freshrss
../profiles/microbin
];
# Capsul specific

View file

@ -61,12 +61,11 @@ in
};
environment.systemPackages = with pkgs; [
unstable.signal-desktop # bridge to sealight?
unstable.sublime-music
unstable.nheko
unstable.tootle
newsflash
liferea
unstable.newsflash
unstable.liferea
scrot
ripcord

View file

@ -1,37 +1,76 @@
{ config, pkgs, lib, ... }:
{
services.dnsmasq.enable = true;
services.dnsmasq.extraConfig = ''
domain-needed
no-resolv
local=/lan/
local=/moss/
cache-size=5000
addn-hosts=/etc/adblock.hosts
''; # TODO find a way to make adblock hosts reproducible and updateable
services.dnsmasq.servers = [ "45.90.30.49" "45.90.28.49" "1.1.1.1" "8.8.8.8" ];
# TODO use this list in mossnet-hosts
networking.hosts = {
"192.168.1.240" = [
"mossnet.lan"
"links.mossnet.lan"
"read.mossnet.lan"
"stats.mossnet.lan"
"music.mossnet.lan"
"rss.mossnet.lan"
"tasks.mossnet.lan"
"file.mossnet.lan"
"books.mossnet.lan"
"fin.mossnet.lan"
"paper.mossnet.lan"
"cal.mossnet.lan"
"archive.mossnet.lan"
"tracks.mossnet.lan"
];
"192.168.1.226" = [
"df-web.lan"
];
let
adblockLocalZones = pkgs.stdenv.mkDerivation {
name = "unbound-zones-adblock";
src = (pkgs.fetchFromGitHub
{
owner = "StevenBlack";
repo = "hosts";
rev = "3.12.21";
sha256 = "Yzr6PY/zqQE+AHH0J6ioHTsgkikM+dz4aelbGpQJa1s=";
} + "/hosts");
phases = [ "installPhase" ];
installPhase = ''
${pkgs.gawk}/bin/awk '{sub(/\r$/,"")} {sub(/^127\.0\.0\.1/,"0.0.0.0")} BEGIN { OFS = "" } NF == 2 && $1 == "0.0.0.0" { print "local-zone: \"", $2, "\" static"}' $src | tr '[:upper:]' '[:lower:]' | sort -u > $out
'';
};
mossnet = "192.168.1.240"; # The local lan-ip for box
wg-mossnet = "10.0.69.4"; # The wireguard ip for box
mossnet-hosts = [
"mossnet.lan"
"links.mossnet.lan"
"read.mossnet.lan"
"stats.mossnet.lan"
"music.mossnet.lan"
"rss.mossnet.lan"
"tasks.mossnet.lan"
"file.mossnet.lan"
"books.mossnet.lan"
"fin.mossnet.lan"
"paper.mossnet.lan"
"cal.mossnet.lan"
"archive.mossnet.lan"
"tracks.mossnet.lan"
"grasp.mossnet.lan"
];
in
{
services.unbound = {
enable = true;
settings = {
server = {
include = "${adblockLocalZones}";
interface = [ "0.0.0.0" ];
access-control = [ "127.0.0.0/24 allow" "192.168.0.0/24 allow" "10.0.69.0/24 allow" ];
access-control-view = "10.0.69.0/24 wireguard";
local-zone = ''"mossnet.lan." redirect'';
local-data = ''"mossnet.lan. IN A ${mossnet}"'';
};
forward-zone = [{
name = ".";
forward-addr = [ "45.90.30.49" "45.90.28.49" "1.1.1.1" "8.8.8.8" ];
}];
view = {
name = "wireguard";
local-zone = ''"mossnet.lan." redirect'';
local-data = ''"mossnet.lan. IN A ${wg-mossnet}"'';
};
do-not-query-localhost = "no";
# Eventually we'll add DNSSEC / DoT
# so-reuseport: yes
# tls-cert-bundle: /etc/ssl/certs/ca-certificates.crt
# tls-upstream: yes
};
};
# With unbound we're doing wildcard redirects, so we don't need that anymore
# networking.hosts = {
# mossnet = mossnet-hosts;
# };
networking.firewall.allowedTCPPorts = [ 53 ];
networking.firewall.allowedUDPPorts = [ 53 ];
}

View file

@ -6,6 +6,7 @@
services.gitea = {
enable = true;
package = pkgs.unstable.forgejo;
appName = "Sealight Git Forge";
domain = "git.sealight.xyz";
rootUrl = "https://git.sealight.xyz";

View file

@ -1,6 +1,12 @@
{ ... }:
{
services."grasp".enable = true;
services."grasp".path = "/home/anish/kitaab/grasp";
services."grasp".user = "anish";
services.grasp = {
enable = true;
path = "/home/anish/kitaab/grasp/notes.wiki";
user = "anish";
};
services.nginx.virtualHosts."grasp.mossnet.lan" = {
locations."/".proxyPass = "http://localhost:12212";
};
}

View file

@ -0,0 +1,20 @@
{ pkgs, ... }:
{
# k3s
networking.firewall.allowedTCPPorts = [ 6443 ];
services.k3s.enable = true;
services.k3s.role = "server";
services.k3s.clusterInit = true;
# services.k3s.extraFlags = toString [
# "--kubelet-arg=v=4" # Optionally add additional args to k3s
# ];
environment.systemPackages = [ pkgs.k3s pkgs.kubernetes-helm ];
# minikube on docker
virtualisation.docker.enable = true;
virtualisation.docker.storageDriver = "btrfs";
# or use kvm
#virtualisation.libvrt.enable = true;
users.users.anish.extraGroups = [ "docker" ]; # "libvert"
}

View file

@ -0,0 +1,21 @@
{ config, lib, pkgs, ... }:
{
services.microbin.enable = true;
services.microbin.hostname = "bin.sealight.xyz";
services.microbin.port = 4949;
networking.firewall.allowedTCPPorts = [ 4949 ];
services.nginx.virtualHosts."bin.sealight.xyz" = {
enableACME = true;
forceSSL = true;
extraConfig = "client_max_body_size 20M;";
locations."/" = {
extraConfig = ''
proxy_pass http://localhost:4949/;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
'';
};
};
}

View file

@ -34,6 +34,7 @@
};
systemd.services.woodpecker-server = {
after = [ "postgresql.service" ];
wantedBy = [ "multi-user.target" ];
serviceConfig = {
WorkingDirectory = "/var/lib/woodpecker";

View file

@ -9,4 +9,5 @@
wireguard = import ./wireguard.nix;
backup = import ./backup.nix;
ulogger-server = import ./ulogger.nix;
microbin = import ./microbin.nix;
}

View file

@ -0,0 +1,95 @@
{ self, config, lib, pkgs, ... }:
with lib;
let
cfg = config.services.microbin;
configFile = "/etc/microbin/config";
dataFolder = "/var/lib/microbin";
in
{
options = {
services.microbin = {
enable = mkEnableOption "A super tiny pasta";
user = mkOption {
type = types.str;
default = "microbin";
description = "User account under which microbin runs.";
};
group = mkOption {
type = types.str;
default = "microbin";
description = "Group account under which microbin runs.";
};
hostname = mkOption {
type = types.str;
description = "Hostname of your microbin service";
};
port = mkOption {
type = types.port;
default = 8080;
description = "Port on which to run the serice";
};
};
};
config = mkIf cfg.enable {
systemd.services.microbin = {
description = "Microbin A Super Tiny Pasta";
after = [ "remote-fs.target" "network.target" ];
wantedBy = [ "multi-user.target" ];
serviceConfig = {
ExecStart = "${pkgs.unstable.microbin}/bin/microbin --public-path ${cfg.hostname} --qr --enable-burn-after --private";
Environment = [
"MICROBIN_EDITABLE=true"
"MICROBIN_HIDE_FOOTER=true"
"MICROBIN_HIGHLIGHTSYNTAX=true"
"MICROBIN_PORT=${builtins.toString cfg.port}"
"MICROBIN_TITLE=SealightBin"
];
WorkingDirectory = dataFolder;
TimeoutStopSec = " 20 ";
KillMode = " process ";
RestartSec = " 10 ";
User = cfg.user;
Group = cfg.group;
DevicePolicy = " closed ";
NoNewPrivileges = " yes ";
PrivateTmp = " yes ";
PrivateUsers = " yes ";
ProtectControlGroups = " yes ";
ProtectKernelModules = " yes ";
ProtectKernelTunables = " yes ";
RestrictAddressFamilies = "
AF_UNIX
AF_INET
AF_INET6 ";
RestrictNamespaces = " yes ";
RestrictRealtime = " yes ";
SystemCallFilter = "~@clock @debug @module @mount @obsolete @privileged @reboot @setuid @swap";
ReadWritePaths = dataFolder;
StateDirectory = baseNameOf dataFolder;
};
};
users.users = optionalAttrs (cfg.user == "microbin") ({
microbin = {
description = "microbin service user";
name = cfg.user;
group = cfg.group;
isSystemUser = true;
};
});
users.groups = optionalAttrs (cfg.group == "microbin") ({
microbin = { };
});
};
}

View file

@ -255,14 +255,13 @@ in
};
script = ''
echo "Setting up ulogger-server files in ${cfg.dataDir} ..."
cd "${cfg.dataDir}"
cp -R ${cfg.package}/* ./
cp ${configFile}/config.php ./
if [ ! -f installed ]; then
echo "Install file not found, installing ..."
cp -R ${cfg.package}/* ./
cp ${configFile}/config.php ./
psql -U ulogger < ${cfg.package}/scripts/ulogger.pgsql
psql -d ulogger -c "INSERT INTO users (login, password, admin) VALUES ('$ULOGGER_ADMIN_USER', '$ULOGGER_ADMIN_PASSWORD', TRUE)"
touch installed
@ -272,6 +271,6 @@ in
};
meta = with stdenv.lib; {
maintainers = with maintainers; [ nadrieril ];
maintainers = with maintainers; [ chickensoupwithrice ];
};
}