aynish/helm
1
0
Fork 0
Code Pull requests Packages Projects Releases Activity

Compare commits

base: aynish:main
Branches Tags
aynish:main
aynish:nix-on-droid
aynish:darwin
aynish:nvim-rewrite
aynish:migrate-off-digga
aynish:devos
aynish:upgrade
aynish:secrets-lituus
aynish:shaarli-api
aynish:box
aynish:merge-box
aynish:deploy
aynish:work
aynish:flakes
aynish:master
aynish:old
..
compare: aynish:migrate-off-digga
Branches Tags
aynish:main
aynish:nix-on-droid
aynish:darwin
aynish:nvim-rewrite
aynish:migrate-off-digga
aynish:devos
aynish:upgrade
aynish:secrets-lituus
aynish:shaarli-api
aynish:box
aynish:merge-box
aynish:deploy
aynish:work
aynish:flakes
aynish:master
aynish:old

No commits in common. "main" and "migrate-off-digga" have entirely different histories.
main ... migrate-of

138 changed files with 1234 additions and 5530 deletions
Show stats Expand all files Collapse all files

8
.direnv/bin/nix-direnv-reload
View file

@ -1,8 +0,0 @@
#!/usr/bin/env bash
dir="$(realpath $(dirname ${BASH_SOURCE[0]})/../..)"
_nix_direnv_force_reload=1 direnv exec "$dir" true
direnv reload
# direnv reload updates the mtime of .envrc. Also update the timestamp of the
# profile_rc file to keep track that we actually are up to date.
touch $dir/.direnv/{nix,flake}-profile-*.rc

1863
.direnv/flake-profile-a5d5b61aa8a61b7d9d765e1daf971a9a578f1cfa.rc
View file

File diff suppressed because it is too large Load diff

2
.envrc
View file

@ -1,2 +0,0 @@
export HE_PASSWORD=SuperDuper
use flake

1
.gitignore vendored
View file

@ -1 +0,0 @@
.direnv/

30
dns/dnsconfig.js
View file

@ -4,27 +4,6 @@ var REG_NONE = NewRegistrar('none'); // No registrar.
var DNS_BIND = NewDnsProvider('bind'); // ISC BIND.
var DNS_HEDNS = NewDnsProvider('hedns');
D("lakhwara.com", REG_NONE,
DnsProvider(DNS_HEDNS),
DefaultTTL(300),
//SOA('@', 'ns1.he.net.', 'hostmaster.he.net.', 2022041702, 86400, 7200, 3600000, 86400, TTL(172800)),
A('anish', '69.61.2.203'),
A('@', '69.61.2.203'),
//A('coaching', '103.16.130.98'),
TXT('anish', 'datkey=dat://1a240a14fab2bae9c85ebad29bddc04505aaba24e5fb809c2ccb4cdf71e3a7d5'),
CNAME('fm1._domainkey', 'fm1.lakhwara.com.dkim.fmhosted.com.'),
CNAME('fm2._domainkey', 'fm2.lakhwara.com.dkim.fmhosted.com.'),
CNAME('fm3._domainkey', 'fm3.lakhwara.com.dkim.fmhosted.com.'),
MX('@', 10, 'in1-smtp.messagingengine.com.'),
MX('@', 20, 'in2-smtp.messagingengine.com.'),
//NAMESERVER('ns1.he.net.'),
//NAMESERVER('ns2.he.net.'),
//NAMESERVER('ns3.he.net.'),
//NAMESERVER('ns4.he.net.'),
//NAMESERVER('ns5.he.net.'),
TXT('@', 'v=spf1 include:spf.messagingengine.com ?all')
)
D('sealight.xyz', REG_NONE, DnsProvider(DNS_HEDNS),
DefaultTTL(86400),
//SOA('@', 'ns1.he.net.', 'hostmaster.he.net.', 2022121008, 86400, 7200, 3600000, 172800, TTL(172800)),
@ -34,12 +13,9 @@ D('sealight.xyz', REG_NONE, DnsProvider(DNS_HEDNS),
//NAMESERVER('ns4.he.net.'),
//NAMESERVER('ns5.he.net.'),
// capsul: helix
A('bridge', '69.61.2.203', TTL(300)),
A('rss', '69.61.2.203', TTL(300)),
A('git', '69.61.2.203', TTL(300)),
A('bin', '69.61.2.203', TTL(300)),
A('ci', '69.61.2.203', TTL(300)),
A('write', '69.61.2.203', TTL(300)),
A('bridge', '69.61.38.225', TTL(300)),
A('rss', '69.61.38.225', TTL(300)),
A('git', '69.61.38.225', TTL(300)),
// vultr -> nulled: lituus
A('@', '45.77.48.108', TTL(300)),
A('jitsi', '45.77.48.108', TTL(300)),

0
dns/test_nullhex.sh Normal file → Executable file
View file

22
dns/zones/lakhwara.com.zone
View file

@ -1,22 +0,0 @@
; lakhwara.com Dumped Sun May 28 22:30:02 2023
;
lakhwara.com. 172800 IN SOA ns1.he.net. hostmaster.he.net. (
2022041702 ;serial
86400 ;refresh
7200 ;retry
3600000 ;expire
86400 ) ;minimum
anish.lakhwara.com. 86400 IN A 103.16.130.98
anish.lakhwara.com. 86400 IN TXT datkey=dat://1a240a14fab2bae9c85ebad29bddc04505aaba24e5fb809c2ccb4cdf71e3a7d5
fm1._domainkey.lakhwara.com. 86400 IN CNAME fm1.lakhwara.com.dkim.fmhosted.com.
fm2._domainkey.lakhwara.com. 86400 IN CNAME fm2.lakhwara.com.dkim.fmhosted.com.
fm3._domainkey.lakhwara.com. 86400 IN CNAME fm3.lakhwara.com.dkim.fmhosted.com.
lakhwara.com. 86400 IN A 103.16.130.98
lakhwara.com. 86400 IN MX 10 in1-smtp.messagingengine.com.
lakhwara.com. 86400 IN MX 20 in2-smtp.messagingengine.com.
lakhwara.com. 86400 IN NS ns1.he.net.
lakhwara.com. 86400 IN NS ns2.he.net.
lakhwara.com. 86400 IN NS ns3.he.net.
lakhwara.com. 86400 IN NS ns4.he.net.
lakhwara.com. 86400 IN NS ns5.he.net.
lakhwara.com. 86400 IN TXT "v=spf1 include:spf.messagingengine.com ?all"

400
flake.lock
View file

@ -2,19 +2,16 @@
"nodes": {
"agenix": {
"inputs": {
"darwin": "darwin",
"home-manager": "home-manager",
"nixpkgs": [
"nixpkgs"
],
"systems": "systems"
]
},
"locked": {
"lastModified": 1723293904,
"narHash": "sha256-b+uqzj+Wa6xgMS9aNbX4I+sXeb5biPDi39VgvSFqFvU=",
"lastModified": 1665870395,
"narHash": "sha256-Tsbqb27LDNxOoPLh0gw2hIb6L/6Ow/6lIBvqcHzEKBI=",
"owner": "ryantm",
"repo": "agenix",
"rev": "f6291c5935fdc4e0bef208cfc0dcab7e3f7a1c41",
"rev": "a630400067c6d03c9b3e0455347dc8559db14288",
"type": "github"
},
"original": {
@ -34,11 +31,11 @@
]
},
"locked": {
"lastModified": 1682226636,
"narHash": "sha256-fmETHfUtQ5zOVr/4MT5wE7eNALCSQCnEUYZYmV3UEwg=",
"lastModified": 1663665682,
"narHash": "sha256-YB+vmQB3N9RyeshHAO4GjIFebA7NPY2jlkdvGGZtM64=",
"ref": "main",
"rev": "095d14ff2469c8f3de7cbf45d229c0f46a733aae",
"revCount": 77,
"rev": "36bda6965ab2e1a206f8c2b7a74f3b022c873662",
"revCount": 65,
"type": "git",
"url": "ssh://gitea@git.sealight.xyz/aynish/basant"
},
@ -48,28 +45,6 @@
"url": "ssh://gitea@git.sealight.xyz/aynish/basant"
}
},
"darwin": {
"inputs": {
"nixpkgs": [
"agenix",
"nixpkgs"
]
},
"locked": {
"lastModified": 1700795494,
"narHash": "sha256-gzGLZSiOhf155FW7262kdHo2YDeugp3VuIFb4/GGng0=",
"owner": "lnl7",
"repo": "nix-darwin",
"rev": "4b9b83d5a92e8c1fbfd8eb27eda375908c11ec4d",
"type": "github"
},
"original": {
"owner": "lnl7",
"ref": "master",
"repo": "nix-darwin",
"type": "github"
}
},
"deploy-rs": {
"inputs": {
"flake-compat": "flake-compat",
@ -79,11 +54,11 @@
"utils": "utils"
},
"locked": {
"lastModified": 1718194053,
"narHash": "sha256-FaGrf7qwZ99ehPJCAwgvNY5sLCqQ3GDiE/6uLhxxwSY=",
"lastModified": 1668797197,
"narHash": "sha256-0w6iD3GSSQbIeSFVDzAAQZB+hDq670ZTms3d9XI+BtM=",
"owner": "serokell",
"repo": "deploy-rs",
"rev": "3867348fa92bc892eba5d9ddb2d7a97b9e127a8a",
"rev": "2a3c5f70eee04a465aa534d8bd4fcc9bb3c4a8ce",
"type": "github"
},
"original": {
@ -92,65 +67,55 @@
"type": "github"
}
},
"devshell": {
"locked": {
"lastModified": 1642188268,
"narHash": "sha256-DNz4xScpXIn7rSDohdayBpPR9H9OWCMDOgTYegX081k=",
"owner": "numtide",
"repo": "devshell",
"rev": "696acc29668b644df1740b69e1601119bf6da83b",
"type": "github"
},
"original": {
"owner": "numtide",
"repo": "devshell",
"type": "github"
}
},
"dirt-samples-src": {
"flake": false,
"locked": {
"lastModified": 1698439458,
"narHash": "sha256-Mp8qBpsOvW9Zguv95Kv7EU6S3ICaF2aO02Wz6xGURtE=",
"lastModified": 1588278411,
"narHash": "sha256-h8vQxRym6QzNLOTZU7A43VCHuG0H77l+BFwXnC0L1CE=",
"owner": "tidalcycles",
"repo": "dirt-samples",
"rev": "9a6dff8f9ec3cd55b287290cf04e01afa6b8f532",
"rev": "66d432418c9a7d82cf049d9246adfa62f46df2a6",
"type": "github"
},
"original": {
"owner": "tidalcycles",
"ref": "master",
"repo": "dirt-samples",
"type": "github"
}
},
"disko": {
"eww": {
"inputs": {
"flake-compat": "flake-compat_2",
"nixpkgs": [
"nixpkgs"
],
"rust-overlay": [
"rust-overlay"
]
},
"locked": {
"lastModified": 1724031427,
"narHash": "sha256-o1HdAf+7IGv9M13R3c+zc/sJ0QgeEnhsvHBcodI4UpM=",
"owner": "nix-community",
"repo": "disko",
"rev": "4e719b38fa7c85f4f65d0308ca7084c91e7bdd6d",
"lastModified": 1669643151,
"narHash": "sha256-39/l57QusriyNr426kXNqtub0ciZna+t20VKPYUAgsM=",
"owner": "elkowar",
"repo": "eww",
"rev": "ec4c2d1a4f12e9c3664e9f53ad99007b4a10a16a",
"type": "github"
},
"original": {
"owner": "nix-community",
"repo": "disko",
"owner": "elkowar",
"repo": "eww",
"type": "github"
}
},
"flake-compat": {
"flake": false,
"locked": {
"lastModified": 1696426674,
"narHash": "sha256-kvjfFW7WAETZlt09AgDn1MrtKzP7t90Vf7vypd3OL1U=",
"lastModified": 1648199409,
"narHash": "sha256-JwPKdC2PoVBkG6E+eWw3j6BMR6sL3COpYWfif7RVb8Y=",
"owner": "edolstra",
"repo": "flake-compat",
"rev": "0f9255e01c2351cc7d116c072cb317785dd33b33",
"rev": "64a525ee38886ab9028e6f61790de0832aa3ef03",
"type": "github"
},
"original": {
@ -162,11 +127,11 @@
"flake-compat_2": {
"flake": false,
"locked": {
"lastModified": 1641205782,
"narHash": "sha256-4jY7RCWUoZ9cKD8co0/4tFARpWB+57+r1bLLvXNJliY=",
"lastModified": 1650374568,
"narHash": "sha256-Z+s0J8/r907g149rllvwhb4pKi8Wam5ij0st8PwAh+E=",
"owner": "edolstra",
"repo": "flake-compat",
"rev": "b7547d3eed6f32d06102ead8991ec52ab0a4f1a7",
"rev": "b4a34015c698c7793d592d66adbab377907a2be8",
"type": "github"
},
"original": {
@ -192,11 +157,26 @@
},
"flake-utils_2": {
"locked": {
"lastModified": 1667395993,
"narHash": "sha256-nuEHfE/LcWyuSWnS8t12N1wc105Qtau+/OdUAjtQ0rA=",
"lastModified": 1652372896,
"narHash": "sha256-lURGussfF3mGrFPQT3zgW7+RC0pBhbHzco0C7I+ilow=",
"owner": "numtide",
"repo": "flake-utils",
"rev": "5aed5285a952e0b949eb3ba02c12fa4fcfef535f",
"rev": "0d347c56f6f41de822a4f4c7ff5072f3382db121",
"type": "github"
},
"original": {
"owner": "numtide",
"repo": "flake-utils",
"type": "github"
}
},
"flake-utils_3": {
"locked": {
"lastModified": 1659877975,
"narHash": "sha256-zllb8aq3YO3h8B/U0/J1WBgAL8EX5yWf5pMj3G0NAmc=",
"owner": "numtide",
"repo": "flake-utils",
"rev": "c0e246b9b83f637f4681389ecabcb2681b4f3af0",
"type": "github"
},
"original": {
@ -208,16 +188,17 @@
"grasp": {
"inputs": {
"flake-utils": "flake-utils_2",
"grasp": "grasp_2",
"nixpkgs": [
"nixpkgs"
]
},
"locked": {
"lastModified": 1682644301,
"narHash": "sha256-gMBFZLf41s3+cnhxgZVRvj2JSAFYv4jn2xBKwEESthE=",
"lastModified": 1652615971,
"narHash": "sha256-e8fvTQCR/At2jgenuY71WXN13XawYRiMpKiHSGgGSkY=",
"ref": "main",
"rev": "a2d85675b930ffc26f6891b2e14491795907be4e",
"revCount": 137,
"rev": "ef605857248ec1b60cece250f98d2964164d48db",
"revCount": 19,
"type": "git",
"url": "ssh://gitea@git.sealight.xyz/aynish/grasp.git"
},
@ -227,13 +208,29 @@
"url": "ssh://gitea@git.sealight.xyz/aynish/grasp.git"
}
},
"grasp_2": {
"flake": false,
"locked": {
"lastModified": 1586706168,
"narHash": "sha256-xLkxE24xtTghQpAfAqAsOvsGpz0coACXjNT8bHZhcxM=",
"owner": "karlicoss",
"repo": "grasp",
"rev": "4bc8f011227d1baa18b4e98543561534065490d8",
"type": "github"
},
"original": {
"owner": "karlicoss",
"repo": "grasp",
"type": "github"
}
},
"hardware": {
"locked": {
"lastModified": 1723310128,
"narHash": "sha256-IiH8jG6PpR4h9TxSGMYh+2/gQiJW9MwehFvheSb5rPc=",
"lastModified": 1670174919,
"narHash": "sha256-XdQr3BUnrvVLRFunLWrZORhwYHDG0+9jUUe0Jv1pths=",
"owner": "nixos",
"repo": "nixos-hardware",
"rev": "c54cf53e022b0b3c1d3b8207aa0f9b194c24f0cf",
"rev": "9d87bc030a0bf3f00e953dbf095a7d8e852dab6b",
"type": "github"
},
"original": {
@ -245,16 +242,16 @@
"home-manager": {
"inputs": {
"nixpkgs": [
"agenix",
"nixpkgs"
]
],
"utils": "utils_2"
},
"locked": {
"lastModified": 1703113217,
"narHash": "sha256-7ulcXOk63TIT2lVDSExj7XzFx09LpdSAPtvgtM7yQPE=",
"lastModified": 1670280307,
"narHash": "sha256-3x+0whP1nCz5adQMIsBA3L9fI/ABOpRUJdbw0AmxBnU=",
"owner": "nix-community",
"repo": "home-manager",
"rev": "3bfaacf46133c037bb356193bd2f1765d9dc82c1",
"rev": "2af0d07678fc15612345e0dd55337550dcf6465f",
"type": "github"
},
"original": {
@ -263,118 +260,44 @@
"type": "github"
}
},
"home-manager_2": {
"inputs": {
"nixpkgs": [
"nixpkgs"
]
},
"locked": {
"lastModified": 1720042825,
"narHash": "sha256-A0vrUB6x82/jvf17qPCpxaM+ulJnD8YZwH9Ci0BsAzE=",
"owner": "nix-community",
"repo": "home-manager",
"rev": "e1391fb22e18a36f57e6999c7a9f966dc80ac073",
"type": "github"
},
"original": {
"owner": "nix-community",
"ref": "release-24.05",
"repo": "home-manager",
"type": "github"
}
},
"nix-matrix-appservices": {
"inputs": {
"devshell": "devshell",
"flake-compat": "flake-compat_2",
"nixlib": "nixlib",
"nixpkgs": "nixpkgs"
},
"locked": {
"lastModified": 1683490239,
"narHash": "sha256-QKzpvl2XrqbobWq/I/smDa9hEniwctjJybXPVILHP0w=",
"owner": "coffeetables",
"repo": "nix-matrix-appservices",
"rev": "e795d2fbc61da45d49802bb3e8f8d0c70ddc1e68",
"type": "gitlab"
},
"original": {
"owner": "coffeetables",
"repo": "nix-matrix-appservices",
"type": "gitlab"
}
},
"nixlib": {
"locked": {
"lastModified": 1643502816,
"narHash": "sha256-Wrbt6Gs+hjXD3HUICPBJHKnHEUqiyx8rzHCgvqC1Bok=",
"owner": "divnix",
"repo": "nixpkgs.lib",
"rev": "ebed7ec5bcb5d01e298535989c6c321df18b631a",
"type": "github"
},
"original": {
"owner": "divnix",
"repo": "nixpkgs.lib",
"type": "github"
}
},
"nixos-hardware": {
"locked": {
"lastModified": 1723310128,
"narHash": "sha256-IiH8jG6PpR4h9TxSGMYh+2/gQiJW9MwehFvheSb5rPc=",
"owner": "NixOS",
"repo": "nixos-hardware",
"rev": "c54cf53e022b0b3c1d3b8207aa0f9b194c24f0cf",
"type": "github"
},
"original": {
"owner": "NixOS",
"ref": "master",
"repo": "nixos-hardware",
"type": "github"
}
},
"nixpkgs": {
"locked": {
"lastModified": 1662099760,
"narHash": "sha256-MdZLCTJPeHi/9fg6R9fiunyDwP3XHJqDd51zWWz9px0=",
"owner": "NixOS",
"lastModified": 1670193339,
"narHash": "sha256-oHTAhX4p6+uxcabq0rKL4EyKWPbDLGKec88ocPIU/2Y=",
"owner": "nixos",
"repo": "nixpkgs",
"rev": "67e45078141102f45eff1589a831aeaa3182b41e",
"rev": "e169cf5b3b1e6cc4a25ff15087c2621605f83409",
"type": "github"
},
"original": {
"owner": "NixOS",
"ref": "nixos-22.05",
"owner": "nixos",
"ref": "nixos-22.11",
"repo": "nixpkgs",
"type": "github"
}
},
"nixpkgs_2": {
"locked": {
"lastModified": 1723938990,
"narHash": "sha256-9tUadhnZQbWIiYVXH8ncfGXGvkNq3Hag4RCBEMUk7MI=",
"lastModified": 1662446902,
"narHash": "sha256-Dmsd3jSG2ldZUlhFaIwunqgMf14EEK7ylXpw+OPDLxE=",
"owner": "nixos",
"repo": "nixpkgs",
"rev": "c42fcfbdfeae23e68fc520f9182dde9f38ad1890",
"rev": "3bfaf06b12253ddaafe64a67f4ed39b547d41667",
"type": "github"
},
"original": {
"owner": "nixos",
"ref": "nixos-24.05",
"repo": "nixpkgs",
"type": "github"
}
},
"nur": {
"locked": {
"lastModified": 1724040334,
"narHash": "sha256-Ia4gRRmhFn4oJ4SJKJPDNPomsRRFWU+bqCK7yuiLW4E=",
"lastModified": 1670315682,
"narHash": "sha256-/v0RgZZIjvsFuJbJLUlzRbzSlYFXq3olgJTuJBNtcoY=",
"owner": "nix-community",
"repo": "NUR",
"rev": "24471a48600e18669d13d24c9640b9859357d2cf",
"rev": "af814db16c89385c65e758608296440555f61ccc",
"type": "github"
},
"original": {
@ -385,16 +308,15 @@
},
"poonam": {
"inputs": {
"nixpkgs": [
"nixpkgs"
]
"nixpkgs": "nixpkgs_2",
"vimwiki-cli": "vimwiki-cli"
},
"locked": {
"lastModified": 1731920409,
"narHash": "sha256-bMjdNGoWJXaWIGtfxcODmmrNoONnwN3hS73cDTRC1Pk=",
"lastModified": 1671357603,
"narHash": "sha256-LIathTJK9ElWdjlT+zI+CJFB5adORTM9kYeWqEbKwiU=",
"ref": "main",
"rev": "a87e348a46fd04dbe35ee9accf710eeec42ecbb6",
"revCount": 1530,
"rev": "ea3d0f9a8146f1985dec0b0348a79e3a3038d9b7",
"revCount": 465,
"type": "git",
"url": "ssh://gitea@git.sealight.xyz/aynish/kitaab"
},
@ -409,33 +331,31 @@
"agenix": "agenix",
"basant": "basant",
"deploy-rs": "deploy-rs",
"disko": "disko",
"eww": "eww",
"grasp": "grasp",
"hardware": "hardware",
"home-manager": "home-manager_2",
"nix-matrix-appservices": "nix-matrix-appservices",
"nixos-hardware": "nixos-hardware",
"nixpkgs": "nixpkgs_2",
"home-manager": "home-manager",
"nixpkgs": "nixpkgs",
"nur": "nur",
"poonam": "poonam",
"rust-overlay": "rust-overlay",
"tidalcycles": "tidalcycles",
"unstable": "unstable",
"vimwikicli": "vimwikicli"
"unstable": "unstable"
}
},
"rust-overlay": {
"inputs": {
"flake-utils": "flake-utils_3",
"nixpkgs": [
"nixpkgs"
]
},
"locked": {
"lastModified": 1724034091,
"narHash": "sha256-b1g7w0sw+MDAhUAeCoX1vlTghsqcDZkxr+k9OZmxPa8=",
"lastModified": 1670293639,
"narHash": "sha256-RkPLwza77YkFgxKHGzfYAYVKiD9SeIvsOA7+ihiySwI=",
"owner": "oxalica",
"repo": "rust-overlay",
"rev": "c7d36e0947826e0751a5214ffe82533fbc909bc0",
"rev": "9767af967a0becaa3bb79eeda838dbf81295eb62",
"type": "github"
},
"original": {
@ -447,62 +367,33 @@
"superdirt-src": {
"flake": false,
"locked": {
"lastModified": 1697377840,
"narHash": "sha256-9qU9CHYAXbN1IE3xXDqGipuroifVaSVXj3c/cDfwM80=",
"lastModified": 1611740180,
"narHash": "sha256-GtnqZeMFqFkVhgx2Exu0wY687cHa7mNnVCgjQd6fiIA=",
"owner": "musikinformatik",
"repo": "superdirt",
"rev": "c7f32998572984705d340e7c1b9ed9ad998a39b6",
"rev": "7abb62e89649daa1232b9cbd6427241868abd30e",
"type": "github"
},
"original": {
"owner": "musikinformatik",
"ref": "master",
"repo": "superdirt",
"type": "github"
}
},
"systems": {
"locked": {
"lastModified": 1681028828,
"narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
"owner": "nix-systems",
"repo": "default",
"rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
"type": "github"
},
"original": {
"owner": "nix-systems",
"repo": "default",
"type": "github"
}
},
"systems_2": {
"locked": {
"lastModified": 1681028828,
"narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
"owner": "nix-systems",
"repo": "default",
"rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
"type": "github"
},
"original": {
"owner": "nix-systems",
"repo": "default",
"type": "github"
}
},
"tidal-src": {
"flake": false,
"locked": {
"lastModified": 1712519522,
"narHash": "sha256-LbvxQmVxHElidCgvt+w0g1k+QQbNLebK46vtRCgsLeQ=",
"lastModified": 1654350756,
"narHash": "sha256-tONM5SYYBca0orTLH1EUOilSC1FCluWrFt8AetUx+YQ=",
"owner": "tidalcycles",
"repo": "tidal",
"rev": "88f09edf6bef2228d5f530dea872b08a9d803066",
"rev": "fda9c1ecb3722698935245e5409ef8ccdfca16c8",
"type": "github"
},
"original": {
"owner": "tidalcycles",
"ref": "v1.9.5",
"ref": "main",
"repo": "tidal",
"type": "github"
}
@ -515,15 +406,16 @@
],
"superdirt-src": "superdirt-src",
"tidal-src": "tidal-src",
"utils": "utils_3",
"vim-tidal-src": "vim-tidal-src",
"vowel-src": "vowel-src"
},
"locked": {
"lastModified": 1723223284,
"narHash": "sha256-NAT+g5nsaJZkpR0sCZjerd1xx233ZUdRH3ZWwZhzq/c=",
"lastModified": 1664760044,
"narHash": "sha256-e5LGk/tDnphory1mYhADgPnVtShofY2w/3xY09jEE2A=",
"owner": "mitchmindtree",
"repo": "tidalcycles.nix",
"rev": "82f3e8e8d02eb9f0c9dfe9ab3773b825c6bc1982",
"rev": "3f3a820cd43709077d15a24fa6062de7d623a6bf",
"type": "github"
},
"original": {
@ -534,11 +426,11 @@
},
"unstable": {
"locked": {
"lastModified": 1723637854,
"narHash": "sha256-med8+5DSWa2UnOqtdICndjDAEjxr5D7zaIiK4pn0Q7c=",
"lastModified": 1670152712,
"narHash": "sha256-LJttwIvJqsZIj8u1LxVRv82vwUtkzVqQVi7Wb8gxPS4=",
"owner": "nixos",
"repo": "nixpkgs",
"rev": "c3aa7b8938b17aebd2deecf7be0636000d62a2b9",
"rev": "14ddeaebcbe9a25748221d1d7ecdf98e20e2325e",
"type": "github"
},
"original": {
@ -549,15 +441,42 @@
}
},
"utils": {
"inputs": {
"systems": "systems_2"
},
"locked": {
"lastModified": 1701680307,
"narHash": "sha256-kAuep2h5ajznlPMD9rnQyffWG8EM/C73lejGofXvdM8=",
"lastModified": 1648297722,
"narHash": "sha256-W+qlPsiZd8F3XkzXOzAoR+mpFqzm3ekQkJNa+PIh1BQ=",
"owner": "numtide",
"repo": "flake-utils",
"rev": "4022d587cbbfd70fe950c1e2083a02621806a725",
"rev": "0f8662f1319ad6abf89b3380dd2722369fc51ade",
"type": "github"
},
"original": {
"owner": "numtide",
"repo": "flake-utils",
"type": "github"
}
},
"utils_2": {
"locked": {
"lastModified": 1667395993,
"narHash": "sha256-nuEHfE/LcWyuSWnS8t12N1wc105Qtau+/OdUAjtQ0rA=",
"owner": "numtide",
"repo": "flake-utils",
"rev": "5aed5285a952e0b949eb3ba02c12fa4fcfef535f",
"type": "github"
},
"original": {
"owner": "numtide",
"repo": "flake-utils",
"type": "github"
}
},
"utils_3": {
"locked": {
"lastModified": 1653893745,
"narHash": "sha256-0jntwV3Z8//YwuOjzhV2sgJJPt+HY6KhU7VZUL0fKZQ=",
"owner": "numtide",
"repo": "flake-utils",
"rev": "1ed9fb1935d260de5fe1c2f7ee0ebaae17ed2fa1",
"type": "github"
},
"original": {
@ -569,22 +488,24 @@
"vim-tidal-src": {
"flake": false,
"locked": {
"lastModified": 1685703852,
"narHash": "sha256-8gyk17YLeKpLpz3LRtxiwbpsIbZka9bb63nK5/9IUoA=",
"lastModified": 1664252474,
"narHash": "sha256-hleiK2Q7xYndpB+tIbyyXIM2sk4NunUh9DPgMqmf/Wc=",
"owner": "tidalcycles",
"repo": "vim-tidal",
"rev": "e440fe5bdfe07f805e21e6872099685d38e8b761",
"rev": "b07f5c12986fb837e055d7fcf0acf3b7e248148f",
"type": "github"
},
"original": {
"owner": "tidalcycles",
"ref": "master",
"repo": "vim-tidal",
"type": "github"
}
},
"vimwikicli": {
"vimwiki-cli": {
"inputs": {
"nixpkgs": [
"poonam",
"nixpkgs"
]
},
@ -615,6 +536,7 @@
},
"original": {
"owner": "supercollider-quarks",
"ref": "master",
"repo": "vowel",
"type": "github"
}

149
flake.nix
View file

@ -1,17 +1,13 @@
{
description = "Sealight NixOS Config";
description = "Your new nix config";
inputs = {
# Nixpkgs
nixpkgs.url = "github:nixos/nixpkgs/nixos-24.05";
nixpkgs.url = "github:nixos/nixpkgs/nixos-22.11";
unstable.url = "github:nixos/nixpkgs/nixos-unstable";
nixos-hardware.url = "github:NixOS/nixos-hardware/master";
# ngipkgs.url = "github:Chickensoupwithrice/ngipkgs?ref=aynish/atomic-server-module";
# ngipkgs-local.url = "path:/home/anish/usr/ngipkgs";
# Home manager
home-manager.url = "github:nix-community/home-manager/release-24.05";
home-manager.url = "github:nix-community/home-manager";
home-manager.inputs.nixpkgs.follows = "nixpkgs";
hardware.url = "github:nixos/nixos-hardware";
@ -20,30 +16,25 @@
agenix.inputs.nixpkgs.follows = "nixpkgs";
deploy-rs.url = "github:serokell/deploy-rs";
deploy-rs.inputs.nixpkgs.follows = "nixpkgs";
disko.url = "github:nix-community/disko";
disko.inputs.nixpkgs.follows = "nixpkgs";
# My Packages
# Packages
poonam.url = "git+ssh://gitea@git.sealight.xyz/aynish/kitaab?ref=main";
poonam.inputs.nixpkgs.follows = "nixpkgs";
basant.url = "git+ssh://gitea@git.sealight.xyz/aynish/basant?ref=main";
vimwikicli.url =
"git+ssh://gitea@git.sealight.xyz/aynish/vimwiki-cli?ref=main";
basant.inputs.nixpkgs.follows = "nixpkgs";
basant.inputs.poonam.follows = "poonam";
vimwikicli.inputs.nixpkgs.follows = "nixpkgs";
grasp.url = "git+ssh://gitea@git.sealight.xyz/aynish/grasp.git?ref=main";
grasp.inputs.nixpkgs.follows = "nixpkgs";
# Matrix
nix-matrix-appservices.url = "gitlab:coffeetables/nix-matrix-appservices";
# Others
nur.url = "github:nix-community/NUR";
rust-overlay = {
url = "github:oxalica/rust-overlay";
inputs.nixpkgs.follows = "nixpkgs";
};
eww = {
url = "github:elkowar/eww";
inputs.nixpkgs.follows = "nixpkgs";
inputs.rust-overlay.follows = "rust-overlay";
};
tidalcycles.url = "github:mitchmindtree/tidalcycles.nix";
tidalcycles.inputs.nixpkgs.follows = "unstable";
# TODO hundred rabbits software
@ -55,9 +46,21 @@
# muneem.inputs.nixpkgs.follows = "nixpkgs";
};
outputs = { self, nixpkgs, unstable, nixos-hardware, home-manager, deploy-rs
, agenix, disko, basant, grasp, nix-matrix-appservices, nur, tidalcycles
, rust-overlay, vimwikicli, ... }@inputs:
outputs =
{ self
, nixpkgs
, unstable
, home-manager
, deploy-rs
, agenix
, basant
, grasp
, nur
, tidalcycles
, rust-overlay
, eww
, ...
}@inputs:
let
forAllSystems = nixpkgs.lib.genAttrs [
"aarch64-linux"
@ -71,17 +74,12 @@
unstable = unstable.legacyPackages.${prev.system};
deploy = deploy-rs.packages.${prev.system}.deploy-rs;
};
vimwikiOverlay = final: prev: {
vimwiki-cli = vimwikicli.packages.${prev.system}.vimwiki-cli;
};
nixpkgsFor = forAllSystems (system:
import nixpkgs {
nixpkgsFor = forAllSystems (system: import nixpkgs {
inherit system;
config.allowUnfreePredicate = pkg:
builtins.elem (nixpkgs.lib.getName pkg) [
config.allowUnfreePredicate = pkg: builtins.elem (nixpkgs.lib.getName pkg) [
"ripcord"
"vcv-rack"
"VCV-Rack"
"SunVox"
"renoise"
];
@ -92,42 +90,36 @@
overlays = [
rust-overlay.overlays.default
tidalcycles.overlays.default
agenix.overlays.default
agenix.overlay
nur.overlay
nix-matrix-appservices.overlay
unstableOverlay
vimwikiOverlay
self.overlays.additions
self.overlays.modifications
];
});
# for when space matters
litePkgsFor = forAllSystems (system:
import nixpkgs {
litePkgsFor = forAllSystems (system: import nixpkgs {
inherit system;
# config.permittedInsecurePackages = [
# "forgejo-1.19.4-0" # Needed for archivebox deployments on curve
# # Check when archive box updates it's dependeny
# ];
overlays = [
agenix.overlays.default
self.overlays.additions
self.overlays.modifications
agenix.overlay
tidalcycles.overlays.default # needed for nvim which comes pre-installed lol
];
});
in {
in
{
# Your custom packages
# Acessible through 'nix build', 'nix shell', etc
packages = forAllSystems (system:
let pkgs = nixpkgsFor.${system};
in import ./pkgs { pkgs = pkgs; });
in import ./pkgs { pkgs = pkgs; }
);
# Devshell for bootstrapping
# Acessible through 'nix develop' or 'nix-shell' (legacy)
devShells = forAllSystems (system:
let pkgs = nixpkgsFor.${system};
in import ./shell.nix { pkgs = pkgs; });
in import ./shell.nix { pkgs = pkgs; }
);
# Your custom packages and modifications, exported as overlays
overlays = import ./overlays;
@ -149,12 +141,8 @@
agenix.nixosModules.age
self.nixosModules.backup
self.nixosModules.wireguard
self.nixosModules.wallabag
nixos-hardware.nixosModules.lenovo-thinkpad-x270
home-manager.nixosModules.home-manager
{
nix.registry.nixpkgs.flake = nixpkgs;
nix.registry.unstable.flake = unstable;
home-manager.useGlobalPkgs = true;
home-manager.useUserPackages = true;
home-manager.users.anish = import ./home/gui;
@ -165,18 +153,17 @@
helix = nixpkgs.lib.nixosSystem rec {
specialArgs = { inherit inputs self; };
system = "x86_64-linux";
pkgs = litePkgsFor.${system};
pkgs = nixpkgsFor.${system};
modules = [
./hosts/helix
agenix.nixosModules.age
self.nixosModules.backup
self.nixosModules.wireguard
basant.nixosModule
# self.nixosModules.microbin
disko.nixosModules.disko
home-manager.nixosModules.home-manager
{
nixpkgs.flake.setNixPath = false;
nixpkgs.flake.setFlakeRegistry = false;
home-manager.useGlobalPkgs = true;
home-manager.useUserPackages = true;
home-manager.users.anish = import ./home/core;
}
];
};
@ -190,7 +177,6 @@
agenix.nixosModules.age
self.nixosModules.backup
self.nixosModules.hesienbridge
nix-matrix-appservices.nixosModule
home-manager.nixosModules.home-manager
{
home-manager.useGlobalPkgs = true;
@ -200,6 +186,19 @@
];
};
cube = nixpkgs.lib.nixosSystem rec {
specialArgs = { inherit inputs self; };
system = "x86_64-linux";
pkgs = litePkgsFor.${system};
modules = [
./hosts/cube
agenix.nixosModules.age
self.nixosModules.backup
self.nixosModules.wireguard
basant.nixosModule
];
};
box = nixpkgs.lib.nixosSystem rec {
specialArgs = { inherit inputs self; };
system = "x86_64-linux";
@ -209,17 +208,14 @@
agenix.nixosModules.age
self.nixosModules.backup
self.nixosModules.wireguard
self.nixosModules.gonic
self.nixosModules.gpodder2go
self.nixosModules.wallabag
self.nixosModules.ulogger-server
self.nixosModules.gonic
grasp.nixosModule
home-manager.nixosModules.home-manager
{
nix.registry.nixpkgs.flake = nixpkgs;
home-manager.useGlobalPkgs = true;
home-manager.useUserPackages = true;
home-manager.users.anish = import ./home/dev;
home-manager.users.anish = import ./home/core;
}
];
};
@ -229,47 +225,46 @@
# Available through 'home-manager --flake .#your-username@your-hostname'
homeConfigurations = {
"anish@work" = home-manager.lib.homeManagerConfiguration {
pkgs =
nixpkgsFor."x86_64-linux"; # Home-manager requires 'pkgs' instance
pkgs = nixpkgsFor."x86_64-linux"; # Home-manager requires 'pkgs' instance
extraSpecialArgs = { inherit inputs; };
modules = [ ./home/core.nix ./home/profiles/firefox ];
modules = [
./home/core.nix
./home/profiles/firefox
];
};
};
deploy.nodes = {
box = {
hostname = "mossnet.lan";
autoRollback = false;
magicRollback = false;
remoteBuild = true;
profiles.system = {
user = "root";
path = deploy-rs.lib.x86_64-linux.activate.nixos
self.nixosConfigurations.box;
path = deploy-rs.lib.x86_64-linux.activate.nixos self.nixosConfigurations.box;
};
};
lituus = {
hostname = "sealight.xyz";
# autoRollback = false;
profiles.system = {
user = "root";
path = deploy-rs.lib.x86_64-linux.activate.nixos
self.nixosConfigurations.lituus;
path = deploy-rs.lib.x86_64-linux.activate.nixos self.nixosConfigurations.lituus;
};
};
helix = {
hostname = "git.sealight.xyz";
autoRollback = false;
magicRollback = false;
profiles.system = {
user = "root";
path = deploy-rs.lib.x86_64-linux.activate.nixos
self.nixosConfigurations.helix;
path = deploy-rs.lib.x86_64-linux.activate.nixos self.nixosConfigurations.helix;
};
};
cube = {
hostname = "lakhwara.com";
profiles.system = {
user = "root";
path = deploy-rs.lib.x86_64-linux.activate.nixos self.nixosConfigurations.cube;
};
};
};
checks = builtins.mapAttrs
(system: deployLib: deployLib.deployChecks self.deploy) deploy-rs.lib;
checks = builtins.mapAttrs (system: deployLib: deployLib.deployChecks self.deploy) deploy-rs.lib;
};
}

2
home/core/default.nix
View file

@ -1,9 +1,11 @@
{ self, pkgs, ... }:
{
imports = [
../profiles/nvim
../profiles/cli
../profiles/direnv
../profiles/git
../profiles/task
];
home.stateVersion = "22.05";
}

5
home/dev/default.nix
View file

@ -1,5 +0,0 @@
{ self, pkgs, ... }: {
imports =
[ ../profiles/cli ../profiles/nvim ../profiles/direnv ../profiles/git ];
home.stateVersion = "22.05";
}

4
home/gui/default.nix
View file

@ -2,13 +2,9 @@
{
imports = [
../core
../profiles/nvim
../profiles/firefox
../profiles/desktop
../profiles/email
../profiles/cal
../profiles/sync/kitaab
../profiles/ssh
../profiles/task
];
}

5
home/profiles/cli/bin/clear-vim-trash.sh
View file

@ -1,5 +0,0 @@
#!/usr/bin/env bash
working_directory=$(pwd)
vim_directory="${working_directory//\//%}.vim"
trash "$HOME/.local/share/nvim/sessions/${vim_directory}"

19
home/profiles/cli/dasht-queries.txt
View file

@ -1,19 +0,0 @@
`dasht-docsets-intstall`
Bash
Clojure
Docker
Elixir
HTML
JavaScript
Jinja
Lua_5.4
Nginx
OpenGL_4
PostgreSQL
Processing
Python_3
React
Rust
TypeScript
Vim

155
home/profiles/cli/default.nix
View file

@ -7,7 +7,6 @@
dasht
dosfstools
#git
git-machete
bottom
gptfdisk
starship
@ -27,12 +26,10 @@
iftop
wget
curl
eza
exa
bat
fd
ncdu
du-dust
# dia-cli
duf
trash-cli
nix-index
@ -54,19 +51,16 @@
gdb
xxd
taskwarrior
yt-dlp
gnupg
syncthing
dijo
#ssb-patchwork
fontconfig
pandoc
taskwarrior-tui
python3Packages.howdoi
vimwiki-cli
(pkgs.writeScriptBin "jq-repl" ''
#!/usr/bin/env bash
if [[ -z $1 ]] || [[ $1 == "-" ]]; then
if [[ -z $1 ]] || [[ $1 == "-" ]] then
input=$(mktemp)
trap "rm -f $input" EXIT
cat /dev/stdin > $input
@ -76,9 +70,16 @@
echo "" \ | fzf --phony --preview-window="up:90%" --print-query --preview "jq --color-output -r {q} $input"
'')
(pkgs.writeScriptBin "clear-vim-trash" (builtins.readFile ./bin/clear-vim-trash.sh))
(pkgs.writeScriptBin "flakify" ''
#!/usr/bin/env zsh
];
programs.zsh = {
enable = true;
enableCompletion = true;
enableAutosuggestions = true;
initExtra = ''
bindkey -v
flakify() {
if [ ! -e flake.nix ]; then
nix flake new -t github:nix-community/nix-direnv .
elif [ ! -e .envrc ]; then
@ -86,54 +87,10 @@
direnv allow
fi
vim flake.nix
'')
(pkgs.writeScriptBin "mx" ''
#!/usr/bin/env bash
}
mx() {
manix "" | grep '^# ' | sed 's/^# \(.*\) (.*/\1/;s/ (.*//;s/^# //' | fzf --preview="manix '{}'" | xargs manix
'')
(pkgs.writeScriptBin "monitor" ''
# hotplug
connect() {
# Turn it on if it was off
xrandr --output HDMI-2 --auto
xrandr --output HDMI-2 --same-as eDP-1
}
disconnect() {
xrandr --output HDMI-2 --off
}
xrandr | grep "HDMI-2 connected" &>>/dev/null && connect || disconnect
'')
(pkgs.writeScriptBin "disconnect-keyboard" ''
# keyboard on curve is busted
get_keyboard_id() {
xinput list | grep 'AT Translated Set' | cut -f2 | cut -d'=' -f2 | xinput float
}
disconnect_keyboard() {
id=$(get_keyboard_id)
xinput float $id
unset id
}
attach_keyboard() {
id=$(get_keyboard_id)
xinput reattach $id 3
unset id
}
disconnect_keyboard
'')
];
programs.zsh = {
enable = true;
enableCompletion = true;
autosuggestion.enable = false;
initExtra = ''
bindkey -v
autopair-init
'';
sessionVariables = {
@ -141,6 +98,15 @@
TERMINFO_DIRS = "${pkgs.kitty.terminfo.outPath}/share/terminfo"; # Needed to run home-manager switch on non-nixOS
};
plugins = [
# {
# name = "zsh-autocomplete";
# src = pkgs.fetchFromGitHub {
# owner = "marlonrichert";
# repo = "zsh-autocomplete";
# rev = "22.01.21";
# sha256 = "+UziTYsjgpiumSulrLojuqHtDrgvuG91+XNiaMD7wIs=";
# };
# }
{
name = "zsh-autopair";
src = pkgs.fetchFromGitHub {
@ -171,16 +137,16 @@
};
file = "zsh-autoquoter.zsh";
}
# {
# name = "zsh-nix-shell";
# file = "nix-shell.plugin.zsh";
# src = pkgs.fetchFromGitHub {
# owner = "chisui";
# repo = "zsh-nix-shell";
# rev = "v0.5.0";
# sha256 = "0za4aiwwrlawnia4f29msk822rj9bgcygw6a8a6iikiwzjjz0g91";
# };
# }
{
name = "zsh-nix-shell";
file = "nix-shell.plugin.zsh";
src = pkgs.fetchFromGitHub {
owner = "chisui";
repo = "zsh-nix-shell";
rev = "v0.5.0";
sha256 = "0za4aiwwrlawnia4f29msk822rj9bgcygw6a8a6iikiwzjjz0g91";
};
}
];
};
@ -198,6 +164,7 @@
enable = true;
enableZshIntegration = true;
nix-direnv.enable = true;
# nix-direnv.enableFlakes = true; always enabled
};
programs.zoxide = {
@ -214,14 +181,13 @@
"...." = "cd ../../..";
"....." = "cd ../../../..";
icat = "kitty +kitten icat";
yt = "ytfzf -T kitty -t ";
gen-secret = "< /dev/urandom tr -dc _A-Z-a-z-0-9 | head -c\${1:-32};echo;";
# kitaab recents
kr = "cd /home/anish/kitaab/vimwiki; ls --sort=modified --reverse | fzf --preview 'bat --style=numbers --color=always --terminal-width -1 {}'";
# modern cli tools
ls = "eza --icons";
l = "esa -l --icons";
la = "eza -la --icons";
ls = "exa --icons";
l = "exa -l --icons";
la = "exa -la --icons";
tree = "ls --tree --icons";
cat = "bat";
unzip = "aunpack";
@ -232,25 +198,19 @@
make-secret = "< /dev/urandom \\tr -dc _A-Za-z0-9 | head -c \${1:-32};echo;";
# task warrior
t = "task -BLOCKED -idea -backlog";
tw = "t rc.context:work";
# TODO find a reasonable way to manage this from a non-nix managed file in ~/.task/context or something
# we can do something like task rc.context:$(cat ~/.task/context) to read context
# and write a little script make-context = cat $@ > ~/.task/context or something
tt = "taskwarrior-tui -r list";
ti = "task +idea";
tb = "task +backlog list";
ttb = "taskwarrior-tui -r backlog";
# TODO: make blocked a context?
t = "task -BLOCKED";
tin = "task in";
tun = "task -BLOCKED -wait";
tb = "task list +backlog";
tr = "task newest limit:page";
twait = "task +wait";
tu = "task unblocked -wait";
tl = "task list";
ta = "task add";
tai = "task add +idea";
tai = "task add +in";
tn = "task-note";
tp = "task limit:page";
ts = "task sync";
# taskwarrior task lists
twt = "task tags +PENDING | tail -n +4 | cut -d ' ' -f1 | fzf --preview 'task +{}'";
# task warrior projects list
tp = "task projects +PENDING | tail -n +4 | head -n -2 | cut -d ' ' -f1 | fzf --preview 'task pro:{}'";
# keeping for posterity but now sxhkbd handles screenshot with <Super+O>
# scrot = "flameshot screen -c -p ~/screenshots/";
@ -275,12 +235,12 @@
nf = "n flake";
nfl = "nf lock";
nepl = "n repl '<nixpkgs>'";
srch = "ns nixpkgs";
srch = "ns nixos";
orch = "ns override";
nrb = "cd /tmp; sudo nixos-rebuild switch --flake '/home/anish/usr/helm#curve'; cd $OLDPWD";
nrt = "cd /tmp; sudo nixos-rebuild test --flake '/home/anish/usr/helm#curve'; cd $OLDPWD";
ned = "cd /home/anish/usr/helm; vim; cd $OLDPWD";
ncd = "cd /home/anish/usr/helm";
nrb = "cd /tmp; sudo nixos-rebuild switch --flake '/etc/nixos/#curve'; cd $OLDPWD";
nrt = "cd /tmp; sudo nixos-rebuild test --flake '/etc/nixos/#curve'; cd $OLDPWD";
ned = "cd /etc/nixos; vim; cd $OLDPWD";
ncd = "cd /etc/nixos";
mn = ''
manix "" | grep '^# ' | sed 's/^# \(.*\) (.*/\1/;s/ (.*//;s/^# //' | sk --preview="manix '{}'" | xargs manix
'';
@ -305,11 +265,10 @@
jtl = "journalctl";
# quick ssh
kssh = "kitty +kitten ssh";
kssh = "kitten +kitty ssh";
smm = "ssh 10.0.69.4"; # box over wireguard
sm = "ssh mossnet.lan"; # box regular
sl = "ssh sealight.xyz"; # lituus
sh = "ssh git.sealight.xyz"; # helix
sb = "ssh cyberian@69.61.38.246"; # bonfire for allwell
ss = "ssh sealight.xyz"; # helix
# sl = "ssh 69.61.38.225"; # lituus has become helix
};
}

0
home/profiles/desktop/Xresources Executable file → Normal file
View file

71
home/profiles/desktop/bin/bspswallow
View file

@ -1,71 +0,0 @@
#!/bin/sh
# Get class of a wid
get_class() {
id=$1
if [ -z "$id" ]; then
echo ""
else
xprop -id "$id" | sed -n \
-e '/WM_CLASS/s/\( "\)/\n/g; s/[^\n]*\n\([^"]*\)[^\n]*/\1\n/g' \
-e '/WM_COMMAND/s/[^"]*/\n\n/1; s/\n"//1; s/\n\([^"]*\)".*/\n\1/; /\n/p' | sed '/^$/d' | head -n1
fi
}
get_pid() {
xprop _NET_WM_PID -id "$1" | awk '/[0-9]+/ {print $3}'
}
get_ppid() {
ps -o ppid= -p $1
}
check_swallowing_process() {
pid=$(get_pid $1)
[ -z $pid ] && return 0
gppid=$(get_ppid $(get_ppid $pid))
grep -i "^$(ps -o cmd= -p $gppid | awk '{print $1}' | sed 's_^.*/__')$" ~/.config/bspwm/terminals && return 0
[ "$(get_ppid "$(get_ppid "$(get_pid "$1")")")" = "$(get_pid "$2")" ] && return 0 || return 1
}
swallow() {
addedtodesktop=$2
lasttermdesktop=$(bspc query -D -n last)
swallowerid=$1
swallowingid=$(bspc query -N -n last)
if [ "$addedtodesktop" = "$lasttermdesktop" ] && check_swallowing_process "$swallowerid" "$swallowingid"; then
grep -q "^$(get_class "$swallowerid")$" ~/.config/bspwm/{noswallow, terminals} && return
grep -i "^$(get_class "$swallowingid")$" ~/.config/bspwm/terminals || return
echo "$swallowerid $swallowingid" >> /tmp/swallowids
bspc node "$swallowingid" --flag hidden=on
fi
}
spit() {
spitterid=$1
spitterdesktop=$2
grep "^$spitterid" /tmp/swallowids || return
spittingid=$(grep "^$spitterid" /tmp/swallowids | head -n1 | awk '{print $2}')
bspc node "$spittingid" --flag hidden=off
termdesktop=$(bspc query -D -n "$spittingid")
[ "$termdesktop" = "$spitterdesktop" ] || bspc node "$spittingid" -d "$spitterdesktop"
bspc node "$spittingid" -f
sed -i "/^$spitterid/d" /tmp/swallowids
}
bspc subscribe node_add node_remove | while read -r event
do
case $(echo "$event" | awk '{ print $1 }') in
node_add)
swallow $(echo "$event" | awk '{print $5 " " $3}')
;;
node_remove)
spit $(echo "$event" | awk '{print $4 " " $3}')
;;
esac
done

15
home/profiles/desktop/bin/ku
View file

@ -1,15 +0,0 @@
#!/usr/bin/env bash
# get into a shell that has poonam
cd ~/kitaab || exit;
nix develop;
# Use fzf to select a file and capture the output
selected_file=$(${pkgs.poonam}/main report --titles=false | head -n -2 | fzf --preview 'bat --color=always --terminal-width -1 ./vimwiki/{}')
echo $selected_file
# Add additional details to the file path
# file_path="./vimwiki/${selected_file}"
#
# # Open the file in vim for editing
# vim "${file_path}"
#

1
home/profiles/desktop/bin/paste
View file

@ -1 +0,0 @@
curl -F "content=$(xclip -o)" -X POST https://bin.sealight.xyz/upload

12
home/profiles/desktop/bin/powermenu
View file

@ -5,9 +5,9 @@ rofi_command="rofi -theme theme/powermenu.rasi"
### Options ###
power_off="\tShutdown"
reboot="\tReboot"
lock="\tLock"
suspend="󰤄\tSleep"
log_out="󰍃\tLogout"
lock="\tLock"
suspend="鈴\tSleep"
log_out="\tLogout"
# Variable passed to rofi
options="$power_off\n$reboot\n$lock\n$suspend\n$log_out"
@ -18,14 +18,14 @@ case "$(echo -e "$options" | $rofi_command -dmenu)" in
" Reboot")
systemctl reboot
;;
" Lock")
" Lock")
dm-tool lock
;;
"󰤄 Sleep")
"鈴 Sleep")
dbus-send --print-reply --dest=org.mpris.MediaPlayer2.spotify /org/mpris/MediaPlayer2 org.mpris.MediaPlayer2.Player.Pause
systemctl suspend
;;
"󰍃 Logout")
" Logout")
bspc quit
;;
esac

13
home/profiles/desktop/bin/screenshot
View file

@ -3,12 +3,11 @@
timer=5
# Options
select="󰩭 "
window=" "
screen=" "
record=" "
delay="󱑃 "
cancel="󰜺 "
select="麗"
window="类"
screen=""
delay=""
cancel=""
# Variable passed to rofi
options="$select\n$window\n$screen\n$delay\n$cancel"
@ -51,6 +50,4 @@ case $chosen in
| tee $filepath | xclip -selection c -t image/png
notify
;;
$record)
kooha
esac

5
home/profiles/desktop/bspwmrc
View file

@ -39,10 +39,7 @@ bspc rule -a Pinentry state=floating center=on
bspc rule -a Firefox state=fullscreen
bspc rule -a feh state=fullscreen
# bspswallow
pgrep bspswallow || bspswallow &
# polybar
for file in "$XDG_CONFIG_HOME"/bspwm/rc.d/*; do
for file in $XDG_CONFIG_HOME/bspwm/rc.d/*; do
source "$file"
done

164
home/profiles/desktop/default.nix
View file

@ -29,104 +29,8 @@ in
kitty
libreoffice
inotify-tools
offpunk
termpdfpy
libsForQt5.kontact
thunderbird
];
# GTK4 color scheme?
dconf.settings = {
"org/gnome/desktop/interface" = {
color-scheme = "prefer-dark";
};
};
# Move required config files around
xdg.enable = true; # This doesn't seem to do anything so we have below
xdg.configHome = "/home/anish/.config"; # TODO bad hardcode
xdg.configFile = {
"Kvantum/Dracula/Dracula.kvconfig".source = "${dracula-gtk}/kde/kvantum/Dracula-purple-solid/Dracula-purple-solid.kvconfig";
"Kvantum/Dracula/Dracula.svg".source = "${dracula-gtk}/kde/kvantum/Dracula-purple-solid/Dracula-purple-solid.svg";
"Kvantum/kvantum.kvconfig".text = "[General]\ntheme=Dracula";
};
xdg.mimeApps.defaultApplications = {
};
home.file = {
".config/bspwm/rc.d/polybar".source = ./run.sh;
".config/bspwm/bspwmrc".source = ./bspwmrc;
".config/sxhkdrc".source = ./sxhkdrc;
".config/rofi/theme" = {
source = ./rofi;
recursive = true;
};
".config/polybar" = {
source = ./polybar;
recursive = true;
};
".config/dunst/dunstrc".source = ./dunstrc;
".config/kitty/kitty.conf".source = ./kitty.conf;
".config/kitty/ayu.conf".source = ./ayu-kitty.conf;
".config/zathura/zathurarc".source = ./zathurarc;
".background-image".source = ./background.jpg;
#gtk4 theme
".config/gtk-4.0/settings.ini".text = ''
[Settings]
gtk-application-prefer-dark-theme=1
'';
# gtk3 theme
".config/gtk-3.0/settings.ini".text = ''
[Settings]
gtk-theme-name=Dracula
gtk-icon-theme-name=Paper
gtk-cursor-theme-name=Capitaine Cursors - White
gtk-fallback-icon-theme=gnome
gtk-application-prefer-dark-theme=1
gtk-xft-hinting=1
gtk-xft-hintstyle=hintfull
gtk-xft-rgba=none
'';
# GTK2 global theme (widget and icon theme)
".config/gtk-2.0/gtkrc".text = ''
gtk-theme-name=Ayu-Mirage
gtk-icon-theme-name=Capitaine Cursors - White
gtk-font-name="Sans 10"
'';
".local/bin/passmenu".source = ./bin/passmenu;
".local/bin/paste".source = ./bin/paste;
".local/bin/bluetoothmenu".source = ./bin/bluetoothmenu;
".local/bin/wifimenu".source = ./bin/wifimenu;
".local/bin/powermenu".source = ./bin/powermenu;
".local/bin/screenshot".source = ./bin/screenshot;
".local/bin/mpv-ify".source = ./bin/mpv-ify;
".local/bin/bspswallow".source = ./bin/bspswallow;
".config/bspwm/terminals".text = "Kitty";
# ".local/bin/hotplug-monitor.sh".source = ./bin/hotplug-monitor.sh;
};
xdg.desktopEntries = {
ocr = {
name = "OCR image";
exec = "${pkgs.writeScript "ocr" ''
${pkgs.xfce.xfce4-screenshooter}/bin/xfce4-screenshooter -r --save /tmp/ocr-tmp.png
${pkgs.tesseract}/bin/tesseract /tmp/ocr-tmp.png | ${pkgs.xclip}/bin/xclip -sel clip
rm /tmp/ocr-tmp.png
''}";
};
screenshot = {
name = "Screenshot";
exec = "screenshot";
};
};
qt = {
enable = true;
platformTheme.name = "gtk";
style = { name = "qt5ct-style"; };
};
# set up env
xsession.enable = true;
@ -162,10 +66,67 @@ in
"*.colorBD" = "#e6e1cf";
};
programs.autorandr.enable = true;
services.udiskie.automount = true;
# Move required config files around
xdg.enable = true; # This doesn't seem to do anything so we have below
xdg.configHome = "/home/anish/.config"; # TODO bad hardcode
xdg.configFile = {
"Kvantum/Dracula/Dracula.kvconfig".source = "${dracula-gtk}/kde/kvantum/Dracula-purple-solid/Dracula-purple-solid.kvconfig";
"Kvantum/Dracula/Dracula.svg".source = "${dracula-gtk}/kde/kvantum/Dracula-purple-solid/Dracula-purple-solid.svg";
"Kvantum/kvantum.kvconfig".text = "[General]\ntheme=Dracula";
};
home.file = {
".config/bspwm/rc.d/polybar".source = ./run.sh;
".config/bspwm/bspwmrc".source = ./bspwmrc;
".config/sxhkdrc".source = ./sxhkdrc;
".config/rofi/theme" = {
source = ./rofi;
recursive = true;
};
".config/polybar" = {
source = ./polybar;
recursive = true;
};
".config/dunst/dunstrc".source = ./dunstrc;
".config/kitty/kitty.conf".source = ./kitty.conf;
".config/kitty/ayu.conf".source = ./ayu-kitty.conf;
".config/zathura/zathurarc".source = ./zathurarc;
".background-image".source = ./background.jpg;
# gtk3 theme
".config/gtk-3.0/settings.ini".text = ''
[Settings]
gtk-theme-name=Dracula
gtk-icon-theme-name=Paper
gtk-cursor-theme-name=Capitaine Cursors - White
gtk-fallback-icon-theme=gnome
gtk-application-prefer-dark-theme=true
gtk-xft-hinting=1
gtk-xft-hintstyle=hintfull
gtk-xft-rgba=none
'';
# GTK2 global theme (widget and icon theme)
".config/gtk-2.0/gtkrc".text = ''
gtk-theme-name=Ayu-Mirage
gtk-icon-theme-name=Capitaine Cursors - White
gtk-font-name="Sans 10"
'';
# TODO hardcoded
".local/bin/passmenu".source = ./bin/passmenu;
".local/bin/bluetoothmenu".source = ./bin/bluetoothmenu;
".local/bin/wifimenu".source = ./bin/wifimenu;
".local/bin/powermenu".source = ./bin/powermenu;
".local/bin/screenshot".source = ./bin/screenshot;
".local/bin/mpv-ify".source = ./bin/mpv-ify;
".config/eww/eww.yuck".source = ./eww/eww.yuck;
".config/eww/eww.scss".source = ./eww/eww.scss;
".config/eww/widgets.yuck".source = ./eww/widgets.yuck;
# ".local/bin/hotplug-monitor.sh".source = ./bin/hotplug-monitor.sh;
};
services.mpris-proxy.enable = true; # bluetooth media control
qt = {
enable = true;
platformTheme = "gtk";
style = { name = "qt5ct-style"; };
};
# Compositor
# services.picom = {
@ -188,4 +149,9 @@ in
# corner-radius = 3
# '';
# };
programs.autorandr.enable = true;
services.udiskie.automount = true;
services.mpris-proxy.enable = true; # bluetooth media control
}

2
home/profiles/desktop/dunstrc
View file

@ -35,7 +35,7 @@
origin = top-right
# Offset from the origin
offset = 12x36
offset = 18x36
# Scale factor. It is auto-detected if value is 0.
scale = 0

6
home/profiles/desktop/kitty.conf
View file

@ -1,13 +1,11 @@
include ayu.conf
font_family Hermit
font_size 13
bold_font auto
italic_font auto
bold_italic_font auto
open_url_with default
mouse_map left click ungrabbed mouse_click_url_or_select
confirm_os_window_close 0
enable_audio_bell no
-- Allows zen-mode.nvim to increase font size
-- allow_remote_control socket-only
-- listen_on unix:/tmp/kitty
allow_remote_control socket-only
listen_on unix:/tmp/kitty

86
home/profiles/desktop/polybar/config
View file

@ -34,6 +34,9 @@ fixed-center = true
width = 100%
height = 34
offset-x =
offset-y =
; Background ARGB color (e.g. #f00, #ff992a, #ddff1023)
background = ${colors.bg}
@ -55,15 +58,14 @@ padding-left = 0
module-margin = 0
margin-bottom = 34
font-0 = "Iosevka Nerd Font,Iosevka NF:pixelsize=10;1" ; Icon Size
font-1 = "Iosevka Nerd Font,Iosevka NF:pixelsize=12;4" ; Large Text font
font-2 = "FiraCode Nerd Font:pixelsize=12;2"
font-3 = "Siji:pixelsize=10;2"
font-4 = "Iosevka Nerd Font,Iosevka NF:pixelsize=8;1" ; Small Icon Size
font-0 = "Iosevka Term:pixelsize=13;4"
font-1 = "Iosevka Term:pixelsize=6;1"
font-2 = "Fira Code:pixelsize=13;2"
font-3 = "Siji:pixelsize=8;2"
; Add module mpd for artist - title info
modules-left = bspwm sps volume
; modules-center = title
modules-center = title
modules-right = wireless-network sps battery sps memory sps cpu sps date
; The separator will be inserted between the output of each module
@ -114,11 +116,11 @@ type = internal/bspwm
pin-workspaces = true
enable-click = true
ws-icon-0 = 1;%{T2} %{T-}
ws-icon-1 = 2;%{T2} %{T-}
ws-icon-2 = 3;%{T2}󰺻 %{T-}
ws-icon-3 = 4;%{T2} %{T-}
ws-icon-4 = 5;%{T2} %{T-}
ws-icon-0 = 1;%{T1}%{T-}
ws-icon-1 = 2;%{T1}%{T-}
ws-icon-2 = 3;%{T1}%{T-}
ws-icon-3 = 4;%{T1}%{T-}
ws-icon-4 = 5;%{T1}%{T-}
ws-icon-default = 
; fuzzy-match = true
@ -155,14 +157,14 @@ interval = 1.0
; See "http://en.cppreference.com/w/cpp/io/manip/put_time" for details on how to format the date string
; NOTE: if you want to use syntax tags here you need to use %%{...}
date = %{T2} %{T-}%{T1} %d/%a%{T-}
date = %{T1}%{T-}%{T2} %d/%a%{T-}
; Optional time format
time = %{T2} %H:%M%{T-}
; if `date-alt` or `time-alt` is defined, clicking
; the module will toggle between formats
date-alt = %{T2} %{T-} %{T1} %a, %d %b %y%{T-}
date-alt = %{T1}%{T-}%{T2} %a, %d %b %y%{T-}
time-alt = %{T2} %H:%M:%S%{T-}
label = %date%%time%
@ -175,12 +177,11 @@ interface = wlp3s0
label-connected = %essid%
label-connected-font = 2
format-connected = <ramp-signal> <label-connected>
format-connected = <ramp-signal><label-connected>
label-connected-foreground = #82b414
format-disconnected = <label-disconnected>
label-disconnected = "󰖪"
label-disconnected = "睊"
label-disconnected-foreground = #f92672
ramp-signal-foreground = #82b414
@ -198,7 +199,7 @@ type = internal/cpu
; Default: 1
interval = 0.5
label = %{T2} %{T-}%{T1} %percentage:2%%%{T-}
label = %{T1}%{T-}%{T2} %percentage:2%%%{T-}
label-foreground = ${colors.cyan}
@ -228,7 +229,7 @@ format = <label>
; %gb_swap_free%
; %gb_swap_used%
label = %{T2}󰍛 %{T-}%{T1} %gb_used%%{T-}
label = %{T1}%{T-}%{T2} %gb_used%%{T-}
label-foreground = ${colors.cyan}
@ -276,6 +277,38 @@ type = custom/text
content = " "
content-padding = 0
[module/network]
type = internal/network
interface = wlp3s0
;enp0s29u1u2
interval = 1.0
label-connected = "%{T1}龍%{T-}%{T2} %downspeed% | %upspeed%%{T-}"
label-disconnected = "%{T2}0/0%{T-}"
label-connected-background = ${colors.bg}
label-connected-foreground = ${colors.blue}
label-disconnected-foreground = ${colors.red}
[module/title]
type = internal/xwindow
; Available tags:
; <label> (default)
format = <label>
format-background = ${colors.bg}
format-foreground = ${colors.green}
format-padding = 4
; Available tokens:
; %title%
; Default: %title%
label = "%{T1}类%{T-}%{T2} %title%%{T-}"
label-maxlen = 65
; Used instead of label when there is no window title
; Available tokens:
; None
label-empty =%{T2}Empty%{T-}
label-empty-foreground = #707880
[module/volume]
type = internal/pulseaudio
@ -283,7 +316,7 @@ use-ui-max = false
interval = 5
format-volume = <ramp-volume> <bar-volume>
format-volume = <ramp-volume><bar-volume>
format-muted = <label-muted>
format-muted-prefix = "  "
@ -299,13 +332,13 @@ label-muted-foreground = ${colors.mauve}
bar-volume-width = 8
bar-volume-gradient = false
bar-volume-indicator = |
bar-volume-indicator-font = 6
bar-volume-indicator-font = 2
bar-volume-indicator-foreground = ${colors.mauve}
bar-volume-fill = ─
bar-volume-fill-font = 6
bar-volume-fill-font = 2
bar-volume-fill-foreground = ${colors.mauve}
bar-volume-empty = ─
bar-volume-empty-font = 6
bar-volume-empty-font = 2
bar-volume-empty-foreground = ${colors.fg-alt}
ramp-volume-0 = "  "
@ -337,19 +370,19 @@ battery = BAT0
poll-interval = 2
time-format = %H:%M
format-charging = <animation-charging> <label-charging>
format-charging = <animation-charging><label-charging>
format-charging-prefix =
format-discharging = <ramp-capacity> <label-discharging>
format-discharging = <ramp-capacity><label-discharging>
format-full = <label-full>
format-full-prefix = " "
format-full-prefix-font = 2
format-full-prefix-font = 1
format-full-prefix-foreground = ${colors.sky}
label-charging = "%percentage%% "
label-discharging = "%percentage%% "
label-full = "%percentage%%"
label-full = "%percentage%% "
label-charging-foreground = ${colors.sky}
label-discharging-foreground = ${colors.sky}
@ -376,4 +409,3 @@ animation-charging-foreground = ${colors.sky}
animation-charging-framerate = 750
;; _-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_

0
home/profiles/desktop/polybar/run.sh Executable file → Normal file
View file

2
home/profiles/desktop/rofi/appmenu.rasi
View file

@ -2,7 +2,7 @@
@import "config.rasi"
textbox-icon {
str: "󱎂 ";
str: " ";
}
prompt {

3
home/profiles/desktop/sxhkdrc
View file

@ -27,9 +27,6 @@ super + Tab
super + e
rofimoji --selector-args "-theme theme/emojimenu.rasi" --skin-tone moderate --action copy
super + a
paste
super + p
passmenu

4
home/profiles/email/default.nix
View file

@ -20,7 +20,7 @@
programs.msmtp.enable = true;
programs.notmuch.enable = true;
home.file.".mailcap".text = ''
text/html; firefox %s
text/html; browsh %s
application/pdf; zathura %s
image/png; feh %s
image/jpeg; feh %s
@ -175,7 +175,7 @@
bind editor ^T complete
# Press A to archive
macro index,pager A "<clear-flag><save-message>=/Archive" "mark message as Archived"
macro index,pager A "<clear-flag>N<save-message>=/Archive" "mark message as Archived"
# Press C to add contact to Khard address book
macro index,pager C \
"<pipe-message>khard add-email<return>" \

16
home/profiles/firefox/default.nix
View file

@ -13,15 +13,10 @@
#env.XDG_DEXSTOP_DIR = "$HOME/";
programs.firefox = {
enable = true;
profiles.anish = {
id = 0;
isDefault = true;
name = "anish";
userChrome = (builtins.readFile ./userChrome.css);
extensions = with pkgs.nur.repos.rycee.firefox-addons; [
# Find extensions: https://github.com/nix-community/nur-combined/blob/master/repos/rycee/pkgs/firefox-addons/generated-firefox-addons.nix
ublock-origin
# wallabagger
wallabagger
# tree-style-tab
tridactyl
promnesia
@ -43,10 +38,12 @@
meta = { };
})
];
profiles.anish = {
id = 0;
isDefault = true;
name = "anish";
userChrome = (builtins.readFile ./userChrome.css);
settings = {
"browser.zoom.siteSpecific" = false;
"zoom.minPercent" = "150"; # TODO doesn't seem to work anymore, you have to manually go into preferences and set the zoom level.
"devtools.theme" = "dark";
# Enable userContent.css and userChrome.css for our theme modules
"toolkit.legacyUserProfileCustomizations.stylesheets" = true;
@ -54,7 +51,6 @@
"browser.download.dir" = "/home/anish/downloads"; # TODO Don't hardcode this!
# Don't use the built-in password manager; a nixos user is more likely
# using an external one (you are using one, right?).
# I am, but it's far too convienent. I'm enabling 2FA anyway so w/e
#"signon.rememberSignons" = false;
# Do not check if Firefox is the default browser
"browser.shell.checkDefaultBrowser" = false;

1
home/profiles/git/default.nix
View file

@ -49,7 +49,6 @@
".tmp"
".direnv"
"result"
"node_modules/"
];
extraConfig = {

191
home/profiles/nvim/default.nix
View file

@ -19,16 +19,7 @@ let
sha256 = "rs3NTZwWdsmBGXnrgUeVxUiNjbN/ULxJHifPYJD9mT4=";
};
};
my-lspsaga = pkgs.vimUtils.buildVimPlugin {
name = "lspsaga.nvim";
src = pkgs.fetchFromGitHub {
owner = "glepnir";
repo = "lspsaga.nvim";
rev = "b7b4777369b441341b2dcd45c738ea4167c11c9e";
sha256 = "sciX/fMxzY1YOxXxjj1+ymrdMi451avcFFu+14R+/pk=";
};
};
nvim-luapad = pkgs.vimUtils.buildVimPlugin {
nvim-luapad = pkgs.vimUtils.buildVimPluginFrom2Nix {
name = "nvim-luapad";
src = pkgs.fetchFromGitHub {
owner = "rafcamlet";
@ -37,7 +28,7 @@ let
sha256 = "gMaS5YFi3+gmUIfkCMEt9vhm8XSgv54Cquv5+WCWeTo=";
};
};
leap = pkgs.vimUtils.buildVimPlugin {
leap = pkgs.vimUtils.buildVimPluginFrom2Nix {
name = "leap";
src = pkgs.fetchFromGitHub {
owner = "ggandor";
@ -55,7 +46,7 @@ let
sha256 = "vX7ZVJxgatIicmijehtaRvyHxk1i4gFfXrbPM/+VoFc=";
};
};
my-which-key-nvim = pkgs.vimUtils.buildVimPlugin {
my-which-key-nvim = pkgs.vimUtils.buildVimPluginFrom2Nix {
pname = "which-key.nvim";
version = "2022-05-04";
src = pkgs.fetchFromGitHub {
@ -66,7 +57,17 @@ let
};
meta.homepage = "https://github.com/folke/which-key.nvim/";
};
scnvim = pkgs.vimUtils.buildVimPlugin {
my-conjure = pkgs.vimUtils.buildVimPluginFrom2Nix {
pname = "conjure";
version = "2022-05-04";
src = pkgs.fetchFromGitHub {
owner = "olical";
repo = "conjure";
rev = "2e7f449d06753f2996e186954e96afc60edd5862";
sha256 = "ZV0vPYiZI5/3Isw2l7rrLuiO+kA9G0vrA6OxHFkLTFw=";
};
};
scnvim = pkgs.vimUtils.buildVimPluginFrom2Nix {
pname = "scnvim";
version = "2022-06-04";
src = pkgs.fetchFromGitHub {
@ -76,7 +77,7 @@ let
sha256 = "kvSwS6FNUY2Ue84NhWLLcm0ldLMSp4WqQ7s6TUoX6Cc=";
};
};
yuck-vim = pkgs.vimUtils.buildVimPlugin {
yuck-vim = pkgs.vimUtils.buildVimPluginFrom2Nix {
pname = "yuck.vim";
version = "2021-08-09";
src = pkgs.fetchFromGitHub {
@ -86,7 +87,7 @@ let
sha256 = "lp7qJWkvelVfoLCyI0aAiajTC+0W1BzDhmtta7tnICE=";
};
};
nvim-parinfer = pkgs.vimUtils.buildVimPlugin {
nvim-parinfer = pkgs.vimUtils.buildVimPluginFrom2Nix {
pname = "nvim-parinfer";
version = "v1.2.0";
src = pkgs.fetchFromGitHub {
@ -96,7 +97,7 @@ let
sha256 = "Dlzfp3CZTzq8zQeHByWf3ER6/Em+KNGYNI4Z17ui8Lc=";
};
};
my-marks = pkgs.vimUtils.buildVimPlugin {
my-marks = pkgs.vimUtils.buildVimPluginFrom2Nix {
pname = "marks";
version = "2022-08-31";
src = pkgs.fetchFromGitHub {
@ -106,7 +107,7 @@ let
sha256 = "XdbgIWuAHNdTfyKDrKmQVq5oSbBoi56DpwtgOqhScAk=";
};
};
my-fterm = pkgs.vimUtils.buildVimPlugin {
my-fterm = pkgs.vimUtils.buildVimPluginFrom2Nix {
pname = "fterm";
version = "2022-07-22";
src = pkgs.fetchFromGitHub {
@ -116,7 +117,7 @@ let
sha256 = "rR6KDwj58aYfyaSsoUy75536SdBhk394yspCUl/hzfE=";
};
};
my-nvim-peekup = pkgs.vimUtils.buildVimPlugin {
my-nvim-peekup = pkgs.vimUtils.buildVimPluginFrom2Nix {
pname = "nvim-peekup";
version = "0.1.0";
src = pkgs.fetchFromGitHub {
@ -145,21 +146,12 @@ in
home.sessionVariables.EDITOR = "nvim";
home.shellAliases = {
k = "cd ~/kitaab/vimwiki; vim -c :VimwikiIndex; cd $OLDPWD";
# kitaab zettel
kz = "cd ~/kitaab/vimwiki; vim -c :VimwikiIndex -c :ZettelNew; cd $OLDPWD";
# kitaab recents
kr = "cd /home/anish/kitaab/vimwiki; eza --sort=modified --reverse | fzf --preview 'bat --style=numbers --color=always --terminal-width -1 ./{}';cd $OLDPWD";
# kitaab get by tagged
kt = "cd /home/anish/kitaab/vimwiki; eza *_index.wiki | fzf --preview 'bat --style=numbers --color=always --terminal-width -1 ./{}';cd $OLDPWD";
# List files that have no links in them
ku = "cd /home/anish/kitaab/;vim ./vimwiki/$(python3 poonam/main.py report --titles=false | tail -n +4 | fzf --preview 'bat --style=numbers --color=always --terminal-width -1 ./vimwiki/{}');cd $OLDPWD";
};
# Add %update to the highlight clause for vimwiki files
home.file.".config/nvim/after/syntax/vimwiki.vim".text = ''
" match with %update
syntax match VimwikiPlaceholder /^\s*%update\ze\%(\s.*\)\?$/ nextgroup=VimwikiPlaceholderParam skipwhite
" match with %link
syntax match VimwikiPlaceholder /^\s*%link\ze\%(\s.*\)\?$/ nextgroup=VimwikiPlaceholderParam skipwhite
'';
#environment.systemPackages = with customPlugins; [ tidal ];
@ -269,10 +261,6 @@ in
" Sexp in Conjure (since it's fennel)
let g:sexp_filetypes = "clojure,scheme,lisp,janet,fennel,yuck"
let g:conjure#filetype#fennel = "conjure.client.fennel.stdio"
" we only use fennel with love; no we don't...
let g:conjure#client#fennel#stdio#command = "fennel"
" let g:conjure#extract#tree_sitter#enabled = true
map <localleader>lt :ConjureLogToggle<CR>
let g:rainbow_active = 0
autocmd BufReadPost,BufNewFile c,clj,cljs RainbowParenthesesToggleAll
@ -350,25 +338,23 @@ in
let g:fzf_layout = { 'window': { 'width': 0.8, 'height': 0.8 } }
" lsp commands
nnoremap <leader>vgd :lua vim.lsp.buf.definition()<CR>
nnoremap <leader>vd :lua vim.lsp.buf.definition()<CR>
nnoremap <leader>vi :lua require('telescope.builtin').lsp_implementation()<CR>
nnoremap <leader>vsh :lua vim.lsp.buf.signature_help()<CR>
nnoremap <leader>vrr :lua require('telescope.builtin').lsp_references()<CR>
" nnoremap <leader>vrn :lua vim.lsp.buf.rename()<CR>
" nnoremap <leader>vh :lua vim.lsp.buf.hover()<CR>
" nnoremap <leader>vca :lua vim.lsp.buf.code_action()<CR>
" nnoremap <leader>vsd :lua vim.lsp.util.show_line_diagnostics()<CR>
" nnoremap <leader>vn :lua vim.lsp.diagnostic.goto_next()<CR>
" nnoremap <leader>va :lua require('telescope.builtin').lsp_code_actions(require('telescope.themes').get_cursor())<cr>
nnoremap <leader>vrn :lua vim.lsp.buf.rename()<CR>
nnoremap <leader>vh :lua vim.lsp.buf.hover()<CR>
nnoremap <leader>vca :lua vim.lsp.buf.code_action()<CR>
nnoremap <leader>vsd :lua vim.lsp.util.show_line_diagnostics()<CR>
nnoremap <leader>vn :lua vim.lsp.diagnostic.goto_next()<CR>
nnoremap <leader>va :lua require('telescope.builtin').lsp_code_actions(require('telescope.themes').get_cursor())<cr>
" lspsaga stuff doesn't work
nnoremap <leader>vd :Lspsaga peek_definition<CR>
nnoremap <leader>vrn :Lspsaga rename<CR><CR>
nnoremap <leader>vh :Lspsaga hover_doc<CR>
nnoremap <leader>vca :Lspsaga code_action<CR>
nnoremap <leader>vsd :Lspsaga show_line_diagnostics<CR>
nnoremap <leader>vs :Dasht<Space>
nnoremap <leader>vn :Lspsaga diagnostic_jump_prev<CR>
nnoremap <leader>vo :LSoutlineToggle<CR>
" nnoremap <leader>vd :call Lspsaga peek_definition<CR>
" nnoremap <leader>vrn :call Lspsaga rename<CR><CR>
" nnoremap <leader>vh :call Lspsaga hover_doc<CR>
" nnoremap <leader>vca :call Lspsaga code_action<CR>
" nnoremap <leader>vsd :call Lspsaga show_line_diagnostics<CR>
" nnoremap <leader>vn :call Lspsaga diagnostic_jump_prev<CR>
" dashboard
let g:dashboard_custom_header = [
@ -478,14 +464,6 @@ in
}
)
local orig_util_open_floating_preview = vim.lsp.util.open_floating_preview
function vim.lsp.util.open_floating_preview(contents, syntax, opts, ...)
opts = opts or {}
opts.border = opts.border or 'rounded'
return orig_util_open_floating_preview(contents, syntax, opts, ...)
end
vim.api.nvim_set_keymap('n', '<leader>vt', ':call v:lua.toggle_diagnostics()<CR>', {noremap = true, silent = true})
-- autopairs
@ -516,6 +494,22 @@ in
format = lspkind.cmp_format({
mode = 'symbol_text',
maxwidth = 50,
-- old format
-- format = function(entry, vim_item)
-- -- fancy icons and a name of kind
-- vim_item.kind = require("lspkind").presets.default[vim_item.kind] ..
-- " " .. vim_item.kind
-- -- set a name for each source
-- vim_item.menu = ({
-- buffer = "[Buffer]",
-- nvim_lsp = "[LSP]",
-- look = "[Look]",
-- path = "[Path]",
-- spell = "[Spell]",
-- calc = "[Calc]",
-- })[entry.source.name]
-- return vim_item
-- end
})
},
mapping = {
@ -574,8 +568,6 @@ in
sources = {
null_ls.builtins.diagnostics.shellcheck,
null_ls.builtins.diagnostics.proselint.with({ filetypes = { "vimwiki", "mail", }, }),
null_ls.builtins.diagnostics.commitlint,
null_ls.builtins.diagnostics.jsonlint,
-- null_ls.builtins.code_actions.statix,
-- null_ls.builtins.diagnostics.clj_kondo,
-- null_ls.builtins.formatting.isort,
@ -590,52 +582,24 @@ in
local navic = require("nvim-navic")
-- lspsaga, code_action lightbulb is annoying
local saga = require('lspsaga')
saga.init_lsp_saga({
border_style = "rounded",
code_action_icon = "",
code_action_num_shortcut = true,
code_action_lightbulb = {
enable = false,
enable_in_insert = false,
cache_code_action = true,
sign = true,
update_time = 150,
sign_priority = 20,
virtual_text = false,
},
code_action_keys = {
quit = 'q',
exec = '<CR>',
},
-- show outline
show_outline = {
win_position = 'right',
--set special filetype win that outline window split.like NvimTree neotree
-- defx, db_ui
auto_enter = true,
auto_preview = true,
virt_text = '┃',
jump_key = 'o',
-- auto refresh when change buffer
auto_refresh = true,
},
})
-- local saga = require('lspsaga')
-- saga.init_lsp_saga({
-- code_action_lightbulb = {
-- enable = true,
-- enable_in_insert = true,
-- cache_code_action = true,
-- sign = true,
-- update_time = 150,
-- sign_priority = 4,
-- virtual_text = false,
-- },
-- })
capabilities = require('cmp_nvim_lsp').default_capabilities()
local capabilities = vim.lsp.protocol.make_client_capabilities()
capabilities = require('cmp_nvim_lsp').default_capabilities(capabilities)
-- fennel-ls is bleeding edge
local lspconfig = require('lspconfig')
require("lspconfig.configs")["fennel-ls"] = {
default_config = {
cmd = {"fennel-ls"},
filetypes = {"fennel"},
root_dir = function(dir) return lspconfig.util.find_git_ancestor(dir) end,
settings = {}
}
}
local servers = { 'clojure_lsp', 'terraform_lsp', 'zls', 'pyright', 'rust_analyzer', 'tsserver', 'lua_ls', 'nil_ls', 'gopls'}
local servers = { 'clojure_lsp', 'terraform_lsp', 'zls', 'pyright', 'rust_analyzer', 'tsserver', 'sumneko_lua' }
for _, lsp in ipairs(servers) do
lspconfig[lsp].setup {
on_attach = function(client, bufnr)
@ -645,15 +609,13 @@ in
capabilities = capabilities,
}
end
-- fennel-ls doesn't support gps
lspconfig['fennel-ls'].setup {
-- rnix doesn't support gps
require('lspconfig').rnix.setup {
on_attach = function(client, bufnr)
format.on_attach(client)
end,
capabilities = capabilities,
}
-- deprecated pylsp
-- require('lspconfig').pylsp.setup {
-- on_attach = function(client, bufnr)
@ -683,8 +645,8 @@ in
-- treesitter
require('nvim-treesitter.configs').setup {
-- parser_install_dir = "~/.local/share/nvim/site/parser/",
-- ensure_installed={'nix', 'clojure', 'python', 'fennel', 'lua', 'html', 'css', 'regex', 'supercollider', 'beancount', 'janet'},
parser_install_dir = "~/.local/share/nvim/site/parser/",
ensure_installed={'nix', 'clojure', 'python', 'fennel', 'lua', 'html', 'css', 'regex', 'supercollider', 'beancount'},
highlight = { enabled = true, additional_vim_regex_highting = true, },
textobjects = { enabled = true },
}
@ -797,7 +759,6 @@ in
['<F2>'] = map_expr('s.meter'),
}
}
-- You gotta run :SCNvimGenerateAssets for this first
-- require("luasnip").add_snippets("supercollider", require("scnvim/utils").get_snippets())
-- zen mode
@ -845,26 +806,21 @@ in
}
require('twilight').setup{}
-- hologram
require('hologram').setup{
auto_display = false -- WIP automatic markdown image display, may be prone to breaking
}
EOF
'';
extraPackages = with pkgs // customPlugins; [
# used to compile tree-sitter grammar
tree-sitter
python-with-my-packages
nodejs
clojure-lsp
clojure
nil
rnix-lsp
terraform-lsp
rust-analyzer
clj-kondo
zls
gopls
gcc
nodePackages_latest.pyright
shellcheck
@ -872,8 +828,7 @@ in
statix
nodePackages.typescript
nodePackages.typescript-language-server
luajitPackages.lua-lsp
fennel-ls
sumneko-lua-language-server
];
plugins = with pkgs.vimPlugins // customPlugins; [
@ -890,7 +845,7 @@ in
telescope-nvim
plenary-nvim
nvim-navic
(nvim-treesitter.withPlugins (p: [ p.nix p.clojure p.python p.fennel p.lua p.html p.css p.regex p.supercollider p.beancount p.markdown p.glsl p.yaml p.toml p.dockerfile p.json ]))
nvim-treesitter
nvim-treesitter-context
my-fterm
barbar-nvim
@ -900,8 +855,7 @@ in
nvim-peekup
zen-mode-nvim
twilight-nvim
my-lspsaga
vim-dasht
lspsaga-nvim
# language
vim-nix
@ -916,7 +870,6 @@ in
vimwiki
taskwiki
vim-zettel
hologram-nvim
# lsp stuff
# nvim-lint

9
home/profiles/nvim/package.json
View file

@ -1,9 +0,0 @@
{
"console.log": {
"prefix": "clog",
"body": [
"console.log('$1')"
],
"description": "Log output to console"
}
}

10
home/profiles/ssh/default.nix
View file

@ -1,10 +0,0 @@
{
home.file.".ssh/config".text = ''
Host mossnet.lan
ForwardAgent Yes
Host sealight.xyz
ForwardAgent Yes
Host git.sealight.xyz
ForwardAgent Yes
'';
}

39
home/profiles/sync/kitaab/default.nix
View file

@ -1,39 +0,0 @@
{ pkgs, ... }:
let
name = "kitaab-sync";
# Note this will fail if index.wiki is open in vim while this runs
mkStartScript = name: pkgs.writeShellScript "${name}.sh" ''
# set -euo pipefail # Sometimes vimwiki is open and that causes `vimwiki tags rebuild` to fail, we still want to push to git in those cases
PATH=/run/current-system/sw/bin:/etc/profiles/per-user/anish/bin:$PATH
cd /home/anish/kitaab/vimwiki
vimwiki tags rebuild
cd ..
pushd kalpana/
${pkgs.luaPackages.fennel}/bin/fennel main.fnl build
popd
pushd vimwiki/
git add -A .
popd
git diff-index --quiet HEAD || git commit -m 'syncing kitaab' # if nothing, don't exit 1
git push
exit 0
'';
in
{
systemd.user.services.kitaab-sync = {
Service = {
ExecStart = "${mkStartScript name}";
Path = [ pkgs.luaPackages.fennel ];
};
};
systemd.user.timers.kitaab-sync = {
Install = {
WantedBy = [ "timers.target" ];
PartOf = [ "kitaab-sync.service" ];
};
Timer = {
OnCalendar = [ "hourly" ];
};
};
}

3
home/profiles/task/bin/set-backlog.sh
View file

@ -1,3 +0,0 @@
#!/usr/bin/env bash
task rc.bulk=0 rc.confirmation=off rc.dependency.confirmation=off rc.recurrence.confirmation=off "$@" modify -idea +backlog

3
home/profiles/task/bin/set-focus.sh
View file

@ -1,3 +0,0 @@
#!/usr/bin/env bash
task rc.bulk=0 rc.confirmation=off rc.dependency.confirmation=off rc.recurrence.confirmation=off "$@" modify -idea -backlog

3
home/profiles/task/bin/set-idea.sh
View file

@ -1,3 +0,0 @@
#!/usr/bin/env bash
task rc.bulk=0 rc.confirmation=off rc.dependency.confirmation=off rc.recurrence.confirmation=off "$@" modify +idea -backlog

6
home/profiles/task/bin/task-note.py
View file

@ -34,16 +34,16 @@ def write_note(task_id: int):
if not os.path.exists(notes_file):
logging.info("Adding description to empty notes file")
task_description = os.popen(f"task _get {task_id}.description").read()
task_project = os.popen(f"task _get {task_id}.project").read().strip("\n").replace(".", ":")
task_project = os.popen(f"task _get {task_id}.project").read().strip("\n")
task_tags = os.popen(f"task _get {task_id}.tags").read().split(",")
if len(task_tags):
task_tags = ":".join(task_tags).strip("\n") + ":"
time = datetime.datetime.now().strftime("%y-%m-%d %H:%M")
with open(notes_file, "w") as f:
f.write(f"%title {task_description}")
f.write(f"%title: {task_description}")
f.write(f":task:{task_project}:{task_tags if len(task_tags) else ''}\n")
f.write(f"%date {time}\n\n")
f.write(f"%date: {time}\n\n")
f.flush()
os.execlp(EDITOR, EDITOR, notes_file)

29
home/profiles/task/ca.cert
View file

@ -1,29 +0,0 @@
-----BEGIN CERTIFICATE-----
MIIE/zCCAuegAwIBAgIUTLEuHYBh/sST/IrIhs+pWjDjW3UwDQYJKoZIhvcNAQEM
BQAwFjEUMBIGA1UEAxMLMTkyLjE2OC4xLjYwIBcNMjEwMjEzMDUzODUxWhgPOTk5
OTEyMzEyMzU5NTlaMBYxFDASBgNVBAMTCzE5Mi4xNjguMS42MIICIjANBgkqhkiG
9w0BAQEFAAOCAg8AMIICCgKCAgEA8ZyNGBoudva5KAe1F281Fe3u91whLPB7SWv4
zvN6n81NaMtl+rkfcO5GrYSbtemeQUz04N9dUIRABPyHGO+y0gQn/1p1KMdFzhH1
wDR45h/Eo7+U+2Y/qjyvdjNU9aPe5yymuqSm0cTdFbRkXBoZDSDrwA0U078oYCBo
yDxubKK7H7jWlSVyaBmsWDA72qdZhcOGKy6YoIEiT18V/57wTXBacBZvs3ORbOR6
SMPjq0Pr32+kDriRbb9lQ9TAAGLE51hM8IBMnAZVvgS5GQ1y8elH4WJc7caom5B3
l1MVQKEtgxU+QA4ZqGr9y7H4ey4Xf0V9pvrnsUTu1zCz+P4wd8jS6toxCnn8A8Tq
c3ytA7t3o7BntLSWeQV5LKEiXqF3n3njqXk5Z0ZxDkI+FkhbnOytwGvUEpanTS1d
z3EyZA8h1huoDdTmL1hVrg9pIaFJG5S9GuwcJiFPFo0QN6lcbhJmKrCOzPKb8Kwn
zhymN7vtskSeqPZnQX+/tGupMzeITwcudoBg7zRUNKikIsTwFze+QV+puGFCjH+B
BIe0NQ+rzpWOyI7FDYIMb5q+/PJKTkH2Bu5qYhgebzdCxKcJGBNoWsgzvl+tofQw
XchzIqR35xbkmvLeuIIABd8BKaowrAUGrRxtp7IZqxcR3XxH1RIimkHzeRHTphU2
oycB3eMCAwEAAaNDMEEwDwYDVR0TAQH/BAUwAwEB/zAPBgNVHQ8BAf8EBQMDBwQA
MB0GA1UdDgQWBBQBl2OoCoAweUqsfVQNmL9H3jtl2DANBgkqhkiG9w0BAQwFAAOC
AgEAypV1zutIu7an9tansll20LH2WMAHqi5JrALPBCO9yTqnCS3xZg8VZott/qxm
/SsdlhKtekpvljiQhKqB4wROTf26GjxB9iAzdfxAZEcpYWkyXQ6qzDpjIHLLB3X2
31KHbMc63GOI4wmpGY532tt3qDb+VhgfK25GyvUvvw5qvFsYeGHdSD/HIEJHKlOK
8esaF2/r+wuOWABbbmSBaCtR8H8T4Z/B5l6PoVft9uu8IQbtuhiDn08mZHat8tUq
nxm3O1JsV4ZNtvqh5st1Qn32f7buM6AFMhMy9bcXwR33TJBuv994zRjJQYk+FKzE
UzrWl9mlglWV34P0+xMxpDFEgQvkJAFmdhcVsZlDwILWzEa/ZrS2EQGsEuzHbfFo
oVQuXjzQkX504kAypwQBwbqPfwwYEev7EPVOj32/ke1TzBLaqqJ5AMABShOUJD3L
pNOWMD3B23lRDll2f/Tkhqq4qriqWmtn7urC5ga6AlnAUueiORHTTcA9XBuAz68q
dVfU3cIwwnGhDAYUB27yeb0mhPGnTz2Xr4tn8TLrL7c0tXZPjDCttr6hUnB+X/Yx
tBxT1fJMZR7lzRMvnLJJQKC5rVKE4AAy+FJb3JvhQw01CF4odCmgWT3y+MG4RxnN
sqTWkKoE6bRT9rnRAG8EntRycibGKH0b1PhpY8ngOgMbfCw=
-----END CERTIFICATE-----

12
home/profiles/task/default.nix
View file

@ -1,19 +1,9 @@
{ pkgs, config, lib, ... }:
{
# If you're setting up taskwarrior again, there's a task-setup.sh script in seafile
home.file = {
# Because the below is inconsistent, I turn it off once I have a copy in place.
".taskrc".enable = true;
# WARN ugly hack
# taskwarrior needs write access to this file for centexts
# this way, we get a copy of the file, and we make sure it's writable
".taskrc".source = ./taskrc;
# ".taskrc".executable = true;
# ".taskrc".onChange = "cp ~/.taskrc ~/.taskrc2;rm ~/.taskrc;mv ~/.taskrc2 ~/.taskrc;chmod +w ~/.taskrc";
".task/keys/ca.cert".source = ./ca.cert;
".task/keys/public.cert".source = ./public.cert;
".local/bin/task-note".source = ./bin/task-note.py;
".local/bin/set-idea".source = ./bin/set-idea.sh;
};
}

31
home/profiles/task/public.cert
View file

@ -1,31 +0,0 @@
-----BEGIN CERTIFICATE-----
MIIFRDCCAyygAwIBAgIUCsfV17Ag4utaNHY9sv6x7g/Z3bgwDQYJKoZIhvcNAQEM
BQAwFjEUMBIGA1UEAxMLMTkyLjE2OC4xLjYwIBcNMjEwMjEzMDUzODU0WhgPOTk5
OTEyMzEyMzU5NTlaMCgxFDASBgNVBAMTCzE5Mi4xNjguMS42MRAwDgYDVQQKEwdt
b3NzbmV0MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA23j6Xo+BlPpM
APbncIztaYOfL02lvCOhbx5sxPk6TH5dIxzkBAc3T9X6uY+hTY36QT+SjN5z0EBi
UghxwMM8r2G4ip3XLEFgyFDuDzVgRRuGBbSGtOEIqt49lvmBEWKaxDdYftdlDpKq
qV8NlQJJnBJ9cNZlWzlheRALHMvCUsfnX60piWbQjYrq6j+lF9VjUKUClD92/jhS
LaeaQ6vMlCabYNOf+vq8J3L2oRwHkLMPHBa/a5vNT3bL8Q/Sjuegi+zD68k/fobt
Y7gYL/qyhrFfIvGyN0Jf92DTKdj+1ma3kIaG+REeAx5W8NtRdfnSlS+DA5O0mp0P
oMZICs0Xbq474XYkhBoz7smWA4DLT86on7qcCo24CvII9YU0VDYHNtnDi8CaStea
dvGFDiQS5X3Awwsgt5OWJSgBx+NL9piiZq9Eu5E3CGpoYNiTCANrRV21qmyf090h
md01QUU/f1IMa+wBgryTW94OUhSMmknB9roFAmQaD9Xnj6ecGJkq2ZiytpJ37QiV
8h2ZM9K1PUD4/QulCG/U4IG1II7ef1IUyEFpj6BB7CGCHq+qJ7QKT6Kc/quEewHB
eUjG+FvSmCCgfVf/hqYvul7ybbiqMgCSTSziKF7tN8DuFfIZo9EGdckKXxBgQ7ua
BRVnSZw2vh8nJ8jtGkrw/grKwHL/yA0CAwEAAaN2MHQwDAYDVR0TAQH/BAIwADAT
BgNVHSUEDDAKBggrBgEFBQcDAjAPBgNVHQ8BAf8EBQMDB6AAMB0GA1UdDgQWBBQi
MnF9Np64W1zshqQxe8Cgvm8hFDAfBgNVHSMEGDAWgBQBl2OoCoAweUqsfVQNmL9H
3jtl2DANBgkqhkiG9w0BAQwFAAOCAgEAsNqR/SziOtCRS+n7FGxJ+3FpfACqV4Yl
MDTbpRe0qUcbMDetWZALdPS5gNW/4rj2cpacd3eQI6qRLtUW/l8QGqZl8OjslA2X
/N+9Alza8D+cv6Almx1TclcYJF/Z0NneJ4DgdFXJAPK3zf5eD73N/7EohNWy70Bj
J/4cmYL3T1Pq/FhN/9DV9HoSaRxy9naRjZ3dZXC4CgFRExXw+sEHLDzOHrLDz2xN
4qOjYUH3I1rGWXsSGRFztgNTnA02hPxG1VHzmTvwPjoBxn2/QGTMuXnk8xQGGtdy
G8oav2RLBqvh0AD4fqd2fnMezJiRipXzYmWb1bySe48HRtHJrZ/aQQrUlPdNQwAe
EeixS97JEdBqtag41VhRBFxF9nML8ozA6cgj+Jm2M6OGU+M3tVhioEiuKPm6jXgl
3v8AA2CQrSJjhkTzinxE4FXa9O8INwziHSCE3GNIZaDCMYj7R8tTVcLaQWzUtdj/
i+0fI61n3ZOabvhLXttsdrtqcfNbrxCBVezoweg2RrVFcJc2GojCwJWt6a0cO+69
ggHZgpAwXsMmyMhhCbBXhnxBrsuGbN7f3YN2ty2veeFtp8uDvjCqmgJ5AG32w5E4
Ck9Rup6lwgq3YTQ4pTxl2y26HinobPrMzsZiWkZhN7elnVZL00kSF2Qn6x6xuAap
Z5oPkwZtYnM=
-----END CERTIFICATE-----

42
home/profiles/task/taskrc
View file

@ -15,7 +15,7 @@ data.location=~/.task
taskd.server=task.mossnet.lan:53589
#taskd.server=10.0.69.4:53589
taskd.ca=~/.task/keys/ca.cert
taskd.key=/run/agenix/taskwarrior-private
taskd.key=~/.task/keys/private.key
taskd.certificate=~/.task/keys/public.cert
taskd.trust=ignore hostname
taskd.credentials=mossnet\/anish\/1647259c-e340-405c-a38b-11ac18e34688
@ -29,7 +29,7 @@ taskd.credentials=mossnet\/anish\/1647259c-e340-405c-a38b-11ac18e34688
#include /nix/store/nv662d85k32kkpqidrj64qy1lnihac4c-taskwarrior-2.5.3/share/doc/task/rc/dark-green-256.theme
#include /nix/store/nv662d85k32kkpqidrj64qy1lnihac4c-taskwarrior-2.5.3/share/doc/task/rc/dark-blue-256.theme
# TODO this needs to be not a hardlink but a nix link
# include /nix/store/64nvv0ac2dr8rdz2414f53x97j3msiz0-taskwarrior-2.6.2/share/doc/task/rc/dark-violets-256.theme
include /nix/store/64nvv0ac2dr8rdz2414f53x97j3msiz0-taskwarrior-2.6.2/share/doc/task/rc/dark-violets-256.theme
#include /nix/store/nv662d85k32kkpqidrj64qy1lnihac4c-taskwarrior-2.5.3/share/doc/task/rc/dark-yellow-green.theme
#include /nix/store/nv662d85k32kkpqidrj64qy1lnihac4c-taskwarrior-2.5.3/share/doc/task/rc/dark-gray-256.theme
#include /nix/store/nv662d85k32kkpqidrj64qy1lnihac4c-taskwarrior-2.5.3/share/doc/task/rc/dark-gray-blue-256.theme
@ -42,11 +42,12 @@ news.version=2.6.0
## Contexts
context.poor.read=-purchase
context.dev.read=+dev or +ops -work
context.home.read=-work
context.work.read=+work
context.work.write=+work
context.bucket.read=+idea
context.dev.read=+dev
context.ops.read=+ops
context.bucket.read=+in
context.focused=(priority:H or priority:M) -idea -backlog -finances urgency > 5.0
# context.work=+Work -idea -personal
# context.offwork=-Work
## Reports
@ -58,35 +59,17 @@ report.list.labels=ID,P,Project,Tags,R,Sch,Due,Until,Description
report.in.columns=id,project,tags,description
report.in.labels=ID,Proj,Tags,Description
report.in.description=Inbox
report.in.filter=status:pending limit:page (+idea)
# Backlog
report.backlog.columns=id,priority,project,tags,recur.indicator,scheduled.countdown,due,until.remaining,description.count
report.backlog.labels=ID,P,Project,Tags,R,Sch,Due,Until,Description
report.backlog.description=backlog
report.backlog.filter=status:pending limit:page (+backlog)
report.backlog.sort=start-,due+,project+/,urgency-
report.in.filter=status:pending limit:page (+in)
# Unblocked
report.unblocked.labels=ID,Deps,Proj,Tags,Due,Active,Description
report.unblocked.columns=id,depends,project,tags,due,start.active,description
# Next
# It's not a good idea to filter this view, since modify depends on the next view
report.next.filter=(status:pending limit:0) # pro.not:ideas -idea -backlog
report.next.filter=(status:pending -in -backlog pro.not:ideas limit:0)
report.next.labels=ID,Active,Deps,P,Project,Tag,Recur,S,Due,Until,Description
report.next.columns=id,start.age,depends,priority,project,tags,recur,scheduled.countdown,due.relative,until.remaining,description
# Everything, including inbox
report.every.filter=(status:pending limit:0)
report.every.labels=ID,Active,Deps,P,Project,Tag,Recur,S,Due,Until,Description
report.every.columns=id,start.age,depends,priority,project,tags,recur,scheduled.countdown,due.relative,until.remaining,description
report.poms.filter=(status:pending -idea -backlog -BLOCKED)
report.poms.labels=UUID,ID,Project,Tag,Description
report.poms.columns=uuid,id,project,tags,description
report.poms.sort=start+,urgency+
# Urgency
urgency.user.project.wait.coefficient=-10.0
urgency.user.project.craft.coefficient=1.9
@ -95,11 +78,6 @@ urgency.user.tag.think.coefficient=-7.0
urgency.user.tag.purchase.coefficient=-1.2
urgency.user.project.curve.glam.coefficient=-1.3
# UDAs
uda.taskwarrior-tui.shortcuts.1=~/.local/bin/task/set-focus.sh
uda.taskwarrior-tui.shortcuts.2=~/.local/bin/task/set-backlog.sh
uda.taskwarrior-tui.shortcuts.3=~/.local/bin/task/set-idea.sh
# Colors
color.project.chores=blue
color.tag.dev=cyan

19
hosts/box/configuration.nix
View file

@ -11,15 +11,13 @@
./hardware-configuration.nix
];
# No systemd emergency mode (can't reliably be accessed over SSH)
systemd.enableEmergencyMode = false;
# Use the GRUB 2 boot loader.
boot.loader.efi.canTouchEfiVariables = false;
boot.loader.efi.efiSysMountPoint = "/boot/efi";
boot.loader.grub = {
enable = true;
device = "nodev";
version = 2;
efiSupport = true;
enableCryptodisk = true;
efiInstallAsRemovable = true;
@ -30,16 +28,6 @@
"/keyfile1.bin" = /etc/secrets/initrd/keyfile1.bin;
};
# Remote SSH unlock
boot.initrd.network.enable = true;
boot.initrd.network.ssh = {
enable = true;
port = 22;
authorizedKeys = [ "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDM0Zvei46x/yZl/IeBCq6+IYQQ0avulzVyBysF9cPigZMCybWRV7IEU+E3k9t6JrbdbdGfJkcZIWmsWDdKS8W8mBnZpVoT0ffLynu8JQ/TKdGm4Qv6bgUeKNrGsNv0ZPs2CDaGSLj0oJfRF7Ko10tcLP0vW+yujrh+y6TH/vVzJioaV4TGvtCUpn+wEQah9ROwPQLUUofsSWdnRsDJ/gp37zXWs4l5wyjSKtP3O9RZUP7kBekbSqEgSXiTk0oUQSVqIWl9NDiP6onk/gSOjXsR/JPqsSN/XI/c/yj6gyY0f51Ru2D7iBxuMJIJcWV+rU6coIj+ULcQWLzt/7TI8jq5AOOzI/ll4zbL24Eo84Rz+TP9tvMMhDZ0VaMN22AJ8qQEjc5P09tWKsX7Jg39XelyV1jHXncE4yvIE9F4RSCHzWCeKeXakizQNuzSaxTxIExRFYHjNW5bR6+3MTGwVrEIXU+qML+0yFTR86MT+tdY5AreAJQLwbog79O1NupeXJE= anish@curve " ];
hostKeys = [ "/etc/secrets/initrd/ssh_host_ed25519_key" ]; # create this file with `ssh-keygen -t ed25519 -N "" -f /etc/secrets/initrd/ssh_host_ed25519_key`
};
boot.initrd.availableKernelModules = [ "igc" "iwlwifi" ];
boot.initrd.luks.devices = {
"root" = {
#name = "root";
@ -85,13 +73,16 @@
networking.useDHCP = false;
networking.interfaces.wlp3s0.useDHCP = true;
# Set your time zone.
time.timeZone = "Australia/Brisbane";
# Enable the OpenSSH daemon.
services.openssh.enable = true;
networking.firewall.allowedTCPPorts = [ 22 ];
sound.enable = false;
programs.gnupg.agent.enable = true;
programs.gnupg.agent.pinentryPackage = pkgs.pinentry-curses;
programs.gnupg.agent.pinentryFlavor = "curses";
programs.gnupg.agent.enableSSHSupport = true;
# This value determines the NixOS release with which your system is to be

57
hosts/box/default.nix
View file

@ -1,4 +1,5 @@
{ self, pkgs, ... }: {
{ self, pkgs, ... }:
{
imports = [
./configuration.nix
../profiles/core
@ -6,33 +7,31 @@
../profiles/taskd
../profiles/shaarli
../profiles/dns
# ../profiles/monitoring
../profiles/monitoring
../profiles/nfs
../profiles/gonic
# ../profiles/headphones # TODO broken on 23.11, see: https://github.com/rembo10/headphones/issues/3320
../profiles/headphones
../profiles/radicale
# ../profiles/seafile # waiting for https://github.com/NixOS/nixpkgs/pull/249523 to be merged
../profiles/seafile
../profiles/syncthing
../profiles/dhyan
../profiles/calibre
../profiles/wallabag
../profiles/finance
../profiles/sync/website
../profiles/grasp
# ../profiles/archivebox
# ../profiles/woodpecker-agent
# ../profiles/jellyfin
../profiles/ulogger-server
../profiles/photoprism # Replace with immich
../profiles/gpodder
#../profiles/postgres_upgrade_script
];
# For some reason this doesn't work in the profile, but does over here??
# Something weird in the way I'm importing nixpkgs in the profile or something
services.grasp.enable = true;
services.grasp.path = "/home/anish/kitaab/grasp/grasp.wiki";
services.grasp.user = "anish";
# Backups
age.secrets.borg-password.file = "${self}/secrets/borg-password.age";
services.postgresqlBackup = {
enable = true;
databases = [ "wallabag" "photoprism" "ulogger" ];
databases = [ "wallabag" ];
location = "/var/backup/postgresql";
};
mossnet.backup = {
@ -52,40 +51,8 @@
# seafile
};
services.transmission = {
enable = true;
settings = {
rpc.bind-address = "0.0.0.0";
download-dir = "/mnt/two/new-music";
};
};
services.nginx.virtualHosts."transmission.mossnet.lan" = {
enableACME = false;
forceSSL = false;
locations."/" = {
extraConfig = ''
proxy_pass http://localhost:9091/;
proxy_set_header X-Forwarded-Host $host;
'';
};
};
services.nginx.virtualHosts."mast.mossnet.lan" = {
enableACME = false;
forceSSL = false;
locations."/" = {
extraConfig = ''
proxy_pass http://localhost:5731/;
proxy_set_header X-Forwarded-Host $host;
'';
};
};
age.secrets.box-wg.file = "${self}/secrets/box-wg.age";
age.secrets.box-wg.owner = "anish";
age.secrets.borg-key.file = "${self}/secrets/borg-key.age";
mossnet.wg = {
enable = true;
ips = [ "10.0.69.4/24" ];

15
hosts/box/hardware-configuration.nix
View file

@ -30,33 +30,18 @@
{
device = "/dev/disk/by-uuid/0f857c6e-509d-436f-9e78-bc25f1b0d23b";
fsType = "ext4";
options = [
"noatime"
"nodiratime"
"nofail"
];
};
fileSystems."/mnt/two" =
{
device = "/dev/disk/by-uuid/5bc894bf-ed87-4c30-aab4-87e154e0cd08";
fsType = "ext4";
options = [
"noatime"
"nodiratime"
"nofail"
];
};
fileSystems."/mnt/three" =
{
device = "/dev/disk/by-uuid/0be3ded1-9c8b-40aa-94ca-dc2297d5988e";
fsType = "ext4";
options = [
"noatime"
"nodiratime"
"nofail"
];
};
swapDevices =

2
hosts/cube/configuration.nix
View file

@ -8,9 +8,11 @@
];
boot.loader.grub.enable = true;
boot.loader.grub.version = 2;
boot.loader.grub.device = "/dev/vda"; # or "nodev" for efi only
networking.hostName = "cube"; # Define your hostname.
time.timeZone = "Australia/Brisbane";
networking.useDHCP = false;
networking.interfaces.ens3.useDHCP = true;

7
hosts/cube/default.nix
View file

@ -6,11 +6,4 @@
../profiles/server
../profiles/site
];
services.nginx.enable = true;
services.nginx.virtualHosts."coaching.lakhwara.com" = {
forceSSL = true;
enableACME = true;
locations."/" = { root = "/var/lib/coaching"; index = "/index.html"; };
};
}

5
hosts/curve/configuration.nix
View file

@ -1,6 +1,7 @@
{
imports = [ ./hardware-configuration.nix ];
boot.loader.grub.enable = true;
boot.loader.grub.version = 2;
# Define on which hard drive you want to install Grub.
boot.loader.grub.device = "/dev/sda"; # or "nodev" for efi only
@ -27,6 +28,8 @@
networking.hostName = "curve";
#networking.wireless.enable = true; # Enables wireless support via wpa_supplicant.
time.timeZone = "Australia/Brisbane";
# Select internationalisation properties.
i18n.defaultLocale = "en_US.UTF-8";
# console = {
@ -36,5 +39,5 @@
sound.enable = true;
services.libinput.enable = true;
services.xserver.libinput.enable = true;
}

47
hosts/curve/default.nix
View file

@ -1,45 +1,31 @@
{ self, pkgs, ... }: {
{ self, pkgs, ... }:
{
imports = [
./configuration.nix
../users/anish
../profiles/core
../profiles/bluetooth
../profiles/music
../profiles/sync/kitaab
../profiles/sync/website
../profiles/sync/cal
../profiles/wifi
../profiles/desktop
../profiles/mimetypes
../profiles/syncthing
../profiles/mossnet-hosts
# ../profiles/fly-wg
# ../profiles/kuberenetes
# ../profiles/mount-mossnet
];
# temporarily allow ssh access for work, to be able to do deploy new services
services.openssh = {
enable = true;
settings.PasswordAuthentication = false;
settings.PermitRootLogin = "no";
};
# import profiling tools
programs.systemtap.enable = true;
virtualisation.docker.enable = true;
virtualisation.docker.storageDriver = "btrfs";
environment.systemPackages = with pkgs; [ docker-compose ];
# home-manager.users.anish = import ../../home/gui;
# Speed up boot by removing dependency on network
systemd = {
targets.network-online.wantedBy =
pkgs.lib.mkForce [ ]; # Normally ["multi-user.target"]
services.NetworkManager-wait-online.wantedBy =
pkgs.lib.mkForce [ ]; # Normally ["network-online.target"]
targets.network-online.wantedBy = pkgs.lib.mkForce [ ]; # Normally ["multi-user.target"]
services.NetworkManager-wait-online.wantedBy = pkgs.lib.mkForce [ ]; # Normally ["network-online.target"]
};
programs.gnupg.agent.enable = true;
programs.gnupg.agent.pinentryPackage = pkgs.pinentry-gnome3;
programs.gnupg.agent.pinentryFlavor = "gnome3";
fileSystems."/mnt/ftp" = {
device = "192.168.1.240:/home/ftp";
@ -70,15 +56,8 @@
# lazy enable of ports necessary for KDE connect which is installed via cli home profile (for some reason?)
networking.firewall = {
allowedTCPPorts = [ 22 ]; # allow ssh
allowedTCPPortRanges = [{
from = 1714;
to = 1764;
}];
allowedUDPPortRanges = [{
from = 1714;
to = 1764;
}];
allowedTCPPortRanges = [{ from = 1714; to = 1764; }];
allowedUDPPortRanges = [{ from = 1714; to = 1764; }];
};
age.secrets.curve-wg.file = "${self}/secrets/curve-wg.age";
@ -90,11 +69,10 @@
};
age.secrets.borg-password.file = "${self}/secrets/borg-password.age";
age.secrets.borg-key.file = "${self}/secrets/borg-key.age";
mossnet.backup = {
enable = true;
name = "curve";
paths = [ "/home/anish/usr" "/home/anish/.ssh" ];
paths = [ "/home/anish/usr" ];
};
# enable adb
@ -103,8 +81,7 @@
#virtualisation.docker.enable = true;
boot.blacklistedKernelModules = [ "qcserial" ];
# Used for packer Capsul
users.users.anish.extraGroups =
[ "adbusers" "wheel" "plugdev" "libvertd" "docker" ];
users.users.anish.extraGroups = [ "adbusers" "wheel" "plugdev" "libvertd" ];
virtualisation.libvirtd.enable = true;
hardware.keyboard.zsa.enable = true;
services.udev.extraRules = ''

22
hosts/curve/hardware-configuration.nix
View file

@ -5,43 +5,47 @@
{
imports =
[ (modulesPath + "/installer/scan/not-detected.nix")
[
(modulesPath + "/installer/scan/not-detected.nix")
];
boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "usbhid" "usb_storage" "sd_mod" "rtsx_pci_sdmmc" ];
boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "usb_storage" "usbhid" "sd_mod" "rtsx_pci_sdmmc" ];
boot.initrd.kernelModules = [ "dm-snapshot" ];
boot.kernelModules = [ "kvm-intel" ];
boot.extraModulePackages = [ ];
fileSystems."/" =
{ device = "/dev/disk/by-uuid/e1268753-4f18-4e6f-8edb-d4724ad8eb4a";
{
device = "/dev/disk/by-uuid/74ba39ee-35cd-4b87-9ee9-651384fa55bd";
fsType = "btrfs";
options = [ "subvol=root" ];
};
fileSystems."/home" =
{ device = "/dev/disk/by-uuid/e1268753-4f18-4e6f-8edb-d4724ad8eb4a";
{
device = "/dev/disk/by-uuid/74ba39ee-35cd-4b87-9ee9-651384fa55bd";
fsType = "btrfs";
options = [ "subvol=home" ];
};
fileSystems."/boot" =
{ device = "/dev/disk/by-uuid/8244-A184";
{
device = "/dev/disk/by-uuid/87DA-98E7";
fsType = "vfat";
};
swapDevices =
[ { device = "/dev/disk/by-uuid/e220fea6-cf3b-4687-bfe1-9cf6d3ba57f7"; }
];
[{ device = "/dev/disk/by-uuid/c36e3ba9-8eee-4fbf-837c-7e1cfda33f09"; }];
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
# (the default) this is the recommended approach. When using systemd-networkd it's
# still possible to use this option, but it's recommended to use it in conjunction
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
networking.useDHCP = lib.mkDefault true;
# networking.useDHCP = lib.mkDefault true;
# networking.interfaces.enp0s31f6.useDHCP = lib.mkDefault true;
# networking.interfaces.wlp3s0.useDHCP = lib.mkDefault true;
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
powerManagement.cpuFreqGovernor = lib.mkDefault "powersave";
hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
nixpkgs.hostPlatform = "x86_64-linux";
}

337
hosts/development/mirlo/docker-compose.nix
View file

@ -1,337 +0,0 @@
# Auto-generated using compose2nix v0.1.6.
{ pkgs, lib, ... }:
{
# Runtime
virtualisation.podman = {
enable = true;
autoPrune.enable = true;
dockerCompat = true;
defaultNetwork.settings = {
# Required for container networking to be able to use names.
dns_enabled = true;
};
};
virtualisation.oci-containers.backend = "podman";
# Containers
virtualisation.oci-containers.containers."blackbird-api" = {
image = "";
environment = {
API_DOMAIN = "http://localhost:3000";
DATABASE_URL = "postgresql://nomads:nomads@pgsql:5432/nomads?schema=public";
JWT_SECRET = "test1234";
MEDIA_LOCATION = "./data/media/";
MEDIA_LOCATION_DOWNLOAD_CACHE = "/data/media/downloadCache";
MEDIA_LOCATION_INCOMING = "/data/media/incoming";
MINIO_HOST = "minio";
MINIO_PORT = "9000";
MINIO_ROOT_PASSWORD = "password";
MINIO_ROOT_USER = "blackbird";
NODE_ENV = "development";
PORT = "3000";
POSTGRES_LOCAL_MACHINE_PORT = "5434";
POSTGRES_PASSWORD = "nomads";
POSTGRES_USER = "nomads";
REACT_APP_API_DOMAIN = "http://localhost:3000";
REDIS_HOST = "redis";
REDIS_PASSWORD = "password";
REDIS_PORT = "6379";
REFRESH_TOKEN_SECRET = "test1234";
STATIC_MEDIA_HOST = "http://localhost:3000";
STRIPE_KEY = "";
};
volumes = [
"/home/anish/.ssh:/root/.ssh:rw"
"/home/anish/usr/mirlo:/var/www/api:rw"
"/home/anish/usr/mirlo/data/media/downloadCache:/data/media/downloadCache:rw"
"/home/anish/usr/mirlo/data/media/incoming:/data/media/incoming:rw"
];
ports = [
"3000:3000/tcp"
];
cmd = [ "/bin/sh" "-c" "yarn && yarn migrate:deploy && yarn dev:api" ];
dependsOn = [
"blackbird-minio"
"blackbird-pgsql"
"blackbird-redis"
];
log-driver = "journald";
extraOptions = [
"--network-alias=api"
"--network=mirlo-api-network"
"--network=mirlo-redis-network"
];
};
systemd.services."podman-blackbird-api" = {
serviceConfig = {
Restart = lib.mkOverride 500 "always";
};
after = [
"podman-network-mirlo-api-network.service"
"podman-network-mirlo-redis-network.service"
];
requires = [
"podman-network-mirlo-api-network.service"
"podman-network-mirlo-redis-network.service"
];
partOf = [
"podman-compose-mirlo-root.target"
];
unitConfig.UpheldBy = [
"podman-blackbird-minio.service"
"podman-blackbird-pgsql.service"
"podman-blackbird-redis.service"
];
wantedBy = [
"podman-compose-mirlo-root.target"
];
};
virtualisation.oci-containers.containers."blackbird-background" = {
image = "";
environment = {
API_DOMAIN = "http://localhost:3000";
DATABASE_URL = "postgresql://nomads:nomads@pgsql:5432/nomads?schema=public";
JWT_SECRET = "test1234";
MEDIA_LOCATION = "./data/media/";
MEDIA_LOCATION_DOWNLOAD_CACHE = "/data/media/downloadCache";
MEDIA_LOCATION_INCOMING = "/data/media/incoming";
MINIO_HOST = "minio";
MINIO_PORT = "9000";
MINIO_ROOT_PASSWORD = "password";
MINIO_ROOT_USER = "blackbird";
NODE_ENV = "development";
PORT = "3000";
POSTGRES_LOCAL_MACHINE_PORT = "5434";
POSTGRES_PASSWORD = "nomads";
POSTGRES_USER = "nomads";
REACT_APP_API_DOMAIN = "http://localhost:3000";
REDIS_HOST = "redis";
REDIS_PASSWORD = "password";
REDIS_PORT = "6379";
REFRESH_TOKEN_SECRET = "test1234";
STATIC_MEDIA_HOST = "http://localhost:3000";
STRIPE_KEY = "";
};
volumes = [
"/home/anish/.ssh:/root/.ssh:rw"
"/home/anish/usr/mirlo:/var/www/api:rw"
"/home/anish/usr/mirlo/data/media/processing:/data/media/processing:rw"
];
dependsOn = [
"blackbird-api"
"blackbird-minio"
"blackbird-pgsql"
"blackbird-redis"
];
log-driver = "journald";
extraOptions = [
"--network-alias=background"
"--network=mirlo-api-network"
"--network=mirlo-redis-network"
];
};
systemd.services."podman-blackbird-background" = {
serviceConfig = {
Restart = lib.mkOverride 500 "always";
};
after = [
"podman-network-mirlo-api-network.service"
"podman-network-mirlo-redis-network.service"
];
requires = [
"podman-network-mirlo-api-network.service"
"podman-network-mirlo-redis-network.service"
];
partOf = [
"podman-compose-mirlo-root.target"
];
unitConfig.UpheldBy = [
"podman-blackbird-api.service"
"podman-blackbird-minio.service"
"podman-blackbird-pgsql.service"
"podman-blackbird-redis.service"
];
wantedBy = [
"podman-compose-mirlo-root.target"
];
};
virtualisation.oci-containers.containers."blackbird-minio" = {
image = "minio/minio";
environment = {
API_DOMAIN = "http://localhost:3000";
DATABASE_URL = "postgresql://nomads:nomads@pgsql:5432/nomads?schema=public";
JWT_SECRET = "test1234";
MEDIA_LOCATION = "./data/media/";
MEDIA_LOCATION_DOWNLOAD_CACHE = "/data/media/downloadCache";
MEDIA_LOCATION_INCOMING = "/data/media/incoming";
MINIO_HOST = "minio";
MINIO_PORT = "9000";
MINIO_ROOT_PASSWORD = "password";
MINIO_ROOT_USER = "blackbird";
PORT = "3000";
POSTGRES_LOCAL_MACHINE_PORT = "5434";
POSTGRES_PASSWORD = "nomads";
POSTGRES_USER = "nomads";
REACT_APP_API_DOMAIN = "http://localhost:3000";
REDIS_HOST = "redis";
REDIS_PASSWORD = "password";
REDIS_PORT = "6379";
REFRESH_TOKEN_SECRET = "test1234";
STATIC_MEDIA_HOST = "http://localhost:3000";
STRIPE_KEY = "";
};
volumes = [
"/home/anish/usr/mirlo/data/minio_storage:/data:rw"
];
ports = [
"9000:9000/tcp"
"9001:9001/tcp"
];
cmd = [ "server" "--console-address" ":9001" "/data" ];
log-driver = "journald";
extraOptions = [
"--network-alias=minio"
"--network=mirlo-api-network:alias=minio"
];
};
systemd.services."podman-blackbird-minio" = {
serviceConfig = {
Restart = lib.mkOverride 500 "no";
};
after = [
"podman-network-mirlo-api-network.service"
];
requires = [
"podman-network-mirlo-api-network.service"
];
partOf = [
"podman-compose-mirlo-root.target"
];
wantedBy = [
"podman-compose-mirlo-root.target"
];
};
virtualisation.oci-containers.containers."blackbird-pgsql" = {
image = "postgres:14-alpine";
environment = {
API_DOMAIN = "http://localhost:3000";
DATABASE_URL = "postgresql://nomads:nomads@pgsql:5432/nomads?schema=public";
JWT_SECRET = "test1234";
MEDIA_LOCATION = "./data/media/";
MEDIA_LOCATION_DOWNLOAD_CACHE = "/data/media/downloadCache";
MEDIA_LOCATION_INCOMING = "/data/media/incoming";
MINIO_HOST = "minio";
MINIO_PORT = "9000";
MINIO_ROOT_PASSWORD = "password";
MINIO_ROOT_USER = "blackbird";
PORT = "3000";
POSTGRES_LOCAL_MACHINE_PORT = "5434";
POSTGRES_PASSWORD = "nomads";
POSTGRES_USER = "nomads";
REACT_APP_API_DOMAIN = "http://localhost:3000";
REDIS_HOST = "redis";
REDIS_PASSWORD = "password";
REDIS_PORT = "6379";
REFRESH_TOKEN_SECRET = "test1234";
STATIC_MEDIA_HOST = "http://localhost:3000";
STRIPE_KEY = "";
};
volumes = [
"/home/anish/usr/mirlo/data/pgsql:/var/lib/postgresql/data:rw"
"/home/anish/usr/mirlo/data/pgsql_backups:/backups:rw"
];
ports = [
"5432:5432/tcp"
];
log-driver = "journald";
extraOptions = [
"--network-alias=pgsql"
"--network=mirlo-api-network:alias=pgsql"
];
};
systemd.services."podman-blackbird-pgsql" = {
serviceConfig = {
Restart = lib.mkOverride 500 "no";
};
after = [
"podman-network-mirlo-api-network.service"
];
requires = [
"podman-network-mirlo-api-network.service"
];
partOf = [
"podman-compose-mirlo-root.target"
];
wantedBy = [
"podman-compose-mirlo-root.target"
];
};
virtualisation.oci-containers.containers."blackbird-redis" = {
image = "redis";
ports = [
"6379:6379/tcp"
];
cmd = [ "redis-server" "--appendonly" "yes" "--requirepass " ];
log-driver = "journald";
extraOptions = [
"--network-alias=redis"
"--network=mirlo-redis-network"
];
};
systemd.services."podman-blackbird-redis" = {
serviceConfig = {
Restart = lib.mkOverride 500 "always";
};
after = [
"podman-network-mirlo-redis-network.service"
];
requires = [
"podman-network-mirlo-redis-network.service"
];
partOf = [
"podman-compose-mirlo-root.target"
];
wantedBy = [
"podman-compose-mirlo-root.target"
];
};
# Networks
systemd.services."podman-network-mirlo-api-network" = {
path = [ pkgs.podman ];
serviceConfig = {
Type = "oneshot";
RemainAfterExit = true;
ExecStop = "${pkgs.podman}/bin/podman network rm -f mirlo-api-network";
};
script = ''
podman network inspect mirlo-api-network || podman network create mirlo-api-network --opt isolate=true
'';
partOf = [ "podman-compose-mirlo-root.target" ];
wantedBy = [ "podman-compose-mirlo-root.target" ];
};
systemd.services."podman-network-mirlo-redis-network" = {
path = [ pkgs.podman ];
serviceConfig = {
Type = "oneshot";
RemainAfterExit = true;
ExecStop = "${pkgs.podman}/bin/podman network rm -f mirlo-redis-network";
};
script = ''
podman network inspect mirlo-redis-network || podman network create mirlo-redis-network --opt isolate=true
'';
partOf = [ "podman-compose-mirlo-root.target" ];
wantedBy = [ "podman-compose-mirlo-root.target" ];
};
# Root service
# When started, this will automatically create all resources and start
# the containers. When stopped, this will teardown all resources.
systemd.targets."podman-compose-mirlo-root" = {
unitConfig = {
Description = "Root target generated by compose2nix.";
};
wantedBy = [ "multi-user.target" ];
};
}

3
hosts/helix/configuration.nix
View file

@ -8,6 +8,7 @@
# Use the GRUB 2 boot loader.
boot.loader.grub.enable = true;
boot.loader.grub.version = 2;
boot.loader.grub.device = "/dev/vda"; # or "nodev" for efi only
networking.hostName = "helix"; # Define your hostname.
@ -21,6 +22,8 @@
# Enable the OpenSSH daemon.
services.openssh.enable = true;
services.openssh.passwordAuthentication = false;
services.openssh.permitRootLogin = "no";
sound.enable = false;
# Define a user account. Don't forget to set a password with ‘passwd’.

34
hosts/helix/default.nix
View file

@ -1,19 +1,14 @@
{ self, profiles, suites, pkgs, ... }:
{ self, profiles, suites, ... }:
{
imports = [
./configuration.nix
../profiles/core
../profiles/server
# ../profiles/metrics
../profiles/metrics
../profiles/gitea
# ../profiles/woodpecker-server
../profiles/rss-bridge
# ../profiles/mount-mossnet
../profiles/mount-mossnet
../profiles/freshrss
../profiles/microbin
../profiles/site
# ../profiles/postgres_upgrade_script
];
# Capsul specific
@ -22,31 +17,10 @@
extraGroups = [ "wheel" ];
};
age.secrets.helix-wg.file = "${self}/secrets/helix-wg.age";
age.secrets.helix-wg.owner = "anish";
mossnet.wg = {
enable = true;
ips = [ "10.0.69.5/24" ];
privateKeyFile = "/run/agenix/helix-wg";
privateKeyFile = "/home/anish/wg/wg-priv";
};
services.postgresql.package = pkgs.postgresql_15;
services.postgresqlBackup = {
# TODO needs working wireguard to box
enable = false;
databases = [ "gitea" "freshrss" ]; # "woodpecker"
location = "/mnt/two/postgres";
};
mossnet.backup = {
enable = true;
name = "helix";
paths = [
"/var/lib/gitea"
"/var/lib/freshrss"
# "/var/lib/woodpecker"
"/var/lib/microbin"
];
};
}

51
hosts/helix/disko.nix
View file

@ -1,51 +0,0 @@
{ disks ? [ "/dev/vdb" ], ... }: {
disko.devices = {
disk = {
vdb = {
type = "disk";
device = builtins.elemAt disks 0;
content = {
type = "table";
format = "gpt";
partitions = [
{
name = "ESP";
start = "1MiB";
end = "128MiB";
fs-type = "fat32";
bootable = true;
content = {
type = "filesystem";
format = "vfat";
mountpoint = "/boot";
};
}
{
name = "root";
start = "128MiB";
end = "100%";
content = {
type = "btrfs";
extraArgs = [ "-f" ]; # Override existing partition
subvolumes = {
# Subvolume name is different from mountpoint
"/rootfs" = {
mountpoint = "/";
};
# Mountpoints inferred from subvolume name
"/home" = {
mountOptions = [ "compress=zstd" ];
};
"/nix" = {
mountOptions = [ "compress=zstd" "noatime" ];
};
};
};
}
];
};
};
};
};
}

20
hosts/helix/hardware-configuration.nix
View file

@ -5,27 +5,23 @@
{
imports =
[ (modulesPath + "/profiles/qemu-guest.nix")
[
(modulesPath + "/profiles/qemu-guest.nix")
];
boot.initrd.availableKernelModules = [ "ata_piix" "virtio_pci" "floppy" "sr_mod" "virtio_blk" ];
boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "sr_mod" "virtio_blk" ];
boot.initrd.kernelModules = [ ];
boot.kernelModules = [ ];
boot.extraModulePackages = [ ];
fileSystems."/" =
{ device = "/dev/disk/by-uuid/7c560634-d545-41cc-b375-42ce3037fd73";
fsType = "ext4";
{
device = "/dev/disk/by-uuid/3b8b2c4b-835e-4822-8ac8-0effdc8270d6";
fsType = "btrfs";
};
swapDevices = [ ];
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
# (the default) this is the recommended approach. When using systemd-networkd it's
# still possible to use this option, but it's recommended to use it in conjunction
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
networking.useDHCP = lib.mkDefault true;
# networking.interfaces.ens3.useDHCP = lib.mkDefault true;
hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
nix.settings.max-jobs = lib.mkDefault 1;
nixpkgs.hostPlatform = "x86_64-linux";
}

1
hosts/lituus/configuration.nix
View file

@ -8,6 +8,7 @@
# Use the GRUB 2 boot loader.
boot.loader.grub.enable = true;
boot.loader.grub.version = 2;
boot.loader.grub.device = "/dev/vda"; # or "nodev" for efi only
networking.hostName = "lituus"; # Define your hostname.

4
hosts/lituus/hardware-configuration.nix
View file

@ -16,8 +16,8 @@
fileSystems."/" =
{
device = "/dev/disk/by-uuid/3b8b2c4b-835e-4822-8ac8-0effdc8270d6";
fsType = "btrfs";
device = "/dev/disk/by-uuid/7c560634-d545-41cc-b375-42ce3037fd73";
fsType = "ext4";
};
swapDevices = [ ];

1
hosts/profiles/calibre/default.nix
View file

@ -36,7 +36,6 @@
extraConfig = ''
proxy_pass http://localhost:8083/;
proxy_set_header X-Forwarded-Host $host;
client_max_body_size 50M;
'';
};
};

7
hosts/profiles/core/default.nix
View file

@ -4,8 +4,9 @@ in
{
imports = [ ../../users/anish ];
fonts = {
packages = with pkgs; [ powerline-fonts dejavu_fonts ];
fonts = with pkgs; [ powerline-fonts dejavu_fonts ];
fontconfig.defaultFonts = {
monospace = [ "DejaVu Sans Mono for Powerline" ];
sansSerif = [ "DejaVu Sans" ];
@ -32,7 +33,7 @@ in
};
environment.systemPackages = with pkgs; [
pinentry-gnome3
pinentry_gnome
cached-nix-shell
];
@ -42,8 +43,6 @@ in
openFirewall = lib.mkDefault false;
};
time.timeZone = "Canada/Pacific";
# programs.gnupg.agent.enable = true;
# programs.gnupg.agent.pinentryFlavor = "curses";

67
hosts/profiles/desktop/default.nix
View file

@ -28,10 +28,6 @@ in
age.secrets.mossnet.file = "${self}/secrets/mossnet.age";
age.secrets.mossnet.owner = "anish";
# Taskwarrior private key
age.secrets.taskwarrior-private.file = "${self}/secrets/taskwarrior-private.age";
age.secrets.taskwarrior-private.owner = "anish";
# We don't plug USBs into servers
services.devmon.enable = true;
@ -44,7 +40,6 @@ in
packages = [ pkgs.dconf ];
};
};
programs.dconf.enable = true;
security.pam.services.Default.enableGnomeKeyring = true;
security.pam.services.Login.enableGnomeKeyring = true;
@ -62,23 +57,23 @@ in
};
environment.systemPackages = with pkgs; [
#unstable.sublime-music
unstable.signal-desktop # bridge to sealight?
unstable.sublime-music
unstable.nheko
unstable.signal-desktop
unstable.tuba
unstable.newsflash
unstable.liferea
unstable.gh
unstable.flyctl
unstable.tootle
newsflash
liferea
kooha
light
scrot
ripcord
xfce.orage
feh
sxiv
xkblayout-state
vcv-rack
zathura
calibre
fractal
mpv
zeal
xclip
@ -86,6 +81,7 @@ in
rofi
rofimoji
rofi-calc
eww
obs-studio
lightdm
dunst
@ -97,18 +93,10 @@ in
papirus-icon-theme
calendar-cli
wyrd
# tic-80
ytfzf
yt-dlp
tex
tic-80
];
xdg.portal = {
# Breaks link clicking in nheko
# Portal doesn't seem to find Firefox as an acceptable app to open links?
enable = false;
extraPortals = [ pkgs.xdg-desktop-portal-gtk ];
xdgOpenUsePortal = false;
};
location.provider = "geoclue2";
services = {
@ -119,15 +107,12 @@ in
night = 3700;
};
};
displayManager.defaultSession = "none+bspwm";
xserver = {
enable = true;
# TODO should be xkb.layout
xkb.layout = "us";
# xkb.variant = "dvorak";
layout = "us,dvorak";
desktopManager.wallpaper.mode = "fill";
displayManager = {
# startx.enable = true;
defaultSession = "none+bspwm";
sessionCommands = ''
${pkgs.xorg.xrdb}/bin/xrdb -merge <<EOF
#define blk #1F2430
@ -178,11 +163,10 @@ in
*.color239: #565761
*.color240: #6272a4
*.color241: #b6b6b2
EOF
# hotplug
connect() {
# Turn it on if it was off
xrandr --output HDMI-2 --auto
xrandr --output HDMI-2 --same-as eDP-1
}
@ -191,7 +175,24 @@ in
}
xrandr | grep "HDMI-2 connected" &>>/dev/null && connect || disconnect
EOF
# keyboard on curve is busted
get_keyboard_id() {
xinput list | grep 'AT Translated Set' | cut -f2 | cut -d'=' -f2 | xinput float
}
disconnect_keyboard() {
id=$(get_keyboard_id)
xinput float $id
unset id
}
attach_keyboard() {
id=$(get_keyboard_id)
xinput reattach $id 3
}
disconnect_keyboard
'';
lightdm = {
enable = true;
@ -214,7 +215,7 @@ in
};
};
fonts.packages = with pkgs; [
fonts.fonts = with pkgs; [
fira-code
fira-code-symbols
hermit

87
hosts/profiles/dns/default.nix
View file

@ -1,31 +1,24 @@
{ config, pkgs, lib, ... }:
let
adblockLocalZones = pkgs.stdenv.mkDerivation {
name = "unbound-zones-adblock";
src = (pkgs.fetchFromGitHub {
owner = "StevenBlack";
repo = "hosts";
rev = "3.12.21";
sha256 = "Yzr6PY/zqQE+AHH0J6ioHTsgkikM+dz4aelbGpQJa1s=";
} + "/hosts");
phases = [ "installPhase" ];
installPhase = ''
${pkgs.gawk}/bin/awk '{sub(/\r$/,"")} {sub(/^127\.0\.0\.1/,"0.0.0.0")} BEGIN { OFS = "" } NF == 2 && $1 == "0.0.0.0" { print "local-zone: \"", $2, "\" static"}' $src | tr '[:upper:]' '[:lower:]' | sort -u > $out
'';
};
mossnet = "192.168.1.240"; # The local lan-ip for box
wg-mossnet = "10.0.69.4"; # The wireguard ip for box
mossnet-hosts = [
{
services.dnsmasq.enable = true;
services.dnsmasq.extraConfig = ''
domain-needed
no-resolv
local=/lan/
local=/moss/
cache-size=5000
addn-hosts=/etc/adblock.hosts
''; # TODO find a way to make adblock hosts reproducible and updateable
services.dnsmasq.servers = [ "45.90.30.49" "45.90.28.49" "1.1.1.1" "8.8.8.8" ];
# TODO use this list in mossnet-hosts
networking.hosts = {
"192.168.1.240" = [
"mossnet.lan"
"headphones.mossnet.lan"
"links.mossnet.lan"
"read.mossnet.lan"
"stats.mossnet.lan"
"music.mossnet.lan"
"rss.mossnet.lan"
"tasks.mossnet.lan"
"file.mossnet.lan"
"books.mossnet.lan"
@ -33,57 +26,11 @@ let
"paper.mossnet.lan"
"cal.mossnet.lan"
"archive.mossnet.lan"
"headphones.mossnet.lan"
"transmission.mossnet.lan"
"tracks.mossnet.lan"
"grasp.mossnet.lan"
"photos.mossnet.lan"
"pod.mossnet.lan"
"mast.mossnet.lan"
];
in {
services.unbound = {
enable = true;
settings = {
server = {
include = "${adblockLocalZones}";
prefetch = "yes";
# private-address = "10.0.69.0/8";
# private-address = "192.168.1.0/24";
cache-min-ttl = 0;
serve-expired = "yes";
interface = [ "0.0.0.0" ];
access-control =
[ "127.0.0.0/8 allow" "192.168.1.0/24 allow" "10.0.69.0/24 allow" ];
access-control-view = "10.0.69.0/24 wireguard";
# so-reuseport = "yes";
tls-upstream = "yes";
domain-insecure = "mossnet.lan";
local-zone = ''"mossnet.lan." redirect'';
local-data = ''"mossnet.lan. IN A ${mossnet}"'';
};
forward-zone = [{
name = ".";
forward-addr = [
"45.90.28.0#6939b9.dns.nextdns.io"
"1.1.1.1@853#cloudflare-dns.com"
"192.168.1.226" = [
"df-web.lan"
];
# non-tls
# forward-addr = ["45.90.30.49" "45.90.28.49" "1.1.1.1" "8.8.8.8"]
}];
view = {
name = "wireguard";
local-zone = ''"mossnet.lan." redirect'';
local-data = ''"mossnet.lan. IN A ${wg-mossnet}"'';
};
};
};
# With unbound we're doing wildcard redirects, so we don't need that anymore
# networking.hosts = {
# mossnet = mossnet-hosts;
# };
networking.firewall.allowedTCPPorts = [ 53 ];
networking.firewall.allowedUDPPorts = [ 53 ];
}

5
hosts/profiles/finance/default.nix
View file

@ -2,9 +2,9 @@
{
services.paperless = {
enable = false;
enable = true;
consumptionDirIsPublic = true;
settings.PAPERLESS_AUTO_LOGIN_USERNAME = "admin";
extraConfig.PAPERLESS_AUTO_LOGIN_USERNAME = "admin";
};
environment.systemPackages = [
@ -18,7 +18,6 @@
path = [
pkgs.fava
];
wantedBy = [ "multi-user.target" ];
before = [ "nginx.service" ];
serviceConfig = {
User = "anish";

6
hosts/profiles/fly-wg/default.nix
View file

@ -1,6 +0,0 @@
{ pkgs, config, lib, ... }:
{
networking.wireguard.interfaces.fly-wg = "/home/anish/usr/fly-io-test/fly-wg.conf";
# ssh.startAgent = true;
}

22
hosts/profiles/freshrss/default.nix
View file

@ -17,21 +17,17 @@
services.postgresql = {
enable = true; # Ensure postgresql is enabled
# authentication = ''
# local freshrss all ident map=freshrss-users
# '';
# identMap = # Map the freshrss user to postgresql
# ''
# freshrss-users freshrss freshrss
# freshrss-users postgres freshrss
# '';
package = pkgs.postgresql_11;
authentication = ''
local freshrss all ident map=freshrss-users
'';
identMap = # Map the freshrss user to postgresql
''
freshrss-users freshrss freshrss
'';
ensureDatabases = [ "freshrss" ];
ensureUsers = [{
name = "freshrss";
ensureDBOwnership = true;
}];
# TODO
# initialScript # set password for freshrss user
# initialScript # set password for gitea user
};
services.nginx.virtualHosts."rss.sealight.xyz" = {

68
hosts/profiles/gitea/default.nix
View file

@ -4,78 +4,56 @@
age.secrets.gitea-dbpass.file = "${self}/secrets/gitea-dbpass.age";
age.secrets.gitea-dbpass.owner = "gitea";
services.forgejo = {
services.gitea = {
enable = true;
user = "gitea";
group = "gitea";
stateDir = "/var/lib/gitea";
appName = "Sealight Git Forge";
domain = "git.sealight.xyz";
rootUrl = "https://git.sealight.xyz";
httpPort = 3001;
database = {
type = "postgres";
user = "gitea";
name = "gitea";
passwordFile = "/run/agenix/gitea-dbpass";
};
settings = {
DEFAULT.APP_NAME = "Sealight Git Forge";
server = {
DOMAIN = "git.sealight.xyz";
ROOT_URL = "https://git.sealight.xyz";
HTTP_PORT = 3001;
};
metrics = {
ENABLED = true;
};
repository = {
DEFAULT_BRANCH = "main";
};
service.DISABLE_REGISTRATION = true;
# TODO
"markup.restructuredtext" = {
ENABLED = true;
FILE_EXTENSIONS = ".rst";
RENDER_COMMAND = "timeout 30s pandoc +RTS -RTS -f rst";
RENDER_COMMAND = "pandoc +RTS -M512M -RTS -f rst";
IS_INPUT_FILE = false;
};
# TODO
mailer = {
ENABLED = true;
ENABLED = false;
MAILER_TYPE = "smtp";
FROM = "ops@sealight.xyz";
SMTP_ADDR = "smtp.nullhex.com";
SMTP_PORT = "465";
USER = "ops@sealight.xyz";
PASSWD = "breed deputy fossil glory"; # TODO how do we pass this from agenix?
IS_TLS_ENABLED = "true";
SENDMAIL_PATH = "${pkgs.system-sendmail}/bin/sendmail";
};
};
};
users.users.gitea = {
home = "/var/lib/gitea";
useDefaultShell = true;
group = "gitea";
isSystemUser = true;
};
users.groups.gitea = {};
environment.systemPackages = [ pkgs.pandoc ];
services.postgresql = {
enable = true; # Ensure postgresql is enabled
# authentication = ''
# local gitea all ident map=gitea-users
# '';
# identMap = # Map the gitea user to postgresql
# ''
# gitea-users gitea gitea
# gitea-users postgres gitea
# '';
ensureDatabases = [ "gitea" ];
ensureUsers = [{
name = "gitea";
ensureDBOwnership = true;
}];
authentication = ''
local gitea all ident map=gitea-users
'';
identMap = # Map the gitea user to postgresql
''
gitea-users gitea gitea
'';
# ensureDatabases = [ "gitea" ];
ensureUsers = [
{ name = "gitea"; ensurePermissions."DATABASE gitea" = "ALL PRIVILEGES"; }
];
# TODO
# initialScript
# set password for gitea user
# initialScript # set password for gitea user
};
services.nginx = {
@ -92,4 +70,6 @@
};
};
networking.firewall.allowedTCPPorts = [ 80 443 22 ];
security.acme.defaults.email = "anish+acme@lakhwara.com";
security.acme.acceptTerms = true;
}

17
hosts/profiles/gonic/default.nix
View file

@ -1,21 +1,12 @@
{ config, lib, pkgs, ... }:
{
mossnet.gonic.enable = true;
mossnet.gonic.settings = ''
services.gonic.enable = true;
services.gonic.settings = ''
music-path /mnt/two/music/
podcast-path /data/podcasts
cache-path /data/cache
playlists-path /data/playlists
'';
mossnet.gonic.user = "gonic";
mossnet.gonic.group = "audio";
services.gonic.group = "audio";
services.gonic.user = "headphones";
networking.firewall.allowedTCPPorts = [ 4747 ];
users.users.gonic = {
# uid = config.ids.uids.headphones;
# isSystemUser = true;
group = "audio";
# home = "/var/lib/headphones";
createHome = true;
};
}

4
hosts/profiles/gonic/module-gonic.nix
View file

@ -68,10 +68,14 @@ in
Group = cfg.group;
DevicePolicy = "closed";
NoNewPrivileges = " yes";
PrivateTmp = "yes";
PrivateUsers = "yes";
ProtectControlGroups = "yes";
ProtectKernelModules = "yes";
ProtectKernelTunables = "yes";
RestrictAddressFamilies = "AF_UNIX AF_INET AF_INET6";
RestrictNamespaces = "yes";
RestrictRealtime = "yes";
SystemCallFilter = "~@clock @debug @module @mount @obsolete @privileged @reboot @setuid @swap";
ReadWritePaths = dataFolder;
StateDirectory = baseNameOf dataFolder;

16
hosts/profiles/gpodder/default.nix
View file

@ -1,16 +0,0 @@
{
services.gpodder.enable = true;
networking.firewall.allowedTCPPorts = [ 3005 ];
services.nginx.virtualHosts."pod.mossnet.lan" = {
extraConfig = "client_max_body_size 20M;";
locations."/" = {
extraConfig = ''
proxy_pass http://localhost:3005/;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
'';
};
};
}

12
hosts/profiles/grasp/default.nix
View file

@ -1,12 +1,6 @@
{ ... }:
{
services.grasp = {
enable = true;
path = "/home/anish/kitaab/grasp/notes.wiki";
user = "anish";
};
services.nginx.virtualHosts."grasp.mossnet.lan" = {
locations."/".proxyPass = "http://localhost:12212";
};
services."grasp".enable = true;
services."grasp".path = "/home/anish/kitaab/grasp";
services."grasp".user = "anish";
}

14
hosts/profiles/headphones/default.nix
View file

@ -2,21 +2,11 @@
{
services.headphones = {
enable = true;
host = "0.0.0.0";
host = "192.168.1.240";
port = 8181;
package = "${pkgs.unstable.headphones}";
user = "headphones";
group = "audio";
dataDir = "/data/music";
};
services.nginx.virtualHosts."headphones.mossnet.lan" = {
enableACME = false;
forceSSL = false;
locations."/" = {
extraConfig = ''
proxy_pass http://127.0.0.1:8181/;
'';
};
};
networking.firewall.allowedTCPPorts = [ 8181 ];
}

27
hosts/profiles/jellyfin/default.nix
View file

@ -1,27 +0,0 @@
{ config, lib, pkgs, ... }:
{
# Enable Hardware Acceleration for transcoding
nixpkgs.config.packageOverrides = pkgs: {
vaapiIntel = pkgs.vaapiIntel.override { enableHybridCodec = true; };
};
hardware.opengl = {
enable = true;
extraPackages = with pkgs; [
intel-media-driver
vaapiIntel
vaapiVdpau
libvdpau-va-gl
intel-compute-runtime # OpenCL filter support (hardware tonemapping and subtitle burn-in)
];
};
services.jellyfin = {
enable = true;
user = "jellyfin";
group = "video";
openFirewall = true; # only for defaults
};
networking.firewall.allowedTCPPorts = [ 8181 ];
users.users.jellyfin = {
extraGroups = [ "video" "audio" ];
};
}

20
hosts/profiles/kuberenetes/default.nix
View file

@ -1,20 +0,0 @@
{ pkgs, ... }:
{
# k3s
networking.firewall.allowedTCPPorts = [ 6443 ];
services.k3s.enable = true;
services.k3s.role = "server";
services.k3s.clusterInit = false;
# services.k3s.extraFlags = toString [
# "--kubelet-arg=v=4" # Optionally add additional args to k3s
# ];
environment.systemPackages = [ pkgs.k3s pkgs.kubernetes-helm pkgs.kubectl ];
# minikube on docker
virtualisation.docker.enable = true;
virtualisation.docker.storageDriver = "btrfs";
# or use kvm
# virtualisation.libvirtd.enable = true;
users.users.anish.extraGroups = [ "docker" "libvert" ]; #
}

6
hosts/profiles/matrix/default.nix
View file

@ -3,7 +3,6 @@
{
imports = [
./mautrix-telegram.nix
./mautrix-services.nix
# ./mautrix-discord.nix
# ./mautrix-whatsapp.nix
# ./mautrix-slack.nix
@ -20,7 +19,6 @@
services.matrix-synapse = {
enable = true;
settings = {
max_upload_size = "100M";
server_name = "sealight.xyz";
listeners = [
{
@ -42,15 +40,11 @@
tls = false;
}
];
app_service_config_files = [
# The registration file is automatically generated after starting the appservice for the first time.
# cp /var/lib/matrix-appservice-discord/discord-registration.yaml /var/lib/matrix-synapse/
# chown matrix-synapse:matrix-synapse /var/lib/matrix-synapse/discord-registration.yaml
"/var/lib/matrix-synapse/telegram-registration.yaml"
"/var/lib/matrix-synapse/signal-registration.yaml"
"/var/lib/matrix-as-whatsapp/whatsapp-registration.yaml"
"/var/lib/matrix-as-discord/discord-registration.yaml"
# "/var/lib/matrix-synapse/slack-registration.yaml"
# "/var/lib/matrix-synapse/discord-registration.yaml"
# "/var/lib/matrix-synapse/whatsapp-registration.yaml"

52
hosts/profiles/matrix/mautrix-services.nix
View file

@ -1,52 +0,0 @@
{ config, lib, pkgs, ... }:
{
# Mautrix-signal settings
services.signald.enable = true;
systemd.services.matrix-as-signal = {
requires = [ "signald.service" ];
after = [ "signald.service" ];
unitConfig = {
JoinsNamespaceOf = "signald.service";
};
path = [
pkgs.ffmpeg # voice messages need `ffmpeg`
];
};
services.matrix-appservices = {
addRegistrationFiles = false;
homeserverURL = "https://sealight.xyz/";
homeserverDomain = "sealight.xyz";
services = {
whatsapp = {
port = 29183;
format = "mautrix-go";
package = pkgs.mautrix-whatsapp;
};
discord = {
port = 29188;
format = "mautrix-go";
package = pkgs.my-mautrix-discord;
};
signal = {
port = 29184;
format = "mautrix-python";
package = pkgs.unstable.mautrix-signal;
serviceConfig = {
StateDirectory = [ "matrix-as-signal" "signald" ];
SupplementaryGroups = [ "signald" ];
TimeoutStopSec = 1; # work around the service ignoring SIGTERM, see https://gitlab.com/coffeetables/nix-matrix-appservices/-/issues/12
User = lib.mkForce config.services.signald.user;
Group = lib.mkForce config.services.signald.group;
};
settings.signal = {
socket_path = config.services.signald.socketPath;
outgoing_attachment_dir = "/var/lib/signald/tmp";
};
};
};
};
}

6
hosts/profiles/matrix/mjolnir.nix
View file

@ -1,9 +1,9 @@
{ self, pkgs, lib, config, ... }:
{
# age.secrets.sealight-mod-password.file = "${self}/secrets/sealight-mod-password.age";
# age.secrets.sealight-mod-password.owner = "mjolnir";
age.secrets.sealight-mod-password.file = "${self}/secrets/sealight-mod-password.age";
age.secrets.sealight-mod-password.owner = "mjolnir";
services.mjolnir = {
enable = false;
enable = true;
protectedRooms = [
"https://matrix.to/#/#public:sealight.xyz"
"https://matrix.to/#/#theFeed:sealight.xyz"

21
hosts/profiles/microbin/default.nix
View file

@ -1,21 +0,0 @@
{ config, lib, pkgs, ... }:
{
services.microbin.enable = true;
services.microbin.settings.PUBLIC_PATH = "bin.sealight.xyz";
services.microbin.settings.MICROBIN_PORT = 4949;
networking.firewall.allowedTCPPorts = [ 4949 ];
services.nginx.virtualHosts."bin.sealight.xyz" = {
enableACME = true;
forceSSL = true;
extraConfig = "client_max_body_size 20M;";
locations."/" = {
extraConfig = ''
proxy_pass http://localhost:4949/;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
'';
};
};
}

2
hosts/profiles/mimetypes/default.nix
View file

@ -2,7 +2,7 @@
{
xdg.mime.defaultApplications = {
"application/pdf" = "zathura.desktop";
"application/pdf" = "firefox.desktop";
"image/png" = [
"sxiv.desktop"
"feh.desktop"

39
hosts/profiles/monitoring/default.nix
View file

@ -1,54 +1,25 @@
{ self, config, pkgs, ... }: {
age.secrets.nullhex-smtp.file = "${self}/secrets/nullhex-smtp.age";
age.secrets.nullhex-smtp.owner = "grafana";
# grafana configuration
services.grafana = {
enable = true;
settings = {
smtp = {
enabled = true;
password = "$__file{/run/agenix/nullhex-smtp}";
host = "smtp.nullhex.com";
user = "ops@sealight.xyz";
from_address = "ops@sealight.xyz";
};
server = {
settings.server = {
domain = "stats.mossnet.lan";
http_addr = "127.0.0.1";
http_port = 2342;
root_url = "http://stats.mossnet.lan/";
};
http_addr = "127.0.0.1";
};
# TODO enable
# provision.alerting.rules.path = "${self}/hosts/profiles/monitoring/alert-rules.yaml";
};
# nginx reverse proxy
# services.nginx.recommendedProxySettings = true; # Needed for new grafana versions
services.nginx.virtualHosts.${config.services.grafana.settings.server.domain} = {
services.nginx.recommendedProxySettings = true; # Needed for new grafana versions
services.nginx.virtualHosts.${config.services.grafana.domain} = {
locations."/" = {
proxyPass = "http://127.0.0.1:2342";
proxyPass = "http://127.0.0.1:${toString config.services.grafana.port}";
proxyWebsockets = true;
};
};
services.postgresql = {
ensureUsers = [{
name = "grafana";
# TODO this is deprecated
# Need to translate this to
# systemd.services.postgresql.postStart
# or initialScript
ensurePermissions = {
"ALL TABLES IN SCHEMA public" = "SELECT";
"DATABASE wallabag" = "CONNECT";
"DATABASE ulogger" = "CONNECT";
"DATABASE photoprism" = "CONNECT";
};
}];
};
services.prometheus = {
enable = true;
port = 9001;

10
hosts/profiles/mossnet-hosts/default.nix
View file

@ -4,8 +4,6 @@
192.168.1.240 mossnet.lan
192.168.1.240 links.mossnet.lan
192.168.1.240 read.mossnet.lan
192.168.1.240 headphones.mossnet.lan
192.168.1.240 transmission.mossnet.lan
192.168.1.240 music.mossnet.lan
192.168.1.240 stats.mossnet.lan
192.168.1.240 file.mossnet.lan
@ -13,16 +11,10 @@
192.168.1.240 fin.mossnet.lan
192.168.1.240 paper.mossnet.lan
192.168.1.240 books.mossnet.lan
192.168.1.240 archive.mossnet.lan
192.168.1.240 music.mossnet.lan
192.168.1.240 tracks.mossnet.lan
192.168.1.240 grasp.mossnet.lan
192.168.1.240 photos.mossnet.lan
192.168.1.240 pod.mossnet.lan
192.f.1.240 archive.mossnet.lan
'';
# 10.0.69.4 mossnet.lan
# 10.0.69.4 links.mossnet.lan
# 10.0.69.4 read.mossnet.lan
# 10.0.69.4 stats.mossnet.lan
}

23
hosts/profiles/music/default.nix
View file

@ -16,7 +16,7 @@
orca-c
supercollider
dirt
# sunvox
sunvox
vcv-rack
lmms
bespokesynth
@ -31,22 +31,21 @@
];
hardware.pulseaudio.enable = lib.mkForce false;
security.rtkit.enable = false;
security.rtkit.enable = true;
services.pipewire = {
enable = true;
alsa.enable = true;
alsa.support32Bit = false;
alsa.support32Bit = true;
pulse.enable = true;
jack.enable = true;
# Deprecated as of 23.05
# config = {
# pipewire."context.properties"."default.clock.rate" = "48000";
# pipewire-pulse."stream.properties"."resample.quality" = 15;
# client."stream.properties"."resample.quality" = 15;
# client-rt."stream.properties"."resample.quality" = 15;
# #jack."context.modules" = [];
# };
config = {
pipewire."context.properties"."default.clock.rate" = "48000";
pipewire-pulse."stream.properties"."resample.quality" = 15;
client."stream.properties"."resample.quality" = 15;
client-rt."stream.properties"."resample.quality" = 15;
#jack."context.modules" = [];
};
#media-session.config.bluez-monitor.properties = {
# "bluez5.headset-roles" = [ "hsp_hs" "hsp_ag" ];
# "bluez5.codecs" = [ "aac" "ldac" "aptx_hd" ];
@ -58,6 +57,6 @@
# "${config.hardware.bluetooth.package}/libexec/bluetooth/bluetoothd --noplugin=sap"
#];
boot.kernelModules = [ "snd-seq" "snd-rawmidi" ]; # midi sequence kernel mods
# hardware.pulseaudio.package = pkgs.pulseaudio.override { jackaudioSupport = true; };
hardware.pulseaudio.package = pkgs.pulseaudio.override { jackaudioSupport = true; };
}

46
hosts/profiles/photoprism/default.nix
View file

@ -1,46 +0,0 @@
{ self, pkgs, config, lib, ... }:
{
services.postgresql = {
enable = true;
ensureDatabases = [ "photoprism" ];
ensureUsers = [{
name = "photoprism";
ensureDBOwnership = true;
}];
};
services.photoprism = {
enable = true;
package = pkgs.unstable.photoprism;
port = 5152;
originalsPath = "/var/lib/private/photoprism/originals";
address = "0.0.0.0";
settings = {
PHOTOPRISM_ADMIN_USER = "admin";
PHOTOPRISM_ADMIN_PASSWORD = "photoprism"; # initial password, do change it!
PHOTOPRISM_DEFAULT_LOCALE = "en";
PHOTOPRISM_DATABASE_DRIVER = "postgres";
PHOTOPRISM_DATABASE_NAME = "photoprism";
PHOTOPRISM_DATABASE_SERVER = "/run/postgresql/";
PHOTOPRISM_DATABASE_USER = "photoprism";
PHOTOPRISM_SITE_URL = "http://photos.mossnet.lan/";
PHOTOPRISM_SITE_TITLE = "mossnet photos";
};
};
services.nginx.clientMaxBodySize = "500m";
services.nginx.recommendedProxySettings = true;
services.nginx.virtualHosts."photos.mossnet.lan" = {
enableACME = false;
forceSSL = false;
locations."/" = {
extraConfig = ''
proxy_pass http://localhost:5152/;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_buffering off;
proxy_http_version 1.1;
'';
};
};
}

7
hosts/profiles/postgres_upgrade_script/default.nix
View file

@ -6,12 +6,13 @@
# TODO it's perhaps advisable to stop all services that depend on postgresql
systemctl stop postgresql
# TODO replace `<new version>` with the psqlSchema here
# The schema can be found by running:
# nix eval --raw nixpkgs#postgresql_15.psqlSchema
export NEWDATA="/var/lib/postgresql/15"
# nix-instantiate '<nixpkgs>' --eval -A postgresql_14.psqlSchema
export NEWDATA="/var/lib/postgresql/<new version>"
# TODO specify the postgresql package you'd like to upgrade to
export NEWBIN="${pkgs.postgresql_15}/bin"
export NEWBIN="${pkgs.postgresql_14}/bin"
export OLDDATA="${config.services.postgresql.dataDir}"
export OLDBIN="${config.services.postgresql.package}/bin"

2
hosts/profiles/rss-bridge/default.nix
View file

@ -3,7 +3,7 @@
services.rss-bridge = {
enable = true;
virtualHost = "bridge.sealight.xyz";
config.system.enabled_bridges = [ "Facebook" "Bandcamp" "Twitter" "Telegram" "Instagram" "Reddit" ];
whitelist = [ "Facebook" "Bandcamp" "Twitter" "Telegram" "Instagram" "Reddit" ];
};
services.nginx.virtualHosts."bridge.sealight.xyz".forceSSL = true;

4
hosts/profiles/server/default.nix
View file

@ -2,8 +2,8 @@
{
services.openssh = {
enable = true;
settings.PasswordAuthentication = false;
settings.PermitRootLogin = "no";
passwordAuthentication = false;
permitRootLogin = "no";
};
networking.firewall.allowedTCPPorts = [ 80 443 22 ]; # ssh and website
security.sudo.wheelNeedsPassword = false; # needed for deploy-rs

27
hosts/profiles/sync/kitaab/default.nix Normal file
View file

@ -0,0 +1,27 @@
{ pkgs, ... }:
{
systemd.services.kitaab-sync = {
serviceConfig.Type = "oneshot";
path = [
pkgs.git
pkgs.openssh
pkgs.coreutils
];
script = ''
cd /home/anish/kitaab
git add -A
git diff-index --quiet HEAD || git commit -m 'syncing kitaab' # if nothing, don't exit 1
git push
exit 0
'';
serviceConfig = {
User = "anish";
};
};
systemd.timers.kitaab-sync = {
wantedBy = [ "timers.target" ];
partOf = [ "kitaab-sync.service" ];
timerConfig.OnCalendar = [ "hourly" ];
};
}

0
hosts/profiles/sync/music/get-music.sh Normal file → Executable file
View file

14
hosts/profiles/sync/website/default.nix
View file

@ -6,19 +6,19 @@
path = [
pkgs.git
pkgs.coreutils
pkgs.nixVersions.latest
pkgs.nixUnstable
pkgs.openssh
pkgs.deploy
];
script = ''
cd /home/anish/usr/helm/
git pull
cd /etc/nixos/ # TODO make variable
nix flake lock --update-input poonam
nix flake lock --update-input basant
git add flake.lock
git diff-index --quiet HEAD || git commit -m 'updating website' # if nothing, don't exit 1
git push
deploy .#helix
# TODO
# git add flake.lock
# git commit -m "update website"
# git push
deploy .#cube
exit 0
'';
serviceConfig = {

61
hosts/profiles/ulogger-server/default.nix
View file

@ -1,61 +0,0 @@
{ self, pkgs, config, lib, ... }:
{
services.postgresql = {
enable = true;
ensureDatabases = [ "ulogger" ];
ensureUsers = [{
name = "ulogger";
ensureDBOwnership = true;
}];
};
services.ulogger = {
enable = true;
hostName = "tracks.mossnet.lan";
user = "ulogger";
conf = ''
<?php
/* μlogger
*
* Copyright(C) 2017 Bartek Fabiszewski (www.fabiszewski.net)
*
* This is free software; you can redistribute it and/or modify it under
* the terms of the GNU General Public License as published by
* the Free Software Foundation; either version 3 of the License, or
* (at your option) any later version.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
* General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program; if not, see <http://www.gnu.org/licenses/>.
*/
// This is default configuration file.
// Copy it to config.php and customize
// Database config
// PDO data source name, eg.:
// mysql:host=localhost;port=3307;dbname=ulogger;charset=utf8
// mysql:unix_socket=/path/to/mysql.sock;dbname=ulogger;charset=utf8
// pgsql:host=localhost;port=5432;dbname=ulogger
// sqlite:/path/to/ulogger.db
$dbdsn = "pgsql:host=/run/postgresql/;port=5432;dbname=ulogger";
// Database user name
$dbuser = "ulogger";
// Database user password
$dbpass = "";
// Optional table names prefix, eg. "ulogger_"
$dbprefix = "";
?>
'';
};
}

93
hosts/profiles/wallabag/default.nix
View file

@ -1,37 +1,94 @@
{ self, pkgs, config, lib, ... }:
{
age.secrets.wallabag-password.file = "${self}/secrets/wallabag-password.age";
age.secrets.wallabag-secret.file = "${self}/secrets/wallabag-secret.age";
age.secrets.wallabag-password.owner = "wallabag";
age.secrets.wallabag-secret.owner = "wallabag";
# age.secrets.wallabag-password.file = "${self}/secrets/wallabag-password.age";
# age.secrets.wallabag-secret.file = "${self}/secrets/wallabag-secret.age";
# age.secrets.wallabag-password.owner = "wallabag";
# age.secrets.wallabag-secret.owner = "wallabag";
services.postgresql = {
enable = true;
package = pkgs.postgresql_15;
package = pkgs.postgresql_11;
# Ensure the database, user, and permissions always exist
ensureDatabases = [ "wallabag" ];
ensureUsers = [
{
name = "wallabag";
# ensureDBOwnership = true;
ensurePermissions."DATABASE wallabag" = "ALL PRIVILEGES";
}
];
authentication = ''
local wallabag all peer
'';
};
services.wallabag = {
enable = true;
domain = "read.mossnet.lan";
virtualHost.enable = true;
package = pkgs.my-wallabag;
# Systemd now defaults to /var/lib?
# dataDir = "/var/lib/wallabag";
parameters = {
"env(SECRET_FILE)" = config.age.secrets.wallabag-secret.path;
secret = "%env(file:resolve:SECRET_FILE)%";
};
hostName = "read.mossnet.lan";
package = pkgs.wallabag;
conf = ''
# This file is a "template" of what your parameters.yml file should look like
parameters:
database_driver: pdo_pgsql
database_host: localhost
database_port: ~
database_name: wallabag
database_user: wallabag
database_password: wallabag
# For SQLite, database_path should be "%kernel.project_dir%/data/db/wallabag.sqlite"
database_path: ~
database_table_prefix: wallabag_
database_socket: null
# with PostgreSQL and SQLite, you must set "utf8"
database_charset: utf8
domain_name: http://read.mossnet.lan
server_name: "mossnet wallabag instance"
mailer_transport: smtp
mailer_user: ~
mailer_password: ~
mailer_host: 127.0.0.1
mailer_port: false
mailer_encryption: ~
mailer_auth_mode: ~
locale: en
# A secret key that's used to generate certain security-related tokens
secret: SAFGOECRIlfal89oe6u0(*^dsaaih961
# two factor stuff
twofactor_auth: true
twofactor_sender: no-reply@wallabag.org
# fosuser stuff
fosuser_registration: true
fosuser_confirmation: true
# how long the access token should live in seconds for the API
fos_oauth_server_access_token_lifetime: 3600
# how long the refresh token should life in seconds for the API
fos_oauth_server_refresh_token_lifetime: 1209600
from_email: ops@sealight.xyz
rss_limit: 50
# RabbitMQ processing
rabbitmq_host: localhost
rabbitmq_port: 5672
rabbitmq_user: guest
rabbitmq_password: guest
rabbitmq_prefetch_count: 10
# Redis processing
redis_scheme: tcp
redis_host: localhost
redis_port: 6379
redis_path: null
redis_password: null
# sentry logging
sentry_dsn: ~
'';
};
# networking.firewall.allowedTCPPorts = [ 8080 ];
}

14
hosts/profiles/wireguard-server/default.nix
View file

@ -18,7 +18,7 @@
peers = [
{
# box
publicKey = "OnvVM1UaX0nmdohzSDyl90VKwd4VUpJZ+4oBpkkytwU=";
publicKey = "Ra78mOc110K7URN5uB3m9d78iBKgeRHzT+3HkiFp9BU=";
allowedIPs = [ "10.0.69.4/32" ];
}
{
@ -28,7 +28,7 @@
}
{
# curve
publicKey = "zkC7IzXX16i2ixqnRrPlUq2fD2/4noe84FlZBFaDBEE=";
publicKey = "kzw+51vVYkitGmSMJPAj1jdhzmxhvmSrrIQ4Ar8wzlI=";
allowedIPs = [ "10.0.69.2/32" ];
}
{
@ -36,16 +36,6 @@
publicKey = "gcdq86hhEUlqF2chqYB/F8pALyAMNFvwLycxBoHuoDs=";
allowedIPs = [ "10.0.69.5/32" ];
}
{
# hyperplane
publicKey = "v+EUuM60yZLvBmdCG9GxfFAtSjS1VvbUWcyNb8emjDg=";
allowedIPs = [ "10.0.69.6/32" ];
}
{
# work
publicKey = "/gv66s8DfppCCjaEN/jlc8z95IhEWPgDumykqKEl0QU=";
allowedIPs = [ "10.0.69.7/32" ];
}
];
};
}

30
hosts/profiles/wireguard/default.nix Normal file
View file

@ -0,0 +1,30 @@
{ config, pkgs, lib, ... }:
{
# services.tailscale.enable = true;
networking.firewall.allowedUDPPorts = [ 60990 ];
age.secrets.curve-wg.file = "/etc/nixos/secrets/curve-wg.age";
age.secrets.curve-wg.owner = "anish";
networking.wireguard.interfaces = {
# TODO need some kind of module here to configure curve & box from hosts or something
wg0 = {
ips = [ "10.0.69.2/24" ];
listenPort = 60990; # to match firewall allowedUDPPorts (without this wg uses random port numbers)
privateKeyFile = "/run/agenix/curve-wg";
peers = [
# For a client configuration, one peer entry for the server will suffice.
{
publicKey = "c1J4p63rD3IlszugMZiki7UBV3YmDdqa3DU4UejXzAI=";
allowedIPs = [ "10.0.69.0/24" ];
# Set this to the server IP and port.
endpoint = "69.61.38.225:60990"; # ToDo: route to endpoint not automatically configured https://wiki.archlinux.org/index.php/WireGuard#Loop_routing https://discourse.nixos.org/t/solved-minimal-firewall-setup-for-wireguard-client/7577
# Send keepalives every 25 seconds. Important to keep NAT tables alive.
persistentKeepalive = 25;
}
];
};
};
}

79
hosts/profiles/woodpecker-agent/default.nix
View file

@ -1,60 +1,61 @@
{ pkgs, config, self, ... }:
{
users.users.woodpecker-runner = {
isSystemUser = true;
group = "woodpecker-runner";
home = "/var/lib/woodpecker";
createHome = true;
extraGroups = [ "docker" ];
};
users.groups.woodpecker-runner = { };
# Allow the exec runner to write to build with nix
nix.settings.allowed-users = [ "woodpecker-runner" ];
virtualisation.docker.enable = true;
nix.allowedUsers = [ "woodpecker-runner" ];
age.secrets.woodpecker-agent-secret.owner = "woodpecker-runner";
age.secrets.woodpecker-agent-secret.file = "${self}/secrets/woodpecker-agent-secret.age";
systemd.services.woodpecker-agent = {
systemd.services.woodpecker-runner-exec = {
enable = true;
wantedBy = [ "multi-user.target" ];
### MANUALLY RESTART SERVICE IF CHANGED
restartIfChanged = true;
# confinement.enable = true;
# confinement.packages = [
# pkgs.git
# pkgs.gnutar
# pkgs.bash
# pkgs.nixFlakes
# pkgs.gzip
# ];
# path = [
# pkgs.git
# pkgs.gnutar
# pkgs.bash
# pkgs.nixFlakes
# pkgs.gzip
# ];
confinement.enable = true;
confinement.packages = [
pkgs.git
pkgs.gnutar
pkgs.bash
pkgs.nixFlakes
pkgs.gzip
];
path = [
pkgs.git
pkgs.gnutar
pkgs.bash
pkgs.nixFlakes
pkgs.gzip
];
serviceConfig = {
Type = "simple";
Environment = [
"WOODPECKER_RUNNER_CAPACITY=6"
"WOODPECKER_RUNNER_CAPACITY=2"
"WOODPECKER_RUNNER_NAME=woodpecker-agent"
"WOODPECKER_SERVER=ci.sealight.xyz:9000"
"WOODPECKER_HOSTNAME=mossnet"
"WOODPECKER_BACKEND=docker"
"NIX_REMOTE=daemon"
"PAGER=cat"
# "WOODPECKER_PROTO=https"
# "WOODPECKER_LOG_LEVEL=debug"
];
WorkingDirectory = "/var/lib/woodpecker";
# Runtime directory and mode
RuntimeDirectory = "woodpecker";
RuntimeDirectoryMode = "0755";
# Access write directories
ReadWritePaths = [ "/var/lib/woodpecker" ];
BindPaths = [
"/nix/var/nix/daemon-socket/socket"
"/run/nscd/socket"
# "/var/lib/woodpecker"
];
BindReadOnlyPaths = [
"/etc/passwd:/etc/passwd"
"/etc/group:/etc/group"
"/nix/var/nix/profiles/system/etc/nix:/etc/nix"
"${config.environment.etc."ssl/certs/ca-certificates.crt".source}:/etc/ssl/certs/ca-certificates.crt"
"${config.environment.etc."ssh/ssh_known_hosts".source}:/etc/ssh/ssh_known_hosts"
"${builtins.toFile "ssh_config" ''
Host git.sealight.xyz
ForwardAgent yes
''}:/etc/ssh/ssh_config"
"/etc/machine-id"
"/etc/resolv.conf"
"/nix/"
];
EnvironmentFile = [
/run/agenix/woodpecker-agent-secret
# /run/agenix/woodpecker-agent-secret
];
ExecStart = "${pkgs.woodpecker-agent}/bin/woodpecker-agent";
User = "woodpecker-runner";

35
hosts/profiles/woodpecker-server/default.nix
View file

@ -1,16 +1,9 @@
{ self, pkgs, config, ... }:
{
age.secrets.woodpecker-server-secrets.owner = "woodpecker";
age.secrets.woodpecker-server-secrets.file = "${self}/secrets/woodpecker-server-secrets.age";
age.secrets.woodpecker-agent-secret.owner = "woodpecker";
age.secrets.woodpecker-agent-secret.file = "${self}/secrets/woodpecker-agent-secret.age";
users.users.woodpecker = {
group = "woodpecker";
group = woodpecker;
description = "woodpecker user";
home = "/var/lib/woodpecker";
createHome = true;
isNormalUser = true;
};
users.groups.woodpecker = { };
@ -18,43 +11,41 @@
services.nginx.virtualHosts."ci.sealight.xyz" = {
enableACME = true;
forceSSL = true;
locations."/".proxyPass = "http://localhost:38125";
locations."/".proxyPass = "http://localhost:3030/";
};
networking.firewall.allowedTCPPorts = [ 80 443 22 ];
services.postgresql = {
ensureDatabases = [ "woodpecker" ];
ensureUsers = [{
name = "woodpecker";
ensureDBOwnership = true;
ensurePermissions = {
"DATABASE woodpecker" = "ALL PRIVILEGES";
};
}];
};
systemd.services.woodpecker-server = {
after = [ "postgresql.service" ];
wantedBy = [ "multi-user.target" ];
serviceConfig = {
WorkingDirectory = "/var/lib/woodpecker";
EnvironmentFile = [
/run/agenix/woodpecker-server-secrets
/run/agenix/woodpecker-agent-secret
# GITEA_CLIENT_SECRET etc
# /run/agenix/woodpecker
];
Environment = [
"WOODPECKER_OPEN=false"
"WOODPECKER_HOST=https://ci.sealight.xyz"
"WOODPECKER_SERVER_ADDR=:38125"
"WOODPECKER_OPEN=true"
"WOODPECKER_AGENT_SECRET=${WOODPECKER_AGENT_SECRET}"
"WOODPECKER_GITEA=true"
"WOODPECKER_GITEA_URL=https://git.sealight.xyz"
"WOODPECKER_DATABASE_DATASOURCE=postgres:///woodpecker?host=/run/postgresql"
"WOODPECKER_DATABASE_DRIVER=postgres"
"WOODPECKER_ADMIN=aynish"
"WOODPECKER_SERVER_PORT=:3030"
"WOODPECKER_USER_CREATE=username:aynish,admin:true" # set your admin username
];
ExecStart = "${pkgs.woodpecker-server}/bin/woodpecker-server";
User = "woodpecker";
Group = "woodpecker";
User = woodpecker;
Group = woodpecker;
};
};

14
hosts/users/anish/default.nix
View file

@ -1,23 +1,17 @@
{ pkgs, ... }:
{
programs.zsh.enable = true;
users.users.anish = {
description = "Personal user for Anish";
hashedPassword =
"$y$j9T$y3DPt/dWaPE.gRazQqw1w0$1RMH5sl/Nu8kW3ZMywYCPRniHD/jF5qRh0VKrdJ.bV2";
hashedPassword = "$y$j9T$y3DPt/dWaPE.gRazQqw1w0$1RMH5sl/Nu8kW3ZMywYCPRniHD/jF5qRh0VKrdJ.bV2";
shell = pkgs.zsh;
isNormalUser = true;
extraGroups = [ "wheel" "audio" "networkmanager" "video" ];
extraGroups = [ "wheel" "audio" "networkmanager" ];
openssh.authorizedKeys.keys = [
# Curve
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDM0Zvei46x/yZl/IeBCq6+IYQQ0avulzVyBysF9cPigZMCybWRV7IEU+E3k9t6JrbdbdGfJkcZIWmsWDdKS8W8mBnZpVoT0ffLynu8JQ/TKdGm4Qv6bgUeKNrGsNv0ZPs2CDaGSLj0oJfRF7Ko10tcLP0vW+yujrh+y6TH/vVzJioaV4TGvtCUpn+wEQah9ROwPQLUUofsSWdnRsDJ/gp37zXWs4l5wyjSKtP3O9RZUP7kBekbSqEgSXiTk0oUQSVqIWl9NDiP6onk/gSOjXsR/JPqsSN/XI/c/yj6gyY0f51Ru2D7iBxuMJIJcWV+rU6coIj+ULcQWLzt/7TI8jq5AOOzI/ll4zbL24Eo84Rz+TP9tvMMhDZ0VaMN22AJ8qQEjc5P09tWKsX7Jg39XelyV1jHXncE4yvIE9F4RSCHzWCeKeXakizQNuzSaxTxIExRFYHjNW5bR6+3MTGwVrEIXU+qML+0yFTR86MT+tdY5AreAJQLwbog79O1NupeXJE= anish@curve"
# Box
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDKN8/SH55DBiwVoSnTU8k2Pen+wmovL9QaMyehxGEsJJv/8fzwsswGalD4C/4O51LOvdu4UKkZW5hG02uVSK+58p3UV3pOPyoqsu/aDeIsWsqmTeTzUrBIWOlNzcDKnohLz2oGC5YO+wyTJ9Iteq6aGJDjErsW7sG3h5lXCs551EmJNNGhtBQaaoytMNnWqSdlVjDNCijurH7WUpp40U/RjEp532l4rX6eIIj3jBKEFbhZkFSSjqbj4xM4SyFt+Jmigb1RMjsQjmpfY1vDtM84RcYfpTUte/T5w2dkD5H6kccmWnwKSJpm9wXfx4E7lR9APdUGnau2U1+XxiD3ytGl anish@box"
# Nix-on-droid line
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJOiXBPVvZAp1fY0a0Tupxj0Ml6MoA51lvqt/jAQq249 nix-on-droid@localhost"
# Work
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC/vvh0i6+uAN0GWlK6ZfyTlc/AW54xe2CroUDsDSoGnFKeIUiSsWexobODlVakNhqwCKfsvUh6g+RdA8ZVcamATcYqxysP4X5fRksmAzRm5281O7ZBDHMB2BdcfHSTgiz7JvMRIQYWDlU8Ck6IL4wlN0b2GMUj9t/GeG37us8280rxpRNoIY7M27AJEZ7XNQhctBIVujxctVBgIMYmZiTwziU7ywJv4rNT5OAWvjRXSo1rkxdvx3VESv4y/mp8m7dEupZpIjIFsLs52+UG5LtadulUqtTWg05sCw8LEcmRhflgZSAvjw60RrKFCuWxc8+/Pmaw+zExeBMenqi0NzuTc3S3k2wCKVIZDh/0tlXzIwZ6WRqxDevUtEKfvbEFMXd8akhTfYs0dyszcFRevBxOBPbcKku+FK/HkdPLmEANvxYty3cv+Eipkz3c8JPJPvXNTXrjepXMm0LUKodO3c15hGogCOxUO38kykkyYnn+MxxHparoMfEr2+oHNpQoS5wA1G43ppqjVoRDgnhleu6ixwRkLZzphY3cnOd5jL9Ie5xIGbFWH1qSlQRdHBkHjuf85z7+QK8nFYAhmG1K3Vt3GNtF8LN1tYQkfwBJ/vsroMNzGPoq4PjVbqb80Eq+96cP89XKfU2/xw1g+p2lJDm/zC1WCjXVzf8NRwC7gqPavQ== anishlakhwara@anishs-mbp.lan"
# Line
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDtU2GMYjXj6RGO1+mwM4TDGOo0qrKLTL4Di8+QgDX0p5vUEsnE1PS9wnuqCmSu75U8g0XIAMtvtdYyGk1N+Bx01erAZpT8DLYtIXFCyaiN28PVu5T1D0T+TQ7xgIH1qenXZR2DOQdf6kpvKEfm7+7bWhCo0N/KFMpmReubyzHDQcq/1qQasxTL+YALQFOjwKqsOTBXbHwZ103AEAcQX4ftBFEOfVli4/1aKIK4dNSZYB7J9Htq707YnsEqo9RLAMh0aOTTYgTx9AoSUDeqGuh/AGkcB7NcS7EEtI6d5YUGylwZh/gF6hqE0jl8kn2m5jMKXL3CRohZvjifue8x/GIjpu5WRabUuhBEbrfTQQaC7taHnt5rvYCGzKZx09TexUzhuz2CL480DRoxSG+P+lCNm1dIg/EZrnGEzXCSr36PlOqS5t5gm8tPkzCmZf2wU15A3ZIYUPmnYLqsn4WmIV7rKmdqt2ctWELUXow3PPiZXBucP9P3xpsYEfF1SB2SGNc= u0_a139@localhost"
];
};
}

0
install-encrypted.sh Normal file → Executable file
View file

10
install-yubikey.sh Normal file → Executable file
View file

@ -1,5 +1,3 @@
#!/usr/bin/env bash
rbtohex() {
( od -An -vtx1 | tr -d ' \n' )
}
@ -19,7 +17,7 @@ cc -O3 -I$(nix-build "<nixpkgs>" --no-build-output -A openssl.dev)/include -L$(n
# Yubikey Setup
SLOT=2
# ykpersonalize -"$SLOT" -ochal-resp -ochal-hmac
ykpersonalize -"$SLOT" -ochal-resp -ochal-hmac
SALT_LENGTH=16
salt="$(dd if=/dev/random bs=1 count=$SALT_LENGTH 2>/dev/null | rbtohex)"
k_user=PASSWORDCHANGEMEPLAEASES
@ -66,7 +64,7 @@ mkfs.btrfs -L "$FSROOT" "/dev/partitions/$FSROOT"
#touch /mnt-root/nix-store.squashfs
mount "/dev/partitions/$FSROOT" /mnt
cd /mnt || exit
cd /mnt
btrfs subvolume create root
btrfs subvolume create home
cd
@ -147,7 +145,7 @@ cat > /mnt/etc/nixos/configuration.nix <<'endmsg'
sound.enable = true;
hardware.pulseaudio.enable = true;
services.libinput.enable = true;
services.xserver.libinput.enable = true;
# Hmmm maybe somewhere else?
users.users.anish = {
@ -169,6 +167,6 @@ cat > /mnt/etc/nixos/configuration.nix <<'endmsg'
endmsg
cd /mnt || exit
cd /mnt
nixos-install --root /mnt
passwd

2
modules/nixos/backup.nix
View file

@ -43,7 +43,7 @@ in
mode = "repokey-blake2";
passCommand = "cat /run/agenix/borg-password";
};
environment = { BORG_RSH = "ssh -i /run/agenix/borg-key"; };
environment = { BORG_RSH = "ssh -i /root/borg/borg-key"; }; # YOU NEED TO PUT THIS HERE MANUALLY
compression = "auto,lzma";
startAt = "daily";
extraArgs = "--remote-path=borg1";

3
modules/nixos/default.nix
View file

@ -8,7 +8,4 @@
hesienbridge = import ./heisenbridge.nix;
wireguard = import ./wireguard.nix;
backup = import ./backup.nix;
ulogger-server = import ./ulogger.nix;
gpodder2go = import ./gpodder2go.nix;
# microbin = import ./microbin.nix; # includide in 23.11
}

Some files were not shown because too many files have changed in this diff Show more